Re: Xen XSM/FLASK policy, grub defaults, etc.

[Jürgen Groß <jgross@xxxxxxxx>]

On 02.06.20 10:26, Julien Grall wrote:
> On 02/06/2020 08:21, Jan Beulich wrote:
> > On 29.05.2020 19:24, Julien Grall wrote:
> > > On 29/05/2020 16:11, Jan Beulich wrote:
> > > > On 29.05.2020 17:05, Julien Grall wrote:
> > > > > On 29/05/2020 15:47, Ian Jackson wrote:
> > > > > > George Dunlap writes ("Re: Xen XSM/FLASK policy, grub defaults, 
> > > > > > etc."):
> > > > > > > Which isn’t to say we shouldn’t do it; but it might be nice to 
> > > > > > > also have an intermediate solution that works right now, even if 
> > > > > > > it’s not optimal.
> > > > > > I propose the following behaviour by updste-grub:
> > > > > >
> > > > > >     1. Look for an ELF note, TBD.  If it's found, make XSM boot 
> > > > > > entries.
> > > > > >        (For now, skip this step, since the ELF note is not defined.)
> > > > > I am afraid the ELF note is a very x86 thing. On Arm, we don't have 
> > > > > such
> > > > > thing for the kernel/xen (actually the final binary is not even an 
> > > > > ELF).
> > > > Ouch - of course. Is there anything similar one could employ there?
> > > In the past, we discussed about adding support for note in the zImage
> > > (arm32 kernel format) but I never got the chance to pursue the 
> > > discussion.
> > > With Juergen's hypfs series, the hypervisor now embbed the .config. Is
> > > it possible to extract it?
> > How easy is it to reliably find a random blob of gzip-ed data in an
> > otherwise unstructured (as in: no ELF sections, and hence no way to
> > put the data of interest into a separate section for easy
> > recognition) binary?
> As I pointed out in another reply, Linux is already doing it (see 
> scripts/extract-ikconfig). In fact I was able to extract the .config 
> from an Linux Arm64 Image.
> AFAICT, Linux will look up with to specific value in the kernel image 
> which surround the gzipped .config.
> If Linux is able to do it, then we should be able to do it. I don't know 
> whether this is 100% reliable, however we could make sure your .config 
> is towards the end of the image. So it reduces the chance you find 
> something different.
> > Also don't forget that the embedding of .config
> > is an optional thing.
> I don't really see this as a blocker. Embedding the .config can be made 
> mandatory going forward. This is not going to significantly increase the 
> size of Xen and would help to when debugging as you could exactly know 
> which .config was used.
If you can find an embedded .config via a special pattern you can just
define a pattern and embed that only in case of a flask-enabled Xen.
This would remove the need to make the config option a stable ABI.


Juergen