From: Ard Biesheuvel ardb@kernel.org

mainline inclusion from mainline-v5.16-rc1 commit 8aa0fb0fbb82a4d2395be7eaeb994653b2d869fc category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4Q94A CVE: NA

------------------------------

Now that the core code switched back to using thread_info::cpu to keep a task's CPU number, we no longer need to keep it in sync explicitly. So just drop the code that does this.

Signed-off-by: Ard Biesheuvel ardb@kernel.org Acked-by: Palmer Dabbelt palmerdabbelt@google.com Acked-by: Mark Rutland mark.rutland@arm.com Signed-off-by: Guan Jing guanjing6@huawei.com Reviewed-by: Chen Hui judy.chenhui@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- arch/riscv/kernel/asm-offsets.c | 1 - arch/riscv/kernel/entry.S | 5 ----- arch/riscv/kernel/head.S | 1 - 3 files changed, 7 deletions(-)

diff --git a/arch/riscv/kernel/asm-offsets.c b/arch/riscv/kernel/asm-offsets.c index 63fbcea8bc70..ddbc952e9eab 100644 --- a/arch/riscv/kernel/asm-offsets.c +++ b/arch/riscv/kernel/asm-offsets.c @@ -33,7 +33,6 @@ void asm_offsets(void) OFFSET(TASK_TI_PREEMPT_COUNT, task_struct, thread_info.preempt_count); OFFSET(TASK_TI_KERNEL_SP, task_struct, thread_info.kernel_sp); OFFSET(TASK_TI_USER_SP, task_struct, thread_info.user_sp); - OFFSET(TASK_TI_CPU, task_struct, thread_info.cpu);

OFFSET(TASK_THREAD_F0, task_struct, thread.fstate.f[0]); OFFSET(TASK_THREAD_F1, task_struct, thread.fstate.f[1]); diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S index 76274a4a1d8e..3a4f24a5b32b 100644 --- a/arch/riscv/kernel/entry.S +++ b/arch/riscv/kernel/entry.S @@ -432,11 +432,6 @@ ENTRY(__switch_to) REG_L s9, TASK_THREAD_S9_RA(a4) REG_L s10, TASK_THREAD_S10_RA(a4) REG_L s11, TASK_THREAD_S11_RA(a4) - /* Swap the CPU entry around. */ - lw a3, TASK_TI_CPU(a0) - lw a4, TASK_TI_CPU(a1) - sw a3, TASK_TI_CPU(a1) - sw a4, TASK_TI_CPU(a0) /* The offset of thread_info in task_struct is zero. */ move tp, a1 ret diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S index 1a819c18bede..5fd9e8f21a26 100644 --- a/arch/riscv/kernel/head.S +++ b/arch/riscv/kernel/head.S @@ -272,7 +272,6 @@ clear_bss_done: call setup_trap_vector /* Restore C environment */ la tp, init_task - sw zero, TASK_TI_CPU(tp) la sp, init_thread_union + THREAD_SIZE

#ifdef CONFIG_KASAN

From: Ard Biesheuvel ardb@kernel.org

mainline inclusion from mainline-v5.16-rc1 commit 001430c1910df65ab805116c563aebd8a40ff23a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4Q94A CVE: NA

------------------------------

The CPU field will be moved back into thread_info even when THREAD_INFO_IN_TASK is enabled, so add it back to arm64's definition of struct thread_info.

Note that arm64 always has CONFIG_SMP=y so there is no point in guarding the CPU field with an #ifdef.

Signed-off-by: Ard Biesheuvel ardb@kernel.org Acked-by: Catalin Marinas catalin.marinas@arm.com Acked-by: Mark Rutland mark.rutland@arm.com Signed-off-by: Guan Jing guanjing6@huawei.com Reviewed-by: Chen Hui judy.chenhui@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- arch/arm64/include/asm/thread_info.h | 1 + arch/arm64/kernel/asm-offsets.c | 1 + 2 files changed, 2 insertions(+)

diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 8b9f936a860e..c826ad282dc9 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -45,6 +45,7 @@ struct thread_info { void *scs_base; void *scs_sp; #endif + u32 cpu; };

#define thread_saved_pc(tsk) \ diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c index 4ed1fec68907..560ae96660ee 100644 --- a/arch/arm64/kernel/asm-offsets.c +++ b/arch/arm64/kernel/asm-offsets.c @@ -28,6 +28,7 @@ int main(void) { DEFINE(TSK_ACTIVE_MM, offsetof(struct task_struct, active_mm)); BLANK(); + DEFINE(TSK_TI_CPU, offsetof(struct task_struct, thread_info.cpu)); DEFINE(TSK_TI_FLAGS, offsetof(struct task_struct, thread_info.flags)); DEFINE(TSK_TI_PREEMPT, offsetof(struct task_struct, thread_info.preempt_count)); DEFINE(TSK_TI_ADDR_LIMIT, offsetof(struct task_struct, thread_info.addr_limit));

From: Ard Biesheuvel ardb@kernel.org

mainline inclusion from mainline-v5.16-rc1 commit bd2e2632556a464bd07cc8e21f60738611a934af category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4Q94A CVE: NA

-----------------------------

The CPU field will be moved back into thread_info even when THREAD_INFO_IN_TASK is enabled, so add it back to s390's definition of struct thread_info.

Note that s390 always has CONFIG_SMP=y so there is no point in guarding the CPU field with an #ifdef.

Signed-off-by: Ard Biesheuvel ardb@kernel.org Acked-by: Mark Rutland mark.rutland@arm.com Acked-by: Heiko Carstens hca@linux.ibm.com Signed-off-by: Guan Jing guanjing6@huawei.com

Conflicts: arch/s390/include/asm/thread_info.h Reviewed-by: Chen Hui judy.chenhui@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- arch/s390/include/asm/thread_info.h | 1 + 1 file changed, 1 insertion(+)

diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h index 13a04fcf7762..97983e99ec27 100644 --- a/arch/s390/include/asm/thread_info.h +++ b/arch/s390/include/asm/thread_info.h @@ -36,6 +36,7 @@ */ struct thread_info { unsigned long flags; /* low level flags */ + unsigned int cpu; /* current CPU */ };

/*

From: Ard Biesheuvel ardb@kernel.org

mainline inclusion from mainline-v5.16-rc1 commit bcf9033e5449bdcaa9bed46467a7141a8049dadb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4Q94A CVE: NA

---------------------------

THREAD_INFO_IN_TASK moved the CPU field out of thread_info, but this causes some issues on architectures that define raw_smp_processor_id() in terms of this field, due to the fact that #include'ing linux/sched.h to get at struct task_struct is problematic in terms of circular dependencies.

Given that thread_info and task_struct are the same data structure anyway when THREAD_INFO_IN_TASK=y, let's move it back so that having access to the type definition of struct thread_info is sufficient to reference the CPU number of the current task.

Note that this requires THREAD_INFO_IN_TASK's definition of the task_thread_info() helper to be updated, as task_cpu() takes a pointer-to-const, whereas task_thread_info() (which is used to generate lvalues as well), needs a non-const pointer. So make it a macro instead.

Signed-off-by: Ard Biesheuvel ardb@kernel.org Acked-by: Catalin Marinas catalin.marinas@arm.com Acked-by: Mark Rutland mark.rutland@arm.com Acked-by: Michael Ellerman mpe@ellerman.id.au Signed-off-by: Guan Jing guanjing6@huawei.com

Conflicts: arch/arm64/kernel/head.S Reviewed-by: Chen Hui judy.chenhui@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- arch/powerpc/kernel/asm-offsets.c | 2 +- arch/powerpc/kernel/smp.c | 2 +- include/linux/sched.h | 13 +------------ kernel/sched/sched.h | 4 ---- 4 files changed, 3 insertions(+), 18 deletions(-)

diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c index c5fe4be1c68a..760f656efcf6 100644 --- a/arch/powerpc/kernel/asm-offsets.c +++ b/arch/powerpc/kernel/asm-offsets.c @@ -96,7 +96,7 @@ int main(void) #endif /* CONFIG_PPC64 */ OFFSET(TASK_STACK, task_struct, stack); #ifdef CONFIG_SMP - OFFSET(TASK_CPU, task_struct, cpu); + OFFSET(TASK_CPU, task_struct, thread_info.cpu); #endif

#ifdef CONFIG_LIVEPATCH diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index b7bed52a5a73..ab2d3446e628 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -1103,7 +1103,7 @@ static void cpu_idle_thread_init(unsigned int cpu, struct task_struct *idle) paca_ptrs[cpu]->kstack = (unsigned long)task_stack_page(idle) + THREAD_SIZE - STACK_FRAME_OVERHEAD; #endif - idle->cpu = cpu; + task_thread_info(idle)->cpu = cpu; secondary_current = current_set[cpu] = idle; }

diff --git a/include/linux/sched.h b/include/linux/sched.h index 3bc2f15df252..5cd59c883522 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -694,10 +694,6 @@ struct task_struct { #ifdef CONFIG_SMP int on_cpu; struct __call_single_node wake_entry; -#ifdef CONFIG_THREAD_INFO_IN_TASK - /* Current CPU: */ - unsigned int cpu; -#endif unsigned int wakee_flips; unsigned long wakee_flip_decay_ts; struct task_struct *last_wakee; @@ -1771,10 +1767,7 @@ extern struct thread_info init_thread_info; extern unsigned long init_stack[THREAD_SIZE / sizeof(unsigned long)];

#ifdef CONFIG_THREAD_INFO_IN_TASK -static inline struct thread_info *task_thread_info(struct task_struct *task) -{ - return &task->thread_info; -} +# define task_thread_info(task) (&(task)->thread_info) #elif !defined(__HAVE_THREAD_FUNCTIONS) # define task_thread_info(task) ((struct thread_info *)(task)->stack) #endif @@ -1970,11 +1963,7 @@ static __always_inline bool need_resched(void)

static inline unsigned int task_cpu(const struct task_struct *p) { -#ifdef CONFIG_THREAD_INFO_IN_TASK - return READ_ONCE(p->cpu); -#else return READ_ONCE(task_thread_info(p)->cpu); -#endif }

extern void set_task_cpu(struct task_struct *p, unsigned int cpu); diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 451440e36318..66be40862d99 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -1652,11 +1652,7 @@ static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu) * per-task data have been completed by this moment. */ smp_wmb(); -#ifdef CONFIG_THREAD_INFO_IN_TASK - WRITE_ONCE(p->cpu, cpu); -#else WRITE_ONCE(task_thread_info(p)->cpu, cpu); -#endif p->wake_cpu = cpu; #endif }

From: Chen Jiahao chenjiahao16@huawei.com

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4QWBF CVE: NA

--------

Reserving some fields in struct i2c_bus_recovery_info, i2c_adapter, i2c_board_info and i2c_algorithm for future development.

Signed-off-by: Chen Jiahao chenjiahao16@huawei.com Reviewed-by: Liao Chang liaochang1@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- include/linux/i2c.h | 12 ++++++++++++ 1 file changed, 12 insertions(+)

diff --git a/include/linux/i2c.h b/include/linux/i2c.h index 75b42c72d454..58a721c23eca 100644 --- a/include/linux/i2c.h +++ b/include/linux/i2c.h @@ -20,6 +20,7 @@ #include <linux/of.h> /* for struct device_node */ #include <linux/swab.h> /* for swab16 */ #include <uapi/linux/i2c.h> +#include <linux/kabi.h>

extern struct bus_type i2c_bus_type; extern struct device_type i2c_adapter_type; @@ -422,6 +423,8 @@ struct i2c_board_info { const struct resource *resources; unsigned int num_resources; int irq; + + KABI_RESERVE(1) };

/** @@ -547,6 +550,9 @@ struct i2c_algorithm { int (*reg_slave)(struct i2c_client *client); int (*unreg_slave)(struct i2c_client *client); #endif + + KABI_RESERVE(1) + KABI_RESERVE(2) };

/** @@ -636,6 +642,9 @@ struct i2c_bus_recovery_info { struct pinctrl *pinctrl; struct pinctrl_state *pins_default; struct pinctrl_state *pins_gpio; + + KABI_RESERVE(1) + KABI_RESERVE(2) };

int i2c_recover_bus(struct i2c_adapter *adap); @@ -726,6 +735,9 @@ struct i2c_adapter { const struct i2c_adapter_quirks *quirks;

struct irq_domain *host_notify_domain; + + KABI_RESERVE(1) + KABI_RESERVE(2) }; #define to_i2c_adapter(d) container_of(d, struct i2c_adapter, dev)

From: Wang Hai wanghai38@huawei.com

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4HE7P?from=project-issue CVE: NA

--------

Reserve some fields beforehand for some net subsystems framework related structures prone to change.

---------

Signed-off-by: Wang Hai wanghai38@huawei.com Reviewed-by: Yue Haibing yuehaibing@huawei.com Reviewed-by: Wei Yongjun weiyongjun1@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- include/linux/inetdevice.h | 4 ++++ include/net/devlink.h | 4 ++++ include/net/flow_dissector.h | 6 ++++++ include/net/sch_generic.h | 1 + include/net/tls.h | 10 ++++++++++ include/net/xsk_buff_pool.h | 3 +++ 6 files changed, 28 insertions(+)

diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h index b68fca08be27..a44812b24687 100644 --- a/include/linux/inetdevice.h +++ b/include/linux/inetdevice.h @@ -13,6 +13,7 @@ #include <linux/sysctl.h> #include <linux/rtnetlink.h> #include <linux/refcount.h> +#include <linux/kabi.h>

struct ipv4_devconf { void *sysctl; @@ -48,6 +49,9 @@ struct in_device { struct neigh_parms *arp_parms; struct ipv4_devconf cnf; struct rcu_head rcu_head; + + KABI_RESERVE(1) + KABI_RESERVE(2) };

#define IPV4_DEVCONF(cnf, attr) ((cnf).data[IPV4_DEVCONF_ ## attr - 1]) diff --git a/include/net/devlink.h b/include/net/devlink.h index b01bb9bca5a2..dbfcb088c86a 100644 --- a/include/net/devlink.h +++ b/include/net/devlink.h @@ -19,6 +19,7 @@ #include <net/flow_offload.h> #include <uapi/linux/devlink.h> #include <linux/xarray.h> +#include <linux/kabi.h>

#define DEVLINK_RELOAD_STATS_ARRAY_SIZE \ (__DEVLINK_RELOAD_LIMIT_MAX * __DEVLINK_RELOAD_ACTION_MAX) @@ -52,6 +53,9 @@ struct devlink { struct mutex lock; /* Serializes access to devlink instance specific objects such as * port, sb, dpipe, resource, params, region, traps and more. */ + KABI_RESERVE(1) + KABI_RESERVE(2) + u8 reload_failed:1, reload_enabled:1, registered:1; diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h index cc10b10dc3a1..31a748a52c90 100644 --- a/include/net/flow_dissector.h +++ b/include/net/flow_dissector.h @@ -7,6 +7,7 @@ #include <linux/siphash.h> #include <linux/string.h> #include <uapi/linux/if_ether.h> +#include <linux/kabi.h>

struct bpf_prog; struct net; @@ -316,6 +317,11 @@ struct flow_keys { struct flow_dissector_key_icmp icmp; /* 'addrs' must be the last member */ struct flow_dissector_key_addrs addrs; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) };

#define FLOW_KEYS_HASH_OFFSET \ diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h index 50dd8be91bf4..3696246d336a 100644 --- a/include/net/sch_generic.h +++ b/include/net/sch_generic.h @@ -116,6 +116,7 @@ struct Qdisc { struct rcu_head rcu;

KABI_RESERVE(1) + KABI_RESERVE(2)

/* private data */ long privdata[] ____cacheline_aligned; diff --git a/include/net/tls.h b/include/net/tls.h index 8e02a6ae247f..fee4e55bd8d9 100644 --- a/include/net/tls.h +++ b/include/net/tls.h @@ -50,6 +50,7 @@ #include <crypto/aead.h> #include <uapi/linux/tls.h>

+#include <linux/kabi.h>

/* Maximum data size carried in a TLS record */ #define TLS_MAX_PAYLOAD_SIZE ((size_t)1 << 14) @@ -167,6 +168,10 @@ struct tls_record_info { u32 end_seq; int len; int num_frags; + + KABI_RESERVE(1) + KABI_RESERVE(2) + skb_frag_t frags[MAX_SKB_FRAGS]; };

@@ -284,6 +289,11 @@ struct tls_context { struct list_head list; refcount_t refcount; struct rcu_head rcu; + + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) };

enum tls_offload_ctx_dir { diff --git a/include/net/xsk_buff_pool.h b/include/net/xsk_buff_pool.h index 7a9a23e7a604..33bf0a584f7c 100644 --- a/include/net/xsk_buff_pool.h +++ b/include/net/xsk_buff_pool.h @@ -8,6 +8,7 @@ #include <linux/types.h> #include <linux/dma-mapping.h> #include <net/xdp.h> +#include <linux/kabi.h>

struct xsk_buff_pool; struct xdp_rxq_info; @@ -78,6 +79,8 @@ struct xsk_buff_pool { * sockets share a single cq when the same netdev and queue id is shared. */ spinlock_t cq_lock; + KABI_RESERVE(1) + KABI_RESERVE(2) struct xdp_buff_xsk *free_heads[]; };

From: Yu Liao liaoyu15@huawei.com

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4QQWY CVE: NA

--------------------------

Reserve space for struct acpi_device_power

Signed-off-by: Yu Liao liaoyu15@huawei.com Reviewed-by: Xiongfeng Wang wangxiongfeng2@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- include/acpi/acpi_bus.h | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h index 6ad3b89a8a2e..a072afc7609a 100644 --- a/include/acpi/acpi_bus.h +++ b/include/acpi/acpi_bus.h @@ -11,6 +11,7 @@

#include <linux/device.h> #include <linux/property.h> +#include <linux/kabi.h>

/* TBD: Make dynamic */ #define ACPI_MAX_HANDLES 10 @@ -277,6 +278,8 @@ struct acpi_device_power { int state; /* Current state */ struct acpi_device_power_flags flags; struct acpi_device_power_state states[ACPI_D_STATE_COUNT]; /* Power states (D0-D3Cold) */ + + KABI_RESERVE(1) };

/* Performance Management */

From: Wang ShaoBo bobo.shaobowang@huawei.com

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4QPLR CVE: NA

Reference: https://patchwork.kernel.org/project/linux-arm-kernel/cover/20211210184133.3...

-------------------------------

Reserve space for arm64 SME in thread_struct.

According to the implementation of SME, we need to reserve space for the following fields like this:

+enum vec_type { + ARM64_VEC_SVE = 0, + ARM64_VEC_SME, + ARM64_VEC_MAX, +}; + struct thread_struct { struct cpu_context cpu_context; /* cpu context */

@@ -149,8 +155,6 @@ struct thread_struct {

unsigned int fpsimd_cpu; void *sve_state; /* SVE registers, if any */ - unsigned int sve_vl; /* SVE vector length */ - unsigned int sve_vl_onexec; /* SVE vl after next exec */ unsigned long fault_address; /* fault info */ unsigned long fault_code; /* ESR_EL1 value */ struct debug_info debug; /* debugging */ @@ -162,6 +166,11 @@ struct thread_struct { u64 sctlr_tcf0; u64 gcr_user_incl; #endif + void *za_state; /* ZA register, if any */ + unsigned int vl[ARM64_VEC_MAX]; /* vector length */ + unsigned int vl_onexec[ARM64_VEC_MAX]; /* vl after next exec */ + u64 svcr; + u64 tpidr2_el0; };

This requires at least five 64bit spaces, other three for expansion.

Signed-off-by: Wang ShaoBo bobo.shaobowang@huawei.com Reviewed-by: Cheng Jian cj.chengjian@huawei.com Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com --- arch/arm64/include/asm/processor.h | 9 +++++++++ 1 file changed, 9 insertions(+)

diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h index 44968ffc322b..d94d60d01d9e 100644 --- a/arch/arm64/include/asm/processor.h +++ b/arch/arm64/include/asm/processor.h @@ -32,6 +32,7 @@ #include <linux/stddef.h> #include <linux/string.h> #include <linux/thread_info.h> +#include <linux/kabi.h>

#include <vdso/processor.h>

@@ -162,6 +163,14 @@ struct thread_struct { u64 sctlr_tcf0; u64 gcr_user_incl; #endif + KABI_RESERVE(1) + KABI_RESERVE(2) + KABI_RESERVE(3) + KABI_RESERVE(4) + KABI_RESERVE(5) + KABI_RESERVE(6) + KABI_RESERVE(7) + KABI_RESERVE(8) };

static inline void arch_thread_struct_whitelist(unsigned long *offset,