Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering

Ingo Molnar
2011-05-26T11:12:06Z

* Gleb Natapov <gleb@redhat.com> wrote:

> > In that model each process has its own stack, not accessible to
> > other worker processes. They'd only share the guest RAM image and
> > some (minimal) global state.
> >
> > This way the individual devices are (optionally) isolated from
> > each other. In a way this is a microkernel done right ;-)
>
> But doesn't this design suffer the same problem as microkernel?
> Namely a lot of slow IPCs?

Most of the IPCs we do already, to keep the devices separated from
each other. So the most common type of IPC comes 'for free' in that
model - and this is specific to virtualization so i'd not extend the
claim to the host kernel.

virtio is an IPC mechanism to begin with.

It's certainly not entirely free though so if this is implemented in
tools/kvm/ it should be configurable.

Thanks,

Ingo