August 2013 - openSUSE Kernel - openSUSE Mailing Lists

[opensuse-kernel] [PATCH] Reenable ARM64 configs
by Dirk Müller 11 Aug '13

11 Aug '13

Hi, could somebody of the kernel git privileged people please merge the patch below to master? it reenables the ARM64 config, which we need to finish a ARM64 port of openSUSE. Thanks a lot in advance, Greetings, Dirk

2 1

[opensuse-kernel] pciehp (epresscard) not working on 3.11rc4 anymore
by Stefan Seyfried 11 Aug '13

11 Aug '13

Hi all, with 3.11rc4, an USB 3.0 expresscard is not working anymore in my ThinkPad X200s unless it is plugged at boot. I'm not 100% sure when it last worked, but in the logs I see that I used it with 3.10rc4. One difference between 3.11-suse and 3.10-suse is, that pciehp is now built in. In 3.10 I had to load it manually to get the card to work. So I'm wondering if there is just some parameter I need to set or if there is a way to trigger the "rescanning" of the port. I don't get any interrupts when inserting or ejecting the card: susi:~ # grep PCIe /proc/interrupts 40: 0 0 PCI-MSI-edge PCIe PME, pciehp 41: 0 0 PCI-MSI-edge PCIe PME, pciehp 42: 0 0 PCI-MSI-edge PCIe PME Any hints? Best regards, Stefan -- Stefan Seyfried "If your lighter runs out of fluid or flint and stops making fire, and you can't be bothered to figure out about lighter fluid or flint, that is not Zippo's fault." -- bkw -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

3 4

[opensuse-kernel] [RFC PATCH 00/18 v2] Signature verification of hibernate snapshot
by Lee, Chun-Yi 09 Aug '13

09 Aug '13

Hi experts, This patchset is the implementation for signature verification of hibernate snapshot image. The origin idea is from Jiri Kosina: Let EFI bootloader generate key-pair in UEFI secure boot environment, then pass it to kernel for sign/verify S4 image. Due to there have potential threat from the S4 image hacked, it may cause SUSE lost the trust in UEFI secure boot. The hacker attack the S4 snapshot image in swap partition through whatever exploit from another trusted OS, an the exploit may don't need physical access machine. So, this patchset give the ability to kernel for parsing the RSA key-pair from EFI bootloader, then using the private key to generate the signature of S4 snapshot image. Kernel put the signature to snapshot header, then verify the signature when kernel try to recover snapshot image to memory. ============== How To Enable ============== Set enable the CONFIG_SNAPSHOT_VERIFICATION kernel config. And you can also choice which hash algorithm should snapshot be signed with. Then rebuild kernel. Please note this function need UEFI bootloader generate key-pair in UEFI secure boot environment, e.g. shim. current shim implementation by Gary Lin: https://build.opensuse.org/package/show/home:gary_lin:UEFI/shim Please use the shim from the above URL if you want to try. And, Please remember add this shim to db in UEFI because it didn't sign by SUSE or Microsoft key. ========= Behavior ========= The RSA key-pair are generated by EFI bootloader(e.g. shim) in UEFI secure boot environment, so currently this function binding with EFI secure boot enabled. The kernel behavior is: + UEFI Secure Boot ON, Kernel found key-pair from shim: Kernel will do the S4 signature check. + UEFI Secure Boot ON, Kernel didn't find key-pair from shim: Kernel will lock down S4 function. + UEFI Secure Boot OFF Kernel will disable S4 signature check, and ignore any keys from EFI bootloader. On EFI bootloader side, the behavior as following: + First, kernel will check the following 2 EFI variable: S4SignKey-fe141863-c070-478e-b8a3-878a5dc9ef21 [Runtime][Non-Volatile] S4WakeKey-fe141863-c070-478e-b8a3-878a5dc9ef21 [Runtime][Volatile] S4SignKey and S4WakeKey is a RSA key-pair: - S4SignKey is a private key that's used to generate signature of S4 snapshot. The blob format of S4SignKey is PKCS#8 format, it should packaged a RSA private key that's followed PKCS#1. - S4WakeKey is a public key that's used to verify signature of S4 snapshot. The blob format of S4WakeKey is X.509 format, it should packaged a RSA public key that's followed PKCS#1. + EFI bootloader must generate RSA key-pair when system boot: - Bootloader store the public key to EFI boottime variable by itself - Bootloader put The private key to S4SignKey EFI variable for forward to kernel. + Kernel will load the S4SignKey blob to RAM when booting and delete it immediately. This private key will sign snapshot when S4. + When machine resume from hibernate: - EFI bootloader should copy the public key from boottime variable to S4WakeKey EFI variable. - Bootloader need generated a new key-pair for next round S4 usage. It should put new privat ekey to S4SignKey variable. ============== Implementation ============== Whole implementation including 3 part: shim, asymmetric keys and hibernate: + shim: Currently solution implemented by Gary Lin: https://build.opensuse.org/package/show/home:gary_lin:UEFI/shim Please use the shim from the above URL if you want to try. And, Please remember add this shim to db because it didn't sign by SUSE or Microsoft key. + Asymmetric keys: This patchset implemented PKCS#8 and RSA private key parser, it also implement the signature verification operation of RSASSA-PKCS1-v_5 in PKCS#1 spec. [RFC3447 sec 8.2.2] Set CONFIG_PKCS8_PRIVATE_KEY_INFO_PARSER=y will give kernel the abilities to parsing private key and verify signature. + Hibernate: Set CONFIG_SNAPSHOT_VERIFICATION=y will give enable the function of snapshot signature generation and verification. We reserved 512 byes size in snapshot header for store the signature that's generated from the digest with SHA256 algorithms. For adapt S4 signature check to secure boot, I have porting 3 patches from Fedora kernel to openSUSE, authors are Josh Boyer and Matthew Garrett. I also add Cc. to them. Please help review this RFC patchset! Appreciate for any comments! Josh Boyer (1): Secure boot: Add a dummy kernel parameter that will switch on Secure Boot mode Lee, Chun-Yi (15): asymmetric keys: add interface and skeleton for implement signature generation asymmetric keys: implement EMSA_PKCS1-v1_5-ENCODE in rsa asymmetric keys: separate the length checking of octet string from RSA_I2OSP asymmetric keys: implement OS2IP in rsa asymmetric keys: implement RSASP1 asymmetric keys: support parsing PKCS #8 private key information asymmetric keys: explicitly add the leading zero byte to encoded message Hibernate: introduced RSA key-pair to verify signature of snapshot Hibernate: generate and verify signature of snapshot Hibernate: Avoid S4 sign key data included in snapshot image Hibernate: fix the race condition of remove S4 sign key Hibernate: applied SNAPSHOT_VERIFICATION config to switch signature check Hibernate: adapt to UEFI secure boot with signature check Hibernate: show the verification time for monitor performance Hibernate: introduced SNAPSHOT_SIG_HASH config for select hash algorithm Matthew Garrett (2): Secure boot: Add new capability efi: Enable secure boot lockdown automatically when enabled in firmware Documentation/kernel-parameters.txt | 7 + Documentation/x86/zero-page.txt | 2 + arch/x86/boot/compressed/eboot.c | 32 +++ arch/x86/include/asm/bootparam_utils.h | 8 +- arch/x86/include/uapi/asm/bootparam.h | 3 +- arch/x86/kernel/setup.c | 7 + crypto/asymmetric_keys/Kconfig | 11 + crypto/asymmetric_keys/Makefile | 16 ++ crypto/asymmetric_keys/pkcs8.asn1 | 19 ++ crypto/asymmetric_keys/pkcs8_info_parser.c | 152 ++++++++++++++ crypto/asymmetric_keys/pkcs8_parser.h | 23 ++ crypto/asymmetric_keys/pkcs8_private_key.c | 148 ++++++++++++++ crypto/asymmetric_keys/pkcs8_rsakey.asn1 | 29 +++ crypto/asymmetric_keys/private_key.h | 29 +++ crypto/asymmetric_keys/public_key.c | 32 +++ crypto/asymmetric_keys/rsa.c | 283 +++++++++++++++++++++++++-- crypto/asymmetric_keys/signature.c | 28 +++ include/crypto/public_key.h | 28 +++ include/keys/asymmetric-subtype.h | 6 + include/linux/cred.h | 2 + include/linux/efi.h | 1 + include/uapi/linux/capability.h | 6 +- kernel/cred.c | 17 ++ kernel/power/Kconfig | 62 ++++++- kernel/power/Makefile | 1 + kernel/power/hibernate.c | 42 ++++ kernel/power/hibernate_keys.c | 262 ++++++++++++++++++++++++ kernel/power/main.c | 11 +- kernel/power/power.h | 27 +++ kernel/power/snapshot.c | 299 +++++++++++++++++++++++++++- kernel/power/swap.c | 18 ++ kernel/power/user.c | 24 +++ 32 files changed, 1611 insertions(+), 24 deletions(-) create mode 100644 crypto/asymmetric_keys/pkcs8.asn1 create mode 100644 crypto/asymmetric_keys/pkcs8_info_parser.c create mode 100644 crypto/asymmetric_keys/pkcs8_parser.h create mode 100644 crypto/asymmetric_keys/pkcs8_private_key.c create mode 100644 crypto/asymmetric_keys/pkcs8_rsakey.asn1 create mode 100644 crypto/asymmetric_keys/private_key.h create mode 100644 kernel/power/hibernate_keys.c -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

5 27

[opensuse-kernel] [PATCH] Update armv7hl default config
by Guillaume Gardet 08 Aug '13

08 Aug '13

Hi, please find in attachment a patch to update armv7hl default config: * Update to 3.11.0-rc4 * Add sound modules * Add TI wifi modules Signed-off-by: Guillaume GARDET <guillaume.gardet(a)opensuse.org> Regards, Guillaume

1 0

[opensuse-kernel] 3.11-rc4: LVM broken?
by Andreas Jaeger 08 Aug '13

08 Aug '13

I use whole-disk encryption on my laptop and tried 3.11-rc4 - and it could not read my volume groups at all from the initial ramdisk. I had to reboot to 3.10... Is there anything I need to change for 3.11? Or is LVM broken? Andreas -- Andreas Jaeger aj(a){suse.com,opensuse.org} Twitter/Identica: jaegerandi SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GF: Jeff Hawn,Jennifer Guild,Felix Imendörffer,HRB16746 (AG Nürnberg) GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126 -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

2 2

[opensuse-kernel] Creating a tarball from and OBS kernel project
by Andrew Wafaa 03 Aug '13

03 Aug '13

Aloha, I need to build an out of tree, closed, kernel driver and there is a kernel on OBS that fits my target. How to I create a configured source tree from that project so that I can build the driver? Thanks, Andy -- Andrew Wafaa IRC: FunkyPenguin GPG: 0x3A36312F -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

5 6

[opensuse-kernel] BtrFS Usage/Complaints
by Jeff Mahoney 02 Aug '13

02 Aug '13

Hi all - Over the past year, btrfs has received substantial attention in the areas of both stability and performance. I've been running it, personally, on a 4 TB data volume as well as my root partitions for my openSUSE 12.2/12.3 systems. I've been able to do stress tests like a long fsmark run simultaneously with creating and removing snapshots (with syncs to force them to disk) and haven't run into any issues. David Sterba, who's been leading the charge at SUSE for btrfs stability has likewise regularly run it through an array of torture tests and has found that problems are occurring a whole lot less frequently than they have in the past. The upstream btrfs community in which we participate has also started focusing less on feature development and more on stability and performance. But these are only anecdotal data points from two file system guys and if my experiences working for a major operating systems vendor have taught me anything, it's that our users can be a lot more creative at finding ways to break things than we are. ;) So, I'd like to hear your stories. What's worked for you? What hasn't worked? What would you consider the pain points with using btrfs? Lastly, I'd like to ask that you take the opportunity to test with the latest openSUSE Factory kernel running 3.10-final. 12.3 used the 3.7 kernel since it was the most recent release going into the beta cycle and we've seen a bunch of btrfs fixes since that release. I look forward to your feedback and the opportunity to improve btrfs for the 13.1 release and future releases. Thanks! -Jeff -- Jeff Mahoney

13 22

[opensuse-kernel] [PATCH] atl1c: Fix misuse of netdev_alloc_skb in refilling rx ring
by David Chang 02 Aug '13

02 Aug '13

From: Eric Dumazet <edumazet(a)google.com> Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git Git-commit: 7b70176421993866e616f1cbc4d0dd4054f1bf78 Patch-mainline: Queued in subsystem maintainer repo References: bnc#812116 On Mon, 2013-07-29 at 08:30 -0700, Eric Dumazet wrote: > On Mon, 2013-07-29 at 13:09 +0100, Luis Henriques wrote: > > > > > I confirm that I can't reproduce the issue using this patch. > > > > Thanks, I'll send a polished patch, as this one had an error if > build_skb() returns NULL (in case sk_buff allocation fails) Please try the following patch : It should use 2K frags instead of 4K for normal 1500 mtu Thanks ! [PATCH] atl1c: use custom skb allocator We had reports ( https://bugzilla.kernel.org/show_bug.cgi?id=54021 ) that using high order pages for skb allocations is problematic for atl1c We do not know exactly what the problem is, but we suspect that crossing 4K pages is not well supported by this hardware. Use a custom allocator, using page allocator and 2K fragments for optimal stack behavior. We might make this allocator generic in future kernels. Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Luis Henriques <luis.henriques(a)canonical.com> Cc: Neil Horman <nhorman(a)tuxdriver.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Acked-by: David Chang <dchang(a)suse.com> --- Target: openSUSE12.3 drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 + drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 40 +++++++++++++++++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/atheros/atl1c/atl1c.h +++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h @@ -520,6 +520,9 @@ struct atl1c_adapter { struct net_device *netdev; struct pci_dev *pdev; struct napi_struct napi; + struct page *rx_page; + unsigned int rx_page_offset; + unsigned int rx_frag_size; struct atl1c_hw hw; struct atl1c_hw_stats hw_stats; struct mii_if_info mii; /* MII interface info */ --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c @@ -482,10 +482,15 @@ static int atl1c_set_mac_addr(struct net static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter, struct net_device *dev) { + unsigned int head_size; int mtu = dev->mtu; adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ? roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE; + + head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) + + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); + adapter->rx_frag_size = roundup_pow_of_two(head_size); } static netdev_features_t atl1c_fix_features(struct net_device *netdev, @@ -953,6 +958,10 @@ static void atl1c_free_ring_resources(st kfree(adapter->tpd_ring[0].buffer_info); adapter->tpd_ring[0].buffer_info = NULL; } + if (adapter->rx_page) { + put_page(adapter->rx_page); + adapter->rx_page = NULL; + } } /** @@ -1642,6 +1651,35 @@ static inline void atl1c_rx_checksum(str skb_checksum_none_assert(skb); } +static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter) +{ + struct sk_buff *skb; + struct page *page; + + if (adapter->rx_frag_size > PAGE_SIZE) + return netdev_alloc_skb(adapter->netdev, + adapter->rx_buffer_len); + + page = adapter->rx_page; + if (!page) { + adapter->rx_page = page = alloc_page(GFP_ATOMIC); + if (unlikely(!page)) + return NULL; + adapter->rx_page_offset = 0; + } + + skb = build_skb(page_address(page) + adapter->rx_page_offset, + adapter->rx_frag_size); + if (likely(skb)) { + adapter->rx_page_offset += adapter->rx_frag_size; + if (adapter->rx_page_offset >= PAGE_SIZE) + adapter->rx_page = NULL; + else + get_page(page); + } + return skb; +} + static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter) { struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring; @@ -1662,7 +1700,7 @@ static int atl1c_alloc_rx_buffer(struct while (next_info->flags & ATL1C_BUFFER_FREE) { rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use); - skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len); + skb = atl1c_alloc_skb(adapter); if (unlikely(!skb)) { if (netif_msg_rx_err(adapter)) dev_warn(&pdev->dev, "alloc rx buffer failed\n"); -- To unsubscribe, e-mail: opensuse-kernel+unsubscribe(a)opensuse.org To contact the owner, e-mail: opensuse-kernel+owner(a)opensuse.org

2 2