From: Bobby Eshleman bobbyeshleman@meta.com

Add netns logic to vsock core. Additionally, modify transport hook prototypes to be used by later transport-specific patches (e.g., *_seqpacket_allow()).

Namespaces are supported primarily by changing socket lookup functions (e.g., vsock_find_connected_socket()) to take into account the socket namespace and the namespace mode before considering a candidate socket a "match".

This patch also introduces the sysctl /proc/sys/net/vsock/ns_mode that accepts the "global" or "local" mode strings.

Add netns functionality (initialization, passing to transports, procfs, etc...) to the af_vsock socket layer. Later patches that add netns support to transports depend on this patch.

seqpacket_allow() callbacks are modified to take a vsk so that transport implementations can inspect sock_net(sk) and vsk->net_mode when performing lookups (e.g., vhost does this in its future netns patch). Because the API change affects all transports, it seemed more appropriate to make this internal API change in the "vsock core" patch then in the "vhost" patch.

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v10: - add file-level comment about what happens to sockets/devices when the namespace mode changes (Stefano) - change the 'if (write)' boolean in vsock_net_mode_string() to if (!write), this simplifies a later patch which adds "goto" for mutex unlocking on function exit.

Changes in v9: - remove virtio_vsock_alloc_rx_skb() (Stefano) - remove vsock_global_dummy_net, not needed as net=NULL + net_mode=VSOCK_NET_MODE_GLOBAL achieves identical result

Changes in v7: - hv_sock: fix hyperv build error - explain why vhost does not use the dummy - explain usage of __vsock_global_dummy_net - explain why VSOCK_NET_MODE_STR_MAX is 8 characters - use switch-case in vsock_net_mode_string() - avoid changing transports as much as possible - add vsock_find_{bound,connected}_socket_net() - rename `vsock_hdr` to `sysctl_hdr` - add virtio_vsock_alloc_linear_skb() wrapper for setting dummy net and global mode for virtio-vsock, move skb->cb zero-ing into wrapper - explain seqpacket_allow() change - move net setting to __vsock_create() instead of vsock_create() so that child sockets also have their net assigned upon accept()

Changes in v6: - unregister sysctl ops in vsock_exit() - af_vsock: clarify description of CID behavior - af_vsock: fix buf vs buffer naming, and length checking - af_vsock: fix length checking w/ correct ctl_table->maxlen

Changes in v5: - vsock_global_net() -> vsock_global_dummy_net() - update comments for new uAPI - use /proc/sys/net/vsock/ns_mode instead of /proc/net/vsock_ns_mode - add prototype changes so patch remains compilable --- drivers/vhost/vsock.c | 6 +- include/net/af_vsock.h | 9 +- net/vmw_vsock/af_vsock.c | 258 ++++++++++++++++++++++++++++++++++++--- net/vmw_vsock/virtio_transport.c | 6 +- net/vmw_vsock/vsock_loopback.c | 6 +- 5 files changed, 261 insertions(+), 24 deletions(-)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index ae01457ea2cd..69074656263d 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -404,7 +404,8 @@ static bool vhost_transport_msgzerocopy_allow(void) return true; }

-static bool vhost_transport_seqpacket_allow(u32 remote_cid); +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, + u32 remote_cid);

static struct virtio_transport vhost_transport = { .transport = { @@ -460,7 +461,8 @@ static struct virtio_transport vhost_transport = { .send_pkt = vhost_transport_send_pkt, };

-static bool vhost_transport_seqpacket_allow(u32 remote_cid) +static bool vhost_transport_seqpacket_allow(struct vsock_sock *vsk, + u32 remote_cid) { struct vhost_vsock *vsock; bool seqpacket_allow = false; diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 9b5bdd083b6f..59d97a143204 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -145,7 +145,7 @@ struct vsock_transport { int flags); int (*seqpacket_enqueue)(struct vsock_sock *vsk, struct msghdr *msg, size_t len); - bool (*seqpacket_allow)(u32 remote_cid); + bool (*seqpacket_allow)(struct vsock_sock *vsk, u32 remote_cid); u32 (*seqpacket_has_data)(struct vsock_sock *vsk);

/* Notification. */ @@ -218,6 +218,13 @@ void vsock_remove_connected(struct vsock_sock *vsk); struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr); struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, struct sockaddr_vm *dst); +struct sock *vsock_find_bound_socket_net(struct sockaddr_vm *addr, + struct net *net, + enum vsock_net_mode net_mode); +struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src, + struct sockaddr_vm *dst, + struct net *net, + enum vsock_net_mode net_mode); void vsock_remove_sock(struct vsock_sock *vsk); void vsock_for_each_connected_socket(struct vsock_transport *transport, void (*fn)(struct sock *sk)); diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index adcba1b7bf74..243c0d588682 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -83,6 +83,38 @@ * TCP_ESTABLISHED - connected * TCP_CLOSING - disconnecting * TCP_LISTEN - listening + * + * - Namespaces in vsock support two different modes configured + * through /proc/sys/net/vsock/ns_mode. The modes are "local" and "global". + * Each mode defines how the namespace interacts with CIDs. + * /proc/sys/net/vsock/ns_mode is write-once, so that it may be configured + * and locked down by a namespace manager. The default is "global". The mode + * is set per-namespace. + * + * The modes affect the allocation and accessibility of CIDs as follows: + * + * - global - access and allocation are all system-wide + * - all CID allocation from global namespaces draw from the same + * system-wide pool. + * - if one global namespace has already allocated some CID, another + * global namespace will not be able to allocate the same CID. + * - global mode AF_VSOCK sockets can reach any VM or socket in any global + * namespace, they are not contained to only their own namespace. + * - AF_VSOCK sockets in a global mode namespace cannot reach VMs or + * sockets in any local mode namespace. + * - local - access and allocation are contained within the namespace + * - CID allocation draws only from a private pool local only to the + * namespace, and does not affect the CIDs available for allocation in any + * other namespace (global or local). + * - VMs in a local namespace do not collide with CIDs in any other local + * namespace or any global namespace. For example, if a VM in a local mode + * namespace is given CID 10, then CID 10 is still available for + * allocation in any other namespace, but not in the same namespace. + * - AF_VSOCK sockets in a local mode namespace can connect only to VMs or + * other sockets within their own namespace. + * - when a socket or device is initialized in a namespace with mode + * global, it will stay in global mode even if the namespace later + * changes to local. */

#include <linux/compat.h> @@ -100,6 +132,7 @@ #include <linux/module.h> #include <linux/mutex.h> #include <linux/net.h> +#include <linux/proc_fs.h> #include <linux/poll.h> #include <linux/random.h> #include <linux/skbuff.h> @@ -111,9 +144,18 @@ #include <linux/workqueue.h> #include <net/sock.h> #include <net/af_vsock.h> +#include <net/netns/vsock.h> #include <uapi/linux/vm_sockets.h> #include <uapi/asm-generic/ioctls.h>

+#define VSOCK_NET_MODE_STR_GLOBAL "global" +#define VSOCK_NET_MODE_STR_LOCAL "local" + +/* 6 chars for "global", 1 for null-terminator, and 1 more for '\n'. + * The newline is added by proc_dostring() for read operations. + */ +#define VSOCK_NET_MODE_STR_MAX 8 + static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr); static void vsock_sk_destruct(struct sock *sk); static int vsock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb); @@ -235,33 +277,47 @@ static void __vsock_remove_connected(struct vsock_sock *vsk) sock_put(&vsk->sk); }

-static struct sock *__vsock_find_bound_socket(struct sockaddr_vm *addr) +static struct sock *__vsock_find_bound_socket_net(struct sockaddr_vm *addr, + struct net *net, + enum vsock_net_mode net_mode) { struct vsock_sock *vsk;

list_for_each_entry(vsk, vsock_bound_sockets(addr), bound_table) { - if (vsock_addr_equals_addr(addr, &vsk->local_addr)) - return sk_vsock(vsk); + struct sock *sk = sk_vsock(vsk); + + if (vsock_addr_equals_addr(addr, &vsk->local_addr) && + vsock_net_check_mode(sock_net(sk), vsk->net_mode, net, + net_mode)) + return sk;

if (addr->svm_port == vsk->local_addr.svm_port && (vsk->local_addr.svm_cid == VMADDR_CID_ANY || - addr->svm_cid == VMADDR_CID_ANY)) - return sk_vsock(vsk); + addr->svm_cid == VMADDR_CID_ANY) && + vsock_net_check_mode(sock_net(sk), vsk->net_mode, net, + net_mode)) + return sk; }

return NULL; }

-static struct sock *__vsock_find_connected_socket(struct sockaddr_vm *src, - struct sockaddr_vm *dst) +static struct sock * +__vsock_find_connected_socket_net(struct sockaddr_vm *src, + struct sockaddr_vm *dst, struct net *net, + enum vsock_net_mode net_mode) { struct vsock_sock *vsk;

list_for_each_entry(vsk, vsock_connected_sockets(src, dst), connected_table) { + struct sock *sk = sk_vsock(vsk); + if (vsock_addr_equals_addr(src, &vsk->remote_addr) && - dst->svm_port == vsk->local_addr.svm_port) { - return sk_vsock(vsk); + dst->svm_port == vsk->local_addr.svm_port && + vsock_net_check_mode(sock_net(sk), vsk->net_mode, net, + net_mode)) { + return sk; } }

@@ -304,12 +360,14 @@ void vsock_remove_connected(struct vsock_sock *vsk) } EXPORT_SYMBOL_GPL(vsock_remove_connected);

-struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) +struct sock *vsock_find_bound_socket_net(struct sockaddr_vm *addr, + struct net *net, + enum vsock_net_mode net_mode) { struct sock *sk;

spin_lock_bh(&vsock_table_lock); - sk = __vsock_find_bound_socket(addr); + sk = __vsock_find_bound_socket_net(addr, net, net_mode); if (sk) sock_hold(sk);

@@ -317,15 +375,23 @@ struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr)

return sk; } +EXPORT_SYMBOL_GPL(vsock_find_bound_socket_net); + +struct sock *vsock_find_bound_socket(struct sockaddr_vm *addr) +{ + return vsock_find_bound_socket_net(addr, NULL, VSOCK_NET_MODE_GLOBAL); +} EXPORT_SYMBOL_GPL(vsock_find_bound_socket);

-struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, - struct sockaddr_vm *dst) +struct sock *vsock_find_connected_socket_net(struct sockaddr_vm *src, + struct sockaddr_vm *dst, + struct net *net, + enum vsock_net_mode net_mode) { struct sock *sk;

spin_lock_bh(&vsock_table_lock); - sk = __vsock_find_connected_socket(src, dst); + sk = __vsock_find_connected_socket_net(src, dst, net, net_mode); if (sk) sock_hold(sk);

@@ -333,6 +399,14 @@ struct sock *vsock_find_connected_socket(struct sockaddr_vm *src,

return sk; } +EXPORT_SYMBOL_GPL(vsock_find_connected_socket_net); + +struct sock *vsock_find_connected_socket(struct sockaddr_vm *src, + struct sockaddr_vm *dst) +{ + return vsock_find_connected_socket_net(src, dst, + NULL, VSOCK_NET_MODE_GLOBAL); +} EXPORT_SYMBOL_GPL(vsock_find_connected_socket);

void vsock_remove_sock(struct vsock_sock *vsk) @@ -528,7 +602,7 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk)

if (sk->sk_type == SOCK_SEQPACKET) { if (!new_transport->seqpacket_allow || - !new_transport->seqpacket_allow(remote_cid)) { + !new_transport->seqpacket_allow(vsk, remote_cid)) { module_put(new_transport->module); return -ESOCKTNOSUPPORT; } @@ -676,6 +750,7 @@ static void vsock_pending_work(struct work_struct *work) static int __vsock_bind_connectible(struct vsock_sock *vsk, struct sockaddr_vm *addr) { + struct net *net = sock_net(sk_vsock(vsk)); static u32 port; struct sockaddr_vm new_addr;

@@ -695,7 +770,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk,

new_addr.svm_port = port++;

- if (!__vsock_find_bound_socket(&new_addr)) { + if (!__vsock_find_bound_socket_net(&new_addr, net, + vsk->net_mode)) { found = true; break; } @@ -712,7 +788,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk, return -EACCES; }

- if (__vsock_find_bound_socket(&new_addr)) + if (__vsock_find_bound_socket_net(&new_addr, net, + vsk->net_mode)) return -EADDRINUSE; }

@@ -836,6 +913,8 @@ static struct sock *__vsock_create(struct net *net, vsk->buffer_max_size = VSOCK_DEFAULT_BUFFER_MAX_SIZE; }

+ vsk->net_mode = vsock_net_mode(net); + return sk; }

@@ -2658,6 +2737,142 @@ static struct miscdevice vsock_device = { .fops = &vsock_device_ops, };

+static int vsock_net_mode_string(const struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos) +{ + char data[VSOCK_NET_MODE_STR_MAX] = {0}; + enum vsock_net_mode mode; + struct ctl_table tmp; + struct net *net; + int ret; + + if (!table->data || !table->maxlen || !*lenp) { + *lenp = 0; + return 0; + } + + net = current->nsproxy->net_ns; + tmp = *table; + tmp.data = data; + + if (!write) { + const char *p; + + mode = vsock_net_mode(net); + + switch (mode) { + case VSOCK_NET_MODE_GLOBAL: + p = VSOCK_NET_MODE_STR_GLOBAL; + break; + case VSOCK_NET_MODE_LOCAL: + p = VSOCK_NET_MODE_STR_LOCAL; + break; + default: + WARN_ONCE(true, "netns has invalid vsock mode"); + *lenp = 0; + return 0; + } + + strscpy(data, p, sizeof(data)); + tmp.maxlen = strlen(p); + } + + ret = proc_dostring(&tmp, write, buffer, lenp, ppos); + if (ret) + return ret; + + if (!write) + return 0; + + if (*lenp >= sizeof(data)) + return -EINVAL; + + if (!strncmp(data, VSOCK_NET_MODE_STR_GLOBAL, sizeof(data))) + mode = VSOCK_NET_MODE_GLOBAL; + else if (!strncmp(data, VSOCK_NET_MODE_STR_LOCAL, sizeof(data))) + mode = VSOCK_NET_MODE_LOCAL; + else + return -EINVAL; + + if (!vsock_net_write_mode(net, mode)) + return -EPERM; + + return 0; +} + +static struct ctl_table vsock_table[] = { + { + .procname = "ns_mode", + .data = &init_net.vsock.mode, + .maxlen = VSOCK_NET_MODE_STR_MAX, + .mode = 0644, + .proc_handler = vsock_net_mode_string + }, +}; + +static int __net_init vsock_sysctl_register(struct net *net) +{ + struct ctl_table *table; + + if (net_eq(net, &init_net)) { + table = vsock_table; + } else { + table = kmemdup(vsock_table, sizeof(vsock_table), GFP_KERNEL); + if (!table) + goto err_alloc; + + table[0].data = &net->vsock.mode; + } + + net->vsock.sysctl_hdr = register_net_sysctl_sz(net, "net/vsock", table, + ARRAY_SIZE(vsock_table)); + if (!net->vsock.sysctl_hdr) + goto err_reg; + + return 0; + +err_reg: + if (!net_eq(net, &init_net)) + kfree(table); +err_alloc: + return -ENOMEM; +} + +static void vsock_sysctl_unregister(struct net *net) +{ + const struct ctl_table *table; + + table = net->vsock.sysctl_hdr->ctl_table_arg; + unregister_net_sysctl_table(net->vsock.sysctl_hdr); + if (!net_eq(net, &init_net)) + kfree(table); +} + +static void vsock_net_init(struct net *net) +{ + net->vsock.mode = VSOCK_NET_MODE_GLOBAL; +} + +static __net_init int vsock_sysctl_init_net(struct net *net) +{ + vsock_net_init(net); + + if (vsock_sysctl_register(net)) + return -ENOMEM; + + return 0; +} + +static __net_exit void vsock_sysctl_exit_net(struct net *net) +{ + vsock_sysctl_unregister(net); +} + +static struct pernet_operations vsock_sysctl_ops __net_initdata = { + .init = vsock_sysctl_init_net, + .exit = vsock_sysctl_exit_net, +}; + static int __init vsock_init(void) { int err = 0; @@ -2685,10 +2900,18 @@ static int __init vsock_init(void) goto err_unregister_proto; }

+ if (register_pernet_subsys(&vsock_sysctl_ops)) { + err = -ENOMEM; + goto err_unregister_sock; + } + + vsock_net_init(&init_net); vsock_bpf_build_proto();

return 0;

+err_unregister_sock: + sock_unregister(AF_VSOCK); err_unregister_proto: proto_unregister(&vsock_proto); err_deregister_misc: @@ -2702,6 +2925,7 @@ static void __exit vsock_exit(void) misc_deregister(&vsock_device); sock_unregister(AF_VSOCK); proto_unregister(&vsock_proto); + unregister_pernet_subsys(&vsock_sysctl_ops); }

const struct vsock_transport *vsock_core_get_transport(struct vsock_sock *vsk) diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index 8c867023a2e5..d365a4b371d0 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -536,7 +536,8 @@ static bool virtio_transport_msgzerocopy_allow(void) return true; }

-static bool virtio_transport_seqpacket_allow(u32 remote_cid); +static bool virtio_transport_seqpacket_allow(struct vsock_sock *vsk, + u32 remote_cid);

static struct virtio_transport virtio_transport = { .transport = { @@ -593,7 +594,8 @@ static struct virtio_transport virtio_transport = { .can_msgzerocopy = virtio_transport_can_msgzerocopy, };

-static bool virtio_transport_seqpacket_allow(u32 remote_cid) +static bool +virtio_transport_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid) { struct virtio_vsock *vsock; bool seqpacket_allow; diff --git a/net/vmw_vsock/vsock_loopback.c b/net/vmw_vsock/vsock_loopback.c index bc2ff918b315..8722337a4f80 100644 --- a/net/vmw_vsock/vsock_loopback.c +++ b/net/vmw_vsock/vsock_loopback.c @@ -46,7 +46,8 @@ static int vsock_loopback_cancel_pkt(struct vsock_sock *vsk) return 0; }

-static bool vsock_loopback_seqpacket_allow(u32 remote_cid); +static bool vsock_loopback_seqpacket_allow(struct vsock_sock *vsk, + u32 remote_cid); static bool vsock_loopback_msgzerocopy_allow(void) { return true; @@ -106,7 +107,8 @@ static struct virtio_transport loopback_transport = { .send_pkt = vsock_loopback_send_pkt, };

-static bool vsock_loopback_seqpacket_allow(u32 remote_cid) +static bool +vsock_loopback_seqpacket_allow(struct vsock_sock *vsk, u32 remote_cid) { return true; }

From: Bobby Eshleman bobbyeshleman@meta.com

Associate reply packets with the sending socket. When vsock must reply with an RST packet and there exists a sending socket (e.g., for loopback), setting the skb owner to the socket correctly handles reference counting between the skb and sk (i.e., the sk stays alive until the skb is freed).

This allows the net namespace to be used for socket lookups for the duration of the reply skb's lifetime, preventing race conditions between the namespace lifecycle and vsock socket search using the namespace pointer.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - move before adding to netns support (Stefano)

Changes in v10: - break this out into its own patch for easy revert (Stefano) --- net/vmw_vsock/virtio_transport_common.c | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index dcc8a1d5851e..675eb9d83549 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1165,6 +1165,12 @@ static int virtio_transport_reset_no_sock(const struct virtio_transport *t, .op = VIRTIO_VSOCK_OP_RST, .type = le16_to_cpu(hdr->type), .reply = true, + + /* Set sk owner to socket we are replying to (may be NULL for + * non-loopback). This keeps a reference to the sock and + * sock_net(sk) until the reply skb is freed. + */ + .vsk = vsock_sk(skb->sk), }; struct sk_buff *reply;

From: Bobby Eshleman bobbyeshleman@meta.com

Add functions for initializing namespaces with the different vsock NS modes. Callers can use add_namespaces() and del_namespaces() to create namespaces global0, global1, local0, and local1.

The init_namespaces() function initializes global0, local0, etc... with their respective vsock NS mode. This function is separate so that tests that depend on this initialization can use it, while other tests that want to test the initialization interface itself can start with a clean slate by omitting this call.

Remove namespaces upon exiting the program in cleanup(). This is unlikely to be needed for a healthy run, but it is useful for tests that are manually killed mid-test. In that case, this patch prevents the subsequent test run from finding stale namespaces with already-write-once-locked vsock ns modes.

This patch is in preparation for later namespace tests.

Reviewed-by: Stefano Garzarella sgarzare@redhat.com Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- tools/testing/selftests/vsock/vmtest.sh | 41 +++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index c7b270dd77a9..f78cc574c274 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -49,6 +49,7 @@ readonly TEST_DESCS=( )

readonly USE_SHARED_VM=(vm_server_host_client vm_client_host_server vm_loopback) +readonly NS_MODES=("local" "global")

VERBOSE=0

@@ -103,6 +104,45 @@ check_result() { fi }

+add_namespaces() { + # add namespaces local0, local1, global0, and global1 + for mode in "${NS_MODES[@]}"; do + ip netns add "${mode}0" 2>/dev/null + ip netns add "${mode}1" 2>/dev/null + done +} + +init_namespaces() { + for mode in "${NS_MODES[@]}"; do + ns_set_mode "${mode}0" "${mode}" + ns_set_mode "${mode}1" "${mode}" + + log_host "set ns ${mode}0 to mode ${mode}" + log_host "set ns ${mode}1 to mode ${mode}" + + # we need lo for qemu port forwarding + ip netns exec "${mode}0" ip link set dev lo up + ip netns exec "${mode}1" ip link set dev lo up + done +} + +del_namespaces() { + for mode in "${NS_MODES[@]}"; do + ip netns del "${mode}0" &>/dev/null + ip netns del "${mode}1" &>/dev/null + log_host "removed ns ${mode}0" + log_host "removed ns ${mode}1" + done +} + +ns_set_mode() { + local ns=$1 + local mode=$2 + + echo "${mode}" | ip netns exec "${ns}" \ + tee /proc/sys/net/vsock/ns_mode &>/dev/null +} + vm_ssh() { ssh -q -o UserKnownHostsFile=/dev/null -p ${SSH_HOST_PORT} localhost "$@" return $? @@ -110,6 +150,7 @@ vm_ssh() {

cleanup() { terminate_pidfiles "${!PIDFILES[@]}" + del_namespaces }

check_args() {

From: Bobby Eshleman bobbyeshleman@meta.com

These functions are reused by the VM tests to collect and compare dmesg warnings and oops counts. The future VM-specific tests use them heavily. This patches relies on vm_ssh() already supporting namespaces.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - break these out into an earlier patch so that they can be used directly in new patches (instead of causing churn by adding this later) --- tools/testing/selftests/vsock/vmtest.sh | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index 4da91828a6a0..1623e4da15e2 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -389,6 +389,17 @@ host_wait_for_listener() { fi }

+vm_dmesg_oops_count() { + local ns=$1 + + vm_ssh "${ns}" -- dmesg 2>/dev/null | grep -c -i 'Oops' +} + +vm_dmesg_warn_count() { + local ns=$1 + + vm_ssh "${ns}" -- dmesg --level=warn 2>/dev/null | grep -c -i 'vsock' +}

vm_vsock_test() { local ns=$1 @@ -596,8 +607,8 @@ run_shared_vm_test() {

host_oops_cnt_before=$(dmesg | grep -c -i 'Oops') host_warn_cnt_before=$(dmesg --level=warn | grep -c -i 'vsock') - vm_oops_cnt_before=$(vm_ssh -- dmesg | grep -c -i 'Oops') - vm_warn_cnt_before=$(vm_ssh -- dmesg --level=warn | grep -c -i 'vsock') + vm_oops_cnt_before=$(vm_dmesg_oops_count "init_ns") + vm_warn_cnt_before=$(vm_dmesg_warn_count "init_ns")

name=$(echo "${1}" | awk '{ print $1 }') eval test_"${name}" @@ -615,13 +626,13 @@ run_shared_vm_test() { rc=$KSFT_FAIL fi

- vm_oops_cnt_after=$(vm_ssh -- dmesg | grep -i 'Oops' | wc -l) + vm_oops_cnt_after=$(vm_dmesg_oops_count "init_ns") if [[ ${vm_oops_cnt_after} -gt ${vm_oops_cnt_before} ]]; then echo "FAIL: kernel oops detected on vm" | log_host rc=$KSFT_FAIL fi

- vm_warn_cnt_after=$(vm_ssh -- dmesg --level=warn | grep -c -i 'vsock') + vm_warn_cnt_after=$(vm_dmesg_warn_count "init_ns") if [[ ${vm_warn_cnt_after} -gt ${vm_warn_cnt_before} ]]; then echo "FAIL: kernel warning detected on vm" | log_host rc=$KSFT_FAIL

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests for the /proc/sys/net/vsock/ns_mode interface. Namely, that it accepts "global" and "local" strings and enforces a write-once policy.

Start a convention of commenting the test name over the test description. Add test name comments over test descriptions that existed before this convention.

Add a check_netns() function that checks if the test requires namespaces and if the current kernel supports namespaces. Skip tests that require namespaces if the system does not have namespace support.

Add a test to verify that guest VMs with an active G2H transport (virtio-vsock) cannot set namespace mode to 'local'. This validates the mutual exclusion between G2H transports and LOCAL mode.

This patch is the first to add tests that do *not* re-use the same shared VM. For that reason, it adds a run_tests() function to run these tests and filter out the shared VM tests.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - Document ns_ prefix above TEST_NAMES (Stefano)

Changes in v10: - Remove extraneous add_namespaces/del_namespaces calls. - Rename run_tests() to run_ns_tests() since it is designed to only run ns tests.

Changes in v9: - add test ns_vm_local_mode_rejected to check that guests cannot use local mode --- tools/testing/selftests/vsock/vmtest.sh | 143 +++++++++++++++++++++++++++++++- 1 file changed, 141 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index e32997db322d..2e077e8a1777 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -41,14 +41,43 @@ readonly KERNEL_CMDLINE="\ virtme.ssh virtme_ssh_channel=tcp virtme_ssh_user=$USER \ " readonly LOG=$(mktemp /tmp/vsock_vmtest_XXXX.log) -readonly TEST_NAMES=(vm_server_host_client vm_client_host_server vm_loopback) + +# Namespace tests must use the ns_ prefix. This is checked in check_netns() and +# is used to determine if a test needs namespace setup before test execution. +readonly TEST_NAMES=( + vm_server_host_client + vm_client_host_server + vm_loopback + ns_host_vsock_ns_mode_ok + ns_host_vsock_ns_mode_write_once_ok + ns_vm_local_mode_rejected +) readonly TEST_DESCS=( + # vm_server_host_client "Run vsock_test in server mode on the VM and in client mode on the host." + + # vm_client_host_server "Run vsock_test in client mode on the VM and in server mode on the host." + + # vm_loopback "Run vsock_test using the loopback transport in the VM." + + # ns_host_vsock_ns_mode_ok + "Check /proc/sys/net/vsock/ns_mode strings on the host." + + # ns_host_vsock_ns_mode_write_once_ok + "Check /proc/sys/net/vsock/ns_mode is write-once on the host." + + # ns_vm_local_mode_rejected + "Test that guest VM with G2H transport cannot set namespace mode to 'local'" )

-readonly USE_SHARED_VM=(vm_server_host_client vm_client_host_server vm_loopback) +readonly USE_SHARED_VM=( + vm_server_host_client + vm_client_host_server + vm_loopback + ns_vm_local_mode_rejected +) readonly NS_MODES=("local" "global")

VERBOSE=0 @@ -205,6 +234,20 @@ check_deps() { fi }

+check_netns() { + local tname=$1 + + # If the test requires NS support, check if NS support exists + # using /proc/self/ns + if [[ "${tname}" =~ ^ns_ ]] && + [[ ! -e /proc/self/ns ]]; then + log_host "No NS support detected for test ${tname}" + return 1 + fi + + return 0 +} + check_vng() { local tested_versions local version @@ -528,6 +571,32 @@ log_guest() { LOG_PREFIX=guest log "$@" }

+test_ns_host_vsock_ns_mode_ok() { + for mode in "${NS_MODES[@]}"; do + if ! ns_set_mode "${mode}0" "${mode}"; then + return "${KSFT_FAIL}" + fi + done + + return "${KSFT_PASS}" +} + +test_ns_host_vsock_ns_mode_write_once_ok() { + for mode in "${NS_MODES[@]}"; do + local ns="${mode}0" + if ! ns_set_mode "${ns}" "${mode}"; then + return "${KSFT_FAIL}" + fi + + # try writing again and expect failure + if ns_set_mode "${ns}" "${mode}"; then + return "${KSFT_FAIL}" + fi + done + + return "${KSFT_PASS}" +} + test_vm_server_host_client() { if ! vm_vsock_test "init_ns" "server" 2 "${TEST_GUEST_PORT}"; then return "${KSFT_FAIL}" @@ -569,6 +638,26 @@ test_vm_loopback() { return "${KSFT_PASS}" }

+test_ns_vm_local_mode_rejected() { + # Guest VMs have a G2H transport (virtio-vsock) active, so they + # should not be able to set namespace mode to 'local'. + # This test verifies that the sysctl write fails as expected. + + # Try to set local mode in the guest's init_ns + if vm_ssh init_ns "echo local | tee /proc/sys/net/vsock/ns_mode &>/dev/null"; then + return "${KSFT_FAIL}" + fi + + # Verify mode is still 'global' + local mode + mode=$(vm_ssh init_ns "cat /proc/sys/net/vsock/ns_mode") + if [[ "${mode}" != "global" ]]; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + shared_vm_test() { local tname

@@ -601,6 +690,11 @@ run_shared_vm_tests() { continue fi

+ if ! check_netns "${arg}"; then + check_result "${KSFT_SKIP}" "${arg}" + continue + fi + run_shared_vm_test "${arg}" check_result "$?" "${arg}" done @@ -654,6 +748,49 @@ run_shared_vm_test() { return "${rc}" }

+run_ns_tests() { + for arg in "${ARGS[@]}"; do + if shared_vm_test "${arg}"; then + continue + fi + + if ! check_netns "${arg}"; then + check_result "${KSFT_SKIP}" "${arg}" + continue + fi + + add_namespaces + + name=$(echo "${arg}" | awk '{ print $1 }') + log_host "Executing test_${name}" + + host_oops_before=$(dmesg 2>/dev/null | grep -c -i 'Oops') + host_warn_before=$(dmesg --level=warn 2>/dev/null | grep -c -i 'vsock') + eval test_"${name}" + rc=$? + + host_oops_after=$(dmesg 2>/dev/null | grep -c -i 'Oops') + if [[ "${host_oops_after}" -gt "${host_oops_before}" ]]; then + echo "FAIL: kernel oops detected on host" | log_host + check_result "${KSFT_FAIL}" "${name}" + del_namespaces + continue + fi + + host_warn_after=$(dmesg --level=warn 2>/dev/null | grep -c -i 'vsock') + if [[ "${host_warn_after}" -gt "${host_warn_before}" ]]; then + echo "FAIL: kernel warning detected on host" | log_host + check_result "${KSFT_FAIL}" "${name}" + del_namespaces + continue + fi + + check_result "${rc}" "${name}" + + del_namespaces + done +} + BUILD=0 QEMU="qemu-system-$(uname -m)"

@@ -699,6 +836,8 @@ if shared_vm_tests_requested "${ARGS[@]}"; then terminate_pidfiles "${pidfile}" fi

+run_ns_tests "${ARGS[@]}" + echo "SUMMARY: PASS=${cnt_pass} SKIP=${cnt_skip} FAIL=${cnt_fail}" echo "Log: ${LOG}"

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests to validate namespace correctness using vsock_test and socat. The vsock_test tool is used to validate expected success tests, but socat is used for expected failure tests. socat is used to ensure that connections are rejected outright instead of failing due to some other socket behavior (as tested in vsock_test). Additionally, socat is already required for tunneling TCP traffic from vsock_test. Using only one of the vsock_test tests like 'test_stream_client_close_client' would have yielded a similar result, but doing so wouldn't remove the socat dependency.

Additionally, check for the dependency socat. socat needs special handling beyond just checking if it is on the path because it must be compiled with support for both vsock and unix. The function check_socat() checks that this support exists.

Add more padding to test name printf strings because the tests added in this patch would otherwise overflow.

Add vm_dmesg_start() and vm_dmesg_check() to encapsulate checking dmesg for oops and warnings.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com --- Changes in v11: - add 'sleep "${WAIT_PERIOD}"' after any non-TCP socat LISTEN cmd (Stefano) - add host_wait_for_listener() after any socat TCP-LISTEN (Stefano) - reuse vm_dmesg_{oops,warn}_count() inside vm_dmesg_check() - fix copy-paste in test_ns_same_local_vm_connect_to_local_host_ok() (Stefano)

Changes in v10: - add vm_dmesg_start() and vm_dmesg_check()

Changes in v9: - consistent variable quoting --- tools/testing/selftests/vsock/vmtest.sh | 557 +++++++++++++++++++++++++++++++- 1 file changed, 555 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index f84da1e8ad14..dfa895abfc7f 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -7,6 +7,7 @@ # * virtme-ng # * busybox-static (used by virtme-ng) # * qemu (used by virtme-ng) +# * socat # # shellcheck disable=SC2317,SC2119

@@ -55,6 +56,19 @@ readonly TEST_NAMES=( ns_local_same_cid_ok ns_global_local_same_cid_ok ns_local_global_same_cid_ok + ns_diff_global_host_connect_to_global_vm_ok + ns_diff_global_host_connect_to_local_vm_fails + ns_diff_global_vm_connect_to_global_host_ok + ns_diff_global_vm_connect_to_local_host_fails + ns_diff_local_host_connect_to_local_vm_fails + ns_diff_local_vm_connect_to_local_host_fails + ns_diff_global_to_local_loopback_local_fails + ns_diff_local_to_global_loopback_fails + ns_diff_local_to_local_loopback_fails + ns_diff_global_to_global_loopback_ok + ns_same_local_loopback_ok + ns_same_local_host_connect_to_local_vm_ok + ns_same_local_vm_connect_to_local_host_ok ) readonly TEST_DESCS=( # vm_server_host_client @@ -86,6 +100,45 @@ readonly TEST_DESCS=(

# ns_local_global_same_cid_ok "Check QEMU successfully starts one VM in a local ns and then another VM in a global ns with the same CID." + + # ns_diff_global_host_connect_to_global_vm_ok + "Run vsock_test client in global ns with server in VM in another global ns." + + # ns_diff_global_host_connect_to_local_vm_fails + "Run socat to test a process in a global ns fails to connect to a VM in a local ns." + + # ns_diff_global_vm_connect_to_global_host_ok + "Run vsock_test client in VM in a global ns with server in another global ns." + + # ns_diff_global_vm_connect_to_local_host_fails + "Run socat to test a VM in a global ns fails to connect to a host process in a local ns." + + # ns_diff_local_host_connect_to_local_vm_fails + "Run socat to test a host process in a local ns fails to connect to a VM in another local ns." + + # ns_diff_local_vm_connect_to_local_host_fails + "Run socat to test a VM in a local ns fails to connect to a host process in another local ns." + + # ns_diff_global_to_local_loopback_local_fails + "Run socat to test a loopback vsock in a global ns fails to connect to a vsock in a local ns." + + # ns_diff_local_to_global_loopback_fails + "Run socat to test a loopback vsock in a local ns fails to connect to a vsock in a global ns." + + # ns_diff_local_to_local_loopback_fails + "Run socat to test a loopback vsock in a local ns fails to connect to a vsock in another local ns." + + # ns_diff_global_to_global_loopback_ok + "Run socat to test a loopback vsock in a global ns successfully connects to a vsock in another global ns." + + # ns_same_local_loopback_ok + "Run socat to test a loopback vsock in a local ns successfully connects to a vsock in the same ns." + + # ns_same_local_host_connect_to_local_vm_ok + "Run vsock_test client in a local ns with server in VM in same ns." + + # ns_same_local_vm_connect_to_local_host_ok + "Run vsock_test client in VM in a local ns with server in same ns." )

readonly USE_SHARED_VM=( @@ -117,7 +170,7 @@ usage() { for ((i = 0; i < ${#TEST_NAMES[@]}; i++)); do name=${TEST_NAMES[${i}]} desc=${TEST_DESCS[${i}]} - printf "\t%-35s%-35s\n" "${name}" "${desc}" + printf "\t%-55s%-35s\n" "${name}" "${desc}" done echo

@@ -236,7 +289,7 @@ check_args() { }

check_deps() { - for dep in vng ${QEMU} busybox pkill ssh ss; do + for dep in vng ${QEMU} busybox pkill ssh ss socat; do if [[ ! -x $(command -v "${dep}") ]]; then echo -e "skip: dependency ${dep} not found!\n" exit "${KSFT_SKIP}" @@ -287,6 +340,20 @@ check_vng() { fi }

+check_socat() { + local support_string + + support_string="$(socat -V)" + + if [[ "${support_string}" != *"WITH_VSOCK 1"* ]]; then + die "err: socat is missing vsock support" + fi + + if [[ "${support_string}" != *"WITH_UNIX 1"* ]]; then + die "err: socat is missing unix support" + fi +} + handle_build() { if [[ ! "${BUILD}" -eq 1 ]]; then return @@ -335,6 +402,14 @@ terminate_pidfiles() { done }

+terminate_pids() { + local pid + + for pid in "$@"; do + kill -SIGTERM "${pid}" &>/dev/null || : + done +} + vm_start() { local pidfile=$1 local ns=$2 @@ -473,6 +548,28 @@ vm_dmesg_warn_count() { vm_ssh "${ns}" -- dmesg --level=warn 2>/dev/null | grep -c -i 'vsock' }

+vm_dmesg_check() { + local pidfile=$1 + local ns=$2 + local oops_before=$3 + local warn_before=$4 + local oops_after warn_after + + oops_after=$(vm_dmesg_oops_count "${ns}") + if [[ "${oops_after}" -gt "${oops_before}" ]]; then + echo "FAIL: kernel oops detected on vm in ns ${ns}" | log_host + return 1 + fi + + warn_after=$(vm_dmesg_warn_count "${ns}") + if [[ "${warn_after}" -gt "${warn_before}" ]]; then + echo "FAIL: kernel warning detected on vm in ns ${ns}" | log_host + return 1 + fi + + return 0 +} + vm_vsock_test() { local ns=$1 local host=$2 @@ -597,6 +694,461 @@ test_ns_host_vsock_ns_mode_ok() { return "${KSFT_PASS}" }

+test_ns_diff_global_host_connect_to_global_vm_ok() { + local oops_before warn_before + local pids pid pidfile + local ns0 ns1 port + declare -a pids + local unixfile + ns0="global0" + ns1="global1" + port=1234 + local rc + + init_namespaces + + pidfile="$(create_pidfile)" + + if ! vm_start "${pidfile}" "${ns0}"; then + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns0}" + oops_before=$(vm_dmesg_oops_count "${ns0}") + warn_before=$(vm_dmesg_warn_count "${ns0}") + + unixfile=$(mktemp -u /tmp/XXXX.sock) + ip netns exec "${ns1}" \ + socat TCP-LISTEN:"${TEST_HOST_PORT}",fork \ + UNIX-CONNECT:"${unixfile}" & + pids+=($!) + host_wait_for_listener "${ns1}" "${TEST_HOST_PORT}" "tcp" + + ip netns exec "${ns0}" socat UNIX-LISTEN:"${unixfile}",fork \ + TCP-CONNECT:localhost:"${TEST_HOST_PORT}" & + pids+=($!) + host_wait_for_listener "${ns0}" "${unixfile}" "unix" + + vm_vsock_test "${ns0}" "server" 2 "${TEST_GUEST_PORT}" + vm_wait_for_listener "${ns0}" "${TEST_GUEST_PORT}" "tcp" + host_vsock_test "${ns1}" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}" + rc=$? + + vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pids "${pids[@]}" + terminate_pidfiles "${pidfile}" + + if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + +test_ns_diff_global_host_connect_to_local_vm_fails() { + local oops_before warn_before + local ns0="global0" + local ns1="local0" + local port=12345 + local dmesg_rc + local pidfile + local result + local pid + + init_namespaces + + outfile=$(mktemp) + + pidfile="$(create_pidfile)" + if ! vm_start "${pidfile}" "${ns1}"; then + log_host "failed to start vm (cid=${VSOCK_CID}, ns=${ns0})" + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns1}" + oops_before=$(vm_dmesg_oops_count "${ns1}") + warn_before=$(vm_dmesg_warn_count "${ns1}") + + vm_ssh "${ns1}" -- socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" & + vm_wait_for_listener "${ns1}" "${port}" "vsock" + echo TEST | ip netns exec "${ns0}" \ + socat STDIN VSOCK-CONNECT:"${VSOCK_CID}":"${port}" 2>/dev/null + + vm_dmesg_check "${pidfile}" "${ns1}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + result=$(cat "${outfile}") + rm -f "${outfile}" + + if [[ "${result}" == "TEST" ]] || [[ "${dmesg_rc}" -ne 0 ]]; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + +test_ns_diff_global_vm_connect_to_global_host_ok() { + local oops_before warn_before + local ns0="global0" + local ns1="global1" + local port=12345 + local unixfile + local dmesg_rc + local pidfile + local pids + local rc + + init_namespaces + + declare -a pids + + log_host "Setup socat bridge from ns ${ns0} to ns ${ns1} over port ${port}" + + unixfile=$(mktemp -u /tmp/XXXX.sock) + + ip netns exec "${ns0}" \ + socat TCP-LISTEN:"${port}" UNIX-CONNECT:"${unixfile}" & + pids+=($!) + host_wait_for_listener "${ns0}" "${port}" "tcp" + + ip netns exec "${ns1}" \ + socat UNIX-LISTEN:"${unixfile}" TCP-CONNECT:127.0.0.1:"${port}" & + pids+=($!) + host_wait_for_listener "${ns1}" "${unixfile}" "unix" + + log_host "Launching ${VSOCK_TEST} in ns ${ns1}" + host_vsock_test "${ns1}" "server" "${VSOCK_CID}" "${port}" + + pidfile="$(create_pidfile)" + if ! vm_start "${pidfile}" "${ns0}"; then + log_host "failed to start vm (cid=${cid}, ns=${ns0})" + terminate_pids "${pids[@]}" + rm -f "${unixfile}" + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns0}" + + oops_before=$(vm_dmesg_oops_count "${ns0}") + warn_before=$(vm_dmesg_warn_count "${ns0}") + + vm_vsock_test "${ns0}" "10.0.2.2" 2 "${port}" + rc=$? + + vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + terminate_pids "${pids[@]}" + rm -f "${unixfile}" + + if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" + +} + +test_ns_diff_global_vm_connect_to_local_host_fails() { + local ns0="global0" + local ns1="local0" + local port=12345 + local oops_before warn_before + local dmesg_rc + local pidfile + local result + local pid + + init_namespaces + + log_host "Launching socat in ns ${ns1}" + outfile=$(mktemp) + + ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT &> "${outfile}" & + pid=$! + host_wait_for_listener "${ns1}" "${port}" "vsock" + + pidfile="$(create_pidfile)" + if ! vm_start "${pidfile}" "${ns0}"; then + log_host "failed to start vm (cid=${cid}, ns=${ns0})" + terminate_pids "${pid}" + rm -f "${outfile}" + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns0}" + + oops_before=$(vm_dmesg_oops_count "${ns0}") + warn_before=$(vm_dmesg_warn_count "${ns0}") + + vm_ssh "${ns0}" -- \ + bash -c "echo TEST | socat STDIN VSOCK-CONNECT:2:${port}" 2>&1 | log_guest + + vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + terminate_pids "${pid}" + + result=$(cat "${outfile}") + rm -f "${outfile}" + + if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_diff_local_host_connect_to_local_vm_fails() { + local ns0="local0" + local ns1="local1" + local port=12345 + local oops_before warn_before + local dmesg_rc + local pidfile + local result + local pid + + init_namespaces + + outfile=$(mktemp) + + pidfile="$(create_pidfile)" + if ! vm_start "${pidfile}" "${ns1}"; then + log_host "failed to start vm (cid=${cid}, ns=${ns0})" + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns1}" + oops_before=$(vm_dmesg_oops_count "${ns1}") + warn_before=$(vm_dmesg_warn_count "${ns1}") + + vm_ssh "${ns1}" -- socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" & + vm_wait_for_listener "${ns1}" "${port}" "vsock" + + echo TEST | ip netns exec "${ns0}" \ + socat STDIN VSOCK-CONNECT:"${VSOCK_CID}":"${port}" 2>/dev/null + + vm_dmesg_check "${pidfile}" "${ns1}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + + result=$(cat "${outfile}") + rm -f "${outfile}" + + if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_diff_local_vm_connect_to_local_host_fails() { + local oops_before warn_before + local ns0="local0" + local ns1="local1" + local port=12345 + local dmesg_rc + local pidfile + local result + local pid + + init_namespaces + + log_host "Launching socat in ns ${ns1}" + outfile=$(mktemp) + ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT &> "${outfile}" & + pid=$! + host_wait_for_listener "${ns1}" "${port}" "vsock" + + pidfile="$(create_pidfile)" + if ! vm_start "${pidfile}" "${ns0}"; then + log_host "failed to start vm (cid=${cid}, ns=${ns0})" + rm -f "${outfile}" + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns0}" + oops_before=$(vm_dmesg_oops_count "${ns0}") + warn_before=$(vm_dmesg_warn_count "${ns0}") + + vm_ssh "${ns0}" -- \ + bash -c "echo TEST | socat STDIN VSOCK-CONNECT:2:${port}" 2>&1 | log_guest + + vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + terminate_pids "${pid}" + + result=$(cat "${outfile}") + rm -f "${outfile}" + + if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +__test_loopback_two_netns() { + local ns0=$1 + local ns1=$2 + local port=12345 + local result + local pid + + modprobe vsock_loopback &> /dev/null || : + + log_host "Launching socat in ns ${ns1}" + outfile=$(mktemp) + + ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" 2>/dev/null & + pid=$! + host_wait_for_listener "${ns1}" "${port}" "vsock" + + log_host "Launching socat in ns ${ns0}" + echo TEST | ip netns exec "${ns0}" socat STDIN VSOCK-CONNECT:1:"${port}" 2>/dev/null + terminate_pids "${pid}" + + result=$(cat "${outfile}") + rm -f "${outfile}" + + if [[ "${result}" == TEST ]]; then + return 0 + fi + + return 1 +} + +test_ns_diff_global_to_local_loopback_local_fails() { + init_namespaces + + if ! __test_loopback_two_netns "global0" "local0"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_diff_local_to_global_loopback_fails() { + init_namespaces + + if ! __test_loopback_two_netns "local0" "global0"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_diff_local_to_local_loopback_fails() { + init_namespaces + + if ! __test_loopback_two_netns "local0" "local1"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_diff_global_to_global_loopback_ok() { + init_namespaces + + if __test_loopback_two_netns "global0" "global1"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_same_local_loopback_ok() { + init_namespaces + + if __test_loopback_two_netns "local0" "local0"; then + return "${KSFT_PASS}" + fi + + return "${KSFT_FAIL}" +} + +test_ns_same_local_host_connect_to_local_vm_ok() { + local oops_before warn_before + local ns="local0" + local port=1234 + local dmesg_rc + local pidfile + local rc + + init_namespaces + + pidfile="$(create_pidfile)" + + if ! vm_start "${pidfile}" "${ns}"; then + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns}" + oops_before=$(vm_dmesg_oops_count "${ns}") + warn_before=$(vm_dmesg_warn_count "${ns}") + + vm_vsock_test "${ns}" "server" 2 "${TEST_GUEST_PORT}" + host_vsock_test "${ns}" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}" + rc=$? + + vm_dmesg_check "${pidfile}" "${ns}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + + if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + +test_ns_same_local_vm_connect_to_local_host_ok() { + local oops_before warn_before + local ns="local0" + local port=1234 + local dmesg_rc + local pidfile + local rc + + init_namespaces + + pidfile="$(create_pidfile)" + + if ! vm_start "${pidfile}" "${ns}"; then + return "${KSFT_FAIL}" + fi + + vm_wait_for_ssh "${ns}" + oops_before=$(vm_dmesg_oops_count "${ns}") + warn_before=$(vm_dmesg_warn_count "${ns}") + + host_vsock_test "${ns}" "server" "${VSOCK_CID}" "${port}" + vm_vsock_test "${ns}" "10.0.2.2" 2 "${port}" + rc=$? + + vm_dmesg_check "${pidfile}" "${ns}" "${oops_before}" "${warn_before}" + dmesg_rc=$? + + terminate_pidfiles "${pidfile}" + + if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then + return "${KSFT_FAIL}" + fi + + return "${KSFT_PASS}" +} + namespaces_can_boot_same_cid() { local ns0=$1 local ns1=$2 @@ -894,6 +1446,7 @@ fi check_args "${ARGS[@]}" check_deps check_vng +check_socat handle_build

echo "1..${#ARGS[@]}"

On Thu, Nov 20, 2025 at 09:44:35PM -0800, Bobby Eshleman wrote:

From: Bobby Eshleman bobbyeshleman@meta.com

Reject setting VSOCK_NET_MODE_LOCAL with -EOPNOTSUPP if a G2H transport is operational. Additionally, reject G2H transport registration if there already exists a namespace in local mode.

G2H sockets break in local mode because the G2H transports don't support namespacing yet. The current approach is to coerce packets coming out of G2H transports into VSOCK_NET_MODE_GLOBAL mode, but it is not possible to coerce sockets in the same way because it cannot be deduced which transport will be used by the socket. Specifically, when bound to VMADDR_CID_ANY in a nested VM (both G2H and H2G available), it is not until a packet is received and matched to the bound socket that we assign the transport. This presents a chicken-and-egg problem, because we need the namespace to lookup the socket and resolve the transport, but we need the transport to know how to use the namespace during lookup.

For that reason, this patch prevents VSOCK_NET_MODE_LOCAL from being used on systems that support G2H, even nested systems that also have H2G transports.

Local mode is blocked based on detecting the presence of G2H devices (when possible, as hyperv is special). This means that a host kernel with G2H support compiled in (or has the module loaded), will still support local mode if there is no G2H (e.g., virtio-vsock) device detected. This enables using the same kernel in the host and in the guest, as we do in kselftest.

Systems with only namespace-aware transports (vhost-vsock, loopback) can still use both VSOCK_NET_MODE_GLOBAL and VSOCK_NET_MODE_LOCAL modes as intended.

Add supports_local_mode() transport callback to indicate transport-specific local mode support.

These restrictions can be lifted in a future patch series when G2H transports gain namespace support.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v11:

• vhost_transport_supports_local_mode() returns false to keep things

disabled until support comes online (Stefano)

• add comment above supports_local_mode() cb to clarify (Stefano)
• Remove redundant `ret = 0` initialization in vsock_net_mode_string()

(Stefano)

• Refactor vsock_net_mode_string() to separate parsing from validation

(Stefano)

• vmci returns false for supports_local_mode(), with comment

Changes in v10:

• move this patch before any transports bring online namespacing (Stefano)
• move vsock_net_mode_string into critical section (Stefano)
• add ->supports_local_mode() callback to transports (Stefano)

---

drivers/vhost/vsock.c | 6 ++++++ include/net/af_vsock.h | 11 +++++++++++ net/vmw_vsock/af_vsock.c | 32 ++++++++++++++++++++++++++++++++ net/vmw_vsock/hyperv_transport.c | 6 ++++++ net/vmw_vsock/virtio_transport.c | 13 +++++++++++++ net/vmw_vsock/vmci_transport.c | 12 ++++++++++++ net/vmw_vsock/vsock_loopback.c | 6 ++++++ 7 files changed, 86 insertions(+)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 69074656263d..4e3856aa2479 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -64,6 +64,11 @@ static u32 vhost_transport_get_local_cid(void) return VHOST_VSOCK_DEFAULT_HOST_CID; }

+static bool vhost_transport_supports_local_mode(void) +{

• return false;

+}

/* Callers that dereference the return value must hold vhost_vsock_mutex or the

• RCU read lock.

*/ @@ -412,6 +417,7 @@ static struct virtio_transport vhost_transport = { .module = THIS_MODULE,

.get_local_cid            = vhost_transport_get_local_cid,

• .supports_local_mode	  = vhost_transport_supports_local_mode,
  
  

  .init = virtio_transport_do_socket_init, .destruct = virtio_transport_destruct,

diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 59d97a143204..e24ef1d9fe02 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -180,6 +180,17 @@ struct vsock_transport { /* Addressing. */ u32 (*get_local_cid)(void);

• /* Return true if the transport is compatible with

• * VSOCK_NET_MODE_LOCAL. Otherwise, return false.
  

• *
  

• * Transports should return false if they lack local-mode namespace
  

• * support (e.g., G2H transports like hyperv-vsock and vmci-vsock).
  

• * virtio-vsock returns true only if no device is present in order to
  

• * enable local mode in nested scenarios in which virtio-vsock is
  

• * loaded or built-in, but nonetheless unusable by sockets.
  

• */
  

• bool (*supports_local_mode)(void);
• /* Read a single skb */ int (*read_skb)(struct vsock_sock *, skb_read_actor_t);

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 243c0d588682..120adb9dad9f 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -91,6 +91,12 @@

• and locked down by a namespace manager. The default is "global". The mode
• is set per-namespace.

• • Note: LOCAL mode is only supported when using namespace-aware transports
• • (vhost-vsock, loopback). If a guest-to-host transport (virtio-vsock,
• • hyperv-vsock, vmci-vsock) is operational, attempts to set LOCAL mode will
• • fail with EOPNOTSUPP, as these transports do not support per-namespace
• • isolation.

• The modes affect the allocation and accessibility of CIDs as follows:
• • global - access and allocation are all system-wide

@@ -2794,6 +2800,15 @@ static int vsock_net_mode_string(const struct ctl_table *table, int write, else return -EINVAL;

• mutex_lock(&vsock_register_mutex);
• if (mode == VSOCK_NET_MODE_LOCAL &&

•    transport_g2h && transport_g2h->supports_local_mode &&
  

•    !transport_g2h->supports_local_mode()) {
  

• mutex_unlock(&vsock_register_mutex);
  

• return -EOPNOTSUPP;
  

• }
• mutex_unlock(&vsock_register_mutex);

Wait, I think we already discussed about this, vsock_net_write_mode() must be called with the lock held.

See https://lore.kernel.org/netdev/aRTTwuuXSz5CvNjt@devvm11784.nha0.facebook.com...

Since I guess we need another version of this patch, can you check the commit description to see if it reflects what we are doing now (e.g vhost is not enabled)?

Also I don't understand why for vhost we will enable it later, but for virtio_transport and vsock_loopback we are enabling it now, also if this patch is before the support on that transports. I'm a bit confused.

If something is unclear, let's discuss it before sending a new version.

What I had in mind was, add this patch and explain why we need this new callback (like you did), but enable the support in the patches that really enable it for any transport. But maybe what is not clear to me is that we need this only for G2H. But now I'm confused about the discussion around vmci H2G. We decided to discard also that one, but here we are not checking that? I mean here we are calling supports_local_mode() only on G2H IIUC.

• if (!vsock_net_write_mode(net, mode)) return -EPERM;

@@ -2938,6 +2953,7 @@ int vsock_core_register(const struct vsock_transport *t, int features) { const struct vsock_transport *t_h2g, *t_g2h, *t_dgram, *t_local; int err = mutex_lock_interruptible(&vsock_register_mutex);

• struct net *net;

  if (err) return err;

@@ -2960,6 +2976,22 @@ int vsock_core_register(const struct vsock_transport *t, int features) err = -EBUSY; goto err_busy; }

• /* G2H sockets break in LOCAL mode namespaces because G2H
  

And also here we are talking about only of G2H, so what happen if vmci is loaded as H2G?

IMO we should discuss this a bit more and make it a bit more generic, like check all the transports.

Thanks, Stefano

•  * transports don't support them yet. Block registering new G2H
  

•  * transports if we already have local mode namespaces on the
  

•  * system.
  

•  */
  

• rcu_read_lock();
  

• for_each_net_rcu(net) {
  

• 	if (vsock_net_mode(net) == VSOCK_NET_MODE_LOCAL) {
  

• 		rcu_read_unlock();
  

• 		err = -EOPNOTSUPP;
  

• 		goto err_busy;
  

• 	}
  

• }
  

• rcu_read_unlock();
  

• t_g2h = t; }

diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c index 432fcbbd14d4..279f04fcd81a 100644 --- a/net/vmw_vsock/hyperv_transport.c +++ b/net/vmw_vsock/hyperv_transport.c @@ -833,10 +833,16 @@ int hvs_notify_set_rcvlowat(struct vsock_sock *vsk, int val) return -EOPNOTSUPP; }

+static bool hvs_supports_local_mode(void) +{

• return false;

+}

static struct vsock_transport hvs_transport = { .module = THIS_MODULE,

.get_local_cid = hvs_get_local_cid,

• .supports_local_mode = hvs_supports_local_mode,

  .init = hvs_sock_init, .destruct = hvs_destruct,

diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index d365a4b371d0..af4fbce0baab 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -94,6 +94,18 @@ static u32 virtio_transport_get_local_cid(void) return ret; }

+static bool virtio_transport_supports_local_mode(void) +{

• struct virtio_vsock *vsock;
• rcu_read_lock();
• vsock = rcu_dereference(the_virtio_vsock);
• rcu_read_unlock();
• /* Local mode is supported only when no G2H device is present. */
• return vsock ? false : true;

+}

/* Caller need to hold vsock->tx_lock on vq */ static int virtio_transport_send_skb(struct sk_buff *skb, struct virtqueue *vq, struct virtio_vsock *vsock, gfp_t gfp) @@ -544,6 +556,7 @@ static struct virtio_transport virtio_transport = { .module = THIS_MODULE,

.get_local_cid            = virtio_transport_get_local_cid,

• .supports_local_mode      = virtio_transport_supports_local_mode,
  
  

  .init = virtio_transport_do_socket_init, .destruct = virtio_transport_destruct,

diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c index 7eccd6708d66..e392d3d1fd90 100644 --- a/net/vmw_vsock/vmci_transport.c +++ b/net/vmw_vsock/vmci_transport.c @@ -2033,6 +2033,17 @@ static u32 vmci_transport_get_local_cid(void) return vmci_get_context_id(); }

+static bool vmci_transport_supports_local_mode(void) +{

• /* Local mode is not yet compatible with vmci because there is no clear

• * mechanism yet for attaching a namespace to a VM, or for handling the
  

• * namespacing for when neither H2G or G2H is registered (as is the
  

• * case for MODULE_ALIAS_NETPROTO(PF_VSOCK) loading. To simplify, we
  

• * keep local mode off for now.
  

• */
  

• return false;

+}

static struct vsock_transport vmci_transport = { .module = THIS_MODULE, .init = vmci_transport_socket_init, @@ -2062,6 +2073,7 @@ static struct vsock_transport vmci_transport = { .notify_send_post_enqueue = vmci_transport_notify_send_post_enqueue, .shutdown = vmci_transport_shutdown, .get_local_cid = vmci_transport_get_local_cid,

• .supports_local_mode = vmci_transport_supports_local_mode,

};

static bool vmci_check_transport(struct vsock_sock *vsk) diff --git a/net/vmw_vsock/vsock_loopback.c b/net/vmw_vsock/vsock_loopback.c index 8722337a4f80..1e25c1a6b43f 100644 --- a/net/vmw_vsock/vsock_loopback.c +++ b/net/vmw_vsock/vsock_loopback.c @@ -26,6 +26,11 @@ static u32 vsock_loopback_get_local_cid(void) return VMADDR_CID_LOCAL; }

+static bool vsock_loopback_supports_local_mode(void) +{

• return true;

+}

static int vsock_loopback_send_pkt(struct sk_buff *skb) { struct vsock_loopback *vsock = &the_vsock_loopback; @@ -58,6 +63,7 @@ static struct virtio_transport loopback_transport = { .module = THIS_MODULE,

.get_local_cid            = vsock_loopback_get_local_cid,

• .supports_local_mode	  = vsock_loopback_supports_local_mode,
  
  

  .init = virtio_transport_do_socket_init, .destruct = virtio_transport_destruct,

-- 2.47.3

On Thu, Nov 20, 2025 at 09:44:42PM -0800, Bobby Eshleman wrote:

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests for the /proc/sys/net/vsock/ns_mode interface. Namely, that it accepts "global" and "local" strings and enforces a write-once policy.

Start a convention of commenting the test name over the test description. Add test name comments over test descriptions that existed before this convention.

Add a check_netns() function that checks if the test requires namespaces and if the current kernel supports namespaces. Skip tests that require namespaces if the system does not have namespace support.

Add a test to verify that guest VMs with an active G2H transport (virtio-vsock) cannot set namespace mode to 'local'. This validates the mutual exclusion between G2H transports and LOCAL mode.

This patch is the first to add tests that do *not* re-use the same shared VM. For that reason, it adds a run_tests() function to run these tests and filter out the shared VM tests.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v11:

• Document ns_ prefix above TEST_NAMES (Stefano)

Changes in v10:

• Remove extraneous add_namespaces/del_namespaces calls.
• Rename run_tests() to run_ns_tests() since it is designed to only

run ns tests.

Changes in v9:

• add test ns_vm_local_mode_rejected to check that guests cannot use

local mode

tools/testing/selftests/vsock/vmtest.sh | 143 +++++++++++++++++++++++++++++++- 1 file changed, 141 insertions(+), 2 deletions(-)

Reviewed-by: Stefano Garzarella sgarzare@redhat.com

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index e32997db322d..2e077e8a1777 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -41,14 +41,43 @@ readonly KERNEL_CMDLINE="\ virtme.ssh virtme_ssh_channel=tcp virtme_ssh_user=$USER \ " readonly LOG=$(mktemp /tmp/vsock_vmtest_XXXX.log) -readonly TEST_NAMES=(vm_server_host_client vm_client_host_server vm_loopback)

+# Namespace tests must use the ns_ prefix. This is checked in check_netns() and +# is used to determine if a test needs namespace setup before test execution. +readonly TEST_NAMES=(

• vm_server_host_client
• vm_client_host_server
• vm_loopback
• ns_host_vsock_ns_mode_ok
• ns_host_vsock_ns_mode_write_once_ok
• ns_vm_local_mode_rejected

+) readonly TEST_DESCS=(

• # vm_server_host_client "Run vsock_test in server mode on the VM and in client mode on the host."
• # vm_client_host_server "Run vsock_test in client mode on the VM and in server mode on the host."
• # vm_loopback "Run vsock_test using the loopback transport in the VM."
• # ns_host_vsock_ns_mode_ok
• "Check /proc/sys/net/vsock/ns_mode strings on the host."
• # ns_host_vsock_ns_mode_write_once_ok
• "Check /proc/sys/net/vsock/ns_mode is write-once on the host."
• # ns_vm_local_mode_rejected
• "Test that guest VM with G2H transport cannot set namespace mode to 'local'"

)

-readonly USE_SHARED_VM=(vm_server_host_client vm_client_host_server vm_loopback) +readonly USE_SHARED_VM=(

• vm_server_host_client
• vm_client_host_server
• vm_loopback
• ns_vm_local_mode_rejected

+) readonly NS_MODES=("local" "global")

VERBOSE=0 @@ -205,6 +234,20 @@ check_deps() { fi }

+check_netns() {

• local tname=$1
• # If the test requires NS support, check if NS support exists
• # using /proc/self/ns
• if [[ "${tname}" =~ ^ns_ ]] &&

•   [[ ! -e /proc/self/ns ]]; then
  

• log_host "No NS support detected for test ${tname}"
  

• return 1
  

• fi
• return 0

+}

check_vng() { local tested_versions local version @@ -528,6 +571,32 @@ log_guest() { LOG_PREFIX=guest log "$@" }

+test_ns_host_vsock_ns_mode_ok() {

• for mode in "${NS_MODES[@]}"; do

• if ! ns_set_mode "${mode}0" "${mode}"; then
  

• 	return "${KSFT_FAIL}"
  

• fi
  

• done
• return "${KSFT_PASS}"

+}

+test_ns_host_vsock_ns_mode_write_once_ok() {

• for mode in "${NS_MODES[@]}"; do

• local ns="${mode}0"
  

• if ! ns_set_mode "${ns}" "${mode}"; then
  

• 	return "${KSFT_FAIL}"
  

• fi
  

• # try writing again and expect failure
  

• if ns_set_mode "${ns}" "${mode}"; then
  

• 	return "${KSFT_FAIL}"
  

• fi
  

• done
• return "${KSFT_PASS}"

+}

test_vm_server_host_client() { if ! vm_vsock_test "init_ns" "server" 2 "${TEST_GUEST_PORT}"; then return "${KSFT_FAIL}" @@ -569,6 +638,26 @@ test_vm_loopback() { return "${KSFT_PASS}" }

+test_ns_vm_local_mode_rejected() {

• # Guest VMs have a G2H transport (virtio-vsock) active, so they
• # should not be able to set namespace mode to 'local'.
• # This test verifies that the sysctl write fails as expected.
• # Try to set local mode in the guest's init_ns
• if vm_ssh init_ns "echo local | tee /proc/sys/net/vsock/ns_mode &>/dev/null"; then

• return "${KSFT_FAIL}"
  

• fi
• # Verify mode is still 'global'
• local mode
• mode=$(vm_ssh init_ns "cat /proc/sys/net/vsock/ns_mode")
• if [[ "${mode}" != "global" ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

shared_vm_test() { local tname

@@ -601,6 +690,11 @@ run_shared_vm_tests() { continue fi

• if ! check_netns "${arg}"; then
  

• 	check_result "${KSFT_SKIP}" "${arg}"
  

• 	continue
  

• fi
  

• run_shared_vm_test "${arg}" check_result "$?" "${arg}" done

@@ -654,6 +748,49 @@ run_shared_vm_test() { return "${rc}" }

+run_ns_tests() {

• for arg in "${ARGS[@]}"; do

• if shared_vm_test "${arg}"; then
  

• 	continue
  

• fi
  

• if ! check_netns "${arg}"; then
  

• 	check_result "${KSFT_SKIP}" "${arg}"
  

• 	continue
  

• fi
  

• add_namespaces
  

• name=$(echo "${arg}" | awk '{ print $1 }')
  

• log_host "Executing test_${name}"
  

• host_oops_before=$(dmesg 2>/dev/null | grep -c -i 'Oops')
  

• host_warn_before=$(dmesg --level=warn 2>/dev/null | grep -c -i 'vsock')
  

• eval test_"${name}"
  

• rc=$?
  

• host_oops_after=$(dmesg 2>/dev/null | grep -c -i 'Oops')
  

• if [[ "${host_oops_after}" -gt "${host_oops_before}" ]]; then
  

• 	echo "FAIL: kernel oops detected on host" | log_host
  

• 	check_result "${KSFT_FAIL}" "${name}"
  

• 	del_namespaces
  

• 	continue
  

• fi
  

• host_warn_after=$(dmesg --level=warn 2>/dev/null | grep -c -i 'vsock')
  

• if [[ "${host_warn_after}" -gt "${host_warn_before}" ]]; then
  

• 	echo "FAIL: kernel warning detected on host" | log_host
  

• 	check_result "${KSFT_FAIL}" "${name}"
  

• 	del_namespaces
  

• 	continue
  

• fi
  

• check_result "${rc}" "${name}"
  

• del_namespaces
  

• done

+}

BUILD=0 QEMU="qemu-system-$(uname -m)"

@@ -699,6 +836,8 @@ if shared_vm_tests_requested "${ARGS[@]}"; then terminate_pidfiles "${pidfile}" fi

+run_ns_tests "${ARGS[@]}"

echo "SUMMARY: PASS=${cnt_pass} SKIP=${cnt_skip} FAIL=${cnt_fail}" echo "Log: ${LOG}"

-- 2.47.3

On Thu, Nov 20, 2025 at 09:44:44PM -0800, Bobby Eshleman wrote:

From: Bobby Eshleman bobbyeshleman@meta.com

Add tests to validate namespace correctness using vsock_test and socat. The vsock_test tool is used to validate expected success tests, but socat is used for expected failure tests. socat is used to ensure that connections are rejected outright instead of failing due to some other socket behavior (as tested in vsock_test). Additionally, socat is already required for tunneling TCP traffic from vsock_test. Using only one of the vsock_test tests like 'test_stream_client_close_client' would have yielded a similar result, but doing so wouldn't remove the socat dependency.

Additionally, check for the dependency socat. socat needs special handling beyond just checking if it is on the path because it must be compiled with support for both vsock and unix. The function check_socat() checks that this support exists.

Add more padding to test name printf strings because the tests added in this patch would otherwise overflow.

Add vm_dmesg_start() and vm_dmesg_check() to encapsulate checking dmesg for oops and warnings.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v11:

• add 'sleep "${WAIT_PERIOD}"' after any non-TCP socat LISTEN cmd

(Stefano)

I guess you meant wait_for_listener, right?

• add host_wait_for_listener() after any socat TCP-LISTEN (Stefano)
• reuse vm_dmesg_{oops,warn}_count() inside vm_dmesg_check()
• fix copy-paste in test_ns_same_local_vm_connect_to_local_host_ok()

(Stefano)

Changes in v10:

• add vm_dmesg_start() and vm_dmesg_check()

Changes in v9:

• consistent variable quoting

---

tools/testing/selftests/vsock/vmtest.sh | 557 +++++++++++++++++++++++++++++++- 1 file changed, 555 insertions(+), 2 deletions(-)

LGTM:

Reviewed-by: Stefano Garzarella sgarzare@redhat.com

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index f84da1e8ad14..dfa895abfc7f 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -7,6 +7,7 @@ # * virtme-ng # * busybox-static (used by virtme-ng) # * qemu (used by virtme-ng) +# * socat # # shellcheck disable=SC2317,SC2119

@@ -55,6 +56,19 @@ readonly TEST_NAMES=( ns_local_same_cid_ok ns_global_local_same_cid_ok ns_local_global_same_cid_ok

• ns_diff_global_host_connect_to_global_vm_ok
• ns_diff_global_host_connect_to_local_vm_fails
• ns_diff_global_vm_connect_to_global_host_ok
• ns_diff_global_vm_connect_to_local_host_fails
• ns_diff_local_host_connect_to_local_vm_fails
• ns_diff_local_vm_connect_to_local_host_fails
• ns_diff_global_to_local_loopback_local_fails
• ns_diff_local_to_global_loopback_fails
• ns_diff_local_to_local_loopback_fails
• ns_diff_global_to_global_loopback_ok
• ns_same_local_loopback_ok
• ns_same_local_host_connect_to_local_vm_ok
• ns_same_local_vm_connect_to_local_host_ok

) readonly TEST_DESCS=( # vm_server_host_client @@ -86,6 +100,45 @@ readonly TEST_DESCS=(

# ns_local_global_same_cid_ok "Check QEMU successfully starts one VM in a local ns and then another VM in a global ns with the same CID."

• # ns_diff_global_host_connect_to_global_vm_ok
• "Run vsock_test client in global ns with server in VM in another global ns."
• # ns_diff_global_host_connect_to_local_vm_fails
• "Run socat to test a process in a global ns fails to connect to a VM in a local ns."
• # ns_diff_global_vm_connect_to_global_host_ok
• "Run vsock_test client in VM in a global ns with server in another global ns."
• # ns_diff_global_vm_connect_to_local_host_fails
• "Run socat to test a VM in a global ns fails to connect to a host process in a local ns."
• # ns_diff_local_host_connect_to_local_vm_fails
• "Run socat to test a host process in a local ns fails to connect to a VM in another local ns."
• # ns_diff_local_vm_connect_to_local_host_fails
• "Run socat to test a VM in a local ns fails to connect to a host process in another local ns."
• # ns_diff_global_to_local_loopback_local_fails
• "Run socat to test a loopback vsock in a global ns fails to connect to a vsock in a local ns."
• # ns_diff_local_to_global_loopback_fails
• "Run socat to test a loopback vsock in a local ns fails to connect to a vsock in a global ns."
• # ns_diff_local_to_local_loopback_fails
• "Run socat to test a loopback vsock in a local ns fails to connect to a vsock in another local ns."
• # ns_diff_global_to_global_loopback_ok
• "Run socat to test a loopback vsock in a global ns successfully connects to a vsock in another global ns."
• # ns_same_local_loopback_ok
• "Run socat to test a loopback vsock in a local ns successfully connects to a vsock in the same ns."
• # ns_same_local_host_connect_to_local_vm_ok
• "Run vsock_test client in a local ns with server in VM in same ns."
• # ns_same_local_vm_connect_to_local_host_ok
• "Run vsock_test client in VM in a local ns with server in same ns."

)

readonly USE_SHARED_VM=( @@ -117,7 +170,7 @@ usage() { for ((i = 0; i < ${#TEST_NAMES[@]}; i++)); do name=${TEST_NAMES[${i}]} desc=${TEST_DESCS[${i}]}

• printf "\t%-35s%-35s\n" "${name}" "${desc}"
  

• printf "\t%-55s%-35s\n" "${name}" "${desc}"
  

  done echo

@@ -236,7 +289,7 @@ check_args() { }

check_deps() {

• for dep in vng ${QEMU} busybox pkill ssh ss; do

• for dep in vng ${QEMU} busybox pkill ssh ss socat; do if [[ ! -x $(command -v "${dep}") ]]; then echo -e "skip: dependency ${dep} not found!\n" exit "${KSFT_SKIP}"

@@ -287,6 +340,20 @@ check_vng() { fi }

+check_socat() {

• local support_string
• support_string="$(socat -V)"
• if [[ "${support_string}" != *"WITH_VSOCK 1"* ]]; then

• die "err: socat is missing vsock support"
  

• fi
• if [[ "${support_string}" != *"WITH_UNIX 1"* ]]; then

• die "err: socat is missing unix support"
  

• fi

+}

handle_build() { if [[ ! "${BUILD}" -eq 1 ]]; then return @@ -335,6 +402,14 @@ terminate_pidfiles() { done }

+terminate_pids() {

• local pid
• for pid in "$@"; do

• kill -SIGTERM "${pid}" &>/dev/null || :
  

• done

+}

vm_start() { local pidfile=$1 local ns=$2 @@ -473,6 +548,28 @@ vm_dmesg_warn_count() { vm_ssh "${ns}" -- dmesg --level=warn 2>/dev/null | grep -c -i 'vsock' }

+vm_dmesg_check() {

• local pidfile=$1
• local ns=$2
• local oops_before=$3
• local warn_before=$4
• local oops_after warn_after
• oops_after=$(vm_dmesg_oops_count "${ns}")
• if [[ "${oops_after}" -gt "${oops_before}" ]]; then

• echo "FAIL: kernel oops detected on vm in ns ${ns}" | log_host
  

• return 1
  

• fi
• warn_after=$(vm_dmesg_warn_count "${ns}")
• if [[ "${warn_after}" -gt "${warn_before}" ]]; then

• echo "FAIL: kernel warning detected on vm in ns ${ns}" | log_host
  

• return 1
  

• fi
• return 0

+}

vm_vsock_test() { local ns=$1 local host=$2 @@ -597,6 +694,461 @@ test_ns_host_vsock_ns_mode_ok() { return "${KSFT_PASS}" }

+test_ns_diff_global_host_connect_to_global_vm_ok() {

• local oops_before warn_before
• local pids pid pidfile
• local ns0 ns1 port
• declare -a pids
• local unixfile
• ns0="global0"
• ns1="global1"
• port=1234
• local rc
• init_namespaces
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• unixfile=$(mktemp -u /tmp/XXXX.sock)
• ip netns exec "${ns1}" \

• socat TCP-LISTEN:"${TEST_HOST_PORT}",fork \
  

• 	UNIX-CONNECT:"${unixfile}" &
  

• pids+=($!)
• host_wait_for_listener "${ns1}" "${TEST_HOST_PORT}" "tcp"
• ip netns exec "${ns0}" socat UNIX-LISTEN:"${unixfile}",fork \

• TCP-CONNECT:localhost:"${TEST_HOST_PORT}" &
  

• pids+=($!)
• host_wait_for_listener "${ns0}" "${unixfile}" "unix"
• vm_vsock_test "${ns0}" "server" 2 "${TEST_GUEST_PORT}"
• vm_wait_for_listener "${ns0}" "${TEST_GUEST_PORT}" "tcp"
• host_vsock_test "${ns1}" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pids "${pids[@]}"
• terminate_pidfiles "${pidfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_diff_global_host_connect_to_local_vm_fails() {

• local oops_before warn_before
• local ns0="global0"
• local ns1="local0"
• local port=12345
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• outfile=$(mktemp)
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns1}"; then

• log_host "failed to start vm (cid=${VSOCK_CID}, ns=${ns0})"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns1}"
• oops_before=$(vm_dmesg_oops_count "${ns1}")
• warn_before=$(vm_dmesg_warn_count "${ns1}")
• vm_ssh "${ns1}" -- socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" &
• vm_wait_for_listener "${ns1}" "${port}" "vsock"
• echo TEST | ip netns exec "${ns0}" \

• socat STDIN VSOCK-CONNECT:"${VSOCK_CID}":"${port}" 2>/dev/null
  

• vm_dmesg_check "${pidfile}" "${ns1}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" == "TEST" ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_diff_global_vm_connect_to_global_host_ok() {

• local oops_before warn_before
• local ns0="global0"
• local ns1="global1"
• local port=12345
• local unixfile
• local dmesg_rc
• local pidfile
• local pids
• local rc
• init_namespaces
• declare -a pids
• log_host "Setup socat bridge from ns ${ns0} to ns ${ns1} over port ${port}"
• unixfile=$(mktemp -u /tmp/XXXX.sock)
• ip netns exec "${ns0}" \

• socat TCP-LISTEN:"${port}" UNIX-CONNECT:"${unixfile}" &
  

• pids+=($!)
• host_wait_for_listener "${ns0}" "${port}" "tcp"
• ip netns exec "${ns1}" \

• socat UNIX-LISTEN:"${unixfile}" TCP-CONNECT:127.0.0.1:"${port}" &
  

• pids+=($!)
• host_wait_for_listener "${ns1}" "${unixfile}" "unix"
• log_host "Launching ${VSOCK_TEST} in ns ${ns1}"
• host_vsock_test "${ns1}" "server" "${VSOCK_CID}" "${port}"
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• terminate_pids "${pids[@]}"
  

• rm -f "${unixfile}"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• vm_vsock_test "${ns0}" "10.0.2.2" 2 "${port}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• terminate_pids "${pids[@]}"
• rm -f "${unixfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_diff_global_vm_connect_to_local_host_fails() {

• local ns0="global0"
• local ns1="local0"
• local port=12345
• local oops_before warn_before
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• log_host "Launching socat in ns ${ns1}"
• outfile=$(mktemp)
• ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT &> "${outfile}" &
• pid=$!
• host_wait_for_listener "${ns1}" "${port}" "vsock"
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• terminate_pids "${pid}"
  

• rm -f "${outfile}"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• vm_ssh "${ns0}" -- \

• bash -c "echo TEST | socat STDIN VSOCK-CONNECT:2:${port}" 2>&1 | log_guest
  

• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• terminate_pids "${pid}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_host_connect_to_local_vm_fails() {

• local ns0="local0"
• local ns1="local1"
• local port=12345
• local oops_before warn_before
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• outfile=$(mktemp)
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns1}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns1}"
• oops_before=$(vm_dmesg_oops_count "${ns1}")
• warn_before=$(vm_dmesg_warn_count "${ns1}")
• vm_ssh "${ns1}" -- socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" &
• vm_wait_for_listener "${ns1}" "${port}" "vsock"
• echo TEST | ip netns exec "${ns0}" \

• socat STDIN VSOCK-CONNECT:"${VSOCK_CID}":"${port}" 2>/dev/null
  

• vm_dmesg_check "${pidfile}" "${ns1}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_vm_connect_to_local_host_fails() {

• local oops_before warn_before
• local ns0="local0"
• local ns1="local1"
• local port=12345
• local dmesg_rc
• local pidfile
• local result
• local pid
• init_namespaces
• log_host "Launching socat in ns ${ns1}"
• outfile=$(mktemp)
• ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT &> "${outfile}" &
• pid=$!
• host_wait_for_listener "${ns1}" "${port}" "vsock"
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns0}"; then

• log_host "failed to start vm (cid=${cid}, ns=${ns0})"
  

• rm -f "${outfile}"
  

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns0}"
• oops_before=$(vm_dmesg_oops_count "${ns0}")
• warn_before=$(vm_dmesg_warn_count "${ns0}")
• vm_ssh "${ns0}" -- \

• bash -c "echo TEST | socat STDIN VSOCK-CONNECT:2:${port}" 2>&1 | log_guest
  

• vm_dmesg_check "${pidfile}" "${ns0}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• terminate_pids "${pid}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" != TEST ]] && [[ "${dmesg_rc}" -eq 0 ]]; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+__test_loopback_two_netns() {

• local ns0=$1
• local ns1=$2
• local port=12345
• local result
• local pid
• modprobe vsock_loopback &> /dev/null || :
• log_host "Launching socat in ns ${ns1}"
• outfile=$(mktemp)
• ip netns exec "${ns1}" socat VSOCK-LISTEN:"${port}" STDOUT > "${outfile}" 2>/dev/null &
• pid=$!
• host_wait_for_listener "${ns1}" "${port}" "vsock"
• log_host "Launching socat in ns ${ns0}"
• echo TEST | ip netns exec "${ns0}" socat STDIN VSOCK-CONNECT:1:"${port}" 2>/dev/null
• terminate_pids "${pid}"
• result=$(cat "${outfile}")
• rm -f "${outfile}"
• if [[ "${result}" == TEST ]]; then

• return 0
  

• fi
• return 1

+}

+test_ns_diff_global_to_local_loopback_local_fails() {

• init_namespaces
• if ! __test_loopback_two_netns "global0" "local0"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_to_global_loopback_fails() {

• init_namespaces
• if ! __test_loopback_two_netns "local0" "global0"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_local_to_local_loopback_fails() {

• init_namespaces
• if ! __test_loopback_two_netns "local0" "local1"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_diff_global_to_global_loopback_ok() {

• init_namespaces
• if __test_loopback_two_netns "global0" "global1"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_same_local_loopback_ok() {

• init_namespaces
• if __test_loopback_two_netns "local0" "local0"; then

• return "${KSFT_PASS}"
  

• fi
• return "${KSFT_FAIL}"

+}

+test_ns_same_local_host_connect_to_local_vm_ok() {

• local oops_before warn_before
• local ns="local0"
• local port=1234
• local dmesg_rc
• local pidfile
• local rc
• init_namespaces
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns}"; then

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns}"
• oops_before=$(vm_dmesg_oops_count "${ns}")
• warn_before=$(vm_dmesg_warn_count "${ns}")
• vm_vsock_test "${ns}" "server" 2 "${TEST_GUEST_PORT}"
• host_vsock_test "${ns}" "127.0.0.1" "${VSOCK_CID}" "${TEST_HOST_PORT}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

+test_ns_same_local_vm_connect_to_local_host_ok() {

• local oops_before warn_before
• local ns="local0"
• local port=1234
• local dmesg_rc
• local pidfile
• local rc
• init_namespaces
• pidfile="$(create_pidfile)"
• if ! vm_start "${pidfile}" "${ns}"; then

• return "${KSFT_FAIL}"
  

• fi
• vm_wait_for_ssh "${ns}"
• oops_before=$(vm_dmesg_oops_count "${ns}")
• warn_before=$(vm_dmesg_warn_count "${ns}")
• host_vsock_test "${ns}" "server" "${VSOCK_CID}" "${port}"
• vm_vsock_test "${ns}" "10.0.2.2" 2 "${port}"
• rc=$?
• vm_dmesg_check "${pidfile}" "${ns}" "${oops_before}" "${warn_before}"
• dmesg_rc=$?
• terminate_pidfiles "${pidfile}"
• if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then

• return "${KSFT_FAIL}"
  

• fi
• return "${KSFT_PASS}"

+}

namespaces_can_boot_same_cid() { local ns0=$1 local ns1=$2 @@ -894,6 +1446,7 @@ fi check_args "${ARGS[@]}" check_deps check_vng +check_socat handle_build

echo "1..${#ARGS[@]}"

-- 2.47.3

On Thu, Nov 20, 2025 at 09:44:40PM -0800, Bobby Eshleman wrote:

From: Bobby Eshleman bobbyeshleman@meta.com

These functions are reused by the VM tests to collect and compare dmesg warnings and oops counts. The future VM-specific tests use them heavily. This patches relies on vm_ssh() already supporting namespaces.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v11:

• break these out into an earlier patch so that they can be used

directly in new patches (instead of causing churn by adding this later)

---

tools/testing/selftests/vsock/vmtest.sh | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)

Reviewed-by: Stefano Garzarella sgarzare@redhat.com

diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh index 4da91828a6a0..1623e4da15e2 100755 --- a/tools/testing/selftests/vsock/vmtest.sh +++ b/tools/testing/selftests/vsock/vmtest.sh @@ -389,6 +389,17 @@ host_wait_for_listener() { fi }

+vm_dmesg_oops_count() {

• local ns=$1
• vm_ssh "${ns}" -- dmesg 2>/dev/null | grep -c -i 'Oops'

+}

+vm_dmesg_warn_count() {

• local ns=$1
• vm_ssh "${ns}" -- dmesg --level=warn 2>/dev/null | grep -c -i 'vsock'

+}

vm_vsock_test() { local ns=$1 @@ -596,8 +607,8 @@ run_shared_vm_test() {

host_oops_cnt_before=$(dmesg | grep -c -i 'Oops') host_warn_cnt_before=$(dmesg --level=warn | grep -c -i 'vsock')

• vm_oops_cnt_before=$(vm_ssh -- dmesg | grep -c -i 'Oops')
• vm_warn_cnt_before=$(vm_ssh -- dmesg --level=warn | grep -c -i 'vsock')

• vm_oops_cnt_before=$(vm_dmesg_oops_count "init_ns")

• vm_warn_cnt_before=$(vm_dmesg_warn_count "init_ns")

  name=$(echo "${1}" | awk '{ print $1 }') eval test_"${name}"

@@ -615,13 +626,13 @@ run_shared_vm_test() { rc=$KSFT_FAIL fi

• vm_oops_cnt_after=$(vm_ssh -- dmesg | grep -i 'Oops' | wc -l)

• vm_oops_cnt_after=$(vm_dmesg_oops_count "init_ns") if [[ ${vm_oops_cnt_after} -gt ${vm_oops_cnt_before} ]]; then echo "FAIL: kernel oops detected on vm" | log_host rc=$KSFT_FAIL fi

• vm_warn_cnt_after=$(vm_ssh -- dmesg --level=warn | grep -c -i 'vsock')

• vm_warn_cnt_after=$(vm_dmesg_warn_count "init_ns") if [[ ${vm_warn_cnt_after} -gt ${vm_warn_cnt_before} ]]; then echo "FAIL: kernel warning detected on vm" | log_host rc=$KSFT_FAIL

-- 2.47.3

On Fri, Nov 21, 2025 at 03:24:25PM +0100, Stefano Garzarella wrote:

On Thu, Nov 20, 2025 at 09:44:35PM -0800, Bobby Eshleman wrote:

...

From: Bobby Eshleman bobbyeshleman@meta.com

Reject setting VSOCK_NET_MODE_LOCAL with -EOPNOTSUPP if a G2H transport is operational. Additionally, reject G2H transport registration if there already exists a namespace in local mode.

G2H sockets break in local mode because the G2H transports don't support namespacing yet. The current approach is to coerce packets coming out of G2H transports into VSOCK_NET_MODE_GLOBAL mode, but it is not possible to coerce sockets in the same way because it cannot be deduced which transport will be used by the socket. Specifically, when bound to VMADDR_CID_ANY in a nested VM (both G2H and H2G available), it is not until a packet is received and matched to the bound socket that we assign the transport. This presents a chicken-and-egg problem, because we need the namespace to lookup the socket and resolve the transport, but we need the transport to know how to use the namespace during lookup.

For that reason, this patch prevents VSOCK_NET_MODE_LOCAL from being used on systems that support G2H, even nested systems that also have H2G transports.

Local mode is blocked based on detecting the presence of G2H devices (when possible, as hyperv is special). This means that a host kernel with G2H support compiled in (or has the module loaded), will still support local mode if there is no G2H (e.g., virtio-vsock) device detected. This enables using the same kernel in the host and in the guest, as we do in kselftest.

Systems with only namespace-aware transports (vhost-vsock, loopback) can still use both VSOCK_NET_MODE_GLOBAL and VSOCK_NET_MODE_LOCAL modes as intended.

Add supports_local_mode() transport callback to indicate transport-specific local mode support.

These restrictions can be lifted in a future patch series when G2H transports gain namespace support.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v11:

• vhost_transport_supports_local_mode() returns false to keep things

disabled until support comes online (Stefano)

• add comment above supports_local_mode() cb to clarify (Stefano)
• Remove redundant `ret = 0` initialization in vsock_net_mode_string()

(Stefano)

• Refactor vsock_net_mode_string() to separate parsing from validation

(Stefano)

• vmci returns false for supports_local_mode(), with comment

Changes in v10:

• move this patch before any transports bring online namespacing (Stefano)
• move vsock_net_mode_string into critical section (Stefano)
• add ->supports_local_mode() callback to transports (Stefano)

---

drivers/vhost/vsock.c | 6 ++++++ include/net/af_vsock.h | 11 +++++++++++ net/vmw_vsock/af_vsock.c | 32 ++++++++++++++++++++++++++++++++ net/vmw_vsock/hyperv_transport.c | 6 ++++++ net/vmw_vsock/virtio_transport.c | 13 +++++++++++++ net/vmw_vsock/vmci_transport.c | 12 ++++++++++++ net/vmw_vsock/vsock_loopback.c | 6 ++++++ 7 files changed, 86 insertions(+)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 69074656263d..4e3856aa2479 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -64,6 +64,11 @@ static u32 vhost_transport_get_local_cid(void) return VHOST_VSOCK_DEFAULT_HOST_CID; }

+static bool vhost_transport_supports_local_mode(void) +{

• return false;

+}

/* Callers that dereference the return value must hold vhost_vsock_mutex or the

• RCU read lock.

*/ @@ -412,6 +417,7 @@ static struct virtio_transport vhost_transport = { .module = THIS_MODULE,

.get_local_cid            = vhost_transport_get_local_cid,

• .supports_local_mode	  = vhost_transport_supports_local_mode,
  
  

  .init = virtio_transport_do_socket_init, .destruct = virtio_transport_destruct,

diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 59d97a143204..e24ef1d9fe02 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -180,6 +180,17 @@ struct vsock_transport { /* Addressing. */ u32 (*get_local_cid)(void);

• /* Return true if the transport is compatible with

• * VSOCK_NET_MODE_LOCAL. Otherwise, return false.
  

• *
  

• * Transports should return false if they lack local-mode namespace
  

• * support (e.g., G2H transports like hyperv-vsock and vmci-vsock).
  

• * virtio-vsock returns true only if no device is present in order to
  

• * enable local mode in nested scenarios in which virtio-vsock is
  

• * loaded or built-in, but nonetheless unusable by sockets.
  

• */
  

• bool (*supports_local_mode)(void);
• /* Read a single skb */ int (*read_skb)(struct vsock_sock *, skb_read_actor_t);

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 243c0d588682..120adb9dad9f 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -91,6 +91,12 @@

• and locked down by a namespace manager. The default is "global". The mode
• is set per-namespace.

• • Note: LOCAL mode is only supported when using namespace-aware transports
• • (vhost-vsock, loopback). If a guest-to-host transport (virtio-vsock,
• • hyperv-vsock, vmci-vsock) is operational, attempts to set LOCAL mode will
• • fail with EOPNOTSUPP, as these transports do not support per-namespace
• • isolation.

• The modes affect the allocation and accessibility of CIDs as follows:
• • global - access and allocation are all system-wide

@@ -2794,6 +2800,15 @@ static int vsock_net_mode_string(const struct ctl_table *table, int write, else return -EINVAL;

• mutex_lock(&vsock_register_mutex);
• if (mode == VSOCK_NET_MODE_LOCAL &&

•    transport_g2h && transport_g2h->supports_local_mode &&
  

•    !transport_g2h->supports_local_mode()) {
  

• mutex_unlock(&vsock_register_mutex);
  

• return -EOPNOTSUPP;
  

• }
• mutex_unlock(&vsock_register_mutex);

Wait, I think we already discussed about this, vsock_net_write_mode() must be called with the lock held.

See https://lore.kernel.org/netdev/aRTTwuuXSz5CvNjt@devvm11784.nha0.facebook.com...

Ah right, oversight on my part.

Since I guess we need another version of this patch, can you check the commit description to see if it reflects what we are doing now (e.g vhost is not enabled)?

Also I don't understand why for vhost we will enable it later, but for virtio_transport and vsock_loopback we are enabling it now, also if this patch is before the support on that transports. I'm a bit confused.

If something is unclear, let's discuss it before sending a new version.

What I had in mind was, add this patch and explain why we need this new callback (like you did), but enable the support in the patches that really enable it for any transport. But maybe what is not clear to me is that we need this only for G2H. But now I'm confused about the discussion around vmci H2G. We decided to discard also that one, but here we are not checking that? I mean here we are calling supports_local_mode() only on G2H IIUC.

Ah right, VMCI broke my original mental model of only needing this check for G2H (originally I didn't realize VMCI was H2G too).

I think now, we actually need to do this check for all of the transports no? Including h2g, g2h, local, and dgram?

Additionally, the commit description needs to be updated to reflect that.

With this, we then end up with two commits:

commit 1) This commit which adds the callbacks and gives each transport stubs to return false. Checks all transports (not just G2H). Update the commit. Fix vsock_net_write_mode() race above.

commit 2) change the virtio-vsock/vhost-vsock/vsock-loopback to add the real implementations (vhost + loopback return true, virtio detects device). The other transports keep their return false stubs so no changes.

Does that seem about right?

...

• if (!vsock_net_write_mode(net, mode)) return -EPERM;

@@ -2938,6 +2953,7 @@ int vsock_core_register(const struct vsock_transport *t, int features) { const struct vsock_transport *t_h2g, *t_g2h, *t_dgram, *t_local; int err = mutex_lock_interruptible(&vsock_register_mutex);

• struct net *net;

  if (err) return err;

@@ -2960,6 +2976,22 @@ int vsock_core_register(const struct vsock_transport *t, int features) err = -EBUSY; goto err_busy; }

• /* G2H sockets break in LOCAL mode namespaces because G2H
  

And also here we are talking about only of G2H, so what happen if vmci is loaded as H2G?

IMO we should discuss this a bit more and make it a bit more generic, like check all the transports.

Thanks, Stefano

Agreed.

Best, Bobby

On Fri, Nov 21, 2025 at 11:01:53AM -0800, Bobby Eshleman wrote:

On Fri, Nov 21, 2025 at 03:24:25PM +0100, Stefano Garzarella wrote:

...

On Thu, Nov 20, 2025 at 09:44:35PM -0800, Bobby Eshleman wrote:

...

From: Bobby Eshleman bobbyeshleman@meta.com

Reject setting VSOCK_NET_MODE_LOCAL with -EOPNOTSUPP if a G2H transport is operational. Additionally, reject G2H transport registration if there already exists a namespace in local mode.

G2H sockets break in local mode because the G2H transports don't support namespacing yet. The current approach is to coerce packets coming out of G2H transports into VSOCK_NET_MODE_GLOBAL mode, but it is not possible to coerce sockets in the same way because it cannot be deduced which transport will be used by the socket. Specifically, when bound to VMADDR_CID_ANY in a nested VM (both G2H and H2G available), it is not until a packet is received and matched to the bound socket that we assign the transport. This presents a chicken-and-egg problem, because we need the namespace to lookup the socket and resolve the transport, but we need the transport to know how to use the namespace during lookup.

For that reason, this patch prevents VSOCK_NET_MODE_LOCAL from being used on systems that support G2H, even nested systems that also have H2G transports.

Local mode is blocked based on detecting the presence of G2H devices (when possible, as hyperv is special). This means that a host kernel with G2H support compiled in (or has the module loaded), will still support local mode if there is no G2H (e.g., virtio-vsock) device detected. This enables using the same kernel in the host and in the guest, as we do in kselftest.

Systems with only namespace-aware transports (vhost-vsock, loopback) can still use both VSOCK_NET_MODE_GLOBAL and VSOCK_NET_MODE_LOCAL modes as intended.

Add supports_local_mode() transport callback to indicate transport-specific local mode support.

These restrictions can be lifted in a future patch series when G2H transports gain namespace support.

Signed-off-by: Bobby Eshleman bobbyeshleman@meta.com

Changes in v11:

• vhost_transport_supports_local_mode() returns false to keep things

disabled until support comes online (Stefano)

• add comment above supports_local_mode() cb to clarify (Stefano)
• Remove redundant `ret = 0` initialization in vsock_net_mode_string()

(Stefano)

• Refactor vsock_net_mode_string() to separate parsing from validation

(Stefano)

• vmci returns false for supports_local_mode(), with comment

Changes in v10:

• move this patch before any transports bring online namespacing (Stefano)
• move vsock_net_mode_string into critical section (Stefano)
• add ->supports_local_mode() callback to transports (Stefano)

---

drivers/vhost/vsock.c | 6 ++++++ include/net/af_vsock.h | 11 +++++++++++ net/vmw_vsock/af_vsock.c | 32 ++++++++++++++++++++++++++++++++ net/vmw_vsock/hyperv_transport.c | 6 ++++++ net/vmw_vsock/virtio_transport.c | 13 +++++++++++++ net/vmw_vsock/vmci_transport.c | 12 ++++++++++++ net/vmw_vsock/vsock_loopback.c | 6 ++++++ 7 files changed, 86 insertions(+)

diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c index 69074656263d..4e3856aa2479 100644 --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -64,6 +64,11 @@ static u32 vhost_transport_get_local_cid(void) return VHOST_VSOCK_DEFAULT_HOST_CID; }

+static bool vhost_transport_supports_local_mode(void) +{

• return false;

+}

/* Callers that dereference the return value must hold vhost_vsock_mutex or the

• RCU read lock.

*/ @@ -412,6 +417,7 @@ static struct virtio_transport vhost_transport = { .module = THIS_MODULE,

.get_local_cid            = vhost_transport_get_local_cid,

• .supports_local_mode	  = vhost_transport_supports_local_mode,
  
  

  .init = virtio_transport_do_socket_init, .destruct = virtio_transport_destruct,

diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h index 59d97a143204..e24ef1d9fe02 100644 --- a/include/net/af_vsock.h +++ b/include/net/af_vsock.h @@ -180,6 +180,17 @@ struct vsock_transport { /* Addressing. */ u32 (*get_local_cid)(void);

• /* Return true if the transport is compatible with

• * VSOCK_NET_MODE_LOCAL. Otherwise, return false.
  

• *
  

• * Transports should return false if they lack local-mode namespace
  

• * support (e.g., G2H transports like hyperv-vsock and vmci-vsock).
  

• * virtio-vsock returns true only if no device is present in order to
  

• * enable local mode in nested scenarios in which virtio-vsock is
  

• * loaded or built-in, but nonetheless unusable by sockets.
  

• */
  

• bool (*supports_local_mode)(void);
• /* Read a single skb */ int (*read_skb)(struct vsock_sock *, skb_read_actor_t);

diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 243c0d588682..120adb9dad9f 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -91,6 +91,12 @@

• and locked down by a namespace manager. The default is "global". The mode
• is set per-namespace.

• • Note: LOCAL mode is only supported when using namespace-aware transports
• • (vhost-vsock, loopback). If a guest-to-host transport (virtio-vsock,
• • hyperv-vsock, vmci-vsock) is operational, attempts to set LOCAL mode will
• • fail with EOPNOTSUPP, as these transports do not support per-namespace
• • isolation.

• The modes affect the allocation and accessibility of CIDs as follows:
• • global - access and allocation are all system-wide

@@ -2794,6 +2800,15 @@ static int vsock_net_mode_string(const struct ctl_table *table, int write, else return -EINVAL;

• mutex_lock(&vsock_register_mutex);
• if (mode == VSOCK_NET_MODE_LOCAL &&

•    transport_g2h && transport_g2h->supports_local_mode &&
  

•    !transport_g2h->supports_local_mode()) {
  

• mutex_unlock(&vsock_register_mutex);
  

• return -EOPNOTSUPP;
  

• }
• mutex_unlock(&vsock_register_mutex);

Wait, I think we already discussed about this, vsock_net_write_mode() must be called with the lock held.

See https://lore.kernel.org/netdev/aRTTwuuXSz5CvNjt@devvm11784.nha0.facebook.com...

Ah right, oversight on my part.

...

Since I guess we need another version of this patch, can you check the commit description to see if it reflects what we are doing now (e.g vhost is not enabled)?

Also I don't understand why for vhost we will enable it later, but for virtio_transport and vsock_loopback we are enabling it now, also if this patch is before the support on that transports. I'm a bit confused.

If something is unclear, let's discuss it before sending a new version.

What I had in mind was, add this patch and explain why we need this new callback (like you did), but enable the support in the patches that really enable it for any transport. But maybe what is not clear to me is that we need this only for G2H. But now I'm confused about the discussion around vmci H2G. We decided to discard also that one, but here we are not checking that? I mean here we are calling supports_local_mode() only on G2H IIUC.

Ah right, VMCI broke my original mental model of only needing this check for G2H (originally I didn't realize VMCI was H2G too).

I think now, we actually need to do this check for all of the transports no? Including h2g, g2h, local, and dgram?

Additionally, the commit description needs to be updated to reflect that.

Let's take a step back, though, because I tried to understand the problem better and I'm confused.

For example, in vmci (G2H side), when a packet arrives, we always use vsock_find_connected_socket(), which only searches in GLOBAL. So connections originating from the host can only reach global sockets in the guest. In this direction (host -> guest), we should be fine, right?

Now let's consider the other direction, from guest to host, so the connection should be generated via vsock_connect(). Here I see that we are not doing anything with regard to the source namespace. At this point, my question is whether we should modify vsock_assign_transport() or transport->stream_allow() to do this for each stream, and not prevent loading a G2H module a priori.

For example, stream_allow() could check that the socket namespace is supported by the assigned transport. E.g., vmci can check that if the namespace mode is not GLOBAL, then it returns false. (Same thing in virtio-vsock, I mean the G2H driver).

This should solve the guest -> host direction, but at this point I wonder if I'm missing something.

With this, we then end up with two commits:

commit 1) This commit which adds the callbacks and gives each transport stubs to return false. Checks all transports (not just G2H). Update the commit. Fix vsock_net_write_mode() race above.

commit 2) change the virtio-vsock/vhost-vsock/vsock-loopback to add the real implementations (vhost + loopback return true, virtio detects device). The other transports keep their return false stubs so no changes.

Does that seem about right?

If we really need this approach, this should be fine.

Thanks, Stefano