Re: [Xen-devel] [PATCH v2 1/7] livepatch-build: Embed hypervisor build id into every hotpatch

[Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>]

On 9/16/19 12:30 PM, Pawel Wieczorkiewicz wrote:
> This change is part of a independant stacked hotpatch modules
> feature. This feature allows to bypass dependencies between modules
> upon loading, but still verifies Xen build ID matching.
> 
> With stacked hotpatch modules it is essential that each and every
> hotpatch is verified against the hypervisor build id upon upload.
> It must not be possible to successfully upload hotpatches built for
> incorrect version of the hypervisor.
> 
> To achieve that always embed an additional ELF section:
> '.livpatch.xen_depends' containing the hypervisor build id.
> 
> The hypervisor build id must be always provided as a command line
> parameter: --xen-depends.
> 
> Signed-off-by: Pawel Wieczorkiewicz <wipawel@xxxxxxxxx>
> Reviewed-by: Andra-Irina Paraschiv <andraprs@xxxxxxxxxx>
> Reviewed-by: Bjoern Doebel <doebel@xxxxxxxxx>
> Reviewed-by: Norbert Manthey <nmanthey@xxxxxxxxx>
Reviewed-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel