From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.2 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5708CC3A5A0 for ; Mon, 19 Aug 2019 13:09:15 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2AD4C20843 for ; Mon, 19 Aug 2019 13:09:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727564AbfHSNJO (ORCPT ); Mon, 19 Aug 2019 09:09:14 -0400 Received: from mx1.redhat.com ([209.132.183.28]:54170 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727424AbfHSNJN (ORCPT ); Mon, 19 Aug 2019 09:09:13 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7225E811A9; Mon, 19 Aug 2019 13:09:13 +0000 (UTC) Received: from localhost (ovpn-117-111.ams2.redhat.com [10.36.117.111]) by smtp.corp.redhat.com (Postfix) with ESMTP id C38B95C205; Mon, 19 Aug 2019 13:09:12 +0000 (UTC) Date: Mon, 19 Aug 2019 14:09:11 +0100 From: Stefan Hajnoczi To: Stefano Garzarella Cc: netdev@vger.kernel.org, Dexuan Cui , Jorgen Hansen , "David S. Miller" , Vishnu Dasa , "K. Y. Srinivasan" , Haiyang Zhang , Stephen Hemminger , Sasha Levin Subject: Re: [RFC v2] vsock: proposal to support multiple transports at runtime Message-ID: <20190819130911.GE28081@stefanha-x1.localdomain> References: <20190606100912.f2zuzrkgmdyxckog@steredhat> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="uCPdOCrL+PnN2Vxy" Content-Disposition: inline In-Reply-To: <20190606100912.f2zuzrkgmdyxckog@steredhat> User-Agent: Mutt/1.12.1 (2019-06-15) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Mon, 19 Aug 2019 13:09:13 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org --uCPdOCrL+PnN2Vxy Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Jun 06, 2019 at 12:09:12PM +0200, Stefano Garzarella wrote: >=20 > Hi all, > this is a v2 of a proposal addressing the comments made by Dexuan, Stefan, > and Jorgen. >=20 > v1: https://www.spinics.net/lists/netdev/msg570274.html >=20 >=20 >=20 > We can define two types of transport that we have to handle at the same t= ime > (e.g. in a nested VM we would have both types of transport running togeth= er): >=20 > - 'host->guest' transport, it runs in the host and it is used to communic= ate > with the guests of a specific hypervisor (KVM, VMWare or Hyper-V). It a= lso > runs in the guest who has nested guests, to communicate with them. >=20 > [Phase 2] > We can support multiple 'host->guest' transport running at the same tim= e, > but on x86 only one hypervisor uses VMX at any given time. >=20 > - 'guest->host' transport, it runs in the guest and it is used to communi= cate > with the host. >=20 >=20 > The main goal is to find a way to decide what transport use in these case= s: > 1. connect() / sendto() >=20 > a. use the 'host->guest' transport, if the destination is the guest > (dest_cid > VMADDR_CID_HOST). >=20 > [Phase 2] > In order to support multiple 'host->guest' transports running at th= e same > time, we should assign CIDs uniquely across all transports. In this= way, > a packet generated by the host side will get directed to the approp= riate > transport based on the CID. >=20 > b. use the 'guest->host' transport, if the destination is the host or = the > hypervisor. > (dest_cid =3D=3D VMADDR_CID_HOST || dest_cid =3D=3D VMADDR_CID_HYPE= RVISOR) >=20 >=20 > 2. listen() / recvfrom() >=20 > a. use the 'host->guest' transport, if the socket is bound to > VMADDR_CID_HOST, or it is bound to VMADDR_CID_ANY and there is no > 'guest->host' transport. > We could also define a new VMADDR_CID_LISTEN_FROM_GUEST in order to > address this case. >=20 > [Phase 2] > We can support network namespaces to create independent AF_VSOCK > addressing domains: > - could be used to partition VMs between hypervisors or at a finer > granularity; > - could be used to isolate host applications from guest applications > using the same ports with CID_ANY; >=20 > b. use the 'guest->host' transport, if the socket is bound to local CID > different from the VMADDR_CID_HOST (guest CID get with > IOCTL_VM_SOCKETS_GET_LOCAL_CID), or it is bound to VMADDR_CID_ANY (= to be > backward compatible). > Also in this case, we could define a new VMADDR_CID_LISTEN_FROM_HOS= T. >=20 > c. shared port space between transports > For incoming requests or packets, we should be able to choose which > transport use, looking at the 'port' requested. >=20 > - stream sockets already support shared port space between transpor= ts > (one port can be assigned to only one transport) >=20 > [Phase 2] > - datagram sockets will support it, but for now VMCI transport is t= he > default transport for any host side datagram socket (KVM and Hype= r-V > do not yet support datagrams sockets) >=20 > We will make the loading of af_vsock.ko independent of the transports to > allow to: > - create a AF_VSOCK socket without any loaded transports; > - listen on a socket (e.g. bound to VMADDR_CID_ANY) without any loaded > transports; >=20 > Hopefully, we could move MODULE_ALIAS_NETPROTO(PF_VSOCK) from the > vmci_transport.ko to the af_vsock.ko. > [Jorgen will check if this will impact the existing VMware products] >=20 > Notes: > - For Hyper-V sockets, the host can only be Windows. No changes should > be required on the Windows host to support the changes on this propo= sal. >=20 > - Communication between guests are not allowed on any transports, so w= e can > drop packets sent from a guest to another guest (dest_cid > > VMADDR_CID_HOST) if the 'host->guest' transport is not available. >=20 > - [Phase 2] tag used to identify things that can be done at a later st= age, > but that should be taken into account during this design. >=20 > - Namespace support will be developed in [Phase 2] or in a separate pr= oject. >=20 >=20 >=20 > Comments and suggestions are welcome. > I'll be on PTO for next two weeks, so sorry in advance if I'll answer lat= er. >=20 > If we agree on this proposal, when I get back, I'll start working on the = code > to get a first PATCH RFC. Stefano, I've reviewed your proposal and it looks good for solving nested virtualization. The tricky implementation details will be supporting listen sockets, especially with VMADDR_CID_ANY so they can be accessed from both transports. Stefan --uCPdOCrL+PnN2Vxy Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAl1an3cACgkQnKSrs4Gr c8iFcwf+J7Hgpr8SCqSHK6DmBwYGTPkESE0j2G7rR4ZDh1namYBmVlinwL++O1cU uZGLMnl4HqOUF0kWxmNmC3qiX4rDK1VTvAbBt/xhGUemiJ0YIj/zPEkQJ1V/Jt8z UyT6XZ8cXOMqqWPIVIJmboy7sJp3Ji8ItVfQ0T1sMMCyjN99dP1GfuqpIEfb/FeF vI0y0HOvBJOVghp6omP/BMuxH5vYyEcWJdgWkgPeCuL1I/qKrtmfGQnasGacedq2 IouXQwXTS57XmL07BY9Cv1b3N6tF5rflCL96Px3l6PggUigmFncOMzZFQneaFY5b GJ9Mfkh6Z8/5BxWe9IaP+RmcmHmypg== =23Yg -----END PGP SIGNATURE----- --uCPdOCrL+PnN2Vxy--