From dea1155b1d8ef661149fc95aee03c93007b9ec12 Mon Sep 17 00:00:00 2001
From: Etienne Perot <eperot@google.com>
Date: Wed, 21 Feb 2024 16:35:06 -0800
Subject: [PATCH 1/2] Make KVM `ioctl(2)` seccomp filter use non-negative FD as
 `arg[0]` on ARM.

We have a test that enforces this now, and it fails on ARM due to this.

PiperOrigin-RevId: 609163474
---
 pkg/sentry/platform/kvm/filters_arm64.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkg/sentry/platform/kvm/filters_arm64.go b/pkg/sentry/platform/kvm/filters_arm64.go
index 9ceeda8a4..4d964d88b 100644
--- a/pkg/sentry/platform/kvm/filters_arm64.go
+++ b/pkg/sentry/platform/kvm/filters_arm64.go
@@ -28,7 +28,7 @@ import (
 func (*KVM) archSyscallFilters() seccomp.SyscallRules {
 	return seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
 		unix.SYS_IOCTL: seccomp.PerArg{
-			seccomp.AnyValue{},
+			seccomp.NonNegativeFD{},
 			seccomp.EqualTo(KVM_SET_VCPU_EVENTS),
 		},
 	})

From 6c5e48c7c3cf426309ca509dabc17b8327c9edcc Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@gmail.com>
Date: Wed, 21 Feb 2024 11:51:43 -0800
Subject: [PATCH 2/2] make: fix unit-tests

The comma character should be put into the argument value by variable
substitution.

Update #10045
---
 Makefile | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 8921e1701..e06af2564 100644
--- a/Makefile
+++ b/Makefile
@@ -24,6 +24,7 @@ header = echo --- $(1) >&2
 EMPTY :=
 SPACE := $(EMPTY) $(EMPTY)
 SHELL = /bin/bash
+COMMA := ,
 
 ## usage: make <target>
 ##         or
@@ -216,8 +217,10 @@ nogo-tests:
 
 # For unit tests, we take everything in the root, pkg/... and tools/..., and
 # pull in all directories in runsc except runsc/container.
+#
+# FIXME(gvisor.dev/issue/10045): Need to fix broken tests.
 unit-tests: ## Local package unit tests in pkg/..., tools/.., etc.
-	@$(call test,'--test_tag_filters=-nogo,-requires-kvm' //:all pkg/... tools/... runsc/... vdso/... test/trace/...)
+	@$(call test,--test_tag_filters=-nogo$(COMMA)-requires-kvm -- //:all pkg/... tools/... runsc/... vdso/... test/trace/... -//pkg/metric:metric_test -//pkg/coretag:coretag_test -//runsc/config:config_test -//tools/tracereplay:tracereplay_test -//test/trace:trace_test)
 .PHONY: unit-tests
 
 # See unit-tests: this includes runsc/container.