aws / aws/aws-nitro-enclaves-cli

update vsock driver

Open
#333 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

For my use case, it is important that the vsock channel preserves packet boundaries. Vsock was updated to support this (https://lwn.net/Articles/846628/), which became part of the linux kernel since June (https://github.com/torvalds/linux/commit/ced7b713711fdd8f99d8d04dc53451441d194c60).

How can I best "update" the vsock (driver?) that my ec2 and enclave use to the most recent version? I'm currently running the
"AWS Nitro Enclaves Developer AMI v1.01" which runs the Linux kernel "Linux 4.14.256-197.484.amzn2.x86_64 x86_64", but the vsock update is only contained in [Linux Kernel v5.14](https://github.com/torvalds/linux/tree/v5.14) and onwards, so it should be available in Fedora 34.

Would you recommend switching to a recent enough Fedora 34 AMI, and following https://github.com/aws/aws-nitro-enclaves-cli/blob/main/docs/fedora_34_how_to_install_nitro_cli_from_github_sources.md to get the Nitro CLI running on there? or is there an easier solution?

Thanks!

Edit: Tried to follow the tutorial with the `Fedora-Cloud-Base-35-1.2.x86_64-hvm-us-east-2-gp2-0` AMI, which comes with the `5.15.7-200.fc35.x86_64` kernel. Everything works until I want to start an .eif. It gets stuck at `Start allocating memory....` If I cancel and try again, I get an `ioctl` error - until I `sudo reboot`, in which case it gets stuck again. Edit2: Same thing with the `Fedora-Cloud-Base-34-20211214.0.x86_64-hvm-us-east-2-gp2-0` AMI.

Contributor guide

Open the contributing guide

Research direction

Start with the reported kernel versions, the linked Linux vsock commit, and the Fedora 34 installation guide in docs/fedora_34_how_to_install_nitro_cli_from_github_sources.md. Reproduce the Fedora behavior through EIF startup and investigate the "Start allocating memory" and ioctl failures. Done means the compatibility issue or required environment constraints are documented and EIF startup works with packet-preserving vsock support.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, fedora, linux, rust
Domain
cli, cloud, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.