1. 24 Apr, 2023 40 commits
    • Linus Torvalds's avatar
      Merge tag 'nolibc.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu · 5d77652f
      Linus Torvalds authored
      Pull nolibc updates from Paul McKenney:
      
       - Add support for loongarch
      
       - Fix stack-protector issues
      
       - Support additional integral types and signal-related macros
      
       - Add support for stdin, stdout, and stderr
      
       - Add getuid() and geteuid()
      
       - Allow S_I* macros to be overridden by program
      
       - Defer to linux/fcntl.h and linux/stat.h to avoid duplicate
         definitions
      
       - Many improvements to the selftests
      
      * tag 'nolibc.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (22 commits)
        tools/nolibc: x86_64: add stackprotector support
        tools/nolibc: i386: add stackprotector support
        tools/nolibc: tests: add test for -fstack-protector
        tools/nolibc: tests: fold in no-stack-protector cflags
        tools/nolibc: add support for stack protector
        tools/nolibc: tests: constify test_names
        tools/nolibc: add helpers for wait() signal exits
        tools/nolibc: add definitions for standard fds
        selftests/nolibc: Adjust indentation for Makefile
        selftests/nolibc: Add support for LoongArch
        tools/nolibc: Add support for LoongArch
        tools/nolibc: Add statx() and make stat() rely on statx() if necessary
        tools/nolibc: Include linux/fcntl.h and remove duplicate code
        tools/nolibc: check for S_I* macros before defining them
        selftests/nolibc: skip the chroot_root and link_dir tests when not privileged
        tools/nolibc: add getuid() and geteuid()
        tools/nolibc: add tests for the integer limits in stdint.h
        tools/nolibc: enlarge column width of tests
        tools/nolibc: add integer types and integer limit macros
        tools/nolibc: add stdint.h
        ...
      5d77652f
    • Linus Torvalds's avatar
      Merge tag 'locktorture.2023.04.04a' of... · 4a4075ad
      Linus Torvalds authored
      Merge tag 'locktorture.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
      
      Pull locktorture updates from Paul McKenney:
       "This adds tests for nested locking and also adds support for testing
        raw spinlocks in PREEMPT_RT kernels"
      
      * tag 'locktorture.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
        locktorture: Add raw_spinlock* torture tests for PREEMPT_RT kernels
        locktorture: With nested locks, occasionally skip main lock
        locktorture: Add nested locking to rtmutex torture tests
        locktorture: Add nested locking to mutex torture tests
        locktorture: Add nested_[un]lock() hooks and nlocks parameter
      4a4075ad
    • Linus Torvalds's avatar
      Merge tag 'lkmm-scripting.2023.04.07a' of... · 60eb4507
      Linus Torvalds authored
      Merge tag 'lkmm-scripting.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
      
      Pull Linux Kernel Memory Model scripting updates from Paul McKenney:
       "This improves litmus-test documentation and improves the ability to do
        before/after tests on the https://github.com/paulmckrcu/litmus repo"
      
      * tag 'lkmm-scripting.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: (32 commits)
        tools/memory-model: Remove out-of-date SRCU documentation
        tools/memory-model: Document LKMM test procedure
        tools/memory-model: Use "grep -E" instead of "egrep"
        tools/memory-model: Use "-unroll 0" to keep --hw runs finite
        tools/memory-model: Make judgelitmus.sh handle scripted Result: tag
        tools/memory-model: Add data-race capabilities to judgelitmus.sh
        tools/memory-model: Add checktheselitmus.sh to run specified litmus tests
        tools/memory-model: Repair parseargs.sh header comment
        tools/memory-model:  Add "--" to parseargs.sh for additional arguments
        tools/memory-model: Make history-check scripts use mselect7
        tools/memory-model: Make checkghlitmus.sh use mselect7
        tools/memory-model: Fix scripting --jobs argument
        tools/memory-model: Implement --hw support for checkghlitmus.sh
        tools/memory-model: Add -v flag to jingle7 runs
        tools/memory-model: Make runlitmus.sh check for jingle errors
        tools/memory-model: Allow herd to deduce CPU type
        tools/memory-model: Keep assembly-language litmus tests
        tools/memory-model: Move from .AArch64.litmus.out to .litmus.AArch.out
        tools/memory-model: Make runlitmus.sh generate .litmus.out for --hw
        tools/memory-model: Split runlitmus.sh out of checklitmus.sh
        ...
      60eb4507
    • Linus Torvalds's avatar
      Merge tag 'lkmm.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu · 40603735
      Linus Torvalds authored
      Pull Linux Kernel Memory Model updates from Paul McKenney
       "This improves LKMM diagnostic messages, unifies handling of the
        ordering produced by unlock/lock pairs, adds support for the
        smp_mb__after_srcu_read_unlock() macro, removes redundant members from
        the to-r relation, brings SRCU read-side semantics into alignment with
        Linux-kernel SRCU, makes ppo a subrelation of po, and improves
        documentation"
      
      * tag 'lkmm.2023.04.07a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
        Documentation: litmus-tests: Correct spelling
        tools/memory-model: Add documentation about SRCU read-side critical sections
        tools/memory-model: Make ppo a subrelation of po
        tools/memory-model: Provide exact SRCU semantics
        tools/memory-model: Restrict to-r to read-read address dependency
        tools/memory-model: Add smp_mb__after_srcu_read_unlock()
        tools/memory-model: Unify UNLOCK+LOCK pairings to po-unlock-lock-po
        tools/memory-model: Update some warning labels
      40603735
    • Linus Torvalds's avatar
      Merge tag 'kcsan.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu · 022e3209
      Linus Torvalds authored
      Pull KCSAN updates from Paul McKenney:
       "Kernel concurrency sanitizer (KCSAN) updates for v6.4
      
        This fixes kernel-doc warnings and also updates instrumentation from
        READ_ONCE() to volatile in order to avoid unaligned load-acquire
        instructions on arm64 in kernels built with LTO"
      
      * tag 'kcsan.2023.04.04a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
        kcsan: Avoid READ_ONCE() in read_instrumented_memory()
        instrumented.h: Fix all kernel-doc format warnings
      022e3209
    • Linus Torvalds's avatar
      Merge tag 'tpmdd-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd · 1a0beef9
      Linus Torvalds authored
      Pull tpm updates from Jarkko Sakkinen:
      
       - The .machine keyring, used for Machine Owner Keys (MOK), acquired the
         ability to store only CA enforced keys, and put rest to the .platform
         keyring, thus separating the code signing keys from the keys that are
         used to sign certificates.
      
         This essentially unlocks the use of the .machine keyring as a trust
         anchor for IMA. It is an opt-in feature, meaning that the additional
         contraints won't brick anyone who does not care about them.
      
       - Enable interrupt based transactions with discrete TPM chips (tpm_tis).
      
         There was code for this existing but it never really worked so I
         consider this a new feature rather than a bug fix. Before the driver
         just fell back to the polling mode.
      
      Link: https://lore.kernel.org/linux-integrity/a93b6222-edda-d43c-f010-a59701f2aeef@gmx.de/
      Link: https://lore.kernel.org/linux-integrity/20230302164652.83571-1-eric.snowberg@oracle.com/
      
      * tag 'tpmdd-v6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: (29 commits)
        tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site
        tpm_tis: fix stall after iowrite*()s
        tpm/tpm_tis_synquacer: Convert to platform remove callback returning void
        tpm/tpm_tis: Convert to platform remove callback returning void
        tpm/tpm_ftpm_tee: Convert to platform remove callback returning void
        tpm: tpm_tis_spi: Mark ACPI and OF related data as maybe unused
        tpm: st33zp24: Mark ACPI and OF related data as maybe unused
        tpm, tpm_tis: Enable interrupt test
        tpm, tpm_tis: startup chip before testing for interrupts
        tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
        tpm, tpm_tis: Claim locality in interrupt handler
        tpm, tpm_tis: Request threaded interrupt handler
        tpm, tpm: Implement usage counter for locality
        tpm, tpm_tis: do not check for the active locality in interrupt handler
        tpm, tpm_tis: Move interrupt mask checks into own function
        tpm, tpm_tis: Only handle supported interrupts
        tpm, tpm_tis: Claim locality before writing interrupt registers
        tpm, tpm_tis: Do not skip reset of original interrupt vector
        tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
        tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
        ...
      1a0beef9
    • Linus Torvalds's avatar
      Merge tag 'Smack-for-6.4' of https://github.com/cschaufler/smack-next · dc7e22a3
      Linus Torvalds authored
      Pull smack updates from Casey Schaufler:
       "There are two changes, one small and one more substantial:
      
         - Remove of an unnecessary cast
      
         - The mount option processing introduced with the mount rework makes
           copies of mount option values. There is no good reason to make
           copies of Smack labels, as they are maintained on a list and never
           removed.
      
           The code now uses pointers to entries on the list, reducing
           processing time and memory use"
      
      * tag 'Smack-for-6.4' of https://github.com/cschaufler/smack-next:
        Smack: Improve mount process memory use
        smack_lsm: remove unnecessary type casting
      dc7e22a3
    • Linus Torvalds's avatar
      Merge tag 'landlock-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux · 62443646
      Linus Torvalds authored
      Pull landlock update from Mickaël Salaün:
       "Improve user space documentation"
      
      * tag 'landlock-6.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:
        landlock: Clarify documentation for the LANDLOCK_ACCESS_FS_REFER right
      62443646
    • Linus Torvalds's avatar
      Merge tag 'tomoyo-pr-20230424' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1 · 5af4b523
      Linus Torvalds authored
      Pull tomoyo update from Tetsuo Handa:
       "One cleanup patch from Vlastimil Babka"
      
      * tag 'tomoyo-pr-20230424' of git://git.osdn.net/gitroot/tomoyo/tomoyo-test1:
        tomoyo: replace tomoyo_round2() with kmalloc_size_roundup()
      5af4b523
    • Linus Torvalds's avatar
      Merge tag 'lsm-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm · 08e30833
      Linus Torvalds authored
      Pull lsm updates from Paul Moore:
      
       - Move the LSM hook comment blocks into security/security.c
      
         For many years the LSM hook comment blocks were located in a very odd
         place, include/linux/lsm_hooks.h, where they lived on their own,
         disconnected from both the function prototypes and definitions.
      
         In keeping with current kernel conventions, this moves all of these
         comment blocks to the top of the function definitions, transforming
         them into the kdoc format in the process. This should make it much
         easier to maintain these comments, which are the main source of LSM
         hook documentation.
      
         For the most part the comment contents were left as-is, although some
         glaring errors were corrected. Expect additional edits in the future
         as we slowly update and correct the comment blocks.
      
         This is the bulk of the diffstat.
      
       - Introduce LSM_ORDER_LAST
      
         Similar to how LSM_ORDER_FIRST is used to specify LSMs which should
         be ordered before "normal" LSMs, the LSM_ORDER_LAST is used to
         specify LSMs which should be ordered after "normal" LSMs.
      
         This is one of the prerequisites for transitioning IMA/EVM to a
         proper LSM.
      
       - Remove the security_old_inode_init_security() hook
      
         The security_old_inode_init_security() LSM hook only allows for a
         single xattr which is problematic both for LSM stacking and the
         IMA/EVM-as-a-LSM effort. This finishes the conversion over to the
         security_inode_init_security() hook and removes the single-xattr LSM
         hook.
      
       - Fix a reiserfs problem with security xattrs
      
         During the security_old_inode_init_security() removal work it became
         clear that reiserfs wasn't handling security xattrs properly so we
         fixed it.
      
      * tag 'lsm-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (32 commits)
        reiserfs: Add security prefix to xattr name in reiserfs_security_write()
        security: Remove security_old_inode_init_security()
        ocfs2: Switch to security_inode_init_security()
        reiserfs: Switch to security_inode_init_security()
        security: Remove integrity from the LSM list in Kconfig
        Revert "integrity: double check iint_cache was initialized"
        security: Introduce LSM_ORDER_LAST and set it for the integrity LSM
        device_cgroup: Fix typo in devcgroup_css_alloc description
        lsm: fix a badly named parameter in security_get_getsecurity()
        lsm: fix doc warnings in the LSM hook comments
        lsm: styling fixes to security/security.c
        lsm: move the remaining LSM hook comments to security/security.c
        lsm: move the io_uring hook comments to security/security.c
        lsm: move the perf hook comments to security/security.c
        lsm: move the bpf hook comments to security/security.c
        lsm: move the audit hook comments to security/security.c
        lsm: move the binder hook comments to security/security.c
        lsm: move the sysv hook comments to security/security.c
        lsm: move the key hook comments to security/security.c
        lsm: move the xfrm hook comments to security/security.c
        ...
      08e30833
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · 72eaa096
      Linus Torvalds authored
      Pull selinux updates from Paul Moore:
      
       - Stop passing the 'selinux_state' pointers as function arguments
      
         As discussed during the end of the last development cycle, passing a
         selinux_state pointer through the SELinux code has a noticeable
         impact on performance, and with the current code it is not strictly
         necessary.
      
         This simplifies things by referring directly to the single
         selinux_state global variable which should help improve SELinux
         performance.
      
       - Uninline the unlikely portions of avc_has_perm_noaudit()
      
         This change was also based on a discussion from the last development
         cycle, and is heavily based on an initial proof of concept patch from
         you. The core issue was that avc_has_perm_noaudit() was not able to
         be inlined, as intended, due to its size. We solved this issue by
         extracting the less frequently hit portions of avc_has_perm_noaudit()
         into a separate function, reducing the size of avc_has_perm_noaudit()
         to the point where the compiler began inlining the function. We also
         took the opportunity to clean up some ugly RCU locking in the code
         that became uglier with the change.
      
       - Remove the runtime disable functionality
      
         After several years of work by the userspace and distro folks, we are
         finally in a place where we feel comfortable removing the runtime
         disable functionality which we initially deprecated at the start of
         2020.
      
         There is plenty of information in the kernel's deprecation (now
         removal) notice, but the main motivation was to be able to safely
         mark the LSM hook structures as '__ro_after_init'.
      
         LWN also wrote a good summary of the deprecation this morning which
         offers a more detailed history:
      
              https://lwn.net/SubscriberLink/927463/dcfa0d4ed2872f03
      
       - Remove the checkreqprot functionality
      
         The original checkreqprot deprecation notice stated that the removal
         would happen no sooner than June 2021, which means this falls hard
         into the "better late than never" bucket.
      
         The Kconfig and deprecation notice has more detail on this setting,
         but the basic idea is that we want to ensure that the SELinux policy
         allows for the memory protections actually applied by the kernel, and
         not those requested by the process.
      
         While we haven't found anyone running a supported distro that is
         affected by this deprecation/removal, anyone who is affected would
         only need to update their policy to reflect the reality of their
         applications' mapping protections.
      
       - Minor Makefile improvements
      
         Some minor Makefile improvements to correct some dependency issues
         likely only ever seen by SELinux developers. I expect we will have at
         least one more tweak to the Makefile during the next merge window,
         but it didn't quite make the cutoff this time around.
      
      * tag 'selinux-pr-20230420' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: ensure av_permissions.h is built when needed
        selinux: fix Makefile dependencies of flask.h
        selinux: stop returning node from avc_insert()
        selinux: clean up dead code after removing runtime disable
        selinux: update the file list in MAINTAINERS
        selinux: remove the runtime disable functionality
        selinux: remove the 'checkreqprot' functionality
        selinux: stop passing selinux_state pointers and their offspring
        selinux: uninline unlikely parts of avc_has_perm_noaudit()
      72eaa096
    • Linus Torvalds's avatar
      Merge branch 'x86-rep-insns': x86 user copy clarifications · a5624566
      Linus Torvalds authored
      Merge my x86 user copy updates branch.
      
      This cleans up a lot of our x86 memory copy code, particularly for user
      accesses.  I've been pushing for microarchitectural support for good
      memory copying and clearing for a long while, and it's been visible in
      how the kernel has aggressively used 'rep movs' and 'rep stos' whenever
      possible.
      
      And that micro-architectural support has been improving over the years,
      to the point where on modern CPU's the best option for a memory copy
      that would become a function call (as opposed to being something that
      can just be turned into individual 'mov' instructions) is now to inline
      the string instruction sequence instead.
      
      However, that only makes sense when we have the modern markers for this:
      the x86 FSRM and FSRS capabilities ("Fast Short REP MOVS/STOS").
      
      So this cleans up a lot of our historical code, gets rid of the legacy
      marker use ("REP_GOOD" and "ERMS") from the memcpy/memset cases, and
      replaces it with that modern reality.  Note that REP_GOOD and ERMS end
      up still being used by the known large cases (ie page copyin gand
      clearing).
      
      The reason much of this ends up being about user memory accesses is that
      the normal in-kernel cases are done by the compiler (__builtin_memcpy()
      and __builtin_memset()) and getting to the point where we can use our
      instruction rewriting to inline those to be string instructions will
      need some compiler support.
      
      In contrast, the user accessor functions are all entirely controlled by
      the kernel code, so we can change those arbitrarily.
      
      Thanks to Borislav Petkov for feedback on the series, and Jens testing
      some of this on micro-architectures I didn't personally have access to.
      
      * x86-rep-insns:
        x86: rewrite '__copy_user_nocache' function
        x86: remove 'zerorest' argument from __copy_user_nocache()
        x86: set FSRS automatically on AMD CPUs that have FSRM
        x86: improve on the non-rep 'copy_user' function
        x86: improve on the non-rep 'clear_user' function
        x86: inline the 'rep movs' in user copies for the FSRM case
        x86: move stac/clac from user copy routines into callers
        x86: don't use REP_GOOD or ERMS for user memory clearing
        x86: don't use REP_GOOD or ERMS for user memory copies
        x86: don't use REP_GOOD or ERMS for small memory clearing
        x86: don't use REP_GOOD or ERMS for small memory copies
      a5624566
    • Linus Torvalds's avatar
      iov: improve copy_iovec_from_user() code generation · 487c20b0
      Linus Torvalds authored
      Use the same pattern as the compat version of this code does: instead of
      copying the whole array to a kernel buffer and then having a separate
      phase of verifying it, just do it one entry at a time, verifying as you
      go.
      
      On Jens' /dev/zero readv() test this improves performance by ~6%.
      
      [ This was obviously triggered by Jens' ITER_UBUF updates series ]
      Reported-and-tested-by: default avatarJens Axboe <axboe@kernel.dk>
      Link: https://lore.kernel.org/all/de35d11d-bce7-e976-7372-1f2caf417103@kernel.dk/Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      487c20b0
    • Linus Torvalds's avatar
      Merge tag 'iter-ubuf.2-2023-04-21' of git://git.kernel.dk/linux · b9dff219
      Linus Torvalds authored
      Pull ITER_UBUF updates from Jens Axboe:
       "This turns singe vector imports into ITER_UBUF, rather than
        ITER_IOVEC.
      
        The former is more trivial to iterate and advance, and hence a bit
        more efficient. From some very unscientific testing, ~60% of all iovec
        imports are single vector"
      
      * tag 'iter-ubuf.2-2023-04-21' of git://git.kernel.dk/linux:
        iov_iter: Mark copy_compat_iovec_from_user() noinline
        iov_iter: import single vector iovecs as ITER_UBUF
        iov_iter: convert import_single_range() to ITER_UBUF
        iov_iter: overlay struct iovec and ubuf/len
        iov_iter: set nr_segs = 1 for ITER_UBUF
        iov_iter: remove iov_iter_iovec()
        iov_iter: add iter_iov_addr() and iter_iov_len() helpers
        ALSA: pcm: check for user backed iterator, not specific iterator type
        IB/qib: check for user backed iterator, not specific iterator type
        IB/hfi1: check for user backed iterator, not specific iterator type
        iov_iter: add iter_iovec() helper
        block: ensure bio_alloc_map_data() deals with ITER_UBUF correctly
      b9dff219
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm · d88867a2
      Linus Torvalds authored
      Pull ARM development updates from Russell King:
       "Four changes for v6.4:
      
         - simplify the path to the top vmlinux
      
         - three patches to fix vfp with instrumentation enabled (eg lockdep)"
      
      * tag 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm:
        ARM: 9294/2: vfp: Fix broken softirq handling with instrumentation enabled
        ARM: 9293/1: vfp: Pass successful return address via register R3
        ARM: 9292/1: vfp: Pass thread_info pointer to vfp_support_entry
        ARM: 9291/1: decompressor: simplify the path to the top vmlinux
      d88867a2
    • Ruihan Li's avatar
      scripts: Remove ICC-related dead code · 1a261a6e
      Ruihan Li authored
      Intel compiler support has already been completely removed in commit
      95207db8 ("Remove Intel compiler support").  However, it appears
      that there is still some ICC-related code in scripts/cc-version.sh.
      There is no harm in leaving the code as it is, but removing the dead
      code makes the codebase a bit cleaner.
      
      Hopefully all ICC-related stuff in the build scripts will be removed
      after this commit, given the grep output as below:
      
      	(linux/scripts) $ grep -i -w -R 'icc'
      	cc-version.sh:ICC)
      	cc-version.sh:	min_version=$($min_tool_version icc)
      	dtc/include-prefixes/arm64/qcom/sm6350.dtsi:#include <dt-bindings/interconnect/qcom,icc.h>
      
      Fixes: 95207db8 ("Remove Intel compiler support")
      Signed-off-by: default avatarRuihan Li <lrh2000@pku.edu.cn>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Reviewed-by: default avatarNathan Chancellor <nathan@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1a261a6e
    • Jarkko Sakkinen's avatar
      tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site · bd8621ca
      Jarkko Sakkinen authored
      The following crash was reported:
      
      [ 1950.279393] list_del corruption, ffff99560d485790->next is NULL
      [ 1950.279400] ------------[ cut here ]------------
      [ 1950.279401] kernel BUG at lib/list_debug.c:49!
      [ 1950.279405] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
      [ 1950.279407] CPU: 11 PID: 5886 Comm: modprobe Tainted: G O 6.2.8_1 #1
      [ 1950.279409] Hardware name: Gigabyte Technology Co., Ltd. B550M AORUS PRO-P/B550M AORUS PRO-P,
      BIOS F15c 05/11/2022
      [ 1950.279410] RIP: 0010:__list_del_entry_valid+0x59/0xc0
      [ 1950.279415] Code: 48 8b 01 48 39 f8 75 5a 48 8b 72 08 48 39 c6 75 65 b8 01 00 00 00 c3 cc cc cc
      cc 48 89 fe 48 c7 c7 08 a8 13 9e e8 b7 0a bc ff <0f> 0b 48 89 fe 48 c7 c7 38 a8 13 9e e8 a6 0a bc
      ff 0f 0b 48 89 fe
      [ 1950.279416] RSP: 0018:ffffa96d05647e08 EFLAGS: 00010246
      [ 1950.279418] RAX: 0000000000000033 RBX: ffff99560d485750 RCX: 0000000000000000
      [ 1950.279419] RDX: 0000000000000000 RSI: ffffffff9e107c59 RDI: 00000000ffffffff
      [ 1950.279420] RBP: ffffffffc19c5168 R08: 0000000000000000 R09: ffffa96d05647cc8
      [ 1950.279421] R10: 0000000000000003 R11: ffffffff9ea2a568 R12: 0000000000000000
      [ 1950.279422] R13: ffff99560140a2e0 R14: ffff99560127d2e0 R15: 0000000000000000
      [ 1950.279422] FS: 00007f67da795380(0000) GS:ffff995d1f0c0000(0000) knlGS:0000000000000000
      [ 1950.279424] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      [ 1950.279424] CR2: 00007f67da7e65c0 CR3: 00000001feed2000 CR4: 0000000000750ee0
      [ 1950.279426] PKRU: 55555554
      [ 1950.279426] Call Trace:
      [ 1950.279428] <TASK>
      [ 1950.279430] hwrng_unregister+0x28/0xe0 [rng_core]
      [ 1950.279436] tpm_chip_unregister+0xd5/0xf0 [tpm]
      
      Add the forgotten !tpm_amd_is_rng_defective() invariant to the
      hwrng_unregister() call site inside tpm_chip_unregister().
      
      Cc: stable@vger.kernel.org
      Reported-by: default avatarMartin Dimov <martin@dmarto.com>
      Link: https://lore.kernel.org/linux-integrity/3d1d7e9dbfb8c96125bc93b6b58b90a7@dmarto.com/
      Fixes: f1324bbc ("tpm: disable hwrng for fTPM on some AMD designs")
      Fixes: b006c439 ("hwrng: core - start hwrng kthread also for untrusted sources")
      Tested-by: default avatarMartin Dimov <martin@dmarto.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      bd8621ca
    • Haris Okanovic's avatar
      tpm_tis: fix stall after iowrite*()s · 77218e83
      Haris Okanovic authored
      ioread8() operations to TPM MMIO addresses can stall the CPU when
      immediately following a sequence of iowrite*()'s to the same region.
      
      For example, cyclitest measures ~400us latency spikes when a non-RT
      usermode application communicates with an SPI-based TPM chip (Intel Atom
      E3940 system, PREEMPT_RT kernel). The spikes are caused by a
      stalling ioread8() operation following a sequence of 30+ iowrite8()s to
      the same address. I believe this happens because the write sequence is
      buffered (in CPU or somewhere along the bus), and gets flushed on the
      first LOAD instruction (ioread*()) that follows.
      
      The enclosed change appears to fix this issue: read the TPM chip's
      access register (status code) after every iowrite*() operation to
      amortize the cost of flushing data to chip across multiple instructions.
      Signed-off-by: default avatarHaris Okanovic <haris.okanovic@ni.com>
      Link: https://lore.kernel.org/r/20230323153436.B2SATnZV@linutronix.deSigned-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      77218e83
    • Uwe Kleine-König's avatar
      tpm/tpm_tis_synquacer: Convert to platform remove callback returning void · 7b69ef62
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is (mostly) ignored
      and this typically results in resource leaks. To improve here there is a
      quest to make the remove callback return void. In the first step of this
      quest all drivers are converted to .remove_new() which already returns
      void.
      
      Trivially convert this driver from always returning zero in the remove
      callback to the void returning variant.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      7b69ef62
    • Uwe Kleine-König's avatar
      tpm/tpm_tis: Convert to platform remove callback returning void · c3da2c6e
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is (mostly) ignored
      and this typically results in resource leaks. To improve here there is a
      quest to make the remove callback return void. In the first step of this
      quest all drivers are converted to .remove_new() which already returns
      void.
      
      Trivially convert this driver from always returning zero in the remove
      callback to the void returning variant.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      c3da2c6e
    • Uwe Kleine-König's avatar
      tpm/tpm_ftpm_tee: Convert to platform remove callback returning void · bd883286
      Uwe Kleine-König authored
      The .remove() callback for a platform driver returns an int which makes
      many driver authors wrongly assume it's possible to do error handling by
      returning an error code. However the value returned is (mostly) ignored
      and this typically results in resource leaks. To improve here there is a
      quest to make the remove callback return void. In the first step of this
      quest all drivers are converted to .remove_new() which already returns
      void.
      
      ftpm_tee_remove() returns zero unconditionally (and cannot easily
      converted to return void). So ignore the return value to be able to make
      ftpm_plat_tee_remove() return void.
      Signed-off-by: default avatarUwe Kleine-König <u.kleine-koenig@pengutronix.de>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      bd883286
    • Krzysztof Kozlowski's avatar
      tpm: tpm_tis_spi: Mark ACPI and OF related data as maybe unused · 3fb29a23
      Krzysztof Kozlowski authored
      The driver can be compile tested with !CONFIG_OF or !CONFIG_ACPI making
      unused:
      
        drivers/char/tpm/tpm_tis_spi_main.c:234:34: error: ‘of_tis_spi_match’ defined but not used [-Werror=unused-const-variable=]
      Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      3fb29a23
    • Krzysztof Kozlowski's avatar
      tpm: st33zp24: Mark ACPI and OF related data as maybe unused · c3985d8b
      Krzysztof Kozlowski authored
      The driver can be compile tested with !CONFIG_OF or !CONFIG_ACPI making
      
        drivers/char/tpm/st33zp24/i2c.c:141:34: error: ‘of_st33zp24_i2c_match’ defined but not used [-Werror=unused-const-variable=]
        drivers/char/tpm/st33zp24/spi.c:258:34: error: ‘of_st33zp24_spi_match’ defined but not used [-Werror=unused-const-variable=]
      Signed-off-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      c3985d8b
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Enable interrupt test · e644b2f4
      Lino Sanfilippo authored
      The test for interrupts in tpm_tis_send() is skipped if the flag
      TPM_CHIP_FLAG_IRQ is not set. Since the current code never sets the flag
      initially the test is never executed.
      
      Fix this by setting the flag in tpm_tis_gen_interrupt() right after
      interrupts have been enabled and before the test is executed.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      e644b2f4
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: startup chip before testing for interrupts · 548eb516
      Lino Sanfilippo authored
      In tpm_tis_gen_interrupt() a request for a property value is sent to the
      TPM to test if interrupts are generated. However after a power cycle the
      TPM responds with TPM_RC_INITIALIZE which indicates that the TPM is not
      yet properly initialized.
      Fix this by first starting the TPM up before the request is sent. For this
      the startup implementation is removed from tpm_chip_register() and put
      into the new function tpm_chip_startup() which is called before the
      interrupts are tested.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      548eb516
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Claim locality when interrupts are reenabled on resume · 955df4f8
      Lino Sanfilippo authored
      In tpm_tis_resume() make sure that the locality has been claimed when
      tpm_tis_reenable_interrupts() is called. Otherwise the writings to the
      register might not have any effect.
      
      Fixes: 45baa1d1 ("tpm_tis: Re-enable interrupts upon (S3) resume")
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      955df4f8
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Claim locality in interrupt handler · 0e069265
      Lino Sanfilippo authored
      Writing the TPM_INT_STATUS register in the interrupt handler to clear the
      interrupts only has effect if a locality is held. Since this is not
      guaranteed at the time the interrupt is fired, claim the locality
      explicitly in the handler.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      0e069265
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Request threaded interrupt handler · 0c7e66e5
      Lino Sanfilippo authored
      The TIS interrupt handler at least has to read and write the interrupt
      status register. In case of SPI both operations result in a call to
      tpm_tis_spi_transfer() which uses the bus_lock_mutex of the spi device
      and thus must only be called from a sleepable context.
      
      To ensure this request a threaded interrupt handler.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      0c7e66e5
    • Lino Sanfilippo's avatar
      tpm, tpm: Implement usage counter for locality · 7a2f55d0
      Lino Sanfilippo authored
      Implement a usage counter for the (default) locality used by the TPM TIS
      driver:
      Request the locality from the TPM if it has not been claimed yet, otherwise
      only increment the counter. Also release the locality if the counter is 0
      otherwise only decrement the counter. Since in case of SPI the register
      accesses are locked by means of the SPI bus mutex use a sleepable lock
      (i.e. also a mutex) to ensure thread-safety of the counter which may be
      accessed by both a userspace thread and the interrupt handler.
      
      By doing this refactor the names of the amended functions to use a more
      appropriate prefix.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      7a2f55d0
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: do not check for the active locality in interrupt handler · 35f62128
      Lino Sanfilippo authored
      After driver initialization tpm_tis_data->locality may only be modified in
      case of a LOCALITY CHANGE interrupt. In this case the interrupt handler
      iterates over all localities only to assign the active one to
      tpm_tis_data->locality.
      
      However this information is never used any more, so the assignment is not
      needed.
      Furthermore without the assignment tpm_tis_data->locality cannot change any
      more at driver runtime, and thus no protection against concurrent
      modification is required when the variable is read at other places.
      
      So remove this iteration entirely.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      35f62128
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Move interrupt mask checks into own function · 4303553b
      Lino Sanfilippo authored
      Clean up wait_for_tpm_stat() by moving multiple similar interrupt mask
      checks into an own function.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Suggested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      4303553b
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Only handle supported interrupts · e87fcf0d
      Lino Sanfilippo authored
      According to the TPM Interface Specification (TIS) support for "stsValid"
      and "commandReady" interrupts is only optional.
      This has to be taken into account when handling the interrupts in functions
      like wait_for_tpm_stat(). To determine the supported interrupts use the
      capability query.
      
      Also adjust wait_for_tpm_stat() to only wait for interrupt reported status
      changes. After that process all the remaining status changes by polling
      the status register.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      e87fcf0d
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Claim locality before writing interrupt registers · 15d7aa4e
      Lino Sanfilippo authored
      In tpm_tis_probe_single_irq() interrupt registers TPM_INT_VECTOR,
      TPM_INT_STATUS and TPM_INT_ENABLE are modified to setup the interrupts.
      Currently these modifications are done without holding a locality thus they
      have no effect. Fix this by claiming the (default) locality before the
      registers are written.
      
      Since now tpm_tis_gen_interrupt() is called with the locality already
      claimed remove locality request and release from this function.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      15d7aa4e
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Do not skip reset of original interrupt vector · ed9be0e6
      Lino Sanfilippo authored
      If in tpm_tis_probe_irq_single() an error occurs after the original
      interrupt vector has been read, restore the interrupts before the error is
      returned.
      
      Since the caller does not check the error value, return -1 in any case that
      the TPM_CHIP_FLAG_IRQ flag is not set. Since the return value of function
      tpm_tis_gen_interrupt() is not longer used, make it a void function.
      
      Fixes: 1107d065 ("tpm_tis: Introduce intermediate layer for TPM access")
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      ed9be0e6
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed · 6d789ad7
      Lino Sanfilippo authored
      Both functions tpm_tis_probe_irq_single() and tpm_tis_probe_irq() may setup
      the interrupts and then return with an error. This case is indicated by a
      missing TPM_CHIP_FLAG_IRQ flag in chip->flags.
      Currently the interrupt setup is only undone if tpm_tis_probe_irq_single()
      fails. Undo the setup also if tpm_tis_probe_irq() fails.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      6d789ad7
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register · 282657a8
      Lino Sanfilippo authored
      In disable_interrupts() the TPM_GLOBAL_INT_ENABLE bit is unset in the
      TPM_INT_ENABLE register to shut the interrupts off. However modifying the
      register is only possible with a held locality. So claim the locality
      before disable_interrupts() is called.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      282657a8
    • Lino Sanfilippo's avatar
      tpm, tpm_tis: Avoid cache incoherency in test for interrupts · 858e8b79
      Lino Sanfilippo authored
      The interrupt handler that sets the boolean variable irq_tested may run on
      another CPU as the thread that checks irq_tested as part of the irq test in
      tpm_tis_send().
      
      Since nothing guarantees cache coherency between CPUs for unsynchronized
      accesses to boolean variables the testing thread might not perceive the
      value change done in the interrupt handler.
      
      Avoid this issue by setting the bit TPM_TIS_IRQ_TESTED in the flags field
      of the tpm_tis_data struct and by accessing this field with the bit
      manipulating functions that provide cache coherency.
      
      Also convert all other existing sites to use the proper macros when
      accessing this bitfield.
      Signed-off-by: default avatarLino Sanfilippo <l.sanfilippo@kunbus.com>
      Tested-by: default avatarMichael Niewöhner <linux@mniewoehner.de>
      Tested-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      858e8b79
    • Eric Snowberg's avatar
      integrity: machine keyring CA configuration · 099f26f2
      Eric Snowberg authored
      Add machine keyring CA restriction options to control the type of
      keys that may be added to it. The motivation is separation of
      certificate signing from code signing keys. Subsquent work will
      limit certificates being loaded into the IMA keyring to code
      signing keys used for signature verification.
      
      When no restrictions are selected, all Machine Owner Keys (MOK) are added
      to the machine keyring.  When CONFIG_INTEGRITY_CA_MACHINE_KEYRING is
      selected, the CA bit must be true.  Also the key usage must contain
      keyCertSign, any other usage field may be set as well.
      
      When CONFIG_INTEGRITY_CA_MACHINE_KEYRING_MAX is selected, the CA bit must
      be true. Also the key usage must contain keyCertSign and the
      digitialSignature usage may not be set.
      Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
      Acked-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Tested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      099f26f2
    • Eric Snowberg's avatar
      KEYS: CA link restriction · 76adb2fb
      Eric Snowberg authored
      Add a new link restriction.  Restrict the addition of keys in a keyring
      based on the key to be added being a CA.
      Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
      Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Tested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      76adb2fb
    • Eric Snowberg's avatar
      KEYS: X.509: Parse Key Usage · 56767128
      Eric Snowberg authored
      Parse the X.509 Key Usage.  The key usage extension defines the purpose of
      the key contained in the certificate.
      
         id-ce-keyUsage OBJECT IDENTIFIER ::=  { id-ce 15 }
      
            KeyUsage ::= BIT STRING {
                 digitalSignature        (0),
                 contentCommitment       (1),
                 keyEncipherment         (2),
                 dataEncipherment        (3),
                 keyAgreement            (4),
                 keyCertSign             (5),
                 cRLSign                 (6),
                 encipherOnly            (7),
                 decipherOnly            (8) }
      
      If the keyCertSign or digitalSignature is set, store it in the
      public_key structure. Having the purpose of the key being stored
      during parsing, allows enforcement on the usage field in the future.
      This will be used in a follow on patch that requires knowing the
      certificate key usage type.
      
      Link: https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.3Signed-off-by: default avatarEric Snowberg <eric.snowberg@oracle.com>
      Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      Tested-by: default avatarMimi Zohar <zohar@linux.ibm.com>
      Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
      56767128