kernel.git/Documentation/userspace-api/index.rst, branch linux-6.10.y

mm/memfd: add documentation for MFD_NOEXEC_SEAL MFD_EXEC

2024-06-15T17:43:07Z

When MFD_NOEXEC_SEAL was introduced, there was one big mistake: it didn't have proper documentation. This led to a lot of confusion, especially about whether or not memfd created with the MFD_NOEXEC_SEAL flag is sealable. Before MFD_NOEXEC_SEAL, memfd had to explicitly set MFD_ALLOW_SEALING to be sealable, so it's a fair question. As one might have noticed, unlike other flags in memfd_create, MFD_NOEXEC_SEAL is actually a combination of multiple flags. The idea is to make it easier to use memfd in the most common way, which is NOEXEC + F_SEAL_EXEC + MFD_ALLOW_SEALING. This works with sysctl vm.noexec to help existing applications move to a more secure way of using memfd. Proposals have been made to put MFD_NOEXEC_SEAL non-sealable, unless MFD_ALLOW_SEALING is set, to be consistent with other flags [1], Those are based on the viewpoint that each flag is an atomic unit, which is a reasonable assumption. However, MFD_NOEXEC_SEAL was designed with the intent of promoting the most secure method of using memfd, therefore a combination of multiple functionalities into one bit. Furthermore, the MFD_NOEXEC_SEAL has been added for more than one year, and multiple applications and distributions have backported and utilized it. Altering ABI now presents a degree of risk and may lead to disruption. MFD_NOEXEC_SEAL is a new flag, and applications must change their code to use it. There is no backward compatibility problem. When sysctl vm.noexec == 1 or 2, applications that don't set MFD_NOEXEC_SEAL or MFD_EXEC will get MFD_NOEXEC_SEAL memfd. And old-application might break, that is by-design, in such a system vm.noexec = 0 shall be used. Also no backward compatibility problem. I propose to include this documentation patch to assist in clarifying the semantics of MFD_NOEXEC_SEAL, thereby preventing any potential future confusion. Finally, I would like to express my gratitude to David Rheinsberg and Barnabás Pőcze for initiating the discussion on the topic of sealability. [1] https://lore.kernel.org/lkml/20230714114753.170814-1-david@readahead.eu/ [jeffxu@chromium.org: updates per Randy] Link: https://lkml.kernel.org/r/20240611034903.3456796-2-jeffxu@chromium.org [jeffxu@chromium.org: v3] Link: https://lkml.kernel.org/r/20240611231409.3899809-2-jeffxu@chromium.org Link: https://lkml.kernel.org/r/20240607203543.2151433-2-jeffxu@google.com Signed-off-by: Jeff Xu Reviewed-by: Randy Dunlap Cc: Aleksa Sarai Cc: Barnabás Pőcze Cc: Daniel Verkamp Cc: David Rheinsberg Cc: Dmitry Torokhov Cc: Hugh Dickins Cc: Jorge Lucangeli Obes Cc: Kees Cook Cc: Shuah Khan Signed-off-by: Andrew Morton

mseal: add documentation

2024-05-24T02:40:26Z

Add documentation for mseal(). Link: https://lkml.kernel.org/r/20240415163527.626541-5-jeffxu@chromium.org Signed-off-by: Jeff Xu Reviewed-by: Kees Cook Reviewed-by: Liam R. Howlett Cc: Dave Hansen Cc: Greg Kroah-Hartman Cc: Guenter Roeck Cc: Jann Horn Cc: Jeff Xu Cc: Jonathan Corbet Cc: Jorge Lucangeli Obes Cc: Linus Torvalds Cc: Matthew Wilcox (Oracle) Cc: Muhammad Usama Anjum Cc: Pedro Falcato Cc: Stephen Röttger Cc: Suren Baghdasaryan Cc: Amer Al Shanawany Cc: Javier Carrasco Cc: Shuah Khan Signed-off-by: Andrew Morton

Merge tag 'gpio-updates-for-v6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

2024-03-13T18:14:55Z

Pull gpio updates from Bartosz Golaszewski: "The biggest feature is the locking overhaul. Up until now the synchronization in the GPIO subsystem was broken. There was a single spinlock "protecting" multiple data structures but doing it wrong (as evidenced by several places where it would be released when a sleeping function was called and then reacquired without checking the protected state). We tried to use an RW semaphore before but the main issue with GPIO is that we have drivers implementing the interfaces in both sleeping and non-sleeping ways as well as user-facing interfaces that can be called both from process as well as atomic contexts. Both ends converge in the same code paths that can use neither spinlocks nor mutexes. The only reasonable way out is to use SRCU and go mostly lockless. To that end: we add several SRCU structs in relevant places and use them to assure consistency between API calls together with atomic reads and writes of GPIO descriptor flags where it makes sense. This code has spent several weeks in next and has received several fixes in the first week or two after which it stabilized nicely. The GPIO subsystem is now resilient to providers being suddenly unbound. We managed to also remove the existing character device RW semaphore and the obsolete global spinlock. Other than the locking rework we have one new driver (for Chromebook EC), much appreciated documentation improvements from Kent and the regular driver improvements, DT-bindings updates and GPIOLIB core tweaks. Serialization rework: - use SRCU to serialize access to the global GPIO device list, to GPIO device structs themselves and to GPIO descriptors - make the GPIO subsystem resilient to the GPIO providers being unbound while the API calls are in progress - don't dereference the SRCU-protected chip pointer if the information we need can be obtained from the GPIO device structure - move some of the information contained in struct gpio_chip to struct gpio_device to further reduce the need to dereference the former - pass the GPIO device struct instead of the GPIO chip to sysfs callback to, again, reduce the need for accessing the latter - get GPIO descriptors from the GPIO device, not from the chip for the same reason - allow for mostly lockless operation of the GPIO driver API: assure consistency with SRCU and atomic operations - remove the global GPIO spinlock - remove the character device RW semaphore Core GPIOLIB: - constify pointers in GPIO API where applicable - unify the GPIO counting APIs for ACPI and OF - provide a macro for iterating over all GPIOs, not only the ones that are requested - remove leftover typedefs - pass the consumer device to GPIO core in devm_fwnode_gpiod_get_index() for improved logging - constify the GPIO bus type - don't warn about removing GPIO chips with descriptors still held by users as we can now handle this situation gracefully - remove unused logging helpers - unexport functions that are only used internally in the GPIO subsystem - set the device type (assign the relevant struct device_type) for GPIO devices New drivers: - add the ChromeOS EC GPIO driver Driver improvements: - allow building gpio-vf610 with COMPILE_TEST as well as disabling it in menuconfig (before it was always built for i.MX cofigs) - count the number of EICs using the device properties instead of hard-coding it in gpio-eic-sprd - improve the device naming, extend the debugfs output and add lockdep asserts to gpio-sim DT bindings: - document the 'label' property for gpio-pca9570 - convert aspeed,ast2400-gpio bindings to DT schema - disallow unevaluated properties for gpio-mvebu - document a new model in renesas,rcar-gpio Documentation: - improve the character device kerneldocs in user-space headers - add proper documentation for the character device uAPI (both v1 and v2) - move the sysfs and gpio-mockup docs into the "obsolete" section - improve naming consistency for GPIO terms - clarify the line values description for sysfs - minor docs improvements - improve the driver API contract for setting GPIO direction - mark unsafe APIs as deprecated in kerneldocs and suggest replacements Other: - remove an obsolete test from selftests" * tag 'gpio-updates-for-v6.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (79 commits) gpio: sysfs: repair export returning -EPERM on 1st attempt selftest: gpio: remove obsolete gpio-mockup test gpiolib: Deduplicate cleanup for-loop in gpiochip_add_data_with_key() dt-bindings: gpio: aspeed,ast2400-gpio: Convert to DT schema gpio: acpi: Make acpi_gpio_count() take firmware node as a parameter gpio: of: Make of_gpio_get_count() take firmware node as a parameter gpiolib: Pass consumer device through to core in devm_fwnode_gpiod_get_index() gpio: sim: use for_each_hwgpio() gpio: provide for_each_hwgpio() gpio: don't warn about removing GPIO chips with active users anymore gpio: sim: delimit the fwnode name with a ":" when generating labels gpio: sim: add lockdep asserts gpio: Add ChromeOS EC GPIO driver gpio: constify of_phandle_args in of_find_gpio_device_by_xlate() gpio: fix memory leak in gpiod_request_commit() gpio: constify opaque pointer "data" in gpio_device_find() gpio: cdev: fix a NULL-pointer dereference with DEBUG enabled gpio: uapi: clarify default_values being logical gpio: sysfs: fix inverted pointer logic gpio: don't let lockdep complain about inherently dangerous RCU usage ...

Documentation: userspace-api: Document perf ring buffer mechanism

2024-01-30T20:49:02Z

In the Linux perf tool, the ring buffer serves not only as a medium for transferring PMU event data but also as a vital mechanism for hardware tracing using technologies like Intel PT and Arm CoreSight, etc. Consequently, the ring buffer mechanism plays a crucial role by ensuring high throughput for data transfer between the kernel and user space while avoiding excessive overhead caused by the ring buffer itself. This commit documents the ring buffer mechanism in detail. It explains the implementation of both the regular ring buffer and the AUX ring buffer. Additionally, it covers how these ring buffers support various tracing modes and explains the synchronization with memory barriers. Signed-off-by: Leo Yan Reviewed-by: James Clark Reviewed-by: Namhyung Kim Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20240102085001.228815-1-leo.yan@linaro.org

docs: rework the userspace-api top page

2024-01-30T20:47:56Z

Add some subsection headings and reorder entries so that the page makes a bit more sense. With luck, adding some ordering will also reduce merge conflicts due to everybody adding new entries at the end. Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/87ttn5m2q1.fsf@meer.lwn.net

Documentation: gpio: add chardev userspace API documentation

2024-01-22T09:47:14Z

Add documentation for the GPIO character device userspace API. Added to the userspace-api book, but also provide a link from the admin-guide book, as historically the GPIO documentation has been there. Signed-off-by: Kent Gibson Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski

Merge tag 'docs-6.8' of git://git.lwn.net/linux

2024-01-12T03:46:52Z

Pull documentation update from Jonathan Corbet: "Another moderately busy cycle for documentation, including: - The minimum Sphinx requirement has been raised to 2.4.4, following a warning that was added in 6.2 - Some reworking of the Documentation/process front page to, hopefully, make it more useful - Various kernel-doc tweaks to, for example, make it deal properly with __counted_by annotations - We have also restored a warning for documentation of nonexistent structure members that disappeared a while back. That had the delightful consequence of adding some 600 warnings to the docs build. A sustained effort by Randy, Vegard, and myself has addressed almost all of those, bringing the documentation back into sync with the code. The fixes are going through the appropriate maintainer trees - Various improvements to the HTML rendered docs, including automatic links to Git revisions and a nice new pulldown to make translations easy to access - Speaking of translations, more of those for Spanish and Chinese ... plus the usual stream of documentation updates and typo fixes" * tag 'docs-6.8' of git://git.lwn.net/linux: (57 commits) MAINTAINERS: use tabs for indent of CONFIDENTIAL COMPUTING THREAT MODEL A reworked process/index.rst ring-buffer/Documentation: Add documentation on buffer_percent file Translated the RISC-V architecture boot documentation. Docs: remove mentions of fdformat from util-linux Docs/zh_CN: Fix the meaning of DEBUG to pr_debug() Documentation: move driver-api/dcdbas to userspace-api/ Documentation: move driver-api/isapnp to userspace-api/ Documentation/core-api : fix typo in workqueue Documentation/trace: Fixed typos in the ftrace FLAGS section kernel-doc: handle a void function without producing a warning scripts/get_abi.pl: ignore some temp files docs: kernel_abi.py: fix command injection scripts/get_abi: fix source path leak CREDITS, MAINTAINERS, docs/process/howto: Update man-pages' maintainer docs: translations: add translations links when they exist kernel-doc: Align quick help and the code MAINTAINERS: add reviewer for Spanish translations docs: ignore __counted_by attribute in structure definitions scripts: kernel-doc: Clarify missing struct member description ..

Documentation: move driver-api/dcdbas to userspace-api/

2024-01-03T21:17:40Z

This file documents a sysfs interface that is intended for systems management software. It does NOT document any kind of kernel driver API. It is also not meant to be used directly by system administrators or users. Cc: Stuart Hayes Cc: platform-driver-x86@vger.kernel.org Signed-off-by: Vegard Nossum Acked-by: Hans de Goede Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231221124816.2978000-3-vegard.nossum@oracle.com

Documentation: move driver-api/isapnp to userspace-api/

2024-01-03T21:17:39Z

driver-api/isapnp documents /proc interfaces for interfacing directly with ISA Plug & Play devices, not any kind of API for kernel developers, and should thus also live under userspace-api/. Also fix a few issues while we're at it. Cc: Jaroslav Kysela Cc: Mauro Carvalho Chehab Cc: Alexandre Belloni Cc: Bartlomiej Zolnierkiewicz Signed-off-by: Vegard Nossum Reviewed-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231221124816.2978000-2-vegard.nossum@oracle.com

Documentation: Destage TEE subsystem documentation

2023-12-08T22:45:10Z

Add a separate documentation directory for TEE subsystem since it is a standalone subsystem which already offers devices consumed by multiple different subsystem drivers. Split overall TEE subsystem documentation modularly where: - The userspace API has been moved to Documentation/userspace-api/tee.rst. - The driver API has been moved to Documentation/driver-api/tee.rst. - The first module covers the overview of TEE subsystem. - The further modules are dedicated to different TEE implementations like: - OP-TEE - AMD-TEE - and so on for future TEE implementation support. Acked-by: Rijo Thomas Acked-by: Jens Wiklander Signed-off-by: Sumit Garg Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20231128072352.866859-1-sumit.garg@linaro.org