From: Jeff Xu <jeffxu(a)chromium.org>
Pedro Falcato's optimization [1] for checking sealed VMAs, which replaces
the can_modify_mm() function with an in-loop check, necessitates an update
to the mseal.rst documentation to reflect this change.
Furthermore, the document has received offline comments regarding the code
sample and suggestions for sentence clarification to enhance reader
comprehension.
[1] https://lore.kernel.org/linux-mm/20240817-mseal-depessimize-v3-0-d8d2e037df…
History:
V2: update according to Randy Dunlap's comments.
V1: initial version
https://lore.kernel.org/all/20240927185211.729207-1-jeffxu@chromium.org/
Jeff Xu (1):
mseal: update mseal.rst
Documentation/userspace-api/mseal.rst | 304 ++++++++++++--------------
1 file changed, 144 insertions(+), 160 deletions(-)
--
2.46.1.824.gd892dcdcdd-goog
This patch series is motivated by the following observation:
Raise a signal, jump to signal handler. The ucontext_t structure dumped
by kernel to userspace has a uc_sigmask field having the mask of blocked
signals. If you run a fresh minimalistic program doing this, this field
is empty, even if you block some signals while registering the handler
with sigaction().
Here is what the man-pages have to say:
sigaction(2): "sa_mask specifies a mask of signals which should be blocked
(i.e., added to the signal mask of the thread in which the signal handler
is invoked) during execution of the signal handler. In addition, the
signal which triggered the handler will be blocked, unless the SA_NODEFER
flag is used."
signal(7): Under "Execution of signal handlers", (1.3) implies:
"The thread's current signal mask is accessible via the ucontext_t
object that is pointed to by the third argument of the signal handler."
But, (1.4) states:
"Any signals specified in act->sa_mask when registering the handler with
sigprocmask(2) are added to the thread's signal mask. The signal being
delivered is also added to the signal mask, unless SA_NODEFER was
specified when registering the handler. These signals are thus blocked
while the handler executes."
There clearly is no distinction being made in the man pages between
"Thread's signal mask" and ucontext_t; this logically should imply
that a signal blocked by populating struct sigaction should be visible
in ucontext_t.
Here is what the kernel code does (for Aarch64):
do_signal() -> handle_signal() -> sigmask_to_save(), which returns
¤t->blocked, is passed to setup_rt_frame() -> setup_sigframe() ->
__copy_to_user(). Hence, ¤t->blocked is copied to ucontext_t
exposed to userspace. Returning back to handle_signal(),
signal_setup_done() -> signal_delivered() -> sigorsets() and
set_current_blocked() are responsible for using information from
struct ksignal ksig, which was populated through the sigaction()
system call in kernel/signal.c:
copy_from_user(&new_sa.sa, act, sizeof(new_sa.sa)),
to update ¤t->blocked; hence, the set of blocked signals for the
current thread is updated AFTER the kernel dumps ucontext_t to
userspace.
Assuming that the above is indeed the intended behaviour, because it
semantically makes sense, since the signals blocked using sigaction()
remain blocked only till the execution of the handler, and not in the
context present before jumping to the handler (but nothing can be
confirmed from the man-pages), the series introduces a test for
mangling with uc_sigmask. I will send a separate series to fix the
man-pages.
The proposed selftest has been tested out on Aarch32, Aarch64 and x86_64.
v5->v6:
- Drop renaming of sas.c
- Include the explanation from the cover letter in the changelog
for the second patch
v4->v5:
- Remove a redundant print statement
v3->v4:
- Allocate sigsets as automatic variables to avoid malloc()
v2->v3:
- ucontext describes current state -> ucontext describes interrupted context
- Add a comment for blockage of USR2 even after return from handler
- Describe blockage of signals in a better way
v1->v2:
- Replace all occurrences of SIGPIPE with SIGSEGV
- Fixed a mismatch between code comment and ksft log
- Add a testcase: Raise the same signal again; it must not be queued
- Remove unneeded <assert.h>, <unistd.h>
- Give a detailed test description in the comments; also describe the
exact meaning of delivered and blocked
- Handle errors for all libc functions/syscalls
- Mention tests in Makefile and .gitignore in alphabetical order
v1:
- https://lore.kernel.org/all/20240607122319.768640-1-dev.jain@arm.com/
Dev Jain (2):
selftests: Rename sigaltstack to generic signal
selftests: Add a test mangling with uc_sigmask
tools/testing/selftests/Makefile | 2 +-
.../{sigaltstack => signal}/.gitignore | 1 +
.../{sigaltstack => signal}/Makefile | 3 +-
.../current_stack_pointer.h | 0
.../selftests/signal/mangle_uc_sigmask.c | 184 ++++++++++++++++++
.../selftests/{sigaltstack => signal}/sas.c | 0
6 files changed, 188 insertions(+), 2 deletions(-)
rename tools/testing/selftests/{sigaltstack => signal}/.gitignore (70%)
rename tools/testing/selftests/{sigaltstack => signal}/Makefile (56%)
rename tools/testing/selftests/{sigaltstack => signal}/current_stack_pointer.h (100%)
create mode 100644 tools/testing/selftests/signal/mangle_uc_sigmask.c
rename tools/testing/selftests/{sigaltstack => signal}/sas.c (100%)
--
2.30.2
Hello,
KernelCI is hosting a bi-weekly call on Thursday to discuss improvements
to existing upstream tests, the development of new tests to increase
kernel testing coverage, and the enablement of these tests in KernelCI.
Below is a list of the tests the community has been working on and their
latest status updates, as discussed in the last meeting held on
2024-11-03:
*Missing devices kselftest*
- Proposing new kselftest to report devices that go missing in the system
(v2):
https://lore.kernel.org/all/20240928-kselftest-dev-exist-v2-1-fab07de6b80b@…
- Sent v2 addressing feedback received on the RFCv1 and during the session
at LPC 2024:
https://www.youtube.com/live/kcr8NXEbzcg?si=QWBvJAOjj7tg264o&t=11283
*Boot time test*
- RFC:
https://lore.kernel.org/all/20240725110622.96301-1-laura.nao@collabora.com/…
- Discussed proposal at LPC2024:
https://www.youtube.com/live/8XQwzUZxLK4?feature=shared&t=16944
- Planning on preparing v2, based on feedback received in the session
- Suggestions for improvements and additional features include: exploring
bootloader tracing via pre-filled ftrace buffers, adding support for
specifying variance values on a per-event basis, investigating the use of
ftrace histograms for initcalls
*Device testing documentation*
- Patch:
https://lore.kernel.org/all/20241001-kselftest-device-docs-v1-1-be28b70dd85…
- Submitted documentation on device testing, detailing the types of
kselftests available, their requirements, and the coverage they provide.
The goal is to guide users in selecting the appropriate tests for their
devices.
*GPIO test*
- RFC:
https://lore.kernel.org/all/20240909-kselftest-gpio-set-get-config-v1-0-16a…
- Proposed a new kselftest to verify the GPIO driver functionality. The
test uses a YAML-based test plan that specifies the configurations to be
checked. It sets each pin configuration and retrieves it to ensure they
match. Currently, the test only verifies bias settings, but it can be
easily extended to cover additional pin configurations.
Please reply to this thread if you'd like to join the call or discuss any
of the topics further. We look forward to collaborating with the community
to improve upstream tests and expand coverage to more areas of interest
within the kernel.
Best regards,
Laura Nao
The arm64 Guarded Control Stack (GCS) feature provides support for
hardware protected stacks of return addresses, intended to provide
hardening against return oriented programming (ROP) attacks and to make
it easier to gather call stacks for applications such as profiling.
When GCS is active a secondary stack called the Guarded Control Stack is
maintained, protected with a memory attribute which means that it can
only be written with specific GCS operations. The current GCS pointer
can not be directly written to by userspace. When a BL is executed the
value stored in LR is also pushed onto the GCS, and when a RET is
executed the top of the GCS is popped and compared to LR with a fault
being raised if the values do not match. GCS operations may only be
performed on GCS pages, a data abort is generated if they are not.
The combination of hardware enforcement and lack of extra instructions
in the function entry and exit paths should result in something which
has less overhead and is more difficult to attack than a purely software
implementation like clang's shadow stacks.
This series implements support for managing GCS for KVM guests, it also
includes a fix for S1PIE which has also been sent separately as this
feature is a dependency for GCS. It is based on:
https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-next/gcs
Signed-off-by: Mark Brown <broonie(a)kernel.org>
---
Changes in v14:
- Rebase onto arm64/for-next/gcs which includes all the non-KVM support.
- Manage the fine grained traps for GCS instructions.
- Manage PSTATE.EXLOCK when delivering exceptions to KVM guests.
- Link to v13: https://lore.kernel.org/r/20241001-arm64-gcs-v13-0-222b78d87eee@kernel.org
Changes in v13:
- Rebase onto v6.12-rc1.
- Allocate VM_HIGH_ARCH_6 since protection keys used all the existing
bits.
- Implement mm_release() and free transparently allocated GCSs there.
- Use bit 32 of AT_HWCAP for GCS due to AT_HWCAP2 being filled.
- Since we now only set GCSCRE0_EL1 on change ensure that it is
initialised with GCSPR_EL0 accessible to EL0.
- Fix OOM handling on thread copy.
- Link to v12: https://lore.kernel.org/r/20240829-arm64-gcs-v12-0-42fec947436a@kernel.org
Changes in v12:
- Clarify and simplify the signal handling code so we work with the
register state.
- When checking for write aborts to shadow stack pages ensure the fault
is a data abort.
- Depend on !UPROBES.
- Comment cleanups.
- Link to v11: https://lore.kernel.org/r/20240822-arm64-gcs-v11-0-41b81947ecb5@kernel.org
Changes in v11:
- Remove the dependency on the addition of clone3() support for shadow
stacks, rebasing onto v6.11-rc3.
- Make ID_AA64PFR1_EL1.GCS writeable in KVM.
- Hide GCS registers when GCS is not enabled for KVM guests.
- Require HCRX_EL2.GCSEn if booting at EL1.
- Require that GCSCR_EL1 and GCSCRE0_EL1 be initialised regardless of
if we boot at EL2 or EL1.
- Remove some stray use of bit 63 in signal cap tokens.
- Warn if we see a GCS with VM_SHARED.
- Remove rdundant check for VM_WRITE in fault handling.
- Cleanups and clarifications in the ABI document.
- Clean up and improve documentation of some sync placement.
- Only set the EL0 GCS mode if it's actually changed.
- Various minor fixes and tweaks.
- Link to v10: https://lore.kernel.org/r/20240801-arm64-gcs-v10-0-699e2bd2190b@kernel.org
Changes in v10:
- Fix issues with THP.
- Tighten up requirements for initialising GCSCR*.
- Only generate GCS signal frames for threads using GCS.
- Only context switch EL1 GCS registers if S1PIE is enabled.
- Move context switch of GCSCRE0_EL1 to EL0 context switch.
- Make GCS registers unconditionally visible to userspace.
- Use FHU infrastructure.
- Don't change writability of ID_AA64PFR1_EL1 for KVM.
- Remove unused arguments from alloc_gcs().
- Typo fixes.
- Link to v9: https://lore.kernel.org/r/20240625-arm64-gcs-v9-0-0f634469b8f0@kernel.org
Changes in v9:
- Rebase onto v6.10-rc3.
- Restructure and clarify memory management fault handling.
- Fix up basic-gcs for the latest clone3() changes.
- Convert to newly merged KVM ID register based feature configuration.
- Fixes for NV traps.
- Link to v8: https://lore.kernel.org/r/20240203-arm64-gcs-v8-0-c9fec77673ef@kernel.org
Changes in v8:
- Invalidate signal cap token on stack when consuming.
- Typo and other trivial fixes.
- Don't try to use process_vm_write() on GCS, it intentionally does not
work.
- Fix leak of thread GCSs.
- Rebase onto latest clone3() series.
- Link to v7: https://lore.kernel.org/r/20231122-arm64-gcs-v7-0-201c483bd775@kernel.org
Changes in v7:
- Rebase onto v6.7-rc2 via the clone3() patch series.
- Change the token used to cap the stack during signal handling to be
compatible with GCSPOPM.
- Fix flags for new page types.
- Fold in support for clone3().
- Replace copy_to_user_gcs() with put_user_gcs().
- Link to v6: https://lore.kernel.org/r/20231009-arm64-gcs-v6-0-78e55deaa4dd@kernel.org
Changes in v6:
- Rebase onto v6.6-rc3.
- Add some more gcsb_dsync() barriers following spec clarifications.
- Due to ongoing discussion around clone()/clone3() I've not updated
anything there, the behaviour is the same as on previous versions.
- Link to v5: https://lore.kernel.org/r/20230822-arm64-gcs-v5-0-9ef181dd6324@kernel.org
Changes in v5:
- Don't map any permissions for user GCSs, we always use EL0 accessors
or use a separate mapping of the page.
- Reduce the standard size of the GCS to RLIMIT_STACK/2.
- Enforce a PAGE_SIZE alignment requirement on map_shadow_stack().
- Clarifications and fixes to documentation.
- More tests.
- Link to v4: https://lore.kernel.org/r/20230807-arm64-gcs-v4-0-68cfa37f9069@kernel.org
Changes in v4:
- Implement flags for map_shadow_stack() allowing the cap and end of
stack marker to be enabled independently or not at all.
- Relax size and alignment requirements for map_shadow_stack().
- Add more blurb explaining the advantages of hardware enforcement.
- Link to v3: https://lore.kernel.org/r/20230731-arm64-gcs-v3-0-cddf9f980d98@kernel.org
Changes in v3:
- Rebase onto v6.5-rc4.
- Add a GCS barrier on context switch.
- Add a GCS stress test.
- Link to v2: https://lore.kernel.org/r/20230724-arm64-gcs-v2-0-dc2c1d44c2eb@kernel.org
Changes in v2:
- Rebase onto v6.5-rc3.
- Rework prctl() interface to allow each bit to be locked independently.
- map_shadow_stack() now places the cap token based on the size
requested by the caller not the actual space allocated.
- Mode changes other than enable via ptrace are now supported.
- Expand test coverage.
- Various smaller fixes and adjustments.
- Link to v1: https://lore.kernel.org/r/20230716-arm64-gcs-v1-0-bf567f93bba6@kernel.org
---
Mark Brown (5):
KVM: arm64: Expose S1PIE to guests
arm64/gcs: Ensure FGTs for EL1 GCS instructions are disabled
KVM: arm64: Manage GCS access and registers for guests
KVM: arm64: Set PSTATE.EXLOCK when entering an exception
KVM: selftests: arm64: Add GCS registers to get-reg-list
arch/arm64/include/asm/el2_setup.h | 7 ++++-
arch/arm64/include/asm/kvm_host.h | 12 ++++++++
arch/arm64/include/asm/vncr_mapping.h | 2 ++
arch/arm64/include/uapi/asm/ptrace.h | 2 ++
arch/arm64/kvm/hyp/exception.c | 10 +++++++
arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 31 +++++++++++++++++++
arch/arm64/kvm/sys_regs.c | 35 ++++++++++++++++++++--
tools/testing/selftests/kvm/aarch64/get-reg-list.c | 28 +++++++++++++++++
8 files changed, 124 insertions(+), 3 deletions(-)
---
base-commit: ed4983d2da8c3b66ac6d048beb242916bec83522
change-id: 20230303-arm64-gcs-e311ab0d8729
Best regards,
--
Mark Brown <broonie(a)kernel.org>
From: Björn Töpel <bjorn(a)rivosinc.com>
This effectively is a revert of commit 7a6eb7c34a78 ("selftests: Skip
BPF seftests by default"). At the time when this was added, BPF had
"build time dependencies on cutting edge versions". Since then a
number of BPF capable tests has been included in net, hid, sched_ext.
There is no reason not to include BPF by default in the build.
Remove BPF from the selftests skiplist.
Signed-off-by: Björn Töpel <bjorn(a)rivosinc.com>
---
tools/testing/selftests/Makefile | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index b38199965f99..88f59a5fef96 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -129,10 +129,8 @@ ifeq ($(filter net/lib,$(TARGETS)),)
endif
endif
-# User can optionally provide a TARGETS skiplist. By default we skip
-# BPF since it has cutting edge build time dependencies which require
-# more effort to install.
-SKIP_TARGETS ?= bpf
+# User can optionally provide a TARGETS skiplist.
+SKIP_TARGETS ?=
ifneq ($(SKIP_TARGETS),)
TMP := $(filter-out $(SKIP_TARGETS), $(TARGETS))
override TARGETS := $(TMP)
base-commit: 0c559323bbaabee7346c12e74b497e283aaafef5
--
2.43.0
Hi Linus,
Please pull this kselftest fixes update for Linux 6.12-rc2.
This kselftest fixes update for Linux 6.12-rc2 consists of fixes
to build warnings, install scripts, run-time error path, and
git status cleanups to tests:
-- devices/probe: fix for Python3 regex string syntax warnings
-- clone3: removing unused macro from clone3_cap_checkpoint_restore()
-- vDSO: fix to align getrandom states to cache line
-- core and exec: add missing executables to .gitignore files
-- rtc: change to skip test if /dev/rtc0 can't be accessed
-- timers/posix: fix warn_unused_result result in __fatal_error()
-- breakpoints: fix to detect suspend successful condition correctly
-- hid: fix to install required dependencies to run the test
diff is attached.
thanks,
-- Shuah
----------------------------------------------------------------
The following changes since commit 9852d85ec9d492ebef56dc5f229416c925758edc:
Linux 6.12-rc1 (2024-09-29 15:06:19 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest tags/linux_kselftest-fixes-6.12-rc2
for you to fetch changes up to c66be905cda24fb782b91053b196bd2e966f95b7:
selftests: breakpoints: use remaining time to check if suspend succeed (2024-10-02 14:37:30 -0600)
----------------------------------------------------------------
linux_kselftest-fixes-6.12-rc2
This kselftest fixes update for Linux 6.12-rc2 consists of fixes
to build warnings, install scripts, run-time error path, and
git status cleanups to tests:
-- devices/probe: fix for Python3 regex string syntax warnings
-- clone3: removing unused macro from clone3_cap_checkpoint_restore()
-- vDSO: fix to align getrandom states to cache line
-- core and exec: add missing executables to .gitignore files
-- rtc: change to skip test if /dev/rtc0 can't be accessed
-- timers/posix: fix warn_unused_result result in __fatal_error()
-- breakpoints: fix to detect suspend successful condition correctly
-- hid: fix to install required dependencies to run the test
----------------------------------------------------------------
Alessandro Zanni (1):
kselftest/devices/probe: Fix SyntaxWarning in regex strings for Python3
Ba Jing (1):
clone3: clone3_cap_checkpoint_restore: remove unused MAX_PID_NS_LEVEL macro
Jason A. Donenfeld (1):
selftests: vDSO: align getrandom states to cache line
Javier Carrasco (2):
selftests: core: add unshare_test to gitignore
selftests: exec: update gitignore for load_address
Joseph Jang (1):
selftest: rtc: Check if could access /dev/rtc0 before testing
Shuah Khan (1):
selftests:timers: posix_timers: Fix warn_unused_result in __fatal_error()
Yifei Liu (1):
selftests: breakpoints: use remaining time to check if suspend succeed
Yun Lu (1):
selftest: hid: add missing run-hid-tools-tests.sh
.../testing/selftests/breakpoints/step_after_suspend_test.c | 5 ++++-
.../testing/selftests/clone3/clone3_cap_checkpoint_restore.c | 2 --
tools/testing/selftests/core/.gitignore | 1 +
.../selftests/devices/probe/test_discoverable_devices.py | 4 ++--
tools/testing/selftests/exec/.gitignore | 3 ++-
tools/testing/selftests/hid/Makefile | 2 ++
tools/testing/selftests/rtc/rtctest.c | 11 ++++++++++-
tools/testing/selftests/timers/posix_timers.c | 12 ++++++++----
tools/testing/selftests/vDSO/vdso_test_getrandom.c | 8 +++++---
9 files changed, 34 insertions(+), 14 deletions(-)
----------------------------------------------------------------
v2:
- v1 missed the merge window, so while we're at it...
- split changes into two patches instead of one for readability (#1
removes the ioam selftests, #2 adds the updated ioam selftests)
TL;DR This patch comes from a discussion we had with Jakub and Paolo on
aligning the ioam selftests with its new "tunsrc" feature.
This patch updates the IOAM selftests to support the new "tunsrc"
feature of IOAM. As a consequence, some changes were required. For
example, the IPv6 header must be accessed to check some fields (i.e.,
the source address for the "tunsrc" feature), which is not possible
AFAIK with IPv6 raw sockets. The latter is currently used with
IPV6_RECVHOPOPTS and was introduced by commit 187bbb6968af ("selftests:
ioam: refactoring to align with the fix") to fix an issue. But, we
really need packet sockets actually... which is one of the changes in
this patch (see the description of the topology at the top of ioam6.sh
for explanations). Another change is that all IPv6 addresses used in the
topology are now based on the documentation prefix (2001:db8::/32).
Also, the tests have been improved and there are now many more of them.
Overall, the script is more robust.
Justin Iurman (2):
selftests: net: remove ioam tests
selftests: net: add new ioam tests
tools/testing/selftests/net/ioam6.sh | 1832 +++++++++++++++-----
tools/testing/selftests/net/ioam6_parser.c | 1087 ++++++++----
2 files changed, 2129 insertions(+), 790 deletions(-)
--
2.34.1