Re: [PATCH v7 12/12] xen: clarify the security-support status of Kconfig options on ARM

[Julien Grall <julien.grall@arm.com>]

On 25/07/18 09:59, Andrew Cooper wrote:
> On 25/07/2018 09:46, Julien Grall wrote:
>>
>>
>> On 24/07/18 23:31, Stefano Stabellini wrote:
>>> On Mon, 23 Jul 2018, Julien Grall wrote:
>>>> Hi,
>>>>
>>>> On 07/07/18 00:14, Stefano Stabellini wrote:
>>>>> Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
>>>>> CC: George.Dunlap@eu.citrix.com
>>>>> CC: Ian.Jackson@eu.citrix.com
>>>>> CC: jbeulich@suse.com
>>>>> CC: andrew.cooper3@citrix.com
>>>>> ---
>>>>>     SUPPORT.md | 10 ++++++++++
>>>>>     1 file changed, 10 insertions(+)
>>>>>
>>>>> diff --git a/SUPPORT.md b/SUPPORT.md
>>>>> index e3e49e2..151a63d 100644
>>>>> --- a/SUPPORT.md
>>>>> +++ b/SUPPORT.md
>>>>> @@ -22,6 +22,16 @@ EXPERT and DEBUG Kconfig options are not security
>>>>> supported. Other
>>>>>     Kconfig options are supported, if the related features are
>>>>> marked as
>>>>>     supported in this document.
>>>>>     +On ARM, a wider range of Kconfig configurations is available to
>>>>> enable
>>>>> +very small lines of code counts in the hypervisor. Not all possible
>>>>> +combinations of kconfig options are security supported. Instead, a
>>>>> few
>>>>
>>>> NIT: s/kconfig/Kconfig/
>>>>
>>>>> +pre-canned configurations have been added to xen/arch/arm/configs:
>>>>> they
>>>>> +are security suppored. Configurations derived from the pre-canned
>>>>> files
>>>>
>>>> s/suppored/supported/
>>>
>>> I'll fix
>>>
>>>
>>>>> +by adding non-listed options with their default values, or by
>>>>> enabling
>>>>> +any of the platform options under "Platform Support" (and their
>>>>> +dependent options) are security supported, unless stated
>>>>> +otherwise.
>>>>
>>>> I am not entirely sure to understand the implications the paragraph.
>>>
>>> It is meant to say:
>>>
>>> 1) xen/arch/arm/configs config files are security supported
>>> 2) default values of any kconfig options are security supported
>>> 3) if an option is marked as not security supported in SUPPORT.md, then
>>>      it is not security supported, no matter the default value
>>> 4) everything else is not security supported
>>>    Should I try to clarify it? I guess I should make clear that a .config
>>> with an unsupported option is unsupported as a whole. I can add:
>>>
>>>    "A configuration with one or more unsupported options, is not
>>>    unsupported."
>>>
>>>
>>>> For instance, if I choose arm64_defconfig, memaccess will be enabled by
>>>> default but any use of it is not security supported. What will be
>>>> the state of
>>>> the security support for that .config?
>>>
>>> Yes, memaccess will default to enable. However, SUPPORT.md says it is
>>> not security supported, hence, the result is that the .config is not
>>> security supported, according to (3).
>>
>> We really don't want that. That arm64_defconfig is the default config
>> for Xen. Anyone using it will not be security supported.
>>
>> Distros will likely use the default config as it enables everything.
>> If I were a package maintainer, I would expect at minimum to security
>> support the .config. This does not mean that using a specific feature
>> will be supported.
> 
> Anything you can select in menuconfig without passing
> XEN_CONFIG_EXPERT=y is security supported.  Anything hidden behind
> XEN_CONFIG_EXPERT is security supported in its default configuration.

Could you clarify what you mean by security supported here? For 
instance, "livepatch" is selectable on Arm with XEN_CONFIG_EXPERT=y but 
it is marked as "experimental" in SUPPORT.MD.

Cheers,

-- 
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel