Re: [Xen-devel] Issue with XSM on xen 4.3 (rc5)

[M A Young <m.a.young@xxxxxxxxxxxx>]

On Sun, 23 Jun 2013, Steven Maresca wrote:

> On Sat, Jun 22, 2013 at 6:07 PM, M A Young <m.a.young@xxxxxxxxxxxx> wrote:
> > I have been testing enabling XSM/FLASK in xen-4.3.0-rc5 (with a view to
> > deciding whether or not to include it in the Fedora builds) and found an
> > issue which might be a bug or a documentation issue.
> >
> > As I read the documentation ( http://wiki.xenproject.org/wiki/XSM and
> > http://xenbits.xen.org/docs/unstable/misc/xsm-flask.txt ) a grub2
> > configuration along the lines of
> >
> > multiboot xen.gz
> > module xenpolicy.24
> > module vmlinuz args
> > module initramfs.img
> >
> > should work, but it gives me a backtrace which looks the same as the one I
> > get if I miss out the xenpolicy.24 line completely.
> > ...
> [ Aside, re: enabling XSM for Fedora: yes please! ]
>
> Under the hood, I don't think XSM cares about the placement of the
> policy in terms of multiboot module order.  While initializing, XSM
> inspects all of the multiboot modules, looking for a magic number
> indicating that the module is a valid XSM policy. (see
> xsm_policy_init() in xen/xsm/xsm_policy.c which was invoked by
> xsm_init()). To be honest, I don't think we ever experimented with the
> module order while building the XSM documentation.
>
> That said, the x86 arch  __start_xen() has a comment "/* Dom0 kernel
> is always first */" which makes me suspect here that this assumption
> could be the one encountered. If you still have the backtrace(s) and
> can share, that could help point in the right direction. I'll also try
> the same on my end. It's definitely possible that a descriptive output
> message is needed to suggest the solution, even while the
> documentation could help to avoid such issues.
The bit is actually the rest of the line containing the comment you 
mention as it grabs the first module so xsm_init doesn't find it. The 
backtrace is actually from the flask code, and is what you get if the 
policy module is not found, as the flask code assumes it has found a 
module and tries to load it even if it hasn't.
My current plan for xen 4.3 in Fedora is to build it with XSM enabled, but 
with an extra patch so it reverts to disabled mode if no policy module is 
found. That would mean that current xen configurations would continue to 
work, and XSM could be turned on with suitable edits to the grub 
configuration file.
        Michael Young

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel