March 2024 - Linux-kselftest-mirror

[PATCH] selftests: cgroup: skip test_cgcore_lesser_ns_open when cgroup2 mounted without nsdelegate

by Tianchen Ding

The test case test_cgcore_lesser_ns_open only tasks effect when cgroup2 is mounted with "nsdelegate" mount option. If it misses this option, or is remounted without "nsdelegate", the test case will fail. For example, running bpf/test_cgroup_storage first, and then run cgroup/test_core will fail on test_cgcore_lesser_ns_open. Skip it if "nsdelegate" is not detected in cgroup2 mount options. Fixes: bf35a7879f1d ("selftests: cgroup: Test open-time cgroup namespace usage for migration checks") Signed-off-by: Tianchen Ding <dtcccc(a)linux.alibaba.com> --- tools/testing/selftests/cgroup/cgroup_util.c | 8 +++++--- tools/testing/selftests/cgroup/cgroup_util.h | 2 +- tools/testing/selftests/cgroup/test_core.c | 7 ++++++- tools/testing/selftests/cgroup/test_cpu.c | 2 +- tools/testing/selftests/cgroup/test_cpuset.c | 2 +- tools/testing/selftests/cgroup/test_freezer.c | 2 +- tools/testing/selftests/cgroup/test_hugetlb_memcg.c | 2 +- tools/testing/selftests/cgroup/test_kill.c | 2 +- tools/testing/selftests/cgroup/test_kmem.c | 2 +- tools/testing/selftests/cgroup/test_memcontrol.c | 2 +- tools/testing/selftests/cgroup/test_zswap.c | 2 +- 11 files changed, 20 insertions(+), 13 deletions(-) diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c index 0340d4ca8f51..432db923bced 100644 --- a/tools/testing/selftests/cgroup/cgroup_util.c +++ b/tools/testing/selftests/cgroup/cgroup_util.c @@ -195,10 +195,10 @@ int cg_write_numeric(const char *cgroup, const char *control, long value) return cg_write(cgroup, control, buf); } -int cg_find_unified_root(char *root, size_t len) +int cg_find_unified_root(char *root, size_t len, bool *nsdelegate) { char buf[10 * PAGE_SIZE]; - char *fs, *mount, *type; + char *fs, *mount, *type, *options; const char delim[] = "\n\t "; if (read_text("/proc/self/mounts", buf, sizeof(buf)) <= 0) @@ -211,12 +211,14 @@ int cg_find_unified_root(char *root, size_t len) for (fs = strtok(buf, delim); fs; fs = strtok(NULL, delim)) { mount = strtok(NULL, delim); type = strtok(NULL, delim); - strtok(NULL, delim); + options = strtok(NULL, delim); strtok(NULL, delim); strtok(NULL, delim); if (strcmp(type, "cgroup2") == 0) { strncpy(root, mount, len); + if (nsdelegate) + *nsdelegate = !!strstr(options, "nsdelegate"); return 0; } } diff --git a/tools/testing/selftests/cgroup/cgroup_util.h b/tools/testing/selftests/cgroup/cgroup_util.h index 1df7f202214a..89e8519fb271 100644 --- a/tools/testing/selftests/cgroup/cgroup_util.h +++ b/tools/testing/selftests/cgroup/cgroup_util.h @@ -21,7 +21,7 @@ static inline int values_close(long a, long b, int err) return abs(a - b) <= (a + b) / 100 * err; } -extern int cg_find_unified_root(char *root, size_t len); +extern int cg_find_unified_root(char *root, size_t len, bool *nsdelegate); extern char *cg_name(const char *root, const char *name); extern char *cg_name_indexed(const char *root, const char *name, int index); extern char *cg_control(const char *cgroup, const char *control); diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c index 80aa6b2373b9..a5672a91d273 100644 --- a/tools/testing/selftests/cgroup/test_core.c +++ b/tools/testing/selftests/cgroup/test_core.c @@ -18,6 +18,8 @@ #include "../kselftest.h" #include "cgroup_util.h" +static bool nsdelegate; + static int touch_anon(char *buf, size_t size) { int fd; @@ -775,6 +777,9 @@ static int test_cgcore_lesser_ns_open(const char *root) pid_t pid; int status; + if (!nsdelegate) + return KSFT_SKIP; + cg_test_a = cg_name(root, "cg_test_a"); cg_test_b = cg_name(root, "cg_test_b"); @@ -862,7 +867,7 @@ int main(int argc, char *argv[]) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), &nsdelegate)) ksft_exit_skip("cgroup v2 isn't mounted\n"); if (cg_read_strstr(root, "cgroup.subtree_control", "memory")) diff --git a/tools/testing/selftests/cgroup/test_cpu.c b/tools/testing/selftests/cgroup/test_cpu.c index 24020a2c68dc..186bf96f6a28 100644 --- a/tools/testing/selftests/cgroup/test_cpu.c +++ b/tools/testing/selftests/cgroup/test_cpu.c @@ -700,7 +700,7 @@ int main(int argc, char *argv[]) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); if (cg_read_strstr(root, "cgroup.subtree_control", "cpu")) diff --git a/tools/testing/selftests/cgroup/test_cpuset.c b/tools/testing/selftests/cgroup/test_cpuset.c index b061ed1e05b4..4034d14ba69a 100644 --- a/tools/testing/selftests/cgroup/test_cpuset.c +++ b/tools/testing/selftests/cgroup/test_cpuset.c @@ -249,7 +249,7 @@ int main(int argc, char *argv[]) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); if (cg_read_strstr(root, "cgroup.subtree_control", "cpuset")) diff --git a/tools/testing/selftests/cgroup/test_freezer.c b/tools/testing/selftests/cgroup/test_freezer.c index 8845353aca53..8730645d363a 100644 --- a/tools/testing/selftests/cgroup/test_freezer.c +++ b/tools/testing/selftests/cgroup/test_freezer.c @@ -827,7 +827,7 @@ int main(int argc, char *argv[]) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); for (i = 0; i < ARRAY_SIZE(tests); i++) { switch (tests[i].fn(root)) { diff --git a/tools/testing/selftests/cgroup/test_hugetlb_memcg.c b/tools/testing/selftests/cgroup/test_hugetlb_memcg.c index f0fefeb4cc24..856f9508ea56 100644 --- a/tools/testing/selftests/cgroup/test_hugetlb_memcg.c +++ b/tools/testing/selftests/cgroup/test_hugetlb_memcg.c @@ -214,7 +214,7 @@ int main(int argc, char **argv) return ret; } - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); switch (test_hugetlb_memcg(root)) { diff --git a/tools/testing/selftests/cgroup/test_kill.c b/tools/testing/selftests/cgroup/test_kill.c index 6153690319c9..0e5bb6c7307a 100644 --- a/tools/testing/selftests/cgroup/test_kill.c +++ b/tools/testing/selftests/cgroup/test_kill.c @@ -276,7 +276,7 @@ int main(int argc, char *argv[]) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); for (i = 0; i < ARRAY_SIZE(tests); i++) { switch (tests[i].fn(root)) { diff --git a/tools/testing/selftests/cgroup/test_kmem.c b/tools/testing/selftests/cgroup/test_kmem.c index c82f974b85c9..137506db0312 100644 --- a/tools/testing/selftests/cgroup/test_kmem.c +++ b/tools/testing/selftests/cgroup/test_kmem.c @@ -420,7 +420,7 @@ int main(int argc, char **argv) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); /* diff --git a/tools/testing/selftests/cgroup/test_memcontrol.c b/tools/testing/selftests/cgroup/test_memcontrol.c index c7c9572003a8..b462416b3806 100644 --- a/tools/testing/selftests/cgroup/test_memcontrol.c +++ b/tools/testing/selftests/cgroup/test_memcontrol.c @@ -1314,7 +1314,7 @@ int main(int argc, char **argv) char root[PATH_MAX]; int i, proc_status, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); /* diff --git a/tools/testing/selftests/cgroup/test_zswap.c b/tools/testing/selftests/cgroup/test_zswap.c index f0e488ed90d8..ef7f39545317 100644 --- a/tools/testing/selftests/cgroup/test_zswap.c +++ b/tools/testing/selftests/cgroup/test_zswap.c @@ -440,7 +440,7 @@ int main(int argc, char **argv) char root[PATH_MAX]; int i, ret = EXIT_SUCCESS; - if (cg_find_unified_root(root, sizeof(root))) + if (cg_find_unified_root(root, sizeof(root), NULL)) ksft_exit_skip("cgroup v2 isn't mounted\n"); if (!zswap_configured()) -- 2.39.3

1 year, 2 months

3
2
0 0

[PATCH v1 2/2] RISC-V: drop SOC_VIRT for ARCH_VIRT

by Conor Dooley

From: Conor Dooley <conor.dooley(a)microchip.com> The ARCH_ and SOC_ versions of this symbol have persisted for quite a while now in parallel. Generated .config files from previous LTS kernels should have both. Finally remove SOC_VIRT and update all config files using it. Signed-off-by: Conor Dooley <conor.dooley(a)microchip.com> --- I had a 1.5 year old ack from Jason that I dropped due to the passage of time. CC: Paul Walmsley <paul.walmsley(a)sifive.com> CC: Palmer Dabbelt <palmer(a)dabbelt.com> CC: Albert Ou <aou(a)eecs.berkeley.edu> CC: Brendan Higgins <brendan.higgins(a)linux.dev> CC: David Gow <davidgow(a)google.com> CC: Rae Moar <rmoar(a)google.com> CC: "Jason A. Donenfeld" <Jason(a)zx2c4.com> CC: Shuah Khan <shuah(a)kernel.org> CC: linux-riscv(a)lists.infradead.org CC: linux-kernel(a)vger.kernel.org CC: linux-kselftest(a)vger.kernel.org CC: kunit-dev(a)googlegroups.com CC: wireguard(a)lists.zx2c4.com CC: netdev(a)vger.kernel.org --- arch/riscv/Kconfig.socs | 3 --- arch/riscv/configs/defconfig | 2 +- arch/riscv/configs/nommu_virt_defconfig | 2 +- tools/testing/kunit/qemu_configs/riscv.py | 2 +- tools/testing/selftests/wireguard/qemu/arch/riscv32.config | 2 +- tools/testing/selftests/wireguard/qemu/arch/riscv64.config | 2 +- 6 files changed, 5 insertions(+), 8 deletions(-) diff --git a/arch/riscv/Kconfig.socs b/arch/riscv/Kconfig.socs index e85ffb63c48d..dcbfb659839c 100644 --- a/arch/riscv/Kconfig.socs +++ b/arch/riscv/Kconfig.socs @@ -52,9 +52,6 @@ config ARCH_THEAD This enables support for the RISC-V based T-HEAD SoCs. config ARCH_VIRT - def_bool SOC_VIRT - -config SOC_VIRT bool "QEMU Virt Machine" select CLINT_TIMER if RISCV_M_MODE select POWER_RESET diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig index ab3bab313d56..8d46a9137b1e 100644 --- a/arch/riscv/configs/defconfig +++ b/arch/riscv/configs/defconfig @@ -32,7 +32,7 @@ CONFIG_ARCH_SOPHGO=y CONFIG_SOC_STARFIVE=y CONFIG_ARCH_SUNXI=y CONFIG_ARCH_THEAD=y -CONFIG_SOC_VIRT=y +CONFIG_ARCH_VIRT=y CONFIG_SMP=y CONFIG_HOTPLUG_CPU=y CONFIG_PM=y diff --git a/arch/riscv/configs/nommu_virt_defconfig b/arch/riscv/configs/nommu_virt_defconfig index b794e2f8144e..de8143d1f738 100644 --- a/arch/riscv/configs/nommu_virt_defconfig +++ b/arch/riscv/configs/nommu_virt_defconfig @@ -24,7 +24,7 @@ CONFIG_EXPERT=y CONFIG_SLUB=y CONFIG_SLUB_TINY=y # CONFIG_MMU is not set -CONFIG_SOC_VIRT=y +CONFIG_ARCH_VIRT=y CONFIG_NONPORTABLE=y CONFIG_SMP=y CONFIG_CMDLINE="root=/dev/vda rw earlycon=uart8250,mmio,0x10000000,115200n8 console=ttyS0" diff --git a/tools/testing/kunit/qemu_configs/riscv.py b/tools/testing/kunit/qemu_configs/riscv.py index 12a1d525978a..c87758030ff7 100644 --- a/tools/testing/kunit/qemu_configs/riscv.py +++ b/tools/testing/kunit/qemu_configs/riscv.py @@ -13,7 +13,7 @@ if not os.path.isfile(OPENSBI_PATH): QEMU_ARCH = QemuArchParams(linux_arch='riscv', kconfig=''' -CONFIG_SOC_VIRT=y +CONFIG_ARCH_VIRT=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_OF_PLATFORM=y diff --git a/tools/testing/selftests/wireguard/qemu/arch/riscv32.config b/tools/testing/selftests/wireguard/qemu/arch/riscv32.config index 2fc36efb166d..2500eaa9b469 100644 --- a/tools/testing/selftests/wireguard/qemu/arch/riscv32.config +++ b/tools/testing/selftests/wireguard/qemu/arch/riscv32.config @@ -2,7 +2,7 @@ CONFIG_NONPORTABLE=y CONFIG_ARCH_RV32I=y CONFIG_MMU=y CONFIG_FPU=y -CONFIG_SOC_VIRT=y +CONFIG_ARCH_VIRT=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_OF_PLATFORM=y diff --git a/tools/testing/selftests/wireguard/qemu/arch/riscv64.config b/tools/testing/selftests/wireguard/qemu/arch/riscv64.config index dc266f3b1915..29a67ac67766 100644 --- a/tools/testing/selftests/wireguard/qemu/arch/riscv64.config +++ b/tools/testing/selftests/wireguard/qemu/arch/riscv64.config @@ -1,7 +1,7 @@ CONFIG_ARCH_RV64I=y CONFIG_MMU=y CONFIG_FPU=y -CONFIG_SOC_VIRT=y +CONFIG_ARCH_VIRT=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_OF_PLATFORM=y -- 2.43.0

1 year, 2 months

2
1
0 0

[PATCH v1 bpf-next 0/8] selftests/bpf: Add sockaddr tests for kernel networking

by Jordan Rife

In a follow up to these patches, - commit 0bdf399342c5("net: Avoid address overwrite in kernel_connect") - commit 86a7e0b69bd5("net: prevent rewrite of msg_name in sock_sendmsg()") - commit c889a99a21bf("net: prevent address rewrite in kernel_bind()") - commit 01b2885d9415("net: Save and restore msg_namelen in sock_sendmsg") this patch series introduces BPF selftests that test the interaction between BPF sockaddr hooks and socket operations in kernel space. It focuses on regression test coverage to ensure that these operations do not overwrite their address parameter and also provides some sanity checks around kernel_getpeername() and kernel_getsockname(). It introduces two new components: a kernel module called sock_addr_testmod and a new test program called sock_addr_kern which is loosely modeled after and adapted from the old-style bpf/test_sock_addr.c selftest. When loaded, the kernel module will perform some socket operation in kernel space. The kernel module accepts five parameters controlling which socket operation will be performed and its inputs: MODULE_PARM_DESC(ip, "IPv4/IPv6/Unix address to use for socket operation"); MODULE_PARM_DESC(port, "Port number to use for socket operation"); MODULE_PARM_DESC(af, "Address family (AF_INET, AF_INET6, or AF_UNIX)"); MODULE_PARM_DESC(type, "Socket type (SOCK_STREAM or SOCK_DGRAM)"); MODULE_PARM_DESC(op, "Socket operation (BIND=0, CONNECT=1, SENDMSG=2)"); On module init, the socket operation is performed and results of are exposed through debugfs. - /sys/kernel/debug/sock_addr_testmod/success Indicates success or failure of the operation. - /sys/kernel/debug/sock_addr_testmod/addr The value of the address parameter after the operation. - /sys/kernel/debug/sock_addr_testmod/sock_name The value of kernel_getsockname() after the socket operation (if relevant). - /sys/kernel/debug/sock_addr_testmod/peer_name The value of kernel_getpeername(() after the socket operation (if relevant). The sock_addr_kern test program loads and unloads the kernel module to drive kernel socket operations, reads the results from debugfs, makes sure that the operation did not overwrite the address, and any result from kernel_getpeername() or kernel_getsockname() were as expected. == Patches == - Patch 1 introduces sock_addr_testmod and functions necessary for the test program to load and unload the module. - Patches 2-6 transform existing test helpers and introduce new test helpers to enable the sock_addr_kern test program. - Patch 7 implements the sock_addr_kern test program. - Patch 8 fixes the sock_addr bind test program to work for big endian architectures such as s390x. Jordan Rife (8): selftests/bpf: Introduce sock_addr_testmod selftests/bpf: Add module load helpers selftests/bpf: Factor out cmp_addr selftests/bpf: Add recv_msg_from_client to network helpers selftests/bpf: Factor out load_path and defines from test_sock_addr selftests/bpf: Add setup/cleanup subcommands selftests/bpf: Add sock_addr_kern prog_test selftests/bpf: Fix bind program for big endian systems tools/testing/selftests/bpf/Makefile | 46 +- tools/testing/selftests/bpf/network_helpers.c | 65 ++ tools/testing/selftests/bpf/network_helpers.h | 5 + .../selftests/bpf/prog_tests/sock_addr.c | 34 - .../selftests/bpf/prog_tests/sock_addr_kern.c | 631 ++++++++++++++++++ .../testing/selftests/bpf/progs/bind4_prog.c | 18 +- .../testing/selftests/bpf/progs/bind6_prog.c | 18 +- tools/testing/selftests/bpf/progs/bind_prog.h | 19 + .../testing/selftests/bpf/sock_addr_helpers.c | 46 ++ .../testing/selftests/bpf/sock_addr_helpers.h | 44 ++ .../bpf/sock_addr_testmod/.gitignore | 6 + .../selftests/bpf/sock_addr_testmod/Makefile | 20 + .../bpf/sock_addr_testmod/sock_addr_testmod.c | 256 +++++++ tools/testing/selftests/bpf/test_sock_addr.c | 76 +-- tools/testing/selftests/bpf/test_sock_addr.sh | 10 +- tools/testing/selftests/bpf/testing_helpers.c | 44 +- tools/testing/selftests/bpf/testing_helpers.h | 2 + 17 files changed, 1196 insertions(+), 144 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/sock_addr_kern.c create mode 100644 tools/testing/selftests/bpf/progs/bind_prog.h create mode 100644 tools/testing/selftests/bpf/sock_addr_helpers.c create mode 100644 tools/testing/selftests/bpf/sock_addr_helpers.h create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/.gitignore create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/Makefile create mode 100644 tools/testing/selftests/bpf/sock_addr_testmod/sock_addr_testmod.c -- 2.44.0.478.gd926399ef9-goog

1 year, 2 months

3
14
0 0

[PATCH] Documentation: kunit: correct KUNIT_VERY_SLOW to KUNIT_SPEED_VERY_SLOW

by Kemeng Shi

There is no KUNIT_VERY_SLOW, I guess we mean KUNIT_SPEED_VERY_SLOW. Signed-off-by: Kemeng Shi <shikemeng(a)huaweicloud.com> --- Documentation/dev-tools/kunit/running_tips.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/dev-tools/kunit/running_tips.rst b/Documentation/dev-tools/kunit/running_tips.rst index bd689db6fdd2..482f598d141c 100644 --- a/Documentation/dev-tools/kunit/running_tips.rst +++ b/Documentation/dev-tools/kunit/running_tips.rst @@ -294,7 +294,7 @@ macro to define the test case instead of ``KUNIT_CASE(test_name)``. .. code-block:: c static const struct kunit_attributes example_attr = { - .speed = KUNIT_VERY_SLOW, + .speed = KUNIT_SPEED_VERY_SLOW, }; static struct kunit_case example_test_cases[] = { @@ -311,7 +311,7 @@ suite definition. .. code-block:: c static const struct kunit_attributes example_attr = { - .speed = KUNIT_VERY_SLOW, + .speed = KUNIT_SPEED_VERY_SLOW, }; static struct kunit_suite example_test_suite = { -- 2.30.0

1 year, 2 months

3
2
0 0

[PATCH net 0/2] mptcp: fix fallback MIB counter and wrong var in selftests

by Matthieu Baerts (NGI0)

Here are two fixes related to MPTCP. The first patch fixes when the MPTcpExtMPCapableFallbackACK MIB counter is modified: it should only be incremented when a connection was using MPTCP options, but then a fallback to TCP has been done. This patch also checks the counter is not incremented by mistake during the connect selftests. This counter was wrongly incremented since its introduction in v5.7. The second patch fixes a wrong parsing of the 'dev' endpoint options in the selftests: the wrong variable was used. This option was not used before, but it is going to be soon. This issue is visible since v5.18. Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> --- Davide Caratti (1): mptcp: don't account accept() of non-MPC client as fallback to TCP Geliang Tang (1): selftests: mptcp: join: fix dev in check_endpoint net/mptcp/protocol.c | 2 -- net/mptcp/subflow.c | 2 ++ tools/testing/selftests/net/mptcp/mptcp_connect.sh | 9 +++++++++ tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 +++- 4 files changed, 14 insertions(+), 3 deletions(-) --- base-commit: 0ba80d96585662299d4ea4624043759ce9015421 change-id: 20240329-upstream-net-20240329-fallback-mib-b0fec9c6189b Best regards, -- Matthieu Baerts (NGI0) <matttbe(a)kernel.org>

1 year, 2 months

2
3
0 0

[PATCH net] selftests: reuseaddr_conflict: add missing new line at the end of the output

by Jakub Kicinski

The netdev CI runs in a VM and captures serial, so stdout and stderr get combined. Because there's a missing new line in stderr the test ends up corrupting KTAP: # Successok 1 selftests: net: reuseaddr_conflict which should have been: # Success ok 1 selftests: net: reuseaddr_conflict Fixes: 422d8dc6fd3a ("selftest: add a reuseaddr test") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> --- Low risk and seems worth backporting to stable, hence the fixes tag. CC: shuah(a)kernel.org CC: jbacik(a)fb.com CC: linux-kselftest(a)vger.kernel.org --- tools/testing/selftests/net/reuseaddr_conflict.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/net/reuseaddr_conflict.c b/tools/testing/selftests/net/reuseaddr_conflict.c index 7c5b12664b03..bfb07dc49518 100644 --- a/tools/testing/selftests/net/reuseaddr_conflict.c +++ b/tools/testing/selftests/net/reuseaddr_conflict.c @@ -109,6 +109,6 @@ int main(void) fd1 = open_port(0, 1); if (fd1 >= 0) error(1, 0, "Was allowed to create an ipv4 reuseport on an already bound non-reuseport socket with no ipv6"); - fprintf(stderr, "Success"); + fprintf(stderr, "Success\n"); return 0; } -- 2.44.0

1 year, 2 months

3
2
0 0

[PATCH v2 00/27] riscv control-flow integrity for usermode

by Deepak Gupta

I had sent RFC patchset early this year (January) [7] to enable CPU assisted control-flow integrity for usermode on riscv. Since then I've been able to do more testing of the changes. As part of testing effort, compiled a rootfs with shadow stack and landing pad enabled (libraries and binaries) and booted to shell. As part of long running tests, I have been able to run some spec 2006 benchmarks [8] (here link is provided only for list of benchmarks that were tested for long running tests, excel sheet provided here actually is for some static stats like code size growth on spec binaries). Thus converting from RFC to regular patchset. Securing control-flow integrity for usermode requires following - Securing forward control flow : All callsites must reach reach a target that they actually intend to reach. - Securing backward control flow : All function returns must return to location where they were called from. This patch series use riscv cpu extension `zicfilp` [2] to secure forward control flow and `zicfiss` [2] to secure backward control flow. `zicfilp` enforces that all indirect calls or jmps must land on a landing pad instr and label embedded in landing pad instr must match a value programmed in `x7` register (at callsite via compiler). `zicfiss` introduces shadow stack which can only be writeable via shadow stack instructions (sspush and ssamoswap) and thus can't be tampered with via inadvertent stores. More details about extension can be read from [2] and there are details in documentation as well (in this patch series). Using config `CONFIG_RISCV_USER_CFI`, kernel support for riscv control flow integrity for user mode programs can be compiled in the kernel. Enabling of control flow integrity for user programs is left to user runtime (specifically expected from dynamic loader). There has been a lot of earlier discussion on the enabling topic around x86 shadow stack enabling [3, 4, 5] and overall consensus had been to let dynamic loader (or usermode) to decide for enabling the feature. This patch series introduces arch agnostic `prctls` to enable shadow stack and indirect branch tracking. And implements them on riscv. arm64 is expected to implement shadow stack part of these arch agnostic `prctls` [6] Changes since last time *********************** Spec changes ------------ - Forward cfi spec has become much simpler. `lpad` instruction is pseudo for `auipc rd, <20bit_imm>`. `lpad` checks x7 against 20bit embedded in instr. Thus label width is 20bit. - Shadow stack management instructions are reduced to sspush - to push x1/x5 on shadow stack sspopchk - pops from shadow stack and comapres with x1/x5. ssamoswap - atomically swap value on shadow stack. rdssp - reads current shadow stack pointer - Shadow stack accesses on readonly memory always raise AMO/store page fault. `sspopchk` is load but if underlying page is readonly, it'll raise a store page fault. It simplifies hardware and kernel for COW handling for shadow stack pages. - riscv defines a new exception type `software check exception` and control flow violations raise software check exception. - enabling controls for shadow stack and landing are in xenvcfg CSR and controls lower privilege mode enabling. As an example senvcfg controls enabling for U and menvcfg controls enabling for S mode. core mm shadow stack enabling ----------------------------- Shadow stack for x86 usermode are now in mainline and thus this patch series builds on top of that for arch-agnostic mm related changes. Big thanks and shout out to Rick Edgecombe for that. selftests --------- Created some minimal selftests to test the patch series. [1] - https://lore.kernel.org/lkml/20230213045351.3945824-1-debug@rivosinc.com/ [2] - https://github.com/riscv/riscv-cfi [3] - https://lore.kernel.org/lkml/ZWHcBq0bJ+15eeKs@finisterre.sirena.org.uk/T/#m… [4] - https://lore.kernel.org/all/20220130211838.8382-1-rick.p.edgecombe@intel.co… [5] - https://lore.kernel.org/lkml/CAHk-=wgP5mk3poVeejw16Asbid0ghDt4okHnWaWKLBkRh… [6] - https://lore.kernel.org/linux-mm/20231122-arm64-gcs-v7-2-201c483bd775@kerne… [7] - https://lore.kernel.org/lkml/20240125062739.1339782-1-debug@rivosinc.com/ [8] - https://docs.google.com/spreadsheets/d/1_cHGH4ctNVvFRiS7hW9dEGKtXLAJ3aX4Z_i… Deepak Gupta (26): riscv: envcfg save and restore on task switching riscv: define default value for envcfg riscv/Kconfig: enable HAVE_EXIT_THREAD for riscv riscv: zicfiss/zicfilp enumeration riscv: zicfiss/zicfilp extension csr and bit definitions riscv: usercfi state for task and save/restore of CSR_SSP on trap entry/exit mm: Define VM_SHADOW_STACK for RISC-V mm: abstract shadow stack vma behind `arch_is_shadow_stack` riscv/mm : ensure PROT_WRITE leads to VM_READ | VM_WRITE riscv mm: manufacture shadow stack pte riscv mmu: teach pte_mkwrite to manufacture shadow stack PTEs riscv mmu: write protect and shadow stack riscv/mm: Implement map_shadow_stack() syscall riscv/shstk: If needed allocate a new shadow stack on clone prctl: arch-agnostic prtcl for indirect branch tracking riscv: Implements arch agnostic shadow stack prctls riscv: Implements arch argnostic indirect branch tracking prctls riscv/kernel: update __show_regs to print shadow stack register riscv/traps: Introduce software check exception riscv sigcontext: adding cfi state field in sigcontext riscv signal: Save and restore of shadow stack for signal riscv/ptrace: riscv cfi status and state via ptrace and in core files riscv: create a config for shadow stack and landing pad instr support riscv: Documentation for landing pad / indirect branch tracking riscv: Documentation for shadow stack on riscv kselftest/riscv: kselftest for user mode cfi Mark Brown (1): prctl: arch-agnostic prctl for shadow stack Documentation/arch/riscv/zicfilp.rst | 104 ++++ Documentation/arch/riscv/zicfiss.rst | 169 ++++++ .../devicetree/bindings/riscv/extensions.yaml | 10 + arch/riscv/Kconfig | 19 + arch/riscv/include/asm/asm-prototypes.h | 1 + arch/riscv/include/asm/cpufeature.h | 13 + arch/riscv/include/asm/csr.h | 18 + arch/riscv/include/asm/hwcap.h | 2 + arch/riscv/include/asm/mman.h | 24 + arch/riscv/include/asm/pgtable.h | 32 +- arch/riscv/include/asm/processor.h | 2 + arch/riscv/include/asm/switch_to.h | 10 + arch/riscv/include/asm/thread_info.h | 4 + arch/riscv/include/asm/usercfi.h | 118 ++++ arch/riscv/include/uapi/asm/ptrace.h | 18 + arch/riscv/include/uapi/asm/sigcontext.h | 5 + arch/riscv/kernel/Makefile | 2 + arch/riscv/kernel/asm-offsets.c | 4 + arch/riscv/kernel/cpufeature.c | 2 + arch/riscv/kernel/entry.S | 29 + arch/riscv/kernel/process.c | 35 +- arch/riscv/kernel/ptrace.c | 83 +++ arch/riscv/kernel/signal.c | 45 ++ arch/riscv/kernel/sys_riscv.c | 11 + arch/riscv/kernel/traps.c | 38 ++ arch/riscv/kernel/usercfi.c | 510 ++++++++++++++++++ arch/riscv/mm/init.c | 2 +- arch/riscv/mm/pgtable.c | 21 + include/linux/mm.h | 35 +- include/uapi/asm-generic/mman.h | 1 + include/uapi/linux/elf.h | 1 + include/uapi/linux/prctl.h | 49 ++ kernel/sys.c | 60 +++ mm/gup.c | 5 +- mm/internal.h | 2 +- mm/mmap.c | 1 + tools/testing/selftests/riscv/Makefile | 2 +- tools/testing/selftests/riscv/cfi/Makefile | 10 + .../testing/selftests/riscv/cfi/cfi_rv_test.h | 85 +++ .../selftests/riscv/cfi/riscv_cfi_test.c | 91 ++++ .../testing/selftests/riscv/cfi/shadowstack.c | 376 +++++++++++++ .../testing/selftests/riscv/cfi/shadowstack.h | 39 ++ 42 files changed, 2077 insertions(+), 11 deletions(-) create mode 100644 Documentation/arch/riscv/zicfilp.rst create mode 100644 Documentation/arch/riscv/zicfiss.rst create mode 100644 arch/riscv/include/asm/mman.h create mode 100644 arch/riscv/include/asm/usercfi.h create mode 100644 arch/riscv/kernel/usercfi.c create mode 100644 tools/testing/selftests/riscv/cfi/Makefile create mode 100644 tools/testing/selftests/riscv/cfi/cfi_rv_test.h create mode 100644 tools/testing/selftests/riscv/cfi/riscv_cfi_test.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.c create mode 100644 tools/testing/selftests/riscv/cfi/shadowstack.h -- 2.43.2

1 year, 2 months

4
36
0 0

[PATCH bpf-next v2 0/9] bpf: make tracing program support multi-link

by Menglong Dong

For now, the BPF program of type BPF_PROG_TYPE_TRACING is not allowed to be attached to multiple hooks, and we have to create a BPF program for each kernel function, for which we want to trace, even through all the program have the same (or similar) logic. This can consume extra memory, and make the program loading slow if we have plenty of kernel function to trace. In this series, we add the support to allow attaching a tracing BPF program to multi hooks, which is similar to BPF_TRACE_KPROBE_MULTI. In the 1st patch, we add the support to record index of the accessed function args of the target for tracing program. Meanwhile, we add the function btf_check_func_part_match() to compare the accessed function args of two function prototype. This function will be used in the next commit. In the 2nd patch, we refactor the struct modules_array to ptr_array, as we need similar function to hold the target btf, target program and kernel modules that we reference to in the following commit. In the 3rd patch, we introduce the struct bpf_tramp_link_conn to be the bridge between bpf_link and trampoline, as the releation between bpf_link and trampoline is not one-to-one anymore. In the 4th patch, we add the struct bpf_tramp_multi_link and bpf_trampoline_multi_{link,unlink}_prog for multi-link of trampoline. In the 5th patch, we add target btf to the function args of bpf_check_attach_target(), then the caller can specify the btf to check. The 6th patch is the main part to add multi-link supporting for tracing. For now, only the following attach type is supported: BPF_TRACE_FENTRY_MULTI BPF_TRACE_FEXIT_MULTI BPF_MODIFY_RETURN_MULTI The attach type of BPF_TRACE_RAW_TP has different link type, so we skip this part in this series for now. In the 7th and 8th patches, we add multi-link supporting of tracing to libbpf. Note that we don't free btfs that we load after the bpf programs are loaded into the kernel now if any programs of type tracing multi-link existing, as we need to lookup the btf types during attaching. In the 9th patch, we add the testcases for this series. Changes since v1: - According to the advice of Alexei, introduce multi-link for tracing instead of attaching a tracing program to multiple trampolines with creating multi instance of bpf_link. Menglong Dong (9): bpf: tracing: add support to record and check the accessed args bpf: refactor the modules_array to ptr_array bpf: trampoline: introduce struct bpf_tramp_link_conn bpf: trampoline: introduce bpf_tramp_multi_link bpf: verifier: add btf to the function args of bpf_check_attach_target bpf: tracing: add multi-link support libbpf: don't free btf if program of multi-link tracing existing libbpf: add support for the multi-link of tracing selftests/bpf: add testcases for multi-link of tracing arch/arm64/net/bpf_jit_comp.c | 4 +- arch/riscv/net/bpf_jit_comp64.c | 4 +- arch/s390/net/bpf_jit_comp.c | 4 +- arch/x86/net/bpf_jit_comp.c | 4 +- include/linux/bpf.h | 51 ++- include/linux/bpf_verifier.h | 1 + include/uapi/linux/bpf.h | 10 + kernel/bpf/bpf_struct_ops.c | 2 +- kernel/bpf/btf.c | 113 ++++- kernel/bpf/syscall.c | 425 +++++++++++++++++- kernel/bpf/trampoline.c | 97 +++- kernel/bpf/verifier.c | 24 +- kernel/trace/bpf_trace.c | 48 +- net/bpf/test_run.c | 3 + net/core/bpf_sk_storage.c | 2 + tools/bpf/bpftool/common.c | 3 + tools/include/uapi/linux/bpf.h | 10 + tools/lib/bpf/bpf.c | 10 + tools/lib/bpf/bpf.h | 6 + tools/lib/bpf/libbpf.c | 215 ++++++++- tools/lib/bpf/libbpf.h | 16 + tools/lib/bpf/libbpf.map | 2 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 49 ++ .../bpf/prog_tests/tracing_multi_link.c | 153 +++++++ .../selftests/bpf/progs/tracing_multi_test.c | 209 +++++++++ 25 files changed, 1366 insertions(+), 99 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/tracing_multi_link.c create mode 100644 tools/testing/selftests/bpf/progs/tracing_multi_test.c -- 2.39.2

1 year, 2 months

8
49
0 0

[PATCH v1 0/3] Add a test case for KVM_X86_DISABLE_EXIT

by Manali Shukla

By default, HLT instruction executed by guest is intercepted by hypervisor. However, KVM_CAP_X86_DISABLE_EXITS capability can be used to not intercept HLT by setting KVM_X86_DISABLE_EXITS_HLT. By default, vms are created with in-kernel APIC support in KVM selftests. VM needs to be created without in-kernel APIC support for this test, so that HLT will exit to userspace. To do so, __vm_create() is modified to not call KVM_CREATE_IRQCHIP ioctl while creating vm. Add a test case to test KVM_X86_DISABLE_EXITS_HLT functionality. Patch 1, 2 -> Preparatory patches to add the KVM_X86_DISABLE_EXITS_HLT test case Patch 3 -> Adds a test case for KVM_X86_DISABLE_EXITS_HLT Testing done: Tested KVM_X86_DISABLE_EXITS_HLT test case on AMD and Intel machines. Manali Shukla (3): KVM: selftests: Add safe_halt() and cli() helpers to common code KVM: selftests: Change __vm_create() to create a vm without in-kernel APIC KVM: selftests: Add a test case for KVM_X86_DISABLE_EXITS_HLT tools/testing/selftests/kvm/Makefile | 1 + tools/testing/selftests/kvm/dirty_log_test.c | 2 +- .../selftests/kvm/include/kvm_util_base.h | 4 +- .../selftests/kvm/include/x86_64/processor.h | 17 +++ tools/testing/selftests/kvm/lib/kvm_util.c | 11 +- .../kvm/x86_64/halt_disable_exit_test.c | 113 ++++++++++++++++++ .../kvm/x86_64/ucna_injection_test.c | 2 +- 7 files changed, 143 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/kvm/x86_64/halt_disable_exit_test.c base-commit: e9da6f08edb0bd4c621165496778d77a222e1174 -- 2.34.1

1 year, 2 months

3
10
0 0

[PATCH bpf-next v2] selftests/bpf: Move test_dev_cgroup to prog_tests

by Muhammad Usama Anjum

Move test_dev_cgroup.c to prog_tests/dev_cgroup.c to be able to run it with test_progs. Replace dev_cgroup.bpf.o with skel header file, dev_cgroup.skel.h and load program from it accourdingly. ./test_progs -t test_dev_cgroup mknod: /tmp/test_dev_cgroup_null: Operation not permitted 64+0 records in 64+0 records out 32768 bytes (33 kB, 32 KiB) copied, 0.000856684 s, 38.2 MB/s dd: failed to open '/dev/full': Operation not permitted dd: failed to open '/dev/random': Operation not permitted #365 test_dev_cgroup:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Muhammad Usama Anjum <usama.anjum(a)collabora.com> --- I've tested the patch with vmtest.sh on bpf-next/for-next and linux next. It is passing on both. Not sure why it was failed on BPFCI. Test run with vmtest.h: sudo LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh ./test_progs -t dev_cgroup ./test_progs -t dev_cgroup mknod: /tmp/test_dev_cgroup_null: Operation not permitted 64+0 records in 64+0 records out 32768 bytes (33 kB, 32 KiB) copied, 0.000403432 s, 81.2 MB/s dd: failed to open '/dev/full': Operation not permitted dd: failed to open '/dev/random': Operation not permitted #69 dev_cgroup:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Changes since v1: - Rename file from test_dev_cgroup.c to dev_cgroup.c - Use ASSERT_* in-place of CHECK --- .../selftests/bpf/prog_tests/dev_cgroup.c | 58 +++++++++++++ tools/testing/selftests/bpf/test_dev_cgroup.c | 85 ------------------- 2 files changed, 58 insertions(+), 85 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/dev_cgroup.c delete mode 100644 tools/testing/selftests/bpf/test_dev_cgroup.c diff --git a/tools/testing/selftests/bpf/prog_tests/dev_cgroup.c b/tools/testing/selftests/bpf/prog_tests/dev_cgroup.c new file mode 100644 index 0000000000000..980b015a116ff --- /dev/null +++ b/tools/testing/selftests/bpf/prog_tests/dev_cgroup.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* Copyright (c) 2017 Facebook + */ + +#include <test_progs.h> +#include <time.h> +#include "cgroup_helpers.h" +#include "dev_cgroup.skel.h" + +#define TEST_CGROUP "/test-bpf-based-device-cgroup/" + +void test_dev_cgroup(void) +{ + struct dev_cgroup *skel; + int cgroup_fd, err; + __u32 prog_cnt; + + skel = dev_cgroup__open_and_load(); + if (!ASSERT_OK_PTR(skel, "skel_open_and_load")) + goto cleanup; + + cgroup_fd = cgroup_setup_and_join(TEST_CGROUP); + if (!ASSERT_GT(cgroup_fd, 0, "cgroup_setup_and_join")) + goto cleanup; + + err = bpf_prog_attach(bpf_program__fd(skel->progs.bpf_prog1), cgroup_fd, + BPF_CGROUP_DEVICE, 0); + if (!ASSERT_EQ(err, 0, "bpf_attach")) + goto cleanup; + + err = bpf_prog_query(cgroup_fd, BPF_CGROUP_DEVICE, 0, NULL, NULL, &prog_cnt); + if (!ASSERT_EQ(err, 0, "bpf_query") || (!ASSERT_EQ(prog_cnt, 1, "bpf_query"))) + goto cleanup; + + /* All operations with /dev/zero and /dev/urandom are allowed, + * everything else is forbidden. + */ + ASSERT_EQ(system("rm -f /tmp/test_dev_cgroup_null"), 0, "rm"); + ASSERT_NEQ(system("mknod /tmp/test_dev_cgroup_null c 1 3"), 0, "mknod"); + ASSERT_EQ(system("rm -f /tmp/test_dev_cgroup_null"), 0, "rm"); + + /* /dev/zero is whitelisted */ + ASSERT_EQ(system("rm -f /tmp/test_dev_cgroup_zero"), 0, "rm"); + ASSERT_EQ(system("mknod /tmp/test_dev_cgroup_zero c 1 5"), 0, "mknod"); + ASSERT_EQ(system("rm -f /tmp/test_dev_cgroup_zero"), 0, "rm"); + + ASSERT_EQ(system("dd if=/dev/urandom of=/dev/zero count=64"), 0, "dd"); + + /* src is allowed, target is forbidden */ + ASSERT_NEQ(system("dd if=/dev/urandom of=/dev/full count=64"), 0, "dd"); + + /* src is forbidden, target is allowed */ + ASSERT_NEQ(system("dd if=/dev/random of=/dev/zero count=64"), 0, "dd"); + +cleanup: + cleanup_cgroup_environment(); + dev_cgroup__destroy(skel); +} diff --git a/tools/testing/selftests/bpf/test_dev_cgroup.c b/tools/testing/selftests/bpf/test_dev_cgroup.c deleted file mode 100644 index adeaf63cb6fa3..0000000000000 --- a/tools/testing/selftests/bpf/test_dev_cgroup.c +++ /dev/null @@ -1,85 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-only -/* Copyright (c) 2017 Facebook - */ - -#include <stdio.h> -#include <stdlib.h> -#include <string.h> -#include <errno.h> -#include <assert.h> -#include <sys/time.h> - -#include <linux/bpf.h> -#include <bpf/bpf.h> -#include <bpf/libbpf.h> - -#include "cgroup_helpers.h" -#include "testing_helpers.h" - -#define DEV_CGROUP_PROG "./dev_cgroup.bpf.o" - -#define TEST_CGROUP "/test-bpf-based-device-cgroup/" - -int main(int argc, char **argv) -{ - struct bpf_object *obj; - int error = EXIT_FAILURE; - int prog_fd, cgroup_fd; - __u32 prog_cnt; - - /* Use libbpf 1.0 API mode */ - libbpf_set_strict_mode(LIBBPF_STRICT_ALL); - - if (bpf_prog_test_load(DEV_CGROUP_PROG, BPF_PROG_TYPE_CGROUP_DEVICE, - &obj, &prog_fd)) { - printf("Failed to load DEV_CGROUP program\n"); - goto out; - } - - cgroup_fd = cgroup_setup_and_join(TEST_CGROUP); - if (cgroup_fd < 0) { - printf("Failed to create test cgroup\n"); - goto out; - } - - /* Attach bpf program */ - if (bpf_prog_attach(prog_fd, cgroup_fd, BPF_CGROUP_DEVICE, 0)) { - printf("Failed to attach DEV_CGROUP program"); - goto err; - } - - if (bpf_prog_query(cgroup_fd, BPF_CGROUP_DEVICE, 0, NULL, NULL, - &prog_cnt)) { - printf("Failed to query attached programs"); - goto err; - } - - /* All operations with /dev/zero and and /dev/urandom are allowed, - * everything else is forbidden. - */ - assert(system("rm -f /tmp/test_dev_cgroup_null") == 0); - assert(system("mknod /tmp/test_dev_cgroup_null c 1 3")); - assert(system("rm -f /tmp/test_dev_cgroup_null") == 0); - - /* /dev/zero is whitelisted */ - assert(system("rm -f /tmp/test_dev_cgroup_zero") == 0); - assert(system("mknod /tmp/test_dev_cgroup_zero c 1 5") == 0); - assert(system("rm -f /tmp/test_dev_cgroup_zero") == 0); - - assert(system("dd if=/dev/urandom of=/dev/zero count=64") == 0); - - /* src is allowed, target is forbidden */ - assert(system("dd if=/dev/urandom of=/dev/full count=64")); - - /* src is forbidden, target is allowed */ - assert(system("dd if=/dev/random of=/dev/zero count=64")); - - error = 0; - printf("test_dev_cgroup:PASS\n"); - -err: - cleanup_cgroup_environment(); - -out: - return error; -} -- 2.42.0

1 year, 2 months

1
3
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror March 2024