--- name: "VNET" section: "9" platform: "freebsd" package: "base" version: "16.0-CURRENT-20261027-61c70dc16a79" release: "FreeBSD 16.0-CURRENT (2026-10-27)" platforms: ["freebsd"] url: "https://new.carta.tech/VIMAGE" --- # VNET(9) network subsystem virtualization infrastructure Part of [VIMAGE(9)](/VIMAGE/9.md). ## NAME **VNET** – network subsystem virtualization infrastructure ## SYNOPSIS **options VIMAGE** **options VNET\_DEBUG** **#include \** ### Constants and Global Variables VNET\_SETNAME VNET\_SYMPREFIX *extern* *struct* *vnet* *\*vnet0;* ### Variable Declaration **VNET**(*name*); **VNET\_NAME**(*name*); **VNET\_DECLARE**(*type*, *name*); **VNET\_DEFINE**(*type*, *name*); **VNET\_DEFINE\_STATIC**(*type*, *name*); ``` #define V_name VNET(name) ``` ### Virtual Instance Selection **CRED\_TO\_VNET**(*struct ucred \**); **TD\_TO\_VNET**(*struct thread \**); **P\_TO\_VNET**(*struct proc \**); **IS\_DEFAULT\_VNET**(*struct vnet \**); **VNET\_ASSERT**(*exp*, *msg*); **CURVNET\_SET**(*struct vnet \**); **CURVNET\_SET\_QUIET**(*struct vnet \**); **CURVNET\_RESTORE**(); **VNET\_ITERATOR\_DECL**(*struct vnet \**); **VNET\_FOREACH**(*struct vnet \**); ### Locking **VNET\_LIST\_RLOCK**(); **VNET\_LIST\_RUNLOCK**(); **VNET\_LIST\_RLOCK\_NOSLEEP**(); **VNET\_LIST\_RUNLOCK\_NOSLEEP**(); ### Startup and Teardown Functions *struct vnet \**\ **vnet\_alloc**(*void*); *void*\ **vnet\_destroy**(*struct vnet \**); **VNET\_SYSINIT**(*ident*, *enum sysinit\_sub\_id subsystem*, *enum sysinit\_elem\_order order*, *sysinit\_cfunc\_t func*, *const void \*arg*); **VNET\_SYSUNINIT**(*ident*, *enum sysinit\_sub\_id subsystem*, *enum sysinit\_elem\_order order*, *sysinit\_cfunc\_t func*, *const void \*arg*); ### Eventhandlers **VNET\_GLOBAL\_EVENTHANDLER\_REGISTER**(*const char \*name*, *void \*func*, *void \*arg*, *int priority*); **VNET\_GLOBAL\_EVENTHANDLER\_REGISTER\_TAG**(*eventhandler\_tag tag*, *const char \*name*, *void \*func*, *void \*arg*, *int priority*); ## DESCRIPTION **VNET** is the name of a technique to virtualize the network stack. The basic idea is to change global resources most notably variables into per network stack resources and have functions, sysctls, eventhandlers, etc. access and handle them in the context of the correct instance. Each (virtual) network stack is attached to a *prison*, with *vnet0* being the unrestricted default network stack of the base system. The global defines for VNET\_SETNAME and VNET\_SYMPREFIX are shared with [kvm(3)](/kvm/3.md) to access internals for debugging reasons. ### Variable Declaration Variables are virtualized by using the **VNET\_DEFINE**() macro rather than writing them out as *type* *name*. One can still use static initialization, e.g., ``` VNET_DEFINE(int, foo) = 1; ``` Variables declared with the static keyword can use the **VNET\_DEFINE\_STATIC**() macro, e.g., ``` VNET_DEFINE_STATIC(SLIST_HEAD(, bar), bars); ``` Static initialization is not possible when the virtualized variable would need to be referenced, e.g., with “TAILQ\_HEAD\_INITIALIZER()”. In that case a **VNET\_SYSINIT**() based initialization function must be used. External variables have to be declared using the **VNET\_DECLARE**() macro. In either case the convention is to define another macro, that is then used throughout the implementation to access that variable. The variable name is usually prefixed by *V\_* to express that it is virtualized. The **VNET**() macro will then translate accesses to that variable to the copy of the currently selected instance (see the Virtual instance selection section): ``` #define V_name VNET(name) ``` *NOTE:* Do not confuse this with the convention used by [VFS(9)](/VFS/9.md). The **VNET\_NAME**() macro returns the offset within the memory region of the virtual network stack instance. ### Virtual Instance Selection There are three different places where the current virtual network stack pointer is stored and can be taken from: 1. a *prison*: ``` (struct prison *)->pr_vnet ``` For convenience the following macros are provided: ``` CRED_TO_VNET(struct ucred *) TD_TO_VNET(struct thread *) P_TO_VNET(struct proc *) ``` 2. a *socket*: ``` (struct socket *)->so_vnet ``` 3. an *interface*: ``` (struct ifnet *)->if_vnet ``` In addition the currently active instance is cached in “curthread-\>td\_vnet” which is usually only accessed through the curvnet macro. To set the correct context of the current virtual network instance, use the **CURVNET\_SET**() or **CURVNET\_SET\_QUIET**() macros. The **CURVNET\_SET\_QUIET**() version will not record vnet recursions in case the kernel was compiled with **options VNET\_DEBUG** and should thus only be used in well known cases, where recursion is unavoidable. Both macros will save the previous state on the stack and it must be restored with the **CURVNET\_RESTORE**() macro. *NOTE:* As the previous state is saved on the stack, you cannot have multiple **CURVNET\_SET**() calls in the same block. *NOTE:* As the previous state is saved on the stack, a **CURVNET\_RESTORE**() call has to be in the same block as the **CURVNET\_SET**() call or in a subblock with the same idea of the saved instances as the outer block. *NOTE:* As each macro is a set of operations and, as previously explained, cannot be put into its own block when defined, one cannot conditionally set the current vnet context. The following will *not* work: ``` if (condition) CURVNET_SET(vnet); ``` nor would this work: ``` if (condition) { CURVNET_SET(vnet); } CURVNET_RESTORE(); ``` Sometimes one needs to loop over all virtual instances, for example to update virtual from global state, to run a function from a [callout(9)](/callout/9.md) for each instance, etc. For those cases the **VNET\_ITERATOR\_DECL**() and **VNET\_FOREACH**() macros are provided. The former macro defines the variable that iterates over the loop, and the latter loops over all of the virtual network stack instances. See Locking for how to savely traverse the list of all virtual instances. The **IS\_DEFAULT\_VNET**() macro provides a safe way to check whether the currently active instance is the unrestricted default network stack of the base system (*vnet0*). The **VNET\_ASSERT**() macro provides a way to conditionally add assertions that are only active with **options VIMAGE** compiled in and either **options VNET\_DEBUG** or **options INVARIANTS** enabled as well. It uses the same semantics as [KASSERT(9)](/KASSERT/9.md). ### Locking For public access to the list of virtual network stack instances e.g., by the **VNET\_FOREACH**() macro, read locks are provided. Macros are used to abstract from the actual type of the locks. If a caller may sleep while traversing the list, it must use the **VNET\_LIST\_RLOCK**() and **VNET\_LIST\_RUNLOCK**() macros. Otherwise, the caller can use **VNET\_LIST\_RLOCK\_NOSLEEP**() and **VNET\_LIST\_RUNLOCK\_NOSLEEP**(). ### Startup and Teardown Functions To start or tear down a virtual network stack instance the internal functions **vnet\_alloc**() and **vnet\_destroy**() are provided and called from the jail framework. They run the publicly provided methods to handle network stack startup and teardown. For public control, the system startup interface has been enhanced to not only handle a system boot but to also handle a virtual network stack startup and teardown. To the base system the **VNET\_SYSINIT**() and **VNET\_SYSUNINIT**() macros look exactly as if there were no virtual network stack. In fact, if **options VIMAGE** is not compiled in they are compiled to the standard **SYSINIT**() macros. In addition to that they are run for each virtual network stack when starting or, in reverse order, when shutting down. ### Eventhandlers Eventhandlers can be handled in two ways: 1. save the *tags* returned in each virtual instance and properly free the eventhandlers on teardown using those, or 2. use one eventhandler that will iterate over all virtual network stack instances. For the first case one can just use the normal [EVENTHANDLER(9)](/EVENTHANDLER/9.md) functions, while for the second case the **VNET\_GLOBAL\_EVENTHANDLER\_REGISTER**() and **VNET\_GLOBAL\_EVENTHANDLER\_REGISTER\_TAG**() macros are provided. These differ in that **VNET\_GLOBAL\_EVENTHANDLER\_REGISTER\_TAG**() takes an extra first argument that will carry the *tag* upon return. Eventhandlers registered with either of these will not run *func* directly but *func* will be called from an internal iterator function for each vnet. Both macros can only be used for eventhandlers that do not take additional arguments, as the variadic arguments from an [EVENTHANDLER\_INVOKE(9)](/EVENTHANDLER_INVOKE/9.md) call will be ignored. ### Sysctl Handling A [sysctl(9)](/sysctl/9.md) can be virtualized by adding the CTLFLAG\_VNET control flag to the ctlflags bitmask of the macros. ## SEE ALSO [jail(2)](/jail/2.md), [kvm(3)](/kvm/3.md), [EVENTHANDLER(9)](/EVENTHANDLER/9.md), [KASSERT(9)](/KASSERT/9.md), [sysctl(9)](/sysctl/9.md) Marko Zec, Implementing a Clonable Network Stack in the FreeBSD Kernel, USENIX ATC'03, June 2003, Boston ## HISTORY The virtual network stack implementation first appeared in FreeBSD 8.0. ## AUTHORS The **VNET** framework was designed and implemented at the University of Zagreb by Marko Zec under sponsorship of the FreeBSD Foundation and NLnet Foundation, and later extended and refined by Bjoern A. Zeeb (also under FreeBSD Foundation sponsorship), and Robert Watson. This manual page was written by Bjoern A. Zeeb, CK Software GmbH, under sponsorship from the FreeBSD Foundation.