Loading Documentation/ABI/testing/evm +24 −2 Original line number Diff line number Diff line Loading @@ -42,8 +42,30 @@ Description: modification of EVM-protected metadata and disable all further modification of policy Note that once a key has been loaded, it will no longer be possible to enable metadata modification. Echoing a value is additive, the new value is added to the existing initialization flags. For example, after:: echo 2 ><securityfs>/evm another echo can be performed:: echo 1 ><securityfs>/evm and the resulting value will be 3. Note that once an HMAC key has been loaded, it will no longer be possible to enable metadata modification. Signaling that an HMAC key has been loaded will clear the corresponding flag. For example, if the current value is 6 (2 and 4 set):: echo 1 ><securityfs>/evm will set the new value to 3 (4 cleared). Loading an HMAC key is the only way to disable metadata modification. Until key loading has been signaled EVM can not create or validate the 'security.evm' xattr, but returns Loading Documentation/admin-guide/device-mapper/dm-integrity.rst +6 −0 Original line number Diff line number Diff line Loading @@ -177,6 +177,12 @@ bitmap_flush_interval:number The bitmap flush interval in milliseconds. The metadata buffers are synchronized when this interval expires. legacy_recalculate Allow recalculating of volumes with HMAC keys. This is disabled by default for security reasons - an attacker could modify the volume, set recalc_sector to zero, and the kernel would not detect the modification. The journal mode (D/J), buffer_sectors, journal_watermark, commit_time can be changed when reloading the target (load an inactive table and swap the Loading Documentation/admin-guide/kernel-parameters.txt +10 −0 Original line number Diff line number Diff line Loading @@ -576,6 +576,12 @@ loops can be debugged more effectively on production systems. clocksource.max_cswd_read_retries= [KNL] Number of clocksource_watchdog() retries due to external delays before the clock will be marked unstable. Defaults to three retries, that is, four attempts to read the clock under test. clearcpuid=BITNUM[,BITNUM...] [X86] Disable CPUID feature X for the kernel. See arch/x86/include/asm/cpufeatures.h for the valid bit Loading Loading @@ -5467,6 +5473,10 @@ This option is obsoleted by the "nopv" option, which has equivalent effect for XEN platform. xen_no_vector_callback [KNL,X86,XEN] Disable the vector callback for Xen event channel interrupts. xen_scrub_pages= [XEN] Boolean option to control scrubbing pages before giving them back to Xen, for use by other domains. Can be also changed at runtime Loading Documentation/arm/memory.rst +6 −1 Original line number Diff line number Diff line Loading @@ -45,9 +45,14 @@ fffe8000 fffeffff DTCM mapping area for platforms with fffe0000 fffe7fff ITCM mapping area for platforms with ITCM mounted inside the CPU. ffc00000 ffefffff Fixmap mapping region. Addresses provided ffc80000 ffefffff Fixmap mapping region. Addresses provided by fix_to_virt() will be located here. ffc00000 ffc7ffff Guard region ff800000 ffbfffff Permanent, fixed read-only mapping of the firmware provided DT blob fee00000 feffffff Mapping of PCI I/O space. This is a static mapping within the vmalloc space. Loading Documentation/core-api/xarray.rst +9 −7 Original line number Diff line number Diff line Loading @@ -461,13 +461,15 @@ or iterations will move the index to the first index in the range. Each entry will only be returned once, no matter how many indices it occupies. Using xas_next() or xas_prev() with a multi-index xa_state is not supported. Using either of these functions on a multi-index entry will reveal sibling entries; these should be skipped over by the caller. Storing ``NULL`` into any index of a multi-index entry will set the entry at every index to ``NULL`` and dissolve the tie. Splitting a multi-index entry into entries occupying smaller ranges is not yet supported. Using xas_next() or xas_prev() with a multi-index xa_state is not supported. Using either of these functions on a multi-index entry will reveal sibling entries; these should be skipped over by the caller. Storing ``NULL`` into any index of a multi-index entry will set the entry at every index to ``NULL`` and dissolve the tie. A multi-index entry can be split into entries occupying smaller ranges by calling xas_split_alloc() without the xa_lock held, followed by taking the lock and calling xas_split(). Functions and structures ======================== Loading Loading
Documentation/ABI/testing/evm +24 −2 Original line number Diff line number Diff line Loading @@ -42,8 +42,30 @@ Description: modification of EVM-protected metadata and disable all further modification of policy Note that once a key has been loaded, it will no longer be possible to enable metadata modification. Echoing a value is additive, the new value is added to the existing initialization flags. For example, after:: echo 2 ><securityfs>/evm another echo can be performed:: echo 1 ><securityfs>/evm and the resulting value will be 3. Note that once an HMAC key has been loaded, it will no longer be possible to enable metadata modification. Signaling that an HMAC key has been loaded will clear the corresponding flag. For example, if the current value is 6 (2 and 4 set):: echo 1 ><securityfs>/evm will set the new value to 3 (4 cleared). Loading an HMAC key is the only way to disable metadata modification. Until key loading has been signaled EVM can not create or validate the 'security.evm' xattr, but returns Loading
Documentation/admin-guide/device-mapper/dm-integrity.rst +6 −0 Original line number Diff line number Diff line Loading @@ -177,6 +177,12 @@ bitmap_flush_interval:number The bitmap flush interval in milliseconds. The metadata buffers are synchronized when this interval expires. legacy_recalculate Allow recalculating of volumes with HMAC keys. This is disabled by default for security reasons - an attacker could modify the volume, set recalc_sector to zero, and the kernel would not detect the modification. The journal mode (D/J), buffer_sectors, journal_watermark, commit_time can be changed when reloading the target (load an inactive table and swap the Loading
Documentation/admin-guide/kernel-parameters.txt +10 −0 Original line number Diff line number Diff line Loading @@ -576,6 +576,12 @@ loops can be debugged more effectively on production systems. clocksource.max_cswd_read_retries= [KNL] Number of clocksource_watchdog() retries due to external delays before the clock will be marked unstable. Defaults to three retries, that is, four attempts to read the clock under test. clearcpuid=BITNUM[,BITNUM...] [X86] Disable CPUID feature X for the kernel. See arch/x86/include/asm/cpufeatures.h for the valid bit Loading Loading @@ -5467,6 +5473,10 @@ This option is obsoleted by the "nopv" option, which has equivalent effect for XEN platform. xen_no_vector_callback [KNL,X86,XEN] Disable the vector callback for Xen event channel interrupts. xen_scrub_pages= [XEN] Boolean option to control scrubbing pages before giving them back to Xen, for use by other domains. Can be also changed at runtime Loading
Documentation/arm/memory.rst +6 −1 Original line number Diff line number Diff line Loading @@ -45,9 +45,14 @@ fffe8000 fffeffff DTCM mapping area for platforms with fffe0000 fffe7fff ITCM mapping area for platforms with ITCM mounted inside the CPU. ffc00000 ffefffff Fixmap mapping region. Addresses provided ffc80000 ffefffff Fixmap mapping region. Addresses provided by fix_to_virt() will be located here. ffc00000 ffc7ffff Guard region ff800000 ffbfffff Permanent, fixed read-only mapping of the firmware provided DT blob fee00000 feffffff Mapping of PCI I/O space. This is a static mapping within the vmalloc space. Loading
Documentation/core-api/xarray.rst +9 −7 Original line number Diff line number Diff line Loading @@ -461,13 +461,15 @@ or iterations will move the index to the first index in the range. Each entry will only be returned once, no matter how many indices it occupies. Using xas_next() or xas_prev() with a multi-index xa_state is not supported. Using either of these functions on a multi-index entry will reveal sibling entries; these should be skipped over by the caller. Storing ``NULL`` into any index of a multi-index entry will set the entry at every index to ``NULL`` and dissolve the tie. Splitting a multi-index entry into entries occupying smaller ranges is not yet supported. Using xas_next() or xas_prev() with a multi-index xa_state is not supported. Using either of these functions on a multi-index entry will reveal sibling entries; these should be skipped over by the caller. Storing ``NULL`` into any index of a multi-index entry will set the entry at every index to ``NULL`` and dissolve the tie. A multi-index entry can be split into entries occupying smaller ranges by calling xas_split_alloc() without the xa_lock held, followed by taking the lock and calling xas_split(). Functions and structures ======================== Loading