linux-kernel - RE: [RFC] hypercall-vsock: add a new vsock transport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 11 Nov 2021 08:02:27 +0000
From:   "Wang, Wei W" <wei.w.wang@...el.com>
To:     Stefan Hajnoczi <stefanha@...hat.com>
CC:     "sgarzare@...hat.com" <sgarzare@...hat.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "mst@...hat.com" <mst@...hat.com>,
        Paolo Bonzini <pbonzini@...hat.com>,
        "kys@...rosoft.com" <kys@...rosoft.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "virtualization@...ts.linux-foundation.org" 
        <virtualization@...ts.linux-foundation.org>,
        "Yamahata, Isaku" <isaku.yamahata@...el.com>,
        "Nakajima, Jun" <jun.nakajima@...el.com>,
        "Kleen, Andi" <andi.kleen@...el.com>,
        Andra Paraschiv <andraprs@...zon.com>,
        "Sergio Lopez Pascual" <slp@...hat.com>
Subject: RE: [RFC] hypercall-vsock: add a new vsock transport

> From: Stefan Hajnoczi <stefanha@...hat.com>
On Wednesday, November 10, 2021 5:35 PM, Stefan Hajnoczi wrote:
> AF_VSOCK is designed to allow multiple transports, so why not. There is a cost
> to developing and maintaining a vsock transport though.

Yes. The effort could be reduced via simplifying the design as much as possible:
e.g. no ring operations - guest just sends a packet each time for the host to read.
(this transport isn't targeting for high performance)

> 
> I think Amazon Nitro enclaves use virtio-vsock and I've CCed Andra in case she
> has thoughts on the pros/cons and how to minimize the trusted computing
> base.

Thanks for adding more related person to the discussion loop.

> 
> If simplicity is the top priority then VIRTIO's MMIO transport without indirect
> descriptors and using the packed virtqueue layout reduces the size of the
> implementation:
> https://docs.oasis-open.org/virtio/virtio/v1.1/cs01/virtio-v1.1-cs01.html#x1-1
> 440002

I listed some considerations for virtio-mmio in the response to Michael.
Please have a check if any different thoughts.

Thanks,
Wei