From: Stefan Hajnoczi <stefanha@gmail.com>
To: Alexander Binun <binun@cs.bgu.ac.il>
Cc: kahilm@post.bgu.ac.il, boaz.menuhin@gmail.com,
markbl@post.bgu.ac.il, qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] kill /destroy a VM - help
Date: Thu, 6 Mar 2014 11:22:45 +0100 [thread overview]
Message-ID: <20140306102245.GE23172@stefanha-thinkpad.redhat.com> (raw)
In-Reply-To: <201403051635.s25GZIiH002403@indigo.cs.bgu.ac.il>
On Wed, Mar 05, 2014 at 06:35:18PM +0200, Alexander Binun wrote:
> Now we encountered yet one problem: Our security module (which is a LKM) performs security check and, when suspecting malicious activity at a VCPU, must suspend or even kill this VM. The problem is: how to suspend/kill a VCPU ?
>
> We have taken the following approach:
> 1. Accessing the VM list (struct list_head vms_list ) through the kallsyms interface
> 2. Iterating through VMs, reaching every VCPU (as a structure struct kvm_vcpu *vcpu)
> 3. Running security check on every such structure. That is we were seeking for a function like cpu_reset(struct kvm_vcpu*vcpu)
>
> The following "reset funtions" were so far tried (taken from kvm_host.h)
> 1. kvm_vcpu_uninit and kvm_x86_ops->vcpu_free. These cause the whole system (both host and guest OSs) hang.
> 2. kvm_vcpu_reset and kvm_arch_vcpu_free lead to the linker error "Warning! Function undefined".
>
> Which "reset function" could you recommend ?
The simplest thing to kill a VM is to send SIGTERM to the QEMU process
(the process that contains the vcpu thread).
Stefan
next prev parent reply other threads:[~2014-03-06 10:23 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-07 14:47 [Qemu-devel] sniffing traffic between VMs Alexander Binun
2013-10-10 9:02 ` Stefan Hajnoczi
2013-10-10 11:00 ` [Qemu-devel] kvm binary is deprecated Alexander Binun
2013-10-11 9:05 ` Stefan Hajnoczi
2013-10-12 14:45 ` Alexander Binun
2013-10-14 9:12 ` Stefan Hajnoczi
2013-10-14 10:36 ` Alexander Binun
2013-10-14 14:16 ` Stefan Hajnoczi
2013-10-24 9:23 ` [Qemu-devel] kvm binary is deprecated - solved! Alexander Binun
2013-10-24 9:49 ` Stefan Hajnoczi
2013-10-24 9:54 ` [Qemu-devel] observing VM actions Alexander Binun
2013-12-18 11:53 ` [Qemu-devel] sniffing traffic between virtual machines Alexander Binun
2013-12-19 9:05 ` Stefan Hajnoczi
2014-03-05 16:35 ` [Qemu-devel] kill /destroy a VM - help Alexander Binun
2014-03-06 10:22 ` Stefan Hajnoczi [this message]
2014-03-06 10:31 ` Alexander Binun
2014-03-06 11:28 ` Paolo Bonzini
2014-03-06 15:54 ` [Qemu-devel] kill /destroy a VM - still hangs! Alexander Binun
2014-03-09 15:40 ` [Qemu-devel] trying to kill a VM Alexander Binun
2014-03-13 12:59 ` [Qemu-devel] different IDTs of the same VCPU Alexander Binun
2014-03-13 15:15 ` Paolo Bonzini
2014-03-17 11:54 ` Alexander Binun
2014-03-17 12:20 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140306102245.GE23172@stefanha-thinkpad.redhat.com \
--to=stefanha@gmail.com \
--cc=binun@cs.bgu.ac.il \
--cc=boaz.menuhin@gmail.com \
--cc=kahilm@post.bgu.ac.il \
--cc=markbl@post.bgu.ac.il \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).