# changelog

author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-18.el6uek]
changelog:
  - sparc: tsb must be flushed before tlb (Dave Kleikamp) [Orabug: 17724439]  
  - config: update config for sparc (Allen Pais) [Orabug: 17715697]  
  - dm mpath: disable WRITE SAME if it fails (Mike Snitzer) [Orabug: 17617256]  
  - Btrfs: dir_inode_operations should use btrfs_update_time also (Guangyu Sun) [Orabug: 17437471]  
  - xfs: fix sgid inheritance for subdirectories inheriting default acls [V3] (Carlos Maiolino) [Orabug: 17354234]  
  - crypto: xor - Check for osxsave as well as avx in crypto/xor (John Haxby) [Orabug: 17066724]  
  - fs: protect write with sb_start/end_write in generic_file_write_iter (Guangyu Sun) [Orabug: 17487738]  
  - bonding: If IP route look-up to send an ARP fails, mark in bonding structure as no ARP sent. (Rama Nichanamatlu) [Orabug: 17557056]  
  - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17617582] {CVE-2013-4299} 
  - Audit: do not print error when LSMs disabled (Eric Paris) [Orabug: 17537769]  
  - oracleasm: Compat changes for 3.5 (Dwight Engen)   
  - megaraid_sas: addded support for big endian architecture (Martin K. Petersen)   
  - ext4: introduce reserved space (Lukas Czerner)


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-17.el6uek]
changelog:
  - dtrace: Use tasklet_hrtimer_*() instead of hrtimer_*() for cyclics (Kris Van Hees) [Orabug: 17553446]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-16.el6uek]
changelog:
  - oracleasm: Add support for new error return codes from block/SCSI (Martin K. Petersen) [Orabug: 17484923]  
  - RDS: protocol negotiation fails during reconnect (Bang Nguyen) [Orabug: 17484877]  
  - ocfs2/dlm: ocfs2 dlm umount skip migrating lockres (Srinivas Eeda) [Orabug: 16859627]  
  - ocfs2/dlm: Fix list traversal in dlm_process_recovery_data (Srinivas Eeda) [Orabug: 17432400]  
  - ocfs2: fix error handling in ocfs2_ioctl_move_extents() (Srinivas Eeda) [Orabug: 16631951]  
  - ocfs2: btrfs: aio-dio-loop changes broke setrlimit behavior (Srinivas Eeda) [Orabug: 14207636]  
  - ocfs2: xattr: fix inlined xattr reflink (Junxiao Bi) [Orabug: 15914937]  
  - ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap() (Joseph Qi) [Orabug: 16963812]  
  - ocfs2: Don't log error message when removing non-empty directory (Xiaowei.Hu) [Orabug: 16790405]  
  - ocfs2: Suppress the error message from being printed in ocfs2_rename (Xiaowei.Hu) [Orabug: 16790405]  
  - ocfs2: ocfs2_prep_new_orphaned_file return ret (Xiaowei.Hu) [Orabug: 16823825]  
  - ocfs2: Fix NULL dereference for moving extents (Dan Carpenter) [Orabug: 16631951]  
  - ocfs2: This is a fix on dlm_clean_master_list() (Xiaowei.Hu) [Orabug: 12798517]  
  - ocfs2: submit disk heartbeat bio using WRITE_SYNC (Srinivas Eeda) [Orabug: 17342255]  
  - ocfs2: fix NULL pointer dereference in ocfs2_duplicate_clusters_by_page v2 (Xiaowei.Hu) [Orabug: 14752693]  
  - ocfs2: Fix oops in ocfs2_fast_symlink_readpage() code path (Xiaowei.Hu) [Orabug: 17342255]  
  - ocfs2: ->rl_count endianness breakage (Al Viro) [Orabug: 17342255]  
  - ocfs2: ->rl_used breakage on big-endian (Al Viro) [Orabug: 17342255]  
  - Revert "ocfs2: Push out dropping of dentry lock to ocfs2_wq" (Sunil Mushran) [Orabug: 17342255]  
  - Revert "ocfs2: Fix deadlock on umount" (Sunil Mushran) [Orabug: 17342255]  
  - Revert "ocfs2: Don't oops in ocfs2_kill_sb on a failed mount" (Sunil Mushran) [Orabug: 17342255]  
  - ocfs2/cluster: Fix o2net_fill_node_map() (Sunil Mushran) [Orabug: 17342255]  
  - ocfs2: Tighten free bit calculation in the global bitmap (Sunil Mushran) [Orabug: 17342255]  
  - ocfs2/trivial: Limit unaligned aio+dio write messages to once per day (Sunil Mushran) [Orabug: 17342255]  
  - ocfs2/trivial: Print message indicating unaligned aio+dio write (Sunil Mushran) [Orabug: 17342255]  
  - ocfs2: update ocfs2 version (Tiger Yang) [Orabug: 17342255]  
  - spec: only require libdtrace-ctf for kernel-uek-devel if with_dtrace is set (Jerry Snitselaar) [Orabug: 17477312]  
  - dtrace: fix for psinfo allocation during execve (Kris Van Hees) [Orabug: 17407069]  
  - kbuild/ctf: Use shell expansion, not $(wildcard ...), for CTF section copying. (Nick Alcock) [Orabug: 17445637]  
  - kbuild/ctf: always build vmlinux when building CTF. (Jamie Iles) [Orabug: 17397200]  
  - kbuild/dtrace: don't assume that bash is the shell. (Jamie Iles) [Orabug: 17397234]  
  - block: Rate-limit failed I/O error message (Dave Kleikamp) [Orabug: 17370630]  
  - block: Disable autoprotect (Martin K. Petersen) [Orabug: 17370630]  
  - cdc-acm: Increase number of devices to 64 (Joe Jin) [Orabug: 17370630]  
  - Parallel mtrr init between cpus (Zhenzhong Duan) [Orabug: 17370630]  
  - sg: push file descriptor list locking down to per-device locking (Vaughan Cao) [Orabug: 17370630]  
  - sg: checking sdp->detached isn't protected when open (Vaughan Cao) [Orabug: 17370630]  
  - sg: no need sg_open_exclusive_lock (Vaughan Cao) [Orabug: 17370630]  
  - sg: use rwsem to solve race during exclusive open (Vaughan Cao) [Orabug: 17370630]  
  - Support checksum and gso offload of ipv6 in netback (Annie Li) [Orabug: 17370630]  
  - net: init perm_addr in register_netdevice() (Jiri Pirko) [Orabug: 17370630]  
  - drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (Jonathan Salwan) [Orabug: 17370630] {CVE-2013-2164} 
  - af_key: fix info leaks in notify messages (Mathias Krause) [Orabug: 17370630] {CVE-2013-2234}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-15.el6uek]
changelog:
  - sparc64: strict_devmem configs (bob picco) [Orabug: 17442487]  
  - sparc64: retry domain service registration (chris hyser) [Orabug: 17375532]  
  - Btrfs: make the chunk allocator completely tree lockless (Josef Bacik) [Orabug: 17329252]  
  - config: Disable memory hotplug support for Xen balloon driver (Daniel Kiper) [Orabug: 17343739]  
  - Revert "SPEC: Do not sign modules, pro tem." (Jerry Snitselaar) [Orabug: 17410371]  
  - config: enable snd-tea575x-tuner driver (Jerry Snitselaar) [Orabug: 17346564]  
  - config: add missing wireless drivers to debug config (Jerry Snitselaar) [Orabug: 17346564]  
  - Btrfs: set/change the label of a mounted file system (jeff.liu) [Orabug: 16745716]  
  - Btrfs: Add a new ioctl to get the label of a mounted file system (jeff.liu) [Orabug: 16745716]  
  - sparc64: __init code no longer called during non __init (chris hyser)   
  - RDS: Port of UEK2 changes between 400.107.0 and 400.124.1 (Venkat Venkatsubra) [Orabug: 17320357]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-14.el6uek]
changelog:
  - dm: allow error target to replace either bio-based and request-based targets (Joe Jin) [Orabug: 17405032]  
  - dtrace: remove unnecessary exported symbol (Kris Van Hees) [Orabug: 17346878]  
  - dtrace: Ensure that USDT probes are carried over correctly across fork(). (Kris Van Hees) [Orabug: 17346878]  
  - dtrace: fix retrieval of arg5 through arg9 (Kris Van Hees) [Orabug: 17368166]  
  - dtrace: Ensure that task_struct members are initialized correctly (Kris Van Hees)   
  - Two efficiency fixes for audit mechanism (Dan Duval) [Orabug: 16765434]  
  - Three fixes to audit_log_start() mechanism (Dan Duval) [Orabug: 167654341]  
  - dtrace: ensure that builds in a separate objdir work (Kris Van Hees) [Orabug: 17369799]  
  - config: align config options with uek2 (Jerry Snitselaar) [Orabug: 17346564]  
  - dwarf2ctf: Ensure the CTF directory exists before writing the filelist. (Nick Alcock) [Orabug: 17363469]  
  - dwarf2ctf: avoid command-line length limits by passing .o filenames via a file. (Nick Alcock) [Orabug: 17363469]  
  - xen: initialize xen panic handler for PVHVM (Vaughan Cao) [Orabug: 17200031]  
  - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370760] {CVE-2013-2237} 
  - RDS: RDS NETFILTER SUPPORT (Ahmed Abbas) [Orabug: 17285666]  
  - mods: don't put regular modules under extra/ (Jerry Snitselaar) [Orabug: 17347419]  
  - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 16993114] {CVE-2013-2852}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-12.el6uek]
changelog:
  - config: update configs (Jerry Snitselaar) [Orabug: 17248299]  
  - fuse: return -EGAIN if not connected (Srinivas Eeda) [Orabug: 17337480]  
  - fuse: split fuse queues to help numa systems (Srinivas Eeda) [Orabug: 17336449]

  Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>  
  - fuse: add fuse numa node struct (Srinivas Eeda) [Orabug: 17336449]

  Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>  
  - fuse: add numa mount option (Srinivas Eeda) [Orabug: 17336449]

  Signed-off-by: Jerry Snitselaar <jerry.snitselaar@oracle.com>  
  - config: remove lm80 driver to avoid possible crash (Jerry Snitselaar) [Orabug: 17337318]  
  - kabi: update Module.kabi and kabi_whitelist for UEK3 (Jerry Snitselaar) [Orabug: 17335510]  
  - config: clean up config files (Jerry Snitselaar) [Orabug: 17335515]  
  - dtrace: DT_FASTTRAP should select UPROBE_EVENT (Jerry Snitselaar) [Orabug: 17325699]  
  - turn on panic on oops and align configs (Maxim Uvarov)   
  - acpi_i2c: set MODULE_LICENSE, MODULE_AUTHOR, and MODULE_DESCRIPTION (Jerry Snitselaar) [Orabug: 17321212]  
  - Revert "cpuidle: Quickly notice prediction failure for repeat mode" (ethan.zhao) [Orabug: 17315729]  
  - Revert "cpuidle: Quickly notice prediction failure in general case" (Rafael J. Wysocki) [Orabug: 17315729]  
  - mm/vmalloc.c: fix an overflow bug in alloc_vmap_area() (Zhang Yanfei) [Orabug: 17315488]  
  - ioat: Add alignment workaround for IVB platforms (Dave Jiang) [Orabug: 16495543]  
  - cpufreq: Fix governor start/stop race condition (ethan.zhao) [Orabug: 17071478]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-11.el6uek]
changelog:
  - sparc: sparc64_task_unmmaped_base and sparc64_task_size_max fix (Jerry Snitselaar)   
  - config: remove unneeded ib config options in sparc build (Jerry Snitselaar) [Orabug: 17315304]  
  - rds: fix build error for ib_recv.c (Jerry Snitselaar) [Orabug: 17315304]  
  - kabi: Fix up Module.kabi_x86_64 (Jerry Snitselaar) [Orabug: 17309389]  
  - Revert "dtrace: only do kallsyms build on x86_64" (Jerry Snitselaar) [Orabug: 17314140]  
  - dtrace: Fix formatting mistake in spec file. (Kris Van Hees) [Orabug: 17313687]  
  - dtrace: Fix for the argument validation code. (Kris Van Hees) [Orabug: 17313687]  
  - dtrace: Include asm/current.h for the mutex_owned() fucntion. (Kris Van Hees) [Orabug: 17313687]  
  - dtrace: Fix build requirements for the new kallsyms util; add requirements to -devel. (Kris Van Hees) [Orabug: 17313687]  
  - dtrace: Bug fix for logic to determine the (inode, offset) pair for uprobes. (Kris Van Hees)


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-10.el6uek]
changelog:
  - mptfusion: fix kernel-doc build errors (Jerry Snitselaar) [Orabug: 17308655]  
  - kabi: fix kabi check for builds (Jerry Snitselaar) [Orabug: 17308516]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-9.el6uek]
changelog:
  - dtrace: only do kallsyms build on x86_64 (Jerry Snitselaar) [Orabug: 17308256]  
  - kabi: Update Module.kabi_x86_64 (Jerry Snitselaar) [Orabug: 17302224]  
  - Update lpfc version for 8.3.7.26.2p driver release (Gairy Grannum)   
  - Enable BlockGuard Support (Vaios Papadimitriou)   
  - Removed obsolete fcp_eq_count and fcp_wq_count driver attributes (James Smart)   
  - Update copyrights for 8.3.41 modifications (James Smart)   
  - Removed obsolete fcp_eq_count and fcp_wq_count driver attributes (James Smart)   
  - Add first burst support to driver (James Smart)   
  - Fixed the format of some log message fields (James Smart)   
  - Add first burst support to driver (James Smart)   
  - Fixed not able to perform PCI function reset when board was not in online mode (James Smart)   
  - Fixed failure in setting SLI3 board mode (James Smart)   
  - Fixed SLI3 failing FCP write on check-condition no-sense with residual zero (James Smart)   
  - Fixed support for 128 byte WQEs (James Smart)   
  - Ensure driver properly zeros unused fields in SLI4 mailbox commands (James Smart)   
  - Fixed max value of lpfc_lun_queue_depth (James Smart)   
  - Fixed Receive Queue varied frame size handling (James Smart)   
  - Fix mailbox byteswap issue on PPC (James Smart)   
  - Fixed freeing of iocb when internal loopback times out (James Smart)   
  - lpfc 8.3.40: Update Copyrights to 2013 for 8.3.38, 8.3.39, and 8.3.40 modifications (James Smart)   
  - lpfc 8.3.40: Fixed a race condition between SLI host and port failed FCF rediscovery (James Smart)   
  - lpfc 8.3.40: Fixed issue mailbox wait routine failed to issue dump memory mbox command (James Smart)   
  - treewide: Fix typos in kernel messages (Masanari Iida)   
  - lpfc 8.3.40: Fixed system panic due to unsafe walking and deleting linked list (James Smart)   
  - lpfc 8.3.40: Fixed FCoE connection list vlan identifier and add FCF list debug (James Smart)   
  - lpfc 8.3.40: Clarified the behavior of the lpfc_max_luns module parameter (James Smart)   
  - lpfc 8.3.40: Fix to allow OCM to report FEC status (James Smart)   
  - lpfc 8.3.40: Fixed a missing return code in a logging message (James Smart)   
  - lpfc 8.3.40: Fixed some logging message fields (James Smart)   
  - lpfc 8.3.40: Fixed list corruption when lpfc_drain_tx runs (James Smart)   
  - lpfc 8.3.40: Fix starting reference tag when calculating BG error (James Smart)   
  - lpfc 8.3.40: Fix inconsistent list removal causes crash (James Smart)   
  - lpfc 8.3.40: Fixed system panic during handling unsolicited receive buffer error condition (James Smart)   
  - lpfc 8.3.40: Fix BlockGuard error checking (James Smart)   
  - lpfc 8.3.40: Fixed crash during FCoE failover testing. (James Smart)   
  - lpfc 8.3.40: Fix lpfc_used_cpu to be more dynamic (James Smart)   
  - lpfc 8.3.39: Fixed driver handling of CLEAR_LA with NPIV enabled causing SID=0 frames out (James Smart)   
  - scsi: fix lpfc build when wmb() is defined as mb() (Randy Dunlap)   
  - lpfc 8.3.39: Reduced tmo value set to FLOGI WQE for quick recovery from FLOGI sequence timeout (James Smart)   
  - lpfc 8.3.39: Add log message when completes with clean address bit set to zero (James Smart)   
  - lpfc 8.3.39: Fixed driver vector mapping to CPU affinity (James Smart)   
  - lpfc 8.3.39: Fixed driver vector mapping to CPU affinity (James Smart)   
  - lpfc 8.3.39: Fixed iocb flags not being reset for scsi commands (James Smart)   
  - lpfc 8.3.39: Fixed system panic during EEH recovery due to midlayer acting on outstanding I/O (James Smart)   
  - lpfc 8.3.39: Fixed system panic during EEH recovery due to midlayer acting on outstanding I/O (James Smart)   
  - lpfc 8.3.39: Fixed not returning FAILED status when SCSI invoking host reset handler failed (James Smart)   
  - lpfc 8.3.39: Fixed bad book keeping in posting els sgls to port (James Smart)   
  - lpfc 8.3.39: Fixed deadlock between hbalock and nlp_lock use (James Smart)   
  - [SCSI] lpfc 8.3.39: Fixed BlockGuard to take advantage of rdprotect/wrprotect info when available (James Smart)   
  - lpfc 8.3.39: Reduced spinlock contention on SCSI buffer list (James Smart)   
  - lpfc 8.3.39: Fixed crash when processing bsg's sg list with high memory pages (James Smart)   
  - lpfc 8.3.39: Remove lpfc_fcp_look_ahead module parameter (James Smart)   
  - lpfc 8.3.39: Fix driver issues with SCSI Host reset (James Smart)   
  - lpfc 8.3.39: Doorbell formation information logged in dual-chute mode WQ and RQ setup (James Smart)   
  - lpfc 8.3.39: Fix driver issues with large s/g lists for BlockGuard (James Smart)   
  - lpfc 8.3.39: Fix driver issues with large lpfc_sg_seg_cnt values (James Smart)   
  - lpfc 8.3.39: Fixed pt2pt and loop discovery problems on topology changes. (James Smart)   
  - lpfc 8.3.39: Remove driver dependency on HZ (James Smart)   
  - lpfc 8.3.38: Fixed async FCF modified event to in-use FCF failure to trigger recovery (James Smart)   
  - lpfc 8.3.39: Fixed BlockGuard error reporting (James Smart)   
  - lpfc 8.3.39: Fixed VPI allocation issues after firmware dump is performed (James Smart)   
  - lpfc 8.3.38: Fixed potential mis-interpretation of READ_TOPOLOGY reserved fields (James Smart)   
  - lpfc 8.3.38: Fix default value for lpfc_enable_rrq. (James Smart)   
  - lpfc 8.3.38: Fixed circular locking dependency and inconsistent lock state issues (James Smart)   
  - lpfc 8.3.38: Fixed PT2PT bring up problem for FC SLI4. (James Smart)   
  - lpfc 8.3.38: Fixed OXID reuse issue. (James Smart)   
  - lpfc 8.3.38: Fixed async FCF modified event to in-use FCF failure to trigger recovery (James Smart)   
  - lpfc 8.3.38: Fixed deadlock condition in FCF round robin handling (James Smart)   
  - scsilpfc 8.3.38: Fixed bsg timeout handling issues that would result in crashes (James Smart)   
  - lpfc 8.3.38: Fixed NMI watch dog panic's when resetting the hba. (James Smart)   
  - lpfc 8.3.38: Fixed degraded performance after cable pulls (James Smart)   
  - lpfc 8.3.37: Provide support for change_queue_type (James Smart)   
  - lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put() (Wei Yongjun)   
  - lpfc 8.3.37: Fixed infinite loop in lpfc_sli4_fcf_rr_next_index_get. (James Smart)   
  - lpfc 8.3.37: Fixed crash due to SLI Port invalid resource count (James Smart)   
  - lpfc 8.3.37: Provide support for FCoE protocol dual-chute (ULP) operation (James Smart)   
  - lpfc 8.3.37: Fixed stale ndlp state when the node is marked for deferred removal. (James Smart)   
  - lpfc 8.3.37: Fix potential memory corruption bug (James Smart)   
  - lpfc 8.3.37: Fixed no-context ABTS failed with BA_RJT (James Smart)   
  - lpfc 8.3.37: Removed use of NOP mailboxes for interrupt verification (James Smart)   
  - lpfc 8.3.37: Fixed exhausted retry for plogi to nameserver. (James Smart)   
  - lpfc 8.3.37: Fixed ELS_REC received on the unsolicited receive queue (James Smart)   
  - mptfusion: update to LSI version 4.28.20.03 (Jerry Snitselaar) [Orabug: 17307187]  
  - turn on kabi check for x86 (Maxim Uvarov)   
  - config: CONFIG_X86_INTERNODE_CACHE_SHIFT=7 (Maxim Uvarov)   
  - kabi_whitelist_x86_64 (Maxim Uvarov)   
  - Ensure memory allocation results are checked throughout the code. (Kris Van Hees)   
  - net: sctp: fix NULL pointer dereference in socket destruction (Daniel Borkmann) [Orabug: 17071059]  
  - mm: leave pmd_huge_pte when CONFIG_TRANSPARENT_HUGEPAGE disabled (Jerry Snitselaar) [Orabug: 17301856]  
  - sparc64 - read_persistent_clock (bob picco)   
  - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17296551] {CVE-2013-4162} 
  - ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size (Hannes Frederic Sowa) [Orabug: 17296420] {CVE-2013-4163} 
  - dm mpath: fix ioctl deadlock when no paths (Hannes Reinecke)   
  - dm mpath: enable WRITE SAME support (Mike Snitzer)   
  - dm table: fix write same support (Mike Snitzer)   
  - dm: rename request variables to bios (Alasdair G Kergon)   
  - dm: clean up clone_bio (Alasdair G Kergon)   
  - NVMe: Add MSI support (Ramachandra Rao Gajula)   
  - NVMe: Use dma_set_mask() correctly (Matthew Wilcox)   
  - Return the result from user admin command IOCTL even in case of failure (Chayan Biswas)   
  - NVMe: Do not cancel command multiple times (Keith Busch)   
  - NVMe: fix error return code in nvme_submit_bio_queue() (Wei Yongjun)   
  - NVMe: check for integer overflow in nvme_map_user_pages() (Dan Carpenter)   
  - NVMe: Fix a signedness bug in nvme_trans_modesel_get_mp (Vishal Verma)   
  - NVMe: Remove redundant version.h header include (Sachin Kamat)   
  - NVMe: Use user defined admin ioctl timeout (Keith Busch)   
  - NVMe: Simplify Firmware Activate code slightly (Matthew Wilcox)   
  - NVMe: Only clear the enable bit when disabling controller (Matthew Wilcox)   
  - NVMe: Wait for device to acknowledge shutdown (Matthew Wilcox)   
  - NVMe: Schedule timeout for sync commands (Keith Busch)   
  - NVMe: Meta-data support in NVME_IOCTL_SUBMIT_IO (Keith Busch)   
  - NVMe: Device specific stripe size handling (Keith Busch)   
  - NVMe: Split non-mergeable bio requests (Keith Busch)   
  - NVMe: Remove dead code in nvme_dev_add (Keith Busch)   
  - NVMe: Check for NULL memory in nvme_dev_add (Keith Busch)   
  - NVMe: Fix error clean-up on nvme_alloc_queue (Keith Busch)   
  - NVMe: Free admin queue on request_irq error (Keith Busch)   
  - NVMe: Add scsi unmap to SG_IO (Keith Busch)   
  - NVMe: queue usage fixes in nvme-scsi (Keith Busch)   
  - NVMe: Set TASK_INTERRUPTIBLE before processing queues (Arjan van de Ven)   
  - NVMe: Add a character device for each nvme device (Keith Busch)   
  - NVMe: Fix endian-related problems in user I/O submission path (Matthew Wilcox)   
  - NVMe: Fix I/O cancellation status on big-endian machines (Matthew Wilcox)   
  - NVMe: Fix sparse warnings in scsi emulation (Vishal Verma)   
  - NVMe: Don't fail initialisation unnecessarily (Matthew Wilcox)   
  - NVMe: Abstract out sector to block number conversion (Matthew Wilcox)   
  - NVMe: Use round_jiffies_relative() for the periodic, once-per-second timer (Arjan van de Ven)   
  - NVMe: Add nvme-scsi.c (Vishal Verma)   
  - NVMe: Add definitions for format command (Vishal Verma)   
  - NVMe: Move structures & definitions to header file (Vishal Verma)   
  - NVMe: Rename nvme.c to nvme-core.c (Vishal Verma)   
  - NVMe: Add discard support for capable devices (Keith Busch)   
  - NVMe: Add namespaces with no LBA range feature (Keith Busch)   
  - NVMe: Initialize iod nents to 0 (Keith Busch)   
  - NVMe: Define SMART log (Keith Busch)   
  - NVMe: Add result to nvme_get_features (Keith Busch)   
  - NVMe: Set result from user admin command (Keith Busch)   
  - NVMe: End queued bio requests when freeing queue (Keith Busch)   
  - NVMe: Free cmdid on nvme_submit_bio error (Keith Busch)   
  - oracleasm: Compat changes for 3.8 (Martin K. Petersen)   
  - oracleasm: Introduce module parameter for block size selection (Martin K. Petersen) [Orabug: 15924773]  
  - oracleasm: Data integrity support (Martin K. Petersen)   
  - oracleasm: Fix two merge errors (Martin K. Petersen)   
  - Oracle ASM Kernel Driver (Martin K. Petersen)   
  - megaraid_sas: Big endian support (Martin K. Petersen)   
  - megaraid: fix BUG_ON() from incorrect use of delayed work (Xiaotian Feng)   
  - aerdrv: Enhanced AER logging (Lance Ortiz) [Orabug: 17293976]  
  - aerdrv: Trace Event for PCI Express Advanced Error Reporting (Lance Ortiz) [Orabug: 17293976]  
  - [SCSI] scsi_dh_alua: Add module parameter to allow failover to non preferred path without STPG (Stewart, Sean)   
  - [SCSI] Don't attempt to send extended INQUIRY command if skip_vpd_pages is set (Martin K. Petersen)   
  - [SCSI] sd: Update WRITE SAME heuristics (Martin K. Petersen)   
  - [SCSI] 3w-xxxx: Create sense buffer for unsupported commands (Martin K. Petersen)   
  - [SCSI] Workaround for disks that report bad optimal transfer length (Martin K. Petersen)   
  - [SCSI] Allow error handling timeout to be specified (Martin K. Petersen)   
  - [SCSI] scsi_dh_alua: fix stpg sense handling (Mike Christie)   
  - [SCSI] sd_dif: problem with verify of type 1 protection information (PI) (Jeremy Higdon)   
  - [SCSI] sd: avoid deadlocks when running under multipath (Hannes Reinecke)   
  - x86/mce: Rework cmci_rediscover() to play well with CPU hotplug (Srivatsa S. Bhat) [Orabug: 17293976]  
  - ACPI / APEI: fix error return code in ghes_probe() (Wei Yongjun) [Orabug: 17293976]  
  - hwmon: (adm1021) Strengthen chip detection for ADM1021, LM84 and MAX1617 (Guenter Roeck) [Orabug: 17293976]  
  - fnic: update from mainline 1.5.0.2 to cisco 1.5.0.45 (Jerry Snitselaar) [Orabug: 17293525]  
  - cgroup: fix bogus kernel warnings when cgroup_create() failed (Li Zefan) [Orabug: 16448051]  
  - cgroup: remove a NULL check in cgroup_exit() (Li Zefan) [Orabug: 16448051]  
  - cgroup: fix cgroup_path() vs rename() race (Li Zefan) [Orabug: 16448051]  
  - cgroup: fix cgroup_rmdir() vs close(eventfd) race (Li Zefan) [Orabug: 16448051]  
  - cgroup: fail if monitored file and event_control are in different cgroup (Li Zefan) [Orabug: 16448051]  
  - cgroup: fix a subtle bug in descendant pre-order walk (Tejun Heo) [Orabug: 16448051]  
  - memcg: do not create memsw files if swap accounting is disabled (Michal Hocko) [Orabug: 16448051]  
  - memcg: initialize kmem-cache destroying work earlier (Konstantin Khlebnikov) [Orabug: 16448051]  
  - mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in uncharge (Johannes Weiner) [Orabug: 16448051]  
  - memcg: fix memcg_cache_name() to use cgroup_name() (Michal Hocko) [Orabug: 16448051]  
  - blkcg: fix "scheduling while atomic" in blk_queue_bypass_start (Jun'ichi Nomura) [Orabug: 16448051]  
  - device_cgroup: don't grab mutex in rcu callback (Jerry Snitselaar) [Orabug: 16448051]  
  - l2tp: prevent tunnel creation on netns mismatch (Tom Parkin) [Orabug: 16448051]  
  - netns: fdb: allow unprivileged users to add/del fdb entries (Gao feng) [Orabug: 16448051]  
  - netns: ebtable: allow unprivileged users to operate ebtables (Gao feng) [Orabug: 16448051]  
  - netns: bridge: allow unprivileged users add/delete mdb entry (Gao feng) [Orabug: 16448051]  
  - netns: bond: allow unprivileged users to control bond device (Gao feng) [Orabug: 16448051]  
  - netfilter: nf_ct_reasm: fix per-netns sysctl initialization (Michal Kubeček) [Orabug: 16448051]  
  - config: enable CONFIG_XFS_WARN for debug builds (Jerry Snitselaar) [Orabug: 17271899]  
  - xfs: introduce CONFIG_XFS_WARN (Dave Chinner) [Orabug: 17271899]  
  - xfs: recheck buffer pinned status after push trylock failure (Brian Foster) [Orabug: 17271899]  
  - xfs: remove log force from xfs_buf_trylock() (Brian Foster) [Orabug: 17271899]  
  - xfs: ensure we capture IO errors correctly (Dave Chinner) [Orabug: 17271899]  
  - xfs: fallback to vmalloc for large buffers in xfs_attrlist_by_handle (Eric Sandeen) [Orabug: 17271899]  
  - xfs: fallback to vmalloc for large buffers in xfs_compat_attrlist_by_handle (Eric Sandeen) [Orabug: 17271899]  
  - ext4: fix corruption when online resizing a fs with 1K block size (Maarten ter Huurne) [Orabug: 17279036]  
  - ext4: fix data integrity for ext4_sync_fs (Jerry Snitselaar) [Orabug: 17279036]  
  - ext4: fix overflow when counting used blocks on 32-bit architectures (Jan Kara) [Orabug: 17279036]  
  - ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs (Jan Kara) [Orabug: 17279036]  
  - ext4: fix overflows in SEEK_HOLE, SEEK_DATA implementations (Jerry Snitselaar) [Orabug: 17279036]  
  - ext4: fix data offset overflow on 32-bit archs in ext4_inline_data_fiemap() (Jan Kara) [Orabug: 17279036]  
  - ext4: fix type-widening bug in inode table readahead code (Theodore Ts'o) [Orabug: 17279036]  
  - ext4: mext_insert_extents should update extent block checksum (Darrick J. Wong) [Orabug: 17279036]  
  - ext4: fix deadlock with quota feature (Jan Kara) [Orabug: 17279036]  
  - qlcnic: update from 5.0.30 to 5.2.43 (Jerry Snitselaar) [Orabug: 17267160]  
  - Remove pre-alpha features for release. (Kris Van Hees) [Orabug: 17076008]  
  - CONFIG_UPROBES is needed by CONFIG_DT_FASTTRAP, not CONFIG_DTRACE. (Nick Alcock) [Orabug: 17076008]  
  - CONFIG_DTRACE should depend on CONFIG_UPROBES. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Include all sources regardless of arch. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Changes for UEK merge. (Nick Alcock) [Orabug: 17076008]  
  - Fix loss of error code from waitid() when info is provided. (Nick Alcock) [Orabug: 17076008]  
  - Make old_rsp available to kernel modules. (Kris Van Hees) [Orabug: 17076008]  
  - waitfd selftest: dike out some dead code. (Nick Alcock) [Orabug: 17076008]  
  - Introduce poll_wait_fixed(), and use it in waitfds. (Nick Alcock) [Orabug: 17076008]  
  - No longer reference 'ctf.ko.unsigned' in CTF debuginfo stripping machinery. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Do not sign modules, pro tem. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Fix the -g1 debuginfo hack. (Nick Alcock) [Orabug: 17076008]  
  - Add waitfd(), and a testcase for it. (Nick Alcock) [Orabug: 17076008]  
  - Ensure that arg6 through arg9 get retrieved correctly for USDT probes. (Kris Van Hees) [Orabug: 17076008]  
  - Finish the implementation of is-enabled USDT probes. (Kris Van Hees) [Orabug: 17076008]  
  - Fixes for tracepoint cleanup. (Kris Van Hees) [Orabug: 17076008]  
  - Remove unnecessary debugging output. (Kris Van Hees) [Orabug: 17076008]  
  - Update syscall tracing in view of Linux 3.8 changes. (Kris Van Hees) [Orabug: 17076008]  
  - USDT implementation (phase 2). (Kris Van Hees) [Orabug: 17076008]  
  - Revamp and split up DTrace headers.  Add ioctl() debugging machinery. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: blacklist certain structure members entirely. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Repair faulty indentation. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Split the absolute-file-name caching machinery out of type_id(). (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: sentinelize str_appendn(). (Nick Alcock) [Orabug: 17076008]  
  - ptrace: Add PTRACE_GETMAPFD. (Nick Alcock) [Orabug: 17076008]  
  - Update execve() syscall probe support. (Kris Van Hees) [Orabug: 17076008]  
  - Add support for an SDT probe getting called from multiple functions. (Kris Van Hees) [Orabug: 17076008]  
  - Move SDT call location for surrender probe. (Kris Van Hees) [Orabug: 17076008]  
  - USDT implementation (Phase 1). (Kris Van Hees) [Orabug: 17076008]  
  - Remove incorrect FBT support code. (Kris Van Hees) [Orabug: 17076008]  
  - Move psinfo to its own header file. (Kris Van Hees) [Orabug: 17076008]  
  - Update copyright statements. (Kris Van Hees) [Orabug: 17076008]  
  - dwarf2ctf: Update the shared CTF file right after initialization. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Improve debugging and indentation fixes. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf doc revisions. (Nick Alcock) [Orabug: 17076008]  
  - Internal performance measurement support code. (Kris Van Hees) [Orabug: 17076008]  
  - Disable KVM steal-time accounting when DTrace is in use. (Nick Alcock) [Orabug: 17076008]  
  - Cosmetic improvements to CTF linking. (Nick Alcock) [Orabug: 17076008]  
  - Remove a few obsolete probes. (Kris Van Hees) [Orabug: 17076008]  
  - Cater for changes in the way the kernel is linked. (Kris Van Hees) [Orabug: 17076008]  
  - Miscellaneous 3.6 porting work. (Kris Van Hees) [Orabug: 17076008]  
  - Fix up rq.dtrace_cpu_info member. (Kris Van Hees) [Orabug: 17076008]  
  - gitignore: Ignore objects.builtin and dwarf2ctf. (Nick Alcock) [Orabug: 17076008]  
  - Fix outright typos in the 3.6 forward-port. (Nick Alcock) [Orabug: 17076008]  
  - Remove obsolete static probe documentation. (Kris Van Hees) [Orabug: 17076008]  
  - DTrace-independent CTF. (Nick Alcock) [Orabug: 17076008]  
  - Do not build in CTF data for no-longer-built-in modules. (Nick Alcock) [Orabug: 17076008]  
  - Document dwarf2ctf. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Extend the deduplication blacklist. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Improve error message on internal deduplication error. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Note a future enhancement. (Nick Alcock) [Orabug: 17076008]  
  - Document parameters to die_to_ctf(). (Nick Alcock) [Orabug: 17076008]  
  - Do not construct objects.builtin if CTF is not being built. (Nick Alcock) [Orabug: 17076008]  
  - Do not build dwarf2ctf nor attempt to use it if !CONFIG_DTRACE. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Rename the DTrace kernel to kernel-uek-dtrace-. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: strip kernel modules using objcopy, not eu-strip (Nick Alcock) [Orabug: 17076008]  
  - SPEC: do not strip non-debugging sections from kernel modules. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: build firmware. (Nick Alcock) [Orabug: 17076008]  
  - Additional action support (and bug fixes). (Kris Van Hees) [Orabug: 17076008]  
  - Get rid of debugging code. (Kris Van Hees) [Orabug: 17076008]  
  - Add psinfo/cpuinfo OS level support. (Kris Van Hees) [Orabug: 17076008]  
  - Removed debugging output (1 line). (Kris Van Hees) [Orabug: 17076008]  
  - Change the DTrace startup handling (at boot time) for SDT. (Kris Van Hees) [Orabug: 17076008]  
  - Cleanup (and adding) of SDT probe points. (Kris Van Hees) [Orabug: 17076008]  
  - Write the CTF files for standalone modules to a subdir of the module directory. (Nick Alcock) [Orabug: 17076008]  
  - Adapt to the libdtrace-ctf devel package split. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: unnamed structure/union support. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: recurse_ctf() -> die_to_ctf(). (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: fix the signed-modules case. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: correctly propagate IDs for array types. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: fix off-by-one in emitted array bounds. (Nick Alcock) [Orabug: 17076008]  
  - Fix tiny comment typo. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: blacklist certain modules from deduplication. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: include enumeration types inside functions. (Nick Alcock) [Orabug: 17076008]  
  - New IO provider probes: start, done, wait-start, wait-done New sched provides probes: enqueue, dequeue, wakeup, preempt, remain-cpu, change-pri, surrender (Note that the preempt probe currently passes a debugging argument that will be removed in the future to match the argument-less version in the documentation.) (Kris Van Hees) [Orabug: 17076008]  
  - Fix to handle multiple SDT-based probes in a single function. (Kris Van Hees) [Orabug: 17076008]  
  - DTrace: require assembler symbol stripping and debug info. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Fix array dimensions. (Nick Alcock) [Orabug: 17076008]  
  - Change the name of the CTF section in kernel modules. (Nick Alcock) [Orabug: 17076008]  
  - Fix a bug in the SDT probe location generator, where it could accidentally add the address of a non-function identifier to the SDT list (e.g. watchdog occurs both in the uninitialised data section (BSS) and the text section). (Kris Van Hees) [Orabug: 17076008]  
  - dwarf2ctf: major duplicate detection fixes. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: optimize type_id() and fix array dimension lookup. (Nick Alcock) [Orabug: 17076008]  
  - Changed the logic for determining SDT probe point locations because the previous version did not account for probes that might be placed in non-.text segments.  New code also avoids extra passes that were not necessary. (Kris Van Hees) [Orabug: 17076008]  
  - dwarf2ctf: store away the types and names of non-static global variables. (Nick Alcock) [Orabug: 17076008]  
  - Set the name of the parent of child modules to "dtrace_ctf". (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: clarify comments, improve a type name. (Nick Alcock) [Orabug: 17076008]  
  - Force dtrace_ctf.ko to be loaded whenever dtrace.ko is. (Nick Alcock) [Orabug: 17076008]  
  - Generate CTF information for the kernel. (Nick Alcock) [Orabug: 17076008]  
  - Drop rogue debugging statements. (Nick Alcock) [Orabug: 17076008]  
  - Provide symbol sizes in /proc/kallmodsyms. (Nick Alcock) [Orabug: 17076008]  
  - Add a dummy dtrace_ctf.ko module. (Nick Alcock) [Orabug: 17076008]  
  - Fix /proc/kallmodsyms population bugs. (Nick Alcock) [Orabug: 17076008]  
  - kallsyms: work in a clean tree, and a non-modular tree. (Nick Alcock) [Orabug: 17076008]  
  - kallsyms: work with older glibc. (Nick Alcock) [Orabug: 17076008]  
  - Don't depend on dtrace-user. (Nick Alcock) [Orabug: 17076008]  
  - Add /proc/kallmodsyms. (Nick Alcock) [Orabug: 17076008]  
  - - sched-tick SDT probe. - FBT probe point discovery and probe creation. - Moving code around for the kernel pseudo-module handling since it gets used   by both the SDT code and the FBT code. (Kris Van Hees) [Orabug: 17076008]  
  - Delete an obsolete release script. (Nick Alcock) [Orabug: 17076008]  
  - Changed from using mutex_is_locked() to a new mutex_owned(), in support of the Solaris MUTEX_HELD() macro.  The former was merely testing whether the mutex was locked, whereas the real test needed here is whether the mutex is held by the current thread. (Kris Van Hees) [Orabug: 17076008]  
  - Fix signed division and modulo operations in DIF. Ensure that SDT probe points are patched with a NOP sequence at boot time. Remove debugging output during SDT registration. (Kris Van Hees) [Orabug: 17076008]  
  - Make sure the insn length is initialized in the right branch of the die notifier. (Nick Alcock) [Orabug: 17076008]  
  - Ensure that the trap handler is regisstered only once. Register with first use, (Kris Van Hees) [Orabug: 17076008]  
  - Ensure that the die notifier hook is installed whenever DTrace is enabled, since page fault and general protection fault handling depends on it, and that is needed for safe memory access support in DTrace. (Kris Van Hees) [Orabug: 17076008]  
  - Adding missing files for PF/GPF support. (Kris Van Hees) [Orabug: 17076008]  
  - Support for page fault and general protection fault detection for DTrace, to ensure that DTrace memory access faults are non-fatal. (Kris Van Hees) [Orabug: 17076008]  
  - Fix incorrect probe point name. (Kris Van Hees) [Orabug: 17076008]  
  - Added lwp-exit and lwp-create SDT probe points. Change the DRELOC tag in make output to DT-SDT. (Kris Van Hees) [Orabug: 17076008]  
  - SDT implementation (core kernel support for providing a list of static probe points for the kernel pseudo-module, dtrace SDT meta-provider support, ...). Also, new script (dtrace_sdt.sh) to extract locations of SDT probe points in the core kernel. (Kris Van Hees) [Orabug: 17076008]  
  - Enable processing the SDT probe point info at boot time (before SMP is actually enabled), if DTrace SDT support has been enabled (built-in or as module).  For now, provide some verbose info on the probe points getting resolved. (Kris Van Hees) [Orabug: 17076008]  
  - Fix resolving addresses of relocation records for SDT probe points.  The addresses were being calculated based on the wrong starting point (_stext whereas it ought to be _text), and the base was not taken into account. Fixed the writing of NOPs in the location of the probe point calls, since the existing case was causing kernel paging faults.  Made the add_nops() function in alternative.c non-static so it can be used in sdt_register. Use add_nops() to select the most appropriate NOP sequence for replacing the probe point call, and write the NOPs using text_poke(). (Kris Van Hees) [Orabug: 17076008]  
  - Fixed the allocation of cyclics that was the cuase for some obscure crashes during the testsuite execution.  Problem was that cyclics were being allocated in chunks, with a new array being allocated as (prev-size + chink-size), and then the old entries being copied over.  However, because the hrtimer struct is embedded in the cyclic struct, this meant that hrtimer structs were being moved outside the hrtimer code. (Kris Van Hees) [Orabug: 17076008]  
  - Removed dead code (was #if 0 ... #endif).  Cleaned up ;; -> ;. (Kris Van Hees) [Orabug: 17076008]  
  - Implementation for tracing stub-based system calls.  Due to the need for specialized code handling (mainly passing in a pt_regs structure as one of the arguments), some syscalls are called through a stub in assembly code. We duplicate the stub cdode in dtrace_stubs_x86_64.S, but instead of calling the actual syscall implementation code call our own syscall-specific handler, which ensures that entry and return probes are called as enabled, and then call the underlying implementation directly for handling the syscall. (Kris Van Hees) [Orabug: 17076008]  
  - Allow for pushes of multiple branches and pushes of merged-back branches. (Nick Alcock) [Orabug: 17076008]  
  - Remove some debugging that crept in. (Nick Alcock) [Orabug: 17076008]  
  - Fix git commit URL. (Nick Alcock) [Orabug: 17076008]  
  - push-dtrace-release: Fix argument checking. (Nick Alcock) [Orabug: 17076008]  
  - Do not rely on 'git clone --branch'. (Nick Alcock) [Orabug: 17076008]  
  - Release-pushing script. (Nick Alcock) [Orabug: 17076008]  
  - Stacktrace dumping has been moved to the GPL-licensed dtrace_os.c because it depends on a symbol that is exported as GPL-only.  Functionality in dtrace_isa that requires stacktrace dumping can now use dtrace_stacktrace(). (Kris Van Hees) [Orabug: 17076008]  
  - Fix porting issues from 2.6.32 to 2.6.39. Disable stub_* based syscalls (for now). (Kris Van Hees) [Orabug: 17076008]  
  - Move cyclic.h into include/linux. (Nick Alcock) [Orabug: 17076008]  
  - Finish GPL/CDDL splitting work. (Nick Alcock) [Orabug: 17076008]  
  - CDDL copyrights for everything needing it. (Nick Alcock) [Orabug: 17076008]  
  - Migrate dtrace to a standalone module, situated at the top level of the tree. (Nick Alcock) [Orabug: 17076008]  
  - Fix walltimestamp. (Nick Alcock) [Orabug: 17076008]  
  - Changes in how we collect the names o system calls.  Used to use the ftrace syscall meta info and the nr-to-meta functionality.  Now populates the systrace info structure statically at kernel compile time.  This means that the DTrace code no longer depends on ftrace. (Kris Van Hees) [Orabug: 17076008]  
  - No more use for ktime_get_nongpl().  We an now use dtrace_gethrtime(). (Kris Van Hees) [Orabug: 17076008]  
  - Implementation for syscall entry/return probes.  Makes the sys call table writable, and replaces the function pointer for select syscalls with the address of a wrapper function to enable entry and return probe firing. (Kris Van Hees) [Orabug: 17076008]  
  - Conflict with CONFIG_DEBUG_LOCK_ALLOC. (Nick Alcock) [Orabug: 17076008]  
  - Dependency fixes for dtrace. (Nick Alcock) [Orabug: 17076008]  
  - Added CONFIG_DT_DEBUG_MUTEX option to enable printing all locations where a mutex is locked and unlocked. Implemented aggregations using the idr mechanism rather than the Solaris-based 1-byte allocation technique to get unique IDs. Various cleanup and small changes. (Kris Van Hees) [Orabug: 17076008]  
  - Update sdt provider (sdt_mod.c) with lots of functions. NOTES: - module loadcnt may need more work. - kernel_searchsym() is incomplete (see FIXMEs). Add sdt_subr.c and build it in Makefile. Add str_impl.h for internal sdt use. Add more fields to linux/module.h for static probe bookkeeping. (Randy Dunlap) [Orabug: 17076008]  
  - Add dtrace_module_loaded() and dtrace_module_unloaded(). Give the static probes in the kernel image a module name of   "kernel_builtins" and a module state of LIVE. Fix an extra-paren typo in dtrace_dev.c. NOTE:  This is incomplete.  There are a few TBDs and FIXMEs   in this patch. (Randy Dunlap) [Orabug: 17076008]  
  - Turn on gcov profiliing for the RPM builds by default. (Nick Alcock) [Orabug: 17076008]  
  - Turn on gcov profiling in the kernel/dtrace directory by default. (Nick Alcock) [Orabug: 17076008]  
  - Adding framework for a test provider that fires a specific probe on request. Adding previously missing (and unused) exported functions: (Kris Van Hees) [Orabug: 17076008]  
  - File needed for rpm builds to ensure DTrace is enabled as modules. (Kris Van Hees) [Orabug: 17076008]  
  - add Documentation/dtrace_static_probes.txt, which is a directory of all static probes in the kernel tree. (Randy Dunlap) [Orabug: 17076008]  
  - Remove license and add copyright. (Randy Dunlap) [Orabug: 17076008]  
  - Build sdt_register.c into the kernel. (Nick Alcock) [Orabug: 17076008]  
  - Add missing include needed for DTrace probes. (Nick Alcock) [Orabug: 17076008]  
  - - convert relative probepoint relocation addresses to absolute:   this should have been done by the top-level Makefile, but it must   have a dependency problem since the generated vmlinux_info.S has   the correct info in it but the vmlinux_info.o file does not AND   the .S file was created AFTER the .o file. - convert calls to dtrace stub RETs to NOPs; (Randy Dunlap) [Orabug: 17076008]  
  - Add some dtrace static probes that are easy to trigger. See the static probes directory listing for a summary of all dtrace static probes. (Randy Dunlap) [Orabug: 17076008]  
  - Added dependency for FTRACE and FTRACE_SYSCALLS for the SYSTRACE provider. (Kris Van Hees) [Orabug: 17076008]  
  - Remove debugging statements. (Kris Van Hees) [Orabug: 17076008]  
  - Reduce the unintended ordering dependency (_text before _stext) when scanning the relocs info file. (Randy Dunlap) [Orabug: 17076008]  
  - Adding debug code to track probe processing through BEGIN probe enabling. Adding minimal implementation of cyclic functionality (based on hrtimer) as an additional to the core kernel, linked in when dtrace is enabled (be it as module, or compiled in).  Exports cyclic_add() and cyclic_remove(). Removed former cyclic stub implementation (cyclic.c). (Kris Van Hees) [Orabug: 17076008]  
  - The systrace provider depends on the FTRACE_SYSCALLS kernel feature. The systrace provider is actually called syscall on Solaris, so it has been renamed on the Linux side (i.e. it registers itself as syscall). Added some debug statements to track probe searches better. The probes/probematch ioctl handling should return -ESRCH when the last hit has been returned already. (Kris Van Hees) [Orabug: 17076008]  
  - Reading the dtrace relocation info table could fail on a boundary condition. Fix by counting the string terminator (null) byte.  Now works for my 4 test cases. (Randy Dunlap) [Orabug: 17076008]  
  - Read and use the _stext value for adding to relative relocation info to make it absolute. This works for my 4 test cases.  It was derived by examination and discovery.  There could be cases where it does not work, e.g. in other text sections. (Randy Dunlap) [Orabug: 17076008]  
  - Removed || CONFIG_DT_SDT_MODULE from conditional surrounding call to dtrace_register_builtins() because that function does not exist in the kernel proper when DTrace is compiled as kernel modules. (Kris Van Hees) [Orabug: 17076008]  
  - Add missing files (present in the CVS repo but not in git). (Kris Van Hees) [Orabug: 17076008]  
  - systrace uses syscall_nr_to_meta, which is only available when FTRACE_SYSCALLS is enabled, so make systrace depend on FTRACE_SYSCALLS. (Randy Dunlap) [Orabug: 17076008]  
  - Test push. (Kris Van Hees) [Orabug: 17076008]  
  - Test commit (reverting previous test commit). (Kris Van Hees) [Orabug: 17076008]  
  - Just a very small change to check whether git push will work fine by someone other than Nix. (Kris Van Hees) [Orabug: 17076008]  
  - Initial import of DTrace kernelspace code. (Nick Alcock) [Orabug: 17076008]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-8.el6uek]
changelog:
  - ipoib fix compilation if rcu debug enabled (Maxim Uvarov)   
  - qlge: update from v1.00.00.31 to v1.00.00.32 (Jerry Snitselaar) [Orabug: 17267206]  
  - qla2xxx: update from mainline 8.04.00.08-k to qlogic version 8.05.00.03.39.0-k (Saurav Kashyap) [Orabug: 17277380]  
  - config file change for eIPoIB (Ajaykumar Hotchandani)   
  - bnx2i: update from mainline version 2.7.2.2 to broadcom version 2.7.6.1d (Jerry Snitselaar) [Orabug: 17024889]  
  - bnx2fc: update from mainline version 1.0.12 to broadcom version 2.3.4 (Jerry Snitselaar) [Orabug: 17024889]  
  - bnx2x: update from mainline version 1.78.00-0 to broadcom version 1.76.54 (Jerry Snitselaar) [Orabug: 17024889]  
  - cnic: update from mainline version 2.5.16 to broadcom version 2.5.16g (Jerry Snitselaar) [Orabug: 17024889]  
  - bnx2: update from mainline version 2.2.3 to broadcom version 2.2.3n (Jerry Snitselaar) [Orabug: 17024889]  
  - tg3: update from mainline version 3.128 to broadcom version 3.131d (Jerry Snitselaar) [Orabug: 17024889]  
  - tmpfs: add support for read_iter and write_iter (Hugh Dickins) [Orabug: 16371286]
  - ubifs: convert file ops from aio_read/write to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - ecrpytfs: Convert aio_read/write ops to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - afs: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - udf: convert file ops from aio_read/write to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - gfs2: Convert aio_read/write ops to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - xfs: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - block_dev: add support for read_iter, write_iter (Asias He) [Orabug: 16371286]
  - btrfs: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - nfs: simplify swap (Dave Kleikamp) [Orabug: 16371286]
  - nfs: add support for read_iter, write_iter (Dave Kleikamp) [Orabug: 16371286]
  - ext4: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - ocfs2: add support for read_iter, write_iter, and direct_IO_bvec (Zach Brown) [Orabug: 16371286]
  - fs: add read_iter and write_iter to several file systems (Dave Kleikamp) [Orabug: 16371286]
  - fs: use read_iter and write_iter rather than aio_read and aio_write (Dave Kleikamp) [Orabug: 16371286]
  - fs: create file_readable() and file_writable() functions (Dave Kleikamp) [Orabug: 16371286]
  - loop: use aio to perform io on the underlying file (Zach Brown) [Orabug: 16371286]
  - bio: add bvec_length(), like iov_length() (Zach Brown) [Orabug: 16371286]
  - aio: add aio support for iov_iter arguments (Zach Brown) [Orabug: 16371286]
  - aio: add aio_kernel_() interface (Zach Brown) [Orabug: 16371286]
  - fs: pull iov_iter use higher up the stack (Zach Brown) [Orabug: 16371286]
  - dio: add bio_vec support to __blockdev_direct_IO() (Dave Kleikamp) [Orabug: 16371286]
  - dio: Convert direct_IO to use iov_iter (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: let callers extract iovecs and bio_vecs (Zach Brown) [Orabug: 16371286]
  - iov_iter: add a shorten call (Zach Brown) [Orabug: 16371286]
  - iov_iter: add bvec support (Zach Brown) [Orabug: 16371286]
  - iov_iter: ii_iovec_copy_to_user should pre-fault user pages (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: hide iovec details behind ops function pointers (Zach Brown) [Orabug: 16371286]
  - fuse: convert fuse to use iov_iter_copy_[to|from]_user (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: add __iovec_copy_to_user() (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: add copy_to_user support (Zach Brown) [Orabug: 16371286]
  - iov_iter: iov_iter_copy_from_user() should use non-atomic copy (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: move into its own file (Zach Brown) [Orabug: 16371286]
  - sparc64 - color correction (bob picco)   
  - [ixgbe] hold rcu_read_lock() when derefencing rcu (Maxim Uvarov) [Orabug: 17213023]  
  - mutex: Back out architecture specific check for negative mutex count (Waiman Long) [Orabug: 17237224]  
  - mutex: Queue mutex spinners with MCS lock to reduce cacheline contention (Waiman Long) [Orabug: 17237224]  
  - mutex: Make more scalable by doing less atomic operations (Waiman Long) [Orabug: 17237224]  
  - mutex: Move mutex spinning code from sched/core.c back to mutex.c (Waiman Long) [Orabug: 17237224]  
  - ipc/sem.c: Fix missing wakeups in do_smart_update_queue() (Manfred Spraul) [Orabug: 17237239]  
  - ipc,sem: fix semctl(..., GETNCNT) (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: fix semctl(..., GETZCNT) (Rik van Riel) [Orabug: 17237239]  
  - ipc: simplify rcu_read_lock() in semctl_nolock() (Linus Torvalds) [Orabug: 17237239]  
  - ipc: simplify semtimedop/semctl_main() common error path handling (Linus Torvalds) [Orabug: 17237239]  
  - ipc: move sem_obtain_lock() rcu locking into the only caller (Linus Torvalds) [Orabug: 17237239]  
  - ipc: fix double sem unlock in semctl error path (Linus Torvalds) [Orabug: 17237239]  
  - ipc: move the rcu_read_lock() from sem_lock_and_putref() into callers (Linus Torvalds) [Orabug: 17237239]  
  - ipc: sem_putref() does not need the semaphore lock any more (Linus Torvalds) [Orabug: 17237239]  
  - ipc: move rcu_read_unlock() out of sem_unlock() and into callers (Linus Torvalds) [Orabug: 17237239]  
  - ipc: fix GETALL/IPC_RM race for sysv semaphores (Al Viro) [Orabug: 17237239]  
  - ipc/msg.c: use list_for_each_entry_[safe] for list traversing (Nikola Pajkovsky) [Orabug: 17237239]  
  - ipc,sem: fine grained locking for semtimedop (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: have only one list in struct sem_queue (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: open code and rename sem_lock (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: do not hold ipc lock more than necessary (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc: introduce lockless pre_down ipcctl (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc: introduce obtaining a lockless ipc object (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc: remove bogus lock comment for ipc_checkid (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc/msgutil.c: use linux/uaccess.h (HoSung Jung) [Orabug: 17237239]  
  - ipc: refactor msg list search into separate function (Peter Hurley) [Orabug: 17237239]  
  - ipc: simplify msg list search (Peter Hurley) [Orabug: 17237239]  
  - ipc: implement MSG_COPY as a new receive mode (Peter Hurley) [Orabug: 17237239]  
  - ipc: remove msg handling from queue scan (Peter Hurley) [Orabug: 17237239]  
  - ipc: set EFAULT as default error in load_msg() (Peter Hurley) [Orabug: 17237239]  
  - ipc: tighten msg copy loops (Peter Hurley) [Orabug: 17237239]  
  - ipc: separate msg allocation from userspace copy (Peter Hurley) [Orabug: 17237239]  
  - ipc: clamp with min() (Peter Hurley) [Orabug: 17237239]  
  - rwsem: check counter to avoid cmpxchg calls (Davidlohr Bueso) [Orabug: 17237186]  
  - rwsem: no need for explicit signed longs (Davidlohr Bueso) [Orabug: 17237186]  
  - x86 rwsem: avoid taking slow path when stealing write lock (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: do not block readers at head of queue if other readers are active (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: implement support for write lock stealing on the fastpath (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: simplify __rwsem_do_wake (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: skip initial trylock in rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: avoid taking wait_lock in rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: use cmpxchg for trying to steal write lock (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: more agressive lock stealing in rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: simplify rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: simplify rwsem_down_read_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: move rwsem_down_failed_common code into rwsem_down_{read,write}_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: shorter spinlocked section in rwsem_down_failed_common() (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: make the waiter type an enumeration rather than a bitmask (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: Implement writer lock-stealing for better scalability (Alex Shi) [Orabug: 17237186]  
  - rwsem-spinlock: Implement writer lock-stealing for better scalability (Yuanhan Liu) [Orabug: 17237186]  
  - mpt3sas: update from v02.100.00.00 to v3.00.00.00 (Sreekanth Reddy) [Orabug: 17249239]  
  - sched: Change position of resched_cpu() in load_balance() (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Move up affinity check to mitigate useless redoing overhead (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Prevent to re-select dst-cpu in load_balance() (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Explicitly cpu_idle_type checking in rebalance_domains() (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Rename load_balance_tmpmask to load_balance_mask (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Don't consider other cpus in our group in case of NEWLY_IDLE (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Fix init NOHZ_IDLE flag (Vincent Guittot) [Orabug: 16988083]  
  - sched: Fix select_idle_sibling() bouncing cow syndrome (Mike Galbraith) [Orabug: 16988083]  
  - disable mlx5 compilation (Ajaykumar Hotchandani)   
  - xfs: Fix the logic check for all quotas being turned off (Chandra Seetharaman)   
  - xfs: return FIEMAP_EXTENT_UNKNOWN for delayed allocation extent (Jie Liu)   
  - xfs: Don't keep silent if sunit/swidth can not be changed via mount (Jie Liu)   
  - xfs: fix rounding in xfs_free_file_space (Dave Chinner)   
  - FSX on 512 byte block size filesystems has been failing for some time with corrupted data. The fault dates back to the change in the writeback data integrity algorithm that uses a mark-and-sweep approach to avoid data writeback livelocks. (Dave Chinner)   
  - xfs: don't free EFIs before the EFDs are committed (Dave Chinner)   
  - xfs: Fix WARN_ON(delalloc) in xfs_vm_releasepage() (Jan Kara)   
  - xfs: fix potential infinite loop in xfs_iomap_prealloc_size() (Brian Foster)   
  - hxge: add support for Oracle 10Gb Ethernet adapter (James Puthukattukaran) [Orabug: 16443155]  
  - rds: complete port of RDS from UEK2 (2.6.39-400.107.0.el5uek) (Venkat Venkatsubra)   
  - rds: RDS files of UEK2 (2.6.39-400.107.0.el5uek) as is (Venkat Venkatsubra)   
  - rds: Add rds.h file (Ajaykumar Hotchandani)   
  - Enable SDP build in config file. (Ajaykumar Hotchandani)   
  - remove drivers/infiniband/debug (Ajaykumar Hotchandani)   
  - Removed srp_1.5.3 (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: use __cancel_delayed_work in IRQ context" (Ajaykumar Hotchandani)   
  - sdp: fix cpu lock-up when sdp call ib_fmr_pool_map_phys (Shamir Rabinovitch)   
  - sdp: IB_CQ_VECTOR_LEAST_ATTACHED will not be supported in ofed-2.0 (Shamir Rabinovitch)   
  - sdp: port sdp to latest devel branch (Shamir Rabinovitch)   
  - sdp: copy sdp from uek-2.0 to ofed-2.0 (Shamir Rabinovitch)   
  - iser: panic on iser login/logout (Shamir Rabinovitch) [Orabug: 16313854]  
  - mlx4_en: Align timestamping support with upstream kernel (Saeed Mahameed)   
  - mlx4_ib: clear comp mask bit of deleted GUID entries after deletion (Saeed Mahameed)   
  - ib_core: fixed resource leak in case of error (Saeed Mahameed)   
  - IB: Introduce Shared PD support (Saeed Mahameed)   
  - ib_core: IB providers/ULPs Relaxed (User) FMR set to NULL (Saeed Mahameed)   
  - mlx4_ib: Enable usermode FMR (Saeed Mahameed)   
  - ib_core: Enable usermode FMR (Saeed Mahameed)   
  - rdma_cm: add ability to control the QP timeout value (Saeed Mahameed)   
  - rdma_cm: adding the RDMA_CM_EVENT_ALT_PATH_LOADED event (Dotan Barak)   
  - mlx4_ib: 6305 bugfix: set the counter sets of the alternate path in the QP (Dotan Barak)   
  - mlx4_ib: Fix the attribute sq_sig_type value in query qp (Saeed Mahameed)   
  - rdma_cm: rdma_create_qp not setting up client context correctly (Saeed Mahameed)   
  - rmda_cm: add APM support to rdma_cm. (rdma_enable_apm) (Saeed Mahameed)   
  - mlx5: Update CMD_IF_REV to 4 (Moshe Lazer)   
  - mlx4_core: resource tracker fix error flow in add_res_range (Saeed Mahameed)   
  - mlx5: Implement new intialization sequeuenc (Moshe Lazer)   
  - ib/ipoib: change mode only when interface is down. (Erez Shitrit)   
  - ib/ipoib: avoid pkey value 0 in child interface. (Erez Shitrit)   
  - ib/ipoib: Fix index 0 pkey value in ipoib sriov env. (Erez Shitrit)   
  - ib/ipoib: limit the max number of receive/transmit queues to 16 (Tal Alon)   
  - mlx4_en: reuse mapped memory in RX flow (v2) (Eugenia Emantayev)   
  - mlx5: Fix check of number of entries in create CQ (Eli Cohen)   
  - mlx5: fix uninitialized var warning (Eli Cohen)   
  - mlx5: fix send work queue size calculation (Eli Cohen)   
  - ib/core: Fix cleanup of user resources (Eli Cohen)   
  - mlx5_ib: fix compilation issues in ubuntu 12.4 The driver uses 2 different enum types in 'switch' and in 'if' statements. This is causing compilation warnings. This patch resolves the issues by replacing the enum with int. (Moshe Lazer)   
  - eth_ipoib: fix hw update in sr-iov interfaces. (Erez Shitrit)   
  - ib/ipoib: handle failure on ipoib_cm_dev_init() for init flow (Tal Alon)   
  - mlx4_core: resolvs kernel panic when connectx_port_config fail to set ports (Moshe Lazer)   
  - mlx5: modify mr cache sizes (Eli Cohen)   
  - Update driver release date (Eli Cohen)   
  - mlx5: fix manipulation of device in healt list (Eli Cohen)   
  - mlx5: fix failure to load on 32 bit archs (Eli Cohen)   
  - mlx5: Add DC support (Eli Cohen)   
  - ib/core: Add support for DC (Eli Cohen)   
  - mlx4_core: implement loopback prevention for ETH qps (Jack Morgenstein)   
  - ib_umad: keep devnum of port cdev and sm_cdev until they are freed (Moshe Lazer)   
  - mlx5: Use UMR based registration directly on mlx5 (Eli Cohen)   
  - mlx5: allow to clear commands stats (Eli Cohen)   
  - ib/ipoib: change skb memory allocation for init process from GFP_ATOMIC to GFP_KERNEL (Tal Alon)   
  - net/mlx4_en: LLS statistics (Amir Vadai)   
  - net/mlx4_en: Add Low Latency Socket (LLS) support (Amir Vadai)   
  - mlx4_core: Free memory only if UNMAP succeeded. (Majd Dibbiny)   
  - eth_ipoib: fix bug in add new vif. (Erez Shitrit)   
  - eth_ipoib: remove unneeded tag (Erez Shitrit)   
  - IB/mlx4: Fetch XRC SRQ in the CQ polling code (Shlomo Pongratz)   
  - mlx4_core: Implement SRQ object lookup from srqn (Shlomo Pongratz)   
  - IB/core: Verify that QP handler is valid before dispatching events (Shlomo Pongratz)   
  - net/mlx4: Add sysFS for vf link state support (Rony Efraim)   
  - net/mlx4: Add vf link state support (Rony Efraim)   
  - Revert "mlx4_en: reuse mapped memory in RX flow" (Vladimir Sokolovsky)   
  - mlx5: improve mr caches (Eli Cohen)   
  - mlx4_core: Dynamic VST to VST vlan/qos changes (Jack Morgenstein)   
  - mlx4_en: reuse mapped memory in RX flow (Eugenia Emantayev)   
  - mlx4: add pci domain to module params that use bdf-to-value format (Moshe Lazer)   
  - mlx5: Add support to measure average command time (Eli Cohen)   
  - ib/core: add means to measure average time of a command (Eli Cohen)   
  - net/mlx4_core eSwitch - add support VST with priority tag+ remove debug prints (Rony Efraim)   
  - mlx4_en: Use state_lock to protect ethtool rules database (Hadar Hen Zion)   
  - IB/core: Remove DMFS rules from uobject rule_list when ib_destroy_flow() fails (Hadar Hen Zion)   
  - IB/core: Do not access flow_id after destroy_flow() is called (Hadar Hen Zion)   
  - mlx4_ib: Free mailbox after create flow is done (Hadar Hen Zion)   
  - mlx4_ib: Check index before access the array in create/destroy flow (Hadar Hen Zion)   
  - mlx4_core : implemented a function ib_rate_to_mlx4 that checks if the 	    static_rate is a valid value before assigning it to the 	    ah_attr in mlx4_set_path. (majd@mellanox.com)   
  - mlx4: add means to measure command execution time (Eli Cohen)   
  - mlx5: Add health plugin support (Eli Cohen)   
  - mlx4_en: fix skb leakage (Eugenia Emantayev)   
  - ib/ipoib: add call to dev_set_mtu when setting mode to connect (Tal Alon)   
  - ib/ipoib: update broadcast record according to the new bcast from the sm. (Erez Shitrit)   
  - ib/ipoib: fix hard_header return value (Erez Shitrit)   
  - Fix broken previous commit (Eli Cohen)   
  - mlx5: fix query of max rd atomic (Eli Cohen)   
  - mlx5: Fix offsets in query hca cap (Eli Cohen)   
  - mlx5: Add descriptive strings to health bufer reports (Eli Cohen)   
  - mlx5: Add fast registraton support (Eli Cohen)   
  - eth_ipoib: fix neigh hash in each slave (Erez Shitrit)   
  - ib/ipoib: add parameters range description to driver info validates received parameters (Tal Alon)   
  - mlx5: Fix fast path configuration (Eli Cohen)   
  - ib_core: xrc cleanup (Yishai Hadas)   
  - kernel-uek.spec: Remove pesign >= 0.10-4 as build requirement (Ajaykumar Hotchandani)   
  - config file change (Ajaykumar Hotchandani)   
  - Kconfig and Makefile specific changes (Ajaykumar Hotchandani)   
  - mlx4_vnic: Fix reference path to hw/mlx4 header files (Ajaykumar Hotchandani)   
  - mlx4: Fix compilation error for mlx4_get_vf_config (Ajaykumar Hotchandani)   
  - Fix IPoIB compilation issue. (Ajaykumar Hotchandani)   
  - mlx5: remove __dev* attributes (Ajaykumar Hotchandani)   
  - mlx4_core: remove __dev* attributes (Bill Pemberton)   
  - IB/srp: Fail I/O requests if the transport is offline (Bart Van Assche)   
  - IB/srp: Avoid endless SCSI error handling loop (Bart Van Assche)   
  - IB/srp: Avoid sending a task management function needlessly (Bart Van Assche)   
  - IB/srp: Track connection state properly (Bart Van Assche)   
  - IB/srp: send disconnect request without waiting for CM timewait exit (Vu Pham)   
  - IB/srp: destroy and recreate QP and CQs when reconnecting (Ishai Rabinovitz)   
  - IB/srp: Eliminate state SRP_TARGET_DEAD (Bart Van Assche)   
  - IB/srp: Allow SRP disconnect through sysfs (Bart Van Assche)   
  - IB/srp: Suppress superfluous error messages (Bart Van Assche)   
  - IB/srp: Introduce the helper function srp_remove_target() (Bart Van Assche)   
  - IB/srp: Process all error completions (Bart Van Assche)   
  - IB/srp: Introduce srp_handle_qp_err() (Bart Van Assche)   
  - IB/srp: Simplify SCSI error handling (Bart Van Assche)   
  - IB/srp: Keep processing commands during host removal (Bart Van Assche)   
  - IB/srp: Eliminate state SRP_TARGET_CONNECTING (Bart Van Assche)   
  - IB/srp: Increase block layer timeout (Bart Van Assche)   
  - net/mlx4_core: Disallow releasing QPs before steering rules are detached (Hadar Hen Zion)   
  - mlx4_core: Fix error flow in the flow steering wrapper (Hadar Hen Zion)   
  - mlx4_core: Fix potential deadlock in mlx4_eq_int() (Jack Morgenstein)   
  - mlx4_core: Add QPN enforcement for flow steering rules set by VFs (Hadar Hen Zion)   
  - Revert "net/mlx4_core: Disallow releasing QPs before steering rules are detached" (Ajaykumar Hotchandani)   
  - mlx4_en: update driver version to 2.1.3 (Eugenia Emantayev)   
  - mlx4_core: Fix advertisement of wrong PF context behaviour (Or Gerlitz)   
  - net/mlx4_en: Use generic etherdevice.h functions. (Yan Burman)   
  - net/mlx4_en: Can set maxrate only for TC0 (Amir Vadai)   
  - IB/mlx4: Fix spinlock order to avoid lockdep warnings (Jack Morgenstein)   
  - Revert "mlx4_en: fix QoS in old kernels" (Ajaykumar Hotchandani)   
  - mlx4_core: use __cancel_delayed_work in IRQ context (Saeed Mahameed)   
  - eth_ipoib:  use hash for managing the neighs in each slave. (Erez Shitrit)   
  - IB/iser: fix device removal flow (Roi Dayan)   
  - Fix compliation issue on 32 bit systems (Eli Cohen)   
  - mlx5: move UMR completions to event driven (Eli Cohen)   
  - eth_ipoib: add bh lock in order to avoid soft-lockups (Erez Shitrit)   
  - mlx4_vnic: align with OFED2 upstream 3.7 kernel (Saeed Mahameed)   
  - mlx4_vnic: adapt vnic to ofed2 mlx4 implementation (Saeed Mahameed)   
  - mlx4_vnic: add mlx4_vnic (Saeed Mahameed)   
  - ib/ipoib: add sysfs for tss/rss over child interface (Saeed Mahameed)   
  - ib/ipoib: fix memory leak in error flow (Saeed Mahameed)   
  - mlx4_ib: Fix connection of UD QPs in rdmacm for SRIOV/RoCE (Shani Michaelli)   
  - mlx4_core: fix error introduced in a merge from upstream (Jack Morgenstein)   
  - Fix compliation issue on 32 bit systems (Eli Cohen)   
  - mlx4_en: fix statistics view in SRIOV mode (Eugenia Emantayev)   
  - mlx5: change SRQ limit event msg to debug (Eli Cohen)   
  - mlx5: dump selected error CQEs (Eli Cohen)   
  - mlx5: move UMR completions to event driven (Eli Cohen)   
  - mlx4_core: Avoid setting ports for auto when only one port type is supported (Moshe Lazer)   
  - mlx4_core: cleared the mailbox->buf (memset 0) before using it.            mlx4_set_port_general_context struct is smaller than the mailbox->buf            therefore clearing only it was not enough and we had to clear the whole            mailbox->buf in order to ensure garbage-free buffer. (majd@mellanox.com)   
  - mlx4_en: setting number of rings resulted in deadlock (Matan Barak)   
  - mlx5: fix query of max rdma/atomics (Eli Cohen)   
  - mlx4_en: update driver version to 2.1.2 (Eugenia Emantayev)   
  - mlx4_en: update driver version to 2.1.1 (Eugenia Emantayev)   
  - IB/iser: Fix coverity errors (Roi Dayan)   
  - mlx5: update modinfo string for mlx5_ib (Eli Cohen)   
  - ib/ipoib: fix panic at cm tx creation. (Erez Shitrit)   
  - mlx5: fix opt param mlx5 translation table (Eli Cohen)   
  - mlx4_core: sysfs, fix usage of log_num_mtt module parameter (Yishai Hadas)   
  - ib/ipoib: in additional to commit 2bf6943f4f9ea9f1f69b4ef5acb4ece11bf50bc0 (Erez Shitrit)   
  - mlx5: fix opt parameters usage (Eli Cohen)   
  - ib/ipoib: fix kernel panic after mode changing. (Erez Shitrit)   
  - mlx5: add missing spare EQEs in create EQ (Eli Cohen)   
  - Revert "ib/ipoib: enhance interop between TSS device to non-TSS device." (Erez Shitrit)   
  - mlx5: mark mlx5_ib QPs how they were created (Eli Cohen)   
  - mlx5: Fix alignement of data buffers for umr registration (Eli Cohen)   
  - ib/ipoib: fix for missing ping reply issue. (Erez Shitrit)   
  - ib/ipoib: Call skb_dst_drop() once skb is enqueued for sending (Erez Shitrit)   
  - net/mlx4_core : update enforce QP param in VST (Rony Efraim)   
  - net/mlx4_core: Always use __mlx4_un/register_vlan for VST (Rony Efraim)   
  - mlx4_ib: set link type for the primary path (Eli Cohen)   
  - mlx4_core: Fix mem leak in SRIOV mlx4_init_one error flow (Jack Morgenstein)   
  - mlx4_core: Add wrapper for mlx4_DIAG_RPRT command to return BAD_OP (Jack Morgenstein)   
  - mlx4_en: do not allow certain ethtool options when alloc resources failed (Eugenia Emantayev)   
  - mlx4_en: restore ring inflight atomic variable (Eugenia Emantayev)   
  - ib/ipoib: move (one more) message to be at debug level instead of warn (Erez Shitrit)   
  - ib/ipoib: move message to be at debug level instead of warn (Erez Shitrit)   
  - mlx5: change message from warn to debug (Eli Cohen)   
  - mlx4_en: No_wqes counter should only be reported via Ethtool (Yevgeny Petrilin)   
  - mlx4_en: inline threshold must be unsigned (Eugenia Emantayev)   
  - mlx4_en: make receive flow more readable (Eugenia Emantayev)   
  - ib/ipoib: fix skb true size (Erez Shitrit)   
  - mlx5: fix offset to health buffer (Eli Cohen)   
  - mlx4_en: fix kernel panic on XenServer hypervisor (Eugenia Emantayev)   
  - mlx4_core: Ignore bf flag in mlx4_qp_reserve_range when count is too large (Jack Morgenstein)   
  - mlx4_core: use kernel to allocate and release umad cdevs (Moshe Lazer)   
  - mlx4_ib: used uninitialized compilation warning (Moshe Lazer)   
  - mlx4_en: change driver version to 2.1 and add date (Eugenia Emantayev)   
  - mlx4_en: remove TX shifting (Eugenia Emantayev)   
  - memtrack: handle umem put page (Yishai Hadas)   
  - mlx4_en: fix wrong MAC address (Eugenia Emantayev)   
  - ib_srp: update module version to 1.2 (Alex Tabachnik)   
  - mlx4_core: fix ib_uverbs_get_context flow (Yishai Hadas)   
  - IB/core: Fix memory leaks in ib_uverbs_create_flow (Hadar Hen Zion)   
  - mlx4_core: Fix Coverity issue (Hadar Hen Zion)   
  - IB/core: Fix Coverity issue (Hadar Hen Zion)   
  - ib/ipoib: remove compilation warning (Erez Shitrit)   
  - mlx4_en: get timestamp request from correct packet info (Eugenia Emantayev)   
  - mlx4_en: make alignment generic (Eugenia Emantayev)   
  - Revert "DEBUG PATCH" (Moshe Lazer)   
  - Revert "DEBUG PATCH update" (Moshe Lazer)   
  - ib/ipoib: allocate always one linear buffer at the RX flow (Erez Shitrit)   
  - ib/ipoib: enhance interop between TSS device to non-TSS device. (Erez Shitrit)   
  - mlx4_en: fix DCB_ENABLE flag (Eugenia Emantayev)   
  - IB/iser: Move important debug prints to debug level 1 (Roi Dayan)   
  - mlx4_en: add check for DMA mapping error (Eugenia Emantayev)   
  - mlx4_en: align dma to 64 (Eugenia Emantayev)   
  - ib_mad: Avoid looking into mad struct before finding it in list (Moshe Lazer)   
  - net/mlx4_core: Translate guest B0 steering rules to DMFS (Hadar Hen Zion)   
  - net/mlx4_core: Add helper function to translate B0 steering to DMFS (Hadar Hen Zion)   
  - net/mlx4_core: Disallow releasing QPs before steering rules are detached (Hadar Hen Zion)   
  - net/mlx4_core: Use 64 bit resource ID when doing lookup (Hadar Hen Zion)   
  - net/mlx4_en: Remove ethtool flow steering rules before releasing QPs (Hadar Hen Zion)   
  - ib_uverbs: added ref_cnt to sysfs (Marcel Apfelbaum)   
  - ib/ipoib: disable reinit at the middle of driver down. (Erez Shitrit)   
  - mlx4_core: change warn msg to dbg msg (Moshe Lazer)   
  - mlx4_core: Fix Coverity issues. (Hadar Hen Zion)   
  - IB/mlx4: Fix Coverity issues (Hadar Hen Zion)   
  - IB/core: Fix Coverity issues (Hadar Hen Zion)   
  - mlx4_en, mlx4_ib: show VSD string through sysfs (Hadar Hen Zion)   
  - mlx4_core: Enhance flow steering validation checks (Hadar Hen Zion)   
  - IB/mlx4: use ARRAY_SIZE kernel macro (Hadar Hen Zion)   
  - net/mlx4_core: Fix wrong order of flow steering resources removal (Hadar Hen Zion)   
  - mlx4_core: map eq inconsistency with prm (Moshe Lazer)   
  - net/mlx4_core: Preparation + workaround for the UPDATE_QP FW cmd (Rony Efraim)   
  - mlx4_ib: assign all dev numbers in low-level driver when dev_assign_str param is active (Jack Morgenstein)   
  - mlx4_core: fix the method to get phys func from its virt func (Moshe Lazer)   
  - ib_iser: move some error prints to debug prints (Roi Dayan)   
  - ib_iser Fix kernel crash on ib_iser module unload immediately after initiator logout (Alex Tabachnik)   
  - ib_srp: simplifying handle port down, cm dreq, scsi error recovery (Alex Tabachnik)   
  - ib_srp: check for error return to avoid garbage gid in initiator_id (Alex Tabachnik)   
  - ib_srp: bail out when scsi command in req is NULL (Alex Tabachnik)   
  - mlx4: Allow RAW PACKET QPs on mlx4 (Eli Cohen)   
  - ib/ipoib: fix for ib_unregister_event_handler (Erez Shitrit)   
  - mlx4_en: fix memory leak in mlx4_en_activate_rx_rings (Eugenia Emantayev)   
  - mlx4_en: verify mlx4_en module parameters (Eugenia Emantayev)   
  - mlx4_en: change ethtool specifications for 1G, 10G, 40G support in advertising and supported fields (Rana Shahout)   
  - IB/core: Fix raw Ethernet qp bug (Hadar Hen Zion)   
  - IB/core: add module parameter check to allow a non-root user to attach DMFS rules (Hadar Hen Zion)   
  - IB/mlx4: Add support for Flow Steering (Hadar Hen Zion)   
  - IB/core: Export ib_create/destroy_flow through uverbs (Hadar Hen Zion)   
  - IB/core: Implement ib_create/destroy_flow (Hadar Hen Zion)   
  - net/mlx4_core: Add flow steering support to be used by mlx4_ib (Hadar Hen Zion)   
  - mlx4_core: Directly expose fields of HW flow steering rule control segment (Hadar Hen Zion)   
  - mlx4_core: Replace flow steering fields names to match the PRM (Hadar Hen Zion)   
  - mlx4_core: Expose flow steering HW structs to be used by mlx4_ib module (Hadar Hen Zion)   
  - mlx4_ib: Remove attach/detach flow API implementation (Hadar Hen Zion)   
  - ib_uverbs: Remove ib_uverbs_attach/detach_flow leftovers (Hadar Hen Zion)   
  - Revert "ib_core: Implement ib_attach_flow ib_detach_flow" (Hadar Hen Zion)   
  - Revert "mlx4_ib: Add support for ib_attach_flow and ib_detach_flow." (Hadar Hen Zion)   
  - Revert "ib_uverbs: Export ib_attach_flow and ib_detach_flow to userspace." (Hadar Hen Zion)   
  - Revert "rdma_cm: Implement rdma_get_l2" (Hadar Hen Zion)   
  - mlx4_en: add port state test before operate mlx4_en_set_cq_moder in mlx4_en_set_ringparam function. (Rana Shahout)   
  - mlx4_en: avoid loosing statistics (Eugenia Emantayev)   
  - ib_iser: add module version (Roi Dayan)   
  - mlx5: fix health counter read (Eli Cohen)   
  - mlx4_en: set correct MTU in SRIOV (Eugenia Emantayev)   
  - Release Date is updated to __DATE__ instead of a static string (Alex Markuze)   
  - mlx4_core: use msi_x module param to limit num of MSI-X irqs (Moshe Lazer)   
  - Seting ring size to default when module param set incorrectly (Alex Markuze)   
  - eth_ipoib: move task from rx flow to workqueue (Erez Shitrit)   
  - mlx5: fix health polling race (Eli Cohen)   
  - DEBUG PATCH update To provide more info on kernel panic in mad layer. (Moshe Lazer)   
  - memtrack: add tracking for kfree_rcu (Eugenia Emantayev)   
  - mlx4_en: Set number of rx/tx channels using ethtool (Amir Vadai)   
  - mlx4_en: fix incorrect timestamp (Eugenia Emantayev)   
  - mlx4_en: remove explicit call to skb_reset_mac_header (Eugenia Emantayev)   
  - ib/ipoib: move global client_data_lock spin_lock init to module_init (Erez Shitrit)   
  - mlx5: use MPI profile as default (Eli Cohen)   
  - ib/ipoib: protect client data with spin-lock. (Erez Shitrit)   
  - ib/ipoib: disable lro over pv interface. (Erez Shitrit)   
  - eth_ipoib: change lock over bh, use regular lock. (Erez Shitrit)   
  - mlx4_core: CQE/EQE by default is 64B (Yishai Hadas)   
  - mlx5: change fw health polling to new definition (Eli Cohen)   
  - mlx5: fix missing symbols in 32 bit platforms (Eli Cohen)   
  - mlx5: use separate EQ of command interface (Eli Cohen)   
  - mlx5: change scatter to cqe to new PRM (Eli Cohen)   
  - net/mlx4: Update FW DEV CAP bits of VST and FSM (Yan Burman)   
  - net/mlx4: Add support to get VF config (Yan Burman)   
  - net/mlx4: Fix the VF numbering from 0 (instead of 1) (Yan Burman)   
  - mlx4_en: fix no vlan traffic on vlan interface (Eugenia Emantayev)   
  - DEBUG PATCH To provide info on kernel panic in mad layer. (Moshe Lazer)   
  - mlx5: fix warning on out of array bounds (Eli Cohen)   
  - mlx5: DEBUG PATCH (Eli Cohen)   
  - mlx4_en: reset mac_header (Eugenia Emantayev)   
  - mlx4_core: fix counters leak as part of slave down (Yishai Hadas)   
  - mlx4_ib, ib_core: UP setting for Raw Eth QP (Amir Vadai)   
  - mlx4_en: help disperse interrupts workload in TX flow (Eugenia Emantayev)   
  - mlx4_en: help disperse interrupts workload in RX flow (Eugenia Emantayev)   
  - mlx4_en: optimize inline logic in TX flow (Eugenia Emantayev)   
  - mlx4_en: remove atomic from transmit flow (Eugenia Emantayev)   
  - mlx4_en: use unlikely when checking for bounce in en_xmit (Eugenia Emantayev)   
  - mlx4_en: code cleanup (Eugenia Emantayev)   
  - Issue: 170150 mlx4: Allow to set CQ Ignore Overrun under capability check (Igor Ivanov)   
  - Issue: 170150 IB/mlx4: Add Cross-channel functionality (Igor Ivanov)   
  - Issue: 170150 IB/core: Add ib_uverbs_modify_cq_ex (Igor Ivanov)   
  - Issue: 170150 IB/core: Add ib_uverbs_create_qp_ex (Igor Ivanov)   
  - Issue: 170150 IB/core: Add Infrastructure to support verbs extensions through uverbs (Igor Ivanov)   
  - Issue: 170150 IB/core: Add support for Cross Channel operations (Igor Ivanov)   
  - Issue: 170150 IB/mlx5: Change CQ modify to have attributes/mask and flags param (Igor Ivanov)   
  - Issue: 170150 IB: Change CQ modify to have attributes/mask and flags param (Igor Ivanov)   
  - ib/core: change error prints in cm module to debug prints. (Jack Morgenstein)   
  - mlx4: bf_qp parameter added to mlx4_qp_reserve_range should be a flags param. (Jack Morgenstein)   
  - mlx4_en: use linear skbs in receive flow (Eugenia Emantayev)   
  - mlx5: debug patch - freeze on too long completions (Eli Cohen)   
  - mlx5: debug patch for umr problem (Eli Cohen)   
  - mlx4_core: Add support for different value formats in BDF-Val params (Moshe Lazer)   
  - mlx4_core: Add more info to mlx4_cmd_post failure error messages (Jack Morgenstein)   
  - mlx4_en: ignore init and shutdown hypervisor events (Eugenia Emantayev)   
  - mlx5: fix false compilation error in qp.c (Eli Cohen)   
  - Fix format specifier for printk (Eli Cohen)   
  - mlx4_ib: in SRIOV, should not reserve QP range for IPoIB use when DMFS is enabled. (Jack Morgenstein)   
  - mlx4_core: use symbolic name for FW commands in warnings (Jack Morgenstein)   
  - mlx5: fix race in destroy CQ (Eli Cohen)   
  - mlx5: fix error flow in destroy SRQ (Eli Cohen)   
  - mlx4_core: Support setting a different port_type_array for each HCA (Moshe Lazer)   
  - mlx4_en: use div_u64 for division (Eugenia Emantayev)   
  - mlx4_core: disable mlx4_QP_ATTACH calls from guests if master is doing flow steering. (Jack Morgenstein)   
  - Adding parametre validation to ipoib_printk (Alex Markuze)   
  - eth_ipoib: enable GRO on the pv interface (Erez Shitrit)   
  - mlx4_en: release QP when destroying TX ring (Eugenia Emantayev)   
  - mlx5: add profie selection of mr cache sizes (Eli Cohen)   
  - memtrack: fix broken memtrack on vzalloc (Eli Cohen)   
  - Add mlx5 driver support (Eli Cohen)   
  - ib/core: add UMR support for verbs (Eli Cohen)   
  - ib/core: Add means to measure command execution times (Eli Cohen)   
  - mlx4_core: Don't fail reg/unreg vlan for upstream guests to 3.8 (Jack Morgenstein)   
  - mlx4_core: Turn off device-managed FS bit in dev-cap wrapper if DMFS is not enabled (Jack Morgenstein)   
  - mlx4_core: change resource quotas to enable supporting upstream-kernel guests (Jack Morgenstein)   
  - mlx4_core: Support setting a different num_vfs and probe_vf for each HCA (Moshe Lazer)   
  - ib/ipoib: fix ipoib_neigh index calculation (Shlomo Pongratz)   
  - mlx4_en: split outgoing traffic to two different rings (Eugenia Emantayev)   
  - Flsu WQ should come after flush_paths in CM mode (Alex Markuze)   
  - net/mlx4_en: Synchronize unicast MAC filter implementation with upstream (Yan Burman)   
  - ib/iser: add BullseyeCoverage pragma lines around ilog2 calls (Roi Dayan)   
  - ib_srp: fix oops during module unload on OEL 6.2 (Alex Tabachnik)   
  - Moved the tx ethtoll counters to ipoib_send (Alex Markuze)   
  - ib/ipoib: fix deadlock between dev_change_flags to __ipoib_dev_flush (Erez Shitrit)   
  - Adding flush WQ for ipoib_ib_dev_cleanup to avoid cm_create_tx_qp handling bad pointers Issue: 111256, 168923 (Alex Markuze)   
  - mlx4: change QP allocation scheme (Eugenia Emantayev)   
  - ib/ipoib: avoid loading the kernel when rtnl is locked. (Erez Shitrit)   
  - ib/ipoib: fix deadlock between ipoib_mcast_dev_flush to ipoib_mcast_join_finish (Erez Shitrit)   
  - mlx4_ib: use correct device for XRC (Yishai Hadas)   
  - net/mlx4_en: Fix resource leak on module unload (Yan Burman)   
  - net/mlx4_en: Fix race in set_mac_address regression (Yan Burman)   
  - ib/ipoib: fix panic on ipoib_get_stats (Erez Shitrit)   
  - mlx4_core: device revision support (Yishai Hadas)   
  - mlx4_core: print more info when command times out (Jack Morgenstein)   
  - ib/ipoib: Fix ipoib_neigh hashing to use the correct daddr octets (Shlomo Pongratz)   
  - ib/ipoib: : Fix race condition in neigh creation under MQ (Shlomo Pongratz)   
  - ib/ipoib: rtnl_unlock cannot come after free_netdev (Erez Shitrit)   
  - ib/ipoib: fix deadlock over vlan_mutex. (Erez Shitrit)   
  - 	This is a partial fix for bad flow when ipoib_reinit fails to ipoib_dev_init. 	This fix enables the driver to call ib_unregister_event_handler in ipoib_remove_one, without crushing, 	though ib_register_event_handler was not called. (Alex Markuze)   
  - eth_ipoib: fix compilation over xen-server. (Erez Shitrit)   
  - ib/ipoib: remove netlink code till further support. (Erez Shitrit)   
  - mlx4_core: move out label to the right place (Eugenia Emantayev)   
  - IB/mlx4: Do reg/unreg vlan for RoCE (Jack Morgenstein)   
  - {IB,EN}/mlx4: In RoCE allow guests to have multiple GIDS (Jack Morgenstein)   
  - IB/mlx4: prepare update_gids flow for multiple gids (Jack Morgenstein)   
  - mlx4_en: add check for QoS capability bit (Eugenia Emantayev)   
  - EN/mlx4: use vlan id in mlx4_unregister_vlan instead of vlan index (Jack Morgenstein)   
  - mlx4_core: fix reg/unreg vlan and reg/unreg mac to conform to the PRM (Jack Morgenstein)   
  - memtrack: alloc/free pages handle size inconsistency (Yishai Hadas)   
  - mlx4_en: use num_possible_cpus instead of num_default_rss_queues (Eugenia Emantayev)   
  - mlx4_en: memory leak in loading driver (Matan Barak)   
  - net/mlx4_en: Add support for destination MAC in steering rules (Yan Burman)   
  - net/mlx4_en: Implement fdb ndo_fdb_{add,del,dump} (Yan Burman)   
  - net/mlx4_en: Add unicast MAC filtering (Yan Burman)   
  - net/mlx4_en: Manage hash of MAC addresses per port (Yan Burman)   
  - net/mlx4_en: Save old MAC address of the port so we can replace it later (Yan Burman)   
  - net/mlx4_en: Re-arrange ndo_set_rx_mode related code (Yan Burman)   
  - net/mlx4: Move ethernet related functionality to mlx4_en out of mlx4_core (Yan Burman)   
  - net/mlx4_en: Cleanup multiline strings (Yan Burman)   
  - net/mlx4_en: Optimize loopback related checks in data path (Yan Burman)   
  - net/mlx4_core: Set number of msix vectors under SRIOV mode to firmware defaults (Or Gerlitz)   
  - ib/ipoib: fix possible deadlock on pkey_poll task. (Erez Shitrit)   
  - mlx4_en: fix BlueFlame race (Eugenia Emantayev)   
  - ib_mad: Add SA MADs congestion control (Moshe Lazer)   
  - ib/ipoib: add robust to ipoib_mcast_join_finish (Erez Shitrit)   
  - ib/ipoib: fix deadlock between ipoib_mcast_dev_flush and ipoib_mcast_join_finish (Erez Shitrit)   
  - IB/iser: Enable iser to work when FMRs are not supported (Or Gerlitz)   
  - mlx4_en: ethtool should return error on turning on autoneg (Matan Barak)   
  - IB/mlx4: deprecate "failed to alloc bf reg" message from err to debug (Jack Morgenstein)   
  - mlx4_en: fix bad english in modprobe and ethtool (Amir Vadai)   
  - mlx4_en: Move initalizations to beginning of init_netdev (Amir Vadai)   
  - mlx4_en: pad ethernet packets smaller than 17 bytes (Amir Vadai)   
  - mlx4_en: print error message on cqe error (Amir Vadai)   
  - mlx4_en: fix set port ratelimit. (Sagi Grimberg)   
  - mlx4_en: fix MLX4_RATELIMIT_DEFAULT define include (Sagi Grimberg)   
  - mlx4_en: report number of rings in RSS as a power of 2 (Amir Vadai)   
  - mlx4_en: fix UP limit in ieee_ets->prio_tc (Amir Vadai)   
  - mlx4_core: Do not allow mlx4_bitmap_init to reserve more slots than available (Amir Vadai)   
  - mlx4_en: fix open-lldp DCB support (Sagi Grimberg)   
  - remove dead code - mlx4_en_can_lro (Sagi Grimberg)   
  - mlx4_en: add support for debugfs (Shani Michaelli)   
  - mlx4_en: TX ring size default to 1024 (Yevgeny Petrilin)   
  - ib/ipoib: Fix deadlock between rmmod and set_mode (Erez Shitrit)   
  - ib/ipoib: fine tune commit aee8f48642fb83820463d042ca80fd5372947cb5 (Erez Shitrit)   
  - In 4K mtu Rx, adding 128 bytes to linear part (Alex Markuze)   
  - ib/ipoib: getout whenever failed to load port. (Erez Shitrit)   
  - ib_ipoib: Fixing issue with delayed work running after child is killed. (Erez Shitrit)   
  - mlx4_en: extract changes to compat from backport (Amir Vadai)   
  - IB/mlx4: in RoCE, report network-view of number of GIDS in query_port. (Jack Morgenstein)   
  - srp: Create additioal tree with srp code from mofed 1.5.3, separated to two parts one for all the distributions and one for sles11sp2 and kernels bigger then 3.0. Original srp code remaine as is and when will be needed will be used for developement (Alex Tabachnik)   
  - mlx4_en: fix QoS in old kernels (Amir Vadai)   
  - ib_core: contig allocation use NOWARN flag (Yishai Hadas)   
  - ib_core: fix memory leak in contig error flow (Yishai Hadas)   
  - mlx4_core: Fixed IPoIB flow steering (Hadar Hen Zion)   
  - ib/ipoib: Add print log for debug. (Erez Shitrit)   
  - ib/ipoib: Fix mess in the select queue in TSS flow. (Erez Shitrit)   
  - ipoib: fix mcast dead-lock (Yishai Hadas)   
  - Fixing RHL6.2 memtrack backports for alloc_worqueue (Alex Markuze)   
  - mlx4_core: additional fix for qp_detach_common (Eugenia Emantayev)   
  - mlx4_core: fix broken logic when removing promisc qp (Eugenia Emantayev)   
  - ib/ipoib: doesn't allow num of tx channel to be 2. (Erez Shitrit)   
  - net/eipoib: sys/fs show of "served" should give the new member as it does with the valid members (Erez Shitrit)   
  - mlx4_en: counters init to non-index (Yishai Hadas)   
  - mlx4_core: Do not guarantee counter availability in SRIOV (Jack Morgenstein)   
  - mlx4_en: counters fine-tuned (Yishai Hadas)   
  - mlx4_core: max counters support (Yishai Hadas)   
  - mlx4_core: change code to endian safe (Hadar Hen Zion)   
  - mlx4_ib: allow FS rules attachments with missing headers (Hadar Hen Zion)   
  - mlx4_en/mlx4_ib: move BE_SHORT/WORD_MASK macro from private to common place (Hadar Hen Zion)   
  - mlx4_core: configure flow steering hash to L4 mode (Hadar Hen Zion)   
  - mlx4_en: Fixed ethtool rules leftovers after mlx4_en unload (Hadar Hen Zion)   
  - mlx4_en: block insertion of FS ethtool rules while port is down (Hadar Hen Zion)   
  - mlx4_en: Remove FS promisc rules removal from mlx4_en_start_port (Hadar Hen Zion)   
  - mlx4_en: fix ethtool vlan range validation (Hadar Hen Zion)   
  - mlx4_ib: Add VLAN support to RawEth QP flow steering (Hadar Hen Zion)   
  - mlx4_en: fixed ip/tcp/udp multicast mac rules when inserted via ethtool (Hadar Hen Zion)   
  - mlx4_en: counters moderation support (Yishai Hadas)   
  - memtrack: add missing untrackable functions for EN under RH6.3 (Yishai Hadas)   
  - mlx4_core: Resource wrapper for reg/unreg vlans (Jack Morgenstein)   
  - mlx4_core: fix register/unreg vlan flow (Jack Morgenstein)   
  - mlx4_core: fix call to __mlx4_unregister_mac (Jack Morgenstein)   
  - mlx4_core: Implement resource quota enforcement when allocating various resources (Jack Morgenstein)   
  - {IB,EN}/mlx4: structures and init/teardown for VF resource quotas (Jack Morgenstein)   
  - memtrack: fix report (Yishai Hadas)   
  - net/mlx4: Add support for MAC spoof checking (Rony Efraim)   
  - net/mlx4: Add support to set default vlan id and priority for VF NIC (Rony Efraim)   
  - net/mlx4: Add support the set mac address for VF NIC (Rony Efraim)   
  - {IB,EN}/mlx4: Replace mlx4_en_mac_to_u64() with mlx4_mac_to_u64() (Rony Efraim)   
  - net/mlx4: Add admin and oper DB (Rony Efraim)   
  - mlx4_en: fix some dead-locks as of flow steering mode (Yishai Hadas)   
  - mlx4_en: Do not query ethernet stats when a device port is down. (Jack Morgenstein)   
  - extended counters use correct reserved bytes (Yishai Hadas)   
  - mlx4_core: fix endianness bug in set_param_l (Jack Morgenstein)   
  - ib/ipoib: fix the failure to delete  clone child interface. (Erez Shitrit)   
  - net/mlx4_core: Fix racy flow in the driver CQ completion handler (Jack Morgenstein)   
  - net/eipoib: Support bonding (active-passive mode) for eIPoIB driver. (Erez Shitrit)   
  - ib/ipoib: Changes in ipoib in order to support the latest version of eIPoIB. (Erez Shitrit)   
  - net/eipoib: Add ethtool file support (Erez Shitrit)   
  - net/eipoib: Add sysfs support (Erez Shitrit)   
  - net/eipoib: Add main driver functionality (Erez Shitrit)   
  - net/eipoib: Add private header file (Erez Shitrit)   
  - mlx4_en: report extra rx counters for SRIOV (Yishai Hadas)   
  - mlx4_ib: add extended counters support (Yishai Hadas)   
  - mlx4_en: support extended counters (Yishai Hadas)   
  - mlx4_core: set device to use extended counters (Yishai Hadas)   
  - fix NULL pointer assignment in the disconnection flow (Alex Tabachnik)   
  - mlx4_ib: mlx4_set_path() wrote the port number into the MAC address field under RoCE (Jack Morgenstein)   
  - mlx4_ib: Called rdma_port_get_link_layer with wrong port number. (Jack Morgenstein)   
  - add support for CQ moderation (Alex Tabachnik)   
  - mlx4_en: fix IPv6 traffic (Eugenia Emantayev)   
  - ipoib: move set_skb_oob_cb_data body to ipoib.h (Vladimir Sokolovsky)   
  - ib/ipoib: Fix deadlock at the release of child_interfaces. (Erez Shitrit)   
  - mlx4: verify port number in __mlx4_unregister_mac (Eli Cohen)   
  - ipoib: improve poll mechanism for better performance (Yishai Hadas)   
  - ipoib: Replace write_lock with rw semaphore (Jack Morgenstein)   
  - mlx4_core: Do not enable flow steering by default (Jack Morgenstein)   
  - mlx4_core: Adjustments to Flow Steering activation logic for SRIOV (Jack Morgenstein)   
  - ipoib: adapt code to netlink changes (Yishai Hadas)   
  - ib/ipoib: debug prints instead of warn in tx_wc function (Erez Shitrit)   
  - ib/ipoib: fix possible race between  ipoib_cm_skb_too_long call to skb free. (Erez Shitrit)   
  - ib/ipoib: Fix race in the TX flow at CM mode. (Erez Shitrit)   
  - ib/ipoib: change list_del to list_del_init in the tx object. (Erez Shitrit)   
  - ib/ipoib: repalce list_del of the neigh->list with  list_del_init (Erez Shitrit)   
  - ib/ipoib: add detailed error message on  dev_queue_xmit (Erez Shitrit)   
  - ib/ipoib: adding completion to ipoib_mc (Erez Shitrit)   
  - ib/ipoib: start mcast_join process only on port active. (Erez Shitrit)   
  - ib/ipoib: Move QP to ERROR only when the QP is not at REST state (Erez Shitrit)   
  - ib_ipoib: always mark QP as NETIF_QP (Amir Vadai)   
  - ib/ipoib: fix ipoib lock is not freed issue (Shlomo Pongratz)   
  - ipoib: fix a deadlock at "carrier on task" (Yishai Hadasa)   
  - ib/ipoib: fix kernel panic when restarting with vma  flag (Shlomo Pongratz)   
  - ib/ipoib: force cleaning of ah's in driver unloading (Erez Shitrit)   
  - IB/ipoib: Remove datagram mode check for ipoib flow steering (Hadar Hen Zion)   
  - ipoib: adaptive moderation fine tuned (Yishai Hadas)   
  - ib/ipoib: fix access to stale cm rx context (Shlomo Pongratz)   
  - ib/ipoib: Change the comparison of tx_outstanding and the timeout function. (Yishai Hadas)   
  - ipoib/ib: don't release resources if the add_one failed (Dotan Barak)   
  - ib/ipoib: Fix removing call for update_pmtu from  spin-lock context. (Erez Shitrit)   
  - ipoib: start_xmit - RSS/TSS adaptations (Yishai Hadas)   
  - ib/ipoib: attach multicast address after RSS/TSS qp num change. (Shlomo Pongratz)   
  - ipoib: flow steering with TSS/RSS support (Hadar Hen Zion)   
  - ipoib: adaptive moderation adaptations to RSS (Yishai Hadas)   
  - ib/ipoib: Added adaptive moderation algorithm for  better latency. (Yishai Hadas)   
  - ipoib: arp snooping for gid cache sync. (Erez Shitrit)   
  - ipoib: add inline/blue flame support (Yishai Hadas)   
  - IB/IPoIB: fix cm tx path index and strenght locking (Shlomo Pongratz)   
  - ipoib: fixed NULL dereferencing in case of error flow (Dotan Barak)   
  - IB/ipoib: add support for ethtool set/get_channels (Shlomo Pongratz)   
  - IB/ipoib: Add RSS and TSS support for datagram mode (Shlomo Pongratz)   
  - IB/ipoib: Implement vectorization restructure as  pre-step for TSS/RSS (Shlomo Pongratz)   
  - eipoib: addon flags (Yishai Hadas)   
  - ib/ipoib: Add support in IPoIB instance (netdevice) functions as a VIF (Erez Shitrit)   
  - ib/ipoib: add support for clones / multiple childs  on the same partitions (Or Gerlitz)   
  - mlx4_core: Fix flow steering backword compatability to old FW's (Amir Vadai)   
  - RDMA/ucm: disable tuning the max listen backlog in debug kernel (Dotan Barak)   
  - mlx4_core: fix memtrack algoritm to identify non trackable mem allocation (Moshe Lazer)   
  - core, srp, mlx4_en: Adjustments to patch set which rebased to kernel 3.7 (Jack Morgenstein)   
  - mlx4_core, mlx4_ib, mlx4_en: match fs promisc enums to new PRM names (Hadar Hen Zion)   
  - RDMA/ib_core: add support for iWarp multicast acceleration over IB_QPT_RAW_PACKET QP type (Solves RM #100087) (Marcel Apfelbaum)   
  - mlx4_core, mlx4_ib: Adding flow steering ibdump support (Hadar Hen Zion)   
  - mlx4_core: Update minimum size for log_num_qp to 18 (Moshe Lazer)   
  - mlx4_en: fix race in join/leave multicast flow (Eugenia Emantayev)   
  - mlx4_ib: allow_loopback flag shouldn't set hardcoded (Hadar Hen Zion)   
  - mlx4_ib:Add ipoib qpn for IB unicast flow steering (Hadar Hen Zion)   
  - net/mlx4: remove BUG_ON in case of an error (Dotan Barak)   
  - mlx4_core: allow_loopback flag is corrupted (Amir Vadai)   
  - mlx4_ib : add module parameter that maps IB device index to device function number (Eli Cohen)   
  - sys_tune: enable sys_tune only if APM MODULE configured (Eugenia Emantayev)   
  - mlx4_en: add defines for supported link speed (Eugenia Emantayev)   
  - mlx4_en: fill truesize field in skb (Eugenia Emantayev)   
  - sys_tune: add sys_tune for cpu tuning for better performance (Eugenia Emantayev)   
  - net/mlx4: fix memory leaks in guest OS in case of error flow (Dotan Barak)   
  - mlx4_core, mlx4_ib: Have enough room in steering range for pkey interfaces (Amir Vadai)   
  - mlx4_ib: fix kernel crash when steering QPN's range is big (Amir Vadai)   
  - mlx4_en: remove all queues empty condition for loopback test (Eugenia Emantayev)   
  - mlx4_en: correct calculation of mtu size (Yishai Hadas)   
  - mlx4_en: merge adaptive moderation logic/values from 1.5.9 (Eugenia Emantayev)   
  - mlx4_ib: Adapt driver to changes in steering range API changes in firmware (Eitan Rabin)   
  - mlx4_en, mlx4_ib: make QP steering range hardcoded (Amir Vadai)   
  - net/mlx4: return bad error status to caller function in case of error (Dotan Barak)   
  - mlx4_en: avoid cache miss in GRO flow (Eugenia Emantayev)   
  - mlx4_en: no IP_ALIGN for scatter entries (Eugenia Emantayev)   
  - mlx4_en: selecting neighbour core for TX interrupts (Eugenia Emantayev)   
  - mlx4_en: NAPI on TX side (Eugenia Emantayev)   
  - mlx4_en: fix kernel panic when accessing uninitialized mutex (Eugenia Emantayev)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - net/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - net/mlx4: print return values in-case of called function failures (Dotan Barak)   
  - net/mlx4: add explicit message if user ask too few QPs (Dotan Barak)   
  - ib_core: fix contig overflow over 2GB (Yishai Hadas)   
  - mlx4/IB: disables user mode RAW QP VLAN stripping in the RX (Dotan Barak)   
  - mlx4_en: fix kernel panic caused by null pointer dereference (Eugenia Emantayev)   
  - ib/core: Remove annoying message. (Erez Shitrit)   
  - mlx4_core: Fixing leackage of SW multicast entries. (Yevgeny Petrilin)   
  - mlx4_en: set netif_carrier off when port stopped (Eugenia Emantayev)   
  - mlx4_en: Adding info when TX timeout ocures (Yevgeny Petrilin)   
  - mlx4_en: Fixing race when closing TX queue (Eugenia Emantayev)   
  - mlx4_en: fix timestamping for gro flow (Eugenia Emantayev)   
  - mlx4_en: fix a race between napi poll function and RX ring cleanup (Eugenia Emantayev)   
  - mlx4_en: Removed failed adding vlan and not found vlan prints. (Eugenia Emantayev)   
  - mlx4_en: move register_netdev() to the end of mlx4_en_init_netdev() (Eugenia Emantayev)   
  - mlx4_en: Fixed no traffic bug when disable port during promisc mode in a loop. (Aviad Yehezkel)   
  - mlx4_en: Do not disable vlan filter during promisc. (Eugenia Emantayev)   
  - mlx4_core: open 4 msi-x vectors for multifunction (Eugenia Emantayev)   
  - et/mlx4_core: make sure that err is non-zero in __mlx4_add_one error flow. (Jack Morgenstein)   
  - mlx4_core: check that number of QP per MCG entry was not exceeded when adding to the default MCG entry (Alexander Guller)   
  - mlx4_core: Expose mlx4_net_trans_rule_hw_ctrl structure fields (Hadar Hen Zion)   
  - net/mlx4_core: fix memory leak in error flow of flow_spec_to_net_rule() (Dotan Barak)   
  - net/mlx4_core: If memory allocation failed, return error to upper function (Dotan Barak)   
  - mlx4_ib: fix memory leak if QP creation failed (Dotan Barak)   
  - mlx4_ib: Fix IPoIB flow steering after broken by the TSS/RSS support commit (Hadar Hen Zion)   
  - mlx4_ib: Bug fix - allow attaching L2 and L3 rules using ibv_attach_flow (Hadar Hen Zion)   
  - net/mlx4_core: reduce the stack usage of the function mlx4_init_hca() (Dotan Barak)   
  - ib/core: add prints to the cm module. (Erez Shitrit)   
  - rds: fix error flow handling (Dotan Barak)   
  - mlx4/IB: add a message print when the logical link goes up/down (Dotan Barak)   
  - mlx4/ib: clean memory for EQs in case of error flow (Dotan Barak)   
  - mlx4/IB: remove proc entries in case of bad flow (Dotan Barak)   
  - net/mlx4_core: set used number of MTTs when using auto-detection (Dotan Barak)   
  - net/mlx4_core: the number of MTTs should consider log_mtts_per_seg (Dotan Barak)   
  - mlx4/IB: remove RD diagnostics counters (Dotan Barak)   
  - ib_core: check that DMA mapping was successful (Dotan Barak)   
  - mlx4_en: remove an unnecessary test if maxrate is NULL (Dotan Barak)   
  - ib: cmem rlimit support (Yishai Hadas)   
  - net/mlx4_core: limit to 4TB of memory registration (Yishai Hadas)   
  - net/mlx4_core: enable 8TB of memory registration (Yishai Hadas)   
  - net/mlx4_core: num mtt issues (Yishai Hadas)   
  - mlx4_en: do dump eth statistics under mutex (Eugenia Emantayev)   
  - net/mlx4_core: make sure that negative array index isn't used (Dotan Barak)   
  - mlx4_en: fixing the condition before releasing resources (Dotan Barak)   
  - IB/mlx4: fix compilation warning (Dotan Barak)   
  - IB/mlx4: Prevent from all of the users in the system to clear the diag counters (Dotan Barak)   
  - IB/core: Fix compilation warning in kernel 3.5+ (Dotan Barak)   
  - mlx4_ib: Partial fix for ipoib SRIOV (Hadar Hen Zion)   
  - mlx4_ib: prevent mixing enum mlx4_ib_qp_flags type with enum ib_qp_create_flags type (Saeed Mahameed)   
  - IB/core: add module parameter to allow a non-root user to open a RAW QP (Dotan Barak)   
  - mlx4_en: returning NETIF_F_GRO flag to dev->features (Yevgeny Petrilin)   
  - mlx4_ib: add blue flame support for kernel consumers (Eli Cohen)   
  - net/mlx4_core: add sanity check when creating bitmap structure (Dotan Barak)   
  - mlx4_core: supporting 64b counters (Vu Pham)   
  - ib_core: supporting 64b counters using PMA_COUNTERS_EXT mad (Vu Pham)   
  - mlx4_core: fix error flow in case mlx4_reset failed (Dotan Barak)   
  - net/mlx4_core: unmap clear register in case of error flow (Dotan Barak)   
  - mlx4_core: support suspend/resume events (Eli Cohen)   
  - srp: don't release resources if the add_one failed (Dotan Barak)   
  - mlx4_en: Fixed memory leak in case of error flow (Dotan Barak)   
  - ib_core: fix NULL pointer dereference (Dotan Barak)   
  - mlx4_en: queue stop/start counters per ring (Yevgeny Petrilin)   
  - mlx4_en: Using atomic counter to decide when queue is full. (Yevgeny Petrilin)   
  - IB/mlx4: Add support for RSS and TSS QP groups (Shlomo Pongratz)   
  - IB/core: Add RSS and TSS QP groups (Shlomo Pongratz)   
  - mlx4_en: Data path structures are allocated per numa node. (Yevgeny Petrilin)   
  - mlx4_core: ICM pages are allocated on device NUMA node (Yevgeny Petrilin)   
  - mlx4_en: Datapath resources allocated separately (Yevgeny Petrilin)   
  - mlx4_en: fix compilation error on 3.5 (Eugenia Emantayev)   
  - mlx4_en: add timestamp support (Eugenia Emantayev)   
  - mlx4_core: read hca frequency and map internal clock (Eugenia Emantayev)   
  - mlx4_core: add timestamp device capability (Eugenia Emantayev)   
  - mlx4_core: For flow steering unicast ipoib support added new flag to IB header check (Hadar Hen Zion)   
  - mlx4_ib: contig support for control objects (Yishai Hadas)   
  - mlx4: Setting Ethernet port even if interface is not being brought up (Yevgeny Petrilin)   
  - mlx4: Enable fast_drop option (Yevgeny Petrilin)   
  - mlx4_en: suppress page allocation failure warnings (Yevgeny Petrilin)   
  - mlx4_en: Allocation order is 0 on 32 bit systems to avoid allocation failures (Yevgeny Petrilin)   
  - mlx4: Allow high_rate_steer (A0 mode) (Yevgeny Petrilin)   
  - mlx4: Respond to operation request by FW. (Yevgeny Petrilin)   
  - mlx4_core: fix wrong comment about the reason of subtract one from the max_cqes (Dotan Barak)   
  - ib/core: change module_param to module_param_named call. (Erez Shitrit)   
  - ib_core: Use weak ordering for data registered memory (Eli Cohen)   
  - IB/core - Don't modify outgoing DR SMP if first part is LID routed (Ralph Campbell)   
  - mlx4_core: remove use_prio module parameter (Eugenia Emantayev)   
  - net/mlx4: adjust initial value of vl_cap in mlx4_SET_PORT (Or Gerlitz)   
  - mlx4_core: Error message on mtt allocation failure (Marcel Apfelbaum)   
  - mlx4_core: fail device init if num_vfs is negative. (Jack Morgenstein)   
  - IB/core: Control number of retries for SA to leave an MCG (Dotan Barak)   
  - mlx4: More mverbs support (Dotan Barak)   
  - mlx4: add warning prints in case of command timeouts (Dotan Barak)   
  - mlx4_core: Increased Command Timeout for NOP operation (Yevgeny Petrilin)   
  - mlx4: Disable BF on PPC (Dotan Barak)   
  - mlx4: reducing wait during SW reset for 500 msecs (Dotan Barak)   
  - mlx4_ib: check for FW version which properly supports resize_cq. (Dotan Barak)   
  - mlx4_ib: Do not enable blueflame sends if write combining is not available (Jack Morgenstein)   
  - IB/core: Fix create_qp issue relates to qp group type (Yishai Hadas)   
  - mlx4_core: log_num_mtt handling (Yishai Hadas)   
  - mlx4_core: adding 'set_4k_mtu' module parameter as an obsolete one (Yishai Hadas)   
  - mlx4_ib: Fix the SQ size of an RC QP to support masked atomic operation (Dotan Barak)   
  - {NET,IB}/mlx4: 64 byte CQE/EQE support (Or Gerlitz)   
  - ib_core: cmem handling to prevent redundant WARN (Yishai Hadas)   
  - ib_core: rlimit fix when cmem alloc has failed (Yishai Hadas)   
  - IB/mlx4_ib: use 8 bits in mlx4_ib_mmap for command ID instead of 3 (Yishai Hadas)   
  - IB: enable shared mr functionality (Yishai Hadas)   
  - IB/mlx4_ib: shared mr initial handling (Yishai Hadas)   
  - IB/core: infrastructure extensions to be used for shared mr functionality (Yishai Hadas)   
  - IB/mlx4_ib: 'proc' handling (Yishai Hadas)   
  - IB: reg_user_mr changes to include a new field named mr_id (Yishai Hadas)   
  - IB/core: ib_uverbs_reg_mr flow change (Yishai Hadas)   
  - ib_core: symmetric issues with user space. (Yishai Hadas)   
  - mlx4_ib: Use optimal numbers of MTT entries. (Yishai Hadas)   
  - mlx4_ib: implement get_unmapped_area (Yishai Hadas)   
  - ib_core: Exporting capability to control the alignment of the virtual address returned by mmap. (Yishai Hadas)   
  - mlx4_ib: Exporting to user space the contiguous allocation capability by mmap extension (Yishai Hadas)   
  - ib_core: Extending umem to support contiguous memory operations. (Yishai Hadas)   
  - mlx4: make firmware diagnostic counters available via sysfs (Dotan Barak)   
  - mlx4: enable discarding/passing multicast loopback packets by FW/HW. (Dotan Barak)   
  - mlx4_ib: set write-combining flag for userspace blueflame pages (Dotan Barak)   
  - mlx4_core: limit min profile numbers (Dotan Barak)   
  - mlx4_core: allow to use 0 in log_mtts_per_seg (Dotan Barak)   
  - mlx4_core: enable changing default max HCA resource limits. (Dotan Barak)   
  - cma: add module parameter to the response timeout (Arlin Davis)   
  - mlx4: Add mverbs support (Dotan Barak)   
  - mlx4_core: replace sscanf() with simple_strtol() (Dotan Barak)   
  - mlx4: increase the command timeout to 60 seconds (Dotan Barak)   
  - mlx4_core, mlx4_ib, cma, ipoib: Add IB UC flow steering for datagram QP's. (Amir Vadai)   
  - mlx4_ib: add support to flow steering attach with rdmacm applications. (Hadar Hen Zion)   
  - rdma_cm: Implement rdma_get_l2 (Nir Muchtar)   
  - ib_uverbs: Export ib_attach_flow and ib_detach_flow to userspace. (Nir Muchtar)   
  - mlx4_ib: Add support for ib_attach_flow and ib_detach_flow. (Nir Muchtar)   
  - ib_core: Implement ib_attach_flow ib_detach_flow (Nir Muchtar)   
  - mlx4_core: enable RoCE under SRIOV (Jack Morgenstein)   
  - mlx4_core: Adjust update-gids task for RoCE running under SRIOV (Jack Morgenstein)   
  - mlx4_ib: In sysfs, do not allow changing the paravirtualization mapping for pkeys (Jack Morgenstein)   
  - {IB,ETH}/mlx4: Adjust QP1 multiplexing and QP creation for RoCE/SRIOV (Jack Morgenstein)   
  - en/mlx4_core: For RoCE, allow slaves to set the GID entry at that slave's index (Jack Morgenstein)   
  - {IB,ETH}/mlx4: Add ref counting to port MAC table for RoCE (Jack Morgenstein)   
  - mlx4_core: Add mechanism for non trackable mem free (Moshe Lazer)   
  - memtrack: fix get_page/put_page tracking (Jack Morgenstein)   
  - Added memtrack (Vladimir Sokolovsky)   
  - Revert "mlx4_en: fix allocation of CPU affinity reverse-map" (Ajaykumar Hotchandani)   
  - Revert "IPoIB: Call skb_dst_drop() once skb is enqueued for sending" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Increase block layer timeout" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Eliminate state SRP_TARGET_CONNECTING" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Keep processing commands during host removal" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Simplify SCSI error handling" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Introduce srp_handle_qp_err()" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Process all error completions" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Introduce the helper function srp_remove_target()" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Suppress superfluous error messages" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Eliminate state SRP_TARGET_DEAD" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: destroy and recreate QP and CQs when reconnecting" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: send disconnect request without waiting for CM timewait exit" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Allow SRP disconnect through sysfs" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Track connection state properly" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Avoid sending a task management function needlessly" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Avoid endless SCSI error handling loop" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Fail I/O requests if the transport is offline" (Ajaykumar Hotchandani)   
  - Revert "rds: limit the size allocated by rds_message_alloc()" (Ajaykumar Hotchandani)   
  - Revert "net: rds: use this_cpu_* per-cpu helper" (Ajaykumar Hotchandani)   
  - Revert "IB/rds: Correct ib_api use with gs_dma_address/sg_dma_len" (Ajaykumar Hotchandani)   
  - Revert "IB/rds: suppress incompatible protocol when version is known" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: remove __dev* attributes" (Ajaykumar Hotchandani)   
  - Revert "mlx4: change TX coalescing defaults" (Ajaykumar Hotchandani)   
  - Revert "IPoIB: Fix send lockup due to missed TX completion" (Ajaykumar Hotchandani)   
  - Revert "mlx4: 64-byte CQE/EQE support" (Ajaykumar Hotchandani)   
  - Revert "mlx4_en: Remove remnants of LRO support" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Can set maxrate only for TC0" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Set number of rx/tx channels using ethtool" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Use generic etherdevice.h functions." (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Add support for destination MAC in steering rules" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Add QPN enforcement for flow steering rules set by VFs" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Fix error flow in the flow steering wrapper" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Adjustments to Flow Steering activation logic for SR-IOV" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Allow choosing flow steering mode" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_core: Set number of msix vectors under SRIOV mode to firmware defaults" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Fix advertisement of wrong PF context behaviour" (Ajaykumar Hotchandani)   
  - Revert "mlx4_en: fix allocation of device tx_cq" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Initialize RFS filters lock and list in init_netdev" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Disable RFS when running in SRIOV mode" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Fix bridged vSwitch configuration for non SRIOV mode" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Fix TX moderation info loss after set_ringparam is called" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Fix potential deadlock in mlx4_eq_int()" (Ajaykumar Hotchandani)   
  - Revert "IPoIB: Fix crash due to skb double destruct" (Ajaykumar Hotchandani)   
  - Revert "IB/mlx4: Fix spinlock order to avoid lockdep warnings" (Ajaykumar Hotchandani)   
  - Revert "RDMA/cm: Change return value from find_gid_port()" (Ajaykumar Hotchandani)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-7.el6uek]
changelog:
  - qla4xxx: Updated driver version to 5.03.00.03.06.02-uek3 (Tej Parkash) [Orabug: 17220566]  
  - libiscsi: Add missing prints for session and connection sysfs attrs (Adheer Chandravanshi) [Orabug: 17220566]  
  - libiscsi: Add a missing break statement (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Export more firmware info in sysfs (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Only BIOS boot target entries should be at index 0 and 1. (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: discovery_parent_idx can be shown without any check. (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Set IPv6 traffic class if device type is IPv6. (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Use discovery_parent_idx instead of discovery_parent_type (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Allow removal of failed session using logout. (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Exporting new attrs for iscsi session and connection in sysfs (Adheer Chandravanshi) [Orabug: 17220566]  
  - libiscsi: Exporting new attrs for iscsi session and connection in sysfs (Adheer Chandravanshi) [Orabug: 17220566]  
  - scsi_transport_iscsi: Exporting new attrs for iscsi session and connection in sysfs (Adheer Chandravanshi) [Orabug: 17220566]  
  - libiscsi: Added new boot entries in the session sysfs (Eddie Wai) [Orabug: 17220566]  
  - treewide: Fix typo in printk (Masanari Iida) [Orabug: 17220566]  
  - iscsi class, qla4xxx: fix sess/conn refcounting when find fns are used (Mike Christie) [Orabug: 17220566]  
  - qla4xxx: Fix iocb_cnt calculation in qla4xxx_send_mbox_iocb() (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Assign values using correct datatype (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Fix smatch warnings (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Fix sparse warning for qla4xxx_sysfs_ddb_tgt_create (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Silence gcc warning (Vikas Chaudhary) [Orabug: 17220566]  
  - iscsi_tcp: support PF_MEMALLOC/__GFP_MEMALLOC (Mike Christie) [Orabug: 17220566]  
  - libiscsi: avoid unnecessary multiple NULL assignments (Masatake YAMATO) [Orabug: 17220566]  
  - qla4xxx: Added print statements to display AENs (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Use correct value for max flash node entries (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Restrict logout from boot target session using session id (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Use correct flash ddb offset for ISP40XX (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Replace dev type macros with generic portal type macros (Adheer Chandravanshi) [Orabug: 17220566]  
  - scsi_transport_iscsi: Declare portal type string macros for generic use (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Add flash node mgmt support (Adheer Chandravanshi) [Orabug: 17220566]  
  - libiscsi: export function iscsi_switch_str_param (Adheer Chandravanshi) [Orabug: 17220566]  
  - scsi_transport_iscsi: Add flash node mgmt support (Adheer Chandravanshi) [Orabug: 17220566]  
  - qla4xxx: Skip retry of initialize_adapter for ISP80XX (Nilesh Javali) [Orabug: 17220566]  
  - qla4xxx: Assign correct CHAP table address to FLT (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Added missing check for ISP83XX in CHAP related functions (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Fixed request queue count manipulation on response path (Tej Parkash) [Orabug: 17220566]  
  - qla4xxx: Fix debug level to avoid floods of same message (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Pass correct LUN address to firmware in case of lun_reset (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Fix double reset in case of firmware hung for ISP83XX (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Set graceful reset bit for ISP83XX (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Boot from SAN fix for ISP83XX (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Take E-port out of reset before disabling pause frames (Manish Dusane) [Orabug: 17220566]  
  - scsi: replace obsolete NLMSG_* with type safe nlmsg_* (Hong zhi guo) [Orabug: 17220566]  
  - treewide: Fix typos in printk and comment (Masanari Iida) [Orabug: 17220566]  
  - qla4xxx: don't free NULL dma pool (Dan Carpenter) [Orabug: 17220566]  
  - qla4xxx: Fix return code for qla4xxx_session_get_param. (Manish Rangankar) [Orabug: 17220566]  
  - qla4xxx: wait for boot target login response during probe. (Manish Rangankar) [Orabug: 17220566]  
  - qla4xxx: Added support for force firmware dump (Vikas Chaudhary) [Orabug: 17220566]  
  - qla4xxx: Re-register IRQ handler while retrying initialize of adapter (Poornima Vonti) [Orabug: 17220566]  
  - qla4xxx: Throttle active IOCBs to firmware limits (Karen Higgins) [Orabug: 17220566]  
  - qla4xxx: Remove unnecessary code from qla4xxx_init_local_data (Karen Higgins) [Orabug: 17220566]  
  - qla4xxx: Quiesce driver activities while loopback (Nilesh Javali) [Orabug: 17220566]  
  - qla4xxx: Rename MBOX_ASTS_IDC_NOTIFY to MBOX_ASTS_IDC_REQUEST_NOTIFICATION (Nilesh Javali) [Orabug: 17220566]  
  - qla4xxx: Add spurious interrupt messages under debug level 2 (Nilesh Javali) [Orabug: 17220566]  
  - qla4xxx: Correct the validation to check in get_sys_info mailbox (Nilesh Javali) [Orabug: 17220566]  
  - qla4xxx: Pass correct function param to qla4_8xxx_rd_direct (Vikas Chaudhary) [Orabug: 17220566]  
  - scsi_transport_iscsi: export iscsi class session's target_id in sysfs. (Manish Rangankar) [Orabug: 17220566]  
  - qla4xxx: Fix memory corruption issue in qla4xxx_get_ep_fwdb. (Manish Rangankar) [Orabug: 17220566]  
  - qla4xxx: Allow reset in link down case (Harish Zunjarrao) [Orabug: 17220566]  
  - qla4xxx: Fix MBOX intr switching from polling to intr mode for ISP83XX (Vikas Chaudhary) [Orabug: 17220566]  
  - config: enable numa balancing (Jerry Snitselaar) [Orabug: 17018504]  
  - config: disable Transparent Hugepages (Jerry Snitselaar) [Orabug: 17251843]  
  - be2net: Updating version number (Sarveshwar Bandi) [Orabug: 17252720]  
  - be2net: Fix to avoid hardware workaround when not needed (Sarveshwar Bandi) [Orabug: 17252720]  
  - net/trivial: replace numeric with standard PM state macros (Yijing Wang) [Orabug: 17252720]  
  - be2net: Fix 32-bit DMA Mask handling (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Implement initiate FW dump feature for Lancer (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Fix crash on 2nd invocation of PCI AER/EEH error_detected hook (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Mark checksum fail for IP fragmented packets (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Trim padded packets for Lancer (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Pad skb to meet min Tx pkt size in lancer (Somnath Kotur) [Orabug: 17252720]  
  - be2net: cleanup be_get_drvinfo() (Somnath Kotur) [Orabug: 17252720]  
  - be2net: refactor HW workarounds in be_xmit() (Sathya Perla) [Orabug: 17252720]  
  - be2net: bug fix on returning an invalid nic descriptor (Wei Yang) [Orabug: 17252720]  
  - be2net: Avoid double insertion of vlan tags. (Sarveshwar Bandi) [Orabug: 17252720]  
  - be2net: disable TX in be_close() (Sathya Perla) [Orabug: 17252720]  
  - be2net: fix EQ from getting full while cleaning RX CQ (Sathya Perla) [Orabug: 17252720]  
  - be2net: fix payload_len value for GET_MAC_LIST cmd req (Sathya Perla) [Orabug: 17252720]  
  - be2net: provision VF resources before enabling SR-IOV (Sathya Perla) [Orabug: 17252720]  
  - be2net: Fix to fail probe if MSI-X enable fails for a VF (Somnath Kotur) [Orabug: 17252720]  
  - be2net: avoid napi_disable() when it has not been enabled (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Fix firmware download for Lancer (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Fix to receive Multicast Packets when Promiscuous mode is enabled on certain devices (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: Fix to show tx priority pause counter in ethtool -S (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: Fix to use 32-bit stats to report rx_drops_no_fragment (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: Fix to use version 2 of cq_create for SkyHawk-R devices (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: FLR must be first cmd issued to Lancer FW (Kalesh AP) [Orabug: 17252720]  
  - be2net: Use GET_FUNCTION_CONFIG V1 cmd (Kalesh AP) [Orabug: 17252720]  
  - be2net: Fix to show wol disabled/enabled state correctly. (Sarveshwar Bandi) [Orabug: 17252720]  
  - be2net: Fixed memory leak (Suresh Reddy) [Orabug: 17252720]  
  - be2net: Avoid diagnostic test in certain versions of firmware to avoid NIC freeze. (Suresh Reddy) [Orabug: 17252720]  
  - be2net: Renamed rx_address_mismatch_errors to rx_address_filtered (Suresh Reddy) [Orabug: 17252720]  
  - be2net: Add support for setting and getting rx flow hash options (Suresh Reddy) [Orabug: 17252720]  
  - be2net: Fix PVID tag offload for packets with inline VLAN tag. (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: Remove an incorrect pvid check in Tx (Ajit Khaparde) [Orabug: 17252720]  
  - be2net: enable IOMMU pass through for be2net (Craig Hada) [Orabug: 17252720]  
  - be2net: Use GET_PROFILE_CONFIG V1 cmd for BE3-R (Vasundhara Volam) [Orabug: 17252720]  
  - be2net: Avoid flashing BE3 UFI on BE3-R chip. (Vasundhara Volam) [Orabug: 17252720]  
  - be2net: Don't log "Out of MCCQ wrbs" error (Vasundhara Volam) [Orabug: 17252720]  
  - be2net: Use TXQ_CREATE_V2 cmd (Vasundhara Volam) [Orabug: 17252720]  
  - be2net: take care of __vlan_put_tag return value (Ivan Vecera) [Orabug: 17252720]  
  - be2net: remove unused variable 'sge' (Ivan Vecera) [Orabug: 17252720]  
  - drivers:net: dma_alloc_coherent: use __GFP_ZERO instead of memset(, 0) (Joe Perches) [Orabug: 17252720]  
  - drivers:net: Remove dma_alloc_coherent OOM messages (Joe Perches) [Orabug: 17252720]  
  - be2net: Use new F/W mailbox cmd to manipulate interrupts. (Somnath Kotur) [Orabug: 17252720]  
  - be2net: enable interrupts in be_probe() (RoCE and other ULPs need them) (Somnath Kotur) [Orabug: 17252720]  
  - be2net: Update copyright year (Vasundhara Volam) [Orabug: 17252720]  
  - be2net: use CSR-BAR SEMAPHORE reg for BE2/BE3 (Sathya Perla) [Orabug: 17252720]  
  - benet: Wait f/w POST until timeout (Gavin Shan) [Orabug: 17252720]  
  - be2net: remove BUG_ON() in be_mcc_compl_is_new() (Sathya Perla) [Orabug: 17252720]  
  - be2net: update driver version to 4.6.x (Sathya Perla) [Orabug: 17252720]  
  - be2net: fix re-loaded PF driver to re-gain control of its VFs (Sathya Perla) [Orabug: 17252720]  
  - ethtool: fix drvinfo strings set in drivers (Jiri Pirko) [Orabug: 17252720]  
  - block: do not pass disk names as format strings (Kees Cook) [Orabug: 17230056] {CVE-2013-2851} 
  - libceph: Fix NULL pointer dereference in auth client code (Tyler Hicks) [Orabug: 17230095] {CVE-2013-1059} 
  - Btrfs: re-add root to dead root list if we stop dropping it (Josef Bacik)   
  - Btrfs: fix lock leak when resuming snapshot deletion (Josef Bacik)   
  - Btrfs: only do the tree_mod_log_free_eb if this is our last ref (Josef Bacik)   
  - Btrfs: hold the tree mod lock in __tree_mod_log_rewind (Josef Bacik)   
  - Btrfs: fix oops when recovering the file data by scrub function (Miao Xie)   
  - Btrfs: unlock extent range on enospc in compressed submit (Josef Bacik)   
  - btrfs: do away with non-whole_page extent I/O (Alexandre Oliva)   
  - btrfs: don't stop searching after encountering the wrong item (Gabriel de Perthuis)   
  - Btrfs: don't call readahead hook until we have read the entire eb (Josef Bacik)   
  - Btrfs: fix possible infinite loop in slow caching (Josef Bacik)   
  - Btrfs: fix lockdep warning (Josef Bacik)   
  - Btrfs: don't force pages under writeback to finish when aborting (Josef Bacik)   
  - Btrfs: fix unlock after free on rewinded tree blocks (Jan Schmidt)   
  - Btrfs: fix accessing the root pointer in tree mod log functions (Jan Schmidt)   
  - Btrfs: fix tree mod log regression on root split operations (Jan Schmidt)   
  - Btrfs: fix bad extent logging (Josef Bacik)   
  - Btrfs: log ram bytes properly (Josef Bacik)   
  - Btrfs: fix memory leak in btrfs_create_tree() (Tsutomu Itoh)   
  - Btrfs: fix warning of free_extent_map (Liu Bo)   
  - Btrfs: fix warning when creating snapshots (Liu Bo)   
  - Btrfs: fix missing deleted items in btrfs_clean_quota_tree (Wang Shilong)   
  - Btrfs: fix memory leak of log roots (Liu Bo)   
  - Btrfs: fix NULL pointer after aborting a transaction (Liu Bo)   
  - Btrfs: do not change inode flags in rename (Liu Bo)   
  - Btrfs: use reserved space for creating a snapshot (Liu Bo)   
  - Btrfs: make sure NODATACOW also gets NODATASUM set (Josef Bacik)   
  - Btrfs: fix backref walking race with tree deletions (Jan Schmidt)   
  - Btrfs: fix wrong outstanding_extents when doing DIO write (Miao Xie)   
  - Btrfs: fix cleaner thread not working with inode cache option (Liu Bo)   
  - Btrfs: fix the deadlock between the transaction start/attach and commit (Miao Xie)   
  - Btrfs: eliminate a use-after-free in btrfs_balance() (Ilya Dryomov)   
  - Btrfs: fix deadlock due to unsubmitted (Miao Xie)   
  - Btrfs: fix memory leak of pending_snapshot->inherit (Miao Xie)   
  - Btrfs: fix the race between bio and btrfs_stop_workers (Miao Xie)   
  - Btrfs: handle errors in compression submission path (Josef Bacik)   
  - Btrfs: rework the overcommit logic to be based on the total size (Josef Bacik)   
  - Btrfs: unreserve space if our ordered extent fails to work (Josef Bacik)   
  - Btrfs: fix how we discard outstanding ordered extents on abort (Josef Bacik)   
  - Btrfs: fix freeing delayed ref head while still holding its mutex (Josef Bacik)   
  - Btrfs: do not overcommit if we don't have enough space for global rsv (Josef Bacik)   
  - Btrfs: remove extent mapping if we fail to add chunk (Josef Bacik)   
  - Btrfs: fix chunk allocation error handling (Josef Bacik)   
  - Btrfs: fix crash in log replay with qgroups enabled (Arne Jansen)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-6.el6uek]
changelog:
  - mpt2sas: update from 16.05.01.00 to 17.00.00.00 (Jerry Snitselaar) [Orabug: 17237382]  
  - enable VMware module vsock,vmw_vmci,vmw_vsock_vmci_transport (Vaughan Cao) [Orabug: 16957210]  
  - Backport VMCI and vSockets from 3.10 (Andy King) [Orabug: 16957210]  
  - vmxnet3: prevent div-by-zero panic when ring resizing uninitialized dev (Bhavesh Davda) [Orabug: 17215008]  
  - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17079717]  
  - build,drm: enable building of vmwgfx driver (Jerry Snitselaar) [Orabug: 17158893]  
  - be2iscsi: Bump the driver version to 10.0.467.0 (John Soni Jose) [Orabug: 17233074]  
  - be2iscsi: Fix issue in passing the exp_cmdsn and max_cmdsn (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix possible reentrancy issue in be_iopoll (Shlomo Pongratz) [Orabug: 17233074]  
  - be2scsi: Update copyright dates to 2013 (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix checking Adapter state while establishing CXN (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix dynamic CID allocation Mechanism in driver (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi : Fix the NOP-In handling code path (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix the Port Link Status issue (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix displaying the Active Session Count from driver (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix displaying the FW Version from driver. (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix support for DEFQ extension (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix MACRO for checking the adapter type (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix freeing CXN specific driver resources. (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix MSIX support in SKH-R to 32 (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix MBX Command issues (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix returning Failure when MBX fails with Insufficient buffer error (Jayamohan Kallickal) [Orabug: 17233074]  
  - be2iscsi: Fix lack of uninitialize pattern to FW (Jayamohan Kallickal) [Orabug: 17233074]  
  - treewide: Fix typo in printk and comments (Masanari Iida) [Orabug: 17233074]  
  - neighbour: fix a race in neigh_destroy() (Eric Dumazet)   
  - mpt3sas: Bump driver version to v02.100.00.00 (Sreekanth Reddy) [Orabug: 17187623]  
  - mpt3sas: when async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed (Sreekanth Reddy) [Orabug: 17187623]  
  - mpt3sas: MPI2.5 Rev F v2.5.1.1 specification (Sreekanth Reddy) [Orabug: 17187623]  
  - mpt3sas: Infinite loops can occur if MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Sreekanth Reddy) [Orabug: 17187623]  
  - mpt3sas: fix for kernel panic when driver loads with HBA conected to non LUN 0 configured expander (Sreekanth Reddy) [Orabug: 17187623]  
  - mpt3sas: Updated the Hardware timing requirements (Sreekanth Reddy) [Orabug: 17187623]  
  - mpt3sas: 2013 source code copyright (Sreekanth Reddy) [Orabug: 17187623]  
  - fib_trie: potential out of bounds access in trie_show_stats() (Jerry Snitselaar) [Orabug: 17215539]  
  - Revert "xen/pat: Disable PAT using pat_enabled value." (Jerry Snitselaar) [Orabug: 17176404]  
  - sxge: Check link state before xmit (Joe Jin) [Orabug: 17201220]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-5.el6uek]
changelog:
  - writeback fix bdi thread race in mark_inode_dirty (UEK3) (Srinivas Eeda)   
  - mpt2sas: update to LSI version 16.05.01.00 (Maxim Uvarov) [Orabug: 16730165]  
  - megaraid_sas driver update from 06.504.01.00-rc1 to version 06.600.18.00 (Maxim Uvarov) [Orabug: 17177382]  
  - Specfile changes for sparc (Dave Kleikamp)   
  - sunvdc: fix typo and remove unused function (Dave Kleikamp)   
  - sparc: rcu_needs_cpu() needs second argument (Dave Kleikamp)   
  - sparc: add back TIF_FREEZE to fix a build break (Dave Kleikamp)   
  - sparc: fix typo in smp_64.h (Dave Kleikamp)   
  - writeback: Fix periodic writeback after fs mount (Jan Kara) [Orabug: 17185874]  
  - [SCSI] scsi_transport_iscsi: fix error return code in iscsi_transport_init() (Wei Yongjun) [Orabug: 17153681]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-4.el6uek]
changelog:
  - configs: turn on sxge (Maxim Uvarov)   
  - [net] add sxge and sxgevf drivers (Maxim Uvarov) [Orabug: 16443168]  
  - sparc64 - userspace VA layout (bob picco)   
  - kernel: freezer: restore TIF_FREEZE (Sasha Levin)   
  - Revert "megaraid_sas: Big endian support" (Maxim Uvarov) [Orabug: 17167688]  
  - bnx2x correct firmwares ihex (Maxim Uvarov) [Orabug: 17034501]  
  - config changes from uek2 (Allen Pais)   
  - sparc64: fatal trap should stop all cpus (Dave Kleikamp)   
  - sunvdc TX TEMPORARY workaround (Allen Pais)   
  - vdisk geometry (Allen Pais)   
  - sunvet (Allen Pais)   
  - sunvdc cdrom support (Allen Pais)   
  - xen-netfront: use skb_partial_csum_set() to simplify the codes (Li RongQing)   
  - xen-netfront: split event channels support for Xen frontend driver (Wei Liu)   
  - xen-netfront: avoid leaking resources when setup_netfront fails (Wei Liu)   
  - xen-netfront: reduce gso_max_size to account for max TCP header (Wei Liu)   
  - xen-netfront: frags -> slots in log message (Wei Liu)   
  - xen-netfront: frags -> slots in xennet_get_responses (Wei Liu)   
  - xen-netfront: remove unused variable `extra' (Wei Liu)   
  - xen-netback: xenbus.c: use more current logging styles (Wei Liu)   
  - xen: Use more current logging styles (Joe Perches)   
  - xen-netback: double free on unload (Dan Carpenter)   
  - xen-netback: don't de-reference vif pointer after having called xenvif_put() (Jan Beulich)   
  - perf sparc4 dwarf (Allen Pais)   
  - xen-netback: split event channels support for Xen backend driver (Wei Liu)   
  - xen-netback: enable user to unload netback module (Wei Liu)   
  - xen-netback: remove dead code (Wei Liu)   
  - xen-netback: better names for thresholds (Wei Liu)   
  - xen-netback: avoid allocating variable size array on stack (Wei Liu)   
  - xen-netback: remove redundent parameter in netbk_count_requests (Wei Liu)   
  - xen-netback: don't disconnect frontend when seeing oversize packet (Wei Liu)   
  - xen-netback: coalesce slots in TX path and fix regressions (Wei Liu)   
  - xen-netback: fix sparse warning (stephen hemminger)   
  - do_rt_sigreturn - minor clean up (bob picco)   
  - remove sparc support (bob picco)   
  - cpu_idle - add rcu needs cpu to yield decision (bob picco)   
  - sparc64_yield - consolidate conditions for enter  yield (Allen Pais)   
  - small clean up - isolate CPU_HOTPLUG in include file (Allen Pais)   
  - xen-netback: remove skb in xen_netbk_alloc_page (Wei Liu)   
  - Revert "xen: netback: remove redundant xenvif_put" (David S. Miller)   
  - xen: netback: remove redundant xenvif_put (Andrew Jones)   
  - xen-netback: allow changing the MAC address of the interface (Matt Wilson)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-3.el6uek]
changelog:
  - xen/netback: correctly calculate required slots of skb. (Annie Li) [Orabug: 16934362]  
  - megaraid_sas: Big endian support (Martin K. Petersen)   
  - sparc/ldom sysfs now shows only CPUs assigned to VM, not all in MD (Allen Pais)   
  - ixgbe: Look up MAC address on SPARC systems (Allen Pais)   
  - bnx2x: update fw to 7.8.2 (Yuval Mintz)   
  - x86 idle: remove mwait_idle() and "idle=mwait" cmdline param (Len Brown) [Orabug: 17034508]  
  - Revert "xen/pci: Use PCI_MSIX_TABLE_BIR, not PCI_MSIX_FLAGS_BIRMASK" (Konrad Rzeszutek Wilk)   
  - Revert "xen/pci: Used cached MSI-X capability offset" (Konrad Rzeszutek Wilk)   
  - Revert "xen-pciback: more uses of cached MSI-X capability offset" (Konrad Rzeszutek Wilk)   
  - xen-blkback: check the number of iovecs before allocating a bios (Roger Pau Monne)   
  - xen: Convert printks to pr_<level> (Joe Perches)   
  - xen/time: remove blocked time accounting from xen "clockchip" (Laszlo Ersek)   
  - xen: ifdef CONFIG_HIBERNATE_CALLBACKS xen_*_suspend (Stefano Stabellini)   
  - xen/pcifront: Deal with toolstack missing 'XenbusStateClosing' state. (Konrad Rzeszutek Wilk)   
  - xen/time: Free onlined per-cpu data structure if we want to online it again. (Konrad Rzeszutek Wilk)   
  - xen/time: Check that the per_cpu data structure has data before freeing. (Konrad Rzeszutek Wilk)   
  - xen/time: Don't leak interrupt name when offlining. (Konrad Rzeszutek Wilk)   
  - xen/time: Encapsulate the struct clock_event_device in another structure. (Konrad Rzeszutek Wilk)   
  - xen/spinlock: Don't leak interrupt name when offlining. (Konrad Rzeszutek Wilk)   
  - xen/smp: Don't leak interrupt name when offlining. (Konrad Rzeszutek Wilk)   
  - xen/smp: Set the per-cpu IRQ number to a valid default. (Konrad Rzeszutek Wilk)   
  - xen/smp: Introduce a common structure to contain the IRQ name and interrupt line. (Konrad Rzeszutek Wilk)   
  - xen/smp: Coalesce the free_irq calls in one function. (Konrad Rzeszutek Wilk)   
  - xen-pciback: fix error return code in pcistub_irq_handler_switch() (Wei Yongjun)   
  - microcode_xen: Add support for AMD family >= 15h (Ian Campbell)   
  - x86/microcode: check proper return code. (Ben Guthro)   
  - xen: add CPU microcode update driver (Jeremy Fitzhardinge)   
  - x86/cpa: Use pte_attrs instead of pte_flags on CPA/set_p.._wb/wc operations. (Konrad Rzeszutek Wilk)   
  - Revert "xen/pat: Disable PAT support for now." (Konrad Rzeszutek Wilk)   
  - Revert "xen/pat: Disable PAT using pat_enabled value." (Konrad Rzeszutek Wilk)   
  - xen / ACPI / sleep: Register an acpi_suspend_lowlevel callback. (Konrad Rzeszutek Wilk)   
  - x86 / ACPI / sleep: Provide registration for acpi_suspend_lowlevel. (Konrad Rzeszutek Wilk)   
  - xen/smp: Fixup NOHZ per cpu data when onlining an offline CPU. (Konrad Rzeszutek Wilk)   
  - xenbus_client.c: correct exit path for xenbus_map_ring_valloc_hvm (Wei Liu)   
  - xen-pciback: more uses of cached MSI-X capability offset (Jan Beulich)   
  - xen: Clean up apic ipi interface (Stefan Bader)   
  - xenbus: save xenstore local status for later use (Aurelien Chartier)   
  - xenbus: delay xenbus frontend resume if xenstored is not running (Aurelien Chartier)   
  - xen: Fixed assignment error in if statement (Lisa Nguyen)   
  - xen/xenbus: Fixed over 80 character limit issue (Lisa Nguyen)   
  - xen/xenbus: Fixed indentation error in switch case (Lisa Nguyen)   
  - xen/privcmd: fix condition in privcmd_close() (Dan Carpenter)   
  - xen/pci: Used cached MSI-X capability offset (Bjorn Helgaas)   
  - xen/pci: Use PCI_MSIX_TABLE_BIR, not PCI_MSIX_FLAGS_BIRMASK (Bjorn Helgaas)   
  - xen: clear IRQ_NOAUTOEN and IRQ_NOREQUEST (Julien Grall)   
  - xen: mask x2APIC feature in PV (Zhenzhong Duan)   
  - xen: SWIOTLB is only used on x86 (Arnd Bergmann)   
  - xen/spinlock: Fix check from greater than to be also be greater or equal to. (Konrad Rzeszutek Wilk)   
  - xen/smp/pvhvm: Don't point per_cpu(xen_vpcu, 33 and larger) to shared_info (Konrad Rzeszutek Wilk)   
  - xen/vcpu: Document the xen_vcpu_info and xen_vcpu (Konrad Rzeszutek Wilk)   
  - xen/vcpu/pvhvm: Fix vcpu hotplugging hanging. (Konrad Rzeszutek Wilk)   
  - xen: resolve section mismatch warnings in xen-acpi-processor (Ben Guthro)   
  - xen: Re-upload processor PM data to hypervisor after S3 resume (v2) (Ben Guthro)   
  - xen/smp: Unifiy some of the PVs and PVHVM offline CPU path (Konrad Rzeszutek Wilk)   
  - xen/smp/pvhvm: Don't initialize IRQ_WORKER as we are using the native one. (Konrad Rzeszutek Wilk)   
  - xen/spinlock: Disable IRQ spinlock (PV) allocation on PVHVM (Konrad Rzeszutek Wilk)   
  - xen/spinlock: Check against default value of -1 for IRQ line. (Konrad Rzeszutek Wilk)   
  - xen/time: Add default value of -1 for IRQ and check for that. (Konrad Rzeszutek Wilk)   
  - xen/events: Check that IRQ value passed in is valid. (Konrad Rzeszutek Wilk)   
  - xen/time: Fix kasprintf splat when allocating timer%d IRQ line. (Konrad Rzeszutek Wilk)   
  - xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU online/offline (Konrad Rzeszutek Wilk)   
  - xen/smp: Fix leakage of timer interrupt line for every CPU online/offline. (Konrad Rzeszutek Wilk)   
  - xen kconfig: fix select INPUT_XEN_KBDDEV_FRONTEND (Andrew Jones)   
  - xen: drop tracking of IRQ vector (Jan Beulich)   
  - x86/xen: populate boot_params with EDD data (David Vrabel)   
  - xen-blkfront: set blk_queue_max_hw_sectors correctly (Roger Pau Monne)   
  - xen-blkback: workaround compiler bug in gcc 4.1 (Roger Pau Monne)   
  - xen/blkback: Check for insane amounts of request on the ring (v6). (Konrad Rzeszutek Wilk)   
  - xen/io/ring.h: new macro to detect whether there are too many requests on the ring (Jan Beulich)   
  - xen/blkback: Check device permissions before allowing OP_DISCARD (Konrad Rzeszutek Wilk)  {CVE-2013-2140} 
  - xen/blkback: Use physical sector size for setup (Stefan Bader)   
  - xen-blkback/sysfs: Move the parameters for the persistent grant features (Konrad Rzeszutek Wilk)   
  - xen-blkfront: Introduce a 'max' module parameter to alter the amount of indirect segments. (Konrad Rzeszutek Wilk)   
  - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne)   
  - xen-blkback: allocate list of pending reqs in small chunks (Roger Pau Monne)   
  - xen-block: implement indirect descriptors (Roger Pau Monne)   
  - xen-blkback: expand map/unmap functions (Roger Pau Monne)   
  - xen-blkback: make the queue of free requests per backend (Roger Pau Monne)   
  - xen-blkback: move pending handles list from blkbk to pending_req (Roger Pau Monne)   
  - xen-blkback: implement LRU mechanism for persistent grants (Roger Pau Monne)   
  - xen-blkback: use balloon pages for all mappings (Roger Pau Monne)   
  - xen-blkback: print stats about persistent grants (Roger Pau Monne)   
  - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk)   
  - xen/events: Handle VIRQ_TIMER before any other hardirq in event loop. (Keir Fraser)   
  - xen/events: avoid race with raising an event in unmask_evtchn() (David Vrabel)   
  - xen/mmu: Move the setting of pvops.write_cr3 to later phase in bootup. (Konrad Rzeszutek Wilk)   
  - xen/acpi-stub: Disable it b/c the acpi_processor_add is no longer called. (Konrad Rzeszutek Wilk)   
  - xen-pciback: notify hypervisor about devices intended to be assigned to guests (Jan Beulich)   
  - xen/acpi-processor: Don't dereference struct acpi_processor on all CPUs. (Konrad Rzeszutek Wilk)   
  - xen/acpi: remove redundant acpi/acpi_drivers.h include (Liu Jinsong)   
  - xen: arm: mandate EABI and use generic atomic operations. (Ian Campbell)   
  - acpi: Export the acpi_processor_get_performance_info (Konrad Rzeszutek Wilk)   
  - xen/pciback: Don't disable a PCI device that is already disabled. (Konrad Rzeszutek Wilk)   
  - xenbus: fix compile failure on ARM with Xen enabled (Steven Noonan)   
  - xen/pci: We don't do multiple MSI's. (Konrad Rzeszutek Wilk)   
  - xen/pat: Disable PAT using pat_enabled value. (Konrad Rzeszutek Wilk)   
  - xen/acpi: xen cpu hotplug minor updates (Liu Jinsong)   
  - xen/acpi: xen memory hotplug minor updates (Liu Jinsong)   
  - xen: event channel arrays are xen_ulong_t and not unsigned long (Ian Campbell)   
  - xen: Send spinlock IPI to all waiters (Stefan Bader)   
  - xen: introduce xen_remap, use it instead of ioremap (Stefano Stabellini)   
  - xen: close evtchn port if binding to irq fails (Wei Liu)   
  - xen-evtchn: correct comment and error output (Wei Liu)   
  - xen/tmem: Add missing %s in the printk statement. (Konrad Rzeszutek Wilk)   
  - xen/acpi: move xen_acpi_get_pxm under CONFIG_XEN_DOM0 (Liu Jinsong)   
  - xen/acpi: ACPI cpu hotplug (Liu Jinsong)   
  - xen/acpi: Move xen_acpi_get_pxm to Xen's acpi.h (Liu Jinsong)   
  - xen/stub: driver for CPU hotplug (Liu Jinsong)   
  - xen/acpi: ACPI memory hotplug (Liu Jinsong)   
  - xen/stub: driver for memory hotplug (Liu Jinsong)   
  - xen: implement updated XENMEM_add_to_physmap_range ABI (Ian Campbell)   
  - xen/smp: Move the common CPU init code a bit to prep for PVH patch. (Konrad Rzeszutek Wilk)   
  - xen-blkfront: remove frame list from blk_shadow (Roger Pau Monne)   
  - xen-blkfront: pre-allocate pages for requests (Roger Pau Monne)   
  - xen-blkback: don't store dev_bus_addr (Roger Pau Monne)   
  - xen-blkfront: switch from llist to list (Roger Pau Monne)   
  - xen-blkback: fix foreach_grant_safe to handle empty lists (Roger Pau Monne)   
  - xen-blkfront: replace kmalloc and then memcpy with kmemdup (Mihnea Dobrescu-Balaur)   
  - xen-blkback: fix dispatch_rw_block_io() error path (Jan Beulich)   
  - xen/blkback: Change statistics counter types to unsigned (Zoltan Kiss)   
  - xen/blkback: correctly respond to unknown, non-native requests (David Vrabel)   
  - xen/xen-blkback: preq.dev is used without initialized (Chen Gang)   
  - xen-blkback: use balloon pages for persistent grants (Roger Pau Monne)   
  - xen-blkfront: drop the use of llist_for_each_entry_safe (Konrad Rzeszutek Wilk) [Orabug: 16263164]  
  - xen/blkback: Don't trust the handle from the frontend. (Konrad Rzeszutek Wilk)   
  - xen-blkback: do not leak mode property (Jan Beulich)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-2.el6uek]
changelog:
  - scsi_prep_fn() check for empty queue (Maxim Uvarov) [Orabug: 17015179]  
  - CONFIG_SCSI_VIRTIO=m (Maxim Uvarov) [Orabug: 17002820]  
  - kernel spec: comment out pesign requirement (Maxim Uvarov)   
  - remove i686 build files (Maxim Uvarov)   
  - ixgbevf driver update from 2.7.12-k to 2.8.7 (Maxim Uvarov)   
  - ixgbe update from 3.11.33-k to 3.15.1 (Maxim Uvarov)   
  - igbvf driver update from 2.0.2-k to 2.3.2 (Maxim Uvarov)   
  - e1000e driver update from 2.1.4-k to 2.4.14-NAPI (Maxim Uvarov)   
  - spec: change kernel version to uek3 (Maxim Uvarov)   
  - igb driver update from 4.1.2-k to 4.3.0 (Maxim Uvarov)   
  - support sparc64x chip type in cpumap (Allen Pais)   
  - cpu hw caps support for sparc64x (Allen Pais)   
  - correctly recognize SPARC64-X chips (Allen Pais)   
  - OVPMAI: modified files to include ovmapi driver. (Cathy Avery) Merge OVMAPI
  [Orabug: 16443145]  
  - OVMAPI: Added uek2 driver to build. (Cathy Avery) Merge OVMAPI
  [Orabug: 16443145]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-1.el6uek]
changelog:
  - kconfig: turn on rcu_trace and rcu_torture_test (Maxim Uvarov) 
  - sparc64 Kconfig and configs V1 (bob picco) 
  - sparc64 irq_64 section mismatch fix (bob picco) 
  - sparc64 sparse irq (bob picco) 
  - sparc64 boot option open up /dev/mem again (bob picco) 
  - sparc64 add mem to iomem resource (bob picco) 
  - sparc64 strict_devmem (bob picco) 
  - sparc64 find_node LDOM (bob picco) 
  - sparc64 address-congruence property (bob picco) 
  - sparc64 kconfig four level page table (bob picco) 
  - sparc64 four level page table support (bob picco) 
  - sparc64 move three level page table scheme (bob picco) 
  - sparc64 expand linear mapping region (bob picco) 
  - ioat3: add missing DMA unmap to ioat_xor_val_self_test() (Bartlomiej Zolnierkiewicz) [Orabug: 16495543] 
  - perf/x86: Add Intel IvyBridge event scheduling constraints (Stephane Eranian) [Orabug: 16495525] 
  - ksplice: Clear garbage data on the kernel stack when handling signals (Nelson Elhage) 
  - spec: ol6 add multipath version deps (Maxim Uvarov) [Orabug: 16763586] 
  - spec: fix suffix order of a directory name (Guangyu Sun) [Orabug: 16682371] 
  - SPEC: add x86_energy_perf_policy tool Add tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy to ol5 ol6 uek kernel rpmbuild spec file and create shell wrapper for this tool. (ethan.zhao) [Orabug: 16036151] 
  - spec: fix instalation if hardlink is installed (Maxim Uvarov) 
  - SPEC: fix doc build (Guru Anbalagane) 
  - spec: unique debuginfo (Maxim Uvarov) [Orabug: 16245366] 
  - Enable CONFIG_SUNRPC_DEBUG by default. (Todd Vierling) [Orabug: 16879097] 
  - x86: Add Xen kexec control code size check to linker script (Daniel Kiper) 
  - drivers/xen: Export vmcoreinfo through sysfs (Daniel Kiper) 
  - x86/xen/enlighten: Add init and crash kexec/kdump hooks (Daniel Kiper) 
  - x86/xen: Add kexec/kdump makefile rules (Daniel Kiper) 
  - x86/xen: Add x86_64 kexec/kdump implementation (Daniel Kiper) 
  - x86/xen: Add i386 kexec/kdump implementation (Daniel Kiper) 
  - x86/xen: Register resources required by kexec-tools (Daniel Kiper) 
  - x86/xen: Introduce architecture dependent data for kexec/kdump (Daniel Kiper) 
  - xen: Introduce architecture independent data for kexec/kdump (Daniel Kiper) 
  - x86/kexec: Add extra pointers to transition page table PGD, PUD, PMD and PTE (Daniel Kiper) 
  - kexec: introduce kexec_ops struct (Daniel Kiper) 
  - spec: inc sublevel to 13 (Maxim Uvarov) 
  - spec: add /boot/vmlinuz*.hmac needed for fips mode (John Haxby) [Orabug: 16807114] 
  - spec: baselevel 12 (Maxim Uvarov) 
  - Fix version.h include due to UAPI change in 3.7 (Dwight Engen) [Orabug: 16526862] 
  - mtip32xx: set config option to enable build (Jerry Snitselaar) [Orabug: 16745449] 
  - mpt3sas: set config options to enable build (Jerry Snitselaar) [Orabug: 16745449] 
  - spec: baselevel 8 (Maxim Uvarov) 
  - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk) 
  - Fix problem in Xen pvhugepages where page table walk to lock/unlock page table pages needed to be taught about hugepages. (Dave McCracken) 
  - Add support for pv hugepages and support for huge balloon pages. (Dave McCracken) 
  - update-el use 6.4 (Maxim Uvarov) 
  - Spec: uek3/v3.8 initial build scripts (Maxim Uvarov) 
  - scripts/sign-file fix typo (Maxim Uvarov) 
  - kbuild: AFTER_LINK (Roland McGrath) 
  - MODSIGN: Simplify Makefile with a Kconfig helper (Michal Marek) 
  - MODSIGN: Add option to not sign modules during modules_install (Michal Marek) 
  - MODSIGN: Specify the hash algorithm on sign-file command line (Michal Marek) 
  - bnx2: Update driver to use new mips firmware. (Joe Jin) 
  - ipmi: make kcs timeout parameters as module options (Pavel Bures) 
  - perf: fix x86 compilation fix (Maxim Uvarov) 
  - ocfs2: Add datavolume mount option (Guru Anbalagane) [Orabug: 16533805] 
  - update-el use 6.4 (Maxim Uvarov) 
  - Spec: uek3/v3.8 initial build scripts (Maxim Uvarov) 
  - scripts/sign-file fix typo (Maxim Uvarov) 
  - kbuild: AFTER_LINK (Roland McGrath) 
  - MODSIGN: Simplify Makefile with a Kconfig helper (Michal Marek) 
  - MODSIGN: Add option to not sign modules during modules_install (Michal Marek) 
  - MODSIGN: Specify the hash algorithm on sign-file command line (Michal Marek) 
  - bnx2: Update driver to use new mips firmware. (Joe Jin) 
  - ipmi: make kcs timeout parameters as module options (Pavel Bures) 
  - perf: fix x86 compilation fix (Maxim Uvarov) 
  - Linux 3.8.13 (Greg Kroah-Hartman) This is the 3.8.13 stable release


author: Jan Kaluza <jkaluza@redhat.com> 5.04-14
changelog:
  - fix #795425 - detect vdi images
  - fix #795761 - detect qed images
  - fix #801711 - uncompress bzip2 archives using -z parameter
  - fix #797784 - read patterns from ~/.magic.mgc


author: Jan Kaluza <jkaluza@redhat.com> 5.04-13
changelog:
  - fix #688136 - fixed the patch from previous commit
  - fix #719583 - support for local magic file in /etc/magic


author: Jan Kaluza <jkaluza@redhat.com> 5.04-12
changelog:
  - fix #758109 - detect ia64 swap
  - fix #760083 - print RPM packages names
  - fix #709846 - detect BIOS headers
  - fix #688136 - remove weak msdos patterns
  - fix #747999 - improve lzma detection
  - fix #733229 - magic pattern for python function detection


author: Jan Kaluza <jkaluza@redhat.com> 5.04-8
changelog:
  - fix #676045 - detect all RPM architectures
  - fix #712992 - detect noarch RPM packages
  - fix #688700 - detect s390 kernel
  - fix #692098 - do not try to get coredump informations from normal binary
  - fix #712988 - do not handle Python scripts as binary files
  - fix #690801 - fixed grammar mistakes in man page
  - fix #675691 - improve TeX recognition


author: Jan Kaluza <jkaluza@redhat.com> 5.04-6
changelog:
  - fix #637782 - identify the zip64 format correctly
  - fix #643046 - recognize volume_key escrow packets
  - fix #594083 - improve Python recognition
  - fix #608686 - mention return code in manpage
  - fix #610795 - recognize webm content
  - fix #670125 - don't identify GFS2 filesystems as GFS1 filesystems


author: Daniel Novotny <dnovotny@redhat.com> 5.03-6
changelog:
  - fix #510429 -  file is confused by string "/* (if any) */" 
         in C header and claims it "Lisp/Scheme program text"


author: Daniel Novotny <dnovotny@redhat.com> 5.00-5
changelog:
  - added two font definitions (#491594, #491595)
    and a fix for file descriptor leak when MAGIC_COMPRESS used (#491596)


author: Daniel Novotny <dnovotny@redhat.com> 4.26-2
changelog:
  - fix #463809: rpmbuild rpmfcClassify: Assertion fails on some binary files
    (false positive test on "DOS device driver" crashed file(1)
     and rpmbuild(8) failed)


author: Tomas Smetana <tsmetana@redhat.com> - 4.24-4
changelog:
  - add GFS2 filesystem magic; thanks to Eric Sandeen
  - add LVM snapshots magic (#449755); thanks to Jason Farrell


author: Tomas Smetana <tsmetana@redhat.com> - 4.24-3
changelog:
  - drop patches that do nothing in recent build system
  - create the text magic file during installation


author: Martin Bacovsky <mbacovsk@redhat.com> - 4.21-3
changelog:
  - resolves: #172015: no longer reports filename of crashed app when run on core files.
  - resolves: #249578: Weird output from "file -i"
  - resolves: #234817: file reports wrong filetype for microsoft word file


author: Martin Bacovsky <mbacovsk@redhat.com> - 4.21-2
changelog:
  - resolves: #246700: RPM description isn't related to product
  - resolves: #238789: file-devel depends on %{version}
    but not on %{version}-%{release}
  - resolves: #235267: for core files, file doesn't display the executable name


author: Martin Bacovsky <mbacovsk@redhat.com> - 4.19-2
changelog:
  - Resolves: #223297 - file does not recognize OpenOffice "native" formats
  - Resolves: #224344 - Magic rules should be in file-libs


author: Martin Bacovsky <mbacovsk@redhat.com> - 4.19-1
changelog:
  - Resolves: #208880 - Pointless file(1) error message while detecting ELF 64-bit file
      thanks to <jakub@redhat.com> for patch
  - Resolves: #214992 - file-devel should own %_includedir/* %_libdir/lib*.so
  - Resolves: #203548 - a -devel package should be split out for libmagic
  - upgrade to new upstream 4.19
  - patch revision and cleaning
  - split package to file, file-devel and file-libs


author: Radek Vokal <rvokal@redhat.com> - 4.12-3
changelog:
  - core64 patch fixing output on core files (#145354) <kzak@redhat.com>
  - minor change in magic patch


author: Radek Vokal <rvokal@redhat.com>
changelog:
  - zlib patch deleted, note patch deleted, rh patch updated, debian patch updated
  - upgrade to file-4.10


author: Jeff Johnson <jbj@jbj.org> 4.07-1
changelog:
  - upgrade to 4.07.
  - deal gracefully with unreadable files (#113207).
  - detect PO files (from Debian).


author: Jeff Johnson <jbj@jbj.org> 4.02-3
changelog:
  - use zlib rather than exec'ing gzip.

  -* Thu Aug 28 2003 Dan Walsh <dwalsh@redhat.com>
  -- Add Selinux support.


author: Trond Eivind Glomsrød <teg@redhat.com> 3.37-1
changelog:
  - 3.37
  - s/Copyright/License/
  - build with --enable-fsect-man5, drop patch
  - disable two old patches


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - fix off-by-1 error when creating filename for use with -i.
  - include a copy of GNOME /etc/mime-types in %{_datadir}/magic.mime (#14741).


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - identify ELF stripped files correctly (#4665).
  - use SPARC (not sparc) consistently throughout (#4665).
  - add entries for MS Office files (#4665).


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.45
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: gnttab: correct pin status fixup for copy
    Regardless of copy operations only setting GNTPIN_hst*, GNTPIN_dev*
    also need to be taken into account when deciding whether to clear
    _GTF_{read,writ}ing. At least for consistency with code elsewhere the
    read part better doesn't use any mask at all.
    This is XSA-230.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26224363] {CVE-2017-12855}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.44
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: grant_table: Default to v1, and disallow transitive grants
    The reference counting and locking discipline for transitive grants is broken.
    Their use is therefore declared out of security support.
    This is XSA-226.
    Transitive grants are expected to be unconditionally available with grant
    table v2.  Hiding transitive grants alone is an ABI breakage for the guest.
    Modern versions of Linux and the Windows PV drivers use grant table v1, but
    older versions did use v2.
    In principle, disabling gnttab v2 entirely is the safer way to cause guests to
    avoid using transitive grants. However, some older guests which defaulted to
    using gnttab v2 don't tolerate falling back from v2 to v1 over migrate.
    This patch introduces a new command line option to control grant table
    behaviour.  One suboption allows a choice of the maximum grant table version
    Xen will allow the guest to use, and defaults to v2.  A different suboption
    independently controls whether transitive grants can be used.
    The default case is:
    gnttab=max_ver:2
    To disable gnttab v2 entirely, use:
    gnttab=max_ver:1
    To allow gnttab v2 and transitive grants, use:
    gnttab=max_ver:2,transitive
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Conflict:
    docs/misc/xen-command-line.markdown
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26567225] {CVE-2017-12135}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.42
changelog:
  - From 3aab881c7331cf93ffd8d2f2dd9adfd18ed4fc99 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Tue, 20 Jun 2017 19:18:54 +0100
    Subject: [PATCH] x86/grant: Disallow misaligned PTEs
    Pagetable entries must be aligned to function correctly.  Disallow attempts
    from the guest to have a grant PTE created at a misaligned address, which
    would result in corruption of the L1 table with largely-guest-controlled
    values.
    This is XSA-227
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26201029] {CVE-2017-12137}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.41
changelog:
  - Prerequisite patch for xsa227-4.5.patch
    There is no macro ASSERT_UNREACHABLE before OVM3.4 which is needed by
    xsa227-4.5.patch
    This chunk is picked from upstream commit cacdb0faaa121ac8f792d5bd34cc6bc7c72d21da
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26201029] {CVE-2017-12137}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.40
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: gnttab: don't use possibly unbounded tail calls
    There is no guarantee that the compiler would actually translate them
    to branches instead of calls, so only ones with a known recursion limit
    are okay:
    - __release_grant_for_copy() can call itself only once, as
    __acquire_grant_for_copy() won't permit use of multi-level transitive
    grants,
    - __acquire_grant_for_copy() is fine to call itself with the last
    argument false, as that prevents further recursion,
    - __acquire_grant_for_copy() must not call itself to recover from an
    observed change to the active entry's pin count
    This is XSA-226.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26567225] {CVE-2017-12135}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.39
changelog:
  - From 69549b08eb9bd3a525c07a97d952673a3d02c76a Mon Sep 17 00:00:00 2001
    From: Annie Li <annie.li@oracle.com>
    Date: Fri, 7 Jul 2017 14:36:08 -0400
    Subject: [PATCH] xen: increase default max grant frames and max maptrack
    frames
    Commit 9dfba034e increase default max grant frames to 128 which is
    still not enough when the guest has more cpus and vbd/vif devices,
    so set it to 256. Also the default max maptrack frames needs to be
    increased accordingly.
    Signed-off-by: Annie Li <annie.li@oracle.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 26412357]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.38
changelog:
  - From 414d97feb2e28ed131da33546ea81a919c30e285 Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Fri, 2 Jun 2017 15:51:58 +0100
    Subject: [PATCH 4/4] gnttab: __gnttab_unmap_common_complete() is
    all-or-nothing
    All failures have to be detected in __gnttab_unmap_common(), the
    completion function must not skip part of its processing. In particular
    the GNTMAP_device_map related putting of page references and adjustment
    of pin count must not occur if __gnttab_unmap_common() signaled an
    error. Furthermore the function must not make adjustments to global
    state (here: clearing GNTTAB_device_map) before all possibly failing
    operations have been performed.
    There's one exception for IOMMU related failures: As IOMMU manipulation
    occurs after GNTMAP_*_map have been cleared already, the related page
    reference and pin count adjustments need to be done nevertheless. A
    fundamental requirement for the correctness of this is that
    iommu_{,un}map_page() crash any affected DomU in case of failure.
    The version check appears to be pointless (or could perhaps be a
    BUG_ON() or ASSERT()), but for the moment also move it.
    This is part of XSA-224.
    Reported-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26224357]  {CVE-2017-10920, CVE-2017-10921, CVE-2017-10922}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.37
changelog:
  - From 5fd4726857a913e90de95623dc385f8856465839 Mon Sep 17 00:00:00 2001
    From: George Dunlap <george.dunlap@citrix.com>
    Date: Fri, 2 Jun 2017 15:21:27 +0100
    Subject: [PATCH 3/4] gnttab: correct logic to get page references during map
    requests
    The rules for reference counting are somewhat complicated:
    * Each of GNTTAB_host_map and GNTTAB_device_map need their own
    reference count
    * If the mapping is writeable:
    - GNTTAB_host_map needs a type count under only some conditions
    - GNTTAB_device_map always needs a type count
    If the mapping succeeds, we need to keep all of these; if the mapping
    fails, we need to release whatever references we have acquired so far.
    Additionally, the code that does a lot of this calculation "inherits"
    a reference as part of the process of finding out who the owner is.
    Finally, if the grant is mapped as writeable (without the
    GNTMAP_readonly flag), but the hypervisor cannot grab a
    PGT_writeable_page type, the entire operation should fail.
    Unfortunately, the current code has several logic holes:
    * If a grant is mapped only GNTTAB_device_map, and with a writeable
    mapping, but in conditions where a *host* type count is not
    necessary, the code will fail to grab the necessary type count.
    * If a grant is mapped both GNTTAB_device_map and GNTTAB_host_map,
    with a writeable mapping, in conditions where the host type count is
    not necessary, *and* where the page cannot be changed to type
    PGT_writeable, the condition will not be detected.
    In both cases, this means that on success, the type count will be
    erroneously reduced when the grant is unmapped.  In the second case,
    the type count will be erroneously reduced on the failure path as
    well.  (In the first case the failure path logic has the same hole
    as the reference grabbing logic.)
    Additionally, the return value of get_page() is not checked; but this
    may fail even if the first get_page() succeeded due to a reference
    counting overflow.
    First of all, simplify the restoration logic by explicitly counting
    the reference and type references acquired.
    Consider each mapping type separately, explicitly marking the
    'incoming' reference as used so we know when we need to grab a second
    one.
    Finally, always check the return value of get_page[_type]() and go to
    the failure path if appropriate.
    This is part of XSA-224.
    Signed-off-by: George Dunlap <george.dunlap@citrix.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26224357]  {CVE-2017-10920, CVE-2017-10921, CVE-2017-10922}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.36
changelog:
  - From 52078b99abbc534a5bda6f7d8ab2b403711a9bcf Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Fri, 2 Jun 2017 15:21:27 +0100
    Subject: [PATCH 2/4] gnttab: never create host mapping unless asked to
    We shouldn't create a host mapping unless asked to even in the case of
    mapping a granted MMIO page. In particular the mapping wouldn't be torn
    down when processing the matching unmap request.
    This is part of XSA-224.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26224357]  {CVE-2017-10920, CVE-2017-10921, CVE-2017-10922}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.35
changelog:
  - From 0aa6bc3bba0aeec067feed2a7378d285d7529684 Mon Sep 17 00:00:00 2001
    From: George Dunlap <george.dunlap@citrix.com>
    Date: Thu, 15 Jun 2017 16:24:02 +0100
    Subject: [PATCH 1/4] gnttab: Fix handling of dev_bus_addr during unmap
    If a grant has been mapped with the GNTTAB_device_map flag, calling
    grant_unmap_ref() with dev_bus_addr set to zero should cause the
    GNTTAB_device_map part of the mapping to be left alone.
    Unfortunately, at the moment, op->dev_bus_addr is implicitly checked
    before clearing the map and adjusting the pin count, but only the bits
    above 12; and it is not checked at all before dropping page
    references.  This means a guest can repeatedly make such a call to
    cause the reference count to drop to zero, causing the page to be
    freed and re-used, even though it's still mapped in its pagetables.
    To fix this, always check op->dev_bus_addr explicitly for being
    non-zero, as well as op->flag & GNTMAP_device_map, before doing
    operations on the device_map.
    While we're here, make the logic a bit cleaner:
    * Always initialize op->frame to zero and set it from act->frame, to reduce the
    chance of untrusted input being used
    * Explicitly check the full dev_bus_addr against act->frame <<
    PAGE_SHIFT, rather than ignoring the lower 12 bits
    This is part of XSA-224.
    Reported-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: George Dunlap <george.dunlap@citrix.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26224357]  {CVE-2017-10920, CVE-2017-10921, CVE-2017-10922}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.34
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: guest_physmap_remove_page() needs its return value checked
    Callers, namely such subsequently freeing the page, must not blindly
    assume success - the function may namely fail when needing to shatter a
    super page, but there not being memory available for the then needed
    intermediate page table.
    As it happens, guest_remove_page() callers now also all check the
    return value.
    Furthermore a missed put_gfn() on an error path in gnttab_transfer() is
    also being taken care of.
    This is part of XSA-222.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Signed-off-by: Julien Grall <julien.grall@arm.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Conflict:
    xen/arch/arm/p2m.c
    xen/arch/x86/mm.c
    xen/include/asm-arm/p2m.h
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202617]  {CVE-2017-10918}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.33
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: xen/memory: Fix return value handing of guest_remove_page()
    Despite the description in mm.h, guest_remove_page() previously returned 0 for
    paging errors.
    Switch guest_remove_page() to having regular 0/-error semantics, and propagate
    the return values from clear_mmio_p2m_entry() and mem_sharing_unshare_page()
    to the callers (although decrease_reservation() is the only caller which
    currently cares).
    This is part of XSA-222.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Conflict:
    xen/common/memory.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202617]  {CVE-2017-10918}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.32
changelog:
  - From 6926e40943eef0e0ef7acfc53cee819a41a41247 Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Thu, 11 May 2017 14:47:00 +0100
    Subject: [PATCH] x86/shadow: Hold references for the duration of emulated
    writes
    The (misnamed) emulate_gva_to_mfn() function translates a linear address to an
    mfn, but releases its page reference before returning the mfn to its caller.
    sh_emulate_map_dest() uses the results of one or two translations to construct
    a virtual mapping to the underlying frames, completes an emulated
    write/cmpxchg, then unmaps the virtual mappings.
    The page references need holding until the mappings are unmapped, or the
    frames can change ownership before the writes occurs.
    This is XSA-219
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202185]  {CVE-2017-10915}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.31
changelog:
  - From 1b0cf99d046286c601a28af0ef7c1a17eb3eb2cb Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Thu, 15 Jun 2017 12:05:29 +0100
    Subject: [PATCH 4/4] gnttab: correct maptrack table accesses
    In order to observe a consistent (limit,pointer-table) pair, the reader
    needs to either hold the maptrack lock (in line with documentation) or
    both sides need to order their accesses suitably. At the same time add
    read barriers to lockless readers.
    This is part of XSA-218.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202032]  {CVE-2017-10913,CVE-2017-10914}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.30
changelog:
  - From d188b4bf7c6d17fae1a7d14867aaeb72f972d3ac Mon Sep 17 00:00:00 2001
    From: George Dunlap <george.dunlap@citrix.com>
    Date: Fri, 2 Jun 2017 12:40:04 +0100
    Subject: [PATCH 3/4] gnttab: Avoid potential double-put of maptrack entry
    Each grant mapping for a particular domain is tracked by an in-Xen
    "maptrack" entry.  This entry is is referenced by a "handle", which is
    given to the guest when it calls gnttab_map_grant_ref().
    There are two types of mapping a particular handle can refer to:
    GNTMAP_host_map and GNTMAP_device_map.  A given
    gnttab_unmap_grant_ref() call can remove either only one or both of
    these entries.  When a particular handle has no entries left, it must
    be freed.
    gnttab_unmap_grant_ref() loops through its grant unmap request list
    twice.  It first removes entries from any host pagetables and (if
    appropraite) iommus; then it does a single domain TLB flush; then it
    does the clean-up, including telling the granter that entries are no
    longer being used (if appropriate).
    At the moment, it's during the first pass that the maptrack flags are
    cleared, but the second pass that the maptrack entry is freed.
    Unfortunately this allows the following race, which results in a
    double-free:
    A: (pass 1) clear host_map
    B: (pass 1) clear device_map
    A: (pass 2) See that maptrack entry has no mappings, free it
    B: (pass 2) See that maptrack entry has no mappings, free it #
    Unfortunately, unlike the active entry pinning update, we can't simply
    move the maptrack flag changes to the second half, because the
    maptrack flags are used to determine if iommu entries need to be
    added: a domain's iommu must never have fewer permissions than the
    maptrack flags indicate, or a subsequent map_grant_ref() might fail to
    add the necessary iommu entries.
    Instead, free the maptrack entry in the first pass if there are no
    further mappings.
    This is part of XSA-218.
    Signed-off-by: George Dunlap <george.dunlap@citrix.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Conflict:
    xen/common/grant_table.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202032]  {CVE-2017-10913,CVE-2017-10914}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.29
changelog:
  - From abbbccaa119bf8b05f0828bd9138104f08c4f8df Mon Sep 17 00:00:00 2001
    From: Jan Beulich <jbeulich@suse.com>
    Date: Fri, 2 Jun 2017 12:22:42 +0100
    Subject: [PATCH 2/4] gnttab: fix unmap pin accounting race
    Once all {writable} mappings of a grant entry have been unmapped, the
    hypervisor informs the guest that the grant entry has been released by
    clearing the _GTF_{reading,writing} usage flags in the guest's grant
    table as appropriate.
    Unfortunately, at the moment, the code that updates the accounting
    happens in a different critical section than the one which updates the
    usage flags; this means that under the right circumstances, there may be
    a window in time after the hypervisor reported the grant as being free
    during which the grant referee still had access to the page.
    Move the grant accounting code into the same critical section as the
    reporting code to make sure this kind of race can't happen.
    This is part of XSA-218.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202032]  {CVE-2017-10913,CVE-2017-10914}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.28
changelog:
  - From 4ca403ecff82d3efdd838e08b258cb4dd3062c60 Mon Sep 17 00:00:00 2001
    From: Quan Xu <quan.xu@intel.com>
    Date: Fri, 2 Jun 2017 12:30:34 +0100
    Subject: [PATCH 1/4] IOMMU: handle IOMMU mapping and unmapping failures
    Treat IOMMU mapping and unmapping failures as a fatal to the DomU
    If IOMMU mapping and unmapping failed, crash the DomU and propagate
    the error up to the call trees.
    No spamming of the log can occur. For DomU, we avoid logging any
    message for already dying domains. For Dom0, that'll still be more
    verbose than we'd really like, but it at least wouldn't outright
    flood the console.
    Signed-off-by: Quan Xu <quan.xu@intel.com>
    Reviewed-by: Kevin Tian <kevin.tian@intel.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Conflict:
    xen/drivers/passthrough/iommu.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26202032]  {CVE-2017-10913,CVE-2017-10914}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.27
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86/mm: disallow page stealing from HVM domains
    The operation's success can't be controlled by the guest, as the device
    model may have an active mapping of the page. If we nevertheless
    permitted this operation, we'd have to add further TLB flushing to
    prevent scenarios like
    "Domains A (HVM), B (PV), C (PV); B->target==A
    Steps:
    1. B maps page X from A as writable
    2. B unmaps page X without a TLB flush
    3. A sends page X to C via GNTTABOP_transfer
    4. C maps page X as pagetable (potentially causing a TLB flush in C,
    but not in B)
    At this point, X would be mapped as a pagetable in C while being
    writable through a stale TLB entry in B."
    A similar scenario could be constructed for A using XENMEM_exchange and
    some arbitrary PV domain C then having this page allocated.
    This is XSA-217.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: George Dunlap <george.dunlap@citrix.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26201839]  {CVE-2017-10912}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.26
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: xen/disk: don't leak stack data via response ring
    Rather than constructing a local structure instance on the stack, fill
    the fields directly on the shared ring, just like other (Linux)
    backends do. Build on the fact that all response structure flavors are
    actually identical (the old code did make this assumption too).
    This is XSA-216.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Anthony PERARD <anthony.perard@citrix.com>
    hw/block/xen_disk.c moved to hw/xen_disk.c
    hw/block/xen_blkif.h moved to hw/xen_blkif.h
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 26201333]  {CVE-2017-10911}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.25
changelog:
  - From c976437c7dba9c7444fb41df45468968aaa326ad Mon Sep 17 00:00:00 2001
    From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Date: Wed, 7 May 2014 13:41:48 +0000
    Subject: [PATCH] qemu-xen: free all the pirqs for msi/msix when driver unload
    Pirqs are not freed when driver unload, then new pirqs are allocated when
    driver reload. This could exhaust pirqs if do it in a loop.
    This patch fixes the bug by freeing pirqs when ENABLE bit is cleared in
    msi/msix control reg.
    There is also other way of fixing it such as reuse pirqs between driver reload,
    but this way is better.
    Xen-devel: http://marc.info/?l=xen-devel&m=136800120304275&w=2
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com> [bug 16910937]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.24
changelog:
  - x86: correct create_bounce_frame
    We may push up to 96 bytes on the guest (kernel) stack, so we should
    also cover as much in the early range check. Note that this is the
    simplest possible patch, which has the theoretical potential of
    breaking a guest: We only really push 96 bytes when invoking the
    failsafe callback, ordinary exceptions only have 56 or 64 bytes pushed
    (without / with error code respectively). There is, however, no PV OS
    known to place a kernel stack there.
    This is XSA-215.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25927751]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.23
changelog:
  - x86: discard type information when stealing pages
    While a page having just a single general reference left necessarily
    has a zero type reference count too, its type may still be valid (and
    in validated state; at present this is only possible and relevant for
    PGT_seg_desc_page, as page tables have their type forcibly zapped when
    their type reference count drops to zero, and
    PGT_{writable,shared}_page pages don't require any validation). In
    such a case when the page is being re-used with the same type again,
    validation is being skipped. As validation criteria differ between
    32- and 64-bit guests, pages to be transferred between guests need to
    have their validation indicator zapped (and with it we zap all other
    type information at once).
    This is XSA-214.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25927697]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.22
changelog:
  - multicall: deal with early exit conditions
    In particular changes to guest privilege level require the multicall
    sequence to be aborted, as hypercalls are permitted from kernel mode
    only. While likely not very useful in a multicall, also properly handle
    the return value in the HYPERVISOR_iret case (which should be the guest
    specified value).
    This is XSA-213.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Julien Grall <julien.grall@arm.com>
    Conflict:
    xen/arch/arm/traps.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25927626]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.21
changelog:
  - From 9cd5ea821213a8d0e4e2ec7a9390713379a82a0a Mon Sep 17 00:00:00 2001
    From: Ian Jackson <ian.jackson@eu.citrix.com>
    Date: Fri, 17 Mar 2017 12:28:02 +0000
    Subject: [PATCH 2/2] xenstored: Log when the write transaction rate limit
    bites
    Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25745231]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.20
changelog:
  - From c91e4cbe19cf6d51b075d4ef3adf6fa50bb16b7a Mon Sep 17 00:00:00 2001
    From: Ian Jackson <ian.jackson@eu.citrix.com>
    Date: Sat, 18 Mar 2017 17:12:39 +0000
    Subject: [PATCH 1/2] xenstored: apply a write transaction rate limit
    This avoids a rogue client being about to stall another client (eg the
    toolstack) indefinitely.
    This is XSA-206.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Backported to 4.8 (not entirely trivial).
    Signed-off-by: George Dunlap <george.dunlap@citrix.com>
    Acked-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25745226]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.19
changelog:
  - Errataly pick an old verion of xsa206 patchset, revert them
    xsa206-4.4-0001-xenstored-apply-a-write-transaction-rate-limit.patch
    xsa206-4.4-0002-xenstored-Log-when-the-write-transaction-rate-limit-.patch [bug 25745231]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.18
changelog:
  - memory: properly check guest memory ranges in XENMEM_exchange handling
    The use of guest_handle_okay() here (as introduced by the XSA-29 fix)
    is insufficient here, guest_handle_subrange_okay() needs to be used
    instead.
    Note that the uses are okay in
    - XENMEM_add_to_physmap_batch handling due to the size field being only
    16 bits wide,
    - livepatch_list() due to the limit of 1024 enforced on the
    number-of-entries input (leaving aside the fact that this can be
    called by a privileged domain only anyway),
    - compat mode handling due to counts there being limited to 32 bits,
    - everywhere else due to guest arrays being accessed sequentially from
    index zero.
    This is XSA-212.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25760591] {CVE-2017-7228}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.16
changelog:
  - From 2693dfd49fa0c0f2dc3ae8d21bda98c757d8bec4 Mon Sep 17 00:00:00 2001
    From: Ian Jackson <ian.jackson@eu.citrix.com>
    Date: Fri, 17 Mar 2017 12:23:34 +0000
    Subject: [PATCH 1/2] xenstored: apply a write transaction rate limit
    This avoids a rogue client being about to stall another client (eg the
    toolstack) indefinitely.
    This is XSA-206.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25745231]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.15
changelog:
  - From dc4eee43ac608337ae96a174e0a5c1278168bd56 Mon Sep 17 00:00:00 2001
    From: Ian Jackson <ian.jackson@eu.citrix.com>
    Date: Thu, 9 Mar 2017 11:14:55 +0000
    Subject: [PATCH] cirrus/vnc: zap drop bitblit support from console code.
    From: Gerd Hoffmann <kraxel@redhat.com>
    There is a special code path (dpy_gfx_copy) to allow graphic emulation
    notify user interface code about bitblit operations carryed out by
    guests.  It is supported by cirrus and vnc server.  The intended purpose
    is to optimize display scrolls and just send over the scroll op instead
    of a full display update.
    This is rarely used these days though because modern guests simply don't
    use the cirrus blitter any more.  Any linux guest using the cirrus drm
    driver doesn't.  Any windows guest newer than winxp doesn't ship with a
    cirrus driver any more and thus uses the cirrus as simple framebuffer.
    So this code tends to bitrot and bugs can go unnoticed for a long time.
    See for example commit "3e10c3e vnc: fix qemu crash because of SIGSEGV"
    which fixes a bug lingering in the code for almost a year, added by
    commit "c7628bf vnc: only alloc server surface with clients connected".
    Also the vnc server will throttle the frame rate in case it figures the
    network can't keep up (send buffers are full).  This doesn't work with
    dpy_gfx_copy, for any copy operation sent to the vnc client we have to
    send all outstanding updates beforehand, otherwise the vnc client might
    run the client side blit on outdated data and thereby corrupt the
    display.  So this dpy_gfx_copy "optimization" might even make things
    worse on slow network links.
    Lets kill it once for all.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    These changes (dropping dpy_copy and all its references and
    implementations) reimplemented for qemu-xen-traditional.
    This is XSA-211.
    Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Conflicts:
    hw/cirrus_vga.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25699219] {CVE-2016-9603}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.14
changelog:
  - From 15268f91fbe75b38a851c458aef74e693d646ea5 Mon Sep 17 00:00:00 2001
    From: Gerd Hoffmann <kraxel@redhat.com>
    Date: Tue, 21 Feb 2017 10:54:59 -0800
    Subject: [PATCH 2/2] cirrus: add blit_is_unsafe call to
    cirrus_bitblt_cputovideo
    CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
    and blit width, at all.  Oops.  Fix it.
    Security impact: high.
    The missing blit destination check allows to write to host memory.
    Basically same as CVE-2014-8106 for the other blit variants.
    The missing blit width check allows to overflow cirrus_bltbuf,
    with the attractive target cirrus_srcptr (current cirrus_bltbuf write
    position) being located right after cirrus_bltbuf in CirrusVGAState.
    Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker
    hasn't full control over cirrus_srcptr though, only one byte can be
    changed.  Once the first byte has been modified further writes land
    elsewhere.
    [ This is CVE-2017-2620 / XSA-209  - Ian Jackson ]
    Reported-by: Gerd Hoffmann <ghoffman@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    cirrus_vga.c moved from hw/display/ to hw/
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2620}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.13
changelog:
  - From 52b7f43c8fa185ab856bcaacda7abc9a6fc07f84 Mon Sep 17 00:00:00 2001
    From: Bruce Rogers <brogers@suse.com>
    Date: Tue, 21 Feb 2017 10:54:38 -0800
    Subject: [PATCH 1/2] display: cirrus: ignore source pitch value as needed in
    blit_is_unsafe
    Commit 4299b90 added a check which is too broad, given that the source
    pitch value is not required to be initialized for solid fill operations.
    This patch refines the blit_is_unsafe() check to ignore source pitch in
    that case. After applying the above commit as a security patch, we
    noticed the SLES 11 SP4 guest gui failed to initialize properly.
    Signed-off-by: Bruce Rogers <brogers@suse.com>
    Message-id: 20170109203520.5619-1-brogers@suse.com
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    cirrus_vga.c moved from hw/display/ to hw/
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2620}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.12
changelog:
  - From: Gerd Hoffmann <kraxel@redhat.com>
    Subject: [PATCH 3/3] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo
    CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination
    and blit width, at all.  Oops.  Fix it.
    Security impact: high.
    The missing blit destination check allows to write to host memory.
    Basically same as CVE-2014-8106 for the other blit variants.
    The missing blit width check allows to overflow cirrus_bltbuf,
    with the attractive target cirrus_srcptr (current cirrus_bltbuf write
    position) being located right after cirrus_bltbuf in CirrusVGAState.
    Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker
    hasn't full control over cirrus_srcptr though, only one byte can be
    changed.  Once the first byte has been modified further writes land
    elsewhere.
    [ This is CVE-2017-2620 / XSA-209  - Ian Jackson ]
    Fixed compilation by removing extra parameter to blit_is_unsafe. -iwj
    Reported-by: Gerd Hoffmann <ghoffman@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2620}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.11
changelog:
  - From 8f63265efeb6f92e63f7e749cb26131b68b20df7 Mon Sep 17 00:00:00 2001
    From: Li Qiang <liqiang6-s@360.cn>
    Date: Mon, 13 Feb 2017 15:22:15 +0000
    Subject: [PATCH] cirrus: fix oob access issue (CVE-2017-2615)
    When doing bitblt copy in backward mode, we should minus the
    blt width first just like the adding in the forward mode. This
    can avoid the oob access of the front of vga's vram.
    This is XSA-208.
    upstream-commit-id: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
    Signed-off-by: Li Qiang <liqiang6-s@360.cn>
    { kraxel: with backward blits (negative pitch) addr is the topmost
    address, so check it as-is against vram size ]
    Cc: qemu-stable@nongnu.org
    Cc: P J P <ppandit@redhat.com>
    Cc: Laszlo Ersek <lersek@redhat.com>
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
    Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    cirrus_vga.c moved from hw/display/ to hw/
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2615}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.10
changelog:
  - From d3532a0db02296e687711b8cdc7791924efccea0 Mon Sep 17 00:00:00 2001
    From: Gerd Hoffmann <kraxel@redhat.com>
    Date: Wed, 19 Nov 2014 11:37:42 +0100
    Subject: [PATCH] cirrus: fix blit region check
    Issues:
    * Doesn't check pitches correctly in case it is negative.
    * Doesn't check width at all.
    Turn macro into functions while being at it, also factor out the check
    for one region which we then can simply call twice for src + dst.
    This is CVE-2014-8106.
    Reported-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
    Prerequisite patch for XSA208, cirrus_vga.c moved from hw/display/ to hw/
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2615}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.9
changelog:
  - From 8f63265efeb6f92e63f7e749cb26131b68b20df7 Mon Sep 17 00:00:00 2001
    From: Li Qiang <liqiang6-s@360.cn>
    Date: Mon, 13 Feb 2017 15:22:15 +0000
    Subject: [PATCH] cirrus: fix oob access issue (CVE-2017-2615)
    When doing bitblt copy in backward mode, we should minus the
    blt width first just like the adding in the forward mode. This
    can avoid the oob access of the front of vga's vram.
    This is XSA-208.
    upstream-commit-id: 62d4c6bd5263bb8413a06c80144fc678df6dfb64
    Signed-off-by: Li Qiang <liqiang6-s@360.cn>
    { kraxel: with backward blits (negative pitch) addr is the topmost
    address, so check it as-is against vram size ]
    [ This is CVE-2017-2615 / XSA-208  - Ian Jackson ]
    Cc: qemu-stable@nongnu.org
    Cc: P J P <ppandit@redhat.com>
    Cc: Laszlo Ersek <lersek@redhat.com>
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Wolfgang Bumiller <w.bumiller@proxmox.com>
    Fixes: d3532a0db02296e687711b8cdc7791924efccea0 (CVE-2014-8106)
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Message-id: 1485938101-26602-1-git-send-email-kraxel@redhat.com
    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2615}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.8
changelog:
  - From 5e4ed9cded14f2d8445150c8a6d225b283bed3fa Mon Sep 17 00:00:00 2001
    From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Sat, 21 Feb 2015 17:16:42 +0000
    Subject: [PATCH] CVE-2014-8106: cirrus: fix blit region check
    Backport of qemu-upstream:
    * bf25983345ca44aec3dd92c57142be45452bd38a
    * d3532a0db02296e687711b8cdc7791924efccea0
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Prerequisite patch for XSA208
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25670969] {CVE-2017-2615}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.7
changelog:
  - IOMMU: always call teardown callback
    There is a possible scenario when (d)->need_iommu remains unset
    during guest domain execution. For example, when no devices
    were assigned to it. Taking into account that teardown callback
    is not called when (d)->need_iommu is unset we might have unreleased
    resourses after destroying domain.
    So, always call teardown callback to roll back actions
    that were performed in init callback.
    This is XSA-207.
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Tested-by: Jan Beulich <jbeulich@suse.com>
    Tested-by: Julien Grall <julien.grall@arm.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 25491807]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.6
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Date: Sun, 18 Dec 2016 15:42:59 +0000
    Subject: [PATCH] x86/emul: Correct the handling of eflags with SYSCALL
    A singlestep #DB is determined by the resulting eflags value from the
    execution of SYSCALL, not the original eflags value.
    By using the original eflags value, we negate the guest kernels attempt to
    protect itself from a privilege escalation by masking TF.
    Introduce a tf boolean and have the SYSCALL emulation recalculate it
    after the instruction is complete.
    This is XSA-204
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 25294877]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.5
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86: force EFLAGS.IF on when exiting to PV guests
    Guest kernels modifying instructions in the process of being emulated
    for another of their vCPU-s may effect EFLAGS.IF to be cleared upon
    next exiting to guest context, by converting the being emulated
    instruction to CLI (at the right point in time). Prevent any such bad
    effects by always forcing EFLAGS.IF on. And to cover hypothetical other
    similar issues, also force EFLAGS.{IOPL,NT,VM} to zero.
    This is XSA-202.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25235014]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.4
changelog:
  - From: Jan Beulich <jbeulich@suse.com>
    Subject: x86emul: CMPXCHG8B ignores operand size prefix
    Otherwise besides mis-handling the instruction, the comparison failure
    case would result in uninitialized stack data being handed back to the
    guest in rDX:rAX (32 bits leaked for 32-bit guests, 96 bits for 64-bit
    ones).
    This is XSA-200.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25180299]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.3
changelog:
  - qemu_up: ioport_read, ioport_write: be defensive about 32-bit addresses
    On x86, ioport addresses are 16-bit.  That these functions take 32-bit
    arguments is a mistake.  Changing the argument type to 16-bit will
    discard the top bits of any erroneous values from elsewhere in qemu.
    Also, check just before use that the value is in range.  (This turns
    an ill-advised change to MAX_IOPORTS into a possible guest crash
    rather than a privilege escalation vulnerability.)
    And, in the Xen ioreq processor, clamp incoming ioport addresses to
    16-bit values.  Xen will never write >16-bit values but the guest may
    have access to the ioreq ring.  We want to defend the rest of the qemu
    code from wrong values.
    This is XSA-199.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25149314] {CVE-2016-9637}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.186.2
changelog:
  - qemu: ioport_read, ioport_write: be defensive about 32-bit addresses
    On x86, ioport addresses are 16-bit.  That these functions take 32-bit
    arguments is a mistake.  Changing the argument type to 16-bit will
    discard the top bits of any erroneous values from elsewhere in qemu.
    Also, check just before use that the value is in range.  (This turns
    an ill-advised change to MAX_IOPORTS into a possible guest crash
    rather than a privilege escalation vulnerability.)
    And, in the Xen ioreq processor, clamp incoming ioport addresses to
    16-bit values.  Xen will never write >16-bit values but the guest may
    have access to the ioreq ring.  We want to defend the rest of the qemu
    code from wrong values.
    This is XSA-199.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 25149314] {CVE-2016-9637}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.186.1
changelog:
  - x86/hvm: Fix the handling of non-present segments
    In 32bit, the data segments may be NULL to indicate that the segment is
    ineligible for use.  In both 32bit and 64bit, the LDT selector may be NULL to
    indicate that the entire LDT is ineligible for use.  However, nothing in Xen
    actually checks for this condition when performing other segmentation
    checks.  (Note however that limit and writeability checks are correctly
    performed).
    Neither Intel nor AMD specify the exact behaviour of loading a NULL segment.
    Experimentally, AMD zeroes all attributes but leaves the base and limit
    unmodified.  Intel zeroes the base, sets the limit to 0xfffffff and resets the
    attributes to just .G and .D/B.
    The use of the segment information in the VMCB/VMCS is equivalent to a native
    pipeline interacting with the segment cache.  The present bit can therefore
    have a subtly different meaning, and it is now cooked to uniformly indicate
    whether the segment is usable or not.
    GDTR and IDTR don't have access rights like the other segments, but for
    consistency, they are treated as being present so no special casing is needed
    elsewhere in the segmentation logic.
    AMD hardware does not consider the present bit for %cs and %tr, and will
    function as if they were present.  They are therefore unconditionally set to
    present when reading information from the VMCB, to maintain the new meaning of
    usability.
    Intel hardware has a separate unusable bit in the VMCS segment attributes.
    This bit is inverted and stored in the present field, so the hvm code can work
    with architecturally-common state.
    This is XSA-191.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Conflicts:
    xen/arch/x86/hvm/vmx/vmx.c
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: boris.ostrovsky@oracle.com [bug 25129752] {CVE-2016-9386}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.186
changelog:
  - pygrub: Properly quote results, when returning them to the caller:
    * When the caller wants sexpr output, use `repr()'
    This is what Xend expects.
    The returned S-expressions are now escaped and quoted by Python,
    generally using '...'.  Previously kernel and ramdisk were unquoted
    and args was quoted with "..." but without proper escaping.  This
    change may break toolstacks which do not properly dequote the
    returned S-expressions.
    * When the caller wants "simple" output, crash if the delimiter is
    contained in the returned value.
    With --output-format=simple it does not seem like this could ever
    happen, because the bootloader config parsers all take line-based
    input from the various bootloader config files.
    With --output-format=simple0, this can happen if the bootloader
    config file contains nul bytes.
    This is XSA-198.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Tested-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Zhigang Wang <zhigang.x.wang@oracle.com> [bug 25094278] {CVE-2016-9379,CVE-2016-9380}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.185
changelog:
  - xen: fix ioreq handling
    Avoid double fetches and bounds check size to avoid overflowing
    internal variables.
    This is XSA-197.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [bug 25094194] {CVE-2016-9381}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.184
changelog:
  - xen: fix ioreq handling
    Avoid double fetches and bounds check size to avoid overflowing
    internal variables.
    This is XSA-197.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
    Reviewed-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [bug 25094194] {CVE-2016-9381}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.183
changelog:
  - x86emul: fix huge bit offset handling
    We must never chop off the high 32 bits.
    This is XSA-195.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [bug 25088385] {CVE-2016-9383}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.182
changelog:
  - x86/HVM: don't load LDTR with VM86 mode attrs during task switch
    Just like TR, LDTR is purely a protected mode facility and hence needs
    to be loaded accordingly. Also move its loading to where it
    architecurally belongs.
    This is XSA-192.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [bug 25087550] {CVE-2016-9382}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.181
changelog:
  - mm: Don't scrub memory if another processor on the same node is already doing it
    There is no reason to have two processors from the same node to scrub memory
    at the same time.
    Original fix of the scrubbing problem tried to prevent multiple scrubbers by
    starting scrub processing only when noone was waiting for the node's
    heap lock. Apparently this was not sufficient: per 20800450 a customer still
    observed extremely long (minutes) periods when the system is essentially
    unusable due to the heap being unavalable.
    My theory is that there is still a window where the lock is not held
    (first half of __scrub_free_pages()) which may allow at least one other CPU
    from the same node to start scrubbing. I haven't been able to verify this
    since I can't reproduce the bug (20800450) but the patch below, which
    explicitly allows only one CPU per node to perform scrubbing, appears to
    make the problem go away.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    This patch is originally for bug24376653.
    Conflicts:
    xen/common/page_alloc.c
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 24376707]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.180
changelog:
  - mm/scrub: clear is_scrubbing flag outside ASSERT()
    Otherwise we never clear the flag on NDEBUG builds that turn ASSERT into
    a nop.
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    This is backport from 3.4 tree from bug21819046
    commit: 886760e191c696464ef3590391d77437244d55a2
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 24376707]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.179
changelog:
  - vmx: restore debug registers when injecting #DB traps
    Commit a929bee0e652 ("x86/vmx: Fix injection of #DB traps following
    XSA-156") prevents an infinite loop in certain #DB traps. However, it
    changed the behavior to not call hvm_hw_inject_trap() for #DB and #AC
    traps which which means that the debug registers are not restored
    correctly and nullified commit b56ae5b48c38 ("VMX: fix/adjust trap
    injection").
    To fix this, restore the original code path through hvm_inject_trap(),
    but ensure that the struct hvm_trap is populated with all the required
    data.
    Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Kevin Tian <kevin.tian@intel.com>
    Conflicts:
    xen/arch/x86/hvm/vmx/vmx.c
    Upstream commit ba22f1f4732acb4d5aebd779122e91753a0e374d
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 24792686] {CVE-2015-5307}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.178
changelog:
  - x86/vmx: Fix injection of #DB traps following XSA-156
    Most #DB exceptions are traps rather than faults, meaning that the instruction
    pointer in the exception frame points after the instruction rather than at it.
    However, VMX intercepts all have fault semantics, even when intercepting a
    trap.  Re-injecting an intercepted trap as a fault causes an infinite loop in
    the guest, by re-executing the same trapping instruction repeatedly.  This
    breaks debugging inside the guest.
    Introduce a helper which copies VM_EXIT_INTR_INTO to VM_ENTRY_INTR_INFO, and
    use it to mirror the intercepted interrupt back to the guest.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Kevin Tian <kevin.tian@intel.com>
    master commit: 0747bc8b4d85f3fc0ee1e58418418fa0229e8ff8
    master date: 2016-01-05 11:28:56 +0000
    Conflicts:
    xen/arch/x86/hvm/vmx/vmx.c
    Upstream commit a929bee0e65296ee565251316dc53f1c6b79084a
    Backported-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 24792686] {CVE-2015-5307}


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.177
changelog:
  - move TLB-flush filtering out into populate_physmap during vm creation
    This patch implemented parts of TODO left in commit id
    a902c12ee45fc9389eb8fe54eeddaf267a555c58 (More efficient TLB-flush
    filtering in alloc_heap_pages()). It moved TLB-flush filtering out into
    populate_physmap. Because of TLB-flush in alloc_heap_pages, it's very slow
    to create a guest with memory size of more than 100GB on host with 100+
    cpus.
    This patch introduced a "MEMF_no_tlbflush" bit to memflags to indicate
    whether TLB-flush should be done in alloc_heap_pages or its caller
    populate_physmap.  Once this bit is set in memflags, alloc_heap_pages will
    ignore TLB-flush. To use this bit after vm is created might lead to
    security issue, that is, this would make pages accessible to the guest B,
    when guest A may still have a cached mapping to them.
    Therefore, this patch also introduced a "creation_finished" field to struct
    domain to indicate whether this domain has ever got unpaused by hypervisor.
    MEMF_no_tlbflush can be set only during vm creation phase when
    creation_finished is still false before this domain gets unpaused for the
    first time.
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: George Dunlap <george.dunlap@citrix.com>
    Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com>
    This is backport of upstream commit
    bbb17f6f1273857b27197b581b87c20264059a8f
    Conflict:
    xen/common/domain.c
    xen/common/memory.c
    xen/include/xen/sched.h
    The following changes are made to avoid conflicts:
    1. bool is changed to bool_t
    2. true/false is changed to 1/0
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 24738894]


author: Dongli Zhang <dongli.zhang@oracle.com> - 4.3.0-55.el6.176
changelog:
  - replace tlbflush check and operation with inline functions
    This patch cleaned up the code by replacing complicated tlbflush check and
    operation with inline functions. We should use those inline functions to
    avoid the complicated tlbflush check and tlbflush operations when
    implementing TODOs left in commit a902c12ee45fc9389eb8fe54eeddaf267a555c58
    (More efficient TLB-flush filtering in alloc_heap_pages()).
    "#include <asm/flushtlb.h>" is removed from xen/arch/x86/acpi/suspend.c to
    avoid the compiling error after we include "<asm/flushtlb.h>" to
    xen/include/xen/mm.h.
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Acked-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: George Dunlap <george.dunlap@citrix.com>
    Reviewed-by: Dario Faggioli <dario.faggioli@citrix.com>
    This is backport of upstream commit
    80943aa40e30bcba24f52eff156c29d9d57a2e53
    Conflict:
    xen/common/page_alloc.c
    xen/include/xen/mm.h
    The following changes are made to avoid conflicts:
    1. bool is changed to bool_t
    2. true/false is changed to 1/0
    Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 24738894]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.175
changelog:
  - x86/hvm: don't intercept #UD exceptions in general
    The upstream commit is 7d7918e but backporting that would
    also require backporting the whole CPUID patchset (~70 patches)
    along with some MMIO/PCI configuration interception patches.
    But we do not need all of that as:
    - We do not support cross-vendor migration (AMD -> Intel or
    vice-versa). And that was the only reason the #UD interception
    was added.
    - Upstream mentions that intercepting #UD:
    "opens up the instruction emulator to arbitrary
    instruction from an HVM guest, don't use this in production system."
    So instead of backporting:
    0f1cb96e: x86 hvm: Allow cross-vendor migration
    4f7da683: x86/HVM: unify and fix #UD intercept
    a6288d5b: xen: make available hvm_fep to non-debug build as well
    or fixes to the instruction emulator, like
    dee231b x86emul: improve LOCK handling
    (which also depends on a whole lot of fixes), we just
    disable #UD interception in general.
    OraBug: 24385487
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Backport from 3bbc1e4f4cd8ad473365f4d4abca4f542020bad5 OVS 3.4.2
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 24616030]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.174
changelog:
  - x86emul: honor guest CR0.TS and CR0.EM
    We must not emulate any instructions accessing respective registers
    when either of these flags is set in the guest view of the register, or
    else we may do so on data not belonging to the guest's current task.
    Being architecturally required behavior, the logic gets place in the
    instruction emulator instead of hvmemul_get_fpu(). It should be noted,
    though, that hvmemul_get_fpu() being the only current handler for the
    get_fpu() callback, we don't have an active problem with CR4: Both
    CR4.OSFXSR and CR4.OSXSAVE get handled as necessary by that function.
    This is XSA-190.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    ---
    v2: Require the read_cr hook to be set, which then requires a change to
    the test code too.
    ---
    The change to xen/arch/x86/hvm/emulate.c isn't strictly needed for
    fixing the security issue, but the patch would be rather incomplete
    without.
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 24697109]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.173
changelog:
  - From: Andrew Cooper <andrew.cooper3@citrix.com>
    Subject: x86/shadow: Avoid overflowing sh_ctxt->seg_reg[]
    hvm_get_seg_reg() does not perform a range check on its input segment, calls
    hvm_get_segment_register() and writes straight into sh_ctxt->seg_reg[].
    x86_seg_none is outside the bounds of sh_ctxt->seg_reg[], and will hit a BUG()
    in {vmx,svm}_get_segment_register().
    HVM guests running with shadow paging can end up performing a virtual to
    linear translation with x86_seg_none.  This is used for addresses which are
    already linear.  However, none of this is a legitimate pagetable update, so
    fail the emulation in such a case.
    This is XSA-187
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 24592906] {CVE-2016-7094}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.172
changelog:
  - x86/32on64: don't allow recursive page tables from L3
    L3 entries are special in PAE mode, and hence can't reasonably be used
    for setting up recursive (and hence linear) page table mappings. Since
    abuse is possible when the guest in fact gets run on 4-level page
    tables, this needs to be excluded explicitly.
    This is XSA-185.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 24592624] {CVE-2016-7092}


author: Joe Jin <joe.jin@oracle.com> - 4.3.0-55.el6.171
changelog:
  - xend/netif: Add handle to xenstore to avoid inconsistent vif state
    If guest assigned multiple vnics, detach one or some then re-attach it,
    vnics state maybe not correct because different handle on xenstore.
    This patch add 'handle' of vnics to xenstore to avoid it.
    Signed-off-by: Joe Jin <joe.jin@oracle.com>
    Reviewed-by: Zhiang Wang <zhigang.x.wang@oracle.com>
    Reviewed-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 24372976]


author: Joe Jin <joe.jin@oracle.com> - 4.3.0-55.el6.170
changelog:
  - xend/bootloader: Fix unclosed quotation string lead duplicate xend process
    When pass unclosed quotation string to bootloader_args it lead child
    corrupted and have no chance to exit, then system became unusable
    because of 2 xend was running, xend.log have below:
    [2016-07-24 21:46:10 1494] ERROR (XendDomainInfo:500) VM start failed
    Traceback (most recent call last):
    File "/usr/lib64/python2.6/site-packages/xen/xend/XendDomainInfo.py",
    line 486, in start
    XendTask.log_progress(31, 60, self._initDomain)
    File "/usr/lib64/python2.6/site-packages/xen/xend/XendTask.py", line
    209, in log_progress
    retval = func(*args, **kwds)
    File "/usr/lib64/python2.6/site-packages/xen/xend/XendDomainInfo.py",
    line 2880, in _initDomain
    self._configureBootloader()
    File "/usr/lib64/python2.6/site-packages/xen/xend/XendDomainInfo.py",
    line 3346, in _configureBootloader
    bootloader_args, kernel, ramdisk, args)
    File "/usr/lib64/python2.6/site-packages/xen/xend/XendBootloader.py",
    line 114, in bootloader
    args.extend(shlex.split(blargs))
    File "/usr/lib64/python2.6/shlex.py", line 279, in split
    return list(lex)
    File "/usr/lib64/python2.6/shlex.py", line 269, in next
    token = self.get_token()
    File "/usr/lib64/python2.6/shlex.py", line 96, in get_token
    raw = self.read_token()
    File "/usr/lib64/python2.6/shlex.py", line 172, in read_token
    raise ValueError, "No closing quotation"
    ValueError: No closing quotation
    This patch moved construct bootloader args before fork, if any exception
    will raise error.
    Signed-off-by: Joe Jin <joe.jin@oracle.com>
    Reviewed-by: Zhiang Wang <zhigang.x.wang@oracle.com>
    Reviewed-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 23625563]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.169
changelog:
  - x86/HVM: correct CPUID leaf 80000008 handling - 6c733e54
    xsa173_01_0001-x86-HVM-correct-CPUID-leaf-80000008-handling.patch was based
    on upstream commit:
    ef437690af8b75e6758dce77af75a22b63982883
    x86/HVM: correct CPUID leaf 80000008 handling
    It should have been based on upstream commit:
    6c733e549889a9b8c4e03140348b8e00241d4ce9
    x86/HVM: correct CPUID leaf 80000008 handling
    The changes in this patch are the differences between those two patches.
    Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 24356309]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.168
changelog:
  - x86: fix unintended fallthrough case from XSA-154
    ... and annotate the other deliberate one: Coverity objects otherwise.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    One of the two instances was actually a bug.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    master commit: 8dd6d1c099865ee5f5916616a0ca79cd943c46f9
    master date: 2016-02-18 15:10:07 +0100
    Upstream commit ccc7adf9cff5d5f93720afcc1d0f7227d50feab2
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22697471] {CVE-2016-2270}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.167
changelog:
  - x86/pv: Remove unsafe bits from the mod_l?_entry() fastpath
    All changes in writeability and cacheability must go through full
    re-validation.
    Rework the logic as a whitelist, to make it clearer to follow.
    This is XSA-182
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Upstream commit 798c1498f764bfaa7b0b955bab40b01b0610d372
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 24307889]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.166
changelog:
  - libxl: Do not trust frontend for nic in getinfo
    libxl_device_nic_getinfo needs to examine devices without trusting
    frontend-controlled data.  So:
    * Use /libxl to find the backend path.
    * Parse the backend path to find the backend domid, rather than
    reading it from the frontend.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 5811d6bdf5bb6e80db7acaf8bab196f9476f5164
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.165
changelog:
  - libxl: Do not trust frontend for nic in libxl_devid_to_device_nic
    Find the backend by reading the pointer in /libxl rather than in the
    guest's frontend area.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 2c74b8dd4c5d6982eee1fd852f9aa10ec1b24545
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.164
changelog:
  - libxl: Do not trust frontend for vtpm in getinfo
    libxl_device_vtpm_getinfo needs to examine devices without trusting
    frontend-controlled data.  So:
    * Use /libxl to find the backend path.
    * Parse the backend path to find the backend domid, rather than
    reading it from the frontend.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 3544831133b19787fc3d9a27711ff9f647d0ddb8
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.163
changelog:
  - libxl: Do not trust frontend for vtpm list
    libxl_device_vtpm_list needs to enumerate and identify devices without
    trusting frontend-controlled data.  So
    * Use the /libxl path to enumerate vtpms.
    * Use the /libxl path to find the corresponding backends.
    * Parse the backend path to find the backend domid.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Conflicts:
    tools/libxl/libxl.c
    Upstream commit 7bde3f4c5d36c8e7760f74aad52546162a62c2b4
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.162
changelog:
  - -bxl: Do not trust frontend for disk in getinfo
    * Rename the frontend variable to `fe_path' to check we caught them all
    * Read the backend path from /libxl, rather than from the frontend
    * Parse the backend domid from the backend path, rather than reading it
    from the frontend (and add the appropriate error path and initialisation)
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 38ef6689b7cf3904355f95a0c12d0b92e5ad2137
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    -This line, and those below, will be ignored--
    ?      0003-libxl-Do-not-trust-frontend-in-libxl__devices_destro.patch
    ?      .0006-libxl-Do-not-trust-frontend-for-disk-in-getinfo.patch.swp
    ?      0001-libxl-Record-backend-frontend-paths-in-libxl-DOMID.patch
    ?      0004-libxl-Do-not-trust-frontend-in-libxl__device_nextid.patch
    ?      0007-libxl-Do-not-trust-frontend-for-vtpm-list.patch
    ?      0005-libxl-Do-not-trust-frontend-for-disk-eject-event.patch
    ?      xsa176.patch
    ?      0008-libxl-Do-not-trust-frontend-for-vtpm-in-getinfo.patch
    ?      0009-libxl-Do-not-trust-frontend-for-nic-in-libxl_devid_t.patch
    ?      0002-libxl-Provide-libxl__backendpath_parse_domid.patch
    ?      0006-libxl-Do-not-trust-frontend-for-disk-in-getinfo.patch
    ?      0010-libxl-Do-not-trust-frontend-for-nic-in-getinfo.patch
    ?      xsa180-qemut.patch
    ?      xsa180-qemuu.patch
    ?      tools/python/xen/xend/XendDomainInfo.py.orig
    ?      tools/qemu-xen-traditional-dir/hw/xenfb.c.orig
    ?      tools/libvchan/io.c.orig
    ?      tools/qemu-xen-dir/hw/qxl.c.orig
    ?      tools/qemu-xen-dir/hw/xenfb.c.orig
    ?      tools/qemu-xen-dir/hw/vga.c.orig
    ?      tools/qemu-xen-dir/hw/vga_int.h.orig
    ?      tools/qemu-xen-dir/hw/xen_blkif.h.orig
    ?      tools/blktap2/drivers/block-log.c.orig
    ?      tools/libxl/libxl.c.orig
    ?      tools/libxl/libxl_internal.h.orig
    ?      tools/libxl/libxl_dom.c.orig
    M      tools/libxl/libxl.c
    ?      xen/include/public/io/ring.h.orig
    ?      xen/arch/x86/cpu/common.c.orig
    ?      xen/arch/x86/hvm/mtrr.c.orig
    ?      xen/arch/x86/hvm/hvm.c.orig
    ?      xen/arch/x86/mm/hap/hap.c.orig [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.161
changelog:
  - libxl: Do not trust frontend for disk eject event
    Use the /libxl path for interpreting disk eject watch events: do not
    read the backend path out of the frontend.  Instead, use the version
    in /libxl.  That avoids us relying on the guest-modifiable
    $frontend/backend pointer.
    To implement this we store the path
    /libxl/$guest/device/vbd/$devid/backend
    in the evgen structure.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit babf4f45a52af68e58316c4456dffc97e0a1df79
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.160
changelog:
  - libxl: Do not trust frontend in libxl__device_nextid
    When selecting the devid for a new device, we should look in
    /libxl/device for existing devices, not in the frontend area.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 13de0ee03135a08c4e8cefa1981d638bb4d5a561
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.159
changelog:
  - libxl: Do not trust frontend in libxl__devices_destroy
    We need to enumerate the devices we have provided to a domain, without
    trusting the guest-writeable (or, at least, guest-deletable) frontend
    paths.
    Instead, enumerate via, and read the backend path from, /libxl.
    The console /libxl path is regular, so the special case for console 0
    is not relevant any more: /libxl/GUEST/device/console/0 will be found,
    and then libxl__device_destroy will DTRT to the right frontend path.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 4a78d360241a4b97a22d83e6283e122a45ef96e3
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.158
changelog:
  - libxl: Provide libxl__backendpath_parse_domid
    Multiple places in libxl need to figure out the backend domid of a
    device.  This can be discovered easily by looking at the backend path,
    which always starts /local/domain/$backend_domid/.
    There are no call sites yet.
    This is part of XSA-175.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 89c6672d012890894105d7f832ddf4cbf8d56a15
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.157
changelog:
  - libxl: Record backend/frontend paths in /libxl/$DOMID
    This gives us a record of all the backends we have set up for a
    domain, which is separate from the frontends in
    /local/domain/$DOMID/device.
    In particular:
    1. A guest has write permission for the frontend path:
    /local/domain/$DOMID/device/$KIND/$DEVID
    which means that the guest can completely delete the frontend.
    (They can't recreate it because they don't have write permission
    on the containing directory.)
    2. A guest has write permission for the backend path recorded in the
    frontend, ie, it can write to
    /local/domain/$DOMID/device/$KIND/$DEVID/backend
    which means that the guest can break the association between
    frontend and backend.
    So we can't rely on iterating over the frontends to find all the
    backends, or examining a frontend to discover how a device is
    configured.
    So, have libxl__device_generic_add record the frontend and backend
    paths in /libxl/$DOMID/device, and have libxl__device_destroy remove
    them again.
    Create the containing directory /libxl/GUEST/device in
    libxl__domain_make.  The already existing xs_rm in devices_destroy_cb
    will take care of removing it.
    This is part of XSA-175.
    Backport note: Backported over 7472ced, which fixes a bug in driver
    domain teardown.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Reviewed-by: Wei Liu <wei.liu2@citrix.com>
    Upstream commit 44ea68c6e6819ee535c4dd3d18a8691ff722d961
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530769] {CVE-2016-4962}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.156
changelog:
  - main loop: Big hammer to fix logfile disk DoS in Xen setups
    Each time round the main loop, we now fstat stderr.  If it is too big,
    we dup2 /dev/null onto it.  This is not a very pretty patch but it is
    very simple, easy to see that it's correct, and has a low risk of
    collateral damage.
    The limit is 1Mby by default but can be adjusted by setting a new
    environment variable.
    This fixes CVE-2014-3672.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Tested-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    ---
    v2: Make it actually compile.  Fix a typo in the message.
    Move the check_cve_2014_3672_xen up in the file, so that we can:
    Call check_cve_2014_3672_xen in the other copy of the main loop (!)
    Conflicts:
    tools/qemu-xen-dir/main-loop.c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23531449] {CVE-2014-3672}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.155
changelog:
  - main loop: Big hammer to fix logfile disk DoS in Xen setups
    Each time round the main loop, we now fstat stderr.  If it is too big,
    we dup2 /dev/null onto it.  This is not a very pretty patch but it is
    very simple, easy to see that it's correct, and has a low risk of
    collateral damage.
    The limit is 1Mby by default but can be adjusted by setting a new
    environment variable.
    This fixes CVE-2014-3672.
    Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Tested-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23531449] {CVE-2014-3672}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.154
changelog:
  - x86/mm: fully honor PS bits in guest page table walks
    In L4 entries it is currently unconditionally reserved (and hence
    should, when set, always result in a reserved bit page fault), and is
    reserved on hardware not supporting 1Gb pages (and hence should, when
    set, similarly cause a reserved bit page fault on such hardware).
    This is CVE-2016-4480 / XSA-176.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23531399] {CVE-2016-4480}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.153
changelog:
  - x86: limit GFNs to 32 bits for shadowed superpages.
    Superpage shadows store the shadowed GFN in the backpointer field,
    which for non-BIGMEM builds is 32 bits wide.  Shadowing a superpage
    mapping of a guest-physical address above 2^44 would lead to the GFN
    being truncated there, and a crash when we come to remove the shadow
    from the hash table.
    Track the valid width of a GFN for each guest, including reporting it
    through CPUID, and enforce it in the shadow pagetables.  Set the
    maximum witth to 32 for guests where this truncation could occur.
    This is XSA-173.
    Signed-off-by: Tim Deegan <tim@xen.org>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reported-by: Ling Liu <liuling-it@360.cn>
    Upstream commit 95dd1b6e87b61222fc856724a5d828c9bdc30c80
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530692] {CVE-2016-3960}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.152
changelog:
  - x86/HVM: correct CPUID leaf 80000008 handling
    CPUID[80000008].EAX[23:16] have been given the meaning of the guest
    physical address restriction (in case it needs to be smaller than the
    host's), hence we need to mirror that into vCPUID[80000008].EAX[7:0].
    Enforce a lower limit at the same time, as well as a fixed value for
    the virtual address bits, and zero for the guest physical address ones.
    In order for the vMTRR code to see these overrides we need to make it
    call hvm_cpuid() instead of domain_cpuid(), which in turn requires
    special casing (and relaxing) the controlling domain.
    This additionally should hide an ordering problem in the tools: Both
    xend and xl appear to be restoring a guest from its image before
    setting up the CPUID policy in the hypervisor, resulting in
    domain_cpuid() returning all zeros and hence the check in
    mtrr_var_range_msr_set() failing if the guest previously had more than
    the minimum 36 physical address bits.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Conflicts:
    xen/arch/x86/hvm/mtrr.c
    Upstream commit ef437690af8b75e6758dce77af75a22b63982883
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23530692] {CVE-2016-3960}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.151
changelog:
  - xenfb: avoid reading twice the same fields from the shared page
    Reading twice the same field could give the guest an attack of
    opportunity. In the case of event->type, gcc could compile the switch
    statement into a jump table, effectively ending up reading the type
    field multiple times.
    This is part of XSA-155.
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 23170500] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.150
changelog:
  - xen/blkif: Avoid double access to src->nr_segments
    src is stored in shared memory and src->nr_segments is dereferenced
    twice at the end of the function.  If a compiler decides to compile this
    into two separate memory accesses then the size limitation could be
    bypassed.
    Fix it by removing the double access to src->nr_segments.
    This is part of XSA-155.
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 23170500] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.149
changelog:
  - xenfb: avoid reading twice the same fields from the shared page
    Reading twice the same field could give the guest an attack of
    opportunity. In the case of event->type, gcc could compile the switch
    statement into a jump table, effectively ending up reading the type
    field multiple times.
    This is part of XSA-155.
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Upsteam commit 0ffd4547665d2fec648ab2c9ff856c5d9db9b07c
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 23170500] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.148
changelog:
  - blkif: Avoid double access to src->nr_segments
    src is stored in shared memory and src->nr_segments is dereferenced
    twice at the end of the function.  If a compiler decides to compile this
    into two separate memory accesses then the size limitation could be
    bypassed.
    Fix it by removing the double access to src->nr_segments.
    This is part of XSA-155.
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Upsteam commit 27942b0cb2327e93deb12326bbe7b36c81f9fa7b
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 23170500] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.147
changelog:
  - libvchan: Read prod/cons only once.
    We must ensure that the prod/cons are only read once and that
    the compiler won't try to optimize the reads. That is split
    the read of these in multiple instructions influencing later
    branch code. As such insert barriers when fetching the cons
    and prod index.
    This is part of XSA155.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 23170500] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.146
changelog:
  - blktap2: Use RING_COPY_REQUEST
    Instead of RING_GET_REQUEST. Using a local copy of the
    ring (and also with proper memory barriers) will mean
    we can do not have to worry about the compiler optimizing
    the code and doing a double-fetch in the shared memory space.
    This is part of XSA155.
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    ---
    v2: Fix compile issues with tapdisk-vbd
    Upsteam commit 851ffb4eea917e2708c912291dea4d133026c0ac
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 23170500] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.145
changelog:
  - xen: Add RING_COPY_REQUEST()
    Using RING_GET_REQUEST() on a shared ring is easy to use incorrectly
    (i.e., by not considering that the other end may alter the data in the
    shared ring while it is being inspected).  Safe usage of a request
    generally requires taking a local copy.
    Provide a RING_COPY_REQUEST() macro to use instead of
    RING_GET_REQUEST() and an open-coded memcpy().  This takes care of
    ensuring that the copy is done correctly regardless of any possible
    compiler optimizations.
    Use a volatile source to prevent the compiler from reordering or
    omitting the copy.
    This is part of XSA155.
    Signed-off-by: David Vrabel <david.vrabel@citrix.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    ---
    v2: Add comment about GCC bug.
    Upsteam commit 12b11658a9d6a654a1e7acbf2f2d56ce9a396c86
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 23170509] {CVE-2015-8550}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.144
changelog:
  - vga: make sure vga register setup for vbe stays intact
    (CVE-2016-3712).
    Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
    registers, to make sure the vga registers will always have the
    values needed by vbe mode.  This makes sure the sanity checks
    applied by vbe_fixup_regs() are effective.
    Without this guests can muck with shift_control, can turn on planar
    vga modes or text mode emulation while VBE is active, making qemu
    take code paths meant for CGA compatibility, but with the very
    large display widths and heigts settable using VBE registers.
    Which is good for one or another buffer overflow.  Not that
    critical as they typically read overflows happening somewhere
    in the display code.  So guests can DoS by crashing qemu with a
    segfault, but it is probably not possible to break out of the VM.
    Fixes: CVE-2016-3712
    Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
    Reported-by: P J P <ppandit@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    Upstream commit 0f2e9e6b3c75a87e9ec9a80d7bc914810e3f3da2
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.143
changelog:
  - vga: update vga register setup on vbe changes
    Call the new vbe_update_vgaregs() function on vbe configuration
    changes, to make sure vga registers are up-to-date.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    Upstream commit 98be1fb6ea31c130264025de8ec87ad2c7532f21
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.142
changelog:
  - vga: factor out vga register setup
    When enabling vbe mode qemu will setup a bunch of vga registers to make
    sure the vga emulation operates in correct mode for a linear
    framebuffer.  Move that code to a separate function so we can call it
    from other places too.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    Upstream commit 2700250c6b28248b70b15fd6e0b4c9db8b2ddfb7
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.141
changelog:
  - vga: add vbe_enabled() helper
    Makes code a bit easier to read.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    Upstream commit e7d7c09689c725be4f0b489b4ba3b741c5d9ab31
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.140
changelog:
  - vbe: rework sanity checks
    Plug a bunch of holes in the bochs dispi interface parameter checking.
    Add a function doing verification on all registers.  Call that
    unconditionally on every register write.  That way we should catch
    everything, even changing one register affecting the valid range of
    another register.
    Some of the holes have been added by commit
    e9c6149f6ae6873f14a12eea554925b6aa4c4dec.  Before that commit the
    maximum possible framebuffer (VBE_DISPI_MAX_XRES * VBE_DISPI_MAX_YRES *
    32 bpp) has been smaller than the qemu vga memory (8MB) and the checking
    for VBE_DISPI_MAX_XRES + VBE_DISPI_MAX_YRES + VBE_DISPI_MAX_BPP was ok.
    Some of the holes have been there forever, such as
    VBE_DISPI_INDEX_X_OFFSET and VBE_DISPI_INDEX_Y_OFFSET register writes
    lacking any verification.
    Security impact:
    (1) Guest can make the ui (gtk/vnc/...) use memory rages outside the vga
    frame buffer as source  ->  host memory leak.  Memory isn't leaked to
    the guest but to the vnc client though.
    (2) Qemu will segfault in case the memory range happens to include
    unmapped areas  ->  Guest can DoS itself.
    The guest can not modify host memory, so I don't think this can be used
    by the guest to escape.
    CVE-2014-3615
    Cc: qemu-stable@nongnu.org
    Cc: secalert@redhat.com
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
    Conflicts:
    hw/vga.c
    Upstream commit c1b886c45dc70f247300f549dce9833f3fa2def5
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.139
changelog:
  - vbe: make bochs dispi interface return the correct memory size with qxl
    VgaState->vram_size is the size of the pci bar.  In case of qxl not the
    whole pci bar can be used as vga framebuffer.  Add a new variable
    vbe_size to handle that case.  By default (if unset) it equals
    vram_size, but qxl can set vbe_size to something else.
    This makes sure VBE_DISPI_INDEX_VIDEO_MEMORY_64K returns correct results
    and sanity checks are done with the correct size too.
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Reviewed-by: Laszlo Ersek <lersek@redhat.com>
    Conflicts:
    hw/qxl.c
    hw/vga.c
    hw/vga_init.c
    Upstream commit 54a85d462447c1cb8a1638578a7fd086350b4d2d
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.138
changelog:
  - vga: fix banked access bounds checking (CVE-2016-3710)
    vga allows banked access to video memory using the window at 0xa00000
    and it supports a different access modes with different address
    calculations.
    The VBE bochs extentions support banked access too, using the
    VBE_DISPI_INDEX_BANK register.  The code tries to take the different
    address calculations into account and applies different limits to
    VBE_DISPI_INDEX_BANK depending on the current access mode.
    Which is probably effective in stopping misprogramming by accident.
    But from a security point of view completely useless as an attacker
    can easily change access modes after setting the bank register.
    Drop the bogus check, add range checks to vga_mem_{readb,writeb}
    instead.
    Fixes: CVE-2016-3710
    Reported-by: Qinghao Tang <luodalongde@gmail.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
    Upstream commit 67305fcf4733fb4fb9eacc33436ec66a7c0352ef
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3710}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.137
changelog:
  - vga: make sure vga register setup for vbe stays intact
    (CVE-2016-3712).
    Call vbe_update_vgaregs() when the guest touches GFX, SEQ or CRT
    registers, to make sure the vga registers will always have the
    values needed by vbe mode.  This makes sure the sanity checks
    applied by vbe_fixup_regs() are effective.
    Without this guests can muck with shift_control, can turn on planar
    vga modes or text mode emulation while VBE is active, making qemu
    take code paths meant for CGA compatibility, but with the very
    large display widths and heigts settable using VBE registers.
    Which is good for one or another buffer overflow.  Not that
    critical as they typically read overflows happening somewhere
    in the display code.  So guests can DoS by crashing qemu with a
    segfault, but it is probably not possible to break out of the VM.
    Fixes: CVE-2016-3712
    Reported-by: Zuozhi Fzz <zuozhi.fzz@alibaba-inc.com>
    Reported-by: P J P <ppandit@redhat.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    [Backport to qemu-xen-tradition]
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Upstream commit 0b0cf8110e97b0cbd0da73d11163e26978822757
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.136
changelog:
  - vga: update vga register setup on vbe changes
    Call the new vbe_update_vgaregs() function on vbe configuration
    changes, to make sure vga registers are up-to-date.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    [Backport to qemu-xen-tradition]
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Upstream commit 5e840e6292825fcae90f6750a8f57bc989e28c5f
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.135
changelog:
  - vga: factor out vga register setup
    When enabling vbe mode qemu will setup a bunch of vga registers to make
    sure the vga emulation operates in correct mode for a linear
    framebuffer.  Move that code to a separate function so we can call it
    from other places too.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    [Backport to qemu-xen-tradition]
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Upstream commit df228023ce39e8b72bd5a198b8703319b8b9ca23
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.134
changelog:
  - vga: add vbe_enabled() helper
    Makes code a bit easier to read.
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    [Backport to qemu-xen-tradition]
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Upstream commit 34db09fb9967441408a1ff0579d553222cf17441
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.133
changelog:
  - CVE-2014-3615: vbe: rework sanity checks
    Backport of qemu-upstream:
    * c1b886c45dc70f247300f549dce9833f3fa2def5
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Upstream commit 8a1e383df25477e21b48c67c93c3a4dde19f9e4f
    Prerequisite commit for CVE-2016-3712
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3712}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.132
changelog:
  - vga: fix banked access bounds checking (CVE-2016-3710)
    vga allows banked access to video memory using the window at 0xa00000
    and it supports a different access modes with different address
    calculations.
    The VBE bochs extentions support banked access too, using the
    VBE_DISPI_INDEX_BANK register.  The code tries to take the different
    address calculations into account and applies different limits to
    VBE_DISPI_INDEX_BANK depending on the current access mode.
    Which is probably effective in stopping misprogramming by accident.
    But from a security point of view completely useless as an attacker
    can easily change access modes after setting the bank register.
    Drop the bogus check, add range checks to vga_mem_{readb,writeb}
    instead.
    Fixes: CVE-2016-3710
    Reported-by: Qinghao Tang <luodalongde@gmail.com>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
    [Backport to qemu-xen-tradition]
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Upstream commit bebb4f580901fb638016d9851a28dbb83d44b3a6
    Backported-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23263093] {CVE-2016-3710}


author: Jie Li <jie.l.li@oracle.com> - 4.3.0-55.el6.131
changelog:
  - Backport BUG 22875089 to ovm 3.3
    Current block script doesn't handle gaps in loop devices well.
    Sorting the losetup -a result with 'sort -g' will fix this issue.
    
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Joe Jin <joe.jin@oracle.com> [bug 23269321]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.130
changelog:
  - x86: fix information leak on AMD CPUs
    The fix for XSA-52 was wrong, and so was the change synchronizing that
    new behavior to the FXRSTOR logic: AMD's manuals explictly state that
    writes to the ES bit are ignored, and it instead gets calculated from
    the exception and mask bits (it gets set whenever there is an unmasked
    exception, and cleared otherwise). Hence we need to follow that model
    in our workaround.
    This is XSA-172 / CVE-2016-3158.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Tested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 23006881] {CVE-2016-3158,CVE-2016-3159}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.129
changelog:
  - x86: enforce consistent cachability of MMIO mappings
    We've been told by Intel that inconsistent cachability between
    multiple mappings of the same page can affect system stability only
    when the affected page is an MMIO one. Since the stale data issue is
    of no relevance to the hypervisor (since all guest memory accesses go
    through proper accessors and validation), handling of RAM pages
    remains unchanged here. Any MMIO mapped by domains however needs to be
    done consistently (all cachable mappings or all uncachable ones), in
    order to avoid Machine Check exceptions. Since converting existing
    cachable mappings to uncachable (at the time an uncachable mapping
    gets established) would in the PV case require tracking all mappings,
    allow MMIO to only get mapped uncachable (UC, UC-, or WC).
    This also implies that in the PV case we mustn't use the L1 PTE update
    fast path when cachability flags get altered.
    Since in the HVM case at least for now we want to continue honoring
    pinned cachability attributes for pages not mapped by the hypervisor,
    special case handling of r/o MMIO pages (forcing UC) gets added there.
    Arguably the counterpart change to p2m-pt.c may not be necessary, since
    UC- (which already gets enforced there) is probably strict enough.
    Note that the shadow code changes include fixing the write protection
    of r/o MMIO ranges: shadow_l1e_remove_flags() and its siblings, other
    than l1e_remove_flags() and alike, return the new PTE (and hence
    ignoring their return values makes them no-ops).
    This is CVE-2016-2270 / XSA-154.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: boris.ostrovsky@oracle.com [bug 22697471] {CVE-2016-2270}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.128
changelog:
  - x86/VMX: sanitize rIP before re-entering guest
    ... to prevent guest user mode arranging for a guest crash (due to
    failed VM entry). (On the AMD system I checked, hardware is doing
    exactly the canonicalization being added here.)
    Note that fixing this in an architecturally correct way would be quite
    a bit more involved: Making the x86 instruction emulator check all
    branch targets for validity, plus dealing with invalid rIP resulting
    from update_guest_eip() or incoming directly during a VM exit. The only
    way to get the latter right would be by not having hardware do the
    injection.
    Note further that there are a two early returns from
    vmx_vmexit_handler(): One (through vmx_failed_vmentry()) leads to
    domain_crash() anyway, and the other covers real mode only and can
    neither occur with a non-canonical rIP nor result in an altered rIP,
    so we don't need to force those paths through the checking logic.
    This is XSA-170.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: boris.ostrovsky@oracle.com [bug 22697473] {CVE-2016-2271}


author: Joe Jin <joe.jin@oracle.com> - 4.3.0-55.el6.127
changelog:
  - x86/irq: limit the maximum number of domain PIRQs
    c/s 7e73a6e "have architectures specify the number of PIRQs a hardware domain
    gets" increased the default number of pirqs for dom0, as 256 was found to be
    too low in some cases.
    However, it didn't account for the upper bound presented by the domains EOI
    bitmap, registered with the PHYSDEVOP_pirq_eoi_gmfn_v* hypercall.
    On a server with 240 cpus, Xen was observed to be attempting to clear the EOI
    bit for dom0's pirq 0xb40f, which hit a pagefault.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    (cherry picked from commit 75d28c917094b0e264874e92e8980b00a372b99f)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Backported-by: Joe Jin <joe.jin@oracle.com> [bug 22661468] [bug 22668626]


author: Joe Jin <joe.jin@oracle.com> - 4.3.0-55.el6.126
changelog:
  - have architectures specify the number of PIRQs a hardware domain gets
    The current value of nr_static_irqs + 256 is often too small for larger
    systems. Make it dependent on CPU count and number of IO-APIC pins on
    x86, and (until it obtains PCI support) simply NR_IRQS on ARM.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: David Vrabel <david.vrabel@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Release-Acked-by: Konrad Rzeszutek Wilk <Konrad.wilk@oracle.com>
    (cherry picked from commit 7e73a6e7f12ae080222c5d339799905de3443a6e)
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [bug 22668626] [bug 22661468]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.125
changelog:
  - xl/xend: error out if pcnet emulated driver model is used.
    From http://xenbits.xen.org/xsa/advisory-162.html:
    The QEMU security team has predisclosed the following advisory:
    The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving
    packets in loopback mode, appends CRC code to the receive
    buffer. If the data size given is same as the buffer size(4096),
    the appended CRC code overwrites 4 bytes after the s->buffer,
    making the adjacent 's->irq' object point to a new location.
    IMPACT
    ======
    A guest which has access to an emulated PCNET network device
    (e.g. with "model=pcnet" in their VIF configuration) can exploit this
    vulnerability to take over the qemu process elevating its privilege to
    that of the qemu process.
    This patch resolves XSA-162 but is not the solution provided by xen.org.
    If using either xl or xm - in both cases fail the creation
    if model=pcnet is used.
    Suggested-by:  Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    ---
    tools/libxl/libxl.c                 |  4 ++++
    tools/python/xen/xend/XendConfig.py | 15 ++++++++++++++-
    2 files changed, 18 insertions(+), 1 deletion(-) [bug 22487422] {CVE-2015-7504}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.124
changelog:
  - x86/VMX: prevent INVVPID failure due to non-canonical guest address
    While INVLPG (and on SVM INVLPGA) don't fault on non-canonical
    addresses, INVVPID fails (in the "individual address" case) when passed
    such an address.
    Since such intercepted INVLPG are effectively no-ops anyway, don't fix
    this in vmx_invlpg_intercept(), but instead have paging_invlpg() never
    return true in such a case.
    This is XSA-168.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: zhenzhong.duan@oracle.com [bug 22577652] {CVE-2016-1571}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.123
changelog:
  - x86/mm: PV superpage handling lacks sanity checks
    MMUEXT_{,UN}MARK_SUPER fail to check the input MFN for validity before
    dereferencing pointers into the superpage frame table.
    get_superpage() has a similar issue.
    This is XSA-167.
    Reported-by: Qinghao Tang <luodalongde@gmail.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22577494] {CVE-2016-1570}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.122
changelog:
  - x86/HVM: avoid reading ioreq state more than once
    Otherwise, especially when the compiler chooses to translate the
    switch() to a jump table, unpredictable behavior (and in the jump table
    case arbitrary code execution) can result.
    This is XSA-166.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22487371]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.121
changelog:
  - x86: don't leak ST(n)/XMMn values to domains first using them
    FNINIT doesn't alter these registers, and hence using it is
    insufficient to initialize a guest's initial state.
    This is XSA-165.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22487377] {CVE-2015-8555}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.120
changelog:
  - MSI-X: avoid array overrun upon MSI-X table writes
    pt_msix_init() allocates msix->msix_entry[] to just cover
    msix->total_entries entries. While pci_msix_readl() resorts to reading
    physical memory for out of bounds reads, pci_msix_writel() so far
    simply accessed/corrupted unrelated memory.
    pt_iomem_map()'s call to cpu_register_physical_memory() registers a
    page granular region, which is necessary as the Pending Bit Array may
    share space with the MSI-X table (but nothing else is allowed to). This
    also explains why pci_msix_readl() actually honors out of bounds reads,
    but pci_msi_writel() doesn't need to.
    This is XSA-164.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22487381] {CVE-2015-8554}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.119
changelog:
  - Fix num node allocation issue for VM
    When bootup a VM with more vcpus than pcpus per node on a numa enabled system,
    VM may get double allocation of the same node for pcpus, lower the performance
    of guest.
    On the customer rack we see the CPU spikes happen on the large vServer
    which has CPU oversubscription problem caused due to this problem.
    Signed-off-by: Zhenzhong Duan<zhenzhong.duan@oracle.com>
    Acked-by: Chuang Cao<chuang.cao@oracle.com> [bug 22154251]


author: Joe Jin <joe.jin@oracle.com> - 4.3.0-55.el6.118
changelog:
  - xend/image: Don't throw VMException when using backend domains for disks.
    If we are using backend domains the disk image may not be
    accessible within the host (domain0). As such it is OK to
    continue on.
    The 'addStoreEntries' in DevController.py already does the check
    to make sure that when the 'backend' configuration is used - that
    said domain exists.
    As such the only change we need to do is to exclude the disk
    image location if the domain is not dom0.
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Joe Jin <joe.jin@oracle.com> [bug 22242513]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.117
changelog:
  - x86/HVM: always intercept #AC and #DB
    Both being benign exceptions, and both being possible to get triggered
    by exception delivery, this is required to prevent a guest from locking
    up a CPU (resulting from no other VM exits occurring once getting into
    such a loop).
    The specific scenarios:
    1) #AC may be raised during exception delivery if the handler is set to
    be a ring-3 one by a 32-bit guest, and the stack is misaligned.
    2) #DB may be raised during exception delivery when a breakpoint got
    placed on a data structure involved in delivering the exception. This
    can result in an endless loop when a 64-bit guest uses a non-zero IST
    for the vector 1 IDT entry, but even without use of IST the time it
    takes until a contributory fault would get raised (results depending
    on the handler) may be quite long.
    This is XSA-156.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Conflicts:
    xen/arch/x86/hvm/svm/svm.c
    xen/include/asm-x86/hvm/hvm.h
    Needed to tweak patch context to match the OVM 3.3 code base
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: Todd Vierling <todd.vierling@oracle.com> [bug 22171710] {CVE-2015-5307}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.116
changelog:
  - From 43a10fecd6f4a9d8adf9f5d85e3d5e7187e2d54a Mon Sep 17 00:00:00 2001
    From: Ian Jackson <ian.jackson@eu.citrix.com>
    Date: Wed, 18 Nov 2015 15:34:54 +0000
    Subject: [PATCH] libxl: Fix bootloader-related virtual memory leak on pv
    build failure
    The bootloader may call libxl__file_reference_map(), which mmap's the
    pv_kernel and pv_ramdisk into process memory.  This was only unmapped,
    however, on the success path of libxl__build_pv().  If there were a
    failure anywhere between libxl_bootloader.c:parse_bootloader_result()
    and the end of libxl__build_pv(), the calls to
    libxl__file_reference_unmap() would be skipped, leaking the mapped
    virtual memory.
    Ideally this would be fixed by adding the unmap calls to the
    destruction path for libxl__domain_build_state.  Unfortunately the
    lifetime of the libxl__domain_build_state is opaque, and it doesn't
    have a proper destruction path.  But, the only thing in it that isn't
    from the gc are these bootloader references, and they are only ever
    set for one libxl__domain_build_state, the one which is
    libxl__domain_create_state.build_state.
    So we can clean up in the exit path from libxl__domain_create_*, which
    always comes through domcreate_complete.
    Remove the now-redundant unmaps in libxl__build_pv's success path.
    This is XSA-160.
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Based on xen.org's xsa160.patch
    Conflicts:
    adjust patch context to match OVM 3.2 code base
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com>
    Tested-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [bug 22326121] {CVE-2015-8341}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.115
changelog:
  - memory: fix XENMEM_exchange error handling
    assign_pages() can fail due to the domain getting killed in parallel,
    which should not result in a hypervisor crash.
    Also delete a redundant put_gfn() - all relevant paths leading to the
    "fail" label already do this (and there are also paths where it was
    plain wrong). All of the put_gfn()-s got introduced by 51032ca058
    ("Modify naming of queries into the p2m"), including the otherwise
    unneeded initializer for k (with even a kind of misleading comment -
    the compiler warning could actually have served as a hint that the use
    is wrong).
    This is XSA-159.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 22325246] {CVE-2015-8339,CVE-2015-8340}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.114
changelog:
  - Revert "Keep the maxmem and memory same in vm.cfg"
    This commit saves original config mem and maxmem and use that in
    the populate on demand check. This patch would be a partial fix to Bug
    21673915 but memory is still being increased by 4M (with cirrus video)
    over reboots and this was being caused by commit
    "xend: Fix xm list bug reporting incorrect memory size". Since the
    latter is reverted the original behaviour of memory/maxmem is restored and
    leaves this commit with no use.
    Reviewed-by: Annie Li <annie.li@oracle.com>
    Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22145952]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.113
changelog:
  - xend: fix xm list introducing memory_actual R/O field
    Introduces a field to sxp data structures named "memory_actual"
    that xm will use to have up-to-date domain memory values from Xen.
    This value is always up-to-date when xend refresh the list of domains,
    though it's not used in domain management functions like memory_dynamic_max
    and memory_static_max to determine the memory the domain will have if
    rebooted/balloned/saved/restored.
    Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22145952]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.112
changelog:
  - Revert "xend: Fix xm list bug reporting incorrect memory size"
    This patch reverts 6797b4c5 because it introduces a regression
    when a guest reboots (on its own initiative) with a PCI passthrough.
    By changing xcinfo domain memory with the most up-to-date values
    from libxc we will cause a failed reboot (with PCI) and the creation
    of a bigger guest and with balloning enabled.
    xm creates a guest with X MBs plus 4 (default) megabytes in a HVM guest.
    Plus, Xen/libxc won't allocate exactly that amount of memory (e.g. there
    is a 128k VGA hole, 8 pages for console/xenstore/etc). This means from the
    view of the toolstack we will always see a gap between mem and maxmem which
    means that PoD gets enabled when guest is rebooted if these memory
    values are up-to-date with libxc. Since PCI devices can't be attached with
    PoD enabled, it later causes the bug we observed.
    The previous behaviour was to change this domain state only when explicit
    for example on xm mem-set, pretty much as xl is doing right now. The next
    patch will (re)fix the memory size listing issue which this commit we are
    reverting intended to fix.
    Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 22145952]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.111
changelog:
  - x86: rate-limit logging in do_xen{oprof,pmu}_op()
    Some of the sub-ops are acessible to all guests, and hence should be
    rate-limited. In the xenoprof case, just like for XSA-146, include them
    only in debug builds. Since the vPMU code is rather new, allow them to
    be always present, but downgrade them to (rate limited) guest messages.
    This is XSA-152.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 22088876] {CVE-2015-7971}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.110
changelog:
  - xenoprof: free domain's vcpu array
    This was overlooked in fb442e2171 ("x86_64: allow more vCPU-s per
    guest").
    This is XSA-151.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 22088823] {CVE-2015-7969}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.109
changelog:
  - x86: guard against undue super page PTE creation
    When optional super page support got added (commit bd1cd81d64 "x86: PV
    support for hugepages"), two adjustments were missed: mod_l2_entry()
    needs to consider the PSE and RW bits when deciding whether to use the
    fast path, and the PSE bit must not be removed from L2_DISALLOW_MASK
    unconditionally.
    This is XSA-148.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 22088354] {CVE-2015-7835}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.108
changelog:
  - AMD IOMMU: don't free page table prematurely
    iommu_merge_pages() still wants to look at the next level page table,
    the TLB flush necessary before freeing too happens in that function,
    and if it fails no free should happen at all. Hence the freeing must
    be done after that function returned successfully, not before it's
    being called.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Joe Jin <joe.jin@oracle.com> [bug 21906833]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 4.3.0-55.el6.107
changelog:
  - chkconfig services should associated with xen-tools
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Reviewed-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 21889146]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 4.3.0-55.el6.106
changelog:
  - Backport python/xc memory leak fix
    3.4.1 commit 00621bb9a6471695e1ea962553f801f38cbe3884
    python/xc: add missing Py_DECREF() to fix a memory leak
    Python PyList_Append() will increase reference count of the item. We have to
    decrease its reference count to let it garbage collected.
    We missed the Py_DECREF() for 'cpuinfo_obj' here, thus we have a memory leak.
    The memory leak could be easily confirmed by:
      >>> import xen.lowlevel.xc
    >>> xc = xen.lowlevel.xc.xc()
    >>> for i in range(1000): xc.getcpuinfo(1)
    And check the python process memory usage before and after:
      Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Acked-by: Wei Liu <wei.liu2@citrix.com> [bug 21784632]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.105
changelog:
  - libxl: explicitly allocate BUFIOREQ event channel
    There is an OVM-only change for domain creation that is only
    implemented for xend. The change is to allocate the buffered IO
    request server explicitly instead of doing it by default for VCPU 0.
    Without this change qemu cannot initialize and thus failing the domain
    creation with the following error in the device model:
    bind interdomain ioctl error 22
    qemu: hardware error: xen hardware virtual machine initialisation failed
    Commit bebfe22 ("Xen: Fix pvhvm  migration issue from ovm3.2.8 to
    ovm3.4") introduces this change for xend and this patch introduces
    it for libxl.
    Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
    Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 21694010] [bug (DEVICE] [bug MODEL] [bug FAILURE] [bug LAUNCHING] [bug HVM] [bug VM] [bug WITH] [bug 'XL')] [bug 21748894]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.104
changelog:
  - x86/kexec: fix kexec on systems which boot in x2apic mode
    Moving straight from fully disabled to x2apic mode is an illegal state
    transition, and causes an unconditional #GP fault.  Bounce through xapic mode
    to avoid the fault.
    In addition, avoid bouncing through the various apic modes if the mode is
    already correct.
    Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Upstream commit 77ffa26374370c1c9805f9596f37a44d412a7fdb
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> [bug 21197271]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.103
changelog:
  - x86/MCE: Fix race condition in mctelem_reserve
    These lines (in mctelem_reserve)
    newhead = oldhead->mcte_next;
    if (cmpxchgptr(freelp, oldhead, newhead) == oldhead) {
    are racy. After you read the newhead pointer it can happen that another
    flow (thread or recursive invocation) change all the list but set head
    with same value. So oldhead is the same as *freelp but you are setting
    a new head that could point to whatever element (even already used).
    This patch use instead a bit array and atomic bit operations.
    Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
    Reviewed-by: Liu Jinsong <jinsong.liu@intel.com>
    Upstream commit 60ea3a3ac3d2bcd8e85b250fdbfc46b3b9dc7085
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Joe Jin <joe.jin@oracle.com> [bug 21544772]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.102
changelog:
  - mce: fix race condition in mctelem_xchg_head
    The function (mctelem_xchg_head()) used to exchange mce telemetry
    list heads is racy.  It may write to the head twice, with the second
    write linking to an element in the wrong state.
    If there are two threads, T1 inserting on committed list; and T2
    trying to consume it.
    1. T1 starts inserting an element (A), sets prev pointer (mcte_prev).
    2. T1 is interrupted after the cmpxchg succeeded.
    3. T2 gets the list and changes element A and updates the commit list
    head.
    4. T1 resumes, reads pointer to prev again and compare with result
    from the cmpxchg which succeeded but in the meantime prev changed
    in memory.
    5. T1 thinks the cmpxchg failed and goes around the loop again,
    linking head to A again.
    To solve the race use temporary variable for prev pointer.
    *linkp (which point to a field in the element) must be updated before
    the cmpxchg() as after a successful cmpxchg the element might be
    immediately removed and reinitialized.
    The wmb() prior to the cmpchgptr() call is not necessary since it is
    already a full memory barrier.  This wmb() is thus removed.
    Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
    Reviewed-by: Liu Jinsong <jinsong.liu@intel.com>
    Upstream commit e9af61b969906976188609379183cb304935f448
    Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Acked-by: Joe Jin <joe.jin@oracle.com>
    ---
    xen/arch/x86/cpu/mcheck/mctelem.c |    9 +++++----
    1 files changed, 5 insertions(+), 4 deletions(-)
    diff --git a/xen/arch/x86/cpu/mcheck/mctelem.c b/xen/arch/x86/cpu/mcheck/mctelem.c
    index 37d830f..895ce1a 100644
    --- a/xen/arch/x86/cpu/mcheck/mctelem.c
    +++ b/xen/arch/x86/cpu/mcheck/mctelem.c
    @@ -127,13 +127,14 @@ static DEFINE_PER_CPU(struct mc_telem_cpu_ctl, mctctl);
    static DEFINE_SPINLOCK(processing_lock);
    
    static void mctelem_xchg_head(struct mctelem_ent **headp,
    -				struct mctelem_ent **old,
    +				struct mctelem_ent **linkp,
    struct mctelem_ent *new)
    {
    for (;;) {
    -		*old = *headp;
    -		wmb();
    -		if (cmpxchgptr(headp, *old, new) == *old)
    +		struct mctelem_ent *old;
    +
    +		*linkp = old = *headp;
    +		if (cmpxchgptr(headp, old, new) == old)
    break;
    }
    }
    --
    1.7.3 [bug 21544772]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.101
changelog:
  - rtl8139: check TCP Data Offset field (qemu traditional)
    The TCP Data Offset field contains the length of the header.  Make sure
    it is valid and does not exceed the IP data length.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 7/7 qemu traditional XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.100
changelog:
  - rtl8139: skip offload on short TCP header (qemu traditional)
    TCP Large Segment Offload accesses the TCP header in the packet.  If the
    packet is too short we must not attempt to access header fields:
    tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
    int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 6/7 qemu traditional XSA-140 CVE-2015-5165
    Conflicts:
    added "(qemu traditional)" to the patch subject line
    tools/qemu-xen-traditional-dir/hw/rtl8139.c
    different patch context
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.99
changelog:
  - rtl8139: check IP Total Length field (qemu traditional)
    The IP Total Length field includes the IP header and data.  Make sure it
    is valid and does not exceed the Ethernet payload size.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 5/7 qemu traditional XSA-140 CVE-2015-5165
    Conflicts:
    added "(qemu traditional)" to the patch subject line
    tools/qemu-xen-traditional-dir/hw/rtl8139.c
    different patch context
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.98
changelog:
  - rtl8139: check IP Header Length field (qemu traditional)
    The IP Header Length field was only checked in the IP checksum case, but
    is used in other cases too.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 4/7 qemu traditional XSA-140 CVE-2015-5165
    Conflicts:
    added "(qemu traditional)" to the patch subject line
    tools/qemu-xen-traditional-dir/hw/rtl8139.c
    different patch context
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.97
changelog:
  - rtl8139: skip offload on short Ethernet/IP header (qemu traditional)
    Transmit offload features access Ethernet and IP headers the packet.  If
    the packet is too short we must not attempt to access header fields:
    int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
    ...
    eth_payload_data = saved_buffer + ETH_HLEN;
    ...
    ip = (ip_header*)eth_payload_data;
    if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 3/7 qemu traditional XSA-140 CVE-2015-5165
    Conflicts:
    added "(qemu traditional)" to the patch subject line
    tools/qemu-xen-traditional-dir/hw/rtl8139.c
    different patch context
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.96
changelog:
  - rtl8139: drop tautologous if (ip) {...} statement (qemu traditional)
    The previous patch stopped using the ip pointer as an indicator that the
    IP header is present.  When we reach the if (ip) {...} statement we know
    ip is always non-NULL.
    Remove the if statement to reduce nesting.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 2/7 qemu traditional XSA-140 CVE-2015-5165
    Conflicts:
    added "(qemu traditional)" to the patch subject line
    tools/qemu-xen-traditional-dir/hw/rtl8139.c
    DPRINTF() changed to DEBUG_PRINT()
    args to rtl8139_transfer_frame()
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.95
changelog:
  - rtl8139: avoid nested ifs in IP header parsing (qemu traditional)
    Transmit offload needs to parse packet headers.  If header fields have
    unexpected values the offload processing is skipped.
    The code currently uses nested ifs because there is relatively little
    input validation.  The next patches will add missing input validation
    and a goto label is more appropriate to avoid deep if statement nesting.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Blind-porting to Xen 4.1.4 by Sebastian Pipping <sebastian@pipping.org>
    This is 1/7 qemu traditional XSA-140 CVE-2015-5165
    Conflicts:
    added "(qemu traditional)" to the patch subject line
    replaced incorrect 3/7 patch comment block with 1/7
    tools/qemu-xen-traditional-dir/hw/rtl8139.c
    DPRINTF() changed to DEBUG_PRINT()
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.94
changelog:
  - rtl8139: check TCP Data Offset field
    The TCP Data Offset field contains the length of the header.  Make sure
    it is valid and does not exceed the IP data length.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 7/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.93
changelog:
  - rtl8139: skip offload on short TCP header
    TCP Large Segment Offload accesses the TCP header in the packet.  If the
    packet is too short we must not attempt to access header fields:
    tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
    int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 6/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.92
changelog:
  - rtl8139: check IP Total Length field
    The IP Total Length field includes the IP header and data.  Make sure it
    is valid and does not exceed the Ethernet payload size.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 5/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.91
changelog:
  - rtl8139: check IP Header Length field
    The IP Header Length field was only checked in the IP checksum case, but
    is used in other cases too.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 4/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.90
changelog:
  - rtl8139: skip offload on short Ethernet/IP header
    Transmit offload features access Ethernet and IP headers the packet.  If
    the packet is too short we must not attempt to access header fields:
    int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
    ...
    eth_payload_data = saved_buffer + ETH_HLEN;
    ...
    ip = (ip_header*)eth_payload_data;
    if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 3/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.89
changelog:
  - rtl8139: drop tautologous if (ip) {...} statement
    The previous patch stopped using the ip pointer as an indicator that the
    IP header is present.  When we reach the if (ip) {...} statement we know
    ip is always non-NULL.
    Remove the if statement to reduce nesting.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 2/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.88
changelog:
  - rtl8139: avoid nested ifs in IP header parsing
    Transmit offload needs to parse packet headers.  If header fields have
    unexpected values the offload processing is skipped.
    The code currently uses nested ifs because there is relatively little
    input validation.  The next patches will add missing input validation
    and a goto label is more appropriate to avoid deep if statement nesting.
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    This is 1/7 XSA-140 CVE-2015-5165
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21526815] {CVE-2015-5165}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.87
changelog:
  - pci: completely unhook the unplugged IDEDevice from the corresponding BlockBackend
    pci_piix3_xen_ide_unplug should completely unhook the unplugged
    IDEDevice from the corresponding BlockBackend, otherwise the next call
    to release_drive will try to detach the drive again.
    Suggested-by: Kevin Wolf <kwolf@redhat.com>
    Signed-off-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    This is XSA-139 / CVE-2015-5166
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21518660] {CVE-2015-5166}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.86
changelog:
  - ide: Clear DRQ after handling all expected accesses
    This is additional hardening against an end_transfer_func that fails to
    clear the DRQ status bit. The bit must be unset as soon as the PIO
    transfer has completed, so it's better to do this in a central place
    instead of duplicating the code in all commands (and forgetting it in
    some).
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
    This is XSA-138 CVE-2015-5154
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com>
    Tested-by: boris.ostrovsky@oracle.com
    Tested-by: konrad.wilk@oracle.com [bug 21497175] {CVE-2015-5154}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.85
changelog:
  - ide/atapi: Fix START STOP UNIT command completion
    The command must be completed on all code paths. START STOP UNIT with
    pwrcnd set should succeed without doing anything.
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
    This is XSA-138 CVE-2015-5154
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com>
    Tested-by: boris.ostrovsky@oracle.com
    Tested-by: konrad.wilk@oracle.com [bug 21497175] {CVE-2015-5154}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.84
changelog:
  - ide: Check array bounds before writing to io_buffer
    (CVE-2015-5154)
    If the end_transfer_func of a command is called because enough data has
    been read or written for the current PIO transfer, and it fails to
    correctly call the command completion functions, the DRQ bit in the
    status register and s->end_transfer_func may remain set. This allows the
    guest to access further bytes in s->io_buffer beyond s->data_end, and
    eventually overflowing the io_buffer.
    One case where this currently happens is emulation of the ATAPI command
    START STOP UNIT.
    This patch fixes the problem by adding explicit array bounds checks
    before accessing the buffer instead of relying on end_transfer_func to
    function correctly.
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
    This is XSA-138 CVE-2015-5154
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com>
    Tested-by: boris.ostrovsky@oracle.com
    Tested-by: konrad.wilk@oracle.com [bug 21497175] {CVE-2015-5154}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.82
changelog:
  - ide: Check array bounds before writing to io_buffer
    If the end_transfer_func of a command is called because enough data has
    been read or written for the current PIO transfer, and it fails to
    correctly call the command completion functions, the DRQ bit in the
    status register and s->end_transfer_func may remain set. This allows the
    guest to access further bytes in s->io_buffer beyond s->data_end, and
    eventually overflowing the io_buffer.
    One case where this currently happens is emulation of the ATAPI command
    START STOP UNIT.
    This patch fixes the problem by adding explicit array bounds checks
    before accessing the buffer instead of relying on end_transfer_func to
    function correctly.
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Kevin Wolf <kwolf@redhat.com>
    This is XSA-138 CVE-2015-5154
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21497175] {CVE-2015-5154}


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> - 4.3.0-55.el6.81
changelog:
  - This affects qemu-xen and qemu-xen-traditional differently.
    If qemu-xen was compiled with SDL support then this would result in an
    SDL window being opened if $DISPLAY is valid, or a failure to start
    the guest if not. Passing "-display none" to qemu before any further
    -sdl options disables this default behaviour and ensures that SDL is
    only started if the libxl configuration demands it.
    If qemu-xen was compiled without SDL support then qemu would instead
    start a VNC server listening on ::1 (IPv6 localhost) or 127.0.0.1
    (IPv4 localhost) with IPv6 preferred if available. Explicitly pass
    "-vnc none" when vnc is not enabled in the libxl configuration to
    remove this possibility.
    qemu-xen-traditional would never start a vnc backend unless asked.
    However by default it will start an SDL backend, the way to disable
    this is to pass a -vnc option. In other words passing "-vnc none" will
    disable both vnc and sdl by default. sdl can then be reenabled if
    configured by subsequent use of the -sdl option.
    Tested with both qemu-xen and qemu-xen-traditional built with SDL
    support and:
    xl cr # defaults
    xl cr sdl=0 vnc=0
    xl cr sdl=1 vnc=0
    xl cr sdl=0 vnc=1
    xl cr sdl=0 vnc=0 vga="none"
    xl cr sdl=0 vnc=0 nographic=1
    with both valid and invalid $DISPLAY.
    This is XSA-119 / CVE-2015-2152.
    Reported-by: Sander Eikelenboom <linux@eikelenboom.it>
    Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
    Acked-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> [bug 20968955] {CVE-2015-2152}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.80
changelog:
  - x86/traps: loop in the correct direction in compat_iret()
    This is XSA-136.
    Reviewed-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21219156] {CVE-2015-4164}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.79
changelog:
  - pcnet: force the buffer access to be in bounds during tx
    4096 is the maximum length per TMD and it is also currently the size of
    the relay buffer pcnet driver uses for sending the packet data to QEMU
    for further processing. With packet spanning multiple TMDs it can
    happen that the overall packet size will be bigger than sizeof(buffer),
    which results in memory corruption.
    Fix this by only allowing to queue maximum sizeof(buffer) bytes.
    This is CVE-2015-3209.
    Signed-off-by: Petr Matousek <pmatouse@redhat.com>
    Reported-by: Matt Tait <matttait@google.com>
    Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21218569] {CVE-2015-3209}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.78
changelog:
  - pcnet: fix Negative array index read
    
    From: Gonglei <arei.gonglei@huawei.com>
    s->xmit_pos maybe assigned to a negative value (-1),
    but in this branch variable s->xmit_pos as an index to
    array s->buffer. Let's add a check for s->xmit_pos.
    
    upstream-commit-id: 7b50d00911ddd6d56a766ac5671e47304c20a21b
    Signed-off-by: Gonglei <arei.gonglei@huawei.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Reviewed-by: Jason Wang <jasowang@redhat.com>
    Reviewed-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-by: John Haxby <john.haxby@oracle.com> [bug 21218569] {CVE-2015-3209}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.76
changelog:
  - pcnet: fix Negative array index read
    
    From: Gonglei <arei.gonglei@huawei.com>
    s->xmit_pos maybe assigned to a negative value (-1),
    but in this branch variable s->xmit_pos as an index to
    array s->buffer. Let's add a check for s->xmit_pos.
    
    upstream-commit-id: 7b50d00911ddd6d56a766ac5671e47304c20a21b
    Signed-off-by: Gonglei <arei.gonglei@huawei.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Reviewed-by: Jason Wang <jasowang@redhat.com>
    Reviewed-by: Jason Wang <jasowang@redhat.com>
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21218569] {CVE-2015-3209}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.75
changelog:
  - gnttab: add missing version check to GNTTABOP_swap_grant_ref handling
    ... avoiding NULL derefs when the version to use wasn't set yet (via
    GNTTABOP_setup_table or GNTTABOP_set_version).
    This is XSA-134.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21217969] {CVE-2015-4163}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.74
changelog:
  - xen/pt: unknown PCI config space fields should be read-only
    ... by default. Add a per-device "permissive" mode similar to pciback's
    to allow restoring previous behavior (and hence break security again,
    i.e. should be used only for trusted guests).
    This is part of XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>)
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.72
changelog:
  - xen/pt: add a few PCI config space field descriptions
    Since the next patch will turn all not explicitly described fields
    read-only by default, those fields that have guest writable bits need
    to be given explicit descriptors.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.71
changelog:
  - xen/pt: add a few PCI config space field descriptions
    Since the next patch will turn all not explicitly described fields
    read-only by default, those fields that have guest writable bits need
    to be given explicit descriptors.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    ---
    Notes:
    - blindly allowing all VPD reads may still be a problem (out of bounds
    addresses aren't allowed, but the spec doesn't say what the effect
    would be) ==> also an issue in pciback?
    - Vendor Specific cap regs aren't in the table (will become r/o by
    default with this change)
    - many PCIe cap regs aren't in the table (will again become r/o)
    - same for PM cap regs at offsets 6 and 7
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.70
changelog:
  - xen/pt: mark reserved bits in PCI config space fields
    The adjustments are solely to make the subsequent patches work right
    (and hence make the patch set consistent), namely if permissive mode
    (introduced by the last patch) gets used (as both reserved registers
    and reserved fields must be similarly protected from guest access in
    default mode, but the guest should be allowed access to them in
    permissive mode).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.68
changelog:
  - xen/pt: mark all PCIe capability bits read-only
    xen_pt_emu_reg_pcie[]'s PCI_EXP_DEVCAP needs to cover all bits as read-
    only to avoid unintended write-back (just a precaution, the field ought
    to be read-only in hardware).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.66
changelog:
  - xen/pt: split out calculation of throughable mask in PCI config space handling
    This is just to avoid having to adjust that calculation later in
    multiple places.
    Note that including ->ro_mask in get_throughable_mask()'s calculation
    is only an apparent (i.e. benign) behavioral change: For r/o fields it
    doesn't matter > whether they get passed through - either the same flag
    is also set in emu_mask (then there's no change at all) or the field is
    r/o in hardware (and hence a write won't change it anyway).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.65
changelog:
  - xen/pt: split out calculation of throughable mask in PCI config space handling
    This is just to avoid having to adjust that calculation later in
    multiple places.
    Note that including ->ro_mask in get_throughable_mask()'s calculation
    is only an apparent (i.e. benign) behavioral change: For r/o fields it
    doesn't matter > whether they get passed through - either the same flag
    is also set in emu_mask (then there's no change at all) or the field is
    r/o in hardware (and hence a write won't change it anyway).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Reviewed-by: Anthony PERARD <anthony.perard@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.64
changelog:
  - xen/pt: correctly handle PM status bit
    xen_pt_pmcsr_reg_write() needs an adjustment to deal with the RW1C
    nature of the not passed through bit 15 (PCI_PM_CTRL_PME_STATUS).
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.62
changelog:
  - xen/pt: consolidate PM capability emu_mask
    There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing
    PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local
    emu_mask variable - we can have the same effect by setting the field
    descriptor's emu_mask member suitably right away. Note that
    xen_pt_pmcsr_reg_write() is being retained in order to allow later
    patches to be less intrusive.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.61
changelog:
  - xen/pt: consolidate PM capability emu_mask
    There's no point in xen_pt_pmcsr_reg_{read,write}() each ORing
    PCI_PM_CTRL_STATE_MASK and PCI_PM_CTRL_NO_SOFT_RESET into a local
    emu_mask variable - we can have the same effect by setting the field
    descriptor's emu_mask member suitably right away. Note that
    xen_pt_pmcsr_reg_write() is being retained in order to allow later
    patches to be less intrusive.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.60
changelog:
  - xen/MSI: don't open-code pass-through of enable bit modifications
    Without this the actual XSA-131 fix would cause the enable bit to not
    get set anymore (due to the write back getting suppressed there based
    on the OR of emu_mask, ro_mask, and res_mask).
    Note that the fiddling with the enable bit shouldn't really be done by
    qemu, but making this work right (via libxc and the hypervisor) will
    require more extensive changes, which can be postponed until after the
    security issue got addressed.
    This is a preparatory patch for XSA-131.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21164462] {CVE-2015-4106}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.58
changelog:
  - xen/MSI-X: disable logging by default
    ... to avoid allowing the guest to cause the control domain's disk to
    fill.
    This is XSA-130.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21159365] {CVE-2015-4105}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.57
changelog:
  - xen/MSI-X: limit error messages resulting from bad guest behavior
    ... to avoid allowing the guest to cause the control domain's disk to
    fill.
    The first message in pci_msix_write() can simply be deleted, as this
    is indeed bad guest behavior, but such out of bounds writes don't
    really need to be logged.
    The second one is more problematic, as there guest behavior may only
    appear to be wrong: For one, the old logic didn't take the mask-all bit
    into account. And then this shouldn't depend on host device state (i.e.
    the host may have masked the entry without the guest having done so).
    Plus these writes shouldn't be dropped even when an entry is unmasked.
    Instead, if they can't be made take effect right away, they should take
    effect on the next unmasking or enabling operation - the specification
    explicitly describes such caching behavior. Until we can validly drop
    the message (implementing such caching/latching behavior), issue the
    message just once per MSI-X table entry.
    Note that the log message in pci_msix_read() similar to the one being
    removed here is not an issue: "addr" being of unsigned type, and the
    maximum size of the MSI-X table being 32k, entry_nr simply can't be
    negative and hence the conditonal guarding issuing of the message will
    never be true.
    This is XSA-130.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21159365] {CVE-2015-4105}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.56
changelog:
  - xen: don't allow guest to control MSI mask register
    It's being used by the hypervisor. For now simply mimic a device not
    capable of masking, and fully emulate any accesses a guest may issue
    nevertheless as simple reads/writes without side effects.
    This is XSA-129.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21158627] {CVE-2015-4104}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.55
changelog:
  - xen: properly gate host writes of modified PCI CFG contents
    The old logic didn't work as intended when an access spanned multiple
    fields (for example a 32-bit access to the location of the MSI Message
    Data field with the high 16 bits not being covered by any known field).
    Remove it and derive which fields not to write to from the accessed
    fields' emulation masks: When they're all ones, there's no point in
    doing any host write.
    This fixes a secondary issue at once: We obviously shouldn't make any
    host write attempt when already the host read failed.
    This is XSA-128.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21157330] {CVE-2015-4103}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.53
changelog:
  - xen: properly gate host writes of modified PCI CFG contents
    The old logic didn't work as intended when an access spanned multiple
    fields (for example a 32-bit access to the location of the MSI Message
    Data field with the high 16 bits not being covered by any known field).
    Remove it and derive which fields not to write to from the accessed
    fields' emulation masks: When they're all ones, there's no point in
    doing any host write.
    This fixes a secondary issue at once: We obviously shouldn't make any
    host write attempt when already the host read failed.
    This is XSA-128.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com>
    Reviewed-By: Todd Vierling <todd.vierling@oracle.com> [bug 21157330] {CVE-2015-4103}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.52
changelog:
  - fdc: force the fifo access to be in bounds of the allocated buffer
    During processing of certain commands such as FD_CMD_READ_ID and
    FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
    get out of bounds leading to memory corruption with values coming
    from the guest.
    Fix this by making sure that the index is always bounded by the
    allocated memory.
    This is CVE-2015-3456.
    Signed-off-by: Petr Matousek <pmatouse@redhat.com>
    Reviewed-by: John Snow <jsnow@redhat.com>
    XSA-133
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 21078489] {CVE-2015-3456}


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.50
changelog:
  - x86: vcpu_destroy_pagetables() must not return -EINTR
    .. otherwise it has the side effect that: domain_relinquish_resources
    will stop and will return to user-space with -EINTR which it is not
    equipped to deal with that error code; or vcpu_reset - which will
    ignore it and convert the error to -ENOMEM..
    The preemption mechanism we have for domain destruction is to return
    -EAGAIN (and then user-space calls the hypercall again) and as such we need
    to catch the case of:
    domain_relinquish_resources
    ->vcpu_destroy_pagetables
    -> put_page_and_type_preemptible
    -> __put_page_type
    returns -EINTR
    and convert it to the proper type. For:
    XEN_DOMCTL_setvcpucontext
    -> vcpu_reset
    -> vcpu_destroy_pagetables
    we need to return -ERESTART otherwise we end up returning -ENOMEM.
    There are also other callers of vcpu_destroy_pagetables: arch_vcpu_reset
    (vcpu_reset) are:
    - hvm_s3_suspend (asserts on any return code),
    - vlapic_init_sipi_one (asserts on any return code),
    Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 20854486]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.49
changelog:
  - mm: Make scrubbing a low-priority task
    An idle processor will attempt to scrub pages left over by a previously
    exited guest. The processor takes global heap_lock in scrub_free_pages(),
    manipulates pages on the heap lists and releases the lock before performing
    the actual scrubbing in __scrub_free_pages().
    It has been observed that on some systems, even though scrubbing itself
    is done with the lock not held, other unrelated heap users are unable
    to take the (now free) lock. We theorize that massive scrubbing locks out
    the bus (or some other HW resources), preventing lock requests from reaching
    the scrubbing node.
    This patch tries to alleviate this problem by having the scrubber monitor
    whether there are other waiters for the heap lock and, if such waiters
    exist, stop scrubbing.
    To achieve this, we make two changes to existing code:
    1. Parallelize the heap lock by breaking it to per-node locks
    2. Create an atomic per-node counter array. Before a CPU on a particular
    node attempts to acquire the (now per-node) lock it increments the counter.
    The scrubbing processor periodically checks this counter and, if it is
    non-zero, stops scrubbing.
    Few notes:
    1. Until now, total_avail_pages and midsize_alloc_zone_pages updates have been
    performed under global heap_lock which was also used to control access to heap.
    Since now those accesses are guarded by per-node locks, we introduce heap_lock_global.
    Note that this is really only to protect readers of this variables from reading
    inconsistent values (such as if another CPU is in the middle of updating them).
    The values themselves are somewhat "unsynchronized" from actual heap state. We
    try to be conservative and decrement them before pages are taken from the heap
    and increment them after they are placed there.
    2. Similarly, page_broken/offlined_list are no longer under heap_lock.
    pglist_lock is added to synchronize access to those lists.
    3. d->last_alloc_node used to be updated under heap_lock. It was read, however,
    without holding this lock so it seems that lockless updates will not make the
    situation any worse (and since these updates are simple writes, as opposed to
    some sort of RMW, we shouldn't need to convert it to an atomic).
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 20816684]


author: Chuck Anderson <chuck.anderson@oracle.com> - 4.3.0-55.el6.48
changelog:
  - IOMMU: make page table deallocation preemptible
    Backport of cedfdd43a97.
    We are spending lots of time flushing CPU cache, one PTE at a time, to
    make sure that IOMMU (which may not be able to watch coherence traffic
    on the bus) doesn't load stale PTE from memory.
    For guests with lots of memory (say, >512GB) this may take as much as
    half a minute or more and as result (because this is a non-preemptable
    operation) things start to break down.
    Below is the original commit message:
    This too can take an arbitrary amount of time.
    In fact, the bulk of the work is being moved to a tasklet, as handling
    the necessary preemption logic in line seems close to impossible given
    that the teardown may also be invoked on error paths.
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Acked-by: Xiantao Zhang <xiantao.zhang@intel.com>
    Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
    Acked-by: Chuck Anderson <chuck.anderson@oracle.com> [bug 19731529]


author: Adam Jackson <ajax@redhat.com> 1.1.4-3
changelog:
  - libX11-1.1.4-xcb-xreply-leak.patch: Fix a leak when the client has a
    non-fatal error handler. (mclasen, fdo #17616)


author: Adam Jackson <ajax@redhat.com> 1.1.3-2
changelog:
  - libX11-1.1.3-xkb-lock-fix.patch: Don't LockDisplay() recursively.  Fixes
    Gnome hang at logout. (#326461)


author: Adam Jackson <ajax@redhat.com> 1.1.2-3
changelog:
  - libX11-1.1.2-GetMotionEvents.patch: Fix the definition of XGetMotionEvents
    to match the argument order in the headers. (#274671)


author: Mike A. Harris <mharris@redhat.com> 1.0.3-2.fc6
changelog:
  - Added libX11-nls-indic-locales-bug185376.patch to add support for various
    indic locales which have now been committed upstream (#185376)


author: Mike A. Harris <mharris@redhat.com> 1.0.3-1.fc6
changelog:
  - Updated libX11 to version 1.0.3
  - Remove libX11-1.0.1-setuid.diff as it is included in the 1.0.3 release.
  - Added 'dist' tag to "Release:"


author: Mike A. Harris <mharris@redhat.com> 1.0.2-1
changelog:
  - Updated libX11 to version 1.0.2
  - Bump BuildRequires and Requires to "xorg-x11-proto-devel >= 7.1-2" to meet
    new "xproto >= 7.0.6" dependency.
  - Disable libX11-0.99.3-datadir-locale-dir-fix.patch as it is now included
    upstream.
  - Remove autoconf dependency as we no longer need it.


author: Mike A. Harris <mharris@redhat.com> 1.0.1-3
changelog:
  - Added libX11-1.0.1-setuid.diff to fix potential security issue (#196094)
  - Change dependency on "filesystem" package to "xorg-x11-filesystem" package,
    so we can control this dep centrally.
  - Added NEWS to doc list.


author: Mike A. Harris <mharris@redhat.com> 0.99.4-1
changelog:
  - Updated libX11 to version 0.99.4 from X11R7 RC3
  - Added "Requires(pre): xorg-x11-filesystem >= 0.99.2-3", to ensure
    that /usr/lib/X11 and /usr/include/X11 pre-exist.
  - Removed 'x' suffix from manpage directories to match RC3 upstream.


author: Mike A. Harris <mharris@redhat.com> 0.99.3-4
changelog:
  - Added libX11-0.99.3-datadir-locale-dir-fix.patch, to fix build to install
    the locale data files into datadir instead of libdir. (#173282)


author: Mike A. Harris <mharris@redhat.com> 0.99.3-1
changelog:
  - Updated libX11 to version 0.99.3 from X11R7 RC2
  - Changed 'Conflicts: XFree86-devel, xorg-x11-devel' to 'Obsoletes'
  - Changed 'Conflicts: XFree86-libs, xorg-x11-libs' to 'Obsoletes'


author: Mike A. Harris <mharris@redhat.com> 0.99.2-1
changelog:
  - Updated to libX11-0.99.2 from the X11R7 RC1 release.
  - Added en_GR.UTF-8 locale to file manifest.
  - Forcibly remove Xcms.txt


author: Mike A. Harris <mharris@redhat.com> 0.99.0-3
changelog:
  - Renamed package to remove xorg-x11 from the name due to unanimous decision
    between developers.
  - Use Fedora Extras style BuildRoot tag.
  - Disable static library creation by default.
  - Add missing defattr to devel subpackage
  - Add missing documentation files to doc macro


author: Martin Nagy <mnagy@redhat.com> - 20071127-3
changelog:
  - major patch cleanup so it will be easier to get patches upstream
  - fix for #68212, previous fix actually didn't work for ping6
  - renewed the ia64 align patches
  - update README.bonding
  - clear up the code from warnings
  - spec file cleanup


author: Martin Nagy <mnagy@redhat.com> - 20070202-6
changelog:
  - fix absolute symlinks and character encoding for RELNOTES (#225909)
  - preserve file timestamps (#225909)
  - use %{?_smp_mflags} (#225909)
  - fix service rdisc stop removing of lock file


author: Martin Bacovsky <mbacovsk@redhat.com> - 20070202-4
changelog:
  - resolves: #236725: ping does not work for subsecond intervals for ordinary user
  - resolves: #243197: RFE: Please sync ifenslave with current kernel
  - resolves: #246954: Initscript Review
  - resolves: #251124: can't build rdisc - OPEN_MAX undeclared


author: Martin Bacovsky <mbacovsk@redhat.com> - 20070202-2
changelog:
  - Resolves: #234060: [PATCH] IDN (umlaut domains) support for ping and ping6
    patch provided by Robert Scheck <redhat@linuxnetz.de>


author: Martin Bacovsky <mbacovsk@redhat.com> - 20070202-1
changelog:
  - upgarde to new upstream iputils-s20070202
  - Resolves: #229995
  - Resolves: #225909 - Merge Review: iputils
  - patches revision


author: Martin Bacovsky <mbacovsk@redhat.com>- 20020927-42
changelog:
  - Resolves: #218706 - now defines the destination address along RFC3484
  - Resolves: #229630 - ifenslave(8) man page added
  - Resolves: #213716 - arping doesn't work on InfiniBand ipoib interfaces


author: Martin Bacovsky <mbacovsk@redhat.com> - 20020927-40
changelog:
  - tracepath doesn't continue past destination host (#174032) 
    previous patch replaced by new one provided by <mildew@gmail.com>
    option -c added


author: Phil Knirsch <pknirsch@redhat.com> 20020927-4
changelog:
  - Fixed DNS lookup problems (#68212).
  - Added warning if binding problem failed on subinterface (#81640).


author: Phil Knirsch <pknirsch@redhat.com> 20020927-3
changelog:
  - Removed bonding tarball and replaced it with ifenslave.c and README
  - FHS compliance for all tools, now to be found in /bin with compat symlinks to
    old places.


author: Phil Knirsch <pknirsch@redhat.com> 20020124-7
changelog:
  - Added new BuildPreReqs for docbook-utils and perl-SGMLSpm (#66661)
  - Fixed ipv6 error printing problem (#66659).


author: Phil Knirsch <pknirsch@redhat.com>
changelog:
  - Added a patch to activate the rdisc server (#64270).
  - Display the countermeasures warning only in verbose (#55236)


author: Philipp Knirsch <pknirsch@redhat.de>
changelog:
  - Fixed a bunch of compiler warnings (#37131)
  - Fixed wrong exit code for no packets and deadline (#40323)
  - Moved arping to /sbin from /usr/sbin due to ifup call (#45785). Symlink from
    /usr/sbin/ provided for backwards compatibility.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - include README.ifenslave doco.
  - "ping -i N" was broke for N >= 3 (#9929).
  - update to ss000121:
  -- clockdiff: preserve raw socket errno.
  -- ping: change error exit code to 1 (used to be 92,93, ...)
  -- ping,ping6: if -w specified, transmit until -c limit is reached.
  -- ping,ping6: exit code non-zero if some packets not received within deadline.


author: Jeff Johnson <jbj@redhat.com>
changelog:
  - add remaining binaries.
  - casts to remove compilation warnings.
  - terminate if -w deadline is reached exactly (#8724).


author: Shelly Ma <shelly.ma@oracle.com> - 1.1.0-95.el6.6
changelog:
  - Backport: fixed multiple repository mounts due to multiple IP assignment to the NFS file server in a round robin fashion. 
    Acknowledged by Firas Azar <firas.azar@oracle.com>, Adnan Misherfi<adnan.misherfi@oralce.com> [bug 22683343]


author: Firas Azar <firas.azar@oracle.com> - 1.1.0-95.el6.5
changelog:
  - Backport 3.4 changes for bug 20488507. Overload control for high numbers of exports in NFS server during refresh operation. Prevent shortage of TCP sockets. [bug 21569557]


author: Chuang Cao <chuang.cao@oracle.com> - 1.1.0-95.el6.4
changelog:
  - Get the correct storage path with split when there is
    a zfs snapshot.
    Signed-off-by: Chuang Cao <chuang.cao@oracle.com>
    Signed-off-by: John Haxby <john.haxby@oracle.com>
    Acked-by: Firas Azar <firas.azar@oracle.com>
    Backported-by: Chuang Cao <chuang.cao@oracle.com> [bug 20510340]


author: Ke-Chiang Chen <ke-chiang.chen@oracle.com> - 1.1.0-95.el6.3
changelog:
  - Correct NFS mount options handling if the options list is empty instead of NONE
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Siddharth Verma <siddharth.x.verma@oracle.com> [bug 20839271]


author: Ke-Chiang Chen <ke-chiang.chen@oracle.com> - 1.1.0-95.el6.2
changelog:
  - Use default NFS mount options instead of toggling NFS versions.
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Siddharth Verma <siddharth.x.verma@oracle.com> [bug 20839176]


author: Chuang Cao <chuang.cao@oracle.com> - 1.1.0-95.el6.1
changelog:
  - Change the string to int type during the size comparing.
    Signed-off-by: Chuang Cao <chuang.cao@oracle.com>
    Acked-by: Cathy Avery <cathy.avery@oracle.com>
    Backported-by: Chuang Cao <chuang.cao@oracle.com> [bug 19146857]


author: Firas Azar <firas.azar@oracle.com> - 1.1.0-95
changelog:
  - Signed-off by: Cathy A Avery <cathy.avery@oracle.com>
    Signed-off by: Adnan G Misherfi <adnan.misherfi@oracle.com>
    Signed-off by: Ken Chen <ke-chiang.chen@oracle.com> [bug 18520749]


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-94
changelog:
  - SPARC - should use san module to retrieve device info
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-93
changelog:
  - Bug 18060881 - IF SPARC SERVER CANNOT ACCESS POOLFS, ADD SERVER TO CLUSTER WILL HANG
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-92
changelog:
  - fix syntax error in generic/scsi_solaris.py
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Carson Hovey <carson.hovey@oracle.com> - 1.1.0-91
changelog:
  - se_record.state field is now filled in with SE_STATES.ONLINE, OFFLINE.
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com>
    Signed-off-by: Alexandre Chartre  <alexandre.chartre@oracle.com>
    Oracle-bug: Bug 17299685 - CLI ALWAYS REPORTS STATE OF PHYSICAL DISK AS UNKNOWN
    patch_name: Bug17299685.patch


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 1.1.0-85
changelog:
  - calling `subprocess.Popen()` with `close_fds=True`
    Problem:
    - Fork a process without closing file descriptors will result in the child process holding all parent opened file descriptors.
    - A child of Agent XMLRPC Daemon is holding the socket port 8899.
    - Agent wants to restart XMLRPC Daemon upon `take_ownership()` and after `release_ownership()` : so it cannot bind to port 8899 any more.
    - The fix is to always calling `subprocess.Popen()` with `close_fds=True`.
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com> [bug 17533127]


author: Carson Hovey <carson.hovey@oracle.com> - 1.1.0-84
changelog:
  - Bug 17258567 - Change directory protection from 0555 to 0755 
    Signed-off-by: Cathy.Avery <cathy.avery@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-83
changelog:
  - SPARC - ZFS disk WWID should be unique accross different servers
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-80
changelog:
  - make iSCSI code modular
    SPARC - add iSCSI support
    SPARC - change LUN identification to be compatible with Linux/x86
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-79
changelog:
  - SPARC - plugin should use Solaris devprop command instead of custom command
    SPARC - "sasinfo lu" fails if there is no SAS adapter
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-78
changelog:
  - include SAS luns to the list of luns on SPARC
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-77
changelog:
  - Bug 16553436 - 3.3.1.175 REFRESH ISCSI/STORAGE FAILS - SERECORD.PATH EXPECTS LIST, NOT STRING
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-75
changelog:
  - add SCSI support for Solaris
    add modules for OS specific SCSI functions
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-72
changelog:
  - Bug 14846665 - ovs sparc packages should not use the ldoms publisher
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-71
changelog:
  - Solaris package should not include SCSI plugin and Linux files
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-70
changelog:
  - report all mount errors if mount fails on Solaris (Solaris fix for 14460831)
    select better mount options for NFS on Solaris
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>


author: Alexandre Chartre <alexandre.chartre@oracle.com> - 1.1.0-67
changelog:
  - Solaris build and package support
    Signed-off-by: Alexandre Chartre <alexandre.chartre@oracle.com>
    Signed-off-by: Liam Merwick <liam.merwick@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 1.1.0-66
changelog:
  - Add debugging information to umount(). Hopefully there will be more details
    logged once we hit the bug again.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Oracle-bug: 14479264


author: Junjie Wei <junjie.wei@oracle.com> - 1.1.0-64
changelog:
  - Enhance logging in NFSPlugin.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>


author: Cathy Avery <cathy.avery@oracle.com> - 1.1.0-60
changelog:
  - Added check to mount to throw exception if the uuid of the fs_record and the uuid of the fs do not match. [bug 14307805]


author: Cathy Avery <cathy.avery@oracle.com> - 1.1.0-52
changelog:
  - Added various mount options for discovery of unpresented luns. The mount will cycle thru to
    obtain a sucessful mount.


author: Kurt Hackel <kurt.hackel@oracle.com> - 1.1.0-51
changelog:
  - * fixes an indentation issue in _getMountInfo
    * workaround the problem in core not stripping trailing slashes from FS mounts
    Signed-off-by:cathy.avery@oracle.com


author: Junjie Wei <junjie.wei@oracle.com> - 1.1.0-48
changelog:
  - Add debug information for mount() and umount().
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 1.1.0-45
changelog:
  - fix file close
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Adnan Misherfi <adnan.misherfi@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>


author: Junjie Wei <junjie.wei@oracle.com> - 1.1.0-41
changelog:
  - Log umount details for NFSPlugin.
    Signed-off-by: Junjie Wei <junjie.wei@oracle.com>
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com> [bug 13001348]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 1.1.0-40
changelog:
  - NFSPlugin listMountPoints(): fix share path dectection
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Wiekus Beukes <wiekus.beukes@oracle.com> [bug 12848852]


author: Zhigang Wang <zhigang.x.wang@oracle.com> - 1.1.0-37
changelog:
  - fix the file/dir creation mode for NFSPlugin
    Signed-off-by: Zhigang Wang <zhigang.x.wang@oracle.com>
    Signed-off-by: Kurt Hackel <kurt.hackel@oracle.com>
    Signed-off-by: Cathy Avery <cathy.avery@oracle.com> [bug 12719289]


author: Cathy Avery <cathy.avery@oracle.com> - 1.1.0-31
changelog:
  - Fixed list method to return only those iscsi /dev/mpath/ devices that belong to the
    specified ss_name. The get mp page 83 is only temporary. [bug 11847174]


author: Kurt Hackel <kurt.hackel@oracle.com> - 1.1.0-14
changelog:
  - Reinstate filtering out extraneous files systems when fs_record is indicated in listMountPoints. [bug 10334559]


author: Cathy Avery <cathy.avery@oracle.com> - 1.1.0-13
changelog:
  - Added uuid stamps to all subdir mounts. This avoids having to mount the nfs root to get the uuidand cuts down on nfs mount activity. This a patch is a partial fix for bug 10278397. [bug 102778397]


author: Wiekus Beukes <wiekus.beukes@oracle.com> - 1.1.0-11
changelog:
  - Need to make sure in listMountPoints that the mount point to check is not a read-only non stamped mount point
    orabug:10268910


author: Cathy Avery <cathy.avery@oracle.com> - 1.1.0-4
changelog:
  - Fixed .generic_fs_stamp going to null. Fixed emtpy .generic_fs_stamp not being updated with a valid uuid.


author: Wiekus Beukes <wiekus.beukes@oracle.com> - 1.0.0-5
changelog:
  - Changed fillSSInfo to not set fields to None, Changed the AccessGroup return a valid dict (for now) This call should never be called since the flag is set to indicate that Access control is not supported


author: Rex Dieter <rdieter@fedoraproject.org> - 0.7.6-3
changelog:
  - drop alternatives, use app-wrapper instead (borrowed from opensuse)
  - -qt4 experimental subpkg, -qt includes qt3 version again  (#523488)


author: Ville Skyttä <ville.skytta at iki.fi> - 0.7.2-1
changelog:
  - 0.7.2, docs patch applied upstream.
  - Switch to GTK2 in -gtk.
  - Fine tune dependencies.
  - Build with dependency tracking disabled.
  - Clean up obsolete pre-FC2 support.


author: Ville Skyttä <ville.skytta at iki.fi> - 0:0.6.9-0.fdr.1
changelog:
  - Update to 0.6.9.
  - Smoother experience with --excludedocs.
  - Don't change alternative priorities on upgrade.


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-1
changelog:
  - Rebase to NSS 3.26.0
  - Remove upstreamed patch for CVE-2016-1950
  - Remove p-disable-md5-590364-reversed.patch for bug 1335915


author: Elio Maldonado <emaldona@redhat.com> - 3.21.0-1
changelog:
  - Rebase to nss-util from nss 3.21
  - Resolves: Bug 1297890 - Rebase RHEL 6.8 to NSS-util 3.21 in preparation for Firefox 45


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Fix the required nspr version to be 4.10.6
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-1
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.1-3
changelog:
  - Preserve existing permissions when replacing existing pkcs11.txt file, but keep strict default permissions for new files
  - Resolves: rhbz#990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-5
changelog:
  - Update to NSS_3_15_1_RTM
  - Resolves: rhbz#1002644 - Rebase RHEL 6 to NSS-UTIL 3.15.1 (for FF 24.x)


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-4
changelog:
  - Resolves: rhbz#976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-2
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#918136 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#919174 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-3
changelog:
  - Update to nss-3.14.0.0-1
  - Add temporary patch so utilmod doesn't include any headers from softoken
  - Keep the hasht.h from current nss-softokn-devel
  - Remove the long obsoleted nss-nolocalsql.patch


author: Elio Maldonado <emaldona@redhat.com> - 3.13.5-1
changelog:
  - Update to NSS_3_13_5_RTM
  - Resolves: rhbz#833480 - Update nss-util on RHEL 6.x to NSS 3.13.5 for Mozilla 10.0.6
  - Add -L${libdir}/nss3 to Libs: line in nspr.pc.in


author: Elio Maldonado <emaldona@redhat.com> - 3.13.3-2
changelog:
  - Resolves: rhbz#799192 - Update to 3.13.3
  - Update minimum nspr version for Requires and BuildRequires to 4.9
  - Fix version/release in changelog to match the Version and Release tags, now 3.13.3-2


author: Elio Maldonado<emaldona@redhat.com> - 3.12.4-3
changelog:
  - Remove symbolic links to shared libraries from devel - 521155
  - Apply nss-nolocalsql patch subset for nss-util
  - No rpath-link in nss-util-config


author: Elio Maldonado<emaldona@redhat.com> - 3.12.3.99.3-11
changelog:
  - Remove spurious executable permissions from nss-util-config
  - Shorten some descriptions to keep rpmlint happy


author: Dennis Gilmore <dennis@ausil.us> 3.12.3.99.3-10
changelog:
  - dont include the headers in nss-util only in the -devel package
  - nss-util-devel Requires nss-devel since its only providing a subset of the headers.


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.18-1
changelog:
  - update to 3.6.18 (http://www.sqlite.org/releaselog/3_6_18.html)
  - drop no longer needed test-disabler patches


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.17-1
changelog:
  - update to 3.6.17 (http://www.sqlite.org/releaselog/3_6_17.html)
  - disable to failing tests until upstream fixes


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.14-1
changelog:
  - update to 3.6.14 (http://www.sqlite.org/releaselog/3_6_14.html)
  - merge-review cosmetics (#226429)
    - drop ancient sqlite3 obsoletes
    - fix tab vs space whitespace issues
    - remove commas from summaries
  - fixup io-test fsync expectations wrt SQLITE_DISABLE_DIRSYNC


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.12-2
changelog:
  - disable strict aliasing to work around brokenness on 3.6.12 (#494266)
  - run test-suite on build but let it fail for now


author: Panu Matilainen <pmatilai@redhat.com> - 3.6.6.2-2
changelog:
  - require tcl(abi) in sqlite-tcl subpackage (#474034)
  - move tcl extensions to arch-specific location
  - enable dependency extraction on the tcl dso
  - require pkgconfig in sqlite-devel


author: Panu Matilainen <pmatilai@redhat.com> - 3.5.9-2
changelog:
  - Remove references to temporary registers from cache on release (#463061)
  - Enable loading of external extensions (#457433)


author: Paul Nasrat <pnasrat@redhat.com> - 3.3.6-1
changelog:
  - Update to 3.3.6
  - Fix typo  (#189647)
  - Enable threading fixes (#181298)
  - Conditionalize static library


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-4
changelog:
  - Fix and enable tests (%check).
  - Backport a change which makes tests exit with nonzero status when they fail.
  - Add a fix for upstream tests for CVE-2018-7750 (broken in previous).


author: Pavel Cahyna <pcahyna@redhat.com> - 1.7.5-3
changelog:
  - Fix a security flaw (CVE-2018-7750) in Paramiko's server mode
    (emphasis on **server** mode; this does **not** impact *client* use!)
    Backported from 1.10: https://gist.github.com/stevebeattie/0eb190004e10ba0926ad8782f89676ad
    Resolves #1557140


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.5-1
changelog:
  - v1.7.5 (Ernest) 19jul09
  - -----------------------
  -  * added support for ARC4 cipher and CTR block chaining (Denis Bernard)
  -  * made transport threads daemonize, to fix python 2.6 atexit behavior
  -  * support unicode hostnames, and IP6 addresses (Maxime Ripard, Shikhar
  -    Bhushan)
  -  * various small bug fixes


author: Jeffrey C. Ollie <jeff@ocjtech.us> - 1.7.1-3
changelog:
  - Update to latest Python packaging guidelines.
  - Apply patch that fixes insecure use of RandomPool.


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.7.el6uek]
changelog:
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796364]  {CVE-2017-1000251}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.5.el6uek]
changelog:
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638921]  {CVE-2017-1000365} {CVE-2017-1000365}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.4.el6uek]
changelog:
  - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault)  [Orabug: 26586047]  {CVE-2016-10200} 
  - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik)  [Orabug: 26586022]  {CVE-2016-9685} 
  - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells)  [Orabug: 26585994]  {CVE-2016-9604} 
  - ipv6: fix out of bound writes in __ip6_append_data() (Eric Dumazet)  [Orabug: 26578198]  {CVE-2017-9242}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.3.el6uek]
changelog:
  - posix_acl: Clear SGID bit when setting file permissions (Jan Kara)  [Orabug: 25507344]  {CVE-2016-7097} {CVE-2016-7097}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.2.el6uek]
changelog:
  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields)  [Orabug: 26366022]  {CVE-2017-7645}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.1.el6uek]
changelog:
  - selinux: quiet the filesystem labeling behavior message (Paul Moore)  [Orabug: 25290650]  
  - HID: hid-cypress: validate length of report (Greg Kroah-Hartman)  [Orabug: 25891907]  {CVE-2017-7273} 
  - udf: Remove repeated loads blocksize (Jan Kara)  [Orabug: 25905721]  {CVE-2015-4167} 
  - udf: Check length of extended attributes and allocation descriptors (Jan Kara)  [Orabug: 25905721]  {CVE-2015-4167} 
  - udf: Verify i_size when loading inode (Jan Kara)  [Orabug: 25905721]  {CVE-2015-4167} 
  - btrfs: drop unused parameter from btrfs_item_nr (Ross Kirk)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: cleanup of function where fixup_low_keys() is called (Tsutomu Itoh)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of fixup_low_keys() (Tsutomu Itoh)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of btrfs_extend_item() (Tsutomu Itoh)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: add support for asserts (Josef Bacik)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: make xattr replace operations atomic (Filipe Manana)  [Orabug: 25948098]  {CVE-2014-9710} 
  - net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom (Al Viro)  [Orabug: 25948145]  {CVE-2015-2686} 
  - PCI: Prevent VPD access for QLogic ISP2722 (Ethan Zhao)  [Orabug: 25975506]  
  - PCI: Prevent VPD access for buggy devices (Babu Moger)  [Orabug: 25975506]  
  - xsigo: [backport](UEK3)-Compute node crash on FC failover (Pradeep Gopanapalli)  [Orabug: 26007560]  
  - ipv4: try to cache dst_entries which would cause a redirect (Hannes Frederic Sowa)  [Orabug: 26032372]  {CVE-2015-1465} 
  - RDS/IB: active bonding port state fix for intfs added late (Mukesh Kacker)  [Orabug: 26139385]  
  - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for priv area size (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - dccp/tcp: do not inherit mc_list from parent (Eric Dumazet)  [Orabug: 26108571]  {CVE-2017-8890} 
  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields)  [Orabug: 25986990]  {CVE-2017-7895}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.18.1.el6uek]
changelog:
  - fnic: Update fnic driver version to 1.6.0.24 (John Sobecki)  [Orabug: 24448585]  
  - xen-netfront: Rework the fix for Rx stall during OOM and network stress (Dongli Zhang)  [Orabug: 25450703]  
  - xen-netfront: Fix Rx stall during network stress and OOM (Dongli Zhang)  [Orabug: 25450703]  
  - ipv6: Skip XFRM lookup if dst_entry in socket cache is valid (Jakub Sitnicki)   
  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles)  [Orabug: 25549809]  
  - ksplice: add sysctls for determining Ksplice features. (Jamie Iles)  [Orabug: 25549809]  
  - signal: protect SIGNAL_UNKILLABLE from unintentional clearing. (Jamie Iles)  [Orabug: 25549809]  
  - VSOCK: Fix lockdep issue. (Dongli Zhang)  [Orabug: 25559937]  
  - VSOCK: sock_put wasn't safe to call in interrupt context (Dongli Zhang)  [Orabug: 25559937]  
  - IB/CORE: sync the resouce access in fmr_pool (Wengang Wang)  [Orabug: 25677469]  
  - KVM: x86: fix emulation of "MOV SS, null selector" (Paolo Bonzini)  [Orabug: 25719675]  {CVE-2017-2583} {CVE-2017-2583} 
  - ext4: validate s_first_meta_bg at mount time (Eryu Guan)  [Orabug: 25719738]  {CVE-2016-10208} 
  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo Ricardo Leitner)  [Orabug: 25719810]  {CVE-2017-5986} 
  - tcp: avoid infinite loop in tcp_splice_read() (Eric Dumazet)  [Orabug: 25720813]  {CVE-2017-6214} 
  - lpfc cannot establish connection with targets that send PRLI under P2P mode (Joe Jin)  [Orabug: 25759083]  
  - USB: visor: fix null-deref at probe (Johan Hovold)  [Orabug: 25796594]  {CVE-2016-2782} 
  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr Bueso)  [Orabug: 25797012]  {CVE-2017-5669} 
  - vhost: actually track log eventfd file (Marc-André Lureau)  [Orabug: 25797052]  {CVE-2015-6252} 
  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Andy Whitcroft)  [Orabug: 25814663]  {CVE-2017-7184} 
  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Andy Whitcroft)  [Orabug: 25814663]  {CVE-2017-7184} 
  - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Aniket Alshi)  [Orabug: 25823962]  {CVE-2017-2647} {CVE-2017-2647} 
  - USB: whiteheat: fix potential null-deref at probe (Johan Hovold)  [Orabug: 25825105]  {CVE-2015-5257} {CVE-2015-5257} 
  - udf: Check path length when reading symlink (Jan Kara)  [Orabug: 25871102]  {CVE-2015-9731} 
  - udp: properly support MSG_PEEK with truncated buffers (Eric Dumazet)  [Orabug: 25876655]  {CVE-2016-10229} 
  - block: fix use-after-free in seq file (Vegard Nossum)  [Orabug: 25877530]  {CVE-2016-7910} 
  - Revert "fix minor infoleak in get_user_ex()" (Brian Maly)  [Orabug: 25790392]  {CVE-2016-9644} 
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766911]  {CVE-2016-8399} 
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765776]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765445]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751996]  {CVE-2017-7187}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.1.el6uek]
changelog:
  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696686]  {CVE-2017-2636} 
  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696686]  {CVE-2017-2636} 
  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696686]  {CVE-2017-2636} 
  - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 21305080]  {CVE-2015-4700} 
  - net: filter: return -EINVAL if BPF_S_ANC* operation is not supported (Daniel Borkmann)  [Orabug: 22187148]  
  - KEYS: request_key() should reget expired keys rather than give EKEYEXPIRED (David Howells)   
  - KEYS: Increase root_maxkeys and root_maxbytes sizes (Steve Dickson)   
  - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451530]  {CVE-2016-8633} 
  - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463927]  {CVE-2016-3672} 
  - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug: 25463927]  {CVE-2016-3672} 
  - pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (WANG Cong)  [Orabug: 25490335]  {CVE-2015-8569} 
  - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490372]  {CVE-2015-5707} 
  - kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (Jim Mattson)  [Orabug: 25507195]  {CVE-2016-9588} 
  - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507230]  {CVE-2016-8645} 
  - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507230]  {CVE-2016-8645} 
  - fix minor infoleak in get_user_ex() (Al Viro)  [Orabug: 25507281]  {CVE-2016-9178} 
  - scsi: arcmsr: Simplify user_len checking (Borislav Petkov)  [Orabug: 25507328]  {CVE-2016-7425} 
  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507328]  {CVE-2016-7425} 
  - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512413]  {CVE-2016-4580} 
  - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512471]  {CVE-2016-3140} 
  - ipv4: keep skb->dst around in presence of IP options (Eric Dumazet)  [Orabug: 25543892]  {CVE-2017-5970} 
  - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682430]  {CVE-2017-6345} 
  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Andrey Konovalov)   {CVE-2017-6074} 
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]  {CVE-2016-8646} 
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25203623]  {CVE-2016-9793}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.1.el6uek]
changelog:
  - nvme: Limit command retries (Ashok Vairavan)  [Orabug: 25374794]  
  - tcp: fix use after free in tcp_xmit_retransmit_queue() (Eric Dumazet)  [Orabug: 25374371]  {CVE-2016-6828} 
  - logging errors that get masked to EIO inside drivers/block/loop.c (Manjunath Patil)  [Orabug: 22505535]  
  - ALSA: pcm : Call kill_fasync() in stream lock (Takashi Iwai)  [Orabug: 25203963]  {CVE-2016-9794} 
  - packet: fix race condition in packet_set_ring (Philip Pettersson)  [Orabug: 25217756]  {CVE-2016-8655} 
  - x86: kvmclock: zero initialize pvclock shared memory area (Igor Mammedov)  [Orabug: 25218431]  
  - KEYS: Fix short sprintf buffer in /proc/keys show function (David Howells)  [Orabug: 25306373]  {CVE-2016-7042} 
  - uek-rpm ol7: change uek-rpm/ol7/update-el release value from 7.1 to 7.3 (Brian Maly)  [Orabug: 25348336]  
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269176]  {CVE-2016-3157} {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298611]  {CVE-2016-7117}


author: Dave Airlie <airlied@redhat.com> 9.0-0.8
changelog:
  - CVE-2013-1872: memory corruption oob read/write on intel (#963063)
  - CVE-2013-1993: interger overflows in protocol handling (#961613)


author: Adam Jackson <ajax@redhat.com> 8.1-0.19
changelog:
  - Fix pthread linkage of glapi and osmesa
  - Drop llvmpipe-related patches
  - Don't require mesa-dri1-drivers on s390{,x}


author: Adam Jackson <ajax@redhat.com> 7.11-2
changelog:
  - mesa-7.11-b9c7773e.patch: Sync with 7.11 branch
  - mesa-7.11-gen6-depth-stalls.patch: Fix GPU hangs on gen6+ in openarena
    and others (#741806)
  - Drop tdfx_dri.so, as there's no glide3 package or drm support in el6.


author: Dave Airlie <airlied@redhat.com> 7.7-1
changelog:
  - rebase to 7.7 release - the best base to move forward at this point in time.
  - bump libdrm requires


author: Adam Jackson <ajax@redhat.com> 7.6-0.9
changelog:
  - Today's git snap.
  - mesa-7.1-disable-intel-classic-warn.patch: Drop.
  - mesa-7.6-hush-vblank-warning.patch: Hush the drmWaitVBlank() warning.
  - Add -dri-drivers-experimental package, add r600 to it.  Note: experimental
    means it doesn't work, don't file bugs unless they contain patches.


author: Adam Jackson <ajax@redhat.com> 7.6-0.8
changelog:
  - Build --disable-asm on x86 since it makes everything all textrel'y and
    that makes selinux unhappy.  Strictly we only need to disable the asm
    dispatch code, but the build system doesn't make that an option yet.


author: Adam Jackson <ajax@redhat.com> 7.3-5
changelog:
  - libGL Requires: mesa-dri-drivers%{?_isa}.  Gets both 32 and 64 bit
    drivers installed on multilib systems, so 32-bit clients get DRI.


author: Dave Airlie <airlied@redhat.com> 7.3-0.2
changelog:
  - intel-fix-sarea-define.patch - workaround wrong define
  - intel-triple-remove.patch - remove triple buffering


author: Dave Airlie <airlied@redhat.com> 7.1-0.38
changelog:
  - latest Mesa snapshot - re-enable tex offset
  - add r300 command buffer support on top of snapshot
  - fix mesa build on intel driver


author: Adam Jackson <ajax@redhat.com> 7.1-0.36
changelog:
  - Today's snapshot.
  - Package swrast_dri for the new X world order.
  - Split DRI drivers to their own subpackage.


author: Dave Airlie <airlied@redhat.com> 7.1-0.31
changelog:
  - Bring in a bunch of fixes from upstream, missing rs690 pci id,
  - DRI2 + modeset + 965 + compiz + alt-tab fixed.


author: Dave Airlie <airlied@redhat.com> 7.1-0.29
changelog:
  - mesa-7.1-f9-intel-and-radeon-fixes.patch - Update mesa 
    package with cherrypicked fixes from master.
  - Fixes numerous i965 3D issues
  - Fixes compiz on rs48x and rs690 radeon chipsets


author: Dennis Gilmore <dennis@ausil.us> 7.1-0.24
changelog:
  - add patch so that we only build dri drivers on sparc that are remotely
    useful.  sis driver breaks the build and the intel ones will never exist


author: Adam Jackson <ajax@redhat.com> 7.1-0.23
changelog:
  - mesa-7.1-link-shared.patch: Make a libdricore.so from libmesa.a, install
    it into %_libdir/dri, and link the DRI drivers against it.  Drops ~20M
    from the installed system (not including debuginfo).  Inspired by a
    similar patch in openSUSE but reworked to be compatible with the OSMesa
    build.


author: Adam Jackson <ajax@redhat.com> 7.1-0.22
changelog:
  - mesa-7.1-visual-crash.patch: Fix a segfault if DRI unavailable.
  - mesa-7.1-fbconfig-fix.patch: Fix fbconfig comparisons.
  - mesa-7.1-dri2.patch: Fix a header path.
  - Add buildreqs for the demos that suddenly stopped compiling.


author: Kristian Høgsberg <krh@redhat.com> - 7.1-0.21
changelog:
  - Update git snapshot to pull in DRI2 direct rendering.
  - Add conflicts for xservers that don't understand the new DRI driver
    interface.


author: Kristian Høgsberg <krh@redhat.com> - 7.1-0.20
changelog:
  - Looks like the TexOffset extension does not work, disable for now.
  - Bump to 20080311 snapshot to get DRI2 tfp fixes.


author: Kristian Høgsberg <krh@redhat.com> - 7.1-0.19
changelog:
  - Bump to latest git snapshot.
  - Drop mesa-7.1-dri-drivers.patch, it's upstream.
  - Require libdrm-devel >= 2.4.0-0.5


author: Adam Jackson <ajax@redhat.com> 7.1-0.17
changelog:
  - Fix OSMesa symlink bug. (#424545)
  - Build OSMesa with -Os to be slightly less bloaty.
  - Re-add osmesa.h to libOSMesa-devel.
  - Really restore -fvisibility=hidden.


author: Dave Airlie <airlied@redhat.com> 7.0.1-7
changelog:
  - mesa-7.0.1-stable-branch.patch - Updated with more fixes from stable
  - mesa-7.0.1-r300-fix-writemask.patch - fix r300 fragprog writemask
  - mesa-7.0.1-r200-settexoffset.patch - add zero-copy TFP support for r200


author: Dave Airlie <airlied@redhat.com> 7.0.1-6
changelog:
  - mesa-7.0.1-stable-branch.patch - Updated to close to 7.0.2-rc1
  - This contains the fixes made to the upstream Mesa stable branch
    including fixes for 965 vblank interrupt issues along with a fix
    in the kernel - remove patches that already upstream.
  - mesa-6.5.2-hush-synthetic-visual-warning.patch - dropped
  - mesa-7.0-i-already-defined-glapi-you-twit.patch - dropped
  - mesa-7.0.1-965-sampler-crash.patch - dropped


author: Dave Airlie <airlied@redhat.com> - 7.0.1-3
changelog:
  - mesa-7.0.1-stable-branch.patch - Add patches from stable branch
    includes support for some Intel chipsets
  - mesa-7.0-use_master-r300.patch - Add r300 driver from master


author: Dave Airlie <airlied@redhat.com> - 7.0.1-1
changelog:
  - Rebase to upstream 7.0.1 release
  - ajax provided patches: for updated selinux awareness, build config
  - gl visibility and picify were fixed upstream
  - OS mesa library version are 6.5.3 not 7.0.1 - spec fix


author: Adam Jackson <ajax@redhat.com> 6.5.2-15
changelog:
  - Add dri_interface.h to mesa-libGL-devel, and conflict with
    xorg-x11-proto-devel versions that attempted to provide it.


author: Adam Jackson <ajax@redhat.com> 6.5.2-9
changelog:
  - mesa-6.5.2-bindcontext-paranoia.patch: Paper over a crash when doBindContext
    fails, to avoid, for example, crashing the server when using tdfx but
    without glide3 installed.


author: Adam Jackson <ajax@redhat.com> 6.5.2-7
changelog:
  - mesa-6.5.2-picify-dri-drivers.patch: Attempt to make the DRI drivers PIC.
  - mesa-6.5.1-build-config.patch: Apply RPM_OPT_FLAGS to OSMesa too.


author: Adam Jackson <ajax@redhat.com> 6.5.2-6
changelog:
  - mesa-6.5.2-libgl-visibility.patch: Fix non-exported GLX symbols (#229808)
  - Require a sufficiently new libdrm at runtime too
  - Make the arch macros do something sensible in the general case


author: Adam Jackson <ajax@redhat.com> 6.5.2-5
changelog:
  - General spec cleanups
  - Require current libdrm
  - Build with -fvisibility=hidden
  - Redo the way mesa-source is generated
  - Add %{?_smp_mflags} where appropriate


author: Adam Jackson <ajax@redhat.com> 6.5.2-3
changelog:
  - mesa-6.5.2-xserver-1.1-source-compat.patch: Add some source-compatibility
    defines to dispatch.h so the X server will continue to build.


author: Adam Jackson <ajax@redhat.com> 6.5.2-2.fc6
changelog:
  - Fix OSMesa file listing to use %version for DSO number.  Note that this
    will still break on Mesa 7; oh well.
  - Deleted file: directfbgl.h


author: Kristian <krh@redhat.com> - 6.5.1-6.fc6
changelog:
  - Add -fno-strict-aliasing to compiler flags for i965 driver.
  - Add post-6.5.1-i965-fixes.patch backport of i965 fixes from mesa CVS.


author: Kristian Høgsberg <krh@redhat.com> - 6.5.1-3.fc6
changelog:
  - Bump xorg-x11-proto-devel BuildRequires to 7.1-8 so we pick up the
    latest GLX_EXT_texture_from_pixmap opcodes.


author: Kristian Høgsberg <krh@redhat.com> 6.5.1-1.fc6
changelog:
  - Bump to 6.5.1 final release.
  - Drop libGLw subpackage, it is now in Fedora Extras (#188974) and
    tweak mesa-6.5.1-build-config.patch to not build libGLw.
  - Drop mesa-6.5.1-r300-smooth-line.patch, the smooth line fallback can
    now be prevented by enabling disable_lowimpact_fallback in
    /etc/drirc.
  - Drop mesa-6.4.1-radeon-use-right-texture-format.patch, now upstream.
  - Drop mesa-6.5-drop-static-inline.patch, workaround no longer necessary.


author: Kristian Høgsberg <krh@redhat.com> - 6.5.1-0.rc2.fc6
changelog:
  - Rebase to 6.5.1 RC2.
  - Get rid of redhat-mesa-driver-install and redhat-mesa-target helper
    scripts and clean up specfile a bit.


author: Kristian Høgsberg <krh@redhat.com> - 6.5.1-0.rc1.2.fc6
changelog:
  - Drop upstreamed patches mesa-6.5-texture-from-pixmap-fixes.patch and
    mesa-6.5-tfp-fbconfig-attribs.patch and fix
    mesa-6.4.1-radeon-use-right-texture-format.patch to not break 16bpp
    transparency.


author: Kristian Høgsberg <krh@redhat.com> 6.5-26.20060818cvs.fc6
changelog:
  - Pull the vtxfmt patch into the selinux-awareness patch, handle exec
    mem heap init failure correctly by releasing mutex.


author: Adam Jackson <ajackson@redhat.com> 6.5-25.20060818cvs.fc6
changelog:
  - mesa-6.5.1-r300-smooth-line.patch: Added, fakes smooth lines with aliased
    lines on R300+ cards, makes Google Earth tolerable.
  - mesa-6.5-force-r300.patch: Resurrect.


author: Adam Jackson <ajackson@redhat.com> 6.5-24.20060818cvs.fc6
changelog:
  - mesa-6.5.1-radeon-vtxfmt-cleanup-properly.patch: Fix a segfault on context
    destruction when selinux is enabled.


author: Adam Jackson <ajackson@redhat.com> 6.5-22.20060818cvs.fc6
changelog:
  - Update to pre-6.5.1 snapshot.
  - Re-add libOSMesa{,16,32}. (#186366)
  - Add BuildReq: on libXp-devel due to openmotif header insanity.


author: Mike A. Harris <mharris@redhat.com> 6.5-20.fc6
changelog:
  - Conditionalized libGLw inclusion with new with_libGLw macro defaulting
    to 1 (enabled) for now, however since nothing in Fedora Core uses libGLw
    anymore, we will be transitioning libGLw to an external package maintained
    in Fedora Extras soon.


author: Adam Jackson <ajackson@redhat.com> 6.5-17.fc6
changelog:
  - mesa-6.5-fix-linux-indirect-build.patch: Added.
  - mesa-6.5-fix-glxinfo-link.patch: Added.
  - Build libOSMesa never instead of inconsistently; to be fixed later.
  - Updates to redhat-mesa-target:
    - Always select linux-indirect when not building for DRI
    - Enable DRI to be built on PPC64 (still disabled in the spec file though)
    - MIT licence boilerplate


author: Mike A. Harris <mharris@redhat.com> 6.5-16.fc6
changelog:
  - Remove glut-devel dependency, as nothing actually uses it that we ship.
  - Added mesa-6.5-dont-libglut-me-harder-ok-thx-bye.patch to prevent libglut
    and other libs from being linked into glxgears/glxinfo even though they
    are not actually used.  This was the final package linking to freeglut in
    Fedora Core, blocking freeglut from being moved to Extras.
  - Commented all of the virtual provides in the spec file to document clearly
    how they should be used by other developers in specifying build and runtime
    dependencies when packaging software which links to libGL, libGLU, and
    libGLw. (#200069)


author: Adam Jackson <ajackson@redhat.com> 6.5-15.fc6
changelog:
  - Attempt to add selinux awareness; check if we can map executable memory
    and fail softly if not.  Removes the need for allow_execmem from huge
    chunks of the desktop.
  - Disable the r300 gart fix for not compiling.


author: Mike A. Harris <mharris@redhat.com> 6.5-13.fc6
changelog:
  - Added mesa-6.5-fix-opt-flags-bug197640.patch as 2nd attempt to fix OPT_FLAGS
    for (#197640).
  - Ensure that redhat-mesa-driver-install creates $DRIMODULE_DESTDIR with
    mode 0755.


author: Mike A. Harris <mharris@redhat.com> 6.5-12.fc6
changelog:
  - Maybe actually, you know, apply the mesa-6.5-glx-use-tls.patch as that might
    help to you know, actually solve the problem.  Duh.
  - Use {dist} tag in Release field now.


author: Mike A. Harris <mharris@redhat.com> 6.5-11
changelog:
  - Added mesa-6.5-glx-use-tls.patch to hopefully get -DGLX_USE_TLS to really
    work this time due to broken upstream linux-dri-* configs. (#193979)
  - Pass RPM_OPT_FLAGS via OPT_FLAGS instead of via CFLAGS also for (#193979)


author: Mike A. Harris <mharris@redhat.com> 6.5-10
changelog:
  - Bump libdrm-devel dep to trigger new ExclusiveArch test with the new package.
  - Use Fedora Extras style BuildRoot tag.
  - Added "Requires(post): /sbin/ldconfig" and postun to all runtime lib packages.


author: Kristian Høgsberg <krh@redhat.com> 6.5-7
changelog:
  - Update mesa-6.5-texture-from-pixmap-fixes.patch to include new
    tokens and change tfp functions to return void.  Yes, a new mesa
    snapshot would be nice.


author: Kristian Høgsberg <krh@redhat.com> 6.5-3
changelog:
  - Add mesa-6.5-noexecstack.patch to prevent assembly files from making
    libGL.so have executable stack.


author: Kristian Høgsberg <krh@redhat.com> 6.5-1
changelog:
  - Update to mesa 6.5 snapshot.
  - Use -MG for generating deps and some files are not yet symlinked at
    make depend time.
  - Drop mesa-6.4.2-dprintf-to-debugprintf-for-bug180122.patch and
    mesa-6.4.2-xorg-server-uses-bad-datatypes-breaking-AMD64-fdo5835.patch
    as these are upstream now.
  - Drop mesa-6.4.1-texture-from-drawable.patch and add
    mesa-6.5-texture-from-pixmap-fixes.patch.
  - Update mesa-modular-dri-dir.patch to apply.
  - Widen libGLU glob.
  - Reenable r300 driver install.
  - Widen libOSMesa glob.
  - Go back to patching config/linux-dri, add mesa-6.5-build-config.patch,
    drop mesa-6.3.2-build-configuration-v4.patch.
  - Disable sis dri driver for now, only builds on x86 and x86-64.


author: Mike A. Harris <mharris@redhat.com> 6.4.2-5
changelog:
  - Disable the expeimental r300 DRI driver, as it has turned out to cause
    instability and system hangs for many users.


author: Mike A. Harris <mharris@redhat.com> 6.4.2-2
changelog:
  - Added new "glx-utils" subpackage with glxgears and glxinfo (#173510)
  - Added mesa-6.4.2-dprintf-to-debugprintf-for-bug180122.patch to workaround
    a Mesa namespace conflict with GNU_SOURCE (#180122)
  - Added mesa-6.4.2-xorg-server-uses-bad-datatypes-breaking-AMD64-fdo5835.patch
    as an attempt to fix bugs (#176976,176414,fdo#5835)
  - Enabled inclusion of the *EXPERIMENTAL UNSUPPORTED* r300 DRI driver on
    x86, x86_64, and ppc architectures, however the 2D Radeon driver will soon
    be modified to require the user to manually turn experimental DRI support
    on with Option "dri" in xorg.conf to test it out and report all X bugs that
    occur while using it directly to X.Org bugzilla.  (#179712)
  - Use "libOSMesa.so.6.4.0604*" glob in file manifest, to avoid having to
    update it each upstream release.


author: Mike A. Harris <mharris@redhat.com> 6.4.2-1
changelog:
  - Updated to Mesa 6.4.2
  - Use "libGLU.so.1.3.0604*" glob in file manifest, to avoid having to update it
    each upstream release.


author: Mike A. Harris <mharris@redhat.com> 6.4.1-5
changelog:
  - Added missing "BuildRequires: expat-devel" for bug (#178525)
  - Temporarily disabled mesa-6.4.1-texture-from-drawable.patch, as it fails
    to compile on at least ia64, and possibly other architectures.


author: Kristian Høgsberg <krh@redhat.com> 6.4.1-4
changelog:
  - Add mesa-6.4.1-texture-from-drawable.patch to implement protocol
    support for GLX_EXT_texture_from_drawable extension.


author: Mike A. Harris <mharris@redhat.com> 6.4.1-3
changelog:
  - Manually copy libGLw headers that Mesa forgets to install, to fix (#173879).
  - Added mesa-6.4.1-libGLw-enable-motif-support.patch to fix (#175251).
  - Removed "Conflicts" lines from libGL package, as they are "Obsoletes" now.
  - Do not rename swrast libGL .so version, as it is the OpenGL version.


author: Mike A. Harris <mharris@redhat.com> 6.4.1-2
changelog:
  - Rebuild to ensure libGLU gets rebuilt with new gcc with C++ compiler fixes.
  - Changed the 3 devel packages to use Obsoletes instead of Conflicts for the
    packages the files used to be present in, as this is more friendy for
    OS upgrades.
  - Added "Requires: libX11-devel" to mesa-libGL-devel package (#173712)
  - Added "Requires: libGL-devel" to mesa-libGLU-devel package (#175253)


author: Mike A. Harris <mharris@redhat.com> 6.4.1-1
changelog:
  - Updated MesaLib tarball to version 6.4.1 from Mesa project for X11R7 RC4.
  - Added pkgconfig dependency.
  - Updated "BuildRequires: libdrm-devel >= 2.0-1"
  - Added Obsoletes lines to all the subpackages to have cleaner upgrades.
  - Added mesa-6.4.1-amd64-assyntax-fix.patch to work around a build problem on
    AMD64, which is fixed in the 6.4 branch of Mesa CVS.
  - Conditionalize libOSMesa inclusion, and default to not including it for now.


author: Jeremy Katz <katzj@redhat.com> 6.4-5
changelog:
  - fix directory used for loading dri modules (#173679)
  - install dri drivers as executable so they get stripped (#173292)


author: Mike A. Harris <mharris@redhat.com> 6.4-4
changelog:
  - Wrote redhat-mesa-source-filelist-generator to dynamically generate the
    files to be included in the mesa-source subpackage, to minimize future
    maintenance.
  - Fixed detection and renaming of software mesa .so version.


author: Mike A. Harris <mharris@redhat.com> 6.4-3
changelog:
  - Hack: autodetect if libGL was given .so.1.5* and rename it to 1.2 for
    consistency on all architectures, and to avoid upgrade problems if we
    ever disable DRI on an arch and then re-enable it later.


author: Mike A. Harris <mharris@redhat.com> 6.4-2
changelog:
  - Added mesa-6.4-multilib-fix.patch to instrument and attempt to fix Mesa
    bin/installmesa script to work properly with multilib lib64 architectures.
  - Set and export LIB_DIR and INCLUDE_DIR in spec file 'install' section,
    and invoke our modified bin/installmesa directly instead of using
    "make install".
  - Remove "include/GL/uglglutshapes.h", as it uses the GLUT license, and seems
    like an extraneous file anyway.
  - Conditionalize the file manifest to include libGL.so.1.2 on DRI enabled
    builds, but use libGL.so.1.5.060400 instead on DRI disabled builds, as
    this is how upstream builds the library, although it is not clear to me
    why this difference exists yet (which was not in Xorg 6.8.2 Mesa).


author: Mike A. Harris <mharris@redhat.com> 6.4-1
changelog:
  - Updated to new upstream MesaLib-6.4
  - Updated libGLU.so.1.3.060400 entry in file manifest
  - Updated "BuildRequires: libdrm-devel >= 1.0.5" to pick up fixes for the
    unichrome driver.


author: Mike A. Harris <mharris@redhat.com> 6.3.2-5
changelog:
  - Fix mesa-libGL-devel to depend on mesa-libGL instead of mesa-libGLU.
  - Added virtual "Provides: libGL..." entries for each subpackage as relevant.


author: Mike A. Harris <mharris@redhat.com> 6.3.2-4
changelog:
  - Added the mesa-source subpackage, which contains part of the Mesa source
    code needed by other packages such as the X server to build stuff.


author: Mike A. Harris <mharris@redhat.com> 6.3.2-3
changelog:
  - Added Conflicts/Obsoletes lines to all of the subpackages to make upgrades
    from previous OS releases, and piecemeal upgrades work as nicely as
    possible.


author: Mike A. Harris <mharris@redhat.com> 6.3.2-2
changelog:
  - Wrote redhat-mesa-target script to simplify mesa build target selection.
  - Wrote redhat-mesa-driver-install to install the DRI drivers and simplify
    per-arch conditionalization, etc.


author: Kai Engert <kaie@redhat.com> - 3.14.3-2
changelog:
  - Revert to accepting MD5 on digital signatures by default
  - Resolves: rhbz#957603 - nss 3.14 - MD5 hash algorithm disabled


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-1
changelog:
  - Update to NSS_3_14_3_RTM
  - Resolves: rhbz#927171 - Rebase to 3.14.3 as part of the fix for the lucky-13 issue


author: Shu Li <shu.li@oracle.com> - 0.8.3-27.0.1.el6
changelog:
  - Remove call to recreate initrd from post section for plymouth-scripts
    [bug 11715160]
  - Check for the System.map file and dracut script before updating
    initrd [bug 11689589]
  - Do not search for " (" in /etc/system-release to strip out code name
    as Oracle Linux does not have this information [bug 11074734]
  - Recreate initrd during post section of scripts package
    [bug 11074734]


author: Ray Strode <rstrode@redhat.com> 0.8.3-21
changelog:
  - Update lock icon dimensions to match dimensions of old
    icon to silence rpmdiff
    Related: #612665


author: Ray Strode <rstrode@redhat.com> 0.8.3-19
changelog:
  - Add explicit, versioned dep on core-libs subpackage to various
    parts of the spec file to silence rpmdiff
    Related: #638621


author: Ray Strode <rstrode@redhat.com> 0.8.3-18
changelog:
  - Handle underpowered video cards that force multiple monitors
    to use one controller
    Resolves: #625209
  - Fix serial console crash
  - Resolves: #631924
  - Remove plymouth-text-and-details-only obsoletes
    Resolves: #638621


author: Ray Strode <rstrode@redhat.com> 0.8.3-16
changelog:
  - Fix up problem introduced in previous patch when kernel
    command line has no consoles
    Related: #615912


author: Ray Strode <rstrode@redhat.com> 0.8.3-14
changelog:
  - Use dark gray instead of black background in rings theme
    to prevent monitor sync issues on some hardware.
    Resolves: #620414


author: Ray Strode <rstrode@redhat.com> 0.8.3-13
changelog:
  - Built details plugin into binary, so there's always
    some splash available (fixes crash for users with
    separate /usr hitting escape early in boot up)
    Resolves: #612569


author: Ray Strode <rstrode@redhat.com> 0.8.3-8
changelog:
  - Use monospace font in plymouth log viewer
    Resolves: #596332
  - Add window icon in plymouth log viewer
    Resolves: #605626


author: Ray Strode <rstrode@redhat.com> 0.8.3-2
changelog:
  - Fix lock tty patch from 0.8.2-2 to properly unlock tty
    Resolves: #590774
  - Fix up pkgwrangler niggles
    Resolves: 592305


author: Ray Strode <rstrode@redhat.com> 0.8.0-0.2009.29.09.19
changelog:
  - Force raw mode on every text draw.  This works around a bug where
    some program at startup is kicking the terminal out of raw mode.


author: Ray Strode <rstrode@redhat.com> 0.8.0-0.2009.29.09.7
changelog:
  - Fix emergency shell horkage (bug 526597)
  - Fix problem with details splash not showing up (bug 527426, bug 527254)


author: Ray Strode <rstrode@redhat.com> 0.8.0-0.2009.29.09.5
changelog:
  - Prevent firstboot's X from crashing on radeon hardware. This should
    only affect multihead users, but for some reason it's getting some
    single head users as well.


author: Ray Strode <rstrode@redhat.com> 0.8.0-0.2009.29.09.3
changelog:
  - Fix crasher in text plugin after password prompt (bug 526652)
  - Actually apply the patch mentioned in 2009.29.09.2


author: Jesse Keating <jkeating@redhat.com> - 0.7.0-0.2009.03.10.3
changelog:
  - Drop the version on system-logos requires for now, causing hell with
    other -logos providers not having the same version.


author: Ray Strode <rstrode@redhat.com> 0.7.0-0.2009.03.10.1
changelog:
  - Address one more issue with password handling.  It wasn't working
    well for secondary devices when using the "details" plugin.


author: Ray Strode <rstrode@redhat.com> 0.7.0-0.2009.03.06
changelog:
  - Updated to development snapshot
  - Guess progress better on second boot of persistent live images
  - Drop upstream patches
  - swap "solar" and "spinfinity" scriptlet behavior


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.11.17.3
changelog:
  - don't give error about missing default.so
  - rework packaging of boot-duration to prevent .rpmnew droppings
    (bug 469752)


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.11.14.1
changelog:
  - Generate solar background dynamically to reduce ondisk size, and
    look better at various resolutions (Charlie, bug 471227)


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.11.12.4
changelog:
  - Move Obsoletes: plymouth-text-and-details-only to base package
    so people who had it installed don't end up solar on upgrade


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.11.11.2
changelog:
  - Improve solar flares (Charlie)
  - redirect tty again on --show-splash
  - ignore subsequent --hide-splash calls after the first one
  - turn off kernel printks during boot up


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.11.06.1
changelog:
  - Don't exit on plymouth --show-splash after sulogin
  - Properly retake console after that --show-splash


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.27.6
changelog:
  - Force raw mode for keyboard input with solar and fade-in
    (bug 468880)
  - make sure windows get closed on exit


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.24.1
changelog:
  - Add updated progress bar for solar plugin from Charlie
  - Log plymouth:debug output to boot log
  - Ignore sigpipe signals in daemon


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.23.2
changelog:
  - Bump so name of libply to hopefully force plymouth to get installed
    before kernel (or at least make plymouth-libs and plymouth get installed
    on the same side of kernel in the transaction).


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.23.1
changelog:
  - Add patch from Charlie to align progress bar to milestones during boot up
  - force tty to be sane on exit (bug 467207)


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.21.2
changelog:
  - add text-and-details-only subpackage so davej can uninstall
    spinfinity, pango, cairo etc from his router.


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.21.1
changelog:
  - Minor event loop changes
  - drop upstream patches
  - Charlie Brej fix for progress bar resetting when escape gets pressed


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.17.1
changelog:
  - Clear screen in details plugin when it's done
  - Make plymouth-update-initrd a small wrapper around mkinitrd instead
    of the broken monstrosity it was before.


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.15.3
changelog:
  - Move plymouth-set-default-plugin, plymouth-update-initrd, and
    plymouth-populate-initrd to plymouth-scripts subpackage
    (the last fix didn't actually help with bug 467356)


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.15.2
changelog:
  - Move plymouth-set-default-plugin to -libs (might help with bug 467356)
  - Fix up requires, provides and postun scripts


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.10.06.1
changelog:
  - Add "Solar" plugin from Charles Brej
  - Move things around so computers with separate /usr boot
    (hopefully this won't break things, but it probably will)
  - Make GDM show up on vt1 for all plugins


author: Jeremy Katz <katzj@redhat.com> 0.6.0-0.2008.09.25.2
changelog:
  - Remove mkinitrd requires to break the dep loop and ensure things
    get installed in the right order


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.09.25.1
changelog:
  - Add new snapshot to fold in Will Woods progress bar, and
    move ajax's splash upstream, putting the old text splash
    in a "pulser" subpackage


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.08.27.1
changelog:
  - Fix another crasher for users with encrypted disks (this time in
    the text plugin, not the client)


author: Ray Strode <rstrode@redhat.com> 0.6.0-0.2008.08.27
changelog:
  - Update to latest snapshot
  - Add the ability to show text prompts in graphical plugin
  - Fix crasher for users with encrypted disks


author: Adam Jackson <ajax@redhat.com> 0.5.0-15.2008.08.08
changelog:
  - plymouth-0.5.0-textbar-hotness.patch: Change the text plugin to a slightly
    more traditional progress bar, to maintain the illusion of progress better
    than the eternally oscillating cylon. Note: still incomplete.


author: Ray Strode <rstrode@redhat.com> - 0.5.0-13.2008.08.07
changelog:
  - Update to new snapshot which when combined with a new mkinitrd should
    make unlocking encrypted root partitions work again


author: Ray Strode <rstrode@redhat.com> - 0.5.0-8.2008.07.31
changelog:
  - Update to snapshot to get new plymouth-populate-initrd features
  - Make removing rhgb use details plugin instead of exiting


author: Peter Jones <pjones@redhat.com> - 0.5.0-7
changelog:
  - Make it a mkinitrd requires instead of a nash requires (that will
    still pull in nash, but we need mkinitrd for newer plymouth-populate-initrd)


author: Ray Strode <rstrode@redhat.com> - 0.5.0-2
changelog:
  - Pull in spinfinity by default.  This whole "figure out
    which plugin to use" set of scripts and scriptlets
    needs work.  We need to separate distro default from
    user choice.


author: Ray Strode <rstrode@redhat.com> - 0.5.0-1
changelog:
  - Add new client "ask-for-password" command which feeds
    the user input to a program instead of standard output,
    and loops when the program returns non-zero exit status.


author: Ray Strode <rstrode@redhat.com> - 0.4.0-1
changelog:
  - Update to version 0.4.0
  - Only run if rhgb is on kernel command line
  - Make text plugin more animated


author: Ray Strode <rstrode@redhat.com> - 0.3.2-1
changelog:
  - Update to version 0.3.2
  - show gradient in spinfinity plugin
  - Drop fade out in spinfinity plugin
  - fix throbber placement
  - rename graphical.so to default.so


author: Ray Strode <rstrode@redhat.com> - 0.3.0-1
changelog:
  - Update to version 0.3.0
  - Better plugin handling
  - Better integration with mkinitrd (pending mkinitrd changes)
  - random bug fixes


author: Ray Strode <rstrode@redhat.com> - 0.2.0-1
changelog:
  - Update to version 0.2.0
  - Integrate more tightly with nash (pending nash changes)
  - ship libs for out of tree splash plugins
  - gradient support
  - random bug fixes


author: Alexander Larsson <alexl@redhat.com> - 2.18.2-2
changelog:
  - Don't return generic fallback icons for files,
    as this means custom mimetypes don't work (from svn)


author: Dan Williams <dcbw@redhat.com> - 2.16.3-3
changelog:
  - Revert upstream changes to g_static_mutex_get_mutex_impl_shortcut that broke
      users of GMutex and GStaticMutex (bgo#316221)


author: Matthias Clasen <mclasen@redhat.com> - 2.12.9-3
changelog:
  - More package review feedback:
   * install /etc/profile.d snipplets as 644
   * explain Conflict with libgnomeui
   * remove stale Conflict with glib-devel


author: Matthias Clasen <mclasen@redhat.com> - 2.12.9-2
changelog:
  - Incorporate package review feedback:
   * drop an obsolete Provides:
   * add a -static subpackage
   * explain %check ppc exception
   * align summaries


author: Owen Taylor <otaylor@redhat.com>
changelog:
  - Add static libraries to build (#78685, Bernd Kischnick)
  - Bump-and-rebuild for new redhat-rpm-config


author: Owen Taylor <otaylor@redhat.com>
changelog:
  - Make -devel package require main package (#45388)
  - Fix description and summary
  - Configure with --disable-gtk-doc


author: Florian La Roche <Florian.LaRoche@redhat.de>
changelog:
  - add some portability fixes needed at least on s390
  - copy config.{guess,sub} instead of calling libtoolize


author: Havoc Pennington <hp@redhat.com>
changelog:
  - try a new glib tarball with Makefile changes to work around
    libtool linking to installed .la files
  - make -devel require pkgconfig


author: Owen Taylor <otaylor@redhat.com>
changelog:
  - Remove glib-config.1 manpage from build since
    it conflicts with glib-devel. When we go to 
    glib glib1.2 setup, we should add it back


author: Peter Schiffer <pschiffe@redhat.com> - 1.6f-31
changelog:
  - resolves: #815209
    fixed override_dir patch - do not override localized man pages
    with English man pages
  - resolves: #713088
    fixed memory leaks


author: Peter Schiffer <pschiffe@redhat.com> - 1.6f-30
changelog:
  - resolves: #659646
    man man for Japanese manual page contains duplicated lines in PAGER explanation
  - resolves: #749290
    [RHEL6:REG] Missing Functionality : Improve makewhatis handling of symbolic links


author: Ivana Varekova <varekova@redhat.com> - 1.6f-8
changelog:
  - Resolves: #449272 
    Latest man behaves very strange for non-existing man pages
  - Resolves: #449275
    Unowned directories where man package provides content for


author: Ivana Varekova <varekova@redhat.com> 1.5p-5
changelog:
  - fix bug 146849 - makewhatis from cron produce error message
    "zcat: stdout: Broken pipe" (patch 18)
  - fix makewhatis problem with sections (patch 19)
  - delete strips


author: Ivana Varekova <varekova@redhat.com> 1.5p-2
changelog:
  - fix bug 140178 - correct one typo 
  - fix bug 140202 - problem with makewhatis exit (patch 13)
  - fix bug 140207 - problem with makewhatis -u  (patch 14)
    the fixed version update information about man-pages which 
    are less then one day old (it is used in day update)
    (man-pages may be fixed)
  - fix bug 140729 - makewhatis removed to /usr/sbin  
  - fix bug 146631 - two-part locale dir-name is support (patch 15)
  - changed makewhatis version


author: Adrian Havill <havill@redhat.com> 1.5m2-9
changelog:
  - make sure we touch Makefile timestamp so make doesn't get
    confused and think we haven't run configure
  - replace russian messages (#134387) Thanks to Leonid Kanter


author: Adrian Havill <havill@redhat.com> 1.5m2-6
changelog:
  - reorder MANSECT so that normal pages (with translations) take
    precedence over the English-only POSIX pages (#119554)


author: Adrian Havill <havill@redhat.com> 1.5m2-5
changelog:
  - force use of /usr/bin/gunzip and not /bin/gunzip for compatibility
    with rescue environments (#118087)
  - add POSIX sections to MANSECT in man.config, giving preference to the
    POSIX pages over the non-POSIX


author: Adrian Havill <havill@redhat.com> 1.5m2-4
changelog:
  - direct nroff stderr to /dev/null so no broken pipe err msgs appear
    when the user quits an error page prior to the full display (#117463)
  - removed bogus whatis search-n-destroy trigger (#117961)
  - don't complain about no lang resource when lang is C/POSIX (#108934)


author: Adrian Havill <havill@redhat.com> 1.5m2-2
changelog:
  - add all locale man pages
  - convert all msgs and manpages to utf-8
  - downconvert via transliteration C locale man pages just in case
  - patch #3, #8, #10, #17, #29, #31 no longer needed-- made it upstream
  - patch #9, #14 and #19 now superfluous-- strs already termed and len checked
  - disable patch #22: defer cat creation to existence of dir, not conf directive
  - patch #32 mostly merged upstream. Keep the "-a" in grep though so all
    locales' grep see man pages as text not binary (patch 37)
  - iconv patch no longer needed now that utf-8-to-legacy conversion is not
    needed
  - patch #52 and #53 not needed: CJK all point to nroff instead of groff, let
    the nroff script decide, based on the charset of the environment and/or the
    charset of the man page, as to what parameters to pass to groff (and
    whether iconv preprocessing is necessary)
  - the string "NROFF_OLD_CHARSET", if present in the man.config for the NROFF
    path, will now be replaced by the old character set so that nroff can figure
    out what the character set/encoding is
  - fix man to reflect status codes returned by forked child processes (#115204)
  - lots of makewhatis changes: re-add custom rh client stuff (/usr/bin vs
    /usr/sbin), -o option, /var/cache/man, utf-8 verification, convert the
    encoding spaghetti in the makewhatis awk script to UTF-8, identify languages
    in comments


author: Adrian Havill <havill@redhat.com> 1.5k-12
changelog:
  - restore russian locale (#81929)
  - force utf locale with jnroff (#105764)
  - don't let awk in makewhatis scan files that aren't man pages (#105594)


author: Adrian Havill <havill@redhat.com> 1.5k-11
changelog:
  - Use UTF-8 in makewhatis when searching for non-English versions of the
    phrase "NAME" in man pages
  - add "-o" option to makeis to specify an alternate whatis db location
  - move makewhatis from /sbin to /usr/bin, chmod o+x it as the whatis db is
    writable only by root anyway


author: Adrian Havill <havill@redhat.com> 1.5k-10
changelog:
  - added auto-detect for utf8 and conversion to allow gripes() and others
    to correctly output to some charsets (#88605)


author: Adrian Havill <havill@redhat.com> 1.5k-9
changelog:
  - cleaned up apropos script bugs (#97006)
  - merged all apropos changes into one cleaner patch
  - fix the search/replace for man.conf


author: Adrian Havill <havill@redhat.com> 1.5k-5
changelog:
  - marked man.config as noreplace config (#82088)
  - moved man.config from /usr/share to /etc even though +fhs (#81964)
  - removed bad argcat patch which made bogus grep queries (#82684)


author: Adrian Havill <havill@redhat.com> 1.5j-16
changelog:
  - require groff 1.18 because prev vers don't have -c getopt (#77847)
  - added /usr/local/share/man to MANPATH (#65467)


author: Adrian Havill <havill@redhat.com> 1.5j-14
changelog:
  - don't run trojan sh cmd that have unsafe chars munged (#79289)
  - made apropos command more robust (#62606)


author: Trond Eivind Glomsrød <teg@redhat.com> 1.5i2-6
changelog:
  - set LC_CTYPE, not just LC_MESSAGES. That way, the messages 
    requested can also be displayed (#52978)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.5i2-3
changelog:
  - Restore /var/cache/man directories even if we've built without usecache.
    This allows users to enable catman caching manually (#48762) and shuts
    up tmpwatch (#47784 and its 1000 duplicates)


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.5i2-2
changelog:
  - Fix makewhatis interoperability with gawk 3.1.x (#46405)
  - Fix initial creation of whatis database if makewhatis is run with "-u"
    even then (e.g. by cron) (#45646)
  - Fix #45827
  - Require current mktemp (#43134)
  - Fix #42915
  - Fix paths on old distributions (#42031)


author: Harald Hoyer <harald@redhat.de> 1.5i-9
changelog:
  - Some fixes for secure pathnames
  - remove cache directories
  - remove sgid
  - fixed man.1 to refer to man.config(5)
  - fixed makewhatis


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.5i-7
changelog:
  - Fix up another buffer overrun (#42450)
  - Add "`" and "$(" to the list of illegal filename parts in makewhatis (#42450)
  - Add a define toggle to build 5.x and 6.x errata correctly (#42031, #42192)
  -


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.5i-2
changelog:
  - break the configure script. We want man to use less even though it
    can't be found at build time.


author: Bernhard Rosenkraenzer <bero@redhat.com> 1.5i-1
changelog:
  - 1.5i (Fixes #23258, #31805, #33276)
  - Fix apropos and whatis for pages that contain non-ascii characters (#21619)
  - Look for legacy whatis databases in $manpath (#33897)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Fix trailing garbage when a man page doesn't end with a newline (Bug #9026)
  - Look for files in other man directories if the first match isn't
    accessible (Bug #10254)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - Move whatis database to {cache}/whatis to allow read-only /usr
    filesystems (Bug #18383)
  - Don't use predictable filenames in makewhatis (not reported, spotted while
    fixing 18383)


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - gzip the man pages manually - since file doesn't recognize them as
    man pages, the build root policy doesn't do it (Bug #12015)


author: Preston Brown <pbrown@redhat.com>
changelog:
  - default man path is now {_mandir}.  /usr/man maintained for compat.
  - remove +sgid option to allow builds as a normal user.  SPEC file maintains
    proper permissions.


author: Bernhard Rosenkraenzer <bero@redhat.com>
changelog:
  - 1.5h1 - this has a better fix for the security problems.
  - remove manpath patch (now in base)
  - remove loop patch (now in base)


