Introduce Virtio-Vsock support by luigix25 · Pull Request #766 · coconut-svsm/svsm

luigix25 · 2025-07-28T13:16:12Z

This PR introduces a wrapper to the virtio-drivers crate like what has been done for virtio-blk. This provides blocking calls to connect close send and recv.

Vsock is more flexible than the serial port as it has the concept of port, and we can reuse vsock for anything else.

I had to make 2 changes to the virtio-drivers crate, the idea is to open a PR in that repo. Before proceeding with the PR, I'd like to take some feedback here, maybe more changes are needed.

To compile it you need to enable the feature vsock and virtio-drivers.

To test it you can use make test-in-svsm

Note: If a vsock device is not attached, svsm will not crash.

aproxy/src/main.rs

kernel/src/attest.rs

stefano-garzarella

Thanks for this PR, I did a quick review and left some comments.
I'll think a bit more about Transport implementation and Vsock, since I'd like to have more abstraction (e.g. be ready to support a new driver for HyperV vsock)

kernel/src/error.rs

kernel/src/vsock/virtio_vsock.rs

scripts/test-in-svsm.sh

aproxy/src/main.rs

scripts/launch_guest.sh

luigix25 · 2025-07-29T12:48:37Z

v2:

Addressed most @stefano-garzarella's comments.
Rebased to latest main to pickup testing: initialize HAS_TEST_IOREQUESTS variable #765 otherwise tests won't run

TODO:

use just one parameter for aproxy
Fix cargo fmt problems

luigix25 · 2025-07-31T09:44:52Z

v3:

Rebased to latest upstream to pickup latest version of attestation's PR.
Addressed all cargo fmt issues

TODO:

comment unsafe blocks
use just one parameter for aproxy
Fix cargo fmt problems

luigix25 · 2025-08-01T11:23:26Z

v4:

Vsock attestation default port can be changed using fw_cfg

TODO:

use just one parameter for aproxy
comment unsafe blocks

kernel/src/attest.rs

aproxy/src/main.rs

luigix25 · 2025-11-03T15:31:56Z

v5:

Dropped fw_cfg usage to change the default vsock attestation port.
Applied all reviewer's suggestions. (Huge thanks to German and Stefano)
Commented unsafe blocks
Applied clippy lints
Rebased on latest main
Fixed some CI issues.

TODO:

Fix VsockStream behavior when hitting EOF

luigix25 · 2025-11-03T16:24:50Z

Looks like CI runner fails to create a vsock listening socket using ncat

luigix25 · 2025-11-04T10:43:40Z

Fixed CI failure.

luigix25 · 2025-11-10T16:19:02Z

Introduced a variable to keep track of the status of every virtio-MMIO slot
Introduced a static variable that contains the vsock driver, so that we only have one for the entire system.
Rebased on latest main

luigix25 · 2026-03-02T11:55:44Z

Addressed all @stefano-garzarella comments:

Port handling is not transport specific anymore
Ports and CID used in tests can be configured
Moved all checks to the highest level possible (stream) to keep changes to the driver as little as possible
Improved documentation and comments
shutdown now takes another parameter (force)

luigix25 · 2026-03-02T11:56:38Z

kernel/src/vsock/mod.rs

+        for _ in 0..MAX_RETRIES {
+            let candidate_port =
+                self.first_free_port
+                    .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |port| {


I'm not sure about this, I'd like some feedback from someone with more experience

kernel/src/vsock/mod.rs

luigix25 · 2026-03-23T10:06:50Z

Added VMADDR_PORT_ANY [Stefano/German]
Added missing SPDX headers to virtio-drivers
CID was u64, switched to u32 as it is on 32 bits.
Rebased to lastest main

luigix25 · 2026-03-23T11:25:03Z

Fixed CI failure because no-cc by default is now run as non-root and /dev/vhost-vsock requires root access.
Added a chmod step in the workflow.

Define a VsockTransport trait to abstract vsock operations and enable multiple backend implementations. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Commit c4719d3 dropped driver support for virtio-vsock because it was not being used. This reverts this commit because we are introducing vsock support. This revert does not add back the examples/aarch64/main.rs file as it is not needed. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Apply lints suggested by clippy. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

The connection status is not tracked in the `Connection` struct, so there is no way to check whether the handshake has completed. Introduce the `established` field and set it when a `Connected` or `ConnectionRequest` event is successfully handled. Expose it via `is_connection_established()`. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

`send()` and `update_credit()` do not check whether the peer has requested shutdown, allowing operations on a connection that the peer considers closed. Check `peer_requested_shutdown` before proceeding in both methods. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add a function that checks if a local port is in use, either for listening or for a connection. This will be used by VsockDriver to allocate local ports when creating new streams. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

kernel/src/vsock/virtio_vsock.rs

kernel/src/vsock/api.rs

00xc · 2026-04-02T13:32:00Z

kernel/src/vsock/stream.rs

+    /// - The VSOCK device is not available (`VsockError::DriverError`)
+    /// - The connection is already shutdown (`VsockError::SocketShutdown`)
+    /// - The shutdown operation fails
+    pub fn shutdown(&mut self) -> Result<(), SvsmError> {


Are there any users that require manually shutting down the stream? If not, then I would suggest moving all of this into Drop. This would make it impossible to use the stream after it is closed. This should also help deduplicate the logic that is already present in Drop and in this method (e.g. VSOCK_DEVICE.shutdown()).

My idea was to replicate this https://docs.rs/vsock/latest/vsock/struct.VsockStream.html

But yes, it would simplify the logic indeed.

I guess it's also a matter of taste, but a big thing in Rust is to make invalid states unrepresentable. Another option would be to make shutdown() take self instead of &mut self, having the method consume the type. But then again, I don't know if there are any valid use cases where you want to use again the struct after shutdown.

I'll keep this open for now, so other reviewers can share their feedback

kernel/src/vsock/stream.rs

kernel/src/vsock/virtio_vsock.rs

kernel/src/error.rs

luigix25 · 2026-04-07T10:21:55Z

Addressed comments from @00xc

Dropped VsockError conversion
Added a comment for VirtIOVsockDriver::new
Improved doc for VsockStream::close, hope now it's clear.
Packed all impl for VirtIOVsockDriver

Add a virtio-vsock wrapper around virtio-drivers. It provides blocking functions for connect, send, recv, shutdown and force_shutdown. To use it you need the `vsock` feature. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add VsockStream struct that provides a high-level stream-oriented interface over the vsock driver API. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

Add an optional `--vsock cid` parameter. This will attach a virtio-vsock device to the VM. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

In preparation to vsock support, QEMU needs to be configured with vhost support enabled. Without the flag `--enable-vhost-kernel`, QEMU would fail to launch with error: `qemu-system-x86_64: -device vhost-vsock-device,guest-cid=3: 'vhost-vsock-device' is not a valid device model name` This flag is disabled by default because of `--without-default-features` Because no-cc is run as non-root, this causes QEMU to fail with the error: `vhost-vsock: failed to open vhost device: Permission denied"` To fix this, setup permissions to /dev/vhost-vsock for non-root. Add the flag to enable support for vsock in QEMU and install netcat Co-Developed-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Luigi Leonardi <leonardi@redhat.com> Signed-off-by: Nicola Ramacciotti <niko.ramak@gmail.com>

Add a test that performs some basic checks on vsock functionalities: - double connection - recv a buffer from the host - send a buffer to the host - recv a buffer after local shutdown - send a buffer after local shutdown The vsock server is created on the host using ncat. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

luigix25 commented Jul 28, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

stefano-garzarella added the needs-rebase The PR needs to be rebased to the latest upstream branch label Jul 29, 2025

stefano-garzarella reviewed Jul 29, 2025

View reviewed changes

luigix25 force-pushed the vsock_attestation branch from e0d157e to 82976c4 Compare July 29, 2025 12:42

luigix25 force-pushed the vsock_attestation branch from 82976c4 to 08ff85f Compare July 31, 2025 09:42

luigix25 force-pushed the vsock_attestation branch from 08ff85f to 9f5553e Compare August 1, 2025 11:18

germag reviewed Aug 4, 2025

View reviewed changes

kernel/src/attest.rs Outdated Show resolved Hide resolved

germag reviewed Aug 4, 2025

View reviewed changes

kernel/src/attest.rs Outdated Show resolved Hide resolved

luigix25 mentioned this pull request Aug 5, 2025

kernel/platform: Add mmio support for native platform #775

Merged

germag reviewed Aug 5, 2025

View reviewed changes

kernel/src/attest.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

kernel/src/attest.rs Outdated Show resolved Hide resolved

germag reviewed Aug 5, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

germag reviewed Aug 6, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

aproxy/src/main.rs Outdated Show resolved Hide resolved

germag reviewed Aug 6, 2025

View reviewed changes

aproxy/src/main.rs Outdated Show resolved Hide resolved

stefano-garzarella added in-review PR is under active review and not yet approved and removed needs-rebase The PR needs to be rebased to the latest upstream branch labels Aug 6, 2025

stefano-garzarella added the needs-rebase The PR needs to be rebased to the latest upstream branch label Sep 22, 2025

luigix25 force-pushed the vsock_attestation branch 3 times, most recently from ca7e076 to 3bc1d0b Compare November 3, 2025 15:29

luigix25 force-pushed the vsock_attestation branch from 3bc1d0b to f9a59be Compare November 4, 2025 10:27

luigix25 force-pushed the vsock_attestation branch from f9a59be to 31df19c Compare November 10, 2025 16:16

luigix25 changed the title ~~[RFC] Introduce Virtio-Vsock support for attestation.~~ Introduce Virtio-Vsock support for attestation. Nov 10, 2025

luigix25 marked this pull request as ready for review November 10, 2025 16:21

stefano-garzarella added wait-for-update PR is waiting to be updated to address review comments and removed needs-rebase The PR needs to be rebased to the latest upstream branch labels Feb 12, 2026

luigix25 force-pushed the vsock_attestation branch from ef04aef to a14dca2 Compare March 2, 2026 11:52

luigix25 commented Mar 2, 2026

View reviewed changes

luigix25 removed the wait-for-update PR is waiting to be updated to address review comments label Mar 2, 2026

germag reviewed Mar 2, 2026

View reviewed changes

kernel/src/vsock/mod.rs Outdated Show resolved Hide resolved

luigix25 force-pushed the vsock_attestation branch from a14dca2 to 0dd8620 Compare March 23, 2026 10:06

luigix25 force-pushed the vsock_attestation branch 2 times, most recently from 3dcc259 to 831ed1c Compare March 23, 2026 11:22

stefano-garzarella added the needs-rebase The PR needs to be rebased to the latest upstream branch label Mar 31, 2026

luigix25 added 6 commits April 2, 2026 13:09

kernel: introduce VsockTransport trait for driver abstraction

1e2e398

Define a VsockTransport trait to abstract vsock operations and enable multiple backend implementations. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

virtio-drivers/socket: apply clippy lints

cc666cc

Apply lints suggested by clippy. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

luigix25 force-pushed the vsock_attestation branch from 831ed1c to 6283c7c Compare April 2, 2026 11:26

luigix25 removed the needs-rebase The PR needs to be rebased to the latest upstream branch label Apr 2, 2026

00xc reviewed Apr 2, 2026

View reviewed changes

luigix25 force-pushed the vsock_attestation branch from 6283c7c to 2e119f4 Compare April 7, 2026 10:18

luigix25 and others added 5 commits April 7, 2026 12:23

kernel/vsock: introduce virtio-vsock support

24ed595

Add a virtio-vsock wrapper around virtio-drivers. It provides blocking functions for connect, send, recv, shutdown and force_shutdown. To use it you need the `vsock` feature. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

kernel/vsock: introduce VsockStream

c37e01f

Add VsockStream struct that provides a high-level stream-oriented interface over the vsock driver API. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

scripts/launch_guest: add vsock to launch_guest

38118a1

Add an optional `--vsock cid` parameter. This will attach a virtio-vsock device to the VM. Signed-off-by: Luigi Leonardi <leonardi@redhat.com>

luigix25 force-pushed the vsock_attestation branch from 2e119f4 to 97efe54 Compare April 7, 2026 10:23

Conversation

luigix25 commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stefano-garzarella left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

luigix25 commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luigix25 commented Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luigix25 commented Aug 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

luigix25 commented Nov 3, 2025

Uh oh!

luigix25 commented Nov 3, 2025

Uh oh!

luigix25 commented Nov 4, 2025

Uh oh!

luigix25 commented Nov 10, 2025

Uh oh!

luigix25 commented Mar 2, 2026

Uh oh!

luigix25 Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

luigix25 commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

luigix25 commented Mar 23, 2026

Uh oh!

Uh oh!

Uh oh!

00xc Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

luigix25 Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

00xc Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

luigix25 Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

luigix25 commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

luigix25 commented Jul 28, 2025 •

edited

Loading

luigix25 commented Jul 29, 2025 •

edited

Loading

luigix25 commented Jul 31, 2025 •

edited

Loading

luigix25 commented Aug 1, 2025 •

edited

Loading

luigix25 commented Mar 23, 2026 •

edited

Loading

00xc Apr 3, 2026 •

edited

Loading

luigix25 commented Apr 7, 2026 •

edited

Loading