VNET(9)

💅 VNET — network subsystem virtualization infrastructure

ok so bestie, welcome to VNET(9), from the Kernel Developer's Manual 🧚✨ this one's a whole vibe: it's the thing that makes the network stack go "one of me per jail, please" and honestly it ate.

---

✨ SYNOPSIS ✨

options VIMAGE
options VNET_DEBUG

#include <net/vnet.h>

🎀 Constants and Global Variables

VNET_SETNAME VNET_SYMPREFIX

extern struct vnet *vnet0;

🦋 Variable Declaration

VNET(name);

VNET_NAME(name);

VNET_DECLARE(type, name);

VNET_DEFINE(type, name);

VNET_DEFINE_STATIC(type, name);

#define V_name  VNET(name)

🌸 Virtual Instance Selection

CRED_TO_VNET(struct ucred *);

TD_TO_VNET(struct thread *);

P_TO_VNET(struct proc *);

IS_DEFAULT_VNET(struct vnet *);

VNET_ASSERT(exp, msg);

CURVNET_SET(struct vnet *);

CURVNET_SET_QUIET(struct vnet *);

CURVNET_RESTORE();

VNET_ITERATOR_DECL(struct vnet *);

VNET_FOREACH(struct vnet *);

🔒 Locking

VNET_LIST_RLOCK();

VNET_LIST_RUNLOCK();

VNET_LIST_RLOCK_NOSLEEP();

VNET_LIST_RUNLOCK_NOSLEEP();

🌈 Startup and Teardown Functions

struct vnet *
vnet_alloc(void);

void
vnet_destroy(struct vnet *);

VNET_SYSINIT(ident, enum sysinit_sub_id subsystem,
      enum sysinit_elem_order order, sysinit_cfunc_t func,
      const void *arg);

VNET_SYSUNINIT(ident, enum sysinit_sub_id subsystem,
      enum sysinit_elem_order order, sysinit_cfunc_t func,
      const void *arg);

💜 Eventhandlers

VNET_GLOBAL_EVENTHANDLER_REGISTER(const char *name, void *func,
      void *arg, int priority);

VNET_GLOBAL_EVENTHANDLER_REGISTER_TAG(eventhandler_tag tag,
      const char *name, void *func, void *arg, int priority);

---

💖 DESCRIPTION 💖

okay so VNET is the name of a technique to virtualize the network stack. the basic idea? take all the global resources — most notably variables — and turn them into per-network-stack resources, and have functions, sysctls, eventhandlers, etc. access and handle them in the context of the correct instance. literally main character energy for every network stack 🫶

each (virtual) network stack is attached to a prison, with vnet0 being the unrestricted default network stack of the base system. iconic.

the globals VNET_SETNAME and VNET_SYMPREFIX are shared with kvm(3) so it can poke at the internals for debugging reasons — iykyk 🔍

🎀 Variable Declaration

variables get virtualized by using the VNET_DEFINE() macro instead of writing them out as type name. you can still do static initialization, like:

VNET_DEFINE(int, foo) = 1;

variables declared with the static keyword can use the VNET_DEFINE_STATIC() macro, like:

VNET_DEFINE_STATIC(SLIST_HEAD(, bar), bars);

heads up bestie — static initialization is not possible when the virtualized variable would need to be referenced, e.g. with TAILQ_HEAD_INITIALIZER(). in that case you gotta use a VNET_SYSINIT() based initialization function. no shortcuts, periodt.

external variables have to be declared using the VNET_DECLARE() macro. either way, the convention is to define another macro and then use that throughout the implementation to access the variable. the variable name is usually prefixed by V_ to express that it's virtualized. the VNET() macro then translates accesses to that variable into the copy of the currently selected instance (see the "Virtual instance selection" section 👀):

#define   V_name    VNET(name)

NOTE: do not confuse this with the convention used by VFS(9). different vibe entirely 💀

the VNET_NAME() macro returns the offset within the memory region of the virtual network stack instance.

🦋 Virtual Instance Selection

there are three different places where the current virtual network stack pointer is stored and can be taken from:

1. a prison:

(struct prison *)->pr_vnet

for convenience the following macros are provided:

CRED_TO_VNET(struct ucred *)
TD_TO_VNET(struct thread *)
P_TO_VNET(struct proc *)

2. a socket:

(struct socket *)->so_vnet

3. an interface:

(struct ifnet *)->if_vnet

in addition, the currently active instance is cached in curthread->td_vnet, which is usually only accessed through the curvnet macro.

to set the correct context of the current virtual network instance, use the CURVNET_SET() or CURVNET_SET_QUIET() macros. the CURVNET_SET_QUIET() version will not record vnet recursions in case the kernel was compiled with options VNET_DEBUG, and should thus only be used in well known cases where recursion is unavoidable. both macros will save the previous state on the stack, and it must be restored with the CURVNET_RESTORE() macro. 🫡

NOTE: since the previous state is saved on the stack, you cannot have multiple CURVNET_SET() calls in the same block. that's a no.

NOTE: since the previous state is saved on the stack, a CURVNET_RESTORE() call has to be in the same block as the CURVNET_SET() call, or in a subblock with the same idea of the saved instances as the outer block. keep the family together fr fr.

NOTE: since each macro is a set of operations and — as previously explained — can't be put into its own block when defined, you cannot conditionally set the current vnet context. this will not work: c if (condition) CURVNET_SET(vnet); nor would this work: c if (condition) { CURVNET_SET(vnet); } CURVNET_RESTORE(); 😭 tragic but true

sometimes you need to loop over all virtual instances — for example to update virtual from global state, to run a function from a callout(9) for each instance, etc. for those cases the VNET_ITERATOR_DECL() and VNET_FOREACH() macros are provided. the former defines the variable that iterates over the loop, and the latter loops over all of the virtual network stack instances. see "Locking" for how to safely traverse the list of all virtual instances 🔒

the IS_DEFAULT_VNET() macro provides a safe way to check whether the currently active instance is the unrestricted default network stack of the base system (vnet0). 💅

the VNET_ASSERT() macro provides a way to conditionally add assertions that are only active with options VIMAGE compiled in and either options VNET_DEBUG or options INVARIANTS enabled as well. it uses the same semantics as KASSERT(9). ✨

🔒 Locking

for public access to the list of virtual network stack instances — e.g., by the VNET_FOREACH() macro — read locks are provided. macros are used to abstract from the actual type of the locks. if a caller may sleep while traversing the list, it must use the VNET_LIST_RLOCK() and VNET_LIST_RUNLOCK() macros. otherwise, the caller can use VNET_LIST_RLOCK_NOSLEEP() and VNET_LIST_RUNLOCK_NOSLEEP(). choose wisely bestie 🌸

🌈 Startup and Teardown Functions

to start or tear down a virtual network stack instance, the internal functions vnet_alloc() and vnet_destroy() are provided and called from the jail framework. they run the publicly provided methods to handle network stack startup and teardown. 👑

for public control, the system startup interface has been enhanced to not only handle a system boot but to also handle a virtual network stack startup and teardown. to the base system, the VNET_SYSINIT() and VNET_SYSUNINIT() macros look exactly as if there were no virtual network stack. in fact, if options VIMAGE is not compiled in, they're compiled to the standard SYSINIT() macros. in addition to that, they're run for each virtual network stack when starting or, in reverse order, when shutting down. not me being obsessed with backwards-compatible glow-ups 💜

💜 Eventhandlers

eventhandlers can be handled in two ways:

1. save the tags returned in each virtual instance and properly free the eventhandlers on teardown using those, or
2. use one eventhandler that will iterate over all virtual network stack instances.

for the first case you can just use the normal EVENTHANDLER(9) functions, while for the second case the VNET_GLOBAL_EVENTHANDLER_REGISTER() and VNET_GLOBAL_EVENTHANDLER_REGISTER_TAG() macros are provided. these differ in that VNET_GLOBAL_EVENTHANDLER_REGISTER_TAG() takes an extra first argument that will carry the tag upon return. eventhandlers registered with either of these will not run func directly — instead func will be called from an internal iterator function for each vnet. both macros can only be used for eventhandlers that do not take additional arguments, since the variadic arguments from an EVENTHANDLER_INVOKE(9) call will be ignored. 🙈

🍓 Sysctl Handling

a sysctl(9) can be virtualized by adding the CTLFLAG_VNET control flag to the ctlflags bitmask of the macros. tiny change, massive slay ✨

---

🔥 SEE ALSO 🔥

jail(2), kvm(3), EVENTHANDLER(9), KASSERT(9), sysctl(9)

Marko Zec, Implementing a Clonable Network Stack in the FreeBSD Kernel, USENIX ATC'03, June 2003, Boston 📚

---

🌸 HISTORY 🌸

the virtual network stack implementation first appeared in FreeBSD 8.0. OG behavior tbh 👑

---

💖 AUTHORS 💖

the VNET framework was designed and implemented at the University of Zagreb by Marko Zec under sponsorship of the FreeBSD Foundation and NLnet Foundation, and later extended and refined by Bjoern A. Zeeb (also under FreeBSD Foundation sponsorship), and Robert Watson. legends only 🫶

this manual page was written by Bjoern A. Zeeb, CK Software GmbH, under sponsorship from the FreeBSD Foundation. ✍️

---

and that's the whole page bestie — brought to you by the Debian build, dated September 19, 2025, VNET(9) and out 💅✨