[Bug Report] cubesandbox是否支持硬件通信的代码执行

[coderjingluo]

cubesandbox是否支持与无线网卡、蓝牙适配器等硬件通信的代码执行

[kinwin-ustc]

Could you clarify your requirements in greater detail?
I think support can be added once the sandbox kernel enables the corresponding emulated devices.

[coderjingluo]

Could you clarify your requirements in greater detail?您能否更详细地说明一下您的需求？ I think support can be added once the sandbox kernel enables the corresponding emulated devices.我认为一旦沙盒内核启用相应的模拟设备，就可以添加支持。

我们有一个自动化插件测试平台，支持用户自己编写插件，然后用户编写的插件需要和硬件进行通信，比如无线网卡、蓝牙适配器、有线adb等等还有其他硬件设备，我们希望将用户编写的插件隔离起来执行（隔离起来的原因就是我们只有一台机器，里面还有其他代码，用户编写的插件如果是恶意的插件，不隔离就会造成其他代码泄露的风险），并且能和硬件正常通信进行测试，然后gpt分析认为我所说的硬件都是usb设备，cubesandbox项目支持的是pci设备

[fslongjin]

It sounds like your requirement involves emulating USB devices within a VM. If that's the case, one approach is to treat CubeSandbox​ as a 'rapidly bootable cloud server': Launch your business container inside CubeSandbox, then spin up a new QEMU VM within that container to host your user's test environment. Meanwhile, other code within the same container can interact with this QEMU instance.
Since the sandbox container provisioned by CubeSandbox runs in privileged mode​ (inside the micro-VM), this should satisfy your requirements.

[coderjingluo]

It sounds like your requirement involves emulating USB devices within a VM. If that's the case, one approach is to treat CubeSandbox​ as a 'rapidly bootable cloud server': Launch your business container inside CubeSandbox, then spin up a new QEMU VM within that container to host your user's test environment. Meanwhile, other code within the same container can interact with this QEMU instance.听起来您的需求是在虚拟机中模拟 USB 设备。如果是这样，一种方法是将 CubeSandbox 视为“快速启动的云服务器”：在 CubeSandbox 中启动您的业务容器，然后在该容器内启动一个新的 QEMU 虚拟机来托管用户的测试环境。同时，同一容器内的其他代码可以与此 QEMU 实例进行交互。 Since the sandbox container provisioned by CubeSandbox runs in privileged mode​ (inside the micro-VM), this should satisfy your requirements.由于 CubeSandbox 提供的沙箱容器以特权模式（在微型虚拟机内部）运行，这应该可以满足您的要求。

我将有线adb、无线网卡、蓝牙适配器透传到sandbox，好像有问题：

[up2wing]

It sounds like your requirement involves emulating USB devices within a VM. If that's the case, one approach is to treat CubeSandbox​ as a 'rapidly bootable cloud server': Launch your business container inside CubeSandbox, then spin up a new QEMU VM within that container to host your user's test environment. Meanwhile, other code within the same container can interact with this QEMU instance.听起来您的需求是在虚拟机中模拟 USB 设备。如果是这样，一种方法是将 CubeSandbox 视为“快速启动的云服务器”：在 CubeSandbox 中启动您的业务容器，然后在该容器内启动一个新的 QEMU 虚拟机来托管用户的测试环境。同时，同一容器内的其他代码可以与此 QEMU 实例进行交互。 Since the sandbox container provisioned by CubeSandbox runs in privileged mode​ (inside the micro-VM), this should satisfy your requirements.由于 CubeSandbox 提供的沙箱容器以特权模式（在微型虚拟机内部）运行，这应该可以满足您的要求。

我将有线adb、无线网卡、蓝牙适配器透传到sandbox，好像有问题：

Could not get region #8 info

This is the normal log when using vfio passthrough device.
Do you install the devices driver in the guest? If not, please install them and check if the problem gone.

If the issue persists, please provide the following output in the vm:
lspci -v
dmesg

[coderjingluo]

It sounds like your requirement involves emulating USB devices within a VM. If that's the case, one approach is to treat CubeSandbox​ as a 'rapidly bootable cloud server': Launch your business container inside CubeSandbox, then spin up a new QEMU VM within that container to host your user's test environment. Meanwhile, other code within the same container can interact with this QEMU instance.听起来您的需求是在虚拟机中模拟 USB 设备。如果是这样，一种方法是将 CubeSandbox 视为“快速启动的云服务器”：在 CubeSandbox 中启动您的业务容器，然后在该容器内启动一个新的 QEMU 虚拟机来托管用户的测试环境。同时，同一容器内的其他代码可以与此 QEMU 实例进行交互。 Since the sandbox container provisioned by CubeSandbox runs in privileged mode​ (inside the micro-VM), this should satisfy your requirements.由于 CubeSandbox 提供的沙箱容器以特权模式（在微型虚拟机内部）运行，这应该可以满足您的要求。

我将有线adb、无线网卡、蓝牙适配器透传到sandbox，好像有问题：

Could not get region #8 info

This is the normal log when using vfio passthrough device. Do you install the devices driver in the guest? If not, please install them and check if the problem gone.

If the issue persists, please provide the following output in the vm: lspci -v dmesg

是否能够补充如何透传硬件到sandbox中的文档，我看看是不是我的操作有问题

[up2wing]

It sounds like your requirement involves emulating USB devices within a VM. If that's the case, one approach is to treat CubeSandbox​ as a 'rapidly bootable cloud server': Launch your business container inside CubeSandbox, then spin up a new QEMU VM within that container to host your user's test environment. Meanwhile, other code within the same container can interact with this QEMU instance.听起来您的需求是在虚拟机中模拟 USB 设备。如果是这样，一种方法是将 CubeSandbox 视为“快速启动的云服务器”：在 CubeSandbox 中启动您的业务容器，然后在该容器内启动一个新的 QEMU 虚拟机来托管用户的测试环境。同时，同一容器内的其他代码可以与此 QEMU 实例进行交互。 Since the sandbox container provisioned by CubeSandbox runs in privileged mode​ (inside the micro-VM), this should satisfy your requirements.由于 CubeSandbox 提供的沙箱容器以特权模式（在微型虚拟机内部）运行，这应该可以满足您的要求。

我将有线adb、无线网卡、蓝牙适配器透传到sandbox，好像有问题：

Could not get region #8 info

This is the normal log when using vfio passthrough device. Do you install the devices driver in the guest? If not, please install them and check if the problem gone.
If the issue persists, please provide the following output in the vm: lspci -v dmesg

是否能够补充如何透传硬件到sandbox中的文档，我看看是不是我的操作有问题

Would you please take a look at this?

@fslongjin

[fslongjin]

Hi @up2wing,

Previously, device passthrough in CubeSandbox was implemented by having Cubelet add annotations and handle the logic to attach VFIO devices to the microVM.

However, in the current sandbox architecture with AppSnapshot, VFIO devices would need to be hot-plugged after the sandbox has already started (since the snapshot is taken without those devices). I'm not sure this can be directly supported with the current implementation.

We'll need to think about how to properly support this scenario. Let us follow up on this.