From nobody Sun Oct 5 12:48:08 2025 Received: from mail-pf1-f169.google.com (mail-pf1-f169.google.com [209.85.210.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6993429ACFD; Tue, 5 Aug 2025 21:49:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754430563; cv=none; b=N/zcuzBG6q6RpVxVrXHfamQkmaDHZKz039QE9DLO6vAGKerpw6CTQAYpsJ2msVzs7SZjAIjUzn9Inj+ybhOG95cfjlp8ggawtHKSP9XFzYi4XEKLOvxKeytu+LVv/eG0E47uvccu5EbKQhJ8BnSAnrPH4udy51Iti2Sv+xzDUMQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1754430563; c=relaxed/simple; bh=4nOiUR2yclelPvjzHls90OB1HWOtZ8j4Fd2CwpbPgy8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZjH82assKEdswV3ZwPjWdqZxjDU3IUDbox6SYeWgTBrNuVxuqEgU6WNy6HC5FaW62eGq7cIFvRoaVeNi7siorsJL9IlsdtwrX+u+ki7brGuWfN3S1WhqLDIfcxiTFqUW8uTxAkkpqOyHKGoI3tGgcupUF81V9uBXDiRGUpu/Obg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lOX4Y6My; arc=none smtp.client-ip=209.85.210.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lOX4Y6My" Received: by mail-pf1-f169.google.com with SMTP id d2e1a72fcca58-76a3818eb9bso4346293b3a.3; Tue, 05 Aug 2025 14:49:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1754430561; x=1755035361; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=jIzbPe6n99JFgKHn/5BXgj7yzYZCxe9bDEHL/cgVeVU=; b=lOX4Y6MyaDBVriGnepT0V5AeuhB8XZbc7nnsEMXzWanaywuBjOol3av0sU2kK56i/V 0WQ/4kYAr9KldqvYQSllR/Rh7oFBQHm4T7Z8s9iBlgsJv9DWb+LHJVC56x3q7rV1SkiU m1Q77eEmIuxhUVKB76JbaYd4M7FOPUfHyi5aflIQApfgrAflqS6AddglJDcZr7pblbQ5 9iI5V7+3f/5IAi3HnDpo/NBOzqnu+99iy/carTih7Qv9cuXSgTZVuzpyx3bJFpn27kGd VOXdJwzMH+i+kFW/wuSe30K+TPQYBr2qU2IgCdPv4xlGtD1cbI6rrA5IlAW9S121f5A3 zvTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1754430561; x=1755035361; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jIzbPe6n99JFgKHn/5BXgj7yzYZCxe9bDEHL/cgVeVU=; b=nh2edPrYTqXJHdskFej+wPOV4KR7AAWopq8lSFt/l+vJQsFu2fDSnReFTjxoVBeYvh UGn/GCrUY/IIv7lnpFMdbsO89W0IkdajaVuLCcyHaxgJO/Uwq5P0LzdoUn9uWtNqCWUq YY57NSMOMi6Tw26gWk7HwlWzlUTjaPVc14Kd3pYNWjmK/Tf/4bQvCv4I4tYwlI116f7K ouY3gprBGvSnP3EXEwEzO7lBnHobJlfB5294Yi4sNx63UTSedy8lvf2SxIeUb1Its6Kv iNMLIen9KP4Ww6kmyee+5tR24khATtqxMFEZwU//ffVO5Xx9zchtj13V9K4SHUjC4udj NZ3g== X-Forwarded-Encrypted: i=1; AJvYcCU2URjAQ4jQ87AEg8FzojoSGUB8Iy5uz+M4GKv6wHoHSa1ODlO0NchONW4S0hYI28+AwAxZIlhspkYXjer7@vger.kernel.org, AJvYcCUDG1Ql4Tbvqjl1XCPQgaJ+Y4+0LTOUz9QBZBvuKkBGVOTonSbuSXPPnLQQZtK4bwnWtY7SVCk/gpvRYmQx@vger.kernel.org, AJvYcCVwJQ/eVwvfAK7na37yM0lhuV3OAY02VuiH/OA2YV1W623+46R0YHcR1LdX/wRHJEJBt61gbHFI@vger.kernel.org, AJvYcCWT8CTrTt5vWjSyY2ARoWG394Cf9RRG54aIgy1uvfQmKMUtB+TIGFgbgZPyK/afCoQZptA=@vger.kernel.org, AJvYcCXUxOsVzdJsevgR5zHjFIFICQhHE+srlu15KWq1EJ6Yomb3RCDjUONPKrmNdCUAY+/EdXC9Q3Tut3MhBHHQ4wLM@vger.kernel.org X-Gm-Message-State: AOJu0YwkStgfT/iXQzOWoXByvhmbEdLGO4xlOpjPpVeJXaG2V31e7RHp xPzNx2DK9rWZci9Xl/XGPeChO2XUcYsjUWgFCnzcZPqAUoYTRSZ3uc/P X-Gm-Gg: ASbGnctNKZnhTrI+N9e6NmhSIWfYC95KISeZwm3ynxa0Eotg8CbaEv3HfHWNiBgVVwv xRapN6K1Qc2wC5v47y8GcGbSHR8dMVc4bVUX78kkSw73hYFfzX1tXyTuJ6J1LJLBtNTdjZkzOy1 JFUtvDcde2FHCP+wRlcDPcxa5aMgTlUxFvB1Uyn5vyY0xTRMHPHLQbl/DWfaCeI8fYaVvT+VsaI azXD/AG/c6oockkAncA6/F5wQuQX1CN3w6UNWGbunvsNmYtA8UPxgqxGlFJTvE3ZUzVqt88oQrc 9n1bJqMH0Ix3kb5JrooE5f2xVYQqUwADbRH7kYwFt3vLLc5jnyh1DCbWZnJqq3LgxjRVl4QUazZ QNVvHEmM+wv5bt6g/fd78 X-Google-Smtp-Source: AGHT+IH30GOU7ALtk6a4Qu69GWLu4nFmm7a9hAyqteGUmf/zmxX9XY6X82MDI/g8fCQ810jQb8Mvgg== X-Received: by 2002:a17:902:e850:b0:235:e942:cb9e with SMTP id d9443c01a7336-242a0a765f6mr3164885ad.9.1754430560589; Tue, 05 Aug 2025 14:49:20 -0700 (PDT) Received: from localhost ([2a03:2880:2ff:72::]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-241d1ef67aesm142920695ad.6.2025.08.05.14.49.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 05 Aug 2025 14:49:19 -0700 (PDT) From: Bobby Eshleman Date: Tue, 05 Aug 2025 14:49:13 -0700 Subject: [PATCH RFC net-next v4 05/12] vhost/vsock: add netns support Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20250805-vsock-vmtest-v4-5-059ec51ab111@meta.com> References: <20250805-vsock-vmtest-v4-0-059ec51ab111@meta.com> In-Reply-To: <20250805-vsock-vmtest-v4-0-059ec51ab111@meta.com> To: Stefano Garzarella , Shuah Khan , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Stefan Hajnoczi , "Michael S. Tsirkin" , Jason Wang , Xuan Zhuo , =?utf-8?q?Eugenio_P=C3=A9rez?= , "K. Y. Srinivasan" , Haiyang Zhang , Wei Liu , Dexuan Cui , Bryan Tan , Vishnu Dasa , Broadcom internal kernel review list Cc: virtualization@lists.linux.dev, netdev@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-hyperv@vger.kernel.org, Bobby Eshleman , berrange@redhat.com, Bobby Eshleman X-Mailer: b4 0.13.0 From: Bobby Eshleman Add the ability to isolate vsock flows using namespaces. The namespace for a VM is inherited from the PID that opened the vhost-vsock device. Signed-off-by: Bobby Eshleman --- drivers/vhost/vsock.c | 48 ++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 38 insertions(+), 10 deletions(-) diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 802153e23073..863419533a3f 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -46,6 +46,8 @@ static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8); struct vhost_vsock { struct vhost_dev dev; struct vhost_virtqueue vqs[2]; + struct net *net; + netns_tracker ns_tracker; =20 /* Link to global vhost_vsock_hash, writes use vhost_vsock_mutex */ struct hlist_node hash; @@ -59,6 +61,22 @@ struct vhost_vsock { bool seqpacket_allow; }; =20 +static void vhost_vsock_net_set(struct vhost_vsock *vsock, struct net *net) +{ + if (net_eq(net, vsock_global_net())) + vsock->net =3D vsock_global_net(); + else + vsock->net =3D get_net_track(net, &vsock->ns_tracker, GFP_KERNEL); +} + +static void vhost_vsock_net_put(struct vhost_vsock *vsock) +{ + if (net_eq(vsock->net, vsock_global_net())) + return; + + put_net_track(vsock->net, &vsock->ns_tracker); +} + static u32 vhost_transport_get_local_cid(void) { return VHOST_VSOCK_DEFAULT_HOST_CID; @@ -67,7 +85,7 @@ static u32 vhost_transport_get_local_cid(void) /* Callers that dereference the return value must hold vhost_vsock_mutex o= r the * RCU read lock. */ -static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) +static struct vhost_vsock *vhost_vsock_get(u32 guest_cid, struct net *net) { struct vhost_vsock *vsock; =20 @@ -78,9 +96,8 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid) if (other_cid =3D=3D 0) continue; =20 - if (other_cid =3D=3D guest_cid) + if (other_cid =3D=3D guest_cid && vsock_net_check_mode(net, vsock->net)) return vsock; - } =20 return NULL; @@ -272,13 +289,14 @@ static int vhost_transport_send_pkt(struct sk_buff *skb) { struct virtio_vsock_hdr *hdr =3D virtio_vsock_hdr(skb); + struct net *net =3D virtio_vsock_skb_net(skb); struct vhost_vsock *vsock; int len =3D skb->len; =20 rcu_read_lock(); =20 /* Find the vhost_vsock according to guest context id */ - vsock =3D vhost_vsock_get(le64_to_cpu(hdr->dst_cid)); + vsock =3D vhost_vsock_get(le64_to_cpu(hdr->dst_cid), net); if (!vsock) { rcu_read_unlock(); kfree_skb(skb); @@ -305,7 +323,7 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk) rcu_read_lock(); =20 /* Find the vhost_vsock according to guest context id */ - vsock =3D vhost_vsock_get(vsk->remote_addr.svm_cid); + vsock =3D vhost_vsock_get(vsk->remote_addr.svm_cid, sock_net(sk_vsock(vsk= ))); if (!vsock) goto out; =20 @@ -403,7 +421,7 @@ static bool vhost_transport_msgzerocopy_allow(void) return true; } =20 -static bool vhost_transport_seqpacket_allow(u32 remote_cid); +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, u32 re= mote_cid); =20 static struct virtio_transport vhost_transport =3D { .transport =3D { @@ -459,13 +477,14 @@ static struct virtio_transport vhost_transport =3D { .send_pkt =3D vhost_transport_send_pkt, }; =20 -static bool vhost_transport_seqpacket_allow(u32 remote_cid) +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, u32 re= mote_cid) { + struct net *net =3D sock_net(sk_vsock(vsk)); struct vhost_vsock *vsock; bool seqpacket_allow =3D false; =20 rcu_read_lock(); - vsock =3D vhost_vsock_get(remote_cid); + vsock =3D vhost_vsock_get(remote_cid, net); =20 if (vsock) seqpacket_allow =3D vsock->seqpacket_allow; @@ -525,6 +544,7 @@ static void vhost_vsock_handle_tx_kick(struct vhost_wor= k *work) continue; } =20 + virtio_vsock_skb_set_net(skb, vsock->net); total_len +=3D sizeof(*hdr) + skb->len; =20 /* Deliver to monitoring devices all received packets */ @@ -651,10 +671,16 @@ static void vhost_vsock_free(struct vhost_vsock *vsoc= k) =20 static int vhost_vsock_dev_open(struct inode *inode, struct file *file) { + struct vhost_virtqueue **vqs; struct vhost_vsock *vsock; + struct net *net; int ret; =20 + net =3D get_net_ns_by_pid(current->pid); + if (IS_ERR(net)) + return PTR_ERR(net); + /* This struct is large and allocation could fail, fall back to vmalloc * if there is no other way. */ @@ -668,6 +694,7 @@ static int vhost_vsock_dev_open(struct inode *inode, st= ruct file *file) goto out; } =20 + vhost_vsock_net_set(vsock, net); vsock->guest_cid =3D 0; /* no CID assigned yet */ vsock->seqpacket_allow =3D false; =20 @@ -707,7 +734,7 @@ static void vhost_vsock_reset_orphans(struct sock *sk) */ =20 /* If the peer is still valid, no need to reset connection */ - if (vhost_vsock_get(vsk->remote_addr.svm_cid)) + if (vhost_vsock_get(vsk->remote_addr.svm_cid, sock_net(sk))) return; =20 /* If the close timeout is pending, let it expire. This avoids races @@ -752,6 +779,7 @@ static int vhost_vsock_dev_release(struct inode *inode,= struct file *file) virtio_vsock_skb_queue_purge(&vsock->send_pkt_queue); =20 vhost_dev_cleanup(&vsock->dev); + vhost_vsock_net_put(vsock); kfree(vsock->dev.vqs); vhost_vsock_free(vsock); return 0; @@ -778,7 +806,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsoc= k, u64 guest_cid) =20 /* Refuse if CID is already in use */ mutex_lock(&vhost_vsock_mutex); - other =3D vhost_vsock_get(guest_cid); + other =3D vhost_vsock_get(guest_cid, vsock->net); if (other && other !=3D vsock) { mutex_unlock(&vhost_vsock_mutex); return -EADDRINUSE; --=20 2.47.3