From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 5F5D050C1; Sat, 06 Dec 2025 17:56:44 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id AD7FB50B5; Sat, 06 Dec 2025 17:56:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_MISSING,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from fout-a6-smtp.messagingengine.com (fout-a6-smtp.messagingengine.com [103.168.172.149]) by atuin.qyliss.net (Postfix) with ESMTPS id D85DE50B3 for ; Sat, 06 Dec 2025 17:56:41 +0000 (UTC) Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfout.phl.internal (Postfix) with ESMTP id DA060EC0403; Sat, 6 Dec 2025 12:56:39 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Sat, 06 Dec 2025 12:56:39 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alyssa.is; h=cc :cc:content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1765043799; x=1765130199; bh=gTyLlgSCol Dl4QqTAjjn1twiwz7fTi4KKXW73nXWB2o=; b=PB7od2YQYp2Yl40P/+xTV6a/rf o//kK5DnGJaHtlxJ24CQgNn72JRcPEqGWCQQcewBANO1sZhKbW66IgLBGKDh1lti MItdo1mdHiXFLLuyho/Il6iO/sui+LaisfOyXuWs2qQ7QQC/V9Fytlqhb11XZ3T9 hn1R+8LvCS4b0ghZIstrsxzC+qS014KAJnok4rSdvoJsII8nzQ0OdFmNp3yhQJ5J jlitksWwcMH+5QCRKPbcTu3sHjcHBi9rJpvYozgQNU3YW7ErDYmOonKWklmDmIig H94leU9+pqHmzCtabNdTAtgs3ex2iW29C5jYCNYlsZpo/sGjHIcspG/6filQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-type:content-type:date:date :feedback-id:feedback-id:from:from:in-reply-to:in-reply-to :message-id:mime-version:references:reply-to:subject:subject:to :to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; t= 1765043799; x=1765130199; bh=gTyLlgSColDl4QqTAjjn1twiwz7fTi4KKXW 73nXWB2o=; b=Nl5mhZB6/Q/zwpmn5IRref7UChygub5I9ehTvCEhUNRHzM7hoqW NCthEm9jkwUStHO77v26h7DJag6ptSBcbMf4uRZXJjDHAF7WDCHpzQKn/8d6kgyr RbJkid9dHivl1mfB7b+vzwWWdsNFCFYuee5LepkZK7gIeT3aloW9EwQrp1JgV1tx tpCC/moTVK5/uQGnVErHgg/4LRQttpEmLnJ8UmbRL/MvekxCFAyRbcXwyXYIaHmu voWZUrU+qp929alpaoYZ2aLKQqf8G1UO6dklc46PKc6Hin5MzxDPgrmrPFnCufW+ jtSG6Ev+7t4ZgLrI+/0wYRPlPEtuHIFj+UA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefgedrtddtgdduudeitdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpuffrtefokffrpgfnqfghnecuuegr ihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjug hrpefhvfevufgjfhffkfggtgesghdtreertddttdenucfhrhhomheptehlhihsshgrucft ohhsshcuoehhihesrghlhihsshgrrdhisheqnecuggftrfgrthhtvghrnhepieduffeuie elgfetgfdttddtkeekheekgfehkedufeevteegfeeiffetvdetueevnecuvehluhhsthgv rhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhephhhisegrlhihshhsrgdrih hspdhnsggprhgtphhtthhopedvpdhmohguvgepshhmthhpohhuthdprhgtphhtthhopegu vghmihhosggvnhhouhhrsehgmhgrihhlrdgtohhmpdhrtghpthhtohepuggvvhgvlhessh hpvggtthhruhhmqdhoshdrohhrgh X-ME-Proxy: Feedback-ID: i12284293:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 6 Dec 2025 12:56:39 -0500 (EST) Received: by fw12.qyliss.net (Postfix, from userid 1000) id C227749A67CE; Sat, 06 Dec 2025 18:56:27 +0100 (CET) From: Alyssa Ross To: Demi Marie Obenour Subject: Re: [PATCH v4 4/6] host/rootfs: Sandbox Cloud Hypervisor In-Reply-To: <0c98ad55-9e7b-4fbe-8e3b-4050037e1e35@gmail.com> References: <20251203-sandbox-v4-0-71542a7dcf5c@gmail.com> <20251203-sandbox-v4-4-71542a7dcf5c@gmail.com> <87pl8u9uxy.fsf@alyssa.is> <87ms3vjyfm.fsf@alyssa.is> <0c98ad55-9e7b-4fbe-8e3b-4050037e1e35@gmail.com> Date: Sat, 06 Dec 2025 18:56:26 +0100 Message-ID: <87h5u3jxyt.fsf@alyssa.is> MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha512; protocol="application/pgp-signature" Message-ID-Hash: HFIP4YRWZ5J7VYZBG7TSR7PUHU3RO23J X-Message-ID-Hash: HFIP4YRWZ5J7VYZBG7TSR7PUHU3RO23J X-MailFrom: hi@alyssa.is X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Spectrum OS Development X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Demi Marie Obenour writes: > On 12/6/25 12:46, Alyssa Ross wrote: >> Demi Marie Obenour writes: >>=20 >>> On 12/4/25 09:35, Alyssa Ross wrote: >>>> Demi Marie Obenour writes: >>>> >>>>> It only needs access to a small number of resources. Unfortunately, = it >>>>> needs access to /dev/vfio right now. This should be fixed by using f= ile >>>>> descriptor passing instead. >>>>> >>>>> Furthermore, Cloud Hypervisor needs to be able to lock memory. Runni= ng >>>>> in a user namespace prevents it from having CAP_IPC_LOCK. Therefore,= it >>>>> is necessary to increase RLIMIT_MLOCK before running Cloud Hypervisor. >>>>> >>>>> Signed-off-by: Demi Marie Obenour >>>>> --- >>>>> .../image/etc/udev/rules.d/99-spectrum.rules | 3 ++ >>>>> host/rootfs/image/usr/bin/run-vmm | 33 ++++++++++++= +++++++++- >>>>> 2 files changed, 35 insertions(+), 1 deletion(-) >>>>> >>>>> diff --git a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules b/h= ost/rootfs/image/etc/udev/rules.d/99-spectrum.rules >>>>> index 337bbe47dbbc6f3828722d8244f2689a39f3090f..de0f682aa40f8481dc3c2= 5a90c695e2326536316 100644 >>>>> --- a/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules >>>>> +++ b/host/rootfs/image/etc/udev/rules.d/99-spectrum.rules >>>>> @@ -3,3 +3,6 @@ >>>>>=20=20 >>>>> # systemd-udevd unsets PATH, so fix that. >>>>> ACTION!=3D"remove", ENV{PCI_CLASS}=3D=3D"2????", RUN+=3D"/usr/bin/en= v PATH=3D/usr/bin /usr/libexec/net-add" >>>>> + >>>>> +# make /dev/kvm world-accessible >>>>> +KERNEL=3D=3D"kvm", MODE=3D"0666" >>>>> diff --git a/host/rootfs/image/usr/bin/run-vmm b/host/rootfs/image/us= r/bin/run-vmm >>>>> index ba8b59c2677408acdd01c2eda3cf2dd60992d881..24c3d607bfcf6fea6196b= 61d2941141486d33fd6 100755 >>>>> --- a/host/rootfs/image/usr/bin/run-vmm >>>>> +++ b/host/rootfs/image/usr/bin/run-vmm >>>>> @@ -52,5 +52,36 @@ unexport ! >>>>> fdmove -c 3 0 >>>>> redirfd -r 0 /dev/null >>>>>=20=20 >>>>> +s6-softlimit -H -l 18446744073709551615 >>>> >>>> The s6-softlimit documentation says that hard limits should generally >>>> only be set once, at boot, and that's what we now do for PipeWire in >>>> img/app. Is the idea here that it would be undesirable to incraese the >>>> hard limit for all processes, so only do it for Cloud Hypervisor? >>> >>> s6-softlimit -H also increases the soft limit. Allowing every >>> process on the system to lock an unlimited amount of memory doesn't >>> seem ideal. For interactive logins, soft limits will be set via PAM, >>> but Spectrum doesn't use PAM yet. This keeps the change localized, >>> rather than having to bump the hard limit everywhere and then undo >>> the change elsewhere. >>=20 >> I wonder why the documentation says that, then. I suppose that's >> something I should take up with skarnet rather than you? > > I think so. I suspect it's subjective but am not sure. Okay. I have enquired. --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQGoGac7QfI+H5ZtFCZddwkt31pFQUCaTRuSgAKCRCZddwkt31p FS9EAP9zg65IMClpN17HYZGEiQCc4L5dfB1lQGJLiCPI2pJ7zgD9FbuhtY5MH6IY GA99kTjOUdP4spWHttvtl3irtqjG8gY= =tMbY -----END PGP SIGNATURE----- --=-=-=--