From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rusty Russell Subject: Re: Secure KVM Date: Tue, 08 Nov 2011 09:26:30 +1030 Message-ID: <87pqh3sfs1.fsf@rustcorp.com.au> References: <1320612020.3299.22.camel@lappy> <4EB7A45D.1030600@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Andrea Arcangeli , Marcelo Tosatti , Ingo Molnar , Pekka Enberg , Cyrill Gorcunov , Asias He , Anthony Liguori , "Michael S. Tsirkin" , kvm To: Avi Kivity , Sasha Levin Return-path: Received: from ozlabs.org ([203.10.76.45]:56024 "EHLO ozlabs.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751896Ab1KHG0Q (ORCPT ); Tue, 8 Nov 2011 01:26:16 -0500 In-Reply-To: <4EB7A45D.1030600@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On Mon, 07 Nov 2011 11:26:53 +0200, Avi Kivity wrote: > One thing to beware of is memory hotplug. If the memory map is static, > then a fork() once everything is set up (with MAP_SHARED) alllows all > processes to access guest memory. However, if memory hotplug is > supported (or planned to be supported), then you can't do that, as > seccomp doesn't allow you to run mmap() in confined processes. > > This means they have to use RPC to the main process in order to access > memory, which is going to slow them down significantly. That would be very silly. As virtio devices are simple, you just ask the device process to save its state, then you kill it and start a new one. For initial implementation, you service each request in a loop so there's no state at all. A pipe is all you need. > > Since I'll be basing it on the KVM tool, which doesn't really emulate > > that many legacy devices, I'll focus first on the virtio family for the > > sake of simplicity (and covering 90% of the options). > > Since virtio is so performance sensitive, my feeling is that it is > better to audit it, and rely on sandboxing for the non performance > sensitive parts of the device model. Of course for a POC it's fine to > start with it. A separate thread per device (or even per virtqueue, as lguest does) will help parallelism. My very brief experiments with lguest showed that it made some things better, some things worse... Cheers, Rusty.