[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: alternatives+livepatch testing


  • To: Andrew Cooper <Andrew.Cooper3@xxxxxxxxxx>
  • From: Roger Pau Monné <roger.pau@xxxxxxxxxx>
  • Date: Fri, 11 Mar 2022 11:05:49 +0100
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=bcs3QXxJEyoE62nLZdflDbySx1KIU6vlO7YUiYFr4uo=; b=LC7Zsqz866IQNSWJD7AGkj0HullPH//aXW9KTJO+6uXIpY4ubQ2X3BK6zW0ymNVdubRWatnnONJBSMcCzYYFP3Bz9wHEDQcQJ36AUE8tJbNFHq2Jje0pliyUxkNLKmsbFYY52MXsNoBcyG09RyYql4WaX3lS0MHuT7VulzTmOtiBHrzu88PpXUr0eJv2ic8LJmxIauoG+zzR2f1vduUJzAfV7HXSEJyxwE+T0S8QQnjWjoz4ZzyCSsBfhoOCQX4h/WJRWAewJVLmDDrC6teWaf3Skm48d0QFNr3EsFdwN4RJSgQLubQjQ+w0nvtIdNBtDVj3OLKY7pTlN7KUcUnxTQ==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=mraqsD1Vh0NyYtPFAXHMg6VR2j2lhNUSDjxuizOSoUs60+kC+GHUmKDq2EIctz0nFgMrxXuE5f7g6Oibac3XYf1MrUw4rG1N9Qt/Fhk2m9hxKDN/UBZsGXOdWhF5jDOURRYut5ph+/7fRrTj5QqW1Pjq+s9CwFcEqkTpy2Advst90wweL1yfjeEXF2mI29LZwX9OnUISjMFHkA8vNrTLiREem54NQ32SDP/w6sgvMTL8TD4qV3ie9hZPGHnXqOW5jKPNK5Yjer//04aRvyEb8b4HG+FJp8fLfAFyqN4NqQHZJ3PljLQZTI2F/ZKAgVupKtDy7fWe1veT8hdrQm1lqw==
  • Authentication-results: esa6.hc3370-68.iphmx.com; dkim=pass (signature verified) header.i=@citrix.onmicrosoft.com
  • Cc: xen-devel <xen-devel@xxxxxxxxxxxxxxxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Wei Liu <wl@xxxxxxx>, Julien Grall <julien@xxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Bertrand Marquis <Bertrand.Marquis@xxxxxxx>, Oleksandr Tyshchenko <oleksandr_tyshchenko@xxxxxxxx>, Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>, Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>, "Bjoern Doebel" <doebel@xxxxxxxxx>, Michael Kurth <mku@xxxxxxxxx>, "Pohlack, Martin" <mpohlack@xxxxxxxxx>
  • Delivery-date: Fri, 11 Mar 2022 10:07:15 +0000
  • Ironport-data: A9a23:upOi/KxuQY71E4QPtzV6t+dwwSrEfRIJ4+MujC+fZmUNrF6WrkUEm DEfCj3QOamOYjTyfN5wYNjn/UgGv8XQzIBiHAdt+yAxQypGp/SeCIXCJC8cHc8zwu4v7q5Dx 59DAjUVBJlsFhcwnj/0bv656yMUOZigHtIQMsadUsxKbVIiGX9JZS5LwbZj2NYz2IHhWmthh PupyyHhEA79s9JLGjp8B5Kr8HuDa9yr5Vv0FnRnDRx6lAe2e0s9VfrzFonoR5fMeaFGH/bSe gr25OrRElU1XfsaIojNfr7TKiXmS1NJVOSEoiI+t6OK2nCuqsGuu0qS2TV1hUp/0l20c95NJ Npl6cG9EVd4BZD2wroRfhpxGSpBYfdm5+qSSZS/mZT7I0zudnLtx7NlDV0sPJ1e8eFyaY1M3 aVGcnZXNEnF3r/ohuLgIgVvrp1LwM3DJoQQt2sm1TjEJf0nXYrCU+PB4towMDIY2J0fR6mFN 5BxhTxHbB6aSEMfKgwuFrU5uPyh3UDYWgcFpwfAzUYwyzeKl1EguFT3C/LWfdqQTMkTgUecp UrB5W3yBhxcP9uaoRKC9n+vnebJkTnMRJMJFLa4+/hph3We3mUWThYRUDOTrf60gEO6c9taI l4T/GwioMAa8VSsTt30VB6QqXuNrBkaHdZde8U/6xylw6/d8QGfQGQJJhZrZcY6rsYwSXoP3 0WQgtLyLTV1tfueTnf13rWeoC62OCMVBXQffiJCRgwAi/HzrYd2gh/RQ9JLFK+uksazCTz22 yqNriU1m/MUl8Fj/7q/1UDKhXSrvJehZhUu+gzdU2ah7wV4TI2ofYql7R7c9/koBISESliMu lAUls7Y6/oBZaxhjwTUHr9LRuvwoa/YbnuM2jaDAqXN6RzxpnP7LdFr3QskektEMe8OcgC1O m/M7FY5CIBoAFOmaqp+YoSUAssszLT9GdmNas04fuaicbAqKlbZoXgGiVq4mjm0zRNyyf1X1 YKzLJ70ZUv2H5iL29Zfqw019bYwjh4zymrILXwQ50T2iOHODJJ5pFpsDbdvUgzbxP/VyOk22 4wGXydv9/m5eLSvCsUw2dRPRW3m1VBhWfjLRzV/L4Zv2DZOFmA7EOP2yrg8YYFjlKk9vr6Wo i/sARAHmAKn3COvxeC2hpZLMeKHsXFX9y9TAMDRFQzwhyhLjXiHsM/ziKfbjZF4rbc+nJaYv tEOetmaA+Qnd9g00291UHUJl6Q7LE7DrVvXZ0KNOWFjF7Y9F12h0oK1JWPHqXhRZhdbQONj+ tVMICuAGsFdL+mjZe6LAM+SI6SZ5iFMxrgtAxOWfrG+uizEqeBXFsA4tdduS+kkIhTf3DqKk QGQBBYTv+7WpIEpttLOgMi5Q02BT7cW8pZyd4UD0YuLCA==
  • Ironport-hdrordr: A9a23:0iqFBKit/JpZPQ9rWAauiEayZHBQXz513DAbv31ZSRFFG/FwyP rBoB1L73DJYWgqNE3I+erhBEGBKUmsk6KdxbNhQItKOzOWxFdATbsSl7cKpgeAJ8SQzJ856U 4NSdkbNDS0NykEsS+Y2njJLz9D+qj+zEnAv463pB0BPGIaCZ2IrT0JcTpzencGNTWubqBJba Z0iPA3wAZJLh8sH7qG7zQ+LqP+juyOsKijTQ8NBhYh5gXLpTS06ITiGxzd+hsFSTtAzZor7G CAymXCl+iemsD+7iWZ+37Y7pxQltek4txfBPaUgsxQDjn3kA6naKloRrXHljEop+OE7kosjb D30l0dFvU2z0mUUnC+oBPr1QWl+DEy60X6wVvdunfnqdyRfkNNN+NxwaZiNjfJ4Uspu99xlI hR2XiCipZRBRTc2Azg+tnhTXhR5wSJiEtntdRWo21UUIMYZrMUh5cY5llpHJAJGz+/wJw7Ed NpENrX6J9tABynhkjizylSKeGXLzcO9k/seDlBhiXV6UkboJlB9TpY+CRF9U1wsa7USPF/lp P52+pT5fVzp/QtHNBA7dc6MLiK41P2MGfx2UKpUB3a/fI8SjrwQ6Ce2sRA2AjtQu1O8KcP
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>

On Thu, Mar 10, 2022 at 12:27:34PM +0000, Andrew Cooper wrote:
> Hello,
> 
> The recent hiccup with CET-IBT, and discovery that livepatch-build-tools
> have been broken for several releases, demonstrates that we do not have
> remotely adequate testing in place.  We need to address, and ensure we
> don't end up in the same position again.
> 
> Alternatives and Livepatching have a number of overlapping test
> requirements, so how about the following plan:
> 
> 1) Introduce a new $arch/scm-tests.c, with something akin to the
> existing stub_selftest().  I'm tempted to move stub_selftest() out of
> initcall and call it from init_done() (before we clobber .init.text)
> because that gets shstk testing included.

Having a specific file we can patch would be good. We could even try
to apply/revert the patch as part of normal build processes, but that
might be too much.

> Even without livepatching, we've got various requirements such as
> endbr's only existing where expected, and getting clobbered when
> suitably annotated, and altcalls turning into UD for a still-NULL pointer.
> 
> Items not yet upstream but on the radar include inlining of retpoline
> thunks and SLS workarounds, which would also fit into this.
> 
> 2) Provide (in xen.git) a patch to scm-tests.c which OSSTest/other can
> use livepatch-build-tools on to generate a real livepatch, and a new
> livepatching subop which can be invoked from xen-livepatch in userspace
> that will run the same kind of consistency checks as 1) on the patched
> content.
> 
> This lets us create specific constructs and confirm that they get
> patched correctly, without having to specifically execute the result.  I
> (think) we can do everything needed without reference to the livepatch
> metadata, which simplifies things.

We could start with just patching the livepatch subop hypercall to
return a specific value and expand from there. We need something
simple in Xen so that we can start and integrate into osstest. We can
then build extra coverage easily from there.

> Providing a patch isn't totally ideal from a "maintaining xen" point of
> view, but I think we can have a build-time test which confirms the patch
> is still good, and it is definitely the right primitive to use for the
> end-to-end testing.

Oh, right, so you would be fine with applying/revertign the patch
during a normal build process.

Roger.



 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.