October 2022 - Linux-kselftest-mirror

[PATCH v15 0/3]] Add TDX Guest Attestation support

by Kuppuswamy Sathyanarayanan

Hi All, Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious hosts and some physical attacks. VM guest with TDX support is called as a TDX Guest. In TDX guest, attestation process is used to verify the TDX guest trustworthiness to other entities before provisioning secrets to the guest. For example, a key server may request for attestation before releasing the encryption keys to mount the encrypted rootfs or secondary drive. This patch set adds attestation support for the TDX guest. Details about the TDX attestation process and the steps involved are explained in Documentation/x86/tdx.rst (added by patch 2/3). Following are the details of the patch set: Patch 1/3 -> Preparatory patch for adding attestation support. Patch 2/3 -> Adds user interface driver to support attestation. Patch 3/3 -> Adds selftest support for TDREPORT feature. Commit log history is maintained in the individual patches. Kuppuswamy Sathyanarayanan (3): x86/tdx: Add a wrapper to get TDREPORT from the TDX Module virt: Add TDX guest driver selftests: tdx: Test TDX attestation GetReport support Documentation/virt/coco/tdx-guest.rst | 42 +++++ Documentation/virt/index.rst | 1 + Documentation/x86/tdx.rst | 43 +++++ arch/x86/coco/tdx/tdx.c | 31 ++++ arch/x86/include/asm/tdx.h | 2 + drivers/virt/Kconfig | 2 + drivers/virt/Makefile | 1 + drivers/virt/coco/tdx-guest/Kconfig | 10 ++ drivers/virt/coco/tdx-guest/Makefile | 2 + drivers/virt/coco/tdx-guest/tdx-guest.c | 131 ++++++++++++++ include/uapi/linux/tdx-guest.h | 51 ++++++ tools/testing/selftests/Makefile | 1 + tools/testing/selftests/tdx/Makefile | 7 + tools/testing/selftests/tdx/config | 1 + tools/testing/selftests/tdx/tdx_guest_test.c | 175 +++++++++++++++++++ 15 files changed, 500 insertions(+) create mode 100644 Documentation/virt/coco/tdx-guest.rst create mode 100644 drivers/virt/coco/tdx-guest/Kconfig create mode 100644 drivers/virt/coco/tdx-guest/Makefile create mode 100644 drivers/virt/coco/tdx-guest/tdx-guest.c create mode 100644 include/uapi/linux/tdx-guest.h create mode 100644 tools/testing/selftests/tdx/Makefile create mode 100644 tools/testing/selftests/tdx/config create mode 100644 tools/testing/selftests/tdx/tdx_guest_test.c -- 2.34.1

1 year, 7 months

5
17
0 0

[GIT PULL] KUnit fixes update for Linux 6.1-rc3

by Shuah Khan

Hi Linus, Please pull the following KUnit fixes update for Linux 6.1-rc3. This KUnit fixes update for Linux 6.1-rc3 consists of one single fix to update alloc_string_stream() callers to check for IS_ERR() instead of NULL to be in sync with alloc_string_stream() returning IS_ERR(). diff for this pull request is attached. thanks, -- Shuah ---------------------------------------------------------------- The following changes since commit 9abf2313adc1ca1b6180c508c25f22f9395cc780: Linux 6.1-rc1 (2022-10-16 15:36:24 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest tags/linux-kselftest-kunit-fixes-6.1-rc3 for you to fetch changes up to 618887768bb71f0a475334fa5a4fba7dc98d7ab5: kunit: update NULL vs IS_ERR() tests (2022-10-18 15:08:42 -0600) ---------------------------------------------------------------- linux-kselftest-kunit-fixes-6.1-rc3 This KUnit fixes update for Linux 6.1-rc3 consists of one single fix to update alloc_string_stream() callers to check for IS_ERR() instead of NULL to be in sync with alloc_string_stream() returning IS_ERR(). ---------------------------------------------------------------- Dan Carpenter (1): kunit: update NULL vs IS_ERR() tests lib/kunit/string-stream.c | 4 ++-- lib/kunit/test.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) ----------------------------------------------------------------

1 year, 7 months

2
1
0 0

[GIT PULL] Kselftest fixes update for Linux 6.1-rc3

by Shuah Khan

Hi Linus, Please pull the following Kselftest fixes update for Linux 6.1-rc3. This Kselftest fixes update for Linux 6.1-rc3 consists of: - futex, intel_pstate, kexec build fixes - ftrace dynamic_events dependency check fix - memory-hotplug fix to remove redundant warning from test report diff for this pull request is attached. thanks, -- Shuah ---------------------------------------------------------------- The following changes since commit 9abf2313adc1ca1b6180c508c25f22f9395cc780: Linux 6.1-rc1 (2022-10-16 15:36:24 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest tags/linux-kselftest-fixes-6.1-rc3 for you to fetch changes up to cb05c81ada76a30a25a5f79b249375e33473af33: selftests/ftrace: fix dynamic_events dependency check (2022-10-18 14:27:23 -0600) ---------------------------------------------------------------- linux-kselftest-fixes-6.1-rc3 This Kselftest fixes update for Linux 6.1-rc3 consists of: - futex, intel_pstate, kexec build fixes - ftrace dynamic_events dependency check fix - memory-hotplug fix to remove redundant warning from test report ---------------------------------------------------------------- Ricardo Cañuelo (3): selftests/futex: fix build for clang selftests/intel_pstate: fix build for ARCH=x86_64 selftests/kexec: fix build for ARCH=x86_64 Sven Schnelle (1): selftests/ftrace: fix dynamic_events dependency check Zhao Gongyi (1): selftests/memory-hotplug: Remove the redundant warning information tools/testing/selftests/ftrace/test.d/dynevent/test_duplicates.tc | 2 +- .../ftrace/test.d/trigger/inter-event/trigger-synthetic-eprobe.tc | 2 +- tools/testing/selftests/futex/functional/Makefile | 6 ++---- tools/testing/selftests/intel_pstate/Makefile | 6 +++--- tools/testing/selftests/kexec/Makefile | 6 +++--- tools/testing/selftests/memory-hotplug/mem-on-off-test.sh | 1 - 6 files changed, 10 insertions(+), 13 deletions(-) ----------------------------------------------------------------

1 year, 7 months

2
1
0 0

[PATCH v8 net-next 00/12] Extend locked port feature with FDB locked flag (MAC-Auth/MAB)

by Hans J. Schultz

This patch set extends the locked port feature for devices that are behind a locked port, but do not have the ability to authorize themselves as a supplicant using IEEE 802.1X. Such devices can be printers, meters or anything related to fixed installations. Instead of 802.1X authorization, devices can get access based on their MAC addresses being whitelisted. For an authorization daemon to detect that a device is trying to get access through a locked port, the bridge will add the MAC address of the device to the FDB with a locked flag to it. Thus the authorization daemon can catch the FDB add event and check if the MAC address is in the whitelist and if so replace the FDB entry without the locked flag enabled, and thus open the port for the device. This feature is known as MAC-Auth or MAC Authentication Bypass (MAB) in Cisco terminology, where the full MAB concept involves additional Cisco infrastructure for authorization. There is no real authentication process, as the MAC address of the device is the only input the authorization daemon, in the general case, has to base the decision if to unlock the port or not. With this patch set, an implementation of the offloaded case is supplied for the mv88e6xxx driver. When a packet ingresses on a locked port, an ATU miss violation event will occur. When handling such ATU miss violation interrupts, the MAC address of the device is added to the FDB with a zero destination port vector (DPV) and the MAC address is communicated through the switchdev layer to the bridge, so that a FDB entry with the locked flag enabled can be added. Log: v3: Added timers and lists in the driver (mv88e6xxx) to keep track of and remove locked entries. v4: Leave out enforcing a limit to the number of locked entries in the bridge. Removed the timers in the driver and use the worker only. Add locked FDB flag to all drivers using port_fdb_add() from the dsa api and let all drivers ignore entries with this flag set. Change how to get the ageing timeout of locked entries. See global1_atu.c and switchdev.c. Use struct mv88e6xxx_port for locked entries variables instead of struct dsa_port. v5: Added 'mab' flag to enable MAB/MacAuth feature, in a similar way to the locked feature flag. In these implementations for the mv88e6xxx, the switchport must be configured with learning on. To tell userspace about the behavior of the locked entries in the driver, a 'blackhole' FDB flag has been added, which locked FDB entries coming from the driver gets. Also the 'sticky' flag comes with those locked entries, as the drivers locked entries cannot roam. Fixed issues with taking mutex locks, and added a function to read the fid, that supports all versions of the chipset family. v6: Added blackhole FDB flag instead of using sticky flag, as the blackhole flag corresponds to the behaviour of the zero-DPV locked entries in the driver. Userspace can add blackhole FDB entries with: # bridge fdb add MAC dev br0 blackhole Added FDB flags towards driver in DSA layer as u16. v7: Remove locked port and mab flags from DSA flags inherit list as it messes with the learning setting and those flags are not naturally meant for enheriting, but should be set explicitly. Fix blackhole implementation, selftests a.o small fixes. v8: Improvements to error messages with user space added blackhole entries and improvements to the selftests. Hans J. Schultz (12): net: bridge: add locked entry fdb flag to extend locked port feature net: bridge: add blackhole fdb entry flag net: bridge: enable bridge to install locked fdb entries from drivers net: bridge: add MAB flag to hardware offloadable flags net: dsa: propagate the locked flag down through the DSA layer net: bridge: enable bridge to send and receive blackhole FDB entries net: dsa: send the blackhole flag down through the DSA layer drivers: net: dsa: add fdb entry flags incoming to switchcore drivers net: dsa: mv88e6xxx: allow reading FID when handling ATU violations net: dsa: mv88e6xxx: mac-auth/MAB implementation net: dsa: mv88e6xxx: add blackhole ATU entries selftests: forwarding: add MAB tests to locked port tests drivers/net/dsa/b53/b53_common.c | 12 +- drivers/net/dsa/b53/b53_priv.h | 4 +- drivers/net/dsa/hirschmann/hellcreek.c | 12 +- drivers/net/dsa/lan9303-core.c | 12 +- drivers/net/dsa/lantiq_gswip.c | 12 +- drivers/net/dsa/microchip/ksz9477.c | 8 +- drivers/net/dsa/microchip/ksz9477.h | 8 +- drivers/net/dsa/microchip/ksz_common.c | 14 +- drivers/net/dsa/mt7530.c | 12 +- drivers/net/dsa/mv88e6xxx/Makefile | 1 + drivers/net/dsa/mv88e6xxx/chip.c | 142 ++++++++- drivers/net/dsa/mv88e6xxx/chip.h | 19 ++ drivers/net/dsa/mv88e6xxx/global1.h | 1 + drivers/net/dsa/mv88e6xxx/global1_atu.c | 72 ++++- drivers/net/dsa/mv88e6xxx/port.c | 15 +- drivers/net/dsa/mv88e6xxx/port.h | 6 + drivers/net/dsa/mv88e6xxx/switchdev.c | 284 ++++++++++++++++++ drivers/net/dsa/mv88e6xxx/switchdev.h | 37 +++ drivers/net/dsa/ocelot/felix.c | 12 +- drivers/net/dsa/qca/qca8k-common.c | 12 +- drivers/net/dsa/qca/qca8k.h | 4 +- drivers/net/dsa/rzn1_a5psw.c | 12 +- drivers/net/dsa/sja1105/sja1105_main.c | 18 +- include/linux/if_bridge.h | 1 + include/net/dsa.h | 7 +- include/net/switchdev.h | 2 + include/uapi/linux/if_link.h | 1 + include/uapi/linux/neighbour.h | 11 +- net/bridge/br.c | 5 +- net/bridge/br_fdb.c | 88 +++++- net/bridge/br_input.c | 20 +- net/bridge/br_netlink.c | 12 +- net/bridge/br_private.h | 5 +- net/bridge/br_switchdev.c | 4 +- net/core/rtnetlink.c | 5 + net/dsa/dsa_priv.h | 10 +- net/dsa/port.c | 32 +- net/dsa/slave.c | 16 +- net/dsa/switch.c | 24 +- .../selftests/drivers/net/dsa/Makefile | 1 + .../testing/selftests/net/forwarding/Makefile | 1 + .../net/forwarding/bridge_blackhole_fdb.sh | 131 ++++++++ .../net/forwarding/bridge_locked_port.sh | 99 +++++- tools/testing/selftests/net/forwarding/lib.sh | 17 ++ 44 files changed, 1100 insertions(+), 121 deletions(-) create mode 100644 drivers/net/dsa/mv88e6xxx/switchdev.c create mode 100644 drivers/net/dsa/mv88e6xxx/switchdev.h create mode 100755 tools/testing/selftests/net/forwarding/bridge_blackhole_fdb.sh -- 2.34.1

1 year, 7 months

6
68
0 0

[PATCH 5.15 399/530] selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle

by Greg Kroah-Hartman

From: Stefan Berger <stefanb(a)linux.ibm.com> [ Upstream commit 2d869f0b458547386fbcd8cf3004b271b7347b7f ] The following output can bee seen when the test is executed: test_flush_context (tpm2_tests.SpaceTest) ... \ /usr/lib64/python3.6/unittest/case.py:605: ResourceWarning: \ unclosed file <_io.FileIO name='/dev/tpmrm0' mode='rb+' closefd=True> An instance of Client does not implicitly close /dev/tpm* handle, once it gets destroyed. Close the file handle in the class destructor Client.__del__(). Fixes: 6ea3dfe1e0732 ("selftests: add TPM 2.0 tests") Cc: Shuah Khan <shuah(a)kernel.org> Cc: linux-kselftest(a)vger.kernel.org Cc: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/tpm2/tpm2.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py index f34486cd7342..3e67fdb518ec 100644 --- a/tools/testing/selftests/tpm2/tpm2.py +++ b/tools/testing/selftests/tpm2/tpm2.py @@ -370,6 +370,10 @@ class Client: fcntl.fcntl(self.tpm, fcntl.F_SETFL, flags) self.tpm_poll = select.poll() + def __del__(self): + if self.tpm: + self.tpm.close() + def close(self): self.tpm.close() -- 2.35.1

1 year, 7 months

1
0
0 0

[PATCH 5.10 294/390] selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle

by Greg Kroah-Hartman

From: Stefan Berger <stefanb(a)linux.ibm.com> [ Upstream commit 2d869f0b458547386fbcd8cf3004b271b7347b7f ] The following output can bee seen when the test is executed: test_flush_context (tpm2_tests.SpaceTest) ... \ /usr/lib64/python3.6/unittest/case.py:605: ResourceWarning: \ unclosed file <_io.FileIO name='/dev/tpmrm0' mode='rb+' closefd=True> An instance of Client does not implicitly close /dev/tpm* handle, once it gets destroyed. Close the file handle in the class destructor Client.__del__(). Fixes: 6ea3dfe1e0732 ("selftests: add TPM 2.0 tests") Cc: Shuah Khan <shuah(a)kernel.org> Cc: linux-kselftest(a)vger.kernel.org Cc: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/tpm2/tpm2.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py index f34486cd7342..3e67fdb518ec 100644 --- a/tools/testing/selftests/tpm2/tpm2.py +++ b/tools/testing/selftests/tpm2/tpm2.py @@ -370,6 +370,10 @@ class Client: fcntl.fcntl(self.tpm, fcntl.F_SETFL, flags) self.tpm_poll = select.poll() + def __del__(self): + if self.tpm: + self.tpm.close() + def close(self): self.tpm.close() -- 2.35.1

1 year, 7 months

1
0
0 0

[PATCH 5.19 538/717] selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle

by Greg Kroah-Hartman

From: Stefan Berger <stefanb(a)linux.ibm.com> [ Upstream commit 2d869f0b458547386fbcd8cf3004b271b7347b7f ] The following output can bee seen when the test is executed: test_flush_context (tpm2_tests.SpaceTest) ... \ /usr/lib64/python3.6/unittest/case.py:605: ResourceWarning: \ unclosed file <_io.FileIO name='/dev/tpmrm0' mode='rb+' closefd=True> An instance of Client does not implicitly close /dev/tpm* handle, once it gets destroyed. Close the file handle in the class destructor Client.__del__(). Fixes: 6ea3dfe1e0732 ("selftests: add TPM 2.0 tests") Cc: Shuah Khan <shuah(a)kernel.org> Cc: linux-kselftest(a)vger.kernel.org Cc: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Stefan Berger <stefanb(a)linux.ibm.com> Reviewed-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/tpm2/tpm2.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/testing/selftests/tpm2/tpm2.py b/tools/testing/selftests/tpm2/tpm2.py index 057a4f49c79d..c7363c6764fc 100644 --- a/tools/testing/selftests/tpm2/tpm2.py +++ b/tools/testing/selftests/tpm2/tpm2.py @@ -371,6 +371,10 @@ class Client: fcntl.fcntl(self.tpm, fcntl.F_SETFL, flags) self.tpm_poll = select.poll() + def __del__(self): + if self.tpm: + self.tpm.close() + def close(self): self.tpm.close() -- 2.35.1

1 year, 7 months

1
0
0 0

[PATCH 0/4] Enhance watchdog API test coverage

by Shuah Khan

Enace watchdog test to improve watchdog API coverage of iocls and return values. Shuah Khan (4): selftests/watchdog: change to print reset reason info. selftests/watchdog: add support for WDIOC_GETSTATUS selftests/watchdog: print watchdog_info option strings selftests/watchdog: add test for WDIOC_GETTEMP .../selftests/watchdog/watchdog-test.c | 104 +++++++++++++++++- 1 file changed, 99 insertions(+), 5 deletions(-) -- 2.34.1

1 year, 7 months

1
4
0 0

[PATCH 1/2] kunit: Provide a static key to check if KUnit is actively running tests

by David Gow

KUnit does a few expensive things when enabled. This hasn't been a problem because KUnit was only enabled on test kernels, but with a few people enabling (but not _using_) KUnit on production systems, we need a runtime way of handling this. Provide a 'kunit_running' static key (defaulting to false), which allows us to hide any KUnit code behind a static branch. This should reduce the performance impact (on other code) of having KUnit enabled to a single NOP when no tests are running. Note that, while it looks unintuitive, tests always run entirely within __kunit_test_suites_init(), so it's safe to decrement the static key at the end of this function, rather than in __kunit_test_suites_exit(), which is only there to clean up results in debugfs. Signed-off-by: David Gow <davidgow(a)google.com> --- This should be a no-op (other than a possible performance improvement) functionality-wise, and lays the groundwork for a more optimised static stub implementation. --- include/kunit/test.h | 4 ++++ lib/kunit/test.c | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/include/kunit/test.h b/include/kunit/test.h index b1ab6b32216d..450a778a039e 100644 --- a/include/kunit/test.h +++ b/include/kunit/test.h @@ -16,6 +16,7 @@ #include <linux/container_of.h> #include <linux/err.h> #include <linux/init.h> +#include <linux/jump_label.h> #include <linux/kconfig.h> #include <linux/kref.h> #include <linux/list.h> @@ -27,6 +28,9 @@ #include <asm/rwonce.h> +/* Static key: true if any KUnit tests are currently running */ +extern struct static_key_false kunit_running; + struct kunit; /* Size of log associated with test. */ diff --git a/lib/kunit/test.c b/lib/kunit/test.c index 90640a43cf62..314717b63080 100644 --- a/lib/kunit/test.c +++ b/lib/kunit/test.c @@ -20,6 +20,8 @@ #include "string-stream.h" #include "try-catch-impl.h" +DEFINE_STATIC_KEY_FALSE(kunit_running); + #if IS_BUILTIN(CONFIG_KUNIT) /* * Fail the current test and print an error message to the log. @@ -612,10 +614,14 @@ int __kunit_test_suites_init(struct kunit_suite * const * const suites, int num_ return 0; } + static_branch_inc(&kunit_running); + for (i = 0; i < num_suites; i++) { kunit_init_suite(suites[i]); kunit_run_tests(suites[i]); } + + static_branch_dec(&kunit_running); return 0; } EXPORT_SYMBOL_GPL(__kunit_test_suites_init); -- 2.38.0.135.g90850a2211-goog

1 year, 7 months

2
2
0 0

[PATCH v1 0/7] mm/ksm: break_ksm() cleanups and fixes

by David Hildenbrand

This series cleans up and fixes break_ksm(). In summary, we no longer use fake write faults to break COW but instead FAULT_FLAG_UNSHARE. Further, we move away from using follow_page() [that we can hopefully remove completely at one point] and use new walk_page_range_vma() instead. Fortunately, we can get rid of VM_FAULT_WRITE and FOLL_MIGRATION in common code now. Add a selftest to measure MADV_UNMERGEABLE performance. In my setup (AMD Ryzen 9 3900X), running the KSM selftest to test unmerge performance on 2 GiB (taskset 0x8 ./ksm_tests -D -s 2048), this results in a performance degradation of ~8% -- 9% (old: ~5250 MiB/s, new: ~4800 MiB/s). I don't think we particularly care for now, but it's good to be aware of the implication. Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Shuah Khan <shuah(a)kernel.org> Cc: Hugh Dickins <hughd(a)google.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Peter Xu <peterx(a)redhat.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> Cc: Jason Gunthorpe <jgg(a)nvidia.com> Cc: John Hubbard <jhubbard(a)nvidia.com> David Hildenbrand (7): selftests/vm: add test to measure MADV_UNMERGEABLE performance mm/ksm: simplify break_ksm() to not rely on VM_FAULT_WRITE mm: remove VM_FAULT_WRITE mm/ksm: fix KSM COW breaking with userfaultfd-wp via FAULT_FLAG_UNSHARE mm/pagewalk: add walk_page_range_vma() mm/ksm: convert break_ksm() to use walk_page_range_vma() mm/gup: remove FOLL_MIGRATION include/linux/mm.h | 1 - include/linux/mm_types.h | 3 - include/linux/pagewalk.h | 3 + mm/gup.c | 55 ++----------- mm/huge_memory.c | 2 +- mm/ksm.c | 103 +++++++++++++++++++------ mm/memory.c | 9 +-- mm/pagewalk.c | 27 +++++++ tools/testing/selftests/vm/ksm_tests.c | 76 +++++++++++++++++- 9 files changed, 192 insertions(+), 87 deletions(-) -- 2.37.3

1 year, 7 months

3
23
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror October 2022