From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jamie Lokier Subject: Re: [Qemu-devel] Re: [PATCH] whitelist host virtio networking features [was Re: qemu-kvm-0.11 regression, crashes on older ...] Date: Thu, 5 Nov 2009 05:06:25 +0000 Message-ID: <20091105050625.GD4879@shareable.org> References: <4AE9A90F.1060108@codemonkey.ws> <1256827719.10825.75.camel@blaa> <1256830455.25064.155.camel@x200> <1257172722.5075.7.camel@blaa> <4AEEFDCE.1000006@codemonkey.ws> <20091102155228.GB9655@shareable.org> <4AEF2B28.6000303@codemonkey.ws> <1257189955.3512.236.camel@x200> <4AEF461A.4020407@codemonkey.ws> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: kirkland@canonical.com, Mark McLoughlin , Scott Tsai , kvm , Rusty Russell , qemu-devel , jdstrand@canonical.com, Marc Deslauriers , kees.cook@canonical.com To: Anthony Liguori Return-path: Received: from mail2.shareable.org ([80.68.89.115]:41679 "EHLO mail2.shareable.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751362AbZKEFGZ (ORCPT ); Thu, 5 Nov 2009 00:06:25 -0500 Content-Disposition: inline In-Reply-To: <4AEF461A.4020407@codemonkey.ws> Sender: kvm-owner@vger.kernel.org List-ID: Anthony Liguori wrote: > Dustin Kirkland wrote: > >On Mon, 2009-11-02 at 12:55 -0600, Anthony Liguori wrote: > > > >>They can exit qemu via an ACPI shutdown. I don't see the difference. > >> > > > >An ACPI shutdown is triggered by an authenticated user inside of the > >guest. > > > >The present exit is triggered by any other anonymous user on the > >network, with the ability to send a lot of packets very quickly to the > >VM guest. The guest isn't able to handle this properly (and rightly > >that guest's kernel should be fixed). But I do see a difference. > > > > Well the problem is triggered by the guest kernel writing garbage to > virtio-net's backend. That's why we're suggesting it's really a guest > kernel issue. > > If the guest kernel writes something bad to qemu, we're may kill the > guest. That's not a qemu bug, it's the designed behavior. I'm ok with killing the guest, but think the right behaviour is whatever the user's configured to happen when the guest is killed, in the same way that ACPI shutdown does not shutdown if -no-shutdown is used, and you can debug a guest which does that. A guest writing garbage to virtio-net should not be able to use it to escape being debugged :-) How can a manager program determine if the exit is due to intentional shutdown or crashing guest? I'd be inclined to make those "exit() called from the device emulation" cases do whatever -watchdog-action says, if the watchdog is enabled. With a great big log message. -- Jamie From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1N5uYT-0006zF-Uz for qemu-devel@nongnu.org; Thu, 05 Nov 2009 00:06:41 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1N5uYP-0006yZ-F6 for qemu-devel@nongnu.org; Thu, 05 Nov 2009 00:06:41 -0500 Received: from [199.232.76.173] (port=58403 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1N5uYP-0006yW-CI for qemu-devel@nongnu.org; Thu, 05 Nov 2009 00:06:37 -0500 Received: from mail2.shareable.org ([80.68.89.115]:60468) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1N5uYO-0005JY-TW for qemu-devel@nongnu.org; Thu, 05 Nov 2009 00:06:37 -0500 Date: Thu, 5 Nov 2009 05:06:25 +0000 From: Jamie Lokier Subject: Re: [Qemu-devel] Re: [PATCH] whitelist host virtio networking features [was Re: qemu-kvm-0.11 regression, crashes on older ...] Message-ID: <20091105050625.GD4879@shareable.org> References: <4AE9A90F.1060108@codemonkey.ws> <1256827719.10825.75.camel@blaa> <1256830455.25064.155.camel@x200> <1257172722.5075.7.camel@blaa> <4AEEFDCE.1000006@codemonkey.ws> <20091102155228.GB9655@shareable.org> <4AEF2B28.6000303@codemonkey.ws> <1257189955.3512.236.camel@x200> <4AEF461A.4020407@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4AEF461A.4020407@codemonkey.ws> List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Mark McLoughlin , Scott Tsai , kvm , kirkland@canonical.com, Rusty Russell , qemu-devel , jdstrand@canonical.com, Marc Deslauriers , kees.cook@canonical.com Anthony Liguori wrote: > Dustin Kirkland wrote: > >On Mon, 2009-11-02 at 12:55 -0600, Anthony Liguori wrote: > > > >>They can exit qemu via an ACPI shutdown. I don't see the difference. > >> > > > >An ACPI shutdown is triggered by an authenticated user inside of the > >guest. > > > >The present exit is triggered by any other anonymous user on the > >network, with the ability to send a lot of packets very quickly to the > >VM guest. The guest isn't able to handle this properly (and rightly > >that guest's kernel should be fixed). But I do see a difference. > > > > Well the problem is triggered by the guest kernel writing garbage to > virtio-net's backend. That's why we're suggesting it's really a guest > kernel issue. > > If the guest kernel writes something bad to qemu, we're may kill the > guest. That's not a qemu bug, it's the designed behavior. I'm ok with killing the guest, but think the right behaviour is whatever the user's configured to happen when the guest is killed, in the same way that ACPI shutdown does not shutdown if -no-shutdown is used, and you can debug a guest which does that. A guest writing garbage to virtio-net should not be able to use it to escape being debugged :-) How can a manager program determine if the exit is due to intentional shutdown or crashing guest? I'd be inclined to make those "exit() called from the device emulation" cases do whatever -watchdog-action says, if the watchdog is enabled. With a great big log message. -- Jamie