From 4b5c3c4a4bd5aa582644405ab8fe1ce9b63255ac Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 10 Sep 2014 12:58:25 -0400 Subject: [PATCH 001/283] CVE-2014-3631 Add patch to fix oops on keyring gc (rhbz 1116347) --- ...tion-condition-in-assoc-array-garbag.patch | 95 +++++++++++++++++++ kernel.spec | 9 ++ 2 files changed, 104 insertions(+) create mode 100644 KEYS-Fix-termination-condition-in-assoc-array-garbag.patch diff --git a/KEYS-Fix-termination-condition-in-assoc-array-garbag.patch b/KEYS-Fix-termination-condition-in-assoc-array-garbag.patch new file mode 100644 index 000000000..3afe63123 --- /dev/null +++ b/KEYS-Fix-termination-condition-in-assoc-array-garbag.patch @@ -0,0 +1,95 @@ +From 11646ff9e6874d205ab92af605db6b90fbe214d1 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 9 Sep 2014 19:12:32 +0100 +Subject: [PATCH] KEYS: Fix termination condition in assoc array garbage + collection + +It is possible for an associative array to end up with a shortcut node at the +root of the tree, if there are more than fan-out nodes in the tree, but they +all crowd into the same slot in the lowest level (ie. they all have the same +first nibble of their index keys). + +When assoc_array_gc() returns back up the tree after scanning some leaves, it +can fall off of the root and crash because it assumes that the back pointer +from a shortcut (after label ascend_old_tree) must point to a normal node - +which isn't true of a shortcut node at the root. + +Should we find we're ascending rootwards over a shortcut, we should check to +see if the backpointer is zero - and if it is, we have completed the scan. + +This particular bug cannot occur if the root node is not a shortcut - ie. if +you have fewer than 17 keys in a keyring or if you have at least two keys that +sit into separate slots (eg. a keyring and a non keyring). + +If we do fall off of the top of the tree, we get the following oops: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 + IP: [] assoc_array_gc+0x2f7/0x540 + PGD dae15067 PUD cfc24067 PMD 0 + Oops: 0000 [#1] SMP + Modules linked in: xt_nat xt_mark nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_ni + CPU: 0 PID: 26011 Comm: kworker/0:1 Not tainted 3.14.9-200.fc20.x86_64 #1 + Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 + Workqueue: events key_garbage_collector + task: ffff8800918bd580 ti: ffff8800aac14000 task.ti: ffff8800aac14000 + RIP: 0010:[] [] assoc_array_gc+0x2f7/0x540 + RSP: 0018:ffff8800aac15d40 EFLAGS: 00010206 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8800aaecacc0 + RDX: ffff8800daecf440 RSI: 0000000000000001 RDI: ffff8800aadc2bc0 + RBP: ffff8800aac15da8 R08: 0000000000000001 R09: 0000000000000003 + R10: ffffffff8136ccc7 R11: 0000000000000000 R12: 0000000000000000 + R13: 0000000000000000 R14: 0000000000000070 R15: 0000000000000001 + FS: 0000000000000000(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b + CR2: 0000000000000018 CR3: 00000000db10d000 CR4: 00000000000006f0 + Stack: + ffff8800aac15d50 0000000000000011 ffff8800aac15db8 ffffffff812e2a70 + ffff880091a00600 0000000000000000 ffff8800aadc2bc3 00000000cd42c987 + ffff88003702df20 ffff88003702dfa0 0000000053b65c09 ffff8800aac15fd8 + Call Trace: + [] ? keyring_detect_cycle_iterator+0x30/0x30 + [] keyring_gc+0x75/0x80 + [] key_garbage_collector+0x154/0x3c0 + [] process_one_work+0x176/0x430 + [] worker_thread+0x11b/0x3a0 + [] ? rescuer_thread+0x3b0/0x3b0 + [] kthread+0xd8/0xf0 + [] ? insert_kthread_work+0x40/0x40 + [] ret_from_fork+0x7c/0xb0 + [] ? insert_kthread_work+0x40/0x40 + Code: 08 4c 8b 22 0f 84 bf 00 00 00 41 83 c7 01 49 83 e4 fc 41 83 ff 0f 4c 89 65 c0 0f 8f 5a fe ff ff 48 8b 45 c0 4d 63 cf 49 83 c1 02 <4e> 8b 34 c8 4d 85 f6 0f 84 be 00 00 00 41 f6 c6 01 0f 84 92 + RIP [] assoc_array_gc+0x2f7/0x540 + RSP + CR2: 0000000000000018 + ---[ end trace 1129028a088c0cbd ]--- + +Bugzilla: 1116347 +Upstream-status: ?? + +Signed-off-by: David Howells +--- + lib/assoc_array.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/assoc_array.c b/lib/assoc_array.c +index ae146f0734eb..2404d03e251a 100644 +--- a/lib/assoc_array.c ++++ b/lib/assoc_array.c +@@ -1723,11 +1723,13 @@ ascend_old_tree: + shortcut = assoc_array_ptr_to_shortcut(ptr); + slot = shortcut->parent_slot; + cursor = shortcut->back_pointer; ++ if (!cursor) ++ goto gc_complete; + } else { + slot = node->parent_slot; + cursor = ptr; + } +- BUG_ON(!ptr); ++ BUG_ON(!cursor); + node = assoc_array_ptr_to_node(cursor); + slot++; + goto continue_node; +-- +1.9.3 + diff --git a/kernel.spec b/kernel.spec index e892c3fb8..b66f0b507 100644 --- a/kernel.spec +++ b/kernel.spec @@ -629,6 +629,9 @@ Patch25119: namespaces-remount-fixes.patch #rhbz 1134969 Patch26019: Input-wacom-Add-support-for-the-Cintiq-Companion.patch +# CVE-2014-3631 rhbz 1116347 +Patch26020: KEYS-Fix-termination-condition-in-assoc-array-garbag.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1351,6 +1354,9 @@ ApplyPatch namespaces-remount-fixes.patch #rhbz 1134969 ApplyPatch Input-wacom-Add-support-for-the-Cintiq-Companion.patch +# CVE-2014-3631 rhbz 1116347 +ApplyPatch KEYS-Fix-termination-condition-in-assoc-array-garbag.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2227,6 +2233,9 @@ fi # ||----w | # || || %changelog +* Wed Sep 10 2014 Josh Boyer +- CVE-2014-3631 Add patch to fix oops on keyring gc (rhbz 1116347) + * Mon Sep 8 2014 Peter Robinson - Build tools on ppc64le (rhbz 1138884) - Some minor ppc64 cleanups From a634cc2b7f987d9dd1db740a6d97188e0846133c Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 11 Sep 2014 08:22:33 -0400 Subject: [PATCH 002/283] Bump for build --- kernel.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel.spec b/kernel.spec index b66f0b507..f37b37b83 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 300 +%global baserelease 301 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -2233,7 +2233,7 @@ fi # ||----w | # || || %changelog -* Wed Sep 10 2014 Josh Boyer +* Wed Sep 10 2014 Josh Boyer - 3.16.2-301 - CVE-2014-3631 Add patch to fix oops on keyring gc (rhbz 1116347) * Mon Sep 8 2014 Peter Robinson From 5fd278390638ccde3f2c9543f4390780569f8471 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Thu, 11 Sep 2014 08:25:00 -0400 Subject: [PATCH 003/283] Add support for touchpad in Asus X450 and X550 (rhbz 1110011) --- ...-the-aux-firmware-id-in-multi-plexed.patch | 32 ++++ kernel.spec | 13 ++ ...mouse_matches_pnp_id-helper-function.patch | 100 +++++++++++ ...ort-for-detecting-FocalTech-PS-2-tou.patch | 159 ++++++++++++++++++ 4 files changed, 304 insertions(+) create mode 100644 i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch create mode 100644 psmouse-Add-psmouse_matches_pnp_id-helper-function.patch create mode 100644 psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch diff --git a/i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch b/i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch new file mode 100644 index 000000000..f2a5454bd --- /dev/null +++ b/i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch @@ -0,0 +1,32 @@ +From ef15224bce9875f9a5fbc93a2823219df6936a18 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 30 Jul 2014 17:56:05 +0200 +Subject: [PATCH 1/3] i8042: Also store the aux firmware id in multi-plexed aux + ports + +So that firmware-id matching can be used with multiplexed aux ports too. + +Bugzilla: 1110011 +Upstream-status: sent for 3.17/3.18 + +Signed-off-by: Hans de Goede +--- + drivers/input/serio/i8042.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c +index f1aeb0240d6e..4b5015f27f9e 100644 +--- a/drivers/input/serio/i8042.c ++++ b/drivers/input/serio/i8042.c +@@ -1253,6 +1253,8 @@ static int __init i8042_create_aux_port(int idx) + } else { + snprintf(serio->name, sizeof(serio->name), "i8042 AUX%d port", idx); + snprintf(serio->phys, sizeof(serio->phys), I8042_MUX_PHYS_DESC, idx + 1); ++ strlcpy(serio->firmware_id, i8042_aux_firmware_id, ++ sizeof(serio->firmware_id)); + } + + port->serio = serio; +-- +1.9.3 + diff --git a/kernel.spec b/kernel.spec index f37b37b83..439b7de24 100644 --- a/kernel.spec +++ b/kernel.spec @@ -632,6 +632,11 @@ Patch26019: Input-wacom-Add-support-for-the-Cintiq-Companion.patch # CVE-2014-3631 rhbz 1116347 Patch26020: KEYS-Fix-termination-condition-in-assoc-array-garbag.patch +#rhbz 1110011 +Patch26021: i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch +Patch26022: psmouse-Add-psmouse_matches_pnp_id-helper-function.patch +Patch26023: psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1357,6 +1362,11 @@ ApplyPatch Input-wacom-Add-support-for-the-Cintiq-Companion.patch # CVE-2014-3631 rhbz 1116347 ApplyPatch KEYS-Fix-termination-condition-in-assoc-array-garbag.patch +#rhbz 1110011 +ApplyPatch i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch +ApplyPatch psmouse-Add-psmouse_matches_pnp_id-helper-function.patch +ApplyPatch psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2233,6 +2243,9 @@ fi # ||----w | # || || %changelog +* Thu Sep 11 2014 Josh Boyer +- Add support for touchpad in Asus X450 and X550 (rhbz 1110011) + * Wed Sep 10 2014 Josh Boyer - 3.16.2-301 - CVE-2014-3631 Add patch to fix oops on keyring gc (rhbz 1116347) diff --git a/psmouse-Add-psmouse_matches_pnp_id-helper-function.patch b/psmouse-Add-psmouse_matches_pnp_id-helper-function.patch new file mode 100644 index 000000000..899a20b50 --- /dev/null +++ b/psmouse-Add-psmouse_matches_pnp_id-helper-function.patch @@ -0,0 +1,100 @@ +From d0d1fbdb2d34a669ffbec814893696909381ac0e Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 27 Jun 2014 18:46:42 +0200 +Subject: [PATCH 2/3] psmouse: Add psmouse_matches_pnp_id helper function + +The matches_pnp_id function from the synaptics driver is useful for other +drivers too. Make it a generic psmouse helper function. + +Bugzilla: 1110011 +Upstream-status: sent for 3.17/3.18 + +Signed-off-by: Hans de Goede +--- + drivers/input/mouse/psmouse-base.c | 14 ++++++++++++++ + drivers/input/mouse/psmouse.h | 1 + + drivers/input/mouse/synaptics.c | 17 +++-------------- + 3 files changed, 18 insertions(+), 14 deletions(-) + +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index cff065f6261c..bc1bc2653f15 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -462,6 +462,20 @@ static int psmouse_poll(struct psmouse *psmouse) + PSMOUSE_CMD_POLL | (psmouse->pktsize << 8)); + } + ++/* ++ * psmouse_matches_pnp_id - check if psmouse matches one of the passed in ids. ++ */ ++bool psmouse_matches_pnp_id(struct psmouse *psmouse, const char * const ids[]) ++{ ++ int i; ++ ++ if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4)) ++ for (i = 0; ids[i]; i++) ++ if (strstr(psmouse->ps2dev.serio->firmware_id, ids[i])) ++ return true; ++ ++ return false; ++} + + /* + * Genius NetMouse magic init. +diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h +index 2f0b39d59a9b..f4cf664c7db3 100644 +--- a/drivers/input/mouse/psmouse.h ++++ b/drivers/input/mouse/psmouse.h +@@ -108,6 +108,7 @@ void psmouse_set_resolution(struct psmouse *psmouse, unsigned int resolution); + psmouse_ret_t psmouse_process_byte(struct psmouse *psmouse); + int psmouse_activate(struct psmouse *psmouse); + int psmouse_deactivate(struct psmouse *psmouse); ++bool psmouse_matches_pnp_id(struct psmouse *psmouse, const char * const ids[]); + + struct psmouse_attribute { + struct device_attribute dattr; +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index e8573c68f77e..854caca6e86e 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -185,18 +185,6 @@ static const char * const topbuttonpad_pnp_ids[] = { + NULL + }; + +-static bool matches_pnp_id(struct psmouse *psmouse, const char * const ids[]) +-{ +- int i; +- +- if (!strncmp(psmouse->ps2dev.serio->firmware_id, "PNP:", 4)) +- for (i = 0; ids[i]; i++) +- if (strstr(psmouse->ps2dev.serio->firmware_id, ids[i])) +- return true; +- +- return false; +-} +- + /***************************************************************************** + * Synaptics communications functions + ****************************************************************************/ +@@ -362,7 +350,8 @@ static int synaptics_resolution(struct psmouse *psmouse) + } + + for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) { +- if (matches_pnp_id(psmouse, min_max_pnpid_table[i].pnp_ids)) { ++ if (psmouse_matches_pnp_id(psmouse, ++ min_max_pnpid_table[i].pnp_ids)) { + priv->x_min = min_max_pnpid_table[i].x_min; + priv->x_max = min_max_pnpid_table[i].x_max; + priv->y_min = min_max_pnpid_table[i].y_min; +@@ -1456,7 +1445,7 @@ static void set_input_params(struct psmouse *psmouse, + + if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) { + __set_bit(INPUT_PROP_BUTTONPAD, dev->propbit); +- if (matches_pnp_id(psmouse, topbuttonpad_pnp_ids)) ++ if (psmouse_matches_pnp_id(psmouse, topbuttonpad_pnp_ids)) + __set_bit(INPUT_PROP_TOPBUTTONPAD, dev->propbit); + /* Clickpads report only left button */ + __clear_bit(BTN_RIGHT, dev->keybit); +-- +1.9.3 + diff --git a/psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch b/psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch new file mode 100644 index 000000000..3282cc6ba --- /dev/null +++ b/psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch @@ -0,0 +1,159 @@ +From 4ab16f30317966f892342e8821a6dc26070d1a06 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 27 Jun 2014 18:50:33 +0200 +Subject: [PATCH 3/3] psmouse: Add support for detecting FocalTech PS/2 + touchpads + +The Asus X450 and X550 laptops use a PS/2 touchpad from a new manufacturer +called FocalTech: + +https://bugzilla.kernel.org/show_bug.cgi?id=77391 +https://bugzilla.redhat.com/show_bug.cgi?id=1110011 + +The protocol for these devices is not known at this time, but even without +knowing the protocol they need some special handling. They get upset by some +of our other PS/2 device probing, and once upset generate random mouse events +making things unusable even with an external mouse. + +This patch adds detection of these devices based on their pnp ids, and when +they are detected, treats them as a bare ps/2 mouse. Doing things this way +they at least work in their ps/2 mouse emulation mode. + +Signed-off-by: Hans de Goede +--- + drivers/input/mouse/Makefile | 2 +- + drivers/input/mouse/focaltech.c | 44 ++++++++++++++++++++++++++++++++++++++ + drivers/input/mouse/focaltech.h | 21 ++++++++++++++++++ + drivers/input/mouse/psmouse-base.c | 10 +++++++++ + 4 files changed, 76 insertions(+), 1 deletion(-) + create mode 100644 drivers/input/mouse/focaltech.c + create mode 100644 drivers/input/mouse/focaltech.h + +diff --git a/drivers/input/mouse/Makefile b/drivers/input/mouse/Makefile +index c25efdb3f288..dda507f8b3a2 100644 +--- a/drivers/input/mouse/Makefile ++++ b/drivers/input/mouse/Makefile +@@ -23,7 +23,7 @@ obj-$(CONFIG_MOUSE_SYNAPTICS_I2C) += synaptics_i2c.o + obj-$(CONFIG_MOUSE_SYNAPTICS_USB) += synaptics_usb.o + obj-$(CONFIG_MOUSE_VSXXXAA) += vsxxxaa.o + +-psmouse-objs := psmouse-base.o synaptics.o ++psmouse-objs := psmouse-base.o synaptics.o focaltech.o + + psmouse-$(CONFIG_MOUSE_PS2_ALPS) += alps.o + psmouse-$(CONFIG_MOUSE_PS2_ELANTECH) += elantech.o +diff --git a/drivers/input/mouse/focaltech.c b/drivers/input/mouse/focaltech.c +new file mode 100644 +index 000000000000..d83a23554d63 +--- /dev/null ++++ b/drivers/input/mouse/focaltech.c +@@ -0,0 +1,44 @@ ++/* ++ * Focaltech TouchPad PS/2 mouse driver ++ * ++ * Copyright (c) 2014 Red Hat Inc. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * Red Hat authors: ++ * ++ * Hans de Goede ++ */ ++ ++/* ++ * The Focaltech PS/2 touchpad protocol is unknown. This drivers deals with ++ * detection only, to avoid further detection attempts confusing the touchpad ++ * this way it at least works in PS/2 mouse compatibility mode. ++ */ ++ ++#include ++#include ++#include "psmouse.h" ++ ++static const char * const focaltech_pnp_ids[] = { ++ "FLT0101", ++ "FLT0102", ++ "FLT0103", ++ NULL ++}; ++ ++int focaltech_detect(struct psmouse *psmouse, bool set_properties) ++{ ++ if (!psmouse_matches_pnp_id(psmouse, focaltech_pnp_ids)) ++ return -ENODEV; ++ ++ if (set_properties) { ++ psmouse->vendor = "FocalTech"; ++ psmouse->name = "FocalTech Touchpad in mouse emulation mode"; ++ } ++ ++ return 0; ++} +diff --git a/drivers/input/mouse/focaltech.h b/drivers/input/mouse/focaltech.h +new file mode 100644 +index 000000000000..0d0fc49451fe +--- /dev/null ++++ b/drivers/input/mouse/focaltech.h +@@ -0,0 +1,21 @@ ++/* ++ * Focaltech TouchPad PS/2 mouse driver ++ * ++ * Copyright (c) 2014 Red Hat Inc. ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * Red Hat authors: ++ * ++ * Hans de Goede ++ */ ++ ++#ifndef _FOCALTECH_H ++#define _FOCALTECH_H ++ ++int focaltech_detect(struct psmouse *psmouse, bool set_properties); ++ ++#endif +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index bc1bc2653f15..0730209cddb0 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -35,6 +35,7 @@ + #include "elantech.h" + #include "sentelic.h" + #include "cypress_ps2.h" ++#include "focaltech.h" + + #define DRIVER_DESC "PS/2 mouse driver" + +@@ -720,6 +721,13 @@ static int psmouse_extensions(struct psmouse *psmouse, + { + bool synaptics_hardware = false; + ++/* Always check for focaltech, this is safe as it uses pnp-id matching */ ++ if (psmouse_do_detect(focaltech_detect, psmouse, set_properties) == 0) { ++ /* Not supported yet, use bare protocol */ ++ psmouse_max_proto = max_proto = PSMOUSE_PS2; ++ goto reset_to_defaults; ++ } ++ + /* + * We always check for lifebook because it does not disturb mouse + * (it only checks DMI information). +@@ -871,6 +879,8 @@ static int psmouse_extensions(struct psmouse *psmouse, + } + } + ++reset_to_defaults: ++ + /* + * Reset to defaults in case the device got confused by extended + * protocol probes. Note that we follow up with full reset because +-- +1.9.3 + From 2d278dc85a6b6fbe8fd1531ea7daeb73537b9cb4 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 12 Sep 2014 12:43:27 -0400 Subject: [PATCH 004/283] CVE-2014-3181 HID: OOB write in magicmouse driver (rhbz 1141173 1141179) --- ...anity-check-report-size-in-raw_event.patch | 51 +++++++++++++++++++ kernel.spec | 9 ++++ 2 files changed, 60 insertions(+) create mode 100644 HID-magicmouse-sanity-check-report-size-in-raw_event.patch diff --git a/HID-magicmouse-sanity-check-report-size-in-raw_event.patch b/HID-magicmouse-sanity-check-report-size-in-raw_event.patch new file mode 100644 index 000000000..32863aff6 --- /dev/null +++ b/HID-magicmouse-sanity-check-report-size-in-raw_event.patch @@ -0,0 +1,51 @@ +From c54def7bd64d7c0b6993336abcffb8444795bf38 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Wed, 27 Aug 2014 09:12:24 +0200 +Subject: [PATCH] HID: magicmouse: sanity check report size in raw_event() + callback + +The report passed to us from transport driver could potentially be +arbitrarily large, therefore we better sanity-check it so that +magicmouse_emit_touch() gets only valid values of raw_id. + +Bugzilla: 1141179 +Upstream-status: 3.17 and CC'd stable + +Cc: stable@vger.kernel.org +Reported-by: Steven Vittitoe +Signed-off-by: Jiri Kosina +--- + drivers/hid/hid-magicmouse.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c +index ecc2cbf300cc..29a74c1efcb8 100644 +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, + if (size < 4 || ((size - 4) % 9) != 0) + return 0; + npoints = (size - 4) / 9; ++ if (npoints > 15) { ++ hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n", ++ size); ++ return 0; ++ } + msc->ntouches = 0; + for (ii = 0; ii < npoints; ii++) + magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); +@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, + if (size < 6 || ((size - 6) % 8) != 0) + return 0; + npoints = (size - 6) / 8; ++ if (npoints > 15) { ++ hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n", ++ size); ++ return 0; ++ } + msc->ntouches = 0; + for (ii = 0; ii < npoints; ii++) + magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); +-- +2.1.0 + diff --git a/kernel.spec b/kernel.spec index 439b7de24..ba4d295e2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -637,6 +637,9 @@ Patch26021: i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch Patch26022: psmouse-Add-psmouse_matches_pnp_id-helper-function.patch Patch26023: psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch +#CVE-2014-3181 rhbz 1141179 1141173 +Patch26024: HID-magicmouse-sanity-check-report-size-in-raw_event.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1367,6 +1370,9 @@ ApplyPatch i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch ApplyPatch psmouse-Add-psmouse_matches_pnp_id-helper-function.patch ApplyPatch psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch +#CVE-2014-3181 rhbz 1141179 1141173 +ApplyPatch HID-magicmouse-sanity-check-report-size-in-raw_event.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2243,6 +2249,9 @@ fi # ||----w | # || || %changelog +* Fri Sep 12 2014 Josh Boyer +- CVE-2014-3181 HID: OOB write in magicmouse driver (rhbz 1141173 1141179) + * Thu Sep 11 2014 Josh Boyer - Add support for touchpad in Asus X450 and X550 (rhbz 1110011) From 80242f8df804e5603f458392b4df858ff954ed4f Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 15 Sep 2014 09:34:06 -0400 Subject: [PATCH 005/283] CVE-2014-3186 HID: memory corruption via OOB write (rhbz 1141407 1141410) --- ...ty-check-report-size-in-raw_event-ca.patch | 41 +++++++++++++++++++ kernel.spec | 9 ++++ 2 files changed, 50 insertions(+) create mode 100644 HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch diff --git a/HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch b/HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch new file mode 100644 index 000000000..456d91c9c --- /dev/null +++ b/HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch @@ -0,0 +1,41 @@ +From 844817e47eef14141cf59b8d5ac08dd11c0a9189 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Wed, 27 Aug 2014 09:13:15 +0200 +Subject: [PATCH] HID: picolcd: sanity check report size in raw_event() + callback + +The report passed to us from transport driver could potentially be +arbitrarily large, therefore we better sanity-check it so that raw_data +that we hold in picolcd_pending structure are always kept within proper +bounds. + +Bugzilla: 1141410 +Upstream-status: 3.17 and CC'd to stable + +Cc: stable@vger.kernel.org +Reported-by: Steven Vittitoe +Signed-off-by: Jiri Kosina +--- + drivers/hid/hid-picolcd_core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c +index acbb021065ec..020df3c2e8b4 100644 +--- a/drivers/hid/hid-picolcd_core.c ++++ b/drivers/hid/hid-picolcd_core.c +@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev, + if (!data) + return 1; + ++ if (size > 64) { ++ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n", ++ size); ++ return 0; ++ } ++ + if (report->id == REPORT_KEY_STATE) { + if (data->input_keys) + ret = picolcd_raw_keypad(data, report, raw_data+1, size-1); +-- +2.1.0 + diff --git a/kernel.spec b/kernel.spec index ba4d295e2..4840eb646 100644 --- a/kernel.spec +++ b/kernel.spec @@ -640,6 +640,9 @@ Patch26023: psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch #CVE-2014-3181 rhbz 1141179 1141173 Patch26024: HID-magicmouse-sanity-check-report-size-in-raw_event.patch +#CVE-2014-3186 rhbz 1141407 1141410 +Patch26025: HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1373,6 +1376,9 @@ ApplyPatch psmouse-Add-support-for-detecting-FocalTech-PS-2-tou.patch #CVE-2014-3181 rhbz 1141179 1141173 ApplyPatch HID-magicmouse-sanity-check-report-size-in-raw_event.patch +#CVE-2014-3186 rhbz 1141407 1141410 +ApplyPatch HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2249,6 +2255,9 @@ fi # ||----w | # || || %changelog +* Mon Sep 15 2014 Josh Boyer +- CVE-2014-3186 HID: memory corruption via OOB write (rhbz 1141407 1141410) + * Fri Sep 12 2014 Josh Boyer - CVE-2014-3181 HID: OOB write in magicmouse driver (rhbz 1141173 1141179) From ad8337e450137b2f5c814cf04d8a91445bcf90b9 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 15 Sep 2014 11:28:40 -0400 Subject: [PATCH 006/283] CVE-2014-XXXX udf: avoid infinite loop on indirect ICBs (rhbz 1141809 1141810) --- kernel.spec | 7 ++ ...te-loop-when-processing-indirect-ICB.patch | 92 +++++++++++++++++++ 2 files changed, 99 insertions(+) create mode 100644 udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch diff --git a/kernel.spec b/kernel.spec index 4840eb646..4d8c4d935 100644 --- a/kernel.spec +++ b/kernel.spec @@ -643,6 +643,9 @@ Patch26024: HID-magicmouse-sanity-check-report-size-in-raw_event.patch #CVE-2014-3186 rhbz 1141407 1141410 Patch26025: HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch +#CVE-2014-XXXX rhbz 1141809 1141810 +Patch26026: udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1379,6 +1382,9 @@ ApplyPatch HID-magicmouse-sanity-check-report-size-in-raw_event.patch #CVE-2014-3186 rhbz 1141407 1141410 ApplyPatch HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch +#CVE-2014-XXXX rhbz 1141809 1141810 +ApplyPatch udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2256,6 +2262,7 @@ fi # || || %changelog * Mon Sep 15 2014 Josh Boyer +- CVE-2014-XXXX udf: avoid infinite loop on indirect ICBs (rhbz 1141809 1141810) - CVE-2014-3186 HID: memory corruption via OOB write (rhbz 1141407 1141410) * Fri Sep 12 2014 Josh Boyer diff --git a/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch b/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch new file mode 100644 index 000000000..a8839661b --- /dev/null +++ b/udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch @@ -0,0 +1,92 @@ +From a45318b5ff8c505afcbf04a1c5fa7dbe426d9588 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 4 Sep 2014 14:06:55 +0200 +Subject: [PATCH] udf: Avoid infinite loop when processing indirect ICBs + +We did not implement any bound on number of indirect ICBs we follow when +loading inode. Thus corrupted medium could cause kernel to go into an +infinite loop, possibly causing a stack overflow. + +Fix the possible stack overflow by removing recursion from +__udf_read_inode() and limit number of indirect ICBs we follow to avoid +infinite loops. + +Bugzilla: 1141810 +Upstream-status: 3.17 + +Signed-off-by: Jan Kara +--- + fs/udf/inode.c | 35 +++++++++++++++++++++-------------- + 1 file changed, 21 insertions(+), 14 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 236cd48184c2..a932f7740b51 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1271,13 +1271,22 @@ update_time: + return 0; + } + ++/* ++ * Maximum length of linked list formed by ICB hierarchy. The chosen number is ++ * arbitrary - just that we hopefully don't limit any real use of rewritten ++ * inode on write-once media but avoid looping for too long on corrupted media. ++ */ ++#define UDF_MAX_ICB_NESTING 1024 ++ + static void __udf_read_inode(struct inode *inode) + { + struct buffer_head *bh = NULL; + struct fileEntry *fe; + uint16_t ident; + struct udf_inode_info *iinfo = UDF_I(inode); ++ unsigned int indirections = 0; + ++reread: + /* + * Set defaults, but the inode is still incomplete! + * Note: get_new_inode() sets the following on a new inode: +@@ -1314,28 +1323,26 @@ static void __udf_read_inode(struct inode *inode) + ibh = udf_read_ptagged(inode->i_sb, &iinfo->i_location, 1, + &ident); + if (ident == TAG_IDENT_IE && ibh) { +- struct buffer_head *nbh = NULL; + struct kernel_lb_addr loc; + struct indirectEntry *ie; + + ie = (struct indirectEntry *)ibh->b_data; + loc = lelb_to_cpu(ie->indirectICB.extLocation); + +- if (ie->indirectICB.extLength && +- (nbh = udf_read_ptagged(inode->i_sb, &loc, 0, +- &ident))) { +- if (ident == TAG_IDENT_FE || +- ident == TAG_IDENT_EFE) { +- memcpy(&iinfo->i_location, +- &loc, +- sizeof(struct kernel_lb_addr)); +- brelse(bh); +- brelse(ibh); +- brelse(nbh); +- __udf_read_inode(inode); ++ if (ie->indirectICB.extLength) { ++ brelse(bh); ++ brelse(ibh); ++ memcpy(&iinfo->i_location, &loc, ++ sizeof(struct kernel_lb_addr)); ++ if (++indirections > UDF_MAX_ICB_NESTING) { ++ udf_err(inode->i_sb, ++ "too many ICBs in ICB hierarchy" ++ " (max %d supported)\n", ++ UDF_MAX_ICB_NESTING); ++ make_bad_inode(inode); + return; + } +- brelse(nbh); ++ goto reread; + } + } + brelse(ibh); +-- +2.1.0 + From 37af7eab0be06081b92a6359b5cc67da455a4fd2 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 16 Sep 2014 07:45:51 -0400 Subject: [PATCH 007/283] Fixup CVE number --- kernel.spec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel.spec b/kernel.spec index 4d8c4d935..c9c31ff34 100644 --- a/kernel.spec +++ b/kernel.spec @@ -643,7 +643,7 @@ Patch26024: HID-magicmouse-sanity-check-report-size-in-raw_event.patch #CVE-2014-3186 rhbz 1141407 1141410 Patch26025: HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch -#CVE-2014-XXXX rhbz 1141809 1141810 +#CVE-2014-6410 rhbz 1141809 1141810 Patch26026: udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel @@ -1382,7 +1382,7 @@ ApplyPatch HID-magicmouse-sanity-check-report-size-in-raw_event.patch #CVE-2014-3186 rhbz 1141407 1141410 ApplyPatch HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch -#CVE-2014-XXXX rhbz 1141809 1141810 +#CVE-2014-6410 rhbz 1141809 1141810 ApplyPatch udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch %if 0%{?aarch64patches} @@ -2262,7 +2262,7 @@ fi # || || %changelog * Mon Sep 15 2014 Josh Boyer -- CVE-2014-XXXX udf: avoid infinite loop on indirect ICBs (rhbz 1141809 1141810) +- CVE-2014-6410 udf: avoid infinite loop on indirect ICBs (rhbz 1141809 1141810) - CVE-2014-3186 HID: memory corruption via OOB write (rhbz 1141407 1141410) * Fri Sep 12 2014 Josh Boyer From 304c6c106fe9ab86c9456d6f137a41501c5c651c Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Wed, 17 Sep 2014 16:35:50 -0400 Subject: [PATCH 008/283] Linux v3.16.3 --- ...tion-condition-in-assoc-array-garbag.patch | 95 --- kernel.spec | 19 +- namespaces-remount-fixes.patch | 625 ------------------ sources | 2 +- 4 files changed, 6 insertions(+), 735 deletions(-) delete mode 100644 KEYS-Fix-termination-condition-in-assoc-array-garbag.patch delete mode 100644 namespaces-remount-fixes.patch diff --git a/KEYS-Fix-termination-condition-in-assoc-array-garbag.patch b/KEYS-Fix-termination-condition-in-assoc-array-garbag.patch deleted file mode 100644 index 3afe63123..000000000 --- a/KEYS-Fix-termination-condition-in-assoc-array-garbag.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 11646ff9e6874d205ab92af605db6b90fbe214d1 Mon Sep 17 00:00:00 2001 -From: David Howells -Date: Tue, 9 Sep 2014 19:12:32 +0100 -Subject: [PATCH] KEYS: Fix termination condition in assoc array garbage - collection - -It is possible for an associative array to end up with a shortcut node at the -root of the tree, if there are more than fan-out nodes in the tree, but they -all crowd into the same slot in the lowest level (ie. they all have the same -first nibble of their index keys). - -When assoc_array_gc() returns back up the tree after scanning some leaves, it -can fall off of the root and crash because it assumes that the back pointer -from a shortcut (after label ascend_old_tree) must point to a normal node - -which isn't true of a shortcut node at the root. - -Should we find we're ascending rootwards over a shortcut, we should check to -see if the backpointer is zero - and if it is, we have completed the scan. - -This particular bug cannot occur if the root node is not a shortcut - ie. if -you have fewer than 17 keys in a keyring or if you have at least two keys that -sit into separate slots (eg. a keyring and a non keyring). - -If we do fall off of the top of the tree, we get the following oops: - - BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 - IP: [] assoc_array_gc+0x2f7/0x540 - PGD dae15067 PUD cfc24067 PMD 0 - Oops: 0000 [#1] SMP - Modules linked in: xt_nat xt_mark nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_rpfilter ip6t_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables ip6table_ni - CPU: 0 PID: 26011 Comm: kworker/0:1 Not tainted 3.14.9-200.fc20.x86_64 #1 - Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 - Workqueue: events key_garbage_collector - task: ffff8800918bd580 ti: ffff8800aac14000 task.ti: ffff8800aac14000 - RIP: 0010:[] [] assoc_array_gc+0x2f7/0x540 - RSP: 0018:ffff8800aac15d40 EFLAGS: 00010206 - RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8800aaecacc0 - RDX: ffff8800daecf440 RSI: 0000000000000001 RDI: ffff8800aadc2bc0 - RBP: ffff8800aac15da8 R08: 0000000000000001 R09: 0000000000000003 - R10: ffffffff8136ccc7 R11: 0000000000000000 R12: 0000000000000000 - R13: 0000000000000000 R14: 0000000000000070 R15: 0000000000000001 - FS: 0000000000000000(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b - CR2: 0000000000000018 CR3: 00000000db10d000 CR4: 00000000000006f0 - Stack: - ffff8800aac15d50 0000000000000011 ffff8800aac15db8 ffffffff812e2a70 - ffff880091a00600 0000000000000000 ffff8800aadc2bc3 00000000cd42c987 - ffff88003702df20 ffff88003702dfa0 0000000053b65c09 ffff8800aac15fd8 - Call Trace: - [] ? keyring_detect_cycle_iterator+0x30/0x30 - [] keyring_gc+0x75/0x80 - [] key_garbage_collector+0x154/0x3c0 - [] process_one_work+0x176/0x430 - [] worker_thread+0x11b/0x3a0 - [] ? rescuer_thread+0x3b0/0x3b0 - [] kthread+0xd8/0xf0 - [] ? insert_kthread_work+0x40/0x40 - [] ret_from_fork+0x7c/0xb0 - [] ? insert_kthread_work+0x40/0x40 - Code: 08 4c 8b 22 0f 84 bf 00 00 00 41 83 c7 01 49 83 e4 fc 41 83 ff 0f 4c 89 65 c0 0f 8f 5a fe ff ff 48 8b 45 c0 4d 63 cf 49 83 c1 02 <4e> 8b 34 c8 4d 85 f6 0f 84 be 00 00 00 41 f6 c6 01 0f 84 92 - RIP [] assoc_array_gc+0x2f7/0x540 - RSP - CR2: 0000000000000018 - ---[ end trace 1129028a088c0cbd ]--- - -Bugzilla: 1116347 -Upstream-status: ?? - -Signed-off-by: David Howells ---- - lib/assoc_array.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/lib/assoc_array.c b/lib/assoc_array.c -index ae146f0734eb..2404d03e251a 100644 ---- a/lib/assoc_array.c -+++ b/lib/assoc_array.c -@@ -1723,11 +1723,13 @@ ascend_old_tree: - shortcut = assoc_array_ptr_to_shortcut(ptr); - slot = shortcut->parent_slot; - cursor = shortcut->back_pointer; -+ if (!cursor) -+ goto gc_complete; - } else { - slot = node->parent_slot; - cursor = ptr; - } -- BUG_ON(!ptr); -+ BUG_ON(!cursor); - node = assoc_array_ptr_to_node(cursor); - slot++; - goto continue_node; --- -1.9.3 - diff --git a/kernel.spec b/kernel.spec index c9c31ff34..cd5eeec3f 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 300 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -54,7 +54,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 2 +%define stable_update 3 # Set rpm version accordingly %if 0%{?stable_update} %define stablerev %{stable_update} @@ -623,15 +623,9 @@ Patch25109: revert-input-wacom-testing-result-shows-get_report-is-unnecessary.pa #rhbz 1021036, submitted upstream Patch25110: 0001-ideapad-laptop-Change-Lenovo-Yoga-2-series-rfkill-ha.patch -#CVE-2014-{5206,5207} rhbz 1129662 1129669 -Patch25119: namespaces-remount-fixes.patch - #rhbz 1134969 Patch26019: Input-wacom-Add-support-for-the-Cintiq-Companion.patch -# CVE-2014-3631 rhbz 1116347 -Patch26020: KEYS-Fix-termination-condition-in-assoc-array-garbag.patch - #rhbz 1110011 Patch26021: i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch Patch26022: psmouse-Add-psmouse_matches_pnp_id-helper-function.patch @@ -1362,15 +1356,9 @@ ApplyPatch revert-input-wacom-testing-result-shows-get_report-is-unnecessary.pat #rhbz 1021036, submitted upstream ApplyPatch 0001-ideapad-laptop-Change-Lenovo-Yoga-2-series-rfkill-ha.patch -#CVE-2014-{5206,5207} rhbz 1129662 1129669 -ApplyPatch namespaces-remount-fixes.patch - #rhbz 1134969 ApplyPatch Input-wacom-Add-support-for-the-Cintiq-Companion.patch -# CVE-2014-3631 rhbz 1116347 -ApplyPatch KEYS-Fix-termination-condition-in-assoc-array-garbag.patch - #rhbz 1110011 ApplyPatch i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch ApplyPatch psmouse-Add-psmouse_matches_pnp_id-helper-function.patch @@ -2261,6 +2249,9 @@ fi # ||----w | # || || %changelog +* Wed Sep 17 2014 Josh Boyer - 3.16.3-300 +- Linux v3.16.3 + * Mon Sep 15 2014 Josh Boyer - CVE-2014-6410 udf: avoid infinite loop on indirect ICBs (rhbz 1141809 1141810) - CVE-2014-3186 HID: memory corruption via OOB write (rhbz 1141407 1141410) diff --git a/namespaces-remount-fixes.patch b/namespaces-remount-fixes.patch deleted file mode 100644 index 2e2800cb8..000000000 --- a/namespaces-remount-fixes.patch +++ /dev/null @@ -1,625 +0,0 @@ -Bugzilla: 1129669 -Upstream-status: 3.17 and CC'd to stable - -From a6138db815df5ee542d848318e5dae681590fccd Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Mon, 28 Jul 2014 16:26:53 -0700 -Subject: [PATCH 1/5] mnt: Only change user settable mount flags in remount - -Kenton Varda discovered that by remounting a -read-only bind mount read-only in a user namespace the -MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user -to the remount a read-only mount read-write. - -Correct this by replacing the mask of mount flags to preserve -with a mask of mount flags that may be changed, and preserve -all others. This ensures that any future bugs with this mask and -remount will fail in an easy to detect way where new mount flags -simply won't change. - -Cc: stable@vger.kernel.org -Acked-by: Serge E. Hallyn -Signed-off-by: "Eric W. Biederman" ---- - fs/namespace.c | 2 +- - include/linux/mount.h | 4 +++- - 2 files changed, 4 insertions(+), 2 deletions(-) - -diff --git a/fs/namespace.c b/fs/namespace.c -index 7187d01329c3..cb40449ea0df 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -1937,7 +1937,7 @@ static int do_remount(struct path *path, int flags, int mnt_flags, - err = do_remount_sb(sb, flags, data, 0); - if (!err) { - lock_mount_hash(); -- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK; -+ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK; - mnt->mnt.mnt_flags = mnt_flags; - touch_mnt_namespace(mnt->mnt_ns); - unlock_mount_hash(); -diff --git a/include/linux/mount.h b/include/linux/mount.h -index 839bac270904..b637a89e1fae 100644 ---- a/include/linux/mount.h -+++ b/include/linux/mount.h -@@ -42,7 +42,9 @@ struct mnt_namespace; - * flag, consider how it interacts with shared mounts. - */ - #define MNT_SHARED_MASK (MNT_UNBINDABLE) --#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE) -+#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ -+ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ -+ | MNT_READONLY) - - #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ - MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED) --- -2.0.4 - - -From 07b645589dcda8b7a5249e096fece2a67556f0f4 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Mon, 28 Jul 2014 17:10:56 -0700 -Subject: [PATCH 2/5] mnt: Move the test for MNT_LOCK_READONLY from - change_mount_flags into do_remount - -There are no races as locked mount flags are guaranteed to never change. - -Moving the test into do_remount makes it more visible, and ensures all -filesystem remounts pass the MNT_LOCK_READONLY permission check. This -second case is not an issue today as filesystem remounts are guarded -by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged -mount namespaces, but it could become an issue in the future. - -Cc: stable@vger.kernel.org -Acked-by: Serge E. Hallyn -Signed-off-by: "Eric W. Biederman" ---- - fs/namespace.c | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/fs/namespace.c b/fs/namespace.c -index cb40449ea0df..1105a577a14f 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -1896,9 +1896,6 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags) - if (readonly_request == __mnt_is_readonly(mnt)) - return 0; - -- if (mnt->mnt_flags & MNT_LOCK_READONLY) -- return -EPERM; -- - if (readonly_request) - error = mnt_make_readonly(real_mount(mnt)); - else -@@ -1924,6 +1921,16 @@ static int do_remount(struct path *path, int flags, int mnt_flags, - if (path->dentry != path->mnt->mnt_root) - return -EINVAL; - -+ /* Don't allow changing of locked mnt flags. -+ * -+ * No locks need to be held here while testing the various -+ * MNT_LOCK flags because those flags can never be cleared -+ * once they are set. -+ */ -+ if ((mnt->mnt.mnt_flags & MNT_LOCK_READONLY) && -+ !(mnt_flags & MNT_READONLY)) { -+ return -EPERM; -+ } - err = security_sb_remount(sb, data); - if (err) - return err; --- -2.0.4 - - -From 9566d6742852c527bf5af38af5cbb878dad75705 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Mon, 28 Jul 2014 17:26:07 -0700 -Subject: [PATCH 3/5] mnt: Correct permission checks in do_remount - -While invesgiating the issue where in "mount --bind -oremount,ro ..." -would result in later "mount --bind -oremount,rw" succeeding even if -the mount started off locked I realized that there are several -additional mount flags that should be locked and are not. - -In particular MNT_NOSUID, MNT_NODEV, MNT_NOEXEC, and the atime -flags in addition to MNT_READONLY should all be locked. These -flags are all per superblock, can all be changed with MS_BIND, -and should not be changable if set by a more privileged user. - -The following additions to the current logic are added in this patch. -- nosuid may not be clearable by a less privileged user. -- nodev may not be clearable by a less privielged user. -- noexec may not be clearable by a less privileged user. -- atime flags may not be changeable by a less privileged user. - -The logic with atime is that always setting atime on access is a -global policy and backup software and auditing software could break if -atime bits are not updated (when they are configured to be updated), -and serious performance degradation could result (DOS attack) if atime -updates happen when they have been explicitly disabled. Therefore an -unprivileged user should not be able to mess with the atime bits set -by a more privileged user. - -The additional restrictions are implemented with the addition of -MNT_LOCK_NOSUID, MNT_LOCK_NODEV, MNT_LOCK_NOEXEC, and MNT_LOCK_ATIME -mnt flags. - -Taken together these changes and the fixes for MNT_LOCK_READONLY -should make it safe for an unprivileged user to create a user -namespace and to call "mount --bind -o remount,... ..." without -the danger of mount flags being changed maliciously. - -Cc: stable@vger.kernel.org -Acked-by: Serge E. Hallyn -Signed-off-by: "Eric W. Biederman" ---- - fs/namespace.c | 36 +++++++++++++++++++++++++++++++++--- - include/linux/mount.h | 5 +++++ - 2 files changed, 38 insertions(+), 3 deletions(-) - -diff --git a/fs/namespace.c b/fs/namespace.c -index 1105a577a14f..dd9c93b5a9d5 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -890,8 +890,21 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, - - mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); - /* Don't allow unprivileged users to change mount flags */ -- if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY)) -- mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; -+ if (flag & CL_UNPRIVILEGED) { -+ mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; -+ -+ if (mnt->mnt.mnt_flags & MNT_READONLY) -+ mnt->mnt.mnt_flags |= MNT_LOCK_READONLY; -+ -+ if (mnt->mnt.mnt_flags & MNT_NODEV) -+ mnt->mnt.mnt_flags |= MNT_LOCK_NODEV; -+ -+ if (mnt->mnt.mnt_flags & MNT_NOSUID) -+ mnt->mnt.mnt_flags |= MNT_LOCK_NOSUID; -+ -+ if (mnt->mnt.mnt_flags & MNT_NOEXEC) -+ mnt->mnt.mnt_flags |= MNT_LOCK_NOEXEC; -+ } - - /* Don't allow unprivileged users to reveal what is under a mount */ - if ((flag & CL_UNPRIVILEGED) && list_empty(&old->mnt_expire)) -@@ -1931,6 +1944,23 @@ static int do_remount(struct path *path, int flags, int mnt_flags, - !(mnt_flags & MNT_READONLY)) { - return -EPERM; - } -+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NODEV) && -+ !(mnt_flags & MNT_NODEV)) { -+ return -EPERM; -+ } -+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOSUID) && -+ !(mnt_flags & MNT_NOSUID)) { -+ return -EPERM; -+ } -+ if ((mnt->mnt.mnt_flags & MNT_LOCK_NOEXEC) && -+ !(mnt_flags & MNT_NOEXEC)) { -+ return -EPERM; -+ } -+ if ((mnt->mnt.mnt_flags & MNT_LOCK_ATIME) && -+ ((mnt->mnt.mnt_flags & MNT_ATIME_MASK) != (mnt_flags & MNT_ATIME_MASK))) { -+ return -EPERM; -+ } -+ - err = security_sb_remount(sb, data); - if (err) - return err; -@@ -2129,7 +2159,7 @@ static int do_new_mount(struct path *path, const char *fstype, int flags, - */ - if (!(type->fs_flags & FS_USERNS_DEV_MOUNT)) { - flags |= MS_NODEV; -- mnt_flags |= MNT_NODEV; -+ mnt_flags |= MNT_NODEV | MNT_LOCK_NODEV; - } - } - -diff --git a/include/linux/mount.h b/include/linux/mount.h -index b637a89e1fae..b0c1e6574e7f 100644 ---- a/include/linux/mount.h -+++ b/include/linux/mount.h -@@ -45,12 +45,17 @@ struct mnt_namespace; - #define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \ - | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \ - | MNT_READONLY) -+#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME ) - - #define MNT_INTERNAL_FLAGS (MNT_SHARED | MNT_WRITE_HOLD | MNT_INTERNAL | \ - MNT_DOOMED | MNT_SYNC_UMOUNT | MNT_MARKED) - - #define MNT_INTERNAL 0x4000 - -+#define MNT_LOCK_ATIME 0x040000 -+#define MNT_LOCK_NOEXEC 0x080000 -+#define MNT_LOCK_NOSUID 0x100000 -+#define MNT_LOCK_NODEV 0x200000 - #define MNT_LOCK_READONLY 0x400000 - #define MNT_LOCKED 0x800000 - #define MNT_DOOMED 0x1000000 --- -2.0.4 - - -From ffbc6f0ead47fa5a1dc9642b0331cb75c20a640e Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Mon, 28 Jul 2014 17:36:04 -0700 -Subject: [PATCH 4/5] mnt: Change the default remount atime from relatime to - the existing value - -Since March 2009 the kernel has treated the state that if no -MS_..ATIME flags are passed then the kernel defaults to relatime. - -Defaulting to relatime instead of the existing atime state during a -remount is silly, and causes problems in practice for people who don't -specify any MS_...ATIME flags and to get the default filesystem atime -setting. Those users may encounter a permission error because the -default atime setting does not work. - -A default that does not work and causes permission problems is -ridiculous, so preserve the existing value to have a default -atime setting that is always guaranteed to work. - -Using the default atime setting in this way is particularly -interesting for applications built to run in restricted userspace -environments without /proc mounted, as the existing atime mount -options of a filesystem can not be read from /proc/mounts. - -In practice this fixes user space that uses the default atime -setting on remount that are broken by the permission checks -keeping less privileged users from changing more privileged users -atime settings. - -Cc: stable@vger.kernel.org -Acked-by: Serge E. Hallyn -Signed-off-by: "Eric W. Biederman" ---- - fs/namespace.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/fs/namespace.c b/fs/namespace.c -index dd9c93b5a9d5..7886176232c1 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2473,6 +2473,14 @@ long do_mount(const char *dev_name, const char *dir_name, - if (flags & MS_RDONLY) - mnt_flags |= MNT_READONLY; - -+ /* The default atime for remount is preservation */ -+ if ((flags & MS_REMOUNT) && -+ ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME | -+ MS_STRICTATIME)) == 0)) { -+ mnt_flags &= ~MNT_ATIME_MASK; -+ mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK; -+ } -+ - flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN | - MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT | - MS_STRICTATIME); --- -2.0.4 - - -From db181ce011e3c033328608299cd6fac06ea50130 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Tue, 29 Jul 2014 15:50:44 -0700 -Subject: [PATCH 5/5] mnt: Add tests for unprivileged remount cases that have - found to be faulty - -Kenton Varda discovered that by remounting a -read-only bind mount read-only in a user namespace the -MNT_LOCK_READONLY bit would be cleared, allowing an unprivileged user -to the remount a read-only mount read-write. - -Upon review of the code in remount it was discovered that the code allowed -nosuid, noexec, and nodev to be cleared. It was also discovered that -the code was allowing the per mount atime flags to be changed. - -The first naive patch to fix these issues contained the flaw that using -default atime settings when remounting a filesystem could be disallowed. - -To avoid this problems in the future add tests to ensure unprivileged -remounts are succeeding and failing at the appropriate times. - -Cc: stable@vger.kernel.org -Acked-by: Serge E. Hallyn -Signed-off-by: "Eric W. Biederman" ---- - tools/testing/selftests/Makefile | 1 + - tools/testing/selftests/mount/Makefile | 17 ++ - .../selftests/mount/unprivileged-remount-test.c | 242 +++++++++++++++++++++ - 3 files changed, 260 insertions(+) - create mode 100644 tools/testing/selftests/mount/Makefile - create mode 100644 tools/testing/selftests/mount/unprivileged-remount-test.c - -diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile -index e66e710cc595..0a8a9db43d34 100644 ---- a/tools/testing/selftests/Makefile -+++ b/tools/testing/selftests/Makefile -@@ -4,6 +4,7 @@ TARGETS += efivarfs - TARGETS += kcmp - TARGETS += memory-hotplug - TARGETS += mqueue -+TARGETS += mount - TARGETS += net - TARGETS += ptrace - TARGETS += timers -diff --git a/tools/testing/selftests/mount/Makefile b/tools/testing/selftests/mount/Makefile -new file mode 100644 -index 000000000000..337d853c2b72 ---- /dev/null -+++ b/tools/testing/selftests/mount/Makefile -@@ -0,0 +1,17 @@ -+# Makefile for mount selftests. -+ -+all: unprivileged-remount-test -+ -+unprivileged-remount-test: unprivileged-remount-test.c -+ gcc -Wall -O2 unprivileged-remount-test.c -o unprivileged-remount-test -+ -+# Allow specific tests to be selected. -+test_unprivileged_remount: unprivileged-remount-test -+ @if [ -f /proc/self/uid_map ] ; then ./unprivileged-remount-test ; fi -+ -+run_tests: all test_unprivileged_remount -+ -+clean: -+ rm -f unprivileged-remount-test -+ -+.PHONY: all test_unprivileged_remount -diff --git a/tools/testing/selftests/mount/unprivileged-remount-test.c b/tools/testing/selftests/mount/unprivileged-remount-test.c -new file mode 100644 -index 000000000000..1b3ff2fda4d0 ---- /dev/null -+++ b/tools/testing/selftests/mount/unprivileged-remount-test.c -@@ -0,0 +1,242 @@ -+#define _GNU_SOURCE -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#ifndef CLONE_NEWNS -+# define CLONE_NEWNS 0x00020000 -+#endif -+#ifndef CLONE_NEWUTS -+# define CLONE_NEWUTS 0x04000000 -+#endif -+#ifndef CLONE_NEWIPC -+# define CLONE_NEWIPC 0x08000000 -+#endif -+#ifndef CLONE_NEWNET -+# define CLONE_NEWNET 0x40000000 -+#endif -+#ifndef CLONE_NEWUSER -+# define CLONE_NEWUSER 0x10000000 -+#endif -+#ifndef CLONE_NEWPID -+# define CLONE_NEWPID 0x20000000 -+#endif -+ -+#ifndef MS_RELATIME -+#define MS_RELATIME (1 << 21) -+#endif -+#ifndef MS_STRICTATIME -+#define MS_STRICTATIME (1 << 24) -+#endif -+ -+static void die(char *fmt, ...) -+{ -+ va_list ap; -+ va_start(ap, fmt); -+ vfprintf(stderr, fmt, ap); -+ va_end(ap); -+ exit(EXIT_FAILURE); -+} -+ -+static void write_file(char *filename, char *fmt, ...) -+{ -+ char buf[4096]; -+ int fd; -+ ssize_t written; -+ int buf_len; -+ va_list ap; -+ -+ va_start(ap, fmt); -+ buf_len = vsnprintf(buf, sizeof(buf), fmt, ap); -+ va_end(ap); -+ if (buf_len < 0) { -+ die("vsnprintf failed: %s\n", -+ strerror(errno)); -+ } -+ if (buf_len >= sizeof(buf)) { -+ die("vsnprintf output truncated\n"); -+ } -+ -+ fd = open(filename, O_WRONLY); -+ if (fd < 0) { -+ die("open of %s failed: %s\n", -+ filename, strerror(errno)); -+ } -+ written = write(fd, buf, buf_len); -+ if (written != buf_len) { -+ if (written >= 0) { -+ die("short write to %s\n", filename); -+ } else { -+ die("write to %s failed: %s\n", -+ filename, strerror(errno)); -+ } -+ } -+ if (close(fd) != 0) { -+ die("close of %s failed: %s\n", -+ filename, strerror(errno)); -+ } -+} -+ -+static void create_and_enter_userns(void) -+{ -+ uid_t uid; -+ gid_t gid; -+ -+ uid = getuid(); -+ gid = getgid(); -+ -+ if (unshare(CLONE_NEWUSER) !=0) { -+ die("unshare(CLONE_NEWUSER) failed: %s\n", -+ strerror(errno)); -+ } -+ -+ write_file("/proc/self/uid_map", "0 %d 1", uid); -+ write_file("/proc/self/gid_map", "0 %d 1", gid); -+ -+ if (setgroups(0, NULL) != 0) { -+ die("setgroups failed: %s\n", -+ strerror(errno)); -+ } -+ if (setgid(0) != 0) { -+ die ("setgid(0) failed %s\n", -+ strerror(errno)); -+ } -+ if (setuid(0) != 0) { -+ die("setuid(0) failed %s\n", -+ strerror(errno)); -+ } -+} -+ -+static -+bool test_unpriv_remount(int mount_flags, int remount_flags, int invalid_flags) -+{ -+ pid_t child; -+ -+ child = fork(); -+ if (child == -1) { -+ die("fork failed: %s\n", -+ strerror(errno)); -+ } -+ if (child != 0) { /* parent */ -+ pid_t pid; -+ int status; -+ pid = waitpid(child, &status, 0); -+ if (pid == -1) { -+ die("waitpid failed: %s\n", -+ strerror(errno)); -+ } -+ if (pid != child) { -+ die("waited for %d got %d\n", -+ child, pid); -+ } -+ if (!WIFEXITED(status)) { -+ die("child did not terminate cleanly\n"); -+ } -+ return WEXITSTATUS(status) == EXIT_SUCCESS ? true : false; -+ } -+ -+ create_and_enter_userns(); -+ if (unshare(CLONE_NEWNS) != 0) { -+ die("unshare(CLONE_NEWNS) failed: %s\n", -+ strerror(errno)); -+ } -+ -+ if (mount("testing", "/tmp", "ramfs", mount_flags, NULL) != 0) { -+ die("mount of /tmp failed: %s\n", -+ strerror(errno)); -+ } -+ -+ create_and_enter_userns(); -+ -+ if (unshare(CLONE_NEWNS) != 0) { -+ die("unshare(CLONE_NEWNS) failed: %s\n", -+ strerror(errno)); -+ } -+ -+ if (mount("/tmp", "/tmp", "none", -+ MS_REMOUNT | MS_BIND | remount_flags, NULL) != 0) { -+ /* system("cat /proc/self/mounts"); */ -+ die("remount of /tmp failed: %s\n", -+ strerror(errno)); -+ } -+ -+ if (mount("/tmp", "/tmp", "none", -+ MS_REMOUNT | MS_BIND | invalid_flags, NULL) == 0) { -+ /* system("cat /proc/self/mounts"); */ -+ die("remount of /tmp with invalid flags " -+ "succeeded unexpectedly\n"); -+ } -+ exit(EXIT_SUCCESS); -+} -+ -+static bool test_unpriv_remount_simple(int mount_flags) -+{ -+ return test_unpriv_remount(mount_flags, mount_flags, 0); -+} -+ -+static bool test_unpriv_remount_atime(int mount_flags, int invalid_flags) -+{ -+ return test_unpriv_remount(mount_flags, mount_flags, invalid_flags); -+} -+ -+int main(int argc, char **argv) -+{ -+ if (!test_unpriv_remount_simple(MS_RDONLY|MS_NODEV)) { -+ die("MS_RDONLY malfunctions\n"); -+ } -+ if (!test_unpriv_remount_simple(MS_NODEV)) { -+ die("MS_NODEV malfunctions\n"); -+ } -+ if (!test_unpriv_remount_simple(MS_NOSUID|MS_NODEV)) { -+ die("MS_NOSUID malfunctions\n"); -+ } -+ if (!test_unpriv_remount_simple(MS_NOEXEC|MS_NODEV)) { -+ die("MS_NOEXEC malfunctions\n"); -+ } -+ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODEV, -+ MS_NOATIME|MS_NODEV)) -+ { -+ die("MS_RELATIME malfunctions\n"); -+ } -+ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODEV, -+ MS_NOATIME|MS_NODEV)) -+ { -+ die("MS_STRICTATIME malfunctions\n"); -+ } -+ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODEV, -+ MS_STRICTATIME|MS_NODEV)) -+ { -+ die("MS_RELATIME malfunctions\n"); -+ } -+ if (!test_unpriv_remount_atime(MS_RELATIME|MS_NODIRATIME|MS_NODEV, -+ MS_NOATIME|MS_NODEV)) -+ { -+ die("MS_RELATIME malfunctions\n"); -+ } -+ if (!test_unpriv_remount_atime(MS_STRICTATIME|MS_NODIRATIME|MS_NODEV, -+ MS_NOATIME|MS_NODEV)) -+ { -+ die("MS_RELATIME malfunctions\n"); -+ } -+ if (!test_unpriv_remount_atime(MS_NOATIME|MS_NODIRATIME|MS_NODEV, -+ MS_STRICTATIME|MS_NODEV)) -+ { -+ die("MS_RELATIME malfunctions\n"); -+ } -+ if (!test_unpriv_remount(MS_STRICTATIME|MS_NODEV, MS_NODEV, -+ MS_NOATIME|MS_NODEV)) -+ { -+ die("Default atime malfunctions\n"); -+ } -+ return EXIT_SUCCESS; -+} --- -2.0.4 - diff --git a/sources b/sources index a9e9cd325..66ccf01ec 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ 5c569ed649a0c9711879f333e90c5386 linux-3.16.tar.xz 49868ce6467b35cd9ffea1120d129462 perf-man-3.16.tar.gz -926e6e2ee0634ce53730701da749b040 patch-3.16.2.xz +387a93e4833df73217c6b9b92153aa7c patch-3.16.3.xz From 00682830a40d732537673caa53afb36da33a3429 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 22 Sep 2014 08:56:35 -0400 Subject: [PATCH 009/283] Add patch to fix i2c-hid touchpad resume (rhbz 1143812) --- ...-the-hid-driver-s-suspend-and-resume.patch | 76 +++++++++++++++++++ kernel.spec | 9 +++ 2 files changed, 85 insertions(+) create mode 100644 HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch diff --git a/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch b/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch new file mode 100644 index 000000000..9fdc11b7f --- /dev/null +++ b/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch @@ -0,0 +1,76 @@ +From 109571cf3ec78a39477eedd6b11927f52cbcb1e8 Mon Sep 17 00:00:00 2001 +From: Andrew Duggan +Date: Fri, 11 Jul 2014 16:34:18 -0700 +Subject: [PATCH] HID: i2c-hid: call the hid driver's suspend and resume + callbacks + +Currently, the i2c-hid driver does not call the suspend, resume, and +reset_resume callbacks in the hid_driver struct when those events occur. +This means that HID drivers for i2c-hid devices will not be able to execute +commands which may be needed during suspend or resume. One example is when a +touchpad using the hid-multitouch driver gets reset by i2c-hid coming out of +resume. Since the reset_resume callback never gets called the device is never +put back into the correct input mode. This patch calls the suspend and resume +callbacks and tries to duplicate the functionality of the usb-hid driver. + +Bugzilla: 1143812 +Upstream-status: 3.17 + +Signed-off-by: Andrew Duggan +Signed-off-by: Vincent Huang +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +--- + drivers/hid/i2c-hid/i2c-hid.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index 21aafc8f48c8..747d54421e73 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -1054,21 +1054,29 @@ static int i2c_hid_remove(struct i2c_client *client) + static int i2c_hid_suspend(struct device *dev) + { + struct i2c_client *client = to_i2c_client(dev); ++ struct i2c_hid *ihid = i2c_get_clientdata(client); ++ struct hid_device *hid = ihid->hid; ++ int ret = 0; + + disable_irq(client->irq); + if (device_may_wakeup(&client->dev)) + enable_irq_wake(client->irq); + ++ if (hid->driver && hid->driver->suspend) ++ ret = hid->driver->suspend(hid, PMSG_SUSPEND); ++ + /* Save some power */ + i2c_hid_set_power(client, I2C_HID_PWR_SLEEP); + +- return 0; ++ return ret; + } + + static int i2c_hid_resume(struct device *dev) + { + int ret; + struct i2c_client *client = to_i2c_client(dev); ++ struct i2c_hid *ihid = i2c_get_clientdata(client); ++ struct hid_device *hid = ihid->hid; + + enable_irq(client->irq); + ret = i2c_hid_hwreset(client); +@@ -1078,6 +1086,11 @@ static int i2c_hid_resume(struct device *dev) + if (device_may_wakeup(&client->dev)) + disable_irq_wake(client->irq); + ++ if (hid->driver && hid->driver->reset_resume) { ++ ret = hid->driver->reset_resume(hid); ++ return ret; ++ } ++ + return 0; + } + #endif +-- +2.1.0 + diff --git a/kernel.spec b/kernel.spec index cd5eeec3f..adf6dcce0 100644 --- a/kernel.spec +++ b/kernel.spec @@ -640,6 +640,9 @@ Patch26025: HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch #CVE-2014-6410 rhbz 1141809 1141810 Patch26026: udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch +#rhbz 1143812 +Patch26027: HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1373,6 +1376,9 @@ ApplyPatch HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch #CVE-2014-6410 rhbz 1141809 1141810 ApplyPatch udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch +#rhbz 1143812 +ApplyPatch HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2249,6 +2255,9 @@ fi # ||----w | # || || %changelog +* Mon Sep 22 2014 Josh Boyer +- Add patch to fix i2c-hid touchpad resume (rhbz 1143812) + * Wed Sep 17 2014 Josh Boyer - 3.16.3-300 - Linux v3.16.3 From 22caf8bcbef62b09cf30a57ca2b63147bc4f0f45 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Tue, 23 Sep 2014 09:23:12 -0400 Subject: [PATCH 010/283] Add patch to fix XPS 13 touchpad issue (rhbz 1123584) --- HID-rmi-check-sanity-of-incoming-report.patch | 105 ++++++++++++++++++ kernel.spec | 9 ++ 2 files changed, 114 insertions(+) create mode 100644 HID-rmi-check-sanity-of-incoming-report.patch diff --git a/HID-rmi-check-sanity-of-incoming-report.patch b/HID-rmi-check-sanity-of-incoming-report.patch new file mode 100644 index 000000000..f3d0b6e08 --- /dev/null +++ b/HID-rmi-check-sanity-of-incoming-report.patch @@ -0,0 +1,105 @@ +From 5b65c2a0296644dd3dbdd590d6f00174d18c96b3 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 10 Sep 2014 18:02:37 -0700 +Subject: HID: rmi: check sanity of the incoming report + +In the Dell XPS 13 9333, it appears that sometimes the bus get confused +and corrupts the incoming data. It fills the input report with the +sentinel value "ff". Synaptics told us that such behavior does not comes +from the touchpad itself, so we filter out such reports here. + +Unfortunately, we can not simply discard the incoming data because they +may contain useful information. Most of the time, the misbehavior is +quite near the end of the report, so we can still use the valid part of +it. + +Fixes: +https://bugzilla.redhat.com/show_bug.cgi?id=1123584 + +Signed-off-by: Benjamin Tissoires +Signed-off-by: Andrew Duggan +Signed-off-by: Jiri Kosina + +diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c +index 8389e81..3cccff7 100644 +--- a/drivers/hid/hid-rmi.c ++++ b/drivers/hid/hid-rmi.c +@@ -320,10 +320,7 @@ static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data, + int offset; + int i; + +- if (size < hdata->f11.report_size) +- return 0; +- +- if (!(irq & hdata->f11.irq_mask)) ++ if (!(irq & hdata->f11.irq_mask) || size <= 0) + return 0; + + offset = (hdata->max_fingers >> 2) + 1; +@@ -332,9 +329,19 @@ static int rmi_f11_input_event(struct hid_device *hdev, u8 irq, u8 *data, + int fs_bit_position = (i & 0x3) << 1; + int finger_state = (data[fs_byte_position] >> fs_bit_position) & + 0x03; ++ int position = offset + 5 * i; ++ ++ if (position + 5 > size) { ++ /* partial report, go on with what we received */ ++ printk_once(KERN_WARNING ++ "%s %s: Detected incomplete finger report. Finger reports may occasionally get dropped on this platform.\n", ++ dev_driver_string(&hdev->dev), ++ dev_name(&hdev->dev)); ++ hid_dbg(hdev, "Incomplete finger report\n"); ++ break; ++ } + +- rmi_f11_process_touch(hdata, i, finger_state, +- &data[offset + 5 * i]); ++ rmi_f11_process_touch(hdata, i, finger_state, &data[position]); + } + input_mt_sync_frame(hdata->input); + input_sync(hdata->input); +@@ -352,6 +359,11 @@ static int rmi_f30_input_event(struct hid_device *hdev, u8 irq, u8 *data, + if (!(irq & hdata->f30.irq_mask)) + return 0; + ++ if (size < (int)hdata->f30.report_size) { ++ hid_warn(hdev, "Click Button pressed, but the click data is missing\n"); ++ return 0; ++ } ++ + for (i = 0; i < hdata->gpio_led_count; i++) { + if (test_bit(i, &hdata->button_mask)) { + value = (data[i / 8] >> (i & 0x07)) & BIT(0); +@@ -412,9 +424,29 @@ static int rmi_read_data_event(struct hid_device *hdev, u8 *data, int size) + return 1; + } + ++static int rmi_check_sanity(struct hid_device *hdev, u8 *data, int size) ++{ ++ int valid_size = size; ++ /* ++ * On the Dell XPS 13 9333, the bus sometimes get confused and fills ++ * the report with a sentinel value "ff". Synaptics told us that such ++ * behavior does not comes from the touchpad itself, so we filter out ++ * such reports here. ++ */ ++ ++ while ((data[valid_size - 1] == 0xff) && valid_size > 0) ++ valid_size--; ++ ++ return valid_size; ++} ++ + static int rmi_raw_event(struct hid_device *hdev, + struct hid_report *report, u8 *data, int size) + { ++ size = rmi_check_sanity(hdev, data, size); ++ if (size < 2) ++ return 0; ++ + switch (data[0]) { + case RMI_READ_DATA_REPORT_ID: + return rmi_read_data_event(hdev, data, size); +-- +cgit v0.10.1 + diff --git a/kernel.spec b/kernel.spec index adf6dcce0..c7f34fef9 100644 --- a/kernel.spec +++ b/kernel.spec @@ -643,6 +643,9 @@ Patch26026: udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch #rhbz 1143812 Patch26027: HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch +#rhbz 1123584 +Patch26028: HID-rmi-check-sanity-of-incoming-report.patch + # git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel Patch30000: kernel-arm64.patch @@ -1379,6 +1382,9 @@ ApplyPatch udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch #rhbz 1143812 ApplyPatch HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch +#rhbz 1123584 +ApplyPatch HID-rmi-check-sanity-of-incoming-report.patch + %if 0%{?aarch64patches} ApplyPatch kernel-arm64.patch %ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does. @@ -2255,6 +2261,9 @@ fi # ||----w | # || || %changelog +* Tue Sep 23 2014 Josh Boyer +- Add patch to fix XPS 13 touchpad issue (rhbz 1123584) + * Mon Sep 22 2014 Josh Boyer - Add patch to fix i2c-hid touchpad resume (rhbz 1143812) From a357c223627a0fe704e38e5c4eb4aa39869cd114 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 26 Sep 2014 08:54:12 -0400 Subject: [PATCH 011/283] Enable early microcode loading (rhbz 1083716) --- config-x86-generic | 4 +++- kernel.spec | 5 ++++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/config-x86-generic b/config-x86-generic index 7968fdaea..fb84c0ac6 100644 --- a/config-x86-generic +++ b/config-x86-generic @@ -10,10 +10,12 @@ CONFIG_HPET_TIMER=y CONFIG_I8K=m CONFIG_SONYPI_COMPAT=y -CONFIG_MICROCODE=m +CONFIG_MICROCODE=y +CONFIG_MICROCODE_EARLY=y CONFIG_MICROCODE_INTEL=y CONFIG_MICROCODE_INTEL_EARLY=y CONFIG_MICROCODE_AMD=y +CONFIG_MICROCODE_AMD_EARLY=y CONFIG_X86_MSR=y CONFIG_X86_CPUID=y diff --git a/kernel.spec b/kernel.spec index c7f34fef9..2369384e0 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 300 +%global baserelease 301 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -2261,6 +2261,9 @@ fi # ||----w | # || || %changelog +* Thu Sep 25 2014 Josh Boyer +- Enable early microcode loading (rhbz 1083716) + * Tue Sep 23 2014 Josh Boyer - Add patch to fix XPS 13 touchpad issue (rhbz 1123584) From d92c81e70c1aab0719bb0748eeae96dd6e769906 Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 26 Sep 2014 08:55:12 -0400 Subject: [PATCH 012/283] Bump for build --- kernel.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel.spec b/kernel.spec index 2369384e0..1d7a3ba48 100644 --- a/kernel.spec +++ b/kernel.spec @@ -42,7 +42,7 @@ Summary: The Linux kernel # For non-released -rc kernels, this will be appended after the rcX and # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3" # -%global baserelease 301 +%global baserelease 302 %global fedora_build %{baserelease} # base_sublevel is the kernel version we're starting with and patching @@ -2261,7 +2261,7 @@ fi # ||----w | # || || %changelog -* Thu Sep 25 2014 Josh Boyer +* Thu Sep 25 2014 Josh Boyer - 3.16.3-302 - Enable early microcode loading (rhbz 1083716) * Tue Sep 23 2014 Josh Boyer From d7c14f7e1bcc04f0cd41923d634b8734de4d54db Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Fri, 26 Sep 2014 10:05:19 -0400 Subject: [PATCH 013/283] Bump prereq on dracut that defaults to early microcode --- kernel.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel.spec b/kernel.spec index 1d7a3ba48..4a0edd0f8 100644 --- a/kernel.spec +++ b/kernel.spec @@ -384,7 +384,7 @@ Summary: The Linux kernel # scripts use them. # %define kernel_prereq fileutils, systemd >= 203-2 -%define initrd_prereq dracut >= 027 +%define initrd_prereq dracut >= 038-29 Name: kernel%{?variant} @@ -2263,6 +2263,7 @@ fi %changelog * Thu Sep 25 2014 Josh Boyer - 3.16.3-302 - Enable early microcode loading (rhbz 1083716) +- Bump prereq on dracut that defaults to early microcode * Tue Sep 23 2014 Josh Boyer - Add patch to fix XPS 13 touchpad issue (rhbz 1123584) From 15e63c946d960980165082689639221a99f70aba Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 8 Sep 2014 14:43:02 -0400 Subject: [PATCH 014/283] Remove ppc32 support The powerpc secondary arch team has disabled all ppc32 builds in koji for F21 and beyond: https://lists.fedoraproject.org/pipermail/ppc/2014-May/002801.html FESCo also recently said that dropped or new architectures must essentially prove they have an active and viable effort behind them before being considered for Secondary Arch support. This effort has not materialized in the interim since the current powerpc team dropped ppc32. There's little point in keeping support for ppc32 support in the kernel package when it will never be built. This also removes the -smp variant and with_smp* support, as that was only used on ppc32. --- Makefile.config | 12 +-- config-powerpc32-generic | 180 --------------------------------------- config-powerpc32-smp | 3 - filter-ppc.sh | 14 --- kernel.spec | 67 ++------------- 5 files changed, 6 insertions(+), 270 deletions(-) delete mode 100644 config-powerpc32-generic delete mode 100644 config-powerpc32-smp delete mode 100644 filter-ppc.sh diff --git a/Makefile.config b/Makefile.config index 348396828..63549f642 100644 --- a/Makefile.config +++ b/Makefile.config @@ -11,11 +11,10 @@ CONFIGFILES = \ $(CFG)-s390x.config \ $(CFG)-armv7hl.config $(CFG)-armv7hl-lpae.config \ $(CFG)-aarch64.config \ - $(CFG)-ppc.config $(CFG)-ppc-smp.config \ $(CFG)-ppc64.config $(CFG)-ppc64p7.config $(CFG)-ppc64-debug.config \ $(CFG)-ppc64le.config -PLATFORMS = x86 x86_64 powerpc powerpc32 powerpc64 s390x arm arm64 +PLATFORMS = x86 x86_64 powerpc powerpc64 s390x arm arm64 TEMPFILES = $(addprefix temp-, $(addsuffix -generic, $(PLATFORMS))) configs: $(CONFIGFILES) @@ -81,9 +80,6 @@ temp-powerpc-generic: config-powerpc-generic temp-generic temp-powerpc-debug-generic: config-powerpc-generic temp-debug-generic perl merge.pl $^ > $@ -temp-powerpc32-generic: config-powerpc32-generic temp-powerpc-generic - perl merge.pl $^ > $@ - temp-powerpc64-generic: config-powerpc64 temp-powerpc-generic perl merge.pl $^ > $@ @@ -134,9 +130,3 @@ $(CFG)-armv7hl-lpae.config: /dev/null temp-armv7-lpae $(CFG)-aarch64.config: /dev/null temp-arm64 perl merge.pl $^ arm64 > $@ - -$(CFG)-ppc.config: /dev/null temp-powerpc32-generic - perl merge.pl $^ powerpc > $@ - -$(CFG)-ppc-smp.config: config-powerpc32-smp temp-powerpc32-generic - perl merge.pl $^ powerpc > $@ diff --git a/config-powerpc32-generic b/config-powerpc32-generic deleted file mode 100644 index 10e02fb7b..000000000 --- a/config-powerpc32-generic +++ /dev/null @@ -1,180 +0,0 @@ -# CONFIG_SMP is not set -CONFIG_PPC32=y -# CONFIG_PPC64 is not set -# CONFIG_RTAS_PROC is not set -# CONFIG_PCMCIA_M8XX is not set -# CONFIG_HOTPLUG_PCI is not set -CONFIG_CPU_FREQ_PMAC=y -CONFIG_PPC_CHRP=y -CONFIG_PPC_PMAC=y -# CONFIG_PPC_MPC52xx is not set -CONFIG_PPC_PREP=y - -# CONFIG_PPC_MPC5200_SIMPLE is not set -# CONFIG_SATA_FSL is not set -# CONFIG_SATA_NV is not set - -# busted in .28git1 -# ERROR: "cacheable_memzero" [drivers/net/gianfar_driver.ko] undefined! -# CONFIG_GIANFAR is not set -# CONFIG_USB_EHCI_FSL is not set - -CONFIG_PMAC_APM_EMU=y -CONFIG_PMAC_BACKLIGHT=y - -CONFIG_HIGHMEM=y -# CONFIG_HIGHMEM_START_BOOL is not set -# CONFIG_LOWMEM_SIZE_BOOL is not set -# CONFIG_TASK_SIZE_BOOL is not set -# CONFIG_KERNEL_START_BOOL is not set -# CONFIG_PPC601_SYNC_FIX is not set -CONFIG_ADVANCED_OPTIONS=y -CONFIG_SCSI_MESH=m -CONFIG_SCSI_MESH_SYNC_RATE=5 -CONFIG_SCSI_MESH_RESET_DELAY_MS=4000 - -CONFIG_LBDAF=y - -CONFIG_SCSI_MAC53C94=m -CONFIG_ADB_CUDA=y -CONFIG_ADB_MACIO=y -CONFIG_INPUT_ADBHID=y -CONFIG_ADB_PMU_LED=y -CONFIG_ADB_PMU_LED_IDE=y - -CONFIG_PMAC_MEDIABAY=y -CONFIG_NET_VENDOR_APPLE=y -CONFIG_BMAC=m -CONFIG_MACE=m -# CONFIG_MACE_AAUI_PORT is not set -# CONFIG_MV643XX_ETH is not set -CONFIG_I2C_HYDRA=m -CONFIG_I2C_MPC=m -CONFIG_THERM_WINDTUNNEL=m -CONFIG_THERM_ADT746X=m -# CONFIG_ANSLCD is not set - -CONFIG_FB_PLATINUM=y -CONFIG_FB_VALKYRIE=y -CONFIG_FB_CT65550=y -# CONFIG_BDI_SWITCH is not set - -CONFIG_MAC_FLOPPY=m -# CONFIG_BLK_DEV_FD is not set - -CONFIG_FB_ATY128=y -CONFIG_FB_ATY=y -CONFIG_FB_MATROX=y -# CONFIG_KEXEC is not set - -# CONFIG_HVC_RTAS is not set - -# CONFIG_UDBG_RTAS_CONSOLE is not set -CONFIG_BRIQ_PANEL=m - -# CONFIG_ATA_PIIX is not set -# CONFIG_PATA_AMD is not set -# CONFIG_PATA_ATIIXP is not set -# CONFIG_PATA_MPC52xx is not set -# CONFIG_PATA_MPIIX is not set -# CONFIG_PATA_OLDPIIX is not set -# CONFIG_PATA_OPTI is not set -# CONFIG_PATA_SERVERWORKS is not set - -# CONFIG_SERIAL_MPC52xx is not set -# CONFIG_MPC5200_WDT is not set -CONFIG_8xxx_WDT=m -CONFIG_GEF_WDT=m - -# CONFIG_PPC_MPC5200_BUGFIX is not set -# CONFIG_NET_VENDOR_FREESCALE is not set -#CHECK: This may later become a tristate. -CONFIG_MDIO_GPIO=m - -CONFIG_SERIAL_OF_PLATFORM=y -CONFIG_DEBUG_STACKOVERFLOW=y - -# CONFIG_EMBEDDED6xx is not set - -# CONFIG_BLK_DEV_PLATFORM is not set -# CONFIG_BLK_DEV_4DRIVES is not set -# CONFIG_BLK_DEV_ALI14XX is not set -# CONFIG_BLK_DEV_DTC2278 is not set -# CONFIG_BLK_DEV_HT6560B is not set -# CONFIG_BLK_DEV_QD65XX is not set -# CONFIG_BLK_DEV_UMC8672 is not set - -# CONFIG_VIRQ_DEBUG is not set - -CONFIG_PPC_BESTCOMM_ATA=m -CONFIG_PPC_BESTCOMM_FEC=m -CONFIG_PPC_BESTCOMM_GEN_BD=m - -CONFIG_FORCE_MAX_ZONEORDER=11 -# CONFIG_PAGE_OFFSET_BOOL is not set -# CONFIG_FB_FSL_DIU is not set -CONFIG_IRQSTACKS=y -CONFIG_VIRTUALIZATION=y - -# CONFIG_DEBUG_GPIO is not set -# CONFIG_GPIO_PCA953X is not set -# CONFIG_GPIO_PCF857X is not set -# CONFIG_HTC_EGPIO is not set - -# CONFIG_TIFM_CORE is not set - -# CONFIG_BLK_CPQ_CISS_DA is not set -# CONFIG_CISS_SCSI_TAPE is not set - -# CONFIG_I2C_NFORCE2 is not set - -# CONFIG_SND_INTEL8X0 is not set -# CONFIG_SND_INTEL8X0M is not set - -# CONFIG_MEMSTICK is not set - -# CONFIG_IPMI_HANDLER is not set - -# PPC gets sad with debug alloc (bz 448598) -# CONFIG_DEBUG_PAGEALLOC is not set - -CONFIG_CRYPTO_DEV_TALITOS=m - -# CONFIG_FSL_EMB_PERFMON is not set -# CONFIG_MPC8272_ADS is not set -# CONFIG_PQ2FADS is not set -# CONFIG_EP8248E is not set -# CONFIG_MPC830x_RDB is not set -# CONFIG_MPC831x_RDB is not set -# CONFIG_MPC832x_MDS is not set -# CONFIG_MPC832x_RDB is not set -# CONFIG_MPC834x_MDS is not set -# CONFIG_MPC834x_ITX is not set -# CONFIG_MPC836x_MDS is not set -# CONFIG_MPC836x_RDK is not set -# CONFIG_MPC837x_MDS is not set -# CONFIG_MPC837x_RDB is not set -# CONFIG_SBC834x is not set -# CONFIG_ASP834x is not set -# CONFIG_KMETER1 is not set -# CONFIG_MPC8641_HPCN is not set -# CONFIG_SBC8641D is not set -# CONFIG_MPC8610_HPCD is not set -# CONFIG_FSL_LBC is not set -# CONFIG_MTD_NAND_FSL_UPM is not set - -# CONFIG_USB_MUSB_HDRC is not set - -# busted in 2.6.27 -# drivers/mtd/maps/sbc8240.c: In function 'init_sbc8240_mtd': -# drivers/mtd/maps/sbc8240.c:172: warning: passing argument 1 of 'simple_map_init' from incompatible pointer type -# drivers/mtd/maps/sbc8240.c:177: error: 'struct mtd_info' has no member named 'module' - -CONFIG_RCU_FANOUT=32 - -CONFIG_KVM_BOOK3S_32=m - -# CONFIG_SCSI_QLA_ISCSI is not set - -CONFIG_BATTERY_PMU=m - diff --git a/config-powerpc32-smp b/config-powerpc32-smp deleted file mode 100644 index 5dbe87f7f..000000000 --- a/config-powerpc32-smp +++ /dev/null @@ -1,3 +0,0 @@ -# CONFIG_HOTPLUG_CPU is not set -CONFIG_NR_CPUS=4 -# CONFIG_BATTERY_PMU is not set diff --git a/filter-ppc.sh b/filter-ppc.sh deleted file mode 100644 index 8ff7a3b9d..000000000 --- a/filter-ppc.sh +++ /dev/null @@ -1,14 +0,0 @@ -#! /bin/bash - -# This is the ppc override file for the core/drivers package split. The -# module directories listed here and in the generic list in filter-modules.sh -# will be moved to the resulting kernel-modules package for this arch. -# Anything not listed in those files will be in the kernel-core package. -# -# Please review the default list in filter-modules.sh before making -# modifications to the overrides below. If something should be removed across -# all arches, remove it in the default instead of per-arch. - -driverdirs="atm auxdisplay bcma bluetooth fmc infiniband isdn leds media memstick message mmc mtd nfc ntb pcmcia platform power ssb staging uio uwb" - -singlemods="ntb_netdev iscsi_ibft iscsi_boot_sysfs iscsi_tcp megaraid pmcraid qla1280 9pnet_rdma svcrdma xprtrdma hid-picolcd hid-prodikeys hwa-hc hwpoison-inject" diff --git a/kernel.spec b/kernel.spec index 4a0edd0f8..632514640 100644 --- a/kernel.spec +++ b/kernel.spec @@ -86,8 +86,6 @@ Summary: The Linux kernel # # standard kernel %define with_up %{?_without_up: 0} %{?!_without_up: 1} -# kernel-smp (only valid for ppc 32-bit) -%define with_smp %{?_without_smp: 0} %{?!_without_smp: 1} # kernel PAE (only valid for i686 (PAE) and ARM (lpae)) %define with_pae %{?_without_pae: 0} %{?!_without_pae: 1} # kernel-debug @@ -109,8 +107,6 @@ Summary: The Linux kernel # # Only build the base kernel (--with baseonly): %define with_baseonly %{?_with_baseonly: 1} %{?!_with_baseonly: 0} -# Only build the smp kernel (--with smponly): -%define with_smponly %{?_with_smponly: 1} %{?!_with_smponly: 0} # Only build the pae kernel (--with paeonly): %define with_paeonly %{?_with_paeonly: 1} %{?!_with_paeonly: 0} # Only build the debug kernel (--with dbgonly): @@ -193,14 +189,6 @@ Summary: The Linux kernel # if requested, only build base kernel %if %{with_baseonly} -%define with_smp 0 -%define with_pae 0 -%define with_debug 0 -%endif - -# if requested, only build smp kernel -%if %{with_smponly} -%define with_up 0 %define with_pae 0 %define with_debug 0 %endif @@ -208,7 +196,6 @@ Summary: The Linux kernel # if requested, only build pae kernel %if %{with_paeonly} %define with_up 0 -%define with_smp 0 %define with_debug 0 %endif @@ -218,7 +205,6 @@ Summary: The Linux kernel %define with_up 0 %define with_pae 0 %endif -%define with_smp 0 %define with_pae 0 %define with_tools 0 %define with_perf 0 @@ -228,16 +214,11 @@ Summary: The Linux kernel %if %{with_vdso_install} # These arches install vdso/ directories. -%define vdso_arches %{all_x86} x86_64 ppc %{power64} s390 s390x aarch64 +%define vdso_arches %{all_x86} x86_64 %{power64} s390 s390x aarch64 %endif # Overrides for generic default options -# only ppc needs a separate smp kernel -%ifnarch ppc -%define with_smp 0 -%endif - # don't do debug builds on anything but i686 and x86_64 %ifnarch i686 x86_64 %define with_debug 0 @@ -254,7 +235,7 @@ Summary: The Linux kernel # bootwrapper is only on ppc # sparse blows up on ppc -%ifnarch ppc %{power64} +%ifnarch %{power64} %define with_bootwrapper 0 %define with_sparse 0 %endif @@ -302,16 +283,6 @@ Summary: The Linux kernel %define with_tools 0 %endif -%ifarch ppc -%define asmarch powerpc -%define hdrarch powerpc -%define all_arch_configs kernel-%{version}-ppc{-,.}*config -%define image_install_path boot -%define make_target vmlinux -%define kernel_image vmlinux -%define kernel_image_elf 1 -%endif - %ifarch %{arm} %define all_arch_configs kernel-%{version}-arm*.config %define image_install_path boot @@ -363,7 +334,6 @@ Summary: The Linux kernel %ifarch %nobuildarches %define with_up 0 -%define with_smp 0 %define with_pae 0 %define with_debuginfo 0 %define with_perf 0 @@ -377,7 +347,7 @@ Summary: The Linux kernel %endif # Architectures we build tools/cpupower on -%define cpupowerarchs %{ix86} x86_64 ppc %{power64} %{arm} aarch64 +%define cpupowerarchs %{ix86} x86_64 %{power64} %{arm} aarch64 # # Packages that need to be installed before the kernel is, because the %%post @@ -395,7 +365,7 @@ Version: %{rpmversion} Release: %{pkg_release} # DO NOT CHANGE THE 'ExclusiveArch' LINE TO TEMPORARILY EXCLUDE AN ARCHITECTURE BUILD. # SET %%nobuildarches (ABOVE) INSTEAD -ExclusiveArch: %{all_x86} x86_64 ppc ppc64 ppc64p7 s390 s390x %{arm} aarch64 ppc64le +ExclusiveArch: %{all_x86} x86_64 ppc64 ppc64p7 s390 s390x %{arm} aarch64 ppc64le ExclusiveOS: Linux %ifnarch %{nobuildarches} Requires: kernel-%{?variant:%{variant}-}core-uname-r = %{KVERREL}%{?variant} @@ -449,7 +419,6 @@ Source90: filter-x86_64.sh Source91: filter-armv7hl.sh Source92: filter-i686.sh Source93: filter-aarch64.sh -Source94: filter-ppc.sh Source95: filter-ppc64.sh Source96: filter-ppc64le.sh Source97: filter-s390x.sh @@ -471,8 +440,6 @@ Source32: config-x86-32-generic Source40: config-x86_64-generic Source50: config-powerpc-generic -Source51: config-powerpc32-generic -Source52: config-powerpc32-smp Source53: config-powerpc64 Source54: config-powerpc64p7 Source55: config-powerpc64le @@ -926,15 +893,6 @@ Provides: kernel-%{?1:%{1}-}core-uname-r = %{KVERREL}%{?1:+%{1}}\ # Now, each variant package. -%define variant_summary The Linux kernel compiled for SMP machines -%kernel_variant_package -n SMP smp -%description smp-core -This package includes a SMP version of the Linux kernel. It is -required only on machines with two or more CPUs as well as machines with -hyperthreading technology. - -Install the kernel-smp package if your machine uses two or more CPUs. - %ifnarch armv7hl %define variant_summary The Linux kernel compiled for PAE capable machines %kernel_variant_package %{pae} @@ -998,13 +956,6 @@ exit 1 %endif %endif -%if %{with_smponly} -%if !%{with_smp} -echo "Cannot build --with smponly, smp build is disabled" -exit 1 -%endif -%endif - %if "%{baserelease}" == "0" echo "baserelease must be greater than zero" exit 1 @@ -1615,7 +1566,7 @@ BuildKernel() { fi rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts/*.o rm -f $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/scripts/*/*.o -%ifarch ppc %{power64} +%ifarch %{power64} cp -a --parents arch/powerpc/lib/crtsavres.[So] $RPM_BUILD_ROOT/lib/modules/$KernelVer/build/ %endif if [ -d arch/%{asmarch}/include ]; then @@ -1798,10 +1749,6 @@ BuildKernel %make_target %kernel_image %{pae} BuildKernel %make_target %kernel_image %endif -%if %{with_smp} -BuildKernel %make_target %kernel_image smp -%endif - %global perf_make \ make -s %{?cross_opts} %{?_smp_mflags} -C tools/perf V=1 WERROR=0 NO_LIBUNWIND=1 HAVE_CPLUS_DEMANGLE=1 NO_GTK2=1 NO_LIBNUMA=1 NO_STRLCPY=1 NO_BIONIC=1 prefix=%{_prefix} %if %{with_perf} @@ -2085,9 +2032,6 @@ fi}\ %kernel_variant_preun %kernel_variant_post -r kernel-smp -%kernel_variant_preun smp -%kernel_variant_post -v smp - %kernel_variant_preun %{pae} %kernel_variant_post -v %{pae} -r (kernel|kernel-smp) @@ -2242,7 +2186,6 @@ fi %kernel_variant_files %{with_up} -%kernel_variant_files %{with_smp} smp %kernel_variant_files %{with_debug} debug %kernel_variant_files %{with_pae} %{pae} %kernel_variant_files %{with_pae_debug} %{pae}debug From dbc4a9b8e84719e73a2c74a178f7838cc57a3acf Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 6 Oct 2014 13:00:30 -0400 Subject: [PATCH 015/283] Linux v3.17 --- ...hange-Lenovo-Yoga-2-series-rfkill-ha.patch | 138 - ACPI-Limit-access-to-custom_method.patch | 30 + ARM-tegra-usb-no-reset.patch | 31 + Add-EFI-signature-data-types.patch | 56 + ...signature-blob-parser-and-key-loader.patch | 178 + ...tomatically-enforce-module-signature.patch | 185 + Add-secure_modules-call.patch | 63 + ...q-option-to-disable-secure-boot-mode.patch | 20 +- ...-the-hid-driver-s-suspend-and-resume.patch | 76 - ...anity-check-report-size-in-raw_event.patch | 51 - ...ty-check-report-size-in-raw_event-ca.patch | 41 - ...Add-support-for-the-Cintiq-Companion.patch | 46 + ...Add-support-for-the-Cintiq-Companion.patch | 46 - KEYS-Add-a-system-blacklist-keyring.patch | 111 + ...PERM-for-a-key-type-name-beginning-w.patch | 44 + ...t-certificates-from-UEFI-Secure-Boot.patch | 185 + ...-Support-not-importing-certs-from-db.patch | 83 + ...R-access-when-module-security-is-ena.patch | 116 + ...-and-dev-kmem-when-module-loading-is.patch | 41 + ...PI-video-change-acpi-video-brightnes.patch | 15 +- ..._rsdp-kernel-parameter-when-module-l.patch | 38 + ...-new-models-to-the-use_native_backli.patch | 17 +- ...se-native-backlight-quirk-for-the-Th.patch | 17 +- ...se_native_backlight-quirk-for-HP-Pro.patch | 17 +- arm-beagle.patch | 460 - ...one-common-add-uart2_pins-uart4_pins.patch | 45 + ...335x-bone-common-enable-and-use-i2c2.patch | 69 + ...one-common-setup-default-pinmux-http.patch | 179 + ...am335x-boneblack-add-cpu0-opp-points.patch | 41 + ...am335x-boneblack-lcdc-add-panel-info.patch | 38 + arm-dts-sun7i-bananapi.patch | 213 + arm-highbank-l2-reverts.patch | 60 + ...atch => arm-i.MX6-Utilite-device-dtb.patch | 13 +- arm-qemu-fixdisplay.patch | 472 - arm-tegra-drmdetection.patch | 111 - arm-tegra-usb-no-reset-linux33.patch | 16 - asus-wmi-Add-a-no-backlight-quirk.patch | 69 - ...t-debugfs-interface-when-module-load.patch | 53 + ...eck.patch => ath9k-rx-dma-stop-check.patch | 17 +- config-arm-generic | 39 +- config-arm64 | 31 +- config-armv7 | 56 +- config-armv7-generic | 52 +- config-armv7-lpae | 2 +- config-debug | 6 +- config-generic | 368 +- config-i686-PAE | 1 - config-nodebug | 4 - config-powerpc-generic | 15 - config-powerpc64 | 16 +- config-powerpc64le | 4 - config-powerpc64p7 | 15 +- config-s390x | 59 +- config-x86-32-generic | 16 - config-x86-generic | 46 +- config-x86_64-generic | 19 +- crash-driver.patch | 120 +- criu-no-expert.patch | 16 +- die-floppy-die.patch | 19 +- disable-i8042-check-on-apple-mac.patch | 21 +- disable-libdw-unwind-on-non-x86.patch | 19 +- drm-i915-hush-check-crtc-state.patch | 23 +- drm-vmwgfx-Fix-drm.h-include.patch | 34 + ...-backlight-quirk-for-Asus-H87I-PLUS-.patch | 50 - efi-Add-EFI_SECURE_BOOT-bit.patch | 42 + ...ure-boot-if-shim-is-in-insecure-mode.patch | 57 + ...ECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch | 29 + ...able-in-a-signed-modules-environment.patch | 38 + ...-the-aux-firmware-id-in-multi-plexed.patch | 32 - input-kill-stupid-messages.patch | 14 +- input-silence-i8042-noise.patch | 65 + ...fter_link.patch => kbuild-AFTER_LINK.patch | 27 +- kernel-arm64.patch | 14531 +++++++--------- kernel.spec | 186 +- ...-runtime-if-the-kernel-enforces-modu.patch | 43 + ...-CPUMASK_OFFSTACK-usable-without-deb.patch | 37 + lis3-improve-handling-of-null-rate.patch | 32 +- modsign-uefi.patch | 624 - no-pcspkr-modalias.patch | 14 +- perf-install-trace-event-plugins.patch | 30 + perf-lib64.patch | 17 - ...trl-single-must-be-initialized-early.patch | 37 + ppc64-fixtools.patch | 12 + ...mouse_matches_pnp_id-helper-function.patch | 9 +- ...ort-for-detecting-FocalTech-PS-2-tou.patch | 10 +- ...sult-shows-get_report-is-unnecessary.patch | 40 - ...dd-broken-acpi-video-quirk-for-NC210.patch | 14 +- ...validate_disk-prevent-NULL-ptr-deref.patch | 20 +- secure-modules.patch | 877 - silence-fbcon-logo.patch | 16 +- sources | 5 +- ...te-loop-when-processing-indirect-ICB.patch | 92 - ...Disable-watchdog-on-virtual-machines.patch | 13 +- ...-port-access-when-module-security-is.patch | 70 + ...-access-when-module-loading-is-restr.patch | 42 + 95 files changed, 9406 insertions(+), 12221 deletions(-) delete mode 100644 0001-ideapad-laptop-Change-Lenovo-Yoga-2-series-rfkill-ha.patch create mode 100644 ACPI-Limit-access-to-custom_method.patch create mode 100644 ARM-tegra-usb-no-reset.patch create mode 100644 Add-EFI-signature-data-types.patch create mode 100644 Add-an-EFI-signature-blob-parser-and-key-loader.patch create mode 100644 Add-option-to-automatically-enforce-module-signature.patch create mode 100644 Add-secure_modules-call.patch rename sysrq-secure-boot.patch => Add-sysrq-option-to-disable-secure-boot-mode.patch (94%) delete mode 100644 HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch delete mode 100644 HID-magicmouse-sanity-check-report-size-in-raw_event.patch delete mode 100644 HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch create mode 100644 HID-wacom-Add-support-for-the-Cintiq-Companion.patch delete mode 100644 Input-wacom-Add-support-for-the-Cintiq-Companion.patch create mode 100644 KEYS-Add-a-system-blacklist-keyring.patch create mode 100644 KEYS-Reinstate-EPERM-for-a-key-type-name-beginning-w.patch create mode 100644 MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch create mode 100644 MODSIGN-Support-not-importing-certs-from-db.patch create mode 100644 PCI-Lock-down-BAR-access-when-module-security-is-ena.patch create mode 100644 Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch create mode 100644 acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch rename 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch => acpi-video-Add-4-new-models-to-the-use_native_backli.patch (81%) delete mode 100644 arm-beagle.patch create mode 100644 arm-dts-am335x-bone-common-add-uart2_pins-uart4_pins.patch create mode 100644 arm-dts-am335x-bone-common-enable-and-use-i2c2.patch create mode 100644 arm-dts-am335x-bone-common-setup-default-pinmux-http.patch create mode 100644 arm-dts-am335x-boneblack-add-cpu0-opp-points.patch create mode 100644 arm-dts-am335x-boneblack-lcdc-add-panel-info.patch create mode 100644 arm-dts-sun7i-bananapi.patch create mode 100644 arm-highbank-l2-reverts.patch rename arm-imx6-utilite.patch => arm-i.MX6-Utilite-device-dtb.patch (81%) delete mode 100644 arm-qemu-fixdisplay.patch delete mode 100644 arm-tegra-drmdetection.patch delete mode 100644 arm-tegra-usb-no-reset-linux33.patch delete mode 100644 asus-wmi-Add-a-no-backlight-quirk.patch create mode 100644 asus-wmi-Restrict-debugfs-interface-when-module-load.patch rename ath9k_rx_dma_stop_check.patch => ath9k-rx-dma-stop-check.patch (55%) create mode 100644 drm-vmwgfx-Fix-drm.h-include.patch delete mode 100644 eeepc-wmi-Add-no-backlight-quirk-for-Asus-H87I-PLUS-.patch create mode 100644 efi-Add-EFI_SECURE_BOOT-bit.patch create mode 100644 efi-Disable-secure-boot-if-shim-is-in-insecure-mode.patch create mode 100644 efi-Make-EFI_SECURE_BOOT_SIG_ENFORCE-depend-on-EFI.patch create mode 100644 hibernate-Disable-in-a-signed-modules-environment.patch delete mode 100644 i8042-Also-store-the-aux-firmware-id-in-multi-plexed.patch create mode 100644 input-silence-i8042-noise.patch rename makefile-after_link.patch => kbuild-AFTER_LINK.patch (90%) create mode 100644 kexec-Disable-at-runtime-if-the-kernel-enforces-modu.patch create mode 100644 lib-cpumask-Make-CPUMASK_OFFSTACK-usable-without-deb.patch delete mode 100644 modsign-uefi.patch create mode 100644 perf-install-trace-event-plugins.patch delete mode 100644 perf-lib64.patch create mode 100644 pinctrl-pinctrl-single-must-be-initialized-early.patch create mode 100644 ppc64-fixtools.patch delete mode 100644 revert-input-wacom-testing-result-shows-get_report-is-unnecessary.patch delete mode 100644 secure-modules.patch delete mode 100644 udf-Avoid-infinite-loop-when-processing-indirect-ICB.patch rename nowatchdog-on-virt.patch => watchdog-Disable-watchdog-on-virtual-machines.patch (91%) create mode 100644 x86-Lock-down-IO-port-access-when-module-security-is.patch create mode 100644 x86-Restrict-MSR-access-when-module-loading-is-restr.patch diff --git a/0001-ideapad-laptop-Change-Lenovo-Yoga-2-series-rfkill-ha.patch b/0001-ideapad-laptop-Change-Lenovo-Yoga-2-series-rfkill-ha.patch deleted file mode 100644 index aab1c4e32..000000000 --- a/0001-ideapad-laptop-Change-Lenovo-Yoga-2-series-rfkill-ha.patch +++ /dev/null @@ -1,138 +0,0 @@ -Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1021036 -Upstream-status: Send upstream for 3.17 - -From 0ad19912cb324f0a356a212433ec0b2a31f61acc Mon Sep 17 00:00:00 2001 -From: Hans de Goede -Date: Fri, 20 Jun 2014 10:29:16 +0200 -Subject: [PATCH] ideapad-laptop: Change Lenovo Yoga 2 series rfkill handling - -It seems that the same problems which lead to adding an rfkill blacklist and -putting the Lenovo Yoga 2 11 on it are also present on the Lenovo Yoga 2 13 -and Lenovo Yoga 2 Pro too: -https://bugzilla.redhat.com/show_bug.cgi?id=1021036 -https://forums.lenovo.com/t5/Linux-Discussion/Yoga-2-13-not-Pro-Linux-Warning/m-p/1517612 - -Testing has shown that the firmware rfkill settings are persistent over -reboots. So blacklisting the driver is not good enough, if the wifi is blocked -at the firmware level the wifi needs to be explictly unblocked through the -ideapad-laptop interface. - -And at least on the Lenovo Yoga 2 13 the VPCCMD_RF register which on devices -with hardware kill switch reports the hardware switch state, needs to be -explictly set to 1 (radio enabled / not blocked). - -So this patch does 3 things to get proper rfkill handling on these models: - -1) Instead of blacklisting the rfkill functionality, which means that people -with a firmware blocked wifi get stuck in that situation, ignore the value -reported by the not present hardware rfkill switch, as this is what is causing -ideapad-laptop to wrongly report all radios as hardware blocks. But do register -the rfkill interfaces so that the user can soft [un]block them. - -2) On models without a hardware rfkill switch, explictly set VPCCMD_RF to 1 - -3) Drop the " 11" postfix from the dmi match string, as the entire Yoga 2 -series is affected. - -Yoga 2 11: -Reported-and-tested-by: Vincent Gerris - -Yoga 2 13: -Tested-by: madls05 - -Yoga 2 Pro: -Reported-and-tested-by: Peter F. Patel-Schneider - -Signed-off-by: Hans de Goede ---- - drivers/platform/x86/ideapad-laptop.c | 41 +++++++++++++++++++++++------------ - 1 file changed, 27 insertions(+), 14 deletions(-) - -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index b4c495a..b0e3a2e 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -87,6 +87,7 @@ struct ideapad_private { - struct backlight_device *blightdev; - struct dentry *debug; - unsigned long cfg; -+ bool has_hw_rfkill_switch; - }; - - static bool no_bt_rfkill; -@@ -473,12 +474,14 @@ static struct rfkill_ops ideapad_rfk_ops = { - - static void ideapad_sync_rfk_state(struct ideapad_private *priv) - { -- unsigned long hw_blocked; -+ unsigned long hw_blocked = 0; - int i; - -- if (read_ec_data(priv->adev->handle, VPCCMD_R_RF, &hw_blocked)) -- return; -- hw_blocked = !hw_blocked; -+ if (priv->has_hw_rfkill_switch) { -+ if (read_ec_data(priv->adev->handle, VPCCMD_R_RF, &hw_blocked)) -+ return; -+ hw_blocked = !hw_blocked; -+ } - - for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++) - if (priv->rfk[i]) -@@ -821,14 +824,17 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data) - } - } - --/* Blacklist for devices where the ideapad rfkill interface does not work */ --static struct dmi_system_id rfkill_blacklist[] = { -- /* The Lenovo Yoga 2 11 always reports everything as blocked */ -+/* -+ * Some ideapads don't have a hardware rfkill switch, reading VPCCMD_R_RF -+ * always results in 0 on these models, causing ideapad_laptop to wrongly -+ * report all radios as hardware-blocked. -+ */ -+static struct dmi_system_id no_hw_rfkill_list[] = { - { -- .ident = "Lenovo Yoga 2 11", -+ .ident = "Lenovo Yoga 2 11 / 13 / Pro", - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -- DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2 11"), -+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2"), - }, - }, - {} -@@ -856,6 +862,7 @@ static int ideapad_acpi_add(struct platform_device *pdev) - priv->cfg = cfg; - priv->adev = adev; - priv->platform_device = pdev; -+ priv->has_hw_rfkill_switch = !dmi_check_system(no_hw_rfkill_list); - - ret = ideapad_sysfs_init(priv); - if (ret) -@@ -869,11 +876,17 @@ static int ideapad_acpi_add(struct platform_device *pdev) - if (ret) - goto input_failed; - -- if (!dmi_check_system(rfkill_blacklist)) { -- for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++) -- if (test_bit(ideapad_rfk_data[i].cfgbit, &priv->cfg)) -- ideapad_register_rfkill(priv, i); -- } -+ /* -+ * On some models without a hw-switch (the yoga 2 13 at least) -+ * VPCCMD_W_RF must be explicitly set to 1 for the wifi to work. -+ */ -+ if (!priv->has_hw_rfkill_switch) -+ write_ec_cmd(priv->adev->handle, VPCCMD_W_RF, 1); -+ -+ for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++) -+ if (test_bit(ideapad_rfk_data[i].cfgbit, &priv->cfg)) -+ ideapad_register_rfkill(priv, i); -+ - ideapad_sync_rfk_state(priv); - ideapad_sync_touchpad_state(priv); - --- -2.0.0 - diff --git a/ACPI-Limit-access-to-custom_method.patch b/ACPI-Limit-access-to-custom_method.patch new file mode 100644 index 000000000..636c25b4c --- /dev/null +++ b/ACPI-Limit-access-to-custom_method.patch @@ -0,0 +1,30 @@ +From: Matthew Garrett +Date: Fri, 9 Mar 2012 08:39:37 -0500 +Subject: [PATCH] ACPI: Limit access to custom_method + +custom_method effectively allows arbitrary access to system memory, making +it possible for an attacker to circumvent restrictions on module loading. +Disable it if any such restrictions have been enabled. + +Signed-off-by: Matthew Garrett +--- + drivers/acpi/custom_method.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/custom_method.c b/drivers/acpi/custom_method.c +index c68e72414a67..4277938af700 100644 +--- a/drivers/acpi/custom_method.c ++++ b/drivers/acpi/custom_method.c +@@ -29,6 +29,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf, + struct acpi_table_header table; + acpi_status status; + ++ if (secure_modules()) ++ return -EPERM; ++ + if (!(*ppos)) { + /* parse the table header to get the table length */ + if (count <= sizeof(struct acpi_table_header)) +-- +1.9.3 + diff --git a/ARM-tegra-usb-no-reset.patch b/ARM-tegra-usb-no-reset.patch new file mode 100644 index 000000000..2f3dd6872 --- /dev/null +++ b/ARM-tegra-usb-no-reset.patch @@ -0,0 +1,31 @@ +From: Peter Robinson +Date: Thu, 3 May 2012 20:27:11 +0100 +Subject: [PATCH] ARM: tegra: usb no reset + +Patch for disconnect issues with storage attached to a + tegra-ehci controller +--- + drivers/usb/core/hub.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index d481c99a20d7..6050143ce7ec 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5036,6 +5036,13 @@ static void hub_events(void) + (u16) hub->change_bits[0], + (u16) hub->event_bits[0]); + ++ /* Don't disconnect USB-SATA on TrimSlice */ ++ if (strcmp(dev_name(hdev->bus->controller), "tegra-ehci.0") == 0) { ++ if ((hdev->state == 7) && (hub->change_bits[0] == 0) && ++ (hub->event_bits[0] == 0x2)) ++ hub->event_bits[0] = 0; ++ } ++ + /* Lock the device, then check to see if we were + * disconnected while waiting for the lock to succeed. */ + usb_lock_device(hdev); +-- +1.9.3 + diff --git a/Add-EFI-signature-data-types.patch b/Add-EFI-signature-data-types.patch new file mode 100644 index 000000000..b6df877a9 --- /dev/null +++ b/Add-EFI-signature-data-types.patch @@ -0,0 +1,56 @@ +From: Dave Howells +Date: Tue, 23 Oct 2012 09:30:54 -0400 +Subject: [PATCH] Add EFI signature data types + +Add the data types that are used for containing hashes, keys and certificates +for cryptographic verification. + +Bugzilla: N/A +Upstream-status: Fedora mustard for now + +Signed-off-by: David Howells +--- + include/linux/efi.h | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/include/linux/efi.h b/include/linux/efi.h +index ebe6a24cc1e1..5ce40e215f15 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -581,6 +581,12 @@ void efi_native_runtime_setup(void); + #define DEVICE_TREE_GUID \ + EFI_GUID( 0xb1b621d5, 0xf19c, 0x41a5, 0x83, 0x0b, 0xd9, 0x15, 0x2c, 0x69, 0xaa, 0xe0 ) + ++#define EFI_CERT_SHA256_GUID \ ++ EFI_GUID( 0xc1c41626, 0x504c, 0x4092, 0xac, 0xa9, 0x41, 0xf9, 0x36, 0x93, 0x43, 0x28 ) ++ ++#define EFI_CERT_X509_GUID \ ++ EFI_GUID( 0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72 ) ++ + typedef struct { + efi_guid_t guid; + u64 table; +@@ -796,6 +802,20 @@ typedef struct _efi_file_io_interface { + + #define EFI_INVALID_TABLE_ADDR (~0UL) + ++typedef struct { ++ efi_guid_t signature_owner; ++ u8 signature_data[]; ++} efi_signature_data_t; ++ ++typedef struct { ++ efi_guid_t signature_type; ++ u32 signature_list_size; ++ u32 signature_header_size; ++ u32 signature_size; ++ u8 signature_header[]; ++ /* efi_signature_data_t signatures[][] */ ++} efi_signature_list_t; ++ + /* + * All runtime access to EFI goes through this structure: + */ +-- +1.9.3 + diff --git a/Add-an-EFI-signature-blob-parser-and-key-loader.patch b/Add-an-EFI-signature-blob-parser-and-key-loader.patch new file mode 100644 index 000000000..e78b065cd --- /dev/null +++ b/Add-an-EFI-signature-blob-parser-and-key-loader.patch @@ -0,0 +1,178 @@ +From: Dave Howells +Date: Tue, 23 Oct 2012 09:36:28 -0400 +Subject: [PATCH] Add an EFI signature blob parser and key loader. + +X.509 certificates are loaded into the specified keyring as asymmetric type +keys. + +Signed-off-by: David Howells +--- + crypto/asymmetric_keys/Kconfig | 8 +++ + crypto/asymmetric_keys/Makefile | 1 + + crypto/asymmetric_keys/efi_parser.c | 109 ++++++++++++++++++++++++++++++++++++ + include/linux/efi.h | 4 ++ + 4 files changed, 122 insertions(+) + create mode 100644 crypto/asymmetric_keys/efi_parser.c + +diff --git a/crypto/asymmetric_keys/Kconfig b/crypto/asymmetric_keys/Kconfig +index 4870f28403f5..4a1b50d73b80 100644 +--- a/crypto/asymmetric_keys/Kconfig ++++ b/crypto/asymmetric_keys/Kconfig +@@ -67,4 +67,12 @@ config SIGNED_PE_FILE_VERIFICATION + This option provides support for verifying the signature(s) on a + signed PE binary. + ++config EFI_SIGNATURE_LIST_PARSER ++ bool "EFI signature list parser" ++ depends on EFI ++ select X509_CERTIFICATE_PARSER ++ help ++ This option provides support for parsing EFI signature lists for ++ X.509 certificates and turning them into keys. ++ + endif # ASYMMETRIC_KEY_TYPE +diff --git a/crypto/asymmetric_keys/Makefile b/crypto/asymmetric_keys/Makefile +index e47fcd9ac5e8..6512f6596785 100644 +--- a/crypto/asymmetric_keys/Makefile ++++ b/crypto/asymmetric_keys/Makefile +@@ -8,6 +8,7 @@ asymmetric_keys-y := asymmetric_type.o signature.o + + obj-$(CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE) += public_key.o + obj-$(CONFIG_PUBLIC_KEY_ALGO_RSA) += rsa.o ++obj-$(CONFIG_EFI_SIGNATURE_LIST_PARSER) += efi_parser.o + + # + # X.509 Certificate handling +diff --git a/crypto/asymmetric_keys/efi_parser.c b/crypto/asymmetric_keys/efi_parser.c +new file mode 100644 +index 000000000000..424896a0b169 +--- /dev/null ++++ b/crypto/asymmetric_keys/efi_parser.c +@@ -0,0 +1,109 @@ ++/* EFI signature/key/certificate list parser ++ * ++ * Copyright (C) 2012 Red Hat, Inc. All Rights Reserved. ++ * Written by David Howells (dhowells@redhat.com) ++ * ++ * This program is free software; you can redistribute it and/or ++ * modify it under the terms of the GNU General Public Licence ++ * as published by the Free Software Foundation; either version ++ * 2 of the Licence, or (at your option) any later version. ++ */ ++ ++#define pr_fmt(fmt) "EFI: "fmt ++#include ++#include ++#include ++#include ++#include ++ ++static __initdata efi_guid_t efi_cert_x509_guid = EFI_CERT_X509_GUID; ++ ++/** ++ * parse_efi_signature_list - Parse an EFI signature list for certificates ++ * @data: The data blob to parse ++ * @size: The size of the data blob ++ * @keyring: The keyring to add extracted keys to ++ */ ++int __init parse_efi_signature_list(const void *data, size_t size, struct key *keyring) ++{ ++ unsigned offs = 0; ++ size_t lsize, esize, hsize, elsize; ++ ++ pr_devel("-->%s(,%zu)\n", __func__, size); ++ ++ while (size > 0) { ++ efi_signature_list_t list; ++ const efi_signature_data_t *elem; ++ key_ref_t key; ++ ++ if (size < sizeof(list)) ++ return -EBADMSG; ++ ++ memcpy(&list, data, sizeof(list)); ++ pr_devel("LIST[%04x] guid=%pUl ls=%x hs=%x ss=%x\n", ++ offs, ++ list.signature_type.b, list.signature_list_size, ++ list.signature_header_size, list.signature_size); ++ ++ lsize = list.signature_list_size; ++ hsize = list.signature_header_size; ++ esize = list.signature_size; ++ elsize = lsize - sizeof(list) - hsize; ++ ++ if (lsize > size) { ++ pr_devel("<--%s() = -EBADMSG [overrun @%x]\n", ++ __func__, offs); ++ return -EBADMSG; ++ } ++ if (lsize < sizeof(list) || ++ lsize - sizeof(list) < hsize || ++ esize < sizeof(*elem) || ++ elsize < esize || ++ elsize % esize != 0) { ++ pr_devel("- bad size combo @%x\n", offs); ++ return -EBADMSG; ++ } ++ ++ if (efi_guidcmp(list.signature_type, efi_cert_x509_guid) != 0) { ++ data += lsize; ++ size -= lsize; ++ offs += lsize; ++ continue; ++ } ++ ++ data += sizeof(list) + hsize; ++ size -= sizeof(list) + hsize; ++ offs += sizeof(list) + hsize; ++ ++ for (; elsize > 0; elsize -= esize) { ++ elem = data; ++ ++ pr_devel("ELEM[%04x]\n", offs); ++ ++ key = key_create_or_update( ++ make_key_ref(keyring, 1), ++ "asymmetric", ++ NULL, ++ &elem->signature_data, ++ esize - sizeof(*elem), ++ (KEY_POS_ALL & ~KEY_POS_SETATTR) | ++ KEY_USR_VIEW, ++ KEY_ALLOC_NOT_IN_QUOTA | ++ KEY_ALLOC_TRUSTED); ++ ++ if (IS_ERR(key)) ++ pr_err("Problem loading in-kernel X.509 certificate (%ld)\n", ++ PTR_ERR(key)); ++ else ++ pr_notice("Loaded cert '%s' linked to '%s'\n", ++ key_ref_to_ptr(key)->description, ++ keyring->description); ++ ++ data += esize; ++ size -= esize; ++ offs += esize; ++ } ++ } ++ ++ return 0; ++} +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 5ce40e215f15..41359e548bcb 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -906,6 +906,10 @@ extern bool efi_poweroff_required(void); + (md) <= (efi_memory_desc_t *)((m)->map_end - (m)->desc_size); \ + (md) = (void *)(md) + (m)->desc_size) + ++struct key; ++extern int __init parse_efi_signature_list(const void *data, size_t size, ++ struct key *keyring); ++ + /** + * efi_range_is_wc - check the WC bit on an address range + * @start: starting kvirt address +-- +1.9.3 + diff --git a/Add-option-to-automatically-enforce-module-signature.patch b/Add-option-to-automatically-enforce-module-signature.patch new file mode 100644 index 000000000..8e2789aae --- /dev/null +++ b/Add-option-to-automatically-enforce-module-signature.patch @@ -0,0 +1,185 @@ +From: Matthew Garrett +Date: Fri, 9 Aug 2013 18:36:30 -0400 +Subject: [PATCH] Add option to automatically enforce module signatures when in + Secure Boot mode + +UEFI Secure Boot provides a mechanism for ensuring that the firmware will +only load signed bootloaders and kernels. Certain use cases may also +require that all kernel modules also be signed. Add a configuration option +that enforces this automatically when enabled. + +Signed-off-by: Matthew Garrett +--- + Documentation/x86/zero-page.txt | 2 ++ + arch/x86/Kconfig | 10 ++++++++++ + arch/x86/boot/compressed/eboot.c | 36 +++++++++++++++++++++++++++++++++++ + arch/x86/include/uapi/asm/bootparam.h | 3 ++- + arch/x86/kernel/setup.c | 6 ++++++ + include/linux/module.h | 6 ++++++ + kernel/module.c | 7 +++++++ + 7 files changed, 69 insertions(+), 1 deletion(-) + +diff --git a/Documentation/x86/zero-page.txt b/Documentation/x86/zero-page.txt +index 199f453cb4de..ec38acf00b40 100644 +--- a/Documentation/x86/zero-page.txt ++++ b/Documentation/x86/zero-page.txt +@@ -30,6 +30,8 @@ Offset Proto Name Meaning + 1E9/001 ALL eddbuf_entries Number of entries in eddbuf (below) + 1EA/001 ALL edd_mbr_sig_buf_entries Number of entries in edd_mbr_sig_buffer + (below) ++1EB/001 ALL kbd_status Numlock is enabled ++1EC/001 ALL secure_boot Secure boot is enabled in the firmware + 1EF/001 ALL sentinel Used to detect broken bootloaders + 290/040 ALL edd_mbr_sig_buffer EDD MBR signatures + 2D0/A00 ALL e820_map E820 memory map table +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 36327438caf0..61542c282e70 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -1566,6 +1566,16 @@ config EFI_MIXED + + If unsure, say N. + ++config EFI_SECURE_BOOT_SIG_ENFORCE ++ def_bool n ++ prompt "Force module signing when UEFI Secure Boot is enabled" ++ ---help--- ++ UEFI Secure Boot provides a mechanism for ensuring that the ++ firmware will only load signed bootloaders and kernels. Certain ++ use cases may also require that all kernel modules also be signed. ++ Say Y here to automatically enable module signature enforcement ++ when a system boots with UEFI Secure Boot enabled. ++ + config SECCOMP + def_bool y + prompt "Enable seccomp to safely compute untrusted bytecode" +diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c +index de8eebd6f67c..975d11bfaf5b 100644 +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + #undef memcpy /* Use memcpy from misc.c */ + +@@ -814,6 +815,37 @@ out: + return status; + } + ++static int get_secure_boot(void) ++{ ++ u8 sb, setup; ++ unsigned long datasize = sizeof(sb); ++ efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; ++ efi_status_t status; ++ ++ status = efi_early->call((unsigned long)sys_table->runtime->get_variable, ++ L"SecureBoot", &var_guid, NULL, &datasize, &sb); ++ ++ if (status != EFI_SUCCESS) ++ return 0; ++ ++ if (sb == 0) ++ return 0; ++ ++ ++ status = efi_early->call((unsigned long)sys_table->runtime->get_variable, ++ L"SetupMode", &var_guid, NULL, &datasize, ++ &setup); ++ ++ if (status != EFI_SUCCESS) ++ return 0; ++ ++ if (setup == 1) ++ return 0; ++ ++ return 1; ++} ++ ++ + /* + * See if we have Graphics Output Protocol + */ +@@ -1389,6 +1421,10 @@ struct boot_params *efi_main(struct efi_config *c, + else + setup_boot_services32(efi_early); + ++ sanitize_boot_params(boot_params); ++ ++ boot_params->secure_boot = get_secure_boot(); ++ + setup_graphics(boot_params); + + setup_efi_pci(boot_params); +diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h +index 225b0988043a..90dbfb73e11f 100644 +--- a/arch/x86/include/uapi/asm/bootparam.h ++++ b/arch/x86/include/uapi/asm/bootparam.h +@@ -133,7 +133,8 @@ struct boot_params { + __u8 eddbuf_entries; /* 0x1e9 */ + __u8 edd_mbr_sig_buf_entries; /* 0x1ea */ + __u8 kbd_status; /* 0x1eb */ +- __u8 _pad5[3]; /* 0x1ec */ ++ __u8 secure_boot; /* 0x1ec */ ++ __u8 _pad5[2]; /* 0x1ed */ + /* + * The sentinel is set to a nonzero value (0xff) in header.S. + * +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 41ead8d3bc0b..5a5cf7395724 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1142,6 +1142,12 @@ void __init setup_arch(char **cmdline_p) + + io_delay_init(); + ++#ifdef CONFIG_EFI_SECURE_BOOT_SIG_ENFORCE ++ if (boot_params.secure_boot) { ++ enforce_signed_modules(); ++ } ++#endif ++ + /* + * Parse the ACPI tables for possible boot-time SMP configuration. + */ +diff --git a/include/linux/module.h b/include/linux/module.h +index 341a73ecea2e..cca08ac450e2 100644 +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -188,6 +188,12 @@ const struct exception_table_entry *search_exception_tables(unsigned long add); + + struct notifier_block; + ++#ifdef CONFIG_MODULE_SIG ++extern void enforce_signed_modules(void); ++#else ++static inline void enforce_signed_modules(void) {}; ++#endif ++ + #ifdef CONFIG_MODULES + + extern int modules_disabled; /* for sysctl */ +diff --git a/kernel/module.c b/kernel/module.c +index 1f7b4664300e..866417ecc76a 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3843,6 +3843,13 @@ void module_layout(struct module *mod, + EXPORT_SYMBOL(module_layout); + #endif + ++#ifdef CONFIG_MODULE_SIG ++void enforce_signed_modules(void) ++{ ++ sig_enforce = true; ++} ++#endif ++ + bool secure_modules(void) + { + #ifdef CONFIG_MODULE_SIG +-- +1.9.3 + diff --git a/Add-secure_modules-call.patch b/Add-secure_modules-call.patch new file mode 100644 index 000000000..ecf5b894f --- /dev/null +++ b/Add-secure_modules-call.patch @@ -0,0 +1,63 @@ +From: Matthew Garrett +Date: Fri, 9 Aug 2013 17:58:15 -0400 +Subject: [PATCH] Add secure_modules() call + +Provide a single call to allow kernel code to determine whether the system +has been configured to either disable module loading entirely or to load +only modules signed with a trusted key. + +Bugzilla: N/A +Upstream-status: Fedora mustard. Replaced by securelevels, but that was nak'd + +Signed-off-by: Matthew Garrett +--- + include/linux/module.h | 7 +++++++ + kernel/module.c | 10 ++++++++++ + 2 files changed, 17 insertions(+) + +diff --git a/include/linux/module.h b/include/linux/module.h +index 71f282a4e307..341a73ecea2e 100644 +--- a/include/linux/module.h ++++ b/include/linux/module.h +@@ -516,6 +516,8 @@ int unregister_module_notifier(struct notifier_block *nb); + + extern void print_modules(void); + ++extern bool secure_modules(void); ++ + #else /* !CONFIG_MODULES... */ + + /* Given an address, look for it in the exception tables. */ +@@ -626,6 +628,11 @@ static inline int unregister_module_notifier(struct notifier_block *nb) + static inline void print_modules(void) + { + } ++ ++static inline bool secure_modules(void) ++{ ++ return false; ++} + #endif /* CONFIG_MODULES */ + + #ifdef CONFIG_SYSFS +diff --git a/kernel/module.c b/kernel/module.c +index 03214bd288e9..1f7b4664300e 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3842,3 +3842,13 @@ void module_layout(struct module *mod, + } + EXPORT_SYMBOL(module_layout); + #endif ++ ++bool secure_modules(void) ++{ ++#ifdef CONFIG_MODULE_SIG ++ return (sig_enforce || modules_disabled); ++#else ++ return modules_disabled; ++#endif ++} ++EXPORT_SYMBOL(secure_modules); +-- +1.9.3 + diff --git a/sysrq-secure-boot.patch b/Add-sysrq-option-to-disable-secure-boot-mode.patch similarity index 94% rename from sysrq-secure-boot.patch rename to Add-sysrq-option-to-disable-secure-boot-mode.patch index 1b1399340..414fe6e31 100644 --- a/sysrq-secure-boot.patch +++ b/Add-sysrq-option-to-disable-secure-boot-mode.patch @@ -1,11 +1,9 @@ -Bugzilla: N/A -Upstream-status: Fedora mustard - -From 603230771bdbca78e6530d29dbe8b239cdcc8473 Mon Sep 17 00:00:00 2001 From: Kyle McMartin Date: Fri, 30 Aug 2013 09:28:51 -0400 Subject: [PATCH] Add sysrq option to disable secure boot mode +Bugzilla: N/A +Upstream-status: Fedora mustard --- arch/x86/kernel/setup.c | 36 ++++++++++++++++++++++++++++++++++++ drivers/input/misc/uinput.c | 1 + @@ -17,7 +15,7 @@ Subject: [PATCH] Add sysrq option to disable secure boot mode 7 files changed, 65 insertions(+), 10 deletions(-) diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 5ce785fc9f05..2024cbb7169b 100644 +index fb282ff6a802..d291d16ba257 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -70,6 +70,11 @@ @@ -71,10 +69,10 @@ index 5ce785fc9f05..2024cbb7169b 100644 .notifier_call = dump_kernel_offset }; diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c -index 856936247500..1e87a1ea704b 100644 +index 421e29e4cd81..61c1eb97806c 100644 --- a/drivers/input/misc/uinput.c +++ b/drivers/input/misc/uinput.c -@@ -353,6 +353,7 @@ static int uinput_allocate_device(struct uinput_device *udev) +@@ -366,6 +366,7 @@ static int uinput_allocate_device(struct uinput_device *udev) if (!udev->dev) return -ENOMEM; @@ -83,7 +81,7 @@ index 856936247500..1e87a1ea704b 100644 input_set_drvdata(udev->dev, udev); diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c -index 454b65898e2c..19d67594a3b8 100644 +index 42bad18c66c9..496e073b09d7 100644 --- a/drivers/tty/sysrq.c +++ b/drivers/tty/sysrq.c @@ -463,6 +463,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = { @@ -217,7 +215,7 @@ index 387fa7d05c98..4b07e30b3279 100644 int unregister_sysrq_key(int key, struct sysrq_key_op *op); struct sysrq_key_op *__sysrq_get_key_op(int key); diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c -index 2f7c760305ca..abb29d9811af 100644 +index 379650b984f8..070f29fefdc2 100644 --- a/kernel/debug/kdb/kdb_main.c +++ b/kernel/debug/kdb/kdb_main.c @@ -1924,7 +1924,7 @@ static int kdb_sr(int argc, const char **argv) @@ -230,10 +228,10 @@ index 2f7c760305ca..abb29d9811af 100644 return 0; diff --git a/kernel/module.c b/kernel/module.c -index 452079124fb7..37dabbc1e902 100644 +index 866417ecc76a..d7ca95c5a349 100644 --- a/kernel/module.c +++ b/kernel/module.c -@@ -109,9 +109,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */ +@@ -108,9 +108,9 @@ struct list_head *kdb_modules = &modules; /* kdb needs the list of modules */ #ifdef CONFIG_MODULE_SIG #ifdef CONFIG_MODULE_SIG_FORCE diff --git a/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch b/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch deleted file mode 100644 index 9fdc11b7f..000000000 --- a/HID-i2c-hid-call-the-hid-driver-s-suspend-and-resume.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 109571cf3ec78a39477eedd6b11927f52cbcb1e8 Mon Sep 17 00:00:00 2001 -From: Andrew Duggan -Date: Fri, 11 Jul 2014 16:34:18 -0700 -Subject: [PATCH] HID: i2c-hid: call the hid driver's suspend and resume - callbacks - -Currently, the i2c-hid driver does not call the suspend, resume, and -reset_resume callbacks in the hid_driver struct when those events occur. -This means that HID drivers for i2c-hid devices will not be able to execute -commands which may be needed during suspend or resume. One example is when a -touchpad using the hid-multitouch driver gets reset by i2c-hid coming out of -resume. Since the reset_resume callback never gets called the device is never -put back into the correct input mode. This patch calls the suspend and resume -callbacks and tries to duplicate the functionality of the usb-hid driver. - -Bugzilla: 1143812 -Upstream-status: 3.17 - -Signed-off-by: Andrew Duggan -Signed-off-by: Vincent Huang -Reviewed-by: Benjamin Tissoires -Signed-off-by: Jiri Kosina ---- - drivers/hid/i2c-hid/i2c-hid.c | 15 ++++++++++++++- - 1 file changed, 14 insertions(+), 1 deletion(-) - -diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c -index 21aafc8f48c8..747d54421e73 100644 ---- a/drivers/hid/i2c-hid/i2c-hid.c -+++ b/drivers/hid/i2c-hid/i2c-hid.c -@@ -1054,21 +1054,29 @@ static int i2c_hid_remove(struct i2c_client *client) - static int i2c_hid_suspend(struct device *dev) - { - struct i2c_client *client = to_i2c_client(dev); -+ struct i2c_hid *ihid = i2c_get_clientdata(client); -+ struct hid_device *hid = ihid->hid; -+ int ret = 0; - - disable_irq(client->irq); - if (device_may_wakeup(&client->dev)) - enable_irq_wake(client->irq); - -+ if (hid->driver && hid->driver->suspend) -+ ret = hid->driver->suspend(hid, PMSG_SUSPEND); -+ - /* Save some power */ - i2c_hid_set_power(client, I2C_HID_PWR_SLEEP); - -- return 0; -+ return ret; - } - - static int i2c_hid_resume(struct device *dev) - { - int ret; - struct i2c_client *client = to_i2c_client(dev); -+ struct i2c_hid *ihid = i2c_get_clientdata(client); -+ struct hid_device *hid = ihid->hid; - - enable_irq(client->irq); - ret = i2c_hid_hwreset(client); -@@ -1078,6 +1086,11 @@ static int i2c_hid_resume(struct device *dev) - if (device_may_wakeup(&client->dev)) - disable_irq_wake(client->irq); - -+ if (hid->driver && hid->driver->reset_resume) { -+ ret = hid->driver->reset_resume(hid); -+ return ret; -+ } -+ - return 0; - } - #endif --- -2.1.0 - diff --git a/HID-magicmouse-sanity-check-report-size-in-raw_event.patch b/HID-magicmouse-sanity-check-report-size-in-raw_event.patch deleted file mode 100644 index 32863aff6..000000000 --- a/HID-magicmouse-sanity-check-report-size-in-raw_event.patch +++ /dev/null @@ -1,51 +0,0 @@ -From c54def7bd64d7c0b6993336abcffb8444795bf38 Mon Sep 17 00:00:00 2001 -From: Jiri Kosina -Date: Wed, 27 Aug 2014 09:12:24 +0200 -Subject: [PATCH] HID: magicmouse: sanity check report size in raw_event() - callback - -The report passed to us from transport driver could potentially be -arbitrarily large, therefore we better sanity-check it so that -magicmouse_emit_touch() gets only valid values of raw_id. - -Bugzilla: 1141179 -Upstream-status: 3.17 and CC'd stable - -Cc: stable@vger.kernel.org -Reported-by: Steven Vittitoe -Signed-off-by: Jiri Kosina ---- - drivers/hid/hid-magicmouse.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c -index ecc2cbf300cc..29a74c1efcb8 100644 ---- a/drivers/hid/hid-magicmouse.c -+++ b/drivers/hid/hid-magicmouse.c -@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, - if (size < 4 || ((size - 4) % 9) != 0) - return 0; - npoints = (size - 4) / 9; -+ if (npoints > 15) { -+ hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n", -+ size); -+ return 0; -+ } - msc->ntouches = 0; - for (ii = 0; ii < npoints; ii++) - magicmouse_emit_touch(msc, ii, data + ii * 9 + 4); -@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct hid_device *hdev, - if (size < 6 || ((size - 6) % 8) != 0) - return 0; - npoints = (size - 6) / 8; -+ if (npoints > 15) { -+ hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n", -+ size); -+ return 0; -+ } - msc->ntouches = 0; - for (ii = 0; ii < npoints; ii++) - magicmouse_emit_touch(msc, ii, data + ii * 8 + 6); --- -2.1.0 - diff --git a/HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch b/HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch deleted file mode 100644 index 456d91c9c..000000000 --- a/HID-picolcd-sanity-check-report-size-in-raw_event-ca.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 844817e47eef14141cf59b8d5ac08dd11c0a9189 Mon Sep 17 00:00:00 2001 -From: Jiri Kosina -Date: Wed, 27 Aug 2014 09:13:15 +0200 -Subject: [PATCH] HID: picolcd: sanity check report size in raw_event() - callback - -The report passed to us from transport driver could potentially be -arbitrarily large, therefore we better sanity-check it so that raw_data -that we hold in picolcd_pending structure are always kept within proper -bounds. - -Bugzilla: 1141410 -Upstream-status: 3.17 and CC'd to stable - -Cc: stable@vger.kernel.org -Reported-by: Steven Vittitoe -Signed-off-by: Jiri Kosina ---- - drivers/hid/hid-picolcd_core.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c -index acbb021065ec..020df3c2e8b4 100644 ---- a/drivers/hid/hid-picolcd_core.c -+++ b/drivers/hid/hid-picolcd_core.c -@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_device *hdev, - if (!data) - return 1; - -+ if (size > 64) { -+ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n", -+ size); -+ return 0; -+ } -+ - if (report->id == REPORT_KEY_STATE) { - if (data->input_keys) - ret = picolcd_raw_keypad(data, report, raw_data+1, size-1); --- -2.1.0 - diff --git a/HID-wacom-Add-support-for-the-Cintiq-Companion.patch b/HID-wacom-Add-support-for-the-Cintiq-Companion.patch new file mode 100644 index 000000000..276fa103f --- /dev/null +++ b/HID-wacom-Add-support-for-the-Cintiq-Companion.patch @@ -0,0 +1,46 @@ +From: Benjamin Tissoires +Date: Wed, 3 Sep 2014 15:43:25 -0400 +Subject: [PATCH] HID: wacom: Add support for the Cintiq Companion + +The Wacom Cintiq Companion shares the same sensor than the Cintiq +Companion Hybrid, with the exception of the different PIDs. + +Bugzilla: 1134969 +Upstream-status: Queued for 3.18 + +Signed-off-by: Benjamin Tissoires +--- + drivers/hid/wacom_wac.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index aa6a08eb7ad6..c3cbbfb5811f 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -2573,6 +2573,14 @@ static const struct wacom_features wacom_features_0x309 = + { "Wacom ISDv5 309", .type = WACOM_24HDT, /* Touch */ + .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x0307, .touch_max = 10, + .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE }; ++static const struct wacom_features wacom_features_0x30A = ++ { "Wacom ISDv5 30A", 59352, 33648, 2047, 63, ++ CINTIQ_HYBRID, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200, ++ .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x30C }; ++static const struct wacom_features wacom_features_0x30C = ++ { "Wacom ISDv5 30C", .type = WACOM_24HDT, /* Touch */ ++ .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x30A, .touch_max = 10, ++ .check_for_hid_type = true, .hid_type = HID_TYPE_USBNONE }; + + #define USB_DEVICE_WACOM(prod) \ + HID_DEVICE(BUS_USB, HID_GROUP_WACOM, USB_VENDOR_ID_WACOM, prod),\ +@@ -2708,6 +2716,8 @@ const struct hid_device_id wacom_ids[] = { + { USB_DEVICE_WACOM(0x304) }, + { USB_DEVICE_WACOM(0x307) }, + { USB_DEVICE_WACOM(0x309) }, ++ { USB_DEVICE_WACOM(0x30A) }, ++ { USB_DEVICE_WACOM(0x30C) }, + { USB_DEVICE_WACOM(0x30E) }, + { USB_DEVICE_WACOM(0x314) }, + { USB_DEVICE_WACOM(0x315) }, +-- +1.9.3 + diff --git a/Input-wacom-Add-support-for-the-Cintiq-Companion.patch b/Input-wacom-Add-support-for-the-Cintiq-Companion.patch deleted file mode 100644 index 33691ccff..000000000 --- a/Input-wacom-Add-support-for-the-Cintiq-Companion.patch +++ /dev/null @@ -1,46 +0,0 @@ -From bdfffc320102278edac2db5a397ffbfd89faeab3 Mon Sep 17 00:00:00 2001 -From: Benjamin Tissoires -Date: Wed, 3 Sep 2014 15:43:25 -0400 -Subject: [PATCH] Input: wacom: Add support for the Cintiq Companion - -The Wacom Cintiq Companion shares the same sensor than the Cintiq -Companion Hybrid, with the exception of the different PIDs. - -Bugzilla: 1134969 -Upstream-status: Queued for 3.18 - -Signed-off-by: Benjamin Tissoires ---- - drivers/input/tablet/wacom_wac.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c -index e73cf2c71f35..7f6caf8c85fb 100644 ---- a/drivers/input/tablet/wacom_wac.c -+++ b/drivers/input/tablet/wacom_wac.c -@@ -2332,6 +2332,13 @@ static const struct wacom_features wacom_features_0x0307 = - static const struct wacom_features wacom_features_0x0309 = - { "Wacom ISDv5 309", .type = WACOM_24HDT, /* Touch */ - .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x0307, .touch_max = 10 }; -+static const struct wacom_features wacom_features_0x030A = -+ { "Wacom ISDv5 30A", WACOM_PKGLEN_INTUOS, 59352, 33648, 2047, -+ 63, CINTIQ_HYBRID, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 200, 200, -+ .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x30C }; -+static const struct wacom_features wacom_features_0x030C = -+ { "Wacom ISDv5 30C", .type = WACOM_24HDT, /* Touch */ -+ .oVid = USB_VENDOR_ID_WACOM, .oPid = 0x030A, .touch_max = 10 }; - - #define USB_DEVICE_WACOM(prod) \ - USB_DEVICE(USB_VENDOR_ID_WACOM, prod), \ -@@ -2478,6 +2485,8 @@ const struct usb_device_id wacom_ids[] = { - { USB_DEVICE_WACOM(0xFA) }, - { USB_DEVICE_WACOM(0xFB) }, - { USB_DEVICE_WACOM(0x0307) }, -+ { USB_DEVICE_WACOM(0x030A) }, -+ { USB_DEVICE_DETAILED(0x030C, USB_CLASS_HID, 0, 0) }, - { USB_DEVICE_DETAILED(0x0309, USB_CLASS_HID, 0, 0) }, - { USB_DEVICE_LENOVO(0x6004) }, - { } --- -1.9.3 - diff --git a/KEYS-Add-a-system-blacklist-keyring.patch b/KEYS-Add-a-system-blacklist-keyring.patch new file mode 100644 index 000000000..17ef25bf1 --- /dev/null +++ b/KEYS-Add-a-system-blacklist-keyring.patch @@ -0,0 +1,111 @@ +From: Josh Boyer +Date: Fri, 26 Oct 2012 12:36:24 -0400 +Subject: [PATCH] KEYS: Add a system blacklist keyring + +This adds an additional keyring that is used to store certificates that +are blacklisted. This keyring is searched first when loading signed modules +and if the module's certificate is found, it will refuse to load. This is +useful in cases where third party certificates are used for module signing. + +Signed-off-by: Josh Boyer +--- + include/keys/system_keyring.h | 4 ++++ + init/Kconfig | 9 +++++++++ + kernel/module_signing.c | 12 ++++++++++++ + kernel/system_keyring.c | 17 +++++++++++++++++ + 4 files changed, 42 insertions(+) + +diff --git a/include/keys/system_keyring.h b/include/keys/system_keyring.h +index 72665eb80692..2c7b80d31366 100644 +--- a/include/keys/system_keyring.h ++++ b/include/keys/system_keyring.h +@@ -28,4 +28,8 @@ static inline struct key *get_system_trusted_keyring(void) + } + #endif + ++#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING ++extern struct key *system_blacklist_keyring; ++#endif ++ + #endif /* _KEYS_SYSTEM_KEYRING_H */ +diff --git a/init/Kconfig b/init/Kconfig +index 80a6907f91c5..dfdd7f738247 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1723,6 +1723,15 @@ config SYSTEM_TRUSTED_KEYRING + + Keys in this keyring are used by module signature checking. + ++config SYSTEM_BLACKLIST_KEYRING ++ bool "Provide system-wide ring of blacklisted keys" ++ depends on KEYS ++ help ++ Provide a system keyring to which blacklisted keys can be added. ++ Keys in the keyring are considered entirely untrusted. Keys in this ++ keyring are used by the module signature checking to reject loading ++ of modules signed with a blacklisted key. ++ + config PROFILING + bool "Profiling support" + help +diff --git a/kernel/module_signing.c b/kernel/module_signing.c +index be5b8fac4bd0..fed815fcdaf2 100644 +--- a/kernel/module_signing.c ++++ b/kernel/module_signing.c +@@ -158,6 +158,18 @@ static struct key *request_asymmetric_key(const char *signer, size_t signer_len, + + pr_debug("Look up: \"%s\"\n", id); + ++#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING ++ key = keyring_search(make_key_ref(system_blacklist_keyring, 1), ++ &key_type_asymmetric, id); ++ if (!IS_ERR(key)) { ++ /* module is signed with a cert in the blacklist. reject */ ++ pr_err("Module key '%s' is in blacklist\n", id); ++ key_ref_put(key); ++ kfree(id); ++ return ERR_PTR(-EKEYREJECTED); ++ } ++#endif ++ + key = keyring_search(make_key_ref(system_trusted_keyring, 1), + &key_type_asymmetric, id); + if (IS_ERR(key)) +diff --git a/kernel/system_keyring.c b/kernel/system_keyring.c +index 875f64e8935b..c15e93f5a418 100644 +--- a/kernel/system_keyring.c ++++ b/kernel/system_keyring.c +@@ -20,6 +20,9 @@ + + struct key *system_trusted_keyring; + EXPORT_SYMBOL_GPL(system_trusted_keyring); ++#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING ++struct key *system_blacklist_keyring; ++#endif + + extern __initconst const u8 system_certificate_list[]; + extern __initconst const unsigned long system_certificate_list_size; +@@ -41,6 +44,20 @@ static __init int system_trusted_keyring_init(void) + panic("Can't allocate system trusted keyring\n"); + + set_bit(KEY_FLAG_TRUSTED_ONLY, &system_trusted_keyring->flags); ++ ++#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING ++ system_blacklist_keyring = keyring_alloc(".system_blacklist_keyring", ++ KUIDT_INIT(0), KGIDT_INIT(0), ++ current_cred(), ++ (KEY_POS_ALL & ~KEY_POS_SETATTR) | ++ KEY_USR_VIEW | KEY_USR_READ, ++ KEY_ALLOC_NOT_IN_QUOTA, NULL); ++ if (IS_ERR(system_blacklist_keyring)) ++ panic("Can't allocate system blacklist keyring\n"); ++ ++ set_bit(KEY_FLAG_TRUSTED_ONLY, &system_blacklist_keyring->flags); ++#endif ++ + return 0; + } + +-- +1.9.3 + diff --git a/KEYS-Reinstate-EPERM-for-a-key-type-name-beginning-w.patch b/KEYS-Reinstate-EPERM-for-a-key-type-name-beginning-w.patch new file mode 100644 index 000000000..cd141ea8d --- /dev/null +++ b/KEYS-Reinstate-EPERM-for-a-key-type-name-beginning-w.patch @@ -0,0 +1,44 @@ +From: David Howells +Date: Tue, 16 Sep 2014 17:29:03 +0100 +Subject: [PATCH] KEYS: Reinstate EPERM for a key type name beginning with a + '.' + +Reinstate the generation of EPERM for a key type name beginning with a '.' in +a userspace call. Types whose name begins with a '.' are internal only. + +The test was removed by: + + commit a4e3b8d79a5c6d40f4a9703abf7fe3abcc6c3b8d + Author: Mimi Zohar + Date: Thu May 22 14:02:23 2014 -0400 + Subject: KEYS: special dot prefixed keyring name bug fix + +I think we want to keep the restriction on type name so that userspace can't +add keys of a special internal type. + +Note that removal of the test causes several of the tests in the keyutils +testsuite to fail. + +Signed-off-by: David Howells +Acked-by: Vivek Goyal +cc: Mimi Zohar +--- + security/keys/keyctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index e26f860e5f2e..eff88a5f5d40 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -37,6 +37,8 @@ static int key_get_type_from_user(char *type, + return ret; + if (ret == 0 || ret >= len) + return -EINVAL; ++ if (type[0] == '.') ++ return -EPERM; + type[len - 1] = '\0'; + return 0; + } +-- +1.9.3 + diff --git a/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch b/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch new file mode 100644 index 000000000..a23a15cd3 --- /dev/null +++ b/MODSIGN-Import-certificates-from-UEFI-Secure-Boot.patch @@ -0,0 +1,185 @@ +From: Josh Boyer +Date: Fri, 26 Oct 2012 12:42:16 -0400 +Subject: [PATCH] MODSIGN: Import certificates from UEFI Secure Boot + +Secure Boot stores a list of allowed certificates in the 'db' variable. +This imports those certificates into the system trusted keyring. This +allows for a third party signing certificate to be used in conjunction +with signed modules. By importing the public certificate into the 'db' +variable, a user can allow a module signed with that certificate to +load. The shim UEFI bootloader has a similar certificate list stored +in the 'MokListRT' variable. We import those as well. + +In the opposite case, Secure Boot maintains a list of disallowed +certificates in the 'dbx' variable. We load those certificates into +the newly introduced system blacklist keyring and forbid any module +signed with those from loading. + +Signed-off-by: Josh Boyer +--- + include/linux/efi.h | 6 ++++ + init/Kconfig | 9 +++++ + kernel/Makefile | 3 ++ + kernel/modsign_uefi.c | 92 +++++++++++++++++++++++++++++++++++++++++++++++++++ + 4 files changed, 110 insertions(+) + create mode 100644 kernel/modsign_uefi.c + +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 41359e548bcb..db9e6118575e 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -587,6 +587,12 @@ void efi_native_runtime_setup(void); + #define EFI_CERT_X509_GUID \ + EFI_GUID( 0xa5c059a1, 0x94e4, 0x4aa7, 0x87, 0xb5, 0xab, 0x15, 0x5c, 0x2b, 0xf0, 0x72 ) + ++#define EFI_IMAGE_SECURITY_DATABASE_GUID \ ++ EFI_GUID( 0xd719b2cb, 0x3d3a, 0x4596, 0xa3, 0xbc, 0xda, 0xd0, 0x0e, 0x67, 0x65, 0x6f ) ++ ++#define EFI_SHIM_LOCK_GUID \ ++ EFI_GUID( 0x605dab50, 0xe046, 0x4300, 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23 ) ++ + typedef struct { + efi_guid_t guid; + u64 table; +diff --git a/init/Kconfig b/init/Kconfig +index dfdd7f738247..3c866db603a7 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1877,6 +1877,15 @@ config MODULE_SIG_ALL + comment "Do not forget to sign required modules with scripts/sign-file" + depends on MODULE_SIG_FORCE && !MODULE_SIG_ALL + ++config MODULE_SIG_UEFI ++ bool "Allow modules signed with certs stored in UEFI" ++ depends on MODULE_SIG && SYSTEM_BLACKLIST_KEYRING && EFI ++ select EFI_SIGNATURE_LIST_PARSER ++ help ++ This will import certificates stored in UEFI and allow modules ++ signed with those to be loaded. It will also disallow loading ++ of modules stored in the UEFI dbx variable. ++ + choice + prompt "Which hash algorithm should modules be signed with?" + depends on MODULE_SIG +diff --git a/kernel/Makefile b/kernel/Makefile +index dc5c77544fd6..95bdf3398880 100644 +--- a/kernel/Makefile ++++ b/kernel/Makefile +@@ -45,6 +45,7 @@ obj-$(CONFIG_UID16) += uid16.o + obj-$(CONFIG_SYSTEM_TRUSTED_KEYRING) += system_keyring.o system_certificates.o + obj-$(CONFIG_MODULES) += module.o + obj-$(CONFIG_MODULE_SIG) += module_signing.o ++obj-$(CONFIG_MODULE_SIG_UEFI) += modsign_uefi.o + obj-$(CONFIG_KALLSYMS) += kallsyms.o + obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o + obj-$(CONFIG_KEXEC) += kexec.o +@@ -99,6 +100,8 @@ obj-$(CONFIG_TORTURE_TEST) += torture.o + + $(obj)/configs.o: $(obj)/config_data.h + ++$(obj)/modsign_uefi.o: KBUILD_CFLAGS += -fshort-wchar ++ + # config_data.h contains the same information as ikconfig.h but gzipped. + # Info from config_data can be extracted from /proc/config* + targets += config_data.gz +diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c +new file mode 100644 +index 000000000000..94b0eb38a284 +--- /dev/null ++++ b/kernel/modsign_uefi.c +@@ -0,0 +1,92 @@ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include "module-internal.h" ++ ++static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size) ++{ ++ efi_status_t status; ++ unsigned long lsize = 4; ++ unsigned long tmpdb[4]; ++ void *db = NULL; ++ ++ status = efi.get_variable(name, guid, NULL, &lsize, &tmpdb); ++ if (status != EFI_BUFFER_TOO_SMALL) { ++ pr_err("Couldn't get size: 0x%lx\n", status); ++ return NULL; ++ } ++ ++ db = kmalloc(lsize, GFP_KERNEL); ++ if (!db) { ++ pr_err("Couldn't allocate memory for uefi cert list\n"); ++ goto out; ++ } ++ ++ status = efi.get_variable(name, guid, NULL, &lsize, db); ++ if (status != EFI_SUCCESS) { ++ kfree(db); ++ db = NULL; ++ pr_err("Error reading db var: 0x%lx\n", status); ++ } ++out: ++ *size = lsize; ++ return db; ++} ++ ++/* ++ * * Load the certs contained in the UEFI databases ++ * */ ++static int __init load_uefi_certs(void) ++{ ++ efi_guid_t secure_var = EFI_IMAGE_SECURITY_DATABASE_GUID; ++ efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; ++ void *db = NULL, *dbx = NULL, *mok = NULL; ++ unsigned long dbsize = 0, dbxsize = 0, moksize = 0; ++ int rc = 0; ++ ++ /* Check if SB is enabled and just return if not */ ++ if (!efi_enabled(EFI_SECURE_BOOT)) ++ return 0; ++ ++ /* Get db, MokListRT, and dbx. They might not exist, so it isn't ++ * an error if we can't get them. ++ */ ++ db = get_cert_list(L"db", &secure_var, &dbsize); ++ if (!db) { ++ pr_err("MODSIGN: Couldn't get UEFI db list\n"); ++ } else { ++ rc = parse_efi_signature_list(db, dbsize, system_trusted_keyring); ++ if (rc) ++ pr_err("Couldn't parse db signatures: %d\n", rc); ++ kfree(db); ++ } ++ ++ mok = get_cert_list(L"MokListRT", &mok_var, &moksize); ++ if (!mok) { ++ pr_info("MODSIGN: Couldn't get UEFI MokListRT\n"); ++ } else { ++ rc = parse_efi_signature_list(mok, moksize, system_trusted_keyring); ++ if (rc) ++ pr_err("Couldn't parse MokListRT signatures: %d\n", rc); ++ kfree(mok); ++ } ++ ++ dbx = get_cert_list(L"dbx", &secure_var, &dbxsize); ++ if (!dbx) { ++ pr_info("MODSIGN: Couldn't get UEFI dbx list\n"); ++ } else { ++ rc = parse_efi_signature_list(dbx, dbxsize, ++ system_blacklist_keyring); ++ if (rc) ++ pr_err("Couldn't parse dbx signatures: %d\n", rc); ++ kfree(dbx); ++ } ++ ++ return rc; ++} ++late_initcall(load_uefi_certs); +-- +1.9.3 + diff --git a/MODSIGN-Support-not-importing-certs-from-db.patch b/MODSIGN-Support-not-importing-certs-from-db.patch new file mode 100644 index 000000000..6ed99e627 --- /dev/null +++ b/MODSIGN-Support-not-importing-certs-from-db.patch @@ -0,0 +1,83 @@ +From: Josh Boyer +Date: Thu, 3 Oct 2013 10:14:23 -0400 +Subject: [PATCH] MODSIGN: Support not importing certs from db + +If a user tells shim to not use the certs/hashes in the UEFI db variable +for verification purposes, shim will set a UEFI variable called MokIgnoreDB. +Have the uefi import code look for this and not import things from the db +variable. + +Signed-off-by: Josh Boyer +--- + kernel/modsign_uefi.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +diff --git a/kernel/modsign_uefi.c b/kernel/modsign_uefi.c +index 94b0eb38a284..ae28b974d49a 100644 +--- a/kernel/modsign_uefi.c ++++ b/kernel/modsign_uefi.c +@@ -8,6 +8,23 @@ + #include + #include "module-internal.h" + ++static __init int check_ignore_db(void) ++{ ++ efi_status_t status; ++ unsigned int db = 0; ++ unsigned long size = sizeof(db); ++ efi_guid_t guid = EFI_SHIM_LOCK_GUID; ++ ++ /* Check and see if the MokIgnoreDB variable exists. If that fails ++ * then we don't ignore DB. If it succeeds, we do. ++ */ ++ status = efi.get_variable(L"MokIgnoreDB", &guid, NULL, &size, &db); ++ if (status != EFI_SUCCESS) ++ return 0; ++ ++ return 1; ++} ++ + static __init void *get_cert_list(efi_char16_t *name, efi_guid_t *guid, unsigned long *size) + { + efi_status_t status; +@@ -47,23 +64,28 @@ static int __init load_uefi_certs(void) + efi_guid_t mok_var = EFI_SHIM_LOCK_GUID; + void *db = NULL, *dbx = NULL, *mok = NULL; + unsigned long dbsize = 0, dbxsize = 0, moksize = 0; +- int rc = 0; ++ int ignore_db, rc = 0; + + /* Check if SB is enabled and just return if not */ + if (!efi_enabled(EFI_SECURE_BOOT)) + return 0; + ++ /* See if the user has setup Ignore DB mode */ ++ ignore_db = check_ignore_db(); ++ + /* Get db, MokListRT, and dbx. They might not exist, so it isn't + * an error if we can't get them. + */ +- db = get_cert_list(L"db", &secure_var, &dbsize); +- if (!db) { +- pr_err("MODSIGN: Couldn't get UEFI db list\n"); +- } else { +- rc = parse_efi_signature_list(db, dbsize, system_trusted_keyring); +- if (rc) +- pr_err("Couldn't parse db signatures: %d\n", rc); +- kfree(db); ++ if (!ignore_db) { ++ db = get_cert_list(L"db", &secure_var, &dbsize); ++ if (!db) { ++ pr_err("MODSIGN: Couldn't get UEFI db list\n"); ++ } else { ++ rc = parse_efi_signature_list(db, dbsize, system_trusted_keyring); ++ if (rc) ++ pr_err("Couldn't parse db signatures: %d\n", rc); ++ kfree(db); ++ } + } + + mok = get_cert_list(L"MokListRT", &mok_var, &moksize); +-- +1.9.3 + diff --git a/PCI-Lock-down-BAR-access-when-module-security-is-ena.patch b/PCI-Lock-down-BAR-access-when-module-security-is-ena.patch new file mode 100644 index 000000000..2fc17c0b4 --- /dev/null +++ b/PCI-Lock-down-BAR-access-when-module-security-is-ena.patch @@ -0,0 +1,116 @@ +From: Matthew Garrett +Date: Thu, 8 Mar 2012 10:10:38 -0500 +Subject: [PATCH] PCI: Lock down BAR access when module security is enabled + +Any hardware that can potentially generate DMA has to be locked down from +userspace in order to avoid it being possible for an attacker to modify +kernel code, allowing them to circumvent disabled module loading or module +signing. Default to paranoid - in future we can potentially relax this for +sufficiently IOMMU-isolated devices. + +Signed-off-by: Matthew Garrett +--- + drivers/pci/pci-sysfs.c | 10 ++++++++++ + drivers/pci/proc.c | 8 +++++++- + drivers/pci/syscall.c | 3 ++- + 3 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index 9ff0a901ecf7..8d0d5d92b8d9 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include "pci.h" + + static int sysfs_initialized; /* = 0 */ +@@ -704,6 +705,9 @@ static ssize_t pci_write_config(struct file *filp, struct kobject *kobj, + loff_t init_off = off; + u8 *data = (u8 *) buf; + ++ if (secure_modules()) ++ return -EPERM; ++ + if (off > dev->cfg_size) + return 0; + if (off + count > dev->cfg_size) { +@@ -998,6 +1002,9 @@ static int pci_mmap_resource(struct kobject *kobj, struct bin_attribute *attr, + resource_size_t start, end; + int i; + ++ if (secure_modules()) ++ return -EPERM; ++ + for (i = 0; i < PCI_ROM_RESOURCE; i++) + if (res == &pdev->resource[i]) + break; +@@ -1099,6 +1106,9 @@ static ssize_t pci_write_resource_io(struct file *filp, struct kobject *kobj, + struct bin_attribute *attr, char *buf, + loff_t off, size_t count) + { ++ if (secure_modules()) ++ return -EPERM; ++ + return pci_resource_io(filp, kobj, attr, buf, off, count, true); + } + +diff --git a/drivers/pci/proc.c b/drivers/pci/proc.c +index 3f155e78513f..4265ea07e3b0 100644 +--- a/drivers/pci/proc.c ++++ b/drivers/pci/proc.c +@@ -116,6 +116,9 @@ static ssize_t proc_bus_pci_write(struct file *file, const char __user *buf, + int size = dev->cfg_size; + int cnt; + ++ if (secure_modules()) ++ return -EPERM; ++ + if (pos >= size) + return 0; + if (nbytes >= size) +@@ -195,6 +198,9 @@ static long proc_bus_pci_ioctl(struct file *file, unsigned int cmd, + #endif /* HAVE_PCI_MMAP */ + int ret = 0; + ++ if (secure_modules()) ++ return -EPERM; ++ + switch (cmd) { + case PCIIOC_CONTROLLER: + ret = pci_domain_nr(dev->bus); +@@ -233,7 +239,7 @@ static int proc_bus_pci_mmap(struct file *file, struct vm_area_struct *vma) + struct pci_filp_private *fpriv = file->private_data; + int i, ret; + +- if (!capable(CAP_SYS_RAWIO)) ++ if (!capable(CAP_SYS_RAWIO) || secure_modules()) + return -EPERM; + + /* Make sure the caller is mapping a real resource for this device */ +diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c +index b91c4da68365..98f5637304d1 100644 +--- a/drivers/pci/syscall.c ++++ b/drivers/pci/syscall.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include "pci.h" + +@@ -92,7 +93,7 @@ SYSCALL_DEFINE5(pciconfig_write, unsigned long, bus, unsigned long, dfn, + u32 dword; + int err = 0; + +- if (!capable(CAP_SYS_ADMIN)) ++ if (!capable(CAP_SYS_ADMIN) || secure_modules()) + return -EPERM; + + dev = pci_get_bus_and_slot(bus, dfn); +-- +1.9.3 + diff --git a/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch b/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch new file mode 100644 index 000000000..003bfec72 --- /dev/null +++ b/Restrict-dev-mem-and-dev-kmem-when-module-loading-is.patch @@ -0,0 +1,41 @@ +From: Matthew Garrett +Date: Fri, 9 Mar 2012 09:28:15 -0500 +Subject: [PATCH] Restrict /dev/mem and /dev/kmem when module loading is + restricted + +Allowing users to write to address space makes it possible for the kernel +to be subverted, avoiding module loading restrictions. Prevent this when +any restrictions have been imposed on loading modules. + +Signed-off-by: Matthew Garrett +--- + drivers/char/mem.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/char/mem.c b/drivers/char/mem.c +index cdf839f9defe..c63cf93b00eb 100644 +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -164,6 +164,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf, + if (p != *ppos) + return -EFBIG; + ++ if (secure_modules()) ++ return -EPERM; ++ + if (!valid_phys_addr_range(p, count)) + return -EFAULT; + +@@ -502,6 +505,9 @@ static ssize_t write_kmem(struct file *file, const char __user *buf, + char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */ + int err = 0; + ++ if (secure_modules()) ++ return -EPERM; ++ + if (p < (unsigned long) high_memory) { + unsigned long to_write = min_t(unsigned long, count, + (unsigned long)high_memory - p); +-- +1.9.3 + diff --git a/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch b/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch index 2f44032c8..0f3a70150 100644 --- a/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch +++ b/Revert-Revert-ACPI-video-change-acpi-video-brightnes.patch @@ -1,23 +1,24 @@ -Bugzilla: N/A -Upstream-status: Sigh. We almost got to drop this. - -From 20e3f1e1b9341d233a11734c07c076caac9936ef Mon Sep 17 00:00:00 2001 From: Josh Boyer Date: Mon, 28 Jul 2014 12:59:48 -0400 Subject: [PATCH] Revert "Revert "ACPI / video: change acpi-video brightness_switch_enabled default to 0"" This reverts commit 2843768b701971ab10e62c77d5c75ad7c306f1bd. + +Bugzilla: N/A +Upstream-status: Sigh. We almost got to drop this. + +Signed-off-by: Josh Boyer --- Documentation/kernel-parameters.txt | 2 +- drivers/acpi/video.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index b7fa2f599459..e8db409a7e3a 100644 +index 10d51c2f10d7..5b6ebe8b519e 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt -@@ -3532,7 +3532,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. +@@ -3596,7 +3596,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted. the allocated input device; If set to 0, video driver will only send out the event without touching backlight brightness level. @@ -27,7 +28,7 @@ index b7fa2f599459..e8db409a7e3a 100644 virtio_mmio.device= [VMMIO] Memory mapped virtio (platform) device. diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c -index 350d52a8f781..44c89f705018 100644 +index 8e7e18567ae6..a3d293806f96 100644 --- a/drivers/acpi/video.c +++ b/drivers/acpi/video.c @@ -68,7 +68,7 @@ MODULE_AUTHOR("Bruno Ducrot"); diff --git a/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch b/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch new file mode 100644 index 000000000..cea06c30f --- /dev/null +++ b/acpi-Ignore-acpi_rsdp-kernel-parameter-when-module-l.patch @@ -0,0 +1,38 @@ +From: Josh Boyer +Date: Mon, 25 Jun 2012 19:57:30 -0400 +Subject: [PATCH] acpi: Ignore acpi_rsdp kernel parameter when module loading + is restricted + +This option allows userspace to pass the RSDP address to the kernel, which +makes it possible for a user to circumvent any restrictions imposed on +loading modules. Disable it in that case. + +Signed-off-by: Josh Boyer +--- + drivers/acpi/osl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index 3abe9b223ba7..ee8f11cf65da 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -44,6 +44,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -245,7 +246,7 @@ early_param("acpi_rsdp", setup_acpi_rsdp); + acpi_physical_address __init acpi_os_get_root_pointer(void) + { + #ifdef CONFIG_KEXEC +- if (acpi_rsdp) ++ if (acpi_rsdp && !secure_modules()) + return acpi_rsdp; + #endif + +-- +1.9.3 + diff --git a/0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch b/acpi-video-Add-4-new-models-to-the-use_native_backli.patch similarity index 81% rename from 0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch rename to acpi-video-Add-4-new-models-to-the-use_native_backli.patch index dd7f27367..4411248f3 100644 --- a/0001-acpi-video-Add-4-new-models-to-the-use_native_backli.patch +++ b/acpi-video-Add-4-new-models-to-the-use_native_backli.patch @@ -1,8 +1,7 @@ -From 5573624261ab5d54f2dea2a3e09a98729db9ecd9 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Wed, 30 Apr 2014 15:24:19 +0200 -Subject: [PATCH 1/2] acpi-video: Add 4 new models to the use_native_backlight - dmi list +Subject: [PATCH] acpi-video: Add 4 new models to the use_native_backlight dmi + list Acer Aspire V5-171 https://bugzilla.redhat.com/show_bug.cgi?id=983342 @@ -21,10 +20,10 @@ Signed-off-by: Hans de Goede 1 file changed, 32 insertions(+) diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c -index 8b6990e..48146fc 100644 +index a3d293806f96..5c8ce8c699fc 100644 --- a/drivers/acpi/video.c +++ b/drivers/acpi/video.c -@@ -488,6 +488,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { +@@ -556,6 +556,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { }, }, { @@ -39,7 +38,7 @@ index 8b6990e..48146fc 100644 .callback = video_set_use_native_backlight, .ident = "Thinkpad Helix", .matches = { -@@ -513,6 +521,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { +@@ -597,6 +605,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { }, { .callback = video_set_use_native_backlight, @@ -54,7 +53,7 @@ index 8b6990e..48146fc 100644 .ident = "Acer Aspire V5-431", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Acer"), -@@ -520,6 +536,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { +@@ -644,6 +660,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { }, }, { @@ -69,7 +68,7 @@ index 8b6990e..48146fc 100644 .callback = video_set_use_native_backlight, .ident = "HP ProBook 4340s", .matches = { -@@ -571,6 +595,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { +@@ -720,6 +744,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { }, { .callback = video_set_use_native_backlight, @@ -85,5 +84,5 @@ index 8b6990e..48146fc 100644 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), -- -1.9.0 +1.9.3 diff --git a/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch b/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch index f3d36889f..fb77e5641 100644 --- a/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch +++ b/acpi-video-Add-use-native-backlight-quirk-for-the-Th.patch @@ -1,11 +1,7 @@ -Bugzilla: 1093171 -Upstream-status: Queued for 3.16 - -From 7ac976d0109433d1ad0812f4f6889a904d9a0c40 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Mon, 2 Jun 2014 17:41:10 +0200 -Subject: [PATCH 13/14] acpi-video: Add use native backlight quirk for the - ThinkPad W530 +Subject: [PATCH] acpi-video: Add use native backlight quirk for the ThinkPad + W530 Like all of the other *30 ThinkPad models, the W530 has a broken acpi-video backlight control. Note in order for this to actually fix things on the @@ -15,6 +11,9 @@ is also needed. https://bugzilla.redhat.com/show_bug.cgi?id=1093171 +Bugzilla: 1093171 +Upstream-status: Queued for 3.16 + Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede --- @@ -22,10 +21,10 @@ Signed-off-by: Hans de Goede 1 file changed, 8 insertions(+) diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c -index ab7cd65ce21e..dcb0ef4c22f6 100644 +index 5c8ce8c699fc..d8a6ecb0b2b2 100644 --- a/drivers/acpi/video.c +++ b/drivers/acpi/video.c -@@ -468,6 +468,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { +@@ -469,6 +469,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { }, { .callback = video_set_use_native_backlight, @@ -41,5 +40,5 @@ index ab7cd65ce21e..dcb0ef4c22f6 100644 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), -- -1.9.0 +1.9.3 diff --git a/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch b/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch index c8c1f7aa2..33a26383b 100644 --- a/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch +++ b/acpi-video-Add-use_native_backlight-quirk-for-HP-Pro.patch @@ -1,16 +1,15 @@ -Bugzilla: 1025690 -Upstream-status: Waiting for feedback from reporter - -From dfe2c6722a6f6cb45f6b336b094b26a77acd8393 Mon Sep 17 00:00:00 2001 From: Hans de Goede Date: Mon, 2 Jun 2014 17:41:11 +0200 -Subject: [PATCH 14/14] acpi-video: Add use_native_backlight quirk for HP - ProBook 4540s +Subject: [PATCH] acpi-video: Add use_native_backlight quirk for HP ProBook + 4540s As reported here: https://bugzilla.redhat.com/show_bug.cgi?id=1025690 This is yet another model which needs this quirk. +Bugzilla: 1025690 +Upstream-status: Waiting for feedback from reporter + Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede --- @@ -18,10 +17,10 @@ Signed-off-by: Hans de Goede 1 file changed, 8 insertions(+) diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c -index dcb0ef4c22f6..3db16753f88a 100644 +index d8a6ecb0b2b2..8dbf009521c7 100644 --- a/drivers/acpi/video.c +++ b/drivers/acpi/video.c -@@ -548,6 +548,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { +@@ -693,6 +693,14 @@ static struct dmi_system_id video_dmi_table[] __initdata = { }, { .callback = video_set_use_native_backlight, @@ -37,5 +36,5 @@ index dcb0ef4c22f6..3db16753f88a 100644 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), -- -1.9.0 +1.9.3 diff --git a/arm-beagle.patch b/arm-beagle.patch deleted file mode 100644 index 5e2d8abdc..000000000 --- a/arm-beagle.patch +++ /dev/null @@ -1,460 +0,0 @@ -Bugzilla: 1012025 -Upstream-status: In beagle github repository https://github.com/beagleboard/kernel - -From b5a2528c89fc8049b2a6a750634c14983e33d00f Mon Sep 17 00:00:00 2001 -From: Robert Nelson -Date: Fri, 27 Dec 2013 13:05:09 -0600 -Subject: [PATCH] arm: dts: am335x-boneblack: lcdc add panel-info - -Signed-off-by: Robert Nelson ---- - arch/arm/boot/dts/am335x-boneblack.dts | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -diff --git a/arch/arm/boot/dts/am335x-boneblack.dts b/arch/arm/boot/dts/am335x-boneblack.dts -index 6b71ad9..09ffbd8 100644 ---- a/arch/arm/boot/dts/am335x-boneblack.dts -+++ b/arch/arm/boot/dts/am335x-boneblack.dts -@@ -74,5 +74,18 @@ - pinctrl-0 = <&nxp_hdmi_bonelt_pins>; - pinctrl-1 = <&nxp_hdmi_bonelt_off_pins>; - status = "okay"; -+ -+ panel-info { -+ bpp = <16>; -+ ac-bias = <255>; -+ ac-bias-intrpt = <0>; -+ dma-burst-sz = <16>; -+ fdd = <16>; -+ sync-edge = <1>; -+ sync-ctrl = <1>; -+ raster-order = <0>; -+ fifo-th = <0>; -+ invert-pxl-clk; -+ }; - }; - }; --- -1.8.5.1 - -From 1da083a002581520dd358b8b8e097078000d12b9 Mon Sep 17 00:00:00 2001 -From: Robert Nelson -Date: Fri, 27 Dec 2013 13:14:19 -0600 -Subject: [PATCH 2/2] arm: dts: am335x-boneblack: add cpu0 opp points - -Signed-off-by: Robert Nelson ---- - arch/arm/boot/dts/am335x-boneblack.dts | 18 ++++++++++++++++++ - 1 file changed, 18 insertions(+) - -diff --git a/arch/arm/boot/dts/am335x-boneblack.dts b/arch/arm/boot/dts/am335x-boneblack.dts -index 09ffbd8..f213ccd 100644 ---- a/arch/arm/boot/dts/am335x-boneblack.dts -+++ b/arch/arm/boot/dts/am335x-boneblack.dts -@@ -67,6 +67,24 @@ - }; - - / { -+ cpus { -+ cpu@0 { -+ cpu0-supply = <&dcdc2_reg>; -+ /* -+ * To consider voltage drop between PMIC and SoC, -+ * tolerance value is reduced to 2% from 4% and -+ * voltage value is increased as a precaution. -+ */ -+ operating-points = < -+ /* kHz uV */ -+ 1000000 1325000 -+ 800000 1300000 -+ 600000 1112000 -+ 300000 969000 -+ >; -+ }; -+ }; -+ - hdmi { - compatible = "ti,tilcdc,slave"; - i2c = <&i2c0>; --- -1.8.5.1 - -From 8551d8aa7d3e002da2097e7e902fb96fceb8694e Mon Sep 17 00:00:00 2001 -From: Robert Nelson -Date: Tue, 31 Dec 2013 11:17:45 -0600 -Subject: [PATCH 3/3] arm: dts: am335x-bone-common: enable and use i2c2 - -Signed-off-by: Robert Nelson ---- - arch/arm/boot/dts/am335x-bone-common.dtsi | 39 +++++++++++++++++++++++++++++++ - 1 file changed, 39 insertions(+) - -diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi -index e3f27ec..54366b6 100644 ---- a/arch/arm/boot/dts/am335x-bone-common.dtsi -+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi -@@ -84,6 +84,13 @@ - >; - }; - -+ i2c2_pins: pinmux_i2c2_pins { -+ pinctrl-single,pins = < -+ 0x178 0x73 /* (SLEWCTRL_SLOW | PIN_INPUT_PULLUP | MUX_MODE3) uart1_ctsn.i2c2_sda */ -+ 0x17c 0x73 /* (SLEWCTRL_SLOW | PIN_INPUT_PULLUP | MUX_MODE3) uart1_rtsn.i2c2_scl */ -+ >; -+ }; -+ - uart0_pins: pinmux_uart0_pins { - pinctrl-single,pins = < - 0x170 (PIN_INPUT_PULLUP | MUX_MODE0) /* uart0_rxd.uart0_rxd */ -@@ -220,6 +227,38 @@ - reg = <0x24>; - }; - -+ baseboard_eeprom: baseboard_eeprom@50 { -+ compatible = "at,24c256"; -+ reg = <0x50>; -+ }; -+}; -+ -+&i2c2 { -+ status = "okay"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&i2c2_pins>; -+ -+ clock-frequency = <100000>; -+ -+ cape_eeprom0: cape_eeprom0@54 { -+ compatible = "at,24c256"; -+ reg = <0x54>; -+ }; -+ -+ cape_eeprom1: cape_eeprom1@55 { -+ compatible = "at,24c256"; -+ reg = <0x55>; -+ }; -+ -+ cape_eeprom2: cape_eeprom2@56 { -+ compatible = "at,24c256"; -+ reg = <0x56>; -+ }; -+ -+ cape_eeprom3: cape_eeprom3@57 { -+ compatible = "at,24c256"; -+ reg = <0x57>; -+ }; - }; - - /include/ "tps65217.dtsi" --- -1.8.5.2 - -From a3099dc53a47d1694a5b575580ec3406dc429bf8 Mon Sep 17 00:00:00 2001 -From: Robert Nelson -Date: Tue, 31 Dec 2013 14:18:00 -0600 -Subject: [PATCH 4/4] arm: dts: am335x-bone-common: setup default pinmux - http://elinux.org/Basic_Proto_Cape - -Signed-off-by: Robert Nelson ---- - arch/arm/boot/dts/am335x-bone-common.dtsi | 130 ++++++++++++++++++++++++++++++ - 1 file changed, 130 insertions(+) - -diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi -index e4571af..f85cabc 100644 ---- a/arch/arm/boot/dts/am335x-bone-common.dtsi -+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi -@@ -98,6 +98,13 @@ - >; - }; - -+ uart1_pins: pinmux_uart1_pins { -+ pinctrl-single,pins = < -+ 0x180 (PIN_INPUT_PULLUP | MUX_MODE0) /* uart1_rxd.uart1_rxd */ -+ 0x184 (PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* uart1_txd.uart1_txd */ -+ >; -+ }; -+ - clkout2_pin: pinmux_clkout2_pin { - pinctrl-single,pins = < - 0x1b4 (PIN_OUTPUT_PULLDOWN | MUX_MODE3) /* xdma_event_intr1.clkout2 */ -@@ -178,6 +185,33 @@ - 0x1c (PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_ad7.mmc1_dat7 */ - >; - }; -+ -+ spi0_pins: pinmux_spi0_pins { -+ pinctrl-single,pins = < -+ 0x150 (PIN_INPUT_PULLUP | MUX_MODE0) /* spi0_sclk.spi0_sclk */ -+ 0x154 (PIN_INPUT_PULLUP | MUX_MODE0) /* spi0_d0.spi0_d0 */ -+ 0x158 (PIN_OUTPUT_PULLUP | MUX_MODE0) /* spi0_d1.spi0_d1 */ -+ 0x15c (PIN_OUTPUT_PULLUP | MUX_MODE0) /* spi0_cs0.spi0_cs0 */ -+ >; -+ }; -+ -+ ehrpwm1_pin_p9_14: pinmux_ehrpwm1_pin_p9_14 { -+ pinctrl-single,pins = < -+ 0x048 0x6 /* P9_14 (ZCZ ball U14) | MODE 6 */ -+ >; -+ }; -+ -+ ehrpwm1_pin_p9_16: pinmux_ehrpwm1_pin_p9_16 { -+ pinctrl-single,pins = < -+ 0x04c 0x6 /* P9_16 (ZCZ ball T14) | MODE 6 */ -+ >; -+ }; -+ -+ ecap0_pin_p9_42: pinmux_ecap0_pin_p9_42 { -+ pinctrl-single,pins = < -+ 0x164 0x0 /* P9_42 (ZCZ ball C18) | MODE 0 */ -+ >; -+ }; - }; - - &uart0 { -@@ -187,6 +221,13 @@ - status = "okay"; - }; - -+&uart1 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&uart1_pins>; -+ -+ status = "okay"; -+}; -+ - &usb { - status = "okay"; - -@@ -261,6 +302,56 @@ - }; - }; - -+&epwmss0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&ecap0_pin_p9_42>; -+ status = "okay"; -+ -+ ecap@48300100 { -+ status = "okay"; -+ }; -+}; -+ -+&epwmss1 { -+ pinctrl-names = "default"; -+ pinctrl-0 = < -+ &ehrpwm1_pin_p9_14 -+ &ehrpwm1_pin_p9_16 -+ >; -+ -+ status = "okay"; -+ -+ ehrpwm@48302200 { -+ status = "okay"; -+ }; -+}; -+ -+&spi0 { -+ pinctrl-names = "default"; -+ pinctrl-0 = <&spi0_pins>; -+ status = "okay"; -+ -+ spidev0: spi@0 { -+ compatible = "spidev"; -+ reg = <0>; -+ spi-max-frequency = <16000000>; -+ spi-cpha; -+ }; -+ -+ spidev1: spi@1 { -+ compatible = "spidev"; -+ reg = <1>; -+ spi-max-frequency = <16000000>; -+ }; -+}; -+ -+&tscadc { -+ status = "okay"; -+ adc { -+ ti,adc-channels = <4 5 6>; -+ }; -+}; -+ - /include/ "tps65217.dtsi" - - &tps { -@@ -336,3 +427,42 @@ - cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>; - cd-inverted; - }; -+ -+/ { -+ ocp { -+ //FIXME: these pwm's still need work, this guild isn't working.. -+ //http://elinux.org/EBC_Exercise_13_Pulse_Width_Modulation -+ pwm_test_P9_14@0 { -+ compatible = "pwm_test"; -+ pwms = <&ehrpwm1 0 500000 1>; -+ pwm-names = "PWM_P9_14"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&ehrpwm1_pin_p9_14>; -+ enabled = <1>; -+ duty = <0>; -+ status = "okay"; -+ }; -+ -+ pwm_test_P9_16@0 { -+ compatible = "pwm_test"; -+ pwms = <&ehrpwm1 0 500000 1>; -+ pwm-names = "PWM_P9_16"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&ehrpwm1_pin_p9_16>; -+ enabled = <1>; -+ duty = <0>; -+ status = "okay"; -+ }; -+ -+ pwm_test_P9_42 { -+ compatible = "pwm_test"; -+ pwms = <&ecap0 0 500000 1>; -+ pwm-names = "PWM_P9_42"; -+ pinctrl-names = "default"; -+ pinctrl-0 = <&ecap0_pin_p9_42>; -+ enabled = <1>; -+ duty = <0>; -+ status = "okay"; -+ }; -+ }; -+}; --- -1.8.5.2 - -From b6e2c817edfc6d73874cf833daffe1be6c7ed8bb Mon Sep 17 00:00:00 2001 -From: Robert Nelson -Date: Thu, 13 Mar 2014 14:18:52 -0500 -Subject: [PATCH] arm: dts: am335x-bone-common: add - uart2_pins/uart4_pins/uart5_pins - -Signed-off-by: Robert Nelson ---- - arch/arm/boot/dts/am335x-bone-common.dtsi | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi -index f85cabc..5270d18 100644 ---- a/arch/arm/boot/dts/am335x-bone-common.dtsi -+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi -@@ -105,6 +105,27 @@ - >; - }; - -+ uart2_pins: pinmux_uart2_pins { -+ pinctrl-single,pins = < -+ 0x150 0x21 /* spi0_sclk.uart2_rxd | MODE1 */ -+ 0x154 0x01 /* spi0_d0.uart2_txd | MODE1 */ -+ >; -+ }; -+ -+ uart4_pins: pinmux_uart4_pins { -+ pinctrl-single,pins = < -+ 0x070 0x26 /* gpmc_wait0.uart4_rxd | MODE6 */ -+ 0x074 0x06 /* gpmc_wpn.uart4_txd | MODE6 */ -+ >; -+ }; -+ -+ uart5_pins: pinmux_uart5_pins { -+ pinctrl-single,pins = < -+ 0x0C4 0x24 /* lcd_data9.uart5_rxd | MODE4 */ -+ 0x0C0 0x04 /* lcd_data8.uart5_txd | MODE4 */ -+ >; -+ }; -+ - clkout2_pin: pinmux_clkout2_pin { - pinctrl-single,pins = < - 0x1b4 (PIN_OUTPUT_PULLDOWN | MUX_MODE3) /* xdma_event_intr1.clkout2 */ --- -1.9.0 - -From 72567452d5d6007010597158f6afd00e2bf07579 Mon Sep 17 00:00:00 2001 -From: Pantelis Antoniou -Date: Sat, 15 Sep 2012 12:00:41 +0300 -Subject: [PATCH] pinctrl: pinctrl-single must be initialized early. - -When using pinctrl-single to handle i2c initialization, it has -to be done early. Whether this is the best way to do so, is an -exercise left to the reader. ---- - drivers/pinctrl/pinctrl-single.c | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c -index 829b98c..5107dcf 100644 ---- a/drivers/pinctrl/pinctrl-single.c -+++ b/drivers/pinctrl/pinctrl-single.c -@@ -2039,7 +2039,17 @@ static struct platform_driver pcs_driver = { - #endif - }; - --module_platform_driver(pcs_driver); -+static int __init pcs_init(void) -+{ -+ return platform_driver_register(&pcs_driver); -+} -+postcore_initcall(pcs_init); -+ -+static void __exit pcs_exit(void) -+{ -+ platform_driver_unregister(&pcs_driver); -+} -+module_exit(pcs_exit); - - MODULE_AUTHOR("Tony Lindgren "); - MODULE_DESCRIPTION("One-register-per-pin type device tree based pinctrl driver"); --- -1.8.5.2 - -From b6e2c817edfc6d73874cf833daffe1be6c7ed8bb Mon Sep 17 00:00:00 2001 -From: Robert Nelson -Date: Thu, 13 Mar 2014 14:18:52 -0500 -Subject: [PATCH] arm: dts: am335x-bone-common: add - uart2_pins/uart4_pins/uart5_pins - -Signed-off-by: Robert Nelson ---- - arch/arm/boot/dts/am335x-bone-common.dtsi | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi -index f85cabc..5270d18 100644 ---- a/arch/arm/boot/dts/am335x-bone-common.dtsi -+++ b/arch/arm/boot/dts/am335x-bone-common.dtsi -@@ -105,6 +105,27 @@ - >; - }; - -+ uart2_pins: pinmux_uart2_pins { -+ pinctrl-single,pins = < -+ 0x150 0x21 /* spi0_sclk.uart2_rxd | MODE1 */ -+ 0x154 0x01 /* spi0_d0.uart2_txd | MODE1 */ -+ >; -+ }; -+ -+ uart4_pins: pinmux_uart4_pins { -+ pinctrl-single,pins = < -+ 0x070 0x26 /* gpmc_wait0.uart4_rxd | MODE6 */ -+ 0x074 0x06 /* gpmc_wpn.uart4_txd | MODE6 */ -+ >; -+ }; -+ -+ uart5_pins: pinmux_uart5_pins { -+ pinctrl-single,pins = < -+ 0x0C4 0x24 /* lcd_data9.uart5_rxd | MODE4 */ -+ 0x0C0 0x04 /* lcd_data8.uart5_txd | MODE4 */ -+ >; -+ }; -+ - clkout2_pin: pinmux_clkout2_pin { - pinctrl-single,pins = < - 0x1b4 (PIN_OUTPUT_PULLDOWN | MUX_MODE3) /* xdma_event_intr1.clkout2 */ --- -1.9.0 diff --git a/arm-dts-am335x-bone-common-add-uart2_pins-uart4_pins.patch b/arm-dts-am335x-bone-common-add-uart2_pins-uart4_pins.patch new file mode 100644 index 000000000..e95955deb --- /dev/null +++ b/arm-dts-am335x-bone-common-add-uart2_pins-uart4_pins.patch @@ -0,0 +1,45 @@ +From: Robert Nelson +Date: Thu, 13 Mar 2014 14:18:52 -0500 +Subject: [PATCH] arm: dts: am335x-bone-common: add + uart2_pins/uart4_pins/uart5_pins + +Signed-off-by: Robert Nelson +--- + arch/arm/boot/dts/am335x-bone-common.dtsi | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi +index 86cdb52dbf8a..db4518ef755d 100644 +--- a/arch/arm/boot/dts/am335x-bone-common.dtsi ++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi +@@ -105,6 +105,27 @@ + >; + }; + ++ uart2_pins: pinmux_uart2_pins { ++ pinctrl-single,pins = < ++ 0x150 0x21 /* spi0_sclk.uart2_rxd | MODE1 */ ++ 0x154 0x01 /* spi0_d0.uart2_txd | MODE1 */ ++ >; ++ }; ++ ++ uart4_pins: pinmux_uart4_pins { ++ pinctrl-single,pins = < ++ 0x070 0x26 /* gpmc_wait0.uart4_rxd | MODE6 */ ++ 0x074 0x06 /* gpmc_wpn.uart4_txd | MODE6 */ ++ >; ++ }; ++ ++ uart5_pins: pinmux_uart5_pins { ++ pinctrl-single,pins = < ++ 0x0C4 0x24 /* lcd_data9.uart5_rxd | MODE4 */ ++ 0x0C0 0x04 /* lcd_data8.uart5_txd | MODE4 */ ++ >; ++ }; ++ + clkout2_pin: pinmux_clkout2_pin { + pinctrl-single,pins = < + 0x1b4 (PIN_OUTPUT_PULLDOWN | MUX_MODE3) /* xdma_event_intr1.clkout2 */ +-- +1.9.3 + diff --git a/arm-dts-am335x-bone-common-enable-and-use-i2c2.patch b/arm-dts-am335x-bone-common-enable-and-use-i2c2.patch new file mode 100644 index 000000000..04efe225a --- /dev/null +++ b/arm-dts-am335x-bone-common-enable-and-use-i2c2.patch @@ -0,0 +1,69 @@ +From: Robert Nelson +Date: Tue, 31 Dec 2013 11:17:45 -0600 +Subject: [PATCH] arm: dts: am335x-bone-common: enable and use i2c2 + +Signed-off-by: Robert Nelson +--- + arch/arm/boot/dts/am335x-bone-common.dtsi | 39 +++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi +index bde1777b62be..c7357bcc7d5c 100644 +--- a/arch/arm/boot/dts/am335x-bone-common.dtsi ++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi +@@ -84,6 +84,13 @@ + >; + }; + ++ i2c2_pins: pinmux_i2c2_pins { ++ pinctrl-single,pins = < ++ 0x178 0x73 /* (SLEWCTRL_SLOW | PIN_INPUT_PULLUP | MUX_MODE3) uart1_ctsn.i2c2_sda */ ++ 0x17c 0x73 /* (SLEWCTRL_SLOW | PIN_INPUT_PULLUP | MUX_MODE3) uart1_rtsn.i2c2_scl */ ++ >; ++ }; ++ + uart0_pins: pinmux_uart0_pins { + pinctrl-single,pins = < + 0x170 (PIN_INPUT_PULLUP | MUX_MODE0) /* uart0_rxd.uart0_rxd */ +@@ -220,6 +227,38 @@ + reg = <0x24>; + }; + ++ baseboard_eeprom: baseboard_eeprom@50 { ++ compatible = "at,24c256"; ++ reg = <0x50>; ++ }; ++}; ++ ++&i2c2 { ++ status = "okay"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c2_pins>; ++ ++ clock-frequency = <100000>; ++ ++ cape_eeprom0: cape_eeprom0@54 { ++ compatible = "at,24c256"; ++ reg = <0x54>; ++ }; ++ ++ cape_eeprom1: cape_eeprom1@55 { ++ compatible = "at,24c256"; ++ reg = <0x55>; ++ }; ++ ++ cape_eeprom2: cape_eeprom2@56 { ++ compatible = "at,24c256"; ++ reg = <0x56>; ++ }; ++ ++ cape_eeprom3: cape_eeprom3@57 { ++ compatible = "at,24c256"; ++ reg = <0x57>; ++ }; + }; + + /include/ "tps65217.dtsi" +-- +1.9.3 + diff --git a/arm-dts-am335x-bone-common-setup-default-pinmux-http.patch b/arm-dts-am335x-bone-common-setup-default-pinmux-http.patch new file mode 100644 index 000000000..180055d44 --- /dev/null +++ b/arm-dts-am335x-bone-common-setup-default-pinmux-http.patch @@ -0,0 +1,179 @@ +From: Robert Nelson +Date: Tue, 31 Dec 2013 14:18:00 -0600 +Subject: [PATCH] arm: dts: am335x-bone-common: setup default pinmux + http://elinux.org/Basic_Proto_Cape + +Signed-off-by: Robert Nelson +--- + arch/arm/boot/dts/am335x-bone-common.dtsi | 130 ++++++++++++++++++++++++++++++ + 1 file changed, 130 insertions(+) + +diff --git a/arch/arm/boot/dts/am335x-bone-common.dtsi b/arch/arm/boot/dts/am335x-bone-common.dtsi +index c7357bcc7d5c..86cdb52dbf8a 100644 +--- a/arch/arm/boot/dts/am335x-bone-common.dtsi ++++ b/arch/arm/boot/dts/am335x-bone-common.dtsi +@@ -98,6 +98,13 @@ + >; + }; + ++ uart1_pins: pinmux_uart1_pins { ++ pinctrl-single,pins = < ++ 0x180 (PIN_INPUT_PULLUP | MUX_MODE0) /* uart1_rxd.uart1_rxd */ ++ 0x184 (PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* uart1_txd.uart1_txd */ ++ >; ++ }; ++ + clkout2_pin: pinmux_clkout2_pin { + pinctrl-single,pins = < + 0x1b4 (PIN_OUTPUT_PULLDOWN | MUX_MODE3) /* xdma_event_intr1.clkout2 */ +@@ -178,6 +185,33 @@ + 0x1c (PIN_INPUT_PULLUP | MUX_MODE1) /* gpmc_ad7.mmc1_dat7 */ + >; + }; ++ ++ spi0_pins: pinmux_spi0_pins { ++ pinctrl-single,pins = < ++ 0x150 (PIN_INPUT_PULLUP | MUX_MODE0) /* spi0_sclk.spi0_sclk */ ++ 0x154 (PIN_INPUT_PULLUP | MUX_MODE0) /* spi0_d0.spi0_d0 */ ++ 0x158 (PIN_OUTPUT_PULLUP | MUX_MODE0) /* spi0_d1.spi0_d1 */ ++ 0x15c (PIN_OUTPUT_PULLUP | MUX_MODE0) /* spi0_cs0.spi0_cs0 */ ++ >; ++ }; ++ ++ ehrpwm1_pin_p9_14: pinmux_ehrpwm1_pin_p9_14 { ++ pinctrl-single,pins = < ++ 0x048 0x6 /* P9_14 (ZCZ ball U14) | MODE 6 */ ++ >; ++ }; ++ ++ ehrpwm1_pin_p9_16: pinmux_ehrpwm1_pin_p9_16 { ++ pinctrl-single,pins = < ++ 0x04c 0x6 /* P9_16 (ZCZ ball T14) | MODE 6 */ ++ >; ++ }; ++ ++ ecap0_pin_p9_42: pinmux_ecap0_pin_p9_42 { ++ pinctrl-single,pins = < ++ 0x164 0x0 /* P9_42 (ZCZ ball C18) | MODE 0 */ ++ >; ++ }; + }; + + &uart0 { +@@ -187,6 +221,13 @@ + status = "okay"; + }; + ++&uart1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart1_pins>; ++ ++ status = "okay"; ++}; ++ + &usb { + status = "okay"; + }; +@@ -261,6 +302,56 @@ + }; + }; + ++&epwmss0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ecap0_pin_p9_42>; ++ status = "okay"; ++ ++ ecap@48300100 { ++ status = "okay"; ++ }; ++}; ++ ++&epwmss1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = < ++ &ehrpwm1_pin_p9_14 ++ &ehrpwm1_pin_p9_16 ++ >; ++ ++ status = "okay"; ++ ++ ehrpwm@48302200 { ++ status = "okay"; ++ }; ++}; ++ ++&spi0 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&spi0_pins>; ++ status = "okay"; ++ ++ spidev0: spi@0 { ++ compatible = "spidev"; ++ reg = <0>; ++ spi-max-frequency = <16000000>; ++ spi-cpha; ++ }; ++ ++ spidev1: spi@1 { ++ compatible = "spidev"; ++ reg = <1>; ++ spi-max-frequency = <16000000>; ++ }; ++}; ++ ++&tscadc { ++ status = "okay"; ++ adc { ++ ti,adc-channels = <4 5 6>; ++ }; ++}; ++ + /include/ "tps65217.dtsi" + + &tps { +@@ -337,3 +428,42 @@ + cd-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>; + cd-inverted; + }; ++ ++/ { ++ ocp { ++ //FIXME: these pwm's still need work, this guild isn't working.. ++ //http://elinux.org/EBC_Exercise_13_Pulse_Width_Modulation ++ pwm_test_P9_14@0 { ++ compatible = "pwm_test"; ++ pwms = <&ehrpwm1 0 500000 1>; ++ pwm-names = "PWM_P9_14"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ehrpwm1_pin_p9_14>; ++ enabled = <1>; ++ duty = <0>; ++ status = "okay"; ++ }; ++ ++ pwm_test_P9_16@0 { ++ compatible = "pwm_test"; ++ pwms = <&ehrpwm1 0 500000 1>; ++ pwm-names = "PWM_P9_16"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ehrpwm1_pin_p9_16>; ++ enabled = <1>; ++ duty = <0>; ++ status = "okay"; ++ }; ++ ++ pwm_test_P9_42 { ++ compatible = "pwm_test"; ++ pwms = <&ecap0 0 500000 1>; ++ pwm-names = "PWM_P9_42"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ecap0_pin_p9_42>; ++ enabled = <1>; ++ duty = <0>; ++ status = "okay"; ++ }; ++ }; ++}; +-- +1.9.3 + diff --git a/arm-dts-am335x-boneblack-add-cpu0-opp-points.patch b/arm-dts-am335x-boneblack-add-cpu0-opp-points.patch new file mode 100644 index 000000000..2c10bfa4f --- /dev/null +++ b/arm-dts-am335x-boneblack-add-cpu0-opp-points.patch @@ -0,0 +1,41 @@ +From: Robert Nelson +Date: Fri, 27 Dec 2013 13:14:19 -0600 +Subject: [PATCH] arm: dts: am335x-boneblack: add cpu0 opp points + +Signed-off-by: Robert Nelson +--- + arch/arm/boot/dts/am335x-boneblack.dts | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/arm/boot/dts/am335x-boneblack.dts b/arch/arm/boot/dts/am335x-boneblack.dts +index bf5349165542..acfff3befff5 100644 +--- a/arch/arm/boot/dts/am335x-boneblack.dts ++++ b/arch/arm/boot/dts/am335x-boneblack.dts +@@ -66,6 +66,24 @@ + }; + + / { ++ cpus { ++ cpu@0 { ++ cpu0-supply = <&dcdc2_reg>; ++ /* ++ * To consider voltage drop between PMIC and SoC, ++ * tolerance value is reduced to 2% from 4% and ++ * voltage value is increased as a precaution. ++ */ ++ operating-points = < ++ /* kHz uV */ ++ 1000000 1325000 ++ 800000 1300000 ++ 600000 1112000 ++ 300000 969000 ++ >; ++ }; ++ }; ++ + hdmi { + compatible = "ti,tilcdc,slave"; + i2c = <&i2c0>; +-- +1.9.3 + diff --git a/arm-dts-am335x-boneblack-lcdc-add-panel-info.patch b/arm-dts-am335x-boneblack-lcdc-add-panel-info.patch new file mode 100644 index 000000000..00511f50e --- /dev/null +++ b/arm-dts-am335x-boneblack-lcdc-add-panel-info.patch @@ -0,0 +1,38 @@ +From: Robert Nelson +Date: Fri, 27 Dec 2013 13:05:09 -0600 +Subject: [PATCH] arm: dts: am335x-boneblack: lcdc add panel-info + +Bugzilla: 1012025 +Upstream-status: In beagle github repository https://github.com/beagleboard/kernel + +Signed-off-by: Robert Nelson +--- + arch/arm/boot/dts/am335x-boneblack.dts | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/arch/arm/boot/dts/am335x-boneblack.dts b/arch/arm/boot/dts/am335x-boneblack.dts +index 305975d3f531..bf5349165542 100644 +--- a/arch/arm/boot/dts/am335x-boneblack.dts ++++ b/arch/arm/boot/dts/am335x-boneblack.dts +@@ -73,5 +73,18 @@ + pinctrl-0 = <&nxp_hdmi_bonelt_pins>; + pinctrl-1 = <&nxp_hdmi_bonelt_off_pins>; + status = "okay"; ++ ++ panel-info { ++ bpp = <16>; ++ ac-bias = <255>; ++ ac-bias-intrpt = <0>; ++ dma-burst-sz = <16>; ++ fdd = <16>; ++ sync-edge = <1>; ++ sync-ctrl = <1>; ++ raster-order = <0>; ++ fifo-th = <0>; ++ invert-pxl-clk; ++ }; + }; + }; +-- +1.9.3 + diff --git a/arm-dts-sun7i-bananapi.patch b/arm-dts-sun7i-bananapi.patch new file mode 100644 index 000000000..94cbc9eb6 --- /dev/null +++ b/arm-dts-sun7i-bananapi.patch @@ -0,0 +1,213 @@ +From: Hans de Goede +Date: Tue, 30 Sep 2014 14:29:26 +0100 +Subject: [PATCH] arm: dts sun7i bananapi + +The Banana Pi is an A20 based development board using Raspberry Pi compatible +IO headers. It comes with 1 GB RAM, 1 Gb ethernet, 2x USB host, sata, hdmi +and stereo audio out + various expenansion headers: + +Signed-off-by: Hans de Goede +--- + arch/arm/boot/dts/Makefile | 1 + + arch/arm/boot/dts/sun7i-a20-bananapi.dts | 177 +++++++++++++++++++++++++++++++ + 2 files changed, 178 insertions(+) + create mode 100644 arch/arm/boot/dts/sun7i-a20-bananapi.dts + +diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile +index b8c5cd3ddeb9..c3003a4460f5 100644 +--- a/arch/arm/boot/dts/Makefile ++++ b/arch/arm/boot/dts/Makefile +@@ -414,6 +414,7 @@ dtb-$(CONFIG_MACH_SUN6I) += \ + sun6i-a31-hummingbird.dtb \ + sun6i-a31-m9.dtb + dtb-$(CONFIG_MACH_SUN7I) += \ ++ sun7i-a20-bananapi.dtb \ + sun7i-a20-cubieboard2.dtb \ + sun7i-a20-cubietruck.dtb \ + sun7i-a20-i12-tvbox.dtb \ +diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi.dts b/arch/arm/boot/dts/sun7i-a20-bananapi.dts +new file mode 100644 +index 000000000000..7214475a3c36 +--- /dev/null ++++ b/arch/arm/boot/dts/sun7i-a20-bananapi.dts +@@ -0,0 +1,177 @@ ++/* ++ * Copyright 2014 Hans de Goede ++ * ++ * The code contained herein is licensed under the GNU General Public ++ * License. You may obtain a copy of the GNU General Public License ++ * Version 2 or later at the following locations: ++ * ++ * http://www.opensource.org/licenses/gpl-license.html ++ * http://www.gnu.org/copyleft/gpl.html ++ */ ++ ++/dts-v1/; ++/include/ "sun7i-a20.dtsi" ++/include/ "sunxi-common-regulators.dtsi" ++ ++/ { ++ model = "LeMaker Banana Pi"; ++ compatible = "lemaker,bananapi", "allwinner,sun7i-a20"; ++ ++ soc@01c00000 { ++ mmc0: mmc@01c0f000 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bananapi>; ++ vmmc-supply = <®_vcc3v3>; ++ bus-width = <4>; ++ cd-gpios = <&pio 7 10 0>; /* PH10 */ ++ cd-inverted; ++ status = "okay"; ++ }; ++ ++ usbphy: phy@01c13400 { ++ usb1_vbus-supply = <®_usb1_vbus>; ++ usb2_vbus-supply = <®_usb2_vbus>; ++ status = "okay"; ++ }; ++ ++ ehci0: usb@01c14000 { ++ status = "okay"; ++ }; ++ ++ ohci0: usb@01c14400 { ++ status = "okay"; ++ }; ++ ++ ahci: sata@01c18000 { ++ status = "okay"; ++ }; ++ ++ ehci1: usb@01c1c000 { ++ status = "okay"; ++ }; ++ ++ ohci1: usb@01c1c400 { ++ status = "okay"; ++ }; ++ ++ pinctrl@01c20800 { ++ uart3_pins_bananapi: uart3_pin@0 { ++ allwinner,pins = "PH0", "PH1"; ++ allwinner,function = "uart3"; ++ allwinner,drive = <0>; ++ allwinner,pull = <0>; ++ }; ++ ++ mmc0_cd_pin_bananapi: mmc0_cd_pin@0 { ++ allwinner,pins = "PH10"; ++ allwinner,function = "gpio_in"; ++ allwinner,drive = <0>; ++ allwinner,pull = <1>; ++ }; ++ ++ gmac_power_pin_bananapi: gmac_power_pin@0 { ++ allwinner,pins = "PH23"; ++ allwinner,function = "gpio_out"; ++ allwinner,drive = <0>; ++ allwinner,pull = <0>; ++ }; ++ ++ led_pins_bananapi: led_pins@0 { ++ allwinner,pins = "PH24"; ++ allwinner,function = "gpio_out"; ++ allwinner,drive = <0>; ++ allwinner,pull = <0>; ++ }; ++ }; ++ ++ ir0: ir@01c21800 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&ir0_pins_a>; ++ status = "okay"; ++ }; ++ ++ uart0: serial@01c28000 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart0_pins_a>; ++ status = "okay"; ++ }; ++ ++ uart3: serial@01c28c00 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart3_pins_bananapi>; ++ status = "okay"; ++ }; ++ ++ uart7: serial@01c29c00 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&uart7_pins_a>; ++ status = "okay"; ++ }; ++ ++ i2c0: i2c@01c2ac00 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c0_pins_a>; ++ status = "okay"; ++ ++ axp209: pmic@34 { ++ compatible = "x-powers,axp209"; ++ reg = <0x34>; ++ interrupt-parent = <&nmi_intc>; ++ interrupts = <0 8>; ++ ++ interrupt-controller; ++ #interrupt-cells = <1>; ++ }; ++ }; ++ ++ i2c2: i2c@01c2b400 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c2_pins_a>; ++ status = "okay"; ++ }; ++ ++ gmac: ethernet@01c50000 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gmac_pins_rgmii_a>; ++ phy = <&phy1>; ++ phy-mode = "rgmii"; ++ phy-supply = <®_gmac_3v3>; ++ status = "okay"; ++ ++ phy1: ethernet-phy@1 { ++ reg = <1>; ++ }; ++ }; ++ }; ++ ++ leds { ++ compatible = "gpio-leds"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&led_pins_bananapi>; ++ ++ green { ++ label = "bananapi:green:usr"; ++ gpios = <&pio 7 24 0>; ++ }; ++ }; ++ ++ reg_usb1_vbus: usb1-vbus { ++ status = "okay"; ++ }; ++ ++ reg_usb2_vbus: usb2-vbus { ++ status = "okay"; ++ }; ++ ++ reg_gmac_3v3: gmac-3v3 { ++ compatible = "regulator-fixed"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&gmac_power_pin_bananapi>; ++ regulator-name = "gmac-3v3"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ startup-delay-us = <50000>; ++ enable-active-high; ++ gpio = <&pio 7 23 0>; ++ }; ++}; +-- +1.9.3 + diff --git a/arm-highbank-l2-reverts.patch b/arm-highbank-l2-reverts.patch new file mode 100644 index 000000000..f1e6d45d3 --- /dev/null +++ b/arm-highbank-l2-reverts.patch @@ -0,0 +1,60 @@ +From: Kyle McMartin +Date: Tue, 30 Sep 2014 16:19:47 -0400 +Subject: [PATCH] arm: highbank l2 reverts + +Revert some v3.16 changes to mach-highbank which broke L2 cache enablement. +Will debug upstream separately, but we need F22/21 running there. (#1139762) +--- + arch/arm/mach-highbank/highbank.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c +index 8c35ae4ff176..38e1dc3b4c6e 100644 +--- a/arch/arm/mach-highbank/highbank.c ++++ b/arch/arm/mach-highbank/highbank.c +@@ -51,13 +51,11 @@ static void __init highbank_scu_map_io(void) + } + + +-static void highbank_l2c310_write_sec(unsigned long val, unsigned reg) ++static void highbank_l2x0_disable(void) + { +- if (reg == L2X0_CTRL) +- highbank_smc1(0x102, val); +- else +- WARN_ONCE(1, "Highbank L2C310: ignoring write to reg 0x%x\n", +- reg); ++ outer_flush_all(); ++ /* Disable PL310 L2 Cache controller */ ++ highbank_smc1(0x102, 0x0); + } + + static void __init highbank_init_irq(void) +@@ -66,6 +64,14 @@ static void __init highbank_init_irq(void) + + if (of_find_compatible_node(NULL, NULL, "arm,cortex-a9")) + highbank_scu_map_io(); ++ ++ /* Enable PL310 L2 Cache controller */ ++ if (IS_ENABLED(CONFIG_CACHE_L2X0) && ++ of_find_compatible_node(NULL, NULL, "arm,pl310-cache")) { ++ highbank_smc1(0x102, 0x1); ++ l2x0_of_init(0, ~0); ++ outer_cache.disable = highbank_l2x0_disable; ++ } + } + + static void highbank_power_off(void) +@@ -179,9 +185,6 @@ DT_MACHINE_START(HIGHBANK, "Highbank") + #if defined(CONFIG_ZONE_DMA) && defined(CONFIG_ARM_LPAE) + .dma_zone_size = (4ULL * SZ_1G), + #endif +- .l2c_aux_val = 0, +- .l2c_aux_mask = ~0, +- .l2c_write_sec = highbank_l2c310_write_sec, + .init_irq = highbank_init_irq, + .init_machine = highbank_init, + .dt_compat = highbank_match, +-- +1.9.3 + diff --git a/arm-imx6-utilite.patch b/arm-i.MX6-Utilite-device-dtb.patch similarity index 81% rename from arm-imx6-utilite.patch rename to arm-i.MX6-Utilite-device-dtb.patch index bb0747202..0354f7547 100644 --- a/arm-imx6-utilite.patch +++ b/arm-i.MX6-Utilite-device-dtb.patch @@ -1,5 +1,13 @@ +From: Peter Robinson +Date: Fri, 11 Jul 2014 00:10:56 +0100 +Subject: [PATCH] arm: i.MX6 Utilite device dtb + +--- + arch/arm/boot/dts/imx6q-cm-fx6.dts | 38 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + diff --git a/arch/arm/boot/dts/imx6q-cm-fx6.dts b/arch/arm/boot/dts/imx6q-cm-fx6.dts -index 99b46f8..8b6ddd1 100644 +index 99b46f8030ad..8b6ddd16dcc5 100644 --- a/arch/arm/boot/dts/imx6q-cm-fx6.dts +++ b/arch/arm/boot/dts/imx6q-cm-fx6.dts @@ -97,11 +97,49 @@ @@ -52,3 +60,6 @@ index 99b46f8..8b6ddd1 100644 + pinctrl-0 = <&pinctrl_usdhc3>; + status = "okay"; +}; +-- +1.9.3 + diff --git a/arm-qemu-fixdisplay.patch b/arm-qemu-fixdisplay.patch deleted file mode 100644 index 090193c2d..000000000 --- a/arm-qemu-fixdisplay.patch +++ /dev/null @@ -1,472 +0,0 @@ -commit d10715be03bd8bad59ddc50236cb140c3bd73c7b -Author: Pawel Moll -Date: Tue Jun 24 12:55:11 2014 +0100 - - video: ARM CLCD: Add DT support - - This patch adds basic DT bindings for the PL11x CLCD cells - and make their fbdev driver use them. - - Signed-off-by: Pawel Moll - Signed-off-by: Tomi Valkeinen - -diff --git a/Documentation/devicetree/bindings/video/arm,pl11x.txt b/Documentation/devicetree/bindings/video/arm,pl11x.txt -new file mode 100644 -index 0000000..3e3039a ---- /dev/null -+++ b/Documentation/devicetree/bindings/video/arm,pl11x.txt -@@ -0,0 +1,109 @@ -+* ARM PrimeCell Color LCD Controller PL110/PL111 -+ -+See also Documentation/devicetree/bindings/arm/primecell.txt -+ -+Required properties: -+ -+- compatible: must be one of: -+ "arm,pl110", "arm,primecell" -+ "arm,pl111", "arm,primecell" -+ -+- reg: base address and size of the control registers block -+ -+- interrupt-names: either the single entry "combined" representing a -+ combined interrupt output (CLCDINTR), or the four entries -+ "mbe", "vcomp", "lnbu", "fuf" representing the individual -+ CLCDMBEINTR, CLCDVCOMPINTR, CLCDLNBUINTR, CLCDFUFINTR interrupts -+ -+- interrupts: contains an interrupt specifier for each entry in -+ interrupt-names -+ -+- clock-names: should contain "clcdclk" and "apb_pclk" -+ -+- clocks: contains phandle and clock specifier pairs for the entries -+ in the clock-names property. See -+ Documentation/devicetree/binding/clock/clock-bindings.txt -+ -+Optional properties: -+ -+- memory-region: phandle to a node describing memory (see -+ Documentation/devicetree/bindings/reserved-memory/reserved-memory.txt) -+ to be used for the framebuffer; if not present, the framebuffer -+ may be located anywhere in the memory -+ -+- max-memory-bandwidth: maximum bandwidth in bytes per second that the -+ cell's memory interface can handle; if not present, the memory -+ interface is fast enough to handle all possible video modes -+ -+Required sub-nodes: -+ -+- port: describes LCD panel signals, following the common binding -+ for video transmitter interfaces; see -+ Documentation/devicetree/bindings/media/video-interfaces.txt; -+ when it is a TFT panel, the port's endpoint must define the -+ following property: -+ -+ - arm,pl11x,tft-r0g0b0-pads: an array of three 32-bit values, -+ defining the way CLD pads are wired up; first value -+ contains index of the "CLD" external pin (pad) used -+ as R0 (first bit of the red component), second value -+ index of the pad used as G0, third value index of the -+ pad used as B0, see also "LCD panel signal multiplexing -+ details" paragraphs in the PL110/PL111 Technical -+ Reference Manuals; this implicitly defines available -+ color modes, for example: -+ - PL111 TFT 4:4:4 panel: -+ arm,pl11x,tft-r0g0b0-pads = <4 15 20>; -+ - PL110 TFT (1:)5:5:5 panel: -+ arm,pl11x,tft-r0g0b0-pads = <1 7 13>; -+ - PL111 TFT (1:)5:5:5 panel: -+ arm,pl11x,tft-r0g0b0-pads = <3 11 19>; -+ - PL111 TFT 5:6:5 panel: -+ arm,pl11x,tft-r0g0b0-pads = <3 10 19>; -+ - PL110 and PL111 TFT 8:8:8 panel: -+ arm,pl11x,tft-r0g0b0-pads = <0 8 16>; -+ - PL110 and PL111 TFT 8:8:8 panel, R & B components swapped: -+ arm,pl11x,tft-r0g0b0-pads = <16 8 0>; -+ -+ -+Example: -+ -+ clcd@10020000 { -+ compatible = "arm,pl111", "arm,primecell"; -+ reg = <0x10020000 0x1000>; -+ interrupt-names = "combined"; -+ interrupts = <0 44 4>; -+ clocks = <&oscclk1>, <&oscclk2>; -+ clock-names = "clcdclk", "apb_pclk"; -+ max-memory-bandwidth = <94371840>; /* Bps, 1024x768@60 16bpp */ -+ -+ port { -+ clcd_pads: endpoint { -+ remote-endpoint = <&clcd_panel>; -+ arm,pl11x,tft-r0g0b0-pads = <0 8 16>; -+ }; -+ }; -+ -+ }; -+ -+ panel { -+ compatible = "panel-dpi"; -+ -+ port { -+ clcd_panel: endpoint { -+ remote-endpoint = <&clcd_pads>; -+ }; -+ }; -+ -+ panel-timing { -+ clock-frequency = <25175000>; -+ hactive = <640>; -+ hback-porch = <40>; -+ hfront-porch = <24>; -+ hsync-len = <96>; -+ vactive = <480>; -+ vback-porch = <32>; -+ vfront-porch = <11>; -+ vsync-len = <2>; -+ }; -+ }; -diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig -index 4a7098f..6f451ad 100644 ---- a/drivers/video/fbdev/Kconfig -+++ b/drivers/video/fbdev/Kconfig -@@ -280,6 +280,7 @@ config FB_ARMCLCD - select FB_CFB_FILLRECT - select FB_CFB_COPYAREA - select FB_CFB_IMAGEBLIT -+ select VIDEOMODE_HELPERS if OF - help - This framebuffer device driver is for the ARM PrimeCell PL110 - Colour LCD controller. ARM PrimeCells provide the building -diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c -index 14d6b37..23b3519 100644 ---- a/drivers/video/fbdev/amba-clcd.c -+++ b/drivers/video/fbdev/amba-clcd.c -@@ -26,6 +26,13 @@ - #include - #include - #include -+#include -+#include -+#include -+#include -+#include