Commit graph

85 commits

Author SHA1 Message Date
Daniel Verkamp
a6f7cbf5fb seccomp: aarch64: fix USB ioctl struct sizes
The ioctl allow list for the emulated xhci USB controller device was
copied from the 32-bit ARM version, but the structure sizes are
incorrect for 64-bit aarch64. Update the constants for ioctls that take
a structure with a different size:

- USBDEVFS_REAPURBNDELAY: struct usbdevfs_urb
- USBDEVFS_SUBMITURB: struct usbdevfs_urb
- USBDEVFS_CONTROL: struct usbdevfs_ctrltransfer

BUG=chromium:1328120
TEST=Share USB device with Crostini on trogdor64

Change-Id: I45d69021257af55cfeaf72dd33a500a358adc5ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3670055
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-05-26 19:37:54 +00:00
Richard
a19d6ce89c devices: Update rng devices to be platform agnostic
On Unix, instead of getting random data from `/dev/urandom`, it will get
it from the `rand` platform agnostic crate instead.

OsRng.fill_bytes on unix will make a syscall to getrandom(2) if
available, otherwise it will read from `dev/urandom` after a succesful
poll to `dev/random`. Regardless of which way a random data is
retrieved, if the entropy pool is not intialized, `fill_bytes` will
block until it is intialized. This shouldn't be a problem because it is
a one time cost.

This CL will also upstream the Windows implementation of the rng device.

BUG=b:213149162
TEST=built and presubmits

Change-Id: Ic017f11795f8006e0bf2a04eb0478b3a3d336507
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3657812
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Richard Zhang <rizhang@google.com>
2022-05-25 01:35:13 +00:00
Douglas Anderson
e742c70edc seccomp: Add io_uring_setup / io_uring_enter to gpu_common.policy
The top part of gpu_common.policy is supposed to match
common_device.policy. In https://crrev.com/c/1993163 we added
io_uring_setup and io_uring_enter to common_device.policy. Even though
there's nothing known to be broken, add these to the gpu_common.policy
to keep things matching.

BUG=None
TEST=kokoro

Change-Id: Ifd4c53c50ec12eb7e1e14f7eb80d2c9b8f0fbe46
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3631411
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Douglas Anderson <dianders@chromium.org>
2022-05-06 22:09:01 +00:00
Douglas Anderson
0508572d3c seccomp: Move prctl in gpu_common to gpu-specific section
The top part of gpu_common.policy is supposed to match
common_device.policy, but "prctl" is in this top part and isn't in
common_device.policy. A bit of history:
* prctl used to be in the common_device.policy but was removed in
  <https://crrev.com/c/2837307>.
* Even when prctl was in common_device.policy, it had different
  arguments than what we allow in gpu_common.policy.

This is a no-op cleanup change.

BUG=None
TEST=None

Change-Id: Ic71c9da3ef9eb24665711d2000416ff9c87d49a1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3631410
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Douglas Anderson <dianders@chromium.org>
2022-05-06 22:09:00 +00:00
Kazuhiro Inaba
6b8153e9c1 seccomp: add sched_yield for arm64
We already allow the system call in arm32.
Testing revealed that the call is actually in use.

BUG=b:231660764, b:230609113
TEST=cheets_CTS_R.internal.arm.CtsSkQP

Change-Id: Ia04089d1454312ac637e5c76d0aceafd2ab55134
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3632320
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Commit-Queue: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2022-05-06 20:19:04 +00:00
Douglas Anderson
3df2a8db60 seccomp: Add memfd_create: arg1 == 3 for arm64
With testing, we're seeing secomp violations on aarch64. We need to
give access to "memfd_create" just like we did for arm32. Copy the
snippet from there.

BUG=b:223410173, b:230609113
TEST=Start arcvm; start android-sh; run tast arc.VMConfig

Change-Id: I4922e6decd67c3bc23fb090987b0318c384e0d68
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3626017
Auto-Submit: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Rob Clark <robdclark@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
2022-05-04 00:22:28 +00:00
Douglas Anderson
5124d62f86 seccomp: Fixes needed for aarch64 to allow arcvm to start
With these changes arcvm starts when running with 64-bit userspace and
this grep turns up blank:
  grep SECCOMP /var/log/audit/audit.log

Generated by:
* Hacking minijail0 to always log <https://r.android.com/2072091> and
  making sure it was compiled in debug mode.
* Hacking "crosvm run" to be "crosvm run --seccomp-log-failures". I
  don't truly know if this is needed but it didn't hurt.
* Diffing arm vs. arm64

From comparing arm vs. arm64 there could still be some things missing,
or it's possible that arm has simply accumulated some cruft. More can
be added later if we find it's needed.

BUG=b:223410173, b:230609113
TEST=Start arcvm; start android-sh; run tast arc.VMConfig

Change-Id: Ib5407ddecc3d19f43e14e5b036ac64baee9335bb
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3543889
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Auto-Submit: Douglas Anderson <dianders@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Douglas Anderson <dianders@chromium.org>
2022-04-29 00:05:48 +00:00
Daniel Verkamp
5d0617cd88 seccomp: use common_device.policy in tpm_device.policy
The TPM device was changed to manually include an edited subset of
common_device.policy in commit 25a86d99cc ("tpm: Update tpm device
policy to support libtpm2") because common_device.policy included rules
for open and openat at the time, and the TPM device needed to override
those rules. Now that common_device.policy no longer defines rules for
open and openat, it is safe to include the common policy instead of
duplicating it.

BUG=None
TEST=build with features=tpm and run with --software-tpm

Change-Id: Ia79d63fcf2cd2c5303384f4d0607b3b543406098
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3482029
Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-02-23 19:23:31 +00:00
Daniel Verkamp
9f7a50fb50 seccomp: allow clock_gettime in all devices
This was already allowed in common_device.policy for arm platforms, and
it can be called via future/async code that is used by many devices. Add
it to x86_64 and aarch64 common policies as well.

BUG=b:220908060
TEST=Start Crostini with virtio-snd on hatch and trogdo

Change-Id: I9bf8f56ebed0cfe6d5e17e45226cac73db3d6d37
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3482026
Reviewed-by: Dmitry Torokhov <dtor@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-02-22 23:15:48 +00:00
Chuanxiao Dong
9ab8349c98 coiommu: add LRU unpin policy
LRU unpin policy is an internal unpin policy which is triggered by
a timer. This policy can be used when there is no external balloon
unpin request.

BUG=b:188481989
TEST=Boot a VM with coiommu enabled + pass through devices.

Change-Id: Icb6e19073cb668fa954aec97e02be77f1b8f6a04
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3292937
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: David Stevens <stevensd@chromium.org>
2022-01-22 06:47:41 +00:00
Chuanxiao Dong
a8d427b9b1 coiommu: enable coiommu
Coiommu can be enabled through the command line. E.g.
To enable coiommu for a VFIO pass-through device:
--vfio=/sys/bus/pci/devices/0000:00:02.0,iommu=coiommu

BUG=b:188481989
TEST=Boot a VM with a VFIO pass through device w/ coiommu
TEST=Boot a VM with a VFIO pass through device w/o coiommu

Change-Id: Ica6145d7bc6a4c398f0fc10899f8ee24138615c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3292934
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: David Stevens <stevensd@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
2022-01-22 06:46:46 +00:00
Yiwei Zhang
2e0a6532fd gpu_render_server: allow syslog and signalfd again
BUG=b:211008411
BUG=b:210908665
TEST=venus on kukui-arc-r and emerge on trogdor64

Change-Id: I5773363857779ecd6c563af331ff7e96dd7f10e9
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3352664
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-22 06:01:25 +00:00
Dennis Kempin
78ff88e7bc Revert "gpu_render_server: allow syslog and signalfd"
This reverts commit 7a4e207896.

Reason for revert: Fails on aarch64, the send syscall does not exist. See http://go/bbid/8827215539398029665

Original change's description:
> gpu_render_server: allow syslog and signalfd
>
> BUG=b:211008411
> BUG=b:210908665
> TEST=venus on kukui-arc-r
>
> Change-Id: I541277b0be64a96a26ee6745ea759679e6dc5230
> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3344109
> Tested-by: kokoro <noreply+kokoro@google.com>
> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
> Reviewed-by: Chia-I Wu <olv@google.com>
> Commit-Queue: Yiwei Zhang <zzyiwei@chromium.org>

Bug: b:211008411
Bug: b:210908665
Change-Id: Ia838bde85c5e5f7c70a051b55735bb18b75c3d77
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3352488
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
2021-12-21 19:38:39 +00:00
Yiwei Zhang
7a4e207896 gpu_render_server: allow syslog and signalfd
BUG=b:211008411
BUG=b:210908665
TEST=venus on kukui-arc-r

Change-Id: I541277b0be64a96a26ee6745ea759679e6dc5230
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3344109
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Chia-I Wu <olv@google.com>
Commit-Queue: Yiwei Zhang <zzyiwei@chromium.org>
2021-12-16 20:40:57 +00:00
Chia-I Wu
b86f7f6110 gpu: allow syslog from the render server
BUG=b:177267762
TEST=run vk and gl apps on volteer

Change-Id: I6fe2ce831eb671fedd1c0aa749066c41d181d152
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3335301
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-14 16:54:22 +00:00
Chia-I Wu
a946256c0b seccomp: allow waitid in gpu_renderer_server
virglrender changed from waitpid to waitid.

BUG=b:177267762
TEST=run vk and gl apps on volteer

Change-Id: If056776d934e0c2376d316dcfe37ff2c168933f3
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3331738
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-13 06:23:12 +00:00
Chia-I Wu
16fb659272 devices: gpu: add render server support
When "--gpu-render-server path=<path>" is specified, start the render
server shipped with virglrenderer and initialize virglrenderer with
VIRGLRENDERER_MULTI_PROCESS flag.

The flag makes virgl_renderer_context_create_with_flags create proxy
contexts instead of venus contexts.  Each proxy context requests the
render server to fork a subprocess and executes GPU commands in the
subprocess.

BUG=b:177267762
TEST=run vk and gl apps on volteer

Change-Id: If5e2dc3353572cadb60b0c25a3e0ad14f633db91
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3283508
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-09 20:16:13 +00:00
Chia-I Wu
64ba89ac84 seccomp: add gpu_common.policy
Let gpu_device.policy include gpu_common.policy.  No functional change.

BUG=b:177267762
TEST=run vk and gl apps on volteer

Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-09 20:16:10 +00:00
Dennis Kempin
39c2a45469 seccomp: Remove readlink from remaining aarch64 policies
Missed a couple that do not inherit from common_device.policy.

BUG=b:209021536
TEST=Cq

Change-Id: I672af4e7746bbf971193a10031f0ac27302ef3b0
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3314284
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Dennis Kempin <denniskempin@google.com>
Tested-by: Dennis Kempin <denniskempin@google.com>
2021-12-03 22:49:04 +00:00
Dennis Kempin
e6ad05efc0 seccomp: Remove readlink from aarch64 policies
aarch64 only has the readlinkat syscall.

BUG=b:209021536
TEST=Cq

Change-Id: I0a6a76bbc388f598f639a97832269256f6e9a61e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3314710
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-12-03 19:35:07 +00:00
Daniel Verkamp
6a7fdb4510 seccomp: add getcwd and readlink to common policy for panic
The panic handler uses getcwd and readlink to print out the executable
name in the backtrace. Allow these for all devices so that panics
actually work instead of crashing the process.

BUG=None
TEST=intentionally panic crosvm on kevin and check /var/log/messages

Change-Id: If64a752a6f0b1f2f6bdd6663ce77078305f38171
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3309201
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-12-02 23:18:03 +00:00
Dennis Kempin
b1751f360e seccomp: Allow lseek on cras_audio_device
The syscall is used for the file backed memory region used
by the audio device since https://crrev.com/c/3159883

BUG=b:208264646
TEST=CQ

Change-Id: I02c24da6389d60847996a62ee0eab658f9c4f7cf
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3307240
Commit-Queue: Dennis Kempin <denniskempin@google.com>
Tested-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-11-29 23:28:45 +00:00
Daniel Verkamp
f20c1cd1e8 wl: update seccomp policies for SYNC_IOC_FILE_INFO on arm
Fixes https://crrev.com/c/3199298, which only added the new ioctl
argument to the seccomp syscall filters on x86.

BUG=b:169908659
TEST=tast.crostini.SecureCopyPaste.* on scarlet

Change-Id: Ifd44c7b403f862d5528d8cc3655f0cd2c71c6e13
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3276675
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Tested-by: Dennis Kempin <denniskempin@google.com>
2021-11-11 19:31:37 +00:00
Chirantan Ekbote
f01d4b1f16 seccomp: Add unshare to fs device policy
Needed because of CL:3263932

BUG=none
TEST=vm.Fio

Change-Id: I50502476dd9591c114094cc43dda81f2c6e2c516
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3276112
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
2021-11-11 13:38:11 +00:00
Jorge E. Moreira
e40fb21c0d Allow sched_yield in all devices' seccomp policy
The sched_yield system call is somehow called by the code the rust
compiler generates and not directly by the author's implementation. That
along with the fact that it won't get called on every run makes it very
easy to miss when adding a new device (that happened with virtio-snd).
Since that call is quite harmless (it could be argued minijail shouldn't
even block it in the first place) it makes sense to allow it for all
devices.

BUG=b/201306350

Change-Id: I9895da6c8060ae83053474ed9e4472ea2cd8d3e3
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3248126
Auto-Submit: Jorge Moreira Broche <jemoreira@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-10-28 19:10:45 +00:00
Woody Chow
0c9c4baa7f seccomp: Add timerfd_* to cras_snd_device.policy
Following CL:3047951 for cras_audio_device.
Without these, the device would crash under crostini.

BUG=b:198730031
TEST=tast run $DUT_IP crostini.PulseAudioBasic.*

Change-Id: I87a60b87461ff10594ebe7643a631630eabc94ac
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3213791
Auto-Submit: Woody Chow <woodychow@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Woody Chow <woodychow@google.com>
2021-10-11 05:10:11 +00:00
Adrian Ratiu
cdedd7000a seccomp: allow newfstatat in more amd64/arm64 policies
newfstatat has been added to a few policies for the
two 64bit architectures, but some more require it to
avoid crashes, so add it to all which contain fstat
or statx.

BUG=b:187795909
TEST=CQ

Change-Id: I3cd0f5379b87102caa256503a888c5a1aa4103b6
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3198571
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2021-10-01 17:09:16 +00:00
Woody Chow
f5183c26be Set rtprio in virtio-snd (cras backend) worker
to 10 (following other cros audio client)

BUG=b:199796992
TEST=Examine output of `ps -AT -eo rtprio,command` when the device
  is running

Change-Id: I1293c693e1bd699788d87d5bc085fd4fd281fff1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3159894
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chih-Yang Hsia <paulhsia@chromium.org>
Commit-Queue: Woody Chow <woodychow@google.com>
2021-09-21 10:49:57 +00:00
Woody Chow
737ff125ca Add virtio-snd device with CRAS backend
Enable with `--cras-snd`.

Verified:
Basic playback and capture

Missing features:
* Getting chmap/jack/stream info from CRAS. They are hardcoded for now.
* Jack connect/disconnect notifications from CRAS
* Reporting latency bytes to the driver. It is currently hardcoded to 0.

BUG=b:179757101
TEST=`aplay` and `arecord` inside a debian img with a 5.10 kernel built
     with virtio snd support. Launched with crosvm on rammus/kukui/hatch

Change-Id: I240000a92418b75b3eb8dcd241ff320214b68739
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2777991
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Woody Chow <woodychow@google.com>
Reviewed-by: Chih-Yang Hsia <paulhsia@chromium.org>
2021-09-02 04:29:55 +00:00
Chirantan Ekbote
b56de80b07 fs: Support fs-verity
Needed by arcvm.

BUG=b:141632062
TEST=Run `fsverity enable $FILE` and `fsverity measure $FILE` inside a
     VM on a virtio-fs mountpoint

Change-Id: Ifb9e7e9c8b924a835971bf298256495d8dc81733
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2387820
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2021-08-23 16:15:03 +00:00
Adrian Ratiu
a0320d286d crosvm: seccomp: allow faccessat2 syscall if it exists
Starting with glibc 2.33 the faccessat2 syscall is used and
only if it doesn't exist (eg kernel older than 5.8) glibc will
default to the older faccessat syscall, so we need to allow it.

Previously this syscall has been enabled on a per-component
basis after testing, but this one does a bulk enable when
faccessat is used on all architectures.

See glibc commit 3d3ab573a5 ("Linux: Use faccessat2 to implement
faccessat (bug 18683")

BUG=b:187795855
TEST=Local builds; CQ.

Change-Id: I1f17e82e8c416b0fa2c43342731e9ea8394c47fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3097212
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-08-19 19:07:35 +00:00
Chih-Yang Hsia
4dd683a354 ac97: Add timerfd operations to accepted list
Since CL:2999451, libcras is using timerfd features from `cros_async`,
we need to add timerfd operations to the accepted list of
`cras_audio_device`'s seccomp policy files.

BUG=b:179757101
BUG=b:194452080
TEST=tast run ${DUT_IP} arc.Notification.vm

Change-Id: I74b33fa1e304fccc95b7326e04bedc32feff85f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3047951
Auto-Submit: Chih-Yang Hsia <paulhsia@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-07-23 18:43:21 +00:00
Jordan R Abrahams
e3c53096d7 seccomp: Update seccomp filters for glibc
At present, libraries which use glibc to dynamically load
shared libraries do not have fstafs in their seccomp policies.
A change in glibc will force all systems which load shared
libraries to call the fstatfs or fstatfs64 syscall.

Without the call, crosvm will not start when running
crostini/android tests.

BUG=chromium:1182687
TEST=CQ of https://crrev.com/c/2910526

Change-Id: I10abb8866474c2fe0398a17a80069cf2b0629493
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3011355
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Jordan R Abrahams <ajordanr@google.com>
2021-07-22 17:08:20 +00:00
Chirantan Ekbote
6074d45aeb cros_async: Don't use io_uring on kernels < 5.10
Kernels before 5.10 had known bugs in the io_uring implementation.
Don't use io_uring when we detect this.  Also skip all the io_uring
tests in this case.

BUG=none
TEST=cargo test

Change-Id: I5fd6203ad25a6fb85ff28f1a6ddb0181f836ad89
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3006309
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Woody Chow <woodychow@google.com>
2021-07-14 09:42:39 +00:00
Jorge E. Moreira
c8cff01c36 Specify prctl's policy only once per device
The libminijail version in AOSP complains when there are multiple entries for
the same system call, which was the case for virtio-fs's policy.

BUG=b/185811304

Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Tested-by: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-20 22:50:20 +00:00
Chirantan Ekbote
a00991cd84 Replace dup with fcntl(F_DUPFD_CLOEXEC)
Fds created via dup don't share file descriptor flags with the original
fd, which means that they don't have the FD_CLOEXEC flag set.  Use
fcntl(F_DUPFD_CLOEXEC) so that this flag gets set for the duplicated fds
as well.

BUG=none
TEST=unit tests

Change-Id: Ib471cf40acac1eacf72969ba45247f50b349ed58
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2809687
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2021-04-15 10:34:04 +00:00
Chirantan Ekbote
4b47aa7105 fs: Fix device socket
validate_raw_fd assumes that the fd passed in was not created by crosvm
and returns EBADF if it sees that the fd has the FD_CLOEXEC flag set.
We can't use it for fds created by the fs device since those do have
that flag set.

We're already taking a `&dyn AsRawFd` as the parameter so just assume
it's valid and clone it directly since there's no safe way to create an
invalid one.

BUG=none
TEST=vm.Fio.virtiofs_dax* tests are no longer failing

Change-Id: I10d9752e0960143fb58a63d2b76f64d34ec464d0
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2809686
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2021-04-09 08:04:30 +00:00
Gurchetan Singh
b66d6f62dc crosvm: sandbox changes for udmabuf
Allow:
   - UDMABUF_CREATE_LIST -- needed to create udmabuf
   - DMA_BUF_IOCTL_SYNC -- to flush the udmabuf.
     virtio-wl already allows this everywhere so
     this should be fine.

Also add the path to minijail.

BUG=chromium:892806, b:173630595
TEST=no sandbox violations

Change-Id: I70ace6ef0349c4b133615eb41f9f56ccd7121e4b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2786287
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Gurchetan Singh <gurchetansingh@chromium.org>
Commit-Queue: Gurchetan Singh <gurchetansingh@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-30 16:42:00 +00:00
Chirantan Ekbote
53ef751fb3 seccomp: 9p: Allow fchown and fchmod
Needed by upcoming implementation changes.

BUG=chromium:1082345,chromium:920262,chromium:912599
TEST=`emerge-$BOARD crosvm`

Change-Id: Id366cd9d0bb3af24e2445fdf897d6ef45ae88115
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2784163
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-24 18:59:02 +00:00
Chirantan Ekbote
7b98502972 fs: Don't drop caps when changing UID
Set the SECBIT_NO_SETUID_FIXUP securebit so that we don't lose
capabilities when changing the thread uid/gid.  This allows us to
simplify the create and mkdir functions so that all the checks we
currently carry out are only done once by the host kernel.

To ensure that the setuid and setgid bits still get dropped when a file
is modified by a process that doesn't hold CAP_FSETID, check for
WRITE_KILL_PRIV in the write flags and temporarily drop CAP_FSETID when
it is set.

BUG=none
TEST=Check that default posix acls, setgid bits, and file/directory
     creation via membership of a supplementary group all work as
     expected.

Change-Id: I420484e357a970e997cb3e968a433278e82d8ad4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2684067
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-12 04:11:58 +00:00
Adrian Ratiu
f19933bfb0 tree-wide: seccomp: allow clock_nanosleep syscalls
Starting with 2.32 glibc nanosleep() was refactored to use the
clock_nanosleep syscall so various software will fail unless
the new syscall is allowed. We can't just drop the old nanosleep
syscall because it will break glibc 2.27 which is still used.

See glibc commits:
807edded25 nptl: Refactor thrd_sleep in terms of clock_nanosleep
3537ecb49c Refactor nanosleep in terms of clock_nanosleep
79a547b162 nptl: Move nanosleep implementation to libc

This is a bulk edit done with the following command:
git grep -rl 'nanosleep: 1' | xargs sed -i \
                           '/^nanosleep: 1/a clock_nanosleep: 1'

BUG=chromium:1171287
TEST=Local builds and booting on kevin/64/eve/minnie.

Change-Id: I975535078d88200f52319c7eea3a4c7ebf299933
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2735575
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-07 01:53:10 +00:00
Dylan Reid
503c5abef6 devices: Add an asynchronous block device
This enables the use of basic disk images with async IO. A new
block_async.rs is added which mostly mirrors block, except that all
IO operations are asynchronous allowing for multiple virt queues to be
used.

The old block remains unchanged and is still used for qcow, android
sparse, and composite disks. Those should be converted to as time
allows, but this dual approach will have to do for now so ARCVM disk
performance can be properly evaluated.

fio --ioengine=libaio --randrepeat=1 --direct=1 --gtod_reduce=1
--name=test --filename=test --bs=4k --iodepth=64 --size=4G
--readwrite=randrw --rwmixread=75

desktop with nvme:

before:
READ: bw=36.2MiB/s (37.9MB/s), 36.2MiB/s-36.2MiB/s (37.9MB/s-37.9MB/s),
io=3070MiB (3219MB), run=84871-84871msec
WRITE: bw=12.1MiB/s (12.7MB/s), 12.1MiB/s-12.1MiB/s (12.7MB/s-12.7MB/s),
io=1026MiB (1076MB), run=84871-84871msec
after:
READ: bw=257MiB/s (269MB/s), 257MiB/s-257MiB/s (269MB/s-269MB/s),
io=3070MiB (3219MB), run=11964-11964msec
WRITE: bw=85.8MiB/s (89.9MB/s), 85.8MiB/s-85.8MiB/s (89.9MB/s-89.9MB/s),
io=1026MiB (1076MB), run=11964-11964msec

samus with 5.6 kernel
before:
READ: bw=55.3MiB/s (57.9MB/s), 55.3MiB/s-55.3MiB/s (57.9MB/s-57.9MB/s),
io=768MiB (805MB), run=13890-13890msec
WRITE: bw=18.5MiB/s (19.4MB/s), 18.5MiB/s-18.5MiB/s (19.4MB/s-19.4MB/s),
io=256MiB (269MB), run=13890-13890msec
after:
READ: bw=71.2MiB/s (74.7MB/s), 71.2MiB/s-71.2MiB/s (74.7MB/s-74.7MB/s),
io=3070MiB (3219MB), run=43096-43096msec
WRITE: bw=23.8MiB/s (24.0MB/s), 23.8MiB/s-23.8MiB/s (24.0MB/s-24.0MB/s),
io=1026MiB (1076MB), run=43096-43096msec

kevin with 5.6 kernel
before:
READ: bw=12.9MiB/s (13.5MB/s), 12.9MiB/s-12.9MiB/s (13.5MB/s-13.5MB/s),
io=1534MiB (1609MB), run=118963-118963msec
WRITE: bw=4424KiB/s (4530kB/s), 4424KiB/s-4424KiB/s (4530kB/s-4530kB/s),
io=514MiB (539MB), run=118963-118963msec
after:
READ: bw=12.9MiB/s (13.5MB/s), 12.9MiB/s-12.9MiB/s (13.5MB/s-13.5MB/s),
io=1534MiB (1609MB), run=119364-119364msec
WRITE: bw=4409KiB/s (4515kB/s), 4409KiB/s-4409KiB/s (4515kB/s-4515kB/s),
io=514MiB (539MB), run=119364-119364msec

eve with nvme and 5.7 kernel
before:
READ: bw=49.4MiB/s (51.8MB/s), 49.4MiB/s-49.4MiB/s (51.8MB/s-51.8MB/s),
io=3070MiB
(3219MB), run=62195-62195msec
WRITE: bw=16.5MiB/s (17.3MB/s), 16.5MiB/s-16.5MiB/s (17.3MB/s-17.3MB/s),
io=1026MiB
 (1076MB), run=62195-62195msec
after
READ: bw=125MiB/s (131MB/s), 125MiB/s-125MiB/s (131MB/s-131MB/s),
io=3070MiB (3219MB), run=24593-24593msec
WRITE: bw=41.7MiB/s (43.7MB/s), 41.7MiB/s-41.7MiB/s
(43.7MB/s-43.7MB/s), io=1026MiB (1076MB), run=24593-24593msec

rammus with 5.10 kernel
before:
READ: bw=6927KiB/s (7093kB/s), 6927KiB/s-6927KiB/s (7093kB/s-7093kB/s),
io=3070MiB (3219MB), run=453822-453822msec
WRITE: bw=2315KiB/s (2371kB/s), 2315KiB/s-2315KiB/s (2371kB/s-2371kB/s),
io=1026MiB (1076MB), run=453822-453822msec
after:
Run status group 0 (all jobs):
READ: bw=10.0MiB/s (11.5MB/s), 10.0MiB/s-10.0MiB/s (11.5MB/s-11.5MB/s),
io=3070MiB (3219MB), run=279111-279111msec
WRITE: bw=3764KiB/s (3855kB/s), 3764KiB/s-3764KiB/s (3855kB/s-3855kB/s),
io=1026MiB (1076MB), run=279111-279111msec

BUG=chromium:901139
TEST=unitests
TEST=boot a test image and run fio tests from the guest to measure speed.
TEST=start ARCVM
TEST=tast run $DUT crostini.ResizeOk.dlc_stretch_stable

Change-Id: Idb63628871d0352bd18501a69d9c1c887c37607b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2306786
Tested-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2021-02-17 04:11:55 +00:00
Dylan Reid
592f3275dd devices: Use async from balloon
The newly added async primitives allow for increasing the separation of
the various tasks performed by balloon. Breaking each task in to an
asynchronous function.

BUG=chromium:901139
TEST=Boot crosvm, run 'crosvm balloon' to set the balloon size, check
'vmstat' inside the VM to verify the free memory is affected by the
balloon growing and shrinking.
run crosvm balloon_stats command and ensure that stats are reported
correctly.

Change-Id: I0ae2be5eb8e4be65b2eb74de90888357af6ecfd4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1993163
Tested-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-02-12 18:27:45 +00:00
Rob Clark
febb71cfb1 seccomp: Update arm/aarch64 gpu_device.policy for Mesa
An upcoming mesa-freedreno uprev will require a couple crosvm policy
updates.  In particular setscheduler/setaffinity, for the same reasons
that AMD requires them.

BUG=b:179519741
TEST=Start crostini with upstream mesa MR that starts requiring
     setscheduler/setaffinity

Change-Id: I4f41a638f413b35f2afebdbe39dde02a02f8322a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2683032
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Rob Clark <robdclark@chromium.org>
Commit-Queue: Rob Clark <robdclark@chromium.org>
Auto-Submit: Rob Clark <robdclark@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-02-11 03:49:59 +00:00
Jorge E. Moreira
359e7de9a1 Add the VioS audio backend
It only supports playback streams, with capture streams to be added in
a different change.

BUG=b/171602855

Change-Id: Id9a5a560506f8fd026ef3ed83f8d14b29389e329
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2574813
Tested-by: Jorge Moreira Broche <jemoreira@google.com>
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Auto-Submit: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Chih-Yang Hsia <paulhsia@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2021-02-01 23:47:02 +00:00
Daniel Verkamp
c7236f2cf1 seccomp: allow USBDEVFS_CLEAR_HALT
This USB ioctl is used in usb_util::Device::clear_halt(), but it was not
allowed in the seccomp policy.

BUG=chromium:1167286
TEST=Attach Keyspan USA-19H USB serial adapter to Crostini

Change-Id: I625cde121a0a248046e476eecd732a98530811dc
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2633824
Reviewed-by: Matthew Blecker <matthewb@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Matthew Blecker <matthewb@chromium.org>
Commit-Queue: Matthew Blecker <matthewb@chromium.org>
2021-01-22 05:00:05 +00:00
John Bates
0d9d0e3c85 Allow perfetto tracing from crosvm gpu process
New syscalls and /run/perfetto bind mount are required.

BUG=b:174162684
TEST=Run crosvm with perfetto instrumentation and confirm that
     events can be traced through traced. Tested on both hatch
     and ARM kukui device.

Cq-Depend: chromium:2570487
Change-Id: I809400ec393c2971ba9a1134ddbef7f48d818786
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2571659
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: John Bates <jbates@chromium.org>
Commit-Queue: John Bates <jbates@chromium.org>
2020-12-10 04:40:43 +00:00
Chirantan Ekbote
8e06159af3 virtiofs: Support FS_IOC_GET_ENCRYPTION_POLICY_EX
Needed by arcvm.  Also fix some style issues with the previous ioctl
definitions.

BUG=b:136127632
TEST=Call this ioctl from inside a VM and see that it is passed through
     to the host.

Change-Id: Icdeff9e2c5b15237ed49e6814b8147258a50ccab
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2560286
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2020-12-08 00:26:39 +00:00
Chirantan Ekbote
c6810f2d4b virtiofs: Drop regular encryption ioctls
These don't work without a kernel change that we never merged.  Arcvm
doesn't need these anymore so just drop them.

BUG=b:136127632
TEST=vm.Virtiofs

Change-Id: I427dee41720b0db1d14f4d03c95ff678ec3fd347
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2573709
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2020-12-08 00:26:39 +00:00
Chuanxiao Dong
bbb32af60d Goldfish battery: create a irq thread
The goldfish battery irq will be used to notify the guest driver that
battery/ac status changed. And the status changing will be done through
external crosvm commands. So the irq injection needs to be done in a
seperate thread which can receive these commands.

BUG=chromium:1050432
BUG=b:137890633
TEST=create VM with parameter "--battery" or "--battery=type=goldfish"
and boot linux guest with goldfish_battery driver enabled. The sysfs
created by the goldfish_battery driver have no issue observed.
TEST=goldfish_battery driver is loaded on ARCVM and interrupts are enabled

Change-Id: Icc902dd8c00bdcf6cb271b20d928a4081533dde6
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2119573
Commit-Queue: Alex Lau <alexlau@chromium.org>
Tested-by: Alex Lau <alexlau@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2020-11-12 09:59:17 +00:00