[kernel] r21972 - in dists/wheezy-security/linux: . debian debian/config debian/config/s390 debian/config/s390x debian/installer debian/installer/modules debian/patches debian/patches/bugfix/all debian/patches/bugfix/alpha debian/patches/bugfix/mips debian/patches/bugfix/s390 debian/patches/bugfix/x86 debian/patches/debian debian/patches/features/all/drm debian/patches/features/all/igb debian/patches/features/all/rt debian/patches/features/arm debian/patches/features/x86/hyperv
Ben Hutchings
benh at moszumanska.debian.org
Sat Oct 25 23:26:42 UTC 2014
Author: benh
Date: Sat Oct 25 23:26:41 2014
New Revision: 21972
Log:
Merge changes from wheezy up to 3.2.63-2
Added:
dists/wheezy-security/linux/debian/patches/bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/libceph-add-process_one_ticket-helper.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/bugfix/all/libceph-add-process_one_ticket-helper.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/nfsd-fix-acl-null-pointer-deref.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/bugfix/all/nfsd-fix-acl-null-pointer-deref.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch
dists/wheezy-security/linux/debian/patches/debian/ip-ident-avoid-abi-change-in-3.2.63.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/ip-ident-avoid-abi-change-in-3.2.63.patch
dists/wheezy-security/linux/debian/patches/debian/irq-avoid-abi-change-in-3.2.61.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/irq-avoid-abi-change-in-3.2.61.patch
dists/wheezy-security/linux/debian/patches/debian/libata-avoid-abi-change-in-3.2.62.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/libata-avoid-abi-change-in-3.2.62.patch
dists/wheezy-security/linux/debian/patches/debian/nlattr-avoid-abi-change-in-3.2.61.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/nlattr-avoid-abi-change-in-3.2.61.patch
dists/wheezy-security/linux/debian/patches/debian/ptrace-avoid-abi-change-in-3.2.61.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/ptrace-avoid-abi-change-in-3.2.61.patch
dists/wheezy-security/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.61.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.61.patch
dists/wheezy-security/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.62.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.62.patch
dists/wheezy-security/linux/debian/patches/debian/sp5100_tco-reject-sb8x0-chips.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/sp5100_tco-reject-sb8x0-chips.patch
dists/wheezy-security/linux/debian/patches/debian/trace-syscall-avoid-abi-change-in-3.2.61.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/debian/trace-syscall-avoid-abi-change-in-3.2.61.patch
dists/wheezy-security/linux/debian/patches/features/all/rt/revert-rtmutex-changes-in-3.2.61.patch
- copied unchanged from r21920, dists/wheezy/linux/debian/patches/features/all/rt/revert-rtmutex-changes-in-3.2.61.patch
Deleted:
dists/wheezy-security/linux/debian/patches/bugfix/all/0001-ptrace-x86-force-IRET-path-after-a-ptrace_stop.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/ALSA-control-Don-t-access-controls-outside-of-protec.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/ALSA-control-Fix-replacing-user-controls.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/ALSA-control-Handle-numid-overflow.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/ALSA-control-Make-sure-that-id-index-does-not-overfl.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/ALSA-control-Protect-user-controls-against-concurren.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/auditsc-audit_krule-mask-accesses-need-bounds-checki.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/net-l2tp-don-t-fall-back-on-UDP-get-set-sockopt.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/revert-net-ip-ipv6-handle-gso-skbs-in-forwarding-pat.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/revert-net-ipv4-ip_forward-fix-inverted-local_df-tes.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/sctp-fix-sk_ack_backlog-wrap-around-problem.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/skbuff-add-an-api-to-orphan-frags.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/skbuff-export-skb_copy_ubufs.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/skbuff-skb_segment-orphan-frags-before-copying.patch
dists/wheezy-security/linux/debian/patches/bugfix/all/target-explicitly-clear-ramdisk_mcp-backend-pages.patch
dists/wheezy-security/linux/debian/patches/bugfix/alpha/alpha-add-io-read-write-16-32-be-functions.patch
dists/wheezy-security/linux/debian/patches/bugfix/mips/MIPS-Cleanup-flags-in-syscall-flags-handlers.patch
dists/wheezy-security/linux/debian/patches/bugfix/mips/MIPS-asm-thread_info-Add-_TIF_SECCOMP-flag.patch
dists/wheezy-security/linux/debian/patches/bugfix/s390/s390-ptrace-fix-PSW-mask-check.patch
dists/wheezy-security/linux/debian/patches/bugfix/x86/x86_32-entry-Do-syscall-exit-work-on-badsys-CVE-2014.patch
Modified:
dists/wheezy-security/linux/ (props changed)
dists/wheezy-security/linux/debian/changelog
dists/wheezy-security/linux/debian/config/defines
dists/wheezy-security/linux/debian/config/s390/defines
dists/wheezy-security/linux/debian/config/s390x/defines
dists/wheezy-security/linux/debian/installer/modules/pata-modules
dists/wheezy-security/linux/debian/installer/modules/virtio-modules
dists/wheezy-security/linux/debian/installer/package-list
dists/wheezy-security/linux/debian/patches/debian/inetpeer-avoid-abi-change-in-3.2.52.patch
dists/wheezy-security/linux/debian/patches/features/all/drm/drm-3.4.patch
dists/wheezy-security/linux/debian/patches/features/all/igb/0008-igb-add-basic-runtime-PM-support.patch
dists/wheezy-security/linux/debian/patches/features/all/rt/0180-mutex-no-spin-on-rt.patch.patch
dists/wheezy-security/linux/debian/patches/features/all/rt/0278-random-Make-it-work-on-rt.patch
dists/wheezy-security/linux/debian/patches/features/arm/net-drop-NET-dependency-from-HAVE_BPF_JIT.patch
dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0003-Staging-hv-storvsc-Use-mempools-to-allocate-struct-s.patch
dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0025-Staging-hv-storvsc-Implement-per-device-memory-pools.patch
dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0050-Staging-hv-storvsc-Cleanup-storvsc_queuecommand.patch
dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0055-Staging-hv-storvsc-Get-rid-of-the-on_io_completion-i.patch
dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0067-Staging-hv-storvsc-Move-the-storage-driver-out-of-th.patch
dists/wheezy-security/linux/debian/patches/series
dists/wheezy-security/linux/debian/patches/series-rt
Modified: dists/wheezy-security/linux/debian/changelog
==============================================================================
--- dists/wheezy-security/linux/debian/changelog Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/changelog Sat Oct 25 23:26:41 2014 (r21972)
@@ -1,3 +1,215 @@
+linux (3.2.63-2) wheezy; urgency=medium
+
+ * [s390*] Ignore ABI change in lowcore structure (fixes FTBFS)
+
+ -- Ben Hutchings <ben at decadent.org.uk> Mon, 29 Sep 2014 22:35:33 +0100
+
+linux (3.2.63-1) wheezy; urgency=medium
+
+ * New upstream stable update:
+ http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.61
+ - mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
+ - UBIFS: fix an mmap and fsync race condition
+ - HID: core: fix validation of report id 0
+ - IB/srp: Fix a sporadic crash triggered by cable pulling
+ - reiserfs: drop vmtruncate
+ - reiserfs: call truncate_setsize under tailpack mutex
+ - [arm] 8051/1: put_user: fix possible data corruption in put_user
+ - ext4: fix zeroing of page during writeback
+ - ext4: fix wrong assert in ext4_mb_normalize_request()
+ - USB: sierra: fix remote wakeup
+ - USB: option: fix runtime PM handling
+ - USB: usb_wwan: fix race between write and resume
+ - USB: usb_wwan: fix write and suspend race
+ - USB: usb_wwan: fix urb leak at shutdown
+ - USB: cdc-acm: Fix various bugs in power management
+ - USB: io_ti: fix firmware download on big-endian machines (part 2)
+ - md: always set MD_RECOVERY_INTR when aborting a reshape or other
+ "resync".
+ - [s390] lowcore: reserve 96 bytes for IRB in lowcore
+ - rtmutex: Fix deadlock detector for real
+ - xhci: delete endpoints from bandwidth list before freeing whole device
+ - IB/umad: Fix error handling
+ - RDMA/cxgb4: Fix four byte info leak in c4iw_create_cq()
+ - nfsd: getattr for FATTR4_WORD0_FILES_AVAIL needs the statfs buffer
+ - UBIFS: Remove incorrect assertion in shrink_tnc()
+ - nfsd4: use recall_lock for delegation hashing
+ - iscsi-target: Reject mutual authentication with reflected CHAP_C
+ - ptrace: fix fork event messages across pid namespaces
+ - idr: fix overflow bug during maximum ID calculation at maximum height
+ - Input: synaptics - fix resolution for manually provided min/max
+ (regression in 3.2.57)
+ - nfsd4: fix FREE_STATEID lockowner leak (regression in 3.2.60)
+ - Btrfs: fix double free in find_lock_delalloc_range
+ - mm: rmap: fix use-after-free in __put_anon_vma
+ - rtmutex: Handle deadlock detection smarter
+ - rtmutex: Detect changes in the pi lock chain
+ - rtmutex: Plug slow unlock race
+ - Bluetooth: Fix check for connection encryption
+ - Bluetooth: Fix SSP acceptor just-works confirmation without MITM
+ - tracing: Fix syscall_*regfunc() vs copy_process() race
+ - lib/lzo: Update LZO compression to current upstream version
+ - lzo: properly check for overruns (CVE-2014-4608)
+ - hugetlb: fix copy_hugetlb_page_range() to handle migration/hwpoisoned
+ entry
+ - mm: fix crashes from mbind() merging vmas
+ - [mips] MSC: Prevent out-of-bounds writes to MIPS SC ioremap'd region
+ - SCSI: Stop accepting SCSI requests before removing a device
+ - SCSI: fix our current target reap infrastructure
+ - SCSI: dual scan thread bug fix
+ - perf: Fix race in removing an event
+ - netlink: rate-limit leftover bytes warning and print process name
+ - net: tunnels - enable module autoloading
+ - net: fix inet_getid() and ipv6_select_ident() bugs
+ - target: Explicitly clear ramdisk_mcp backend pages
+ - iommu/vt-d: Fix missing IOTLB flush in intel_iommu_unmap()
+ http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.62
+ - ibmvscsi: Add memory barriers for send / receive
+ - cpuset,mempolicy: fix sleeping function called from invalid context
+ - nfsd: fix rare symlink decoding bug
+ - md: flush writes before starting a recovery.
+ - drm/vmwgfx: Fix incorrect write to read-only register v2:
+ (regression in 3.2.58)
+ - ACPI / EC: Avoid race condition related to advance_transaction()
+ - ACPI / EC: Fix race condition in ec_transaction_completed()
+ - hwmon: (adm1031) Fix writes to limit registers
+ - alarmtimer: Fix bug where relative alarm timers were treated as absolute
+ - dm io: fix a race condition in the wake up code for sync_io
+ - sched: Fix possible divide by zero in avg_atom() calculation
+ - locking/mutex: Disable optimistic spinning on some architectures
+ - hwmon: (adt7470) Fix writes to temperature limit registers
+ - usb: Check if port status is equal to RxDetect (regression in 3.2.38)
+ - tcp: fix tcp_match_skb_to_sack() for unaligned SACK at end of an skb
+ - igmp: fix the problem when mc leave group
+ - appletalk: Fix socket referencing in skb
+ - net: sctp: fix information leaks in ulpevent layer
+ - dns_resolver: assure that dns_query() result is null-terminated
+ - dns_resolver: Null-terminate the right string
+ - rtnetlink: fix userspace API breakage for iproute2 < v3.9.0
+ (regression in 3.2.45)
+ - netfilter: ipt_ULOG: fix info leaks
+ - xfs: fix allocbt cursor leak in xfs_alloc_ag_vextent_near
+ - xfs: really fix the cursor leak in xfs_alloc_ag_vextent_near
+ - shmem: fix faulting into a hole, not taking i_mutex (CVE-2014-4171)
+ - shmem: fix splicing from a hole while it's punched (CVE-2014-4171)
+ - [x86] x86-32, espfix: Remove filter for espfix32 due to race
+ - sym53c8xx_2: Set DID_REQUEUE return code when aborting squeue
+ - mm: hugetlb: fix copy_hugetlb_page_range() (regression in 3.2.61)
+ - [arm*] 7668/1: fix memset-related crashes caused by recent GCC (4.7.2)
+ optimizations
+ - [arm*] 7670/1: fix the memset fix
+ - ceph: fix overflow check in build_snap_context()
+ - libata: support the ata host which implements a queue depth less than 32
+ (regression in 3.2.59)
+ - libata: introduce ata_host->n_tags to avoid oops on SAS controllers
+ - [x86] x86_32, entry: Store badsys error code in %eax
+ (regression in 3.2.60-1)
+ http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.63
+ - [x86] KVM: Inter-privilege level ret emulation is not implemeneted
+ - block: don't assume last put of shared tags is for the host
+ - debugfs: Fix corrupted loop in debugfs_remove_recursive
+ - mtd/ftl: fix the double free of the buffers allocated in build_maps()
+ - [x86] don't exclude low BIOS area when allocating address space for
+ non-PCI cards (regression in 2.6.37)
+ - scsi: handle flush errors properly
+ - hwmon: (smsc47m192) Fix temperature limit and vrm write operations
+ - staging: vt6655: Fix Warning on boot handle_irq_event_percpu.
+ - [mips,powerpc] bfa: Fix undefined bit shift on big-endian architectures
+ with 32-bit DMA address
+ - Drivers: scsi: storvsc: Implement a eh_timed_out handler
+ - iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
+ - net: sendmsg: fix NULL pointer dereference
+ - hwmon: (ads1015) Fix off-by-one for valid channel index checking
+ - [mips*] tlbex: Fix a missing statement for HUGETLB
+ - [mips*] Prevent user from setting FCSR cause bits
+ - md/raid1,raid10: always abort recover on write error.
+ - ext4: fix ext4_discard_allocated_blocks() if we can't allocate the pa
+ struct
+ - hwmon: (lm85) Fix various errors on attribute writes
+ - hwmon: (amc6821) Fix possible race condition bug
+ - crypto: af_alg - properly label AF_ALG socket
+ - mnt: Change the default remount atime from relatime to the existing value
+ - netlabel: fix a problem when setting bits below the previously lowest bit
+ - ALSA: virtuoso: Xonar DSX support (Closes: #721346)
+ - hwmon: (ads1015) Fix out-of-bounds array access
+ - [s390*] locking: Reenable optimistic spinning
+ - ring-buffer: Always reset iterator to reader page
+ - reiserfs: Fix use after free in journal teardown
+ - [powerpc*] mm: Use read barrier when creating real_pte
+ - Btrfs: fix csum tree corruption, duplicate and outdated checksums
+ - CIFS: Fix wrong directory attributes after rename
+ - md/raid6: avoid data corruption during recovery of double-degraded RAID6
+ - iommu/amd: Fix cleanup_domain for mass device removal
+ - pata_scc: propagate return value of scc_wait_after_reset
+ - kvm: iommu: fix the third parameter of kvm_iommu_put_pages
+ (CVE-2014-3601)
+ - [mips*/octeon] make get_system_type() thread-safe
+ - xhci: rework cycle bit checking for new dequeue pointers
+ (regression in 3.2.59)
+ - isofs: Fix unbounded recursion when processing relocated directories
+ (CVE-2014-5471, CVE-2014-5472)
+ - HID: logitech: perform bounds checking on device_id early enough
+ (CVE-2014-3182)
+ - USB: whiteheat: Added bounds checking for bulk command response
+ (CVE-2014-3183, CVE-2014-3184, CVE-2014-3185)
+ - HID: logitech-dj: prevent false errors to be shown
+ - ACPI / EC: Add support to disallow QR_EC to be issued when SCI_EVT isn't
+ set (regression in 3.2.62)
+ - HID: magicmouse: sanity check report size in raw_event() callback
+ (CVE-2014-3181)
+ - HID: picolcd: sanity check report size in raw_event() callback
+ (CVE-2014-3186)
+ - [armhf] 8128/1: abort: don't clear the exclusive monitors
+ - [armhf] 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy
+ strex
+ - USB: serial: fix potential stack buffer overflow
+ - USB: serial: fix potential heap buffer overflow
+ - [mips*] Fix accessing to per-cpu data when flushing the cache
+ - inetpeer: get rid of ip_id_count
+ - ip: make IP identifiers less predictable
+ - tcp: Fix integer-overflows in TCP veno
+ - tcp: Fix integer-overflow in TCP vegas
+ - net: sctp: inherit auth_capable on INIT collisions (CVE-2014-5077)
+ - iovec: make sure the caller actually wants anything in
+ memcpy_fromiovecend
+ - sctp: fix possible seqlock seadlock in sctp_packet_transmit()
+ - [sparc] Fix argument sign extension for compat_sys_futex().
+ - [sparc] Handle 32-bit tasks properly in compute_effective_address().
+ - [sparc] Fix top-level fault handling bugs.
+ - [sparc] Don't bark so loudly about 32-bit tasks generating 64-bit fault
+ addresses.
+ - [sparc] Fix huge TSB mapping on pre-UltraSPARC-III cpus.
+ - [sparc] Add membar to Niagara2 memcpy code.
+ - [sparc] Do not insert non-valid PTEs into the TSB hash table.
+ - [sparc] arch/sparc/math-emu/math_32.c: drop stray break operator
+ - [amd64] Revert "x86-64, modify_ldt: Make support for 16-bit segments a
+ runtime option"
+ - [amd64] x86-64, espfix: Don't leak bits 31:16 of %esp returning to 16-bit
+ stack
+ - [amd64] x86_64/entry/xen: Do not invoke espfix64 on Xen
+ - [amd64] x86/espfix/xen: Fix allocation of pages for paravirt page tables
+
+ [ Ben Hutchings ]
+ * drm, agp: Update to 3.4.103:
+ - drm/radeon: only apply hdmi bpc pll flags when encoder mode is hdmi
+ - drm/radeon: fix typo in radeon_connector_is_dp12_capable()
+ - drm/radeon/atom: fix dithering on certain panels
+ - drm/vmwgfx: Fix incorrect write to read-only register v2:
+ - drm/radeon: stop poisoning the GART TLB
+ * nfsd: Fix ACL null pointer deref (thanks to Sergio Gelato)
+ (Closes: #754420)
+ * ext4: fix BUG_ON in mb_free_blocks() (regression in 3.2.63)
+ * udf: Avoid infinite loop when processing indirect ICBs (CVE-2014-6410)
+ * libceph: do not hard code max auth ticket len (CVE-2014-6416,
+ CVE-2014-6417, CVE-2014-6418)
+ * sp5100_tco: Reject SB8x0 chips (Closes: #726150)
+ * udeb: Add pata_rdc to pata-modules (Closes: #633128)
+
+ [ Cyril Brulebois ]
+ * udeb: Add virtio_scsi to virtio-modules (Closes: #756249).
+
+ -- Ben Hutchings <ben at decadent.org.uk> Sat, 27 Sep 2014 13:36:53 +0100
+
linux (3.2.60-1+deb7u3) wheezy-security; urgency=medium
* net/l2tp: don't fall back on UDP [get|set]sockopt (CVE-2014-4943)
Modified: dists/wheezy-security/linux/debian/config/defines
==============================================================================
--- dists/wheezy-security/linux/debian/config/defines Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/config/defines Sat Oct 25 23:26:41 2014 (r21972)
@@ -52,6 +52,7 @@
module:drivers/usb/serial/*
module:arch/s390/kvm/kvm
module:drivers/scsi/esp_scsi
+ module:drivers/char/tpm/tpm
# Only exported for tidspbridge, disabled for security reasons in 3.2.54
omap_dsp_get_mempool_base
# Should only be used by ioatdma
Modified: dists/wheezy-security/linux/debian/config/s390/defines
==============================================================================
--- dists/wheezy-security/linux/debian/config/s390/defines Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/config/s390/defines Sat Oct 25 23:26:41 2014 (r21972)
@@ -2,6 +2,8 @@
ignore-changes:
# Seems to be exported by mistake; no other architecture does
arch_pick_mmap_layout
+# Not used in any in-tree module, nor obviously used OOT either
+ lowcore_ptr
[base]
flavours:
Modified: dists/wheezy-security/linux/debian/config/s390x/defines
==============================================================================
--- dists/wheezy-security/linux/debian/config/s390x/defines Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/config/s390x/defines Sat Oct 25 23:26:41 2014 (r21972)
@@ -2,6 +2,8 @@
ignore-changes:
# Seems to be exported by mistake; no other architecture does
arch_pick_mmap_layout
+# Not used in any in-tree module, nor obviously used OOT either
+ lowcore_ptr
[base]
flavours:
Modified: dists/wheezy-security/linux/debian/installer/modules/pata-modules
==============================================================================
--- dists/wheezy-security/linux/debian/installer/modules/pata-modules Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/installer/modules/pata-modules Sat Oct 25 23:26:41 2014 (r21972)
@@ -28,6 +28,7 @@
pata_piccolo ?
pata_qdi ?
pata_radisys ?
+pata_rdc ?
pata_rz1000 ?
pata_sc1200 ?
pata_serverworks ?
Modified: dists/wheezy-security/linux/debian/installer/modules/virtio-modules
==============================================================================
--- dists/wheezy-security/linux/debian/installer/modules/virtio-modules Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/installer/modules/virtio-modules Sat Oct 25 23:26:41 2014 (r21972)
@@ -1,6 +1,7 @@
virtio_net
virtio_blk
virtio_balloon
+virtio_scsi
# Some architectures do not have PCI bus
virtio_pci ?
Modified: dists/wheezy-security/linux/debian/installer/package-list
==============================================================================
--- dists/wheezy-security/linux/debian/installer/package-list Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/installer/package-list Sat Oct 25 23:26:41 2014 (r21972)
@@ -414,7 +414,7 @@
This package contains RTC modules.
Package: virtio-modules
-Depends: kernel-image
+Depends: kernel-image, scsi-core-modules
Priority: extra
Description: virtio modules
This package contains virtio modules.
Copied: dists/wheezy-security/linux/debian/patches/bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch (from r21920, dists/wheezy/linux/debian/patches/bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch)
@@ -0,0 +1,58 @@
+From: Theodore Ts'o <tytso at mit.edu>
+Date: Sat, 23 Aug 2014 17:47:28 -0400
+Subject: ext4: fix BUG_ON in mb_free_blocks()
+Origin: https://git.kernel.org/linus/c99d1e6e83b06744c75d9f5e491ed495a7086b7b
+
+If we suffer a block allocation failure (for example due to a memory
+allocation failure), it's possible that we will call
+ext4_discard_allocated_blocks() before we've actually allocated any
+blocks. In that case, fe_len and fe_start in ac->ac_f_ex will still
+be zero, and this will result in mb_free_blocks(inode, e4b, 0, 0)
+triggering the BUG_ON on mb_free_blocks():
+
+ BUG_ON(last >= (sb->s_blocksize << 3));
+
+Fix this by bailing out of ext4_discard_allocated_blocks() if fs_len
+is zero.
+
+Also fix a missing ext4_mb_unload_buddy() call in
+ext4_discard_allocated_blocks().
+
+Google-Bug-Id: 16844242
+
+Fixes: 86f0afd463215fc3e58020493482faa4ac3a4d69
+Signed-off-by: Theodore Ts'o <tytso at mit.edu>
+Cc: stable at vger.kernel.org
+[bwh: Backported to 3.2: adjust context]
+---
+ fs/ext4/mballoc.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1312,6 +1312,8 @@ static void mb_free_blocks(struct inode
+ void *buddy2;
+ struct super_block *sb = e4b->bd_sb;
+
++ if (WARN_ON(count == 0))
++ return;
+ BUG_ON(first + count > (sb->s_blocksize << 3));
+ assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
+ mb_check_buddy(e4b);
+@@ -3132,6 +3134,8 @@ static void ext4_discard_allocated_block
+ int err;
+
+ if (pa == NULL) {
++ if (ac->ac_f_ex.fe_len == 0)
++ return;
+ err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
+ if (err) {
+ /*
+@@ -3146,6 +3150,7 @@ static void ext4_discard_allocated_block
+ mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
+ ac->ac_f_ex.fe_len);
+ ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
++ ext4_mb_unload_buddy(&e4b);
+ return;
+ }
+ if (pa->pa_type == MB_INODE_PA)
Copied: dists/wheezy-security/linux/debian/patches/bugfix/all/libceph-add-process_one_ticket-helper.patch (from r21920, dists/wheezy/linux/debian/patches/bugfix/all/libceph-add-process_one_ticket-helper.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/bugfix/all/libceph-add-process_one_ticket-helper.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/bugfix/all/libceph-add-process_one_ticket-helper.patch)
@@ -0,0 +1,275 @@
+From: Ilya Dryomov <ilya.dryomov at inktank.com>
+Date: Mon, 8 Sep 2014 17:25:34 +0400
+Subject: libceph: add process_one_ticket() helper
+Origin: https://git.kernel.org/linus/597cda357716a3cf8d994cb11927af917c8d71fa
+
+Add a helper for processing individual cephx auth tickets. Needed for
+the next commit, which deals with allocating ticket buffers. (Most of
+the diff here is whitespace - view with git diff -b).
+
+Cc: stable at vger.kernel.org
+Signed-off-by: Ilya Dryomov <ilya.dryomov at inktank.com>
+Reviewed-by: Sage Weil <sage at redhat.com>
+---
+ net/ceph/auth_x.c | 228 +++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 124 insertions(+), 104 deletions(-)
+
+diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
+index 96238ba..0eb146d 100644
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -129,17 +129,131 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
+ kfree(th);
+ }
+
++static int process_one_ticket(struct ceph_auth_client *ac,
++ struct ceph_crypto_key *secret,
++ void **p, void *end,
++ void *dbuf, void *ticket_buf)
++{
++ struct ceph_x_info *xi = ac->private;
++ int type;
++ u8 tkt_struct_v, blob_struct_v;
++ struct ceph_x_ticket_handler *th;
++ void *dp, *dend;
++ int dlen;
++ char is_enc;
++ struct timespec validity;
++ struct ceph_crypto_key old_key;
++ void *tp, *tpend;
++ struct ceph_timespec new_validity;
++ struct ceph_crypto_key new_session_key;
++ struct ceph_buffer *new_ticket_blob;
++ unsigned long new_expires, new_renew_after;
++ u64 new_secret_id;
++ int ret;
++
++ ceph_decode_need(p, end, sizeof(u32) + 1, bad);
++
++ type = ceph_decode_32(p);
++ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
++
++ tkt_struct_v = ceph_decode_8(p);
++ if (tkt_struct_v != 1)
++ goto bad;
++
++ th = get_ticket_handler(ac, type);
++ if (IS_ERR(th)) {
++ ret = PTR_ERR(th);
++ goto out;
++ }
++
++ /* blob for me */
++ dlen = ceph_x_decrypt(secret, p, end, dbuf,
++ TEMP_TICKET_BUF_LEN);
++ if (dlen <= 0) {
++ ret = dlen;
++ goto out;
++ }
++ dout(" decrypted %d bytes\n", dlen);
++ dp = dbuf;
++ dend = dp + dlen;
++
++ tkt_struct_v = ceph_decode_8(&dp);
++ if (tkt_struct_v != 1)
++ goto bad;
++
++ memcpy(&old_key, &th->session_key, sizeof(old_key));
++ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
++ if (ret)
++ goto out;
++
++ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
++ ceph_decode_timespec(&validity, &new_validity);
++ new_expires = get_seconds() + validity.tv_sec;
++ new_renew_after = new_expires - (validity.tv_sec / 4);
++ dout(" expires=%lu renew_after=%lu\n", new_expires,
++ new_renew_after);
++
++ /* ticket blob for service */
++ ceph_decode_8_safe(p, end, is_enc, bad);
++ tp = ticket_buf;
++ if (is_enc) {
++ /* encrypted */
++ dout(" encrypted ticket\n");
++ dlen = ceph_x_decrypt(&old_key, p, end, ticket_buf,
++ TEMP_TICKET_BUF_LEN);
++ if (dlen < 0) {
++ ret = dlen;
++ goto out;
++ }
++ dlen = ceph_decode_32(&tp);
++ } else {
++ /* unencrypted */
++ ceph_decode_32_safe(p, end, dlen, bad);
++ ceph_decode_need(p, end, dlen, bad);
++ ceph_decode_copy(p, ticket_buf, dlen);
++ }
++ tpend = tp + dlen;
++ dout(" ticket blob is %d bytes\n", dlen);
++ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
++ blob_struct_v = ceph_decode_8(&tp);
++ new_secret_id = ceph_decode_64(&tp);
++ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
++ if (ret)
++ goto out;
++
++ /* all is well, update our ticket */
++ ceph_crypto_key_destroy(&th->session_key);
++ if (th->ticket_blob)
++ ceph_buffer_put(th->ticket_blob);
++ th->session_key = new_session_key;
++ th->ticket_blob = new_ticket_blob;
++ th->validity = new_validity;
++ th->secret_id = new_secret_id;
++ th->expires = new_expires;
++ th->renew_after = new_renew_after;
++ dout(" got ticket service %d (%s) secret_id %lld len %d\n",
++ type, ceph_entity_type_name(type), th->secret_id,
++ (int)th->ticket_blob->vec.iov_len);
++ xi->have_keys |= th->service;
++
++out:
++ return ret;
++
++bad:
++ ret = -EINVAL;
++ goto out;
++}
++
+ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+ struct ceph_crypto_key *secret,
+ void *buf, void *end)
+ {
+- struct ceph_x_info *xi = ac->private;
+- int num;
+ void *p = buf;
+- int ret;
+ char *dbuf;
+ char *ticket_buf;
+ u8 reply_struct_v;
++ u32 num;
++ int ret;
+
+ dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+ if (!dbuf)
+@@ -150,112 +264,18 @@ static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+ if (!ticket_buf)
+ goto out_dbuf;
+
+- ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+- reply_struct_v = ceph_decode_8(&p);
++ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
+ if (reply_struct_v != 1)
+- goto bad;
+- num = ceph_decode_32(&p);
+- dout("%d tickets\n", num);
+- while (num--) {
+- int type;
+- u8 tkt_struct_v, blob_struct_v;
+- struct ceph_x_ticket_handler *th;
+- void *dp, *dend;
+- int dlen;
+- char is_enc;
+- struct timespec validity;
+- struct ceph_crypto_key old_key;
+- void *tp, *tpend;
+- struct ceph_timespec new_validity;
+- struct ceph_crypto_key new_session_key;
+- struct ceph_buffer *new_ticket_blob;
+- unsigned long new_expires, new_renew_after;
+- u64 new_secret_id;
+-
+- ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
+-
+- type = ceph_decode_32(&p);
+- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+-
+- tkt_struct_v = ceph_decode_8(&p);
+- if (tkt_struct_v != 1)
+- goto bad;
+-
+- th = get_ticket_handler(ac, type);
+- if (IS_ERR(th)) {
+- ret = PTR_ERR(th);
+- goto out;
+- }
+-
+- /* blob for me */
+- dlen = ceph_x_decrypt(secret, &p, end, dbuf,
+- TEMP_TICKET_BUF_LEN);
+- if (dlen <= 0) {
+- ret = dlen;
+- goto out;
+- }
+- dout(" decrypted %d bytes\n", dlen);
+- dend = dbuf + dlen;
+- dp = dbuf;
+-
+- tkt_struct_v = ceph_decode_8(&dp);
+- if (tkt_struct_v != 1)
+- goto bad;
++ return -EINVAL;
+
+- memcpy(&old_key, &th->session_key, sizeof(old_key));
+- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+- if (ret)
+- goto out;
++ ceph_decode_32_safe(&p, end, num, bad);
++ dout("%d tickets\n", num);
+
+- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+- ceph_decode_timespec(&validity, &new_validity);
+- new_expires = get_seconds() + validity.tv_sec;
+- new_renew_after = new_expires - (validity.tv_sec / 4);
+- dout(" expires=%lu renew_after=%lu\n", new_expires,
+- new_renew_after);
+-
+- /* ticket blob for service */
+- ceph_decode_8_safe(&p, end, is_enc, bad);
+- tp = ticket_buf;
+- if (is_enc) {
+- /* encrypted */
+- dout(" encrypted ticket\n");
+- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
+- TEMP_TICKET_BUF_LEN);
+- if (dlen < 0) {
+- ret = dlen;
+- goto out;
+- }
+- dlen = ceph_decode_32(&tp);
+- } else {
+- /* unencrypted */
+- ceph_decode_32_safe(&p, end, dlen, bad);
+- ceph_decode_need(&p, end, dlen, bad);
+- ceph_decode_copy(&p, ticket_buf, dlen);
+- }
+- tpend = tp + dlen;
+- dout(" ticket blob is %d bytes\n", dlen);
+- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+- blob_struct_v = ceph_decode_8(&tp);
+- new_secret_id = ceph_decode_64(&tp);
+- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
++ while (num--) {
++ ret = process_one_ticket(ac, secret, &p, end,
++ dbuf, ticket_buf);
+ if (ret)
+ goto out;
+-
+- /* all is well, update our ticket */
+- ceph_crypto_key_destroy(&th->session_key);
+- if (th->ticket_blob)
+- ceph_buffer_put(th->ticket_blob);
+- th->session_key = new_session_key;
+- th->ticket_blob = new_ticket_blob;
+- th->validity = new_validity;
+- th->secret_id = new_secret_id;
+- th->expires = new_expires;
+- th->renew_after = new_renew_after;
+- dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+- type, ceph_entity_type_name(type), th->secret_id,
+- (int)th->ticket_blob->vec.iov_len);
+- xi->have_keys |= th->service;
+ }
+
+ ret = 0;
Copied: dists/wheezy-security/linux/debian/patches/bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch (from r21920, dists/wheezy/linux/debian/patches/bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch)
@@ -0,0 +1,193 @@
+From: Ilya Dryomov <ilya.dryomov at inktank.com>
+Date: Tue, 9 Sep 2014 19:39:15 +0400
+Subject: libceph: do not hard code max auth ticket len
+Origin: https://git.kernel.org/linus/c27a3e4d667fdcad3db7b104f75659478e0c68d8
+
+We hard code cephx auth ticket buffer size to 256 bytes. This isn't
+enough for any moderate setups and, in case tickets themselves are not
+encrypted, leads to buffer overflows (ceph_x_decrypt() errors out, but
+ceph_decode_copy() doesn't - it's just a memcpy() wrapper). Since the
+buffer is allocated dynamically anyway, allocated it a bit later, at
+the point where we know how much is going to be needed.
+
+Fixes: http://tracker.ceph.com/issues/8979
+
+Cc: stable at vger.kernel.org
+Signed-off-by: Ilya Dryomov <ilya.dryomov at inktank.com>
+Reviewed-by: Sage Weil <sage at redhat.com>
+---
+ net/ceph/auth_x.c | 64 +++++++++++++++++++++++++------------------------------
+ 1 file changed, 29 insertions(+), 35 deletions(-)
+
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -13,8 +13,6 @@
+ #include "auth_x.h"
+ #include "auth_x_protocol.h"
+
+-#define TEMP_TICKET_BUF_LEN 256
+-
+ static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
+
+ static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
+@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_cr
+ }
+
+ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+- void **p, void *end, void *obuf, size_t olen)
++ void **p, void *end, void **obuf, size_t olen)
+ {
+ struct ceph_x_encrypt_header head;
+ size_t head_len = sizeof(head);
+@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_cr
+ return -EINVAL;
+
+ dout("ceph_x_decrypt len %d\n", len);
+- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
+- *p, len);
++ if (*obuf == NULL) {
++ *obuf = kmalloc(len, GFP_NOFS);
++ if (!*obuf)
++ return -ENOMEM;
++ olen = len;
++ }
++
++ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
+ if (ret)
+ return ret;
+ if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
+@@ -131,18 +135,19 @@ static void remove_ticket_handler(struct
+
+ static int process_one_ticket(struct ceph_auth_client *ac,
+ struct ceph_crypto_key *secret,
+- void **p, void *end,
+- void *dbuf, void *ticket_buf)
++ void **p, void *end)
+ {
+ struct ceph_x_info *xi = ac->private;
+ int type;
+ u8 tkt_struct_v, blob_struct_v;
+ struct ceph_x_ticket_handler *th;
++ void *dbuf = NULL;
+ void *dp, *dend;
+ int dlen;
+ char is_enc;
+ struct timespec validity;
+ struct ceph_crypto_key old_key;
++ void *ticket_buf = NULL;
+ void *tp, *tpend;
+ struct ceph_timespec new_validity;
+ struct ceph_crypto_key new_session_key;
+@@ -167,8 +172,7 @@ static int process_one_ticket(struct cep
+ }
+
+ /* blob for me */
+- dlen = ceph_x_decrypt(secret, p, end, dbuf,
+- TEMP_TICKET_BUF_LEN);
++ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
+ if (dlen <= 0) {
+ ret = dlen;
+ goto out;
+@@ -195,20 +199,25 @@ static int process_one_ticket(struct cep
+
+ /* ticket blob for service */
+ ceph_decode_8_safe(p, end, is_enc, bad);
+- tp = ticket_buf;
+ if (is_enc) {
+ /* encrypted */
+ dout(" encrypted ticket\n");
+- dlen = ceph_x_decrypt(&old_key, p, end, ticket_buf,
+- TEMP_TICKET_BUF_LEN);
++ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
+ if (dlen < 0) {
+ ret = dlen;
+ goto out;
+ }
++ tp = ticket_buf;
+ dlen = ceph_decode_32(&tp);
+ } else {
+ /* unencrypted */
+ ceph_decode_32_safe(p, end, dlen, bad);
++ ticket_buf = kmalloc(dlen, GFP_NOFS);
++ if (!ticket_buf) {
++ ret = -ENOMEM;
++ goto out;
++ }
++ tp = ticket_buf;
+ ceph_decode_need(p, end, dlen, bad);
+ ceph_decode_copy(p, ticket_buf, dlen);
+ }
+@@ -237,6 +246,8 @@ static int process_one_ticket(struct cep
+ xi->have_keys |= th->service;
+
+ out:
++ kfree(ticket_buf);
++ kfree(dbuf);
+ return ret;
+
+ bad:
+@@ -249,21 +260,10 @@ static int ceph_x_proc_ticket_reply(stru
+ void *buf, void *end)
+ {
+ void *p = buf;
+- char *dbuf;
+- char *ticket_buf;
+ u8 reply_struct_v;
+ u32 num;
+ int ret;
+
+- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+- if (!dbuf)
+- return -ENOMEM;
+-
+- ret = -ENOMEM;
+- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+- if (!ticket_buf)
+- goto out_dbuf;
+-
+ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
+ if (reply_struct_v != 1)
+ return -EINVAL;
+@@ -272,22 +272,15 @@ static int ceph_x_proc_ticket_reply(stru
+ dout("%d tickets\n", num);
+
+ while (num--) {
+- ret = process_one_ticket(ac, secret, &p, end,
+- dbuf, ticket_buf);
++ ret = process_one_ticket(ac, secret, &p, end);
+ if (ret)
+- goto out;
++ return ret;
+ }
+
+- ret = 0;
+-out:
+- kfree(ticket_buf);
+-out_dbuf:
+- kfree(dbuf);
+- return ret;
++ return 0;
+
+ bad:
+- ret = -EINVAL;
+- goto out;
++ return -EINVAL;
+ }
+
+ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+@@ -583,13 +576,14 @@ static int ceph_x_verify_authorizer_repl
+ struct ceph_x_ticket_handler *th;
+ int ret = 0;
+ struct ceph_x_authorize_reply reply;
++ void *preply = &reply;
+ void *p = au->reply_buf;
+ void *end = p + sizeof(au->reply_buf);
+
+ th = get_ticket_handler(ac, au->service);
+ if (IS_ERR(th))
+ return PTR_ERR(th);
+- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
++ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
+ if (ret < 0)
+ return ret;
+ if (ret != sizeof(reply))
Copied: dists/wheezy-security/linux/debian/patches/bugfix/all/nfsd-fix-acl-null-pointer-deref.patch (from r21920, dists/wheezy/linux/debian/patches/bugfix/all/nfsd-fix-acl-null-pointer-deref.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/bugfix/all/nfsd-fix-acl-null-pointer-deref.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/bugfix/all/nfsd-fix-acl-null-pointer-deref.patch)
@@ -0,0 +1,37 @@
+From: Sergio Gelato <Sergio.Gelato at astro.su.se>
+Date: Wed, 24 Sep 2014 08:47:24 +0200
+Subject: Re: NFS regression in 3.2.60
+Bug-Debian: https://bugs.debian.org/754420
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1348670
+Origin: http://mid.gmane.org/20140924064724.GB4025@ebisu.astro.su.se
+
+BugLink: http://bugs.launchpad.net/bugs/1348670
+
+Fix regression introduced in pre-3.14 kernels by cherry-picking
+aa07c713ecfc0522916f3cd57ac628ea6127c0ec
+(NFSD: Call ->set_acl with a NULL ACL structure if no entries).
+
+The affected code was removed in 3.14 by commit
+4ac7249ea5a0ceef9f8269f63f33cc873c3fac61
+(nfsd: use get_acl and ->set_acl).
+The ->set_acl methods are already able to cope with a NULL argument.
+
+Signed-off-by: Sergio Gelato <Sergio.Gelato at astro.su.se>
+---
+ fs/nfsd/vfs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 446dc01..fc208e4 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -508,6 +508,9 @@
+ char *buf = NULL;
+ int error = 0;
+
++ if (!pacl)
++ return vfs_setxattr(dentry, key, NULL, 0, 0);
++
+ buflen = posix_acl_xattr_size(pacl->a_count);
+ buf = kmalloc(buflen, GFP_KERNEL);
+ error = -ENOMEM;
Copied: dists/wheezy-security/linux/debian/patches/bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch (from r21920, dists/wheezy/linux/debian/patches/bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch)
@@ -0,0 +1,85 @@
+From: Jan Kara <jack at suse.cz>
+Date: Thu, 4 Sep 2014 14:06:55 +0200
+Subject: udf: Avoid infinite loop when processing indirect ICBs
+Origin: https://git.kernel.org/linus/c03aa9f6e1f938618e6db2e23afef0574efeeb65
+
+We did not implement any bound on number of indirect ICBs we follow when
+loading inode. Thus corrupted medium could cause kernel to go into an
+infinite loop, possibly causing a stack overflow.
+
+Fix the possible stack overflow by removing recursion from
+__udf_read_inode() and limit number of indirect ICBs we follow to avoid
+infinite loops.
+
+Signed-off-by: Jan Kara <jack at suse.cz>
+[bwh: Backported to 3.2: adjust context]
+---
+ fs/udf/inode.c | 35 +++++++++++++++++++++--------------
+ 1 file changed, 21 insertions(+), 14 deletions(-)
+
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1176,13 +1176,22 @@ update_time:
+ return 0;
+ }
+
++/*
++ * Maximum length of linked list formed by ICB hierarchy. The chosen number is
++ * arbitrary - just that we hopefully don't limit any real use of rewritten
++ * inode on write-once media but avoid looping for too long on corrupted media.
++ */
++#define UDF_MAX_ICB_NESTING 1024
++
+ static void __udf_read_inode(struct inode *inode)
+ {
+ struct buffer_head *bh = NULL;
+ struct fileEntry *fe;
+ uint16_t ident;
+ struct udf_inode_info *iinfo = UDF_I(inode);
++ unsigned int indirections = 0;
+
++reread:
+ /*
+ * Set defaults, but the inode is still incomplete!
+ * Note: get_new_inode() sets the following on a new inode:
+@@ -1219,28 +1228,26 @@ static void __udf_read_inode(struct inod
+ ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1,
+ &ident);
+ if (ident == TAG_IDENT_IE && ibh) {
+- struct buffer_head *nbh = NULL;
+ struct kernel_lb_addr loc;
+ struct indirectEntry *ie;
+
+ ie = (struct indirectEntry *)ibh->b_data;
+ loc = lelb_to_cpu(ie->indirectICB.extLocation);
+
+- if (ie->indirectICB.extLength &&
+- (nbh = udf_read_ptagged(inode->i_sb, &loc, 0,
+- &ident))) {
+- if (ident == TAG_IDENT_FE ||
+- ident == TAG_IDENT_EFE) {
+- memcpy(&iinfo->i_location,
+- &loc,
+- sizeof(struct kernel_lb_addr));
+- brelse(bh);
+- brelse(ibh);
+- brelse(nbh);
+- __udf_read_inode(inode);
++ if (ie->indirectICB.extLength) {
++ brelse(bh);
++ brelse(ibh);
++ memcpy(&iinfo->i_location, &loc,
++ sizeof(struct kernel_lb_addr));
++ if (++indirections > UDF_MAX_ICB_NESTING) {
++ udf_err(inode->i_sb,
++ "too many ICBs in ICB hierarchy"
++ " (max %d supported)\n",
++ UDF_MAX_ICB_NESTING);
++ make_bad_inode(inode);
+ return;
+ }
+- brelse(nbh);
++ goto reread;
+ }
+ }
+ brelse(ibh);
Modified: dists/wheezy-security/linux/debian/patches/debian/inetpeer-avoid-abi-change-in-3.2.52.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/debian/inetpeer-avoid-abi-change-in-3.2.52.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/debian/inetpeer-avoid-abi-change-in-3.2.52.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -23,8 +23,8 @@
- };
/*
* Once inet_peer is queued for deletion (refcnt == -1), following fields
- * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
-@@ -64,6 +60,13 @@ struct inet_peer {
+ * are not available: rid, tcp_ts, tcp_ts_stamp
+@@ -63,6 +59,13 @@ struct inet_peer {
/* following fields might be frequently dirtied */
__u32 dtime; /* the time of last use of not referenced entries */
atomic_t refcnt;
Copied: dists/wheezy-security/linux/debian/patches/debian/ip-ident-avoid-abi-change-in-3.2.63.patch (from r21920, dists/wheezy/linux/debian/patches/debian/ip-ident-avoid-abi-change-in-3.2.63.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/ip-ident-avoid-abi-change-in-3.2.63.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/ip-ident-avoid-abi-change-in-3.2.63.patch)
@@ -0,0 +1,53 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Tue, 16 Sep 2014 02:44:19 +0100
+Subject: ip_ident: Avoid ABI change in 3.2.63
+
+Commits 64b5c251d5b2 ('inetpeer: get rid of ip_id_count') and
+04ca6973f7c1 ('ip: make IP identifiers less predictable'),
+backported into 3.2.63, removed a field from struct inetpeer
+and changed the parameters of __ip_select_ident(). Restore
+them as unused padding.
+
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -49,6 +49,7 @@ struct inet_peer {
+ union {
+ struct {
+ atomic_t rid; /* Frag reception counter */
++ atomic_t ip_id_count; /* now unused */
+ __u32 tcp_ts;
+ __u32 tcp_ts_stamp;
+ };
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -265,7 +265,8 @@ int ip_dont_fragment(struct sock *sk, st
+ }
+
+ u32 ip_idents_reserve(u32 hash, int segs);
+-void __ip_select_ident(struct iphdr *iph, int segs);
++void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst /*unused*/,
++ int segs);
+
+ static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
+ {
+@@ -284,7 +285,7 @@ static inline void ip_select_ident_segs(
+ iph->id = 0;
+ }
+ } else {
+- __ip_select_ident(iph, segs);
++ __ip_select_ident(iph, NULL, segs);
+ }
+ }
+
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1374,7 +1374,8 @@ u32 ip_idents_reserve(u32 hash, int segs
+ }
+ EXPORT_SYMBOL(ip_idents_reserve);
+
+-void __ip_select_ident(struct iphdr *iph, int segs)
++void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst /*unused*/,
++ int segs)
+ {
+ static u32 ip_idents_hashrnd __read_mostly;
+ static bool hashrnd_initialized = false;
Copied: dists/wheezy-security/linux/debian/patches/debian/irq-avoid-abi-change-in-3.2.61.patch (from r21920, dists/wheezy/linux/debian/patches/debian/irq-avoid-abi-change-in-3.2.61.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/irq-avoid-abi-change-in-3.2.61.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/irq-avoid-abi-change-in-3.2.61.patch)
@@ -0,0 +1,32 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Mon, 07 Jul 2014 01:09:53 +0100
+Subject: irq: Avoid ABI change in 3.2.61
+Forwarded: not-needed
+
+Move the new fields to the end of struct irq_desc and hide them from
+genksyms. Although struct irq_desc is normally allocated as part of a
+static array, access is abstracted through the irq_to_desc() function
+so modules don't depend on the size of the structure.
+
+--- a/include/linux/irqdesc.h
++++ b/include/linux/irqdesc.h
+@@ -55,8 +55,6 @@ struct irq_desc {
+ unsigned int irq_count; /* For detecting broken IRQs */
+ unsigned long last_unhandled; /* Aging timer for unhandled count */
+ unsigned int irqs_unhandled;
+- atomic_t threads_handled;
+- int threads_handled_last;
+ raw_spinlock_t lock;
+ struct cpumask *percpu_enabled;
+ #ifdef CONFIG_SMP
+@@ -74,6 +72,10 @@ struct irq_desc {
+ #endif
+ struct module *owner;
+ const char *name;
++#ifndef __GENKSYMS__
++ atomic_t threads_handled;
++ int threads_handled_last;
++#endif
+ } ____cacheline_internodealigned_in_smp;
+
+ #ifndef CONFIG_SPARSE_IRQ
Copied: dists/wheezy-security/linux/debian/patches/debian/libata-avoid-abi-change-in-3.2.62.patch (from r21920, dists/wheezy/linux/debian/patches/debian/libata-avoid-abi-change-in-3.2.62.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/libata-avoid-abi-change-in-3.2.62.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/libata-avoid-abi-change-in-3.2.62.patch)
@@ -0,0 +1,77 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Tue, 05 Aug 2014 09:51:04 +0100
+Subject: libata: Avoid ABI change in 3.2.62
+
+Commit 1a112d10f03e ('libata: introduce ata_host->n_tags to avoid oops
+on SAS controllers') added a field in a structure which may be
+driver-allocated. So we can't simply move it to the end. However
+there is a flags field with many free bits, and we only need 5 bits
+(ATA_MAX_QUEUE == 32 and n_tags must be less than this). Add a
+pair of accessors to make this slightly less ugly.
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -171,6 +171,17 @@ static bool ata_sstatus_online(u32 sstat
+ return (sstatus & 0xf) == 0x3;
+ }
+
++static unsigned int ata_host_get_n_tags(const struct ata_host *host)
++{
++ return (host->flags & ATA_HOST_N_TAGS_MASK) >> ATA_HOST_N_TAGS_SHIFT;
++}
++
++static void ata_host_set_n_tags(struct ata_host *host, unsigned int n_tags)
++{
++ host->flags = ((host->flags & ~ATA_HOST_N_TAGS_MASK) |
++ (n_tags << ATA_HOST_N_TAGS_SHIFT));
++}
++
+ /**
+ * ata_link_next - link iteration helper
+ * @link: the previous link, NULL to start
+@@ -4728,7 +4739,7 @@ void swap_buf_le16(u16 *buf, unsigned in
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ struct ata_queued_cmd *qc = NULL;
+- unsigned int max_queue = ap->host->n_tags;
++ unsigned int max_queue = ata_host_get_n_tags(ap->host);
+ unsigned int i, tag;
+
+ /* no command while frozen */
+@@ -5929,7 +5940,7 @@ void ata_host_init(struct ata_host *host
+ {
+ spin_lock_init(&host->lock);
+ mutex_init(&host->eh_mutex);
+- host->n_tags = ATA_MAX_QUEUE - 1;
++ ata_host_set_n_tags(host, ATA_MAX_QUEUE - 1);
+ host->dev = dev;
+ host->flags = flags;
+ host->ops = ops;
+@@ -6010,7 +6021,7 @@ int ata_host_register(struct ata_host *h
+ {
+ int i, rc;
+
+- host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1);
++ ata_host_set_n_tags(host, clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1));
+
+ /* host must have been started */
+ if (!(host->flags & ATA_HOST_STARTED)) {
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -248,6 +248,8 @@ enum {
+ ATA_HOST_STARTED = (1 << 1), /* Host started */
+ ATA_HOST_PARALLEL_SCAN = (1 << 2), /* Ports on this host can be scanned in parallel */
+ ATA_HOST_IGNORE_ATA = (1 << 3), /* Ignore ATA devices on this host. */
++ ATA_HOST_N_TAGS_SHIFT = 4,
++ ATA_HOST_N_TAGS_MASK = (ATA_MAX_QUEUE - 1) << ATA_HOST_N_TAGS_SHIFT,
+
+ /* bits 24:31 of host->flags are reserved for LLD specific flags */
+
+@@ -541,7 +543,6 @@ struct ata_host {
+ struct device *dev;
+ void __iomem * const *iomap;
+ unsigned int n_ports;
+- unsigned int n_tags; /* nr of NCQ tags */
+ void *private_data;
+ struct ata_port_operations *ops;
+ unsigned long flags;
Copied: dists/wheezy-security/linux/debian/patches/debian/nlattr-avoid-abi-change-in-3.2.61.patch (from r21920, dists/wheezy/linux/debian/patches/debian/nlattr-avoid-abi-change-in-3.2.61.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/nlattr-avoid-abi-change-in-3.2.61.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/nlattr-avoid-abi-change-in-3.2.61.patch)
@@ -0,0 +1,21 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Tue, 16 Sep 2014 14:19:33 +0100
+Subject: nlattr: Avoid ABI change in 3.2.61
+
+Commit bfc5184b69cf ('netlink: rate-limit leftover bytes warning and
+print process name') added new #includes, and these changed symbol
+hashes on some architectures. Hide them from genksyms.
+
+--- a/lib/nlattr.c
++++ b/lib/nlattr.c
+@@ -12,8 +12,10 @@
+ #include <linux/netdevice.h>
+ #include <linux/skbuff.h>
+ #include <linux/string.h>
++#ifndef __GENKSYMS__
+ #include <linux/ratelimit.h>
+ #include <linux/sched.h>
++#endif
+ #include <linux/types.h>
+ #include <net/netlink.h>
+
Copied: dists/wheezy-security/linux/debian/patches/debian/ptrace-avoid-abi-change-in-3.2.61.patch (from r21920, dists/wheezy/linux/debian/patches/debian/ptrace-avoid-abi-change-in-3.2.61.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/ptrace-avoid-abi-change-in-3.2.61.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/ptrace-avoid-abi-change-in-3.2.61.patch)
@@ -0,0 +1,20 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Mon, 07 Jul 2014 09:52:12 +0100
+Subject: ptrace: Avoid ABI change in 3.2.61
+Forwarded: not-needed
+
+Hide a new #include from genksyms, which changed the symbol hashes for
+most of networking.
+
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -112,7 +112,9 @@
+
+ #include <linux/compiler.h> /* For unlikely. */
+ #include <linux/sched.h> /* For struct task_struct. */
++#ifndef __GENKSYMS__
+ #include <linux/pid_namespace.h> /* For task_active_pid_ns. */
++#endif
+
+
+ extern long arch_ptrace(struct task_struct *child, long request,
Copied: dists/wheezy-security/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.61.patch (from r21920, dists/wheezy/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.61.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.61.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.61.patch)
@@ -0,0 +1,43 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Sun, 01 Jun 2014 20:47:46 +0100
+Subject: SCSI: Avoid ABI change in 3.2.61
+
+Commit e63ed0d7a980 ("scsi: fix our current target reap infrastructure")
+removed one field (ew) and changed the type of another (reap_ref).
+
+Put back 'ew' and hide the type change to 'reap_ref', which remains
+the same size and is only used within the SCSI core.
+
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -445,6 +445,8 @@ static struct scsi_target *scsi_alloc_ta
+ }
+ dev = &starget->dev;
+ device_initialize(dev);
++ /* bwh: assert binary compatibility */
++ BUILD_BUG_ON(sizeof(starget->reap_ref) != sizeof(unsigned int));
+ kref_init(&starget->reap_ref);
+ dev->parent = get_device(parent);
+ dev_set_name(dev, "target%d:%d:%d", shost->host_no, channel, id);
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -239,7 +239,11 @@ struct scsi_target {
+ struct list_head siblings;
+ struct list_head devices;
+ struct device dev;
++#ifdef __GENKSYMS__
++ unsigned int reap_ref;
++#else
+ struct kref reap_ref; /* last put renders target invisible */
++#endif
+ unsigned int channel;
+ unsigned int id; /* target id ... replace
+ * scsi_device.id eventually */
+@@ -261,6 +265,7 @@ struct scsi_target {
+ #define SCSI_DEFAULT_TARGET_BLOCKED 3
+
+ char scsi_level;
++ struct execute_work ew; /* bwh: unused, for binary compatibility */
+ enum scsi_target_state state;
+ void *hostdata; /* available to low-level driver */
+ unsigned long starget_data[0]; /* for the transport */
Copied: dists/wheezy-security/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.62.patch (from r21920, dists/wheezy/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.62.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.62.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/scsi-avoid-abi-change-in-3.2.62.patch)
@@ -0,0 +1,22 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Tue, 16 Sep 2014 02:51:20 +0100
+Subject: SCSI: Avoid ABI change in 3.2.62
+
+Commit b14bf2d0c035 ('usb-storage/SCSI: Add broken_fua blacklist flag')
+adds a new 1-bit field to struct scsi_device. This is fine because it
+had 29 bits of padding to spare, but we need to hide the new field
+from genksyms.
+
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -151,7 +151,10 @@ struct scsi_device {
+ unsigned no_read_disc_info:1; /* Avoid READ_DISC_INFO cmds */
+ unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */
+ unsigned is_visible:1; /* is the device visible in sysfs */
++#ifndef __GENKSYMS__
+ unsigned broken_fua:1; /* Don't set FUA bit */
++ /* 28 bits of padding */
++#endif
+
+ DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
+ struct list_head event_list; /* asserted events */
Copied: dists/wheezy-security/linux/debian/patches/debian/sp5100_tco-reject-sb8x0-chips.patch (from r21920, dists/wheezy/linux/debian/patches/debian/sp5100_tco-reject-sb8x0-chips.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/sp5100_tco-reject-sb8x0-chips.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/sp5100_tco-reject-sb8x0-chips.patch)
@@ -0,0 +1,27 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Wed, 24 Sep 2014 03:02:28 +0100
+Subject: sp5100_tco: Reject SB8x0 chips
+Bug-Debian: https://bugs.debian.org/726150
+Forwarded: not-needed
+
+The SMBus functions of SB8x0 chips have the same PCI ID as on the
+SP5100, but the TCO timer has a different register set! They can be
+distinguished by PCI revision.
+
+Upstream commit 740fbddf5c3f ('watchdog: sp5100_tco: Add SB8x0 chipset
+support') adds support for the newer chips, but we're playing safe
+here by rejecting them completely.
+
+--- a/drivers/watchdog/sp5100_tco.c
++++ b/drivers/watchdog/sp5100_tco.c
+@@ -287,6 +287,10 @@ static unsigned char __devinit sp5100_tc
+ if (!sp5100_tco_pci)
+ return 0;
+
++ /* Higher revisions are SB8x0 which have a different register set */
++ if (sp5100_tco_pci->revision >= 0x40)
++ return 0;
++
+ /* Request the IO ports used by this driver */
+ pm_iobase = SP5100_IO_PM_INDEX_REG;
+ if (!request_region(pm_iobase, SP5100_PM_IOPORTS_SIZE, "SP5100 TCO")) {
Copied: dists/wheezy-security/linux/debian/patches/debian/trace-syscall-avoid-abi-change-in-3.2.61.patch (from r21920, dists/wheezy/linux/debian/patches/debian/trace-syscall-avoid-abi-change-in-3.2.61.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/debian/trace-syscall-avoid-abi-change-in-3.2.61.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/debian/trace-syscall-avoid-abi-change-in-3.2.61.patch)
@@ -0,0 +1,19 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Fri, 11 Jul 2014 09:07:00 +0100
+Subject: trace/syscall: Avoid ABI change in 3.2.61
+Forwarded: not-needed
+
+Hide the added #include from genksyms.
+
+--- a/include/trace/syscall.h
++++ b/include/trace/syscall.h
+@@ -4,7 +4,9 @@
+ #include <linux/tracepoint.h>
+ #include <linux/unistd.h>
+ #include <linux/ftrace_event.h>
++#ifndef __GENKSYMS__
+ #include <linux/thread_info.h>
++#endif
+
+ #include <asm/ptrace.h>
+
Modified: dists/wheezy-security/linux/debian/patches/features/all/drm/drm-3.4.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/all/drm/drm-3.4.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/all/drm/drm-3.4.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -2156,7 +2156,7 @@
+}
+EXPORT_SYMBOL(drm_format_num_planes);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
-index acfe567..e9f1ef5 100644
+index 0731d43..e9f1ef5 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -61,14 +61,14 @@ static int drm_version(struct drm_device *dev, void *data,
@@ -2226,6 +2226,17 @@
atomic_inc(&dev->ioctl_count);
atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
++file_priv->ioctl_count;
+@@ -456,9 +468,8 @@ long drm_ioctl(struct file *filp,
+ retcode = -EFAULT;
+ goto err_i1;
+ }
+- } else if (cmd & IOC_OUT) {
++ } else
+ memset(kdata, 0, usize);
+- }
+
+ if (ioctl->flags & DRM_UNLOCKED)
+ retcode = func(dev, kdata, file_priv);
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 72f460e..d75dccb 100644
--- a/drivers/gpu/drm/drm_edid.c
@@ -45455,7 +45466,7 @@
return ret;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index b1bb734..e97ed61 100644
+index a0b69ae..e97ed61 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -203,9 +203,9 @@ i915_gem_object_set_to_gpu_domain(struct drm_i915_gem_object *obj,
@@ -45470,62 +45481,18 @@
}
struct eb_objects {
-@@ -287,14 +287,14 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
- * exec_object list, so it should have a GTT space bound by now.
- */
- if (unlikely(target_offset == 0)) {
-- DRM_ERROR("No GTT space found for object %d\n",
-+ DRM_DEBUG("No GTT space found for object %d\n",
- reloc->target_handle);
- return ret;
- }
-
- /* Validate that the target is in a valid r/w GPU domain */
- if (unlikely(reloc->write_domain & (reloc->write_domain - 1))) {
-- DRM_ERROR("reloc with multiple write domains: "
-+ DRM_DEBUG("reloc with multiple write domains: "
- "obj %p target %d offset %d "
- "read %08x write %08x",
- obj, reloc->target_handle,
@@ -303,8 +303,9 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
reloc->write_domain);
return ret;
}
- if (unlikely((reloc->write_domain | reloc->read_domains) & I915_GEM_DOMAIN_CPU)) {
-- DRM_ERROR("reloc with read/write CPU domains: "
+- DRM_DEBUG("reloc with read/write CPU domains: "
+ if (unlikely((reloc->write_domain | reloc->read_domains)
+ & ~I915_GEM_GPU_DOMAINS)) {
+ DRM_DEBUG("reloc with read/write non-GPU domains: "
"obj %p target %d offset %d "
"read %08x write %08x",
obj, reloc->target_handle,
-@@ -315,7 +316,7 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
- }
- if (unlikely(reloc->write_domain && target_obj->pending_write_domain &&
- reloc->write_domain != target_obj->pending_write_domain)) {
-- DRM_ERROR("Write domain conflict: "
-+ DRM_DEBUG("Write domain conflict: "
- "obj %p target %d offset %d "
- "new %08x old %08x\n",
- obj, reloc->target_handle,
-@@ -336,7 +337,7 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
-
- /* Check that the relocation address is valid... */
- if (unlikely(reloc->offset > obj->base.size - 4)) {
-- DRM_ERROR("Relocation beyond object bounds: "
-+ DRM_DEBUG("Relocation beyond object bounds: "
- "obj %p target %d offset %d size %d.\n",
- obj, reloc->target_handle,
- (int) reloc->offset,
-@@ -344,7 +345,7 @@ i915_gem_execbuffer_relocate_entry(struct drm_i915_gem_object *obj,
- return ret;
- }
- if (unlikely(reloc->offset & 3)) {
-- DRM_ERROR("Relocation not 4-byte aligned: "
-+ DRM_DEBUG("Relocation not 4-byte aligned: "
- "obj %p target %d offset %d.\n",
- obj, reloc->target_handle,
- (int) reloc->offset);
@@ -461,11 +462,60 @@ i915_gem_execbuffer_relocate(struct drm_device *dev,
return ret;
}
@@ -45703,13 +45670,13 @@
- i915_gem_object_unpin(obj);
+ list_for_each_entry_continue_reverse(obj, objects, exec_list) {
+ struct drm_i915_gem_exec_object2 *entry;
-+
-+ if (!obj->gtt_space)
-+ continue;
- obj = list_entry(obj->exec_list.prev,
- struct drm_i915_gem_object,
- exec_list);
++ if (!obj->gtt_space)
++ continue;
++
+ entry = obj->exec_entry;
+ if (entry->flags & __EXEC_OBJECT_HAS_FENCE) {
+ i915_gem_object_unpin_fence(obj);
@@ -45720,15 +45687,19 @@
}
return ret;
-@@ -704,7 +754,7 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
- obj = to_intel_bo(drm_gem_object_lookup(dev, file,
- exec[i].handle));
- if (&obj->base == NULL) {
-- DRM_ERROR("Invalid object handle %d at index %d\n",
-+ DRM_DEBUG("Invalid object handle %d at index %d\n",
- exec[i].handle, i);
- ret = -ENOENT;
- goto err;
+@@ -679,9 +729,9 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
+ * relocations were valid.
+ */
+ for (j = 0; j < exec[i].relocation_count; j++) {
+- if (__copy_to_user(&user_relocs[j].presumed_offset,
+- &invalid_offset,
+- sizeof(invalid_offset))) {
++ if (copy_to_user(&user_relocs[j].presumed_offset,
++ &invalid_offset,
++ sizeof(invalid_offset))) {
+ ret = -EFAULT;
+ mutex_lock(&dev->struct_mutex);
+ goto err;
@@ -998,6 +1048,31 @@ i915_gem_execbuffer_retire_commands(struct drm_device *dev,
}
@@ -45761,88 +45732,6 @@
i915_gem_do_execbuffer(struct drm_device *dev, void *data,
struct drm_file *file,
struct drm_i915_gem_execbuffer2 *args,
-@@ -1015,7 +1090,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- int ret, mode, i;
-
- if (!i915_gem_check_execbuffer(args)) {
-- DRM_ERROR("execbuf with invalid offset/length\n");
-+ DRM_DEBUG("execbuf with invalid offset/length\n");
- return -EINVAL;
- }
-
-@@ -1030,20 +1105,20 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- break;
- case I915_EXEC_BSD:
- if (!HAS_BSD(dev)) {
-- DRM_ERROR("execbuf with invalid ring (BSD)\n");
-+ DRM_DEBUG("execbuf with invalid ring (BSD)\n");
- return -EINVAL;
- }
- ring = &dev_priv->ring[VCS];
- break;
- case I915_EXEC_BLT:
- if (!HAS_BLT(dev)) {
-- DRM_ERROR("execbuf with invalid ring (BLT)\n");
-+ DRM_DEBUG("execbuf with invalid ring (BLT)\n");
- return -EINVAL;
- }
- ring = &dev_priv->ring[BCS];
- break;
- default:
-- DRM_ERROR("execbuf with unknown ring: %d\n",
-+ DRM_DEBUG("execbuf with unknown ring: %d\n",
- (int)(args->flags & I915_EXEC_RING_MASK));
- return -EINVAL;
- }
-@@ -1069,18 +1144,18 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- }
- break;
- default:
-- DRM_ERROR("execbuf with unknown constants: %d\n", mode);
-+ DRM_DEBUG("execbuf with unknown constants: %d\n", mode);
- return -EINVAL;
- }
-
- if (args->buffer_count < 1) {
-- DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
-+ DRM_DEBUG("execbuf with %d buffers\n", args->buffer_count);
- return -EINVAL;
- }
-
- if (args->num_cliprects != 0) {
- if (ring != &dev_priv->ring[RCS]) {
-- DRM_ERROR("clip rectangles are only valid with the render ring\n");
-+ DRM_DEBUG("clip rectangles are only valid with the render ring\n");
- return -EINVAL;
- }
-
-@@ -1130,7 +1205,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- obj = to_intel_bo(drm_gem_object_lookup(dev, file,
- exec[i].handle));
- if (&obj->base == NULL) {
-- DRM_ERROR("Invalid object handle %d at index %d\n",
-+ DRM_DEBUG("Invalid object handle %d at index %d\n",
- exec[i].handle, i);
- /* prevent error path from reading uninitialized data */
- ret = -ENOENT;
-@@ -1138,7 +1213,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- }
-
- if (!list_empty(&obj->exec_list)) {
-- DRM_ERROR("Object %p [handle %d, index %d] appears more than once in object list\n",
-+ DRM_DEBUG("Object %p [handle %d, index %d] appears more than once in object list\n",
- obj, exec[i].handle, i);
- ret = -EINVAL;
- goto err;
-@@ -1176,7 +1251,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
-
- /* Set the pending read domains for the batch buffer to COMMAND */
- if (batch_obj->base.pending_write_domain) {
-- DRM_ERROR("Attempting to use self-modifying batch buffer\n");
-+ DRM_DEBUG("Attempting to use self-modifying batch buffer\n");
- ret = -EINVAL;
- goto err;
- }
@@ -1193,7 +1268,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
* so every billion or so execbuffers, we need to stall
* the GPU in order to reset the counters.
@@ -45865,78 +45754,71 @@
trace_i915_gem_ring_dispatch(ring, seqno);
exec_start = batch_obj->gtt_offset + args->batch_start_offset;
-@@ -1275,7 +1356,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- int ret, i;
-
- if (args->buffer_count < 1) {
-- DRM_ERROR("execbuf with %d buffers\n", args->buffer_count);
-+ DRM_DEBUG("execbuf with %d buffers\n", args->buffer_count);
- return -EINVAL;
- }
+@@ -1325,21 +1406,19 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
-@@ -1283,7 +1364,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- exec_list = drm_malloc_ab(sizeof(*exec_list), args->buffer_count);
- exec2_list = drm_malloc_ab(sizeof(*exec2_list), args->buffer_count);
- if (exec_list == NULL || exec2_list == NULL) {
-- DRM_ERROR("Failed to allocate exec list for %d buffers\n",
-+ DRM_DEBUG("Failed to allocate exec list for %d buffers\n",
- args->buffer_count);
- drm_free_large(exec_list);
- drm_free_large(exec2_list);
-@@ -1294,7 +1375,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- (uintptr_t) args->buffers_ptr,
- sizeof(*exec_list) * args->buffer_count);
- if (ret != 0) {
-- DRM_ERROR("copy %d exec entries failed %d\n",
-+ DRM_DEBUG("copy %d exec entries failed %d\n",
- args->buffer_count, ret);
- drm_free_large(exec_list);
- drm_free_large(exec2_list);
-@@ -1335,7 +1416,7 @@ i915_gem_execbuffer(struct drm_device *dev, void *data,
- sizeof(*exec_list) * args->buffer_count);
- if (ret) {
- ret = -EFAULT;
-- DRM_ERROR("failed to copy %d exec entries "
+ ret = i915_gem_do_execbuffer(dev, data, file, &exec2, exec2_list);
+ if (!ret) {
+- struct drm_i915_gem_exec_object __user *user_exec_list =
+- (void __user *)(uintptr_t)args->buffers_ptr;
+-
+ /* Copy the new buffer offsets back to the user's exec list. */
+- for (i = 0; i < args->buffer_count; i++) {
+- ret = __copy_to_user(&user_exec_list[i].offset,
+- &exec2_list[i].offset,
+- sizeof(user_exec_list[i].offset));
+- if (ret) {
+- ret = -EFAULT;
+- DRM_DEBUG("failed to copy %d exec entries "
+- "back to user (%d)\n",
+- args->buffer_count, ret);
+- break;
+- }
++ for (i = 0; i < args->buffer_count; i++)
++ exec_list[i].offset = exec2_list[i].offset;
++ /* ... and back out to userspace */
++ ret = copy_to_user((struct drm_i915_relocation_entry __user *)
++ (uintptr_t) args->buffers_ptr,
++ exec_list,
++ sizeof(*exec_list) * args->buffer_count);
++ if (ret) {
++ ret = -EFAULT;
+ DRM_DEBUG("failed to copy %d exec entries "
- "back to user (%d)\n",
- args->buffer_count, ret);
++ "back to user (%d)\n",
++ args->buffer_count, ret);
}
-@@ -1356,7 +1437,7 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
-
- if (args->buffer_count < 1 ||
- args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
-- DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
-+ DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count);
- return -EINVAL;
}
-@@ -1366,7 +1447,7 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
- exec2_list = drm_malloc_ab(sizeof(*exec2_list),
- args->buffer_count);
- if (exec2_list == NULL) {
-- DRM_ERROR("Failed to allocate exec list for %d buffers\n",
-+ DRM_DEBUG("Failed to allocate exec list for %d buffers\n",
- args->buffer_count);
- return -ENOMEM;
- }
-@@ -1375,7 +1456,7 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
- (uintptr_t) args->buffers_ptr,
- sizeof(*exec2_list) * args->buffer_count);
- if (ret != 0) {
-- DRM_ERROR("copy %d exec entries failed %d\n",
-+ DRM_DEBUG("copy %d exec entries failed %d\n",
- args->buffer_count, ret);
- drm_free_large(exec2_list);
- return -EFAULT;
-@@ -1390,7 +1471,7 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
- sizeof(*exec2_list) * args->buffer_count);
- if (ret) {
- ret = -EFAULT;
-- DRM_ERROR("failed to copy %d exec entries "
+@@ -1386,21 +1465,15 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
+ ret = i915_gem_do_execbuffer(dev, data, file, args, exec2_list);
+ if (!ret) {
+ /* Copy the new buffer offsets back to the user's exec list. */
+- struct drm_i915_gem_exec_object2 __user *user_exec_list =
+- (void __user *)(uintptr_t)args->buffers_ptr;
+- int i;
+-
+- for (i = 0; i < args->buffer_count; i++) {
+- ret = __copy_to_user(&user_exec_list[i].offset,
+- &exec2_list[i].offset,
+- sizeof(user_exec_list[i].offset));
+- if (ret) {
+- ret = -EFAULT;
+- DRM_DEBUG("failed to copy %d exec entries "
+- "back to user\n",
+- args->buffer_count);
+- break;
+- }
++ ret = copy_to_user((struct drm_i915_relocation_entry __user *)
++ (uintptr_t) args->buffers_ptr,
++ exec2_list,
++ sizeof(*exec2_list) * args->buffer_count);
++ if (ret) {
++ ret = -EFAULT;
+ DRM_DEBUG("failed to copy %d exec entries "
- "back to user (%d)\n",
- args->buffer_count, ret);
++ "back to user (%d)\n",
++ args->buffer_count, ret);
}
+ }
+
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index 6042c5e..99a7855 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -67890,7 +67772,7 @@
shl b32 $r14 8
sub b32 $r15 $r14 $r15
diff --git a/drivers/gpu/drm/nouveau/nvc0_graph.h b/drivers/gpu/drm/nouveau/nvc0_graph.h
-index 636fe98..91d44ea 100644
+index 636fe98..91d44ea6 100644
--- a/drivers/gpu/drm/nouveau/nvc0_graph.h
+++ b/drivers/gpu/drm/nouveau/nvc0_graph.h
@@ -87,6 +87,7 @@ nvc0_graph_class(struct drm_device *dev)
@@ -71874,7 +71756,7 @@
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index cd98c06..dc612ef 100644
+index 927d170..d51c08d 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -231,6 +231,22 @@ static void atombios_blank_crtc(struct drm_crtc *crtc, int state)
@@ -72073,7 +71955,7 @@
break;
default:
DRM_ERROR("Unknown table version %d %d\n", frev, crev);
-@@ -935,7 +968,9 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+@@ -939,7 +972,9 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
struct radeon_connector_atom_dig *dig_connector =
radeon_connector->con_priv;
int dp_clock;
@@ -72084,7 +71966,7 @@
switch (encoder_mode) {
case ATOM_ENCODER_MODE_DP_MST:
-@@ -956,13 +991,10 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+@@ -960,13 +995,10 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
ss_enabled =
radeon_atombios_get_ppll_ss_info(rdev, &ss,
ATOM_DP_SS_ID1);
@@ -72099,7 +71981,7 @@
}
break;
case ATOM_ENCODER_MODE_LVDS:
-@@ -1007,7 +1039,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+@@ -1011,7 +1043,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
radeon_compute_pll_legacy(pll, adjusted_clock, &pll_clock, &fb_div, &frac_fb_div,
&ref_div, &post_div);
@@ -72108,7 +71990,7 @@
atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
encoder_mode, radeon_encoder->encoder_id, mode->clock,
-@@ -1030,7 +1062,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
+@@ -1034,7 +1066,7 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
ss.step = step_size;
}
@@ -72117,7 +71999,7 @@
}
}
-@@ -1047,6 +1079,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+@@ -1051,6 +1083,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
struct radeon_bo *rbo;
uint64_t fb_location;
uint32_t fb_format, fb_pitch_pixels, tiling_flags;
@@ -72125,7 +72007,7 @@
u32 fb_swap = EVERGREEN_GRPH_ENDIAN_SWAP(EVERGREEN_GRPH_ENDIAN_NONE);
u32 tmp, viewport_w, viewport_h;
int r;
-@@ -1137,20 +1170,13 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+@@ -1141,20 +1174,13 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
break;
}
@@ -72152,7 +72034,7 @@
} else if (tiling_flags & RADEON_TILING_MICRO)
fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1);
-@@ -1195,7 +1221,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
+@@ -1199,7 +1225,7 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
WREG32(EVERGREEN_GRPH_X_END + radeon_crtc->crtc_offset, target_fb->width);
WREG32(EVERGREEN_GRPH_Y_END + radeon_crtc->crtc_offset, target_fb->height);
@@ -72161,7 +72043,7 @@
WREG32(EVERGREEN_GRPH_PITCH + radeon_crtc->crtc_offset, fb_pitch_pixels);
WREG32(EVERGREEN_GRPH_ENABLE + radeon_crtc->crtc_offset, 1);
-@@ -1364,7 +1390,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
+@@ -1368,7 +1394,7 @@ static int avivo_crtc_do_set_base(struct drm_crtc *crtc,
WREG32(AVIVO_D1GRPH_X_END + radeon_crtc->crtc_offset, target_fb->width);
WREG32(AVIVO_D1GRPH_Y_END + radeon_crtc->crtc_offset, target_fb->height);
@@ -72170,7 +72052,7 @@
WREG32(AVIVO_D1GRPH_PITCH + radeon_crtc->crtc_offset, fb_pitch_pixels);
WREG32(AVIVO_D1GRPH_ENABLE + radeon_crtc->crtc_offset, 1);
-@@ -1466,7 +1492,36 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+@@ -1470,7 +1496,36 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
struct drm_crtc *test_crtc;
uint32_t pll_in_use = 0;
@@ -72208,7 +72090,7 @@
list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
if (test_encoder->crtc && (test_encoder->crtc == crtc)) {
/* in DP mode, the DP ref clock can come from PPLL, DCPLL, or ext clock,
-@@ -1481,6 +1536,8 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+@@ -1485,6 +1540,8 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(test_encoder))) {
if (rdev->clock.dp_extclk)
return ATOM_PPLL_INVALID;
@@ -72217,7 +72099,7 @@
else if (ASIC_IS_DCE5(rdev))
return ATOM_DCPLL;
}
-@@ -1507,6 +1564,26 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
+@@ -1511,6 +1568,26 @@ static int radeon_atom_pick_pll(struct drm_crtc *crtc)
}
@@ -72244,7 +72126,7 @@
int atombios_crtc_mode_set(struct drm_crtc *crtc,
struct drm_display_mode *mode,
struct drm_display_mode *adjusted_mode,
-@@ -1528,19 +1605,6 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc,
+@@ -1532,19 +1609,6 @@ int atombios_crtc_mode_set(struct drm_crtc *crtc,
}
}
@@ -72264,7 +72146,7 @@
atombios_crtc_set_pll(crtc, adjusted_mode);
if (ASIC_IS_DCE4(rdev))
-@@ -1574,18 +1638,28 @@ static bool atombios_crtc_mode_fixup(struct drm_crtc *crtc,
+@@ -1578,18 +1642,28 @@ static bool atombios_crtc_mode_fixup(struct drm_crtc *crtc,
static void atombios_crtc_prepare(struct drm_crtc *crtc)
{
struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
@@ -72293,7 +72175,7 @@
}
static void atombios_crtc_disable(struct drm_crtc *crtc)
-@@ -1597,6 +1671,8 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
+@@ -1601,6 +1675,8 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
int i;
atombios_crtc_dpms(crtc, DRM_MODE_DPMS_OFF);
@@ -72302,7 +72184,7 @@
for (i = 0; i < rdev->num_crtc; i++) {
if (rdev->mode_info.crtcs[i] &&
-@@ -1617,6 +1693,12 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
+@@ -1621,6 +1697,12 @@ static void atombios_crtc_disable(struct drm_crtc *crtc)
atombios_crtc_program_pll(crtc, radeon_crtc->crtc_id, radeon_crtc->pll_id,
0, 0, ATOM_DISABLE, 0, 0, 0, 0, 0, false, &ss);
break;
@@ -72316,7 +72198,7 @@
break;
}
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
-index 3254d51e..8d1724c 100644
+index e8a3c31..8d1724c 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -45,6 +45,41 @@ static char *pre_emph_names[] = {
@@ -72378,6 +72260,15 @@
args.v1.ucDataOutLen = 0;
args.v1.ucChannelID = chan->rec.i2c_id;
args.v1.ucDelay = delay / 10;
+@@ -89,7 +124,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
+ /* flags not zero */
+ if (args.v1.ucReplyStatus == 2) {
+ DRM_DEBUG_KMS("dp_aux_ch flags not zero\n");
+- return -EIO;
++ return -EBUSY;
+ }
+
+ /* error */
@@ -103,7 +138,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
recv_bytes = recv_size;
@@ -72412,7 +72303,7 @@
radeon_write_dpcd_reg(dp_info->radeon_connector, DP_LANE_COUNT_SET, tmp);
diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
-index 475a275..072229d 100644
+index 286f1fa..dd5c14e 100644
--- a/drivers/gpu/drm/radeon/atombios_encoders.c
+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
@@ -57,22 +57,6 @@ static inline bool radeon_encoder_is_digital(struct drm_encoder *encoder)
@@ -72834,7 +72725,7 @@
atombios_external_encoder_setup(encoder, ext_encoder,
EXTERNAL_ENCODER_ACTION_V3_ENCODER_BLANKING);
atombios_external_encoder_setup(encoder, ext_encoder,
-@@ -1738,13 +1778,34 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
+@@ -1741,13 +1781,34 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
struct drm_encoder *test_encoder;
@@ -72874,7 +72765,7 @@
/* ontario follows DCE4 */
if (rdev->family == CHIP_PALM) {
if (dig->linkb)
-@@ -1832,7 +1893,7 @@ radeon_atom_encoder_init(struct radeon_device *rdev)
+@@ -1835,7 +1896,7 @@ radeon_atom_encoder_init(struct radeon_device *rdev)
break;
}
@@ -73043,7 +72934,7 @@
#include <linux/kernel.h>
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 5efba47..df62c39 100644
+index 9b3f787..df62c39 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -50,6 +50,39 @@ static const u32 crtc_offsets[6] =
@@ -73581,7 +73472,15 @@
WREG32(GRBM_INT_CNTL, grbm_int_cntl);
WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, crtc1);
-@@ -3014,11 +3166,24 @@ restart_ih:
+@@ -2765,7 +2917,6 @@ static u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
+ tmp = RREG32(IH_RB_CNTL);
+ tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ WREG32(IH_RB_CNTL, tmp);
+- wptr &= ~RB_OVERFLOW;
+ }
+ return (wptr & rdev->ih.ptr_mask);
+ }
+@@ -3015,11 +3166,24 @@ restart_ih:
case 177: /* CP_INT in IB1 */
case 178: /* CP_INT in IB2 */
DRM_DEBUG("IH: CP int: 0x%08x\n", src_data);
@@ -73608,7 +73507,7 @@
break;
case 233: /* GUI IDLE */
DRM_DEBUG("IH: GUI idle\n");
-@@ -3048,6 +3213,7 @@ restart_ih:
+@@ -3049,6 +3213,7 @@ restart_ih:
static int evergreen_startup(struct radeon_device *rdev)
{
@@ -73616,7 +73515,7 @@
int r;
/* enable pcie gen2 link */
-@@ -3094,7 +3260,7 @@ static int evergreen_startup(struct radeon_device *rdev)
+@@ -3095,7 +3260,7 @@ static int evergreen_startup(struct radeon_device *rdev)
r = evergreen_blit_init(rdev);
if (r) {
r600_blit_fini(rdev);
@@ -73625,7 +73524,7 @@
dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
}
-@@ -3103,6 +3269,12 @@ static int evergreen_startup(struct radeon_device *rdev)
+@@ -3104,6 +3269,12 @@ static int evergreen_startup(struct radeon_device *rdev)
if (r)
return r;
@@ -73638,7 +73537,7 @@
/* Enable IRQ */
if (!rdev->irq.installed) {
r = radeon_irq_kms_init(rdev);
-@@ -3118,7 +3290,9 @@ static int evergreen_startup(struct radeon_device *rdev)
+@@ -3119,7 +3290,9 @@ static int evergreen_startup(struct radeon_device *rdev)
}
evergreen_irq_set(rdev);
@@ -73649,7 +73548,7 @@
if (r)
return r;
r = evergreen_cp_load_microcode(rdev);
-@@ -3128,6 +3302,23 @@ static int evergreen_startup(struct radeon_device *rdev)
+@@ -3129,6 +3302,23 @@ static int evergreen_startup(struct radeon_device *rdev)
if (r)
return r;
@@ -73673,7 +73572,7 @@
return 0;
}
-@@ -3147,15 +3338,11 @@ int evergreen_resume(struct radeon_device *rdev)
+@@ -3148,15 +3338,11 @@ int evergreen_resume(struct radeon_device *rdev)
/* post card */
atom_asic_init(rdev->mode_info.atom_context);
@@ -73691,7 +73590,7 @@
return r;
}
-@@ -3165,13 +3352,17 @@ int evergreen_resume(struct radeon_device *rdev)
+@@ -3166,13 +3352,17 @@ int evergreen_resume(struct radeon_device *rdev)
int evergreen_suspend(struct radeon_device *rdev)
{
@@ -73711,7 +73610,7 @@
return 0;
}
-@@ -3242,8 +3433,8 @@ int evergreen_init(struct radeon_device *rdev)
+@@ -3243,8 +3433,8 @@ int evergreen_init(struct radeon_device *rdev)
if (r)
return r;
@@ -73722,7 +73621,7 @@
rdev->ih.ring_obj = NULL;
r600_ih_ring_init(rdev, 64 * 1024);
-@@ -3252,29 +3443,24 @@ int evergreen_init(struct radeon_device *rdev)
+@@ -3253,29 +3443,24 @@ int evergreen_init(struct radeon_device *rdev)
if (r)
return r;
@@ -73759,7 +73658,7 @@
/* Don't start up if the MC ucode is missing on BTC parts.
* The default clocks and voltages before the MC ucode
-@@ -3292,15 +3478,17 @@ int evergreen_init(struct radeon_device *rdev)
+@@ -3293,15 +3478,17 @@ int evergreen_init(struct radeon_device *rdev)
void evergreen_fini(struct radeon_device *rdev)
{
@@ -79258,7 +79157,7 @@
if (r) {
/* Somethings want wront with the accel init stop accel */
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index f7e3cc0..1555cd6 100644
+index ab46a99..1555cd6 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -49,6 +49,7 @@
@@ -79900,7 +79799,15 @@
DRM_DEBUG("r600_irq_set: sw int\n");
cp_int_cntl |= RB_INT_ENABLE;
cp_int_cntl |= TIME_STAMP_INT_ENABLE;
-@@ -3465,11 +3493,11 @@ restart_ih:
+@@ -3280,7 +3308,6 @@ static u32 r600_get_ih_wptr(struct radeon_device *rdev)
+ tmp = RREG32(IH_RB_CNTL);
+ tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ WREG32(IH_RB_CNTL, tmp);
+- wptr &= ~RB_OVERFLOW;
+ }
+ return (wptr & rdev->ih.ptr_mask);
+ }
+@@ -3466,11 +3493,11 @@ restart_ih:
case 177: /* CP_INT in IB1 */
case 178: /* CP_INT in IB2 */
DRM_DEBUG("IH: CP int: 0x%08x\n", src_data);
@@ -79914,7 +79821,7 @@
break;
case 233: /* GUI IDLE */
DRM_DEBUG("IH: GUI idle\n");
-@@ -3502,30 +3530,6 @@ restart_ih:
+@@ -3503,30 +3530,6 @@ restart_ih:
*/
#if defined(CONFIG_DEBUG_FS)
@@ -79945,7 +79852,7 @@
static int r600_debugfs_mc_info(struct seq_file *m, void *data)
{
struct drm_info_node *node = (struct drm_info_node *) m->private;
-@@ -3539,7 +3543,6 @@ static int r600_debugfs_mc_info(struct seq_file *m, void *data)
+@@ -3540,7 +3543,6 @@ static int r600_debugfs_mc_info(struct seq_file *m, void *data)
static struct drm_info_list r600_mc_info_list[] = {
{"r600_mc_info", r600_debugfs_mc_info, 0, NULL},
@@ -85425,7 +85332,7 @@
#endif
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
-index e4e455e..6d0c32b 100644
+index 6d9c32b..6d0c32b 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -56,6 +56,10 @@ extern void
@@ -85450,6 +85357,24 @@
reg = EVERGREEN_DC_GPIO_HPD_A;
else
reg = AVIVO_DC_GPIO_HPD_A;
+@@ -1873,7 +1879,7 @@ static const char *thermal_controller_names[] = {
+ "adm1032",
+ "adm1030",
+ "max6649",
+- "lm63", /* lm64 */
++ "lm64",
+ "f75375",
+ "asc7xxx",
+ };
+@@ -1884,7 +1890,7 @@ static const char *pp_lib_thermal_controller_names[] = {
+ "adm1032",
+ "adm1030",
+ "max6649",
+- "lm63", /* lm64 */
++ "lm64",
+ "f75375",
+ "RV6xx",
+ "RV770",
@@ -1895,6 +1901,8 @@ static const char *pp_lib_thermal_controller_names[] = {
"emc2103",
"Sumo",
@@ -86004,7 +85929,7 @@
break;
default:
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
-index b101843..1334dbd 100644
+index 683cede..9184bbe 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -846,6 +846,27 @@ static int radeon_dvi_get_modes(struct drm_connector *connector)
@@ -86827,7 +86752,7 @@
}
#endif
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
-index 3291ab8..60404f4 100644
+index ad5d774..adc9bfd 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -303,8 +303,17 @@ void radeon_crtc_handle_flip(struct radeon_device *rdev, int crtc_id)
@@ -86887,7 +86812,7 @@
};
static const char *connector_names[15] = {
-@@ -1084,29 +1096,36 @@ static const struct drm_framebuffer_funcs radeon_fb_funcs = {
+@@ -1089,29 +1101,36 @@ static const struct drm_framebuffer_funcs radeon_fb_funcs = {
.create_handle = radeon_user_framebuffer_create_handle,
};
@@ -86930,7 +86855,7 @@
return ERR_PTR(-ENOENT);
}
-@@ -1116,7 +1135,12 @@ radeon_user_framebuffer_create(struct drm_device *dev,
+@@ -1121,7 +1140,12 @@ radeon_user_framebuffer_create(struct drm_device *dev,
return ERR_PTR(-ENOMEM);
}
@@ -86944,7 +86869,7 @@
return &radeon_fb->base;
}
-@@ -1132,11 +1156,6 @@ static const struct drm_mode_config_funcs radeon_mode_funcs = {
+@@ -1137,11 +1161,6 @@ static const struct drm_mode_config_funcs radeon_mode_funcs = {
.output_poll_changed = radeon_output_poll_changed
};
@@ -86956,7 +86881,7 @@
static struct drm_prop_enum_list radeon_tmds_pll_enum_list[] =
{ { 0, "driver" },
{ 1, "bios" },
-@@ -1161,86 +1180,53 @@ static struct drm_prop_enum_list radeon_underscan_enum_list[] =
+@@ -1166,86 +1185,53 @@ static struct drm_prop_enum_list radeon_underscan_enum_list[] =
static int radeon_modeset_create_props(struct radeon_device *rdev)
{
@@ -87059,7 +86984,7 @@
return 0;
}
-@@ -1286,6 +1272,9 @@ int radeon_modeset_init(struct radeon_device *rdev)
+@@ -1291,6 +1277,9 @@ int radeon_modeset_init(struct radeon_device *rdev)
rdev->ddev->mode_config.max_height = 4096;
}
@@ -87069,7 +86994,7 @@
rdev->ddev->mode_config.fb_base = rdev->mc.aper_base;
ret = radeon_modeset_create_props(rdev);
-@@ -1313,9 +1302,11 @@ int radeon_modeset_init(struct radeon_device *rdev)
+@@ -1318,9 +1307,11 @@ int radeon_modeset_init(struct radeon_device *rdev)
return ret;
}
@@ -91633,7 +91558,7 @@
if (r) {
/* Somethings want wront with the accel init stop accel */
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index cea482a..5248001 100644
+index dc00155..739eb0d 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -46,6 +46,25 @@
@@ -91698,7 +91623,23 @@
/* reset GA+VAP */
WREG32(R_0000F0_RBBM_SOFT_RESET, S_0000F0_SOFT_RESET_VAP(1) |
S_0000F0_SOFT_RESET_GA(1));
-@@ -549,7 +559,7 @@ int rs600_irq_set(struct radeon_device *rdev)
+@@ -529,11 +539,10 @@ int rs600_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
+ return -EINVAL;
+ }
+ addr = addr & 0xFFFFFFFFFFFFF000ULL;
+- if (addr == rdev->dummy_page.addr)
+- addr |= R600_PTE_SYSTEM | R600_PTE_SNOOPED;
+- else
+- addr |= (R600_PTE_VALID | R600_PTE_SYSTEM | R600_PTE_SNOOPED |
+- R600_PTE_READABLE | R600_PTE_WRITEABLE);
++ if (addr != rdev->dummy_page.addr)
++ addr |= R600_PTE_VALID | R600_PTE_READABLE |
++ R600_PTE_WRITEABLE;
++ addr |= R600_PTE_SYSTEM | R600_PTE_SNOOPED;
+ writeq(addr, ptr + (i * 8));
+ return 0;
+ }
+@@ -552,7 +561,7 @@ int rs600_irq_set(struct radeon_device *rdev)
WREG32(R_000040_GEN_INT_CNTL, 0);
return -EINVAL;
}
@@ -91707,7 +91648,7 @@
tmp |= S_000040_SW_INT_EN(1);
}
if (rdev->irq.gui_idle) {
-@@ -642,7 +652,7 @@ int rs600_irq_process(struct radeon_device *rdev)
+@@ -645,7 +654,7 @@ int rs600_irq_process(struct radeon_device *rdev)
while (status || rdev->irq.stat_regs.r500.disp_int) {
/* SW interrupt */
if (G_000044_SW_INT(status)) {
@@ -91716,7 +91657,7 @@
}
/* GUI idle */
if (G_000040_GUI_IDLE(status)) {
-@@ -847,6 +857,12 @@ static int rs600_startup(struct radeon_device *rdev)
+@@ -850,6 +859,12 @@ static int rs600_startup(struct radeon_device *rdev)
if (r)
return r;
@@ -91729,7 +91670,7 @@
/* Enable IRQ */
if (!rdev->irq.installed) {
r = radeon_irq_kms_init(rdev);
-@@ -862,15 +878,21 @@ static int rs600_startup(struct radeon_device *rdev)
+@@ -865,15 +880,21 @@ static int rs600_startup(struct radeon_device *rdev)
dev_err(rdev->dev, "failed initializing CP (%d).\n", r);
return r;
}
@@ -91755,7 +91696,7 @@
return r;
}
-@@ -879,6 +901,8 @@ static int rs600_startup(struct radeon_device *rdev)
+@@ -882,6 +903,8 @@ static int rs600_startup(struct radeon_device *rdev)
int rs600_resume(struct radeon_device *rdev)
{
@@ -91764,7 +91705,7 @@
/* Make sur GART are not working */
rs600_gart_disable(rdev);
/* Resume clock before doing reset */
-@@ -895,11 +919,18 @@ int rs600_resume(struct radeon_device *rdev)
+@@ -898,11 +921,18 @@ int rs600_resume(struct radeon_device *rdev)
rv515_clock_startup(rdev);
/* Initialize surface registers */
radeon_surface_init(rdev);
@@ -91784,7 +91725,7 @@
r600_audio_fini(rdev);
r100_cp_disable(rdev);
radeon_wb_disable(rdev);
-@@ -977,7 +1008,14 @@ int rs600_init(struct radeon_device *rdev)
+@@ -980,7 +1010,14 @@ int rs600_init(struct radeon_device *rdev)
if (r)
return r;
rs600_set_safe_registers(rdev);
@@ -99055,7 +98996,7 @@
return NULL;
}
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
-index 9e4313e..578207e 100644
+index 508c64c..578207e 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -30,6 +30,9 @@
@@ -99110,7 +99051,38 @@
return 0;
}
-@@ -438,16 +434,12 @@ static int ttm_set_pages_caching(struct page **pages,
+@@ -398,18 +394,13 @@ static int ttm_pool_get_num_unused_pages(void)
+ static int ttm_pool_mm_shrink(struct shrinker *shrink,
+ struct shrink_control *sc)
+ {
+- static DEFINE_MUTEX(lock);
+- static unsigned start_pool;
++ static atomic_t start_pool = ATOMIC_INIT(0);
+ unsigned i;
+- unsigned pool_offset;
++ unsigned pool_offset = atomic_add_return(1, &start_pool);
+ struct ttm_page_pool *pool;
+ int shrink_pages = sc->nr_to_scan;
+
+- if (shrink_pages == 0)
+- goto out;
+- if (!mutex_trylock(&lock))
+- return -1;
+- pool_offset = ++start_pool % NUM_POOLS;
++ pool_offset = pool_offset % NUM_POOLS;
+ /* select start pool in round robin fashion */
+ for (i = 0; i < NUM_POOLS; ++i) {
+ unsigned nr_free = shrink_pages;
+@@ -418,8 +409,6 @@ static int ttm_pool_mm_shrink(struct shrinker *shrink,
+ pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+ shrink_pages = ttm_page_pool_free(pool, nr_free);
+ }
+- mutex_unlock(&lock);
+-out:
+ /* return estimated number of unused pages in pool */
+ return ttm_pool_get_num_unused_pages();
+ }
+@@ -445,16 +434,12 @@ static int ttm_set_pages_caching(struct page **pages,
case tt_uncached:
r = set_pages_array_uc(pages, cpages);
if (r)
@@ -99129,7 +99101,7 @@
break;
default:
break;
-@@ -492,8 +484,7 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
+@@ -499,8 +484,7 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
caching_array = kmalloc(max_cpages*sizeof(struct page *), GFP_KERNEL);
if (!caching_array) {
@@ -99139,7 +99111,7 @@
return -ENOMEM;
}
-@@ -501,7 +492,7 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
+@@ -508,7 +492,7 @@ static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
p = alloc_page(gfp_flags);
if (!p) {
@@ -99148,7 +99120,7 @@
/* store already allocated pages in the pool after
* setting the caching state */
-@@ -599,8 +590,7 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
+@@ -606,8 +590,7 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
++pool->nrefills;
pool->npages += alloc_size;
} else {
@@ -99158,7 +99130,7 @@
/* If we have any pages left put them to the pool. */
list_for_each_entry(p, &pool->list, lru) {
++cpages;
-@@ -619,8 +609,10 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
+@@ -626,8 +609,10 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool,
* @return count of pages still required to fulfill the request.
*/
static unsigned ttm_page_pool_get_pages(struct ttm_page_pool *pool,
@@ -99171,7 +99143,7 @@
{
unsigned long irq_flags;
struct list_head *p;
-@@ -660,17 +652,63 @@ out:
+@@ -667,17 +652,63 @@ out:
return count;
}
@@ -99238,7 +99210,7 @@
int r;
/* set zero flag for page allocation if required */
-@@ -684,30 +722,33 @@ int ttm_get_pages(struct list_head *pages, int flags,
+@@ -691,30 +722,33 @@ int ttm_get_pages(struct list_head *pages, int flags,
else
gfp_flags |= GFP_HIGHUSER;
@@ -99279,7 +99251,7 @@
if (PageHighMem(p))
clear_highpage(p);
else
-@@ -716,67 +757,27 @@ int ttm_get_pages(struct list_head *pages, int flags,
+@@ -723,67 +757,27 @@ int ttm_get_pages(struct list_head *pages, int flags,
}
/* If pool didn't have enough pages allocate new one. */
@@ -99355,7 +99327,7 @@
static void ttm_page_pool_init_locked(struct ttm_page_pool *pool, int flags,
char *name)
{
-@@ -794,7 +795,7 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
+@@ -801,7 +795,7 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
WARN_ON(_manager);
@@ -99364,7 +99336,7 @@
_manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
-@@ -829,7 +830,7 @@ void ttm_page_alloc_fini(void)
+@@ -836,7 +830,7 @@ void ttm_page_alloc_fini(void)
{
int i;
@@ -99373,7 +99345,7 @@
ttm_pool_mm_shrink_fini(_manager);
for (i = 0; i < NUM_POOLS; ++i)
-@@ -839,6 +840,62 @@ void ttm_page_alloc_fini(void)
+@@ -846,6 +840,62 @@ void ttm_page_alloc_fini(void)
_manager = NULL;
}
@@ -104327,10 +104299,10 @@
if (unlikely(ret != 0))
goto out_unlock;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
-index 907c26f..6651cb3 100644
+index 7f16ff2..7fc3dc7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
-@@ -417,10 +417,6 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
+@@ -416,10 +416,6 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
unsigned fb_bpp, fb_depth, fb_offset, fb_pitch, fb_size;
int ret;
@@ -104341,7 +104313,7 @@
fb_bpp = 32;
fb_depth = 24;
-@@ -428,8 +424,8 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
+@@ -427,8 +423,8 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
fb_width = min(vmw_priv->fb_max_width, (unsigned)2048);
fb_height = min(vmw_priv->fb_max_height, (unsigned)2048);
@@ -104352,7 +104324,7 @@
fb_pitch = fb_width * fb_bpp / 8;
fb_size = fb_pitch * fb_height;
-@@ -518,19 +514,7 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
+@@ -517,19 +513,7 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
info->var.xres = initial_width;
info->var.yres = initial_height;
Modified: dists/wheezy-security/linux/debian/patches/features/all/igb/0008-igb-add-basic-runtime-PM-support.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/all/igb/0008-igb-add-basic-runtime-PM-support.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/all/igb/0008-igb-add-basic-runtime-PM-support.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -18,13 +18,13 @@
Tested-by: Aaron Brown <aaron.f.brown at intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
Signed-off-by: David S. Miller <davem at davemloft.net>
+[bwh: Adjust to apply after backported commit 76252723e886
+ 'igb: do a reset on SR-IOV re-init if device is down']
---
drivers/net/ethernet/intel/igb/igb_ethtool.c | 16 ++++
drivers/net/ethernet/intel/igb/igb_main.c | 136 +++++++++++++++++++++++----
2 files changed, 133 insertions(+), 19 deletions(-)
-diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
-index 40110c5..75a560c 100644
--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
+++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
@@ -36,6 +36,7 @@
@@ -35,7 +35,7 @@
#include "igb.h"
-@@ -2168,6 +2169,19 @@ static void igb_get_strings(struct net_device *netdev, u32 stringset, u8 *data)
+@@ -2168,6 +2169,19 @@ static void igb_get_strings(struct net_d
}
}
@@ -55,7 +55,7 @@
static const struct ethtool_ops igb_ethtool_ops = {
.get_settings = igb_get_settings,
.set_settings = igb_set_settings,
-@@ -2194,6 +2208,8 @@ static const struct ethtool_ops igb_ethtool_ops = {
+@@ -2194,6 +2208,8 @@ static const struct ethtool_ops igb_etht
.get_ethtool_stats = igb_get_ethtool_stats,
.get_coalesce = igb_get_coalesce,
.set_coalesce = igb_set_coalesce,
@@ -64,8 +64,6 @@
};
void igb_set_ethtool_ops(struct net_device *netdev)
-diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
-index 2706d41..4527f7f 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -53,6 +53,7 @@
@@ -76,7 +74,7 @@
#ifdef CONFIG_IGB_DCA
#include <linux/dca.h>
#endif
-@@ -172,8 +173,18 @@ static int igb_check_vf_assignment(struct igb_adapter *adapter);
+@@ -172,8 +173,18 @@ static int igb_check_vf_assignment(struc
#endif
#ifdef CONFIG_PM
@@ -108,7 +106,7 @@
#endif
.shutdown = igb_shutdown,
.err_handler = &igb_err_handler
-@@ -2121,6 +2130,8 @@ static int __devinit igb_probe(struct pci_dev *pdev,
+@@ -2121,6 +2130,8 @@ static int __devinit igb_probe(struct pc
default:
break;
}
@@ -117,7 +115,7 @@
return 0;
err_register:
-@@ -2160,6 +2171,8 @@ static void __devexit igb_remove(struct pci_dev *pdev)
+@@ -2160,6 +2171,8 @@ static void __devexit igb_remove(struct
struct igb_adapter *adapter = netdev_priv(netdev);
struct e1000_hw *hw = &adapter->hw;
@@ -126,7 +124,7 @@
/*
* The watchdog timer may be rescheduled, so explicitly
* disable watchdog from being rescheduled.
-@@ -2482,16 +2495,22 @@ static int __devinit igb_sw_init(struct igb_adapter *adapter)
+@@ -2482,16 +2495,22 @@ static int __devinit igb_sw_init(struct
* handler is registered with the OS, the watchdog timer is started,
* and the stack is notified that the interface is ready.
**/
@@ -151,7 +149,7 @@
netif_carrier_off(netdev);
-@@ -2537,6 +2556,9 @@ static int igb_open(struct net_device *netdev)
+@@ -2537,6 +2556,9 @@ static int igb_open(struct net_device *n
netif_tx_start_all_queues(netdev);
@@ -214,7 +212,7 @@
/**
* igb_setup_tx_resources - allocate Tx resources (Descriptors)
* @tx_ring: tx descriptor ring (for a specific queue) to setup
-@@ -3642,6 +3682,9 @@ static void igb_watchdog_task(struct work_struct *work)
+@@ -3642,6 +3682,9 @@ static void igb_watchdog_task(struct wor
link = igb_has_link(adapter);
if (link) {
@@ -224,7 +222,7 @@
if (!netif_carrier_ok(netdev)) {
u32 ctrl;
hw->mac.ops.get_speed_and_duplex(hw,
-@@ -3713,6 +3756,9 @@ static void igb_watchdog_task(struct work_struct *work)
+@@ -3713,6 +3756,9 @@ static void igb_watchdog_task(struct wor
if (!test_bit(__IGB_DOWN, &adapter->state))
mod_timer(&adapter->phy_info_timer,
round_jiffies(jiffies + 2 * HZ));
@@ -251,16 +249,16 @@
#ifdef CONFIG_PM
int retval = 0;
#endif
-@@ -6612,7 +6659,7 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake)
+@@ -6612,7 +6659,7 @@ static int __igb_shutdown(struct pci_dev
netif_device_detach(netdev);
if (netif_running(netdev))
- igb_close(netdev);
+ __igb_close(netdev, true);
+ else
+ igb_reset(adapter);
- igb_clear_interrupt_scheme(adapter);
-
-@@ -6671,12 +6718,13 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake)
+@@ -6673,12 +6720,13 @@ static int __igb_shutdown(struct pci_dev
}
#ifdef CONFIG_PM
@@ -276,7 +274,7 @@
if (retval)
return retval;
-@@ -6690,8 +6738,9 @@ static int igb_suspend(struct pci_dev *pdev, pm_message_t state)
+@@ -6692,8 +6740,9 @@ static int igb_suspend(struct pci_dev *p
return 0;
}
@@ -287,7 +285,7 @@
struct net_device *netdev = pci_get_drvdata(pdev);
struct igb_adapter *adapter = netdev_priv(netdev);
struct e1000_hw *hw = &adapter->hw;
-@@ -6712,7 +6761,18 @@ static int igb_resume(struct pci_dev *pdev)
+@@ -6714,7 +6763,18 @@ static int igb_resume(struct pci_dev *pd
pci_enable_wake(pdev, PCI_D3hot, 0);
pci_enable_wake(pdev, PCI_D3cold, 0);
@@ -307,7 +305,7 @@
dev_err(&pdev->dev, "Unable to allocate memory for queues\n");
return -ENOMEM;
}
-@@ -6725,23 +6785,61 @@ static int igb_resume(struct pci_dev *pdev)
+@@ -6727,23 +6787,61 @@ static int igb_resume(struct pci_dev *pd
wr32(E1000_WUS, ~0);
Modified: dists/wheezy-security/linux/debian/patches/features/all/rt/0180-mutex-no-spin-on-rt.patch.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/all/rt/0180-mutex-no-spin-on-rt.patch.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/all/rt/0180-mutex-no-spin-on-rt.patch.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -4,17 +4,17 @@
Origin: https://git.kernel.org/cgit/linux/kernel/git/rt/linux-stable-rt.git/commit?id=6f372b425516d80347ddb16c9d0c99de748cd4bc
Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
+[bwh: Adjust to apply after backported commit 4badad352a6b
+ 'locking/mutex: Disable optimistic spinning on some architectures']
---
kernel/Kconfig.locks | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/kernel/Kconfig.locks b/kernel/Kconfig.locks
-index 5068e2a..7bd0598 100644
--- a/kernel/Kconfig.locks
+++ b/kernel/Kconfig.locks
-@@ -199,4 +199,4 @@ config INLINE_WRITE_UNLOCK_IRQRESTORE
- def_bool !DEBUG_SPINLOCK && ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
+@@ -203,4 +203,4 @@ config ARCH_SUPPORTS_ATOMIC_RMW
config MUTEX_SPIN_ON_OWNER
-- def_bool SMP && !DEBUG_MUTEXES
-+ def_bool SMP && !DEBUG_MUTEXES && !PREEMPT_RT_FULL
+ def_bool y
+- depends on SMP && !DEBUG_MUTEXES && ARCH_SUPPORTS_ATOMIC_RMW
++ depends on SMP && !DEBUG_MUTEXES && ARCH_SUPPORTS_ATOMIC_RMW && !PREEMPT_RT_FULL
Modified: dists/wheezy-security/linux/debian/patches/features/all/rt/0278-random-Make-it-work-on-rt.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/all/rt/0278-random-Make-it-work-on-rt.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/all/rt/0278-random-Make-it-work-on-rt.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -11,6 +11,7 @@
Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
Cc: stable-rt at vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
+[bwh: Adjust context after 3.2.61]
---
drivers/char/random.c | 10 ++++++----
include/linux/irqdesc.h | 1 +
@@ -19,8 +20,6 @@
kernel/irq/manage.c | 6 ++++++
5 files changed, 19 insertions(+), 7 deletions(-)
-diff --git a/drivers/char/random.c b/drivers/char/random.c
-index 94f53fe..fab8f25 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -767,18 +767,16 @@ EXPORT_SYMBOL_GPL(add_input_randomness);
@@ -44,7 +43,7 @@
input[2] = ip;
input[3] = ip >> 32;
}
-@@ -792,7 +790,11 @@ void add_interrupt_randomness(int irq, int irq_flags)
+@@ -792,7 +790,11 @@ void add_interrupt_randomness(int irq, i
fast_pool->last = now;
r = nonblocking_pool.initialized ? &input_pool : &nonblocking_pool;
@@ -56,11 +55,9 @@
/*
* If we don't have a valid cycle counter, and we see
* back-to-back timer interrupts, then skip giving credit for
-diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
-index f1e2527..5f4f091 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
-@@ -53,6 +53,7 @@ struct irq_desc {
+@@ -55,6 +55,7 @@ struct irq_desc {
unsigned int irq_count; /* For detecting broken IRQs */
unsigned long last_unhandled; /* Aging timer for unhandled count */
unsigned int irqs_unhandled;
@@ -68,11 +65,9 @@
raw_spinlock_t lock;
struct cpumask *percpu_enabled;
#ifdef CONFIG_SMP
-diff --git a/include/linux/random.h b/include/linux/random.h
-index f5e1311..1622993 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
-@@ -53,7 +53,7 @@ extern void rand_initialize_irq(int irq);
+@@ -53,7 +53,7 @@ extern void rand_initialize_irq(int irq)
extern void add_device_randomness(const void *, unsigned int);
extern void add_input_randomness(unsigned int type, unsigned int code,
unsigned int value);
@@ -81,11 +76,9 @@
extern void get_random_bytes(void *buf, int nbytes);
extern void get_random_bytes_arch(void *buf, int nbytes);
-diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
-index a768885..f6b91bc 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
-@@ -116,6 +116,8 @@ static void irq_wake_thread(struct irq_desc *desc, struct irqaction *action)
+@@ -116,6 +116,8 @@ static void irq_wake_thread(struct irq_d
irqreturn_t
handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action)
{
@@ -94,7 +87,7 @@
irqreturn_t retval = IRQ_NONE;
unsigned int flags = 0, irq = desc->irq_data.irq;
-@@ -157,8 +159,9 @@ handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action)
+@@ -157,8 +159,9 @@ handle_irq_event_percpu(struct irq_desc
} while (action);
#ifndef CONFIG_PREEMPT_RT_FULL
@@ -106,14 +99,12 @@
#endif
if (!noirqdebug)
-diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
-index 1ec20f5..8178df7 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -825,6 +825,12 @@ static int irq_thread(void *data)
action_ret = handler_fn(desc, action);
- if (!noirqdebug)
- note_interrupt(action->irq, desc, action_ret);
+ if (action_ret == IRQ_HANDLED)
+ atomic_inc(&desc->threads_handled);
+#ifdef CONFIG_PREEMPT_RT_FULL
+ migrate_disable();
+ add_interrupt_randomness(action->irq, 0,
Copied: dists/wheezy-security/linux/debian/patches/features/all/rt/revert-rtmutex-changes-in-3.2.61.patch (from r21920, dists/wheezy/linux/debian/patches/features/all/rt/revert-rtmutex-changes-in-3.2.61.patch)
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ dists/wheezy-security/linux/debian/patches/features/all/rt/revert-rtmutex-changes-in-3.2.61.patch Sat Oct 25 23:26:41 2014 (r21972, copy of r21920, dists/wheezy/linux/debian/patches/features/all/rt/revert-rtmutex-changes-in-3.2.61.patch)
@@ -0,0 +1,473 @@
+From: Ben Hutchings <ben at decadent.org.uk>
+Date: Mon, 07 Jul 2014 01:18:47 +0100
+Subject: Revert rtmutex changes in 3.2.61
+
+These conflict with the rt changes and need to be resolved by an
+expert.
+
+diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
+index 1928f3d..f9d8482 100644
+--- a/kernel/rtmutex.c
++++ b/kernel/rtmutex.c
+@@ -81,47 +81,6 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
+ owner = *p;
+ } while (cmpxchg(p, owner, owner | RT_MUTEX_HAS_WAITERS) != owner);
+ }
+-
+-/*
+- * Safe fastpath aware unlock:
+- * 1) Clear the waiters bit
+- * 2) Drop lock->wait_lock
+- * 3) Try to unlock the lock with cmpxchg
+- */
+-static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock)
+- __releases(lock->wait_lock)
+-{
+- struct task_struct *owner = rt_mutex_owner(lock);
+-
+- clear_rt_mutex_waiters(lock);
+- raw_spin_unlock(&lock->wait_lock);
+- /*
+- * If a new waiter comes in between the unlock and the cmpxchg
+- * we have two situations:
+- *
+- * unlock(wait_lock);
+- * lock(wait_lock);
+- * cmpxchg(p, owner, 0) == owner
+- * mark_rt_mutex_waiters(lock);
+- * acquire(lock);
+- * or:
+- *
+- * unlock(wait_lock);
+- * lock(wait_lock);
+- * mark_rt_mutex_waiters(lock);
+- *
+- * cmpxchg(p, owner, 0) != owner
+- * enqueue_waiter();
+- * unlock(wait_lock);
+- * lock(wait_lock);
+- * wake waiter();
+- * unlock(wait_lock);
+- * lock(wait_lock);
+- * acquire(lock);
+- */
+- return rt_mutex_cmpxchg(lock, owner, NULL);
+-}
+-
+ #else
+ # define rt_mutex_cmpxchg(l,c,n) (0)
+ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
+@@ -129,17 +88,6 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
+ lock->owner = (struct task_struct *)
+ ((unsigned long)lock->owner | RT_MUTEX_HAS_WAITERS);
+ }
+-
+-/*
+- * Simple slow path only version: lock->owner is protected by lock->wait_lock.
+- */
+-static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock)
+- __releases(lock->wait_lock)
+-{
+- lock->owner = NULL;
+- raw_spin_unlock(&lock->wait_lock);
+- return true;
+-}
+ #endif
+
+ /*
+@@ -193,36 +141,14 @@ static void rt_mutex_adjust_prio(struct task_struct *task)
+ */
+ int max_lock_depth = 1024;
+
+-static inline struct rt_mutex *task_blocked_on_lock(struct task_struct *p)
+-{
+- return p->pi_blocked_on ? p->pi_blocked_on->lock : NULL;
+-}
+-
+ /*
+ * Adjust the priority chain. Also used for deadlock detection.
+ * Decreases task's usage by one - may thus free the task.
+- *
+- * @task: the task owning the mutex (owner) for which a chain walk is
+- * probably needed
+- * @deadlock_detect: do we have to carry out deadlock detection?
+- * @orig_lock: the mutex (can be NULL if we are walking the chain to recheck
+- * things for a task that has just got its priority adjusted, and
+- * is waiting on a mutex)
+- * @next_lock: the mutex on which the owner of @orig_lock was blocked before
+- * we dropped its pi_lock. Is never dereferenced, only used for
+- * comparison to detect lock chain changes.
+- * @orig_waiter: rt_mutex_waiter struct for the task that has just donated
+- * its priority to the mutex owner (can be NULL in the case
+- * depicted above or if the top waiter is gone away and we are
+- * actually deboosting the owner)
+- * @top_task: the current top waiter
+- *
+ * Returns 0 or -EDEADLK.
+ */
+ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ int deadlock_detect,
+ struct rt_mutex *orig_lock,
+- struct rt_mutex *next_lock,
+ struct rt_mutex_waiter *orig_waiter,
+ struct task_struct *top_task)
+ {
+@@ -256,7 +182,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ }
+ put_task_struct(task);
+
+- return -EDEADLK;
++ return deadlock_detect ? -EDEADLK : 0;
+ }
+ retry:
+ /*
+@@ -281,32 +207,13 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ goto out_unlock_pi;
+
+ /*
+- * We dropped all locks after taking a refcount on @task, so
+- * the task might have moved on in the lock chain or even left
+- * the chain completely and blocks now on an unrelated lock or
+- * on @orig_lock.
+- *
+- * We stored the lock on which @task was blocked in @next_lock,
+- * so we can detect the chain change.
+- */
+- if (next_lock != waiter->lock)
+- goto out_unlock_pi;
+-
+- /*
+ * Drop out, when the task has no waiters. Note,
+ * top_waiter can be NULL, when we are in the deboosting
+ * mode!
+ */
+- if (top_waiter) {
+- if (!task_has_pi_waiters(task))
+- goto out_unlock_pi;
+- /*
+- * If deadlock detection is off, we stop here if we
+- * are not the top pi waiter of the task.
+- */
+- if (!detect_deadlock && top_waiter != task_top_pi_waiter(task))
+- goto out_unlock_pi;
+- }
++ if (top_waiter && (!task_has_pi_waiters(task) ||
++ top_waiter != task_top_pi_waiter(task)))
++ goto out_unlock_pi;
+
+ /*
+ * When deadlock detection is off then we check, if further
+@@ -322,16 +229,11 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ goto retry;
+ }
+
+- /*
+- * Deadlock detection. If the lock is the same as the original
+- * lock which caused us to walk the lock chain or if the
+- * current lock is owned by the task which initiated the chain
+- * walk, we detected a deadlock.
+- */
++ /* Deadlock detection */
+ if (lock == orig_lock || rt_mutex_owner(lock) == top_task) {
+ debug_rt_mutex_deadlock(deadlock_detect, orig_waiter, lock);
+ raw_spin_unlock(&lock->wait_lock);
+- ret = -EDEADLK;
++ ret = deadlock_detect ? -EDEADLK : 0;
+ goto out_unlock_pi;
+ }
+
+@@ -378,26 +280,11 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ __rt_mutex_adjust_prio(task);
+ }
+
+- /*
+- * Check whether the task which owns the current lock is pi
+- * blocked itself. If yes we store a pointer to the lock for
+- * the lock chain change detection above. After we dropped
+- * task->pi_lock next_lock cannot be dereferenced anymore.
+- */
+- next_lock = task_blocked_on_lock(task);
+-
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+
+ top_waiter = rt_mutex_top_waiter(lock);
+ raw_spin_unlock(&lock->wait_lock);
+
+- /*
+- * We reached the end of the lock chain. Stop right here. No
+- * point to go back just to figure that out.
+- */
+- if (!next_lock)
+- goto out_put_task;
+-
+ if (!detect_deadlock && waiter != top_waiter)
+ goto out_put_task;
+
+@@ -508,21 +395,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ {
+ struct task_struct *owner = rt_mutex_owner(lock);
+ struct rt_mutex_waiter *top_waiter = waiter;
+- struct rt_mutex *next_lock;
+- int chain_walk = 0, res;
+ unsigned long flags;
+-
+- /*
+- * Early deadlock detection. We really don't want the task to
+- * enqueue on itself just to untangle the mess later. It's not
+- * only an optimization. We drop the locks, so another waiter
+- * can come in before the chain walk detects the deadlock. So
+- * the other will detect the deadlock and return -EDEADLOCK,
+- * which is wrong, as the other waiter is not in a deadlock
+- * situation.
+- */
+- if (owner == task)
+- return -EDEADLK;
++ int chain_walk = 0, res;
+
+ raw_spin_lock_irqsave(&task->pi_lock, flags);
+ __rt_mutex_adjust_prio(task);
+@@ -543,28 +417,20 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ if (!owner)
+ return 0;
+
+- raw_spin_lock_irqsave(&owner->pi_lock, flags);
+ if (waiter == rt_mutex_top_waiter(lock)) {
++ raw_spin_lock_irqsave(&owner->pi_lock, flags);
+ plist_del(&top_waiter->pi_list_entry, &owner->pi_waiters);
+ plist_add(&waiter->pi_list_entry, &owner->pi_waiters);
+
+ __rt_mutex_adjust_prio(owner);
+ if (owner->pi_blocked_on)
+ chain_walk = 1;
+- } else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock)) {
+- chain_walk = 1;
++ raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+ }
++ else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock))
++ chain_walk = 1;
+
+- /* Store the lock on which owner is blocked or NULL */
+- next_lock = task_blocked_on_lock(owner);
+-
+- raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+- /*
+- * Even if full deadlock detection is on, if the owner is not
+- * blocked itself, we can avoid finding this out in the chain
+- * walk.
+- */
+- if (!chain_walk || !next_lock)
++ if (!chain_walk)
+ return 0;
+
+ /*
+@@ -576,8 +442,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+
+ raw_spin_unlock(&lock->wait_lock);
+
+- res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock,
+- next_lock, waiter, task);
++ res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock, waiter,
++ task);
+
+ raw_spin_lock(&lock->wait_lock);
+
+@@ -587,8 +453,7 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ /*
+ * Wake up the next waiter on the lock.
+ *
+- * Remove the top waiter from the current tasks pi waiter list and
+- * wake it up.
++ * Remove the top waiter from the current tasks waiter list and wake it up.
+ *
+ * Called with lock->wait_lock held.
+ */
+@@ -609,23 +474,10 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
+ */
+ plist_del(&waiter->pi_list_entry, ¤t->pi_waiters);
+
+- /*
+- * As we are waking up the top waiter, and the waiter stays
+- * queued on the lock until it gets the lock, this lock
+- * obviously has waiters. Just set the bit here and this has
+- * the added benefit of forcing all new tasks into the
+- * slow path making sure no task of lower priority than
+- * the top waiter can steal this lock.
+- */
+- lock->owner = (void *) RT_MUTEX_HAS_WAITERS;
++ rt_mutex_set_owner(lock, NULL);
+
+ raw_spin_unlock_irqrestore(¤t->pi_lock, flags);
+
+- /*
+- * It's safe to dereference waiter as it cannot go away as
+- * long as we hold lock->wait_lock. The waiter task needs to
+- * acquire it in order to dequeue the waiter.
+- */
+ wake_up_process(waiter->task);
+ }
+
+@@ -640,8 +492,8 @@ static void remove_waiter(struct rt_mutex *lock,
+ {
+ int first = (waiter == rt_mutex_top_waiter(lock));
+ struct task_struct *owner = rt_mutex_owner(lock);
+- struct rt_mutex *next_lock = NULL;
+ unsigned long flags;
++ int chain_walk = 0;
+
+ raw_spin_lock_irqsave(¤t->pi_lock, flags);
+ plist_del(&waiter->list_entry, &lock->wait_list);
+@@ -665,15 +517,15 @@ static void remove_waiter(struct rt_mutex *lock,
+ }
+ __rt_mutex_adjust_prio(owner);
+
+- /* Store the lock on which owner is blocked or NULL */
+- next_lock = task_blocked_on_lock(owner);
++ if (owner->pi_blocked_on)
++ chain_walk = 1;
+
+ raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+ }
+
+ WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
+
+- if (!next_lock)
++ if (!chain_walk)
+ return;
+
+ /* gets dropped in rt_mutex_adjust_prio_chain()! */
+@@ -681,7 +533,7 @@ static void remove_waiter(struct rt_mutex *lock,
+
+ raw_spin_unlock(&lock->wait_lock);
+
+- rt_mutex_adjust_prio_chain(owner, 0, lock, next_lock, NULL, current);
++ rt_mutex_adjust_prio_chain(owner, 0, lock, NULL, current);
+
+ raw_spin_lock(&lock->wait_lock);
+ }
+@@ -694,7 +546,6 @@ static void remove_waiter(struct rt_mutex *lock,
+ void rt_mutex_adjust_pi(struct task_struct *task)
+ {
+ struct rt_mutex_waiter *waiter;
+- struct rt_mutex *next_lock;
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&task->pi_lock, flags);
+@@ -704,13 +555,12 @@ void rt_mutex_adjust_pi(struct task_struct *task)
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+ return;
+ }
+- next_lock = waiter->lock;
++
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+
+ /* gets dropped in rt_mutex_adjust_prio_chain()! */
+ get_task_struct(task);
+-
+- rt_mutex_adjust_prio_chain(task, 0, NULL, next_lock, NULL, task);
++ rt_mutex_adjust_prio_chain(task, 0, NULL, NULL, task);
+ }
+
+ /**
+@@ -770,26 +620,6 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
+ return ret;
+ }
+
+-static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
+- struct rt_mutex_waiter *w)
+-{
+- /*
+- * If the result is not -EDEADLOCK or the caller requested
+- * deadlock detection, nothing to do here.
+- */
+- if (res != -EDEADLOCK || detect_deadlock)
+- return;
+-
+- /*
+- * Yell lowdly and stop the task right here.
+- */
+- rt_mutex_print_deadlock(w);
+- while (1) {
+- set_current_state(TASK_INTERRUPTIBLE);
+- schedule();
+- }
+-}
+-
+ /*
+ * Slow path lock function:
+ */
+@@ -827,10 +657,8 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
+
+ set_current_state(TASK_RUNNING);
+
+- if (unlikely(ret)) {
++ if (unlikely(ret))
+ remove_waiter(lock, &waiter);
+- rt_mutex_handle_deadlock(ret, detect_deadlock, &waiter);
+- }
+
+ /*
+ * try_to_take_rt_mutex() sets the waiter bit
+@@ -886,49 +714,12 @@ rt_mutex_slowunlock(struct rt_mutex *lock)
+
+ rt_mutex_deadlock_account_unlock(current);
+
+- /*
+- * We must be careful here if the fast path is enabled. If we
+- * have no waiters queued we cannot set owner to NULL here
+- * because of:
+- *
+- * foo->lock->owner = NULL;
+- * rtmutex_lock(foo->lock); <- fast path
+- * free = atomic_dec_and_test(foo->refcnt);
+- * rtmutex_unlock(foo->lock); <- fast path
+- * if (free)
+- * kfree(foo);
+- * raw_spin_unlock(foo->lock->wait_lock);
+- *
+- * So for the fastpath enabled kernel:
+- *
+- * Nothing can set the waiters bit as long as we hold
+- * lock->wait_lock. So we do the following sequence:
+- *
+- * owner = rt_mutex_owner(lock);
+- * clear_rt_mutex_waiters(lock);
+- * raw_spin_unlock(&lock->wait_lock);
+- * if (cmpxchg(&lock->owner, owner, 0) == owner)
+- * return;
+- * goto retry;
+- *
+- * The fastpath disabled variant is simple as all access to
+- * lock->owner is serialized by lock->wait_lock:
+- *
+- * lock->owner = NULL;
+- * raw_spin_unlock(&lock->wait_lock);
+- */
+- while (!rt_mutex_has_waiters(lock)) {
+- /* Drops lock->wait_lock ! */
+- if (unlock_rt_mutex_safe(lock) == true)
+- return;
+- /* Relock the rtmutex and try again */
+- raw_spin_lock(&lock->wait_lock);
++ if (!rt_mutex_has_waiters(lock)) {
++ lock->owner = NULL;
++ raw_spin_unlock(&lock->wait_lock);
++ return;
+ }
+
+- /*
+- * The wakeup next waiter path does not suffer from the above
+- * race. See the comments there.
+- */
+ wakeup_next_waiter(lock);
+
+ raw_spin_unlock(&lock->wait_lock);
+@@ -1175,8 +966,7 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ return 1;
+ }
+
+- /* We enforce deadlock detection for futexes */
+- ret = task_blocks_on_rt_mutex(lock, waiter, task, 1);
++ ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock);
+
+ if (ret && !rt_mutex_owner(lock)) {
+ /*
Modified: dists/wheezy-security/linux/debian/patches/features/arm/net-drop-NET-dependency-from-HAVE_BPF_JIT.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/arm/net-drop-NET-dependency-from-HAVE_BPF_JIT.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/arm/net-drop-NET-dependency-from-HAVE_BPF_JIT.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -24,11 +24,9 @@
net/Kconfig | 7 ++++---
5 files changed, 8 insertions(+), 7 deletions(-)
-Index: linux/arch/arm/Kconfig
-===================================================================
---- linux.orig/arch/arm/Kconfig 2012-06-24 23:41:24.000000000 +0200
-+++ linux/arch/arm/Kconfig 2012-06-24 23:49:03.000000000 +0200
-@@ -30,7 +30,7 @@
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -30,7 +30,7 @@ config ARM
select HAVE_SPARSE_IRQ
select GENERIC_IRQ_SHOW
select CPU_PM if (SUSPEND || CPU_IDLE)
@@ -37,11 +35,9 @@
help
The ARM series is a line of low-power-consumption RISC chip designs
licensed by ARM Ltd and targeted at embedded applications and
-Index: linux/arch/powerpc/Kconfig
-===================================================================
---- linux.orig/arch/powerpc/Kconfig 2012-06-20 00:18:30.000000000 +0200
-+++ linux/arch/powerpc/Kconfig 2012-06-24 23:49:03.000000000 +0200
-@@ -134,7 +134,7 @@
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -134,7 +134,7 @@ config PPC
select GENERIC_IRQ_SHOW_LEVEL
select HAVE_RCU_TABLE_FREE if SMP
select HAVE_SYSCALL_TRACEPOINTS
@@ -49,12 +45,10 @@
+ select HAVE_BPF_JIT if PPC64
select HAVE_ARCH_JUMP_LABEL
select ARCH_HAVE_NMI_SAFE_CMPXCHG
-
-Index: linux/arch/x86/Kconfig
-===================================================================
---- linux.orig/arch/x86/Kconfig 2012-06-23 17:09:51.000000000 +0200
-+++ linux/arch/x86/Kconfig 2012-06-24 23:49:03.000000000 +0200
-@@ -72,7 +72,7 @@
+ select ARCH_SUPPORTS_ATOMIC_RMW
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -72,7 +72,7 @@ config X86
select GENERIC_CLOCKEVENTS_MIN_ADJUST
select IRQ_FORCED_THREADING
select USE_GENERIC_SMP_HELPERS if SMP
@@ -62,12 +56,10 @@
+ select HAVE_BPF_JIT if X86_64
select CLKEVT_I8253
select ARCH_HAVE_NMI_SAFE_CMPXCHG
-
-Index: linux/net/Kconfig
-===================================================================
---- linux.orig/net/Kconfig 2012-06-20 00:18:30.000000000 +0200
-+++ linux/net/Kconfig 2012-06-24 23:49:03.000000000 +0200
-@@ -232,9 +232,6 @@
+ select ARCH_SUPPORTS_ATOMIC_RMW
+--- a/net/Kconfig
++++ b/net/Kconfig
+@@ -232,9 +232,6 @@ config XPS
depends on SMP && SYSFS && USE_GENERIC_SMP_HELPERS
default y
@@ -77,7 +69,7 @@
config BPF_JIT
bool "enable BPF Just In Time compiler"
depends on HAVE_BPF_JIT
-@@ -326,3 +323,7 @@
+@@ -326,3 +323,7 @@ source "net/nfc/Kconfig"
endif # if NET
Modified: dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0003-Staging-hv-storvsc-Use-mempools-to-allocate-struct-s.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0003-Staging-hv-storvsc-Use-mempools-to-allocate-struct-s.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0003-Staging-hv-storvsc-Use-mempools-to-allocate-struct-s.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -11,12 +11,12 @@
Signed-off-by: K. Y. Srinivasan <kys at microsoft.com>
Signed-off-by: Haiyang Zhang <haiyangz at microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>
+[bwh: Adjusted to apply after backported commit 56b26e69c828
+ 'Drivers: scsi: storvsc: Implement a eh_timed_out handler'
---
drivers/staging/hv/storvsc_drv.c | 30 +++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
-diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
-index ae8c33e..6a255e9 100644
--- a/drivers/staging/hv/storvsc_drv.c
+++ b/drivers/staging/hv/storvsc_drv.c
@@ -32,6 +32,7 @@
@@ -24,10 +24,10 @@
#include <linux/device.h>
#include <linux/hyperv.h>
+#include <linux/mempool.h>
+ #include <linux/blkdev.h>
#include <scsi/scsi.h>
#include <scsi/scsi_cmnd.h>
- #include <scsi/scsi_host.h>
-@@ -42,6 +43,7 @@
+@@ -43,6 +44,7 @@
#include <scsi/scsi_dbg.h>
@@ -35,7 +35,7 @@
#define STORVSC_RING_BUFFER_SIZE (20*PAGE_SIZE)
static int storvsc_ringbuffer_size = STORVSC_RING_BUFFER_SIZE;
-@@ -287,6 +289,7 @@ struct storvsc_device {
+@@ -288,6 +290,7 @@ struct storvsc_device {
struct hv_host_device {
struct hv_device *dev;
struct kmem_cache *request_pool;
@@ -43,7 +43,7 @@
unsigned int port;
unsigned char path;
unsigned char target;
-@@ -974,8 +977,10 @@ static int storvsc_remove(struct hv_device *dev)
+@@ -976,8 +979,10 @@ static int storvsc_remove(struct hv_devi
storvsc_dev_remove(dev);
if (host_dev->request_pool) {
@@ -54,7 +54,7 @@
}
return 0;
}
-@@ -1120,7 +1125,7 @@ static void storvsc_command_completion(struct hv_storvsc_request *request)
+@@ -1127,7 +1132,7 @@ static void storvsc_command_completion(s
scsi_done_fn(scmnd);
@@ -62,8 +62,8 @@
+ mempool_free(cmd_request, host_dev->request_mempool);
}
- static bool storvsc_check_scsi_cmd(struct scsi_cmnd *scmnd)
-@@ -1176,12 +1181,13 @@ static int storvsc_queuecommand_lck(struct scsi_cmnd *scmnd,
+ /*
+@@ -1193,12 +1198,13 @@ static int storvsc_queuecommand_lck(stru
request_size = sizeof(struct storvsc_cmd_request);
@@ -78,7 +78,7 @@
/* Setup the cmd request */
cmd_request->bounce_sgl_count = 0;
-@@ -1235,8 +1241,8 @@ static int storvsc_queuecommand_lck(struct scsi_cmnd *scmnd,
+@@ -1252,8 +1258,8 @@ static int storvsc_queuecommand_lck(stru
if (!cmd_request->bounce_sgl) {
scmnd->scsi_done = NULL;
scmnd->host_scribble = NULL;
@@ -89,7 +89,7 @@
return SCSI_MLQUEUE_HOST_BUSY;
}
-@@ -1278,7 +1284,7 @@ retry_request:
+@@ -1295,7 +1301,7 @@ retry_request:
destroy_bounce_buffer(cmd_request->bounce_sgl,
cmd_request->bounce_sgl_count);
@@ -98,7 +98,7 @@
scmnd->scsi_done = NULL;
scmnd->host_scribble = NULL;
-@@ -1348,6 +1354,7 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1366,6 +1372,7 @@ static int storvsc_probe(struct hv_devic
const struct hv_vmbus_device_id *dev_id)
{
int ret;
@@ -106,7 +106,7 @@
struct Scsi_Host *host;
struct hv_host_device *host_dev;
bool dev_is_ide = ((dev_id->driver_data == IDE_GUID) ? true : false);
-@@ -1376,8 +1383,19 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1394,8 +1401,19 @@ static int storvsc_probe(struct hv_devic
return -ENOMEM;
}
@@ -126,7 +126,7 @@
kmem_cache_destroy(host_dev->request_pool);
scsi_host_put(host);
return -ENOMEM;
-@@ -1392,6 +1410,7 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1410,6 +1428,7 @@ static int storvsc_probe(struct hv_devic
stor_device->port_number = host->host_no;
ret = storvsc_connect_to_vsp(device, storvsc_ringbuffer_size);
if (ret) {
@@ -134,7 +134,7 @@
kmem_cache_destroy(host_dev->request_pool);
scsi_host_put(host);
kfree(stor_device);
-@@ -1431,6 +1450,7 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1449,6 +1468,7 @@ static int storvsc_probe(struct hv_devic
err_out:
storvsc_dev_remove(device);
@@ -142,6 +142,3 @@
kmem_cache_destroy(host_dev->request_pool);
scsi_host_put(host);
return -ENODEV;
---
-1.7.9.5
-
Modified: dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0025-Staging-hv-storvsc-Implement-per-device-memory-pools.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0025-Staging-hv-storvsc-Implement-per-device-memory-pools.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0025-Staging-hv-storvsc-Implement-per-device-memory-pools.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -18,11 +18,9 @@
drivers/staging/hv/storvsc_drv.c | 106 ++++++++++++++++++++++----------------
1 file changed, 62 insertions(+), 44 deletions(-)
-diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
-index c22de06..18f8771 100644
--- a/drivers/staging/hv/storvsc_drv.c
+++ b/drivers/staging/hv/storvsc_drv.c
-@@ -285,10 +285,13 @@ struct storvsc_device {
+@@ -286,10 +286,13 @@ struct storvsc_device {
struct hv_storvsc_request reset_request;
};
@@ -38,7 +36,7 @@
unsigned int port;
unsigned char path;
unsigned char target;
-@@ -790,7 +793,48 @@ static void storvsc_get_ide_info(struct hv_device *dev, int *target, int *path)
+@@ -791,7 +794,48 @@ static void storvsc_get_ide_info(struct
static int storvsc_device_alloc(struct scsi_device *sdevice)
{
@@ -87,7 +85,7 @@
}
static int storvsc_device_configure(struct scsi_device *sdevice)
-@@ -1031,19 +1075,13 @@ static int storvsc_remove(struct hv_device *dev)
+@@ -1033,19 +1077,13 @@ static int storvsc_remove(struct hv_devi
{
struct storvsc_device *stor_device = hv_get_drvdata(dev);
struct Scsi_Host *host = stor_device->host;
@@ -108,7 +106,7 @@
return 0;
}
-@@ -1139,6 +1177,7 @@ static void storvsc_command_completion(struct hv_storvsc_request *request)
+@@ -1146,6 +1184,7 @@ static void storvsc_command_completion(s
struct scsi_sense_hdr sense_hdr;
struct vmscsi_request *vm_srb;
struct storvsc_scan_work *wrk;
@@ -116,7 +114,7 @@
vm_srb = &request->vstor_packet.vm_srb;
if (cmd_request->bounce_sgl_count) {
-@@ -1201,7 +1240,7 @@ static void storvsc_command_completion(struct hv_storvsc_request *request)
+@@ -1208,7 +1247,7 @@ static void storvsc_command_completion(s
scsi_done_fn(scmnd);
@@ -124,8 +122,8 @@
+ mempool_free(cmd_request, memp->request_mempool);
}
- static bool storvsc_check_scsi_cmd(struct scsi_cmnd *scmnd)
-@@ -1236,6 +1275,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+ /*
+@@ -1253,6 +1292,7 @@ static int storvsc_queuecommand(struct S
struct scatterlist *sgl;
unsigned int sg_count = 0;
struct vmscsi_request *vm_srb;
@@ -133,7 +131,7 @@
if (storvsc_check_scsi_cmd(scmnd) == false) {
scmnd->scsi_done(scmnd);
-@@ -1253,7 +1293,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+@@ -1270,7 +1310,7 @@ static int storvsc_queuecommand(struct S
request_size = sizeof(struct storvsc_cmd_request);
@@ -142,7 +140,7 @@
GFP_ATOMIC);
if (!cmd_request)
return SCSI_MLQUEUE_DEVICE_BUSY;
-@@ -1312,7 +1352,7 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+@@ -1329,7 +1369,7 @@ static int storvsc_queuecommand(struct S
if (!cmd_request->bounce_sgl) {
scmnd->host_scribble = NULL;
mempool_free(cmd_request,
@@ -151,7 +149,7 @@
return SCSI_MLQUEUE_HOST_BUSY;
}
-@@ -1354,7 +1394,7 @@ retry_request:
+@@ -1371,7 +1411,7 @@ retry_request:
destroy_bounce_buffer(cmd_request->bounce_sgl,
cmd_request->bounce_sgl_count);
@@ -160,15 +158,15 @@
scmnd->host_scribble = NULL;
-@@ -1372,6 +1412,7 @@ static struct scsi_host_template scsi_driver = {
- .queuecommand = storvsc_queuecommand,
+@@ -1390,6 +1430,7 @@ static struct scsi_host_template scsi_dr
.eh_host_reset_handler = storvsc_host_reset_handler,
+ .eh_timed_out = storvsc_eh_timed_out,
.slave_alloc = storvsc_device_alloc,
+ .slave_destroy = storvsc_device_destroy,
.slave_configure = storvsc_device_configure,
.cmd_per_lun = 1,
/* 64 max_queue * 1 target */
-@@ -1413,7 +1454,6 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1431,7 +1472,6 @@ static int storvsc_probe(struct hv_devic
const struct hv_vmbus_device_id *dev_id)
{
int ret;
@@ -176,7 +174,7 @@
struct Scsi_Host *host;
struct hv_host_device *host_dev;
bool dev_is_ide = ((dev_id->driver_data == IDE_GUID) ? true : false);
-@@ -1432,29 +1472,11 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1450,29 +1490,11 @@ static int storvsc_probe(struct hv_devic
host_dev->port = host->host_no;
host_dev->dev = device;
@@ -207,7 +205,7 @@
}
stor_device->destroy = false;
-@@ -1466,7 +1488,7 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1484,7 +1506,7 @@ static int storvsc_probe(struct hv_devic
stor_device->port_number = host->host_no;
ret = storvsc_connect_to_vsp(device, storvsc_ringbuffer_size);
if (ret)
@@ -216,7 +214,7 @@
if (dev_is_ide)
storvsc_get_ide_info(device, &target, &path);
-@@ -1486,7 +1508,7 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1504,7 +1526,7 @@ static int storvsc_probe(struct hv_devic
/* Register the HBA and start the scsi bus scan */
ret = scsi_add_host(host, &device->device);
if (ret != 0)
@@ -225,7 +223,7 @@
if (!dev_is_ide) {
scsi_scan_host(host);
-@@ -1495,28 +1517,24 @@ static int storvsc_probe(struct hv_device *device,
+@@ -1513,28 +1535,24 @@ static int storvsc_probe(struct hv_devic
ret = scsi_add_device(host, 0, target, 0);
if (ret) {
scsi_remove_host(host);
@@ -259,6 +257,3 @@
scsi_host_put(host);
return ret;
}
---
-1.7.9.5
-
Modified: dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0050-Staging-hv-storvsc-Cleanup-storvsc_queuecommand.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0050-Staging-hv-storvsc-Cleanup-storvsc_queuecommand.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0050-Staging-hv-storvsc-Cleanup-storvsc_queuecommand.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -14,12 +14,10 @@
drivers/staging/hv/storvsc_drv.c | 48 +++++++++++++++++---------------------
1 file changed, 22 insertions(+), 26 deletions(-)
-diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
-index 7561d29..71e50c3 100644
--- a/drivers/staging/hv/storvsc_drv.c
+++ b/drivers/staging/hv/storvsc_drv.c
-@@ -1239,13 +1239,16 @@ static void storvsc_command_completion(struct hv_storvsc_request *request)
- mempool_free(cmd_request, memp->request_mempool);
+@@ -1256,13 +1256,16 @@ static enum blk_eh_timer_return storvsc_
+ return BLK_EH_RESET_TIMER;
}
-static bool storvsc_check_scsi_cmd(struct scsi_cmnd *scmnd)
@@ -37,7 +35,7 @@
case SET_WINDOW:
scmnd->result = ILLEGAL_REQUEST << 16;
allowed = false;
-@@ -1270,32 +1273,26 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+@@ -1287,32 +1290,26 @@ static int storvsc_queuecommand(struct S
struct vmscsi_request *vm_srb;
struct stor_mem_pools *memp = scmnd->device->hostdata;
@@ -76,7 +74,7 @@
cmd_request->cmd = scmnd;
scmnd->host_scribble = (unsigned char *)cmd_request;
-@@ -1344,11 +1341,8 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+@@ -1361,11 +1358,8 @@ static int storvsc_queuecommand(struct S
scsi_bufflen(scmnd),
vm_srb->data_in);
if (!cmd_request->bounce_sgl) {
@@ -90,7 +88,7 @@
}
cmd_request->bounce_sgl_count =
-@@ -1377,24 +1371,26 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+@@ -1394,24 +1388,26 @@ static int storvsc_queuecommand(struct S
virt_to_phys(scsi_sglist(scmnd)) >> PAGE_SHIFT;
}
@@ -124,6 +122,3 @@
return ret;
}
---
-1.7.9.5
-
Modified: dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0055-Staging-hv-storvsc-Get-rid-of-the-on_io_completion-i.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0055-Staging-hv-storvsc-Get-rid-of-the-on_io_completion-i.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0055-Staging-hv-storvsc-Get-rid-of-the-on_io_completion-i.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -10,15 +10,17 @@
Signed-off-by: K. Y. Srinivasan <kys at microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
-[bwh: Adjusted to apply after backported commit 9d2696e658ef
- '[SCSI] storvsc: Initialize the sglist']
+[bwh: Adjusted to apply after backported commits 9d2696e658ef
+ '[SCSI] storvsc: Initialize the sglist' and 56b26e69c828
+ 'Drivers: scsi: storvsc: Implement a eh_timed_out handler']
+
---
drivers/staging/hv/storvsc_drv.c | 630 +++++++++++++++++++-------------------
1 file changed, 313 insertions(+), 317 deletions(-)
--- a/drivers/staging/hv/storvsc_drv.c
+++ b/drivers/staging/hv/storvsc_drv.c
-@@ -276,7 +276,6 @@ struct hv_storvsc_request {
+@@ -277,7 +277,6 @@ struct hv_storvsc_request {
unsigned char *sense_buffer;
void *context;
@@ -26,7 +28,7 @@
struct hv_multipage_buffer data_buffer;
struct vstor_packet vstor_packet;
-@@ -436,6 +435,228 @@ get_in_err:
+@@ -437,6 +436,228 @@ get_in_err:
}
@@ -255,7 +257,7 @@
static int storvsc_channel_init(struct hv_device *device)
{
struct storvsc_device *stor_device;
-@@ -562,23 +783,100 @@ cleanup:
+@@ -563,23 +784,100 @@ cleanup:
return ret;
}
@@ -369,7 +371,7 @@
* We do this so we can distinguish truly fatal failues
* (srb status == 0x4) and off-line the device in that case.
*/
-@@ -625,7 +923,7 @@ static void storvsc_on_io_completion(str
+@@ -626,7 +924,7 @@ static void storvsc_on_io_completion(str
stor_pkt->vm_srb.data_transfer_length =
vstor_packet->vm_srb.data_transfer_length;
@@ -378,7 +380,7 @@
if (atomic_dec_and_test(&stor_device->num_outstanding_req) &&
stor_device->drain_notify)
-@@ -875,230 +1173,6 @@ static int storvsc_device_configure(stru
+@@ -876,230 +1174,6 @@ static int storvsc_device_configure(stru
return 0;
}
@@ -609,7 +611,7 @@
static int storvsc_get_chs(struct scsi_device *sdev, struct block_device * bdev,
sector_t capacity, int *info)
{
-@@ -1172,83 +1246,6 @@ static int storvsc_host_reset_handler(st
+@@ -1173,83 +1247,6 @@ static int storvsc_host_reset_handler(st
return SUCCESS;
}
@@ -690,10 +692,10 @@
- mempool_free(cmd_request, memp->request_mempool);
-}
-
- static bool storvsc_scsi_cmd_ok(struct scsi_cmnd *scmnd)
- {
- bool allowed = true;
-@@ -1324,7 +1321,6 @@ static int storvsc_queuecommand(struct S
+ /*
+ * The host guarantees to respond to each command, although I/O latencies might
+ * be unbounded on Azure. Reset the timer unconditionally to give the host a
+@@ -1335,7 +1332,6 @@ static int storvsc_queuecommand(struct S
break;
}
Modified: dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0067-Staging-hv-storvsc-Move-the-storage-driver-out-of-th.patch
==============================================================================
--- dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0067-Staging-hv-storvsc-Move-the-storage-driver-out-of-th.patch Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/features/x86/hyperv/0067-Staging-hv-storvsc-Move-the-storage-driver-out-of-th.patch Sat Oct 25 23:26:41 2014 (r21972)
@@ -21,7 +21,8 @@
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
[bwh: Adjusted to apply after backported commits 5c1b10ab7f93
'[SCSI] storvsc: Account for in-transit packets in the RESET path' and
- 9d2696e658ef '[SCSI] storvsc: Initialize the sglist']
+ 9d2696e658ef '[SCSI] storvsc: Initialize the sglist' and 56b26e69c828
+ 'Drivers: scsi: storvsc: Implement a eh_timed_out handler']
---
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -60,7 +61,7 @@
sd_mod-objs := sd.o
--- /dev/null
+++ b/drivers/scsi/storvsc_drv.c
-@@ -0,0 +1,1554 @@
+@@ -0,0 +1,1566 @@
+/*
+ * Copyright (c) 2009, Microsoft Corporation.
+ *
@@ -96,6 +97,7 @@
+#include <linux/device.h>
+#include <linux/hyperv.h>
+#include <linux/mempool.h>
++#include <linux/blkdev.h>
+#include <scsi/scsi.h>
+#include <scsi/scsi_cmnd.h>
+#include <scsi/scsi_host.h>
@@ -1285,6 +1287,16 @@
+ return SUCCESS;
+}
+
++/*
++ * The host guarantees to respond to each command, although I/O latencies might
++ * be unbounded on Azure. Reset the timer unconditionally to give the host a
++ * chance to perform EH.
++ */
++static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
++{
++ return BLK_EH_RESET_TIMER;
++}
++
+static bool storvsc_scsi_cmd_ok(struct scsi_cmnd *scmnd)
+{
+ bool allowed = true;
@@ -1442,6 +1454,7 @@
+ .bios_param = storvsc_get_chs,
+ .queuecommand = storvsc_queuecommand,
+ .eh_host_reset_handler = storvsc_host_reset_handler,
++ .eh_timed_out = storvsc_eh_timed_out,
+ .slave_alloc = storvsc_device_alloc,
+ .slave_destroy = storvsc_device_destroy,
+ .slave_configure = storvsc_device_configure,
@@ -1660,7 +1673,7 @@
-Haiyang Zhang <haiyangz at microsoft.com>, and K. Y. Srinivasan <kys at microsoft.com>
--- a/drivers/staging/hv/storvsc_drv.c
+++ /dev/null
-@@ -1,1554 +0,0 @@
+@@ -1,1566 +0,0 @@
-/*
- * Copyright (c) 2009, Microsoft Corporation.
- *
@@ -1696,6 +1709,7 @@
-#include <linux/device.h>
-#include <linux/hyperv.h>
-#include <linux/mempool.h>
+-#include <linux/blkdev.h>
-#include <scsi/scsi.h>
-#include <scsi/scsi_cmnd.h>
-#include <scsi/scsi_host.h>
@@ -2885,6 +2899,16 @@
- return SUCCESS;
-}
-
+-/*
+- * The host guarantees to respond to each command, although I/O latencies might
+- * be unbounded on Azure. Reset the timer unconditionally to give the host a
+- * chance to perform EH.
+- */
+-static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
+-{
+- return BLK_EH_RESET_TIMER;
+-}
+-
-static bool storvsc_scsi_cmd_ok(struct scsi_cmnd *scmnd)
-{
- bool allowed = true;
@@ -3042,6 +3066,7 @@
- .bios_param = storvsc_get_chs,
- .queuecommand = storvsc_queuecommand,
- .eh_host_reset_handler = storvsc_host_reset_handler,
+- .eh_timed_out = storvsc_eh_timed_out,
- .slave_alloc = storvsc_device_alloc,
- .slave_destroy = storvsc_device_destroy,
- .slave_configure = storvsc_device_configure,
Modified: dists/wheezy-security/linux/debian/patches/series
==============================================================================
--- dists/wheezy-security/linux/debian/patches/series Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/series Sat Oct 25 23:26:41 2014 (r21972)
@@ -48,7 +48,6 @@
bugfix/all/snapshot-Implement-compat_ioctl.patch
debian/ARM-Remove-use-of-possibly-undefined-BUILD_BUG_ON-in.patch
bugfix/arm/ARM-topdown-mmap.patch
-bugfix/alpha/alpha-add-io-read-write-16-32-be-functions.patch
features/arm/ARM-kirkwood-6282A1.patch
features/all/Input-ALPS-move-protocol-information-to-Documentatio.patch
features/all/Input-ALPS-add-protocol-version-field-in-alps_model_.patch
@@ -663,8 +662,6 @@
debian/mm-avoid-ABI-change-in-3.2.55.patch
features/all/sound-usb-emu0204-frontselection.patch
debian/net-avoid-abi-change-in-3.2.57.patch
-bugfix/all/skbuff-add-an-api-to-orphan-frags.patch
-bugfix/all/skbuff-skb_segment-orphan-frags-before-copying.patch
debian/revert-alsa-enable-config_zone_dma.patch
# Support for e1000e and igb backports
@@ -1108,13 +1105,10 @@
features/all/igb/0180-igb-disable-eee.patch
bugfix/x86/crypto-ghash-clmulni-intel-use-C-implementation-for-.patch
-bugfix/all/skbuff-export-skb_copy_ubufs.patch
bugfix/x86/revert-perf-x86-amd-ibs-fix-waking-up-from-s3-for-amd-family-10h.patch
debian/libata-avoid-abi-change-in-3.2.59.patch
debian/dmi-avoid-abi-change-in-3.2.59.patch
-bugfix/mips/MIPS-Cleanup-flags-in-syscall-flags-handlers.patch
-bugfix/mips/MIPS-asm-thread_info-Add-_TIF_SECCOMP-flag.patch
bugfix/all/netfilter-ipv4-defrag-set-local_df-flag-on-defragmen.patch
features/all/msi-sysfs/PCI-sysfs-add-per-pci-device-msi-x-irq-listing-v5.patch
features/all/msi-sysfs/PCI-msi-fix-imbalanced-refcount-of-msi-irq-sysfs-obj.patch
@@ -1124,22 +1118,22 @@
features/all/msi-sysfs/PCI-MSI-Fix-leak-of-msi_attrs.patch
features/all/msi-sysfs/PCI-MSI-Fix-memory-leak-in-free_msi_irqs.patch
features/all/msi-sysfs/pci-msi_desc-remove-unused-kobject.patch
-bugfix/all/auditsc-audit_krule-mask-accesses-need-bounds-checki.patch
bugfix/all/mm-add-pte_present-check-on-existing-hugetlb_entry-c.patch
-bugfix/x86/x86_32-entry-Do-syscall-exit-work-on-badsys-CVE-2014.patch
-bugfix/all/ALSA-control-Protect-user-controls-against-concurren.patch
-bugfix/all/ALSA-control-Don-t-access-controls-outside-of-protec.patch
-bugfix/all/ALSA-control-Fix-replacing-user-controls.patch
-bugfix/all/ALSA-control-Make-sure-that-id-index-does-not-overfl.patch
-bugfix/all/ALSA-control-Handle-numid-overflow.patch
-bugfix/all/target-explicitly-clear-ramdisk_mcp-backend-pages.patch
debian/alsa-avoid-abi-change-for-cve-2014-4652-fix.patch
# CVE-2014-4699
-bugfix/all/0001-ptrace-x86-force-IRET-path-after-a-ptrace_stop.patch
-bugfix/all/revert-net-ipv4-ip_forward-fix-inverted-local_df-tes.patch
-bugfix/all/revert-net-ip-ipv6-handle-gso-skbs-in-forwarding-pat.patch
-bugfix/all/net-l2tp-don-t-fall-back-on-UDP-get-set-sockopt.patch
-bugfix/all/sctp-fix-sk_ack_backlog-wrap-around-problem.patch
-bugfix/s390/s390-ptrace-fix-PSW-mask-check.patch
+debian/irq-avoid-abi-change-in-3.2.61.patch
+debian/ptrace-avoid-abi-change-in-3.2.61.patch
+debian/trace-syscall-avoid-abi-change-in-3.2.61.patch
+debian/scsi-avoid-abi-change-in-3.2.61.patch
+debian/libata-avoid-abi-change-in-3.2.62.patch
+debian/ip-ident-avoid-abi-change-in-3.2.63.patch
+debian/scsi-avoid-abi-change-in-3.2.62.patch
+debian/nlattr-avoid-abi-change-in-3.2.61.patch
+bugfix/all/nfsd-fix-acl-null-pointer-deref.patch
+bugfix/all/ext4-fix-BUG_ON-in-mb_free_blocks.patch
+bugfix/all/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch
+bugfix/all/libceph-add-process_one_ticket-helper.patch
+bugfix/all/libceph-do-not-hard-code-max-auth-ticket-len.patch
+debian/sp5100_tco-reject-sb8x0-chips.patch
Modified: dists/wheezy-security/linux/debian/patches/series-rt
==============================================================================
--- dists/wheezy-security/linux/debian/patches/series-rt Fri Oct 24 11:54:55 2014 (r21971)
+++ dists/wheezy-security/linux/debian/patches/series-rt Sat Oct 25 23:26:41 2014 (r21972)
@@ -1,3 +1,4 @@
+features/all/rt/revert-rtmutex-changes-in-3.2.61.patch
features/all/rt/0001-Revert-workqueue-skip-nr_running-sanity-check-in-wor.patch
features/all/rt/0002-x86-Call-idle-notifier-after-irq_enter.patch
features/all/rt/0003-slab-lockdep-Annotate-all-slab-caches.patch
More information about the Kernel-svn-changes
mailing list