Eric Lee / smarc-fsl-linux-kernel

13 Jul, 2017

2 commits

  • e2ae8ab4b   kexec_file: adjust declaration of kexec_purgatory ... Browse Code »

    Defining kexec_purgatory as a zero-length char array upsets compile time
    size checking. Since this is built on a per-arch basis, define it as an
    unsized char array (like is done for other similar things, e.g. linker
    sections). This silences the warning generated by the future
    CONFIG_FORTIFY_SOURCE, which did not like the memcmp() of a "0 byte"
    array. This drops the __weak and uses an extern instead, since both
    users define kexec_purgatory.

    Link: http://lkml.kernel.org/r/1497903987-21002-4-git-send-email-keescook@chromium.org
    Signed-off-by: Kees Cook
    Acked-by: "Eric W. Biederman"
    Cc: Daniel Micay
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Kees Cook
     
  • 1229384f5   kdump: protect vmcoreinfo data under the crash memory ... Browse Code »

    Currently vmcoreinfo data is updated at boot time subsys_initcall(), it
    has the risk of being modified by some wrong code during system is
    running.

    As a result, vmcore dumped may contain the wrong vmcoreinfo. Later on,
    when using "crash", "makedumpfile", etc utility to parse this vmcore, we
    probably will get "Segmentation fault" or other unexpected errors.

    E.g. 1) wrong code overwrites vmcoreinfo_data; 2) further crashes the
    system; 3) trigger kdump, then we obviously will fail to recognize the
    crash context correctly due to the corrupted vmcoreinfo.

    Now except for vmcoreinfo, all the crash data is well
    protected(including the cpu note which is fully updated in the crash
    path, thus its correctness is guaranteed). Given that vmcoreinfo data
    is a large chunk prepared for kdump, we better protect it as well.

    To solve this, we relocate and copy vmcoreinfo_data to the crash memory
    when kdump is loading via kexec syscalls. Because the whole crash
    memory will be protected by existing arch_kexec_protect_crashkres()
    mechanism, we naturally protect vmcoreinfo_data from write(even read)
    access under kernel direct mapping after kdump is loaded.

    Since kdump is usually loaded at the very early stage after boot, we can
    trust the correctness of the vmcoreinfo data copied.

    On the other hand, we still need to operate the vmcoreinfo safe copy
    when crash happens to generate vmcoreinfo_note again, we rely on vmap()
    to map out a new kernel virtual address and update to use this new one
    instead in the following crash_save_vmcoreinfo().

    BTW, we do not touch vmcoreinfo_note, because it will be fully updated
    using the protected vmcoreinfo_data after crash which is surely correct
    just like the cpu crash note.

    Link: http://lkml.kernel.org/r/1493281021-20737-3-git-send-email-xlpang@redhat.com
    Signed-off-by: Xunlei Pang
    Tested-by: Michael Holzheu
    Cc: Benjamin Herrenschmidt
    Cc: Dave Young
    Cc: Eric Biederman
    Cc: Hari Bathini
    Cc: Juergen Gross
    Cc: Mahesh Salgaonkar
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Xunlei Pang
     

30 Jun, 2017

1 commit

11 Mar, 2017

1 commit

  • 40c50c1fe   kexec, x86/purgatory: Unbreak it and clean it up ... Browse Code »

    The purgatory code defines global variables which are referenced via a
    symbol lookup in the kexec code (core and arch).

    A recent commit addressing sparse warnings made these static and thereby
    broke kexec_file.

    Why did this happen? Simply because the whole machinery is undocumented and
    lacks any form of forward declarations. The variable names are unspecific
    and lack a prefix, so adding forward declarations creates shadow variables
    in the core code. Aside of that the code relies on magic constants and
    duplicate struct definitions with no way to ensure that these things stay
    in sync. The section placement of the purgatory variables happened by
    chance and not by design.

    Unbreak kexec and cleanup the mess:

    - Add proper forward declarations and document the usage
    - Use common struct definition
    - Use the proper common defines instead of magic constants
    - Add a purgatory_ prefix to have a proper name space
    - Use ARRAY_SIZE() instead of a homebrewn reimplementation
    - Add proper sections to the purgatory variables [ From Mike ]

    Fixes: 72042a8c7b01 ("x86/purgatory: Make functions and variables static")
    Reported-by: Mike Galbraith <
    Signed-off-by: Thomas Gleixner
    Cc: Nicholas Mc Guire
    Cc: Borislav Petkov
    Cc: Vivek Goyal
    Cc: "Tobin C. Harding"
    Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1703101315140.3681@nanos
    Signed-off-by: Thomas Gleixner

    Thomas Gleixner
     

21 Dec, 2016

1 commit

  • 7b8589cc2   ima: on soft reboot, save the measurement list ... Browse Code »

    The TPM PCRs are only reset on a hard reboot. In order to validate a
    TPM's quote after a soft reboot (eg. kexec -e), the IMA measurement
    list of the running kernel must be saved and restored on boot.

    This patch uses the kexec buffer passing mechanism to pass the
    serialized IMA binary_runtime_measurements to the next kernel.

    Link: http://lkml.kernel.org/r/1480554346-29071-7-git-send-email-zohar@linux.vnet.ibm.com
    Signed-off-by: Thiago Jung Bauermann
    Signed-off-by: Mimi Zohar
    Acked-by: "Eric W. Biederman"
    Acked-by: Dmitry Kasatkin
    Cc: Andreas Steffen
    Cc: Josh Sklar
    Cc: Dave Young
    Cc: Vivek Goyal
    Cc: Baoquan He
    Cc: Michael Ellerman
    Cc: Benjamin Herrenschmidt
    Cc: Paul Mackerras
    Cc: Stewart Smith
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Mimi Zohar
     

30 Nov, 2016

3 commits

02 Sep, 2016

1 commit

  • 070c43eea   kexec: fix double-free when failing to relocate the purgatory ... Browse Code »

    If kexec_apply_relocations fails, kexec_load_purgatory frees pi->sechdrs
    and pi->purgatory_buf. This is redundant, because in case of error
    kimage_file_prepare_segments calls kimage_file_post_load_cleanup, which
    will also free those buffers.

    This causes two warnings like the following, one for pi->sechdrs and the
    other for pi->purgatory_buf:

    kexec-bzImage64: Loading purgatory failed
    ------------[ cut here ]------------
    WARNING: CPU: 1 PID: 2119 at mm/vmalloc.c:1490 __vunmap+0xc1/0xd0
    Trying to vfree() nonexistent vm area (ffffc90000e91000)
    Modules linked in:
    CPU: 1 PID: 2119 Comm: kexec Not tainted 4.8.0-rc3+ #5
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Call Trace:
    dump_stack+0x4d/0x65
    __warn+0xcb/0xf0
    warn_slowpath_fmt+0x4f/0x60
    ? find_vmap_area+0x19/0x70
    ? kimage_file_post_load_cleanup+0x47/0xb0
    __vunmap+0xc1/0xd0
    vfree+0x2e/0x70
    kimage_file_post_load_cleanup+0x5e/0xb0
    SyS_kexec_file_load+0x448/0x680
    ? putname+0x54/0x60
    ? do_sys_open+0x190/0x1f0
    entry_SYSCALL_64_fastpath+0x13/0x8f
    ---[ end trace 158bb74f5950ca2b ]---

    Fix by setting pi->sechdrs an pi->purgatory_buf to NULL, since vfree
    won't try to free a NULL pointer.

    Link: http://lkml.kernel.org/r/1472083546-23683-1-git-send-email-bauerman@linux.vnet.ibm.com
    Signed-off-by: Thiago Jung Bauermann
    Acked-by: Baoquan He
    Cc: "Eric W. Biederman"
    Cc: Vivek Goyal
    Cc: Dave Young
    Cc:
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Thiago Jung Bauermann
     

24 May, 2016

1 commit

  • 9b492cf58   kexec: introduce a protection mechanism for the crashkernel reserved memory ... Browse Code »

    For the cases that some kernel (module) path stamps the crash reserved
    memory(already mapped by the kernel) where has been loaded the second
    kernel data, the kdump kernel will probably fail to boot when panic
    happens (or even not happens) leaving the culprit at large, this is
    unacceptable.

    The patch introduces a mechanism for detecting such cases:

    1) After each crash kexec loading, it simply marks the reserved memory
    regions readonly since we no longer access it after that. When someone
    stamps the region, the first kernel will panic and trigger the kdump.
    The weak arch_kexec_protect_crashkres() is introduced to do the actual
    protection.

    2) To allow multiple loading, once 1) was done we also need to remark
    the reserved memory to readwrite each time a system call related to
    kdump is made. The weak arch_kexec_unprotect_crashkres() is introduced
    to do the actual protection.

    The architecture can make its specific implementation by overriding
    arch_kexec_protect_crashkres() and arch_kexec_unprotect_crashkres().

    Signed-off-by: Xunlei Pang
    Cc: Eric Biederman
    Cc: Dave Young
    Cc: Minfei Huang
    Cc: Vivek Goyal
    Cc: Baoquan He
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Xunlei Pang
     

18 Mar, 2016

1 commit

  • bb7aeae3d   Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security layer updates from James Morris:
    "There are a bunch of fixes to the TPM, IMA, and Keys code, with minor
    fixes scattered across the subsystem.

    IMA now requires signed policy, and that policy is also now measured
    and appraised"

    * 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (67 commits)
    X.509: Make algo identifiers text instead of enum
    akcipher: Move the RSA DER encoding check to the crypto layer
    crypto: Add hash param to pkcs1pad
    sign-file: fix build with CMS support disabled
    MAINTAINERS: update tpmdd urls
    MODSIGN: linux/string.h should be #included to get memcpy()
    certs: Fix misaligned data in extra certificate list
    X.509: Handle midnight alternative notation in GeneralizedTime
    X.509: Support leap seconds
    Handle ISO 8601 leap seconds and encodings of midnight in mktime64()
    X.509: Fix leap year handling again
    PKCS#7: fix unitialized boolean 'want'
    firmware: change kernel read fail to dev_dbg()
    KEYS: Use the symbol value for list size, updated by scripts/insert-sys-cert
    KEYS: Reserve an extra certificate symbol for inserting without recompiling
    modsign: hide openssl output in silent builds
    tpm_tis: fix build warning with tpm_tis_resume
    ima: require signed IMA policy
    ima: measure and appraise the IMA policy itself
    ima: load policy using path
    ...

    Linus Torvalds
     

21 Feb, 2016

1 commit

  • b804defe4   kexec: replace call to copy_file_from_fd() with kernel version ... Browse Code »

    Replace copy_file_from_fd() with kernel_read_file_from_fd().

    Two new identifiers named READING_KEXEC_IMAGE and READING_KEXEC_INITRAMFS
    are defined for measuring, appraising or auditing the kexec image and
    initramfs.

    Changelog v3:
    - return -EBADF, not -ENOEXEC
    - identifier change
    - split patch, moving copy_file_from_fd() to a separate patch
    - split patch, moving IMA changes to a separate patch
    v0:
    - use kstat file size type loff_t, not size_t
    - Calculate the file hash from the in memory buffer - Dave Young

    Signed-off-by: Mimi Zohar
    Acked-by: Kees Cook
    Acked-by: Luis R. Rodriguez
    Cc: Eric Biederman
    Acked-by: Dave Young

    Mimi Zohar
     

30 Jan, 2016

2 commits

  • f0f4711aa   x86, kexec, nvdimm: Use walk_iomem_res_desc() for iomem search ... Browse Code »

    Change the callers of walk_iomem_res() scanning for the
    following resources by name to use walk_iomem_res_desc()
    instead.

    "ACPI Tables"
    "ACPI Non-volatile Storage"
    "Persistent Memory (legacy)"
    "Crash kernel"

    Note, the caller of walk_iomem_res() with "GART" will be removed
    in a later patch.

    Signed-off-by: Toshi Kani
    Signed-off-by: Borislav Petkov
    Reviewed-by: Dave Young
    Cc: Andrew Morton
    Cc: Andy Lutomirski
    Cc: Andy Lutomirski
    Cc: Borislav Petkov
    Cc: Brian Gerst
    Cc: Chun-Yi
    Cc: Dan Williams
    Cc: Denys Vlasenko
    Cc: Don Zickus
    Cc: H. Peter Anvin
    Cc: Lee, Chun-Yi
    Cc: Linus Torvalds
    Cc: Luis R. Rodriguez
    Cc: Minfei Huang
    Cc: Peter Zijlstra (Intel)
    Cc: Ross Zwisler
    Cc: Stephen Rothwell
    Cc: Takao Indoh
    Cc: Thomas Gleixner
    Cc: Toshi Kani
    Cc: kexec@lists.infradead.org
    Cc: linux-arch@vger.kernel.org
    Cc: linux-mm
    Cc: linux-nvdimm@lists.01.org
    Link: http://lkml.kernel.org/r/1453841853-11383-15-git-send-email-bp@alien8.de
    Signed-off-by: Ingo Molnar

    Toshi Kani
     
  • 1a085d072   kexec: Set IORESOURCE_SYSTEM_RAM for System RAM ... Browse Code »

    Set proper ioresource flags and types for crash kernel
    reservation areas.

    Signed-off-by: Toshi Kani
    Signed-off-by: Borislav Petkov
    Reviewed-by: Dave Young
    Cc: Andrew Morton
    Cc: Andy Lutomirski
    Cc: Baoquan He
    Cc: Borislav Petkov
    Cc: Brian Gerst
    Cc: Denys Vlasenko
    Cc: H. Peter Anvin
    Cc: HATAYAMA Daisuke
    Cc: Linus Torvalds
    Cc: Luis R. Rodriguez
    Cc: Minfei Huang
    Cc: Peter Zijlstra
    Cc: Thomas Gleixner
    Cc: Toshi Kani
    Cc: Vivek Goyal
    Cc: kexec@lists.infradead.org
    Cc: linux-arch@vger.kernel.org
    Cc: linux-mm
    Link: http://lkml.kernel.org/r/1453841853-11383-8-git-send-email-bp@alien8.de
    Signed-off-by: Ingo Molnar

    Toshi Kani
     

21 Jan, 2016

1 commit

07 Nov, 2015

1 commit

  • de90a6bca   kexec: use file name as the output message prefix ... Browse Code »

    kexec output message misses the prefix "kexec", when Dave Young split the
    kexec code. Now, we use file name as the output message prefix.

    Currently, the format of output message:
    [ 140.290795] SYSC_kexec_load: hello, world
    [ 140.291534] kexec: sanity_check_segment_list: hello, world

    Ideally, the format of output message:
    [ 30.791503] kexec: SYSC_kexec_load, Hello, world
    [ 79.182752] kexec_core: sanity_check_segment_list, Hello, world

    Remove the custom prefix "kexec" in output message.

    Signed-off-by: Minfei Huang
    Acked-by: Dave Young
    Cc: "Eric W. Biederman"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Minfei Huang
     

11 Sep, 2015

1 commit

  • a43cac0d9   kexec: split kexec_file syscall code to kexec_file.c ... Browse Code »

    Split kexec_file syscall related code to another file kernel/kexec_file.c
    so that the #ifdef CONFIG_KEXEC_FILE in kexec.c can be dropped.

    Sharing variables and functions are moved to kernel/kexec_internal.h per
    suggestion from Vivek and Petr.

    [akpm@linux-foundation.org: fix bisectability]
    [akpm@linux-foundation.org: declare the various arch_kexec functions]
    [akpm@linux-foundation.org: fix build]
    Signed-off-by: Dave Young
    Cc: Eric W. Biederman
    Cc: Vivek Goyal
    Cc: Petr Tesarik
    Cc: Theodore Ts'o
    Cc: Josh Boyer
    Cc: David Howells
    Cc: Geert Uytterhoeven
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dave Young