starlingx
/
integ
Code Issues Proposed changes

Upgrade rt kernel patch to CentOS7.6 3.10.0-957.12.2 

New set of CVEs was reported against Intel CPUs: CVE-2018-12126,
CVE-2018-12127, CVE-2018-12130 and CVE-2019-11091.
For these CVEs there are RH and CentOS updates available.

CVE-2018-12126:
Microarchitectural Store Buffer Data Sampling (MSBDS):
Store buffers on some microprocessors utilizing speculative
execution may allow an authenticated user to potentially
enable information disclosure via a side channel with local access.
A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVE-2018-12127:
Microarchitectural Load Port Data Sampling (MLPDS):
Load ports on some microprocessors utilizing speculative execution
may allow an authenticated user to potentially enable information
disclosure via a side channel with local access. A list of impacted
products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVE-2018-12130:
Microarchitectural Fill Buffer Data Sampling (MFBDS):
Fill buffers on some microprocessors utilizing speculative execution
may allow an authenticated user to potentially enable information
disclosure via a side channel with local access. A list of impacted
products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

CVE-2019-11091:
Microarchitectural Data Sampling Uncacheable Memory(MDSUM):
Uncacheable memory on some microprocessors utilizing speculative
execution may allow an authenticated user to potentially enable
information disclosure via a side channel with local access.
A list of impacted products can be found here:
https://www.intel.com/content/dam/www/public/us/en/documents/
corporate-information/SA00233-microcode-update-guidance_05132019.pdf

These are from the http://cve.mitre.org website.
These are the MDS security CVEs.

The patch is modified as follows:
1.Delete the 929-931 line of the arch/x86/kernel/cpu/cacheinfo.c
  file,
  because starlingx's Porting-Cacheinfo-from-Kernel-4.10.17.patch
  removes the ici_cpuid4_info structure.

2.Except for the modification of the file in 1, the other patches
  only modify the line number.

Closes-Bug: 1830487
Depends-On: https://review.opendev.org/663071
Change-Id: I16ac63df21eeb85b4fc3ab19d539986e77c8c0d3
Signed-off-by: zhiguo.zhang <zhiguox.zhang@intel.com>
This commit is contained in:
zhiguo.zhang 2019-06-05 00:16:44 +08:00
parent 6c7632be90
commit d4aebcaf91
7 changed files with 57 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
kernel/kernel-rt/centos/meta_patches/Build-logic-and-sources-for-TiC.patch
View File

@ -309,7 +309,7 @@ index c05b910..dfbbe1f 100644
$CopyKernel $KernelImage $RPM_BUILD_ROOT/%{image_install_path}/$InstallName-$KernelVer
chmod 755 $RPM_BUILD_ROOT/%{image_install_path}/$InstallName-$KernelVer
@@ -910,6 +1032,12 @@ BuildKernel() {
@@ -913,6 +1035,12 @@ BuildKernel() {
cp signing_key.priv signing_key.priv.sign${Flavour:+.${Flavour}}
cp signing_key.x509 signing_key.x509.sign${Flavour:+.${Flavour}}
@ -322,7 +322,7 @@ index c05b910..dfbbe1f 100644
# remove files that will be auto generated by depmod at rpm -i time
for i in alias alias.bin builtin.bin ccwmap dep dep.bin ieee1394map inputmap isapnpmap ofmap pcimap seriomap symbols symbols.bin usbmap softdep devname
do
@@ -925,6 +1053,15 @@ BuildKernel() {
@@ -928,6 +1056,15 @@ BuildKernel() {
install -Dm644 %{SOURCE1000} $RPM_BUILD_ROOT%{_sysconfdir}/modprobe.d/dccp-blacklist.conf
@ -338,7 +338,7 @@ index c05b910..dfbbe1f 100644
# prune junk from kernel-devel
find $RPM_BUILD_ROOT/usr/src/kernels -name ".*.cmd" -exec rm -f {} \;
}
@@ -972,6 +1109,31 @@ BuildKernel %make_target %kernel_image vanilla
@@ -975,6 +1112,31 @@ BuildKernel %make_target %kernel_image vanilla
BuildKernel %make_target %kernel_image
%endif
@ -370,7 +370,7 @@ index c05b910..dfbbe1f 100644
%if %{builddoc}
# Make the HTML and man pages.
make -j1 htmldocs mandocs || %{doc_build_fail}
@@ -1004,6 +1166,7 @@ popd
@@ -1007,6 +1169,7 @@ popd
# if it isn't.
%ifnarch noarch
@ -378,7 +378,7 @@ index c05b910..dfbbe1f 100644
%define __modsign_install_post \
if [ "%{with_rt}" -ne "0" ]; then \
Arch=`head -1 configs/kernel-%{version}-%{_target_cpu}-rt.config | cut -b 3-` \
@@ -1022,6 +1185,24 @@ popd
@@ -1025,6 +1188,24 @@ popd
%{modsign_cmd} $RPM_BUILD_ROOT/lib/modules/%{KVERREL}.${AAA} || exit 1 \
done \
%{nil}
@ -403,7 +403,7 @@ index c05b910..dfbbe1f 100644
%endif
###
@@ -1111,6 +1292,39 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/perf
@@ -1114,6 +1295,39 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/perf
%endif # buildperf
%endif
@ -443,7 +443,7 @@ index c05b910..dfbbe1f 100644
%if %{buildheaders}
# Install kernel headers
make ARCH=%{hdrarch} INSTALL_HDR_PATH=$RPM_BUILD_ROOT/usr headers_install
@@ -1165,6 +1379,14 @@ rm -rf $RPM_BUILD_ROOT
@@ -1168,6 +1382,14 @@ rm -rf $RPM_BUILD_ROOT
### scripts
###
@ -458,7 +458,7 @@ index c05b910..dfbbe1f 100644
#
# This macro defines a %%post script for a kernel*-devel package.
# %%kernel_devel_post [<subpackage>]
@@ -1328,6 +1550,43 @@ fi
@@ -1331,6 +1553,43 @@ fi
%endif
%endif
@ -502,7 +502,7 @@ index c05b910..dfbbe1f 100644
# This is %{image_install_path} on an arch where that includes ELF files,
# or empty otherwise.
%global elf_image_install_path %{?kernel_image_elf:%{image_install_path}}
@@ -1344,6 +1603,7 @@ fi
@@ -1347,6 +1606,7 @@ fi
/%{image_install_path}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?2:.%{2}}\
/%{image_install_path}/.vmlinuz-%{KVERREL}%{?2:.%{2}}.hmac\
/boot/System.map-%{KVERREL}%{?2:.%{2}}\
@ -510,7 +510,7 @@ index c05b910..dfbbe1f 100644
/boot/config-%{KVERREL}%{?2:.%{2}}\
%exclude /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/arch/x86/kvm\
%exclude /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/drivers/gpu/drm/i915/gvt\
@@ -1422,6 +1682,11 @@ fi
@@ -1427,6 +1687,11 @@ fi
%kernel_variant_files %{buildvanilla} vanilla
%endif
@ -520,8 +520,8 @@ index c05b910..dfbbe1f 100644
+%endif # do_sign
+
%changelog
* Thu Nov 15 2018 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [3.10.0-957.1.3.rt56.913.el7]
- [rt] Update source tree to match RHEL 7.6.z tree [1632386 1642619]
* Fri Apr 26 2019 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [3.10.0-957.12.2.rt56.929.el7]
- [rt] Update source tree to match RHEL 7.6.z tree [1689417 1642619]
--
2.7.4

2
kernel/kernel-rt/centos/patches/Notification-of-death-of-arbitrary-processes.patch
View File

@ -65,7 +65,7 @@ diff --git a/include/linux/sched.h b/include/linux/sched.h
index 97ff026..0785453 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1682,6 +1682,12 @@ struct task_struct {
@@ -1686,6 +1686,12 @@ struct task_struct {
short il_next;
short pref_node_fork;
#endif

71
kernel/kernel-rt/centos/patches/Porting-Cacheinfo-from-Kernel-4.10.17.patch
View File

@ -47,13 +47,13 @@ This helps in:
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
---
Documentation/ABI/testing/sysfs-devices-system-cpu | 65 ++
arch/x86/kernel/cpu/cacheinfo.c | 830 +++++++--------------
arch/x86/kernel/cpu/cacheinfo.c | 833 +++++++--------------
drivers/base/Makefile | 2 +-
drivers/base/cacheinfo.c | 662 ++++++++++++++++
drivers/base/cpu.c | 54 ++
include/linux/cacheinfo.h | 104 +++
include/linux/cpu.h | 3 +
7 files changed, 1147 insertions(+), 573 deletions(-)
7 files changed, 1147 insertions(+), 576 deletions(-)
create mode 100644 drivers/base/cacheinfo.c
create mode 100644 include/linux/cacheinfo.h
@ -461,7 +461,7 @@ index d529019..bf23bd2 100644
+
+ if (nb && nb->l3_cache.indices)
+ init_amd_l3_attrs();
+
+ return &cache_private_group;
+}
+
@ -472,7 +472,7 @@ index d529019..bf23bd2 100644
+ /* only for L3, and not in virtualized environments */
+ if (index < 3)
+ return;
+
+ node = amd_get_nb_id(smp_processor_id());
+ this_leaf->nb = node_to_amd_nb(node);
+ if (this_leaf->nb && !this_leaf->nb->l3_cache.indices)
@ -798,11 +798,11 @@ index d529019..bf23bd2 100644
+static int __init_cache_level(unsigned int cpu)
{
- int i;
-
- for (i = 0; i < num_cache_leaves; i++)
- cache_remove_shared_cpu_map(cpu, i);
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- for (i = 0; i < num_cache_leaves; i++)
- cache_remove_shared_cpu_map(cpu, i);
-
- kfree(per_cpu(ici_cpuid4_info, cpu));
- per_cpu(ici_cpuid4_info, cpu) = NULL;
+ if (!num_cache_leaves)
@ -815,17 +815,20 @@ index d529019..bf23bd2 100644
}
/*
@@ -925,411 +985,37 @@ static void get_cache_id(int cpu, struct _cpuid4_info_regs *id4_regs)
@@ -925,414 +985,37 @@ static void get_cache_id(int cpu, struct _cpuid4_info_regs *id4_regs)
int get_cpu_cache_id(int cpu, int level)
{
int i;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
- for (i = 0; i < num_cache_leaves; i++) {
- struct _cpuid4_info *this_leaf = CPUID4_INFO_IDX(cpu, i);
- if (!per_cpu(ici_cpuid4_info, cpu))
- return -1;
+ for (i = 0; i < this_cpu_ci->num_leaves; i++) {
+ struct cacheinfo *this_leaf = this_cpu_ci->info_list + i;
- for (i = 0; i < num_cache_leaves; i++) {
- struct _cpuid4_info *this_leaf = CPUID4_INFO_IDX(cpu, i);
-
- if (this_leaf->base.eax.split.level == level)
- return this_leaf->base.id;
+ if (this_leaf->level == level)
@ -836,13 +839,18 @@ index d529019..bf23bd2 100644
}
-static void get_cpu_leaves(void *_retval)
-{
+static int __populate_cache_leaves(unsigned int cpu)
{
- int j, *retval = _retval, cpu = smp_processor_id();
-
- /* Do cpuid and store the results */
- for (j = 0; j < num_cache_leaves; j++) {
- struct _cpuid4_info *this_leaf = CPUID4_INFO_IDX(cpu, j);
-
+ unsigned int idx, ret;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+ struct _cpuid4_info_regs id4_regs = {};
- *retval = cpuid4_cache_lookup_regs(j, &this_leaf->base);
- if (unlikely(*retval < 0)) {
- int i;
@ -853,13 +861,21 @@ index d529019..bf23bd2 100644
- }
- cache_shared_cpu_map_setup(cpu, j);
- get_cache_id(cpu, &this_leaf->base);
- }
+ for (idx = 0; idx < this_cpu_ci->num_leaves; idx++) {
+ ret = cpuid4_cache_lookup_regs(idx, &id4_regs);
+ if (ret)
+ return ret;
+ get_cache_id(cpu, &id4_regs);
+ ci_leaf_init(this_leaf++, &id4_regs);
+ __cache_cpumap_setup(cpu, idx, &id4_regs);
}
-}
-
-static int detect_cache_attributes(unsigned int cpu)
-{
- int retval;
-
+ this_cpu_ci->cpu_map_populated = true;
- if (num_cache_leaves == 0)
- return -ENOENT;
-
@ -1116,8 +1132,7 @@ index d529019..bf23bd2 100644
-
-/* Add/Remove cache interface for CPU device */
-static int cache_add_dev(struct device *dev)
+static int __populate_cache_leaves(unsigned int cpu)
{
-{
- unsigned int cpu = dev->id;
- unsigned long i, j;
- struct _index_kobject *this_object;
@ -1140,11 +1155,7 @@ index d529019..bf23bd2 100644
- this_object = INDEX_KOBJECT_PTR(cpu, i);
- this_object->cpu = cpu;
- this_object->index = i;
+ unsigned int idx, ret;
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
+ struct cacheinfo *this_leaf = this_cpu_ci->info_list;
+ struct _cpuid4_info_regs id4_regs = {};
-
- this_leaf = CPUID4_INFO_IDX(cpu, i);
-
- ktype_cache.default_attrs = default_attrs;
@ -1164,17 +1175,9 @@ index d529019..bf23bd2 100644
- return retval;
- }
- kobject_uevent(&(this_object->kobj), KOBJ_ADD);
+ for (idx = 0; idx < this_cpu_ci->num_leaves; idx++) {
+ ret = cpuid4_cache_lookup_regs(idx, &id4_regs);
+ if (ret)
+ return ret;
+ get_cache_id(cpu, &id4_regs);
+ ci_leaf_init(this_leaf++, &id4_regs);
+ __cache_cpumap_setup(cpu, idx, &id4_regs);
}
- }
- cpumask_set_cpu(cpu, to_cpumask(cache_dev_map));
+ this_cpu_ci->cpu_map_populated = true;
-
- kobject_uevent(per_cpu(ici_cache_kobject, cpu), KOBJ_ADD);
return 0;
}
@ -2107,9 +2110,9 @@ diff --git a/include/linux/cpu.h b/include/linux/cpu.h
index a5dd694..ceaa393 100644
--- a/include/linux/cpu.h
+++ b/include/linux/cpu.h
@@ -49,6 +49,9 @@ extern ssize_t cpu_show_spec_store_bypass(struct device *dev,
extern ssize_t cpu_show_l1tf(struct device *dev,
struct device_attribute *attr, char *buf);
@@ -51,6 +51,9 @@ extern ssize_t cpu_show_l1tf(struct device *dev,
extern ssize_t cpu_show_mds(struct device *dev,
struct device_attribute *attr, char *buf);
+extern struct device *cpu_device_create(struct device *parent, void *drvdata,
+ const struct attribute_group **groups,

8
kernel/kernel-rt/centos/patches/US101216-IMA-support-in-Titanium-kernel.patch
View File

@ -229,7 +229,7 @@ diff --git a/security/security.c b/security/security.c
index f069482..646a0e3 100644
--- a/security/security.c
+++ b/security/security.c
@@ -157,6 +157,110 @@ EXPORT_SYMBOL(unregister_lsm_notifier);
@@ -161,6 +161,110 @@ EXPORT_SYMBOL(unregister_lsm_notifier);
/* Security operations */
@ -340,7 +340,7 @@ index f069482..646a0e3 100644
int security_ptrace_access_check(struct task_struct *child, unsigned int mode)
{
#ifdef CONFIG_SECURITY_YAMA_STACKED
@@ -716,8 +820,11 @@ EXPORT_SYMBOL(security_inode_listsecurity);
@@ -720,8 +824,11 @@ EXPORT_SYMBOL(security_inode_listsecurity);
void security_inode_getsecid(struct inode *inode, u32 *secid)
{
@ -353,7 +353,7 @@ index f069482..646a0e3 100644
int security_inode_copy_up(struct dentry *src, struct cred **new)
{
@@ -1526,6 +1633,7 @@ int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
@@ -1530,6 +1637,7 @@ int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
{
return security_ops->audit_rule_init(field, op, rulestr, lsmrule);
}
@ -361,7 +361,7 @@ index f069482..646a0e3 100644
int security_audit_rule_known(struct audit_krule *krule)
{
@@ -1542,6 +1650,7 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
@@ -1546,6 +1654,7 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
{
return security_ops->audit_rule_match(secid, field, op, lsmrule, actx);
}

2
kernel/kernel-rt/centos/patches/affine-compute-kernel-threads.patch
View File

@ -107,7 +107,7 @@ diff --git a/kernel/cpu.c b/kernel/cpu.c
index 6fe84e4..325a47a 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1308,6 +1308,19 @@ static DECLARE_BITMAP(cpu_active_bits, CONFIG_NR_CPUS) __read_mostly;
@@ -1329,6 +1329,19 @@ static DECLARE_BITMAP(cpu_active_bits, CONFIG_NR_CPUS) __read_mostly;
const struct cpumask *const cpu_active_mask = to_cpumask(cpu_active_bits);
EXPORT_SYMBOL(cpu_active_mask);

2
kernel/kernel-rt/centos/patches/intel-iommu-allow-ignoring-Ethernet-device-RMRR-with.patch
View File

@ -99,7 +99,7 @@ index 05b0971..d6f4723 100644
} else if (!strncmp(str, "strict", 6)) {
pr_info("Disable batched IOTLB flush\n");
intel_iommu_strict = 1;
@@ -2779,6 +2789,15 @@ static bool device_is_rmrr_locked(struct device *dev)
@@ -2820,6 +2830,15 @@ static bool device_is_rmrr_locked(struct device *dev)
if (IS_USB_DEVICE(pdev) || IS_GFX_DEVICE(pdev))
return false;

2
kernel/kernel-rt/centos/srpm_path
View File

@ -1 +1 @@
mirror:Source/kernel-rt-3.10.0-957.1.3.rt56.913.el7.src.rpm
mirror:Source/kernel-rt-3.10.0-957.12.2.rt56.929.el7.src.rpm