- Linux-kselftest-mirror - lists.linaro.org

[PATCH 0/9] Create a userfaultfd demand paging test

by Ben Gardon

When handling page faults for many vCPUs during demand paging, KVM's MMU lock becomes highly contended. This series creates a test with a naive userfaultfd based demand paging implementation to demonstrate that contention. This test serves both as a functional test of userfaultfd and a microbenchmark of demand paging performance with a variable number of vCPUs and memory per vCPU. The test creates N userfaultfd threads, N vCPUs, and a region of memory with M pages per vCPU. The N userfaultfd polling threads are each set up to serve faults on a region of memory corresponding to one of the vCPUs. Each of the vCPUs is then started, and touches each page of its disjoint memory region, sequentially. In response to faults, the userfaultfd threads copy a static buffer into the guest's memory. This creates a worst case for MMU lock contention as we have removed most of the contention between the userfaultfd threads and there is no time required to fetch the contents of guest memory. This test was run successfully on Intel Haswell, Broadwell, and Cascadelake hosts with a variety of vCPU counts and memory sizes. This test was adapted from the dirty_log_test. The series can also be viewed in Gerrit here: https://linux-review.googlesource.com/c/virt/kvm/kvm/+/1464 (Thanks to Dmitry Vyukov <dvyukov(a)google.com> for setting up the Gerrit instance) Ben Gardon (9): KVM: selftests: Create a demand paging test KVM: selftests: Add demand paging content to the demand paging test KVM: selftests: Add memory size parameter to the demand paging test KVM: selftests: Pass args to vCPU instead of using globals KVM: selftests: Support multiple vCPUs in demand paging test KVM: selftests: Time guest demand paging KVM: selftests: Add parameter to _vm_create for memslot 0 base paddr KVM: selftests: Support large VMs in demand paging test Add static flag tools/testing/selftests/kvm/.gitignore | 1 + tools/testing/selftests/kvm/Makefile | 4 +- .../selftests/kvm/demand_paging_test.c | 610 ++++++++++++++++++ tools/testing/selftests/kvm/dirty_log_test.c | 2 +- .../testing/selftests/kvm/include/kvm_util.h | 3 +- tools/testing/selftests/kvm/lib/kvm_util.c | 7 +- 6 files changed, 621 insertions(+), 6 deletions(-) create mode 100644 tools/testing/selftests/kvm/demand_paging_test.c -- 2.23.0.444.g18eeb5a265-goog

5 years, 9 months

3
13
0 0

[PATCH v2] selftests: kvm: Fix libkvm build error

by Shuah Khan

Fix the following build error from "make TARGETS=kvm kselftest": libkvm.a(assert.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a PIE object; recompile with -fPIC This error is seen when build is done from the main Makefile using kselftest target. In this case KBUILD_CPPFLAGS and CC_OPTION_CFLAGS are defined. When build is invoked using: "make -C tools/testing/selftests/kvm" KBUILD_CPPFLAGS and CC_OPTION_CFLAGS aren't defined. There is no need to pass in KBUILD_CPPFLAGS and CC_OPTION_CFLAGS for the check to determine if --no-pie is necessary1s, which is the when these two aren't defined when "make -C tools/testing/selftests/kvm" runs. Fix it by simplifying the no-pie-option logic. With this change, bith build variations work. "make TARGETS=kvm kselftest" "make -C tools/testing/selftests/kvm" Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- tools/testing/selftests/kvm/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile index 62c591f87dab..02d20aab9440 100644 --- a/tools/testing/selftests/kvm/Makefile +++ b/tools/testing/selftests/kvm/Makefile @@ -48,8 +48,9 @@ CFLAGS += -Wall -Wstrict-prototypes -Wuninitialized -O2 -g -std=gnu99 \ -I$(LINUX_HDR_PATH) -Iinclude -I$(<D) -Iinclude/$(UNAME_M) -I.. no-pie-option := $(call try-run, echo 'int main() { return 0; }' | \ - $(CC) -Werror $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -no-pie -x c - -o "$$TMP", -no-pie) + $(CC) -Werror -no-pie -x c - -o "$$TMP", -no-pie) +# # On s390, build the testcases KVM-enabled pgste-option = $(call try-run, echo 'int main() { return 0; }' | \ $(CC) -Werror -Wl$(comma)--s390-pgste -x c - -o "$$TMP",-Wl$(comma)--s390-pgste) -- 2.20.1

5 years, 9 months

1
0
0 0

Re: [PATCH v3 1/2] selftests: watchdog: Validate optional file argument

by Eugeniu Rosca

Hi Shuah, On Tue, Oct 01, 2019 at 08:41:43PM +0000, patchwork-bot+linux-kselftest(a)kernel.org wrote: > Hello: > > This series was applied to shuah/linux-kselftest.git (refs/heads/fixes). > > On Tue, 17 Sep 2019 20:40:22 +0200 you wrote: > > From: "George G. Davis" <george_davis(a)mentor.com> > > > > The newly added optional file argument does not validate if the > > file is indeed a watchdog, e.g.: > > > > ./watchdog-test -f /dev/zero > > Watchdog Ticking Away! > > > > [...] > > Here is a summary with links: > - [v3,1/2] selftests: watchdog: Validate optional file argument > https://git.kernel.org/shuah/linux-kselftest/c/93c384f5d553bc4fdfb252b89ff3… Could you please update the 'Fixes:' tag in the above commit to: Fixes: a4864a33f56caa ("selftests: watchdog: Add optional file argument") The warning in https://patchwork.kernel.org/patch/11149287/ clearly says that the fixed commit is from linux-next and it seems to have been updated before landing in mainline. TIA. -- Best Regards, Eugeniu

5 years, 9 months

2
1
0 0

next-20191001 kselftest results

by ci_notify＠linaro.org

Summary ------------------------------------------------------------------------ kernel: 5.4.0-rc1 git repo: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git git branch: master git commit: afb37288faaa88577b2b4d3b484bdcc85f311ea5 git describe: next-20191001 Test details: https://qa-reports.linaro.org/lkft/linux-next-oe/build/next-20191001 Regressions (compared to build next-20190930) ------------------------------------------------------------------------ qemu_arm: kselftest: * timers_rtcpie i386: kselftest: * bpf_test_sock_addr.sh Fixes (compared to build next-20190930) ------------------------------------------------------------------------ x86_64: kselftest-vsyscall-mode-native: * bpf_test_sock_addr.sh qemu_x86_64: kselftest: * net_udpgso_bench.sh In total: ------------------------------------------------------------------------ Ran 1731 total tests in the following environments and test suites. pass 1033 fail 581 xfail 0 skip 117 Environments -------------- - dragonboard-410c - arm64 - hi6220-hikey - arm64 - i386 - juno-r2 - arm64 - qemu_arm - qemu_arm64 - qemu_i386 - qemu_x86_64 - x15 - arm - x86_64 Test Suites ----------- * kselftest * kselftest-vsyscall-mode-native * kselftest-vsyscall-mode-none Failures ------------------------------------------------------------------------ qemu_x86_64: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/cpufreq_main.sh * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_platform_info_test * kselftest/kvm_set_sregs_test * kselftest/kvm_smm_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/lib_bitmap.sh * kselftest/lib_prime_numbers.sh * kselftest/lib_printf.sh * kselftest/lib_strscpy.sh * kselftest/net_fib-onlink-tests.sh * kselftest/net_fib_tests.sh * kselftest/net_ip_defrag.sh * kselftest/net_l2tp.sh * kselftest/net_pmtu.sh * kselftest/net_psock_snd.sh * kselftest/net_run_netsocktests * kselftest/net_tcp_fastopen_backup_key.sh * kselftest/net_test_vxlan_under_vrf.sh * kselftest/net_xfrm_policy.sh * kselftest/pidfd_pidfd_open_test * kselftest/pidfd_pidfd_poll_test * kselftest/pstore_pstore_tests * kselftest/timestamping_txtimestamp.sh * kselftest/tpm2_test_smoke.sh * kselftest/tpm2_test_space.sh * kselftest/x86_fsgsbase_64 qemu_i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_sysctl * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/cpufreq_main.sh * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_mmio_warning_test * kselftest/kvm_platform_info_test * kselftest/kvm_set_sregs_test * kselftest/kvm_smm_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/kvm_vmx_close_while_nested_test * kselftest/kvm_vmx_set_nested_state_test * kselftest/kvm_vmx_tsc_adjust_test * kselftest/lib_bitmap.sh * kselftest/lib_prime_numbers.sh * kselftest/lib_printf.sh * kselftest/lib_strscpy.sh * kselftest/net_fib-onlink-tests.sh * kselftest/net_fib_tests.sh * kselftest/netfilter_conntrack_icmp_related.sh * kselftest/netfilter_nft_nat.sh * kselftest/net_ip_defrag.sh * kselftest/net_l2tp.sh * kselftest/net_pmtu.sh * kselftest/net_psock_snd.sh * kselftest/net_run_netsocktests * kselftest/net_tcp_fastopen_backup_key.sh * kselftest/net_test_vxlan_under_vrf.sh * kselftest/net_xfrm_policy.sh * kselftest/pidfd_pidfd_open_test * kselftest/pidfd_pidfd_poll_test * kselftest/proc_proc-self-map-files-002 * kselftest/proc_proc-self-syscall * kselftest/pstore_pstore_tests * kselftest/seccomp_seccomp_bpf * kselftest/size_get_size * kselftest/timestamping_txtimestamp.sh * kselftest/tpm2_test_smoke.sh * kselftest/tpm2_test_space.sh * kselftest/x86_sigreturn_32 qemu_arm: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_sysctl * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcp_check_syncookie.sh * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_verifier * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/cgroup_test_freezer * kselftest/cpufreq_main.sh * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_mmio_warning_test * kselftest/kvm_platform_info_test * kselftest/kvm_set_sregs_test * kselftest/kvm_smm_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/kvm_vmx_close_while_nested_test * kselftest/kvm_vmx_set_nested_state_test * kselftest/kvm_vmx_tsc_adjust_test * kselftest/lib_bitmap.sh * kselftest/lib_prime_numbers.sh * kselftest/lib_printf.sh * kselftest/lib_strscpy.sh * kselftest/net_fib-onlink-tests.sh * kselftest/net_fib_rule_tests.sh * kselftest/net_fib_tests.sh * kselftest/netfilter_conntrack_icmp_related.sh * kselftest/netfilter_nft_nat.sh * kselftest/net_ip_defrag.sh * kselftest/net_l2tp.sh * kselftest/net_pmtu.sh * kselftest/net_psock_snd.sh * kselftest/net_reuseport_bpf_numa * kselftest/net_run_netsocktests * kselftest/net_tcp_fastopen_backup_key.sh * kselftest/net_test_vxlan_under_vrf.sh * kselftest/pidfd_pidfd_open_test * kselftest/pidfd_pidfd_poll_test * kselftest/proc_proc-self-map-files-002 * kselftest/proc_proc-self-syscall * kselftest/pstore_pstore_tests * kselftest/seccomp_seccomp_bpf * kselftest/timers_rtcpie * kselftest/timestamping_txtimestamp.sh * kselftest/tpm2_test_smoke.sh * kselftest/tpm2_test_space.sh x86: * kselftest-vsyscall-mode-native/bpf_get_cgroup_id_user * kselftest-vsyscall-mode-native/bpf_test_bpftool_build.sh * kselftest-vsyscall-mode-native/bpf_test_btf_dump * kselftest-vsyscall-mode-native/bpf_test_flow_dissector.sh * kselftest-vsyscall-mode-native/bpf_test_libbpf.sh * kselftest-vsyscall-mode-native/bpf_test_lwt_ip_encap.sh * kselftest-vsyscall-mode-native/bpf_test_lwt_seg6local.sh * kselftest-vsyscall-mode-native/bpf_test_maps * kselftest-vsyscall-mode-native/bpf_test_netcnt * kselftest-vsyscall-mode-native/bpf_test_progs * kselftest-vsyscall-mode-native/bpf_test_select_reuseport * kselftest-vsyscall-mode-native/bpf_test_socket_cookie * kselftest-vsyscall-mode-native/bpf_test_sock_fields * kselftest-vsyscall-mode-native/bpf_test_sockmap * kselftest-vsyscall-mode-native/bpf_test_tc_edt.sh * kselftest-vsyscall-mode-native/bpf_test_tcpbpf_user * kselftest-vsyscall-mode-native/bpf_test_tcpnotify_user * kselftest-vsyscall-mode-native/bpf_test_tc_tunnel.sh * kselftest-vsyscall-mode-native/bpf_test_tunnel.sh * kselftest-vsyscall-mode-native/bpf_test_xdping.sh * kselftest-vsyscall-mode-native/bpf_xdping * kselftest-vsyscall-mode-native/firmware_fw_run_tests.sh * kselftest-vsyscall-mode-native/ftrace_ftracetest * kselftest-vsyscall-mode-native/kvm_clear_dirty_log_test * kselftest-vsyscall-mode-native/kvm_cr4_cpuid_sync_test * kselftest-vsyscall-mode-native/kvm_dirty_log_test * kselftest-vsyscall-mode-native/kvm_evmcs_test * kselftest-vsyscall-mode-native/kvm_hyperv_cpuid * kselftest-vsyscall-mode-native/kvm_kvm_create_max_vcpus * kselftest-vsyscall-mode-native/kvm_platform_info_test * kselftest-vsyscall-mode-native/kvm_set_sregs_test * kselftest-vsyscall-mode-native/kvm_smm_test * kselftest-vsyscall-mode-native/kvm_state_test * kselftest-vsyscall-mode-native/kvm_sync_regs_test * kselftest-vsyscall-mode-native/kvm_vmx_close_while_nested_test * kselftest-vsyscall-mode-native/kvm_vmx_set_nested_state_test * kselftest-vsyscall-mode-native/kvm_vmx_tsc_adjust_test * kselftest-vsyscall-mode-native/lib_bitmap.sh * kselftest-vsyscall-mode-native/lib_prime_numbers.sh * kselftest-vsyscall-mode-native/lib_printf.sh * kselftest-vsyscall-mode-native/lib_strscpy.sh * kselftest-vsyscall-mode-native/net_fib-onlink-tests.sh * kselftest-vsyscall-mode-native/net_fib_tests.sh * kselftest-vsyscall-mode-native/net_ip_defrag.sh * kselftest-vsyscall-mode-native/net_l2tp.sh * kselftest-vsyscall-mode-native/net_pmtu.sh * kselftest-vsyscall-mode-native/net_psock_snd.sh * kselftest-vsyscall-mode-native/net_run_netsocktests * kselftest-vsyscall-mode-native/net_tcp_fastopen_backup_key.sh * kselftest-vsyscall-mode-native/net_test_vxlan_under_vrf.sh * kselftest-vsyscall-mode-native/net_xfrm_policy.sh * kselftest-vsyscall-mode-native/pidfd_pidfd_open_test * kselftest-vsyscall-mode-native/pidfd_pidfd_poll_test * kselftest-vsyscall-mode-native/pstore_pstore_tests * kselftest-vsyscall-mode-native/timestamping_txtimestamp.sh * kselftest-vsyscall-mode-native/tpm2_test_smoke.sh * kselftest-vsyscall-mode-native/tpm2_test_space.sh * kselftest-vsyscall-mode-none/bpf_get_cgroup_id_user * kselftest-vsyscall-mode-none/bpf_test_bpftool_build.sh * kselftest-vsyscall-mode-none/bpf_test_btf_dump * kselftest-vsyscall-mode-none/bpf_test_flow_dissector.sh * kselftest-vsyscall-mode-none/bpf_test_libbpf.sh * kselftest-vsyscall-mode-none/bpf_test_lwt_ip_encap.sh * kselftest-vsyscall-mode-none/bpf_test_lwt_seg6local.sh * kselftest-vsyscall-mode-none/bpf_test_maps * kselftest-vsyscall-mode-none/bpf_test_netcnt * kselftest-vsyscall-mode-none/bpf_test_progs * kselftest-vsyscall-mode-none/bpf_test_select_reuseport * kselftest-vsyscall-mode-none/bpf_test_socket_cookie * kselftest-vsyscall-mode-none/bpf_test_sock_fields * kselftest-vsyscall-mode-none/bpf_test_sockmap * kselftest-vsyscall-mode-none/bpf_test_tc_edt.sh * kselftest-vsyscall-mode-none/bpf_test_tcpbpf_user * kselftest-vsyscall-mode-none/bpf_test_tcpnotify_user * kselftest-vsyscall-mode-none/bpf_test_tc_tunnel.sh * kselftest-vsyscall-mode-none/bpf_test_tunnel.sh * kselftest-vsyscall-mode-none/bpf_test_xdping.sh * kselftest-vsyscall-mode-none/bpf_xdping * kselftest-vsyscall-mode-none/firmware_fw_run_tests.sh * kselftest-vsyscall-mode-none/ftrace_ftracetest * kselftest-vsyscall-mode-none/kvm_clear_dirty_log_test * kselftest-vsyscall-mode-none/kvm_dirty_log_test * kselftest-vsyscall-mode-none/kvm_evmcs_test * kselftest-vsyscall-mode-none/kvm_hyperv_cpuid * kselftest-vsyscall-mode-none/kvm_kvm_create_max_vcpus * kselftest-vsyscall-mode-none/kvm_platform_info_test * kselftest-vsyscall-mode-none/kvm_set_sregs_test * kselftest-vsyscall-mode-none/kvm_smm_test * kselftest-vsyscall-mode-none/kvm_state_test * kselftest-vsyscall-mode-none/kvm_sync_regs_test * kselftest-vsyscall-mode-none/kvm_vmx_close_while_nested_test * kselftest-vsyscall-mode-none/kvm_vmx_set_nested_state_test * kselftest-vsyscall-mode-none/kvm_vmx_tsc_adjust_test * kselftest-vsyscall-mode-none/lib_bitmap.sh * kselftest-vsyscall-mode-none/lib_prime_numbers.sh * kselftest-vsyscall-mode-none/lib_printf.sh * kselftest-vsyscall-mode-none/lib_strscpy.sh * kselftest-vsyscall-mode-none/net_fib-onlink-tests.sh * kselftest-vsyscall-mode-none/net_fib_tests.sh * kselftest-vsyscall-mode-none/net_ip_defrag.sh * kselftest-vsyscall-mode-none/net_l2tp.sh * kselftest-vsyscall-mode-none/net_pmtu.sh * kselftest-vsyscall-mode-none/net_psock_snd.sh * kselftest-vsyscall-mode-none/net_run_netsocktests * kselftest-vsyscall-mode-none/net_tcp_fastopen_backup_key.sh * kselftest-vsyscall-mode-none/net_test_vxlan_under_vrf.sh * kselftest-vsyscall-mode-none/net_xfrm_policy.sh * kselftest-vsyscall-mode-none/pidfd_pidfd_open_test * kselftest-vsyscall-mode-none/pidfd_pidfd_poll_test * kselftest-vsyscall-mode-none/pstore_pstore_tests * kselftest-vsyscall-mode-none/timestamping_txtimestamp.sh * kselftest-vsyscall-mode-none/tpm2_test_smoke.sh * kselftest-vsyscall-mode-none/tpm2_test_space.sh * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_platform_info_test * kselftest/kvm_set_sregs_test * kselftest/kvm_smm_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/kvm_vmx_close_while_nested_test * kselftest/kvm_vmx_set_nested_state_test * kselftest/kvm_vmx_tsc_adjust_test * kselftest/lib_bitmap.sh * kselftest/lib_prime_numbers.sh * kselftest/lib_printf.sh * kselftest/lib_strscpy.sh * kselftest/net_fib-onlink-tests.sh * kselftest/net_fib_tests.sh * kselftest/net_ip_defrag.sh * kselftest/net_l2tp.sh * kselftest/net_pmtu.sh * kselftest/net_psock_snd.sh * kselftest/net_run_netsocktests * kselftest/net_tcp_fastopen_backup_key.sh * kselftest/net_test_vxlan_under_vrf.sh * kselftest/net_xfrm_policy.sh * kselftest/pidfd_pidfd_open_test * kselftest/pidfd_pidfd_poll_test * kselftest/pstore_pstore_tests * kselftest/timestamping_txtimestamp.sh * kselftest/tpm2_test_smoke.sh * kselftest/tpm2_test_space.sh juno-r2: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcp_check_syncookie.sh * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_verifier * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/cpufreq_main.sh * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_mmio_warning_test * kselftest/kvm_platform_info_test * kselftest/kvm_set_sregs_test * kselftest/kvm_smm_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/kvm_vmx_close_while_nested_test * kselftest/kvm_vmx_set_nested_state_test * kselftest/kvm_vmx_tsc_adjust_test x15: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_sockmap * kselftest/bpf_test_sysctl * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcp_check_syncookie.sh * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_verifier * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_mmio_warning_test * kselftest/kvm_set_sregs_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/kvm_vmx_close_while_nested_test * kselftest/kvm_vmx_set_nested_state_test * kselftest/kvm_vmx_tsc_adjust_test * kselftest/lib_bitmap.sh * kselftest/lib_prime_numbers.sh * kselftest/lib_printf.sh * kselftest/lib_strscpy.sh * kselftest/net_fib-onlink-tests.sh * kselftest/net_fib_rule_tests.sh * kselftest/net_fib_tests.sh * kselftest/netfilter_conntrack_icmp_related.sh * kselftest/netfilter_nft_nat.sh * kselftest/net_ip_defrag.sh * kselftest/net_l2tp.sh * kselftest/net_pmtu.sh * kselftest/net_psock_snd.sh * kselftest/net_reuseport_bpf_numa * kselftest/net_run_netsocktests * kselftest/net_so_txtime.sh * kselftest/net_tcp_fastopen_backup_key.sh * kselftest/net_test_vxlan_under_vrf.sh * kselftest/pidfd_pidfd_open_test * kselftest/pidfd_pidfd_poll_test * kselftest/proc_proc-self-map-files-002 * kselftest/proc_proc-self-syscall * kselftest/pstore_pstore_tests * kselftest/rtc_rtctest * kselftest/seccomp_seccomp_bpf * kselftest/timestamping_txtimestamp.sh * kselftest/tpm2_test_smoke.sh * kselftest/tpm2_test_space.sh i386: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_hashmap * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_sock_addr.sh * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_sysctl * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest * kselftest/kvm_clear_dirty_log_test * kselftest/kvm_cr4_cpuid_sync_test * kselftest/kvm_dirty_log_test * kselftest/kvm_evmcs_test * kselftest/kvm_hyperv_cpuid * kselftest/kvm_kvm_create_max_vcpus * kselftest/kvm_mmio_warning_test * kselftest/kvm_platform_info_test * kselftest/kvm_set_sregs_test * kselftest/kvm_smm_test * kselftest/kvm_state_test * kselftest/kvm_sync_regs_test * kselftest/kvm_vmx_close_while_nested_test * kselftest/kvm_vmx_set_nested_state_test * kselftest/lib_bitmap.sh * kselftest/lib_prime_numbers.sh * kselftest/lib_printf.sh * kselftest/lib_strscpy.sh * kselftest/net_fib-onlink-tests.sh * kselftest/net_fib_tests.sh * kselftest/net_ip_defrag.sh * kselftest/net_l2tp.sh * kselftest/net_pmtu.sh * kselftest/net_psock_snd.sh * kselftest/net_run_netsocktests * kselftest/net_tcp_fastopen_backup_key.sh * kselftest/net_test_vxlan_under_vrf.sh * kselftest/pidfd_pidfd_open_test * kselftest/pidfd_pidfd_poll_test * kselftest/proc_proc-self-map-files-002 * kselftest/proc_proc-self-syscall * kselftest/pstore_pstore_tests * kselftest/timestamping_txtimestamp.sh qemu_arm64: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcp_check_syncookie.sh * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_verifier * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/cpufreq_main.sh * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest dragonboard-410c: * kselftest/bpf_get_cgroup_id_user * kselftest/bpf_test_bpftool_build.sh * kselftest/bpf_test_btf_dump * kselftest/bpf_test_flow_dissector.sh * kselftest/bpf_test_libbpf.sh * kselftest/bpf_test_lwt_ip_encap.sh * kselftest/bpf_test_lwt_seg6local.sh * kselftest/bpf_test_maps * kselftest/bpf_test_netcnt * kselftest/bpf_test_progs * kselftest/bpf_test_select_reuseport * kselftest/bpf_test_socket_cookie * kselftest/bpf_test_sock_fields * kselftest/bpf_test_sockmap * kselftest/bpf_test_tc_edt.sh * kselftest/bpf_test_tcpbpf_user * kselftest/bpf_test_tcp_check_syncookie.sh * kselftest/bpf_test_tcpnotify_user * kselftest/bpf_test_tc_tunnel.sh * kselftest/bpf_test_tunnel.sh * kselftest/bpf_test_verifier * kselftest/bpf_test_xdping.sh * kselftest/bpf_xdping * kselftest/firmware_fw_run_tests.sh * kselftest/ftrace_ftracetest hi6220-hikey: * kselftest/bpf_test_maps * kselftest/bpf_test_progs * kselftest/bpf_test_verifier Skips ------------------------------------------------------------------------ No skips -- Linaro LKFT https://lkft.linaro.org

5 years, 9 months

1
0
0 0

[PATCH v3 0/3] selftests: netfilter: introduce test cases for ipvs

by Haishuang Yan

This series patch include test cases for ipvs. The test topology is who as below: +--------------------------------------------------------------+ | | | | ns0 | ns1 | | ----------- | ----------- ----------- | | | veth01 | --------- | veth10 | | veth12 | | | ----------- peer ----------- ----------- | | | | | | | ----------- | | | | | br0 | |----------------- peer |--------------| | ----------- | | | | | | | | | ---------- peer ---------- ----------- | | | veth02 | --------- | veth20 | | veth12 | | | ---------- | ---------- ----------- | | | ns2 | | | | +--------------------------------------------------------------+ Test results: # selftests: netfilter: ipvs.sh # Testing DR mode... # Testing NAT mode... # Testing Tunnel mode... # ipvs.sh: PASS ok 6 selftests: netfilter: ipvs.sh Haishuang Yan (3): selftests: netfilter: add ipvs test script selftests: netfilter: add ipvs nat test case selftests: netfilter: add ipvs tunnel test case tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/ipvs.sh | 234 +++++++++++++++++++++++++++++ 2 files changed, 235 insertions(+), 1 deletion(-) create mode 100755 tools/testing/selftests/netfilter/ipvs.sh -- 1.8.3.1

5 years, 9 months

4
6
0 0

[PATCH v2 0/3] selftests: netfilter: introduce test cases for ipvs

by Haishuang Yan

This series patch include test cases for ipvs. The test topology is who as below: +--------------------------------------------------------------+ | | | | ns0 | ns1 | | ----------- | ----------- ----------- | | | veth01 | --------- | veth10 | | veth12 | | | ----------- peer ----------- ----------- | | | | | | | ----------- | | | | | br0 | |----------------- peer |--------------| | ----------- | | | | | | | | | ---------- peer ---------- ----------- | | | veth02 | --------- | veth20 | | veth21 | | | ---------- | ---------- ----------- | | | ns2 | | | | +--------------------------------------------------------------+ Test results: # selftests: netfilter: ipvs.sh # Testing DR mode... # Testing NAT mode... # Testing Tunnel mode... # ipvs.sh: PASS ok 6 selftests: netfilter: ipvs.sh Haishuang Yan (3): selftests: netfilter: add ipvs test script selftests: netfilter: add ipvs nat test case selftests: netfilter: add ipvs tunnel test case tools/testing/selftests/netfilter/Makefile | 2 +- tools/testing/selftests/netfilter/ipvs.sh | 234 +++++++++++++++++++++++++++++ 2 files changed, 235 insertions(+), 1 deletion(-) create mode 100755 tools/testing/selftests/netfilter/ipvs.sh -- 1.8.3.1

5 years, 9 months

4
6
0 0

[PATCH AUTOSEL 5.3 50/71] selftests/bpf: adjust strobemeta loop to satisfy latest clang

by Sasha Levin

From: Andrii Nakryiko <andriin(a)fb.com> [ Upstream commit 4670d68b9254710fdeaf794cad54d8b2c9929e0a ] Some recent changes in latest Clang started causing the following warning when unrolling strobemeta test case main loop: progs/strobemeta.h:416:2: warning: loop not unrolled: the optimizer was unable to perform the requested transformation; the transformation might be disabled or specified as part of an unsupported transformation ordering [-Wpass-failed=transform-warning] This patch simplifies loop's exit condition to depend only on constant max iteration number (STROBE_MAX_MAP_ENTRIES), while moving early termination logic inside the loop body. The changes are equivalent from program logic standpoint, but fixes the warning. It also appears to improve generated BPF code, as it fixes previously failing non-unrolled strobemeta test cases. Cc: Alexei Starovoitov <ast(a)fb.com> Signed-off-by: Andrii Nakryiko <andriin(a)fb.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/bpf/progs/strobemeta.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/progs/strobemeta.h b/tools/testing/selftests/bpf/progs/strobemeta.h index 8a399bdfd9203..067eb625d01c5 100644 --- a/tools/testing/selftests/bpf/progs/strobemeta.h +++ b/tools/testing/selftests/bpf/progs/strobemeta.h @@ -413,7 +413,10 @@ static __always_inline void *read_map_var(struct strobemeta_cfg *cfg, #else #pragma unroll #endif - for (int i = 0; i < STROBE_MAX_MAP_ENTRIES && i < map.cnt; ++i) { + for (int i = 0; i < STROBE_MAX_MAP_ENTRIES; ++i) { + if (i >= map.cnt) + break; + descr->key_lens[i] = 0; len = bpf_probe_read_str(payload, STROBE_MAX_STR_LEN, map.entries[i].key); -- 2.20.1

5 years, 9 months

1
0
0 0

[PATCH AUTOSEL 5.3 30/71] selftests/seccomp: fix build on older kernels

by Sasha Levin

From: Tycho Andersen <tycho(a)tycho.ws> [ Upstream commit 88282297fff00796e81f5e67734a6afdfb31fbc4 ] The seccomp selftest goes to some length to build against older kernel headers, viz. all the #ifdefs at the beginning of the file. Commit 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request") introduces some additional macros, but doesn't do the #ifdef dance. Let's add that dance here to avoid: gcc -Wl,-no-as-needed -Wall seccomp_bpf.c -lpthread -o seccomp_bpf In file included from seccomp_bpf.c:51: seccomp_bpf.c: In function ‘tracer_ptrace’: seccomp_bpf.c:1787:20: error: ‘PTRACE_EVENTMSG_SYSCALL_ENTRY’ undeclared (first use in this function); did you mean ‘PTRACE_EVENT_CLONE’? EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ __typeof__(_expected) __exp = (_expected); \ ^~~~~~~~~ seccomp_bpf.c:1787:2: note: in expansion of macro ‘EXPECT_EQ’ EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~ seccomp_bpf.c:1787:20: note: each undeclared identifier is reported only once for each function it appears in EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ __typeof__(_expected) __exp = (_expected); \ ^~~~~~~~~ seccomp_bpf.c:1787:2: note: in expansion of macro ‘EXPECT_EQ’ EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~ seccomp_bpf.c:1788:6: error: ‘PTRACE_EVENTMSG_SYSCALL_EXIT’ undeclared (first use in this function); did you mean ‘PTRACE_EVENT_EXIT’? : PTRACE_EVENTMSG_SYSCALL_EXIT, msg); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../kselftest_harness.h:608:13: note: in definition of macro ‘__EXPECT’ __typeof__(_expected) __exp = (_expected); \ ^~~~~~~~~ seccomp_bpf.c:1787:2: note: in expansion of macro ‘EXPECT_EQ’ EXPECT_EQ(entry ? PTRACE_EVENTMSG_SYSCALL_ENTRY ^~~~~~~~~ make: *** [Makefile:12: seccomp_bpf] Error 1 [skhan(a)linuxfoundation.org: Fix checkpatch error in commit log] Signed-off-by: Tycho Andersen <tycho(a)tycho.ws> Fixes: 201766a20e30 ("ptrace: add PTRACE_GET_SYSCALL_INFO request") Acked-by: Kees Cook <keescook(a)chromium.org> Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- tools/testing/selftests/seccomp/seccomp_bpf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c index 6ef7f16c4cf52..7f8b5c8982e3b 100644 --- a/tools/testing/selftests/seccomp/seccomp_bpf.c +++ b/tools/testing/selftests/seccomp/seccomp_bpf.c @@ -199,6 +199,11 @@ struct seccomp_notif_sizes { }; #endif +#ifndef PTRACE_EVENTMSG_SYSCALL_ENTRY +#define PTRACE_EVENTMSG_SYSCALL_ENTRY 1 +#define PTRACE_EVENTMSG_SYSCALL_EXIT 2 +#endif + #ifndef seccomp int seccomp(unsigned int op, unsigned int flags, void *args) { -- 2.20.1

5 years, 9 months

1
0
0 0

[PATCH v13 0/9] namei: openat2(2) path resolution restrictions

by Aleksa Sarai

This patchset is being developed here: <https://github.com/cyphar/linux/tree/resolveat/master> It depends on the copy_struct_from_user() helpers being developed here: <https://github.com/cyphar/linux/tree/copy_struct_from_user/master> and posted here: <https://lore.kernel.org/lkml/20190930182810.6090-1-cyphar@cyphar.com/> Patch changelog: v13: * Fix race with the magic-link mode semantics by recomputing the mode during ->get_link() and storing it with nd_jump_link(). A selftest was added for this attack scenario as well. [Jann Horn] * Fix gap in RESOLVE_NO_XDEV with magic-links -- now magic-link resolution is only permitted if the link doesn't jump vfsmounts. * Remove path_is_under() checks for ".." resolution (due to the possibility of O(m*n) lookup behaviour). Instead, return -EAGAIN if a racing rename or mount occurs. Userspace is then encouraged to retry or have another fallback (if after several tries, it still fails it's likely that there is an attack going on -- though failures will occur spuriously because &{rename,mount}_lock are both global). [Linus Torvalds] * Move copy_struct_from_user() to a separate series so it can be merged separately. [Christian Brauner] * Small test improvements (mainly making the TAP output more readable and adding a few new minor test cases). Now the openat2(2) self-tests have ~271 overall test cases. * Expand on changes to path-lookup in the kernel docs. * Kernel-doc fixes. [Randy Dunlap] v12: <https://lore.kernel.org/lkml/20190904201933.10736-1-cyphar@cyphar.com/> v11: <https://lore.kernel.org/lkml/20190820033406.29796-1-cyphar@cyphar.com/> <https://lore.kernel.org/lkml/20190728010207.9781-1-cyphar@cyphar.com/> v10: <https://lore.kernel.org/lkml/20190719164225.27083-1-cyphar@cyphar.com/> v09: <https://lore.kernel.org/lkml/20190706145737.5299-1-cyphar@cyphar.com/> v08: <https://lore.kernel.org/lkml/20190520133305.11925-1-cyphar@cyphar.com/> v07: <https://lore.kernel.org/lkml/20190507164317.13562-1-cyphar@cyphar.com/> v06: <https://lore.kernel.org/lkml/20190506165439.9155-1-cyphar@cyphar.com/> v05: <https://lore.kernel.org/lkml/20190320143717.2523-1-cyphar@cyphar.com/> v04: <https://lore.kernel.org/lkml/20181112142654.341-1-cyphar@cyphar.com/> v03: <https://lore.kernel.org/lkml/20181009070230.12884-1-cyphar@cyphar.com/> v02: <https://lore.kernel.org/lkml/20181009065300.11053-1-cyphar@cyphar.com/> v01: <https://lore.kernel.org/lkml/20180929103453.12025-1-cyphar@cyphar.com/> The need for some sort of control over VFS's path resolution (to avoid malicious paths resulting in inadvertent breakouts) has been a very long-standing desire of many userspace applications. This patchset is a revival of Al Viro's old AT_NO_JUMPS[1,2] patchset (which was a variant of David Drysdale's O_BENEATH patchset[3] which was a spin-off of the Capsicum project[4]) with a few additions and changes made based on the previous discussion within [5] as well as others I felt were useful. In line with the conclusions of the original discussion of AT_NO_JUMPS, the flag has been split up into separate flags. However, instead of being an openat(2) flag it is provided through a new syscall openat2(2) which provides several other improvements to the openat(2) interface (see the patch description for more details). The following new LOOKUP_* flags are added: * LOOKUP_NO_XDEV blocks all mountpoint crossings (upwards, downwards, or through absolute links). Absolute pathnames alone in openat(2) do not trigger this. Magic-link traversal which implies a vfsmount jump is also blocked (though magic-link jumps on the same vfsmount are permitted). * LOOKUP_NO_MAGICLINKS blocks resolution through /proc/$pid/fd-style links. This is done by blocking the usage of nd_jump_link() during resolution in a filesystem. The term "magic-links" is used to match with the only reference to these links in Documentation/, but I'm happy to change the name. It should be noted that this is different to the scope of ~LOOKUP_FOLLOW in that it applies to all path components. However, you can do openat2(NO_FOLLOW|NO_MAGICLINKS) on a magic-link and it will *not* fail (assuming that no parent component was a magic-link), and you will have an fd for the magic-link. * LOOKUP_BENEATH disallows escapes to outside the starting dirfd's tree, using techniques such as ".." or absolute links. Absolute paths in openat(2) are also disallowed. Conceptually this flag is to ensure you "stay below" a certain point in the filesystem tree -- but this requires some additional to protect against various races that would allow escape using "..". Currently LOOKUP_BENEATH implies LOOKUP_NO_MAGICLINKS, because it can trivially beam you around the filesystem (breaking the protection). In future, there might be similar safety checks done as in LOOKUP_IN_ROOT, but that requires more discussion. In addition, two new flags are added that expand on the above ideas: * LOOKUP_NO_SYMLINKS does what it says on the tin. No symlink resolution is allowed at all, including magic-links. Just as with LOOKUP_NO_MAGICLINKS this can still be used with NOFOLLOW to open an fd for the symlink as long as no parent path had a symlink component. * LOOKUP_IN_ROOT is an extension of LOOKUP_BENEATH that, rather than blocking attempts to move past the root, forces all such movements to be scoped to the starting point. This provides chroot(2)-like protection but without the cost of a chroot(2) for each filesystem operation, as well as being safe against race attacks that chroot(2) is not. If a race is detected (as with LOOKUP_BENEATH) then an error is generated, and similar to LOOKUP_BENEATH it is not permitted to cross magic-links with LOOKUP_IN_ROOT. The primary need for this is from container runtimes, which currently need to do symlink scoping in userspace[6] when opening paths in a potentially malicious container. There is a long list of CVEs that could have bene mitigated by having RESOLVE_THIS_ROOT (such as CVE-2017-1002101, CVE-2017-1002102, CVE-2018-15664, and CVE-2019-5736, just to name a few). And further, several semantics of file descriptor "re-opening" are now changed to prevent attacks like CVE-2019-5736 by restricting how magic-links can be resolved (based on their mode). This required some other changes to the semantics of the modes of O_PATH file descriptor's associated /proc/self/fd magic-links. openat2(2) has the ability to further restrict re-opening of its own O_PATH fds, so that users can make even better use of this feature. Finally, O_EMPTYPATH was added so that users can do /proc/self/fd-style re-opening without depending on procfs. The new restricted semantics for magic-links are applied here too. In order to make all of the above more usable, I'm working on libpathrs[7] which is a C-friendly library for safe path resolution. It features a userspace-emulated backend if the kernel doesn't support openat2(2). Hopefully we can get userspace to switch to using it, and thus get openat2(2) support for free once it's ready. [1]: https://lwn.net/Articles/721443/ [2]: https://lore.kernel.org/patchwork/patch/784221/ [3]: https://lwn.net/Articles/619151/ [4]: https://lwn.net/Articles/603929/ [5]: https://lwn.net/Articles/723057/ [6]: https://github.com/cyphar/filepath-securejoin [7]: https://github.com/openSUSE/libpathrs Aleksa Sarai (9): namei: obey trailing magic-link DAC permissions procfs: switch magic-link modes to be more sane open: O_EMPTYPATH: procfs-less file descriptor re-opening namei: O_BENEATH-style path resolution flags namei: LOOKUP_IN_ROOT: chroot-like path resolution namei: permit ".." resolution with LOOKUP_{IN_ROOT,BENEATH} open: openat2(2) syscall selftests: add openat2(2) selftests Documentation: update path-lookup to mention trailing magic-links Documentation/filesystems/path-lookup.rst | 80 ++- arch/alpha/include/uapi/asm/fcntl.h | 1 + arch/alpha/kernel/syscalls/syscall.tbl | 1 + arch/arm/tools/syscall.tbl | 1 + arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/include/asm/unistd32.h | 2 + arch/ia64/kernel/syscalls/syscall.tbl | 1 + arch/m68k/kernel/syscalls/syscall.tbl | 1 + arch/microblaze/kernel/syscalls/syscall.tbl | 1 + arch/mips/kernel/syscalls/syscall_n32.tbl | 1 + arch/mips/kernel/syscalls/syscall_n64.tbl | 1 + arch/mips/kernel/syscalls/syscall_o32.tbl | 1 + arch/parisc/include/uapi/asm/fcntl.h | 39 +- arch/parisc/kernel/syscalls/syscall.tbl | 1 + arch/powerpc/kernel/syscalls/syscall.tbl | 1 + arch/s390/kernel/syscalls/syscall.tbl | 1 + arch/sh/kernel/syscalls/syscall.tbl | 1 + arch/sparc/include/uapi/asm/fcntl.h | 1 + arch/sparc/kernel/syscalls/syscall.tbl | 1 + arch/x86/entry/syscalls/syscall_32.tbl | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 1 + arch/xtensa/kernel/syscalls/syscall.tbl | 1 + fs/fcntl.c | 2 +- fs/internal.h | 1 + fs/namei.c | 286 +++++++-- fs/open.c | 100 ++- fs/proc/base.c | 69 +- fs/proc/fd.c | 45 +- fs/proc/internal.h | 2 +- fs/proc/namespaces.c | 4 +- include/linux/fcntl.h | 21 +- include/linux/fs.h | 8 +- include/linux/namei.h | 15 +- include/linux/syscalls.h | 14 +- include/uapi/asm-generic/fcntl.h | 4 + include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/fcntl.h | 42 ++ security/apparmor/apparmorfs.c | 2 +- tools/testing/selftests/Makefile | 1 + tools/testing/selftests/memfd/memfd_test.c | 7 +- tools/testing/selftests/openat2/.gitignore | 1 + tools/testing/selftests/openat2/Makefile | 8 + tools/testing/selftests/openat2/helpers.c | 98 +++ tools/testing/selftests/openat2/helpers.h | 114 ++++ .../testing/selftests/openat2/linkmode_test.c | 590 ++++++++++++++++++ .../testing/selftests/openat2/openat2_test.c | 152 +++++ .../selftests/openat2/rename_attack_test.c | 149 +++++ .../testing/selftests/openat2/resolve_test.c | 522 ++++++++++++++++ 48 files changed, 2258 insertions(+), 145 deletions(-) create mode 100644 tools/testing/selftests/openat2/.gitignore create mode 100644 tools/testing/selftests/openat2/Makefile create mode 100644 tools/testing/selftests/openat2/helpers.c create mode 100644 tools/testing/selftests/openat2/helpers.h create mode 100644 tools/testing/selftests/openat2/linkmode_test.c create mode 100644 tools/testing/selftests/openat2/openat2_test.c create mode 100644 tools/testing/selftests/openat2/rename_attack_test.c create mode 100644 tools/testing/selftests/openat2/resolve_test.c -- 2.23.0

5 years, 9 months

2
15
0 0

[PATCH] tools: bpf: Use !building_out_of_srctree to determine srctree

by Shuah Khan

make TARGETS=bpf kselftest fails with: Makefile:127: tools/build/Makefile.include: No such file or directory When the bpf tool make is invoked from tools Makefile, srctree is cleared and the current logic check for srctree equals to empty string to determine srctree location from CURDIR. When the build in invoked from selftests/bpf Makefile, the srctree is set to "." and the same logic used for srctree equals to empty is needed to determine srctree. Check building_out_of_srctree undefined as the condition for both cases to fix "make TARGETS=bpf kselftest" build failure. Signed-off-by: Shuah Khan <skhan(a)linuxfoundation.org> --- tools/bpf/Makefile | 6 +++++- tools/lib/bpf/Makefile | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/tools/bpf/Makefile b/tools/bpf/Makefile index fbf5e4a0cb9c..5d1995fd369c 100644 --- a/tools/bpf/Makefile +++ b/tools/bpf/Makefile @@ -12,7 +12,11 @@ INSTALL ?= install CFLAGS += -Wall -O2 CFLAGS += -D__EXPORTED_HEADERS__ -I$(srctree)/include/uapi -I$(srctree)/include -ifeq ($(srctree),) +# This will work when bpf is built in tools env. where srctree +# isn't set and when invoked from selftests build, where srctree +# is set to ".". building_out_of_srctree is undefined for in srctree +# builds +ifndef building_out_of_srctree srctree := $(patsubst %/,%,$(dir $(CURDIR))) srctree := $(patsubst %/,%,$(dir $(srctree))) endif diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile index c6f94cffe06e..20772663d3e1 100644 --- a/tools/lib/bpf/Makefile +++ b/tools/lib/bpf/Makefile @@ -8,7 +8,11 @@ LIBBPF_MAJOR_VERSION := $(firstword $(subst ., ,$(LIBBPF_VERSION))) MAKEFLAGS += --no-print-directory -ifeq ($(srctree),) +# This will work when bpf is built in tools env. where srctree +# isn't set and when invoked from selftests build, where srctree +# is a ".". building_out_of_srctree is undefined for in srctree +# builds +ifndef building_out_of_srctree srctree := $(patsubst %/,%,$(dir $(CURDIR))) srctree := $(patsubst %/,%,$(dir $(srctree))) srctree := $(patsubst %/,%,$(dir $(srctree))) -- 2.20.1

5 years, 9 months

4
6
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror