Messages in this thread | | | Subject | Re: [PATCH net-next v1 0/3] vsock: Add flag field in the vsock address | From | "Paraschiv, Andra-Irina" <> | Date | Wed, 2 Dec 2020 18:18:15 +0200 |
| |
On 02/12/2020 15:37, Stefano Garzarella wrote: > > Hi Andra, > > On Tue, Dec 01, 2020 at 05:25:02PM +0200, Andra Paraschiv wrote: >> vsock enables communication between virtual machines and the host >> they are >> running on. Nested VMs can be setup to use vsock channels, as the multi >> transport support has been available in the mainline since the v5.5 >> Linux kernel >> has been released. >> >> Implicitly, if no host->guest vsock transport is loaded, all the >> vsock packets >> are forwarded to the host. This behavior can be used to setup >> communication >> channels between sibling VMs that are running on the same host. One >> example can >> be the vsock channels that can be established within AWS Nitro Enclaves >> (see Documentation/virt/ne_overview.rst). >> >> To be able to explicitly mark a connection as being used for a >> certain use case, >> add a flag field in the vsock address data structure. The >> "svm_reserved1" field >> has been repurposed to be the flag field. The value of the flag will >> then be >> taken into consideration when the vsock transport is assigned. >> >> This way can distinguish between nested VMs / local communication and >> sibling >> VMs use cases. And can also setup one or more types of communication >> at the same >> time. >> > > Another thing worth mentioning is that for now it is not supported in > vhost-vsock, since we are discarding every packet not addressed to the > host.
Right, thanks for the follow-up.
> > What we should do would be: > - add a new IOCTL to vhost-vsock to enable sibling communication, by > default I'd like to leave it disabled > > - allow sibling forwarding only if both guests have sibling > communication enabled and we should implement some kind of filtering > or network namespace support to allow the communication only between a > subset of VMs > > > Do you have plans to work on it?
Nope, not yet. But I can take some time in the second part of December / beginning of January for this. And we can catch up in the meantime if there is something blocking or more clarifications are needed to make it work.
Thanks, Andra
> > > Otherwise I put it in my to-do list and hope I have time to do it (maybe > next month). > > Thanks, > Stefano >
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
| |