Commit graph

9 commits

Author SHA1 Message Date
hscham
a7fd914538 crosvm: add memfd_create to seccomp policy files
To enable SupportsChannelUpgrade in libchrome (upstream r850346,
crrev.com/c/2670092).

BUG=b:189403036
TEST=tast run $hatch-DUT
         arc.Notification.vm
         arc.CheckAndroidVersion.vm
         arc.RemovableMedia.vm
         arc.Gamepad.vm
         arc.IMEBlockingVK.vm
         security.SELinuxFilesDataDir.vm
         arc.StartStop.vm
         arc.CPUSet.vm
         arc.Optin.vm
         arc.IntentForward.vm
         arc.MIDIClient.vm
         arc.IMESwitchShortcut.vm
         arc.ChromeCrash.vm_logged_in
         arc.Boot.vm
         arc.BuildProperties.vm
         arc.ConciergeCrash
         arc.VMPstoreDump
         security.SELinuxProcessesARC.vm
         security.NetworkListenersARC.vm
     with disable patch removed in libchrome

Change-Id: I1a924c60ebe9707627fdd064b2233a7452d5cc57
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2984719
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Qijiang Fan <fqj@google.com>
Commit-Queue: Grace Cham <hscham@chromium.org>
2021-06-28 04:40:43 +00:00
Jorge E. Moreira
c8cff01c36 Specify prctl's policy only once per device
The libminijail version in AOSP complains when there are multiple entries for
the same system call, which was the case for virtio-fs's policy.

BUG=b/185811304

Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Tested-by: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-20 22:50:20 +00:00
Chirantan Ekbote
a00991cd84 Replace dup with fcntl(F_DUPFD_CLOEXEC)
Fds created via dup don't share file descriptor flags with the original
fd, which means that they don't have the FD_CLOEXEC flag set.  Use
fcntl(F_DUPFD_CLOEXEC) so that this flag gets set for the duplicated fds
as well.

BUG=none
TEST=unit tests

Change-Id: Ib471cf40acac1eacf72969ba45247f50b349ed58
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2809687
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2021-04-15 10:34:04 +00:00
Manoj Gupta
19ad688208 add getdents64 to policies
glibc 2.32 is using getdents64 syscall instead of getdents.
So add getdents64 to policies that already have getdents.

BUG=chromium:1171287
TEST=CQ

Change-Id: Icbe1da7cbf669432c8160779a9cbfdeb04db57c0
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2760299
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-03-16 05:25:16 +00:00
Lepton Wu
8e1d300613 seccomp: x86_64: Fix video device crash on AMD GPU
BUG=b:174620502
TEST=`tast run $DUT arc.Boot.vm`

Change-Id: I62e61aa681353d88c3cf8f69ce0f97db3e919599
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2570453
Tested-by: Lepton Wu <lepton@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Lepton Wu <lepton@chromium.org>
Reviewed-by: Morg <morg@chromium.org>
Commit-Queue: Morg <morg@chromium.org>
2020-12-07 06:10:42 +00:00
David Stevens
e341d0ab7b Expand video sandboxing for AMD devices
BUG=b:170062417
TEST=tast run grunt-DUT arc.Boot.vm and no resource bridge logspam

Change-Id: I84e185c4507b8df6b09505a369f09933d3d6143f
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2461149
Reviewed-by: Alexandre Courbot <acourbot@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: David Stevens <stevensd@chromium.org>
Commit-Queue: David Stevens <stevensd@chromium.org>
2020-10-14 16:17:17 +00:00
Lepton Wu
ff7796372b seccomp: x86_64: Allow fstat for video device
libvda depends minigbm, on amdgpu, minigbm calls dri_init
to check GPU type. dri_init calls drmGetRenderDeviceNameFromFd
in libdrm which calls fstat.

BUG=b:161376212
TEST=manual - Run arcvm on grunt

Change-Id: I3dcb723711030d25e85cf3cac4cc7c66e0e2077f
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2301439
Commit-Queue: Lepton Wu <lepton@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: Lepton Wu <lepton@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Lepton Wu <lepton@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2020-07-17 00:48:12 +00:00
Lepton Wu
436296b1f0 secomp: Allow sched_yield for video device.
libvda depends on libchrome and libchrome call sched_yield
in NeedsLazyInstance sometimes.

BUG=b:159855961
TEST=manual - keep running `android -c reboot` on hatch-arc-r

Change-Id: I39afb77541c6d129ff84a776644c5cb68687ec82
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2269339
Commit-Queue: Lepton Wu <lepton@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Alexandre Courbot <acourbot@chromium.org>
Tested-by: Lepton Wu <lepton@chromium.org>
Auto-Submit: Lepton Wu <lepton@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Alexandre Courbot <acourbot@chromium.org>
2020-06-26 11:35:33 +00:00
Keiichi Watanabe
57df6a0ab2 devices: virtio: Initial implementation of virtio-video device
This CL adds a fundamental part of the virtio video device, which will
be shared between the encoder and the decoder.
Both devices uses the virtio-video protocol proposed as RFC v3 [1,2].
The corresponding driver code is at CL:2060327 and its children CLs.

The actual decoding and encoding logic will be implemented in different
CLs.

[1]: mail: https://markmail.org/thread/wxdne5re7aaugbjg
[2]: PDF: https://drive.google.com/file/d/1jOsS2WdVhL4PpcWLO8Zukq5J0fXDiWn-/view

BUG=b:147465619, b:140082257
TEST=cargo check --features=video-decoder,video-encoder
TEST=ARCVM started with --video-decoder --video-encoder

Cq-Depend: chromium:2203997
Change-Id: I01999eea218ba0f3aaed1558ca2311a57d0c6819
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1973973
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2020-05-23 09:54:13 +00:00