Home Home > GIT Browse > SLE12-SP4-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-07-16 07:07:24 +0200
committerKernel Build Daemon <kbuild@suse.de>2019-07-16 07:07:24 +0200
commit5ff13ebf62071db2f41c635cd3998d5f0e71bf3d (patch)
tree92383f74b172c417d2ada19788dc7f371c1bc15e
parent4578335ba0a1958bccd962cd8d58091d1703a19c (diff)
parent329ab56292916bd88f400957ef9eec6fac8f0b4c (diff)
Merge branch 'SLE12-SP4' into SLE12-SP4-AZURE
-rw-r--r--blacklist.conf1
-rw-r--r--config/s390x/default1
-rw-r--r--config/s390x/zfcpdump1
-rw-r--r--patches.arch/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch121
-rw-r--r--patches.drivers/ALSA-hda-realtek-Headphone-Mic-can-t-record-after-S3.patch46
-rw-r--r--patches.drivers/ASoC-cs4265-readable-register-too-low.patch45
-rw-r--r--patches.drivers/ASoC-max98090-remove-24-bit-format-support-if-RJ-is-.patch58
-rw-r--r--patches.drivers/ASoC-soc-pcm-BE-dai-needs-prepare-when-pause-release.patch49
-rw-r--r--patches.drivers/HID-wacom-correct-touch-resolution-x-y-typo.patch38
-rw-r--r--patches.drivers/HID-wacom-generic-Correct-pad-syncing.patch83
-rw-r--r--patches.drivers/HID-wacom-generic-only-switch-the-mode-on-devices-wi.patch75
-rw-r--r--patches.drivers/HID-wacom-generic-read-HID_DG_CONTACTMAX-from-any-fe.patch80
-rw-r--r--patches.drivers/ath6kl-add-some-bounds-checking.patch64
-rw-r--r--patches.drivers/batman-adv-fix-for-leaked-TVLV-handler.patch34
-rw-r--r--patches.drivers/cpufreq-Use-struct-kobj_attribute-instead-of-struct-.patch192
-rw-r--r--patches.drivers/cpufreq-acpi-cpufreq-Report-if-CPU-doesn-t-support-b.patch51
-rw-r--r--patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-initial-command-chec.patch40
-rw-r--r--patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-types-for-voltage-fr.patch61
-rw-r--r--patches.drivers/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch98
-rw-r--r--patches.drivers/cpufreq-kirkwood-fix-possible-object-reference-leak.patch87
-rw-r--r--patches.drivers/cpufreq-pasemi-fix-possible-object-reference-leak.patch44
-rw-r--r--patches.drivers/cpufreq-pmac32-fix-possible-object-reference-leak.patch56
-rw-r--r--patches.drivers/cpufreq-ppc_cbe-fix-possible-object-reference-leak.patch43
-rw-r--r--patches.drivers/intel_th-msu-Fix-single-mode-with-disabled-IOMMU.patch45
-rw-r--r--patches.drivers/media-marvell-ccic-fix-DMA-s-g-desc-number-calculati.patch66
-rw-r--r--patches.drivers/media-s5p-mfc-Make-additional-clocks-optional.patch46
-rw-r--r--patches.drivers/media-v4l2-Test-type-instead-of-cfg-type-in-v4l2_ctr.patch51
-rw-r--r--patches.drivers/media-vivid-fix-incorrect-assignment-operation-when-.patch41
-rw-r--r--patches.drivers/memstick-Fix-error-cleanup-path-of-memstick_init.patch77
-rw-r--r--patches.drivers/mmc-sdhci-pci-Try-cd-for-card-detect-lookup-before-u.patch95
-rw-r--r--patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch43
-rw-r--r--patches.drivers/staging-comedi-amplc_pci230-fix-null-pointer-deref-o.patch50
-rw-r--r--patches.drivers/staging-comedi-dt282x-fix-a-null-pointer-deref-on-in.patch55
-rw-r--r--patches.drivers/staging-rtl8712-reduce-stack-usage-again.patch209
-rw-r--r--patches.drivers/wil6210-fix-potential-out-of-bounds-read.patch49
-rw-r--r--patches.fixes/0001-ocfs2-add-last-unlock-times-in-locking_state.patch115
-rw-r--r--patches.fixes/0002-ocfs2-add-locking-filter-debugfs-file.patch123
-rw-r--r--patches.fixes/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch166
-rw-r--r--patches.fixes/KVM-polling-add-architecture-backend-to-disable-poll.patch60
-rw-r--r--patches.fixes/KVM-s390-change-default-halt-poll-time-to-50us.patch31
-rw-r--r--patches.fixes/KVM-s390-fix-typo-in-parameter-description.patch31
-rw-r--r--patches.fixes/KVM-s390-provide-kvm_arch_no_poll-function.patch82
-rw-r--r--patches.fixes/RDS-IB-fix-passing-zero-to-ERR_PTR-warning.patch35
-rw-r--r--patches.fixes/af_unix-remove-redundant-lockdep-class.patch54
-rw-r--r--patches.fixes/cgroup-use-css_tryget-instead-of-css_tryget_online-in-task_get_css.patch90
-rw-r--r--patches.fixes/ethtool-check-the-return-value-of-get_regs_len.patch51
-rw-r--r--patches.fixes/lib-fix-stall-in-__bitmap_parselist.patch54
-rw-r--r--patches.fixes/lib-scatterlist-Fix-mapping-iterator-when-sg-offset-.patch63
-rw-r--r--patches.fixes/memory-tegra-Fix-integer-overflow-on-tick-value-calc.patch38
-rw-r--r--patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch138
-rw-r--r--patches.fixes/net-packet-fix-memory-leak-in-packet_set_ring.patch44
-rw-r--r--patches.fixes/netfilter-conntrack-fix-calculation-of-next-bucket-n.patch62
-rw-r--r--patches.fixes/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch67
-rw-r--r--patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch99
-rw-r--r--patches.fixes/s390-vtime-steal-time-exponential-moving-average.patch105
-rw-r--r--patches.fixes/tcp-reduce-tcp_fastretrans_alert-verbosity.patch35
-rw-r--r--patches.kabi/kabi-fix-KVM-s390-provide-kvm_arch_no_poll-function.patch27
-rw-r--r--patches.kabi/kabi-fix-s390-vtime-steal-time-exponential-moving-average.patch31
-rw-r--r--patches.kabi/mwifiex-ieee-types-kabi-fix.patch56
-rw-r--r--patches.suse/0001-bcache-do-not-assign-in-if-condition-in-bcache_devic.patch57
-rw-r--r--patches.suse/0002-bcache-fix-crashes-stopping-bcache-device-before-rea.patch99
-rw-r--r--patches.suse/0003-bcache-fix-inaccurate-result-of-unused-buckets.patch36
-rw-r--r--patches.suse/0004-bcache-avoid-clang-Wunintialized-warning.patch76
-rw-r--r--patches.suse/0005-bcache-Clean-up-bch_get_congested.patch178
-rw-r--r--patches.suse/0006-bcache-fix-a-race-between-cache-register-and-cachese.patch80
-rw-r--r--patches.suse/0007-bcache-move-definition-of-int-ret-out-of-macro-read_.patch56
-rw-r--r--patches.suse/0008-bcache-never-set-KEY_PTRS-of-journal-key-to-0-in-jou.patch100
-rw-r--r--patches.suse/0009-bcache-add-failure-check-to-run_cache_set-for-journa.patch93
-rw-r--r--patches.suse/0010-bcache-add-comments-for-kobj-release-callback-routin.patch68
-rw-r--r--patches.suse/0011-bcache-return-error-immediately-in-bch_journal_repla.patch53
-rw-r--r--patches.suse/0012-bcache-add-error-check-for-calling-register_bdev.patch96
-rw-r--r--patches.suse/0013-bcache-Add-comments-for-blkdev_put-in-registration-c.patch58
-rw-r--r--patches.suse/0014-bcache-add-comments-for-closure_fn-to-be-called-in-c.patch49
-rw-r--r--patches.suse/0015-bcache-improve-bcache_reboot.patch62
-rw-r--r--patches.suse/0016-bcache-fix-failure-in-journal-relplay.patch89
-rw-r--r--patches.suse/0017-bcache-fix-wrong-usage-use-after-freed-on-keylist-in.patch41
-rw-r--r--patches.suse/0018-bcache-avoid-potential-memleak-of-list-of-journal_re.patch62
-rw-r--r--patches.suse/0019-bcache-remove-redundant-LIST_HEAD-journal-from-run_c.patch41
-rw-r--r--patches.suse/0020-bcache-make-is_discard_enabled-static.patch33
-rw-r--r--patches.suse/0021-bcache-fix-stack-corruption-by-PRECEDING_KEY.patch132
-rw-r--r--patches.suse/0022-bcache-only-set-BCACHE_DEV_WB_RUNNING-when-cached-de.patch62
-rw-r--r--patches.suse/0023-bcache-don-t-set-max-writeback-rate-if-gc-is-running.patch46
-rw-r--r--patches.suse/0024-bcache-check-c-gc_thread-by-IS_ERR_OR_NULL-in-cache_.patch130
-rw-r--r--patches.suse/0025-bcache-fix-return-value-error-in-bch_journal_read.patch47
-rw-r--r--patches.suse/0026-Revert-bcache-set-CACHE_SET_IO_DISABLE-in-bch_cached.patch69
-rw-r--r--patches.suse/0027-bcache-avoid-flushing-btree-node-in-cache_set_flush-.patch58
-rw-r--r--patches.suse/0028-bcache-ignore-read-ahead-request-failure-on-backing-.patch60
-rw-r--r--patches.suse/0029-bcache-add-io-error-counting-in-write_bdev_super_end.patch42
-rw-r--r--patches.suse/0030-bcache-remove-unnecessary-prefetch-in-bset_search_tr.patch60
-rw-r--r--patches.suse/0031-bcache-use-sysfs_match_string-instead-of-__sysfs_mat.patch102
-rw-r--r--patches.suse/0032-bcache-add-return-value-check-to-bch_cached_dev_run.patch153
-rw-r--r--patches.suse/0033-bcache-remove-unncessary-code-in-bch_btree_keys_init.patch77
-rw-r--r--patches.suse/0034-bcache-check-CACHE_SET_IO_DISABLE-in-allocator-code.patch57
-rw-r--r--patches.suse/0035-bcache-check-CACHE_SET_IO_DISABLE-bit-in-bch_journal.patch44
-rw-r--r--patches.suse/0036-bcache-more-detailed-error-message-to-bcache_device_.patch51
-rw-r--r--patches.suse/0037-bcache-add-more-error-message-in-bch_cached_dev_atta.patch43
-rw-r--r--patches.suse/0038-bcache-improve-error-message-in-bch_cached_dev_run.patch57
-rw-r--r--patches.suse/0039-bcache-remove-XXX-comment-line-from-run_cache_set.patch36
-rw-r--r--patches.suse/0040-bcache-make-bset_search_tree-be-more-understandable.patch75
-rw-r--r--patches.suse/0041-bcache-add-pendings_cleanup-to-stop-pending-bcache-d.patch111
-rw-r--r--patches.suse/0042-bcache-fix-mistaken-sysfs-entry-for-io_error-counter.patch48
-rw-r--r--patches.suse/0043-bcache-destroy-dc-writeback_write_wq-if-failed-to-cr.patch40
-rw-r--r--patches.suse/0044-bcache-stop-writeback-kthread-and-kworker-when-bch_c.patch47
-rw-r--r--patches.suse/0045-bcache-avoid-a-deadlock-in-bcache_reboot.patch216
-rw-r--r--patches.suse/0046-bcache-acquire-bch_register_lock-later-in-cached_dev.patch52
-rw-r--r--patches.suse/0047-bcache-acquire-bch_register_lock-later-in-cached_dev.patch164
-rw-r--r--patches.suse/0048-bcache-fix-potential-deadlock-in-cached_def_free.patch173
-rw-r--r--patches.suse/0049-bcache-add-code-comments-for-journal_read_bucket.patch77
-rw-r--r--patches.suse/0050-bcache-set-largest-seq-to-ja-seq-bucket_index-in-jou.patch39
-rw-r--r--patches.suse/0051-bcache-shrink-btree-node-cache-after-bch_btree_check.patch60
-rw-r--r--patches.suse/0052-bcache-Revert-bcache-free-heap-cache_set-flush_btree.patch40
-rw-r--r--patches.suse/0053-bcache-Revert-bcache-fix-high-CPU-occupancy-during-j.patch134
-rw-r--r--patches.suse/0054-bcache-only-clear-BTREE_NODE_dirty-bit-when-it-is-se.patch62
-rw-r--r--patches.suse/0055-bcache-add-comments-for-mutex_lock-b-write_lock.patch52
-rw-r--r--patches.suse/0056-bcache-remove-retry_flush_write-from-struct-cache_se.patch80
-rw-r--r--patches.suse/0057-bcache-fix-race-in-btree_flush_write.patch191
-rw-r--r--patches.suse/0058-bcache-performance-improvement-for-btree_flush_write.patch192
-rw-r--r--patches.suse/0059-bcache-add-reclaimed_journal_buckets-to-struct-cache.patch84
-rw-r--r--patches.suse/Btrfs-kill-btrfs_clear_path_blocking.patch314
-rw-r--r--series.conf116
120 files changed, 8972 insertions, 0 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 77272e3621..0b13fea43b 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1278,3 +1278,4 @@ c6975e4196549c18c5277a55e30b2d6d1b80abf2 # compiler.h: reverted above in 4.14.x
9c3e922ba316a5d3d8cbe41e0db97888fca5c359 # too risky because too many dependencies
8a4db13ccc079b762123d04a7270d6d2cb3398d7 # drm/i915: Already cherry-picked
600d3712ae122be3ceab0d7ac8246caa3d87dcea # drm/i915: Already cherry-picked
+c3ad2c3b02e953ead2b8d52a0c9e70312930c3d0 # kABI breaker, cause unlikely to happen (bsc#1107003)
diff --git a/config/s390x/default b/config/s390x/default
index e901a6ca58..636b634400 100644
--- a/config/s390x/default
+++ b/config/s390x/default
@@ -3111,6 +3111,7 @@ CONFIG_KVM_ASYNC_PF_SYNC=y
CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y
CONFIG_KVM_VFIO=y
CONFIG_HAVE_KVM_INVALID_WAKEUPS=y
+CONFIG_HAVE_KVM_NO_POLL=y
CONFIG_VIRTUALIZATION=y
CONFIG_KVM=m
# CONFIG_KVM_S390_UCONTROL is not set
diff --git a/config/s390x/zfcpdump b/config/s390x/zfcpdump
index 08c108ad91..9db66f2134 100644
--- a/config/s390x/zfcpdump
+++ b/config/s390x/zfcpdump
@@ -1238,6 +1238,7 @@ CONFIG_KVM_ASYNC_PF_SYNC=y
CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y
CONFIG_KVM_VFIO=y
CONFIG_HAVE_KVM_INVALID_WAKEUPS=y
+CONFIG_HAVE_KVM_NO_POLL=y
CONFIG_VIRTUALIZATION=y
CONFIG_KVM=y
# CONFIG_KVM_S390_UCONTROL is not set
diff --git a/patches.arch/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch b/patches.arch/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch
new file mode 100644
index 0000000000..2109d8b68e
--- /dev/null
+++ b/patches.arch/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch
@@ -0,0 +1,121 @@
+From f474c28fbcbe42faca4eb415172c07d76adcb819 Mon Sep 17 00:00:00 2001
+From: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Date: Thu, 13 Jun 2019 09:00:14 +0530
+Subject: [PATCH] powerpc/watchpoint: Restore NV GPRs while returning from
+ exception
+
+References: bsc#1140945 bsc#1141401 bsc#1141402 bsc#1141452 bsc#1141453 bsc#1141454 LTC#178983 LTC#179191 LTC#179192 LTC#179193 LTC#179194 LTC#179195
+Patch-mainline: v5.3-rc1
+Git-commit: f474c28fbcbe42faca4eb415172c07d76adcb819
+
+powerpc hardware triggers watchpoint before executing the instruction.
+To make trigger-after-execute behavior, kernel emulates the
+instruction. If the instruction is 'load something into non-volatile
+register', exception handler should restore emulated register state
+while returning back, otherwise there will be register state
+corruption. eg, adding a watchpoint on a list can corrput the list:
+
+ # cat /proc/kallsyms | grep kthread_create_list
+ c00000000121c8b8 d kthread_create_list
+
+Add watchpoint on kthread_create_list->prev:
+
+ # perf record -e mem:0xc00000000121c8c0
+
+Run some workload such that new kthread gets invoked. eg, I just
+logged out from console:
+
+ list_add corruption. next->prev should be prev (c000000001214e00), \
+ but was c00000000121c8b8. (next=c00000000121c8b8).
+ WARNING: CPU: 59 PID: 309 at lib/list_debug.c:25 __list_add_valid+0xb4/0xc0
+ CPU: 59 PID: 309 Comm: kworker/59:0 Kdump: loaded Not tainted 5.1.0-rc7+ #69
+ ...
+ NIP __list_add_valid+0xb4/0xc0
+ LR __list_add_valid+0xb0/0xc0
+ Call Trace:
+ __list_add_valid+0xb0/0xc0 (unreliable)
+ __kthread_create_on_node+0xe0/0x260
+ kthread_create_on_node+0x34/0x50
+ create_worker+0xe8/0x260
+ worker_thread+0x444/0x560
+ kthread+0x160/0x1a0
+ ret_from_kernel_thread+0x5c/0x70
+
+List corruption happened because it uses 'load into non-volatile
+register' instruction:
+
+Snippet from __kthread_create_on_node:
+
+ c000000000136be8: addis r29,r2,-19
+ c000000000136bec: ld r29,31424(r29)
+ if (!__list_add_valid(new, prev, next))
+ c000000000136bf0: mr r3,r30
+ c000000000136bf4: mr r5,r28
+ c000000000136bf8: mr r4,r29
+ c000000000136bfc: bl c00000000059a2f8 <__list_add_valid+0x8>
+
+Register state from WARN_ON():
+
+ GPR00: c00000000059a3a0 c000007ff23afb50 c000000001344e00 0000000000000075
+ GPR04: 0000000000000000 0000000000000000 0000001852af8bc1 0000000000000000
+ GPR08: 0000000000000001 0000000000000007 0000000000000006 00000000000004aa
+ GPR12: 0000000000000000 c000007ffffeb080 c000000000137038 c000005ff62aaa00
+ GPR16: 0000000000000000 0000000000000000 c000007fffbe7600 c000007fffbe7370
+ GPR20: c000007fffbe7320 c000007fffbe7300 c000000001373a00 0000000000000000
+ GPR24: fffffffffffffef7 c00000000012e320 c000007ff23afcb0 c000000000cb8628
+ GPR28: c00000000121c8b8 c000000001214e00 c000007fef5b17e8 c000007fef5b17c0
+
+Watchpoint hit at 0xc000000000136bec.
+
+ addis r29,r2,-19
+ => r29 = 0xc000000001344e00 + (-19 << 16)
+ => r29 = 0xc000000001214e00
+
+ ld r29,31424(r29)
+ => r29 = *(0xc000000001214e00 + 31424)
+ => r29 = *(0xc00000000121c8c0)
+
+0xc00000000121c8c0 is where we placed a watchpoint and thus this
+instruction was emulated by emulate_step. But because handle_dabr_fault
+did not restore emulated register state, r29 still contains stale
+value in above register state.
+
+Fixes: 5aae8a5370802 ("powerpc, hw_breakpoints: Implement hw_breakpoints for 64-bit server processors")
+Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
+Cc: stable@vger.kernel.org # 2.6.36+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/kernel/exceptions-64s.S | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 6b86055e5251..4d4fd2ad5b7d 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1746,7 +1746,7 @@ handle_page_fault:
+ addi r3,r1,STACK_FRAME_OVERHEAD
+ bl do_page_fault
+ cmpdi r3,0
+- beq+ 12f
++ beq+ ret_from_except_lite
+ bl save_nvgprs
+ mr r5,r3
+ addi r3,r1,STACK_FRAME_OVERHEAD
+@@ -1761,7 +1761,12 @@ handle_dabr_fault:
+ ld r5,_DSISR(r1)
+ addi r3,r1,STACK_FRAME_OVERHEAD
+ bl do_break
+-12: b ret_from_except_lite
++ /*
++ * do_break() may have changed the NV GPRS while handling a breakpoint.
++ * If so, we need to restore them with their updated values. Don't use
++ * ret_from_except_lite here.
++ */
++ b ret_from_except
+
+
+ #ifdef CONFIG_PPC_BOOK3S_64
+--
+2.22.0
+
diff --git a/patches.drivers/ALSA-hda-realtek-Headphone-Mic-can-t-record-after-S3.patch b/patches.drivers/ALSA-hda-realtek-Headphone-Mic-can-t-record-after-S3.patch
new file mode 100644
index 0000000000..f33e312a3b
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Headphone-Mic-can-t-record-after-S3.patch
@@ -0,0 +1,46 @@
+From d07a9a4f66e944fcc900812cbc2f6817bde6a43d Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Thu, 4 Jul 2019 16:02:10 +0800
+Subject: [PATCH] ALSA: hda/realtek - Headphone Mic can't record after S3
+Git-commit: d07a9a4f66e944fcc900812cbc2f6817bde6a43d
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Dell headset mode platform with ALC236.
+It doesn't recording after system resume from S3.
+S3 mode was deep. s2idle was not has this issue.
+S3 deep will cut of codec power. So, the register will back to default
+after resume back.
+This patch will solve this issue.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 48f3c5b8d6e9..0f776444ab86 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3268,6 +3268,7 @@ static void alc256_init(struct hda_codec *codec)
+ alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */
+ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15);
++ alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
+ }
+
+ static void alc256_shutup(struct hda_codec *codec)
+@@ -7838,7 +7839,6 @@ static int patch_alc269(struct hda_codec *codec)
+ spec->shutup = alc256_shutup;
+ spec->init_hook = alc256_init;
+ spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */
+- alc_update_coef_idx(codec, 0x36, 1 << 13, 1 << 5); /* Switch pcbeep path to Line in path*/
+ break;
+ case 0x10ec0257:
+ spec->codec_variant = ALC269_TYPE_ALC257;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-cs4265-readable-register-too-low.patch b/patches.drivers/ASoC-cs4265-readable-register-too-low.patch
new file mode 100644
index 0000000000..db6741ed55
--- /dev/null
+++ b/patches.drivers/ASoC-cs4265-readable-register-too-low.patch
@@ -0,0 +1,45 @@
+From f3df05c805983427319eddc2411a2105ee1757cf Mon Sep 17 00:00:00 2001
+From: Matt Flax <flatmax@flatmax.org>
+Date: Wed, 8 May 2019 16:33:13 +1000
+Subject: [PATCH] ASoC : cs4265 : readable register too low
+Git-commit: f3df05c805983427319eddc2411a2105ee1757cf
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+The cs4265_readable_register function stopped short of the maximum
+register.
+
+An example bug is taken from :
+https://github.com/Audio-Injector/Ultra/issues/25
+
+Where alsactl store fails with :
+Cannot read control '2,0,0,C Data Buffer,0': Input/output error
+
+This patch fixes the bug by setting the cs4265 to have readable
+registers up to the maximum hardware register CS4265_MAX_REGISTER.
+
+Signed-off-by: Matt Flax <flatmax@flatmax.org>
+Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/cs4265.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
+index ab27d2b94d02..c0190ec59e74 100644
+--- a/sound/soc/codecs/cs4265.c
++++ b/sound/soc/codecs/cs4265.c
+@@ -60,7 +60,7 @@ static const struct reg_default cs4265_reg_defaults[] = {
+ static bool cs4265_readable_register(struct device *dev, unsigned int reg)
+ {
+ switch (reg) {
+- case CS4265_CHIP_ID ... CS4265_SPDIF_CTL2:
++ case CS4265_CHIP_ID ... CS4265_MAX_REGISTER:
+ return true;
+ default:
+ return false;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-max98090-remove-24-bit-format-support-if-RJ-is-.patch b/patches.drivers/ASoC-max98090-remove-24-bit-format-support-if-RJ-is-.patch
new file mode 100644
index 0000000000..61254216fc
--- /dev/null
+++ b/patches.drivers/ASoC-max98090-remove-24-bit-format-support-if-RJ-is-.patch
@@ -0,0 +1,58 @@
+From 5628c8979642a076f91ee86c3bae5ad251639af0 Mon Sep 17 00:00:00 2001
+From: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Date: Tue, 4 Jun 2019 18:49:09 +0800
+Subject: [PATCH] ASoC: max98090: remove 24-bit format support if RJ is 0
+Git-commit: 5628c8979642a076f91ee86c3bae5ad251639af0
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+The supported formats are S16_LE and S24_LE now. However, by datasheet
+of max98090, S24_LE is only supported when it is in the right justified
+mode. We should remove 24-bit format if it is not in that mode to avoid
+triggering error.
+
+Signed-off-by: Yu-Hsuan Hsu <yuhsuan@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/max98090.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 7619ea31ab50..ada8c25e643d 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1909,6 +1909,21 @@ static int max98090_configure_dmic(struct max98090_priv *max98090,
+ return 0;
+ }
+
++static int max98090_dai_startup(struct snd_pcm_substream *substream,
++ struct snd_soc_dai *dai)
++{
++ struct snd_soc_component *component = dai->component;
++ struct max98090_priv *max98090 = snd_soc_component_get_drvdata(component);
++ unsigned int fmt = max98090->dai_fmt;
++
++ /* Remove 24-bit format support if it is not in right justified mode. */
++ if ((fmt & SND_SOC_DAIFMT_FORMAT_MASK) != SND_SOC_DAIFMT_RIGHT_J) {
++ substream->runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
++ snd_pcm_hw_constraint_msbits(substream->runtime, 0, 16, 16);
++ }
++ return 0;
++}
++
+ static int max98090_dai_hw_params(struct snd_pcm_substream *substream,
+ struct snd_pcm_hw_params *params,
+ struct snd_soc_dai *dai)
+@@ -2316,6 +2331,7 @@ EXPORT_SYMBOL_GPL(max98090_mic_detect);
+ #define MAX98090_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S24_LE)
+
+ static const struct snd_soc_dai_ops max98090_dai_ops = {
++ .startup = max98090_dai_startup,
+ .set_sysclk = max98090_dai_set_sysclk,
+ .set_fmt = max98090_dai_set_fmt,
+ .set_tdm_slot = max98090_set_tdm_slot,
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-soc-pcm-BE-dai-needs-prepare-when-pause-release.patch b/patches.drivers/ASoC-soc-pcm-BE-dai-needs-prepare-when-pause-release.patch
new file mode 100644
index 0000000000..a30ea5fbbb
--- /dev/null
+++ b/patches.drivers/ASoC-soc-pcm-BE-dai-needs-prepare-when-pause-release.patch
@@ -0,0 +1,49 @@
+From 5087a8f17df868601cd7568299e91c28086d2b45 Mon Sep 17 00:00:00 2001
+From: Libin Yang <libin.yang@intel.com>
+Date: Wed, 8 May 2019 10:32:41 +0800
+Subject: [PATCH] ASoC: soc-pcm: BE dai needs prepare when pause release after resume
+Git-commit: 5087a8f17df868601cd7568299e91c28086d2b45
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+If playback/capture is paused and system enters S3, after system returns
+from suspend, BE dai needs to call prepare() callback when playback/capture
+is released from pause if RESUME_INFO flag is not set.
+
+Currently, the dpcm_be_dai_prepare() function will block calling prepare()
+if the pcm is in SND_SOC_DPCM_STATE_PAUSED state. This will cause the
+following test case fail if the pcm uses BE:
+
+playback -> pause -> S3 suspend -> S3 resume -> pause release
+
+The playback may exit abnormally when pause is released because the BE dai
+prepare() is not called.
+
+This patch allows dpcm_be_dai_prepare() to call dai prepare() callback in
+SND_SOC_DPCM_STATE_PAUSED state.
+
+Signed-off-by: Libin Yang <libin.yang@intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index 74695355c1f8..7347e6f99248 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -2471,7 +2471,8 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)
+
+ if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) &&
+ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) &&
+- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND))
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) &&
++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED))
+ continue;
+
+ dev_dbg(be->dev, "ASoC: prepare BE %s\n",
+--
+2.16.4
+
diff --git a/patches.drivers/HID-wacom-correct-touch-resolution-x-y-typo.patch b/patches.drivers/HID-wacom-correct-touch-resolution-x-y-typo.patch
new file mode 100644
index 0000000000..3af63a5388
--- /dev/null
+++ b/patches.drivers/HID-wacom-correct-touch-resolution-x-y-typo.patch
@@ -0,0 +1,38 @@
+From 68c20cc2164cc5c7c73f8012ae6491afdb1f7f72 Mon Sep 17 00:00:00 2001
+From: Aaron Armstrong Skomra <skomra@gmail.com>
+Date: Fri, 10 May 2019 15:34:18 -0700
+Subject: [PATCH] HID: wacom: correct touch resolution x/y typo
+Git-commit: 68c20cc2164cc5c7c73f8012ae6491afdb1f7f72
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+This affects the 2nd-gen Intuos Pro Medium and Large
+when using their Bluetooth connection.
+
+Fixes: 4922cd26f03c ("HID: wacom: Support 2nd-gen Intuos Pro's Bluetooth classic interface")
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
+Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/wacom_wac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index ed6726eeeae5..a98ad4fdcf9e 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -3692,7 +3692,7 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev,
+ 0, 5920, 4, 0);
+ }
+ input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
+- input_abs_set_res(input_dev, ABS_MT_POSITION_X, 40);
++ input_abs_set_res(input_dev, ABS_MT_POSITION_Y, 40);
+
+ /* fall through */
+
+--
+2.16.4
+
diff --git a/patches.drivers/HID-wacom-generic-Correct-pad-syncing.patch b/patches.drivers/HID-wacom-generic-Correct-pad-syncing.patch
new file mode 100644
index 0000000000..68d3bb588a
--- /dev/null
+++ b/patches.drivers/HID-wacom-generic-Correct-pad-syncing.patch
@@ -0,0 +1,83 @@
+From d4b8efeb46d99a5d02e7f88ac4eaccbe49370770 Mon Sep 17 00:00:00 2001
+From: Aaron Armstrong Skomra <skomra@gmail.com>
+Date: Fri, 10 May 2019 15:34:17 -0700
+Subject: [PATCH] HID: wacom: generic: Correct pad syncing
+Git-commit: d4b8efeb46d99a5d02e7f88ac4eaccbe49370770
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Only sync the pad once per report, not once per collection.
+Also avoid syncing the pad on battery reports.
+
+Fixes: f8b6a74719b5 ("HID: wacom: generic: Support multiple tools per report")
+Cc: <stable@vger.kernel.org> # v4.17+
+Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/wacom_wac.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 62bf8ec6023e..ed6726eeeae5 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2097,14 +2097,12 @@ static void wacom_wac_pad_report(struct hid_device *hdev,
+ bool active = wacom_wac->hid_data.inrange_state != 0;
+
+ /* report prox for expresskey events */
+- if ((wacom_equivalent_usage(field->physical) == HID_DG_TABLETFUNCTIONKEY) &&
+- wacom_wac->hid_data.pad_input_event_flag) {
++ if (wacom_wac->hid_data.pad_input_event_flag) {
+ input_event(input, EV_ABS, ABS_MISC, active ? PAD_DEVICE_ID : 0);
+ input_sync(input);
+ if (!active)
+ wacom_wac->hid_data.pad_input_event_flag = false;
+ }
+-
+ }
+
+ static void wacom_wac_pen_usage_mapping(struct hid_device *hdev,
+@@ -2680,9 +2678,7 @@ static int wacom_wac_collection(struct hid_device *hdev, struct hid_report *repo
+ if (report->type != HID_INPUT_REPORT)
+ return -1;
+
+- if (WACOM_PAD_FIELD(field) && wacom->wacom_wac.pad_input)
+- wacom_wac_pad_report(hdev, report, field);
+- else if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
++ if (WACOM_PEN_FIELD(field) && wacom->wacom_wac.pen_input)
+ wacom_wac_pen_report(hdev, report);
+ else if (WACOM_FINGER_FIELD(field) && wacom->wacom_wac.touch_input)
+ wacom_wac_finger_report(hdev, report);
+@@ -2696,7 +2692,7 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ struct hid_field *field;
+ bool pad_in_hid_field = false, pen_in_hid_field = false,
+- finger_in_hid_field = false;
++ finger_in_hid_field = false, true_pad = false;
+ int r;
+ int prev_collection = -1;
+
+@@ -2712,6 +2708,8 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
+ pen_in_hid_field = true;
+ if (WACOM_FINGER_FIELD(field))
+ finger_in_hid_field = true;
++ if (wacom_equivalent_usage(field->physical) == HID_DG_TABLETFUNCTIONKEY)
++ true_pad = true;
+ }
+
+ wacom_wac_battery_pre_report(hdev, report);
+@@ -2735,6 +2733,9 @@ void wacom_wac_report(struct hid_device *hdev, struct hid_report *report)
+ }
+
+ wacom_wac_battery_report(hdev, report);
++
++ if (true_pad && wacom->wacom_wac.pad_input)
++ wacom_wac_pad_report(hdev, report, field);
+ }
+
+ static int wacom_bpt_touch(struct wacom_wac *wacom)
+--
+2.16.4
+
diff --git a/patches.drivers/HID-wacom-generic-only-switch-the-mode-on-devices-wi.patch b/patches.drivers/HID-wacom-generic-only-switch-the-mode-on-devices-wi.patch
new file mode 100644
index 0000000000..f183c11d2f
--- /dev/null
+++ b/patches.drivers/HID-wacom-generic-only-switch-the-mode-on-devices-wi.patch
@@ -0,0 +1,75 @@
+From d8e9806005f28bbb49899dab2068e3359e22ba35 Mon Sep 17 00:00:00 2001
+From: Aaron Armstrong Skomra <skomra@gmail.com>
+Date: Fri, 10 May 2019 15:31:16 -0700
+Subject: [PATCH] HID: wacom: generic: only switch the mode on devices with LEDs
+Git-commit: d8e9806005f28bbb49899dab2068e3359e22ba35
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Currently, the driver will attempt to set the mode on all
+devices with a center button, but some devices with a center
+button lack LEDs, and attempting to set the LEDs on devices
+without LEDs results in the kernel error message of the form:
+
+"leds input8::wacom-0.1: Setting an LED's brightness failed (-32)"
+
+This is because the generic codepath erroneously assumes that the
+BUTTON_CENTER usage indicates that the device has LEDs, the
+previously ignored TOUCH_RING_SETTING usage is a more accurate
+indication of the existence of LEDs on the device.
+
+Fixes: 10c55cacb8b2 ("HID: wacom: generic: support LEDs")
+Cc: <stable@vger.kernel.org> # v4.11+
+Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
+Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/wacom_sys.c | 3 +++
+ drivers/hid/wacom_wac.c | 2 --
+ drivers/hid/wacom_wac.h | 1 +
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index a8633b1437b2..2e3e03df83da 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -307,6 +307,9 @@ static void wacom_feature_mapping(struct hid_device *hdev,
+ wacom_hid_usage_quirk(hdev, field, usage);
+
+ switch (equivalent_usage) {
++ case WACOM_HID_WD_TOUCH_RING_SETTING:
++ wacom->generic_has_leds = true;
++ break;
+ case HID_DG_CONTACTMAX:
+ /* leave touch_max as is if predefined */
+ if (!features->touch_max) {
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 747730d32ab6..62bf8ec6023e 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -1906,8 +1906,6 @@ static void wacom_wac_pad_usage_mapping(struct hid_device *hdev,
+ features->device_type |= WACOM_DEVICETYPE_PAD;
+ break;
+ case WACOM_HID_WD_BUTTONCENTER:
+- wacom->generic_has_leds = true;
+- /* fall through */
+ case WACOM_HID_WD_BUTTONHOME:
+ case WACOM_HID_WD_BUTTONUP:
+ case WACOM_HID_WD_BUTTONDOWN:
+diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h
+index 295fd3718caa..f67d871841c0 100644
+--- a/drivers/hid/wacom_wac.h
++++ b/drivers/hid/wacom_wac.h
+@@ -145,6 +145,7 @@
+ #define WACOM_HID_WD_OFFSETBOTTOM (WACOM_HID_UP_WACOMDIGITIZER | 0x0d33)
+ #define WACOM_HID_WD_DATAMODE (WACOM_HID_UP_WACOMDIGITIZER | 0x1002)
+ #define WACOM_HID_WD_DIGITIZERINFO (WACOM_HID_UP_WACOMDIGITIZER | 0x1013)
++#define WACOM_HID_WD_TOUCH_RING_SETTING (WACOM_HID_UP_WACOMDIGITIZER | 0x1032)
+ #define WACOM_HID_UP_G9 0xff090000
+ #define WACOM_HID_G9_PEN (WACOM_HID_UP_G9 | 0x02)
+ #define WACOM_HID_G9_TOUCHSCREEN (WACOM_HID_UP_G9 | 0x11)
+--
+2.16.4
+
diff --git a/patches.drivers/HID-wacom-generic-read-HID_DG_CONTACTMAX-from-any-fe.patch b/patches.drivers/HID-wacom-generic-read-HID_DG_CONTACTMAX-from-any-fe.patch
new file mode 100644
index 0000000000..5bbc9318a6
--- /dev/null
+++ b/patches.drivers/HID-wacom-generic-read-HID_DG_CONTACTMAX-from-any-fe.patch
@@ -0,0 +1,80 @@
+From 184eccd40389df29abefab88092c4ff33191fd0c Mon Sep 17 00:00:00 2001
+From: Aaron Armstrong Skomra <skomra@gmail.com>
+Date: Wed, 12 Jun 2019 14:19:29 -0700
+Subject: [PATCH] HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report
+Git-commit: 184eccd40389df29abefab88092c4ff33191fd0c
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+In the generic code path, HID_DG_CONTACTMAX was previously
+only read from the second byte of report 0x23.
+
+Another report (0x82) has the HID_DG_CONTACTMAX in the
+higher nibble of the third byte. We should support reading the
+value of HID_DG_CONTACTMAX no matter what report we are reading
+or which position that value is in.
+
+To do this we submit the feature report as a event report
+using hid_report_raw_event(). Our modified finger event path
+records the value of HID_DG_CONTACTMAX when it sees that usage.
+
+Fixes: 8ffffd5212846 ("HID: wacom: fix timeout on probe for some wacoms")
+Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/wacom_sys.c | 10 ++++++----
+ drivers/hid/wacom_wac.c | 4 ++++
+ 2 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
+index 2e3e03df83da..9ec895e5fd00 100644
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -314,14 +314,16 @@ static void wacom_feature_mapping(struct hid_device *hdev,
+ /* leave touch_max as is if predefined */
+ if (!features->touch_max) {
+ /* read manually */
+- data = kzalloc(2, GFP_KERNEL);
++ n = hid_report_len(field->report);
++ data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ if (!data)
+ break;
+ data[0] = field->report->id;
+ ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
+- data, 2, WAC_CMD_RETRIES);
+- if (ret == 2) {
+- features->touch_max = data[1];
++ data, n, WAC_CMD_RETRIES);
++ if (ret == n) {
++ ret = hid_report_raw_event(hdev,
++ HID_FEATURE_REPORT, data, n, 0);
+ } else {
+ features->touch_max = 16;
+ hid_warn(hdev, "wacom_feature_mapping: "
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index b764e9d72b5b..678f504239a0 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2492,6 +2492,7 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+ struct wacom *wacom = hid_get_drvdata(hdev);
+ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
+ unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
++ struct wacom_features *features = &wacom->wacom_wac.features;
+
+ switch (equivalent_usage) {
+ case HID_GD_X:
+@@ -2512,6 +2513,9 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
+ case HID_DG_TIPSWITCH:
+ wacom_wac->hid_data.tipswitch = value;
+ break;
++ case HID_DG_CONTACTMAX:
++ features->touch_max = value;
++ return;
+ }
+
+
+--
+2.16.4
+
diff --git a/patches.drivers/ath6kl-add-some-bounds-checking.patch b/patches.drivers/ath6kl-add-some-bounds-checking.patch
new file mode 100644
index 0000000000..f8cfc55857
--- /dev/null
+++ b/patches.drivers/ath6kl-add-some-bounds-checking.patch
@@ -0,0 +1,64 @@
+From 5d6751eaff672ea77642e74e92e6c0ac7f9709ab Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 4 Apr 2019 11:56:51 +0300
+Subject: [PATCH] ath6kl: add some bounds checking
+Git-commit: 5d6751eaff672ea77642e74e92e6c0ac7f9709ab
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The "ev->traffic_class" and "reply->ac" variables come from the network
+and they're used as an offset into the wmi->stream_exist_for_ac[] array.
+Those variables are u8 so they can be 0-255 but the stream_exist_for_ac[]
+array only has WMM_NUM_AC (4) elements. We need to add a couple bounds
+checks to prevent array overflows.
+
+I also modified one existing check from "if (traffic_class > 3) {" to
+"if (traffic_class >= WMM_NUM_AC) {" just to make them all consistent.
+
+Fixes: bdcd81707973 (" Add ath6kl cleaned up driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath6kl/wmi.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
+index 39925a8f5e85..2382c6c46851 100644
+--- a/drivers/net/wireless/ath/ath6kl/wmi.c
++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
+@@ -1176,6 +1176,10 @@ static int ath6kl_wmi_pstream_timeout_event_rx(struct wmi *wmi, u8 *datap,
+ return -EINVAL;
+
+ ev = (struct wmi_pstream_timeout_event *) datap;
++ if (ev->traffic_class >= WMM_NUM_AC) {
++ ath6kl_err("invalid traffic class: %d\n", ev->traffic_class);
++ return -EINVAL;
++ }
+
+ /*
+ * When the pstream (fat pipe == AC) timesout, it means there were
+@@ -1516,6 +1520,10 @@ static int ath6kl_wmi_cac_event_rx(struct wmi *wmi, u8 *datap, int len,
+ return -EINVAL;
+
+ reply = (struct wmi_cac_event *) datap;
++ if (reply->ac >= WMM_NUM_AC) {
++ ath6kl_err("invalid AC: %d\n", reply->ac);
++ return -EINVAL;
++ }
+
+ if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
+ (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) {
+@@ -2632,7 +2640,7 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
+ u16 active_tsids = 0;
+ int ret;
+
+- if (traffic_class > 3) {
++ if (traffic_class >= WMM_NUM_AC) {
+ ath6kl_err("invalid traffic class: %d\n", traffic_class);
+ return -EINVAL;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/batman-adv-fix-for-leaked-TVLV-handler.patch b/patches.drivers/batman-adv-fix-for-leaked-TVLV-handler.patch
new file mode 100644
index 0000000000..dab04996fe
--- /dev/null
+++ b/patches.drivers/batman-adv-fix-for-leaked-TVLV-handler.patch
@@ -0,0 +1,34 @@
+From 17f78dd1bd624a4dd78ed5db3284a63ee807fcc3 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Tue, 21 May 2019 20:58:57 +0100
+Subject: [PATCH] batman-adv: fix for leaked TVLV handler.
+Git-commit: 17f78dd1bd624a4dd78ed5db3284a63ee807fcc3
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+A handler for BATADV_TVLV_ROAM was being registered when the
+translation-table was initialized, but not unregistered when the
+translation-table was freed. Unregister it.
+
+Fixes: 122edaa05940 ("batman-adv: tvlv - convert roaming adv packet to use tvlv unicast packets")
+Reported-by: syzbot+d454a826e670502484b8@syzkaller.appspotmail.com
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Sven Eckelmann <sven@narfation.org
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/translation-table.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -3793,6 +3793,8 @@ static void batadv_tt_purge(struct work_
+
+ void batadv_tt_free(struct batadv_priv *bat_priv)
+ {
++ batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_ROAM, 1);
++
+ batadv_tvlv_container_unregister(bat_priv, BATADV_TVLV_TT, 1);
+ batadv_tvlv_handler_unregister(bat_priv, BATADV_TVLV_TT, 1);
+
diff --git a/patches.drivers/cpufreq-Use-struct-kobj_attribute-instead-of-struct-.patch b/patches.drivers/cpufreq-Use-struct-kobj_attribute-instead-of-struct-.patch
new file mode 100644
index 0000000000..c02f361a34
--- /dev/null
+++ b/patches.drivers/cpufreq-Use-struct-kobj_attribute-instead-of-struct-.patch
@@ -0,0 +1,192 @@
+From 625c85a62cb7d3c79f6e16de3cfa972033658250 Mon Sep 17 00:00:00 2001
+From: Viresh Kumar <viresh.kumar@linaro.org>
+Date: Fri, 25 Jan 2019 12:53:07 +0530
+Subject: [PATCH] cpufreq: Use struct kobj_attribute instead of struct global_attr
+Git-commit: 625c85a62cb7d3c79f6e16de3cfa972033658250
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+The cpufreq_global_kobject is created using kobject_create_and_add()
+helper, which assigns the kobj_type as dynamic_kobj_ktype and show/store
+routines are set to kobj_attr_show() and kobj_attr_store().
+
+These routines pass struct kobj_attribute as an argument to the
+show/store callbacks. But all the cpufreq files created using the
+cpufreq_global_kobject expect the argument to be of type struct
+attribute. Things work fine currently as no one accesses the "attr"
+argument. We may not see issues even if the argument is used, as struct
+kobj_attribute has struct attribute as its first element and so they
+will both get same address.
+
+But this is logically incorrect and we should rather use struct
+kobj_attribute instead of struct global_attr in the cpufreq core and
+drivers and the show/store callbacks should take struct kobj_attribute
+as argument instead.
+
+This bug is caught using CFI CLANG builds in android kernel which
+catches mismatch in function prototypes for such callbacks.
+
+Reported-by: Donghee Han <dh.han@samsung.com>
+Reported-by: Sangkyu Kim <skwith.kim@samsung.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/cpufreq.c | 6 +++---
+ drivers/cpufreq/intel_pstate.c | 23 ++++++++++++-----------
+ include/linux/cpufreq.h | 12 ++----------
+ 3 files changed, 17 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index a8fa684f5f90..3eff158d9750 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -545,13 +545,13 @@ EXPORT_SYMBOL_GPL(cpufreq_policy_transition_delay_us);
+ * SYSFS INTERFACE *
+ *********************************************************************/
+ static ssize_t show_boost(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ return sprintf(buf, "%d\n", cpufreq_driver->boost_enabled);
+ }
+
+-static ssize_t store_boost(struct kobject *kobj, struct attribute *attr,
+- const char *buf, size_t count)
++static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr,
++ const char *buf, size_t count)
+ {
+ int ret, enable;
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index dd66decf2087..5ab6a4fe93aa 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -895,7 +895,7 @@ static void intel_pstate_update_policies(void)
+ /************************** sysfs begin ************************/
+ #define show_one(file_name, object) \
+ static ssize_t show_##file_name \
+- (struct kobject *kobj, struct attribute *attr, char *buf) \
++ (struct kobject *kobj, struct kobj_attribute *attr, char *buf) \
+ { \
+ return sprintf(buf, "%u\n", global.object); \
+ }
+@@ -904,7 +904,7 @@ static ssize_t intel_pstate_show_status(char *buf);
+ static int intel_pstate_update_status(const char *buf, size_t size);
+
+ static ssize_t show_status(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ ssize_t ret;
+
+@@ -915,7 +915,7 @@ static ssize_t show_status(struct kobject *kobj,
+ return ret;
+ }
+
+-static ssize_t store_status(struct kobject *a, struct attribute *b,
++static ssize_t store_status(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ char *p = memchr(buf, '\n', count);
+@@ -929,7 +929,7 @@ static ssize_t store_status(struct kobject *a, struct attribute *b,
+ }
+
+ static ssize_t show_turbo_pct(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpudata *cpu;
+ int total, no_turbo, turbo_pct;
+@@ -955,7 +955,7 @@ static ssize_t show_turbo_pct(struct kobject *kobj,
+ }
+
+ static ssize_t show_num_pstates(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ struct cpudata *cpu;
+ int total;
+@@ -976,7 +976,7 @@ static ssize_t show_num_pstates(struct kobject *kobj,
+ }
+
+ static ssize_t show_no_turbo(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ ssize_t ret;
+
+@@ -998,7 +998,7 @@ static ssize_t show_no_turbo(struct kobject *kobj,
+ return ret;
+ }
+
+-static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
++static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+@@ -1045,7 +1045,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct attribute *b,
+ return count;
+ }
+
+-static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
++static ssize_t store_max_perf_pct(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+@@ -1075,7 +1075,7 @@ static ssize_t store_max_perf_pct(struct kobject *a, struct attribute *b,
+ return count;
+ }
+
+-static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
++static ssize_t store_min_perf_pct(struct kobject *a, struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+@@ -1107,12 +1107,13 @@ static ssize_t store_min_perf_pct(struct kobject *a, struct attribute *b,
+ }
+
+ static ssize_t show_hwp_dynamic_boost(struct kobject *kobj,
+- struct attribute *attr, char *buf)
++ struct kobj_attribute *attr, char *buf)
+ {
+ return sprintf(buf, "%u\n", hwp_boost);
+ }
+
+-static ssize_t store_hwp_dynamic_boost(struct kobject *a, struct attribute *b,
++static ssize_t store_hwp_dynamic_boost(struct kobject *a,
++ struct kobj_attribute *b,
+ const char *buf, size_t count)
+ {
+ unsigned int input;
+diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
+index bd7fbd6a4478..c19142911554 100644
+--- a/include/linux/cpufreq.h
++++ b/include/linux/cpufreq.h
+@@ -254,20 +254,12 @@ __ATTR(_name, 0644, show_##_name, store_##_name)
+ static struct freq_attr _name = \
+ __ATTR(_name, 0200, NULL, store_##_name)
+
+-struct global_attr {
+- struct attribute attr;
+- ssize_t (*show)(struct kobject *kobj,
+- struct attribute *attr, char *buf);
+- ssize_t (*store)(struct kobject *a, struct attribute *b,
+- const char *c, size_t count);
+-};
+-
+ #define define_one_global_ro(_name) \
+-static struct global_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0444, show_##_name, NULL)
+
+ #define define_one_global_rw(_name) \
+-static struct global_attr _name = \
++static struct kobj_attribute _name = \
+ __ATTR(_name, 0644, show_##_name, store_##_name)
+
+
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-acpi-cpufreq-Report-if-CPU-doesn-t-support-b.patch b/patches.drivers/cpufreq-acpi-cpufreq-Report-if-CPU-doesn-t-support-b.patch
new file mode 100644
index 0000000000..c0815a2881
--- /dev/null
+++ b/patches.drivers/cpufreq-acpi-cpufreq-Report-if-CPU-doesn-t-support-b.patch
@@ -0,0 +1,51 @@
+From 1222d527f314c86a3b59a522115d62facc5a7965 Mon Sep 17 00:00:00 2001
+From: Erwan Velu <erwanaliasr1@gmail.com>
+Date: Wed, 20 Feb 2019 11:10:17 +0100
+Subject: [PATCH] cpufreq: acpi-cpufreq: Report if CPU doesn't support boost technologies
+Git-commit: 1222d527f314c86a3b59a522115d62facc5a7965
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+There is some rare cases where CPB (and possibly IDA) are missing on
+processors.
+
+This is the case fixed by commit f7f3dc00f612 ("x86/cpu/AMD: Fix
+erratum 1076 (CPB bit)") and following.
+
+In such context, the boost status isn't reported by
+/sys/devices/system/cpu/cpufreq/boost.
+
+This commit is about printing a message to report that the CPU
+doesn't expose the boost capabilities.
+
+This message could help debugging platforms hit by this phenomena.
+
+Signed-off-by: Erwan Velu <e.velu@criteo.com>
+[ rjw: Change the message text somewhat ]
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/acpi-cpufreq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
+index d62fd374d5c7..c72258a44ba4 100644
+--- a/drivers/cpufreq/acpi-cpufreq.c
++++ b/drivers/cpufreq/acpi-cpufreq.c
+@@ -916,8 +916,10 @@ static void __init acpi_cpufreq_boost_init(void)
+ {
+ int ret;
+
+- if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA)))
++ if (!(boot_cpu_has(X86_FEATURE_CPB) || boot_cpu_has(X86_FEATURE_IDA))) {
++ pr_debug("Boost capabilities not present in the processor\n");
+ return;
++ }
+
+ acpi_cpufreq_driver.set_boost = set_boost;
+ acpi_cpufreq_driver.boost_enabled = boost_state(0);
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-initial-command-chec.patch b/patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-initial-command-chec.patch
new file mode 100644
index 0000000000..1c5412a432
--- /dev/null
+++ b/patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-initial-command-chec.patch
@@ -0,0 +1,40 @@
+From 22a26cc6a51ef73dcfeb64c50513903f6b2d53d8 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Wed, 22 May 2019 11:45:46 -0700
+Subject: [PATCH] cpufreq: brcmstb-avs-cpufreq: Fix initial command check
+Git-commit: 22a26cc6a51ef73dcfeb64c50513903f6b2d53d8
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+There is a logical error in brcm_avs_is_firmware_loaded() whereby if the
+firmware returns -EINVAL, we will be reporting this as an error. The
+comment is correct, the code was not.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index e6f9cbe5835f..6ed53ca8aa98 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -446,8 +446,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv)
+ rc = brcm_avs_get_pmap(priv, NULL);
+ magic = readl(priv->base + AVS_MBOX_MAGIC);
+
+- return (magic == AVS_FIRMWARE_MAGIC) && (rc != -ENOTSUPP) &&
+- (rc != -EINVAL);
++ return (magic == AVS_FIRMWARE_MAGIC) && ((rc != -ENOTSUPP) ||
++ (rc != -EINVAL));
+ }
+
+ static unsigned int brcm_avs_cpufreq_get(unsigned int cpu)
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-types-for-voltage-fr.patch b/patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-types-for-voltage-fr.patch
new file mode 100644
index 0000000000..01c2e60678
--- /dev/null
+++ b/patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-types-for-voltage-fr.patch
@@ -0,0 +1,61 @@
+From 4c5681fcc684c762b09435de3e82ffeee7769d21 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Wed, 22 May 2019 11:45:47 -0700
+Subject: [PATCH] cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency
+Git-commit: 4c5681fcc684c762b09435de3e82ffeee7769d21
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+What we read back from the register is going to be capped at 32-bits,
+and cpufreq_freq_table.frequency is an unsigned int. Avoid any possible
+value truncation by using the appropriate return value.
+
+Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Markus Mayer <mmayer@broadcom.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/brcmstb-avs-cpufreq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+index 6ed53ca8aa98..77b0e5d0fb13 100644
+--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
+@@ -384,12 +384,12 @@ static int brcm_avs_set_pstate(struct private_data *priv, unsigned int pstate)
+ return __issue_avs_command(priv, AVS_CMD_SET_PSTATE, true, args);
+ }
+
+-static unsigned long brcm_avs_get_voltage(void __iomem *base)
++static u32 brcm_avs_get_voltage(void __iomem *base)
+ {
+ return readl(base + AVS_MBOX_VOLTAGE1);
+ }
+
+-static unsigned long brcm_avs_get_frequency(void __iomem *base)
++static u32 brcm_avs_get_frequency(void __iomem *base)
+ {
+ return readl(base + AVS_MBOX_FREQUENCY) * 1000; /* in kHz */
+ }
+@@ -653,14 +653,14 @@ static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf)
+ {
+ struct private_data *priv = policy->driver_data;
+
+- return sprintf(buf, "0x%08lx\n", brcm_avs_get_voltage(priv->base));
++ return sprintf(buf, "0x%08x\n", brcm_avs_get_voltage(priv->base));
+ }
+
+ static ssize_t show_brcm_avs_frequency(struct cpufreq_policy *policy, char *buf)
+ {
+ struct private_data *priv = policy->driver_data;
+
+- return sprintf(buf, "0x%08lx\n", brcm_avs_get_frequency(priv->base));
++ return sprintf(buf, "0x%08x\n", brcm_avs_get_frequency(priv->base));
+ }
+
+ cpufreq_freq_attr_ro(brcm_avs_pstate);
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch b/patches.drivers/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch
new file mode 100644
index 0000000000..6c843f6300
--- /dev/null
+++ b/patches.drivers/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch
@@ -0,0 +1,98 @@
+From 2f66196208c98b3d1b4294edffb2c5a8197be899 Mon Sep 17 00:00:00 2001
+From: Sudeep Holla <sudeep.holla@arm.com>
+Date: Mon, 7 Jan 2019 18:51:53 +0000
+Subject: [PATCH] cpufreq: check if policy is inactive early in __cpufreq_get()
+Git-commit: 2f66196208c98b3d1b4294edffb2c5a8197be899
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+cpuinfo_cur_freq gets current CPU frequency as detected by hardware
+while scaling_cur_freq last known CPU frequency. Some platforms may not
+allow checking the CPU frequency of an offline CPU or the associated
+resources may have been released via cpufreq_exit when the CPU gets
+offlined, in which case the policy would have been invalidated already.
+If we attempt to get current frequency from the hardware, it may result
+in hang or crash.
+
+For example on Juno, I see:
+
+Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188
+[0000000000000188] pgd=0000000000000000
+Internal error: Oops: 96000004 [#1] PREEMPT SMP
+Modules linked in:
+Cpu: 5 PID: 4202 Comm: cat Not tainted 4.20.0-08251-ga0f2c0318a15-dirty #87
+Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform
+Pstate: 40000005 (nZcv daif -PAN -UAO)
+pc : scmi_cpufreq_get_rate+0x34/0xb0
+lr : scmi_cpufreq_get_rate+0x34/0xb0
+Call trace:
+ scmi_cpufreq_get_rate+0x34/0xb0
+ __cpufreq_get+0x34/0xc0
+ show_cpuinfo_cur_freq+0x24/0x78
+ show+0x40/0x60
+ sysfs_kf_seq_show+0xc0/0x148
+ kernfs_seq_show+0x44/0x50
+ seq_read+0xd4/0x480
+ kernfs_fop_read+0x15c/0x208
+ __vfs_read+0x60/0x188
+ vfs_read+0x94/0x150
+ ksys_read+0x6c/0xd8
+ __arm64_sys_read+0x24/0x30
+ el0_svc_common+0x78/0x100
+ el0_svc_handler+0x38/0x78
+ el0_svc+0x8/0xc
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---[ end trace 3d1024e58f77f6b2 ]---
+
+So fix the issue by checking if the policy is invalid early in
+__cpufreq_get before attempting to get the current frequency.
+
+Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+---
+ drivers/cpufreq/cpufreq.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 7aa3dcad2175..df34a12a388f 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1530,17 +1530,16 @@ static unsigned int __cpufreq_get(struct cpufreq_policy *policy)
+ {
+ unsigned int ret_freq = 0;
+
+- if (!cpufreq_driver->get)
++ if (unlikely(policy_is_inactive(policy)) || !cpufreq_driver->get)
+ return ret_freq;
+
+ ret_freq = cpufreq_driver->get(policy->cpu);
+
+ /*
+- * Updating inactive policies is invalid, so avoid doing that. Also
+- * if fast frequency switching is used with the given policy, the check
++ * If fast frequency switching is used with the given policy, the check
+ * against policy->cur is pointless, so skip it in that case too.
+ */
+- if (unlikely(policy_is_inactive(policy)) || policy->fast_switch_enabled)
++ if (policy->fast_switch_enabled)
+ return ret_freq;
+
+ if (ret_freq && policy->cur &&
+@@ -1569,10 +1568,7 @@ unsigned int cpufreq_get(unsigned int cpu)
+
+ if (policy) {
+ down_read(&policy->rwsem);
+-
+- if (!policy_is_inactive(policy))
+- ret_freq = __cpufreq_get(policy);
+-
++ ret_freq = __cpufreq_get(policy);
+ up_read(&policy->rwsem);
+
+ cpufreq_cpu_put(policy);
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-kirkwood-fix-possible-object-reference-leak.patch b/patches.drivers/cpufreq-kirkwood-fix-possible-object-reference-leak.patch
new file mode 100644
index 0000000000..488c1d9019
--- /dev/null
+++ b/patches.drivers/cpufreq-kirkwood-fix-possible-object-reference-leak.patch
@@ -0,0 +1,87 @@
+From 7c468966f05ac9c17bb5948275283d34e6fe0660 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Mon, 1 Apr 2019 09:37:50 +0800
+Subject: [PATCH] cpufreq: kirkwood: fix possible object reference leak
+Git-commit: 7c468966f05ac9c17bb5948275283d34e6fe0660
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call to of_get_child_by_name returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+./drivers/cpufreq/kirkwood-cpufreq.c:127:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 118, but without a corresponding object release within this function.
+./drivers/cpufreq/kirkwood-cpufreq.c:133:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 118, but without a corresponding object release within this function.
+
+and also do some cleanup:
+- of_node_put(np);
+- np = NULL;
+...
+of_node_put(np);
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/kirkwood-cpufreq.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/cpufreq/kirkwood-cpufreq.c b/drivers/cpufreq/kirkwood-cpufreq.c
+index c2dd43f3f5d8..8d63a6dc8383 100644
+--- a/drivers/cpufreq/kirkwood-cpufreq.c
++++ b/drivers/cpufreq/kirkwood-cpufreq.c
+@@ -124,13 +124,14 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
+ priv.cpu_clk = of_clk_get_by_name(np, "cpu_clk");
+ if (IS_ERR(priv.cpu_clk)) {
+ dev_err(priv.dev, "Unable to get cpuclk\n");
+- return PTR_ERR(priv.cpu_clk);
++ err = PTR_ERR(priv.cpu_clk);
++ goto out_node;
+ }
+
+ err = clk_prepare_enable(priv.cpu_clk);
+ if (err) {
+ dev_err(priv.dev, "Unable to prepare cpuclk\n");
+- return err;
++ goto out_node;
+ }
+
+ kirkwood_freq_table[0].frequency = clk_get_rate(priv.cpu_clk) / 1000;
+@@ -161,20 +162,22 @@ static int kirkwood_cpufreq_probe(struct platform_device *pdev)
+ goto out_ddr;
+ }
+
+- of_node_put(np);
+- np = NULL;
+-
+ err = cpufreq_register_driver(&kirkwood_cpufreq_driver);
+- if (!err)
+- return 0;
++ if (err) {
++ dev_err(priv.dev, "Failed to register cpufreq driver\n");
++ goto out_powersave;
++ }
+
+- dev_err(priv.dev, "Failed to register cpufreq driver\n");
++ of_node_put(np);
++ return 0;
+
++out_powersave:
+ clk_disable_unprepare(priv.powersave_clk);
+ out_ddr:
+ clk_disable_unprepare(priv.ddr_clk);
+ out_cpu:
+ clk_disable_unprepare(priv.cpu_clk);
++out_node:
+ of_node_put(np);
+
+ return err;
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-pasemi-fix-possible-object-reference-leak.patch b/patches.drivers/cpufreq-pasemi-fix-possible-object-reference-leak.patch
new file mode 100644
index 0000000000..e615d7a998
--- /dev/null
+++ b/patches.drivers/cpufreq-pasemi-fix-possible-object-reference-leak.patch
@@ -0,0 +1,44 @@
+From a9acc26b75f652f697e02a9febe2ab0da648a571 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Mon, 1 Apr 2019 09:37:52 +0800
+Subject: [PATCH] cpufreq/pasemi: fix possible object reference leak
+Git-commit: a9acc26b75f652f697e02a9febe2ab0da648a571
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call to of_get_cpu_node returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+./drivers/cpufreq/pasemi-cpufreq.c:212:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 147, but without a corresponding object release within this function.
+./drivers/cpufreq/pasemi-cpufreq.c:220:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 147, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/pasemi-cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/pasemi-cpufreq.c b/drivers/cpufreq/pasemi-cpufreq.c
+index 75dfbd2a58ea..c7710c149de8 100644
+--- a/drivers/cpufreq/pasemi-cpufreq.c
++++ b/drivers/cpufreq/pasemi-cpufreq.c
+@@ -146,6 +146,7 @@ static int pas_cpufreq_cpu_init(struct cpufreq_policy *policy)
+
+ cpu = of_get_cpu_node(policy->cpu, NULL);
+
++ of_node_put(cpu);
+ if (!cpu)
+ goto out;
+
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-pmac32-fix-possible-object-reference-leak.patch b/patches.drivers/cpufreq-pmac32-fix-possible-object-reference-leak.patch
new file mode 100644
index 0000000000..ddae6ef074
--- /dev/null
+++ b/patches.drivers/cpufreq-pmac32-fix-possible-object-reference-leak.patch
@@ -0,0 +1,56 @@
+From 8d10dc28a9ea6e8c02e825dab28699f3c72b02d9 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Mon, 1 Apr 2019 09:37:53 +0800
+Subject: [PATCH] cpufreq: pmac32: fix possible object reference leak
+Git-commit: 8d10dc28a9ea6e8c02e825dab28699f3c72b02d9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call to of_find_node_by_name returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+./drivers/cpufreq/pmac32-cpufreq.c:557:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 552, but without a corresponding object release within this function.
+./drivers/cpufreq/pmac32-cpufreq.c:569:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 552, but without a corresponding object release within this function.
+./drivers/cpufreq/pmac32-cpufreq.c:598:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 587, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linux-pm@vger.kernel.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/pmac32-cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/cpufreq/pmac32-cpufreq.c b/drivers/cpufreq/pmac32-cpufreq.c
+index 52f0d91d30c1..9b4ce2eb8222 100644
+--- a/drivers/cpufreq/pmac32-cpufreq.c
++++ b/drivers/cpufreq/pmac32-cpufreq.c
+@@ -552,6 +552,7 @@ static int pmac_cpufreq_init_7447A(struct device_node *cpunode)
+ volt_gpio_np = of_find_node_by_name(NULL, "cpu-vcore-select");
+ if (volt_gpio_np)
+ voltage_gpio = read_gpio(volt_gpio_np);
++ of_node_put(volt_gpio_np);
+ if (!voltage_gpio){
+ pr_err("missing cpu-vcore-select gpio\n");
+ return 1;
+@@ -588,6 +589,7 @@ static int pmac_cpufreq_init_750FX(struct device_node *cpunode)
+ if (volt_gpio_np)
+ voltage_gpio = read_gpio(volt_gpio_np);
+
++ of_node_put(volt_gpio_np);
+ pvr = mfspr(SPRN_PVR);
+ has_cpu_l2lve = !((pvr & 0xf00) == 0x100);
+
+--
+2.16.4
+
diff --git a/patches.drivers/cpufreq-ppc_cbe-fix-possible-object-reference-leak.patch b/patches.drivers/cpufreq-ppc_cbe-fix-possible-object-reference-leak.patch
new file mode 100644
index 0000000000..9849b62227
--- /dev/null
+++ b/patches.drivers/cpufreq-ppc_cbe-fix-possible-object-reference-leak.patch
@@ -0,0 +1,43 @@
+From 233298032803f2802fe99892d0de4ab653bfece4 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Mon, 1 Apr 2019 09:37:54 +0800
+Subject: [PATCH] cpufreq: ppc_cbe: fix possible object reference leak
+Git-commit: 233298032803f2802fe99892d0de4ab653bfece4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call to of_get_cpu_node returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+./drivers/cpufreq/ppc_cbe_cpufreq.c:89:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 76, but without a corresponding object release within this function.
+./drivers/cpufreq/ppc_cbe_cpufreq.c:89:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 76, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
+Cc: Viresh Kumar <viresh.kumar@linaro.org>
+Cc: linux-pm@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cpufreq/ppc_cbe_cpufreq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/cpufreq/ppc_cbe_cpufreq.c b/drivers/cpufreq/ppc_cbe_cpufreq.c
+index 41a0f0be3f9f..8414c3a4ea08 100644
+--- a/drivers/cpufreq/ppc_cbe_cpufreq.c
++++ b/drivers/cpufreq/ppc_cbe_cpufreq.c
+@@ -86,6 +86,7 @@ static int cbe_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ if (!cbe_get_cpu_pmd_regs(policy->cpu) ||
+ !cbe_get_cpu_mic_tm_regs(policy->cpu)) {
+ pr_info("invalid CBE regs pointers for cpufreq\n");
++ of_node_put(cpu);
+ return -EINVAL;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/intel_th-msu-Fix-single-mode-with-disabled-IOMMU.patch b/patches.drivers/intel_th-msu-Fix-single-mode-with-disabled-IOMMU.patch
new file mode 100644
index 0000000000..567322f9cd
--- /dev/null
+++ b/patches.drivers/intel_th-msu-Fix-single-mode-with-disabled-IOMMU.patch
@@ -0,0 +1,45 @@
+From 918b8646497b5dba6ae82d4a7325f01b258972b9 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 21 Jun 2019 19:19:29 +0300
+Subject: [PATCH] intel_th: msu: Fix single mode with disabled IOMMU
+Git-commit: 918b8646497b5dba6ae82d4a7325f01b258972b9
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Commit 4e0eaf239fb3 ("intel_th: msu: Fix single mode with IOMMU") switched
+the single mode code to use dma mapping pages obtained from the page
+allocator, but with IOMMU disabled, that may lead to using SWIOTLB bounce
+buffers and without additional sync'ing, produces empty trace buffers.
+
+Fix this by using a DMA32 GFP flag to the page allocation in single mode,
+as the device supports full 32-bit DMA addressing.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: 4e0eaf239fb3 ("intel_th: msu: Fix single mode with IOMMU")
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reported-by: Ammy Yi <ammy.yi@intel.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20190621161930.60785-4-alexander.shishkin@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/intel_th/msu.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index 6bfce03c6489..cfd48c81b9d9 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -667,7 +667,7 @@ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ goto err_out;
+
+ ret = -ENOMEM;
+- page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
++ page = alloc_pages(GFP_KERNEL | __GFP_ZERO | GFP_DMA32, order);
+ if (!page)
+ goto err_free_sgt;
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-marvell-ccic-fix-DMA-s-g-desc-number-calculati.patch b/patches.drivers/media-marvell-ccic-fix-DMA-s-g-desc-number-calculati.patch
new file mode 100644
index 0000000000..b642d7e7f0
--- /dev/null
+++ b/patches.drivers/media-marvell-ccic-fix-DMA-s-g-desc-number-calculati.patch
@@ -0,0 +1,66 @@
+From 0c7aa32966dab0b8a7424e1b34c7f206817953ec Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Sun, 5 May 2019 10:00:23 -0400
+Subject: [PATCH] media: marvell-ccic: fix DMA s/g desc number calculation
+Git-commit: 0c7aa32966dab0b8a7424e1b34c7f206817953ec
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The commit d790b7eda953 ("[media] vb2-dma-sg: move dma_(un)map_sg here")
+left dma_desc_nent unset. It previously contained the number of DMA
+descriptors as returned from dma_map_sg().
+
+We can now (since the commit referred to above) obtain the same value from
+the sg_table and drop dma_desc_nent altogether.
+
+Tested on OLPC XO-1.75 machine. Doesn't affect the OLPC XO-1's Cafe
+driver, since that one doesn't do DMA.
+
+[mchehab+samsung@kernel.org: fix a checkpatch warning]
+
+Fixes: d790b7eda953 ("[media] vb2-dma-sg: move dma_(un)map_sg here")
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/marvell-ccic/mcam-core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c
+index f1b301810260..0a6411b877e9 100644
+--- a/drivers/media/platform/marvell-ccic/mcam-core.c
++++ b/drivers/media/platform/marvell-ccic/mcam-core.c
+@@ -200,7 +200,6 @@ struct mcam_vb_buffer {
+ struct list_head queue;
+ struct mcam_dma_desc *dma_desc; /* Descriptor virtual address */
+ dma_addr_t dma_desc_pa; /* Descriptor physical address */
+- int dma_desc_nent; /* Number of mapped descriptors */
+ };
+
+ static inline struct mcam_vb_buffer *vb_to_mvb(struct vb2_v4l2_buffer *vb)
+@@ -608,9 +607,11 @@ static void mcam_dma_contig_done(struct mcam_camera *cam, int frame)
+ static void mcam_sg_next_buffer(struct mcam_camera *cam)
+ {
+ struct mcam_vb_buffer *buf;
++ struct sg_table *sg_table;
+
+ buf = list_first_entry(&cam->buffers, struct mcam_vb_buffer, queue);
+ list_del_init(&buf->queue);
++ sg_table = vb2_dma_sg_plane_desc(&buf->vb_buf.vb2_buf, 0);
+ /*
+ * Very Bad Not Good Things happen if you don't clear
+ * C1_DESC_ENA before making any descriptor changes.
+@@ -618,7 +619,7 @@ static void mcam_sg_next_buffer(struct mcam_camera *cam)
+ mcam_reg_clear_bit(cam, REG_CTRL1, C1_DESC_ENA);
+ mcam_reg_write(cam, REG_DMA_DESC_Y, buf->dma_desc_pa);
+ mcam_reg_write(cam, REG_DESC_LEN_Y,
+- buf->dma_desc_nent*sizeof(struct mcam_dma_desc));
++ sg_table->nents * sizeof(struct mcam_dma_desc));
+ mcam_reg_write(cam, REG_DESC_LEN_U, 0);
+ mcam_reg_write(cam, REG_DESC_LEN_V, 0);
+ mcam_reg_set_bit(cam, REG_CTRL1, C1_DESC_ENA);
+--
+2.16.4
+
diff --git a/patches.drivers/media-s5p-mfc-Make-additional-clocks-optional.patch b/patches.drivers/media-s5p-mfc-Make-additional-clocks-optional.patch
new file mode 100644
index 0000000000..83f49c5de9
--- /dev/null
+++ b/patches.drivers/media-s5p-mfc-Make-additional-clocks-optional.patch
@@ -0,0 +1,46 @@
+From e08efef8fe7db87206314c19b341612c719f891a Mon Sep 17 00:00:00 2001
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+Date: Thu, 13 Jun 2019 06:48:34 -0400
+Subject: [PATCH] media: s5p-mfc: Make additional clocks optional
+Git-commit: e08efef8fe7db87206314c19b341612c719f891a
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Since the beginning the second clock ('special', 'sclk') was optional and
+it is not available on some variants of Exynos SoCs (i.e. Exynos5420 with
+v7 of MFC hardware).
+
+However commit 1bce6fb3edf1 ("[media] s5p-mfc: Rework clock handling")
+made handling of all specified clocks mandatory. This patch restores
+original behavior of the driver and fixes its operation on
+Exynos5420 SoCs.
+
+Fixes: 1bce6fb3edf1 ("[media] s5p-mfc: Rework clock handling")
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+index 2e62f8721fa5..7d52431c2c83 100644
+--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
+@@ -34,6 +34,11 @@ int s5p_mfc_init_pm(struct s5p_mfc_dev *dev)
+ for (i = 0; i < pm->num_clocks; i++) {
+ pm->clocks[i] = devm_clk_get(pm->device, pm->clk_names[i]);
+ if (IS_ERR(pm->clocks[i])) {
++ /* additional clocks are optional */
++ if (i && PTR_ERR(pm->clocks[i]) == -ENOENT) {
++ pm->clocks[i] = NULL;
++ continue;
++ }
+ mfc_err("Failed to get clock: %s\n",
+ pm->clk_names[i]);
+ return PTR_ERR(pm->clocks[i]);
+--
+2.16.4
+
diff --git a/patches.drivers/media-v4l2-Test-type-instead-of-cfg-type-in-v4l2_ctr.patch b/patches.drivers/media-v4l2-Test-type-instead-of-cfg-type-in-v4l2_ctr.patch
new file mode 100644
index 0000000000..7a2dda0d95
--- /dev/null
+++ b/patches.drivers/media-v4l2-Test-type-instead-of-cfg-type-in-v4l2_ctr.patch
@@ -0,0 +1,51 @@
+From 07d89227a983df957a6a7c56f7c040cde9ac571f Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <boris.brezillon@collabora.com>
+Date: Wed, 19 Jun 2019 05:21:33 -0400
+Subject: [PATCH] media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
+Git-commit: 07d89227a983df957a6a7c56f7c040cde9ac571f
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+cfg->type can be overridden by v4l2_ctrl_fill() and the new value is
+stored in the local type var. Fix the tests to use this local var.
+
+Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
+[hverkuil-cisco@xs4all.nl: change to !qmenu and !qmenu_int (checkpatch)]
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/v4l2-core/v4l2-ctrls.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index 29b86d7448dc..371537dd8cd3 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -2464,16 +2464,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(struct v4l2_ctrl_handler *hdl,
+ v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step,
+ &def, &flags);
+
+- is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU ||
+- cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU);
++ is_menu = (type == V4L2_CTRL_TYPE_MENU ||
++ type == V4L2_CTRL_TYPE_INTEGER_MENU);
+ if (is_menu)
+ WARN_ON(step);
+ else
+ WARN_ON(cfg->menu_skip_mask);
+- if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL)
++ if (type == V4L2_CTRL_TYPE_MENU && !qmenu) {
+ qmenu = v4l2_ctrl_get_menu(cfg->id);
+- else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU &&
+- qmenu_int == NULL) {
++ } else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) {
+ handler_set_err(hdl, -EINVAL);
+ return NULL;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/media-vivid-fix-incorrect-assignment-operation-when-.patch b/patches.drivers/media-vivid-fix-incorrect-assignment-operation-when-.patch
new file mode 100644
index 0000000000..60d1aef98b
--- /dev/null
+++ b/patches.drivers/media-vivid-fix-incorrect-assignment-operation-when-.patch
@@ -0,0 +1,41 @@
+From d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 4 Jun 2019 10:55:15 -0400
+Subject: [PATCH] media: vivid: fix incorrect assignment operation when setting video mode
+Git-commit: d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a
+bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment,
+otherwise the previous clearing of the FB_VMODE_MASK bits of
+var->vmode makes no sense and is redundant.
+
+Addresses-coverity: ("Unused value")
+Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/vivid/vivid-osd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c
+index 1a89593b0c86..f2e789bdf4a6 100644
+--- a/drivers/media/platform/vivid/vivid-osd.c
++++ b/drivers/media/platform/vivid/vivid-osd.c
+@@ -155,7 +155,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev *
+ var->nonstd = 0;
+
+ var->vmode &= ~FB_VMODE_MASK;
+- var->vmode = FB_VMODE_NONINTERLACED;
++ var->vmode |= FB_VMODE_NONINTERLACED;
+
+ /* Dummy values */
+ var->hsync_len = 24;
+--
+2.16.4
+
diff --git a/patches.drivers/memstick-Fix-error-cleanup-path-of-memstick_init.patch b/patches.drivers/memstick-Fix-error-cleanup-path-of-memstick_init.patch
new file mode 100644
index 0000000000..e27e3e277a
--- /dev/null
+++ b/patches.drivers/memstick-Fix-error-cleanup-path-of-memstick_init.patch
@@ -0,0 +1,77 @@
+From 65f1a0d39c289bb6fc85635528cd36c4b07f560e Mon Sep 17 00:00:00 2001
+From: Wang Hai <wanghai26@huawei.com>
+Date: Wed, 15 May 2019 22:37:25 +0800
+Subject: [PATCH] memstick: Fix error cleanup path of memstick_init
+Git-commit: 65f1a0d39c289bb6fc85635528cd36c4b07f560e
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+If bus_register fails. On its error handling path, it has cleaned up
+what it has done. There is no need to call bus_unregister again.
+Otherwise, if bus_unregister is called, issues such as null-ptr-deref
+will arise.
+
+Syzkaller report this:
+
+kobject_add_internal failed for memstick (error: -12 parent: bus)
+Bug: KASAN: null-ptr-deref in sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
+Read of size 8 at addr 0000000000000078 by task syz-executor.0/4460
+
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xa9/0x10e lib/dump_stack.c:113
+ __kasan_report+0x171/0x18d mm/kasan/report.c:321
+ kasan_report+0xe/0x20 mm/kasan/common.c:614
+ sysfs_remove_file_ns+0x1b/0x40 fs/sysfs/file.c:467
+ sysfs_remove_file include/linux/sysfs.h:519 [inline]
+ bus_remove_file+0x6c/0x90 drivers/base/bus.c:145
+ remove_probe_files drivers/base/bus.c:599 [inline]
+ bus_unregister+0x6e/0x100 drivers/base/bus.c:916 ? 0xffffffffc1590000
+ memstick_init+0x7a/0x1000 [memstick]
+ do_one_initcall+0xb9/0x3b5 init/main.c:914
+ do_init_module+0xe0/0x330 kernel/module.c:3468
+ load_module+0x38eb/0x4270 kernel/module.c:3819
+ __do_sys_finit_module+0x162/0x190 kernel/module.c:3909
+ do_syscall_64+0x72/0x2a0 arch/x86/entry/common.c:298
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Fixes: baf8532a147d ("memstick: initial commit for Sony MemoryStick support")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wang Hai <wanghai26@huawei.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/memstick/core/memstick.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
+index 1246d69ba187..b1564cacd19e 100644
+--- a/drivers/memstick/core/memstick.c
++++ b/drivers/memstick/core/memstick.c
+@@ -629,13 +629,18 @@ static int __init memstick_init(void)
+ return -ENOMEM;
+
+ rc = bus_register(&memstick_bus_type);
+- if (!rc)
+- rc = class_register(&memstick_host_class);
++ if (rc)
++ goto error_destroy_workqueue;
+
+- if (!rc)
+- return 0;
++ rc = class_register(&memstick_host_class);
++ if (rc)
++ goto error_bus_unregister;
++
++ return 0;
+
++error_bus_unregister:
+ bus_unregister(&memstick_bus_type);
++error_destroy_workqueue:
+ destroy_workqueue(workqueue);
+
+ return rc;
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-sdhci-pci-Try-cd-for-card-detect-lookup-before-u.patch b/patches.drivers/mmc-sdhci-pci-Try-cd-for-card-detect-lookup-before-u.patch
new file mode 100644
index 0000000000..dc679c2d62
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-pci-Try-cd-for-card-detect-lookup-before-u.patch
@@ -0,0 +1,95 @@
+From cdcefe6bd9df754f528ffc339d3cc143cea4ddf6 Mon Sep 17 00:00:00 2001
+From: Rajat Jain <rajatja@google.com>
+Date: Mon, 29 Oct 2018 15:17:01 -0700
+Subject: [PATCH] mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
+Git-commit: cdcefe6bd9df754f528ffc339d3cc143cea4ddf6
+Patch-mainline: v4.20-rc4
+References: bsc#1051510
+
+Problem:
+
+The card detect IRQ does not work with modern BIOS (that want
+to use _DSD to provide the card detect GPIO to the driver).
+
+Details:
+
+The mmc core provides the mmc_gpiod_request_cd() API to let host drivers
+request the gpio descriptor for the "card detect" pin.
+This pin is specified in the ACPI for the SDHC device:
+
+ * Either as a resource using _CRS. This is a method used by legacy BIOS.
+ (The driver needs to tell which resource index).
+
+ * Or as a named property ("cd-gpios"/"cd-gpio") in _DSD (which internally
+ points to an entry in _CRS). This way, the driver can lookup using a
+ string. This is what modern BIOS prefer to use.
+
+This API finally results in a call to the following code:
+
+struct gpio_desc *acpi_find_gpio(..., const char *con_id,...)
+{
+...
+ /* Lookup gpio (using "<con_id>-gpio") in the _DSD */
+...
+ if (!acpi_can_fallback_to_crs(adev, con_id))
+ return ERR_PTR(-ENOENT);
+...
+ /* Falling back to _CRS is allowed, Lookup gpio in the _CRS */
+...
+}
+
+Note that this means that if the ACPI has _DSD properties, the kernel
+will never use _CRS for the lookup (Because acpi_can_fallback_to_crs()
+will always be false for any device hat has _DSD entries).
+
+The SDHCI driver is thus currently broken on a modern BIOS, even if
+BIOS provides both _CRS (for index based lookup) and _DSD entries (for
+string based lookup). Ironically, none of these will be used for the
+lookup currently because:
+
+* Since the con_id is NULL, acpi_find_gpio() does not find a matching
+ entry in DSDT. (The _DSDT entry has the property name = "cd-gpios")
+
+* Because ACPI contains DSDT entries, thus acpi_can_fallback_to_crs()
+ returns false (because device properties have been populated from
+ _DSD), thus the _CRS is never used for the lookup.
+
+Fix:
+
+Try "cd" for lookup in the _DSD before falling back to using NULL so
+as to try looking up in the _CRS.
+
+I've tested this patch successfully with both Legacy BIOS (that
+provide only _CRS method) as well as modern BIOS (that provide both
+_CRS and _DSD). Also the use of "cd" appears to be fairly consistent
+across other users of this API (other MMC host controller drivers).
+
+Link: https://lkml.org/lkml/2018/9/25/1113
+Signed-off-by: Rajat Jain <rajatja@google.com>
+Acked-by: Adrian Hunter <adrian.hunter@intel.com>
+Fixes: f10e4bf6632b ("gpio: acpi: Even more tighten up ACPI GPIO lookups")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci-pci-core.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -1613,8 +1613,13 @@ static struct sdhci_pci_slot *sdhci_pci_
+ host->mmc->caps2 |= MMC_CAP2_NO_PRESCAN_POWERUP;
+
+ if (slot->cd_idx >= 0) {
+- ret = mmc_gpiod_request_cd(host->mmc, NULL, slot->cd_idx,
++ ret = mmc_gpiod_request_cd(host->mmc, "cd", slot->cd_idx,
+ slot->cd_override_level, 0, NULL);
++ if (ret && ret != -EPROBE_DEFER)
++ ret = mmc_gpiod_request_cd(host->mmc, NULL,
++ slot->cd_idx,
++ slot->cd_override_level,
++ 0, NULL);
+ if (ret == -EPROBE_DEFER)
+ goto remove;
+
diff --git a/patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch b/patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch
new file mode 100644
index 0000000000..6dceb1bf36
--- /dev/null
+++ b/patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch
@@ -0,0 +1,43 @@
+From 9452fbf5c6cf5f470e0748fe7a14a683e7765f7a Mon Sep 17 00:00:00 2001
+From: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+Date: Tue, 18 Jun 2019 15:31:02 +0200
+Subject: [PATCH] platform/x86: pmc_atom: Add CB4063 Beckhoff Automation board to critclk_systems DMI table
+Git-commit: 9452fbf5c6cf5f470e0748fe7a14a683e7765f7a
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The CB4063 board uses pmc_plt_clk* clocks for ethernet controllers. This
+adds it to the critclk_systems DMI table so the clocks are marked as
+CLK_CRITICAL and not turned off.
+
+Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/pmc_atom.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c
+index 2104e1ad38d9..005634c11ebe 100644
+--- a/drivers/platform/x86/pmc_atom.c
++++ b/drivers/platform/x86/pmc_atom.c
+@@ -400,6 +400,14 @@ static const struct dmi_system_id critclk_systems[] = {
+ DMI_MATCH(DMI_BOARD_NAME, "CB3163"),
+ },
+ },
++ {
++ /* pmc_plt_clk* - are used for ethernet controllers */
++ .ident = "Beckhoff CB4063",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Beckhoff Automation"),
++ DMI_MATCH(DMI_BOARD_NAME, "CB4063"),
++ },
++ },
+ {
+ /* pmc_plt_clk* - are used for ethernet controllers */
+ .ident = "Beckhoff CB6263",
+--
+2.16.4
+
diff --git a/patches.drivers/staging-comedi-amplc_pci230-fix-null-pointer-deref-o.patch b/patches.drivers/staging-comedi-amplc_pci230-fix-null-pointer-deref-o.patch
new file mode 100644
index 0000000000..91ea5d830d
--- /dev/null
+++ b/patches.drivers/staging-comedi-amplc_pci230-fix-null-pointer-deref-o.patch
@@ -0,0 +1,50 @@
+From 7379e6baeddf580d01feca650ec1ad508b6ea8ee Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Wed, 26 Jun 2019 14:17:39 +0100
+Subject: [PATCH] staging: comedi: amplc_pci230: fix null pointer deref on interrupt
+Git-commit: 7379e6baeddf580d01feca650ec1ad508b6ea8ee
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The interrupt handler `pci230_interrupt()` causes a null pointer
+dereference for a PCI260 card. There is no analog output subdevice for
+a PCI260. The `dev->write_subdev` subdevice pointer and therefore the
+`s_ao` subdevice pointer variable will be `NULL` for a PCI260. The
+following call near the end of the interrupt handler results in the null
+pointer dereference for a PCI260:
+
+ comedi_handle_events(dev, s_ao);
+
+Fix it by only calling the above function if `s_ao` is valid.
+
+Note that the other uses of `s_ao` in the calls
+`pci230_handle_ao_nofifo(dev, s_ao);` and `pci230_handle_ao_fifo(dev,
+s_ao);` will never be reached for a PCI260, so they are safe.
+
+Fixes: 39064f23284c ("staging: comedi: amplc_pci230: use comedi_handle_events()")
+Cc: <stable@vger.kernel.org> # v3.19+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/comedi/drivers/amplc_pci230.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/comedi/drivers/amplc_pci230.c b/drivers/staging/comedi/drivers/amplc_pci230.c
+index 65f60c2b702a..f7e673121864 100644
+--- a/drivers/staging/comedi/drivers/amplc_pci230.c
++++ b/drivers/staging/comedi/drivers/amplc_pci230.c
+@@ -2330,7 +2330,8 @@ static irqreturn_t pci230_interrupt(int irq, void *d)
+ devpriv->intr_running = false;
+ spin_unlock_irqrestore(&devpriv->isr_spinlock, irqflags);
+
+- comedi_handle_events(dev, s_ao);
++ if (s_ao)
++ comedi_handle_events(dev, s_ao);
+ comedi_handle_events(dev, s_ai);
+
+ return IRQ_HANDLED;
+--
+2.16.4
+
diff --git a/patches.drivers/staging-comedi-dt282x-fix-a-null-pointer-deref-on-in.patch b/patches.drivers/staging-comedi-dt282x-fix-a-null-pointer-deref-on-in.patch
new file mode 100644
index 0000000000..b36f554f9c
--- /dev/null
+++ b/patches.drivers/staging-comedi-dt282x-fix-a-null-pointer-deref-on-in.patch
@@ -0,0 +1,55 @@
+From b8336be66dec06bef518030a0df9847122053ec5 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Wed, 26 Jun 2019 14:18:04 +0100
+Subject: [PATCH] staging: comedi: dt282x: fix a null pointer deref on interrupt
+Git-commit: b8336be66dec06bef518030a0df9847122053ec5
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+The interrupt handler `dt282x_interrupt()` causes a null pointer
+dereference for those supported boards that have no analog output
+support. For these boards, `dev->write_subdev` will be `NULL` and
+therefore the `s_ao` subdevice pointer variable will be `NULL`. In that
+case, the following call near the end of the interrupt handler results
+in a null pointer dereference:
+
+ comedi_handle_events(dev, s_ao);
+
+Fix it by only calling the above function if `s_ao` is valid.
+
+(There are other uses of `s_ao` by the interrupt handler that may or may
+not be reached depending on values of hardware registers. Trust that
+they are reliable for now.)
+
+Note:
+commit 4f6f009b204f ("staging: comedi: dt282x: use comedi_handle_events()")
+propagates an earlier error from
+commit f21c74fa4cfe ("staging: comedi: dt282x: use cfc_handle_events()").
+
+Fixes: 4f6f009b204f ("staging: comedi: dt282x: use comedi_handle_events()")
+Cc: <stable@vger.kernel.org> # v3.19+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/comedi/drivers/dt282x.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
+index 3be927f1d3a9..e15e33ed94ae 100644
+--- a/drivers/staging/comedi/drivers/dt282x.c
++++ b/drivers/staging/comedi/drivers/dt282x.c
+@@ -557,7 +557,8 @@ static irqreturn_t dt282x_interrupt(int irq, void *d)
+ }
+ #endif
+ comedi_handle_events(dev, s);
+- comedi_handle_events(dev, s_ao);
++ if (s_ao)
++ comedi_handle_events(dev, s_ao);
+
+ return IRQ_RETVAL(handled);
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/staging-rtl8712-reduce-stack-usage-again.patch b/patches.drivers/staging-rtl8712-reduce-stack-usage-again.patch
new file mode 100644
index 0000000000..bc5f0cdc85
--- /dev/null
+++ b/patches.drivers/staging-rtl8712-reduce-stack-usage-again.patch
@@ -0,0 +1,209 @@
+From fbd6b25009ac76b2034168cd21d5e01f8c2d83d1 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 28 Jun 2019 14:37:48 +0200
+Subject: [PATCH] staging: rtl8712: reduce stack usage, again
+Git-commit: fbd6b25009ac76b2034168cd21d5e01f8c2d83d1
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+An earlier patch I sent reduced the stack usage enough to get
+below the warning limit, and I could show this was safe, but with
+GCC_PLUGIN_STRUCTLEAK_BYREF_ALL, it gets worse again because large stack
+variables in the same function no longer overlap:
+
+Drivers/staging/rtl8712/rtl871x_ioctl_linux.c: In function 'translate_scan.isra.2':
+drivers/staging/rtl8712/rtl871x_ioctl_linux.c:322:1: error: the frame size of 1200 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
+
+Split out the largest two blocks in the affected function into two
+separate functions and mark those noinline_for_stack.
+
+Fixes: 8c5af16f7953 ("staging: rtl8712: reduce stack usage")
+Fixes: 81a56f6dcd20 ("gcc-plugins: structleak: Generalize to all variable types")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 157 +++++++++++++++-----------
+ 1 file changed, 88 insertions(+), 69 deletions(-)
+
+diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+index a224797cd993..fdc1df99d852 100644
+--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
++++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+@@ -124,10 +124,91 @@ static inline void handle_group_key(struct ieee_param *param,
+ }
+ }
+
+-static noinline_for_stack char *translate_scan(struct _adapter *padapter,
+- struct iw_request_info *info,
+- struct wlan_network *pnetwork,
+- char *start, char *stop)
++static noinline_for_stack char *translate_scan_wpa(struct iw_request_info *info,
++ struct wlan_network *pnetwork,
++ struct iw_event *iwe,
++ char *start, char *stop)
++{
++ /* parsing WPA/WPA2 IE */
++ u8 buf[MAX_WPA_IE_LEN];
++ u8 wpa_ie[255], rsn_ie[255];
++ u16 wpa_len = 0, rsn_len = 0;
++ int n, i;
++
++ r8712_get_sec_ie(pnetwork->network.IEs,
++ pnetwork->network.IELength, rsn_ie, &rsn_len,
++ wpa_ie, &wpa_len);
++ if (wpa_len > 0) {
++ memset(buf, 0, MAX_WPA_IE_LEN);
++ n = sprintf(buf, "wpa_ie=");
++ for (i = 0; i < wpa_len; i++) {
++ n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
++ "%02x", wpa_ie[i]);
++ if (n >= MAX_WPA_IE_LEN)
++ break;
++ }
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVCUSTOM;
++ iwe->u.data.length = (u16)strlen(buf);
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, buf);
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVGENIE;
++ iwe->u.data.length = (u16)wpa_len;
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, wpa_ie);
++ }
++ if (rsn_len > 0) {
++ memset(buf, 0, MAX_WPA_IE_LEN);
++ n = sprintf(buf, "rsn_ie=");
++ for (i = 0; i < rsn_len; i++) {
++ n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
++ "%02x", rsn_ie[i]);
++ if (n >= MAX_WPA_IE_LEN)
++ break;
++ }
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVCUSTOM;
++ iwe->u.data.length = strlen(buf);
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, buf);
++ memset(iwe, 0, sizeof(*iwe));
++ iwe->cmd = IWEVGENIE;
++ iwe->u.data.length = rsn_len;
++ start = iwe_stream_add_point(info, start, stop, iwe,
++ rsn_ie);
++ }
++
++ return start;
++}
++
++static noinline_for_stack char *translate_scan_wps(struct iw_request_info *info,
++ struct wlan_network *pnetwork,
++ struct iw_event *iwe,
++ char *start, char *stop)
++{
++ /* parsing WPS IE */
++ u8 wps_ie[512];
++ uint wps_ielen;
++
++ if (r8712_get_wps_ie(pnetwork->network.IEs,
++ pnetwork->network.IELength,
++ wps_ie, &wps_ielen)) {
++ if (wps_ielen > 2) {
++ iwe->cmd = IWEVGENIE;
++ iwe->u.data.length = (u16)wps_ielen;
++ start = iwe_stream_add_point(info, start, stop,
++ iwe, wps_ie);
++ }
++ }
++
++ return start;
++}
++
++static char *translate_scan(struct _adapter *padapter,
++ struct iw_request_info *info,
++ struct wlan_network *pnetwork,
++ char *start, char *stop)
+ {
+ struct iw_event iwe;
+ struct ieee80211_ht_cap *pht_capie;
+@@ -240,73 +321,11 @@ static noinline_for_stack char *translate_scan(struct _adapter *padapter,
+ /* Check if we added any event */
+ if ((current_val - start) > iwe_stream_lcp_len(info))
+ start = current_val;
+- /* parsing WPA/WPA2 IE */
+- {
+- u8 buf[MAX_WPA_IE_LEN];
+- u8 wpa_ie[255], rsn_ie[255];
+- u16 wpa_len = 0, rsn_len = 0;
+- int n;
+-
+- r8712_get_sec_ie(pnetwork->network.IEs,
+- pnetwork->network.IELength, rsn_ie, &rsn_len,
+- wpa_ie, &wpa_len);
+- if (wpa_len > 0) {
+- memset(buf, 0, MAX_WPA_IE_LEN);
+- n = sprintf(buf, "wpa_ie=");
+- for (i = 0; i < wpa_len; i++) {
+- n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
+- "%02x", wpa_ie[i]);
+- if (n >= MAX_WPA_IE_LEN)
+- break;
+- }
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVCUSTOM;
+- iwe.u.data.length = (u16)strlen(buf);
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, buf);
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVGENIE;
+- iwe.u.data.length = (u16)wpa_len;
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, wpa_ie);
+- }
+- if (rsn_len > 0) {
+- memset(buf, 0, MAX_WPA_IE_LEN);
+- n = sprintf(buf, "rsn_ie=");
+- for (i = 0; i < rsn_len; i++) {
+- n += snprintf(buf + n, MAX_WPA_IE_LEN - n,
+- "%02x", rsn_ie[i]);
+- if (n >= MAX_WPA_IE_LEN)
+- break;
+- }
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVCUSTOM;
+- iwe.u.data.length = strlen(buf);
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, buf);
+- memset(&iwe, 0, sizeof(iwe));
+- iwe.cmd = IWEVGENIE;
+- iwe.u.data.length = rsn_len;
+- start = iwe_stream_add_point(info, start, stop, &iwe,
+- rsn_ie);
+- }
+- }
+
+- { /* parsing WPS IE */
+- u8 wps_ie[512];
+- uint wps_ielen;
++ start = translate_scan_wpa(info, pnetwork, &iwe, start, stop);
++
++ start = translate_scan_wps(info, pnetwork, &iwe, start, stop);
+
+- if (r8712_get_wps_ie(pnetwork->network.IEs,
+- pnetwork->network.IELength,
+- wps_ie, &wps_ielen)) {
+- if (wps_ielen > 2) {
+- iwe.cmd = IWEVGENIE;
+- iwe.u.data.length = (u16)wps_ielen;
+- start = iwe_stream_add_point(info, start, stop,
+- &iwe, wps_ie);
+- }
+- }
+- }
+ /* Add quality statistics */
+ iwe.cmd = IWEVQUAL;
+ rssi = r8712_signal_scale_mapping(pnetwork->network.Rssi);
+--
+2.16.4
+
diff --git a/patches.drivers/wil6210-fix-potential-out-of-bounds-read.patch b/patches.drivers/wil6210-fix-potential-out-of-bounds-read.patch
new file mode 100644
index 0000000000..15fc2d5047
--- /dev/null
+++ b/patches.drivers/wil6210-fix-potential-out-of-bounds-read.patch
@@ -0,0 +1,49 @@
+From bfabdd6997323adbedccb13a3fed1967fb8cf8f5 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 15 Apr 2019 09:56:46 -0500
+Subject: [PATCH] wil6210: fix potential out-of-bounds read
+Git-commit: bfabdd6997323adbedccb13a3fed1967fb8cf8f5
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
+
+enum gro_result {
+ GRO_MERGED,
+ GRO_MERGED_FREE,
+ GRO_HELD,
+ GRO_NORMAL,
+ GRO_DROP,
+ GRO_CONSUMED,
+};
+typedef enum gro_result gro_result_t;
+
+In case *rc* evaluates to 5, we end up having an out-of-bounds read
+at drivers/net/wireless/ath/wil6210/txrx.c:821:
+
+ wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
+ len, gro_res_str[rc]);
+
+Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
+
+Addresses-coverity-id: 1444666 ("Out-of-bounds read")
+Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Maya Erez <merez@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/wil6210/txrx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/ath/wil6210/txrx.c
++++ b/drivers/net/wireless/ath/wil6210/txrx.c
+@@ -675,6 +675,7 @@ void wil_netif_rx_any(struct sk_buff *sk
+ [GRO_HELD] = "GRO_HELD",
+ [GRO_NORMAL] = "GRO_NORMAL",
+ [GRO_DROP] = "GRO_DROP",
++ [GRO_CONSUMED] = "GRO_CONSUMED",
+ };
+
+ if (ndev->features & NETIF_F_RXHASH)
diff --git a/patches.fixes/0001-ocfs2-add-last-unlock-times-in-locking_state.patch b/patches.fixes/0001-ocfs2-add-last-unlock-times-in-locking_state.patch
new file mode 100644
index 0000000000..5e3b1cc412
--- /dev/null
+++ b/patches.fixes/0001-ocfs2-add-last-unlock-times-in-locking_state.patch
@@ -0,0 +1,115 @@
+From 8a7f5f4c26dd4e969b5f3b30d06c54dc6a520eda Mon Sep 17 00:00:00 2001
+From: Gang He <ghe@suse.com>
+Date: Thu, 11 Jul 2019 20:53:02 -0700
+Subject: [PATCH 1/3] ocfs2: add last unlock times in locking_state
+Git-commit: 8a7f5f4c26dd4e969b5f3b30d06c54dc6a520eda
+Patch-mainline: v5.3-rc1
+References: bsc#1134390
+
+ocfs2 file system uses locking_state file under debugfs to dump each
+ocfs2 file system's dlm lock resources, but the dlm lock resources in
+memory are becoming more and more after the files were touched by the
+user. it will become a bit difficult to analyze these dlm lock resource
+records in locking_state file by the upper scripts, though some files
+are not active for now, which were accessed long time ago.
+
+Then, I'd like to add last pr/ex unlock times in locking_state file for
+each dlm lock resource record, the the upper scripts can use last unlock
+time to filter inactive dlm lock resource record.
+
+Link: http://lkml.kernel.org/r/20190611015414.27754-1-ghe@suse.com
+Signed-off-by: Gang He <ghe@suse.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/ocfs2/dlmglue.c | 18 +++++++++++++++---
+ fs/ocfs2/ocfs2.h | 1 +
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index b5fc5d3c7525..5f696be267e7 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -460,6 +460,8 @@ static void ocfs2_update_lock_stats(struct ocfs2_lock_res *res, int level,
+
+ if (ret)
+ stats->ls_fail++;
++
++ stats->ls_last = ktime_to_us(ktime_get_real());
+ }
+
+ static inline void ocfs2_track_lock_refresh(struct ocfs2_lock_res *lockres)
+@@ -3079,8 +3081,10 @@ static void *ocfs2_dlm_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ * - Lock stats printed
+ * New in version 3
+ * - Max time in lock stats is in usecs (instead of nsecs)
++ * New in version 4
++ * - Add last pr/ex unlock times in usecs
+ */
+-#define OCFS2_DLM_DEBUG_STR_VERSION 3
++#define OCFS2_DLM_DEBUG_STR_VERSION 4
+ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ {
+ int i;
+@@ -3131,6 +3135,8 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ # define lock_max_prmode(_l) ((_l)->l_lock_prmode.ls_max)
+ # define lock_max_exmode(_l) ((_l)->l_lock_exmode.ls_max)
+ # define lock_refresh(_l) ((_l)->l_lock_refresh)
++# define lock_last_prmode(_l) ((_l)->l_lock_prmode.ls_last)
++# define lock_last_exmode(_l) ((_l)->l_lock_exmode.ls_last)
+ #else
+ # define lock_num_prmode(_l) (0)
+ # define lock_num_exmode(_l) (0)
+@@ -3141,6 +3147,8 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ # define lock_max_prmode(_l) (0)
+ # define lock_max_exmode(_l) (0)
+ # define lock_refresh(_l) (0)
++# define lock_last_prmode(_l) (0ULL)
++# define lock_last_exmode(_l) (0ULL)
+ #endif
+ /* The following seq_print was added in version 2 of this output */
+ seq_printf(m, "%u\t"
+@@ -3151,7 +3159,9 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ "%llu\t"
+ "%u\t"
+ "%u\t"
+- "%u\t",
++ "%u\t"
++ "%llu\t"
++ "%llu\t",
+ lock_num_prmode(lockres),
+ lock_num_exmode(lockres),
+ lock_num_prmode_failed(lockres),
+@@ -3160,7 +3170,9 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ lock_total_exmode(lockres),
+ lock_max_prmode(lockres),
+ lock_max_exmode(lockres),
+- lock_refresh(lockres));
++ lock_refresh(lockres),
++ lock_last_prmode(lockres),
++ lock_last_exmode(lockres));
+
+ /* End the line */
+ seq_printf(m, "\n");
+diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
+index a4647a646f07..5c111eabaa1d 100644
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -150,6 +150,7 @@ struct ocfs2_lock_stats {
+
+ /* Storing max wait in usecs saves 24 bytes per inode */
+ u32 ls_max; /* Max wait in USEC */
++ u64 ls_last; /* Last unlock time in USEC */
+ };
+ #endif
+
+--
+2.12.3
+
diff --git a/patches.fixes/0002-ocfs2-add-locking-filter-debugfs-file.patch b/patches.fixes/0002-ocfs2-add-locking-filter-debugfs-file.patch
new file mode 100644
index 0000000000..0fa4cd9e88
--- /dev/null
+++ b/patches.fixes/0002-ocfs2-add-locking-filter-debugfs-file.patch
@@ -0,0 +1,123 @@
+From 8056773ac4b42f36bae6406030218a5f12749c64 Mon Sep 17 00:00:00 2001
+From: Gang He <ghe@suse.com>
+Date: Thu, 11 Jul 2019 20:53:05 -0700
+Subject: [PATCH 2/3] ocfs2: add locking filter debugfs file
+Git-commit: 8056773ac4b42f36bae6406030218a5f12749c64
+Patch-mainline: v5.3-rc1
+References: bsc#1134390
+
+Add locking filter debugfs file, which is used to filter lock resources
+dump from locking_state debugfs file. We use d_filter_secs field to
+filter lock resources dump, the default d_filter_secs(0) value filters
+nothing, otherwise, only dump the last N seconds active lock resources.
+This enhancement can avoid dumping lots of old records. The
+d_filter_secs value can be changed via locking_filter file.
+
+[akpm@linux-foundation.org: fix undefined reference to `__udivdi3']
+Link: http://lkml.kernel.org/r/20190611015414.27754-2-ghe@suse.com
+Signed-off-by: Gang He <ghe@suse.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Acked-by: Randy Dunlap <rdunlap@infradead.org> [build-tested]
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/ocfs2/dlmglue.c | 38 ++++++++++++++++++++++++++++++++++++++
+ fs/ocfs2/ocfs2.h | 2 ++
+ 2 files changed, 40 insertions(+)
+
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 5f696be267e7..4089daba4c6f 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -2991,6 +2991,8 @@ struct ocfs2_dlm_debug *ocfs2_new_dlm_debug(void)
+ kref_init(&dlm_debug->d_refcnt);
+ INIT_LIST_HEAD(&dlm_debug->d_lockres_tracking);
+ dlm_debug->d_locking_state = NULL;
++ dlm_debug->d_locking_filter = NULL;
++ dlm_debug->d_filter_secs = 0;
+ out:
+ return dlm_debug;
+ }
+@@ -3090,10 +3092,34 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ int i;
+ char *lvb;
+ struct ocfs2_lock_res *lockres = v;
++#ifdef CONFIG_OCFS2_FS_STATS
++ u64 now, last;
++ struct ocfs2_dlm_debug *dlm_debug =
++ ((struct ocfs2_dlm_seq_priv *)m->private)->p_dlm_debug;
++#endif
+
+ if (!lockres)
+ return -EINVAL;
+
++#ifdef CONFIG_OCFS2_FS_STATS
++ if (dlm_debug->d_filter_secs) {
++ now = ktime_to_us(ktime_get_real());
++ if (lockres->l_lock_prmode.ls_last >
++ lockres->l_lock_exmode.ls_last)
++ last = lockres->l_lock_prmode.ls_last;
++ else
++ last = lockres->l_lock_exmode.ls_last;
++ /*
++ * Use d_filter_secs field to filter lock resources dump,
++ * the default d_filter_secs(0) value filters nothing,
++ * otherwise, only dump the last N seconds active lock
++ * resources.
++ */
++ if (div_u64(now - last, 1000000) > dlm_debug->d_filter_secs)
++ return 0;
++ }
++#endif
++
+ seq_printf(m, "0x%x\t", OCFS2_DLM_DEBUG_STR_VERSION);
+
+ if (lockres->l_type == OCFS2_LOCK_TYPE_DENTRY)
+@@ -3243,6 +3269,17 @@ static int ocfs2_dlm_init_debug(struct ocfs2_super *osb)
+ goto out;
+ }
+
++ dlm_debug->d_locking_filter = debugfs_create_u32("locking_filter",
++ 0600,
++ osb->osb_debug_root,
++ &dlm_debug->d_filter_secs);
++ if (!dlm_debug->d_locking_filter) {
++ ret = -EINVAL;
++ mlog(ML_ERROR,
++ "Unable to create locking filter debugfs file.\n");
++ goto out;
++ }
++
+ ocfs2_get_dlm_debug(dlm_debug);
+ out:
+ return ret;
+@@ -3254,6 +3291,7 @@ static void ocfs2_dlm_shutdown_debug(struct ocfs2_super *osb)
+
+ if (dlm_debug) {
+ debugfs_remove(dlm_debug->d_locking_state);
++ debugfs_remove(dlm_debug->d_locking_filter);
+ ocfs2_put_dlm_debug(dlm_debug);
+ }
+ }
+diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
+index 5c111eabaa1d..c7539601555b 100644
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -223,6 +223,8 @@ struct ocfs2_orphan_scan {
+ struct ocfs2_dlm_debug {
+ struct kref d_refcnt;
+ struct dentry *d_locking_state;
++ struct dentry *d_locking_filter;
++ u32 d_filter_secs;
+ struct list_head d_lockres_tracking;
+ };
+
+--
+2.12.3
+
diff --git a/patches.fixes/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch b/patches.fixes/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch
new file mode 100644
index 0000000000..47be0e74a8
--- /dev/null
+++ b/patches.fixes/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch
@@ -0,0 +1,166 @@
+From 5da844a2c7df642de2618fc3efe9a92eec40899d Mon Sep 17 00:00:00 2001
+From: Gang He <ghe@suse.com>
+Date: Thu, 11 Jul 2019 20:53:09 -0700
+Subject: [PATCH 3/3] ocfs2: add first lock wait time in locking_state
+Git-commit: 5da844a2c7df642de2618fc3efe9a92eec40899d
+Patch-mainline: v5.3-rc1
+References: bsc#1134390
+
+ocfs2 file system uses locking_state file under debugfs to dump each
+ocfs2 file system's dlm lock resources, but the users ever encountered
+some hang(deadlock) problems in ocfs2 file system. I'd like to add
+first lock wait time in locking_state file, which can help the upper
+scripts detect these deadlock problems via comparing the first lock wait
+time with the current time.
+
+Link: http://lkml.kernel.org/r/20190611015414.27754-3-ghe@suse.com
+Signed-off-by: Gang He <ghe@suse.com>
+Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
+Cc: Mark Fasheh <mark@fasheh.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Cc: Changwei Ge <gechangwei@live.cn>
+Cc: Gang He <ghe@suse.com>
+Cc: Jun Piao <piaojun@huawei.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ fs/ocfs2/dlmglue.c | 32 +++++++++++++++++++++++++++++---
+ fs/ocfs2/ocfs2.h | 1 +
+ 2 files changed, 30 insertions(+), 3 deletions(-)
+
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 4089daba4c6f..cf90688ff2ed 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -426,6 +426,7 @@ static void ocfs2_remove_lockres_tracking(struct ocfs2_lock_res *res)
+ static void ocfs2_init_lock_stats(struct ocfs2_lock_res *res)
+ {
+ res->l_lock_refresh = 0;
++ res->l_lock_wait = 0;
+ memset(&res->l_lock_prmode, 0, sizeof(struct ocfs2_lock_stats));
+ memset(&res->l_lock_exmode, 0, sizeof(struct ocfs2_lock_stats));
+ }
+@@ -469,6 +470,21 @@ static inline void ocfs2_track_lock_refresh(struct ocfs2_lock_res *lockres)
+ lockres->l_lock_refresh++;
+ }
+
++static inline void ocfs2_track_lock_wait(struct ocfs2_lock_res *lockres)
++{
++ struct ocfs2_mask_waiter *mw;
++
++ if (list_empty(&lockres->l_mask_waiters)) {
++ lockres->l_lock_wait = 0;
++ return;
++ }
++
++ mw = list_first_entry(&lockres->l_mask_waiters,
++ struct ocfs2_mask_waiter, mw_item);
++ lockres->l_lock_wait =
++ ktime_to_us(ktime_mono_to_real(mw->mw_lock_start));
++}
++
+ static inline void ocfs2_init_start_time(struct ocfs2_mask_waiter *mw)
+ {
+ mw->mw_lock_start = ktime_get();
+@@ -484,6 +500,9 @@ static inline void ocfs2_update_lock_stats(struct ocfs2_lock_res *res,
+ static inline void ocfs2_track_lock_refresh(struct ocfs2_lock_res *lockres)
+ {
+ }
++static inline void ocfs2_track_lock_wait(struct ocfs2_lock_res *lockres)
++{
++}
+ static inline void ocfs2_init_start_time(struct ocfs2_mask_waiter *mw)
+ {
+ }
+@@ -877,6 +896,7 @@ static void lockres_set_flags(struct ocfs2_lock_res *lockres,
+ list_del_init(&mw->mw_item);
+ mw->mw_status = 0;
+ complete(&mw->mw_complete);
++ ocfs2_track_lock_wait(lockres);
+ }
+ }
+ static void lockres_or_flags(struct ocfs2_lock_res *lockres, unsigned long or)
+@@ -1388,6 +1408,7 @@ static void lockres_add_mask_waiter(struct ocfs2_lock_res *lockres,
+ list_add_tail(&mw->mw_item, &lockres->l_mask_waiters);
+ mw->mw_mask = mask;
+ mw->mw_goal = goal;
++ ocfs2_track_lock_wait(lockres);
+ }
+
+ /* returns 0 if the mw that was removed was already satisfied, -EBUSY
+@@ -1404,6 +1425,7 @@ static int __lockres_remove_mask_waiter(struct ocfs2_lock_res *lockres,
+
+ list_del_init(&mw->mw_item);
+ init_completion(&mw->mw_complete);
++ ocfs2_track_lock_wait(lockres);
+ }
+
+ return ret;
+@@ -3084,7 +3106,7 @@ static void *ocfs2_dlm_seq_next(struct seq_file *m, void *v, loff_t *pos)
+ * New in version 3
+ * - Max time in lock stats is in usecs (instead of nsecs)
+ * New in version 4
+- * - Add last pr/ex unlock times in usecs
++ * - Add last pr/ex unlock times and first lock wait time in usecs
+ */
+ #define OCFS2_DLM_DEBUG_STR_VERSION 4
+ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+@@ -3102,7 +3124,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ return -EINVAL;
+
+ #ifdef CONFIG_OCFS2_FS_STATS
+- if (dlm_debug->d_filter_secs) {
++ if (!lockres->l_lock_wait && dlm_debug->d_filter_secs) {
+ now = ktime_to_us(ktime_get_real());
+ if (lockres->l_lock_prmode.ls_last >
+ lockres->l_lock_exmode.ls_last)
+@@ -3163,6 +3185,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ # define lock_refresh(_l) ((_l)->l_lock_refresh)
+ # define lock_last_prmode(_l) ((_l)->l_lock_prmode.ls_last)
+ # define lock_last_exmode(_l) ((_l)->l_lock_exmode.ls_last)
++# define lock_wait(_l) ((_l)->l_lock_wait)
+ #else
+ # define lock_num_prmode(_l) (0)
+ # define lock_num_exmode(_l) (0)
+@@ -3175,6 +3198,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ # define lock_refresh(_l) (0)
+ # define lock_last_prmode(_l) (0ULL)
+ # define lock_last_exmode(_l) (0ULL)
++# define lock_wait(_l) (0ULL)
+ #endif
+ /* The following seq_print was added in version 2 of this output */
+ seq_printf(m, "%u\t"
+@@ -3187,6 +3211,7 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ "%u\t"
+ "%u\t"
+ "%llu\t"
++ "%llu\t"
+ "%llu\t",
+ lock_num_prmode(lockres),
+ lock_num_exmode(lockres),
+@@ -3198,7 +3223,8 @@ static int ocfs2_dlm_seq_show(struct seq_file *m, void *v)
+ lock_max_exmode(lockres),
+ lock_refresh(lockres),
+ lock_last_prmode(lockres),
+- lock_last_exmode(lockres));
++ lock_last_exmode(lockres),
++ lock_wait(lockres));
+
+ /* End the line */
+ seq_printf(m, "\n");
+diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
+index c7539601555b..fddbbd60f434 100644
+--- a/fs/ocfs2/ocfs2.h
++++ b/fs/ocfs2/ocfs2.h
+@@ -192,6 +192,7 @@ struct ocfs2_lock_res {
+ #ifdef CONFIG_OCFS2_FS_STATS
+ struct ocfs2_lock_stats l_lock_prmode; /* PR mode stats */
+ u32 l_lock_refresh; /* Disk refreshes */
++ u64 l_lock_wait; /* First lock wait time */
+ struct ocfs2_lock_stats l_lock_exmode; /* EX mode stats */
+ #endif
+ #ifdef CONFIG_DEBUG_LOCK_ALLOC
+--
+2.12.3
+
diff --git a/patches.fixes/KVM-polling-add-architecture-backend-to-disable-poll.patch b/patches.fixes/KVM-polling-add-architecture-backend-to-disable-poll.patch
new file mode 100644
index 0000000000..fde6a6e77b
--- /dev/null
+++ b/patches.fixes/KVM-polling-add-architecture-backend-to-disable-poll.patch
@@ -0,0 +1,60 @@
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Tue, 5 Mar 2019 05:30:01 -0500
+Subject: KVM: polling: add architecture backend to disable polling
+Patch-mainline: v5.2-rc1
+Git-commit: cdd6ad3ac63d2fa320baefcf92a02a918375c30f
+References: bsc#1119222
+
+There are cases where halt polling is unwanted. For example when running
+KVM on an over committed LPAR we rather want to give back the CPU to
+neighbour LPARs instead of polling. Let us provide a callback that
+allows architectures to disable polling.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Liang Yan <lyan@suse.com>
+---
+ include/linux/kvm_host.h | 10 ++++++++++
+ virt/kvm/Kconfig | 3 +++
+ virt/kvm/kvm_main.c | 2 +-
+ 3 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -1265,4 +1265,14 @@ static inline bool vcpu_valid_wakeup(str
+ }
+ #endif /* CONFIG_HAVE_KVM_INVALID_WAKEUPS */
+
++#ifdef CONFIG_HAVE_KVM_NO_POLL
++/* Callback that tells if we must not poll */
++bool kvm_arch_no_poll(struct kvm_vcpu *vcpu);
++#else
++static inline bool kvm_arch_no_poll(struct kvm_vcpu *vcpu)
++{
++ return false;
++}
++#endif /* CONFIG_HAVE_KVM_NO_POLL */
++
+ #endif
+--- a/virt/kvm/Kconfig
++++ b/virt/kvm/Kconfig
+@@ -50,3 +50,6 @@ config KVM_COMPAT
+
+ config HAVE_KVM_IRQ_BYPASS
+ bool
++
++config HAVE_KVM_NO_POLL
++ bool
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2205,7 +2205,7 @@ void kvm_vcpu_block(struct kvm_vcpu *vcp
+ u64 block_ns;
+
+ start = cur = ktime_get();
+- if (vcpu->halt_poll_ns) {
++ if (vcpu->halt_poll_ns && !kvm_arch_no_poll(vcpu)) {
+ ktime_t stop = ktime_add_ns(ktime_get(), vcpu->halt_poll_ns);
+
+ ++vcpu->stat.halt_attempted_poll;
diff --git a/patches.fixes/KVM-s390-change-default-halt-poll-time-to-50us.patch b/patches.fixes/KVM-s390-change-default-halt-poll-time-to-50us.patch
new file mode 100644
index 0000000000..9a29093a72
--- /dev/null
+++ b/patches.fixes/KVM-s390-change-default-halt-poll-time-to-50us.patch
@@ -0,0 +1,31 @@
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Wed, 15 May 2019 09:59:08 +0200
+Subject: KVM: s390: change default halt poll time to 50us
+Patch-mainline: v5.2-rc2
+Git-commit: 6e9b622d1c3628fae65217465a148b157a361c2a
+References: bsc#1119222
+
+Recent measurements indicate that using 50us results in a reduced CPU
+consumption, while still providing the benefit of halt polling. Let's
+use 50us instead.
+
+Acked-by: David Hildenbrand <david@redhat.com>
+Acked-by: Janosch Frank <frankja@linux.ibm.com>
+Acked-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Liang Yan <lyan@suse.com>
+---
+ arch/s390/include/asm/kvm_host.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -39,7 +39,7 @@
+ */
+ #define KVM_NR_IRQCHIPS 1
+ #define KVM_IRQCHIP_NUM_PINS 4096
+-#define KVM_HALT_POLL_NS_DEFAULT 80000
++#define KVM_HALT_POLL_NS_DEFAULT 50000
+
+ /* s390-specific vcpu->requests bit members */
+ #define KVM_REQ_ENABLE_IBS KVM_ARCH_REQ(0)
diff --git a/patches.fixes/KVM-s390-fix-typo-in-parameter-description.patch b/patches.fixes/KVM-s390-fix-typo-in-parameter-description.patch
new file mode 100644
index 0000000000..15830f1fec
--- /dev/null
+++ b/patches.fixes/KVM-s390-fix-typo-in-parameter-description.patch
@@ -0,0 +1,31 @@
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Sat, 4 May 2019 06:51:45 +0000
+Subject: KVM: s390: fix typo in parameter description
+Patch-mainline: v5.2-rc2
+Git-commit: b41fb528dd8784a87414e3af5579674badefa76b
+References: bsc#1119222
+
+Fix typo in parameter description.
+
+Fixes: 8b905d28ee17 ("KVM: s390: provide kvm_arch_no_poll function")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Message-Id: <20190504065145.53665-1-weiyongjun1@huawei.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Liang Yan <lyan@suse.com>
+---
+ arch/s390/kvm/kvm-s390.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -163,7 +163,7 @@ MODULE_PARM_DESC(nested, "Nested virtual
+ /* maximum percentage of steal time for polling. >100 is treated like 100 */
+ static u8 halt_poll_max_steal = 10;
+ module_param(halt_poll_max_steal, byte, 0644);
+-MODULE_PARM_DESC(hpage, "Maximum percentage of steal time to allow polling");
++MODULE_PARM_DESC(halt_poll_max_steal, "Maximum percentage of steal time to allow polling");
+
+ /*
+ * Base feature mask that defines default mask for facilities. Consists of the
diff --git a/patches.fixes/KVM-s390-provide-kvm_arch_no_poll-function.patch b/patches.fixes/KVM-s390-provide-kvm_arch_no_poll-function.patch
new file mode 100644
index 0000000000..cd955d9026
--- /dev/null
+++ b/patches.fixes/KVM-s390-provide-kvm_arch_no_poll-function.patch
@@ -0,0 +1,82 @@
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Tue, 5 Mar 2019 05:30:02 -0500
+Subject: KVM: s390: provide kvm_arch_no_poll function
+Patch-mainline: v5.2-rc1
+Git-commit: 8b905d28ee17795c939813b2f6947829774619b9
+References: bsc#1119222
+
+We do track the current steal time of the host CPUs. Let us use
+this value to disable halt polling if the steal time goes beyond
+a configured value.
+
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Acked-by: Liang Yan <lyan@suse.com>
+---
+ arch/s390/include/asm/kvm_host.h | 1 +
+ arch/s390/kvm/Kconfig | 1 +
+ arch/s390/kvm/kvm-s390.c | 17 +++++++++++++++++
+ 3 files changed, 19 insertions(+)
+
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -303,6 +303,7 @@ struct kvm_vcpu_stat {
+ u64 halt_successful_poll;
+ u64 halt_attempted_poll;
+ u64 halt_poll_invalid;
++ u64 halt_no_poll_steal;
+ u64 halt_wakeup;
+ u64 instruction_lctl;
+ u64 instruction_lctlg;
+--- a/arch/s390/kvm/Kconfig
++++ b/arch/s390/kvm/Kconfig
+@@ -29,6 +29,7 @@ config KVM
+ select HAVE_KVM_IRQFD
+ select HAVE_KVM_IRQ_ROUTING
+ select HAVE_KVM_INVALID_WAKEUPS
++ select HAVE_KVM_NO_POLL
+ select SRCU
+ select KVM_VFIO
+ ---help---
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -73,6 +73,7 @@ struct kvm_stats_debugfs_item debugfs_en
+ { "halt_successful_poll", VCPU_STAT(halt_successful_poll) },
+ { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll) },
+ { "halt_poll_invalid", VCPU_STAT(halt_poll_invalid) },
++ { "halt_no_poll_steal", VCPU_STAT(halt_no_poll_steal) },
+ { "halt_wakeup", VCPU_STAT(halt_wakeup) },
+ { "instruction_lctlg", VCPU_STAT(instruction_lctlg) },
+ { "instruction_lctl", VCPU_STAT(instruction_lctl) },
+@@ -159,6 +160,11 @@ MODULE_PARM_DESC(nested, "Nested virtual
+ */
+ #define SIZE_INTERNAL 16
+
++/* maximum percentage of steal time for polling. >100 is treated like 100 */
++static u8 halt_poll_max_steal = 10;
++module_param(halt_poll_max_steal, byte, 0644);
++MODULE_PARM_DESC(hpage, "Maximum percentage of steal time to allow polling");
++
+ /*
+ * Base feature mask that defines default mask for facilities. Consists of the
+ * defines in FACILITIES_KVM and the non-hypervisor managed bits.
+@@ -2659,6 +2665,17 @@ static void kvm_gmap_notifier(struct gma
+ }
+ }
+
++bool kvm_arch_no_poll(struct kvm_vcpu *vcpu)
++{
++ /* do not poll with more than halt_poll_max_steal percent of steal time */
++ if (S390_lowcore.avg_steal_timer * 100 / (TICK_USEC << 12) >=
++ halt_poll_max_steal) {
++ vcpu->stat.halt_no_poll_steal++;
++ return true;
++ }
++ return false;
++}
++
+ int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu)
+ {
+ /* kvm common code refers to this, but never calls it */
diff --git a/patches.fixes/RDS-IB-fix-passing-zero-to-ERR_PTR-warning.patch b/patches.fixes/RDS-IB-fix-passing-zero-to-ERR_PTR-warning.patch
new file mode 100644
index 0000000000..2a0b91e8a5
--- /dev/null
+++ b/patches.fixes/RDS-IB-fix-passing-zero-to-ERR_PTR-warning.patch
@@ -0,0 +1,35 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Subject: RDS: IB: fix 'passing zero to ERR_PTR()' warning
+Patch-mainline: v4.19-rc1
+Git-commit: 5941923da29e84bc9e2a1abb2c14fffaf8d71e2f
+References: git-fixes
+
+Fix a static code checker warning:
+ net/rds/ib_frmr.c:82 rds_ib_alloc_frmr() warn: passing zero to 'ERR_PTR'
+
+The error path for ib_alloc_mr failure should set err to PTR_ERR.
+
+Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/rds/ib_frmr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c
+index 48332a6ed738..d290416e79e9 100644
+--- a/net/rds/ib_frmr.c
++++ b/net/rds/ib_frmr.c
+@@ -61,6 +61,7 @@ static struct rds_ib_mr *rds_ib_alloc_frmr(struct rds_ib_device *rds_ibdev,
+ pool->fmr_attr.max_pages);
+ if (IS_ERR(frmr->mr)) {
+ pr_warn("RDS/IB: %s failed to allocate MR", __func__);
++ err = PTR_ERR(frmr->mr);
+ goto out_no_cigar;
+ }
+
+--
+2.12.3
+
diff --git a/patches.fixes/af_unix-remove-redundant-lockdep-class.patch b/patches.fixes/af_unix-remove-redundant-lockdep-class.patch
new file mode 100644
index 0000000000..be8dacde99
--- /dev/null
+++ b/patches.fixes/af_unix-remove-redundant-lockdep-class.patch
@@ -0,0 +1,54 @@
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Subject: af_unix: remove redundant lockdep class
+Patch-mainline: v4.17-rc1
+Git-commit: 3848ec5dc82ce648a84ed10021ce2562fdac7c6a
+References: git-fixes
+
+After commit 581319c58600 ("net/socket: use per af lockdep classes for sk queues")
+sock queue locks now have per-af lockdep classes, including unix socket.
+It is no longer necessary to workaround it.
+
+I noticed this while looking at a syzbot deadlock report, this patch
+itself doesn't fix it (this is why I don't add Reported-by).
+
+Fixes: 581319c58600 ("net/socket: use per af lockdep classes for sk queues")
+Cc: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/unix/af_unix.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 85ec5460e6b2..c96d129a0959 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -745,14 +745,6 @@ static struct proto unix_proto = {
+ .obj_size = sizeof(struct unix_sock),
+ };
+
+-/*
+- * AF_UNIX sockets do not interact with hardware, hence they
+- * dont trigger interrupts - so it's safe for them to have
+- * bh-unsafe locking for their sk_receive_queue.lock. Split off
+- * this special lock-class by reinitializing the spinlock key:
+- */
+-static struct lock_class_key af_unix_sk_receive_queue_lock_key;
+-
+ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
+ {
+ struct sock *sk = NULL;
+@@ -767,8 +759,6 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
+ goto out;
+
+ sock_init_data(sock, sk);
+- lockdep_set_class(&sk->sk_receive_queue.lock,
+- &af_unix_sk_receive_queue_lock_key);
+
+ sk->sk_allocation = GFP_KERNEL_ACCOUNT;
+ sk->sk_write_space = unix_write_space;
+--
+2.12.3
+
diff --git a/patches.fixes/cgroup-use-css_tryget-instead-of-css_tryget_online-in-task_get_css.patch b/patches.fixes/cgroup-use-css_tryget-instead-of-css_tryget_online-in-task_get_css.patch
new file mode 100644
index 0000000000..582f24cbf4
--- /dev/null
+++ b/patches.fixes/cgroup-use-css_tryget-instead-of-css_tryget_online-in-task_get_css.patch
@@ -0,0 +1,90 @@
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 29 May 2019 13:46:25 -0700
+Subject: cgroup: Use css_tryget() instead of css_tryget_online() in
+ task_get_css()
+Git-commit: 18fa84a2db0e15b02baa5d94bdb5bd509175d2f6
+Patch-mainline: v5.2-rc2
+References: bsc#1141478
+
+A PF_EXITING task can stay associated with an offline css. If such
+task calls task_get_css(), it can get stuck indefinitely. This can be
+triggered by BSD process accounting which writes to a file with
+PF_EXITING set when racing against memcg disable as in the backtrace
+at the end.
+
+After this change, task_get_css() may return a css which was already
+offline when the function was called. None of the existing users are
+affected by this change.
+
+ INFO: rcu_sched self-detected stall on CPU
+ INFO: rcu_sched detected stalls on CPUs/tasks:
+ ...
+ NMI backtrace for cpu 0
+ ...
+ Call Trace:
+ <IRQ>
+ dump_stack+0x46/0x68
+ nmi_cpu_backtrace.cold.2+0x13/0x57
+ nmi_trigger_cpumask_backtrace+0xba/0xca
+ rcu_dump_cpu_stacks+0x9e/0xce
+ rcu_check_callbacks.cold.74+0x2af/0x433
+ update_process_times+0x28/0x60
+ tick_sched_timer+0x34/0x70
+ __hrtimer_run_queues+0xee/0x250
+ hrtimer_interrupt+0xf4/0x210
+ smp_apic_timer_interrupt+0x56/0x110
+ apic_timer_interrupt+0xf/0x20
+ </IRQ>
+ RIP: 0010:balance_dirty_pages_ratelimited+0x28f/0x3d0
+ ...
+ btrfs_file_write_iter+0x31b/0x563
+ __vfs_write+0xfa/0x140
+ __kernel_write+0x4f/0x100
+ do_acct_process+0x495/0x580
+ acct_process+0xb9/0xdb
+ do_exit+0x748/0xa00
+ do_group_exit+0x3a/0xa0
+ get_signal+0x254/0x560
+ do_signal+0x23/0x5c0
+ exit_to_usermode_loop+0x5d/0xa0
+ prepare_exit_to_usermode+0x53/0x80
+ retint_user+0x8/0x8
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Cc: stable@vger.kernel.org # v4.2+
+Fixes: ec438699a9ae ("cgroup, block: implement task_get_css() and use it in bio_associate_current()")
+
+Acked-by: Michal Koutný <mkoutny@suse.com>
+---
+ include/linux/cgroup.h | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index c0077adeea83..a7e4611e20c8 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -487,7 +487,7 @@ static inline struct cgroup_subsys_state *task_css(struct task_struct *task,
+ *
+ * Find the css for the (@task, @subsys_id) combination, increment a
+ * reference on and return it. This function is guaranteed to return a
+- * valid css.
++ * valid css. The returned css may already have been offlined.
+ */
+ static inline struct cgroup_subsys_state *
+ task_get_css(struct task_struct *task, int subsys_id)
+@@ -497,7 +497,13 @@ task_get_css(struct task_struct *task, int subsys_id)
+ rcu_read_lock();
+ while (true) {
+ css = task_css(task, subsys_id);
+- if (likely(css_tryget_online(css)))
++ /*
++ * Can't use css_tryget_online() here. A task which has
++ * PF_EXITING set may stay associated with an offline css.
++ * If such task calls this function, css_tryget_online()
++ * will keep failing.
++ */
++ if (likely(css_tryget(css)))
+ break;
+ cpu_relax();
+ }
+
diff --git a/patches.fixes/ethtool-check-the-return-value-of-get_regs_len.patch b/patches.fixes/ethtool-check-the-return-value-of-get_regs_len.patch
new file mode 100644
index 0000000000..6e14ad907d
--- /dev/null
+++ b/patches.fixes/ethtool-check-the-return-value-of-get_regs_len.patch
@@ -0,0 +1,51 @@
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Subject: ethtool: check the return value of get_regs_len
+Patch-mainline: v5.0-rc1
+Git-commit: f9fc54d313fab2834f44f516459cdc8ac91d797f
+References: git-fixes
+
+
+The return type for get_regs_len in struct ethtool_ops is int,
+the hns3 driver may return error when failing to get the regs
+len by sending cmd to firmware.
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/ethtool.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 54ebe68ead43..0fb534943da5 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -907,8 +907,13 @@ static noinline_for_stack int ethtool_get_drvinfo(struct net_device *dev,
+ if (rc >= 0)
+ info.n_priv_flags = rc;
+ }
+- if (ops->get_regs_len)
+- info.regdump_len = ops->get_regs_len(dev);
++ if (ops->get_regs_len) {
++ int ret = ops->get_regs_len(dev);
++
++ if (ret > 0)
++ info.regdump_len = ret;
++ }
++
+ if (ops->get_eeprom_len)
+ info.eedump_len = ops->get_eeprom_len(dev);
+
+@@ -1409,6 +1414,9 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
+ return -EFAULT;
+
+ reglen = ops->get_regs_len(dev);
++ if (reglen <= 0)
++ return reglen;
++
+ if (regs.len > reglen)
+ regs.len = reglen;
+
+--
+2.12.3
+
diff --git a/patches.fixes/lib-fix-stall-in-__bitmap_parselist.patch b/patches.fixes/lib-fix-stall-in-__bitmap_parselist.patch
new file mode 100644
index 0000000000..16829c3bfa
--- /dev/null
+++ b/patches.fixes/lib-fix-stall-in-__bitmap_parselist.patch
@@ -0,0 +1,54 @@
+From 8351760ff5b2042039554b4948ddabaac644a976 Mon Sep 17 00:00:00 2001
+From: Yury Norov <ynorov@caviumnetworks.com>
+Date: Thu, 5 Apr 2018 16:18:25 -0700
+Subject: [PATCH] lib: fix stall in __bitmap_parselist()
+Git-commit: 8351760ff5b2042039554b4948ddabaac644a976
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+syzbot is catching stalls at __bitmap_parselist()
+(https://syzkaller.appspot.com/bug?id=ad7e0351fbc90535558514a71cd3edc11681997a).
+The trigger is
+
+ unsigned long v = 0;
+ bitmap_parselist("7:,", &v, BITS_PER_LONG);
+
+which results in hitting infinite loop at
+
+ while (a <= b) {
+ off = min(b - a + 1, used_size);
+ bitmap_set(maskp, a, off);
+ a += group_size;
+ }
+
+due to used_size == group_size == 0.
+
+Link: http://lkml.kernel.org/r/20180404162647.15763-1-ynorov@caviumnetworks.com
+Fixes: 0a5ce0831d04382a ("lib/bitmap.c: make bitmap_parselist() thread-safe and much faster")
+Signed-off-by: Yury Norov <ynorov@caviumnetworks.com>
+Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Reported-by: syzbot <syzbot+6887cbb011c8054e8a3d@syzkaller.appspotmail.com>
+Cc: Noam Camus <noamca@mellanox.com>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: Matthew Wilcox <mawilcox@microsoft.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ lib/bitmap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -603,7 +603,7 @@ static int __bitmap_parselist(const char
+ /* if no digit is after '-', it's wrong*/
+ if (at_start && in_range)
+ return -EINVAL;
+- if (!(a <= b) || !(used_size <= group_size))
++ if (!(a <= b) || group_size == 0 || !(used_size <= group_size))
+ return -EINVAL;
+ if (b >= nmaskbits)
+ return -ERANGE;
diff --git a/patches.fixes/lib-scatterlist-Fix-mapping-iterator-when-sg-offset-.patch b/patches.fixes/lib-scatterlist-Fix-mapping-iterator-when-sg-offset-.patch
new file mode 100644
index 0000000000..4c599c4dab
--- /dev/null
+++ b/patches.fixes/lib-scatterlist-Fix-mapping-iterator-when-sg-offset-.patch
@@ -0,0 +1,63 @@
+From aeb87246537a83c2aff482f3f34a2e0991e02cbc Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Mon, 24 Jun 2019 07:20:14 +0000
+Subject: [PATCH] lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
+Git-commit: aeb87246537a83c2aff482f3f34a2e0991e02cbc
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+[ dropped the patch chunk to lib/test_bitmap.c as it's not applicable -- tiwai ]
+
+All mapping iterator logic is based on the assumption that sg->offset
+is always lower than PAGE_SIZE.
+
+But there are situations where sg->offset is such that the SG item
+is on the second page. In that case sg_copy_to_buffer() fails
+properly copying the data into the buffer. One of the reason is
+that the data will be outside the kmapped area used to access that
+data.
+
+This patch fixes the issue by adjusting the mapping iterator
+offset and pgoffset fields such that offset is always lower than
+PAGE_SIZE.
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Fixes: 4225fc8555a9 ("lib/scatterlist: use page iterator in the mapping iterator")
+Cc: stable@vger.kernel.org
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ lib/scatterlist.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/scatterlist.c b/lib/scatterlist.c
+index 739dc9fe2c55..f0757a67affe 100644
+--- a/lib/scatterlist.c
++++ b/lib/scatterlist.c
+@@ -678,17 +678,18 @@ static bool sg_miter_get_next_page(struct sg_mapping_iter *miter)
+ {
+ if (!miter->__remaining) {
+ struct scatterlist *sg;
+- unsigned long pgoffset;
+
+ if (!__sg_page_iter_next(&miter->piter))
+ return false;
+
+ sg = miter->piter.sg;
+- pgoffset = miter->piter.sg_pgoffset;
+
+- miter->__offset = pgoffset ? 0 : sg->offset;
++ miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset;
++ miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT;
++ miter->__offset &= PAGE_SIZE - 1;
+ miter->__remaining = sg->offset + sg->length -
+- (pgoffset << PAGE_SHIFT) - miter->__offset;
++ (miter->piter.sg_pgoffset << PAGE_SHIFT) -
++ miter->__offset;
+ miter->__remaining = min_t(unsigned long, miter->__remaining,
+ PAGE_SIZE - miter->__offset);
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/memory-tegra-Fix-integer-overflow-on-tick-value-calc.patch b/patches.fixes/memory-tegra-Fix-integer-overflow-on-tick-value-calc.patch
new file mode 100644
index 0000000000..b7eb7c4209
--- /dev/null
+++ b/patches.fixes/memory-tegra-Fix-integer-overflow-on-tick-value-calc.patch
@@ -0,0 +1,38 @@
+From b906c056b6023c390f18347169071193fda57dde Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 01:12:48 +0300
+Subject: [PATCH] memory: tegra: Fix integer overflow on tick value calculation
+Git-commit: b906c056b6023c390f18347169071193fda57dde
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Multiplying the Memory Controller clock rate by the tick count results
+in an integer overflow and in result the truncated tick value is being
+programmed into hardware, such that the GR3D memory client performance is
+reduced by two times.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/memory/tegra/mc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
+index 1735e23dbc28..483ac3c1a762 100644
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -285,7 +285,7 @@ static int tegra_mc_setup_latency_allowance(struct tegra_mc *mc)
+ u32 value;
+
+ /* compute the number of MC clock cycles per tick */
+- tick = mc->tick * clk_get_rate(mc->clk);
++ tick = (unsigned long long)mc->tick * clk_get_rate(mc->clk);
+ do_div(tick, NSEC_PER_SEC);
+
+ value = readl(mc->regs + MC_EMEM_ARB_CFG);
+--
+2.16.4
+
diff --git a/patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch b/patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch
new file mode 100644
index 0000000000..42b9697b14
--- /dev/null
+++ b/patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch
@@ -0,0 +1,138 @@
+From 63d7ef36103d26f20325a921ecc96a3288560146 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Fri, 14 Jun 2019 17:13:20 -0700
+Subject: [PATCH] mwifiex: Don't abort on small, spec-compliant vendor IEs
+Git-commit: 63d7ef36103d26f20325a921ecc96a3288560146
+Patch-mainline: v5.3-rc1
+References: CVE-2019-3846,bsc#1136424
+
+Per the 802.11 specification, vendor IEs are (at minimum) only required
+to contain an OUI. A type field is also included in ieee80211.h (struct
+ieee80211_vendor_ie) but doesn't appear in the specification. The
+remaining fields (subtype, version) are a convention used in WMM
+headers.
+
+Thus, we should not reject vendor-specific IEs that have only the
+minimum length (3 bytes) -- we should skip over them (since we only want
+to match longer IEs, that match either WMM or WPA formats). We can
+reject elements that don't have the minimum-required 3 byte OUI.
+
+While we're at it, move the non-standard subtype and version fields into
+the WMM structs, to avoid this confusion in the future about generic
+"vendor header" attributes.
+
+Fixes: 685c9b7750bf ("mwifiex: Abort at too short BSS descriptor element")
+Cc: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwifiex/fw.h | 12 +++++++++---
+ drivers/net/wireless/marvell/mwifiex/scan.c | 18 +++++++++++-------
+ drivers/net/wireless/marvell/mwifiex/sta_ioctl.c | 4 ++--
+ drivers/net/wireless/marvell/mwifiex/wmm.c | 2 +-
+ 4 files changed, 23 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -1743,9 +1743,10 @@ struct mwifiex_ie_types_wmm_queue_status
+ struct ieee_types_vendor_header {
+ u8 element_id;
+ u8 len;
+- u8 oui[4]; /* 0~2: oui, 3: oui_type */
+- u8 oui_subtype;
+- u8 version;
++ struct {
++ u8 oui[3];
++ u8 oui_type;
++ } __packed oui;
+ } __packed;
+
+ struct ieee_types_wmm_parameter {
+@@ -1759,6 +1760,9 @@ struct ieee_types_wmm_parameter {
+ * Version [1]
+ */
+ struct ieee_types_vendor_header vend_hdr;
++ u8 oui_subtype;
++ u8 version;
++
+ u8 qos_info_bitmap;
+ u8 reserved;
+ struct ieee_types_wmm_ac_parameters ac_params[IEEE80211_NUM_ACS];
+@@ -1776,6 +1780,8 @@ struct ieee_types_wmm_info {
+ * Version [1]
+ */
+ struct ieee_types_vendor_header vend_hdr;
++ u8 oui_subtype;
++ u8 version;
+
+ u8 qos_info_bitmap;
+ } __packed;
+--- a/drivers/net/wireless/marvell/mwifiex/scan.c
++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
+@@ -1357,21 +1357,25 @@ int mwifiex_update_bss_desc_with_ie(stru
+ break;
+
+ case WLAN_EID_VENDOR_SPECIFIC:
+- if (element_len + 2 < sizeof(vendor_ie->vend_hdr))
+- return -EINVAL;
+-
+ vendor_ie = (struct ieee_types_vendor_specific *)
+ current_ptr;
+
+- if (!memcmp
+- (vendor_ie->vend_hdr.oui, wpa_oui,
+- sizeof(wpa_oui))) {
++ /* 802.11 requires at least 3-byte OUI. */
++ if (element_len < sizeof(vendor_ie->vend_hdr.oui.oui))
++ return -EINVAL;
++
++ /* Not long enough for a match? Skip it. */
++ if (element_len < sizeof(wpa_oui))
++ break;
++
++ if (!memcmp(&vendor_ie->vend_hdr.oui, wpa_oui,
++ sizeof(wpa_oui))) {
+ bss_entry->bcn_wpa_ie =
+ (struct ieee_types_vendor_specific *)
+ current_ptr;
+ bss_entry->wpa_offset = (u16)
+ (current_ptr - bss_entry->beacon_buf);
+- } else if (!memcmp(vendor_ie->vend_hdr.oui, wmm_oui,
++ } else if (!memcmp(&vendor_ie->vend_hdr.oui, wmm_oui,
+ sizeof(wmm_oui))) {
+ if (total_ie_len ==
+ sizeof(struct ieee_types_wmm_parameter) ||
+--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+@@ -1332,7 +1332,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex
+ /* Test to see if it is a WPA IE, if not, then it is a
+ * gen IE
+ */
+- if (!memcmp(pvendor_ie->oui, wpa_oui,
++ if (!memcmp(&pvendor_ie->oui, wpa_oui,
+ sizeof(wpa_oui))) {
+ find_wpa_ie = 1;
+ break;
+@@ -1341,7 +1341,7 @@ mwifiex_set_gen_ie_helper(struct mwifiex
+ /* Test to see if it is a WPS IE, if so, enable
+ * wps session flag
+ */
+- if (!memcmp(pvendor_ie->oui, wps_oui,
++ if (!memcmp(&pvendor_ie->oui, wps_oui,
+ sizeof(wps_oui))) {
+ priv->wps.session_enable = true;
+ mwifiex_dbg(priv->adapter, MSG,
+--- a/drivers/net/wireless/marvell/mwifiex/wmm.c
++++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
+@@ -240,7 +240,7 @@ mwifiex_wmm_setup_queue_priorities(struc
+ mwifiex_dbg(priv->adapter, INFO,
+ "info: WMM Parameter IE: version=%d,\t"
+ "qos_info Parameter Set Count=%d, Reserved=%#x\n",
+- wmm_ie->vend_hdr.version, wmm_ie->qos_info_bitmap &
++ wmm_ie->version, wmm_ie->qos_info_bitmap &
+ IEEE80211_WMM_IE_AP_QOSINFO_PARAM_SET_CNT_MASK,
+ wmm_ie->reserved);
+
diff --git a/patches.fixes/net-packet-fix-memory-leak-in-packet_set_ring.patch b/patches.fixes/net-packet-fix-memory-leak-in-packet_set_ring.patch
new file mode 100644
index 0000000000..3835183626
--- /dev/null
+++ b/patches.fixes/net-packet-fix-memory-leak-in-packet_set_ring.patch
@@ -0,0 +1,44 @@
+From: Eric Dumazet <edumazet@google.com>
+Subject: net/packet: fix memory leak in packet_set_ring()
+Patch-mainline: v5.2-rc7
+Git-commit: 55655e3d1197fff16a7a05088fb0e5eba50eac55
+References: git-fixes
+
+
+syzbot found we can leak memory in packet_set_ring(), if user application
+provides buggy parameters.
+
+Fixes: 7f953ab2ba46 ("af_packet: TX_RING support for TPACKET_V3")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/packet/af_packet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index bab2bfecbf35..55639987775c 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4354,7 +4354,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ req3->tp_sizeof_priv ||
+ req3->tp_feature_req_word) {
+ err = -EINVAL;
+- goto out;
++ goto out_free_pg_vec;
+ }
+ }
+ break;
+@@ -4418,6 +4418,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ prb_shutdown_retire_blk_timer(po, rb_queue);
+ }
+
++out_free_pg_vec:
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
+--
+2.12.3
+
diff --git a/patches.fixes/netfilter-conntrack-fix-calculation-of-next-bucket-n.patch b/patches.fixes/netfilter-conntrack-fix-calculation-of-next-bucket-n.patch
new file mode 100644
index 0000000000..22db45b44b
--- /dev/null
+++ b/patches.fixes/netfilter-conntrack-fix-calculation-of-next-bucket-n.patch
@@ -0,0 +1,62 @@
+From: Vasily Khoruzhick <vasilykh@arista.com>
+Subject: netfilter: conntrack: fix calculation of next bucket
+ number in early_drop
+Patch-mainline: v4.20-rc2
+Git-commit: f393808dc64149ccd0e5a8427505ba2974a59854
+References: git-fixes
+
+
+If there's no entry to drop in bucket that corresponds to the hash,
+early_drop() should look for it in other buckets. But since it increments
+hash instead of bucket number, it actually looks in the same bucket 8
+times: hsize is 16k by default (14 bits) and hash is 32-bit value, so
+reciprocal_scale(hash, hsize) returns the same value for hash..hash+7 in
+most cases.
+
+Fix it by increasing bucket number instead of hash and rename _hash
+to bucket to avoid future confusion.
+
+Fixes: 3e86638e9a0b ("netfilter: conntrack: consider ct netns in early_drop logic")
+Cc: <stable@vger.kernel.org> # v4.7+
+Signed-off-by: Vasily Khoruzhick <vasilykh@arista.com>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/netfilter/nf_conntrack_core.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index e0560c41e371..570c5353cb85 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -934,19 +934,22 @@ static unsigned int early_drop_list(struct net *net,
+ return drops;
+ }
+
+-static noinline int early_drop(struct net *net, unsigned int _hash)
++static noinline int early_drop(struct net *net, unsigned int hash)
+ {
+- unsigned int i;
++ unsigned int i, bucket;
+
+ for (i = 0; i < NF_CT_EVICTION_RANGE; i++) {
+ struct hlist_nulls_head *ct_hash;
+- unsigned int hash, hsize, drops;
++ unsigned int hsize, drops;
+
+ rcu_read_lock();
+ nf_conntrack_get_ht(&ct_hash, &hsize);
+- hash = reciprocal_scale(_hash++, hsize);
++ if (!i)
++ bucket = reciprocal_scale(hash, hsize);
++ else
++ bucket = (bucket + 1) % hsize;
+
+- drops = early_drop_list(net, &ct_hash[hash]);
++ drops = early_drop_list(net, &ct_hash[bucket]);
+ rcu_read_unlock();
+
+ if (drops) {
+--
+2.12.3
+
diff --git a/patches.fixes/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch b/patches.fixes/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
new file mode 100644
index 0000000000..eddfaf7341
--- /dev/null
+++ b/patches.fixes/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
@@ -0,0 +1,67 @@
+From: Willem de Bruijn <willemb@google.com>
+Subject: packet: in recvmsg msg_name return at least sizeof
+ sockaddr_ll
+Patch-mainline: v5.1
+Git-commit: b2cf86e1563e33a14a1c69b3e508d15dc12f804c
+References: git-fixes
+
+Packet send checks that msg_name is at least sizeof sockaddr_ll.
+Packet recv must return at least this length, so that its output
+can be passed unmodified to packet send.
+
+This ceased to be true since adding support for lladdr longer than
+sll_addr. Since, the return value uses true address length.
+
+Always return at least sizeof sockaddr_ll, even if address length
+is shorter. Zero the padding bytes.
+
+Change v1->v2: do not overwrite zeroed padding again. use copy_len.
+
+Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.")
+Suggested-by: David Laight <David.Laight@aculab.com>
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/packet/af_packet.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index aefda8127760..bab2bfecbf35 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3390,20 +3390,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
+ sock_recv_ts_and_drops(msg, sk, skb);
+
+ if (msg->msg_name) {
++ int copy_len;
++
+ /* If the address length field is there to be filled
+ * in, we fill it in now.
+ */
+ if (sock->type == SOCK_PACKET) {
+ __sockaddr_check_size(sizeof(struct sockaddr_pkt));
+ msg->msg_namelen = sizeof(struct sockaddr_pkt);
++ copy_len = msg->msg_namelen;
+ } else {
+ struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
+
+ msg->msg_namelen = sll->sll_halen +
+ offsetof(struct sockaddr_ll, sll_addr);
++ copy_len = msg->msg_namelen;
++ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
++ memset(msg->msg_name +
++ offsetof(struct sockaddr_ll, sll_addr),
++ 0, sizeof(sll->sll_addr));
++ msg->msg_namelen = sizeof(struct sockaddr_ll);
++ }
+ }
+- memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
+- msg->msg_namelen);
++ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
+ }
+
+ if (pkt_sk(sk)->auxdata) {
+--
+2.12.3
+
diff --git a/patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch b/patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch
new file mode 100644
index 0000000000..f6c147a72f
--- /dev/null
+++ b/patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch
@@ -0,0 +1,99 @@
+From: Paolo Abeni <pabeni@redhat.com>
+Subject: pktgen: do not sleep with the thread lock held.
+Patch-mainline: v5.2-rc4
+Git-commit: 720f1de4021f09898b8c8443f3b3e995991b6e3a
+References: git-fixes
+
+
+Currently, the process issuing a "start" command on the pktgen procfs
+interface, acquires the pktgen thread lock and never release it, until
+all pktgen threads are completed. The above can blocks indefinitely any
+other pktgen command and any (even unrelated) netdevice removal - as
+the pktgen netdev notifier acquires the same lock.
+
+The issue is demonstrated by the following script, reported by Matteo:
+
+ip -b - <<'EOF'
+ link add type dummy
+ link add type veth
+ link set dummy0 up
+EOF
+modprobe pktgen
+echo reset >/proc/net/pktgen/pgctrl
+{
+ echo rem_device_all
+ echo add_device dummy0
+} >/proc/net/pktgen/kpktgend_0
+echo count 0 >/proc/net/pktgen/dummy0
+echo start >/proc/net/pktgen/pgctrl &
+sleep 1
+rmmod veth
+
+Fix the above releasing the thread lock around the sleep call.
+
+Additionally we must prevent racing with forcefull rmmod - as the
+thread lock no more protects from them. Instead, acquire a self-reference
+before waiting for any thread. As a side effect, running
+
+rmmod pktgen
+
+while some thread is running now fails with "module in use" error,
+before this patch such command hanged indefinitely.
+
+Note: the issue predates the commit reported in the fixes tag, but
+this fix can't be applied before the mentioned commit.
+
+v1 -> v2:
+ - no need to check for thread existence after flipping the lock,
+ pktgen threads are freed only at net exit time
+ -
+
+Fixes: 6146e6a43b35 ("[PKTGEN]: Removes thread_{un,}lock() macros.")
+Reported-and-tested-by: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/core/pktgen.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 3b2034f6d49d..2e9401312eb2 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3149,7 +3149,13 @@ static int pktgen_wait_thread_run(struct pktgen_thread *t)
+ {
+ while (thread_is_running(t)) {
+
++ /* note: 't' will still be around even after the unlock/lock
++ * cycle because pktgen_thread threads are only cleared at
++ * net exit
++ */
++ mutex_unlock(&pktgen_thread_lock);
+ msleep_interruptible(100);
++ mutex_lock(&pktgen_thread_lock);
+
+ if (signal_pending(current))
+ goto signal;
+@@ -3164,6 +3170,10 @@ static int pktgen_wait_all_threads_run(struct pktgen_net *pn)
+ struct pktgen_thread *t;
+ int sig = 1;
+
++ /* prevent from racing with rmmod */
++ if (!try_module_get(THIS_MODULE))
++ return sig;
++
+ mutex_lock(&pktgen_thread_lock);
+
+ list_for_each_entry(t, &pn->pktgen_threads, th_list) {
+@@ -3177,6 +3187,7 @@ static int pktgen_wait_all_threads_run(struct pktgen_net *pn)
+ t->control |= (T_STOP);
+
+ mutex_unlock(&pktgen_thread_lock);
++ module_put(THIS_MODULE);
+ return sig;
+ }
+
+--
+2.12.3
+
diff --git a/patches.fixes/s390-vtime-steal-time-exponential-moving-average.patch b/patches.fixes/s390-vtime-steal-time-exponential-moving-average.patch
new file mode 100644
index 0000000000..6074e284ca
--- /dev/null
+++ b/patches.fixes/s390-vtime-steal-time-exponential-moving-average.patch
@@ -0,0 +1,105 @@
+From d6bf059d348d5cb3d6908e839562ce46a9d3f252 Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Wed, 6 Mar 2019 13:31:21 +0200
+Subject: [PATCH] s390/vtime: steal time exponential moving average
+Patch-mainline: v5.1-rc3
+Git-commit: 152e9b8676c6e788c6bff095c1eaae7b86df5003
+References: bsc#1119222
+
+To be able to judge the current overcommitment ratio for a CPU add
+a lowcore field with the exponential moving average of the steal time.
+The average is updated every tick.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Liang Yan <lyan@suse.com>
+---
+ arch/s390/include/asm/lowcore.h | 4 ++--
+ arch/s390/kernel/smp.c | 3 ++-
+ arch/s390/kernel/vtime.c | 19 ++++++++++++-------
+ 3 files changed, 16 insertions(+), 10 deletions(-)
+
+diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
+index 4b028396e539..39ed06d0eff0 100644
+--- a/arch/s390/include/asm/lowcore.h
++++ b/arch/s390/include/asm/lowcore.h
+@@ -98,7 +98,7 @@ struct lowcore {
+
+ /* Current process. */
+ __u64 current_task; /* 0x0328 */
+- __u8 pad_0x318[0x320-0x318]; /* 0x0330 */
++ __u64 avg_steal_timer; /* 0x0330 */
+ __u64 kernel_stack; /* 0x0338 */
+
+ /* Interrupt, panic and restart stack. */
+@@ -139,7 +139,7 @@ struct lowcore {
+ /* Per cpu primary space access list */
+ __u32 paste[16]; /* 0x0400 */
+
+- __u8 pad_0x04c0[0x0500-0x0440]; /* 0x0440 */
++ __u8 pad_0x04c0[0x0500-0x0440]; /* 0x0440 */
+
+ /* br %r1 trampoline */
+ __u16 br_r1_trampoline; /* 0x0500 */
+diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
+index 07383496f1d3..0400a8dfc63d 100644
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -274,7 +274,8 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
+ lc->percpu_offset = __per_cpu_offset[cpu];
+ lc->kernel_asce = S390_lowcore.kernel_asce;
+ lc->machine_flags = S390_lowcore.machine_flags;
+- lc->user_timer = lc->system_timer = lc->steal_timer = 0;
++ lc->user_timer = lc->system_timer =
++ lc->steal_timer = lc->avg_steal_timer = 0;
+ __ctl_store(lc->cregs_save_area, 0, 15);
+ save_access_regs((unsigned int *) lc->access_regs_save_area);
+ memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list,
+diff --git a/arch/s390/kernel/vtime.c b/arch/s390/kernel/vtime.c
+index 072d84ba42a3..a6f23238c3b0 100644
+--- a/arch/s390/kernel/vtime.c
++++ b/arch/s390/kernel/vtime.c
+@@ -124,7 +124,7 @@ static void account_system_index_scaled(struct task_struct *p,
+ */
+ static int do_account_vtime(struct task_struct *tsk)
+ {
+- u64 timer, clock, user, guest, system, hardirq, softirq, steal;
++ u64 timer, clock, user, guest, system, hardirq, softirq;
+
+ timer = S390_lowcore.last_update_timer;
+ clock = S390_lowcore.last_update_clock;
+@@ -185,12 +185,6 @@ static int do_account_vtime(struct task_struct *tsk)
+ account_system_index_scaled(tsk, softirq, scale_vtime(softirq),
+ CPUTIME_SOFTIRQ);
+
+- steal = S390_lowcore.steal_timer;
+- if ((s64) steal > 0) {
+- S390_lowcore.steal_timer = 0;
+- account_steal_time(cputime_to_nsecs(steal));
+- }
+-
+ return virt_timer_forward(user + guest + system + hardirq + softirq);
+ }
+
+@@ -216,8 +210,19 @@ void vtime_task_switch(struct task_struct *prev)
+ */
+ void vtime_flush(struct task_struct *tsk)
+ {
++ u64 steal, avg_steal;
++
+ if (do_account_vtime(tsk))
+ virt_timer_expire();
++
++ steal = S390_lowcore.steal_timer;
++ avg_steal = S390_lowcore.avg_steal_timer / 2;
++ if ((s64) steal > 0) {
++ S390_lowcore.steal_timer = 0;
++ account_steal_time(steal);
++ avg_steal += steal;
++ }
++ S390_lowcore.avg_steal_timer = avg_steal;
+ }
+
+ /*
+--
+2.22.0
+
diff --git a/patches.fixes/tcp-reduce-tcp_fastretrans_alert-verbosity.patch b/patches.fixes/tcp-reduce-tcp_fastretrans_alert-verbosity.patch
new file mode 100644
index 0000000000..4ffd7bdb76
--- /dev/null
+++ b/patches.fixes/tcp-reduce-tcp_fastretrans_alert-verbosity.patch
@@ -0,0 +1,35 @@
+From: Eric Dumazet <edumazet@google.com>
+Subject: tcp: reduce tcp_fastretrans_alert() verbosity
+Patch-mainline: v4.15-rc1
+Git-commit: 8ba6ddaaf86c4c6814774e4e4ef158b732bd9f9f
+References: git-fixes
+
+With upcoming rb-tree implementation, the checks will trigger
+more often, and this is expected.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ net/ipv4/tcp_input.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 75a2b0a665ac..d6f437883d13 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2823,9 +2823,9 @@ static void tcp_fastretrans_alert(struct sock *sk, const int acked,
+ bool do_lost = is_dupack || ((flag & FLAG_DATA_SACKED) &&
+ (tcp_fackets_out(tp) > tp->reordering));
+
+- if (WARN_ON(!tp->packets_out && tp->sacked_out))
++ if (!tp->packets_out && tp->sacked_out)
+ tp->sacked_out = 0;
+- if (WARN_ON(!tp->sacked_out && tp->fackets_out))
++ if (!tp->sacked_out && tp->fackets_out)
+ tp->fackets_out = 0;
+
+ /* Now state machine starts.
+--
+2.12.3
+
diff --git a/patches.kabi/kabi-fix-KVM-s390-provide-kvm_arch_no_poll-function.patch b/patches.kabi/kabi-fix-KVM-s390-provide-kvm_arch_no_poll-function.patch
new file mode 100644
index 0000000000..3f266c1cd4
--- /dev/null
+++ b/patches.kabi/kabi-fix-KVM-s390-provide-kvm_arch_no_poll-function.patch
@@ -0,0 +1,27 @@
+From: Liang Yan <lyan@suse.com>
+Date: Thu, 30 May 2019 16:35:17 -0400
+Subject: KVM: s390: kABI Workaround for 'kvm_vcpu_stat'
+Patch-mainline: Never, kABI workaround
+References: bsc#1119222
+
+Add halt_no_poll_steal to kvm_vcpu_stat. Hide it from the kABI checker.
+Related patch:
+patches.fixes/KVM-s390-provide-kvm_arch_no_poll-function.patch
+
+Signed-off-by: Liang Yan <lyan@suse.com>
+---
+ arch/s390/include/asm/kvm_host.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/s390/include/asm/kvm_host.h
++++ b/arch/s390/include/asm/kvm_host.h
+@@ -303,7 +303,9 @@ struct kvm_vcpu_stat {
+ u64 halt_successful_poll;
+ u64 halt_attempted_poll;
+ u64 halt_poll_invalid;
++#ifndef __GENKSYMS__
+ u64 halt_no_poll_steal;
++#endif
+ u64 halt_wakeup;
+ u64 instruction_lctl;
+ u64 instruction_lctlg;
diff --git a/patches.kabi/kabi-fix-s390-vtime-steal-time-exponential-moving-average.patch b/patches.kabi/kabi-fix-s390-vtime-steal-time-exponential-moving-average.patch
new file mode 100644
index 0000000000..f6186efded
--- /dev/null
+++ b/patches.kabi/kabi-fix-s390-vtime-steal-time-exponential-moving-average.patch
@@ -0,0 +1,31 @@
+From: Liang Yan <lyan@suse.com>
+Date: Thu, 30 May 2019 17:20:06 -0400
+Subject: KVM: s390: kABI Workaround for 'lowcore'
+Patch-mainline: Never, kABI workaround
+References: bsc#1119222
+
+Add avg_steal_timer and remove pad_ox318 in lowcore.
+Hide that from the kABI checker.
+Related patch:
+s390-vtime-steal-time-exponential-moving-average.patch
+
+Signed-off-by: Liang Yan <lyan@suse.com>
+
+---
+ arch/s390/include/asm/lowcore.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/s390/include/asm/lowcore.h
++++ b/arch/s390/include/asm/lowcore.h
+@@ -98,7 +98,11 @@ struct lowcore {
+
+ /* Current process. */
+ __u64 current_task; /* 0x0328 */
++#ifndef __GENKSYMS__
+ __u64 avg_steal_timer; /* 0x0330 */
++#else
++ __u8 pad_0x318[0x320-0x318]; /* 0x0330 */
++#endif
+ __u64 kernel_stack; /* 0x0338 */
+
+ /* Interrupt, panic and restart stack. */
diff --git a/patches.kabi/mwifiex-ieee-types-kabi-fix.patch b/patches.kabi/mwifiex-ieee-types-kabi-fix.patch
new file mode 100644
index 0000000000..4ac808900f
--- /dev/null
+++ b/patches.kabi/mwifiex-ieee-types-kabi-fix.patch
@@ -0,0 +1,56 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: Fix kABI breakage by mwifiex security fix
+Patch-mainline: Never, kABI fix
+References: CVE-2019-3846,bsc#1136424
+
+The recent fix for mwifiex driver for a security issue
+ patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch
+broke kABI. Fix by restoring the old firmware struct with ifdef.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/marvell/mwifiex/fw.h | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/wireless/marvell/mwifiex/fw.h
++++ b/drivers/net/wireless/marvell/mwifiex/fw.h
+@@ -1743,10 +1743,16 @@ struct mwifiex_ie_types_wmm_queue_status
+ struct ieee_types_vendor_header {
+ u8 element_id;
+ u8 len;
++#ifdef __GENKSYMS__
++ u8 oui[4]; /* 0~2: oui, 3: oui_type */
++ u8 oui_subtype;
++ u8 version;
++#else
+ struct {
+ u8 oui[3];
+ u8 oui_type;
+ } __packed oui;
++#endif
+ } __packed;
+
+ struct ieee_types_wmm_parameter {
+@@ -1760,8 +1766,10 @@ struct ieee_types_wmm_parameter {
+ * Version [1]
+ */
+ struct ieee_types_vendor_header vend_hdr;
++#ifndef __GENKSYMS__
+ u8 oui_subtype;
+ u8 version;
++#endif
+
+ u8 qos_info_bitmap;
+ u8 reserved;
+@@ -1780,8 +1788,10 @@ struct ieee_types_wmm_info {
+ * Version [1]
+ */
+ struct ieee_types_vendor_header vend_hdr;
++#ifndef __GENKSYMS__
+ u8 oui_subtype;
+ u8 version;
++#endif
+
+ u8 qos_info_bitmap;
+ } __packed;
diff --git a/patches.suse/0001-bcache-do-not-assign-in-if-condition-in-bcache_devic.patch b/patches.suse/0001-bcache-do-not-assign-in-if-condition-in-bcache_devic.patch
new file mode 100644
index 0000000000..a04346ff07
--- /dev/null
+++ b/patches.suse/0001-bcache-do-not-assign-in-if-condition-in-bcache_devic.patch
@@ -0,0 +1,57 @@
+From 9b4e9f5abb94b671f998ffc0efebd1582852fee3 Mon Sep 17 00:00:00 2001
+From: Florian Schmaus <flo@geekplace.eu>
+Date: Thu, 26 Jul 2018 12:17:40 +0800
+Subject: [PATCH] bcache: do not assign in if condition in bcache_device_init()
+Git-commit: 9b4e9f5abb94b671f998ffc0efebd1582852fee3
+Patch-mainline: v4.19-rc1
+References: bsc#1140652
+
+Fixes an error condition reported by checkpatch.pl which is caused by
+assigning a variable in an if condition.
+
+(Coly Li: rebase for SLE15 kernel)
+
+Signed-off-by: Florian Schmaus <flo@geekplace.eu>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -796,13 +796,14 @@ static int bcache_device_init(struct bca
+ if (idx < 0)
+ return idx;
+
+- if (!(d->bio_split = bioset_create(4, offsetof(struct bbio, bio),
+- BIOSET_NEED_BVECS |
+- BIOSET_NEED_RESCUER)) ||
+- !(d->disk = alloc_disk(BCACHE_MINORS))) {
+- ida_simple_remove(&bcache_device_idx, idx);
+- return -ENOMEM;
+- }
++ d->bio_split = bioset_create(4, offsetof(struct bbio, bio),
++ BIOSET_NEED_BVECS | BIOSET_NEED_RESCUER);
++ if (!d->bio_split)
++ goto err;
++
++ d->disk = alloc_disk(BCACHE_MINORS);
++ if (!d->disk)
++ goto err;
+
+ set_capacity(d->disk, sectors);
+ snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx);
+@@ -836,6 +837,11 @@ static int bcache_device_init(struct bca
+ blk_queue_write_cache(q, true, true);
+
+ return 0;
++
++err:
++ ida_simple_remove(&bcache_device_idx, idx);
++ return -ENOMEM;
++
+ }
+
+ /* Cached device */
diff --git a/patches.suse/0002-bcache-fix-crashes-stopping-bcache-device-before-rea.patch b/patches.suse/0002-bcache-fix-crashes-stopping-bcache-device-before-rea.patch
new file mode 100644
index 0000000000..d232b08989
--- /dev/null
+++ b/patches.suse/0002-bcache-fix-crashes-stopping-bcache-device-before-rea.patch
@@ -0,0 +1,99 @@
+From 1568ee7e3c6305d9fbb2414bfd4b56e52853d42d Mon Sep 17 00:00:00 2001
+From: Guoju Fang <fangguoju@gmail.com>
+Date: Thu, 25 Apr 2019 00:48:26 +0800
+Subject: [PATCH] bcache: fix crashes stopping bcache device before read miss
+ done
+Git-commit: 1568ee7e3c6305d9fbb2414bfd4b56e52853d42d
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+The bio from upper layer is considered completed when bio_complete()
+returns. In most scenarios bio_complete() is called in search_free(),
+but when read miss happens, the bio_compete() is called when backing
+device reading completed, while the struct search is still in use until
+cache inserting finished.
+
+If someone stops the bcache device just then, the device may be closed
+and released, but after cache inserting finished the struct search will
+access a freed struct cached_dev.
+
+This patch add the reference of bcache device before bio_complete() when
+read miss happens, and put it after the search is not used.
+
+(Coly Li: rebased for SLE15 kernel)
+
+Signed-off-by: Guoju Fang <fangguoju@gmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/request.c | 26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -706,14 +706,14 @@ static void search_free(struct closure *
+ {
+ struct search *s = container_of(cl, struct search, cl);
+
+- atomic_dec(&s->d->c->search_inflight);
++ atomic_dec(&s->iop.c->search_inflight);
+
+ if (s->iop.bio)
+ bio_put(s->iop.bio);
+
+ bio_complete(s);
+ closure_debug_destroy(cl);
+- mempool_free(s, s->d->c->search);
++ mempool_free(s, s->iop.c->search);
+ }
+
+ static inline struct search *search_alloc(struct bio *bio,
+@@ -756,13 +756,13 @@ static void cached_dev_bio_complete(stru
+ struct search *s = container_of(cl, struct search, cl);
+ struct cached_dev *dc = container_of(s->d, struct cached_dev, disk);
+
+- search_free(cl);
+ cached_dev_put(dc);
++ search_free(cl);
+ }
+
+ /* Process reads */
+
+-static void cached_dev_cache_miss_done(struct closure *cl)
++static void cached_dev_read_error_done(struct closure *cl)
+ {
+ struct search *s = container_of(cl, struct search, cl);
+
+@@ -800,7 +800,22 @@ static void cached_dev_read_error(struct
+ closure_bio_submit(s->iop.c, bio, cl);
+ }
+
+- continue_at(cl, cached_dev_cache_miss_done, NULL);
++ continue_at(cl, cached_dev_read_error_done, NULL);
++}
++
++static void cached_dev_cache_miss_done(struct closure *cl)
++{
++ struct search *s = container_of(cl, struct search, cl);
++ struct bcache_device *d = s->d;
++
++ if (s->iop.replace_collision)
++ bch_mark_cache_miss_collision(s->iop.c, s->d);
++
++ if (s->iop.bio)
++ bio_free_pages(s->iop.bio);
++
++ cached_dev_bio_complete(cl);
++ closure_put(&d->cl);
+ }
+
+ static void cached_dev_read_done(struct closure *cl)
+@@ -833,6 +848,7 @@ static void cached_dev_read_done(struct
+ if (verify(dc) && s->recoverable && !s->read_dirty_data)
+ bch_data_verify(dc, s->orig_bio);
+
++ closure_get(&dc->disk.cl);
+ bio_complete(s);
+
+ if (s->iop.bio &&
diff --git a/patches.suse/0003-bcache-fix-inaccurate-result-of-unused-buckets.patch b/patches.suse/0003-bcache-fix-inaccurate-result-of-unused-buckets.patch
new file mode 100644
index 0000000000..6e6aa60caa
--- /dev/null
+++ b/patches.suse/0003-bcache-fix-inaccurate-result-of-unused-buckets.patch
@@ -0,0 +1,36 @@
+From 4e0c04ec3a304490a83d5c0355e64176acc9b4ba Mon Sep 17 00:00:00 2001
+From: Guoju Fang <fangguoju@gmail.com>
+Date: Thu, 25 Apr 2019 00:48:27 +0800
+Subject: [PATCH] bcache: fix inaccurate result of unused buckets
+Git-commit: 4e0c04ec3a304490a83d5c0355e64176acc9b4ba
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+To get the amount of unused buckets in sysfs_priority_stats, the code
+count the buckets which GC_SECTORS_USED is zero. It's correct and should
+not be overwritten by the count of buckets which prio is zero.
+
+Signed-off-by: Guoju Fang <fangguoju@gmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/sysfs.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 17bae9c14ca0..6cd44d3cf906 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -996,8 +996,6 @@ SHOW(__bch_cache)
+ !cached[n - 1])
+ --n;
+
+- unused = ca->sb.nbuckets - n;
+-
+ while (cached < p + n &&
+ *cached == BTREE_PRIO)
+ cached++, n--;
+--
+2.16.4
+
diff --git a/patches.suse/0004-bcache-avoid-clang-Wunintialized-warning.patch b/patches.suse/0004-bcache-avoid-clang-Wunintialized-warning.patch
new file mode 100644
index 0000000000..19b8c30c77
--- /dev/null
+++ b/patches.suse/0004-bcache-avoid-clang-Wunintialized-warning.patch
@@ -0,0 +1,76 @@
+From 78d4eb8ad9e1d413449d1b7a060f50b6efa81ebd Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 25 Apr 2019 00:48:28 +0800
+Subject: [PATCH] bcache: avoid clang -Wunintialized warning
+Git-commit: 78d4eb8ad9e1d413449d1b7a060f50b6efa81ebd
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+clang has identified a code path in which it thinks a
+variable may be unused:
+
+drivers/md/bcache/alloc.c:333:4: error: variable 'bucket' is used uninitialized whenever 'if' condition is false
+ [-Werror,-Wsometimes-uninitialized]
+ fifo_pop(&ca->free_inc, bucket);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/md/bcache/util.h:219:27: note: expanded from macro 'fifo_pop'
+ #define fifo_pop(fifo, i) fifo_pop_front(fifo, (i))
+ ^~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/md/bcache/util.h:189:6: note: expanded from macro 'fifo_pop_front'
+ if (_r) { \
+ ^~
+drivers/md/bcache/alloc.c:343:46: note: uninitialized use occurs here
+ allocator_wait(ca, bch_allocator_push(ca, bucket));
+ ^~~~~~
+drivers/md/bcache/alloc.c:287:7: note: expanded from macro 'allocator_wait'
+ if (cond) \
+ ^~~~
+drivers/md/bcache/alloc.c:333:4: note: remove the 'if' if its condition is always true
+ fifo_pop(&ca->free_inc, bucket);
+ ^
+drivers/md/bcache/util.h:219:27: note: expanded from macro 'fifo_pop'
+ #define fifo_pop(fifo, i) fifo_pop_front(fifo, (i))
+ ^
+drivers/md/bcache/util.h:189:2: note: expanded from macro 'fifo_pop_front'
+ if (_r) { \
+ ^
+drivers/md/bcache/alloc.c:331:15: note: initialize the variable 'bucket' to silence this warning
+ long bucket;
+ ^
+
+This cannot happen in practice because we only enter the loop
+if there is at least one element in the list.
+
+Slightly rearranging the code makes this clearer to both the
+reader and the compiler, which avoids the warning.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/alloc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index 5002838ea476..f8986effcb50 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -327,10 +327,11 @@ static int bch_allocator_thread(void *arg)
+ * possibly issue discards to them, then we add the bucket to
+ * the free list:
+ */
+- while (!fifo_empty(&ca->free_inc)) {
++ while (1) {
+ long bucket;
+
+- fifo_pop(&ca->free_inc, bucket);
++ if (!fifo_pop(&ca->free_inc, bucket))
++ break;
+
+ if (ca->discard) {
+ mutex_unlock(&ca->set->bucket_lock);
+--
+2.16.4
+
diff --git a/patches.suse/0005-bcache-Clean-up-bch_get_congested.patch b/patches.suse/0005-bcache-Clean-up-bch_get_congested.patch
new file mode 100644
index 0000000000..3ea8ede6aa
--- /dev/null
+++ b/patches.suse/0005-bcache-Clean-up-bch_get_congested.patch
@@ -0,0 +1,178 @@
+From 3a3947271cd6ce05c5b30c1250fa99de57410500 Mon Sep 17 00:00:00 2001
+From: George Spelvin <lkml@sdf.org>
+Date: Thu, 25 Apr 2019 00:48:30 +0800
+Subject: [PATCH] bcache: Clean up bch_get_congested()
+Git-commit: 3a3947271cd6ce05c5b30c1250fa99de57410500
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+There are a few nits in this function. They could in theory all
+be separate patches, but that's probably taking small commits
+too far.
+
+1) I added a brief comment saying what it does.
+
+2) I like to declare pointer parameters "const" where possible
+ for documentation reasons.
+
+3) It uses bitmap_weight(&rand, BITS_PER_LONG) to compute the Hamming
+weight of a 32-bit random number (giving a random integer with
+mean 16 and variance 8). Passing by reference in a 64-bit variable
+is silly; just use hweight32().
+
+4) Its helper function fract_exp_two is unnecessarily tangled.
+Gcc can optimize the multiply by (1 << x) to a shift, but it can
+be written in a much more straightforward way at the cost of one
+more bit of internal precision. Some analysis reveals that this
+bit is always available.
+
+This shrinks the object code for fract_exp_two(x, 6) from 23 bytes:
+
+0000000000000000 <foo1>:
+ 0: 89 f9 mov %edi,%ecx
+ 2: c1 e9 06 shr $0x6,%ecx
+ 5: b8 01 00 00 00 mov $0x1,%eax
+ a: d3 e0 shl %cl,%eax
+ c: 83 e7 3f and $0x3f,%edi
+ f: d3 e7 shl %cl,%edi
+ 11: c1 ef 06 shr $0x6,%edi
+ 14: 01 f8 add %edi,%eax
+ 16: c3 retq
+
+To 19:
+
+0000000000000017 <foo2>:
+ 17: 89 f8 mov %edi,%eax
+ 19: 83 e0 3f and $0x3f,%eax
+ 1c: 83 c0 40 add $0x40,%eax
+ 1f: 89 f9 mov %edi,%ecx
+ 21: c1 e9 06 shr $0x6,%ecx
+ 24: d3 e0 shl %cl,%eax
+ 26: c1 e8 06 shr $0x6,%eax
+ 29: c3 retq
+
+(Verified with 0 <= frac_bits <= 8, 0 <= x < 16<<frac_bits;
+both versions produce the same output.)
+
+5) And finally, the call to bch_get_congested() in check_should_bypass()
+is separated from the use of the value by multiple tests which
+could moot the need to compute it. Move the computation down to
+where it's needed. This also saves a local register to hold the
+computed value.
+
+Signed-off-by: George Spelvin <lkml@sdf.org>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/request.c | 15 ++++++++-------
+ drivers/md/bcache/request.h | 2 +-
+ drivers/md/bcache/util.h | 26 +++++++++++++++++++-------
+ 3 files changed, 28 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c
+index f11123079fe0..41adcd1546f1 100644
+--- a/drivers/md/bcache/request.c
++++ b/drivers/md/bcache/request.c
+@@ -329,12 +329,13 @@ void bch_data_insert(struct closure *cl)
+ bch_data_insert_start(cl);
+ }
+
+-/* Congested? */
+-
+-unsigned int bch_get_congested(struct cache_set *c)
++/*
++ * Congested? Return 0 (not congested) or the limit (in sectors)
++ * beyond which we should bypass the cache due to congestion.
++ */
++unsigned int bch_get_congested(const struct cache_set *c)
+ {
+ int i;
+- long rand;
+
+ if (!c->congested_read_threshold_us &&
+ !c->congested_write_threshold_us)
+@@ -353,8 +354,7 @@ unsigned int bch_get_congested(struct cache_set *c)
+ if (i > 0)
+ i = fract_exp_two(i, 6);
+
+- rand = get_random_int();
+- i -= bitmap_weight(&rand, BITS_PER_LONG);
++ i -= hweight32(get_random_u32());
+
+ return i > 0 ? i : 1;
+ }
+@@ -376,7 +376,7 @@ static bool check_should_bypass(struct cached_dev *dc, struct bio *bio)
+ {
+ struct cache_set *c = dc->disk.c;
+ unsigned int mode = cache_mode(dc);
+- unsigned int sectors, congested = bch_get_congested(c);
++ unsigned int sectors, congested;
+ struct task_struct *task = current;
+ struct io *i;
+
+@@ -412,6 +412,7 @@ static bool check_should_bypass(struct cached_dev *dc, struct bio *bio)
+ goto rescale;
+ }
+
++ congested = bch_get_congested(c);
+ if (!congested && !dc->sequential_cutoff)
+ goto rescale;
+
+diff --git a/drivers/md/bcache/request.h b/drivers/md/bcache/request.h
+index 721bf336ed1a..c64dbd7a91aa 100644
+--- a/drivers/md/bcache/request.h
++++ b/drivers/md/bcache/request.h
+@@ -33,7 +33,7 @@ struct data_insert_op {
+ BKEY_PADDED(replace_key);
+ };
+
+-unsigned int bch_get_congested(struct cache_set *c);
++unsigned int bch_get_congested(const struct cache_set *c);
+ void bch_data_insert(struct closure *cl);
+
+ void bch_cached_dev_request_init(struct cached_dev *dc);
+diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
+index 00aab6abcfe4..1fbced94e4cc 100644
+--- a/drivers/md/bcache/util.h
++++ b/drivers/md/bcache/util.h
+@@ -560,17 +560,29 @@ static inline uint64_t bch_crc64_update(uint64_t crc,
+ return crc;
+ }
+
+-/* Does linear interpolation between powers of two */
++/*
++ * A stepwise-linear pseudo-exponential. This returns 1 << (x >>
++ * frac_bits), with the less-significant bits filled in by linear
++ * interpolation.
++ *
++ * This can also be interpreted as a floating-point number format,
++ * where the low frac_bits are the mantissa (with implicit leading
++ * 1 bit), and the more significant bits are the exponent.
++ * The return value is 1.mantissa * 2^exponent.
++ *
++ * The way this is used, fract_bits is 6 and the largest possible
++ * input is CONGESTED_MAX-1 = 1023 (exponent 16, mantissa 0x1.fc),
++ * so the maximum output is 0x1fc00.
++ */
+ static inline unsigned int fract_exp_two(unsigned int x,
+ unsigned int fract_bits)
+ {
+- unsigned int fract = x & ~(~0 << fract_bits);
+-
+- x >>= fract_bits;
+- x = 1 << x;
+- x += (x * fract) >> fract_bits;
++ unsigned int mantissa = 1 << fract_bits; /* Implicit bit */
+
+- return x;
++ mantissa += x & (mantissa - 1);
++ x >>= fract_bits; /* The exponent */
++ /* Largest intermediate value 0x7f0000 */
++ return mantissa << x >> fract_bits;
+ }
+
+ void bch_bio_map(struct bio *bio, void *base);
+--
+2.16.4
+
diff --git a/patches.suse/0006-bcache-fix-a-race-between-cache-register-and-cachese.patch b/patches.suse/0006-bcache-fix-a-race-between-cache-register-and-cachese.patch
new file mode 100644
index 0000000000..ca1aa0d0e9
--- /dev/null
+++ b/patches.suse/0006-bcache-fix-a-race-between-cache-register-and-cachese.patch
@@ -0,0 +1,80 @@
+From a4b732a248d12cbdb46999daf0bf288c011335eb Mon Sep 17 00:00:00 2001
+From: Liang Chen <liangchen.linux@gmail.com>
+Date: Thu, 25 Apr 2019 00:48:31 +0800
+Subject: [PATCH] bcache: fix a race between cache register and cacheset
+ unregister
+Git-commit: a4b732a248d12cbdb46999daf0bf288c011335eb
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+There is a race between cache device register and cache set unregister.
+For an already registered cache device, register_bcache will call
+bch_is_open to iterate through all cachesets and check every cache
+there. The race occurs if cache_set_free executes at the same time and
+clears the caches right before ca is dereferenced in bch_is_open_cache.
+To close the race, let's make sure the clean up work is protected by
+the bch_register_lock as well.
+
+This issue can be reproduced as follows,
+while true; do echo /dev/XXX> /sys/fs/bcache/register ; done&
+while true; do echo 1> /sys/block/XXX/bcache/set/unregister ; done &
+
+and results in the following oops,
+
+[ +0.000053] BUG: unable to handle kernel NULL pointer dereference at 0000000000000998
+[ +0.000457] #PF error: [normal kernel read fault]
+[ +0.000464] PGD 800000003ca9d067 P4D 800000003ca9d067 PUD 3ca9c067 PMD 0
+[ +0.000388] Oops: 0000 [#1] SMP PTI
+[ +0.000269] CPU: 1 PID: 3266 Comm: bash Not tainted 5.0.0+ #6
+[ +0.000346] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.fc28 04/01/2014
+[ +0.000472] RIP: 0010:register_bcache+0x1829/0x1990 [bcache]
+[ +0.000344] Code: b0 48 83 e8 50 48 81 fa e0 e1 10 c0 0f 84 a9 00 00 00 48 89 c6 48 89 ca 0f b7 ba 54 04 00 00 4c 8b 82 60 0c 00 00 85 ff 74 2f <49> 3b a8 98 09 00 00 74 4e 44 8d 47 ff 31 ff 49 c1 e0 03 eb 0d
+[ +0.000839] RSP: 0018:ffff92ee804cbd88 EFLAGS: 00010202
+[ +0.000328] RAX: ffffffffc010e190 RBX: ffff918b5c6b5000 RCX: ffff918b7d8e0000
+[ +0.000399] RDX: ffff918b7d8e0000 RSI: ffffffffc010e190 RDI: 0000000000000001
+[ +0.000398] RBP: ffff918b7d318340 R08: 0000000000000000 R09: ffffffffb9bd2d7a
+[ +0.000385] R10: ffff918b7eb253c0 R11: ffffb95980f51200 R12: ffffffffc010e1a0
+[ +0.000411] R13: fffffffffffffff2 R14: 000000000000000b R15: ffff918b7e232620
+[ +0.000384] FS: 00007f955bec2740(0000) GS:ffff918b7eb00000(0000) knlGS:0000000000000000
+[ +0.000420] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ +0.000801] CR2: 0000000000000998 CR3: 000000003cad6000 CR4: 00000000001406e0
+[ +0.000837] Call Trace:
+[ +0.000682] ? _cond_resched+0x10/0x20
+[ +0.000691] ? __kmalloc+0x131/0x1b0
+[ +0.000710] kernfs_fop_write+0xfa/0x170
+[ +0.000733] __vfs_write+0x2e/0x190
+[ +0.000688] ? inode_security+0x10/0x30
+[ +0.000698] ? selinux_file_permission+0xd2/0x120
+[ +0.000752] ? security_file_permission+0x2b/0x100
+[ +0.000753] vfs_write+0xa8/0x1a0
+[ +0.000676] ksys_write+0x4d/0xb0
+[ +0.000699] do_syscall_64+0x3a/0xf0
+[ +0.000692] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1517,6 +1517,7 @@ static void cache_set_free(struct closur
+ bch_btree_cache_free(c);
+ bch_journal_free(c);
+
++ mutex_lock(&bch_register_lock);
+ for_each_cache(ca, c, i)
+ if (ca) {
+ ca->set = NULL;
+@@ -1539,7 +1540,6 @@ static void cache_set_free(struct closur
+ mempool_destroy(c->search);
+ kfree(c->devices);
+
+- mutex_lock(&bch_register_lock);
+ list_del(&c->list);
+ mutex_unlock(&bch_register_lock);
+
diff --git a/patches.suse/0007-bcache-move-definition-of-int-ret-out-of-macro-read_.patch b/patches.suse/0007-bcache-move-definition-of-int-ret-out-of-macro-read_.patch
new file mode 100644
index 0000000000..5f7fa56ec2
--- /dev/null
+++ b/patches.suse/0007-bcache-move-definition-of-int-ret-out-of-macro-read_.patch
@@ -0,0 +1,56 @@
+From 14215ee01f6377c81c25c2cecda729e8811d2826 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:32 +0800
+Subject: [PATCH] bcache: move definition of 'int ret' out of macro
+ read_bucket()
+Git-commit: 14215ee01f6377c81c25c2cecda729e8811d2826
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+'int ret' is defined as a local variable inside macro read_bucket().
+Since this macro is called multiple times, and following patches will
+use a 'int ret' variable in bch_journal_read(), this patch moves
+definition of 'int ret' from macro read_bucket() to range of function
+bch_journal_read().
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index b2fd412715b1..6e18057d1d82 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -147,7 +147,7 @@ int bch_journal_read(struct cache_set *c, struct list_head *list)
+ {
+ #define read_bucket(b) \
+ ({ \
+- int ret = journal_read_bucket(ca, list, b); \
++ ret = journal_read_bucket(ca, list, b); \
+ __set_bit(b, bitmap); \
+ if (ret < 0) \
+ return ret; \
+@@ -156,6 +156,7 @@ int bch_journal_read(struct cache_set *c, struct list_head *list)
+
+ struct cache *ca;
+ unsigned int iter;
++ int ret = 0;
+
+ for_each_cache(ca, c, iter) {
+ struct journal_device *ja = &ca->journal;
+@@ -267,7 +268,7 @@ int bch_journal_read(struct cache_set *c, struct list_head *list)
+ struct journal_replay,
+ list)->j.seq;
+
+- return 0;
++ return ret;
+ #undef read_bucket
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/0008-bcache-never-set-KEY_PTRS-of-journal-key-to-0-in-jou.patch b/patches.suse/0008-bcache-never-set-KEY_PTRS-of-journal-key-to-0-in-jou.patch
new file mode 100644
index 0000000000..cf5c546818
--- /dev/null
+++ b/patches.suse/0008-bcache-never-set-KEY_PTRS-of-journal-key-to-0-in-jou.patch
@@ -0,0 +1,100 @@
+From 1bee2addc0c8470c8aaa65ef0599eeae96dd88bc Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:33 +0800
+Subject: [PATCH] bcache: never set KEY_PTRS of journal key to 0 in
+ journal_reclaim()
+Git-commit: 1bee2addc0c8470c8aaa65ef0599eeae96dd88bc
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+In journal_reclaim() ja->cur_idx of each cache will be update to
+reclaim available journal buckets. Variable 'int n' is used to count how
+many cache is successfully reclaimed, then n is set to c->journal.key
+by SET_KEY_PTRS(). Later in journal_write_unlocked(), a for_each_cache()
+loop will write the jset data onto each cache.
+
+The problem is, if all jouranl buckets on each cache is full, the
+following code in journal_reclaim(),
+
+529 for_each_cache(ca, c, iter) {
+530 struct journal_device *ja = &ca->journal;
+531 unsigned int next = (ja->cur_idx + 1) % ca->sb.njournal_buckets;
+532
+533 /* No space available on this device */
+534 if (next == ja->discard_idx)
+535 continue;
+536
+537 ja->cur_idx = next;
+538 k->ptr[n++] = MAKE_PTR(0,
+539 bucket_to_sector(c, ca->sb.d[ja->cur_idx]),
+540 ca->sb.nr_this_dev);
+541 }
+542
+543 bkey_init(k);
+544 SET_KEY_PTRS(k, n);
+
+If there is no available bucket to reclaim, the if() condition at line
+534 will always true, and n remains 0. Then at line 544, SET_KEY_PTRS()
+will set KEY_PTRS field of c->journal.key to 0.
+
+Setting KEY_PTRS field of c->journal.key to 0 is wrong. Because in
+journal_write_unlocked() the journal data is written in following loop,
+
+649 for (i = 0; i < KEY_PTRS(k); i++) {
+650-671 submit journal data to cache device
+672 }
+
+If KEY_PTRS field is set to 0 in jouranl_reclaim(), the journal data
+won't be written to cache device here. If system crahed or rebooted
+before bkeys of the lost journal entries written into btree nodes, data
+corruption will be reported during bcache reload after rebooting the
+system.
+
+Indeed there is only one cache in a cache set, there is no need to set
+KEY_PTRS field in journal_reclaim() at all. But in order to keep the
+for_each_cache() logic consistent for now, this patch fixes the above
+problem by not setting 0 KEY_PTRS of journal key, if there is no bucket
+available to reclaim.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 6e18057d1d82..5180bed911ef 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -541,11 +541,11 @@ static void journal_reclaim(struct cache_set *c)
+ ca->sb.nr_this_dev);
+ }
+
+- bkey_init(k);
+- SET_KEY_PTRS(k, n);
+-
+- if (n)
++ if (n) {
++ bkey_init(k);
++ SET_KEY_PTRS(k, n);
+ c->journal.blocks_free = c->sb.bucket_size >> c->block_bits;
++ }
+ out:
+ if (!journal_full(&c->journal))
+ __closure_wake_up(&c->journal.wait);
+@@ -672,6 +672,9 @@ static void journal_write_unlocked(struct closure *cl)
+ ca->journal.seq[ca->journal.cur_idx] = w->data->seq;
+ }
+
++ /* If KEY_PTRS(k) == 0, this jset gets lost in air */
++ BUG_ON(i == 0);
++
+ atomic_dec_bug(&fifo_back(&c->journal.pin));
+ bch_journal_next(&c->journal);
+ journal_reclaim(c);
+--
+2.16.4
+
diff --git a/patches.suse/0009-bcache-add-failure-check-to-run_cache_set-for-journa.patch b/patches.suse/0009-bcache-add-failure-check-to-run_cache_set-for-journa.patch
new file mode 100644
index 0000000000..5522b9c5ab
--- /dev/null
+++ b/patches.suse/0009-bcache-add-failure-check-to-run_cache_set-for-journa.patch
@@ -0,0 +1,93 @@
+From ce3e4cfb59cb382f8e5ce359238aa580d4ae7778 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:34 +0800
+Subject: [PATCH] bcache: add failure check to run_cache_set() for journal
+ replay
+Git-commit: ce3e4cfb59cb382f8e5ce359238aa580d4ae7778
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+Currently run_cache_set() has no return value, if there is failure in
+bch_journal_replay(), the caller of run_cache_set() has no idea about
+such failure and just continue to execute following code after
+run_cache_set(). The internal failure is triggered inside
+bch_journal_replay() and being handled in async way. This behavior is
+inefficient, while failure handling inside bch_journal_replay(), cache
+register code is still running to start the cache set. Registering and
+unregistering code running as same time may introduce some rare race
+condition, and make the code to be more hard to be understood.
+
+This patch adds return value to run_cache_set(), and returns -EIO if
+bch_journal_rreplay() fails. Then caller of run_cache_set() may detect
+such failure and stop registering code flow immedidately inside
+register_cache_set().
+
+If journal replay fails, run_cache_set() can report error immediately
+to register_cache_set(). This patch makes the failure handling for
+bch_journal_replay() be in synchronized way, easier to understand and
+debug, and avoid poetential race condition for register-and-unregister
+in same time.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 53c5e3e0ac22..8c7fdada0acf 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1773,7 +1773,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
+ return NULL;
+ }
+
+-static void run_cache_set(struct cache_set *c)
++static int run_cache_set(struct cache_set *c)
+ {
+ const char *err = "cannot allocate memory";
+ struct cached_dev *dc, *t;
+@@ -1867,7 +1867,9 @@ static void run_cache_set(struct cache_set *c)
+ if (j->version < BCACHE_JSET_VERSION_UUID)
+ __uuid_write(c);
+
+- bch_journal_replay(c, &journal);
++ err = "bcache: replay journal failed";
++ if (bch_journal_replay(c, &journal))
++ goto err;
+ } else {
+ pr_notice("invalidating existing data");
+
+@@ -1935,11 +1937,13 @@ static void run_cache_set(struct cache_set *c)
+ flash_devs_run(c);
+
+ set_bit(CACHE_SET_RUNNING, &c->flags);
+- return;
++ return 0;
+ err:
+ closure_sync(&cl);
+ /* XXX: test this, it's broken */
+ bch_cache_set_error(c, "%s", err);
++
++ return -EIO;
+ }
+
+ static bool can_attach_cache(struct cache *ca, struct cache_set *c)
+@@ -2003,8 +2007,11 @@ static const char *register_cache_set(struct cache *ca)
+ ca->set->cache[ca->sb.nr_this_dev] = ca;
+ c->cache_by_alloc[c->caches_loaded++] = ca;
+
+- if (c->caches_loaded == c->sb.nr_in_set)
+- run_cache_set(c);
++ if (c->caches_loaded == c->sb.nr_in_set) {
++ err = "failed to run cache set";
++ if (run_cache_set(c) < 0)
++ goto err;
++ }
+
+ return NULL;
+ err:
+--
+2.16.4
+
diff --git a/patches.suse/0010-bcache-add-comments-for-kobj-release-callback-routin.patch b/patches.suse/0010-bcache-add-comments-for-kobj-release-callback-routin.patch
new file mode 100644
index 0000000000..c04e2107f3
--- /dev/null
+++ b/patches.suse/0010-bcache-add-comments-for-kobj-release-callback-routin.patch
@@ -0,0 +1,68 @@
+From 2d17456eb1cc78803b999fdd503c2dbd42a7d3da Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:35 +0800
+Subject: [PATCH] bcache: add comments for kobj release callback routine
+Git-commit: 2d17456eb1cc78803b999fdd503c2dbd42a7d3da
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+Bcache has several routines to release resources in implicit way, they
+are called when the associated kobj released. This patch adds code
+comments to notice when and which release callback will be called,
+- When dc->disk.kobj released:
+ void bch_cached_dev_release(struct kobject *kobj)
+- When d->kobj released:
+ void bch_flash_dev_release(struct kobject *kobj)
+- When c->kobj released:
+ void bch_cache_set_release(struct kobject *kobj)
+- When ca->kobj released
+ void bch_cache_release(struct kobject *kobj)
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 8c7fdada0acf..f8d80adcafec 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1172,6 +1172,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ return 0;
+ }
+
++/* when dc->disk.kobj released */
+ void bch_cached_dev_release(struct kobject *kobj)
+ {
+ struct cached_dev *dc = container_of(kobj, struct cached_dev,
+@@ -1324,6 +1325,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
+
+ /* Flash only volumes */
+
++/* When d->kobj released */
+ void bch_flash_dev_release(struct kobject *kobj)
+ {
+ struct bcache_device *d = container_of(kobj, struct bcache_device,
+@@ -1494,6 +1496,7 @@ bool bch_cache_set_error(struct cache_set *c, const char *fmt, ...)
+ return true;
+ }
+
++/* When c->kobj released */
+ void bch_cache_set_release(struct kobject *kobj)
+ {
+ struct cache_set *c = container_of(kobj, struct cache_set, kobj);
+@@ -2021,6 +2024,7 @@ static const char *register_cache_set(struct cache *ca)
+
+ /* Cache device */
+
++/* When ca->kobj released */
+ void bch_cache_release(struct kobject *kobj)
+ {
+ struct cache *ca = container_of(kobj, struct cache, kobj);
+--
+2.16.4
+
diff --git a/patches.suse/0011-bcache-return-error-immediately-in-bch_journal_repla.patch b/patches.suse/0011-bcache-return-error-immediately-in-bch_journal_repla.patch
new file mode 100644
index 0000000000..18e69791ec
--- /dev/null
+++ b/patches.suse/0011-bcache-return-error-immediately-in-bch_journal_repla.patch
@@ -0,0 +1,53 @@
+From 68d10e6979a3b59e3cd2e90bfcafed79c4cf180a Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:36 +0800
+Subject: [PATCH] bcache: return error immediately in bch_journal_replay()
+Git-commit: 68d10e6979a3b59e3cd2e90bfcafed79c4cf180a
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+When failure happens inside bch_journal_replay(), calling
+cache_set_err_on() and handling the failure in async way is not a good
+idea. Because after bch_journal_replay() returns, registering code will
+continue to execute following steps, and unregistering code triggered
+by cache_set_err_on() is running in same time. First it is unnecessary
+to handle failure and unregister cache set in an async way, second there
+might be potential race condition to run register and unregister code
+for same cache set.
+
+So in this patch, if failure happens in bch_journal_replay(), we don't
+call cache_set_err_on(), and just print out the same error message to
+kernel message buffer, then return -EIO immediately caller. Then caller
+can detect such failure and handle it in synchrnozied way.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 5180bed911ef..828ab474696a 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -331,9 +331,12 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+ list_for_each_entry(i, list, list) {
+ BUG_ON(i->pin && atomic_read(i->pin) != 1);
+
+- cache_set_err_on(n != i->j.seq, s,
+-"bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)",
+- n, i->j.seq - 1, start, end);
++ if (n != i->j.seq) {
++ pr_err("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)",
++ n, i->j.seq - 1, start, end);
++ ret = -EIO;
++ goto err;
++ }
+
+ for (k = i->j.start;
+ k < bset_bkey_last(&i->j);
+--
+2.16.4
+
diff --git a/patches.suse/0012-bcache-add-error-check-for-calling-register_bdev.patch b/patches.suse/0012-bcache-add-error-check-for-calling-register_bdev.patch
new file mode 100644
index 0000000000..d860eb44d0
--- /dev/null
+++ b/patches.suse/0012-bcache-add-error-check-for-calling-register_bdev.patch
@@ -0,0 +1,96 @@
+From 88c12d42d2bb6e05deb3cfd24d12f6fe80544575 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:37 +0800
+Subject: [PATCH] bcache: add error check for calling register_bdev()
+Git-commit: 88c12d42d2bb6e05deb3cfd24d12f6fe80544575
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+This patch adds return value to register_bdev(). Then if failure happens
+inside register_bdev(), its caller register_bcache() may detect and
+handle the failure more properly.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index f8d80adcafec..fde334939545 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1279,7 +1279,7 @@ static int cached_dev_init(struct cached_dev *dc, unsigned int block_size)
+
+ /* Cached device - bcache superblock */
+
+-static void register_bdev(struct cache_sb *sb, struct page *sb_page,
++static int register_bdev(struct cache_sb *sb, struct page *sb_page,
+ struct block_device *bdev,
+ struct cached_dev *dc)
+ {
+@@ -1317,10 +1317,11 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page,
+ BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
+ bch_cached_dev_run(dc);
+
+- return;
++ return 0;
+ err:
+ pr_notice("error %s: %s", dc->backing_dev_name, err);
+ bcache_device_stop(&dc->disk);
++ return -EIO;
+ }
+
+ /* Flash only volumes */
+@@ -2271,7 +2272,7 @@ static bool bch_is_open(struct block_device *bdev)
+ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ const char *buffer, size_t size)
+ {
+- ssize_t ret = size;
++ ssize_t ret = -EINVAL;
+ const char *err = "cannot allocate memory";
+ char *path = NULL;
+ struct cache_sb *sb = NULL;
+@@ -2305,7 +2306,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ if (!IS_ERR(bdev))
+ bdput(bdev);
+ if (attr == &ksysfs_register_quiet)
+- goto out;
++ goto quiet_out;
+ }
+ goto err;
+ }
+@@ -2326,8 +2327,10 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ goto err_close;
+
+ mutex_lock(&bch_register_lock);
+- register_bdev(sb, sb_page, bdev, dc);
++ ret = register_bdev(sb, sb_page, bdev, dc);
+ mutex_unlock(&bch_register_lock);
++ if (ret < 0)
++ goto err;
+ } else {
+ struct cache *ca = kzalloc(sizeof(*ca), GFP_KERNEL);
+
+@@ -2337,6 +2340,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ if (register_cache(sb, sb_page, bdev, ca) != 0)
+ goto err;
+ }
++quiet_out:
++ ret = size;
+ out:
+ if (sb_page)
+ put_page(sb_page);
+@@ -2349,7 +2354,6 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ err:
+ pr_info("error %s: %s", path, err);
+- ret = -EINVAL;
+ goto out;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/0013-bcache-Add-comments-for-blkdev_put-in-registration-c.patch b/patches.suse/0013-bcache-Add-comments-for-blkdev_put-in-registration-c.patch
new file mode 100644
index 0000000000..5e891496a3
--- /dev/null
+++ b/patches.suse/0013-bcache-Add-comments-for-blkdev_put-in-registration-c.patch
@@ -0,0 +1,58 @@
+From bb6d355c2aff42d4075a8e7428dd72cb009d6143 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:38 +0800
+Subject: [PATCH] bcache: Add comments for blkdev_put() in registration code
+ path
+Git-commit: bb6d355c2aff42d4075a8e7428dd72cb009d6143
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+Add comments to explain why in register_bcache() blkdev_put() won't
+be called in two location. Add comments to explain why blkdev_put()
+must be called in register_cache() when cache_alloc() failed.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index fde334939545..fa856b2ca7af 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2189,6 +2189,12 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
+
+ ret = cache_alloc(ca);
+ if (ret != 0) {
++ /*
++ * If we failed here, it means ca->kobj is not initialized yet,
++ * kobject_put() won't be called and there is no chance to
++ * call blkdev_put() to bdev in bch_cache_release(). So we
++ * explicitly call blkdev_put() here.
++ */
+ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL);
+ if (ret == -ENOMEM)
+ err = "cache_alloc(): -ENOMEM";
+@@ -2329,6 +2335,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ mutex_lock(&bch_register_lock);
+ ret = register_bdev(sb, sb_page, bdev, dc);
+ mutex_unlock(&bch_register_lock);
++ /* blkdev_put() will be called in cached_dev_free() */
+ if (ret < 0)
+ goto err;
+ } else {
+@@ -2337,6 +2344,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ if (!ca)
+ goto err_close;
+
++ /* blkdev_put() will be called in bch_cache_release() */
+ if (register_cache(sb, sb_page, bdev, ca) != 0)
+ goto err;
+ }
+--
+2.16.4
+
diff --git a/patches.suse/0014-bcache-add-comments-for-closure_fn-to-be-called-in-c.patch b/patches.suse/0014-bcache-add-comments-for-closure_fn-to-be-called-in-c.patch
new file mode 100644
index 0000000000..008d1df742
--- /dev/null
+++ b/patches.suse/0014-bcache-add-comments-for-closure_fn-to-be-called-in-c.patch
@@ -0,0 +1,49 @@
+From 63d63b51d70fb5155754dcf0baa2c1700bcafcb0 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:39 +0800
+Subject: [PATCH] bcache: add comments for closure_fn to be called in
+ closure_queue()
+Git-commit: 63d63b51d70fb5155754dcf0baa2c1700bcafcb0
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+Add code comments to explain which call back function might be called
+for the closure_queue(). This is an effort to make code to be more
+understandable for readers.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index fa856b2ca7af..0363ab534c8e 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -662,6 +662,11 @@ static const struct block_device_operations bcache_ops = {
+ void bcache_device_stop(struct bcache_device *d)
+ {
+ if (!test_and_set_bit(BCACHE_DEV_CLOSING, &d->flags))
++ /*
++ * closure_fn set to
++ * - cached device: cached_dev_flush()
++ * - flash dev: flash_dev_flush()
++ */
+ closure_queue(&d->cl);
+ }
+
+@@ -1675,6 +1680,7 @@ static void __cache_set_unregister(struct closure *cl)
+ void bch_cache_set_stop(struct cache_set *c)
+ {
+ if (!test_and_set_bit(CACHE_SET_STOPPING, &c->flags))
++ /* closure_fn set to __cache_set_unregister() */
+ closure_queue(&c->caching);
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/0015-bcache-improve-bcache_reboot.patch b/patches.suse/0015-bcache-improve-bcache_reboot.patch
new file mode 100644
index 0000000000..bd117531e3
--- /dev/null
+++ b/patches.suse/0015-bcache-improve-bcache_reboot.patch
@@ -0,0 +1,62 @@
+From eb8cbb6df38f6e5124a3d5f1f8a3dbf519537c60 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Thu, 25 Apr 2019 00:48:40 +0800
+Subject: [PATCH] bcache: improve bcache_reboot()
+Git-commit: eb8cbb6df38f6e5124a3d5f1f8a3dbf519537c60
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+This patch tries to release mutex bch_register_lock early, to give
+chance to stop cache set and bcache device early.
+
+This patch also expends time out of stopping all bcache device from
+2 seconds to 10 seconds, because stopping writeback rate update worker
+may delay for 5 seconds, 2 seconds is not enough.
+
+After this patch applied, stopping bcache devices during system reboot
+or shutdown is very hard to be observed any more.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 0363ab534c8e..3f34b96ebbc3 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2397,10 +2397,19 @@ static int bcache_reboot(struct notifier_block *n, unsigned long code, void *x)
+ list_for_each_entry_safe(dc, tdc, &uncached_devices, list)
+ bcache_device_stop(&dc->disk);
+
++ mutex_unlock(&bch_register_lock);
++
++ /*
++ * Give an early chance for other kthreads and
++ * kworkers to stop themselves
++ */
++ schedule();
++
+ /* What's a condition variable? */
+ while (1) {
+- long timeout = start + 2 * HZ - jiffies;
++ long timeout = start + 10 * HZ - jiffies;
+
++ mutex_lock(&bch_register_lock);
+ stopped = list_empty(&bch_cache_sets) &&
+ list_empty(&uncached_devices);
+
+@@ -2412,7 +2421,6 @@ static int bcache_reboot(struct notifier_block *n, unsigned long code, void *x)
+
+ mutex_unlock(&bch_register_lock);
+ schedule_timeout(timeout);
+- mutex_lock(&bch_register_lock);
+ }
+
+ finish_wait(&unregister_wait, &wait);
+--
+2.16.4
+
diff --git a/patches.suse/0016-bcache-fix-failure-in-journal-relplay.patch b/patches.suse/0016-bcache-fix-failure-in-journal-relplay.patch
new file mode 100644
index 0000000000..290087843d
--- /dev/null
+++ b/patches.suse/0016-bcache-fix-failure-in-journal-relplay.patch
@@ -0,0 +1,89 @@
+From 631207314d88e9091be02fbdd1fdadb1ae2ed79a Mon Sep 17 00:00:00 2001
+From: Tang Junhui <tang.junhui.linux@gmail.com>
+Date: Thu, 25 Apr 2019 00:48:41 +0800
+Subject: [PATCH] bcache: fix failure in journal relplay
+Git-commit: 631207314d88e9091be02fbdd1fdadb1ae2ed79a
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+journal replay failed with messages:
+Sep 10 19:10:43 ceph kernel: bcache: error on
+Bb379a64-e44e-4812-b91d-a5599871a3b1: bcache: journal entries
+2057493-2057567 missing! (replaying 2057493-2076601), disabling
+caching
+
+The reason is in journal_reclaim(), when discard is enabled, we send
+discard command and reclaim those journal buckets whose seq is old
+than the last_seq_now, but before we write a journal with last_seq_now,
+the machine is restarted, so the journal with the last_seq_now is not
+written to the journal bucket, and the last_seq_wrote in the newest
+journal is old than last_seq_now which we expect to be, so when we doing
+replay, journals from last_seq_wrote to last_seq_now are missing.
+
+It's hard to write a journal immediately after journal_reclaim(),
+and it harmless if those missed journal are caused by discarding
+since those journals are already wrote to btree node. So, if miss
+seqs are started from the beginning journal, we treat it as normal,
+and only print a message to show the miss journal, and point out
+it maybe caused by discarding.
+
+Patch v2 add a judgement condition to ignore the missed journal
+only when discard enabled as Coly suggested.
+
+(Coly Li: rebase the patch with other changes in bch_journal_replay())
+
+Signed-off-by: Tang Junhui <tang.junhui.linux@gmail.com>
+Tested-by: Dennis Schridde <devurandom@gmx.net>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 25 +++++++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 828ab474696a..f9afb164b887 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -318,6 +318,18 @@ void bch_journal_mark(struct cache_set *c, struct list_head *list)
+ }
+ }
+
++bool is_discard_enabled(struct cache_set *s)
++{
++ struct cache *ca;
++ unsigned int i;
++
++ for_each_cache(ca, s, i)
++ if (ca->discard)
++ return true;
++
++ return false;
++}
++
+ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+ {
+ int ret = 0, keys = 0, entries = 0;
+@@ -332,10 +344,15 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+ BUG_ON(i->pin && atomic_read(i->pin) != 1);
+
+ if (n != i->j.seq) {
+- pr_err("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)",
+- n, i->j.seq - 1, start, end);
+- ret = -EIO;
+- goto err;
++ if (n == start && is_discard_enabled(s))
++ pr_info("bcache: journal entries %llu-%llu may be discarded! (replaying %llu-%llu)",
++ n, i->j.seq - 1, start, end);
++ else {
++ pr_err("bcache: journal entries %llu-%llu missing! (replaying %llu-%llu)",
++ n, i->j.seq - 1, start, end);
++ ret = -EIO;
++ goto err;
++ }
+ }
+
+ for (k = i->j.start;
+--
+2.16.4
+
diff --git a/patches.suse/0017-bcache-fix-wrong-usage-use-after-freed-on-keylist-in.patch b/patches.suse/0017-bcache-fix-wrong-usage-use-after-freed-on-keylist-in.patch
new file mode 100644
index 0000000000..5316dd48fa
--- /dev/null
+++ b/patches.suse/0017-bcache-fix-wrong-usage-use-after-freed-on-keylist-in.patch
@@ -0,0 +1,41 @@
+From f16277ca20acf2c213fcd4b645f4c1cffcadf533 Mon Sep 17 00:00:00 2001
+From: Shenghui Wang <shhuiw@foxmail.com>
+Date: Thu, 25 Apr 2019 00:48:42 +0800
+Subject: [PATCH] bcache: fix wrong usage use-after-freed on keylist in
+ out_nocoalesce branch of btree_gc_coalesce
+Git-commit: f16277ca20acf2c213fcd4b645f4c1cffcadf533
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+Elements of keylist should be accessed before the list is freed.
+Move bch_keylist_free() calling after the while loop to avoid wrong
+content accessed.
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/btree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 64def336f053..b139858b0802 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -1476,11 +1476,11 @@ static int btree_gc_coalesce(struct btree *b, struct btree_op *op,
+
+ out_nocoalesce:
+ closure_sync(&cl);
+- bch_keylist_free(&keylist);
+
+ while ((k = bch_keylist_pop(&keylist)))
+ if (!bkey_cmp(k, &ZERO_KEY))
+ atomic_dec(&b->c->prio_blocked);
++ bch_keylist_free(&keylist);
+
+ for (i = 0; i < nodes; i++)
+ if (!IS_ERR_OR_NULL(new_nodes[i])) {
+--
+2.16.4
+
diff --git a/patches.suse/0018-bcache-avoid-potential-memleak-of-list-of-journal_re.patch b/patches.suse/0018-bcache-avoid-potential-memleak-of-list-of-journal_re.patch
new file mode 100644
index 0000000000..d41b24f07b
--- /dev/null
+++ b/patches.suse/0018-bcache-avoid-potential-memleak-of-list-of-journal_re.patch
@@ -0,0 +1,62 @@
+From 95f18c9d1310730d075499a75aaf13bcd60405a7 Mon Sep 17 00:00:00 2001
+From: Shenghui Wang <shhuiw@foxmail.com>
+Date: Thu, 25 Apr 2019 00:48:43 +0800
+Subject: [PATCH] bcache: avoid potential memleak of list of journal_replay(s)
+ in the CACHE_SYNC branch of run_cache_set
+Git-commit: 95f18c9d1310730d075499a75aaf13bcd60405a7
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+In the CACHE_SYNC branch of run_cache_set(), LIST_HEAD(journal) is used
+to collect journal_replay(s) and filled by bch_journal_read().
+
+If all goes well, bch_journal_replay() will release the list of
+jounal_replay(s) at the end of the branch.
+
+If something goes wrong, code flow will jump to the label "err:" and leave
+the list unreleased.
+
+This patch will release the list of journal_replay(s) in the case of
+error detected.
+
+v1 -> v2:
+* Move the release code to the location after label 'err:' to
+ simply the change.
+
+Signed-off-by: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 3f34b96ebbc3..0ffe9acee9d8 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1790,6 +1790,8 @@ static int run_cache_set(struct cache_set *c)
+ struct cache *ca;
+ struct closure cl;
+ unsigned int i;
++ LIST_HEAD(journal);
++ struct journal_replay *l;
+
+ closure_init_stack(&cl);
+
+@@ -1949,6 +1951,12 @@ static int run_cache_set(struct cache_set *c)
+ set_bit(CACHE_SET_RUNNING, &c->flags);
+ return 0;
+ err:
++ while (!list_empty(&journal)) {
++ l = list_first_entry(&journal, struct journal_replay, list);
++ list_del(&l->list);
++ kfree(l);
++ }
++
+ closure_sync(&cl);
+ /* XXX: test this, it's broken */
+ bch_cache_set_error(c, "%s", err);
+--
+2.16.4
+
diff --git a/patches.suse/0019-bcache-remove-redundant-LIST_HEAD-journal-from-run_c.patch b/patches.suse/0019-bcache-remove-redundant-LIST_HEAD-journal-from-run_c.patch
new file mode 100644
index 0000000000..e45265c48b
--- /dev/null
+++ b/patches.suse/0019-bcache-remove-redundant-LIST_HEAD-journal-from-run_c.patch
@@ -0,0 +1,41 @@
+From cdca22bcbc64fc83dadb8d927df400a8d86ddabb Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Tue, 30 Apr 2019 22:02:25 +0800
+Subject: [PATCH] bcache: remove redundant LIST_HEAD(journal) from
+ run_cache_set()
+Git-commit: cdca22bcbc64fc83dadb8d927df400a8d86ddabb
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+Commit 95f18c9d1310 ("bcache: avoid potential memleak of list of
+journal_replay(s) in the CACHE_SYNC branch of run_cache_set") forgets
+to remove the original define of LIST_HEAD(journal), which makes
+the change no take effect. This patch removes redundant variable
+LIST_HEAD(journal) from run_cache_set(), to make Shenghui's fix
+working.
+
+Fixes: 95f18c9d1310 ("bcache: avoid potential memleak of list of journal_replay(s) in the CACHE_SYNC branch of run_cache_set")
+Reported-by: Juha Aatrokoski <juha.aatrokoski@aalto.fi>
+Cc: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 0ffe9acee9d8..1b63ac876169 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1800,7 +1800,6 @@ static int run_cache_set(struct cache_set *c)
+ set_gc_sectors(c);
+
+ if (CACHE_SYNC(&c->sb)) {
+- LIST_HEAD(journal);
+ struct bkey *k;
+ struct jset *j;
+
+--
+2.16.4
+
diff --git a/patches.suse/0020-bcache-make-is_discard_enabled-static.patch b/patches.suse/0020-bcache-make-is_discard_enabled-static.patch
new file mode 100644
index 0000000000..8e0ccf68ab
--- /dev/null
+++ b/patches.suse/0020-bcache-make-is_discard_enabled-static.patch
@@ -0,0 +1,33 @@
+From 2d5abb9a1e8e92b25e781f0c3537a5b3b4b2f033 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Wed, 1 May 2019 06:34:09 -0600
+Subject: [PATCH] bcache: make is_discard_enabled() static
+Git-commit: 2d5abb9a1e8e92b25e781f0c3537a5b3b4b2f033
+Patch-mainline: v5.2-rc1
+References: bsc#1140652
+
+It's not used outside this file.
+
+Fixes: 631207314d88 ("bcache: fix failure in journal relplay")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Coly Li <colyli@suse.de>
+---
+ drivers/md/bcache/journal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index f9afb164b887..12dae9348147 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -318,7 +318,7 @@ void bch_journal_mark(struct cache_set *c, struct list_head *list)
+ }
+ }
+
+-bool is_discard_enabled(struct cache_set *s)
++static bool is_discard_enabled(struct cache_set *s)
+ {
+ struct cache *ca;
+ unsigned int i;
+--
+2.16.4
+
diff --git a/patches.suse/0021-bcache-fix-stack-corruption-by-PRECEDING_KEY.patch b/patches.suse/0021-bcache-fix-stack-corruption-by-PRECEDING_KEY.patch
new file mode 100644
index 0000000000..9f91861e94
--- /dev/null
+++ b/patches.suse/0021-bcache-fix-stack-corruption-by-PRECEDING_KEY.patch
@@ -0,0 +1,132 @@
+From 31b90956b124240aa8c63250243ae1a53585c5e2 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Mon, 10 Jun 2019 06:13:34 +0800
+Subject: [PATCH] bcache: fix stack corruption by PRECEDING_KEY()
+Git-commit: 31b90956b124240aa8c63250243ae1a53585c5e2
+Patch-mainline: v5.2-rc5
+References: bsc#1140652
+
+Recently people report bcache code compiled with gcc9 is broken, one of
+the buggy behavior I observe is that two adjacent 4KB I/Os should merge
+into one but they don't. Finally it turns out to be a stack corruption
+caused by macro PRECEDING_KEY().
+
+See how PRECEDING_KEY() is defined in bset.h,
+437 #define PRECEDING_KEY(_k) \
+438 ({ \
+439 struct bkey *_ret = NULL; \
+440 \
+441 if (KEY_INODE(_k) || KEY_OFFSET(_k)) { \
+442 _ret = &KEY(KEY_INODE(_k), KEY_OFFSET(_k), 0); \
+443 \
+444 if (!_ret->low) \
+445 _ret->high--; \
+446 _ret->low--; \
+447 } \
+448 \
+449 _ret; \
+450 })
+
+At line 442, _ret points to address of a on-stack variable combined by
+KEY(), the life range of this on-stack variable is in line 442-446,
+once _ret is returned to bch_btree_insert_key(), the returned address
+points to an invalid stack address and this address is overwritten in
+the following called bch_btree_iter_init(). Then argument 'search' of
+bch_btree_iter_init() points to some address inside stackframe of
+bch_btree_iter_init(), exact address depends on how the compiler
+allocates stack space. Now the stack is corrupted.
+
+Fixes: 0eacac22034c ("bcache: PRECEDING_KEY()")
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Rolf Fokkens <rolf@rolffokkens.nl>
+Reviewed-by: Pierre JUHEN <pierre.juhen@orange.fr>
+Tested-by: Shenghui Wang <shhuiw@foxmail.com>
+Tested-by: Pierre JUHEN <pierre.juhen@orange.fr>
+Cc: Kent Overstreet <kent.overstreet@gmail.com>
+Cc: Nix <nix@esperi.org.uk>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bset.c | 16 +++++++++++++---
+ drivers/md/bcache/bset.h | 34 ++++++++++++++++++++--------------
+ 2 files changed, 33 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 8f07fa6e1739..268f1b685084 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -887,12 +887,22 @@ unsigned int bch_btree_insert_key(struct btree_keys *b, struct bkey *k,
+ struct bset *i = bset_tree_last(b)->data;
+ struct bkey *m, *prev = NULL;
+ struct btree_iter iter;
++ struct bkey preceding_key_on_stack = ZERO_KEY;
++ struct bkey *preceding_key_p = &preceding_key_on_stack;
+
+ BUG_ON(b->ops->is_extents && !KEY_SIZE(k));
+
+- m = bch_btree_iter_init(b, &iter, b->ops->is_extents
+- ? PRECEDING_KEY(&START_KEY(k))
+- : PRECEDING_KEY(k));
++ /*
++ * If k has preceding key, preceding_key_p will be set to address
++ * of k's preceding key; otherwise preceding_key_p will be set
++ * to NULL inside preceding_key().
++ */
++ if (b->ops->is_extents)
++ preceding_key(&START_KEY(k), &preceding_key_p);
++ else
++ preceding_key(k, &preceding_key_p);
++
++ m = bch_btree_iter_init(b, &iter, preceding_key_p);
+
+ if (b->ops->insert_fixup(b, k, &iter, replace_key))
+ return status;
+diff --git a/drivers/md/bcache/bset.h b/drivers/md/bcache/bset.h
+index bac76aabca6d..c71365e7c1fa 100644
+--- a/drivers/md/bcache/bset.h
++++ b/drivers/md/bcache/bset.h
+@@ -434,20 +434,26 @@ static inline bool bch_cut_back(const struct bkey *where, struct bkey *k)
+ return __bch_cut_back(where, k);
+ }
+
+-#define PRECEDING_KEY(_k) \
+-({ \
+- struct bkey *_ret = NULL; \
+- \
+- if (KEY_INODE(_k) || KEY_OFFSET(_k)) { \
+- _ret = &KEY(KEY_INODE(_k), KEY_OFFSET(_k), 0); \
+- \
+- if (!_ret->low) \
+- _ret->high--; \
+- _ret->low--; \
+- } \
+- \
+- _ret; \
+-})
++/*
++ * Pointer '*preceding_key_p' points to a memory object to store preceding
++ * key of k. If the preceding key does not exist, set '*preceding_key_p' to
++ * NULL. So the caller of preceding_key() needs to take care of memory
++ * which '*preceding_key_p' pointed to before calling preceding_key().
++ * Currently the only caller of preceding_key() is bch_btree_insert_key(),
++ * and it points to an on-stack variable, so the memory release is handled
++ * by stackframe itself.
++ */
++static inline void preceding_key(struct bkey *k, struct bkey **preceding_key_p)
++{
++ if (KEY_INODE(k) || KEY_OFFSET(k)) {
++ (**preceding_key_p) = KEY(KEY_INODE(k), KEY_OFFSET(k), 0);
++ if (!(*preceding_key_p)->low)
++ (*preceding_key_p)->high--;
++ (*preceding_key_p)->low--;
++ } else {
++ (*preceding_key_p) = NULL;
++ }
++}
+
+ static inline bool bch_ptr_invalid(struct btree_keys *b, const struct bkey *k)
+ {
+--
+2.16.4
+
diff --git a/patches.suse/0022-bcache-only-set-BCACHE_DEV_WB_RUNNING-when-cached-de.patch b/patches.suse/0022-bcache-only-set-BCACHE_DEV_WB_RUNNING-when-cached-de.patch
new file mode 100644
index 0000000000..9156d8c276
--- /dev/null
+++ b/patches.suse/0022-bcache-only-set-BCACHE_DEV_WB_RUNNING-when-cached-de.patch
@@ -0,0 +1,62 @@
+From 1f0ffa67349c56ea54c03ccfd1e073c990e7411e Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Mon, 10 Jun 2019 06:13:35 +0800
+Subject: [PATCH] bcache: only set BCACHE_DEV_WB_RUNNING when cached device
+ attached
+Git-commit: 1f0ffa67349c56ea54c03ccfd1e073c990e7411e
+Patch-mainline: v5.2-rc5
+References: bsc#1140652
+
+When people set a writeback percent via sysfs file,
+ /sys/block/bcache<N>/bcache/writeback_percent
+current code directly sets BCACHE_DEV_WB_RUNNING to dc->disk.flags
+and schedules kworker dc->writeback_rate_update.
+
+If there is no cache set attached to, the writeback kernel thread is
+not running indeed, running dc->writeback_rate_update does not make
+sense and may cause NULL pointer deference when reference cache set
+pointer inside update_writeback_rate().
+
+This patch checks whether the cache set point (dc->disk.c) is NULL in
+sysfs interface handler, and only set BCACHE_DEV_WB_RUNNING and
+schedule dc->writeback_rate_update when dc->disk.c is not NULL (it
+means the cache device is attached to a cache set).
+
+This problem might be introduced from initial bcache commit, but
+commit 3fd47bfe55b0 ("bcache: stop dc->writeback_rate_update properly")
+changes part of the original code piece, so I add 'Fixes: 3fd47bfe55b0'
+to indicate from which commit this patch can be applied.
+
+Fixes: 3fd47bfe55b0 ("bcache: stop dc->writeback_rate_update properly")
+Reported-by: Bjørn Forsman <bjorn.forsman@gmail.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Reviewed-by: Bjørn Forsman <bjorn.forsman@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/sysfs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 6cd44d3cf906..bfb437ffb13c 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -431,8 +431,13 @@ STORE(bch_cached_dev)
+ bch_writeback_queue(dc);
+ }
+
++ /*
++ * Only set BCACHE_DEV_WB_RUNNING when cached device attached to
++ * a cache set, otherwise it doesn't make sense.
++ */
+ if (attr == &sysfs_writeback_percent)
+- if (!test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags))
++ if ((dc->disk.c != NULL) &&
++ (!test_and_set_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags)))
+ schedule_delayed_work(&dc->writeback_rate_update,
+ dc->writeback_rate_update_seconds * HZ);
+
+--
+2.16.4
+
diff --git a/patches.suse/0023-bcache-don-t-set-max-writeback-rate-if-gc-is-running.patch b/patches.suse/0023-bcache-don-t-set-max-writeback-rate-if-gc-is-running.patch
new file mode 100644
index 0000000000..f30aebd1c3
--- /dev/null
+++ b/patches.suse/0023-bcache-don-t-set-max-writeback-rate-if-gc-is-running.patch
@@ -0,0 +1,46 @@
+From 141df8bb5dc052f605de8f48a7aa10290e1384ae Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:24 +0800
+Subject: [PATCH] bcache: don't set max writeback rate if gc is running
+Git-commit: 141df8bb5dc052f605de8f48a7aa10290e1384ae
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When gc is running, user space I/O processes may wait inside
+bcache code, so no new I/O coming. Indeed this is not a real idle
+time, maximum writeback rate should not be set in such situation.
+Otherwise a faster writeback thread may compete locks with gc thread
+and makes garbage collection slower, which results a longer I/O
+freeze period.
+
+This patch checks c->gc_mark_valid in set_at_max_writeback_rate(). If
+c->gc_mark_valid is 0 (gc running), set_at_max_writeback_rate() returns
+false, then update_writeback_rate() will not set writeback rate to
+maximum value even c->idle_counter reaches an idle threshold.
+
+Now writeback thread won't interfere gc thread performance.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/writeback.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 73f0efac2b9f..262f7ef20992 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -122,6 +122,9 @@ static void __update_writeback_rate(struct cached_dev *dc)
+ static bool set_at_max_writeback_rate(struct cache_set *c,
+ struct cached_dev *dc)
+ {
++ /* Don't set max writeback rate if gc is running */
++ if (!c->gc_mark_valid)
++ return false;
+ /*
+ * Idle_counter is increased everytime when update_writeback_rate() is
+ * called. If all backing devices attached to the same cache set have
+--
+2.16.4
+
diff --git a/patches.suse/0024-bcache-check-c-gc_thread-by-IS_ERR_OR_NULL-in-cache_.patch b/patches.suse/0024-bcache-check-c-gc_thread-by-IS_ERR_OR_NULL-in-cache_.patch
new file mode 100644
index 0000000000..e487f254c0
--- /dev/null
+++ b/patches.suse/0024-bcache-check-c-gc_thread-by-IS_ERR_OR_NULL-in-cache_.patch
@@ -0,0 +1,130 @@
+From b387e9b58679c60f5b1e4313939bd4878204fc37 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:25 +0800
+Subject: [PATCH] bcache: check c->gc_thread by IS_ERR_OR_NULL in
+ cache_set_flush()
+Git-commit: b387e9b58679c60f5b1e4313939bd4878204fc37
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When system memory is in heavy pressure, bch_gc_thread_start() from
+run_cache_set() may fail due to out of memory. In such condition,
+c->gc_thread is assigned to -ENOMEM, not NULL pointer. Then in following
+failure code path bch_cache_set_error(), when cache_set_flush() gets
+called, the code piece to stop c->gc_thread is broken,
+ if (!IS_ERR_OR_NULL(c->gc_thread))
+ kthread_stop(c->gc_thread);
+
+And KASAN catches such NULL pointer deference problem, with the warning
+Information:
+
+[ 561.207881] ==================================================================
+[ 561.207900] BUG: KASAN: null-ptr-deref in kthread_stop+0x3b/0x440
+[ 561.207904] Write of size 4 at addr 000000000000001c by task kworker/15:1/313
+
+[ 561.207913] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G W 5.0.0-vanilla+ #3
+[ 561.207916] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019
+[ 561.207935] Workqueue: events cache_set_flush [bcache]
+[ 561.207940] Call Trace:
+[ 561.207948] dump_stack+0x9a/0xeb
+[ 561.207955] ? kthread_stop+0x3b/0x440
+[ 561.207960] ? kthread_stop+0x3b/0x440
+[ 561.207965] kasan_report+0x176/0x192
+[ 561.207973] ? kthread_stop+0x3b/0x440
+[ 561.207981] kthread_stop+0x3b/0x440
+[ 561.207995] cache_set_flush+0xd4/0x6d0 [bcache]
+[ 561.208008] process_one_work+0x856/0x1620
+[ 561.208015] ? find_held_lock+0x39/0x1d0
+[ 561.208028] ? drain_workqueue+0x380/0x380
+[ 561.208048] worker_thread+0x87/0xb80
+[ 561.208058] ? __kthread_parkme+0xb6/0x180
+[ 561.208067] ? process_one_work+0x1620/0x1620
+[ 561.208072] kthread+0x326/0x3e0
+[ 561.208079] ? kthread_create_worker_on_cpu+0xc0/0xc0
+[ 561.208090] ret_from_fork+0x3a/0x50
+[ 561.208110] ==================================================================
+[ 561.208113] Disabling lock debugging due to kernel taint
+[ 561.208115] irq event stamp: 11800231
+[ 561.208126] hardirqs last enabled at (11800231): [<ffffffff83008538>] do_syscall_64+0x18/0x410
+[ 561.208127] BUG: unable to handle kernel NULL pointer dereference at 000000000000001c
+[ 561.208129] #PF error: [WRITE]
+[ 561.312253] hardirqs last disabled at (11800230): [<ffffffff830052ff>] trace_hardirqs_off_thunk+0x1a/0x1c
+[ 561.312259] softirqs last enabled at (11799832): [<ffffffff850005c7>] __do_softirq+0x5c7/0x8c3
+[ 561.405975] PGD 0 P4D 0
+[ 561.442494] softirqs last disabled at (11799821): [<ffffffff831add2c>] irq_exit+0x1ac/0x1e0
+[ 561.791359] Oops: 0002 [#1] SMP KASAN NOPTI
+[ 561.791362] CPU: 15 PID: 313 Comm: kworker/15:1 Tainted: G B W 5.0.0-vanilla+ #3
+[ 561.791363] Hardware name: Lenovo ThinkSystem SR650 -[7X05CTO1WW]-/-[7X05CTO1WW]-, BIOS -[IVE136T-2.10]- 03/22/2019
+[ 561.791371] Workqueue: events cache_set_flush [bcache]
+[ 561.791374] RIP: 0010:kthread_stop+0x3b/0x440
+[ 561.791376] Code: 00 00 65 8b 05 26 d5 e0 7c 89 c0 48 0f a3 05 ec aa df 02 0f 82 dc 02 00 00 4c 8d 63 20 be 04 00 00 00 4c 89 e7 e8 65 c5 53 00 <f0> ff 43 20 48 8d 7b 24 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48
+[ 561.791377] RSP: 0018:ffff88872fc8fd10 EFLAGS: 00010286
+[ 561.838895] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 561.838916] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 561.838934] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 561.838948] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 561.838966] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 561.838979] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 561.838996] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 563.067028] RAX: 0000000000000000 RBX: fffffffffffffffc RCX: ffffffff832dd314
+[ 563.067030] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000297
+[ 563.067032] RBP: ffff88872fc8fe88 R08: fffffbfff0b8213d R09: fffffbfff0b8213d
+[ 563.067034] R10: 0000000000000001 R11: fffffbfff0b8213c R12: 000000000000001c
+[ 563.408618] R13: ffff88dc61cc0f68 R14: ffff888102b94900 R15: ffff88dc61cc0f68
+[ 563.408620] FS: 0000000000000000(0000) GS:ffff888f7dc00000(0000) knlGS:0000000000000000
+[ 563.408622] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 563.408623] CR2: 000000000000001c CR3: 0000000f48a1a004 CR4: 00000000007606e0
+[ 563.408625] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 563.408627] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 563.904795] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 563.915796] PKRU: 55555554
+[ 563.915797] Call Trace:
+[ 563.915807] cache_set_flush+0xd4/0x6d0 [bcache]
+[ 563.915812] process_one_work+0x856/0x1620
+[ 564.001226] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 564.033563] ? find_held_lock+0x39/0x1d0
+[ 564.033567] ? drain_workqueue+0x380/0x380
+[ 564.033574] worker_thread+0x87/0xb80
+[ 564.062823] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 564.118042] ? __kthread_parkme+0xb6/0x180
+[ 564.118046] ? process_one_work+0x1620/0x1620
+[ 564.118048] kthread+0x326/0x3e0
+[ 564.118050] ? kthread_create_worker_on_cpu+0xc0/0xc0
+[ 564.167066] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 564.252441] ret_from_fork+0x3a/0x50
+[ 564.252447] Modules linked in: msr rpcrdma sunrpc rdma_ucm ib_iser ib_umad rdma_cm ib_ipoib i40iw configfs iw_cm ib_cm libiscsi scsi_transport_iscsi mlx4_ib ib_uverbs mlx4_en ib_core nls_iso8859_1 nls_cp437 vfat fat intel_rapl skx_edac x86_pkg_temp_thermal coretemp iTCO_wdt iTCO_vendor_support crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel ses raid0 aesni_intel cdc_ether enclosure usbnet ipmi_ssif joydev aes_x86_64 i40e scsi_transport_sas mii bcache md_mod crypto_simd mei_me ioatdma crc64 ptp cryptd pcspkr i2c_i801 mlx4_core glue_helper pps_core mei lpc_ich dca wmi ipmi_si ipmi_devintf nd_pmem dax_pmem nd_btt ipmi_msghandler device_dax pcc_cpufreq button hid_generic usbhid mgag200 i2c_algo_bit drm_kms_helper syscopyarea sysfillrect xhci_pci sysimgblt fb_sys_fops xhci_hcd ttm megaraid_sas drm usbcore nfit libnvdimm sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua efivarfs
+[ 564.299390] bcache: bch_count_io_errors() nvme0n1: IO error on writing btree.
+[ 564.348360] CR2: 000000000000001c
+[ 564.348362] ---[ end trace b7f0e5cc7b2103b0 ]---
+
+Therefore, it is not enough to only check whether c->gc_thread is NULL,
+we should use IS_ERR_OR_NULL() to check both NULL pointer and error
+value.
+
+This patch changes the above buggy code piece in this way,
+ if (!IS_ERR_OR_NULL(c->gc_thread))
+ kthread_stop(c->gc_thread);
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 1b63ac876169..64d9de89a63f 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1564,7 +1564,7 @@ static void cache_set_flush(struct closure *cl)
+ kobject_put(&c->internal);
+ kobject_del(&c->kobj);
+
+- if (c->gc_thread)
++ if (!IS_ERR_OR_NULL(c->gc_thread))
+ kthread_stop(c->gc_thread);
+
+ if (!IS_ERR_OR_NULL(c->root))
+--
+2.16.4
+
diff --git a/patches.suse/0025-bcache-fix-return-value-error-in-bch_journal_read.patch b/patches.suse/0025-bcache-fix-return-value-error-in-bch_journal_read.patch
new file mode 100644
index 0000000000..5b52a82668
--- /dev/null
+++ b/patches.suse/0025-bcache-fix-return-value-error-in-bch_journal_read.patch
@@ -0,0 +1,47 @@
+From 0ae49cb7aa005ed18fe8f4d6ccf73019b78ac7b2 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:26 +0800
+Subject: [PATCH] bcache: fix return value error in bch_journal_read()
+Git-commit: 0ae49cb7aa005ed18fe8f4d6ccf73019b78ac7b2
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When everything is OK in bch_journal_read(), finally the return value
+is returned by,
+ return ret;
+which assumes ret will be 0 here. This assumption is wrong when all
+journal buckets as are full and filled with valid journal entries. In
+such cache the last location referencess read_bucket() sets 'ret' to
+1, which means new jset added into jset list. The jset list is list
+'journal' in caller run_cache_set().
+
+Return 1 to run_cache_set() means something wrong and the cache set
+won't start, but indeed everything is OK.
+
+This patch changes the line at end of bch_journal_read() to directly
+return 0 since everything if verything is good. Then a bogus error
+is fixed.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 12dae9348147..4e5fc05720fc 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -268,7 +268,7 @@ int bch_journal_read(struct cache_set *c, struct list_head *list)
+ struct journal_replay,
+ list)->j.seq;
+
+- return ret;
++ return 0;
+ #undef read_bucket
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/0026-Revert-bcache-set-CACHE_SET_IO_DISABLE-in-bch_cached.patch b/patches.suse/0026-Revert-bcache-set-CACHE_SET_IO_DISABLE-in-bch_cached.patch
new file mode 100644
index 0000000000..9ffba08c6b
--- /dev/null
+++ b/patches.suse/0026-Revert-bcache-set-CACHE_SET_IO_DISABLE-in-bch_cached.patch
@@ -0,0 +1,69 @@
+From 695277f16b3a102fcc22c97fdf2de77c7b19f0b3 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:27 +0800
+Subject: [PATCH] Revert "bcache: set CACHE_SET_IO_DISABLE in
+ bch_cached_dev_error()"
+Git-commit: 695277f16b3a102fcc22c97fdf2de77c7b19f0b3
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This reverts commit 6147305c73e4511ca1a975b766b97a779d442567.
+
+Although this patch helps the failed bcache device to stop faster when
+too many I/O errors detected on corresponding cached device, setting
+CACHE_SET_IO_DISABLE bit to cache set c->flags was not a good idea. This
+operation will disable all I/Os on cache set, which means other attached
+bcache devices won't work neither.
+
+Without this patch, the failed bcache device can also be stopped
+eventually if internal I/O accomplished (e.g. writeback). Therefore here
+I revert it.
+
+Fixes: 6147305c73e4 ("bcache: set CACHE_SET_IO_DISABLE in bch_cached_dev_error()")
+Reported-by: Yong Li <mr.liyong@qq.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 17 -----------------
+ 1 file changed, 17 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 64d9de89a63f..ba2ad093bc80 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1437,8 +1437,6 @@ int bch_flash_dev_create(struct cache_set *c, uint64_t size)
+
+ bool bch_cached_dev_error(struct cached_dev *dc)
+ {
+- struct cache_set *c;
+-
+ if (!dc || test_bit(BCACHE_DEV_CLOSING, &dc->disk.flags))
+ return false;
+
+@@ -1449,21 +1447,6 @@ bool bch_cached_dev_error(struct cached_dev *dc)
+ pr_err("stop %s: too many IO errors on backing device %s\n",
+ dc->disk.disk->disk_name, dc->backing_dev_name);
+
+- /*
+- * If the cached device is still attached to a cache set,
+- * even dc->io_disable is true and no more I/O requests
+- * accepted, cache device internal I/O (writeback scan or
+- * garbage collection) may still prevent bcache device from
+- * being stopped. So here CACHE_SET_IO_DISABLE should be
+- * set to c->flags too, to make the internal I/O to cache
+- * device rejected and stopped immediately.
+- * If c is NULL, that means the bcache device is not attached
+- * to any cache set, then no CACHE_SET_IO_DISABLE bit to set.
+- */
+- c = dc->disk.c;
+- if (c && test_and_set_bit(CACHE_SET_IO_DISABLE, &c->flags))
+- pr_info("CACHE_SET_IO_DISABLE already set");
+-
+ bcache_device_stop(&dc->disk);
+ return true;
+ }
+--
+2.16.4
+
diff --git a/patches.suse/0027-bcache-avoid-flushing-btree-node-in-cache_set_flush-.patch b/patches.suse/0027-bcache-avoid-flushing-btree-node-in-cache_set_flush-.patch
new file mode 100644
index 0000000000..3d52425568
--- /dev/null
+++ b/patches.suse/0027-bcache-avoid-flushing-btree-node-in-cache_set_flush-.patch
@@ -0,0 +1,58 @@
+From e6dcbd3e6c91b7828cb305ec324eb7fd9bdea8a0 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:28 +0800
+Subject: [PATCH] bcache: avoid flushing btree node in cache_set_flush() if io
+ disabled
+Git-commit: e6dcbd3e6c91b7828cb305ec324eb7fd9bdea8a0
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When cache_set_flush() is called for too many I/O errors detected on
+cache device and the cache set is retiring, inside the function it
+doesn't make sense to flushing cached btree nodes from c->btree_cache
+because CACHE_SET_IO_DISABLE is set on c->flags already and all I/Os
+onto cache device will be rejected.
+
+This patch checks in cache_set_flush() that whether CACHE_SET_IO_DISABLE
+is set. If yes, then avoids to flush the cached btree nodes to reduce
+more time and make cache set retiring more faster.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 18 +++++++++++-------
+ 1 file changed, 11 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index ba2ad093bc80..dc6702c2c4b6 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1553,13 +1553,17 @@ static void cache_set_flush(struct closure *cl)
+ if (!IS_ERR_OR_NULL(c->root))
+ list_add(&c->root->list, &c->btree_cache);
+
+- /* Should skip this if we're unregistering because of an error */
+- list_for_each_entry(b, &c->btree_cache, list) {
+- mutex_lock(&b->write_lock);
+- if (btree_node_dirty(b))
+- __bch_btree_node_write(b, NULL);
+- mutex_unlock(&b->write_lock);
+- }
++ /*
++ * Avoid flushing cached nodes if cache set is retiring
++ * due to too many I/O errors detected.
++ */
++ if (!test_bit(CACHE_SET_IO_DISABLE, &c->flags))
++ list_for_each_entry(b, &c->btree_cache, list) {
++ mutex_lock(&b->write_lock);
++ if (btree_node_dirty(b))
++ __bch_btree_node_write(b, NULL);
++ mutex_unlock(&b->write_lock);
++ }
+
+ for_each_cache(ca, c, i)
+ if (ca->alloc_thread)
+--
+2.16.4
+
diff --git a/patches.suse/0028-bcache-ignore-read-ahead-request-failure-on-backing-.patch b/patches.suse/0028-bcache-ignore-read-ahead-request-failure-on-backing-.patch
new file mode 100644
index 0000000000..55b78ccb88
--- /dev/null
+++ b/patches.suse/0028-bcache-ignore-read-ahead-request-failure-on-backing-.patch
@@ -0,0 +1,60 @@
+From 578df99b1b0531d19af956530fe4da63d01a1604 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:29 +0800
+Subject: [PATCH] bcache: ignore read-ahead request failure on backing device
+Git-commit: 578df99b1b0531d19af956530fe4da63d01a1604
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When md raid device (e.g. raid456) is used as backing device, read-ahead
+requests on a degrading and recovering md raid device might be failured
+immediately by md raid code, but indeed this md raid array can still be
+read or write for normal I/O requests. Therefore such failed read-ahead
+request are not real hardware failure. Further more, after degrading and
+recovering accomplished, read-ahead requests will be handled by md raid
+array again.
+
+For such condition, I/O failures of read-ahead requests don't indicate
+real health status (because normal I/O still be served), they should not
+be counted into I/O error counter dc->io_errors.
+
+Since there is no simple way to detect whether the backing divice is a
+md raid device, this patch simply ignores I/O failures for read-ahead
+bios on backing device, to avoid bogus backing device failure on a
+degrading md raid array.
+
+Suggested-and-tested-by: Thorsten Knabe <linux@thorsten-knabe.de>
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/io.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/md/bcache/io.c b/drivers/md/bcache/io.c
+index c25097968319..4d93f07f63e5 100644
+--- a/drivers/md/bcache/io.c
++++ b/drivers/md/bcache/io.c
+@@ -58,6 +58,18 @@ void bch_count_backing_io_errors(struct cached_dev *dc, struct bio *bio)
+
+ WARN_ONCE(!dc, "NULL pointer of struct cached_dev");
+
++ /*
++ * Read-ahead requests on a degrading and recovering md raid
++ * (e.g. raid6) device might be failured immediately by md
++ * raid code, which is not a real hardware media failure. So
++ * we shouldn't count failed REQ_RAHEAD bio to dc->io_errors.
++ */
++ if (bio->bi_opf & REQ_RAHEAD) {
++ pr_warn_ratelimited("%s: Read-ahead I/O failed on backing device, ignore",
++ dc->backing_dev_name);
++ return;
++ }
++
+ errors = atomic_add_return(1, &dc->io_errors);
+ if (errors < dc->error_limit)
+ pr_err("%s: IO error on backing device, unrecoverable",
+--
+2.16.4
+
diff --git a/patches.suse/0029-bcache-add-io-error-counting-in-write_bdev_super_end.patch b/patches.suse/0029-bcache-add-io-error-counting-in-write_bdev_super_end.patch
new file mode 100644
index 0000000000..e5011f2604
--- /dev/null
+++ b/patches.suse/0029-bcache-add-io-error-counting-in-write_bdev_super_end.patch
@@ -0,0 +1,42 @@
+From 08ec1e6282f271698f0053983fab89de6e1a8217 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:30 +0800
+Subject: [PATCH] bcache: add io error counting in write_bdev_super_endio()
+Git-commit: 08ec1e6282f271698f0053983fab89de6e1a8217
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When backing device super block is written by bch_write_bdev_super(),
+the bio complete callback write_bdev_super_endio() simply ignores I/O
+status. Indeed such write request also contribute to backing device
+health status if the request failed.
+
+This patch checkes bio->bi_status in write_bdev_super_endio(), if there
+is error, bch_count_backing_io_errors() will be called to count an I/O
+error to dc->io_errors.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index dc6702c2c4b6..73466bda12a7 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -197,7 +197,9 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev,
+ static void write_bdev_super_endio(struct bio *bio)
+ {
+ struct cached_dev *dc = bio->bi_private;
+- /* XXX: error checking */
++
++ if (bio->bi_status)
++ bch_count_backing_io_errors(dc, bio);
+
+ closure_put(&dc->sb_write);
+ }
+--
+2.16.4
+
diff --git a/patches.suse/0030-bcache-remove-unnecessary-prefetch-in-bset_search_tr.patch b/patches.suse/0030-bcache-remove-unnecessary-prefetch-in-bset_search_tr.patch
new file mode 100644
index 0000000000..ca16ad7b8d
--- /dev/null
+++ b/patches.suse/0030-bcache-remove-unnecessary-prefetch-in-bset_search_tr.patch
@@ -0,0 +1,60 @@
+From f960facb399ece6ff88a7a2d4b4a5515e3a467a0 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:31 +0800
+Subject: [PATCH] bcache: remove unnecessary prefetch() in bset_search_tree()
+Git-commit: f960facb399ece6ff88a7a2d4b4a5515e3a467a0
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In function bset_search_tree(), when p >= t->size, t->tree[0] will be
+prefetched by the following code piece,
+ 974 unsigned int p = n << 4;
+ 975
+ 976 p &= ((int) (p - t->size)) >> 31;
+ 977
+ 978 prefetch(&t->tree[p]);
+
+The purpose of the above code is to avoid a branch instruction, but
+when p >= t->size, prefetch(&t->tree[0]) has no positive performance
+contribution at all. This patch avoids the unncessary prefetch by only
+calling prefetch() when p < t->size.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bset.c | 16 ++--------------
+ 1 file changed, 2 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 268f1b685084..e36a108d3648 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -970,22 +970,10 @@ static struct bset_search_iter bset_search_tree(struct bset_tree *t,
+ unsigned int inorder, j, n = 1;
+
+ do {
+- /*
+- * A bit trick here.
+- * If p < t->size, (int)(p - t->size) is a minus value and
+- * the most significant bit is set, right shifting 31 bits
+- * gets 1. If p >= t->size, the most significant bit is
+- * not set, right shifting 31 bits gets 0.
+- * So the following 2 lines equals to
+- * if (p >= t->size)
+- * p = 0;
+- * but a branch instruction is avoided.
+- */
+ unsigned int p = n << 4;
+
+- p &= ((int) (p - t->size)) >> 31;
+-
+- prefetch(&t->tree[p]);
++ if (p < t->size)
++ prefetch(&t->tree[p]);
+
+ j = n;
+ f = &t->tree[j];
+--
+2.16.4
+
diff --git a/patches.suse/0031-bcache-use-sysfs_match_string-instead-of-__sysfs_mat.patch b/patches.suse/0031-bcache-use-sysfs_match_string-instead-of-__sysfs_mat.patch
new file mode 100644
index 0000000000..f3289af8cb
--- /dev/null
+++ b/patches.suse/0031-bcache-use-sysfs_match_string-instead-of-__sysfs_mat.patch
@@ -0,0 +1,102 @@
+From 89e0341af082dbc170019f908846f4a424efc86b Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Date: Fri, 28 Jun 2019 19:59:32 +0800
+Subject: [PATCH] bcache: use sysfs_match_string() instead of
+ __sysfs_match_string()
+Git-commit: 89e0341af082dbc170019f908846f4a424efc86b
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+The arrays (of strings) that are passed to __sysfs_match_string() are
+static, so use sysfs_match_string() which does an implicit ARRAY_SIZE()
+over these arrays.
+
+Functionally, this doesn't change anything.
+The change is more cosmetic.
+
+It only shrinks the static arrays by 1 byte each.
+
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/sysfs.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index bfb437ffb13c..760cf8951338 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -21,28 +21,24 @@ static const char * const bch_cache_modes[] = {
+ "writethrough",
+ "writeback",
+ "writearound",
+- "none",
+- NULL
++ "none"
+ };
+
+ /* Default is 0 ("auto") */
+ static const char * const bch_stop_on_failure_modes[] = {
+ "auto",
+- "always",
+- NULL
++ "always"
+ };
+
+ static const char * const cache_replacement_policies[] = {
+ "lru",
+ "fifo",
+- "random",
+- NULL
++ "random"
+ };
+
+ static const char * const error_actions[] = {
+ "unregister",
+- "panic",
+- NULL
++ "panic"
+ };
+
+ write_attribute(attach);
+@@ -333,7 +329,7 @@ STORE(__cached_dev)
+ bch_cached_dev_run(dc);
+
+ if (attr == &sysfs_cache_mode) {
+- v = __sysfs_match_string(bch_cache_modes, -1, buf);
++ v = sysfs_match_string(bch_cache_modes, buf);
+ if (v < 0)
+ return v;
+
+@@ -344,7 +340,7 @@ STORE(__cached_dev)
+ }
+
+ if (attr == &sysfs_stop_when_cache_set_failed) {
+- v = __sysfs_match_string(bch_stop_on_failure_modes, -1, buf);
++ v = sysfs_match_string(bch_stop_on_failure_modes, buf);
+ if (v < 0)
+ return v;
+
+@@ -799,7 +795,7 @@ STORE(__bch_cache_set)
+ 0, UINT_MAX);
+
+ if (attr == &sysfs_errors) {
+- v = __sysfs_match_string(error_actions, -1, buf);
++ v = sysfs_match_string(error_actions, buf);
+ if (v < 0)
+ return v;
+
+@@ -1063,7 +1059,7 @@ STORE(__bch_cache)
+ }
+
+ if (attr == &sysfs_cache_replacement_policy) {
+- v = __sysfs_match_string(cache_replacement_policies, -1, buf);
++ v = sysfs_match_string(cache_replacement_policies, buf);
+ if (v < 0)
+ return v;
+
+--
+2.16.4
+
diff --git a/patches.suse/0032-bcache-add-return-value-check-to-bch_cached_dev_run.patch b/patches.suse/0032-bcache-add-return-value-check-to-bch_cached_dev_run.patch
new file mode 100644
index 0000000000..25f5ceacda
--- /dev/null
+++ b/patches.suse/0032-bcache-add-return-value-check-to-bch_cached_dev_run.patch
@@ -0,0 +1,153 @@
+From 0b13efecf5f25ce5e31f2ab3930335015cb65a7d Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:33 +0800
+Subject: [PATCH] bcache: add return value check to bch_cached_dev_run()
+Git-commit: 0b13efecf5f25ce5e31f2ab3930335015cb65a7d
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This patch adds return value check to bch_cached_dev_run(), now if there
+is error happens inside bch_cached_dev_run(), it can be catched.
+
+(Coly Li: rebase for SLE15 kernel)
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bcache.h | 2 +-
+ drivers/md/bcache/super.c | 33 ++++++++++++++++++++++++++-------
+ drivers/md/bcache/sysfs.c | 7 +++++--
+ 3 files changed, 32 insertions(+), 10 deletions(-)
+
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -1005,7 +1005,7 @@ int bch_flash_dev_create(struct cache_se
+ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ uint8_t *set_uuid);
+ void bch_cached_dev_detach(struct cached_dev *dc);
+-void bch_cached_dev_run(struct cached_dev *dc);
++int bch_cached_dev_run(struct cached_dev *dc);
+ void bcache_device_stop(struct bcache_device *d);
+
+ void bch_cache_set_unregister(struct cache_set *c);
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -913,7 +913,7 @@ static int cached_dev_status_update(void
+ }
+
+
+-void bch_cached_dev_run(struct cached_dev *dc)
++int bch_cached_dev_run(struct cached_dev *dc)
+ {
+ struct bcache_device *d = &dc->disk;
+ char buf[SB_LABEL_SIZE + 1];
+@@ -924,6 +924,9 @@ void bch_cached_dev_run(struct cached_de
+ NULL,
+ };
+
++ if (dc->io_disable)
++ return -EIO;
++
+ memcpy(buf, dc->sb.label, SB_LABEL_SIZE);
+ buf[SB_LABEL_SIZE] = '\0';
+ env[2] = kasprintf(GFP_KERNEL, "CACHED_LABEL=%s", buf);
+@@ -931,7 +934,7 @@ void bch_cached_dev_run(struct cached_de
+ if (atomic_xchg(&dc->running, 1)) {
+ kfree(env[1]);
+ kfree(env[2]);
+- return;
++ return -EBUSY;
+ }
+
+ if (!d->c &&
+@@ -956,8 +959,11 @@ void bch_cached_dev_run(struct cached_de
+ kfree(env[2]);
+
+ if (sysfs_create_link(&d->kobj, &disk_to_dev(d->disk)->kobj, "dev") ||
+- sysfs_create_link(&disk_to_dev(d->disk)->kobj, &d->kobj, "bcache"))
++ sysfs_create_link(&disk_to_dev(d->disk)->kobj,
++ &d->kobj, "bcache")) {
+ pr_debug("error creating sysfs link");
++ return -ENOMEM;
++ }
+
+ dc->status_update_thread = kthread_run(cached_dev_status_update,
+ dc, "bcache_status_update");
+@@ -966,6 +972,8 @@ void bch_cached_dev_run(struct cached_de
+ "continue to run without monitoring backing "
+ "device status");
+ }
++
++ return 0;
+ }
+
+ /*
+@@ -1061,6 +1069,7 @@ int bch_cached_dev_attach(struct cached_
+ uint32_t rtime = cpu_to_le32((u32)ktime_get_real_seconds());
+ struct uuid_entry *u;
+ struct cached_dev *exist_dc, *t;
++ int ret = 0;
+
+ if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) ||
+ (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)))
+@@ -1170,7 +1179,12 @@ int bch_cached_dev_attach(struct cached_
+
+ bch_sectors_dirty_init(&dc->disk);
+
+- bch_cached_dev_run(dc);
++ ret = bch_cached_dev_run(dc);
++ if (ret && (ret != -EBUSY)) {
++ up_write(&dc->writeback_lock);
++ return ret;
++ }
++
+ bcache_device_link(&dc->disk, c, "bdev");
+ atomic_inc(&c->attached_dev_nr);
+
+@@ -1297,6 +1311,7 @@ static int register_bdev(struct cache_sb
+ {
+ const char *err = "cannot allocate memory";
+ struct cache_set *c;
++ int ret = -ENOMEM;
+
+ bdevname(bdev, dc->backing_dev_name);
+ memcpy(&dc->sb, sb, sizeof(struct cache_sb));
+@@ -1326,14 +1341,18 @@ static int register_bdev(struct cache_sb
+ bch_cached_dev_attach(dc, c, NULL);
+
+ if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE ||
+- BDEV_STATE(&dc->sb) == BDEV_STATE_STALE)
+- bch_cached_dev_run(dc);
++ BDEV_STATE(&dc->sb) == BDEV_STATE_STALE) {
++ err = "failed to run cached device";
++ ret = bch_cached_dev_run(dc);
++ if (ret)
++ goto err;
++ }
+
+ return 0;
+ err:
+ pr_notice("error %s: %s", dc->backing_dev_name, err);
+ bcache_device_stop(&dc->disk);
+- return -EIO;
++ return ret;
+ }
+
+ /* Flash only volumes */
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -324,8 +324,11 @@ STORE(__cached_dev)
+ bch_cache_accounting_clear(&dc->accounting);
+
+ if (attr == &sysfs_running &&
+- strtoul_or_return(buf))
+- bch_cached_dev_run(dc);
++ strtoul_or_return(buf)) {
++ v = bch_cached_dev_run(dc);
++ if (v)
++ return v;
++ }
+
+ if (attr == &sysfs_cache_mode) {
+ v = sysfs_match_string(bch_cache_modes, buf);
diff --git a/patches.suse/0033-bcache-remove-unncessary-code-in-bch_btree_keys_init.patch b/patches.suse/0033-bcache-remove-unncessary-code-in-bch_btree_keys_init.patch
new file mode 100644
index 0000000000..fe5cc8875e
--- /dev/null
+++ b/patches.suse/0033-bcache-remove-unncessary-code-in-bch_btree_keys_init.patch
@@ -0,0 +1,77 @@
+From bd9026c8a7f33ebe25543b7b7e6276b49db60f7e Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:34 +0800
+Subject: [PATCH] bcache: remove unncessary code in bch_btree_keys_init()
+Git-commit: bd9026c8a7f33ebe25543b7b7e6276b49db60f7e
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+Function bch_btree_keys_init() initializes b->set[].size and
+b->set[].data to zero. As the code comments indicates, these code indeed
+is unncessary, because both struct btree_keys and struct bset_tree are
+nested embedded into struct btree, when struct btree is filled with 0
+bits by kzalloc() in mca_bucket_alloc(), b->set[].size and
+b->set[].data are initialized to 0 (a.k.a NULL) already.
+
+This patch removes the redundant code, and add comments in
+bch_btree_keys_init() and mca_bucket_alloc() to explain why it's safe.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bset.c | 15 ++++++---------
+ drivers/md/bcache/btree.c | 4 ++++
+ 2 files changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index e36a108d3648..8af9509e78bd 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -347,22 +347,19 @@ EXPORT_SYMBOL(bch_btree_keys_alloc);
+ void bch_btree_keys_init(struct btree_keys *b, const struct btree_keys_ops *ops,
+ bool *expensive_debug_checks)
+ {
+- unsigned int i;
+-
+ b->ops = ops;
+ b->expensive_debug_checks = expensive_debug_checks;
+ b->nsets = 0;
+ b->last_set_unwritten = 0;
+
+- /* XXX: shouldn't be needed */
+- for (i = 0; i < MAX_BSETS; i++)
+- b->set[i].size = 0;
+ /*
+- * Second loop starts at 1 because b->keys[0]->data is the memory we
+- * allocated
++ * struct btree_keys in embedded in struct btree, and struct
++ * bset_tree is embedded into struct btree_keys. They are all
++ * initialized as 0 by kzalloc() in mca_bucket_alloc(), and
++ * b->set[0].data is allocated in bch_btree_keys_alloc(), so we
++ * don't have to initiate b->set[].size and b->set[].data here
++ * any more.
+ */
+- for (i = 1; i < MAX_BSETS; i++)
+- b->set[i].data = NULL;
+ }
+ EXPORT_SYMBOL(bch_btree_keys_init);
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 773f5fdad25f..cf38a1b031fa 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -613,6 +613,10 @@ static void mca_data_alloc(struct btree *b, struct bkey *k, gfp_t gfp)
+ static struct btree *mca_bucket_alloc(struct cache_set *c,
+ struct bkey *k, gfp_t gfp)
+ {
++ /*
++ * kzalloc() is necessary here for initialization,
++ * see code comments in bch_btree_keys_init().
++ */
+ struct btree *b = kzalloc(sizeof(struct btree), gfp);
+
+ if (!b)
+--
+2.16.4
+
diff --git a/patches.suse/0034-bcache-check-CACHE_SET_IO_DISABLE-in-allocator-code.patch b/patches.suse/0034-bcache-check-CACHE_SET_IO_DISABLE-in-allocator-code.patch
new file mode 100644
index 0000000000..8d3774a004
--- /dev/null
+++ b/patches.suse/0034-bcache-check-CACHE_SET_IO_DISABLE-in-allocator-code.patch
@@ -0,0 +1,57 @@
+From e775339e1ae1205b47d94881db124c11385e597c Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:35 +0800
+Subject: [PATCH] bcache: check CACHE_SET_IO_DISABLE in allocator code
+Git-commit: e775339e1ae1205b47d94881db124c11385e597c
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+If CACHE_SET_IO_DISABLE of a cache set flag is set by too many I/O
+errors, currently allocator routines can still continue allocate
+space which may introduce inconsistent metadata state.
+
+This patch checkes CACHE_SET_IO_DISABLE bit in following allocator
+routines,
+- bch_bucket_alloc()
+- __bch_bucket_alloc_set()
+Once CACHE_SET_IO_DISABLE is set on cache set, the allocator routines
+may reject allocation request earlier to avoid potential inconsistent
+metadata.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/alloc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
+index f8986effcb50..6f776823b9ba 100644
+--- a/drivers/md/bcache/alloc.c
++++ b/drivers/md/bcache/alloc.c
+@@ -393,6 +393,11 @@ long bch_bucket_alloc(struct cache *ca, unsigned int reserve, bool wait)
+ struct bucket *b;
+ long r;
+
++
++ /* No allocation if CACHE_SET_IO_DISABLE bit is set */
++ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &ca->set->flags)))
++ return -1;
++
+ /* fastpath */
+ if (fifo_pop(&ca->free[RESERVE_NONE], r) ||
+ fifo_pop(&ca->free[reserve], r))
+@@ -484,6 +489,10 @@ int __bch_bucket_alloc_set(struct cache_set *c, unsigned int reserve,
+ {
+ int i;
+
++ /* No allocation if CACHE_SET_IO_DISABLE bit is set */
++ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
++ return -1;
++
+ lockdep_assert_held(&c->bucket_lock);
+ BUG_ON(!n || n > c->caches_loaded || n > MAX_CACHES_PER_SET);
+
+--
+2.16.4
+
diff --git a/patches.suse/0035-bcache-check-CACHE_SET_IO_DISABLE-bit-in-bch_journal.patch b/patches.suse/0035-bcache-check-CACHE_SET_IO_DISABLE-bit-in-bch_journal.patch
new file mode 100644
index 0000000000..6eabe99a3a
--- /dev/null
+++ b/patches.suse/0035-bcache-check-CACHE_SET_IO_DISABLE-bit-in-bch_journal.patch
@@ -0,0 +1,44 @@
+From 383ff2183ad16a8842d1fbd9dd3e1cbd66813e64 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:36 +0800
+Subject: [PATCH] bcache: check CACHE_SET_IO_DISABLE bit in bch_journal()
+Git-commit: 383ff2183ad16a8842d1fbd9dd3e1cbd66813e64
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When too many I/O errors happen on cache set and CACHE_SET_IO_DISABLE
+bit is set, bch_journal() may continue to work because the journaling
+bkey might be still in write set yet. The caller of bch_journal() may
+believe the journal still work but the truth is in-memory journal write
+set won't be written into cache device any more. This behavior may
+introduce potential inconsistent metadata status.
+
+This patch checks CACHE_SET_IO_DISABLE bit at the head of bch_journal(),
+if the bit is set, bch_journal() returns NULL immediately to notice
+caller to know journal does not work.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 4e5fc05720fc..54f8886b6177 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -811,6 +811,10 @@ atomic_t *bch_journal(struct cache_set *c,
+ struct journal_write *w;
+ atomic_t *ret;
+
++ /* No journaling if CACHE_SET_IO_DISABLE set already */
++ if (unlikely(test_bit(CACHE_SET_IO_DISABLE, &c->flags)))
++ return NULL;
++
+ if (!CACHE_SYNC(&c->sb))
+ return NULL;
+
+--
+2.16.4
+
diff --git a/patches.suse/0036-bcache-more-detailed-error-message-to-bcache_device_.patch b/patches.suse/0036-bcache-more-detailed-error-message-to-bcache_device_.patch
new file mode 100644
index 0000000000..b122c6240d
--- /dev/null
+++ b/patches.suse/0036-bcache-more-detailed-error-message-to-bcache_device_.patch
@@ -0,0 +1,51 @@
+From 4b6efb4bdbce25097f1a6329e18c2b77c4f27722 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:37 +0800
+Subject: [PATCH] bcache: more detailed error message to bcache_device_link()
+Git-commit: 4b6efb4bdbce25097f1a6329e18c2b77c4f27722
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This patch adds more accurate error message for specific
+ssyfs_create_link() call, to help debugging failure during
+bcache device start tup.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 0abee44092bf..d4d8d1300faf 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -693,6 +693,7 @@ static void bcache_device_link(struct bcache_device *d, struct cache_set *c,
+ {
+ unsigned int i;
+ struct cache *ca;
++ int ret;
+
+ for_each_cache(ca, d->c, i)
+ bd_link_disk_holder(ca->bdev, d->disk);
+@@ -700,9 +701,13 @@ static void bcache_device_link(struct bcache_device *d, struct cache_set *c,
+ snprintf(d->name, BCACHEDEVNAME_SIZE,
+ "%s%u", name, d->id);
+
+- WARN(sysfs_create_link(&d->kobj, &c->kobj, "cache") ||
+- sysfs_create_link(&c->kobj, &d->kobj, d->name),
+- "Couldn't create device <-> cache set symlinks");
++ ret = sysfs_create_link(&d->kobj, &c->kobj, "cache");
++ if (ret < 0)
++ pr_err("Couldn't create device -> cache set symlink");
++
++ ret = sysfs_create_link(&c->kobj, &d->kobj, d->name);
++ if (ret < 0)
++ pr_err("Couldn't create cache set -> device symlink");
+
+ clear_bit(BCACHE_DEV_UNLINK_DONE, &d->flags);
+ }
+--
+2.16.4
+
diff --git a/patches.suse/0037-bcache-add-more-error-message-in-bch_cached_dev_atta.patch b/patches.suse/0037-bcache-add-more-error-message-in-bch_cached_dev_atta.patch
new file mode 100644
index 0000000000..cee9844e7c
--- /dev/null
+++ b/patches.suse/0037-bcache-add-more-error-message-in-bch_cached_dev_atta.patch
@@ -0,0 +1,43 @@
+From 633bb2ce60b949e2990c15324be162c54788c027 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:38 +0800
+Subject: [PATCH] bcache: add more error message in bch_cached_dev_attach()
+Git-commit: 633bb2ce60b949e2990c15324be162c54788c027
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This patch adds more error message for attaching cached device, this is
+helpful to debug code failure during bache device start up.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index d4d8d1300faf..a836910ef368 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1169,6 +1169,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ down_write(&dc->writeback_lock);
+ if (bch_cached_dev_writeback_start(dc)) {
+ up_write(&dc->writeback_lock);
++ pr_err("Couldn't start writeback facilities for %s",
++ dc->disk.disk->disk_name);
+ return -ENOMEM;
+ }
+
+@@ -1182,6 +1184,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ ret = bch_cached_dev_run(dc);
+ if (ret && (ret != -EBUSY)) {
+ up_write(&dc->writeback_lock);
++ pr_err("Couldn't run cached device %s",
++ dc->backing_dev_name);
+ return ret;
+ }
+
+--
+2.16.4
+
diff --git a/patches.suse/0038-bcache-improve-error-message-in-bch_cached_dev_run.patch b/patches.suse/0038-bcache-improve-error-message-in-bch_cached_dev_run.patch
new file mode 100644
index 0000000000..b0301a293c
--- /dev/null
+++ b/patches.suse/0038-bcache-improve-error-message-in-bch_cached_dev_run.patch
@@ -0,0 +1,57 @@
+From e0faa3d7f79f7e1abb43de168e88c76061518ea4 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:39 +0800
+Subject: [PATCH] bcache: improve error message in bch_cached_dev_run()
+Git-commit: e0faa3d7f79f7e1abb43de168e88c76061518ea4
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This patch adds more error message in bch_cached_dev_run() to indicate
+the exact reason why an error value is returned. Please notice when
+printing out the "is running already" message, pr_info() is used here,
+because in this case also -EBUSY is returned, the bcache device can
+continue to attach to the cache devince and run, so it won't be an
+error level message in kernel message.
+
+(Coly Li: rebase for SLE15 kernel)
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -929,8 +929,11 @@ int bch_cached_dev_run(struct cached_dev
+ NULL,
+ };
+
+- if (dc->io_disable)
++ if (dc->io_disable) {
++ pr_err("I/O disabled on cached dev %s",
++ dc->backing_dev_name);
+ return -EIO;
++ }
+
+ memcpy(buf, dc->sb.label, SB_LABEL_SIZE);
+ buf[SB_LABEL_SIZE] = '\0';
+@@ -939,6 +942,8 @@ int bch_cached_dev_run(struct cached_dev
+ if (atomic_xchg(&dc->running, 1)) {
+ kfree(env[1]);
+ kfree(env[2]);
++ pr_info("cached dev %s is running already",
++ dc->backing_dev_name);
+ return -EBUSY;
+ }
+
+@@ -966,7 +971,7 @@ int bch_cached_dev_run(struct cached_dev
+ if (sysfs_create_link(&d->kobj, &disk_to_dev(d->disk)->kobj, "dev") ||
+ sysfs_create_link(&disk_to_dev(d->disk)->kobj,
+ &d->kobj, "bcache")) {
+- pr_debug("error creating sysfs link");
++ pr_err("Couldn't create bcache dev <-> disk sysfs symlinks");
+ return -ENOMEM;
+ }
+
diff --git a/patches.suse/0039-bcache-remove-XXX-comment-line-from-run_cache_set.patch b/patches.suse/0039-bcache-remove-XXX-comment-line-from-run_cache_set.patch
new file mode 100644
index 0000000000..b8626facf7
--- /dev/null
+++ b/patches.suse/0039-bcache-remove-XXX-comment-line-from-run_cache_set.patch
@@ -0,0 +1,36 @@
+From 68a53c95a0fce541321fbca74a7f72c71361f496 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:40 +0800
+Subject: [PATCH] bcache: remove "XXX:" comment line from run_cache_set()
+Git-commit: 68a53c95a0fce541321fbca74a7f72c71361f496
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In previous bcache patches for Linux v5.2, the failure code path of
+run_cache_set() is tested and fixed. So now the following comment
+line can be removed from run_cache_set(),
+ /* XXX: test this, it's broken */
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index e9e6d653bf70..c53fe0f1629f 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1979,7 +1979,7 @@ static int run_cache_set(struct cache_set *c)
+ }
+
+ closure_sync(&cl);
+- /* XXX: test this, it's broken */
++
+ bch_cache_set_error(c, "%s", err);
+
+ return -EIO;
+--
+2.16.4
+
diff --git a/patches.suse/0040-bcache-make-bset_search_tree-be-more-understandable.patch b/patches.suse/0040-bcache-make-bset_search_tree-be-more-understandable.patch
new file mode 100644
index 0000000000..e911da2eca
--- /dev/null
+++ b/patches.suse/0040-bcache-make-bset_search_tree-be-more-understandable.patch
@@ -0,0 +1,75 @@
+From 944a4f340a65c21ee311d2d3e617034bef9d0b25 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:41 +0800
+Subject: [PATCH] bcache: make bset_search_tree() be more understandable
+Git-commit: 944a4f340a65c21ee311d2d3e617034bef9d0b25
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+The purpose of following code in bset_search_tree() is to avoid a branch
+instruction,
+ 994 if (likely(f->exponent != 127))
+ 995 n = j * 2 + (((unsigned int)
+ 996 (f->mantissa -
+ 997 bfloat_mantissa(search, f))) >> 31);
+ 998 else
+ 999 n = (bkey_cmp(tree_to_bkey(t, j), search) > 0)
+1000 ? j * 2
+1001 : j * 2 + 1;
+
+This piece of code is not very clear to understand, even when I tried to
+add code comment for it, I made mistake. This patch removes the implict
+bit operation and uses explicit branch to calculate next location in
+binary tree search.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bset.c | 30 +++++++++++-------------------
+ 1 file changed, 11 insertions(+), 19 deletions(-)
+
+diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
+index 8af9509e78bd..08768796b543 100644
+--- a/drivers/md/bcache/bset.c
++++ b/drivers/md/bcache/bset.c
+@@ -975,25 +975,17 @@ static struct bset_search_iter bset_search_tree(struct bset_tree *t,
+ j = n;
+ f = &t->tree[j];
+
+- /*
+- * Similar bit trick, use subtract operation to avoid a branch
+- * instruction.
+- *
+- * n = (f->mantissa > bfloat_mantissa())
+- * ? j * 2
+- * : j * 2 + 1;
+- *
+- * We need to subtract 1 from f->mantissa for the sign bit trick
+- * to work - that's done in make_bfloat()
+- */
+- if (likely(f->exponent != 127))
+- n = j * 2 + (((unsigned int)
+- (f->mantissa -
+- bfloat_mantissa(search, f))) >> 31);
+- else
+- n = (bkey_cmp(tree_to_bkey(t, j), search) > 0)
+- ? j * 2
+- : j * 2 + 1;
++ if (likely(f->exponent != 127)) {
++ if (f->mantissa >= bfloat_mantissa(search, f))
++ n = j * 2;
++ else
++ n = j * 2 + 1;
++ } else {
++ if (bkey_cmp(tree_to_bkey(t, j), search) > 0)
++ n = j * 2;
++ else
++ n = j * 2 + 1;
++ }
+ } while (n < t->size);
+
+ inorder = to_inorder(j, t);
+--
+2.16.4
+
diff --git a/patches.suse/0041-bcache-add-pendings_cleanup-to-stop-pending-bcache-d.patch b/patches.suse/0041-bcache-add-pendings_cleanup-to-stop-pending-bcache-d.patch
new file mode 100644
index 0000000000..6d8aa5e472
--- /dev/null
+++ b/patches.suse/0041-bcache-add-pendings_cleanup-to-stop-pending-bcache-d.patch
@@ -0,0 +1,111 @@
+From 0c277e211aae056b26513358fc060291d8523747 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:42 +0800
+Subject: [PATCH] bcache: add pendings_cleanup to stop pending bcache device
+Git-commit: 0c277e211aae056b26513358fc060291d8523747
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+If a bcache device is in dirty state and its cache set is not
+registered, this bcache device will not appear in /dev/bcache<N>,
+and there is no way to stop it or remove the bcache kernel module.
+
+This is an as-designed behavior, but sometimes people has to reboot
+whole system to release or stop the pending backing device.
+
+This sysfs interface may remove such pending bcache devices when
+write anything into the sysfs file manually.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 55 +++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 55 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index c53fe0f1629f..c4c4b2d99dc2 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -2273,9 +2273,13 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page,
+
+ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ const char *buffer, size_t size);
++static ssize_t bch_pending_bdevs_cleanup(struct kobject *k,
++ struct kobj_attribute *attr,
++ const char *buffer, size_t size);
+
+ kobj_attribute_write(register, register_bcache);
+ kobj_attribute_write(register_quiet, register_bcache);
++kobj_attribute_write(pendings_cleanup, bch_pending_bdevs_cleanup);
+
+ static bool bch_is_open_backing(struct block_device *bdev)
+ {
+@@ -2400,6 +2404,56 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ goto out;
+ }
+
++
++struct pdev {
++ struct list_head list;
++ struct cached_dev *dc;
++};
++
++static ssize_t bch_pending_bdevs_cleanup(struct kobject *k,
++ struct kobj_attribute *attr,
++ const char *buffer,
++ size_t size)
++{
++ LIST_HEAD(pending_devs);
++ ssize_t ret = size;
++ struct cached_dev *dc, *tdc;
++ struct pdev *pdev, *tpdev;
++ struct cache_set *c, *tc;
++
++ mutex_lock(&bch_register_lock);
++ list_for_each_entry_safe(dc, tdc, &uncached_devices, list) {
++ pdev = kmalloc(sizeof(struct pdev), GFP_KERNEL);
++ if (!pdev)
++ break;
++ pdev->dc = dc;
++ list_add(&pdev->list, &pending_devs);
++ }
++
++ list_for_each_entry_safe(pdev, tpdev, &pending_devs, list) {
++ list_for_each_entry_safe(c, tc, &bch_cache_sets, list) {
++ char *pdev_set_uuid = pdev->dc->sb.set_uuid;
++ char *set_uuid = c->sb.uuid;
++
++ if (!memcmp(pdev_set_uuid, set_uuid, 16)) {
++ list_del(&pdev->list);
++ kfree(pdev);
++ break;
++ }
++ }
++ }
++ mutex_unlock(&bch_register_lock);
++
++ list_for_each_entry_safe(pdev, tpdev, &pending_devs, list) {
++ pr_info("delete pdev %p", pdev);
++ list_del(&pdev->list);
++ bcache_device_stop(&pdev->dc->disk);
++ kfree(pdev);
++ }
++
++ return ret;
++}
++
+ static int bcache_reboot(struct notifier_block *n, unsigned long code, void *x)
+ {
+ if (code == SYS_DOWN ||
+@@ -2518,6 +2572,7 @@ static int __init bcache_init(void)
+ static const struct attribute *files[] = {
+ &ksysfs_register.attr,
+ &ksysfs_register_quiet.attr,
++ &ksysfs_pendings_cleanup.attr,
+ NULL
+ };
+
+--
+2.16.4
+
diff --git a/patches.suse/0042-bcache-fix-mistaken-sysfs-entry-for-io_error-counter.patch b/patches.suse/0042-bcache-fix-mistaken-sysfs-entry-for-io_error-counter.patch
new file mode 100644
index 0000000000..ff46c0a016
--- /dev/null
+++ b/patches.suse/0042-bcache-fix-mistaken-sysfs-entry-for-io_error-counter.patch
@@ -0,0 +1,48 @@
+From 5461999848e0462c14f306a62923d22de820a59c Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:43 +0800
+Subject: [PATCH] bcache: fix mistaken sysfs entry for io_error counter
+Git-commit: 5461999848e0462c14f306a62923d22de820a59c
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In bch_cached_dev_files[] from driver/md/bcache/sysfs.c, sysfs_errors is
+incorrectly inserted in. The correct entry should be sysfs_io_errors.
+
+This patch fixes the problem and now I/O errors of cached device can be
+read from /sys/block/bcache<N>/bcache/io_errors.
+
+Fixes: c7b7bd07404c5 ("bcache: add io_disable to struct cached_dev")
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/sysfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index eb678e43ac00..dddb8d4048ce 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -176,7 +176,7 @@ SHOW(__bch_cached_dev)
+ var_print(writeback_percent);
+ sysfs_hprint(writeback_rate,
+ wb ? atomic_long_read(&dc->writeback_rate.rate) << 9 : 0);
+- sysfs_hprint(io_errors, atomic_read(&dc->io_errors));
++ sysfs_printf(io_errors, "%i", atomic_read(&dc->io_errors));
+ sysfs_printf(io_error_limit, "%i", dc->error_limit);
+ sysfs_printf(io_disable, "%i", dc->io_disable);
+ var_print(writeback_rate_update_seconds);
+@@ -463,7 +463,7 @@ static struct attribute *bch_cached_dev_files[] = {
+ &sysfs_writeback_rate_p_term_inverse,
+ &sysfs_writeback_rate_minimum,
+ &sysfs_writeback_rate_debug,
+- &sysfs_errors,
++ &sysfs_io_errors,
+ &sysfs_io_error_limit,
+ &sysfs_io_disable,
+ &sysfs_dirty_data,
+--
+2.16.4
+
diff --git a/patches.suse/0043-bcache-destroy-dc-writeback_write_wq-if-failed-to-cr.patch b/patches.suse/0043-bcache-destroy-dc-writeback_write_wq-if-failed-to-cr.patch
new file mode 100644
index 0000000000..d5f2f3d3c0
--- /dev/null
+++ b/patches.suse/0043-bcache-destroy-dc-writeback_write_wq-if-failed-to-cr.patch
@@ -0,0 +1,40 @@
+From f54d801dda14942dbefa00541d10603015b7859c Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:44 +0800
+Subject: [PATCH] bcache: destroy dc->writeback_write_wq if failed to create
+ dc->writeback_thread
+Git-commit: f54d801dda14942dbefa00541d10603015b7859c
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+Commit 9baf30972b55 ("bcache: fix for gc and write-back race") added a
+new work queue dc->writeback_write_wq, but forgot to destroy it in the
+error condition when creating dc->writeback_thread failed.
+
+This patch destroys dc->writeback_write_wq if kthread_create() returns
+error pointer to dc->writeback_thread, then a memory leak is avoided.
+
+Fixes: 9baf30972b55 ("bcache: fix for gc and write-back race")
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/writeback.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 262f7ef20992..21081febcb59 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -833,6 +833,7 @@ int bch_cached_dev_writeback_start(struct cached_dev *dc)
+ "bcache_writeback");
+ if (IS_ERR(dc->writeback_thread)) {
+ cached_dev_put(dc);
++ destroy_workqueue(dc->writeback_write_wq);
+ return PTR_ERR(dc->writeback_thread);
+ }
+ dc->writeback_running = true;
+--
+2.16.4
+
diff --git a/patches.suse/0044-bcache-stop-writeback-kthread-and-kworker-when-bch_c.patch b/patches.suse/0044-bcache-stop-writeback-kthread-and-kworker-when-bch_c.patch
new file mode 100644
index 0000000000..db7ca75505
--- /dev/null
+++ b/patches.suse/0044-bcache-stop-writeback-kthread-and-kworker-when-bch_c.patch
@@ -0,0 +1,47 @@
+From 5c2a634cbfaf1971cb6453fe5f86d83585257790 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:45 +0800
+Subject: [PATCH] bcache: stop writeback kthread and kworker when
+ bch_cached_dev_run() failed
+Git-commit: 5c2a634cbfaf1971cb6453fe5f86d83585257790
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In bch_cached_dev_attach() after bch_cached_dev_writeback_start()
+called, the wrireback kthread and writeback rate update kworker of the
+cached device are created, if the following bch_cached_dev_run()
+failed, bch_cached_dev_attach() will return with -ENOMEM without
+stopping the writeback related kthread and kworker.
+
+This patch stops writeback kthread and writeback rate update kworker
+before returning -ENOMEM if bch_cached_dev_run() returns error.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index c4c4b2d99dc2..791cb930b353 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1189,6 +1189,14 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c,
+ ret = bch_cached_dev_run(dc);
+ if (ret && (ret != -EBUSY)) {
+ up_write(&dc->writeback_lock);
++ /*
++ * bch_register_lock is held, bcache_device_stop() is not
++ * able to be directly called. The kthread and kworker
++ * created previously in bch_cached_dev_writeback_start()
++ * have to be stopped manually here.
++ */
++ kthread_stop(dc->writeback_thread);
++ cancel_writeback_rate_update_dwork(dc);
+ pr_err("Couldn't run cached device %s",
+ dc->backing_dev_name);
+ return ret;
+--
+2.16.4
+
diff --git a/patches.suse/0045-bcache-avoid-a-deadlock-in-bcache_reboot.patch b/patches.suse/0045-bcache-avoid-a-deadlock-in-bcache_reboot.patch
new file mode 100644
index 0000000000..91d9dcad33
--- /dev/null
+++ b/patches.suse/0045-bcache-avoid-a-deadlock-in-bcache_reboot.patch
@@ -0,0 +1,216 @@
+From a59ff6ccc2bf2e2934b31bbf734f0bc04b5ec78a Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:46 +0800
+Subject: [PATCH] bcache: avoid a deadlock in bcache_reboot()
+Git-commit: a59ff6ccc2bf2e2934b31bbf734f0bc04b5ec78a
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+It is quite frequently to observe deadlock in bcache_reboot() happens
+and hang the system reboot process. The reason is, in bcache_reboot()
+when calling bch_cache_set_stop() and bcache_device_stop() the mutex
+bch_register_lock is held. But in the process to stop cache set and
+bcache device, bch_register_lock will be acquired again. If this mutex
+is held here, deadlock will happen inside the stopping process. The
+aftermath of the deadlock is, whole system reboot gets hung.
+
+The fix is to avoid holding bch_register_lock for the following loops
+in bcache_reboot(),
+ list_for_each_entry_safe(c, tc, &bch_cache_sets, list)
+ bch_cache_set_stop(c);
+
+ list_for_each_entry_safe(dc, tdc, &uncached_devices, list)
+ bcache_device_stop(&dc->disk);
+
+A module range variable 'bcache_is_reboot' is added, it sets to true
+in bcache_reboot(). In register_bcache(), if bcache_is_reboot is checked
+to be true, reject the registration by returning -EBUSY immediately.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 40 +++++++++++++++++++++++++++++++++++++++-
+ drivers/md/bcache/sysfs.c | 26 ++++++++++++++++++++++++++
+ 2 files changed, 65 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 791cb930b353..a88238ad5da1 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -40,6 +40,7 @@ static const char invalid_uuid[] = {
+
+ static struct kobject *bcache_kobj;
+ struct mutex bch_register_lock;
++bool bcache_is_reboot;
+ LIST_HEAD(bch_cache_sets);
+ static LIST_HEAD(uncached_devices);
+
+@@ -49,6 +50,7 @@ static wait_queue_head_t unregister_wait;
+ struct workqueue_struct *bcache_wq;
+ struct workqueue_struct *bch_journal_wq;
+
++
+ #define BTREE_MAX_PAGES (256 * 1024 / PAGE_SIZE)
+ /* limitation of partitions number on single bcache device */
+ #define BCACHE_MINORS 128
+@@ -2335,6 +2337,11 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr,
+ if (!try_module_get(THIS_MODULE))
+ return -EBUSY;
+
++ /* For latest state of bcache_is_reboot */
++ smp_mb();
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ path = kstrndup(buffer, size, GFP_KERNEL);
+ if (!path)
+ goto err;
+@@ -2464,6 +2471,9 @@ static ssize_t bch_pending_bdevs_cleanup(struct kobject *k,
+
+ static int bcache_reboot(struct notifier_block *n, unsigned long code, void *x)
+ {
++ if (bcache_is_reboot)
++ return NOTIFY_DONE;
++
+ if (code == SYS_DOWN ||
+ code == SYS_HALT ||
+ code == SYS_POWER_OFF) {
+@@ -2476,19 +2486,45 @@ static int bcache_reboot(struct notifier_block *n, unsigned long code, void *x)
+
+ mutex_lock(&bch_register_lock);
+
++ if (bcache_is_reboot)
++ goto out;
++
++ /* New registration is rejected since now */
++ bcache_is_reboot = true;
++ /*
++ * Make registering caller (if there is) on other CPU
++ * core know bcache_is_reboot set to true earlier
++ */
++ smp_mb();
++
+ if (list_empty(&bch_cache_sets) &&
+ list_empty(&uncached_devices))
+ goto out;
+
++ mutex_unlock(&bch_register_lock);
++
+ pr_info("Stopping all devices:");
+
++ /*
++ * The reason bch_register_lock is not held to call
++ * bch_cache_set_stop() and bcache_device_stop() is to
++ * avoid potential deadlock during reboot, because cache
++ * set or bcache device stopping process will acqurie
++ * bch_register_lock too.
++ *
++ * We are safe here because bcache_is_reboot sets to
++ * true already, register_bcache() will reject new
++ * registration now. bcache_is_reboot also makes sure
++ * bcache_reboot() won't be re-entered on by other thread,
++ * so there is no race in following list iteration by
++ * list_for_each_entry_safe().
++ */
+ list_for_each_entry_safe(c, tc, &bch_cache_sets, list)
+ bch_cache_set_stop(c);
+
+ list_for_each_entry_safe(dc, tdc, &uncached_devices, list)
+ bcache_device_stop(&dc->disk);
+
+- mutex_unlock(&bch_register_lock);
+
+ /*
+ * Give an early chance for other kthreads and
+@@ -2616,6 +2652,8 @@ static int __init bcache_init(void)
+ bch_debug_init();
+ closure_debug_init();
+
++ bcache_is_reboot = false;
++
+ return 0;
+ err:
+ bcache_exit();
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index dddb8d4048ce..d62e28643109 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -16,6 +16,8 @@
+ #include <linux/sort.h>
+ #include <linux/sched/clock.h>
+
++extern bool bcache_is_reboot;
++
+ /* Default is 0 ("writethrough") */
+ static const char * const bch_cache_modes[] = {
+ "writethrough",
+@@ -267,6 +269,10 @@ STORE(__cached_dev)
+ struct cache_set *c;
+ struct kobj_uevent_env *env;
+
++ /* no user space access if system is rebooting */
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ #define d_strtoul(var) sysfs_strtoul(var, dc->var)
+ #define d_strtoul_nonzero(var) sysfs_strtoul_clamp(var, dc->var, 1, INT_MAX)
+ #define d_strtoi_h(var) sysfs_hatoi(var, dc->var)
+@@ -407,6 +413,10 @@ STORE(bch_cached_dev)
+ struct cached_dev *dc = container_of(kobj, struct cached_dev,
+ disk.kobj);
+
++ /* no user space access if system is rebooting */
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ mutex_lock(&bch_register_lock);
+ size = __cached_dev_store(kobj, attr, buf, size);
+
+@@ -510,6 +520,10 @@ STORE(__bch_flash_dev)
+ kobj);
+ struct uuid_entry *u = &d->c->uuids[d->id];
+
++ /* no user space access if system is rebooting */
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ sysfs_strtoul(data_csum, d->data_csum);
+
+ if (attr == &sysfs_size) {
+@@ -745,6 +759,10 @@ STORE(__bch_cache_set)
+ struct cache_set *c = container_of(kobj, struct cache_set, kobj);
+ ssize_t v;
+
++ /* no user space access if system is rebooting */
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ if (attr == &sysfs_unregister)
+ bch_cache_set_unregister(c);
+
+@@ -864,6 +882,10 @@ STORE(bch_cache_set_internal)
+ {
+ struct cache_set *c = container_of(kobj, struct cache_set, internal);
+
++ /* no user space access if system is rebooting */
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ return bch_cache_set_store(&c->kobj, attr, buf, size);
+ }
+
+@@ -1049,6 +1071,10 @@ STORE(__bch_cache)
+ struct cache *ca = container_of(kobj, struct cache, kobj);
+ ssize_t v;
+
++ /* no user space access if system is rebooting */
++ if (bcache_is_reboot)
++ return -EBUSY;
++
+ if (attr == &sysfs_discard) {
+ bool v = strtoul_or_return(buf);
+
+--
+2.16.4
+
diff --git a/patches.suse/0046-bcache-acquire-bch_register_lock-later-in-cached_dev.patch b/patches.suse/0046-bcache-acquire-bch_register_lock-later-in-cached_dev.patch
new file mode 100644
index 0000000000..7c0d66857b
--- /dev/null
+++ b/patches.suse/0046-bcache-acquire-bch_register_lock-later-in-cached_dev.patch
@@ -0,0 +1,52 @@
+From 97ba3b816e2cdea798398bc8486125f79f2453c1 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:47 +0800
+Subject: [PATCH] bcache: acquire bch_register_lock later in
+ cached_dev_detach_finish()
+Git-commit: 97ba3b816e2cdea798398bc8486125f79f2453c1
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+Now there is variable bcache_is_reboot to prevent device register or
+unregister during reboot, it is unncessary to still hold mutex lock
+bch_register_lock before stopping writeback_rate_update kworker and
+writeback kthread. And if the stopping kworker or kthread holding
+bch_register_lock inside their routine (we used to have such problem
+in writeback thread, thanks to Junhui Wang fixed it), it is very easy
+to introduce deadlock during reboot/shutdown procedure.
+
+Therefore in this patch, the location to acquire bch_register_lock is
+moved to the location before calling calc_cached_dev_sectors(). Which
+is later then original location in cached_dev_detach_finish().
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index a88238ad5da1..40d857e690f9 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1018,7 +1018,6 @@ static void cached_dev_detach_finish(struct work_struct *w)
+ BUG_ON(!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags));
+ BUG_ON(refcount_read(&dc->count));
+
+- mutex_lock(&bch_register_lock);
+
+ if (test_and_clear_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags))
+ cancel_writeback_rate_update_dwork(dc);
+@@ -1034,6 +1033,8 @@ static void cached_dev_detach_finish(struct work_struct *w)
+ bch_write_bdev_super(dc, &cl);
+ closure_sync(&cl);
+
++ mutex_lock(&bch_register_lock);
++
+ calc_cached_dev_sectors(dc->disk.c);
+ bcache_device_detach(&dc->disk);
+ list_move(&dc->list, &uncached_devices);
+--
+2.16.4
+
diff --git a/patches.suse/0047-bcache-acquire-bch_register_lock-later-in-cached_dev.patch b/patches.suse/0047-bcache-acquire-bch_register_lock-later-in-cached_dev.patch
new file mode 100644
index 0000000000..5b44c594ac
--- /dev/null
+++ b/patches.suse/0047-bcache-acquire-bch_register_lock-later-in-cached_dev.patch
@@ -0,0 +1,164 @@
+From 80265d8dfd77792e133793cef44a21323aac2908 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:48 +0800
+Subject: [PATCH] bcache: acquire bch_register_lock later in cached_dev_free()
+Git-commit: 80265d8dfd77792e133793cef44a21323aac2908
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When enable lockdep engine, a lockdep warning can be observed when
+reboot or shutdown system,
+
+[ 3142.764557][ T1] bcache: bcache_reboot() Stopping all devices:
+[ 3142.776265][ T2649]
+[ 3142.777159][ T2649] ======================================================
+[ 3142.780039][ T2649] WARNING: possible circular locking dependency detected
+[ 3142.782869][ T2649] 5.2.0-rc4-lp151.20-default+ #1 Tainted: G W
+[ 3142.785684][ T2649] ------------------------------------------------------
+[ 3142.788479][ T2649] kworker/3:67/2649 is trying to acquire lock:
+[ 3142.790738][ T2649] 00000000aaf02291 ((wq_completion)bcache_writeback_wq){+.+.}, at: flush_workqueue+0x87/0x4c0
+[ 3142.794678][ T2649]
+[ 3142.794678][ T2649] but task is already holding lock:
+[ 3142.797402][ T2649] 000000004fcf89c5 (&bch_register_lock){+.+.}, at: cached_dev_free+0x17/0x120 [bcache]
+[ 3142.801462][ T2649]
+[ 3142.801462][ T2649] which lock already depends on the new lock.
+[ 3142.801462][ T2649]
+[ 3142.805277][ T2649]
+[ 3142.805277][ T2649] the existing dependency chain (in reverse order) is:
+[ 3142.808902][ T2649]
+[ 3142.808902][ T2649] -> #2 (&bch_register_lock){+.+.}:
+[ 3142.812396][ T2649] __mutex_lock+0x7a/0x9d0
+[ 3142.814184][ T2649] cached_dev_free+0x17/0x120 [bcache]
+[ 3142.816415][ T2649] process_one_work+0x2a4/0x640
+[ 3142.818413][ T2649] worker_thread+0x39/0x3f0
+[ 3142.820276][ T2649] kthread+0x125/0x140
+[ 3142.822061][ T2649] ret_from_fork+0x3a/0x50
+[ 3142.823965][ T2649]
+[ 3142.823965][ T2649] -> #1 ((work_completion)(&cl->work)#2){+.+.}:
+[ 3142.827244][ T2649] process_one_work+0x277/0x640
+[ 3142.829160][ T2649] worker_thread+0x39/0x3f0
+[ 3142.830958][ T2649] kthread+0x125/0x140
+[ 3142.832674][ T2649] ret_from_fork+0x3a/0x50
+[ 3142.834915][ T2649]
+[ 3142.834915][ T2649] -> #0 ((wq_completion)bcache_writeback_wq){+.+.}:
+[ 3142.838121][ T2649] lock_acquire+0xb4/0x1c0
+[ 3142.840025][ T2649] flush_workqueue+0xae/0x4c0
+[ 3142.842035][ T2649] drain_workqueue+0xa9/0x180
+[ 3142.844042][ T2649] destroy_workqueue+0x17/0x250
+[ 3142.846142][ T2649] cached_dev_free+0x52/0x120 [bcache]
+[ 3142.848530][ T2649] process_one_work+0x2a4/0x640
+[ 3142.850663][ T2649] worker_thread+0x39/0x3f0
+[ 3142.852464][ T2649] kthread+0x125/0x140
+[ 3142.854106][ T2649] ret_from_fork+0x3a/0x50
+[ 3142.855880][ T2649]
+[ 3142.855880][ T2649] other info that might help us debug this:
+[ 3142.855880][ T2649]
+[ 3142.859663][ T2649] Chain exists of:
+[ 3142.859663][ T2649] (wq_completion)bcache_writeback_wq --> (work_completion)(&cl->work)#2 --> &bch_register_lock
+[ 3142.859663][ T2649]
+[ 3142.865424][ T2649] Possible unsafe locking scenario:
+[ 3142.865424][ T2649]
+[ 3142.868022][ T2649] CPU0 CPU1
+[ 3142.869885][ T2649] ---- ----
+[ 3142.871751][ T2649] lock(&bch_register_lock);
+[ 3142.873379][ T2649] lock((work_completion)(&cl->work)#2);
+[ 3142.876399][ T2649] lock(&bch_register_lock);
+[ 3142.879727][ T2649] lock((wq_completion)bcache_writeback_wq);
+[ 3142.882064][ T2649]
+[ 3142.882064][ T2649] *** DEADLOCK ***
+[ 3142.882064][ T2649]
+[ 3142.885060][ T2649] 3 locks held by kworker/3:67/2649:
+[ 3142.887245][ T2649] #0: 00000000e774cdd0 ((wq_completion)events){+.+.}, at: process_one_work+0x21e/0x640
+[ 3142.890815][ T2649] #1: 00000000f7df89da ((work_completion)(&cl->work)#2){+.+.}, at: process_one_work+0x21e/0x640
+[ 3142.894884][ T2649] #2: 000000004fcf89c5 (&bch_register_lock){+.+.}, at: cached_dev_free+0x17/0x120 [bcache]
+[ 3142.898797][ T2649]
+[ 3142.898797][ T2649] stack backtrace:
+[ 3142.900961][ T2649] CPU: 3 PID: 2649 Comm: kworker/3:67 Tainted: G W 5.2.0-rc4-lp151.20-default+ #1
+[ 3142.904789][ T2649] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
+[ 3142.909168][ T2649] Workqueue: events cached_dev_free [bcache]
+[ 3142.911422][ T2649] Call Trace:
+[ 3142.912656][ T2649] dump_stack+0x85/0xcb
+[ 3142.914181][ T2649] print_circular_bug+0x19a/0x1f0
+[ 3142.916193][ T2649] __lock_acquire+0x16cd/0x1850
+[ 3142.917936][ T2649] ? __lock_acquire+0x6a8/0x1850
+[ 3142.919704][ T2649] ? lock_acquire+0xb4/0x1c0
+[ 3142.921335][ T2649] ? find_held_lock+0x34/0xa0
+[ 3142.923052][ T2649] lock_acquire+0xb4/0x1c0
+[ 3142.924635][ T2649] ? flush_workqueue+0x87/0x4c0
+[ 3142.926375][ T2649] flush_workqueue+0xae/0x4c0
+[ 3142.928047][ T2649] ? flush_workqueue+0x87/0x4c0
+[ 3142.929824][ T2649] ? drain_workqueue+0xa9/0x180
+[ 3142.931686][ T2649] drain_workqueue+0xa9/0x180
+[ 3142.933534][ T2649] destroy_workqueue+0x17/0x250
+[ 3142.935787][ T2649] cached_dev_free+0x52/0x120 [bcache]
+[ 3142.937795][ T2649] process_one_work+0x2a4/0x640
+[ 3142.939803][ T2649] worker_thread+0x39/0x3f0
+[ 3142.941487][ T2649] ? process_one_work+0x640/0x640
+[ 3142.943389][ T2649] kthread+0x125/0x140
+[ 3142.944894][ T2649] ? kthread_create_worker_on_cpu+0x70/0x70
+[ 3142.947744][ T2649] ret_from_fork+0x3a/0x50
+[ 3142.970358][ T2649] bcache: bcache_device_free() bcache0 stopped
+
+Here is how the deadlock happens.
+1) bcache_reboot() calls bcache_device_stop(), then inside
+ bcache_device_stop() BCACHE_DEV_CLOSING bit is set on d->flags.
+ Then closure_queue(&d->cl) is called to invoke cached_dev_flush().
+2) In cached_dev_flush(), cached_dev_free() is called by continu_at().
+3) In cached_dev_free(), when stopping the writeback kthread of the
+ cached device by kthread_stop(), dc->writeback_thread will be waken
+ up to quite the kthread while-loop, then cached_dev_put() is called
+ in bch_writeback_thread().
+4) Calling cached_dev_put() in writeback kthread may drop dc->count to
+ 0, then dc->detach kworker is scheduled, which is initialized as
+ cached_dev_detach_finish().
+5) Inside cached_dev_detach_finish(), the last line of code is to call
+ closure_put(&dc->disk.cl), which drops the last reference counter of
+ closrure dc->disk.cl, then the callback cached_dev_flush() gets
+ called.
+Now cached_dev_flush() is called for second time in the code path, the
+first time is in step 2). And again bch_register_lock will be acquired
+again, and a A-A lock (lockdep terminology) is happening.
+
+The root cause of the above A-A lock is in cached_dev_free(), mutex
+bch_register_lock is held before stopping writeback kthread and other
+kworkers. Fortunately now we have variable 'bcache_is_reboot', which may
+prevent device registration or unregistration during reboot/shutdown
+time, so it is unncessary to hold bch_register_lock such early now.
+
+This is how this patch fixes the reboot/shutdown time A-A lock issue:
+After moving mutex_lock(&bch_register_lock) to a later location where
+before atomic_read(&dc->running) in cached_dev_free(), such A-A lock
+problem can be solved without any reboot time registration race.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 40d857e690f9..8a12a8313367 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1231,8 +1231,6 @@ static void cached_dev_free(struct closure *cl)
+ {
+ struct cached_dev *dc = container_of(cl, struct cached_dev, disk.cl);
+
+- mutex_lock(&bch_register_lock);
+-
+ if (test_and_clear_bit(BCACHE_DEV_WB_RUNNING, &dc->disk.flags))
+ cancel_writeback_rate_update_dwork(dc);
+
+@@ -1243,6 +1241,8 @@ static void cached_dev_free(struct closure *cl)
+ if (!IS_ERR_OR_NULL(dc->status_update_thread))
+ kthread_stop(dc->status_update_thread);
+
++ mutex_lock(&bch_register_lock);
++
+ if (atomic_read(&dc->running))
+ bd_unlink_disk_holder(dc->bdev, dc->disk.disk);
+ bcache_device_free(&dc->disk);
+--
+2.16.4
+
diff --git a/patches.suse/0048-bcache-fix-potential-deadlock-in-cached_def_free.patch b/patches.suse/0048-bcache-fix-potential-deadlock-in-cached_def_free.patch
new file mode 100644
index 0000000000..12b5133f47
--- /dev/null
+++ b/patches.suse/0048-bcache-fix-potential-deadlock-in-cached_def_free.patch
@@ -0,0 +1,173 @@
+From 7e865eba00a3df2dc8c4746173a8ca1c1c7f042e Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:49 +0800
+Subject: [PATCH] bcache: fix potential deadlock in cached_def_free()
+Git-commit: 7e865eba00a3df2dc8c4746173a8ca1c1c7f042e
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When enable lockdep and reboot system with a writeback mode bcache
+device, the following potential deadlock warning is reported by lockdep
+engine.
+
+[ 101.536569][ T401] kworker/2:2/401 is trying to acquire lock:
+[ 101.538575][ T401] 00000000bbf6e6c7 ((wq_completion)bcache_writeback_wq){+.+.}, at: flush_workqueue+0x87/0x4c0
+[ 101.542054][ T401]
+[ 101.542054][ T401] but task is already holding lock:
+[ 101.544587][ T401] 00000000f5f305b3 ((work_completion)(&cl->work)#2){+.+.}, at: process_one_work+0x21e/0x640
+[ 101.548386][ T401]
+[ 101.548386][ T401] which lock already depends on the new lock.
+[ 101.548386][ T401]
+[ 101.551874][ T401]
+[ 101.551874][ T401] the existing dependency chain (in reverse order) is:
+[ 101.555000][ T401]
+[ 101.555000][ T401] -> #1 ((work_completion)(&cl->work)#2){+.+.}:
+[ 101.557860][ T401] process_one_work+0x277/0x640
+[ 101.559661][ T401] worker_thread+0x39/0x3f0
+[ 101.561340][ T401] kthread+0x125/0x140
+[ 101.562963][ T401] ret_from_fork+0x3a/0x50
+[ 101.564718][ T401]
+[ 101.564718][ T401] -> #0 ((wq_completion)bcache_writeback_wq){+.+.}:
+[ 101.567701][ T401] lock_acquire+0xb4/0x1c0
+[ 101.569651][ T401] flush_workqueue+0xae/0x4c0
+[ 101.571494][ T401] drain_workqueue+0xa9/0x180
+[ 101.573234][ T401] destroy_workqueue+0x17/0x250
+[ 101.575109][ T401] cached_dev_free+0x44/0x120 [bcache]
+[ 101.577304][ T401] process_one_work+0x2a4/0x640
+[ 101.579357][ T401] worker_thread+0x39/0x3f0
+[ 101.581055][ T401] kthread+0x125/0x140
+[ 101.582709][ T401] ret_from_fork+0x3a/0x50
+[ 101.584592][ T401]
+[ 101.584592][ T401] other info that might help us debug this:
+[ 101.584592][ T401]
+[ 101.588355][ T401] Possible unsafe locking scenario:
+[ 101.588355][ T401]
+[ 101.590974][ T401] CPU0 CPU1
+[ 101.592889][ T401] ---- ----
+[ 101.594743][ T401] lock((work_completion)(&cl->work)#2);
+[ 101.596785][ T401] lock((wq_completion)bcache_writeback_wq);
+[ 101.600072][ T401] lock((work_completion)(&cl->work)#2);
+[ 101.602971][ T401] lock((wq_completion)bcache_writeback_wq);
+[ 101.605255][ T401]
+[ 101.605255][ T401] *** DEADLOCK ***
+[ 101.605255][ T401]
+[ 101.608310][ T401] 2 locks held by kworker/2:2/401:
+[ 101.610208][ T401] #0: 00000000cf2c7d17 ((wq_completion)events){+.+.}, at: process_one_work+0x21e/0x640
+[ 101.613709][ T401] #1: 00000000f5f305b3 ((work_completion)(&cl->work)#2){+.+.}, at: process_one_work+0x21e/0x640
+[ 101.617480][ T401]
+[ 101.617480][ T401] stack backtrace:
+[ 101.619539][ T401] CPU: 2 PID: 401 Comm: kworker/2:2 Tainted: G W 5.2.0-rc4-lp151.20-default+ #1
+[ 101.623225][ T401] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 04/13/2018
+[ 101.627210][ T401] Workqueue: events cached_dev_free [bcache]
+[ 101.629239][ T401] Call Trace:
+[ 101.630360][ T401] dump_stack+0x85/0xcb
+[ 101.631777][ T401] print_circular_bug+0x19a/0x1f0
+[ 101.633485][ T401] __lock_acquire+0x16cd/0x1850
+[ 101.635184][ T401] ? __lock_acquire+0x6a8/0x1850
+[ 101.636863][ T401] ? lock_acquire+0xb4/0x1c0
+[ 101.638421][ T401] ? find_held_lock+0x34/0xa0
+[ 101.640015][ T401] lock_acquire+0xb4/0x1c0
+[ 101.641513][ T401] ? flush_workqueue+0x87/0x4c0
+[ 101.643248][ T401] flush_workqueue+0xae/0x4c0
+[ 101.644832][ T401] ? flush_workqueue+0x87/0x4c0
+[ 101.646476][ T401] ? drain_workqueue+0xa9/0x180
+[ 101.648303][ T401] drain_workqueue+0xa9/0x180
+[ 101.649867][ T401] destroy_workqueue+0x17/0x250
+[ 101.651503][ T401] cached_dev_free+0x44/0x120 [bcache]
+[ 101.653328][ T401] process_one_work+0x2a4/0x640
+[ 101.655029][ T401] worker_thread+0x39/0x3f0
+[ 101.656693][ T401] ? process_one_work+0x640/0x640
+[ 101.658501][ T401] kthread+0x125/0x140
+[ 101.660012][ T401] ? kthread_create_worker_on_cpu+0x70/0x70
+[ 101.661985][ T401] ret_from_fork+0x3a/0x50
+[ 101.691318][ T401] bcache: bcache_device_free() bcache0 stopped
+
+Here is how the above potential deadlock may happen in reboot/shutdown
+code path,
+1) bcache_reboot() is called firstly in the reboot/shutdown code path,
+ then in bcache_reboot(), bcache_device_stop() is called.
+2) bcache_device_stop() sets BCACHE_DEV_CLOSING on d->falgs, then call
+ closure_queue(&d->cl) to invoke cached_dev_flush(). And in turn
+ cached_dev_flush() calls cached_dev_free() via closure_at()
+3) In cached_dev_free(), after stopped writebach kthread
+ dc->writeback_thread, the kwork dc->writeback_write_wq is stopping by
+ destroy_workqueue().
+4) Inside destroy_workqueue(), drain_workqueue() is called. Inside
+ drain_workqueue(), flush_workqueue() is called. Then wq->lockdep_map
+ is acquired by lock_map_acquire() in flush_workqueue(). After the
+ lock acquired the rest part of flush_workqueue() just wait for the
+ workqueue to complete.
+5) Now we look back at writeback thread routine bch_writeback_thread(),
+ in the main while-loop, write_dirty() is called via continue_at() in
+ read_dirty_submit(), which is called via continue_at() in while-loop
+ level called function read_dirty(). Inside write_dirty() it may be
+ re-called on workqueeu dc->writeback_write_wq via continue_at().
+ It means when the writeback kthread is stopped in cached_dev_free()
+ there might be still one kworker queued on dc->writeback_write_wq
+ to execute write_dirty() again.
+6) Now this kworker is scheduled on dc->writeback_write_wq to run by
+ process_one_work() (which is called by worker_thread()). Before
+ calling the kwork routine, wq->lockdep_map is acquired.
+7) But wq->lockdep_map is acquired already in step 4), so a A-A lock
+ (lockdep terminology) scenario happens.
+
+Indeed on multiple cores syatem, the above deadlock is very rare to
+happen, just as the code comments in process_one_work() says,
+2263 * AFAICT there is no possible deadlock scenario between the
+2264 * flush_work() and complete() primitives (except for
+ single-threaded
+2265 * workqueues), so hiding them isn't a problem.
+
+But it is still good to fix such lockdep warning, even no one running
+bcache on single core system.
+
+The fix is simple. This patch solves the above potential deadlock by,
+- Do not destroy workqueue dc->writeback_write_wq in cached_dev_free().
+- Flush and destroy dc->writeback_write_wq in writebach kthread routine
+ bch_writeback_thread(), where after quit the thread main while-loop
+ and before cached_dev_put() is called.
+
+By this fix, dc->writeback_write_wq will be stopped and destroy before
+the writeback kthread stopped, so the chance for a A-A locking on
+wq->lockdep_map is disappeared, such A-A deadlock won't happen
+any more.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 2 --
+ drivers/md/bcache/writeback.c | 4 ++++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index 8a12a8313367..a8ea4e2086a9 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1236,8 +1236,6 @@ static void cached_dev_free(struct closure *cl)
+
+ if (!IS_ERR_OR_NULL(dc->writeback_thread))
+ kthread_stop(dc->writeback_thread);
+- if (dc->writeback_write_wq)
+- destroy_workqueue(dc->writeback_write_wq);
+ if (!IS_ERR_OR_NULL(dc->status_update_thread))
+ kthread_stop(dc->status_update_thread);
+
+diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
+index 21081febcb59..d60268fe49e1 100644
+--- a/drivers/md/bcache/writeback.c
++++ b/drivers/md/bcache/writeback.c
+@@ -738,6 +738,10 @@ static int bch_writeback_thread(void *arg)
+ }
+ }
+
++ if (dc->writeback_write_wq) {
++ flush_workqueue(dc->writeback_write_wq);
++ destroy_workqueue(dc->writeback_write_wq);
++ }
+ cached_dev_put(dc);
+ wait_for_kthread_stop();
+
+--
+2.16.4
+
diff --git a/patches.suse/0049-bcache-add-code-comments-for-journal_read_bucket.patch b/patches.suse/0049-bcache-add-code-comments-for-journal_read_bucket.patch
new file mode 100644
index 0000000000..fd12ccde2f
--- /dev/null
+++ b/patches.suse/0049-bcache-add-code-comments-for-journal_read_bucket.patch
@@ -0,0 +1,77 @@
+From 2464b693148e5d5ca42b6064bb40c1a275ea61cd Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:50 +0800
+Subject: [PATCH] bcache: add code comments for journal_read_bucket()
+Git-commit: 2464b693148e5d5ca42b6064bb40c1a275ea61cd
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This patch adds more code comments in journal_read_bucket(), this is an
+effort to make the code to be more understandable.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 54f8886b6177..98ee467ec3f7 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -100,6 +100,20 @@ reread: left = ca->sb.bucket_size - offset;
+
+ blocks = set_blocks(j, block_bytes(ca->set));
+
++ /*
++ * Nodes in 'list' are in linear increasing order of
++ * i->j.seq, the node on head has the smallest (oldest)
++ * journal seq, the node on tail has the biggest
++ * (latest) journal seq.
++ */
++
++ /*
++ * Check from the oldest jset for last_seq. If
++ * i->j.seq < j->last_seq, it means the oldest jset
++ * in list is expired and useless, remove it from
++ * this list. Otherwise, j is a condidate jset for
++ * further following checks.
++ */
+ while (!list_empty(list)) {
+ i = list_first_entry(list,
+ struct journal_replay, list);
+@@ -109,13 +123,22 @@ reread: left = ca->sb.bucket_size - offset;
+ kfree(i);
+ }
+
++ /* iterate list in reverse order (from latest jset) */
+ list_for_each_entry_reverse(i, list, list) {
+ if (j->seq == i->j.seq)
+ goto next_set;
+
++ /*
++ * if j->seq is less than any i->j.last_seq
++ * in list, j is an expired and useless jset.
++ */
+ if (j->seq < i->j.last_seq)
+ goto next_set;
+
++ /*
++ * 'where' points to first jset in list which
++ * is elder then j.
++ */
+ if (j->seq > i->j.seq) {
+ where = &i->list;
+ goto add;
+@@ -129,6 +152,7 @@ reread: left = ca->sb.bucket_size - offset;
+ if (!i)
+ return -ENOMEM;
+ memcpy(&i->j, j, bytes);
++ /* Add to the location after 'where' points to */
+ list_add(&i->list, where);
+ ret = 1;
+
+--
+2.16.4
+
diff --git a/patches.suse/0050-bcache-set-largest-seq-to-ja-seq-bucket_index-in-jou.patch b/patches.suse/0050-bcache-set-largest-seq-to-ja-seq-bucket_index-in-jou.patch
new file mode 100644
index 0000000000..0a71b87d76
--- /dev/null
+++ b/patches.suse/0050-bcache-set-largest-seq-to-ja-seq-bucket_index-in-jou.patch
@@ -0,0 +1,39 @@
+From a231f07a5fe30a522b402011c5190cb936641a66 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:51 +0800
+Subject: [PATCH] bcache: set largest seq to ja->seq[bucket_index] in
+ journal_read_bucket()
+Git-commit: a231f07a5fe30a522b402011c5190cb936641a66
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In journal_read_bucket() when setting ja->seq[bucket_index], there might
+be potential case that a later non-maximum overwrites a better sequence
+number to ja->seq[bucket_index]. This patch adds a check to make sure
+that ja->seq[bucket_index] will be only set a new value if it is bigger
+then current value.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 98ee467ec3f7..3d321bffddc9 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -156,7 +156,8 @@ reread: left = ca->sb.bucket_size - offset;
+ list_add(&i->list, where);
+ ret = 1;
+
+- ja->seq[bucket_index] = j->seq;
++ if (j->seq > ja->seq[bucket_index])
++ ja->seq[bucket_index] = j->seq;
+ next_set:
+ offset += blocks * ca->sb.block_size;
+ len -= blocks * ca->sb.block_size;
+--
+2.16.4
+
diff --git a/patches.suse/0051-bcache-shrink-btree-node-cache-after-bch_btree_check.patch b/patches.suse/0051-bcache-shrink-btree-node-cache-after-bch_btree_check.patch
new file mode 100644
index 0000000000..86ad95018e
--- /dev/null
+++ b/patches.suse/0051-bcache-shrink-btree-node-cache-after-bch_btree_check.patch
@@ -0,0 +1,60 @@
+From 1df3877ff6a4810054237c3259d900ded4468969 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:52 +0800
+Subject: [PATCH] bcache: shrink btree node cache after bch_btree_check()
+Git-commit: 1df3877ff6a4810054237c3259d900ded4468969
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When cache set starts, bch_btree_check() will check all bkeys on cache
+device by calculating the checksum. This operation will consume a huge
+number of system memory if there are a lot of data cached. Since bcache
+uses its own mca cache to maintain all its read-in btree nodes, and only
+releases the cache space when system memory manage code starts to shrink
+caches. Then before memory manager code to call the mca cache shrinker
+callback, bcache mca cache will compete memory resource with user space
+application, which may have nagive effect to performance of user space
+workloads (e.g. data base, or I/O service of distributed storage node).
+
+This patch tries to call bcache mca shrinker routine to proactively
+release mca cache memory, to decrease the memory pressure of system and
+avoid negative effort of the overall system I/O performance.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/super.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index a8ea4e2086a9..26e374fbf57c 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1880,6 +1880,23 @@ static int run_cache_set(struct cache_set *c)
+ if (bch_btree_check(c))
+ goto err;
+
++ /*
++ * bch_btree_check() may occupy too much system memory which
++ * has negative effects to user space application (e.g. data
++ * base) performance. Shrink the mca cache memory proactively
++ * here to avoid competing memory with user space workloads..
++ */
++ if (!c->shrinker_disabled) {
++ struct shrink_control sc;
++
++ sc.gfp_mask = GFP_KERNEL;
++ sc.nr_to_scan = c->btree_cache_used * c->btree_pages;
++ /* first run to clear b->accessed tag */
++ c->shrink.scan_objects(&c->shrink, &sc);
++ /* second run to reap non-accessed nodes */
++ c->shrink.scan_objects(&c->shrink, &sc);
++ }
++
+ bch_journal_mark(c, &journal);
+ bch_initial_gc_finish(c);
+ pr_debug("btree_check() done");
+--
+2.16.4
+
diff --git a/patches.suse/0052-bcache-Revert-bcache-free-heap-cache_set-flush_btree.patch b/patches.suse/0052-bcache-Revert-bcache-free-heap-cache_set-flush_btree.patch
new file mode 100644
index 0000000000..c2d90bc728
--- /dev/null
+++ b/patches.suse/0052-bcache-Revert-bcache-free-heap-cache_set-flush_btree.patch
@@ -0,0 +1,40 @@
+From ba82c1ac1667d6efb91a268edb13fc9cdaecec9b Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:53 +0800
+Subject: [PATCH] bcache: Revert "bcache: free heap cache_set->flush_btree in
+ bch_journal_free"
+Git-commit: ba82c1ac1667d6efb91a268edb13fc9cdaecec9b
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This reverts commit 6268dc2c4703aabfb0b35681be709acf4c2826c6.
+
+This patch depends on commit c4dc2497d50d ("bcache: fix high CPU
+occupancy during journal") which is reverted in previous patch. So
+revert this one too.
+
+Fixes: 6268dc2c4703 ("bcache: free heap cache_set->flush_btree in bch_journal_free")
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org
+Cc: Shenghui Wang <shhuiw@foxmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 3d321bffddc9..11d8c93b88bb 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -884,7 +884,6 @@ void bch_journal_free(struct cache_set *c)
+ free_pages((unsigned long) c->journal.w[1].data, JSET_BITS);
+ free_pages((unsigned long) c->journal.w[0].data, JSET_BITS);
+ free_fifo(&c->journal.pin);
+- free_heap(&c->flush_btree);
+ }
+
+ int bch_journal_alloc(struct cache_set *c)
+--
+2.16.4
+
diff --git a/patches.suse/0053-bcache-Revert-bcache-fix-high-CPU-occupancy-during-j.patch b/patches.suse/0053-bcache-Revert-bcache-fix-high-CPU-occupancy-during-j.patch
new file mode 100644
index 0000000000..6c620a7694
--- /dev/null
+++ b/patches.suse/0053-bcache-Revert-bcache-fix-high-CPU-occupancy-during-j.patch
@@ -0,0 +1,134 @@
+From 249a5f6da57c28a903c75d81505d58ec8c10030d Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:54 +0800
+Subject: [PATCH] bcache: Revert "bcache: fix high CPU occupancy during
+ journal"
+Git-commit: 249a5f6da57c28a903c75d81505d58ec8c10030d
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This reverts commit c4dc2497d50d9c6fb16aa0d07b6a14f3b2adb1e0.
+
+This patch enlarges a race between normal btree flush code path and
+flush_btree_write(), which causes deadlock when journal space is
+exhausted. Reverts this patch makes the race window from 128 btree
+nodes to only 1 btree nodes.
+
+Fixes: c4dc2497d50d ("bcache: fix high CPU occupancy during journal")
+Signed-off-by: Coly Li <colyli@suse.de>
+Cc: stable@vger.kernel.org
+Cc: Tang Junhui <tang.junhui.linux@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bcache.h | 2 --
+ drivers/md/bcache/journal.c | 47 +++++++++++++++------------------------------
+ drivers/md/bcache/util.h | 2 --
+ 3 files changed, 15 insertions(+), 36 deletions(-)
+
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 73a97586a2ef..cb268d7c6cea 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -726,8 +726,6 @@ struct cache_set {
+
+ #define BUCKET_HASH_BITS 12
+ struct hlist_head bucket_hash[1 << BUCKET_HASH_BITS];
+-
+- DECLARE_HEAP(struct btree *, flush_btree);
+ };
+
+ struct bbio {
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 11d8c93b88bb..14a4e2c44de9 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -416,12 +416,6 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+ }
+
+ /* Journalling */
+-#define journal_max_cmp(l, r) \
+- (fifo_idx(&c->journal.pin, btree_current_write(l)->journal) < \
+- fifo_idx(&(c)->journal.pin, btree_current_write(r)->journal))
+-#define journal_min_cmp(l, r) \
+- (fifo_idx(&c->journal.pin, btree_current_write(l)->journal) > \
+- fifo_idx(&(c)->journal.pin, btree_current_write(r)->journal))
+
+ static void btree_flush_write(struct cache_set *c)
+ {
+@@ -429,35 +423,25 @@ static void btree_flush_write(struct cache_set *c)
+ * Try to find the btree node with that references the oldest journal
+ * entry, best is our current candidate and is locked if non NULL:
+ */
+- struct btree *b;
+- int i;
++ struct btree *b, *best;
++ unsigned int i;
+
+ atomic_long_inc(&c->flush_write);
+-
+ retry:
+- spin_lock(&c->journal.lock);
+- if (heap_empty(&c->flush_btree)) {
+- for_each_cached_btree(b, c, i)
+- if (btree_current_write(b)->journal) {
+- if (!heap_full(&c->flush_btree))
+- heap_add(&c->flush_btree, b,
+- journal_max_cmp);
+- else if (journal_max_cmp(b,
+- heap_peek(&c->flush_btree))) {
+- c->flush_btree.data[0] = b;
+- heap_sift(&c->flush_btree, 0,
+- journal_max_cmp);
+- }
++ best = NULL;
++
++ for_each_cached_btree(b, c, i)
++ if (btree_current_write(b)->journal) {
++ if (!best)
++ best = b;
++ else if (journal_pin_cmp(c,
++ btree_current_write(best)->journal,
++ btree_current_write(b)->journal)) {
++ best = b;
+ }
++ }
+
+- for (i = c->flush_btree.used / 2 - 1; i >= 0; --i)
+- heap_sift(&c->flush_btree, i, journal_min_cmp);
+- }
+-
+- b = NULL;
+- heap_pop(&c->flush_btree, b, journal_min_cmp);
+- spin_unlock(&c->journal.lock);
+-
++ b = best;
+ if (b) {
+ mutex_lock(&b->write_lock);
+ if (!btree_current_write(b)->journal) {
+@@ -898,8 +882,7 @@ int bch_journal_alloc(struct cache_set *c)
+ j->w[0].c = c;
+ j->w[1].c = c;
+
+- if (!(init_heap(&c->flush_btree, 128, GFP_KERNEL)) ||
+- !(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
++ if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
+ !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) ||
+ !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)))
+ return -ENOMEM;
+diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
+index 1fbced94e4cc..c029f7443190 100644
+--- a/drivers/md/bcache/util.h
++++ b/drivers/md/bcache/util.h
+@@ -113,8 +113,6 @@ do { \
+
+ #define heap_full(h) ((h)->used == (h)->size)
+
+-#define heap_empty(h) ((h)->used == 0)
+-
+ #define DECLARE_FIFO(type, name) \
+ struct { \
+ size_t front, back, size, mask; \
+--
+2.16.4
+
diff --git a/patches.suse/0054-bcache-only-clear-BTREE_NODE_dirty-bit-when-it-is-se.patch b/patches.suse/0054-bcache-only-clear-BTREE_NODE_dirty-bit-when-it-is-se.patch
new file mode 100644
index 0000000000..603184a335
--- /dev/null
+++ b/patches.suse/0054-bcache-only-clear-BTREE_NODE_dirty-bit-when-it-is-se.patch
@@ -0,0 +1,62 @@
+From e5ec5f4765ada9c75fb3eee93a6e72f0e50599d5 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:55 +0800
+Subject: [PATCH] bcache: only clear BTREE_NODE_dirty bit when it is set
+Git-commit: e5ec5f4765ada9c75fb3eee93a6e72f0e50599d5
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In bch_btree_cache_free() and btree_node_free(), BTREE_NODE_dirty is
+always set no matter btree node is dirty or not. The code looks like
+this,
+ if (btree_node_dirty(b))
+ btree_complete_write(b, btree_current_write(b));
+ clear_bit(BTREE_NODE_dirty, &b->flags);
+
+Indeed if btree_node_dirty(b) returns false, it means BTREE_NODE_dirty
+bit is cleared, then it is unnecessary to clear the bit again.
+
+This patch only clears BTREE_NODE_dirty when btree_node_dirty(b) is
+true (the bit is set), to save a few CPU cycles.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/btree.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index cf38a1b031fa..88e5aa3fbb07 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -782,10 +782,10 @@ void bch_btree_cache_free(struct cache_set *c)
+ while (!list_empty(&c->btree_cache)) {
+ b = list_first_entry(&c->btree_cache, struct btree, list);
+
+- if (btree_node_dirty(b))
++ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+- clear_bit(BTREE_NODE_dirty, &b->flags);
+-
++ clear_bit(BTREE_NODE_dirty, &b->flags);
++ }
+ mca_data_free(b);
+ }
+
+@@ -1073,9 +1073,10 @@ static void btree_node_free(struct btree *b)
+
+ mutex_lock(&b->write_lock);
+
+- if (btree_node_dirty(b))
++ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+- clear_bit(BTREE_NODE_dirty, &b->flags);
++ clear_bit(BTREE_NODE_dirty, &b->flags);
++ }
+
+ mutex_unlock(&b->write_lock);
+
+--
+2.16.4
+
diff --git a/patches.suse/0055-bcache-add-comments-for-mutex_lock-b-write_lock.patch b/patches.suse/0055-bcache-add-comments-for-mutex_lock-b-write_lock.patch
new file mode 100644
index 0000000000..2e53222aa7
--- /dev/null
+++ b/patches.suse/0055-bcache-add-comments-for-mutex_lock-b-write_lock.patch
@@ -0,0 +1,52 @@
+From 41508bb7d46b74dba631017e5a702a86caf1db8c Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:56 +0800
+Subject: [PATCH] bcache: add comments for mutex_lock(&b->write_lock)
+Git-commit: 41508bb7d46b74dba631017e5a702a86caf1db8c
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+When accessing or modifying BTREE_NODE_dirty bit, it is not always
+necessary to acquire b->write_lock. In bch_btree_cache_free() and
+mca_reap() acquiring b->write_lock is necessary, and this patch adds
+comments to explain why mutex_lock(&b->write_lock) is necessary for
+checking or clearing BTREE_NODE_dirty bit there.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/btree.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 88e5aa3fbb07..846306c3a887 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -659,6 +659,11 @@ static int mca_reap(struct btree *b, unsigned int min_order, bool flush)
+ up(&b->io_mutex);
+ }
+
++ /*
++ * BTREE_NODE_dirty might be cleared in btree_flush_btree() by
++ * __bch_btree_node_write(). To avoid an extra flush, acquire
++ * b->write_lock before checking BTREE_NODE_dirty bit.
++ */
+ mutex_lock(&b->write_lock);
+ if (btree_node_dirty(b))
+ __bch_btree_node_write(b, &cl);
+@@ -782,6 +787,11 @@ void bch_btree_cache_free(struct cache_set *c)
+ while (!list_empty(&c->btree_cache)) {
+ b = list_first_entry(&c->btree_cache, struct btree, list);
+
++ /*
++ * This function is called by cache_set_free(), no I/O
++ * request on cache now, it is unnecessary to acquire
++ * b->write_lock before clearing BTREE_NODE_dirty anymore.
++ */
+ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+ clear_bit(BTREE_NODE_dirty, &b->flags);
+--
+2.16.4
+
diff --git a/patches.suse/0056-bcache-remove-retry_flush_write-from-struct-cache_se.patch b/patches.suse/0056-bcache-remove-retry_flush_write-from-struct-cache_se.patch
new file mode 100644
index 0000000000..88f21bf0b9
--- /dev/null
+++ b/patches.suse/0056-bcache-remove-retry_flush_write-from-struct-cache_se.patch
@@ -0,0 +1,80 @@
+From d91ce7574daf48a4567ba62733d43284f5d2a3f4 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:57 +0800
+Subject: [PATCH] bcache: remove retry_flush_write from struct cache_set
+Git-commit: d91ce7574daf48a4567ba62733d43284f5d2a3f4
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+In struct cache_set, retry_flush_write is added for commit c4dc2497d50d
+("bcache: fix high CPU occupancy during journal") which is reverted in
+previous patch.
+
+Now it is useless anymore, and this patch removes it from bcache code.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bcache.h | 1 -
+ drivers/md/bcache/journal.c | 1 -
+ drivers/md/bcache/sysfs.c | 5 -----
+ 3 files changed, 7 deletions(-)
+
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index cb268d7c6cea..35396248a7d5 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -706,7 +706,6 @@ struct cache_set {
+
+ atomic_long_t reclaim;
+ atomic_long_t flush_write;
+- atomic_long_t retry_flush_write;
+
+ enum {
+ ON_ERROR_UNREGISTER,
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 14a4e2c44de9..1218e3cada3c 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -447,7 +447,6 @@ static void btree_flush_write(struct cache_set *c)
+ if (!btree_current_write(b)->journal) {
+ mutex_unlock(&b->write_lock);
+ /* We raced */
+- atomic_long_inc(&c->retry_flush_write);
+ goto retry;
+ }
+
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index d62e28643109..701a386a954c 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -83,7 +83,6 @@ read_attribute(state);
+ read_attribute(cache_read_races);
+ read_attribute(reclaim);
+ read_attribute(flush_write);
+-read_attribute(retry_flush_write);
+ read_attribute(writeback_keys_done);
+ read_attribute(writeback_keys_failed);
+ read_attribute(io_errors);
+@@ -709,9 +708,6 @@ SHOW(__bch_cache_set)
+ sysfs_print(flush_write,
+ atomic_long_read(&c->flush_write));
+
+- sysfs_print(retry_flush_write,
+- atomic_long_read(&c->retry_flush_write));
+-
+ sysfs_print(writeback_keys_done,
+ atomic_long_read(&c->writeback_keys_done));
+ sysfs_print(writeback_keys_failed,
+@@ -936,7 +932,6 @@ static struct attribute *bch_cache_set_internal_files[] = {
+ &sysfs_cache_read_races,
+ &sysfs_reclaim,
+ &sysfs_flush_write,
+- &sysfs_retry_flush_write,
+ &sysfs_writeback_keys_done,
+ &sysfs_writeback_keys_failed,
+
+--
+2.16.4
+
diff --git a/patches.suse/0057-bcache-fix-race-in-btree_flush_write.patch b/patches.suse/0057-bcache-fix-race-in-btree_flush_write.patch
new file mode 100644
index 0000000000..96f2d7910f
--- /dev/null
+++ b/patches.suse/0057-bcache-fix-race-in-btree_flush_write.patch
@@ -0,0 +1,191 @@
+From 50a260e859964002dab162513a10f91ae9d3bcd3 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:58 +0800
+Subject: [PATCH] bcache: fix race in btree_flush_write()
+Git-commit: 50a260e859964002dab162513a10f91ae9d3bcd3
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+There is a race between mca_reap(), btree_node_free() and journal code
+btree_flush_write(), which results very rare and strange deadlock or
+panic and are very hard to reproduce.
+
+Let me explain how the race happens. In btree_flush_write() one btree
+node with oldest journal pin is selected, then it is flushed to cache
+device, the select-and-flush is a two steps operation. Between these two
+steps, there are something may happen inside the race window,
+- The selected btree node was reaped by mca_reap() and allocated to
+ other requesters for other btree node.
+- The slected btree node was selected, flushed and released by mca
+ shrink callback bch_mca_scan().
+When btree_flush_write() tries to flush the selected btree node, firstly
+b->write_lock is held by mutex_lock(). If the race happens and the
+memory of selected btree node is allocated to other btree node, if that
+btree node's write_lock is held already, a deadlock very probably
+happens here. A worse case is the memory of the selected btree node is
+released, then all references to this btree node (e.g. b->write_lock)
+will trigger NULL pointer deference panic.
+
+This race was introduced in commit cafe56359144 ("bcache: A block layer
+cache"), and enlarged by commit c4dc2497d50d ("bcache: fix high CPU
+occupancy during journal"), which selected 128 btree nodes and flushed
+them one-by-one in a quite long time period.
+
+Such race is not easy to reproduce before. On a Lenovo SR650 server with
+48 Xeon cores, and configure 1 NVMe SSD as cache device, a MD raid0
+device assembled by 3 NVMe SSDs as backing device, this race can be
+observed around every 10,000 times btree_flush_write() gets called. Both
+deadlock and kernel panic all happened as aftermath of the race.
+
+The idea of the fix is to add a btree flag BTREE_NODE_journal_flush. It
+is set when selecting btree nodes, and cleared after btree nodes
+flushed. Then when mca_reap() selects a btree node with this bit set,
+this btree node will be skipped. Since mca_reap() only reaps btree node
+without BTREE_NODE_journal_flush flag, such race is avoided.
+
+Once corner case should be noticed, that is btree_node_free(). It might
+be called in some error handling code path. For example the following
+code piece from btree_split(),
+ 2149 err_free2:
+ 2150 bkey_put(b->c, &n2->key);
+ 2151 btree_node_free(n2);
+ 2152 rw_unlock(true, n2);
+ 2153 err_free1:
+ 2154 bkey_put(b->c, &n1->key);
+ 2155 btree_node_free(n1);
+ 2156 rw_unlock(true, n1);
+At line 2151 and 2155, the btree node n2 and n1 are released without
+mac_reap(), so BTREE_NODE_journal_flush also needs to be checked here.
+If btree_node_free() is called directly in such error handling path,
+and the selected btree node has BTREE_NODE_journal_flush bit set, just
+delay for 1 us and retry again. In this case this btree node won't
+be skipped, just retry until the BTREE_NODE_journal_flush bit cleared,
+and free the btree node memory.
+
+Fixes: cafe56359144 ("bcache: A block layer cache")
+Signed-off-by: Coly Li <colyli@suse.de>
+Reported-and-tested-by: kbuild test robot <lkp@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/btree.c | 28 +++++++++++++++++++++++++++-
+ drivers/md/bcache/btree.h | 2 ++
+ drivers/md/bcache/journal.c | 7 +++++++
+ 3 files changed, 36 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 846306c3a887..ba434d9ac720 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -35,7 +35,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/sched/clock.h>
+ #include <linux/rculist.h>
+-
++#include <linux/delay.h>
+ #include <trace/events/bcache.h>
+
+ /*
+@@ -659,12 +659,25 @@ static int mca_reap(struct btree *b, unsigned int min_order, bool flush)
+ up(&b->io_mutex);
+ }
+
++retry:
+ /*
+ * BTREE_NODE_dirty might be cleared in btree_flush_btree() by
+ * __bch_btree_node_write(). To avoid an extra flush, acquire
+ * b->write_lock before checking BTREE_NODE_dirty bit.
+ */
+ mutex_lock(&b->write_lock);
++ /*
++ * If this btree node is selected in btree_flush_write() by journal
++ * code, delay and retry until the node is flushed by journal code
++ * and BTREE_NODE_journal_flush bit cleared by btree_flush_write().
++ */
++ if (btree_node_journal_flush(b)) {
++ pr_debug("bnode %p is flushing by journal, retry", b);
++ mutex_unlock(&b->write_lock);
++ udelay(1);
++ goto retry;
++ }
++
+ if (btree_node_dirty(b))
+ __bch_btree_node_write(b, &cl);
+ mutex_unlock(&b->write_lock);
+@@ -1081,7 +1094,20 @@ static void btree_node_free(struct btree *b)
+
+ BUG_ON(b == b->c->root);
+
++retry:
+ mutex_lock(&b->write_lock);
++ /*
++ * If the btree node is selected and flushing in btree_flush_write(),
++ * delay and retry until the BTREE_NODE_journal_flush bit cleared,
++ * then it is safe to free the btree node here. Otherwise this btree
++ * node will be in race condition.
++ */
++ if (btree_node_journal_flush(b)) {
++ mutex_unlock(&b->write_lock);
++ pr_debug("bnode %p journal_flush set, retry", b);
++ udelay(1);
++ goto retry;
++ }
+
+ if (btree_node_dirty(b)) {
+ btree_complete_write(b, btree_current_write(b));
+diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h
+index d1c72ef64edf..76cfd121a486 100644
+--- a/drivers/md/bcache/btree.h
++++ b/drivers/md/bcache/btree.h
+@@ -158,11 +158,13 @@ enum btree_flags {
+ BTREE_NODE_io_error,
+ BTREE_NODE_dirty,
+ BTREE_NODE_write_idx,
++ BTREE_NODE_journal_flush,
+ };
+
+ BTREE_FLAG(io_error);
+ BTREE_FLAG(dirty);
+ BTREE_FLAG(write_idx);
++BTREE_FLAG(journal_flush);
+
+ static inline struct btree_write *btree_current_write(struct btree *b)
+ {
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 1218e3cada3c..a1e3e1fcea6e 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -430,6 +430,7 @@ static void btree_flush_write(struct cache_set *c)
+ retry:
+ best = NULL;
+
++ mutex_lock(&c->bucket_lock);
+ for_each_cached_btree(b, c, i)
+ if (btree_current_write(b)->journal) {
+ if (!best)
+@@ -442,15 +443,21 @@ static void btree_flush_write(struct cache_set *c)
+ }
+
+ b = best;
++ if (b)
++ set_btree_node_journal_flush(b);
++ mutex_unlock(&c->bucket_lock);
++
+ if (b) {
+ mutex_lock(&b->write_lock);
+ if (!btree_current_write(b)->journal) {
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ /* We raced */
+ goto retry;
+ }
+
+ __bch_btree_node_write(b, NULL);
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ }
+ }
+--
+2.16.4
+
diff --git a/patches.suse/0058-bcache-performance-improvement-for-btree_flush_write.patch b/patches.suse/0058-bcache-performance-improvement-for-btree_flush_write.patch
new file mode 100644
index 0000000000..31314b07c8
--- /dev/null
+++ b/patches.suse/0058-bcache-performance-improvement-for-btree_flush_write.patch
@@ -0,0 +1,192 @@
+From 91be66e1318f67ed5888ca10e10cc8ffdc24f661 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 19:59:59 +0800
+Subject: [PATCH] bcache: performance improvement for btree_flush_write()
+Git-commit: 91be66e1318f67ed5888ca10e10cc8ffdc24f661
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+This patch improves performance for btree_flush_write() in following
+ways,
+- Use another spinlock journal.flush_write_lock to replace the very
+ hot journal.lock. We don't have to use journal.lock here, selecting
+ candidate btree nodes takes a lot of time, hold journal.lock here will
+ block other jouranling threads and drop the overall I/O performance.
+- Only select flushing btree node from c->btree_cache list. When the
+ machine has a large system memory, mca cache may have a huge number of
+ cached btree nodes. Iterating all the cached nodes will take a lot
+ of CPU time, and most of the nodes on c->btree_cache_freeable and
+ c->btree_cache_freed lists are cleared and have need to flush. So only
+ travel mca list c->btree_cache to select flushing btree node should be
+ enough for most of the cases.
+- Don't iterate whole c->btree_cache list, only reversely select first
+ BTREE_FLUSH_NR btree nodes to flush. Iterate all btree nodes from
+ c->btree_cache and select the oldest journal pin btree nodes consumes
+ huge number of CPU cycles if the list is huge (push and pop a node
+ into/out of a heap is expensive). The last several dirty btree nodes
+ on the tail of c->btree_cache list are earlest allocated and cached
+ btree nodes, they are relative to the oldest journal pin btree nodes.
+ Therefore only flushing BTREE_FLUSH_NR btree nodes from tail of
+ c->btree_cache probably includes the oldest journal pin btree nodes.
+
+In my testing, the above change decreases 50%+ CPU consumption when
+journal space is full. Some times IOPS drops to 0 for 5-8 seconds,
+comparing blocking I/O for 120+ seconds in previous code, this is much
+better. Maybe there is room to improve in future, but at this momment
+the fix looks fine and performs well in my testing.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/journal.c | 85 +++++++++++++++++++++++++++++++++------------
+ drivers/md/bcache/journal.h | 4 +++
+ 2 files changed, 67 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index a1e3e1fcea6e..8bcd8f1bf8cb 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -419,47 +419,87 @@ int bch_journal_replay(struct cache_set *s, struct list_head *list)
+
+ static void btree_flush_write(struct cache_set *c)
+ {
+- /*
+- * Try to find the btree node with that references the oldest journal
+- * entry, best is our current candidate and is locked if non NULL:
+- */
+- struct btree *b, *best;
+- unsigned int i;
++ struct btree *b, *t, *btree_nodes[BTREE_FLUSH_NR];
++ unsigned int i, n;
++
++ if (c->journal.btree_flushing)
++ return;
++
++ spin_lock(&c->journal.flush_write_lock);
++ if (c->journal.btree_flushing) {
++ spin_unlock(&c->journal.flush_write_lock);
++ return;
++ }
++ c->journal.btree_flushing = true;
++ spin_unlock(&c->journal.flush_write_lock);
+
+ atomic_long_inc(&c->flush_write);
+-retry:
+- best = NULL;
++ memset(btree_nodes, 0, sizeof(btree_nodes));
++ n = 0;
+
+ mutex_lock(&c->bucket_lock);
+- for_each_cached_btree(b, c, i)
+- if (btree_current_write(b)->journal) {
+- if (!best)
+- best = b;
+- else if (journal_pin_cmp(c,
+- btree_current_write(best)->journal,
+- btree_current_write(b)->journal)) {
+- best = b;
+- }
++ list_for_each_entry_safe_reverse(b, t, &c->btree_cache, list) {
++ if (btree_node_journal_flush(b))
++ pr_err("BUG: flush_write bit should not be set here!");
++
++ mutex_lock(&b->write_lock);
++
++ if (!btree_node_dirty(b)) {
++ mutex_unlock(&b->write_lock);
++ continue;
++ }
++
++ if (!btree_current_write(b)->journal) {
++ mutex_unlock(&b->write_lock);
++ continue;
+ }
+
+- b = best;
+- if (b)
+ set_btree_node_journal_flush(b);
++
++ mutex_unlock(&b->write_lock);
++
++ btree_nodes[n++] = b;
++ if (n == BTREE_FLUSH_NR)
++ break;
++ }
+ mutex_unlock(&c->bucket_lock);
+
+- if (b) {
++ for (i = 0; i < n; i++) {
++ b = btree_nodes[i];
++ if (!b) {
++ pr_err("BUG: btree_nodes[%d] is NULL", i);
++ continue;
++ }
++
++ /* safe to check without holding b->write_lock */
++ if (!btree_node_journal_flush(b)) {
++ pr_err("BUG: bnode %p: journal_flush bit cleaned", b);
++ continue;
++ }
++
+ mutex_lock(&b->write_lock);
+ if (!btree_current_write(b)->journal) {
+ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+- /* We raced */
+- goto retry;
++ pr_debug("bnode %p: written by others", b);
++ continue;
++ }
++
++ if (!btree_node_dirty(b)) {
++ clear_bit(BTREE_NODE_journal_flush, &b->flags);
++ mutex_unlock(&b->write_lock);
++ pr_debug("bnode %p: dirty bit cleaned by others", b);
++ continue;
+ }
+
+ __bch_btree_node_write(b, NULL);
+ clear_bit(BTREE_NODE_journal_flush, &b->flags);
+ mutex_unlock(&b->write_lock);
+ }
++
++ spin_lock(&c->journal.flush_write_lock);
++ c->journal.btree_flushing = false;
++ spin_unlock(&c->journal.flush_write_lock);
+ }
+
+ #define last_seq(j) ((j)->seq - fifo_used(&(j)->pin) + 1)
+@@ -881,6 +921,7 @@ int bch_journal_alloc(struct cache_set *c)
+ struct journal *j = &c->journal;
+
+ spin_lock_init(&j->lock);
++ spin_lock_init(&j->flush_write_lock);
+ INIT_DELAYED_WORK(&j->work, journal_write_work);
+
+ c->journal_delay_ms = 100;
+diff --git a/drivers/md/bcache/journal.h b/drivers/md/bcache/journal.h
+index 66f0facff84b..f2ea34d5f431 100644
+--- a/drivers/md/bcache/journal.h
++++ b/drivers/md/bcache/journal.h
+@@ -103,6 +103,8 @@ struct journal_write {
+ /* Embedded in struct cache_set */
+ struct journal {
+ spinlock_t lock;
++ spinlock_t flush_write_lock;
++ bool btree_flushing;
+ /* used when waiting because the journal was full */
+ struct closure_waitlist wait;
+ struct closure io;
+@@ -154,6 +156,8 @@ struct journal_device {
+ struct bio_vec bv[8];
+ };
+
++#define BTREE_FLUSH_NR 8
++
+ #define journal_pin_cmp(c, l, r) \
+ (fifo_idx(&(c)->journal.pin, (l)) > fifo_idx(&(c)->journal.pin, (r)))
+
+--
+2.16.4
+
diff --git a/patches.suse/0059-bcache-add-reclaimed_journal_buckets-to-struct-cache.patch b/patches.suse/0059-bcache-add-reclaimed_journal_buckets-to-struct-cache.patch
new file mode 100644
index 0000000000..0a370a911f
--- /dev/null
+++ b/patches.suse/0059-bcache-add-reclaimed_journal_buckets-to-struct-cache.patch
@@ -0,0 +1,84 @@
+From dff90d58a1c815b87b2603295382c97e78064349 Mon Sep 17 00:00:00 2001
+From: Coly Li <colyli@suse.de>
+Date: Fri, 28 Jun 2019 20:00:00 +0800
+Subject: [PATCH] bcache: add reclaimed_journal_buckets to struct cache_set
+Git-commit: dff90d58a1c815b87b2603295382c97e78064349
+References: bsc#1140652
+Patch-mainline: v5.3-rc1
+
+Now we have counters for how many times jouranl is reclaimed, how many
+times cached dirty btree nodes are flushed, but we don't know how many
+jouranl buckets are really reclaimed.
+
+This patch adds reclaimed_journal_buckets into struct cache_set, this
+is an increasing only counter, to tell how many journal buckets are
+reclaimed since cache set runs. From all these three counters (reclaim,
+reclaimed_journal_buckets, flush_write), we can have idea how well
+current journal space reclaim code works.
+
+Signed-off-by: Coly Li <colyli@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+
+---
+ drivers/md/bcache/bcache.h | 1 +
+ drivers/md/bcache/journal.c | 1 +
+ drivers/md/bcache/sysfs.c | 5 +++++
+ 3 files changed, 7 insertions(+)
+
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 35396248a7d5..013e35a9e317 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -705,6 +705,7 @@ struct cache_set {
+ atomic_long_t writeback_keys_failed;
+
+ atomic_long_t reclaim;
++ atomic_long_t reclaimed_journal_buckets;
+ atomic_long_t flush_write;
+
+ enum {
+diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
+index 8bcd8f1bf8cb..be2a2a201603 100644
+--- a/drivers/md/bcache/journal.c
++++ b/drivers/md/bcache/journal.c
+@@ -614,6 +614,7 @@ static void journal_reclaim(struct cache_set *c)
+ k->ptr[n++] = MAKE_PTR(0,
+ bucket_to_sector(c, ca->sb.d[ja->cur_idx]),
+ ca->sb.nr_this_dev);
++ atomic_long_inc(&c->reclaimed_journal_buckets);
+ }
+
+ if (n) {
+diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
+index 701a386a954c..9f0826712845 100644
+--- a/drivers/md/bcache/sysfs.c
++++ b/drivers/md/bcache/sysfs.c
+@@ -82,6 +82,7 @@ read_attribute(bset_tree_stats);
+ read_attribute(state);
+ read_attribute(cache_read_races);
+ read_attribute(reclaim);
++read_attribute(reclaimed_journal_buckets);
+ read_attribute(flush_write);
+ read_attribute(writeback_keys_done);
+ read_attribute(writeback_keys_failed);
+@@ -705,6 +706,9 @@ SHOW(__bch_cache_set)
+ sysfs_print(reclaim,
+ atomic_long_read(&c->reclaim));
+
++ sysfs_print(reclaimed_journal_buckets,
++ atomic_long_read(&c->reclaimed_journal_buckets));
++
+ sysfs_print(flush_write,
+ atomic_long_read(&c->flush_write));
+
+@@ -931,6 +935,7 @@ static struct attribute *bch_cache_set_internal_files[] = {
+ &sysfs_bset_tree_stats,
+ &sysfs_cache_read_races,
+ &sysfs_reclaim,
++ &sysfs_reclaimed_journal_buckets,
+ &sysfs_flush_write,
+ &sysfs_writeback_keys_done,
+ &sysfs_writeback_keys_failed,
+--
+2.16.4
+
diff --git a/patches.suse/Btrfs-kill-btrfs_clear_path_blocking.patch b/patches.suse/Btrfs-kill-btrfs_clear_path_blocking.patch
new file mode 100644
index 0000000000..4d509af7a5
--- /dev/null
+++ b/patches.suse/Btrfs-kill-btrfs_clear_path_blocking.patch
@@ -0,0 +1,314 @@
+From: Liu Bo <bo.liu@linux.alibaba.com>
+Date: Wed, 22 Aug 2018 05:54:37 +0800
+Git-commit: 523983401644ebeb331c923c28c9591c07430a7d
+Patch-mainline: v4.20
+References: bsc#1140139
+Subject: [PATCH] Btrfs: kill btrfs_clear_path_blocking
+
+Btrfs's btree locking has two modes, spinning mode and blocking mode,
+while searching btree, locking is always acquired in spinning mode and
+then converted to blocking mode if necessary, and in some hot paths we may
+switch the locking back to spinning mode by btrfs_clear_path_blocking().
+
+When acquiring locks, both of reader and writer need to wait for blocking
+readers and writers to complete before doing read_lock()/write_lock().
+
+The problem is that btrfs_clear_path_blocking() needs to switch nodes
+in the path to blocking mode at first (by btrfs_set_path_blocking) to
+make lockdep happy before doing its actual clearing blocking job.
+
+When switching to blocking mode from spinning mode, it consists of
+
+step 1) bumping up blocking readers counter and
+step 2) read_unlock()/write_unlock(),
+
+this has caused serious ping-pong effect if there're a great amount of
+concurrent readers/writers, as waiters will be woken up and go to
+sleep immediately.
+
+1) Killing this kind of ping-pong results in a big improvement in my 1600k
+files creation script,
+
+MNT=/mnt/btrfs
+mkfs.btrfs -f /dev/sdf
+mount /dev/def $MNT
+time fsmark -D 10000 -S0 -n 100000 -s 0 -L 1 -l /tmp/fs_log.txt \
+ -d $MNT/0 -d $MNT/1 \
+ -d $MNT/2 -d $MNT/3 \
+ -d $MNT/4 -d $MNT/5 \
+ -d $MNT/6 -d $MNT/7 \
+ -d $MNT/8 -d $MNT/9 \
+ -d $MNT/10 -d $MNT/11 \
+ -d $MNT/12 -d $MNT/13 \
+ -d $MNT/14 -d $MNT/15
+
+w/o patch:
+real 2m27.307s
+user 0m12.839s
+sys 13m42.831s
+
+w/ patch:
+real 1m2.273s
+user 0m15.802s
+sys 8m16.495s
+
+1.1) latency histogram from funclatency[1]
+
+Overall with the patch, there're ~50% less write lock acquisition and
+the 95% max latency that write lock takes also reduces to ~100ms from
+>500ms.
+
+--------------------------------------------
+w/o patch:
+--------------------------------------------
+Function = btrfs_tree_lock
+ msecs : count distribution
+ 0 -> 1 : 2385222 |****************************************|
+ 2 -> 3 : 37147 | |
+ 4 -> 7 : 20452 | |
+ 8 -> 15 : 13131 | |
+ 16 -> 31 : 3877 | |
+ 32 -> 63 : 3900 | |
+ 64 -> 127 : 2612 | |
+ 128 -> 255 : 974 | |
+ 256 -> 511 : 165 | |
+ 512 -> 1023 : 13 | |
+
+Function = btrfs_tree_read_lock
+ msecs : count distribution
+ 0 -> 1 : 6743860 |****************************************|
+ 2 -> 3 : 2146 | |
+ 4 -> 7 : 190 | |
+ 8 -> 15 : 38 | |
+ 16 -> 31 : 4 | |
+
+--------------------------------------------
+w/ patch:
+--------------------------------------------
+Function = btrfs_tree_lock
+ msecs : count distribution
+ 0 -> 1 : 1318454 |****************************************|
+ 2 -> 3 : 6800 | |
+ 4 -> 7 : 3664 | |
+ 8 -> 15 : 2145 | |
+ 16 -> 31 : 809 | |
+ 32 -> 63 : 219 | |
+ 64 -> 127 : 10 | |
+
+Function = btrfs_tree_read_lock
+ msecs : count distribution
+ 0 -> 1 : 6854317 |****************************************|
+ 2 -> 3 : 2383 | |
+ 4 -> 7 : 601 | |
+ 8 -> 15 : 92 | |
+
+2) dbench also proves the improvement,
+dbench -t 120 -D /mnt/btrfs 16
+
+w/o patch:
+Throughput 158.363 MB/sec
+
+w/ patch:
+Throughput 449.52 MB/sec
+
+3) xfstests didn't show any additional failures.
+
+One thing to note is that callers may set path->leave_spinning to have
+all nodes in the path stay in spinning mode, which means callers are
+ready to not sleep before releasing the path, but it won't cause
+problems if they don't want to sleep in blocking mode.
+
+[1]: https://github.com/iovisor/bcc/blob/master/tools/funclatency.py
+
+Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+---
+ fs/btrfs/ctree.c | 57 ++++--------------------------------------------
+ fs/btrfs/ctree.h | 2 --
+ fs/btrfs/delayed-inode.c | 3 ---
+ 3 files changed, 4 insertions(+), 58 deletions(-)
+
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 0512723d2fc6..be26e2583ce7 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -68,42 +68,6 @@ noinline void btrfs_set_path_blocking(struct btrfs_path *p)
+ }
+ }
+
+-/*
+- * reset all the locked nodes in the patch to spinning locks.
+- *
+- * held is used to keep lockdep happy, when lockdep is enabled
+- * we set held to a blocking lock before we go around and
+- * retake all the spinlocks in the path. You can safely use NULL
+- * for held
+- */
+-noinline void btrfs_clear_path_blocking(struct btrfs_path *p,
+- struct extent_buffer *held, int held_rw)
+-{
+- int i;
+-
+- if (held) {
+- btrfs_set_lock_blocking_rw(held, held_rw);
+- if (held_rw == BTRFS_WRITE_LOCK)
+- held_rw = BTRFS_WRITE_LOCK_BLOCKING;
+- else if (held_rw == BTRFS_READ_LOCK)
+- held_rw = BTRFS_READ_LOCK_BLOCKING;
+- }
+- btrfs_set_path_blocking(p);
+-
+- for (i = BTRFS_MAX_LEVEL - 1; i >= 0; i--) {
+- if (p->nodes[i] && p->locks[i]) {
+- btrfs_clear_lock_blocking_rw(p->nodes[i], p->locks[i]);
+- if (p->locks[i] == BTRFS_WRITE_LOCK_BLOCKING)
+- p->locks[i] = BTRFS_WRITE_LOCK;
+- else if (p->locks[i] == BTRFS_READ_LOCK_BLOCKING)
+- p->locks[i] = BTRFS_READ_LOCK;
+- }
+- }
+-
+- if (held)
+- btrfs_clear_lock_blocking_rw(held, held_rw);
+-}
+-
+ /* this also releases the path */
+ void btrfs_free_path(struct btrfs_path *p)
+ {
+@@ -1429,7 +1393,6 @@ tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct btrfs_path *path,
+ }
+ }
+
+- btrfs_clear_path_blocking(path, NULL, BTRFS_READ_LOCK);
+ btrfs_tree_read_unlock_blocking(eb);
+ free_extent_buffer(eb);
+
+@@ -2611,7 +2574,6 @@ setup_nodes_for_search(struct btrfs_trans_handle *trans,
+ btrfs_set_path_blocking(p);
+ reada_for_balance(fs_info, p, level);
+ sret = split_node(trans, root, p, level);
+- btrfs_clear_path_blocking(p, NULL, 0);
+
+ BUG_ON(sret > 0);
+ if (sret) {
+@@ -2632,7 +2594,6 @@ setup_nodes_for_search(struct btrfs_trans_handle *trans,
+ btrfs_set_path_blocking(p);
+ reada_for_balance(fs_info, p, level);
+ sret = balance_level(trans, root, p, level);
+- btrfs_clear_path_blocking(p, NULL, 0);
+
+ if (sret) {
+ ret = sret;
+@@ -2928,7 +2889,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ }
+ cow_done:
+ p->nodes[level] = b;
+- btrfs_clear_path_blocking(p, NULL, 0);
++ /*
++ * Leave path with blocking locks to avoid massive
++ * lock context switch, this is made on purpose.
++ */
+
+ /*
+ * we have a lock on b and as long as we aren't changing
+@@ -3010,8 +2974,6 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ if (!err) {
+ btrfs_set_path_blocking(p);
+ btrfs_tree_lock(b);
+- btrfs_clear_path_blocking(p, b,
+- BTRFS_WRITE_LOCK);
+ }
+ p->locks[level] = BTRFS_WRITE_LOCK;
+ } else {
+@@ -3019,8 +2981,6 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ if (!err) {
+ btrfs_set_path_blocking(p);
+ btrfs_tree_read_lock(b);
+- btrfs_clear_path_blocking(p, b,
+- BTRFS_READ_LOCK);
+ }
+ p->locks[level] = BTRFS_READ_LOCK;
+ }
+@@ -3039,7 +2999,6 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+ btrfs_set_path_blocking(p);
+ err = split_leaf(trans, root, key,
+ p, ins_len, ret == 0);
+- btrfs_clear_path_blocking(p, NULL, 0);
+
+ BUG_ON(err > 0);
+ if (err) {
+@@ -3106,7 +3065,6 @@ int btrfs_search_old_slot(struct btrfs_root *root, const struct btrfs_key *key,
+ while (b) {
+ level = btrfs_header_level(b);
+ p->nodes[level] = b;
+- btrfs_clear_path_blocking(p, NULL, 0);
+
+ /*
+ * we have a lock on b and as long as we aren't changing
+@@ -3152,8 +3110,6 @@ int btrfs_search_old_slot(struct btrfs_root *root, const struct btrfs_key *key,
+ if (!err) {
+ btrfs_set_path_blocking(p);
+ btrfs_tree_read_lock(b);
+- btrfs_clear_path_blocking(p, b,
+- BTRFS_READ_LOCK);
+ }
+ b = tree_mod_log_rewind(fs_info, p, b, time_seq);
+ if (!b) {
+@@ -5358,7 +5314,6 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key,
+ path->locks[level - 1] = BTRFS_READ_LOCK;
+ path->nodes[level - 1] = cur;
+ unlock_up(path, level, 1, 0, NULL);
+- btrfs_clear_path_blocking(path, NULL, 0);
+ }
+ out:
+ path->keep_locks = keep_locks;
+@@ -5948,8 +5903,6 @@ int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
+ if (!ret) {
+ btrfs_set_path_blocking(path);
+ btrfs_tree_read_lock(next);
+- btrfs_clear_path_blocking(path, next,
+- BTRFS_READ_LOCK);
+ }
+ next_rw_lock = BTRFS_READ_LOCK;
+ }
+@@ -5985,8 +5938,6 @@ int btrfs_next_old_leaf(struct btrfs_root *root, struct btrfs_path *path,
+ if (!ret) {
+ btrfs_set_path_blocking(path);
+ btrfs_tree_read_lock(next);
+- btrfs_clear_path_blocking(path, next,
+- BTRFS_READ_LOCK);
+ }
+ next_rw_lock = BTRFS_READ_LOCK;
+ }
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index ad071b77c04a..cabd87614a39 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2938,8 +2938,6 @@ void btrfs_release_path(struct btrfs_path *p);
+ struct btrfs_path *btrfs_alloc_path(void);
+ void btrfs_free_path(struct btrfs_path *p);
+ void btrfs_set_path_blocking(struct btrfs_path *p);
+-void btrfs_clear_path_blocking(struct btrfs_path *p,
+- struct extent_buffer *held, int held_rw);
+ void btrfs_unlock_up_safe(struct btrfs_path *p, int level);
+
+ int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
+diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c
+index 9b1df3912260..baccc5215fa4 100644
+--- a/fs/btrfs/delayed-inode.c
++++ b/fs/btrfs/delayed-inode.c
+@@ -755,9 +755,6 @@ static int btrfs_batch_insert_items(struct btrfs_root *root,
+ i++;
+ }
+
+- /* reset all the locked nodes in the patch to spinning locks. */
+- btrfs_clear_path_blocking(path, NULL, 0);
+-
+ /* insert the keys of the items */
+ setup_items_for_insert(root, path, keys, data_size,
+ total_data_size, total_size, nitems);
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index c143c1315e..f0048f5faf 100644
--- a/series.conf
+++ b/series.conf
@@ -8979,6 +8979,7 @@
patches.drivers/i40e-ignore-skb-xmit_more-when-deciding-to-set-RS-bi.patch
patches.drivers/i40e-i40evf-organize-and-re-number-feature-flags.patch
patches.fixes/net-add-rb_to_skb-and-other-rb-tree-helpers.patch
+ patches.fixes/tcp-reduce-tcp_fastretrans_alert-verbosity.patch
patches.drivers/bnxt_en-don-t-consider-building-bnxt_tc.o-if-option-.patch
patches.suse/msft-hv-1510-hv_netvsc-Change-the-hash-level-variable-to-bit-flag.patch
patches.suse/msft-hv-1511-hv_netvsc-Add-ethtool-handler-to-set-and-get-TCP-has.patch
@@ -15137,6 +15138,7 @@
patches.drivers/crypto-chelsio-don-t-leak-pointers-to-authenc-keys.patch
patches.drivers/crypto-ahash-Fix-early-termination-in-hash-walk
patches.drivers/net-bcmgenet-Fix-sparse-warnings-in-bcmgenet_put_tx_
+ patches.fixes/af_unix-remove-redundant-lockdep-class.patch
patches.suse/pptp-remove-a-buggy-dst-release-in-pptp_connect.patch
patches.drivers/lan78xx-Connect-phy-early.patch
patches.drivers/nfp-use-full-40-bits-of-the-NSP-buffer-address.patch
@@ -15421,6 +15423,7 @@
patches.suse/0215-dm-bufio-support-non-power-of-two-block-sizes.patch
patches.suse/0216-dm-bufio-don-t-embed-a-bio-in-the-dm_buffer-structur.patch
patches.suse/0217-dm-raid-fix-parse_raid_params-variable-range-issue.patch
+ patches.fixes/lib-fix-stall-in-__bitmap_parselist.patch
patches.fixes/ocfs2-dlm-wait-for-dlm-recovery-done-when-migrating-.patch
patches.arch/x86-mm-memory_hotplug-determine-block-size-based-on-the-end-of-boot-memory
patches.fixes/mm-huge_memory-c-reorder-operations-in-_split_huge_page_tail.patch
@@ -18529,6 +18532,7 @@
patches.suse/0230-bcache-do-not-assign-in-if-condition-register_bcache.patch
patches.suse/0231-bcache-free-heap-cache_set-flush_btree-in-bch_journa.patch
patches.suse/0231-bcache-do-not-assign-in-if-condition-in-bcache_init.patch
+ patches.suse/0001-bcache-do-not-assign-in-if-condition-in-bcache_devic.patch
patches.suse/0231-bcache-stop-using-the-deprecated-get_seconds.patch
patches.fixes/partitions-aix-fix-usage-of-uninitialized-lv_info-an.patch
patches.fixes/partitions-aix-append-null-character-to-print-data-f.patch
@@ -18739,6 +18743,7 @@
patches.fixes/0012-ip6_tunnel-collect_md-xmit-Use-ip_tunnel_key-s-provi.patch
patches.drivers/ibmvnic-Remove-code-to-request-error-information.patch
patches.drivers/ibmvnic-Update-firmware-error-reporting-with-cause-s.patch
+ patches.fixes/RDS-IB-fix-passing-zero-to-ERR_PTR-warning.patch
patches.drivers/cxgb4-add-support-to-display-DCB-info.patch
patches.arch/s390-sles15sp1-00-12-30-net-smc-send-response-to-test-link-signal.patch
patches.suse/net-mvneta-fix-mvneta_config_rss-on-armada-3700.patch
@@ -20046,6 +20051,7 @@
patches.suse/0004-btrfs-qgroup-Use-generation-aware-subtree-swap-to-ma.patch
patches.suse/0005-btrfs-qgroup-Don-t-trace-subtree-if-we-re-dropping-r.patch
patches.suse/0006-btrfs-qgroup-Only-trace-data-extents-in-leaves-if-we.patch
+ patches.suse/Btrfs-kill-btrfs_clear_path_blocking.patch
patches.suse/0008-btrfs-protect-space-cache-inode-alloc-with-GFP_NOFS.patch
patches.suse/btrfs-make-sure-we-create-all-new-block-groups.patch
patches.suse/btrfs-fix-warning-when-replaying-log-after-fsync-of-.patch
@@ -20451,6 +20457,7 @@
patches.drivers/net-hns3-Fix-for-out-of-bounds-access-when-setting-p.patch
patches.suse/mlxsw-spectrum-Fix-IP2ME-CPU-policer-configuration.patch
patches.suse/sctp-fix-strchange_flags-name-for-Stream-Change-Even.patch
+ patches.fixes/netfilter-conntrack-fix-calculation-of-next-bucket-n.patch
patches.drivers/HID-hiddev-fix-potential-Spectre-v1.patch
patches.drivers/hwmon-core-Fix-double-free-in-__hwmon_device_registe.patch
patches.drivers/hwmon-ibmpowernv-Remove-bogus-__init-annotations.patch
@@ -20588,6 +20595,7 @@
patches.drm/drm-ast-change-resolution-may-cause-screen-blurred.patch
patches.drm/drm-ast-fixed-cursor-may-disappear-sometimes.patch
patches.drm/drm-i915-Write-GPU-relocs-harder-with-gen3.patch
+ patches.drivers/mmc-sdhci-pci-Try-cd-for-card-detect-lookup-before-u.patch
patches.drivers/gpio-don-t-free-unallocated-ida-on-gpiochip_add_data.patch
patches.fixes/tools-power-cpupower-fix-compilation-with-static-true.patch
patches.drivers/ACPI-platform-Add-SMB0001-HID-to-forbidden_id_list.patch
@@ -21328,6 +21336,7 @@
patches.drivers/Input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
patches.drivers/input-add-official-raspberry-pi-s-touchscreen-driver.patch
patches.drivers/niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
+ patches.fixes/ethtool-check-the-return-value-of-get_regs_len.patch
patches.drivers/isdn-hisax-hfc_pci-Fix-a-possible-concurrency-use-af.patch
patches.suse/ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch
patches.suse/net-wan-fix-a-double-free-in-x25_asy_open_tty.patch
@@ -21382,6 +21391,7 @@
patches.drm/drm-bridge-tc358767-fix-initial-DP0-1_SRCCTRL-value.patch
patches.drm/drm-bridge-tc358767-reject-modes-which-require-too-m.patch
patches.drm/drm-bridge-tc358767-fix-output-H-V-syncs.patch
+ patches.drivers/cpufreq-check-if-policy-is-inactive-early-in-__cpufr.patch
patches.drivers/ACPI-power-Skip-duplicate-power-resource-references-.patch
patches.fixes/ACPI-NUMA-Use-correct-type-for-printing-addresses-on.patch
patches.arch/x86-modpost-replace-last-remnants-of-retpoline-with-config_retpoline.patch
@@ -21903,7 +21913,9 @@
patches.fixes/mm-vmalloc-fix-size-check-for-remap_vmalloc_range_partial
patches.arch/intel_idle-add-support-for-Jacobsville.patch
patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch
+ patches.drivers/cpufreq-Use-struct-kobj_attribute-instead-of-struct-.patch
patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch
+ patches.drivers/cpufreq-acpi-cpufreq-Report-if-CPU-doesn-t-support-b.patch
patches.drivers/ACPI-video-Refactor-and-fix-dmi_is_desktop.patch
patches.drivers/ACPI-video-Extend-chassis-type-detection-with-a-Lunc.patch
patches.fixes/device-property-Fix-the-length-used-in-PROPERTY_ENTR.patch
@@ -22320,6 +22332,7 @@
patches.fixes/rhashtable-Still-do-rehash-when-we-get-EEXIST.patch
patches.fixes/bpf-do-not-restore-dst_reg-when-cur_state-is-freed.patch
patches.arch/ARM-imx6q-cpuidle-fix-bug-that-CPU-might-not-wake-up.patch
+ patches.fixes/s390-vtime-steal-time-exponential-moving-average.patch
patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt
patches.drm/0001-drm-rockchip-vop-reset-scale-mode-when-win-is-disabl.patch
patches.drm/drm-meson-Fix-invalid-pointer-in-meson_drv_unbind.patch
@@ -22586,6 +22599,7 @@
patches.suse/net-dsa-bcm_sf2-fix-buffer-overflow-doing-set_rxnfc.patch
patches.drivers/iwlwifi-mvm-check-for-length-correctness-in-iwl_mvm_.patch
patches.suse/sctp-avoid-running-the-sctp-state-machine-recursivel.patch
+ patches.fixes/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch
patches.suse/packet-validate-msg_namelen-in-send-directly.patch
patches.suse/ipv4-ip_do_fragment-Preserve-skb_iif-during-fragment.patch
patches.drivers/ALSA-hda-realtek-Add-new-Dell-platform-for-headset-m.patch
@@ -22605,6 +22619,10 @@
patches.suse/x86-smpboot-Rename-match_die-to-match_pkg.patch
patches.arch/x86-microcode-fix-the-ancient-deprecated-microcode-loading-method.patch
patches.fixes/ACPI-button-reinitialize-button-state-upon-resume.patch
+ patches.drivers/cpufreq-kirkwood-fix-possible-object-reference-leak.patch
+ patches.drivers/cpufreq-pasemi-fix-possible-object-reference-leak.patch
+ patches.drivers/cpufreq-pmac32-fix-possible-object-reference-leak.patch
+ patches.drivers/cpufreq-ppc_cbe-fix-possible-object-reference-leak.patch
patches.drivers/PM-core-Propagate-dev-power.wakeup_path-when-no-call.patch
patches.fixes/ACPI-property-fix-handling-of-data_nodes-in-acpi_get.patch
patches.arch/x86-mce-fix-machine_check_poll-tests-for-error-types.patch
@@ -22686,6 +22704,25 @@
patches.suse/Revert-block-unexport-DISK_EVENT_MEDIA_CHANGE-for.patch
patches.suse/block-check_events-don-t-bother-with-events-if-un.patch
patches.fixes/block-fix-use-after-free-on-gendisk.patch
+ patches.suse/0002-bcache-fix-crashes-stopping-bcache-device-before-rea.patch
+ patches.suse/0003-bcache-fix-inaccurate-result-of-unused-buckets.patch
+ patches.suse/0004-bcache-avoid-clang-Wunintialized-warning.patch
+ patches.suse/0005-bcache-Clean-up-bch_get_congested.patch
+ patches.suse/0006-bcache-fix-a-race-between-cache-register-and-cachese.patch
+ patches.suse/0007-bcache-move-definition-of-int-ret-out-of-macro-read_.patch
+ patches.suse/0008-bcache-never-set-KEY_PTRS-of-journal-key-to-0-in-jou.patch
+ patches.suse/0009-bcache-add-failure-check-to-run_cache_set-for-journa.patch
+ patches.suse/0010-bcache-add-comments-for-kobj-release-callback-routin.patch
+ patches.suse/0011-bcache-return-error-immediately-in-bch_journal_repla.patch
+ patches.suse/0012-bcache-add-error-check-for-calling-register_bdev.patch
+ patches.suse/0013-bcache-Add-comments-for-blkdev_put-in-registration-c.patch
+ patches.suse/0014-bcache-add-comments-for-closure_fn-to-be-called-in-c.patch
+ patches.suse/0015-bcache-improve-bcache_reboot.patch
+ patches.suse/0016-bcache-fix-failure-in-journal-relplay.patch
+ patches.suse/0017-bcache-fix-wrong-usage-use-after-freed-on-keylist-in.patch
+ patches.suse/0018-bcache-avoid-potential-memleak-of-list-of-journal_re.patch
+ patches.suse/0019-bcache-remove-redundant-LIST_HEAD-journal-from-run_c.patch
+ patches.suse/0020-bcache-make-is_discard_enabled-static.patch
patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
patches.fixes/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch
patches.fixes/audit-fix-a-memleak-caused-by-auditing-load-module.patch
@@ -22937,6 +22974,7 @@
patches.fixes/drivers-thermal-tsens-Don-t-print-error-message-on-E.patch
patches.fixes/thermal-rcar_gen3_thermal-disable-interrupt-in-.remo.patch
patches.drivers/thermal-cpu_cooling-Actually-trace-CPU-load-in-therm.patch
+ patches.fixes/memory-tegra-Fix-integer-overflow-on-tick-value-calc.patch
patches.drivers/soc-mediatek-pwrap-Zero-initialize-rdata-in-pwrap_in.patch
patches.drivers/soc-rockchip-Set-the-proper-PWM-for-rk3288.patch
patches.suse/objtool-fix-function-fallthrough-detection.patch
@@ -22950,6 +22988,8 @@
patches.fixes/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch
patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
patches.arch/kvm-x86-skip-efer-vs-guest-cpuid-checks-for-host-initiated-writes
+ patches.fixes/KVM-polling-add-architecture-backend-to-disable-poll.patch
+ patches.fixes/KVM-s390-provide-kvm_arch_no_poll-function.patch
patches.arch/KVM-PPC-Book3S-HV-Avoid-lockdep-debugging-in-TCE-rea.patch
patches.drivers/ALSA-hda-realtek-Fixup-headphone-noise-via-runtime-s.patch
patches.drivers/ALSA-hda-realtek-Avoid-superfluous-COEF-EAPD-setups.patch
@@ -22994,6 +23034,8 @@
patches.fixes/nvme-copy-mtfa-field-from-identify-controller.patch
patches.fixes/ext4-wait-for-outstanding-dio-during-truncate-in-noj.patch
patches.fixes/ext4-do-not-delete-unlinked-inode-from-orphan-list-o.patch
+ patches.fixes/KVM-s390-fix-typo-in-parameter-description.patch
+ patches.fixes/KVM-s390-change-default-halt-poll-time-to-50us.patch
patches.arch/kvm-x86-include-multiple-indices-with-cpuid-leaf-0x8000001d.patch
patches.arch/kvm-x86-include-cpuid-leaf-0x8000001e-in-kvm-s-supported-cpuid.patch
patches.arch/kvm-svm-avic-fix-off-by-one-in-checking-host-apic-id
@@ -23047,6 +23089,7 @@
patches.fixes/fuse-fallocate-fix-return-with-locked-inode.patch
patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event
patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch
+ patches.fixes/pktgen-do-not-sleep-with-the-thread-lock-held.patch
patches.drivers/hwmon-core-add-thermal-sensors-only-if-dev-of_node-i.patch
patches.drivers/hwmon-pmbus-core-Treat-parameters-as-paged-if-on-mul.patch
patches.drm/0002-drm-i915-gvt-refine-ggtt-range-validation.patch
@@ -23067,17 +23110,23 @@
patches.drivers/ALSA-hda-realtek-Update-headset-mode-for-ALC256.patch
patches.drivers/ALSA-firewire-motu-fix-destruction-of-data-for-isoch.patch
patches.drivers/ALSA-oxfw-allow-PCM-capture-for-Stanton-SCS.1m.patch
+ patches.drivers/ASoC-cs4265-readable-register-too-low.patch
+ patches.drivers/ASoC-soc-pcm-BE-dai-needs-prepare-when-pause-release.patch
patches.drivers/ASoC-fsl_asrc-Fix-the-issue-about-unsupported-rate.patch
patches.drivers/ASoC-cs42xx8-Add-regcache-mask-dirty.patch
+ patches.drivers/ASoC-max98090-remove-24-bit-format-support-if-RJ-is-.patch
patches.drivers/Revert-ALSA-hda-realtek-Improve-the-headset-mic-for-.patch
patches.drivers/iommu-arm-smmu-avoid-constant-zero-in-tlbi-writes
patches.fixes/fs-ocfs2-fix-race-in-ocfs2_dentry_attach_lock.patch
patches.fixes/0001-coredump-fix-race-condition-between-collapse_huge_pa.patch
patches.fixes/0001-i2c-acorn-fix-i2c-warning.patch
+ patches.suse/0021-bcache-fix-stack-corruption-by-PRECEDING_KEY.patch
+ patches.suse/0022-bcache-only-set-BCACHE_DEV_WB_RUNNING-when-cached-de.patch
patches.drivers/libata-Extend-quirks-for-the-ST1000LM024-drives-with.patch
patches.drm/drm-i915-dmc-protect-against-reading-random-memory.patch
patches.drm/drm-i915-sdvo-Implement-proper-HDMI-audio-support-fo.patch
patches.drm/drm-i915-perf-fix-whitelist-on-Gen10.patch
+ patches.fixes/cgroup-use-css_tryget-instead-of-css_tryget_online-in-task_get_css.patch
patches.suse/module-fix-livepatch-ftrace-module-text-permissions-race.patch
patches.drivers/USB-usb-storage-Add-new-ID-to-ums-realtek.patch
patches.drivers/USB-Fix-chipmunk-like-voice-when-using-Logitech-C270.patch
@@ -23128,6 +23177,7 @@
patches.fixes/tcp-refine-memory-limit-test-in-tcp_fragment.patch
patches.drivers/Bluetooth-Fix-regression-with-minimum-encryption-key.patch
patches.drivers/ppp-mppe-Add-softdep-to-arc4.patch
+ patches.fixes/net-packet-fix-memory-leak-in-packet_set_ring.patch
patches.drivers/qmi_wwan-Fix-out-of-bounds-read.patch
patches.suse/ipv4-Use-return-value-of-inet_iif-for-__raw_v4_looku.patch
patches.fixes/scsi-vmw_pscsi-Fix-use-after-free-in-pvscsi_queue_lc.patch
@@ -23148,6 +23198,7 @@
patches.drm/drm-amdgpu-gfx9-use-reset-default-for-PA_SC_FIFO_SIZ.patch
patches.fixes/scsi-target-iblock-fix-overrun-in-write-same-emulation
patches.drivers/dmaengine-imx-sdma-remove-BD_INTR-for-channel0.patch
+ patches.fixes/lib-scatterlist-Fix-mapping-iterator-when-sg-offset-.patch
patches.drivers/pwm-stm32-Use-3-cells-of_xlate.patch
patches.drivers/gpio-omap-fix-lack-of-irqstatus_raw0-for-OMAP4.patch
patches.drivers/regulator-s2mps11-Fix-buck7-and-buck8-wrong-voltages.patch
@@ -23159,17 +23210,79 @@
patches.drivers/iommu-vt-d-handle-pci-bridge-rmrr-device-scopes-in-intel_iommu_get_resv_regions
patches.drivers/iommu-amd-make-iommu_disable-safer
patches.drivers/iommu-use-right-function-to-get-group-for-device
+ patches.drivers/media-marvell-ccic-fix-DMA-s-g-desc-number-calculati.patch
patches.fixes/0001-media-cpia2_usb-first-wake-up-then-free-in-disconnec.patch
+ patches.drivers/media-vivid-fix-incorrect-assignment-operation-when-.patch
+ patches.drivers/media-s5p-mfc-Make-additional-clocks-optional.patch
+ patches.drivers/media-v4l2-Test-type-instead-of-cfg-type-in-v4l2_ctr.patch
+ patches.drivers/ALSA-hda-realtek-Headphone-Mic-can-t-record-after-S3.patch
patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072
patches.drivers/ASoC-cx2072x-fix-integer-overflow-on-unsigned-int-mu.patch
patches.drivers/ACPI-PM-Avoid-evaluating-_PS3-on-transitions-from-D3.patch
patches.drivers/ACPI-PM-Allow-transitions-to-D0-to-occur-in-special-.patch
patches.fixes/PCI-Do-not-poll-for-PME-if-the-device-is-in-D3cold.patch
+ patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-initial-command-chec.patch
+ patches.drivers/cpufreq-brcmstb-avs-cpufreq-Fix-types-for-voltage-fr.patch
+ patches.suse/0023-bcache-don-t-set-max-writeback-rate-if-gc-is-running.patch
+ patches.suse/0024-bcache-check-c-gc_thread-by-IS_ERR_OR_NULL-in-cache_.patch
+ patches.suse/0025-bcache-fix-return-value-error-in-bch_journal_read.patch
+ patches.suse/0026-Revert-bcache-set-CACHE_SET_IO_DISABLE-in-bch_cached.patch
+ patches.suse/0027-bcache-avoid-flushing-btree-node-in-cache_set_flush-.patch
+ patches.suse/0028-bcache-ignore-read-ahead-request-failure-on-backing-.patch
+ patches.suse/0029-bcache-add-io-error-counting-in-write_bdev_super_end.patch
+ patches.suse/0030-bcache-remove-unnecessary-prefetch-in-bset_search_tr.patch
+ patches.suse/0031-bcache-use-sysfs_match_string-instead-of-__sysfs_mat.patch
+ patches.suse/0032-bcache-add-return-value-check-to-bch_cached_dev_run.patch
+ patches.suse/0033-bcache-remove-unncessary-code-in-bch_btree_keys_init.patch
+ patches.suse/0034-bcache-check-CACHE_SET_IO_DISABLE-in-allocator-code.patch
+ patches.suse/0035-bcache-check-CACHE_SET_IO_DISABLE-bit-in-bch_journal.patch
+ patches.suse/0036-bcache-more-detailed-error-message-to-bcache_device_.patch
+ patches.suse/0037-bcache-add-more-error-message-in-bch_cached_dev_atta.patch
+ patches.suse/0038-bcache-improve-error-message-in-bch_cached_dev_run.patch
+ patches.suse/0039-bcache-remove-XXX-comment-line-from-run_cache_set.patch
+ patches.suse/0040-bcache-make-bset_search_tree-be-more-understandable.patch
+ patches.suse/0041-bcache-add-pendings_cleanup-to-stop-pending-bcache-d.patch
+ patches.suse/0042-bcache-fix-mistaken-sysfs-entry-for-io_error-counter.patch
+ patches.suse/0043-bcache-destroy-dc-writeback_write_wq-if-failed-to-cr.patch
+ patches.suse/0044-bcache-stop-writeback-kthread-and-kworker-when-bch_c.patch
+ patches.suse/0045-bcache-avoid-a-deadlock-in-bcache_reboot.patch
+ patches.suse/0046-bcache-acquire-bch_register_lock-later-in-cached_dev.patch
+ patches.suse/0047-bcache-acquire-bch_register_lock-later-in-cached_dev.patch
+ patches.suse/0048-bcache-fix-potential-deadlock-in-cached_def_free.patch
+ patches.suse/0049-bcache-add-code-comments-for-journal_read_bucket.patch
+ patches.suse/0050-bcache-set-largest-seq-to-ja-seq-bucket_index-in-jou.patch
+ patches.suse/0051-bcache-shrink-btree-node-cache-after-bch_btree_check.patch
+ patches.suse/0052-bcache-Revert-bcache-free-heap-cache_set-flush_btree.patch
+ patches.suse/0053-bcache-Revert-bcache-fix-high-CPU-occupancy-during-j.patch
+ patches.suse/0054-bcache-only-clear-BTREE_NODE_dirty-bit-when-it-is-se.patch
+ patches.suse/0055-bcache-add-comments-for-mutex_lock-b-write_lock.patch
+ patches.suse/0056-bcache-remove-retry_flush_write-from-struct-cache_se.patch
+ patches.suse/0057-bcache-fix-race-in-btree_flush_write.patch
+ patches.suse/0058-bcache-performance-improvement-for-btree_flush_write.patch
+ patches.suse/0059-bcache-add-reclaimed_journal_buckets-to-struct-cache.patch
patches.drivers/documentation-dma-api-fix-a-function-name-of-max_mapping_size
+ patches.drivers/ath6kl-add-some-bounds-checking.patch
+ patches.drivers/wil6210-fix-potential-out-of-bounds-read.patch
+ patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch
+ patches.drivers/batman-adv-fix-for-leaked-TVLV-handler.patch
patches.suse/livepatch-use-static-buffer-for-debugging-messages-under-rq-lock.patch
patches.suse/revert-livepatch-remove-reliable-stacktrace-check-in-klp_try_switch_task.patch
patches.suse/livepatch-remove-duplicate-warning-about-missing-reliable-stacktrace-support.patch
+ patches.drivers/HID-wacom-generic-only-switch-the-mode-on-devices-wi.patch
+ patches.drivers/HID-wacom-generic-Correct-pad-syncing.patch
+ patches.drivers/HID-wacom-correct-touch-resolution-x-y-typo.patch
+ patches.drivers/HID-wacom-generic-read-HID_DG_CONTACTMAX-from-any-fe.patch
+ patches.drivers/intel_th-msu-Fix-single-mode-with-disabled-IOMMU.patch
+ patches.drivers/staging-rtl8712-reduce-stack-usage-again.patch
+ patches.drivers/staging-comedi-amplc_pci230-fix-null-pointer-deref-o.patch
+ patches.drivers/staging-comedi-dt282x-fix-a-null-pointer-deref-on-in.patch
+ patches.drivers/memstick-Fix-error-cleanup-path-of-memstick_init.patch
+ patches.fixes/0001-ocfs2-add-last-unlock-times-in-locking_state.patch
+ patches.fixes/0002-ocfs2-add-locking-filter-debugfs-file.patch
+ patches.fixes/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch
+ patches.arch/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch
+ patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch
# powerpc/linux next
patches.arch/powerpc-pseries-dlpar-Fix-a-missing-check-in-dlpar_p.patch
@@ -23230,6 +23343,8 @@
patches.suse/block-Fix-a-NULL-pointer-dereference-in-generic_make.patch
patches.kabi/kabi-kvm-mmu-Fix-overflow-on-kvm-mmu-page-limit-calculati.patch
patches.suse/dasd_fba-Display-00000000-for-zero-page-when-dumping.patch
+ patches.kabi/kabi-fix-KVM-s390-provide-kvm_arch_no_poll-function.patch
+ patches.kabi/kabi-fix-s390-vtime-steal-time-exponential-moving-average.patch
########################################################
# end of sorted patches
@@ -23645,6 +23760,7 @@
patches.kabi/ath9k-ath_node-ackto-kabi-workaround.patch
patches.suse/ath10k-QCA9377-firmware-limit.patch
patches.kabi/bt_accept_enqueue-kabi-workaround.patch
+ patches.kabi/mwifiex-ieee-types-kabi-fix.patch
########################################################
# ISDN