- 05 Oct, 2020 23 commits
-
-
Kees Cook authored
As with the kernel_load_data LSM hook, add a "contents" flag to the kernel_read_file LSM hook that indicates whether the LSM can expect a matching call to the kernel_post_read_file LSM hook with the full contents of the file. With the coming addition of partial file read support for kernel_read_file*() API, the LSM will no longer be able to always see the entire contents of a file during the read calls. For cases where the LSM must read examine the complete file contents, it will need to do so on its own every time the kernel_read_file hook is called with contents=false (or reject such cases). Adjust all existing LSMs to retain existing behavior. Signed-off-by:
Kees Cook <keescook@chromium.org> Reviewed-by:
Mimi Zohar <zohar@linux.ibm.com> Link: https://lore.kernel.org/r/20201002173828.2099543-12-keescook@chromium.orgSigned-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
Kees Cook authored
Now that there is an API for checking loaded contents for modules loaded without a file, call into the LSM hooks. Signed-off-by:
KP Singh <kpsingh@google.com> Acked-by:
Jessica Yu <jeyu@kernel.org> Link: https://lore.kernel.org/r/20201002173828.2099543-11-keescook@chromium.orgSigned-off-by:
-
Kees Cook authored
Now that security_post_load_data() is wired up, use it instead of the NULL file argument style of security_post_read_file(), and update the security_kernel_load_data() call to indicate that a security_kernel_post_load_data() call is expected. Wire up the IMA check to match earlier logic. Perhaps a generalized change to ima_post_load_data() might look something like this: return process_buffer_measurement(buf, size, kernel_load_data_id_str(load_id), read_idmap[load_id] ?: FILE_CHECK, 0, NULL); Signed-off-by: -
Kees Cook authored
There are a few places in the kernel where LSMs would like to have visibility into the contents of a kernel buffer that has been loaded or read. While security_kernel_post_read_file() (which includes the buffer) exists as a pairing for security_kernel_read_file(), no such hook exists to pair with security_kernel_load_data(). Earlier proposals for just using security_kernel_post_read_file() with a NULL file argument were rejected (i.e. "file" should always be valid for the security_..._file hooks, but it appears at least one case was left in the kernel during earlier refactoring. (This will be fixed in a subsequent patch.) Since not all cases of security_kernel_load_data() can have a single contiguous buffer made available to the LSM hook (e.g. kexec image segments are separately loaded), there needs to be a way for the LSM to reason about its expectations of the hook coverage. In order to handle this, add a "contents" argument to the "kernel_load_data" hook that indicates if the newly added "kernel_post_load_data" hook will be called with the full contents once loaded. That way, LSMs requiring full contents can choose to unilaterally reject "kernel_load_data" with contents=false (which is effectively the existing hook coverage), but when contents=true they can allow it and later evaluate the "kernel_post_load_data" hook once the buffer is loaded. With this change, LSMs can gain coverage over non-file-backed data loads (e.g. init_module(2) and firmware userspace helper), which will happen in subsequent patches. Additionally prepare IMA to start processing these cases. Signed-off-by:
-
Kees Cook authored
In preparation for adding partial read support, add an optional output argument to kernel_read_file*() that reports the file size so callers can reason more easily about their reading progress. Signed-off-by:
Luis Chamberlain <mcgrof@kernel.org> Reviewed-by:
James Morris <jamorris@linux.microsoft.com> Acked-by:
Scott Branden <scott.branden@broadcom.com> Link: https://lore.kernel.org/r/20201002173828.2099543-8-keescook@chromium.orgSigned-off-by:
-
Kees Cook authored
In preparation for further refactoring of kernel_read_file*(), rename the "max_size" argument to the more accurate "buf_size", and correct its type to size_t. Add kerndoc to explain the specifics of how the arguments will be used. Note that with buf_size now size_t, it can no longer be negative (and was never called with a negative value). Adjust callers to use it as a "maximum size" when *buf is NULL. Signed-off-by:
-
Kees Cook authored
In preparation for refactoring kernel_read_file*(), remove the redundant "size" argument which is not needed: it can be included in the return code, with callers adjusted. (VFS reads already cannot be larger than INT_MAX.) Signed-off-by:
-
Kees Cook authored
These routines are used in places outside of exec(2), so in preparation for refactoring them, move them into a separate source file, fs/kernel_read_file.c. Signed-off-by:
-
Scott Branden authored
Move kernel_read_file* out of linux/fs.h to its own linux/kernel_read_file.h include file. That header gets pulled in just about everywhere and doesn't really need functions not related to the general fs interface. Suggested-by:
Christoph Hellwig <hch@lst.de> Signed-off-by:
-
Kees Cook authored
The "FIRMWARE_EFI_EMBEDDED" enum is a "where", not a "what". It should not be distinguished separately from just "FIRMWARE", as this confuses the LSMs about what is being loaded. Additionally, there was no actual validation of the firmware contents happening. Fixes: e4c2c0ff ("firmware: Add new platform fallback mechanism and firmware_request_platform()") Signed-off-by:
-
Kees Cook authored
FIRMWARE_PREALLOC_BUFFER is a "how", not a "what", and confuses the LSMs that are interested in filtering between types of things. The "how" should be an internal detail made uninteresting to the LSMs. Fixes: a098ecd2 ("firmware: support loading into a pre-allocated buffer") Fixes: fd90bc55 ("ima: based on policy verify firmware signatures (pre-allocated buffer)") Fixes: 4f0496d8 ("ima: based on policy warn about loading firmware (pre-allocated buffer)") Signed-off-by:
-
Rikard Falkeborn authored
The only usage of these structs is to assign their address to the fops field in the w1_family struct, which is a const pointer. Make them const to allow the compiler to put them in read-only memory. This was done with the following Coccinelle semantic patch (http://coccinelle.lip6.fr/): // <smpl> @r1 disable optional_qualifier @ identifier i; position p; @@ static struct w1_family_ops i@p = {...}; @ok1@ identifier r1.i; position p; identifier s; @@ static struct w1_family s = { .fops=&i@p, }; @bad1@ position p!={r1.p,ok1.p}; identifier r1.i; @@ i@p @depends on !bad1 disable optional_qualifier@ identifier r1.i; @@ static +const struct w1_family_ops i={}; // </smpl> Acked-by:
Sebastian Reichel <sre@kernel.org> Signed-off-by:
Rikard Falkeborn <rikard.falkeborn@gmail.com> Link: https://lore.kernel.org/r/20201004193202.4044-4-rikard.falkeborn@gmail.comSigned-off-by:
-
Rikard Falkeborn authored
The only usage of these structs is to assign their address to the fops field in the w1_family struct, which is a const pointer. Make them const to allow the compiler to put them in read-only memory. This was done with the following Coccinelle semantic patch (http://coccinelle.lip6.fr/): // <smpl> @r1 disable optional_qualifier @ identifier i; position p; @@ static struct w1_family_ops i@p = {...}; @ok1@ identifier r1.i; position p; identifier s; @@ static struct w1_family s = { .fops=&i@p, }; @bad1@ position p!={r1.p,ok1.p}; identifier r1.i; @@ i@p @depends on !bad1 disable optional_qualifier@ identifier r1.i; @@ static +const struct w1_family_ops i={}; // </smpl> Signed-off-by:
-
Rikard Falkeborn authored
The fops field in the w1_family struct is never modified. Make it const to indicate that. Constifying the pointer makes it possible for drivers to declare static w1_family_ops structs const, which in turn will allow the compiler to put it in read-only memory. Reviewed-by:
Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by:
-
Alexander Shishkin authored
This adds support for the Trace Hub in Alder Lake CPU. Signed-off-by:
Alexander Shishkin <alexander.shishkin@linux.intel.com> Link: https://lore.kernel.org/r/20201005071319.78508-9-alexander.shishkin@linux.intel.comSigned-off-by:
-
Alexander Shishkin authored
This adds support for the Trace Hub in Alder Lake-S. Signed-off-by:
-
Tingwei Zhang authored
To avoid mixup of packets from differnt ftrace packets simultaneously, use different channel for packets from different CPU. Reviewed-by:
Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by:
Tingwei Zhang <tingwei@codeaurora.org> Signed-off-by:
-
Tingwei Zhang authored
Set flags for trace_export. Export function trace, event trace and trace marker to stm. Reviewed-by:
-
Tingwei Zhang authored
Add the support to route trace_marker buffer to other destination via trace_export. Reviewed-by:
-
Tingwei Zhang authored
Only function traces can be exported to other destinations currently. This patch exports event trace as well. Move trace export related function to the beginning of file so other trace can call trace_process_export() to export. Reviewed-by:
-
Tingwei Zhang authored
More traces like event trace or trace marker will be supported. Add flag for difference traces, so that they can be controlled separately. Move current function trace to it's own flag instead of global ftrace enable flag. Reviewed-by:
-
Tingwei Zhang authored
We will support copying event trace to STM. Change STM_SOURCE_FTRACE to depend on TRACING since we will support multiple tracers. Reviewed-by:
-
Greg Kroah-Hartman authored
Merge tag 'extcon-next-for-5.10-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon into char-misc-next Chanwoo writes: Detailed description for this pull request: 1. Update extcon driver with minor updates: - Covert the devicetree binding format from txt to yaml and edit the bidning document for extcon-ptn5150.c. - Clean-up the code of extcon-ptn5150.c without any behavior changes. - Replace HTTP links with HTTPS ones on extcon-palmas.c and extcon-usb-gpio.c. - Return the proper error code on extcon-max14577/max77693/max77843.c. - Simplify with dev_err_probe() on extcon-palmas.c. - Use module_platform_driver to simplify the code on extcon-axp288.c. 2. Update MAINTAINERS - Add Krzysztof Kozlowski as maintainer of NXP PTN5150A CC/extcon driver to provide review, feedback and testing. * tag 'extcon-next-for-5.10-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon: (25 commits) extcon: axp288: Use module_platform_driver to simplify the code extcon: ptn5150: Do not print error during probe if nothing is attached extcon: ptn5150: Use defines for registers extcon: palmas: Simplify with dev_err_probe() extcon: max8997: Return error code of extcon_dev_allocate() extcon: max77843: Return error code of extcon_dev_allocate() extcon: max77693: Return error code of extcon_dev_allocate() extcon: max14577: Return error code of extcon_dev_allocate() extcon: ptn5150: Set the VBUS and POLARITY property capability extcon: ptn5150: Switch to GENMASK() and BIT() macros extcon: ptn5150: Deduplicate parts of dev_err_probe() extcon: Replace HTTP links with HTTPS ones MAINTAINERS: Add entry for NXP PTN5150A CC driver extcon: ptn5150: Convert to .probe_new extcon: ptn5150: Convert to module_i2c_driver extcon: ptn5150: Reduce the amount of logs on deferred probe extcon: ptn5150: Make 'vbus-gpios' optional extcon: ptn5150: Check current USB mode when probing extcon: ptn5150: Lower the noisiness of probe extcon: ptn5150: Simplify getting vbus-gpios with flags ...
-
- 02 Oct, 2020 17 commits
-
-
Diana Craciun authored
The region size reported by the firmware for mc and software portals was less than allocated by the hardware. This may be problematic when mmapping the region in user space because the region size is less than page size. However the size as reserved by the hardware is 64K. Reviewed-by:
Laurentiu Tudor <laurentiu.tudor@nxp.com> Acked-by:
Diana Craciun <diana.craciun@oss.nxp.com> Link: https://lore.kernel.org/r/20200929085441.17448-14-diana.craciun@oss.nxp.comSigned-off-by:
-
Bharat Bhushan authored
In virtual machines the device-id range is defined between 0x10000-0x20000. The reason for using such a large range is to avoid overlapping with the PCI range. Reviewed-by:
Bharat Bhushan <Bharat.Bhushan@nxp.com> Signed-off-by:
-
Diana Craciun authored
The IRQ pool handling functions can be used by both DPRC driver and VFIO. Adapt and export those functions. Reviewed-by:
-
Diana Craciun authored
Before destroying the mc_io, check first that it was allocated. Reviewed-by:
-
Diana Craciun authored
Both DPRC driver and VFIO driver use the same initialization code for the DPRC. Introduced a new function which groups this initialization code. The function is exported and may be used by VFIO as well. Reviewed-by:
-
Diana Craciun authored
Create and export a cleanup function for DPRC. The function is used by the DPRC driver, but it will be used by the VFIO driver as well. Reviewed-by:
-
Diana Craciun authored
Currently the DPRC scan function is used only by the bus driver. But the same functionality will be needed by the VFIO driver. To support this, the dprc scan function was exported and a little bit adjusted to fit both scenarios. Also the scan mutex initialization is done when the bus object is created, not in dprc_probe in order to be used by both VFIO and bus driver. Similarily dprc_remove_devices is exported to be used by VFIO. Reviewed-by:
-
Bharat Bhushan authored
DPRC reset is required by VFIO-mc in order to stop a device to further generate DMA transactions. Reviewed-by:
-
Diana Craciun authored
There are already firmware API commands that have multiple versions. For each multiple version command, another command to retrieve the API version is issued. This may introduce an important overhead. The version does not change while the system is running, so the DPRC API version can be safely cached. Reviewed-by:
-
Diana Craciun authored
The QMAN region is memory mapped, so it should be of type IORESOURCE_MEM. The region flags bits were wrongly used to pass additional information. Use the bus specific bits for this purpose. Reviewed-by:
-
Bharat Bhushan authored
This patch is required for vfio-fsl-mc meta driver to successfully bind layerscape container devices for device passthrough. This patch adds a mechanism to allow a layerscape device to specify a driver rather than a layerscape driver provide a device match. Example to allow a device (dprc.1) to specifically bind with driver (vfio-fsl-mc):- - echo vfio-fsl-mc > /sys/bus/fsl-mc/devices/dprc.1/driver_override - echo dprc.1 > /sys/bus/fsl-mc/drivers/fsl_mc_dprc/unbind - echo dprc.1 > /sys/bus/fsl-mc/drivers/vfio-fsl-mc/bind Reviewed-by:
-
Diana Craciun authored
Prepare the dprc_scan_objects function to be used by the VFIO mc driver code. The function is used to scan the mc objects by the bus driver. The same functionality is needed by the VFIO mc driver, but in this case the interrupt configuration is delayed until the userspace configures the interrupts. In order to use the same function in both drivers add a new parameter. Reviewed-by:
-
Diana Craciun authored
The total number of interrupts is only used for some checks outside the dprc_scan_objects function. Furthermore, in some situations the check is made twice. Move the bounds check inside the function for all situations. Reviewed-by:
-
Sherry Sun authored
Read and write io memory should address align on ARCH ARM. Change to use memcpy_toio to avoid kernel panic caused by the address un-align issue. Signed-off-by:
Sherry Sun <sherry.sun@nxp.com> Signed-off-by:
Joakim Zhang <qiangqing.zhang@nxp.com> Link: https://lore.kernel.org/r/20200929091106.24624-5-sherry.sun@nxp.comSigned-off-by:
-
Sherry Sun authored
Since struct _mic_vring_info and vring are allocated together and follow vring, if the vring_size() is not four bytes aligned, which will cause the start address of struct _mic_vring_info is not four byte aligned. For example, when vring entries is 128, the vring_size() will be 5126 bytes. The _mic_vring_info struct layout in ddr looks like: 0x90002400: 00000000 00390000 EE010000 0000C0FF Here 0x39 is the avail_idx member, and 0xC0FFEE01 is the magic member. When EP use ioread32(magic) to reads the magic in RC's share memory, it will cause kernel panic on ARM64 platform due to the cross-byte io read. Here read magic in user space use le32toh(vr0->info->magic) will meet the same issue. So add round_up(x,4) for vring_size, then the struct _mic_vring_info will store in this way: 0x90002400: 00000000 00000000 00000039 C0FFEE01 Which will avoid kernel panic when read magic in struct _mic_vring_info. Signed-off-by:
-
Sherry Sun authored
Build module or builtin VOP based on CONFIG_VOP macro. Signed-off-by:
-
Martin Fuzzey authored
On my platform (i.MX53) bus access sometimes fails with w1_search: max_slave_count 64 reached, will continue next search. The reason is the use of jiffies to implement a 200us timeout in mxc_w1_ds2_touch_bit(). On some platforms the jiffies timer resolution is insufficient for this. Fix by replacing jiffies by ktime_get(). For consistency apply the same change to the other use of jiffies in mxc_w1_ds2_reset_bus(). Fixes: f80b2581 ("w1: mxc_w1: Optimize mxc_w1_ds2_touch_bit()") Cc: stable <stable@vger.kernel.org> Signed-off-by:
Martin Fuzzey <martin.fuzzey@flowbird.group> Link: https://lore.kernel.org/r/1601455030-6607-1-git-send-email-martin.fuzzey@flowbird.groupSigned-off-by:
-
