Re: [PATCH 1/2] xen/xsm: Introduce new boot parameter xsm

From: Daniel De Graaf <dgdegra@tycho.nsa.gov>
To: Xin Li <talons.lee@gmail.com>, xen-devel@lists.xen.org
Cc: Sergey Dyasli <sergey.dyasli@citrix.com>,
	Stefano Stabellini <sstabellini@kernel.org>,
	Wei Liu <wei.liu2@citrix.com>,
	Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
	George Dunlap <George.Dunlap@eu.citrix.com>,
	Xin Li <xin.li@citrix.com>, Tim Deegan <tim@xen.org>,
	Jan Beulich <JBeulich@suse.com>,
	Andrew Cooper <andrew.cooper3@citrix.com>,
	Ming Lu <ming.lu@citrix.com>
Subject: Re: [PATCH 1/2] xen/xsm: Introduce new boot parameter xsm
Date: Fri, 28 Sep 2018 13:15:21 -0400	[thread overview]
Message-ID: <3e93905d-9a9f-e54a-8633-cc79e3010172@tycho.nsa.gov> (raw)
In-Reply-To: <20180928081817.16317-1-xin.li@citrix.com>

On 09/28/2018 04:18 AM, Xin Li wrote:
> Introduce new boot parameter xsm to choose which xsm module is enabled,
> and set default to dummy.
> 
> Signed-off-by: Xin Li <xin.li@citrix.com>

This changes the default behavior of a hypervisor compiled with XSM+FLASK when
booted with no command line arguments from enabling FLASK to enabling the dummy
module.  I think the default value of the "xsm=" parameter should be settable
in Kconfig to allow existing systems to continue working after an upgrade.

If not, this new command line argument needs to be mentioned in more locations
in the documentation; at least docs/misc/xsm-flask "Setting up FLASK" will need
to mention it.  I think a mention in the release notes for the next version is
also a good idea (in addition to or as part of the note on the new SILO feature),
but that's not a part of the patch.

Untested Kconfig snippet:

choice
     prompt "Default XSM implementation"
     default XSM_FLASK_DEFAULT if XSM_FLASK
     default XSM_SILO_DEFAULT if XSM_SILO
     default XSM_DUMMY_DEFAULT
     config XSM_DUMMY_DEFAULT
         bool "Match non-XSM behavior"
     config XSM_FLASK_DEFAULT
         bool "FLux Advanced Security Kernel" if XSM_FLASK
     config XSM_SILO_DEFAULT
         bool "SILO" if XSM_SILO
endchoice

The multiple "default" statements are intended to cause the default to be the
chosen enabled system, or dummy if there are no existing Kconfig settings.

I also think the question for XSM_FLASK should be removed from EXPERT now that
there is a reason to enable XSM without FLASK.

The name "default" might end up being misleading in this case; "none", "off",
or "dummy" might be better.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel