Re: ELF Notes for kernel image

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 25/10/2015 00:07, Carl Patenaude Poulin wrote:
> Hi all,
>
> For my undergraduate project, I am developing a simple
> paravirtualized x64 Xen unikernel. I've been hitting some issues
> that I hope you can help me with!
>
> I'm trying to figure out how to equip an ELF binary with an ELF note
> that marks it as a valid Xen image. I've found the following
> resources:
>
> http://wiki.xenproject.org/wiki/X86_Paravirtualised_Memory_Management#Start_Of_Day
> http://www.netbsd.org/docs/kernel/elf-notes.html#note-creation
> http://xenbits.xen.org/docs/4.3-testing/hypercall/include,public,elfnote.h.html
>
> Unfortunately, they are quite hard to decipher!

I have to concur.  The Xen elf note documentation is in a poor state.

I have recently made a set of unikernels from scratch for a different
project, and I had to reverse engineer some bits of the elfnote layout
from the domain building code.

>  I've tried to
> summarize what little information I've extracted. Can you please
> verify that the following is accurate, and maybe help me fill in the
> blanks or point me to additional resources?
>
> * A "PT_NOTE section" is any ELF header section which conforms to
> the PT_NOTE specification. It is typically named ".note.*" and
> marked allocatable.
> * A PT_NOTE section is a series of "notes", or key-value pairs, each
> formatted as `key_size: int32, value_size: int32, value_type: int32,
> key: (int32|int64|asciz), value: (int32|int64|asciz)`.

This is not the PT_NOTE specification.

Notes are:
name size, [4 bytes]
desc size, [4 bytes]
type [4 bytes]
name [variable length, typically NUL terminated ASCII string, padded to
4 byte]
desc [variable length, padded to 4 bytes]

For Xen notes, 'name' is always "Xen" to indicate the specifying entity
(i.e. us).
'type' is the integer index from elfnote.h, and is effectively the key.
'desc' is the value associated with 'type'.  The type of data in 'desc'
is specified by 'type'

> * The Xen PT_NOTE section is named ".note.Xen", and its keys are
> listen (in order) in $XEN_ROOT/xen/include/public/elfnote.h.

There is no ordering requirements about notes, not an expectation that
all will be filled in.  Very few are actually required to get a Paravirt
kernel started.

>
> My questions:
> * Every PT_NOTE entry contains a type field. What does it do, and
> how do I decide what goes in it?

I hope these are now clear, given the explanation above.

> * In particular, what are the types of the various entries in the
> Xen PT_NOTES (as seen in elfnote.h)?

An interpretation of the text describing the 'type'.  Mostly NUL
terminated ASCII strings, but not always.

> * After all of this is done, how can I verify that my compiled
> binary indeed has a valid PT_NOTE entry for Xen? Does `readelf` have
> a switch that's particularly appropriate for this?

There is a utility called readnotes (tools/xcutils/readnotes.c in the
Xen source tree) which can parse and print the Xen elf notes, similar to
`readelf`

To get you started,
http://xenbits.xen.org/gitweb/?p=people/andrewcoop/xen-test-framework.git;a=blob;f=arch/x86/boot/head_pv.S;h=078d6b85af704840a0abb700a4d5e40253c21fdf;hb=HEAD
are the minimal set of elfnotes to get a PV guest booted.  (The
hypercall page note isn't strictly needed, but you would silly not to
include it).

Alternatively,
http://lxr.free-electrons.com/source/arch/x86/xen/xen-head.S is the set
of elfnotes used by Linux.

~Andrew