VMM: networking mode management#756
Open
Leechael wants to merge 6 commits into
Open
Conversation
Leechael
force-pushed
the
vmm-networking-rpc-iteration
branch
from
a084dbe to
d79b272
Compare
Single-NIC bridge/user networking could not express mixed topologies (e.g. one bridge NIC for external traffic + one user-mode NIC for isolated management). Extend the model to support multiple NICs per VM. - Manifest field: networking (singular, Optional) -> networks (Vec) with backward-compatible deserialization of the legacy field - Proto: add repeated NetworkingConfig in VmConfiguration/UpdateVmRequest, NetworkInterfaceStatus in VmInfo, and NetworkingCapabilities in GetMetaResponse - QEMU: generate one -netdev/-device pair per entry with indexed net IDs and per-NIC deterministic MACs (SHA256 of vm_id:index) - DHCP: match leases against all NICs, persist per-MAC guest IP map - Port forwarding: select the first bridge NIC with forward_service_enabled - Validation: reject bridge mode when the host interface does not exist, reject custom mode via RPC (manifest-only) - Measurement: networking config excluded from VM measurement to allow topology changes without re-attestation
- Replace hand-written Manifest Deserialize impl with derive + Manifest::from_json() for legacy "networking" field migration - Simplify resolve_networking to clone global config as base then selectively override non-empty per-VM fields - Extract effective_networks() on VmState and VmInfo to eliminate four duplicated runtime_networks fallback blocks - Remove redundant forward_service_enabled pre-assignment in resolve_requested_networks (now inherited from global config clone)
Drop if_name, lowerdev, and pci_bdf — all three were always set to None in the only construction site. Add them back when a backend actually populates them.
Leechael
force-pushed
the
vmm-networking-rpc-iteration
branch
from
501848b to
de1bbb1
Compare
Each virtio-net-pci device changes the guest ACPI/DSDT layout and thus RTMR0. Before this change dstack-mr hardcoded exactly one NIC, so a CVM booted with the new multi-network support (repeated `networks`) would produce an RTMR0 the verifier could never reconstruct, and attestation would fail closed. Dropping ACPI from the measurement instead would let an untrusted host silently attach un-attested devices under an unchanged quote, so the NIC count must be measured. Mirror the existing `num_gpus` plumbing: add `num_nics` to `dstack_types::VmConfig` and `dstack_mr::Machine`, emit one `-netdev/-device virtio-net-pci` pair per NIC in the ACPI generator, and thread the resolved interface count from the VMM through to the verifier. Backward compatibility: - `num_nics` defaults to 1 and is omitted from the serialized VmConfig when equal to 1, so existing configs, their measurement cache keys, and RTMR0 values are byte-for-byte unchanged (verified against the previous hardcoded layout). - legacy configs without the field deserialize to 1. Verified: RTMR0(num_nics=1) == RTMR0(previous hardcoded layout); RTMR0(num_nics=2) differs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.