MAINTAINERS | 1 + drivers/vhost/vsock.c | 48 +- include/linux/virtio_vsock.h | 12 + include/net/af_vsock.h | 59 +- include/net/net_namespace.h | 4 + include/net/netns/vsock.h | 21 + net/vmw_vsock/af_vsock.c | 204 +++++- net/vmw_vsock/hyperv_transport.c | 2 +- net/vmw_vsock/virtio_transport.c | 5 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 4 +- net/vmw_vsock/vsock_loopback.c | 59 +- tools/testing/selftests/vsock/vmtest.sh | 1088 ++++++++++++++++++++++++++----- 13 files changed, 1330 insertions(+), 191 deletions(-)
This series adds namespace support to vhost-vsock. It does not add
namespaces to any of the guest transports (virtio-vsock, hyperv, or
vmci).
The current revision only supports two modes: local or global. Local
mode is complete isolation of namespaces, while global mode is complete
sharing between namespaces of CIDs (the original behavior).
Future may include supporting a mixed mode, which I expect to be more
complicated because socket lookups will have to include new logic and
API changes to behave differently based on if the lookup is part of a
mixed mode CID allocation, a global CID allocation, a mixed-to-global
connection (allowed), or a global-to-mixed connection (not allowed).
Modes are per-netns and write-once. This allows a system to configure
namespaces independently (some may share CIDs, others are completely
isolated). This also supports future mixed use cases, where there may be
namespaces in global mode spinning up VMs while there are
mixed mode namespaces that provide services to the VMs, but are not
allowed to allocate from the global CID pool.
Thanks again for everyone's help and reviews!
Signed-off-by: Bobby Eshleman <bobbyeshleman@gmail.com>
To: Stefano Garzarella <sgarzare@redhat.com>
To: Shuah Khan <shuah@kernel.org>
To: David S. Miller <davem@davemloft.net>
To: Eric Dumazet <edumazet@google.com>
To: Jakub Kicinski <kuba@kernel.org>
To: Paolo Abeni <pabeni@redhat.com>
To: Simon Horman <horms@kernel.org>
To: Stefan Hajnoczi <stefanha@redhat.com>
To: Michael S. Tsirkin <mst@redhat.com>
To: Jason Wang <jasowang@redhat.com>
To: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
To: Eugenio Pérez <eperezma@redhat.com>
To: K. Y. Srinivasan <kys@microsoft.com>
To: Haiyang Zhang <haiyangz@microsoft.com>
To: Wei Liu <wei.liu@kernel.org>
To: Dexuan Cui <decui@microsoft.com>
To: Bryan Tan <bryan-bt.tan@broadcom.com>
To: Vishnu Dasa <vishnu.dasa@broadcom.com>
To: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
Cc: virtualization@lists.linux.dev
Cc: netdev@vger.kernel.org
Cc: linux-kselftest@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-hyperv@vger.kernel.org
Cc: berrange@redhat.com
Changes in v4:
- removed RFC tag
- implemented loopback support
- renamed new tests to better reflect behavior
- completed suite of tests with permutations of ns modes and vsock_test
as guest/host
- simplified socat bridging with unix socket instead of tcp + veth
- only use vsock_test for success case, socat for failure case (context
in commit message)
- lots of cleanup
Changes in v3:
- add notion of "modes"
- add procfs /proc/net/vsock_ns_mode
- local and global modes only
- no /dev/vhost-vsock-netns
- vmtest.sh already merged, so new patch just adds new tests for NS
- Link to v2:
https://lore.kernel.org/kvm/20250312-vsock-netns-v2-0-84bffa1aa97a@gmail.com
Changes in v2:
- only support vhost-vsock namespaces
- all g2h namespaces retain old behavior, only common API changes
impacted by vhost-vsock changes
- add /dev/vhost-vsock-netns for "opt-in"
- leave /dev/vhost-vsock to old behavior
- removed netns module param
- Link to v1:
https://lore.kernel.org/r/20200116172428.311437-1-sgarzare@redhat.com
Changes in v1:
- added 'netns' module param to vsock.ko to enable the
network namespace support (disabled by default)
- added 'vsock_net_eq()' to check the "net" assigned to a socket
only when 'netns' support is enabled
- Link to RFC: https://patchwork.ozlabs.org/cover/1202235/
---
Bobby Eshleman (12):
vsock: a per-net vsock NS mode state
vsock: add net to vsock skb cb
vsock: add netns to af_vsock core
vsock/virtio: add netns to virtio transport common
vhost/vsock: add netns support
vsock/virtio: use the global netns
hv_sock: add netns hooks
vsock/vmci: add netns hooks
vsock/loopback: add netns support
selftests/vsock: improve logging in vmtest.sh
selftests/vsock: invoke vsock_test through helpers
selftests/vsock: add namespace tests
MAINTAINERS | 1 +
drivers/vhost/vsock.c | 48 +-
include/linux/virtio_vsock.h | 12 +
include/net/af_vsock.h | 59 +-
include/net/net_namespace.h | 4 +
include/net/netns/vsock.h | 21 +
net/vmw_vsock/af_vsock.c | 204 +++++-
net/vmw_vsock/hyperv_transport.c | 2 +-
net/vmw_vsock/virtio_transport.c | 5 +-
net/vmw_vsock/virtio_transport_common.c | 14 +-
net/vmw_vsock/vmci_transport.c | 4 +-
net/vmw_vsock/vsock_loopback.c | 59 +-
tools/testing/selftests/vsock/vmtest.sh | 1088 ++++++++++++++++++++++++++-----
13 files changed, 1330 insertions(+), 191 deletions(-)
---
base-commit: dd500e4aecf25e48e874ca7628697969df679493
change-id: 20250325-vsock-vmtest-b3a21d2102c2
Best regards,
--
Bobby Eshleman <bobbyeshleman@meta.com>
On Tue, Aug 05, 2025 at 02:49:08PM -0700, Bobby Eshleman wrote: ... > > Thanks again for everyone's help and reviews! > > > Changes in v4: > - removed RFC tag My bad, I didn't notice I still had the rfc tag before sending out with b4. This is ready for review and not really an RFC. All test cases passing, etc... -Bobby
On Tue, Aug 05, 2025 at 03:03:37PM -0700, Bobby Eshleman wrote: > On Tue, Aug 05, 2025 at 02:49:08PM -0700, Bobby Eshleman wrote: > > ... > > > > > Thanks again for everyone's help and reviews! > > > > > > Changes in v4: > > - removed RFC tag > > My bad, I didn't notice I still had the rfc tag before sending out with > b4. > > This is ready for review and not really an RFC. All test cases passing, > etc... Ack. But net-next is currently closed for the merge-window. So please don't post non-RFC patches for it until it reopens, around the 11th August.
On Wed, Aug 06, 2025 at 08:13:48PM +0100, Simon Horman wrote: > On Tue, Aug 05, 2025 at 03:03:37PM -0700, Bobby Eshleman wrote: > > On Tue, Aug 05, 2025 at 02:49:08PM -0700, Bobby Eshleman wrote: ... > > Ack. But net-next is currently closed for the merge-window. > > So please don't post non-RFC patches for it until it reopens, > around the 11th August. Got it, thanks!
Hi Bobby, On Tue, Aug 05, 2025 at 02:49:08PM -0700, Bobby Eshleman wrote: >This series adds namespace support to vhost-vsock. It does not add >namespaces to any of the guest transports (virtio-vsock, hyperv, or >vmci). > >The current revision only supports two modes: local or global. Local >mode is complete isolation of namespaces, while global mode is complete >sharing between namespaces of CIDs (the original behavior). > >Future may include supporting a mixed mode, which I expect to be more >complicated because socket lookups will have to include new logic and >API changes to behave differently based on if the lookup is part of a >mixed mode CID allocation, a global CID allocation, a mixed-to-global >connection (allowed), or a global-to-mixed connection (not allowed). > >Modes are per-netns and write-once. This allows a system to configure >namespaces independently (some may share CIDs, others are completely >isolated). This also supports future mixed use cases, where there may >be >namespaces in global mode spinning up VMs while there are >mixed mode namespaces that provide services to the VMs, but are not >allowed to allocate from the global CID pool. > >Thanks again for everyone's help and reviews! Thanks for your work! As I mentioned to you, I'll be off for the next 2 weeks, so I'll take a look when I'm back, but feel free to send new versions if you receive enough comments on this. Thanks, Stefano > >Signed-off-by: Bobby Eshleman <bobbyeshleman@gmail.com> >To: Stefano Garzarella <sgarzare@redhat.com> >To: Shuah Khan <shuah@kernel.org> >To: David S. Miller <davem@davemloft.net> >To: Eric Dumazet <edumazet@google.com> >To: Jakub Kicinski <kuba@kernel.org> >To: Paolo Abeni <pabeni@redhat.com> >To: Simon Horman <horms@kernel.org> >To: Stefan Hajnoczi <stefanha@redhat.com> >To: Michael S. Tsirkin <mst@redhat.com> >To: Jason Wang <jasowang@redhat.com> >To: Xuan Zhuo <xuanzhuo@linux.alibaba.com> >To: Eugenio Pérez <eperezma@redhat.com> >To: K. Y. Srinivasan <kys@microsoft.com> >To: Haiyang Zhang <haiyangz@microsoft.com> >To: Wei Liu <wei.liu@kernel.org> >To: Dexuan Cui <decui@microsoft.com> >To: Bryan Tan <bryan-bt.tan@broadcom.com> >To: Vishnu Dasa <vishnu.dasa@broadcom.com> >To: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com> >Cc: virtualization@lists.linux.dev >Cc: netdev@vger.kernel.org >Cc: linux-kselftest@vger.kernel.org >Cc: linux-kernel@vger.kernel.org >Cc: kvm@vger.kernel.org >Cc: linux-hyperv@vger.kernel.org >Cc: berrange@redhat.com > >Changes in v4: >- removed RFC tag >- implemented loopback support >- renamed new tests to better reflect behavior >- completed suite of tests with permutations of ns modes and vsock_test > as guest/host >- simplified socat bridging with unix socket instead of tcp + veth >- only use vsock_test for success case, socat for failure case (context > in commit message) >- lots of cleanup > >Changes in v3: >- add notion of "modes" >- add procfs /proc/net/vsock_ns_mode >- local and global modes only >- no /dev/vhost-vsock-netns >- vmtest.sh already merged, so new patch just adds new tests for NS >- Link to v2: > https://lore.kernel.org/kvm/20250312-vsock-netns-v2-0-84bffa1aa97a@gmail.com > >Changes in v2: >- only support vhost-vsock namespaces >- all g2h namespaces retain old behavior, only common API changes > impacted by vhost-vsock changes >- add /dev/vhost-vsock-netns for "opt-in" >- leave /dev/vhost-vsock to old behavior >- removed netns module param >- Link to v1: > https://lore.kernel.org/r/20200116172428.311437-1-sgarzare@redhat.com > >Changes in v1: >- added 'netns' module param to vsock.ko to enable the > network namespace support (disabled by default) >- added 'vsock_net_eq()' to check the "net" assigned to a socket > only when 'netns' support is enabled >- Link to RFC: https://patchwork.ozlabs.org/cover/1202235/ > >--- >Bobby Eshleman (12): > vsock: a per-net vsock NS mode state > vsock: add net to vsock skb cb > vsock: add netns to af_vsock core > vsock/virtio: add netns to virtio transport common > vhost/vsock: add netns support > vsock/virtio: use the global netns > hv_sock: add netns hooks > vsock/vmci: add netns hooks > vsock/loopback: add netns support > selftests/vsock: improve logging in vmtest.sh > selftests/vsock: invoke vsock_test through helpers > selftests/vsock: add namespace tests > > MAINTAINERS | 1 + > drivers/vhost/vsock.c | 48 +- > include/linux/virtio_vsock.h | 12 + > include/net/af_vsock.h | 59 +- > include/net/net_namespace.h | 4 + > include/net/netns/vsock.h | 21 + > net/vmw_vsock/af_vsock.c | 204 +++++- > net/vmw_vsock/hyperv_transport.c | 2 +- > net/vmw_vsock/virtio_transport.c | 5 +- > net/vmw_vsock/virtio_transport_common.c | 14 +- > net/vmw_vsock/vmci_transport.c | 4 +- > net/vmw_vsock/vsock_loopback.c | 59 +- > tools/testing/selftests/vsock/vmtest.sh | 1088 ++++++++++++++++++++++++++----- > 13 files changed, 1330 insertions(+), 191 deletions(-) >--- >base-commit: dd500e4aecf25e48e874ca7628697969df679493 >change-id: 20250325-vsock-vmtest-b3a21d2102c2 > >Best regards, >-- >Bobby Eshleman <bobbyeshleman@meta.com> >
On Thu, Aug 07, 2025 at 10:06:35AM +0200, Stefano Garzarella wrote: > Hi Bobby, > ... > > Thanks for your work! > > As I mentioned to you, I'll be off for the next 2 weeks, so I'll take a look > when I'm back, but feel free to send new versions if you receive enough > comments on this. > > Thanks, > Stefano > Thanks Stefano, enjoy your time off! Best, Bobby
© 2016 - 2025 Red Hat, Inc.