From: "Cole Helbling" <cole.e.helbling@outlook.com>
To: "Alyssa Ross" <hi@alyssa.is>, <devel@spectrum-os.org>
Subject: Re: [PATCH nixpkgs 00/16] Inter-guest networking
Date: Wed, 14 Apr 2021 15:15:32 -0700 [thread overview]
Message-ID: <SJ0PR03MB5581760B5D1885BE8C9E965EB34E9@SJ0PR03MB5581.namprd03.prod.outlook.com> (raw)
In-Reply-To: <20210411115740.29615-1-hi@alyssa.is>
On Sun Apr 11, 2021 at 4:57 AM PDT, Alyssa Ross wrote:
> In Spectrum, we want the host kernel to include as few drivers as
> possible, to reduce attack service. To accomplish this, we need to
> move as much hardware interaction as possible into VMs. This series
> introduces proof-of-concept network hardware isolation by passing
> through network devices to a VM, and having that VM handle all
> interaction with that hardware instead of the host system.
[snip]
> Alyssa Ross (16):
> linux: enable Xen everywhere it can be
> cloud-hypervisor: 0.8.0 -> 0.14.1
> mdevd: init at 0.1.3.0
> spectrumPackages.linux_vm: fix cloud-hypervisor hotplug
> spectrumPackages.linux_vm: allow config overrides
> crosvm: support setting guest MAC from --tap-fd
> spectrumPackages: export makeRootfs
> spectrumPackages.rootfs: add s6-rc support
> spectrumPackages.rootfs: make /var/lib and /var/run
> spectrumPackages.rootfs: add dbus configuration
> spectrumPackages.rootfs: add connman dbus services
> spectrumPackages.sys-vms.comp: init
> spectrumPackages.makeRootfs: move to default.nix
> spectrumPackages.sys-vms.net: init
> spectrumPackages.sys-vms.app: init
> spectrumPackages.spectrum-testhost: init
>
> .../cargo-lock-vendor-fix.patch | 53 ----
> .../cloud-hypervisor/default.nix | 15 +-
> ...upport-setting-guest-MAC-from-tap-fd.patch | 294 ++++++++++++++++++
> .../linux/chromium-os/crosvm/default.nix | 1 +
> .../linux/kernel/common-config.nix | 13 +-
> pkgs/os-specific/linux/kernel/patches.nix | 9 +
> pkgs/os-specific/linux/mdevd/default.nix | 28 ++
> pkgs/os-specific/linux/spectrum/default.nix | 6 +-
> pkgs/os-specific/linux/spectrum/linux/vm.nix | 7 +-
> .../linux/spectrum/rootfs/default.nix | 92 +++---
> .../linux/spectrum/rootfs/etc/group | 1 +
> .../linux/spectrum/rootfs/etc/passwd | 1 +
> .../linux/spectrum/rootfs/generic.nix | 48 ---
> .../linux/spectrum/rootfs/rc-services.nix | 26 ++
> .../linux/spectrum/rootfs/stage1.nix | 25 +-
> .../linux/spectrum/spectrum-vm/default.nix | 6 +-
> .../linux/spectrum/testhost/default.nix | 205 ++++++++++++
> .../linux/spectrum/vm/app/default.nix | 63 ++++
> .../linux/spectrum/vm/comp/default.nix | 86 +++++
> .../os-specific/linux/spectrum/vm/default.nix | 9 +
> .../linux/spectrum/vm/net/default.nix | 165 ++++++++++
> pkgs/top-level/aliases.nix | 6 +
> pkgs/top-level/all-packages.nix | 12 +-
> 23 files changed, 976 insertions(+), 195 deletions(-)
> delete mode 100644 pkgs/applications/virtualization/cloud-hypervisor/cargo-lock-vendor-fix.patch
> create mode 100644 pkgs/os-specific/linux/chromium-os/crosvm/0001-crosvm-support-setting-guest-MAC-from-tap-fd.patch
> create mode 100644 pkgs/os-specific/linux/mdevd/default.nix
> delete mode 100644 pkgs/os-specific/linux/spectrum/rootfs/generic.nix
> create mode 100644 pkgs/os-specific/linux/spectrum/rootfs/rc-services.nix
> create mode 100644 pkgs/os-specific/linux/spectrum/testhost/default.nix
> create mode 100644 pkgs/os-specific/linux/spectrum/vm/app/default.nix
> create mode 100644 pkgs/os-specific/linux/spectrum/vm/comp/default.nix
> create mode 100644 pkgs/os-specific/linux/spectrum/vm/default.nix
> create mode 100644 pkgs/os-specific/linux/spectrum/vm/net/default.nix
>
> --
> 2.30.0
Thanks for the beautiful cover letter. Such a great amount of detail
and information brings a tear to my eye!
Each individual patch reviewed-by me, nothing stood out as weird or
wrong or bad or whatever. I only tested the final result, not each
individual patch.
Reviewed-by: Cole Helbling <cole.e.helbling@outlook.com>
Tested-by: Cole Helbling <cole.e.helbling@outlook.com>
next prev parent reply other threads:[~2021-04-14 22:20 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-11 11:57 Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 01/16] linux: enable Xen everywhere it can be Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 02/16] cloud-hypervisor: 0.8.0 -> 0.14.1 Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 03/16] mdevd: init at 0.1.3.0 Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 04/16] spectrumPackages.linux_vm: fix cloud-hypervisor hotplug Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 05/16] spectrumPackages.linux_vm: allow config overrides Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 06/16] crosvm: support setting guest MAC from --tap-fd Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 07/16] spectrumPackages: export makeRootfs Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 08/16] spectrumPackages.rootfs: add s6-rc support Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 09/16] spectrumPackages.rootfs: make /var/lib and /var/run Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 10/16] spectrumPackages.rootfs: add dbus configuration Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 11/16] spectrumPackages.rootfs: add connman dbus services Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 12/16] spectrumPackages.sys-vms.comp: init Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 13/16] spectrumPackages.makeRootfs: move to default.nix Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 14/16] spectrumPackages.sys-vms.net: init Alyssa Ross
2021-04-14 20:49 ` Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 15/16] spectrumPackages.sys-vms.app: init Alyssa Ross
2021-04-11 11:57 ` [PATCH nixpkgs 16/16] spectrumPackages.spectrum-testhost: init Alyssa Ross
2021-04-14 22:15 ` Cole Helbling [this message]
2021-04-14 23:56 ` [PATCH nixpkgs 00/16] Inter-guest networking Alyssa Ross
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=SJ0PR03MB5581760B5D1885BE8C9E965EB34E9@SJ0PR03MB5581.namprd03.prod.outlook.com \
--to=cole.e.helbling@outlook.com \
--cc=devel@spectrum-os.org \
--cc=hi@alyssa.is \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://spectrum-os.org/git/crosvm
https://spectrum-os.org/git/doc
https://spectrum-os.org/git/mktuntap
https://spectrum-os.org/git/nixpkgs
https://spectrum-os.org/git/spectrum
https://spectrum-os.org/git/ucspi-vsock
https://spectrum-os.org/git/www
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).