On Tue, Sep 15, 2026 at 12:16:47PM +0200, Stefano Garzarella wrote: > On Fri, Sep 04, 2026 at 10:30:28AM -0700, Bobby Eshleman wrote: > > On Fri, Sep 04, 2026 at 10:55:17AM +0200, Stefano Garzarella wrote: > > > On Wed, Sep 02, 2026 at 04:00:46PM -0700, Bobby Eshleman wrote: > > > > vsock network namespaces let a host put each VM in a namespace of its > > > > own. A guest has no equivalent yet. It has a single G2H device that > > > > cannot be assigned to a network namespace. > > > > > > Thanks for this, I'll do a proper review next week, in the mean time some > > > comments below: > > > > > > > > > > > This series lets a guest move that device into a network namespace. A > > > > new ioctl on /dev/vsock, IOCTL_VM_SOCKETS_ASSIGN_G2H_NETNS, assigns the > > > > device to the namespace of the calling process. The namespace's existing > > > > > > Why an ioctl? > > > > > > I'm asking because I'd like to know if you've already considered any > > > alternatives (sysfs, netlink, etc.) > > > > > > How do you think the ioctl should be used? Should we provide an userspace > > > tool, or extending some existing tools? > > > > > > Thanks, > > > Stefano > > > > Really only because /dev/vsock exists and the prior series used it. > > Yeah, I vaguely remember that we may have discussed switching to netlink in > that thread, but I can't find it. > > > > > Considering netlink, it might be the better option because there is a > > lot of prior art solving problems we might have in the future. For > > example, I was thinking about when users suddenly lose access to vsock, > > with just the current assign ioctl there is no way for apps or users to > > figure out why this happened. We can have an ioctl() setter for user, > > but in netdev world users can actually get a notification via netlink as > > to which namespace the device went to and what its ifindex is there (see > > __dev_change_net_namespace() for the RTM_DELLINK and RTM_NEWLINK > > messages). There is probably more, but that's the case that comes to > > mind. > > netlink seems like the right way to go, do you think it'll be a real pain to > implement?
It is really not bad... it'll include a yaml spec in Documentation/netlink/specs/ of call names and perms, a new target for generated code in the Makefile, a handler, and then tools/net/ynl/ynl-regen.sh generates the plumbing. > > > > > > > > > > ns_mode then decides who may use it: a "global" namespace shares the > > > > device with every other global namespace, and a "local" namespace keeps > > > > the host connection to itself. The device starts out in the initial > > > > namespace, so until the ioctl is issued nothing has moved and no mode > > > > has changed. There is no explicit unassign as assigning the device back > > > > to the initial namespace is equivalent. > > > > > > > > The ioctl requires CAP_NET_ADMIN in the initial user namespace. > > > > > > > > Connections that can no longer reach the device after a move are reset, > > > > so that a namespace which has lost access cannot keep using a socket it > > > > opened while it still had access. Following netdevs, the device returns > > > > to the initial namespace when the namespace it was moved to is deleted. > > > > > > > > Transports opt in through a new netns_assign_allow callback. Only > > > > virtio-vsock implements it here. > > > > > > Why? (Not asking to support all the others, asking to explain the reason > > > or > > > ask helps from others to extend it) > > > > > > Thanks, > > > Stefano > > > > Sure, can add a note here about extending it. I just didn't want to > > implement code without having an environment allowing me to test it. > > It's fine, I'm not asking you to do it ;-) > > Sorry again for the delay, I hope to review this series today/tomorrow. > > Thanks, > Stefano > No rush! Thanks, Bobby
