Skip to content

Conversation

PlaidCat
Copy link
Collaborator

LE-3025

Config Changes

None

Build Log

[jmaple@devbox code]$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" kernel-build-ciq-6.12.y-next-036e3db84c67.log
kABI check will be skipped
/mnt/code/kernel-src-tree
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated .config .config.old
[TIMER]{MRPROPER}: 7s
x86_64 architecture detected, copying config
'ciq/configs/kernel-x86_64.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-_automation_tmp__ciq-6.12.y-next-036e3db84c67"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  GEN     arch/x86/include/generated/asm/orc_hash.h
  WRAP    arch/x86/include/generated/uapi/asm/bpf_perf_event.h
  WRAP    arch/x86/include/generated/uapi/asm/errno.h
  UPD     include/generated/uapi/linux/version.h
  WRAP    arch/x86/include/generated/uapi/asm/fcntl.h
--
  LD [M]  net/qrtr/qrtr-mhi.ko
  BTF [M] net/qrtr/qrtr.ko
  LD [M]  virt/lib/irqbypass.ko
  BTF [M] net/qrtr/qrtr-mhi.ko
  BTF [M] virt/lib/irqbypass.ko
[TIMER]{BUILD}: 1725s
Making Modules
  SYMLINK /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/build
  INSTALL /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/modules.order
  INSTALL /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/modules.builtin
  INSTALL /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/modules.builtin.modinfo
--
  STRIP   /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/kernel/net/qrtr/qrtr-mhi.ko
  STRIP   /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/kernel/virt/lib/irqbypass.ko
  SIGN    /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+/kernel/net/qrtr/qrtr-mhi.ko
  DEPMOD  /lib/modules/6.12.28-_automation_tmp__ciq-6.12.y-next-036e3db84c67+
[TIMER]{MODULES}: 7s
Making Install
  INSTALL /boot
[TIMER]{INSTALL}: 23s
Checking kABI
kABI check skipped
Setting Default Kernel to /boot/vmlinuz-6.12.27-_automation_tmp__ciq-6.12.y-next-8a1c6a14ab72+ and Index to 3
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 7s
[TIMER]{BUILD}: 1725s
[TIMER]{MODULES}: 7s
[TIMER]{INSTALL}: 23s
[TIMER]{TOTAL} 1769s
Rebooting in 10 seconds

KeslfTests

[jmaple@devbox code]$ ls 6.12.27-_automation_tmp__ciq-6.12.y-next-8a1c6a14ab72+.kselftest.log kselftest.6.12.28-_automation_tmp__ciq-6.12.y-next-8a1c6a14ab72+.log | while read line ; do echo $line; grep '^ok ' $line | wc -l; done
6.12.27-_automation_tmp__ciq-6.12.y-next-8a1c6a14ab72+.kselftest.log
522
kselftest.6.12.28-_automation_tmp__ciq-6.12.y-next-8a1c6a14ab72+.log
522

PlaidCat and others added 15 commits May 12, 2025 16:19
Adding configs based of Fedora-ARK default config from 6.12.15.

We are modifying these with the following configs where available
CONFIG_MODIFY_LDT_SYSCALL=n
CONFIG_LEGACY_VSYSCALL_NONE=n
These options are for old software support which adds performance
overhead and potential attack surfaces with go against the CIQ LT
kernels priority of performance and security.

CONFIG_LIVEPATCH=n
We do not have Live patching on for any road-map, is not even supported
as a config for ARM.

CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
This should be enabled, it often improves performance funnily enough

CONFIG_PREEMPT_VOLUNTARY=y
CONFIG_HZ=100
These are set to increase throughput CONFIG_PREEMPT_VOLUNTARY=y (default
Fedora config) but CONFIG_HZ=100 for higher throughput over the x86_64
default of CONFIG_HZ=1000 which provides lower latency.
Setting up the default build configs to ensure everything builds when we
update and rebase.
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
	    summary line.

Add a kernel configuration option to lock down the kernel, to restrict
userspace's ability to modify the running kernel when UEFI Secure Boot is
enabled. Based on the x86 patch by Matthew Garrett.

Determine the state of Secure Boot in the EFI stub and pass this to the
kernel using the FDT.

Signed-off-by: Linn Crosetto <linn@hpe.com>
[bwh: Forward-ported to 4.10: adjust context]
[Lukas Wunner: Forward-ported to 4.11: drop parts applied upstream]
[bwh: Forward-ported to 4.15 and lockdown patch set:
 - Pass result of efi_get_secureboot() in stub through to
   efi_set_secure_boot() in main kernel
 - Use lockdown API and naming]
[bwh: Forward-ported to 4.19.3: adjust context in update_fdt()]
[dannf: Moved init_lockdown() call after uefi_init(), fixing SB detection]
[bwh: Drop call to init_lockdown(), as efi_set_secure_boot() now calls this]
[bwh: Forward-ported to 5.6: efi_get_secureboot() no longer takes a
 sys_table parameter]
[bwh: Forward-ported to 5.7: EFI initialisation from FDT was rewritten, so:
 - Add Secure Boot mode to the parameter enumeration in fdtparams.c
 - Add a parameter to efi_get_fdt_params() to return the Secure Boot mode
 - Since Xen does not have a property name defined for Secure Boot mode,
   change efi_get_fdt_prop() to handle a missing property name by clearing
   the output variable]
[Salvatore Bonaccorso: Forward-ported to 5.10: f30f242 ("efi: Rename
arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]

Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.
UEFI machines can be booted in Secure Boot mode.  Add an EFI_SECURE_BOOT
flag that can be passed to efi_enabled() to find out whether secure boot is
enabled.

Move the switch-statement in x86's setup_arch() that inteprets the
secure_boot boot parameter to generic code and set the bit there.

Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
cc: linux-efi@vger.kernel.org
[rperier: Forward-ported to 5.5:
 - Use pr_warn()
 - Adjust context]
[bwh: Forward-ported to 5.6: adjust context]
[bwh: Forward-ported to 5.7:
 - Use the next available bit in efi.flags
 - Adjust context]
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.

Based on an earlier patch by David Howells, who wrote the following
description:

> UEFI Secure Boot provides a mechanism for ensuring that the firmware will
> only load signed bootloaders and kernels.  Certain use cases may also
> require that all kernel modules also be signed.  Add a configuration option
> that to lock down the kernel - which includes requiring validly signed
> modules - if the kernel is secure-booted.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
[Salvatore Bonaccorso: After fixing https://bugs.debian.org/956197 the
help text for LOCK_DOWN_IN_EFI_SECURE_BOOT was adjusted to mention that
lockdown is triggered in integrity mode (https://bugs.debian.org/1025417)]
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit 78c8af872660c31779951583b6f1ebf283d95985
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.

These drivers allow mapping arbitrary memory ranges as MTD devices.
This should be disabled to preserve the kernel's integrity when it is
locked down.

* Add the HWPARAM flag to the module parameters
* When slram is built-in, it uses __setup() to read kernel parameters,
  so add an explicit check security_locked_down() check

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Matthew Garrett <mjg59@google.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Joern Engel <joern@lazybastard.org>
Cc: linux-mtd@lists.infradead.org
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-2629
feature Fedora EFI status status
ommit 7a60169d168d6aae70aca10b7b71070666068529
commit-source https://gitlab.com/cki-project/kernel-ark/

This adds efi_status_to_str() for use when printing efi_status_t
messages, and reworks efi_status_to_err() so that the two use a common
list of errors.

Upstream Status: RHEL only
Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-2629

The config option CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT is enabled for
x86_64 from our base kernel-ark fork process however since we
prioritized the additional lockdown patches from Debian as they also
support ARM they've also set the config CONFIG_LOCK_DOWN_IN_EFI_SECURE_BOOT
to for their arm configs as well so we must do the same.

For technical reasons its defined here:
https://salsa.debian.org/kernel-team/linux/-/blob/debian/latest/debian/config/config?ref_type=heads#L7762

It was validated that this is the generic setting by downloading their
arm64 configs from here:
https://packages.debian.org/sid/amd64/linux-config-6.12/download
jira LE-2628

The config changes should have been run through make olddefconfig but
were not after making their modifications.  We want to do thsi so that
we can identify easily configs that might be introduced in a Zeta
release of the LT or Stable GKH kernels.

Fixes: 59a132d
All configs dropped the follwoing since its dependent on ARCH_MVEBU
which is not configured on so there is no reason to ask.
 # CONFIG_CZNIC_PLATFORMS is not set
See upstream commit: dd0f05b

x86_64 configs also dropped a previously defined y config
 -CONFIG_IMX_SCMI_MISC_DRV=y
 This comes from firmware: imx: IMX_SCMI_MISC_DRV should depend on ARCH_MXC
See Upstream Commit: be6686b
Whats a little confusing is that the fedora kernel-ark says that this is
marked as a `y`
$ cat redhat/configs/rhel/generic/CONFIG_IMX_SCMI_MISC_DRV
CONFIG_IMX_SCMI_MISC_DRV=y

[kernel-ark]$ ls redhat/configs/kernel-6.13.8-x86_64*
redhat/configs/kernel-6.13.8-x86_64-automotive.config
redhat/configs/kernel-6.13.8-x86_64.config
redhat/configs/kernel-6.13.8-x86_64-rt.config
redhat/configs/kernel-6.13.8-x86_64-automotive-debug.config
redhat/configs/kernel-6.13.8-x86_64-debug.config
redhat/configs/kernel-6.13.8-x86_64-rt-debug.config

[kernel-ark]$ grep CONFIG_IMX_SCMI_MISC_DRV redhat/configs/kernel-6.13.8-x86_64*
[kernel-ark]$

Do to this we're leaving this as the default Kconfig of off for x86_64
These are all default options that are extending other selections
already present in our configs.

FW_CACHE is enabled ddue to PM_SLEEP being enabled in all kernels
 drm/nouveau: select FW caching
 Upstream commit 6b481ab

DRM_CLIENT_SELECTION is enabled due to this change for nouveau
 drm/nouveau: Run DRM default client setup
 Upstream commit ef35089

DRM_CLIENT_SETUP is selected if DRM_CLIENT_SELECTION is selected and if
DRM_FBDEV_EMULATION is selected which is selected in all configs
 drm: Add client-agnostic setup helper
 Upstream comimt d07fdf9
HAVE_EISA is only allowed for 32-bit
 x86/platform: Only allow CONFIG_EISA for 32-bit
 Upstream: commit 3e14d9a

LD_CAN_USE_KEEP_IN_OVERLAY is now enabled if LD_IS_BFD=y
 ARM: 9443/1: Require linker to support KEEP within OVERLAY for DCE
 Upstream: 59fc423
CONFIG_IRQ_BYPASS_MANAGER now follows KVM
CONFIG_HAVE_KVM_IRQ_BYPASS now follows KVM
 KVM: Allow building irqbypass.ko as as module when kvm.ko is a module
 Upstream: fae0a87

CONFIG_HID_UNIVERSAL_PIDFF is new
 HID: Add hid-universal-pidff driver and supported device ids
 Upstream: f45f26a
CONFIG_SND_HDA_CIRRUS_SCODEC and
CONFIG_SND_HDA_CIRRUS_SCODEC_KUNIT_TEST are no longer
automatically selected on arm64 builds
 ALSA: hda/cirrus_scodec_test: Don't select dependencies
 Upstream: 9b019be
The following changes come from :
  crypto: lib/Kconfig - Hide arch options from user
  17ec3e7
  which is a fix and simplificatio for:
    crypto: lib/Kconfig - Fix lib built-in failure when arch is modular
    1047e21

kernel-aarch64-64k-debug.config
kernel-aarch64-64k.config
kernel-aarch64-debug.config
kernel-aarch64.config
kernel-x86_64-debug.config
kernel-x86_64.config
 CONFIG_CRYPTO_LIB_CHACHA_INTERNAL=y
 CONFIG_CRYPTO_LIB_CURVE25519_INTERNAL=m
 CONFIG_CRYPTO_LIB_POLY1305_INTERNAL=y

kernel-x86_64-debug.config
kernel-x86_64.config
 -CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=m
 +CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=y
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

Copy link

@thefossguy-ciq thefossguy-ciq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚤

@PlaidCat PlaidCat merged commit 036e3db into ciq-6.12.y-next May 13, 2025
6 checks passed
@PlaidCat PlaidCat deleted the {automation_tmp}_ciq-6.12.y-next branch May 13, 2025 15:32
github-actions bot pushed a commit that referenced this pull request Aug 22, 2025
When set multicast_query_interval to a large value, the local variable
'time' in br_multicast_send_query() may overflow. If the time is smaller
than jiffies, the timer will expire immediately, and then call mod_timer()
again, which creates a loop and may trigger the following soft lockup
issue.

  watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66]
  CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none)
  Call Trace:
   <IRQ>
   __netdev_alloc_skb+0x2e/0x3a0
   br_ip6_multicast_alloc_query+0x212/0x1b70
   __br_multicast_send_query+0x376/0xac0
   br_multicast_send_query+0x299/0x510
   br_multicast_query_expired.constprop.0+0x16d/0x1b0
   call_timer_fn+0x3b/0x2a0
   __run_timers+0x619/0x950
   run_timer_softirq+0x11c/0x220
   handle_softirqs+0x18e/0x560
   __irq_exit_rcu+0x158/0x1a0
   sysvec_apic_timer_interrupt+0x76/0x90
   </IRQ>

This issue can be reproduced with:
  ip link add br0 type bridge
  echo 1 > /sys/class/net/br0/bridge/multicast_querier
  echo 0xffffffffffffffff >
  	/sys/class/net/br0/bridge/multicast_query_interval
  ip link set dev br0 up

The multicast_startup_query_interval can also cause this issue. Similar to
the commit 99b4061 ("net: bridge: mcast: add and enforce query
interval minimum"), add check for the query interval maximum to fix this
issue.

Link: https://lore.kernel.org/netdev/20250806094941.1285944-1-wangliang74@huawei.com/
Link: https://lore.kernel.org/netdev/20250812091818.542238-1-wangliang74@huawei.com/
Fixes: d902eee ("bridge: Add multicast count/interval sysfs entries")
Suggested-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250813021054.1643649-1-wangliang74@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
github-actions bot pushed a commit that referenced this pull request Aug 29, 2025
[ Upstream commit d1547bf ]

When set multicast_query_interval to a large value, the local variable
'time' in br_multicast_send_query() may overflow. If the time is smaller
than jiffies, the timer will expire immediately, and then call mod_timer()
again, which creates a loop and may trigger the following soft lockup
issue.

  watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66]
  CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none)
  Call Trace:
   <IRQ>
   __netdev_alloc_skb+0x2e/0x3a0
   br_ip6_multicast_alloc_query+0x212/0x1b70
   __br_multicast_send_query+0x376/0xac0
   br_multicast_send_query+0x299/0x510
   br_multicast_query_expired.constprop.0+0x16d/0x1b0
   call_timer_fn+0x3b/0x2a0
   __run_timers+0x619/0x950
   run_timer_softirq+0x11c/0x220
   handle_softirqs+0x18e/0x560
   __irq_exit_rcu+0x158/0x1a0
   sysvec_apic_timer_interrupt+0x76/0x90
   </IRQ>

This issue can be reproduced with:
  ip link add br0 type bridge
  echo 1 > /sys/class/net/br0/bridge/multicast_querier
  echo 0xffffffffffffffff >
  	/sys/class/net/br0/bridge/multicast_query_interval
  ip link set dev br0 up

The multicast_startup_query_interval can also cause this issue. Similar to
the commit 99b4061 ("net: bridge: mcast: add and enforce query
interval minimum"), add check for the query interval maximum to fix this
issue.

Link: https://lore.kernel.org/netdev/20250806094941.1285944-1-wangliang74@huawei.com/
Link: https://lore.kernel.org/netdev/20250812091818.542238-1-wangliang74@huawei.com/
Fixes: d902eee ("bridge: Add multicast count/interval sysfs entries")
Suggested-by: Nikolay Aleksandrov <razor@blackwall.org>
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250813021054.1643649-1-wangliang74@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
bmastbergen pushed a commit to bmastbergen/kernel-src-tree that referenced this pull request Aug 29, 2025
jira LE-1907
Rebuild_History Non-Buildable kernel-5.14.0-427.18.1.el9_4
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit 21ce6ab

Add a detachment test case with miniq present to assert that with and
without the miniq we get the same error.

  # ./test_progs -t tc_opts
  ctrliq#244     tc_opts_after:OK
  ctrliq#245     tc_opts_append:OK
  ctrliq#246     tc_opts_basic:OK
  ctrliq#247     tc_opts_before:OK
  ctrliq#248     tc_opts_chain_classic:OK
  ctrliq#249     tc_opts_delete_empty:OK
  ctrliq#250     tc_opts_demixed:OK
  ctrliq#251     tc_opts_detach:OK
  ctrliq#252     tc_opts_detach_after:OK
  ctrliq#253     tc_opts_detach_before:OK
  ctrliq#254     tc_opts_dev_cleanup:OK
  ctrliq#255     tc_opts_invalid:OK
  ctrliq#256     tc_opts_mixed:OK
  ctrliq#257     tc_opts_prepend:OK
  ctrliq#258     tc_opts_replace:OK
  ctrliq#259     tc_opts_revision:OK
  Summary: 16/0 PASSED, 0 SKIPPED, 0 FAILED

	Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20230804131112.11012-2-daniel@iogearbox.net
	Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
(cherry picked from commit 21ce6ab)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
bmastbergen pushed a commit to bmastbergen/kernel-src-tree that referenced this pull request Aug 29, 2025
jira LE-1907
Rebuild_History Non-Buildable kernel-5.14.0-427.18.1.el9_4
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit ccd9a8b

Add several new tcx test cases to improve test coverage. This also includes
a few new tests with ingress instead of clsact qdisc, to cover the fix from
commit dc644b5 ("tcx: Fix splat in ingress_destroy upon tcx_entry_free").

  # ./test_progs -t tc
  [...]
  ctrliq#234     tc_links_after:OK
  ctrliq#235     tc_links_append:OK
  ctrliq#236     tc_links_basic:OK
  ctrliq#237     tc_links_before:OK
  ctrliq#238     tc_links_chain_classic:OK
  ctrliq#239     tc_links_chain_mixed:OK
  ctrliq#240     tc_links_dev_cleanup:OK
  ctrliq#241     tc_links_dev_mixed:OK
  ctrliq#242     tc_links_ingress:OK
  ctrliq#243     tc_links_invalid:OK
  ctrliq#244     tc_links_prepend:OK
  ctrliq#245     tc_links_replace:OK
  ctrliq#246     tc_links_revision:OK
  ctrliq#247     tc_opts_after:OK
  ctrliq#248     tc_opts_append:OK
  ctrliq#249     tc_opts_basic:OK
  ctrliq#250     tc_opts_before:OK
  ctrliq#251     tc_opts_chain_classic:OK
  ctrliq#252     tc_opts_chain_mixed:OK
  ctrliq#253     tc_opts_delete_empty:OK
  ctrliq#254     tc_opts_demixed:OK
  ctrliq#255     tc_opts_detach:OK
  ctrliq#256     tc_opts_detach_after:OK
  ctrliq#257     tc_opts_detach_before:OK
  ctrliq#258     tc_opts_dev_cleanup:OK
  ctrliq#259     tc_opts_invalid:OK
  ctrliq#260     tc_opts_mixed:OK
  ctrliq#261     tc_opts_prepend:OK
  ctrliq#262     tc_opts_replace:OK
  ctrliq#263     tc_opts_revision:OK
  [...]
  Summary: 44/38 PASSED, 0 SKIPPED, 0 FAILED

	Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/8699efc284b75ccdc51ddf7062fa2370330dc6c0.1692029283.git.daniel@iogearbox.net
	Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
(cherry picked from commit ccd9a8b)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
bmastbergen pushed a commit to bmastbergen/kernel-src-tree that referenced this pull request Aug 29, 2025
jira LE-1907
Rebuild_History Non-Buildable kernel-5.14.0-427.18.1.el9_4
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit d1a783d

Add various tests to check maximum number of supported programs
being attached:

  # ./vmtest.sh -- ./test_progs -t tc_opts
  [...]
  ./test_progs -t tc_opts
  [    1.185325] bpf_testmod: loading out-of-tree module taints kernel.
  [    1.186826] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
  [    1.270123] tsc: Refined TSC clocksource calibration: 3407.988 MHz
  [    1.272428] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fc932722, max_idle_ns: 440795381586 ns
  [    1.276408] clocksource: Switched to clocksource tsc
  ctrliq#252     tc_opts_after:OK
  ctrliq#253     tc_opts_append:OK
  ctrliq#254     tc_opts_basic:OK
  ctrliq#255     tc_opts_before:OK
  ctrliq#256     tc_opts_chain_classic:OK
  ctrliq#257     tc_opts_chain_mixed:OK
  ctrliq#258     tc_opts_delete_empty:OK
  ctrliq#259     tc_opts_demixed:OK
  ctrliq#260     tc_opts_detach:OK
  ctrliq#261     tc_opts_detach_after:OK
  ctrliq#262     tc_opts_detach_before:OK
  ctrliq#263     tc_opts_dev_cleanup:OK
  ctrliq#264     tc_opts_invalid:OK
  ctrliq#265     tc_opts_max:OK              <--- (new test)
  ctrliq#266     tc_opts_mixed:OK
  ctrliq#267     tc_opts_prepend:OK
  ctrliq#268     tc_opts_replace:OK
  ctrliq#269     tc_opts_revision:OK
  Summary: 18/0 PASSED, 0 SKIPPED, 0 FAILED

	Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
	Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230929204121.20305-2-daniel@iogearbox.net
(cherry picked from commit d1a783d)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
bmastbergen pushed a commit to bmastbergen/kernel-src-tree that referenced this pull request Aug 29, 2025
jira LE-1907
Rebuild_History Non-Buildable kernel-5.14.0-427.18.1.el9_4
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit f9b0879

Add a new test case which performs double query of the bpf_mprog through
libbpf API, but also via raw bpf(2) syscall. This is testing to gather
first the count and then in a subsequent probe the full information with
the program array without clearing passed structs in between.

  # ./vmtest.sh -- ./test_progs -t tc_opts
  [...]
  ./test_progs -t tc_opts
  [    1.398818] tsc: Refined TSC clocksource calibration: 3407.999 MHz
  [    1.400263] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fd336761, max_idle_ns: 440795243819 ns
  [    1.402734] clocksource: Switched to clocksource tsc
  [    1.426639] bpf_testmod: loading out-of-tree module taints kernel.
  [    1.428112] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
  ctrliq#252     tc_opts_after:OK
  ctrliq#253     tc_opts_append:OK
  ctrliq#254     tc_opts_basic:OK
  ctrliq#255     tc_opts_before:OK
  ctrliq#256     tc_opts_chain_classic:OK
  ctrliq#257     tc_opts_chain_mixed:OK
  ctrliq#258     tc_opts_delete_empty:OK
  ctrliq#259     tc_opts_demixed:OK
  ctrliq#260     tc_opts_detach:OK
  ctrliq#261     tc_opts_detach_after:OK
  ctrliq#262     tc_opts_detach_before:OK
  ctrliq#263     tc_opts_dev_cleanup:OK
  ctrliq#264     tc_opts_invalid:OK
  ctrliq#265     tc_opts_max:OK
  ctrliq#266     tc_opts_mixed:OK
  ctrliq#267     tc_opts_prepend:OK
  ctrliq#268     tc_opts_query:OK            <--- (new test)
  ctrliq#269     tc_opts_replace:OK
  ctrliq#270     tc_opts_revision:OK
  Summary: 19/0 PASSED, 0 SKIPPED, 0 FAILED

	Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20231006220655.1653-4-daniel@iogearbox.net
	Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
(cherry picked from commit f9b0879)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
bmastbergen pushed a commit to bmastbergen/kernel-src-tree that referenced this pull request Aug 29, 2025
jira LE-1907
Rebuild_History Non-Buildable kernel-5.14.0-427.18.1.el9_4
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit 685446b

Add a new test case to query on an empty bpf_mprog and pass the revision
directly into expected_revision for attachment to assert that this does
succeed.

  ./test_progs -t tc_opts
  [    1.406778] tsc: Refined TSC clocksource calibration: 3407.990 MHz
  [    1.408863] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fcaf6eb0, max_idle_ns: 440795321766 ns
  [    1.412419] clocksource: Switched to clocksource tsc
  [    1.428671] bpf_testmod: loading out-of-tree module taints kernel.
  [    1.430260] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
  ctrliq#252     tc_opts_after:OK
  ctrliq#253     tc_opts_append:OK
  ctrliq#254     tc_opts_basic:OK
  ctrliq#255     tc_opts_before:OK
  ctrliq#256     tc_opts_chain_classic:OK
  ctrliq#257     tc_opts_chain_mixed:OK
  ctrliq#258     tc_opts_delete_empty:OK
  ctrliq#259     tc_opts_demixed:OK
  ctrliq#260     tc_opts_detach:OK
  ctrliq#261     tc_opts_detach_after:OK
  ctrliq#262     tc_opts_detach_before:OK
  ctrliq#263     tc_opts_dev_cleanup:OK
  ctrliq#264     tc_opts_invalid:OK
  ctrliq#265     tc_opts_max:OK
  ctrliq#266     tc_opts_mixed:OK
  ctrliq#267     tc_opts_prepend:OK
  ctrliq#268     tc_opts_query:OK
  ctrliq#269     tc_opts_query_attach:OK     <--- (new test)
  ctrliq#270     tc_opts_replace:OK
  ctrliq#271     tc_opts_revision:OK
  Summary: 20/0 PASSED, 0 SKIPPED, 0 FAILED

	Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20231006220655.1653-6-daniel@iogearbox.net
	Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
(cherry picked from commit 685446b)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
bmastbergen pushed a commit to bmastbergen/kernel-src-tree that referenced this pull request Aug 29, 2025
jira LE-1907
Rebuild_History Non-Buildable kernel-5.14.0-427.18.1.el9_4
commit-author Daniel Borkmann <daniel@iogearbox.net>
commit 2451630

Add several new test cases which assert corner cases on the mprog query
mechanism, for example, around passing in a too small or a larger array
than the current count.

  ./test_progs -t tc_opts
  ctrliq#252     tc_opts_after:OK
  ctrliq#253     tc_opts_append:OK
  ctrliq#254     tc_opts_basic:OK
  ctrliq#255     tc_opts_before:OK
  ctrliq#256     tc_opts_chain_classic:OK
  ctrliq#257     tc_opts_chain_mixed:OK
  ctrliq#258     tc_opts_delete_empty:OK
  ctrliq#259     tc_opts_demixed:OK
  ctrliq#260     tc_opts_detach:OK
  ctrliq#261     tc_opts_detach_after:OK
  ctrliq#262     tc_opts_detach_before:OK
  ctrliq#263     tc_opts_dev_cleanup:OK
  ctrliq#264     tc_opts_invalid:OK
  ctrliq#265     tc_opts_max:OK
  ctrliq#266     tc_opts_mixed:OK
  ctrliq#267     tc_opts_prepend:OK
  ctrliq#268     tc_opts_query:OK
  ctrliq#269     tc_opts_query_attach:OK
  ctrliq#270     tc_opts_replace:OK
  ctrliq#271     tc_opts_revision:OK
  Summary: 20/0 PASSED, 0 SKIPPED, 0 FAILED

	Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
	Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
	Reviewed-by: Alan Maguire <alan.maguire@oracle.com>
Link: https://lore.kernel.org/bpf/20231017081728.24769-1-daniel@iogearbox.net
(cherry picked from commit 2451630)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

6 participants