[Xen-devel] [PATCH v2 3/3] x86/hvm: Use white-lists for HVM param guest accessibility checks

[Paul Durrant <paul.durrant@xxxxxxxxxx>]

There are actually very few HVM parameters that a guest needs to read
and even fewer that a guest needs to write. Use white-lists to specify
those parameters and also ensre that, by default, newly introduced
parameters are not accessible.

Signed-off-by: Paul Durrant <paul.durrant@xxxxxxxxxx>
Cc: Keir Fraser <keir@xxxxxxx>
Cc: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/arch/x86/hvm/hvm.c |   40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 1025681..3725349 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -5648,25 +5648,18 @@ static int hvm_allow_set_param(struct domain *d,
     if ( rc )
         return rc;
 
-    /* The following parameters cannot be set by the guest. */
+    /* The following parameters can be set by the guest. */
     switch ( a->index )
     {
-    case HVM_PARAM_IDENT_PT:
-    case HVM_PARAM_DM_DOMAIN:
-    case HVM_PARAM_ACPI_S_STATE:
-    case HVM_PARAM_VIRIDIAN:
-    case HVM_PARAM_MEMORY_EVENT_CR0:
-    case HVM_PARAM_MEMORY_EVENT_CR3:
-    case HVM_PARAM_MEMORY_EVENT_CR4:
-    case HVM_PARAM_MEMORY_EVENT_INT3:
-    case HVM_PARAM_MEMORY_EVENT_SINGLE_STEP:
-    case HVM_PARAM_MEMORY_EVENT_MSR:
-    case HVM_PARAM_IOREQ_SERVER_PFN:
-    case HVM_PARAM_NR_IOREQ_SERVER_PAGES:
-        if ( d == current->domain )
-            rc = -EPERM;
+    case HVM_PARAM_CALLBACK_IRQ:
+    case HVM_PARAM_VM86_TSS:
+    case HVM_PARAM_ACPI_IOPORTS_LOCATION:
+    case HVM_PARAM_TRIPLE_FAULT_REASON:
+    case HVM_PARAM_VM_GENERATION_ID_ADDR:
         break;
     default:
+        if ( d == current->domain )
+            rc = -EPERM;
         break;
     }
 
@@ -5870,15 +5863,22 @@ static int hvm_allow_get_param(struct domain *d,
     if ( rc )
         return rc;
 
-    /* The following parameters should not be read by the guest. */
+    /* The following parameters can be read by the guest. */
     switch ( a->index )
     {
-    case HVM_PARAM_IOREQ_SERVER_PFN:
-    case HVM_PARAM_NR_IOREQ_SERVER_PAGES:
-        if ( d == current->domain )
-            rc = -EPERM;
+    case HVM_PARAM_CALLBACK_IRQ:
+    case HVM_PARAM_VM86_TSS:
+    case HVM_PARAM_ACPI_IOPORTS_LOCATION:
+    case HVM_PARAM_TRIPLE_FAULT_REASON:
+    case HVM_PARAM_VM_GENERATION_ID_ADDR:
+    case HVM_PARAM_STORE_PFN:
+    case HVM_PARAM_STORE_EVTCHN:
+    case HVM_PARAM_CONSOLE_PFN:
+    case HVM_PARAM_CONSOLE_EVTCHN:
         break;
     default:
+        if ( d == current->domain )
+            rc = -EPERM;
         break;
     }
 
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel