Fix wrongly deleted patch
SECCOMP is merged in 5.5 kernel, but not CPUFreq (still not posted for upstream review). Signed-off-by: David Abdurachmanov <david.abdurachmanov@sifive.com>
This commit is contained in:
parent
2669cb387c
commit
8b4848f6c7
GPG Key ID:
8B7F1DA0E2C9FDBB
|
|
@ -1,192 +0,0 @@
|
|||
From 269ef272b24c852a52deb5b119d4f1744108b5b8 Mon Sep 17 00:00:00 2001
|
||||
From: Fedora Kernel Team <kernel-team@fedoraproject.org>
|
||||
Date: Sat, 19 Oct 2019 16:20:51 +0000
|
||||
Subject: [PATCH] riscv: add support for SECCOMP
|
||||
|
||||
---
|
||||
arch/riscv/Kconfig | 14 ++++++++++
|
||||
arch/riscv/include/asm/seccomp.h | 10 +++++++
|
||||
arch/riscv/include/asm/thread_info.h | 5 +++-
|
||||
arch/riscv/kernel/entry.S | 27 +++++++++++++++++--
|
||||
arch/riscv/kernel/ptrace.c | 10 +++++++
|
||||
tools/testing/selftests/seccomp/seccomp_bpf.c | 8 +++++-
|
||||
6 files changed, 70 insertions(+), 4 deletions(-)
|
||||
create mode 100644 arch/riscv/include/asm/seccomp.h
|
||||
|
||||
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
|
||||
index 391b191..b3650f1 100644
|
||||
--- a/arch/riscv/Kconfig
|
||||
+++ b/arch/riscv/Kconfig
|
||||
@@ -31,6 +31,7 @@ config RISCV
|
||||
select GENERIC_SMP_IDLE_THREAD
|
||||
select GENERIC_ATOMIC64 if !64BIT
|
||||
select HAVE_ARCH_AUDITSYSCALL
|
||||
+ select HAVE_ARCH_SECCOMP_FILTER
|
||||
select HAVE_ASM_MODVERSIONS
|
||||
select HAVE_MEMBLOCK_NODE_MAP
|
||||
select HAVE_DMA_CONTIGUOUS
|
||||
@@ -272,6 +273,19 @@ menu "Kernel features"
|
||||
|
||||
source "kernel/Kconfig.hz"
|
||||
|
||||
+config SECCOMP
|
||||
+ bool "Enable seccomp to safely compute untrusted bytecode"
|
||||
+ help
|
||||
+ This kernel feature is useful for number crunching applications
|
||||
+ that may need to compute untrusted bytecode during their
|
||||
+ execution. By using pipes or other transports made available to
|
||||
+ the process as file descriptors supporting the read/write
|
||||
+ syscalls, it's possible to isolate those applications in
|
||||
+ their own address space using seccomp. Once seccomp is
|
||||
+ enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
|
||||
+ and the task is only allowed to execute a few safe syscalls
|
||||
+ defined by each seccomp mode.
|
||||
+
|
||||
endmenu
|
||||
|
||||
menu "Boot options"
|
||||
diff --git a/arch/riscv/include/asm/seccomp.h b/arch/riscv/include/asm/seccomp.h
|
||||
new file mode 100644
|
||||
index 0000000..bf7744e
|
||||
--- /dev/null
|
||||
+++ b/arch/riscv/include/asm/seccomp.h
|
||||
@@ -0,0 +1,10 @@
|
||||
+/* SPDX-License-Identifier: GPL-2.0 */
|
||||
+
|
||||
+#ifndef _ASM_SECCOMP_H
|
||||
+#define _ASM_SECCOMP_H
|
||||
+
|
||||
+#include <asm/unistd.h>
|
||||
+
|
||||
+#include <asm-generic/seccomp.h>
|
||||
+
|
||||
+#endif /* _ASM_SECCOMP_H */
|
||||
diff --git a/arch/riscv/include/asm/thread_info.h b/arch/riscv/include/asm/thread_info.h
|
||||
index 905372d..a0b2a29 100644
|
||||
--- a/arch/riscv/include/asm/thread_info.h
|
||||
+++ b/arch/riscv/include/asm/thread_info.h
|
||||
@@ -75,6 +75,7 @@ struct thread_info {
|
||||
#define TIF_MEMDIE 5 /* is terminating due to OOM killer */
|
||||
#define TIF_SYSCALL_TRACEPOINT 6 /* syscall tracepoint instrumentation */
|
||||
#define TIF_SYSCALL_AUDIT 7 /* syscall auditing */
|
||||
+#define TIF_SECCOMP 8 /* syscall secure computing */
|
||||
|
||||
#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
|
||||
#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
|
||||
@@ -82,11 +83,13 @@ struct thread_info {
|
||||
#define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED)
|
||||
#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
|
||||
#define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
|
||||
+#define _TIF_SECCOMP (1 << TIF_SECCOMP)
|
||||
|
||||
#define _TIF_WORK_MASK \
|
||||
(_TIF_NOTIFY_RESUME | _TIF_SIGPENDING | _TIF_NEED_RESCHED)
|
||||
|
||||
#define _TIF_SYSCALL_WORK \
|
||||
- (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT)
|
||||
+ (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_TRACEPOINT | _TIF_SYSCALL_AUDIT | \
|
||||
+ _TIF_SECCOMP )
|
||||
|
||||
#endif /* _ASM_RISCV_THREAD_INFO_H */
|
||||
diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S
|
||||
index 8ca4798..c68b987 100644
|
||||
--- a/arch/riscv/kernel/entry.S
|
||||
+++ b/arch/riscv/kernel/entry.S
|
||||
@@ -226,8 +226,25 @@ check_syscall_nr:
|
||||
/* Check to make sure we don't jump to a bogus syscall number. */
|
||||
li t0, __NR_syscalls
|
||||
la s0, sys_ni_syscall
|
||||
- /* Syscall number held in a7 */
|
||||
- bgeu a7, t0, 1f
|
||||
+ /*
|
||||
+ * The tracer can change syscall number to valid/invalid value.
|
||||
+ * We use syscall_set_nr helper in syscall_trace_enter thus we
|
||||
+ * cannot trust the current value in a7 and have to reload from
|
||||
+ * the current task pt_regs.
|
||||
+ */
|
||||
+ REG_L a7, PT_A7(sp)
|
||||
+ /*
|
||||
+ * Syscall number held in a7.
|
||||
+ * If syscall number is above allowed value, redirect to ni_syscall.
|
||||
+ */
|
||||
+ bge a7, t0, 1f
|
||||
+ /*
|
||||
+ * Check if syscall is rejected by tracer or seccomp, i.e., a7 == -1.
|
||||
+ * If yes, we pretend it was executed.
|
||||
+ */
|
||||
+ li t1, -1
|
||||
+ beq a7, t1, ret_from_syscall_rejected
|
||||
+ /* Call syscall */
|
||||
la s0, sys_call_table
|
||||
slli t0, a7, RISCV_LGPTR
|
||||
add s0, s0, t0
|
||||
@@ -238,6 +255,12 @@ check_syscall_nr:
|
||||
ret_from_syscall:
|
||||
/* Set user a0 to kernel a0 */
|
||||
REG_S a0, PT_A0(sp)
|
||||
+ /*
|
||||
+ * We didn't execute the actual syscall.
|
||||
+ * Seccomp already set return value for the current task pt_regs.
|
||||
+ * (If it was configured with SECCOMP_RET_ERRNO/TRACE)
|
||||
+ */
|
||||
+ret_from_syscall_rejected:
|
||||
/* Trace syscalls, but only if requested by the user. */
|
||||
REG_L t0, TASK_TI_FLAGS(tp)
|
||||
andi t0, t0, _TIF_SYSCALL_WORK
|
||||
diff --git a/arch/riscv/kernel/ptrace.c b/arch/riscv/kernel/ptrace.c
|
||||
index 3687514..63e47c9 100644
|
||||
--- a/arch/riscv/kernel/ptrace.c
|
||||
+++ b/arch/riscv/kernel/ptrace.c
|
||||
@@ -154,6 +154,16 @@ void do_syscall_trace_enter(struct pt_regs *regs)
|
||||
if (tracehook_report_syscall_entry(regs))
|
||||
syscall_set_nr(current, regs, -1);
|
||||
|
||||
+ /*
|
||||
+ * Do the secure computing after ptrace; failures should be fast.
|
||||
+ * If this fails we might have return value in a0 from seccomp
|
||||
+ * (via SECCOMP_RET_ERRNO/TRACE).
|
||||
+ */
|
||||
+ if (secure_computing(NULL) == -1) {
|
||||
+ syscall_set_nr(current, regs, -1);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
#ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
|
||||
if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
|
||||
trace_sys_enter(regs, syscall_get_nr(current, regs));
|
||||
diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c
|
||||
index 7f8b5c8..69bd454 100644
|
||||
--- a/tools/testing/selftests/seccomp/seccomp_bpf.c
|
||||
+++ b/tools/testing/selftests/seccomp/seccomp_bpf.c
|
||||
@@ -112,6 +112,8 @@ struct seccomp_data {
|
||||
# define __NR_seccomp 383
|
||||
# elif defined(__aarch64__)
|
||||
# define __NR_seccomp 277
|
||||
+# elif defined(__riscv)
|
||||
+# define __NR_seccomp 277
|
||||
# elif defined(__hppa__)
|
||||
# define __NR_seccomp 338
|
||||
# elif defined(__powerpc__)
|
||||
@@ -1587,6 +1589,10 @@ TEST_F(TRACE_poke, getpid_runs_normally)
|
||||
# define ARCH_REGS struct user_pt_regs
|
||||
# define SYSCALL_NUM regs[8]
|
||||
# define SYSCALL_RET regs[0]
|
||||
+#elif defined(__riscv) && __riscv_xlen == 64
|
||||
+# define ARCH_REGS struct user_regs_struct
|
||||
+# define SYSCALL_NUM a7
|
||||
+# define SYSCALL_RET a0
|
||||
#elif defined(__hppa__)
|
||||
# define ARCH_REGS struct user_regs_struct
|
||||
# define SYSCALL_NUM gr[20]
|
||||
@@ -1676,7 +1682,7 @@ void change_syscall(struct __test_metadata *_metadata,
|
||||
EXPECT_EQ(0, ret) {}
|
||||
|
||||
#if defined(__x86_64__) || defined(__i386__) || defined(__powerpc__) || \
|
||||
- defined(__s390__) || defined(__hppa__)
|
||||
+ defined(__s390__) || defined(__hppa__) || defined(__riscv)
|
||||
{
|
||||
regs.SYSCALL_NUM = syscall;
|
||||
}
|
||||
--
|
||||
2.23.0
|
||||
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
From 8d741d97eeb3a0c1b9aa09da15fbb1c5c7214fcd Mon Sep 17 00:00:00 2001
|
||||
From: Fedora Kernel Team <kernel-team@fedoraproject.org>
|
||||
Date: Sun, 25 Aug 2019 06:58:34 +0000
|
||||
Subject: [PATCH 2/2] SiFive Unleashed CPUFreq
|
||||
|
||||
Signed-off-by: Fedora Kernel Team <kernel-team@fedoraproject.org>
|
||||
---
|
||||
arch/riscv/Kconfig | 8 +++++
|
||||
arch/riscv/boot/dts/sifive/fu540-c000.dtsi | 5 +++
|
||||
.../boot/dts/sifive/hifive-unleashed-a00.dts | 34 +++++++++++++++++++
|
||||
arch/riscv/configs/defconfig | 5 +++
|
||||
4 files changed, 52 insertions(+)
|
||||
|
||||
diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig
|
||||
index 441e63f..ccd590c 100644
|
||||
--- a/arch/riscv/Kconfig
|
||||
+++ b/arch/riscv/Kconfig
|
||||
@@ -298,6 +298,14 @@ endchoice
|
||||
|
||||
endmenu
|
||||
|
||||
+menu "CPU Power Management"
|
||||
+
|
||||
+source "drivers/cpuidle/Kconfig"
|
||||
+
|
||||
+source "drivers/cpufreq/Kconfig"
|
||||
+
|
||||
+endmenu
|
||||
+
|
||||
menu "Power management options"
|
||||
|
||||
source "kernel/power/Kconfig"
|
||||
diff --git a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
|
||||
index 42b5ec2..b07079f 100644
|
||||
--- a/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
|
||||
+++ b/arch/riscv/boot/dts/sifive/fu540-c000.dtsi
|
||||
@@ -29,6 +29,7 @@
|
||||
i-cache-size = <16384>;
|
||||
reg = <0>;
|
||||
riscv,isa = "rv64imac";
|
||||
+ clocks = <&prci PRCI_CLK_COREPLL>;
|
||||
status = "disabled";
|
||||
cpu0_intc: interrupt-controller {
|
||||
#interrupt-cells = <1>;
|
||||
@@ -53,6 +54,7 @@
|
||||
reg = <1>;
|
||||
riscv,isa = "rv64imafdc";
|
||||
tlb-split;
|
||||
+ clocks = <&prci PRCI_CLK_COREPLL>;
|
||||
cpu1_intc: interrupt-controller {
|
||||
#interrupt-cells = <1>;
|
||||
compatible = "riscv,cpu-intc";
|
||||
@@ -77,6 +79,7 @@
|
||||
reg = <2>;
|
||||
riscv,isa = "rv64imafdc";
|
||||
tlb-split;
|
||||
+ clocks = <&prci PRCI_CLK_COREPLL>;
|
||||
cpu2_intc: interrupt-controller {
|
||||
#interrupt-cells = <1>;
|
||||
compatible = "riscv,cpu-intc";
|
||||
@@ -101,6 +104,7 @@
|
||||
reg = <3>;
|
||||
riscv,isa = "rv64imafdc";
|
||||
tlb-split;
|
||||
+ clocks = <&prci PRCI_CLK_COREPLL>;
|
||||
cpu3_intc: interrupt-controller {
|
||||
#interrupt-cells = <1>;
|
||||
compatible = "riscv,cpu-intc";
|
||||
@@ -125,6 +129,7 @@
|
||||
reg = <4>;
|
||||
riscv,isa = "rv64imafdc";
|
||||
tlb-split;
|
||||
+ clocks = <&prci PRCI_CLK_COREPLL>;
|
||||
cpu4_intc: interrupt-controller {
|
||||
#interrupt-cells = <1>;
|
||||
compatible = "riscv,cpu-intc";
|
||||
diff --git a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
|
||||
index 54fc701..5b43bdf 100644
|
||||
--- a/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
|
||||
+++ b/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts
|
||||
@@ -40,6 +40,40 @@
|
||||
clock-frequency = <RTCCLK_FREQ>;
|
||||
clock-output-names = "rtcclk";
|
||||
};
|
||||
+
|
||||
+ fu540_c000_opp_table: opp-table {
|
||||
+ compatible = "operating-points-v2";
|
||||
+ opp-shared;
|
||||
+
|
||||
+ opp-350000000 {
|
||||
+ opp-hz = /bits/ 64 <350000000>;
|
||||
+ };
|
||||
+ opp-700000000 {
|
||||
+ opp-hz = /bits/ 64 <700000000>;
|
||||
+ };
|
||||
+ opp-999999999 {
|
||||
+ opp-hz = /bits/ 64 <999999999>;
|
||||
+ };
|
||||
+ opp-1400000000 {
|
||||
+ opp-hz = /bits/ 64 <1400000000>;
|
||||
+ };
|
||||
+ };
|
||||
+};
|
||||
+
|
||||
+&cpu0 {
|
||||
+ operating-points-v2 = <&fu540_c000_opp_table>;
|
||||
+};
|
||||
+&cpu1 {
|
||||
+ operating-points-v2 = <&fu540_c000_opp_table>;
|
||||
+};
|
||||
+&cpu2 {
|
||||
+ operating-points-v2 = <&fu540_c000_opp_table>;
|
||||
+};
|
||||
+&cpu3 {
|
||||
+ operating-points-v2 = <&fu540_c000_opp_table>;
|
||||
+};
|
||||
+&cpu4 {
|
||||
+ operating-points-v2 = <&fu540_c000_opp_table>;
|
||||
};
|
||||
|
||||
&uart0 {
|
||||
diff --git a/arch/riscv/configs/defconfig b/arch/riscv/configs/defconfig
|
||||
index 3efff55..c9542a9 100644
|
||||
--- a/arch/riscv/configs/defconfig
|
||||
+++ b/arch/riscv/configs/defconfig
|
||||
@@ -16,6 +16,11 @@ CONFIG_EXPERT=y
|
||||
CONFIG_BPF_SYSCALL=y
|
||||
CONFIG_SOC_SIFIVE=y
|
||||
CONFIG_SMP=y
|
||||
+CONFIG_CPU_IDLE=y
|
||||
+CONFIG_CPU_FREQ=y
|
||||
+CONFIG_CPU_FREQ_STAT=y
|
||||
+CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
|
||||
+CONFIG_CPUFREQ_DT=y
|
||||
CONFIG_MODULES=y
|
||||
CONFIG_MODULE_UNLOAD=y
|
||||
CONFIG_NET=y
|
||||
--
|
||||
2.23.0
|
||||
|
||||
Loading…
Reference in New Issue