Re: Doubt on KVM-88 vulnerabilities

[Daniel Bareiro <daniel-listas@gmx.net>]

[-- Attachment #1: Type: text/plain, Size: 2208 bytes --]

On Monday, 14 December 2009 08:08:32 -0300,
Daniel Bareiro wrote:

> > I recommend to use distro-provided modules (or kernel.org kernels
> > within  their support period) for production use. This ensures you
> > get security  and stability fixes.  kvm-89 will fix these issues,
> > but as it's a  development snapshot, may introduce new issues.

> Minutes ago I've downloaded of kernel.org the source code of Linux
> 2.6.32 because I wanted to test with KSM, that it seems to me a very
> interesting aggregate. As you said above, surely the modules of 2.6.32
> are going to be newer than the compiled ones with KVM-88 with security
> fixes like the one of the DSA-1907-1.
> 
> Then, I imagine that only it would be necessary to compile the
> userspace. The steps that I habitually followed are the mentioned ones
> in the section 'Unpacking and configuring kvm components' of this [1]
> document, but I suppose that to only compile userspace it will be
> necessary to follow a different procedure. Is there some document that
> you can indicate to me where are mentioned these steps?

According to I found looking for in Internet, qemu-kvm does not include
the kernel modules but only the userspace and it is considered to be
stable. I've downloaded qemu-kvm-0.11.0 and I build it with 'make' and
'make install' like did with kvm-nn but it seems that KSM is not
working:

root@ubuntu:~# uname -a
Linux ubuntu 2.6.32-dgb #1 SMP Mon Dec 14 06:18:06 ART 2009 x86_64 GNU/Linux

root@ubuntu:~# cat /sys/kernel/mm/ksm/max_kernel_pages
253738

root@ubuntu:~# cat /sys/kernel/mm/ksm/run
1

root@ubuntu:~# cat /sys/kernel/mm/ksm/pages_sharing
0

root@ubuntu:~# cat /sys/kernel/mm/ksm/pages_shared
0

Is it possible that there is to apply a patch on some of the files of
qemu-kvm-0.11.0? At least a fast search in the files does not show some
definition of MADV_MERGEABLE.

Also I have understood that it must exist support of KSM on glibc. I'm
using ubuntu Hardy Heron. Is it possible that this support is not
enabled?

Regards,
Daniel
-- 
Fingerprint: BFB3 08D6 B4D1 31B2 72B9  29CE 6696 BF1B 14E6 1D37
Powered by Debian GNU/Linux Squeeze - Linux user #188.598

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 197 bytes --]