The security state of KVM

Matthew, that sounds dangerously like a versioned ABI, something I like the idea of but for-some-reason think that Linus would object to it as a pattern[1]. I think you gain the ability to kill off harmful and antipattern chunks of the ABI and manage the move forward to better-implemented functionality, or leave old interfaces in place with their original code and be explicit about whether your kernel supports them or not. Obviously: show me the code, post the patches, etc.

1: I think that the issue has been raised in the past and been criticised (haven't searched for the links) but in any case I can see that a versioned ABI would become an abstraction layer to change the implementation underneath it and the old methods would be retained for backwards compatibility, then on the road to deprecation would become configurable at build-time, before every version of the ABI would be a config option. That eventually allows a kind of Tivo-isation where you ship a userland and kernel with a custom ABI that can't run external software despite sharing a kernel version. And somehow that becomes LKML's fault rather than the device aggregator's responsibility.

K3n.