search

mirage / qubes-mirage-firewall

A Mirage firewall VM for QubesOS
208 stars 28 forks source link

Update to Mirage 4.5.0 #192

Closed palainp closed 4 months ago

palainp commented 4 months ago

Dear devs, This PR wants to update to recent mirage API. In doing so it appears that Memory.quick_stat() reports wrong values (I haven't investigated why yet, and maybe it was present before, but now it goes lower than the limits in memory_pressure.ml EDIT: There was a bad computation in ocaml-solo5 again):

Memory.quick_stat() INF [memory_pressure] Writing meminfo: free 11MiB / 27MiB (39.99 %)
Memory.stat() INF [memory_pressure] Writing meminfo: free 19MiB / 27MiB (70.31 %)

With wrong values, the firewall starts to drop packets (Memory_critical being returned by Memory_pressure.status()). So I've replaced Memory.quick_stat() with Memory.stat(), but this is at the cost of going through the whole heap and Memory_pressure.status calls it for each packets. But I'd rather the firewall be slower than unusable :)

Going further will need to dive more into ocaml-solo5/nolibc/malloc.i as the bug seems to come from there but the code is really hard :'( Best,

palainp commented 4 months ago

With https://github.com/mirage/ocaml-solo5/pull/135 using quick_stat() is ok now so I removed the last modifications to have it back :) EDIT: I'll force push the new Dockerfile and hashsum when ocaml-solo5 will be released.

palainp commented 4 months ago

Will be included in #178 .

palainp commented 4 months ago

Sorry I closed while you are reviewing it, I'll add your changes in #178.

hannesm commented 4 months ago

@palainp thanks. no worries. :)