From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36229) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z0BYS-0001nT-IE for qemu-devel@nongnu.org; Wed, 03 Jun 2015 12:30:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Z0BYM-0001LJ-S6 for qemu-devel@nongnu.org; Wed, 03 Jun 2015 12:30:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39571) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Z0BYM-0001Jt-NG for qemu-devel@nongnu.org; Wed, 03 Jun 2015 12:30:06 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id F3C62B6F45 for ; Wed, 3 Jun 2015 16:30:05 +0000 (UTC) Date: Wed, 3 Jun 2015 18:30:02 +0200 From: "Michael S. Tsirkin" Message-ID: <20150603182649-mutt-send-email-mst@redhat.com> References: <1433334157-37665-1-git-send-email-imammedo@redhat.com> <1433334157-37665-3-git-send-email-imammedo@redhat.com> <556EF7AE.8040609@redhat.com> <20150603160526.7727e4e4@nial.brq.redhat.com> <556F1850.7090903@redhat.com> <20150603172347.481107ae@nial.brq.redhat.com> <556F2731.8010801@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <556F2731.8010801@redhat.com> Subject: Re: [Qemu-devel] [RFC 2/2] pc: fix QEMU crashing when more than ~50 memory hotplugged List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: Igor Mammedov , qemu-devel@nongnu.org On Wed, Jun 03, 2015 at 06:11:29PM +0200, Paolo Bonzini wrote: > > > On 03/06/2015 17:23, Igor Mammedov wrote: > >> > Understood now. This still should be a separate patch. I'm much more > >> > confident with the other two (e.g. what happens if a malicious guest > >> > writes to memory that is still MAP_NORESERVE), > > it should get SIGSEVG due to access to PROT_NONE. > > QEMU doesn't get the SEGV if you do address_space_rw or > address_space_map to unallocated space, because the empty area in the > container is treated as MMIO. > > But what does vhost do if you tell it to treat the whole block as a > single huge lump? > > Paolo Guest can make vhost attempt reading or writing it. vhost will do copy from/to user. > >> > so feel free to post > >> > those without RFC tag. But the vhost one really needs mst's eyes. > > ok, I'll split it out. > >