| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <s626klsk5bzidowkph3j7dk4bxnn2f45kyfkespfwz4ykbzazl@mhpju54tahiu>
Date: Wed, 12 Nov 2025 15:23:00 +0100
From: Stefano Garzarella <sgarzare@...hat.com>
To: Bobby Eshleman <bobbyeshleman@...il.com>
Cc: Shuah Khan <shuah@...nel.org>, "David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>,
Stefan Hajnoczi <stefanha@...hat.com>, "Michael S. Tsirkin" <mst@...hat.com>,
Jason Wang <jasowang@...hat.com>, Xuan Zhuo <xuanzhuo@...ux.alibaba.com>,
Eugenio Pérez <eperezma@...hat.com>, "K. Y. Srinivasan" <kys@...rosoft.com>,
Haiyang Zhang <haiyangz@...rosoft.com>, Wei Liu <wei.liu@...nel.org>, Dexuan Cui <decui@...rosoft.com>,
Bryan Tan <bryan-bt.tan@...adcom.com>, Vishnu Dasa <vishnu.dasa@...adcom.com>,
Broadcom internal kernel review list <bcm-kernel-feedback-list@...adcom.com>, virtualization@...ts.linux.dev, netdev@...r.kernel.org,
linux-kselftest@...r.kernel.org, linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
linux-hyperv@...r.kernel.org, Sargun Dhillon <sargun@...gun.me>, berrange@...hat.com,
Bobby Eshleman <bobbyeshleman@...a.com>
Subject: Re: [PATCH net-next v9 10/14] selftests/vsock: prepare vm management
helpers for namespaces
On Tue, Nov 11, 2025 at 10:54:52PM -0800, Bobby Eshleman wrote:
>From: Bobby Eshleman <bobbyeshleman@...a.com>
>
>Add namespace support to vm management, ssh helpers, and vsock_test
>wrapper functions. This enables running VMs and test helpers in specific
>namespaces, which is required for upcoming namespace isolation tests.
>
>The functions still work correctly within the init ns, though the caller
>must now pass "init_ns" explicitly.
>
>No functional changes for existing tests. All have been updated to pass
>"init_ns" explicitly.
>
>Affected functions (such as vm_start() and vm_ssh()) now wrap their
>commands with 'ip netns exec' when executing commands in non-init
>namespaces.
>
>Signed-off-by: Bobby Eshleman <bobbyeshleman@...a.com>
>---
> tools/testing/selftests/vsock/vmtest.sh | 100 ++++++++++++++++++++++----------
> 1 file changed, 68 insertions(+), 32 deletions(-)
Reviewed-by: Stefano Garzarella <sgarzare@...hat.com>
>
>diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh
>index f78cc574c274..663be2da4e22 100755
>--- a/tools/testing/selftests/vsock/vmtest.sh
>+++ b/tools/testing/selftests/vsock/vmtest.sh
>@@ -144,7 +144,18 @@ ns_set_mode() {
> }
>
> vm_ssh() {
>- ssh -q -o UserKnownHostsFile=/dev/null -p ${SSH_HOST_PORT} localhost "$@"
>+ local ns_exec
>+
>+ if [[ "${1}" == init_ns ]]; then
>+ ns_exec=""
>+ else
>+ ns_exec="ip netns exec ${1}"
>+ fi
>+
>+ shift
>+
>+ ${ns_exec} ssh -q -o UserKnownHostsFile=/dev/null -p "${SSH_HOST_PORT}" localhost "$@"
>+
> return $?
> }
>
>@@ -267,10 +278,12 @@ terminate_pidfiles() {
>
> vm_start() {
> local pidfile=$1
>+ local ns=$2
> local logfile=/dev/null
> local verbose_opt=""
> local kernel_opt=""
> local qemu_opts=""
>+ local ns_exec=""
> local qemu
>
> qemu=$(command -v "${QEMU}")
>@@ -291,7 +304,11 @@ vm_start() {
> kernel_opt="${KERNEL_CHECKOUT}"
> fi
>
>- vng \
>+ if [[ "${ns}" != "init_ns" ]]; then
>+ ns_exec="ip netns exec ${ns}"
>+ fi
>+
>+ ${ns_exec} vng \
> --run \
> ${kernel_opt} \
> ${verbose_opt} \
>@@ -306,6 +323,7 @@ vm_start() {
> }
>
> vm_wait_for_ssh() {
>+ local ns=$1
> local i
>
> i=0
>@@ -313,7 +331,8 @@ vm_wait_for_ssh() {
> if [[ ${i} -gt ${WAIT_PERIOD_MAX} ]]; then
> die "Timed out waiting for guest ssh"
> fi
>- if vm_ssh -- true; then
>+
>+ if vm_ssh "${ns}" -- true; then
> break
> fi
> i=$(( i + 1 ))
>@@ -347,30 +366,40 @@ wait_for_listener()
> }
>
> vm_wait_for_listener() {
>- local port=$1
>+ local ns=$1
>+ local port=$2
>
>- vm_ssh <<EOF
>+ vm_ssh "${ns}" <<EOF
> $(declare -f wait_for_listener)
> wait_for_listener ${port} ${WAIT_PERIOD} ${WAIT_PERIOD_MAX}
> EOF
> }
>
> host_wait_for_listener() {
>- local port=$1
>+ local ns=$1
>+ local port=$2
>
>- wait_for_listener "${port}" "${WAIT_PERIOD}" "${WAIT_PERIOD_MAX}"
>+ if [[ "${ns}" == "init_ns" ]]; then
>+ wait_for_listener "${port}" "${WAIT_PERIOD}" "${WAIT_PERIOD_MAX}"
>+ else
>+ ip netns exec "${ns}" bash <<-EOF
>+ $(declare -f wait_for_listener)
>+ wait_for_listener ${port} ${WAIT_PERIOD} ${WAIT_PERIOD_MAX}
>+ EOF
>+ fi
> }
>
> vm_vsock_test() {
>- local host=$1
>- local cid=$2
>- local port=$3
>+ local ns=$1
>+ local host=$2
>+ local cid=$3
>+ local port=$4
> local rc
>
> # log output and use pipefail to respect vsock_test errors
> set -o pipefail
> if [[ "${host}" != server ]]; then
>- vm_ssh -- "${VSOCK_TEST}" \
>+ vm_ssh "${ns}" -- "${VSOCK_TEST}" \
> --mode=client \
> --control-host="${host}" \
> --peer-cid="${cid}" \
>@@ -378,7 +407,7 @@ vm_vsock_test() {
> 2>&1 | log_guest
> rc=$?
> else
>- vm_ssh -- "${VSOCK_TEST}" \
>+ vm_ssh "${ns}" -- "${VSOCK_TEST}" \
> --mode=server \
> --peer-cid="${cid}" \
> --control-port="${port}" \
>@@ -390,7 +419,7 @@ vm_vsock_test() {
> return $rc
> fi
>
>- vm_wait_for_listener "${port}"
>+ vm_wait_for_listener "${ns}" "${port}"
> rc=$?
> fi
> set +o pipefail
>@@ -399,22 +428,28 @@ vm_vsock_test() {
> }
>
> host_vsock_test() {
>- local host=$1
>- local cid=$2
>- local port=$3
>+ local ns=$1
>+ local host=$2
>+ local cid=$3
>+ local port=$4
> local rc
>
>+ local cmd="${VSOCK_TEST}"
>+ if [[ "${ns}" != "init_ns" ]]; then
>+ cmd="ip netns exec ${ns} ${cmd}"
>+ fi
>+
> # log output and use pipefail to respect vsock_test errors
> set -o pipefail
> if [[ "${host}" != server ]]; then
>- ${VSOCK_TEST} \
>+ ${cmd} \
> --mode=client \
> --peer-cid="${cid}" \
> --control-host="${host}" \
> --control-port="${port}" 2>&1 | log_host
> rc=$?
> else
>- ${VSOCK_TEST} \
>+ ${cmd} \
> --mode=server \
> --peer-cid="${cid}" \
> --control-port="${port}" 2>&1 | log_host &
>@@ -425,7 +460,7 @@ host_vsock_test() {
> return $rc
> fi
>
>- host_wait_for_listener "${port}"
>+ host_wait_for_listener "${ns}" "${port}"
> rc=$?
> fi
> set +o pipefail
>@@ -469,11 +504,11 @@ log_guest() {
> }
>
> test_vm_server_host_client() {
>- if ! vm_vsock_test "server" 2 "${TEST_GUEST_PORT}"; then
>+ if ! vm_vsock_test "init_ns" "server" 2 "${TEST_GUEST_PORT}"; then
> return "${KSFT_FAIL}"
> fi
>
>- if ! host_vsock_test "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}"; then
>+ if ! host_vsock_test "init_ns" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}"; then
> return "${KSFT_FAIL}"
> fi
>
>@@ -481,11 +516,11 @@ test_vm_server_host_client() {
> }
>
> test_vm_client_host_server() {
>- if ! host_vsock_test "server" "${VSOCK_CID}" "${TEST_HOST_PORT_LISTENER}"; then
>+ if ! host_vsock_test "init_ns" "server" "${VSOCK_CID}" "${TEST_HOST_PORT_LISTENER}"; then
> return "${KSFT_FAIL}"
> fi
>
>- if ! vm_vsock_test "10.0.2.2" 2 "${TEST_HOST_PORT_LISTENER}"; then
>+ if ! vm_vsock_test "init_ns" "10.0.2.2" 2 "${TEST_HOST_PORT_LISTENER}"; then
> return "${KSFT_FAIL}"
> fi
>
>@@ -495,13 +530,14 @@ test_vm_client_host_server() {
> test_vm_loopback() {
> local port=60000 # non-forwarded local port
>
>- vm_ssh -- modprobe vsock_loopback &> /dev/null || :
>+ vm_ssh "init_ns" -- modprobe vsock_loopback &> /dev/null || :
>
>- if ! vm_vsock_test "server" 1 "${port}"; then
>+ if ! vm_vsock_test "init_ns" "server" 1 "${port}"; then
> return "${KSFT_FAIL}"
> fi
>
>- if ! vm_vsock_test "127.0.0.1" 1 "${port}"; then
>+
>+ if ! vm_vsock_test "init_ns" "127.0.0.1" 1 "${port}"; then
> return "${KSFT_FAIL}"
> fi
>
>@@ -559,8 +595,8 @@ run_shared_vm_test() {
>
> host_oops_cnt_before=$(dmesg | grep -c -i 'Oops')
> host_warn_cnt_before=$(dmesg --level=warn | grep -c -i 'vsock')
>- vm_oops_cnt_before=$(vm_ssh -- dmesg | grep -c -i 'Oops')
>- vm_warn_cnt_before=$(vm_ssh -- dmesg --level=warn | grep -c -i 'vsock')
>+ vm_oops_cnt_before=$(vm_ssh "init_ns" -- dmesg | grep -c -i 'Oops')
>+ vm_warn_cnt_before=$(vm_ssh "init_ns" -- dmesg --level=warn | grep -c -i 'vsock')
>
> name=$(echo "${1}" | awk '{ print $1 }')
> eval test_"${name}"
>@@ -578,13 +614,13 @@ run_shared_vm_test() {
> rc=$KSFT_FAIL
> fi
>
>- vm_oops_cnt_after=$(vm_ssh -- dmesg | grep -i 'Oops' | wc -l)
>+ vm_oops_cnt_after=$(vm_ssh "init_ns" -- dmesg | grep -i 'Oops' | wc -l)
> if [[ ${vm_oops_cnt_after} -gt ${vm_oops_cnt_before} ]]; then
> echo "FAIL: kernel oops detected on vm" | log_host
> rc=$KSFT_FAIL
> fi
>
>- vm_warn_cnt_after=$(vm_ssh -- dmesg --level=warn | grep -c -i 'vsock')
>+ vm_warn_cnt_after=$(vm_ssh "init_ns" -- dmesg --level=warn | grep -c -i 'vsock')
> if [[ ${vm_warn_cnt_after} -gt ${vm_warn_cnt_before} ]]; then
> echo "FAIL: kernel warning detected on vm" | log_host
> rc=$KSFT_FAIL
>@@ -630,8 +666,8 @@ cnt_total=0
> if shared_vm_tests_requested "${ARGS[@]}"; then
> log_host "Booting up VM"
> pidfile="$(create_pidfile)"
>- vm_start "${pidfile}"
>- vm_wait_for_ssh
>+ vm_start "${pidfile}" "init_ns"
>+ vm_wait_for_ssh "init_ns"
> log_host "VM booted up"
>
> run_shared_vm_tests "${ARGS[@]}"
>
>--
>2.47.3
>
Powered by blists - more mailing lists