From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: [PATCH 2/2] kvm: pr_guest: don't let guest invoke printk() on host Date: Tue, 24 Jul 2007 15:19:04 +0300 Message-ID: <46A5EE38.3060703@qumranet.com> References: <1185259677.1803.239.camel@localhost.localdomain> <1185260620.1803.245.camel@localhost.localdomain> <46A5D215.5030301@qumranet.com> <1185274114.1803.309.camel@localhost.localdomain> <46A5DC11.4070400@qumranet.com> <1185276567.1803.330.camel@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: kvm-devel To: Rusty Russell Return-path: In-Reply-To: <1185276567.1803.330.camel-bi+AKbBUZKY6gyzm1THtWbp2dZbC/Bob@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org Errors-To: kvm-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: kvm.vger.kernel.org Rusty Russell wrote: > On Tue, 2007-07-24 at 14:01 +0300, Avi Kivity wrote: > >> Rusty Russell wrote: >> >>> KVM *will* be used to run malicious guests. That's going to be hard to >>> lock down later, so I figure we should start now. >>> >> There's no reason to make this KERN_WARN. There's nothing wrong with >> the host, and there may not be anything wrong with the guest. These are >> only used to see if the guest did something unexpected, which may or may >> not be a problem (a kvm test suite would certainly trigger them). >> >> Perhaps we should make them conditional on a debug flag, or remove them >> completely. Most of them don't ever trigger, and i don't expect we can >> bring up a new guest solely using these printks. >> > > So should there be two routines? pr_unimpl() (KERN_ERR) and > pr_unexpected() (KERN_DEBUG) maybe. Both ratelimited, with nice > formatting to tell user which machine & cpu for reporting when there's a > problem... > > Turning them off is your call: have they proven useful? > Unimplemented has certainly proven useful, mostly with msrs (which we implement on demand). The unexpected ones are usually badly implemented (as you discovered with the set_cr4() bug), so if something goes wrong and they show up, that's a hint. However, that was useful during initial bringup, and these things don't happen anymore, so it's probably better to remove them than to introduce a new kernel subsystem after a 400-message thread on kvm-devel. They don't rhyme anyway. -- error compiling committee.c: too many arguments to function ------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/