From: Thomas Gleixner <tglx@linutronix.de>
To: David Howells <dhowells@redhat.com>
Cc: linux-kernel@vger.kernel.org, gnomes@lxorguk.ukuu.org.uk,
gregkh@linuxfoundation.org, nouveau@lists.freedesktop.org,
x86@kernel.org, Steven Rostedt <rostedt@goodmis.org>,
linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
"H. Peter Anvin" <hpa@zytor.com>, Ingo Molnar <mingo@kernel.org>
Subject: Re: [PATCH 02/38] Annotate hardware config module parameters in arch/x86/mm/
Date: Fri, 14 Apr 2017 20:15:49 +0200 (CEST) [thread overview]
Message-ID: <alpine.DEB.2.20.1704142007590.2327@nanos> (raw)
In-Reply-To: <149141142839.29162.10470212173396183651.stgit@warthog.procyon.org.uk>
On Wed, 5 Apr 2017, David Howells wrote:
The subject line hardly qualifies as a valid one.
arch/subsys: Short description
Do I really have to explain that to you?
> When the kernel is running in secure boot mode, we lock down the kernel to
> prevent userspace from modifying the running kernel image. Whilst this
> includes prohibiting access to things like /dev/mem, it must also prevent
> access by means of configuring driver modules in such a way as to cause a
> device to access or modify the kernel image.
>
> To this end, annotate module_param* statements that refer to hardware
> configuration and indicate for future reference what type of parameter they
> specify. The parameter parser in the core sees this information and can
> skip such parameters with an error message if the kernel is locked down.
> The module initialisation then runs as normal, but just sees whatever the
> default values for those parameters is.
>
> Note that we do still need to do the module initialisation because some
> drivers have viable defaults set in case parameters aren't specified and
> some drivers support automatic configuration (e.g. PNP or PCI) in addition
> to manually coded parameters.
>
> This patch annotates drivers in arch/x86/mm/.
We already know that this is a patch. There is a chapter in
Documentation/process/SubmittingPatches which explains that. That file is
not only for newbies.
> diff --git a/arch/x86/mm/testmmiotrace.c b/arch/x86/mm/testmmiotrace.c
> index 38868adf07ea..f6ae6830b341 100644
> --- a/arch/x86/mm/testmmiotrace.c
> +++ b/arch/x86/mm/testmmiotrace.c
> @@ -9,7 +9,7 @@
> #include <linux/mmiotrace.h>
>
> static unsigned long mmio_address;
> -module_param(mmio_address, ulong, 0);
> +module_param_hw(mmio_address, ulong, iomem, 0);
> MODULE_PARM_DESC(mmio_address, " Start address of the mapping of 16 kB "
> "(or 8 MB if read_far is non-zero).");
The copied boilerplate above is really nonsensical here. The default
address is 0, so the init function will emit:
pr_err("you have to use the module argument mmio_address.\n");
pr_err("DO NOT LOAD THIS MODULE UNLESS YOU REALLY KNOW WHAT YOU ARE DOING!\n");
Pretty useless when you can't supply a valid address.
if (kernel_locked_down()) {
pr_info("This is not allowed because ...");
return -EPERM;
}
would make too much sense for the user, right?
Thanks,
tglx
next prev parent reply other threads:[~2017-04-14 18:16 UTC|newest]
Thread overview: 70+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-05 16:56 [PATCH 00/38] Annotate hw config module params for future lockdown David Howells
2017-04-05 16:57 ` [PATCH 01/38] Annotate module params that specify hardware parameters (eg. ioport) David Howells
2017-04-05 16:57 ` [PATCH 02/38] Annotate hardware config module parameters in arch/x86/mm/ David Howells
2017-04-05 17:35 ` Steven Rostedt
2017-04-14 18:15 ` Thomas Gleixner [this message]
2017-04-18 12:38 ` David Howells
2017-04-05 16:57 ` [PATCH 03/38] Annotate hardware config module parameters in drivers/char/ipmi/ David Howells
2017-04-05 16:57 ` [PATCH 04/38] Annotate hardware config module parameters in drivers/char/mwave/ David Howells
2017-04-05 16:57 ` [PATCH 05/38] Annotate hardware config module parameters in drivers/char/ David Howells
2017-04-08 15:23 ` Greg KH
2017-04-05 16:57 ` [PATCH 06/38] Annotate hardware config module parameters in drivers/clocksource/ David Howells
2017-04-14 18:25 ` Thomas Gleixner
2017-04-18 16:24 ` Jens Rottmann
2017-04-18 16:34 ` Jens Rottmann
2017-04-19 15:29 ` David Howells
2017-04-14 22:59 ` David Howells
2017-04-15 5:49 ` Thomas Gleixner
2017-04-15 5:51 ` David Howells
2017-04-15 9:54 ` Thomas Gleixner
2017-04-18 12:43 ` David Howells
2017-04-18 12:54 ` Thomas Gleixner
2017-04-19 15:33 ` David Howells
2017-04-05 16:57 ` [PATCH 07/38] Annotate hardware config module parameters in drivers/cpufreq/ David Howells
2017-04-10 10:33 ` Viresh Kumar
2017-04-05 16:57 ` [PATCH 08/38] Annotate hardware config module parameters in drivers/gpio/ David Howells
2017-04-07 10:42 ` Linus Walleij
2017-04-07 12:52 ` David Howells
2017-04-05 16:58 ` [PATCH 09/38] Annotate hardware config module parameters in drivers/i2c/ David Howells
2017-04-19 19:25 ` Wolfram Sang
2017-04-20 7:31 ` Jean Delvare
2017-04-05 16:58 ` [PATCH 10/38] Annotate hardware config module parameters in drivers/iio/ David Howells
2017-04-05 16:58 ` [PATCH 11/38] Annotate hardware config module parameters in drivers/input/ David Howells
2017-04-05 16:58 ` [PATCH 12/38] Annotate hardware config module parameters in drivers/isdn/ David Howells
2017-04-05 16:58 ` [PATCH 13/38] Annotate hardware config module parameters in drivers/media/ David Howells
2017-04-19 11:09 ` Mauro Carvalho Chehab
2017-04-05 16:58 ` [PATCH 14/38] Annotate hardware config module parameters in drivers/misc/ David Howells
2017-04-08 15:23 ` Greg KH
2017-04-05 16:59 ` [PATCH 15/38] Annotate hardware config module parameters in drivers/mmc/host/ David Howells
2017-04-05 16:59 ` [PATCH 16/38] Annotate hardware config module parameters in drivers/net/appletalk/ David Howells
2017-04-05 16:59 ` [PATCH 17/38] Annotate hardware config module parameters in drivers/net/arcnet/ David Howells
2017-04-05 16:59 ` [PATCH 18/38] Annotate hardware config module parameters in drivers/net/can/ David Howells
2017-04-14 13:08 ` Marc Kleine-Budde
2017-04-18 14:36 ` David Howells
2017-04-05 16:59 ` [PATCH 19/38] Annotate hardware config module parameters in drivers/net/ethernet/ David Howells
2017-04-05 16:59 ` [PATCH 20/38] Annotate hardware config module parameters in drivers/net/hamradio/ David Howells
2017-04-05 17:00 ` [PATCH 21/38] Annotate hardware config module parameters in drivers/net/irda/ David Howells
2017-04-05 17:00 ` [PATCH 22/38] Annotate hardware config module parameters in drivers/net/wan/ David Howells
2017-04-05 17:00 ` [PATCH 23/38] Annotate hardware config module parameters in drivers/net/wireless/ David Howells
2017-04-05 17:00 ` [PATCH 24/38] Annotate hardware config module parameters in drivers/parport/ David Howells
2017-04-05 17:00 ` [PATCH 25/38] Annotate hardware config module parameters in drivers/pci/hotplug/ David Howells
2017-04-05 17:00 ` [PATCH 26/38] Annotate hardware config module parameters in drivers/pcmcia/ David Howells
2017-04-05 17:00 ` [PATCH 27/38] Annotate hardware config module parameters in drivers/scsi/ David Howells
2017-04-05 17:01 ` [PATCH 28/38] Annotate hardware config module parameters in drivers/staging/media/ David Howells
2017-04-08 15:23 ` Greg KH
2017-04-19 11:08 ` Mauro Carvalho Chehab
2017-04-05 17:01 ` [PATCH 29/38] Annotate hardware config module parameters in drivers/staging/speakup/ David Howells
2017-04-08 15:23 ` Greg KH
2017-04-05 17:01 ` [PATCH 30/38] Annotate hardware config module parameters in drivers/staging/vme/ David Howells
2017-04-05 17:01 ` [PATCH 31/38] Annotate hardware config module parameters in drivers/tty/ David Howells
2017-04-08 15:19 ` Greg KH
2017-04-05 17:01 ` [PATCH 32/38] Annotate hardware config module parameters in drivers/video/ David Howells
[not found] ` <CGME20170414112713epcas5p218f3663e4f0ea4ca1bfaf4155d4724c8@epcas5p2.samsung.com>
2017-04-14 11:27 ` Bartlomiej Zolnierkiewicz
2017-04-05 17:01 ` [PATCH 33/38] Annotate hardware config module parameters in drivers/watchdog/ David Howells
2017-04-05 17:01 ` [PATCH 34/38] Annotate hardware config module parameters in fs/pstore/ David Howells
2017-04-05 17:04 ` Kees Cook
2017-04-05 17:01 ` [PATCH 35/38] Annotate hardware config module parameters in sound/drivers/ David Howells
2017-04-07 8:42 ` Takashi Iwai
2017-04-05 17:02 ` [PATCH 36/38] Annotate hardware config module parameters in sound/isa/ David Howells
2017-04-05 17:02 ` [PATCH 37/38] Annotate hardware config module parameters in sound/oss/ David Howells
2017-04-05 17:02 ` [PATCH 38/38] Annotate hardware config module parameters in sound/pci/ David Howells
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.20.1704142007590.2327@nanos \
--to=tglx@linutronix.de \
--cc=dhowells@redhat.com \
--cc=gnomes@lxorguk.ukuu.org.uk \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=nouveau@lists.freedesktop.org \
--cc=rostedt@goodmis.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).