Re: [Qemu-devel] [PATCH] xen: use libxendevice model to restrict operations

[Paul Durrant]

> -Original Message-
> From: Philippe Mathieu-Daudé [mailto:philippe.mathieu.da...@gmail.com]
> On Behalf Of Philippe Mathieu-Daudé
> Sent: 17 March 2017 21:21
> To: Paul Durrant <paul.durr...@citrix.com>; qemu-devel@nongnu.org; xen-
> de...@lists.xenproject.org
> Cc: Anthony Perard <anthony.per...@citrix.com>; Paolo Bonzini
> <pbonz...@redhat.com>; Stefano Stabellini <sstabell...@kernel.org>
> Subject: Re: [Qemu-devel] [PATCH] xen: use libxendevice model to restrict
> operations
> 
> Hi Paul,
> 
> On 03/17/2017 10:30 AM, Paul Durrant wrote:
> > This patch adds a command-line option (-xen-domid-restrict) which will
> > use the new libxendevicemodel API to restrict devicemodel operations to
> > the specified domid.
> >
> > This patch also adds a tracepoint to allow successful enabling of the
> > restriction to be monitored.
> >
> > Signed-off-by: Paul Durrant <paul.durr...@citrix.com>
> > ---
> > Cc: Stefano Stabellini <sstabell...@kernel.org>
> > Cc: Anthony Perard <anthony.per...@citrix.com>
> > Cc: Paolo Bonzini <pbonz...@redhat.com>
> >
> > NOTE: This is already re-based on Juergen Gross's patch "xen: use 5 digit
> >   xen versions" and so should not be applied until after that patch
> >   has been applied.
> > ---
> >  hw/xen/trace-events |  1 +
> >  include/hw/xen/xen.h|  1 +
> >  include/hw/xen/xen_common.h | 23 +++
> >  qemu-options.hx |  6 ++
> >  vl.c|  8 
> >  xen-hvm.c   |  8 
> >  6 files changed, 47 insertions(+)
> >
> > diff --git a/hw/xen/trace-events b/hw/xen/trace-events
> > index c4fb6f1..a5b5e8b 100644
> > --- a/hw/xen/trace-events
> > +++ b/hw/xen/trace-events
> > @@ -11,3 +11,4 @@ xen_map_portio_range(uint32_t id, uint64_t
> start_addr, uint64_t end_addr) "id: %
> >  xen_unmap_portio_range(uint32_t id, uint64_t start_addr, uint64_t
> end_addr) "id: %u start: %#"PRIx64" end: %#"PRIx64
> >  xen_map_pcidev(uint32_t id, uint8_t bus, uint8_t dev, uint8_t func) "id:
> %u bdf: %02x.%02x.%02x"
> >  xen_unmap_pcidev(uint32_t id, uint8_t bus, uint8_t dev, uint8_t func) "id:
> %u bdf: %02x.%02x.%02x"
> > +xen_domid_restrict(void) ""
> > diff --git a/include/hw/xen/xen.h b/include/hw/xen/xen.h
> > index 2b1733b..7efcdaa 100644
> > --- a/include/hw/xen/xen.h
> > +++ b/include/hw/xen/xen.h
> > @@ -21,6 +21,7 @@ enum xen_mode {
> >
> >  extern uint32_t xen_domid;
> >  extern enum xen_mode xen_mode;
> > +extern bool xen_domid_restrict;
> >
> >  extern bool xen_allowed;
> >
> > diff --git a/include/hw/xen/xen_common.h
> b/include/hw/xen/xen_common.h
> > index df098c7..5962bc4 100644
> > --- a/include/hw/xen/xen_common.h
> > +++ b/include/hw/xen/xen_common.h
> > @@ -152,6 +152,13 @@ static inline int xendevicemodel_set_mem_type(
> >  return xc_hvm_set_mem_type(dmod, domid, mem_type, first_pfn, nr);
> >  }
> >
> > +static inline int xendevicemodel_restrict(
> > +xendevicemodel_handle *dmod, domid_t domid)
> > +{
> > +errno = ENOTTY;
> > +return -1;
> > +}
> > +
> >  #else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 40900 */
> >
> >  #include 
> > @@ -206,6 +213,22 @@ static inline int xen_modified_memory(domid_t
> domid, uint64_t first_pfn,
> >  return xendevicemodel_modified_memory(xen_dmod, domid,
> first_pfn, nr);
> >  }
> >
> > +static inline int xen_restrict(domid_t domid)
> > +{
> > +int rc = xendevicemodel_restrict(xen_dmod, domid);
> 
> might it be more useful to log the retcode?
> 
> trace_xen_domid_restrict(rc);
> 
> > +
> > +if (rc == 0) {
> > +trace_xen_domid_restrict();
> 
> and drop the previous line.

Actually the retcode is pretty uninteresting but tracing errno would be a good 
idea so I think I'll do that.

Cheers,

  Paul

> 
> > +return 0;
> > +}
> > +
> > +if (errno == ENOTTY) {
> > +return 0;
> > +}
> > +
> > +return rc;
> > +}
> > +
> >  /* Xen 4.2 through 4.6 */
> >  #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40701
> >
> > diff --git a/qemu-options.hx b/qemu-options.hx
> > index 99af8ed..4aab077 100644
> > --- a/qemu-options.hx
> > +++ b/qemu-options.hx
> > @@ -3354,6 +3354,10 @@ DEF("xen-attach", 0,
> QEMU_OPTION_xen_attach,
>

Re: [Qemu-devel] [PATCH] xen: use libxendevice model to restrict operations

[Philippe Mathieu-Daudé]

Hi Paul,

On 03/17/2017 10:30 AM, Paul Durrant wrote:

This patch adds a command-line option (-xen-domid-restrict) which will
use the new libxendevicemodel API to restrict devicemodel operations to
the specified domid.

This patch also adds a tracepoint to allow successful enabling of the
restriction to be monitored.

Signed-off-by: Paul Durrant 
---
Cc: Stefano Stabellini 
Cc: Anthony Perard 
Cc: Paolo Bonzini 

NOTE: This is already re-based on Juergen Gross's patch "xen: use 5 digit
  xen versions" and so should not be applied until after that patch
  has been applied.
---
 hw/xen/trace-events |  1 +
 include/hw/xen/xen.h|  1 +
 include/hw/xen/xen_common.h | 23 +++
 qemu-options.hx |  6 ++
 vl.c|  8 
 xen-hvm.c   |  8 
 6 files changed, 47 insertions(+)

diff --git a/hw/xen/trace-events b/hw/xen/trace-events
index c4fb6f1..a5b5e8b 100644
--- a/hw/xen/trace-events
+++ b/hw/xen/trace-events
@@ -11,3 +11,4 @@ xen_map_portio_range(uint32_t id, uint64_t start_addr, uint64_t 
end_addr) "id: %
 xen_unmap_portio_range(uint32_t id, uint64_t start_addr, uint64_t end_addr) "id: %u start: 
%#"PRIx64" end: %#"PRIx64
 xen_map_pcidev(uint32_t id, uint8_t bus, uint8_t dev, uint8_t func) "id: %u bdf: 
%02x.%02x.%02x"
 xen_unmap_pcidev(uint32_t id, uint8_t bus, uint8_t dev, uint8_t func) "id: %u bdf: 
%02x.%02x.%02x"
+xen_domid_restrict(void) ""
diff --git a/include/hw/xen/xen.h b/include/hw/xen/xen.h
index 2b1733b..7efcdaa 100644
--- a/include/hw/xen/xen.h
+++ b/include/hw/xen/xen.h
@@ -21,6 +21,7 @@ enum xen_mode {

 extern uint32_t xen_domid;
 extern enum xen_mode xen_mode;
+extern bool xen_domid_restrict;

 extern bool xen_allowed;

diff --git a/include/hw/xen/xen_common.h b/include/hw/xen/xen_common.h
index df098c7..5962bc4 100644
--- a/include/hw/xen/xen_common.h
+++ b/include/hw/xen/xen_common.h
@@ -152,6 +152,13 @@ static inline int xendevicemodel_set_mem_type(
 return xc_hvm_set_mem_type(dmod, domid, mem_type, first_pfn, nr);
 }

+static inline int xendevicemodel_restrict(
+xendevicemodel_handle *dmod, domid_t domid)
+{
+errno = ENOTTY;
+return -1;
+}
+
 #else /* CONFIG_XEN_CTRL_INTERFACE_VERSION >= 40900 */

 #include 
@@ -206,6 +213,22 @@ static inline int xen_modified_memory(domid_t domid, 
uint64_t first_pfn,
 return xendevicemodel_modified_memory(xen_dmod, domid, first_pfn, nr);
 }

+static inline int xen_restrict(domid_t domid)
+{
+int rc = xendevicemodel_restrict(xen_dmod, domid);


might it be more useful to log the retcode?

   trace_xen_domid_restrict(rc);


+
+if (rc == 0) {
+trace_xen_domid_restrict();


and drop the previous line.


+return 0;
+}
+
+if (errno == ENOTTY) {
+return 0;
+}
+
+return rc;
+}
+
 /* Xen 4.2 through 4.6 */
 #if CONFIG_XEN_CTRL_INTERFACE_VERSION < 40701

diff --git a/qemu-options.hx b/qemu-options.hx
index 99af8ed..4aab077 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -3354,6 +3354,10 @@ DEF("xen-attach", 0, QEMU_OPTION_xen_attach,
 "-xen-attach attach to existing xen domain\n"
 "xend will use this when starting QEMU\n",
 QEMU_ARCH_ALL)
+DEF("xen-domid-restrict", 0, QEMU_OPTION_xen_domid_restrict,
+"-xen-domid-restrict restrict set of available xen operations\n"
+"to specified domain id\n",
+QEMU_ARCH_ALL)
 STEXI
 @item -xen-domid @var{id}
 @findex -xen-domid
@@ -3366,6 +3370,8 @@ Warning: should not be used when xend is in use (XEN 
only).
 @findex -xen-attach
 Attach to existing xen domain.
 xend will use this when starting QEMU (XEN only).
+@findex -xen-domid-restrict
+Restrict set of available xen operations to specified domain id (XEN only).
 ETEXI

 DEF("no-reboot", 0, QEMU_OPTION_no_reboot, \
diff --git a/vl.c b/vl.c
index 0b4ed52..f46e070 100644
--- a/vl.c
+++ b/vl.c
@@ -205,6 +205,7 @@ static NotifierList machine_init_done_notifiers =
 bool xen_allowed;
 uint32_t xen_domid;
 enum xen_mode xen_mode = XEN_EMULATE;
+bool xen_domid_restrict;

 static int has_defaults = 1;
 static int default_serial = 1;
@@ -3933,6 +3934,13 @@ int main(int argc, char **argv, char **envp)
 }
 xen_mode = XEN_ATTACH;
 break;
+case QEMU_OPTION_xen_domid_restrict:
+if (!(xen_available())) {
+error_report("Option not supported for this target");
+exit(1);
+}
+xen_domid_restrict = true;
+break;
 case QEMU_OPTION_trace:
 g_free(trace_file);
 trace_file = trace_opt_parse(optarg);
diff --git a/xen-hvm.c b/xen-hvm.c
index 4b928cf..335e263 100644
--- a/xen-hvm.c
+++ b/xen-hvm.c
@@ -1226,6 +1226,14 @@ void xen_hvm_init(PCMachineState