From e9c9d3de82eb926ab6d494358c7a1891b171e190 Mon Sep 17 00:00:00 2001 From: frankyj915 Date: Sun, 15 Dec 2024 09:35:03 +0800 Subject: [PATCH] micro_comman/syscall: Update ioctl allow list Signed-off-by: frankyj915 --- hypervisor/src/kvm/mod.rs | 6 ++++++ machine/src/micro_common/syscall.rs | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/hypervisor/src/kvm/mod.rs b/hypervisor/src/kvm/mod.rs index e20f102..b88aeed 100644 --- a/hypervisor/src/kvm/mod.rs +++ b/hypervisor/src/kvm/mod.rs @@ -99,6 +99,12 @@ ioctl_iowr_nr!(KVM_GET_IRQCHIP, KVMIO, 0x62, kvm_irqchip); ioctl_iow_nr!(KVM_IRQ_LINE, KVMIO, 0x61, kvm_irq_level); ioctl_iow_nr!(KVM_SET_MP_STATE, KVMIO, 0x99, kvm_mp_state); ioctl_iow_nr!(KVM_SET_VCPU_EVENTS, KVMIO, 0xa0, kvm_vcpu_events); +#[cfg(target_arch = "x86_64")] +ioctl_iow_nr!(KVM_SET_PIT2, KVMIO, 0xa0, kvm_pit_state2); +#[cfg(target_arch = "x86_64")] +ioctl_iow_nr!(KVM_SET_CLOCK, KVMIO, 0x7b, kvm_clock_data); +#[cfg(target_arch = "x86_64")] +ioctl_ior_nr!(KVM_SET_IRQCHIP, KVMIO, 0x63, kvm_irqchip); #[allow(clippy::upper_case_acronyms)] #[derive(Default)] diff --git a/machine/src/micro_common/syscall.rs b/machine/src/micro_common/syscall.rs index 6ae9a56..ca8327f 100644 --- a/machine/src/micro_common/syscall.rs +++ b/machine/src/micro_common/syscall.rs @@ -160,7 +160,13 @@ fn ioctl_allow_list() -> BpfRule { .add_constraint(SeccompCmpOpt::Eq, 1, KVM_GET_MP_STATE() as u32) .add_constraint(SeccompCmpOpt::Eq, 1, KVM_SET_MP_STATE() as u32) .add_constraint(SeccompCmpOpt::Eq, 1, KVM_SET_VCPU_EVENTS() as u32) - .add_constraint(SeccompCmpOpt::Eq, 1, KVM_GET_VCPU_EVENTS() as u32); + .add_constraint(SeccompCmpOpt::Eq, 1, KVM_GET_VCPU_EVENTS() as u32) + .add_constraint(SeccompCmpOpt::Eq, 1, KVM_SET_USER_MEMORY_REGION); + #[cfg(target_arch = "x86_64")] + let bpf_rule = bpf_rule + .add_constraint(SeccompCmpOpt::Eq, 1, KVM_SET_PIT2() as u32) + .add_constraint(SeccompCmpOpt::Eq, 1, KVM_SET_CLOCK() as u32) + .add_constraint(SeccompCmpOpt::Eq, 1, KVM_SET_IRQCHIP() as u32); arch_ioctl_allow_list(bpf_rule) } -- 2.34.1