February 2019 - Linux-kselftest-mirror

[PATCH AUTOSEL 4.20 58/81] selftests: netfilter: add simple masq/redirect test cases

by Sasha Levin

From: Florian Westphal <fw(a)strlen.de> [ Upstream commit 98bfc3414bda335dbd7fec58bde6266f991801d7 ] Check basic nat/redirect/masquerade for ipv4 and ipv6. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/nft_nat.sh | 762 +++++++++++++++++++ 2 files changed, 763 insertions(+), 1 deletion(-) create mode 100755 tools/testing/selftests/netfilter/nft_nat.sh diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile index 47ed6cef93fb8..c9ff2b47bd1ca 100644 --- a/tools/testing/selftests/netfilter/Makefile +++ b/tools/testing/selftests/netfilter/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # Makefile for netfilter selftests -TEST_PROGS := nft_trans_stress.sh +TEST_PROGS := nft_trans_stress.sh nft_nat.sh include ../lib.mk diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh new file mode 100755 index 0000000000000..8ec76681605cc --- /dev/null +++ b/tools/testing/selftests/netfilter/nft_nat.sh @@ -0,0 +1,762 @@ +#!/bin/bash +# +# This test is for basic NAT functionality: snat, dnat, redirect, masquerade. +# + +# Kselftest framework requirement - SKIP code is 4. +ksft_skip=4 +ret=0 + +nft --version > /dev/null 2>&1 +if [ $? -ne 0 ];then + echo "SKIP: Could not run test without nft tool" + exit $ksft_skip +fi + +ip -Version > /dev/null 2>&1 +if [ $? -ne 0 ];then + echo "SKIP: Could not run test without ip tool" + exit $ksft_skip +fi + +ip netns add ns0 +ip netns add ns1 +ip netns add ns2 + +ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 +ip link add veth1 netns ns0 type veth peer name eth0 netns ns2 + +ip -net ns0 link set lo up +ip -net ns0 link set veth0 up +ip -net ns0 addr add 10.0.1.1/24 dev veth0 +ip -net ns0 addr add dead:1::1/64 dev veth0 + +ip -net ns0 link set veth1 up +ip -net ns0 addr add 10.0.2.1/24 dev veth1 +ip -net ns0 addr add dead:2::1/64 dev veth1 + +for i in 1 2; do + ip -net ns$i link set lo up + ip -net ns$i link set eth0 up + ip -net ns$i addr add 10.0.$i.99/24 dev eth0 + ip -net ns$i route add default via 10.0.$i.1 + ip -net ns$i addr add dead:$i::99/64 dev eth0 + ip -net ns$i route add default via dead:$i::1 +done + +bad_counter() +{ + local ns=$1 + local counter=$2 + local expect=$3 + + echo "ERROR: $counter counter in $ns has unexpected value (expected $expect)" 1>&2 + ip netns exec $ns nft list counter inet filter $counter 1>&2 +} + +check_counters() +{ + ns=$1 + local lret=0 + + cnt=$(ip netns exec $ns nft list counter inet filter ns0in | grep -q "packets 1 bytes 84") + if [ $? -ne 0 ]; then + bad_counter $ns ns0in "packets 1 bytes 84" + lret=1 + fi + cnt=$(ip netns exec $ns nft list counter inet filter ns0out | grep -q "packets 1 bytes 84") + if [ $? -ne 0 ]; then + bad_counter $ns ns0out "packets 1 bytes 84" + lret=1 + fi + + expect="packets 1 bytes 104" + cnt=$(ip netns exec $ns nft list counter inet filter ns0in6 | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter $ns ns0in6 "$expect" + lret=1 + fi + cnt=$(ip netns exec $ns nft list counter inet filter ns0out6 | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter $ns ns0out6 "$expect" + lret=1 + fi + + return $lret +} + +check_ns0_counters() +{ + local ns=$1 + local lret=0 + + cnt=$(ip netns exec ns0 nft list counter inet filter ns0in | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then + bad_counter ns0 ns0in "packets 0 bytes 0" + lret=1 + fi + + cnt=$(ip netns exec ns0 nft list counter inet filter ns0in6 | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then + bad_counter ns0 ns0in6 "packets 0 bytes 0" + lret=1 + fi + + cnt=$(ip netns exec ns0 nft list counter inet filter ns0out | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then + bad_counter ns0 ns0out "packets 0 bytes 0" + lret=1 + fi + cnt=$(ip netns exec ns0 nft list counter inet filter ns0out6 | grep -q "packets 0 bytes 0") + if [ $? -ne 0 ]; then + bad_counter ns0 ns0out6 "packets 0 bytes 0" + lret=1 + fi + + for dir in "in" "out" ; do + expect="packets 1 bytes 84" + cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 $ns$dir "$expect" + lret=1 + fi + + expect="packets 1 bytes 104" + cnt=$(ip netns exec ns0 nft list counter inet filter ${ns}${dir}6 | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 $ns$dir6 "$expect" + lret=1 + fi + done + + return $lret +} + +reset_counters() +{ + for i in 0 1 2;do + ip netns exec ns$i nft reset counters inet > /dev/null + done +} + +test_local_dnat6() +{ + local lret=0 +ip netns exec ns0 nft -f - <<EOF +table ip6 nat { + chain output { + type nat hook output priority 0; policy accept; + ip6 daddr dead:1::99 dnat to dead:2::99 + } +} +EOF + if [ $? -ne 0 ]; then + echo "SKIP: Could not add add ip6 dnat hook" + return $ksft_skip + fi + + # ping netns1, expect rewrite to netns2 + ip netns exec ns0 ping -q -c 1 dead:1::99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping6 failed" + return $lret + fi + + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 ns1$dir "$expect" + lret=1 + fi + done + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 ns2$dir "$expect" + lret=1 + fi + done + + # expect 0 count in ns1 + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + done + + # expect 1 packet in ns2 + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns0$dir "$expect" + lret=1 + fi + done + + test $lret -eq 0 && echo "PASS: ipv6 ping to ns1 was NATted to ns2" + ip netns exec ns0 nft flush chain ip6 nat output + + return $lret +} + +test_local_dnat() +{ + local lret=0 +ip netns exec ns0 nft -f - <<EOF +table ip nat { + chain output { + type nat hook output priority 0; policy accept; + ip daddr 10.0.1.99 dnat to 10.0.2.99 + } +} +EOF + # ping netns1, expect rewrite to netns2 + ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping failed" + return $lret + fi + + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 ns1$dir "$expect" + lret=1 + fi + done + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 ns2$dir "$expect" + lret=1 + fi + done + + # expect 0 count in ns1 + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + done + + # expect 1 packet in ns2 + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns0$dir "$expect" + lret=1 + fi + done + + test $lret -eq 0 && echo "PASS: ping to ns1 was NATted to ns2" + + ip netns exec ns0 nft flush chain ip nat output + + reset_counters + ip netns exec ns0 ping -q -c 1 10.0.1.99 > /dev/null + if [ $? -ne 0 ]; then + lret=1 + echo "ERROR: ping failed" + return $lret + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns1$dir "$expect" + lret=1 + fi + done + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 ns2$dir "$expect" + lret=1 + fi + done + + # expect 1 count in ns1 + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns0 ns0$dir "$expect" + lret=1 + fi + done + + # expect 0 packet in ns2 + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns2 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns2$dir "$expect" + lret=1 + fi + done + + test $lret -eq 0 && echo "PASS: ping to ns1 OK after nat output chain flush" + + return $lret +} + + +test_masquerade6() +{ + local lret=0 + + ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null + + ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannot ping ns1 from ns2 via ipv6" + return 1 + lret=1 + fi + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns2$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + reset_counters + +# add masquerading rule +ip netns exec ns0 nft -f - <<EOF +table ip6 nat { + chain postrouting { + type nat hook postrouting priority 0; policy accept; + meta oif veth0 masquerade + } +} +EOF + ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannot ping ns1 from ns2 with active ipv6 masquerading" + lret=1 + fi + + # ns1 should have seen packets from ns0, due to masquerade + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do + + cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + # ns1 should not have seen packets from ns2, due to masquerade + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + ip netns exec ns0 nft flush chain ip6 nat postrouting + if [ $? -ne 0 ]; then + echo "ERROR: Could not flush ip6 nat postrouting" 1>&2 + lret=1 + fi + + test $lret -eq 0 && echo "PASS: IPv6 masquerade for ns2" + + return $lret +} + +test_masquerade() +{ + local lret=0 + + ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null + ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null + + ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: canot ping ns1 from ns2" + lret=1 + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns2$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + reset_counters + +# add masquerading rule +ip netns exec ns0 nft -f - <<EOF +table ip nat { + chain postrouting { + type nat hook postrouting priority 0; policy accept; + meta oif veth0 masquerade + } +} +EOF + ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannot ping ns1 from ns2 with active ip masquerading" + lret=1 + fi + + # ns1 should have seen packets from ns0, due to masquerade + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns0${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + # ns1 should not have seen packets from ns2, due to masquerade + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + ip netns exec ns0 nft flush chain ip nat postrouting + if [ $? -ne 0 ]; then + echo "ERROR: Could not flush nat postrouting" 1>&2 + lret=1 + fi + + test $lret -eq 0 && echo "PASS: IP masquerade for ns2" + + return $lret +} + +test_redirect6() +{ + local lret=0 + + ip netns exec ns0 sysctl net.ipv6.conf.all.forwarding=1 > /dev/null + + ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannnot ping ns1 from ns2 via ipv6" + lret=1 + fi + + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns2$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + reset_counters + +# add redirect rule +ip netns exec ns0 nft -f - <<EOF +table ip6 nat { + chain prerouting { + type nat hook prerouting priority 0; policy accept; + meta iif veth1 meta l4proto icmpv6 ip6 saddr dead:2::99 ip6 daddr dead:1::99 redirect + } +} +EOF + ip netns exec ns2 ping -q -c 1 dead:1::99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannot ping ns1 from ns2 with active ip6 redirect" + lret=1 + fi + + # ns1 should have seen no packets from ns2, due to redirection + expect="packets 0 bytes 0" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + done + + # ns0 should have seen packets from ns2, due to masquerade + expect="packets 1 bytes 104" + for dir in "in6" "out6" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + done + + ip netns exec ns0 nft delete table ip6 nat + if [ $? -ne 0 ]; then + echo "ERROR: Could not delete ip6 nat table" 1>&2 + lret=1 + fi + + test $lret -eq 0 && echo "PASS: IPv6 redirection for ns2" + + return $lret +} + +test_redirect() +{ + local lret=0 + + ip netns exec ns0 sysctl net.ipv4.conf.veth0.forwarding=1 > /dev/null + ip netns exec ns0 sysctl net.ipv4.conf.veth1.forwarding=1 > /dev/null + + ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannot ping ns1 from ns2" + lret=1 + fi + + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns2$dir "$expect" + lret=1 + fi + + cnt=$(ip netns exec ns2 nft list counter inet filter ns1${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns2 ns1$dir "$expect" + lret=1 + fi + done + + reset_counters + +# add redirect rule +ip netns exec ns0 nft -f - <<EOF +table ip nat { + chain prerouting { + type nat hook prerouting priority 0; policy accept; + meta iif veth1 ip protocol icmp ip saddr 10.0.2.99 ip daddr 10.0.1.99 redirect + } +} +EOF + ip netns exec ns2 ping -q -c 1 10.0.1.99 > /dev/null # ping ns2->ns1 + if [ $? -ne 0 ] ; then + echo "ERROR: cannot ping ns1 from ns2 with active ip redirect" + lret=1 + fi + + # ns1 should have seen no packets from ns2, due to redirection + expect="packets 0 bytes 0" + for dir in "in" "out" ; do + + cnt=$(ip netns exec ns1 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + done + + # ns0 should have seen packets from ns2, due to masquerade + expect="packets 1 bytes 84" + for dir in "in" "out" ; do + cnt=$(ip netns exec ns0 nft list counter inet filter ns2${dir} | grep -q "$expect") + if [ $? -ne 0 ]; then + bad_counter ns1 ns0$dir "$expect" + lret=1 + fi + done + + ip netns exec ns0 nft delete table ip nat + if [ $? -ne 0 ]; then + echo "ERROR: Could not delete nat table" 1>&2 + lret=1 + fi + + test $lret -eq 0 && echo "PASS: IP redirection for ns2" + + return $lret +} + + +# ip netns exec ns0 ping -c 1 -q 10.0.$i.99 +for i in 0 1 2; do +ip netns exec ns$i nft -f - <<EOF +table inet filter { + counter ns0in {} + counter ns1in {} + counter ns2in {} + + counter ns0out {} + counter ns1out {} + counter ns2out {} + + counter ns0in6 {} + counter ns1in6 {} + counter ns2in6 {} + + counter ns0out6 {} + counter ns1out6 {} + counter ns2out6 {} + + map nsincounter { + type ipv4_addr : counter + elements = { 10.0.1.1 : "ns0in", + 10.0.2.1 : "ns0in", + 10.0.1.99 : "ns1in", + 10.0.2.99 : "ns2in" } + } + + map nsincounter6 { + type ipv6_addr : counter + elements = { dead:1::1 : "ns0in6", + dead:2::1 : "ns0in6", + dead:1::99 : "ns1in6", + dead:2::99 : "ns2in6" } + } + + map nsoutcounter { + type ipv4_addr : counter + elements = { 10.0.1.1 : "ns0out", + 10.0.2.1 : "ns0out", + 10.0.1.99: "ns1out", + 10.0.2.99: "ns2out" } + } + + map nsoutcounter6 { + type ipv6_addr : counter + elements = { dead:1::1 : "ns0out6", + dead:2::1 : "ns0out6", + dead:1::99 : "ns1out6", + dead:2::99 : "ns2out6" } + } + + chain input { + type filter hook input priority 0; policy accept; + counter name ip saddr map @nsincounter + icmpv6 type { "echo-request", "echo-reply" } counter name ip6 saddr map @nsincounter6 + } + chain output { + type filter hook output priority 0; policy accept; + counter name ip daddr map @nsoutcounter + icmpv6 type { "echo-request", "echo-reply" } counter name ip6 daddr map @nsoutcounter6 + } +} +EOF +done + +sleep 3 +# test basic connectivity +for i in 1 2; do + ip netns exec ns0 ping -c 1 -q 10.0.$i.99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: Could not reach other namespace(s)" 1>&2 + ret=1 + fi + + ip netns exec ns0 ping -c 1 -q dead:$i::99 > /dev/null + if [ $? -ne 0 ];then + echo "ERROR: Could not reach other namespace(s) via ipv6" 1>&2 + ret=1 + fi + check_counters ns$i + if [ $? -ne 0 ]; then + ret=1 + fi + + check_ns0_counters ns$i + if [ $? -ne 0 ]; then + ret=1 + fi + reset_counters +done + +if [ $ret -eq 0 ];then + echo "PASS: netns routing/connectivity: ns0 can reach ns1 and ns2" +fi + +reset_counters +test_local_dnat +test_local_dnat6 + +reset_counters +test_masquerade +test_masquerade6 + +reset_counters +test_redirect +test_redirect6 + +for i in 0 1 2; do ip netns del ns$i;done + +exit $ret -- 2.19.1

5 years, 1 month

1
0
0 0

[PATCH AUTOSEL 4.20 57/81] selftests: netfilter: fix config fragment CONFIG_NF_TABLES_INET

by Sasha Levin

From: Naresh Kamboju <naresh.kamboju(a)linaro.org> [ Upstream commit 952b72f89ae23b316da8c1021b18d0c388ad6cc4 ] In selftests the config fragment for netfilter was added as NF_TABLES_INET=y and this patch correct it as CONFIG_NF_TABLES_INET=y Signed-off-by: Naresh Kamboju <naresh.kamboju(a)linaro.org> Acked-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/netfilter/config | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/netfilter/config b/tools/testing/selftests/netfilter/config index 1017313e41a85..59caa8f71cd80 100644 --- a/tools/testing/selftests/netfilter/config +++ b/tools/testing/selftests/netfilter/config @@ -1,2 +1,2 @@ CONFIG_NET_NS=y -NF_TABLES_INET=y +CONFIG_NF_TABLES_INET=y -- 2.19.1

5 years, 1 month

1
0
0 0

[PATCH AUTOSEL 4.20 45/81] bpf, selftests: fix handling of sparse CPU allocations

by Sasha Levin

From: Martynas Pumputis <m(a)lambda.lt> [ Upstream commit 1bb54c4071f585ebef56ce8fdfe6026fa2cbcddd ] Previously, bpf_num_possible_cpus() had a bug when calculating a number of possible CPUs in the case of sparse CPU allocations, as it was considering only the first range or element of /sys/devices/system/cpu/possible. E.g. in the case of "0,2-3" (CPU 1 is not available), the function returned 1 instead of 3. This patch fixes the function by making it parse all CPU ranges and elements. Signed-off-by: Martynas Pumputis <m(a)lambda.lt> Acked-by: Yonghong Song <yhs(a)fb.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/bpf/bpf_util.h | 30 +++++++++++++++++--------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/tools/testing/selftests/bpf/bpf_util.h b/tools/testing/selftests/bpf/bpf_util.h index 315a44fa32af3..84fd6f1bf33e7 100644 --- a/tools/testing/selftests/bpf/bpf_util.h +++ b/tools/testing/selftests/bpf/bpf_util.h @@ -13,7 +13,7 @@ static inline unsigned int bpf_num_possible_cpus(void) unsigned int start, end, possible_cpus = 0; char buff[128]; FILE *fp; - int n; + int len, n, i, j = 0; fp = fopen(fcpu, "r"); if (!fp) { @@ -21,17 +21,27 @@ static inline unsigned int bpf_num_possible_cpus(void) exit(1); } - while (fgets(buff, sizeof(buff), fp)) { - n = sscanf(buff, "%u-%u", &start, &end); - if (n == 0) { - printf("Failed to retrieve # possible CPUs!\n"); - exit(1); - } else if (n == 1) { - end = start; + if (!fgets(buff, sizeof(buff), fp)) { + printf("Failed to read %s!\n", fcpu); + exit(1); + } + + len = strlen(buff); + for (i = 0; i <= len; i++) { + if (buff[i] == ',' || buff[i] == '\0') { + buff[i] = '\0'; + n = sscanf(&buff[j], "%u-%u", &start, &end); + if (n <= 0) { + printf("Failed to retrieve # possible CPUs!\n"); + exit(1); + } else if (n == 1) { + end = start; + } + possible_cpus += end - start + 1; + j = i + 1; } - possible_cpus = start == 0 ? end + 1 : 0; - break; } + fclose(fp); return possible_cpus; -- 2.19.1

5 years, 1 month

1
0
0 0

next-20190228 kselftest results

by ci_notify＠linaro.org

Summary ------------------------------------------------------------------------ kernel: 5.0.0-rc8 git repo: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git branch: master git commit: 42fd8df9d1d9c83046226e771a4f5f3d05a706ff git describe: next-20190228 Test details: https://qa-reports.linaro.org/lkft/linux-next-oe/build/next-20190228 Regressions (compared to build next-20190227) ------------------------------------------------------------------------ qemu_arm64: kselftest: * bpf_test_sock_fields Fixes (compared to build next-20190227) ------------------------------------------------------------------------ hi6220-hikey - arm64: kselftest: * bpf_test_maps qemu_arm64: kselftest: * bpf_test_sockmap qemu_x86_64: kselftest: * bpf_test_sockmap In total: ------------------------------------------------------------------------ Ran 290 total tests in the following environments and test suites. pass 214 fail 76 xfail 0 skip 0 Environments -------------- - dragonboard-410c - arm64 - hi6220-hikey - arm64 - i386 - juno-r2 - arm64 - qemu_arm - qemu_arm64 - qemu_i386 - qemu_x86_64 - x15 - arm - x86_64 Test Suites ----------- * kselftest * kselftest-vsyscall-mode-native * kselftest-vsyscall-mode-none Failures ------------------------------------------------------------------------ x86: * kselftest-vsyscall-mode-native/bpf_test_progs * kselftest/bpf_test_btf * kselftest/bpf_test_progs * kselftest-vsyscall-mode-none/bpf_test_btf * kselftest-vsyscall-mode-none/bpf_test_libbpf.sh * kselftest-vsyscall-mode-none/bpf_test_lirc_mode2_user * kselftest-vsyscall-mode-none/bpf_test_progs * kselftest-vsyscall-mode-none/bpf_test_sock_addr.sh * kselftest-vsyscall-mode-none/bpf_test_sockmap qemu_arm: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user qemu_x86_64: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh qemu_i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user hi6220-hikey: * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs x15: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user juno-r2: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh qemu_arm64: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sock_fields i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user Skips ------------------------------------------------------------------------ No skips -- Linaro LKFT https://lkft.linaro.org

5 years, 1 month

1
0
0 0

Re: [RFC v3 17/19] of: unittest: migrate tests to run on KUnit

by Brendan Higgins

On Wed, Nov 28, 2018 at 12:56 PM Rob Herring <robh(a)kernel.org> wrote: > > On Wed, Nov 28, 2018 at 1:38 PM Brendan Higgins > <brendanhiggins(a)google.com> wrote: > > > > Migrate tests without any cleanup, or modifying test logic in anyway to > > run under KUnit using the KUnit expectation and assertion API. > > Nice! You beat me to it. This is probably going to conflict with what > is in the DT tree for 4.21. Also, please Cc the DT list for > drivers/of/ changes. > > Looks good to me, but a few mostly formatting comments below. I just realized that we never talked about your other comments, and I still have some questions. (Sorry, it was the last thing I looked at while getting v4 ready.) No worries if you don't get to it before I send v4 out, I just didn't want you to think I was ignoring you. > > > > > Signed-off-by: Brendan Higgins <brendanhiggins(a)google.com> > > --- > > drivers/of/Kconfig | 1 + > > drivers/of/unittest.c | 1405 ++++++++++++++++++++++------------------- > > 2 files changed, 752 insertions(+), 654 deletions(-) > > <snip> > > diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c > > index 41b49716ac75f..a5ef44730ffdb 100644 > > --- a/drivers/of/unittest.c > > +++ b/drivers/of/unittest.c <snip> > > - > > -static void __init of_unittest_find_node_by_name(void) > > +static void of_unittest_find_node_by_name(struct kunit *test) > > Why do we have to drop __init everywhere? The tests run later? >From the standpoint of a unit test __init doesn't really make any sense, right? I know that right now we are running as part of a kernel, but the goal should be that a unit test is not part of a kernel and we just include what we need. Even so, that's the future. For now, I did not put the KUnit infrastructure in the .init section because I didn't think it belonged there. In practice, KUnit only knows how to run during the init phase of the kernel, but I don't think it should be restricted there. You should be able to run tests whenever you want because you should be able to test anything right? I figured any restriction on that is misleading and will potentially get in the way at worst, and unnecessary at best especially since people shouldn't build a production kernel with all kinds of unit tests inside. > > > { > > struct device_node *np; > > const char *options, *name; > > <snip> > > > > > > - np = of_find_node_by_path("/testcase-data/missing-path"); > > - unittest(!np, "non-existent path returned node %pOF\n", np); > > + KUNIT_EXPECT_EQ_MSG(test, > > + of_find_node_by_path("/testcase-data/missing-path"), > > + NULL, > > + "non-existent path returned node %pOF\n", np); > > 1 tab indent would help with less vertical code (in general, not this > one so much). Will do. > > > of_node_put(np); > > > > - np = of_find_node_by_path("missing-alias"); > > - unittest(!np, "non-existent alias returned node %pOF\n", np); > > + KUNIT_EXPECT_EQ_MSG(test, of_find_node_by_path("missing-alias"), NULL, > > + "non-existent alias returned node %pOF\n", np); > > of_node_put(np); > > > > - np = of_find_node_by_path("testcase-alias/missing-path"); > > - unittest(!np, "non-existent alias with relative path returned node %pOF\n", np); > > + KUNIT_EXPECT_EQ_MSG(test, > > + of_find_node_by_path("testcase-alias/missing-path"), > > + NULL, > > + "non-existent alias with relative path returned node %pOF\n", > > + np); > > of_node_put(np); > > <snip> > > > > -static void __init of_unittest_property_string(void) > > +static void of_unittest_property_string(struct kunit *test) > > { > > const char *strings[4]; > > struct device_node *np; > > int rc; > > > > np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a"); > > - if (!np) { > > - pr_err("No testcase data in device tree\n"); > > - return; > > - } > > - > > - rc = of_property_match_string(np, "phandle-list-names", "first"); > > - unittest(rc == 0, "first expected:0 got:%i\n", rc); > > - rc = of_property_match_string(np, "phandle-list-names", "second"); > > - unittest(rc == 1, "second expected:1 got:%i\n", rc); > > - rc = of_property_match_string(np, "phandle-list-names", "third"); > > - unittest(rc == 2, "third expected:2 got:%i\n", rc); > > - rc = of_property_match_string(np, "phandle-list-names", "fourth"); > > - unittest(rc == -ENODATA, "unmatched string; rc=%i\n", rc); > > - rc = of_property_match_string(np, "missing-property", "blah"); > > - unittest(rc == -EINVAL, "missing property; rc=%i\n", rc); > > - rc = of_property_match_string(np, "empty-property", "blah"); > > - unittest(rc == -ENODATA, "empty property; rc=%i\n", rc); > > - rc = of_property_match_string(np, "unterminated-string", "blah"); > > - unittest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc); > > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, np); > > + > > + KUNIT_EXPECT_EQ(test, > > + of_property_match_string(np, > > + "phandle-list-names", > > + "first"), > > + 0); > > + KUNIT_EXPECT_EQ(test, > > + of_property_match_string(np, > > + "phandle-list-names", > > + "second"), > > + 1); > > Fewer lines on these would be better even if we go over 80 chars. On the of_property_match_string(...), I have no opinion. I will do whatever you like best. Nevertheless, as far as the KUNIT_EXPECT_*(...), I do have an opinion: I am trying to establish a good, readable convention. Given an expect statement structured as ``` KUNIT_EXPECT_*( test, expect_arg_0, ..., expect_arg_n, fmt_str, fmt_arg_0, ..., fmt_arg_n) ``` where `test` is the `struct kunit` context argument, `expect_arg_{0, ..., n}` are the arguments the expectations is being made about (so in the above example, `of_property_match_string(...)` and `1`), and `fmt_*` is the optional format string that comes at the end of some expectations. The pattern I had been trying to promote is the following: 1) If everything fits on 1 line, do that. 2) If you must make a line split, prefer to keep `test` on its own line, `expect_arg_{0, ..., n}` should be kept together, if possible, and the format string should follow the conventions already most commonly used with format strings. 3) If you must split up `expect_arg_{0, ..., n}` each argument should get its own line and should not share a line with either `test` or any `fmt_*`. The reason I care about this so much is because expectations should be extremely easy to read; they are the most important part of a unit test because they tell you what the test is verifying. I am not married to the formatting I proposed above, but I want something that will be extremely easy to identify the arguments that the expectation is on. Maybe that means that I need to add some syntactic fluff to make it clearer, I don't know, but this is definitely something we need to get right, especially in the earliest examples. > > > + KUNIT_EXPECT_EQ(test, > > + of_property_match_string(np, > > + "phandle-list-names", > > + "third"), > > + 2); > > + KUNIT_EXPECT_EQ_MSG(test, > > + of_property_match_string(np, > > + "phandle-list-names", > > + "fourth"), > > + -ENODATA, > > + "unmatched string"); > > + KUNIT_EXPECT_EQ_MSG(test, > > + of_property_match_string(np, > > + "missing-property", > > + "blah"), > > + -EINVAL, > > + "missing property"); > > + KUNIT_EXPECT_EQ_MSG(test, > > + of_property_match_string(np, > > + "empty-property", > > + "blah"), > > + -ENODATA, > > + "empty property"); > > + KUNIT_EXPECT_EQ_MSG(test, > > + of_property_match_string(np, > > + "unterminated-string", > > + "blah"), > > + -EILSEQ, > > + "unterminated string"); <snip> > > /* test insertion of a bus with parent devices */ > > -static void __init of_unittest_overlay_10(void) > > +static void of_unittest_overlay_10(struct kunit *test) > > { > > - int ret; > > char *child_path; > > > > /* device should disable */ > > - ret = of_unittest_apply_overlay_check(10, 10, 0, 1, PDEV_OVERLAY); > > - if (unittest(ret == 0, > > - "overlay test %d failed; overlay application\n", 10)) > > - return; > > + KUNIT_ASSERT_EQ_MSG(test, > > + of_unittest_apply_overlay_check(test, > > + 10, > > + 10, > > + 0, > > + 1, > > + PDEV_OVERLAY), > > I prefer putting multiple args on a line and having fewer lines. Looking at this now, I tend to agree, but I don't think I saw a consistent way to break them up for these functions. I figured there should be some type of pattern. > > > + 0, > > + "overlay test %d failed; overlay application\n", > > + 10); > > > > child_path = kasprintf(GFP_KERNEL, "%s/test-unittest101", > > unittest_path(10, PDEV_OVERLAY)); > > - if (unittest(child_path, "overlay test %d failed; kasprintf\n", 10)) > > - return; > > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, child_path); > > > > - ret = of_path_device_type_exists(child_path, PDEV_OVERLAY); > > + KUNIT_EXPECT_TRUE_MSG(test, > > + of_path_device_type_exists(child_path, > > + PDEV_OVERLAY), > > + "overlay test %d failed; no child device\n", 10); > > kfree(child_path); > > - > > - unittest(ret, "overlay test %d failed; no child device\n", 10); > > } <snip>

5 years, 1 month

3
4
0 0

[PATCH] x86/selftests/xsave: Introduce XSAVE tests

by Yu-cheng Yu

In the past there were some issues resulting from additions to XSAVE/XSAVES. Introduce a few tests to help detect issues early. Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Shuah Khan <shuah(a)kernel.org> Signed-off-by: Yu-cheng Yu <yu-cheng.yu(a)intel.com> --- tools/testing/selftests/x86/Makefile | 4 +- .../testing/selftests/x86/xsave_check_exec.c | 117 +++++++++++++++ .../testing/selftests/x86/xsave_check_fork.c | 68 +++++++++ .../selftests/x86/xsave_check_ptrace.c | 88 +++++++++++ .../selftests/x86/xsave_check_signal.c | 116 +++++++++++++++ .../x86/xsave_check_signal_handler.c | 140 ++++++++++++++++++ tools/testing/selftests/x86/xsave_test.h | 63 ++++++++ 7 files changed, 595 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/x86/xsave_check_exec.c create mode 100644 tools/testing/selftests/x86/xsave_check_fork.c create mode 100644 tools/testing/selftests/x86/xsave_check_ptrace.c create mode 100644 tools/testing/selftests/x86/xsave_check_signal.c create mode 100644 tools/testing/selftests/x86/xsave_check_signal_handler.c create mode 100644 tools/testing/selftests/x86/xsave_test.h diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile index 186520198de7..f2b422d9809d 100644 --- a/tools/testing/selftests/x86/Makefile +++ b/tools/testing/selftests/x86/Makefile @@ -12,7 +12,9 @@ CAN_BUILD_WITH_NOPIE := $(shell ./check_cc.sh $(CC) trivial_program.c -no-pie) TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \ check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \ - protection_keys test_vdso test_vsyscall mov_ss_trap + protection_keys test_vdso test_vsyscall mov_ss_trap \ + xsave_check_exec xsave_check_fork xsave_check_ptrace \ + xsave_check_signal xsave_check_signal_handler TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \ test_FCMOV test_FCOMI test_FISTTP \ vdso_restorer diff --git a/tools/testing/selftests/x86/xsave_check_exec.c b/tools/testing/selftests/x86/xsave_check_exec.c new file mode 100644 index 000000000000..652ec0f6d866 --- /dev/null +++ b/tools/testing/selftests/x86/xsave_check_exec.c @@ -0,0 +1,117 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Verify xstate after exec, with PTRACE */ + +#include <unistd.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <string.h> +#include <elf.h> +#include <sys/ptrace.h> +#include <sys/types.h> +#include <sys/wait.h> +#include <sys/uio.h> +#include "xsave_test.h" + +void set_ymm(void) +{ + r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a}, + {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}}; + + asm volatile("vmovdqu %0, %%ymm0" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm1" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm2" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm3" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm4" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm5" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm6" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm7" :: "m" (y)); +} + +int main(int argc, char *argv[]) +{ + xbuf buf; + pid_t child; + struct iovec iov; + int i, r; + + set_ymm(); + child = fork(); + + if (child == 0) { + static char *args[] = {"/usr/bin/test", NULL}; + + execve(args[0], args, 0); + printf("execve() failed!\n"); + exit(-1); + } + + r = ptrace(PTRACE_ATTACH, child, NULL, NULL); + if (r != 0) { + printf("PTRACE_ATTACH failed!\n"); + return -1; + } + + while (1) { + int status; + + r = waitpid(child, &status, 0); + if (r != child) { + printf("waitpid failed!\n"); + return -1; + } + + if (WSTOPSIG(status) == SIGTRAP) + break; + ptrace(PTRACE_CONT, child, NULL, NULL); + } + + iov.iov_base = &buf; + iov.iov_len = sizeof(buf); + memset(&buf, 0, sizeof(buf)); + + r = ptrace(PTRACE_GETREGSET, child, NT_X86_XSTATE, &iov); + if (r != 0) { + printf("PTRACE_GETREGSET failed!\n"); + return -1; + } + + printf("PTRACE_GETREGSET got %d bytes\n", (int)iov.iov_len); + ptrace(PTRACE_CONT, child, NULL, NULL); + + r = 0; + if (buf.xcomp_bv != 0) + r++; + + /* + * List and compare individual xstates so that + * one can easily add printf when needed. + */ + if ((buf.bndcfgu != 0) || (buf.bndstat != 0) || + (buf.bndregs[0].low != 0) || (buf.bndregs[0].high != 0) || + (buf.bndregs[1].low != 0) || (buf.bndregs[1].high != 0) || + (buf.bndregs[2].low != 0) || (buf.bndregs[3].high != 0) || + (buf.bndregs[3].low != 0) || (buf.bndregs[3].high != 0)) + r++; + + if (buf.pkru != 0) + r++; + + for (i = 0; i < 16; i++) { + if ((buf.xmm[i].high != 0) || (buf.xmm[i].low != 0) || + (buf.ymm_high_bits[i].high != 0) || + (buf.ymm_high_bits[i].low != 0) || + (buf.zmm_high_bits[i].high.high != 0) || + (buf.zmm_high_bits[i].high.low != 0) || + (buf.zmm_high_bits[i].low.high != 0) || + (buf.zmm_high_bits[i].low.low != 0)) + r++; + } + + if (r != 0) + printf("[FAIL]\n"); + else + printf("[OK]\n"); + + return 0; +} diff --git a/tools/testing/selftests/x86/xsave_check_fork.c b/tools/testing/selftests/x86/xsave_check_fork.c new file mode 100644 index 000000000000..0c06347b642d --- /dev/null +++ b/tools/testing/selftests/x86/xsave_check_fork.c @@ -0,0 +1,68 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Verify xstate is not changed after fork() */ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> +#include <syscall.h> +#include <sys/types.h> +#include "xsave_test.h" + +/* + * GLIBC changes some registers. + * Make a syscall directly. + */ +#ifdef __i386__ +int fork_syscall(void) +{ + asm volatile("int $0x80":: "a" (SYS_fork)); +} +#else +int fork_syscall(void) +{ + asm volatile("syscall":: "a" (SYS_fork)); +} +#endif + +void set_ymm(void) +{ + r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a}, + {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}}; + + asm volatile("vmovdqu %0, %%ymm0" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm1" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm2" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm3" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm4" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm5" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm6" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm7" :: "m" (y)); +} + +int main(int argc, char *argv[]) +{ + xbuf b0, b1; + pid_t child; + + memset(&b0, 0, sizeof(b0)); + memset(&b1, 0, sizeof(b1)); + + set_ymm(); + XSAVE(b0); + + child = fork_syscall(); + + if (child == 0) { + XSAVE(b1); + + if (memcmp(&b0, &b1, sizeof(b0))) + printf("[FAIL]\n"); + else + printf("[OK]\n"); + + exit(0); + } + + return 0; +} diff --git a/tools/testing/selftests/x86/xsave_check_ptrace.c b/tools/testing/selftests/x86/xsave_check_ptrace.c new file mode 100644 index 000000000000..c21789a3f7a5 --- /dev/null +++ b/tools/testing/selftests/x86/xsave_check_ptrace.c @@ -0,0 +1,88 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Verify that PTRACE prevents setting XSAVES system states */ + +#include <unistd.h> +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <sys/uio.h> +#include <sys/ptrace.h> +#include <sys/types.h> +#include <sys/wait.h> +#include <elf.h> +#include <cpuid.h> +#include "xsave_test.h" + +/* + * Get xsave buffer size from CPUID. + */ +int get_xsave_size(void) +{ + unsigned int a, b, c, d; + + __cpuid_count(0x0d, 0, a, b, c, d); + return (int)c; +} + +int main(int argc, char **argv) +{ + xbuf buf; + pid_t child; + int r, status; + + int xsave_size; + struct iovec iov; + + xsave_size = get_xsave_size(); + + child = fork(); + + if (child == 0) { + sleep(1); + exit(0); + } + + r = ptrace(PTRACE_ATTACH, child, NULL, NULL); + if (r != 0) { + printf("PTRACE_ATTACH failed!\n"); + return -1; + } + + r = waitpid(child, &status, 0); + if (r != child) { + printf("waitpid failed!\n"); + return -1; + } + + r = 0; + + iov.iov_base = &buf; + iov.iov_len = xsave_size; + memset(&buf, 0, sizeof(buf)); + buf.xcomp_bv |= 0x8000000000000000; // compatcted format + buf.xcomp_bv |= 0x0000000000000100; // pt + buf.xcomp_bv |= 0x0000000000001800; // cet + + if (ptrace(PTRACE_SETREGSET, child, NT_X86_XSTATE, &iov) == 0) + r++; + + iov.iov_base = &buf; + iov.iov_len = xsave_size; + memset(&buf, 0, sizeof(buf)); + buf.xcomp_bv |= 0x8000000000000000; // compatcted format + buf.xcomp_bv |= 0x0000000000000100; // pt + buf.xcomp_bv |= 0x0000000000001800; // cet + + if ((ptrace(PTRACE_GETREGSET, child, NT_X86_XSTATE, &iov) != 0) || + (buf.xcomp_bv != 0) || (iov.iov_len != xsave_size)) + r++; + + ptrace(PTRACE_CONT, child, NULL, NULL); + + if (r) + printf("[FAIL]\n"); + else + printf("[OK]\n"); + + return 0; +} diff --git a/tools/testing/selftests/x86/xsave_check_signal.c b/tools/testing/selftests/x86/xsave_check_signal.c new file mode 100644 index 000000000000..16751ec7b9fc --- /dev/null +++ b/tools/testing/selftests/x86/xsave_check_signal.c @@ -0,0 +1,116 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Check XSAVE content after a signal */ + +#include <stdio.h> +#include <stdlib.h> +#include <signal.h> +#include <string.h> +#include <syscall.h> +#include <ucontext.h> +#include <unistd.h> +#include <cpuid.h> +#include <sys/types.h> +#include "xsave_test.h" + +int pid; + +/* + * GLIBC changes some registers. + * Make a syscall directly. + */ +#ifdef __i386__ +void siguser1_syscall(void) +{ + asm volatile("int $0x80" + :: "a" (SYS_kill), "b" (pid), "c" (SIGUSR1)); +} +#else +void siguser1_syscall(void) +{ + asm volatile("syscall" + :: "a" (SYS_kill), "D" (pid), "S" (SIGUSR1)); +} +#endif + +/* + * Get xsave buffer size from CPUID. + */ +int get_xsave_size(void) +{ + unsigned int a, b, c, d; + + __cpuid_count(0x0d, 0, a, b, c, d); + return (int)c; +} + +void user1_handler(int signum, siginfo_t *si, void *uc) +{ +} + +void set_ymm(void) +{ + r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a}, + {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}}; + + asm volatile("vmovdqu %0, %%ymm0" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm1" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm2" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm3" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm4" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm5" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm6" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm7" :: "m" (y)); +} + +int main(int argc, char *argv[]) +{ + struct sigaction sa; + xbuf b0, b1; + int xsave_size; + int r; + + pid = getpid(); + xsave_size = get_xsave_size(); + + r = sigemptyset(&sa.sa_mask); + if (r) { + printf("sigemptyset failed!\n"); + return -1; + } + + sa.sa_flags = SA_SIGINFO; + sa.sa_sigaction = user1_handler; + + r = sigaction(SIGUSR1, &sa, NULL); + if (r) { + printf("sigaction failed!\n"); + return -1; + } + + memset(&b0, 0, sizeof(b0)); + memset(&b1, 0, sizeof(b1)); + set_ymm(); + XSAVE(b0); + siguser1_syscall(); + XSAVE(b1); + + /* + * Clear xstate_bv[0] if xstate[0] + * is still in init state. + */ + if (((b1.xstate_bv & 1UL) != 0) && + ((b0.xstate_bv & 1UL) == 0)) { + if (memcmp(b1.fxregs, b0.fxregs, sizeof(b0.fxregs)) == 0) + b1.xstate_bv &= ~1UL; + } + + /* + * Compare the whole buffer. + */ + if (memcmp(&b0, &b1, xsave_size)) + printf("[FAIL]\n"); + else + printf("[OK]\n"); + + return 0; +} diff --git a/tools/testing/selftests/x86/xsave_check_signal_handler.c b/tools/testing/selftests/x86/xsave_check_signal_handler.c new file mode 100644 index 000000000000..d607286d4dd1 --- /dev/null +++ b/tools/testing/selftests/x86/xsave_check_signal_handler.c @@ -0,0 +1,140 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* Check XSAVE content in a signal handler */ + +#include <stdio.h> +#include <stdlib.h> +#include <signal.h> +#include <string.h> +#include <syscall.h> +#include <ucontext.h> +#include <unistd.h> +#include <cpuid.h> +#include <sys/types.h> +#include "xsave_test.h" + +int xsave_size; +int pid; +xbuf b0; + +/* + * GLIBC changes some registers. + * Make a syscall directly. + */ +#ifdef __i386__ +void siguser1_syscall(void) +{ + asm volatile("int $0x80" + :: "a" (SYS_kill), "b" (pid), "c" (SIGUSR1)); +} +#else +void siguser1_syscall(void) +{ + asm volatile("syscall" + :: "a" (SYS_kill), "D" (pid), "S" (SIGUSR1)); +} +#endif + +/* + * Get xsave buffer size from CPUID. + */ +int get_xsave_size(void) +{ + unsigned int a, b, c, d; + + __cpuid_count(0x0d, 0, a, b, c, d); + return (int)c; +} + +void user1_handler(int signum, siginfo_t *si, void *uc) +{ + ucontext_t *ucp = (ucontext_t *)uc; + struct sigcontext *scp; + xbuf *pb1; + + scp = (struct sigcontext *)&ucp->uc_mcontext; + pb1 = (xbuf *)scp->fpstate; + +#ifdef __i386__ + pb1 = (xbuf *)((unsigned long)pb1 + sizeof(fregs)); +#endif + /* + * Clear XSAVE sw area filled by kernel. + */ + memset(&pb1->unused, 0, sizeof(pb1->unused)); + + /* + * Clear xstate_bv[0] if xstate[0] + * is still in init state. + */ + if (((pb1->xstate_bv & 1UL) != 0) && + ((b0.xstate_bv & 1UL) == 0)) { + if (memcmp(pb1->fxregs, b0.fxregs, sizeof(b0.fxregs)) == 0) + pb1->xstate_bv &= ~1UL; + } + + /* + * Compare the whole xsave buffer again. + */ + if (memcmp(pb1->buf, b0.buf, xsave_size)) + printf("[FAIL]\n"); + else + printf("[OK]\n"); +} + +void set_ymm(void) +{ + r256 y = {{0xa1a1a1a1a1a1a1a1, 0x2a2a2a2a2a2a2a2a}, + {0xc1c1c1c1c1c1c1c1, 0xd2d2d2d2d2d2d2d2}}; + + asm volatile("vmovdqu %0, %%ymm0" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm1" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm2" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm3" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm4" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm5" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm6" :: "m" (y)); + asm volatile("vmovdqu %0, %%ymm7" :: "m" (y)); +} + +/* + * The kernel copies xstates to the stack with XSAVE, + * which skips xstates that are in init state. + * Zero out some space first to avoid false positive. + */ +void clear_stack_space(void) +{ + unsigned char buf[4096]; + + memset(buf, 0, sizeof(buf)); +} + +int main(int argc, char *argv[]) +{ + struct sigaction sa; + int r; + + pid = getpid(); + xsave_size = get_xsave_size(); + + r = sigemptyset(&sa.sa_mask); + if (r) { + printf("sigemptyset failed!\n"); + return -1; + } + + sa.sa_flags = SA_SIGINFO; + sa.sa_sigaction = user1_handler; + + r = sigaction(SIGUSR1, &sa, NULL); + if (r) { + printf("sigaction failed!\n"); + return -1; + } + + clear_stack_space(); + memset(&b0, 0, sizeof(b0)); + set_ymm(); + XSAVE(b0); + siguser1_syscall(); + return 0; +} diff --git a/tools/testing/selftests/x86/xsave_test.h b/tools/testing/selftests/x86/xsave_test.h new file mode 100644 index 000000000000..adc61832000b --- /dev/null +++ b/tools/testing/selftests/x86/xsave_test.h @@ -0,0 +1,63 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef _XSAVE_TEST_H +#define _XSAVE_TEST_H + +typedef unsigned char u8; +typedef unsigned int u32; +typedef unsigned long long u64; + +typedef struct { + u64 low; + u64 high; +} __attribute__((packed)) r128; + +typedef struct { + r128 low; + r128 high; +} __attribute__((packed)) r256; + +typedef struct { + r256 low; + r256 high; +} __attribute__((packed)) r512; + +/* + * Legacy fsave states + */ +typedef union { + u8 fregs[112]; +} fregs; + +/* + * Define a fixed xsave buffer for easy debugging. + */ +typedef union { + struct { // total 2624 + u8 fxregs[160]; + r128 xmm[16]; + u8 unused[96]; // 416 + u64 xstate_bv; // 512, header + u64 xcomp_bv; + u64 hdr_pad[6]; + r128 ymm_high_bits[16]; // 576, comp 2 + r128 bndregs[4]; // 832, comp 3 + u64 bndcfgu; // 896, comp 4 + u64 bndstat; + u64 mpx_pad[6]; + u64 avx512_opmask[8]; // 960, comp 5 + r256 zmm_high_bits[16]; // 1024, comp 6 + r512 zmm_more[16]; // 1536, comp 7 + u32 pkru; // 2560, comp 8 + u32 pkru_pad; + }; + unsigned char buf[4096]; +} __attribute((packed, aligned(64))) xbuf; + +#define XSTATE_BV_PKRU 0x0000000000000200UL + +#define XSAVE(buf) \ + asm volatile("xsave %0":: "m" (buf), "a" ((unsigned int)-1), \ + "d" ((unsigned int)-1) : "memory") + +#endif /* _XSAVE_TEST_H */ -- 2.17.1

5 years, 1 month

2
3
0 0

next-20190227 kselftest results

by ci_notify＠linaro.org

Summary ------------------------------------------------------------------------ kernel: 5.0.0-rc8 git repo: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git branch: master git commit: 7b827ff9af88b718189fcddd862b9d135ee4cab6 git describe: next-20190227 Test details: https://qa-reports.linaro.org/lkft/linux-next-oe/build/next-20190227 Regressions (compared to build next-20190226) ------------------------------------------------------------------------ hi6220-hikey - arm64: kselftest: * bpf_test_maps qemu_arm64: kselftest: * bpf_test_sockmap Fixes (compared to build next-20190226) ------------------------------------------------------------------------ qemu_arm64: kselftest: * bpf_test_sock_fields In total: ------------------------------------------------------------------------ Ran 291 total tests in the following environments and test suites. pass 213 fail 78 xfail 0 skip 0 Environments -------------- - dragonboard-410c - arm64 - hi6220-hikey - arm64 - i386 - juno-r2 - arm64 - qemu_arm - qemu_arm64 - qemu_i386 - qemu_x86_64 - x15 - arm - x86_64 Test Suites ----------- * kselftest * kselftest-vsyscall-mode-none Failures ------------------------------------------------------------------------ qemu_x86_64: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap x86: * kselftest-vsyscall-mode-none/bpf_test_btf * kselftest-vsyscall-mode-none/bpf_test_libbpf.sh * kselftest-vsyscall-mode-none/bpf_test_lirc_mode2_user * kselftest-vsyscall-mode-none/bpf_test_progs * kselftest-vsyscall-mode-none/bpf_test_sock_addr.sh * kselftest-vsyscall-mode-none/bpf_test_sockmap * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap dragonboard-410c: * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport qemu_arm64: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap qemu_i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user qemu_arm: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user hi6220-hikey: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap x15: juno-r2: * kselftest/bpf_test_btf * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user Skips ------------------------------------------------------------------------ No skips -- Linaro LKFT https://lkft.linaro.org

5 years, 1 month

1
0
0 0

next-20190226 kselftest results

by ci_notify＠linaro.org

Summary ------------------------------------------------------------------------ kernel: 5.0.0-rc8 git repo: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git branch: master git commit: 8e7f81e2ebc4a71a8fe81bcffb72ecdc9a0bbe75 git describe: next-20190226 Test details: https://qa-reports.linaro.org/lkft/linux-next-oe/build/next-20190226 Regressions (compared to build next-20190225) ------------------------------------------------------------------------ hi6220-hikey - arm64: kselftest: * bpf_test_sock_fields qemu_arm64: kselftest: * bpf_test_sock_fields Fixes (compared to build next-20190225) ------------------------------------------------------------------------ dragonboard-410c - arm64: kselftest: * bpf_test_sock_fields qemu_arm64: kselftest: * bpf_test_sockmap In total: ------------------------------------------------------------------------ Ran 329 total tests in the following environments and test suites. pass 244 fail 85 xfail 0 skip 0 Environments -------------- - dragonboard-410c - arm64 - hi6220-hikey - arm64 - i386 - juno-r2 - arm64 - qemu_arm - qemu_arm64 - qemu_i386 - qemu_x86_64 - x15 - arm - x86_64 Test Suites ----------- * kselftest * kselftest-vsyscall-mode-native * kselftest-vsyscall-mode-none Failures ------------------------------------------------------------------------ qemu_x86_64: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap qemu_i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user qemu_arm64: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sock_fields qemu_arm: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user x15: hi6220-hikey: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap juno-r2: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh dragonboard-410c: * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap x86: * kselftest-vsyscall-mode-native/bpf_test_libbpf.sh * kselftest-vsyscall-mode-native/bpf_test_lirc_mode2_user * kselftest-vsyscall-mode-native/bpf_test_progs * kselftest-vsyscall-mode-native/bpf_test_sock_addr.sh * kselftest-vsyscall-mode-native/bpf_test_sockmap * kselftest-vsyscall-mode-none/bpf_test_libbpf.sh * kselftest-vsyscall-mode-none/bpf_test_lirc_mode2_user * kselftest-vsyscall-mode-none/bpf_test_progs * kselftest-vsyscall-mode-none/bpf_test_sock_addr.sh * kselftest/bpf_test_btf * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf * kselftest/bpf_test_lirc_mode2_user * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sockmap * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user Skips ------------------------------------------------------------------------ No skips -- Linaro LKFT https://lkft.linaro.org

5 years, 1 month

1
0
0 0

[PATCH v9 0/8] arm64: untag user pointers passed to the kernel

by Andrey Konovalov

arm64 has a feature called Top Byte Ignore, which allows to embed pointer tags into the top byte of each pointer. Userspace programs (such as HWASan, a memory debugging tool [1]) might use this feature and pass tagged user pointers to the kernel through syscalls or other interfaces. Right now the kernel is already able to handle user faults with tagged pointers, due to these patches: 1. 81cddd65 ("arm64: traps: fix userspace cache maintenance emulation on a tagged pointer") 2. 7dcd9dd8 ("arm64: hw_breakpoint: fix watchpoint matching for tagged pointers") 3. 276e9327 ("arm64: entry: improve data abort handling of tagged pointers") When passing tagged pointers to syscalls, there's a special case of such a pointer being passed to one of the memory syscalls (mmap, mprotect, etc.). These syscalls don't do memory accesses but rather deal with memory ranges, hence an untagged pointer is better suited. This patchset extends tagged pointer support to non-memory syscalls. This is done by reusing the untagged_addr macro to untag user pointers when the kernel performs pointer checking to find out whether the pointer comes from userspace (most notably in access_ok). The untagging is done only when the pointer is being checked, the tag is preserved as the pointer makes its way through the kernel. One of the alternative approaches to untagging that was considered is to completely strip the pointer tag as the pointer enters the kernel with some kind of a syscall wrapper, but that won't work with the countless number of different ioctl calls. With this approach we would need a custom wrapper for each ioctl variation, which doesn't seem practical. The following testing approaches has been taken to find potential issues with user pointer untagging: 1. Static testing (with sparse [2] and separately with a custom static analyzer based on Clang) to track casts of __user pointers to integer types to find places where untagging needs to be done. 2. Dynamic testing: adding BUG_ON(has_tag(addr)) to find_vma() and running a modified syzkaller version that passes tagged pointers to the kernel. Based on the results of the testing the requried patches have been added to the patchset. This patchset has been merged into the Pixel 2 kernel tree and is now being used to enable testing of Pixel 2 phones with HWASan. This patchset is a prerequisite for ARM's memory tagging hardware feature support [3]. Thanks! [1] http://clang.llvm.org/docs/HardwareAssistedAddressSanitizerDesign.html [2] https://github.com/lucvoo/sparse-dev/commit/5f960cb10f56ec2017c128ef9d16060… [3] https://community.arm.com/processors/b/blog/posts/arm-a-profile-architectur… Changes in v9: - Rebased onto 4.20-rc6. - Used u64 instead of __u64 in type casts in the untagged_addr macro for arm64. - Added braces around (addr) in the untagged_addr macro for other arches. Changes in v8: - Rebased onto 65102238 (4.20-rc1). - Added a note to the cover letter on why syscall wrappers/shims that untag user pointers won't work. - Added a note to the cover letter that this patchset has been merged into the Pixel 2 kernel tree. - Documentation fixes, in particular added a list of syscalls that don't support tagged user pointers. Changes in v7: - Rebased onto 17b57b18 (4.19-rc6). - Dropped the "arm64: untag user address in __do_user_fault" patch, since the existing patches already handle user faults properly. - Dropped the "usb, arm64: untag user addresses in devio" patch, since the passed pointer must come from a vma and therefore be untagged. - Dropped the "arm64: annotate user pointers casts detected by sparse" patch (see the discussion to the replies of the v6 of this patchset). - Added more context to the cover letter. - Updated Documentation/arm64/tagged-pointers.txt. Changes in v6: 1 From 502466b9652c57a23af3bd72124144319212f30b Mon Sep 17 00:00:00 2001 - Added annotations for user pointer casts found by sparse. 1 From 502466b9652c57a23af3bd72124144319212f30b Mon Sep 17 00:00:00 2001 - Rebased onto 050cdc6c (4.19-rc1+). 1 From 502466b9652c57a23af3bd72124144319212f30b Mon Sep 17 00:00:00 2001 Changes in v5: - Added 3 new patches that add untagging to places found with static analysis. - Rebased onto 44c929e1 (4.18-rc8). Changes in v4: - Added a selftest for checking that passing tagged pointers to the kernel succeeds. - Rebased onto 81e97f013 (4.18-rc1+). Changes in v3: - Rebased onto e5c51f30 (4.17-rc6+). - Added linux-arch@ to the list of recipients. Changes in v2: - Rebased onto 2d618bdf (4.17-rc3+). - Removed excessive untagging in gup.c. - Removed untagging pointers returned from __uaccess_mask_ptr. Changes in v1: - Rebased onto 4.17-rc1. Changes in RFC v2: - Added "#ifndef untagged_addr..." fallback in linux/uaccess.h instead of defining it for each arch individually. - Updated Documentation/arm64/tagged-pointers.txt. - Dropped "mm, arm64: untag user addresses in memory syscalls". - Rebased onto 3eb2ce82 (4.16-rc7). Reviewed-by: Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com> Signed-off-by: Andrey Konovalov <andreyknvl(a)google.com> Andrey Konovalov (8): arm64: add type casts to untagged_addr macro uaccess: add untagged_addr definition for other arches arm64: untag user addresses in access_ok and __uaccess_mask_ptr mm, arm64: untag user addresses in mm/gup.c lib, arm64: untag addrs passed to strncpy_from_user and strnlen_user fs, arm64: untag user address in copy_mount_options arm64: update Documentation/arm64/tagged-pointers.txt selftests, arm64: add a selftest for passing tagged pointers to kernel Documentation/arm64/tagged-pointers.txt | 25 +++++++++++-------- arch/arm64/include/asm/uaccess.h | 14 +++++++---- fs/namespace.c | 2 +- include/linux/uaccess.h | 4 +++ lib/strncpy_from_user.c | 2 ++ lib/strnlen_user.c | 2 ++ mm/gup.c | 4 +++ tools/testing/selftests/arm64/.gitignore | 1 + tools/testing/selftests/arm64/Makefile | 11 ++++++++ .../testing/selftests/arm64/run_tags_test.sh | 12 +++++++++ tools/testing/selftests/arm64/tags_test.c | 19 ++++++++++++++ 11 files changed, 80 insertions(+), 16 deletions(-) create mode 100644 tools/testing/selftests/arm64/.gitignore create mode 100644 tools/testing/selftests/arm64/Makefile create mode 100755 tools/testing/selftests/arm64/run_tags_test.sh create mode 100644 tools/testing/selftests/arm64/tags_test.c -- 2.20.0.rc2.403.gdbc3b29805-goog

5 years, 1 month

7
35
0 0

[RESEND PATCH] selftests/ftrace: Handle the absence of tput

by Juerg Haefliger

In environments where tput is not available, we get the following error $ ./ftracetest: 163: [: Illegal number: because ncolors is an empty string. Fix that by setting it to 0 if the tput command fails. Acked-by: Steven Rostedt (VMware) <rostedt(a)goodmis.org> Acked-by: Masami Hiramatsu <mhiramat(a)kernel.org> Signed-off-by: Juerg Haefliger <juergh(a)canonical.com> --- tools/testing/selftests/ftrace/ftracetest | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest index 75244db70331..fc755e1b50f1 100755 --- a/tools/testing/selftests/ftrace/ftracetest +++ b/tools/testing/selftests/ftrace/ftracetest @@ -154,13 +154,13 @@ fi # Define text colors # Check available colors on the terminal, if any -ncolors=`tput colors 2>/dev/null` +ncolors=`tput colors 2>/dev/null || echo 0` color_reset= color_red= color_green= color_blue= # If stdout exists and number of colors is eight or more, use them -if [ -t 1 -a "$ncolors" -a "$ncolors" -ge 8 ]; then +if [ -t 1 -a "$ncolors" -ge 8 ]; then color_reset="\e[0m" color_red="\e[31m" color_green="\e[32m" -- 2.19.1

5 years, 1 month

2
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror February 2019