From patchwork Wed Jul 3 08:00:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Elder X-Patchwork-Id: 1588 Return-Path: Received: from perceval.ideasonboard.com (perceval.ideasonboard.com [IPv6:2001:4b98:dc2:55:216:3eff:fef7:d647]) by lancelot.ideasonboard.com (Postfix) with ESMTPS id C53D860C23 for ; Wed, 3 Jul 2019 10:00:23 +0200 (CEST) Received: from neptunite.flets-east.jp (p1871204-ipngn14001hodogaya.kanagawa.ocn.ne.jp [153.220.127.204]) by perceval.ideasonboard.com (Postfix) with ESMTPSA id 5A7B524B; Wed, 3 Jul 2019 10:00:22 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ideasonboard.com; s=mail; t=1562140823; bh=ThaYDGRWx2r8D4ChwM5T62wXJ061ngGbqVoHw43X+hs=; h=From:To:Cc:Subject:Date:From; b=iFvBilHyWJLZWiHePe63BhQS5nngfHaHJpfekmcVG+Z1BKrqF/+6+zIiLPPYjkRfE JbbwC+5d/TXOzpwMwN+H5rex8Eg0HT7Oxn/EpJ+pqAlmtqDe/w5fqeHwOl5qT3HTTz C2RQf9Q+hxnQ6v9DLQSr+qzIcf2KA+aYt15isDdk= From: Paul Elder To: libcamera-devel@lists.libcamera.org Date: Wed, 3 Jul 2019 17:00:00 +0900 Message-Id: <20190703080007.21376-1-paul.elder@ideasonboard.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Subject: [libcamera-devel] [RFC PATCH v2 0/7] Add IPA process isolation X-BeenThere: libcamera-devel@lists.libcamera.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 03 Jul 2019 08:00:23 -0000 We need to be able to isolate untrusted IPA implementations into a separate process. To achieve this, we use an IPA proxy, that acts like a regular IPAInterface to the pipeline handler, but will initialize and communicate with the real IPA module in a separate, isolated process. Changes in v2: - renamed Shim to Proxy - build proxies into libcamera, and not into separate .so - add Process and ProcessManager - add license field to IPAModuleInfo (as opposed to a "please isolate me" flag) - use IPCUnixSocket (it's only initialized for now) - moved out some patches into their own series Paul Elder (7): libcamera: ipa_module_info: add license field libcamera: process, process manager: create process and manager classes libcamera: add IPA proxy libcamera: proxy: add default linux proxy libcamera: ipa_manager: use proxy libcamera: ipa: add dummy IPA that needs to be isolated libcamera: ipa: meson: build dummy IPA that needs isolation Documentation/Doxyfile.in | 3 +- include/libcamera/ipa/ipa_module_info.h | 2 + src/ipa/ipa_dummy.cpp | 1 + src/ipa/ipa_dummy_isolate.cpp | 46 ++++ src/ipa/meson.build | 23 +- src/libcamera/include/ipa_proxy.h | 68 ++++++ src/libcamera/include/process.h | 35 +++ src/libcamera/include/process_manager.h | 40 ++++ src/libcamera/ipa_manager.cpp | 48 +++- src/libcamera/ipa_module.cpp | 3 + src/libcamera/ipa_proxy.cpp | 219 ++++++++++++++++++ src/libcamera/meson.build | 9 + src/libcamera/process.cpp | 140 +++++++++++ src/libcamera/process_manager.cpp | 104 +++++++++ src/libcamera/proxy/meson.build | 3 + src/libcamera/proxy/proxy_linux_default.cpp | 90 +++++++ src/libcamera/proxy_worker/meson.build | 18 ++ .../proxy_linux_default_worker.cpp | 46 ++++ test/ipa/ipa_test.cpp | 1 + test/libtest/test.cpp | 4 + 20 files changed, 890 insertions(+), 13 deletions(-) create mode 100644 src/ipa/ipa_dummy_isolate.cpp create mode 100644 src/libcamera/include/ipa_proxy.h create mode 100644 src/libcamera/include/process.h create mode 100644 src/libcamera/include/process_manager.h create mode 100644 src/libcamera/ipa_proxy.cpp create mode 100644 src/libcamera/process.cpp create mode 100644 src/libcamera/process_manager.cpp create mode 100644 src/libcamera/proxy/meson.build create mode 100644 src/libcamera/proxy/proxy_linux_default.cpp create mode 100644 src/libcamera/proxy_worker/meson.build create mode 100644 src/libcamera/proxy_worker/proxy_linux_default_worker.cpp