summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2017-01-27Merge branch 'master' of ↵Dave Airlie
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into drm-next Backmerge Linus master to get the connector locking revert. * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux: (645 commits) sysctl: fix proc_doulongvec_ms_jiffies_minmax() Revert "drm/probe-helpers: Drop locking from poll_enable" MAINTAINERS: add Dan Streetman to zbud maintainers MAINTAINERS: add Dan Streetman to zswap maintainers mm: do not export ioremap_page_range symbol for external module mn10300: fix build error of missing fpu_save() romfs: use different way to generate fsid for BLOCK or MTD frv: add missing atomic64 operations mm, page_alloc: fix premature OOM when racing with cpuset mems update mm, page_alloc: move cpuset seqcount checking to slowpath mm, page_alloc: fix fast-path race with cpuset update or removal mm, page_alloc: fix check for NULL preferred_zone kernel/panic.c: add missing \n fbdev: color map copying bounds checking frv: add atomic64_add_unless() mm/mempolicy.c: do not put mempolicy before using its nodemask radix-tree: fix private list warnings Documentation/filesystems/proc.txt: add VmPin mm, memcg: do not retry precharge charges proc: add a schedule point in proc_pid_readdir() ...
2017-01-25bpf: use prefix_len in test_tag when reading fdinfoDaniel Borkmann
We currently used len instead of prefix_len for the strncmp() in fdinfo on the prog_tag. It still worked as we matched on the correct output line also with first 8 instead of 10 chars, but lets fix it properly to use the intended length. Fixes: 62b64660262a ("bpf: add prog tag test case to bpf selftests") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-25Merge branches 'doc.2017.01.15b', 'dyntick.2017.01.23a', ↵Paul E. McKenney
'fixes.2017.01.23a', 'srcu.2017.01.25a' and 'torture.2017.01.15b' into HEAD doc.2017.01.15b: Documentation updates dyntick.2017.01.23a: Dyntick tracking consolidation fixes.2017.01.23a: Miscellaneous fixes srcu.2017.01.25a: SRCU rewrite, fixes, and verification torture.2017.01.15b: Torture-test updates
2017-01-25rcutorture: Add CBMC-based formal verification for SRCULance Roy
This commit creates a formal/srcu-cbmc directory containing scripts that pull SRCU in from the source code, filter it to remove things that CBMC cannot handle, and run a series of verifications on it. This has a number of shortcomings: 1. It does not yet hook into the upper-level self-test Makefiles. 2. It tests only a single scenario, store buffering. 3. There is no gcc-based syntax-error prefiltering. Nevertheless, it does fully verify a piece of SRCU under a moderately weak memory model (PSO). Signed-off-by: Lance Roy <ldr709@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
2017-01-25test_firmware: add test custom fallback triggerLuis R. Rodriguez
We have no custom fallback mechanism test interface. Provide one. This tests both the custom fallback mechanism and cancelling the it. Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-25tools: firmware: add fallback cancelation testingLuis R. Rodriguez
Add a test case for cancelling the sync fallback mechanism. Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-25tools: firmware: rename fallback mechanism scriptLuis R. Rodriguez
Calling it user mode helper only creates confusion. Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-25tools: firmware: check for distro fallback udev cancel ruleLuis R. Rodriguez
Some distributions (Debian, OpenSUSE) have a udev rule in place to cancel all fallback mechanism uevents immediately. This would obviously make it hard to test against the fallback mechanism test interface, so we need to check for this. Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-24bpf: enable verifier to better track const alu opsDaniel Borkmann
William reported couple of issues in relation to direct packet access. Typical scheme is to check for data + [off] <= data_end, where [off] can be either immediate or coming from a tracked register that contains an immediate, depending on the branch, we can then access the data. However, in case of calculating [off] for either the mentioned test itself or for access after the test in a more "complex" way, then the verifier will stop tracking the CONST_IMM marked register and will mark it as UNKNOWN_VALUE one. Adding that UNKNOWN_VALUE typed register to a pkt() marked register, the verifier then bails out in check_packet_ptr_add() as it finds the registers imm value below 48. In the first below example, that is due to evaluate_reg_imm_alu() not handling right shifts and thus marking the register as UNKNOWN_VALUE via helper __mark_reg_unknown_value() that resets imm to 0. In the second case the same happens at the time when r4 is set to r4 &= r5, where it transitions to UNKNOWN_VALUE from evaluate_reg_imm_alu(). Later on r4 we shift right by 3 inside evaluate_reg_alu(), where the register's imm turns into 3. That is, for registers with type UNKNOWN_VALUE, imm of 0 means that we don't know what value the register has, and for imm > 0 it means that the value has [imm] upper zero bits. F.e. when shifting an UNKNOWN_VALUE register by 3 to the right, no matter what value it had, we know that the 3 upper most bits must be zero now. This is to make sure that ALU operations with unknown registers don't overflow. Meaning, once we know that we have more than 48 upper zero bits, or, in other words cannot go beyond 0xffff offset with ALU ops, such an addition will track the target register as a new pkt() register with a new id, but 0 offset and 0 range, so for that a new data/data_end test will be required. Is the source register a CONST_IMM one that is to be added to the pkt() register, or the source instruction is an add instruction with immediate value, then it will get added if it stays within max 0xffff bounds. >From there, pkt() type, can be accessed should reg->off + imm be within the access range of pkt(). [...] from 28 to 30: R0=imm1,min_value=1,max_value=1 R1=pkt(id=0,off=0,r=22) R2=pkt_end R3=imm144,min_value=144,max_value=144 R4=imm0,min_value=0,max_value=0 R5=inv48,min_value=2054,max_value=2054 R10=fp 30: (bf) r5 = r3 31: (07) r5 += 23 32: (77) r5 >>= 3 33: (bf) r6 = r1 34: (0f) r6 += r5 cannot add integer value with 0 upper zero bits to ptr_to_packet [...] from 52 to 80: R0=imm1,min_value=1,max_value=1 R1=pkt(id=0,off=0,r=34) R2=pkt_end R3=inv R4=imm272 R5=inv56,min_value=17,max_value=17 R6=pkt(id=0,off=26,r=34) R10=fp 80: (07) r4 += 71 81: (18) r5 = 0xfffffff8 83: (5f) r4 &= r5 84: (77) r4 >>= 3 85: (0f) r1 += r4 cannot add integer value with 3 upper zero bits to ptr_to_packet Thus to get above use-cases working, evaluate_reg_imm_alu() has been extended for further ALU ops. This is fine, because we only operate strictly within realm of CONST_IMM types, so here we don't care about overflows as they will happen in the simulated but also real execution and interaction with pkt() in check_packet_ptr_add() will check actual imm value once added to pkt(), but it's irrelevant before. With regards to 06c1c049721a ("bpf: allow helpers access to variable memory") that works on UNKNOWN_VALUE registers, the verifier becomes now a bit smarter as it can better resolve ALU ops, so we need to adapt two test cases there, as min/max bound tracking only becomes necessary when registers were spilled to stack. So while mask was set before to track upper bound for UNKNOWN_VALUE case, it's now resolved directly as CONST_IMM, and such contructs are only necessary when f.e. registers are spilled. For commit 6b17387307ba ("bpf: recognize 64bit immediate loads as consts") that initially enabled dw load tracking only for nfp jit/ analyzer, I did couple of tests on large, complex programs and we don't increase complexity badly (my tests were in ~3% range on avg). I've added a couple of tests similar to affected code above, and it works fine with verifier now. Reported-by: William Tu <u9012063@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Cc: Gianluca Borello <g.borello@gmail.com> Cc: William Tu <u9012063@gmail.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-24bpf: add prog tag test case to bpf selftestsDaniel Borkmann
Add the test case used to compare the results from fdinfo with af_alg's output on the tag. Tests are from min to max sized programs, with and without maps included. # ./test_tag test_tag: OK (40945 tests) Tested on x86_64 and s390x. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-23bpf: Add tests for the lpm trie mapDavid Herrmann
The first part of this program runs randomized tests against the lpm-bpf-map. It implements a "Trivial Longest Prefix Match" (tlpm) based on simple, linear, single linked lists. The implementation should be pretty straightforward. Based on tlpm, this inserts randomized data into bpf-lpm-maps and verifies the trie-based bpf-map implementation behaves the same way as tlpm. The second part uses 'real world' IPv4 and IPv6 addresses and tests the trie with those. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Daniel Mack <daniel@zonque.org> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-19selftest: cpufreq: Add special testsViresh Kumar
This patch adds support for special tests which were reported on the PM list over the years, which helped catching core bugs by several developers. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftest: cpufreq: Add support to test cpufreq modulesViresh Kumar
This patch adds support for cpufreq modules like cpufreq drivers and cpufreq governors. The tests will insert the modules in different orders and them perform basic cpufreq tests. The modules are then removed from the kernel. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftest: cpufreq: Add suspend/resume/hibernate supportViresh Kumar
This patch adds support to test basic suspend/resume and hibernation to the cpufreq selftests. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftest: cpufreq: Add support for cpufreq testsViresh Kumar
This patch adds supports for basic cpufreq tests, which can be performed independent of any platform. It does basic tests for now, like - reading all cpufreq files - trying to update them - switching frequencies - switching governors This can be extended to have more specific tests later on. Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftests: Add intel_pstate to TARGETSStafford Horne
This test was missing from the TARGETS list. The test requires patches to cpupower to pass correctly. Cc: Prarit Bhargava <prarit@redhat.com> Signed-off-by: Stafford Horne <shorne@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftests/intel_pstate: Update makefile to match new styleStafford Horne
Recent changes from Bamvor (88baa78d1f318) have standardized the variable names like TEST_GEN_FILES and removed the need for make targets all and clean. These changes bring the intel_pstate test inline with those changes. Cc: Prarit Bhargava <prarit@redhat.com> Signed-off-by: Stafford Horne <shorne@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftests/intel_pstate: Fix warning on loop index overflowStafford Horne
The build was showing the warning: aperf.c:60:27: warning: iteration 2147483647 invokes undefined behavior [-Waggressive-loop-optimizations] for (i=0; i<0x8fffffff; i++) { This change sets i, cpu and fd to unsigned int as they should not need to be signed. Cc: Prarit Bhargava <prarit@redhat.com> Signed-off-by: Stafford Horne <shorne@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftests/futex: Add headers to makefile dependenciesStafford Horne
The futex makefile did not contain dependencies for all headers, so if we make changes to logging.h rebuild will not happen. Add headers to fix it up. Signed-off-by: Stafford Horne <shorne@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-19selftests/futex: Add stdio used for loggingStafford Horne
Fix missing printf compile warnings. Signed-off-by: Stafford Horne <shorne@gmail.com> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-18selftest/powerpc: Wrong PMC initialized in pmc56_overflow testMadhavan Srinivasan
Test uses PMC2 to count the event. But PMC1 is being initialized. Patch to fix it. Fixes: 3752e453f6ba ('selftests/powerpc: Add tests of PMU EBBs') Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
2017-01-17bpf: Fix test_lru_sanity5() in test_lru_map.cMartin KaFai Lau
test_lru_sanity5() fails when the number of online cpus is fewer than the number of possible cpus. It can be reproduced with qemu by using cmd args "--smp cpus=2,maxcpus=8". The problem is the loop in test_lru_sanity5() is testing 'i' which is incorrect. This patch: 1. Make sched_next_online() always return -1 if it cannot find a next cpu to schedule the process. 2. In test_lru_sanity5(), the parent process does sched_setaffinity() first (through sched_next_online()) and the forked process will inherit it according to the 'man sched_setaffinity'. Fixes: 5db58faf989f ("bpf: Add tests for the LRU bpf_htab") Reported-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-16Merge 4.10-rc4 into driver-core-nextGreg Kroah-Hartman
We want the sysfs file revert and other fixes in here as well for testing. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-14torture: Enable DEBUG_OBJECTS_RCU_HEAD for Tiny RCUPaul E. McKenney
The RCU torture tests currently do not run any Tiny RCU scenarios for CONFIG_DEBUG_OBJECTS_RCU_HEAD=y. This is a hole in the test, given that someone might need this in real life and given that Tiny RCU uses different callback-handling code than does Tree RCU. This commit therefore enables this Kconfig option for scenario TINY02. Reported-by: "Ahmed, Iftekhar" <ahmedi@oregonstate.edu> Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Update RCU test scenario documentationPaul E. McKenney
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Run a couple scenarios with CONFIG_RCU_EQS_DEBUGPaul E. McKenney
This commit runs TREE04 and TREE08 with CONFIG_RCU_EQS_DEBUG=y, enabling dyntick-counter checking on those two tests. Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Run one test with DEBUG_LOCK_ALLOC but not PROVE_LOCKINGPaul E. McKenney
This commit sets CONFIG_DEBUG_LOCK_ALLOC but not CONFIG_PROVE_LOCKING for TREE08 in order to have at least one test with this configuration. Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Run at least one test with CONFIG_DEBUG_OBJECTS_RCU_HEADPaul E. McKenney
This commit enables the CONFIG_DEBUG_OBJECTS_RCU_HEAD Kconfig option in TREE02 in order to do at least some testing with this enabled. Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Add tests without slow grace period setup/cleanupPaul E. McKenney
This commit moves CONFIG_RCU_TORTURE_TEST_SLOW_CLEANUP, CONFIG_RCU_TORTURE_TEST_SLOW_INIT, and CONFIG_RCU_TORTURE_TEST_SLOW_PREINIT from CFcommon to all of the TREE scenarios other than TREE08 and TREE09 in order to do at least some testing without these Kconfig options set. Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Add CONFIG_PROVE_RCU_REPEATEDLY=y for TINY02Paul E. McKenney
This commit adds CONFIG_PROVE_RCU_REPEATEDLY=y, which has been untested for quite some time. Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14torture: Add a check for CONFIG_RCU_STALL_COMMON for TINY01Paul E. McKenney
This commit verifies coverage of testing with CONFIG_RCU_STALL_COMMON=n. Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Reviewed-by: Josh Triplett <josh@joshtriplett.org>
2017-01-14locking/ww_mutex: Add ww_mutex to tools/testing/selftestsChris Wilson
Add the minimal test running (modprobe test-ww_mutex) to the kselftests CI framework. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20161201114711.28697-9-chris@chris-wilson.co.uk Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-01-14locking/ww_mutex: Add ww_mutex to locktorture testChris Wilson
Although ww_mutexes degenerate into mutexes, it would be useful to torture the deadlock handling between multiple ww_mutexes in addition to torturing the regular mutexes. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Maarten Lankhorst <dev@mblankhorst.nl> Cc: Nicolai Hähnle <nhaehnle@gmail.com> Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Link: http://lkml.kernel.org/r/20161201114711.28697-3-chris@chris-wilson.co.uk Signed-off-by: Ingo Molnar <mingo@kernel.org>
2017-01-12tools: psock_lib: harden socket filter used by psock testsSowmini Varadhan
The filter added by sock_setfilter is intended to only permit packets matching the pattern set up by create_payload(), but we only check the ip_len, and a single test-character in the IP packet to ensure this condition. Harden the filter by adding additional constraints so that we only permit UDP/IPv4 packets that meet the ip_len and test-character requirements. Include the bpf_asm src as a comment, in case this needs to be enhanced in the future Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-12bpf: allow b/h/w/dw access for bpf's cb in ctxDaniel Borkmann
When structs are used to store temporary state in cb[] buffer that is used with programs and among tail calls, then the generated code will not always access the buffer in bpf_w chunks. We can ease programming of it and let this act more natural by allowing for aligned b/h/w/dw sized access for cb[] ctx member. Various test cases are attached as well for the selftest suite. Potentially, this can also be reused for other program types to pass data around. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-11Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/netDavid S. Miller
Two AF_* families adding entries to the lockdep tables at the same time. Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-11selftests: x86 protection_keys remove dead codeShuah Khan
Remove commented out calls to pkey_get(). Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-11selftests: x86 protection_keys fix unused variable compile warningsShuah Khan
Fix unused variable compile warnings in protection_keys.c Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-11selftests: ipc add missing generated file to .gitignoreShuah Khan
Add missing generated file msgque to .gitignore Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-11selftests: gpio add .gitignore for generated filesShuah Khan
Add .gitignore for generated files Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-11selftests: firmware: send expected errors to /dev/nullLuis R. Rodriguez
Error that we expect should not be spilled to stdout. Without this we get: ./fw_filesystem.sh: line 58: printf: write error: Invalid argument ./fw_filesystem.sh: line 63: printf: write error: No such device ./fw_filesystem.sh: line 69: echo: write error: No such file or directory ./fw_filesystem.sh: filesystem loading works ./fw_filesystem.sh: async filesystem loading works With it: ./fw_filesystem.sh: filesystem loading works ./fw_filesystem.sh: async filesystem loading works Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-11selftests: firmware: only modprobe if driver is missingLuis R. Rodriguez
No need to load test_firmware if its already there. Also use a more generic form to recommend what is required to be built. Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-01-09bpf: allow helpers access to variable memoryGianluca Borello
Currently, helpers that read and write from/to the stack can do so using a pair of arguments of type ARG_PTR_TO_STACK and ARG_CONST_STACK_SIZE. ARG_CONST_STACK_SIZE accepts a constant register of type CONST_IMM, so that the verifier can safely check the memory access. However, requiring the argument to be a constant can be limiting in some circumstances. Since the current logic keeps track of the minimum and maximum value of a register throughout the simulated execution, ARG_CONST_STACK_SIZE can be changed to also accept an UNKNOWN_VALUE register in case its boundaries have been set and the range doesn't cause invalid memory accesses. One common situation when this is useful: int len; char buf[BUFSIZE]; /* BUFSIZE is 128 */ if (some_condition) len = 42; else len = 84; some_helper(..., buf, len & (BUFSIZE - 1)); The compiler can often decide to assign the constant values 42 or 48 into a variable on the stack, instead of keeping it in a register. When the variable is then read back from stack into the register in order to be passed to the helper, the verifier will not be able to recognize the register as constant (the verifier is not currently tracking all constant writes into memory), and the program won't be valid. However, by allowing the helper to accept an UNKNOWN_VALUE register, this program will work because the bitwise AND operation will set the range of possible values for the UNKNOWN_VALUE register to [0, BUFSIZE), so the verifier can guarantee the helper call will be safe (assuming the argument is of type ARG_CONST_STACK_SIZE_OR_ZERO, otherwise one more check against 0 would be needed). Custom ranges can be set not only with ALU operations, but also by explicitly comparing the UNKNOWN_VALUE register with constants. Another very common example happens when intercepting system call arguments and accessing user-provided data of variable size using bpf_probe_read(). One can load at runtime the user-provided length in an UNKNOWN_VALUE register, and then read that exact amount of data up to a compile-time determined limit in order to fit into the proper local storage allocated on the stack, without having to guess a suboptimal access size at compile time. Also, in case the helpers accepting the UNKNOWN_VALUE register operate in raw mode, disable the raw mode so that the program is required to initialize all memory, since there is no guarantee the helper will fill it completely, leaving possibilities for data leak (just relevant when the memory used by the helper is the stack, not when using a pointer to map element value or packet). In other words, ARG_PTR_TO_RAW_STACK will be treated as ARG_PTR_TO_STACK. Signed-off-by: Gianluca Borello <g.borello@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-09bpf: allow adjusted map element values to spillGianluca Borello
commit 484611357c19 ("bpf: allow access into map value arrays") introduces the ability to do pointer math inside a map element value via the PTR_TO_MAP_VALUE_ADJ register type. The current support doesn't handle the case where a PTR_TO_MAP_VALUE_ADJ is spilled into the stack, limiting several use cases, especially when generating bpf code from a compiler. Handle this case by explicitly enabling the register type PTR_TO_MAP_VALUE_ADJ to be spilled. Also, make sure that min_value and max_value are reset just for BPF_LDX operations that don't result in a restore of a spilled register from stack. Signed-off-by: Gianluca Borello <g.borello@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-09bpf: allow helpers access to map element valuesGianluca Borello
Enable helpers to directly access a map element value by passing a register type PTR_TO_MAP_VALUE (or PTR_TO_MAP_VALUE_ADJ) to helper arguments ARG_PTR_TO_STACK or ARG_PTR_TO_RAW_STACK. This enables several use cases. For example, a typical tracing program might want to capture pathnames passed to sys_open() with: struct trace_data { char pathname[PATHLEN]; }; SEC("kprobe/sys_open") void bpf_sys_open(struct pt_regs *ctx) { struct trace_data data; bpf_probe_read(data.pathname, sizeof(data.pathname), ctx->di); /* consume data.pathname, for example via * bpf_trace_printk() or bpf_perf_event_output() */ } Such a program could easily hit the stack limit in case PATHLEN needs to be large or more local variables need to exist, both of which are quite common scenarios. Allowing direct helper access to map element values, one could do: struct bpf_map_def SEC("maps") scratch_map = { .type = BPF_MAP_TYPE_PERCPU_ARRAY, .key_size = sizeof(u32), .value_size = sizeof(struct trace_data), .max_entries = 1, }; SEC("kprobe/sys_open") int bpf_sys_open(struct pt_regs *ctx) { int id = 0; struct trace_data *p = bpf_map_lookup_elem(&scratch_map, &id); if (!p) return; bpf_probe_read(p->pathname, sizeof(p->pathname), ctx->di); /* consume p->pathname, for example via * bpf_trace_printk() or bpf_perf_event_output() */ } And wouldn't risk exhausting the stack. Code changes are loosely modeled after commit 6841de8b0d03 ("bpf: allow helpers access the packet directly"). Unlike with PTR_TO_PACKET, these changes just work with ARG_PTR_TO_STACK and ARG_PTR_TO_RAW_STACK (not ARG_PTR_TO_MAP_KEY, ARG_PTR_TO_MAP_VALUE, ...): adding those would be trivial, but since there is not currently a use case for that, it's reasonable to limit the set of changes. Also, add new tests to make sure accesses to map element values from helpers never go out of boundary, even when adjusted. Signed-off-by: Gianluca Borello <g.borello@gmail.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-09Merge tag 'drm-misc-next-2016-12-30' of ↵Dave Airlie
git://anongit.freedesktop.org/git/drm-misc into drm-next First -misc pull for 4.11: - drm_mm rework + lots of selftests (Chris Wilson) - new connector_list locking+iterators - plenty of kerneldoc updates - format handling rework from Ville - atomic helper changes from Maarten for better plane corner-case handling in drivers, plus the i915 legacy cursor patch that needs this - bridge cleanup from Laurent - plus plenty of small stuff all over - also contains a merge of the 4.10 docs tree so that we could apply the dma-buf kerneldoc patches It's a lot more than usual, but due to the merge window blackout it also covers about 4 weeks, so all in line again on a per-week basis. The more annoying part with no pull request for 4 weeks is managing cross-tree work. The -intel pull request I'll follow up with does conflict quite a bit with -misc here. Longer-term (if drm-misc keeps growing) a drm-next-queued to accept pull request for the next merge window during this time might be useful. I'd also like to backmerge -rc2+this into drm-intel next week, we have quite a pile of patches waiting for the stuff in here. * tag 'drm-misc-next-2016-12-30' of git://anongit.freedesktop.org/git/drm-misc: (126 commits) drm: Add kerneldoc markup for new @scan parameters in drm_mm drm/mm: Document locking rules drm: Use drm_mm_insert_node_in_range_generic() for everyone drm: Apply range restriction after color adjustment when allocation drm: Wrap drm_mm_node.hole_follows drm: Apply tight eviction scanning to color_adjust drm: Simplify drm_mm scan-list manipulation drm: Optimise power-of-two alignments in drm_mm_scan_add_block() drm: Compute tight evictions for drm_mm_scan drm: Fix application of color vs range restriction when scanning drm_mm drm: Unconditionally do the range check in drm_mm_scan_add_block() drm: Rename prev_node to hole in drm_mm_scan_add_block() drm: Fix O= out-of-tree builds for selftests drm: Extract struct drm_mm_scan from struct drm_mm drm: Add asserts to catch overflow in drm_mm_init() and drm_mm_init_scan() drm: Simplify drm_mm_clean() drm: Detect overflow in drm_mm_reserve_node() drm: Fix kerneldoc for drm_mm_scan_remove_block() drm: Promote drm_mm alignment to u64 drm: kselftest for drm_mm and restricted color eviction ...
2017-01-05selftests: enable O and KBUILD_OUTPUTbamvor.zhangjian@huawei.com
Enable O and KBUILD_OUTPUT for kselftest. User could compile kselftest to another directory by passing O or KBUILD_OUTPUT. And O is high priority than KBUILD_OUTPUT. Signed-off-by: Bamvor Jian Zhang <bamvor.zhangjian@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-05selftests: add EXTRA_CLEAN for clean targetbamvor.zhangjian@huawei.com
Some testcases need the clean extra data after running. This patch introduce the "EXTRA_CLEAN" variable to address this requirement. After KBUILD_OUTPUT is enabled in later patch, it will be easy to decide to if we need do the cleanup in the KBUILD_OUTPUT path(if the testcase ran immediately after compiled). Signed-off-by: Bamvor Jian Zhang <bamvor.zhangjian@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-05selftests: remove CROSS_COMPILE in dedicated Makefilebamvor.zhangjian@huawei.com
After previous clean up patches, memfd and timers could get CROSS_COMPILE from tools/testing/selftest/lib.mk. There is no need to preserve these definition. So, this patch remove them. Acked-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Bamvor Jian Zhang <bamvor.zhangjian@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
2017-01-05selftests: add default rules for c source filebamvor.zhangjian@huawei.com
There are difference rules for compiling c source file in different testcases. In order to enable KBUILD_OUTPUT support in later patch, this patch introduce the default rules in "tools/testing/selftest/lib.mk" and remove the existing rules in each testcase. Acked-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Bamvor Jian Zhang <bamvor.zhangjian@linaro.org> Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>