millerson.name
/
gentoo-overlay
1
0
Fork 0
Code Issues Pull Requests Releases Activity

sys-kernel/hardened-kernel: Bump version 5.10.45

master
Alexander Miroshnichenko 2021-06-19 17:48:59 +03:00
parent 18b7af2a2a
commit 8103b1bdb8
Signed by: alex
GPG Key ID: E93720C6C73A77F4
37 changed files with 613 additions and 2321 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
sys-kernel/hardened-kernel/Manifest
View File

@ -1,48 +1,12 @@
AUX linux-5.4.amd64.config 143288 BLAKE2B 5bd566ad9ad350fcce79302edf623a8ca6e4b7629a2afac1811737ee51ace2b6ca0c26a79073f09eb6d45c8d516e58f43b4b883dcb4dd9f8b5f720c05b14b45c SHA512 e5b6675f1b425b035f083f00a04853fa4f37db8f6d1968b1505ec45d1c66299f8b187feac45b60e1dd84af3ccae5b793ed6992312e185bf753d17feb79cf2d31
AUX linux-5.4/9001_CVE-2019-12379.patch 1326 BLAKE2B 6eff041ea65aba116ddd96e5229d009f764f30e9ff0ef80d6674141cf26f6829a0ebe2f3674dc1a27ad63373766aa6644f33556e192a833092b7a0f3d18675dc SHA512 62e07dc31d5f6253fe747bef8e2816f59216cf4211b28397f16021a3db27596fbf42daa854b53ae6c5d3a6f6a4df3968e00ce3abe9c806e77cbf1f415e0b0c24
AUX linux-5.4/9004_CVE-2019-19054.patch 1210 BLAKE2B 2184cbe9b15e8f7087a84f6d328af53de8766de8e1c85335877d113e0bc4355b1d92c4babd95458bcb2cf7df0218dfa440dbb904587bc9039d10a46344aecaca SHA512 2bf2ed725c826ab4446178a5d393f54810871caa9a0ca6a06a149cd4565c7b9923c4893f268a9acdacb46097348b713eae34602bf3286cf28abc4260196af86c
AUX linux-5.4/9052_0052-drm-i915-save-AUD_FREQ_CNTRL-state-at-audio-domain-s.patch 3194 BLAKE2B 50632614e3bb13c8a4f1444dcbb2fe6de9fa6777fa78d5f50e0f2337d3c0efabfe175fc68b80c35c58e95c6081c2bb28c0dffa5ad4a537d71fa0a197e2e56e20 SHA512 7f2747b65bd5c2c0d0d89ea0609055b6df57ad4d86a16797864da6fcb6b7fc77f5f7756632caa1d3ea26155158521995c868b9b21360e73a8fd6ffef60710d7e
AUX linux-5.4/9053_0053-drm-i915-Fix-audio-power-up-sequence-for-gen10-displ.patch 2278 BLAKE2B f10f0d7c003cf42abba502f9beaf8080bd6c57a28685148b70f25d85d47f51b266e3a33ab93560c5743eab27276291bb974480d6126d9548878a2e2552cef0e6 SHA512 1438ebf92ca3b36a906a21fc5eb657ac7dc48494264ecb83b6f672fa5707e16b02249517c42cb6800276e4f9d48d1a1e7dd01fe49558d77b51ef70b57501b347
AUX linux-5.4/9054_0054-drm-i915-extend-audio-CDCLK-2-BCLK-constraint-to-mor.patch 1839 BLAKE2B cd7bd53bbb6d6406ad80f5d7f98d0a755931f716f426071cce19a9b151366d972e74064792c7756e7e761b01112fa81e4ca94eb7f1063333809ecc5a40a82adc SHA512 3b2c078008fb3528960e589a091b9aef12bc578ae6939e32830cafc00bd4ae5ce247587d41d5af1f8d570d0450cdb0263bfd25b05c8955333ad0cd612d863f5f
AUX linux-5.4/9101_0101-i8042-decrease-debug-message-level-to-info.patch 2123 BLAKE2B fd3ed7dc924687a0606be77448af0f79f43bae5dce87d855eff0a1ae923efe7c3d14be8b23f1acbe2c499ce7e13827c29c61ba3766bb551d51a3f43c0e3547a9 SHA512 55038d455c7fdf2281f432745bc143b7274c0558acc47bba57e68ec0bc33a27dc2b177f1affde0bdddc32e632c8d2908cbbe0dcaffa1132511ee1f7cb278ff47
AUX linux-5.4/9102_0102-Increase-the-ext4-default-commit-age.patch 1097 BLAKE2B a3a00f6ba5fef3abacc56c364667e3911cb9015366cc542f5cc339c91b71204afbeada2a23e2fceebe5596529f5608bd960eba10027190f711add92f1c3814fc SHA512 0085744c57ee80dda40f81fb7e57b7e895433b319bed4959ec8bc4b97e5313a67725667ac52639a497ef8c8c7740a33b4cd9b588008fa8c09a2e06de724b3d25
AUX linux-5.4/9103_0103-silence-rapl.patch 831 BLAKE2B 2e39b8094132b38f118ef97c2c3915a74a0173cd2f88b6de176ab17117a3081b15407f44e9b4966d7f3b44eca1526d744ed8e58170dbe79c30724751e851573a SHA512 c978f3441b69ecc065ea12a482bcf73ce01d884703ccad9fd54d121ea78b545848302d491da984fc7551e798ed736b090770544c64f9a9e34f9bd9237aee5e98
AUX linux-5.4/9104_0104-pci-pme-wakeups.patch 794 BLAKE2B 44563ee4b016b066ca44bc65a4d2b61f5f8c3a6663e1ce26f4de0d7189f7d6befb2fe9fa173f62fdbd52570bab231e7b94b8ef7114767fff62b37b1dcffbc4fd SHA512 dba6fc0aff4bd1dc968a2f08d21e15d791d30e1e515cd9f40cebed8fcb98d622a5deb34fce27537d5c8d2d726002941d912f41f714f87559f79a6095d40fb615
AUX linux-5.4/9105_0105-ksm-wakeups.patch 1894 BLAKE2B 88041857a2f4cd78eeabdcc31c61d6d85e56b3c1a99faaa75d6b3884998c271be57ee42e9f611ec9a02ac09496330eba2cb9d7128da824a871df11646fa66206 SHA512 eea981d63fcd94f72a3fd7d714f7c738db08dcdbce324967aa232b4421eb42f20d214c3c87f9558e24bf8723d5e8adc5ff5095c2926c640cab41120e71644a99
AUX linux-5.4/9106_0106-intel_idle-tweak-cpuidle-cstates.patch 7229 BLAKE2B 990225de896037667e643e663491ee5de7d7a1984db7eae520f5c565f038a094cbe955601c8e97c04d6a990f57a9060a1b14e07277abd4ec75122ab56df6b6c4 SHA512 e52a2f0e604c84a42f8123508967e8f0ffc8131310720c85bc09c41b1330e19e0454343b543e1665973d65bd8539c99667b82f970d150e51aabdd5cf48e95645
AUX linux-5.4/9107_0107-bootstats-add-printk-s-to-measure-boot-time-in-more-.patch 1026 BLAKE2B 9ffc62f4bef83c51c2b3b3a7f88a49cfc7ff1deff6d591b8ac475feaa7e2890314375ef4600e89ccf2acd53624a43128113c73c9b01f40465b3a1f9c24248c93 SHA512 c825c2e5d17d3c85efe8efc2077e4f931526a62cb8c62bc42e65cc43648d9612a09a4f381863af17871a7bbe955d5f65dd9cdd3741cee4269c3f28c2f082f93a
AUX linux-5.4/9108_0108-smpboot-reuse-timer-calibration.patch 818 BLAKE2B f381dce4f6db246e86b7597883443af067a89fca27ba36f6d1c903c876c6001dd824bcbd313a9b37e222b9b9e2e67dc44ca75e760168a6a7278cb3dc5ea873c4 SHA512 12bcc0bea4d8dc9e9f144c9c195f4125918bb2ad337e3a27a76713218d85ba1019aa7cb9621bd6031ee202f42df8f86d6ad8f73cc5b75ba2ffa5f17d487cba58
AUX linux-5.4/9109_0109-raid6-add-Kconfig-option-to-skip-raid6-benchmarking.patch 4362 BLAKE2B 85e4588e6c36e04507a1ae077bc4ec4e000a3b006e1145d2579da5b5180f354576942ef15a947b5dac3471aca7ec84a81efa789017765f56341b5d33f42445d9 SHA512 b8c5fcef11c5a6166f03197890c40a5f380ad1790b253cd98145391045b1bdb80cd67af69dbeba3febae3e2c7991467e49b87a3ce22e9374263c7c94e16fa46a
AUX linux-5.4/9110_0110-Initialize-ata-before-graphics.patch 1569 BLAKE2B 0cb41106463350792c9dff3e069f1b54d8b65b187489760d6f28feadfc9b70d3e62b83a3b183b7de2e97243fece8dad1b5cfc49a40b05dad356186d5201b6424 SHA512 f12aac546e4199e061c3d100ce76c62a81a2452a567485db7152682e646c7904f9bb27956759b814ab8da569734b621188d498782a016f41a63168ebb603f51c
AUX linux-5.4/9111_0111-give-rdrand-some-credit.patch 995 BLAKE2B 07bb1ea29c73dff2fdf40ceb1c39c76ba2fe5e0e0989bdbb461764bccfbcd29de66d697a6068a3a7da96fa96e2a59d82f17be46fef0ae4f51a6ed5e220f22909 SHA512 f1270e12534b861882f88853347a1545eb7f25e758885db941b9aa8d4b00fefb16d017175a4c5058ba4d1bc9ca900369ee6775798cdd13b6022835e617aa8285
AUX linux-5.4/9112_0112-ipv4-tcp-allow-the-memory-tuning-for-tcp-to-go-a-lit.patch 952 BLAKE2B 88db4d1f070afba94dcd2144ac0e1ffa586ae6d042d5b672457b7aeca33c2149dc02fae17726d50bb6a8d3d7c3fd5959c82dff9efce7c5cc71363647e2d572b9 SHA512 18a294cea9c7fda95501895f1156216cd7371b5acae4f2093c650f35c169b6defbe01fa2b9257aa4f9eae1faec4a5259c3849c695dbce5f59b0fb311c41d6f89
AUX linux-5.4/9113_0113-kernel-time-reduce-ntp-wakeups.patch 777 BLAKE2B 212e55668fb9b334ac34b2b75b13790a7830f2a172f7259e1f052ab639cd1065f87ae0b4233b3dcb11c687bfd84a0a11fdef7d075e80d6afe117f15e30d27726 SHA512 9d5a3b2d0315329fab7f1fae214a2491cbe1d6ebce6235311caa9b9ba0f80183d3feedb8c1abe04012ee2f98e5a836b418d85cb60d6650cd8065b077caaaff90
AUX linux-5.4/9114_0114-init-wait-for-partition-and-retry-scan.patch 1447 BLAKE2B e971ed1cab8b84d0b3c01b973a21febfa80dfaf1411ece38083eff4e931ef19e2fef9c619a32cf747e368dc9b180b9e30dd33929ee72d06596d1954ecfb68ce3 SHA512 87ec090c374ea0fa4484a00d4d352c10811d50322696b4d2833798b426deb7adacdac7453c31003e917919d9d494804c39e8acb14356b9e6364634d9c803ff10
AUX linux-5.4/9115_0115-print-fsync-count-for-bootchart.patch 1498 BLAKE2B 0a1020d2581e0d038f0874d7de3d3ecc417a129d7edd206a78485d5dfb03aed98c4c08d553a118872d2235dbad8c447accd3ca743d5750c7266e22df2cee151e SHA512 f1363ea29c7869da360094305d17de162379b2095f0f7c0ae481b6aeb02235cc93653581f0e59f7770289b5468b5d08e922f3b5bd12f44b56c0686ae71a7048e
AUX linux-5.4/9116_0116-Add-boot-option-to-allow-unsigned-modules.patch 2198 BLAKE2B 2d8dfa5141b480b61ead02d6b8c0d055819b3f5be0bf6529d1b648b3a516ca78c2e26ff3cfe8d72ede2fe5b5d1a7a086478871db5f637800eeb699bf43e7ba3b SHA512 4f7eb5b8c21694e83432978ff17ceb8685fc730fd02f1c1e16ed1865d3482291e7b608180c27b87defc2f073bc37916e9416c39d67511dea9a3a5ef60e61800a
AUX linux-5.4/9117_0117-Enable-stateless-firmware-loading.patch 1031 BLAKE2B 0e6465420a66194ca718231fbbab1cbf51f2d05a50968025efe5f56ee07586ba25339f099cecd4a56a7ac52aa2f9e1761d5b4207ef9a1d1f52bf95a8c2e30518 SHA512 101cd9e39fb6358c8fb575fea1e77690ac1a7fde7f748798c992a91e54899945b175ffa975fc21023600ee2380a29b21cf55639d7974032c8643a130ffe9c289
AUX linux-5.4/9118_0118-Migrate-some-systemd-defaults-to-the-kernel-defaults.patch 1602 BLAKE2B be12ac13585fc3b2051eddf71920f481cc3677e02106b6f29ec451794c39cc1d37b5c13afeb21f0fc53acc29b1d979a2b2d85c8bf7e28f13952c61865162dcd7 SHA512 16ab23002ec19a4c5b351cc83f131838cf855b781962c230f71c1c6b6587abbd5aa077d36b6b0e34a888d77a6b4b52fe655fd9d85e19d1dc28761ac17b17c81f
AUX linux-5.4/9119_0119-xattr-allow-setting-user.-attributes-on-symlinks-by-.patch 2281 BLAKE2B 398839b04e6180b737c8fd1d544e70a4447a3f3eb75eec4e24fc8f67f36dccd0144386bf26a321c0d612cfdfc4e6a376a3797503ae9fde4d476cc3ebbb868b15 SHA512 92db7dd3419b64eee60b0e48da2975edff9907c29ca96e554c07954d00d19fa843519db70a58042133d3e8d9d845edb2b36dc4689e93f841505ff6bbb478bf4c
AUX linux-5.4/9120_0120-add-scheduler-turbo3-patch.patch 2645 BLAKE2B dc8732e38aee23c33e2cf586aa7917c321719932ded24487e227326e2952919932477ea46ce88b60364aa413e10f965813d706912d07aecf9208989a401ebd9e SHA512 3075056ddf69aac1fa800f31451f9b10703854b8d96ec68b207b3d43ec375bdeb93c46f63be81c256fd9770296b5e78db97baa696abb5acf83398af4bd37bddf
AUX linux-5.4/9121_0121-use-lfence-instead-of-rep-and-nop.patch 848 BLAKE2B 721e0488350ed4c739074680c9c2b9c5e0bcc63b459e03df2b91b28312b7c5fb5ff77d5524849a257004b3edd992e52e7b9174a723f9419fc6487a4084458072 SHA512 344d7aa32ceaad1ec78b379c8edbfc04992e75551b9752925964659862f27bc2c605f16d9d3ce1aafae4c167907850a969ab63306239e878cc3af77d82ca336f
AUX linux-5.4/9122_0122-do-accept-in-LIFO-order-for-cache-efficiency.patch 3878 BLAKE2B 464c9bf40d2c3d1a1e2eb0fbd28bd55fb462d119f00d945bccddc6187536d18ff6881ca9151e44ce26b8d295e50e5102c440a2330baaf47a8070c236ce51977b SHA512 3827ae5499c013ab7aadfe1fc4c7c66d6096191f4a7bc44cad674ce7cdf57176fa89dd1ac2b9eae33fca567b80a04fd6b2c7bb1c09c5f8b7b1612ad0d980079a
AUX linux-5.4/9124_0124-locking-rwsem-spin-faster.patch 1002 BLAKE2B 87514bcbbe30dbadf5bfe26231f78a35d4ca31f256703ef390f7d6cca14b965470e3c9405ca2adad7482fdd8b7bb8fd9fda5018b97d911ef85fc9d04d4982e08 SHA512 93831951ca8bf15a3660695453b21dfc87399b2c995434b1e89de71ad1ef82db8e06ad9a0086a3631da80a909f38204eaaf3cf27152c93559e37c818bb7868a6
AUX linux-5.4/9125_0125-ata-libahci-ignore-staggered-spin-up.patch 1466 BLAKE2B a7765f9edb2d1f60b4f6fbc66cdc36a73661586d104e69f0faf2a1749378a4a1ad9643451d004dcb8627c129c772a5b70b21ff1e71c8de8fad82b5e9fc043d6b SHA512 daa47222b26ae0ab8b81ab7ec4efc91bc2aafb96029e81df8f71c965a10764e1eb010ae9d3ce87a4a0b2384ecd1c399b14fd666359d7eb5b377a5511f69cbdf7
AUX linux-5.4/9126_0126-print-CPU-that-faults.patch 976 BLAKE2B 1cca18251ee83377d4ae83133d265331cfa0a8f46454b1f323cebd501f47ce6bc5aac2ef40f0fc6d23eb85c0569cddc42e78491a2e8468f5fe40bc88b5095c27 SHA512 88d12072c7a05bfd4215b9733fb87533615ef3f697f28e04c1c31166ba35ec9603273f516eed5a845704e75f1c58261b752fe42e996f9e9d936c23c5fb229459
AUX linux-5.4/9127_0127-x86-microcode-Force-update-a-uCode-even-if-the-rev-i.patch 4328 BLAKE2B a5046c7eb4806c013174e15f81c0c645256a4044ac4f4775566a568810aff167923f260b13672e161bd2a8819018b0494697f3c3b98175955f8db116936980dc SHA512 32ce99684b12cc820f5cab6295c45c0ac12c86e896f84dc2873892e7fe6309e95905a23895dd161f8a73176888b5cec3dcf68eea4718bcab95c982bd1c59c8b4
AUX linux-5.4/9128_0128-x86-microcode-echo-2-reload-to-force-load-ucode.patch 2137 BLAKE2B 6ebe1a45ab240e3b8388a189fead7908140705014f6ab649cb0083260f9214d22066d9fc6bfb15049e835617f0e760cbd0a381453a15c97f629daac2de7d174b SHA512 2c0545594364bce9a97b0e66cc6d53fe0064009d75a346fdc9c0b0f743f431f744349e61da916f9a7ef3f2834204f0dcc1a1fe47ba6b5a948e95685472c170e6
AUX linux-5.4/9129_0129-fix-bug-in-ucode-force-reload-revision-check.patch 912 BLAKE2B d1340c3e9d2b65fcec19d44f6bf18a1e9b7af3f6df95e4d5757a356dbbe7967bd6a258b8cc17fa4d49e5e6b994577d1eb85b9ccd53a8325ba70037a719969a4d SHA512 8ba90dbaf05c8632ce4896cf0153d96385d812779800729010beac156cc643035af1db2b1ad726da1dd39a7ee92db7f947b26d5a1224567d9666cd687c33b181
AUX linux-5.4/9131_0131-nvme-workaround.patch 957 BLAKE2B 417108734ef872b76ab5fd07e244b3bfac39045626bcdc422e37e7248ca2ce0844eec0babd57d0860145d2d18d334dfe46ce328a8a029cb29a4bd53164037a7a SHA512 ffe0e581f3e7efd5bd1de700cb434e9ef91761cc00d1f74da7e52d04478cc46e4bed655e934c8fbedd67434ef7c6c00baa5c59c471cca0bc494da9f6e5a4726c
AUX linux-5.10.amd64.config 151797 BLAKE2B e25add6ed0ea63bced8ed850218e44686d478da4df4d4215514a3c71b27f763b8ca52feb2e1287a4a0ac7d85a991ace6eece8dc29433dc960bdeef9d0256971e SHA512 a8ef0ca2ae036a3071083a6112dd6dcf73df59bc9364aeb5401a380a722f051b48111bdcd4d5493b3f925acc05e44cf18dcecda9c8b55fc3616b578462675daf
DIST genpatches-4.19-124.base.tar.xz 3482680 BLAKE2B e8716be023f6512fb4613fab11a6ecf6472dd738cdb63669cfc6573e70030bfc5d3374c18672661867dd584d621cffdced21403a337af40b2428ff6703b6aa53 SHA512 dde38efe4b8e413b0aa1380c3fc4284b153b048a38cb8e05fdec34c14588d3e60092a20d247195389ceace0dc9e353caacaf9573c75a2327b4667dcad90c15fa
DIST genpatches-4.19-124.extras.tar.xz 17516 BLAKE2B 1c7db2f9f888a9becf0dd891a3f9980431419af50552a4cda06c51f1a7b5d923698d6ce625c619b73386a300438f858a551ca53adc2a5bc110d6eda2a575a22d SHA512 4f29e993be982e272205c6d57e1828e7cc837abbde4a1e7b59e6b20eac648315bec135338b8f6e33df2b49d81e855a9f5c7eeebf6238fa8bc3bbd2215c324eff
DIST genpatches-5.4-48.base.tar.xz 1620972 BLAKE2B 45f358c85092ba422f8c411e91da90ccfc4b607f9c095dbe9ff02bc6adfbab4b35b03763316999810364d18ed3323fa613b70117e6f8454b2ba74744c1266b0e SHA512 b99974f5491b6103bb3e6b3b97e613322001bec40e49a4edc53893e94df66b7cc03370ca28af62d21dda995a477e395c16c22b8595ac96723ae66f2747fc9df4
DIST genpatches-5.4-48.extras.tar.xz 1768 BLAKE2B 3f281c1c36c2a52e4fe2419592377baf4553c5fc61088911e50a901f96a1f4d89dc3e1b441b4b02575fca77ef6c371ccbecf8c55ff2eb9fbe14a7047451ae873 SHA512 9d2dbd829c53a310549811c2f133b19e4525c103827c5c5935cbd09d790eec105957dcbaee10cbe6409e0b7e00065c91b29a52e6d2bbf8e41859f5e4987de98a
DIST genpatches-5.10-49.base.tar.xz 1588092 BLAKE2B d31ab75b6106e81654a69d1d0cb1d765cad83fcdb20a4cad9bf44749146aeb4c19cb6c8bb743b26ec48cb6439c64f8b3af9011468ba6b140dfcdd00adf14286f SHA512 cf6973eed088a99b9e9bc5822f87e75bec61f94207a783f25ec5e835fde565dfbc04fe3dc5c6709f213479b86bbfab26003661108607a17df0169ee2ae5f43c3
DIST genpatches-5.10-49.extras.tar.xz 3412 BLAKE2B 3feb28c887152586b0e5c282e898d447451cdc7b0dcd0749d69890b72fc1d38f9a0a9dfe62d09c8f37ee198ff809edd949137503dafbd63120b566a837c83e32 SHA512 dc916a8848358891c749ab2853d49a2e5a3e7cc0c696b4f523902c5526fe3463730209bcd9a229dea86ed628a8da63b16316b565752e4eba6ee68381af92b6c7
DIST linux-4.19.tar.xz 103117552 BLAKE2B 1dbf16cf410867412d17568fe42bc1e90c034183b654d270b650621ff7664a321950943d0639205bc1ee7ef6210be170c1f2c785a042ed8a4ec5e3a486d890e0 SHA512 ab67cc746b375a8b135e8b23e35e1d6787930d19b3c26b2679787d62951cbdbc3bb66f8ededeb9b890e5008b2459397f9018f1a6772fdef67780b06a4cb9f6f4
DIST linux-5.4.tar.xz 109441440 BLAKE2B 193bc4a3147e147d5529956164ec4912fad5d5c6fb07f909ff1056e57235834173194afc686993ccd785c1ff15804de0961b625f3008cca0e27493efc8f27b13 SHA512 9f60f77e8ab972b9438ac648bed17551c8491d6585a5e85f694b2eaa4c623fbc61eb18419b2656b6795eac5deec0edaa04547fc6723fbda52256bd7f3486898f
DIST linux-5.10.tar.xz 116606704 BLAKE2B b923d7b66309224f42f35f8a5fa219421b0a9362d2adacdadd8d96251f61f7230878ea297a269a7f3b3c56830f0b177e068691e1d7f88501a05653b0a13274d1 SHA512 95bc137d0cf9148da6a9d1f1a878698dc27b40f68e22c597544010a6c591ce1b256f083489d3ff45ff77753289b535135590194d88ef9f007d0ddab3d74de70e
DIST linux-hardened-4.19.125.a.patch 97705 BLAKE2B ca013aaf31bf90177b5d2d2cb2018bafaa0173c6017193bd5bbc3568a4bd34d628798a8dc56411add627340b3b1617f7d43b02a7e032bd7e4374166e7c3bf8e0 SHA512 771a696115a9879b36fb01d3dc7c4cc9cd02591c07f6cca6f73e956818fa77e1dc42289f79167c4fb2deb69ec8fd9b458757bf45403d7fce874b7b57eb551482
DIST linux-hardened-5.4.48.a.patch 100543 BLAKE2B 48c15ec66ec6ef9c70c5b600b37b125ae5812b433425cfa32d04d4d80ddfb5f4bdba415a35b2885fb8e73bfb49dda677bd5d756f5b526b38ce1c7a016bb8ddc3 SHA512 46749197b9b7517c4bdf7d619fbdd716726d947f4a6214119ac777096673b351fbee408ae02ce23d241bfa7028ec57f6e8c7e72f2d2ef137c9f58be0d194ba93
DIST tinycorelinux-10.1-amd64.qcow2 16842752 BLAKE2B e013e76503c335739a9623c0901ca791937a0e6b177854535cadec1e2c2cd2df588283ed3128cf652595f32264fbfe5b3bd3a8c97665fd4da344e308535be366 SHA512 c3aeb20ff8769da9211694b7f701907cc7ae7582cdfad2c2fdc008d97ebcbd9dc08245b4e8f8450e1cb304bd705345a11fe79f901a47979fee91443841d55641
DIST tinycorelinux-10.1-x86.qcow2 14876672 BLAKE2B 3c760eb7438b13261e52ecfaa33a53649ced95f1ab40aae52134b8cdc31a16d7aa0d6a6dd716e268ed148e9d77a10b7c700b141b61d70c82d271ffe88e8e2a3c SHA512 9964538dc42f232a11949f74b61d46422ea5da3bdc253a217119bd0b8a750c40fd2da0b07157067be9ac0226472614f210a1248114df0d331df390979867a895
DIST linux-hardened-5.10.45-hardened1.patch 118939 BLAKE2B ceb1fa26c133beb2f35aab6c92151d3dd52febfe68ee83a42452b5af485a9c992ea5652ce89fd815fc746bfbde88377eaf0939c75c1e0cbdeee95306f56bad4c SHA512 34bebab9b7fdf1b7119e560de324d0d0ac62ca35cbeb674377a825a97076ea4f0873f34920bd28bfb5631fe9d0e81c2fbd3188e79b1df4271f50821782179d28
EBUILD hardened-kernel-4.19.125.ebuild 2568 BLAKE2B 1c165f8359a5d5926cc866769f0ca7fe8b999e190cc92cd92b253efac18ca6d4bcddb89c1ffe8d83bdcb2249421dd58b7372ec4d74f4f432e874503a8fe2e5ab SHA512 08c7c6ef75a00bbf78ab49a01214230e44a602c51b70ad9d61b49c76a014b6d006d67984a482b3142b9aba835ab819f80bbde0a8adc40eab298fba9e9d3b3742
EBUILD hardened-kernel-5.4.48.ebuild 2906 BLAKE2B f6b41e3a4942413ab87d7800005723c6c1782bfdb52386e1283f77e0a8c3d489dafbe94e927b34d80c231391048efff3255f747d6619dfbb2f893a209294957a SHA512 84923b06453a405c0e56ee6ad34b37877707400c4918094baba8ab22063d5f537afd0fd89e19e18a4b7e63a09ebb85f78a1f3a5f7e2c0e8fb761b2dff12a534b
EBUILD hardened-kernel-5.10.45.ebuild 2955 BLAKE2B f575bf1eb269030c4c9d695c39b5b684c1cda57837db0d83d41c8e7e14f30f5a3f4af72641d99c6bedeb0852ff714a282fa679b9ad64d2ad035eb7f2faddb1a1 SHA512 29ad137704d4048c3d801564aadfa37ae90a9a35374d497552d17d326f6538f91049d0b739711a3c79073a73c4b80f72199bce6993506ce7a0eda1e4b7b57bc7
MISC metadata.xml 345 BLAKE2B 4003222d76459210cbeba27d68bcef9b42f500dd3dafe53505dae42004c5224eeae395fb30d7582de614654d2fde19d118c8c31fbc35e5335c9150d93f42efc9 SHA512 994d288cd16858bad3177d383a279f0f549ddf40ef87c62683815540b331bd48d4afa4d0c6af947e409c58f8abb5e1da045bb98dc00a422ea724cdf0610d6619

977
sys-kernel/hardened-kernel/files/linux-5.4.amd64.config → sys-kernel/hardened-kernel/files/linux-5.10.amd64.config
View File

File diff suppressed because it is too large Load Diff

38
sys-kernel/hardened-kernel/files/linux-5.4/9001_CVE-2019-12379.patch
View File

@ -1,38 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Gen Zhang <blackgod016574@gmail.com>
Date: Thu, 23 May 2019 08:34:52 +0800
Subject: [PATCH] consolemap: Fix a memory leaking bug in
drivers/tty/vt/consolemap.c
In function con_insert_unipair(), when allocation for p2 and p1[n]
fails, ENOMEM is returned, but previously allocated p1 is not freed,
remains as leaking memory. Thus we should free p1 as well when this
allocation fails.
Signed-off-by: Gen Zhang <blackgod016574@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/consolemap.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index b28aa0d289f8..79fcc96cc7c0 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -489,7 +489,11 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
p2 = p1[n = (unicode >> 6) & 0x1f];
if (!p2) {
p2 = p1[n] = kmalloc_array(64, sizeof(u16), GFP_KERNEL);
- if (!p2) return -ENOMEM;
+ if (!p2) {
+ kfree(p1);
+ p->uni_pgdir[n] = NULL;
+ return -ENOMEM;
+ }
memset(p2, 0xff, 64*sizeof(u16)); /* No glyphs for the characters (yet) */
}
--
https://clearlinux.org

35
sys-kernel/hardened-kernel/files/linux-5.4/9004_CVE-2019-19054.patch
View File

@ -1,35 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Navid Emamdoost <navid.emamdoost@gmail.com>
Date: Wed, 25 Sep 2019 12:02:41 -0300
Subject: [PATCH] media: rc: prevent memory leak in cx23888_ir_probe
In cx23888_ir_probe if kfifo_alloc fails the allocated memory for state
should be released.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
---
drivers/media/pci/cx23885/cx23888-ir.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/media/pci/cx23885/cx23888-ir.c b/drivers/media/pci/cx23885/cx23888-ir.c
index e880afe37f15..d59ca3601785 100644
--- a/drivers/media/pci/cx23885/cx23888-ir.c
+++ b/drivers/media/pci/cx23885/cx23888-ir.c
@@ -1167,8 +1167,11 @@ int cx23888_ir_probe(struct cx23885_dev *dev)
return -ENOMEM;
spin_lock_init(&state->rx_kfifo_lock);
- if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE, GFP_KERNEL))
+ if (kfifo_alloc(&state->rx_kfifo, CX23888_IR_RX_KFIFO_SIZE,
+ GFP_KERNEL)) {
+ kfree(state);
return -ENOMEM;
+ }
state->dev = dev;
sd = &state->sd;
--
https://clearlinux.org

88
sys-kernel/hardened-kernel/files/linux-5.4/9052_0052-drm-i915-save-AUD_FREQ_CNTRL-state-at-audio-domain-s.patch
View File

@ -1,88 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Fri, 20 Sep 2019 11:39:18 +0300
Subject: [PATCH] drm/i915: save AUD_FREQ_CNTRL state at audio domain suspend
commit 87c1694533c947bf950251df3da04a32a05ede64 upstream
When audio power domain is suspended, the display driver must
save state of AUD_FREQ_CNTRL on Tiger Lake and Ice Lake
systems. The initial value of the register is set by BIOS and
is read by driver during the audio component init sequence.
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Imre Deak <imre.deak@intel.com>
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190920083918.27057-1-kai.vehmanen@linux.intel.com
---
drivers/gpu/drm/i915/display/intel_audio.c | 17 +++++++++++++++--
drivers/gpu/drm/i915/i915_drv.h | 1 +
drivers/gpu/drm/i915/i915_reg.h | 2 ++
3 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_audio.c b/drivers/gpu/drm/i915/display/intel_audio.c
index aac089c79ceb..54638d99e021 100644
--- a/drivers/gpu/drm/i915/display/intel_audio.c
+++ b/drivers/gpu/drm/i915/display/intel_audio.c
@@ -852,10 +852,17 @@ static unsigned long i915_audio_component_get_power(struct device *kdev)
ret = intel_display_power_get(dev_priv, POWER_DOMAIN_AUDIO);
- /* Force CDCLK to 2*BCLK as long as we need audio to be powered. */
- if (dev_priv->audio_power_refcount++ == 0)
+ if (dev_priv->audio_power_refcount++ == 0) {
+ if (IS_TIGERLAKE(dev_priv) || IS_ICELAKE(dev_priv)) {
+ I915_WRITE(AUD_FREQ_CNTRL, dev_priv->audio_freq_cntrl);
+ DRM_DEBUG_KMS("restored AUD_FREQ_CNTRL to 0x%x\n",
+ dev_priv->audio_freq_cntrl);
+ }
+
+ /* Force CDCLK to 2*BCLK as long as we need audio powered. */
if (IS_CANNONLAKE(dev_priv) || IS_GEMINILAKE(dev_priv))
glk_force_audio_cdclk(dev_priv, true);
+ }
return ret;
}
@@ -1116,6 +1123,12 @@ static void i915_audio_component_init(struct drm_i915_private *dev_priv)
return;
}
+ if (IS_TIGERLAKE(dev_priv) || IS_ICELAKE(dev_priv)) {
+ dev_priv->audio_freq_cntrl = I915_READ(AUD_FREQ_CNTRL);
+ DRM_DEBUG_KMS("init value of AUD_FREQ_CNTRL of 0x%x\n",
+ dev_priv->audio_freq_cntrl);
+ }
+
dev_priv->audio_component_registered = true;
}
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 07f1e89a55ca..fcf7423075ef 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1541,6 +1541,7 @@ struct drm_i915_private {
*/
struct mutex av_mutex;
int audio_power_refcount;
+ u32 audio_freq_cntrl;
struct {
struct mutex mutex;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 8649a3028963..6ecb64c042ef 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -9127,6 +9127,8 @@ enum {
#define HSW_AUD_CHICKENBIT _MMIO(0x65f10)
#define SKL_AUD_CODEC_WAKE_SIGNAL (1 << 15)
+#define AUD_FREQ_CNTRL _MMIO(0x65900)
+
/*
* HSW - ICL power wells
*
--
https://clearlinux.org

58
sys-kernel/hardened-kernel/files/linux-5.4/9053_0053-drm-i915-Fix-audio-power-up-sequence-for-gen10-displ.patch
View File

@ -1,58 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Thu, 3 Oct 2019 11:55:30 +0300
Subject: [PATCH] drm/i915: Fix audio power up sequence for gen10+ display
commit 1580d3cdddbba4a5ef78a04a5289e32844e6af24 upstream
On platfroms with gen10+ display, driver must set the enable bit of
AUDIO_PIN_BUF_CTL register before transactions with the HDA controller
can proceed. Add setting this bit to the audio power up sequence.
Failing to do this resulted in errors during display audio codec probe,
and failures during resume from suspend.
Note: We may also need to disable the bit afterwards, but there are
still unresolved issues with that.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=111214
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20191003085531.30990-1-kai.vehmanen@linux.intel.com
---
drivers/gpu/drm/i915/display/intel_audio.c | 5 +++++
drivers/gpu/drm/i915/i915_reg.h | 2 ++
2 files changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/i915/display/intel_audio.c b/drivers/gpu/drm/i915/display/intel_audio.c
index 54638d99e021..e93776710abc 100644
--- a/drivers/gpu/drm/i915/display/intel_audio.c
+++ b/drivers/gpu/drm/i915/display/intel_audio.c
@@ -862,6 +862,11 @@ static unsigned long i915_audio_component_get_power(struct device *kdev)
/* Force CDCLK to 2*BCLK as long as we need audio powered. */
if (IS_CANNONLAKE(dev_priv) || IS_GEMINILAKE(dev_priv))
glk_force_audio_cdclk(dev_priv, true);
+
+ if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv))
+ I915_WRITE(AUD_PIN_BUF_CTL,
+ (I915_READ(AUD_PIN_BUF_CTL) |
+ AUD_PIN_BUF_ENABLE));
}
return ret;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index eefd789b9a28..813ddea3f9f1 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -9133,6 +9133,8 @@ enum {
#define SKL_AUD_CODEC_WAKE_SIGNAL (1 << 15)
#define AUD_FREQ_CNTRL _MMIO(0x65900)
+#define AUD_PIN_BUF_CTL _MMIO(0x48414)
+#define AUD_PIN_BUF_ENABLE REG_BIT(31)
/*
* HSW - ICL power wells
--
https://clearlinux.org

43
sys-kernel/hardened-kernel/files/linux-5.4/9054_0054-drm-i915-extend-audio-CDCLK-2-BCLK-constraint-to-mor.patch
View File

@ -1,43 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Date: Thu, 3 Oct 2019 11:55:31 +0300
Subject: [PATCH] drm/i915: extend audio CDCLK>=2*BCLK constraint to more
platforms
commit f6ec9483091f8e67adab0311a4e2f90aab523310 upstream
The CDCLK>=2*BCLK constraint applies to all generations since gen10.
Extend the constraint logic in audio get/put_power().
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20191003085531.30990-2-kai.vehmanen@linux.intel.com
---
drivers/gpu/drm/i915/display/intel_audio.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_audio.c b/drivers/gpu/drm/i915/display/intel_audio.c
index e93776710abc..ed18511befa3 100644
--- a/drivers/gpu/drm/i915/display/intel_audio.c
+++ b/drivers/gpu/drm/i915/display/intel_audio.c
@@ -860,7 +860,7 @@ static unsigned long i915_audio_component_get_power(struct device *kdev)
}
/* Force CDCLK to 2*BCLK as long as we need audio powered. */
- if (IS_CANNONLAKE(dev_priv) || IS_GEMINILAKE(dev_priv))
+ if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv))
glk_force_audio_cdclk(dev_priv, true);
if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv))
@@ -879,7 +879,7 @@ static void i915_audio_component_put_power(struct device *kdev,
/* Stop forcing CDCLK to 2*BCLK if no need for audio to be powered. */
if (--dev_priv->audio_power_refcount == 0)
- if (IS_CANNONLAKE(dev_priv) || IS_GEMINILAKE(dev_priv))
+ if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv))
glk_force_audio_cdclk(dev_priv, false);
intel_display_power_put(dev_priv, POWER_DOMAIN_AUDIO, cookie);
--
https://clearlinux.org

65
sys-kernel/hardened-kernel/files/linux-5.4/9101_0101-i8042-decrease-debug-message-level-to-info.patch
View File

@ -1,65 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Tue, 23 Jun 2015 01:26:52 -0500
Subject: [PATCH] i8042: decrease debug message level to info
Author: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com>
Signed-off-by: Jose Carlos Venegas Munoz <jos.c.venegas.munoz@intel.com>
---
drivers/input/serio/i8042.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 20ff2bed3917..9716c549a76b 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -611,7 +611,7 @@ static int i8042_enable_kbd_port(void)
if (i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR)) {
i8042_ctr &= ~I8042_CTR_KBDINT;
i8042_ctr |= I8042_CTR_KBDDIS;
- pr_err("Failed to enable KBD port\n");
+ pr_info("Failed to enable KBD port\n");
return -EIO;
}
@@ -630,7 +630,7 @@ static int i8042_enable_aux_port(void)
if (i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR)) {
i8042_ctr &= ~I8042_CTR_AUXINT;
i8042_ctr |= I8042_CTR_AUXDIS;
- pr_err("Failed to enable AUX port\n");
+ pr_info("Failed to enable AUX port\n");
return -EIO;
}
@@ -722,7 +722,7 @@ static int __init i8042_check_mux(void)
i8042_ctr &= ~I8042_CTR_AUXINT;
if (i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR)) {
- pr_err("Failed to disable AUX port, can't use MUX\n");
+ pr_info("Failed to disable AUX port, can't use MUX\n");
return -EIO;
}
@@ -945,7 +945,7 @@ static int i8042_controller_selftest(void)
do {
if (i8042_command(&param, I8042_CMD_CTL_TEST)) {
- pr_err("i8042 controller selftest timeout\n");
+ pr_info("i8042 controller selftest timeout\n");
return -ENODEV;
}
@@ -967,7 +967,7 @@ static int i8042_controller_selftest(void)
pr_info("giving up on controller selftest, continuing anyway...\n");
return 0;
#else
- pr_err("i8042 controller selftest failed\n");
+ pr_info("i8042 controller selftest failed\n");
return -EIO;
#endif
}
--
https://clearlinux.org

35
sys-kernel/hardened-kernel/files/linux-5.4/9102_0102-Increase-the-ext4-default-commit-age.patch
View File

@ -1,35 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Mon, 11 Jan 2016 10:01:44 -0600
Subject: [PATCH] Increase the ext4 default commit age
Both the VM and EXT4 have a "commit to disk after X seconds" time.
Currently the EXT4 time is shorter than our VM time, which is a bit
suboptional,
it's better for performance to let the VM do the writeouts in bulk
rather than something deep in the journalling layer.
(DISTRO TWEAK -- NOT FOR UPSTREAM)
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Jose Carlos Venegas Munoz <jose.carlos.venegas.munoz@intel.com>
---
include/linux/jbd2.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index 603fbc4e2f70..339e22bd75d3 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -44,7 +44,7 @@
/*
* The default maximum commit age, in seconds.
*/
-#define JBD2_DEFAULT_MAX_COMMIT_AGE 5
+#define JBD2_DEFAULT_MAX_COMMIT_AGE 30
#ifdef CONFIG_JBD2_DEBUG
/*
--
https://clearlinux.org

25
sys-kernel/hardened-kernel/files/linux-5.4/9103_0103-silence-rapl.patch
View File

@ -1,25 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Mon, 14 Mar 2016 11:22:09 -0600
Subject: [PATCH] silence rapl
---
drivers/powercap/intel_rapl_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/powercap/intel_rapl_common.c b/drivers/powercap/intel_rapl_common.c
index 94ddd7d659c8..8c5a87f5f966 100644
--- a/drivers/powercap/intel_rapl_common.c
+++ b/drivers/powercap/intel_rapl_common.c
@@ -1419,7 +1419,7 @@ static int __init rapl_init(void)
id = x86_match_cpu(rapl_ids);
if (!id) {
- pr_err("driver does not support CPU family %d model %d\n",
+ pr_info("driver does not support CPU family %d model %d\n",
boot_cpu_data.x86, boot_cpu_data.x86_model);
return -ENODEV;
--
https://clearlinux.org

27
sys-kernel/hardened-kernel/files/linux-5.4/9104_0104-pci-pme-wakeups.patch
View File

@ -1,27 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Mon, 14 Mar 2016 11:10:58 -0600
Subject: [PATCH] pci pme wakeups
Reduce wakeups for PME checks, which are a workaround for miswired
boards (sadly, too many of them) in laptops.
---
drivers/pci/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index a97e2571a527..772e8935aa60 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -61,7 +61,7 @@ struct pci_pme_device {
struct pci_dev *dev;
};
-#define PME_TIMEOUT 1000 /* How long between PME checks */
+#define PME_TIMEOUT 4000 /* How long between PME checks */
static void pci_dev_d3_sleep(struct pci_dev *dev)
{
--
https://clearlinux.org

52
sys-kernel/hardened-kernel/files/linux-5.4/9105_0105-ksm-wakeups.patch
View File

@ -1,52 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Mon, 6 May 2019 12:57:09 -0500
Subject: [PATCH] ksm-wakeups
reduce wakeups in ksm by adding rounding (aligning) when
the sleep times are 1 second or longer
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
---
kernel/watchdog.c | 2 +-
mm/ksm.c | 11 ++++++++---
2 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/kernel/watchdog.c b/kernel/watchdog.c
index f41334ef0971..eb49c42f215b 100644
--- a/kernel/watchdog.c
+++ b/kernel/watchdog.c
@@ -41,7 +41,7 @@ unsigned long __read_mostly watchdog_enabled;
int __read_mostly watchdog_user_enabled = 1;
int __read_mostly nmi_watchdog_user_enabled = NMI_WATCHDOG_DEFAULT;
int __read_mostly soft_watchdog_user_enabled = 1;
-int __read_mostly watchdog_thresh = 10;
+int __read_mostly watchdog_thresh = 40;
static int __read_mostly nmi_watchdog_available;
static struct cpumask watchdog_allowed_mask __read_mostly;
diff --git a/mm/ksm.c b/mm/ksm.c
index 7905934cd3ad..9ea848346a0b 100644
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -2414,9 +2414,14 @@ static int ksm_scan_thread(void *nothing)
if (ksmd_should_run()) {
sleep_ms = READ_ONCE(ksm_thread_sleep_millisecs);
- wait_event_interruptible_timeout(ksm_iter_wait,
- sleep_ms != READ_ONCE(ksm_thread_sleep_millisecs),
- msecs_to_jiffies(sleep_ms));
+ if (sleep_ms >= 1000)
+ wait_event_interruptible_timeout(ksm_iter_wait,
+ sleep_ms != READ_ONCE(ksm_thread_sleep_millisecs),
+ msecs_to_jiffies(round_jiffies_relative(sleep_ms)));
+ else
+ wait_event_interruptible_timeout(ksm_iter_wait,
+ sleep_ms != READ_ONCE(ksm_thread_sleep_millisecs),
+ msecs_to_jiffies(sleep_ms));
} else {
wait_event_freezable(ksm_thread_wait,
ksmd_should_run() || kthread_should_stop());
--
https://clearlinux.org

220
sys-kernel/hardened-kernel/files/linux-5.4/9106_0106-intel_idle-tweak-cpuidle-cstates.patch
View File

@ -1,220 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sat, 19 Mar 2016 21:32:19 -0400
Subject: [PATCH] intel_idle: tweak cpuidle cstates
Increase target_residency in cpuidle cstate
Tune intel_idle to be a bit less agressive;
Clear linux is cleaner in hygiene (wakupes) than the average linux,
so we can afford changing these in a way that increases
performance while keeping power efficiency
---
drivers/idle/intel_idle.c | 44 +++++++++++++++++++--------------------
1 file changed, 22 insertions(+), 22 deletions(-)
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 347b08b56042..31772dd98192 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -454,7 +454,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x01",
.flags = MWAIT2flg(0x01),
.exit_latency = 10,
- .target_residency = 20,
+ .target_residency = 120,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -462,7 +462,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x10",
.flags = MWAIT2flg(0x10) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 33,
- .target_residency = 100,
+ .target_residency = 900,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -470,7 +470,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x20",
.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 133,
- .target_residency = 400,
+ .target_residency = 1000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -478,7 +478,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x32",
.flags = MWAIT2flg(0x32) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 166,
- .target_residency = 500,
+ .target_residency = 1500,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -486,7 +486,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x40",
.flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 300,
- .target_residency = 900,
+ .target_residency = 2000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -494,7 +494,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x50",
.flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 600,
- .target_residency = 1800,
+ .target_residency = 5000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -502,7 +502,7 @@ static struct cpuidle_state hsw_cstates[] = {
.desc = "MWAIT 0x60",
.flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 2600,
- .target_residency = 7700,
+ .target_residency = 9000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -522,7 +522,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x01",
.flags = MWAIT2flg(0x01),
.exit_latency = 10,
- .target_residency = 20,
+ .target_residency = 120,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -530,7 +530,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x10",
.flags = MWAIT2flg(0x10) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 40,
- .target_residency = 100,
+ .target_residency = 1000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -538,7 +538,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x20",
.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 133,
- .target_residency = 400,
+ .target_residency = 1000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -546,7 +546,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x32",
.flags = MWAIT2flg(0x32) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 166,
- .target_residency = 500,
+ .target_residency = 2000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -554,7 +554,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x40",
.flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 300,
- .target_residency = 900,
+ .target_residency = 4000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -562,7 +562,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x50",
.flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 600,
- .target_residency = 1800,
+ .target_residency = 7000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -570,7 +570,7 @@ static struct cpuidle_state bdw_cstates[] = {
.desc = "MWAIT 0x60",
.flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 2600,
- .target_residency = 7700,
+ .target_residency = 9000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -591,7 +591,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x01",
.flags = MWAIT2flg(0x01),
.exit_latency = 10,
- .target_residency = 20,
+ .target_residency = 120,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -599,7 +599,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x10",
.flags = MWAIT2flg(0x10) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 70,
- .target_residency = 100,
+ .target_residency = 1000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -607,7 +607,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x20",
.flags = MWAIT2flg(0x20) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 85,
- .target_residency = 200,
+ .target_residency = 600,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -615,7 +615,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x33",
.flags = MWAIT2flg(0x33) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 124,
- .target_residency = 800,
+ .target_residency = 3000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -623,7 +623,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x40",
.flags = MWAIT2flg(0x40) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 200,
- .target_residency = 800,
+ .target_residency = 3200,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -631,7 +631,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x50",
.flags = MWAIT2flg(0x50) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 480,
- .target_residency = 5000,
+ .target_residency = 9000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -639,7 +639,7 @@ static struct cpuidle_state skl_cstates[] = {
.desc = "MWAIT 0x60",
.flags = MWAIT2flg(0x60) | CPUIDLE_FLAG_TLB_FLUSHED,
.exit_latency = 890,
- .target_residency = 5000,
+ .target_residency = 9000,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
@@ -660,7 +660,7 @@ static struct cpuidle_state skx_cstates[] = {
.desc = "MWAIT 0x01",
.flags = MWAIT2flg(0x01),
.exit_latency = 10,
- .target_residency = 20,
+ .target_residency = 300,
.enter = &intel_idle,
.enter_s2idle = intel_idle_s2idle, },
{
--
https://clearlinux.org

31
sys-kernel/hardened-kernel/files/linux-5.4/9107_0107-bootstats-add-printk-s-to-measure-boot-time-in-more-.patch
View File

@ -1,31 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Wed, 11 Feb 2015 16:05:23 -0600
Subject: [PATCH] bootstats: add printk's to measure boot time in more detail
Few distro-tweaks to add printk's to visualize boot time better
Author: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com>
---
arch/x86/kernel/alternative.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 9d3a971ea364..49c56443759c 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -720,7 +720,9 @@ void __init alternative_instructions(void)
* patching.
*/
+ printk("clr: Applying alternatives\n");
apply_alternatives(__alt_instructions, __alt_instructions_end);
+ printk("clr: Applying alternatives done\n");
#ifdef CONFIG_SMP
/* Patch to UP if other cpus not imminent. */
--
https://clearlinux.org

28
sys-kernel/hardened-kernel/files/linux-5.4/9108_0108-smpboot-reuse-timer-calibration.patch
View File

@ -1,28 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Wed, 11 Feb 2015 17:28:14 -0600
Subject: [PATCH] smpboot: reuse timer calibration
NO point recalibrating for known-constant tsc ...
saves 200ms+ of boot time.
---
arch/x86/kernel/tsc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 7e322e2daaf5..bb2c9b5eed71 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -1528,6 +1528,9 @@ unsigned long calibrate_delay_is_known(void)
if (!constant_tsc || !mask)
return 0;
+ if (cpu != 0)
+ return cpu_data(0).loops_per_jiffy;
+
sibling = cpumask_any_but(mask, cpu);
if (sibling < nr_cpu_ids)
return cpu_data(sibling).loops_per_jiffy;
--
https://clearlinux.org

156
sys-kernel/hardened-kernel/files/linux-5.4/9109_0109-raid6-add-Kconfig-option-to-skip-raid6-benchmarking.patch
View File

@ -1,156 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jim Kukunas <james.t.kukunas@linux.intel.com>
Date: Fri, 27 May 2016 09:26:51 -0400
Subject: [PATCH] raid6: add Kconfig option to skip raid6 benchmarking
Adds CONFIG_RAID6_FORCE_ALGO, which causes the kernel to not benchmark
each raid recovery and syndrome generation algorithm, and instead use
the version selected via Kconfig (CONFIG_RAID6_FORCE_{INT,SSSE3,AVX2}).
In the case, the selected algorithm is not supported by the processor at
runtime, a fallback is used.
Signed-off-by: Jim Kukunas <james.t.kukunas@linux.intel.com>
---
lib/Kconfig | 3 +--
lib/raid6/Kconfig | 38 +++++++++++++++++++++++++++++++
lib/raid6/algos.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 97 insertions(+), 2 deletions(-)
create mode 100644 lib/raid6/Kconfig
diff --git a/lib/Kconfig b/lib/Kconfig
index 3321d04dfa5a..e4343fa05964 100644
--- a/lib/Kconfig
+++ b/lib/Kconfig
@@ -8,8 +8,7 @@ config BINARY_PRINTF
menu "Library routines"
-config RAID6_PQ
- tristate
+source "lib/raid6/Kconfig"
config RAID6_PQ_BENCHMARK
bool "Automatically choose fastest RAID6 PQ functions"
diff --git a/lib/raid6/Kconfig b/lib/raid6/Kconfig
new file mode 100644
index 000000000000..d881d6be89bb
--- /dev/null
+++ b/lib/raid6/Kconfig
@@ -0,0 +1,38 @@
+menu "RAID 6"
+
+config RAID6_PQ
+ tristate
+
+config RAID6_FORCE_ALGO
+ bool "Always use specified recovery algorithm"
+ default n
+ depends on RAID6_PQ
+ help
+ If this option is not set, on every boot the kernel will
+ benchmark each optimized version of the RAID6 recovery and
+ syndrome generation algorithms and will select the one that
+ performs best. Microbenchmarking each version negatively
+ affects boot time.
+
+ Enabling this option skips the benchmark at boot, and
+ instead always uses the algorithm selected. The only exception
+ is if the selected algorithm relies on a cpu feature not
+ supported at runtime. In this case, one of the lower performance
+ fallbacks are used.
+
+choice
+ prompt "RAID6 Recovery Algorithm"
+ default RAID6_FORCE_INT
+ depends on RAID6_FORCE_ALGO
+ ---help---
+ Select the RAID6 recovery algorithm to unconditionally use
+
+ config RAID6_FORCE_INT
+ bool "Reference Implementation"
+ config RAID6_FORCE_SSSE3
+ bool "SSSE3"
+ config RAID6_FORCE_AVX2
+ bool "AVX2"
+endchoice
+
+endmenu
diff --git a/lib/raid6/algos.c b/lib/raid6/algos.c
index 17417eee0866..8af3d7c737c1 100644
--- a/lib/raid6/algos.c
+++ b/lib/raid6/algos.c
@@ -124,6 +124,63 @@ const struct raid6_recov_calls *const raid6_recov_algos[] = {
#define time_before(x, y) ((x) < (y))
#endif
+#ifdef CONFIG_RAID6_FORCE_ALGO
+/* TODO don't compile in algos that will never be used */
+int __init raid6_select_algo(void)
+{
+ const struct raid6_recov_calls *recov_fallback = &raid6_recov_intx1;
+ const struct raid6_recov_calls *recov_algo;
+ const struct raid6_calls *gen_fallback;
+ const struct raid6_calls *gen_algo;
+
+#if defined(__i386__)
+ gen_fallback = &raid6_intx32;
+#elif defined(__x86_64__)
+ gen_fallback = &raid6_sse2x2;
+#else
+# error "TODO"
+#endif
+
+#if defined(CONFIG_RAID6_FORCE_INT)
+ recov_algo = &raid6_recov_intx1;
+ gen_algo = &raid6_intx32;
+
+#elif defined(CONFIG_RAID6_FORCE_SSSE3)
+ recov_algo = &raid6_recov_ssse3;
+#if defined(__i386__)
+ gen_algo = &raid6_sse2x2;
+#else
+ gen_algo = &raid6_sse2x4;
+#endif
+
+#elif defined(CONFIG_RAID6_FORCE_AVX2)
+ recov_algo = &raid6_recov_avx2;
+
+#if defined(__i386__)
+ gen_algo = &raid6_avx2x2;
+#else
+ gen_algo = &raid6_avx2x4;
+#endif
+
+#else
+#error "RAID6 Forced Recov Algo: Unsupported selection"
+#endif
+
+ if (recov_algo->valid != NULL && recov_algo->valid() == 0)
+ recov_algo = recov_fallback;
+
+ pr_info("raid6: Forced to use recovery algorithm %s\n", recov_algo->name);
+
+ raid6_2data_recov = recov_algo->data2;
+ raid6_datap_recov = recov_algo->datap;
+
+ pr_info("raid6: Forced gen() algo %s\n", gen_algo->name);
+
+ raid6_call = *gen_algo;
+
+ return gen_algo && recov_algo ? 0 : -EINVAL;
+}
+#else
static inline const struct raid6_recov_calls *raid6_choose_recov(void)
{
const struct raid6_recov_calls *const *algo;
@@ -260,6 +317,7 @@ int __init raid6_select_algo(void)
return gen_best && rec_best ? 0 : -EINVAL;
}
+#endif
static void raid6_exit(void)
{
--
https://clearlinux.org

50
sys-kernel/hardened-kernel/files/linux-5.4/9110_0110-Initialize-ata-before-graphics.patch
View File

@ -1,50 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Thu, 2 Jun 2016 23:36:32 -0500
Subject: [PATCH] Initialize ata before graphics
ATA init is the long pole in the boot process, and its asynchronous.
move the graphics init after it so that ata and graphics initialize
in parallel
---
drivers/Makefile | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/Makefile b/drivers/Makefile
index aaef17cc6512..d08f3a394929 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -58,15 +58,8 @@ obj-y += char/
# iommu/ comes before gpu as gpu are using iommu controllers
obj-y += iommu/
-# gpu/ comes after char for AGP vs DRM startup and after iommu
-obj-y += gpu/
-
obj-$(CONFIG_CONNECTOR) += connector/
-# i810fb and intelfb depend on char/agp/
-obj-$(CONFIG_FB_I810) += video/fbdev/i810/
-obj-$(CONFIG_FB_INTEL) += video/fbdev/intelfb/
-
obj-$(CONFIG_PARPORT) += parport/
obj-$(CONFIG_NVM) += lightnvm/
obj-y += base/ block/ misc/ mfd/ nfc/
@@ -79,6 +72,14 @@ obj-$(CONFIG_IDE) += ide/
obj-y += scsi/
obj-y += nvme/
obj-$(CONFIG_ATA) += ata/
+
+# gpu/ comes after char for AGP vs DRM startup and after iommu
+obj-y += gpu/
+
+# i810fb and intelfb depend on char/agp/
+obj-$(CONFIG_FB_I810) += video/fbdev/i810/
+obj-$(CONFIG_FB_INTEL) += video/fbdev/intelfb/
+
obj-$(CONFIG_TARGET_CORE) += target/
obj-$(CONFIG_MTD) += mtd/
obj-$(CONFIG_SPI) += spi/
--
https://clearlinux.org

30
sys-kernel/hardened-kernel/files/linux-5.4/9111_0111-give-rdrand-some-credit.patch
View File

@ -1,30 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Fri, 29 Jul 2016 19:10:52 +0000
Subject: [PATCH] give rdrand some credit
try to credit rdrand/rdseed with some entropy
In VMs but even modern hardware, we're super starved for entropy, and while we can
and do wear a tin foil hat, it's very hard to argue that
rdrand and rdtsc add zero entropy.
---
drivers/char/random.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 01b8868b9bed..8544472650ea 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1937,6 +1937,8 @@ static void __init init_std_data(struct entropy_store *r)
if (!arch_get_random_seed_long(&rv) &&
!arch_get_random_long(&rv))
rv = random_get_entropy();
+ else
+ credit_entropy_bits(r, 1);
mix_pool_bytes(r, &rv, sizeof(rv));
}
mix_pool_bytes(r, utsname(), sizeof(*(utsname())));
--
https://clearlinux.org

28
sys-kernel/hardened-kernel/files/linux-5.4/9112_0112-ipv4-tcp-allow-the-memory-tuning-for-tcp-to-go-a-lit.patch
View File

@ -1,28 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Fri, 6 Jan 2017 15:34:09 +0000
Subject: [PATCH] ipv4/tcp: allow the memory tuning for tcp to go a little
bigger than default
---
net/ipv4/tcp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index d8876f0e9672..bbd15a66bf6e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4001,8 +4001,8 @@ void __init tcp_init(void)
tcp_init_mem();
/* Set per-socket limits to no more than 1/128 the pressure threshold */
limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
- max_wshare = min(4UL*1024*1024, limit);
- max_rshare = min(6UL*1024*1024, limit);
+ max_wshare = min(16UL*1024*1024, limit);
+ max_rshare = min(16UL*1024*1024, limit);
init_net.ipv4.sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
init_net.ipv4.sysctl_tcp_wmem[1] = 16*1024;
--
https://clearlinux.org

25
sys-kernel/hardened-kernel/files/linux-5.4/9113_0113-kernel-time-reduce-ntp-wakeups.patch
View File

@ -1,25 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sat, 29 Apr 2017 22:24:34 +0000
Subject: [PATCH] kernel: time: reduce ntp wakeups
---
kernel/time/ntp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index 069ca78fb0bf..22d82f21fc2e 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -513,7 +513,7 @@ static void sched_sync_hw_clock(struct timespec64 now,
* the algorithm is very likely to require a short-sleep retry
* after the above long sleep to synchronize ts_nsec.
*/
- next.tv_sec = 0;
+ next.tv_sec = 10;
}
/* Compute the needed delay that will get to tv_nsec == target_nsec */
--
https://clearlinux.org

52
sys-kernel/hardened-kernel/files/linux-5.4/9114_0114-init-wait-for-partition-and-retry-scan.patch
View File

@ -1,52 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Wed, 17 May 2017 01:52:11 +0000
Subject: [PATCH] init: wait for partition and retry scan
As Clear Linux boots fast the device is not ready when
the mounting code is reached, so a retry device scan will
be performed every 0.5 sec for at least 40 sec
and synchronize the async task.
Signed-off-by: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com>
---
init/do_mounts.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/init/do_mounts.c b/init/do_mounts.c
index 9634ecf3743d..7f7d64621a2a 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -225,11 +225,19 @@ dev_t name_to_dev_t(const char *name)
char *p;
dev_t res = 0;
int part;
+ /* we will wait at least 40 sec */
+ int needtowait = 40<<1;
#ifdef CONFIG_BLOCK
if (strncmp(name, "PARTUUID=", 9) == 0) {
name += 9;
res = devt_from_partuuid(name);
+ while (!res && needtowait) {
+ /* waiting 0.5 sec */
+ msleep(500);
+ res = devt_from_partuuid(name);
+ needtowait--;
+ }
if (!res)
goto fail;
goto done;
@@ -585,7 +593,9 @@ void __init prepare_namespace(void)
* For example, it is not atypical to wait 5 seconds here
* for the touchpad of a laptop to initialize.
*/
+ async_synchronize_full();
wait_for_device_probe();
+ async_synchronize_full();
md_run_setup();
--
https://clearlinux.org

52
sys-kernel/hardened-kernel/files/linux-5.4/9115_0115-print-fsync-count-for-bootchart.patch
View File

@ -1,52 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Tue, 20 Jun 2017 20:19:08 +0000
Subject: [PATCH] print fsync count for bootchart
---
block/blk-core.c | 3 +++
include/linux/sched.h | 1 +
kernel/sched/debug.c | 1 +
3 files changed, 5 insertions(+)
diff --git a/block/blk-core.c b/block/blk-core.c
index d5e668ec751b..be554fee0584 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1168,6 +1168,9 @@ blk_qc_t submit_bio(struct bio *bio)
count_vm_events(PGPGIN, count);
}
+ if (bio->bi_opf & REQ_PREFLUSH)
+ current->fsync_count++;
+
if (unlikely(block_dump)) {
char b[BDEVNAME_SIZE];
printk(KERN_DEBUG "%s(%d): %s block %Lu on %s (%u sectors)\n",
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 775503573ed7..08eb6063db49 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -881,6 +881,7 @@ struct task_struct {
/* Cached requested key. */
struct key *cached_requested_key;
#endif
+ int fsync_count;
/*
* executable name, excluding path.
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index f7e4579e746c..2e4e887349ff 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -879,6 +879,7 @@ void proc_sched_show_task(struct task_struct *p, struct pid_namespace *ns,
PN(se.exec_start);
PN(se.vruntime);
PN(se.sum_exec_runtime);
+ P(fsync_count);
nr_switches = p->nvcsw + p->nivcsw;
--
https://clearlinux.org

71
sys-kernel/hardened-kernel/files/linux-5.4/9116_0116-Add-boot-option-to-allow-unsigned-modules.patch
View File

@ -1,71 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: "Brett T. Warden" <brett.t.warden@intel.com>
Date: Mon, 13 Aug 2018 04:01:21 -0500
Subject: [PATCH] Add boot option to allow unsigned modules
Add module.sig_unenforce boot parameter to allow loading unsigned kernel
modules. Parameter is only effective if CONFIG_MODULE_SIG_FORCE is
enabled and system is *not* SecureBooted.
Signed-off-by: Brett T. Warden <brett.t.warden@intel.com>
Signed-off-by: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com>
---
kernel/module.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
diff --git a/kernel/module.c b/kernel/module.c
index ff2d7359a418..f6368b8f90b6 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -53,6 +53,7 @@
#include <linux/bsearch.h>
#include <linux/dynamic_debug.h>
#include <linux/audit.h>
+#include <linux/efi.h>
#include <uapi/linux/module.h>
#include "module-internal.h"
@@ -268,6 +269,10 @@ static void module_assert_mutex_or_preempt(void)
static bool sig_enforce = IS_ENABLED(CONFIG_MODULE_SIG_FORCE);
module_param(sig_enforce, bool_enable_only, 0644);
+/* Allow disabling module signature requirement by adding boot param */
+static bool sig_unenforce = false;
+module_param(sig_unenforce, bool_enable_only, 0644);
+
/*
* Export sig_enforce kernel cmdline parameter to allow other subsystems rely
@@ -393,6 +398,8 @@ extern const s32 __start___kcrctab_unused[];
extern const s32 __start___kcrctab_unused_gpl[];
#endif
+extern struct boot_params boot_params;
+
#ifndef CONFIG_MODVERSIONS
#define symversion(base, idx) NULL
#else
@@ -4401,6 +4408,20 @@ static const struct file_operations proc_modules_operations = {
static int __init proc_modules_init(void)
{
proc_create("modules", 0, NULL, &proc_modules_operations);
+
+#ifdef CONFIG_MODULE_SIG_FORCE
+ switch (boot_params.secure_boot) {
+ case efi_secureboot_mode_unset:
+ case efi_secureboot_mode_unknown:
+ case efi_secureboot_mode_disabled:
+ /*
+ * sig_unenforce is only applied if SecureBoot is not
+ * enabled.
+ */
+ sig_enforce = !sig_unenforce;
+ }
+#endif
+
return 0;
}
module_init(proc_modules_init);
--
https://clearlinux.org

28
sys-kernel/hardened-kernel/files/linux-5.4/9117_0117-Enable-stateless-firmware-loading.patch
View File

@ -1,28 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: William Douglas <william.douglas@intel.com>
Date: Wed, 20 Jun 2018 17:23:21 +0000
Subject: [PATCH] Enable stateless firmware loading
Prefer the order of specific version before generic and /etc before
/lib to enable the user to give specific overrides for generic
firmware and distribution firmware.
---
drivers/base/firmware_loader/main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index bf44c79beae9..019547b549a9 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -439,6 +439,8 @@ static int fw_decompress_xz(struct device *dev, struct fw_priv *fw_priv,
static char fw_path_para[256];
static const char * const fw_path[] = {
fw_path_para,
+ "/etc/firmware/" UTS_RELEASE,
+ "/etc/firmware",
"/lib/firmware/updates/" UTS_RELEASE,
"/lib/firmware/updates",
"/lib/firmware/" UTS_RELEASE,
--
https://clearlinux.org

45
sys-kernel/hardened-kernel/files/linux-5.4/9118_0118-Migrate-some-systemd-defaults-to-the-kernel-defaults.patch
View File

@ -1,45 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Auke Kok <auke-jan.h.kok@intel.com>
Date: Thu, 2 Aug 2018 12:03:22 -0700
Subject: [PATCH] Migrate some systemd defaults to the kernel defaults.
These settings are needed to prevent networking issues when
the networking modules come up by default without explicit
settings, which breaks some cases.
We don't want the modprobe settings to be read at boot time
if we're not going to do anything else ever.
---
drivers/net/dummy.c | 2 +-
include/uapi/linux/if_bonding.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
index 54e4d8b07f0e..a23d569417a7 100644
--- a/drivers/net/dummy.c
+++ b/drivers/net/dummy.c
@@ -44,7 +44,7 @@
#define DRV_NAME "dummy"
#define DRV_VERSION "1.0"
-static int numdummies = 1;
+static int numdummies = 0;
/* fake multicast ability */
static void set_multicast_list(struct net_device *dev)
diff --git a/include/uapi/linux/if_bonding.h b/include/uapi/linux/if_bonding.h
index 790585f0e61b..85560927eff7 100644
--- a/include/uapi/linux/if_bonding.h
+++ b/include/uapi/linux/if_bonding.h
@@ -82,7 +82,7 @@
#define BOND_STATE_ACTIVE 0 /* link is active */
#define BOND_STATE_BACKUP 1 /* link is backup */
-#define BOND_DEFAULT_MAX_BONDS 1 /* Default maximum number of devices to support */
+#define BOND_DEFAULT_MAX_BONDS 0 /* Default maximum number of devices to support */
#define BOND_DEFAULT_TX_QUEUES 16 /* Default number of tx queues per device */
--
https://clearlinux.org

55
sys-kernel/hardened-kernel/files/linux-5.4/9119_0119-xattr-allow-setting-user.-attributes-on-symlinks-by-.patch
View File

@ -1,55 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Alan Cox <alan@linux.intel.com>
Date: Thu, 10 Mar 2016 15:11:28 +0000
Subject: [PATCH] xattr: allow setting user.* attributes on symlinks by owner
Kvmtool and clear containers supports using user attributes to label host
files with the virtual uid/guid of the file in the container. This allows an
end user to manage their files and a complete uid space without all the ugly
namespace stuff.
The one gap in the support is symlinks because an end user can change the
ownership of a symbolic link. We support attributes on these files as you
can already (as root) set security attributes on them.
The current rules seem slightly over-paranoid and as we have a use case this
patch enables updating the attributes on a symbolic link IFF you are the
owner of the synlink (as permissions are not usually meaningful on the link
itself).
Signed-off-by: Alan Cox <alan@linux.intel.com>
---
fs/xattr.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/fs/xattr.c b/fs/xattr.c
index 90dd78f0eb27..a81d9690f136 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -119,15 +119,17 @@ xattr_permission(struct inode *inode, const char *name, int mask)
}
/*
- * In the user.* namespace, only regular files and directories can have
- * extended attributes. For sticky directories, only the owner and
- * privileged users can write attributes.
+ * In the user.* namespace, only regular files, symbolic links, and
+ * directories can have extended attributes. For symbolic links and
+ * sticky directories, only the owner and privileged users can write
+ * attributes.
*/
if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
- if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
+ if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode) && !S_ISLNK(inode->i_mode))
return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
- if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
- (mask & MAY_WRITE) && !inode_owner_or_capable(inode))
+ if (((S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX))
+ || S_ISLNK(inode->i_mode)) && (mask & MAY_WRITE)
+ && !inode_owner_or_capable(inode))
return -EPERM;
}
--
https://clearlinux.org

82
sys-kernel/hardened-kernel/files/linux-5.4/9120_0120-add-scheduler-turbo3-patch.patch
View File

@ -1,82 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Wed, 21 Nov 2018 21:21:44 +0000
Subject: [PATCH] add scheduler turbo3 patch
Small scheduler tweak to make the scheduler more turbo3 aware
---
arch/x86/kernel/itmt.c | 14 ++++++++++++++
kernel/sched/fair.c | 19 +++++++++++++++++++
2 files changed, 33 insertions(+)
diff --git a/arch/x86/kernel/itmt.c b/arch/x86/kernel/itmt.c
index 1cb3ca9bba49..eeb201bb014b 100644
--- a/arch/x86/kernel/itmt.c
+++ b/arch/x86/kernel/itmt.c
@@ -173,6 +173,11 @@ int arch_asym_cpu_priority(int cpu)
return per_cpu(sched_core_priority, cpu);
}
+extern int best_core;
+extern int second_best_core;
+static int best_core_score;
+static int second_best_core_score;
+
/**
* sched_set_itmt_core_prio() - Set CPU priority based on ITMT
* @prio: Priority of cpu core
@@ -202,5 +207,14 @@ void sched_set_itmt_core_prio(int prio, int core_cpu)
smt_prio = prio * smp_num_siblings / i;
per_cpu(sched_core_priority, cpu) = smt_prio;
i++;
+
+ if (smt_prio > best_core_score) {
+ best_core = cpu;
+ best_core_score = smt_prio;
+ } else
+ if (smt_prio > second_best_core_score) {
+ second_best_core = cpu;
+ second_best_core_score = smt_prio;
+ }
}
}
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 69a81a5709ff..e1961b94270d 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6439,6 +6439,10 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu)
*
* preempt must be disabled.
*/
+
+int best_core = -1;
+int second_best_core = -1;
+
static int
select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_flags)
{
@@ -6462,6 +6466,21 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f
cpumask_test_cpu(cpu, p->cpus_ptr);
}
+ if (prev_cpu != best_core && prev_cpu != second_best_core &&
+ cpu_rq(prev_cpu)->nr_running != 0) {
+ if (second_best_core != -1 && cpu_rq(second_best_core)->nr_running == 0 &&
+ nr_iowait_cpu(second_best_core) < 2 && cpu_to_node(prev_cpu) == cpu_to_node(second_best_core))
+ prev_cpu = second_best_core;
+ if (best_core != -1 && cpu_rq(best_core)->nr_running == 0 &&
+ nr_iowait_cpu(best_core) < 2 && cpu_to_node(prev_cpu) == cpu_to_node(best_core))
+ prev_cpu = best_core;
+ }
+/*
+ if (prev_cpu > 0 && cpu_rq(prev_cpu)->nr_running != 0 && cpu_rq(prev_cpu - 1)->nr_running == 0)
+ prev_cpu = prev_cpu - 1;
+*/
+
+
rcu_read_lock();
for_each_domain(cpu, tmp) {
if (!(tmp->flags & SD_LOAD_BALANCE))
--
https://clearlinux.org

25
sys-kernel/hardened-kernel/files/linux-5.4/9121_0121-use-lfence-instead-of-rep-and-nop.patch
View File

@ -1,25 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sat, 8 Dec 2018 18:21:32 +0000
Subject: [PATCH] use lfence instead of rep and nop
---
arch/x86/include/asm/processor.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 54f5d54280f6..ee60a1f2dd11 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -647,7 +647,7 @@ static inline unsigned int cpuid_edx(unsigned int op)
/* REP NOP (PAUSE) is a good thing to insert into busy-wait loops. */
static __always_inline void rep_nop(void)
{
- asm volatile("rep; nop" ::: "memory");
+ asm volatile("lfence" ::: "memory");
}
static __always_inline void cpu_relax(void)
--
https://clearlinux.org

89
sys-kernel/hardened-kernel/files/linux-5.4/9122_0122-do-accept-in-LIFO-order-for-cache-efficiency.patch
View File

@ -1,89 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Thu, 13 Dec 2018 01:00:49 +0000
Subject: [PATCH] do accept() in LIFO order for cache efficiency
---
include/linux/wait.h | 2 ++
kernel/sched/wait.c | 24 ++++++++++++++++++++++++
net/ipv4/inet_connection_sock.c | 2 +-
3 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/include/linux/wait.h b/include/linux/wait.h
index 3eb7cae8206c..340ca4b81b26 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -162,6 +162,7 @@ static inline bool wq_has_sleeper(struct wait_queue_head *wq_head)
extern void add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
extern void add_wait_queue_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
+extern void add_wait_queue_exclusive_lifo(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
extern void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
static inline void __add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
@@ -1122,6 +1123,7 @@ do { \
*/
void prepare_to_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
void prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
+void prepare_to_wait_exclusive_lifo(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
long prepare_to_wait_event(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state);
void finish_wait(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry);
long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long timeout);
diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
index c1e566a114ca..5f8fca88ab23 100644
--- a/kernel/sched/wait.c
+++ b/kernel/sched/wait.c
@@ -37,6 +37,17 @@ void add_wait_queue_exclusive(struct wait_queue_head *wq_head, struct wait_queue
}
EXPORT_SYMBOL(add_wait_queue_exclusive);
+void add_wait_queue_exclusive_lifo(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
+{
+ unsigned long flags;
+
+ wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
+ spin_lock_irqsave(&wq_head->lock, flags);
+ __add_wait_queue(wq_head, wq_entry);
+ spin_unlock_irqrestore(&wq_head->lock, flags);
+}
+EXPORT_SYMBOL(add_wait_queue_exclusive_lifo);
+
void remove_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry)
{
unsigned long flags;
@@ -246,6 +257,19 @@ prepare_to_wait_exclusive(struct wait_queue_head *wq_head, struct wait_queue_ent
}
EXPORT_SYMBOL(prepare_to_wait_exclusive);
+void prepare_to_wait_exclusive_lifo(struct wait_queue_head *wq_head, struct wait_queue_entry *wq_entry, int state)
+{
+ unsigned long flags;
+
+ wq_entry->flags |= WQ_FLAG_EXCLUSIVE;
+ spin_lock_irqsave(&wq_head->lock, flags);
+ if (list_empty(&wq_entry->entry))
+ __add_wait_queue(wq_head, wq_entry);
+ set_current_state(state);
+ spin_unlock_irqrestore(&wq_head->lock, flags);
+}
+EXPORT_SYMBOL(prepare_to_wait_exclusive_lifo);
+
void init_wait_entry(struct wait_queue_entry *wq_entry, int flags)
{
wq_entry->flags = flags;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index eb30fc1770de..71e8dc087870 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -407,7 +407,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
* having to remove and re-insert us on the wait queue.
*/
for (;;) {
- prepare_to_wait_exclusive(sk_sleep(sk), &wait,
+ prepare_to_wait_exclusive_lifo(sk_sleep(sk), &wait,
TASK_INTERRUPTIBLE);
release_sock(sk);
if (reqsk_queue_empty(&icsk->icsk_accept_queue))
--
https://clearlinux.org

35
sys-kernel/hardened-kernel/files/linux-5.4/9124_0124-locking-rwsem-spin-faster.patch
View File

@ -1,35 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sun, 18 Feb 2018 23:35:41 +0000
Subject: [PATCH] locking: rwsem: spin faster
tweak rwsem owner spinning a bit
---
kernel/locking/rwsem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index eef04551eae7..1ec5ab4c8ff7 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -720,6 +720,7 @@ rwsem_spin_on_owner(struct rw_semaphore *sem, unsigned long nonspinnable)
struct task_struct *new, *owner;
unsigned long flags, new_flags;
enum owner_state state;
+ int i = 0;
owner = rwsem_owner_flags(sem, &flags);
state = rwsem_owner_state(owner, flags, nonspinnable);
@@ -753,7 +754,8 @@ rwsem_spin_on_owner(struct rw_semaphore *sem, unsigned long nonspinnable)
break;
}
- cpu_relax();
+ if (i++ > 1000)
+ cpu_relax();
}
rcu_read_unlock();
--
https://clearlinux.org

42
sys-kernel/hardened-kernel/files/linux-5.4/9125_0125-ata-libahci-ignore-staggered-spin-up.patch
View File

@ -1,42 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Joe Konno <joe.konno@intel.com>
Date: Tue, 25 Jun 2019 10:35:54 -0700
Subject: [PATCH] ata: libahci: ignore staggered spin-up
Change libahci to ignore firmware's staggered spin-up flag. End-users
who wish to honor firmware's SSS flag can add the following kernel
parameter to a new file at /etc/kernel/cmdline.d/ignore_sss.conf:
libahci.ignore_sss=0
And then run
sudo clr-boot-manager update
Signed-off-by: Joe Konno <joe.konno@intel.com>
---
drivers/ata/libahci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index bff369d9a1a7..30d5784741d1 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -33,14 +33,14 @@
#include "libata.h"
static int ahci_skip_host_reset;
-int ahci_ignore_sss;
+int ahci_ignore_sss=1;
EXPORT_SYMBOL_GPL(ahci_ignore_sss);
module_param_named(skip_host_reset, ahci_skip_host_reset, int, 0444);
MODULE_PARM_DESC(skip_host_reset, "skip global host reset (0=don't skip, 1=skip)");
module_param_named(ignore_sss, ahci_ignore_sss, int, 0444);
-MODULE_PARM_DESC(ignore_sss, "Ignore staggered spinup flag (0=don't ignore, 1=ignore)");
+MODULE_PARM_DESC(ignore_sss, "Ignore staggered spinup flag (0=don't ignore, 1=ignore [default])");
static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
unsigned hints);
--
https://clearlinux.org

29
sys-kernel/hardened-kernel/files/linux-5.4/9126_0126-print-CPU-that-faults.patch
View File

@ -1,29 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Sat, 10 Aug 2019 03:19:04 +0000
Subject: [PATCH] print CPU that faults
print cpu number when we print a crash
---
arch/x86/mm/fault.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9ceacd1156db..5ffc44b5decb 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -842,9 +842,9 @@ show_signal_msg(struct pt_regs *regs, unsigned long error_code,
if (!printk_ratelimit())
return;
- printk("%s%s[%d]: segfault at %lx ip %px sp %px error %lx",
+ printk("%s%s[%d]: segfault at %lx ip %px sp %px error %lx cpu %i",
loglvl, tsk->comm, task_pid_nr(tsk), address,
- (void *)regs->ip, (void *)regs->sp, error_code);
+ (void *)regs->ip, (void *)regs->sp, error_code, raw_smp_processor_id());
print_vma_addr(KERN_CONT " in ", regs->ip);
--
https://clearlinux.org

143
sys-kernel/hardened-kernel/files/linux-5.4/9127_0127-x86-microcode-Force-update-a-uCode-even-if-the-rev-i.patch
View File

@ -1,143 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Ashok Raj <ashok.raj@intel.com>
Date: Sat, 20 Jul 2019 14:14:47 +0000
Subject: [PATCH] x86/microcode: Force update a uCode even if the rev is the
same
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
---
arch/x86/kernel/cpu/microcode/core.c | 1 +
arch/x86/kernel/cpu/microcode/intel.c | 57 +++++++++++++++++++++++++--
2 files changed, 55 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index cb0fdcaf1415..d44fe3e5c028 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -601,6 +601,7 @@ static int microcode_reload_late(void)
atomic_set(&late_cpus_in, 0);
atomic_set(&late_cpus_out, 0);
+ printk ("Going to do stop_machine\n");
ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask);
if (ret > 0)
microcode_check();
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index ce799cfe9434..9e85d785b226 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -30,6 +30,7 @@
#include <linux/uio.h>
#include <linux/mm.h>
+#include <asm/cmdline.h>
#include <asm/microcode_intel.h>
#include <asm/intel-family.h>
#include <asm/processor.h>
@@ -38,6 +39,7 @@
#include <asm/msr.h>
static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin";
+static bool force_ucode_load = false;
/* Current microcode patch used in early patching on the APs. */
static struct microcode_intel *intel_ucode_patch;
@@ -94,8 +96,18 @@ static int has_newer_microcode(void *mc, unsigned int csig, int cpf, int new_rev
{
struct microcode_header_intel *mc_hdr = mc;
- if (mc_hdr->rev <= new_rev)
+ //if (mc_hdr->rev <= new_rev)
+ if (mc_hdr->rev < new_rev) {
+ printk ("Returning NO_NEW old = 0x%x new = 0x%x\n",
+ mc_hdr->rev, new_rev);
return 0;
+ }
+ if ((mc_hdr->rev == new_rev) && !force_ucode_load) {
+ printk ("SAME REV: no_force Returning NO_NEW old = 0x%x new = 0x%x\n",
+ mc_hdr->rev, new_rev);
+ return 0;
+ }
+ printk ("ucode: force loading same rev\n");
return find_matching_signature(mc, csig, cpf);
}
@@ -593,11 +605,20 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early)
* already.
*/
rev = intel_get_microcode_revision();
- if (rev >= mc->hdr.rev) {
+ if (rev > mc->hdr.rev) {
uci->cpu_sig.rev = rev;
return UCODE_OK;
}
+ if (rev == mc->hdr.rev) {
+ if (!force_ucode_load) {
+ printk ("Matching ucode rev, no update\n");
+ return UCODE_OK;
+ } else {
+ printk ("Matching ucode rev.. force updating\n");
+ }
+ }
+
/*
* Writeback and invalidate caches before updating microcode to avoid
* internal issues depending on what the microcode is updating.
@@ -649,6 +670,29 @@ int __init save_microcode_in_initrd_intel(void)
return 0;
}
+static bool check_force_ucode_bsp(void)
+{
+ static const char *__force_ucode_str = "force_ucode_load";
+
+#ifdef CONFIG_X86_32
+ const char *cmdline = (const char *)__pa_nodebug(boot_command_line);
+ const char *option = (const char *)__pa_nodebug(__force_ucode_str);
+ bool *res = (bool *)__pa_nodebug(&force_ucode_load);
+
+#else /* CONFIG_X86_64 */
+ const char *cmdline = boot_command_line;
+ const char *option = __force_ucode_str;
+ bool *res = &force_ucode_load;
+#endif
+
+ if (cmdline_find_option_bool(cmdline, option)) {
+ printk("cmdline forcing ucode update for same rev\n");
+ *res = true;
+ }
+
+ return *res;
+}
+
/*
* @res_patch, output: a pointer to the patch we found.
*/
@@ -682,6 +726,9 @@ void __init load_ucode_intel_bsp(void)
{
struct microcode_intel *patch;
struct ucode_cpu_info uci;
+ bool force_bsp;
+
+ force_bsp = check_force_ucode_bsp();
patch = __load_ucode_intel(&uci);
if (!patch)
@@ -730,8 +777,12 @@ static struct microcode_intel *find_patch(struct ucode_cpu_info *uci)
phdr = (struct microcode_header_intel *)iter->data;
- if (phdr->rev <= uci->cpu_sig.rev)
+ if (phdr->rev < uci->cpu_sig.rev)
continue;
+ if (phdr->rev == uci->cpu_sig.rev && !force_ucode_load)
+ continue;
+ else
+ printk ("same rev forcing ucode\n");
if (!find_matching_signature(phdr,
uci->cpu_sig.sig,
--
https://clearlinux.org

69
sys-kernel/hardened-kernel/files/linux-5.4/9128_0128-x86-microcode-echo-2-reload-to-force-load-ucode.patch
View File

@ -1,69 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Ashok Raj <ashok.raj@intel.com>
Date: Sat, 20 Jul 2019 14:14:47 +0000
Subject: [PATCH] x86/microcode: echo 2 > reload to force load ucode.
If you want to force a ucode load even if the version
doesn't change try this
To just do a normal upgrade where new rev > current rev
Signed-off-by: Ashok Raj <ashok.raj@intel.com>
---
arch/x86/kernel/cpu/microcode/core.c | 8 +++++++-
arch/x86/kernel/cpu/microcode/intel.c | 2 +-
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index d44fe3e5c028..2b0e98ec22bc 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -615,18 +615,23 @@ static ssize_t reload_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t size)
{
+ extern bool force_ucode_load;
enum ucode_state tmp_ret = UCODE_OK;
int bsp = boot_cpu_data.cpu_index;
unsigned long val;
+ bool orig_cmd_line = force_ucode_load;
ssize_t ret = 0;
ret = kstrtoul(buf, 0, &val);
if (ret)
return ret;
- if (val != 1)
+ if (!val || val > 2)
return size;
+ if (val == 2)
+ force_ucode_load = true;
+
tmp_ret = microcode_ops->request_microcode_fw(bsp, &microcode_pdev->dev, true);
if (tmp_ret != UCODE_NEW)
return size;
@@ -642,6 +647,7 @@ static ssize_t reload_store(struct device *dev,
mutex_unlock(&microcode_mutex);
put:
+ force_ucode_load = orig_cmd_line;
put_online_cpus();
if (ret >= 0)
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 9e85d785b226..5c67ac023f4a 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -39,7 +39,7 @@
#include <asm/msr.h>
static const char ucode_path[] = "kernel/x86/microcode/GenuineIntel.bin";
-static bool force_ucode_load = false;
+bool force_ucode_load = false;
/* Current microcode patch used in early patching on the APs. */
static struct microcode_intel *intel_ucode_patch;
--
https://clearlinux.org

26
sys-kernel/hardened-kernel/files/linux-5.4/9129_0129-fix-bug-in-ucode-force-reload-revision-check.patch
View File

@ -1,26 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Jim Kukunas <james.t.kukunas@linux.intel.com>
Date: Sat, 2 Nov 2019 00:59:52 +0000
Subject: [PATCH] fix bug in ucode force reload revision check
If force_ucode_load==true, reload ucode even if revision # is identical.
---
arch/x86/kernel/cpu/microcode/intel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index 5c67ac023f4a..2ca566bedfc8 100644
--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -865,7 +865,7 @@ static enum ucode_state apply_microcode_intel(int cpu)
* already.
*/
rev = intel_get_microcode_revision();
- if (rev >= mc->hdr.rev) {
+ if (rev > mc->hdr.rev || (rev == mc->hdr.rev && !force_ucode_load)) {
ret = UCODE_OK;
goto out;
}
--
https://clearlinux.org

25
sys-kernel/hardened-kernel/files/linux-5.4/9131_0131-nvme-workaround.patch
View File

@ -1,25 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Arjan van de Ven <arjan@linux.intel.com>
Date: Mon, 11 Nov 2019 23:12:11 +0000
Subject: [PATCH] nvme workaround
---
drivers/nvme/host/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index fa7ba09dca77..758553763243 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -48,7 +48,7 @@ static u8 nvme_max_retries = 5;
module_param_named(max_retries, nvme_max_retries, byte, 0644);
MODULE_PARM_DESC(max_retries, "max number of retries a command may have");
-static unsigned long default_ps_max_latency_us = 100000;
+static unsigned long default_ps_max_latency_us = 200;
module_param(default_ps_max_latency_us, ulong, 0644);
MODULE_PARM_DESC(default_ps_max_latency_us,
"max power saving latency for new devices; use PM QOS to change per device");
--
https://clearlinux.org

7
sys-kernel/hardened-kernel/hardened-kernel-5.4.48.ebuild → sys-kernel/hardened-kernel/hardened-kernel-5.10.45.ebuild
View File

@ -6,13 +6,14 @@ EAPI=7
inherit kernel-build
MY_P=linux-${PV%.*}
GENPATCHES_P=genpatches-${PV%.*}-${PV##*.}
HARDENED_PATCH_VER="${PV}.a"
GENPATCHES_P=genpatches-${PV%.*}-$((${PV##*.}+4))
HARDENED_PATCH_VER="${PV}-hardened1"
GENPATCHES_EXCLUDE="1500_XATTR_USER_PREFIX.patch
1510_fs-enable-link-security-restrictions-by-default.patch
2900_dev-root-proc-mount-fix.patch
4200_fbcondecor.patch
4400_alpha-sysctl-uac.patch"
4400_alpha-sysctl-uac.patch
4567_distro-Gentoo-Kconfig.patch"
DESCRIPTION="Linux kernel built with Gentoo patches"