1. 18 Jun, 2004 9 commits
    • Russell King's avatar
      [PATCH] Clean up asm/pgalloc.h include · 1c60f076
      Russell King authored
      This patch cleans up needless includes of asm/pgalloc.h from the fs/
      kernel/ and mm/ subtrees.  Compile tested on multiple ARM platforms, and
      x86, this patch appears safe.
      
      This patch is part of a larger patch aiming towards getting the include of
      asm/pgtable.h out of linux/mm.h, so that asm/pgtable.h can sanely get at
      things like mm_struct and friends.
      
      I suggest testing in -mm for a while to ensure there aren't any hidden arch
      issues.
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      1c60f076
    • Yoav Zach's avatar
      [PATCH] binfmt_misc: improve calculation of interpreter's credentials · c407c033
      Yoav Zach authored
      This patch allows for misc binaries to run with credentials and security
      token that are calculated according to the binaries, and not according to the
      interpreter, which is the legacy behavior of binfmt_misc.
      
      The way it is done is by calling prepare_binprm, which is where these
      attributes are calculated, before switching the 'file' field in the bprm from
      the binary to the interpreter.
      
      This feature should be used with care, since the interpreter will have root
      permissions when running a setuid binary owned by root.
      
      Please note -
      
      - Only root can register an interpreter with binfmt_misc.  The feature is
        documented and the administrator is advised to handle it with care
      
      - The new feature is enabled only with a special flag in the registration
        string.  When this flag is not specified the current behavior of
        binfmt_misc is kept
      
      - This is the only 'right' way for an interpreter to know the correct
        AT_SECURE value for the interpreted binary
      
      
      From: Chris Wright <chrisw@osdl.org>
      
        This patchset looks OK, except for one problem.  It installs the fd (which
        could've been unreadable) without unsharing the ->files.  So someone can use
        this to read unreadable yet executable files.  Here's a patch which fixes
        that up.  I added one bit that's commented out because I'm not positive if a
        final steal_locks() is needed.
      
        I did a fair amount of rearranging to simplify the error conditions
        relative to the fd_install(), and unshare_files().
      
      From: Chris Wright <chrisw@osdl.org>
      
        I found that the intel patchset (and mine as well) leaked i_writecount on
        the original executed file.  In addition, I verified that the steal_locks()
        bit is indeed needed.
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      c407c033
    • Yoav Zach's avatar
      [PATCH] Handle non-readable binfmt_misc executables · 79baf43b
      Yoav Zach authored
      <background>
      
      I work in a group that works on enabling the IA-32 Execution Layer
      (http://www.intel.com/pressroom/archive/releases/20040113comp.htm) on Linux.
      In a few words - this is a dynamic translator for IA-32 binaries on IPF
      platform.  Following David Mosberger's advice - we use the binfmt_misc
      mechanism for the invocation of the translator whenever the user tries to
      exec an IA-32 binary.
      
      The EL is meant to help in the migration path from IA-32 to IPF.  From our
      beta customers we learnt that at first stage - they tend to keep their
      environment mostly intact, using the legacy IA-32 binaries.
      
      Such an environment has, naturally, setuid and non-readable binaries.  It
      will be useless to ask the administrator to change the settings of such an
      environment - some of them are very complex, and the administrators are
      reluctant to make any changes in a system that already proved itself to be
      robust and secure.  So, our target with these patches is not to enhance the
      support for scripts but rather to allow a translator to be integrated into a
      working environment that is not (and should not be) aware to the fact it's
      being emulated.
      
      As I said before - it is practically hopeless to expect an administrator of
      such a system to change it so that it will suit the current behavior of
      binfmt_misc.  But, even if we could do that,
      
      I'm not sure it would be a good idea - these changes are likely to be less
      secure than the suggested patches -
      
      - In order to execute non-readable binaries the binary will have to be made
        readable, which is obviously less secure than allowing only a trusted
        translator to read it
      
      - There will be no way for the translator to calculate the accurate
        AT_SECURE value for the translated process.  This might end up with the
        translated process running in a non-secured mode when it actually needs to
        be secured.
      
      </background>
      
      
      I prepared a patch that solves a couple of problems that interpreters have
      when invoked via binfmt_misc.  currently -
      
      1) such interpreters cannot open non-readable binaries
      
      2) the processes will have their credentials and security attributes
         calculated according to interpreter permissions and not those of the
         original binary
      
      the proposed patch solves these problems by -
      
      1) opening the binary on behalf of the interpreter and passing its fd
         instead of the path as argv[1] to the interpreter
      
      2) calling prepare_binprm with the file struct of the binary and not the
         one of the interpreter
      
      The new functionality is enabled by adding a special flag to the registration
      string.  If this flag is not added then old behavior is not changed.
      
      A preliminary version of this patch was sent to the list on 9/1/2003 with the
      title "[PATCH]: non-readable binaries - binfmt_misc 2.6.0-test4".  This new
      version fixes the concerns that were raised by the patch, except of calling
      unshare_files() before allocating a new fd.  this is because this feature did
      not enter 2.6 yet.
      
      
      Arun Sharma <arun.sharma@intel.com> says:
      
      We were going through an internal review of this patch:
      
      http://marc.theaimsgroup.com/?l=linux-kernel&m=107424598901720&w=2
      
      which is in your tree already.  I'm not sure if this line of code got
      sufficient review.
      
      +               /* call prepare_binprm before switching to interpreter's file
      +                * so that all security calculation will be done according to
      +                * binary and not interpreter */
      +               retval = prepare_binprm(bprm);
      
      The case that concerns me is: unprivileged interpreter and a privileged
      binary.  One can use binfmt_misc to execute untrusted code (interpreter) with
      elevated privileges.  One could argue that all binfmt_misc interpreters are
      trusted, because only root can register them.  But that's a change from the
      traditional behavior of binfmt_misc (and binfmt_script).
      
      
      (Update):
      
      Arun pointed out that calculating the process credentials according to the
      binary that needs to be translated is a bit risky, since it requires the
      administrator to pay extra attention not to register an interpreter which is
      not intended to run with root credentials.
      
      After discussing this issue with him, I would like to propose a modified
      patch: The old patch did 2 things - 1) open the binary for reading and 2)
      calculate the credentials according to the binary.
      
      I removed the riskier part of changing the credentials calculation, so the
      revised patch only opens the binary for reading.  It also includes few words
      of warning in the description of the 'open-binary' feature in
      binfmt_misc.txt, and makes the function entry_status print the flags in use.
      
      As for the 'credentials' part of the patch, I will prepare a separate patch
      for it and send it again to the LKML, describe the problem and ask for people
      comments.
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      79baf43b
    • Matt Porter's avatar
      [PATCH] Add PPC4xx MAINTAINERS entry, merge CREDITS from 2.4 · 69ac831e
      Matt Porter authored
      Add myself as the PPC4xx maintainer. Merge CREDITS entry from 2.4
      Signed-off-by: default avatarMatt Porter <mporter@kernel.crashing.org>
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      69ac831e
    • Olaf Hering's avatar
      [PATCH] ppc64: avoid multiline /proc/cmdline content on iSeries · 1d023f88
      Olaf Hering authored
      /proc/cmdline is filled via an OS400 call iSeries_init().  It scans the
      returned data from the end, instead of the beginning.  This leads to
      multiple lines in /proc/cmdline
      
      Just scan from the beginning and stop at the first newline.  This patch
      changes also the /proc/iSeries/mf/*/cmdline interface to do the same as the
      initial setup.
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      1d023f88
    • Mikael Pettersson's avatar
      [PATCH] ppc32 irq.c cpumask fix · bf70d874
      Mikael Pettersson authored
      2.6.7-rc3-mm1 changed cpumask_t from ulong to a struct, causing
      compile-time errors in arch/ppc/kernel/irq.c.
      
      Proposed fix below. Tested on a G3.
      Signed-off-by: default avatarMikael Pettersson <mikpe@csd.uu.se>
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      bf70d874
    • Kumar Gala's avatar
      [PATCH] ppc32: support for e500 and 85xx · 9bad068c
      Kumar Gala authored
      Here is both a GNU style and BK patch for adding support for the e500 core and
      85xx platform to 2.6.  This is pretty much a direct port from 2.4 with a bit
      of cleanup around the edges.
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      9bad068c
    • Hugh Dickins's avatar
      [PATCH] mm: pretest pte_young and pte_dirty · f866d89a
      Hugh Dickins authored
      Test for pte_young before going to the costlier atomic test_and_clear, as
      asm-generic does.  Test for pte_dirty before going to the costlier atomic
      test_and_clear, as asm-generic does (I said before that I would not do so for
      pte_dirty, but was missing the point: there is nothing atomic about deciding
      to do nothing).  But I've not touched the rather different ppc and ppc64.
      Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      f866d89a
    • Hugh Dickins's avatar
      [PATCH] mm: flush TLB when clearing young · 68dc3ce3
      Hugh Dickins authored
      Traditionally we've not flushed TLB after clearing the young/referenced bit,
      it has seemed just a waste of time.  Russell King points out that on some
      architectures, with the move from 2.4 mm sweeping to 2.6 rmap, this may be a
      serious omission: very frequently referenced pages never re-marked young, and
      the worst choices made for unmapping.
      
      So, replace ptep_test_and_clear_young by ptep_clear_flush_young throughout
      rmap.c.  Originally I'd imagined making some kind of TLB gather optimization,
      but don't see what now: whether worth it rather depends on how common
      cross-cpu flushes are, and whether global or not.
      
      ppc and ppc64 have already found this issue, and worked around it by arranging
      TLB flush from their ptep_test_and_clear_young: with the aid of pgtable rmap
      pointers.  I'm hoping ptep_clear_flush_young will allow ppc and ppc64 to
      remove that special code, but won't change them myself.
      
      It's worth noting that it is Andrea's anon_vma rmap which makes the vma
      available for ptep_clear_flush_young in page_referenced_one: anonmm and
      pte_chains would both need an additional find_vma for that.
      Signed-off-by: default avatarHugh Dickins <hugh@veritas.com>
      Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      68dc3ce3
  2. 17 Jun, 2004 3 commits
    • Richard Henderson's avatar
      [PATCH] alpha: fix discontigmem+initrd build · 3900b963
      Richard Henderson authored
      From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
      
      Compilation fails due to incorrect usage of NODE_DATA().
      
      Reported by hpa.
      3900b963
    • Paul Mackerras's avatar
      [PATCH] ppc64: Optimize exception/syscall entry/exit · 1ab196f3
      Paul Mackerras authored
      This rewrites the PPC64 exception entry/exit routines to make them
      smaller and faster.
      
      In particular we no longer save all of the registers for the common
      exceptions - system calls, hardware interrupts and decrementer (timer)
      interrupts - only the volatile registers.  The other registers are saved
      and restored (if used) by the C functions we call.  This involved
      changing the registers we use in early exception processing from r20-r23
      to r9-r12, which ended up changing quite a lot of code in head.S. 
      Overall this gives us about a 20% reduction in null syscall time. 
      
      Some system calls need all the registers (e.g.  fork/clone/vfork and
      [rt_]sigsuspend).  For these the syscall dispatch code calls a stub that
      saves the nonvolatile registers before calling the real handler.
      
      This also implements the force_successful_syscall_return() thing for
      ppc64.
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      1ab196f3
    • Paul Mackerras's avatar
      [PATCH] ppc64: Implement CONFIG_PREEMPT · 23932693
      Paul Mackerras authored
      This implements CONFIG_PREEMPT for ppc64.  Aside from the entry.S
      changes to check the _TIF_NEED_RESCHED bit when returning from an
      exception, there are various changes to make the ppc64-specific code
      preempt-safe, mostly adding preempt_enable/disable or get_cpu/put_cpu
      calls where needed.  I have been using this on my desktop G5 for the
      last week without problems.
      Signed-off-by: default avatarPaul Mackerras <paulus@samba.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
      23932693
  3. 15 Jun, 2004 24 commits
  4. 14 Jun, 2004 4 commits