Re: [Qemu-devel] [Qemu-ppc] [PATCH v3] ppc: add host-serial and host-model machine attributes

2019-02-19 Thread Daniel P . Berrangé 
On Tue, Feb 19, 2019 at 12:21:04PM +1100, David Gibson wrote:
> On Mon, Feb 18, 2019 at 11:52:18AM +, Daniel P. Berrangé wrote:
> > On Mon, Feb 18, 2019 at 12:38:11PM +0100, Greg Kurz wrote:
> > > On Mon, 18 Feb 2019 15:42:18 +0530
> > > P J P  wrote:
> > > 
> > > > From: Prasad J Pandit 
> > > > 
> > > > On ppc hosts, hypervisor shares following system attributes
> > > > 
> > > >   - /proc/device-tree/system-id
> > > >   - /proc/device-tree/model
> > > > 
> > > > with a guest. This could lead to information leakage and misuse.[*]
> > > > Add machine attributes to control such system information exposure
> > > > to a guest.
> > > > 
> > > > [*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028
> > > > 
> > > > Reported-by: Daniel P. Berrangé 
> > > > Fix-suggested-by: Daniel P. Berrangé 
> > > > Signed-off-by: Prasad J Pandit 
> > > > ---
> > > >  hw/ppc/spapr.c | 79 ++
> > > >  include/hw/ppc/spapr.h |  2 ++
> > > >  2 files changed, 75 insertions(+), 6 deletions(-)
> > > > 
> > > > Update v3: move host-serial,host-model options to ppc sPAPR machine
> > > >   -> 
> > > > https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg03182.html  
> > > > 
> > > > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > > > index 0942f35bf8..666e500376 100644
> > > > --- a/hw/ppc/spapr.c
> > > > +++ b/hw/ppc/spapr.c
> > > > @@ -1249,13 +1249,30 @@ static void *spapr_build_fdt(sPAPRMachineState 
> > > > *spapr,
> > > >   * Add info to guest to indentify which host is it being run on
> > > >   * and what is the uuid of the guest
> > > >   */
> > > > -if (kvmppc_get_host_model()) {
> > > > -_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > > > -g_free(buf);
> > > > +if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
> > > > +if (g_str_equal(spapr->host_model, "passthrough")) {
> > > > +/* -M host-model=passthrough */
> > > > +if (kvmppc_get_host_model()) {
> > > > +_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > > > +g_free(buf);
> > > > +}
> > > > +} else {
> > > > +/* -M host-model= */
> > > > +_FDT(fdt_setprop_string(fdt, 0, "host-model", 
> > > > spapr->host_model));
> > > > +}
> > > >  }
> > > > -if (kvmppc_get_host_serial()) {
> > > > -_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > > > -g_free(buf);
> > > > +
> > > > +if (spapr->host_serial && !g_str_equal(spapr->host_serial, 
> > > > "none")) {
> > > > +if (g_str_equal(spapr->host_serial, "passthrough")) {
> > > > +/* -M host-serial=passthrough */
> > > > +if (kvmppc_get_host_serial()) {
> > > > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > > > +g_free(buf);
> > > > +}
> > > > +} else {
> > > > +/* -M host-serial= */
> > > > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", 
> > > > spapr->host_serial));
> > > > +}
> > > >  }
> > > >  
> > > >  buf = qemu_uuid_unparse_strdup(_uuid);
> > > > @@ -3138,6 +3155,36 @@ static void spapr_set_ic_mode(Object *obj, const 
> > > > char *value, Error **errp)
> > > >  }
> > > >  }
> > > >  
> > > > +static char *spapr_get_host_model(Object *obj, Error **errp)
> > > > +{
> > > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > > +
> > > > +return g_strdup(spapr->host_model);
> > > > +}
> > > > +
> > > > +static void spapr_set_host_model(Object *obj, const char *value, Error 
> > > > **errp)
> > > > +{
> > > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > > +
> > > > +g_free(spapr->host_model);
> > > > +spapr->host_model = g_strdup(value);
> > > > +}
> > > > +
> > > > +static char *spapr_get_host_serial(Object *obj, Error **errp)
> > > > +{
> > > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > > +
> > > > +return g_strdup(spapr->host_serial);
> > > > +}
> > > > +
> > > > +static void spapr_set_host_serial(Object *obj, const char *value, 
> > > > Error **errp)
> > > > +{
> > > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > > +
> > > > +g_free(spapr->host_serial);
> > > > +spapr->host_serial = g_strdup(value);
> > > > +}
> > > > +
> > > >  static void spapr_instance_init(Object *obj)
> > > >  {
> > > >  sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > > @@ -3183,6 +3230,20 @@ static void spapr_instance_init(Object *obj)
> > > >  object_property_set_description(obj, "ic-mode",
> > > >   "Specifies the interrupt controller mode (xics, xive, 
> > > > dual)",
> > > >   NULL);
> > > > +
> > > > +spapr->host_model = NULL;
> > > 
> > > This isn't needed since object_initialize_with_type() already takes care
> > > of zeroing the instance for us.
> > > 
> > > > +object_property_add_str(obj, "host-model",
> > > > +

Re: [Qemu-devel] [Qemu-ppc] [PATCH v3] ppc: add host-serial and host-model machine attributes

2019-02-18 Thread David Gibson 
On Mon, Feb 18, 2019 at 11:52:18AM +, Daniel P. Berrangé wrote:
> On Mon, Feb 18, 2019 at 12:38:11PM +0100, Greg Kurz wrote:
> > On Mon, 18 Feb 2019 15:42:18 +0530
> > P J P  wrote:
> > 
> > > From: Prasad J Pandit 
> > > 
> > > On ppc hosts, hypervisor shares following system attributes
> > > 
> > >   - /proc/device-tree/system-id
> > >   - /proc/device-tree/model
> > > 
> > > with a guest. This could lead to information leakage and misuse.[*]
> > > Add machine attributes to control such system information exposure
> > > to a guest.
> > > 
> > > [*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028
> > > 
> > > Reported-by: Daniel P. Berrangé 
> > > Fix-suggested-by: Daniel P. Berrangé 
> > > Signed-off-by: Prasad J Pandit 
> > > ---
> > >  hw/ppc/spapr.c | 79 ++
> > >  include/hw/ppc/spapr.h |  2 ++
> > >  2 files changed, 75 insertions(+), 6 deletions(-)
> > > 
> > > Update v3: move host-serial,host-model options to ppc sPAPR machine
> > >   -> https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg03182.html  
> > > 
> > > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > > index 0942f35bf8..666e500376 100644
> > > --- a/hw/ppc/spapr.c
> > > +++ b/hw/ppc/spapr.c
> > > @@ -1249,13 +1249,30 @@ static void *spapr_build_fdt(sPAPRMachineState 
> > > *spapr,
> > >   * Add info to guest to indentify which host is it being run on
> > >   * and what is the uuid of the guest
> > >   */
> > > -if (kvmppc_get_host_model()) {
> > > -_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > > -g_free(buf);
> > > +if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
> > > +if (g_str_equal(spapr->host_model, "passthrough")) {
> > > +/* -M host-model=passthrough */
> > > +if (kvmppc_get_host_model()) {
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > > +g_free(buf);
> > > +}
> > > +} else {
> > > +/* -M host-model= */
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-model", 
> > > spapr->host_model));
> > > +}
> > >  }
> > > -if (kvmppc_get_host_serial()) {
> > > -_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > > -g_free(buf);
> > > +
> > > +if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) {
> > > +if (g_str_equal(spapr->host_serial, "passthrough")) {
> > > +/* -M host-serial=passthrough */
> > > +if (kvmppc_get_host_serial()) {
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > > +g_free(buf);
> > > +}
> > > +} else {
> > > +/* -M host-serial= */
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", 
> > > spapr->host_serial));
> > > +}
> > >  }
> > >  
> > >  buf = qemu_uuid_unparse_strdup(_uuid);
> > > @@ -3138,6 +3155,36 @@ static void spapr_set_ic_mode(Object *obj, const 
> > > char *value, Error **errp)
> > >  }
> > >  }
> > >  
> > > +static char *spapr_get_host_model(Object *obj, Error **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +return g_strdup(spapr->host_model);
> > > +}
> > > +
> > > +static void spapr_set_host_model(Object *obj, const char *value, Error 
> > > **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +g_free(spapr->host_model);
> > > +spapr->host_model = g_strdup(value);
> > > +}
> > > +
> > > +static char *spapr_get_host_serial(Object *obj, Error **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +return g_strdup(spapr->host_serial);
> > > +}
> > > +
> > > +static void spapr_set_host_serial(Object *obj, const char *value, Error 
> > > **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +g_free(spapr->host_serial);
> > > +spapr->host_serial = g_strdup(value);
> > > +}
> > > +
> > >  static void spapr_instance_init(Object *obj)
> > >  {
> > >  sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > @@ -3183,6 +3230,20 @@ static void spapr_instance_init(Object *obj)
> > >  object_property_set_description(obj, "ic-mode",
> > >   "Specifies the interrupt controller mode (xics, xive, 
> > > dual)",
> > >   NULL);
> > > +
> > > +spapr->host_model = NULL;
> > 
> > This isn't needed since object_initialize_with_type() already takes care
> > of zeroing the instance for us.
> > 
> > > +object_property_add_str(obj, "host-model",
> > > +spapr_get_host_model, spapr_set_host_model,
> > > +_abort);
> > > +object_property_set_description(obj, "host-model",
> > > +"Set host's model-id to use - none|passthrough|string", 
> > > _abort);
> > > +
> > > +spapr->host_serial = NULL;
> > 
> > Same here.
> > 
> > > +object_property_add_str(obj,

Re: [Qemu-devel] [Qemu-ppc] [PATCH v3] ppc: add host-serial and host-model machine attributes

2019-02-18 Thread P J P 
  Hello Greg, Dan,

+-- On Mon, 18 Feb 2019, Greg Kurz wrote --+
| >>> +spapr->host_model = NULL;  
| >> 
| >> This isn't needed since object_initialize_with_type() already takes care
| >> of zeroing the instance for us.
| >>   
| >>> +spapr->host_serial = NULL;  
| >> 
| >> Same here.
| 
| Alright then if there's prior consensus on compatibility versus security.
| 
| So, with or without the unneeded zeroing of the spapr->host_* fields:
| 
| Reviewed-by: Greg Kurz 

I have sent a revised patch v4 removing above NULL initialisations. Thank you 
for the review.

Thank you.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F

Re: [Qemu-devel] [Qemu-ppc] [PATCH v3] ppc: add host-serial and host-model machine attributes

2019-02-18 Thread Greg Kurz 
On Mon, 18 Feb 2019 11:52:18 +
Daniel P. Berrangé  wrote:

> On Mon, Feb 18, 2019 at 12:38:11PM +0100, Greg Kurz wrote:
> > On Mon, 18 Feb 2019 15:42:18 +0530
> > P J P  wrote:
> >   
> > > From: Prasad J Pandit 
> > > 
> > > On ppc hosts, hypervisor shares following system attributes
> > > 
> > >   - /proc/device-tree/system-id
> > >   - /proc/device-tree/model
> > > 
> > > with a guest. This could lead to information leakage and misuse.[*]
> > > Add machine attributes to control such system information exposure
> > > to a guest.
> > > 
> > > [*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028
> > > 
> > > Reported-by: Daniel P. Berrangé 
> > > Fix-suggested-by: Daniel P. Berrangé 
> > > Signed-off-by: Prasad J Pandit 
> > > ---
> > >  hw/ppc/spapr.c | 79 ++
> > >  include/hw/ppc/spapr.h |  2 ++
> > >  2 files changed, 75 insertions(+), 6 deletions(-)
> > > 
> > > Update v3: move host-serial,host-model options to ppc sPAPR machine  
> > >   -> https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg03182.html  
> > >   
> > > 
> > > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > > index 0942f35bf8..666e500376 100644
> > > --- a/hw/ppc/spapr.c
> > > +++ b/hw/ppc/spapr.c
> > > @@ -1249,13 +1249,30 @@ static void *spapr_build_fdt(sPAPRMachineState 
> > > *spapr,
> > >   * Add info to guest to indentify which host is it being run on
> > >   * and what is the uuid of the guest
> > >   */
> > > -if (kvmppc_get_host_model()) {
> > > -_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > > -g_free(buf);
> > > +if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
> > > +if (g_str_equal(spapr->host_model, "passthrough")) {
> > > +/* -M host-model=passthrough */
> > > +if (kvmppc_get_host_model()) {
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > > +g_free(buf);
> > > +}
> > > +} else {
> > > +/* -M host-model= */
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-model", 
> > > spapr->host_model));
> > > +}
> > >  }
> > > -if (kvmppc_get_host_serial()) {
> > > -_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > > -g_free(buf);
> > > +
> > > +if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) {
> > > +if (g_str_equal(spapr->host_serial, "passthrough")) {
> > > +/* -M host-serial=passthrough */
> > > +if (kvmppc_get_host_serial()) {
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > > +g_free(buf);
> > > +}
> > > +} else {
> > > +/* -M host-serial= */
> > > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", 
> > > spapr->host_serial));
> > > +}
> > >  }
> > >  
> > >  buf = qemu_uuid_unparse_strdup(_uuid);
> > > @@ -3138,6 +3155,36 @@ static void spapr_set_ic_mode(Object *obj, const 
> > > char *value, Error **errp)
> > >  }
> > >  }
> > >  
> > > +static char *spapr_get_host_model(Object *obj, Error **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +return g_strdup(spapr->host_model);
> > > +}
> > > +
> > > +static void spapr_set_host_model(Object *obj, const char *value, Error 
> > > **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +g_free(spapr->host_model);
> > > +spapr->host_model = g_strdup(value);
> > > +}
> > > +
> > > +static char *spapr_get_host_serial(Object *obj, Error **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +return g_strdup(spapr->host_serial);
> > > +}
> > > +
> > > +static void spapr_set_host_serial(Object *obj, const char *value, Error 
> > > **errp)
> > > +{
> > > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > +
> > > +g_free(spapr->host_serial);
> > > +spapr->host_serial = g_strdup(value);
> > > +}
> > > +
> > >  static void spapr_instance_init(Object *obj)
> > >  {
> > >  sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > > @@ -3183,6 +3230,20 @@ static void spapr_instance_init(Object *obj)
> > >  object_property_set_description(obj, "ic-mode",
> > >   "Specifies the interrupt controller mode (xics, xive, 
> > > dual)",
> > >   NULL);
> > > +
> > > +spapr->host_model = NULL;  
> > 
> > This isn't needed since object_initialize_with_type() already takes care
> > of zeroing the instance for us.
> >   
> > > +object_property_add_str(obj, "host-model",
> > > +spapr_get_host_model, spapr_set_host_model,
> > > +_abort);
> > > +object_property_set_description(obj, "host-model",
> > > +"Set host's model-id to use - none|passthrough|string", 
> > > _abort);
> > > +
> > > +spapr->host_serial = NULL;  
> > 
> > Same here.
> >   
> > > +

Re: [Qemu-devel] [Qemu-ppc] [PATCH v3] ppc: add host-serial and host-model machine attributes

2019-02-18 Thread Daniel P . Berrangé 
On Mon, Feb 18, 2019 at 12:38:11PM +0100, Greg Kurz wrote:
> On Mon, 18 Feb 2019 15:42:18 +0530
> P J P  wrote:
> 
> > From: Prasad J Pandit 
> > 
> > On ppc hosts, hypervisor shares following system attributes
> > 
> >   - /proc/device-tree/system-id
> >   - /proc/device-tree/model
> > 
> > with a guest. This could lead to information leakage and misuse.[*]
> > Add machine attributes to control such system information exposure
> > to a guest.
> > 
> > [*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028
> > 
> > Reported-by: Daniel P. Berrangé 
> > Fix-suggested-by: Daniel P. Berrangé 
> > Signed-off-by: Prasad J Pandit 
> > ---
> >  hw/ppc/spapr.c | 79 ++
> >  include/hw/ppc/spapr.h |  2 ++
> >  2 files changed, 75 insertions(+), 6 deletions(-)
> > 
> > Update v3: move host-serial,host-model options to ppc sPAPR machine
> >   -> https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg03182.html  
> > 
> > diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> > index 0942f35bf8..666e500376 100644
> > --- a/hw/ppc/spapr.c
> > +++ b/hw/ppc/spapr.c
> > @@ -1249,13 +1249,30 @@ static void *spapr_build_fdt(sPAPRMachineState 
> > *spapr,
> >   * Add info to guest to indentify which host is it being run on
> >   * and what is the uuid of the guest
> >   */
> > -if (kvmppc_get_host_model()) {
> > -_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > -g_free(buf);
> > +if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
> > +if (g_str_equal(spapr->host_model, "passthrough")) {
> > +/* -M host-model=passthrough */
> > +if (kvmppc_get_host_model()) {
> > +_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> > +g_free(buf);
> > +}
> > +} else {
> > +/* -M host-model= */
> > +_FDT(fdt_setprop_string(fdt, 0, "host-model", 
> > spapr->host_model));
> > +}
> >  }
> > -if (kvmppc_get_host_serial()) {
> > -_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > -g_free(buf);
> > +
> > +if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) {
> > +if (g_str_equal(spapr->host_serial, "passthrough")) {
> > +/* -M host-serial=passthrough */
> > +if (kvmppc_get_host_serial()) {
> > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> > +g_free(buf);
> > +}
> > +} else {
> > +/* -M host-serial= */
> > +_FDT(fdt_setprop_string(fdt, 0, "host-serial", 
> > spapr->host_serial));
> > +}
> >  }
> >  
> >  buf = qemu_uuid_unparse_strdup(_uuid);
> > @@ -3138,6 +3155,36 @@ static void spapr_set_ic_mode(Object *obj, const 
> > char *value, Error **errp)
> >  }
> >  }
> >  
> > +static char *spapr_get_host_model(Object *obj, Error **errp)
> > +{
> > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > +
> > +return g_strdup(spapr->host_model);
> > +}
> > +
> > +static void spapr_set_host_model(Object *obj, const char *value, Error 
> > **errp)
> > +{
> > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > +
> > +g_free(spapr->host_model);
> > +spapr->host_model = g_strdup(value);
> > +}
> > +
> > +static char *spapr_get_host_serial(Object *obj, Error **errp)
> > +{
> > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > +
> > +return g_strdup(spapr->host_serial);
> > +}
> > +
> > +static void spapr_set_host_serial(Object *obj, const char *value, Error 
> > **errp)
> > +{
> > +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > +
> > +g_free(spapr->host_serial);
> > +spapr->host_serial = g_strdup(value);
> > +}
> > +
> >  static void spapr_instance_init(Object *obj)
> >  {
> >  sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> > @@ -3183,6 +3230,20 @@ static void spapr_instance_init(Object *obj)
> >  object_property_set_description(obj, "ic-mode",
> >   "Specifies the interrupt controller mode (xics, xive, 
> > dual)",
> >   NULL);
> > +
> > +spapr->host_model = NULL;
> 
> This isn't needed since object_initialize_with_type() already takes care
> of zeroing the instance for us.
> 
> > +object_property_add_str(obj, "host-model",
> > +spapr_get_host_model, spapr_set_host_model,
> > +_abort);
> > +object_property_set_description(obj, "host-model",
> > +"Set host's model-id to use - none|passthrough|string", 
> > _abort);
> > +
> > +spapr->host_serial = NULL;
> 
> Same here.
> 
> > +object_property_add_str(obj, "host-serial",
> > +spapr_get_host_serial, spapr_set_host_serial,
> > +_abort);
> > +object_property_set_description(obj, "host-serial",
> > +"Set host's system-id to use - none|passthrough|string", 
> > _abort);
> >  }
> >  
> >  static void spapr_machine_finalizefn(Object *obj)
> > @@ -4080,9 +4141,15 @@

Re: [Qemu-devel] [Qemu-ppc] [PATCH v3] ppc: add host-serial and host-model machine attributes

2019-02-18 Thread Greg Kurz 
On Mon, 18 Feb 2019 15:42:18 +0530
P J P  wrote:

> From: Prasad J Pandit 
> 
> On ppc hosts, hypervisor shares following system attributes
> 
>   - /proc/device-tree/system-id
>   - /proc/device-tree/model
> 
> with a guest. This could lead to information leakage and misuse.[*]
> Add machine attributes to control such system information exposure
> to a guest.
> 
> [*] https://wiki.openstack.org/wiki/OSSN/OSSN-0028
> 
> Reported-by: Daniel P. Berrangé 
> Fix-suggested-by: Daniel P. Berrangé 
> Signed-off-by: Prasad J Pandit 
> ---
>  hw/ppc/spapr.c | 79 ++
>  include/hw/ppc/spapr.h |  2 ++
>  2 files changed, 75 insertions(+), 6 deletions(-)
> 
> Update v3: move host-serial,host-model options to ppc sPAPR machine
>   -> https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg03182.html  
> 
> diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
> index 0942f35bf8..666e500376 100644
> --- a/hw/ppc/spapr.c
> +++ b/hw/ppc/spapr.c
> @@ -1249,13 +1249,30 @@ static void *spapr_build_fdt(sPAPRMachineState *spapr,
>   * Add info to guest to indentify which host is it being run on
>   * and what is the uuid of the guest
>   */
> -if (kvmppc_get_host_model()) {
> -_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> -g_free(buf);
> +if (spapr->host_model && !g_str_equal(spapr->host_model, "none")) {
> +if (g_str_equal(spapr->host_model, "passthrough")) {
> +/* -M host-model=passthrough */
> +if (kvmppc_get_host_model()) {
> +_FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
> +g_free(buf);
> +}
> +} else {
> +/* -M host-model= */
> +_FDT(fdt_setprop_string(fdt, 0, "host-model", 
> spapr->host_model));
> +}
>  }
> -if (kvmppc_get_host_serial()) {
> -_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> -g_free(buf);
> +
> +if (spapr->host_serial && !g_str_equal(spapr->host_serial, "none")) {
> +if (g_str_equal(spapr->host_serial, "passthrough")) {
> +/* -M host-serial=passthrough */
> +if (kvmppc_get_host_serial()) {
> +_FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
> +g_free(buf);
> +}
> +} else {
> +/* -M host-serial= */
> +_FDT(fdt_setprop_string(fdt, 0, "host-serial", 
> spapr->host_serial));
> +}
>  }
>  
>  buf = qemu_uuid_unparse_strdup(_uuid);
> @@ -3138,6 +3155,36 @@ static void spapr_set_ic_mode(Object *obj, const char 
> *value, Error **errp)
>  }
>  }
>  
> +static char *spapr_get_host_model(Object *obj, Error **errp)
> +{
> +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> +
> +return g_strdup(spapr->host_model);
> +}
> +
> +static void spapr_set_host_model(Object *obj, const char *value, Error 
> **errp)
> +{
> +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> +
> +g_free(spapr->host_model);
> +spapr->host_model = g_strdup(value);
> +}
> +
> +static char *spapr_get_host_serial(Object *obj, Error **errp)
> +{
> +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> +
> +return g_strdup(spapr->host_serial);
> +}
> +
> +static void spapr_set_host_serial(Object *obj, const char *value, Error 
> **errp)
> +{
> +sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> +
> +g_free(spapr->host_serial);
> +spapr->host_serial = g_strdup(value);
> +}
> +
>  static void spapr_instance_init(Object *obj)
>  {
>  sPAPRMachineState *spapr = SPAPR_MACHINE(obj);
> @@ -3183,6 +3230,20 @@ static void spapr_instance_init(Object *obj)
>  object_property_set_description(obj, "ic-mode",
>   "Specifies the interrupt controller mode (xics, xive, 
> dual)",
>   NULL);
> +
> +spapr->host_model = NULL;

This isn't needed since object_initialize_with_type() already takes care
of zeroing the instance for us.

> +object_property_add_str(obj, "host-model",
> +spapr_get_host_model, spapr_set_host_model,
> +_abort);
> +object_property_set_description(obj, "host-model",
> +"Set host's model-id to use - none|passthrough|string", 
> _abort);
> +
> +spapr->host_serial = NULL;

Same here.

> +object_property_add_str(obj, "host-serial",
> +spapr_get_host_serial, spapr_set_host_serial,
> +_abort);
> +object_property_set_description(obj, "host-serial",
> +"Set host's system-id to use - none|passthrough|string", 
> _abort);
>  }
>  
>  static void spapr_machine_finalizefn(Object *obj)
> @@ -4080,9 +4141,15 @@ DEFINE_SPAPR_MACHINE(4_0, "4.0", true);
>  static void spapr_machine_3_1_class_options(MachineClass *mc)
>  {
>  sPAPRMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
> +static GlobalProperty compat[] = {
> +{ TYPE_SPAPR_MACHINE, "host-model", "passthrough" },
> +{ TYPE_SPAPR_MACHINE, "host-serial", "passthrough" },
> +};
>