Re: [RFC 0/3] extend kexec_file_load system call

2016-07-20 Thread Thiago Jung Bauermann
"plugged" virtually by a managing system (BMC) is considered a physical attack or a remote attack in the context of UEFI Secure Boot. -- []'s Thiago Jung Bauermann IBM Linux Technology Center

Re: [RFC 0/3] extend kexec_file_load system call

2016-07-21 Thread Thiago Jung Bauermann
Am Freitag, 15 Juli 2016, 18:03:35 schrieb Thiago Jung Bauermann: > Am Freitag, 15 Juli 2016, 22:26:09 schrieb Arnd Bergmann: > > However, the powerpc specific RTAS runtime services provide a similar > > interface to the UEFI runtime support and allow to call into > > binary

Re: [RFC 0/3] extend kexec_file_load system call

2016-07-22 Thread Thiago Jung Bauermann
Am Freitag, 22 Juli 2016, 12:54:28 schrieb Michael Ellerman: > Thiago Jung Bauermann writes: > > So even if not ideal, the solution above is desirable for powerpc. We > > would like to preserve the ability of allowing userspace to pass > > parameters to the OS via the DTB, e

Re: linux-next: build failure after merge of the akpm-current tree

2016-09-20 Thread Thiago Jung Bauermann
rmail/linuxppc-dev/2016-September/148898.html elf_util_64.o is only built if CONFIG_WORD_SIZE=64. This is affects the bisectabilty of many patches in the kexec_file_load series. Should I post a new version rebased on powerpc/next? -- []'s Thiago Jung Bauermann IBM Linux Technology Center

Re: linux-next: build failure after merge of the akpm-current tree

2016-09-20 Thread Thiago Jung Bauermann
should fix it? > > I think I'd actually prefer it if purgatory didn't redefine the CFLAGS > from scratch, so I'll see if Thiago can do that and send a new version. I could move the purgatory inside arch/powerpc/boot and use its BOOTCFLAGS. The needs of the purgatory and the boot wrapper are very similar. Would that be better? -- []'s Thiago Jung Bauermann IBM Linux Technology Center

Re: [PATCH v2 2/9] kexec_file: Generalize kexec_add_buffer.

2016-06-20 Thread Thiago Jung Bauermann
Am Montag, 20 Juni 2016, 10:26:05 schrieb Dave Young: > kexec_buf should go within #ifdef for kexec file like struct > purgatory_info > > Other than that it looks good. Great! Here it is. -- []'s Thiago Jung Bauermann IBM Linux Technology Center kexec_file: Generalize

[PATCH 6/6] IMA: Demonstration code for kexec buffer passing.

2016-06-20 Thread Thiago Jung Bauermann
This shows how kernel code can use the kexec buffer passing mechanism to pass information to the next kernel. This patch is not intended to be committed. Signed-off-by: Thiago Jung Bauermann --- include/linux/ima.h | 11 + kernel/kexec_file.c | 4

[PATCH 2/6] powerpc: kexec_file: Add buffer hand-over support for the next kernel

2016-06-20 Thread Thiago Jung Bauermann
The buffer hand-over mechanism allows the currently running kernel to pass data to kernel that will be kexec'd via a kexec segment. The second kernel can check whether the previous kernel sent data and retrieve it. This is the architecture-specific part. Signed-off-by: Thiago Jung Baue

[PATCH 5/6] kexec: Share logic to copy segment page contents.

2016-06-20 Thread Thiago Jung Bauermann
Make kimage_load_normal_segment and kexec_update_segment share code which they currently duplicate. Signed-off-by: Thiago Jung Bauermann --- kernel/kexec_core.c | 159 +++- 1 file changed, 95 insertions(+), 64 deletions(-) diff --git a/kernel

[PATCH 4/6] kexec_file: Add mechanism to update kexec segments.

2016-06-20 Thread Thiago Jung Bauermann
kexec_update_segment allows a given segment in kexec_image to have its contents updated. This is useful if the current kernel wants to send information to the next kernel that is up-to-date at the time of reboot. Signed-off-by: Thiago Jung Bauermann --- include/linux/kexec.h | 2 ++ kernel

[PATCH 0/6] kexec_file: Add buffer hand-over for the next kernel

2016-06-20 Thread Thiago Jung Bauermann
rg/pipermail/kexec/2016-June/016078.html Thiago Jung Bauermann (6): kexec_file: Add buffer hand-over support for the next kernel powerpc: kexec_file: Add buffer hand-over support for the next kernel kexec_file: Allow skipping checksum calculation for some segments. kexec_file: Add mechanis

[PATCH 3/6] kexec_file: Allow skipping checksum calculation for some segments.

2016-06-20 Thread Thiago Jung Bauermann
purgatory checksum verification to fail when the machine is rebooted. As a bonus, we don't need to special-case the purgatory segment anymore to avoid checksumming it. Adjust call sites for the new argument. Signed-off-by: Thiago Jung Bauermann --- arch/powerpc/kernel/kexec_elf_64.c

[PATCH 1/6] kexec_file: Add buffer hand-over support for the next kernel

2016-06-20 Thread Thiago Jung Bauermann
hiago Jung Bauermann --- include/linux/kexec.h | 40 ++ kernel/kexec_file.c | 79 +++ 2 files changed, 119 insertions(+) diff --git a/include/linux/kexec.h b/include/linux/kexec.h index a08cd986b5a1..72db95c623b3 100644

[PATCH v3 8/9] powerpc: Add support for loading ELF kernels with kexec_file_load.

2016-06-21 Thread Thiago Jung Bauermann
purgatory. Signed-off-by: Thiago Jung Bauermann Cc: ke...@lists.infradead.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/include/asm/elf_util.h | 1 + arch/powerpc/include/asm/kexec_elf_64.h | 10 + arch/powerpc/kernel/Makefile| 5 +- arch/powerpc/kernel/elf_util_64.c

[PATCH v3 6/9] powerpc: Add functions to read ELF files of any endianness.

2016-06-21 Thread Thiago Jung Bauermann
ating the ELF structs. These functions will be used in the next patch in the series. Signed-off-by: Thiago Jung Bauermann Cc: ke...@lists.infradead.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/include/asm/elf_util.h | 19 ++ arch/powerpc/kernel/Makefile| 2 +- arch/powerpc/k

[PATCH v3 9/9] powerpc: Add purgatory for kexec_file_load implementation.

2016-06-21 Thread Thiago Jung Bauermann
A-256 implementation. Also, some formatting warnings found by checkpatch.pl were fixed. Signed-off-by: Thiago Jung Bauermann Cc: ke...@lists.infradead.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/Makefile | 4 + arch/powerpc/purgatory/.gitignore | 2 + arch/po

[PATCH v3 0/9] kexec_file_load implementation for PowerPC

2016-06-21 Thread Thiago Jung Bauermann
the other adding kexec_locate_mem_hole. - Patch "powerpc: Implement kexec_file_load.": - Moved relocation changes and the arch_kexec_walk_mem implementation to the next patch in the series. - Removed pr_fmt from machine_kexec_64.c, since the patch doesn't add any

[PATCH v3 3/9] kexec_file: Factor out kexec_locate_mem_hole from kexec_add_buffer.

2016-06-21 Thread Thiago Jung Bauermann
kexec_locate_mem_hole will be used by the PowerPC kexec_file_load implementation to find free memory for the purgatory stack. Signed-off-by: Thiago Jung Bauermann Cc: Eric Biederman Cc: Dave Young Cc: ke...@lists.infradead.org Cc: linux-kernel@vger.kernel.org --- include/linux/kexec.h | 4

[PATCH v3 1/9] kexec_file: Remove unused members from struct kexec_buf.

2016-06-21 Thread Thiago Jung Bauermann
kexec_add_buffer uses kexec_buf.buffer and kexec_buf.bufsz to pass along its own arguments buffer and bufsz, but since they aren't used anywhere else, it's pointless. Signed-off-by: Thiago Jung Bauermann Cc: Eric Biederman Cc: ke...@lists.infradead.org Cc: linux-kernel@vger.kernel.or

[PATCH v3 5/9] powerpc: Generalize elf64_apply_relocate_add.

2016-06-21 Thread Thiago Jung Bauermann
et at its final location by adding an addr_base argument to specify the address at which the section will be loaded, and rela, loc_base and syms_base to point to the sections' contents. Signed-off-by: Thiago Jung Bauermann Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc:

[PATCH v3 7/9] powerpc: Implement kexec_file_load.

2016-06-21 Thread Thiago Jung Bauermann
Adds the basic machinery needed by kexec_file_load. Signed-off-by: Josh Sklar Signed-off-by: Thiago Jung Bauermann Cc: ke...@lists.infradead.org Cc: linux-kernel@vger.kernel.org --- arch/powerpc/Kconfig | 13 + arch/powerpc/include/asm/systbl.h | 1 + arch

[PATCH v3 2/9] kexec_file: Generalize kexec_add_buffer.

2016-06-21 Thread Thiago Jung Bauermann
Allow architectures to specify different memory walking functions for kexec_add_buffer. Intel uses iomem to track reserved memory ranges, but PowerPC uses the memblock subsystem. Signed-off-by: Thiago Jung Bauermann Cc: Eric Biederman Cc: Dave Young Cc: ke...@lists.infradead.org Cc: linux

[PATCH v3 4/9] powerpc: Factor out relocation code from module_64.c to elf_util_64.c.

2016-06-21 Thread Thiago Jung Bauermann
alled from elf64_apply_relocate_add. local_entry_offset and squash_toc_save_inst were only used by apply_rellocate_add, so they were moved to elf_util_64.c as well. Signed-off-by: Thiago Jung Bauermann Cc: Benjamin Herrenschmidt Cc: Paul Mackerras Cc: Michael Ellerman Cc: Torsten Duwe C

Re: [PATHC v2 0/9] ima: carry the measurement list across kexec

2016-09-26 Thread Thiago Jung Bauermann
Hello Eric, Am Dienstag, 20 September 2016, 11:07:29 schrieb Eric W. Biederman: > Thiago Jung Bauermann writes: > > Am Samstag, 17 September 2016, 00:17:37 schrieb Eric W. Biederman: > >> Thiago Jung Bauermann writes: > > Is this what you had in mind? > > Sort of.

Re: Kexec regression in next-20160906

2016-09-06 Thread Thiago Jung Bauermann
ARM, then. I verified that kexec_load kept working on ppc64le with a kexec binary compiled with the original struct kexec_segment definition, but apparently I got lucky. I'll prepare a new version of the kexec buffer hand-over series which doesn't touch struct kexec_segment. -- []'s Thiago Jung Bauermann IBM Linux Technology Center

Re: Kexec regression in next-20160906

2016-09-08 Thread Thiago Jung Bauermann
pth review of the change. No UAPI header is touched by this patch series. That is because there are two definitions of struct kexec_segment, one in include/linux/kexec.h and the other one in include/uapi/linux/kexec.h. My patch changed the former. I was unaware of the second definition in t

Re: [PATCH v4 0/5] kexec_file: Add buffer hand-over for the next kernel

2016-09-08 Thread Thiago Jung Bauermann
Am Mittwoch, 07 September 2016, 09:19:40 schrieb Eric W. Biederman: > ebied...@xmission.com (Eric W. Biederman) writes: > > Thiago Jung Bauermann writes: > >> Hello, > >> > >> The purpose of this new version of the series is to fix a small issue > &g

[PATCH v5 2/5] kexec_file: Add buffer hand-over support for the next kernel

2016-09-14 Thread Thiago Jung Bauermann
hiago Jung Bauermann --- include/linux/kexec.h | 31 +++ kernel/kexec_file.c | 68 +++ 2 files changed, 99 insertions(+) diff --git a/include/linux/kexec.h b/include/linux/kexec.h index 2a96292ee544..768245aa76bf 100644 --- a/in

[PATCH v5 5/5] IMA: Demonstration code for kexec buffer passing.

2016-09-14 Thread Thiago Jung Bauermann
This shows how kernel code can use the kexec buffer passing mechanism to pass information to the next kernel. This patch is not intended to be committed. [a...@linux-foundation.org: coding-style fixes] Signed-off-by: Thiago Jung Bauermann Signed-off-by: Andrew Morton Signed-off-by: Thiago

[PATCH v5 1/5] kexec_file: Include the purgatory segment in the kexec image checksum.

2016-09-14 Thread Thiago Jung Bauermann
e use CONFIG_ARCH_MODIFIES_KEXEC_PURGATORY to allow the powerpc purgatory to be protected by the checksum while still preserving x86 behavior. Signed-off-by: Thiago Jung Bauermann --- arch/powerpc/purgatory/purgatory.c | 4 +- arch/x86/Kconfig | 6 +++ arch/x86/purgatory/purgatory.c

[PATCH v5 4/5] kexec_file: Add mechanism to update kexec segments.

2016-09-14 Thread Thiago Jung Bauermann
is updated the checksum is recalculated and updated in the kexec image. Suggested-by: Mimi Zohar Signed-off-by: Thiago Jung Bauermann --- include/linux/kexec.h | 2 + kernel/kexec_core.c | 5 - kernel/kexec_file.c | 331 kernel

[PATCH v5 0/5] kexec_file: Add buffer hand-over for the next kernel

2016-09-14 Thread Thiago Jung Bauermann
Patch "kexec_file: Add mechanism to update kexec segments.": - Removed unnecessary "#include " in kexec_file.c. - Round up memsz argument to PAGE_SIZE. - Check if kexec_image is NULL in kexec_update_segment. - Patch "IMA: Demonstration code for kexec buffer passing." -

[PATCH v5 3/5] powerpc: kexec_file: Add buffer hand-over support for the next kernel

2016-09-14 Thread Thiago Jung Bauermann
The buffer hand-over mechanism allows the currently running kernel to pass data to kernel that will be kexec'd via a kexec segment. The second kernel can check whether the previous kernel sent data and retrieve it. This is the architecture-specific part. Signed-off-by: Thiago Jung Baue

Re: [PATCH v5 1/5] kexec_file: Include the purgatory segment in the kexec image checksum.

2016-09-14 Thread Thiago Jung Bauermann
ORY > > + bool > > + > > The above should probably be in arch/Kconfig (with an appropriately > changed comment) since it is used in generic code. Thanks for your quick response! I'll make that change tomorrow and send an updated version of just this patch. -- []'s Thiago Jung Bauermann IBM Linux Technology Center

Re: [PATCH v5 1/5] kexec_file: Include the purgatory segment in the kexec image checksum.

2016-09-15 Thread Thiago Jung Bauermann
ORY > > + bool > > + > > The above should probably be in arch/Kconfig (with an appropriately > changed comment) since it is used in generic code. Here is the new version, with that change. -- []'s Thiago Jung Bauermann IBM Linux Technology Center Subject: [PAT

Re: [PATCH] powerpc: Clean up tm_abort duplication in hash_utils_64.c

2016-09-01 Thread Thiago Jung Bauermann
ould be static. Also, since both places calling it are guarded by CONFIG_PPC_TRANSACTIONAL_MEM, wouldn't it be cleaner if the #ifdef was here instead and the #else block defined an empty static inline function? Then the call sites wouldn't need to be guarded. -- []'s Thiago Jung Bauermann IBM Linux Technology Center

Re: [PATCH v2 3/3] kexec: extend kexec_file_load system call

2016-08-05 Thread Thiago Jung Bauermann
Hi, Am Dienstag, 26 Juli 2016, 21:24:29 schrieb Thiago Jung Bauermann: > Notes: > This is a new version of the last patch in this series which adds > a function where each architecture can verify if the DTB is safe > to load: > > int __weak arch_kexec_

Re: [PATCH v5 04/13] powerpc: Factor out relocation code from module_64.c to elf_util_64.c.

2016-08-23 Thread Thiago Jung Bauermann
mitation, cc'ing him > > I don't think it's ever worked so I wouldn't worry too much about > supporting it. Fixing kexec-into-zImage and fixing the 32bit wrapper > on 64bit BE kernel problem has been on my TODO list for a while, but > it's not a priority. Ok, thanks for your input. -- []'s Thiago Jung Bauermann IBM Linux Technology Center

[PATCH] kexec: Fix double-free when failing to relocate the purgatory.

2016-08-25 Thread Thiago Jung Bauermann
to free a NULL pointer. Signed-off-by: Thiago Jung Bauermann --- kernel/kexec_file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 503bc2d348e5..037c321c5618 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -887,7 +887,10 @@ i

[PATCH v3 0/5] kexec_file: Add buffer hand-over for the next kernel

2016-08-25 Thread Thiago Jung Bauermann
heck if kexec_image is NULL in kexec_update_segment. - Patch "IMA: Demonstration code for kexec buffer passing." - Avoid registering reboot notifier again if kexec_file_load is called more than once. Thiago Jung Bauermann (5): kexec_file: Add buffer hand-over support for the next kernel

[PATCH v3 4/5] kexec_file: Add mechanism to update kexec segments.

2016-08-25 Thread Thiago Jung Bauermann
kexec_update_segment allows a given segment in kexec_image to have its contents updated. This is useful if the current kernel wants to send information to the next kernel that is up-to-date at the time of reboot. Signed-off-by: Thiago Jung Bauermann --- include/linux/kexec.h | 2 ++ kernel

[PATCH v3 3/5] kexec_file: Allow skipping checksum calculation for some segments.

2016-08-25 Thread Thiago Jung Bauermann
nated initializers. Therefore, there is no behavior change with this patch and all segments except the purgatory are checksummed. Signed-off-by: Thiago Jung Bauermann --- include/linux/kexec.h | 23 ++- kernel/kexec_file.c | 15 +++ 2 files changed, 21 insertions(+

[PATCH v3 1/5] kexec_file: Add buffer hand-over support for the next kernel

2016-08-25 Thread Thiago Jung Bauermann
hiago Jung Bauermann --- include/linux/kexec.h | 31 +++ kernel/kexec_file.c | 68 +++ 2 files changed, 99 insertions(+) diff --git a/include/linux/kexec.h b/include/linux/kexec.h index d419d0e51fe5..16561e96a6d7 100644 --- a/in

[PATCH v3 5/5] IMA: Demonstration code for kexec buffer passing.

2016-08-25 Thread Thiago Jung Bauermann
This shows how kernel code can use the kexec buffer passing mechanism to pass information to the next kernel. This patch is not intended to be committed. Signed-off-by: Thiago Jung Bauermann --- include/linux/ima.h | 11 + kernel/kexec_file.c | 4

Re: [PATCH v3 0/5] kexec_file: Add buffer hand-over for the next kernel

2016-08-25 Thread Thiago Jung Bauermann
ce the "ima: carry the > measurement list across kexec" series has stabilised, I should drop the > demo patch and also grab those? If so, pelase start cc'ing me. I'm not sure how Mimi is planning to upstream that series. -- []'s Thiago Jung Bauermann IBM Linux Technology Center

[PATCH v3 2/5] powerpc: kexec_file: Add buffer hand-over support for the next kernel

2016-08-25 Thread Thiago Jung Bauermann
The buffer hand-over mechanism allows the currently running kernel to pass data to kernel that will be kexec'd via a kexec segment. The second kernel can check whether the previous kernel sent data and retrieve it. This is the architecture-specific part. Signed-off-by: Thiago Jung Baue

[PATCH] powerpc: Only obtain cpu_hotplug_lock if called by rtasd

2017-06-20 Thread Thiago Jung Bauermann
://patchwork.ozlabs.org/patch/771293/ Signed-off-by: Thiago Jung Bauermann --- Notes: This patch applies on tip/smp/hotplug, it should probably be carried there. arch/powerpc/include/asm/topology.h | 6 ++ arch/powerpc/kernel/rtasd.c | 2 +- arch/powerpc/mm/numa.c | 22

Re: [PATCH v2 6/6] ima: Support module-style appended signatures for appraisal

2017-06-21 Thread Thiago Jung Bauermann
Hello Mimi, Thanks for your review, and for queuing the other patches in this series. Mimi Zohar writes: > On Wed, 2017-06-07 at 22:49 -0300, Thiago Jung Bauermann wrote: >> This patch introduces the modsig keyword to the IMA policy syntax to >> specify that a given hook should

Re: [PATCH] powerpc: Only obtain cpu_hotplug_lock if called by rtasd

2017-06-21 Thread Thiago Jung Bauermann
Michael Ellerman writes: > Thiago Jung Bauermann writes: > >> Calling arch_update_cpu_topology from a CPU hotplug state machine callback >> hits a deadlock because the function tries to get a read lock on >> cpu_hotplug_lock while the state machine still holds a write

[PATCH v5 17/18] ima: Implement support for module-style appended signatures

2017-10-17 Thread Thiago Jung Bauermann
This patch actually implements the appraise_type=modsig option, allowing IMA to read and verify modsig signatures Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima.h | 17 +++-- security/integrity/ima/ima_appraise.c | 119 -- security

[PATCH v5 12/18] MODSIGN: Export module signature definitions

2017-10-17 Thread Thiago Jung Bauermann
validate_module_signature without having to depend on CONFIG_MODULE_SIG. Signed-off-by: Thiago Jung Bauermann --- include/linux/module.h | 3 -- include/linux/module_signature.h | 47 + init/Kconfig | 6 +++- kernel/Makefile | 2 +- kernel

[PATCH v5 00/18] Appended signatures support for IMA appraisal

2017-10-17 Thread Thiago Jung Bauermann
g verification fails. - Pass NULL xattr_value to evm_verifyxattr even in the case of xattr signature in ima_appraise_measurement (suggested by Mimi Zohar). - Use switch statement provided by Mimi Zohar to check result of evm_verifyxattr. - If the modsig verification succeeds, copy the

[PATCH v5 15/18] ima: Add modsig appraise_type option for module-style appended signatures

2017-10-17 Thread Thiago Jung Bauermann
because the actual modsig implementation will be introduced in a separate patch. Suggested-by: Mimi Zohar Signed-off-by: Thiago Jung Bauermann --- Documentation/ABI/testing/ima_policy | 6 +- security/integrity/ima/Kconfig | 10 + security/integrity/ima/Makefile | 1

[PATCH v5 03/18] evm, ima: Remove superfluous parentheses

2017-10-17 Thread Thiago Jung Bauermann
that it can be easily dropped if the churn and conflict potential is deemed not worth it. Confirmed that the patch is correct by comparing the object files from before and after the patch. They are identical. Signed-off-by: Thiago Jung Bauermann --- security/integrity/evm/evm_crypto.c

[PATCH v5 07/18] integrity: Introduce struct evm_xattr

2017-10-17 Thread Thiago Jung Bauermann
, since in most places the array doesn't hold a digest. A separate struct evm_xattr is introduced, with the original definition of evm_ima_xattr_data to be used in the places that actually expect that definition. Signed-off-by: Thiago Jung Bauermann --- security/integrity/evm/evm_

[PATCH v5 11/18] ima: Export func_tokens

2017-10-17 Thread Thiago Jung Bauermann
ima_read_modsig will need it so that it can show an error message. Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima.h| 2 ++ security/integrity/ima/ima_policy.c | 12 ++-- 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/security/integrity/ima

[PATCH v5 08/18] integrity: Select CONFIG_KEYS instead of depending on it

2017-10-17 Thread Thiago Jung Bauermann
This avoids a dependency cycle in CONFIG_IMA_APPRAISE_MODSIG (introduced by a later patch in this series): it will select CONFIG_MODULE_SIG_FORMAT which in turn selects CONFIG_KEYS. Kconfig then complains that CONFIG_INTEGRITY_SIGNATURE depends on CONFIG_KEYS. Signed-off-by: Thiago Jung Bauermann

[PATCH v5 10/18] ima: Store measurement after appraisal

2017-10-17 Thread Thiago Jung Bauermann
then the measure step was already completed and would need to be done again in case the template includes the signature. To avoid this problem, do the appraisal first so that the correct signature is stored by the template in the measure step. Suggested-by: Mimi Zohar Signed-off-by: Thiago

[PATCH v5 18/18] ima: Write modsig to the measurement list

2017-10-17 Thread Thiago Jung Bauermann
Add modsig support for templates which require the contents of the file signature to be included in the measurement list. Suggested-by: Mimi Zohar Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima.h | 8 security/integrity/ima/ima_api.c | 8

[PATCH v5 01/18] ima: Remove redundant conditional operator

2017-10-17 Thread Thiago Jung Bauermann
correct by comparing the object file from before and after the patch. They are identical. Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima_appraise.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity

[PATCH v5 05/18] ima: Simplify ima_eventsig_init

2017-10-17 Thread Thiago Jung Bauermann
The "goto out" statement doesn't have any purpose since there's no cleanup to be done when returning early, so remove it. This also makes the rc variable unnecessary so remove it as well. Also, the xattr_len and fmt variables are redundant so remove them as well. Signed

[PATCH v5 16/18] ima: Add functions to read and verify a modsig signature

2017-10-17 Thread Thiago Jung Bauermann
This is the code needed by IMA-appraise to work with modsig signatures. It will be used by the next patch. Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/Kconfig | 3 + security/integrity/ima/ima.h| 34 +++ security/integrity/ima/ima_modsig.c | 119

[PATCH v5 14/18] integrity: Introduce integrity_keyring_from_id

2017-10-17 Thread Thiago Jung Bauermann
IMA will need to obtain the keyring used to verify file signatures so that it can verify the module-style signature appended to files. Signed-off-by: Thiago Jung Bauermann --- security/integrity/digsig.c| 28 +++- security/integrity/integrity.h | 1 + 2 files

[PATCH v5 13/18] PKCS#7: Introduce pkcs7_get_message_sig and verify_pkcs7_message_sig

2017-10-17 Thread Thiago Jung Bauermann
verify_pkcs7_message_signature which takes a struct pkcs7_message for verification instead of the raw bytes that verify_pkcs7_signature takes. Signed-off-by: Thiago Jung Bauermann --- certs/system_keyring.c| 60 +-- crypto/asymmetric_keys/pkcs7_parser.c | 12

[PATCH v5 06/18] ima: Improvements in ima_appraise_measurement

2017-10-17 Thread Thiago Jung Bauermann
Replace nested ifs in the EVM xattr verification logic with a switch statement, making the code easier to understand. Also, add comments to the if statements in the out section. Signed-off-by: Mimi Zohar Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima.h | 5

[PATCH v5 09/18] ima: Don't pass xattr value to EVM xattr verification.

2017-10-17 Thread Thiago Jung Bauermann
d not actually required, just don't do it. Suggested-by: Mimi Zohar Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima_appraise.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_apprai

[PATCH v5 02/18] ima: Remove some superfluous parentheses

2017-10-17 Thread Thiago Jung Bauermann
. Confirmed that the patch is correct by comparing the object files from before and after the patch. They are identical. Signed-off-by: Thiago Jung Bauermann --- security/integrity/ima/ima_appraise.c | 11 +-- security/integrity/ima/ima_template_lib.c | 2 +- 2 files changed, 6

[PATCH v5 04/18] evm, ima: Remove more superfluous parentheses

2017-10-17 Thread Thiago Jung Bauermann
object files from before and after the patch. They are identical. Signed-off-by: Thiago Jung Bauermann --- security/integrity/evm/evm_posix_acl.c | 8 security/integrity/ima/ima_fs.c| 6 +++--- security/integrity/ima/ima_queue.c | 6 +++--- 3 files changed, 10 insertions

Re: [PATCH v5 18/18] ima: Write modsig to the measurement list

2017-10-26 Thread Thiago Jung Bauermann
Hello Mimi, Thanks for your review. Mimi Zohar writes: > On Tue, 2017-10-17 at 22:53 -0200, Thiago Jung Bauermann wrote: > >> diff --git a/security/integrity/ima/ima_main.c >> b/security/integrity/ima/ima_main.c >> index 6a2d960fbd92..0d3390de7432 100644 >>

Re: [PATCH v5 12/18] MODSIGN: Export module signature definitions

2017-10-26 Thread Thiago Jung Bauermann
Mimi Zohar writes: > On Tue, 2017-10-17 at 22:53 -0200, Thiago Jung Bauermann wrote: >> IMA will use the module_signature format for append signatures, so export >> the relevant definitions and factor out the code which verifies that the >> appended signature trailer

[PATCH v2 3/4] userfaultfd: selftest: Skip test if a feature isn't supported

2018-08-03 Thread Thiago Jung Bauermann
ivery: UFFDIO_API: Invalid argument testing events (fork, remap, remove): userfaults: 160 # echo $? 0 While at it, also improve the error message of the ioctl(UFFDIO_API) call. Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c

[PATCH v2 4/4] userfaultfd: selftest: Cope if shmem doesn't support zeropage

2018-08-03 Thread Thiago Jung Bauermann
at feature. Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c | 36 +++- 1 file changed, 31 insertions(+), 5 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c index c8

[PATCH v2 1/4] userfaultfd: selftest: Fix checking of userfaultfd_open() result

2018-08-03 Thread Thiago Jung Bauermann
tfd anon 30 1 nr_pages: 480, nr_pages_per_cpu: 120 userfaultfd syscall not available in this kernel Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultf

[PATCH v2 0/4] userfaultfd: selftest: Improve behavior with older kernels

2018-08-03 Thread Thiago Jung Bauermann
e if shmem doesn't support zeropage" - Ignore lack of UFFDIO_ZEROPAGE in userfaultfd_events_test() and userfaultfd_stress(). - Make userfaultfd_zeropage_test() return KSFT_SKIP if UFFDIO_ZEROPAGE isn't supported. Thiago Jung Bauermann (4): userfaultfd: selftest: Fix checking of

[PATCH v2 2/4] userfaultfd: selftest: Skip test if userfaultfd() syscall not supported

2018-08-03 Thread Thiago Jung Bauermann
After: # ./userfaultfd shmem 10 10 nr_pages: 160, nr_pages_per_cpu: 40 userfaultfd syscall not available in this kernel: Function not implemented # echo $? 4 Suggested-by: Mike Rapoport Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c | 8 +--- 1 file ch

Re: [PATCH] selftests: kselftest: Remove outdated comment

2018-08-27 Thread Thiago Jung Bauermann
Shuah Khan writes: > On 07/24/2018 08:57 PM, Thiago Jung Bauermann wrote: >> Commit 3c07aaef6598 ("selftests: kselftest: change KSFT_SKIP=4 instead of >> KSFT_PASS") reverted commit 11867a77eb85 ("selftests: kselftest framework: >> change skip exit code to

Re: [PATCH v2 4/4] userfaultfd: selftest: Cope if shmem doesn't support zeropage

2018-08-27 Thread Thiago Jung Bauermann
Hello Mike, Mike Rapoport writes: > Hi, > > On Fri, Aug 03, 2018 at 07:00:46PM -0300, Thiago Jung Bauermann wrote: >> If userfaultfd runs on a system that doesn't support UFFDIO_ZEROPAGE for >> shared memory, it currently ends with error code 1 which

[PATCH v3 1/4] userfaultfd: selftest: Fix checking of userfaultfd_open() result

2018-08-28 Thread Thiago Jung Bauermann
tfd anon 30 1 nr_pages: 480, nr_pages_per_cpu: 120 userfaultfd syscall not available in this kernel Signed-off-by: Thiago Jung Bauermann Reviewed-by: Mike Rapoport --- tools/testing/selftests/vm/userfaultfd.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/to

[PATCH v3 4/4] userfaultfd: selftest: make supported range ioctl verification more robust

2018-08-28 Thread Thiago Jung Bauermann
memory areas. Signed-off-by: Mike Rapoport Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c | 63 +--- 1 file changed, 34 insertions(+), 29 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm

[PATCH v3 2/4] userfaultfd: selftest: Skip test if userfaultfd() syscall not supported

2018-08-28 Thread Thiago Jung Bauermann
After: # ./userfaultfd shmem 10 10 nr_pages: 160, nr_pages_per_cpu: 40 userfaultfd syscall not available in this kernel: Function not implemented # echo $? 4 Suggested-by: Mike Rapoport Signed-off-by: Thiago Jung Bauermann Acked-by: Mike Rapoport --- tools/testing/selftests/vm/userfaultfd.

[PATCH v3 3/4] userfaultfd: selftest: Skip test if a feature isn't supported

2018-08-28 Thread Thiago Jung Bauermann
ivery: UFFDIO_API: Invalid argument testing events (fork, remap, remove): userfaults: 160 # echo $? 0 While at it, also improve the error message of the ioctl(UFFDIO_API) call. Signed-off-by: Thiago Jung Bauermann Acked-by: Mike Rapoport --- tools/testing/selftests/vm/userfaultfd.c

[PATCH v3 0/4] userfaultfd: selftest: Improve behavior with older kernels

2018-08-28 Thread Thiago Jung Bauermann
oport (1): userfaultfd: selftest: make supported range ioctl verification more robust Thiago Jung Bauermann (3): userfaultfd: selftest: Fix checking of userfaultfd_open() result userfaultfd: selftest: Skip test if userfaultfd() syscall not supported userfaultfd: selftest: Skip te

Re: [PATCH] apparmor: remove unused label

2018-08-23 Thread Thiago Jung Bauermann
> return dfa; > > -fail: > aa_put_dfa(dfa); > return ERR_PTR(-EPROTO); > } Shouldn't the two lines after the label be removed as well? IIUC they're unreachable now. -- Thiago Jung Bauermann IBM Linux Technology Center

Re: [PATCH 1/3] userfaultfd: selftest: Fix checking of userfaultfd_open() result

2018-07-30 Thread Thiago Jung Bauermann
Hello Mike, Thanks for promptly reviewing the patches. Mike Rapoport writes: > Hi, > > On Tue, Jul 24, 2018 at 11:42:07PM -0300, Thiago Jung Bauermann wrote: >> If the userfaultfd test is run on a kernel with CONFIG_USERFAULTFD=n, it >> will report that the system call

Re: [PATCH 2/3] userfaultfd: selftest: Skip test if a feature isn't supported

2018-07-30 Thread Thiago Jung Bauermann
Mike Rapoport writes: > Hi, > > On Tue, Jul 24, 2018 at 11:42:08PM -0300, Thiago Jung Bauermann wrote: >> If userfaultfd runs on a system that doesn't support some feature it is >> trying to test, it currently ends with error code 1 which indicates >> test f

Re: [PATCH 3/3] userfaultfd: selftest: Report XFAIL if shmem doesn't support zeropage

2018-07-30 Thread Thiago Jung Bauermann
Mike Rapoport writes: > Hi, > > On Tue, Jul 24, 2018 at 11:42:09PM -0300, Thiago Jung Bauermann wrote: >> If userfaultfd runs on a system that doesn't support UFFDIO_ZEROPAGE for >> shared memory, it currently ends with error code 1 which indicates test >>

[PATCH 2/3] userfaultfd: selftest: Skip test if a feature isn't supported

2018-07-24 Thread Thiago Jung Bauermann
le at it, also improve the error message of the ioctl(UFFDIO_API) call. Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c | 41 ++-- 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultfd

[PATCH 3/3] userfaultfd: selftest: Report XFAIL if shmem doesn't support zeropage

2018-07-24 Thread Thiago Jung Bauermann
emory # echo $? 1 This is a real failure, but expected so signal that to the test harness: # ./userfaultfd shmem 10 10 nr_pages: 160, nr_pages_per_cpu: 80 bounces: 9, mode: rnd poll, UFFDIO_ZEROPAGE unsupported in shmem VMAs # echo $? 2 Signed-off-by: Thiago Jung Bauermann --- tools/te

[PATCH 0/3] userfaultfd: selftest: Improve behavior with older kernels

2018-07-24 Thread Thiago Jung Bauermann
Hello, A tester ran the upstream selftest on a distro kernel and sounded the alarm when it reported failures for features which aren't included in that kernel. This patch set improves the test behavior in that scenario. Thiago Jung Bauermann (3): userfaultfd: selftest: Fix checki

[PATCH 1/3] userfaultfd: selftest: Fix checking of userfaultfd_open() result

2018-07-24 Thread Thiago Jung Bauermann
tfd anon 30 1 nr_pages: 480, nr_pages_per_cpu: 120 userfaultfd syscall not available in this kernel Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/vm/userfaultfd.c | 8 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/testing/selftests/vm/userfaultf

[PATCH] selftests: kselftest: Remove outdated comment

2018-07-24 Thread Thiago Jung Bauermann
Commit 3c07aaef6598 ("selftests: kselftest: change KSFT_SKIP=4 instead of KSFT_PASS") reverted commit 11867a77eb85 ("selftests: kselftest framework: change skip exit code to 0") but missed removing the comment which that commit added, so do that now. Signed-off-by: T

[PATCH 0/2] Testcases for protection keys feature in powerpc/next

2018-01-25 Thread Thiago Jung Bauermann
ubmitting these tests separately from the one coming from x86 so here they are. Thiago Jung Bauermann (2): selftests/powerpc: Add ptrace tests for Protection Key registers selftests/powerpc: Add core file test for Protection Key registers tools/testing/selftests/powerpc/include/reg.h

[PATCH 2/2] selftests/powerpc: Add core file test for Protection Key registers

2018-01-25 Thread Thiago Jung Bauermann
This test verifies that the AMR, IAMR and UAMOR are being written to a process' core file. Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/powerpc/ptrace/Makefile| 5 +- tools/testing/selftests/powerpc/ptrace/core-pkey.c | 460 + 2 files changed

[PATCH 1/2] selftests/powerpc: Add ptrace tests for Protection Key registers

2018-01-25 Thread Thiago Jung Bauermann
This test exercises read and write access to the AMR, IAMR and UAMOR. Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/powerpc/include/reg.h | 1 + tools/testing/selftests/powerpc/ptrace/Makefile| 5 +- tools/testing/selftests/powerpc/ptrace/child.h | 130

Re: [PATCH v12 04/22] selftests/vm: typecast the pkey register

2018-03-26 Thread Thiago Jung Bauermann
- dprintf4("read_pkey_reg(line=%d) pkey_reg: %016lx shadow: %016lx\n", + dprintf4("read_pkey_reg(line=%d) pkey_reg: "PKEY_REG_FMT + " shadow: "PKEY_REG_FMT"\n", line, pkey_reg, shadow_pkey_reg); assert(pkey_reg == shadow_pkey_reg); -- Thiago Jung Bauermann IBM Linux Technology Center

Re: [PATCH v2] powerpc, pkey: make protection key 0 less special

2018-04-06 Thread Thiago Jung Bauermann
Ram Pai writes: > On Wed, Apr 04, 2018 at 06:41:01PM -0300, Thiago Jung Bauermann wrote: >> >> Hello Ram, >> >> Ram Pai writes: >> >> > Applications need the ability to associate an address-range with some >> > key and latter rever

Re: [PATCH v2 2/7] kexec_file,x86,powerpc: factor out kexec_file_ops functions

2018-03-13 Thread Thiago Jung Bauermann
gt; an architecture-defined kexec_file_ops array. So let's factor them out. >> >> Signed-off-by: AKASHI Takahiro >> Cc: Dave Young >> Cc: Vivek Goyal >> Cc: Baoquan He >> Cc: Michael Ellerman >> Cc: Thiago Jung Bauermann >> --- >> arch

Re: [PATCH] pseries/hotplug: Add more delay in pseries_cpu_die while waiting for rtas-stop

2018-12-06 Thread Thiago Jung Bauermann
loop in pseries_cpu_die() a bit fragile. I describe the race in the patch description. My solution to make the race less tight is to make the CPU driving the unplug to only start the busy loop only after the CPU being unplugged is in the CPU_STATE_OFFLINE state. At that point, we know that it ei

Re: [PATCH] pseries/hotplug: Add more delay in pseries_cpu_die while waiting for rtas-stop

2018-12-07 Thread Thiago Jung Bauermann
0003a4a84800 (unreliable) > [c61aba20] [c001e24c] __switch_to+0x2dc/0x430 > [c61aba80] [c0e5fb94] __schedule+0x3d4/0xa20 > [c61abb50] [c0e6022c] schedule+0x4c/0xc0 > [c61abb80] [c0e64ffc] schedule_timeout+0x1dc/0x4e0 > [c61abc80] [c01af40c] rcu_gp_kthread+0xc3c/0x11f0 > [c61abdb0] [c013c7c8] kthread+0x168/0x1b0 > [c61abe20] [c000b658] ret_from_kernel_thread+0x5c/0x64 I don't know what to make of CPU 72. :-) Perhaps it's the one making the other "rogue" RTAS call interfering with stop-self in CPU 105? It must be some RTAS call made with rtas_call_unlocked, because CPU 88 is holding the RTAS lock. -- Thiago Jung Bauermann IBM Linux Technology Center

[PATCH v2 2/2] selftests/powerpc: Add core file test for Protection Key registers

2018-05-24 Thread Thiago Jung Bauermann
This test verifies that the AMR, IAMR and UAMOR are being written to a process' core file. Signed-off-by: Thiago Jung Bauermann --- tools/testing/selftests/powerpc/ptrace/Makefile| 5 +- tools/testing/selftests/powerpc/ptrace/core-pkey.c | 461 + 2 files changed

  1   2   3   4   5   6   7   >