- 12 3月, 2021 6 次提交
-
-
由 Sang Yan 提交于
hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ One cpu in PARK state could not come up in this case: CPU 0 | CPU 1 boot_secondary(cpu 1) | --> write_park_exit(cpu 1) | | cpu uping from PARK | ... uninstall_cpu_park() | --> memset to 0 park text | | ... | Exception in memory !! wait for cpu up | Cpu 1 uping from PARK may trap into exception while cpu 0 clear cpu 1's park text memory. This uninstall_cpu_park should be after waiting for cpu up. Signed-off-by: NSang Yan <sangyan@huawei.com> Reviewed-by: NXiongfeng Wang <wangxiongfeng2@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Xiongfeng Wang 提交于
hulk inclusion category: bugfix bugzilla: 50623 CVE: N/A ------------------------------ When we print system information by echo 't' into 'sysrq-trigger' on several cores at the same time, we got the following calltrace. [ 1352.854632] NMI watchdog: Watchdog detected hard LOCKUP on cpu 6 [ 1352.854633] Modules linked in: nf_log_arp nf_log_ipv6 nf_log_ipv4 nf_log_common binfmt_misc salsa20_generic camellia_generic cast6_generic cast_common rfkill serpent_generic twofish_generic twofish_common xts lrw tgr192 wp512 rmd320 rmd256 rmd160 rmd128 md4 sha512_generic loop jprob(OE) ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter vfat fat hns_roce_hw_v2 hns_roce ib_core aes_ce_blk crypto_simd cryptd aes_ce_cipher ghash_ce sha2_ce ipmi_ssif ofpart sha256_arm64 sha1_ce cmdlinepart [ 1352.854649] hi_sfc ses enclosure mtd sg sbsa_gwdt ipmi_si ipmi_devintf ipmi_msghandler spi_dw_mmio sch_fq_codel ip_tables ext4 mbcache jbd2 sr_mod cdrom sd_mod realtek hclge hisi_sas_v3_hw hisi_sas_main ahci libsas libahci hns3 hinic libata usb_storage hnae3 megaraid_sas scsi_transport_sas i2c_designware_platform i2c_designware_core dm_multipath dm_mirror dm_region_hash dm_log dm_mod [last unloaded: ip_vs] [ 1352.854658] CPU: 6 PID: 220569 Comm: sh Kdump: loaded Tainted: G OEL 4.19.90-vhulk2001.1.0.0026.aarch64 #1 [ 1352.854659] Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 1.06 10/29/2019 [ 1352.854659] pstate: 80400089 (Nzcv daIf +PAN -UAO) [ 1352.854660] pc : queued_spin_lock_slowpath+0x1d8/0x2e0 [ 1352.854660] lr : print_cpu+0x414/0x690 [ 1352.854660] sp : ffff0001743afb80 [ 1352.854661] x29: ffff0001743afb80 x28: ffff805fcef6e880 [ 1352.854662] x27: 0000000000000000 x26: 0000000000000000 [ 1352.854662] x25: ffff000008cab000 x24: ffff000008cab000 [ 1352.854663] x23: 0000000000000000 x22: 0000000000000000 [ 1352.854664] x21: ffff000009478000 x20: 0000000000900001 [ 1352.854664] x19: ffff000009478d20 x18: ffffffffffffffff [ 1352.854665] x17: 0000000000000000 x16: 0000000000000000 [ 1352.854666] x15: ffff000009273708 x14: ffff00000947af60 [ 1352.854667] x13: ffff00000947abab x12: ffff00000929d000 [ 1352.854668] x11: 0000000000006fc8 x10: ffff00000947a1c0 [ 1352.854668] x9 : 0000000000000001 x8 : 0000000000000000 [ 1352.854669] x7 : ffff0000092737c8 x6 : ffff803fffc9e1c0 [ 1352.854670] x5 : 0000000000000000 x4 : ffff803fffc9e1c0 [ 1352.854671] x3 : ffff000008f5e000 x2 : 00000000001c0000 [ 1352.854671] x1 : 0000000000000000 x0 : ffff803fffc9e1c8 [ 1352.854672] Call trace: [ 1352.854673] queued_spin_lock_slowpath+0x1d8/0x2e0 [ 1352.854673] print_cpu+0x414/0x690 [ 1352.854673] sysrq_sched_debug_show+0x50/0x80 [ 1352.854674] show_state_filter+0xc0/0xd0 [ 1352.854674] sysrq_handle_showstate+0x18/0x28 [ 1352.854674] __handle_sysrq+0xa0/0x190 [ 1352.854675] write_sysrq_trigger+0x70/0x88 [ 1352.854675] proc_reg_write+0x80/0xd8 [ 1352.854675] __vfs_write+0x60/0x190 [ 1352.854676] vfs_write+0xac/0x1c0 [ 1352.854676] ksys_write+0x74/0xf0 [ 1352.854676] __arm64_sys_write+0x24/0x30 [ 1352.854677] el0_svc_common+0x78/0x130 [ 1352.854677] el0_svc_handler+0x38/0x78 [ 1352.854677] el0_svc+0x8/0xc [ 1352.854678] Kernel panic - not syncing: Hard LOCKUP [ 1352.854679] CPU: 6 PID: 220569 Comm: sh Kdump: loaded Tainted: G OEL 4.19.90-vhulk2001.1.0.0026.aarch64 #1 [ 1352.854679] Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 1.06 10/29/2019 [ 1352.854679] Call trace: [ 1352.854680] dump_backtrace+0x0/0x198 [ 1352.854680] show_stack+0x24/0x30 [ 1352.854681] dump_stack+0xa4/0xc4 [ 1352.854681] panic+0x130/0x304 [ 1352.854681] __stack_chk_fail+0x0/0x28 [ 1352.854682] watchdog_hardlockup_check+0x138/0x140 [ 1352.854682] sdei_watchdog_callback+0x20/0x30 [ 1352.854682] sdei_event_handler+0x50/0xf0 [ 1352.854683] __sdei_handler+0xd8/0x228 [ 1352.854683] __sdei_asm_handler+0xbc/0x134 [ 1352.854683] queued_spin_lock_slowpath+0x1d8/0x2e0 [ 1352.854684] print_cpu+0x414/0x690 [ 1352.854684] sysrq_sched_debug_show+0x50/0x80 [ 1352.854684] show_state_filter+0xc0/0xd0 [ 1352.854685] sysrq_handle_showstate+0x18/0x28 [ 1352.854685] __handle_sysrq+0xa0/0x190 [ 1352.854685] write_sysrq_trigger+0x70/0x88 [ 1352.854686] proc_reg_write+0x80/0xd8 [ 1352.854686] __vfs_write+0x60/0x190 [ 1352.854686] vfs_write+0xac/0x1c0 [ 1352.854687] ksys_write+0x74/0xf0 [ 1352.854687] __arm64_sys_write+0x24/0x30 [ 1352.854687] el0_svc_common+0x78/0x130 [ 1352.854688] el0_svc_handler+0x38/0x78 [ 1352.854688] el0_svc+0x8/0xc It is because there are many processes in the system. 'print_cpu()' aquires 'sched_debug_lock', print some information, and releases 'sched_debug_lock'. This procedure takes about 4 seconds in our testcase. When four cores concurrently print system info by sysrq, it will takes the last core 12 seconds to get the spinlock. This will cause a hardlockup. Signed-off-by: NKai Shen <shenkai8@huawei.com> Signed-off-by: NXiongfeng Wang <wangxiongfeng2@huawei.com> Reviewed-By: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NYang Yingliang <yangyingliang@huawei.com> Signed-off-by: NXiongfeng Wang <wangxiongfeng2@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Wang ShaoBo 提交于
hulk inclusion category: bugfix bugzilla: 48265 CVE: NA -------------------------------- Workaround cacheinfo's info_list uninitialized error in some special cases, such as free_cache_attributes() free info_list but not set num_leaves to zero when PPTT is not supported. this solution lasts until upstream issue resolved. Fixes: 950e5edb ("drivers: base: cacheinfo: Add helper to search cacheinfo by of_node") Fixes: 709c4362 ("cacheinfo: Move resctrl's get_cache_id() to the cacheinfo header file") Signed-off-by: NWang ShaoBo <bobo.shaobowang@huawei.com> Reviewed-by: NJian Cheng <cj.chengjian@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Sang Yan 提交于
hulk inclusion category: feature bugzilla: 48159 CVE: N/A ------------------------------ reserve_crashkernel or reserve_quick_kexec may find one sutiable memory region and reserves it, which address of the region is not fixed. As a result, cpu park reserves memory could be failed while specified address used by crashkernel or quickkexec. So, move reserve_park_mem before reserve_crashkernel and reserve_quick_kexec. Signed-off-by: Sang Yan <sangyan(a)huawei.com> Reviewed-by: Jing Xiangfeng <jingxiangfeng(a)huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> -
由 ZhuLing 提交于
hulk inclusion category: feature bugzilla: 48159 CVE: NA ------------------------------ Enable legacy pmem on openEuler defconfig both arm64 and x86 Signed-off-by: ZhuLing <zhuling8(a)huawei.com> Signed-off-by: Sang Yan <sangyan(a)huawei.com> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> -
由 ZhuLing 提交于
hulk inclusion category: feature bugzilla: 48159 CVE: NA ------------------------------ Register pmem in arm64: Use memmap(memmap=nn[KMG]!ss[KMG]) reserve memory and e820(driver/nvdimm/e820.c) function to register persistent memory in arm64. when the kernel restart or update, the data in PMEM will not be lost and can be loaded faster. this is a general features. driver/nvdimm/e820.c: The function of this file is scan "iomem_resource" and take advantage of nvdimm resource discovery mechanism by registering a resource named "Persistent Memory (legacy)", this function doesn't depend on architecture. We will push the feature to linux kernel community and discuss to modify the file name. because people have a mistaken notion that the e820.c is depend on x86. If you want use this features, you need do as follows: 1.Reserve memory: add memmap to reserve memory in grub.cfg memmap=nn[KMG]!ss[KMG] exp:memmap=100K!0x1a0000000. 2.Insmod nd_e820.ko: modprobe nd_e820. 3.Check pmem device in /dev exp: /dev/pmem0 Signed-off-by: ZhuLing <zhuling8(a)huawei.com> Signed-off-by: Sang Yan <sangyan(a)huawei.com> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
- 11 3月, 2021 2 次提交
-
-
由 liubo 提交于
euleros inclusion category: feature feature: etmem bugzilla: 48246 ------------------------------------------------- The original memory extension feature name is memig, after open source the feature name is changed to etmem. This patch is used to synchronously modify the feature name and file name. The config options and the file name are modified synchronously to etmem. Signed-off-by: Nliubo <liubo254@huawei.com> Reviewed-by: Ngeruijun <geruijun@huawei.com> Reviewed-by: NXiongfeng Wang <wangxiongfeng2@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Zheng Zengkai 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following arch arm related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: d5c13edb Improve __copy_to_user and __copy_from_user performance 97145d2a Update vfpmodule.c bffc462c Main bcm2708/bcm2709 linux port 588cfce7 cache: export clean and invalidate 41cd350c ARM: Activate FIQs to avoid __irq_startup warnings 90607c7a ARM: proc-v7: Force misalignment of early stmia ee46d0fa reboot: Use power off rather than busy spinning when halt is requested Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com>
-
- 08 3月, 2021 2 次提交
-
-
由 Xiongfeng Wang 提交于
hulk inclusion category: bugfix bugzilla: 50485 CVE: NA ------------------------------------------------------------------------- Fix the following compile error. arch/arm64/kernel/ipi_nmi.c: In function ‘ipi_nmi_handler’: arch/arm64/kernel/ipi_nmi.c:54:7: error: implicit declaration of function ‘kgdb_nmicallback’ [-Werror=implicit-function-declaration] if (!kgdb_nmicallback(cpu, get_irq_regs())) ^~~~~~~~~~~~~~~~ Signed-off-by: NXiongfeng Wang <wangxiongfeng2@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> -
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ Fix the following compile error when using bcm2711_defconfig (for RPi). /bin/sh: -c: line 0: syntax error near unexpected token `(' /bin/sh: -c: line 0: `set -e; echo ' DTCO arch/arm64/boot/dts/overlays/act-led.dtbo'; mkdir -p arch/arm64/boot/dts/overlays/ ; gcc -E -Wp,-MMD,arch/arm64/boot/dts/overlays/.act-led.dtbo.d.pre.tmp -nostdinc -I./scripts/dtc/include-prefixes -undef -D__DTS__ -x assembler-with-cpp -o arch/arm64/boot/dts/overlays/.act-led.dtbo.dts.tmp arch/arm64/boot/dts/overlays/act-led-overlay.dts ; ./scripts/dtc/dtc -@ -H epapr -O dtb -o arch/arm64/boot/dts/overlays/act-led.dtbo -b 0 -i arch/arm64/boot/dts/overlays/ -Wno-interrupt_provider -Wno-unit_address_vs_reg -Wno-unit_address_format -Wno-gpios_property -Wno-avoid_unnecessary_addr_size -Wno-alias_paths -Wno-graph_child_address -Wno-simple_bus_reg -Wno-unique_unit_address -Wno-pci_device_reg -Wno-interrupts_property ifeq (y,y) -Wno-label_is_string -Wno-reg_format -Wno-pci_device_bus_num -Wno-i2c_bus_reg -Wno-spi_bus_reg -Wno-avoid_default_addr_size endif -d arch/arm64/boot/dts/overlays/.act-led.dtbo.d.dtc.tmp arch/arm64/boot/dts/overlays/.act-led.dtbo.dts.tmp ; cat ...; rm -f arch/arm64/boot/dts/overlays/.act-led.dtbo.d' make[2]: *** [scripts/Makefile.lib;363: arch/arm64/boot/dts/overlays/act-led.dtbo] Error 1 make[2]: *** Waiting for unfinished jobs.... Related patches: ffa2d13c BCM2708: Add core Device Tree support 4894352e kbuild: Silence unavoidable dtc overlay warnings a4a4d07f kbuild: keep the original function for non-RPi Signed-off-by: Fang Yafen <yafen(a)iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
- 05 3月, 2021 10 次提交
-
-
由 Zheng Zengkai 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following kbuild related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: d2864887 Kbuild: Allow .dtbo overlays to be built, adjust. 0131a56e kbuild: Disable gcc plugins 4894352e kbuild: Silence unavoidable dtc overlay warnings Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com>
-
由 Zheng Zengkai 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following arch arm64 related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: 154e93c8 ARM64: Force hardware emulation of deprecated instructions 40cdf60c arch/arm64: Add Revision, Serial, Model to cpuinfo Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com>
-
由 Zheng Zengkai 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following usb related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: cbf9b5f6 Add dwc_otg driver 470f9247 hid: Reduce default mouse polling interval to 60Hz 1771bca0 usb: xhci: Disable the XHCI 5 second timeout fb2ea552 usbhid: call usb_fixup_endpoint after mangling intervals 8f2c6b7c xhci: Use more event ring segment table entries Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com>
-
由 Zheng Zengkai 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following memory related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: 6e500008 mm: Remove the PFN busy warning 244b4163 cgroup: Disable cgroup "memory" by default a7536dd3 zswap: Defer zswap initialisation Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com>
-
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following video & logo patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: 38a1e371 bcm2708 framebuffer driver 08fb78e5 drm: Checking of the pitch is only valid for linear formats 31c95f1a media: videobuf2: Allow exporting of a struct dmabuf Signed-off-by: NFang Yafen <yafen@iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following serial related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: 239d5fc7 amba_pl011: Round input clock up 05884dbf amba_pl011: Insert mb() for correct FIFO handling 1309c3c7 amba_pl011: Add cts-event-workaround DT property Signed-off-by: NFang Yafen <yafen@iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following mmc/spi driver related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: f3badb78 of: overlay: Correct symbol path fixups 8f150108 mmc: sdhci: Silence MMC warnings 893e457c spi: Force CS_HIGH if GPIO descriptors are used Signed-off-by: NFang Yafen <yafen@iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following net related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: 5e6ba3df smsc95xx: Experimental: Enable turbo_mode and packetsize=2560 by default ab8cdd97 lan78xx: use default alignment for rx buffers 03c2e3cc net:phy:2711 Change the default ethernet LED actions ae5b52c2 brcmfmac: Prefer a ccode from OTP over nvram file 83998d2a brcmfmac: Increase power saving delay to 2s cd40cb1f net: lan78xx: Ack pending PHY ints when resetting Signed-off-by: NFang Yafen <yafen@iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ This patch adjusts following gpio related patches for raspberry pi on non-Raspberry Pi platforms, using specific config CONFIG_OPENEULER_RASPBERRYPI to distinguish them: 680d5826 Revert "mailbox: avoid timer start from callback" 1088c5d4 gpiolib: Don't prevent IRQ usage of output GPIOs 54bc28b4 gpio-poweroff: Allow it to work on Raspberry Pi 26b77aae i2c-gpio: Also set bus numbers from reg property Signed-off-by: NFang Yafen <yafen@iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Fang Yafen 提交于
raspberrypi inclusion category: feature bugzilla: 50432 ------------------------------ Add new config CONFIG_OPENEULER_RASPBERRYPI to denote that the compiled kernel will be used for Raspberry Pi. Signed-off-by: NFang Yafen <yafen@iscas.ac.cn> Reviewed-by: NXie XiuQi <xiexiuqi@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
- 04 3月, 2021 20 次提交
-
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 --------------------------- Enable digest lists and PGP keys preload. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NYang Yingliang <yangyingliang@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Commit 5feeb611 ("evm: Allow non-SHA1 digital signatures") introduced the possibility to use different hash algorithm for signatures, but kept the algorithm for the HMAC hard-coded (SHA1). Switching to a different algorithm for HMAC would require to change the code in different places. This patch introduces a new global variable called evm_hash_algo, and consistently uses it whenever EVM perform HMAC-related operations. It also introduces a new kernel configuration option called CONFIG_EVM_DEFAULT_HASH so that evm_hash_algo can be defined at kernel compilation time. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Acked-by: NHanjun Guo <guohanjun@huawei.com> Signed-off-by: NYang Yingliang <yangyingliang@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Introduce three new values for evm= kernel option: x509: enable EVM by setting x509 flag; allow_metadata_writes: permit metadata modificatons; complete: don't allow further changes of the EVM status. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 --------------------------- This patch limits the digest lists processed by the kernel by excluding those that are not in the compact format. The patch then executes the user space parsers to process the skipped digest lists. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Acked-by: NHanjun Guo <guohanjun@huawei.com> Signed-off-by: NYang Yingliang <yangyingliang@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch adds the new policy keyword 'parser' to measure and appraise any file opened by the user space parser, while the parser opened digest_list_data_add or digest_list_data_del securityfs interfaces. This ensures that all files processed by the user space parser are processed without including the FILE_CHECK hook in the policy. With this keyword it would be possible to have a policy to measure/appraise only executable code and digest lists. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch allows direct upload of digest lists by user space parsers. This operation is possible if the digest of the process's executable is found in the digest lists and its type is COMPACT_PARSER. ima_check_measured_appraised() is called at the end of ima_file_check() to verify that everything accessed by the user space parsers (except for directories and securityfs) has been processed by IMA. If a digest list was not processed by an IMA submodule, digest list lookup is disabled for that submodule. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch calls search_trusted_key() in request_asymmetric_key() if the key is not found in the IMA/EVM keyrings. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Introduce search_trusted_key() to extend the key search to the primary or secondary built-in keyrings. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Preload PGP keys from 'pubring.gpg', placed in certs/ of the kernel source directory. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 David Howells 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Provide a function to load keys from a PGP keyring blob for use in initialising the module signing key keyring: int preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, struct key *keyring); Descriptions are generated from user ID notes and key fingerprints. The keys will actually be identified by the ID calculated from the PGP data rather than by the description, so this shouldn't be a problem. The keys are attached to the keyring supplied. Looking as root in /proc/keys after the module signing keyring has been loaded: 383a00c1 I------ 1 perm 1f030000 0 0 asymmetri \ Red Hat, Inc. dbeca166: PGP.DSA dbeca166 [] Thanks to Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> for some pointing out some errors. Changelog v0: - avoid Kconfig circular dependency (Roberto Sassu) - modify flags passed to key_create_or_update() (Roberto Sassu) - don't process Public-Subkey packets (Roberto Sassu) Signed-off-by: NDavid Howells <dhowells@redhat.com> Co-developed-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 David Howells 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Provide a facility to autogenerate the name of PGP keys from the contents of the payload. If add_key() is given a blank description, a description is constructed from the last user ID packet in the payload data plus the last 8 hex digits of the key ID. For instance: keyctl padd asymmetric "" @s </tmp/key.pub might create a key with a constructed description that can be seen in /proc/keys: 2f674b96 I--Q--- 1 perm 39390000 0 0 crypto \ Sample kernel key 31f0ae93: PGP.RSA 31f0ae93 [] Changelog v0: - fix style issues (Roberto Sassu) Signed-off-by: NDavid Howells <dhowells@redhat.com> Co-developed-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Implement a PGP data parser for the crypto key type to use when instantiating a key. This parser attempts to parse the instantiation data as a PGP packet sequence (RFC 4880) and if it parses okay, attempts to extract a public-key algorithm key or subkey from it. If it finds such a key, it will set up a public_key subtype payload with appropriate handler routines (DSA or RSA) and attach it to the key. Thanks to Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> for pointing out some errors. Changelog v0: - remove declaration of pgp_to_public_key_algo (Roberto Sassu) - replace prep->type_data with prep->payload.data (Roberto Sassu) - replace public_key_destroy() with public_key_free() (Roberto Sassu) - use asymmetric_key_generate_id() to generate the key identifiers (Roberto Sassu) - add raw_fingerprint to pgp_key_data_parse_context structure (Roberto Sassu) - replace algorithm identifiers with strings (Roberto Sassu) - don't parse MPIs (Roberto Sassu) - don't process Public-Subkey packets (only one key will be created) (Roberto Sassu) Signed-off-by: NDavid Howells <dhowells@redhat.com> Co-developed-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 David Howells 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Provide a simple parser that extracts the packets from a PGP packet blob and passes the desirous ones to the given processor function: struct pgp_parse_context { u64 types_of_interest; int (*process_packet)(struct pgp_parse_context *context, enum pgp_packet_tag type, u8 headerlen, const u8 *data, size_t datalen); }; int pgp_parse_packets(const u8 *data, size_t datalen, struct pgp_parse_context *ctx); This is configured on with CONFIG_PGP_LIBRARY. Changelog v0: - fix style issues (Roberto Sassu) - declare pgp_to_public_key_algo (Roberto Sassu) Signed-off-by: NDavid Howells <dhowells@redhat.com> Co-developed-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com> -
由 David Howells 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Provide some useful PGP definitions from RFC 4880. These describe details of public key crypto as used by crypto keys for things like signature verification. Changelog: v0: - fix style issues (Roberto Sassu) Signed-off-by: NDavid Howells <dhowells@redhat.com> Co-developed-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Parse the RSA key with RAW format if the ASN.1 parser returns an error. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Introduce the new function to get the number of bits and bytes from an MPI. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- Without resetting the status when security.evm is modified, IMA appraisal would continue to use the cached result and wouldn't detect whether the meta_immutable requirement is still satisfied. This patch calls evm_reset_status() in the post hooks when security.evm is modified. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch adds the documentation of the IMA Digest Lists extension. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch modifies the existing "appraise_exec_tcb" policy, by adding the appraise_type=meta_immutable requirement for executed files: appraise func=MODULE_CHECK appraise_type=imasig appraise func=FIRMWARE_CHECK appraise_type=imasig appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig appraise func=POLICY_CHECK appraise_type=imasig appraise func=DIGEST_LIST_CHECK appraise_type=imasig dont_appraise fsmagic=0x9fa0 dont_appraise fsmagic=0x62656572 dont_appraise fsmagic=0x64626720 dont_appraise fsmagic=0x858458f6 dont_appraise fsmagic=0x1cd1 dont_appraise fsmagic=0x42494e4d dont_appraise fsmagic=0x73636673 dont_appraise fsmagic=0xf97cff8c dont_appraise fsmagic=0x43415d53 dont_appraise fsmagic=0x6e736673 dont_appraise fsmagic=0xde5e81e4 dont_appraise fsmagic=0x27e0eb dont_appraise fsmagic=0x63677270 appraise func=BPRM_CHECK appraise_type=imasig appraise_type=meta_immutable appraise func=MMAP_CHECK appraise_type=imasig This policy can be selected by specifying ima_policy="appraise_exec_tcb|appraise_exec_immutable" in the kernel command line. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-
由 Roberto Sassu 提交于
hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch introduces a new hard-coded policy to appraise executable code: appraise func=MODULE_CHECK appraise_type=imasig appraise func=FIRMWARE_CHECK appraise_type=imasig appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig appraise func=POLICY_CHECK appraise_type=imasig appraise func=DIGEST_LIST_CHECK appraise_type=imasig dont_appraise fsmagic=0x9fa0 dont_appraise fsmagic=0x62656572 dont_appraise fsmagic=0x64626720 dont_appraise fsmagic=0x858458f6 dont_appraise fsmagic=0x1cd1 dont_appraise fsmagic=0x42494e4d dont_appraise fsmagic=0x73636673 dont_appraise fsmagic=0xf97cff8c dont_appraise fsmagic=0x43415d53 dont_appraise fsmagic=0x6e736673 dont_appraise fsmagic=0xde5e81e4 dont_appraise fsmagic=0x27e0eb dont_appraise fsmagic=0x63677270 appraise func=BPRM_CHECK appraise_type=imasig appraise func=MMAP_CHECK appraise_type=imasig The new policy can be selected by specifying ima_policy=appraise_exec_tcb in the kernel command line. Signed-off-by: NRoberto Sassu <roberto.sassu@huawei.com> Signed-off-by: NTianxing Zhang <zhangtianxing3@huawei.com> Reviewed-by: NJason Yan <yanaijie@huawei.com> Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
-