Factor out common ioctl wrappers and macros into their own module.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=cargo test
Change-Id: Ibede8a853f5cc6c6d62565930f312b11024cc5b5
Reviewed-on: https://chromium-review.googlesource.com/566540
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
In preparation for adding a net device, factor out some of the common code
for setting up an mmio device and jailing it.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=cargo test
Change-Id: I94f02e56a2b0938d860322b731d8b17a25357128
Reviewed-on: https://chromium-review.googlesource.com/543910
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
The cpus option is now used.
Change-Id: I64bcc7cf27427f20b093c70eec3b58cd2c55e290
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/569098
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
When syslog is used from another crate, the compiler needs a specific
place to look for the symbols.
Change-Id: I5ba1b7ae0e8f6825aaf2a0d0b6ff31dcab21aa0c
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/569360
Reviewed-by: Zach Reizner <zachr@chromium.org>
Dealing with signals is unpleasant business. SignalFd wraps a kernel
signalfd for a signal, and blocks the default handling for the signal.
Signed-off-by: Stephen Barber <smbarber@chromium.org>
BUG=none
TEST=cargo test
Change-Id: I161c992b65b98ffa5c07d546f13efa6b56890df4
Reviewed-on: https://chromium-review.googlesource.com/557459
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
The `clone_process` function was created to safely encapsulate
fork/clone usage for the proxy device. This patch changes proxy device
to do utilize that.
TEST=cargo run -- -u <other crosvm args>...
BUG=None
Change-Id: I2d9f1794be61be31f3aae21037c7df14b7691172
Reviewed-on: https://chromium-review.googlesource.com/518935
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This module is designed as a safe wrapper around clone for use by the
proxy device. It includes safe guards that prevent errors with typical
forking applications in rust.
TEST=cargo test
BUG=None
Change-Id: I09132a4cae61ebdaa97ec3b95d22567c36c5f15d
Reviewed-on: https://chromium-review.googlesource.com/518446
Commit-Ready: Stephen Barber <smbarber@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This CL adds the SharedMemory structure for managing memory attached to
a file descriptor, which can be sent to external processes.
TEST=cargo test
BUG=chromium:738638
Change-Id: I2b6a10e0e7275367ddb578831a73de6956d231bb
Reviewed-on: https://chromium-review.googlesource.com/562509
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Add a new method to GuestMemory that allows running a FnMut over all
regions. This will allow the virtio module to generate a vhost memory
table.
Also make do_in_region public, so that VHOST_NET can find the host
userspace address of vrings (necessary for VHOST ioctls).
BUG=none
TEST=cargo build
Change-Id: I43611dcc56146ed4d160f0e189b9328ca0e6d87d
Reviewed-on: https://chromium-review.googlesource.com/543909
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
A VirtioDevice should expose its type so that the guest can probe it
correctly.
BUG=none
TEST=boot with block device
Change-Id: I6a8cae3afbdc5ae9f6af23eea928c83e67719c12
Reviewed-on: https://chromium-review.googlesource.com/538104
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Run with the new seccomp filter and drop all capabilities. In addition enter a
new user, mount, network, and ipc namespace. Leave the mount namespace empty
after pivot-rooting to an empty directory.
Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/515603
There were a few cases of a write into the serial device that would
panic because the registers were read-only. This change simply ignores
those writes instead of raising a panic.
This is also the first bug that was found by cargo-fuzz! Wohoo!
TEST=None
BUG=None
Change-Id: I8b6805617ac3dcfddd0555c1bb394a7bc1a7cf6d
Reviewed-on: https://chromium-review.googlesource.com/518445
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This program is used to boot a 64-bit kernel elf. It has support for
basic devices that are exposed to the kernel, including a block device.
TEST=cargo test;
cargo run -- -m 512 -c 4 -d rootfs.squashfs -u -p "init=/bin/bash" vmlinux
BUG=chromium:712319
Change-Id: I25a8349a4624d8643fefe2ad70e517fe03b16b8c
Reviewed-on: https://chromium-review.googlesource.com/514417
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This will be used by some device jails to get access to unix sockets
after being jailed.
TEST=None
BUG=None
Change-Id: I870bfb155b275769ccb3248b1441e7c0b8f20ad7
Reviewed-on: https://chromium-review.googlesource.com/558447
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Should use &<vec> instead of <vec>.iter() in a for loop.
cmdline returns a size that can't be negative.
Change-Id: I5f0ee3584d8890ac26feaadb99360b2d23f67d70
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/515604
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
For some reason, the angle brackets in the comments confused doc-tests
such that they hung everytime `cargo test` was run on sys_util on my
machine. My theory is that the angle brackets triggered some strange
HTML behavior in `cargo test`.
BUG=None
TEST=cd sys_util; cargo test
Change-Id: Iceb81e64aecc4cc2a9397f2d1af2e64aeb8e2b5e
Reviewed-on: https://chromium-review.googlesource.com/518444
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This change adds the control socket, a unix domain socket on the
filesystem that other programs can use to control the operation of
crosvm during runtime. Currently only shutdown is supported.
BUG=None
TEST=cargo test
Change-Id: Ic5f91647e28d279debaa2f9f7dbcb606ca96439b
Reviewed-on: https://chromium-review.googlesource.com/514416
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The signal module is used for registering signal handlers and for
signalling threads. Normally signals would be a method of last resort,
but in this case it's the only possible way to trigger a VM exit on a
thread currently inside of a KVM_RUN call.
BUG=None
TEST=None
Change-Id: If1db1e17937d1af08fc24b422c460be754cf9d22
Reviewed-on: https://chromium-review.googlesource.com/514415
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The poll module adds the Poller object for waiting on mutliple file
descriptors at once. The Pollable trait is introduced so rust objects
can expose a file descriptor useful for polling. An impl for EventFd is
included with this change for testing.
TEST=cargo test
BUG=None
Change-Id: I94fd15a17fe0527c0d29c623badb90668d708689
Reviewed-on: https://chromium-review.googlesource.com/514413
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
This CL takes the handle_intr!() macro, changes its name to
handle_eintr!(), and overloads it so it can handle EINTR embedded in
other kinds of Result types.
BUG=None
TEST=cargo test
Change-Id: I920ea7d9f156137f42e9e8ea44a3e6946d06b746
Reviewed-on: https://chromium-review.googlesource.com/556348
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The FDs for stdin, stdout, and stderr shouldn't be left empty. Just
closing these FDs causes the next open() call from the jailed process to
reuse the 0, 1, or 2 FD. This confuses basic infrastructure like
println!.
Change-Id: I40ea471b4a011f2be5132e1a0ff50656ae2ec14a
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/549659
The kernel command line is dynamically built up based on what devices
are added and what extra parameters are passed in my the user. The
module this CL adds ensures the kernel command line that is built is a
valid one.
TEST=None
BUG=None
Change-Id: Ia2b7b9fae7eb29140ae25ab34119d050984f8ef2
Reviewed-on: https://chromium-review.googlesource.com/514689
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Mmap and GuestMemory are the intended targets for the VolatileMemory
trait.
TEST=cargo test
BUG=None
Change-Id: Ie228b5daef691a6dcb80841be1c3dddb4b19ffc4
Reviewed-on: https://chromium-review.googlesource.com/547335
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
This includes both VolatileRef, for accessing DataInit, and
VolatileSlice, for accessing bulk raw memory.
BUG=None
TEST=cargo test
Change-Id: I356c7e6f05361fa711dc91555f68e4323667884a
Reviewed-on: https://chromium-review.googlesource.com/547050
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
This device is useful for exposing a block device, for example a rootfs
image, to the guest.
TEST=None
BUG=None
Change-Id: Ida0d24ed57602f25352563893a1c85b171771c7a
Reviewed-on: https://chromium-review.googlesource.com/514688
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
These types are just like normal unsigned primitives, except their
endian is explicit.
TEST=cargo test
BUG=None
Change-Id: I3d0a7f7ccbf276e2cfdb34310f173df193c70c79
Reviewed-on: https://chromium-review.googlesource.com/544692
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Not all types are safe to read from guest memory. Any type with a
reference or pointer will be initialized to random bits that don't refer
to a valid address. This can cause dangling pointer and general
unsafe behavior.
To fix this, limit types that can be read with read_obj to those that
implement the unsafe trait `DataInit`. Provide implementations of
`DataInit` for intrinsic types that are obviously safe to initialize
with random data.
Implement the needed traits for bootparam types as they are read from
the kernel image directly.
Change-Id: I1040f5bc1b2fc4c58c87d8a2ce3f618edcf6f9b1
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/540750
Reviewed-by: Zach Reizner <zachr@chromium.org>
The data_model crate is created to hold the DataInit trait. Types
implementing this unsafe trait must guarantee that the type can be
initialized with random data and the resulting object will be valid.
Change-Id: Id6314d114805ec502adabe50a8bd6aa42fdb2c52
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/541681
Reviewed-by: Zach Reizner <zachr@chromium.org>
Cargo.lock will need to be checked in to ensure reproducible builds.
However continue to ignore Cargo.lock in subdirectories as the main Cargo.lock
shouls dictate the versions of everything.
Change-Id: I448527b3c23bb9de939682ec1a78fd06a2530857
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/538067
Reviewed-by: Zach Reizner <zachr@chromium.org>
This will be used to create temporary directories that are lifetime
managed for running jails.
Change-Id: I35dfeae76a211c820db090b65baf72277d9e2d8a
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/520706
Reviewed-by: Zach Reizner <zachr@chromium.org>
The MMIO transport, along with PCI, is a standard transport for
discovering and configuring virtio devices and their associated queues.
MMIO is by far easier and simpler and so gets implemented first.
BUG=None
TEST=None
Change-Id: Icdaa02284aedf8ec726199784da45d22c8dbab87
Reviewed-on: https://chromium-review.googlesource.com/514687
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The queue module is for navigating virtio queues using guest memory. It
is the basis of the virtio protocol post-configuration.
TEST=None
BUG=None
Change-Id: I2e6f9a1398ee06f3e766fe5edcb1c4283ebe7be8
Reviewed-on: https://chromium-review.googlesource.com/514686
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
The purpose of the child process is to enable an extra layer of
isolation between the emulated devices, which have to deal with much
more untrusted guest memory, and the main process which has access to
the kernel's KVM ioctls.
BUG=None
TEST=None
Change-Id: I13c1fcf29e6da88a8a390e1cb174915fa2d86596
Reviewed-on: https://chromium-review.googlesource.com/514685
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
The Bus object is meant to be useful for arbitrary address space access
routing. In practice, this is used for MMIO and I/O ports.
TEST=None
BUG=None
Change-Id: I1ac7f231ac630a29195773425ce461fa7ade1753
Reviewed-on: https://chromium-review.googlesource.com/514684
Commit-Ready: Zach Reizner <zachr@chromium.org>
Tested-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
A few places were passing a reference to a reference, which just gets
compiled out anyways.
Some other places where passing `|e| ErrorName(e)` as a closure when
just `ErrorName` would be more succinct.
Change-Id: Ic097a81b956ef82b29fc1a15196c245bee61c251
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/510782
Reviewed-by: Zach Reizner <zachr@chromium.org>
Add a module for accessing guest memory.
This module will replace all the slices that are used to access it
currently as those slices aren't valid because the memory is volatile
and a volatile slice doesn't exist in rust.
Modify the existing users so they no longer depend on the deprecated slice
access.
Change-Id: Ic0e86dacf66f68bd88ed9cc197cb14e45ada891d
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/509919
The io_jail is used to jail io processes run from crosvm. Under the hood
it mostly configures a minijail jail to run in. The minijail
restrictions are applied when iojail::enter is called. This closes
extra FDs and calls minijail_enter.
The minijail_run* functions are left out as we don't have a need to exec
foreign programs. libminijail will be used to jail separate processes
spawned from the main crosvm process.
The ability to close all open file descriptors is added. Minijail only
closes FDs after forking and before exec.
Change-Id: Ida7f52022c934e9e6edeb7b604cd6e6399860cb9
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/505100
Reviewed-by: Zach Reizner <zachr@chromium.org>
Add the ability to set sregs, lapic, and msrs as they are needed before
running the VM.
Change-Id: I5c6f01f6e5302e3c3519f8748dd292a60180b6d5
Signed-off-by: Dylan Reid <dgreid@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/498129
Reviewed-by: Zach Reizner <zachr@chromium.org>
