You've already forked linux-apfs
mirror of
https://github.com/linux-apfs/linux-apfs.git
synced 2026-05-01 15:00:59 -07:00
Merge branch 'common/pinctrl' into sh-latest
This commit is contained in:
@@ -111,6 +111,7 @@ Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
|
||||
Uwe Kleine-König <ukl@pengutronix.de>
|
||||
Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
|
||||
Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
|
||||
Viresh Kumar <viresh.linux@gmail.com> <viresh.kumar@st.com>
|
||||
Takashi YOSHII <takashi.yoshii.zj@renesas.com>
|
||||
Yusuke Goda <goda.yusuke@renesas.com>
|
||||
Gustavo Padovan <gustavo@las.ic.unicamp.br>
|
||||
|
||||
@@ -1,26 +1,5 @@
|
||||
What: /sys/block/rssd*/registers
|
||||
Date: March 2012
|
||||
KernelVersion: 3.3
|
||||
Contact: Asai Thambi S P <asamymuthupa@micron.com>
|
||||
Description: This is a read-only file. Dumps below driver information and
|
||||
hardware registers.
|
||||
- S ACTive
|
||||
- Command Issue
|
||||
- Completed
|
||||
- PORT IRQ STAT
|
||||
- HOST IRQ STAT
|
||||
- Allocated
|
||||
- Commands in Q
|
||||
|
||||
What: /sys/block/rssd*/status
|
||||
Date: April 2012
|
||||
KernelVersion: 3.4
|
||||
Contact: Asai Thambi S P <asamymuthupa@micron.com>
|
||||
Description: This is a read-only file. Indicates the status of the device.
|
||||
|
||||
What: /sys/block/rssd*/flags
|
||||
Date: May 2012
|
||||
KernelVersion: 3.5
|
||||
Contact: Asai Thambi S P <asamymuthupa@micron.com>
|
||||
Description: This is a read-only file. Dumps the flags in port and driver
|
||||
data structure
|
||||
|
||||
@@ -219,6 +219,7 @@ What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/in_voltageY_supply_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/in_voltage_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/in_accel_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/in_accel_peak_scale
|
||||
What: /sys/bus/iio/devices/iio:deviceX/in_anglvel_scale
|
||||
@@ -273,6 +274,7 @@ What: /sys/bus/iio/devices/iio:deviceX/in_accel_scale_available
|
||||
What: /sys/.../iio:deviceX/in_voltageX_scale_available
|
||||
What: /sys/.../iio:deviceX/in_voltage-voltage_scale_available
|
||||
What: /sys/.../iio:deviceX/out_voltageX_scale_available
|
||||
What: /sys/.../iio:deviceX/out_altvoltageX_scale_available
|
||||
What: /sys/.../iio:deviceX/in_capacitance_scale_available
|
||||
KernelVersion: 2.635
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
@@ -298,14 +300,19 @@ Description:
|
||||
gives the 3dB frequency of the filter in Hz.
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_raw
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_raw
|
||||
KernelVersion: 2.6.37
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
Raw (unscaled, no bias etc.) output voltage for
|
||||
channel Y. The number must always be specified and
|
||||
unique if the output corresponds to a single channel.
|
||||
While DAC like devices typically use out_voltage,
|
||||
a continuous frequency generating device, such as
|
||||
a DDS or PLL should use out_altvoltage.
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY&Z_raw
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY&Z_raw
|
||||
KernelVersion: 2.6.37
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
@@ -316,6 +323,8 @@ Description:
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_powerdown_mode
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltage_powerdown_mode
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_powerdown_mode
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltage_powerdown_mode
|
||||
KernelVersion: 2.6.38
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
@@ -330,6 +339,8 @@ Description:
|
||||
|
||||
What: /sys/.../iio:deviceX/out_votlageY_powerdown_mode_available
|
||||
What: /sys/.../iio:deviceX/out_voltage_powerdown_mode_available
|
||||
What: /sys/.../iio:deviceX/out_altvotlageY_powerdown_mode_available
|
||||
What: /sys/.../iio:deviceX/out_altvoltage_powerdown_mode_available
|
||||
KernelVersion: 2.6.38
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
@@ -338,6 +349,8 @@ Description:
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltageY_powerdown
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_voltage_powerdown
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_powerdown
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltage_powerdown
|
||||
KernelVersion: 2.6.38
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
@@ -346,6 +359,24 @@ Description:
|
||||
normal operation. Y may be suppressed if all outputs are
|
||||
controlled together.
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_frequency
|
||||
KernelVersion: 3.4.0
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
Output frequency for channel Y in Hz. The number must always be
|
||||
specified and unique if the output corresponds to a single
|
||||
channel.
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/out_altvoltageY_phase
|
||||
KernelVersion: 3.4.0
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
Description:
|
||||
Phase in radians of one frequency/clock output Y
|
||||
(out_altvoltageY) relative to another frequency/clock output
|
||||
(out_altvoltageZ) of the device X. The number must always be
|
||||
specified and unique if the output corresponds to a single
|
||||
channel.
|
||||
|
||||
What: /sys/bus/iio/devices/iio:deviceX/events
|
||||
KernelVersion: 2.6.35
|
||||
Contact: linux-iio@vger.kernel.org
|
||||
|
||||
@@ -986,13 +986,13 @@ http://www.thedirks.org/winnov/</ulink></para></entry>
|
||||
<row id="V4L2-PIX-FMT-Y4">
|
||||
<entry><constant>V4L2_PIX_FMT_Y4</constant></entry>
|
||||
<entry>'Y04 '</entry>
|
||||
<entry>Old 4-bit greyscale format. Only the least significant 4 bits of each byte are used,
|
||||
<entry>Old 4-bit greyscale format. Only the most significant 4 bits of each byte are used,
|
||||
the other bits are set to 0.</entry>
|
||||
</row>
|
||||
<row id="V4L2-PIX-FMT-Y6">
|
||||
<entry><constant>V4L2_PIX_FMT_Y6</constant></entry>
|
||||
<entry>'Y06 '</entry>
|
||||
<entry>Old 6-bit greyscale format. Only the least significant 6 bits of each byte are used,
|
||||
<entry>Old 6-bit greyscale format. Only the most significant 6 bits of each byte are used,
|
||||
the other bits are set to 0.</entry>
|
||||
</row>
|
||||
</tbody>
|
||||
|
||||
@@ -560,6 +560,7 @@ and discussions on the V4L mailing list.</revremark>
|
||||
&sub-g-tuner;
|
||||
&sub-log-status;
|
||||
&sub-overlay;
|
||||
&sub-prepare-buf;
|
||||
&sub-qbuf;
|
||||
&sub-querybuf;
|
||||
&sub-querycap;
|
||||
@@ -567,7 +568,6 @@ and discussions on the V4L mailing list.</revremark>
|
||||
&sub-query-dv-preset;
|
||||
&sub-query-dv-timings;
|
||||
&sub-querystd;
|
||||
&sub-prepare-buf;
|
||||
&sub-reqbufs;
|
||||
&sub-s-hw-freq-seek;
|
||||
&sub-streamon;
|
||||
|
||||
@@ -108,10 +108,9 @@ information.</para>
|
||||
/></entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>__u32</entry>
|
||||
<entry>struct v4l2_format</entry>
|
||||
<entry><structfield>format</structfield></entry>
|
||||
<entry>Filled in by the application, preserved by the driver.
|
||||
See <xref linkend="v4l2-format" />.</entry>
|
||||
<entry>Filled in by the application, preserved by the driver.</entry>
|
||||
</row>
|
||||
<row>
|
||||
<entry>__u32</entry>
|
||||
|
||||
@@ -89,7 +89,7 @@
|
||||
<row>
|
||||
<entry></entry>
|
||||
<entry>&v4l2-event-frame-sync;</entry>
|
||||
<entry><structfield>frame</structfield></entry>
|
||||
<entry><structfield>frame_sync</structfield></entry>
|
||||
<entry>Event data for event V4L2_EVENT_FRAME_SYNC.</entry>
|
||||
</row>
|
||||
<row>
|
||||
|
||||
@@ -60,4 +60,4 @@ Introduction
|
||||
Document Author
|
||||
---------------
|
||||
|
||||
Viresh Kumar <viresh.kumar@st.com>, (c) 2010-2012 ST Microelectronics
|
||||
Viresh Kumar <viresh.linux@gmail.com>, (c) 2010-2012 ST Microelectronics
|
||||
|
||||
@@ -7,39 +7,39 @@ This target is read-only.
|
||||
|
||||
Construction Parameters
|
||||
=======================
|
||||
<version> <dev> <hash_dev> <hash_start>
|
||||
<version> <dev> <hash_dev>
|
||||
<data_block_size> <hash_block_size>
|
||||
<num_data_blocks> <hash_start_block>
|
||||
<algorithm> <digest> <salt>
|
||||
|
||||
<version>
|
||||
This is the version number of the on-disk format.
|
||||
This is the type of the on-disk hash format.
|
||||
|
||||
0 is the original format used in the Chromium OS.
|
||||
The salt is appended when hashing, digests are stored continuously and
|
||||
the rest of the block is padded with zeros.
|
||||
The salt is appended when hashing, digests are stored continuously and
|
||||
the rest of the block is padded with zeros.
|
||||
|
||||
1 is the current format that should be used for new devices.
|
||||
The salt is prepended when hashing and each digest is
|
||||
padded with zeros to the power of two.
|
||||
The salt is prepended when hashing and each digest is
|
||||
padded with zeros to the power of two.
|
||||
|
||||
<dev>
|
||||
This is the device containing the data the integrity of which needs to be
|
||||
This is the device containing data, the integrity of which needs to be
|
||||
checked. It may be specified as a path, like /dev/sdaX, or a device number,
|
||||
<major>:<minor>.
|
||||
|
||||
<hash_dev>
|
||||
This is the device that that supplies the hash tree data. It may be
|
||||
This is the device that supplies the hash tree data. It may be
|
||||
specified similarly to the device path and may be the same device. If the
|
||||
same device is used, the hash_start should be outside of the dm-verity
|
||||
configured device size.
|
||||
same device is used, the hash_start should be outside the configured
|
||||
dm-verity device.
|
||||
|
||||
<data_block_size>
|
||||
The block size on a data device. Each block corresponds to one digest on
|
||||
the hash device.
|
||||
The block size on a data device in bytes.
|
||||
Each block corresponds to one digest on the hash device.
|
||||
|
||||
<hash_block_size>
|
||||
The size of a hash block.
|
||||
The size of a hash block in bytes.
|
||||
|
||||
<num_data_blocks>
|
||||
The number of data blocks on the data device. Additional blocks are
|
||||
@@ -65,7 +65,7 @@ Construction Parameters
|
||||
Theory of operation
|
||||
===================
|
||||
|
||||
dm-verity is meant to be setup as part of a verified boot path. This
|
||||
dm-verity is meant to be set up as part of a verified boot path. This
|
||||
may be anything ranging from a boot using tboot or trustedgrub to just
|
||||
booting from a known-good device (like a USB drive or CD).
|
||||
|
||||
@@ -73,20 +73,20 @@ When a dm-verity device is configured, it is expected that the caller
|
||||
has been authenticated in some way (cryptographic signatures, etc).
|
||||
After instantiation, all hashes will be verified on-demand during
|
||||
disk access. If they cannot be verified up to the root node of the
|
||||
tree, the root hash, then the I/O will fail. This should identify
|
||||
tree, the root hash, then the I/O will fail. This should detect
|
||||
tampering with any data on the device and the hash data.
|
||||
|
||||
Cryptographic hashes are used to assert the integrity of the device on a
|
||||
per-block basis. This allows for a lightweight hash computation on first read
|
||||
into the page cache. Block hashes are stored linearly-aligned to the nearest
|
||||
block the size of a page.
|
||||
per-block basis. This allows for a lightweight hash computation on first read
|
||||
into the page cache. Block hashes are stored linearly, aligned to the nearest
|
||||
block size.
|
||||
|
||||
Hash Tree
|
||||
---------
|
||||
|
||||
Each node in the tree is a cryptographic hash. If it is a leaf node, the hash
|
||||
is of some block data on disk. If it is an intermediary node, then the hash is
|
||||
of a number of child nodes.
|
||||
of some data block on disk is calculated. If it is an intermediary node,
|
||||
the hash of a number of child nodes is calculated.
|
||||
|
||||
Each entry in the tree is a collection of neighboring nodes that fit in one
|
||||
block. The number is determined based on block_size and the size of the
|
||||
@@ -110,63 +110,23 @@ alg = sha256, num_blocks = 32768, block_size = 4096
|
||||
On-disk format
|
||||
==============
|
||||
|
||||
Below is the recommended on-disk format. The verity kernel code does not
|
||||
read the on-disk header. It only reads the hash blocks which directly
|
||||
follow the header. It is expected that a user-space tool will verify the
|
||||
integrity of the verity_header and then call dmsetup with the correct
|
||||
parameters. Alternatively, the header can be omitted and the dmsetup
|
||||
parameters can be passed via the kernel command-line in a rooted chain
|
||||
of trust where the command-line is verified.
|
||||
The verity kernel code does not read the verity metadata on-disk header.
|
||||
It only reads the hash blocks which directly follow the header.
|
||||
It is expected that a user-space tool will verify the integrity of the
|
||||
verity header.
|
||||
|
||||
The on-disk format is especially useful in cases where the hash blocks
|
||||
are on a separate partition. The magic number allows easy identification
|
||||
of the partition contents. Alternatively, the hash blocks can be stored
|
||||
in the same partition as the data to be verified. In such a configuration
|
||||
the filesystem on the partition would be sized a little smaller than
|
||||
the full-partition, leaving room for the hash blocks.
|
||||
|
||||
struct superblock {
|
||||
uint8_t signature[8]
|
||||
"verity\0\0";
|
||||
|
||||
uint8_t version;
|
||||
1 - current format
|
||||
|
||||
uint8_t data_block_bits;
|
||||
log2(data block size)
|
||||
|
||||
uint8_t hash_block_bits;
|
||||
log2(hash block size)
|
||||
|
||||
uint8_t pad1[1];
|
||||
zero padding
|
||||
|
||||
uint16_t salt_size;
|
||||
big-endian salt size
|
||||
|
||||
uint8_t pad2[2];
|
||||
zero padding
|
||||
|
||||
uint32_t data_blocks_hi;
|
||||
big-endian high 32 bits of the 64-bit number of data blocks
|
||||
|
||||
uint32_t data_blocks_lo;
|
||||
big-endian low 32 bits of the 64-bit number of data blocks
|
||||
|
||||
uint8_t algorithm[16];
|
||||
cryptographic algorithm
|
||||
|
||||
uint8_t salt[384];
|
||||
salt (the salt size is specified above)
|
||||
|
||||
uint8_t pad3[88];
|
||||
zero padding to 512-byte boundary
|
||||
}
|
||||
Alternatively, the header can be omitted and the dmsetup parameters can
|
||||
be passed via the kernel command-line in a rooted chain of trust where
|
||||
the command-line is verified.
|
||||
|
||||
Directly following the header (and with sector number padded to the next hash
|
||||
block boundary) are the hash blocks which are stored a depth at a time
|
||||
(starting from the root), sorted in order of increasing index.
|
||||
|
||||
The full specification of kernel parameters and on-disk metadata format
|
||||
is available at the cryptsetup project's wiki page
|
||||
http://code.google.com/p/cryptsetup/wiki/DMVerity
|
||||
|
||||
Status
|
||||
======
|
||||
V (for Valid) is returned if every check performed so far was valid.
|
||||
@@ -174,21 +134,22 @@ If any check failed, C (for Corruption) is returned.
|
||||
|
||||
Example
|
||||
=======
|
||||
|
||||
Setup a device:
|
||||
dmsetup create vroot --table \
|
||||
"0 2097152 "\
|
||||
"verity 1 /dev/sda1 /dev/sda2 4096 4096 2097152 1 "\
|
||||
Set up a device:
|
||||
# dmsetup create vroot --readonly --table \
|
||||
"0 2097152 verity 1 /dev/sda1 /dev/sda2 4096 4096 262144 1 sha256 "\
|
||||
"4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076 "\
|
||||
"1234000000000000000000000000000000000000000000000000000000000000"
|
||||
|
||||
A command line tool veritysetup is available to compute or verify
|
||||
the hash tree or activate the kernel driver. This is available from
|
||||
the LVM2 upstream repository and may be supplied as a package called
|
||||
device-mapper-verity-tools:
|
||||
git://sources.redhat.com/git/lvm2
|
||||
http://sourceware.org/git/?p=lvm2.git
|
||||
http://sourceware.org/cgi-bin/cvsweb.cgi/LVM2/verity?cvsroot=lvm2
|
||||
the hash tree or activate the kernel device. This is available from
|
||||
the cryptsetup upstream repository http://code.google.com/p/cryptsetup/
|
||||
(as a libcryptsetup extension).
|
||||
|
||||
veritysetup -a vroot /dev/sda1 /dev/sda2 \
|
||||
4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
|
||||
Create hash on the device:
|
||||
# veritysetup format /dev/sda1 /dev/sda2
|
||||
...
|
||||
Root hash: 4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
|
||||
|
||||
Activate the device:
|
||||
# veritysetup create vroot /dev/sda1 /dev/sda2 \
|
||||
4392712ba01368efdf14b05c76f9e4df0d53664630b5d48632ed17a137f39076
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
|
||||
Required properties:
|
||||
- compatible : "fsl,mma8450".
|
||||
- reg: the I2C address of MMA8450
|
||||
|
||||
Example:
|
||||
|
||||
|
||||
@@ -46,8 +46,8 @@ Examples:
|
||||
|
||||
ecspi@70010000 { /* ECSPI1 */
|
||||
fsl,spi-num-chipselects = <2>;
|
||||
cs-gpios = <&gpio3 24 0>, /* GPIO4_24 */
|
||||
<&gpio3 25 0>; /* GPIO4_25 */
|
||||
cs-gpios = <&gpio4 24 0>, /* GPIO4_24 */
|
||||
<&gpio4 25 0>; /* GPIO4_25 */
|
||||
status = "okay";
|
||||
|
||||
pmic: mc13892@0 {
|
||||
|
||||
@@ -29,6 +29,6 @@ esdhc@70008000 {
|
||||
compatible = "fsl,imx51-esdhc";
|
||||
reg = <0x70008000 0x4000>;
|
||||
interrupts = <2>;
|
||||
cd-gpios = <&gpio0 6 0>; /* GPIO1_6 */
|
||||
wp-gpios = <&gpio0 5 0>; /* GPIO1_5 */
|
||||
cd-gpios = <&gpio1 6 0>; /* GPIO1_6 */
|
||||
wp-gpios = <&gpio1 5 0>; /* GPIO1_5 */
|
||||
};
|
||||
|
||||
@@ -19,6 +19,6 @@ ethernet@83fec000 {
|
||||
reg = <0x83fec000 0x4000>;
|
||||
interrupts = <87>;
|
||||
phy-mode = "mii";
|
||||
phy-reset-gpios = <&gpio1 14 0>; /* GPIO2_14 */
|
||||
phy-reset-gpios = <&gpio2 14 0>; /* GPIO2_14 */
|
||||
local-mac-address = [00 04 9F 01 1B B9];
|
||||
};
|
||||
|
||||
@@ -17,6 +17,6 @@ ecspi@70010000 {
|
||||
reg = <0x70010000 0x4000>;
|
||||
interrupts = <36>;
|
||||
fsl,spi-num-chipselects = <2>;
|
||||
cs-gpios = <&gpio3 24 0>, /* GPIO4_24 */
|
||||
<&gpio3 25 0>; /* GPIO4_25 */
|
||||
cs-gpios = <&gpio3 24 0>, /* GPIO3_24 */
|
||||
<&gpio3 25 0>; /* GPIO3_25 */
|
||||
};
|
||||
|
||||
@@ -3,6 +3,7 @@ Device tree binding vendor prefix registry. Keep list in alphabetical order.
|
||||
This isn't an exhaustive list, but you should add new prefixes to it before
|
||||
using them to avoid name-space collisions.
|
||||
|
||||
ad Avionic Design GmbH
|
||||
adi Analog Devices, Inc.
|
||||
amcc Applied Micro Circuits Corporation (APM, formally AMCC)
|
||||
apm Applied Micro Circuits Corporation (APM)
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
The execve system call can grant a newly-started program privileges that
|
||||
its parent did not have. The most obvious examples are setuid/setgid
|
||||
programs and file capabilities. To prevent the parent program from
|
||||
gaining these privileges as well, the kernel and user code must be
|
||||
careful to prevent the parent from doing anything that could subvert the
|
||||
child. For example:
|
||||
|
||||
- The dynamic loader handles LD_* environment variables differently if
|
||||
a program is setuid.
|
||||
|
||||
- chroot is disallowed to unprivileged processes, since it would allow
|
||||
/etc/passwd to be replaced from the point of view of a process that
|
||||
inherited chroot.
|
||||
|
||||
- The exec code has special handling for ptrace.
|
||||
|
||||
These are all ad-hoc fixes. The no_new_privs bit (since Linux 3.5) is a
|
||||
new, generic mechanism to make it safe for a process to modify its
|
||||
execution environment in a manner that persists across execve. Any task
|
||||
can set no_new_privs. Once the bit is set, it is inherited across fork,
|
||||
clone, and execve and cannot be unset. With no_new_privs set, execve
|
||||
promises not to grant the privilege to do anything that could not have
|
||||
been done without the execve call. For example, the setuid and setgid
|
||||
bits will no longer change the uid or gid; file capabilities will not
|
||||
add to the permitted set, and LSMs will not relax constraints after
|
||||
execve.
|
||||
|
||||
To set no_new_privs, use prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0).
|
||||
|
||||
Be careful, though: LSMs might also not tighten constraints on exec
|
||||
in no_new_privs mode. (This means that setting up a general-purpose
|
||||
service launcher to set no_new_privs before execing daemons may
|
||||
interfere with LSM-based sandboxing.)
|
||||
|
||||
Note that no_new_privs does not prevent privilege changes that do not
|
||||
involve execve. An appropriately privileged task can still call
|
||||
setuid(2) and receive SCM_RIGHTS datagrams.
|
||||
|
||||
There are two main use cases for no_new_privs so far:
|
||||
|
||||
- Filters installed for the seccomp mode 2 sandbox persist across
|
||||
execve and can change the behavior of newly-executed programs.
|
||||
Unprivileged users are therefore only allowed to install such filters
|
||||
if no_new_privs is set.
|
||||
|
||||
- By itself, no_new_privs can be used to reduce the attack surface
|
||||
available to an unprivileged user. If everything running with a
|
||||
given uid has no_new_privs set, then that uid will be unable to
|
||||
escalate its privileges by directly attacking setuid, setgid, and
|
||||
fcap-using binaries; it will need to compromise something without the
|
||||
no_new_privs bit set first.
|
||||
|
||||
In the future, other potentially dangerous kernel features could become
|
||||
available to unprivileged tasks if no_new_privs is set. In principle,
|
||||
several options to unshare(2) and clone(2) would be safe when
|
||||
no_new_privs is set, and no_new_privs + chroot is considerable less
|
||||
dangerous than chroot by itself.
|
||||
@@ -12,6 +12,12 @@ Rules on what kind of patches are accepted, and which ones are not, into the
|
||||
marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
|
||||
security issue, or some "oh, that's not good" issue. In short, something
|
||||
critical.
|
||||
- Serious issues as reported by a user of a distribution kernel may also
|
||||
be considered if they fix a notable performance or interactivity issue.
|
||||
As these fixes are not as obvious and have a higher risk of a subtle
|
||||
regression they should only be submitted by a distribution kernel
|
||||
maintainer and include an addendum linking to a bugzilla entry if it
|
||||
exists and additional information on the user-visible impact.
|
||||
- New device IDs and quirks are also accepted.
|
||||
- No "theoretical race condition" issues, unless an explanation of how the
|
||||
race can be exploited is also provided.
|
||||
|
||||
@@ -1930,6 +1930,23 @@ The "pte_enc" field provides a value that can OR'ed into the hash
|
||||
PTE's RPN field (ie, it needs to be shifted left by 12 to OR it
|
||||
into the hash PTE second double word).
|
||||
|
||||
4.75 KVM_IRQFD
|
||||
|
||||
Capability: KVM_CAP_IRQFD
|
||||
Architectures: x86
|
||||
Type: vm ioctl
|
||||
Parameters: struct kvm_irqfd (in)
|
||||
Returns: 0 on success, -1 on error
|
||||
|
||||
Allows setting an eventfd to directly trigger a guest interrupt.
|
||||
kvm_irqfd.fd specifies the file descriptor to use as the eventfd and
|
||||
kvm_irqfd.gsi specifies the irqchip pin toggled by this event. When
|
||||
an event is tiggered on the eventfd, an interrupt is injected into
|
||||
the guest using the specified gsi pin. The irqfd is removed using
|
||||
the KVM_IRQFD_FLAG_DEASSIGN flag, specifying both kvm_irqfd.fd
|
||||
and kvm_irqfd.gsi.
|
||||
|
||||
|
||||
5. The kvm_run structure
|
||||
------------------------
|
||||
|
||||
|
||||
+12
-12
@@ -579,7 +579,7 @@ F: drivers/net/appletalk/
|
||||
F: net/appletalk/
|
||||
|
||||
ARASAN COMPACT FLASH PATA CONTROLLER
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
L: linux-ide@vger.kernel.org
|
||||
S: Maintained
|
||||
F: include/linux/pata_arasan_cf_data.h
|
||||
@@ -4654,8 +4654,8 @@ L: netfilter@vger.kernel.org
|
||||
L: coreteam@netfilter.org
|
||||
W: http://www.netfilter.org/
|
||||
W: http://www.iptables.org/
|
||||
T: git git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-2.6.git
|
||||
T: git git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next-2.6.git
|
||||
T: git git://1984.lsi.us.es/nf
|
||||
T: git git://1984.lsi.us.es/nf-next
|
||||
S: Supported
|
||||
F: include/linux/netfilter*
|
||||
F: include/linux/netfilter/
|
||||
@@ -5296,7 +5296,7 @@ S: Maintained
|
||||
F: drivers/pinctrl/
|
||||
|
||||
PIN CONTROLLER - ST SPEAR
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
|
||||
W: http://www.st.com/spear
|
||||
@@ -5873,7 +5873,7 @@ S: Maintained
|
||||
F: drivers/tty/serial
|
||||
|
||||
SYNOPSYS DESIGNWARE DMAC DRIVER
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
S: Maintained
|
||||
F: include/linux/dw_dmac.h
|
||||
F: drivers/dma/dw_dmac_regs.h
|
||||
@@ -6021,7 +6021,7 @@ S: Maintained
|
||||
F: drivers/mmc/host/sdhci-s3c.c
|
||||
|
||||
SECURE DIGITAL HOST CONTROLLER INTERFACE (SDHCI) ST SPEAR DRIVER
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-mmc@vger.kernel.org
|
||||
S: Maintained
|
||||
@@ -6377,7 +6377,7 @@ S: Maintained
|
||||
F: include/linux/compiler.h
|
||||
|
||||
SPEAR PLATFORM SUPPORT
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
M: Shiraz Hashim <shiraz.hashim@st.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
|
||||
@@ -6386,7 +6386,7 @@ S: Maintained
|
||||
F: arch/arm/plat-spear/
|
||||
|
||||
SPEAR13XX MACHINE SUPPORT
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
M: Shiraz Hashim <shiraz.hashim@st.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
|
||||
@@ -6395,7 +6395,7 @@ S: Maintained
|
||||
F: arch/arm/mach-spear13xx/
|
||||
|
||||
SPEAR3XX MACHINE SUPPORT
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
M: Shiraz Hashim <shiraz.hashim@st.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
|
||||
@@ -6406,7 +6406,7 @@ F: arch/arm/mach-spear3xx/
|
||||
SPEAR6XX MACHINE SUPPORT
|
||||
M: Rajeev Kumar <rajeev-dlh.kumar@st.com>
|
||||
M: Shiraz Hashim <shiraz.hashim@st.com>
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
|
||||
W: http://www.st.com/spear
|
||||
@@ -6414,7 +6414,7 @@ S: Maintained
|
||||
F: arch/arm/mach-spear6xx/
|
||||
|
||||
SPEAR CLOCK FRAMEWORK SUPPORT
|
||||
M: Viresh Kumar <viresh.kumar@st.com>
|
||||
M: Viresh Kumar <viresh.linux@gmail.com>
|
||||
L: spear-devel@list.st.com
|
||||
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
|
||||
W: http://www.st.com/spear
|
||||
@@ -7421,7 +7421,7 @@ F: include/linux/vlynq.h
|
||||
|
||||
VME SUBSYSTEM
|
||||
M: Martyn Welch <martyn.welch@ge.com>
|
||||
M: Manohar Vanga <manohar.vanga@cern.ch>
|
||||
M: Manohar Vanga <manohar.vanga@gmail.com>
|
||||
M: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
L: devel@driverdev.osuosl.org
|
||||
S: Maintained
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
VERSION = 3
|
||||
PATCHLEVEL = 5
|
||||
SUBLEVEL = 0
|
||||
EXTRAVERSION = -rc3
|
||||
EXTRAVERSION = -rc6
|
||||
NAME = Saber-toothed Squirrel
|
||||
|
||||
# *DOCUMENTATION*
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user