Re: [Qemu-devel] [Qemu-ppc] [PATCH v2] spapr-rtas: add ibm, get-vpd RTAS interface

[Murilo Opsfelder Araujo <muriloo@linux.ibm.com>]

On Tue, Feb 26, 2019 at 02:08:30PM -0300, Murilo Opsfelder Araujo wrote:
> Hi, Maxiwell.
>
> On Tue, Feb 26, 2019 at 11:21:26AM -0300, Maxiwell S. Garcia wrote:
> > On Tue, Feb 26, 2019 at 02:21:03PM +1100, David Gibson wrote:
> > > On Mon, Feb 25, 2019 at 08:20:09PM -0300, Murilo Opsfelder Araujo wrote:
> > > > Hi, Maxiwell.
> > > >
> > > > On Mon, Feb 25, 2019 at 01:23:25PM -0300, Maxiwell S. Garcia wrote:
> > > > > This adds a handler for ibm,get-vpd RTAS calls, allowing pseries
> > > > > guest to collect host information. It is disabled by default to
> > > > > avoid unwanted information leakage. To enable it, use:
> > > > > ‘-M pseries,vpd-export=on’
> > > >
> > > > The patch for setting host-serial and host-model already landed Gibson's
> > > > ppc-for-4.0 branch:
> > > >
> > > >   commit 9e584f45868f6945c1282c938278038cba0e4af2
> > > >   Author: Prasad J Pandit <pjp@fedoraproject.org>
> > > >   Date:   Mon Feb 18 23:43:49 2019 +0530
> > > >
> > > >       ppc: add host-serial and host-model machine attributes (CVE-2019-8934)
> > > >
> > > >
> > > > QEMU should only return host-serial and host-model from the host if the
> > > > following combination of parameters are provided:
> > > >
> > > >   -M host-serial=passthrough,host-model=passthrough,vpd-export=on
> > > >
> > > > If host-serial or host-model are set with a user-string, ibm,get-vpd should
> > > > honor these values and return them, not exposing host information by accident.
> > > >
> > > > I'm not even sure if we need vpd-export=<bool> setting. Its logic could be
> > > > derived from the presence of host-serial=passthrough and host-model=passthrough
> > > > options.
> > > >
> > > > What do you think?
> > >
> > > That's an excellent point - I hadn't thought through the fact that
> > > this is the same information exposed by those properties.  I do indeed
> > > think that exposing the same information set in those properties - and
> > > thereby avoiding the new machine option - would be a better plan.
> > >
> >
> > I saw that the patch was applied. So I will work in another patch
> > to use these properties and remove the export-vpd option.
> >
> > Another thing that I thought the fact that 'host-serial' and 'host-model'
> > nodes in Device Tree are not in accordance with LoPAPR document. What
> > you think in use only get-vpd to get these information and remove
> > nodes from device tree?
>
> Both "system-id" and "model" properties are described in the section "3.3.2.1
> Root Node Properties" of the "Device Tree Bindings: Linux on Power Architecture
> Reference" document:
>
>   https://members.openpowerfoundation.org/wg/SYSSW/document/1455

I replied too early. As Maxiwell explained to me (thanks Max!), guest can end up
having the following entries under /proc/device-tree/ (among other entries):

  $ cat host-serial
  12A3B4C

  $ cat host-model
  1234-56A

  $ cat system-id
  c7b62da9-3d0c-44f9-8edb-2318271f3c1a

  $ cat model
  IBM pSeries (emulated by qemu)

Where:

  - host-serial/host-model: depend on "-M host-serial" and "-M host-model"
    machine options.

  - system-id: created when "-uuid <val>" exists in qemu command line options.

  - model: hard-coded.

With this patch, RTAS ibm,get-vpd call will return "system-id" and "model" from
the host, not from the guest. I found this confusing.

Perhaps we can trick ibm,get-vpd call to return "host-serial" and "host-model"
values from the guest, which will hold safe values after commit
9e584f45868f6945c1282c938278038cba0e4af2 "ppc: add host-serial and host-model
machine attributes (CVE-2019-8934)".

What do you think?

As to removing "host-serial" and "host-model", I am not entirely sure for what
they are used. There should be a reason for them to exist.

--
Murilo