- Spectrum Development - spectrum-os.org

[PATCH www] todo.html: add request for memfd server ceiling
by Alyssa Ross 29 May '20

29 May '20

--- I pushed this already, but I'm posting it here in case anybody is interested in doing it. ;) todo.html | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/todo.html b/todo.html index abb9c11..417b3c3 100644 --- a/todo.html +++ b/todo.html @@ -48,6 +48,11 @@ might be able to help out. <a href="https://spectrum-os.org/git/nixpkgs/tree/pkgs/development/libraries/wlroots…">patch</a> wlroots to downgrade it to an older protocol. + <li> + Implement a ceiling for host memory allocated by the + crosvm <a href="https://spectrum-os.org/doc/developer-manual.html#_the_memfd_server">memfd + server</a>. + <li> Create a minimal VM kernel configuration. This will make it much easier to iterate on the VM kernel, by substantially reducing clean -- 2.26.2

1 0

[PATCH doc] Document crosvm memfd server
by Alyssa Ross 29 May '20

29 May '20

--- Looking for another set of eyes on this to check it makes sense to people who haven't dedicated several weeks of their life to thinking about it. ;) developer-manual.adoc | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/developer-manual.adoc b/developer-manual.adoc index a538437..5a5f80d 100644 --- a/developer-manual.adoc +++ b/developer-manual.adoc @@ -194,6 +194,31 @@ compile the policy files into the crosvm binary so paths don't have to be hardcoded. +==== The memfd server + +Spectrum's crosvm has been augmented with a feature called the +"`memfd server`", (currently only on the +https://spectrum-os.org/git/crosvm/log/?h=interguest[interguest] +branch). This is a small server that listens on a Unix stream socket. +It receives a request consisting of a name and a size, uses those to +allocate a receives requests for a +https://man7.org/linux/man-pages/man2/memfd_create.2.html[memfd], and +then sends the resulting memfd file descriptor back over the socket in +response, along with a single byte status code. + +The purpose of this is that it can be exposed to the guest over +virtio_wl. This means that the guest can request and receive +allocations of host memory. This is important, because virtio_wl only +allows file descriptors pointing to host memory to be sent over +virtio_wl -- a memfd allocated in a guest cannot be sent over virtio_wl. +It is rare that a guest needs to be able to allocate and send shared +memory in this way, but it is important for a Wayland compositor +running in a guest to be able to do this. + +The memfd server is disabled by default, but is enabled at startup +time with the `--wl-memfd` flag. + + === Sommelier https://chromium.googlesource.com/chromiumos/platform2/+/master/vm_tools/so… -- 2.26.2

3 6

This Week in Spectrum, 2020-W21
by Alyssa Ross 24 May '20

24 May '20

A week of results! Infrastructure -------------- Fixed a misconfigured spam filter that allowed an obvious spam message through to devel@. Oops. crosvm ------ Integrated the memfd server[1] on the interguest branch. It's now all sandboxed, and optionally enabled with a command line argument to crosvm run. Not all that much to say here, but it's what took me most of the week! Getting the sandbox working was a bit weird. When I tried to get it to log seccomp failures, it seemed to just disable the sandbox. I had to track them down with strace instead. Annoying. But the sandbox does work in normal operation. I still haven't limited how much memory can be requested this way. I think implementing that would be relatively straightforward for another contributor, so I think I'll add it to the ideas list[2] and see if a patch is forthcoming. Otherwise I'll do it myself. [1]: https://spectrum-os.org/git/crosvm/commit/?h=interguest [2]: https://spectrum-os.org/todo.html wlroots ------- I took my standalone virtio_wl test program, and integrated it into wlroots' allocate_shm_file function. This has the result that, when running under Sommelier, this patched wlroots will request shared memory from the host, rather than allocating it itself. Porting from the standalone test program was nice, because it meant that this all just worked, first try! (Once I got it to compile under Nixpkgs' or wlroots' strict compiler errors, at least.) This will allow that memory to be sent between VMs! I haven't pushed the patch yet because I haven't integrated it into Spectrum's Nixpkgs yet. I plan to do that next week. I'm starting to think about moving the stuff specific to Spectrum VMs into an overlay, but I need to think a bit about how to structure that. Nixpkgs ------- There's no sign of the expected Chromium OS release so far, so I backported[3] support for multiple virtio_wl sockets from a more recent Chromium OS kernel to the one in Spectrum's Nixpkgs. We need this to be able to dedicate a named socket to the memfd server. [3]: https://spectrum-os.org/git/nixpkgs/commit/?id=f24d310275909265de32cbc831d5… It's been another week where I've been very focused on one task. I'm quite excited about the direction this is all going. It's looking like we'll be able to do almost everything inside VMs, which means it might be possible to have a host kernel that does almost nothing apart from KVM and PCI passthrough?? This would mean we'd end up with a tiny Linux a little bit (but not all that much) like a microkernel, with most hardware interaction and all user programs running in VMs. Cool stuff! It's not clear to me yet the exact extent to which this is achievable, but it's a nice vision to keep in mind. It might also make it easier for us to transition to a true microkernel at some point in the future. I'm hoping that I'll hit an NLnet milestone related to this stuff fairly soon. Until I do, I'm now living on the money I've received in the past six months through GitHub Sponsors. Thank you so much to everyone who is helping to make it possible for me to spend this time on the fundamentals so we have a good foundation to build Spectrum on. <3

1 0

Spam on this list
by Alyssa Ross 18 May '20

18 May '20

Hi, Apologies for the recent spam message on the list. It got through due to a misconfigured spam filter. Should be fixed now. Let me know if you see anything else unusual. :)

1 0

This Week in Spectrum, 2020-W20
by Alyssa Ross 17 May '20

17 May '20

It feels like things are finally starting to come together. Infrastructure -------------- Server memory upgraded. We should now be able to handle more than one person cloning Spectrum's nixpkgs repo at once! Documentation ------------- I added a much requested page[1] to the website with a few tasks a potential contributor might want to look into. More to come here, too! [1]: https://spectrum-os.org/todo.html virtio_wl --------- I wrote a simple guest C program that connected to a host socket over virtio_wl, and sent some messages back and forth. In doing this, I've ended up with a nice set of generic functions for interacting with virtio_wl -- virtio_wl_connect(), virtio_wl_send(), etc. This is nice, because it allows me to treat virtio_wl inside a guest much like a regular socket (albeit one that can only be interacted with using a custom set of functions). Otherwise, I'd have to do ioctl operations every time (which seems to be what the various virtio_wl-using Chromium OS components do). Having a simple test program (rather than integrating directly into wlroots) gives me a more simple environment with which to test the other end of this connection. crosvm ------ I implemented a little Rust server that listens on a Unix stream socket. When it receives a message (consisting of an identifier {for debug purposes} and a size), it will allocate a memfd of the requested size, and then send that back to the socket, along with a status byte indicating success or failure. I then integrated this program into crosvm, so it is started as part of the VM initialization, and exposed over virtio_wl as an additional socket. Integrating this into crosvm required some careful thought, because there's no precedent in crosvm for a virtio_wl server of this sort. It has almost nothing with the existing concept in crosvm of a "device", which is something that communicates with a guest kernel driver over PCI. So Spectrum's crosvm now has the concept of "servers". I can see us wanting to provide other VM services over virtio_wl in the future. It allows us to exchange various resources between host and guest (or between guests) without having to write a kernel driver specific to each task. This all now works well enough that my program inside the VM can request a chunk of memory, and receive back something that looks a bit like a memfd, that can then be sent back to the host over a virtio_wl socket. It was great to see this working the first time! One thing crosvm devices do that I would also like to apply to this type of server is sandboxing. The sandboxing mechanism used in crosvm is pretty generic (it's really just a thin wrapper around Minijail[2]), so it should be straightforward to reuse. I just have to understand a bit better how to use it. The other crosvm change I still need to make is to put this functionality behind a command line flag. Most VMs should not be able to give themselves extra memory this way -- really only the Wayland compositor should be using it. I should also impose some upper bound on how much memory is allowed to be allocated this way. Such a limit will probably get harder to add (from a testing point of view) the longer I wait. [2]: https://lwn.net/Articles/700557/ So, at lot of very focused progress this week. From here I plan to finish up the crosvm stuff, and then integrate this protocol into wlroots. Then, not too long from now, we'll finally be able to move the Wayland compositor into its own VM, separate from applications. Exciting! There will also probably be a Chromium OS release next week, which will require some updates in Spectrum. If all goes well, I won't actually be the one doing that this time. ;)

1 0

[PATCH www] todo.html: fix 'appears' -> 'appeals'
by Vincent Ambo 15 May '20

15 May '20

Hello world o/ --- todo.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/todo.html b/todo.html index fd8bc04..b8c091a 100644 --- a/todo.html +++ b/todo.html @@ -26,7 +26,7 @@ system available to experiment with yet. <p> Here are some ideas for contributions, roughly ordered by priority. -If working on any of these appears to you, even if you don't +If working on any of these appeals to you, even if you don't understand all the parts involved, we'd be happy to provide mentorship and support. Just reach out on <a href="participating.html#irc">IRC</a> or email -- 2.26.2.761.g0e0b3e54be-goog

2 1

oops
by impaqt 13 May '20

13 May '20

sorry, this isn't devel-subscribe...

1 0

sign me up
by impaqt 13 May '20

13 May '20

1 0

This Week in Spectrum, 2020-W19
by Alyssa Ross 10 May '20

10 May '20

This week, I want to give a special shoutout to Cole Helbling, who sent three patches to improve our documentation. Non-Alyssa Spectrum patches are quite rare at the moment, so it was very very nice to get these all at once. Thanks Cole! This week has mostly been tidying up loose ends and working on documentation. But there's some good, concrete progress as well. Website ------- <https://spectrum-os.org/> now links directly to my blog and This Week in Spectrum, so that people who come to the website can more easily see that development is ongoing and progress is being made[1]. I've also made it a little more obvious how to find the IRC channel and mailing lists from the homepage[2], because a conversation on the fediverse made me realise that wasn't clear at all before. Cole fixed the advice in the website's CONTRIBUTING file on sending patches for the website[3]. I had written to set Git's "sendemail.subjectPrefix" configuration option, but the option is actually called "format.subjectPrefix". Cole fixed a broken link[4], and I made the incorrect URL redirect to the right one as well, just in case. [1]: https://spectrum-os.org/git/www/commit/?id=8f37213cfd4d5dbd4a982bfc1899a3b3… [2]: https://spectrum-os.org/git/www/commit/?id=6d1ce779016cd84c0413b225355715e5… [3]: https://spectrum-os.org/git/www/commit/?id=8f37213cfd4d5dbd4a982bfc1899a3b3… [4]: https://spectrum-os.org/git/www/commit/?id=13c860e1e5bb02fce683012b851c4451… Developer manual ---------------- Did you know there's a developer manual[5] for Spectrum? There's not a lot in there yet, so for now it might not be all that useful, but it will be one day! I added a section about how to hack on Spectrum's crosvm, because it can be a bit non-obvious how to get up and running with it. I got some great feedback on it on IRC, and a diff from Cole with some fixes. Thanks to everybody who gave me feedback and helped get that documentation into shape. Setting up a crosvm build still isn't all that easy, but at least it's documented. [5]: https://spectrum-os.org/doc/developer-manual.html Infrastructure -------------- Two(?) people trying to clone all of Nixpkgs from the tiny VPS running spectrum-os.org caused the server to run out of memory and return 504 to those clones. It's quite important that people are able to get Spectrum's code, so I've arranged for the VPS to be upgraded with more memory, and so now I just need to reboot the machine so it picks it up. I plan on doing this tomorrow, since there's less likely to be mailing list traffic then than there is immediately after I send this. In the medium term I'll host all this stuff on a more sensible machine, because it's quite clear the workload on this server (which also runs some other stuff) is starting to get beyond the "tiny VPS" territory. IRC --- Activity in #spectrum has really picked up all of a sudden. Hundreds of messages were sent in the second half of this week, mostly talking either about Spectrum or about the future of secure computing in general, and I'm extremely here for all of it. The best thing is that I wasn't even around for most of these conversations! It's hugely motivating to me to feel that people are so interested in Spectrum, and it's great to have people with all sorts of useful knowledge and questions around. If you weren't there, I recommend actually checking out the logs from this period[6], because the conversations being had were just a great read full of interesting stuff. #spectrum feels like it's now at the point where you can start a discussion about secure computing, and be confident that you'll get at least a couple of extremely knowledgeable people involved in the conversation, and that's just fantastic. [6]: https://logs.spectrum-os.org/spectrum/2020-05-06 Wayfire ------- I replaced Sway in the test VM derivation with our newly packaged Wayfire. I was worried at first because wf-shell wasn't starting properly, but strace helped me realise that wf-shell likes HOME to be set, and I hadn't actually done that in the VMs yet. So now that works. There hasn't been much movement on my Wayfire PRs, or my PR to add Wayfire to upstream Nixpkgs, and that's down to me. I felt like after working on it all week last week, I needed a bit of a break. I'll try to get back to it next week so all those PRs can be gotten over the line. crosvm ------ I merged the latest crosvm changes from Google into Spectrum's crosvm tree. Doing this at the moment takes quite a while, because my work-in-progress "interguest" branch has about 50 commits that have to be rebased onto the new master, and quite a lot of those usually result in conflicts. This won't be as much of a problem once that code is ready to be included in master, because updating then will just be a single merge commit, but for now it's a bit of a pain, especially since I try to make sure every commit works. I haven't had much of a look over what's changed yet. There's usually at least one cool new toy to be excited about when I merge Google's crosvm, though, so I look forward to finding out what it is this time. I think that's it for this week, although honestly there have been so many different things going on I've probably missed something. Hopefully next week will be a bit more focused and I'll make more progress with interguest communication. This week, though, we've made some great improvements in several important areas. I'm optimistic that the increased IRC and patch volume are a sign of things to come. I'm looking forward to seeing where things will go from here. :)

1 1

[PATCH www] CONTRIBUTING: fix `git config` suggestion
by Cole Helbling 09 May '20

09 May '20

format-patch is the component that adds to the prefix, not send-email. --- CONTRIBUTING | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING b/CONTRIBUTING index 2f1f8b2..7ec8fba 100644 --- a/CONTRIBUTING +++ b/CONTRIBUTING @@ -23,8 +23,8 @@ automatically prepend a prefix to the subject line of every patch message sent by it in a given repository. You can configure it by running the following command in this Git repository: - git config sendemail.subjectPrefix "PATCH www" + git config format.subjectPrefix "PATCH www" From now on, git-send-email(1) will automatically add "[PATCH www]" to the start of every patch sent for this repository, instead of the -default "[PATCH]". \ No newline at end of file +default "[PATCH]". -- 2.26.2

2 1