KVM support (process isolation - security)

[ZLangJIT]

does rvvm support KVM inside guests ?

from boot to initramfs # shell

assuming a single bare boot rvvm instance uses ~100 MB of memory

attempting to run each process in its own fully isolated rvvm instance (so 1 process cannot interfere with another even if it attempts to modify the kernel) would consume 100 MB for each additional process, extremely ineffiecent

assuming we want to run 10 isolated processes, this would consume ~1 GB of memory, which may lead to OOM on memory critical devices such as Android or embedded systems or low RAM systems

utilising a guest KVM to isolate processes inside a per-process kvm virtualized kernel inside a single rvvm processes could yield drastically improved memory savings per additional process isolated

specifically this would be an attempt to safeguard against kernel attacks from malicios processes ran inside the VM along side trusted processes

such a malicious program may attempt something such as this

https://www.wiz.io/blog/linux-rootkits-explained-part-1-dynamic-linker-hijacking

or

https://www.wiz.io/blog/linux-rootkits-explained-part-2-loadable-kernel-modules

[LekKit]

Using KVM will not help with memory consumption it is primarily a CPU acceleration primitive. No there is no recursive virtualization (KVM in guests) yet. You might have confused KVM with KSM, which are separate concepts.

RVVM already supports KSM (same-page memory merging) instead (requires running atop a Linux kernel host). It drastically reduces memory use by scanning identical pages and merging them as Copy-on-Write.

Note that KSM might need some assistance like kernel-side configuration (sysctl) which may be unavailable on non-rooted Android devices. But otherwise it has proven itself to be very useful and i was able to run 1000 identical Debian VMs (sic!) on a 16G RAM host.

[LekKit]

Also about those 100M of RAM used after boot: Those are mostly guest memory, RVVM doesn't have a lot of overhead itself (JIT uses maximum of 16M cache by default, and even that maximum is usually not reached and may be flushed under low memory condition).

[LekKit]

Also see https://github.com/LekKit/RVVM/issues/145#issuecomment-2367357951

[ZLangJIT]

Also about those 100M of RAM used after boot: Those are mostly guest memory, RVVM doesn't have a lot of overhead itself (JIT uses maximum of 16M cache by default, and even that maximum is usually not reached and may be flushed under low memory condition).

so for example, inside RVVM running a unix kernel, currently consuming 100 MB, if we launch a second rvvm process (with the same kernel) inside that kernel, would KMS save probably 90% of additional memory usage, eg instead of using 200 MB total it would use ~116 MB total ?

assuming a unix/windows host