Home| summaryrefslogtreecommitdiff |
diff options
| author | Petr Tesarik <ptesarik@suse.cz> | 2019-09-17 16:22:10 +0200 |
|---|---|---|
| committer | Petr Tesarik <ptesarik@suse.cz> | 2019-09-17 16:26:49 +0200 |
| commit | d75059b7eb91d6e60addfcec7d1e96f4190a62c2 (patch) | |
| tree | 803ecdee39b6d597ad097f148b5c6f2f3a74e959 | |
| parent | 9233377b2118c07c8cb294426427b2b24dd5cce1 (diff) | |
| parent | 700d2e9ac5473579edfbccea9121f8652c6c33dd (diff) | |
Merge branch 'SLE15' into SLE15-SP1rpm-4.12.14-197.18--sle15-sp1-updatesrpm-4.12.14-197.18
- Refresh
patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch
| -rw-r--r-- | patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch | 50 | ||||
| -rw-r--r-- | patches.suse/vhost-make-sure-log_num-in_num.patch | 58 | ||||
| -rw-r--r-- | series.conf | 2 |
3 files changed, 110 insertions, 0 deletions
diff --git a/patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch b/patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch new file mode 100644 index 0000000000..dab53a8de3 --- /dev/null +++ b/patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch @@ -0,0 +1,50 @@ +From 2eb0964eec5f1d99f9eaf4963eee267acc72b615 Mon Sep 17 00:00:00 2001 +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Wed, 4 Sep 2019 11:07:07 +0100 +Subject: drm/i915: Restore relaxed padding (OCL_OOB_SUPPRES_ENABLE) for skl+ +Git-commit: 2eb0964eec5f1d99f9eaf4963eee267acc72b615 +Patch-mainline: v5.3 +References: bsc#1142635 +No-fix: 9d7b01e93526efe79dbf75b69cc5972b5a4f7b37 + +This bit was fliped on for "syncing dependencies between camera and +graphics". BSpec has no recollection why, and it is causing +unrecoverable GPU hangs with Vulkan compute workloads. + +From BSpec, setting bit5 to 0 enables relaxed padding requirements for +buffers, 1D and 2D non-array, non-MSAA, non-mip-mapped linear surfaces; +and *must* be set to 0h on skl+ to ensure "Out of Bounds" case is +suppressed. + +Reported-by: Jason Ekstrand <jason@jlekstrand.net> +Suggested-by: Jason Ekstrand <jason@jlekstrand.net> +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=110998 +Fixes: 8424171e135c ("drm/i915/gen9: h/w w/a: syncing dependencies between camera and graphics") +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Tested-by: denys.kostin@globallogic.com +Cc: Jason Ekstrand <jason@jlekstrand.net> +Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com> +Cc: <stable@vger.kernel.org> # v4.1+ +Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com> +Link: https://patchwork.freedesktop.org/patch/msgid/20190904100707.7377-1-chris@chris-wilson.co.uk +(cherry picked from commit 9d7b01e93526efe79dbf75b69cc5972b5a4f7b37) +Signed-off-by: Jani Nikula <jani.nikula@intel.com> +Acked-by: Thomas Zimmermann <tzimmermann@suse.de> +--- + drivers/gpu/drm/i915/intel_workarounds.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/gpu/drm/i915/intel_workarounds.c ++++ b/drivers/gpu/drm/i915/intel_workarounds.c +@@ -241,11 +241,6 @@ static int gen9_ctx_workarounds_init(str + FLOW_CONTROL_ENABLE | + PARTIAL_INSTRUCTION_SHOOTDOWN_DISABLE); + +- /* Syncing dependencies between camera and graphics:skl,bxt,kbl */ +- if (!IS_COFFEELAKE(dev_priv)) +- WA_SET_BIT_MASKED(HALF_SLICE_CHICKEN3, +- GEN9_DISABLE_OCL_OOB_SUPPRESS_LOGIC); +- + /* WaEnableYV12BugFixInHalfSliceChicken7:skl,bxt,kbl,glk,cfl */ + /* WaEnableSamplerGPGPUPreemptionSupport:skl,bxt,kbl,cfl */ + WA_SET_BIT_MASKED(GEN9_HALF_SLICE_CHICKEN7, diff --git a/patches.suse/vhost-make-sure-log_num-in_num.patch b/patches.suse/vhost-make-sure-log_num-in_num.patch new file mode 100644 index 0000000000..a350c6c7c4 --- /dev/null +++ b/patches.suse/vhost-make-sure-log_num-in_num.patch @@ -0,0 +1,58 @@ +From 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 Mon Sep 17 00:00:00 2001 +From: yongduan <yongduan@tencent.com> +Date: Wed, 11 Sep 2019 17:44:24 +0800 +Subject: [PATCH] vhost: make sure log_num < in_num +Git-commit: 060423bfdee3f8bc6e2c1bac97de24d5415e2bc4 +Patch-mainline: v5.3 +References: bsc#1150112,CVE-2019-14835 + +The code assumes log_num < in_num everywhere, and that is true as long as +in_num is incremented by descriptor iov count, and log_num by 1. However +this breaks if there's a zero sized descriptor. + +As a result, if a malicious guest creates a vring desc with desc.len = 0, +it may cause the host kernel to crash by overflowing the log array. This +bug can be triggered during the VM migration. + +There's no need to log when desc.len = 0, so just don't increment log_num +in this case. + +Fixes: 3a4d5c94e959 ("vhost_net: a kernel-level virtio server") +Cc: stable@vger.kernel.org +Reviewed-by: Lidong Chen <lidongchen@tencent.com> +Signed-off-by: ruippan <ruippan@tencent.com> +Signed-off-by: yongduan <yongduan@tencent.com> +Acked-by: Michael S. Tsirkin <mst@redhat.com> +Reviewed-by: Tyler Hicks <tyhicks@canonical.com> +Signed-off-by: Michael S. Tsirkin <mst@redhat.com> +Acked-by: Takashi Iwai <tiwai@suse.de> + +--- + drivers/vhost/vhost.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 34ea219936e3..acabf20b069e 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -2180,7 +2180,7 @@ static int get_indirect(struct vhost_virtqueue *vq, + /* If this is an input descriptor, increment that count. */ + if (access == VHOST_ACCESS_WO) { + *in_num += ret; +- if (unlikely(log)) { ++ if (unlikely(log && ret)) { + log[*log_num].addr = vhost64_to_cpu(vq, desc.addr); + log[*log_num].len = vhost32_to_cpu(vq, desc.len); + ++*log_num; +@@ -2321,7 +2321,7 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq, + /* If this is an input descriptor, + * increment that count. */ + *in_num += ret; +- if (unlikely(log)) { ++ if (unlikely(log && ret)) { + log[*log_num].addr = vhost64_to_cpu(vq, desc.addr); + log[*log_num].len = vhost32_to_cpu(vq, desc.len); + ++*log_num; +-- +2.16.4 + diff --git a/series.conf b/series.conf index cd1378e620..18d3e9e589 100644 --- a/series.conf +++ b/series.conf @@ -49660,7 +49660,9 @@ patches.suse/powerpc-tm-Fix-restoring-FP-VMX-facility-incorrectly.patch patches.suse/iommu-amd-flush-old-domains-in-kdump-kernel patches.suse/iommu-amd-fix-race-in-increase_address_space + patches.suse/vhost-make-sure-log_num-in_num.patch patches.suse/Btrfs-fix-assertion-failure-during-fsync-and-use-of-.patch + patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch patches.suse/Revert-Bluetooth-validate-BLE-connection-interval-up.patch patches.suse/net-ibmvnic-free-reset-work-of-removed-device-from-q.patch patches.suse/net-ibmvnic-Fix-missing-in-__ibmvnic_reset.patch |