Re: [PATCH] x86-64: refine the XSA-9 fix

[Olaf Hering <olaf@aepfle.de>]

On Fri, Aug 17, Keir Fraser wrote:

> On 17/08/2012 16:11, "Olaf Hering" <olaf@aepfle.de> wrote:
> 
> > On Mon, Jun 18, Keir Fraser wrote:
> > 
> >> On 13/06/2012 11:04, "Jan Beulich" <JBeulich@suse.com> wrote:
> >> 
> >>> Our product management wasn't happy with the "solution" for XSA-9, and
> >>> demanded that customer systems must continue to boot. Rather than
> >>> having our and perhaps other distros carry non-trivial patches, allow
> >>> for more fine grained control (panic on boot, deny guest creation, or
> >>> merely warn) by means of a single line change.
> >> 
> >> All this seems to allow is to boot but not create domU-s. Which seems a bit
> >> pointless.
> > 
> > Refusing to boot into dom0 with no good reason is a good way to lose
> > remote control of a system without serial console. Not funny.
> > 
> > Fortunately I booted and tested with sles11 Xen first before ruining the
> > box with plain xen-unstable.
> > 
> > So, please apply this patch and remove the panic() from
> > ./xen/arch/x86/cpu/amd.c
> 
> Okay, that's a good argument for that patch.

Oh, now that the context was posted again:
With the patch the box would still panic per default. Leaving it zero to
refuse guest creation looks like a sensible default.

Olaf