> virtio-vsock did not have namespace support (the device was always > accessible to any global namespace). > > Make the virtio-vsock device assignable to a namespace and initialize it > to init_net. Because virtio-vsock and init_net are both hardcoded to > global mode, nothing changes until the assign command is issued. > > An assign can land while virtio_transport_rx_work() is draining a > batch, so the assigned namespace is re-read per packet rather than once > per batch. Matching the rest of the batch against the namespace the > device has left would reset connections that belong to the new one. > > When a device is assigned to a namespace, every already established > vsock socket that is no longer able to reach the device is forcibly > closed. For that reason, adding new sockets to the connected table must > be performed atomically with regards to namespace assignment. This > ensures that when the socket is added to the connected table that it > actually passes the new reachability conditions set by ns assignment. If > it wins the race to the table and does NOT pass the reachability tests, > then it will be reset. This is the purpose of the new helper > 'vsock_maybe_set_connected()'. > > Signed-off-by: Bobby Eshleman <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=5
