4.13.9-100.fc25.gnu

5 files changed, 195 insertions, 8 deletions

diff --git a/freed-ora/current/f25/kernel.spec b/freed-ora/current/f25/kernel.spec
index c662efa54..60619805a 100644
--- a/freed-ora/current/f25/kernel.spec
+++ b/freed-ora/current/f25/kernel.spec
@@ -92,7 +92,7 @@ Summary: The Linux kernel
 %if 0%{?released_kernel}
 
 # Do we have a -stable update to apply?
-%define stable_update 8
+%define stable_update 9
 # Set rpm version accordingly
 %if 0%{?stable_update}
 %define stablerev %{stable_update}
@@ -2403,11 +2403,18 @@ fi
 #
 #
 %changelog
+* Mon Oct 23 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
+- GNU Linux-libre 4.13.9-gnu.
+
+* Mon Oct 23 2017 Laura Abbott <labbott@redhat.com> - 4.13.9-100
+- Linux v4.13.9
+
 * Thu Oct 19 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.13.8-gnu.
 
 * Wed Oct 18 2017 Laura Abbott <labbott@fedoraproject.org> - 4.13.8-100
 - Linux v4.13.8
+- Fix CVE-2017-12190 (rhbz 1495089 1503580)
 
 * Mon Oct 16 2017 Alexandre Oliva <lxoliva@fsfla.org> -libre
 - GNU Linux-libre 4.13.7-gnu.
diff --git a/freed-ora/current/f25/patch-4.13-gnu-4.13.8-gnu.xz.sign b/freed-ora/current/f25/patch-4.13-gnu-4.13.8-gnu.xz.sign
deleted file mode 100644
index c5cdf94b6..000000000
--- a/freed-ora/current/f25/patch-4.13-gnu-4.13.8-gnu.xz.sign
+++ /dev/null
@@ -1,6 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWehEFgAKCRC8t8+Hfn1H
-pwvKAJ9q7ffTA7TnZhcO1leVa3J13SX3vgCeLYq8ra5cECgtLfr40NGUB+vSstE=
-=RMOJ
------END PGP SIGNATURE-----
diff --git a/freed-ora/current/f25/patch-4.13-gnu-4.13.9-gnu.xz.sign b/freed-ora/current/f25/patch-4.13-gnu-4.13.9-gnu.xz.sign
new file mode 100644
index 000000000..46c4ab5eb
--- /dev/null
+++ b/freed-ora/current/f25/patch-4.13-gnu-4.13.9-gnu.xz.sign
@@ -0,0 +1,6 @@
+-----BEGIN PGP SIGNATURE-----
+
+iF0EABECAB0WIQRHRALIxYLa++OJxCe8t8+Hfn1HpwUCWexPJgAKCRC8t8+Hfn1H
+pyAoAJ9EfKYF72itOQ9HdjOvy1kOEf6jNQCgoupq13ksKZVfCRCHw92d1BuTPS4=
+=Kemg
+-----END PGP SIGNATURE-----
diff --git a/freed-ora/current/f25/qxl-fixes.patch b/freed-ora/current/f25/qxl-fixes.patch
index 0b39c6f01..558204ac5 100644
--- a/freed-ora/current/f25/qxl-fixes.patch
+++ b/freed-ora/current/f25/qxl-fixes.patch
@@ -124,3 +124,183 @@ index 7babdd8f..afc2272 100644
 -- 
 cgit v0.12
 
+From 7a39a01887acc66d9b318d5e5898cf00d323eb8f Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Wed, 18 Oct 2017 13:18:40 +0200
+Subject: qxl: alloc & use shadow for dumb buffers
+
+This patch changes the way the primary surface is used for dumb
+framebuffers.  Instead of configuring the bo itself as primary surface
+a shadow bo is created and used instead.  Framebuffers can share the
+shadow bo in case they have the same format and resolution.
+
+On atomic plane updates we don't have to update the primary surface in
+case we pageflip from one framebuffer to another framebuffer which
+shares the same shadow.  This in turn avoids the flicker caused by the
+primary-destroy + primary-create cycle, which is very annonying when
+running wayland on qxl.
+
+The qxl driver never actually writes to the shadow bo.  It sends qxl
+blit commands which update it though, and the spice server might
+actually execute them (and thereby write to the shadow) in case the
+local rendering is kicked for some reason.  This happens for example in
+case qemu is asked to write out a dump of the guest display (screendump
+monitor command).
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+---
+ drivers/gpu/drm/qxl/qxl_cmd.c     |  6 ++++-
+ drivers/gpu/drm/qxl/qxl_display.c | 49 ++++++++++++++++++++++++++++++++++++---
+ drivers/gpu/drm/qxl/qxl_drv.h     |  2 ++
+ drivers/gpu/drm/qxl/qxl_dumb.c    |  1 +
+ 4 files changed, 54 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
+index 74fc936..3eb9208 100644
+--- a/drivers/gpu/drm/qxl/qxl_cmd.c
++++ b/drivers/gpu/drm/qxl/qxl_cmd.c
+@@ -388,7 +388,11 @@ void qxl_io_create_primary(struct qxl_device *qdev,
+ 	create->width = bo->surf.width;
+ 	create->height = bo->surf.height;
+ 	create->stride = bo->surf.stride;
+-	create->mem = qxl_bo_physical_address(qdev, bo, offset);
++	if (bo->shadow) {
++		create->mem = qxl_bo_physical_address(qdev, bo->shadow, offset);
++	} else {
++		create->mem = qxl_bo_physical_address(qdev, bo, offset);
++	}
+
+ 	QXL_INFO(qdev, "%s: mem = %llx, from %p\n", __func__, create->mem,
+ 		 bo->kptr);
+diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
+index afc2272..da6648e 100644
+--- a/drivers/gpu/drm/qxl/qxl_display.c
++++ b/drivers/gpu/drm/qxl/qxl_display.c
+@@ -305,7 +305,9 @@ static const struct drm_crtc_funcs qxl_crtc_funcs = {
+ void qxl_user_framebuffer_destroy(struct drm_framebuffer *fb)
+ {
+ 	struct qxl_framebuffer *qxl_fb = to_qxl_framebuffer(fb);
++	struct qxl_bo *bo = gem_to_qxl_bo(qxl_fb->obj);
+
++	WARN_ON(bo->shadow);
+ 	drm_gem_object_unreference_unlocked(qxl_fb->obj);
+ 	drm_framebuffer_cleanup(fb);
+ 	kfree(qxl_fb);
+@@ -511,6 +513,7 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
+ 	    .x2 = qfb->base.width,
+ 	    .y2 = qfb->base.height
+ 	};
++	bool same_shadow = false;
+
+ 	if (old_state->fb) {
+ 		qfb_old = to_qxl_framebuffer(old_state->fb);
+@@ -522,15 +525,23 @@ static void qxl_primary_atomic_update(struct drm_plane *plane,
+ 	if (bo == bo_old)
+ 		return;
+
++	if (bo_old && bo_old->shadow && bo->shadow &&
++	    bo_old->shadow == bo->shadow) {
++		same_shadow = true;
++	}
++
+ 	if (bo_old && bo_old->is_primary) {
+-		qxl_io_destroy_primary(qdev);
++		if (!same_shadow)
++			qxl_io_destroy_primary(qdev);
+ 		bo_old->is_primary = false;
+ 	}
+
+ 	if (!bo->is_primary) {
+-		qxl_io_create_primary(qdev, 0, bo);
++		if (!same_shadow)
++			qxl_io_create_primary(qdev, 0, bo);
+ 		bo->is_primary = true;
+ 	}
++
+ 	qxl_draw_dirty_fb(qdev, qfb, bo, 0, 0, &norect, 1, 1);
+ }
+
+@@ -682,8 +693,9 @@ void qxl_cursor_atomic_disable(struct drm_plane *plane,
+ int qxl_plane_prepare_fb(struct drm_plane *plane,
+ 			 struct drm_plane_state *new_state)
+ {
++	struct qxl_device *qdev = plane->dev->dev_private;
+ 	struct drm_gem_object *obj;
+-	struct qxl_bo *user_bo;
++	struct qxl_bo *user_bo, *old_bo = NULL;
+ 	int ret;
+
+ 	if (!new_state->fb)
+@@ -692,6 +704,32 @@ int qxl_plane_prepare_fb(struct drm_plane *plane,
+ 	obj = to_qxl_framebuffer(new_state->fb)->obj;
+ 	user_bo = gem_to_qxl_bo(obj);
+
++	if (plane->type == DRM_PLANE_TYPE_PRIMARY &&
++	    user_bo->is_dumb && !user_bo->shadow) {
++		if (plane->state->fb) {
++			obj = to_qxl_framebuffer(plane->state->fb)->obj;
++			old_bo = gem_to_qxl_bo(obj);
++		}
++		if (old_bo && old_bo->shadow &&
++		    user_bo->gem_base.size == old_bo->gem_base.size &&
++		    plane->state->crtc     == new_state->crtc &&
++		    plane->state->crtc_w   == new_state->crtc_w &&
++		    plane->state->crtc_h   == new_state->crtc_h &&
++		    plane->state->src_x    == new_state->src_x &&
++		    plane->state->src_y    == new_state->src_y &&
++		    plane->state->src_w    == new_state->src_w &&
++		    plane->state->src_h    == new_state->src_h &&
++		    plane->state->rotation == new_state->rotation &&
++		    plane->state->zpos     == new_state->zpos) {
++			drm_gem_object_get(&old_bo->shadow->gem_base);
++			user_bo->shadow = old_bo->shadow;
++		} else {
++			qxl_bo_create(qdev, user_bo->gem_base.size,
++				      true, true, QXL_GEM_DOMAIN_VRAM, NULL,
++				      &user_bo->shadow);
++		}
++	}
++
+ 	ret = qxl_bo_pin(user_bo, QXL_GEM_DOMAIN_CPU, NULL);
+ 	if (ret)
+ 		return ret;
+@@ -716,6 +754,11 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane,
+ 	obj = to_qxl_framebuffer(old_state->fb)->obj;
+ 	user_bo = gem_to_qxl_bo(obj);
+ 	qxl_bo_unpin(user_bo);
++
++	if (user_bo->shadow && !user_bo->is_primary) {
++		drm_gem_object_put_unlocked(&user_bo->shadow->gem_base);
++		user_bo->shadow = NULL;
++	}
+ }
+
+ static const uint32_t qxl_cursor_plane_formats[] = {
+diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h
+index 3591d23..b5e9dc6 100644
+--- a/drivers/gpu/drm/qxl/qxl_drv.h
++++ b/drivers/gpu/drm/qxl/qxl_drv.h
+@@ -112,6 +112,8 @@ struct qxl_bo {
+ 	/* Constant after initialization */
+ 	struct drm_gem_object		gem_base;
+ 	bool is_primary; /* is this now a primary surface */
++	bool is_dumb;
++	struct qxl_bo *shadow;
+ 	bool hw_surf_alloc;
+ 	struct qxl_surface surf;
+ 	uint32_t surface_id;
+diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c
+index 5e65d5d..11085ab 100644
+--- a/drivers/gpu/drm/qxl/qxl_dumb.c
++++ b/drivers/gpu/drm/qxl/qxl_dumb.c
+@@ -63,6 +63,7 @@ int qxl_mode_dumb_create(struct drm_file *file_priv,
+ 					      &handle);
+ 	if (r)
+ 		return r;
++	qobj->is_dumb = true;
+ 	args->pitch = pitch;
+ 	args->handle = handle;
+ 	return 0;
+-- 
+2.13.5
+
diff --git a/freed-ora/current/f25/sources b/freed-ora/current/f25/sources
index fb04de808..e84590428 100644
--- a/freed-ora/current/f25/sources
+++ b/freed-ora/current/f25/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-libre-4.13-gnu.tar.xz) = 9ad6866c68f29f7e4f8b53d0b857f9b3c7f6abd0054460675c76f3100db34a77c2777d7f4191831008b532cb2ab6f686d8c4f457a4d005226c73f90937963518
 SHA512 (perf-man-4.13.tar.gz) = 9bcc2cd8e56ec583ed2d8e0b0c88e7a94035a1915e40b3177bb02d6c0f10ddd4df9b097b1f5af59efc624226b613e240ddba8ddc2156f3682f992d5455fc5c03
-SHA512 (patch-4.13-gnu-4.13.8-gnu.xz) = d86cf42fce2e82180517a1cefd84ae37484c78d0852086af341e12c2b19d5068075a38375a9c55cfe7c6c1ef169ae01b94d6bd856602efbf089d59ff1d356082
+SHA512 (patch-4.13-gnu-4.13.9-gnu.xz) = 12221d0eb85f30eace8fac389c27d3455df11475c466b600c466a2cb843435a406cf663547cb7a0aa8340ac4bd178ba4e694136e5172c1c396bd033ab840ac4e