- Kernel - mailweb.openeuler.org

[PATCH kernel-4.19 000/280] backport linux-4.19.207
by Yang Yingliang 27 Sep '21

27 Sep '21

Adrian Bunk (1): bnx2x: Fix enabling network interfaces without VFs Alexander Tsoy (1): ALSA: usb-audio: Add registration quirk for JBL Quantum 800 Alexei Starovoitov (1): selftests/bpf: fix tests due to const spill/fill Andreas Obergschwandtner (1): ARM: tegra: tamonten: Fix UART pad setting Andrey Grodzovsky (1): drm/amdgpu: Fix BUG_ON assert Andrey Ignatov (5): bpf: Support variable offset stack access from helpers bpf: Reject indirect var_off stack access in raw mode bpf: Reject indirect var_off stack access in unpriv mode bpf: Sanity check max value for var_off stack access selftests/bpf: Test variable offset stack access Andy Duan (1): tty: serial: fsl_lpuart: fix the wrong mapbase value Andy Shevchenko (3): include/linux/list.h: add a macro to test if entry is pointing to the head ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n Anirudh Rayabharam (1): usbip: give back URBs for unsent unlink requests during cleanup Anson Jacob (1): drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex Arne Welzel (1): dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() Austin Kim (1): IMA: remove -Wmissing-prototypes warning Babu Moger (1): x86/resctrl: Fix a maybe-uninitialized build warning treated as error Baptiste Lepers (1): events: Reuse value read using READ_ONCE instead of re-reading it Ben Dooks (1): ARM: 8918/2: only build return_address() if needed Benjamin Hesmans (1): netfilter: socket: icmp6: fix use-after-scope Bob Peterson (1): gfs2: Don't call dlm after protocol is unmounted Chao Yu (2): f2fs: fix to account missing .skipped_gc_rwsem f2fs: fix to unmap pages from userspace process in punch_hole() Chih-Kang Chang (1): mac80211: Fix insufficient headroom issue for AMSDU Christoph Hellwig (2): cryptoloop: add a deprecation warning bcache: add proper error unwinding in bcache_device_init Christophe JAILLET (4): drm/msm/dsi: Fix some reference counted resource leaks usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available staging: ks7010: Fix the initialization of the 'sleep_status' structure mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' Christophe Leroy (1): crypto: talitos - reduce max key size for SEC1 Chunfeng Yun (2): usb: mtu3: use @mult for HS isoc or intr usb: mtu3: fix the wrong HS mult value Chunyan Zhang (1): spi: sprd: Fix the wrong WDG_LOAD_VAL Colin Ian King (4): ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init media: venus: venc: Fix potential null pointer dereference on pointer fmt Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow parport: remove non-zero check on count Damien Le Moal (2): libata: fix ata_host_start() block: bfq: fix bfq_set_next_ioprio_data() Dan Carpenter (4): Bluetooth: sco: prevent information leak in sco_conn_defer_accept() ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() scsi: qedi: Fix error codes in qedi_alloc_global_queues() PCI: Fix pci_dev_str_match_path() alloc while atomic bug Daniel Borkmann (1): bpf: Fix pointer arithmetic mask tightening under state pruning Daniel Thompson (1): backlight: pwm_bl: Improve bootloader/kernel device handover Daniele Palmas (1): net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920 David Heidelberg (2): ARM: 9105/1: atags_to_fdt: don't warn about stack size ARM: dts: qcom: apq8064: correct clock names David Hildenbrand (1): mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range() David Howells (1): fscache: Fix cookie key hashing Desmond Cheong Zhi Xi (4): fcntl: fix potential deadlock for &fasync_struct.fa_lock Bluetooth: fix repeated calls to sco_sock_kill btrfs: reset replace target device to allocation state on close Bluetooth: skip invalid hci_sync_conn_complete_evt Dietmar Eggemann (1): sched/deadline: Fix missing clock update in migrate_task_rq_dl() Ding Hui (1): cifs: fix wrong release in sess_alloc_buffer() failed path Dinghao Liu (1): qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom Dmitry Baryshkov (1): drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Dmitry Osipenko (1): rtc: tps65910: Correct driver module alias Dmitry Torokhov (1): HID: input: do not report stylus battery state as "full" Dongliang Mu (3): media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init media: dvb-usb: fix uninit-value in vp702x_read_mac_addr media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Eric Biggers (4): fscrypt: add fscrypt_symlink_getattr() for computing st_size ext4: report correct st_size for encrypted symlinks f2fs: report correct st_size for encrypted symlinks ubifs: report correct st_size for encrypted symlinks Eric Dumazet (5): ipv4: make exception cache less predictible ipv4: fix endianness issue in inet_rtm_getroute_build_skb() net-caif: avoid user-triggerable WARN_ON(1) net/af_unix: fix a data-race in unix_dgram_poll fq_codel: reject silly quantum parameters Esben Haabendal (1): net: ll_temac: Remove left-over debug message Evan Quan (1): PCI: Add AMD GPU multi-function power dependencies Evgeny Novikov (2): usb: ehci-orion: Handle errors of clk_prepare_enable() in probe media: tegra-cec: Handle errors of clk_prepare_enable() Fangrui Song (1): powerpc/boot: Delete unneeded .globl _zimage_start Florian Fainelli (1): r6040: Restore MDIO clock frequency after MAC reset Geert Uytterhoeven (2): soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally staging: board: Fix uninitialized spinlock when attaching genpd George Cherian (1): PCI: Add ACS quirks for Cavium multi-function devices Giovanni Cabiddu (4): crypto: qat - do not ignore errors from enable_vf2pf_comms() crypto: qat - handle both source of interrupt in VF ISR crypto: qat - do not export adf_iov_putmsg() crypto: qat - use proper type for vf_mask Greg Kroah-Hartman (2): serial: 8250_pci: make setup_port() parameters explicitly unsigned Linux 4.19.207 Guillaume Nault (1): netns: protect netns ID lookups with RCU Gustavo A. R. Silva (2): ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() flow_dissector: Fix out-of-bounds warnings Halil Pasic (1): KVM: s390: index kvm->arch.idle_mask by vcpu_idx Hans Verkuil (1): media: v4l2-dv-timings.c: fix wrong condition in two for-loops Hans de Goede (5): power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output mfd: axp20x: Update AXP288 volatile ranges Harini Katakam (1): net: macb: Add a NULL check on desc_ptp Harshvardhan Jha (1): 9p/xen: Fix end of loop tests for list_for_each_entry Heiko Carstens (1): s390/jump_label: print real address in a case of a jump label bug Hoang Le (1): tipc: increase timeout in tipc_sk_enqueue() Hongbo Li (1): lib/mpi: use kcalloc in mpi_resize Hyun Kwon (1): PCI: xilinx-nwl: Enable the clock through CCF Ilya Leoshkevich (1): s390/bpf: Fix 64-bit subtraction of the -0x80000000 constant Iwona Winiarska (1): soc: aspeed: lpc-ctrl: Fix boundary check for mmap J. Bruce Fields (1): rpc: fix gss_svc_init cleanup on failure Jack Pham (1): usb: gadget: composite: Allow bMaxPower=0 if self-powered Jaehyoung Choi (1): pinctrl: samsung: Fix pinctrl bank pin count Jan Kara (1): udf: Check LVID earlier Jason Gunthorpe (1): vfio: Use config not menuconfig for VFIO_NOIOMMU Jeongtae Park (1): regmap: fix the offset of register error log Jiong Wang (1): bpf: correct slot_type marking logic to allow more stack slot sharing Jiri Slaby (2): xtensa: ISS: don't panic in rs_init hvsi: don't panic on tty_register_driver failure Johan Almbladh (2): bpf/tests: Fix copy-and-paste error in double word test bpf/tests: Do not PASS tests without actually testing the result Jonathan Cameron (1): iio: dac: ad5624r: Fix incorrect handling of an optional regulator. Juergen Gross (3): xen: fix setting of max_pfn in shared_info xen: reset legacy rtc flag for PV domU PM: base: power: don't try to use non-existing RTC for storing data Juhee Kang (1): samples: bpf: Fix tracex7 error raised on the missing argument Kai-Heng Feng (1): Bluetooth: Move shutdown callback before flushing tx and rx queue Kajol Jain (1): powerpc/perf/hv-gpci: Fix counter value parsing Kees Cook (1): staging: rts5208: Fix get_ms_information() heap buffer size Kelly Devilliv (2): usb: host: fotg210: fix the endpoint's transactional opportunities calculation usb: host: fotg210: fix the actual_length of an iso packet Kim Phillips (1): perf/x86/amd/ibs: Work around erratum #1197 Krzysztof Hałasa (3): gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats media: TDA1997x: enable EDID support media: TDA1997x: fix tda1997x_query_dv_timings() return value Krzysztof Kozlowski (2): arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 power: supply: max17042: handle fails of reading status register Krzysztof Wilczyński (1): PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure Laurent Pinchart (1): media: imx258: Rectify mismatch of VTS value Len Baker (1): CIFS: Fix a potencially linear read overflow Leon Romanovsky (2): RDMA/iwcm: Release resources if iw_cm module initialization fails docs: Fix infiniband uverbs minor number Li Zhijian (1): selftests/bpf: Enlarge select() timeout for test_maps Lin, Zhenpeng (1): dccp: don't duplicate ccid when cloning dccp sock Linus Walleij (1): clk: kirkwood: Fix a clocking boot regression Liu Zixian (1): mm/hugetlb: initialize hugetlb_usage in mm_init Lorenz Bauer (1): bpf: verifier: Allocate idmap scratch in verifier env Luiz Augusto von Dentz (1): Bluetooth: Fix handling of LE Enhanced Connection Complete Luke Hsiao (1): tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Maciej W. Rozycki (2): serial: 8250: Define RX trigger levels for OxSemi 950 devices scsi: BusLogic: Fix missing pr_cont() use Maciej Żenczykowski (1): usb: gadget: u_ether: fix a potential null pointer dereference Manish Narani (1): mmc: sdhci-of-arasan: Check return value of non-void funtions Maor Gottlieb (1): net/mlx5: Fix potential sleeping in atomic context Marc Zyngier (2): of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS mfd: Don't use irq_create_mapping() to resolve a mapping Marco Chiappero (2): crypto: qat - fix reuse of completion variable crypto: qat - fix naming for init/shutdown VF to PF notifications Marek Behún (2): PCI: Call Max Payload Size-related fixup quirks early PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported Marek Marczykowski-Górecki (1): PCI/MSI: Skip masking MSI-X on Xen PV Mark Brown (1): arm64/sve: Use correct size when reinitialising SVE state Mark Rutland (1): arm64: head: avoid over-mapping in map_memory Martin KaFai Lau (1): tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Mathias Nyman (1): Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" Mathieu Desnoyers (1): ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2) Mauro Carvalho Chehab (2): media: uvc: don't do DMA on stack media: dib8000: rewrite the init prbs logic Miaoqing Pan (1): ath9k: fix sleeping in atomic context Michael Ellerman (1): powerpc/module64: Fix comment in R_PPC64_ENTRY handling Michael Petlan (1): perf machine: Initialize srcline string member in add_location struct Michal Suchanek (1): powerpc/stacktrace: Include linux/delay.h Mike Rapoport (1): x86/mm: Fix kern_addr_valid() to cope with existing but not present entries Mikulas Patocka (1): parisc: fix crash with signals and alloca Miquel Raynal (1): dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation Nadav Amit (1): userfaultfd: prevent concurrent API initialization Nadezda Lutovinova (2): usb: gadget: mv_u3d: request_irq() after initializing UDC usb: musb: musb_dsps: request_irq() after initializing musb Nathan Chancellor (1): net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() Nguyen Dinh Phi (1): tty: Fix data race between tiocsti() and flush_to_ldisc() Niklas Cassel (2): blk-zoned: allow zone management send operations without CAP_SYS_ADMIN blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN Nishad Kamdar (1): mmc: core: Return correct emmc response in case of ioctl error Oleksij Rempel (1): MIPS: Malta: fix alignment of the devicetree buffer Oliver Upton (1): KVM: arm64: Handle PSCI resets before userspace touches vCPU state Pali Rohár (3): isofs: joliet: Fix iocharset=utf8 mount option PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response PCI: aardvark: Fix masking and unmasking legacy INTx interrupts Paolo Valente (1): block, bfq: honor already-setup queue merges Patryk Duda (1): platform/chrome: cros_ec_proto: Send command again when timeout occurs Paul Gortmaker (1): x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions Pavel Skripkin (5): media: stkwebcam: fix memory leak in stk_camera_probe m68k: emu: Fix invalid free in nfeth_cleanup() media: go7007: remove redundant initialization net: cipso: fix warnings in netlbl_cipsov4_add_std Bluetooth: add timeout sanity check to hci_inquiry Peter Zijlstra (1): locking/mutex: Fix HANDOFF condition Phong Hoang (1): clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel Pratik R. Sampat (1): cpufreq: powernv: Fix init_chip_info initialization in numa=off Qu Wenruo (1): Revert "btrfs: compression: don't try to compress if we don't have enough pages" Quentin Perret (1): sched/deadline: Fix reset_on_fork reporting of DL tasks Rafael J. Wysocki (3): PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently PCI: PM: Enable PME if it can be signaled from D3cold PCI: Use pci_update_current_state() in pci_enable_device_flags() Rafał Miłecki (1): net: dsa: b53: Fix calculating number of switch ports Randy Dunlap (4): xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG openrisc: don't printk() unconditionally ptp: dp83640: don't define PAGE0 ARC: export clear_user_page() for modules Rolf Eike Beer (1): tools/thermal/tmon: Add cross compiling support Saurav Kashyap (1): scsi: qla2xxx: Sync queue idx with queue_pair_map idx Sean Anderson (2): crypto: mxs-dcp - Check for DMA mapping errors crypto: mxs-dcp - Use sg_mapping_iter to copy data Sean Young (1): media: rc-loopback: return number of emitters rather than error Sebastian Krzyszkowiak (1): power: supply: max17042_battery: fix typo in MAx17042_TOFF Sebastian Reichel (1): ARM: dts: imx53-ppd: Fix ACHC entry Sergey Shtylyov (9): i2c: highlander: add IRQ check usb: gadget: udc: at91: add IRQ check usb: phy: fsl-usb: add IRQ check usb: phy: twl6030: add IRQ checks usb: host: ohci-tmio: add IRQ check usb: phy: tahvo: add IRQ check i2c: iop3xx: fix deferred probing i2c: s3c2410: fix IRQ check i2c: mt65xx: fix IRQ check Shai Malin (3): qed: Fix the VF msix vectors flow qede: Fix memset corruption qed: Handle management FW error Shuah Khan (1): usbip:vhci_hcd USB port can get stuck in the disabled state Stefan Berger (1): certs: Trigger creation of RSA module signing key if it's not an RSA key Stefan Wahren (1): net: qualcomm: fix QCA7000 checksum handling Stephan Gerhold (1): soc: qcom: smsm: Fix missed interrupts if state changes while masked Stian Skjelstad (1): udf_get_extendedattr() had no boundary checks. Sugar Zhang (1): ASoC: rockchip: i2s: Fix regmap_ops hang Sukadev Bhattiprolu (1): ibmvnic: check failover_pending in login response THOBY Simon (1): IMA: remove the dependency on CRYPTO_MD5 Tetsuo Handa (1): fbmem: don't allow too huge resolutions Thomas Gleixner (1): hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Thomas Hebb (1): mmc: rtsx_pci: Fix long reads when clock is prescaled Tianjia Zhang (1): Smack: Fix wrong semantics in smk_access_entry() Tom Rix (1): USB: serial: mos7720: improve OOM-handling in read_mos_reg() Tony Lindgren (5): crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config spi: spi-pic32: Fix issue with uninitialized dma_slave_config mmc: dw_mmc: Fix issue with uninitialized dma_slave_config mmc: moxart: Fix issue with uninitialized dma_slave_config Tuo Li (1): gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() Ulrich Hecht (1): serial: sh-sci: fix break handling for sysrq Umang Jain (1): media: imx258: Limit the max analogue gain to 480 Vineeth Vijayan (1): s390/cio: add dev_busid sysfs entry for each subchannel Vinod Koul (1): arm64: dts: qcom: sdm660: use reg value for memory node Vladimir Oltean (1): net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup Wang Hai (1): VMCI: fix NULL pointer dereference when unmapping queue pair Willem de Bruijn (1): ip_gre: validate csum_start only on pull Xiaotan Luo (1): ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B Xiaoyao Li (1): perf/x86/intel/pt: Fix mask of num_address_ranges Xin Long (2): tipc: keep the skb in rcv queue until the whole data is read tipc: fix an use-after-free issue in tipc_recvmsg Xiyu Yang (2): net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed net/l2tp: Fix reference count leak in l2tp_udp_recv_core Yajun Deng (1): netlink: Deal with ESRCH error in nlmsg_notify() Yang Li (2): ethtool: Fix an error code in cxgb2.c NTB: perf: Fix an error code in perf_setup_inbuf() Yang Yingliang (2): ARM: imx: add missing clk_disable_unprepare() net: w5100: check return value after calling platform_get_resource() Yoshihiro Shimoda (2): usb: host: xhci-rcar: Don't reload firmware after the completion net: renesas: sh_eth: Fix freeing wrong tx descriptor Yufeng Mo (1): bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() Zekun Shen (1): ath9k: fix OOB read ar9300_eeprom_restore_internal Zelin Deng (1): KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted Zenghui Yu (1): bcma: Fix memory leak for internally-handled cores Zhen Lei (1): pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry() Zheyu Ma (5): video: fbdev: kyro: fix a DoS bug by restricting user input tty: serial: jsm: hold port lock when reporting modem line changes video: fbdev: asiliantfb: Error out if 'pixclock' equals zero video: fbdev: kyro: Error out if 'pixclock' equals zero video: fbdev: riva: Error out if 'pixclock' equals zero Zubin Mithra (1): ALSA: pcm: fix divide error in snd_pcm_lib_ioctl chenying (1): ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup() zhenggy (1): tcp: fix tp->undo_retrans accounting in tcp_sacktag_one() zhenwei pi (1): crypto: public_key: fix overflow during implicit conversion 王贇 (1): net: fix NULL pointer reference in cipso_v4_doi_free Documentation/admin-guide/devices.txt | 6 +- .../devicetree/bindings/mtd/gpmc-nand.txt | 2 +- Makefile | 2 +- arch/arc/mm/cache.c | 2 +- arch/arm/boot/compressed/Makefile | 2 + arch/arm/boot/dts/imx53-ppd.dts | 23 ++- arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +- arch/arm/kernel/Makefile | 6 +- arch/arm/kernel/return_address.c | 4 - arch/arm/mach-imx/mmdc.c | 14 +- arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +- arch/arm64/include/asm/kernel-pgtable.h | 4 +- arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kernel/head.S | 11 +- arch/m68k/emu/nfeth.c | 4 +- arch/mips/mti-malta/malta-dtshim.c | 2 +- arch/openrisc/kernel/entry.S | 2 + arch/parisc/kernel/signal.c | 6 + arch/powerpc/boot/crt0.S | 3 - arch/powerpc/kernel/module_64.c | 2 +- arch/powerpc/kernel/stacktrace.c | 1 + arch/powerpc/perf/hv-gpci.c | 2 +- arch/s390/kernel/jump_label.c | 2 +- arch/s390/kvm/interrupt.c | 4 +- arch/s390/kvm/kvm-s390.h | 2 +- arch/s390/net/bpf_jit_comp.c | 9 +- arch/x86/events/amd/ibs.c | 8 + arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/cpu/intel_rdt_monitor.c | 6 + arch/x86/kernel/reboot.c | 3 +- arch/x86/kvm/x86.c | 4 + arch/x86/mm/init_64.c | 6 +- arch/x86/xen/enlighten_pv.c | 7 + arch/x86/xen/p2m.c | 4 +- arch/xtensa/Kconfig | 2 +- arch/xtensa/platforms/iss/console.c | 17 +- block/bfq-iosched.c | 18 +- block/blk-zoned.c | 6 - certs/Makefile | 8 + drivers/ata/libata-core.c | 6 +- drivers/ata/sata_dwc_460ex.c | 12 +- drivers/base/power/trace.c | 10 + drivers/base/regmap/regmap.c | 2 +- drivers/bcma/main.c | 6 +- drivers/block/Kconfig | 4 +- drivers/block/cryptoloop.c | 2 + drivers/clk/mvebu/kirkwood.c | 1 + drivers/clocksource/sh_cmt.c | 30 +-- drivers/cpufreq/powernv-cpufreq.c | 16 +- drivers/crypto/mxs-dcp.c | 81 ++++---- drivers/crypto/omap-sham.c | 2 +- .../qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 +- .../qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 +- .../crypto/qat/qat_common/adf_common_drv.h | 8 +- drivers/crypto/qat/qat_common/adf_init.c | 5 +- drivers/crypto/qat/qat_common/adf_isr.c | 7 +- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 3 +- drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 +- drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 +- .../qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 +- drivers/crypto/talitos.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 16 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 +- drivers/gpu/drm/msm/dsi/dsi.c | 6 +- drivers/gpu/ipu-v3/ipu-cpmem.c | 30 +-- drivers/hid/hid-input.c | 2 - drivers/i2c/busses/i2c-highlander.c | 2 +- drivers/i2c/busses/i2c-iop3xx.c | 6 +- drivers/i2c/busses/i2c-mt65xx.c | 2 +- drivers/i2c/busses/i2c-s3c2410.c | 2 +- drivers/iio/dac/ad5624r_spi.c | 18 +- drivers/infiniband/core/iwcm.c | 19 +- drivers/md/bcache/super.c | 16 +- drivers/md/dm-crypt.c | 7 +- drivers/media/dvb-frontends/dib8000.c | 58 ++++-- drivers/media/i2c/imx258.c | 4 +- drivers/media/i2c/tda1997x.c | 6 +- drivers/media/platform/qcom/venus/venc.c | 2 + drivers/media/platform/tegra-cec/tegra_cec.c | 10 +- drivers/media/rc/rc-loopback.c | 2 +- drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 +- drivers/media/usb/dvb-usb/vp702x.c | 12 +- drivers/media/usb/em28xx/em28xx-input.c | 1 - drivers/media/usb/go7007/go7007-driver.c | 26 --- drivers/media/usb/stkwebcam/stk-webcam.c | 6 +- drivers/media/usb/uvc/uvc_v4l2.c | 34 ++-- drivers/media/v4l2-core/v4l2-dv-timings.c | 4 +- drivers/mfd/ab8500-core.c | 2 +- drivers/mfd/axp20x.c | 3 +- drivers/mfd/stmpe.c | 4 +- drivers/mfd/tc3589x.c | 2 +- drivers/mfd/wm8994-irq.c | 2 +- drivers/misc/aspeed-lpc-ctrl.c | 2 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/block.c | 3 +- drivers/mmc/host/dw_mmc.c | 1 + drivers/mmc/host/moxart-mmc.c | 1 + drivers/mmc/host/rtsx_pci_sdmmc.c | 36 ++-- drivers/mmc/host/sdhci-of-arasan.c | 18 +- drivers/mtd/nand/raw/cafe_nand.c | 4 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/dsa/b53/b53_common.c | 3 +- .../net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 2 +- drivers/net/ethernet/cadence/macb_ptp.c | 11 +- drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 + drivers/net/ethernet/ibm/ibmvnic.c | 8 + .../net/ethernet/mellanox/mlx5/core/fs_core.c | 5 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 7 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 6 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- .../net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 - drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/rdc/r6040.c | 9 +- drivers/net/ethernet/renesas/sh_eth.c | 1 + .../ethernet/stmicro/stmmac/dwmac-ipq806x.c | 18 +- drivers/net/ethernet/wiznet/w5100.c | 2 + drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +- drivers/net/phy/dp83640_reg.h | 2 +- drivers/net/usb/cdc_mbim.c | 5 + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +- .../net/wireless/ath/ath9k/ar9003_eeprom.c | 3 +- drivers/net/wireless/ath/ath9k/hw.c | 12 +- drivers/ntb/test/ntb_perf.c | 1 + drivers/of/kobj.c | 2 +- drivers/parport/ieee1284_ops.c | 2 +- drivers/pci/controller/pci-aardvark.c | 11 +- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++ drivers/pci/msi.c | 3 + drivers/pci/pci.c | 33 ++-- drivers/pci/quirks.c | 26 ++- drivers/pci/syscall.c | 4 +- drivers/pinctrl/pinctrl-single.c | 1 + drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 9 + drivers/platform/x86/dell-smbios-wmi.c | 1 + drivers/power/supply/axp288_fuel_gauge.c | 4 +- drivers/power/supply/max17042_battery.c | 8 +- drivers/rtc/rtc-tps65910.c | 2 +- drivers/s390/cio/css.c | 17 ++ drivers/scsi/BusLogic.c | 4 +- drivers/scsi/qedi/qedi_main.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 5 +- drivers/soc/qcom/smsm.c | 11 +- drivers/soc/rockchip/Kconfig | 4 +- drivers/spi/spi-fsl-dspi.c | 1 + drivers/spi/spi-pic32.c | 1 + drivers/spi/spi-sprd-adi.c | 2 +- drivers/staging/board/board.c | 7 +- drivers/staging/ks7010/ks7010_sdio.c | 2 +- drivers/staging/rts5208/rtsx_scsi.c | 10 +- drivers/tty/hvc/hvsi.c | 19 +- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/serial/fsl_lpuart.c | 2 +- drivers/tty/serial/jsm/jsm_neo.c | 2 + drivers/tty/serial/jsm/jsm_tty.c | 3 + drivers/tty/serial/sh-sci.c | 7 +- drivers/tty/tty_io.c | 4 +- drivers/usb/gadget/composite.c | 8 +- drivers/usb/gadget/function/u_ether.c | 5 +- drivers/usb/gadget/udc/at91_udc.c | 4 +- drivers/usb/gadget/udc/bdc/bdc_core.c | 3 +- drivers/usb/gadget/udc/mv_u3d_core.c | 19 +- drivers/usb/host/ehci-orion.c | 8 +- drivers/usb/host/fotg210-hcd.c | 41 ++-- drivers/usb/host/fotg210.h | 5 - drivers/usb/host/ohci-tmio.c | 3 + drivers/usb/host/xhci-rcar.c | 7 + drivers/usb/host/xhci.c | 24 +-- drivers/usb/mtu3/mtu3_gadget.c | 6 +- drivers/usb/musb/musb_dsps.c | 13 +- drivers/usb/phy/phy-fsl-usb.c | 2 + drivers/usb/phy/phy-tahvo.c | 4 +- drivers/usb/phy/phy-twl6030-usb.c | 5 + drivers/usb/serial/mos7720.c | 4 +- drivers/usb/usbip/vhci_hcd.c | 32 +++- drivers/vfio/Kconfig | 2 +- drivers/video/backlight/pwm_bl.c | 54 +++--- drivers/video/fbdev/asiliantfb.c | 3 + drivers/video/fbdev/core/fbmem.c | 6 + drivers/video/fbdev/kyro/fbdev.c | 8 + drivers/video/fbdev/riva/fbdev.c | 3 + fs/btrfs/inode.c | 2 +- fs/btrfs/volumes.c | 3 + fs/cifs/cifs_unicode.c | 9 +- fs/cifs/sess.c | 2 +- fs/crypto/hooks.c | 44 +++++ fs/ext4/symlink.c | 11 +- fs/f2fs/file.c | 4 +- fs/f2fs/gc.c | 4 +- fs/f2fs/namei.c | 11 +- fs/fcntl.c | 5 +- fs/fscache/cookie.c | 14 +- fs/fscache/internal.h | 2 + fs/fscache/main.c | 39 ++++ fs/gfs2/lock_dlm.c | 5 + fs/isofs/inode.c | 27 ++- fs/isofs/isofs.h | 1 - fs/isofs/joliet.c | 4 +- fs/overlayfs/dir.c | 6 +- fs/ubifs/file.c | 12 +- fs/udf/misc.c | 13 +- fs/udf/super.c | 25 ++- fs/userfaultfd.c | 93 +++++----- include/crypto/public_key.h | 4 +- include/linux/bpf_verifier.h | 9 + include/linux/fscrypt_notsupp.h | 6 + include/linux/fscrypt_supp.h | 1 + include/linux/hugetlb.h | 9 + include/linux/list.h | 29 ++- include/linux/memory_hotplug.h | 4 +- include/linux/pci.h | 5 +- include/linux/power/max17042_battery.h | 2 +- include/linux/skbuff.h | 2 +- include/uapi/linux/pkt_sched.h | 2 + include/uapi/linux/serial_reg.h | 1 + kernel/bpf/verifier.c | 175 ++++++++++++------ kernel/events/core.c | 2 +- kernel/fork.c | 1 + kernel/locking/mutex.c | 15 +- kernel/sched/deadline.c | 8 +- kernel/sched/sched.h | 2 + kernel/time/hrtimer.c | 60 +++++- lib/mpi/mpiutil.c | 2 +- lib/test_bpf.c | 13 +- mm/memory_hotplug.c | 4 +- net/9p/trans_xen.c | 4 +- net/bluetooth/cmtp/cmtp.h | 2 +- net/bluetooth/hci_core.c | 14 ++ net/bluetooth/hci_event.c | 108 +++++++---- net/bluetooth/sco.c | 11 +- net/caif/chnl_net.c | 19 +- net/core/flow_dissector.c | 12 +- net/core/net_namespace.c | 18 +- net/dccp/minisocks.c | 2 + net/dsa/slave.c | 12 +- net/ipv4/icmp.c | 23 ++- net/ipv4/ip_gre.c | 9 +- net/ipv4/ip_output.c | 5 +- net/ipv4/route.c | 48 +++-- net/ipv4/tcp_fastopen.c | 3 +- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/netfilter/nf_socket_ipv6.c | 4 +- net/l2tp/l2tp_core.c | 4 +- net/mac80211/tx.c | 4 +- net/netlabel/netlabel_cipso_v4.c | 12 +- net/netlink/af_netlink.c | 4 +- net/sched/sch_cbq.c | 2 +- net/sched/sch_fq_codel.c | 12 +- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- net/tipc/socket.c | 36 +++- net/unix/af_unix.c | 2 +- samples/bpf/test_override_return.sh | 1 + samples/bpf/tracex7_user.c | 5 + security/integrity/ima/Kconfig | 1 - security/integrity/ima/ima_mok.c | 2 +- security/smack/smack_access.c | 17 +- sound/core/pcm_lib.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 9 +- sound/soc/rockchip/rockchip_i2s.c | 35 ++-- sound/usb/quirks.c | 1 + tools/perf/util/machine.c | 1 + tools/testing/selftests/bpf/test_maps.c | 2 +- tools/testing/selftests/bpf/test_verifier.c | 144 ++++++++++++-- tools/thermal/tmon/Makefile | 2 +- virt/kvm/arm/arm.c | 8 + 272 files changed, 1866 insertions(+), 915 deletions(-) -- 2.25.1

1 280

[PATCH openEuler-1.0-LTS v2 0/9] ascend inclusion mpam feature
by Wang Xingang 27 Sep '21

27 Sep '21

From: Xingang Wang <wangxingang5(a)huawei.com> v1->v2: - fix bugs and review suggestions, add result check when update rmid This series patches introduce mpam feature for ascend: - 1. The mpam driver resctrlfs need to add write interface for rmid, so that the rmid can be configured from userspace. - 2. Add support to configure SMMU mpam from svm. bugzilla: https://gitee.com/openeuler/kernel/issues/I49RB2 Xingang Wang (9): iommu/arm-smmu-v3: Add support to configure mpam in STE/CD context iommu/arm-smmu-v3: Add support to get SMMU mpam configuration iommu/arm-smmu-v3: Add support to enable/disable SMMU user_mpam_en svm: Add support to get svm mpam configuration svm: Add support to set svm mpam configuration svm: Add svm_set_user_mpam_en to enable/disable mpam for smmu mpam: enable rdt_mon_capable for mbw monitor mpam: Add support for group rmid modify mpam: update monitor rmid and group configuration arch/arm64/kernel/mpam/mpam_ctrlmon.c | 33 ++-- arch/arm64/kernel/mpam/mpam_resctrl.c | 138 +++++++++++++- arch/arm64/kernel/mpam/mpam_setup.c | 1 + drivers/char/svm.c | 228 ++++++++++++++++++++++ drivers/iommu/arm-smmu-v3-context.c | 42 ++++ drivers/iommu/arm-smmu-v3.c | 265 ++++++++++++++++++++++++++ include/linux/ascend_smmu.h | 21 ++ 7 files changed, 709 insertions(+), 19 deletions(-) create mode 100644 include/linux/ascend_smmu.h -- 2.19.1

2 10

[PATCH kernel-4.19 1/4] block: fix race between adding/removing rq qos and normal IO
by Yang Yingliang 27 Sep '21

27 Sep '21

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v5.14 commit 2cafe29a8d03f02a3d16193bdaae2f3e82a423f9 category: bugfix bugzilla: 182135 CVE: NA ------------------------------------------------- Yi reported several kernel panics on: [16687.001777] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... [16687.163549] pc : __rq_qos_track+0x38/0x60 or [ 997.690455] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... [ 997.850347] pc : __rq_qos_done+0x2c/0x50 Turns out it is caused by race between adding rq qos(wbt) and normal IO because rq_qos_add can be run when IO is being submitted, fix this issue by freezing queue before adding/deleting rq qos to queue. rq_qos_exit() needn't to freeze queue because it is called after queue has been frozen. iolatency calls rq_qos_add() during allocating queue, so freezing won't add delay because queue usage refcount works at atomic mode at that time. iocost calls rq_qos_add() when writing cgroup attribute file, that is fine to freeze queue at that time since we usually freeze queue when storing to queue sysfs attribute, meantime iocost only exists on the root cgroup. wbt_init calls it in blk_register_queue() and queue sysfs attribute store(queue_wb_lat_store() when write it 1st time in case of !BLK_WBT_MQ), the following patch will speedup the queue freezing in wbt_init. Reported-by: Yi Zhang <yi.zhang(a)redhat.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Tested-by: Yi Zhang <yi.zhang(a)redhat.com> Link: https://lore.kernel.org/r/20210609015822.103433-2-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/blk-rq-qos.h Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-rq-qos.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h index efb3e5430ce3c..7c36442ba7f7f 100644 --- a/block/blk-rq-qos.h +++ b/block/blk-rq-qos.h @@ -6,6 +6,7 @@ #include <linux/blk_types.h> #include <linux/atomic.h> #include <linux/wait.h> +#include <linux/blk-mq.h> enum rq_qos_id { RQ_QOS_WBT, @@ -77,20 +78,43 @@ static inline void rq_wait_init(struct rq_wait *rq_wait) static inline void rq_qos_add(struct request_queue *q, struct rq_qos *rqos) { + /* + * No IO can be in-flight when adding rqos, so freeze queue, which + * is fine since we only support rq_qos for blk-mq queue. + * + * Reuse ->queue_lock for protecting against other concurrent + * rq_qos adding/deleting + */ + blk_mq_freeze_queue(q); + + spin_lock_irq(q->queue_lock); rqos->next = q->rq_qos; q->rq_qos = rqos; + spin_unlock_irq(q->queue_lock); + + blk_mq_unfreeze_queue(q); } static inline void rq_qos_del(struct request_queue *q, struct rq_qos *rqos) { struct rq_qos **cur; + /* + * See comment in rq_qos_add() about freezing queue & using + * ->queue_lock. + */ + blk_mq_freeze_queue(q); + + spin_lock_irq(q->queue_lock); for (cur = &q->rq_qos; *cur; cur = &(*cur)->next) { if (*cur == rqos) { *cur = rqos->next; break; } } + spin_unlock_irq(q->queue_lock); + + blk_mq_unfreeze_queue(q); } bool rq_wait_inc_below(struct rq_wait *rq_wait, unsigned int limit); -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] pid: fix imbalanced calling of cgroup_threadgroup_change_begin/end()
by Yang Yingliang 26 Sep '21

26 Sep '21

hulk inclusion category: bugfix bugzilla: 182255 CVE: NA ------------------------------------------------- cgroup_threadgroup_change_begin() is called after allocating futex_exit_mutex, cgroup_threadgroup_change_end() don't need be called on error path of allocating futex_exit_mutex. Fixes: 04d0e96b230ac ("futex: sched: fix kabi broken in task_struct") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index adc8fc99246fb..e17aaa526c593 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2176,10 +2176,10 @@ static __latent_entropy struct task_struct *copy_process( write_unlock_irq(&tasklist_lock); cgroup_cancel_fork(p); bad_fork_free_futex_mutex: + cgroup_threadgroup_change_end(current); kfree(p->futex_exit_mutex); p->futex_exit_mutex = NULL; bad_fork_free_pid: - cgroup_threadgroup_change_end(current); if (pid != &init_struct_pid) free_pid(pid); bad_fork_cleanup_thread: -- 2.25.1

1 0

[PATCH kernel_4.19 v2 01/30] delayacct: track delays from thrashing cache pages
by Liu Xinpeng 26 Sep '21

26 Sep '21

mainline inclusion from mainline-v5.4 commit b1d29ba82cf2bc784f4c963ddd6a2cf29e229b33 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I47QS2 CVE: NA -------------------------------- Delay accounting already measures the time a task spends in direct reclaim and waiting for swapin, but in low memory situations tasks spend can spend a significant amount of their time waiting on thrashing page cache. This isn't tracked right now. To know the full impact of memory contention on an individual task, measure the delay when waiting for a recently evicted active cache page to read back into memory. Also update tools/accounting/getdelays.c: [hannes@computer accounting]$ sudo ./getdelays -d -p 1 print delayacct stats ON PID 1 CPU count real total virtual total delay total delay average 50318 745000000 847346785 400533713 0.008ms IO count delay total delay average 435 122601218 0ms SWAP count delay total delay average 0 0 0ms RECLAIM count delay total delay average 0 0 0ms THRASHING count delay total delay average 19 12621439 0ms Link: http://lkml.kernel.org/r/20180828172258.3185-4-hannes@cmpxchg.org Signed-off-by: Johannes Weiner <hannes(a)cmpxchg.org> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Daniel Drake <drake(a)endlessm.com> Tested-by: Suren Baghdasaryan <surenb(a)google.com> Cc: Christopher Lameter <cl(a)linux.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Johannes Weiner <jweiner(a)fb.com> Cc: Mike Galbraith <efault(a)gmx.de> Cc: Peter Enderborg <peter.enderborg(a)sony.com> Cc: Randy Dunlap <rdunlap(a)infradead.org> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: Vinayak Menon <vinmenon(a)codeaurora.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Xinpeng <liuxp11(a)chinatelecom.cn> Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> --- include/linux/delayacct.h | 23 +++++++++++++++++++++++ include/uapi/linux/taskstats.h | 6 +++++- kernel/delayacct.c | 15 +++++++++++++++ mm/filemap.c | 11 +++++++++++ tools/accounting/getdelays.c | 8 +++++++- 5 files changed, 61 insertions(+), 2 deletions(-) diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h index 31c865d..577d1b2 100644 --- a/include/linux/delayacct.h +++ b/include/linux/delayacct.h @@ -57,7 +57,12 @@ struct task_delay_info { u64 freepages_start; u64 freepages_delay; /* wait for memory reclaim */ + + u64 thrashing_start; + u64 thrashing_delay; /* wait for thrashing page */ + u32 freepages_count; /* total count of memory reclaim */ + u32 thrashing_count; /* total count of thrash waits */ }; #endif @@ -76,6 +81,8 @@ struct task_delay_info { extern __u64 __delayacct_blkio_ticks(struct task_struct *); extern void __delayacct_freepages_start(void); extern void __delayacct_freepages_end(void); +extern void __delayacct_thrashing_start(void); +extern void __delayacct_thrashing_end(void); static inline int delayacct_is_task_waiting_on_io(struct task_struct *p) { @@ -156,6 +163,18 @@ static inline void delayacct_freepages_end(void) __delayacct_freepages_end(); } +static inline void delayacct_thrashing_start(void) +{ + if (current->delays) + __delayacct_thrashing_start(); +} + +static inline void delayacct_thrashing_end(void) +{ + if (current->delays) + __delayacct_thrashing_end(); +} + #else static inline void delayacct_set_flag(int flag) {} @@ -182,6 +201,10 @@ static inline void delayacct_freepages_start(void) {} static inline void delayacct_freepages_end(void) {} +static inline void delayacct_thrashing_start(void) +{} +static inline void delayacct_thrashing_end(void) +{} #endif /* CONFIG_TASK_DELAY_ACCT */ diff --git a/include/uapi/linux/taskstats.h b/include/uapi/linux/taskstats.h index b7aa7bb..5e8ca16 100644 --- a/include/uapi/linux/taskstats.h +++ b/include/uapi/linux/taskstats.h @@ -34,7 +34,7 @@ */ -#define TASKSTATS_VERSION 8 +#define TASKSTATS_VERSION 9 #define TS_COMM_LEN 32 /* should be >= TASK_COMM_LEN * in linux/sched.h */ @@ -164,6 +164,10 @@ struct taskstats { /* Delay waiting for memory reclaim */ __u64 freepages_count; __u64 freepages_delay_total; + + /* Delay waiting for thrashing page */ + __u64 thrashing_count; + __u64 thrashing_delay_total; }; diff --git a/kernel/delayacct.c b/kernel/delayacct.c index ca8ac28..2a12b98 100644 --- a/kernel/delayacct.c +++ b/kernel/delayacct.c @@ -135,9 +135,12 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk) d->swapin_delay_total = (tmp < d->swapin_delay_total) ? 0 : tmp; tmp = d->freepages_delay_total + tsk->delays->freepages_delay; d->freepages_delay_total = (tmp < d->freepages_delay_total) ? 0 : tmp; + tmp = d->thrashing_delay_total + tsk->delays->thrashing_delay; + d->thrashing_delay_total = (tmp < d->thrashing_delay_total) ? 0 : tmp; d->blkio_count += tsk->delays->blkio_count; d->swapin_count += tsk->delays->swapin_count; d->freepages_count += tsk->delays->freepages_count; + d->thrashing_count += tsk->delays->thrashing_count; raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); return 0; @@ -169,3 +172,15 @@ void __delayacct_freepages_end(void) &current->delays->freepages_count); } +void __delayacct_thrashing_start(void) +{ + current->delays->thrashing_start = ktime_get_ns(); +} + +void __delayacct_thrashing_end(void) +{ + delayacct_end(&current->delays->lock, + &current->delays->thrashing_start, + &current->delays->thrashing_delay, + &current->delays->thrashing_count); +} diff --git a/mm/filemap.c b/mm/filemap.c index 4cf4b09..6c964d8 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -36,6 +36,7 @@ #include <linux/cleancache.h> #include <linux/shmem_fs.h> #include <linux/rmap.h> +#include <linux/delayacct.h> #include "internal.h" #define CREATE_TRACE_POINTS @@ -1183,8 +1184,15 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q, { struct wait_page_queue wait_page; wait_queue_entry_t *wait = &wait_page.wait; + bool thrashing = false; int ret = 0; + if (bit_nr == PG_locked && !PageSwapBacked(page) && + !PageUptodate(page) && PageWorkingset(page)) { + delayacct_thrashing_start(); + thrashing = true; + } + init_wait(wait); wait->flags = lock ? WQ_FLAG_EXCLUSIVE : 0; wait->func = wake_page_function; @@ -1223,6 +1231,9 @@ static inline int wait_on_page_bit_common(wait_queue_head_t *q, finish_wait(q, wait); + if (thrashing) + delayacct_thrashing_end(); + /* * A signal could leave PageWaiters set. Clearing it here if * !waitqueue_active would be possible (by open-coding finish_wait), diff --git a/tools/accounting/getdelays.c b/tools/accounting/getdelays.c index 6bf6a20..5ef1c15 100644 --- a/tools/accounting/getdelays.c +++ b/tools/accounting/getdelays.c @@ -203,6 +203,8 @@ static void print_delayacct(struct taskstats *t) "SWAP %15s%15s%15s\n" " %15llu%15llu%15llums\n" "RECLAIM %12s%15s%15s\n" + " %15llu%15llu%15llums\n" + "THRASHING%12s%15s%15s\n" " %15llu%15llu%15llums\n", "count", "real total", "virtual total", "delay total", "delay average", @@ -222,7 +224,11 @@ static void print_delayacct(struct taskstats *t) "count", "delay total", "delay average", (unsigned long long)t->freepages_count, (unsigned long long)t->freepages_delay_total, - average_ms(t->freepages_delay_total, t->freepages_count)); + average_ms(t->freepages_delay_total, t->freepages_count), + "count", "delay total", "delay average", + (unsigned long long)t->thrashing_count, + (unsigned long long)t->thrashing_delay_total, + average_ms(t->thrashing_delay_total, t->thrashing_count)); } static void task_context_switch_counts(struct taskstats *t) -- 1.8.3.1

3 30

[PATCH v3 OLK-5.10 0/2] spraid: support Ramaxel raid controller
by Yanling Song 24 Sep '21

24 Sep '21

Support Ramaxel raid controller Changes since v2: - Improve IO error handling - Add new functions to get controller's information: firmware version, the ability of chip - Support pass through command of admin Changes since v1: - Add "OLK-5.10" to subject - Add commit header into commit message - Add CONFIG_RAMAXEL_SPRAID in defconfig Yanling Song (2): spraid: support Ramaxel raid controller spraid: Add CONFIG_RAMAXEL_SPRAID in defconfig of arch arm64 and x86 arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/Kconfig | 1 + drivers/scsi/Makefile | 1 + drivers/scsi/spraid/Kconfig | 11 + drivers/scsi/spraid/Makefile | 7 + drivers/scsi/spraid/spraid.h | 655 +++++ drivers/scsi/spraid/spraid_main.c | 3616 ++++++++++++++++++++++++ 8 files changed, 4293 insertions(+) create mode 100644 drivers/scsi/spraid/Kconfig create mode 100644 drivers/scsi/spraid/Makefile create mode 100644 drivers/scsi/spraid/spraid.h create mode 100644 drivers/scsi/spraid/spraid_main.c -- 2.17.1

1 2

[PATCH openEuler-1.0-LTS] pid: fix return value when copy_process() failed
by Yang Yingliang 24 Sep '21

24 Sep '21

hulk inclusion category: bugfix bugzilla: 182255 CVE: NA ------------------------------------------------- When allocating futex_exit_mutex fails in copy_process(), it needs return an error code, or it will lead a null-ptr-deref when it's used in get_task_pid(). Fixes: 04d0e96b230ac ("futex: sched: fix kabi broken in task_struct") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/fork.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/fork.c b/kernel/fork.c index b4fee9799c153..adc8fc99246fb 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2000,8 +2000,10 @@ static __latent_entropy struct task_struct *copy_process( #endif futex_init_task(p); p->futex_exit_mutex = kmalloc(sizeof(struct mutex), GFP_KERNEL); - if (!p->futex_exit_mutex) + if (!p->futex_exit_mutex) { + retval = -ENOMEM; goto bad_fork_free_pid; + } mutex_init(p->futex_exit_mutex); /* -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] block: fix NULL pointer in blkcg_drain_queue()
by Yang Yingliang 24 Sep '21

24 Sep '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182135 CVE: NA ------------------------------------------------- blkcg_init_queue blk_iolatency_init blk_mq_freeze_queue blk_throtl_drain <- blk_throtl will be initialized later, so q->td is NULL and trigger this NULL pointer BUG. blk_throtl_init The following is the log of the problem. ------------[ cut here ]------------ [ 8.516269] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 [ 8.516296] RIP: 0010:blk_throtl_drain+0x142/0x760 [ 8.520477] Call Trace: [ 8.520477] blkcg_drain_queue+0x90/0x120 [ 8.520477] __blk_drain_queue+0x18a/0x760 [ 8.520477] blk_drain_queue+0x45/0x80 [ 8.520477] blk_freeze_queue+0x58/0x70 [ 8.520477] blk_iolatency_init+0xdc/0x3e7 [ 8.520477] blkcg_init_queue+0x214/0x5e0 [ 8.520477] blk_alloc_queue_node+0x826/0xc10 [ 8.520477] ? ramdisk_size+0x27/0x27 [ 8.520477] brd_alloc+0x118/0x540 [ 8.520477] ? ramdisk_size+0x27/0x27 [ 8.520477] brd_init+0x179/0x4be [ 8.520477] ? do_one_initcall+0x5fe/0x783 [ 8.520477] ? ramdisk_size+0x27/0x27 [ 8.520477] do_one_initcall+0xf7/0x783 [ 8.520477] ? initcall_blacklisted+0x1b0/0x1b0 [ 8.520477] ? __wake_up_common+0x600/0x620 [ 8.520477] ? lock_downgrade+0x720/0x720 [ 8.520477] ? check_preemption_disabled+0x40/0x2a0 [ 8.520477] kernel_init_freeable+0xb34/0xc27 [ 8.520477] ? rest_init+0x41c/0x41c [ 8.520477] kernel_init+0x10/0x1e0 [ 8.520477] ? rest_init+0x41c/0x41c [ 8.520477] ret_from_fork+0x24/0x30 [ 8.520477] Modules linked in: [ 8.520477] Dumping ftrace buffer: [ 8.520477] (ftrace buffer empty) [ 8.520477] ---[ end trace 74cf51ecec6ee7a1 ]--- Fix this by judging whether q->td is NULL. If so, Indicates that the io_throttle module has not been initialized. Fixes: ee3147b403e5e ("block: fix race between adding/removing rq qos and normal IO") Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 592befc26584f..9511330bfebc7 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1314,6 +1314,13 @@ void blkcg_drain_queue(struct request_queue *q) if (!q->root_blkg) return; + /* + * @q could be exiting and q->td has not been initialized. + * If so, don't need drain any throttled bios. + */ + if (!q->td) + return; + blk_throtl_drain(q); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/9] ascend inclusion mpam feature
by Wang Xingang 24 Sep '21

24 Sep '21

From: Xingang Wang <wangxingang5(a)huawei.com> This series patches introduce mpam feature for ascend: - 1. The mpam driver resctrlfs need to add write interface for rmid, so that the rmid can be configured from userspace. - 2. Add support to configure SMMU mpam from svm. bugzilla: https://gitee.com/openeuler/kernel/issues/I49RB2 Xingang Wang (9): iommu/arm-smmu-v3: Add support to configure mpam in STE/CD context iommu/arm-smmu-v3: Add support to get SMMU mpam configuration iommu/arm-smmu-v3: Add support to enable/disable SMMU user_mpam_en svm: Add support to get svm mpam configuration svm: Add support to set svm mpam configuration svm: Add svm_set_user_mpam_en to enable/disable mpam for smmu mpam: enable rdt_mon_capable for mbw monitor mpam: Add support for group rmid modify mpam: update monitor rmid and group configuration arch/arm64/kernel/mpam/mpam_ctrlmon.c | 33 ++-- arch/arm64/kernel/mpam/mpam_resctrl.c | 104 +++++++++- arch/arm64/kernel/mpam/mpam_setup.c | 1 + drivers/char/svm.c | 227 ++++++++++++++++++++++ drivers/iommu/arm-smmu-v3-context.c | 42 ++++ drivers/iommu/arm-smmu-v3.c | 265 ++++++++++++++++++++++++++ include/linux/ascend_smmu.h | 21 ++ 7 files changed, 674 insertions(+), 19 deletions(-) create mode 100644 include/linux/ascend_smmu.h -- 2.19.1

2 10

[PATCH openEuler-1.0-LTS 1/3] block: fix race between adding/removing rq qos and normal IO
by Yang Yingliang 24 Sep '21

24 Sep '21

From: Ming Lei <ming.lei(a)redhat.com> mainline inclusion from mainline-v5.14 commit 2cafe29a8d03f02a3d16193bdaae2f3e82a423f9 category: bugfix bugzilla: 182135 CVE: NA ------------------------------------------------- Yi reported several kernel panics on: [16687.001777] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... [16687.163549] pc : __rq_qos_track+0x38/0x60 or [ 997.690455] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 ... [ 997.850347] pc : __rq_qos_done+0x2c/0x50 Turns out it is caused by race between adding rq qos(wbt) and normal IO because rq_qos_add can be run when IO is being submitted, fix this issue by freezing queue before adding/deleting rq qos to queue. rq_qos_exit() needn't to freeze queue because it is called after queue has been frozen. iolatency calls rq_qos_add() during allocating queue, so freezing won't add delay because queue usage refcount works at atomic mode at that time. iocost calls rq_qos_add() when writing cgroup attribute file, that is fine to freeze queue at that time since we usually freeze queue when storing to queue sysfs attribute, meantime iocost only exists on the root cgroup. wbt_init calls it in blk_register_queue() and queue sysfs attribute store(queue_wb_lat_store() when write it 1st time in case of !BLK_WBT_MQ), the following patch will speedup the queue freezing in wbt_init. Reported-by: Yi Zhang <yi.zhang(a)redhat.com> Cc: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Tested-by: Yi Zhang <yi.zhang(a)redhat.com> Link: https://lore.kernel.org/r/20210609015822.103433-2-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/blk-rq-qos.h Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-rq-qos.h | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h index 98caba3e962ee..c99b2facd9ffd 100644 --- a/block/blk-rq-qos.h +++ b/block/blk-rq-qos.h @@ -6,6 +6,7 @@ #include <linux/blk_types.h> #include <linux/atomic.h> #include <linux/wait.h> +#include <linux/blk-mq.h> enum rq_qos_id { RQ_QOS_WBT, @@ -74,20 +75,43 @@ static inline void rq_wait_init(struct rq_wait *rq_wait) static inline void rq_qos_add(struct request_queue *q, struct rq_qos *rqos) { + /* + * No IO can be in-flight when adding rqos, so freeze queue, which + * is fine since we only support rq_qos for blk-mq queue. + * + * Reuse ->queue_lock for protecting against other concurrent + * rq_qos adding/deleting + */ + blk_mq_freeze_queue(q); + + spin_lock_irq(q->queue_lock); rqos->next = q->rq_qos; q->rq_qos = rqos; + spin_unlock_irq(q->queue_lock); + + blk_mq_unfreeze_queue(q); } static inline void rq_qos_del(struct request_queue *q, struct rq_qos *rqos) { struct rq_qos **cur; + /* + * See comment in rq_qos_add() about freezing queue & using + * ->queue_lock. + */ + blk_mq_freeze_queue(q); + + spin_lock_irq(q->queue_lock); for (cur = &q->rq_qos; *cur; cur = &(*cur)->next) { if (*cur == rqos) { *cur = rqos->next; break; } } + spin_unlock_irq(q->queue_lock); + + blk_mq_unfreeze_queue(q); } bool rq_wait_inc_below(struct rq_wait *rq_wait, unsigned int limit); -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS] Fix incorrect call to free srb in qla2xxx_mqueuecommand()
by yinxiujiang 23 Sep '21

23 Sep '21

From: yin-xiujiang <yinxiujiang(a)kylinos.cn> Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now allocated by upper layers. This fixes smatch warning of srb unintended free. Signed-off-by: yin-xiujiang <yinxiujiang(a)kylinos.cn> --- drivers/scsi/qla2xxx/qla_os.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index bfbf213b15c0..8e9d386146ac 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -1028,8 +1028,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, if (rval != QLA_SUCCESS) { ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x3078, "Start scsi failed rval=%d for cmd=%p.\n", rval, cmd); - if (rval == QLA_INTERFACE_ERROR) - goto qc24_free_sp_fail_command; goto qc24_host_busy_free_sp; } @@ -1044,11 +1042,6 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd, qc24_target_busy: return SCSI_MLQUEUE_TARGET_BUSY; -qc24_free_sp_fail_command: - sp->free(sp); - CMD_SP(cmd) = NULL; - qla2xxx_rel_qpair_sp(sp->qpair, sp); - qc24_fail_command: cmd->scsi_done(cmd); -- 2.27.0

2 1

[PATCH openEuler-1.0-LTS 0/34] arm64 support kexec -l -s
by xuhuijie 23 Sep '21

23 Sep '21

support arm64 kexec_file(23): kexec_file: add kexec_file_load system call to unistd.h kexec_file: make kexec_image_post_load_cleanup_default() global kexec_file: drop arch_kexec_mem_walk() kexec_file: factor out memblock-based arch_kexec_walk_mem() kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump kexec_file: add image head flag definitions kexec_file: cpufeature: add MMFR0 helper functions kexec_file: enable KEXEC_FILE config kexec_file: load initrd and device-tree kexec_file: allow for loading Image-format kernel kexec_file: invoke the kernel without purgatory kexec_file: pe.h: remove message[] from mz header definition kexec_file: add kernel signature verification support kexec_file: add kaslr support kexec_file: forbid kdump via kexec_file_load() kexec_file: include fdt_addresses.c kexec_file: include linux/vmalloc.h kexec_file: Refactor setup_dtb() to consolidate error checking kexec_file: add rng-seed support kexec_file: add crash dump support kexec_file: Update to upstream version v1.5.0-23-g87963ee20693 kexec_file: handle empty command-line kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails support platform keyring(10): integrity: Define a trusted platform keyring integrity: Load certs to the platform keyring integrity: Add EFI signature data types integrity: Add an EFI signature blob parser integrity: Import certificates from UEFI Secure Boot integrity: Allow the "db" UEFI variable to be suppressed integrity: Support platform keyring for kernel appraisal integrity, KEYS: add a reference to platform keyring integrity: Make use of platform keyring for signature verify integrity: Fix __integrity_init_keyring() section mismatch fix kabi(1): kexec_file: fix kabi because of the new system call sys_kexec_file_load --- arch/arm64/Kconfig | 33 ++ arch/arm64/include/asm/cpufeature.h | 48 +++ arch/arm64/include/asm/image.h | 59 +++ arch/arm64/include/asm/kexec.h | 23 ++ arch/arm64/kernel/Makefile | 3 +- arch/arm64/kernel/cpu-reset.S | 8 +- arch/arm64/kernel/head.S | 3 +- arch/arm64/kernel/image.h | 21 +- arch/arm64/kernel/kexec_image.c | 126 +++++++ arch/arm64/kernel/machine_kexec.c | 12 +- arch/arm64/kernel/machine_kexec_file.c | 342 ++++++++++++++++++ arch/arm64/kernel/relocate_kernel.S | 3 +- arch/powerpc/kernel/machine_kexec_file_64.c | 54 --- arch/s390/kernel/machine_kexec_file.c | 10 - arch/x86/kernel/kexec-bzimage64.c | 14 +- certs/system_keyring.c | 23 +- include/keys/system_keyring.h | 8 + include/linux/efi.h | 34 ++ include/linux/kexec.h | 15 +- include/linux/pe.h | 2 +- include/linux/verification.h | 1 + include/uapi/linux/kexec.h | 1 + kernel/kexec.c | 10 + kernel/kexec_file.c | 160 +++++++- lib/Makefile | 2 +- lib/fdt_addresses.c | 2 + scripts/dtc/libfdt/fdt_addresses.c | 47 +++ scripts/dtc/libfdt/libfdt.h | 61 ++++ security/integrity/Kconfig | 11 + security/integrity/Makefile | 5 + security/integrity/digsig.c | 114 ++++-- security/integrity/ima/ima_appraise.c | 14 +- security/integrity/integrity.h | 23 +- .../integrity/platform_certs/efi_parser.c | 108 ++++++ security/integrity/platform_certs/load_uefi.c | 194 ++++++++++ .../platform_certs/platform_keyring.c | 58 +++ 36 files changed, 1518 insertions(+), 134 deletions(-) create mode 100644 arch/arm64/include/asm/image.h create mode 100644 arch/arm64/kernel/kexec_image.c create mode 100644 arch/arm64/kernel/machine_kexec_file.c create mode 100644 lib/fdt_addresses.c create mode 100644 security/integrity/platform_certs/efi_parser.c create mode 100644 security/integrity/platform_certs/load_uefi.c create mode 100644 security/integrity/platform_certs/platform_keyring.c diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 9dfbd052b..5381d21bb 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -957,6 +957,39 @@ config KEXEC but it is independent of the system firmware. And like a reboot you can start any kernel with it, not just Linux. +config KEXEC_FILE + bool "kexec file based system call" + select KEXEC_CORE + help + This is new version of kexec system call. This system call is + file based and takes file descriptors as system call argument + for kernel and initramfs as opposed to list of segments as + accepted by previous system call. + +config KEXEC_VERIFY_SIG + bool "Verify kernel signature during kexec_file_load() syscall" + depends on KEXEC_FILE + help + Select this option to verify a signature with loaded kernel + image. If configured, any attempt of loading a image without + valid signature will fail. + + In addition to that option, you need to enable signature + verification for the corresponding kernel image type being + loaded in order for this to work. + +config KEXEC_IMAGE_VERIFY_SIG + bool "Enable Image signature verification support" + default y + depends on KEXEC_VERIFY_SIG + depends on EFI && SIGNED_PE_FILE_VERIFICATION + help + Enable Image signature verification support. + +comment "Support for PE file signature verification disabled" + depends on KEXEC_VERIFY_SIG + depends on !EFI || !SIGNED_PE_FILE_VERIFICATION + config CRASH_DUMP bool "Build kdump crash kernel" help diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index c43d02365..211aa994b 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -497,11 +497,59 @@ static inline bool system_supports_32bit_el0(void) return cpus_have_const_cap(ARM64_HAS_32BIT_EL0); } +static inline bool system_supports_4kb_granule(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_TGRAN4_SHIFT); + + return val == ID_AA64MMFR0_TGRAN4_SUPPORTED; +} + +static inline bool system_supports_64kb_granule(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_TGRAN64_SHIFT); + + return val == ID_AA64MMFR0_TGRAN64_SUPPORTED; +} + +static inline bool system_supports_16kb_granule(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_TGRAN16_SHIFT); + + return val == ID_AA64MMFR0_TGRAN16_SUPPORTED; +} + static inline bool system_supports_mixed_endian_el0(void) { return id_aa64mmfr0_mixed_endian_el0(read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1)); } +static inline bool system_supports_mixed_endian(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_BIGENDEL_SHIFT); + + return val == 0x1; +} + static inline bool system_supports_fpsimd(void) { return !cpus_have_const_cap(ARM64_HAS_NO_FPSIMD); diff --git a/arch/arm64/include/asm/image.h b/arch/arm64/include/asm/image.h new file mode 100644 index 000000000..e2c27a227 --- /dev/null +++ b/arch/arm64/include/asm/image.h @@ -0,0 +1,59 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef __ASM_IMAGE_H +#define __ASM_IMAGE_H + +#define ARM64_IMAGE_MAGIC "ARM\x64" + +#define ARM64_IMAGE_FLAG_BE_SHIFT 0 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_SHIFT (ARM64_IMAGE_FLAG_BE_SHIFT + 1) +#define ARM64_IMAGE_FLAG_PHYS_BASE_SHIFT \ + (ARM64_IMAGE_FLAG_PAGE_SIZE_SHIFT + 2) +#define ARM64_IMAGE_FLAG_BE_MASK 0x1 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_MASK 0x3 +#define ARM64_IMAGE_FLAG_PHYS_BASE_MASK 0x1 + +#define ARM64_IMAGE_FLAG_LE 0 +#define ARM64_IMAGE_FLAG_BE 1 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_4K 1 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_16K 2 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_64K 3 +#define ARM64_IMAGE_FLAG_PHYS_BASE 1 + +#ifndef __ASSEMBLY__ + +#define arm64_image_flag_field(flags, field) \ + (((flags) >> field##_SHIFT) & field##_MASK) + +/* + * struct arm64_image_header - arm64 kernel image header + * See Documentation/arm64/booting.txt for details + * + * @code0: Executable code, or + * @mz_header alternatively used for part of MZ header + * @code1: Executable code + * @text_offset: Image load offset + * @image_size: Effective Image size + * @flags: kernel flags + * @reserved: reserved + * @magic: Magic number + * @reserved5: reserved, or + * @pe_header: alternatively used for PE COFF offset + */ + +struct arm64_image_header { + __le32 code0; + __le32 code1; + __le64 text_offset; + __le64 image_size; + __le64 flags; + __le64 res2; + __le64 res3; + __le64 res4; + __le32 magic; + __le32 res5; +}; + +#endif /* __ASSEMBLY__ */ + +#endif /* __ASM_IMAGE_H */ diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h index 30ab1fa34..286950227 100644 --- a/arch/arm64/include/asm/kexec.h +++ b/arch/arm64/include/asm/kexec.h @@ -101,6 +101,29 @@ static inline void crash_prepare_suspend(void) {} static inline void crash_post_resume(void) {} #endif +#ifdef CONFIG_KEXEC_FILE +#define ARCH_HAS_KIMAGE_ARCH + +struct kimage_arch { + void *dtb; + unsigned long dtb_mem; + /* Core ELF header buffer */ + void *elf_headers; + unsigned long elf_headers_mem; + unsigned long elf_headers_sz; +}; + +extern const struct kexec_file_ops kexec_image_ops; + +struct kimage; + +extern int arch_kimage_file_post_load_cleanup(struct kimage *image); +extern int load_other_segments(struct kimage *image, + unsigned long kernel_load_addr, unsigned long kernel_size, + char *initrd, unsigned long initrd_len, + char *cmdline); +#endif + void machine_kexec_mask_interrupts(void); #endif /* __ASSEMBLY__ */ diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index fe759f364..2e21303b6 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -54,8 +54,9 @@ arm64-obj-$(CONFIG_ARM64_ACPI_PARKING_PROTOCOL) += acpi_parking_protocol.o arm64-obj-$(CONFIG_PARAVIRT) += paravirt.o paravirt-spinlocks.o arm64-obj-$(CONFIG_RANDOMIZE_BASE) += kaslr.o arm64-obj-$(CONFIG_HIBERNATION) += hibernate.o hibernate-asm.o -arm64-obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o \ +arm64-obj-$(CONFIG_KEXEC_CORE) += machine_kexec.o relocate_kernel.o \ cpu-reset.o +arm64-obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o arm64-obj-$(CONFIG_ARM64_CPU_PARK) += cpu-park.o arm64-obj-$(CONFIG_ARM64_RELOC_TEST) += arm64-reloc-test.o arm64-reloc-test-y := reloc_test_core.o reloc_test_syms.o diff --git a/arch/arm64/kernel/cpu-reset.S b/arch/arm64/kernel/cpu-reset.S index 8021b46c9..a2be30275 100644 --- a/arch/arm64/kernel/cpu-reset.S +++ b/arch/arm64/kernel/cpu-reset.S @@ -22,11 +22,11 @@ * __cpu_soft_restart(el2_switch, entry, arg0, arg1, arg2) - Helper for * cpu_soft_restart. * - * @el2_switch: Flag to indicate a swich to EL2 is needed. + * @el2_switch: Flag to indicate a switch to EL2 is needed. * @entry: Location to jump to for soft reset. - * arg0: First argument passed to @entry. - * arg1: Second argument passed to @entry. - * arg2: Third argument passed to @entry. + * arg0: First argument passed to @entry. (relocation list) + * arg1: Second argument passed to @entry.(physical kernel entry) + * arg2: Third argument passed to @entry. (physical dtb address) * * Put the CPU into the same state as it would be if it had been reset, and * branch to what would be the reset vector. It must be executed with the diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index 34bd0790d..5edfb9cfd 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -31,6 +31,7 @@ #include <asm/cache.h> #include <asm/cputype.h> #include <asm/elf.h> +#include <asm/image.h> #include <asm/kernel-pgtable.h> #include <asm/kvm_arm.h> #include <asm/memory.h> @@ -91,7 +92,7 @@ _head: .quad 0 // reserved .quad 0 // reserved .quad 0 // reserved - .ascii "ARM\x64" // Magic number + .ascii ARM64_IMAGE_MAGIC // Magic number #ifdef CONFIG_EFI .long pe_header - _head // Offset to the PE header. diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h index eff6a564a..b22e8ad07 100644 --- a/arch/arm64/kernel/image.h +++ b/arch/arm64/kernel/image.h @@ -15,13 +15,15 @@ * You should have received a copy of the GNU General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. */ -#ifndef __ASM_IMAGE_H -#define __ASM_IMAGE_H +#ifndef __ARM64_KERNEL_IMAGE_H +#define __ARM64_KERNEL_IMAGE_H #ifndef LINKER_SCRIPT #error This file should only be included in vmlinux.lds.S #endif +#include <asm/image.h> + /* * There aren't any ELF relocations we can use to endian-swap values known only * at link time (e.g. the subtraction of two symbol addresses), so we must get @@ -47,19 +49,22 @@ sym##_lo32 = DATA_LE32((data) & 0xffffffff); \ sym##_hi32 = DATA_LE32((data) >> 32) +#define __HEAD_FLAG(field) (__HEAD_FLAG_##field << \ + ARM64_IMAGE_FLAG_##field##_SHIFT) + #ifdef CONFIG_CPU_BIG_ENDIAN -#define __HEAD_FLAG_BE 1 +#define __HEAD_FLAG_BE ARM64_IMAGE_FLAG_BE #else -#define __HEAD_FLAG_BE 0 +#define __HEAD_FLAG_BE ARM64_IMAGE_FLAG_LE #endif #define __HEAD_FLAG_PAGE_SIZE ((PAGE_SHIFT - 10) / 2) #define __HEAD_FLAG_PHYS_BASE 1 -#define __HEAD_FLAGS ((__HEAD_FLAG_BE << 0) | \ - (__HEAD_FLAG_PAGE_SIZE << 1) | \ - (__HEAD_FLAG_PHYS_BASE << 3)) +#define __HEAD_FLAGS (__HEAD_FLAG(BE) | \ + __HEAD_FLAG(PAGE_SIZE) | \ + __HEAD_FLAG(PHYS_BASE)) /* * These will output as part of the Image header, which should be little-endian @@ -113,4 +118,4 @@ __efistub_screen_info = screen_info; #endif -#endif /* __ASM_IMAGE_H */ +#endif /* __ARM64_KERNEL_IMAGE_H */ diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c new file mode 100644 index 000000000..1ad1d5f8f --- /dev/null +++ b/arch/arm64/kernel/kexec_image.c @@ -0,0 +1,126 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Kexec image loader + + * Copyright (C) 2018 Linaro Limited + * Author: AKASHI Takahiro <takahiro.akashi(a)linaro.org> + */ + +#define pr_fmt(fmt) "kexec_file(Image): " fmt + +#include <linux/err.h> +#include <linux/errno.h> +#include <linux/kernel.h> +#include <linux/kexec.h> +#include <linux/pe.h> +#include <linux/string.h> +#include <linux/verification.h> +#include <asm/byteorder.h> +#include <asm/cpufeature.h> +#include <asm/image.h> +#include <asm/memory.h> + +static int image_probe(const char *kernel_buf, unsigned long kernel_len) +{ + const struct arm64_image_header *h = + (const struct arm64_image_header *)(kernel_buf); + + if (!h || (kernel_len < sizeof(*h))) + return -EINVAL; + + if (memcmp(&h->magic, ARM64_IMAGE_MAGIC, sizeof(h->magic))) + return -EINVAL; + + return 0; +} + +static void *image_load(struct kimage *image, + char *kernel, unsigned long kernel_len, + char *initrd, unsigned long initrd_len, + char *cmdline, unsigned long cmdline_len) +{ + struct arm64_image_header *h; + u64 flags, value; + bool be_image, be_kernel; + struct kexec_buf kbuf; + unsigned long text_offset; + struct kexec_segment *kernel_segment; + int ret; + + /* + * We require a kernel with an unambiguous Image header. Per + * Documentation/booting.txt, this is the case when image_size + * is non-zero (practically speaking, since v3.17). + */ + h = (struct arm64_image_header *)kernel; + if (!h->image_size) + return ERR_PTR(-EINVAL); + + /* Check cpu features */ + flags = le64_to_cpu(h->flags); + be_image = arm64_image_flag_field(flags, ARM64_IMAGE_FLAG_BE); + be_kernel = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN); + if ((be_image != be_kernel) && !system_supports_mixed_endian()) + return ERR_PTR(-EINVAL); + + value = arm64_image_flag_field(flags, ARM64_IMAGE_FLAG_PAGE_SIZE); + if (((value == ARM64_IMAGE_FLAG_PAGE_SIZE_4K) && + !system_supports_4kb_granule()) || + ((value == ARM64_IMAGE_FLAG_PAGE_SIZE_64K) && + !system_supports_64kb_granule()) || + ((value == ARM64_IMAGE_FLAG_PAGE_SIZE_16K) && + !system_supports_16kb_granule())) + return ERR_PTR(-EINVAL); + + /* Load the kernel */ + kbuf.image = image; + kbuf.buf_min = 0; + kbuf.buf_max = ULONG_MAX; + kbuf.top_down = false; + + kbuf.buffer = kernel; + kbuf.bufsz = kernel_len; + kbuf.mem = 0; + kbuf.memsz = le64_to_cpu(h->image_size); + text_offset = le64_to_cpu(h->text_offset); + kbuf.buf_align = MIN_KIMG_ALIGN; + + /* Adjust kernel segment with TEXT_OFFSET */ + kbuf.memsz += text_offset; + + ret = kexec_add_buffer(&kbuf); + if (ret) + return ERR_PTR(ret); + + kernel_segment = &image->segment[image->nr_segments - 1]; + kernel_segment->mem += text_offset; + kernel_segment->memsz -= text_offset; + image->start = kernel_segment->mem; + + pr_debug("Loaded kernel at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + kernel_segment->mem, kbuf.bufsz, + kernel_segment->memsz); + + /* Load additional data */ + ret = load_other_segments(image, + kernel_segment->mem, kernel_segment->memsz, + initrd, initrd_len, cmdline); + + return ERR_PTR(ret); +} + +#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +static int image_verify_sig(const char *kernel, unsigned long kernel_len) +{ + return verify_pefile_signature(kernel, kernel_len, NULL, + VERIFYING_KEXEC_PE_SIGNATURE); +} +#endif + +const struct kexec_file_ops kexec_image_ops = { + .probe = image_probe, + .load = image_load, +#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG + .verify_sig = image_verify_sig, +#endif +}; diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index b41d6d482..213d0053e 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -214,9 +214,17 @@ void machine_kexec(struct kimage *kimage) * uses physical addressing to relocate the new image to its final * position and transfers control to the image entry point when the * relocation is complete. + * In kexec case, kimage->start points to purgatory assuming that + * kernel entry and dtb address are embedded in purgatory by + * userspace (kexec-tools). + * In kexec_file case, the kernel starts directly without purgatory. */ - - cpu_soft_restart(reboot_code_buffer_phys, kimage->head, kimage->start, 0); + cpu_soft_restart(reboot_code_buffer_phys, kimage->head, kimage->start, +#ifdef CONFIG_KEXEC_FILE + kimage->arch.dtb_mem); +#else + 0); +#endif BUG(); /* Should never get here. */ } diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c new file mode 100644 index 000000000..ec3b72dc0 --- /dev/null +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -0,0 +1,342 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * kexec_file for arm64 + * + * Copyright (C) 2018 Linaro Limited + * Author: AKASHI Takahiro <takahiro.akashi(a)linaro.org> + * + * Most code is derived from arm64 port of kexec-tools + */ + +#define pr_fmt(fmt) "kexec_file: " fmt + +#include <linux/ioport.h> +#include <linux/kernel.h> +#include <linux/kexec.h> +#include <linux/libfdt.h> +#include <linux/memblock.h> +#include <linux/of_fdt.h> +#include <linux/random.h> +#include <linux/slab.h> +#include <linux/string.h> +#include <linux/types.h> +#include <linux/vmalloc.h> +#include <asm/byteorder.h> + +/* relevant device tree properties */ +#define FDT_PROP_KEXEC_ELFHDR "linux,elfcorehdr" +#define FDT_PROP_MEM_RANGE "linux,usable-memory-range" +#define FDT_PROP_INITRD_START "linux,initrd-start" +#define FDT_PROP_INITRD_END "linux,initrd-end" +#define FDT_PROP_BOOTARGS "bootargs" +#define FDT_PROP_KASLR_SEED "kaslr-seed" +#define FDT_PROP_RNG_SEED "rng-seed" +#define RNG_SEED_SIZE 128 + +const struct kexec_file_ops * const kexec_file_loaders[] = { + &kexec_image_ops, + NULL +}; + +int arch_kimage_file_post_load_cleanup(struct kimage *image) +{ + vfree(image->arch.dtb); + image->arch.dtb = NULL; + + vfree(image->arch.elf_headers); + image->arch.elf_headers = NULL; + image->arch.elf_headers_sz = 0; + + return kexec_image_post_load_cleanup_default(image); +} + +static int setup_dtb(struct kimage *image, + unsigned long initrd_load_addr, unsigned long initrd_len, + char *cmdline, void *dtb) +{ + int off, ret; + + ret = fdt_path_offset(dtb, "/chosen"); + if (ret < 0) + goto out; + + off = ret; + + ret = fdt_delprop(dtb, off, FDT_PROP_KEXEC_ELFHDR); + if (ret && ret != -FDT_ERR_NOTFOUND) + goto out; + ret = fdt_delprop(dtb, off, FDT_PROP_MEM_RANGE); + if (ret && ret != -FDT_ERR_NOTFOUND) + goto out; + + if (image->type == KEXEC_TYPE_CRASH) { + /* add linux,elfcorehdr */ + ret = fdt_appendprop_addrrange(dtb, 0, off, + FDT_PROP_KEXEC_ELFHDR, + image->arch.elf_headers_mem, + image->arch.elf_headers_sz); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + + /* add linux,usable-memory-range */ + ret = fdt_appendprop_addrrange(dtb, 0, off, + FDT_PROP_MEM_RANGE, + crashk_res.start, + crashk_res.end - crashk_res.start + 1); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + } + + /* add bootargs */ + if (cmdline) { + ret = fdt_setprop_string(dtb, off, FDT_PROP_BOOTARGS, cmdline); + if (ret) + goto out; + } else { + ret = fdt_delprop(dtb, off, FDT_PROP_BOOTARGS); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + } + + /* add initrd-* */ + if (initrd_load_addr) { + ret = fdt_setprop_u64(dtb, off, FDT_PROP_INITRD_START, + initrd_load_addr); + if (ret) + goto out; + + ret = fdt_setprop_u64(dtb, off, FDT_PROP_INITRD_END, + initrd_load_addr + initrd_len); + if (ret) + goto out; + } else { + ret = fdt_delprop(dtb, off, FDT_PROP_INITRD_START); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + + ret = fdt_delprop(dtb, off, FDT_PROP_INITRD_END); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + } + + /* add kaslr-seed */ + ret = fdt_delprop(dtb, off, FDT_PROP_KASLR_SEED); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + + if (rng_is_initialized()) { + u64 seed = get_random_u64(); + ret = fdt_setprop_u64(dtb, off, FDT_PROP_KASLR_SEED, seed); + if (ret) + goto out; + } else { + pr_notice("RNG is not initialised: omitting \"%s\" property\n", + FDT_PROP_KASLR_SEED); + } + + /* add rng-seed */ + if (rng_is_initialized()) { + u8 rng_seed[RNG_SEED_SIZE]; + get_random_bytes(rng_seed, RNG_SEED_SIZE); + ret = fdt_setprop(dtb, off, FDT_PROP_RNG_SEED, rng_seed, + RNG_SEED_SIZE); + if (ret) + goto out; + } else { + pr_notice("RNG is not initialised: omitting \"%s\" property\n", + FDT_PROP_RNG_SEED); + } + +out: + if (ret) + return (ret == -FDT_ERR_NOSPACE) ? -ENOMEM : -EINVAL; + + return 0; +} + +/* + * More space needed so that we can add initrd, bootargs, kaslr-seed, + * rng-seed, userable-memory-range and elfcorehdr. + */ +#define DTB_EXTRA_SPACE 0x1000 + +static int create_dtb(struct kimage *image, + unsigned long initrd_load_addr, unsigned long initrd_len, + char *cmdline, void **dtb) +{ + void *buf; + size_t buf_size; + size_t cmdline_len; + int ret; + + cmdline_len = cmdline ? strlen(cmdline) : 0; + buf_size = fdt_totalsize(initial_boot_params) + + cmdline_len + DTB_EXTRA_SPACE; + + for (;;) { + buf = vmalloc(buf_size); + if (!buf) + return -ENOMEM; + + /* duplicate a device tree blob */ + ret = fdt_open_into(initial_boot_params, buf, buf_size); + if (ret) { + vfree(buf); + return -EINVAL; + } + + ret = setup_dtb(image, initrd_load_addr, initrd_len, + cmdline, buf); + if (ret) { + vfree(buf); + if (ret == -ENOMEM) { + /* unlikely, but just in case */ + buf_size += DTB_EXTRA_SPACE; + continue; + } else { + return ret; + } + } + + /* trim it */ + fdt_pack(buf); + *dtb = buf; + + return 0; + } +} + +static int prepare_elf_headers(void **addr, unsigned long *sz) +{ + struct crash_mem *cmem; + unsigned int nr_ranges; + int ret; + u64 i; + phys_addr_t start, end; + + nr_ranges = 1; /* for exclusion of crashkernel region */ + for_each_mem_range(i, &memblock.memory, NULL, NUMA_NO_NODE, + MEMBLOCK_NONE, &start, &end, NULL) + nr_ranges++; + + cmem = kmalloc(sizeof(struct crash_mem) + + sizeof(struct crash_mem_range) * nr_ranges, GFP_KERNEL); + if (!cmem) + return -ENOMEM; + + cmem->max_nr_ranges = nr_ranges; + cmem->nr_ranges = 0; + for_each_mem_range(i, &memblock.memory, NULL, NUMA_NO_NODE, + MEMBLOCK_NONE, &start, &end, NULL) { + cmem->ranges[cmem->nr_ranges].start = start; + cmem->ranges[cmem->nr_ranges].end = end - 1; + cmem->nr_ranges++; + } + + /* Exclude crashkernel region */ + ret = crash_exclude_mem_range(cmem, crashk_res.start, crashk_res.end); + + if (!ret) + ret = crash_prepare_elf64_headers(cmem, true, addr, sz); + + kfree(cmem); + return ret; +} + +int load_other_segments(struct kimage *image, + unsigned long kernel_load_addr, + unsigned long kernel_size, + char *initrd, unsigned long initrd_len, + char *cmdline) +{ + struct kexec_buf kbuf; + void *headers, *dtb = NULL; + unsigned long headers_sz, initrd_load_addr = 0, dtb_len; + int ret = 0; + + kbuf.image = image; + /* not allocate anything below the kernel */ + kbuf.buf_min = kernel_load_addr + kernel_size; + + /* load elf core header */ + if (image->type == KEXEC_TYPE_CRASH) { + ret = prepare_elf_headers(&headers, &headers_sz); + if (ret) { + pr_err("Preparing elf core header failed\n"); + goto out_err; + } + + kbuf.buffer = headers; + kbuf.bufsz = headers_sz; + kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; + kbuf.memsz = headers_sz; + kbuf.buf_align = SZ_64K; /* largest supported page size */ + kbuf.buf_max = ULONG_MAX; + kbuf.top_down = true; + + ret = kexec_add_buffer(&kbuf); + if (ret) { + vfree(headers); + goto out_err; + } + image->arch.elf_headers = headers; + image->arch.elf_headers_mem = kbuf.mem; + image->arch.elf_headers_sz = headers_sz; + + pr_debug("Loaded elf core header at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + image->arch.elf_headers_mem, headers_sz, headers_sz); + } + + /* load initrd */ + if (initrd) { + kbuf.buffer = initrd; + kbuf.bufsz = initrd_len; + kbuf.mem = 0; + kbuf.memsz = initrd_len; + kbuf.buf_align = 0; + /* within 1GB-aligned window of up to 32GB in size */ + kbuf.buf_max = round_down(kernel_load_addr, SZ_1G) + + (unsigned long)SZ_1G * 32; + kbuf.top_down = false; + + ret = kexec_add_buffer(&kbuf); + if (ret) + goto out_err; + initrd_load_addr = kbuf.mem; + + pr_debug("Loaded initrd at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + initrd_load_addr, initrd_len, initrd_len); + } + + /* load dtb */ + ret = create_dtb(image, initrd_load_addr, initrd_len, cmdline, &dtb); + if (ret) { + pr_err("Preparing for new dtb failed\n"); + goto out_err; + } + + dtb_len = fdt_totalsize(dtb); + kbuf.buffer = dtb; + kbuf.bufsz = dtb_len; + kbuf.mem = 0; + kbuf.memsz = dtb_len; + /* not across 2MB boundary */ + kbuf.buf_align = SZ_2M; + kbuf.buf_max = ULONG_MAX; + kbuf.top_down = true; + + ret = kexec_add_buffer(&kbuf); + if (ret) + goto out_err; + image->arch.dtb = dtb; + image->arch.dtb_mem = kbuf.mem; + + pr_debug("Loaded dtb at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + kbuf.mem, dtb_len, dtb_len); + + return 0; + +out_err: + vfree(dtb); + return ret; +} diff --git a/arch/arm64/kernel/relocate_kernel.S b/arch/arm64/kernel/relocate_kernel.S index f407e422a..95fd94209 100644 --- a/arch/arm64/kernel/relocate_kernel.S +++ b/arch/arm64/kernel/relocate_kernel.S @@ -32,6 +32,7 @@ ENTRY(arm64_relocate_new_kernel) /* Setup the list loop variables. */ + mov x18, x2 /* x18 = dtb address */ mov x17, x1 /* x17 = kimage_start */ mov x16, x0 /* x16 = kimage_head */ raw_dcache_line_size x15, x0 /* x15 = dcache line size */ @@ -107,7 +108,7 @@ ENTRY(arm64_relocate_new_kernel) isb /* Start new image. */ - mov x0, xzr + mov x0, x18 mov x1, xzr mov x2, xzr mov x3, xzr diff --git a/arch/powerpc/kernel/machine_kexec_file_64.c b/arch/powerpc/kernel/machine_kexec_file_64.c index c77e95e9b..0d20c7ad4 100644 --- a/arch/powerpc/kernel/machine_kexec_file_64.c +++ b/arch/powerpc/kernel/machine_kexec_file_64.c @@ -24,7 +24,6 @@ #include <linux/slab.h> #include <linux/kexec.h> -#include <linux/memblock.h> #include <linux/of_fdt.h> #include <linux/libfdt.h> #include <asm/ima.h> @@ -46,59 +45,6 @@ int arch_kexec_kernel_image_probe(struct kimage *image, void *buf, return kexec_image_probe_default(image, buf, buf_len); } -/** - * arch_kexec_walk_mem - call func(data) for each unreserved memory block - * @kbuf: Context info for the search. Also passed to @func. - * @func: Function to call for each memory block. - * - * This function is used by kexec_add_buffer and kexec_locate_mem_hole - * to find unreserved memory to load kexec segments into. - * - * Return: The memory walk will stop when func returns a non-zero value - * and that value will be returned. If all free regions are visited without - * func returning non-zero, then zero will be returned. - */ -int arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)) -{ - int ret = 0; - u64 i; - phys_addr_t mstart, mend; - struct resource res = { }; - - if (kbuf->top_down) { - for_each_free_mem_range_reverse(i, NUMA_NO_NODE, 0, - &mstart, &mend, NULL) { - /* - * In memblock, end points to the first byte after the - * range while in kexec, end points to the last byte - * in the range. - */ - res.start = mstart; - res.end = mend - 1; - ret = func(&res, kbuf); - if (ret) - break; - } - } else { - for_each_free_mem_range(i, NUMA_NO_NODE, 0, &mstart, &mend, - NULL) { - /* - * In memblock, end points to the first byte after the - * range while in kexec, end points to the last byte - * in the range. - */ - res.start = mstart; - res.end = mend - 1; - ret = func(&res, kbuf); - if (ret) - break; - } - } - - return ret; -} - /** * setup_purgatory - initialize the purgatory's global variables * @image: kexec image. diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c index f413f57f8..32023b4f9 100644 --- a/arch/s390/kernel/machine_kexec_file.c +++ b/arch/s390/kernel/machine_kexec_file.c @@ -134,16 +134,6 @@ int kexec_file_add_initrd(struct kimage *image, struct s390_load_data *data, return ret; } -/* - * The kernel is loaded to a fixed location. Turn off kexec_locate_mem_hole - * and provide kbuf->mem by hand. - */ -int arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)) -{ - return 1; -} - int arch_kexec_apply_relocations_add(struct purgatory_info *pi, Elf_Shdr *section, const Elf_Shdr *relsec, diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c index 70caa60b4..8977de5ad 100644 --- a/arch/x86/kernel/kexec-bzimage64.c +++ b/arch/x86/kernel/kexec-bzimage64.c @@ -535,9 +535,17 @@ static int bzImage64_cleanup(void *loader_data) #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len) { - return verify_pefile_signature(kernel, kernel_len, - VERIFY_USE_SECONDARY_KEYRING, - VERIFYING_KEXEC_PE_SIGNATURE); + int ret; + + ret = verify_pefile_signature(kernel, kernel_len, + VERIFY_USE_SECONDARY_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) { + ret = verify_pefile_signature(kernel, kernel_len, + VERIFY_USE_PLATFORM_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + } + return ret; } #endif diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 817287175..c05c29ae4 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING +static struct key *platform_trusted_keys; +#endif extern __initconst const u8 system_certificate_list[]; extern __initconst const unsigned long system_certificate_list_size; @@ -237,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len, #else trusted_keys = builtin_trusted_keys; #endif + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) { +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING + trusted_keys = platform_trusted_keys; +#else + trusted_keys = NULL; +#endif + if (!trusted_keys) { + ret = -ENOKEY; + pr_devel("PKCS#7 platform keyring is not available\n"); + goto error; + } } ret = pkcs7_validate_trust(pkcs7, trusted_keys); if (ret < 0) { if (ret == -ENOKEY) - pr_err("PKCS#7 signature not signed with a trusted key\n"); + pr_devel("PKCS#7 signature not signed with a trusted key\n"); goto error; } @@ -266,3 +280,10 @@ int verify_pkcs7_signature(const void *data, size_t len, EXPORT_SYMBOL_GPL(verify_pkcs7_signature); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ + +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING +void __init set_platform_trusted_keys(struct key *keyring) +{ + platform_trusted_keys = keyring; +} +#endif diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 359c2f936..42a93eda3 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -61,5 +61,13 @@ static inline struct key *get_ima_blacklist_keyring(void) } #endif /* CONFIG_IMA_BLACKLIST_KEYRING */ +#if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \ + defined(CONFIG_SYSTEM_TRUSTED_KEYRING) +extern void __init set_platform_trusted_keys(struct key *keyring); +#else +static inline void set_platform_trusted_keys(struct key *keyring) +{ +} +#endif #endif /* _KEYS_SYSTEM_KEYRING_H */ diff --git a/include/linux/efi.h b/include/linux/efi.h index 34c255c2a..b8a6df5df 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -676,6 +676,10 @@ void efi_native_runtime_setup(void); #define EFI_IMAGE_SECURITY_DATABASE_GUID EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f) #define EFI_SHIM_LOCK_GUID EFI_GUID(0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23) +#define EFI_CERT_SHA256_GUID EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28) +#define EFI_CERT_X509_GUID EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72) +#define EFI_CERT_X509_SHA256_GUID EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed) + /* * This GUID is used to pass to the kernel proper the struct screen_info * structure that was populated by the stub based on the GOP protocol instance @@ -947,6 +951,27 @@ typedef struct { efi_memory_desc_t entry[0]; } efi_memory_attributes_table_t; +typedef struct { + efi_guid_t signature_owner; + u8 signature_data[]; +} efi_signature_data_t; + +typedef struct { + efi_guid_t signature_type; + u32 signature_list_size; + u32 signature_header_size; + u32 signature_size; + u8 signature_header[]; + /* efi_signature_data_t signatures[][] */ +} efi_signature_list_t; + +typedef u8 efi_sha256_hash_t[32]; + +typedef struct { + efi_sha256_hash_t to_be_signed_hash; + efi_time_t time_of_revocation; +} efi_cert_x509_sha256_t; + /* * All runtime access to EFI goes through this structure: */ @@ -1129,6 +1154,15 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm, char * __init efi_md_typeattr_format(char *buf, size_t size, const efi_memory_desc_t *md); + +typedef void (*efi_element_handler_t)(const char *source, + const void *element_data, + size_t element_size); +extern int __init parse_efi_signature_list( + const char *source, + const void *data, size_t size, + efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *)); + /** * efi_range_is_wc - check the WC bit on an address range * @start: starting kvirt address diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 98cf0fb09..542a15c91 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -147,6 +147,19 @@ extern const struct kexec_file_ops * const kexec_file_loaders[]; int kexec_image_probe_default(struct kimage *image, void *buf, unsigned long buf_len); +int kexec_image_post_load_cleanup_default(struct kimage *image); + +int wrap_kexec_file_load(int kernel_fd, int initrd_fd, + unsigned long cmdline_len, const char __user *cmdline_ptr, + unsigned long flags); + +/* + * If kexec_buf.mem is set to this value, kexec_locate_mem_hole() + * will try to allocate free memory. Arch may overwrite it. + */ +#ifndef KEXEC_BUF_MEM_UNKNOWN +#define KEXEC_BUF_MEM_UNKNOWN 0 +#endif /** * struct kexec_buf - parameters for finding a place for a buffer in memory @@ -187,8 +200,6 @@ int __weak arch_kexec_apply_relocations(struct purgatory_info *pi, const Elf_Shdr *relsec, const Elf_Shdr *symtab); -int __weak arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)); extern int kexec_add_buffer(struct kexec_buf *kbuf); int kexec_locate_mem_hole(struct kexec_buf *kbuf); diff --git a/include/linux/pe.h b/include/linux/pe.h index 143ce75be..3482b18a4 100644 --- a/include/linux/pe.h +++ b/include/linux/pe.h @@ -166,7 +166,7 @@ struct mz_hdr { uint16_t oem_info; /* oem specific */ uint16_t reserved1[10]; /* reserved */ uint32_t peaddr; /* address of pe header */ - char message[64]; /* message to print */ + char message[]; /* message to print */ }; struct mz_reloc { diff --git a/include/linux/verification.h b/include/linux/verification.h index cfa4730d6..018fb5f13 100644 --- a/include/linux/verification.h +++ b/include/linux/verification.h @@ -17,6 +17,7 @@ * should be used. */ #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL) +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL) /* * The use to which an asymmetric key is being put. diff --git a/include/uapi/linux/kexec.h b/include/uapi/linux/kexec.h index ca3cebebd..9385ecba2 100644 --- a/include/uapi/linux/kexec.h +++ b/include/uapi/linux/kexec.h @@ -25,6 +25,7 @@ #define KEXEC_FILE_UNLOAD 0x00000001 #define KEXEC_FILE_ON_CRASH 0x00000002 #define KEXEC_FILE_NO_INITRAMFS 0x00000004 +#define KEXEC_FILE_LOAD_WRAP 0x100000000 /* These values match the ELF architecture values. * Unless there is a good reason that should continue to be the case. diff --git a/kernel/kexec.c b/kernel/kexec.c index 47dfad722..d44a55202 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -238,6 +238,16 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, { int result; + if (flags & KEXEC_FILE_LOAD_WRAP) { + int kernel_fd, initrd_fd; + + kernel_fd = entry >> 32; + initrd_fd = entry & 0x00000000ffffffff; + flags &= ~KEXEC_FILE_LOAD_WRAP; + return wrap_kexec_file_load(kernel_fd, initrd_fd, nr_segments, + (char __user *)segments, flags); + } + result = kexec_load_check(nr_segments, flags); if (result) return result; diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 04f99368b..2a25db8dd 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -16,6 +16,7 @@ #include <linux/file.h> #include <linux/slab.h> #include <linux/kexec.h> +#include <linux/memblock.h> #include <linux/mutex.h> #include <linux/list.h> #include <linux/fs.h> @@ -78,7 +79,7 @@ void * __weak arch_kexec_kernel_image_load(struct kimage *image) return kexec_image_load_default(image); } -static int kexec_image_post_load_cleanup_default(struct kimage *image) +int kexec_image_post_load_cleanup_default(struct kimage *image) { if (!image->fops || !image->fops->cleanup) return 0; @@ -407,6 +408,96 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, return ret; } +int wrap_kexec_file_load(int kernel_fd, int initrd_fd, + unsigned long cmdline_len, const char __user *cmdline_ptr, + unsigned long flags) +{ + int ret = 0, i; + struct kimage **dest_image, *image; + + /* We only trust the superuser with rebooting the system. */ + if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) + return -EPERM; + + /* Make sure we have a legal set of flags */ + if (flags != (flags & KEXEC_FILE_FLAGS)) + return -EINVAL; + + image = NULL; + + if (!mutex_trylock(&kexec_mutex)) + return -EBUSY; + + dest_image = &kexec_image; + if (flags & KEXEC_FILE_ON_CRASH) { + dest_image = &kexec_crash_image; + if (kexec_crash_image) + arch_kexec_unprotect_crashkres(); + } + + if (flags & KEXEC_FILE_UNLOAD) + goto exchange; + + /* + * In case of crash, new kernel gets loaded in reserved region. It is + * same memory where old crash kernel might be loaded. Free any + * current crash dump kernel before we corrupt it. + */ + if (flags & KEXEC_FILE_ON_CRASH) + kimage_free(xchg(&kexec_crash_image, NULL)); + + ret = kimage_file_alloc_init(&image, kernel_fd, initrd_fd, cmdline_ptr, + cmdline_len, flags); + if (ret) + goto out; + + ret = machine_kexec_prepare(image); + if (ret) + goto out; + + /* + * Some architecture(like S390) may touch the crash memory before + * machine_kexec_prepare(), we must copy vmcoreinfo data after it. + */ + ret = kimage_crash_copy_vmcoreinfo(image); + if (ret) + goto out; + + ret = kexec_calculate_store_digests(image); + if (ret) + goto out; + + for (i = 0; i < image->nr_segments; i++) { + struct kexec_segment *ksegment; + + ksegment = &image->segment[i]; + pr_debug("Loading segment %d: buf=0x%p bufsz=0x%zx mem=0x%lx memsz=0x%zx\n", + i, ksegment->buf, ksegment->bufsz, ksegment->mem, + ksegment->memsz); + + ret = kimage_load_segment(image, &image->segment[i]); + if (ret) + goto out; + } + + kimage_terminate(image); + + /* + * Free up any temporary buffers allocated which are not needed + * after image has been loaded + */ + kimage_file_post_load_cleanup(image); +exchange: + image = xchg(dest_image, image); +out: + if ((flags & KEXEC_FILE_ON_CRASH) && kexec_crash_image) + arch_kexec_protect_crashkres(); + + mutex_unlock(&kexec_mutex); + kimage_free(image); + return ret; +} + static int locate_mem_hole_top_down(unsigned long start, unsigned long end, struct kexec_buf *kbuf) { @@ -501,8 +592,60 @@ static int locate_mem_hole_callback(struct resource *res, void *arg) return locate_mem_hole_bottom_up(start, end, kbuf); } +#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK +static int kexec_walk_memblock(struct kexec_buf *kbuf, + int (*func)(struct resource *, void *)) +{ + return 0; +} +#else +static int kexec_walk_memblock(struct kexec_buf *kbuf, + int (*func)(struct resource *, void *)) +{ + int ret = 0; + u64 i; + phys_addr_t mstart, mend; + struct resource res = { }; + + if (kbuf->image->type == KEXEC_TYPE_CRASH) + return func(&crashk_res, kbuf); + + if (kbuf->top_down) { + for_each_free_mem_range_reverse(i, NUMA_NO_NODE, MEMBLOCK_NONE, + &mstart, &mend, NULL) { + /* + * In memblock, end points to the first byte after the + * range while in kexec, end points to the last byte + * in the range. + */ + res.start = mstart; + res.end = mend - 1; + ret = func(&res, kbuf); + if (ret) + break; + } + } else { + for_each_free_mem_range(i, NUMA_NO_NODE, MEMBLOCK_NONE, + &mstart, &mend, NULL) { + /* + * In memblock, end points to the first byte after the + * range while in kexec, end points to the last byte + * in the range. + */ + res.start = mstart; + res.end = mend - 1; + ret = func(&res, kbuf); + if (ret) + break; + } + } + + return ret; +} +#endif + /** - * arch_kexec_walk_mem - call func(data) on free memory regions + * kexec_walk_resources - call func(data) on free memory regions * @kbuf: Context info for the search. Also passed to @func. * @func: Function to call for each memory region. * @@ -510,8 +653,8 @@ static int locate_mem_hole_callback(struct resource *res, void *arg) * and that value will be returned. If all free regions are visited without * func returning non-zero, then zero will be returned. */ -int __weak arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)) +static int kexec_walk_resources(struct kexec_buf *kbuf, + int (*func)(struct resource *, void *)) { if (kbuf->image->type == KEXEC_TYPE_CRASH) return walk_iomem_res_desc(crashk_res.desc, @@ -534,7 +677,14 @@ int kexec_locate_mem_hole(struct kexec_buf *kbuf) { int ret; - ret = arch_kexec_walk_mem(kbuf, locate_mem_hole_callback); + /* Arch knows where to place */ + if (kbuf->mem != KEXEC_BUF_MEM_UNKNOWN) + return 0; + + if (IS_ENABLED(CONFIG_ARCH_DISCARD_MEMBLOCK)) + ret = kexec_walk_resources(kbuf, locate_mem_hole_callback); + else + ret = kexec_walk_memblock(kbuf, locate_mem_hole_callback); return ret == 1 ? 0 : -EADDRNOTAVAIL; } diff --git a/lib/Makefile b/lib/Makefile index 01f8051b4..455797430 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -213,7 +213,7 @@ KASAN_SANITIZE_stackdepot.o := n KCOV_INSTRUMENT_stackdepot.o := n libfdt_files = fdt.o fdt_ro.o fdt_wip.o fdt_rw.o fdt_sw.o fdt_strerror.o \ - fdt_empty_tree.o + fdt_empty_tree.o fdt_addresses.o $(foreach file, $(libfdt_files), \ $(eval CFLAGS_$(file) = -I$(src)/../scripts/dtc/libfdt)) lib-$(CONFIG_LIBFDT) += $(libfdt_files) diff --git a/lib/fdt_addresses.c b/lib/fdt_addresses.c new file mode 100644 index 000000000..23610bcf3 --- /dev/null +++ b/lib/fdt_addresses.c @@ -0,0 +1,2 @@ +#include <linux/libfdt_env.h> +#include "../scripts/dtc/libfdt/fdt_addresses.c" diff --git a/scripts/dtc/libfdt/fdt_addresses.c b/scripts/dtc/libfdt/fdt_addresses.c index eff4dbcc7..8211d00ba 100644 --- a/scripts/dtc/libfdt/fdt_addresses.c +++ b/scripts/dtc/libfdt/fdt_addresses.c @@ -94,3 +94,50 @@ int fdt_size_cells(const void *fdt, int nodeoffset) return val; } + +/* This function assumes that [address|size]_cells is 1 or 2 */ +int fdt_appendprop_addrrange(void *fdt, int parent, int nodeoffset, + const char *name, uint64_t addr, uint64_t size) +{ + int addr_cells, size_cells, ret; + uint8_t data[sizeof(fdt64_t) * 2], *prop; + + ret = fdt_address_cells(fdt, parent); + if (ret < 0) + return ret; + addr_cells = ret; + + ret = fdt_size_cells(fdt, parent); + if (ret < 0) + return ret; + size_cells = ret; + + /* check validity of address */ + prop = data; + if (addr_cells == 1) { + if ((addr > UINT32_MAX) || ((UINT32_MAX + 1 - addr) < size)) + return -FDT_ERR_BADVALUE; + + fdt32_st(prop, (uint32_t)addr); + } else if (addr_cells == 2) { + fdt64_st(prop, addr); + } else { + return -FDT_ERR_BADNCELLS; + } + + /* check validity of size */ + prop += addr_cells * sizeof(fdt32_t); + if (size_cells == 1) { + if (size > UINT32_MAX) + return -FDT_ERR_BADVALUE; + + fdt32_st(prop, (uint32_t)size); + } else if (size_cells == 2) { + fdt64_st(prop, size); + } else { + return -FDT_ERR_BADNCELLS; + } + + return fdt_appendprop(fdt, nodeoffset, name, data, + (addr_cells + size_cells) * sizeof(fdt32_t)); +} diff --git a/scripts/dtc/libfdt/libfdt.h b/scripts/dtc/libfdt/libfdt.h index 1e27780e1..da72b54c4 100644 --- a/scripts/dtc/libfdt/libfdt.h +++ b/scripts/dtc/libfdt/libfdt.h @@ -153,6 +153,30 @@ static inline void *fdt_offset_ptr_w(void *fdt, int offset, int checklen) uint32_t fdt_next_tag(const void *fdt, int offset, int *nextoffset); +static inline void fdt32_st(void *property, uint32_t value) +{ + uint8_t *bp = property; + + bp[0] = value >> 24; + bp[1] = (value >> 16) & 0xff; + bp[2] = (value >> 8) & 0xff; + bp[3] = value & 0xff; +} + +static inline void fdt64_st(void *property, uint64_t value) +{ + uint8_t *bp = property; + + bp[0] = value >> 56; + bp[1] = (value >> 48) & 0xff; + bp[2] = (value >> 40) & 0xff; + bp[3] = (value >> 32) & 0xff; + bp[4] = (value >> 24) & 0xff; + bp[5] = (value >> 16) & 0xff; + bp[6] = (value >> 8) & 0xff; + bp[7] = value & 0xff; +} + /**********************************************************************/ /* Traversal functions */ /**********************************************************************/ @@ -1765,6 +1789,43 @@ static inline int fdt_appendprop_cell(void *fdt, int nodeoffset, #define fdt_appendprop_string(fdt, nodeoffset, name, str) \ fdt_appendprop((fdt), (nodeoffset), (name), (str), strlen(str)+1) +/** + * fdt_appendprop_addrrange - append a address range property + * @fdt: pointer to the device tree blob + * @parent: offset of the parent node + * @nodeoffset: offset of the node to add a property at + * @name: name of property + * @addr: start address of a given range + * @size: size of a given range + * + * fdt_appendprop_addrrange() appends an address range value (start + * address and size) to the value of the named property in the given + * node, or creates a new property with that value if it does not + * already exist. + * If "name" is not specified, a default "reg" is used. + * Cell sizes are determined by parent's #address-cells and #size-cells. + * + * This function may insert data into the blob, and will therefore + * change the offsets of some existing nodes. + * + * returns: + * 0, on success + * -FDT_ERR_BADLAYOUT, + * -FDT_ERR_BADMAGIC, + * -FDT_ERR_BADNCELLS, if the node has a badly formatted or invalid + * #address-cells property + * -FDT_ERR_BADOFFSET, nodeoffset did not point to FDT_BEGIN_NODE tag + * -FDT_ERR_BADSTATE, + * -FDT_ERR_BADSTRUCTURE, + * -FDT_ERR_BADVERSION, + * -FDT_ERR_BADVALUE, addr or size doesn't fit to respective cells size + * -FDT_ERR_NOSPACE, there is insufficient free space in the blob to + * contain a new property + * -FDT_ERR_TRUNCATED, standard meanings + */ +int fdt_appendprop_addrrange(void *fdt, int parent, int nodeoffset, + const char *name, uint64_t addr, uint64_t size); + /** * fdt_delprop - delete a property * @fdt: pointer to the device tree blob diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index da9565891..4b4d2aeef 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -51,6 +51,17 @@ config INTEGRITY_TRUSTED_KEYRING .evm keyrings be signed by a key on the system trusted keyring. +config INTEGRITY_PLATFORM_KEYRING + bool "Provide keyring for platform/firmware trusted keys" + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on EFI + help + Provide a separate, distinct keyring for platform trusted keys, which + the kernel automatically populates during initialization from values + provided by the platform for verifying the kexec'ed kerned image + and, possibly, the initramfs signature. + config INTEGRITY_AUDIT bool "Enables integrity auditing support " depends on AUDIT diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 04d6e462b..86df9aba8 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -9,6 +9,11 @@ integrity-y := iint.o integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o +integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o \ + platform_certs/efi_parser.o \ + platform_certs/load_uefi.o +obj-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/load_uefi.o +$(obj)/load_uefi.o: KBUILD_CFLAGS += -fshort-wchar subdir-$(CONFIG_IMA) += ima obj-$(CONFIG_IMA) += ima/ diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 9bb0a7f28..c585ca8db 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -35,6 +35,7 @@ static const char *keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif "_module", + ".platform", }; #ifdef CONFIG_INTEGRITY_TRUSTED_KEYRING @@ -79,12 +80,42 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, return -EOPNOTSUPP; } -int __init integrity_init_keyring(const unsigned int id) +static int __init __integrity_init_keyring(const unsigned int id, + key_perm_t perm, + struct key_restriction *restriction) { const struct cred *cred = current_cred(); - struct key_restriction *restriction; int err = 0; + keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0), + KGIDT_INIT(0), cred, perm, + KEY_ALLOC_NOT_IN_QUOTA, restriction, NULL); + if (IS_ERR(keyring[id])) { + err = PTR_ERR(keyring[id]); + pr_info("Can't allocate %s keyring (%d)\n", + keyring_name[id], err); + keyring[id] = NULL; + } else { + if (id == INTEGRITY_KEYRING_PLATFORM) + set_platform_trusted_keys(keyring[id]); + } + + return err; +} + +int __init integrity_init_keyring(const unsigned int id) +{ + struct key_restriction *restriction; + key_perm_t perm; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW + | KEY_USR_READ | KEY_USR_SEARCH; + + if (id == INTEGRITY_KEYRING_PLATFORM) { + restriction = NULL; + goto out; + } + if (!init_keyring) return 0; @@ -93,32 +124,43 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; + perm |= KEY_USR_WRITE; - keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0), - KGIDT_INIT(0), cred, - ((KEY_POS_ALL & ~KEY_POS_SETATTR) | - KEY_USR_VIEW | KEY_USR_READ | - KEY_USR_WRITE | KEY_USR_SEARCH), - KEY_ALLOC_NOT_IN_QUOTA, - restriction, NULL); - if (IS_ERR(keyring[id])) { - err = PTR_ERR(keyring[id]); - pr_info("Can't allocate %s keyring (%d)\n", - keyring_name[id], err); - keyring[id] = NULL; +out: + return __integrity_init_keyring(id, perm, restriction); +} + +int __init integrity_add_key(const unsigned int id, const void *data, + off_t size, key_perm_t perm) +{ + key_ref_t key; + int rc = 0; + + if (!keyring[id]) + return -EINVAL; + + key = key_create_or_update(make_key_ref(keyring[id], 1), "asymmetric", + NULL, data, size, perm, + KEY_ALLOC_NOT_IN_QUOTA); + if (IS_ERR(key)) { + rc = PTR_ERR(key); + pr_err("Problem loading X.509 certificate %d\n", rc); + } else { + pr_notice("Loaded X.509 cert '%s'\n", + key_ref_to_ptr(key)->description); + key_ref_put(key); } - return err; + + return rc; + } int __init integrity_load_x509(const unsigned int id, const char *path) { - key_ref_t key; void *data; loff_t size; int rc; - - if (!keyring[id]) - return -EINVAL; + key_perm_t perm; rc = kernel_read_file_from_path(path, &data, &size, 0, READING_X509_CERTIFICATE); @@ -127,23 +169,21 @@ int __init integrity_load_x509(const unsigned int id, const char *path) return rc; } - key = key_create_or_update(make_key_ref(keyring[id], 1), - "asymmetric", - NULL, - data, - size, - ((KEY_POS_ALL & ~KEY_POS_SETATTR) | - KEY_USR_VIEW | KEY_USR_READ), - KEY_ALLOC_NOT_IN_QUOTA); - if (IS_ERR(key)) { - rc = PTR_ERR(key); - pr_err("Problem loading X.509 certificate (%d): %s\n", - rc, path); - } else { - pr_notice("Loaded X.509 cert '%s': %s\n", - key_ref_to_ptr(key)->description, path); - key_ref_put(key); - } + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ; + + pr_info("Loading X.509 certificate: %s\n", path); + rc = integrity_add_key(id, (const void *)data, size, perm); + vfree(data); - return 0; + return rc; +} + +int __init integrity_load_cert(const unsigned int id, const char *source, + const void *data, size_t len, key_perm_t perm) +{ + if (!data) + return -EINVAL; + + pr_info("Loading X.509 certificate: %s\n", source); + return integrity_add_key(id, data, len, perm); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 08aabf763..ad285f17d 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -294,12 +294,22 @@ int ima_appraise_measurement(enum ima_hooks func, case EVM_IMA_XATTR_DIGSIG: set_bit(IMA_DIGSIG, &iint->atomic_flags); rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA, - (const char *)xattr_value, rc, + (const char *)xattr_value, + xattr_len, iint->ima_hash->digest, iint->ima_hash->length); if (rc == -EOPNOTSUPP) { status = INTEGRITY_UNKNOWN; - } else if (rc) { + break; + } + if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc && + func == KEXEC_KERNEL_CHECK) + rc = integrity_digsig_verify(INTEGRITY_KEYRING_PLATFORM, + (const char *)xattr_value, + xattr_len, + iint->ima_hash->digest, + iint->ima_hash->length); + if (rc) { cause = "invalid-signature"; status = INTEGRITY_FAIL; } else { diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 0ec551223..0750bab0d 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -142,7 +142,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_MODULE 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_PLATFORM 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -153,6 +154,8 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, int __init integrity_init_keyring(const unsigned int id); int __init integrity_load_x509(const unsigned int id, const char *path); +int __init integrity_load_cert(const unsigned int id, const char *source, + const void *data, size_t len, key_perm_t perm); #else static inline int integrity_digsig_verify(const unsigned int id, @@ -166,6 +169,14 @@ static inline int integrity_init_keyring(const unsigned int id) { return 0; } + +static inline int __init integrity_load_cert(const unsigned int id, + const char *source, + const void *data, size_t len, + key_perm_t perm) +{ + return 0; +} #endif /* CONFIG_INTEGRITY_SIGNATURE */ #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS @@ -222,3 +233,13 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type) } #endif + +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING +void __init add_to_platform_keyring(const char *source, const void *data, + size_t len); +#else +static inline void __init add_to_platform_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/efi_parser.c b/security/integrity/platform_certs/efi_parser.c new file mode 100644 index 000000000..18f01f36f --- /dev/null +++ b/security/integrity/platform_certs/efi_parser.c @@ -0,0 +1,108 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* EFI signature/key/certificate list parser + * + * Copyright (C) 2012, 2016 Red Hat, Inc. All Rights Reserved. + * Written by David Howells (dhowells(a)redhat.com) + */ + +#define pr_fmt(fmt) "EFI: "fmt +#include <linux/module.h> +#include <linux/printk.h> +#include <linux/err.h> +#include <linux/efi.h> + +/** + * parse_efi_signature_list - Parse an EFI signature list for certificates + * @source: The source of the key + * @data: The data blob to parse + * @size: The size of the data blob + * @get_handler_for_guid: Get the handler func for the sig type (or NULL) + * + * Parse an EFI signature list looking for elements of interest. A list is + * made up of a series of sublists, where all the elements in a sublist are of + * the same type, but sublists can be of different types. + * + * For each sublist encountered, the @get_handler_for_guid function is called + * with the type specifier GUID and returns either a pointer to a function to + * handle elements of that type or NULL if the type is not of interest. + * + * If the sublist is of interest, each element is passed to the handler + * function in turn. + * + * Error EBADMSG is returned if the list doesn't parse correctly and 0 is + * returned if the list was parsed correctly. No error can be returned from + * the @get_handler_for_guid function or the element handler function it + * returns. + */ +int __init parse_efi_signature_list( + const char *source, + const void *data, size_t size, + efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *)) +{ + efi_element_handler_t handler; + unsigned int offs = 0; + + pr_devel("-->%s(,%zu)\n", __func__, size); + + while (size > 0) { + const efi_signature_data_t *elem; + efi_signature_list_t list; + size_t lsize, esize, hsize, elsize; + + if (size < sizeof(list)) + return -EBADMSG; + + memcpy(&list, data, sizeof(list)); + pr_devel("LIST[%04x] guid=%pUl ls=%x hs=%x ss=%x\n", + offs, + list.signature_type.b, list.signature_list_size, + list.signature_header_size, list.signature_size); + + lsize = list.signature_list_size; + hsize = list.signature_header_size; + esize = list.signature_size; + elsize = lsize - sizeof(list) - hsize; + + if (lsize > size) { + pr_devel("<--%s() = -EBADMSG [overrun @%x]\n", + __func__, offs); + return -EBADMSG; + } + + if (lsize < sizeof(list) || + lsize - sizeof(list) < hsize || + esize < sizeof(*elem) || + elsize < esize || + elsize % esize != 0) { + pr_devel("- bad size combo @%x\n", offs); + return -EBADMSG; + } + + handler = get_handler_for_guid(&list.signature_type); + if (!handler) { + data += lsize; + size -= lsize; + offs += lsize; + continue; + } + + data += sizeof(list) + hsize; + size -= sizeof(list) + hsize; + offs += sizeof(list) + hsize; + + for (; elsize > 0; elsize -= esize) { + elem = data; + + pr_devel("ELEM[%04x]\n", offs); + handler(source, + &elem->signature_data, + esize - sizeof(*elem)); + + data += esize; + size -= esize; + offs += esize; + } + } + + return 0; +} diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c new file mode 100644 index 000000000..81b19c528 --- /dev/null +++ b/security/integrity/platform_certs/load_uefi.c @@ -0,0 +1,194 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/kernel.h> +#include <linux/sched.h> +#include <linux/cred.h> +#include <linux/err.h> +#include <linux/efi.h> +#include <linux/slab.h> +#include <keys/asymmetric-type.h> +#include <keys/system_keyring.h> +#include "../integrity.h" + +static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; +static efi_guid_t efi_cert_x509_sha256_guid __initdata = + EFI_CERT_X509_SHA256_GUID; +static efi_guid_t efi_cert_sha256_guid __initdata = EFI_CERT_SHA256_GUID; + +/* + * Look to see if a UEFI variable called MokIgnoreDB exists and return true if + * it does. + * + * This UEFI variable is set by the shim if a user tells the shim to not use + * the certs/hashes in the UEFI db variable for verification purposes. If it + * is set, we should ignore the db variable also and the true return indicates + * this. + */ +static __init bool uefi_check_ignore_db(void) +{ + efi_status_t status; + unsigned int db = 0; + unsigned long size = sizeof(db); + efi_guid_t guid = EFI_SHIM_LOCK_GUID; + + status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db); + return status == EFI_SUCCESS; +} + +/* + * Get a certificate list blob from the named EFI variable. + */ +static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, + unsigned long *size) +{ + efi_status_t status; + unsigned long lsize = 4; + unsigned long tmpdb[4]; + void *db; + + status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); + if (status != EFI_BUFFER_TOO_SMALL) { + pr_err("Couldn't get size: 0x%lx\n", status); + return NULL; + } + + db = kmalloc(lsize, GFP_KERNEL); + if (!db) + return NULL; + + status = efi.get_variable(name, guid, NULL, &lsize, db); + if (status != EFI_SUCCESS) { + kfree(db); + pr_err("Error reading db var: 0x%lx\n", status); + return NULL; + } + + *size = lsize; + return db; +} + +/* + * Blacklist a hash. + */ +static __init void uefi_blacklist_hash(const char *source, const void *data, + size_t len, const char *type, + size_t type_len) +{ + char *hash, *p; + + hash = kmalloc(type_len + len * 2 + 1, GFP_KERNEL); + if (!hash) + return; + p = memcpy(hash, type, type_len); + p += type_len; + bin2hex(p, data, len); + p += len * 2; + *p = 0; + + mark_hash_blacklisted(hash); + kfree(hash); +} + +/* + * Blacklist an X509 TBS hash. + */ +static __init void uefi_blacklist_x509_tbs(const char *source, + const void *data, size_t len) +{ + uefi_blacklist_hash(source, data, len, "tbs:", 4); +} + +/* + * Blacklist the hash of an executable. + */ +static __init void uefi_blacklist_binary(const char *source, + const void *data, size_t len) +{ + uefi_blacklist_hash(source, data, len, "bin:", 4); +} + +/* + * Return the appropriate handler for particular signature list types found in + * the UEFI db and MokListRT tables. + */ +static __init efi_element_handler_t get_handler_for_db(const efi_guid_t * + sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) + return add_to_platform_keyring; + return 0; +} + +/* + * Return the appropriate handler for particular signature list types found in + * the UEFI dbx and MokListXRT tables. + */ +static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t * + sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0) + return uefi_blacklist_x509_tbs; + if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0) + return uefi_blacklist_binary; + return 0; +} + +/* + * Load the certs contained in the UEFI databases into the platform trusted + * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist + * keyring. + */ +static int __init load_uefi_certs(void) +{ + efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; + efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; + void *db = NULL, *dbx = NULL, *mok = NULL; + unsigned long dbsize = 0, dbxsize = 0, moksize = 0; + int rc = 0; + + if (!efi.get_variable) + return false; + + /* Get db, MokListRT, and dbx. They might not exist, so it isn't + * an error if we can't get them. + */ + if (!uefi_check_ignore_db()) { + db = get_cert_list(L"db", &secure_var, &dbsize); + if (!db) { + pr_err("MODSIGN: Couldn't get UEFI db list\n"); + } else { + rc = parse_efi_signature_list("UEFI:db", + db, dbsize, get_handler_for_db); + if (rc) + pr_err("Couldn't parse db signatures: %d\n", + rc); + kfree(db); + } + } + + mok = get_cert_list(L"MokListRT", &mok_var, &moksize); + if (!mok) { + pr_info("Couldn't get UEFI MokListRT\n"); + } else { + rc = parse_efi_signature_list("UEFI:MokListRT", + mok, moksize, get_handler_for_db); + if (rc) + pr_err("Couldn't parse MokListRT signatures: %d\n", rc); + kfree(mok); + } + + dbx = get_cert_list(L"dbx", &secure_var, &dbxsize); + if (!dbx) { + pr_info("Couldn't get UEFI dbx list\n"); + } else { + rc = parse_efi_signature_list("UEFI:dbx", + dbx, dbxsize, + get_handler_for_dbx); + if (rc) + pr_err("Couldn't parse dbx signatures: %d\n", rc); + kfree(dbx); + } + + return rc; +} +late_initcall(load_uefi_certs); diff --git a/security/integrity/platform_certs/platform_keyring.c b/security/integrity/platform_certs/platform_keyring.c new file mode 100644 index 000000000..bcafd7387 --- /dev/null +++ b/security/integrity/platform_certs/platform_keyring.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Platform keyring for firmware/platform keys + * + * Copyright IBM Corporation, 2018 + * Author(s): Nayna Jain <nayna(a)linux.ibm.com> + */ + +#include <linux/export.h> +#include <linux/kernel.h> +#include <linux/sched.h> +#include <linux/cred.h> +#include <linux/err.h> +#include <linux/slab.h> +#include "../integrity.h" + +/** + * add_to_platform_keyring - Add to platform keyring without validation. + * @source: Source of key + * @data: The blob holding the key + * @len: The length of the data blob + * + * Add a key to the platform keyring without checking its trust chain. This + * is available only during kernel initialisation. + */ +void __init add_to_platform_keyring(const char *source, const void *data, + size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, data, len, + perm); + if (rc) + pr_info("Error adding keys to platform keyring %s\n", source); +} + +/* + * Create the trusted keyrings. + */ +static __init int platform_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_PLATFORM); + if (rc) + return rc; + + pr_notice("Platform Keyring initialized\n"); + return 0; +} + +/* + * Must be initialised before we try and load the keys into the keyring. + */ +device_initcall(platform_keyring_init); -- 2.27.0

2 35

[PATCH kernel-4.19] scsi: hisi_sas: set sense data when the sas disk's I/O abnormally completed
by Yang Yingliang 23 Sep '21

23 Sep '21

From: yangxingui <yangxingui(a)huawei.com> driver inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- The sense data of the sas disk is used by the kernel and upper layers to perform some policies on disks when the I/O is abnormally completed. Such as the logs as follow, if the driver transmit sense data to the upper layer, the disk may be repaired by remap policy of disk management system. [Wed Sep 15 13:03:04 2021] hisi_sas_v3_hw 0000:74:02.0: erroneous completion iptt=3342 task= pK-error dev id=0 sas_addr=0x5541310520e0b000 CQ hdr: 0x1503 0xd0e 0x0 0x20000 Error info: 0x1200 0x0 0x0 0x40 [Wed Sep 15 13:03:04 2021] hisi_sas_v3_hw 0000:74:02.0: data underflow, rsp_code:0x72, sensekey:0x3, ASC:0x11, ASCQ:0x0. Signed-off-by: yangxingui <yangxingui(a)huawei.com> Reviewed-by: ouyangdelong < ouyangdelong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 2 ++ drivers/scsi/hisi_sas/hisi_sas_main.c | 17 +++++++++++++++++ drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 + 3 files changed, 20 insertions(+) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index eae0e533ce7fc..193fc960d87fd 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -571,6 +571,8 @@ extern void hisi_sas_free(struct hisi_hba *hisi_hba); extern u8 hisi_sas_get_ata_protocol(struct host_to_dev_fis *fis, int direction); extern struct hisi_sas_port *to_hisi_sas_port(struct asd_sas_port *sas_port); +extern void hisi_sas_set_sense_data(struct sas_task *task, + struct hisi_sas_slot *slot); extern void hisi_sas_sata_done(struct sas_task *task, struct hisi_sas_slot *slot); extern int hisi_sas_get_fw_info(struct hisi_hba *hisi_hba); diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index f944371ac3133..51555cfc40578 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -105,6 +105,23 @@ u8 hisi_sas_get_ata_protocol(struct host_to_dev_fis *fis, int direction) } EXPORT_SYMBOL_GPL(hisi_sas_get_ata_protocol); +void hisi_sas_set_sense_data(struct sas_task *task, + struct hisi_sas_slot *slot) +{ + struct ssp_response_iu *iu = + hisi_sas_status_buf_addr_mem(slot) + + sizeof(struct hisi_sas_err_record); + if (iu->datapres == 2) { + struct task_status_struct *ts = &task->task_status; + + ts->buf_valid_size = + min_t(int, SAS_STATUS_BUF_SIZE, + be32_to_cpu(iu->sense_data_len)); + memcpy(ts->buf, iu->sense_data, ts->buf_valid_size); + } +} +EXPORT_SYMBOL_GPL(hisi_sas_set_sense_data); + void hisi_sas_sata_done(struct sas_task *task, struct hisi_sas_slot *slot) { diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index a9f53dbb91679..06b4f2db62f7b 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -2234,6 +2234,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task, ts->stat = SAS_OPEN_REJECT; ts->open_rej_reason = SAS_OREJ_RSVD_RETRY; } + hisi_sas_set_sense_data(task, slot); break; case SAS_PROTOCOL_SATA: case SAS_PROTOCOL_STP: -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] kyber: introduce kyber_depth_updated()
by Yang Yingliang 23 Sep '21

23 Sep '21

From: Yang Yang <yang.yang(a)vivo.com> mainline inclusion from mainline-5.12-rc1 commit ffa772cfe9356ce94d3061335c2681f60e7c1c5b category: bugfix bugzilla: 182133 CVE: NA ------------------------------------------------- Hang occurs when user changes the scheduler queue depth, by writing to the 'nr_requests' sysfs file of that device. The details of the environment that we found the problem are as follows: an eMMC block device total driver tags: 16 default queue_depth: 32 kqd->async_depth initialized in kyber_init_sched() with queue_depth=32 Then we change queue_depth to 256, by writing to the 'nr_requests' sysfs file. But kqd->async_depth don't be updated after queue_depth changes. Now the value of async depth is too small for queue_depth=256, this may cause hang. This patch introduces kyber_depth_updated(), so that kyber can update async depth when queue depth changes. Signed-off-by: Yang Yang <yang.yang(a)vivo.com> Reviewed-by: Omar Sandoval <osandov(a)fb.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/kyber-iosched.c Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/kyber-iosched.c | 29 +++++++++++++---------------- 1 file changed, 13 insertions(+), 16 deletions(-) diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c index a1660bafc9124..9eeb60d97f0ca 100644 --- a/block/kyber-iosched.c +++ b/block/kyber-iosched.c @@ -288,15 +288,6 @@ static void kyber_stat_timer_fn(struct blk_stat_callback *cb) blk_stat_activate_msecs(kqd->cb, 100); } -static unsigned int kyber_sched_tags_shift(struct kyber_queue_data *kqd) -{ - /* - * All of the hardware queues have the same depth, so we can just grab - * the shift of the first one. - */ - return kqd->q->queue_hw_ctx[0]->sched_tags->bitmap_tags.sb.shift; -} - static int kyber_bucket_fn(const struct request *rq) { return kyber_sched_domain(rq->cmd_flags); @@ -306,7 +297,6 @@ static struct kyber_queue_data *kyber_queue_data_alloc(struct request_queue *q) { struct kyber_queue_data *kqd; unsigned int max_tokens; - unsigned int shift; int ret = -ENOMEM; int i; @@ -341,9 +331,6 @@ static struct kyber_queue_data *kyber_queue_data_alloc(struct request_queue *q) sbitmap_queue_resize(&kqd->domain_tokens[i], kyber_depth[i]); } - shift = kyber_sched_tags_shift(kqd); - kqd->async_depth = (1U << shift) * KYBER_ASYNC_PERCENT / 100U; - kqd->read_lat_nsec = 2000000ULL; kqd->write_lat_nsec = 10000000ULL; @@ -403,9 +390,19 @@ static void kyber_ctx_queue_init(struct kyber_ctx_queue *kcq) INIT_LIST_HEAD(&kcq->rq_list[i]); } -static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) +static void kyber_depth_updated(struct blk_mq_hw_ctx *hctx) { struct kyber_queue_data *kqd = hctx->queue->elevator->elevator_data; + struct blk_mq_tags *tags = hctx->sched_tags; + unsigned int shift = tags->bitmap_tags.sb.shift; + + kqd->async_depth = (1U << shift) * KYBER_ASYNC_PERCENT / 100U; + + sbitmap_queue_min_shallow_depth(&tags->bitmap_tags, kqd->async_depth); +} + +static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) +{ struct kyber_hctx_data *khd; int i; @@ -446,8 +443,7 @@ static int kyber_init_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) khd->batching = 0; hctx->sched_data = khd; - sbitmap_queue_min_shallow_depth(&hctx->sched_tags->bitmap_tags, - kqd->async_depth); + kyber_depth_updated(hctx); return 0; @@ -966,6 +962,7 @@ static struct elevator_type kyber_sched = { .completed_request = kyber_completed_request, .dispatch_request = kyber_dispatch_request, .has_work = kyber_has_work, + .depth_updated = kyber_depth_updated, }, .uses_mq = true, #ifdef CONFIG_BLK_DEBUG_FS -- 2.25.1

1 1

[PATCH kernel-4.19 openEuler-1.0-LTS] blk-mq: handle all throttled io in blk_cleanup_queue()
by Cheng Jian 22 Sep '21

22 Sep '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 182132 CVE: NA ------------------------------------------------- All throttled io will never be issued after blk_throtl_exit() in blk_cleanup_queue(), which will lead to hung. Thus handle throttled io before calling blk_throtl_exit() from blk_exit_queue(). Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> --- block/blk-core.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/block/blk-core.c b/block/blk-core.c index 9d2a5a8c78d4..dd3719be9581 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -783,6 +783,16 @@ void blk_cleanup_queue(struct request_queue *q) */ blk_freeze_queue(q); + /* + * All throttled io will never be issued after blk_throtl_exit(), which + * will lead to hung. Thus we need to issue them before calling + * blk_throtl_exit() from blk_exit_queue(). + */ + if (q->mq_ops) { + spin_lock_irq(lock); + blkcg_drain_queue(q); + spin_unlock_irq(lock); + } rq_qos_exit(q); spin_lock_irq(lock); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/7] memcg: enable accounting for pids in nested pid namespaces
by Yang Yingliang 22 Sep '21

22 Sep '21

From: Vasily Averin <vvs(a)virtuozzo.com> mainline inclusion from mainline-v5.15-rc1 commit fab827dbee8c2e06ca4ba000fa6c48bcf9054aba category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4A0WD CVE: NA -------------------------------- Commit 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg") enabled memcg accounting for pids allocated from init_pid_ns.pid_cachep, but forgot to adjust the setting for nested pid namespaces. As a result, pid memory is not accounted exactly where it is really needed, inside memcg-limited containers with their own pid namespaces. Pid was one the first kernel objects enabled for memcg accounting. init_pid_ns.pid_cachep marked by SLAB_ACCOUNT and we can expect that any new pids in the system are memcg-accounted. Though recently I've noticed that it is wrong. nested pid namespaces creates own slab caches for pid objects, nested pids have increased size because contain id both for all parent and for own pid namespaces. The problem is that these slab caches are _NOT_ marked by SLAB_ACCOUNT, as a result any pids allocated in nested pid namespaces are not memcg-accounted. Pid struct in nested pid namespace consumes up to 500 bytes memory, 100000 such objects gives us up to ~50Mb unaccounted memory, this allow container to exceed assigned memcg limits. Link: https://lkml.kernel.org/r/8b6de616-fd1a-02c6-cbdb-976ecdcfa604@virtuozzo.com Fixes: 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg") Cc: stable(a)vger.kernel.org Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Reviewed-by: Michal Koutný <mkoutny(a)suse.com> Reviewed-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com> Acked-by: Roman Gushchin <guro(a)fb.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Li Ming <limingming.li(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/pid_namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index dd7a0e41d4016..ad95ca43b51ee 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -52,7 +52,8 @@ static struct kmem_cache *create_pid_cachep(unsigned int level) mutex_lock(&pid_caches_mutex); /* Name collision forces to do allocation under mutex. */ if (!*pkc) - *pkc = kmem_cache_create(name, len, 0, SLAB_HWCACHE_ALIGN, 0); + *pkc = kmem_cache_create(name, len, 0, + SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, 0); mutex_unlock(&pid_caches_mutex); /* current can fail, but someone else can succeed. */ return READ_ONCE(*pkc); -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS] KVM: do not allow mapping valid but non-reference-counted pages
by Yang Yingliang 22 Sep '21

22 Sep '21

From: Nicholas Piggin <npiggin(a)gmail.com> stable inclusion from linux-4.19.199 commit 117777467bc015f0dc5fc079eeba0fa80c965149 CVE: CVE-2021-22543 -------------------------------- commit f8be156be163a052a067306417cd0ff679068c97 upstream. It's possible to create a region which maps valid but non-refcounted pages (e.g., tail pages of non-compound higher order allocations). These host pages can then be returned by gfn_to_page, gfn_to_pfn, etc., family of APIs, which take a reference to the page, which takes it from 0 to 1. When the reference is dropped, this will free the page incorrectly. Fix this by only taking a reference on valid pages if it was non-zero, which indicates it is participating in normal refcounting (and can be released with put_page). This addresses CVE-2021-22543. Signed-off-by: Nicholas Piggin <npiggin(a)gmail.com> Tested-by: Paolo Bonzini <pbonzini(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ovidiu Panait <ovidiu.panait(a)windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- virt/kvm/kvm_main.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 20c53b5cf4837..78bcd465c4f4f 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -1484,6 +1484,13 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault) return true; } +static int kvm_try_get_pfn(kvm_pfn_t pfn) +{ + if (kvm_is_reserved_pfn(pfn)) + return 1; + return get_page_unless_zero(pfn_to_page(pfn)); +} + static int hva_to_pfn_remapped(struct vm_area_struct *vma, unsigned long addr, bool *async, bool write_fault, bool *writable, @@ -1526,11 +1533,19 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma, * Whoever called remap_pfn_range is also going to call e.g. * unmap_mapping_range before the underlying pages are freed, * causing a call to our MMU notifier. + * + * Certain IO or PFNMAP mappings can be backed with valid + * struct pages, but be allocated without refcounting e.g., + * tail pages of non-compound higher order allocations, which + * would then underflow the refcount when the caller does the + * required put_page. Don't allow those pages here. */ - kvm_get_pfn(pfn); + if (!kvm_try_get_pfn(pfn)) + r = -EFAULT; *p_pfn = pfn; - return 0; + + return r; } /* -- 2.25.1

1 0

[PATCH kernel-4.19 1/7] memcg: enable accounting for pids in nested pid namespaces
by Yang Yingliang 22 Sep '21

22 Sep '21

From: Vasily Averin <vvs(a)virtuozzo.com> mainline inclusion from mainline-v5.15-rc1 commit fab827dbee8c2e06ca4ba000fa6c48bcf9054aba category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4A0WD CVE: NA -------------------------------- Commit 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg") enabled memcg accounting for pids allocated from init_pid_ns.pid_cachep, but forgot to adjust the setting for nested pid namespaces. As a result, pid memory is not accounted exactly where it is really needed, inside memcg-limited containers with their own pid namespaces. Pid was one the first kernel objects enabled for memcg accounting. init_pid_ns.pid_cachep marked by SLAB_ACCOUNT and we can expect that any new pids in the system are memcg-accounted. Though recently I've noticed that it is wrong. nested pid namespaces creates own slab caches for pid objects, nested pids have increased size because contain id both for all parent and for own pid namespaces. The problem is that these slab caches are _NOT_ marked by SLAB_ACCOUNT, as a result any pids allocated in nested pid namespaces are not memcg-accounted. Pid struct in nested pid namespace consumes up to 500 bytes memory, 100000 such objects gives us up to ~50Mb unaccounted memory, this allow container to exceed assigned memcg limits. Link: https://lkml.kernel.org/r/8b6de616-fd1a-02c6-cbdb-976ecdcfa604@virtuozzo.com Fixes: 5d097056c9a0 ("kmemcg: account certain kmem allocations to memcg") Cc: stable(a)vger.kernel.org Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Reviewed-by: Michal Koutný <mkoutny(a)suse.com> Reviewed-by: Shakeel Butt <shakeelb(a)google.com> Acked-by: Christian Brauner <christian.brauner(a)ubuntu.com> Acked-by: Roman Gushchin <guro(a)fb.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Li Ming <limingming.li(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/pid_namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index dd7a0e41d4016..ad95ca43b51ee 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -52,7 +52,8 @@ static struct kmem_cache *create_pid_cachep(unsigned int level) mutex_lock(&pid_caches_mutex); /* Name collision forces to do allocation under mutex. */ if (!*pkc) - *pkc = kmem_cache_create(name, len, 0, SLAB_HWCACHE_ALIGN, 0); + *pkc = kmem_cache_create(name, len, 0, + SLAB_HWCACHE_ALIGN | SLAB_ACCOUNT, 0); mutex_unlock(&pid_caches_mutex); /* current can fail, but someone else can succeed. */ return READ_ONCE(*pkc); -- 2.25.1

1 6

[PATCH] arm64 support kexec -l -s
by xuhuijie 22 Sep '21

22 Sep '21

support arm64 kexec_file(23): kexec_file: add kexec_file_load system call to unistd.h kexec_file: make kexec_image_post_load_cleanup_default() global kexec_file: drop arch_kexec_mem_walk() kexec_file: factor out memblock-based arch_kexec_walk_mem() kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump kexec_file: add image head flag definitions kexec_file: cpufeature: add MMFR0 helper functions kexec_file: enable KEXEC_FILE config kexec_file: load initrd and device-tree kexec_file: allow for loading Image-format kernel kexec_file: invoke the kernel without purgatory kexec_file: pe.h: remove message[] from mz header definition kexec_file: add kernel signature verification support kexec_file: add kaslr support kexec_file: forbid kdump via kexec_file_load() kexec_file: include fdt_addresses.c kexec_file: include linux/vmalloc.h kexec_file: Refactor setup_dtb() to consolidate error checking kexec_file: add rng-seed support kexec_file: add crash dump support kexec_file: Update to upstream version v1.5.0-23-g87963ee20693 kexec_file: handle empty command-line kexec_file: fix memory leakage in create_dtb() when fdt_open_into() fails support arm64 platform keyring(10): integrity: Define a trusted platform keyring integrity: Load certs to the platform keyring integrity: Add EFI signature data types integrity: Add an EFI signature blob parser integrity: Import certificates from UEFI Secure Boot integrity: Allow the "db" UEFI variable to be suppressed integrity: Support platform keyring for kernel appraisal integrity, KEYS: add a reference to platform keyring integrity: Make use of platform keyring for signature verify integrity: Fix __integrity_init_keyring() section mismatch fix kabi(1): kexec_file: fix kabi because of the new system call sys_kexec_file_load --- arch/arm64/Kconfig | 33 ++ arch/arm64/include/asm/cpufeature.h | 48 +++ arch/arm64/include/asm/image.h | 59 +++ arch/arm64/include/asm/kexec.h | 23 ++ arch/arm64/kernel/Makefile | 3 +- arch/arm64/kernel/cpu-reset.S | 8 +- arch/arm64/kernel/head.S | 3 +- arch/arm64/kernel/image.h | 21 +- arch/arm64/kernel/kexec_image.c | 126 +++++++ arch/arm64/kernel/machine_kexec.c | 12 +- arch/arm64/kernel/machine_kexec_file.c | 342 ++++++++++++++++++ arch/arm64/kernel/relocate_kernel.S | 3 +- arch/powerpc/kernel/machine_kexec_file_64.c | 54 --- arch/s390/kernel/machine_kexec_file.c | 10 - arch/x86/kernel/kexec-bzimage64.c | 14 +- certs/system_keyring.c | 23 +- include/keys/system_keyring.h | 8 + include/linux/efi.h | 34 ++ include/linux/kexec.h | 15 +- include/linux/pe.h | 2 +- include/linux/verification.h | 1 + include/uapi/linux/kexec.h | 1 + kernel/kexec.c | 10 + kernel/kexec_file.c | 160 +++++++- lib/Makefile | 2 +- lib/fdt_addresses.c | 2 + scripts/dtc/libfdt/fdt_addresses.c | 47 +++ scripts/dtc/libfdt/libfdt.h | 61 ++++ security/integrity/Kconfig | 11 + security/integrity/Makefile | 5 + security/integrity/digsig.c | 114 ++++-- security/integrity/ima/ima_appraise.c | 14 +- security/integrity/integrity.h | 23 +- .../integrity/platform_certs/efi_parser.c | 108 ++++++ security/integrity/platform_certs/load_uefi.c | 194 ++++++++++ .../platform_certs/platform_keyring.c | 58 +++ 36 files changed, 1518 insertions(+), 134 deletions(-) create mode 100644 arch/arm64/include/asm/image.h create mode 100644 arch/arm64/kernel/kexec_image.c create mode 100644 arch/arm64/kernel/machine_kexec_file.c create mode 100644 lib/fdt_addresses.c create mode 100644 security/integrity/platform_certs/efi_parser.c create mode 100644 security/integrity/platform_certs/load_uefi.c create mode 100644 security/integrity/platform_certs/platform_keyring.c diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 9dfbd052b..5381d21bb 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -957,6 +957,39 @@ config KEXEC but it is independent of the system firmware. And like a reboot you can start any kernel with it, not just Linux. +config KEXEC_FILE + bool "kexec file based system call" + select KEXEC_CORE + help + This is new version of kexec system call. This system call is + file based and takes file descriptors as system call argument + for kernel and initramfs as opposed to list of segments as + accepted by previous system call. + +config KEXEC_VERIFY_SIG + bool "Verify kernel signature during kexec_file_load() syscall" + depends on KEXEC_FILE + help + Select this option to verify a signature with loaded kernel + image. If configured, any attempt of loading a image without + valid signature will fail. + + In addition to that option, you need to enable signature + verification for the corresponding kernel image type being + loaded in order for this to work. + +config KEXEC_IMAGE_VERIFY_SIG + bool "Enable Image signature verification support" + default y + depends on KEXEC_VERIFY_SIG + depends on EFI && SIGNED_PE_FILE_VERIFICATION + help + Enable Image signature verification support. + +comment "Support for PE file signature verification disabled" + depends on KEXEC_VERIFY_SIG + depends on !EFI || !SIGNED_PE_FILE_VERIFICATION + config CRASH_DUMP bool "Build kdump crash kernel" help diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index c43d02365..211aa994b 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -497,11 +497,59 @@ static inline bool system_supports_32bit_el0(void) return cpus_have_const_cap(ARM64_HAS_32BIT_EL0); } +static inline bool system_supports_4kb_granule(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_TGRAN4_SHIFT); + + return val == ID_AA64MMFR0_TGRAN4_SUPPORTED; +} + +static inline bool system_supports_64kb_granule(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_TGRAN64_SHIFT); + + return val == ID_AA64MMFR0_TGRAN64_SUPPORTED; +} + +static inline bool system_supports_16kb_granule(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_TGRAN16_SHIFT); + + return val == ID_AA64MMFR0_TGRAN16_SUPPORTED; +} + static inline bool system_supports_mixed_endian_el0(void) { return id_aa64mmfr0_mixed_endian_el0(read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1)); } +static inline bool system_supports_mixed_endian(void) +{ + u64 mmfr0; + u32 val; + + mmfr0 = read_sanitised_ftr_reg(SYS_ID_AA64MMFR0_EL1); + val = cpuid_feature_extract_unsigned_field(mmfr0, + ID_AA64MMFR0_BIGENDEL_SHIFT); + + return val == 0x1; +} + static inline bool system_supports_fpsimd(void) { return !cpus_have_const_cap(ARM64_HAS_NO_FPSIMD); diff --git a/arch/arm64/include/asm/image.h b/arch/arm64/include/asm/image.h new file mode 100644 index 000000000..e2c27a227 --- /dev/null +++ b/arch/arm64/include/asm/image.h @@ -0,0 +1,59 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#ifndef __ASM_IMAGE_H +#define __ASM_IMAGE_H + +#define ARM64_IMAGE_MAGIC "ARM\x64" + +#define ARM64_IMAGE_FLAG_BE_SHIFT 0 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_SHIFT (ARM64_IMAGE_FLAG_BE_SHIFT + 1) +#define ARM64_IMAGE_FLAG_PHYS_BASE_SHIFT \ + (ARM64_IMAGE_FLAG_PAGE_SIZE_SHIFT + 2) +#define ARM64_IMAGE_FLAG_BE_MASK 0x1 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_MASK 0x3 +#define ARM64_IMAGE_FLAG_PHYS_BASE_MASK 0x1 + +#define ARM64_IMAGE_FLAG_LE 0 +#define ARM64_IMAGE_FLAG_BE 1 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_4K 1 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_16K 2 +#define ARM64_IMAGE_FLAG_PAGE_SIZE_64K 3 +#define ARM64_IMAGE_FLAG_PHYS_BASE 1 + +#ifndef __ASSEMBLY__ + +#define arm64_image_flag_field(flags, field) \ + (((flags) >> field##_SHIFT) & field##_MASK) + +/* + * struct arm64_image_header - arm64 kernel image header + * See Documentation/arm64/booting.txt for details + * + * @code0: Executable code, or + * @mz_header alternatively used for part of MZ header + * @code1: Executable code + * @text_offset: Image load offset + * @image_size: Effective Image size + * @flags: kernel flags + * @reserved: reserved + * @magic: Magic number + * @reserved5: reserved, or + * @pe_header: alternatively used for PE COFF offset + */ + +struct arm64_image_header { + __le32 code0; + __le32 code1; + __le64 text_offset; + __le64 image_size; + __le64 flags; + __le64 res2; + __le64 res3; + __le64 res4; + __le32 magic; + __le32 res5; +}; + +#endif /* __ASSEMBLY__ */ + +#endif /* __ASM_IMAGE_H */ diff --git a/arch/arm64/include/asm/kexec.h b/arch/arm64/include/asm/kexec.h index 30ab1fa34..286950227 100644 --- a/arch/arm64/include/asm/kexec.h +++ b/arch/arm64/include/asm/kexec.h @@ -101,6 +101,29 @@ static inline void crash_prepare_suspend(void) {} static inline void crash_post_resume(void) {} #endif +#ifdef CONFIG_KEXEC_FILE +#define ARCH_HAS_KIMAGE_ARCH + +struct kimage_arch { + void *dtb; + unsigned long dtb_mem; + /* Core ELF header buffer */ + void *elf_headers; + unsigned long elf_headers_mem; + unsigned long elf_headers_sz; +}; + +extern const struct kexec_file_ops kexec_image_ops; + +struct kimage; + +extern int arch_kimage_file_post_load_cleanup(struct kimage *image); +extern int load_other_segments(struct kimage *image, + unsigned long kernel_load_addr, unsigned long kernel_size, + char *initrd, unsigned long initrd_len, + char *cmdline); +#endif + void machine_kexec_mask_interrupts(void); #endif /* __ASSEMBLY__ */ diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index fe759f364..2e21303b6 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -54,8 +54,9 @@ arm64-obj-$(CONFIG_ARM64_ACPI_PARKING_PROTOCOL) += acpi_parking_protocol.o arm64-obj-$(CONFIG_PARAVIRT) += paravirt.o paravirt-spinlocks.o arm64-obj-$(CONFIG_RANDOMIZE_BASE) += kaslr.o arm64-obj-$(CONFIG_HIBERNATION) += hibernate.o hibernate-asm.o -arm64-obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o \ +arm64-obj-$(CONFIG_KEXEC_CORE) += machine_kexec.o relocate_kernel.o \ cpu-reset.o +arm64-obj-$(CONFIG_KEXEC_FILE) += machine_kexec_file.o kexec_image.o arm64-obj-$(CONFIG_ARM64_CPU_PARK) += cpu-park.o arm64-obj-$(CONFIG_ARM64_RELOC_TEST) += arm64-reloc-test.o arm64-reloc-test-y := reloc_test_core.o reloc_test_syms.o diff --git a/arch/arm64/kernel/cpu-reset.S b/arch/arm64/kernel/cpu-reset.S index 8021b46c9..a2be30275 100644 --- a/arch/arm64/kernel/cpu-reset.S +++ b/arch/arm64/kernel/cpu-reset.S @@ -22,11 +22,11 @@ * __cpu_soft_restart(el2_switch, entry, arg0, arg1, arg2) - Helper for * cpu_soft_restart. * - * @el2_switch: Flag to indicate a swich to EL2 is needed. + * @el2_switch: Flag to indicate a switch to EL2 is needed. * @entry: Location to jump to for soft reset. - * arg0: First argument passed to @entry. - * arg1: Second argument passed to @entry. - * arg2: Third argument passed to @entry. + * arg0: First argument passed to @entry. (relocation list) + * arg1: Second argument passed to @entry.(physical kernel entry) + * arg2: Third argument passed to @entry. (physical dtb address) * * Put the CPU into the same state as it would be if it had been reset, and * branch to what would be the reset vector. It must be executed with the diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index 34bd0790d..5edfb9cfd 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -31,6 +31,7 @@ #include <asm/cache.h> #include <asm/cputype.h> #include <asm/elf.h> +#include <asm/image.h> #include <asm/kernel-pgtable.h> #include <asm/kvm_arm.h> #include <asm/memory.h> @@ -91,7 +92,7 @@ _head: .quad 0 // reserved .quad 0 // reserved .quad 0 // reserved - .ascii "ARM\x64" // Magic number + .ascii ARM64_IMAGE_MAGIC // Magic number #ifdef CONFIG_EFI .long pe_header - _head // Offset to the PE header. diff --git a/arch/arm64/kernel/image.h b/arch/arm64/kernel/image.h index eff6a564a..b22e8ad07 100644 --- a/arch/arm64/kernel/image.h +++ b/arch/arm64/kernel/image.h @@ -15,13 +15,15 @@ * You should have received a copy of the GNU General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. */ -#ifndef __ASM_IMAGE_H -#define __ASM_IMAGE_H +#ifndef __ARM64_KERNEL_IMAGE_H +#define __ARM64_KERNEL_IMAGE_H #ifndef LINKER_SCRIPT #error This file should only be included in vmlinux.lds.S #endif +#include <asm/image.h> + /* * There aren't any ELF relocations we can use to endian-swap values known only * at link time (e.g. the subtraction of two symbol addresses), so we must get @@ -47,19 +49,22 @@ sym##_lo32 = DATA_LE32((data) & 0xffffffff); \ sym##_hi32 = DATA_LE32((data) >> 32) +#define __HEAD_FLAG(field) (__HEAD_FLAG_##field << \ + ARM64_IMAGE_FLAG_##field##_SHIFT) + #ifdef CONFIG_CPU_BIG_ENDIAN -#define __HEAD_FLAG_BE 1 +#define __HEAD_FLAG_BE ARM64_IMAGE_FLAG_BE #else -#define __HEAD_FLAG_BE 0 +#define __HEAD_FLAG_BE ARM64_IMAGE_FLAG_LE #endif #define __HEAD_FLAG_PAGE_SIZE ((PAGE_SHIFT - 10) / 2) #define __HEAD_FLAG_PHYS_BASE 1 -#define __HEAD_FLAGS ((__HEAD_FLAG_BE << 0) | \ - (__HEAD_FLAG_PAGE_SIZE << 1) | \ - (__HEAD_FLAG_PHYS_BASE << 3)) +#define __HEAD_FLAGS (__HEAD_FLAG(BE) | \ + __HEAD_FLAG(PAGE_SIZE) | \ + __HEAD_FLAG(PHYS_BASE)) /* * These will output as part of the Image header, which should be little-endian @@ -113,4 +118,4 @@ __efistub_screen_info = screen_info; #endif -#endif /* __ASM_IMAGE_H */ +#endif /* __ARM64_KERNEL_IMAGE_H */ diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c new file mode 100644 index 000000000..1ad1d5f8f --- /dev/null +++ b/arch/arm64/kernel/kexec_image.c @@ -0,0 +1,126 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Kexec image loader + + * Copyright (C) 2018 Linaro Limited + * Author: AKASHI Takahiro <takahiro.akashi(a)linaro.org> + */ + +#define pr_fmt(fmt) "kexec_file(Image): " fmt + +#include <linux/err.h> +#include <linux/errno.h> +#include <linux/kernel.h> +#include <linux/kexec.h> +#include <linux/pe.h> +#include <linux/string.h> +#include <linux/verification.h> +#include <asm/byteorder.h> +#include <asm/cpufeature.h> +#include <asm/image.h> +#include <asm/memory.h> + +static int image_probe(const char *kernel_buf, unsigned long kernel_len) +{ + const struct arm64_image_header *h = + (const struct arm64_image_header *)(kernel_buf); + + if (!h || (kernel_len < sizeof(*h))) + return -EINVAL; + + if (memcmp(&h->magic, ARM64_IMAGE_MAGIC, sizeof(h->magic))) + return -EINVAL; + + return 0; +} + +static void *image_load(struct kimage *image, + char *kernel, unsigned long kernel_len, + char *initrd, unsigned long initrd_len, + char *cmdline, unsigned long cmdline_len) +{ + struct arm64_image_header *h; + u64 flags, value; + bool be_image, be_kernel; + struct kexec_buf kbuf; + unsigned long text_offset; + struct kexec_segment *kernel_segment; + int ret; + + /* + * We require a kernel with an unambiguous Image header. Per + * Documentation/booting.txt, this is the case when image_size + * is non-zero (practically speaking, since v3.17). + */ + h = (struct arm64_image_header *)kernel; + if (!h->image_size) + return ERR_PTR(-EINVAL); + + /* Check cpu features */ + flags = le64_to_cpu(h->flags); + be_image = arm64_image_flag_field(flags, ARM64_IMAGE_FLAG_BE); + be_kernel = IS_ENABLED(CONFIG_CPU_BIG_ENDIAN); + if ((be_image != be_kernel) && !system_supports_mixed_endian()) + return ERR_PTR(-EINVAL); + + value = arm64_image_flag_field(flags, ARM64_IMAGE_FLAG_PAGE_SIZE); + if (((value == ARM64_IMAGE_FLAG_PAGE_SIZE_4K) && + !system_supports_4kb_granule()) || + ((value == ARM64_IMAGE_FLAG_PAGE_SIZE_64K) && + !system_supports_64kb_granule()) || + ((value == ARM64_IMAGE_FLAG_PAGE_SIZE_16K) && + !system_supports_16kb_granule())) + return ERR_PTR(-EINVAL); + + /* Load the kernel */ + kbuf.image = image; + kbuf.buf_min = 0; + kbuf.buf_max = ULONG_MAX; + kbuf.top_down = false; + + kbuf.buffer = kernel; + kbuf.bufsz = kernel_len; + kbuf.mem = 0; + kbuf.memsz = le64_to_cpu(h->image_size); + text_offset = le64_to_cpu(h->text_offset); + kbuf.buf_align = MIN_KIMG_ALIGN; + + /* Adjust kernel segment with TEXT_OFFSET */ + kbuf.memsz += text_offset; + + ret = kexec_add_buffer(&kbuf); + if (ret) + return ERR_PTR(ret); + + kernel_segment = &image->segment[image->nr_segments - 1]; + kernel_segment->mem += text_offset; + kernel_segment->memsz -= text_offset; + image->start = kernel_segment->mem; + + pr_debug("Loaded kernel at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + kernel_segment->mem, kbuf.bufsz, + kernel_segment->memsz); + + /* Load additional data */ + ret = load_other_segments(image, + kernel_segment->mem, kernel_segment->memsz, + initrd, initrd_len, cmdline); + + return ERR_PTR(ret); +} + +#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +static int image_verify_sig(const char *kernel, unsigned long kernel_len) +{ + return verify_pefile_signature(kernel, kernel_len, NULL, + VERIFYING_KEXEC_PE_SIGNATURE); +} +#endif + +const struct kexec_file_ops kexec_image_ops = { + .probe = image_probe, + .load = image_load, +#ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG + .verify_sig = image_verify_sig, +#endif +}; diff --git a/arch/arm64/kernel/machine_kexec.c b/arch/arm64/kernel/machine_kexec.c index b41d6d482..213d0053e 100644 --- a/arch/arm64/kernel/machine_kexec.c +++ b/arch/arm64/kernel/machine_kexec.c @@ -214,9 +214,17 @@ void machine_kexec(struct kimage *kimage) * uses physical addressing to relocate the new image to its final * position and transfers control to the image entry point when the * relocation is complete. + * In kexec case, kimage->start points to purgatory assuming that + * kernel entry and dtb address are embedded in purgatory by + * userspace (kexec-tools). + * In kexec_file case, the kernel starts directly without purgatory. */ - - cpu_soft_restart(reboot_code_buffer_phys, kimage->head, kimage->start, 0); + cpu_soft_restart(reboot_code_buffer_phys, kimage->head, kimage->start, +#ifdef CONFIG_KEXEC_FILE + kimage->arch.dtb_mem); +#else + 0); +#endif BUG(); /* Should never get here. */ } diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c new file mode 100644 index 000000000..ec3b72dc0 --- /dev/null +++ b/arch/arm64/kernel/machine_kexec_file.c @@ -0,0 +1,342 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * kexec_file for arm64 + * + * Copyright (C) 2018 Linaro Limited + * Author: AKASHI Takahiro <takahiro.akashi(a)linaro.org> + * + * Most code is derived from arm64 port of kexec-tools + */ + +#define pr_fmt(fmt) "kexec_file: " fmt + +#include <linux/ioport.h> +#include <linux/kernel.h> +#include <linux/kexec.h> +#include <linux/libfdt.h> +#include <linux/memblock.h> +#include <linux/of_fdt.h> +#include <linux/random.h> +#include <linux/slab.h> +#include <linux/string.h> +#include <linux/types.h> +#include <linux/vmalloc.h> +#include <asm/byteorder.h> + +/* relevant device tree properties */ +#define FDT_PROP_KEXEC_ELFHDR "linux,elfcorehdr" +#define FDT_PROP_MEM_RANGE "linux,usable-memory-range" +#define FDT_PROP_INITRD_START "linux,initrd-start" +#define FDT_PROP_INITRD_END "linux,initrd-end" +#define FDT_PROP_BOOTARGS "bootargs" +#define FDT_PROP_KASLR_SEED "kaslr-seed" +#define FDT_PROP_RNG_SEED "rng-seed" +#define RNG_SEED_SIZE 128 + +const struct kexec_file_ops * const kexec_file_loaders[] = { + &kexec_image_ops, + NULL +}; + +int arch_kimage_file_post_load_cleanup(struct kimage *image) +{ + vfree(image->arch.dtb); + image->arch.dtb = NULL; + + vfree(image->arch.elf_headers); + image->arch.elf_headers = NULL; + image->arch.elf_headers_sz = 0; + + return kexec_image_post_load_cleanup_default(image); +} + +static int setup_dtb(struct kimage *image, + unsigned long initrd_load_addr, unsigned long initrd_len, + char *cmdline, void *dtb) +{ + int off, ret; + + ret = fdt_path_offset(dtb, "/chosen"); + if (ret < 0) + goto out; + + off = ret; + + ret = fdt_delprop(dtb, off, FDT_PROP_KEXEC_ELFHDR); + if (ret && ret != -FDT_ERR_NOTFOUND) + goto out; + ret = fdt_delprop(dtb, off, FDT_PROP_MEM_RANGE); + if (ret && ret != -FDT_ERR_NOTFOUND) + goto out; + + if (image->type == KEXEC_TYPE_CRASH) { + /* add linux,elfcorehdr */ + ret = fdt_appendprop_addrrange(dtb, 0, off, + FDT_PROP_KEXEC_ELFHDR, + image->arch.elf_headers_mem, + image->arch.elf_headers_sz); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + + /* add linux,usable-memory-range */ + ret = fdt_appendprop_addrrange(dtb, 0, off, + FDT_PROP_MEM_RANGE, + crashk_res.start, + crashk_res.end - crashk_res.start + 1); + if (ret) + return (ret == -FDT_ERR_NOSPACE ? -ENOMEM : -EINVAL); + } + + /* add bootargs */ + if (cmdline) { + ret = fdt_setprop_string(dtb, off, FDT_PROP_BOOTARGS, cmdline); + if (ret) + goto out; + } else { + ret = fdt_delprop(dtb, off, FDT_PROP_BOOTARGS); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + } + + /* add initrd-* */ + if (initrd_load_addr) { + ret = fdt_setprop_u64(dtb, off, FDT_PROP_INITRD_START, + initrd_load_addr); + if (ret) + goto out; + + ret = fdt_setprop_u64(dtb, off, FDT_PROP_INITRD_END, + initrd_load_addr + initrd_len); + if (ret) + goto out; + } else { + ret = fdt_delprop(dtb, off, FDT_PROP_INITRD_START); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + + ret = fdt_delprop(dtb, off, FDT_PROP_INITRD_END); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + } + + /* add kaslr-seed */ + ret = fdt_delprop(dtb, off, FDT_PROP_KASLR_SEED); + if (ret && (ret != -FDT_ERR_NOTFOUND)) + goto out; + + if (rng_is_initialized()) { + u64 seed = get_random_u64(); + ret = fdt_setprop_u64(dtb, off, FDT_PROP_KASLR_SEED, seed); + if (ret) + goto out; + } else { + pr_notice("RNG is not initialised: omitting \"%s\" property\n", + FDT_PROP_KASLR_SEED); + } + + /* add rng-seed */ + if (rng_is_initialized()) { + u8 rng_seed[RNG_SEED_SIZE]; + get_random_bytes(rng_seed, RNG_SEED_SIZE); + ret = fdt_setprop(dtb, off, FDT_PROP_RNG_SEED, rng_seed, + RNG_SEED_SIZE); + if (ret) + goto out; + } else { + pr_notice("RNG is not initialised: omitting \"%s\" property\n", + FDT_PROP_RNG_SEED); + } + +out: + if (ret) + return (ret == -FDT_ERR_NOSPACE) ? -ENOMEM : -EINVAL; + + return 0; +} + +/* + * More space needed so that we can add initrd, bootargs, kaslr-seed, + * rng-seed, userable-memory-range and elfcorehdr. + */ +#define DTB_EXTRA_SPACE 0x1000 + +static int create_dtb(struct kimage *image, + unsigned long initrd_load_addr, unsigned long initrd_len, + char *cmdline, void **dtb) +{ + void *buf; + size_t buf_size; + size_t cmdline_len; + int ret; + + cmdline_len = cmdline ? strlen(cmdline) : 0; + buf_size = fdt_totalsize(initial_boot_params) + + cmdline_len + DTB_EXTRA_SPACE; + + for (;;) { + buf = vmalloc(buf_size); + if (!buf) + return -ENOMEM; + + /* duplicate a device tree blob */ + ret = fdt_open_into(initial_boot_params, buf, buf_size); + if (ret) { + vfree(buf); + return -EINVAL; + } + + ret = setup_dtb(image, initrd_load_addr, initrd_len, + cmdline, buf); + if (ret) { + vfree(buf); + if (ret == -ENOMEM) { + /* unlikely, but just in case */ + buf_size += DTB_EXTRA_SPACE; + continue; + } else { + return ret; + } + } + + /* trim it */ + fdt_pack(buf); + *dtb = buf; + + return 0; + } +} + +static int prepare_elf_headers(void **addr, unsigned long *sz) +{ + struct crash_mem *cmem; + unsigned int nr_ranges; + int ret; + u64 i; + phys_addr_t start, end; + + nr_ranges = 1; /* for exclusion of crashkernel region */ + for_each_mem_range(i, &memblock.memory, NULL, NUMA_NO_NODE, + MEMBLOCK_NONE, &start, &end, NULL) + nr_ranges++; + + cmem = kmalloc(sizeof(struct crash_mem) + + sizeof(struct crash_mem_range) * nr_ranges, GFP_KERNEL); + if (!cmem) + return -ENOMEM; + + cmem->max_nr_ranges = nr_ranges; + cmem->nr_ranges = 0; + for_each_mem_range(i, &memblock.memory, NULL, NUMA_NO_NODE, + MEMBLOCK_NONE, &start, &end, NULL) { + cmem->ranges[cmem->nr_ranges].start = start; + cmem->ranges[cmem->nr_ranges].end = end - 1; + cmem->nr_ranges++; + } + + /* Exclude crashkernel region */ + ret = crash_exclude_mem_range(cmem, crashk_res.start, crashk_res.end); + + if (!ret) + ret = crash_prepare_elf64_headers(cmem, true, addr, sz); + + kfree(cmem); + return ret; +} + +int load_other_segments(struct kimage *image, + unsigned long kernel_load_addr, + unsigned long kernel_size, + char *initrd, unsigned long initrd_len, + char *cmdline) +{ + struct kexec_buf kbuf; + void *headers, *dtb = NULL; + unsigned long headers_sz, initrd_load_addr = 0, dtb_len; + int ret = 0; + + kbuf.image = image; + /* not allocate anything below the kernel */ + kbuf.buf_min = kernel_load_addr + kernel_size; + + /* load elf core header */ + if (image->type == KEXEC_TYPE_CRASH) { + ret = prepare_elf_headers(&headers, &headers_sz); + if (ret) { + pr_err("Preparing elf core header failed\n"); + goto out_err; + } + + kbuf.buffer = headers; + kbuf.bufsz = headers_sz; + kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; + kbuf.memsz = headers_sz; + kbuf.buf_align = SZ_64K; /* largest supported page size */ + kbuf.buf_max = ULONG_MAX; + kbuf.top_down = true; + + ret = kexec_add_buffer(&kbuf); + if (ret) { + vfree(headers); + goto out_err; + } + image->arch.elf_headers = headers; + image->arch.elf_headers_mem = kbuf.mem; + image->arch.elf_headers_sz = headers_sz; + + pr_debug("Loaded elf core header at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + image->arch.elf_headers_mem, headers_sz, headers_sz); + } + + /* load initrd */ + if (initrd) { + kbuf.buffer = initrd; + kbuf.bufsz = initrd_len; + kbuf.mem = 0; + kbuf.memsz = initrd_len; + kbuf.buf_align = 0; + /* within 1GB-aligned window of up to 32GB in size */ + kbuf.buf_max = round_down(kernel_load_addr, SZ_1G) + + (unsigned long)SZ_1G * 32; + kbuf.top_down = false; + + ret = kexec_add_buffer(&kbuf); + if (ret) + goto out_err; + initrd_load_addr = kbuf.mem; + + pr_debug("Loaded initrd at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + initrd_load_addr, initrd_len, initrd_len); + } + + /* load dtb */ + ret = create_dtb(image, initrd_load_addr, initrd_len, cmdline, &dtb); + if (ret) { + pr_err("Preparing for new dtb failed\n"); + goto out_err; + } + + dtb_len = fdt_totalsize(dtb); + kbuf.buffer = dtb; + kbuf.bufsz = dtb_len; + kbuf.mem = 0; + kbuf.memsz = dtb_len; + /* not across 2MB boundary */ + kbuf.buf_align = SZ_2M; + kbuf.buf_max = ULONG_MAX; + kbuf.top_down = true; + + ret = kexec_add_buffer(&kbuf); + if (ret) + goto out_err; + image->arch.dtb = dtb; + image->arch.dtb_mem = kbuf.mem; + + pr_debug("Loaded dtb at 0x%lx bufsz=0x%lx memsz=0x%lx\n", + kbuf.mem, dtb_len, dtb_len); + + return 0; + +out_err: + vfree(dtb); + return ret; +} diff --git a/arch/arm64/kernel/relocate_kernel.S b/arch/arm64/kernel/relocate_kernel.S index f407e422a..95fd94209 100644 --- a/arch/arm64/kernel/relocate_kernel.S +++ b/arch/arm64/kernel/relocate_kernel.S @@ -32,6 +32,7 @@ ENTRY(arm64_relocate_new_kernel) /* Setup the list loop variables. */ + mov x18, x2 /* x18 = dtb address */ mov x17, x1 /* x17 = kimage_start */ mov x16, x0 /* x16 = kimage_head */ raw_dcache_line_size x15, x0 /* x15 = dcache line size */ @@ -107,7 +108,7 @@ ENTRY(arm64_relocate_new_kernel) isb /* Start new image. */ - mov x0, xzr + mov x0, x18 mov x1, xzr mov x2, xzr mov x3, xzr diff --git a/arch/powerpc/kernel/machine_kexec_file_64.c b/arch/powerpc/kernel/machine_kexec_file_64.c index c77e95e9b..0d20c7ad4 100644 --- a/arch/powerpc/kernel/machine_kexec_file_64.c +++ b/arch/powerpc/kernel/machine_kexec_file_64.c @@ -24,7 +24,6 @@ #include <linux/slab.h> #include <linux/kexec.h> -#include <linux/memblock.h> #include <linux/of_fdt.h> #include <linux/libfdt.h> #include <asm/ima.h> @@ -46,59 +45,6 @@ int arch_kexec_kernel_image_probe(struct kimage *image, void *buf, return kexec_image_probe_default(image, buf, buf_len); } -/** - * arch_kexec_walk_mem - call func(data) for each unreserved memory block - * @kbuf: Context info for the search. Also passed to @func. - * @func: Function to call for each memory block. - * - * This function is used by kexec_add_buffer and kexec_locate_mem_hole - * to find unreserved memory to load kexec segments into. - * - * Return: The memory walk will stop when func returns a non-zero value - * and that value will be returned. If all free regions are visited without - * func returning non-zero, then zero will be returned. - */ -int arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)) -{ - int ret = 0; - u64 i; - phys_addr_t mstart, mend; - struct resource res = { }; - - if (kbuf->top_down) { - for_each_free_mem_range_reverse(i, NUMA_NO_NODE, 0, - &mstart, &mend, NULL) { - /* - * In memblock, end points to the first byte after the - * range while in kexec, end points to the last byte - * in the range. - */ - res.start = mstart; - res.end = mend - 1; - ret = func(&res, kbuf); - if (ret) - break; - } - } else { - for_each_free_mem_range(i, NUMA_NO_NODE, 0, &mstart, &mend, - NULL) { - /* - * In memblock, end points to the first byte after the - * range while in kexec, end points to the last byte - * in the range. - */ - res.start = mstart; - res.end = mend - 1; - ret = func(&res, kbuf); - if (ret) - break; - } - } - - return ret; -} - /** * setup_purgatory - initialize the purgatory's global variables * @image: kexec image. diff --git a/arch/s390/kernel/machine_kexec_file.c b/arch/s390/kernel/machine_kexec_file.c index f413f57f8..32023b4f9 100644 --- a/arch/s390/kernel/machine_kexec_file.c +++ b/arch/s390/kernel/machine_kexec_file.c @@ -134,16 +134,6 @@ int kexec_file_add_initrd(struct kimage *image, struct s390_load_data *data, return ret; } -/* - * The kernel is loaded to a fixed location. Turn off kexec_locate_mem_hole - * and provide kbuf->mem by hand. - */ -int arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)) -{ - return 1; -} - int arch_kexec_apply_relocations_add(struct purgatory_info *pi, Elf_Shdr *section, const Elf_Shdr *relsec, diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c index 70caa60b4..8977de5ad 100644 --- a/arch/x86/kernel/kexec-bzimage64.c +++ b/arch/x86/kernel/kexec-bzimage64.c @@ -535,9 +535,17 @@ static int bzImage64_cleanup(void *loader_data) #ifdef CONFIG_KEXEC_BZIMAGE_VERIFY_SIG static int bzImage64_verify_sig(const char *kernel, unsigned long kernel_len) { - return verify_pefile_signature(kernel, kernel_len, - VERIFY_USE_SECONDARY_KEYRING, - VERIFYING_KEXEC_PE_SIGNATURE); + int ret; + + ret = verify_pefile_signature(kernel, kernel_len, + VERIFY_USE_SECONDARY_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + if (ret == -ENOKEY && IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING)) { + ret = verify_pefile_signature(kernel, kernel_len, + VERIFY_USE_PLATFORM_KEYRING, + VERIFYING_KEXEC_PE_SIGNATURE); + } + return ret; } #endif diff --git a/certs/system_keyring.c b/certs/system_keyring.c index 817287175..c05c29ae4 100644 --- a/certs/system_keyring.c +++ b/certs/system_keyring.c @@ -24,6 +24,9 @@ static struct key *builtin_trusted_keys; #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING static struct key *secondary_trusted_keys; #endif +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING +static struct key *platform_trusted_keys; +#endif extern __initconst const u8 system_certificate_list[]; extern __initconst const unsigned long system_certificate_list_size; @@ -237,11 +240,22 @@ int verify_pkcs7_signature(const void *data, size_t len, #else trusted_keys = builtin_trusted_keys; #endif + } else if (trusted_keys == VERIFY_USE_PLATFORM_KEYRING) { +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING + trusted_keys = platform_trusted_keys; +#else + trusted_keys = NULL; +#endif + if (!trusted_keys) { + ret = -ENOKEY; + pr_devel("PKCS#7 platform keyring is not available\n"); + goto error; + } } ret = pkcs7_validate_trust(pkcs7, trusted_keys); if (ret < 0) { if (ret == -ENOKEY) - pr_err("PKCS#7 signature not signed with a trusted key\n"); + pr_devel("PKCS#7 signature not signed with a trusted key\n"); goto error; } @@ -266,3 +280,10 @@ int verify_pkcs7_signature(const void *data, size_t len, EXPORT_SYMBOL_GPL(verify_pkcs7_signature); #endif /* CONFIG_SYSTEM_DATA_VERIFICATION */ + +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING +void __init set_platform_trusted_keys(struct key *keyring) +{ + platform_trusted_keys = keyring; +} +#endif diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h index 359c2f936..42a93eda3 100644 --- a/include/keys/system_keyring.h +++ b/include/keys/system_keyring.h @@ -61,5 +61,13 @@ static inline struct key *get_ima_blacklist_keyring(void) } #endif /* CONFIG_IMA_BLACKLIST_KEYRING */ +#if defined(CONFIG_INTEGRITY_PLATFORM_KEYRING) && \ + defined(CONFIG_SYSTEM_TRUSTED_KEYRING) +extern void __init set_platform_trusted_keys(struct key *keyring); +#else +static inline void set_platform_trusted_keys(struct key *keyring) +{ +} +#endif #endif /* _KEYS_SYSTEM_KEYRING_H */ diff --git a/include/linux/efi.h b/include/linux/efi.h index 34c255c2a..b8a6df5df 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -676,6 +676,10 @@ void efi_native_runtime_setup(void); #define EFI_IMAGE_SECURITY_DATABASE_GUID EFI_GUID(0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f) #define EFI_SHIM_LOCK_GUID EFI_GUID(0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23) +#define EFI_CERT_SHA256_GUID EFI_GUID(0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28) +#define EFI_CERT_X509_GUID EFI_GUID(0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72) +#define EFI_CERT_X509_SHA256_GUID EFI_GUID(0x3bd2a492, 0x96c0, 0x4079, 0xb4, 0x20, 0xfc, 0xf9, 0x8e, 0xf1, 0x03, 0xed) + /* * This GUID is used to pass to the kernel proper the struct screen_info * structure that was populated by the stub based on the GOP protocol instance @@ -947,6 +951,27 @@ typedef struct { efi_memory_desc_t entry[0]; } efi_memory_attributes_table_t; +typedef struct { + efi_guid_t signature_owner; + u8 signature_data[]; +} efi_signature_data_t; + +typedef struct { + efi_guid_t signature_type; + u32 signature_list_size; + u32 signature_header_size; + u32 signature_size; + u8 signature_header[]; + /* efi_signature_data_t signatures[][] */ +} efi_signature_list_t; + +typedef u8 efi_sha256_hash_t[32]; + +typedef struct { + efi_sha256_hash_t to_be_signed_hash; + efi_time_t time_of_revocation; +} efi_cert_x509_sha256_t; + /* * All runtime access to EFI goes through this structure: */ @@ -1129,6 +1154,15 @@ extern int efi_memattr_apply_permissions(struct mm_struct *mm, char * __init efi_md_typeattr_format(char *buf, size_t size, const efi_memory_desc_t *md); + +typedef void (*efi_element_handler_t)(const char *source, + const void *element_data, + size_t element_size); +extern int __init parse_efi_signature_list( + const char *source, + const void *data, size_t size, + efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *)); + /** * efi_range_is_wc - check the WC bit on an address range * @start: starting kvirt address diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 98cf0fb09..542a15c91 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -147,6 +147,19 @@ extern const struct kexec_file_ops * const kexec_file_loaders[]; int kexec_image_probe_default(struct kimage *image, void *buf, unsigned long buf_len); +int kexec_image_post_load_cleanup_default(struct kimage *image); + +int wrap_kexec_file_load(int kernel_fd, int initrd_fd, + unsigned long cmdline_len, const char __user *cmdline_ptr, + unsigned long flags); + +/* + * If kexec_buf.mem is set to this value, kexec_locate_mem_hole() + * will try to allocate free memory. Arch may overwrite it. + */ +#ifndef KEXEC_BUF_MEM_UNKNOWN +#define KEXEC_BUF_MEM_UNKNOWN 0 +#endif /** * struct kexec_buf - parameters for finding a place for a buffer in memory @@ -187,8 +200,6 @@ int __weak arch_kexec_apply_relocations(struct purgatory_info *pi, const Elf_Shdr *relsec, const Elf_Shdr *symtab); -int __weak arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)); extern int kexec_add_buffer(struct kexec_buf *kbuf); int kexec_locate_mem_hole(struct kexec_buf *kbuf); diff --git a/include/linux/pe.h b/include/linux/pe.h index 143ce75be..3482b18a4 100644 --- a/include/linux/pe.h +++ b/include/linux/pe.h @@ -166,7 +166,7 @@ struct mz_hdr { uint16_t oem_info; /* oem specific */ uint16_t reserved1[10]; /* reserved */ uint32_t peaddr; /* address of pe header */ - char message[64]; /* message to print */ + char message[]; /* message to print */ }; struct mz_reloc { diff --git a/include/linux/verification.h b/include/linux/verification.h index cfa4730d6..018fb5f13 100644 --- a/include/linux/verification.h +++ b/include/linux/verification.h @@ -17,6 +17,7 @@ * should be used. */ #define VERIFY_USE_SECONDARY_KEYRING ((struct key *)1UL) +#define VERIFY_USE_PLATFORM_KEYRING ((struct key *)2UL) /* * The use to which an asymmetric key is being put. diff --git a/include/uapi/linux/kexec.h b/include/uapi/linux/kexec.h index ca3cebebd..9385ecba2 100644 --- a/include/uapi/linux/kexec.h +++ b/include/uapi/linux/kexec.h @@ -25,6 +25,7 @@ #define KEXEC_FILE_UNLOAD 0x00000001 #define KEXEC_FILE_ON_CRASH 0x00000002 #define KEXEC_FILE_NO_INITRAMFS 0x00000004 +#define KEXEC_FILE_LOAD_WRAP 0x100000000 /* These values match the ELF architecture values. * Unless there is a good reason that should continue to be the case. diff --git a/kernel/kexec.c b/kernel/kexec.c index 47dfad722..d44a55202 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -238,6 +238,16 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, { int result; + if (flags & KEXEC_FILE_LOAD_WRAP) { + int kernel_fd, initrd_fd; + + kernel_fd = entry >> 32; + initrd_fd = entry & 0x00000000ffffffff; + flags &= ~KEXEC_FILE_LOAD_WRAP; + return wrap_kexec_file_load(kernel_fd, initrd_fd, nr_segments, + (char __user *)segments, flags); + } + result = kexec_load_check(nr_segments, flags); if (result) return result; diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 04f99368b..2a25db8dd 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -16,6 +16,7 @@ #include <linux/file.h> #include <linux/slab.h> #include <linux/kexec.h> +#include <linux/memblock.h> #include <linux/mutex.h> #include <linux/list.h> #include <linux/fs.h> @@ -78,7 +79,7 @@ void * __weak arch_kexec_kernel_image_load(struct kimage *image) return kexec_image_load_default(image); } -static int kexec_image_post_load_cleanup_default(struct kimage *image) +int kexec_image_post_load_cleanup_default(struct kimage *image) { if (!image->fops || !image->fops->cleanup) return 0; @@ -407,6 +408,96 @@ SYSCALL_DEFINE5(kexec_file_load, int, kernel_fd, int, initrd_fd, return ret; } +int wrap_kexec_file_load(int kernel_fd, int initrd_fd, + unsigned long cmdline_len, const char __user *cmdline_ptr, + unsigned long flags) +{ + int ret = 0, i; + struct kimage **dest_image, *image; + + /* We only trust the superuser with rebooting the system. */ + if (!capable(CAP_SYS_BOOT) || kexec_load_disabled) + return -EPERM; + + /* Make sure we have a legal set of flags */ + if (flags != (flags & KEXEC_FILE_FLAGS)) + return -EINVAL; + + image = NULL; + + if (!mutex_trylock(&kexec_mutex)) + return -EBUSY; + + dest_image = &kexec_image; + if (flags & KEXEC_FILE_ON_CRASH) { + dest_image = &kexec_crash_image; + if (kexec_crash_image) + arch_kexec_unprotect_crashkres(); + } + + if (flags & KEXEC_FILE_UNLOAD) + goto exchange; + + /* + * In case of crash, new kernel gets loaded in reserved region. It is + * same memory where old crash kernel might be loaded. Free any + * current crash dump kernel before we corrupt it. + */ + if (flags & KEXEC_FILE_ON_CRASH) + kimage_free(xchg(&kexec_crash_image, NULL)); + + ret = kimage_file_alloc_init(&image, kernel_fd, initrd_fd, cmdline_ptr, + cmdline_len, flags); + if (ret) + goto out; + + ret = machine_kexec_prepare(image); + if (ret) + goto out; + + /* + * Some architecture(like S390) may touch the crash memory before + * machine_kexec_prepare(), we must copy vmcoreinfo data after it. + */ + ret = kimage_crash_copy_vmcoreinfo(image); + if (ret) + goto out; + + ret = kexec_calculate_store_digests(image); + if (ret) + goto out; + + for (i = 0; i < image->nr_segments; i++) { + struct kexec_segment *ksegment; + + ksegment = &image->segment[i]; + pr_debug("Loading segment %d: buf=0x%p bufsz=0x%zx mem=0x%lx memsz=0x%zx\n", + i, ksegment->buf, ksegment->bufsz, ksegment->mem, + ksegment->memsz); + + ret = kimage_load_segment(image, &image->segment[i]); + if (ret) + goto out; + } + + kimage_terminate(image); + + /* + * Free up any temporary buffers allocated which are not needed + * after image has been loaded + */ + kimage_file_post_load_cleanup(image); +exchange: + image = xchg(dest_image, image); +out: + if ((flags & KEXEC_FILE_ON_CRASH) && kexec_crash_image) + arch_kexec_protect_crashkres(); + + mutex_unlock(&kexec_mutex); + kimage_free(image); + return ret; +} + static int locate_mem_hole_top_down(unsigned long start, unsigned long end, struct kexec_buf *kbuf) { @@ -501,8 +592,60 @@ static int locate_mem_hole_callback(struct resource *res, void *arg) return locate_mem_hole_bottom_up(start, end, kbuf); } +#ifdef CONFIG_ARCH_DISCARD_MEMBLOCK +static int kexec_walk_memblock(struct kexec_buf *kbuf, + int (*func)(struct resource *, void *)) +{ + return 0; +} +#else +static int kexec_walk_memblock(struct kexec_buf *kbuf, + int (*func)(struct resource *, void *)) +{ + int ret = 0; + u64 i; + phys_addr_t mstart, mend; + struct resource res = { }; + + if (kbuf->image->type == KEXEC_TYPE_CRASH) + return func(&crashk_res, kbuf); + + if (kbuf->top_down) { + for_each_free_mem_range_reverse(i, NUMA_NO_NODE, MEMBLOCK_NONE, + &mstart, &mend, NULL) { + /* + * In memblock, end points to the first byte after the + * range while in kexec, end points to the last byte + * in the range. + */ + res.start = mstart; + res.end = mend - 1; + ret = func(&res, kbuf); + if (ret) + break; + } + } else { + for_each_free_mem_range(i, NUMA_NO_NODE, MEMBLOCK_NONE, + &mstart, &mend, NULL) { + /* + * In memblock, end points to the first byte after the + * range while in kexec, end points to the last byte + * in the range. + */ + res.start = mstart; + res.end = mend - 1; + ret = func(&res, kbuf); + if (ret) + break; + } + } + + return ret; +} +#endif + /** - * arch_kexec_walk_mem - call func(data) on free memory regions + * kexec_walk_resources - call func(data) on free memory regions * @kbuf: Context info for the search. Also passed to @func. * @func: Function to call for each memory region. * @@ -510,8 +653,8 @@ static int locate_mem_hole_callback(struct resource *res, void *arg) * and that value will be returned. If all free regions are visited without * func returning non-zero, then zero will be returned. */ -int __weak arch_kexec_walk_mem(struct kexec_buf *kbuf, - int (*func)(struct resource *, void *)) +static int kexec_walk_resources(struct kexec_buf *kbuf, + int (*func)(struct resource *, void *)) { if (kbuf->image->type == KEXEC_TYPE_CRASH) return walk_iomem_res_desc(crashk_res.desc, @@ -534,7 +677,14 @@ int kexec_locate_mem_hole(struct kexec_buf *kbuf) { int ret; - ret = arch_kexec_walk_mem(kbuf, locate_mem_hole_callback); + /* Arch knows where to place */ + if (kbuf->mem != KEXEC_BUF_MEM_UNKNOWN) + return 0; + + if (IS_ENABLED(CONFIG_ARCH_DISCARD_MEMBLOCK)) + ret = kexec_walk_resources(kbuf, locate_mem_hole_callback); + else + ret = kexec_walk_memblock(kbuf, locate_mem_hole_callback); return ret == 1 ? 0 : -EADDRNOTAVAIL; } diff --git a/lib/Makefile b/lib/Makefile index 01f8051b4..455797430 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -213,7 +213,7 @@ KASAN_SANITIZE_stackdepot.o := n KCOV_INSTRUMENT_stackdepot.o := n libfdt_files = fdt.o fdt_ro.o fdt_wip.o fdt_rw.o fdt_sw.o fdt_strerror.o \ - fdt_empty_tree.o + fdt_empty_tree.o fdt_addresses.o $(foreach file, $(libfdt_files), \ $(eval CFLAGS_$(file) = -I$(src)/../scripts/dtc/libfdt)) lib-$(CONFIG_LIBFDT) += $(libfdt_files) diff --git a/lib/fdt_addresses.c b/lib/fdt_addresses.c new file mode 100644 index 000000000..23610bcf3 --- /dev/null +++ b/lib/fdt_addresses.c @@ -0,0 +1,2 @@ +#include <linux/libfdt_env.h> +#include "../scripts/dtc/libfdt/fdt_addresses.c" diff --git a/scripts/dtc/libfdt/fdt_addresses.c b/scripts/dtc/libfdt/fdt_addresses.c index eff4dbcc7..8211d00ba 100644 --- a/scripts/dtc/libfdt/fdt_addresses.c +++ b/scripts/dtc/libfdt/fdt_addresses.c @@ -94,3 +94,50 @@ int fdt_size_cells(const void *fdt, int nodeoffset) return val; } + +/* This function assumes that [address|size]_cells is 1 or 2 */ +int fdt_appendprop_addrrange(void *fdt, int parent, int nodeoffset, + const char *name, uint64_t addr, uint64_t size) +{ + int addr_cells, size_cells, ret; + uint8_t data[sizeof(fdt64_t) * 2], *prop; + + ret = fdt_address_cells(fdt, parent); + if (ret < 0) + return ret; + addr_cells = ret; + + ret = fdt_size_cells(fdt, parent); + if (ret < 0) + return ret; + size_cells = ret; + + /* check validity of address */ + prop = data; + if (addr_cells == 1) { + if ((addr > UINT32_MAX) || ((UINT32_MAX + 1 - addr) < size)) + return -FDT_ERR_BADVALUE; + + fdt32_st(prop, (uint32_t)addr); + } else if (addr_cells == 2) { + fdt64_st(prop, addr); + } else { + return -FDT_ERR_BADNCELLS; + } + + /* check validity of size */ + prop += addr_cells * sizeof(fdt32_t); + if (size_cells == 1) { + if (size > UINT32_MAX) + return -FDT_ERR_BADVALUE; + + fdt32_st(prop, (uint32_t)size); + } else if (size_cells == 2) { + fdt64_st(prop, size); + } else { + return -FDT_ERR_BADNCELLS; + } + + return fdt_appendprop(fdt, nodeoffset, name, data, + (addr_cells + size_cells) * sizeof(fdt32_t)); +} diff --git a/scripts/dtc/libfdt/libfdt.h b/scripts/dtc/libfdt/libfdt.h index 1e27780e1..da72b54c4 100644 --- a/scripts/dtc/libfdt/libfdt.h +++ b/scripts/dtc/libfdt/libfdt.h @@ -153,6 +153,30 @@ static inline void *fdt_offset_ptr_w(void *fdt, int offset, int checklen) uint32_t fdt_next_tag(const void *fdt, int offset, int *nextoffset); +static inline void fdt32_st(void *property, uint32_t value) +{ + uint8_t *bp = property; + + bp[0] = value >> 24; + bp[1] = (value >> 16) & 0xff; + bp[2] = (value >> 8) & 0xff; + bp[3] = value & 0xff; +} + +static inline void fdt64_st(void *property, uint64_t value) +{ + uint8_t *bp = property; + + bp[0] = value >> 56; + bp[1] = (value >> 48) & 0xff; + bp[2] = (value >> 40) & 0xff; + bp[3] = (value >> 32) & 0xff; + bp[4] = (value >> 24) & 0xff; + bp[5] = (value >> 16) & 0xff; + bp[6] = (value >> 8) & 0xff; + bp[7] = value & 0xff; +} + /**********************************************************************/ /* Traversal functions */ /**********************************************************************/ @@ -1765,6 +1789,43 @@ static inline int fdt_appendprop_cell(void *fdt, int nodeoffset, #define fdt_appendprop_string(fdt, nodeoffset, name, str) \ fdt_appendprop((fdt), (nodeoffset), (name), (str), strlen(str)+1) +/** + * fdt_appendprop_addrrange - append a address range property + * @fdt: pointer to the device tree blob + * @parent: offset of the parent node + * @nodeoffset: offset of the node to add a property at + * @name: name of property + * @addr: start address of a given range + * @size: size of a given range + * + * fdt_appendprop_addrrange() appends an address range value (start + * address and size) to the value of the named property in the given + * node, or creates a new property with that value if it does not + * already exist. + * If "name" is not specified, a default "reg" is used. + * Cell sizes are determined by parent's #address-cells and #size-cells. + * + * This function may insert data into the blob, and will therefore + * change the offsets of some existing nodes. + * + * returns: + * 0, on success + * -FDT_ERR_BADLAYOUT, + * -FDT_ERR_BADMAGIC, + * -FDT_ERR_BADNCELLS, if the node has a badly formatted or invalid + * #address-cells property + * -FDT_ERR_BADOFFSET, nodeoffset did not point to FDT_BEGIN_NODE tag + * -FDT_ERR_BADSTATE, + * -FDT_ERR_BADSTRUCTURE, + * -FDT_ERR_BADVERSION, + * -FDT_ERR_BADVALUE, addr or size doesn't fit to respective cells size + * -FDT_ERR_NOSPACE, there is insufficient free space in the blob to + * contain a new property + * -FDT_ERR_TRUNCATED, standard meanings + */ +int fdt_appendprop_addrrange(void *fdt, int parent, int nodeoffset, + const char *name, uint64_t addr, uint64_t size); + /** * fdt_delprop - delete a property * @fdt: pointer to the device tree blob diff --git a/security/integrity/Kconfig b/security/integrity/Kconfig index da9565891..4b4d2aeef 100644 --- a/security/integrity/Kconfig +++ b/security/integrity/Kconfig @@ -51,6 +51,17 @@ config INTEGRITY_TRUSTED_KEYRING .evm keyrings be signed by a key on the system trusted keyring. +config INTEGRITY_PLATFORM_KEYRING + bool "Provide keyring for platform/firmware trusted keys" + depends on INTEGRITY_ASYMMETRIC_KEYS + depends on SYSTEM_BLACKLIST_KEYRING + depends on EFI + help + Provide a separate, distinct keyring for platform trusted keys, which + the kernel automatically populates during initialization from values + provided by the platform for verifying the kexec'ed kerned image + and, possibly, the initramfs signature. + config INTEGRITY_AUDIT bool "Enables integrity auditing support " depends on AUDIT diff --git a/security/integrity/Makefile b/security/integrity/Makefile index 04d6e462b..86df9aba8 100644 --- a/security/integrity/Makefile +++ b/security/integrity/Makefile @@ -9,6 +9,11 @@ integrity-y := iint.o integrity-$(CONFIG_INTEGRITY_AUDIT) += integrity_audit.o integrity-$(CONFIG_INTEGRITY_SIGNATURE) += digsig.o integrity-$(CONFIG_INTEGRITY_ASYMMETRIC_KEYS) += digsig_asymmetric.o +integrity-$(CONFIG_INTEGRITY_PLATFORM_KEYRING) += platform_certs/platform_keyring.o \ + platform_certs/efi_parser.o \ + platform_certs/load_uefi.o +obj-$(CONFIG_LOAD_UEFI_KEYS) += platform_certs/load_uefi.o +$(obj)/load_uefi.o: KBUILD_CFLAGS += -fshort-wchar subdir-$(CONFIG_IMA) += ima obj-$(CONFIG_IMA) += ima/ diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c index 9bb0a7f28..c585ca8db 100644 --- a/security/integrity/digsig.c +++ b/security/integrity/digsig.c @@ -35,6 +35,7 @@ static const char *keyring_name[INTEGRITY_KEYRING_MAX] = { ".ima", #endif "_module", + ".platform", }; #ifdef CONFIG_INTEGRITY_TRUSTED_KEYRING @@ -79,12 +80,42 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, return -EOPNOTSUPP; } -int __init integrity_init_keyring(const unsigned int id) +static int __init __integrity_init_keyring(const unsigned int id, + key_perm_t perm, + struct key_restriction *restriction) { const struct cred *cred = current_cred(); - struct key_restriction *restriction; int err = 0; + keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0), + KGIDT_INIT(0), cred, perm, + KEY_ALLOC_NOT_IN_QUOTA, restriction, NULL); + if (IS_ERR(keyring[id])) { + err = PTR_ERR(keyring[id]); + pr_info("Can't allocate %s keyring (%d)\n", + keyring_name[id], err); + keyring[id] = NULL; + } else { + if (id == INTEGRITY_KEYRING_PLATFORM) + set_platform_trusted_keys(keyring[id]); + } + + return err; +} + +int __init integrity_init_keyring(const unsigned int id) +{ + struct key_restriction *restriction; + key_perm_t perm; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW + | KEY_USR_READ | KEY_USR_SEARCH; + + if (id == INTEGRITY_KEYRING_PLATFORM) { + restriction = NULL; + goto out; + } + if (!init_keyring) return 0; @@ -93,32 +124,43 @@ int __init integrity_init_keyring(const unsigned int id) return -ENOMEM; restriction->check = restrict_link_to_ima; + perm |= KEY_USR_WRITE; - keyring[id] = keyring_alloc(keyring_name[id], KUIDT_INIT(0), - KGIDT_INIT(0), cred, - ((KEY_POS_ALL & ~KEY_POS_SETATTR) | - KEY_USR_VIEW | KEY_USR_READ | - KEY_USR_WRITE | KEY_USR_SEARCH), - KEY_ALLOC_NOT_IN_QUOTA, - restriction, NULL); - if (IS_ERR(keyring[id])) { - err = PTR_ERR(keyring[id]); - pr_info("Can't allocate %s keyring (%d)\n", - keyring_name[id], err); - keyring[id] = NULL; +out: + return __integrity_init_keyring(id, perm, restriction); +} + +int __init integrity_add_key(const unsigned int id, const void *data, + off_t size, key_perm_t perm) +{ + key_ref_t key; + int rc = 0; + + if (!keyring[id]) + return -EINVAL; + + key = key_create_or_update(make_key_ref(keyring[id], 1), "asymmetric", + NULL, data, size, perm, + KEY_ALLOC_NOT_IN_QUOTA); + if (IS_ERR(key)) { + rc = PTR_ERR(key); + pr_err("Problem loading X.509 certificate %d\n", rc); + } else { + pr_notice("Loaded X.509 cert '%s'\n", + key_ref_to_ptr(key)->description); + key_ref_put(key); } - return err; + + return rc; + } int __init integrity_load_x509(const unsigned int id, const char *path) { - key_ref_t key; void *data; loff_t size; int rc; - - if (!keyring[id]) - return -EINVAL; + key_perm_t perm; rc = kernel_read_file_from_path(path, &data, &size, 0, READING_X509_CERTIFICATE); @@ -127,23 +169,21 @@ int __init integrity_load_x509(const unsigned int id, const char *path) return rc; } - key = key_create_or_update(make_key_ref(keyring[id], 1), - "asymmetric", - NULL, - data, - size, - ((KEY_POS_ALL & ~KEY_POS_SETATTR) | - KEY_USR_VIEW | KEY_USR_READ), - KEY_ALLOC_NOT_IN_QUOTA); - if (IS_ERR(key)) { - rc = PTR_ERR(key); - pr_err("Problem loading X.509 certificate (%d): %s\n", - rc, path); - } else { - pr_notice("Loaded X.509 cert '%s': %s\n", - key_ref_to_ptr(key)->description, path); - key_ref_put(key); - } + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW | KEY_USR_READ; + + pr_info("Loading X.509 certificate: %s\n", path); + rc = integrity_add_key(id, (const void *)data, size, perm); + vfree(data); - return 0; + return rc; +} + +int __init integrity_load_cert(const unsigned int id, const char *source, + const void *data, size_t len, key_perm_t perm) +{ + if (!data) + return -EINVAL; + + pr_info("Loading X.509 certificate: %s\n", source); + return integrity_add_key(id, data, len, perm); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 08aabf763..ad285f17d 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -294,12 +294,22 @@ int ima_appraise_measurement(enum ima_hooks func, case EVM_IMA_XATTR_DIGSIG: set_bit(IMA_DIGSIG, &iint->atomic_flags); rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA, - (const char *)xattr_value, rc, + (const char *)xattr_value, + xattr_len, iint->ima_hash->digest, iint->ima_hash->length); if (rc == -EOPNOTSUPP) { status = INTEGRITY_UNKNOWN; - } else if (rc) { + break; + } + if (IS_ENABLED(CONFIG_INTEGRITY_PLATFORM_KEYRING) && rc && + func == KEXEC_KERNEL_CHECK) + rc = integrity_digsig_verify(INTEGRITY_KEYRING_PLATFORM, + (const char *)xattr_value, + xattr_len, + iint->ima_hash->digest, + iint->ima_hash->length); + if (rc) { cause = "invalid-signature"; status = INTEGRITY_FAIL; } else { diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h index 0ec551223..0750bab0d 100644 --- a/security/integrity/integrity.h +++ b/security/integrity/integrity.h @@ -142,7 +142,8 @@ int integrity_kernel_read(struct file *file, loff_t offset, #define INTEGRITY_KEYRING_EVM 0 #define INTEGRITY_KEYRING_IMA 1 #define INTEGRITY_KEYRING_MODULE 2 -#define INTEGRITY_KEYRING_MAX 3 +#define INTEGRITY_KEYRING_PLATFORM 3 +#define INTEGRITY_KEYRING_MAX 4 extern struct dentry *integrity_dir; @@ -153,6 +154,8 @@ int integrity_digsig_verify(const unsigned int id, const char *sig, int siglen, int __init integrity_init_keyring(const unsigned int id); int __init integrity_load_x509(const unsigned int id, const char *path); +int __init integrity_load_cert(const unsigned int id, const char *source, + const void *data, size_t len, key_perm_t perm); #else static inline int integrity_digsig_verify(const unsigned int id, @@ -166,6 +169,14 @@ static inline int integrity_init_keyring(const unsigned int id) { return 0; } + +static inline int __init integrity_load_cert(const unsigned int id, + const char *source, + const void *data, size_t len, + key_perm_t perm) +{ + return 0; +} #endif /* CONFIG_INTEGRITY_SIGNATURE */ #ifdef CONFIG_INTEGRITY_ASYMMETRIC_KEYS @@ -222,3 +233,13 @@ integrity_audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, int type) } #endif + +#ifdef CONFIG_INTEGRITY_PLATFORM_KEYRING +void __init add_to_platform_keyring(const char *source, const void *data, + size_t len); +#else +static inline void __init add_to_platform_keyring(const char *source, + const void *data, size_t len) +{ +} +#endif diff --git a/security/integrity/platform_certs/efi_parser.c b/security/integrity/platform_certs/efi_parser.c new file mode 100644 index 000000000..18f01f36f --- /dev/null +++ b/security/integrity/platform_certs/efi_parser.c @@ -0,0 +1,108 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* EFI signature/key/certificate list parser + * + * Copyright (C) 2012, 2016 Red Hat, Inc. All Rights Reserved. + * Written by David Howells (dhowells(a)redhat.com) + */ + +#define pr_fmt(fmt) "EFI: "fmt +#include <linux/module.h> +#include <linux/printk.h> +#include <linux/err.h> +#include <linux/efi.h> + +/** + * parse_efi_signature_list - Parse an EFI signature list for certificates + * @source: The source of the key + * @data: The data blob to parse + * @size: The size of the data blob + * @get_handler_for_guid: Get the handler func for the sig type (or NULL) + * + * Parse an EFI signature list looking for elements of interest. A list is + * made up of a series of sublists, where all the elements in a sublist are of + * the same type, but sublists can be of different types. + * + * For each sublist encountered, the @get_handler_for_guid function is called + * with the type specifier GUID and returns either a pointer to a function to + * handle elements of that type or NULL if the type is not of interest. + * + * If the sublist is of interest, each element is passed to the handler + * function in turn. + * + * Error EBADMSG is returned if the list doesn't parse correctly and 0 is + * returned if the list was parsed correctly. No error can be returned from + * the @get_handler_for_guid function or the element handler function it + * returns. + */ +int __init parse_efi_signature_list( + const char *source, + const void *data, size_t size, + efi_element_handler_t (*get_handler_for_guid)(const efi_guid_t *)) +{ + efi_element_handler_t handler; + unsigned int offs = 0; + + pr_devel("-->%s(,%zu)\n", __func__, size); + + while (size > 0) { + const efi_signature_data_t *elem; + efi_signature_list_t list; + size_t lsize, esize, hsize, elsize; + + if (size < sizeof(list)) + return -EBADMSG; + + memcpy(&list, data, sizeof(list)); + pr_devel("LIST[%04x] guid=%pUl ls=%x hs=%x ss=%x\n", + offs, + list.signature_type.b, list.signature_list_size, + list.signature_header_size, list.signature_size); + + lsize = list.signature_list_size; + hsize = list.signature_header_size; + esize = list.signature_size; + elsize = lsize - sizeof(list) - hsize; + + if (lsize > size) { + pr_devel("<--%s() = -EBADMSG [overrun @%x]\n", + __func__, offs); + return -EBADMSG; + } + + if (lsize < sizeof(list) || + lsize - sizeof(list) < hsize || + esize < sizeof(*elem) || + elsize < esize || + elsize % esize != 0) { + pr_devel("- bad size combo @%x\n", offs); + return -EBADMSG; + } + + handler = get_handler_for_guid(&list.signature_type); + if (!handler) { + data += lsize; + size -= lsize; + offs += lsize; + continue; + } + + data += sizeof(list) + hsize; + size -= sizeof(list) + hsize; + offs += sizeof(list) + hsize; + + for (; elsize > 0; elsize -= esize) { + elem = data; + + pr_devel("ELEM[%04x]\n", offs); + handler(source, + &elem->signature_data, + esize - sizeof(*elem)); + + data += esize; + size -= esize; + offs += esize; + } + } + + return 0; +} diff --git a/security/integrity/platform_certs/load_uefi.c b/security/integrity/platform_certs/load_uefi.c new file mode 100644 index 000000000..81b19c528 --- /dev/null +++ b/security/integrity/platform_certs/load_uefi.c @@ -0,0 +1,194 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <linux/kernel.h> +#include <linux/sched.h> +#include <linux/cred.h> +#include <linux/err.h> +#include <linux/efi.h> +#include <linux/slab.h> +#include <keys/asymmetric-type.h> +#include <keys/system_keyring.h> +#include "../integrity.h" + +static efi_guid_t efi_cert_x509_guid __initdata = EFI_CERT_X509_GUID; +static efi_guid_t efi_cert_x509_sha256_guid __initdata = + EFI_CERT_X509_SHA256_GUID; +static efi_guid_t efi_cert_sha256_guid __initdata = EFI_CERT_SHA256_GUID; + +/* + * Look to see if a UEFI variable called MokIgnoreDB exists and return true if + * it does. + * + * This UEFI variable is set by the shim if a user tells the shim to not use + * the certs/hashes in the UEFI db variable for verification purposes. If it + * is set, we should ignore the db variable also and the true return indicates + * this. + */ +static __init bool uefi_check_ignore_db(void) +{ + efi_status_t status; + unsigned int db = 0; + unsigned long size = sizeof(db); + efi_guid_t guid = EFI_SHIM_LOCK_GUID; + + status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db); + return status == EFI_SUCCESS; +} + +/* + * Get a certificate list blob from the named EFI variable. + */ +static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, + unsigned long *size) +{ + efi_status_t status; + unsigned long lsize = 4; + unsigned long tmpdb[4]; + void *db; + + status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); + if (status != EFI_BUFFER_TOO_SMALL) { + pr_err("Couldn't get size: 0x%lx\n", status); + return NULL; + } + + db = kmalloc(lsize, GFP_KERNEL); + if (!db) + return NULL; + + status = efi.get_variable(name, guid, NULL, &lsize, db); + if (status != EFI_SUCCESS) { + kfree(db); + pr_err("Error reading db var: 0x%lx\n", status); + return NULL; + } + + *size = lsize; + return db; +} + +/* + * Blacklist a hash. + */ +static __init void uefi_blacklist_hash(const char *source, const void *data, + size_t len, const char *type, + size_t type_len) +{ + char *hash, *p; + + hash = kmalloc(type_len + len * 2 + 1, GFP_KERNEL); + if (!hash) + return; + p = memcpy(hash, type, type_len); + p += type_len; + bin2hex(p, data, len); + p += len * 2; + *p = 0; + + mark_hash_blacklisted(hash); + kfree(hash); +} + +/* + * Blacklist an X509 TBS hash. + */ +static __init void uefi_blacklist_x509_tbs(const char *source, + const void *data, size_t len) +{ + uefi_blacklist_hash(source, data, len, "tbs:", 4); +} + +/* + * Blacklist the hash of an executable. + */ +static __init void uefi_blacklist_binary(const char *source, + const void *data, size_t len) +{ + uefi_blacklist_hash(source, data, len, "bin:", 4); +} + +/* + * Return the appropriate handler for particular signature list types found in + * the UEFI db and MokListRT tables. + */ +static __init efi_element_handler_t get_handler_for_db(const efi_guid_t * + sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_guid) == 0) + return add_to_platform_keyring; + return 0; +} + +/* + * Return the appropriate handler for particular signature list types found in + * the UEFI dbx and MokListXRT tables. + */ +static __init efi_element_handler_t get_handler_for_dbx(const efi_guid_t * + sig_type) +{ + if (efi_guidcmp(*sig_type, efi_cert_x509_sha256_guid) == 0) + return uefi_blacklist_x509_tbs; + if (efi_guidcmp(*sig_type, efi_cert_sha256_guid) == 0) + return uefi_blacklist_binary; + return 0; +} + +/* + * Load the certs contained in the UEFI databases into the platform trusted + * keyring and the UEFI blacklisted X.509 cert SHA256 hashes into the blacklist + * keyring. + */ +static int __init load_uefi_certs(void) +{ + efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; + efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; + void *db = NULL, *dbx = NULL, *mok = NULL; + unsigned long dbsize = 0, dbxsize = 0, moksize = 0; + int rc = 0; + + if (!efi.get_variable) + return false; + + /* Get db, MokListRT, and dbx. They might not exist, so it isn't + * an error if we can't get them. + */ + if (!uefi_check_ignore_db()) { + db = get_cert_list(L"db", &secure_var, &dbsize); + if (!db) { + pr_err("MODSIGN: Couldn't get UEFI db list\n"); + } else { + rc = parse_efi_signature_list("UEFI:db", + db, dbsize, get_handler_for_db); + if (rc) + pr_err("Couldn't parse db signatures: %d\n", + rc); + kfree(db); + } + } + + mok = get_cert_list(L"MokListRT", &mok_var, &moksize); + if (!mok) { + pr_info("Couldn't get UEFI MokListRT\n"); + } else { + rc = parse_efi_signature_list("UEFI:MokListRT", + mok, moksize, get_handler_for_db); + if (rc) + pr_err("Couldn't parse MokListRT signatures: %d\n", rc); + kfree(mok); + } + + dbx = get_cert_list(L"dbx", &secure_var, &dbxsize); + if (!dbx) { + pr_info("Couldn't get UEFI dbx list\n"); + } else { + rc = parse_efi_signature_list("UEFI:dbx", + dbx, dbxsize, + get_handler_for_dbx); + if (rc) + pr_err("Couldn't parse dbx signatures: %d\n", rc); + kfree(dbx); + } + + return rc; +} +late_initcall(load_uefi_certs); diff --git a/security/integrity/platform_certs/platform_keyring.c b/security/integrity/platform_certs/platform_keyring.c new file mode 100644 index 000000000..bcafd7387 --- /dev/null +++ b/security/integrity/platform_certs/platform_keyring.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Platform keyring for firmware/platform keys + * + * Copyright IBM Corporation, 2018 + * Author(s): Nayna Jain <nayna(a)linux.ibm.com> + */ + +#include <linux/export.h> +#include <linux/kernel.h> +#include <linux/sched.h> +#include <linux/cred.h> +#include <linux/err.h> +#include <linux/slab.h> +#include "../integrity.h" + +/** + * add_to_platform_keyring - Add to platform keyring without validation. + * @source: Source of key + * @data: The blob holding the key + * @len: The length of the data blob + * + * Add a key to the platform keyring without checking its trust chain. This + * is available only during kernel initialisation. + */ +void __init add_to_platform_keyring(const char *source, const void *data, + size_t len) +{ + key_perm_t perm; + int rc; + + perm = (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_VIEW; + + rc = integrity_load_cert(INTEGRITY_KEYRING_PLATFORM, source, data, len, + perm); + if (rc) + pr_info("Error adding keys to platform keyring %s\n", source); +} + +/* + * Create the trusted keyrings. + */ +static __init int platform_keyring_init(void) +{ + int rc; + + rc = integrity_init_keyring(INTEGRITY_KEYRING_PLATFORM); + if (rc) + return rc; + + pr_notice("Platform Keyring initialized\n"); + return 0; +} + +/* + * Must be initialised before we try and load the keys into the keyring. + */ +device_initcall(platform_keyring_init); -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS 0/5] drm/hisilicon: Fix hibmc did not get edid
by Gou Hao 18 Sep '21

18 Sep '21

From: gouhao <gouhao(a)uniontech.com> Fix hibmc did not get edid. issue: https://gitee.com/openeuler/kernel/issues/I469VQ gouhao (5): drm-Split-out-drm_probe_helper.h drm-Add-ddc-link-in-sysfs-created-by-drm_connector drm-Add-drm_connector_init-variant-with-ddc drm/hisilicon: Support i2c driver algorithms for bit-shift adapters drm/hisilicon: Features to support reading resolutions from EDID drivers/gpu/drm/drm_connector.c | 35 +++++++ drivers/gpu/drm/drm_sysfs.c | 8 ++ drivers/gpu/drm/hisilicon/hibmc/Makefile | 3 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 26 +++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 99 +++++++++++++++++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 55 ++++++++--- include/drm/drm_connector.h | 18 ++++ include/drm/drm_probe_helper.h | 27 +++++ 8 files changed, 256 insertions(+), 15 deletions(-) create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c create mode 100644 include/drm/drm_probe_helper.h -- 2.20.1

2 6

[PATCH openEuler-1.0-LTS 1/3] block: check if a profile is actually registered in blk_integrity_unregister
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.15 commit 783a40a1b3ac7f3714d2776fa8ac8cce3535e4f6 category: bugfix bugzilla: 181328 CVE: NA ----------------------------------------------- While clearing the profile itself is harmless, we really should not clear the stable writes flag if it wasn't set due to a registered integrity profile. Reported-by: Lihong Kou <koulihong(a)huawei.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Link: https://lore.kernel.org/r/20210914070657.87677-2-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-integrity.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/block/blk-integrity.c b/block/blk-integrity.c index 6121611e13164..0638f4868f705 100644 --- a/block/blk-integrity.c +++ b/block/blk-integrity.c @@ -431,8 +431,13 @@ EXPORT_SYMBOL(blk_integrity_register); */ void blk_integrity_unregister(struct gendisk *disk) { + struct blk_integrity *bi = &disk->queue->integrity; + + if (!bi->profile) + return; + disk->queue->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES; - memset(&disk->queue->integrity, 0, sizeof(struct blk_integrity)); + memset(bi, 0, sizeof(*bi)); } EXPORT_SYMBOL(blk_integrity_unregister); -- 2.25.1

1 2

[PATCH kernel-4.19 1/3] block: check if a profile is actually registered in blk_integrity_unregister
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from block-5.15 commit 783a40a1b3ac7f3714d2776fa8ac8cce3535e4f6 category: bugfix bugzilla: 181328 CVE: NA ----------------------------------------------- While clearing the profile itself is harmless, we really should not clear the stable writes flag if it wasn't set due to a registered integrity profile. Reported-by: Lihong Kou <koulihong(a)huawei.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Link: https://lore.kernel.org/r/20210914070657.87677-2-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-integrity.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/block/blk-integrity.c b/block/blk-integrity.c index 6121611e13164..0638f4868f705 100644 --- a/block/blk-integrity.c +++ b/block/blk-integrity.c @@ -431,8 +431,13 @@ EXPORT_SYMBOL(blk_integrity_register); */ void blk_integrity_unregister(struct gendisk *disk) { + struct blk_integrity *bi = &disk->queue->integrity; + + if (!bi->profile) + return; + disk->queue->backing_dev_info->capabilities &= ~BDI_CAP_STABLE_WRITES; - memset(&disk->queue->integrity, 0, sizeof(struct blk_integrity)); + memset(bi, 0, sizeof(*bi)); } EXPORT_SYMBOL(blk_integrity_unregister); -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/11] Revert "nbd: use blk_mq_queue_tag_inflight_iter()"
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 34280, https://gitee.com/openeuler/kernel/issues/I4AKY4 CVE: NA ----------------------------------------------- This reverts commit a139227441d1a01bfce70e591dd6b17e126561fa. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index a82a5dc845c6f..6a72c07ce3cba 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -763,8 +763,7 @@ static void recv_work(struct work_struct *work) kfree(args); } -static void nbd_clear_req(struct blk_mq_hw_ctx *hctx, - struct request *req, void *data, bool reserved) +static void nbd_clear_req(struct request *req, void *data, bool reserved) { struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req); @@ -778,7 +777,7 @@ static void nbd_clear_req(struct blk_mq_hw_ctx *hctx, static void nbd_clear_que(struct nbd_device *nbd) { blk_mq_quiesce_queue(nbd->disk->queue); - blk_mq_queue_tag_inflight_iter(nbd->disk->queue, nbd_clear_req, NULL); + blk_mq_tagset_busy_iter(&nbd->tag_set, nbd_clear_req, NULL); blk_mq_unquiesce_queue(nbd->disk->queue); dev_dbg(disk_to_dev(nbd->disk), "queue cleared\n"); } -- 2.25.1

1 10

[PATCH kernel-4.19 01/11] Revert "nbd: use blk_mq_queue_tag_inflight_iter()"
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 34280, https://gitee.com/openeuler/kernel/issues/I4AKY4 CVE: NA ----------------------------------------------- This reverts commit a139227441d1a01bfce70e591dd6b17e126561fa. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 3a6b46aeacee4..f881c34e28661 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -763,8 +763,7 @@ static void recv_work(struct work_struct *work) kfree(args); } -static void nbd_clear_req(struct blk_mq_hw_ctx *hctx, - struct request *req, void *data, bool reserved) +static void nbd_clear_req(struct request *req, void *data, bool reserved) { struct nbd_cmd *cmd = blk_mq_rq_to_pdu(req); @@ -778,7 +777,7 @@ static void nbd_clear_req(struct blk_mq_hw_ctx *hctx, static void nbd_clear_que(struct nbd_device *nbd) { blk_mq_quiesce_queue(nbd->disk->queue); - blk_mq_queue_tag_inflight_iter(nbd->disk->queue, nbd_clear_req, NULL); + blk_mq_tagset_busy_iter(&nbd->tag_set, nbd_clear_req, NULL); blk_mq_unquiesce_queue(nbd->disk->queue); dev_dbg(disk_to_dev(nbd->disk), "queue cleared\n"); } -- 2.25.1

1 10

[PATCH] arm64: smp: Fix cpu_freq print for NMI watchdog
by Wenchao Qin 17 Sep '21

17 Sep '21

hulk inclusion category: bugfix bugzilla: N/A CVE: N/A ------------------------------ When we are in the arch_get_cpu_freq func for the first time, after arch_probe_cpu_freq is excuted, the return of smp_processor_id() will change due to preemption while cpu_freq get the freq belong to original processor id, so pr_info will print the freq with wrong processor id like below table from dmesg: [ 1.713211] NMI watchdog: CPU1 freq probed as 2189072384 HZ. [ 1.810819] NMI watchdog: CPU1 freq probed as 2192003108 HZ. [ 1.909910] NMI watchdog: CPU2 freq probed as 2191345967 HZ. [ 2.015327] NMI watchdog: CPU3 freq probed as 2189460398 HZ. Actually, the first line should print the freq of CPU0, this bu can occur in virtual machine with less then 17 vCPUs. Changing smp_processor_id() to cpu will fix the bug Signed-off-by: Wenchao Qin <qinwenchao(a)cmss.chinamobile.com> --- arch/arm64/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c index fe56277..d685a27 100644 --- a/arch/arm64/kernel/smp.c +++ b/arch/arm64/kernel/smp.c @@ -1457,7 +1457,7 @@ static u64 arch_get_cpu_freq(void) if (!cpu_freq) { cpu_freq = arch_probe_cpu_freq(); pr_info("NMI watchdog: CPU%u freq probed as %llu HZ.\n", - smp_processor_id(), cpu_freq); + cpu, cpu_freq); if (!cpu_freq) cpu_freq = -1; per_cpu(cpu_freq_probed, cpu) = cpu_freq; -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 181879, https://gitee.com/openeuler/kernel/issues/I4AJ00 CVE: NA -------------------------- KASAN reports a use-after-free report when doing fuzz test: [693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338 [693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648] print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670] bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683] cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ? cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90 [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ? cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140 [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ? syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.105875] Allocated by task 1453337: [693354.106001] kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010] bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020] bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031] blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041] elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049] queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056] vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370 [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106114] Freed by task 1453336: [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241] blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249] elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257] elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264] kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140 [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000 [693354.108278] page dumped because: kasan: bad access detected [693354.108511] Memory state around the buggy address: [693354.108671] ffff888be0a35500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [693354.116396] ffff888be0a35580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.124473] >ffff888be0a35600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.132421] ^ [693354.140284] ffff888be0a35680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.147912] ffff888be0a35700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.155281] ================================================================== blkgs are protected by both queue and blkcg locks and holding either should stabilize them. However, the path of destroying blkg policy data is only protected by queue lock in blkcg_activate_policy()/blkcg_deactivate_policy(). Other tasks can get the blkg policy data before the blkg policy data is destroyed, and use it after destroyed, which will result in a use-after-free. CPU0 CPU1 blkcg_deactivate_policy spin_lock_irq(&q->queue_lock) bfq_io_set_weight_legacy spin_lock_irq(&blkcg->lock) blkg_to_bfqg(blkg) pd_to_bfqg(blkg->pd[pol->plid]) ^^^^^^blkg->pd[pol->plid] != NULL bfqg != NULL pol->pd_free_fn(blkg->pd[pol->plid]) pd_to_bfqg(blkg->pd[pol->plid]) bfqg_put(bfqg) kfree(bfqg) blkg->pd[pol->plid] = NULL spin_unlock_irq(q->queue_lock); bfq_group_set_weight(bfqg, val, 0) bfqg->entity.new_weight ^^^^^^trigger uaf here spin_unlock_irq(&blkcg->lock); Fix by garbbing the matching blkcg lock before trying to destroy blkg policy data. [Resolve conflict in blkcg_activate_policy() flow due to lack of 9d179b865449b ("blkcg: Fix multiple bugs in blkcg_activate_policy()"). 4.18 no need to merge this patch. So there is no problem in blkcg_activate_policy() flow.] Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com> Link: https://lore.kernel.org/linux-block/YUDLt9uBNLhWL6Gt@slm.duckdns.org/T/#r07… Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 7ded51051e0bc..592befc26584f 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1509,12 +1509,16 @@ void blkcg_deactivate_policy(struct request_queue *q, __clear_bit(pol->plid, q->blkcg_pols); list_for_each_entry(blkg, &q->blkg_list, q_node) { + struct blkcg *blkcg = blkg->blkcg; + + spin_lock(&blkcg->lock); if (blkg->pd[pol->plid]) { if (pol->pd_offline_fn) pol->pd_offline_fn(blkg->pd[pol->plid]); pol->pd_free_fn(blkg->pd[pol->plid]); blkg->pd[pol->plid] = NULL; } + spin_unlock(&blkcg->lock); } spin_unlock_irq(q->queue_lock); -- 2.25.1

1 0

[PATCH kernel-4.19] blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 181879, https://gitee.com/openeuler/kernel/issues/I4AJ00 CVE: NA -------------------------- KASAN reports a use-after-free report when doing fuzz test: [693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338 [693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648] print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670] bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683] cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ? cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90 [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ? cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140 [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ? syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.105875] Allocated by task 1453337: [693354.106001] kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010] bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020] bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031] blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041] elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049] queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056] vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370 [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106114] Freed by task 1453336: [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241] blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249] elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257] elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264] kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140 [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca [693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000 [693354.108278] page dumped because: kasan: bad access detected [693354.108511] Memory state around the buggy address: [693354.108671] ffff888be0a35500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [693354.116396] ffff888be0a35580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.124473] >ffff888be0a35600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.132421] ^ [693354.140284] ffff888be0a35680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.147912] ffff888be0a35700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [693354.155281] ================================================================== blkgs are protected by both queue and blkcg locks and holding either should stabilize them. However, the path of destroying blkg policy data is only protected by queue lock in blkcg_activate_policy()/blkcg_deactivate_policy(). Other tasks can get the blkg policy data before the blkg policy data is destroyed, and use it after destroyed, which will result in a use-after-free. CPU0 CPU1 blkcg_deactivate_policy spin_lock_irq(&q->queue_lock) bfq_io_set_weight_legacy spin_lock_irq(&blkcg->lock) blkg_to_bfqg(blkg) pd_to_bfqg(blkg->pd[pol->plid]) ^^^^^^blkg->pd[pol->plid] != NULL bfqg != NULL pol->pd_free_fn(blkg->pd[pol->plid]) pd_to_bfqg(blkg->pd[pol->plid]) bfqg_put(bfqg) kfree(bfqg) blkg->pd[pol->plid] = NULL spin_unlock_irq(q->queue_lock); bfq_group_set_weight(bfqg, val, 0) bfqg->entity.new_weight ^^^^^^trigger uaf here spin_unlock_irq(&blkcg->lock); Fix by garbbing the matching blkcg lock before trying to destroy blkg policy data. Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com> Link: https://lore.kernel.org/linux-block/YUDLt9uBNLhWL6Gt@slm.duckdns.org/T/#r07… Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-cgroup.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 05980d1a03f70..492e49f8e76c0 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1531,10 +1531,14 @@ int blkcg_activate_policy(struct request_queue *q, /* alloc failed, nothing's initialized yet, free everything */ spin_lock_irq(q->queue_lock); list_for_each_entry(blkg, &q->blkg_list, q_node) { + struct blkcg *blkcg = blkg->blkcg; + + spin_lock(&blkcg->lock); if (blkg->pd[pol->plid]) { pol->pd_free_fn(blkg->pd[pol->plid]); blkg->pd[pol->plid] = NULL; } + spin_unlock(&blkcg->lock); } spin_unlock_irq(q->queue_lock); ret = -ENOMEM; @@ -1568,12 +1572,16 @@ void blkcg_deactivate_policy(struct request_queue *q, __clear_bit(pol->plid, q->blkcg_pols); list_for_each_entry(blkg, &q->blkg_list, q_node) { + struct blkcg *blkcg = blkg->blkcg; + + spin_lock(&blkcg->lock); if (blkg->pd[pol->plid]) { if (pol->pd_offline_fn) pol->pd_offline_fn(blkg->pd[pol->plid]); pol->pd_free_fn(blkg->pd[pol->plid]); blkg->pd[pol->plid] = NULL; } + spin_unlock(&blkcg->lock); } spin_unlock_irq(q->queue_lock); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/6] Revert "sched/membarrier: fix NULL poiner in membarrier_global_expedited"
by Yang Yingliang 17 Sep '21

17 Sep '21

From: Li Hua <hucool.lihua(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3UKOW CVE: NA ------------------------------------------------- This reverts commit 3eb3533c1cb849559fc5a01410e7c863624b2ae5. Remove the work aroud to fix NULL poiner in membarrier_global_expedited, so as to prepare to introduce formal bug fix solution. Signed-off-by: Li Hua <hucool.lihua(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/sched/membarrier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c index ea888ddb914f6..c4ea07e857985 100644 --- a/kernel/sched/membarrier.c +++ b/kernel/sched/membarrier.c @@ -115,7 +115,7 @@ static int membarrier_global_expedited(void) * scheduling a kthread. */ p = task_rcu_dereference(&cpu_rq(cpu)->curr); - if (p && p->flags & PF_KTHREAD) + if (p->flags & PF_KTHREAD) continue; __cpumask_set_cpu(cpu, tmpmask); -- 2.25.1

1 5

[PATCH kernel-4.19] ext4: update last_pos for the case ext4_htree_fill_tree return fail
by Yang Yingliang 17 Sep '21

17 Sep '21

From: yangerkun <yangerkun(a)huawei.com> hulk inclusion category: bugfix bugzilla: 181452, https://gitee.com/openeuler/kernel/issues/I4AI46 CVE: NA --------------------------- Or the ls for ext4 dir can run into a deadloop since info->last_pos != ctx->pos which will reset the world and start read the entry which has already got before. Details see below: 1. a dx_dir which has 3 block, block 0 as dx_root block, block 1/2 as leaf block which own the ext4_dir_entry_2 2. block 1 read ok and call_filldir which will fill the dirent and update the ctx->pos 3. block 2 read fail, but we has already fill some dirent, so we will return back to userspace will a positive return val(see ksys_getdents64) 4. the second ext4_dx_readdir will reset the world since info->last_pos != ctx->pos, and will also init the curr_hash which pos to block 1 5. So we will read block1 too, and once block2 still read fail, we can only fill one dirent because the hash of the entry in block1(besides the last one) won't greater than curr_hash 6. this time, we forget update last_pos too since the read for block2 will fail, and since we has got the one entry, ksys_getdents64 can return success 7. Latter we will trapped in a loop with step 4~6 Fix it by update last_pos too once ext4_htree_fill_tree return fail. Signed-off-by: yangerkun <yangerkun(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/dir.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index ae520a7263395..aed33af7551ee 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -535,7 +535,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) struct dir_private_info *info = file->private_data; struct inode *inode = file_inode(file); struct fname *fname; - int ret; + int ret = 0; if (!info) { info = ext4_htree_create_dir_info(file, ctx->pos); @@ -583,7 +583,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) info->curr_minor_hash, &info->next_hash); if (ret < 0) - return ret; + goto finished; if (ret == 0) { ctx->pos = ext4_get_htree_eof(file); break; @@ -614,7 +614,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) } finished: info->last_pos = ctx->pos; - return 0; + return ret < 0 ? ret : 0; } static int ext4_dir_open(struct inode * inode, struct file * filp) -- 2.25.1

1 0

Re: [PATCH openEuler-1.0-LTS] net:fix tcp timeout retransmits are always missing 2 times
by Xie XiuQi 17 Sep '21

17 Sep '21

Hi zhenyuan, Thanks for your patch. Please subscribe the kernel(a)openeuler.org mailing list first, and then resend this patch again, or your patch would be blocked. Others could not receive this email. Click this link for subscribe mailing list: https://openeuler.org/zh/community/mailing-list/ On 2021/9/17 11:40, jiazhenyuan wrote: > mainline inclusion > from mainline-v5.3.0 > commit 3256a2d6ab1f71f9a1bd2d7f6f18eb8108c48d17 > category: bugfix > bugzilla: https://gitee.com/openeuler/kernel/issues/I4AFRJ?from=project-issue > CVE: NA > > --------------------------------------------------------------- > > tcp: adjust rto_base in retransmits_timed_out() > The cited commit exposed an old retransmits_timed_out() bug > which assumed it could call tcp_model_timeout() with > TCP_RTO_MIN as rto_base for all states. > > But flows in SYN_SENT or SYN_RECV state uses a different > RTO base (1 sec instead of 200 ms, unless BPF choses > another value) > > This caused a reduction of SYN retransmits from 6 to 4 with > the default /proc/sys/net/ipv4/tcp_syn_retries value. > > Fixes: a41e8a8 ("tcp: better handle TCP_USER_TIMEOUT in SYN_SENT state") > Signed-off-by: Eric Dumazet <edumazet(a)google.com> > Cc: Yuchung Cheng <ycheng(a)google.com> > Cc: Marek Majkowski <marek(a)cloudflare.com> > Signed-off-by: David S. Miller <davem(a)davemloft.net> > > Signed-off-by: jiazhenyuan <jiazhenyuan(a)uniontech.com> > --- > net/ipv4/tcp_timer.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c > index 681882a40968..81a47e87c35d 100644 > --- a/net/ipv4/tcp_timer.c > +++ b/net/ipv4/tcp_timer.c > @@ -190,7 +190,7 @@ static bool retransmits_timed_out(struct sock *sk, > unsigned int boundary, > unsigned int timeout) > { > - const unsigned int rto_base = TCP_RTO_MIN; > + unsigned int rto_base = TCP_RTO_MIN; > unsigned int linear_backoff_thresh, start_ts; > > if (!inet_csk(sk)->icsk_retransmits) > @@ -201,6 +201,9 @@ static bool retransmits_timed_out(struct sock *sk, > return false; > > if (likely(timeout == 0)) { > + if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) > + rto_base = tcp_timeout_init(sk); > + > linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base); > > if (boundary <= linear_backoff_thresh) >

1 0

Re: [PATCH] arm64: smp: Fix cpu_freq print for NMI watchdog
by Xie XiuQi 17 Sep '21

17 Sep '21

Hi Wenchao, Thanks for your patch. Please subscribe the kernel(a)openeuler.org mailing list first, and then resend this patch again, or your patch would be blocked. Others who in the mailing list could not receive the emails. Click this link for subscribe mailing list: https://openeuler.org/zh/community/mailing-list/ On 2021/9/17 17:16, Wenchao Qin wrote: > hulk inclusion > category: bugfix > bugzilla: N/A > CVE: N/A > > ------------------------------ > > When we are in the arch_get_cpu_freq func for the first time, > after arch_probe_cpu_freq is excuted, the return of smp_processor_id() > will change due to preemption while cpu_freq get the freq belong to > original processor id, so pr_info will print the freq with wrong > processor id like below table from dmesg: > > [ 1.713211] NMI watchdog: CPU1 freq probed as 2189072384 HZ. > [ 1.810819] NMI watchdog: CPU1 freq probed as 2192003108 HZ. > [ 1.909910] NMI watchdog: CPU2 freq probed as 2191345967 HZ. > [ 2.015327] NMI watchdog: CPU3 freq probed as 2189460398 HZ. > > Actually, the first line should print the freq of CPU0, this bu > can occur in virtual machine with less then 17 vCPUs. > > Changing smp_processor_id() to cpu will fix the bug > > Signed-off-by: Wenchao Qin <qinwenchao(a)cmss.chinamobile.com> > --- > arch/arm64/kernel/smp.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c > index fe56277..d685a27 100644 > --- a/arch/arm64/kernel/smp.c > +++ b/arch/arm64/kernel/smp.c > @@ -1457,7 +1457,7 @@ static u64 arch_get_cpu_freq(void) > if (!cpu_freq) { > cpu_freq = arch_probe_cpu_freq(); > pr_info("NMI watchdog: CPU%u freq probed as %llu HZ.\n", > - smp_processor_id(), cpu_freq); > + cpu, cpu_freq); arch_probe_cpu_freq() 一样也会调用 smp_processor_id()，也可能存在被抢占的情况。是不是需要关抢占？ > if (!cpu_freq) > cpu_freq = -1; > per_cpu(cpu_freq_probed, cpu) = cpu_freq; >

1 0

[PATCH kernel-4.19] blk-throttle: fix UAF by deleteing timer in blk_throtl_exit()
by Yang Yingliang 16 Sep '21

16 Sep '21

From: Li Jinlin <lijinlin3(a)huawei.com> mainline inclusion from mainline-5.14 commit 884f0e84f1e3195b801319c8ec3d5774e9bf2710 category: bugfix bugzilla: NA CVE: NA The pending timer has been set up in blk_throtl_init(). However, the timer is not deleted in blk_throtl_exit(). This means that the timer handler may still be running after freeing the timer, which would result in a use-after-free. Fix by calling del_timer_sync() to delete the timer in blk_throtl_exit(). Signed-off-by: Li Jinlin <lijinlin3(a)huawei.com> Link: https://lore.kernel.org/r/20210907121242.2885564-1-lijinlin3@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-throttle.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 9426330d99dda..2c6df348faf5f 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -2482,6 +2482,7 @@ int blk_throtl_init(struct request_queue *q) void blk_throtl_exit(struct request_queue *q) { BUG_ON(!q->td); + del_timer_sync(&q->td->service_queue.pending_timer); throtl_shutdown_wq(q); blkcg_deactivate_policy(q, &blkcg_policy_throtl); free_percpu(q->td->latency_buckets[READ]); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] fix hibmc did not get edid
by Gou Hao 16 Sep '21

16 Sep '21

From: gouhao <gouhao(a)uniontech.com> uniontech inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I469VQ CVE: NA ---------------------------------------------------------- fix hibmc did not get edid. backport from openEuler master branch: 4eb4d99dfe: drm/hisilicon: Support i2c driver algorithms for bit-shift a0d078d06e: drm/hisilicon: Features to support reading resolutions from EDID. Modified the a0d078d06e original patch. add include/drm/drm_probe_helper.h add drm_connector_init_with_ddc interface in /drivers/gpu/drm/drm_connector.c Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Signed-off-by: Andrzej Pietrasiewicz <andrzej.p(a)collabora.com> Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> Signed-off-by: Gou Hao <gouhao(a)uniontech.com> --- drivers/gpu/drm/drm_connector.c | 35 +++++++ drivers/gpu/drm/hisilicon/hibmc/Makefile | 3 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 27 +++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 99 +++++++++++++++++++ .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 59 ++++++++--- include/drm/drm_connector.h | 17 ++++ include/drm/drm_probe_helper.h | 27 +++++ 7 files changed, 250 insertions(+), 17 deletions(-) create mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c create mode 100644 include/drm/drm_probe_helper.h diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index 6011d769d..ed49d0e93 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -290,6 +290,41 @@ out_put: } EXPORT_SYMBOL(drm_connector_init); +/** + * drm_connector_init_with_ddc - Init a preallocated connector + * @dev: DRM device + * @connector: the connector to init + * @funcs: callbacks for this connector + * @connector_type: user visible type of the connector + * @ddc: pointer to the associated ddc adapter + * + * Initialises a preallocated connector. Connectors should be + * subclassed as part of driver connector objects. + * + * Ensures that the ddc field of the connector is correctly set. + * + * Returns: + * Zero on success, error code on failure. + */ +int drm_connector_init_with_ddc(struct drm_device *dev, + struct drm_connector *connector, + const struct drm_connector_funcs *funcs, + int connector_type, + struct i2c_adapter *ddc) +{ + int ret; + + ret = drm_connector_init(dev, connector, funcs, connector_type); + if (ret) + return ret; + + /* provide ddc symlink in sysfs */ + connector->ddc = ddc; + + return ret; +} +EXPORT_SYMBOL(drm_connector_init_with_ddc); + /** * drm_connector_attach_encoder - attach a connector to an encoder * @connector: connector to attach diff --git a/drivers/gpu/drm/hisilicon/hibmc/Makefile b/drivers/gpu/drm/hisilicon/hibmc/Makefile index 3df726696..14c1ca9c9 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/Makefile +++ b/drivers/gpu/drm/hisilicon/hibmc/Makefile @@ -1,3 +1,4 @@ -hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o hibmc_drm_fbdev.o hibmc_ttm.o +hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o \ + hibmc_drm_fbdev.o hibmc_ttm.o hibmc_drm_i2c.o obj-$(CONFIG_DRM_HISI_HIBMC) += hibmc-drm.o diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 4395dc667..2b42864ba 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -19,12 +19,24 @@ #ifndef HIBMC_DRM_DRV_H #define HIBMC_DRM_DRV_H +#include <linux/gpio/consumer.h> +#include <linux/i2c-algo-bit.h> +#include <linux/i2c.h> + +#include <drm/drm_edid.h> #include <drm/drmP.h> #include <drm/drm_atomic.h> #include <drm/drm_fb_helper.h> #include <drm/drm_gem.h> #include <drm/ttm/ttm_bo_driver.h> +struct hibmc_connector { + struct drm_connector base; + + struct i2c_adapter adapter; + struct i2c_algo_bit_data bit_data; +}; + struct hibmc_framebuffer { struct drm_framebuffer fb; struct drm_gem_object *obj; @@ -43,6 +55,8 @@ struct hibmc_drm_private { unsigned long fb_base; unsigned long fb_size; bool msi_enabled; + struct drm_encoder encoder; + struct hibmc_connector connector; /* drm */ struct drm_device *dev; @@ -60,6 +74,17 @@ struct hibmc_drm_private { bool mm_inited; }; +static inline struct hibmc_connector *to_hibmc_connector(struct drm_connector *connector) +{ + return container_of(connector, struct hibmc_connector, base); +} + +static inline struct hibmc_drm_private *to_hibmc_drm_private(struct drm_device *dev) +{ + return dev->dev_private; +} + + #define to_hibmc_framebuffer(x) container_of(x, struct hibmc_framebuffer, fb) struct hibmc_bo { @@ -111,6 +136,8 @@ int hibmc_dumb_mmap_offset(struct drm_file *file, struct drm_device *dev, u32 handle, u64 *offset); int hibmc_mmap(struct file *filp, struct vm_area_struct *vma); +int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_connector *connector); + extern const struct drm_mode_config_funcs hibmc_mode_funcs; #endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c new file mode 100644 index 000000000..86d712090 --- /dev/null +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -0,0 +1,99 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* Hisilicon Hibmc SoC drm driver + * + * Based on the bochs drm driver. + * + * Copyright (c) 2016 Huawei Limited. + * + * Author: + * Tian Tao <tiantao6(a)hisilicon.com> + */ + +#include <linux/delay.h> +#include <linux/pci.h> + +#include <drm/drm_atomic_helper.h> +#include <drm/drm_probe_helper.h> + +#include "hibmc_drm_drv.h" + +#define GPIO_DATA 0x0802A0 +#define GPIO_DATA_DIRECTION 0x0802A4 + +#define I2C_SCL_MASK BIT(0) +#define I2C_SDA_MASK BIT(1) + +static void hibmc_set_i2c_signal(void *data, u32 mask, int value) +{ + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); + u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); + + if (value) { + tmp_dir &= ~mask; + writel(tmp_dir, priv->mmio + GPIO_DATA_DIRECTION); + } else { + u32 tmp_data = readl(priv->mmio + GPIO_DATA); + + tmp_data &= ~mask; + writel(tmp_data, priv->mmio + GPIO_DATA); + + tmp_dir |= mask; + writel(tmp_dir, priv->mmio + GPIO_DATA_DIRECTION); + } +} + +static int hibmc_get_i2c_signal(void *data, u32 mask) +{ + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); + u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); + + if ((tmp_dir & mask) != mask) { + tmp_dir &= ~mask; + writel(tmp_dir, priv->mmio + GPIO_DATA_DIRECTION); + } + + return (readl(priv->mmio + GPIO_DATA) & mask) ? 1 : 0; +} + +static void hibmc_ddc_setsda(void *data, int state) +{ + hibmc_set_i2c_signal(data, I2C_SDA_MASK, state); +} + +static void hibmc_ddc_setscl(void *data, int state) +{ + hibmc_set_i2c_signal(data, I2C_SCL_MASK, state); +} + +static int hibmc_ddc_getsda(void *data) +{ + return hibmc_get_i2c_signal(data, I2C_SDA_MASK); +} + +static int hibmc_ddc_getscl(void *data) +{ + return hibmc_get_i2c_signal(data, I2C_SCL_MASK); +} + +int hibmc_ddc_create(struct drm_device *drm_dev, + struct hibmc_connector *connector) +{ + connector->adapter.owner = THIS_MODULE; + connector->adapter.class = I2C_CLASS_DDC; + snprintf(connector->adapter.name, I2C_NAME_SIZE, "HIS i2c bit bus"); + connector->adapter.dev.parent = &drm_dev->pdev->dev; + i2c_set_adapdata(&connector->adapter, connector); + connector->adapter.algo_data = &connector->bit_data; + + connector->bit_data.udelay = 20; + connector->bit_data.timeout = usecs_to_jiffies(2000); + connector->bit_data.data = connector; + connector->bit_data.setsda = hibmc_ddc_setsda; + connector->bit_data.setscl = hibmc_ddc_setscl; + connector->bit_data.getsda = hibmc_ddc_getsda; + connector->bit_data.getscl = hibmc_ddc_getscl; + + return i2c_bit_add_bus(&connector->adapter); +} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 90319a902..3f176d500 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -59,11 +59,24 @@ static int hibmc_valid_mode(int w, int h) static int hibmc_connector_get_modes(struct drm_connector *connector) { int count; + void *edid; + struct hibmc_connector *hibmc_connector = to_hibmc_connector(connector); + + edid = drm_get_edid(connector, &hibmc_connector->adapter); + if (edid) { + drm_connector_update_edid_property(connector, edid); + count = drm_add_edid_modes(connector, edid); + if (count) + goto out; + } - drm_connector_update_edid_property(connector, NULL); - count = drm_add_modes_noedid(connector, 1920, 1200); + count = drm_add_modes_noedid(connector, + connector->dev->mode_config.max_width, + connector->dev->mode_config.max_height); drm_set_preferred_mode(connector, 1024, 768); +out: + kfree(edid); return count; } @@ -86,6 +99,14 @@ hibmc_connector_best_encoder(struct drm_connector *connector) return drm_encoder_find(connector->dev, NULL, connector->encoder_ids[0]); } +static void hibmc_connector_destroy(struct drm_connector *connector) +{ + struct hibmc_connector *hibmc_connector = to_hibmc_connector(connector); + + i2c_del_adapter(&hibmc_connector->adapter); + drm_connector_cleanup(connector); +} + static const struct drm_connector_helper_funcs hibmc_connector_helper_funcs = { .get_modes = hibmc_connector_get_modes, @@ -95,7 +116,7 @@ static const struct drm_connector_helper_funcs static const struct drm_connector_funcs hibmc_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = drm_connector_cleanup, + .destroy = hibmc_connector_destroy, .reset = drm_atomic_helper_connector_reset, .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, @@ -155,21 +176,15 @@ static const struct drm_encoder_funcs hibmc_encoder_funcs = { int hibmc_vdac_init(struct hibmc_drm_private *priv) { struct drm_device *dev = priv->dev; - struct drm_encoder *encoder; - struct drm_connector *connector; + struct hibmc_connector *hibmc_connector = &priv->connector; + struct drm_encoder *encoder = &priv->encoder; + struct drm_connector *connector = &hibmc_connector->base; int ret; - connector = hibmc_connector_init(priv); - if (IS_ERR(connector)) { - DRM_ERROR("failed to create connector: %ld\n", - PTR_ERR(connector)); - return PTR_ERR(connector); - } - - encoder = devm_kzalloc(dev->dev, sizeof(*encoder), GFP_KERNEL); - if (!encoder) { - DRM_ERROR("failed to alloc memory when init encoder\n"); - return -ENOMEM; + ret = hibmc_ddc_create(dev, hibmc_connector); + if (ret) { + DRM_ERROR("failed to create ddc: %d\n", ret); + return ret; } encoder->possible_crtcs = 0x1; @@ -181,6 +196,18 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) } drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); + + ret = drm_connector_init_with_ddc(dev, connector, + &hibmc_connector_funcs, + DRM_MODE_CONNECTOR_VGA, + &hibmc_connector->adapter); + if (ret) { + DRM_ERROR("failed to init connector: %d\n", ret); + return ret; + } + + drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); + drm_connector_attach_encoder(connector, encoder); return 0; diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h index 97ea41dc6..b9efb4564 100644 --- a/include/drm/drm_connector.h +++ b/include/drm/drm_connector.h @@ -998,6 +998,18 @@ struct drm_connector { * [0]: progressive, [1]: interlaced */ int audio_latency[2]; + + /** + * @ddc: associated ddc adapter. + * A connector usually has its associated ddc adapter. If a driver uses + * this field, then an appropriate symbolic link is created in connector + * sysfs directory to make it easy for the user to tell which i2c + * adapter is for a particular display. + * + * The field should be set by calling drm_connector_init_with_ddc(). + */ + struct i2c_adapter *ddc; + /** * @null_edid_counter: track sinks that give us all zeros for the EDID. * Needed to workaround some HW bugs where we get all 0s @@ -1083,6 +1095,11 @@ int drm_connector_init(struct drm_device *dev, struct drm_connector *connector, const struct drm_connector_funcs *funcs, int connector_type); +int drm_connector_init_with_ddc(struct drm_device *dev, + struct drm_connector *connector, + const struct drm_connector_funcs *funcs, + int connector_type, + struct i2c_adapter *ddc); int drm_connector_register(struct drm_connector *connector); void drm_connector_unregister(struct drm_connector *connector); int drm_connector_attach_encoder(struct drm_connector *connector, diff --git a/include/drm/drm_probe_helper.h b/include/drm/drm_probe_helper.h new file mode 100644 index 000000000..8d3ed2834 --- /dev/null +++ b/include/drm/drm_probe_helper.h @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 OR MIT + +#ifndef __DRM_PROBE_HELPER_H__ +#define __DRM_PROBE_HELPER_H__ + +#include <linux/types.h> + +struct drm_connector; +struct drm_device; +struct drm_modeset_acquire_ctx; + +int drm_helper_probe_single_connector_modes(struct drm_connector + *connector, uint32_t maxX, + uint32_t maxY); +int drm_helper_probe_detect(struct drm_connector *connector, + struct drm_modeset_acquire_ctx *ctx, + bool force); +void drm_kms_helper_poll_init(struct drm_device *dev); +void drm_kms_helper_poll_fini(struct drm_device *dev); +bool drm_helper_hpd_irq_event(struct drm_device *dev); +void drm_kms_helper_hotplug_event(struct drm_device *dev); + +void drm_kms_helper_poll_disable(struct drm_device *dev); +void drm_kms_helper_poll_enable(struct drm_device *dev); +bool drm_kms_helper_is_poll_worker(void); + +#endif -- 2.20.1

2 1

【Meeting Notice】openEuler kernel 技术分享第十二期 & 双周例会 Time: 2021-09-17 14:00-17:00
by Meeting Book 16 Sep '21

16 Sep '21

1 0

[PATCH kernel-4.19] nvme-rdma: don't update queue count when failing to set io queues
by Yang Yingliang 16 Sep '21

16 Sep '21

From: Ruozhu Li <liruozhu(a)huawei.com> mainline inclusion from mainline-v5.15 commit 85032874f80ba17bf187de1d14d9603bf3f582b8 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE This patch fix a BUG_ON when rescan ns after set queue count cmd timeout: BUG_ON(hctx_idx >= ctrl->ctrl.queue_count); //in nvme_rdma_init_hctx Call trace: nvme_rdma_init_hctx+0x58/0x60 [nvme_rdma] blk_mq_realloc_hw_ctxs+0x140/0x4c0 blk_mq_init_allocated_queue+0x130/0x410 blk_mq_init_queue+0x40/0x88 nvme_validate_ns+0xb8/0x740 nvme_scan_work+0x29c/0x460 process_one_work+0x1f8/0x490 worker_thread+0x50/0x4b8 kthread+0x134/0x138 ret_from_fork+0x10/0x18 ------------------------------------------------- We update ctrl->queue_count and schedule another reconnect when io queue count is zero.But we will never try to create any io queue in next reco- nnection, because ctrl->queue_count already set to zero.We will end up having an admin-only session in Live state, which is exactly what we try to avoid in the original patch. Update ctrl->queue_count after queue_count zero checking to fix it. Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Tested-by: Ruozhu Li <liruozhu(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index 91ff9262f6729..b8e0d637ddcfc 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -656,13 +656,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) if (ret) return ret; - ctrl->ctrl.queue_count = nr_io_queues + 1; - if (ctrl->ctrl.queue_count < 2) { + if (nr_io_queues == 0) { dev_err(ctrl->ctrl.device, "unable to set any I/O queues\n"); return -ENOMEM; } + ctrl->ctrl.queue_count = nr_io_queues + 1; dev_info(ctrl->ctrl.device, "creating %d I/O queues.\n", nr_io_queues); -- 2.25.1

1 0

[PATCH kernel-4.19 1/5] Revert "sched/membarrier: fix NULL poiner in membarrier_global_expedited"
by Yang Yingliang 16 Sep '21

16 Sep '21

From: Li Hua <hucool.lihua(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I3UKOW CVE: NA ------------------------------------------------- This reverts commit 3eb3533c1cb849559fc5a01410e7c863624b2ae5. Remove the work aroud to fix NULL poiner in membarrier_global_expedited, so as to prepare to introduce formal bug fix solution. Signed-off-by: Li Hua <hucool.lihua(a)huawei.com> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/sched/membarrier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c index ea888ddb914f6..c4ea07e857985 100644 --- a/kernel/sched/membarrier.c +++ b/kernel/sched/membarrier.c @@ -115,7 +115,7 @@ static int membarrier_global_expedited(void) * scheduling a kthread. */ p = task_rcu_dereference(&cpu_rq(cpu)->curr); - if (p && p->flags & PF_KTHREAD) + if (p->flags & PF_KTHREAD) continue; __cpumask_set_cpu(cpu, tmpmask); -- 2.25.1

1 4

[PATCH kernel-4.19 openEuler-1.0-LTS 00/30] psi support for 4.19
by Cheng Jian 16 Sep '21

16 Sep '21

psi support for 4.19 Liu Xinpeng (30): delayacct: track delays from thrashing cache pages sched: loadavg: consolidate LOAD_INT, LOAD_FRAC, CALC_LOAD sched: loadavg: make calc_load_n() public sched: sched.h: make rq locking and clock functions available in stats.h sched: introduce this_rq_lock_irq() psi: pressure stall information for CPU, memory, and IO psi: cgroup support kernel/sched/psi.c: simplify cgroup_move_task() psi: make disabling/enabling easier for vendor kernels psi: fix aggregation idle shut-off psi: avoid divide-by-zero crash inside virtual machines fs: kernfs: add poll file operation kernel: cgroup: add poll file operation psi: introduce state_mask to represent stalled psi states psi: make psi_enable static psi: rename psi fields in preparation for psi trigger addition psi: split update_stats into parts psi: track changed states include/: refactor headers to allow kthread.h inclusion in psi_types.h psi: introduce psi monitor kernel/sched/psi.c: expose pressure metrics on root cgroup sched/psi: Reduce psimon FIFO priority sched/psi: Do not require setsched permission from the psi: get poll_work to run when calling poll syscall next time sched/psi: Correct overly pessimistic size calculation sched/psi: Fix sampling error and rare div0 crashes with cgroups and high uptime psi: Fix a division error in psi poll() sched/psi: Fix OOB write when writing 0 bytes to PSI files psi:enable psi in config avoid kabi change for psi merged feature Documentation/accounting/psi.txt | 180 +++ Documentation/admin-guide/cgroup-v2.rst | 18 + .../admin-guide/kernel-parameters.txt | 4 + arch/arm64/configs/openeuler_defconfig | 2 + .../platforms/cell/cpufreq_spudemand.c | 2 +- arch/powerpc/platforms/cell/spufs/sched.c | 9 +- arch/s390/appldata/appldata_os.c | 4 - arch/x86/configs/openeuler_defconfig | 2 + block/blk-iolatency.c | 8 +- drivers/cpuidle/governors/menu.c | 4 - drivers/spi/spi-rockchip.c | 1 + fs/kernfs/file.c | 31 +- fs/proc/loadavg.c | 3 - include/linux/cgroup-defs.h | 12 + include/linux/cgroup.h | 15 + include/linux/delayacct.h | 27 + include/linux/kernfs.h | 8 + include/linux/kthread.h | 4 + include/linux/psi.h | 65 + include/linux/psi_types.h | 173 +++ include/linux/sched.h | 9 + include/linux/sched/loadavg.h | 24 +- include/uapi/linux/taskstats.h | 8 +- init/Kconfig | 28 + kernel/cgroup/cgroup.c | 129 +- kernel/debug/kdb/kdb_main.c | 7 +- kernel/delayacct.c | 15 + kernel/fork.c | 4 + kernel/kthread.c | 3 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 16 +- kernel/sched/loadavg.c | 139 +- kernel/sched/psi.c | 1292 +++++++++++++++++ kernel/sched/sched.h | 178 +-- kernel/sched/stats.h | 86 ++ kernel/workqueue.c | 23 + kernel/workqueue_internal.h | 6 +- mm/compaction.c | 5 + mm/filemap.c | 20 + mm/page_alloc.c | 9 + mm/vmscan.c | 9 + tools/accounting/getdelays.c | 8 +- 42 files changed, 2380 insertions(+), 211 deletions(-) create mode 100644 Documentation/accounting/psi.txt create mode 100644 include/linux/psi.h create mode 100644 include/linux/psi_types.h create mode 100644 kernel/sched/psi.c -- 2.25.1

1 17

[PATCH kernel-4.19 1/2] scsi: hisi_sas: use threaded irq to process CQ interrupts
by Yang Yingliang 15 Sep '21

15 Sep '21

From: Yang Xingui <yangxingui(a)huawei.com> mainline inclusion from mainline-v5.10-rc4 commit 81f338e9709d category: bugfix bugzilla: NA CVE: NA Currently IRQ_EFFECTIVE_AFF_MASK is enabled for ARM_GIC and ARM_GIC3, so it only allows a single target CPU in the affinity mask to process interrupts and also interrupt thread, and the performance of using threaded irq is almost the same as tasklet. But if the config is not enabled, the interrupt thread will be allowed all the CPUs in the affinity mask. At that situation it improves the performance (about 20%). Note: IRQ_EFFECTIVE_AFF_MASK is configured differently for different architecture chip, and it seems to be better to make it be configured easily. Link: https://lore.kernel.org/r/1579522957-4393-2-git-send-email-john.garry@huawe… Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: John Garry <john.garry(a)huawei.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yang Xingui <yangxingui(a)huawei.com> Reviewed-by: kangfenglong <kangfenglong(a)huawei.com> Reviewed-by: ouyangdelong < ouyangdelong(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas.h | 4 ++-- drivers/scsi/hisi_sas/hisi_sas_main.c | 22 +++++++++--------- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 28 ++++++++-------------- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 32 ++++++++++++-------------- 4 files changed, 38 insertions(+), 48 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h index 80cd8870477b4..eae0e533ce7fc 100644 --- a/drivers/scsi/hisi_sas/hisi_sas.h +++ b/drivers/scsi/hisi_sas/hisi_sas.h @@ -173,9 +173,9 @@ struct hisi_sas_port { struct hisi_sas_cq { struct hisi_hba *hisi_hba; - struct tasklet_struct tasklet; int rd_point; int id; + int irq_no; }; struct hisi_sas_dq { @@ -591,7 +591,7 @@ extern void hisi_sas_slot_task_free(struct hisi_hba *hisi_hba, extern void hisi_sas_init_mem(struct hisi_hba *hisi_hba); extern void hisi_sas_rst_work_handler(struct work_struct *work); extern void hisi_sas_sync_rst_work_handler(struct work_struct *work); -extern void hisi_sas_kill_tasklets(struct hisi_hba *hisi_hba); +extern void hisi_sas_sync_irqs(struct hisi_hba *hisi_hba); extern bool hisi_sas_notify_phy_event(struct hisi_sas_phy *phy, enum hisi_sas_phy_event event); extern void hisi_sas_release_tasks(struct hisi_hba *hisi_hba); diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 902893dfaacc2..6138e5240c347 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -1248,10 +1248,10 @@ static int hisi_sas_exec_internal_tmf_task(struct domain_device *device, struct hisi_sas_cq *cq = &hisi_hba->cq[slot->dlvry_queue]; /* - * flush tasklet to avoid free'ing task + * sync irq to avoid free'ing task * before using task in IO completion */ - tasklet_kill(&cq->tasklet); + synchronize_irq(cq->irq_no); slot->task = NULL; } @@ -1660,11 +1660,11 @@ static int hisi_sas_abort_task(struct sas_task *task) if (slot) { /* - * flush tasklet to avoid free'ing task + * sync irq to avoid free'ing task * before using task in IO completion */ cq = &hisi_hba->cq[slot->dlvry_queue]; - tasklet_kill(&cq->tasklet); + synchronize_irq(cq->irq_no); } spin_unlock_irqrestore(&task->task_state_lock, flags); rc = TMF_RESP_FUNC_COMPLETE; @@ -1727,10 +1727,10 @@ static int hisi_sas_abort_task(struct sas_task *task) if (((rc < 0) || (rc == TMF_RESP_FUNC_FAILED)) && task->lldd_task) { /* - * flush tasklet to avoid free'ing task + * sync irq to avoid free'ing task * before using task in IO completion */ - tasklet_kill(&cq->tasklet); + synchronize_irq(cq->irq_no); slot->task = NULL; } } @@ -2103,10 +2103,10 @@ _hisi_sas_internal_task_abort(struct hisi_hba *hisi_hba, struct hisi_sas_cq *cq = &hisi_hba->cq[slot->dlvry_queue]; /* - * flush tasklet to avoid free'ing task + * sync irq to avoid free'ing task * before using task in IO completion */ - tasklet_kill(&cq->tasklet); + synchronize_irq(cq->irq_no); slot->task = NULL; } dev_err(dev, "internal task abort: timeout and not done.\n"); @@ -2262,17 +2262,17 @@ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy) } EXPORT_SYMBOL_GPL(hisi_sas_phy_down); -void hisi_sas_kill_tasklets(struct hisi_hba *hisi_hba) +void hisi_sas_sync_irqs(struct hisi_hba *hisi_hba) { int i; for (i = 0; i < hisi_hba->nvecs; i++) { struct hisi_sas_cq *cq = &hisi_hba->cq[i]; - tasklet_kill(&cq->tasklet); + synchronize_irq(cq->irq_no); } } -EXPORT_SYMBOL_GPL(hisi_sas_kill_tasklets); +EXPORT_SYMBOL_GPL(hisi_sas_sync_irqs); int hisi_sas_host_reset(struct Scsi_Host *shost, int reset_type) { diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c index 61ff065e5d9b8..fa4233454dccb 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c @@ -3148,9 +3148,9 @@ static irqreturn_t fatal_axi_int_v2_hw(int irq_no, void *p) return IRQ_HANDLED; } -static void cq_tasklet_v2_hw(unsigned long val) +static irqreturn_t cq_thread_v2_hw(int irq_no, void *p) { - struct hisi_sas_cq *cq = (struct hisi_sas_cq *)val; + struct hisi_sas_cq *cq = p; struct hisi_hba *hisi_hba = cq->hisi_hba; struct hisi_sas_slot *slot; struct hisi_sas_itct *itct; @@ -3212,6 +3212,8 @@ static void cq_tasklet_v2_hw(unsigned long val) /* update rd_point */ cq->rd_point = rd_point; hisi_sas_write32(hisi_hba, COMPL_Q_0_RD_PTR + (0x14 * queue), rd_point); + + return IRQ_HANDLED; } static irqreturn_t cq_interrupt_v2_hw(int irq_no, void *p) @@ -3222,9 +3224,7 @@ static irqreturn_t cq_interrupt_v2_hw(int irq_no, void *p) hisi_sas_write32(hisi_hba, OQ_INT_SRC, 1 << queue); - tasklet_schedule(&cq->tasklet); - - return IRQ_HANDLED; + return IRQ_WAKE_THREAD; } static irqreturn_t sata_int_v2_hw(int irq_no, void *p) @@ -3394,11 +3394,11 @@ static int interrupt_init_v2_hw(struct hisi_hba *hisi_hba) for (queue_no = 0; queue_no < hisi_hba->queue_count; queue_no++) { struct hisi_sas_cq *cq = &hisi_hba->cq[queue_no]; - struct tasklet_struct *t = &cq->tasklet; - - irq = irq_map[queue_no + 96]; - rc = devm_request_irq(dev, irq, cq_interrupt_v2_hw, 0, - DRV_NAME " cq", cq); + cq->irq_no = irq_map[queue_no + 96]; + rc = devm_request_threaded_irq(dev, cq->irq_no, + cq_interrupt_v2_hw, + cq_thread_v2_hw, IRQF_ONESHOT, + DRV_NAME " cq", cq); if (rc) { dev_err(dev, "irq init: could not request cq interrupt %d, rc=%d\n", @@ -3406,7 +3406,6 @@ static int interrupt_init_v2_hw(struct hisi_hba *hisi_hba) rc = -ENOENT; goto free_cq_int_irqs; } - tasklet_init(t, cq_tasklet_v2_hw, (unsigned long)cq); } hisi_hba->nvecs = hisi_hba->queue_count; @@ -3418,7 +3417,6 @@ static int interrupt_init_v2_hw(struct hisi_hba *hisi_hba) struct hisi_sas_cq *cq = &hisi_hba->cq[k]; free_irq(irq_map[k + 96], cq); - tasklet_kill(&cq->tasklet); } free_fatal_int_irqs: for (k = 0; k < fatal_no; k++) @@ -3487,7 +3485,6 @@ static int soft_reset_v2_hw(struct hisi_hba *hisi_hba) interrupt_disable_v2_hw(hisi_hba); hisi_sas_write32(hisi_hba, DLVRY_QUEUE_ENABLE, 0x0); - hisi_sas_kill_tasklets(hisi_hba); hisi_sas_stop_phys(hisi_hba); @@ -3660,11 +3657,6 @@ static int hisi_sas_v2_probe(struct platform_device *pdev) static int hisi_sas_v2_remove(struct platform_device *pdev) { - struct sas_ha_struct *sha = platform_get_drvdata(pdev); - struct hisi_hba *hisi_hba = sha->lldd_ha; - - hisi_sas_kill_tasklets(hisi_hba); - return hisi_sas_remove(pdev); } diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index b38aa8d0a2242..a9f53dbb91679 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -2506,9 +2506,9 @@ slot_complete_v3_hw(struct hisi_hba *hisi_hba, struct hisi_sas_slot *slot) return sts; } -static void cq_tasklet_v3_hw(unsigned long val) +static irqreturn_t cq_thread_v3_hw(int irq_no, void *p) { - struct hisi_sas_cq *cq = (struct hisi_sas_cq *)val; + struct hisi_sas_cq *cq = p; struct hisi_hba *hisi_hba = cq->hisi_hba; struct hisi_sas_slot *slot; struct hisi_sas_complete_v3_hdr *complete_queue; @@ -2545,6 +2545,8 @@ static void cq_tasklet_v3_hw(unsigned long val) hisi_sas_write32(hisi_hba, COMPL_Q_0_RD_PTR + (NEXT_DQCQ_REG_OFF * queue), rd_point); + + return IRQ_HANDLED; } static irqreturn_t cq_interrupt_v3_hw(int irq_no, void *p) @@ -2555,9 +2557,7 @@ static irqreturn_t cq_interrupt_v3_hw(int irq_no, void *p) hisi_sas_write32(hisi_hba, OQ_INT_SRC, 1 << queue); - tasklet_schedule(&cq->tasklet); - - return IRQ_HANDLED; + return IRQ_WAKE_THREAD; } static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba) @@ -2626,17 +2626,19 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba) goto free_chnl_interrupt; } - /* Init tasklets for cq only */ for (i = 0; i < hisi_hba->nvecs; i++) { struct hisi_sas_cq *cq = &hisi_hba->cq[i]; - struct tasklet_struct *t = &cq->tasklet; int nr = hisi_sas_intr_conv ? PCI_IRQ_CQ_BASE : PCI_IRQ_CQ_BASE + i; - unsigned long irqflags = hisi_sas_intr_conv ? IRQF_SHARED : 0; - - rc = devm_request_irq(dev, pci_irq_vector(pdev, nr), - cq_interrupt_v3_hw, irqflags, - DRV_NAME " cq", cq); + unsigned long irqflags = hisi_sas_intr_conv ? IRQF_SHARED : + IRQF_ONESHOT; + + cq->irq_no = pci_irq_vector(pdev, nr); + rc = devm_request_threaded_irq(dev, cq->irq_no, + cq_interrupt_v3_hw, + cq_thread_v3_hw, + irqflags, + DRV_NAME " cq", cq); if (rc) { dev_err(dev, "could not request cq%d interrupt, rc=%d\n", @@ -2644,8 +2646,6 @@ static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba) rc = -ENOENT; goto free_cq_irqs; } - - tasklet_init(t, cq_tasklet_v3_hw, (uintptr_t)cq); } return 0; @@ -2768,7 +2768,6 @@ static int disable_host_v3_hw(struct hisi_hba *hisi_hba) interrupt_disable_v3_hw(hisi_hba); hisi_sas_write32(hisi_hba, DLVRY_QUEUE_ENABLE, 0x0); - hisi_sas_kill_tasklets(hisi_hba); hisi_sas_stop_phys(hisi_hba); @@ -3121,7 +3120,7 @@ static void debugfs_snapshot_prepare_v3_hw(struct hisi_hba *hisi_hba) if (wait_cmds_complete_timeout_v3_hw(hisi_hba, 100, 5000) == -ETIMEDOUT) dev_dbg(dev, "Wait commands complete timeout!\n"); - hisi_sas_kill_tasklets(hisi_hba); + hisi_sas_sync_irqs(hisi_hba); } static void debugfs_snapshot_restore_v3_hw(struct hisi_hba *hisi_hba) @@ -3509,7 +3508,6 @@ static void hisi_sas_v3_remove(struct pci_dev *pdev) sas_remove_host(sha->core.shost); hisi_sas_v3_destroy_irqs(pdev, hisi_hba); - hisi_sas_kill_tasklets(hisi_hba); pci_release_regions(pdev); pci_disable_device(pdev); hisi_sas_free(hisi_hba); -- 2.25.1

1 1

【Meeting Notice】openEuler kernel 技术分享第十二期 & 双周例会 Time: 2021-09-17 14:00-17:00
by Meeting Book 15 Sep '21

15 Sep '21

1 0

[PATCH kernel-4.19] ext4: fix race writing to an inline_data file while its xattrs are changing
by Yang Yingliang 14 Sep '21

14 Sep '21

From: Theodore Ts'o <tytso(a)mit.edu> mainline inclusion from mainline-5.14 commit 9e445093e523f3277081314c864f708fd4bd34aa category: bugfix bugzilla: 180850 CVE: NA ------------------------------------------------- The location of the system.data extended attribute can change whenever xattr_sem is not taken. So we need to recalculate the i_inline_off field since it mgiht have changed between ext4_write_begin() and ext4_write_end(). This means that caching i_inline_off is probably not helpful, so in the long run we should probably get rid of it and shrink the in-memory ext4 inode slightly, but let's fix the race the simple way for now. Cc: stable(a)kernel.org Fixes: f19d5870cbf72 ("ext4: add normal write support for inline data") Reported-by: syzbot+13146364637c7363a7de(a)syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/ext4/inline.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c index 7eeed4d50deac..3e238a2840a3b 100644 --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, ext4_write_lock_xattr(inode, &no_expand); BUG_ON(!ext4_has_inline_data(inode)); + /* + * ei->i_inline_off may have changed since ext4_write_begin() + * called ext4_try_to_write_inline_data() + */ + (void) ext4_find_inline_data_nolock(inode); + kaddr = kmap_atomic(page); ext4_write_inline_data(inode, &iloc, kaddr, pos, len); kunmap_atomic(kaddr); -- 2.25.1

1 0

[PATCH kernel-4.19] uce: pagecache reading scenario add shmem support
by Yang Yingliang 14 Sep '21

14 Sep '21

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I44REB CVE: NA --------------------------- The call trace is as follows: __arch_copy_to_user+0x1bc/0x21c copy_page_to_iter+0xdc/0x328 shmem_file_read_iter+0x124/0x350 __vfs_read+0x11c/0x188 vfs_read+0x94/0x150 ksys_read+0x6c/0xd8 __arm64_sys_read+0x24/0x30 el0_svc_common+0x78/0x130 el0_svc_handler+0x38/0x78 el0_svc+0x8/0xc This patch add uce kernel recovery path support in shmem_file_read_iter(). Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/shmem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/shmem.c b/mm/shmem.c index 4522348cfc189..8d32d49a4d7ba 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -2674,7 +2674,14 @@ static ssize_t shmem_file_read_iter(struct kiocb *iocb, struct iov_iter *to) * Ok, we have the page, and it's up-to-date, so * now we can copy it to user space... */ +#ifdef CONFIG_UCE_KERNEL_RECOVERY + if (is_pagecache_reading_kernel_recovery_enable()) + ret = copy_page_to_iter_generic_read(page, offset, nr, to); + else + ret = copy_page_to_iter(page, offset, nr, to); +#else ret = copy_page_to_iter(page, offset, nr, to); +#endif retval += ret; offset += ret; index += offset >> PAGE_SHIFT; -- 2.25.1

1 0

Re: 答复: [PATCH] 4.19: PTP_KVM support for arm/arm64
by Keqian Zhu 14 Sep '21

14 Sep '21

好的，那我们暂时把这个事情优先级调低。 On 2021/9/14 15:15, Chentao (Boby) wrote: > 我和品高黎思恒前段时间聊过，思恒反馈客户已无意愿在ARM上使用该特性，因此他们移植该特性到ARM上的意愿在降低 > > -----邮件原件----- > 发件人: zhukeqian > 发送时间: 2021年9月14日 15:11 > 收件人: lisiheng <justcaca(a)126.com> > 抄送: lisiheng(a)bingosoft.net; kernel(a)openeuler.org; Xiexiuqi <xiexiuqi(a)huawei.com>; chengjian (D) <cj.chengjian(a)huawei.com>; xingchaochao <xingchaochao(a)huawei.com>; Chentao (Boby) <boby.chen(a)huawei.com> > 主题: Re: [PATCH] 4.19: PTP_KVM support for arm/arm64 > > Hi Siheng, > > On 2021/6/1 13:41, lisiheng wrote: >> 感谢review！ >> 我重新回合！ >> > 期待你将这个高价值特性回合到openEuler社区，我们会积极检视你的补丁。感谢你对openEuler社区的贡献:)。 > > Thanks, > Keqian > >> >> >> 在 2021-06-01 11:49:34，"Keqian Zhu" <zhukeqian1(a)huawei.com> 写道： >>> Hi Siheng, >>> >>> Thanks for your patch! >>> >>> 我看到你是从原作者的kata仓库【1】回合的补丁，我发现这组补丁是比较早期的。 >>> >>> 目前社区已经正式合入了ptp_kvm arm64的特性【2】，相比这组补丁，解决了很多问题。包括： >>> 1）对热迁移的支持。 >>> 2）ptp_kvm的hyper call做了一些扩展，以区分virt_counter和phys_counter。 >>> 3）host侧使用snapshot获取时间，提高精度。 >>> 等等。 >>> >>> 考虑到特性的功能稳定性，内核的兼容性，我建议从社区主线【2】回合补丁，谢谢！ >>> >>> 【1】https://github.com/kata-containers/packaging/blob/master/kernel/pat >>> ches/4.19.x/0001-4.19-enable-ptp_kvm-for-arm64-in-kata.patch >>> 【2】https://lore.kernel.org/kvmarm/20210330145430.996981-1-maz@kernel.o >>> rg/ >>> >>> >>> BRs, >>> Keqian >>> _______________________________________________ >>> Kernel mailing list -- kernel(a)openeuler.org To unsubscribe send an >>> email to kernel-leave(a)openeuler.org >>

1 0

[PATCH] 4.19: PTP_KVM support for arm/arm64
by lisiheng 14 Sep '21

14 Sep '21

From: lisiheng <lisiheng(a)bingosoft.net> PTP_KVM is used for high precision time sync between host and guests. It relies on transferring the wall clock and counter value from the host to the guest using a KVM-specific hypercall. mainline inclusion from mainline-v4.19 category: feature bugzilla:https://gitee.com/openeuler/kernel/issues/I3R900 CVE: NA Reference: https://www.kernel.org/doc/html/latest/_sources/virt/kvm/arm/ptp_kvm.rst.txt https://github.com/kata-containers/packaging/blob/master/kernel/patches/4.1… Signed-off-by: lisiheng <lisiheng(a)bingosoft.net> --- drivers/clocksource/arm_arch_timer.c | 24 ++++++ drivers/ptp/Kconfig | 2 +- drivers/ptp/Makefile | 1 + drivers/ptp/ptp_kvm_arm64.c | 52 ++++++++++++ drivers/ptp/{ptp_kvm.c => ptp_kvm_common.c} | 89 +++++---------------- drivers/ptp/ptp_kvm_x86.c | 87 ++++++++++++++++++++ fs/jbd2/transaction.c | 17 ---- include/asm-generic/ptp_kvm.h | 12 +++ include/linux/arm-smccc.h | 5 ++ virt/kvm/arm/hypercalls.c | 14 ++++ 10 files changed, 216 insertions(+), 87 deletions(-) create mode 100644 drivers/ptp/ptp_kvm_arm64.c rename drivers/ptp/{ptp_kvm.c => ptp_kvm_common.c} (55%) create mode 100644 drivers/ptp/ptp_kvm_x86.c create mode 100644 include/asm-generic/ptp_kvm.h diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index 6847a5fe13fd..f84bed34e9ea 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -1653,3 +1653,27 @@ static int __init arch_timer_acpi_init(struct acpi_table_header *table) } TIMER_ACPI_DECLARE(arch_timer, ACPI_SIG_GTDT, arch_timer_acpi_init); #endif + +#if IS_ENABLED(CONFIG_PTP_1588_CLOCK_KVM) +#include <linux/arm-smccc.h> +int kvm_arch_ptp_get_clock_fn(long *cycle, struct timespec64 *ts, + struct clocksource **cs) +{ + struct arm_smccc_res hvc_res; + + arm_smccc_1_1_invoke(ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID, + &hvc_res); + + if ((long)(hvc_res.a0) < 0) + return -EOPNOTSUPP; + + ts->tv_sec = hvc_res.a0; + ts->tv_nsec = hvc_res.a1; + *cycle = hvc_res.a2 << 32 | hvc_res.a3; + *cs = &clocksource_counter; + + return 0; +} +EXPORT_SYMBOL_GPL(kvm_arch_ptp_get_clock_fn); +#endif + diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig index d137c480db46..318b3f5df1ea 100644 --- a/drivers/ptp/Kconfig +++ b/drivers/ptp/Kconfig @@ -109,7 +109,7 @@ config PTP_1588_CLOCK_PCH config PTP_1588_CLOCK_KVM tristate "KVM virtual PTP clock" depends on PTP_1588_CLOCK - depends on KVM_GUEST && X86 + depends on KVM_GUEST && X86 || ARM64 default y help This driver adds support for using kvm infrastructure as a PTP diff --git a/drivers/ptp/Makefile b/drivers/ptp/Makefile index 19efa9cfa950..1bf4940a88a6 100644 --- a/drivers/ptp/Makefile +++ b/drivers/ptp/Makefile @@ -4,6 +4,7 @@ # ptp-y := ptp_clock.o ptp_chardev.o ptp_sysfs.o +ptp_kvm-y := ptp_kvm_common.o ptp_kvm_$(ARCH).o obj-$(CONFIG_PTP_1588_CLOCK) += ptp.o obj-$(CONFIG_PTP_1588_CLOCK_DTE) += ptp_dte.o obj-$(CONFIG_PTP_1588_CLOCK_IXP46X) += ptp_ixp46x.o diff --git a/drivers/ptp/ptp_kvm_arm64.c b/drivers/ptp/ptp_kvm_arm64.c new file mode 100644 index 000000000000..07ee2fc2c7b1 --- /dev/null +++ b/drivers/ptp/ptp_kvm_arm64.c @@ -0,0 +1,52 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Virtual PTP 1588 clock for use with KVM guests + * Copyright (C) 2019 ARM Ltd. + * All Rights Reserved + */ + +#include <linux/kernel.h> +#include <linux/err.h> +#include <asm/hypervisor.h> +#include <linux/module.h> +#include <linux/psci.h> +#include <linux/arm-smccc.h> +#include <linux/timecounter.h> +#include <linux/sched/clock.h> +#include <asm/arch_timer.h> + + +int kvm_arch_ptp_init(void) +{ + struct arm_smccc_res hvc_res; + + arm_smccc_1_1_invoke(ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID, + &hvc_res); + if ((long)(hvc_res.a0) < 0) + return -EOPNOTSUPP; + + return 0; +} + +int kvm_arch_ptp_get_clock_generic(struct timespec64 *ts, + struct arm_smccc_res *hvc_res) +{ + arm_smccc_1_1_invoke(ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID, + hvc_res); + if ((long)(hvc_res->a0) < 0) + return -EOPNOTSUPP; + + ts->tv_sec = hvc_res->a0; + ts->tv_nsec = hvc_res->a1; + + return 0; +} + +int kvm_arch_ptp_get_clock(struct timespec64 *ts) +{ + struct arm_smccc_res hvc_res; + + kvm_arch_ptp_get_clock_generic(ts, &hvc_res); + + return 0; +} diff --git a/drivers/ptp/ptp_kvm.c b/drivers/ptp/ptp_kvm_common.c similarity index 55% rename from drivers/ptp/ptp_kvm.c rename to drivers/ptp/ptp_kvm_common.c index c67dd11e08b1..69a7cd05d188 100644 --- a/drivers/ptp/ptp_kvm.c +++ b/drivers/ptp/ptp_kvm_common.c @@ -1,29 +1,19 @@ +// SPDX-License-Identifier: GPL-2.0-or-later /* * Virtual PTP 1588 clock for use with KVM guests * * Copyright (C) 2017 Red Hat Inc. * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * */ #include <linux/device.h> #include <linux/err.h> #include <linux/init.h> #include <linux/kernel.h> +#include <linux/slab.h> #include <linux/module.h> #include <uapi/linux/kvm_para.h> #include <asm/kvm_para.h> -#include <asm/pvclock.h> -#include <asm/kvmclock.h> -#include <uapi/asm/kvm_para.h> +#include <asm-generic/ptp_kvm.h> #include <linux/ptp_clock_kernel.h> @@ -34,56 +24,31 @@ struct kvm_ptp_clock { DEFINE_SPINLOCK(kvm_ptp_lock); -static struct pvclock_vsyscall_time_info *hv_clock; - -static struct kvm_clock_pairing clock_pair; -static phys_addr_t clock_pair_gpa; static int ptp_kvm_get_time_fn(ktime_t *device_time, struct system_counterval_t *system_counter, void *ctx) { - unsigned long ret; + unsigned long ret, cycle; struct timespec64 tspec; - unsigned version; - int cpu; - struct pvclock_vcpu_time_info *src; + struct clocksource *cs; spin_lock(&kvm_ptp_lock); preempt_disable_notrace(); - cpu = smp_processor_id(); - src = &hv_clock[cpu].pvti; - - do { - /* - * We are using a TSC value read in the hosts - * kvm_hc_clock_pairing handling. - * So any changes to tsc_to_system_mul - * and tsc_shift or any other pvclock - * data invalidate that measurement. - */ - version = pvclock_read_begin(src); - - ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, - clock_pair_gpa, - KVM_CLOCK_PAIRING_WALLCLOCK); - if (ret != 0) { - pr_err_ratelimited("clock pairing hypercall ret %lu\n", ret); - spin_unlock(&kvm_ptp_lock); - preempt_enable_notrace(); - return -EOPNOTSUPP; - } - - tspec.tv_sec = clock_pair.sec; - tspec.tv_nsec = clock_pair.nsec; - ret = __pvclock_read_cycles(src, clock_pair.tsc); - } while (pvclock_read_retry(src, version)); + + ret = kvm_arch_ptp_get_clock_fn(&cycle, &tspec, &cs); + if (ret != 0) { + pr_err_ratelimited("clock pairing hypercall ret %lu\n", ret); + spin_unlock(&kvm_ptp_lock); + preempt_enable_notrace(); + return -EOPNOTSUPP; + } preempt_enable_notrace(); - system_counter->cycles = ret; - system_counter->cs = &kvm_clock; + system_counter->cycles = cycle; + system_counter->cs = cs; *device_time = timespec64_to_ktime(tspec); @@ -126,17 +91,13 @@ static int ptp_kvm_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) spin_lock(&kvm_ptp_lock); - ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, - clock_pair_gpa, - KVM_CLOCK_PAIRING_WALLCLOCK); + ret = kvm_arch_ptp_get_clock(&tspec); if (ret != 0) { pr_err_ratelimited("clock offset hypercall ret %lu\n", ret); spin_unlock(&kvm_ptp_lock); return -EOPNOTSUPP; } - tspec.tv_sec = clock_pair.sec; - tspec.tv_nsec = clock_pair.nsec; spin_unlock(&kvm_ptp_lock); memcpy(ts, &tspec, sizeof(struct timespec64)); @@ -176,22 +137,12 @@ static void __exit ptp_kvm_exit(void) static int __init ptp_kvm_init(void) { - long ret; - - if (!kvm_para_available()) - return -ENODEV; - clock_pair_gpa = slow_virt_to_phys(&clock_pair); - hv_clock = pvclock_get_pvti_cpu0_va(); - - if (!hv_clock) - return -ENODEV; - - ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa, - KVM_CLOCK_PAIRING_WALLCLOCK); - if (ret == -KVM_ENOSYS || ret == -KVM_EOPNOTSUPP) - return -ENODEV; + int ret; + ret = kvm_arch_ptp_init(); + if (ret) + return -EOPNOTSUPP; kvm_ptp_clock.caps = ptp_kvm_caps; kvm_ptp_clock.ptp_clock = ptp_clock_register(&kvm_ptp_clock.caps, NULL); diff --git a/drivers/ptp/ptp_kvm_x86.c b/drivers/ptp/ptp_kvm_x86.c new file mode 100644 index 000000000000..a52cf1c2990c --- /dev/null +++ b/drivers/ptp/ptp_kvm_x86.c @@ -0,0 +1,87 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Virtual PTP 1588 clock for use with KVM guests + * + * Copyright (C) 2017 Red Hat Inc. + */ + +#include <asm/pvclock.h> +#include <asm/kvmclock.h> +#include <linux/module.h> +#include <uapi/asm/kvm_para.h> +#include <uapi/linux/kvm_para.h> +#include <linux/ptp_clock_kernel.h> + +phys_addr_t clock_pair_gpa; +struct kvm_clock_pairing clock_pair; +struct pvclock_vsyscall_time_info *hv_clock; + +int kvm_arch_ptp_init(void) +{ + int ret; + + if (!kvm_para_available()) + return -ENODEV; + + clock_pair_gpa = slow_virt_to_phys(&clock_pair); + hv_clock = pvclock_get_pvti_cpu0_va(); + if (!hv_clock) + return -ENODEV; + + ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa, + KVM_CLOCK_PAIRING_WALLCLOCK); + if (ret == -KVM_ENOSYS || ret == -KVM_EOPNOTSUPP) + return -ENODEV; + + return 0; +} + +int kvm_arch_ptp_get_clock(struct timespec64 *ts) +{ + long ret; + + ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, + clock_pair_gpa, + KVM_CLOCK_PAIRING_WALLCLOCK); + if (ret != 0) + return -EOPNOTSUPP; + + ts->tv_sec = clock_pair.sec; + ts->tv_nsec = clock_pair.nsec; + + return 0; +} + +int kvm_arch_ptp_get_clock_fn(unsigned long *cycle, struct timespec64 *tspec, + struct clocksource **cs) +{ + unsigned long ret; + unsigned int version; + int cpu; + struct pvclock_vcpu_time_info *src; + + cpu = smp_processor_id(); + src = &hv_clock[cpu].pvti; + + do { + /* + * We are using a TSC value read in the hosts + * kvm_hc_clock_pairing handling. + * So any changes to tsc_to_system_mul + * and tsc_shift or any other pvclock + * data invalidate that measurement. + */ + version = pvclock_read_begin(src); + + ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, + clock_pair_gpa, + KVM_CLOCK_PAIRING_WALLCLOCK); + tspec->tv_sec = clock_pair.sec; + tspec->tv_nsec = clock_pair.nsec; + *cycle = __pvclock_read_cycles(src, clock_pair.tsc); + } while (pvclock_read_retry(src, version)); + + *cs = &kvm_clock; + + return 0; +} diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index ffa6d3530f4b..4055929a043c 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -2085,7 +2085,6 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, { struct buffer_head *head; struct buffer_head *bh; - bool has_write_io_error = false; int ret = 0; J_ASSERT(PageLocked(page)); @@ -2110,26 +2109,10 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, jbd_unlock_bh_state(bh); if (buffer_jbd(bh)) goto busy; - - /* - * If we free a metadata buffer which has been failed to - * write out, the jbd2 checkpoint procedure will not detect - * this failure and may lead to filesystem inconsistency - * after cleanup journal tail. - */ - if (buffer_write_io_error(bh)) { - pr_err("JBD2: Error while async write back metadata bh %llu.", - (unsigned long long)bh->b_blocknr); - has_write_io_error = true; - } } while ((bh = bh->b_this_page) != head); ret = try_to_free_buffers(page); - busy: - if (has_write_io_error) - jbd2_journal_abort(journal, -EIO); - return ret; } diff --git a/include/asm-generic/ptp_kvm.h b/include/asm-generic/ptp_kvm.h new file mode 100644 index 000000000000..d87a08495710 --- /dev/null +++ b/include/asm-generic/ptp_kvm.h @@ -0,0 +1,12 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * linux/drivers/clocksource/arm_arch_timer.c + * + * Copyright (C) 2019 ARM Ltd. + * All Rights Reserved + */ + +int kvm_arch_ptp_init(void); +int kvm_arch_ptp_get_clock(struct timespec64 *ts); +int kvm_arch_ptp_get_clock_fn(unsigned long *cycle, + struct timespec64 *tspec, void *cs); diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h index 5b5f52ca6ac8..5a46bb6df894 100644 --- a/include/linux/arm-smccc.h +++ b/include/linux/arm-smccc.h @@ -76,6 +76,11 @@ ARM_SMCCC_SMC_32, \ 0, 1) +#define ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID \ + ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ + ARM_SMCCC_SMC_32, \ + 0, 2) + #define ARM_SMCCC_ARCH_WORKAROUND_1 \ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ ARM_SMCCC_SMC_32, \ diff --git a/virt/kvm/arm/hypercalls.c b/virt/kvm/arm/hypercalls.c index 7a6c5f18dff2..495b25b9ed13 100644 --- a/virt/kvm/arm/hypercalls.c +++ b/virt/kvm/arm/hypercalls.c @@ -15,6 +15,9 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) u32 val = SMCCC_RET_NOT_SUPPORTED; u32 feature; gpa_t gpa; + struct timespec64 ts; + u64 cycles, cycle_high, cycle_low; + struct system_time_snapshot systime_snapshot; switch (func_id) { case ARM_SMCCC_VERSION_FUNC_ID: @@ -63,6 +66,17 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) case ARM_SMCCC_HV_PV_SCHED_KICK_CPU: val = kvm_pvsched_kick_vcpu(vcpu); break; + + case ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID: + ktime_get_real_ts64(&ts); + ktime_get_snapshot(&systime_snapshot); + cycles = systime_snapshot.cycles - vcpu_vtimer(vcpu)->cntvoff; + cycle_high = cycles >> 32; + cycle_low = cycles << 32 >> 32; + + smccc_set_retval(vcpu, ts.tv_sec, ts.tv_nsec, cycle_high, cycle_low); + return 1; + default: return kvm_psci_call(vcpu); } -- 2.23.0

2 4

[PATCH v2 OLK-5.10 0/2] spraid: support Ramaxel raid controller
by Yanling Song 14 Sep '21

14 Sep '21

Support Ramaxel raid controller Changes since v1: - Add "OLK-5.10" to subject - Add commit header into commit message - Add CONFIG_RAMAXEL_SPRAID in defconfig Yanling Song (2): spraid: support Ramaxel raid controller Add CONFIG_RAMAXEL_SPRAID in defconfig of arch arm64 and x86 to support Ramaxel spraid controller arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/scsi/Kconfig | 1 + drivers/scsi/Makefile | 1 + drivers/scsi/spraid/Kconfig | 11 + drivers/scsi/spraid/Makefile | 7 + drivers/scsi/spraid/spraid.h | 572 +++++ drivers/scsi/spraid/spraid_main.c | 3159 ++++++++++++++++++++++++ 8 files changed, 3753 insertions(+) create mode 100644 drivers/scsi/spraid/Kconfig create mode 100644 drivers/scsi/spraid/Makefile create mode 100644 drivers/scsi/spraid/spraid.h create mode 100644 drivers/scsi/spraid/spraid_main.c -- 2.17.1

1 2

[PATCH kernel-4.19] memcg: enable accounting of ipc resources
by Yang Yingliang 14 Sep '21

14 Sep '21

From: Vasily Averin <vvs(a)virtuozzo.com> mainline inclusion from mainline-v5.15-rc1 commit 18319498fdd4cdf8c1c2c48cd432863b1f915d6f category: bugfix bugzilla: NA CVE: CVE-2021-3759 --------------------------- When user creates IPC objects it forces kernel to allocate memory for these long-living objects. It makes sense to account them to restrict the host's memory consumption from inside the memcg-limited container. This patch enables accounting for IPC shared memory segments, messages semaphores and semaphore's undo lists. Link: https://lkml.kernel.org/r/d6507b06-4df6-78f8-6c54-3ae86e3b5339@virtuozzo.com Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Reviewed-by: Shakeel Butt <shakeelb(a)google.com> Cc: Alexander Viro <viro(a)zeniv.linux.org.uk> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: Andrei Vagin <avagin(a)gmail.com> Cc: Borislav Petkov <bp(a)alien8.de> Cc: Borislav Petkov <bp(a)suse.de> Cc: Christian Brauner <christian.brauner(a)ubuntu.com> Cc: Dmitry Safonov <0x7f454c46(a)gmail.com> Cc: "Eric W. Biederman" <ebiederm(a)xmission.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: "J. Bruce Fields" <bfields(a)fieldses.org> Cc: Jeff Layton <jlayton(a)kernel.org> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Jiri Slaby <jirislaby(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kirill Tkhai <ktkhai(a)virtuozzo.com> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Roman Gushchin <guro(a)fb.com> Cc: Serge Hallyn <serge(a)hallyn.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Yutian Yang <nglaive(a)gmail.com> Cc: Zefan Li <lizefan.x(a)bytedance.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: ipc/msg.c ipc/sem.c ipc/shm.c Signed-off-by: Li Ming <limingming.li(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- ipc/msg.c | 2 +- ipc/sem.c | 9 +++++---- ipc/shm.c | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/ipc/msg.c b/ipc/msg.c index ac4de3f672615..9a1ff5669cfbd 100644 --- a/ipc/msg.c +++ b/ipc/msg.c @@ -137,7 +137,7 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params) key_t key = params->key; int msgflg = params->flg; - msq = kvmalloc(sizeof(*msq), GFP_KERNEL); + msq = kvmalloc(sizeof(*msq), GFP_KERNEL_ACCOUNT); if (unlikely(!msq)) return -ENOMEM; diff --git a/ipc/sem.c b/ipc/sem.c index 2bf535dd0b934..171881795a302 100644 --- a/ipc/sem.c +++ b/ipc/sem.c @@ -494,7 +494,7 @@ static struct sem_array *sem_alloc(size_t nsems) return NULL; size = sizeof(*sma) + nsems * sizeof(sma->sems[0]); - sma = kvmalloc(size, GFP_KERNEL); + sma = kvmalloc(size, GFP_KERNEL_ACCOUNT); if (unlikely(!sma)) return NULL; @@ -1813,7 +1813,7 @@ static inline int get_undo_list(struct sem_undo_list **undo_listp) undo_list = current->sysvsem.undo_list; if (!undo_list) { - undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL); + undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL_ACCOUNT); if (undo_list == NULL) return -ENOMEM; spin_lock_init(&undo_list->lock); @@ -1897,7 +1897,7 @@ static struct sem_undo *find_alloc_undo(struct ipc_namespace *ns, int semid) rcu_read_unlock(); /* step 2: allocate new undo structure */ - new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL); + new = kzalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL_ACCOUNT); if (!new) { ipc_rcu_putref(&sma->sem_perm, sem_rcu_free); return ERR_PTR(-ENOMEM); @@ -1961,7 +1961,8 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops, if (nsops > ns->sc_semopm) return -E2BIG; if (nsops > SEMOPM_FAST) { - sops = kvmalloc_array(nsops, sizeof(*sops), GFP_KERNEL); + sops = kvmalloc_array(nsops, sizeof(*sops), + GFP_KERNEL_ACCOUNT); if (sops == NULL) return -ENOMEM; } diff --git a/ipc/shm.c b/ipc/shm.c index 1c65fb357395e..904fe53256af0 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -619,7 +619,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) ns->shm_tot + numpages > ns->shm_ctlall) return -ENOSPC; - shp = kvmalloc(sizeof(*shp), GFP_KERNEL); + shp = kvmalloc(sizeof(*shp), GFP_KERNEL_ACCOUNT); if (unlikely(!shp)) return -ENOMEM; -- 2.25.1

1 0

[PATCH kernel-4.19] uce: pagecache reading scenario add shmem support
by Yang Yingliang 14 Sep '21

14 Sep '21

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I44R9D CVE: NA --------------------------- The call trace is as follows: __arch_copy_to_user+0x1bc/0x21c copy_page_to_iter+0xdc/0x328 shmem_file_read_iter+0x124/0x350 __vfs_read+0x11c/0x188 vfs_read+0x94/0x150 ksys_read+0x6c/0xd8 __arm64_sys_read+0x24/0x30 el0_svc_common+0x78/0x130 el0_svc_handler+0x38/0x78 el0_svc+0x8/0xc This patch add uce kernel recovery path support in shmem_file_read_iter(). Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/shmem.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/shmem.c b/mm/shmem.c index 4522348cfc189..df7bac986e5e2 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -2674,7 +2674,12 @@ static ssize_t shmem_file_read_iter(struct kiocb *iocb, struct iov_iter *to) * Ok, we have the page, and it's up-to-date, so * now we can copy it to user space... */ - ret = copy_page_to_iter(page, offset, nr, to); +#ifdef CONFIG_UCE_KERNEL_RECOVERY + if (is_pagecache_reading_kernel_recovery_enable()) + ret = copy_page_to_iter_generic_read(page, offset, nr, to); + else + ret = copy_page_to_iter(page, offset, nr, to); +#endif retval += ret; offset += ret; index += offset >> PAGE_SHIFT; -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] crypto/sec: add aead support for user-side
by Yang Yingliang 14 Sep '21

14 Sep '21

From: Yu'an Wang <wangyuan46(a)huawei.com> driver inclusion category: Feature bugzilla: NA CVE: NA In this patch, add aead alg support for user-side alg enable. Signed-off-by: Yu'an Wang <wangyuan46(a)huawei.com> Reviewed-by: Guangwei Zhou <zhouguangwei5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/crypto/hisilicon/sec2/sec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c index e3b21ef4d0c82..deda0f679ff65 100644 --- a/drivers/crypto/hisilicon/sec2/sec_main.c +++ b/drivers/crypto/hisilicon/sec2/sec_main.c @@ -816,7 +816,7 @@ static int sec_qm_pre_init(struct hisi_qm *qm, struct pci_dev *pdev) int ret; #ifdef CONFIG_CRYPTO_QM_UACCE - qm->algs = "sec\ncipher\ndigest\n"; + qm->algs = "sec\ncipher\ndigest\naead\n"; qm->uacce_mode = uacce_mode; #endif qm->pdev = pdev; -- 2.25.1

1 1

[PATCH kernel-4.19] Intel: PCI: Add support for Immediate Readiness
by Yang Yingliang 11 Sep '21

11 Sep '21

From: Felipe Balbi <felipe.balbi(a)linux.intel.com> mainline inclusion from mainline-v4.20-rc1 commit d6112f8def514e019658bcc9b57d53acdb71ca3f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I47H3V CVE: NA -------------------------------- commit d6112f8def514e019658bcc9b57d53acdb71ca3f upstream. PCIe r4.0, sec 7.5.1.1.4 defines a new bit in the Status Register: Immediate Readiness – This optional bit, when Set, indicates the Function is guaranteed to be ready to successfully complete valid configuration accesses at any time following any reset that the host is capable of issuing Configuration Requests to this Function. When this bit is Set, for accesses to this Function, software is exempt from all requirements to delay configuration accesses following any type of reset, including but not limited to the timing requirements defined in Section 6.6. This means that all delays after a Conventional or Function Reset can be skipped. This patch reads such bit and caches its value in a flag inside struct pci_dev to be checked later if we should delay or can skip delays after a reset. While at that, also move the explicit msleep(100) call from pcie_flr() and pci_af_flr() to pci_dev_wait(). Signed-off-by: Felipe Balbi <felipe.balbi(a)linux.intel.com> [bhelgaas: rename PCI_STATUS_IMMEDIATE to PCI_STATUS_IMM_READY] Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Signed-off-by: Lin Wang <lin.x.wang(a)intel.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pci/pci.c | 13 ++++++++++++- include/linux/pci.h | 1 + include/uapi/linux/pci_regs.h | 1 + 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 9b88665347c2b..52618fb1bf64c 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -1009,7 +1009,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state) * because have already delayed for the bridge. */ if (dev->runtime_d3cold) { - if (dev->d3cold_delay) + if (dev->d3cold_delay && !dev->imm_ready) msleep(dev->d3cold_delay); /* * When powering on a bridge from D3cold, the @@ -2756,6 +2756,7 @@ EXPORT_SYMBOL_GPL(pci_d3cold_disable); void pci_pm_init(struct pci_dev *dev) { int pm; + u16 status; u16 pmc; pm_runtime_forbid(&dev->dev); @@ -2818,6 +2819,10 @@ void pci_pm_init(struct pci_dev *dev) /* Disable the PME# generation functionality */ pci_pme_active(dev, false); } + + pci_read_config_word(dev, PCI_STATUS, &status); + if (status & PCI_STATUS_IMM_READY) + dev->imm_ready = 1; } static unsigned long pci_ea_flags(struct pci_dev *dev, u8 prop) @@ -4504,6 +4509,9 @@ int pcie_flr(struct pci_dev *dev) pcie_capability_set_word(dev, PCI_EXP_DEVCTL, PCI_EXP_DEVCTL_BCR_FLR); + if (dev->imm_ready) + return 0; + /* * Per PCIe r4.0, sec 6.6.2, a device must complete an FLR within * 100ms, but may silently discard requests while the FLR is in @@ -4545,6 +4553,9 @@ static int pci_af_flr(struct pci_dev *dev, int probe) pci_write_config_byte(dev, pos + PCI_AF_CTRL, PCI_AF_CTRL_FLR); + if (dev->imm_ready) + return 0; + /* * Per Advanced Capabilities for Conventional PCI ECN, 13 April 2006, * updated 27 July 2006; a device must complete an FLR within diff --git a/include/linux/pci.h b/include/linux/pci.h index 6e4780bd1c84d..228dfd59086d4 100644 --- a/include/linux/pci.h +++ b/include/linux/pci.h @@ -327,6 +327,7 @@ struct pci_dev { pci_power_t current_state; /* Current operating state. In ACPI, this is D0-D3, D0 being fully functional, and D3 being off. */ + unsigned int imm_ready:1; /* Supports Immediate Readiness */ u8 pm_cap; /* PM capability offset */ unsigned int pme_support:5; /* Bitmask of states from which PME# can be generated */ diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h index b51b5ea5c456d..c209c4d1730ad 100644 --- a/include/uapi/linux/pci_regs.h +++ b/include/uapi/linux/pci_regs.h @@ -52,6 +52,7 @@ #define PCI_COMMAND_INTX_DISABLE 0x400 /* INTx Emulation Disable */ #define PCI_STATUS 0x06 /* 16 bits */ +#define PCI_STATUS_IMM_READY 0x01 /* Immediate Readiness */ #define PCI_STATUS_INTERRUPT 0x08 /* Interrupt status */ #define PCI_STATUS_CAP_LIST 0x10 /* Support Capability List */ #define PCI_STATUS_66MHZ 0x20 /* Support 66 MHz PCI 2.1 bus */ -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] nvme-pci: use unsigned for io queue depth
by Yang Yingliang 11 Sep '21

11 Sep '21

From: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> mainline inclusion from mainline-5.9-rc1 commit 61f3b89630973037f67d8e25e5d26e80a51a7b37 category: bugfix bugzilla: 175286 CVE: NA --------------------------- The NVMe PCIe declares module parameter io_queue_depth as int. Change this to u16 as queue depth can never be negative. Now to reflect this update module parameter getter function from param_get_int() -> param_get_uint() and respective setter function with type of n changed from int to u16 with param_set_int() to param_set_ushort(). Finally update struct nvme_dev q_depth member to u16 and use u16 in min_t() when calculating dev->q_depth in the nvme_pci_enable() (since q_depth is now u16) and use unsigned int instead of int when calculating dev->tagset.queue_depth as target variable tagset->queue_depth is of type unsigned int in nvme_dev_add(). Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni(a)wdc.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflicts: drivers/nvme/host/pci.c [ Feature patch 3b6592f70ad7("nvme: utilize two queue maps, one for reads and one for writes") is not applied. ed92ad37e88("nvme-pci: only set nr_maps to 2 if poll queues are supported") is not applied. aa22c8e665("nvme-pci: set ctrl sqsize to the device q_depth") is not applied. ] Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/pci.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 0a5e20808ba2e..e741b1d167c3e 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -66,10 +66,10 @@ MODULE_PARM_DESC(sgl_threshold, static int io_queue_depth_set(const char *val, const struct kernel_param *kp); static const struct kernel_param_ops io_queue_depth_ops = { .set = io_queue_depth_set, - .get = param_get_int, + .get = param_get_uint, }; -static int io_queue_depth = 1024; +static unsigned int io_queue_depth = 1024; module_param_cb(io_queue_depth, &io_queue_depth_ops, &io_queue_depth, 0644); MODULE_PARM_DESC(io_queue_depth, "set io queue depth, should >= 2"); @@ -93,7 +93,7 @@ struct nvme_dev { unsigned online_queues; unsigned max_qid; unsigned int num_vecs; - int q_depth; + u16 q_depth; u32 db_stride; void __iomem *bar; unsigned long bar_mapped_size; @@ -126,13 +126,14 @@ struct nvme_dev { static int io_queue_depth_set(const char *val, const struct kernel_param *kp) { - int n = 0, ret; + int ret; + u16 n; - ret = kstrtoint(val, 10, &n); + ret = kstrtou16(val, 10, &n); if (ret != 0 || n < 2) return -EINVAL; - return param_set_int(val, kp); + return param_set_ushort(val, kp); } static inline unsigned int sq_idx(unsigned int qid, u32 stride) @@ -2062,8 +2063,8 @@ static int nvme_dev_add(struct nvme_dev *dev) dev->tagset.nr_hw_queues = dev->online_queues - 1; dev->tagset.timeout = NVME_IO_TIMEOUT; dev->tagset.numa_node = dev_to_node(dev->dev); - dev->tagset.queue_depth = - min_t(int, dev->q_depth, BLK_MQ_MAX_DEPTH) - 1; + dev->tagset.queue_depth = min_t(unsigned int, dev->q_depth, + BLK_MQ_MAX_DEPTH) - 1; dev->tagset.cmd_size = nvme_pci_cmd_size(dev, false); if ((dev->ctrl.sgls & ((1 << 0) | (1 << 1))) && sgl_threshold) { dev->tagset.cmd_size = max(dev->tagset.cmd_size, @@ -2121,7 +2122,7 @@ static int nvme_pci_enable(struct nvme_dev *dev) dev->ctrl.cap = lo_hi_readq(dev->bar + NVME_REG_CAP); - dev->q_depth = min_t(int, NVME_CAP_MQES(dev->ctrl.cap) + 1, + dev->q_depth = min_t(u16, NVME_CAP_MQES(dev->ctrl.cap) + 1, io_queue_depth); dev->db_stride = 1 << NVME_CAP_STRIDE(dev->ctrl.cap); dev->dbs = dev->bar + 4096; -- 2.25.1

1 1

[PATCH hulk-4.19-next 00/75] misc updates for hns3 driver 2021.09.10
by Yonglong Liu 11 Sep '21

11 Sep '21

This patch set contains some backport patch from mainline, and some bugfix for hns3 driver. Chen Zhou (1): net: hns3: replace snprintf with scnprintf in hns3_update_strings Guangbin Huang (13): net: hns3: dump tqp enable status in debugfs net: hns3: remediate a potential overflow risk of bd_num_list net: hns3: VF not request link status when PF support push link status feature net: hns3: add interfaces to query information of tm priority/qset net: hns3: add debugfs support for tm priority and qset info net: hns3: refactor dump tm map of debugfs net: hns3: refactor dump tm of debugfs net: hns3: refactor dump tc of debugfs net: hns3: refactor dump qos pause cfg of debugfs net: hns3: refactor dump qos pri map of debugfs net: hns3: refactor dump qos buf cfg of debugfs net: hns3: refactor dump qs shaper of debugfs net: hns3: fix get wrong pfc_en when query PFC configuration Hao Chen (4): net: hns3: fix for vxlan gpe tx checksum bug net: hns3: refactor queue map of debugfs net: hns3: refactor queue info of debugfs net: hns3: refactor dump fd tcam of debugfs Huazhong Tan (8): net: hns3: add a print for initializing CMDQ when reset pending net: hns3: add a missing mutex destroy in hclge_init_ad_dev() net: hns3: print out speed info when parsing speed fails net: hns3: remove a misused pragma packed net: hns3: remove a duplicate pf reset counting net: hns3: change the value of the SEPARATOR_VALUE macro in hclgevf_main.c net: hns3: refactor dump bd info of debugfs net: hns3: refactor dump mac list of debugfs Jian Shen (17): net: hns3: refine function hclge_set_vf_vlan_cfg() net: hns3: fix incorrect handling of sctp6 rss tuple net: hns3: cleanup for endian issue for VF RSS net: hns3: fix error mask definition of flow director net: hns3: fix query vlan mask value error for flow director net: hns3: refine the struct hane3_tc_info net: hns3: split out hclge_dbg_dump_qos_buf_cfg() net: hns3: add support for dumping MAC umv counter in debugfs net: hns3: add support for modify VLAN filter state net: hns3: add query basic info support for VF net: hns3: add support for VF modify VLAN filter state net: hns3: add debugfs support for vlan configuration net: hns3: add support for tc mqprio offload net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE net: hns3: disable port VLAN filter when support function level VLAN filter control net: hns3: add 'QoS' support for port based VLAN configuration net: hns3: remove tc enable checking Jiaran Zhang (5): net: hns3: refactor dump intr of debugfs net: hns3: refactor dump reset info of debugfs net: hns3: refactor dump m7 info of debugfs net: hns3: refactor dump ncl config of debugfs net: hns3: refactor dump mac tnl status of debugfs Peng Li (2): net: hns3: remove redundant param mbx_event_pending net: hns3: remove unused parameter from hclge_set_vf_vlan_common() Rikard Falkeborn (2): net: hns3: Constify static structs net: hns3: Constify static structs Wang Hai (1): net: hns3: Supply missing hclge_dcb.h include file Yi Li (1): net: hns3: Fix for geneve tx checksum bug Yonglong Liu (7): net: hns3: refactor dump mac tbl of debugfs net: hns3: pad the short tunnel frame before sending to hardware net: hns3: fix memory override when bd_num is bigger than the ring size net: hns3: fix kernel crash when unload VF while it is being reset net: hns3: cleanup for some print type miss match and blank lines net: hns3: the pointer is cast to another pointer in a different type, which is incompatible. net: hns3: update hns3 version to 21.9.2 Yufeng Mo (11): net: hns3: change hclge/hclgevf workqueue to WQ_UNBOUND mode net: hns3: change affinity_mask to numa node range net: hns3: add debugfs of dumping pf interrupt resources net: hns3: refactor the debugfs process net: hns3: refactor dump mng tbl of debugfs net: hns3: refactor dump loopback of debugfs net: hns3: refactor dump reg of debugfs net: hns3: refactor dump reg dcb info of debugfs net: hns3: refactor dump serv info of debugfs net: hns3: change the method of getting cmd index in debugfs net: hns3: remove the useless debugfs file node cmd Yunsheng Lin (1): net: hns3: check the return of skb_checksum_help() Zheng Yongjun (1): hisilicon/hns3: convert comma to semicolon shenhao (1): Revert: net: hns3: adds support for extended VLAN mode and 'QOS' in vlan 802.1Q protocol. .../net/ethernet/hisilicon/hns3/hclge_mbx.h | 10 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 86 +- .../hisilicon/hns3/hns3_cae/hns3_cae_port.c | 6 + .../hns3/hns3_cae/hns3_cae_version.h | 2 +- .../ethernet/hisilicon/hns3/hns3_debugfs.c | 1126 +++++-- .../ethernet/hisilicon/hns3/hns3_debugfs.h | 62 + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 134 +- .../net/ethernet/hisilicon/hns3/hns3_enet.h | 6 +- .../ethernet/hisilicon/hns3/hns3_ethtool.c | 16 +- .../hisilicon/hns3/hns3pf/hclge_cmd.c | 5 +- .../hisilicon/hns3/hns3pf/hclge_cmd.h | 28 +- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 136 +- .../hisilicon/hns3/hns3pf/hclge_debugfs.c | 2763 ++++++++++------- .../hisilicon/hns3/hns3pf/hclge_debugfs.h | 71 +- .../hisilicon/hns3/hns3pf/hclge_main.c | 598 ++-- .../hisilicon/hns3/hns3pf/hclge_main.h | 52 +- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 54 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 469 ++- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.h | 52 +- .../hisilicon/hns3/hns3vf/hclgevf_cmd.h | 6 +- .../hisilicon/hns3/hns3vf/hclgevf_main.c | 109 +- .../hisilicon/hns3/hns3vf/hclgevf_main.h | 10 +- .../hisilicon/hns3/hns3vf/hclgevf_mbx.c | 17 +- 23 files changed, 3853 insertions(+), 1965 deletions(-) create mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.h -- 2.33.0

3 78