tests for sys/dev/clock_subr.c

Add a basic test for fss(4)

XXX For now, we just create required files (including mount-points)
XXX in the test's working directory. Eventually someone with more
XXX rump-foo than I should create a fss rump-component and then update
XXX the test to run under rump.

branches: 1.10.2;
Add some tests for the kernel HID parser.

Don't build tests that depend on RUMP if BSD_MK_COMPAT_FILE is defined.

Exclude tests that use rump

branches: 1.7.6;
"A few seconds later" I realized the kernel directory is dev/raidframe,
not dev/raid, so reflect this in the test dir. Affects location
for test of PR kern/44239.

Add first raidframe tests. This is the test for the kernel fault
described in PR kern/44239

Add simple test for md(4) which just stuffs junk into /dev/rmd0d
and checks the same data can be retrieved.

Add rudimentary cgd tests. The tests use cgd to transform a
plaintext into into an encrypted image and back into plaintext by
doing rump I/O on /dev/cgd. There is one test to check that giving
the same password for both encryption and decryption produces the
same plaintext and another to check that giving a different passwords
does not produce the same plaintext.

This could be fairly easily extended to test all feature of cgd
(hint hint). For example, now cgd.conf is included in cvs, but
the only reason for that is that without further hacking cgdconfig
uses /dev/random quality random to generate the salt for a
pkcsetcetc_kdf2 cgconfig -g, and making an automated test block on
the entropy pool is just not good form. Details are everything.

Test for cache sync noises after disk is ejected.

test case for PR kern/43785

Add test cases to check that sysmon/swwdog will panic and reboot
the kernel if left untickled.

Thanks to jmmv for the tip that doing this is possible in atf via
means of fork/wait.

Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

Remove. Nothing here (or below) seems to refer to it, and it won't
work anyway due to the case of the 'l' in CPPFlAGS

branches: 1.2.2;
Define _KERNTYPES for things that need it.

add Makefile.inc everywhere so that we can set WARNS=4 by default. Amazing
how many bugs this found :-)

Actually remove the no-longer-needed Atffiles

branches: 1.1.6; 1.1.12;
Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

Re-add -lrumpdev dropped in the previous commit.

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

Add ATF tests for audio(4).

91 passed test cases
0 failed test cases.
0 expected failed test cases.
62 skipped test cases.

There are many skipped tests, because the test itself supports full-
duplex, half-duplex and uni-directional devices but pad(4) used in ATF
tests is uni-directional device.

Rewrite t_pad test.
Previous version compared the pad's output binary passed mulaw-slinear
conversion and frequency conversion with the prepared "good result".
In such case, a test may fail when the implemantation changes. In fact,
the frequency conversion algorithm was changed in isaki-audio2, so
output waveforms is not completely the same (but that's no problem with
the audio waveforms).
New version uses slinear_le/2ch/44100Hz input data and compares the
output binary with the input data. pad with no conversions should
output the same binary.
Fix PR kern/54187.

branches: 1.5.16;
Define _KERNTYPES for things that need it.

Build helper programs as PROGS and not as TESTS_{C,SH}

This enables us to remove custom Atffiles whose only purpose was to avoid
using the helpers as tests.

XXX src/tests/dev/dm/ is not (yet) linked into the build!

branches: 1.3.6; 1.3.12;
There's apparently a circular dependency between -lrump and -lrumpuser.
This poses problems when linking statically, as for sun2. Add -lrump
also after -lrumpuser, so that this links statically as well.

need to update install filename too

Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

Fix various typos, mainly in comments.

branches: 1.32.2;
mmap() fails for size == 0 with EINVAL unless the mapping is anonymous.

audiotest: Appease GCC 12.3.0 -Wmisleading-indentation

It does not matter whether this statement is a part of this if-then
block or not, anyway. No binary changes.

Fix typo in comment.

Allow 24bit support.

s/plyaback/playback/ in comment.

audiotest: Add two tests for AUDIO_SETINFO after mmap.
These tests affect only standalone test, not atf.

audiotest: Fix typo in comments.

audiotest: Separate mmap_len test by parameters.
This change affects only standalone test, not atf.

fix some typos and grammar in comments.

s/blity/bility/ in various words, mainly in comments.

fix various typos in comments, documentation and messages.

s/changable/changeable/ in comments.

fix few typos in comments.

tests: Add tests for AUDIO_GET[IO]OFFS ioctls.
- AUDIO_GETIOFFS_one_{RDONLY,RDWR,WRONLY}
- AUDIO_GETOOFFS_one_{RDONLY,RDWR,WRONLY}
- AUDIO_GETOOFFS_wrap_{RDONLY,RDWR,WRONLY}
- AUDIO_GETOOFFS_flush_{RDONLY,RDWR,WRONLY}
- AUDIO_GETOOFFS_set_{RDONLY,RDWR,WRONLY}

s/occured/occurred/ in comments, log messages and man pages.

fix various typos in comments and log messages.

s/recored/record/ in comment.

s/helt/held+s/eroneously/erroneously/+s/splitted/split/+s/recommented/recommended/

Add AUDIO_SETINFO_gain_balance test.
The test checks whether AUDIO_SETINFO can change the gain and the balance
at the same time (if MD driver has the capability). See PR kern/56308.

Argument for AUDIO_WSEEK ioctl is u_long, not int.

Fix false positive for aarch64eb (LP64BE):
AUDIO_WSEEK, failed, Line 4467: n expects 4 but 0

Reference PRs consistently.

Fix two tests.
- kqueue_mode_{RDONLY,RDWR}_READ: Fix expected value.
This is rest of rev1.9.
- AUDIO_SETINFO_params_simul: Fix condition.
This happens on full-duplex, not bi-directional.
These affect only standalone test, not atf.

branches: 1.10.2;
Add tests for poll(POLLIN) before read().
This affects only standalone test, not atf.

Sync with sys/dev/audio/audio.c rev1.65.
> Fix to start recording immediately when open() with READ mode is called.
This affects only standalone test, not atf.

Use exact match to search testname.
This didn't affect test results.

Sync with sys/dev/audio/audio.c rev1.62.
> Restore backward compatibility with netbsd-7 audio.

Update AUDIO_SETINFO_channels test.
The kernel limits the number of channels that userland apps can set to
the number of channels supported by the hardware or less.

Add tests.
AUDIO_SETINFO_channels
AUDIO_SETINFO_sample_rate
AUDIO_SETINFO_sample_rate_0

Improve around {audioctl_,}open_multiuser.
- Make multiuser bool and remove newval.
- try_audioctl_open_multiuser() doesn't need multiuser argument.

don't use variable 'newval' uninitialized when multiuser mode unchanged

Add sentinel to the testtable[] array.

Add ATF tests for audio(4).

91 passed test cases
0 failed test cases.
0 expected failed test cases.
62 skipped test cases.

There are many skipped tests, because the test itself supports full-
duplex, half-duplex and uni-directional devices but pad(4) used in ATF
tests is uni-directional device.

Rewrite t_pad test.
Previous version compared the pad's output binary passed mulaw-slinear
conversion and frequency conversion with the prepared "good result".
In such case, a test may fail when the implemantation changes. In fact,
the frequency conversion algorithm was changed in isaki-audio2, so
output waveforms is not completely the same (but that's no problem with
the audio waveforms).
New version uses slinear_le/2ch/44100Hz input data and compares the
output binary with the input data. pad with no conversions should
output the same binary.
Fix PR kern/54187.

branches: 1.2.14;
pad(4) must be open before corresponding audio device is opened.

OK christos@

branches: 1.1.28;
Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

Represent test data as bytes to make it "endian-independent".

from martin

branches: 1.1.2;
Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

branches: 1.2.2;
Use exact match to search testname.
This didn't affect test results.

Add ATF tests for audio(4).

91 passed test cases
0 failed test cases.
0 expected failed test cases.
62 skipped test cases.

There are many skipped tests, because the test itself supports full-
duplex, half-duplex and uni-directional devices but pad(4) used in ATF
tests is uni-directional device.

Rewrite t_pad test.
Previous version compared the pad's output binary passed mulaw-slinear
conversion and frequency conversion with the prepared "good result".
In such case, a test may fail when the implemantation changes. In fact,
the frequency conversion algorithm was changed in isaki-audio2, so
output waveforms is not completely the same (but that's no problem with
the audio waveforms).
New version uses slinear_le/2ch/44100Hz input data and compares the
output binary with the input data. pad with no conversions should
output the same binary.
Fix PR kern/54187.

branches: 1.3.46;
Adjusts tests after import of atf-0.12:

- The use.fs property is gone.
- Mark the tests/fs/t_create:attrs test as broken when using the default
unprivileged-user:_atf setting. This probably deserves a fix somehow
but I'm not sure at this point.

Update test program to deal with uuencoded golden data.
XXX: is it not possible to use a pipeline in atf_check?

Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

Actually, some nagging voice in my head tells me that all binary files
in the repo should be uuencoded, so uuencode the golden audio output.

Add test of pad(4): stuff some audio into /dev/audio, read it from
/dev/pad. Test that we got sensible output by comparing against
a previous audibly good result.

This exercises auconv, audio and pad.

Rewrite t_pad test.
Previous version compared the pad's output binary passed mulaw-slinear
conversion and frequency conversion with the prepared "good result".
In such case, a test may fail when the implemantation changes. In fact,
the frequency conversion algorithm was changed in isaki-audio2, so
output waveforms is not completely the same (but that's no problem with
the audio waveforms).
New version uses slinear_le/2ch/44100Hz input data and compares the
output binary with the input data. pad with no conversions should
output the same binary.
Fix PR kern/54187.

branches: 1.4.12;
Revert to previous. Audio passes the test properly again.

branches: 1.3.2;
Update test output to reflect audio changes.

branches: 1.2.2;
Fix soft volume audio distortion. OK jmcneil@.
Update atf pad expected output.

Actually, some nagging voice in my head tells me that all binary files
in the repo should be uuencoded, so uuencode the golden audio output.

cgdconfig(8): Add support for shared keys.

New clause `shared <id> algorithm <alg> subkey <info>' in a keygen
block enables `cgdconfig -C' to reuse a key between different params
files, so you can, e.g., use a single password for multiple disks.
This is better than simply caching the password itself because:

- Hashing the password is expensive, so it should only be done once.

Suppose your budget is time t before you get bored, and you
calibrate password hash parameters to unlock n disks before you get
bored waiting for `cgdconfig -C'.

. With n password hashings the adversary's cost goes up only by a
factor of t/n.
. With one password hashing and n subkeys the adversary's cost goes
up by a factor of n.

And if you ever add a disk, rehashing it will make `cgdconfig -C'
go over budget, whereas another subkey adds negligible cost to you.

- Subkeys work for other types of keygen blocks, like shell_cmd,
which could be used to get a key from a hardware token that needs a
button press.

The <info> parameter must be different for each params file;
everything else in the keygen block must be the same. With this
clause, the keygen block determines a shared key used only to derive
keys; the actual key used by cgdconfig is derived from the shared key
by the specified algorithm.

The only supported algorithm is hkdf-hmac-sha256, which uses
HKDF-Expand of RFC 5869 instantiated with SHA-256.

Example:

algorithm aes-cbc;
iv-method encblkno1;
keylength 128;
verify_method none;
keygen pkcs5_pbkdf2/sha1 {
iterations 39361;
salt AAAAgMoHiYonye6KogdYJAobCHE=;
shared "pw" algorithm hkdf-hmac-sha256
subkey AAAAgFlw0BMQ5gY+haYkZ6JC+yY=;
};

The key used for this disk will be derived by

HKDF-HMAC-SHA256_k(WXDQExDmBj6FpiRnokL7Jg==),

where k is the outcome of PBKDF2-SHA1 with the given parameters.

Note that <info> encodes a four-byte prefix giving the big-endian
length in bits of the info argument to HKDF, just like all other bit
strings in cgdconfig parameters files.

If you have multiple disks configured using the same keygen block
except for the info parameter, `cgdconfig -C' will only prompt once
for your passphrase, generate a shared key k with PBKDF2 as usual,
and then reuse it for each of the disks.

cgdconfig(8): New -t operation just prints the derived key in base64.

For testing purposes.

New cgd cipher adiantum.

Adiantum is a wide-block cipher, built out of AES, XChaCha12,
Poly1305, and NH, defined in

Paul Crowley and Eric Biggers, `Adiantum: length-preserving
encryption for entry-level processors', IACR Transactions on
Symmetric Cryptology 2018(4), pp. 39--61.

Adiantum provides better security than a narrow-block cipher with CBC
or XTS, because every bit of each sector affects every other bit,
whereas with CBC each block of plaintext only affects the following
blocks of ciphertext in the disk sector, and with XTS each block of
plaintext only affects its own block of ciphertext and nothing else.

Adiantum generally provides much better performance than
constant-time AES-CBC or AES-XTS software do without hardware
support, and performance comparable to or better than the
variable-time (i.e., leaky) AES-CBC and AES-XTS software we had
before. (Note: Adiantum also uses AES as a subroutine, but only once
per disk sector. It takes only a small fraction of the time spent by
Adiantum, so there's relatively little performance impact to using
constant-time AES software over using variable-time AES software for
it.)

Adiantum naturally scales to essentially arbitrary disk sector sizes;
sizes >=1024-bytes take the most advantage of Adiantum's design for
performance, so 4096-byte sectors would be a natural choice if we
taught cgd to change the disk sector size. (However, it's a
different cipher for each disk sector size, so it _must_ be a cgd
parameter.)

The paper presents a similar construction HPolyC. The salient
difference is that HPolyC uses Poly1305 directly, whereas Adiantum
uses Poly1395(NH(...)). NH is annoying because it requires a
1072-byte key, which means the test vectors are ginormous, and
changing keys is costly; HPolyC avoids these shortcomings by using
Poly1305 directly, but HPolyC is measurably slower, costing about
1.5x what Adiantum costs on 4096-byte sectors.

For the purposes of cgd, we will reuse each key for many messages,
and there will be very few keys in total (one per cgd volume) so --
except for the annoying verbosity of test vectors -- the tradeoff
weighs in the favour of Adiantum, especially if we teach cgd to do
>>512-byte sectors.

For now, everything that Adiantum needs beyond what's already in the
kernel is gathered into a single file, including NH, Poly1305, and
XChaCha12. We can split those out -- and reuse them, and provide MD
tuned implementations, and so on -- as needed; this is just a first
pass to get Adiantum implemented for experimentation.

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

librump depends on vfs so add a dependency on for sun2.

branches: 1.8.10;
Remove MKCRYPTO option.

Originally, MKCRYPTO was introduced because the United States
classified cryptography as a munition and restricted its export. The
export controls were substantially relaxed fifteen years ago, and are
essentially irrelevant for software with published source code.

In the intervening time, nobody bothered to remove the option after
its motivation -- the US export restriction -- was eliminated. I'm
not aware of any other operating system that has a similar option; I
expect it is mainly out of apathy for churn that we still have it.
Today, cryptography is an essential part of modern computing -- you
can't use the internet responsibly without cryptography.

The position of the TNF board of directors is that TNF makes no
representation that MKCRYPTO=no satisfies any country's cryptography
regulations.

My personal position is that the availability of cryptography is a
basic human right; that any local laws restricting it to a privileged
few are fundamentally immoral; and that it is wrong for developers to
spend effort crippling cryptography to work around such laws.

As proposed on tech-crypto, tech-security, and tech-userlevel to no
objections:

https://mail-index.netbsd.org/tech-crypto/2017/05/06/msg000719.html
https://mail-index.netbsd.org/tech-security/2017/05/06/msg000928.html
https://mail-index.netbsd.org/tech-userlevel/2017/05/06/msg010547.html

P.S. Reviewing all the uses of MKCRYPTO in src revealed a lot of
*bad* crypto that was conditional on it, e.g. DES in telnet... That
should probably be removed too, but on the grounds that it is bad,
not on the grounds that it is (nominally) crypto.

Add 3des-cbc tests with 192 bits key.

Add blowfish-cbc tests for 128, 256 and 448 bits keys.

Only build t_cgd_aes if MKCRYPTO==yes and MKRUMP==yes.

Don't build t_cgd_aes if ${MKCRYPTO} == "no".

Add tests for not-yet-committed cgd algorithm AES-XTS.

The tests are marked as expected failures.

branches: 1.2.28;
Retire the old C helper in h_img2cgd since we can now write everything
with a shellscript in terms of rump.cgdconfig and dd.

Add rudimentary cgd tests. The tests use cgd to transform a
plaintext into into an encrypted image and back into plaintext by
doing rump I/O on /dev/cgd. There is one test to check that giving
the same password for both encryption and decryption produces the
same plaintext and another to check that giving a different passwords
does not produce the same plaintext.

This could be fairly easily extended to test all feature of cgd
(hint hint). For example, now cgd.conf is included in cvs, but
the only reason for that is that without further hacking cgdconfig
uses /dev/random quality random to generate the salt for a
pkcsetcetc_kdf2 cgconfig -g, and making an automated test block on
the entropy pool is just not good form. Details are everything.

cgdconfig(8): Add support for shared keys.

New clause `shared <id> algorithm <alg> subkey <info>' in a keygen
block enables `cgdconfig -C' to reuse a key between different params
files, so you can, e.g., use a single password for multiple disks.
This is better than simply caching the password itself because:

- Hashing the password is expensive, so it should only be done once.

Suppose your budget is time t before you get bored, and you
calibrate password hash parameters to unlock n disks before you get
bored waiting for `cgdconfig -C'.

. With n password hashings the adversary's cost goes up only by a
factor of t/n.
. With one password hashing and n subkeys the adversary's cost goes
up by a factor of n.

And if you ever add a disk, rehashing it will make `cgdconfig -C'
go over budget, whereas another subkey adds negligible cost to you.

- Subkeys work for other types of keygen blocks, like shell_cmd,
which could be used to get a key from a hardware token that needs a
button press.

The <info> parameter must be different for each params file;
everything else in the keygen block must be the same. With this
clause, the keygen block determines a shared key used only to derive
keys; the actual key used by cgdconfig is derived from the shared key
by the specified algorithm.

The only supported algorithm is hkdf-hmac-sha256, which uses
HKDF-Expand of RFC 5869 instantiated with SHA-256.

Example:

algorithm aes-cbc;
iv-method encblkno1;
keylength 128;
verify_method none;
keygen pkcs5_pbkdf2/sha1 {
iterations 39361;
salt AAAAgMoHiYonye6KogdYJAobCHE=;
shared "pw" algorithm hkdf-hmac-sha256
subkey AAAAgFlw0BMQ5gY+haYkZ6JC+yY=;
};

The key used for this disk will be derived by

HKDF-HMAC-SHA256_k(WXDQExDmBj6FpiRnokL7Jg==),

where k is the outcome of PBKDF2-SHA1 with the given parameters.

Note that <info> encodes a four-byte prefix giving the big-endian
length in bits of the info argument to HKDF, just like all other bit
strings in cgdconfig parameters files.

If you have multiple disks configured using the same keygen block
except for the info parameter, `cgdconfig -C' will only prompt once
for your passphrase, generate a shared key k with PBKDF2 as usual,
and then reuse it for each of the disks.

Retire the old C helper in h_img2cgd since we can now write everything
with a shellscript in terms of rump.cgdconfig and dd.

Unfortunately rump does not provide the same magic as MAKEDEV does
for native /dev and create an alias for disk devices w/o partition
latter pointing at the raw partition, so for rump based tests we
actually have to calculate the concrete device name.

Use an idiom suggested by kre for this which also works for ports that
have kern.rawpartition > 4.

Fix quoting (quotes really do not nest...) and remove a bunch of it
that is harmless, but also pointless (in sh, quotes do not make strings,
everything is a string, rather they hide characters which would have
some other meaning unquoted (like spaces) - quotes are not needed around
strings like "descr" so remove them...

Be more consistent with line wrap style, try to avoid wrapping in the
middle of a (sh) word where possible. Avoid \ use when it is not needed.

Un-KNF (C style) - sh has no declarations, there is no need to leave
blank lines at the head of a function to mark the end of the declarations.

This should be a NFC - but the quoting really was broken before, just
was probably harmless breakage.

PR bin/53999 from rudolf (eq.cz)

Fix cgdconfig to report verification failures with gpt and mbr
verification methods (and not treat them as silent hard errors).
This also causes the cgd to be unconfigured when one of those
verification methods fails.

Add ATF tests to check that bad verification is reported, and
does not leave the cgd configured.

Patches from the PR applied.

branches: 1.11.30;
Check for RUMP programs before using them.

branches: 1.10.4; 1.10.10;
Expand tests for unaligned writes to cgd. No more xfail.

PR kern/44515
PR kern/44964

Instead of doing 'atf_check ... sh -c foo', just do 'atf_check ... -x foo'.

Force cleanup parts to exit with a success status. Failures in cleanup
should not be allowed by atf-run (although they currently are ignored).

test case for PR kern/44515

convert tests from oldstyle dd rif/rof to newstyle dd | rump.dd

branches: 1.5.2;
make this work when rawpart != d

Substitute a surgical rump_server configuration for rump_allserver
now that it's possible. With warm fs cache, the startup time of
the former is 0.01s and the latter 0.1s. With cold caches it's
0.2s vs 2s.

Use proper cleanup.

XXX: the atf sh "compiler" should check for errors.

Retire the old C helper in h_img2cgd since we can now write everything
with a shellscript in terms of rump.cgdconfig and dd.

Add rudimentary cgd tests. The tests use cgd to transform a
plaintext into into an encrypted image and back into plaintext by
doing rump I/O on /dev/cgd. There is one test to check that giving
the same password for both encryption and decryption produces the
same plaintext and another to check that giving a different passwords
does not produce the same plaintext.

This could be fairly easily extended to test all feature of cgd
(hint hint). For example, now cgd.conf is included in cvs, but
the only reason for that is that without further hacking cgdconfig
uses /dev/random quality random to generate the salt for a
pkcsetcetc_kdf2 cgconfig -g, and making an automated test block on
the entropy pool is just not good form. Details are everything.

Plaintext buffers are used directly for write() operations to the raw device.
Align them to the needs of cgd(4).

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.1.2;
Add 3des-cbc tests with 192 bits key.

clang can't handle __aligned on anonymous structure initializers.

Plaintext buffers are used directly for write() operations to the raw device.
Align them to the needs of cgd(4).

Missed a spot -- one more 32-bit sign-compare issue.

Fix sign-compare issue on 32-bit systems.

Built fine on amd64, where all unsigned values are representable in
ssize_t, but I didn't try building on i386, where they're not.

New cgd cipher adiantum.

Adiantum is a wide-block cipher, built out of AES, XChaCha12,
Poly1305, and NH, defined in

Paul Crowley and Eric Biggers, `Adiantum: length-preserving
encryption for entry-level processors', IACR Transactions on
Symmetric Cryptology 2018(4), pp. 39--61.

Adiantum provides better security than a narrow-block cipher with CBC
or XTS, because every bit of each sector affects every other bit,
whereas with CBC each block of plaintext only affects the following
blocks of ciphertext in the disk sector, and with XTS each block of
plaintext only affects its own block of ciphertext and nothing else.

Adiantum generally provides much better performance than
constant-time AES-CBC or AES-XTS software do without hardware
support, and performance comparable to or better than the
variable-time (i.e., leaky) AES-CBC and AES-XTS software we had
before. (Note: Adiantum also uses AES as a subroutine, but only once
per disk sector. It takes only a small fraction of the time spent by
Adiantum, so there's relatively little performance impact to using
constant-time AES software over using variable-time AES software for
it.)

Adiantum naturally scales to essentially arbitrary disk sector sizes;
sizes >=1024-bytes take the most advantage of Adiantum's design for
performance, so 4096-byte sectors would be a natural choice if we
taught cgd to change the disk sector size. (However, it's a
different cipher for each disk sector size, so it _must_ be a cgd
parameter.)

The paper presents a similar construction HPolyC. The salient
difference is that HPolyC uses Poly1305 directly, whereas Adiantum
uses Poly1395(NH(...)). NH is annoying because it requires a
1072-byte key, which means the test vectors are ginormous, and
changing keys is costly; HPolyC avoids these shortcomings by using
Poly1305 directly, but HPolyC is measurably slower, costing about
1.5x what Adiantum costs on 4096-byte sectors.

For the purposes of cgd, we will reuse each key for many messages,
and there will be very few keys in total (one per cgd volume) so --
except for the annoying verbosity of test vectors -- the tradeoff
weighs in the favour of Adiantum, especially if we teach cgd to do
>>512-byte sectors.

For now, everything that Adiantum needs beyond what's already in the
kernel is gathered into a single file, including NH, Poly1305, and
XChaCha12. We can split those out -- and reuse them, and provide MD
tuned implementations, and so on -- as needed; this is just a first
pass to get Adiantum implemented for experimentation.

Plaintext buffers are used directly for write() operations to the raw device.
Align them to the needs of cgd(4).

Gracefully skip test if not enough space in temporary directory.

branches: 1.6.14;
Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.5.2;
AES XTS unit tests should now pass.

Switch to CHECK_LIBC for writing.

Add aes-cbc tests.

Don't use mktemp.

Add tests for not-yet-committed cgd algorithm AES-XTS.

The tests are marked as expected failures.

Plaintext buffers are used directly for write() operations to the raw device.
Align them to the needs of cgd(4).

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.1.2;
Add blowfish-cbc tests for 128, 256 and 448 bits keys.

When run from py-anita/amd64 this test fails with:

cgdconfig: getfsspecname failed: no match for `wd0e'

as the virtual machine has root on dk0, dk0 at wd0 and trying to
open wd0e fails.

This tests runs without a rump kernel and therefore should not
even try to open configured devices on the host. Replace the
disks "wd0e" and "ld1e" with non-existant disks "dska" and "dskb".

cgdconfig(8): Add support for shared keys.

New clause `shared <id> algorithm <alg> subkey <info>' in a keygen
block enables `cgdconfig -C' to reuse a key between different params
files, so you can, e.g., use a single password for multiple disks.
This is better than simply caching the password itself because:

- Hashing the password is expensive, so it should only be done once.

Suppose your budget is time t before you get bored, and you
calibrate password hash parameters to unlock n disks before you get
bored waiting for `cgdconfig -C'.

. With n password hashings the adversary's cost goes up only by a
factor of t/n.
. With one password hashing and n subkeys the adversary's cost goes
up by a factor of n.

And if you ever add a disk, rehashing it will make `cgdconfig -C'
go over budget, whereas another subkey adds negligible cost to you.

- Subkeys work for other types of keygen blocks, like shell_cmd,
which could be used to get a key from a hardware token that needs a
button press.

The <info> parameter must be different for each params file;
everything else in the keygen block must be the same. With this
clause, the keygen block determines a shared key used only to derive
keys; the actual key used by cgdconfig is derived from the shared key
by the specified algorithm.

The only supported algorithm is hkdf-hmac-sha256, which uses
HKDF-Expand of RFC 5869 instantiated with SHA-256.

Example:

algorithm aes-cbc;
iv-method encblkno1;
keylength 128;
verify_method none;
keygen pkcs5_pbkdf2/sha1 {
iterations 39361;
salt AAAAgMoHiYonye6KogdYJAobCHE=;
shared "pw" algorithm hkdf-hmac-sha256
subkey AAAAgFlw0BMQ5gY+haYkZ6JC+yY=;
};

The key used for this disk will be derived by

HKDF-HMAC-SHA256_k(WXDQExDmBj6FpiRnokL7Jg==),

where k is the outcome of PBKDF2-SHA1 with the given parameters.

Note that <info> encodes a four-byte prefix giving the big-endian
length in bits of the info argument to HKDF, just like all other bit
strings in cgdconfig parameters files.

If you have multiple disks configured using the same keygen block
except for the info parameter, `cgdconfig -C' will only prompt once
for your passphrase, generate a shared key k with PBKDF2 as usual,
and then reuse it for each of the disks.

cgdconfig(8): New -T operation prints all generated keys in cgd.conf.

For testing purposes.

cgdconfig(8): New -t operation just prints the derived key in base64.

For testing purposes.

branches: 1.1.2;
tests for sys/dev/clock_subr.c

branches: 1.1.2;
tests for sys/dev/clock_subr.c

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.2.2;
These clock_subr tests are no longer expected to fail.

tests for sys/dev/clock_subr.c

Actually remove the no-longer-needed Atffiles

branches: 1.1.6; 1.1.12;
Import new test program for device-mapper driver it currently call dm_version_list
and dm_targets_list ioctl to test if dm driver inside rump works.

It will be disable for now, because I need to find out why if I run this
test by atf-run it fails while running h_dm by hand works.

XXX. component.c in rump/libdm calls devsw_attach before dm_modcmd can do
that therefore unmodified modcmd returns error.

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

branches: 1.3.16;
Define _KERNTYPES for things that need it.

Build helper programs as PROGS and not as TESTS_{C,SH}

This enables us to remove custom Atffiles whose only purpose was to avoid
using the helpers as tests.

XXX src/tests/dev/dm/ is not (yet) linked into the build!

branches: 1.1.6; 1.1.12;
Import new test program for device-mapper driver it currently call dm_version_list
and dm_targets_list ioctl to test if dm driver inside rump works.

It will be disable for now, because I need to find out why if I run this
test by atf-run it fails while running h_dm by hand works.

XXX. component.c in rump/libdm calls devsw_attach before dm_modcmd can do
that therefore unmodified modcmd returns error.

Import new test program for device-mapper driver it currently call dm_version_list
and dm_targets_list ioctl to test if dm driver inside rump works.

It will be disable for now, because I need to find out why if I run this
test by atf-run it fails while running h_dm by hand works.

XXX. component.c in rump/libdm calls devsw_attach before dm_modcmd can do
that therefore unmodified modcmd returns error.

Import new test program for device-mapper driver it currently call dm_version_list
and dm_targets_list ioctl to test if dm driver inside rump works.

It will be disable for now, because I need to find out why if I run this
test by atf-run it fails while running h_dm by hand works.

XXX. component.c in rump/libdm calls devsw_attach before dm_modcmd can do
that therefore unmodified modcmd returns error.

XXX: use unused variables.

Import new test program for device-mapper driver it currently call dm_version_list
and dm_targets_list ioctl to test if dm driver inside rump works.

It will be disable for now, because I need to find out why if I run this
test by atf-run it fails while running h_dm by hand works.

XXX. component.c in rump/libdm calls devsw_attach before dm_modcmd can do
that therefore unmodified modcmd returns error.

Adjusts tests after import of atf-0.12:

- The use.fs property is gone.
- Mark the tests/fs/t_create:attrs test as broken when using the default
unprivileged-user:_atf setting. This probably deserves a fix somehow
but I'm not sure at this point.

Import new test program for device-mapper driver it currently call dm_version_list
and dm_targets_list ioctl to test if dm driver inside rump works.

It will be disable for now, because I need to find out why if I run this
test by atf-run it fails while running h_dm by hand works.

XXX. component.c in rump/libdm calls devsw_attach before dm_modcmd can do
that therefore unmodified modcmd returns error.

We don't have any FILES, so no need for a FILESDIR

branches: 1.1.2;
Add a basic test for fss(4)

XXX For now, we just create required files (including mount-points)
XXX in the test's working directory. Eventually someone with more
XXX rump-foo than I should create a fss rump-component and then update
XXX the test to run under rump.

tests: Skip vnd(4)-based tests on vax for now

in order to avoid kernel crash described in PR port-vax/59287

branches: 1.6.2;
t_fss.sh: add missing test case head

Avoid explicitly naming the raw part device with a partition letter - use
the non-partition letter variant instead.

Unmount and unconfigure in the reverse order that they were done. Fixes
problem with leaving a dangling snapshot configured.

Do not assume an all-zeroes disk label will read back as a disk with
an 'a' partition covering the whole disk, instead use the raw partition.
Also skip this test if the fss device is not available.
With lots of help from pgoyette.

branches: 1.2.2;
Mount the snapshot read-only; otherwise we get a nasty panic.

Re-order the clean-up steps to properly undo what we did.

branches: 1.1.2;
Add a basic test for fss(4)

XXX For now, we just create required files (including mount-points)
XXX in the test's working directory. Eventually someone with more
XXX rump-foo than I should create a fss rump-component and then update
XXX the test to run under rump.

Actually remove the no-longer-needed Atffiles

branches: 1.1.6; 1.1.12;
Add simple test for md(4) which just stuffs junk into /dev/rmd0d
and checks the same data can be retrieved.

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

branches: 1.6.16;
Define _KERNTYPES for things that need it.

Move sysproxy support into a separate component, rumpkern_sysproxy,
instead of it being always provided by the rump kernel base. This
move accomplishes two things:

1) it is no longer necessary to provide sysproxy hypercall stubs for
platforms which do not want to use sysproxy
2) it is easier to reason about the security aspects, since configurations
not linking the sysproxy component simply do not support remote
system calls

discussed on rumpkernel-users

When linking statically (as for sun2), need to list -lrump also
after -lrumpuser, because rump_pub_lwproc_switch is used in the
latter and defined in the former.

branches: 1.3.6;
Build helper programs as PROGS and not as TESTS_{C,SH}

This enables us to remove custom Atffiles whose only purpose was to avoid
using the helpers as tests.

XXX src/tests/dev/dm/ is not (yet) linked into the build!

branches: 1.2.6; 1.2.12;
don't include librump twice

Add simple test for md(4) which just stuffs junk into /dev/rmd0d
and checks the same data can be retrieved.

fix typos in word "successful".

explicitly zero-fill the initial md backend

branches: 1.3.2;
comment tyops

Get rid of the "sleep 1" by using rump_daemonize_begin/end().
Notably, md is a little tricky for this, since the ioctl that
configures the service also blocks in the kernel. Therefore, use
an additional pthread to probe when the service is fully configured
and the server can detach.

Also, rawpart love.

Add simple test for md(4) which just stuffs junk into /dev/rmd0d
and checks the same data can be retrieved.

Unfortunately rump does not provide the same magic as MAKEDEV does
for native /dev and create an alias for disk devices w/o partition
latter pointing at the raw partition, so for rump based tests we
actually have to calculate the concrete device name.

Use an idiom suggested by kre for this which also works for ports that
have kern.rawpartition > 4.

Instead of doing 'atf_check ... sh -c foo', just do 'atf_check ... -x foo'.

convert tests from oldstyle dd rif/rof to newstyle dd | rump.dd

branches: 1.5.2;
use rawpart

use rump.halt

cleanup server after use
(XXX: need better way to reboot it)

Get rid of the "sleep 1" by using rump_daemonize_begin/end().
Notably, md is a little tricky for this, since the ioctl that
configures the service also blocks in the kernel. Therefore, use
an additional pthread to probe when the service is fully configured
and the server can detach.

Also, rawpart love.

Add simple test for md(4) which just stuffs junk into /dev/rmd0d
and checks the same data can be retrieved.

fix post-move testsdir. duh

"A few seconds later" I realized the kernel directory is dev/raidframe,
not dev/raid, so reflect this in the test dir. Affects location
for test of PR kern/44239.

Unfortunately rump does not provide the same magic as MAKEDEV does
for native /dev and create an alias for disk devices w/o partition
latter pointing at the raw partition, so for rump based tests we
actually have to calculate the concrete device name.

Use an idiom suggested by kre for this which also works for ports that
have kern.rawpartition > 4.

s/ we we / we /

Reduce disk image size for tests (PR 44239 has been fixed)

branches: 1.13.4;
implement 32-bit compat support for raidframe.

convert several raidframe ioctls to be bitsize idempotent so that
they work the same in 32 and 64 bit worlds, allowing netbsd32 to
configure and query raid properly. remove useless 'row' in a few
places. add COMPAT_80 and put the old ioctls there.

raidframeio.h:
RAIDFRAME_TEST_ACC
- remove, unused
RAIDFRAME_GET_COMPONENT_LABEL
- convert to label not pointer to label
RAIDFRAME_CHECK_RECON_STATUS_EXT
RAIDFRAME_CHECK_PARITYREWRITE_STATUS_EXT
RAIDFRAME_CHECK_COPYBACK_STATUS_EXT
- convert to progress info not pointer to info
RAIDFRAME_GET_INFO
- version entirely.
raidframevar.h:
- rf_recon_req{} has row, flags and raidPtr removed (they're
not a useful part of this interface.)
- RF_Config_s{} and RF_DeviceConfig_s{} have numRow/rows removed.
- RF_RaidDisk_s{} is re-ordered slightly to fix alignment
padding - the actual data was already OK.
- InstallSpareTable() loses row argument

rf_compat32.c has code for RF_Config_s{} in 32 bit mode, used
by RAIDFRAME_CONFIGURE and RAIDFRAME_GET_INFO32.

rf_compat80.c has code for rf_recon_req{}, RF_RaidDisk_s{} and
RF_DeviceConfig_s{} to handle RAIDFRAME_FAIL_DISK,
RAIDFRAME_GET_COMPONENT_LABEL, RAIDFRAME_CHECK_RECON_STATUS_EXT,
RAIDFRAME_CHECK_PARITYREWRITE_STATUS_EXT,
RAIDFRAME_CHECK_COPYBACK_STATUS_EXT, RAIDFRAME_GET_INFO.

move several of the per-ioctl code blocks into separate functions.

add rf_recon_req_internal{} to replace old usage of global
rf_recon_req{} that had unused void * in the structure, ruining
it's 32/64 bit ABI.

add missing case for RAIDFRAME_GET_INFO50.

adjust raid tests to use the new .conf format, and add a case to
test the old method as well.

raidctl:
deal with lack of 'row' members in a couple of places.
fail request no longer takes row.
handle "START array" sections with just "numCol numSpare", ie
no "numRow" specified. for now, generate old-style configuration
but update raidctl.8 to specify the new style (keeping reference
to the old style.)

note that: RF_ComponentLabel_s::{row,num_rows} and
RF_SingleComponent_s::row are obsolete but not removed yet.

Check for RUMP programs before using them.

branches: 1.11.2; 1.11.8;
Fix cut-and-paste-o that casused the raid1_normal test case to have no
cleanup function defined, resulting in a rump_server process hanging
around after the tests completed.

Add missing RUMP_SERVER export, so the "normal" test does not fail with
a stupid error.

Note that PR kern/44251 is fixed.
Add tests for normal configuration of RAID 1 and RAID 5 sets.

Instead of doing 'atf_check ... sh -c foo', just do 'atf_check ... -x foo'.

PR#44239 is now fixed, remove the xfail from the test.

convert tests from oldstyle dd rif/rof to newstyle dd | rump.dd

branches: 1.5.2;
Substitute a surgical rump_server configuration for rump_allserver
now that it's possible. With warm fs cache, the startup time of
the former is 0.01s and the latter 0.1s. With cold caches it's
0.2s vs 2s.

test case for PR kern/44251

Check that raid1 and raid5 can serve data after a component has
been nuked.

fix editing artifact

"A few seconds later" I realized the kernel directory is dev/raidframe,
not dev/raid, so reflect this in the test dir. Affects location
for test of PR kern/44239.

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

branches: 1.7.16;
Define _KERNTYPES for things that need it.

Fix static linking for the tests: -lrump is also used by -lrumpuser,
so we also need -lrump after -lrumpuser. Fixes build for sun2.

obsolete the installed <rump/scsitest.h> header and make it private
to tests/dev/scsipi

scsitest is a SCSI target emulator used by one test, and has little
reason to get installed. Make the component private to the test using
it and obsolete the installed one.

IOW, rename sys/rump/dev/lib/libscsitest -> tests/dev/scsipi/libscsitest

branches: 1.3.6; 1.3.12; 1.3.22;
Query the raw partition at runtime

Re-order libraries so that this links statically as well.

Test for cache sync noises after disk is ejected.

test case for PR kern/43785

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.7.6;
obsolete the installed <rump/scsitest.h> header and make it private
to tests/dev/scsipi

branches: 1.6.6;
The CD emulator has been fixed, no longer expect the test to die.

Expect a crash in the noisyeject test. Mention PR kern/47646.

branches: 1.4.2;
Comment out the expected failure, as it does not trigger anymore.

branches: 1.3.4;
validate that getrawpartition() didn't fail.

Query the raw partition at runtime

Test for cache sync noises after disk is ejected.

test case for PR kern/43785

LIBISPRIVATE=yes

branches: 1.3.2; 1.3.4; 1.3.8;
Include bsd.own.mk (hi pooka)

CPPFLAGS for rump_private.h

scsitest is a SCSI target emulator used by one test, and has little
reason to get installed. Make the component private to the test using
it and obsolete the installed one.

IOW, rename sys/rump/dev/lib/libscsitest -> tests/dev/scsipi/libscsitest

branches: 1.1.2; 1.1.4; 1.1.8;
scsitest is a SCSI target emulator used by one test, and has little
reason to get installed. Make the component private to the test using
it and obsolete the installed one.

IOW, rename sys/rump/dev/lib/libscsitest -> tests/dev/scsipi/libscsitest

Convert the test to cfargs. OK @thorpej.

config_found_ia() -> config_found().

use strncpy() into a buffer that may not be nul terminated.

branches: 1.2.2; 1.2.4; 1.2.8; 1.2.30;
obsolete the installed <rump/scsitest.h> header and make it private
to tests/dev/scsipi

scsitest is a SCSI target emulator used by one test, and has little
reason to get installed. Make the component private to the test using
it and obsolete the installed one.

IOW, rename sys/rump/dev/lib/libscsitest -> tests/dev/scsipi/libscsitest

branches: 1.1.2; 1.1.4; 1.1.8;
obsolete the installed <rump/scsitest.h> header and make it private
to tests/dev/scsipi

branches: 1.1.2; 1.1.4; 1.1.8;
scsitest is a SCSI target emulator used by one test, and has little
reason to get installed. Make the component private to the test using
it and obsolete the installed one.

IOW, rename sys/rump/dev/lib/libscsitest -> tests/dev/scsipi/libscsitest

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

branches: 1.4.16;
Define _KERNTYPES for things that need it.

Fix static linking for the tests: -lrump is also used by -lrumpuser,
so we also need -lrump after -lrumpuser. Fixes build for sun2.

branches: 1.2.12; 1.2.22;
Add a rump-based set of tests for sysmon_envsys(8) + powerd(8) + swsensor(4)

Add test cases to check that sysmon/swwdog will panic and reboot
the kernel if left untickled.

Thanks to jmmv for the tip that doing this is possible in atf via
means of fork/wait.

s/timout/timeout/

tests/dev/sysmon: Query bits of data, not bits of entropy.

Fixes PR kern/47661.

These test cases should now succeed, after fixing rump kernel to handle
modules that establish their sysctls via SYSCTL_SETUP()

Mark the swsensor tests "expected failure" since the rump world doesn't
seem to handle the SYSCTL_SETUP stuff. PR kern/55088

Include better diagnostic info when a required key value cannot be retrieved from envstat -x

Double the timeout (to 120s) for slower machines

The sh api calls it atf_expect_fail, while the c api calls it
atf_tc_expect_fail - this is shell, so fix the names accordingly.
XXX Why do they differ?

These tests are flaky so mark them as expected failures... when they fail.
See PR kern/47661.

branches: 1.5.2;
Add new test cases for entropy-providing sensors

branches: 1.4.6;
Now that 'rump_server -l stuff' works, use a less heavyweight rump_server
for this test. Thanks, pooka!

Now that we update the callout timer as soon as it is updated, we no longer
need to have an extended wait for the first powerd event to occur. Revert
that portion of previous commit.

Various cleanup (most from pooka@)
- Does not require root access on the host, only in the rump
environment (which it gets by default)
- Manual clean-up of powerd process and rump-server socket is
not necessary - happens automatically
- Don't use a global, absolute path for the rump-server socket

For alarm_sensor, make sure events are still delivered after 'envstat -S'
(the cur_value was deliberately left at an alarm level and should not be
affected by the reset).

No longer need to skip the alarm_sensor and limit_sensor tests, since
pooka fixed passing of proplist to built-in modules.

Increase wait time for first powerd event report. (This should not be
needed, so there's probably a bug somewhere, but the increased timeout
lets us validate the rest of the sensor functionality.)

Add a rump-based set of tests for sysmon_envsys(8) + powerd(8) + swsensor(4)

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.6.2;
When exiting, provide a reason.

need signal.h for kill()
this is why it was wrong for rump_syscalls.h to include this.

Due to timing discrepancies desribed in PR kern/43997, tickle the
watchdog just a little bit sooner. This maintains the spirit of the
test while avoiding the actual bug. This can be reverted once (if)
the PR is fixed.

Add a third test-case to verify that disarming of the watchdog works.

Make tcount volatile since a signal handler plays with it.

Add test cases to check that sysmon/swwdog will panic and reboot
the kernel if left untickled.

Thanks to jmmv for the tip that doing this is possible in atf via
means of fork/wait.

rework build of t_hid to be more reliable, while working around ATF cruddyness

Unbreak the sun2 build: Don't use program-specific LDADD options because
those come after the general LDADD options and break static linking.

Add some tests for the kernel HID parser.

branches: 1.1.4;
fix build by adding a Makefile.inc that chains up.

Use rump_schedule() before calling things in the rump context.
Hopefully fixes these tests on all ports.

t_hid doesn't use rump correctly, and thus consistently fails; mark as such

Call rump_init() before using rump functionality.

This change should make these test cases consistently fail on all ports.

Related to PR kern/51096.

locate_item() doesn't need to have a flags argument, as the flags
are also in the hid item data structure.

fix test program for hid item checks

Don't crash when the device's HID Report Descriptor Pops from an empty stack.

Add tests for HID Parser Pop-on-empty-stack bug.

Add some tests for the kernel HID parser.

Set LIBISPRIVATE=yes

Fix fallout from hid factorisation:
- need to install sys/dev/hid/hid.h for userland
- include it where needed - most of the time in place if usb/usbhid.h

Add some tests for the kernel HID parser.

fix build by adding a Makefile.inc that chains up.

Centralize the base rump libraries into a variable used by all the other
Makefiles so that we can make changes to it centrally as needed and have
less mess. Fixes the sun2 build that needs rumpvfs after librump after
the latest changes.

Deal with fallout from the addition of
KERN_PROC_CWD in sysctl(3)
That is kern.proc.$$.KERN_PROC_CWD (I think - not that it matters here)

The effect is that -lrump now requires -lrumpvfs

This set of changes fixes (I believe) regular dynamic builds,
more might be required for static builds (will be verified soon).

branches: 1.2.4;
Fix fallout from hid factorisation:
- need to install sys/dev/hid/hid.h for userland
- include it where needed - most of the time in place if usb/usbhid.h

rework build of t_hid to be more reliable, while working around ATF cruddyness