vsock enables communication between virtual machines and the host they are
running on. Nested VMs can be setup to use vsock channels, as the multi
transport support has been available in the mainline since the v5.5 Linux kernel
has been released.
Implicitly, if no host->guest vsock transport is loaded, all the vsock packets
are forwarded to the host. This behavior can be used to setup communication
channels between sibling VMs that are running on the same host. One example can
be the vsock channels that can be established within AWS Nitro Enclaves
(see Documentation/virt/ne_overview.rst).
To be able to explicitly mark a connection as being used for a certain use case,
add a flags field in the vsock address data structure. The value of the flags
field is taken into consideration when the vsock transport is assigned. This way
can distinguish between different use cases, such as nested VMs / local
communication and sibling VMs.
The flags field can be set in the user space application connect logic. On the
listen path, the field can be set in the kernel space logic.
Thank you.
Andra
---
Patch Series Changelog
The patch series is built on top of v5.10.
GitHub repo branch for the latest version of the patch series:
* https://github.com/andraprs/linux/tree/vsock-flag-sibling-comm-v4
v3 -> v4
* Rebase on top of v5.10.
* Add check for supported flag values.
* Update the "svm_flags" field to be 1 byte instead of 2 bytes.
* v3: https://lore.kernel.org/lkml/[email protected]/
v2 -> v3
* Rebase on top of v5.10-rc7.
* Add "svm_flags" as a new field, not reusing "svm_reserved1".
* Update comments to mention when the "VMADDR_FLAG_TO_HOST" flag is set in the
connect and listen paths.
* Update bitwise check logic to not compare result to the flag value.
* v2: https://lore.kernel.org/lkml/[email protected]/
v1 -> v2
* Update the vsock flag naming to "VMADDR_FLAG_TO_HOST".
* Use bitwise operators to setup and check the vsock flag.
* Set the vsock flag on the receive path in the vsock transport assignment
logic.
* Merge the checks for the g2h transport assignment in one "if" block.
* v1: https://lore.kernel.org/lkml/[email protected]/
---
Andra Paraschiv (5):
vm_sockets: Add flags field in the vsock address data structure
vm_sockets: Add VMADDR_FLAG_TO_HOST vsock flag
vsock_addr: Check for supported flag values
af_vsock: Set VMADDR_FLAG_TO_HOST flag on the receive path
af_vsock: Assign the vsock transport considering the vsock address
flags
include/uapi/linux/vm_sockets.h | 26 +++++++++++++++++++++++++-
net/vmw_vsock/af_vsock.c | 21 +++++++++++++++++++--
net/vmw_vsock/vsock_addr.c | 4 +++-
3 files changed, 47 insertions(+), 4 deletions(-)
--
2.20.1 (Apple Git-117)
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
The vsock flags can be set during the connect() setup logic, when
initializing the vsock address data structure variable. Then the vsock
transport is assigned, also considering this flags field.
The vsock transport is also assigned on the (listen) receive path. The
flags field needs to be set considering the use case.
Set the value of the vsock flags of the remote address to the one
targeted for packets forwarding to the host, if the following conditions
are met:
* The source CID of the packet is higher than VMADDR_CID_HOST.
* The destination CID of the packet is higher than VMADDR_CID_HOST.
Changelog
v3 -> v4
* No changes.
v2 -> v3
* No changes.
v1 -> v2
* Set the vsock flag on the receive path in the vsock transport
assignment logic.
* Use bitwise operator for the vsock flag setup.
* Use the updated "VMADDR_FLAG_TO_HOST" flag naming.
Signed-off-by: Andra Paraschiv <[email protected]>
Reviewed-by: Stefano Garzarella <[email protected]>
---
net/vmw_vsock/af_vsock.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index d10916ab45267..83d035eab0b05 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -431,6 +431,18 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)
unsigned int remote_cid = vsk->remote_addr.svm_cid;
int ret;
+ /* If the packet is coming with the source and destination CIDs higher
+ * than VMADDR_CID_HOST, then a vsock channel where all the packets are
+ * forwarded to the host should be established. Then the host will
+ * need to forward the packets to the guest.
+ *
+ * The flag is set on the (listen) receive path (psk is not NULL). On
+ * the connect path the flag can be set by the user space application.
+ */
+ if (psk && vsk->local_addr.svm_cid > VMADDR_CID_HOST &&
+ vsk->remote_addr.svm_cid > VMADDR_CID_HOST)
+ vsk->remote_addr.svm_flags |= VMADDR_FLAG_TO_HOST;
+
switch (sk->sk_type) {
case SOCK_DGRAM:
new_transport = transport_dgram;
--
2.20.1 (Apple Git-117)
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
Check if the provided flags value from the vsock address data structure
includes the supported flags in the corresponding kernel version.
The first byte of the "svm_zero" field is used as "svm_flags", so add
the flags check instead.
Changelog
v3 -> v4
* New patch in v4.
Signed-off-by: Andra Paraschiv <[email protected]>
---
net/vmw_vsock/vsock_addr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/vmw_vsock/vsock_addr.c b/net/vmw_vsock/vsock_addr.c
index 909de26cb0e70..223b9660a759f 100644
--- a/net/vmw_vsock/vsock_addr.c
+++ b/net/vmw_vsock/vsock_addr.c
@@ -22,13 +22,15 @@ EXPORT_SYMBOL_GPL(vsock_addr_init);
int vsock_addr_validate(const struct sockaddr_vm *addr)
{
+ __u8 svm_valid_flags = VMADDR_FLAG_TO_HOST;
+
if (!addr)
return -EFAULT;
if (addr->svm_family != AF_VSOCK)
return -EAFNOSUPPORT;
- if (addr->svm_zero[0] != 0)
+ if (addr->svm_flags & ~svm_valid_flags)
return -EINVAL;
return 0;
--
2.20.1 (Apple Git-117)
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
Add VMADDR_FLAG_TO_HOST vsock flag that is used to setup a vsock
connection where all the packets are forwarded to the host.
Then, using this type of vsock channel, vsock communication between
sibling VMs can be built on top of it.
Changelog
v3 -> v4
* Update the "VMADDR_FLAG_TO_HOST" value, as the size of the field has
been updated to 1 byte.
v2 -> v3
* Update comments to mention when the flag is set in the connect and
listen paths.
v1 -> v2
* New patch in v2, it was split from the first patch in the series.
* Remove the default value for the vsock flags field.
* Update the naming for the vsock flag to "VMADDR_FLAG_TO_HOST".
Signed-off-by: Andra Paraschiv <[email protected]>
Reviewed-by: Stefano Garzarella <[email protected]>
---
include/uapi/linux/vm_sockets.h | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/include/uapi/linux/vm_sockets.h b/include/uapi/linux/vm_sockets.h
index c2eac3d0a9f00..46918a1852d7b 100644
--- a/include/uapi/linux/vm_sockets.h
+++ b/include/uapi/linux/vm_sockets.h
@@ -115,6 +115,26 @@
#define VMADDR_CID_HOST 2
+/* The current default use case for the vsock channel is the following:
+ * local vsock communication between guest and host and nested VMs setup.
+ * In addition to this, implicitly, the vsock packets are forwarded to the host
+ * if no host->guest vsock transport is set.
+ *
+ * Set this flag value in the sockaddr_vm corresponding field if the vsock
+ * packets need to be always forwarded to the host. Using this behavior,
+ * vsock communication between sibling VMs can be setup.
+ *
+ * This way can explicitly distinguish between vsock channels created for
+ * different use cases, such as nested VMs (or local communication between
+ * guest and host) and sibling VMs.
+ *
+ * The flag can be set in the connect logic in the user space application flow.
+ * In the listen logic (from kernel space) the flag is set on the remote peer
+ * address. This happens for an incoming connection when it is routed from the
+ * host and comes from the guest (local CID and remote CID > VMADDR_CID_HOST).
+ */
+#define VMADDR_FLAG_TO_HOST 0x01
+
/* Invalid vSockets version. */
#define VM_SOCKETS_INVALID_VERSION -1U
--
2.20.1 (Apple Git-117)
Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
On Mon, Dec 14, 2020 at 06:11:20PM +0200, Andra Paraschiv wrote:
>Check if the provided flags value from the vsock address data structure
>includes the supported flags in the corresponding kernel version.
>
>The first byte of the "svm_zero" field is used as "svm_flags", so add
>the flags check instead.
>
>Changelog
>
>v3 -> v4
>
>* New patch in v4.
>
>Signed-off-by: Andra Paraschiv <[email protected]>
>---
> net/vmw_vsock/vsock_addr.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Reviewed-by: Stefano Garzarella <[email protected]>
>
>diff --git a/net/vmw_vsock/vsock_addr.c b/net/vmw_vsock/vsock_addr.c
>index 909de26cb0e70..223b9660a759f 100644
>--- a/net/vmw_vsock/vsock_addr.c
>+++ b/net/vmw_vsock/vsock_addr.c
>@@ -22,13 +22,15 @@ EXPORT_SYMBOL_GPL(vsock_addr_init);
>
> int vsock_addr_validate(const struct sockaddr_vm *addr)
> {
>+ __u8 svm_valid_flags = VMADDR_FLAG_TO_HOST;
>+
> if (!addr)
> return -EFAULT;
>
> if (addr->svm_family != AF_VSOCK)
> return -EAFNOSUPPORT;
>
>- if (addr->svm_zero[0] != 0)
>+ if (addr->svm_flags & ~svm_valid_flags)
> return -EINVAL;
>
> return 0;
>--
>2.20.1 (Apple Git-117)
>
>
>
>
>Amazon Development Center (Romania) S.R.L. registered office: 27A Sf. Lazar Street, UBC5, floor 2, Iasi, Iasi County, 700045, Romania. Registered in Romania. Registration number J22/2621/2005.
>
Hello:
This series was applied to netdev/net-next.git (refs/heads/master):
On Mon, 14 Dec 2020 18:11:17 +0200 you wrote:
> vsock enables communication between virtual machines and the host they are
> running on. Nested VMs can be setup to use vsock channels, as the multi
> transport support has been available in the mainline since the v5.5 Linux kernel
> has been released.
>
> Implicitly, if no host->guest vsock transport is loaded, all the vsock packets
> are forwarded to the host. This behavior can be used to setup communication
> channels between sibling VMs that are running on the same host. One example can
> be the vsock channels that can be established within AWS Nitro Enclaves
> (see Documentation/virt/ne_overview.rst).
>
> [...]
Here is the summary with links:
- [net-next,v4,1/5] vm_sockets: Add flags field in the vsock address data structure
https://git.kernel.org/netdev/net-next/c/dc8eeef73b63
- [net-next,v4,2/5] vm_sockets: Add VMADDR_FLAG_TO_HOST vsock flag
https://git.kernel.org/netdev/net-next/c/caaf95e0f23f
- [net-next,v4,3/5] vsock_addr: Check for supported flag values
https://git.kernel.org/netdev/net-next/c/cada7ccd9dc7
- [net-next,v4,4/5] af_vsock: Set VMADDR_FLAG_TO_HOST flag on the receive path
https://git.kernel.org/netdev/net-next/c/1b5f2ab98e7f
- [net-next,v4,5/5] af_vsock: Assign the vsock transport considering the vsock address flags
https://git.kernel.org/netdev/net-next/c/7f816984f439
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html