On 11/07/2011 07:39 PM, Anthony Liguori wrote: >> One thing to beware of is memory hotplug. If the memory map is static, >> then a fork() once everything is set up (with MAP_SHARED) alllows all >> processes to access guest memory. However, if memory hotplug is >> supported (or planned to be supported), then you can't do that, as >> seccomp doesn't allow you to run mmap() in confined processes. >> >> This means they have to use RPC to the main process in order to access >> memory, which is going to slow them down significantly. > > > If you treat the sandbox as ephemeral by leveraging save/restore, you > can throw away and rebuild the device model on every memory change. > While not a super cheap operation, it's at least amortized over time. Good idea! We lost the context of all threads, but that also happens on live migration. I'm sure this is workable. Plus we get save/restore testing for free. Did someone say win/win? -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
