1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 156e43f5cd..40637a16f6 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -13577,6 +13577,12 @@ virDomainVideoModelDefParseXML(virDomainVideoDef *def,
if (virXMLPropTristateSwitch(node, "blob", VIR_XML_PROP_NONE, &def->blob) < 0)
return -1;
+ if (virXMLPropUInt(node, "hostmem", 10, VIR_XML_PROP_NONE, &def->hostmem) < 0)
+ return -1;
+
+ if (virXMLPropTristateSwitch(node, "venus", VIR_XML_PROP_NONE, &def->venus) < 0)
+ return -1;
+
if (virXMLPropTristateSwitch(node, "edid", VIR_XML_PROP_NONE, &def->edid) < 0)
return -1;
@@ -26702,6 +26708,10 @@ virDomainVideoDefFormat(virBuffer *buf,
virBufferAddLit(buf, " primary='yes'");
if (def->blob != VIR_TRISTATE_SWITCH_ABSENT)
virBufferAsprintf(buf, " blob='%s'", virTristateSwitchTypeToString(def->blob));
+ if (def->hostmem)
+ virBufferAsprintf(buf, " hostmem='%u'", def->hostmem);
+ if (def->venus)
+ virBufferAsprintf(buf, " venus='%s'", virTristateSwitchTypeToString(def->venus));
if (def->edid != VIR_TRISTATE_SWITCH_ABSENT)
virBufferAsprintf(buf, " edid='%s'", virTristateSwitchTypeToString(def->edid));
if (def->accel || def->res) {
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index 9159a69833..033e79a8b4 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -1888,11 +1888,13 @@ struct _virDomainVideoDef {
unsigned int vram; /* kibibytes (multiples of 1024) */
unsigned int vram64; /* kibibytes (multiples of 1024) */
unsigned int vgamem; /* kibibytes (multiples of 1024) */
+ unsigned int hostmem; /* kibibytes (multiples of 1024) */
unsigned int heads;
bool primary;
virDomainVideoAccelDef *accel;
virDomainVideoResolutionDef *res;
virTristateSwitch blob;
+ virTristateSwitch venus;
virDomainVideoDriverDef *driver;
virDomainDeviceInfo info;
virDomainVirtioOptions *virtio;
diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 93a2bc9b01..2dcbc45285 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -229,6 +229,18 @@ virDomainVideoDefValidate(const virDomainVideoDef *video,
virDomainVideoTypeToString(video->type));
return -1;
}
+ if (video->hostmem != 0) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("video type '%1$s' does not support hostmem"),
+ virDomainVideoTypeToString(video->type));
+ return -1;
+ }
+ if (video->venus != VIR_TRISTATE_SWITCH_ABSENT) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("video type '%1$s' does not support venus"),
+ virDomainVideoTypeToString(video->type));
+ return -1;
+ }
}
if ((video->type != VIR_DOMAIN_VIDEO_TYPE_BOCHS) &&
diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
index b9230a35b4..067b330915 100644
--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
@@ -4822,6 +4822,16 @@
<ref name="virOnOff"/>
</attribute>
</optional>
+ <optional>
+ <attribute name="hostmem">
+ <ref name="unsignedInt"/>
+ </attribute>
+ </optional>
+ <optional>
+ <attribute name="venus">
+ <ref name="virOnOff"/>
+ </attribute>
+ </optional>
<optional>
<attribute name="edid">
<ref name="virOnOff"/>
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index f7af92fe35..c8985fecc3 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -4576,6 +4576,7 @@ qemuBuildSoundCommandLine(virCommand *cmd,
return 0;
}
+static bool insecure_disable_sandbox;
static int
qemuBuildDeviceVideoCmd(virCommand *cmd,
@@ -4663,8 +4664,13 @@ qemuBuildDeviceVideoCmd(virCommand *cmd,
NULL) < 0)
return -1;
} else if (video->type == VIR_DOMAIN_VIDEO_TYPE_VIRTIO) {
- if (virJSONValueObjectAdd(&props, "T:blob", video->blob, NULL) < 0)
+ if (virJSONValueObjectAdd(&props,
+ "T:blob", video->blob,
+ "p:hostmem", video->hostmem * 1024,
+ "T:venus", video->venus,
+ NULL) < 0)
return -1;
+ insecure_disable_sandbox = (video->venus == VIR_TRISTATE_SWITCH_ON);
}
if (virJSONValueObjectAdd(&props, "T:edid", video->edid, NULL) < 0)
@@ -10351,7 +10357,7 @@ qemuBuildSeccompSandboxCommandLine(virCommand *cmd,
return 0;
}
- if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX)) {
+ if (!insecure_disable_sandbox && virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX)) {
virCommandAddArgList(cmd, "-sandbox",
"on,obsolete=deny,elevateprivileges=deny,"
"spawn=deny,resourcecontrol=deny",
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 930ba3543f..9c269efeeb 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -2899,6 +2899,27 @@ qemuValidateDomainDeviceDefVideo(const virDomainVideoDef *video,
return -1;
}
}
+
+ if (video->hostmem != 0) {
+ unsigned n;
+ for (n = video->hostmem - 1; n != 0; n >>= 1)
+ if ((n & 0x1U) == 0)
+ break;
+ if (n != 0) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("'hostmem' is not power of 2"));
+ return -1;
+ }
+ }
+
+ if (video->venus == VIR_TRISTATE_SWITCH_ON &&
+ (video->blob != VIR_TRISTATE_SWITCH_ON ||
+ video->hostmem == 0 ||
+ video->accel->accel3d != VIR_TRISTATE_BOOL_YES)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
+ _("'venus' requires 'blob', 'hostmem' and 3d acceleration"));
+ return -1;
+ }
}
if (video->type == VIR_DOMAIN_VIDEO_TYPE_RAMFB &&
|