Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-03 Thread Daniel P . Berrangé
On Tue, Mar 02, 2021 at 04:01:17PM -0500, Daniele Buono wrote: > On 3/2/2021 11:40 AM, Daniel P. Berrangé wrote: > > The CFI protection is something I'd say is relevant to virtualization > > use cases, not to emulation use cases > > > > https://qemu-project.gitlab.io/qemu/system/security.html

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-02 Thread Daniele Buono
On 3/2/2021 11:40 AM, Daniel P. Berrangé wrote: The CFI protection is something I'd say is relevant to virtualization use cases, not to emulation use cases https://qemu-project.gitlab.io/qemu/system/security.html IOW, the targets that are important to test are the ones where KVM is availabl

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-02 Thread Daniel P . Berrangé
On Tue, Mar 02, 2021 at 11:31:54AM -0500, Daniele Buono wrote: > > On 3/2/2021 10:38 AM, Daniel P. Berrangé wrote: > > Is this scenario going to upset CFI, or is it happy that 'void *' > > is compatible with 'mytype *', and ok with the intermediate casts > > to/from GCallback ? > > This is a val

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-02 Thread Daniele Buono
On 3/2/2021 10:38 AM, Daniel P. Berrangé wrote: Is this scenario going to upset CFI, or is it happy that 'void *' is compatible with 'mytype *', and ok with the intermediate casts to/from GCallback ? This is a valid scenario. LLVM does offer the ability of considering all pointer types comp

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-02 Thread Daniel P . Berrangé
On Tue, Mar 02, 2021 at 08:18:03AM -0500, Daniele Buono wrote: > On 3/2/2021 5:30 AM, Daniel P. Berrangé wrote: > > On Mon, Mar 01, 2021 at 03:39:42PM -0500, Daniele Buono wrote: > > > Hi Daniel, > > > > > > On 3/1/2021 10:08 AM, Daniel P. Berrangé wrote: > > > > What are the unique failure scenar

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-02 Thread Daniele Buono
On 3/2/2021 5:30 AM, Daniel P. Berrangé wrote: On Mon, Mar 01, 2021 at 03:39:42PM -0500, Daniele Buono wrote: Hi Daniel, On 3/1/2021 10:08 AM, Daniel P. Berrangé wrote: What are the unique failure scenarios for CFI that these jobs are likely to expose ? Is it likely that we'll have cases where

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-02 Thread Daniel P . Berrangé
On Mon, Mar 01, 2021 at 03:39:42PM -0500, Daniele Buono wrote: > Hi Daniel, > > On 3/1/2021 10:08 AM, Daniel P. Berrangé wrote: > > What are the unique failure scenarios for CFI that these jobs are > > likely to expose ? Is it likely that we'll have cases where > > CFI succeeds in say, x86_64 targ

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-01 Thread Daniele Buono
Hi Daniel, On 3/1/2021 10:08 AM, Daniel P. Berrangé wrote: What are the unique failure scenarios for CFI that these jobs are likely to expose ? Is it likely that we'll have cases where CFI succeeds in say, x86_64 target, but fails in aarch64 target ? For CFI to fail (even if it shouldn't) you'

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-01 Thread Daniel P . Berrangé
On Mon, Mar 01, 2021 at 09:59:22AM -0500, Daniele Buono wrote: > Hi Daniel, > > On 3/1/2021 5:06 AM, Daniel P. Berrangé wrote: > > On Fri, Feb 26, 2021 at 10:21:06AM -0500, Daniele Buono wrote: > > > Build jobs are on the longer side (about 2h and 20m), but I thought it > > > would be better to ju

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-01 Thread Daniele Buono
Hi Daniel, On 3/1/2021 5:06 AM, Daniel P. Berrangé wrote: On Fri, Feb 26, 2021 at 10:21:06AM -0500, Daniele Buono wrote: Build jobs are on the longer side (about 2h and 20m), but I thought it would be better to just have 6 large jobs than tens of smaller ones. IMHO that is a not viable. Our

Re: [PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-03-01 Thread Daniel P . Berrangé
On Fri, Feb 26, 2021 at 10:21:06AM -0500, Daniele Buono wrote: > Build jobs are on the longer side (about 2h and 20m), but I thought it > would be better to just have 6 large jobs than tens of smaller ones. IMHO that is a not viable. Our longest job today is approx 60 minutes, and that is already

[PATCH v2 0/2] gitlab-ci.yml: Add jobs to test CFI

2021-02-26 Thread Daniele Buono
For a few months now QEMU has had options to enable compiler-based control-flow integrity if built with clang. While this feature has a low maintenance, It's probably still better to add tests to the CI environment to check that an update doesn't break it. The patchset allow gitlab testing of: *