<!DOCTYPE html>
<html lang='en'>
<head>
<title>xen/xen - xen</title>
<meta name='generator' content='cgit v1.2.3'/>
<meta name='robots' content='index, nofollow'/>
<link rel='stylesheet' type='text/css' href='/cgit.css'/>
<link rel='shortcut icon' href='/favicon.ico'/>
<link rel='alternate' title='Atom feed' href='http://openwrt.panaceas.org/cgit/xen/xen/atom/docs/src?h=xen-4.3.0-rc2' type='application/atom+xml'/>
<link rel='vcs-git' href='git://git.panaceas.org/xen/xen' title='xen/xen Git repository'/>
<link rel='vcs-git' href='ssh://git@git.panaceas.org/git/xen/xen' title='xen/xen Git repository'/>
</head>
<body>
<div id='cgit'><table id='header'>
<tr>
<td class='logo' rowspan='2'><a href='/cgit/'><img src='/cgit.png' alt='cgit logo'/></a></td>
<td class='main'><a href='/cgit/'>index</a> : <a title='xen/xen' href='/cgit/xen/xen/'>xen/xen</a></td><td class='form'><form method='get'>
<input type='hidden' name='id' value='6102cace934c5ef156e7e1e21966cf3950dc40e5'/><select name='h' onchange='this.form.submit();'>
<option value='master'>master</option>
<option value='stable-4.0'>stable-4.0</option>
<option value='stable-4.1'>stable-4.1</option>
<option value='stable-4.2'>stable-4.2</option>
<option value='stable-4.3'>stable-4.3</option>
<option value='staging'>staging</option>
<option value='staging-4.0'>staging-4.0</option>
<option value='staging-4.1'>staging-4.1</option>
<option value='staging-4.2'>staging-4.2</option>
<option value='staging-4.3'>staging-4.3</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>xen</td><td class='sub right'>James</td></tr></table>
<table class='tabs'><tr><td>
<a href='/cgit/xen/xen/about/?h=xen-4.3.0-rc2'>about</a><a href='/cgit/xen/xen/?h=xen-4.3.0-rc2'>summary</a><a href='/cgit/xen/xen/refs/?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>refs</a><a href='/cgit/xen/xen/log/docs/src?h=xen-4.3.0-rc2'>log</a><a href='/cgit/xen/xen/tree/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>tree</a><a class='active' href='/cgit/xen/xen/commit/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>commit</a><a href='/cgit/xen/xen/diff/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>diff</a><a href='/cgit/xen/xen/stats/docs/src?h=xen-4.3.0-rc2'>stats</a></td><td class='form'><form class='right' method='get' action='/cgit/xen/xen/log/docs/src'>
<input type='hidden' name='h' value='xen-4.3.0-rc2'/><input type='hidden' name='id' value='6102cace934c5ef156e7e1e21966cf3950dc40e5'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit/xen/xen/commit/?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>root</a>/<a href='/cgit/xen/xen/commit/docs?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>docs</a>/<a href='/cgit/xen/xen/commit/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>src</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='h' value='xen-4.3.0-rc2'/><input type='hidden' name='id' value='6102cace934c5ef156e7e1e21966cf3950dc40e5'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Keir Fraser &lt;keir@xen.org&gt;</td><td class='right'>2011-03-25 21:47:57 +0000</td></tr>
<tr><th>committer</th><td>Keir Fraser &lt;keir@xen.org&gt;</td><td class='right'>2011-03-25 21:47:57 +0000</td></tr>
<tr><th>commit</th><td colspan='2' class='sha1'><a href='/cgit/xen/xen/commit/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>6102cace934c5ef156e7e1e21966cf3950dc40e5</a> (<a href='/cgit/xen/xen/patch/docs/src?id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='sha1'><a href='/cgit/xen/xen/tree/?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>612c892c08a8a6c371b3c02981b2699e7ebdc9ae</a> /<a href='/cgit/xen/xen/tree/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>docs/src</a></td></tr>
<tr><th>parent</th><td colspan='2' class='sha1'><a href='/cgit/xen/xen/commit/docs/src?h=xen-4.3.0-rc2&amp;id=662f524483de23084ae4dde930fa7570fb15e033'>662f524483de23084ae4dde930fa7570fb15e033</a> (<a href='/cgit/xen/xen/diff/docs/src?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5&amp;id2=662f524483de23084ae4dde930fa7570fb15e033'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='sha1'><a href='/cgit/xen/xen/snapshot/xen-6102cace934c5ef156e7e1e21966cf3950dc40e5.tar.gz'>xen-6102cace934c5ef156e7e1e21966cf3950dc40e5.tar.gz</a><br/><a href='/cgit/xen/xen/snapshot/xen-6102cace934c5ef156e7e1e21966cf3950dc40e5.tar.bz2'>xen-6102cace934c5ef156e7e1e21966cf3950dc40e5.tar.bz2</a><br/><a href='/cgit/xen/xen/snapshot/xen-6102cace934c5ef156e7e1e21966cf3950dc40e5.zip'>xen-6102cace934c5ef156e7e1e21966cf3950dc40e5.zip</a><br/></td></tr></table>
<div class='commit-subject'>Remove unmaintained Access Control Module (ACM) from hypervisor.</div><div class='commit-msg'>Signed-off-by: Keir Fraser &lt;keir@xen.org&gt;
</div><div class='diffstat-header'><a href='/cgit/xen/xen/diff/?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>Diffstat</a> (limited to 'docs/src')</div><table summary='diffstat' class='diffstat'><tr><td class='mode'>-rw-r--r--</td><td class='upd'><a href='/cgit/xen/xen/diff/docs/src/interface.tex?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>docs/src/interface.tex</a></td><td class='right'>41</td><td class='graph'><table summary='file diffstat' width='100%'><tr><td class='add' style='width: 0.0%;'/><td class='rem' style='width: 2.1%;'/><td class='none' style='width: 97.9%;'/></tr></table></td></tr>
<tr><td class='mode'>-rw-r--r--</td><td class='upd'><a href='/cgit/xen/xen/diff/docs/src/user.tex?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>docs/src/user.tex</a></td><td class='right'>1921</td><td class='graph'><table summary='file diffstat' width='100%'><tr><td class='add' style='width: 0.0%;'/><td class='rem' style='width: 100.0%;'/><td class='none' style='width: 0.0%;'/></tr></table></td></tr>
</table><div class='diffstat-summary'>2 files changed, 0 insertions, 1962 deletions</div><table summary='diff' class='diff'><tr><td><div class='head'>diff --git a/docs/src/interface.tex b/docs/src/interface.tex<br/>index e596b63535..6f81ead684 100644<br/>--- a/<a href='/cgit/xen/xen/tree/docs/src/interface.tex?h=xen-4.3.0-rc2&amp;id=662f524483de23084ae4dde930fa7570fb15e033'>docs/src/interface.tex</a><br/>+++ b/<a href='/cgit/xen/xen/tree/docs/src/interface.tex?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>docs/src/interface.tex</a></div><div class='hunk'>@@ -2177,47 +2177,6 @@ Most of the above are best understood by looking at the code</div><div class='ctx'> implementing them (in {\tt xen/common/dom0\_ops.c}) and in </div><div class='ctx'> the user-space tools that use them (mostly in {\tt tools/libxc}). </div><div class='ctx'> </div><div class='del'>-\section{Access Control Module Hypercalls}</div><div class='del'>-\label{s:acmops}</div><div class='del'>-</div><div class='del'>-Hypercalls relating to the management of the Access Control Module are</div><div class='del'>-also restricted to domain 0 access for now. For more details on any or</div><div class='del'>-all of these, please see {\tt xen/include/public/acm\_ops.h}.  A</div><div class='del'>-complete list is given below:</div><div class='del'>-</div><div class='del'>-\begin{quote}</div><div class='del'>-</div><div class='del'>-\hypercall{acm\_op(int cmd, void *args)}</div><div class='del'>-</div><div class='del'>-This hypercall can be used to configure the state of the ACM, query</div><div class='del'>-that state, request access control decisions and dump additional</div><div class='del'>-information.</div><div class='del'>-</div><div class='del'>-\begin{description}</div><div class='del'>-</div><div class='del'>-\item [ACMOP\_SETPOLICY:] set the access control policy</div><div class='del'>-</div><div class='del'>-\item [ACMOP\_GETPOLICY:] get the current access control policy and</div><div class='del'>-  status</div><div class='del'>-</div><div class='del'>-\item [ACMOP\_DUMPSTATS:] get current access control hook invocation</div><div class='del'>-  statistics</div><div class='del'>-</div><div class='del'>-\item [ACMOP\_GETSSID:] get security access control information for a</div><div class='del'>-  domain</div><div class='del'>-</div><div class='del'>-\item [ACMOP\_GETDECISION:] get access decision based on the currently</div><div class='del'>-  enforced access control policy</div><div class='del'>-</div><div class='del'>-\end{description}</div><div class='del'>-\end{quote}</div><div class='del'>-</div><div class='del'>-Most of the above are best understood by looking at the code</div><div class='del'>-implementing them (in {\tt xen/common/acm\_ops.c}) and in the</div><div class='del'>-user-space tools that use them (mostly in {\tt tools/security} and</div><div class='del'>-{\tt tools/python/xen/lowlevel/acm}).</div><div class='del'>-</div><div class='del'>-</div><div class='ctx'> \section{Debugging Hypercalls} </div><div class='ctx'> </div><div class='ctx'> A few additional hypercalls are mainly useful for debugging: </div><div class='head'>diff --git a/docs/src/user.tex b/docs/src/user.tex<br/>index 69971cdd66..a35bb86b88 100644<br/>--- a/<a href='/cgit/xen/xen/tree/docs/src/user.tex?h=xen-4.3.0-rc2&amp;id=662f524483de23084ae4dde930fa7570fb15e033'>docs/src/user.tex</a><br/>+++ b/<a href='/cgit/xen/xen/tree/docs/src/user.tex?h=xen-4.3.0-rc2&amp;id=6102cace934c5ef156e7e1e21966cf3950dc40e5'>docs/src/user.tex</a></div><div class='hunk'>@@ -2081,1927 +2081,6 @@ iptables:</div><div class='ctx'> iptables -A INPUT -p tcp -{}-destination-port 8002 -j REJECT</div><div class='ctx'> \end{verbatim}</div><div class='ctx'> </div><div class='del'>-%% Chapter Xen Mandatory Access Control Framework</div><div class='del'>-\chapter{sHype/Xen Access Control}</div><div class='del'>-The Xen mandatory access control framework is an implementation of the</div><div class='del'>-sHype Hypervisor Security Architecture</div><div class='del'>-(www.research.ibm.com/ssd\_shype). It permits or denies communication</div><div class='del'>-and resource access of domains based on a security policy. The</div><div class='del'>-mandatory access controls are enforced in addition to the Xen core</div><div class='del'>-controls, such as memory protection.  They are designed to remain</div><div class='del'>-transparent during normal operation of domains (policy-conform</div><div class='del'>-behavior) but to intervene when domains move outside their intended</div><div class='del'>-sharing behavior.  This chapter will describe how the sHype access</div><div class='del'>-controls in Xen can be configured to prevent viruses from spilling</div><div class='del'>-over from one into another workload type and secrets from leaking from</div><div class='del'>-one workload type to another. sHype/Xen depends on the correct</div><div class='del'>-behavior of Domain-0 (cf previous chapter).</div><div class='del'>-</div><div class='del'>-Benefits of configuring sHype/ACM in Xen include:</div><div class='del'>-\begin{itemize}</div><div class='del'>-\item robust workload and resource protection effective against rogue</div><div class='del'>-  user domains</div><div class='del'>-\item simple, platform- and operating system-independent security</div><div class='del'>-  policies (ideal for heterogeneous distributed environments)</div><div class='del'>-\item safety net with minimal performance overhead in case operating</div><div class='del'>-  system security is missing, does not scale, or fails</div><div class='del'>-\end{itemize}</div><div class='del'>-</div><div class='del'>-These benefits are very valuable because today's operating systems</div><div class='del'>-become increasingly complex and often have no or insufficient</div><div class='del'>-mandatory access controls.  (Discretionary access controls, supported</div><div class='del'>-by most operating systems, are not effective against viruses or</div><div class='del'>-misbehaving programs.)  Where mandatory access control exists (e.g.,</div><div class='del'>-SELinux), they usually deploy platform-specific, complex, and difficult</div><div class='del'>-to understand s<style>pre { line-height: 125%; margin: 0; }
td.linenos pre { color: #000000; background-color: #f0f0f0; padding: 0 5px 0 5px; }
span.linenos { color: #000000; background-color: #f0f0f0; padding: 0 5px 0 5px; }
td.linenos pre.special { color: #000000; background-color: #ffffc0; padding: 0 5px 0 5px; }
span.linenos.special { color: #000000; background-color: #ffffc0; padding: 0 5px 0 5px; }
.highlight .hll { background-color: #ffffcc }
.highlight { background: #ffffff; }
.highlight .c { color: #888888 } /* Comment */
.highlight .err { color: #a61717; background-color: #e3d2d2 } /* Error */
.highlight .k { color: #008800; font-weight: bold } /* Keyword */
.highlight .ch { color: #888888 } /* Comment.Hashbang */
.highlight .cm { color: #888888 } /* Comment.Multiline */
.highlight .cp { color: #cc0000; font-weight: bold } /* Comment.Preproc */
.highlight .cpf { color: #888888 } /* Comment.PreprocFile */
.highlight .c1 { color: #888888 } /* Comment.Single */
.highlight .cs { color: #cc0000; font-weight: bold; background-color: #fff0f0 } /* Comment.Special */
.highlight .gd { color: #000000; background-color: #ffdddd } /* Generic.Deleted */
.highlight .ge { font-style: italic } /* Generic.Emph */
.highlight .gr { color: #aa0000 } /* Generic.Error */
.highlight .gh { color: #333333 } /* Generic.Heading */
.highlight .gi { color: #000000; background-color: #ddffdd } /* Generic.Inserted */
.highlight .go { color: #888888 } /* Generic.Output */
.highlight .gp { color: #555555 } /* Generic.Prompt */
.highlight .gs { font-weight: bold } /* Generic.Strong */
.highlight .gu { color: #666666 } /* Generic.Subheading */
.highlight .gt { color: #aa0000 } /* Generic.Traceback */
.highlight .kc { color: #008800; font-weight: bold } /* Keyword.Constant */
.highlight .kd { color: #008800; font-weight: bold } /* Keyword.Declaration */
.highlight .kn { color: #008800; font-weight: bold } /* Keyword.Namespace */
.highlight .kp { color: #008800 } /* Keyword.Pseudo */
.highlight .kr { color: #008800; font-weight: bold } /* Keyword.Reserved */
.highlight .kt { color: #888888; font-weight: bold } /* Keyword.Type */
.highlight .m { color: #0000DD; font-weight: bold } /* Literal.Number */
.highlight .s { color: #dd2200; background-color: #fff0f0 } /* Literal.String */
.highlight .na { color: #336699 } /* Name.Attribute */
.highlight .nb { color: #003388 } /* Name.Builtin */
.highlight .nc { color: #bb0066; font-weight: bold } /* Name.Class */
.highlight .no { color: #003366; font-weight: bold } /* Name.Constant */
.highlight .nd { color: #555555 } /* Name.Decorator */
.highlight .ne { color: #bb0066; font-weight: bold } /* Name.Exception */
.highlight .nf { color: #0066bb; font-weight: bold } /* Name.Function */
.highlight .nl { color: #336699; font-style: italic } /* Name.Label */
.highlight .nn { color: #bb0066; font-weight: bold } /* Name.Namespace */
.highlight .py { color: #336699; font-weight: bold } /* Name.Property */
.highlight .nt { color: #bb0066; font-weight: bold } /* Name.Tag */
.highlight .nv { color: #336699 } /* Name.Variable */
.highlight .ow { color: #008800 } /* Operator.Word */
.highlight .w { color: #bbbbbb } /* Text.Whitespace */
.highlight .mb { color: #0000DD; font-weight: bold } /* Literal.Number.Bin */
.highlight .mf { color: #0000DD; font-weight: bold } /* Literal.Number.Float */
.highlight .mh { color: #0000DD; font-weight: bold } /* Literal.Number.Hex */
.highlight .mi { color: #0000DD; font-weight: bold } /* Literal.Number.Integer */
.highlight .mo { color: #0000DD; font-weight: bold } /* Literal.Number.Oct */
.highlight .sa { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Affix */
.highlight .sb { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Backtick */
.highlight .sc { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Char */
.highlight .dl { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Delimiter */
.highlight .sd { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Doc */
.highlight .s2 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Double */
.highlight .se { color: #0044dd; background-color: #fff0f0 } /* Literal.String.Escape */
.highlight .sh { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Heredoc */
.highlight .si { color: #3333bb; background-color: #fff0f0 } /* Literal.String.Interpol */
.highlight .sx { color: #22bb22; background-color: #f0fff0 } /* Literal.String.Other */
.highlight .sr { color: #008800; background-color: #fff0ff } /* Literal.String.Regex */
.highlight .s1 { color: #dd2200; background-color: #fff0f0 } /* Literal.String.Single */
.highlight .ss { color: #aa6600; background-color: #fff0f0 } /* Literal.String.Symbol */
.highlight .bp { color: #003388 } /* Name.Builtin.Pseudo */
.highlight .fm { color: #0066bb; font-weight: bold } /* Name.Function.Magic */
.highlight .vc { color: #336699 } /* Name.Variable.Class */
.highlight .vg { color: #dd7700 } /* Name.Variable.Global */
.highlight .vi { color: #3333bb } /* Name.Variable.Instance */
.highlight .vm { color: #336699 } /* Name.Variable.Magic */
.highlight .il { color: #0000DD; font-weight: bold } /* Literal.Number.Integer.Long */</style><div class="highlight"><pre><span></span><span class="k">\chapter</span><span class="nb">{</span>Optimizations<span class="nb">}</span>
<span class="k">\label</span><span class="nb">{</span>chapter:opt<span class="nb">}</span>

Yosys employs a number of optimizations to generate better and cleaner results.
This chapter outlines these optimizations.

<span class="k">\section</span><span class="nb">{</span>Simple Optimizations<span class="nb">}</span>

The Yosys pass <span class="nb">{</span><span class="k">\tt</span> opt<span class="nb">}</span> runs a number of simple optimizations. This includes removing unused
signals and cells and const folding. It is recommended to run this pass after each major step
in the synthesis script. At the time of this writing the <span class="nb">{</span><span class="k">\tt</span> opt<span class="nb">}</span> pass executes the following
passes that each perform a simple optimization:

<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> Once at the beginning of <span class="nb">{</span><span class="k">\tt</span> opt<span class="nb">}</span>:
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>expr<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>merge -nomux<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> Repeat until result is stable:
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>muxtree<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>reduce<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>merge<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>rmdff<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>clean<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>expr<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

The following section describes each of the <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_*</span><span class="nb">}</span> passes.

<span class="k">\subsection</span><span class="nb">{</span>The opt<span class="k">\_</span>expr pass<span class="nb">}</span>

This pass performs const folding on the internal combinational cell types
described in Chap.~<span class="k">\ref</span><span class="nb">{</span>chapter:celllib<span class="nb">}</span>. This means a cell with all constant
inputs is replaced with the constant value this cell drives. In some cases
this pass can also optimize cells with some constant inputs.

<span class="k">\begin</span><span class="nb">{</span>table<span class="nb">}</span>
	<span class="k">\hfil</span>
	<span class="k">\begin</span><span class="nb">{</span>tabular<span class="nb">}{</span>cc|c<span class="nb">}</span>
		A-Input <span class="nb">&amp;</span> B-Input <span class="nb">&amp;</span> Replacement <span class="k">\\</span>
		<span class="k">\hline</span>
		any <span class="nb">&amp;</span>   0 <span class="nb">&amp;</span>   0 <span class="k">\\</span>
		  0 <span class="nb">&amp;</span> any <span class="nb">&amp;</span>   0 <span class="k">\\</span>
		  1 <span class="nb">&amp;</span>   1 <span class="nb">&amp;</span>   1 <span class="k">\\</span>
		<span class="k">\hline</span>
		X/Z <span class="nb">&amp;</span> X/Z <span class="nb">&amp;</span>   X <span class="k">\\</span>
		  1 <span class="nb">&amp;</span> X/Z <span class="nb">&amp;</span>   X <span class="k">\\</span>
		X/Z <span class="nb">&amp;</span>   1 <span class="nb">&amp;</span>   X <span class="k">\\</span>
		<span class="k">\hline</span>
		any <span class="nb">&amp;</span> X/Z <span class="nb">&amp;</span>   0 <span class="k">\\</span>
		X/Z <span class="nb">&amp;</span> any <span class="nb">&amp;</span>   0 <span class="k">\\</span>
		<span class="k">\hline</span>
		<span class="s">$</span><span class="nb">a</span><span class="s">$</span> <span class="nb">&amp;</span>   1 <span class="nb">&amp;</span> <span class="s">$</span><span class="nb">a</span><span class="s">$</span> <span class="k">\\</span>
		  1 <span class="nb">&amp;</span> <span class="s">$</span><span class="nb">b</span><span class="s">$</span> <span class="nb">&amp;</span> <span class="s">$</span><span class="nb">b</span><span class="s">$</span> <span class="k">\\</span>
	<span class="k">\end</span><span class="nb">{</span>tabular<span class="nb">}</span>
	<span class="k">\caption</span><span class="nb">{</span>Const folding rules for <span class="nb">{</span><span class="k">\tt\$\_</span>AND<span class="k">\_</span><span class="nb">}</span> cells as used in <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>expr<span class="nb">}</span>.<span class="nb">}</span>
	<span class="k">\label</span><span class="nb">{</span>tab:opt<span class="nb">_</span>expr<span class="nb">_</span>and<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>table<span class="nb">}</span>

Table~<span class="k">\ref</span><span class="nb">{</span>tab:opt<span class="nb">_</span>expr<span class="nb">_</span>and<span class="nb">}</span> shows the replacement rules used for optimizing
an <span class="nb">{</span><span class="k">\tt\$\_</span>AND<span class="k">\_</span><span class="nb">}</span> gate. The first three rules implement the obvious const folding
rules. Note that `any&#39; might include dynamic values calculated by other parts
of the circuit. The following three lines propagate undef (X) states.
These are the only three cases in which it is allowed to propagate an undef
according to Sec.~5.1.10 of IEEE Std. 1364-2005 <span class="k">\cite</span><span class="nb">{</span>Verilog2005<span class="nb">}</span>.

The next two lines assume the value 0 for undef states. These two rules are only
used if no other substitutions are possible in the current module. If other substitutions
are possible they are performed first, in the hope that the `any&#39; will change to
an undef value or a 1 and therefore the output can be set to undef.

The last two lines simply replace an <span class="nb">{</span><span class="k">\tt\$\_</span>AND<span class="k">\_</span><span class="nb">}</span> gate with one constant-1
input with a buffer.

Besides this basic const folding the <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>expr<span class="nb">}</span> pass can replace 1-bit wide
<span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>eq<span class="nb">}</span> and <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>ne<span class="nb">}</span> cells with buffers or not-gates if one input is constant.

The <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>expr<span class="nb">}</span> pass is very conservative regarding optimizing <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>mux<span class="nb">}</span> cells,
as these cells are often used to model decision-trees and breaking these trees can
interfere with other optimizations.

<span class="k">\subsection</span><span class="nb">{</span>The opt<span class="k">\_</span>muxtree pass<span class="nb">}</span>

This pass optimizes trees of multiplexer cells by analyzing the select inputs.
Consider the following simple example:

<span class="k">\begin</span><span class="nb">{</span>lstlisting<span class="nb">}</span>[numbers=left,frame=single,language=Verilog]
module uut(a, y);
input a;
output [1:0] y = a ? (a ? 1 : 2) : 3;
endmodule
<span class="k">\end</span><span class="nb">{</span>lstlisting<span class="nb">}</span>

The output can never be 2, as this would require <span class="k">\lstinline</span><span class="na">[language=Verilog]</span>;a;
to be 1 for the outer multiplexer and 0 for the inner multiplexer. The <span class="nb">{</span><span class="k">\tt</span>
opt<span class="k">\_</span>muxtree<span class="nb">}</span> pass detects this contradiction and replaces the inner multiplexer
with a constant 1, yielding the logic for <span class="k">\lstinline</span><span class="na">[language=Verilog]</span>;y = a ? 1 : 3;.

<span class="k">\subsection</span><span class="nb">{</span>The opt<span class="k">\_</span>reduce pass<span class="nb">}</span>

<span class="k">\begin</span><span class="nb">{</span>sloppypar<span class="nb">}</span>
This is a simple optimization pass that identifies and consolidates identical input
bits to <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>and<span class="nb">}</span> and <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>or<span class="nb">}</span> cells. It also sorts the input
bits to ease identification of shareable <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>and<span class="nb">}</span> and <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>or<span class="nb">}</span> cells
in other passes.
<span class="k">\end</span><span class="nb">{</span>sloppypar<span class="nb">}</span>

This pass also identifies and consolidates identical inputs to multiplexer cells. In this
case the new shared select bit is driven using a <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>or<span class="nb">}</span> cell that combines
the original select bits.

Lastly this pass consolidates trees of <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>and<span class="nb">}</span> cells and trees of
<span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>or<span class="nb">}</span> cells to single large <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>and<span class="nb">}</span> or <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>reduce<span class="k">\_</span>or<span class="nb">}</span> cells.

These three simple optimizations are performed in a loop until a stable result is
produced.

<span class="k">\subsection</span><span class="nb">{</span>The opt<span class="k">\_</span>rmdff pass<span class="nb">}</span>

This pass identifies single-bit d-type flip-flops (<span class="nb">{</span><span class="k">\tt</span> <span class="k">\$\_</span>DFF<span class="k">\_*</span><span class="nb">}</span>, <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>dff<span class="nb">}</span>, and <span class="nb">{</span><span class="k">\tt</span>
<span class="k">\$</span>adff<span class="nb">}</span> cells) with a constant data input and replaces them with a constant driver.

<span class="k">\subsection</span><span class="nb">{</span>The opt<span class="k">\_</span>clean pass<span class="nb">}</span>

This pass identifies unused signals and cells and removes them from the design. It also
creates an <span class="k">\B</span><span class="nb">{</span>unused<span class="k">\_</span>bits<span class="nb">}</span> attribute on wires with unused bits. This attribute can be
used for debugging or by other optimization passes.

<span class="k">\subsection</span><span class="nb">{</span>The opt<span class="k">\_</span>merge pass<span class="nb">}</span>

This pass performs trivial resource sharing. This means that this pass identifies cells
with identical inputs and replaces them with a single instance of the cell.

The option <span class="nb">{</span><span class="k">\tt</span> -nomux<span class="nb">}</span> can be used to disable resource sharing for multiplexer
cells (<span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>mux<span class="nb">}</span> and <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>pmux<span class="nb">}</span>. This can be useful as
it prevents multiplexer trees to be merged, which might prevent <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>muxtree<span class="nb">}</span>
to identify possible optimizations.

<span class="k">\section</span><span class="nb">{</span>FSM Extraction and Encoding<span class="nb">}</span>

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="nb">}</span> pass performs finite-state-machine (FSM) extraction and recoding. The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="nb">}</span>
pass simply executes the following other passes:

<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> Identify and extract FSMs:
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>detect<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>extract<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\item</span> Basic optimizations:
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>opt<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>clean<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>opt<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\item</span> Expanding to nearby gate-logic (if called with <span class="nb">{</span><span class="k">\tt</span> -expand<span class="nb">}</span>):
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>expand<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>clean<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>opt<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\item</span> Re-code FSM states (unless called with <span class="nb">{</span><span class="k">\tt</span> -norecode<span class="nb">}</span>):
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>recode<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\item</span> Print information about FSMs:
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>info<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\item</span> Export FSMs in KISS2 file format (if called with <span class="nb">{</span><span class="k">\tt</span> -export<span class="nb">}</span>):
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>export<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\item</span> Map FSMs to RTL cells (unless called with <span class="nb">{</span><span class="k">\tt</span> -nomap<span class="nb">}</span>):
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>map<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>detect<span class="nb">}</span> pass identifies FSM state registers and marks them using the
<span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}{</span><span class="k">\tt</span> = &quot;auto&quot;<span class="nb">}</span> attribute. The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>extract<span class="nb">}</span> extracts all
FSMs marked using the <span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}</span> attribute (unless <span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}</span> is
set to <span class="nb">{</span><span class="k">\tt</span> &quot;none&quot;<span class="nb">}</span>) and replaces the corresponding RTL cells with a <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>fsm<span class="nb">}</span>
cell. All other <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_*</span><span class="nb">}</span> passes operate on these <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>fsm<span class="nb">}</span> cells. The
<span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>map<span class="nb">}</span> call finally replaces the <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>fsm<span class="nb">}</span> cells with RTL cells.

Note that these optimizations operate on an RTL netlist. I.e.~the <span class="nb">{</span><span class="k">\tt</span> fsm<span class="nb">}</span> pass
should be executed after the <span class="nb">{</span><span class="k">\tt</span> proc<span class="nb">}</span> pass has transformed all
<span class="nb">{</span><span class="k">\tt</span> RTLIL::Process<span class="nb">}</span> objects to RTL cells.

The algorithms used for FSM detection and extraction are influenced by a more
general reported technique <span class="k">\cite</span><span class="nb">{</span>fsmextract<span class="nb">}</span>.

<span class="k">\subsection</span><span class="nb">{</span>FSM Detection<span class="nb">}</span>

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>detect<span class="nb">}</span> pass identifies FSM state registers. It sets the
<span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}{</span><span class="k">\tt</span> = &quot;auto&quot;<span class="nb">}</span> attribute on any (multi-bit) wire that matches
the following description:

<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> Does not already have the <span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}</span> attribute.
<span class="k">\item</span> Is not an output of the containing module.
<span class="k">\item</span> Is driven by single <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>dff<span class="nb">}</span> or <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>adff<span class="nb">}</span> cell.
<span class="k">\item</span> The <span class="k">\B</span><span class="nb">{</span>D<span class="nb">}</span>-Input of this <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>dff<span class="nb">}</span> or <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>adff<span class="nb">}</span> cell is driven by a multiplexer
tree that only has constants or the old state value on its leaves.
<span class="k">\item</span> The state value is only used in the said multiplexer tree or by simple relational
cells that compare the state value to a constant (usually <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>eq<span class="nb">}</span> cells).
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

This heuristic has proven to work very well. It is possible to overwrite it by setting
<span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}{</span><span class="k">\tt</span> = &quot;auto&quot;<span class="nb">}</span> on registers that should be considered FSM state registers
and setting <span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}{</span><span class="k">\tt</span> = &quot;none&quot;<span class="nb">}</span> on registers that match the above criteria
but should not be considered FSM state registers.

Note however that marking state registers with <span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}</span> that are not
suitable for FSM recoding can cause synthesis to fail or produce invalid
results.

<span class="k">\subsection</span><span class="nb">{</span>FSM Extraction<span class="nb">}</span>

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>extract<span class="nb">}</span> pass operates on all state signals marked with the
<span class="k">\B</span><span class="nb">{</span>fsm<span class="k">\_</span>encoding<span class="nb">}</span> (<span class="nb">{</span><span class="k">\tt</span> != &quot;none&quot;<span class="nb">}</span>) attribute. For each state signal the following
information is determined:

<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> The state registers
<span class="k">\item</span> The asynchronous reset state if the state registers use asynchronous reset
<span class="k">\item</span> All states and the control input signals used in the state transition functions
<span class="k">\item</span> The control output signals calculated from the state signals and control inputs
<span class="k">\item</span> A table of all state transitions and corresponding control inputs- and outputs
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

The state registers (and asynchronous reset state, if applicable) is simply determined
by identifying the driver for the state signal.

From there the <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>mux<span class="nb">}</span>-tree driving the state register inputs is
recursively traversed. All select inputs are control signals and the leaves of the
<span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>mux<span class="nb">}</span>-tree are the states. The algorithm fails if a non-constant leaf
that is not the state signal itself is found.

The list of control outputs is initialized with the bits from the state signal.
It is then extended by adding all values that are calculated by cells that
compare the state signal with a constant value.

In most cases this will cover all uses of the state register, thus rendering the
state encoding arbitrary. If however a design uses e.g.~a single bit of the state
value to drive a control output directly, this bit of the state signal will be
transformed to a control output of the same value.

Finally, a transition table for the FSM is generated. This is done by using the
<span class="nb">{</span><span class="k">\tt</span> ConstEval<span class="nb">}</span> C++ helper class (defined in <span class="nb">{</span><span class="k">\tt</span> kernel/consteval.h<span class="nb">}</span>) that can
be used to evaluate parts of the design. The <span class="nb">{</span><span class="k">\tt</span> ConstEval<span class="nb">}</span> class can be asked
to calculate a given set of result signals using a set of signal-value
assignments. It can also be passed a list of stop-signals that abort the <span class="nb">{</span><span class="k">\tt</span>
ConstEval<span class="nb">}</span> algorithm if the value of a stop-signal is needed in order to
calculate the result signals.

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>extract<span class="nb">}</span> pass uses the <span class="nb">{</span><span class="k">\tt</span> ConstEval<span class="nb">}</span> class in the following way
to create a transition table. For each state:

<span class="k">\begin</span><span class="nb">{</span>enumerate<span class="nb">}</span>
<span class="k">\item</span> Create a <span class="nb">{</span><span class="k">\tt</span> ConstEval<span class="nb">}</span> object for the module containing the FSM
<span class="k">\item</span> Add all control inputs to the list of stop signals
<span class="k">\item</span> Set the state signal to the current state
<span class="k">\item</span> Try to evaluate the next state and control output <span class="k">\label</span><span class="nb">{</span>enum:fsm<span class="nb">_</span>extract<span class="nb">_</span>cealg<span class="nb">_</span>try<span class="nb">}</span>
<span class="k">\item</span> If step~<span class="k">\ref</span><span class="nb">{</span>enum:fsm<span class="nb">_</span>extract<span class="nb">_</span>cealg<span class="nb">_</span>try<span class="nb">}</span> was not successful:
<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> Recursively goto step~<span class="k">\ref</span><span class="nb">{</span>enum:fsm<span class="nb">_</span>extract<span class="nb">_</span>cealg<span class="nb">_</span>try<span class="nb">}</span> with the offending stop-signal set to 0.
<span class="k">\item</span> Recursively goto step~<span class="k">\ref</span><span class="nb">{</span>enum:fsm<span class="nb">_</span>extract<span class="nb">_</span>cealg<span class="nb">_</span>try<span class="nb">}</span> with the offending stop-signal set to 1.
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> If step~<span class="k">\ref</span><span class="nb">{</span>enum:fsm<span class="nb">_</span>extract<span class="nb">_</span>cealg<span class="nb">_</span>try<span class="nb">}</span> was successful: Emit transition
<span class="k">\end</span><span class="nb">{</span>enumerate<span class="nb">}</span>

Finally a <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>fsm<span class="nb">}</span> cell is created with the generated transition table and added to the
module. This new cell is connected to the control signals and the old drivers for the
control outputs are disconnected.

<span class="k">\subsection</span><span class="nb">{</span>FSM Optimization<span class="nb">}</span>

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>opt<span class="nb">}</span> pass performs basic optimizations on <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>fsm<span class="nb">}</span> cells (not including state
recoding). The following optimizations are performed (in this order):

<span class="k">\begin</span><span class="nb">{</span>itemize<span class="nb">}</span>
<span class="k">\item</span> Unused control outputs are removed from the <span class="nb">{</span><span class="k">\tt</span> <span class="k">\$</span>fsm<span class="nb">}</span> cell. The attribute <span class="k">\B</span><span class="nb">{</span>unused<span class="k">\_</span>bits<span class="nb">}</span>
(that is usually set by the <span class="nb">{</span><span class="k">\tt</span> opt<span class="k">\_</span>clean<span class="nb">}</span> pass) is used to determine which control
outputs are unused.
<span class="k">\item</span> Control inputs that are connected to the same driver are merged.
<span class="k">\item</span> When a control input is driven by a control output, the control input is removed and the transition
table altered to give the same performance without the external feedback path.
<span class="k">\item</span> Entries in the transition table that yield the same output and only
differ in the value of a single control input bit are merged and the different bit is removed
from the sensitivity list (turned into a don&#39;t-care bit).
<span class="k">\item</span> Constant inputs are removed and the transition table is altered to give an unchanged behaviour.
<span class="k">\item</span> Unused inputs are removed.
<span class="k">\end</span><span class="nb">{</span>itemize<span class="nb">}</span>

<span class="k">\subsection</span><span class="nb">{</span>FSM Recoding<span class="nb">}</span>

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>recode<span class="nb">}</span> pass assigns new bit pattern to the states. Usually this
also implies a change in the width of the state signal. At the moment of this
writing only one-hot encoding with all-zero for the reset state is supported.

The <span class="nb">{</span><span class="k">\tt</span> fsm<span class="k">\_</span>recode<span class="nb">}</span> pass can also write a text file with the changes performed
by it that can be used when verifying designs synthesized by Yosys using Synopsys
Formality <span class="k">\citeweblink</span><span class="nb">{</span>Formality<span class="nb">}</span>.

<span class="k">\section</span><span class="nb">{</span>Logic Optimization<span class="nb">}</span>

Yosys can perform multi-level combinational logic optimization on gate-level netlists using the
external program ABC <span class="k">\citeweblink</span><span class="nb">{</span>ABC<span class="nb">}</span>. The <span class="nb">{</span><span class="k">\tt</span> abc<span class="nb">}</span> pass extracts the combinational gate-level
parts of the design, passes it through ABC, and re-integrates the results. The <span class="nb">{</span><span class="k">\tt</span> abc<span class="nb">}</span> pass
can also be used to perform other operations using ABC, such as technology mapping (see
Sec.~<span class="k">\ref</span><span class="nb">{</span>sec:techmap<span class="nb">_</span>extern<span class="nb">}</span> for details).
</pre></div>
</code></pre></td></tr></table>
</div> <!-- class=content -->
<div class='footer'>generated by <a href='https://git.zx2c4.com/cgit/about/'>cgit v1.2.3</a> (<a href='https://git-scm.com/'>git 2.25.1</a>) at 2025-11-30 21:33:53 +0000</div>
</div> <!-- id=cgit -->
</body>
</html>
by using the 'ping' connectivity test. It is also related to the STE</div><div class='del'>-policy. {\bf Note:} sHype/Xen does control direct communication between</div><div class='del'>-domains. However, domains associated with different workloads can</div><div class='del'>-currently still communicate through the Domain-0 virtual network. We</div><div class='del'>-are working on the sHype/ACM controls for local and remote network</div><div class='del'>-traffic through Domain-0. Please monitor the xen-devel mailing list</div><div class='del'>-for updated information.</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-\subsection{Labeling Domain-0 --or-- Restricting System Authorization}</div><div class='del'>-\label{subsection:acmlabeldom0}</div><div class='del'>-The major use case for explicitly labeling or relabeling Domain-0 is to restrict</div><div class='del'>-or extend which workload types can run on a virtualized Xen system. This enables</div><div class='del'>-flexible partitioning of the physical infrastructure as well as the workloads</div><div class='del'>-running on it in a multi-platform environment.</div><div class='del'>-</div><div class='del'>-In case no Domain-0 label is explicitly stated, we automatically assigned Domain-0</div><div class='del'>-the \verb|SystemManagement| label, which includes all STE (workload) types that</div><div class='del'>-are known to the policy. In effect, the Domain-0 label authorizes the Xen system</div><div class='del'>-to run only those workload types, whose STE types are included in the Domain-0</div><div class='del'>-label. Hence, choosing the \verb|SystemManagement| label for Domain-0 permits any</div><div class='del'>-labeled domain to run. Resetting the label for Domain-0 at boot or run-time to</div><div class='del'>-a label with a subset of the known STE workload types restricts which user domains</div><div class='del'>-can run on this system. If Domain-0 is relabeled at run-time, then the new label</div><div class='del'>-must at least include all STE types of those domains that are currently running.</div><div class='del'>-The operation fails otherwise. This requirement ensures that the system remains</div><div class='del'>-in a valid security configuration after re-labelling.</div><div class='del'>-</div><div class='del'>-Restricting the Domain-0 authorization through the label creates a flexible</div><div class='del'>-policy-driven way to strongly partition the physical infrastructure and the</div><div class='del'>-workloads running on it. This partitioning will be automatically enforced during</div><div class='del'>-migration, start, or resume of domains and simplifies the security management</div><div class='del'>-considerably. Strongly competing workloads can be forced to run on separate physical</div><div class='del'>-infrastructure and become less depend on the domain isolation capabilities</div><div class='del'>-of the hypervisor.</div><div class='del'>-</div><div class='del'>-First, we relabel the swap image back to A-Bank and then start up domain1:</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm rmlabel res file:/home/xen/dom_fc5/fedora.fc5.swap</div><div class='del'>-</div><div class='del'>-# xm addlabel A-Bank res file:/home/xen/dom_fc5/fedora.fc5.swap</div><div class='del'>-</div><div class='del'>-# xm create domain1.xm</div><div class='del'>-Using config file "./domain1.xm".</div><div class='del'>-Started domain domain1</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    7   128     1     -b----      0.7  ACM:mytest:A-Bank</div><div class='del'>-Domain-0   0   839     1     r-----    103.1  ACM:mytest:SystemManagement</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-The following command will restrict the Xen system to only run STE types</div><div class='del'>-included in the A-Bank label.</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm addlabel A-Bank mgt Domain-0</div><div class='del'>-Successfully set the label of domain 'Domain-0' to 'A-Bank'.</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-Domain-0   0   839     1     r-----    103.7  ACM:mytest:A-Bank</div><div class='del'>-domain1    7   128     1     -b----      0.7  ACM:mytest:A-Bank</div><div class='del'>-</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-In our example policy in Figure~\ref{fig:acmxmlfileb}, this means that</div><div class='del'>-only \verb|A-Bank| domains and workloads (types) can run after the</div><div class='del'>-successful completion of this command because the \verb|A-Bank| label</div><div class='del'>-includes only a single STE type, namely \verb|A-Bank|. This command</div><div class='del'>-fails if any running domain has an STE type in its label that is not</div><div class='del'>-included in the A-Bank label.</div><div class='del'>-</div><div class='del'>-If we now label a domain3 with AutoCorp, it cannot start because Domain-0 is</div><div class='del'>-no longer authorized to run the workload type \verb|AutoCorp|.</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm addlabel AutoCorp dom domain3.xm</div><div class='del'>-  (remember to label its resources, too)</div><div class='del'>-</div><div class='del'>-# xm create domain3.xm</div><div class='del'>-Using config file "./domain3.xm".</div><div class='del'>-Error: VM is not authorized to run.</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-Domain-0   0   839     1     r-----    104.7  ACM:mytest:A-Bank</div><div class='del'>-domain1    7   128     1     -b----      0.7  ACM:mytest:A-Bank</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-At this point, unlabeled domains cannot start either. Let domain4.xm</div><div class='del'>-describe an unlabeled domain, then trying to start domain4</div><div class='del'>-will fail:</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm getlabel dom domain4.xm</div><div class='del'>-Error: 'Domain not labeled'</div><div class='del'>-</div><div class='del'>-# xm create domain4.xm</div><div class='del'>-Using config file "./domain4.xm".</div><div class='del'>-Error: VM is not authorized to run.</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-Relabeling Domain-0 with the SystemManagement label will enable domain3 to start.</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm addlabel SystemManagement mgt Domain-0</div><div class='del'>-Successfully set the label of domain 'Domain-0' to 'SystemManagement'.</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    7   128     1     -b----      0.8  ACM:mytest:A-Bank</div><div class='del'>-Domain-0   0   839     1     r-----    106.6  ACM:mytest:SystemManagement</div><div class='del'>-</div><div class='del'>-# xm create domain3.xm</div><div class='del'>-Using config file "./domain3.xm".</div><div class='del'>-Started domain domain3</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    7   128     1     -b----      0.8 ACM:mytest:A-Bank</div><div class='del'>-domain3    8   164     1     -b----      0.3 ACM:mytest:AutoCorp</div><div class='del'>-Domain-0   0   711     1     r-----    107.6 ACM:mytest:SystemManagement</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-\subsection{Labeling Managed User Domains}</div><div class='del'>-\label{subsection:acmlabelmanageddomains}</div><div class='del'>-</div><div class='del'>-Xend has been extended with functionality to manage domains along with their</div><div class='del'>-configuration information. Such domains are configured and started via Xen-API</div><div class='del'>-calls. Since managed domains do not have an associated xm configuration file,</div><div class='del'>-the existing \verb|addlabel| command, which adds the security label into a</div><div class='del'>-domain's configuration file, will not work for such managed domains.</div><div class='del'>-</div><div class='del'>-Therefore, we have extended the \verb|xm addlabel| and \verb|xm rmlabel|</div><div class='del'>-subcommands to enable adding security labels to and removing security</div><div class='del'>-labels from managed domain configurations. The following example shows how</div><div class='del'>-the \verb|A-Bank| label can be assigned to the xend-managed</div><div class='del'>-domain configuration of \verb|domain1|. Removing labels from managed user</div><div class='del'>-domain configurations works similarly.</div><div class='del'>-</div><div class='del'>-Below, we show a dormant configuration of the managed domain1</div><div class='del'>-with ID \verb|"-1"| and state \verb|"-----"| before labeling:</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1   -1   128     1     ------      0.0 ACM:mytest:__UNLABELED__</div><div class='del'>-Domain-0   0   711     1     r-----    128.4 ACM:mytest:SystemManagement</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-Now we label the managed domain:</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm addlabel A-Bank mgt domain1</div><div class='del'>-Successfully set the label of the dormant domain 'domain1' to 'A-Bank'.</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-After labeling, you can see that the security label is part of the</div><div class='del'>-domain configuration:</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1   -1   128     1     ------      0.0  ACM:mytest:A-Bank</div><div class='del'>-Domain-0   0   711     1     r-----    129.7  ACM:mytest:SystemManagement</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-This command extension does not support relabeling of individual running user domains</div><div class='del'>-for several reasons. For one, because of the difficulty to revoke resources</div><div class='del'>-in cases where a running domain's new label does not permit access to resources</div><div class='del'>-that were accessible under the old label. Another reason is that changing the</div><div class='del'>-label of a single domain of a workload is rarely a good choice and will affect</div><div class='del'>-the workload isolation properties of the overall workload.</div><div class='del'>-</div><div class='del'>-However, the name and contents of the label associated with running domains can</div><div class='del'>-be indirectly changed through a global policy change, which will update the whole</div><div class='del'>-workload consistently (domains and resources), cf.</div><div class='del'>-Section~\ref{subsection:acmpolicymanagement}.</div><div class='del'>-</div><div class='del'>-\section{Xen Access Control Policy}</div><div class='del'>-\label{section:acmpolicy}</div><div class='del'>-</div><div class='del'>-This section describes the sHype/Xen access control policy in detail.</div><div class='del'>-It gives enough information to enable the reader to write custom</div><div class='del'>-access control policies and to use the available Xen policy tools. The</div><div class='del'>-policy language is expressive enough to specify most symmetric access</div><div class='del'>-relationships between domains and resources efficiently.</div><div class='del'>-</div><div class='del'>-The Xen access control policy consists of two policy components.  The</div><div class='del'>-first component, called Simple Type Enforcement (STE) policy, controls</div><div class='del'>-the sharing between running domains, i.e., communication or access to</div><div class='del'>-shared resources. The second component, called Chinese Wall (CHWALL)</div><div class='del'>-policy, controls which domains can run simultaneously on the same</div><div class='del'>-virtualized platform. The CHWALL and STE policy components complement</div><div class='del'>-each other. The XML policy file includes all information</div><div class='del'>-needed by Xen to enforce those policies.</div><div class='del'>-</div><div class='del'>-Figures~\ref{fig:acmxmlfilea} and \ref{fig:acmxmlfileb} show the fully</div><div class='del'>-functional but very simple example Xen security policy that is created</div><div class='del'>-by ezPolicy as shown in Figure~\ref{fig:acmezpolicy}. The policy can</div><div class='del'>-distinguish the 6 workload types shown in lines 11-17 in</div><div class='del'>-Fig.~\ref{fig:acmxmlfilea}. The whole XML Security Policy consists of</div><div class='del'>-four parts:</div><div class='del'>-\begin{enumerate}</div><div class='del'>-\item Policy header including the policy name</div><div class='del'>-\item Simple Type Enforcement block</div><div class='del'>-\item Chinese Wall Policy block</div><div class='del'>-\item Label definition block</div><div class='del'>-\end{enumerate}</div><div class='del'>-</div><div class='del'>-\begin{figure}</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-01  &lt;?xml version="1.0" ?&gt;</div><div class='del'>-02  &lt;!-- Auto-generated by ezPolicy        --&gt;</div><div class='del'>-03  &lt;SecurityPolicyDefinition ..."&gt;</div><div class='del'>-04      &lt;PolicyHeader&gt;</div><div class='del'>-05          &lt;PolicyName&gt;mytest&lt;/PolicyName&gt;</div><div class='del'>-06          &lt;Date&gt;Mon Nov 19 22:51:56 2007&lt;/Date&gt;</div><div class='del'>-07          &lt;Version&gt;1.0&lt;/Version&gt;</div><div class='del'>-08      &lt;/PolicyHeader&gt;</div><div class='del'>-09      &lt;SimpleTypeEnforcement&gt;</div><div class='del'>-10          &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-11              &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-12              &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-13              &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-14              &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-15              &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-16              &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-17              &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-18          &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-19      &lt;/SimpleTypeEnforcement&gt;</div><div class='del'>-20      &lt;ChineseWall priority="PrimaryPolicyComponent"&gt;</div><div class='del'>-21          &lt;ChineseWallTypes&gt;</div><div class='del'>-22              &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-23              &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-24              &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-25              &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-26              &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-27              &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-28              &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-29          &lt;/ChineseWallTypes&gt;</div><div class='del'>-30          &lt;ConflictSets&gt;</div><div class='del'>-31              &lt;Conflict name="RER"&gt;</div><div class='del'>-32                  &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-33                  &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-34                  &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-35              &lt;/Conflict&gt;</div><div class='del'>-36              &lt;Conflict name="RER"&gt;</div><div class='del'>-37                  &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-38                  &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-39                  &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-40              &lt;/Conflict&gt;</div><div class='del'>-41         &lt;/ConflictSets&gt;</div><div class='del'>-42      &lt;/ChineseWall&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-\caption{Example XML security policy file -- Part I: Types and Rules Definition.}</div><div class='del'>-\label{fig:acmxmlfilea}</div><div class='del'>-\end{figure}</div><div class='del'>-</div><div class='del'>-\subsection{Policy Header and Policy Name}</div><div class='del'>-\label{subsection:acmnaming}</div><div class='del'>-Lines 1-2 (cf Figure~\ref{fig:acmxmlfilea}) include the usual XML</div><div class='del'>-header. The security policy definition starts in Line 3 and refers to</div><div class='del'>-the policy schema. The XML-Schema definition for the Xen policy can be</div><div class='del'>-found in the file</div><div class='del'>-\textit{/etc/xen/acm-security/policies/security-policy.xsd}. Examples</div><div class='del'>-for security policies can be found in the example subdirectory. The</div><div class='del'>-acm-security directory is only installed if ACM security is configured</div><div class='del'>-during installation (cf Section~\ref{subsection:acmexampleconfigure}).</div><div class='del'>-</div><div class='del'>-The \verb|Policy Header| spans lines 4-8. It includes a date field and</div><div class='del'>-defines the policy name \verb|mytest| as well</div><div class='del'>-as the version of the XML. It can also include optional fields that are</div><div class='del'>-not shown and are for future use (see schema definition).</div><div class='del'>-</div><div class='del'>-The policy name serves two purposes: First, it provides a unique name</div><div class='del'>-for the security policy. This name is also exported by the Xen</div><div class='del'>-hypervisor to the Xen management tools in order to ensure that both</div><div class='del'>-the Xen hypervisor and Domain-0 enforce the same policy.</div><div class='del'>-We plan to extend the policy name with a</div><div class='del'>-digital fingerprint of the policy contents to better protect this</div><div class='del'>-correlation.  Second, it implicitly points the xm tools to the</div><div class='del'>-location where the XML policy file is stored on the Xen system.</div><div class='del'>-Replacing the colons in the policy name by slashes yields the local</div><div class='del'>-path to the policy file starting from the global policy directory</div><div class='del'>-\verb|/etc/xen/acm-security/policies|. The last part of the policy</div><div class='del'>-name is the prefix for the XML policy file name, completed by</div><div class='del'>-\verb|-security_policy.xml|. Our example policy with the name</div><div class='del'>-\verb|mytest| can be found in the XML policy file named</div><div class='del'>-\verb|mytest-security_policy.xml| that is stored under the global</div><div class='del'>-policy directory. Another, preinstalled example policy named</div><div class='del'>-\verb|example.test| can be found in the \verb|test-security_policy.xml|</div><div class='del'>-under \verb|/etc/xen/acm-security/policies/example|.</div><div class='del'>-</div><div class='del'>-\subsection{Simple Type Enforcement Policy Component}</div><div class='del'>-</div><div class='del'>-The Simple Type Enforcement (STE) policy controls which domains can</div><div class='del'>-communicate or share resources. This way, Xen can enforce confinement</div><div class='del'>-of workload types by confining the domains running those workload</div><div class='del'>-types and their resources. The mandatory access control framework</div><div class='del'>-enforces its policy when</div><div class='del'>-domains access intended communication or cooperation means (shared</div><div class='del'>-memory, events, shared resources such as block devices). It builds on</div><div class='del'>-top of the core hypervisor isolation, which restricts the ways of</div><div class='del'>-inter-communication to those intended means.  STE does not protect or</div><div class='del'>-intend to protect from covert channels in the hypervisor or hardware;</div><div class='del'>-this is an orthogonal problem that can be mitigated by using the</div><div class='del'>-Run-time Exclusion rules described above or by fixing the problem leading</div><div class='del'>-to those covert channels in the core hypervisor or hardware platform.</div><div class='del'>-</div><div class='del'>-Xen controls sharing between domains on the resource and domain level</div><div class='del'>-because this is the abstraction the hypervisor and its management</div><div class='del'>-understand naturally. While this is coarse-grained, it is also very</div><div class='del'>-reliable and robust and it requires minimal changes to implement</div><div class='del'>-mandatory access controls in the hypervisor. It enables platform- and</div><div class='del'>-operating system-independent policies as part of a layered security</div><div class='del'>-approach.</div><div class='del'>-</div><div class='del'>-Lines 11-17 (cf Figure~\ref{fig:acmxmlfilea}) define the Simple Type</div><div class='del'>-Enforcement policy component.  Essentially, they define the workload</div><div class='del'>-type names \verb|SystemManagement|, \verb|A-Bank|,</div><div class='del'>-\verb|AutoCorp| etc. that are available in the STE policy component. The</div><div class='del'>-policy rules are implicit: Xen permits two domains to communicate with</div><div class='del'>-each other if and only if their security labels have at least one STE type in</div><div class='del'>-common.  Similarly, Xen permits a user domain to access a</div><div class='del'>-resource if and only if the labels of the domain and the resource</div><div class='del'>-have at least one STE workload type in common.</div><div class='del'>-</div><div class='del'>-\subsection{Chinese Wall Policy Component}</div><div class='del'>-</div><div class='del'>-The Chinese Wall security policy interpretation of sHype enables users</div><div class='del'>-to prevent certain workloads from running simultaneously on the same</div><div class='del'>-hypervisor platform.  Run-time Exclusion rules (RER), also called</div><div class='del'>-Conflict Sets or Anti-Collocation rules, define a set of workload types</div><div class='del'>-that are not permitted to run simultaneously on the same virtualized</div><div class='del'>-platform. Of all the workloads specified in a Run-time</div><div class='del'>-Exclusion rule, at most one type can run on the same hypervisor</div><div class='del'>-platform at a time.  Run-time Exclusion Rules implement a less</div><div class='del'>-rigorous variant of the original Chinese Wall security component. They</div><div class='del'>-do not implement the *-property of the policy, which would require to</div><div class='del'>-restrict also types that are not part of an exclusion rule once they</div><div class='del'>-are running together with a type in an exclusion rule</div><div class='del'>-(http://www.gammassl.co.uk/topics/chinesewall.html provides more information</div><div class='del'>-on the original Chinese Wall policy).</div><div class='del'>-</div><div class='del'>-Xen considers the \verb|ChineseWallTypes| part of the label for the</div><div class='del'>-enforcement of the Run-time Exclusion rules.  It is illegal to define</div><div class='del'>-labels including conflicting Chinese Wall types.</div><div class='del'>-</div><div class='del'>-Lines 20-41 (cf Figure~\ref{fig:acmxmlfilea}) define the Chinese Wall</div><div class='del'>-policy component. Lines 22-28 define the known Chinese Wall types,</div><div class='del'>-which coincide here with the STE types defined above. This usually</div><div class='del'>-holds if the criteria for sharing among domains and sharing of the</div><div class='del'>-hardware platform are the same. Lines 30-41 define one Run-time</div><div class='del'>-Exclusion rules, the first of which is depicted below:</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-31  &lt;Conflict name="RER"&gt;</div><div class='del'>-32    &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-33    &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-34    &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-35  &lt;/Conflict&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-Based on this rule, Xen enforces that only one of the types</div><div class='del'>-\verb|A-Bank|, \verb|B-Bank|, or \verb|__UNLABELED__| will run</div><div class='del'>-on a single hypervisor platform at a time. For example, once a domain assigned a</div><div class='del'>-\verb|A-Bank| workload type is started, domains with the</div><div class='del'>-\verb|B-Bank| type or unlabeled domains will be denied to start.</div><div class='del'>-When the former domain stops and no other domains with the \verb|A-Bank|</div><div class='del'>-type are running, then domains with the \verb|B-Bank| type or unlabeled domains</div><div class='del'>-can start.</div><div class='del'>-</div><div class='del'>-Xen maintains reference counts on each running workload type to keep</div><div class='del'>-track of which workload types are running. Every time a domain starts</div><div class='del'>-or resumes, the reference count on those Chinese Wall types that are</div><div class='del'>-referenced in the domain's label are incremented. Every time a domain</div><div class='del'>-is destroyed or saved, the reference counts of its Chinese Wall types</div><div class='del'>-are decremented. sHype in Xen fully supports migration and live-migration,</div><div class='del'>-which is subject to access control the same way as saving a domain on</div><div class='del'>-the source platform and resuming it on the destination platform.</div><div class='del'>-</div><div class='del'>-Here are some reasons why users might want to restrict workloads or domains</div><div class='del'>-from sharing the system hardware simultaneously:</div><div class='del'>-</div><div class='del'>-\begin{itemize}</div><div class='del'>-\item Imperfect resource management or control might enable a compromised</div><div class='del'>-  user domain to starve other domains and the workload running in them.</div><div class='del'>-\item Redundant user domains might run the same workload to increase</div><div class='del'>-  availability; such domains should not run on the same hardware to</div><div class='del'>-  avoid single points of failure.</div><div class='del'>-\item Imperfect Xen core domain isolation might enable two rogue</div><div class='del'>-  domains running different workload types to use unintended and</div><div class='del'>-  unknown ways (covert channels) to exchange some bits of information.</div><div class='del'>-  This way, they bypass the policed Xen access control mechanisms.  Such</div><div class='del'>-  imperfections cannot be completely eliminated and are a result of</div><div class='del'>-  trade-offs between security and other design requirements. For a</div><div class='del'>-  simple example of a covert channel see</div><div class='del'>-  http://www.multicians.org/timing-chn.html. Such covert channels</div><div class='del'>-  exist also between workloads running on different platforms if they</div><div class='del'>-  are connected through networks. The Xen Chinese Wall policy provides</div><div class='del'>-  an approximated ``air-gap'' between selected workload types.</div><div class='del'>-\end{itemize}</div><div class='del'>-</div><div class='del'>-\subsection{Security Labels}</div><div class='del'>-</div><div class='del'>-To enable Xen to associate domains with workload types running in</div><div class='del'>-them, each domain is assigned a security label that includes the</div><div class='del'>-workload types of the domain.</div><div class='del'>-</div><div class='del'>-\begin{figure}[htb]</div><div class='del'>-		\begin{tabular*}{\textwidth}{@{\extracolsep{\fill}}l|l}</div><div class='del'>-		\begin{minipage}{0.475\textwidth}</div><div class='del'>-		\begin{tiny}</div><div class='del'>-		\begin{verbatim}</div><div class='del'>-&lt;SecurityLabelTemplate&gt;</div><div class='del'>-  &lt;SubjectLabels bootstrap="SystemManagement"&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;SystemManagement&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;__UNLABELED__&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank.SecurityUnderwriting&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank.MarketAnalysis&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;B-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{tiny}</div><div class='del'>-\end{minipage} &amp;</div><div class='del'>-\begin{minipage}{0.475\textwidth}</div><div class='del'>-\begin{tiny}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;AutoCorp&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;/SubjectLabels&gt;</div><div class='del'>-  &lt;ObjectLabels&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;SystemManagement&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;__UNLABELED__&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;__UNLABELED__&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank.SecurityUnderwriting&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank.MarketAnalysis&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;B-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;AutoCorp&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;/ObjectLabels&gt;</div><div class='del'>-&lt;/SecurityLabelTemplate&gt;</div><div class='del'>-&lt;/SecurityPolicyDefinition&gt;</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{tiny}</div><div class='del'>-\end{minipage}</div><div class='del'>-\end{tabular*}</div><div class='del'>-\caption{Example XML security policy file -- Part II: Label Definition.}</div><div class='del'>-\label{fig:acmxmlfileb}</div><div class='del'>-\end{figure}</div><div class='del'>-% DO NOT MODIFY WHITESPACE ABOVE, it balances the columns</div><div class='del'>-The \verb|SecurityLabelTemplate| (cf Figure~\ref{fig:acmxmlfileb}) defines</div><div class='del'>-the security labels that can be associated with domains and resources when</div><div class='del'>-this policy is active (use the \verb|xm labels type=any| command described in</div><div class='del'>-Section~\ref{subsection:acmexamplelabeldomains} to list all available labels).</div><div class='del'>-</div><div class='del'>-The domain labels include</div><div class='del'>-Chinese Wall types while resource labels do not include Chinese Wall types.</div><div class='del'>-The \verb|SubjectLabels| policy section defines the labels that can be</div><div class='del'>-assigned to domains. The VM label</div><div class='del'>-\verb|A-Bank.SecurityUnderwriting| in Figure~\ref{fig:acmxmlfileb})</div><div class='del'>-associates the domain that carries it with the workload STE type</div><div class='del'>-\verb|A-Bank.SecurityUnderwriting| and with the CHWALL types \verb|A-Bank|</div><div class='del'>-and \verb|A-Bank.SecurityUnderwriting|. The ezPolicy tool</div><div class='del'>-assumes that any department workload will inherit any conflict set that</div><div class='del'>-is specified for its organization, i.e., if \verb|B-Bank| is running, not</div><div class='del'>-only \verb|A-Bank| but also all its departmental workloads are prevented</div><div class='del'>-from running by this first run-time exclusion set. The separation of STE</div><div class='del'>-and CHWALL types in the label definition ensures that</div><div class='del'>-all departmental workloads are isolated from each other and from their generic</div><div class='del'>-organization workloads, while they are sharing CHWALL types to</div><div class='del'>-simplify the formulation of run-time exclusion sets.</div><div class='del'>-</div><div class='del'>-The \verb|bootstrap| attribute of the \verb|&lt;SubjectLabels&gt;| XML node</div><div class='del'>-in our example policy shown in Figure~\ref{fig:acmxmlfileb} names</div><div class='del'>-the label \verb|SystemManagement| as the label that Xen will assign</div><div class='del'>-to Domain-0 at boot time (if this policy is installed as boot policy). The</div><div class='del'>-label of Domain-0 can be persistently changed at run-time with the</div><div class='del'>-\verb|addlabel| command, which adds an overriding option to the grub.conf</div><div class='del'>-boot entry (cf Section~\ref{subsection:acmlabeldom0}).</div><div class='del'>-All user domains are assigned labels according to their domain configuration</div><div class='del'>-(see Section~\ref{subsection:acmexamplelabeldomains} for examples of</div><div class='del'>-how to label domains).</div><div class='del'>-</div><div class='del'>-The \verb|ObjectLabels| depicted in Figure~\ref{fig:acmxmlfileb} can be</div><div class='del'>-assigned to resources when this policy is active.</div><div class='del'>-</div><div class='del'>-In general, user domains should be assigned labels that have only a</div><div class='del'>-single SimpleTypeEnforcement workload type. This way, workloads remain</div><div class='del'>-confined even if user domains become rogue. Any domain that is</div><div class='del'>-assigned a label with multiple STE types must be trusted to keep</div><div class='del'>-information belonging to the different STE types separate (confined).</div><div class='del'>-For example, Domain-0 is assigned the bootstrap label</div><div class='del'>-\verb|SystemManagement|, which includes all existing STE types.</div><div class='del'>-Therefore, Domain-0 must take care not to enable unauthorized</div><div class='del'>-information flow (eg. through block devices or virtual networking)</div><div class='del'>-between domains or resources that are assigned different STE types.</div><div class='del'>-</div><div class='del'>-Security administrators simply use the name of a label (specified in</div><div class='del'>-the \verb|&lt;Name&gt;| field) to associate a label with a domain (cf.</div><div class='del'>-Section~\ref{subsection:acmexamplelabeldomains}). The types inside the</div><div class='del'>-label are used by the Xen access control enforcement.  While the name</div><div class='del'>-can be arbitrarily chosen (as long as it is unique), it is advisable</div><div class='del'>-to choose the label name in accordance to the security types included.</div><div class='del'>-Similarly, the STE and CHWALL types should be named according to the</div><div class='del'>-workloads they represent. While the XML representation of the label</div><div class='del'>-in the above example seems unnecessary flexible, labels in general</div><div class='del'>-must be able to include multiple types.</div><div class='del'>-</div><div class='del'>-We assume in the following example, that \verb|A-Bank.SecurityUnderwriting| and</div><div class='del'>-\verb|A-Bank.MarketAnalysis| workloads use virtual disks that are provided</div><div class='del'>-by a virtual I/O domain hosting a physical storage device and carrying</div><div class='del'>-the following label:</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-        &lt;VirtualMachineLabel&gt;</div><div class='del'>-          &lt;Name&gt;VIOServer&lt;/Name&gt;</div><div class='del'>-          &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-              &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-              &lt;Type&gt;A-Bank.SecurityUnderwriting&lt;/Type&gt;</div><div class='del'>-              &lt;Type&gt;A-Bank.MarketAnalysis&lt;/Type&gt;</div><div class='del'>-              &lt;Type&gt;VIOServer&lt;/Type&gt;</div><div class='del'>-          &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-          &lt;ChineseWallTypes&gt;</div><div class='del'>-              &lt;Type&gt;VIOServer&lt;/Type&gt;</div><div class='del'>-          &lt;/ChineseWallTypes&gt;</div><div class='del'>-        &lt;/VirtualMachineLabel&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-This Virtual I/O domain (VIO) exports its virtualized disks by</div><div class='del'>-communicating to all domains labeled with the</div><div class='del'>-\verb|A-Bank.SecurityUnderwriting|, the \verb|A-Bank|, or the</div><div class='del'>-\verb|A-Bank.MarketAnalysis| label. This requires the</div><div class='del'>-VIO domain to carry those STE types. In addition, this label includes a</div><div class='del'>-new \verb|VIOServer| type that can be used to restrict direct access to the</div><div class='del'>-physical storage resource to the VIODomain.</div><div class='del'>-</div><div class='del'>-In this example, the confinement of  these A-Bank workloads depends on the</div><div class='del'>-VIO domain that must keep the data of those different workloads separate.</div><div class='del'>-The virtual disks are labeled as well to keep track of their assignments</div><div class='del'>-to workload types (see Section~\ref{subsection:acmexamplelabelresources}</div><div class='del'>-for labeling resources) and enforcement functions inside the VIO</div><div class='del'>-domain must ensure that the labels of the domain mounting a virtual</div><div class='del'>-disk and the virtual disk label share a common STE type. The VIO label</div><div class='del'>-carrying its own VIOServer CHWALL type introduces the flexibility to</div><div class='del'>-permit the trusted VIO server to run together with \verb|A-Bank.SecurityUnderwriting|</div><div class='del'>-or \verb|A-Bank.MarketAnalysis| workloads.</div><div class='del'>-</div><div class='del'>-Alternatively, a system that has two hard-drives does not need a VIO</div><div class='del'>-domain but can directly assign one hardware storage device to each of</div><div class='del'>-the workloads if the platform offers an IO-MMU, cf</div><div class='del'>-Section~\ref{s:ddsecurity}.  Sharing hardware through virtualized devices</div><div class='del'>-is a trade-off between the amount of trusted code (size of the trusted</div><div class='del'>-computing base) and the amount of acceptable over-provisioning. This</div><div class='del'>-holds both for peripherals and for system platforms.</div><div class='del'>-</div><div class='del'>-</div><div class='del'>-\subsection{Managing sHype/Xen Security Policies at Run-time}</div><div class='del'>-\label{subsection:acmpolicymanagement}</div><div class='del'>-</div><div class='del'>-\subsubsection{Removing the sHype/Xen Security Policy}</div><div class='del'>-When resetting the policy, no labeled domains can be running.</div><div class='del'>-Please stop or shutdown all running labeled domains. Then you can reset</div><div class='del'>-the policy to the default policy using the \verb|resetpolicy| command:</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm getpolicy</div><div class='del'>-Supported security subsystems   : ACM</div><div class='del'>-Policy name           : mytest</div><div class='del'>-Policy type           : ACM</div><div class='del'>-Version of XML policy : 1.0</div><div class='del'>-Policy configuration  : loaded, activated for boot</div><div class='del'>-</div><div class='del'>-# xm resetpolicy</div><div class='del'>-Successfully reset the system's policy.</div><div class='del'>-</div><div class='del'>-# xm getpolicy</div><div class='del'>-Supported security subsystems   : ACM</div><div class='del'>-Policy name           : DEFAULT</div><div class='del'>-Policy type           : ACM</div><div class='del'>-Version of XML policy : 1.0</div><div class='del'>-Policy configuration  : loaded</div><div class='del'>-</div><div class='del'>-# xm resources</div><div class='del'>-file:/home/xen/dom_fc5/fedora.fc5.swap</div><div class='del'>-      type: INV_ACM</div><div class='del'>-    policy: mytest</div><div class='del'>-     label: A-Bank</div><div class='del'>-file:/home/xen/dom_fc5/fedora.fc5.img</div><div class='del'>-      type: INV_ACM</div><div class='del'>-    policy: mytest</div><div class='del'>-     label: A-Bank</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-As the \verb|xm resources| output shows, all resource labels have</div><div class='del'>-invalidated type information but their semantics remain associated</div><div class='del'>-with the resources so that they can later on either be relabeled</div><div class='del'>-with semantically equivalent labels or sanitized and reused</div><div class='del'>-(storage resources).</div><div class='del'>-</div><div class='del'>-At this point, the system is in the same initial state as after</div><div class='del'>-configuring XSM and sHype/ACM and rebooting the system without</div><div class='del'>-a specific policy. No user domains can run.</div><div class='del'>-</div><div class='del'>-\subsubsection{Changing to a Different sHype/Xen Security Policy}</div><div class='del'>-The easiest way to change to a different, unrelated policy is to reset the system</div><div class='del'>-policy and then set the new policy. Please consider that the existing</div><div class='del'>-domain and resource labels become invalid at this point. Please refer</div><div class='del'>-to the next section for an example of how to seamlessly update an</div><div class='del'>-active policy at run-time without invalidating labels.</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm resetpolicy</div><div class='del'>-Successfully reset the system's policy.</div><div class='del'>-</div><div class='del'>-# xm setpolicy ACM example.test</div><div class='del'>-Successfully set the new policy.</div><div class='del'>-Supported security subsystems   : ACM</div><div class='del'>-Policy name           : example.test</div><div class='del'>-Policy type           : ACM</div><div class='del'>-Version of XML policy : 1.0</div><div class='del'>-Policy configuration  : loaded, activated for boot</div><div class='del'>-</div><div class='del'>-# xm labels</div><div class='del'>-CocaCola</div><div class='del'>-PepsiCo</div><div class='del'>-SystemManagement</div><div class='del'>-VIO</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-Domain-0   0   873     1     r-----     56.3  ACM:example.test:SystemManagement</div><div class='del'>-</div><div class='del'>-# xm resetpolicy</div><div class='del'>-Successfully reset the system's policy.</div><div class='del'>-</div><div class='del'>-# xm getpolicy</div><div class='del'>-Supported security subsystems   : ACM</div><div class='del'>-Policy name           : DEFAULT</div><div class='del'>-Policy type           : ACM</div><div class='del'>-Version of XML policy : 1.0</div><div class='del'>-Policy configuration  : loaded</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-Domain-0   0   873     1     r-----     57.2  ACM:DEFAULT:SystemManagement</div><div class='del'>-</div><div class='del'>-# xm setpolicy ACM mytest</div><div class='del'>-Successfully set the new policy.</div><div class='del'>-Supported security subsystems   : ACM</div><div class='del'>-Policy name           : mytest</div><div class='del'>-Policy type           : ACM</div><div class='del'>-Version of XML policy : 1.0</div><div class='del'>-Policy configuration  : loaded, activated for boot</div><div class='del'>-</div><div class='del'>-# xm labels</div><div class='del'>-A-Bank</div><div class='del'>-A-Bank.MarketAnalysis</div><div class='del'>-A-Bank.SecurityUnderwriting</div><div class='del'>-AutoCorp</div><div class='del'>-B-Bank</div><div class='del'>-SystemManagement</div><div class='del'>-__UNLABELED__</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-Domain-0   0   873     1     r-----     58.0  ACM:mytest:SystemManagement</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-The described way of changing policies by resetting the existing</div><div class='del'>-policy is useful for testing different policies. For real deployment</div><div class='del'>-environments, a policy update as described in the following section</div><div class='del'>-is more appropriate and can be applied seamlessly at run-time while</div><div class='del'>-user domains are running.</div><div class='del'>-</div><div class='del'>-\subsubsection{Update an sHype/Xen Security Policy at Run-time}</div><div class='del'>-</div><div class='del'>-Once an ACM security policy is activated (loaded into the Xen</div><div class='del'>-hypervisor), the policy may be updated at run-time without the</div><div class='del'>-need to re-boot the system. The XML update-policy contains several</div><div class='del'>-additional information fields that are required to safely link the</div><div class='del'>-new policy contents to the old policy and ensure a consistent</div><div class='del'>-transformation of the system security state from the old to the</div><div class='del'>-new policy. Those additional fields are required for policies that</div><div class='del'>-are updating an existing policy at run-time.</div><div class='del'>-</div><div class='del'>-The major benefit of policy updates is the ability to add, delete,</div><div class='del'>-or rename workload types, labels, and conflict sets (run-time</div><div class='del'>-exclusion rules) to accommodate changes in the managed virtual</div><div class='del'>-environment without the need to reboot the Xen system. When a</div><div class='del'>-new policy renames labels of the current policy, the labels</div><div class='del'>-attached to resources and domains are automatically updated</div><div class='del'>-during a successful policy update.</div><div class='del'>-</div><div class='del'>-We have manually crafted an update policy for the \verb|mytest|</div><div class='del'>-security policy and stored it in the file mytest\_update-security\_policy.xml</div><div class='del'>-in the policies directory. We will discuss this policy in detail before</div><div class='del'>-using it to update a running sHype/Xen system. The following figures contain</div><div class='del'>-the whole contents of the update policy file.</div><div class='del'>-</div><div class='del'>-Figure~\ref{fig:acmupdateheader} shows the policy</div><div class='del'>-header of an update-policy and the new \verb|FromPolicy| XML</div><div class='del'>-node. For the policy update to succeed, the policy name and the</div><div class='del'>-policy version fields of the \verb|FromPolicy| XML node must</div><div class='del'>-exactly match those of the currently enforced policy. This</div><div class='del'>-ensures a controlled update path of the policy.</div><div class='del'>-</div><div class='del'>-\begin{figure}[htb]</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-&lt;?xml version="1.0" encoding="UTF-8"?&gt;</div><div class='del'>-&lt;!-- Auto-generated by ezPolicy        --&gt;</div><div class='del'>-&lt;SecurityPolicyDefinition xmlns="http://www.ibm.com"</div><div class='del'>-xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"</div><div class='del'>-xsi:schemaLocation="http://www.ibm.com ../../security_policy.xsd "&gt;</div><div class='del'>-    &lt;PolicyHeader&gt;</div><div class='del'>-        &lt;PolicyName&gt;mytest&lt;/PolicyName&gt;</div><div class='del'>-        &lt;Date&gt;Tue Nov 27 21:53:45 2007&lt;/Date&gt;</div><div class='del'>-        &lt;Version&gt;1.1&lt;/Version&gt;</div><div class='del'>-        &lt;FromPolicy&gt;</div><div class='del'>-            &lt;PolicyName&gt;mytest&lt;/PolicyName&gt;</div><div class='del'>-            &lt;Version&gt;1.0&lt;/Version&gt;</div><div class='del'>-        &lt;/FromPolicy&gt;</div><div class='del'>-    &lt;/PolicyHeader&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-\caption{XML security policy update -- Part I: Updated Policy Header.}</div><div class='del'>-\label{fig:acmupdateheader}</div><div class='del'>-\end{figure}</div><div class='del'>-</div><div class='del'>-The version number of the new policy, which is shown in the</div><div class='del'>-node following the \verb|Date| node, must be a logical increment</div><div class='del'>-to the current policy's version. Therefore at least the minor</div><div class='del'>-number of the policy version must be incremented. This ensures</div><div class='del'>-that a policy update is applied only to exactly the policy for</div><div class='del'>-which this update was created and minimizes unforseen side-effects</div><div class='del'>- of policy updates.</div><div class='del'>-</div><div class='del'>-\paragraph{Types and Conflic Sets}</div><div class='del'>-The type names and the assignment of types to labels or conflict</div><div class='del'>-sets (run-time exclusion rules) can</div><div class='del'>-simply be changed consistently throughout the policy. Types,</div><div class='del'>-as opposed to labels, are not directly associated or referenced</div><div class='del'>-outside the policy so they do not need to carry their history</div><div class='del'>-in a ``From'' field. The figure below shows the update for the</div><div class='del'>-types and conflict sets. The \verb|__UNLABELED__| type is removed</div><div class='del'>-to disable support for running unlabeled domains. Additionally,</div><div class='del'>-we have renamed the two \verb|A-Bank| department types with</div><div class='del'>-abbreviated names \verb|A-Bank.SU| and \verb|A-Bank.MA|. You</div><div class='del'>-can also see how those type names are</div><div class='del'>-consistently changed within the conflict set definition.</div><div class='del'>-</div><div class='del'>-\begin{figure}[htb]</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-    &lt;SimpleTypeEnforcement&gt;</div><div class='del'>-        &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-            &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-        &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcement&gt;</div><div class='del'>-</div><div class='del'>-    &lt;ChineseWall priority="PrimaryPolicyComponent"&gt;</div><div class='del'>-        &lt;ChineseWallTypes&gt;</div><div class='del'>-            &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-            &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-        &lt;/ChineseWallTypes&gt;</div><div class='del'>-</div><div class='del'>-        &lt;ConflictSets&gt;</div><div class='del'>-            &lt;Conflict name="RER"&gt;</div><div class='del'>-                &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-                &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-            &lt;/Conflict&gt;</div><div class='del'>-            &lt;Conflict name="RER"&gt;</div><div class='del'>-                &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-                &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-            &lt;/Conflict&gt;</div><div class='del'>-       &lt;/ConflictSets&gt;</div><div class='del'>-    &lt;/ChineseWall&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-\caption{XML security policy update -- Part II: Updated Types and Conflict Sets.}</div><div class='del'>-\label{fig:acmupdatetypesnrules}</div><div class='del'>-\end{figure}</div><div class='del'>-</div><div class='del'>-In the same way, new types can be introduced and new conflict sets</div><div class='del'>-can be defined by simply adding the types or conflict sets to the</div><div class='del'>-update policy.</div><div class='del'>-</div><div class='del'>-\paragraph{Labels} Virtual machine and resource labels of an existing policy can be</div><div class='del'>-deleted through a policy update simply by omitting them in the</div><div class='del'>-update-policy. However, if a currently running virtual machine</div><div class='del'>-or a currently used resource is labeled with a label not stated</div><div class='del'>-in the update-policy, then the policy update is rejected. This</div><div class='del'>-ensures that a policy update leaves the system in a consistent</div><div class='del'>-security state.</div><div class='del'>-</div><div class='del'>-A policy update also enables the renaming of virtual machine and</div><div class='del'>-resource labels. Linking the old label name with the new label</div><div class='del'>-name is achieved through the \verb|from| attribute in the</div><div class='del'>-\verb|VirtualMachineLabel| or \verb|ResourceLabel| nodes in the</div><div class='del'>-update-policy. Figure~\ref{fig:acmupdatelabels} shown how subject</div><div class='del'>-and resource labels</div><div class='del'>-are updated from their old name \verb|A-Bank.SecurityUnterwriting|</div><div class='del'>-to their new name \verb|A-Bank.SU| using the \verb|from| attribute.</div><div class='del'>-</div><div class='del'>-\begin{figure}[htb]</div><div class='del'>-\begin{tabular*}{\textwidth}{@{\extracolsep{\fill}}l|l}</div><div class='del'>-\begin{minipage}{0.475\textwidth}</div><div class='del'>-\begin{tiny}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-&lt;SecurityLabelTemplate&gt;</div><div class='del'>-  &lt;SubjectLabels bootstrap="SystemManagement"&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;SystemManagement&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank-WL&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name from="A-Bank.SecurityUnderwriting"&gt;</div><div class='del'>-            A-Bank.SU&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-   &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name from="A-Bank.MarketAnalysis"&gt;</div><div class='del'>-            A-Bank.MA&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{tiny}</div><div class='del'>-\end{minipage} &amp;</div><div class='del'>-\begin{minipage}{0.475\textwidth}</div><div class='del'>-\begin{tiny}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;B-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-  &lt;VirtualMachineLabel&gt;</div><div class='del'>-    &lt;Name&gt;AutoCorp&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-    &lt;ChineseWallTypes&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/ChineseWallTypes&gt;</div><div class='del'>-  &lt;/VirtualMachineLabel&gt;</div><div class='del'>-&lt;/SubjectLabels&gt;</div><div class='del'>-</div><div class='del'>-&lt;ObjectLabels&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;SystemManagement&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;SystemManagement&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;A-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name from="A-Bank.SecurityUnderwriting"&gt;</div><div class='del'>-            A-Bank.SU&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.SU&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name from="A-Bank.MarketAnalysis"&gt;</div><div class='del'>-            A-Bank.MA&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;A-Bank.MA&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;B-Bank&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;B-Bank&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;ResourceLabel&gt;</div><div class='del'>-    &lt;Name&gt;AutoCorp&lt;/Name&gt;</div><div class='del'>-    &lt;SimpleTypeEnforcementTypes&gt;</div><div class='del'>-      &lt;Type&gt;AutoCorp&lt;/Type&gt;</div><div class='del'>-    &lt;/SimpleTypeEnforcementTypes&gt;</div><div class='del'>-  &lt;/ResourceLabel&gt;</div><div class='del'>-  &lt;/ObjectLabels&gt;</div><div class='del'>-&lt;/SecurityLabelTemplate&gt;</div><div class='del'>-&lt;/SecurityPolicyDefinition&gt;</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{tiny}</div><div class='del'>-\end{minipage}</div><div class='del'>-\end{tabular*}</div><div class='del'>-\caption{XML security policy update -- Part III: Updated Label Definition.}</div><div class='del'>-\label{fig:acmupdatelabels}</div><div class='del'>-\end{figure}</div><div class='del'>-% DO NOT MODIFY WHITESPACE ABOVE, it balances the columns</div><div class='del'>-</div><div class='del'>-The updated label definition also includes a new label \verb|A-Bank-WL|</div><div class='del'>-that includes all STE types related to A-Bank. Its CHWALL type</div><div class='del'>-is \verb|SystemManagement|. This indicates that this label is designed</div><div class='del'>-as Domain-0 label. A Xen system can be restricted to only run A-Bank</div><div class='del'>-related workloads by relabeling Domain-0 with the \verb|A-Bank-WL| label.</div><div class='del'>-</div><div class='del'>-We assume that the update-policy shown in</div><div class='del'>-Figures~\ref{fig:acmupdateheader}, \ref{fig:acmupdatetypesnrules}</div><div class='del'>-and \ref{fig:acmupdatelabels}</div><div class='del'>-is stored in the XML file mytest\_update-security\_policy.xml located</div><div class='del'>-in the ACM policy directory. See Section~\ref{subsection:acmnaming}</div><div class='del'>-for information about policy names and locations.</div><div class='del'>-</div><div class='del'>-The following \verb|xm setpolicy| command updates the active ACM</div><div class='del'>-security policy at run-time.</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs    State  Time(s) Label</div><div class='del'>-domain1    2   128     1   -b----     0.6  ACM:mytest:A-Bank</div><div class='del'>-domain4    3   164     1   -b----     0.3  ACM:mytest:A-Bank.SecurityUnderwriting</div><div class='del'>-Domain-0   0   711     1   r-----    71.8  ACM:mytest:SystemManagement</div><div class='del'>-</div><div class='del'>-# xm resources</div><div class='del'>-file:/home/xen/dom_fc5/fedora.fc5.swap</div><div class='del'>-      type: ACM</div><div class='del'>-    policy: mytest</div><div class='del'>-    label:  A-Bank</div><div class='del'>-file:/home/xen/dom_fc5/fedora.fc5.img</div><div class='del'>-      type: ACM</div><div class='del'>-    policy: mytest</div><div class='del'>-    label:  A-Bank</div><div class='del'>-</div><div class='del'>-# xm setpolicy ACM mytest_update</div><div class='del'>-Successfully set the new policy.</div><div class='del'>-Supported security subsystems   : ACM</div><div class='del'>-Policy name           : mytest</div><div class='del'>-Policy type           : ACM</div><div class='del'>-Version of XML policy : 1.1</div><div class='del'>-Policy configuration  : loaded, activated for boot</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    2   128     1     -b----      0.7  ACM:mytest:A-Bank</div><div class='del'>-domain4    3   164     1     -b----      0.3  ACM:mytest:A-Bank.SU</div><div class='del'>-Domain-0   0   711     1     r-----     72.8  ACM:mytest:SystemManagement</div><div class='del'>-</div><div class='del'>-# xm labels</div><div class='del'>-A-Bank</div><div class='del'>-A-Bank-WL</div><div class='del'>-A-Bank.MA</div><div class='del'>-A-Bank.SU</div><div class='del'>-AutoCorp</div><div class='del'>-B-Bank</div><div class='del'>-</div><div class='del'>-# xm resources</div><div class='del'>-file:/home/xen/dom_fc5/fedora.fc5.swap</div><div class='del'>-      type: ACM</div><div class='del'>-    policy: mytest</div><div class='del'>-     label: A-Bank</div><div class='del'>-file:/home/xen/dom_fc5/fedora.fc5.img</div><div class='del'>-      type: ACM</div><div class='del'>-    policy: mytest</div><div class='del'>-     label: A-Bank</div><div class='del'>-    \end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-After successful completion of this command, \verb|xm list --label|</div><div class='del'>-shows that the labels of running domains changed to their new names.</div><div class='del'>-\verb|xm labels| shows that new labels \verb|A-Bank.SU| and \verb|A-Bank.AM|</div><div class='del'>-are now available in the policy. The resource labels remain valid after</div><div class='del'>-the successful update as \verb|xm resources| confirms.</div><div class='del'>-</div><div class='del'>-The \verb|setpolicy| command fails if the new policy is inconsistent</div><div class='del'>-with the current one or the policy is inconsistent internally (e.g., types</div><div class='del'>-are renamed in the type definition but not in the label definition part of</div><div class='del'>-the policy). In this case, the old policy remains active.</div><div class='del'>-</div><div class='del'>-After relabeling Domain-0 with the new \verb|A-Bank-WL| label, we can no</div><div class='del'>-longer run domains labeled \verb|B-Bank| or \verb|AutoCorp| since their</div><div class='del'>-STE types are not a subset of the new Domain-0 label.</div><div class='del'>-</div><div class='del'>-\begin{scriptsize}</div><div class='del'>-\begin{verbatim}</div><div class='del'>-# xm addlabel A-Bank-WL mgt Domain-0</div><div class='del'>-Successfully set the label of domain 'Domain-0' to 'A-Bank-WL'.</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    2   128     1     -b----      0.8  ACM:mytest:A-Bank</div><div class='del'>-Domain-0   0   711     1     r-----     74.5  ACM:mytest:A-Bank-WL</div><div class='del'>-domain4    3   164     1     -b----      0.3  ACM:mytest:A-Bank.SU</div><div class='del'>-</div><div class='del'>-# xm getlabel dom domain3.xm</div><div class='del'>-policytype=ACM,policy=mytest,label=AutoCorp</div><div class='del'>-</div><div class='del'>-# xm create domain3.xm</div><div class='del'>-Using config file "./domain3.xm".</div><div class='del'>-Error: VM is not authorized to run.</div><div class='del'>-</div><div class='del'>-# xm addlabel SystemManagement mgt Domain-0</div><div class='del'>-Successfully set the label of domain 'Domain-0' to 'SystemManagement'.</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    2   128     1     -b----      0.8  ACM:mytest:A-Bank</div><div class='del'>-domain4    3   164     1     -b----      0.3  ACM:mytest:A-Bank.SU</div><div class='del'>-Domain-0   0   709     1     r-----     76.4  ACM:mytest:SystemManagement</div><div class='del'>-</div><div class='del'>-# xm create domain3.xm</div><div class='del'>-Using config file "./domain3.xm".</div><div class='del'>-Started domain domain3</div><div class='del'>-</div><div class='del'>-# xm list --label</div><div class='del'>-Name      ID   Mem VCPUs      State   Time(s) Label</div><div class='del'>-domain1    2   128     1     -b----      0.8  ACM:mytest:A-Bank</div><div class='del'>-domain4    3   164     1     -b----      0.3  ACM:mytest:A-Bank.SU</div><div class='del'>-domain3    4   164     1     -b----      0.3  ACM:mytest:AutoCorp</div><div class='del'>-Domain-0   0   547     1     r-----     77.5  ACM:mytest:SystemManagement</div><div class='del'>-\end{verbatim}</div><div class='del'>-\end{scriptsize}</div><div class='del'>-</div><div class='del'>-In the same manner, you can add new labels to support new workloads and</div><div class='del'>-add, delete, or rename workload types (STE and/or CHWALL types) simply</div><div class='del'>-by changing the composition of labels. Another use case is to add new</div><div class='del'>-workload types to the current Domain-0 label to enable them to run.</div><div class='del'>-Conflict sets (run-time exclusion rules) can be simply omitted or added.</div><div class='del'>-The policy and label changes become active at once and new workloads</div><div class='del'>-can be run in protected mode without rebooting the Xen system.</div><div class='del'>-</div><div class='del'>-In all these cases, if any running user domain would--under the new policy--not</div><div class='del'>-be allowed to run or would not be allowed to access any of the resources</div><div class='del'>-it currently uses, then the policy update is rejected. In this case, you</div><div class='del'>-can stop domains that conflict with the new policy and update the policy</div><div class='del'>-afterwards. The old policy remains active until a policy update succeeds</div><div class='del'>-or Xen is re-booted into a new policy.</div><div class='del'>-</div><div class='del'>-\subsection{Tools For Creating sHype/Xen Security Policies}</div><div class='del'>-To create a security policy for Xen, you can use one of the following</div><div class='del'>-tools:</div><div class='del'>-\begin{itemize}</div><div class='del'>-\item \verb|ezPolicy| GUI tool -- start writing policies</div><div class='del'>-\item \verb|xensec_gen| tool -- refine policies created with \verb|ezPolicy|</div><div class='del'>-\item text or XML editor</div><div class='del'>-\end{itemize}</div><div class='del'>-</div><div class='del'>-We use the \verb|ezPolicy| tool in</div><div class='del'>-Section~\ref{subsection:acmexamplecreate} to quickly create a workload</div><div class='del'>-protection policy. If desired, the resulting XML policy file can be</div><div class='del'>-loaded into the \verb|xensec_gen| tool to refine it. It can also be</div><div class='del'>-directly edited using an XML editor. Any XML policy file is verified</div><div class='del'>-against the security policy schema when it is translated (see</div><div class='del'>-Subsection~\ref{subsection:acmexampleinstall}).</div><div class='del'>-</div><div class='del'>-\section{Current Limitations}</div><div class='del'>-\label{section:acmlimitations}</div><div class='del'>-</div><div class='del'>-The sHype/ACM configuration for Xen is work in progress. There is</div><div class='del'>-ongoing work for protecting virtualized resources and planned and</div><div class='del'>-ongoing work for protecting access to remote resources and domains.</div><div class='del'>-The following sections describe limitations of some of the areas into</div><div class='del'>-which access control is being extended.</div><div class='del'>-</div><div class='del'>-\subsection{Network Traffic}</div><div class='del'>-Local and remote network traffic is currently not controlled.</div><div class='del'>-Solutions to add sHype/ACM policy enforcement to the virtual network</div><div class='del'>-exist but need to be discussed before they can become part of Xen.</div><div class='del'>-Subjecting external network traffic to the ACM security policy is work</div><div class='del'>-in progress. Manually setting up filters in domain 0 is required for</div><div class='del'>-now but does not scale well.</div><div class='del'>-</div><div class='del'>-\subsection{Resource Access and Usage Control}</div><div class='del'>-</div><div class='del'>-Enforcing the security policy across multiple hypervisor systems and</div><div class='del'>-on access to remote shared resources is work in progress. Extending</div><div class='del'>-access control to new types of resources is ongoing work (e.g. network</div><div class='del'>-storage).</div><div class='del'>-</div><div class='del'>-On a single Xen system, information about the association of resources</div><div class='del'>-and security labels is stored in</div><div class='del'>-\verb|/var/lib/xend/security/policies/resource_labels|. This file relates</div><div class='del'>-a full resource path with a security label. This association is weak</div><div class='del'>-and will break if resources are moved or renamed without adapting the</div><div class='del'>-label file. Improving the protection of label-resource relationships</div><div class='del'>-is ongoing work.</div><div class='del'>-</div><div class='del'>-Controlling resource usage and enforcing resource limits in general is</div><div class='del'>-ongoing work in the Xen community.</div><div class='del'>-</div><div class='del'>-\subsection{Domain Migration}</div><div class='del'>-</div><div class='del'>-Labels on domains are enforced during domain migration and the</div><div class='del'>-destination hypervisor will ensure that the domain label is valid and</div><div class='del'>-the domain is permitted to run (considering the Chinese Wall policy</div><div class='del'>-rules) before it accepts the migration.  However, the network between</div><div class='del'>-the source and destination hypervisor as well as both hypervisors must</div><div class='del'>-be trusted. Architectures and prototypes exist that both protect the</div><div class='del'>-network connection and ensure that the hypervisors enforce access</div><div class='del'>-control consistently but patches are not yet available for the main</div><div class='del'>-stream.</div><div class='del'>-</div><div class='del'>-\subsection{Covert Channels}</div><div class='del'>-</div><div class='del'>-The sHype access control aims at system independent security policies.</div><div class='del'>-It builds on top of the core hypervisor isolation. Any covert channels</div><div class='del'>-that exist in the core hypervisor or in the hardware (e.g., shared</div><div class='del'>-processor cache) will be inherited. If those covert channels are not</div><div class='del'>-the result of trade-offs between security and other system properties,</div><div class='del'>-then they are most effectively minimized or eliminated where they are</div><div class='del'>-caused. sHype offers however some means to mitigate their impact, e.g.,</div><div class='del'>-run-time exclusion rules (cf Section~\ref{subsection:acmexamplecreate})</div><div class='del'>-or limiting the system authorization (cf Section~\ref{subsection:acmlabeldom0}).</div><div class='del'>-</div><div class='del'>-</div><div class='ctx'> \part{Reference}</div><div class='ctx'> </div><div class='ctx'> %% Chapter Build and Boot Options</div></td></tr></table></div> <!-- class=content -->
<div class='footer'>generated by <a href='https://git.zx2c4.com/cgit/about/'>cgit v1.2.3</a> (<a href='https://git-scm.com/'>git 2.25.1</a>) at 2025-11-30 21:33:52 +0000</div>
</div> <!-- id=cgit -->
</body>
</html>
