From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel De Graaf Subject: Re: [Hackathon 16] Notes from Security Session Date: Mon, 23 May 2016 10:53:57 -0400 Message-ID: <57431985.60801@tycho.nsa.gov> References: <5715F43E.7090503@cardoe.com> <5715F640.1070206@citrix.com> <20160425183229.GB13411@char.us.oracle.com> <571E7524.8070005@tycho.nsa.gov> <1445CEA7-78E1-428B-BD7C-757B2B8EB684@gmail.com> <20160517210843.GD7179@char.us.oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8"; Format="flowed" Content-Transfer-Encoding: base64 Return-path: Received: from mail6.bemta6.messagelabs.com ([85.158.143.247]) by lists.xenproject.org with esmtp (Exim 4.84_2) (envelope-from ) id 1b4rF8-0008QB-VV for xen-devel@lists.xenproject.org; Mon, 23 May 2016 14:54:07 +0000 In-Reply-To: <20160517210843.GD7179@char.us.oracle.com> List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xen.org Sender: "Xen-devel" To: Konrad Rzeszutek Wilk , Lars Kurth Cc: James McKenzie , sstabellini@kernel.org, Wei Liu , steve@zentific.com, Ross Philipson , Andrew Cooper , openxt@googlegroups.com, Doug Goldstein , George Dunlap , Rich Persaud , Jan Beulich , Anthony PERARD , Xen-devel List-Id: xen-devel@lists.xenproject.org T24gMDUvMTcvMjAxNiAwNTowOCBQTSwgS29ucmFkIFJ6ZXN6dXRlayBXaWxrIHdyb3RlOgo+IE9u IFR1ZSwgQXByIDI2LCAyMDE2IGF0IDA5OjU3OjEyQU0gKzAxMDAsIExhcnMgS3VydGggd3JvdGU6 Cj4+IEFsc28gYWRkaW5nIFN0ZXZlIE1hcmVzY2EgdG8gdGhlIHRocmVhZCwgd2hvIGhhcyBiZWVu IHVzaW5nIFhTTSBleHRlbnNpdmVseSBhbmQgYWxzbyBkb2N1bWVudGluZyBYU00gYW5kIGNhbiBw cm92aWRlIHNvbWUgdXNlciBwZXJzcGVjdGl2ZQo+PiBMYXJzCj4+Cj4+PiBPbiAyNSBBcHIgMjAx NiwgYXQgMjA6NTEsIERhbmllbCBEZSBHcmFhZiA8ZGdkZWdyYUB0eWNoby5uc2EuZ292PiB3cm90 ZToKPj4+Cj4+PiBPbiAwNC8yNS8yMDE2IDAyOjMyIFBNLCBLb25yYWQgUnplc3p1dGVrIFdpbGsg d3JvdGU6Cj4+Pj4gT24gVHVlLCBBcHIgMTksIDIwMTYgYXQgMTA6MTE6MjhBTSArMDEwMCwgQW5k cmV3IENvb3BlciB3cm90ZToKPj4+Pj4gT24gMTkvMDQvMTYgMTA6MDIsIERvdWcgR29sZHN0ZWlu IHdyb3RlOgo+Pj4+Pj4gT24gNC8xOC8xNiAxMjoyMCBQTSwgTGFycyBLdXJ0aCB3cm90ZToKPj4+ Pj4+PiBIaSBhbGwsCj4+Pj4KPj4+PiBDQy1pbmcgWFNNIG1haW50YWluZXIgOi0pCj4+Pgo+Pj4g VGhhbmtzLiBJJ20gZ29pbmcgdG8gY29tbWVudCBvbiB0aGlzIGFuZCB0aGUgd2lraS4KPj4+Cj4+ PiBbLi4uXQo+Pj4+Pj4+ID09PSBFbmFibGluZyBYU00gQnkgZGVmYXVsdCA9PT0KPj4+Pj4+PiBB bmRyZXc6IFRoZXJlIGFyZSBzb21lIGlzc3VlcyB3aGljaCB3ZSBuZWVkIHRvIHdvcmsgdGhyb3Vn aDsgYSBsb3Qgb2YgbGl0dGxlIHBhcGVyIGN1dHMKPj4+Pj4+PiBSaWNoOiBDb3VsZCB3ZSBjcmVh dGUgYSBsaXN0IG9mIGlzc3VlcyBvbiB0aGUgd2lraT8KPj4+Pj4+PiBMYXJzOiBEZWZpbml0ZWx5 Cj4+Pj4+Pj4gRG91ZzogQ291bGQgd2Ugbm90IGhhdmUgYSBwb2xpY3kgd2hpY2ggaXMgZXF1aXZh bGVudCB0byBYU00gYmVpbmcgY29tcGlsZWQgb3V0Cj4+Pj4+Pj4gQW5kcmV3OiBDb3VsZCBtYWtl IHBvbGljeSBtb3JlIG1vZHVsYXIgaW5zdGVhZCBvZiBvbmUgYmlnIGdsb2JhbCBwb2xpY3kKPj4+ Pj4+Pgo+Pj4+Pj4+IFJlLWFwcGx5IHBvbGljeSBvZiBndWVzdCBhZnRlciBydW5uaW5nCj4+Pj4+ Pj4KPj4+Pj4+PiBBQ1RJT046IE5lZWQgYSB3aWtpIHBhZ2UsIEtvbnJhZCBjYW4gc3RhcnQgb25l IGFuZCB3ZSBjYW4gY29sbGFib3JhdGl2ZWx5IGZsZXNoIGl0IG91dAo+Pj4+Pj4+IExhcnM6IFNl ZSBodHRwOi8vd2lraS54ZW5wcm9qZWN0Lm9yZy93aWtpL1hTTUFzRGVmYXVsdF9UT0RPX0xpc3QK Pj4+Pj4+Pgo+Pj4+Pj4+IEFDVElPTjogS29ucmFkIGFuZCBvdGhlcnMgdG8gYWRkIGRldGFpbCB0 byBpdAo+Pj4+Pj4+Cj4+Pj4+Pj4KPj4+Pj4+IEl0IHdhcyBwb2ludGVkIG91dCB0byBtZSB0aGF0 IEkgZGlkIG5vdCBnZXQgbXkgY29tbWVudHMgYWJvdXQgWFNNIGFjcm9zcwo+Pj4+Pj4gY2xlYXJs eS4gSSBiZWxpZXZlIHdlIG5lZWQgdG8gaW1wcm92ZSB0aGUgZGVmYXVsdCBwb2xpY3kgdG8gYmUK Pj4+Pj4+IGVxdWl2YWxlbnQgdG8gZGlzYWJsaW5nIFhTTSBhbmQvb3IgY3JlYXRlIGEgcG9saWN5 IGNhbGxlZCAiZHVtbXkiIHRoYXQKPj4+Pj4+IGlzIHRoZSBzYW1lIGFzIFhTTSBkaXNhYmxlZC4g VG8gbWFrZSBYU00gdXNhZ2UgbW9yZSBzbW9vdGggSSBwcm9wb3NlIHdlCj4+Pj4+PiBiYWtlIHRo ZSBkZWZhdWx0IHBvbGljeSBpbnRvIC5pbml0ZGF0YSBzbyB0aGF0IHdoZW4geW91IGJvb3QgWGVu Cj4+Pj4+PiBjb21waWxlZCB3aXRoIFhTTSB5b3UgYXJlIG5vIHdvcnNlIG9mZiB0aGFuIGNvbXBp bGluZyBYU00gb3V0Lgo+Pj4+Pj4KPj4+Pj4+IFRoZSByYXRpb25hbGUgaGVyZSBpcyB0aGF0IHBy aW9yIHRvIGEgcmVjZW50IGNvbW1pdCB3aGVuIHlvdSBjb21waWxlZAo+Pj4+Pj4gWGVuIHdpdGgg WFNNIGVuYWJsZWQgYnV0IGRpZCBub3QgcHJvdmlkZSBhIGRlZmF1bHQgcG9saWN5IHRoZW4gYW55 IGRvbVVzCj4+Pj4+PiB0aGF0IHlvdSByYW4gaGFkIGFzIG11Y2ggYWNjZXNzIGFzIGRvbTAuIFRo ZSByZWNlbnQgY29tbWl0IGNoYW5nZWQgaXQgc28KPj4+Pj4+IHRoYXQgWGVuIGJ5IGRlZmF1bHQg ZG9lcyBub3QgYm9vdCB3aXRob3V0IGEgcG9saWN5Lgo+Pj4+Pj4KPj4+Pj4+IFdpdGggbXkgcHJv cG9zZWQgY2hhbmdlIHdlIHdvdWxkIGhhdmUgImR1bW15IiB0aGF0IHdvdWxkIGNvbXBpbGUgaW4g YW5kCj4+Pj4+PiBpZiB5b3UgcHJvdmlkZWQgYW5vdGhlciBwb2xpY3kgaXQgd291bGQgYmUgdXNl ZCBpbnN0ZWFkIG9yIHlvdSBjb3VsZAo+Pj4+Pj4gbGF0ZSBsb2FkIGEgcmVwbGFjZW1lbnQgcG9s aWN5LiBCYXNpY2FsbHkgZmlsbGluZyB0aGUgZ2FwIG9mIHR1cm5pbmcgb24KPj4+Pj4+IFhTTSBh bmQgaGF2aW5nIGEgc3lzdGVtIGxlc3Mgc2VjdXJlIHRoYW4gWFNNIG9mZiB1bnRpbCB5b3UgZGV2 ZWxvcGVkCj4+Pj4+PiB5b3VyIHBvbGljeS4KPj4+Pj4KPj4+Pj4gKzEuICBJdCBhbHNvIGF2b2lk cyBuZWVkaW5nIHRvIHBsYXkgYXJvdW5kIGxvYWRpbmcgYW4gZXh0cmEgZmlsZSBhcyBhIGdydWIK Pj4+Pj4gbW9kdWxlLCB3aGljaCBtYWtlcyBkaXN0cm8taW50ZWdyYXRpb24gZWFzZXIuCj4+Pj4+ Cj4+Pj4+IH5BbmRyZXcKPj4+Cj4+PiBUaGlzIHNob3VsZCBiZSBkb2FibGUsIHRob3VnaCBpdCB3 aWxsIHJlcXVpcmUgbW92aW5nIHRoZSByZXN0IG9mCj4+PiB0b29scy9mbGFzay9wb2xpY3kgdW5k ZXIgeGVuLyBmb3IgcHJvcGVyIGRlcGVuZGVuY2llcy4gQmV5b25kIHRoYXQsIGl0Cj4+PiB3b3Vs ZCBuZWVkIGVpdGhlciBhIHNjcmlwdCBvciBhIGNhcmVmdWwgaW52b2NhdGlvbiBvZiBvYmpjb3B5 IHRvIGNvbnZlcnQKPj4+IHRoZSBwb2xpY3kgb3V0cHV0IHRvIGFuIGFycmF5IGluIGluaXRkYXRh LCBhbmQgdGhlbiB0aGF0IHBvbGljeSB3b3VsZCBiZQo+Pj4gdXNlZCBpZiB0aGUgYm9vdGxvYWRl ciBvbmUgaXMgbm90IHByZXNlbnQuCj4KPiBPSywgbGV0IG1lIHRha2UgYSBzdGFiIGF0IHRoYXQu IFVubGVzcyBzb21lYm9keSBlbHNlIGlzIGFscmVhZHkgbG9va2luZwo+IGF0IHRoaXM/CgpJIGhh dmUgYW4gUkZDIHBhdGNoIHRoYXQgSSdsbCBzZW5kIGluIGEgbW9tZW50LgoKPj4+Cj4+PiAgRnJv bSB0aGUgd2lraToKPj4+PiBYU00gd2l0aCBkZWZhdWx0IHBvbGljeSB3aWxsIGhhdmU6Cj4+Pj4K Pj4+PiAgIC0gU2FtZSBmdW5jdGlvbmFsaXR5IGV4cG9zZWQgdG8gZ3Vlc3RzIHdpdGhvdXQgcmVn cmVzc2lvbnMKPj4+PiAgIC0gSGF2ZSBhdCBtaW5pbXVtIHRoZSBzYW1lIHNlY3VyaXR5IGFzIHdl IGhhdmUgd2l0aG91dCBYU00gZW5hYmxlZC4KPj4+PiAgIC0gSGF2ZSBzZXQgb2YgcG9saWNpZXMg Zm9yIGRldmljZSBkcml2ZXIgZG9tYWlucyB2cyBjb250cm9sIGRvbWFpbnMuCj4+Pgo+Pj4gVGhl IGZpcnN0IHR3byBidWxsZXRzIHNob3VsZCBiZSB0cnVlIHdpdGggdGhlIGN1cnJlbnQgcG9saWN5 LiBUaGUgdGhpcmQKPj4+IG5lZWRzIHRvIGJlIG1vcmUgcHJlY2lzZWx5IGRlZmluZWQ6IGFueSBv cGVyYXRpb24gb24gYSBncm91cCBpdAo+Pj4gY29udHJvbHMsIG9yIGxpbWl0ZWQgb3BlcmF0aW9u cyAoc3VjaCBhcyBhZGp1c3RpbmcgbWVtb3J5IHNpemUpIG9uIGFsbAo+Pj4gZ3Vlc3RzPyAgVGhl IGxhdHRlciB3aWxsIHByb2JhYmx5IG5lZWQgYSBjdXN0b20gcG9saWN5IChtb2R1bGUpIGZvcgo+ Pj4gZXhhY3RseSB3aGF0IHRoZSBjb250cm9sIGRvbWFpbiBkb2VzLgo+Cj4gSG0uIEkgd291bGQg aGF2ZSB0aG91Z2h0IHRoYXQgZGV2aWNlIGRyaXZlciBkb21haW5zIHdvdWxkIGhhdmUKPiBsaW1p dGVkIG9wZXJhdGlvbnMuIEFzIGluIHRoZXkgY2FuIGRvIGdyYW50IG1hcHMsIFBDSWUgYWNjZXNz LCBldGMuCj4gQnV0IHRoZXkgY2Fubm90IGRvIHRoZSBvcGVyYXRpb25zIHRoYXQgZG9tMCBoYXMg ZG9uZS4KCkZvciBwdXJlIGRldmljZSBkcml2ZXIgZG9tYWlucywgdGhpcyBpcyB0cnVlOiB0aGV5 IGNhbiBqdXN0IHVzZSBkb21VX3QgYW5kCmJlIGRvbmUuICBUaGUgY3VzdG9tIHR5cGVzIHdvdWxk IGJlIG5lZWRlZCBmb3IgKG5vbi1kb20wKSBjb250cm9sIGRvbWFpbnMuCgo+IERvdWcsIGRpZG4n dCB5b3UgZG8gc29tZSBvZiB0aGlzIGFscmVhZHk/Cj4+Pgo+Pj4+IEtub3duIElzc3Vlcwo+Pj4+ Cj4+Pj4gICAtIENhbm5vdCByZS1hcHBseSBhIG5ldyBwb2xpY3kgYWZ0ZXIgZ3Vlc3RzIGhhdmUg YmVlbiBydW5uaW5nLgo+Pj4KPj4+IFRoaXMgaXMgcG9zc2libGUgdmlhICJ4bCBsb2FkcG9saWN5 Ii4gIFRoZXJlIGlzIG5vIChleHBvc2VkKSB3YXkgdG8KPj4+IHJlLWxhYmVsIGV4aXN0aW5nIGRv bWFpbnMsIGJ1dCB5b3UgY2FuIGNyZWF0ZSBuZXcgZG9tYWlucyB1c2luZyBuZXcKPj4+IHR5cGVz IGluIHRoZSBwb2xpY3kuICBUaGUgbmV3IHBvbGljeSBydWxlcyB3aWxsIGJlIGVuZm9yY2VkIGlt bWVkaWF0ZWx5Cj4+PiBvbiBleGlzdGluZyBkb21haW5zLCBidXQgdGhpcyBtYXkgbm90IGZ1bGx5 IHRpZ2h0ZW4gcmVzdHJpY3Rpb25zOiBmb3IKPj4+IGV4YW1wbGUsIGlmIGEgcGFzc3Rocm91Z2gg ZGV2aWNlIGlzIG5ld2x5IGRpc2FsbG93ZWQgYnV0IGFscmVhZHkgbWFwcGVkCj4+PiBieSBhIGRv bWFpbiwgaXQgd2lsbCBub3QgYmUgdW5tYXBwZWQuCj4KPiBXb3VsZCB0aGUgYXVkaXQgY29kZSBt ZW50aW9uIHRoaXM/IEFoIEkgcHJlc3VtZSBub3QgYXMgdGhlIG9wZXJhdGlvbgo+IGhhcyBhbHJl YWR5IGJlZW4gY29tcGxldGVkIGFuZCB0aGUgSU9NTVUgYWNjZXNzIGFuZCBzdWNoIGRvIG5vdCBk byBYU00KPiBjaGVja3MuCgpUaGUgYXVkaXQgY29kZSB3b3VsZCBjYXRjaCB0aGUgcG9saWN5IHJl bG9hZCwgYW5kIGl0IG1pZ2h0IGZpbmQgKGFuZCBkZW55KQpvcGVyYXRpb25zIGJ5IFBWIGRvbWFp bnMgZG9pbmcgYSByZW1hcCBvZiB0aGUgZGV2aWNlIG1hcHBpbmcuICBIVk0gZG9tYWlucwooZXNw ZWNpYWxseSBvbmVzIHVzaW5nIEVQVCkgZG9uJ3QgaGl0IFhTTSBjb2RlIHdoZW4gYWRqdXN0aW5n IHRoYXQgbWFwcGluZywKb25seSB3aGVuIGl0IGlzIGluaXRpYWxseSBhZGRlZCB0byB0aGUgZ3Vl c3QgdG8gbWFjaGluZSBtYXBwaW5nLgoKPiBCdXQgaXQgaXMgZ29vZCB0byBrbm93IHRoYXQgeW91 IGNhbiByZWxhYmxlIGV4aXN0aW5nIGRvbWFpbnMuCj4gSSB3YXMgdW5kZXIgdGhlIG1pc3Rha2Vu IGltcHJlc3Npb24geW91IGNvdWxkbid0IQoKVGhpcyBpcyBvbmx5IGV4cG9zZWQgYXQgdGhlIGxp YnhjIGxldmVsICh4Y19mbGFza19yZWxhYmVsX2RvbWFpbiksIGFuZCBpdAppcyBkaXNjb3VyYWdl ZCBhcyB0aGUgImRvZXNuJ3QgcmV2b2tlIGV4aXN0aW5nIG1hcHBpbmdzIiBhc3BlY3QsIGlmIG5v dAp0YWtlbiBpbnRvIGNvbnNpZGVyYXRpb24sIGNhbiBtYWtlIHlvdSB0aGluayB0aGUgc3lzdGVt IGlzIG1vcmUgc2VjdXJlIHRoYW4KaXQgYWN0dWFsbHkgaXMuCgo+Pj4KPj4+PiBUT0RPIExpc3QK Pj4+Pgo+Pj4+ICAgLSBDb3VsZCBpbml0aWFsIGJ1aWxkIG9mIFhlbiBoeXBlcnZpc29yIGluY2x1 ZGUgYSBidWlsdC1pbiAoaW5zaWRlIC5pbml0LmRhdGEpIHBvbGljeSBmaWxlPwo+Pj4gKEFib3Zl KS4KPj4+PiAgIC0gQ2FuIHdlIG1ha2UgcG9saWNpZXMgbW9kdWxhcml6ZWQ/IEEgY29yZSAocGVy aGFwcyBidWlsdC1pbj8pIHdpdGggYW1lbmRtZW50cyBsb2FkZWQgbGF0ZXI/Cj4+Pgo+Pj4gVGhl cmUgaXMgYWxyZWFkeSBzb21lIHN1cHBvcnQgZm9yIG1vZHVsZXMgaW4gdGhlIFhTTSBwb2xpY3k6 IHNlZQo+Pj4gdG9vbHMvZmxhc2svcG9saWN5L3BvbGljeS9tb2R1bGVzLmNvbmYuICBDdXJyZW50 bHkgdGhpcyBpcyBub3QgcmVhbGx5Cj4+PiB1c2VkOiBhbGwgcnVsZXMgYXJlIGluIHRoZSAieGVu IiBtb2R1bGUuICBIb3dldmVyLCBpdCBjb3VsZCBiZSBzcGxpdCB1cAo+Pj4gaW50byBhIHJlYWwg Y29yZSBtb2R1bGUgKHByb2JhYmx5IHN0aWxsIG5hbWVkICJ4ZW4iKSBhbmQgb3RoZXIgbW9kdWxl cwo+Pj4gdGhhdCB3b3VsZCBiZSBhdmFpbGFibGUgdG8gdHVybiBvbi9vZmYuCj4KPiBUaGF0IGlz IHF1aXQgYXBwZWFsaW5nLiBFc3BlY2lhbGx5IHdoZW4gaXQgY29tZXMgdG8gd29ya2luZyBvbgo+ IHNheSBkZXZpY2UgZHJpdmVyIGRvbWFpbnMgYW5kIGhhdmluZyB0aGUgJ2NvcmUnIFhlbiBvbmUg dGhlcmUgd2hpbGUKPiBJIGNhbiBmdXR6IGFyb3VuZCB3aXRoIGRldmljZSBkcml2ZXIgb25lLgoK SSB0cmllZCBtYWtpbmcgdGhpcyB3b3JrIGxhc3Qgd2VlaywgYW5kIEkgdGhpbmsgSSdsbCBwb3N0 IHdoYXQgSSBoYXZlIG5vdwppbnN0ZWFkIG9mIHdhaXRpbmcgdW50aWwgYWZ0ZXIgNC43IGhhcyBi ZWVuIGJyYW5jaGVkLgoKPj4+Cj4+PiBUaGUgcHJvY2VzcyBvZiBhc3NlbWJsaW5nIHRoZSBtb2R1 bGVzIGludG8gYSBzaW5nbGUgWFNNIHBvbGljeSBpcyBkb25lCj4+PiBpbiB1c2Vyc3BhY2UsIG5v dCB0aGUgaHlwZXJ2aXNvciwgc28gInhsIGxvYWRwb2xpY3kiIHdvdWxkIG5vdCBjaGFuZ2UuCj4K PiAvbWUgbm9kcwo+Cj4gVGhhbmsgeW91IQo+CgotLSAKRGFuaWVsIERlIEdyYWFmCk5hdGlvbmFs IFNlY3VyaXR5IEFnZW5jeQoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18KWGVuLWRldmVsIG1haWxpbmcgbGlzdApYZW4tZGV2ZWxAbGlzdHMueGVuLm9yZwpo dHRwOi8vbGlzdHMueGVuLm9yZy94ZW4tZGV2ZWwK