From nobody Fri Apr 26 12:59:25 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.37 as permitted sender) client-ip=209.132.183.37; envelope-from=libvir-list-bounces@redhat.com; helo=mx5-phx2.redhat.com; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.37 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; Return-Path: Received: from mx5-phx2.redhat.com (mx5-phx2.redhat.com [209.132.183.37]) by mx.zohomail.com with SMTPS id 1487580795285322.1280512773228; Mon, 20 Feb 2017 00:53:15 -0800 (PST) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by mx5-phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v1K8nmxT047258; Mon, 20 Feb 2017 03:49:49 -0500 Received: from int-mx14.intmail.prod.int.phx2.redhat.com (int-mx14.intmail.prod.int.phx2.redhat.com [10.5.11.27]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id v1K8iY3i018071 for ; Mon, 20 Feb 2017 03:44:34 -0500 Received: from lisa.redhat.com (ovpn-204-62.brq.redhat.com [10.40.204.62]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v1K8iWV2009070; Mon, 20 Feb 2017 03:44:32 -0500 From: Michal Privoznik To: libvir-list@redhat.com Date: Mon, 20 Feb 2017 09:44:25 +0100 Message-Id: X-Scanned-By: MIMEDefang 2.68 on 10.5.11.27 X-loop: libvir-list@redhat.com Cc: marcandre.lureau@redhat.com Subject: [libvirt] [PATCH v2] qemu: Allow @rednernode for virgl domains X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" When enabling virgl, qemu opens /dev/dri/render*. So far, we are not allowing that in devices cgroup nor creating the file in domain's namespace and thus requiring users to set the paths in qemu.conf. This, however, is suboptimal as it allows access to ALL qemu processes even those which don't have virgl configured. Now that we have a way to specify render node that qemu will use we can be more cautious and enable just that. Signed-off-by: Michal Privoznik Reviewed-by: Marc-Andr=C3=A9 Lureau --- Technically, this is v2 of: https://www.redhat.com/archives/libvir-list/2017-February/msg00497.html diff to v1: - now that we have @rendernode for which selects just one path (and d= oes it in predictable fashion) only that path is enabled in the CGgroups and created in the namespace. src/qemu/qemu_cgroup.c | 27 +++++++++++++++++++++++++++ src/qemu/qemu_domain.c | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 66 insertions(+) diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index 209cbc275..f0729743a 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -335,6 +335,28 @@ qemuTeardownHostdevCgroup(virDomainObjPtr vm, return ret; } =20 + +static int +qemuSetupGraphicsCgroup(virDomainObjPtr vm, + virDomainGraphicsDefPtr gfx) +{ + qemuDomainObjPrivatePtr priv =3D vm->privateData; + const char *rendernode =3D gfx->data.spice.rendernode; + int ret; + + if (gfx->type !=3D VIR_DOMAIN_GRAPHICS_TYPE_SPICE || + gfx->data.spice.gl !=3D VIR_TRISTATE_BOOL_YES || + !rendernode) + return 0; + + ret =3D virCgroupAllowDevicePath(priv->cgroup, rendernode, + VIR_CGROUP_DEVICE_RW, false); + virDomainAuditCgroupPath(vm, priv->cgroup, "allow", rendernode, + "rw", ret =3D=3D 0); + return ret; +} + + static int qemuSetupBlkioCgroup(virDomainObjPtr vm) { @@ -604,6 +626,11 @@ qemuSetupDevicesCgroup(virQEMUDriverPtr driver, goto cleanup; } =20 + for (i =3D 0; i < vm->def->ngraphics; i++) { + if (qemuSetupGraphicsCgroup(vm, vm->def->graphics[i]) < 0) + goto cleanup; + } + for (i =3D 0; i < vm->def->ninputs; i++) { if (qemuSetupInputCgroup(vm, vm->def->inputs[i]) < 0) goto cleanup; diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c index 92a9a105c..ea4b28288 100644 --- a/src/qemu/qemu_domain.c +++ b/src/qemu/qemu_domain.c @@ -7526,6 +7526,42 @@ qemuDomainSetupTPM(virQEMUDriverPtr driver ATTRIBUTE= _UNUSED, } =20 =20 +static int +qemuDomainSetupGraphics(virQEMUDriverPtr driver ATTRIBUTE_UNUSED, + virDomainGraphicsDefPtr gfx, + const char *devPath) +{ + const char *rendernode =3D gfx->data.spice.rendernode; + + if (gfx->type !=3D VIR_DOMAIN_GRAPHICS_TYPE_SPICE || + gfx->data.spice.gl !=3D VIR_TRISTATE_BOOL_YES || + !rendernode) + return 0; + + return qemuDomainCreateDevice(rendernode, devPath, false); +} + + +static int +qemuDomainSetupAllGraphics(virQEMUDriverPtr driver, + virDomainObjPtr vm, + const char *devPath) +{ + size_t i; + + VIR_DEBUG("Setting up graphics"); + for (i =3D 0; i < vm->def->ngraphics; i++) { + if (qemuDomainSetupGraphics(driver, + vm->def->graphics[i], + devPath) < 0) + return -1; + } + + VIR_DEBUG("Setup all graphics"); + return 0; +} + + static int qemuDomainSetupInput(virQEMUDriverPtr driver ATTRIBUTE_UNUSED, virDomainInputDefPtr input, @@ -7679,6 +7715,9 @@ qemuDomainBuildNamespace(virQEMUDriverPtr driver, if (qemuDomainSetupTPM(driver, vm, devPath) < 0) goto cleanup; =20 + if (qemuDomainSetupAllGraphics(driver, vm, devPath) < 0) + goto cleanup; + if (qemuDomainSetupAllInputs(driver, vm, devPath) < 0) goto cleanup; =20 --=20 2.11.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list