sys-kernel/coreos-*: bump to 4.17.3

Several nftables options are no longer available as modules.
This commit is contained in:
Benjamin Gilbert 2018-06-29 18:09:25 -07:00
parent 415adb13ef
commit cb38792143
15 changed files with 162 additions and 191 deletions

View File

@ -175,8 +175,8 @@ CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_CT_NETLINK_TIMEOUT=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=m
CONFIG_NF_TABLES_NETDEV=m
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_EXTHDR=m
CONFIG_NFT_META=m
CONFIG_NFT_RT=m
@ -203,17 +203,17 @@ CONFIG_NFT_FWD_NETDEV=m
CONFIG_NFT_FIB_NETDEV=m
CONFIG_NF_CONNTRACK_IPV4=m
CONFIG_NF_SOCKET_IPV4=m
CONFIG_NF_TABLES_IPV4=m
CONFIG_NF_TABLES_IPV4=y
CONFIG_NFT_CHAIN_ROUTE_IPV4=m
CONFIG_NFT_DUP_IPV4=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NF_TABLES_ARP=m
CONFIG_NF_TABLES_ARP=y
CONFIG_NF_LOG_ARP=m
CONFIG_NFT_CHAIN_NAT_IPV4=m
CONFIG_NFT_MASQ_IPV4=m
CONFIG_NFT_REDIR_IPV4=m
CONFIG_NF_SOCKET_IPV6=m
CONFIG_NF_TABLES_IPV6=m
CONFIG_NF_TABLES_IPV6=y
CONFIG_NFT_CHAIN_ROUTE_IPV6=m
CONFIG_NFT_DUP_IPV6=m
CONFIG_NFT_FIB_IPV6=m
@ -361,7 +361,7 @@ CONFIG_IP6_NF_SECURITY=m
CONFIG_IP6_NF_NAT=m
CONFIG_IP6_NF_TARGET_MASQUERADE=m
CONFIG_IP6_NF_TARGET_NPT=m
CONFIG_NF_TABLES_BRIDGE=m
CONFIG_NF_TABLES_BRIDGE=y
CONFIG_NFT_BRIDGE_META=m
CONFIG_NFT_BRIDGE_REJECT=m
CONFIG_NF_LOG_BRIDGE=m

View File

@ -1,4 +1,4 @@
DIST linux-4.14.tar.xz 100770500 SHA256 f81d59477e90a130857ce18dc02f4fbe5725854911db1e7ba770c7cd350f96a7 SHA512 77e43a02d766c3d73b7e25c4aafb2e931d6b16e870510c22cef0cdb05c3acb7952b8908ebad12b10ef982c6efbe286364b1544586e715cf38390e483927904d8 WHIRLPOOL fee10d54ecb210156aa55364ecc15867127819e9f7ff9ec5f6ef159b1013e2ae3d3a28d35c62d663886cbe826b996a1387671766093be002536309045a8e4d10
DIST linux-4.16.tar.xz 103020152 SHA256 63f6dc8e3c9f3a0273d5d6f4dca38a2413ca3a5f689329d05b750e4c87bb21b9 SHA512 ab47849314b177d0eec9dbf261f33972b0d89fb92fb0650130ffa7abc2f36c0fab2d06317dc1683c51a472a9a631573a9b1e7258d6281a2ee189897827f14662 WHIRLPOOL e03466f20fbac5b54c963845449d88589cb01fcc47837adbcf7ed1fb7b74422251df3a9a83f3a74d79f086a0f2eaa3cdf3654869717c72c3fb3a195f3f721942
DIST linux-4.17.tar.xz 102165892 SHA256 9faa1dd896eaea961dc6e886697c0b3301277102e5bc976b2758f9a62d3ccd13 SHA512 4d9de340a26155a89ea8773131c76220cc2057f2b5d031b467b60e8b14c1842518e2d60a863d8c695f0f7640f3f18d43826201984a238dade857b6cef79837db WHIRLPOOL 60573a6837a5daae91ea8d36f7aea0439a398d47810524df378b37df20ebb6fa83d518380348ec66cfe8f94b2405de59f884d52ac879cb4ff78f6674ad322077
DIST patch-4.14.52.xz 1373656 SHA256 02afce8ee5d78452589ad7bb23c7d7c94d18f9c346594088b36d67e0b0f62275 SHA512 720b310700337d7c8b77b78592aae6c8d9bd08cb4da0437110ddcdf4e9e8146367293a2f2d94325787b5f201a09847badb50657082426212b610f6993eefc536 WHIRLPOOL adb86e001c2ef778a2de096184729086723ef2c5d0792824c70f7fcc63a10cc63f3bb62b34c49bce817d274ba677223d5bcae6ba8d70f25de413a6ec793ffa95
DIST patch-4.16.18.xz 506924 SHA256 848fdff6385eddb5b3eac6e394d5d5427c8735dc93a123ee62da611d04eb1637 SHA512 9e1cf90b874c757393680026cb74500ca9fa22c0047ac820f4e5f43062125f8cf469f1e8e93a084b9ecc28a177e55c8b733c2fe620e46694a338f1b2ff4180f8 WHIRLPOOL 882fe047675845f8ca70d23e8018a3032d5d6c7dbd9b93e38c97b3e5a7a019ed6d0dcfd91e1a59c87836981c1a7db439d044afc0ff4cb356ec35aa5bfc4b62b3
DIST patch-4.17.3.xz 47420 SHA256 01d5cc024dcfed615f84fd83be9c248261d8fc2c062520d38397cead6857b596 SHA512 c0b3dfb1c1d64edc74cb3b35a4d6160ccf80b5b58d19e5a11dde372ab515c350576f8981b3816e4e8689da38b792eb85b3ef46581d65d7c51c72943dea7409f4 WHIRLPOOL 3f35cad858d1905c1d620cdce7acfd3158539d66594877717089f67f95014568bd9655ff2cf6862b00843070d95f55a89c930e082bcd3975d46699cb398eaa98

View File

@ -8,7 +8,7 @@ ETYPE="sources"
# Final releases should be versioned L.M.N, even for N == 0
# Only needed for RCs
K_BASE_VER="4.16"
K_BASE_VER="4.17"
inherit kernel-2
detect_version
@ -38,8 +38,7 @@ UNIPATCH_LIST="
${PATCH_DIR}/z0001-kbuild-derive-relative-path-for-KBUILD_SRC-from-CURD.patch \
${PATCH_DIR}/z0002-Add-arm64-coreos-verity-hash.patch \
${PATCH_DIR}/z0003-tools-objtool-Makefile-Don-t-fail-on-fallthrough-wit.patch \
${PATCH_DIR}/z0004-Revert-random-use-a-different-mixing-algorithm-for-a.patch \
${PATCH_DIR}/z0005-Revert-random-fix-crng_ready-test.patch \
${PATCH_DIR}/z0006-xen-netfront-Fix-mismatched-rtnl_unlock.patch \
${PATCH_DIR}/z0007-xen-netfront-Update-features-after-registering-netde.patch \
${PATCH_DIR}/z0004-xen-netfront-Fix-mismatched-rtnl_unlock.patch \
${PATCH_DIR}/z0005-xen-netfront-Update-features-after-registering-netde.patch \
${PATCH_DIR}/z0006-Revert-x86-boot-compressed-64-Handle-5-level-paging-.patch \
"

View File

@ -1,96 +0,0 @@
From ae9b00302f008eb5af826e2b8c88fa78c76f6b4f Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jeremy@jcline.org>
Date: Wed, 2 May 2018 15:16:29 -0400
Subject: [PATCH 4/7] Revert "random: use a different mixing algorithm for
add_device_randomness()"
This reverts commit 89b59f050347d376c2ace8b1ceb908a218cfdc2e.
Signed-off-by: Jeremy Cline <jeremy@jcline.org>
---
drivers/char/random.c | 55 ++++-----------------------------------------------
1 file changed, 4 insertions(+), 51 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 8f4e11842c60..aa5b04af86c6 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -831,10 +831,6 @@ static void numa_crng_init(void)
static void numa_crng_init(void) {}
#endif
-/*
- * crng_fast_load() can be called by code in the interrupt service
- * path. So we can't afford to dilly-dally.
- */
static int crng_fast_load(const char *cp, size_t len)
{
unsigned long flags;
@@ -861,51 +857,6 @@ static int crng_fast_load(const char *cp, size_t len)
return 1;
}
-/*
- * crng_slow_load() is called by add_device_randomness, which has two
- * attributes. (1) We can't trust the buffer passed to it is
- * guaranteed to be unpredictable (so it might not have any entropy at
- * all), and (2) it doesn't have the performance constraints of
- * crng_fast_load().
- *
- * So we do something more comprehensive which is guaranteed to touch
- * all of the primary_crng's state, and which uses a LFSR with a
- * period of 255 as part of the mixing algorithm. Finally, we do
- * *not* advance crng_init_cnt since buffer we may get may be something
- * like a fixed DMI table (for example), which might very well be
- * unique to the machine, but is otherwise unvarying.
- */
-static int crng_slow_load(const char *cp, size_t len)
-{
- unsigned long flags;
- static unsigned char lfsr = 1;
- unsigned char tmp;
- unsigned i, max = CHACHA20_KEY_SIZE;
- const char * src_buf = cp;
- char * dest_buf = (char *) &primary_crng.state[4];
-
- if (!spin_trylock_irqsave(&primary_crng.lock, flags))
- return 0;
- if (crng_init != 0) {
- spin_unlock_irqrestore(&primary_crng.lock, flags);
- return 0;
- }
- if (len > max)
- max = len;
-
- for (i = 0; i < max ; i++) {
- tmp = lfsr;
- lfsr >>= 1;
- if (tmp & 1)
- lfsr ^= 0xE1;
- tmp = dest_buf[i % CHACHA20_KEY_SIZE];
- dest_buf[i % CHACHA20_KEY_SIZE] ^= src_buf[i % len] ^ lfsr;
- lfsr += (tmp << 3) | (tmp >> 5);
- }
- spin_unlock_irqrestore(&primary_crng.lock, flags);
- return 1;
-}
-
static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
{
unsigned long flags;
@@ -1089,8 +1040,10 @@ void add_device_randomness(const void *buf, unsigned int size)
unsigned long time = random_get_entropy() ^ jiffies;
unsigned long flags;
- if (!crng_ready() && size)
- crng_slow_load(buf, size);
+ if (!crng_ready()) {
+ crng_fast_load(buf, size);
+ return;
+ }
trace_add_device_randomness(size, _RET_IP_);
spin_lock_irqsave(&input_pool.lock, flags);
--
2.14.4

View File

@ -1,64 +0,0 @@
From 7e3362c1c8774baa81c8df962b7593c2ad20f9d1 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jeremy@jcline.org>
Date: Wed, 2 May 2018 15:18:03 -0400
Subject: [PATCH 5/7] Revert "random: fix crng_ready() test"
This reverts commit cd8d7a5778a4abf76ee8fe8f1bfcf78976029f8d.
Signed-off-by: Jeremy Cline <jeremy@jcline.org>
---
drivers/char/random.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/char/random.c b/drivers/char/random.c
index aa5b04af86c6..ef05cc685b74 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -428,7 +428,7 @@ struct crng_state primary_crng = {
* its value (from 0->1->2).
*/
static int crng_init = 0;
-#define crng_ready() (likely(crng_init > 1))
+#define crng_ready() (likely(crng_init > 0))
static int crng_init_cnt = 0;
static unsigned long crng_global_init_time = 0;
#define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE)
@@ -838,7 +838,7 @@ static int crng_fast_load(const char *cp, size_t len)
if (!spin_trylock_irqsave(&primary_crng.lock, flags))
return 0;
- if (crng_init != 0) {
+ if (crng_ready()) {
spin_unlock_irqrestore(&primary_crng.lock, flags);
return 0;
}
@@ -913,7 +913,7 @@ static void _extract_crng(struct crng_state *crng,
{
unsigned long v, flags;
- if (crng_ready() &&
+ if (crng_init > 1 &&
(time_after(crng_global_init_time, crng->init_time) ||
time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL)))
crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL);
@@ -1200,7 +1200,7 @@ void add_interrupt_randomness(int irq, int irq_flags)
fast_mix(fast_pool);
add_interrupt_bench(cycles);
- if (unlikely(crng_init == 0)) {
+ if (!crng_ready()) {
if ((fast_pool->count >= 64) &&
crng_fast_load((char *) fast_pool->pool,
sizeof(fast_pool->pool))) {
@@ -2269,7 +2269,7 @@ void add_hwgenerator_randomness(const char *buffer, size_t count,
{
struct entropy_store *poolp = &input_pool;
- if (unlikely(crng_init == 0)) {
+ if (!crng_ready()) {
crng_fast_load(buffer, count);
return;
}
--
2.14.4

View File

@ -1,7 +1,7 @@
From fd931fb1cab3f1c8e360b2ef8bbbefdc77d8dd20 Mon Sep 17 00:00:00 2001
From e83d7983c35e86f1c4a44748c4a5e7fd1bb16c69 Mon Sep 17 00:00:00 2001
From: Vito Caputo <vito.caputo@coreos.com>
Date: Wed, 25 Nov 2015 02:59:45 -0800
Subject: [PATCH 1/7] kbuild: derive relative path for KBUILD_SRC from CURDIR
Subject: [PATCH 1/6] kbuild: derive relative path for KBUILD_SRC from CURDIR
This enables relocating source and build trees to different roots,
provided they stay reachable relative to one another. Useful for
@ -12,7 +12,7 @@ by some undesirable path component.
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/Makefile b/Makefile
index 8a34b54f2a06..df11a9ce66b2 100644
index 31dc3a08295a..fdb91172fa9b 100644
--- a/Makefile
+++ b/Makefile
@@ -143,7 +143,8 @@ $(filter-out _all sub-make $(CURDIR)/Makefile, $(MAKECMDGOALS)) _all: sub-make
@ -26,5 +26,5 @@ index 8a34b54f2a06..df11a9ce66b2 100644
# Leave processing to above invocation of make
--
2.14.4
2.17.1

View File

@ -1,7 +1,7 @@
From e5f594c832b4914806f55b64c73e239a6d37d42f Mon Sep 17 00:00:00 2001
From b417f8704384d32d6c0d5790f209f09d7323560f Mon Sep 17 00:00:00 2001
From: Geoff Levand <geoff@infradead.org>
Date: Fri, 11 Nov 2016 17:28:52 -0800
Subject: [PATCH 2/7] Add arm64 coreos verity hash
Subject: [PATCH 2/6] Add arm64 coreos verity hash
Signed-off-by: Geoff Levand <geoff@infradead.org>
---
@ -25,5 +25,5 @@ index 613fc3000677..fdaf86c78332 100644
/*
* The debug table is referenced via its Relative Virtual Address (RVA),
--
2.14.4
2.17.1

View File

@ -1,7 +1,7 @@
From 4ce8ac41943274054f9e2d90fb55a99df85bf88e Mon Sep 17 00:00:00 2001
From 8d858ab31cb9f1fd77a636e911284992421ef225 Mon Sep 17 00:00:00 2001
From: David Michael <david.michael@coreos.com>
Date: Thu, 8 Feb 2018 21:23:12 -0500
Subject: [PATCH 3/7] tools/objtool/Makefile: Don't fail on fallthrough with
Subject: [PATCH 3/6] tools/objtool/Makefile: Don't fail on fallthrough with
new GCCs
---
@ -23,5 +23,5 @@ index 95563b8e1ad7..307652c42a7b 100644
CFLAGS += -I$(srctree)/tools/include/
--
2.14.4
2.17.1

View File

@ -1,7 +1,7 @@
From 2b985fa24f0f6cfa25eb63c9f79fa1dee17e1a34 Mon Sep 17 00:00:00 2001
From cd4d6483723ea3185f97a6896b006b2582baaad5 Mon Sep 17 00:00:00 2001
From: Ross Lagerwall <ross.lagerwall@citrix.com>
Date: Thu, 21 Jun 2018 14:00:20 +0100
Subject: [PATCH 6/7] xen-netfront: Fix mismatched rtnl_unlock
Subject: [PATCH 4/6] xen-netfront: Fix mismatched rtnl_unlock
Fixes: f599c64fdf7d ("xen-netfront: Fix race between device setup and open")
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
@ -13,7 +13,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 3127bc8633ca..5f4951a48c9a 100644
index 4dd0668003e7..244095bfd604 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1810,7 +1810,7 @@ static int talk_to_netback(struct xenbus_device *dev,
@ -34,5 +34,5 @@ index 3127bc8633ca..5f4951a48c9a 100644
return err;
}
--
2.14.4
2.17.1

View File

@ -1,7 +1,7 @@
From 77a0d69a6d7b82a4724c966428a0652929a2565c Mon Sep 17 00:00:00 2001
From 64dca404996f00e7df2b829e471c687286e8e847 Mon Sep 17 00:00:00 2001
From: Ross Lagerwall <ross.lagerwall@citrix.com>
Date: Thu, 21 Jun 2018 14:00:21 +0100
Subject: [PATCH 7/7] xen-netfront: Update features after registering netdev
Subject: [PATCH 5/6] xen-netfront: Update features after registering netdev
Update the features after calling register_netdev() otherwise the
device features are not set up correctly and it not possible to change
@ -19,7 +19,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 5f4951a48c9a..ad2e9cb36903 100644
index 244095bfd604..1d5082d30187 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1951,10 +1951,6 @@ static int xennet_connect(struct net_device *dev)
@ -45,5 +45,5 @@ index 5f4951a48c9a..ad2e9cb36903 100644
* All public and private state should now be sane. Get
* ready to start sending and receiving packets and give the driver
--
2.14.4
2.17.1

View File

@ -0,0 +1,132 @@
From 8a18baaaff11b8758d738e4325fbe77476191446 Mon Sep 17 00:00:00 2001
From: Benjamin Gilbert <bgilbert@redhat.com>
Date: Sun, 1 Jul 2018 12:13:35 -0700
Subject: [PATCH 6/6] Revert "x86/boot/compressed/64: Handle 5-level paging
boot if kernel is above 4G"
This reverts commit 194a9749c73d650c0b1dfdee04fb0bdf0a888ba8, which causes
instantaneous and silent boot failures.
---
arch/x86/boot/compressed/head_64.S | 69 +++++++-----------------------
1 file changed, 16 insertions(+), 53 deletions(-)
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index 8169e8b7a4dc..7588e65a9c4a 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -326,27 +326,11 @@ ENTRY(startup_64)
/*
* At this point we are in long mode with 4-level paging enabled,
- * but we might want to enable 5-level paging or vice versa.
+ * but we want to enable 5-level paging.
*
- * The problem is that we cannot do it directly. Setting or clearing
- * CR4.LA57 in long mode would trigger #GP. So we need to switch off
- * long mode and paging first.
- *
- * We also need a trampoline in lower memory to switch over from
- * 4- to 5-level paging for cases when the bootloader puts the kernel
- * above 4G, but didn't enable 5-level paging for us.
- *
- * The same trampoline can be used to switch from 5- to 4-level paging
- * mode, like when starting 4-level paging kernel via kexec() when
- * original kernel worked in 5-level paging mode.
- *
- * For the trampoline, we need the top page table to reside in lower
- * memory as we don't have a way to load 64-bit values into CR3 in
- * 32-bit mode.
- *
- * We go though the trampoline even if we don't have to: if we're
- * already in a desired paging mode. This way the trampoline code gets
- * tested on every boot.
+ * The problem is that we cannot do it directly. Setting LA57 in
+ * long mode would trigger #GP. So we need to switch off long mode
+ * first.
*/
/* Make sure we have GDT with 32-bit code segment */
@@ -371,18 +355,13 @@ ENTRY(startup_64)
/* Save the trampoline address in RCX */
movq %rax, %rcx
- /*
- * Load the address of trampoline_return() into RDI.
- * It will be used by the trampoline to return to the main code.
- */
- leaq trampoline_return(%rip), %rdi
/* Switch to compatibility mode (CS.L = 0 CS.D = 1) via far return */
pushq $__KERNEL32_CS
- leaq TRAMPOLINE_32BIT_CODE_OFFSET(%rax), %rax
+ leaq compatible_mode(%rip), %rax
pushq %rax
lretq
-trampoline_return:
+lvl5:
/* Restore the stack, the 32-bit trampoline uses its own stack */
leaq boot_stack_end(%rbx), %rsp
@@ -559,14 +538,8 @@ adjust_got:
ret
.code32
-/*
- * This is the 32-bit trampoline that will be copied over to low memory.
- *
- * RDI contains the return address (might be above 4G).
- * ECX contains the base address of the trampoline memory.
- * Non zero RDX on return means we need to enable 5-level paging.
- */
ENTRY(trampoline_32bit_src)
+compatible_mode:
/* Set up data and stack segments */
movl $__KERNEL_DS, %eax
movl %eax, %ds
@@ -607,34 +580,24 @@ ENTRY(trampoline_32bit_src)
1:
movl %eax, %cr4
- /* Calculate address of paging_enabled() once we are executing in the trampoline */
- leal paging_enabled - trampoline_32bit_src + TRAMPOLINE_32BIT_CODE_OFFSET(%ecx), %eax
+ /* Calculate address we are running at */
+ call 1f
+1: popl %edi
+ subl $1b, %edi
- /* Prepare the stack for far return to Long Mode */
+ /* Prepare stack for far return to Long Mode */
pushl $__KERNEL_CS
- pushl %eax
+ leal lvl5(%edi), %eax
+ push %eax
- /* Enable paging again */
+ /* Enable paging back */
movl $(X86_CR0_PG | X86_CR0_PE), %eax
movl %eax, %cr0
lret
- .code64
-paging_enabled:
- /* Return from the trampoline */
- jmp *%rdi
-
- /*
- * The trampoline code has a size limit.
- * Make sure we fail to compile if the trampoline code grows
- * beyond TRAMPOLINE_32BIT_CODE_SIZE bytes.
- */
- .org trampoline_32bit_src + TRAMPOLINE_32BIT_CODE_SIZE
-
- .code32
no_longmode:
- /* This isn't an x86-64 CPU, so hang intentionally, we cannot continue */
+ /* This isn't an x86-64 CPU so hang */
1:
hlt
jmp 1b
--
2.17.1