From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:47067) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RZg66-00063y-IK for qemu-devel@nongnu.org; Sun, 11 Dec 2011 04:53:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RZg65-00037D-FB for qemu-devel@nongnu.org; Sun, 11 Dec 2011 04:53:30 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58152) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RZg65-00035o-4h for qemu-devel@nongnu.org; Sun, 11 Dec 2011 04:53:29 -0500 Message-ID: <4EE47302.4030000@redhat.com> Date: Sun, 11 Dec 2011 11:08:18 +0200 From: Avi Kivity MIME-Version: 1.0 References: <4EDFAF91.4070904@linux.vnet.ibm.com> <201112091617.50928.paul@codesourcery.com> In-Reply-To: <201112091617.50928.paul@codesourcery.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [RFC] Device sandboxing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Brook Cc: Ashley D Lai , Anthony Liguori , Stefan Hajnoczi , Corey Bryant , Michael Halcrow , qemu-devel@nongnu.org, Eric Paris , Paul Moore , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Richa Marwaha , Amit Shah , Eduardo Terrell Ferrari Otubo , Lee Terrell , George Wilson On 12/09/2011 06:17 PM, Paul Brook wrote: > > A group of us are starting to work on sandboxing QEMU device emulation > > code. We're just getting started investigating various approaches, and > > want to engage the community to gather input. > > > > Following are the design points that we are currently considering: > > > > * Decompose QEMU into multiple processes: > > > > * This could be done such that QEMU devices execute in separate > > processes based on device type, e.g. all block devices in one > > process and all network devices in a second process. Another > > alternative is executing a separate process per device. > > I can't help wondering if nested virtualization would be a better solution. > i.e. have an outer VM that only implements a trusted subset of devices. Inside > that run a VM that provides the flakey legacy device emulation you expect to > be compromised. Nested virtualization is going to be painfully slow. We did consider side-by-side virtualization: both the guest and the device model run in separate VM containers (this is what Xen does, except it uses paravirtualization for the device model). It's going to be more expensive that the other forms of sandboxing, though, due to the heavier context switch penalty. -- error compiling committee.c: too many arguments to function