Introduce Virtio-Vsock support by luigix25 · Pull Request #766 · coconut-svsm/svsm

luigix25 · 2025-07-28T13:16:12Z

This PR introduces a wrapper to the virtio-drivers crate like what has been done for virtio-blk. This provides blocking calls to connect close send and recv.

Vsock is more flexible than the serial port as it has the concept of port, and we can reuse vsock for anything else.

I had to make 2 changes to the virtio-drivers crate, the idea is to open a PR in that repo. Before proceeding with the PR, I'd like to take some feedback here, maybe more changes are needed.

To compile it you need to enable the feature vsock and virtio-drivers.

To test it you can use make test-in-svsm

Note: If a vsock device is not attached, svsm will not crash.

aproxy/src/main.rs

kernel/src/attest.rs

stefano-garzarella

Thanks for this PR, I did a quick review and left some comments.
I'll think a bit more about Transport implementation and Vsock, since I'd like to have more abstraction (e.g. be ready to support a new driver for HyperV vsock)

kernel/src/error.rs

kernel/src/vsock/virtio_vsock.rs

scripts/test-in-svsm.sh

aproxy/src/main.rs

scripts/launch_guest.sh

luigix25 · 2025-07-29T12:48:37Z

v2:

Addressed most @stefano-garzarella's comments.
Rebased to latest main to pickup testing: initialize HAS_TEST_IOREQUESTS variable #765 otherwise tests won't run

TODO:

use just one parameter for aproxy
Fix cargo fmt problems

luigix25 · 2025-07-31T09:44:52Z

v3:

Rebased to latest upstream to pickup latest version of attestation's PR.
Addressed all cargo fmt issues

TODO:

comment unsafe blocks
use just one parameter for aproxy
Fix cargo fmt problems

luigix25 · 2025-08-01T11:23:26Z

v4:

Vsock attestation default port can be changed using fw_cfg

TODO:

use just one parameter for aproxy
comment unsafe blocks

kernel/src/attest.rs

aproxy/src/main.rs

luigix25 · 2025-11-03T15:31:56Z

v5:

Dropped fw_cfg usage to change the default vsock attestation port.
Applied all reviewer's suggestions. (Huge thanks to German and Stefano)
Commented unsafe blocks
Applied clippy lints
Rebased on latest main
Fixed some CI issues.

TODO:

Fix VsockStream behavior when hitting EOF

luigix25 · 2025-11-03T16:24:50Z

Looks like CI runner fails to create a vsock listening socket using ncat

luigix25 · 2025-11-04T10:43:40Z

Fixed CI failure.

luigix25 · 2025-11-10T16:19:02Z

Introduced a variable to keep track of the status of every virtio-MMIO slot
Introduced a static variable that contains the vsock driver, so that we only have one for the entire system.
Rebased on latest main

luigix25 · 2026-01-23T14:30:13Z

rebased to latest main and picked up 2024 rust update.

stefano-garzarella · 2026-02-06T13:43:57Z

@luigix25 since we merged #948 , can you rebase this and check initialize_virtio_mmio()?

Merging main or rebasing on it, produces this error (I guess related to #948 changes):

error[E0425]: cannot find value `slots` in this scope
   --> kernel/src/svsm.rs:185:31
    |
185 |         initialize_vsock(&mut slots)?;
    |                               ^^^^^ not found in this scope

kernel/src/vsock/api.rs

virtio-drivers/src/device/socket/connectionmanager.rs

.github/workflows/qemu.yml

kernel/src/vsock/stream.rs

scripts/test-in-svsm.sh

luigix25 · 2026-03-02T11:55:44Z

Addressed all @stefano-garzarella comments:

Port handling is not transport specific anymore
Ports and CID used in tests can be configured
Moved all checks to the highest level possible (stream) to keep changes to the driver as little as possible
Improved documentation and comments
shutdown now takes another parameter (force)

luigix25 · 2026-03-02T11:56:38Z

kernel/src/vsock/mod.rs

+        for _ in 0..MAX_RETRIES {
+            let candidate_port =
+                self.first_free_port
+                    .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |port| {


I'm not sure about this, I'd like some feedback from someone with more experience

germag · 2026-03-02T13:20:17Z

kernel/src/vsock/mod.rs

+                        if port >= u32::MAX - 1 {
+                            Some(VSOCK_MIN_PORT)
+                        } else {
+                            Some(port + 1)
+                        }


could you explain this logic?, is the port u32::MAX reserved?, and if all the ports are assigned, so I'll assume that also VSOCK_MIN_PORT is already assigned why is re-assigned. It's just confusing because that closure never fails (returning None I mean)

could you explain this logic?, is the port u32::MAX reserved?

correct!

so I'll assume that also VSOCK_MIN_PORT is already assigned why is re-assigned. It's just confusing >because that closure never fails (returning None I mean)

Ports can be reused. The idea is that we use the ports sequentially up to u32::MAX, then we start again from VSOCK_MIN_PORT. So yes, in theory port 1024 can be still in use, this is why there is a check and a retry mechanism. But in the meanwhile the connection on those ports could be ended, and it could be used again.

up to u32::MAX

sorry, just to confirm, can you have an u32::MAX port?

u32::MAX is reserved

IIRC in Linux we defined VMADDR_PORT_ANY for that, can we define here those well-know port/cid and use them, instead of hard coding their values ?

luigix25 · 2026-03-23T10:06:50Z

Added VMADDR_PORT_ANY [Stefano/German]
Added missing SPDX headers to virtio-drivers
CID was u64, switched to u32 as it is on 32 bits.
Rebased to lastest main

Define a VsockTransport trait to abstract vsock operations and enable multiple backend implementations. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Commit c4719d3 dropped driver support for virtio-vsock because it was not being used. This reverts this commit because we are introducing vsock support. This revert does not add back the examples/aarch64/main.rs file as it is not needed. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Apply lints suggested by clippy. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

The connection status is not tracked in the `Connection` struct, so there is no way to check whether the handshake has completed. Introduce the `established` field and set it when a `Connected` or `ConnectionRequest` event is successfully handled. Expose it via `is_connection_established()`. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

`send()` and `update_credit()` do not check whether the peer has requested shutdown, allowing operations on a connection that the peer considers closed. Check `peer_requested_shutdown` before proceeding in both methods. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add a function that checks if a local port is in use, either for listening or for a connection. This will be used by VsockDriver to allocate local ports when creating new streams. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add a virtio-vsock wrapper around virtio-drivers. It provides blocking functions for connect, send, recv, shutdown and force_shutdown. To use it you need the `vsock` feature. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add VsockStream struct that provides a high-level stream-oriented interface over the vsock driver API. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add an optional `--vsock cid` parameter. This will attach a virtio-vsock device to the VM. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

In preparation to vsock support, QEMU needs to be configured with vhost support enabled. Without the flag `--enable-vhost-kernel`, QEMU would fail to launch with error: `qemu-system-x86_64: -device vhost-vsock-device,guest-cid=3: 'vhost-vsock-device' is not a valid device model name` This flag is disabled by default because of `--without-default-features` Because no-cc is run as non-root, this causes QEMU to fail with the error: `vhost-vsock: failed to open vhost device: Permission denied"` To fix this, setup permissions to /dev/vhost-vsock for non-root. Add the flag to enable support for vsock in QEMU and install netcat Co-Developed-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Nicola Ramacciotti <niko.ramak@gmail.com>

Add a test that performs some basic checks on vsock functionalities: - double connection - recv a buffer from the host - send a buffer to the host - recv a buffer after local shutdown - send a buffer after local shutdown The vsock server is created on the host using ncat. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

luigix25 · 2026-03-23T11:25:03Z

Fixed CI failure because no-cc by default is now run as non-root and /dev/vhost-vsock requires root access.
Added a chmod step in the workflow.

luigix25 commented Jul 28, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

stefano-garzarella added the needs-rebase The PR needs to be rebased to the latest upstream branch label Jul 29, 2025

stefano-garzarella reviewed Jul 29, 2025

View reviewed changes

luigix25 force-pushed the vsock_attestation branch from e0d157e to 82976c4 Compare July 29, 2025 12:42

luigix25 force-pushed the vsock_attestation branch from 82976c4 to 08ff85f Compare July 31, 2025 09:42

luigix25 force-pushed the vsock_attestation branch from 08ff85f to 9f5553e Compare August 1, 2025 11:18

germag reviewed Aug 4, 2025

View reviewed changes

kernel/src/attest.rs Outdated Show resolved Hide resolved

germag reviewed Aug 4, 2025

View reviewed changes

kernel/src/attest.rs Outdated Show resolved Hide resolved

luigix25 mentioned this pull request Aug 5, 2025

kernel/platform: Add mmio support for native platform #775

Merged

germag reviewed Aug 5, 2025

View reviewed changes

kernel/src/attest.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

germag reviewed Aug 5, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

germag reviewed Aug 6, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

aproxy/src/main.rs Outdated Show resolved Hide resolved

germag reviewed Aug 6, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

stefano-garzarella added in-review PR is under active review and not yet approved and removed needs-rebase The PR needs to be rebased to the latest upstream branch labels Aug 6, 2025

stefano-garzarella added the needs-rebase The PR needs to be rebased to the latest upstream branch label Sep 22, 2025

luigix25 force-pushed the vsock_attestation branch 3 times, most recently from ca7e076 to 3bc1d0b Compare November 3, 2025 15:29

luigix25 force-pushed the vsock_attestation branch from 3bc1d0b to f9a59be Compare November 4, 2025 10:27

luigix25 force-pushed the vsock_attestation branch from f9a59be to 31df19c Compare November 10, 2025 16:16

luigix25 changed the title ~~[RFC] Introduce Virtio-Vsock support for attestation.~~ Introduce Virtio-Vsock support for attestation. Nov 10, 2025

luigix25 marked this pull request as ready for review November 10, 2025 16:21

luigix25 force-pushed the vsock_attestation branch 2 times, most recently from 161527b to ef04aef Compare January 23, 2026 13:24

luigix25 mentioned this pull request Jan 26, 2026

virtio/mmio: move fw_cfg check into probe_mmio_slots() #948

Merged

stefano-garzarella added the needs-rebase The PR needs to be rebased to the latest upstream branch label Feb 6, 2026

stefano-garzarella requested changes Feb 6, 2026

View reviewed changes

stefano-garzarella added wait-for-update PR is waiting to be updated to address review comments and removed needs-rebase The PR needs to be rebased to the latest upstream branch labels Feb 12, 2026

luigix25 force-pushed the vsock_attestation branch from ef04aef to a14dca2 Compare March 2, 2026 11:52

luigix25 commented Mar 2, 2026

View reviewed changes

luigix25 removed the wait-for-update PR is waiting to be updated to address review comments label Mar 2, 2026

germag reviewed Mar 2, 2026

View reviewed changes

luigix25 force-pushed the vsock_attestation branch from a14dca2 to 0dd8620 Compare March 23, 2026 10:06

luigix25 added 9 commits March 23, 2026 11:24

kernel: introduce VsockTransport trait for driver abstraction

eb3e018

Define a VsockTransport trait to abstract vsock operations and enable multiple backend implementations. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

virtio-drivers/socket: apply clippy lints

f6dd194

Apply lints suggested by clippy. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

kernel/vsock: introduce virtio-vsock support

3f51a21

Add a virtio-vsock wrapper around virtio-drivers. It provides blocking functions for connect, send, recv, shutdown and force_shutdown. To use it you need the `vsock` feature. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

kernel/vsock: introduce VsockStream

4080f76

Add VsockStream struct that provides a high-level stream-oriented interface over the vsock driver API. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

scripts/launch_guest: add vsock to launch_guest

ea845cd

Add an optional `--vsock cid` parameter. This will attach a virtio-vsock device to the VM. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

luigix25 force-pushed the vsock_attestation branch from 0dd8620 to 3dcc259 Compare March 23, 2026 10:25

n-ramacciotti and others added 2 commits March 23, 2026 12:13

luigix25 force-pushed the vsock_attestation branch from 3dcc259 to 831ed1c Compare March 23, 2026 11:22

Conversation

luigix25 commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stefano-garzarella left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

luigix25 commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luigix25 commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luigix25 commented Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

luigix25 commented Nov 3, 2025

Uh oh!

luigix25 commented Nov 3, 2025

Uh oh!

luigix25 commented Nov 4, 2025

Uh oh!

luigix25 commented Nov 10, 2025

Uh oh!

luigix25 commented Jan 23, 2026

Uh oh!

stefano-garzarella commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

luigix25 commented Mar 2, 2026

Uh oh!

luigix25 Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

germag Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

luigix25 Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

germag Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

luigix25 Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

stefano-garzarella Mar 2, 2026

Choose a reason for hiding this comment

luigix25 commented Jul 28, 2025 •

edited

Loading

luigix25 commented Jul 29, 2025 •

edited

Loading

luigix25 commented Jul 31, 2025 •

edited

Loading

luigix25 commented Aug 1, 2025 •

edited

Loading

stefano-garzarella commented Feb 6, 2026 •

edited

Loading

germag Mar 2, 2026 •

edited

Loading

luigix25 commented Mar 23, 2026 •

edited

Loading