This series adds namespace support to vhost-vsock. It does not add namespaces to any of the guest transports (virtio-vsock, hyperv, or vmci). The current revision only supports two modes: local or global. Local mode is complete isolation of namespaces, while global mode is complete sharing between namespaces of CIDs (the original behavior). Future may include supporting a mixed mode, which I expect to be more complicated because socket lookups will have to include new logic and API changes to behave differently based on if the lookup is part of a mixed mode CID allocation, a global CID allocation, a mixed-to-global connection (allowed), or a global-to-mixed connection (not allowed). Modes are per-netns and write-once. This allows a system to configure namespaces independently (some may share CIDs, others are completely isolated). This also supports future mixed use cases, where there may be namespaces in global mode spinning up VMs while there are mixed mode namespaces that provide services to the VMs, but are not allowed to allocate from the global CID pool. Thanks again for everyone's help and reviews! Signed-off-by: Bobby Eshleman <bobbyeshleman@xxxxxxxxx> To: Stefano Garzarella <sgarzare@xxxxxxxxxx> To: Shuah Khan <shuah@xxxxxxxxxx> To: David S. Miller <davem@xxxxxxxxxxxxx> To: Eric Dumazet <edumazet@xxxxxxxxxx> To: Jakub Kicinski <kuba@xxxxxxxxxx> To: Paolo Abeni <pabeni@xxxxxxxxxx> To: Simon Horman <horms@xxxxxxxxxx> To: Stefan Hajnoczi <stefanha@xxxxxxxxxx> To: Michael S. Tsirkin <mst@xxxxxxxxxx> To: Jason Wang <jasowang@xxxxxxxxxx> To: Xuan Zhuo <xuanzhuo@xxxxxxxxxxxxxxxxx> To: Eugenio Pérez <eperezma@xxxxxxxxxx> To: K. Y. Srinivasan <kys@xxxxxxxxxxxxx> To: Haiyang Zhang <haiyangz@xxxxxxxxxxxxx> To: Wei Liu <wei.liu@xxxxxxxxxx> To: Dexuan Cui <decui@xxxxxxxxxxxxx> To: Bryan Tan <bryan-bt.tan@xxxxxxxxxxxx> To: Vishnu Dasa <vishnu.dasa@xxxxxxxxxxxx> To: Broadcom internal kernel review list <bcm-kernel-feedback-list@xxxxxxxxxxxx> Cc: virtualization@xxxxxxxxxxxxxxx Cc: netdev@xxxxxxxxxxxxxxx Cc: linux-kselftest@xxxxxxxxxxxxxxx Cc: linux-kernel@xxxxxxxxxxxxxxx Cc: kvm@xxxxxxxxxxxxxxx Cc: linux-hyperv@xxxxxxxxxxxxxxx Cc: berrange@xxxxxxxxxx Changes in v4: - removed RFC tag - implemented loopback support - renamed new tests to better reflect behavior - completed suite of tests with permutations of ns modes and vsock_test as guest/host - simplified socat bridging with unix socket instead of tcp + veth - only use vsock_test for success case, socat for failure case (context in commit message) - lots of cleanup Changes in v3: - add notion of "modes" - add procfs /proc/net/vsock_ns_mode - local and global modes only - no /dev/vhost-vsock-netns - vmtest.sh already merged, so new patch just adds new tests for NS - Link to v2: https://lore.kernel.org/kvm/20250312-vsock-netns-v2-0-84bffa1aa97a@xxxxxxxxx Changes in v2: - only support vhost-vsock namespaces - all g2h namespaces retain old behavior, only common API changes impacted by vhost-vsock changes - add /dev/vhost-vsock-netns for "opt-in" - leave /dev/vhost-vsock to old behavior - removed netns module param - Link to v1: https://lore.kernel.org/r/20200116172428.311437-1-sgarzare@xxxxxxxxxx Changes in v1: - added 'netns' module param to vsock.ko to enable the network namespace support (disabled by default) - added 'vsock_net_eq()' to check the "net" assigned to a socket only when 'netns' support is enabled - Link to RFC: https://patchwork.ozlabs.org/cover/1202235/ --- Bobby Eshleman (12): vsock: a per-net vsock NS mode state vsock: add net to vsock skb cb vsock: add netns to af_vsock core vsock/virtio: add netns to virtio transport common vhost/vsock: add netns support vsock/virtio: use the global netns hv_sock: add netns hooks vsock/vmci: add netns hooks vsock/loopback: add netns support selftests/vsock: improve logging in vmtest.sh selftests/vsock: invoke vsock_test through helpers selftests/vsock: add namespace tests MAINTAINERS | 1 + drivers/vhost/vsock.c | 48 +- include/linux/virtio_vsock.h | 12 + include/net/af_vsock.h | 59 +- include/net/net_namespace.h | 4 + include/net/netns/vsock.h | 21 + net/vmw_vsock/af_vsock.c | 204 +++++- net/vmw_vsock/hyperv_transport.c | 2 +- net/vmw_vsock/virtio_transport.c | 5 +- net/vmw_vsock/virtio_transport_common.c | 14 +- net/vmw_vsock/vmci_transport.c | 4 +- net/vmw_vsock/vsock_loopback.c | 59 +- tools/testing/selftests/vsock/vmtest.sh | 1088 ++++++++++++++++++++++++++----- 13 files changed, 1330 insertions(+), 191 deletions(-) --- base-commit: dd500e4aecf25e48e874ca7628697969df679493 change-id: 20250325-vsock-vmtest-b3a21d2102c2 Best regards, -- Bobby Eshleman <bobbyeshleman@xxxxxxxx>
