- Spectrum Development - spectrum-os.org

[PATCH 1/2] Busybox modprobe is banned
by Alyssa Ross 22 Mar '22

22 Mar '22

Trying to use modprobe from Busybox has caused nothing but problems. The latest issue is that it doesn't implement softdep at all. rootfs.ext4 before: 509M rootfs.ext4 after: 513M Thanks-to: Puck Meerburg <puck(a)puckipedia.com> --- host/initramfs/default.nix | 8 +++++++- host/rootfs/default.nix | 10 ++++++++-- vm/app/catgirl/default.nix | 15 +++++++++++++-- vm/app/lynx/default.nix | 15 +++++++++++++-- vm/sys/net/default.nix | 15 +++++++++++++-- 5 files changed, 54 insertions(+), 9 deletions(-) diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix index b207ace..5ce198a 100644 --- a/host/initramfs/default.nix +++ b/host/initramfs/default.nix @@ -16,7 +16,7 @@ let linux = rootfs.kernel; packages = [ - pkgsStatic.mdevd pkgsStatic.execline + pkgsStatic.execline pkgsStatic.kmod pkgsStatic.mdevd (pkgsStatic.cryptsetup.override { programs = { @@ -29,7 +29,13 @@ let (busybox.override { enableStatic = true; extraConfig = '' + CONFIG_DEPMOD n CONFIG_FINDFS n + CONFIG_INSMOD n + CONFIG_LSMOD n + CONFIG_MODINFO n + CONFIG_MODPROBE n + CONFIG_RMMOD n ''; }) ]; diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index b9fabee..2f2c368 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -4,7 +4,7 @@ { pkgs ? import <nixpkgs> {} }: pkgs.pkgsStatic.callPackage ( { lib, stdenv, runCommand, writeReferencesToFile, s6-rc, tar2ext4 -, busybox, cloud-hypervisor, cryptsetup, execline, jq, mdevd, s6 +, busybox, cloud-hypervisor, cryptsetup, execline, jq, kmod, mdevd, s6 , s6-linux-utils, s6-portable-utils, socat, util-linuxMinimal, xorg }: @@ -20,7 +20,7 @@ let foot = pkgsGui.foot.override { allowPgo = false; }; packages = [ - cloud-hypervisor execline jq mdevd s6 s6-linux-utils + cloud-hypervisor execline jq kmod mdevd s6 s6-linux-utils s6-portable-utils s6-rc socat start-vm (cryptsetup.override { @@ -33,8 +33,14 @@ let (busybox.override { extraConfig = '' + CONFIG_DEPMOD n CONFIG_FINDFS n CONFIG_INIT n + CONFIG_INSMOD n + CONFIG_LSMOD n + CONFIG_MODINFO n + CONFIG_MODPROBE n + CONFIG_RMMOD n ''; }) ] ++ (with pkgsGui; [ foot westonLite ]); diff --git a/vm/app/catgirl/default.nix b/vm/app/catgirl/default.nix index ed897eb..716e7dd 100644 --- a/vm/app/catgirl/default.nix +++ b/vm/app/catgirl/default.nix @@ -9,7 +9,7 @@ pkgs.pkgsStatic.callPackage ( { lib, stdenv, runCommand, writeReferencesToFile, buildPackages , s6-rc, tar2ext4 -, busybox, cacert, catgirl, execline, mdevd, s6, s6-linux-utils +, busybox, cacert, catgirl, execline, kmod, mdevd, s6, s6-linux-utils , s6-portable-utils }: @@ -17,7 +17,18 @@ let inherit (lib) cleanSource cleanSourceWith concatMapStringsSep; packages = [ - busybox catgirl execline mdevd s6 s6-linux-utils s6-portable-utils s6-rc + catgirl execline kmod mdevd s6 s6-linux-utils s6-portable-utils s6-rc + + (busybox.override { + extraConfig = '' + CONFIG_DEPMOD n + CONFIG_INSMOD n + CONFIG_LSMOD n + CONFIG_MODINFO n + CONFIG_MODPROBE n + CONFIG_RMMOD n + ''; + }) ]; packagesSysroot = runCommand "packages-sysroot" { diff --git a/vm/app/lynx/default.nix b/vm/app/lynx/default.nix index 90fda0f..72bff7f 100644 --- a/vm/app/lynx/default.nix +++ b/vm/app/lynx/default.nix @@ -9,7 +9,7 @@ pkgs.pkgsStatic.callPackage ( { lib, stdenv, runCommand, writeReferencesToFile, buildPackages , s6-rc, tar2ext4 -, busybox, cacert, execline, lynx, mdevd, s6, s6-linux-utils +, busybox, cacert, execline, kmod, lynx, mdevd, s6, s6-linux-utils , s6-portable-utils }: @@ -17,7 +17,18 @@ let inherit (lib) cleanSource cleanSourceWith concatMapStringsSep; packages = [ - busybox execline lynx mdevd s6 s6-linux-utils s6-portable-utils s6-rc + execline kmod lynx mdevd s6 s6-linux-utils s6-portable-utils s6-rc + + (busybox.override { + extraConfig = '' + CONFIG_DEPMOD n + CONFIG_INSMOD n + CONFIG_LSMOD n + CONFIG_MODINFO n + CONFIG_MODPROBE n + CONFIG_RMMOD n + ''; + }) ]; packagesSysroot = runCommand "packages-sysroot" { diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index a9e1fdc..62a13bb 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -9,7 +9,7 @@ pkgs.pkgsStatic.callPackage ( { lib, stdenv, runCommand, writeReferencesToFile, buildPackages , s6-rc, tar2ext4, xorg -, busybox, connmanMinimal, dbus, execline, mdevd, nftables, s6 +, busybox, connmanMinimal, dbus, execline, kmod, mdevd, nftables, s6 , s6-linux-utils, s6-portable-utils }: @@ -19,9 +19,20 @@ let connman = connmanMinimal; packages = [ - busybox connman dbus execline mdevd s6 s6-linux-utils + connman dbus execline kmod mdevd s6 s6-linux-utils s6-portable-utils s6-rc + (busybox.override { + extraConfig = '' + CONFIG_DEPMOD n + CONFIG_INSMOD n + CONFIG_LSMOD n + CONFIG_MODINFO n + CONFIG_MODPROBE n + CONFIG_RMMOD n + ''; + }) + (nftables.override { withCli = false; }) ]; -- 2.35.1

2 3

[PATCH] use statically linked cryptsetup in initramfs
by Yureka 16 Feb '22

16 Feb '22

--- host/initramfs/default.nix | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/host/initramfs/default.nix b/host/initramfs/default.nix index ba6ede2..91e598f 100644 --- a/host/initramfs/default.nix +++ b/host/initramfs/default.nix @@ -2,15 +2,38 @@ { lib, stdenv, runCommand, writeReferencesToFile, pkgsStatic , busybox, cpio, cryptsetup, linux, lvm2 +, fetchpatch }: -let - cryptsetup' = cryptsetup; -in let inherit (lib) cleanSource cleanSourceWith concatMapStringsSep; - cryptsetup = cryptsetup'.override { lvm2 = lvm2.override { udev = null; }; }; + # https://github.com/NixOS/nixpkgs/pull/148948 + cryptsetup = (pkgsStatic.cryptsetup.override { + lvm2 = (pkgsStatic.lvm2.override { + udev = null; + }).overrideAttrs (old: { + patches = (old.patches or []) ++ [ + (fetchpatch { + url = "https://raw.githubusercontent.com/NixOS/nixpkgs/bf8b0d818a6c5fa65f318603756…"; + sha256 = "sha256-t67Osvcn92R7q9V+KDW+SyJDmajzVbnTPONlokcBU9U="; + }) + ]; + configureFlags = old.configureFlags ++ [ "--enable-static_link" ]; + makeFlags = old.makeFlags ++ [ "libdm.device-mapper" ]; + installPhase = '' + install -D -t $out/lib libdm/ioctl/libdevmapper.a + make -C libdm install_include + make -C libdm install_pkgconfig + ''; + outputs = [ "out" ]; + }); + }).overrideAttrs (old: { + NIX_LDFLAGS = ""; + configureFlags = old.configureFlags ++ [ + "--enable-static-cryptsetup" + ]; + }); packages = [ cryptsetup pkgsStatic.mdevd pkgsStatic.execline -- 2.34.0

2 1

[PATCH] installer: operate on FAT image directly
by Alyssa Ross 01 Feb '22

01 Feb '22

--- It feels cleaner to me to operate directly on the FAT image, rather than constructing the directory on the build filesystem and then copying it into the FAT image at the end. But, I'm wondering if maybe there's a reason it's better to do it the other way that I've missed? installer/default.nix | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/installer/default.nix b/installer/default.nix index f7e84ac..0818091 100644 --- a/installer/default.nix +++ b/installer/default.nix @@ -24,6 +24,7 @@ let esp = runCommand "esp.img" { nativeBuildInputs = [ grub libfaketime dosfstools mtools ]; + grubTargetDir = "${grub}/lib/grub/${grub.grubTarget}"; # Definition copied from util/grub-install-common.c. # Last checked: GRUB 2.06 pkglib_DATA = [ @@ -31,23 +32,23 @@ let "parttool.lst" "video.lst" "crypto.lst" "terminal.lst" "modinfo.sh" ]; } '' - mkdir -p files/grub/${grub.grubTarget} - cp ${grubCfg} files/grub/grub.cfg - cp ${grub}/lib/grub/${grub.grubTarget}/*.mod files/grub/${grub.grubTarget} + truncate -s 15M $out + faketime "1970-01-01 00:00:00" mkfs.vfat -i 0x2178694e -n EFI $out + mmd -i $out ::/EFI ::/EFI/BOOT \ + ::/grub ::/grub/${grub.grubTarget} ::/grub/fonts + + mcopy -i $out ${grubCfg} ::/grub/grub.cfg + mcopy -i $out $grubTargetDir/*.mod ::/grub/${grub.grubTarget} for file in $pkglib_DATA; do - path="${grub}/lib/grub/${grub.grubTarget}/$file" - ! [ -e "$path" ] || cp "$path" files/grub/${grub.grubTarget} + path="$grubTargetDir/$file" + ! [ -e "$path" ] || mcopy -i $out "$path" ::/grub/${grub.grubTarget} done + mcopy -i $out ${grub}/share/grub/unicode.pf2 ::/grub/fonts - install -D ${grub}/share/grub/unicode.pf2 files/grub/fonts/unicode.pf2 grub-mkimage -o grubx64.efi -p "(hd0,gpt1)/grub" -O ${grub.grubTarget} part_gpt fat - install -D grubx64.efi files/EFI/BOOT/BOOTX64.EFI + mcopy -i $out grubx64.efi ::/EFI/BOOT/BOOTX64.EFI - img=$out - truncate -s 15M $img - faketime "1970-01-01 00:00:00" mkfs.vfat -i 0x2178694e -n EFI $img - (cd files; mcopy -psvm -i $img ./* ::) - fsck.vfat -vn $img + fsck.vfat -n $out ''; installer = runCommand "installer.img" { -- 2.33.0

1 0

[PATCH] installer: more closely match grub-install
by Alyssa Ross 12 Jan '22

12 Jan '22

The main motivation here is that I noticed we're installing a lot of *.module files that grub-install didn't include. After this change, we're still differing from what grub-install does in the following ways: • Locale files are still not included • grub/x86_64-efi/core.efi or grub/x86_64-efi/grub.efi are not included. I'm not sure where those executables come from, but they don't seem to be required. • We're still not creating a grubenv file, which should be fine because there's no data that might need to be persisted anyway. --- installer/default.nix | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/installer/default.nix b/installer/default.nix index 9fc7493..f7e84ac 100644 --- a/installer/default.nix +++ b/installer/default.nix @@ -24,10 +24,22 @@ let esp = runCommand "esp.img" { nativeBuildInputs = [ grub libfaketime dosfstools mtools ]; + # Definition copied from util/grub-install-common.c. + # Last checked: GRUB 2.06 + pkglib_DATA = [ + "efiemu32.o" "efiemu64.o" "moddep.lst" "command.lst" "fs.lst" "partmap.lst" + "parttool.lst" "video.lst" "crypto.lst" "terminal.lst" "modinfo.sh" + ]; } '' - install -D ${grubCfg} files/grub/grub.cfg - cp -r ${grub}/lib/grub/${grub.grubTarget} files/grub/ - cp ${grub}/share/grub/unicode.pf2 files/grub/ + mkdir -p files/grub/${grub.grubTarget} + cp ${grubCfg} files/grub/grub.cfg + cp ${grub}/lib/grub/${grub.grubTarget}/*.mod files/grub/${grub.grubTarget} + for file in $pkglib_DATA; do + path="${grub}/lib/grub/${grub.grubTarget}/$file" + ! [ -e "$path" ] || cp "$path" files/grub/${grub.grubTarget} + done + + install -D ${grub}/share/grub/unicode.pf2 files/grub/fonts/unicode.pf2 grub-mkimage -o grubx64.efi -p "(hd0,gpt1)/grub" -O ${grub.grubTarget} part_gpt fat install -D grubx64.efi files/EFI/BOOT/BOOTX64.EFI base-commit: 907294e4a85e77e5db116a73ecfdf9a406be663b -- 2.33.0

1 0

[PATCH] fix imports after repo merge
by Yureka 16 Dec '21

16 Dec '21

--- host/initramfs/extfs.nix | 6 +++--- host/initramfs/live.nix | 2 +- host/rootfs/default.nix | 6 +++--- installer/default.nix | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/host/initramfs/extfs.nix b/host/initramfs/extfs.nix index b26f6e1..c50df21 100644 --- a/host/initramfs/extfs.nix +++ b/host/initramfs/extfs.nix @@ -1,17 +1,17 @@ { pkgs, runCommand, s6-rc, tar2ext4 }: let - netvm = import ../spectrum-netvm { + netvm = import ../../vm/sys/net { inherit pkgs; # inherit (foot) terminfo; }; - appvm-catgirl = import ../spectrum-appvm-catgirl { + appvm-catgirl = import ../../vm/app/catgirl { inherit pkgs; # inherit (foot) terminfo; }; - appvm-lynx = import ../spectrum-appvm-lynx { + appvm-lynx = import ../../vm/app/lynx { inherit pkgs; # inherit (foot) terminfo; }; diff --git a/host/initramfs/live.nix b/host/initramfs/live.nix index 27d868b..6446593 100644 --- a/host/initramfs/live.nix +++ b/host/initramfs/live.nix @@ -6,7 +6,7 @@ let initramfs = callPackage ./. { }; - host-rootfs = import ../spectrum-rootfs { inherit pkgs; }; + host-rootfs = import ../rootfs { inherit pkgs; }; extfs = pkgsStatic.callPackage ./extfs.nix { inherit pkgs; }; kernelTarget = stdenv.hostPlatform.linux-kernel.target; diff --git a/host/rootfs/default.nix b/host/rootfs/default.nix index fc347aa..21a9818 100644 --- a/host/rootfs/default.nix +++ b/host/rootfs/default.nix @@ -62,17 +62,17 @@ let -T ${writeReferencesToFile packagesSysroot} . ''; - netvm = import ../spectrum-netvm { + netvm = import ../../vm/sys/net { inherit pkgs; inherit (foot) terminfo; }; - appvm-catgirl = import ../spectrum-appvm-catgirl { + appvm-catgirl = import ../../vm/app/catgirl { inherit pkgs; inherit (foot) terminfo; }; - appvm-lynx = import ../spectrum-appvm-lynx { + appvm-lynx = import ../../vm/app/lynx { inherit pkgs; inherit (foot) terminfo; }; diff --git a/installer/default.nix b/installer/default.nix index 183a962..0685bdd 100644 --- a/installer/default.nix +++ b/installer/default.nix @@ -8,7 +8,7 @@ let inherit (pkgs.lib) removePrefix; inherit (nixos ./configuration.nix) config; - image = import ../spectrum-initramfs/live.nix { inherit pkgs; }; + image = import ../host/initramfs/live.nix { inherit pkgs; }; grub = grub2_efi; -- 2.34.0

2 1

[PATCH 1/2] increase partition sizes
by Yureka 16 Dec '21

16 Dec '21

--- host/initramfs/live.nix | 2 +- installer/default.nix | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/host/initramfs/live.nix b/host/initramfs/live.nix index 6446593..5dc4f87 100644 --- a/host/initramfs/live.nix +++ b/host/initramfs/live.nix @@ -29,7 +29,7 @@ let nativeBuildInputs = [ dosfstools mtools ]; passthru = { inherit uki; }; } '' - truncate -s ${toString (100 * 1024 * 1024)} $out + truncate -s ${toString (150 * 1024 * 1024)} $out mkfs.vfat $out mmd -i $out ::/EFI ::/EFI/BOOT mcopy -i $out ${uki} ::/EFI/BOOT/BOOTX64.EFI diff --git a/installer/default.nix b/installer/default.nix index 0685bdd..39933d9 100644 --- a/installer/default.nix +++ b/installer/default.nix @@ -35,7 +35,7 @@ let eosimages = vmTools.runInLinuxVM (runCommand "eosimages.img" { nativeBuildInputs = [ exfatprogs kmod util-linux ]; } '' - truncate -s 4G "$out" + truncate -s 5G "$out" mkfs.exfat -L eosimages "$out" mkdir /mnt modprobe loop -- 2.34.0

2 2

[PATCH linux] usbip: tools: usbipd: implement authorization
by Alyssa Ross 18 Oct '21

18 Oct '21

Devices are filtered before all usbipd operations, so that to each client, it's as if the only usbip-able devices are the ones it's been authorized to see. Authorizing a client is as simple as e.g.: ln -s /sys/bus/usb/devices/3-2.2 /var/run/usbipd/2001:db8::1/ Which will make the USB device 3-2.2 available to the client connecting from 2001:db8::1. I selected this filesystem based mechanism because of its simplicity to implement -- no need to parse any files, and granting and revoking permissions is atomic. Technically, it doesn't matter what's actually at that path, as long as it exists, but I've chosen to require it to be a symlink into sysfs, because I think that's the most clear, and actually checking that minimizes valid states, which is generally good practice. Currently, only IP addresses are supported (IPv4 and IPv6). It would be possible to extend this to support hostnames as well, but that would require various additional security considerations. This shouldn't make a difference to any USB functionality when a client _is_ authorized, but just to make sure, I've tested with various USB 2 and USB 3 devices, including hubs. Signed-off-by: Alyssa Ross <hi(a)alyssa.is> --- tools/usb/usbip/src/usbipd.c | 112 +++++++++++++++++++++++++++++++---- 1 file changed, 100 insertions(+), 12 deletions(-) diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c index 48398a78e88a..c380e785106f 100644 --- a/tools/usb/usbip/src/usbipd.c +++ b/tools/usb/usbip/src/usbipd.c @@ -16,6 +16,7 @@ #include <unistd.h> #include <netdb.h> #include <string.h> +#include <stdbool.h> #include <stdlib.h> #include <sys/types.h> #include <sys/stat.h> @@ -45,6 +46,7 @@ #define MAIN_LOOP_TIMEOUT 10 #define DEFAULT_PID_FILE "/var/run/" PROGNAME ".pid" +#define PROG_STATE_PATH "/var/run/" PROGNAME static const char usbip_version_string[] = PACKAGE_STRING; @@ -57,6 +59,14 @@ static const char usbipd_help_string[] = " -6, --ipv6\n" " Bind to IPv6. Default is both.\n" "\n" + " -A, --authorization\n" + " Apply authorization rules to clients. Clients\n" + " will only be able to attach to devices, or see\n" + " devices in the device list, that they are\n" + " authorized to access. To authorize a client to\n" + " access a device:\n" + " ln -s /sys/bus/usb/devices/$USB_PATH " PROG_STATE_PATH "/auth/$CLIENT_IP/\n" + "\n" " -e, --device\n" " Run in device mode.\n" " Rather than drive an attached device, create\n" @@ -82,12 +92,78 @@ static const char usbipd_help_string[] = " Show version.\n"; static struct usbip_host_driver *driver; +static bool enable_authorization; static void usbipd_help(void) { printf("%s\n", usbipd_help_string); } +static bool device_visible(struct usbip_exported_device *edev, int connfd) +{ + bool r = false; + int e; + struct sockaddr *addr = NULL; + socklen_t addr_len = 0; + char name[NI_MAXHOST]; + char *path = NULL, *real_path = NULL; + char *expected_path = NULL, *expected_real_path = NULL; + + if (!enable_authorization) + return true; + + if (getpeername(connfd, NULL, &addr_len) == -1) + goto err; + if (!(addr = malloc(addr_len))) + goto err; + if (getpeername(connfd, addr, &addr_len) == -1) + goto err; + + if ((e = getnameinfo(addr, addr_len, + name, sizeof name, NULL, 0, NI_NUMERICHOST))) { + err("getting name of peer: %s", gai_strerror(e)); + goto out; + } + + // Since we're mandating numeric hosts, we don't have to worry + // about what happens if name contains things like slashes. + // If we were to use names as well, we might have to be more + // careful, and use openat2, etc. + if (asprintf(&path, "%s/auth/%s/%s", + PROG_STATE_PATH, name, edev->udev.busid) == -1) + goto err; + + if (!(real_path = realpath(path, NULL))) { + if (errno == ENOENT) + goto out; + goto err; + } + + if (asprintf(&expected_path, "/sys/bus/usb/devices/%s", + edev->udev.busid) == -1) + goto err; + + if (!(expected_real_path = realpath(expected_path, NULL))) + goto err; + + r = !strcmp(real_path, expected_real_path); + goto out; + +err: + err("checking device visibility: %s", strerror(errno)); +out: + free(addr); + free(path); + free(real_path); + free(expected_path); + free(expected_real_path); + return r; +} + +#define CHECK_DEVICE_VISIBILITY(edev, connfd) \ + if (!device_visible(edev, connfd)) \ + continue + static int recv_request_import(int sockfd) { struct op_import_request req; @@ -109,6 +185,7 @@ static int recv_request_import(int sockfd) list_for_each(i, &driver->edev_list) { edev = list_entry(i, struct usbip_exported_device, node); + CHECK_DEVICE_VISIBILITY(edev, sockfd); if (!strncmp(req.busid, edev->udev.busid, SYSFS_BUS_ID_SIZE)) { info("found requested device: %s", req.busid); found = 1; @@ -176,6 +253,7 @@ static int send_reply_devlist(int connfd) /* number of exported devices */ list_for_each(j, &driver->edev_list) { edev = list_entry(j, struct usbip_exported_device, node); + CHECK_DEVICE_VISIBILITY(edev, connfd); if (edev->status != SDEV_ST_USED) reply.ndev += 1; } @@ -196,6 +274,7 @@ static int send_reply_devlist(int connfd) list_for_each(j, &driver->edev_list) { edev = list_entry(j, struct usbip_exported_device, node); + CHECK_DEVICE_VISIBILITY(edev, connfd); if (edev->status == SDEV_ST_USED) continue; @@ -586,17 +665,18 @@ static int do_standalone_mode(int daemonize, int ipv4, int ipv6) int main(int argc, char *argv[]) { static const struct option longopts[] = { - { "ipv4", no_argument, NULL, '4' }, - { "ipv6", no_argument, NULL, '6' }, - { "daemon", no_argument, NULL, 'D' }, - { "daemon", no_argument, NULL, 'D' }, - { "debug", no_argument, NULL, 'd' }, - { "device", no_argument, NULL, 'e' }, - { "pid", optional_argument, NULL, 'P' }, - { "tcp-port", required_argument, NULL, 't' }, - { "help", no_argument, NULL, 'h' }, - { "version", no_argument, NULL, 'v' }, - { NULL, 0, NULL, 0 } + { "ipv4", no_argument, NULL, '4' }, + { "ipv6", no_argument, NULL, '6' }, + { "authorization", no_argument, NULL, 'A' }, + { "daemon", no_argument, NULL, 'D' }, + { "daemon", no_argument, NULL, 'D' }, + { "debug", no_argument, NULL, 'd' }, + { "device", no_argument, NULL, 'e' }, + { "pid", optional_argument, NULL, 'P' }, + { "tcp-port", required_argument, NULL, 't' }, + { "help", no_argument, NULL, 'h' }, + { "version", no_argument, NULL, 'v' }, + { NULL, 0, NULL, 0 } }; enum { @@ -620,7 +700,7 @@ int main(int argc, char *argv[]) cmd = cmd_standalone_mode; driver = &host_driver; for (;;) { - opt = getopt_long(argc, argv, "46DdeP::t:hv", longopts, NULL); + opt = getopt_long(argc, argv, "46ADdeP::t:hv", longopts, NULL); if (opt == -1) break; @@ -632,6 +712,9 @@ int main(int argc, char *argv[]) case '6': ipv6 = 1; break; + case 'A': + enable_authorization = true; + break; case 'D': daemonize = 1; break; @@ -663,6 +746,11 @@ int main(int argc, char *argv[]) if (!ipv4 && !ipv6) ipv4 = ipv6 = 1; + if (enable_authorization && driver != &host_driver) { + err("authorization is only supported when using host driver"); + goto err_out; + } + switch (cmd) { case cmd_standalone_mode: rc = do_standalone_mode(daemonize, ipv4, ipv6); base-commit: 620b74d01b9d4393bef6742bf121908322c2fe0b -- 2.33.0

1 0

[DEMO PATCH linux 0/3] usbip: tools: support USB over vsock(7)
by Alyssa Ross 13 Oct '21

13 Oct '21

This series implements USB over VSOCK sockets, as an alternative to USB over IP. This would allow, for example, a host system to share its USB controller with a VM over VFIO, and then selectively attach to certain specific USB devices exported by the VM over a VSOCK connection. If inter-guest VSOCK were to be implemented in the kernel, or using a program like vsock-bridge[1] or socat[2], USB devices could also be shared between VMs in this way, without having to have a full-on networking setup between those VMs. I've taken different approaches to implement the VSOCK support in each of the usbip client and server. For the server, I added a new program, in.usbipd, that implements an inetd-style interface, taking a socket from its environment. This way, the socket could be a TCP socket, a VSOCK socket, or something else entirely, and the program doesn't have to care. The usbip client, on the other hand, cares about what type of socket it's communicating over, because it records address information for the remote server. Since this meant I had to teach it about VSOCK anyway, to tell it how to find that information for VSOCK sockets, it was easier to just extend the existing program with an option to choose an alternative protocol family than to have it take a socket from its environment. I've tested this series by running in.usbipd in a NixOS VM, and then attaching a device from it to my host system. The following NixOS configuration sets up an in.usbipd service listening on a VSOCK socket: systemd.sockets.usbipd = { wantedBy = [ "sockets.target" ]; listenStreams = [ "vsock::3240" ]; socketConfig.Accept = "yes"; }; systemd.services."usbipd@" = { serviceConfig.ExecStart = "${usbip}/bin/in.usbipd"; serviceConfig.StandardInput = "socket"; serviceConfig.StandardOutput = "socket"; serviceConfig.StandardError = "journal"; }; [1]: https://github.com/stefano-garzarella/vsock-bridge [2]: http://www.dest-unreach.org/socat/ Alyssa Ross (3): usbip: tools: in.usbipd: add usbip: tools: usbip: record protocol usbip: tools: usbip: support vsock(7) connections tools/usb/usbip/libsrc/vhci_driver.c | 26 ++- tools/usb/usbip/src/Makefile.am | 4 +- tools/usb/usbip/src/in.usbipd.c | 326 +++++++++++++++++++++++++++ tools/usb/usbip/src/usbip_attach.c | 54 ++++- tools/usb/usbip/src/usbip_list.c | 43 +++- tools/usb/usbip/src/usbip_network.c | 51 ++++- tools/usb/usbip/src/usbip_network.h | 4 +- 7 files changed, 470 insertions(+), 38 deletions(-) create mode 100644 tools/usb/usbip/src/in.usbipd.c base-commit: 620b74d01b9d4393bef6742bf121908322c2fe0b -- 2.32.0

1 3

This Week in Spectrum, 2021-W33
by Alyssa Ross 22 Aug '21

22 Aug '21

Hi! I've had a busy day today and am pretty tired, so I'm not sure how coherent my writing is at the moment. But I'd rather get this out on time, especially since tomorrow is also busy today. As I said last week[1], I took some time off this week as a preventative measure against burnout. [1]: https://spectrum-os.org/lists/archives/spectrum-devel/87lf51ybwk.fsf@alyssa… rust-vmm -------- One of my patches[2] was accepted, but another[3] is still waiting. As I said last week, I have more fixes for rust-vmm planned, but want to let them catch up with the changes I've already sent upstream first so I know what base I'm using for the next stuff. I expect the one that's still waiting to be accepted next week. [2]: https://github.com/rust-vmm/vmm-sys-util/pull/135 [3]: https://github.com/rust-vmm/vhost/pull/69 spectrum-live ------------- Last week, I'd just integrated dm-verity into the Spectrum live image I've been working on. When it came time to work on the actual root filesystem, instead of the initramfs, I hit a bit of a brick wall. I realised that trying to generate a whole operating system image using Nix was giving me real writers' block. There was too much inbetween me and how the files ended up on disk, and that meant there was too much overhead to keep in mind when I was thinking about how things should be designed and laid out. It might feel like making a Linux root filesystem should be a solved problem, but Spectrum has a bunch of special requirements. You might want to do something like start a VM for each hardware device of a specific type, and that's something that isn't really addressed by most standard stuff. All this stuff is definitely solveable, but it requires some experimentation to get right, and Nix was getting a bit in the way of that. So I created a new directory, and I wrote a Makefile that builds an ext4 image, and I just started putting files in an etc/ directory. This made reasoning about the system way easier, and I was immediately making progress. Nix is great for building known targets, and for making customisable systems (there's no way my Makefile-based system would allow the amount of customisation I'd easily be able to provide with Nix), but for experimentation, it's a lot nicer to be closer to the end product. So once I know how all this should look I'll make it Nix-aware. Currently, I have a root filesystem with a service manager that can respond to hardware appearing and disappearing. The next (more exciting) step will be to have it start some VMs, and assign hardware to them appropriately. I'm looking forward to getting to that next week. An interesting challenge I'll have to solve will be figuring out simple categories (e.g. "ethernet device") from the huge amount of very specific information the kernel provides. I think I might be able abuse the modules.alias file from the kernel, that defines the mappings from PCI etc. information to default drivers. Then all I'll have to do will be to write mappings from default drivers to whatever categories I come up with, or what VM I want to assign them to, or whatever. One neat thing I'm using for the first time here is tar2ext4[4], a utility program that's part of a larger Microsoft open source project I don't entirely understand the purpose of. It's really useful for me it builds ext4 images entirely in userspace, which will be great for using in Nix derivations where it's not possible to just mount an ext4 image and write directly to it. For previous Spectrum experiments, I'd always used SquashFS[5], entirely because I already knew of a tar2sqfs program[6] that made creating filesystem images really easy. I've added tar2ext4 to Nixpkgs[7], which will hopefully help other people who have similar problems discover it. [4]: https://github.com/microsoft/hcsshim/blob/master/cmd/tar2ext4/tar2ext4.go [5]: https://en.wikipedia.org/wiki/SquashFS [6]: https://github.com/AgentD/squashfs-tools-ng [7]: https://github.com/NixOS/nixpkgs/pull/134650 musl ---- While I was working on the root filesystem, I noticed that mount -a, which mounts all filesystems described in fstab(5), wasn't working. This turned out to be because of a bug in Musl's implementation of getmntent(3), a libc function for parsing fstab files. So I wrote some tests and a fix and sent them to Musl[8]. [8]: https://inbox.vuxu.org/musl/20210821085420.474615-1-hi@alyssa.is/ Hope that all made sense. Next week, I'll continue working on Spectrum live, and maybe fix the next rust-vmm issue I have on my todo list if my final outstanding PR is merged.

1 0

[PATCH www] todo.html: refresh
by Alyssa Ross 21 Aug '21

21 Aug '21

The old tasks listed here aren't really relevant any more. But I would love me a static veritysetup -- it would massively reduce initramfs size. --- todo.html | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/todo.html b/todo.html index 67cf072..dc768e3 100644 --- a/todo.html +++ b/todo.html @@ -1,5 +1,5 @@ <!doctype html> - +   <html lang="en"> @@ -44,23 +44,12 @@ might be able to help out. <ol> <li> - Implement - <a href="https://wayland.freedesktop.org/docs/html/apa.html#protocol-spec-wl_composi…">wl_compositor - v4</a> in - <a href="https://spectrum-os.org/doc/developer-manual.html#_sommelier">Sommelier</a>. - This will mean we no longer have to - <a href="https://spectrum-os.org/git/nixpkgs/tree/pkgs/development/libraries/wlroots…">patch</a> - wlroots to downgrade it to an older protocol. - - <li> - Implement a ceiling for host memory allocated by the - crosvm <a href="https://spectrum-os.org/doc/developer-manual.html#_the_memfd_server">memfd - server</a>. - - <li> - Create a minimal VM kernel configuration. This will make it much - easier to iterate on the VM kernel, by substantially reducing clean - build times. + <a href="https://github.com/NixOS/nixpkgs/issues/134948">nixpkgs + #134984</a>: cryptsetup cannot be built statically. This would let + us massively reduce the size of Spectrum's initramfs. For Spectrum, + we only need the <code>veritysetup</code> program from that package + at the moment, so it's okay for us if other features have to be + disabled to make static linking work. </ol> <p> -- 2.32.0

2 2