kernel: Move to Linux v5.4.48-openpower1
This adds secure boot support backported from upstream and enables it
in the configuration.
Appearing in the backports is a patch to disable STRICT_KERNEL_RWX so
it drops out of the configuration.
Backported patches to support secureboot:
powerpc/ima: Fix secure boot rules in ima arch policy
powerpc/ima: Indicate kernel modules appended signatures are enforced
powerpc/xmon: Allow listing and clearing breakpoints in read-only mode
powerpc: Load firmware trusted keys/hashes into kernel keyring
x86/efi: move common keyring handler functions to new file
powerpc: expose secure variables to userspace via sysfs
powerpc/powernv: Add OPAL API interface to access secure variable
powerpc/ima: Update ima arch policy to check for blacklist
ima: Check against blacklisted hashes for files with modsig
certs: Add wrapper function to check blacklisted binary hash
ima: Make process_buffer_measurement() generic
powerpc/ima: Define trusted boot policy
powerpc: Detect the trusted boot state of the system
powerpc/ima: Add support to initialize ima policy rules
powerpc: Detect the secure boot mode of the system
PowerPC related fixes:
powerpc/64s: Save FSCR to init_task.thread.fscr after feature init
powerpc/64s: Don't let DT CPU features set FSCR_DSCR
powerpc/kasan: Fix shadow pages allocation failure
powerpc/kasan: Fix issues by lowering KASAN_SHADOW_END
powerpc/fadump: Account for memory_limit while reserving memory
powerpc/fadump: consider reserved ranges while reserving memory
powerpc/fadump: use static allocation for reserved memory ranges
powerpc/mm: Fix conditions to perform MMU specific management by blocks on PPC32.
powerpc/spufs: fix copy_to_user while atomic
sched/core: Fix illegal RCU from offline CPUs
powerpc/ptdump: Properly handle non standard page size
powerpc/xive: Clear the page tables for the ESB IO mapping
bpf: Support llvm-objcopy for vmlinux BTF
powerpc/xmon: Restrict when kernel is locked down
powerpc/powernv: Avoid re-registration of imc debugfs directory
powerpc/64s: Disable STRICT_KERNEL_RWX
powerpc: Remove STRICT_KERNEL_RWX incompatibility with RELOCATABLE
powerpc/mm: Fix CONFIG_PPC_KUAP_DEBUG on PPC32
powerpc/kuap: PPC_KUAP_DEBUG should depend on PPC_KUAP
powerpc/setup_64: Set cache-line-size based on cache-block-size
Revert "powerpc/64: irq_work avoid interrupt when called with hardware irqs enabled"
Signed-off-by: Joel Stanley <joel@jms.id.au>
diff --git a/openpower/linux/0014-powerpc-xmon-Allow-listing-and-clearing-breakpoints-.patch b/openpower/linux/0014-powerpc-xmon-Allow-listing-and-clearing-breakpoints-.patch
new file mode 100644
index 0000000..c04e5fb
--- /dev/null
+++ b/openpower/linux/0014-powerpc-xmon-Allow-listing-and-clearing-breakpoints-.patch
@@ -0,0 +1,73 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Christopher M. Riedl" <cmr@informatik.wtf>
+Date: Sat, 7 Sep 2019 01:11:23 -0500
+Subject: [PATCH 14/18] powerpc/xmon: Allow listing and clearing breakpoints in
+ read-only mode
+
+Read-only mode should not prevent listing and clearing any active
+breakpoints.
+
+Tested-by: Daniel Axtens <dja@axtens.net>
+Reviewed-by: Daniel Axtens <dja@axtens.net>
+Signed-off-by: Christopher M. Riedl <cmr@informatik.wtf>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190907061124.1947-2-cmr@informatik.wtf
+(cherry picked from commit 96664dee5cf1815777286227b09884b4f019727f)
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+---
+ arch/powerpc/xmon/xmon.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 6d130c89fbd8..ab6371aedfcb 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -1096,10 +1096,6 @@ cmds(struct pt_regs *excp)
+ set_lpp_cmd();
+ break;
+ case 'b':
+- if (xmon_is_ro) {
+- printf(xmon_ro_msg);
+- break;
+- }
+ bpt_cmds();
+ break;
+ case 'C':
+@@ -1368,11 +1364,16 @@ bpt_cmds(void)
+ struct bpt *bp;
+
+ cmd = inchar();
++
+ switch (cmd) {
+ #ifndef CONFIG_PPC_8xx
+ static const char badaddr[] = "Only kernel addresses are permitted for breakpoints\n";
+ int mode;
+ case 'd': /* bd - hardware data breakpoint */
++ if (xmon_is_ro) {
++ printf(xmon_ro_msg);
++ break;
++ }
+ if (!ppc_breakpoint_available()) {
+ printf("Hardware data breakpoint not supported on this cpu\n");
+ break;
+@@ -1400,6 +1401,10 @@ bpt_cmds(void)
+ break;
+
+ case 'i': /* bi - hardware instr breakpoint */
++ if (xmon_is_ro) {
++ printf(xmon_ro_msg);
++ break;
++ }
+ if (!cpu_has_feature(CPU_FTR_ARCH_207S)) {
+ printf("Hardware instruction breakpoint "
+ "not supported on this cpu\n");
+@@ -1458,7 +1463,8 @@ bpt_cmds(void)
+ break;
+ }
+ termch = cmd;
+- if (!scanhex(&a)) {
++
++ if (xmon_is_ro || !scanhex(&a)) {
+ /* print all breakpoints */
+ printf(" type address\n");
+ if (dabr.enabled) {