Re: [Xen-devel] [PATCH v3 36/38] altp2m: Allow specifying external-only use-case

[Wei Liu]

On Wed, Aug 17, 2016 at 12:17:12AM +0200, Sergej Proskurin wrote:
> From: Tamas K Lengyel 
> 
> Currently setting altp2mhvm=1 in the domain configuration allows access to the
> altp2m interface for both in-guest and external privileged tools. This poses
> a problem for use-cases where only external access should be allowed, 
> requiring
> the user to compile Xen with XSM enabled to be able to appropriately restrict
> access.
> 
> In this patch we deprecate the altp2mhvm domain configuration option and
> introduce the altp2m option, which allows specifying if by default the altp2m
> interface should be external-only. The information is stored in
> HVM_PARAM_ALTP2M which we now define with specific XEN_ALTP2M_* modes.
> If external_only mode is selected, the XSM check is shifted to use XSM_DM_PRIV
> type check, thus restricting access to the interface by the guest itself. Note
> that we keep the default XSM policy untouched. Users of XSM who wish to 
> enforce
> external_only mode for altp2m can do so by adjusting their XSM policy 
> directly,
> as this domain config option does not override an active XSM policy.
> 
> Also, as part of this patch we adjust the hvmop handler to require
> HVM_PARAM_ALTP2M to be of a type other then disabled for all ops. This has 
> been
> previously only required for get/set altp2m domain state, all other options
> were gated on altp2m_enabled. Since altp2m_enabled only gets set during set
> altp2m domain state, this change introduces no new requirements to the other
> ops but makes it more clear that it is required for all ops.
> 
> Signed-off-by: Tamas K Lengyel 
> Signed-off-by: Sergej Proskurin 


During my review of Tamas's original patch, I figured that it would
be quite ugly to handle the old type vs new type of altp2m in order to
not break compilation for older application.

But it seems that we shall just keep altp2mhvm libxl_def_bool and use
the new type for altp2m.  I think by taking this patch in the series, we
manage to reduce the compatibility cruft needed, which is good.

> ---
> Cc: Ian Jackson 
> Cc: Wei Liu 
> Cc: Jan Beulich 
> Cc: Andrew Cooper 
> Cc: Daniel De Graaf 
> 
> v2: Rename HVMALTP2M_* to XEN_ALTP2M_*
> Relax xsm check to XSM_DM_PRIV for external-only mode
> 
> v3: Introduce macro LIBXL_HAVE_ARM_ALTP2M in parallel to the former
> LIBXL_HAVE_ALTP2M to differentiate between altp2m for x86 and and
> altp2m for ARM architectures.
> 
> Document the option "altp2m" in ./docs/man/xl.cfg.pod.5.in.
> 
> Maintain the legacy info->u.hvm.altp2m field for x86 HVM domains in
> parallel to the introduced info->altp2m field for x86 HVM and ARM
> domains.
> ---
>  docs/man/xl.cfg.pod.5.in| 37 -
>  tools/libxl/libxl.h | 10 +-
>  tools/libxl/libxl_create.c  |  7 +--
>  tools/libxl/libxl_dom.c | 30 --
>  tools/libxl/libxl_types.idl | 13 +
>  tools/libxl/xl_cmdimpl.c| 25 -
>  xen/arch/arm/hvm.c  | 14 +-
>  xen/arch/x86/hvm/hvm.c  | 20 ++--
>  xen/include/public/hvm/params.h | 10 +-
>  xen/include/xsm/dummy.h | 14 +++---
>  xen/include/xsm/xsm.h   |  6 +++---
>  xen/xsm/flask/hooks.c   |  2 +-
>  12 files changed, 162 insertions(+), 26 deletions(-)
> 
> diff --git a/docs/man/xl.cfg.pod.5.in b/docs/man/xl.cfg.pod.5.in
> index 48c9c0d..bf9a48a 100644
> --- a/docs/man/xl.cfg.pod.5.in
> +++ b/docs/man/xl.cfg.pod.5.in
> @@ -1268,6 +1268,37 @@ enabled by default and you should usually omit it. It 
> may be necessary
>  to disable the HPET in order to improve compatibility with guest
>  Operating Systems (X86 only)
>  
> +=item 

Re: [Xen-devel] [PATCH v3 36/38] altp2m: Allow specifying external-only use-case

[Daniel De Graaf]

On 08/16/2016 06:17 PM, Sergej Proskurin wrote:

From: Tamas K Lengyel 

Currently setting altp2mhvm=1 in the domain configuration allows access to the
altp2m interface for both in-guest and external privileged tools. This poses
a problem for use-cases where only external access should be allowed, requiring
the user to compile Xen with XSM enabled to be able to appropriately restrict
access.

In this patch we deprecate the altp2mhvm domain configuration option and
introduce the altp2m option, which allows specifying if by default the altp2m
interface should be external-only. The information is stored in
HVM_PARAM_ALTP2M which we now define with specific XEN_ALTP2M_* modes.
If external_only mode is selected, the XSM check is shifted to use XSM_DM_PRIV
type check, thus restricting access to the interface by the guest itself. Note
that we keep the default XSM policy untouched. Users of XSM who wish to enforce
external_only mode for altp2m can do so by adjusting their XSM policy directly,
as this domain config option does not override an active XSM policy.

Also, as part of this patch we adjust the hvmop handler to require
HVM_PARAM_ALTP2M to be of a type other then disabled for all ops. This has been
previously only required for get/set altp2m domain state, all other options
were gated on altp2m_enabled. Since altp2m_enabled only gets set during set
altp2m domain state, this change introduces no new requirements to the other
ops but makes it more clear that it is required for all ops.

Signed-off-by: Tamas K Lengyel 
Signed-off-by: Sergej Proskurin 


Acked-by: Daniel De Graaf 

___
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

Re: [Xen-devel] [PATCH v3 36/38] altp2m: Allow specifying external-only use-case

[Jan Beulich]

>>> On 17.08.16 at 00:17,  wrote:
> From: Tamas K Lengyel 
> 
> Currently setting altp2mhvm=1 in the domain configuration allows access to the
> altp2m interface for both in-guest and external privileged tools. This poses
> a problem for use-cases where only external access should be allowed, 
> requiring
> the user to compile Xen with XSM enabled to be able to appropriately restrict
> access.
> 
> In this patch we deprecate the altp2mhvm domain configuration option and
> introduce the altp2m option, which allows specifying if by default the altp2m
> interface should be external-only. The information is stored in
> HVM_PARAM_ALTP2M which we now define with specific XEN_ALTP2M_* modes.
> If external_only mode is selected, the XSM check is shifted to use XSM_DM_PRIV
> type check, thus restricting access to the interface by the guest itself. Note
> that we keep the default XSM policy untouched. Users of XSM who wish to 
> enforce
> external_only mode for altp2m can do so by adjusting their XSM policy 
> directly,
> as this domain config option does not override an active XSM policy.
> 
> Also, as part of this patch we adjust the hvmop handler to require
> HVM_PARAM_ALTP2M to be of a type other then disabled for all ops. This has 
> been
> previously only required for get/set altp2m domain state, all other options
> were gated on altp2m_enabled. Since altp2m_enabled only gets set during set
> altp2m domain state, this change introduces no new requirements to the other
> ops but makes it more clear that it is required for all ops.
> 
> Signed-off-by: Tamas K Lengyel 
> Signed-off-by: Sergej Proskurin 

x86 and public header parts:
Acked-by: Jan Beulich 


___
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

[Xen-devel] [PATCH v3 36/38] altp2m: Allow specifying external-only use-case

[Sergej Proskurin]

From: Tamas K Lengyel 

Currently setting altp2mhvm=1 in the domain configuration allows access to the
altp2m interface for both in-guest and external privileged tools. This poses
a problem for use-cases where only external access should be allowed, requiring
the user to compile Xen with XSM enabled to be able to appropriately restrict
access.

In this patch we deprecate the altp2mhvm domain configuration option and
introduce the altp2m option, which allows specifying if by default the altp2m
interface should be external-only. The information is stored in
HVM_PARAM_ALTP2M which we now define with specific XEN_ALTP2M_* modes.
If external_only mode is selected, the XSM check is shifted to use XSM_DM_PRIV
type check, thus restricting access to the interface by the guest itself. Note
that we keep the default XSM policy untouched. Users of XSM who wish to enforce
external_only mode for altp2m can do so by adjusting their XSM policy directly,
as this domain config option does not override an active XSM policy.

Also, as part of this patch we adjust the hvmop handler to require
HVM_PARAM_ALTP2M to be of a type other then disabled for all ops. This has been
previously only required for get/set altp2m domain state, all other options
were gated on altp2m_enabled. Since altp2m_enabled only gets set during set
altp2m domain state, this change introduces no new requirements to the other
ops but makes it more clear that it is required for all ops.

Signed-off-by: Tamas K Lengyel 
Signed-off-by: Sergej Proskurin 
---
Cc: Ian Jackson 
Cc: Wei Liu 
Cc: Jan Beulich 
Cc: Andrew Cooper 
Cc: Daniel De Graaf 

v2: Rename HVMALTP2M_* to XEN_ALTP2M_*
Relax xsm check to XSM_DM_PRIV for external-only mode

v3: Introduce macro LIBXL_HAVE_ARM_ALTP2M in parallel to the former
LIBXL_HAVE_ALTP2M to differentiate between altp2m for x86 and and
altp2m for ARM architectures.

Document the option "altp2m" in ./docs/man/xl.cfg.pod.5.in.

Maintain the legacy info->u.hvm.altp2m field for x86 HVM domains in
parallel to the introduced info->altp2m field for x86 HVM and ARM
domains.
---
 docs/man/xl.cfg.pod.5.in| 37 -
 tools/libxl/libxl.h | 10 +-
 tools/libxl/libxl_create.c  |  7 +--
 tools/libxl/libxl_dom.c | 30 --
 tools/libxl/libxl_types.idl | 13 +
 tools/libxl/xl_cmdimpl.c| 25 -
 xen/arch/arm/hvm.c  | 14 +-
 xen/arch/x86/hvm/hvm.c  | 20 ++--
 xen/include/public/hvm/params.h | 10 +-
 xen/include/xsm/dummy.h | 14 +++---
 xen/include/xsm/xsm.h   |  6 +++---
 xen/xsm/flask/hooks.c   |  2 +-
 12 files changed, 162 insertions(+), 26 deletions(-)

diff --git a/docs/man/xl.cfg.pod.5.in b/docs/man/xl.cfg.pod.5.in
index 48c9c0d..bf9a48a 100644
--- a/docs/man/xl.cfg.pod.5.in
+++ b/docs/man/xl.cfg.pod.5.in
@@ -1268,6 +1268,37 @@ enabled by default and you should usually omit it. It 
may be necessary
 to disable the HPET in order to improve compatibility with guest
 Operating Systems (X86 only)
 
+=item