[Qemu-commits] [qemu/qemu] 0958ee: virtiofsd: Allow to build it without the tools

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 0958ee89b6fb8542867ca68203626d6aef522e8f
      
https://github.com/qemu/qemu/commit/0958ee89b6fb8542867ca68203626d6aef522e8f
  Author: Wainer dos Santos Moschetta <wainersm@redhat.com>
  Date:   2021-02-16 (Tue, 16 Feb 2021)

  Changed paths:
    M tools/meson.build

  Log Message:
  -----------
  virtiofsd: Allow to build it without the tools

This changed the Meson build script to allow virtiofsd be built even
though the tools build is disabled, thus honoring the --enable-virtiofsd
option.

Fixes: cece116c939d219070b250338439c2d16f94e3da (configure: add option for 
virtiofsd)
Signed-off-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Message-Id: <20210201211456.1133364-2-wainersm@redhat.com>
Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 525a3030a82714693c2045d390b698dd4e2090bd
      
https://github.com/qemu/qemu/commit/525a3030a82714693c2045d390b698dd4e2090bd
  Author: Greg Kurz <groug@kaod.org>
  Date:   2021-02-16 (Tue, 16 Feb 2021)

  Changed paths:
    M tools/virtiofsd/fuse_virtio.c

  Log Message:
  -----------
  virtiofsd: vu_dispatch locking should never fail

pthread_rwlock_rdlock() and pthread_rwlock_wrlock() can fail if a
deadlock condition is detected or the current thread already owns
the lock. They can also fail, like pthread_rwlock_unlock(), if the
mutex wasn't properly initialized. None of these are ever expected
to happen with fv_VuDev::vu_dispatch_rwlock.

Some users already check the return value and assert, some others
don't. Introduce rdlock/wrlock/unlock wrappers that just do the
former and use them everywhere for improved consistency and
robustness.

This is just cleanup. It doesn't fix any actual issue.

Signed-off-by: Greg Kurz <groug@kaod.org>
Message-Id: <20210203182434.93870-1-groug@kaod.org>
Reviewed-by: Vivek Goyal <vgoyal@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: a65963efa3a8533e8c9fc62e899147612d913058
      
https://github.com/qemu/qemu/commit/a65963efa3a8533e8c9fc62e899147612d913058
  Author: Philippe Mathieu-Daudé <philmd@redhat.com>
  Date:   2021-02-16 (Tue, 16 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c
    M tools/virtiofsd/passthrough_seccomp.c

  Log Message:
  -----------
  tools/virtiofsd: Replace the word 'whitelist'

Follow the inclusive terminology from the "Conscious Language in your
Open Source Projects" guidelines [*] and replace the words "whitelist"
appropriately.

[*] https://github.com/conscious-lang/conscious-lang-docs/blob/main/faq.md

Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20210205171817.2108907-3-philmd@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 1e08f164e9fdc9528ad6990012301b9a04b0bc90
      
https://github.com/qemu/qemu/commit/1e08f164e9fdc9528ad6990012301b9a04b0bc90
  Author: Vivek Goyal <vgoyal@redhat.com>
  Date:   2021-02-16 (Tue, 16 Feb 2021)

  Changed paths:
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  virtiofsd: Save error code early at the failure callsite

Change error code handling slightly in lo_setattr(). Right now we seem
to jump to out_err and assume that "errno" is valid and use that to
send reply.

But if caller has to do some other operations before jumping to out_err,
then it does the dance of first saving errno to saverr and the restore
errno before jumping to out_err. This makes it more confusing.

I am about to make more changes where caller will have to do some
work after error before jumping to out_err. I found it easier to
change the convention a bit. That is caller saves error in "saverr"
before jumping to out_err. And out_err uses "saverr" to send error
back and does not rely on "errno" having actual error.

v3: Resolved conflicts in lo_setattr() due to lo_inode_open() changes.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20210208224024.43555-2-vgoyal@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: d64907acbf6e436099fd26fbb6312fd56f9fb29d
      
https://github.com/qemu/qemu/commit/d64907acbf6e436099fd26fbb6312fd56f9fb29d
  Author: Vivek Goyal <vgoyal@redhat.com>
  Date:   2021-02-16 (Tue, 16 Feb 2021)

  Changed paths:
    M tools/virtiofsd/fuse_common.h
    M tools/virtiofsd/fuse_lowlevel.c
    M tools/virtiofsd/fuse_lowlevel.h
    M tools/virtiofsd/passthrough_ll.c

  Log Message:
  -----------
  viriofsd: Add support for FUSE_HANDLE_KILLPRIV_V2

This patch adds basic support for FUSE_HANDLE_KILLPRIV_V2. virtiofsd
can enable/disable this by specifying option "-o killpriv_v2/no_killpriv_v2".
By default this is enabled as long as client supports it

Enabling this option helps with performance in write path. Without this
option, currently every write is first preceeded with a getxattr() operation
to find out if security.capability is set. (Write is supposed to clear
security.capability). With this option enabled, server is signing up for
clearing security.capability on every WRITE and also clearing suid/sgid
subject to certain rules. This gets rid of extra getxattr() call for every
WRITE and improves performance. This is true when virtiofsd is run with
option -o xattr.

What does enabling FUSE_HANDLE_KILLPRIV_V2 mean for file server implementation.
It needs to adhere to following rules. Thanks to Miklos for this summary.

- clear "security.capability" on write, truncate and chown unconditionally
- clear suid/sgid in case of following. Note, sgid is cleared only if
  group executable bit is set.
    o setattr has FATTR_SIZE and FATTR_KILL_SUIDGID set.
    o setattr has FATTR_UID or FATTR_GID
    o open has O_TRUNC and FUSE_OPEN_KILL_SUIDGID
    o create has O_TRUNC and FUSE_OPEN_KILL_SUIDGID flag set.
    o write has FUSE_WRITE_KILL_SUIDGID

>From Linux VFS client perspective, here are the requirements.

- caps are always cleared on chown/write/truncate
- suid is always cleared on chown, while for truncate/write it is cleared
  only if caller does not have CAP_FSETID.
- sgid is always cleared on chown, while for truncate/write it is cleared
  only if caller does not have CAP_FSETID as well as file has group execute
  permission.

virtiofsd implementation has not changed much to adhere to above ruls. And
reason being that current assumption is that we are running on Linux
and on top of filesystems like ext4/xfs which already follow above rules.
On write, truncate, chown, seucurity.capability is cleared. And virtiofsd
drops CAP_FSETID if need be and that will lead to clearing of suid/sgid.

But if virtiofsd is running on top a filesystem which breaks above assumptions,
then it will have to take extra actions to emulate above. That's a TODO
for later when need arises.

Note: create normally is supposed to be called only when file does not
      exist. So generally there should not be any question of clearing
      setuid/setgid. But it is possible that after client checks that
      file is not present, some other client creates file on server
      and this race can trigger sending FUSE_CREATE. In that case, if
      O_TRUNC is set, we should clear suid/sgid if FUSE_OPEN_KILL_SUIDGID
      is also set.

v3:
  - Resolved conflicts due to lo_inode_open() changes.
  - Moved capability code in lo_do_open() so that both lo_open() and
    lo_create() can benefit from common code.
  - Dropped changes to kernel headers as these are part of qemu already.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20210208224024.43555-3-vgoyal@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 26ec1909648e0c06ff06ebc3ddb2f88ebeeaa6a9
      
https://github.com/qemu/qemu/commit/26ec1909648e0c06ff06ebc3ddb2f88ebeeaa6a9
  Author: Vivek Goyal <vgoyal@redhat.com>
  Date:   2021-02-16 (Tue, 16 Feb 2021)

  Changed paths:
    M tools/virtiofsd/fuse_lowlevel.c

  Log Message:
  -----------
  virtiofsd: Do not use a thread pool by default

Currently we created a thread pool (With 64 max threads per pool) for
each virtqueue. We hoped that this will provide us with better scalability
and performance.

But in practice, we are getting better numbers in most of the cases
when we don't create a thread pool at all and a single thread per
virtqueue receives the request and processes it.

Hence, I am proposing that we switch to no thread pool by default
(equivalent of --thread-pool-size=0). This will provide out of
box better performance to most of the users. In fact other users
have confirmed that not using a thread pool gives them better
numbers. So why not use this as default. It can be changed when
somebody can fix the issues with thread pool performance.

Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
Message-Id: <20210210182744.27324-2-vgoyal@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>


  Commit: 1af5629673bb5c1592d993f9fb6119a62845f576
      
https://github.com/qemu/qemu/commit/1af5629673bb5c1592d993f9fb6119a62845f576
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2021-02-17 (Wed, 17 Feb 2021)

  Changed paths:
    M tools/meson.build
    M tools/virtiofsd/fuse_common.h
    M tools/virtiofsd/fuse_lowlevel.c
    M tools/virtiofsd/fuse_lowlevel.h
    M tools/virtiofsd/fuse_virtio.c
    M tools/virtiofsd/passthrough_ll.c
    M tools/virtiofsd/passthrough_seccomp.c

  Log Message:
  -----------
  Merge remote-tracking branch 
'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210216' into staging

virtiofsd pull 2021-02-16

Vivek's support for new FUSE KILLPRIV_V2
and some smaller cleanups.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

# gpg: Signature made Tue 16 Feb 2021 18:34:32 GMT
# gpg:                using RSA key 45F5C71B4A0CB7FB977A9FA90516331EBC5BFDE7
# gpg: Good signature from "Dr. David Alan Gilbert (RH2) <dgilbert@redhat.com>" 
[full]
# Primary key fingerprint: 45F5 C71B 4A0C B7FB 977A  9FA9 0516 331E BC5B FDE7

* remotes/dgilbert-gitlab/tags/pull-virtiofs-20210216:
  virtiofsd: Do not use a thread pool by default
  viriofsd: Add support for FUSE_HANDLE_KILLPRIV_V2
  virtiofsd: Save error code early at the failure callsite
  tools/virtiofsd: Replace the word 'whitelist'
  virtiofsd: vu_dispatch locking should never fail
  virtiofsd: Allow to build it without the tools

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/f0f75dc174b6...1af5629673bb