• Linus Torvalds's avatar
    Merge tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs · 291b38a7
    Linus Torvalds authored
    Pull hw lockdown support from David Howells:
     "Annotation of module parameters that configure hardware resources
      including ioports, iomem addresses, irq lines and dma channels.
    
      This allows a future patch to prohibit the use of such module
      parameters to prevent that hardware from being abused to gain access
      to the running kernel image as part of locking the kernel down under
      UEFI secure boot conditions.
    
      Annotations are made by changing:
    
            module_param(n, t, p)
            module_param_named(n, v, t, p)
            module_param_array(n, t, m, p)
    
      to:
    
            module_param_hw(n, t, hwtype, p)
            module_param_hw_named(n, v, t, hwtype, p)
            module_param_hw_array(n, t, hwtype, m, p)
    
      where the module parameter refers to a hardware setting
    
      hwtype specifies the type of the resource being configured. This can
      be one of:
    
            ioport          Module parameter configures an I/O port
            iomem           Module parameter configures an I/O mem address
            ioport_or_iomem Module parameter could be either (runtime set)
            irq             Module parameter configures an I/O port
            dma             Module parameter configures a DMA channel
            dma_addr        Module parameter configures a DMA buffer address
            other           Module parameter configures some other value
    
      Note that the hwtype is compile checked, but not currently stored (the
      lockdown code probably won't require it). It is, however, there for
      future use.
    
      A bonus is that the hwtype can also be used for grepping.
    
      The intention is for the kernel to ignore or reject attempts to set
      annotated module parameters if lockdown is enabled. This applies to
      options passed on the boot command line, passed to insmod/modprobe or
      direct twiddling in /sys/module/ parameter files.
    
      The module initialisation then needs to handle the parameter not being
      set, by (1) giving an error, (2) probing for a value or (3) using a
      reasonable default.
    
      What I can't do is just reject a module out of hand because it may
      take a hardware setting in the module parameters. Some important
      modules, some ipmi stuff for instance, both probe for hardware and
      allow hardware to be manually specified; if the driver is aborts with
      any error, you don't get any ipmi hardware.
    
      Further, trying to do this entirely in the module initialisation code
      doesn't protect against sysfs twiddling.
    
      [!] Note that in and of itself, this series of patches should have no
          effect on the the size of the kernel or code execution - that is
          left to a patch in the next series to effect. It does mark
          annotated kernel parameters with a KERNEL_PARAM_FL_HWPARAM flag in
          an already existing field"
    
    * tag 'hwparam-20170420' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs: (38 commits)
      Annotate hardware config module parameters in sound/pci/
      Annotate hardware config module parameters in sound/oss/
      Annotate hardware config module parameters in sound/isa/
      Annotate hardware config module parameters in sound/drivers/
      Annotate hardware config module parameters in fs/pstore/
      Annotate hardware config module parameters in drivers/watchdog/
      Annotate hardware config module parameters in drivers/video/
      Annotate hardware config module parameters in drivers/tty/
      Annotate hardware config module parameters in drivers/staging/vme/
      Annotate hardware config module parameters in drivers/staging/speakup/
      Annotate hardware config module parameters in drivers/staging/media/
      Annotate hardware config module parameters in drivers/scsi/
      Annotate hardware config module parameters in drivers/pcmcia/
      Annotate hardware config module parameters in drivers/pci/hotplug/
      Annotate hardware config module parameters in drivers/parport/
      Annotate hardware config module parameters in drivers/net/wireless/
      Annotate hardware config module parameters in drivers/net/wan/
      Annotate hardware config module parameters in drivers/net/irda/
      Annotate hardware config module parameters in drivers/net/hamradio/
      Annotate hardware config module parameters in drivers/net/ethernet/
      ...
    291b38a7
Name
Last commit
Last update
..
Kconfig Loading commit data...
Makefile Loading commit data...
ftrace.c Loading commit data...
inode.c Loading commit data...
internal.h Loading commit data...
platform.c Loading commit data...
pmsg.c Loading commit data...
ram.c Loading commit data...
ram_core.c Loading commit data...