On Wed, Dec 02, 2020 at 06:18:15PM +0200, Paraschiv, Andra-Irina wrote:
On 02/12/2020 15:37, Stefano Garzarella wrote:
Hi Andra,
On Tue, Dec 01, 2020 at 05:25:02PM +0200, Andra Paraschiv wrote:
vsock enables communication between virtual machines and the host
they are
running on. Nested VMs can be setup to use vsock channels, as the multi
transport support has been available in the mainline since the
v5.5 Linux kernel
has been released.
Implicitly, if no host->guest vsock transport is loaded, all the
vsock packets
are forwarded to the host. This behavior can be used to setup
communication
channels between sibling VMs that are running on the same host.
One example can
be the vsock channels that can be established within AWS Nitro Enclaves
(see Documentation/virt/ne_overview.rst).
To be able to explicitly mark a connection as being used for a
certain use case,
add a flag field in the vsock address data structure. The
"svm_reserved1" field
has been repurposed to be the flag field. The value of the flag
will then be
taken into consideration when the vsock transport is assigned.
This way can distinguish between nested VMs / local communication
and sibling
VMs use cases. And can also setup one or more types of
communication at the same
time.
Another thing worth mentioning is that for now it is not supported in
vhost-vsock, since we are discarding every packet not addressed to the
host.
Right, thanks for the follow-up.
What we should do would be:
- add a new IOCTL to vhost-vsock to enable sibling communication, by
default I'd like to leave it disabled
- allow sibling forwarding only if both guests have sibling
communication enabled and we should implement some kind of filtering
or network namespace support to allow the communication only between a
subset of VMs
Do you have plans to work on it?
Nope, not yet. But I can take some time in the second part of December
/ beginning of January for this. And we can catch up in the meantime
if there is something blocking or more clarifications are needed to
make it work.
Good, it will be great!
Thanks,
Stefano
