December 2022 - Linux-kselftest-mirror

[PATCH v1] lib/hashtable_test.c: add test for the hashtable structure

by Rae Moar

Add a KUnit test for the kernel hashtable implementation in include/linux/hashtable.h. Note that this version does not yet test each of the rcu alternative versions of functions. Signed-off-by: Rae Moar <rmoar(a)google.com> --- Note: The check patch script is outputting open brace errors on lines 154, 186, 231 of lib/hashtable_test.c but I believe the format of the braces on those lines is consistent with the Linux Kernel style guide. Will continue to look at these errors. lib/Kconfig.debug | 13 ++ lib/Makefile | 1 + lib/hashtable_test.c | 299 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 313 insertions(+) create mode 100644 lib/hashtable_test.c diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index 3fc7abffc7aa..3cf3b6f8cff4 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -2458,6 +2458,19 @@ config LIST_KUNIT_TEST If unsure, say N. +config HASHTABLE_KUNIT_TEST + tristate "KUnit Test for Kernel Hashtable structures" if !KUNIT_ALL_TESTS + depends on KUNIT + default KUNIT_ALL_TESTS + help + This builds the hashtable KUnit test suite. + It tests the API and basic functionality of the functions + and associated macros defined in include/linux/hashtable.h. + For more information on KUnit and unit tests in general please refer + to the KUnit documentation in Documentation/dev-tools/kunit/. + + If unsure, say N. + config LINEAR_RANGES_TEST tristate "KUnit test for linear_ranges" depends on KUNIT diff --git a/lib/Makefile b/lib/Makefile index 161d6a724ff7..9036d3aeee0a 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -370,6 +370,7 @@ obj-$(CONFIG_PLDMFW) += pldmfw/ CFLAGS_bitfield_kunit.o := $(DISABLE_STRUCTLEAK_PLUGIN) obj-$(CONFIG_BITFIELD_KUNIT) += bitfield_kunit.o obj-$(CONFIG_LIST_KUNIT_TEST) += list-test.o +obj-$(CONFIG_HASHTABLE_KUNIT_TEST) += hashtable_test.o obj-$(CONFIG_LINEAR_RANGES_TEST) += test_linear_ranges.o obj-$(CONFIG_BITS_TEST) += test_bits.o obj-$(CONFIG_CMDLINE_KUNIT_TEST) += cmdline_kunit.o diff --git a/lib/hashtable_test.c b/lib/hashtable_test.c new file mode 100644 index 000000000000..7907df66a8e7 --- /dev/null +++ b/lib/hashtable_test.c @@ -0,0 +1,299 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * KUnit test for the Kernel Hashtable structures. + * + * Copyright (C) 2022, Google LLC. + * Author: Rae Moar <rmoar(a)google.com> + */ +#include <kunit/test.h> + +#include <linux/hashtable.h> + +struct hashtable_test_entry { + int key; + int data; + struct hlist_node node; + int visited; +}; + +static void hashtable_test_hash_init(struct kunit *test) +{ + /* Test the different ways of initialising a hashtable. */ + DEFINE_HASHTABLE(hash1, 3); + DECLARE_HASHTABLE(hash2, 3); + + hash_init(hash1); + hash_init(hash2); + + KUNIT_EXPECT_TRUE(test, hash_empty(hash1)); + KUNIT_EXPECT_TRUE(test, hash_empty(hash2)); +} + +static void hashtable_test_hash_empty(struct kunit *test) +{ + struct hashtable_test_entry a; + DEFINE_HASHTABLE(hash, 3); + + hash_init(hash); + KUNIT_EXPECT_TRUE(test, hash_empty(hash)); + + a.key = 1; + a.data = 13; + hash_add(hash, &a.node, a.key); + + /* Hashtable should no longer be empty. */ + KUNIT_EXPECT_FALSE(test, hash_empty(hash)); +} + +static void hashtable_test_hash_hashed(struct kunit *test) +{ + struct hashtable_test_entry a, b; + DEFINE_HASHTABLE(hash, 3); + + hash_init(hash); + a.key = 1; + a.data = 13; + b.key = 1; + b.data = 2; + + hash_add(hash, &a.node, a.key); + hash_add(hash, &b.node, b.key); + + KUNIT_EXPECT_TRUE(test, hash_hashed(&a.node)); + KUNIT_EXPECT_TRUE(test, hash_hashed(&b.node)); +} + +static void hashtable_test_hash_add(struct kunit *test) +{ + struct hashtable_test_entry a, b, *x; + int bkt; + DEFINE_HASHTABLE(hash, 3); + + hash_init(hash); + a.key = 1; + a.data = 13; + a.visited = 0; + b.key = 2; + b.data = 10; + b.visited = 0; + + hash_add(hash, &a.node, a.key); + hash_add(hash, &b.node, b.key); + + hash_for_each(hash, bkt, x, node) { + if (x->key == a.key && x->data == a.data) + a.visited += 1; + if (x->key == b.key && x->data == b.data) + b.visited += 1; + } + + /* Both entries should have been visited exactly once. */ + KUNIT_EXPECT_EQ(test, a.visited, 1); + KUNIT_EXPECT_EQ(test, b.visited, 1); +} + +static void hashtable_test_hash_del(struct kunit *test) +{ + struct hashtable_test_entry a, b, *x; + DEFINE_HASHTABLE(hash, 3); + + hash_init(hash); + a.key = 1; + a.data = 13; + b.key = 2; + b.data = 10; + b.visited = 0; + + hash_add(hash, &a.node, a.key); + hash_add(hash, &b.node, b.key); + + hash_del(&b.node); + hash_for_each_possible(hash, x, node, b.key) { + if (x->key == b.key && x->data == b.data) + b.visited += 1; + } + + /* The deleted entry should not have been visited. */ + KUNIT_EXPECT_EQ(test, b.visited, 0); + + hash_del(&a.node); + + /* The hashtable should be empty. */ + KUNIT_EXPECT_TRUE(test, hash_empty(hash)); +} + +static void hashtable_test_hash_for_each(struct kunit *test) +{ + struct hashtable_test_entry entries[3]; + struct hashtable_test_entry *x; + int bkt, i, j, count; + DEFINE_HASHTABLE(hash, 3); + + /* Initialize a hashtable with three entries. */ + hash_init(hash); + for (i = 0; i < 3; i++) { + entries[i].key = i; + entries[i].data = i + 10; + entries[i].visited = 0; + hash_add(hash, &entries[i].node, entries[i].key); + } + + count = 0; + hash_for_each(hash, bkt, x, node) { + if (x->key >= 0 && x->key < 3) + entries[x->key].visited += 1; + count++; + } + + /* Should have visited each entry exactly once. */ + KUNIT_EXPECT_EQ(test, count, 3); + for (j = 0; j < 3; j++) + KUNIT_EXPECT_EQ(test, entries[j].visited, 1); +} + +static void hashtable_test_hash_for_each_safe(struct kunit *test) +{ + struct hashtable_test_entry entries[3]; + struct hashtable_test_entry *x; + struct hlist_node *tmp; + int bkt, i, j, count; + DEFINE_HASHTABLE(hash, 3); + + /* Initialize a hashtable with three entries. */ + hash_init(hash); + for (i = 0; i < 3; i++) { + entries[i].key = i; + entries[i].data = i + 10; + entries[i].visited = 0; + hash_add(hash, &entries[i].node, entries[i].key); + } + + count = 0; + hash_for_each_safe(hash, bkt, tmp, x, node) { + if (x->key >= 0 && x->key < 3) { + entries[x->key].visited += 1; + hash_del(&entries[x->key].node); + } + count++; + } + + /* Should have visited each entry exactly once. */ + KUNIT_EXPECT_EQ(test, count, 3); + for (j = 0; j < 3; j++) + KUNIT_EXPECT_EQ(test, entries[j].visited, 1); +} + +static void hashtable_test_hash_for_each_possible(struct kunit *test) +{ + struct hashtable_test_entry entries[4]; + struct hashtable_test_entry *x; + int i, j, count; + DEFINE_HASHTABLE(hash, 3); + + /* Initialize a hashtable with three entries with key = 1. */ + hash_init(hash); + for (i = 0; i < 3; i++) { + entries[i].key = 1; + entries[i].data = i; + entries[i].visited = 0; + hash_add(hash, &entries[i].node, entries[i].key); + } + + /* Add an entry with key = 2. */ + entries[3].key = 2; + entries[3].data = 3; + entries[3].visited = 0; + hash_add(hash, &entries[3].node, entries[3].key); + + count = 0; + hash_for_each_possible(hash, x, node, 1) { + if (x->data >= 0 && x->data < 4) + entries[x->data].visited += 1; + count++; + } + + /* Should have visited each entry with key = 1 exactly once. */ + for (j = 0; j < 3; j++) + KUNIT_EXPECT_EQ(test, entries[j].visited, 1); + + /* If entry with key = 2 is in the same bucket as the entries with + * key = 1, check it was visited. Otherwise ensure that only three + * entries were visited. + */ + if (hash_min(1, HASH_BITS(hash)) == hash_min(2, HASH_BITS(hash))) { + KUNIT_EXPECT_EQ(test, count, 4); + KUNIT_EXPECT_EQ(test, entries[3].visited, 1); + } else { + KUNIT_EXPECT_EQ(test, count, 3); + } +} + +static void hashtable_test_hash_for_each_possible_safe(struct kunit *test) +{ + struct hashtable_test_entry entries[4]; + struct hashtable_test_entry *x; + struct hlist_node *tmp; + int i, j, count; + DEFINE_HASHTABLE(hash, 3); + + /* Initialize a hashtable with three entries with key = 1. */ + hash_init(hash); + for (i = 0; i < 3; i++) { + entries[i].key = 1; + entries[i].data = i; + entries[i].visited = 0; + hash_add(hash, &entries[i].node, entries[i].key); + } + + /* Add an entry with key = 2. */ + entries[3].key = 2; + entries[3].data = 3; + entries[3].visited = 0; + hash_add(hash, &entries[3].node, entries[3].key); + + count = 0; + hash_for_each_possible_safe(hash, x, tmp, node, 1) { + if (x->data >= 0 && x->data < 4) { + entries[x->data].visited += 1; + hash_del(&entries[x->data].node); + } + count++; + } + + /* Should have visited each entry with key = 1 exactly once. */ + for (j = 0; j < 3; j++) + KUNIT_EXPECT_EQ(test, entries[j].visited, 1); + + /* If entry with key = 2 is in the same bucket as the entries with + * key = 1, check it was visited. Otherwise ensure that only three + * entries were visited. + */ + if (hash_min(1, HASH_BITS(hash)) == hash_min(2, HASH_BITS(hash))) { + KUNIT_EXPECT_EQ(test, count, 4); + KUNIT_EXPECT_EQ(test, entries[3].visited, 1); + } else { + KUNIT_EXPECT_EQ(test, count, 3); + } +} + +static struct kunit_case hashtable_test_cases[] = { + KUNIT_CASE(hashtable_test_hash_init), + KUNIT_CASE(hashtable_test_hash_empty), + KUNIT_CASE(hashtable_test_hash_hashed), + KUNIT_CASE(hashtable_test_hash_add), + KUNIT_CASE(hashtable_test_hash_del), + KUNIT_CASE(hashtable_test_hash_for_each), + KUNIT_CASE(hashtable_test_hash_for_each_safe), + KUNIT_CASE(hashtable_test_hash_for_each_possible), + KUNIT_CASE(hashtable_test_hash_for_each_possible_safe), + {}, +}; + +static struct kunit_suite hashtable_test_module = { + .name = "hashtable", + .test_cases = hashtable_test_cases, +}; + +kunit_test_suites(&hashtable_test_module); + +MODULE_LICENSE("GPL"); base-commit: 054be257f28ca8eeb8e3620766501b81ceb4b293 -- 2.39.0.314.g84b9a713c41-goog

1 year, 11 months

3
4
0 0

[PATCH] kselftest/arm64: Skip non-power of 2 SVE vector lengths in fp-stress

by Mark Brown

As documented in issue C215 in the known issues list for DDI0487I.a [1] Arm will be making a retroactive change to SVE to remove the possibility of selecting non power of two vector lengths. This has no impact on existing physical implementations but most virtual implementations have implemented the full range of permissible vector lengths. Given how demanding fp-stress is for these implementations update to only attempt to enumerate the power of two vector lengths, reducing the load created on existing virtual implementations and only exercising the functionality that will be seen in physical implementations. [1] https://developer.arm.com/documentation/102105/ia-00/ Signed-off-by: Mark Brown <broonie(a)kernel.org> --- tools/testing/selftests/arm64/fp/fp-stress.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/arm64/fp/fp-stress.c b/tools/testing/selftests/arm64/fp/fp-stress.c index f8b2f41aac36..2b95f9451b1b 100644 --- a/tools/testing/selftests/arm64/fp/fp-stress.c +++ b/tools/testing/selftests/arm64/fp/fp-stress.c @@ -377,7 +377,7 @@ static void probe_vls(int vls[], int *vl_count, int set_vl) *vl_count = 0; - for (vq = SVE_VQ_MAX; vq > 0; --vq) { + for (vq = SVE_VQ_MAX; vq > 0; vq /= 2) { vl = prctl(set_vl, vq * 16); if (vl == -1) ksft_exit_fail_msg("SET_VL failed: %s (%d)\n", @@ -385,6 +385,9 @@ static void probe_vls(int vls[], int *vl_count, int set_vl) vl &= PR_SVE_VL_LEN_MASK; + if (*vl_count && (vl == vls[*vl_count - 1])) + break; + vq = sve_vq_from_vl(vl); vls[*vl_count] = vl; --- base-commit: 1b929c02afd37871d5afb9d498426f83432e71c2 change-id: 20221220-arm64-fp-stress-pow2-b81ee6471492 Best regards, -- Mark Brown <broonie(a)kernel.org>

1 year, 11 months

2
1
0 0

[PATCH 0/4] kselftest/arm64: syscall-abi fix and enhancements

by Mark Brown

The first patch here is a fix which should ideally be sent as such, currently the program will hang on architecturally valid systems which implement SME but not 128 bit vector lengths. The remaining patches are general enhancements, including coverage for the SME ABI on SME only systems. To: Catalin Marinas <catalin.marinas(a)arm.com> To: Will Deacon <will(a)kernel.org> To: Shuah Khan <shuah(a)kernel.org> Cc: Shuah Khan <skhan(a)linuxfoundation.org> Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kselftest(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> --- Mark Brown (4): kselftest/arm64: Fix syscall-abi for systems without 128 bit SME kselftest/arm64: Only enumerate VLs once in syscall-abi kselftest/arm64: Verify SME only ABI in syscall-abi kselftest/arm64: Only enumerate power of two VLs in syscall-abi .../testing/selftests/arm64/abi/syscall-abi-asm.S | 14 ++- tools/testing/selftests/arm64/abi/syscall-abi.c | 133 +++++++++++++-------- 2 files changed, 89 insertions(+), 58 deletions(-) --- base-commit: 1b929c02afd37871d5afb9d498426f83432e71c2 change-id: 20221223-arm64-syscall-abi-sme-only-c3bb2c0f81e5 Best regards, -- Mark Brown <broonie(a)kernel.org>

1 year, 11 months

2
5
0 0

[V4 PATCH 0/4] Execute hypercalls according to host cpu

by Vishal Annapurve

Confidential VMs(CVMs) need to execute hypercall instruction as per the CPU type. Normally KVM emulates the vmcall/vmmcall instruction by patching the guest code at runtime. Such a guest memory manipulation by KVM is not allowed with CVMs and is also undesirable in general. This series adds support of executing hypercall as per the host cpu type queried using cpuid instruction. CPU vendor type is stored early during selftest setup and guest setup to be reused later. Changes in v4: 1) Incoporated suggestions from Sean - * Added APIs to query host cpu type * Shared the host cpu type with guests to avoid querying the cpu type again * Modified kvm_hypercall to execute vmcall/vmmcall according to host cpu type. 2) Dropped the separate API for kvm_hypercall. v3: https://lore.kernel.org/lkml/20221222230458.3828342-1-vannapurve@google.com/ Vishal Annapurve (4): KVM: selftests: x86: use this_cpu_* helpers KVM: selftests: x86: Add variables to store cpu type KVM: sefltests: x86: Replace is_*cpu with is_host_*cpu KVM: selftests: x86: Invoke kvm hypercall as per host cpu .../selftests/kvm/include/x86_64/processor.h | 26 ++++++++++- .../selftests/kvm/lib/x86_64/processor.c | 44 ++++++++++--------- .../selftests/kvm/x86_64/fix_hypercall_test.c | 4 +- .../selftests/kvm/x86_64/mmio_warning_test.c | 2 +- .../kvm/x86_64/pmu_event_filter_test.c | 4 +- .../vmx_exception_with_invalid_guest_state.c | 2 +- 6 files changed, 54 insertions(+), 28 deletions(-) -- 2.39.0.314.g84b9a713c41-goog

1 year, 11 months

3
11
0 0

[PATCH v4 00/17] IOMMUFD Generic interface

by Jason Gunthorpe

[ This has been in linux-next for a little while now, and we've completed the syzkaller run. 1300 hours of CPU time have been invested since the last report with no improvement in coverage or new detections. syzkaller coverage reached 69%(75%), and review of the misses show substantial amounts are WARN_ON's and other debugging which are not expected to be covered. ] iommufd is the user API to control the IOMMU subsystem as it relates to managing IO page tables that point at user space memory. It takes over from drivers/vfio/vfio_iommu_type1.c (aka the VFIO container) which is the VFIO specific interface for a similar idea. We see a broad need for extended features, some being highly IOMMU device specific: - Binding iommu_domain's to PASID/SSID - Userspace IO page tables, for ARM, x86 and S390 - Kernel bypassed invalidation of user page tables - Re-use of the KVM page table in the IOMMU - Dirty page tracking in the IOMMU - Runtime Increase/Decrease of IOPTE size - PRI support with faults resolved in userspace Many of these HW features exist to support VM use cases - for instance the combination of PASID, PRI and Userspace IO Page Tables allows an implementation of DMA Shared Virtual Addressing (vSVA) within a guest. Dirty tracking enables VM live migration with SRIOV devices and PASID support allow creating "scalable IOV" devices, among other things. As these features are fundamental to a VM platform they need to be uniformly exposed to all the driver families that do DMA into VMs, which is currently VFIO and VDPA. The pre-v1 series proposed re-using the VFIO type 1 data structure, however it was suggested that if we are doing this big update then we should also come with an improved data structure that solves the limitations that VFIO type1 has. Notably this addresses: - Multiple IOAS/'containers' and multiple domains inside a single FD - Single-pin operation no matter how many domains and containers use a page - A fine grained locking scheme supporting user managed concurrency for multi-threaded map/unmap - A pre-registration mechanism to optimize vIOMMU use cases by pre-pinning pages - Extended ioctl API that can manage these new objects and exposes domains directly to user space - domains are sharable between subsystems, eg VFIO and VDPA The bulk of this code is a new data structure design to track how the IOVAs are mapped to PFNs. iommufd intends to be general and consumable by any driver that wants to DMA to userspace. From a driver perspective it can largely be dropped in in-place of iommu_attach_device() and provides a uniform full feature set to all consumers. As this is a larger project this series is the first step. This series provides the iommfd "generic interface" which is designed to be suitable for applications like DPDK and VMM flows that are not optimized to specific HW scenarios. It is close to being a drop in replacement for the existing VFIO type 1 and supports existing qemu based VM flows. Several follow-on series are being prepared: - Patches integrating with qemu in native mode: https://github.com/yiliu1765/qemu/commits/qemu-iommufd-6.0-rc2 - A completed integration with VFIO now exists that covers "emulated" mdev use cases now, and can pass testing with qemu/etc in compatability mode: https://github.com/jgunthorpe/linux/commits/vfio_iommufd - A draft providing system iommu dirty tracking on top of iommufd, including iommu driver implementations: https://github.com/jpemartins/linux/commits/x86-iommufd This pairs with patches for providing a similar API to support VFIO-device tracking to give a complete vfio solution: https://lore.kernel.org/kvm/20220901093853.60194-1-yishaih@nvidia.com/ - Userspace page tables aka 'nested translation' for ARM and Intel iommu drivers: https://github.com/nicolinc/iommufd/commits/iommufd_nesting - "device centric" vfio series to expose the vfio_device FD directly as a normal cdev, and provide an extended API allowing dynamically changing the IOAS binding: https://github.com/yiliu1765/iommufd/commits/iommufd-v6.0-rc2-nesting-0901 - Drafts for PASID and PRI interfaces are included above as well Overall enough work is done now to show the merit of the new API design and at least draft solutions to many of the main problems. Several people have contributed directly to this work: Eric Auger, Joao Martins, Kevin Tian, Lu Baolu, Nicolin Chen, Yi L Liu. Many more have participated in the discussions that lead here, and provided ideas. Thanks to all! The v1/v2 iommufd series has been used to guide a large amount of preparatory work that has now been merged. The general theme is to organize things in a way that makes injecting iommufd natural: - VFIO live migration support with mlx5 and hisi_acc drivers. These series need a dirty tracking solution to be really usable. https://lore.kernel.org/kvm/20220224142024.147653-1-yishaih@nvidia.com/ https://lore.kernel.org/kvm/20220308184902.2242-1-shameerali.kolothum.thodi… - Significantly rework the VFIO gvt mdev and remove struct mdev_parent_ops https://lore.kernel.org/lkml/20220411141403.86980-1-hch@lst.de/ - Rework how PCIe no-snoop blocking works https://lore.kernel.org/kvm/0-v3-2cf356649677+a32-intel_no_snoop_jgg@nvidia… - Consolidate dma ownership into the iommu core code https://lore.kernel.org/linux-iommu/20220418005000.897664-1-baolu.lu@linux.… - Make all vfio driver interfaces use struct vfio_device consistently https://lore.kernel.org/kvm/0-v4-8045e76bf00b+13d-vfio_mdev_no_group_jgg@nv… - Remove the vfio_group from the kvm/vfio interface https://lore.kernel.org/kvm/0-v3-f7729924a7ea+25e33-vfio_kvm_no_group_jgg@n… - Simplify locking in vfio https://lore.kernel.org/kvm/0-v2-d035a1842d81+1bf-vfio_group_locking_jgg@nv… - Remove the vfio notifiter scheme that faces drivers https://lore.kernel.org/kvm/0-v4-681e038e30fd+78-vfio_unmap_notif_jgg@nvidi… - Improve the driver facing API for vfio pin/unpin pages to make the presence of struct page clear https://lore.kernel.org/kvm/20220723020256.30081-1-nicolinc@nvidia.com/ - Clean up in the Intel IOMMU driver https://lore.kernel.org/linux-iommu/20220301020159.633356-1-baolu.lu@linux.… https://lore.kernel.org/linux-iommu/20220510023407.2759143-1-baolu.lu@linux… https://lore.kernel.org/linux-iommu/20220514014322.2927339-1-baolu.lu@linux… https://lore.kernel.org/linux-iommu/20220706025524.2904370-1-baolu.lu@linux… https://lore.kernel.org/linux-iommu/20220702015610.2849494-1-baolu.lu@linux… - Rework s390 vfio drivers https://lore.kernel.org/kvm/20220707135737.720765-1-farman@linux.ibm.com/ - Normalize vfio ioctl handling https://lore.kernel.org/kvm/0-v2-0f9e632d54fb+d6-vfio_ioctl_split_jgg@nvidi… - VFIO API for dirty tracking (aka dma logging) managed inside a PCI device, with mlx5 implementation https://lore.kernel.org/kvm/20220901093853.60194-1-yishaih@nvidia.com - Introduce a struct device sysfs presence for struct vfio_device https://lore.kernel.org/kvm/20220901143747.32858-1-kevin.tian@intel.com/ - Complete restructuring the vfio mdev model https://lore.kernel.org/kvm/20220822062208.152745-1-hch@lst.de/ - Isolate VFIO container code in preperation for iommufd to provide an alternative implementation of it all https://lore.kernel.org/kvm/0-v1-a805b607f1fb+17b-vfio_container_split_jgg@… - Simplify and consolidate iommu_domain/device compatability checking https://lore.kernel.org/linux-iommu/cover.1666042872.git.nicolinc@nvidia.co… - Align iommu SVA support with the domain-centric model https://lore.kernel.org/all/20221031005917.45690-1-baolu.lu@linux.intel.com/ This is about 233 patches applied since March, thank you to everyone involved in all this work! Currently there are a number of supporting series still in progress: - DMABUF exporter support for VFIO to allow PCI P2P with VFIO https://lore.kernel.org/r/0-v2-472615b3877e+28f7-vfio_dma_buf_jgg@nvidia.com - Start to provide iommu_domain ops for POWER https://lore.kernel.org/all/20220714081822.3717693-1-aik@ozlabs.ru/ However, these are not necessary for this series to advance. This is on github: https://github.com/jgunthorpe/linux/commits/iommufd v4: - Rebase to v6.1-rc3, include the iommu branch with the needed EINVAL patch series and also the SVA rework - All bug fixes and comments with no API or behavioral changes - gvt tests are passing again - Syzkaller is no longer finding issues and achieved high coverage of 69%(75%) - Coverity has been run by two people - new "nth failure" test that systematically sweeps all error unwind paths looking for splats - All fixes noted in the mailing list If you sent an email and I didn't reply please ping it, I have lost it. - The selftest patch has been broken into three to make the additional modification to the main code clearer - The interdiff is 1.8k lines for the main code, with another 3k of test suite changes v3: https://lore.kernel.org/r/0-v3-402a7d6459de+24b-iommufd_jgg@nvidia.com - Rebase to v6.1-rc1 - Improve documentation - Use EXPORT_SYMBOL_NS - Fix W1, checkpatch stuff - Revise pages.c to resolve the FIXMEs. Create a interval_tree_double_span_iter which allows a simple expression of the previously problematic algorithms - Consistently use the word 'access' instead of user to refer to an access from an in-kernel user (eg vfio mdev) - Support two forms of rlimit accounting and make the vfio compatible one the default in compatability mode (following series) - Support old VFIO type1 by disabling huge pages and implementing a simple algorithm to split a struct iopt_area - Full implementation of access support, test coverage and optimizations - Complete COPY to be able to copy across contiguous areas. Improve all the algorithms around contiguous areas with a dedicated iterator - Functional ENFORCED_COHERENT support - Support multi-device groups - Lots of smaller changes (the interdiff is 5k lines) v2: https://lore.kernel.org/r/0-v2-f9436d0bde78+4bb-iommufd_jgg@nvidia.com - Rebase to v6.0-rc3 - Improve comments - Change to an iterative destruction approach to avoid cycles - Near rewrite of the vfio facing implementation, supported by a complete implementation on the vfio side - New IOMMU_IOAS_ALLOW_IOVAS API as discussed. Allows userspace to assert that ranges of IOVA must always be mappable. To be used by a VMM that has promised a guest a certain availability of IOVA. May help guide PPC's multi-window implementation. - Rework how unmap_iova works, user can unmap the whole ioas now - The no-snoop / wbinvd support is implemented - Bug fixes - Test suite improvements - Lots of smaller changes (the interdiff is 3k lines) v1: https://lore.kernel.org/r/0-v1-e79cd8d168e8+6-iommufd_jgg@nvidia.com Jason Gunthorpe (15): iommu: Add IOMMU_CAP_ENFORCE_CACHE_COHERENCY interval-tree: Add a utility to iterate over spans in an interval tree iommufd: File descriptor, context, kconfig and makefiles kernel/user: Allow user::locked_vm to be usable for iommufd iommufd: PFN handling for iopt_pages iommufd: Algorithms for PFN storage iommufd: Data structure to provide IOVA to PFN mapping iommufd: IOCTLs for the io_pagetable iommufd: Add a HW pagetable object iommufd: Add kAPI toward external drivers for physical devices iommufd: Add kAPI toward external drivers for kernel access iommufd: vfio container FD ioctl compatibility iommufd: Add a selftest iommufd: Add some fault injection points iommufd: Add additional invariant assertions Kevin Tian (1): iommufd: Document overview of iommufd Lu Baolu (1): iommu: Add device-centric DMA ownership interfaces .clang-format | 3 + Documentation/userspace-api/index.rst | 1 + .../userspace-api/ioctl/ioctl-number.rst | 1 + Documentation/userspace-api/iommufd.rst | 222 ++ MAINTAINERS | 12 + drivers/iommu/Kconfig | 1 + drivers/iommu/Makefile | 2 +- drivers/iommu/amd/iommu.c | 2 + drivers/iommu/intel/iommu.c | 16 +- drivers/iommu/iommu.c | 124 +- drivers/iommu/iommufd/Kconfig | 23 + drivers/iommu/iommufd/Makefile | 13 + drivers/iommu/iommufd/device.c | 748 +++++++ drivers/iommu/iommufd/double_span.h | 98 + drivers/iommu/iommufd/hw_pagetable.c | 57 + drivers/iommu/iommufd/io_pagetable.c | 1214 +++++++++++ drivers/iommu/iommufd/io_pagetable.h | 241 +++ drivers/iommu/iommufd/ioas.c | 390 ++++ drivers/iommu/iommufd/iommufd_private.h | 307 +++ drivers/iommu/iommufd/iommufd_test.h | 93 + drivers/iommu/iommufd/main.c | 419 ++++ drivers/iommu/iommufd/pages.c | 1884 +++++++++++++++++ drivers/iommu/iommufd/selftest.c | 853 ++++++++ drivers/iommu/iommufd/vfio_compat.c | 452 ++++ include/linux/interval_tree.h | 58 + include/linux/iommu.h | 17 + include/linux/iommufd.h | 102 + include/linux/sched/user.h | 2 +- include/uapi/linux/iommufd.h | 332 +++ kernel/user.c | 1 + lib/Kconfig | 4 + lib/interval_tree.c | 132 ++ tools/testing/selftests/Makefile | 1 + tools/testing/selftests/iommu/.gitignore | 3 + tools/testing/selftests/iommu/Makefile | 12 + tools/testing/selftests/iommu/config | 2 + tools/testing/selftests/iommu/iommufd.c | 1627 ++++++++++++++ .../selftests/iommu/iommufd_fail_nth.c | 580 +++++ tools/testing/selftests/iommu/iommufd_utils.h | 278 +++ 39 files changed, 10294 insertions(+), 33 deletions(-) create mode 100644 Documentation/userspace-api/iommufd.rst create mode 100644 drivers/iommu/iommufd/Kconfig create mode 100644 drivers/iommu/iommufd/Makefile create mode 100644 drivers/iommu/iommufd/device.c create mode 100644 drivers/iommu/iommufd/double_span.h create mode 100644 drivers/iommu/iommufd/hw_pagetable.c create mode 100644 drivers/iommu/iommufd/io_pagetable.c create mode 100644 drivers/iommu/iommufd/io_pagetable.h create mode 100644 drivers/iommu/iommufd/ioas.c create mode 100644 drivers/iommu/iommufd/iommufd_private.h create mode 100644 drivers/iommu/iommufd/iommufd_test.h create mode 100644 drivers/iommu/iommufd/main.c create mode 100644 drivers/iommu/iommufd/pages.c create mode 100644 drivers/iommu/iommufd/selftest.c create mode 100644 drivers/iommu/iommufd/vfio_compat.c create mode 100644 include/linux/iommufd.h create mode 100644 include/uapi/linux/iommufd.h create mode 100644 tools/testing/selftests/iommu/.gitignore create mode 100644 tools/testing/selftests/iommu/Makefile create mode 100644 tools/testing/selftests/iommu/config create mode 100644 tools/testing/selftests/iommu/iommufd.c create mode 100644 tools/testing/selftests/iommu/iommufd_fail_nth.c create mode 100644 tools/testing/selftests/iommu/iommufd_utils.h base-commit: 69e61edebea030f177de7a23b8d5d9b8c4a90bda -- 2.38.1

1 year, 11 months

9
73
0 0

[PATCH] dma-mapping: benchmark: Fix compile error in user-space tool

by Gerd Bayer

Since [1] the user-space program dma_map_benchmark shares the header file linux/map_benchmark.h with the kernel driver in kernel/dma/map_benchmark.c. With latest kernel version this does not compile any more. While https://kernelnewbies.org/KernelHeaders suggests otherwise, allow it to use of kernel headers through the uapi/ include direcotry. I assume we can do so safely, since the controlling user-space program is distributed with the kernel. With this change dma_map_benchmark compiles with just the obvious warning about uapi usage on ARCH=x86 and s390 and runs on ARCH=s390. [1] commit 8ddde07a3d28 ("dma-mapping: benchmark: extract a common header file for map_benchmark definition") Signed-off-by: Gerd Bayer <gbayer(a)linux.ibm.com> --- tools/testing/selftests/dma/dma_map_benchmark.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/dma/dma_map_benchmark.c b/tools/testing/selftests/dma/dma_map_benchmark.c index 5c997f17fcbd..d49d7ea6a63e 100644 --- a/tools/testing/selftests/dma/dma_map_benchmark.c +++ b/tools/testing/selftests/dma/dma_map_benchmark.c @@ -10,7 +10,7 @@ #include <unistd.h> #include <sys/ioctl.h> #include <sys/mman.h> -#include <linux/types.h> +#include <uapi/linux/types.h> #include <linux/map_benchmark.h> #define NSEC_PER_MSEC 1000000L base-commit: 8abacb3356e68261ccd3a2ad74ed6042363e5d0f -- 2.38.1

1 year, 11 months

4
7
0 0

[RFC PATCH v1 0/8] nolibc signal handling support

by Ammar Faizi

From: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> Hi, This series adds signal handling support to the nolibc subsystem. 1) Initial implementation of nolibc sigaction(2) function. Currently, this implementation is only available on the x86-64 arch. sigaction() needs an architecture-dependent "signal trampoline" function that invokes the __rt_sigreturn syscall to resume the process after a signal gets handled. On Linux x86-64, the "signal trampoline" function has to be written in inline Assembly to prevent the compiler from controlling the %rsp (e.g., with -fno-omit-frame-pointer, every function has a pushq %rbp that makes the %rsp no longer point to struct rt_sigframe). The "signal trampoline" function is called __arch_restore_rt in this implementation. 2) signal(2) function. signal() function is the simpler version of sigaction(). Unlike sigaction(), which fully controls the struct sigaction, the caller only cares about the sa_handler when calling the signal() function. signal() internally calls sigaction(). This implementation is currently only available on the x86-64 arch. When the sigaction() function support is expanded to other architectures, this function will automatically support those architectures. It's basically just a sigaction() wrapper. 3) Extra nolibc updates. Apart from the signal handling support. This series also contains nolibc updates, they are: - getpagesize() support. - CFLAGS update. - fork(2) selftest. - sigaction(2) selftest. - signal(2) selftest. - getpagesize(2) selftest. There 8 patches in this series. It has been tested on Linux x86-64 arch and all tests OK. $ sudo ./nolibc-test Running test 'syscall' ... ... 66 wait_child = -1 ECHILD [OK] 67 waitpid_min = -1 ESRCH [OK] 68 waitpid_child = -1 ECHILD [OK] 69 write_badf = -1 EBADF [OK] 70 write_zero = 0 [OK] Errors during this test: 0 Running test 'stdlib' ... ... 14 memcmp_60_20 = 64 [OK] 15 memcmp_20_e0 = -192 [OK] 16 memcmp_e0_20 = 192 [OK] 17 memcmp_80_e0 = -96 [OK] 18 memcmp_e0_80 = 96 [OK] Errors during this test: 0 Total number of errors: 0 Exiting with status 0 $ make run -j8 Kernel: arch/x86/boot/bzImage is ready (#3) ... 82 test(s) passed. Signed-off-by: Ammar Faizi <ammarfaizi2(a)gnuweeb.org> --- It's also available in the Git repository. The following changes since commit caf5c36025ec9395c8d7c78957b016a284812d23: srcu: Update comment after the index flip (2022-12-21 09:01:53 -0800) are available in the Git repository at: https://github.com/ammarfaizi2/linux-block testing/rfc.v1.2022-12-22.nolibc for you to fetch changes up to ac79aca684125907bfbefadfd6c6be0ccdfe8b33: selftests/nolibc: Add `getpagesize(2)` selftest (2022-12-22 09:57:31 +0700) ---------------------------------------------------------------- Ammar Faizi (8): nolibc/sys: Implement `sigaction(2)` function nolibc/sys: Implement `signal(2)` function nolibc/sys: Implement `getpagesize(2)` function selftests/nolibc: Add `-Wall` and `-Wno-unsed-function` to the CFLAGS selftests/nolibc: Add `fork(2)` selftest selftests/nolibc: Add `sigaction(2)` selftest selftests/nolibc: Add `signal(2)` selftest selftests/nolibc: Add `getpagesize(2)` selftest tools/include/nolibc/arch-x86_64.h | 12 + tools/include/nolibc/sys.h | 224 +++++++++++++++++++ tools/testing/selftests/nolibc/Makefile | 2 +- tools/testing/selftests/nolibc/nolibc-test.c | 219 +++++++++++++++++- 4 files changed, 454 insertions(+), 3 deletions(-) base-commit: caf5c36025ec9395c8d7c78957b016a284812d23 -- Ammar Faizi

1 year, 11 months

3
34
0 0

[PATCH v3 0/2] bpftool: improve error handing for missing .BTF section

by Changbin Du

Display error message for missing ".BTF" section and clean up empty vmlinux.h file. v3: - fix typo and make error message consistent. (Andrii Nakryiko) - split out perf change. v2: - remove vmlinux specific error info. - use builtin target .DELETE_ON_ERROR: to delete empty vmlinux.h Changbin Du (2): libbpf: show error info about missing ".BTF" section bpf: makefiles: do not generate empty vmlinux.h tools/bpf/bpftool/Makefile | 3 +++ tools/lib/bpf/btf.c | 1 + tools/testing/selftests/bpf/Makefile | 3 +++ 3 files changed, 7 insertions(+) -- 2.37.2

1 year, 11 months

5
17
0 0

Re: [PATCH v4 1/9] KVM: s390: Extend MEM_OP ioctl by storage key checked cmpxchg

by Janis Schoetterl-Glausch

On Wed, 2022-12-14 at 10:23 +0800, kernel test robot wrote: > Hi Janis, > > Thank you for the patch! Yet something to improve: > > [auto build test ERROR on 739ad2e4e15b585a0eaf98b7bdee62b2dd9588c9] > > url: https://github.com/intel-lab-lkp/linux/commits/Janis-Schoetterl-Glausch/KVM… > base: 739ad2e4e15b585a0eaf98b7bdee62b2dd9588c9 > patch link: https://lore.kernel.org/r/20221213165405.2953539-2-scgl%40linux.ibm.com > patch subject: [PATCH v4 1/9] KVM: s390: Extend MEM_OP ioctl by storage key checked cmpxchg > config: s390-randconfig-r004-20221213 > compiler: s390-linux-gcc (GCC) 12.1.0 > reproduce (this is a W=1 build): > wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross > chmod +x ~/bin/make.cross > # https://github.com/intel-lab-lkp/linux/commit/4e0991bd47ba30c7588e042da7a84… > git remote add linux-review https://github.com/intel-lab-lkp/linux > git fetch --no-tags linux-review Janis-Schoetterl-Glausch/KVM-s390-Extend-MEM_OP-ioctl-by-storage-key-checked-cmpxchg/20221214-005540 > git checkout 4e0991bd47ba30c7588e042da7a84d84b9f84056 > # save the config file > mkdir build_dir && cp config build_dir/.config > COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=s390 SHELL=/bin/bash > > If you fix the issue, kindly add following tag where applicable > > Reported-by: kernel test robot <lkp(a)intel.com> > > All errors (new ones prefixed by >>): > > s390-linux-ld: arch/s390/kvm/gaccess.o: in function `__cmpxchg_user_key': > > > arch/s390/include/asm/uaccess.h:410: undefined reference to `__ashlti3' > > > s390-linux-ld: arch/s390/include/asm/uaccess.h:411: undefined reference to `__ashlti3' > s390-linux-ld: arch/s390/include/asm/uaccess.h:458: undefined reference to `__ashlti3' > s390-linux-ld: arch/s390/include/asm/uaccess.h:459: undefined reference to `__ashlti3' > > > vim +410 arch/s390/include/asm/uaccess.h > > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 396 > 4148575abe1e14 Heiko Carstens 2022-11-02 397 static __always_inline int __cmpxchg_user_key(unsigned long address, void *uval, > 4148575abe1e14 Heiko Carstens 2022-11-02 398 __uint128_t old, __uint128_t new, > 4148575abe1e14 Heiko Carstens 2022-11-02 399 unsigned long key, int size) > 4148575abe1e14 Heiko Carstens 2022-11-02 400 { > 4148575abe1e14 Heiko Carstens 2022-11-02 401 int rc = 0; > 4148575abe1e14 Heiko Carstens 2022-11-02 402 > 4148575abe1e14 Heiko Carstens 2022-11-02 403 switch (size) { > 4148575abe1e14 Heiko Carstens 2022-11-02 404 case 1: { > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 405 unsigned int prev, shift, mask, _old, _new; > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 406 unsigned long count; > 4148575abe1e14 Heiko Carstens 2022-11-02 407 > 4148575abe1e14 Heiko Carstens 2022-11-02 408 shift = (3 ^ (address & 3)) << 3; > 4148575abe1e14 Heiko Carstens 2022-11-02 409 address ^= address & 3; > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 @410 _old = (old & 0xff) << shift; > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 @411 _new = (new & 0xff) << shift; Not sure what it is in this config that causes gcc to emit this symbol instead of a shift instruction, but casting old/new to 32 bit fixes the error. > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 412 mask = ~(0xff << shift); > 4148575abe1e14 Heiko Carstens 2022-11-02 413 asm volatile( > 4148575abe1e14 Heiko Carstens 2022-11-02 414 " spka 0(%[key])\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 415 " sacf 256\n" > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 416 " llill %[count],%[max_loops]\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 417 "0: l %[prev],%[address]\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 418 "1: nr %[prev],%[mask]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 419 " xilf %[mask],0xffffffff\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 420 " or %[new],%[prev]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 421 " or %[prev],%[tmp]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 422 "2: lr %[tmp],%[prev]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 423 "3: cs %[prev],%[new],%[address]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 424 "4: jnl 5f\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 425 " xr %[tmp],%[prev]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 426 " xr %[new],%[tmp]\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 427 " nr %[tmp],%[mask]\n" > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 428 " jnz 5f\n" > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 429 " brct %[count],2b\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 430 "5: sacf 768\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 431 " spka %[default_key]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 432 EX_TABLE_UA_LOAD_REG(0b, 5b, %[rc], %[prev]) > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 433 EX_TABLE_UA_LOAD_REG(1b, 5b, %[rc], %[prev]) > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 434 EX_TABLE_UA_LOAD_REG(3b, 5b, %[rc], %[prev]) > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 435 EX_TABLE_UA_LOAD_REG(4b, 5b, %[rc], %[prev]) > 4148575abe1e14 Heiko Carstens 2022-11-02 436 : [rc] "+&d" (rc), > 4148575abe1e14 Heiko Carstens 2022-11-02 437 [prev] "=&d" (prev), > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 438 [address] "+Q" (*(int *)address), > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 439 [tmp] "+&d" (_old), > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 440 [new] "+&d" (_new), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 441 [mask] "+&d" (mask), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 442 [count] "=a" (count) > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 443 : [key] "%[count]" (key << 4), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 444 [default_key] "J" (PAGE_DEFAULT_KEY), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 445 [max_loops] "J" (CMPXCHG_USER_KEY_MAX_LOOPS) > 4148575abe1e14 Heiko Carstens 2022-11-02 446 : "memory", "cc"); > 4148575abe1e14 Heiko Carstens 2022-11-02 447 *(unsigned char *)uval = prev >> shift; > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 448 if (!count) > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 449 rc = -EAGAIN; > 4148575abe1e14 Heiko Carstens 2022-11-02 450 return rc; > 4148575abe1e14 Heiko Carstens 2022-11-02 451 } > 4148575abe1e14 Heiko Carstens 2022-11-02 452 case 2: { > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 453 unsigned int prev, shift, mask, _old, _new; > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 454 unsigned long count; > 4148575abe1e14 Heiko Carstens 2022-11-02 455 > 4148575abe1e14 Heiko Carstens 2022-11-02 456 shift = (2 ^ (address & 2)) << 3; > 4148575abe1e14 Heiko Carstens 2022-11-02 457 address ^= address & 2; > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 458 _old = (old & 0xffff) << shift; > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 459 _new = (new & 0xffff) << shift; Same here. > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 460 mask = ~(0xffff << shift); > 4148575abe1e14 Heiko Carstens 2022-11-02 461 asm volatile( > 4148575abe1e14 Heiko Carstens 2022-11-02 462 " spka 0(%[key])\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 463 " sacf 256\n" > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 464 " llill %[count],%[max_loops]\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 465 "0: l %[prev],%[address]\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 466 "1: nr %[prev],%[mask]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 467 " xilf %[mask],0xffffffff\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 468 " or %[new],%[prev]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 469 " or %[prev],%[tmp]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 470 "2: lr %[tmp],%[prev]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 471 "3: cs %[prev],%[new],%[address]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 472 "4: jnl 5f\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 473 " xr %[tmp],%[prev]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 474 " xr %[new],%[tmp]\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 475 " nr %[tmp],%[mask]\n" > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 476 " jnz 5f\n" > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 477 " brct %[count],2b\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 478 "5: sacf 768\n" > 4148575abe1e14 Heiko Carstens 2022-11-02 479 " spka %[default_key]\n" > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 480 EX_TABLE_UA_LOAD_REG(0b, 5b, %[rc], %[prev]) > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 481 EX_TABLE_UA_LOAD_REG(1b, 5b, %[rc], %[prev]) > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 482 EX_TABLE_UA_LOAD_REG(3b, 5b, %[rc], %[prev]) > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 483 EX_TABLE_UA_LOAD_REG(4b, 5b, %[rc], %[prev]) > 4148575abe1e14 Heiko Carstens 2022-11-02 484 : [rc] "+&d" (rc), > 4148575abe1e14 Heiko Carstens 2022-11-02 485 [prev] "=&d" (prev), > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 486 [address] "+Q" (*(int *)address), > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 487 [tmp] "+&d" (_old), > 51098f0eb22e2f Janis Schoetterl-Glausch 2022-11-16 488 [new] "+&d" (_new), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 489 [mask] "+&d" (mask), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 490 [count] "=a" (count) > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 491 : [key] "%[count]" (key << 4), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 492 [default_key] "J" (PAGE_DEFAULT_KEY), > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 493 [max_loops] "J" (CMPXCHG_USER_KEY_MAX_LOOPS) > 4148575abe1e14 Heiko Carstens 2022-11-02 494 : "memory", "cc"); > 4148575abe1e14 Heiko Carstens 2022-11-02 495 *(unsigned short *)uval = prev >> shift; > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 496 if (!count) > 739ad2e4e15b58 Janis Schoetterl-Glausch 2022-11-17 497 rc = -EAGAIN; > 4148575abe1e14 Heiko Carstens 2022-11-02 498 return rc; [...]

1 year, 11 months

2
1
0 0

[PATCH v3 2/2] selftests/kexec: enable lockdown tests

by Coiby Xu

When lockdown is enabled, kexec_load syscall should always fail. For kexec_file_load, when lockdown is enabled, it should - fail of missing PE signature when KEXEC_SIG is enabled - fail of missing IMA signature when KEXEC_SIG is disabled Before this patch, test_kexec_load.sh fails (false positive) and test_kexec_file_load.sh fails without a reason when lockdown enabled and KEXEC_SIG disabled, # kexec_load failed [FAIL] not ok 1 selftests: kexec: test_kexec_load.sh # exit=1 # kexec_file_load failed [PASS] ok 2 selftests: kexec: test_kexec_file_load.sh After this patch, test_kexec_load.sh succeeds and test_kexec_file_load.sh fails with the correct reason when lockdown enabled and KEXEC_SIG disabled, # kexec_load failed [PASS] ok 1 selftests: kexec: test_kexec_load.sh # kexec_file_load failed (missing IMA sig) [PASS] ok 2 selftests: kexec: test_kexec_file_load.sh Cc: kexec(a)lists.infradead.org Cc: linux-integrity(a)vger.kernel.org Suggested-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Coiby Xu <coxu(a)redhat.com> --- .../selftests/kexec/kexec_common_lib.sh | 16 +++++++++++ .../selftests/kexec/test_kexec_file_load.sh | 27 +++++++++++++++++++ .../selftests/kexec/test_kexec_load.sh | 12 ++++++--- 3 files changed, 52 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/kexec/kexec_common_lib.sh b/tools/testing/selftests/kexec/kexec_common_lib.sh index 641ef05863b2..06c298b46788 100755 --- a/tools/testing/selftests/kexec/kexec_common_lib.sh +++ b/tools/testing/selftests/kexec/kexec_common_lib.sh @@ -110,6 +110,22 @@ get_secureboot_mode() return $secureboot_mode; } +is_lockdown_enabled() +{ + local ret=0 + + if [ -f /sys/kernel/security/lockdown ] \ + && ! grep -qs "\[none\]" /sys/kernel/security/lockdown; then + ret=1 + fi + + if [ $ret -eq 0 ]; then + log_info "lockdown not enabled" + fi + + return $ret +} + require_root_privileges() { if [ $(id -ru) -ne 0 ]; then diff --git a/tools/testing/selftests/kexec/test_kexec_file_load.sh b/tools/testing/selftests/kexec/test_kexec_file_load.sh index c9ccb3c93d72..790f96938083 100755 --- a/tools/testing/selftests/kexec/test_kexec_file_load.sh +++ b/tools/testing/selftests/kexec/test_kexec_file_load.sh @@ -139,6 +139,16 @@ kexec_file_load_test() log_fail "$succeed_msg (missing IMA sig)" fi + if [ $lockdown -eq 1 ] && [ $kexec_sig_enabled -eq 1 ] \ + && [ $pe_signed -eq 0 ]; then + log_fail "$succeed_msg (missing PE sig)" + fi + + if [ $lockdown -eq 1 ] && [ $kexec_sig_enabled -eq 0 ] && [ $ima_signed -eq 0 ] \ + && [ $ima_modsig -eq 0 ]; then + log_fail "$succeed_msg (missing IMA sig)" + fi + if [ $pe_sig_required -eq 0 ] && [ $ima_appraise -eq 1 ] \ && [ $ima_sig_required -eq 0 ] && [ $ima_signed -eq 0 ] \ && [ $ima_read_policy -eq 0 ]; then @@ -181,6 +191,16 @@ kexec_file_load_test() log_pass "$failed_msg (possibly missing IMA sig)" fi + if [ $lockdown -eq 1 ] && [ $kexec_sig_enabled -eq 1 ] \ + && [ $pe_signed -eq 0 ]; then + log_pass "$failed_msg (missing PE sig)" + fi + + if [ $lockdown -eq 1 ] && [ $kexec_sig_enabled -eq 0 ] \ + && [ $ima_signed -eq 0 ] && [ $ima_modsig -eq 0 ]; then + log_pass "$failed_msg (missing IMA sig)" + fi + log_pass "$failed_msg" return 0 } @@ -215,6 +235,10 @@ kconfig_enabled "CONFIG_KEXEC_SIG_FORCE=y" \ "kexec signed kernel image required" kexec_sig_required=$? +kconfig_enabled "CONFIG_KEXEC_SIG=y" \ + "KEXEC_SIG enabled" +kexec_sig_enabled=$? + kconfig_enabled "CONFIG_KEXEC_BZIMAGE_VERIFY_SIG=y" \ "PE signed kernel image required" pe_sig_required=$? @@ -225,6 +249,9 @@ ima_sig_required=$? get_secureboot_mode secureboot=$? +is_lockdown_enabled +lockdown=$? + # Are there pe and ima signatures if [ "$(get_arch)" == 'ppc64le' ]; then pe_signed=0 diff --git a/tools/testing/selftests/kexec/test_kexec_load.sh b/tools/testing/selftests/kexec/test_kexec_load.sh index 49c6aa929137..0542887866c0 100755 --- a/tools/testing/selftests/kexec/test_kexec_load.sh +++ b/tools/testing/selftests/kexec/test_kexec_load.sh @@ -28,18 +28,24 @@ arch_policy=$? get_secureboot_mode secureboot=$? -# kexec_load should fail in secure boot mode and CONFIG_IMA_ARCH_POLICY enabled +is_lockdown_enabled +lockdown=$? + +# kexec_load should fail in either +# a) secure boot mode and CONFIG_IMA_ARCH_POLICY enabled +# or +# b) lockdown enabled kexec --load $KERNEL_IMAGE > /dev/null 2>&1 if [ $? -eq 0 ]; then kexec --unload - if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ]; then + if [ $secureboot -eq 1 -a $arch_policy -eq 1 ] || [ $lockdown -eq 1 ]; then log_fail "kexec_load succeeded" elif [ $ima_appraise -eq 0 -o $arch_policy -eq 0 ]; then log_info "Either IMA or the IMA arch policy is not enabled" fi log_pass "kexec_load succeeded" else - if [ $secureboot -eq 1 ] && [ $arch_policy -eq 1 ] ; then + if [ $secureboot -eq 1 -a $arch_policy -eq 1 ] || [ $lockdown -eq 1 ]; then log_pass "kexec_load failed" else log_fail "kexec_load failed" -- 2.38.1

1 year, 11 months

2
1
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror December 2022