* Make hvm_fep available to non-debug build as well?
@ 2016-06-14 10:47 Wei Liu
2016-06-14 10:54 ` Jan Beulich
0 siblings, 1 reply; 4+ messages in thread
From: Wei Liu @ 2016-06-14 10:47 UTC (permalink / raw)
To: Jan Beulich, Andrew Cooper; +Cc: Xen-devel, Wei Liu
Andrew and I had a short conversation on IRC about why hvm_fep is only
available to debug build. Here is what he said:
<andyhhp> liuw: because hvm_fep puts a very large attack surface back
into the hypervisor
<andyhhp> I intoduced it originally to make it easy to test the
instruction emulator without requiring a race condition between two
vcpus
<andyhhp> so I guess paranoia is the underlying answer to your question
<andyhhp> there is nothing wrong in principle with making available in
non-debug builds
I think I agree with him that in principle it should be possible to
make hvm_fep available to non-debug build. Andrew also suggested a
sync_console style warning, which I think makes sense.
If hvm_fep is enabled, we also should not provide any security support,
because the attack surface is widen. That should be reflected in the
warning message.
I think there is one major benefit for making hvm_fep available to
non-debug build: user can replicate the exact setup in production and
use XTF to test if it is vulnerable to various issues.
My own reason for having hvm_fep for non-debug builds is that would make
integrating it with osstest much easier, and possibly require less
resources from osstest.
I want XTF to run on every flight and gate xen-unstable. Remember that
we switch from debug to non-debug build at some point during release
process -- if hvm_fep is only available to debug build, that would
require some more arrangement to run such tests. We also essentially
test less for non-debug build, which is not very desirable.
Thoughts?
Wei.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: Make hvm_fep available to non-debug build as well?
2016-06-14 10:47 Make hvm_fep available to non-debug build as well? Wei Liu
@ 2016-06-14 10:54 ` Jan Beulich
2016-06-14 11:36 ` Andrew Cooper
0 siblings, 1 reply; 4+ messages in thread
From: Jan Beulich @ 2016-06-14 10:54 UTC (permalink / raw)
To: Wei Liu; +Cc: Andrew Cooper, Xen-devel
>>> On 14.06.16 at 12:47, <wei.liu2@citrix.com> wrote:
> Andrew and I had a short conversation on IRC about why hvm_fep is only
> available to debug build. Here is what he said:
>
> <andyhhp> liuw: because hvm_fep puts a very large attack surface back
> into the hypervisor
> <andyhhp> I intoduced it originally to make it easy to test the
> instruction emulator without requiring a race condition between
> two
> vcpus
> <andyhhp> so I guess paranoia is the underlying answer to your question
> <andyhhp> there is nothing wrong in principle with making available in
> non-debug builds
>
> I think I agree with him that in principle it should be possible to
> make hvm_fep available to non-debug build. Andrew also suggested a
> sync_console style warning, which I think makes sense.
Properly documented I'm not heavily opposed (but also not fully
convinced of this being a good idea).
Jan
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Make hvm_fep available to non-debug build as well?
2016-06-14 10:54 ` Jan Beulich
@ 2016-06-14 11:36 ` Andrew Cooper
2016-06-15 14:16 ` Wei Liu
0 siblings, 1 reply; 4+ messages in thread
From: Andrew Cooper @ 2016-06-14 11:36 UTC (permalink / raw)
To: Jan Beulich, Wei Liu; +Cc: Xen-devel
On 14/06/16 11:54, Jan Beulich wrote:
>>>> On 14.06.16 at 12:47, <wei.liu2@citrix.com> wrote:
>> Andrew and I had a short conversation on IRC about why hvm_fep is only
>> available to debug build. Here is what he said:
>>
>> <andyhhp> liuw: because hvm_fep puts a very large attack surface back
>> into the hypervisor
>> <andyhhp> I intoduced it originally to make it easy to test the
>> instruction emulator without requiring a race condition between
>> two
>> vcpus
>> <andyhhp> so I guess paranoia is the underlying answer to your question
>> <andyhhp> there is nothing wrong in principle with making available in
>> non-debug builds
>>
>> I think I agree with him that in principle it should be possible to
>> make hvm_fep available to non-debug build. Andrew also suggested a
>> sync_console style warning, which I think makes sense.
> Properly documented I'm not heavily opposed (but also not fully
> convinced of this being a good idea).
I have had one case where I needed to make FEP available in non-debug
build, as a bug I was chasing had its repro symptoms disappeared in a
debug build.
(https://github.com/xenserver/xen-4.6.pg/commit/5826deab561dd92efaaeeb222c27184be257fad5
for those who are interested)
So long as it is obvious when it is enabled, I am a hesitant +1.
~Andrew
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Make hvm_fep available to non-debug build as well?
2016-06-14 11:36 ` Andrew Cooper
@ 2016-06-15 14:16 ` Wei Liu
0 siblings, 0 replies; 4+ messages in thread
From: Wei Liu @ 2016-06-15 14:16 UTC (permalink / raw)
To: Andrew Cooper; +Cc: Xen-devel, Wei Liu, Jan Beulich
On Tue, Jun 14, 2016 at 12:36:09PM +0100, Andrew Cooper wrote:
> On 14/06/16 11:54, Jan Beulich wrote:
> >>>> On 14.06.16 at 12:47, <wei.liu2@citrix.com> wrote:
> >> Andrew and I had a short conversation on IRC about why hvm_fep is only
> >> available to debug build. Here is what he said:
> >>
> >> <andyhhp> liuw: because hvm_fep puts a very large attack surface back
> >> into the hypervisor
> >> <andyhhp> I intoduced it originally to make it easy to test the
> >> instruction emulator without requiring a race condition between
> >> two
> >> vcpus
> >> <andyhhp> so I guess paranoia is the underlying answer to your question
> >> <andyhhp> there is nothing wrong in principle with making available in
> >> non-debug builds
> >>
> >> I think I agree with him that in principle it should be possible to
> >> make hvm_fep available to non-debug build. Andrew also suggested a
> >> sync_console style warning, which I think makes sense.
> > Properly documented I'm not heavily opposed (but also not fully
> > convinced of this being a good idea).
>
> I have had one case where I needed to make FEP available in non-debug
> build, as a bug I was chasing had its repro symptoms disappeared in a
> debug build.
> (https://github.com/xenserver/xen-4.6.pg/commit/5826deab561dd92efaaeeb222c27184be257fad5
> for those who are interested)
>
> So long as it is obvious when it is enabled, I am a hesitant +1.
>
OK, I think I can start writing patch(es) to do that now.
Wei.
> ~Andrew
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-06-15 14:16 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-06-14 10:47 Make hvm_fep available to non-debug build as well? Wei Liu
2016-06-14 10:54 ` Jan Beulich
2016-06-14 11:36 ` Andrew Cooper
2016-06-15 14:16 ` Wei Liu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).