From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([140.186.70.92]:34230)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Paul_Brook@mentor.com>) id 1RZ395-0003fO-PG
	for qemu-devel@nongnu.org; Fri, 09 Dec 2011 11:18:03 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <Paul_Brook@mentor.com>) id 1RZ394-0003Yq-Qd
	for qemu-devel@nongnu.org; Fri, 09 Dec 2011 11:17:59 -0500
Received: from relay1.mentorg.com ([192.94.38.131]:40417)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <Paul_Brook@mentor.com>) id 1RZ394-0003Yl-JF
	for qemu-devel@nongnu.org; Fri, 09 Dec 2011 11:17:58 -0500
From: Paul Brook <paul@codesourcery.com>
Date: Fri, 9 Dec 2011 16:17:50 +0000
References: <4EDFAF91.4070904@linux.vnet.ibm.com>
In-Reply-To: <4EDFAF91.4070904@linux.vnet.ibm.com>
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="utf-8"
Content-Transfer-Encoding: 7bit
Message-Id: <201112091617.50928.paul@codesourcery.com>
Subject: Re: [Qemu-devel] [RFC] Device sandboxing
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: Ashley D Lai <adlai@us.ibm.com>, Anthony Liguori <aliguori@us.ibm.com>, Stefan Hajnoczi <stefanha@gmail.com>, Corey Bryant <coreyb@linux.vnet.ibm.com>, Michael Halcrow <mhalcrow@google.com>, Eric Paris <eparis@redhat.com>, Paul Moore <pmoore@redhat.com>, Radim =?utf-8?q?Kr=C4=8Dm=C3=A1=C5=99?= <radimkrcmar@hpx.cz>, Avi Kivity <avi@redhat.com>, Richa Marwaha <rmarwah@us.ibm.com>, Amit Shah <amit.shah@redhat.com>, Eduardo Terrell Ferrari Otubo <eotubo@br.ibm.com>, Lee Terrell <lterrell@us.ibm.com>, George Wilson <gcwilson@us.ibm.com>

> A group of us are starting to work on sandboxing QEMU device emulation
> code.  We're just getting started investigating various approaches, and
> want to engage the community to gather input.
> 
> Following are the design points that we are currently considering:
> 
> * Decompose QEMU into multiple processes:
> 
>      * This could be done such that QEMU devices execute in separate
>        processes based on device type, e.g. all block devices in one
>        process and all network devices in a second process.  Another
>        alternative is executing a separate process per device.

I can't help wondering if nested virtualization would be a better solution.  
i.e. have an outer VM that only implements a trusted subset of devices. Inside 
that run a VM that provides the flakey legacy device emulation you expect to 
be compromised.

Paul