Diagnostic vmtest Checks
Relevant source files
The following files were used as context for generating this wiki page:
The gokrazy-kernel-buggy-linux-7_0 project provides a Linux 7.0 amd64 kernel package. It intentionally maintains a UDP Generic Segmentation Offload (GSO) regression for testing purposes. This kernel allows the Tailscale natlab/vmtest environment to verify mitigation behaviors even if the host kernel contains a fix.
The system targets QEMU q35 environments. It includes drivers for PCI, virtio block devices, and Intel igb network interfaces. Diagnostic checks ensure the guest environment correctly identifies buggy hardware acceleration features before proceeding with regression tests.
Sources: README.md:3-15, empty.go:7-11
Kernel Architecture and Features
The kernel implements a specific feature set to support container-like networking and hardware emulation within virtual machines. It enables IPv6, nftables, and WireGuard to facilitate modern networking tests.
Network Segmentation Offload
The primary purpose of this kernel involves the UDP GSO bug. The diagnostic vmtest verifies specific offload advertisements on the network interface.
- tx-udp-segmentation: The diagnostic check confirms the
igbinterface advertises this capability. - tx-gso-partial: The check validates this advertisement to ensure the kernel is ready for mitigation testing.
Sources: README.md:14-16, config.addendum.txt:104-106
Hardware Support
The kernel configuration includes specific drivers to enable standard virtualized hardware.
| Component | Kernel Config | Purpose |
|---|---|---|
| Intel NIC | CONFIG_IGB | Emulated NIC for UDP GSO bug testing |
| Virtio PCI | CONFIG_VIRTIO_PCI | Basic virtualization bus support |
| Virtio Net | CONFIG_VIRTIO_NET | Standard virtual networking |
| Virtio Block | CONFIG_VIRTIO_BLK | Root filesystem access |
Sources: config.addendum.txt:94-106, README.md:12-14
Diagnostic Workflow
The diagnostic vmtest process validates the environment before executing mitigation tests. It ensures the emulated hardware correctly exposes the bugs required for the test suite.
The diagram shows the sequence of checks performed by the vmtest image to validate the guest kernel environment.
Sources: README.md:14-16, cmdline.txt:1
Build and Configuration
The build system produces a vmlinuz image compatible with gokrazy. It merges standard x86 configurations with specific addendums.
Build Sequence
The build-buggy-linux-7_0.bash script automates the kernel construction.
- The script downloads the Linux 7.0 source tarball.
- It extracts the source into a local directory.
- It applies
make defconfigfor initial setup. - It appends the contents of
config.addendum.txtto the.configfile. - It runs
make olddefconfigto resolve new dependencies. - It compiles the
bzImageand copies it tovmlinuz.
Sources: build-buggy-linux-7_0.bash:4-22, README.md:33-35
Boot Parameters
The system uses a specific command line for initialization and error handling.
root=/dev/sda2 ro init=/gokrazy/init panic=10 oops=panic
Sources: cmdline.txt:1
Networking and Security Configuration
The kernel includes advanced networking features used by Tailscale and various network plumbing tools.
- NFTables: Enables comprehensive firewalling and NAT capabilities through
CONFIG_NF_TABLES. - Mitigation Controls: Explicitly disables
NF_CONNTRACKhelper modules to prevent NAT slipstreaming. - Congestion Control: Sets TCP BBR as the default using
CONFIG_TCP_CONG_BBR.
Sources: config.addendum.txt:28-66, config.addendum.txt:128-130
Diagnostic Networking Requirements
The following configuration flags enable the diagnostic path for the UDP GSO bug:
# From config.addendum.txt
CONFIG_NET_VENDOR_INTEL=y
CONFIG_IGB=y
CONFIG_PCI=y
CONFIG_NET_UDP_TUNNEL=y
Sources: config.addendum.txt:81, config.addendum.txt:104-108
Summary of Diagnostic Checks
The diagnostic vmtest checks ensure the environment matches the expected buggy state. By verifying tx-udp-segmentation and tx-gso-partial on the igb interface, the system guarantees that the kernel is capable of exercising the UDP GSO regression mitigation logic. This setup allows developers to test software fixes against a known-broken kernel version in a controlled, virtualized environment.
Sources: README.md:4-16, empty.go:9-11