Home Home > GIT Browse > SLE12-SP3-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-19 07:00:30 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-19 07:00:30 +0100
commit0d93c1735fc4db4c1321b923e4704c13c9ee47e7 (patch)
tree750975b8fa77c63d263bc0898285ffc24810b47e
parenteceea0548f275da75ff7d52ebdf3770abeb18226 (diff)
parenteec003c669ed8912b6acebdbebe1a08c5417191c (diff)
Merge branch 'SLE12-SP3' into SLE12-SP3-AZURE
-rw-r--r--blacklist.conf2
-rw-r--r--patches.drivers/IB-rxe-Fix-incorrect-cache-cleanup-in-error-flow.patch68
-rw-r--r--patches.fixes/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch39
-rw-r--r--patches.fixes/0001-locking-rwsem-Fix-possible-missed-wakeup.patch64
-rw-r--r--patches.fixes/0001-sched-wake_q-Document-wake_q_add.patch81
-rw-r--r--patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-paramete.patch109
-rw-r--r--patches.fixes/0002-futex-Fix-possible-missed-wakeup.patch63
-rw-r--r--patches.fixes/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch38
-rw-r--r--patches.fixes/0002-sched-wake_q-Fix-wakeup-ordering-for-wake_q.patch97
-rw-r--r--patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocat.patch135
-rw-r--r--patches.fixes/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch165
-rw-r--r--patches.fixes/0003-sched-wake_q-Reduce-reference-counting-for-special-u.patch181
-rw-r--r--patches.fixes/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch65
-rw-r--r--patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch31
-rw-r--r--patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch57
-rw-r--r--patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch57
-rw-r--r--patches.fixes/scsi-lpfc-correct-mds-diag-and-nvmet-configuration.patch42
-rw-r--r--patches.fixes/scsi-qla2xxx-fix-deadlock-between-atio-and-hw-lock.patch148
-rw-r--r--series.conf17
19 files changed, 1459 insertions, 0 deletions
diff --git a/blacklist.conf b/blacklist.conf
index f60e08b4b1..ed585da52e 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -587,3 +587,5 @@ b31a8cc1a53dda3a33b6c9c62779869d4d5fc142 # the test is not in 4.4 yet
6e00f7dd5e4edc2443f030b226f66fe4f1267667 # 3e67f106f619 was reverted
e8c8b53ccaff568fef4c13a6ccaf08bf241aa01a # 88078d98d1bb was reverted
acc93d30d7d43f428272c20a047389c4cbca82ba # Possibly breaking existing setups
+368686a95e55fd66b88542b5b23d802a4886b1aa # False positive due to different merge paths, patch already included
+24e3a7fb60a9187e5df90e5fa655ffc94b9c4f77 # Too intrusive for SLE12-SP3
diff --git a/patches.drivers/IB-rxe-Fix-incorrect-cache-cleanup-in-error-flow.patch b/patches.drivers/IB-rxe-Fix-incorrect-cache-cleanup-in-error-flow.patch
new file mode 100644
index 0000000000..5c63fb895e
--- /dev/null
+++ b/patches.drivers/IB-rxe-Fix-incorrect-cache-cleanup-in-error-flow.patch
@@ -0,0 +1,68 @@
+From: Yuval Shaia <yuval.shaia@oracle.com>
+Date: Sun, 9 Dec 2018 15:53:49 +0200
+Subject: IB/rxe: Fix incorrect cache cleanup in error flow
+Patch-mainline: v5.0-rc1
+Git-commit: 6db21d8986e14e2e86573a3b055b05296188bd2c
+References: FATE#322149
+
+Array iterator stays at the same slot, fix it.
+
+Fixes: 8700e3e7c485 ("Soft RoCE driver")
+Signed-off-by: Yuval Shaia <yuval.shaia@oracle.com>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Zhu Yanjun <yanjun.zhu@oracle.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/infiniband/sw/rxe/rxe_pool.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+--- a/drivers/infiniband/sw/rxe/rxe_pool.c
++++ b/drivers/infiniband/sw/rxe/rxe_pool.c
+@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_ca
+ return rxe_type_info[pool->type].cache;
+ }
+
++static void rxe_cache_clean(size_t cnt)
++{
++ int i;
++ struct rxe_type_info *type;
++
++ for (i = 0; i < cnt; i++) {
++ type = &rxe_type_info[i];
++ kmem_cache_destroy(type->cache);
++ type->cache = NULL;
++ }
++}
++
+ int rxe_cache_init(void)
+ {
+ int err;
+@@ -136,24 +148,14 @@ int rxe_cache_init(void)
+ return 0;
+
+ err1:
+- while (--i >= 0) {
+- kmem_cache_destroy(type->cache);
+- type->cache = NULL;
+- }
++ rxe_cache_clean(i);
+
+ return err;
+ }
+
+ void rxe_cache_exit(void)
+ {
+- int i;
+- struct rxe_type_info *type;
+-
+- for (i = 0; i < RXE_NUM_TYPES; i++) {
+- type = &rxe_type_info[i];
+- kmem_cache_destroy(type->cache);
+- type->cache = NULL;
+- }
++ rxe_cache_clean(RXE_NUM_TYPES);
+ }
+
+ static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min)
diff --git a/patches.fixes/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch b/patches.fixes/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
new file mode 100644
index 0000000000..1dd626eba6
--- /dev/null
+++ b/patches.fixes/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
@@ -0,0 +1,39 @@
+From 2c0408dd0d8906b26fe8023889af7adf5e68b2c2 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <shc_work@mail.ru>
+Date: Thu, 20 Dec 2018 11:06:38 +0300
+Subject: gpu: ipu-v3: Fix i.MX51 CSI control registers offset
+Git-commit: 2c0408dd0d8906b26fe8023889af7adf5e68b2c2
+Patch-mainline: v5.0-rc7
+References: bsc#1106929
+
+The CSI0/CSI1 registers offset is at +0xe030000/+0xe038000 relative
+to the control module registers on IPUv3EX.
+This patch fixes wrong values for i.MX51 CSI0/CSI1.
+
+Fixes: 2ffd48f2e7 ("gpu: ipu-v3: Add Camera Sensor Interface unit")
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/ipu-v3/ipu-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 474b00e19697..5b7cdbfe062f 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = {
+ .cpmem_ofs = 0x1f000000,
+ .srm_ofs = 0x1f040000,
+ .tpm_ofs = 0x1f060000,
+- .csi0_ofs = 0x1f030000,
+- .csi1_ofs = 0x1f038000,
++ .csi0_ofs = 0x1e030000,
++ .csi1_ofs = 0x1e038000,
+ .ic_ofs = 0x1e020000,
+ .disp0_ofs = 0x1e040000,
+ .disp1_ofs = 0x1e048000,
+--
+2.20.1
+
diff --git a/patches.fixes/0001-locking-rwsem-Fix-possible-missed-wakeup.patch b/patches.fixes/0001-locking-rwsem-Fix-possible-missed-wakeup.patch
new file mode 100644
index 0000000000..7d053c69de
--- /dev/null
+++ b/patches.fixes/0001-locking-rwsem-Fix-possible-missed-wakeup.patch
@@ -0,0 +1,64 @@
+From a9cf88b3740a83e0c3dc38f2ac41bccccbbe3332 Mon Sep 17 00:00:00 2001
+From: Xie Yongji <xieyongji@baidu.com>
+Date: Mon, 18 Feb 2019 09:49:40 -0800
+Subject: [PATCH 1/3] locking/rwsem: Fix (possible) missed wakeup
+Git-commit: e158488be27b157802753a59b336142dc0eb0380
+Patch-mainline: v5.0-rc4
+References: bsc#1050549
+
+Because wake_q_add() can imply an immediate wakeup (cmpxchg failure
+case), we must not rely on the wakeup being delayed. However, commit:
+
+ e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task")
+
+relies on exactly that behaviour in that the wakeup must not happen
+until after we clear waiter->task.
+
+[ peterz: Added changelog. ]
+
+Signed-off-by: Xie Yongji <xieyongji@baidu.com>
+Signed-off-by: Zhang Yu <zhangyu31@baidu.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task")
+Link: https://lkml.kernel.org/r/1543495830-2644-1-git-send-email-xieyongji@baidu.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+
+---
+ kernel/locking/rwsem-xadd.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
+index 27316d8f7d87..1dad74958b1c 100644
+--- a/kernel/locking/rwsem-xadd.c
++++ b/kernel/locking/rwsem-xadd.c
+@@ -207,14 +207,21 @@ __rwsem_mark_wake(struct rw_semaphore *sem,
+ next = waiter->list.next;
+ tsk = waiter->task;
+
+- wake_q_add(wake_q, tsk);
++ get_task_struct(tsk);
+ /*
+- * Ensure that the last operation is setting the reader
++ * Ensure calling get_task_struct() before setting the reader
+ * waiter to nil such that rwsem_down_read_failed() cannot
+ * race with do_exit() by always holding a reference count
+ * to the task to wakeup.
+ */
+ smp_store_release(&waiter->task, NULL);
++ /*
++ * Ensure issuing the wakeup (either by us or someone else)
++ * after setting the reader waiter to nil.
++ */
++ wake_q_add(wake_q, tsk);
++ /* wake_q_add() already take the task ref */
++ put_task_struct(tsk);
+ } while (--loop);
+
+ sem->wait_list.next = next;
+--
+2.16.4
+
diff --git a/patches.fixes/0001-sched-wake_q-Document-wake_q_add.patch b/patches.fixes/0001-sched-wake_q-Document-wake_q_add.patch
new file mode 100644
index 0000000000..6dd69754ce
--- /dev/null
+++ b/patches.fixes/0001-sched-wake_q-Document-wake_q_add.patch
@@ -0,0 +1,81 @@
+From 33a2c192f7e9f9869c4bfb246d5befef544bb3b9 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 18 Feb 2019 09:09:22 -0800
+Subject: [PATCH 1/2] sched/wake_q: Document wake_q_add()
+Git-commit: e6018c0f5c996e61639adce6a0697391a2861916
+Patch-mainline: v5.0-rc4
+References: bsc#1050549
+
+The only guarantee provided by wake_q_add() is that a wakeup will
+happen after it, it does _NOT_ guarantee the wakeup will be delayed
+until the matching wake_up_q().
+
+If wake_q_add() fails the cmpxchg() a concurrent wakeup is pending and
+that can happen at any time after the cmpxchg(). This means we should
+not rely on the wakeup happening at wake_q_up(), but should be ready
+for wake_q_add() to issue the wakeup.
+
+The delay; if provided (most likely); should only result in more efficient
+behaviour.
+
+Reported-by: Yongji Xie <elohimes@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Waiman Long <longman@redhat.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+
+---
+ include/linux/sched.h | 6 +++++-
+ kernel/sched/core.c | 12 ++++++++++++
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 690ecc765880..ebe1aa236fba 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -982,9 +982,13 @@ enum cpu_idle_type {
+ * called near the end of a function, where the fact that the queue is
+ * not used again will be easy to see by inspection.
+ *
+- * Note that this can cause spurious wakeups. schedule() callers
++ * NOTE that this can cause spurious wakeups. schedule() callers
+ * must ensure the call is done inside a loop, confirming that the
+ * wakeup condition has in fact occurred.
++ *
++ * NOTE that there is no guarantee the wakeup will happen any later than the
++ * wake_q_add() location. Therefore task must be ready to be woken at the
++ * location of the wake_q_add().
+ */
+ struct wake_q_node {
+ struct wake_q_node *next;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index e1ddab401dc9..5f68564cf53d 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -588,6 +588,18 @@ static bool set_nr_if_polling(struct task_struct *p)
+ #endif
+ #endif
+
++/**
++ * wake_q_add() - queue a wakeup for 'later' waking.
++ * @head: the wake_q_head to add @task to
++ * @task: the task to queue for 'later' wakeup
++ *
++ * Queue a task for later wakeup, most likely by the wake_up_q() call in the
++ * same context, _HOWEVER_ this is not guaranteed, the wakeup can come
++ * instantly.
++ *
++ * This function must be used as-if it were wake_up_process(); IOW the task
++ * must be ready to be woken at this location.
++ */
+ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
+ {
+ struct wake_q_node *node = &task->wake_q;
+--
+2.16.4
+
diff --git a/patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-paramete.patch b/patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-paramete.patch
new file mode 100644
index 0000000000..ae0250d205
--- /dev/null
+++ b/patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-paramete.patch
@@ -0,0 +1,109 @@
+From: Juergen Gross <jgross@suse.com>
+Date: Mon, 21 Jan 2019 11:26:02 +0100
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git
+Git-commit: 357b4da50a62e2fd70eacee21cdbd22d4c7a7b60
+References: bsc#1117645
+Subject: x86: respect memory size limiting via mem= parameter
+
+When limiting memory size via kernel parameter "mem=" this should be
+respected even in case of memory made accessible via a PCI card.
+
+Today this kind of memory won't be made usable in initial memory
+setup as the memory won't be visible in E820 map, but it might be
+added when adding PCI devices due to corresponding ACPI table entries.
+
+Not respecting "mem=" can be corrected by adding a global max_mem_size
+variable set by parse_memopt() which will result in rejecting adding
+memory areas resulting in a memory size above the allowed limit.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: William Kucharski <william.kucharski@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ arch/x86/kernel/e820.c | 5 +++++
+ include/linux/memory_hotplug.h | 2 ++
+ mm/memory_hotplug.c | 6 ++++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
+index 50895c2f937d..e67513e2cbbb 100644
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -20,6 +20,7 @@
+ #include <linux/firmware-map.h>
+ #include <linux/memblock.h>
+ #include <linux/sort.h>
++#include <linux/memory_hotplug.h>
+
+ #include <asm/e820.h>
+ #include <asm/proto.h>
+@@ -831,6 +832,10 @@ static int __init parse_memopt(char *p)
+ return -EINVAL;
+ e820_remove_range(mem_size, ULLONG_MAX - mem_size, E820_RAM, 1);
+
++#ifdef CONFIG_MEMORY_HOTPLUG
++ max_mem_size = mem_size;
++#endif
++
+ return 0;
+ }
+ early_param("mem", parse_memopt);
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 07da5c6c5ba0..fb6bd0022d41 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -100,6 +100,8 @@ extern void __online_page_free(struct page *page);
+
+ extern int try_online_node(int nid);
+
++extern u64 max_mem_size;
++
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+ extern bool is_pageblock_removable_nolock(struct page *page);
+ extern int arch_remove_memory(u64 start, u64 size);
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index b9a667d36c55..94f81c596151 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -128,10 +128,16 @@ void mem_hotplug_done(void)
+ memhp_lock_release();
+ }
+
++u64 max_mem_size = U64_MAX;
++
+ /* add this memory to iomem resource */
+ static struct resource *register_memory_resource(u64 start, u64 size)
+ {
+ struct resource *res;
++
++ if (start + size > max_mem_size)
++ return ERR_PTR(-E2BIG);
++
+ res = kzalloc(sizeof(struct resource), GFP_KERNEL);
+ BUG_ON(!res);
+
+@@ -148,7 +154,7 @@ void mem_hotplug_done(void)
+ if (request_resource(&iomem_resource, res) < 0) {
+ pr_debug("System RAM resource %pR cannot be added\n", res);
+ kfree(res);
+- res = NULL;
++ res = ERR_PTR(-EEXIST);
+ }
+ return res;
+ }
+@@ -1359,8 +1365,8 @@ int __ref add_memory(int nid, u64 start, u64 size)
+ int ret;
+
+ res = register_memory_resource(start, size);
+- if (!res)
+- return -EEXIST;
++ if (IS_ERR(res))
++ return PTR_ERR(res);
+
+ ret = add_memory_resource(nid, res);
+ if (ret < 0)
+--
+2.16.4
+
diff --git a/patches.fixes/0002-futex-Fix-possible-missed-wakeup.patch b/patches.fixes/0002-futex-Fix-possible-missed-wakeup.patch
new file mode 100644
index 0000000000..b28fc7ce1c
--- /dev/null
+++ b/patches.fixes/0002-futex-Fix-possible-missed-wakeup.patch
@@ -0,0 +1,63 @@
+From 521fa9e2590a78f9a71c71bf2ea2a1ad3669b8c0 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 18 Feb 2019 09:50:26 -0800
+Subject: [PATCH 2/3] futex: Fix (possible) missed wakeup
+Git-commit: b061c38bef43406df8e73c5be06cbfacad5ee6ad
+Patch-mainline: v5.0-rc4
+References: bsc#1050549
+
+We must not rely on wake_q_add() to delay the wakeup; in particular
+Commit:
+
+ 1d0dcb3ad9d3 ("futex: Implement lockless wakeups")
+
+moved wake_q_add() before smp_store_release(&q->lock_ptr, NULL), which
+could result in futex_wait() waking before observing ->lock_ptr ==
+NULL and going back to sleep again.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 1d0dcb3ad9d3 ("futex: Implement lockless wakeups")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+
+---
+ kernel/futex.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 643d54f987ef..c3a7a434004e 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1275,11 +1275,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n"))
+ return;
+
+- /*
+- * Queue the task for later wakeup for after we've released
+- * the hb->lock. wake_q_add() grabs reference to p.
+- */
+- wake_q_add(wake_q, p);
++ get_task_struct(p);
+ __unqueue_futex(q);
+ /*
+ * The waiting task can free the futex_q as soon as
+@@ -1289,6 +1285,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ */
+ smp_wmb();
+ q->lock_ptr = NULL;
++
++ /*
++ * Queue the task for later wakeup for after we've released
++ * the hb->lock. wake_q_add() grabs reference to p.
++ */
++ wake_q_add(wake_q, p);
++ put_task_struct(p);
+ }
+
+ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
+--
+2.16.4
+
diff --git a/patches.fixes/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch b/patches.fixes/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
new file mode 100644
index 0000000000..4c098aaaa7
--- /dev/null
+++ b/patches.fixes/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
@@ -0,0 +1,38 @@
+From bb867d219fda7fbaabea3314702474c4eac2b91d Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Tue, 16 Oct 2018 17:31:40 -0700
+Subject: gpu: ipu-v3: Fix CSI offsets for imx53
+Git-commit: bb867d219fda7fbaabea3314702474c4eac2b91d
+Patch-mainline: v5.0-rc7
+References: bsc#1106929
+
+The CSI offsets are wrong for both CSI0 and CSI1. They are at
+physical address 0x1e030000 and 0x1e038000 respectively.
+
+Fixes: 2ffd48f2e7 ("gpu: ipu-v3: Add Camera Sensor Interface unit")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/ipu-v3/ipu-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 5b7cdbfe062f..0a7d4395d427 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = {
+ .cpmem_ofs = 0x07000000,
+ .srm_ofs = 0x07040000,
+ .tpm_ofs = 0x07060000,
+- .csi0_ofs = 0x07030000,
+- .csi1_ofs = 0x07038000,
++ .csi0_ofs = 0x06030000,
++ .csi1_ofs = 0x06038000,
+ .ic_ofs = 0x06020000,
+ .disp0_ofs = 0x06040000,
+ .disp1_ofs = 0x06048000,
+--
+2.20.1
+
diff --git a/patches.fixes/0002-sched-wake_q-Fix-wakeup-ordering-for-wake_q.patch b/patches.fixes/0002-sched-wake_q-Fix-wakeup-ordering-for-wake_q.patch
new file mode 100644
index 0000000000..4fbd93ab49
--- /dev/null
+++ b/patches.fixes/0002-sched-wake_q-Fix-wakeup-ordering-for-wake_q.patch
@@ -0,0 +1,97 @@
+From 63f8f1ba3f28d32883e39f8f6be26fb3f0658d96 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 18 Feb 2019 09:14:51 -0800
+Subject: [PATCH 2/2] sched/wake_q: Fix wakeup ordering for wake_q
+Git-commit: 4c4e3731564c8945ac5ac90fc2a1e1f21cb79c92
+Patch-mainline: v5.0-rc4
+References: bsc#1050549
+
+Notable cmpxchg() does not provide ordering when it fails, however
+wake_q_add() requires ordering in this specific case too. Without this
+it would be possible for the concurrent wakeup to not observe our
+prior state.
+
+Andrea Parri provided:
+
+ C wake_up_q-wake_q_add
+
+ {
+ int next = 0;
+ int y = 0;
+ }
+
+ P0(int *next, int *y)
+ {
+ int r0;
+
+ /* in wake_up_q() */
+
+ WRITE_ONCE(*next, 1); /* node->next = NULL */
+ smp_mb(); /* implied by wake_up_process() */
+ r0 = READ_ONCE(*y);
+ }
+
+ P1(int *next, int *y)
+ {
+ int r1;
+
+ /* in wake_q_add() */
+
+ WRITE_ONCE(*y, 1); /* wake_cond = true */
+ smp_mb__before_atomic();
+ r1 = cmpxchg_relaxed(next, 1, 2);
+ }
+
+ exists (0:r0=0 /\ 1:r1=0)
+
+ This "exists" clause cannot be satisfied according to the LKMM:
+
+ Test wake_up_q-wake_q_add Allowed
+ States 3
+ 0:r0=0; 1:r1=1;
+ 0:r0=1; 1:r1=0;
+ 0:r0=1; 1:r1=1;
+ No
+ Witnesses
+ Positive: 0 Negative: 3
+ Condition exists (0:r0=0 /\ 1:r1=0)
+ Observation wake_up_q-wake_q_add Never 0 3
+
+Reported-by: Yongji Xie <elohimes@gmail.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Davidlohr Bueso <dave@stgolabs.net>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Waiman Long <longman@redhat.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+
+
+---
+ kernel/sched/core.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 5f68564cf53d..b5f7fd0b5938 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -609,10 +609,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
+ * its already queued (either by us or someone else) and will get the
+ * wakeup due to that.
+ *
+- * This cmpxchg() implies a full barrier, which pairs with the write
+- * barrier implied by the wakeup in wake_up_q().
++ * In order to ensure that a pending wakeup will observe our pending
++ * state, even in the failed case, an explicit smp_mb() must be used.
+ */
+- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL))
++ smp_mb__before_atomic();
++ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
+ return;
+
+ get_task_struct(task);
+--
+2.16.4
+
diff --git a/patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocat.patch b/patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocat.patch
new file mode 100644
index 0000000000..3b59629c53
--- /dev/null
+++ b/patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocat.patch
@@ -0,0 +1,135 @@
+From: Juergen Gross <jgross@suse.com>
+Date: Mon, 21 Jan 2019 16:08:39 +0100
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git
+Git-commit: 1d988ed46543ca36c010634c97ac32114362ddb1
+References: bsc#1117645
+Subject: x86/xen: dont add memory above max allowed allocation
+
+Don't allow memory to be added above the allowed maximum allocation
+limit set by Xen.
+
+Trying to do so would result in cases like the following:
+
+[ 584.559652] ------------[ cut here ]------------
+[ 584.564897] WARNING: CPU: 2 PID: 1 at ../arch/x86/xen/multicalls.c:129 xen_alloc_pte+0x1c7/0x390()
+[ 584.575151] Modules linked in:
+[ 584.578643] Supported: Yes
+[ 584.581750] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.4.120-92.70-default #1
+[ 584.590000] Hardware name: Cisco Systems Inc UCSC-C460-M4/UCSC-C460-M4, BIOS C460M4.4.0.1b.0.0629181419 06/29/2018
+[ 584.601862] 0000000000000000 ffffffff813175a0 0000000000000000 ffffffff8184777c
+[ 584.610200] ffffffff8107f4e1 ffff880487eb7000 ffff8801862b79c0 ffff88048608d290
+[ 584.618537] 0000000000487eb7 ffffea0000000201 ffffffff81009de7 ffffffff81068561
+[ 584.626876] Call Trace:
+[ 584.629699] [<ffffffff81019ad9>] dump_trace+0x59/0x340
+[ 584.635645] [<ffffffff81019eaa>] show_stack_log_lvl+0xea/0x170
+[ 584.642391] [<ffffffff8101ac51>] show_stack+0x21/0x40
+[ 584.648238] [<ffffffff813175a0>] dump_stack+0x5c/0x7c
+[ 584.654085] [<ffffffff8107f4e1>] warn_slowpath_common+0x81/0xb0
+[ 584.660932] [<ffffffff81009de7>] xen_alloc_pte+0x1c7/0x390
+[ 584.667289] [<ffffffff810647f0>] pmd_populate_kernel.constprop.6+0x40/0x80
+[ 584.675241] [<ffffffff815ecfe8>] phys_pmd_init+0x210/0x255
+[ 584.681587] [<ffffffff815ed207>] phys_pud_init+0x1da/0x247
+[ 584.687931] [<ffffffff815edb3b>] kernel_physical_mapping_init+0xf5/0x1d4
+[ 584.695682] [<ffffffff815e9bdd>] init_memory_mapping+0x18d/0x380
+[ 584.702631] [<ffffffff81064699>] arch_add_memory+0x59/0xf0
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ arch/x86/xen/setup.c | 13 +++++++++++++
+ drivers/xen/xen-balloon.c | 11 +++++++++++
+ include/xen/xen.h | 4 ++++
+ 3 files changed, 28 insertions(+)
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index d5f303c0e656..0e770f5e5e8c 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -11,6 +11,7 @@
+ #include <linux/memblock.h>
+ #include <linux/cpuidle.h>
+ #include <linux/cpufreq.h>
++#include <linux/memory_hotplug.h>
+
+ #include <asm/elf.h>
+ #include <asm/vdso.h>
+@@ -594,6 +595,14 @@ static void __init xen_align_and_add_e820_region(phys_addr_t start,
+ if (type == E820_RAM) {
+ start = PAGE_ALIGN(start);
+ end &= ~((phys_addr_t)PAGE_SIZE - 1);
++#ifdef CONFIG_MEMORY_HOTPLUG
++ /*
++ * Don't allow adding memory not in E820 map while booting the
++ * system. Once the balloon driver is up it will remove that
++ * restriction again.
++ */
++ max_mem_size = end;
++#endif
+ }
+
+ e820_add_region(start, end - start, type);
+@@ -753,6 +762,10 @@ char * __init xen_memory_setup(void)
+ memmap.nr_entries = E820MAX;
+ set_xen_guest_handle(memmap.buffer, xen_e820_map);
+
++#if defined(CONFIG_MEMORY_HOTPLUG) && defined(CONFIG_XEN_BALLOON)
++ xen_saved_max_mem_size = max_mem_size;
++#endif
++
+ op = xen_initial_domain() ?
+ XENMEM_machine_memory_map :
+ XENMEM_memory_map;
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index 2acbfe104e46..a67236b02452 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -37,6 +37,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/capability.h>
++#include <linux/memory_hotplug.h>
+
+ #include <xen/xen.h>
+ #include <xen/interface/xen.h>
+@@ -50,6 +51,10 @@
+
+ #define BALLOON_CLASS_NAME "xen_memory"
+
++#ifdef CONFIG_MEMORY_HOTPLUG
++u64 xen_saved_max_mem_size = 0;
++#endif
++
+ static struct device balloon_dev;
+
+ static int register_balloon(struct device *dev);
+@@ -63,6 +68,12 @@ static void watch_target(struct xenbus_watch *watch,
+ static bool watch_fired;
+ static long target_diff;
+
++#ifdef CONFIG_MEMORY_HOTPLUG
++ /* The balloon driver will take care of adding memory now. */
++ if (xen_saved_max_mem_size)
++ max_mem_size = xen_saved_max_mem_size;
++#endif
++
+ err = xenbus_scanf(XBT_NIL, "memory", "target", "%llu", &new_target);
+ if (err != 1) {
+ /* This is ok (for domain0 at least) - so just return */
+diff --git a/include/xen/xen.h b/include/xen/xen.h
+index 0e2156786ad2..d8f1ab43ab56 100644
+--- a/include/xen/xen.h
++++ b/include/xen/xen.h
+@@ -43,4 +43,8 @@ struct bio_vec;
+ #else
+ #define xen_pvh_domain() (0)
+ #endif
++
++#if defined(CONFIG_MEMORY_HOTPLUG) && defined(CONFIG_XEN_BALLOON)
++extern u64 xen_saved_max_mem_size;
++#endif
+ #endif /* _XEN_XEN_H */
+--
+2.16.4
+
diff --git a/patches.fixes/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch b/patches.fixes/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
new file mode 100644
index 0000000000..d96087897a
--- /dev/null
+++ b/patches.fixes/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
@@ -0,0 +1,165 @@
+From e8a8fedd57fdcebf0e4f24ef0fc7e29323df8e66 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 29 Jan 2019 14:09:59 -0500
+Subject: drm/i915: Block fbdev HPD processing during suspend
+Git-commit: e8a8fedd57fdcebf0e4f24ef0fc7e29323df8e66
+Patch-mainline: v5.0-rc7
+References: bsc#1106929
+
+When resuming, we check whether or not any previously connected
+MST topologies are still present and if so, attempt to resume them. If
+this fails, we disable said MST topologies and fire off a hotplug event
+so that userspace knows to reprobe.
+
+However, sending a hotplug event involves calling
+drm_fb_helper_hotplug_event(), which in turn results in fbcon doing a
+connector reprobe in the caller's thread - something we can't do at the
+point in which i915 calls drm_dp_mst_topology_mgr_resume() since
+hotplugging hasn't been fully initialized yet.
+
+This currently causes some rather subtle but fatal issues. For example,
+on my T480s the laptop dock connected to it usually disappears during a
+suspend cycle, and comes back up a short while after the system has been
+resumed. This guarantees pretty much every suspend and resume cycle,
+drm_dp_mst_topology_mgr_set_mst(mgr, false); will be caused and in turn,
+a connector hotplug will occur. Now it's Rute Goldberg time: when the
+connector hotplug occurs, i915 reprobes /all/ of the connectors,
+including eDP. However, eDP probing requires that we power on the panel
+VDD which in turn, grabs a wakeref to the appropriate power domain on
+the GPU (on my T480s, this is the PORT_DDI_A_IO domain). This is where
+things start breaking, since this all happens before
+intel_power_domains_enable() is called we end up leaking the wakeref
+that was acquired and never releasing it later. Come next suspend/resume
+cycle, this causes us to fail to shut down the GPU properly, which
+causes it not to resume properly and die a horrible complicated death.
+
+(as a note: this only happens when there's both an eDP panel and MST
+topology connected which is removed mid-suspend. One or the other seems
+to always be OK).
+
+We could try to fix the VDD wakeref leak, but this doesn't seem like
+it's worth it at all since we aren't able to handle hotplug detection
+while resuming anyway. So, let's go with a more robust solution inspired
+by nouveau: block fbdev from handling hotplug events until we resume
+fbdev. This allows us to still send sysfs hotplug events to be handled
+later by user space while we're resuming, while also preventing us from
+actually processing any hotplug events we receive until it's safe.
+
+This fixes the wakeref leak observed on the T480s and as such, also
+fixes suspend/resume with MST topologies connected on this machine.
+
+Changes since v2:
+* Don't call drm_fb_helper_hotplug_event() under lock, do it after lock
+ (Chris Wilson)
+* Don't call drm_fb_helper_hotplug_event() in
+ intel_fbdev_output_poll_changed() under lock (Chris Wilson)
+* Always set ifbdev->hpd_waiting (Chris Wilson)
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 0e32b39ceed6 ("drm/i915: add DP 1.2 MST support (v0.7)")
+Cc: Todd Previte <tprevite@gmail.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v3.17+
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190129191001.442-2-lyude@redhat.com
+(cherry picked from commit fe5ec65668cdaa4348631d8ce1766eed43b33c10)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_drv.h | 10 ++++++++++
+ drivers/gpu/drm/i915/intel_fbdev.c | 34 +++++++++++++++++++++++++++++++++-
+ 2 files changed, 43 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -126,6 +126,16 @@ struct intel_fbdev {
+ struct list_head fbdev_list;
+ struct drm_display_mode *our_mode;
+ int preferred_bpp;
++
++ /* Whether or not fbdev hpd processing is temporarily suspended */
++ bool hpd_suspended : 1;
++ /* Set when a hotplug was received while HPD processing was
++ * suspended
++ */
++ bool hpd_waiting : 1;
++
++ /* Protects hpd_suspended */
++ struct mutex hpd_lock;
+ };
+
+ struct intel_encoder {
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -687,6 +687,7 @@ int intel_fbdev_init(struct drm_device *
+ if (ifbdev == NULL)
+ return -ENOMEM;
+
++ mutex_init(&ifbdev->hpd_lock);
+ drm_fb_helper_prepare(dev, &ifbdev->helper, &intel_fb_helper_funcs);
+
+ if (!intel_fbdev_init_bios(dev, ifbdev))
+@@ -732,6 +733,26 @@ void intel_fbdev_fini(struct drm_device
+ dev_priv->fbdev = NULL;
+ }
+
++/* Suspends/resumes fbdev processing of incoming HPD events. When resuming HPD
++ * processing, fbdev will perform a full connector reprobe if a hotplug event
++ * was received while HPD was suspended.
++ */
++static void intel_fbdev_hpd_set_suspend(struct intel_fbdev *ifbdev, int state)
++{
++ bool send_hpd = false;
++
++ mutex_lock(&ifbdev->hpd_lock);
++ ifbdev->hpd_suspended = state == FBINFO_STATE_SUSPENDED;
++ send_hpd = !ifbdev->hpd_suspended && ifbdev->hpd_waiting;
++ ifbdev->hpd_waiting = false;
++ mutex_unlock(&ifbdev->hpd_lock);
++
++ if (send_hpd) {
++ DRM_DEBUG_KMS("Handling delayed fbcon HPD event\n");
++ drm_fb_helper_hotplug_event(&ifbdev->helper);
++ }
++}
++
+ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -753,6 +774,7 @@ void intel_fbdev_set_suspend(struct drm_
+ */
+ if (state != FBINFO_STATE_RUNNING)
+ flush_work(&dev_priv->fbdev_suspend_work);
++
+ console_lock();
+ } else {
+ /*
+@@ -779,12 +801,22 @@ void intel_fbdev_set_suspend(struct drm_
+
+ drm_fb_helper_set_suspend(&ifbdev->helper, state);
+ console_unlock();
++
++ intel_fbdev_hpd_set_suspend(ifbdev, state);
+ }
+
+ void intel_fbdev_output_poll_changed(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+- if (dev_priv->fbdev)
++ struct intel_fbdev *ifbdev = dev_priv->fbdev;
++ bool send_hpd;
++
++ mutex_lock(&ifbdev->hpd_lock);
++ send_hpd = !ifbdev->hpd_suspended;
++ ifbdev->hpd_waiting = true;
++ mutex_unlock(&ifbdev->hpd_lock);
++
++ if (send_hpd && dev_priv->fbdev)
+ drm_fb_helper_hotplug_event(&dev_priv->fbdev->helper);
+ }
+
diff --git a/patches.fixes/0003-sched-wake_q-Reduce-reference-counting-for-special-u.patch b/patches.fixes/0003-sched-wake_q-Reduce-reference-counting-for-special-u.patch
new file mode 100644
index 0000000000..344af4055f
--- /dev/null
+++ b/patches.fixes/0003-sched-wake_q-Reduce-reference-counting-for-special-u.patch
@@ -0,0 +1,181 @@
+From 38c5ba7f66c90b3c0b8e68f6a070a8cb9e659855 Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 18 Feb 2019 10:03:21 -0800
+Subject: [PATCH 3/3] sched/wake_q: Reduce reference counting for special users
+Patch-mainline: Not yet, queued via tip for v5.1.
+References: bsc#1050549
+
+Some users, specifically futexes and rwsems, required fixes
+that allowed the callers to be safe when wakeups occur before
+they are expected by wake_up_q(). Such scenarios also play
+games and rely on reference counting, and until now were
+pivoting on wake_q doing it. With the wake_q_add() call being
+moved down, this can no longer be the case. As such we end up
+with a a double task refcounting overhead; and these callers
+care enough about this (being rather core-ish).
+
+This patch introduces a wake_q_add_safe() call that serves
+for callers that have already done refcounting and therefore the
+task is 'safe' from wake_q point of view (int that it requires
+reference throughout the entire queue/>wakeup cycle). In the one
+case it has internal reference counting, in the other case it
+consumes the reference counting.
+
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Waiman Long <longman@redhat.com>
+Cc: Will Deacon <will.deacon@arm.com>
+Cc: Xie Yongji <xieyongji@baidu.com>
+Cc: Yongji Xie <elohimes@gmail.com>
+Cc: andrea.parri@amarulasolutions.com
+Cc: lilin24@baidu.com
+Cc: liuqi16@baidu.com
+Cc: nixun@baidu.com
+Cc: yuanlinsi01@baidu.com
+Cc: zhangyu31@baidu.com
+Link: https://lkml.kernel.org/r/20181218195352.7orq3upiwfdbrdne@linux-r8p5
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+
+---
+ include/linux/sched.h | 4 +--
+ kernel/futex.c | 3 +--
+ kernel/locking/rwsem-xadd.c | 4 +--
+ kernel/sched/core.c | 60 +++++++++++++++++++++++++++++++++------------
+ 4 files changed, 48 insertions(+), 23 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index ebe1aa236fba..3e17daba39e4 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1004,8 +1004,8 @@ struct wake_q_head {
+ #define WAKE_Q(name) \
+ struct wake_q_head name = { WAKE_Q_TAIL, &name.first }
+
+-extern void wake_q_add(struct wake_q_head *head,
+- struct task_struct *task);
++extern void wake_q_add(struct wake_q_head *head, struct task_struct *task);
++extern void wake_q_add_safe(struct wake_q_head *head, struct task_struct *task);
+ extern void wake_up_q(struct wake_q_head *head);
+
+ /*
+diff --git a/kernel/futex.c b/kernel/futex.c
+index c3a7a434004e..4323f8061654 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1290,8 +1290,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q)
+ * Queue the task for later wakeup for after we've released
+ * the hb->lock. wake_q_add() grabs reference to p.
+ */
+- wake_q_add(wake_q, p);
+- put_task_struct(p);
++ wake_q_add_safe(wake_q, p);
+ }
+
+ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this,
+diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
+index 1dad74958b1c..32f66c0b53e7 100644
+--- a/kernel/locking/rwsem-xadd.c
++++ b/kernel/locking/rwsem-xadd.c
+@@ -219,9 +219,7 @@ __rwsem_mark_wake(struct rw_semaphore *sem,
+ * Ensure issuing the wakeup (either by us or someone else)
+ * after setting the reader waiter to nil.
+ */
+- wake_q_add(wake_q, tsk);
+- /* wake_q_add() already take the task ref */
+- put_task_struct(tsk);
++ wake_q_add_safe(wake_q, tsk);
+ } while (--loop);
+
+ sem->wait_list.next = next;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index b5f7fd0b5938..61f80137dee6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -588,19 +588,7 @@ static bool set_nr_if_polling(struct task_struct *p)
+ #endif
+ #endif
+
+-/**
+- * wake_q_add() - queue a wakeup for 'later' waking.
+- * @head: the wake_q_head to add @task to
+- * @task: the task to queue for 'later' wakeup
+- *
+- * Queue a task for later wakeup, most likely by the wake_up_q() call in the
+- * same context, _HOWEVER_ this is not guaranteed, the wakeup can come
+- * instantly.
+- *
+- * This function must be used as-if it were wake_up_process(); IOW the task
+- * must be ready to be woken at this location.
+- */
+-void wake_q_add(struct wake_q_head *head, struct task_struct *task)
++static bool __wake_q_add(struct wake_q_head *head, struct task_struct *task)
+ {
+ struct wake_q_node *node = &task->wake_q;
+
+@@ -614,15 +602,55 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task)
+ */
+ smp_mb__before_atomic();
+ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL))
+- return;
+-
+- get_task_struct(task);
++ return false;
+
+ /*
+ * The head is context local, there can be no concurrency.
+ */
+ *head->lastp = node;
+ head->lastp = &node->next;
++ return true;
++}
++
++/**
++ * wake_q_add() - queue a wakeup for 'later' waking.
++ * @head: the wake_q_head to add @task to
++ * @task: the task to queue for 'later' wakeup
++ *
++ * Queue a task for later wakeup, most likely by the wake_up_q() call in the
++ * same context, _HOWEVER_ this is not guaranteed, the wakeup can come
++ * instantly.
++ *
++ * This function must be used as-if it were wake_up_process(); IOW the task
++ * must be ready to be woken at this location.
++ */
++void wake_q_add(struct wake_q_head *head, struct task_struct *task)
++{
++ if (__wake_q_add(head, task))
++ get_task_struct(task);
++}
++
++/**
++ * wake_q_add_safe() - safely queue a wakeup for 'later' waking.
++ * @head: the wake_q_head to add @task to
++ * @task: the task to queue for 'later' wakeup
++ *
++ * Queue a task for later wakeup, most likely by the wake_up_q() call in the
++ * same context, _HOWEVER_ this is not guaranteed, the wakeup can come
++ * instantly.
++ *
++ * This function must be used as-if it were wake_up_process(); IOW the task
++ * must be ready to be woken at this location.
++ *
++ * This function is essentially a task-safe equivalent to wake_q_add(). Callers
++ * that already hold reference to @task can call the 'safe' version and trust
++ * wake_q to do the right thing depending whether or not the @task is already
++ * queued for wakeup.
++ */
++void wake_q_add_safe(struct wake_q_head *head, struct task_struct *task)
++{
++ if (!__wake_q_add(head, task))
++ put_task_struct(task);
+ }
+
+ void wake_up_q(struct wake_q_head *head)
+--
+2.16.4
+
diff --git a/patches.fixes/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch b/patches.fixes/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
new file mode 100644
index 0000000000..9e1afc6c08
--- /dev/null
+++ b/patches.fixes/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
@@ -0,0 +1,65 @@
+From 2e7bd10e05afb866b5fb13eda25095c35d7a27cc Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Thu, 7 Feb 2019 10:54:53 +0200
+Subject: drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
+Git-commit: 2e7bd10e05afb866b5fb13eda25095c35d7a27cc
+Patch-mainline: v5.0-rc7
+References: bsc#1106929
+
+Make sure the underlying VMA in the process address space is the
+same as it was during vm_mmap to avoid applying WC to wrong VMA.
+
+A more long-term solution would be to have vm_mmap_locked variant
+in linux/mmap.h for when caller wants to hold mmap_sem for an
+extended duration.
+
+v2:
+- Refactor the compare function
+
+Fixes: 1816f9236303 ("drm/i915: Support creation of unbound wc user mappings for objects")
+Reported-by: Adam Zabrocki <adamza@microsoft.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v4.0+
+Cc: Akash Goel <akash.goel@intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
+Cc: Adam Zabrocki <adamza@microsoft.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> #v1
+Link: https://patchwork.freedesktop.org/patch/msgid/20190207085454.10598-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 5c4604e757ba9b193b09768d75a7d2105a5b883f)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1708,6 +1708,16 @@ unlock:
+ return ret;
+ }
+
++static inline bool
++__vma_matches(struct vm_area_struct *vma, struct file *filp,
++ unsigned long addr, unsigned long size)
++{
++ if (vma->vm_file != filp)
++ return false;
++
++ return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
++}
++
+ /**
+ * Maps the contents of an object, returning the address it is mapped
+ * into.
+@@ -1760,7 +1770,7 @@ i915_gem_mmap_ioctl(struct drm_device *d
+
+ down_write(&mm->mmap_sem);
+ vma = find_vma(mm, addr);
+- if (vma)
++ if (vma && __vma_matches(vma, obj->filp, addr, args->size))
+ vma->vm_page_prot =
+ pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+ else
diff --git a/patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch b/patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch
new file mode 100644
index 0000000000..2269f5500a
--- /dev/null
+++ b/patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch
@@ -0,0 +1,31 @@
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Thu, 10 Jan 2019 15:41:09 +0800
+Subject: ceph: clear inode pointer when snap realm gets dropped by its inode
+Git-commit: d95e674c01cfb5461e8b9fdeebf6d878c9b80b2f
+Patch-mainline: v5.0-rc4
+References: bsc#1125809
+
+snap realm and corresponding inode have pointers to each other.
+The two pointer should get clear at the same time. Otherwise,
+snap realm's pointer may reference freed inode.
+
+Cc: stable@vger.kernel.org # 4.17+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Luis Henriques <lhenriques@suse.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/caps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -936,6 +936,8 @@ static void drop_inode_snap_realm(struct
+ list_del_init(&ci->i_snap_realm_item);
+ ci->i_snap_realm_counter++;
+ ci->i_snap_realm = NULL;
++ if (realm->ino == ci->i_vino.ino)
++ realm->inode = NULL;
+ spin_unlock(&realm->inodes_with_caps_lock);
+ ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
+ realm);
diff --git a/patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch b/patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
new file mode 100644
index 0000000000..d0b84ee127
--- /dev/null
+++ b/patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
@@ -0,0 +1,57 @@
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 14 Jan 2019 21:13:10 +0100
+Subject: libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
+Git-commit: 4aac9228d16458cedcfd90c7fb37211cf3653ac3
+Patch-mainline: v5.0-rc4
+References: bsc#1125810
+
+con_fault() can transition the connection into STANDBY right after
+ceph_con_keepalive() clears STANDBY in clear_standby():
+
+ libceph user thread ceph-msgr worker
+
+ceph_con_keepalive()
+ mutex_lock(&con->mutex)
+ clear_standby(con)
+ mutex_unlock(&con->mutex)
+ mutex_lock(&con->mutex)
+ con_fault()
+ ...
+ if KEEPALIVE_PENDING isn't set
+ set state to STANDBY
+ ...
+ mutex_unlock(&con->mutex)
+ set KEEPALIVE_PENDING
+ set WRITE_PENDING
+
+This triggers warnings in clear_standby() when either ceph_con_send()
+or ceph_con_keepalive() get to clearing STANDBY next time.
+
+I don't see a reason to condition queue_con() call on the previous
+value of KEEPALIVE_PENDING, so move the setting of KEEPALIVE_PENDING
+into the critical section -- unlike WRITE_PENDING, KEEPALIVE_PENDING
+could have been a non-atomic flag.
+
+Reported-by: syzbot+acdeb633f6211ccdf886@syzkaller.appspotmail.com
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Tested-by: Myungho Jung <mhjungk@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ net/ceph/messenger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -3208,9 +3208,10 @@ void ceph_con_keepalive(struct ceph_conn
+ dout("con_keepalive %p\n", con);
+ mutex_lock(&con->mutex);
+ clear_standby(con);
++ con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
+ mutex_unlock(&con->mutex);
+- if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
+- con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
++
++ if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+ queue_con(con);
+ }
+ EXPORT_SYMBOL(ceph_con_keepalive);
diff --git a/patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch b/patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
new file mode 100644
index 0000000000..e22d2ba8d9
--- /dev/null
+++ b/patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
@@ -0,0 +1,57 @@
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Tue, 8 Jan 2019 19:47:38 +0100
+Subject: rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
+Git-commit: 85f5a4d666fd9be73856ed16bb36c5af5b406b29
+Patch-mainline: v5.0-rc2
+References: bsc#1125808
+
+There is a window between when RBD_DEV_FLAG_REMOVING is set and when
+the device is removed from rbd_dev_list. During this window, we set
+"already" and return 0.
+
+Returning 0 from write(2) can confuse userspace tools because
+0 indicates that nothing was written. In particular, "rbd unmap"
+will retry the write multiple times a second:
+
+ 10:28:05.463299 write(4, "0", 1) = 0
+ 10:28:05.463509 write(4, "0", 1) = 0
+ 10:28:05.463720 write(4, "0", 1) = 0
+ 10:28:05.463942 write(4, "0", 1) = 0
+ 10:28:05.464155 write(4, "0", 1) = 0
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Tested-by: Dongsheng Yang <dongsheng.yang@easystack.cn>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ drivers/block/rbd.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -5404,7 +5404,6 @@ static ssize_t do_rbd_remove(struct bus_
+ struct list_head *tmp;
+ int dev_id;
+ char opt_buf[6];
+- bool already = false;
+ bool force = false;
+ int ret;
+
+@@ -5437,13 +5436,13 @@ static ssize_t do_rbd_remove(struct bus_
+ spin_lock_irq(&rbd_dev->lock);
+ if (rbd_dev->open_count && !force)
+ ret = -EBUSY;
+- else
+- already = test_and_set_bit(RBD_DEV_FLAG_REMOVING,
+- &rbd_dev->flags);
++ else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING,
++ &rbd_dev->flags))
++ ret = -EINPROGRESS;
+ spin_unlock_irq(&rbd_dev->lock);
+ }
+ spin_unlock(&rbd_dev_list_lock);
+- if (ret < 0 || already)
++ if (ret)
+ return ret;
+
+ if (force) {
diff --git a/patches.fixes/scsi-lpfc-correct-mds-diag-and-nvmet-configuration.patch b/patches.fixes/scsi-lpfc-correct-mds-diag-and-nvmet-configuration.patch
new file mode 100644
index 0000000000..be4e339491
--- /dev/null
+++ b/patches.fixes/scsi-lpfc-correct-mds-diag-and-nvmet-configuration.patch
@@ -0,0 +1,42 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 16 Aug 2018 16:04:05 -0700
+Subject: scsi: lpfc: Correct MDS diag and nvmet configuration
+Git-commit: 53e13ee087a80e8d4fc95436318436e5c2c1f8c2
+Patch-mainline: v4.19-rc3
+References: bsc#1125796
+
+A recent change added some MDS processing in the lpfc_drain_txq routine
+that relies on the fcp_wq being allocated. For nvmet operation the fcp_wq
+is not allocated because it can only be an nvme-target. When the original
+MDS support was added LS_MDS_LOOPBACK was defined wrong, (0x16) it should
+have been 0x10 (decimal value used for hex setting). This incorrect value
+allowed MDS_LOOPBACK to be set simultaneously with LS_NPIV_FAB_SUPPORTED,
+causing the driver to crash when it accesses the non-existent fcp_wq.
+
+Correct the bad value setting for LS_MDS_LOOPBACK.
+
+Fixes: ae9e28f36a6c ("lpfc: Add MDS Diagnostic support.")
+Cc: <stable@vger.kernel.org> # v4.12+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Tested-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/scsi/lpfc/lpfc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index e0d0da5f43d6..43732e8d1347 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -672,7 +672,7 @@ struct lpfc_hba {
+ #define LS_NPIV_FAB_SUPPORTED 0x2 /* Fabric supports NPIV */
+ #define LS_IGNORE_ERATT 0x4 /* intr handler should ignore ERATT */
+ #define LS_MDS_LINK_DOWN 0x8 /* MDS Diagnostics Link Down */
+-#define LS_MDS_LOOPBACK 0x16 /* MDS Diagnostics Link Up (Loopback) */
++#define LS_MDS_LOOPBACK 0x10 /* MDS Diagnostics Link Up (Loopback) */
+
+ uint32_t hba_flag; /* hba generic flags */
+ #define HBA_ERATT_HANDLED 0x1 /* This flag is set when eratt handled */
+
diff --git a/patches.fixes/scsi-qla2xxx-fix-deadlock-between-atio-and-hw-lock.patch b/patches.fixes/scsi-qla2xxx-fix-deadlock-between-atio-and-hw-lock.patch
new file mode 100644
index 0000000000..7a5b5bc99d
--- /dev/null
+++ b/patches.fixes/scsi-qla2xxx-fix-deadlock-between-atio-and-hw-lock.patch
@@ -0,0 +1,148 @@
+From: Quinn Tran <quinn.tran@cavium.com>
+Date: Tue, 4 Sep 2018 14:19:10 -0700
+Subject: scsi: qla2xxx: Fix deadlock between ATIO and HW lock
+Git-commit: 1073daa470d906f1853ed4b828f16e2350a5875c
+Patch-mainline: v4.20-rc1
+References: bsc#1125794
+
+Move ATIO queue processing out of hardware_lock to prevent deadlock.
+
+Fixes: 3bb67df5b5f8 ("qla2xxx: Check for online flag instead of active reset when transmitting responses")
+Signed-off-by: Quinn Tran <quinn.tran@cavium.com>
+Signed-off-by: Himanshu Madhani <himanshu.madhani@cavium.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/scsi/qla2xxx/qla_init.c | 17 ++++-----------
+ drivers/scsi/qla2xxx/qla_isr.c | 48 +++++++++++++++++++----------------------
+ 2 files changed, 26 insertions(+), 39 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index f8f55184f542..c3c7ab6fe6e1 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -4859,19 +4859,10 @@ qla2x00_configure_loop(scsi_qla_host_t *vha)
+ */
+ if (qla_tgt_mode_enabled(vha) ||
+ qla_dual_mode_enabled(vha)) {
+- if (IS_QLA27XX(ha) || IS_QLA83XX(ha)) {
+- spin_lock_irqsave(&ha->tgt.atio_lock,
+- flags);
+- qlt_24xx_process_atio_queue(vha, 0);
+- spin_unlock_irqrestore(
+- &ha->tgt.atio_lock, flags);
+- } else {
+- spin_lock_irqsave(&ha->hardware_lock,
+- flags);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(
+- &ha->hardware_lock, flags);
+- }
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock,
++ flags);
+ }
+ }
+ }
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 36cbb29c84f6..bc97e3a1bef7 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3121,6 +3121,7 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ uint16_t mb[8];
+ struct rsp_que *rsp;
+ unsigned long flags;
++ bool process_atio = false;
+
+ rsp = (struct rsp_que *) dev_id;
+ if (!rsp) {
+@@ -3181,22 +3182,13 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+ case INTR_ATIO_QUE_UPDATE_27XX:
+- case INTR_ATIO_QUE_UPDATE:{
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
++ case INTR_ATIO_QUE_UPDATE:
++ process_atio = true;
+ break;
+- }
+- case INTR_ATIO_RSP_QUE_UPDATE: {
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
+-
++ case INTR_ATIO_RSP_QUE_UPDATE:
++ process_atio = true;
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+- }
+ default:
+ ql_dbg(ql_dbg_async, vha, 0x504f,
+ "Unrecognized interrupt type (%d).\n", stat * 0xff);
+@@ -3210,6 +3202,12 @@ qla24xx_intr_handler(int irq, void *dev_id)
+ qla2x00_handle_mbx_completion(ha, status);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
++ if (process_atio) {
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock, flags);
++ }
++
+ return IRQ_HANDLED;
+ }
+
+@@ -3256,6 +3254,7 @@ qla24xx_msix_default(int irq, void *dev_id)
+ uint32_t hccr;
+ uint16_t mb[8];
+ unsigned long flags;
++ bool process_atio = false;
+
+ rsp = (struct rsp_que *) dev_id;
+ if (!rsp) {
+@@ -3312,22 +3311,13 @@ qla24xx_msix_default(int irq, void *dev_id)
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+ case INTR_ATIO_QUE_UPDATE_27XX:
+- case INTR_ATIO_QUE_UPDATE:{
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
++ case INTR_ATIO_QUE_UPDATE:
++ process_atio = true;
+ break;
+- }
+- case INTR_ATIO_RSP_QUE_UPDATE: {
+- unsigned long flags2;
+- spin_lock_irqsave(&ha->tgt.atio_lock, flags2);
+- qlt_24xx_process_atio_queue(vha, 1);
+- spin_unlock_irqrestore(&ha->tgt.atio_lock, flags2);
+-
++ case INTR_ATIO_RSP_QUE_UPDATE:
++ process_atio = true;
+ qla24xx_process_response_queue(vha, rsp);
+ break;
+- }
+ default:
+ ql_dbg(ql_dbg_async, vha, 0x5051,
+ "Unrecognized interrupt type (%d).\n", stat & 0xff);
+@@ -3338,6 +3328,12 @@ qla24xx_msix_default(int irq, void *dev_id)
+ qla2x00_handle_mbx_completion(ha, status);
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
++ if (process_atio) {
++ spin_lock_irqsave(&ha->tgt.atio_lock, flags);
++ qlt_24xx_process_atio_queue(vha, 0);
++ spin_unlock_irqrestore(&ha->tgt.atio_lock, flags);
++ }
++
+ return IRQ_HANDLED;
+ }
+
+
diff --git a/series.conf b/series.conf
index fe97f6d5dc..600383a1d6 100644
--- a/series.conf
+++ b/series.conf
@@ -24203,6 +24203,7 @@
patches.suse/msft-hv-1752-hv_netvsc-Fix-a-deadlock-by-getting-rtnl-lock-earlie.patch
patches.drivers/ibmvnic-Include-missing-return-code-checks-in-reset-.patch
patches.fixes/mm-hugetlb-filter-out-hugetlb-pages-if-hugepage-migration-is-not-supported.patch
+ patches.fixes/scsi-lpfc-correct-mds-diag-and-nvmet-configuration.patch
patches.fixes/scsi-hpsa-limit-transfer-length-to-1mb-not-512kb.patch
patches.fixes/cifs-connect-to-servername-instead-of-IP-for-IPC-share.patch
patches.fixes/ceph-avoid-a-use-after-free-in-ceph_destroy_options.patch
@@ -24286,6 +24287,7 @@
patches.drivers/0001-pci-aspm-fix-link_state-teardown-on-device-removal
patches.drivers/0002-pci-aspm-do-not-initialize-link-state-when-aspm_disabled-is-set
patches.drivers/pci-vmd-detach-resources-after-stopping-root-bus
+ patches.fixes/scsi-qla2xxx-fix-deadlock-between-atio-and-hw-lock.patch
patches.drivers/scsi-mpt3sas-add-ioc_-level-logging-macros
patches.drivers/scsi-mpt3sas-convert-uses-of-pr_-level-with-mpt3sas_fmt-to-ioc_-level
patches.drivers/scsi-mpt3sas-convert-mlsleading-uses-of-pr_-level-with-mpt3sas_fmt
@@ -24395,6 +24397,7 @@
patches.fixes/xfs-Align-compat-attrlist_by_handle-with-native-impl.patch
patches.fixes/scsi-target-add-emulate_pr-backstore-attr-to-toggle-.patch
patches.fixes/scsi-target-drop-unused-pi_prot_format-attribute-sto.patch
+ patches.drivers/IB-rxe-Fix-incorrect-cache-cleanup-in-error-flow.patch
patches.suse/dm-do-not-allow-readahead-to-limit-IO-size.patch
patches.fixes/0001-mm-print-more-information-about-mapping-in-__dump_pa.patch
patches.fixes/0002-mm-lower-the-printk-loglevel-for-__dump_page-message.patch
@@ -24414,10 +24417,17 @@
patches.suse/0001-block-swim3-Fix-EBUSY-error-when-re-opening-device-a.patch
patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch
patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch
+ patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
patches.suse/tty-Don-t-hold-ldisc-lock-in-tty_reopen-if-ldisc-pre.patch
+ patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch
+ patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
patches.drivers/ibmveth-Do-not-process-frames-after-calling-napi_res.patch
patches.fixes/acpi-nfit-block-function-zero-dsms.patch
patches.fixes/acpi-nfit-fix-command-supported-detection.patch
+ patches.fixes/0001-sched-wake_q-Document-wake_q_add.patch
+ patches.fixes/0002-sched-wake_q-Fix-wakeup-ordering-for-wake_q.patch
+ patches.fixes/0002-futex-Fix-possible-missed-wakeup.patch
+ patches.fixes/0001-locking-rwsem-Fix-possible-missed-wakeup.patch
patches.arch/x86-pkeys-properly-copy-pkey-state-at-fork
patches.drivers/iommu-amd-call-free_iova_fast-with-pfn-in-map_sg
patches.drivers/iommu-amd-unmap-all-mapped-pages-in-error-path-of-map_sg
@@ -24428,6 +24438,10 @@
patches.arch/kvm-nvmx-unconditionally-cancel-preemption-timer-in-free_nested-cve-2019-7221
patches.fixes/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch
patches.fixes/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch
+ patches.fixes/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
+ patches.fixes/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
+ patches.fixes/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
+ patches.fixes/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
# mkp/scsi 5.0/scsi-fixes
patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
@@ -24462,6 +24476,7 @@
patches.suse/0013-net-mpls-prevent-speculative-execution.patch
patches.suse/0014-udf-prevent-speculative-execution.patch
patches.fixes/sched-fair-Avoid-divide-by-zero-when-rebalancing-dom.patch
+ patches.fixes/0003-sched-wake_q-Reduce-reference-counting-for-special-u.patch
########################################################
# interrupts/core
@@ -24848,6 +24863,8 @@
# Xen
patches.fixes/xen-hold-lock_device_hotplug-throughout-vcpu-hotplug.patch
patches.fixes/xen-netback-dont-overflow-meta-array.patch
+ patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-paramete.patch
+ patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocat.patch
# bsc#1025461 - Slow throughput on SLES 12 SP2 compared to SLES 11 SP3
patches.fixes/0001-smartpqi-limit-transfer-length-to-1MB.patch