On Thu, May 17, 2018 at 12:13:58PM +0000, Trapp, Michael wrote:
> I would like to add virtio based communication to vhostmd.
> The current vhostmd implementation writes the metric data of all VMs and the
> host to a single file. This file is mapped as a disk to all VMs and due to
> that every VM can see all VMs and also has access to the whole data set of
> all VMs.
> >From security perspective this could be more restrictive and a ‘per VM’
> >view on the data would help to improve the situation a bit.
> So far I have implemented the virtio channel based communication between VMs
> and vhostmd and tested the feature in a local setup.
> Let's start with the relevant VM config:
> <domain type='kvm'>
> <channel type='unix'>
> <source mode='bind'
Ewww, that is a global namespace you're using there - you can't assume
this is the only channel using this directory. It needs to include the
channel target name in the path as a prefix, as well a unique per-VM
identifier of some kind
> <target type='virtio' name='vhostmd'/>
We'd generally recomend reverse domain name for channel names, along with
a version number in case protocol needs to change. eg perhaps
> <address type='virtio-serial' controller='0' bus='0' port='1'/>
> Based on that, the VM can access the virtio channel on /dev/vport1p1
Again, this mustn't assume there's only one channel - there are symlinks
created in the guest based on the target name that should be used.
> So far I've tested in a setup with 40 VMs for several days with a mix of
> continuously running/restarting VMs and a simple 'virtio client' inside
> each VM.
The main troublespot with virtio channel is that the guest sees a EOF
across live migration, so the protocol needs to be able to resynchronize
> Well, before this gets to detailed I guess it's better to have a look into my
> changes ;-)
> virt-tools-list mailing list
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
virt-tools-list mailing list