Re: [PATCH v2 04/17] xen: Introduce XEN_DOMCTL_CDF_not_hypercall_target

[Julien Grall <julien@xxxxxxx>]

Hi Jason,

On 16/07/2025 22:14, Jason Andryuk wrote:
> Add a new create domain flag  to indicate if a domain can be the target
> of hypercalls.  By default all domains can be targetted - subject to any
> other permission checks.
>
> This property is useful in a safety environment to isolate domains for
> freedom from interference.
I see the flag is exposed to the toolstack. However, I don't see how you 
can successfully create a VM if you are not allowed to call hypercalls 
(for instance to add some memory).
I think, at minimum, you would want to allow hypercalls while the domain 
is created. That said, I wonder if this setup would not be better to 
describe with XSM?

[...]

> diff --git a/xen/include/public/domctl.h b/xen/include/public/domctl.h
> index 88a294c5be..f1f6f96bc2 100644
> --- a/xen/include/public/domctl.h
> +++ b/xen/include/public/domctl.h
> @@ -70,9 +70,11 @@ struct xen_domctl_createdomain {
>   #define XEN_DOMCTL_CDF_trap_unmapped_accesses  (1U << 8)
>   /* Allow domain to provide device model for multiple other domains */
>   #define XEN_DOMCTL_CDF_device_model   (1U << 9)
> +/* Domain cannot be the target of hypercalls */
> +#define XEN_DOMCTL_CDF_not_hypercall_target   (1U << 10)
>   
>   /* Max XEN_DOMCTL_CDF_* constant.  Used for ABI checking. */
> -#define XEN_DOMCTL_CDF_MAX XEN_DOMCTL_CDF_device_model
> +#define XEN_DOMCTL_CDF_MAX XEN_DOMCTL_CDF_not_hypercall_target
I am not sure where to comment. But aren't both flags mutually exclusive?

> diff --git a/xen/include/xsm/dummy.h b/xen/include/xsm/dummy.h
> index 0b341efd18..f2205575ed 100644
> --- a/xen/include/xsm/dummy.h
> +++ b/xen/include/xsm/dummy.h
> @@ -91,12 +91,16 @@ static always_inline int xsm_default_action(
>               return 0;
>           fallthrough;
>       case XSM_DM_PRIV:
> +        if ( target && !is_hypercall_target(target) )
> +            return -EPERM;
>           if ( is_dm_domain(src) )
>               return 0;
>           if ( target && evaluate_nospec(src->target == target) )
>               return 0;
>           fallthrough;
>       case XSM_PRIV:
> +        if ( target && !is_hypercall_target(target) )
> +            return -EPERM;
>           if ( is_control_domain(src) )
>               return 0;
>           return -EPERM;
Cheers,

--
Julien Grall