Message-ID: <wcts7brlugr337mcdfbrz5vkhvjikcaql3pdzgke5ahuuut37v@mgcqyo2umu7w>
Date: Fri, 26 Sep 2025 15:52:43 +0200
From: Stefano Garzarella <sgarzare@...hat.com>
To: Bobby Eshleman <bobbyeshleman@...il.com>
Cc: Shuah Khan <shuah@...nel.org>, "David S. Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	Stefan Hajnoczi <stefanha@...hat.com>, "Michael S. Tsirkin" <mst@...hat.com>, 
	Jason Wang <jasowang@...hat.com>, Xuan Zhuo <xuanzhuo@...ux.alibaba.com>, 
	Eugenio Pérez <eperezma@...hat.com>, "K. Y. Srinivasan" <kys@...rosoft.com>, 
	Haiyang Zhang <haiyangz@...rosoft.com>, Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>, 
	Bryan Tan <bryan-bt.tan@...adcom.com>, Vishnu Dasa <vishnu.dasa@...adcom.com>, 
	Broadcom internal kernel review list <bcm-kernel-feedback-list@...adcom.com>, virtualization@...ts.linux.dev, netdev@...r.kernel.org, 
	linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org, kvm@...r.kernel.org, 
	linux-hyperv@...r.kernel.org, berrange@...hat.com, Bobby Eshleman <bobbyeshleman@...a.com>
Subject: Re: [PATCH net-next v6 0/9] vsock: add namespace support to
 vhost-vsock

Hi Bobby,

On Tue, Sep 16, 2025 at 04:43:44PM -0700, Bobby Eshleman wrote:
>This series adds namespace support to vhost-vsock and loopback. It does
>not add namespaces to any of the other guest transports (virtio-vsock,
>hyperv, or vmci).

Thanks for this new series and the patience!
I've been a bit messed up after KVM Forum between personal stuff and 
other things. I'm starting to review and test today, so between this 
afternoon and Monday I hope to send you all my comments.

Thanks,
Stefano

>
>The current revision supports two modes: local and global. Local
>mode is complete isolation of namespaces, while global mode is complete
>sharing between namespaces of CIDs (the original behavior).
>
>The mode is set using /proc/sys/net/vsock/ns_mode.
>
>Modes are per-netns and write-once. This allows a system to configure
>namespaces independently (some may share CIDs, others are completely
>isolated). This also supports future possible mixed use cases, where
>there may be namespaces in global mode spinning up VMs while there are
>mixed mode namespaces that provide services to the VMs, but are not
>allowed to allocate from the global CID pool (this mode not implemented
>in this series).
>
>If a socket or VM is created when a namespace is global but the
>namespace changes to local, the socket or VM will continue working
>normally. That is, the socket or VM assumes the mode behavior of the
>namespace at the time the socket/VM was created. The original mode is
>captured in vsock_create() and so occurs at the time of socket(2) and
>accept(2) for sockets and open(2) on /dev/vhost-vsock for VMs. This
>prevents a socket/VM connection from suddenly breaking due to a
>namespace mode change. Any new sockets/VMs created after the mode change
>will adopt the new mode's behavior.
>
>Additionally, added tests for the new namespace features:
>
>tools/testing/selftests/vsock/vmtest.sh
>1..22
>ok 1 vm_server_host_client
>ok 2 vm_client_host_server
>ok 3 vm_loopback
>ok 4 host_vsock_ns_mode_ok
>ok 5 host_vsock_ns_mode_write_once_ok
>ok 6 global_same_cid_fails
>ok 7 local_same_cid_ok
>ok 8 global_local_same_cid_ok
>ok 9 local_global_same_cid_ok
>ok 10 diff_ns_global_host_connect_to_global_vm_ok
>ok 11 diff_ns_global_host_connect_to_local_vm_fails
>ok 12 diff_ns_global_vm_connect_to_global_host_ok
>ok 13 diff_ns_global_vm_connect_to_local_host_fails
>ok 14 diff_ns_local_host_connect_to_local_vm_fails
>ok 15 diff_ns_local_vm_connect_to_local_host_fails
>ok 16 diff_ns_global_to_local_loopback_local_fails
>ok 17 diff_ns_local_to_global_loopback_fails
>ok 18 diff_ns_local_to_local_loopback_fails
>ok 19 diff_ns_global_to_global_loopback_ok
>ok 20 same_ns_local_loopback_ok
>ok 21 same_ns_local_host_connect_to_local_vm_ok
>ok 22 same_ns_local_vm_connect_to_local_host_ok
>SUMMARY: PASS=22 SKIP=0 FAIL=0
>Log: /tmp/vsock_vmtest_OQC4.log
>
>Thanks again for everyone's help and reviews!
>
>Signed-off-by: Bobby Eshleman <bobbyeshleman@...il.com>
>To: Stefano Garzarella <sgarzare@...hat.com>
>To: Shuah Khan <shuah@...nel.org>
>To: David S. Miller <davem@...emloft.net>
>To: Eric Dumazet <edumazet@...gle.com>
>To: Jakub Kicinski <kuba@...nel.org>
>To: Paolo Abeni <pabeni@...hat.com>
>To: Simon Horman <horms@...nel.org>
>To: Stefan Hajnoczi <stefanha@...hat.com>
>To: Michael S. Tsirkin <mst@...hat.com>
>To: Jason Wang <jasowang@...hat.com>
>To: Xuan Zhuo <xuanzhuo@...ux.alibaba.com>
>To: Eugenio Pérez <eperezma@...hat.com>
>To: K. Y. Srinivasan <kys@...rosoft.com>
>To: Haiyang Zhang <haiyangz@...rosoft.com>
>To: Wei Liu <wei.liu@...nel.org>
>To: Dexuan Cui <decui@...rosoft.com>
>To: Bryan Tan <bryan-bt.tan@...adcom.com>
>To: Vishnu Dasa <vishnu.dasa@...adcom.com>
>To: Broadcom internal kernel review list <bcm-kernel-feedback-list@...adcom.com>
>Cc: virtualization@...ts.linux.dev
>Cc: netdev@...r.kernel.org
>Cc: linux-kselftest@...r.kernel.org
>Cc: linux-kernel@...r.kernel.org
>Cc: kvm@...r.kernel.org
>Cc: linux-hyperv@...r.kernel.org
>Cc: berrange@...hat.com
>
>Changes in v6:
>- define behavior when mode changes to local while socket/VM is alive
>- af_vsock: clarify description of CID behavior
>- af_vsock: use stronger langauge around CID rules (dont use "may")
>- af_vsock: improve naming of buf/buffer
>- af_vsock: improve string length checking on proc writes
>- vsock_loopback: add space in struct to clarify lock protection
>- vsock_loopback: do proper cleanup/unregister on vsock_loopback_exit()
>- vsock_loopback: use virtio_vsock_skb_net() instead of sock_net()
>- vsock_loopback: set loopback to NULL after kfree()
>- vsock_loopback: use pernet_operations and remove callback mechanism
>- vsock_loopback: add macros for "global" and "local"
>- vsock_loopback: fix length checking
>- vmtest.sh: check for namespace support in vmtest.sh
>- Link to v5: https://lore.kernel.org/r/20250827-vsock-vmtest-v5-0-0ba580bede5b@meta.com
>
>Changes in v5:
>- /proc/net/vsock_ns_mode -> /proc/sys/net/vsock/ns_mode
>- vsock_global_net -> vsock_global_dummy_net
>- fix netns lookup in vhost_vsock to respect pid namespaces
>- add callbacks for vsock_loopback to avoid circular dependency
>- vmtest.sh loads vsock_loopback module
>- remove vsock_net_mode_can_set()
>- change vsock_net_write_mode() to return true/false based on success
>- make vsock_net_mode enum instead of u8
>- Link to v4: https://lore.kernel.org/r/20250805-vsock-vmtest-v4-0-059ec51ab111@meta.com
>
>Changes in v4:
>- removed RFC tag
>- implemented loopback support
>- renamed new tests to better reflect behavior
>- completed suite of tests with permutations of ns modes and vsock_test
>  as guest/host
>- simplified socat bridging with unix socket instead of tcp + veth
>- only use vsock_test for success case, socat for failure case (context
>  in commit message)
>- lots of cleanup
>
>Changes in v3:
>- add notion of "modes"
>- add procfs /proc/net/vsock_ns_mode
>- local and global modes only
>- no /dev/vhost-vsock-netns
>- vmtest.sh already merged, so new patch just adds new tests for NS
>- Link to v2:
>  https://lore.kernel.org/kvm/20250312-vsock-netns-v2-0-84bffa1aa97a@gmail.com
>
>Changes in v2:
>- only support vhost-vsock namespaces
>- all g2h namespaces retain old behavior, only common API changes
>  impacted by vhost-vsock changes
>- add /dev/vhost-vsock-netns for "opt-in"
>- leave /dev/vhost-vsock to old behavior
>- removed netns module param
>- Link to v1:
>  https://lore.kernel.org/r/20200116172428.311437-1-sgarzare@redhat.com
>
>Changes in v1:
>- added 'netns' module param to vsock.ko to enable the
>  network namespace support (disabled by default)
>- added 'vsock_net_eq()' to check the "net" assigned to a socket
>  only when 'netns' support is enabled
>- Link to RFC: https://patchwork.ozlabs.org/cover/1202235/
>
>---
>Bobby Eshleman (9):
>      vsock: a per-net vsock NS mode state
>      vsock: add net to vsock skb cb
>      vsock: add netns to vsock core
>      vsock/loopback: add netns support
>      vsock/virtio: add netns to virtio transport common
>      vhost/vsock: add netns support
>      selftests/vsock: improve logging in vmtest.sh
>      selftests/vsock: invoke vsock_test through helpers
>      selftests/vsock: add namespace tests
>
> MAINTAINERS                             |    1 +
> drivers/vhost/vsock.c                   |   78 ++-
> include/linux/virtio_vsock.h            |   24 +
> include/net/af_vsock.h                  |   71 +-
> include/net/net_namespace.h             |    4 +
> include/net/netns/vsock.h               |   26 +
> net/vmw_vsock/af_vsock.c                |  219 +++++-
> net/vmw_vsock/hyperv_transport.c        |    2 +-
> net/vmw_vsock/virtio_transport.c        |    6 +-
> net/vmw_vsock/virtio_transport_common.c |   18 +-
> net/vmw_vsock/vmci_transport.c          |    6 +-
> net/vmw_vsock/vsock_loopback.c          |  102 ++-
> tools/testing/selftests/vsock/vmtest.sh | 1133 +++++++++++++++++++++++++++----
> 13 files changed, 1501 insertions(+), 189 deletions(-)
>---
>base-commit: 949ddfb774fe527cebfa3f769804344940f7ed2e
>change-id: 20250325-vsock-vmtest-b3a21d2102c2
>
>Best regards,
>-- 
>Bobby Eshleman <bobbyeshleman@...a.com>
>

Powered by blists - more mailing lists