These functions are trivially safe and by adding them to sys_util, we
can remove some unsafe blocks from crosvm. This CL also replaces the
unsafe call sites with the safe alternatives.
There are no previous usages of gete{g,u}id(2), but they will be needed
in a future change.
TEST=None
BUG=None
Change-Id: Ief8787b298cfaa5b7fd1b83f0eba6660369e687d
Reviewed-on: https://chromium-review.googlesource.com/634268
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
We will almost certainly require different seccomp policy files for
different architectures. Move all the existing secommp policy files
into a common directory grouped by architecture.
This will make it easier to install them via the ebuild later.
BUG=none
TEST=none
Change-Id: I0495789cd4143dc374ee6ebe083dc20ce724edbb
Signed-off-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/630058
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This CL adds VM request capabilities to the control socket. These
requests include the basic exit as well as the essential ioeventfd and
irqfd requests. For virtio wayland, the register/unregister device
memory request was added.
TEST=cargo test
BUG=chromium:738638
Change-Id: I0cbf62d85a299cf454bcf6924a4e1d52d5b7183f
Reviewed-on: https://chromium-review.googlesource.com/602593
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
While vhost_net can provide better performance than a userspace
virtio device, it also requires a kernel module to function. This
also prevents jailing the virtio device, since virtqueue operations
(which necessarily touch guest memory) will be running directly
in the kernel.
Add a userspace virtio net device that can be jailed and works
without vhost support in the kernel.
BUG=chromium:703920
TEST=networking works
Change-Id: I468114b48abd8e30e967ff16329a5dce6a75018f
Signed-off-by: Stephen Barber <smbarber@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/604937
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
We have to guarantee that all the descriptor writes are visible to the
guest before the index update is.
Change-Id: I35f1c8d3f5fc9a6ac54de1eb4be66e1c5ac81fc8
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/611215
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Provide the guest OS with /dev/random.
Change-Id: I1323836392f3f1d59a6be276ce495e0d78ea9669
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/603531
Reviewed-by: Zach Reizner <zachr@chromium.org>
Because there are more than one kind of slice (typical &[T] and
VolatileSlice), the trait IntoIovec is added that any linear memory
region-like type can implement. This helps to reduce the number of
copies needed when dealing with volatile memory.
TEST=cargo test
BUG=chromium:738638
Change-Id: I86bbb693cb7a10ec85bafccf562c078167121c03
Reviewed-on: https://chromium-review.googlesource.com/599042
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
UnixDatagram and UnixStream are both wrappers around unix domain sockets
which are often polled.
TEST=None
BUG=chromium:738638
Change-Id: Ib5572faf1d601b89b9fdd323f654ba04650b7600
Reviewed-on: https://chromium-review.googlesource.com/599041
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The queue's next index, as set by the kernel, will increase
monotonically to the limit of a u16 and then wrap back to zero. In
contrast, Rust will panic when its internal counter reaches the limit.
This change enables the wrapping behavior that we want.
TEST=run a kernel that uses a queue >0xffff times
BUG=None
Change-Id: I24101dfb137a1350fd93d1b378840b72431764ea
Reviewed-on: https://chromium-review.googlesource.com/598502
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Add an option for allowing a writable disk.
Allow specifying multiple disks.
Don't assume the path to the root device, force the user to specify a
correct command line option.
Change-Id: I87dea1152e1f81c0cde45ad47e2c4cf0f187918e
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/569450
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
parse_seccomp_filters in libminijail will unhelpfully abort() if the
path doesn't exist. Check that the policy file exists so that there's
a semi-useful error message.
BUG=none
TEST=crosvm run without seccomp policy in current directory; no abort
Change-Id: Ie1123e8cae3f6a27bbd5a3128161364401e8d4b2
Signed-off-by: Stephen Barber <smbarber@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/585829
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This CL also includes the gcc build time dependency for building the
sock_ctrl_msg.c helper code.
TEST=cargo test
BUG=chromium:738638
Change-Id: I4adc2360b7fab4ed7d557603aa7bad2e738b69b4
Reviewed-on: https://chromium-review.googlesource.com/562574
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Fill the upper for bytes of the disk size configuration. The size is a
64bit value accessed with two 32bit reads.
The guest is permitted to read at any byte offset in the config space.
Allow it to do so, even if it doesn't make much sense.
Change-Id: I5d02620a8751b31784e419ae6a57173a2e212b8f
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/569359
Reviewed-by: Zach Reizner <zachr@chromium.org>
vhost_net is an in-kernel implementation of a virtio_net device. This device
implementation is responsible only for negotiating features and setting up
vhost_net to point to the virtqueues in the guest.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=chromium:738639
TEST=boot with networking enabled and ping host
Change-Id: I9192765b9348528a8a7a7f273e9522c2373d22fb
Reviewed-on: https://chromium-review.googlesource.com/538106
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
According to the Virtio specification, all MMIO register access must be
32-bit wide and aligned. However, this restriction is not true in
general for the config space. This change relaxes the restriction for
accesses to config space.
This change also checks that each queue is valid before activating a
device.
TEST=crosvm run
BUG=None
Change-Id: I10228d99992576837ff505aad56fefbc4d8eff78
Reviewed-on: https://chromium-review.googlesource.com/578314
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Add a method get_host_address for converting a
GuestAddress to a (usize) pointer in crosvm's address
space.
Change-Id: I6dc09e942c95204f4e53218b3250664782c8f8f9
Signed-off-by: Stephen Barber <smbarber@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/575439
Reviewed-by: Zach Reizner <zachr@chromium.org>
Use signalfd to catch SIGCHLD, which will notify the main process when a
device process has died, e.g. it crashed or violated seccomp policy. The
main process will then exit gracefully.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=block a syscall and run with multiprocess; ensure no defunct
processes are hanging around
Change-Id: Ief8a94576ad9eeb032f45ce8491fcfe23a971473
Reviewed-on: https://chromium-review.googlesource.com/557460
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Factor out common ioctl wrappers and macros into their own module.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=cargo test
Change-Id: Ibede8a853f5cc6c6d62565930f312b11024cc5b5
Reviewed-on: https://chromium-review.googlesource.com/566540
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
In preparation for adding a net device, factor out some of the common code
for setting up an mmio device and jailing it.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=cargo test
Change-Id: I94f02e56a2b0938d860322b731d8b17a25357128
Reviewed-on: https://chromium-review.googlesource.com/543910
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
The cpus option is now used.
Change-Id: I64bcc7cf27427f20b093c70eec3b58cd2c55e290
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/569098
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
When syslog is used from another crate, the compiler needs a specific
place to look for the symbols.
Change-Id: I5ba1b7ae0e8f6825aaf2a0d0b6ff31dcab21aa0c
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/569360
Reviewed-by: Zach Reizner <zachr@chromium.org>
Dealing with signals is unpleasant business. SignalFd wraps a kernel
signalfd for a signal, and blocks the default handling for the signal.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=cargo test
Change-Id: I161c992b65b98ffa5c07d546f13efa6b56890df4
Reviewed-on: https://chromium-review.googlesource.com/557459
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
The `clone_process` function was created to safely encapsulate
fork/clone usage for the proxy device. This patch changes proxy device
to do utilize that.
TEST=cargo run -- -u <other crosvm args>...
BUG=None
Change-Id: I2d9f1794be61be31f3aae21037c7df14b7691172
Reviewed-on: https://chromium-review.googlesource.com/518935
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This module is designed as a safe wrapper around clone for use by the
proxy device. It includes safe guards that prevent errors with typical
forking applications in rust.
TEST=cargo test
BUG=None
Change-Id: I09132a4cae61ebdaa97ec3b95d22567c36c5f15d
Reviewed-on: https://chromium-review.googlesource.com/518446
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This CL adds the SharedMemory structure for managing memory attached to
a file descriptor, which can be sent to external processes.
TEST=cargo test
BUG=chromium:738638
Change-Id: I2b6a10e0e7275367ddb578831a73de6956d231bb
Reviewed-on: https://chromium-review.googlesource.com/562509
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Add a new method to GuestMemory that allows running a FnMut over all
regions. This will allow the virtio module to generate a vhost memory
table.
Also make do_in_region public, so that VHOST_NET can find the host
userspace address of vrings (necessary for VHOST ioctls).
BUG=none
TEST=cargo build
Change-Id: I43611dcc56146ed4d160f0e189b9328ca0e6d87d
Reviewed-on: https://chromium-review.googlesource.com/543909
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
A VirtioDevice should expose its type so that the guest can probe it
correctly.
BUG=none
TEST=boot with block device
Change-Id: I6a8cae3afbdc5ae9f6af23eea928c83e67719c12
Reviewed-on: https://chromium-review.googlesource.com/538104
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Run with the new seccomp filter and drop all capabilities. In addition enter a
new user, mount, network, and ipc namespace. Leave the mount namespace empty
after pivot-rooting to an empty directory.
Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/515603
There were a few cases of a write into the serial device that would
panic because the registers were read-only. This change simply ignores
those writes instead of raising a panic.
This is also the first bug that was found by cargo-fuzz! Wohoo!
TEST=None
BUG=None
Change-Id: I8b6805617ac3dcfddd0555c1bb394a7bc1a7cf6d
Reviewed-on: https://chromium-review.googlesource.com/518445
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This program is used to boot a 64-bit kernel elf. It has support for
basic devices that are exposed to the kernel, including a block device.
TEST=cargo test;
cargo run -- -m 512 -c 4 -d rootfs.squashfs -u -p "init=/bin/bash" vmlinux
BUG=chromium:712319
Change-Id: I25a8349a4624d8643fefe2ad70e517fe03b16b8c
Reviewed-on: https://chromium-review.googlesource.com/514417
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This will be used by some device jails to get access to unix sockets
after being jailed.
TEST=None
BUG=None
Change-Id: I870bfb155b275769ccb3248b1441e7c0b8f20ad7
Reviewed-on: https://chromium-review.googlesource.com/558447
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Should use &<vec> instead of <vec>.iter() in a for loop.
cmdline returns a size that can't be negative.
Change-Id: I5f0ee3584d8890ac26feaadb99360b2d23f67d70
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/515604
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
For some reason, the angle brackets in the comments confused doc-tests
such that they hung everytime `cargo test` was run on sys_util on my
machine. My theory is that the angle brackets triggered some strange
HTML behavior in `cargo test`.
BUG=None
TEST=cd sys_util; cargo test
Change-Id: Iceb81e64aecc4cc2a9397f2d1af2e64aeb8e2b5e
Reviewed-on: https://chromium-review.googlesource.com/518444
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This change adds the control socket, a unix domain socket on the
filesystem that other programs can use to control the operation of
crosvm during runtime. Currently only shutdown is supported.
BUG=None
TEST=cargo test
Change-Id: Ic5f91647e28d279debaa2f9f7dbcb606ca96439b
Reviewed-on: https://chromium-review.googlesource.com/514416
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The signal module is used for registering signal handlers and for
signalling threads. Normally signals would be a method of last resort,
but in this case it's the only possible way to trigger a VM exit on a
thread currently inside of a KVM_RUN call.
BUG=None
TEST=None
Change-Id: If1db1e17937d1af08fc24b422c460be754cf9d22
Reviewed-on: https://chromium-review.googlesource.com/514415
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
