Re: Xen XSM/FLASK policy, grub defaults, etc.

[Julien Grall <julien@xxxxxxx>]

On 02/06/2020 08:21, Jan Beulich wrote:
> On 29.05.2020 19:24, Julien Grall wrote:
> > On 29/05/2020 16:11, Jan Beulich wrote:
> > > On 29.05.2020 17:05, Julien Grall wrote:
> > > > On 29/05/2020 15:47, Ian Jackson wrote:
> > > > > George Dunlap writes ("Re: Xen XSM/FLASK policy, grub defaults, etc."):
> > > > > > Which isn’t to say we shouldn’t do it; but it might be nice to also have an 
> > > > > > intermediate solution that works right now, even if it’s not optimal.
> > > > > I propose the following behaviour by updste-grub:
> > > > >
> > > > >     1. Look for an ELF note, TBD.  If it's found, make XSM boot entries.
> > > > >        (For now, skip this step, since the ELF note is not defined.)
> > > > I am afraid the ELF note is a very x86 thing. On Arm, we don't have such
> > > > thing for the kernel/xen (actually the final binary is not even an ELF).
> > > Ouch - of course. Is there anything similar one could employ there?
> > In the past, we discussed about adding support for note in the zImage
> > (arm32 kernel format) but I never got the chance to pursue the discussion.
> >
> > With Juergen's hypfs series, the hypervisor now embbed the .config. Is
> > it possible to extract it?
> How easy is it to reliably find a random blob of gzip-ed data in an
> otherwise unstructured (as in: no ELF sections, and hence no way to
> put the data of interest into a separate section for easy
> recognition) binary?
As I pointed out in another reply, Linux is already doing it (see 
scripts/extract-ikconfig). In fact I was able to extract the .config 
from an Linux Arm64 Image.
AFAICT, Linux will look up with to specific value in the kernel image 
which surround the gzipped .config.
If Linux is able to do it, then we should be able to do it. I don't know 
whether this is 100% reliable, however we could make sure your .config 
is towards the end of the image. So it reduces the chance you find 
something different.
> Also don't forget that the embedding of .config
> is an optional thing.
I don't really see this as a blocker. Embedding the .config can be made 
mandatory going forward. This is not going to significantly increase the 
size of Xen and would help to when debugging as you could exactly know 
which .config was used.
Cheers,

--
Julien Grall