From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Durrant Subject: Re: [PATCH v3] xen: use libxendevice model to restrict operations Date: Wed, 22 Mar 2017 09:22:07 +0000 Message-ID: References: <1490120877-3731-1-git-send-email-paul.durrant@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail6.bemta3.messagelabs.com ([195.245.230.39]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1cqcT3-0006ac-R6 for xen-devel@lists.xenproject.org; Wed, 22 Mar 2017 09:22:09 +0000 In-Reply-To: Content-Language: en-US List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: 'Stefano Stabellini' Cc: Anthony Perard , "xen-devel@lists.xenproject.org" , "qemu-devel@nongnu.org" , Paolo Bonzini List-Id: xen-devel@lists.xenproject.org PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQo+IEZyb206IFN0ZWZhbm8gU3RhYmVsbGluaSBb bWFpbHRvOnNzdGFiZWxsaW5pQGtlcm5lbC5vcmddCj4gU2VudDogMjEgTWFyY2ggMjAxNyAxODo1 OQo+IFRvOiBQYXVsIER1cnJhbnQgPFBhdWwuRHVycmFudEBjaXRyaXguY29tPgo+IENjOiBxZW11 LWRldmVsQG5vbmdudS5vcmc7IHhlbi1kZXZlbEBsaXN0cy54ZW5wcm9qZWN0Lm9yZzsgU3RlZmFu bwo+IFN0YWJlbGxpbmkgPHNzdGFiZWxsaW5pQGtlcm5lbC5vcmc+OyBBbnRob255IFBlcmFyZAo+ IDxhbnRob255LnBlcmFyZEBjaXRyaXguY29tPjsgUGFvbG8gQm9uemluaSA8cGJvbnppbmlAcmVk aGF0LmNvbT4KPiBTdWJqZWN0OiBSZTogW1BBVENIIHYzXSB4ZW46IHVzZSBsaWJ4ZW5kZXZpY2Ug bW9kZWwgdG8gcmVzdHJpY3Qgb3BlcmF0aW9ucwo+IAo+IE9uIFR1ZSwgMjEgTWFyIDIwMTcsIFBh dWwgRHVycmFudCB3cm90ZToKPiA+IFRoaXMgcGF0Y2ggYWRkcyBhIGNvbW1hbmQtbGluZSBvcHRp b24gKC14ZW4tZG9taWQtcmVzdHJpY3QpIHdoaWNoIHdpbGwKPiA+IHVzZSB0aGUgbmV3IGxpYnhl bmRldmljZW1vZGVsIEFQSSB0byByZXN0cmljdCBkZXZpY2Vtb2RlbCBbMV0gb3BlcmF0aW9ucwo+ ID4gdG8gdGhlIHNwZWNpZmllZCBkb21pZC4gKFN1Y2ggb3BlcmF0aW9ucyBhcmUgbm90IGFwcGxp Y2FibGUgdG8gdGhlIHhlbnB2Cj4gPiBtYWNoaW5lIHR5cGUpLgo+ID4KPiA+IFRoaXMgcGF0Y2gg YWxzbyBhZGRzIGEgdHJhY2Vwb2ludCB0byBhbGxvdyBzdWNjZXNzZnVsIGVuYWJsaW5nIG9mIHRo ZQo+ID4gcmVzdHJpY3Rpb24gdG8gYmUgbW9uaXRvcmVkLgo+ID4KPiA+IFsxXSBJLmUuIG9wZXJh dGlvbnMgaXNzdWVkIGJ5IGxpYnhlbmRldmljZW1vZGVsLiBPcGVyYXRpb24gaXNzdWVkIGJ5IG90 aGVyCj4gPiAgICAgeGVuIGxpYnJhcmllcyAoZS5nLiBsaWJ4ZW5mb3JlaWdubWVtb3J5KSBhcmUg Y3VycmVudGx5IHN0aWxsIHVucmVzdHJpY3RlZAo+ID4gICAgIGJ1dCB0aGlzIHdpbGwgYmUgcmVj dGlmaWVkIGJ5IHN1YnNlcXVlbnQgcGF0Y2hlcy4KPiA+Cj4gPiBTaWduZWQtb2ZmLWJ5OiBQYXVs IER1cnJhbnQgPHBhdWwuZHVycmFudEBjaXRyaXguY29tPgo+IAo+IEluIGZpbGUgaW5jbHVkZWQg ZnJvbSBxZW11LW9wdGlvbnMtd3JhcHBlci5oOjMyOjAsCj4gICAgICAgICAgICAgICAgICBmcm9t IHFlbXUtb3B0aW9ucy5oOjMzLAo+ICAgICAgICAgICAgICAgICAgZnJvbSBvcy1wb3NpeC5jOjM2 Ogo+IHFlbXUtb3B0aW9ucy5kZWY6Njk4OjE6IGVycm9yOiBtaXNzaW5nIHRlcm1pbmF0aW5nICIg Y2hhcmFjdGVyIFstV2Vycm9yXQo+IGNjMTogYWxsIHdhcm5pbmdzIGJlaW5nIHRyZWF0ZWQgYXMg ZXJyb3JzCj4gbWFrZTogKioqIFtvcy1wb3NpeC5vXSBFcnJvciAxCj4gbWFrZTogKioqIFdhaXRp bmcgZm9yIHVuZmluaXNoZWQgam9icy4uLi4KPiAKPiBZb3UgYXJlIG1pc3NpbmcgYSBcIgoKU28g SSBhbS4gSSdsbCBzZW5kIHY0LgoKICBQYXVsCgo+IAo+IAo+ID4gLS0tCj4gPiBDYzogU3RlZmFu byBTdGFiZWxsaW5pIDxzc3RhYmVsbGluaUBrZXJuZWwub3JnPgo+ID4gQ2M6IEFudGhvbnkgUGVy YXJkIDxhbnRob255LnBlcmFyZEBjaXRyaXguY29tPgo+ID4gQ2M6IFBhb2xvIEJvbnppbmkgPHBi b256aW5pQHJlZGhhdC5jb20+Cj4gPgo+ID4gTk9URTogVGhpcyBpcyBhbHJlYWR5IHJlLWJhc2Vk IG9uIEp1ZXJnZW4gR3Jvc3MncyBwYXRjaCAieGVuOiB1c2UgNSBkaWdpdAo+ID4gICAgICAgeGVu IHZlcnNpb25zIiBhbmQgc28gc2hvdWxkIG5vdCBiZSBhcHBsaWVkIHVudGlsIGFmdGVyIHRoYXQg cGF0Y2gKPiA+ICAgICAgIGhhcyBiZWVuIGFwcGxpZWQuCj4gPgo+ID4gdjI6Cj4gPiAgLSBMb2cg ZXJybm8gaW4gdHJhY2Vwb2ludAo+ID4gLS0tCj4gPiAgaHcveGVuL3RyYWNlLWV2ZW50cyAgICAg ICAgIHwgIDEgKwo+ID4gIGluY2x1ZGUvaHcveGVuL3hlbi5oICAgICAgICB8ICAxICsKPiA+ICBp bmNsdWRlL2h3L3hlbi94ZW5fY29tbW9uLmggfCAyMCArKysrKysrKysrKysrKysrKysrKwo+ID4g IHFlbXUtb3B0aW9ucy5oeCAgICAgICAgICAgICB8ICA3ICsrKysrKysKPiA+ICB2bC5jICAgICAg ICAgICAgICAgICAgICAgICAgfCAgOCArKysrKysrKwo+ID4gIHhlbi1odm0uYyAgICAgICAgICAg ICAgICAgICB8ICA4ICsrKysrKysrCj4gPiAgNiBmaWxlcyBjaGFuZ2VkLCA0NSBpbnNlcnRpb25z KCspCj4gPgo+ID4gZGlmZiAtLWdpdCBhL2h3L3hlbi90cmFjZS1ldmVudHMgYi9ody94ZW4vdHJh Y2UtZXZlbnRzCj4gPiBpbmRleCBjNGZiNmYxLi41NjE1ZGNlIDEwMDY0NAo+ID4gLS0tIGEvaHcv eGVuL3RyYWNlLWV2ZW50cwo+ID4gKysrIGIvaHcveGVuL3RyYWNlLWV2ZW50cwo+ID4gQEAgLTEx LDMgKzExLDQgQEAgeGVuX21hcF9wb3J0aW9fcmFuZ2UodWludDMyX3QgaWQsIHVpbnQ2NF90Cj4g c3RhcnRfYWRkciwgdWludDY0X3QgZW5kX2FkZHIpICJpZDogJQo+ID4gIHhlbl91bm1hcF9wb3J0 aW9fcmFuZ2UodWludDMyX3QgaWQsIHVpbnQ2NF90IHN0YXJ0X2FkZHIsIHVpbnQ2NF90Cj4gZW5k X2FkZHIpICJpZDogJXUgc3RhcnQ6ICUjIlBSSXg2NCIgZW5kOiAlIyJQUkl4NjQKPiA+ICB4ZW5f bWFwX3BjaWRldih1aW50MzJfdCBpZCwgdWludDhfdCBidXMsIHVpbnQ4X3QgZGV2LCB1aW50OF90 IGZ1bmMpICJpZDoKPiAldSBiZGY6ICUwMnguJTAyeC4lMDJ4Igo+ID4gIHhlbl91bm1hcF9wY2lk ZXYodWludDMyX3QgaWQsIHVpbnQ4X3QgYnVzLCB1aW50OF90IGRldiwgdWludDhfdCBmdW5jKSAi aWQ6Cj4gJXUgYmRmOiAlMDJ4LiUwMnguJTAyeCIKPiA+ICt4ZW5fZG9taWRfcmVzdHJpY3QoaW50 IGVycikgImVycjogJXUiCj4gPiBkaWZmIC0tZ2l0IGEvaW5jbHVkZS9ody94ZW4veGVuLmggYi9p bmNsdWRlL2h3L3hlbi94ZW4uaAo+ID4gaW5kZXggMmIxNzMzYi4uN2VmY2RhYSAxMDA2NDQKPiA+ IC0tLSBhL2luY2x1ZGUvaHcveGVuL3hlbi5oCj4gPiArKysgYi9pbmNsdWRlL2h3L3hlbi94ZW4u aAo+ID4gQEAgLTIxLDYgKzIxLDcgQEAgZW51bSB4ZW5fbW9kZSB7Cj4gPgo+ID4gIGV4dGVybiB1 aW50MzJfdCB4ZW5fZG9taWQ7Cj4gPiAgZXh0ZXJuIGVudW0geGVuX21vZGUgeGVuX21vZGU7Cj4g PiArZXh0ZXJuIGJvb2wgeGVuX2RvbWlkX3Jlc3RyaWN0Owo+ID4KPiA+ICBleHRlcm4gYm9vbCB4 ZW5fYWxsb3dlZDsKPiA+Cj4gPiBkaWZmIC0tZ2l0IGEvaW5jbHVkZS9ody94ZW4veGVuX2NvbW1v bi5oCj4gYi9pbmNsdWRlL2h3L3hlbi94ZW5fY29tbW9uLmgKPiA+IGluZGV4IGRmMDk4YzcuLjRm M2JkMzUgMTAwNjQ0Cj4gPiAtLS0gYS9pbmNsdWRlL2h3L3hlbi94ZW5fY29tbW9uLmgKPiA+ICsr KyBiL2luY2x1ZGUvaHcveGVuL3hlbl9jb21tb24uaAo+ID4gQEAgLTE1Miw2ICsxNTIsMTMgQEAg c3RhdGljIGlubGluZSBpbnQgeGVuZGV2aWNlbW9kZWxfc2V0X21lbV90eXBlKAo+ID4gICAgICBy ZXR1cm4geGNfaHZtX3NldF9tZW1fdHlwZShkbW9kLCBkb21pZCwgbWVtX3R5cGUsIGZpcnN0X3Bm biwgbnIpOwo+ID4gIH0KPiA+Cj4gPiArc3RhdGljIGlubGluZSBpbnQgeGVuZGV2aWNlbW9kZWxf cmVzdHJpY3QoCj4gPiArICAgIHhlbmRldmljZW1vZGVsX2hhbmRsZSAqZG1vZCwgZG9taWRfdCBk b21pZCkKPiA+ICt7Cj4gPiArICAgIGVycm5vID0gRU5PVFRZOwo+ID4gKyAgICByZXR1cm4gLTE7 Cj4gPiArfQo+ID4gKwo+ID4gICNlbHNlIC8qIENPTkZJR19YRU5fQ1RSTF9JTlRFUkZBQ0VfVkVS U0lPTiA+PSA0MDkwMCAqLwo+ID4KPiA+ICAjaW5jbHVkZSA8eGVuZGV2aWNlbW9kZWwuaD4KPiA+ IEBAIC0yMDYsNiArMjEzLDE5IEBAIHN0YXRpYyBpbmxpbmUgaW50IHhlbl9tb2RpZmllZF9tZW1v cnkoZG9taWRfdAo+IGRvbWlkLCB1aW50NjRfdCBmaXJzdF9wZm4sCj4gPiAgICAgIHJldHVybiB4 ZW5kZXZpY2Vtb2RlbF9tb2RpZmllZF9tZW1vcnkoeGVuX2Rtb2QsIGRvbWlkLAo+IGZpcnN0X3Bm biwgbnIpOwo+ID4gIH0KPiA+Cj4gPiArc3RhdGljIGlubGluZSBpbnQgeGVuX3Jlc3RyaWN0KGRv bWlkX3QgZG9taWQpCj4gPiArewo+ID4gKyAgICBpbnQgcmMgPSB4ZW5kZXZpY2Vtb2RlbF9yZXN0 cmljdCh4ZW5fZG1vZCwgZG9taWQpOwo+ID4gKwo+ID4gKyAgICB0cmFjZV94ZW5fZG9taWRfcmVz dHJpY3QoZXJybm8pOwo+ID4gKwo+ID4gKyAgICBpZiAoZXJybm8gPT0gRU5PVFRZKSB7Cj4gPiAr ICAgICAgICByZXR1cm4gMDsKPiA+ICsgICAgfQo+ID4gKwo+ID4gKyAgICByZXR1cm4gcmM7Cj4g PiArfQo+ID4gKwo+ID4gIC8qIFhlbiA0LjIgdGhyb3VnaCA0LjYgKi8KPiA+ICAjaWYgQ09ORklH X1hFTl9DVFJMX0lOVEVSRkFDRV9WRVJTSU9OIDwgNDA3MDEKPiA+Cj4gPiBkaWZmIC0tZ2l0IGEv cWVtdS1vcHRpb25zLmh4IGIvcWVtdS1vcHRpb25zLmh4Cj4gPiBpbmRleCA5OWFmOGVkLi5kMzgw ZjdkIDEwMDY0NAo+ID4gLS0tIGEvcWVtdS1vcHRpb25zLmh4Cj4gPiArKysgYi9xZW11LW9wdGlv bnMuaHgKPiA+IEBAIC0zMzU0LDYgKzMzNTQsMTEgQEAgREVGKCJ4ZW4tYXR0YWNoIiwgMCwKPiBR RU1VX09QVElPTl94ZW5fYXR0YWNoLAo+ID4gICAgICAiLXhlbi1hdHRhY2ggICAgIGF0dGFjaCB0 byBleGlzdGluZyB4ZW4gZG9tYWluXG4iCj4gPiAgICAgICIgICAgICAgICAgICAgICAgeGVuZCB3 aWxsIHVzZSB0aGlzIHdoZW4gc3RhcnRpbmcgUUVNVVxuIiwKPiA+ICAgICAgUUVNVV9BUkNIX0FM TCkKPiA+ICtERUYoInhlbi1kb21pZC1yZXN0cmljdCIsIDAsIFFFTVVfT1BUSU9OX3hlbl9kb21p ZF9yZXN0cmljdCwKPiA+ICsgICAgIi14ZW4tZG9taWQtcmVzdHJpY3QgICAgIHJlc3RyaWN0IHNl dCBvZiBhdmFpbGFibGUgeGVuIG9wZXJhdGlvbnNcbiIKPiA+ICsgICAgIiAgICAgICAgICAgICAg ICAgICAgICAgIHRvIHNwZWNpZmllZCBkb21haW4gaWQuIChEb2VzIG5vdCBhZmZlY3Rcbgo+ID4g KyAgICAiICAgICAgICAgICAgICAgICAgICAgICAgeGVucHYgbWFjaGluZSB0eXBlKS5cbiIsCj4g PiArICAgIFFFTVVfQVJDSF9BTEwpCj4gPiAgU1RFWEkKPiA+ICBAaXRlbSAteGVuLWRvbWlkIEB2 YXJ7aWR9Cj4gPiAgQGZpbmRleCAteGVuLWRvbWlkCj4gPiBAQCAtMzM2Niw2ICszMzcxLDggQEAg V2FybmluZzogc2hvdWxkIG5vdCBiZSB1c2VkIHdoZW4geGVuZCBpcyBpbiB1c2UKPiAoWEVOIG9u bHkpLgo+ID4gIEBmaW5kZXggLXhlbi1hdHRhY2gKPiA+ICBBdHRhY2ggdG8gZXhpc3RpbmcgeGVu IGRvbWFpbi4KPiA+ICB4ZW5kIHdpbGwgdXNlIHRoaXMgd2hlbiBzdGFydGluZyBRRU1VIChYRU4g b25seSkuCj4gPiArQGZpbmRleCAteGVuLWRvbWlkLXJlc3RyaWN0Cj4gPiArUmVzdHJpY3Qgc2V0 IG9mIGF2YWlsYWJsZSB4ZW4gb3BlcmF0aW9ucyB0byBzcGVjaWZpZWQgZG9tYWluIGlkIChYRU4g b25seSkuCj4gPiAgRVRFWEkKPiA+Cj4gPiAgREVGKCJuby1yZWJvb3QiLCAwLCBRRU1VX09QVElP Tl9ub19yZWJvb3QsIFwKPiA+IGRpZmYgLS1naXQgYS92bC5jIGIvdmwuYwo+ID4gaW5kZXggMGI0 ZWQ1Mi4uZjQ2ZTA3MCAxMDA2NDQKPiA+IC0tLSBhL3ZsLmMKPiA+ICsrKyBiL3ZsLmMKPiA+IEBA IC0yMDUsNiArMjA1LDcgQEAgc3RhdGljIE5vdGlmaWVyTGlzdCBtYWNoaW5lX2luaXRfZG9uZV9u b3RpZmllcnMgPQo+ID4gIGJvb2wgeGVuX2FsbG93ZWQ7Cj4gPiAgdWludDMyX3QgeGVuX2RvbWlk Owo+ID4gIGVudW0geGVuX21vZGUgeGVuX21vZGUgPSBYRU5fRU1VTEFURTsKPiA+ICtib29sIHhl bl9kb21pZF9yZXN0cmljdDsKPiA+Cj4gPiAgc3RhdGljIGludCBoYXNfZGVmYXVsdHMgPSAxOwo+ ID4gIHN0YXRpYyBpbnQgZGVmYXVsdF9zZXJpYWwgPSAxOwo+ID4gQEAgLTM5MzMsNiArMzkzNCwx MyBAQCBpbnQgbWFpbihpbnQgYXJnYywgY2hhciAqKmFyZ3YsIGNoYXIgKiplbnZwKQo+ID4gICAg ICAgICAgICAgICAgICB9Cj4gPiAgICAgICAgICAgICAgICAgIHhlbl9tb2RlID0gWEVOX0FUVEFD SDsKPiA+ICAgICAgICAgICAgICAgICAgYnJlYWs7Cj4gPiArICAgICAgICAgICAgY2FzZSBRRU1V X09QVElPTl94ZW5fZG9taWRfcmVzdHJpY3Q6Cj4gPiArICAgICAgICAgICAgICAgIGlmICghKHhl bl9hdmFpbGFibGUoKSkpIHsKPiA+ICsgICAgICAgICAgICAgICAgICAgIGVycm9yX3JlcG9ydCgi T3B0aW9uIG5vdCBzdXBwb3J0ZWQgZm9yIHRoaXMgdGFyZ2V0Iik7Cj4gPiArICAgICAgICAgICAg ICAgICAgICBleGl0KDEpOwo+ID4gKyAgICAgICAgICAgICAgICB9Cj4gPiArICAgICAgICAgICAg ICAgIHhlbl9kb21pZF9yZXN0cmljdCA9IHRydWU7Cj4gPiArICAgICAgICAgICAgICAgIGJyZWFr Owo+ID4gICAgICAgICAgICAgIGNhc2UgUUVNVV9PUFRJT05fdHJhY2U6Cj4gPiAgICAgICAgICAg ICAgICAgIGdfZnJlZSh0cmFjZV9maWxlKTsKPiA+ICAgICAgICAgICAgICAgICAgdHJhY2VfZmls ZSA9IHRyYWNlX29wdF9wYXJzZShvcHRhcmcpOwo+ID4gZGlmZiAtLWdpdCBhL3hlbi1odm0uYyBi L3hlbi1odm0uYwo+ID4gaW5kZXggNGI5MjhjZi4uMzM1ZTI2MyAxMDA2NDQKPiA+IC0tLSBhL3hl bi1odm0uYwo+ID4gKysrIGIveGVuLWh2bS5jCj4gPiBAQCAtMTIyNiw2ICsxMjI2LDE0IEBAIHZv aWQgeGVuX2h2bV9pbml0KFBDTWFjaGluZVN0YXRlICpwY21zLAo+IE1lbW9yeVJlZ2lvbiAqKnJh bV9tZW1vcnkpCj4gPiAgICAgICAgICBnb3RvIGVycjsKPiA+ICAgICAgfQo+ID4KPiA+ICsgICAg aWYgKHhlbl9kb21pZF9yZXN0cmljdCkgewo+ID4gKyAgICAgICAgcmMgPSB4ZW5fcmVzdHJpY3Qo eGVuX2RvbWlkKTsKPiA+ICsgICAgICAgIGlmIChyYyA8IDApIHsKPiA+ICsgICAgICAgICAgICBl cnJvcl9yZXBvcnQoImZhaWxlZCB0byByZXN0cmljdDogZXJyb3IgJWQiLCBlcnJubyk7Cj4gPiAr ICAgICAgICAgICAgZ290byBlcnI7Cj4gPiArICAgICAgICB9Cj4gPiArICAgIH0KPiA+ICsKPiA+ ICAgICAgeGVuX2NyZWF0ZV9pb3JlcV9zZXJ2ZXIoeGVuX2RvbWlkLCAmc3RhdGUtPmlvc2Vydmlk KTsKPiA+Cj4gPiAgICAgIHN0YXRlLT5leGl0Lm5vdGlmeSA9IHhlbl9leGl0X25vdGlmaWVyOwo+ ID4gLS0KPiA+IDIuMS40Cj4gPgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KWGVuLWRldmVsIG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9y ZwpodHRwczovL2xpc3RzLnhlbi5vcmcveGVuLWRldmVsCg==