From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:58673) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SeoxW-0001nC-4I for qemu-devel@nongnu.org; Wed, 13 Jun 2012 10:54:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SeoxP-0007n1-J6 for qemu-devel@nongnu.org; Wed, 13 Jun 2012 10:54:09 -0400 Received: from mx1.redhat.com ([209.132.183.28]:18416) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SeoxP-0007mb-Az for qemu-devel@nongnu.org; Wed, 13 Jun 2012 10:54:03 -0400 Date: Wed, 13 Jun 2012 15:53:55 +0100 From: "Daniel P. Berrange" Message-ID: <20120613145355.GC29641@redhat.com> References: <1337619593-25823-1-git-send-email-berrange@redhat.com> <1337619593-25823-4-git-send-email-berrange@redhat.com> <20120530155037.4e5d46df@doriath.home> <20120608164856.GB4012@redhat.com> <20120611142205.68e86ddb@doriath.home> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20120611142205.68e86ddb@doriath.home> Subject: Re: [Qemu-devel] [PATCH v2 3/3] Add rate limiting of RTC_CHANGE, BALLOON_CHANGE & WATCHDOG events Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Luiz Capitulino Cc: Amit Shah , qemu-devel@nongnu.org, Anthony Liguori , Markus Armbruster On Mon, Jun 11, 2012 at 02:22:05PM -0300, Luiz Capitulino wrote: > On Fri, 8 Jun 2012 17:48:56 +0100 > "Daniel P. Berrange" wrote: > > > On Wed, May 30, 2012 at 03:50:37PM -0300, Luiz Capitulino wrote: > > > On Mon, 21 May 2012 17:59:53 +0100 > > > "Daniel P. Berrange" wrote: > > > > > > +/* Global, one-time initializer to configure the rate limiting > > > > + * and initialize state */ > > > > +static void monitor_protocol_event_init(void) > > > > +{ > > > > + qemu_mutex_init(&monitor_event_state_lock); > > > > + /* Limit RTC & BALLOON events to 1 per second */ > > > > + monitor_protocol_event_throttle(QEVENT_RTC_CHANGE, 1000); > > > > + monitor_protocol_event_throttle(QEVENT_BALLOON_CHANGE, 1000); > > > > + monitor_protocol_event_throttle(QEVENT_WATCHDOG, 1000); > > > > > > What about SUSPENDED and BLOCK_IO_ERROR? Couldn't the former be also > > > used by a malicious guest to cause a DoS? The former is already emitted > > > several times for virtio. > > > > This can't be used to filter BLOCK_IO_ERROR, since that event > > contains per-device state information. Filtering this would > > need to be done in the block layer, so it can done per device. > > That's right. > > > I don't think SUSPEND can be used to DoS, since once the VM > > is in the suspend state, a monitor command is required to wake > > it up again before the guest OS can trigger a new suspend. > > Can't the guest OS awake itself? I didn't think so. Even if it can, we can't rate limit SUSPEND events in isolation, because they must be strictly ordered wrt RESUME events. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|