From mboxrd@z Thu Jan 1 00:00:00 1970 From: Asdo Subject: Re: Doubt on KVM-88 vulnerabilities Date: Tue, 10 Nov 2009 12:10:34 +0100 Message-ID: <4AF94A2A.2020302@shiftmail.org> References: <20091108184240.GA29279@defiant.freesoftware> <4AF93AB8.3040504@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: kvm@vger.kernel.org To: Avi Kivity Return-path: Received: from blade4.isti.cnr.it ([194.119.192.20]:49262 "EHLO BLADE4.ISTI.CNR.IT" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755842AbZKJLKl (ORCPT ); Tue, 10 Nov 2009 06:10:41 -0500 Received: from conversionlocal.isti.cnr.it by mx.isti.cnr.it (PMDF V6.4 #31773) id <01NFXDSFX4Z48Y8KGY@mx.isti.cnr.it> for kvm@vger.kernel.org; Tue, 10 Nov 2009 12:10:29 +0100 In-reply-to: <4AF93AB8.3040504@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: Avi Kivity wrote: > I recommend to use distro-provided modules (or kernel.org kernels > within their support period) for production use. This ensures you get > security and stability fixes. kvm-89 will fix these issues, but as > it's a development snapshot, may introduce new issues. This is interesting. I prefer compiling from source especially for upgrading KVM on production systems, because then I do not need to upgrade the kernel (may introduce new stability issues on very new kernels) or the distro (may introduce LOTS of new changes and stability issues on production sytems). KVM is newer and evolves more rapidly than the kernel so it is more beneficial to upgrade KVM than the rest of the kernel or distro However for compiling from source I would need to know which versions of KVM are "stable" and which are not. I see the 89 you tell about, is not released yet: http://sourceforge.net/projects/kvm/files/ So did you mean that 89 is not "yet" for production use or will "never" be for production use? Are there versions number which are "stabilization" versions and others which are development, or they are all equal? You know it would be great if the KVM versions would be versioned like the kernels, so that we could have kvm version 86.1, 86.2, 86.3 which would apply only the bug fixes and not new stuff which might be risky (i.e. no speed optimizations) so one willing to upgrade a production system could choose a somewhat older version with a higher bugfix version number. In the past I chose the kvm-86 which had been just released (i.e. visible in http://sourceforge.net/projects/kvm/files/ ) but there was a bug on the CPU detection causing the message "This kernel requires an x86-64 CPU, but only detected an i686 CPU. \n Unable to boot - please use a kernel appropriate for your CPU.". I had to manually find and apply the patch http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commitdiff;h=8fa3b3ce6e . Luckily this bug was discussed somewhere so I could find the patch. Summing up, it would be great to have some maintained kvm versions... BTW I do not know what are kvm-kmod's or qemu-kvm's downloadable from http://sourceforge.net/projects/kvm/files/ : I always compile the "kvm" from source. Are those the solution to my problem? Where can I find info about the difference between the three? Thank you