nitro: Don't listen on enclave vsock for console

Since the nitro enclave CID is returned to the caller, the caller can be
responsible for setting up the vsock to read enclave console output.

Signed-off-by: Tyler Fanelli <[email protected]>

Author: tylerfanelli

src/libkrun/src/lib.rs

@@ -12,8 +12,6 @@ use std::fs::File;
 #[cfg(target_os = "linux")]
 use std::os::fd::AsRawFd;
 use std::os::fd::{FromRawFd, RawFd};
-#[cfg(feature = "nitro")]
-use std::os::unix::net::UnixStream;
 use std::path::PathBuf;
 use std::slice;
 use std::sync::atomic::{AtomicI32, Ordering};
@@ -325,31 +323,10 @@ impl TryFrom<ContextConfig> for NitroEnclave {
             return Err(-libc::EINVAL);
         };
 
-        let Some(port_map) = ctx.unix_ipc_port_map else {
-            error!("enclave vsock not configured");
-            return Err(-libc::EINVAL);
-        };
-
-        if port_map.len() > 1 {
-            error!("too many nitro vsocks detected (max 1)");
-            return Err(-libc::EINVAL);
-        }
-
-        let ipc_stream = {
-            let mut vec = Vec::from_iter(port_map.values());
-            let Some((path, _)) = vec.pop() else {
-                error!("enclave vsock path not found");
-                return Err(-libc::EINVAL);
-            };
-
-            UnixStream::connect(path).unwrap()
-        };
-
         Ok(Self {
             image,
             mem_size_mib,
             vcpus,
-            ipc_stream,
             start_flags: ctx.nitro_start_flags,
         })
     }

src/nitro/src/enclaves.rs

@@ -5,33 +5,19 @@ use nitro_enclaves::{
     launch::{ImageType, Launcher, MemoryInfo, PollTimeout, StartFlags},
     Device,
 };
-use nix::{
-    poll::{poll, PollFd, PollFlags},
-    sys::{
-        socket::{connect, socket, AddressFamily, SockFlag, SockType, VsockAddr as NixVsockAddr},
-        time::{TimeVal, TimeValLike},
-    },
-    unistd::read,
-};
+use nix::poll::{poll, PollFd, PollFlags};
 use std::{
     fs::File,
     io::{Read, Write},
-    os::{
-        fd::{AsRawFd, RawFd},
-        unix::net::UnixStream,
-    },
+    os::fd::AsRawFd,
 };
 use vsock::{VsockAddr, VsockListener};
 
 type Result<T> = std::result::Result<T, NitroError>;
 
 const ENCLAVE_READY_VSOCK_PORT: u32 = 9000;
-const CID_TO_CONSOLE_PORT_OFFSET: u32 = 10000;
 
 const VMADDR_CID_PARENT: u32 = 3;
-const VMADDR_CID_HYPERVISOR: u32 = 0;
-
-const SO_VM_SOCKETS_CONNECT_TIMEOUT: i32 = 6;
 
 const HEART_BEAT: u8 = 0xb7;
 
@@ -43,8 +29,6 @@ pub struct NitroEnclave {
     pub mem_size_mib: usize,
     /// Number of vCPUs.
     pub vcpus: u8,
-    /// Path of vsock for initial enclave communication.
-    pub ipc_stream: UnixStream,
     /// Enclave start flags.
     pub start_flags: StartFlags,
 }
@@ -78,45 +62,8 @@ impl NitroEnclave {
 
         enclave_check(listener, poll_timeout.into(), cid)?;
 
-        self.listen(VMADDR_CID_HYPERVISOR, cid + CID_TO_CONSOLE_PORT_OFFSET)?;
-
         Ok(cid)
     }
-
-    fn listen(&mut self, cid: u32, port: u32) -> Result<()> {
-        let socket_fd = socket(
-            AddressFamily::Vsock,
-            SockType::Stream,
-            SockFlag::empty(),
-            None,
-        )
-        .map_err(|_| NitroError::VsockCreate)?;
-
-        let sockaddr = NixVsockAddr::new(cid, port);
-
-        vsock_timeout(socket_fd)?;
-
-        connect(socket_fd, &sockaddr).map_err(|_| NitroError::VsockConnect)?;
-
-        let mut buf = [0u8; 512];
-        loop {
-            // Read debug output from vsock.
-            if let Ok(sz) = read(socket_fd, &mut buf) {
-                // If there is enclave debug output read, write it to the IPC socket.
-                if sz > 0 {
-                    self.ipc_stream
-                        .write_all(&buf[..sz])
-                        .map_err(NitroError::IpcWrite)?;
-
-                    continue;
-                }
-            }
-
-            break;
-        }
-
-        Ok(())
-    }
 }
 
 fn enclave_check(listener: VsockListener, poll_timeout_ms: libc::c_int, cid: u32) -> Result<()> {
@@ -148,24 +95,3 @@ fn enclave_check(listener: VsockListener, poll_timeout_ms: libc::c_int, cid: u32
 
     Ok(())
 }
-
-fn vsock_timeout(socket_fd: RawFd) -> Result<()> {
-    // Set the timeout to 20 seconds.
-    let timeval = TimeVal::milliseconds(20000);
-
-    let ret = unsafe {
-        libc::setsockopt(
-            socket_fd,
-            libc::AF_VSOCK,
-            SO_VM_SOCKETS_CONNECT_TIMEOUT,
-            &timeval as *const _ as *const libc::c_void,
-            size_of::<TimeVal>() as u32,
-        )
-    };
-
-    if ret != 0 {
-        return Err(NitroError::VsockSetTimeout);
-    }
-
-    Ok(())
-}