On Wed, Dec 02, 2020 at 06:18:15PM +0200, Paraschiv, Andra-Irina wrote:

On 02/12/2020 15:37, Stefano Garzarella wrote:

quoted

Hi Andra,

On Tue, Dec 01, 2020 at 05:25:02PM +0200, Andra Paraschiv wrote:

quoted

vsock enables communication between virtual machines and the host 
they are
running on. Nested VMs can be setup to use vsock channels, as the multi
transport support has been available in the mainline since the 
v5.5 Linux kernel
has been released.

Implicitly, if no host->guest vsock transport is loaded, all the 
vsock packets
are forwarded to the host. This behavior can be used to setup 
communication
channels between sibling VMs that are running on the same host. 
One example can
be the vsock channels that can be established within AWS Nitro Enclaves
(see Documentation/virt/ne_overview.rst).

To be able to explicitly mark a connection as being used for a 
certain use case,
add a flag field in the vsock address data structure. The 
"svm_reserved1" field
has been repurposed to be the flag field. The value of the flag 
will then be
taken into consideration when the vsock transport is assigned.

This way can distinguish between nested VMs / local communication 
and sibling
VMs use cases. And can also setup one or more types of 
communication at the same
time.

Another thing worth mentioning is that for now it is not supported in
vhost-vsock, since we are discarding every packet not addressed to the
host.

Right, thanks for the follow-up.

quoted

What we should do would be:
- add a new IOCTL to vhost-vsock to enable sibling communication, by
 default I'd like to leave it disabled

- allow sibling forwarding only if both guests have sibling
 communication enabled and we should implement some kind of filtering
 or network namespace support to allow the communication only between a
 subset of VMs


Do you have plans to work on it?

Nope, not yet. But I can take some time in the second part of December 
/ beginning of January for this. And we can catch up in the meantime 
if there is something blocking or more clarifications are needed to 
make it work.

Good, it will be great!

Thanks,
Stefano