Skip to content
Snippets Groups Projects
  1. Jul 06, 2021
  2. Jul 05, 2021
    • Tom Rini's avatar
      Merge branch '2021-07-01-update-CI-containers' · 1311dd37
      Tom Rini authored
      - General test.py improvements
      - Rewrite the squashfs tests
      - Update our CI container to Ubuntu 20.04 "focal" base.
      - Make some changes to the Azure yaml so that we can have more tests run
        there.
      1311dd37
    • Tom Rini's avatar
      Docker/CI: Update to "focal" and latest build · b1c2102d
      Tom Rini authored
      
      Move us up to being based on Ubuntu 20.04 "focal" and the latest tag
      from Ubuntu for this release.  For this, we make sure that "python" is
      now python3 but still include python2.7 for the rx51 qemu build as that
      is very old and does not support python3.
      
      Signed-off-by: default avatarTom Rini <trini@konsulko.com>
      b1c2102d
    • Joao Marcos Costa's avatar
      test/py: rewrite sqfsls command test suite · 9bde9b5e
      Joao Marcos Costa authored and Tom Rini's avatar Tom Rini committed
      
      Add more details to test cases by comparing each expected line with the
      command's output. Add new test cases:
      - sqfsls at an empty directory
      - sqfsls at a sub-directory
      
      Reviewed-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      Tested-by: Simon Glass <sjg@chromium.org> [on sandbox]
      Signed-off-by: default avatarJoao Marcos Costa <jmcosta944@gmail.com>
      9bde9b5e
    • Joao Marcos Costa's avatar
      test/py: rewrite sqfsload command test suite · 208eb2a4
      Joao Marcos Costa authored and Tom Rini's avatar Tom Rini committed
      
      The previous strategy to know if a file was correctly loaded was to
      check for how many bytes were read and compare it against the file's
      original size. Since this is not a good solution, replace it by
      comparing the checksum of the loaded bytes against the original file's
      checksum. Add more test cases: files at a sub-directory and non-existent
      file.
      
      Reviewed-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      Tested-by: Simon Glass <sjg@chromium.org> [on sandbox]
      Signed-off-by: default avatarJoao Marcos Costa <jmcosta944@gmail.com>
      208eb2a4
    • Joao Marcos Costa's avatar
      test/py: rewrite common tools for SquashFS tests · 04c9813e
      Joao Marcos Costa authored and Tom Rini's avatar Tom Rini committed
      
      Remove the previous OOP approach, which was confusing and incomplete.
      Add more test cases by making SquashFS images with various options,
      concerning file fragmentation and its compression. Add comments to
      properly document the code.
      
      Reviewed-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      Tested-by: Simon Glass <sjg@chromium.org> [on sandbox]
      Signed-off-by: default avatarJoao Marcos Costa <jmcosta944@gmail.com>
      04c9813e
    • Alper Nebi Yasak's avatar
      Azure: Add loop devices and CAP_SYS_ADMIN for sandbox test.py tests · e22ec9c6
      Alper Nebi Yasak authored and Tom Rini's avatar Tom Rini committed
      The filesystem test setup needs to prepare disk images for its tests,
      with either guestmount or loop mounts. The former requires access to the
      host fuse device (added in a previous patch), the latter requires access
      to host loop devices. Both mounts also need additional privileges since
      docker's default configuration prevents the containers from mounting
      filesystems (for host security).
      
      Add any available loop devices to the container and try to add as few
      privileges as possible to run these tests, which narrow down to adding
      SYS_ADMIN capability and disabling apparmor confinement. However, this
      much still seems to be insecure enough to let malicious container
      processes escape as root on the host system [1].
      
      [1] https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
      
      
      
      Since the mentioned tests are marked to run only on the sandbox board,
      add these additional devices and privileges only when testing with that.
      
      An alternative to using mounts is modifying the filesystem tests to use
      virt-make-fs (like some EFI tests do), but it fails to generate a
      partitionless FAT filesystem image on Debian systems. Other more
      feasible alternatives are using guestfish or directly using libguestfs
      Python bindings to create and populate the images, but switching the
      test setups to these is nontrivial and is left as future work.
      
      Signed-off-by: default avatarAlper Nebi Yasak <alpernebiyasak@gmail.com>
      e22ec9c6
    • Alper Nebi Yasak's avatar
      Azure: Add fuse device for test.py tests · 1aaaf60d
      Alper Nebi Yasak authored and Tom Rini's avatar Tom Rini committed
      
      The EFI secure boot and capsule test setups need to prepare disk images
      for their tests using virt-make-fs, which requires access to the host
      fuse device. This is not exposed to the docker container by default and
      has to be added explicitly. Add it.
      
      Signed-off-by: default avatarAlper Nebi Yasak <alpernebiyasak@gmail.com>
      1aaaf60d
    • Alper Nebi Yasak's avatar
      tools: docker: Install a readable kernel for libguestfs-tools · f9abaa53
      Alper Nebi Yasak authored and Tom Rini's avatar Tom Rini committed
      
      The filesystem and EFI (capsule and secure boot) test setups try to use
      guestmount and virt-make-fs respectively to prepare disk images to run
      tests on. However, these libguestfs tools need a kernel image and fail
      with the following message (revealed in debug/trace mode) if it can't
      find one:
      
          supermin: failed to find a suitable kernel (host_cpu=x86_64).
      
          I looked for kernels in /boot and modules in /lib/modules.
      
          If this is a Xen guest, and you only have Xen domU kernels
          installed, try installing a fullvirt kernel (only for
          supermin use, you shouldn't boot the Xen guest with it).
      
      This failure then causes these tests to be skipped in CIs. Install a
      kernel package in the Docker containers so the CIs can run these
      tests with libguestfs tools again (assuming the container is run with
      necessary host devices and privileges). As this kernel would be only
      used for virtualization, we can use the kernel package specialized for
      that. On Ubuntu systems kernel images are not readable by non-root
      users, so explicitly add read permissions with chmod as well.
      
      Signed-off-by: default avatarAlper Nebi Yasak <alpernebiyasak@gmail.com>
      Acked-by: Heinrich Schuchardt's avatarHeinrich Schuchardt <xypron.glpk@gmx.de>
      f9abaa53
    • Alper Nebi Yasak's avatar
      test/py: Wait for guestmount worker to exit after running guestunmount · 99f5303c
      Alper Nebi Yasak authored and Tom Rini's avatar Tom Rini committed
      
      Some filesystem tests are failing when their image is prepared with
      guestmount, but succeeding if loop mounts are used instead. The reason
      seems to be a race condition the guestmount(1) manual page explains:
      
          When guestunmount(1)/fusermount(1) exits, guestmount may still be
          running and cleaning up the mountpoint.  The disk image will not be
          fully finalized.
      
          This means that scripts like the following have a nasty race condition:
      
           guestmount -a disk.img -i /mnt
           # copy things into /mnt
           guestunmount /mnt
           # immediately try to use 'disk.img' ** UNSAFE **
      
          The solution is to use the --pid-file option to write the guestmount
          PID to a file, then after guestunmount spin waiting for this PID to
          exit.
      
      The Python standard library has an os.waitpid() function for waiting a
      child to terminate, but it cannot wait on non-child processes. Implement
      a utility function that can do this by polling the process repeatedly
      for a given duration, optionally killing the process if it won't
      terminate on its own. Apply the suggested solution with this utility
      function, which makes the failing tests succeed again.
      
      Signed-off-by: default avatarAlper Nebi Yasak <alpernebiyasak@gmail.com>
      Reviewed-by: Simon Glass's avatarSimon Glass <sjg@chromium.org>
      99f5303c
    • Alper Nebi Yasak's avatar
      test/py: Use loop mounts if guestmount fails in filesystem tests · 8f5f5d3a
      Alper Nebi Yasak authored and Tom Rini's avatar Tom Rini committed
      
      If guestmount isn't available on the system, filesystem test setup falls
      back to using loop mounts to prepare its disk images. If guestmount is
      available but fails to work, the tests are immediately skipped. Instead
      of giving up on a guestmount failure, try using loop mounts as an
      attempt to keep tests running.
      
      Also stop checking if guestmount is in PATH, as trying to run a missing
      guestmount can now follow the same failure codepath and fall back to
      loop mounts anyway.
      
      Signed-off-by: default avatarAlper Nebi Yasak <alpernebiyasak@gmail.com>
      8f5f5d3a
    • AKASHI Takahiro's avatar
      env: efi: fix a wrong address dereference · f1eb346e
      AKASHI Takahiro authored and Tom Rini's avatar Tom Rini committed
      
      Probably, a pointer to a variable in an inner block should not
      be exposed to an outer block.
      
      Fixes: c70f4481 ("efi_loader: simplify 'printenv -e'")
      Signed-off-by: default avatarAKASHI Takahiro <takahiro.akashi@linaro.org>
      [trini: Don't make guid const now]
      Signed-off-by: default avatarTom Rini <trini@konsulko.com>
      f1eb346e
    • Tom Rini's avatar
      Merge branch 'next' · 6194b45a
      Tom Rini authored
      6194b45a
    • Tom Rini's avatar
      Prepare v2021.07 · 840658b0
      Tom Rini authored
      
      Signed-off-by: default avatarTom Rini <trini@konsulko.com>
  3. Jul 02, 2021
Loading