rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

3.10.1 rebase

This commit is contained in:
Dave Jones 2013-07-17 15:23:01 -04:00
parent 632c277802
commit d4ff6bd675
28 changed files with 143 additions and 9097 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
VMX-x86-handle-host-TSC-calibration-failure.patch
View File

@ -1,58 +0,0 @@
@@ -, +, @@
VMX: x86: handle host TSC calibration failure
If the host TSC calibration fails, tsc_khz is zero (see tsc_init.c).
Handle such case properly in KVM (instead of dividing by zero).
https://bugzilla.redhat.com/show_bug.cgi?id=859282
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
--- a/arch/x86/kvm/x86.c
+++ a/arch/x86/kvm/x86.c
@@ -1079,6 +1079,10 @@ static void kvm_set_tsc_khz(struct kvm_vcpu *vcpu, u32 this_tsc_khz)
u32 thresh_lo, thresh_hi;
int use_scaling = 0;
+ /* tsc_khz can be zero if TSC calibration fails */
+ if (this_tsc_khz == 0)
+ return;
+
/* Compute a scale to convert nanoseconds in TSC cycles */
kvm_get_time_scale(this_tsc_khz, NSEC_PER_SEC / 1000,
&vcpu->arch.virtual_tsc_shift,
@@ -1156,20 +1160,23 @@ void kvm_write_tsc(struct kvm_vcpu *vcpu, struct msr_data *msr)
ns = get_kernel_ns();
elapsed = ns - kvm->arch.last_tsc_nsec;
- /* n.b - signed multiplication and division required */
- usdiff = data - kvm->arch.last_tsc_write;
+ if (vcpu->arch.virtual_tsc_khz) {
+ /* n.b - signed multiplication and division required */
+ usdiff = data - kvm->arch.last_tsc_write;
#ifdef CONFIG_X86_64
- usdiff = (usdiff * 1000) / vcpu->arch.virtual_tsc_khz;
+ usdiff = (usdiff * 1000) / vcpu->arch.virtual_tsc_khz;
#else
- /* do_div() only does unsigned */
- asm("idivl %2; xor %%edx, %%edx"
- : "=A"(usdiff)
- : "A"(usdiff * 1000), "rm"(vcpu->arch.virtual_tsc_khz));
+ /* do_div() only does unsigned */
+ asm("idivl %2; xor %%edx, %%edx"
+ : "=A"(usdiff)
+ : "A"(usdiff * 1000), "rm"(vcpu->arch.virtual_tsc_khz));
#endif
- do_div(elapsed, 1000);
- usdiff -= elapsed;
- if (usdiff < 0)
- usdiff = -usdiff;
+ do_div(elapsed, 1000);
+ usdiff -= elapsed;
+ if (usdiff < 0)
+ usdiff = -usdiff;
+ } else
+ usdiff = USEC_PER_SEC; /* disable TSC match window below */
/*
* Special case: TSC write with a small delta (1 second) of virtual

37
af_key-fix-info-leaks-in-notify-messages.patch
View File

@ -1,37 +0,0 @@
From a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli@googlemail.com>
Date: Wed, 26 Jun 2013 21:52:30 +0000
Subject: af_key: fix info leaks in notify messages
key_notify_sa_flush() and key_notify_policy_flush() miss to initialize
the sadb_msg_reserved member of the broadcasted message and thereby
leak 2 bytes of heap memory to listeners. Fix that.
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
diff --git a/net/key/af_key.c b/net/key/af_key.c
index c5fbd75..9da8620 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c)
hdr->sadb_msg_version = PF_KEY_V2;
hdr->sadb_msg_errno = (uint8_t) 0;
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ hdr->sadb_msg_reserved = 0;
pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
@@ -2699,6 +2700,7 @@ static int key_notify_policy_flush(const struct km_event *c)
hdr->sadb_msg_errno = (uint8_t) 0;
hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ hdr->sadb_msg_reserved = 0;
pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
return 0;
--
cgit v0.9.2

190
arm-omap-ehci-fix.patch
View File

@ -1,190 +0,0 @@
From 54a419668b0f27b7982807fb2376d237e0a0ce05 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Tue, 12 Mar 2013 10:44:39 +0000
Subject: USB: EHCI: split ehci-omap out to a separate driver
This patch (as1645) converts ehci-omap over to the new "ehci-hcd is a
library" approach, so that it can coexist peacefully with other EHCI
platform drivers and can make use of the private area allocated at
the end of struct ehci_hcd.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index c59a112..62f4e9a 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -155,7 +155,7 @@ config USB_EHCI_MXC
Variation of ARC USB block used in some Freescale chips.
config USB_EHCI_HCD_OMAP
- bool "EHCI support for OMAP3 and later chips"
+ tristate "EHCI support for OMAP3 and later chips"
depends on USB_EHCI_HCD && ARCH_OMAP
default y
---help---
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index 001fbff..56de410 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_USB_EHCI_HCD) += ehci-hcd.o
obj-$(CONFIG_USB_EHCI_PCI) += ehci-pci.o
obj-$(CONFIG_USB_EHCI_HCD_PLATFORM) += ehci-platform.o
obj-$(CONFIG_USB_EHCI_MXC) += ehci-mxc.o
+obj-$(CONFIG_USB_EHCI_HCD_OMAP) += ehci-omap.o
obj-$(CONFIG_USB_OXU210HP_HCD) += oxu210hp-hcd.o
obj-$(CONFIG_USB_ISP116X_HCD) += isp116x-hcd.o
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index b416a3f..303b022 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1252,11 +1252,6 @@ MODULE_LICENSE ("GPL");
#define PLATFORM_DRIVER ehci_hcd_sh_driver
#endif
-#ifdef CONFIG_USB_EHCI_HCD_OMAP
-#include "ehci-omap.c"
-#define PLATFORM_DRIVER ehci_hcd_omap_driver
-#endif
-
#ifdef CONFIG_PPC_PS3
#include "ehci-ps3.c"
#define PS3_SYSTEM_BUS_DRIVER ps3_ehci_driver
@@ -1346,6 +1341,7 @@ MODULE_LICENSE ("GPL");
!IS_ENABLED(CONFIG_USB_EHCI_HCD_PLATFORM) && \
!IS_ENABLED(CONFIG_USB_CHIPIDEA_HOST) && \
!IS_ENABLED(CONFIG_USB_EHCI_MXC) && \
+ !IS_ENABLED(CONFIG_USB_EHCI_HCD_OMAP) && \
!defined(PLATFORM_DRIVER) && \
!defined(PS3_SYSTEM_BUS_DRIVER) && \
!defined(OF_PLATFORM_DRIVER) && \
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index 0555ee4..fa66757 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -36,6 +36,9 @@
* - convert to use hwmod and runtime PM
*/
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/io.h>
#include <linux/platform_device.h>
#include <linux/slab.h>
#include <linux/usb/ulpi.h>
@@ -43,6 +46,10 @@
#include <linux/pm_runtime.h>
#include <linux/gpio.h>
#include <linux/clk.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
+
+#include "ehci.h"
#include <linux/platform_data/usb-omap.h>
@@ -57,9 +64,11 @@
#define EHCI_INSNREG05_ULPI_EXTREGADD_SHIFT 8
#define EHCI_INSNREG05_ULPI_WRDATA_SHIFT 0
-/*-------------------------------------------------------------------------*/
+#define DRIVER_DESC "OMAP-EHCI Host Controller driver"
-static const struct hc_driver ehci_omap_hc_driver;
+static const char hcd_name[] = "ehci-omap";
+
+/*-------------------------------------------------------------------------*/
static inline void ehci_write(void __iomem *base, u32 reg, u32 val)
@@ -166,6 +175,12 @@ static void disable_put_regulator(
/* configure so an HC device and id are always provided */
/* always called with process context; sleeping is OK */
+static struct hc_driver __read_mostly ehci_omap_hc_driver;
+
+static const struct ehci_driver_overrides ehci_omap_overrides __initdata = {
+ .reset = omap_ehci_init,
+};
+
/**
* ehci_hcd_omap_probe - initialize TI-based HCDs
*
@@ -315,56 +330,33 @@ static struct platform_driver ehci_hcd_omap_driver = {
/*.suspend = ehci_hcd_omap_suspend, */
/*.resume = ehci_hcd_omap_resume, */
.driver = {
- .name = "ehci-omap",
+ .name = hcd_name,
}
};
/*-------------------------------------------------------------------------*/
-static const struct hc_driver ehci_omap_hc_driver = {
- .description = hcd_name,
- .product_desc = "OMAP-EHCI Host Controller",
- .hcd_priv_size = sizeof(struct ehci_hcd),
-
- /*
- * generic hardware linkage
- */
- .irq = ehci_irq,
- .flags = HCD_MEMORY | HCD_USB2,
-
- /*
- * basic lifecycle operations
- */
- .reset = omap_ehci_init,
- .start = ehci_run,
- .stop = ehci_stop,
- .shutdown = ehci_shutdown,
-
- /*
- * managing i/o requests and associated device resources
- */
- .urb_enqueue = ehci_urb_enqueue,
- .urb_dequeue = ehci_urb_dequeue,
- .endpoint_disable = ehci_endpoint_disable,
- .endpoint_reset = ehci_endpoint_reset,
+static int __init ehci_omap_init(void)
+{
+ if (usb_disabled())
+ return -ENODEV;
- /*
- * scheduling support
- */
- .get_frame_number = ehci_get_frame,
+ pr_info("%s: " DRIVER_DESC "\n", hcd_name);
- /*
- * root hub support
- */
- .hub_status_data = ehci_hub_status_data,
- .hub_control = ehci_hub_control,
- .bus_suspend = ehci_bus_suspend,
- .bus_resume = ehci_bus_resume,
+ ehci_init_driver(&ehci_omap_hc_driver, &ehci_omap_overrides);
+ return platform_driver_register(&ehci_hcd_omap_driver);
+}
+module_init(ehci_omap_init);
- .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
-};
+static void __exit ehci_omap_cleanup(void)
+{
+ platform_driver_unregister(&ehci_hcd_omap_driver);
+}
+module_exit(ehci_omap_cleanup);
MODULE_ALIAS("platform:ehci-omap");
MODULE_AUTHOR("Texas Instruments, Inc.");
MODULE_AUTHOR("Felipe Balbi <felipe.balbi@nokia.com>");
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_LICENSE("GPL");
--
cgit v0.9.1

19
arm-omap-fixdrm.patch
View File

@ -1,19 +0,0 @@
diff --git a/drivers/gpu/drm/omapdrm/omap_plane.c b/drivers/gpu/drm/omapdrm/omap_plane.c
index 2882cda..8d225d7 100644
--- a/drivers/gpu/drm/omapdrm/omap_plane.c
+++ b/drivers/gpu/drm/omapdrm/omap_plane.c
@@ -247,6 +247,12 @@ static int omap_plane_update(struct drm_plane *plane,
{
struct omap_plane *omap_plane = to_omap_plane(plane);
omap_plane->enabled = true;
+
+ if (plane->fb)
+ drm_framebuffer_unreference(plane->fb);
+
+ drm_framebuffer_reference(fb);
+
return omap_plane_mode_set(plane, crtc, fb,
crtc_x, crtc_y, crtc_w, crtc_h,
src_x, src_y, src_w, src_h,

64
block-do-not-pass-disk-names-as-format-strings.patch
View File

@ -1,64 +0,0 @@
Disk names may contain arbitrary strings, so they must not be interpreted
as format strings. It seems that only md allows arbitrary strings to be
used for disk names, but this could allow for a local memory corruption
from uid 0 into ring 0.
CVE-2013-2851
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Cc: Jens Axboe <axboe@kernel.dk>
---
block/genhd.c | 2 +-
drivers/block/nbd.c | 3 ++-
drivers/scsi/osd/osd_uld.c | 2 +-
3 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/block/genhd.c b/block/genhd.c
index 20625ee..cdeb527 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -512,7 +512,7 @@ static void register_disk(struct gendisk *disk)
ddev->parent = disk->driverfs_dev;
- dev_set_name(ddev, disk->disk_name);
+ dev_set_name(ddev, "%s", disk->disk_name);
/* delay uevents, until we scanned partition table */
dev_set_uevent_suppress(ddev, 1);
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 037288e..46b35f7 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -714,7 +714,8 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
else
blk_queue_flush(nbd->disk->queue, 0);
- thread = kthread_create(nbd_thread, nbd, nbd->disk->disk_name);
+ thread = kthread_create(nbd_thread, nbd, "%s",
+ nbd->disk->disk_name);
if (IS_ERR(thread)) {
mutex_lock(&nbd->tx_lock);
return PTR_ERR(thread);
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index 0fab6b5..9d86947 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -485,7 +485,7 @@ static int osd_probe(struct device *dev)
oud->class_dev.class = &osd_uld_class;
oud->class_dev.parent = dev;
oud->class_dev.release = __remove;
- error = dev_set_name(&oud->class_dev, disk->disk_name);
+ error = dev_set_name(&oud->class_dev, "%s", disk->disk_name);
if (error) {
OSD_ERR("dev_set_name failed => %d\n", error);
goto err_put_cdev;
--
1.7.9.5
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

45
cdrom-use-kzalloc-for-failing-hardware.patch
View File

@ -1,45 +0,0 @@
From 050e4b8fb7cdd7096c987a9cd556029c622c7fe2 Mon Sep 17 00:00:00 2001
From: Jonathan Salwan <jonathan.salwan@gmail.com>
Date: Thu, 06 Jun 2013 00:39:39 +0000
Subject: drivers/cdrom/cdrom.c: use kzalloc() for failing hardware
In drivers/cdrom/cdrom.c mmc_ioctl_cdrom_read_data() allocates a memory
area with kmalloc in line 2885.
2885 cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
2886 if (cgc->buffer == NULL)
2887 return -ENOMEM;
In line 2908 we can find the copy_to_user function:
2908 if (!ret && copy_to_user(arg, cgc->buffer, blocksize))
The cgc->buffer is never cleaned and initialized before this function. If
ret = 0 with the previous basic block, it's possible to display some
memory bytes in kernel space from userspace.
When we read a block from the disk it normally fills the ->buffer but if
the drive is malfunctioning there is a chance that it would only be
partially filled. The result is an leak information to userspace.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
(limited to 'drivers/cdrom/cdrom.c')
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index d620b44..8a3aff7 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2882,7 +2882,7 @@ static noinline int mmc_ioctl_cdrom_read_data(struct cdrom_device_info *cdi,
if (lba < 0)
return -EINVAL;
- cgc->buffer = kmalloc(blocksize, GFP_KERNEL);
+ cgc->buffer = kzalloc(blocksize, GFP_KERNEL);
if (cgc->buffer == NULL)
return -ENOMEM;
--
cgit v0.9.2

4
config-debug
View File

@ -117,3 +117,7 @@ CONFIG_MAC80211_MESSAGE_TRACING=y
CONFIG_EDAC_DEBUG=y
CONFIG_LATENCYTOP=y
CONFIG_SCHEDSTATS=y
CONFIG_TEST_STRING_HELPERS=m
CONFIG_XFS_WARN=y

57
config-generic
View File

@ -4713,3 +4713,60 @@ CONFIG_IOMMU_SUPPORT=y
# CONFIG_CRYPTO_KEY_TYPE is not set
# CONFIG_PGP_LIBRARY is not set
# CONFIG_PGP_PRELOAD is not set
# F19 3.10 rebase options below
# CONFIG_ATH6KL_TRACING is not set
CONFIG_BATMAN_ADV_NC=y
# CONFIG_BCACHE_CLOSURES_DEBUG is not set
# CONFIG_BCACHE_DEBUG is not set
# CONFIG_BCACHE_EDEBUG is not set
CONFIG_BCACHE=m
CONFIG_BINFMT_SCRIPT=y
CONFIG_BOUNCE=y
# CONFIG_BTRFS_DEBUG is not set
# CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
CONFIG_CRYPTO_CMAC=m
# CONFIG_DUMMY_IRQ is not set
# CONFIG_FB_SIMPLE is not set
# CONFIG_GPIO_GRGPIO is not set
CONFIG_HID_APPLEIR=m
# CONFIG_INPUT_IMS_PCU is not set
CONFIG_LEDS_LP5562=m
CONFIG_LEDS_TRIGGER_CAMERA=m
# CONFIG_MFD_CROS_EC is not set
# CONFIG_MFD_SI476X_CORE is not set
CONFIG_NETLINK_DIAG=m
CONFIG_NETLINK_MMAP=y
CONFIG_NET_TEAM_MODE_RANDOM=m
# CONFIG_RCU_USER_QS is not set
# CONFIG_RESET_CONTROLLER is not set
# CONFIG_RING_BUFFER_STARTUP_TEST is not set
CONFIG_RT2800USB_RT55XX=y
# CONFIG_SCSI_UFSHCD_PLATFORM is not set
CONFIG_SENSORS_ADT7310=m
CONFIG_SENSORS_LM95234=m
CONFIG_SENSORS_NCT6775=m
# CONFIG_SERIO_APBPS2 is not set
# CONFIG_SMS_SIANO_DEBUGFS is not set
# CONFIG_SRAM is not set
# CONFIG_SSBI is not set
# CONFIG_TRACER_SNAPSHOT_PER_CPU_SWAP is not set
CONFIG_USB_DEFAULT_PERSIST=y
CONFIG_USB_PHY=y
CONFIG_USB_RTL8152=m
# CONFIG_USB_SERIAL_WISHBONE is not set
# CONFIG_W1_SLAVE_DS2408_READBACK is not set
# CONFIG_SAMSUNG_USB2PHY is not set
# CONFIG_SAMSUNG_USB3PHY is not set
CONFIG_ALX=m
CONFIG_INFINIBAND_ISERT=m
CONFIG_QLCNIC_SRIOV=y
CONFIG_RTL8188EE=m
# CONFIG_SAMSUNG_USBPHY is not set
# CONFIG_TIPC_MEDIA_IB is not set
# CONFIG_USB_DWC2 is not set
CONFIG_VHOST_SCSI=m
# CONFIG_MFD_TPS65912 is not set
# CONFIG_MFD_SYSCON is not set

4
config-nodebug
View File

@ -119,3 +119,7 @@ CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y
# CONFIG_SPI_DEBUG is not set
# CONFIG_LATENCYTOP is not set
# CONFIG_SCHEDSTATS is not set
# CONFIG_TEST_STRING_HELPERS is not set
# CONFIG_XFS_WARN is not set

2
config-powerpc-generic
View File

@ -392,3 +392,5 @@ CONFIG_BACKLIGHT_PWM=m
CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=n
CONFIG_XZ_DEC_POWERPC=y
# CONFIG_POWERNV_MSI is not set

3
config-powerpc64
View File

@ -181,3 +181,6 @@ CONFIG_BPF_JIT=y
# CONFIG_PPC_TRANSACTIONAL_MEM is not set
# CONFIG_SND_HDA_INTEL is not set
CONFIG_BLK_DEV_RSXX=m
CONFIG_POWERNV_MSI=y
CONFIG_KVM_XICS=y

3
config-powerpc64p7
View File

@ -171,3 +171,6 @@ CONFIG_BPF_JIT=y
# CONFIG_PCIEPORTBUS is not set
# CONFIG_SND_HDA_INTEL is not set
CONFIG_BLK_DEV_RSXX=m
CONFIG_POWERNV_MSI=y
CONFIG_KVM_XICS=y

11
config-x86-generic
View File

@ -459,3 +459,14 @@ CONFIG_MODULE_SIG_UEFI=y
CONFIG_VMXNET3=m
CONFIG_VFIO_PCI_VGA=y
CONFIG_EFIVAR_FS=y
CONFIG_HYPERVISOR_GUEST=y
CONFIG_KVM_DEVICE_ASSIGNMENT=y
CONFIG_NFC_MEI_PHY=m
CONFIG_PVPANIC=m
CONFIG_X86_AMD_FREQ_SENSITIVITY=m
CONFIG_FB_HYPERV=m
CONFIG_NFC_MICROREAD_MEI=m
CONFIG_NFC_PN544_MEI=m

5
config-x86_64-generic
View File

@ -157,3 +157,8 @@ CONFIG_SFC_MTD=y
CONFIG_MTD_CHAR=m
CONFIG_MTD_BLOCK=m
CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64=m
CONFIG_CRYPTO_SERPENT_AVX2_X86_64=m
CONFIG_CRYPTO_SHA256_SSSE3=m
CONFIG_CRYPTO_SHA512_SSSE3=m

66
debug-bad-pte-dmi.patch
View File

@ -1,66 +0,0 @@
--- linux.orig/include/asm-generic/bug.h
+++ linux/include/asm-generic/bug.h
@@ -55,6 +55,8 @@ struct bug_entry {
#define BUG_ON(condition) do { if (unlikely(condition)) BUG(); } while(0)
#endif
+void print_hardware_dmi_name(void);
+
/*
* WARN(), WARN_ON(), WARN_ON_ONCE, and so on can be used to report
* significant issues that need prompt attention if they should ever
--- linux.orig/kernel/panic.c
+++ linux/kernel/panic.c
@@ -391,6 +391,15 @@ void oops_exit(void)
kmsg_dump(KMSG_DUMP_OOPS);
}
+void print_hardware_dmi_name(void)
+{
+ const char *board;
+
+ board = dmi_get_system_info(DMI_PRODUCT_NAME);
+ if (board)
+ printk(KERN_WARNING "Hardware name: %s\n", board);
+}
+
#ifdef WANT_WARN_ON_SLOWPATH
struct slowpath_args {
const char *fmt;
@@ -400,13 +409,10 @@ struct slowpath_args {
static void warn_slowpath_common(const char *file, int line, void *caller,
unsigned taint, struct slowpath_args *args)
{
- const char *board;
-
printk(KERN_WARNING "------------[ cut here ]------------\n");
printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
- board = dmi_get_system_info(DMI_PRODUCT_NAME);
- if (board)
- printk(KERN_WARNING "Hardware name: %s\n", board);
+
+ print_hardware_dmi_name();
if (args)
vprintk(args->fmt, args->args);
--- linux.orig/mm/memory.c
+++ linux/mm/memory.c
@@ -706,6 +706,8 @@ static void print_bad_pte(struct vm_area
"BUG: Bad page map in process %s pte:%08llx pmd:%08llx\n",
current->comm,
(long long)pte_val(pte), (long long)pmd_val(*pmd));
+ print_hardware_dmi_name();
+
if (page)
dump_page(page);
printk(KERN_ALERT
--- linux.orig/mm/page_alloc.c
+++ linux/mm/page_alloc.c
@@ -321,6 +321,7 @@ static void bad_page(struct page *page)
current->comm, page_to_pfn(page));
dump_page(page);
+ print_hardware_dmi_name();
print_modules();
dump_stack();
out:

20
debug-bad-pte-modules.patch
View File

@ -1,20 +0,0 @@
diff -durpN '--exclude-from=/home/davej/.exclude' /home/davej/src/kernel/git-trees/linux/mm/memory.c linux-dj/mm/memory.c
--- /home/davej/src/kernel/git-trees/linux/mm/memory.c 2013-02-26 14:41:18.591116577 -0500
+++ linux-dj/mm/memory.c 2013-02-28 20:04:37.678304092 -0500
@@ -57,6 +57,7 @@
#include <linux/swapops.h>
#include <linux/elf.h>
#include <linux/gfp.h>
+#include <linux/module.h>
#include <linux/migrate.h>
#include <linux/string.h>
@@ -719,6 +722,7 @@ static void print_bad_pte(struct vm_area
if (vma->vm_file && vma->vm_file->f_op)
print_symbol(KERN_ALERT "vma->vm_file->f_op->mmap: %s\n",
(unsigned long)vma->vm_file->f_op->mmap);
+ print_modules();
dump_stack();
add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE);
}

22
drm-i915-dp-stfu.patch
View File

@ -1,17 +1,17 @@
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f61cb79..64a24c0 100644
index fb2fbc1..0aaf67d 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -315,7 +315,7 @@ intel_dp_check_edp(struct intel_dp *intel_dp)
if (!is_edp(intel_dp))
return;
@@ -283,7 +283,7 @@ intel_dp_check_edp(struct intel_dp *intel_dp)
pp_ctrl_reg = IS_VALLEYVIEW(dev) ? PIPEA_PP_CONTROL : PCH_PP_CONTROL;
if (!ironlake_edp_have_panel_power(intel_dp) && !ironlake_edp_have_panel_vdd(intel_dp)) {
- WARN(1, "eDP powered off while attempting aux channel communication.\n");
+ DRM_ERROR("eDP powered off while attempting aux channel communication.\n");
DRM_DEBUG_KMS("Status 0x%08x Control 0x%08x\n",
I915_READ(PCH_PP_STATUS),
I915_READ(PCH_PP_CONTROL));
@@ -446,7 +446,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
I915_READ(pp_stat_reg),
I915_READ(pp_ctrl_reg));
@@ -376,7 +376,7 @@ intel_dp_aux_ch(struct intel_dp *intel_dp,
}
if (try == 3) {
@ -20,7 +20,7 @@ index f61cb79..64a24c0 100644
I915_READ(ch_ctl));
ret = -EBUSY;
goto out;
@@ -1083,8 +1083,8 @@ void ironlake_edp_panel_vdd_on(struct intel_dp *intel_dp)
@@ -995,8 +995,8 @@ void ironlake_edp_panel_vdd_on(struct intel_dp *intel_dp)
return;
DRM_DEBUG_KMS("Turn eDP VDD on\n");
@ -31,7 +31,7 @@ index f61cb79..64a24c0 100644
intel_dp->want_panel_vdd = true;
@@ -1151,7 +1151,8 @@ void ironlake_edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync)
@@ -1070,7 +1070,8 @@ void ironlake_edp_panel_vdd_off(struct intel_dp *intel_dp, bool sync)
return;
DRM_DEBUG_KMS("Turn eDP VDD off %d\n", intel_dp->want_panel_vdd);
@ -41,7 +41,7 @@ index f61cb79..64a24c0 100644
intel_dp->want_panel_vdd = false;
@@ -1221,7 +1222,8 @@ void ironlake_edp_panel_off(struct intel_dp *intel_dp)
@@ -1144,7 +1145,8 @@ void ironlake_edp_panel_off(struct intel_dp *intel_dp)
DRM_DEBUG_KMS("Turn eDP power off\n");
@ -49,5 +49,5 @@ index f61cb79..64a24c0 100644
+ if (!intel_dp->want_panel_vdd)
+ DRM_ERROR("Need VDD to turn off panel\n");
pp = ironlake_get_pp_control(dev_priv);
pp = ironlake_get_pp_control(intel_dp);
/* We need to switch off panel power _and_ force vdd, for otherwise some

593
drm-qxl-3.10-rc7-diff.patch
View File

@ -1,593 +0,0 @@
From be71369a5b4297776fb9988e6274595136294588 Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Tue, 16 Apr 2013 13:24:25 +1000
Subject: [PATCH 4/5] drm/qxl 3.10-rc7 diff
drm/qxl: make lots of things static.
drm/qxl: fix smatch warnings
drm/qxl: fix build with debugfs turned off.
drivers, drm: fix qxl build error when debugfs is disabled
drm/qxl: fix ioport interactions for kernel submitted commands.
qxl: drop unused variable.
drm/qxl: drop active_user_framebuffer as its unneeded
qxl: fix bug with object eviction and update area
qxl: fix Kconfig deps - select FB_DEFERRED_IO
drm/qxl: fix build warnings on 32-bit
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/qxl/Kconfig | 1 +
drivers/gpu/drm/qxl/qxl_cmd.c | 52 +++++++++++++++++----------------------
drivers/gpu/drm/qxl/qxl_debugfs.c | 6 +++++
drivers/gpu/drm/qxl/qxl_display.c | 36 +++++++++++----------------
drivers/gpu/drm/qxl/qxl_drv.c | 2 +-
drivers/gpu/drm/qxl/qxl_drv.h | 7 ------
drivers/gpu/drm/qxl/qxl_fb.c | 2 +-
drivers/gpu/drm/qxl/qxl_gem.c | 29 ----------------------
drivers/gpu/drm/qxl/qxl_ioctl.c | 29 +++++++++++-----------
drivers/gpu/drm/qxl/qxl_kms.c | 11 +++++----
drivers/gpu/drm/qxl/qxl_object.c | 6 ++---
drivers/gpu/drm/qxl/qxl_release.c | 4 +--
drivers/gpu/drm/qxl/qxl_ttm.c | 10 +++++---
13 files changed, 78 insertions(+), 117 deletions(-)
diff --git a/drivers/gpu/drm/qxl/Kconfig b/drivers/gpu/drm/qxl/Kconfig
index 2f1a57e..d6c1279 100644
--- a/drivers/gpu/drm/qxl/Kconfig
+++ b/drivers/gpu/drm/qxl/Kconfig
@@ -4,6 +4,7 @@ config DRM_QXL
select FB_SYS_FILLRECT
select FB_SYS_COPYAREA
select FB_SYS_IMAGEBLIT
+ select FB_DEFERRED_IO
select DRM_KMS_HELPER
select DRM_TTM
help
diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
index 804b411..02befd9 100644
--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -144,8 +144,8 @@ int qxl_ring_push(struct qxl_ring *ring,
return 0;
}
-bool qxl_ring_pop(struct qxl_ring *ring,
- void *element)
+static bool qxl_ring_pop(struct qxl_ring *ring,
+ void *element)
{
volatile struct qxl_ring_header *header = &(ring->ring->header);
volatile uint8_t *ring_elt;
@@ -169,23 +169,6 @@ bool qxl_ring_pop(struct qxl_ring *ring,
return true;
}
-void qxl_ring_wait_idle(struct qxl_ring *ring)
-{
- struct qxl_ring_header *header = &(ring->ring->header);
- unsigned long flags;
-
- spin_lock_irqsave(&ring->lock, flags);
- if (ring->ring->header.cons < ring->ring->header.prod) {
- header->notify_on_cons = header->prod;
- mb();
- spin_unlock_irqrestore(&ring->lock, flags);
- wait_event_interruptible(*ring->push_event,
- qxl_check_idle(ring));
- spin_lock_irqsave(&ring->lock, flags);
- }
- spin_unlock_irqrestore(&ring->lock, flags);
-}
-
int
qxl_push_command_ring_release(struct qxl_device *qdev, struct qxl_release *release,
uint32_t type, bool interruptible)
@@ -294,7 +277,7 @@ out_unref:
return 0;
}
-static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
+static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port, bool intr)
{
int irq_num;
long addr = qdev->io_base + port;
@@ -302,20 +285,29 @@ static int wait_for_io_cmd_user(struct qxl_device *qdev, uint8_t val, long port)
mutex_lock(&qdev->async_io_mutex);
irq_num = atomic_read(&qdev->irq_received_io_cmd);
-
-
if (qdev->last_sent_io_cmd > irq_num) {
- ret = wait_event_interruptible(qdev->io_cmd_event,
- atomic_read(&qdev->irq_received_io_cmd) > irq_num);
- if (ret)
+ if (intr)
+ ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
+ atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+ else
+ ret = wait_event_timeout(qdev->io_cmd_event,
+ atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+ /* 0 is timeout, just bail the "hw" has gone away */
+ if (ret <= 0)
goto out;
irq_num = atomic_read(&qdev->irq_received_io_cmd);
}
outb(val, addr);
qdev->last_sent_io_cmd = irq_num + 1;
- ret = wait_event_interruptible(qdev->io_cmd_event,
- atomic_read(&qdev->irq_received_io_cmd) > irq_num);
+ if (intr)
+ ret = wait_event_interruptible_timeout(qdev->io_cmd_event,
+ atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
+ else
+ ret = wait_event_timeout(qdev->io_cmd_event,
+ atomic_read(&qdev->irq_received_io_cmd) > irq_num, 5*HZ);
out:
+ if (ret > 0)
+ ret = 0;
mutex_unlock(&qdev->async_io_mutex);
return ret;
}
@@ -325,7 +317,7 @@ static void wait_for_io_cmd(struct qxl_device *qdev, uint8_t val, long port)
int ret;
restart:
- ret = wait_for_io_cmd_user(qdev, val, port);
+ ret = wait_for_io_cmd_user(qdev, val, port, false);
if (ret == -ERESTARTSYS)
goto restart;
}
@@ -357,7 +349,7 @@ int qxl_io_update_area(struct qxl_device *qdev, struct qxl_bo *surf,
mutex_lock(&qdev->update_area_mutex);
qdev->ram_header->update_area = *area;
qdev->ram_header->update_surface = surface_id;
- ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC);
+ ret = wait_for_io_cmd_user(qdev, 0, QXL_IO_UPDATE_AREA_ASYNC, true);
mutex_unlock(&qdev->update_area_mutex);
return ret;
}
@@ -609,7 +601,7 @@ retry:
return ret;
}
-void qxl_surface_evict_locked(struct qxl_device *qdev, struct qxl_bo *surf, bool do_update_area)
+static void qxl_surface_evict_locked(struct qxl_device *qdev, struct qxl_bo *surf, bool do_update_area)
{
/* no need to update area if we are just freeing the surface normally */
if (do_update_area)
diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c
index c630152..c3c2bbd 100644
--- a/drivers/gpu/drm/qxl/qxl_debugfs.c
+++ b/drivers/gpu/drm/qxl/qxl_debugfs.c
@@ -35,6 +35,7 @@
#include "qxl_object.h"
+#if defined(CONFIG_DEBUG_FS)
static int
qxl_debugfs_irq_received(struct seq_file *m, void *data)
{
@@ -69,20 +70,25 @@ static struct drm_info_list qxl_debugfs_list[] = {
{ "qxl_buffers", qxl_debugfs_buffers_info, 0, NULL },
};
#define QXL_DEBUGFS_ENTRIES ARRAY_SIZE(qxl_debugfs_list)
+#endif
int
qxl_debugfs_init(struct drm_minor *minor)
{
+#if defined(CONFIG_DEBUG_FS)
drm_debugfs_create_files(qxl_debugfs_list, QXL_DEBUGFS_ENTRIES,
minor->debugfs_root, minor);
+#endif
return 0;
}
void
qxl_debugfs_takedown(struct drm_minor *minor)
{
+#if defined(CONFIG_DEBUG_FS)
drm_debugfs_remove_files(qxl_debugfs_list, QXL_DEBUGFS_ENTRIES,
minor);
+#endif
}
int qxl_debugfs_add_files(struct qxl_device *qdev,
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index c80ddfe..823d29e 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -84,6 +84,7 @@ void qxl_alloc_client_monitors_config(struct qxl_device *qdev, unsigned count)
if (qdev->client_monitors_config &&
count > qdev->client_monitors_config->count) {
kfree(qdev->client_monitors_config);
+ qdev->client_monitors_config = NULL;
}
if (!qdev->client_monitors_config) {
qdev->client_monitors_config = kzalloc(
@@ -413,11 +414,11 @@ static void qxl_user_framebuffer_destroy(struct drm_framebuffer *fb)
kfree(qxl_fb);
}
-int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
- struct drm_file *file_priv,
- unsigned flags, unsigned color,
- struct drm_clip_rect *clips,
- unsigned num_clips)
+static int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
+ struct drm_file *file_priv,
+ unsigned flags, unsigned color,
+ struct drm_clip_rect *clips,
+ unsigned num_clips)
{
/* TODO: vmwgfx where this was cribbed from had locking. Why? */
struct qxl_framebuffer *qxl_fb = to_qxl_framebuffer(fb);
@@ -427,10 +428,10 @@ int qxl_framebuffer_surface_dirty(struct drm_framebuffer *fb,
int inc = 1;
qobj = gem_to_qxl_bo(qxl_fb->obj);
- if (qxl_fb != qdev->active_user_framebuffer) {
- DRM_INFO("%s: qxl_fb 0x%p != qdev->active_user_framebuffer 0x%p\n",
- __func__, qxl_fb, qdev->active_user_framebuffer);
- }
+ /* if we aren't primary surface ignore this */
+ if (!qobj->is_primary)
+ return 0;
+
if (!num_clips) {
num_clips = 1;
clips = &norect;
@@ -603,7 +604,6 @@ static int qxl_crtc_mode_set(struct drm_crtc *crtc,
mode->hdisplay,
mode->vdisplay);
}
- qdev->mode_set = true;
return 0;
}
@@ -619,7 +619,7 @@ static void qxl_crtc_commit(struct drm_crtc *crtc)
DRM_DEBUG("\n");
}
-void qxl_crtc_load_lut(struct drm_crtc *crtc)
+static void qxl_crtc_load_lut(struct drm_crtc *crtc)
{
DRM_DEBUG("\n");
}
@@ -633,7 +633,7 @@ static const struct drm_crtc_helper_funcs qxl_crtc_helper_funcs = {
.load_lut = qxl_crtc_load_lut,
};
-int qdev_crtc_init(struct drm_device *dev, int num_crtc)
+static int qdev_crtc_init(struct drm_device *dev, int num_crtc)
{
struct qxl_crtc *qxl_crtc;
@@ -764,7 +764,7 @@ static int qxl_conn_mode_valid(struct drm_connector *connector,
return MODE_OK;
}
-struct drm_encoder *qxl_best_encoder(struct drm_connector *connector)
+static struct drm_encoder *qxl_best_encoder(struct drm_connector *connector)
{
struct qxl_output *qxl_output =
drm_connector_to_qxl_output(connector);
@@ -855,7 +855,7 @@ static const struct drm_encoder_funcs qxl_enc_funcs = {
.destroy = qxl_enc_destroy,
};
-int qdev_output_init(struct drm_device *dev, int num_output)
+static int qdev_output_init(struct drm_device *dev, int num_output)
{
struct qxl_output *qxl_output;
struct drm_connector *connector;
@@ -892,7 +892,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
{
struct drm_gem_object *obj;
struct qxl_framebuffer *qxl_fb;
- struct qxl_device *qdev = dev->dev_private;
int ret;
obj = drm_gem_object_lookup(dev, file_priv, mode_cmd->handles[0]);
@@ -908,13 +907,6 @@ qxl_user_framebuffer_create(struct drm_device *dev,
return NULL;
}
- if (qdev->active_user_framebuffer) {
- DRM_INFO("%s: active_user_framebuffer %p -> %p\n",
- __func__,
- qdev->active_user_framebuffer, qxl_fb);
- }
- qdev->active_user_framebuffer = qxl_fb;
-
return &qxl_fb->base;
}
diff --git a/drivers/gpu/drm/qxl/qxl_drv.c b/drivers/gpu/drm/qxl/qxl_drv.c
index d337da0..aa291d8 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.c
+++ b/drivers/gpu/drm/qxl/qxl_drv.c
@@ -46,7 +46,7 @@ static DEFINE_PCI_DEVICE_TABLE(pciidlist) = {
};
MODULE_DEVICE_TABLE(pci, pciidlist);
-int qxl_modeset = -1;
+static int qxl_modeset = -1;
MODULE_PARM_DESC(modeset, "Disable/Enable modesetting");
module_param_named(modeset, qxl_modeset, int, 0400);
diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
index 52b582c..43d06ab 100644
--- a/drivers/gpu/drm/qxl/qxl_drv.h
+++ b/drivers/gpu/drm/qxl/qxl_drv.h
@@ -255,12 +255,6 @@ struct qxl_device {
struct qxl_gem gem;
struct qxl_mode_info mode_info;
- /*
- * last created framebuffer with fb_create
- * only used by debugfs dumbppm
- */
- struct qxl_framebuffer *active_user_framebuffer;
-
struct fb_info *fbdev_info;
struct qxl_framebuffer *fbdev_qfb;
void *ram_physical;
@@ -270,7 +264,6 @@ struct qxl_device {
struct qxl_ring *cursor_ring;
struct qxl_ram_header *ram_header;
- bool mode_set;
bool primary_created;
diff --git a/drivers/gpu/drm/qxl/qxl_fb.c b/drivers/gpu/drm/qxl/qxl_fb.c
index 232b52b..b3c5127 100644
--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
@@ -159,7 +159,7 @@ static void qxl_deferred_io(struct fb_info *info,
};
-struct fb_deferred_io qxl_defio = {
+static struct fb_deferred_io qxl_defio = {
.delay = QXL_DIRTY_DELAY,
.deferred_io = qxl_deferred_io,
};
diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c
index adc1ee2..a235693 100644
--- a/drivers/gpu/drm/qxl/qxl_gem.c
+++ b/drivers/gpu/drm/qxl/qxl_gem.c
@@ -127,35 +127,6 @@ void qxl_gem_object_unpin(struct drm_gem_object *obj)
}
}
-int qxl_gem_set_domain(struct drm_gem_object *gobj,
- uint32_t rdomain, uint32_t wdomain)
-{
- struct qxl_bo *qobj;
- uint32_t domain;
- int r;
-
- /* FIXME: reeimplement */
- qobj = gobj->driver_private;
- /* work out where to validate the buffer to */
- domain = wdomain;
- if (!domain)
- domain = rdomain;
- if (!domain) {
- /* Do nothings */
- pr_warn("Set domain withou domain !\n");
- return 0;
- }
- if (domain == QXL_GEM_DOMAIN_CPU) {
- /* Asking for cpu access wait for object idle */
- r = qxl_bo_wait(qobj, NULL, false);
- if (r) {
- pr_err("Failed to wait for object !\n");
- return r;
- }
- }
- return 0;
-}
-
int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv)
{
return 0;
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index 83ca4f7..a4b71b2 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -30,8 +30,8 @@
* TODO: allocating a new gem(in qxl_bo) for each request.
* This is wasteful since bo's are page aligned.
*/
-int qxl_alloc_ioctl(struct drm_device *dev, void *data,
- struct drm_file *file_priv)
+static int qxl_alloc_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
{
struct qxl_device *qdev = dev->dev_private;
struct drm_qxl_alloc *qxl_alloc = data;
@@ -58,8 +58,8 @@ int qxl_alloc_ioctl(struct drm_device *dev, void *data,
return 0;
}
-int qxl_map_ioctl(struct drm_device *dev, void *data,
- struct drm_file *file_priv)
+static int qxl_map_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
{
struct qxl_device *qdev = dev->dev_private;
struct drm_qxl_map *qxl_map = data;
@@ -101,9 +101,9 @@ apply_surf_reloc(struct qxl_device *qdev, struct qxl_bo *dst, uint64_t dst_off,
}
/* return holding the reference to this object */
-struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- struct drm_file *file_priv, uint64_t handle,
- struct qxl_reloc_list *reloc_list)
+static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
+ struct drm_file *file_priv, uint64_t handle,
+ struct qxl_reloc_list *reloc_list)
{
struct drm_gem_object *gobj;
struct qxl_bo *qobj;
@@ -129,8 +129,8 @@ struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
* However, the command as passed from user space must *not* contain the initial
* QXLReleaseInfo struct (first XXX bytes)
*/
-int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
- struct drm_file *file_priv)
+static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *file_priv)
{
struct qxl_device *qdev = dev->dev_private;
struct drm_qxl_execbuffer *execbuffer = data;
@@ -151,7 +151,7 @@ int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
struct qxl_bo *cmd_bo;
int release_type;
struct drm_qxl_command *commands =
- (struct drm_qxl_command *)execbuffer->commands;
+ (struct drm_qxl_command *)(uintptr_t)execbuffer->commands;
if (DRM_COPY_FROM_USER(&user_cmd, &commands[cmd_num],
sizeof(user_cmd)))
@@ -193,7 +193,7 @@ int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
for (i = 0 ; i < user_cmd.relocs_num; ++i) {
if (DRM_COPY_FROM_USER(&reloc,
- &((struct drm_qxl_reloc *)user_cmd.relocs)[i],
+ &((struct drm_qxl_reloc *)(uintptr_t)user_cmd.relocs)[i],
sizeof(reloc))) {
qxl_bo_list_unreserve(&reloc_list, true);
qxl_release_unreserve(qdev, release);
@@ -266,8 +266,8 @@ int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
return 0;
}
-int qxl_update_area_ioctl(struct drm_device *dev, void *data,
- struct drm_file *file)
+static int qxl_update_area_ioctl(struct drm_device *dev, void *data,
+ struct drm_file *file)
{
struct qxl_device *qdev = dev->dev_private;
struct drm_qxl_update_area *update_area = data;
@@ -294,6 +294,7 @@ int qxl_update_area_ioctl(struct drm_device *dev, void *data,
goto out;
if (!qobj->pin_count) {
+ qxl_ttm_placement_from_domain(qobj, qobj->type);
ret = ttm_bo_validate(&qobj->tbo, &qobj->placement,
true, false);
if (unlikely(ret))
@@ -347,7 +348,7 @@ static int qxl_clientcap_ioctl(struct drm_device *dev, void *data,
if (qdev->pdev->revision < 4)
return -ENOSYS;
- if (byte > 58)
+ if (byte >= 58)
return -ENOSYS;
if (qdev->rom->client_capabilities[byte] & (1 << idx))
diff --git a/drivers/gpu/drm/qxl/qxl_kms.c b/drivers/gpu/drm/qxl/qxl_kms.c
index 036e0de..e27ce2a 100644
--- a/drivers/gpu/drm/qxl/qxl_kms.c
+++ b/drivers/gpu/drm/qxl/qxl_kms.c
@@ -128,12 +128,13 @@ int qxl_device_init(struct qxl_device *qdev,
qdev->vram_mapping = io_mapping_create_wc(qdev->vram_base, pci_resource_len(pdev, 0));
qdev->surface_mapping = io_mapping_create_wc(qdev->surfaceram_base, qdev->surfaceram_size);
- DRM_DEBUG_KMS("qxl: vram %p-%p(%dM %dk), surface %p-%p(%dM %dk)\n",
- (void *)qdev->vram_base, (void *)pci_resource_end(pdev, 0),
+ DRM_DEBUG_KMS("qxl: vram %llx-%llx(%dM %dk), surface %llx-%llx(%dM %dk)\n",
+ (unsigned long long)qdev->vram_base,
+ (unsigned long long)pci_resource_end(pdev, 0),
(int)pci_resource_len(pdev, 0) / 1024 / 1024,
(int)pci_resource_len(pdev, 0) / 1024,
- (void *)qdev->surfaceram_base,
- (void *)pci_resource_end(pdev, 1),
+ (unsigned long long)qdev->surfaceram_base,
+ (unsigned long long)pci_resource_end(pdev, 1),
(int)qdev->surfaceram_size / 1024 / 1024,
(int)qdev->surfaceram_size / 1024);
@@ -230,7 +231,7 @@ int qxl_device_init(struct qxl_device *qdev,
return 0;
}
-void qxl_device_fini(struct qxl_device *qdev)
+static void qxl_device_fini(struct qxl_device *qdev)
{
if (qdev->current_release_bo[0])
qxl_bo_unref(&qdev->current_release_bo[0]);
diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c
index 51efb94..d9b12e7 100644
--- a/drivers/gpu/drm/qxl/qxl_object.c
+++ b/drivers/gpu/drm/qxl/qxl_object.c
@@ -59,11 +59,11 @@ void qxl_ttm_placement_from_domain(struct qxl_bo *qbo, u32 domain)
qbo->placement.lpfn = 0;
qbo->placement.placement = qbo->placements;
qbo->placement.busy_placement = qbo->placements;
- if (domain & QXL_GEM_DOMAIN_VRAM)
+ if (domain == QXL_GEM_DOMAIN_VRAM)
qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_VRAM;
- if (domain & QXL_GEM_DOMAIN_SURFACE)
+ if (domain == QXL_GEM_DOMAIN_SURFACE)
qbo->placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_PRIV0;
- if (domain & QXL_GEM_DOMAIN_CPU)
+ if (domain == QXL_GEM_DOMAIN_CPU)
qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
if (!c)
qbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 1600781..c4267c7 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -117,8 +117,8 @@ qxl_release_add_res(struct qxl_device *qdev, struct qxl_release *release,
release->bos[release->bo_count++] = qxl_bo_ref(bo);
}
-int qxl_release_bo_alloc(struct qxl_device *qdev,
- struct qxl_bo **bo)
+static int qxl_release_bo_alloc(struct qxl_device *qdev,
+ struct qxl_bo **bo)
{
int ret;
ret = qxl_bo_create(qdev, PAGE_SIZE, false, QXL_GEM_DOMAIN_VRAM, NULL,
diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
index aa9fb9a..489cb8c 100644
--- a/drivers/gpu/drm/qxl/qxl_ttm.c
+++ b/drivers/gpu/drm/qxl/qxl_ttm.c
@@ -315,9 +315,9 @@ static void qxl_ttm_tt_unpopulate(struct ttm_tt *ttm)
ttm_pool_unpopulate(ttm);
}
-struct ttm_tt *qxl_ttm_tt_create(struct ttm_bo_device *bdev,
- unsigned long size, uint32_t page_flags,
- struct page *dummy_read_page)
+static struct ttm_tt *qxl_ttm_tt_create(struct ttm_bo_device *bdev,
+ unsigned long size, uint32_t page_flags,
+ struct page *dummy_read_page)
{
struct qxl_device *qdev;
struct qxl_ttm_tt *gtt;
@@ -555,6 +555,7 @@ static int qxl_mm_dump_table(struct seq_file *m, void *data)
static int qxl_ttm_debugfs_init(struct qxl_device *qdev)
{
+#if defined(CONFIG_DEBUG_FS)
static struct drm_info_list qxl_mem_types_list[QXL_DEBUGFS_MEM_TYPES];
static char qxl_mem_types_names[QXL_DEBUGFS_MEM_TYPES][32];
unsigned i;
@@ -574,4 +575,7 @@ static int qxl_ttm_debugfs_init(struct qxl_device *qdev)
}
return qxl_debugfs_add_files(qdev, qxl_mem_types_list, i);
+#else
+ return 0;
+#endif
}
--
1.8.3.1

30
drm-qxl-access-fix.patch
View File

@ -1,30 +0,0 @@
From 18097b91aaff215e843f04b84ec2c686270bb55f Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Fri, 28 Jun 2013 13:27:40 +1000
Subject: [PATCH] drm/qxl: add missing access check for execbuffer ioctl
Reported-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
index a4b71b2..a30f294 100644
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -171,6 +171,11 @@ static int qxl_execbuffer_ioctl(struct drm_device *dev, void *data,
if (user_cmd.command_size > PAGE_SIZE - sizeof(union qxl_release_info))
return -EINVAL;
+ if (!access_ok(VERIFY_READ,
+ (void *)(unsigned long)user_cmd.command,
+ user_cmd.command_size))
+ return -EFAULT;
+
ret = qxl_alloc_release_reserved(qdev,
sizeof(union qxl_release_info) +
user_cmd.command_size,
--
1.8.1.2

7507
drm-qxl-driver.patch
View File

File diff suppressed because it is too large Load Diff

86
drm-ttm-exports-for-qxl.patch
View File

@ -1,86 +0,0 @@
From b538d2921b8aaaa1d7abf1bf0ba3ab9330b0b0c8 Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@gmail.com>
Date: Tue, 22 Jan 2013 13:56:04 +1000
Subject: [PATCH 1/2] ttm: export functions to allow qxl do its own iomapping
qxl wants to use io mapping like i915 gem does, for now
just export the symbols so the driver can implement atomic
page maps using io mapping.
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
drivers/gpu/drm/ttm/ttm_bo_util.c | 13 +++++++++----
include/drm/ttm/ttm_bo_driver.h | 4 ++++
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 44420fc..aaf6f47 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -86,6 +86,7 @@ int ttm_mem_io_lock(struct ttm_mem_type_manager *man, bool interruptible)
mutex_lock(&man->io_reserve_mutex);
return 0;
}
+EXPORT_SYMBOL(ttm_mem_io_lock);
void ttm_mem_io_unlock(struct ttm_mem_type_manager *man)
{
@@ -94,6 +95,7 @@ void ttm_mem_io_unlock(struct ttm_mem_type_manager *man)
mutex_unlock(&man->io_reserve_mutex);
}
+EXPORT_SYMBOL(ttm_mem_io_unlock);
static int ttm_mem_io_evict(struct ttm_mem_type_manager *man)
{
@@ -111,8 +113,9 @@ static int ttm_mem_io_evict(struct ttm_mem_type_manager *man)
return 0;
}
-static int ttm_mem_io_reserve(struct ttm_bo_device *bdev,
- struct ttm_mem_reg *mem)
+
+int ttm_mem_io_reserve(struct ttm_bo_device *bdev,
+ struct ttm_mem_reg *mem)
{
struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type];
int ret = 0;
@@ -134,9 +137,10 @@ retry:
}
return ret;
}
+EXPORT_SYMBOL(ttm_mem_io_reserve);
-static void ttm_mem_io_free(struct ttm_bo_device *bdev,
- struct ttm_mem_reg *mem)
+void ttm_mem_io_free(struct ttm_bo_device *bdev,
+ struct ttm_mem_reg *mem)
{
struct ttm_mem_type_manager *man = &bdev->man[mem->mem_type];
@@ -149,6 +153,7 @@ static void ttm_mem_io_free(struct ttm_bo_device *bdev,
bdev->driver->io_mem_free(bdev, mem);
}
+EXPORT_SYMBOL(ttm_mem_io_free);
int ttm_mem_io_reserve_vm(struct ttm_buffer_object *bo)
{
diff --git a/include/drm/ttm/ttm_bo_driver.h b/include/drm/ttm/ttm_bo_driver.h
index 0fbd046..9c8dca7 100644
--- a/include/drm/ttm/ttm_bo_driver.h
+++ b/include/drm/ttm/ttm_bo_driver.h
@@ -902,6 +902,10 @@ extern void ttm_bo_unreserve_locked(struct ttm_buffer_object *bo);
* ttm_bo_util.c
*/
+int ttm_mem_io_reserve(struct ttm_bo_device *bdev,
+ struct ttm_mem_reg *mem);
+void ttm_mem_io_free(struct ttm_bo_device *bdev,
+ struct ttm_mem_reg *mem);
/**
* ttm_bo_move_ttm
*
--
1.8.1.4

134
forcedeth-dma-error-check.patch
View File

@ -1,134 +0,0 @@
From e33f52b67b45dd95b973260c54c6ef207ee44f84 Mon Sep 17 00:00:00 2001
From: Neil Horman <nhorman@tuxdriver.com>
Date: Tue, 26 Mar 2013 14:36:56 -0400
Subject: [PATCH] forcedeth: Do a dma_mapping_error check after
skb_frag_dma_map
This backtrace was recently reported on a 3.9 kernel:
Actual results: from syslog /var/log/messsages:
kernel: [17539.340285] ------------[ cut here ]------------
kernel: [17539.341012] WARNING: at lib/dma-debug.c:937 check_unmap+0x493/0x960()
kernel: [17539.341012] Hardware name: MS-7125
kernel: [17539.341012] forcedeth 0000:00:0a.0: DMA-API: device driver failed to
check map error[device address=0x0000000013c88000] [size=544 bytes] [mapped as
page]
kernel: [17539.341012] Modules linked in: fuse ebtable_nat ipt_MASQUERADE
nf_conntrack_netbios_ns nf_conntrack_broadcast ip6table_nat nf_nat_ipv6
ip6table_mangle ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 iptable_nat
nf_nat_ipv4 nf_nat iptable_mangle nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack
nf_conntrack bnep bluetooth rfkill ebtable_filter ebtables ip6table_filter
ip6_tables snd_hda_codec_hdmi snd_cmipci snd_mpu401_uart snd_hda_intel
snd_intel8x0 snd_opl3_lib snd_ac97_codec gameport snd_hda_codec snd_rawmidi
ac97_bus snd_hwdep snd_seq snd_seq_device snd_pcm snd_page_alloc snd_timer snd
k8temp soundcore serio_raw i2c_nforce2 forcedeth ata_generic pata_acpi nouveau
video mxm_wmi wmi i2c_algo_bit drm_kms_helper ttm drm i2c_core sata_sil pata_amd
sata_nv uinput
kernel: [17539.341012] Pid: 17340, comm: sshd Not tainted
3.9.0-0.rc4.git0.1.fc19.i686.PAE #1
kernel: [17539.341012] Call Trace:
kernel: [17539.341012] [<c045573c>] warn_slowpath_common+0x6c/0xa0
kernel: [17539.341012] [<c0701953>] ? check_unmap+0x493/0x960
kernel: [17539.341012] [<c0701953>] ? check_unmap+0x493/0x960
kernel: [17539.341012] [<c04557a3>] warn_slowpath_fmt+0x33/0x40
kernel: [17539.341012] [<c0701953>] check_unmap+0x493/0x960
kernel: [17539.341012] [<c049238f>] ? sched_clock_cpu+0xdf/0x150
kernel: [17539.341012] [<c0701e87>] debug_dma_unmap_page+0x67/0x70
kernel: [17539.341012] [<f7eae8f2>] nv_unmap_txskb.isra.32+0x92/0x100
Its pretty plainly the result of an skb fragment getting unmapped without having
its initial mapping operation checked for errors. This patch corrects that
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: "David S. Miller" <davem@davemloft.net>
---
drivers/net/ethernet/nvidia/forcedeth.c | 41 ++++++++++++++++++++++++++++++++-
1 file changed, 40 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/nvidia/forcedeth.c b/drivers/net/ethernet/nvidia/forcedeth.c
index b62262c..5ae1247 100644
--- a/drivers/net/ethernet/nvidia/forcedeth.c
+++ b/drivers/net/ethernet/nvidia/forcedeth.c
@@ -2200,6 +2200,7 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
struct ring_desc *start_tx;
struct ring_desc *prev_tx;
struct nv_skb_map *prev_tx_ctx;
+ struct nv_skb_map *tmp_tx_ctx = NULL, *start_tx_ctx = NULL;
unsigned long flags;
/* add fragments to entries count */
@@ -2261,12 +2262,31 @@ static netdev_tx_t nv_start_xmit(struct sk_buff *skb, struct net_device *dev)
do {
prev_tx = put_tx;
prev_tx_ctx = np->put_tx_ctx;
+ if (!start_tx_ctx)
+ start_tx_ctx = tmp_tx_ctx = np->put_tx_ctx;
+
bcnt = (frag_size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : frag_size;
np->put_tx_ctx->dma = skb_frag_dma_map(
&np->pci_dev->dev,
frag, offset,
bcnt,
DMA_TO_DEVICE);
+ if (dma_mapping_error(&np->pci_dev->dev, np->put_tx_ctx->dma)) {
+
+ /* Unwind the mapped fragments */
+ do {
+ nv_unmap_txskb(np, start_tx_ctx);
+ if (unlikely(tmp_tx_ctx++ == np->last_tx_ctx))
+ tmp_tx_ctx = np->first_tx_ctx;
+ } while (tmp_tx_ctx != np->put_tx_ctx);
+ kfree_skb(skb);
+ np->put_tx_ctx = start_tx_ctx;
+ u64_stats_update_begin(&np->swstats_tx_syncp);
+ np->stat_tx_dropped++;
+ u64_stats_update_end(&np->swstats_tx_syncp);
+ return NETDEV_TX_OK;
+ }
+
np->put_tx_ctx->dma_len = bcnt;
np->put_tx_ctx->dma_single = 0;
put_tx->buf = cpu_to_le32(np->put_tx_ctx->dma);
@@ -2327,7 +2347,8 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
struct ring_desc_ex *start_tx;
struct ring_desc_ex *prev_tx;
struct nv_skb_map *prev_tx_ctx;
- struct nv_skb_map *start_tx_ctx;
+ struct nv_skb_map *start_tx_ctx = NULL;
+ struct nv_skb_map *tmp_tx_ctx = NULL;
unsigned long flags;
/* add fragments to entries count */
@@ -2392,11 +2413,29 @@ static netdev_tx_t nv_start_xmit_optimized(struct sk_buff *skb,
prev_tx = put_tx;
prev_tx_ctx = np->put_tx_ctx;
bcnt = (frag_size > NV_TX2_TSO_MAX_SIZE) ? NV_TX2_TSO_MAX_SIZE : frag_size;
+ if (!start_tx_ctx)
+ start_tx_ctx = tmp_tx_ctx = np->put_tx_ctx;
np->put_tx_ctx->dma = skb_frag_dma_map(
&np->pci_dev->dev,
frag, offset,
bcnt,
DMA_TO_DEVICE);
+
+ if (dma_mapping_error(&np->pci_dev->dev, np->put_tx_ctx->dma)) {
+
+ /* Unwind the mapped fragments */
+ do {
+ nv_unmap_txskb(np, start_tx_ctx);
+ if (unlikely(tmp_tx_ctx++ == np->last_tx_ctx))
+ tmp_tx_ctx = np->first_tx_ctx;
+ } while (tmp_tx_ctx != np->put_tx_ctx);
+ kfree_skb(skb);
+ np->put_tx_ctx = start_tx_ctx;
+ u64_stats_update_begin(&np->swstats_tx_syncp);
+ np->stat_tx_dropped++;
+ u64_stats_update_end(&np->swstats_tx_syncp);
+ return NETDEV_TX_OK;
+ }
np->put_tx_ctx->dma_len = bcnt;
np->put_tx_ctx->dma_single = 0;
put_tx->bufhigh = cpu_to_le32(dma_high(np->put_tx_ctx->dma));
--
1.7.11.7

52
ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch
View File

@ -1,52 +0,0 @@
From a963a37d384d71ad43b3e9e79d68d42fbe0901f3 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 26 Jun 2013 04:15:07 -0700
Subject: [PATCH] ipv6: ip6_sk_dst_check() must not assume ipv6 dst
It's possible to use AF_INET6 sockets and to connect to an IPv4
destination. After this, socket dst cache is a pointer to a rtable,
not rt6_info.
ip6_sk_dst_check() should check the socket dst cache is IPv6, or else
various corruptions/crashes can happen.
Dave Jones can reproduce immediate crash with
trinity -q -l off -n -c sendmsg -c connect
With help from Hannes Frederic Sowa
Reported-by: Dave Jones <davej@redhat.com>
Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/ipv6/ip6_output.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 95703ba..d5d20cd 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -821,11 +821,17 @@ static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
const struct flowi6 *fl6)
{
struct ipv6_pinfo *np = inet6_sk(sk);
- struct rt6_info *rt = (struct rt6_info *)dst;
+ struct rt6_info *rt;
if (!dst)
goto out;
+ if (dst->ops->family != AF_INET6) {
+ dst_release(dst);
+ return NULL;
+ }
+
+ rt = (struct rt6_info *)dst;
/* Yes, checking route validity in not connected
* case is not very simple. Take into account,
* that we do not support routing by source, TOS,
--
1.8.2.1

119
kernel.spec
View File

@ -62,19 +62,19 @@ Summary: The Linux kernel
# For non-released -rc kernels, this will be appended after the rcX and
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
#
%global baserelease 304
%global baserelease 300
%global fedora_build %{baserelease}
# base_sublevel is the kernel version we're starting with and patching
# on top of -- for example, 3.1-rc7-git1 starts with a 3.0 base,
# which yields a base_sublevel of 0.
%define base_sublevel 9
%define base_sublevel 10
## If this is a released kernel ##
%if 0%{?released_kernel}
# Do we have a -stable update to apply?
%define stable_update 9
%define stable_update 1
# Is it a -stable RC?
%define stable_rc 0
# Set rpm version accordingly
@ -639,9 +639,6 @@ Patch100: taint-vbox.patch
Patch110: vmbugon-warnon.patch
Patch200: debug-bad-pte-dmi.patch
Patch201: debug-bad-pte-modules.patch
Patch390: defaults-acpi-video.patch
Patch391: acpi-video-dos.patch
Patch396: acpi-sony-nonvs-blacklist.patch
@ -668,11 +665,7 @@ Patch1000: devel-pekey-secure-boot-20130306.patch
# DRM
#atch1700: drm-edid-try-harder-to-fix-up-broken-headers.patch
#Patch1800: drm-vgem.patch
Patch1700: drm-ttm-exports-for-qxl.patch
Patch1701: drm-hotspot-cursor-backport.patch
Patch1702: drm-qxl-driver.patch
Patch1703: drm-qxl-3.10-rc7-diff.patch
Patch1704: drm-qxl-access-fix.patch
Patch1705: drm-qxl-post-3.10-feature-fixes.patch
Patch1706: drm-qxl-post-3.10-features-part-2.patch
# nouveau + drm fixes
@ -712,10 +705,7 @@ Patch21000: arm-export-read_current_timer.patch
Patch21001: arm-lpae-ax88796.patch
# ARM omap
Patch21002: arm-omap-ehci-fix.patch
Patch21003: arm-omap-load-tfp410.patch
# https://patchwork.kernel.org/patch/2414881/
Patch21004: arm-omap-fixdrm.patch
# ARM tegra
Patch21005: arm-tegra-usb-no-reset-linux33.patch
@ -737,9 +727,6 @@ Patch21247: ath9k_rx_dma_stop_check.patch
Patch21273: cfg80211-mac80211-disconnect-on-suspend.patch
Patch21274: mac80211_fixes_for_ieee80211_do_stop_while_suspend_v3.9.patch
#rhbz 859282
Patch21275: VMX-x86-handle-host-TSC-calibration-failure.patch
Patch22000: weird-root-dentry-name-debug.patch
Patch22010: debug-idle-sched-warn-once.patch
@ -749,9 +736,6 @@ Patch22001: selinux-apply-different-permission-to-ptrace-child.patch
#rhbz 927469
Patch23006: fix-child-thread-introspection.patch
#rhbz 928024
Patch23008: forcedeth-dma-error-check.patch
#rhbz 948262
Patch25024: intel_iommu-Downgrade-the-warning-if-enabling-irq-remapping-fails.patch
@ -767,27 +751,14 @@ Patch25032: cve-2013-2147-ciss-info-leak.patch
#CVE-2013-2148 rhbz 971258 971261
Patch25033: fanotify-info-leak-in-copy_event_to_user.patch
#CVE-2013-2851 rhbz 969515 971662
Patch25035: block-do-not-pass-disk-names-as-format-strings.patch
#rhbz 954252
Patch25036: scsi-ipr-possible-irq-lock-inversion-dependency-detected.patch
#CVE-2013-2164 rhbz 973100 973109
Patch25038: cdrom-use-kzalloc-for-failing-hardware.patch
#rhbz 967230
Patch25043: vfio-Set-container-device-mode.patch
Patch25044: vfio-fix-crash-on-rmmod.patch
#rhbz 969644
Patch25046: KVM-x86-handle-idiv-overflow-at-kvm_write_tsc.patch
Patch25047: drm-radeon-Disable-writeback-by-default-on-ppc.patch
#rhbz 956732
Patch25048: tulip-dma-debug-error.patch
Patch25050: iwlwifi-pcie-fix-race-in-queue-unmapping.patch
Patch25051: iwlwifi-pcie-wake-the-queue-if-stopped-when-being-unmapped.patch
@ -807,15 +778,9 @@ Patch25055: ath3k-dont-use-stack-memory-for-DMA.patch
Patch25056: iwl3945-better-skb-management-in-rx-path.patch
Patch25057: iwl4965-better-skb-management-in-rx-path.patch
#CVE-2013-2234 rhbz 980995 981007
Patch25058: af_key-fix-info-leaks-in-notify-messages.patch
#CVE-2013-1059 rhbz 977356 980341
Patch25059: ceph-fix.patch
#CVE-2013-2232 rhbz 981552 981564
Patch25060: ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch
#rhbz 976789 980643
Patch25062: vhost-net-fix-use-after-free-in-vhost_net_flush.patch
@ -1374,9 +1339,6 @@ ApplyPatch taint-vbox.patch
ApplyPatch vmbugon-warnon.patch
ApplyPatch debug-bad-pte-dmi.patch
ApplyPatch debug-bad-pte-modules.patch
# Architecture patches
# x86(-64)
@ -1385,11 +1347,9 @@ ApplyPatch debug-bad-pte-modules.patch
#
ApplyPatch arm-export-read_current_timer.patch
ApplyPatch arm-lpae-ax88796.patch
ApplyPatch arm-omap-ehci-fix.patch
ApplyPatch arm-omap-load-tfp410.patch
ApplyPatch arm-omap-fixdrm.patch
ApplyPatch arm-tegra-usb-no-reset-linux33.patch
ApplyPatch arm-tegra-fixclk.patch
#ApplyPatch arm-tegra-fixclk.patch
#
# bugfixes to drivers and filesystems
@ -1460,11 +1420,7 @@ ApplyPatch devel-pekey-secure-boot-20130306.patch
# Assorted Virt Fixes
# DRM core
ApplyPatch drm-ttm-exports-for-qxl.patch
ApplyPatch drm-hotspot-cursor-backport.patch
ApplyPatch drm-qxl-driver.patch
ApplyPatch drm-qxl-3.10-rc7-diff.patch
ApplyPatch drm-qxl-access-fix.patch
ApplyPatch drm-qxl-post-3.10-feature-fixes.patch
ApplyPatch drm-qxl-post-3.10-features-part-2.patch
#ApplyPatch drm-edid-try-harder-to-fix-up-broken-headers.patch
@ -1517,23 +1473,17 @@ ApplyPatch criu-no-expert.patch
ApplyPatch ath9k_rx_dma_stop_check.patch
#rhbz 856863 892599
ApplyPatch cfg80211-mac80211-disconnect-on-suspend.patch
ApplyPatch mac80211_fixes_for_ieee80211_do_stop_while_suspend_v3.9.patch
#rhbz 859282
ApplyPatch VMX-x86-handle-host-TSC-calibration-failure.patch
#ApplyPatch cfg80211-mac80211-disconnect-on-suspend.patch
#ApplyPatch mac80211_fixes_for_ieee80211_do_stop_while_suspend_v3.9.patch
#rhbz 927469
ApplyPatch fix-child-thread-introspection.patch
#rhbz 928024
ApplyPatch forcedeth-dma-error-check.patch
#rhbz 948262
ApplyPatch intel_iommu-Downgrade-the-warning-if-enabling-irq-remapping-fails.patch
# Needed for F19 gssproxy feature
ApplyPatch gssproxy-backport.patch
#ApplyPatch gssproxy-backport.patch
#CVE-2013-2140 rhbz 971146 971148
ApplyPatch xen-blkback-Check-device-permissions-before-allowing.patch
@ -1544,27 +1494,14 @@ ApplyPatch cve-2013-2147-ciss-info-leak.patch
#CVE-2013-2148 rhbz 971258 971261
ApplyPatch fanotify-info-leak-in-copy_event_to_user.patch
#CVE-2013-2851 rhbz 969515 971662
ApplyPatch block-do-not-pass-disk-names-as-format-strings.patch
#rhbz 954252
ApplyPatch scsi-ipr-possible-irq-lock-inversion-dependency-detected.patch
#CVE-2013-2164 rhbz 973100 973109
ApplyPatch cdrom-use-kzalloc-for-failing-hardware.patch
#rhbz 967230
ApplyPatch vfio-Set-container-device-mode.patch
ApplyPatch vfio-fix-crash-on-rmmod.patch
#rhbz 969644
ApplyPatch KVM-x86-handle-idiv-overflow-at-kvm_write_tsc.patch
ApplyPatch drm-radeon-Disable-writeback-by-default-on-ppc.patch
#rhbz 956732
ApplyPatch tulip-dma-debug-error.patch
ApplyPatch iwlwifi-pcie-fix-race-in-queue-unmapping.patch
ApplyPatch iwlwifi-pcie-wake-the-queue-if-stopped-when-being-unmapped.patch
@ -1583,17 +1520,11 @@ ApplyPatch ath3k-dont-use-stack-memory-for-DMA.patch
ApplyPatch iwl3945-better-skb-management-in-rx-path.patch
ApplyPatch iwl4965-better-skb-management-in-rx-path.patch
#CVE-2013-2234 rhbz 980995 981007
ApplyPatch af_key-fix-info-leaks-in-notify-messages.patch
#CVE-2013-1059 rhbz 977356 980341
ApplyPatch ceph-fix.patch
#CVE-2013-2232 rhbz 981552 981564
ApplyPatch ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch
#ApplyPatch ceph-fix.patch
#rhbz 976789 980643
ApplyPatch vhost-net-fix-use-after-free-in-vhost_net_flush.patch
#ApplyPatch vhost-net-fix-use-after-free-in-vhost_net_flush.patch
#rhbz 959721
ApplyPatch HID-kye-Add-report-fixup-for-Genius-Gila-Gaming-mouse.patch
@ -1624,6 +1555,9 @@ mkdir configs
rm -f kernel-%{version}-*debug.config
%endif
# FIXME: ARM needs fixing.
rm -f kernel*arm*.config
# now run oldconfig over all the config files
for i in *.config
do
@ -2420,6 +2354,35 @@ fi
# and build.
%changelog
* Wed Jul 17 2013 Dave Jones <davej@redhat.com>
- Rebase to 3.10.1
dropped:
debug-bad-pte-dmi.patch
debug-bad-pte-modules.patch
arm-omap-ehci-fix.patch
arm-omap-fixdrm.patch
drm-ttm-exports-for-qxl.patch
drm-qxl-driver.patch
drm-qxl-3.10-rc7-diff.patch
drm-qxl-access-fix.patch
VMX-x86-handle-host-TSC-calibration-failure.patch
forcedeth-dma-error-check.patch
block-do-not-pass-disk-names-as-format-strings.patch
cdrom-use-kzalloc-for-failing-hardware.patch
vfio-Set-container-device-mode.patch
vfio-fix-crash-on-rmmod.patch
tulip-dma-debug-error.patch
af_key-fix-info-leaks-in-notify-messages.patch
ipv6-ip6_sk_dst_check-must-not-assume-ipv6-dst.patch
needs fixing:
arm-tegra-fixclk.patch
cfg80211-mac80211-disconnect-on-suspend.patch
mac80211_fixes_for_ieee80211_do_stop_while_suspend_v3.9.patch
gssproxy-backport.patch
ceph-fix.patch
vhost-net-fix-use-after-free-in-vhost_net_flush.patch
ARM currently disabled, requires config changes. (See line 1558)
* Fri Jul 12 2013 Dave Jones <davej@redhat.com> - 3.9.9-304
- Disable LATENCYTOP/SCHEDSTATS in non-debug builds.

4
sources
View File

@ -1,2 +1,2 @@
4348c9b6b2eb3144d601e87c19d5d909 linux-3.9.tar.xz
41f350c2fd6aa14414bf39f173a8e6a3 patch-3.9.9.xz
4f25cd5bec5f8d5a7d935b3f2ccb8481 linux-3.10.tar.xz
0e7f2a767ef3b3643856c96af3409af3 patch-3.10.1.xz

32
tulip-dma-debug-error.patch
View File

@ -1,32 +0,0 @@
commit 2087ac1fc6fd9bbb1f7e16889e984e0af0510b4b
Author: Neil Horman <nhorman@tuxdriver.com>
Date: Thu Jun 13 15:25:45 2013 -0400
tulip: Properly check dma mapping result
Tulip throws an error when dma debugging is enabled, as it doesn't properly
check dma mapping results with dma_mapping_error() durring tx ring refills.
Easy fix, just add it in, and drop the frame if the mapping is bad
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
CC: Grant Grundler <grundler@parisc-linux.org>
CC: "David S. Miller" <davem@davemloft.net>
diff --git a/drivers/net/ethernet/dec/tulip/interrupt.c b/drivers/net/ethernet/dec/tulip/interrupt.c
index 28a5e42..92306b3 100644
--- a/drivers/net/ethernet/dec/tulip/interrupt.c
+++ b/drivers/net/ethernet/dec/tulip/interrupt.c
@@ -76,6 +76,12 @@ int tulip_refill_rx(struct net_device *dev)
mapping = pci_map_single(tp->pdev, skb->data, PKT_BUF_SZ,
PCI_DMA_FROMDEVICE);
+ if (dma_mapping_error(&tp->pdev->dev, mapping)) {
+ dev_kfree_skb(skb);
+ tp->rx_buffers[entry].skb = NULL;
+ break;
+ }
+
tp->rx_buffers[entry].mapping = mapping;
tp->rx_ring[entry].buffer1 = cpu_to_le32(mapping);

41
vfio-Set-container-device-mode.patch
View File

@ -1,41 +0,0 @@
From 664e9386bd05dbdfecfb28d6cf2fde983aabc65c Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Tue, 30 Apr 2013 15:42:28 -0600
Subject: [PATCH] vfio: Set container device mode
Minor 0 is the VFIO container device (/dev/vfio/vfio). On it's own
the container does not provide a user with any privileged access. It
only supports API version check and extension check ioctls. Only by
attaching a VFIO group to the container does it gain any access. Set
the mode of the container to allow access.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
drivers/vfio/vfio.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index ac7423b..acb7121 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -27,6 +27,7 @@
#include <linux/rwsem.h>
#include <linux/sched.h>
#include <linux/slab.h>
+#include <linux/stat.h>
#include <linux/string.h>
#include <linux/uaccess.h>
#include <linux/vfio.h>
@@ -1359,6 +1360,9 @@ static const struct file_operations vfio_device_fops = {
*/
static char *vfio_devnode(struct device *dev, umode_t *mode)
{
+ if (MINOR(dev->devt) == 0)
+ *mode = S_IRUGO | S_IWUGO;
+
return kasprintf(GFP_KERNEL, "vfio/%s", dev_name(dev));
}
--
1.8.1.4

32
vfio-fix-crash-on-rmmod.patch
View File

@ -1,32 +0,0 @@
From 9a6aa279d3d17af73a029fa40654e92f4e75e8bb Mon Sep 17 00:00:00 2001
From: Alexey Kardashevskiy <aik@ozlabs.ru>
Date: Wed, 5 Jun 2013 08:54:16 -0600
Subject: [PATCH] vfio: fix crash on rmmod
devtmpfs_delete_node() calls devnode() callback with mode==NULL but
vfio still tries to write there.
The patch fixes this.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---
drivers/vfio/vfio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c
index acb7121..6d78736 100644
--- a/drivers/vfio/vfio.c
+++ b/drivers/vfio/vfio.c
@@ -1360,7 +1360,7 @@ static const struct file_operations vfio_device_fops = {
*/
static char *vfio_devnode(struct device *dev, umode_t *mode)
{
- if (MINOR(dev->devt) == 0)
+ if (mode && (MINOR(dev->devt) == 0))
*mode = S_IRUGO | S_IWUGO;
return kasprintf(GFP_KERNEL, "vfio/%s", dev_name(dev));
--
1.8.1.4