From mboxrd@z Thu Jan  1 00:00:00 1970
From: Keir Fraser <keir.xen@gmail.com>
Subject: Re: [PATCH] x86-64: refine the XSA-9 fix
Date: Fri, 17 Aug 2012 17:41:56 +0100
Message-ID: <CC5432E4.3C46E%keir.xen@gmail.com>
References: <502E8D600200007800096034@nat28.tlf.novell.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <502E8D600200007800096034@nat28.tlf.novell.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Jan Beulich <JBeulich@suse.com>
Cc: Olaf Hering <olaf@aepfle.de>, Keir Fraser <keir@xen.org>, xen-devel <xen-devel@lists.xen.org>
List-Id: xen-devel@lists.xenproject.org

On 17/08/2012 17:28, "Jan Beulich" <JBeulich@suse.com> wrote:

>>>> On 17.08.12 at 17:56, Olaf Hering <olaf@aepfle.de> wrote:
>> On Fri, Aug 17, Keir Fraser wrote:
>> 
>>> On 17/08/2012 16:11, "Olaf Hering" <olaf@aepfle.de> wrote:
>>> 
>>>> On Mon, Jun 18, Keir Fraser wrote:
>>>> 
>>>>> On 13/06/2012 11:04, "Jan Beulich" <JBeulich@suse.com> wrote:
>>>>> 
>>>>>> Our product management wasn't happy with the "solution" for XSA-9, and
>>>>>> demanded that customer systems must continue to boot. Rather than
>>>>>> having our and perhaps other distros carry non-trivial patches, allow
>>>>>> for more fine grained control (panic on boot, deny guest creation, or
>>>>>> merely warn) by means of a single line change.
>>>>> 
>>>>> All this seems to allow is to boot but not create domU-s. Which seems a
>>>>> bit
>>>>> pointless.
>>>> 
>>>> Refusing to boot into dom0 with no good reason is a good way to lose
>>>> remote control of a system without serial console. Not funny.
>>>> 
>>>> Fortunately I booted and tested with sles11 Xen first before ruining the
>>>> box with plain xen-unstable.
>>>> 
>>>> So, please apply this patch and remove the panic() from
>>>> ./xen/arch/x86/cpu/amd.c
>>> 
>>> Okay, that's a good argument for that patch.
>> 
>> Oh, now that the context was posted again:
>> With the patch the box would still panic per default. Leaving it zero to
>> refuse guest creation looks like a sensible default.
> 
> Keir, should I change the default then before committing?

Yes please.

 -- Keir

> Jan
>