krd/linux
1
0
Fork 0
Code Activity

refresh Debian patches

Browse Source
This commit is contained in:
Konstantin Demin
2024-10-29 05:12:06 +03:00
parent 8863ede258
commit 8082dfeaca
54 changed files with 114 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
debian/patches/features/all/db-mok-keyring/0003-MODSIGN-checking-the-blacklisted-hash-before-loading-a-kernel-module.patch vendored
View File

@@ -39,7 +39,7 @@ Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
#include <uapi/linux/module.h>
#include "internal.h"
@@ -37,13 +39,60 @@
@@ -37,13 +39,60 @@ void set_module_sig_enforced(void)
sig_enforce = true;
}
@@ -101,7 +101,7 @@ Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
int ret;
pr_devel("==>%s(,%zu)\n", __func__, modlen);
@@ -51,6 +100,7 @@
@@ -51,6 +100,7 @@ int mod_verify_sig(const void *mod, stru
if (modlen <= sizeof(ms))
return -EBADMSG;
@@ -109,7 +109,7 @@ Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
memcpy(&ms, mod + (modlen - sizeof(ms)), sizeof(ms));
ret = mod_check_sig(&ms, modlen, "module");
@@ -61,10 +111,17 @@
@@ -61,10 +111,17 @@ int mod_verify_sig(const void *mod, stru
modlen -= sig_len + sizeof(ms);
info->len = modlen;

2
debian/patches/features/all/db-mok-keyring/trust-machine-keyring-by-default.patch vendored
View File

@@ -11,8 +11,6 @@ To keep backward compatibility skip this check.
security/integrity/platform_certs/machine_keyring.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/security/integrity/platform_certs/machine_keyring.c b/security/integrity/platform_certs/machine_keyring.c
index a401640a63cd..0627f14eacbe 100644
--- a/security/integrity/platform_certs/machine_keyring.c
+++ b/security/integrity/platform_certs/machine_keyring.c
@@ -68,10 +68,7 @@ static bool __init trust_moklist(void)

14
debian/patches/features/all/drivers-media-dvb-usb-af9005-request_firmware.patch vendored
View File

@@ -11,11 +11,9 @@ a version of the script which is directly derived from the driver.
drivers/media/dvb/dvb-usb/af9005-fe.c | 66 ++++++++++++++++++++++++++------
2 files changed, 54 insertions(+), 14 deletions(-)
Index: debian-kernel/drivers/media/usb/dvb-usb/Kconfig
===================================================================
--- debian-kernel.orig/drivers/media/usb/dvb-usb/Kconfig
+++ debian-kernel/drivers/media/usb/dvb-usb/Kconfig
@@ -260,10 +260,10 @@ config DVB_USB_OPERA1
--- a/drivers/media/usb/dvb-usb/Kconfig
+++ b/drivers/media/usb/dvb-usb/Kconfig
@@ -35,10 +35,10 @@ config DVB_USB_A800
config DVB_USB_AF9005
tristate "Afatech AF9005 DVB-T USB1.1 support"
@@ -27,10 +25,8 @@ Index: debian-kernel/drivers/media/usb/dvb-usb/Kconfig
help
Say Y here to support the Afatech AF9005 based DVB-T USB1.1 receiver
and the TerraTec Cinergy T USB XE (Rev.1)
Index: debian-kernel/drivers/media/usb/dvb-usb/af9005-fe.c
===================================================================
--- debian-kernel.orig/drivers/media/usb/dvb-usb/af9005-fe.c
+++ debian-kernel/drivers/media/usb/dvb-usb/af9005-fe.c
--- a/drivers/media/usb/dvb-usb/af9005-fe.c
+++ b/drivers/media/usb/dvb-usb/af9005-fe.c
@@ -9,10 +9,26 @@
* see Documentation/driver-api/media/drivers/dvb-usb.rst for more information
*/

18
debian/patches/features/all/lockdown/arm64-add-kernel-config-option-to-lock-down-when.patch vendored
View File

@@ -40,7 +40,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
--- a/drivers/firmware/efi/efi-init.c
+++ b/drivers/firmware/efi/efi-init.c
@@ -210,9 +210,10 @@ void __init efi_init(void)
@@ -213,9 +213,10 @@ void __init efi_init(void)
{
struct efi_memory_map_data data;
u64 efi_system_table;
@@ -52,7 +52,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
if (!efi_system_table)
return;
@@ -234,6 +235,8 @@ void __init efi_init(void)
@@ -237,6 +238,8 @@ void __init efi_init(void)
return;
}
@@ -79,7 +79,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
};
static __initconst const struct {
@@ -41,6 +43,7 @@ static __initconst const struct {
@@ -43,6 +45,7 @@ static __initconst const struct {
[MMSIZE] = "xen,uefi-mmap-size",
[DCSIZE] = "xen,uefi-mmap-desc-size",
[DCVERS] = "xen,uefi-mmap-desc-ver",
@@ -87,7 +87,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
}
}, {
#endif
@@ -51,6 +54,7 @@ static __initconst const struct {
@@ -53,6 +56,7 @@ static __initconst const struct {
[MMSIZE] = "linux,uefi-mmap-size",
[DCSIZE] = "linux,uefi-mmap-desc-size",
[DCVERS] = "linux,uefi-mmap-desc-ver",
@@ -95,7 +95,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
}
}
};
@@ -62,6 +66,11 @@ static int __init efi_get_fdt_prop(const
@@ -64,6 +68,11 @@ static int __init efi_get_fdt_prop(const
int len;
u64 val;
@@ -107,7 +107,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
prop = fdt_getprop(fdt, node, pname, &len);
if (!prop)
return 1;
@@ -79,7 +88,7 @@ static int __init efi_get_fdt_prop(const
@@ -81,7 +90,7 @@ static int __init efi_get_fdt_prop(const
return 0;
}
@@ -116,7 +116,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
{
const void *fdt = initial_boot_params;
unsigned long systab;
@@ -93,6 +102,7 @@ u64 __init efi_get_fdt_params(struct efi
@@ -95,6 +104,7 @@ u64 __init efi_get_fdt_params(struct efi
[MMSIZE] = { &mm->size, sizeof(mm->size) },
[DCSIZE] = { &mm->desc_size, sizeof(mm->desc_size) },
[DCVERS] = { &mm->desc_version, sizeof(mm->desc_version) },
@@ -126,7 +126,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
BUILD_BUG_ON(ARRAY_SIZE(target) != ARRAY_SIZE(name));
--- a/drivers/firmware/efi/libstub/fdt.c
+++ b/drivers/firmware/efi/libstub/fdt.c
@@ -148,6 +148,12 @@ static efi_status_t update_fdt(void *ori
@@ -132,6 +132,12 @@ static efi_status_t update_fdt(void *ori
}
}
@@ -141,7 +141,7 @@ arm-init to efi-init common for all arch") renamed arm-init.c to efi-init.c]
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -662,7 +662,8 @@ extern void efi_mem_reserve(phys_addr_t
@@ -766,7 +766,8 @@ extern void efi_mem_reserve(phys_addr_t
extern int efi_mem_reserve_persistent(phys_addr_t addr, u64 size);
extern void efi_initialize_iomem_resources(struct resource *code_resource,
struct resource *data_resource, struct resource *bss_resource);

12
debian/patches/features/all/lockdown/efi-add-an-efi_secure_boot-flag-to-indicate-secure-b.patch vendored
View File

@@ -31,7 +31,7 @@ cc: linux-efi@vger.kernel.org
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1193,19 +1193,7 @@ void __init setup_arch(char **cmdline_p)
@@ -1065,19 +1065,7 @@ void __init setup_arch(char **cmdline_p)
/* Allocate bigger log buffer */
setup_log_buf(1);
@@ -54,7 +54,7 @@ cc: linux-efi@vger.kernel.org
--- a/drivers/firmware/efi/Makefile
+++ b/drivers/firmware/efi/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_EFI_FAKE_MEMMAP) += fake_m
@@ -25,6 +25,7 @@ subdir-$(CONFIG_EFI_STUB) += libstub
obj-$(CONFIG_EFI_BOOTLOADER_CONTROL) += efibc.o
obj-$(CONFIG_EFI_TEST) += test/
obj-$(CONFIG_EFI_DEV_PATH_PARSER) += dev-path-parser.o
@@ -106,7 +106,7 @@ cc: linux-efi@vger.kernel.org
+}
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -871,6 +871,14 @@ extern int __init efi_setup_pcdp_console
@@ -877,6 +877,14 @@ static inline int efi_range_is_wc(unsign
#define EFI_MEM_ATTR 10 /* Did firmware publish an EFI_MEMORY_ATTRIBUTES table? */
#define EFI_MEM_NO_SOFT_RESERVE 11 /* Is the kernel configured to ignore soft reservations? */
#define EFI_PRESERVE_BS_REGIONS 12 /* Are EFI boot-services memory segments available? */
@@ -121,7 +121,7 @@ cc: linux-efi@vger.kernel.org
#ifdef CONFIG_EFI
/*
@@ -895,6 +903,7 @@ static inline bool efi_rt_services_suppo
@@ -901,6 +909,7 @@ static inline bool efi_rt_services_suppo
return (efi.runtime_supported_mask & mask) == mask;
}
extern void efi_find_mirror(void);
@@ -129,7 +129,7 @@ cc: linux-efi@vger.kernel.org
#else
static inline bool efi_enabled(int feature)
{
@@ -914,6 +923,7 @@ static inline bool efi_rt_services_suppo
@@ -920,6 +929,7 @@ static inline bool efi_rt_services_suppo
}
static inline void efi_find_mirror(void) {}
@@ -137,7 +137,7 @@ cc: linux-efi@vger.kernel.org
#endif
extern int efi_status_to_err(efi_status_t status);
@@ -1133,13 +1143,6 @@ static inline bool efi_runtime_disabled(
@@ -1138,13 +1148,6 @@ static inline bool efi_runtime_disabled(
extern void efi_call_virt_check_flags(unsigned long flags, const void *caller);
extern unsigned long efi_call_virt_save_flags(void);

8
debian/patches/features/all/lockdown/efi-lock-down-the-kernel-if-booted-in-secure-boot-mo.patch vendored
View File

@@ -26,7 +26,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -900,6 +900,8 @@ void __init setup_arch(char **cmdline_p)
@@ -904,6 +904,8 @@ void __init setup_arch(char **cmdline_p)
if (efi_enabled(EFI_BOOT))
efi_init();
@@ -35,7 +35,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
reserve_ibft_region();
x86_init.resources.dmi_setup();
@@ -1061,8 +1063,6 @@ void __init setup_arch(char **cmdline_p)
@@ -1065,8 +1067,6 @@ void __init setup_arch(char **cmdline_p)
/* Allocate bigger log buffer */
setup_log_buf(1);
@@ -67,7 +67,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
default:
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -509,6 +509,7 @@ int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
@@ -509,6 +509,7 @@ int security_inode_getsecctx(struct inod
int security_locked_down(enum lockdown_reason what);
int lsm_fill_user_ctx(struct lsm_ctx __user *uctx, u32 *uctx_len,
void *val, size_t val_len, u64 id, u64 flags);
@@ -75,7 +75,7 @@ Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
#else /* CONFIG_SECURITY */
static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)
@@ -1483,6 +1484,11 @@ static inline int lsm_fill_user_ctx(struct lsm_ctx __user *uctx,
@@ -1483,6 +1484,11 @@ static inline int lsm_fill_user_ctx(stru
{
return -EOPNOTSUPP;
}

4
debian/patches/features/x86/intel-iommu-add-kconfig-option-to-exclude-igpu-by-default.patch vendored
View File

@@ -48,7 +48,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
def_bool y
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -218,13 +218,13 @@ static LIST_HEAD(dmar_satc_units);
@@ -214,13 +214,13 @@ static LIST_HEAD(dmar_satc_units);
static void intel_iommu_domain_free(struct iommu_domain *domain);
@@ -64,7 +64,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
static int intel_iommu_superpage = 1;
static int iommu_identity_mapping;
static int iommu_skip_te_disable;
@@ -263,6 +263,7 @@ static int __init intel_iommu_setup(char
@@ -259,6 +259,7 @@ static int __init intel_iommu_setup(char
while (*str) {
if (!strncmp(str, "on", 2)) {
dmar_disabled = 0;

12
debian/patches/features/x86/intel-iommu-add-option-to-exclude-integrated-gpu-only.patch vendored
View File

@@ -22,7 +22,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -2174,6 +2174,8 @@
@@ -2201,6 +2201,8 @@
bypassed by not enabling DMAR with this option. In
this case, gfx device will use physical address for
DMA.
@@ -33,7 +33,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
sp_off [Default Off]
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -35,6 +35,9 @@
@@ -36,6 +36,9 @@
#define CONTEXT_SIZE VTD_PAGE_SIZE
#define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
@@ -43,7 +43,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
#define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
#define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
#define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
@@ -221,12 +224,14 @@ int intel_iommu_sm = IS_ENABLED(CONFIG_I
@@ -217,12 +220,14 @@ int intel_iommu_sm = IS_ENABLED(CONFIG_I
int intel_iommu_enabled = 0;
EXPORT_SYMBOL_GPL(intel_iommu_enabled);
@@ -58,7 +58,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
const struct iommu_ops intel_iommu_ops;
static const struct iommu_dirty_ops intel_dirty_ops;
@@ -266,6 +271,9 @@ static int __init intel_iommu_setup(char
@@ -262,6 +267,9 @@ static int __init intel_iommu_setup(char
} else if (!strncmp(str, "igfx_off", 8)) {
disable_igfx_iommu = 1;
pr_info("Disable GFX device mapping\n");
@@ -68,7 +68,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
} else if (!strncmp(str, "forcedac", 8)) {
pr_warn("intel_iommu=forcedac deprecated; use iommu.forcedac instead\n");
iommu_dma_forcedac = true;
@@ -2401,6 +2409,9 @@ static int device_def_domain_type(struct
@@ -2156,6 +2164,9 @@ static int device_def_domain_type(struct
if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
return IOMMU_DOMAIN_IDENTITY;
@@ -78,7 +78,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
}
return 0;
@@ -2701,6 +2712,9 @@ static int __init init_dmars(void)
@@ -2456,6 +2467,9 @@ static int __init init_dmars(void)
iommu_set_root_entry(iommu);
}

8
debian/patches/features/x86/x86-make-x32-syscall-support-conditional.patch vendored
View File

@@ -29,7 +29,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -6498,6 +6498,10 @@
@@ -6578,6 +6578,10 @@
later by a loaded module cannot be set this way.
Example: sysctl.vm.swappiness=40
@@ -42,7 +42,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Ignore sysrq setting - this boot parameter will
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -3058,6 +3058,14 @@ config COMPAT_32
@@ -3065,6 +3065,14 @@ config COMPAT_32
select HAVE_UID16
select OLD_SIGSUSPEND3
@@ -80,7 +80,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
#include <linux/syscalls.h>
#include <asm/syscall.h>
@@ -20,3 +23,46 @@
@@ -23,3 +26,46 @@ long x32_sys_call(const struct pt_regs *
default: return __x64_sys_ni_syscall(regs);
}
};
@@ -159,7 +159,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
#include <asm/thread_info.h> /* for TS_COMPAT */
#include <asm/unistd.h>
@@ -28,6 +29,18 @@ extern const sys_call_ptr_t ia32_sys_cal
@@ -28,6 +29,18 @@ extern long ia32_sys_call(const struct p
extern long x32_sys_call(const struct pt_regs *, unsigned int nr);
extern long x64_sys_call(const struct pt_regs *, unsigned int nr);

2
debian/patches/features/x86/x86-memtest-WARN-if-bad-RAM-found.patch vendored
View File

@@ -15,7 +15,7 @@ Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
--- a/mm/memtest.c
+++ b/mm/memtest.c
@@ -26,6 +26,10 @@ static u64 patterns[] __initdata = {
@@ -31,6 +31,10 @@ static u64 patterns[] __initdata = {
static void __init reserve_bad_mem(u64 pattern, phys_addr_t start_bad, phys_addr_t end_bad)
{