integ/kernel/kernel-rt/centos/meta_patches/Build-logic-and-sources-for-TiC.patch
zhao.shuai 811823b983 Upgrade kernel (rt) to version kernel-3.10.0-957.21.3.el7
Security Fix(es):
(CVE-2019-11477)-
An integer overflow flaw was found in the way
the Linux kernel's networking subsystem processed
TCP Selective Acknowledgment (SACK) segments.
While processing SACK segments,
the Linux kernel's socket buffer (SKB) data structure
becomes fragmented. Each fragment is about TCP
maximum segment size (MSS) bytes.
To efficiently process SACK blocks, the Linux kernel merges
multiple fragmented SKBs into one, potentially overflowing
the variable holding the number of segments.
A remote attacker could use this flaw to crash the Linux kernel
by sending a crafted sequence of SACK segments on a TCP
connection with small value of TCP MSS,
resulting in a denial of service (DoS).

(CVE-2019-11478)-
Kernel: tcp: excessive resource consumption while processing SACK blocks
allows remote denial of service.

(CVE-2019-11479)-
Kernel: tcp: excessive resource consumption for TCP connections with low MSS
allows remote denial of service.

Details:
https://access.redhat.com/errata/RHSA-2019:1481
https://access.redhat.com/errata/RHSA-2019:1486
https://nvd.nist.gov/vuln/detail/

Closes-Bug: 1836685
Depends-On: https://review.opendev.org/670856
Change-Id: I24cd556b9aafd2aa3234ab2f0b7dd6b23185ffd2
Signed-off-by: zhao.shuai <zhaos@neusoft.com>
2019-08-05 11:54:30 +08:00

528 lines
17 KiB
Diff

From 4a2a30175a859e5a60b5a0e999c9edfde03eee7c Mon Sep 17 00:00:00 2001
From: Jim Somerville <Jim.Somerville@windriver.com>
Date: Mon, 23 Apr 2018 15:18:45 -0400
Subject: [PATCH] Build logic and sources for TiC
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
---
SPECS/kernel-rt.spec | 279 +++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 272 insertions(+), 7 deletions(-)
diff --git a/SPECS/kernel-rt.spec b/SPECS/kernel-rt.spec
index a922773..adffde2 100644
--- a/SPECS/kernel-rt.spec
+++ b/SPECS/kernel-rt.spec
@@ -17,23 +17,33 @@ Summary: The Linux Realtime kernel
# The Build ID
# %%define buildid .local
+%define buildid .tis.%{tis_patch_ver}
# For a kernel released for public testing, released_kernel should be 1.
# For internal testing builds during development, it should be 0.
%global released_kernel 1
+# If we want to sign the kernel and modules, do_sign should be 1.
+# To speed up builds (don't sign) use 0.
+%global do_sign 1
+
# conditional with/without variables
# Note that the logic here is inverted; a bcond_without implies
# that the variable is on by default (since you use --without to turn it off)
# Likewise a bcond_with implies the variable is off by default (turned on by --with)
%bcond_without rt
%bcond_without doc
-%bcond_without debug
-%bcond_with headers
+%bcond_with debug
+%bcond_without headers
%bcond_with vanilla
-%bcond_without trace
+%bcond_with trace
%bcond_with perf
-%bcond_without debuginfo
+%bcond_with debuginfo
+%bcond_without tools
+
+# Architectures we build tools/cpupower on
+%define cpupowerarchs x86_64 ppc64 ppc64le
+
# What parts do we want to build? We must build at least one kernel.
# These are the kernels that are built IF the architecture allows it.
@@ -53,7 +63,11 @@ Summary: The Linux Realtime kernel
# Verbose output?
# %%global verbose V=1
+%if %{do_sign}
%global signmodules 1
+%else
+%global signmodules 0
+%endif
# if patch fuzzy patch applying will be forbidden
%global with_fuzzy_patches 0
@@ -84,7 +98,7 @@ Summary: The Linux Realtime kernel
%global with_sparse %{?_with_sparse: 1} %{?!_with_sparse: 0}
%global pkg_release_simple %{rhel_build}.%{rttag}.%{rtbuild}
-%global pkg_release %{rhel_build}.%{rttag}.%{rtbuild}%{?buildid}%{?dist}
+%global pkg_release %{pkg_release_simple}%{?dist}%{?buildid}
%global KVERREL %{rpmversion}-%{pkg_release}.%{_target_cpu}
@@ -290,9 +304,14 @@ BuildRequires: xmlto, asciidoc
BuildRequires: openssl
BuildRequires: hmaccalc
BuildRequires: elfutils-libelf-devel
+%if %{do_sign}
%ifarch x86_64
BuildRequires: pesign >= 0.109-4
%endif
+%endif
+%if %{with_tools}
+BuildRequires: pciutils-devel gettext ncurses-devel
+%endif
%if %{with_sparse}
BuildRequires: sparse >= 0.4.1
%endif
@@ -340,12 +359,26 @@ Source25: merge.pl
Source27: sanity_check.py
Source29: extrakeys.pub
+Source37: centos.cer
+Source38: ima_signing_key.pub
+%if %{?released_kernel}
+%define pesign_name redhatsecureboot301
+%else
+%define pesign_name redhatsecureboot003
+%endif
### Configuration files
Source50: kernel-%{version}-x86_64-rt.config
Source51: kernel-%{version}-x86_64-rt-trace.config
Source52: kernel-%{version}-x86_64-rt-debug.config
+# Sources for kernel-rt-tools
+Source2000: cpupower.service
+Source2001: cpupower.config
+
+Source30000: kernel-3.10.0-x86_64-rt.config.tis_extra
+Source30001: kernel-3.10.0-x86_64-rt-debug.config.tis_extra
+Source30002: kernel-3.10.0-x86_64-rt-trace.config.tis_extra
### Started using a unified SRPM
# Sources for kernel modprobe config files
@@ -373,6 +406,7 @@ This kernel has been compiled with the RT patch applied and is intended
for use in deterministic response-time situations
+%if %{builddoc}
%package doc
Summary: Various documentation bits found in the kernel source
Group: Documentation
@@ -384,13 +418,14 @@ device drivers shipped with it are documented in these files.
You will want to install this package if you need a reference to the
options that can be passed to Linux kernel modules at load time.
-
+%endif
%package headers
Summary: Header files for the Linux kernel for use by glibc
Group: Development/System
Obsoletes: glibc-kernheaders < 3.0-46
Provides: glibc-kernheaders = 3.0-46
+Provides: kernel-headers
%description headers
Kernel-headers includes the C header files that specify the interface
between the Linux kernel and userspace libraries and programs. The
@@ -438,6 +473,7 @@ AutoReq: no\
This package provides KVM modules for package %{name}%{?1:-%{1}}.\
%{nil}
+%if %{builddebuginfo}
#
# This macro creates a kernel-rt-<subpackage>-kvm-debuginfo package.
# %%kernel_kvm_debuginfo_package <subpackage>
@@ -453,7 +489,9 @@ This package provides debug information for package %{name}%{?1:-%{1}}.\
This is required to use SystemTap with %{name}%{?1:-%{1}}-%{KVERREL}.\
%{expand:%%global debuginfo_args %{?debuginfo_args} -p '/.*/%%{KVERREL}%{?1:\.%{1}}/.*|/.*%%{KVERREL}%{?1:\.%{1}}(\.debug)?' -o debuginfo%{?1}-kvm.list}\
%{nil}
+%endif
+%if %{builddebuginfo}
#
# This macro creates a kernel-<subpackage>-debuginfo package.
# %%kernel_debuginfo_package <subpackage>
@@ -470,6 +508,7 @@ This package provides debug information for package %{name}%{?1:-%{1}}.\
This is required to use SystemTap with %{name}%{?1:-%{1}}-%{KVERREL}.\
%{expand:%%global debuginfo_args %{?debuginfo_args} -p '/.*/%%{KVERREL}%{?1:\.%{1}}/.*|/.*%%{KVERREL}%{?1:\.%{1}}(\.debug)?' -o debuginfo%{?1}.list}\
%{nil}
+%endif
#
# This macro creates a kernel-<subpackage>-devel package.
@@ -483,6 +522,7 @@ Provides: installonlypkg(kernel-rt-devel) = %{version}-%{release}%{?1:.%{1}}\
Provides: kernel-rt%{?1:-%{1}}-devel-%{_target_cpu} = %{version}-%{release}\
Provides: kernel-rt-devel-%{_target_cpu} = %{version}-%{release}%{?1:.%{1}}\
Provides: kernel-rt-devel-uname-r = %{KVERREL}%{?1:.%{1}}\
+Provides: kernel-devel = %{version}-%{release}%{?1:.%{1}}\
AutoReqProv: no\
Requires(pre): /usr/bin/find\
%description -n kernel-rt%{?variant}%{?1:-%{1}}-devel\
@@ -495,6 +535,7 @@ against the %{?2:%{2} }kernel package.\
# %%define variant_summary The Linux kernel compiled for <configuration>
# %%kernel_variant_package [-n <pretty-name>] <subpackage>
#
+%if %{builddebuginfo}
%define kernel_variant_package(n:) \
%package %1\
Summary: %{variant_summary}\
@@ -505,15 +546,29 @@ Group: System Environment/Kernel\
%{expand:%%kernel_kvm_package %1}\
%{expand:%%kernel_kvm_debuginfo_package %1}\
%{nil}
+%else
+%define kernel_variant_package(n:) \
+%package %1\
+Summary: %{variant_summary}\
+Group: System Environment/Kernel\
+%kernel_reqprovconf\
+%{expand:%%kernel_devel_package %1 %{!?-n:%1}%{?-n:%{-n*}}}\
+%{expand:%%kernel_kvm_package %1}\
+%{nil}
+%endif
# First the auxiliary packages of the main kernel package.
%kernel_devel_package
+%if %{builddebuginfo}
%kernel_debuginfo_package
+%endif
# create the production kvm module package
%kernel_kvm_package
+%if %{builddebuginfo}
%kernel_kvm_debuginfo_package
+%endif
# Now, each variant package.
@@ -563,6 +618,54 @@ It should only be installed when trying to gather additional information
on kernel bugs.
%endif
+%if %{with_tools}
+
+%package -n kernel-rt-tools
+Summary: Assortment of tools for the Linux kernel
+Group: Development/System
+License: GPLv2
+Provides: cpupowerutils-rt = 1:009-0.6.p1
+Obsoletes: cpupowerutils-rt < 1:009-0.6.p1
+Provides: cpufreq-utils-rt = 1:009-0.6.p1
+Provides: cpufrequtils-rt = 1:009-0.6.p1
+Obsoletes: cpufreq-utils-rt < 1:009-0.6.p1
+Obsoletes: cpufrequtils-rt < 1:009-0.6.p1
+Obsoletes: cpuspeed-rt < 1:2.0
+Requires: kernel-rt-tools-libs = %{version}-%{release}
+%description -n kernel-rt-tools
+This package contains the tools/ directory from the kernel source
+and the supporting documentation.
+
+%package -n kernel-rt-tools-libs
+Summary: Libraries for the kernels-tools
+Group: Development/System
+License: GPLv2
+%description -n kernel-rt-tools-libs
+This package contains the libraries built from the tools/ directory
+from the kernel source.
+
+%package -n kernel-rt-tools-libs-devel
+Summary: Assortment of tools for the Linux kernel
+Group: Development/System
+License: GPLv2
+Requires: kernel-rt-tools = %{version}-%{release}
+Provides: cpupowerutils-devel = 1:009-0.6.p1.1
+Obsoletes: cpupowerutils-devel <= 1:009-0.6.p1
+Requires: kernel-rt-tools-libs = %{version}-%{release}
+Provides: kernel-rt-tools-devel
+%description -n kernel-rt-tools-libs-devel
+This package contains the development files for the tools/ directory from
+the kernel source.
+
+%endif # with_tools
+
+%if %{do_sign}
+%package unsigned
+Summary: Unsigned build of the Linux kernel
+%description unsigned
+Contains an unsigned version of the Linux kernel
+%endif # do_sign
+
%prep
## ApplyPatch routine
patch_command='patch -p1 -F1 -s'
@@ -607,6 +710,12 @@ cp -rl vanilla-%{kversion} linux-%{kversion}.%{_target_cpu}
cd linux-%{kversion}.%{_target_cpu}
+# Copy any TiS-specific config changes
+cp $RPM_SOURCE_DIR/kernel-%{version}-*.config.tis_extra .
+
+# Copy TiS specific IMA public key
+cp %{SOURCE38} .
+
## Apply Patches here
ApplyPatch linux-kernel-test.patch
@@ -630,6 +739,15 @@ for i in *.config
do
mv $i .config
Arch=`head -1 .config | cut -b 3-`
+
+ # Handle StarlingX Cloud customizations. Use -n to match oldnoconfig below. We want this before
+ # the make line below so that the one below removes any dependencies of ones that we
+ # turn off here. We also want it before "make listnewconfig" so that we can set the
+ # config option for new configs introduced in the StarlingX Cloud patches.
+ if [ -f ${i}.tis_extra ]; then
+ scripts/kconfig/merge_config.sh -m -n .config ${i}.tis_extra
+ fi
+
make %{?cross_opts} ARCH=$Arch listnewconfig | grep -E '^CONFIG_' >.newoptions || true
%if %{listnewconfig_fail}
if [ -s .newoptions ]; then
@@ -764,10 +882,14 @@ BuildKernel() {
cp arch/$Arch/boot/zImage.stub $RPM_BUILD_ROOT/%{image_install_path}/zImage.stub-$KernelVer || :
fi
# EFI SecureBoot signing, x86_64-only
+%if %{do_sign}
+ cp $KernelImage vmlinuz.unsigned
+ $CopyKernel vmlinuz.unsigned $RPM_BUILD_ROOT/%{image_install_path}/vmlinuz.unsigned
%ifarch x86_64
- %pesign -s -i $KernelImage -o $KernelImage.signed -a %{SOURCE13} -c %{SOURCE14} -n %{pesign_name}
+ %pesign -s -i $KernelImage -o $KernelImage.signed -a %{SOURCE37} -c %{SOURCE37} -n %{pesign_name}
mv $KernelImage.signed $KernelImage
%endif
+%endif
$CopyKernel $KernelImage $RPM_BUILD_ROOT/%{image_install_path}/$InstallName-$KernelVer
chmod 755 $RPM_BUILD_ROOT/%{image_install_path}/$InstallName-$KernelVer
@@ -910,6 +1032,12 @@ BuildKernel() {
cp signing_key.priv signing_key.priv.sign${Flavour:+.${Flavour}}
cp signing_key.x509 signing_key.x509.sign${Flavour:+.${Flavour}}
+ # STX: Copy these keys as part of the devel package
+ # The Module signing keys are to ensure that only Out-of-tree
+ # built against the StarlingX Kernel get signed and loaded sans warnings
+ cp signing_key.priv ${RPM_BUILD_ROOT}/lib/modules/${KernelVer}/build/
+ cp signing_key.x509 ${RPM_BUILD_ROOT}/lib/modules/${KernelVer}/build/
+
# remove files that will be auto generated by depmod at rpm -i time
for i in alias alias.bin builtin.bin ccwmap dep dep.bin ieee1394map inputmap isapnpmap ofmap pcimap seriomap symbols symbols.bin usbmap softdep devname
do
@@ -925,6 +1053,15 @@ BuildKernel() {
install -Dm644 %{SOURCE1000} $RPM_BUILD_ROOT%{_sysconfdir}/modprobe.d/dccp-blacklist.conf
+ # create the kABI metadata for use in packaging
+ # NOTENOTE: the name symvers is used by the rpm backend
+ # NOTENOTE: to discover and run the /usr/lib/rpm/fileattrs/kabi.attr
+ # NOTENOTE: script which dynamically adds exported kernel symbol
+ # NOTENOTE: checksums to the rpm metadata provides list.
+ # NOTENOTE: if you change the symvers name, update the backend too
+ echo "**** GENERATING kernel ABI metadata ****"
+ gzip -c9 < Module.symvers > $RPM_BUILD_ROOT/boot/symvers-$KernelVer.gz
+
# prune junk from kernel-devel
find $RPM_BUILD_ROOT/usr/src/kernels -name ".*.cmd" -exec rm -f {} \;
}
@@ -972,6 +1109,31 @@ BuildKernel %make_target %kernel_image vanilla
BuildKernel %make_target %kernel_image
%endif
+%if %{with_tools}
+%ifarch %{cpupowerarchs}
+# cpupower
+# make sure version-gen.sh is executable.
+chmod +x tools/power/cpupower/utils/version-gen.sh
+make %{?cross_opts} %{?_smp_mflags} -C tools/power/cpupower CPUFREQ_BENCH=false
+%ifarch x86_64
+ pushd tools/power/cpupower/debug/x86_64
+ make %{?_smp_mflags} centrino-decode powernow-k8-decode
+ popd
+%endif
+%ifarch x86_64
+ pushd tools/power/x86/x86_energy_perf_policy/
+ make
+ popd
+ pushd tools/power/x86/turbostat
+ make
+ popd
+%endif #turbostat/x86_energy_perf_policy
+%endif
+pushd tools
+make tmon
+popd
+%endif
+
%if %{builddoc}
# Make the HTML and man pages.
make -j1 htmldocs mandocs || %{doc_build_fail}
@@ -1004,6 +1166,7 @@ popd
# if it isn't.
%ifnarch noarch
+%if %{do_sign}
%define __modsign_install_post \
if [ "%{with_rt}" -ne "0" ]; then \
Arch=`head -1 configs/kernel-%{version}-%{_target_cpu}-rt.config | cut -b 3-` \
@@ -1022,6 +1185,24 @@ popd
%{modsign_cmd} $RPM_BUILD_ROOT/lib/modules/%{KVERREL}.${AAA} || exit 1 \
done \
%{nil}
+%else
+%define __modsign_install_post \
+ if [ "%{with_rt}" -ne "0" ]; then \
+ Arch=`head -1 configs/kernel-%{version}-%{_target_cpu}-rt.config | cut -b 3-` \
+ rm -rf .tmp_versions \
+ mv .tmp_versions.sign .tmp_versions \
+ mv signing_key.priv.sign signing_key.priv \
+ mv signing_key.x509.sign signing_key.x509 \
+ fi\
+ for AAA in %{?with_trace:trace} %{?with_debug:debug} %{?with_vanilla:vanilla}; do \
+ Arch=`head -1 configs/kernel-%{version}-%{_target_cpu}-rt-${AAA}.config | cut -b 3-` \
+ rm -rf .tmp_versions \
+ mv .tmp_versions.sign.${AAA} .tmp_versions \
+ mv signing_key.priv.sign.${AAA} signing_key.priv \
+ mv signing_key.x509.sign.${AAA} signing_key.x509 \
+ done \
+%{nil}
+%endif
%endif
###
@@ -1111,6 +1292,39 @@ mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/perf
%endif # buildperf
%endif
+%if %{with_tools}
+%ifarch %{cpupowerarchs}
+make -C tools/power/cpupower DESTDIR=$RPM_BUILD_ROOT libdir=%{_libdir} mandir=%{_mandir} CPUFREQ_BENCH=false install
+rm -f %{buildroot}%{_libdir}/*.{a,la}
+%find_lang cpupower
+mv cpupower.lang ../
+%ifarch x86_64
+ pushd tools/power/cpupower/debug/x86_64
+ install -m755 centrino-decode %{buildroot}%{_bindir}/centrino-decode
+ install -m755 powernow-k8-decode %{buildroot}%{_bindir}/powernow-k8-decode
+ popd
+%endif
+chmod 0755 %{buildroot}%{_libdir}/libcpupower.so*
+mkdir -p %{buildroot}%{_unitdir} %{buildroot}%{_sysconfdir}/sysconfig
+install -m644 %{SOURCE2000} %{buildroot}%{_unitdir}/cpupower.service
+install -m644 %{SOURCE2001} %{buildroot}%{_sysconfdir}/sysconfig/cpupower
+%ifarch %{ix86} x86_64
+ mkdir -p %{buildroot}%{_mandir}/man8
+ pushd tools/power/x86/x86_energy_perf_policy
+ make DESTDIR=%{buildroot} install
+ popd
+ pushd tools/power/x86/turbostat
+ make DESTDIR=%{buildroot} install
+ popd
+%endif #turbostat/x86_energy_perf_policy
+pushd tools/thermal/tmon
+make INSTALL_ROOT=%{buildroot} install
+popd
+%endif
+
+%endif
+
+
%if %{buildheaders}
# Install kernel headers
make ARCH=%{hdrarch} INSTALL_HDR_PATH=$RPM_BUILD_ROOT/usr headers_install
@@ -1165,6 +1379,14 @@ rm -rf $RPM_BUILD_ROOT
### scripts
###
+%if %{with_tools}
+%post -n kernel-rt-tools
+/sbin/ldconfig
+
+%postun -n kernel-rt-tools
+/sbin/ldconfig
+%endif
+
#
# This macro defines a %%post script for a kernel*-devel package.
# %%kernel_devel_post [<subpackage>]
@@ -1328,6 +1550,43 @@ fi
%endif
%endif
+
+%if %{with_tools}
+%files -n kernel-rt-tools -f cpupower.lang
+%defattr(-,root,root)
+%ifarch %{cpupowerarchs}
+%{_bindir}/cpupower
+%ifarch x86_64
+%{_bindir}/centrino-decode
+%{_bindir}/powernow-k8-decode
+%endif
+%{_unitdir}/cpupower.service
+%{_mandir}/man[1-8]/cpupower*
+%config(noreplace) %{_sysconfdir}/sysconfig/cpupower
+%ifarch %{ix86} x86_64
+%{_bindir}/x86_energy_perf_policy
+%{_mandir}/man8/x86_energy_perf_policy*
+%{_bindir}/turbostat
+%{_mandir}/man8/turbostat*
+%endif
+%endif
+%{_bindir}/tmon
+
+%ifarch %{cpupowerarchs}
+%files -n kernel-rt-tools-libs
+%defattr(-,root,root)
+%{_libdir}/libcpupower.so.0
+%{_libdir}/libcpupower.so.0.0.0
+
+%files -n kernel-rt-tools-libs-devel
+%defattr(-,root,root)
+%{_libdir}/libcpupower.so
+%{_includedir}/cpufreq.h
+%endif
+
+%endif # with_tools
+
+
# This is %{image_install_path} on an arch where that includes ELF files,
# or empty otherwise.
%global elf_image_install_path %{?kernel_image_elf:%{image_install_path}}
@@ -1344,6 +1603,7 @@ fi
/%{image_install_path}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-%{KVERREL}%{?2:.%{2}}\
/%{image_install_path}/.vmlinuz-%{KVERREL}%{?2:.%{2}}.hmac\
/boot/System.map-%{KVERREL}%{?2:.%{2}}\
+/boot/symvers-%{KVERREL}%{?2:.%{2}}.gz\
/boot/config-%{KVERREL}%{?2:.%{2}}\
%exclude /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/arch/x86/kvm\
%exclude /lib/modules/%{KVERREL}%{?2:.%{2}}/kernel/drivers/gpu/drm/i915/gvt\
@@ -1422,6 +1682,11 @@ fi
%kernel_variant_files %{buildvanilla} vanilla
%endif
+%if %{do_sign}
+%files unsigned
+/boot/vmlinuz.unsigned
+%endif # do_sign
+
%changelog
* Fri Jun 14 2019 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [3.10.0-957.21.3.rt56.935.el7]
- [rt] Update source tree to match RHEL 7.6.z tree [1689417 1642619]
--
1.8.3.1