- Linux-kselftest-mirror - lists.linaro.org

[PATCH bpf,v4 0/4] Socket lookup BPF API from tc/xdp ingress does not respect VRF bindings.

by Gilad Sever

When calling socket lookup from L2 (tc, xdp), VRF boundaries aren't respected. This patchset fixes this by regarding the incoming device's VRF attachment when performing the socket lookups from tc/xdp. The first two patches are coding changes which factor out the tc helper's logic which was shared with cg/sk_skb (which operate correctly). This refactoring is needed in order to avoid affecting the cgroup/sk_skb flows as there does not seem to be a strict criteria for discerning which flow the helper is called from based on the net device or packet information. The third patch contains the actual bugfix. The fourth patch adds bpf tests for these lookup functions. --- v4: - Move dev_sdif() to include/linux/netdevice.h as suggested by Stanislav Fomichev - Remove SYS and SYS_NOFAIL duplicate definitions v3: - Rename bpf_l2_sdif() to dev_sdif() as suggested by Stanislav Fomichev - Added xdp tests as suggested by Daniel Borkmann - Use start_server() to avoid duplicate code as suggested by Stanislav Fomichev v2: Fixed uninitialized var in test patch (4). Gilad Sever (4): bpf: factor out socket lookup functions for the TC hookpoint. bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint bpf: fix bpf socket lookup from tc/xdp to respect socket VRF bindings selftests/bpf: Add vrf_socket_lookup tests include/linux/netdevice.h | 9 + net/core/filter.c | 123 +++++-- .../bpf/prog_tests/vrf_socket_lookup.c | 312 ++++++++++++++++++ .../selftests/bpf/progs/vrf_socket_lookup.c | 88 +++++ 4 files changed, 511 insertions(+), 21 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/vrf_socket_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/vrf_socket_lookup.c -- 2.34.1

2 years, 8 months

2
5
0 0

[PATCH v9 2/3] mm: add new KSM process and sysfs knobs

by xu xin

> This adds the general_profit KSM sysfs knob and the process profit metric > knobs to ksm_stat. > > 1) expose general_profit metric > > The documentation mentions a general profit metric, however this > metric is not calculated. In addition the formula depends on the size > of internal structures, which makes it more difficult for an > administrator to make the calculation. Adding the metric for a better > user experience. > > 2) document general_profit sysfs knob > > 3) calculate ksm process profit metric > > The ksm documentation mentions the process profit metric and how to > calculate it. This adds the calculation of the metric. > > 4) mm: expose ksm process profit metric in ksm_stat > > This exposes the ksm process profit metric in /proc/<pid>/ksm_stat. > The documentation mentions the formula for the ksm process profit > metric, however it does not calculate it. In addition the formula > depends on the size of internal structures. So it makes sense to > expose it. > Hi, Stefan, I think you should give some credits to me about my contributions on the concept and formula of ksm profit (process wide and system wide), it's kind of idea stealing. Besides, the idea of Process control KSM was proposed by me last year although you use prctl instead of /proc fs. you even didn't CC my email. I think you should CC my email (xu.xin16(a)zte.com.cn) as least. > 5) document new procfs ksm knobs > > Signed-off-by: Stefan Roesch <shr(a)devkernel.io> > Reviewed-by: Bagas Sanjaya <bagasdotme(a)gmail.com> > Acked-by: David Hildenbrand <david(a)redhat.com> > Cc: David Hildenbrand <david(a)redhat.com> > Cc: Johannes Weiner <hannes(a)cmpxchg.org> > Cc: Michal Hocko <mhocko(a)suse.com> > Cc: Rik van Riel <riel(a)surriel.com> > Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> > --- > Documentation/ABI/testing/sysfs-kernel-mm-ksm | 8 +++++++ > Documentation/admin-guide/mm/ksm.rst | 5 ++++- > fs/proc/base.c | 3 +++ > include/linux/ksm.h | 4 ++++ > mm/ksm.c | 21 +++++++++++++++++++ > 5 files changed, 40 insertions(+), 1 deletion(-) > > diff --git a/Documentation/ABI/testing/sysfs-kernel-mm-ksm b/Documentation/ABI/testing/sysfs-kernel-mm-ksm > index d244674a9480..6041a025b65a 100644 > --- a/Documentation/ABI/testing/sysfs-kernel-mm-ksm > +++ b/Documentation/ABI/testing/sysfs-kernel-mm-ksm > @@ -51,3 +51,11 @@ Description: Control merging pages across different NUMA nodes. > > When it is set to 0 only pages from the same node are merged, > otherwise pages from all nodes can be merged together (default). > + > +What: /sys/kernel/mm/ksm/general_profit > +Date: April 2023 > +KernelVersion: 6.4 > +Contact: Linux memory management mailing list <linux-mm(a)kvack.org> > +Description: Measure how effective KSM is. > + general_profit: how effective is KSM. The formula for the > + calculation is in Documentation/admin-guide/mm/ksm.rst. > diff --git a/Documentation/admin-guide/mm/ksm.rst b/Documentation/admin-guide/mm/ksm.rst

2 years, 8 months

2
1
0 0

[net] selftests: srv6: make srv6_end_dt46_l3vpn_test more robust

by Andrea Mayer

On some distributions, the rp_filter is automatically set (=1) by default on a netdev basis (also on VRFs). In an SRv6 End.DT46 behavior, decapsulated IPv4 packets are routed using the table associated with the VRF bound to that tunnel. During lookup operations, the rp_filter can lead to packet loss when activated on the VRF. Therefore, we chose to make this selftest more robust by explicitly disabling the rp_filter during tests (as it is automatically set by some Linux distributions). Fixes: 03a0b567a03d ("selftests: seg6: add selftest for SRv6 End.DT46 Behavior") Reported-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Tested-by: Hangbin Liu <liuhangbin(a)gmail.com> --- .../testing/selftests/net/srv6_end_dt46_l3vpn_test.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh index aebaab8ce44c..441eededa031 100755 --- a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh +++ b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh @@ -292,6 +292,11 @@ setup_hs() ip netns exec ${hsname} sysctl -wq net.ipv6.conf.all.accept_dad=0 ip netns exec ${hsname} sysctl -wq net.ipv6.conf.default.accept_dad=0 + # disable the rp_filter otherwise the kernel gets confused about how + # to route decap ipv4 packets. + ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${rtname} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip -netns ${hsname} link add veth0 type veth peer name ${rtveth} ip -netns ${hsname} link set ${rtveth} netns ${rtname} ip -netns ${hsname} addr add ${IPv6_HS_NETWORK}::${hs}/64 dev veth0 nodad @@ -316,11 +321,6 @@ setup_hs() ip netns exec ${rtname} sysctl -wq net.ipv6.conf.${rtveth}.proxy_ndp=1 ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.proxy_arp=1 - # disable the rp_filter otherwise the kernel gets confused about how - # to route decap ipv4 packets. - ip netns exec ${rtname} sysctl -wq net.ipv4.conf.all.rp_filter=0 - ip netns exec ${rtname} sysctl -wq net.ipv4.conf.${rtveth}.rp_filter=0 - ip netns exec ${rtname} sh -c "echo 1 > /proc/sys/net/vrf/strict_mode" } -- 2.20.1

2 years, 8 months

3
2
0 0

[PATCH] selftests/powerpc: Replace obsolete memalign() with posix_memalign()

by Deming Wang

memalign() is obsolete according to its manpage. Replace memalign() with posix_memalign() and remove malloc.h include that was there for memalign(). As a pointer is passed into posix_memalign(), initialize *s to NULL to silence a warning about the function's return value being used as uninitialized (which is not valid anyway because the error is properly checked before s is returned). Signed-off-by: Deming Wang <wangdeming(a)inspur.com> --- tools/testing/selftests/powerpc/stringloops/strlen.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/testing/selftests/powerpc/stringloops/strlen.c b/tools/testing/selftests/powerpc/stringloops/strlen.c index 9055ebc484d0..f9c1f9cc2d32 100644 --- a/tools/testing/selftests/powerpc/stringloops/strlen.c +++ b/tools/testing/selftests/powerpc/stringloops/strlen.c @@ -1,5 +1,4 @@ // SPDX-License-Identifier: GPL-2.0 -#include <malloc.h> #include <stdlib.h> #include <string.h> #include <time.h> @@ -51,10 +50,11 @@ static void bench_test(char *s) static int testcase(void) { char *s; + int ret; unsigned long i; - s = memalign(128, SIZE); - if (!s) { + ret = posix_memalign((void **)&s, 128, SIZE); + if (ret < 0) { perror("memalign"); exit(1); } -- 2.27.0

2 years, 8 months

2
1
0 0

[PATCH tracing 0/3] tracing: support > 8 byte filter predicates

by Alan Maguire

For cases like IPv6 addresses, having a means to supply tracing predicates for fields with more than 8 bytes would be convenient. This series provides a simple way to support this by allowing simple ==, != memory comparison with the predicate supplied when the size of the field exceeds 8 bytes. For example, to trace ::1, the predicate "dst == 0x00000000000000000000000000000001" ..could be used. Patch 1 provides the support for > 8 byte fields via a memcmp()-style predicate. Patch 2 adds tests for filter predicates, and patch 3 documents the fact that for > 8 bytes. only == and != are supported. Changes since RFC [1]: - originally a fix was intermixed with the new functionality as patch 1 in series [1]; the fix landed separately - small tweaks to how filter predicates are defined via fn_num as opposed to via fn directly [1] https://lore.kernel.org/lkml/1659910883-18223-1-git-send-email-alan.maguire… Alan Maguire (3): tracing: support > 8 byte array filter predicates selftests/ftrace: add test coverage for filter predicates tracing: document > 8 byte numeric filtering support Documentation/trace/events.rst | 9 +++ kernel/trace/trace_events_filter.c | 55 +++++++++++++++- .../selftests/ftrace/test.d/event/filter.tc | 62 +++++++++++++++++++ 3 files changed, 125 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/ftrace/test.d/event/filter.tc -- 2.31.1

2 years, 8 months

4
11
0 0

[PATCH bpf] selftests/bpf: fix pkg-config call building sign-file

by Jeremy Sowden

When building sign-file, the call to get the CFLAGS for libcrypto is missing white-space between `pkg-config` and `--cflags`: $(shell $(HOSTPKG_CONFIG)--cflags libcrypto 2> /dev/null) Removing the redirection of stderr, we see: $ make -C tools/testing/selftests/bpf sign-file make: Entering directory '[...]/tools/testing/selftests/bpf' make: pkg-config--cflags: No such file or directory SIGN-FILE sign-file make: Leaving directory '[...]/tools/testing/selftests/bpf' Add the missing space. Fixes: fc97590668ae ("selftests/bpf: Add test for bpf_verify_pkcs7_signature() kfunc") Signed-off-by: Jeremy Sowden <jeremy(a)azazel.net> --- tools/testing/selftests/bpf/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile index b677dcd0b77a..ad01c9e1ff12 100644 --- a/tools/testing/selftests/bpf/Makefile +++ b/tools/testing/selftests/bpf/Makefile @@ -197,7 +197,7 @@ $(OUTPUT)/urandom_read: urandom_read.c urandom_read_aux.c $(OUTPUT)/liburandom_r $(OUTPUT)/sign-file: ../../../../scripts/sign-file.c $(call msg,SIGN-FILE,,$@) - $(Q)$(CC) $(shell $(HOSTPKG_CONFIG)--cflags libcrypto 2> /dev/null) \ + $(Q)$(CC) $(shell $(HOSTPKG_CONFIG) --cflags libcrypto 2> /dev/null) \ $< -o $@ \ $(shell $(HOSTPKG_CONFIG) --libs libcrypto 2> /dev/null || echo -lcrypto) -- 2.39.2

2 years, 8 months

3
3
0 0

[PATCH bpf,v3 0/4] Socket lookup BPF API from tc/xdp ingress does not respect VRF bindings.

by Gilad Sever

When calling socket lookup from L2 (tc, xdp), VRF boundaries aren't respected. This patchset fixes this by regarding the incoming device's VRF attachment when performing the socket lookups from tc/xdp. The first two patches are coding changes which factor out the tc helper's logic which was shared with cg/sk_skb (which operate correctly). This refactoring is needed in order to avoid affecting the cgroup/sk_skb flows as there does not seem to be a strict criteria for discerning which flow the helper is called from based on the net device or packet information. The third patch contains the actual bugfix. The fourth patch adds bpf tests for these lookup functions. --- v3: - Rename bpf_l2_sdif() to dev_sdif() as suggested by Stanislav Fomichev - Added xdp tests as suggested by Daniel Borkmann - Use start_server() to avoid duplicate code as suggested by Stanislav Fomichev v2: Fixed uninitialized var in test patch (4). Gilad Sever (4): bpf: factor out socket lookup functions for the TC hookpoint. bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint bpf: fix bpf socket lookup from tc/xdp to respect socket VRF bindings selftests/bpf: Add vrf_socket_lookup tests net/core/filter.c | 132 +++++-- .../bpf/prog_tests/vrf_socket_lookup.c | 327 ++++++++++++++++++ .../selftests/bpf/progs/vrf_socket_lookup.c | 88 +++++ 3 files changed, 526 insertions(+), 21 deletions(-) create mode 100644 tools/testing/selftests/bpf/prog_tests/vrf_socket_lookup.c create mode 100644 tools/testing/selftests/bpf/progs/vrf_socket_lookup.c -- 2.34.1

2 years, 8 months

2
8
0 0

[PATCH v2] selftests/kselftest/runner/run_one(): Allow running non-executable files

by SeongJae Park

From: SeongJae Park <sjpark(a)amazon.de> When running a test program, 'run_one()' checks if the program has the execution permission and fails if it doesn't. However, it's easy to mistakenly missing the permission, as some common tools like 'diff' don't support the permission change well[1]. Compared to that, making mistakes in the test program's path would only rare, as those are explicitly listed in 'TEST_PROGS'. Therefore, it might make more sense to resolve the situation on our own and run the program. For the reason, this commit makes the test program runner function to still print the warning message but try parsing the interpreter of the program and explicitly run it with the interpreter, in the case. [1] https://lore.kernel.org/mm-commits/YRJisBs9AunccCD4@kroah.com/ Suggested-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: SeongJae Park <sjpark(a)amazon.de> --- Changes from v1 (https://lore.kernel.org/linux-kselftest/20210810140459.23990-1-sj38.park@gm…) - Parse and use the interpreter instead of changing the file tools/testing/selftests/kselftest/runner.sh | 28 +++++++++++++-------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh index cc9c846585f0..a9ba782d8ca0 100644 --- a/tools/testing/selftests/kselftest/runner.sh +++ b/tools/testing/selftests/kselftest/runner.sh @@ -33,9 +33,9 @@ tap_timeout() { # Make sure tests will time out if utility is available. if [ -x /usr/bin/timeout ] ; then - /usr/bin/timeout --foreground "$kselftest_timeout" "$1" + /usr/bin/timeout --foreground "$kselftest_timeout" $1 else - "$1" + $1 fi } @@ -65,17 +65,25 @@ run_one() TEST_HDR_MSG="selftests: $DIR: $BASENAME_TEST" echo "# $TEST_HDR_MSG" - if [ ! -x "$TEST" ]; then - echo -n "# Warning: file $TEST is " - if [ ! -e "$TEST" ]; then - echo "missing!" - else - echo "not executable, correct this." - fi + if [ ! -e "$TEST" ]; then + echo "# Warning: file $TEST is missing!" echo "not ok $test_num $TEST_HDR_MSG" else + cmd="./$BASENAME_TEST" + if [ ! -x "$TEST" ]; then + echo "# Warning: file $TEST is not executable" + + if [ $(head -n 1 "$TEST" | cut -c -2) = "#!" ] + then + interpreter=$(head -n 1 "$TEST" | cut -c 3-) + cmd="$interpreter ./$BASENAME_TEST" + else + echo "not ok $test_num $TEST_HDR_MSG" + return + fi + fi cd `dirname $TEST` > /dev/null - ((((( tap_timeout ./$BASENAME_TEST 2>&1; echo $? >&3) | + ((((( tap_timeout "$cmd" 2>&1; echo $? >&3) | tap_prefix >&4) 3>&1) | (read xs; exit $xs)) 4>>"$logfile" && echo "ok $test_num $TEST_HDR_MSG") || -- 2.17.1

2 years, 8 months

3
6
0 0

[PATCH bpf-next v3 0/2] Introduce a new kfunc of bpf_task_under_cgroup

by Feng zhou

From: Feng Zhou <zhoufeng.zf(a)bytedance.com> Trace sched related functions, such as enqueue_task_fair, it is necessary to specify a task instead of the current task which within a given cgroup. Feng Zhou (2): bpf: Add bpf_task_under_cgroup() kfunc selftests/bpf: Add testcase for bpf_task_under_cgroup Changelog: v2->v3: Addressed comments from Alexei Starovoitov - Modify the comment information of the function. - Narrow down the testcase's hook point Details in here: https://lore.kernel.org/all/20230421090403.15515-1-zhoufeng.zf@bytedance.co… v1->v2: Addressed comments from Alexei Starovoitov - Add kfunc instead. Details in here: https://lore.kernel.org/all/20230420072657.80324-1-zhoufeng.zf@bytedance.co… kernel/bpf/helpers.c | 20 ++++++++ tools/testing/selftests/bpf/DENYLIST.s390x | 1 + .../bpf/prog_tests/task_under_cgroup.c | 47 +++++++++++++++++++ .../selftests/bpf/progs/cgrp_kfunc_common.h | 1 + .../bpf/progs/test_task_under_cgroup.c | 37 +++++++++++++++ 5 files changed, 106 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/task_under_cgroup.c create mode 100644 tools/testing/selftests/bpf/progs/test_task_under_cgroup.c -- 2.20.1

2 years, 8 months

2
3
0 0

[RFC][PATCH 0/6] KEYS: Introduce user mode key and signature parsers

by Roberto Sassu

From: Roberto Sassu <roberto.sassu(a)huawei.com> Goals ===== Support new key and signature formats with the same kernel component. Verify the authenticity of system data with newly supported data formats. Mitigate the risk of parsing arbitrary data in the kernel. Motivation ========== Adding new functionality to the kernel comes with an increased risk of introducing new bugs which, once exploited, can lead to a partial or full system compromise. Parsing arbitrary data is particularly critical, since it allows an attacker to send a malicious sequence of bytes to exploit vulnerabilities in the parser code. The attacker might be able to overwrite kernel memory to bypass kernel protections, and obtain more privileges. User Mode Drivers (UMDs) can effectively mitigate this risk. If the parser runs in user space, even if it has a bug, it won't allow the attacker to overwrite kernel memory. The communication protocol between the UMD and the kernel should be simple enough, that the kernel can immediately recognize malformed data sent by an attacker controlling the UMD, and discard it. Solution ======== Register a new parser of the asymmetric key type which, instead of parsing the key blob, forwards it to a UMD, and populates the key fields from the UMD response. That response contains the data for each field of the public key structure, defined in the kernel, and possibly a key description. Supporting new data formats can be achieved by simply extending the UMD. As long as the UMD recognizes them, and provides the crypto material to the kernel Crypto API in the expected format, the kernel does not need to be aware of the UMD changes. Add a new API to verify the authenticity of system data, similar to the one for PKCS#7 signatures. As for the key parser, send the signature to a UMD, and fill the public_key_signature structure from the UMD response. The API still supports a very basic trust model, it accepts a key for signature verification if it is in the supplied keyring. The API can be extended later to support more sophisticated models. Use cases ========= eBPF ---- The eBPF infrastructure already offers to eBPF programs the ability to verify PKCS#7 signatures, through the bpf_verify_pkcs7_signature() kfunc. Add the new bpf_verify_umd_signature() kfunc, to allow eBPF programs verify signatures in a data format that is not PKCS#7 (for example PGP). IMA Appraisal ------------- An alternative to appraising each file with its signature (Fedora 38) is to build a repository of reference file digests from signed RPM headers, and lookup the calculated digest of files being accessed in that repository (DIGLIM[1]). With this patch set, the kernel can verify the authenticity of RPM headers from their PGP signature against the Linux distribution GPG keys. Once verified, RPM headers can be parsed with a UMD to build the repository of reference file digests. With DIGLIM, Linux distributions are not required to change anything in their building infrastructure (no extra data in the RPM header, no new PKI for IMA signatures). [1]: https://lore.kernel.org/linux-integrity/20210914163401.864635-1-roberto.sas… UMD development =============== The header file crypto/asymmetric_keys/umd_key_sig_umh.h contains the details of the communication protocol between the kernel and the UMD handler. The UMD handler should implement the commands defined, CMD_KEY and CMD_SIG, should set the result of the processing, and fill the key and signature-specific structures umd_key_msg_out and umd_sig_msg_out. The UMD handler should provide the key and signature blobs in a format that is understood by the kernel. For example, for RSA keys, it should provide them in ASN.1 format (SEQUENCE of INTEGER). The auth IDs of the keys and signatures should match, for signature verification. Auth ID matching can be partial. Patch set dependencies ====================== This patch set depends on 'usermode_driver: Add management library and API': https://lore.kernel.org/bpf/20230317145240.363908-1-roberto.sassu@huaweiclo… Patch set content ================= Patch 1 introduces the new parser for the asymmetric key type. Patch 2 introduces the parser for signatures and its API. Patch 3 introduces the system-level API for signature verification. Patch 4 extends eBPF to use the new system-level API. Patch 5 adds a test for UMD-parser signatures (not executed until the UMD supports PGP). Patch 6 introduces the skeleton of the UMD handler. PGP === A work in progress implementation of the PGP format (RFC 4880 and RFC 6637) in the UMD handler is available at: https://github.com/robertosassu/linux/commits/pgp-signatures-umd-v1-devel-v… It is based on a previous work of David Howells, available at: https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-modsign.git/… The patches have been adapted for use in user space. Roberto Sassu (6): KEYS: asymmetric: Introduce UMD-based asymmetric key parser KEYS: asymmetric: Introduce UMD-based asymmetric key signature parser verification: Introduce verify_umd_signature() and verify_umd_message_sig() bpf: Introduce bpf_verify_umd_signature() kfunc selftests/bpf: Prepare a test for UMD-parsed signatures KEYS: asymmetric: Add UMD handler .gitignore | 3 + MAINTAINERS | 1 + certs/system_keyring.c | 125 ++++++ crypto/asymmetric_keys/Kconfig | 32 ++ crypto/asymmetric_keys/Makefile | 23 + crypto/asymmetric_keys/asymmetric_type.c | 3 +- crypto/asymmetric_keys/umd_key.h | 28 ++ crypto/asymmetric_keys/umd_key_parser.c | 203 +++++++++ crypto/asymmetric_keys/umd_key_sig_loader.c | 32 ++ crypto/asymmetric_keys/umd_key_sig_umh.h | 71 +++ crypto/asymmetric_keys/umd_key_sig_umh_blob.S | 7 + crypto/asymmetric_keys/umd_key_sig_umh_user.c | 84 ++++ crypto/asymmetric_keys/umd_sig_parser.c | 416 ++++++++++++++++++ include/crypto/umd_sig.h | 71 +++ include/keys/asymmetric-type.h | 1 + include/linux/verification.h | 48 ++ kernel/trace/bpf_trace.c | 69 ++- ...ify_pkcs7_sig.c => verify_pkcs7_umd_sig.c} | 109 +++-- ...kcs7_sig.c => test_verify_pkcs7_umd_sig.c} | 18 +- .../testing/selftests/bpf/verify_sig_setup.sh | 82 +++- 20 files changed, 1378 insertions(+), 48 deletions(-) create mode 100644 crypto/asymmetric_keys/umd_key.h create mode 100644 crypto/asymmetric_keys/umd_key_parser.c create mode 100644 crypto/asymmetric_keys/umd_key_sig_loader.c create mode 100644 crypto/asymmetric_keys/umd_key_sig_umh.h create mode 100644 crypto/asymmetric_keys/umd_key_sig_umh_blob.S create mode 100644 crypto/asymmetric_keys/umd_key_sig_umh_user.c create mode 100644 crypto/asymmetric_keys/umd_sig_parser.c create mode 100644 include/crypto/umd_sig.h rename tools/testing/selftests/bpf/prog_tests/{verify_pkcs7_sig.c => verify_pkcs7_umd_sig.c} (75%) rename tools/testing/selftests/bpf/progs/{test_verify_pkcs7_sig.c => test_verify_pkcs7_umd_sig.c} (82%) -- 2.25.1

2 years, 8 months

3
12
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-kselftest-mirror