Make hvm_fep available to non-debug build as well?

Make hvm_fep available to non-debug build as well?

[Wei Liu]

Andrew and I had a short conversation on IRC about why hvm_fep is only
available to debug build. Here is what he said:

<andyhhp> liuw: because hvm_fep puts a very large attack surface back
          into the hypervisor
<andyhhp> I intoduced it originally to make it easy to test the
          instruction emulator without requiring a race condition between two
          vcpus
<andyhhp> so I guess paranoia is the underlying answer to your question
<andyhhp> there is nothing wrong in principle with making available in
          non-debug builds

I think I agree with him that in principle it should be possible to
make hvm_fep available to non-debug build. Andrew also suggested a
sync_console style warning, which I think makes sense.

If hvm_fep is enabled, we also should not provide any security support,
because the attack surface is widen. That should be reflected in the
warning message.

I think there is one major benefit for making hvm_fep available to
non-debug build:  user can replicate the exact setup in production and
use XTF to test if it is vulnerable to various issues.

My own reason for having hvm_fep for non-debug builds is that would make
integrating it with osstest much easier, and possibly require less
resources from osstest.  

I want XTF to run on every flight and gate xen-unstable. Remember that
we switch from debug to non-debug build  at some point during release
process -- if hvm_fep is only available to debug build, that would
require some more arrangement to run such tests.  We also essentially
test less for non-debug build, which is not very desirable.

Thoughts?

Wei.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: Make hvm_fep available to non-debug build as well?

[Jan Beulich]

>>> On 14.06.16 at 12:47, <wei.liu2@citrix.com> wrote:
> Andrew and I had a short conversation on IRC about why hvm_fep is only
> available to debug build. Here is what he said:
> 
> <andyhhp> liuw: because hvm_fep puts a very large attack surface back
>           into the hypervisor
> <andyhhp> I intoduced it originally to make it easy to test the
>           instruction emulator without requiring a race condition between 
> two
>           vcpus
> <andyhhp> so I guess paranoia is the underlying answer to your question
> <andyhhp> there is nothing wrong in principle with making available in
>           non-debug builds
> 
> I think I agree with him that in principle it should be possible to
> make hvm_fep available to non-debug build. Andrew also suggested a
> sync_console style warning, which I think makes sense.

Properly documented I'm not heavily opposed (but also not fully
convinced of this being a good idea).

Jan


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: Make hvm_fep available to non-debug build as well?

[Andrew Cooper]

On 14/06/16 11:54, Jan Beulich wrote:
>>>> On 14.06.16 at 12:47, <wei.liu2@citrix.com> wrote:
>> Andrew and I had a short conversation on IRC about why hvm_fep is only
>> available to debug build. Here is what he said:
>>
>> <andyhhp> liuw: because hvm_fep puts a very large attack surface back
>>           into the hypervisor
>> <andyhhp> I intoduced it originally to make it easy to test the
>>           instruction emulator without requiring a race condition between 
>> two
>>           vcpus
>> <andyhhp> so I guess paranoia is the underlying answer to your question
>> <andyhhp> there is nothing wrong in principle with making available in
>>           non-debug builds
>>
>> I think I agree with him that in principle it should be possible to
>> make hvm_fep available to non-debug build. Andrew also suggested a
>> sync_console style warning, which I think makes sense.
> Properly documented I'm not heavily opposed (but also not fully
> convinced of this being a good idea).

I have had one case where I needed to make FEP available in non-debug
build, as a bug I was chasing had its repro symptoms disappeared in a
debug build. 
(https://github.com/xenserver/xen-4.6.pg/commit/5826deab561dd92efaaeeb222c27184be257fad5
for those who are interested)

So long as it is obvious when it is enabled, I am a hesitant +1.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Re: Make hvm_fep available to non-debug build as well?

[Wei Liu]

On Tue, Jun 14, 2016 at 12:36:09PM +0100, Andrew Cooper wrote:
> On 14/06/16 11:54, Jan Beulich wrote:
> >>>> On 14.06.16 at 12:47, <wei.liu2@citrix.com> wrote:
> >> Andrew and I had a short conversation on IRC about why hvm_fep is only
> >> available to debug build. Here is what he said:
> >>
> >> <andyhhp> liuw: because hvm_fep puts a very large attack surface back
> >>           into the hypervisor
> >> <andyhhp> I intoduced it originally to make it easy to test the
> >>           instruction emulator without requiring a race condition between 
> >> two
> >>           vcpus
> >> <andyhhp> so I guess paranoia is the underlying answer to your question
> >> <andyhhp> there is nothing wrong in principle with making available in
> >>           non-debug builds
> >>
> >> I think I agree with him that in principle it should be possible to
> >> make hvm_fep available to non-debug build. Andrew also suggested a
> >> sync_console style warning, which I think makes sense.
> > Properly documented I'm not heavily opposed (but also not fully
> > convinced of this being a good idea).
> 
> I have had one case where I needed to make FEP available in non-debug
> build, as a bug I was chasing had its repro symptoms disappeared in a
> debug build. 
> (https://github.com/xenserver/xen-4.6.pg/commit/5826deab561dd92efaaeeb222c27184be257fad5
> for those who are interested)
> 
> So long as it is obvious when it is enabled, I am a hesitant +1.
> 

OK, I think I can start writing patch(es) to do that now.

Wei.

> ~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel