From mboxrd@z Thu Jan 1 00:00:00 1970 From: Avi Kivity Subject: Re: Secure KVM Date: Mon, 07 Nov 2011 20:43:45 +0200 Message-ID: <4EB826E1.8010106@redhat.com> References: <1320612020.3299.22.camel@lappy> <4EB7A45D.1030600@redhat.com> <4EB817D2.5010200@codemonkey.ws> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Sasha Levin , Andrea Arcangeli , Marcelo Tosatti , Ingo Molnar , Pekka Enberg , Cyrill Gorcunov , Asias He , Rusty Russell , "Michael S. Tsirkin" , kvm To: Anthony Liguori Return-path: Received: from mx1.redhat.com ([209.132.183.28]:1028 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751283Ab1KGSoC (ORCPT ); Mon, 7 Nov 2011 13:44:02 -0500 In-Reply-To: <4EB817D2.5010200@codemonkey.ws> Sender: kvm-owner@vger.kernel.org List-ID: On 11/07/2011 07:39 PM, Anthony Liguori wrote: >> One thing to beware of is memory hotplug. If the memory map is static, >> then a fork() once everything is set up (with MAP_SHARED) alllows all >> processes to access guest memory. However, if memory hotplug is >> supported (or planned to be supported), then you can't do that, as >> seccomp doesn't allow you to run mmap() in confined processes. >> >> This means they have to use RPC to the main process in order to access >> memory, which is going to slow them down significantly. > > > If you treat the sandbox as ephemeral by leveraging save/restore, you > can throw away and rebuild the device model on every memory change. > While not a super cheap operation, it's at least amortized over time. Good idea! We lost the context of all threads, but that also happens on live migration. I'm sure this is workable. Plus we get save/restore testing for free. Did someone say win/win? -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain.