August 2023 - Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-23.09 0/9] enable memcg qos and memcg async reclaim
by Lu Jialin 30 Aug '23

30 Aug '23

v2->v1: introduce CONFIG_CGROUP_V1_KILL to isolated cgroup.kill in cgroupv1 Lu Jialin (9): memcg: Export memcg.{min/low} from cgroupv2 to cgroupv1 memcg: Export memcg.high from cgroupv2 to cgroupv1 memcg: Export memory.events and memory.events.local from cgroupv2 to cgroupv1 memcg: Fix inconsistent oom event behavior for OOM_MEMCG_KILL cgroup: Export cgroup.kill from cgroupv2 to cgroupv1 memcg: Introduce CONFIG_MEMCG_V1_THRESHOLD_QOS memcg: enable memcg async reclaim memcg: export high_async_ratio to userland cgroup: add config isolation for cgroup_kill in cgroupv1 arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + include/linux/memcontrol.h | 23 +- init/Kconfig | 10 + kernel/cgroup/cgroup-internal.h | 3 + kernel/cgroup/cgroup-v1.c | 7 + kernel/cgroup/cgroup.c | 4 +- mm/memcontrol.c | 382 ++++++++++++++++++------- 8 files changed, 321 insertions(+), 112 deletions(-) -- 2.34.1

2 10

[PATCH openEuler-23.09 0/2] configs: open drivers' config
by Liu Chao 29 Aug '23

29 Aug '23

The number of drivers opened by openEuler is less than other distributions. In order to narrow the gap with other distributions and support more hardware devices, especially various PC hardware commonly used by developers and personal users, more hardware driver modules need to be enabled. Reference:https://gitee.com/openeuler/TC/blob/master/oEEP/oEEP-0006%20openE… Liu Chao (2): configs: aarch64: open drivers' config configs: x86_64: open drivers' config arch/arm64/configs/openeuler_defconfig | 3107 +++++++++++++++++++----- arch/x86/configs/openeuler_defconfig | 2694 ++++++++++++-------- 2 files changed, 4142 insertions(+), 1659 deletions(-) -- 2.33.0

3 4

[PATCH v2 openEuler-23.09 0/8] Backport corelockup from OLK-5.10
by Li Huafei 29 Aug '23

29 Aug '23

v2: - Fix the checkpatch format check. Dong Kai (3): corelockup: Add support of cpu core hang check corelockup: Disable wfi/wfe mode for pmu based nmi corelockup: Add detector enable support by cmdline Li Huafei (1): watchdog/corelockup: Support corelockup on X86_64 Xu Qiang (4): watchdog/corelockup: Optimized core lockup detection judgment rules watchdog/corelockup: Add interface to control the detection sensitivity. watchdog/corelockup: Depends on the hardlockup detection switch config: Open CONFIG_CORELOCKUP_DETECTOR arch/arm64/configs/openeuler_defconfig | 1 + include/linux/nmi.h | 10 ++ kernel/watchdog.c | 45 +++++- kernel/watchdog_hld.c | 198 +++++++++++++++++++++++++ lib/Kconfig.debug | 9 ++ 5 files changed, 261 insertions(+), 2 deletions(-) -- 2.25.1

2 9

[PATCH v3 openEuler-23.09 00/46] ima: Add IMA digest lists extension
by Zhou Shuiqing 29 Aug '23

29 Aug '23

This patchset supports IMA digest lists for the kernel. v2: -remove unused variable in ima_main.c v3: -modify patch header information David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 124 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3299 insertions(+), 218 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

2 47

[PATCH openEuler-23.09 0/8] Backport corelockup from OLK-5.10
by Li Huafei 29 Aug '23

29 Aug '23

Dong Kai (3): corelockup: Add support of cpu core hang check corelockup: Disable wfi/wfe mode for pmu based nmi corelockup: Add detector enable support by cmdline Li Huafei (1): watchdog/corelockup: Support corelockup on X86_64 Xu Qiang (4): watchdog/corelockup: Optimized core lockup detection judgment rules watchdog/corelockup: Add interface to control the detection sensitivity. watchdog/corelockup: Depends on the hardlockup detection switch config: Open CONFIG_CORELOCKUP_DETECTOR arch/arm64/configs/openeuler_defconfig | 1 + include/linux/nmi.h | 10 ++ kernel/watchdog.c | 45 +++++- kernel/watchdog_hld.c | 198 +++++++++++++++++++++++++ lib/Kconfig.debug | 9 ++ 5 files changed, 261 insertions(+), 2 deletions(-) -- 2.25.1

2 9

[PATCH OLK-5.10 00/10] fix CVE-2023-20569
by Jialin Zhang 29 Aug '23

29 Aug '23

New architectural features and CPUID bits related to the Speculative Return Stack Overflow (SRSO) vulnerability. Arnaldo Carvalho de Melo (1): tools headers cpufeatures: Sync with the kernel sources Borislav Petkov (AMD) (7): x86/bugs: Increase the x86 bugs vector size to two u32s x86/srso: Add a Speculative RAS Overflow mitigation x86/srso: Add IBPB_BRTYPE support x86/srso: Add SRSO_NO support x86/srso: Add IBPB x86/srso: Add IBPB on VMEXIT x86/srso: Tie SBPB bit setting to microcode patch detection Josh Poimboeuf (1): x86/srso: Fix return thunks in generated code Kim Phillips (1): x86/cpu, kvm: Add support for CPUID_80000021_EAX Documentation/admin-guide/hw-vuln/index.rst | 1 + Documentation/admin-guide/hw-vuln/srso.rst | 133 +++++++++++++ .../admin-guide/kernel-parameters.txt | 11 ++ arch/x86/Kconfig | 7 + arch/x86/include/asm/cpufeature.h | 7 +- arch/x86/include/asm/cpufeatures.h | 14 +- arch/x86/include/asm/disabled-features.h | 3 +- arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/nospec-branch.h | 18 +- arch/x86/include/asm/processor.h | 2 + arch/x86/include/asm/required-features.h | 3 +- arch/x86/kernel/cpu/amd.c | 19 ++ arch/x86/kernel/cpu/bugs.c | 179 ++++++++++++++++++ arch/x86/kernel/cpu/common.c | 13 +- arch/x86/kernel/vmlinux.lds.S | 32 +++- arch/x86/kvm/cpuid.c | 3 + arch/x86/kvm/cpuid.h | 1 + arch/x86/kvm/svm/svm.c | 4 +- arch/x86/kvm/svm/vmenter.S | 3 + arch/x86/lib/retpoline.S | 81 +++++++- drivers/base/cpu.c | 8 + include/linux/cpu.h | 2 + tools/arch/x86/include/asm/cpufeatures.h | 18 +- tools/objtool/arch/x86/decode.c | 5 +- 24 files changed, 544 insertions(+), 24 deletions(-) create mode 100644 Documentation/admin-guide/hw-vuln/srso.rst -- 2.25.1

2 11

[PTACH openEuler-23.09 v1 00/15] Support Qos scheduler
by Zhang Qiao 29 Aug '23

29 Aug '23

Zhang Qiao (15): sched: Introduce qos scheduler for co-location sched: Throttle qos cfs_rq when current cpu is running online task sched: Fix offline task can't be killed in a timely sched: Unthrottle the throttled cfs rq when offline rq sched: Unthrottle qos cfs rq when free a task group sched: bugfix setscheduler unlock cpuset_rwsem sched: Introduce handle priority reversion mechanism sched: enable CONFIG_QOS_SCHED on arm64 sched: Fix sleeping in atomic context at cpu_qos_write() sched/fair: Add qos_throttle_list node in struct cfs_rq sched: Throttle offline task at tracehook_notify_resume() sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} sched/fair: Update rq clock before unthrottle a qos cfs_rq sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos sched: Enable qos scheduler config arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup.h | 4 + include/linux/resume_user_mode.h | 5 + include/linux/sched.h | 11 + include/linux/sched/sysctl.h | 5 + init/Kconfig | 12 + kernel/cgroup/cgroup.c | 22 ++ kernel/sched/core.c | 155 ++++++++++++ kernel/sched/fair.c | 336 +++++++++++++++++++++++++ kernel/sched/sched.h | 12 + kernel/signal.c | 3 + kernel/sysctl.c | 24 ++ 13 files changed, 591 insertions(+) -- 2.25.1

1 15

[PTACH openEuler-23.09 v1 00/15] Support Qos scheduler
by Zhang Qiao 29 Aug '23

29 Aug '23

Zhang Qiao (15): sched: Introduce qos scheduler for co-location sched: Throttle qos cfs_rq when current cpu is running online task sched: Fix offline task can't be killed in a timely sched: Unthrottle the throttled cfs rq when offline rq sched: Unthrottle qos cfs rq when free a task group sched: bugfix setscheduler unlock cpuset_rwsem sched: Introduce handle priority reversion mechanism sched: enable CONFIG_QOS_SCHED on arm64 sched: Fix sleeping in atomic context at cpu_qos_write() sched/fair: Add qos_throttle_list node in struct cfs_rq sched: Throttle offline task at tracehook_notify_resume() sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} sched/fair: Update rq clock before unthrottle a qos cfs_rq sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos sched: Enable qos scheduler config arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup.h | 4 + include/linux/resume_user_mode.h | 5 + include/linux/sched.h | 11 + include/linux/sched/sysctl.h | 5 + init/Kconfig | 12 + kernel/cgroup/cgroup.c | 22 ++ kernel/sched/core.c | 155 ++++++++++++ kernel/sched/fair.c | 336 +++++++++++++++++++++++++ kernel/sched/sched.h | 12 + kernel/signal.c | 3 + kernel/sysctl.c | 24 ++ 13 files changed, 591 insertions(+) -- 2.25.1

1 15

[PATCH openEuler-1.0-LTS] crypto:hisilicon/sec - modify hw endian config
by Zhang Changzhong 29 Aug '23

29 Aug '23

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4YKLC CVE: NA -------------------------------- When the endian configuration of the hardware is abnormal, it will affect the normal function. Currently the soft configuration method can't restore the faulty device. The endian needs to be configured according to the system properties. So fix it. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> Reviewed-by: Kai Ye <yekai13(a)huawei.com> Reviewed-by: Ling Mingqiang <lingmingqiang(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec_main.c | 36 +++++++----------------- 1 file changed, 10 insertions(+), 26 deletions(-) diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c index 58f726ba022f..a568d5363c1e 100644 --- a/drivers/crypto/hisilicon/sec2/sec_main.c +++ b/drivers/crypto/hisilicon/sec2/sec_main.c @@ -255,33 +255,19 @@ static const struct pci_device_id sec_dev_ids[] = { }; MODULE_DEVICE_TABLE(pci, sec_dev_ids); -static u8 sec_get_endian(struct hisi_qm *qm) +static void sec_set_endian(struct hisi_qm *qm) { u32 reg; - /* - * As for VF, it is a wrong way to get endian setting by - * reading a register of the engine - */ - if (qm->pdev->is_virtfn) { - dev_err_ratelimited(&qm->pdev->dev, - "cannot access a register in VF!\n"); - return SEC_LE; - } - reg = readl_relaxed(qm->io_base + SEC_ENGINE_PF_CFG_OFF + - SEC_ACC_COMMON_REG_OFF + SEC_CONTROL_REG); - - /* BD little endian mode */ - if (!(reg & BIT(0))) - return SEC_LE; + reg = readl_relaxed(SEC_ADDR(qm, SEC_CONTROL_REG)); + reg &= ~(BIT(1) | BIT(0)); + if (IS_ENABLED(CONFIG_64BIT)) + reg |= BIT(1); - /* BD 32-bits big endian mode */ - else if (!(reg & BIT(1))) - return SEC_32BE; + if (IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) + reg |= BIT(0); - /* BD 64-bits big endian mode */ - else - return SEC_64BE; + writel_relaxed(reg, SEC_ADDR(qm, SEC_CONTROL_REG)); } static int sec_engine_init(struct hisi_qm *qm) @@ -331,9 +317,7 @@ static int sec_engine_init(struct hisi_qm *qm) SEC_ADDR(qm, SEC_BD_ERR_CHK_EN_REG3)); /* config endian */ - reg = readl_relaxed(SEC_ADDR(qm, SEC_CONTROL_REG)); - reg |= sec_get_endian(qm); - writel_relaxed(reg, SEC_ADDR(qm, SEC_CONTROL_REG)); + sec_set_endian(qm); return 0; } @@ -813,7 +797,7 @@ static int sec_qm_pre_init(struct hisi_qm *qm, struct pci_dev *pdev) { int ret; - qm->algs = "sec\ncipher\ndigest\naead\n"; + qm->algs = "cipher\ndigest\naead\n"; qm->uacce_mode = uacce_mode; qm->pdev = pdev; ret = hisi_qm_pre_init(qm, pf_q_num, SEC_PF_DEF_Q_BASE); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto:hisilicon/qm - cache write back before flr and poweroff
by Zhang Changzhong 29 Aug '23

29 Aug '23

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4YKIJ CVE: NA -------------------------------- In order to prevent an error when the hardware writes back cache, the driver should write back the hardware cache before flr and poweroff. If vfs is enabled, we should process abnormal scenes of the whole vfs. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> Reviewed-by: Weili Qian <qianweili(a)huawei.com> Reviewed-by: Ling Mingqiang <lingmingqiang(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> --- drivers/crypto/hisilicon/qm.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/drivers/crypto/hisilicon/qm.c b/drivers/crypto/hisilicon/qm.c index 8fa855fd2387..e0fd83465dce 100644 --- a/drivers/crypto/hisilicon/qm.c +++ b/drivers/crypto/hisilicon/qm.c @@ -2772,6 +2772,8 @@ void hisi_qm_dev_shutdown(struct pci_dev *pdev) ret = hisi_qm_stop(qm, QM_NORMAL); if (ret) dev_err(&pdev->dev, "Fail to stop qm in shutdown!\n"); + + hisi_qm_cache_wb(qm); } EXPORT_SYMBOL_GPL(hisi_qm_dev_shutdown); @@ -3718,12 +3720,16 @@ static int qm_vf_reset_prepare(struct pci_dev *pdev, pci_save_state(dev); ret = hisi_qm_stop(qm, stop_reason); - if (ret) - goto prepare_fail; + if (ret) { + hisi_qm_set_hw_reset(qm, + QM_RESET_STOP_TX_OFFSET); + hisi_qm_set_hw_reset(qm, + QM_RESET_STOP_RX_OFFSET); + atomic_set(&qm->status.flags, QM_STOP); + } } } -prepare_fail: mutex_unlock(&qm_list->lock); return ret; } @@ -4117,19 +4123,26 @@ void hisi_qm_reset_prepare(struct pci_dev *pdev) if (qm->vfs_num) { ret = qm_vf_reset_prepare(pdev, qm->qm_list, QM_FLR); - if (ret) { - pci_err(pdev, "Fails to prepare reset!\n"); - return; - } + if (ret) + pci_err(pdev, "Failed to stop vfs!\n"); } ret = hisi_qm_stop(qm, QM_FLR); if (ret) { - pci_err(pdev, "Fails to stop QM!\n"); - return; + pci_err(pdev, "Failed to stop QM!\n"); + goto err_prepare; } + hisi_qm_cache_wb(qm); pci_info(pdev, "FLR resetting...\n"); + return; + +err_prepare: + pci_info(pdev, "FLR resetting prepare failed!\n"); + hisi_qm_set_hw_reset(qm, QM_RESET_STOP_TX_OFFSET); + hisi_qm_set_hw_reset(qm, QM_RESET_STOP_RX_OFFSET); + atomic_set(&qm->status.flags, QM_STOP); + hisi_qm_cache_wb(qm); } EXPORT_SYMBOL_GPL(hisi_qm_reset_prepare); -- 2.34.1

2 1