Home Home > GIT Browse > SLE12-SP4-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOlaf Hering <ohering@suse.de>2019-01-16 08:17:46 +0100
committerOlaf Hering <ohering@suse.de>2019-01-16 08:17:46 +0100
commitc8f9f2c482b3c8e02d157b0a7bdd5349708a3bb4 (patch)
tree5b14d67595e814955392e3c6503820d2d1b39039
parent323f480b0fd7640e2fa2a70a0a39c5df8f53ecbc (diff)
parent99d4b71a1d39333e9f74d16868afbf6cce3abec1 (diff)
Merge remote-tracking branch 'kerncvs/SLE12-SP4' into SLE12-SP4-AZURE
-rw-r--r--blacklist.conf34
-rw-r--r--config/arm64/default65
-rw-r--r--patches.arch/05-arch-mm-allow-arch_dup_mmap-to-fail.patch2
-rw-r--r--patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch151
-rw-r--r--patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch70
-rw-r--r--patches.arch/jump_label-split-out-code-under-the-hotplug-lock.patch96
-rw-r--r--patches.arch/kvm-x86-fix-scan-ioapic-use-before-initialization104
-rw-r--r--patches.arch/locking-static_keys-improve-uninitialized-key-warning.patch207
-rw-r--r--patches.arch/powerpc-64s-radix-Fix-process-table-entry-cache-inva.patch117
-rw-r--r--patches.arch/powerpc-pkeys-Fix-handling-of-pkey-state-across-fork.patch98
-rw-r--r--patches.arch/powerpc-powernv-Fix-save-restore-of-SPRG3-on-entry-e.patch53
-rw-r--r--patches.arch/ptrace-remove-unused-ptrace_may_access_sched-and-mode_ibrs.patch113
-rw-r--r--patches.arch/s390-dasd-simplify-locking-in-dasd_times_out.patch101
-rw-r--r--patches.arch/s390-scsi-zfcp-fix-posting-too-many-status-read-buffers.patch93
-rw-r--r--patches.arch/s390-sles15-17-01-01-s390-kdump-Fix-elfcorehdr-size-calculation.patch199
-rw-r--r--patches.arch/s390-sles15-17-01-02-s390-kdump-Make-elfcorehdr-size-calculation-ABI-comp.patch79
-rw-r--r--patches.arch/s390-sles15-17-02-01-s390-qeth-remove-outdated-portname-debug-msg.patch48
-rw-r--r--patches.arch/s390-sles15-17-02-02-s390-qeth-sanitize-strings-in-debug-messages.patch642
-rw-r--r--patches.arch/s390-sles15-17-03-s390-qeth-fix-length-check-in-SNMP-processing.patch107
-rw-r--r--patches.arch/s390-sles15-dasd-fix-deadlock-in-dasd_times_out.patch62
-rw-r--r--patches.arch/sched-core-fix-cpu-max-vs-cpuhotplug-deadlock.patch121
-rw-r--r--patches.arch/sched-smt-expose-sched_smt_present-static-key.patch83
-rw-r--r--patches.arch/sched-smt-make-sched_smt_present-track-topology.patch84
-rw-r--r--patches.arch/x86-PCI-Add-additional-VMD-device-root-ports-to-VMD-.patch40
-rw-r--r--patches.arch/x86-PCI-Add-pci-big_root_window-option-for-AMD-64-bi.patch109
-rw-r--r--patches.arch/x86-PCI-Apply-VMD-s-AERSID-fixup-generically.patch48
-rw-r--r--patches.arch/x86-PCI-Avoid-AMD-SB7xx-EHCI-USB-wakeup-defect.patch59
-rw-r--r--patches.arch/x86-PCI-Enable-AMD-64-bit-window-on-resume.patch98
-rw-r--r--patches.arch/x86-PCI-Enable-a-64bit-BAR-on-AMD-Family-15h-Models-.patch121
-rw-r--r--patches.arch/x86-PCI-Fix-infinite-loop-in-search-for-64bit-BAR-pl.patch43
-rw-r--r--patches.arch/x86-PCI-Move-and-shrink-AMD-64-bit-window-to-avoid-c.patch83
-rw-r--r--patches.arch/x86-PCI-Only-enable-a-64bit-BAR-on-single-socket-AMD.patch63
-rw-r--r--patches.arch/x86-PCI-Use-is_vmd-rather-than-relying-on-the-domain.patch35
-rw-r--r--patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch156
-rw-r--r--patches.arch/x86-bugs-fix-the-amd-ssbd-usage-of-the-spec_ctrl-msr.patch58
-rw-r--r--patches.arch/x86-bugs-switch-the-selection-of-mitigation-from-cpu-vendor-to-cpu-features.patch55
-rw-r--r--patches.arch/x86-build-Fix-compiler-support-check-for-CONFIG_RETP.patch70
-rw-r--r--patches.arch/x86-l1tf-show-actual-smt-state.patch63
-rw-r--r--patches.arch/x86-process-consolidate-and-simplify-switch_to_xtra-code.patch200
-rw-r--r--patches.arch/x86-retpoline-make-config_retpoline-depend-on-compiler-support.patch123
-rw-r--r--patches.arch/x86-retpoline-remove-minimal-retpoline-support.patch79
-rw-r--r--patches.arch/x86-speculataion-mark-command-line-parser-data-_initdata.patch58
-rw-r--r--patches.arch/x86-speculation-add-command-line-control-for-indirect-branch-speculation.patch328
-rw-r--r--patches.arch/x86-speculation-add-prctl-control-for-indirect-branch-speculation.patch249
-rw-r--r--patches.arch/x86-speculation-add-seccomp-spectre-v2-user-space-protection-mode.patch183
-rw-r--r--patches.arch/x86-speculation-apply-ibpb-more-strictly-to-avoid-cross-process-data-leak.patch180
-rw-r--r--patches.arch/x86-speculation-avoid-_switch_to_xtra-calls.patch106
-rw-r--r--patches.arch/x86-speculation-clean-up-spectre_v2_parse_cmdline.patch80
-rw-r--r--patches.arch/x86-speculation-disable-stibp-when-enhanced-ibrs-is-in-use.patch67
-rw-r--r--patches.arch/x86-speculation-enable-cross-hyperthread-spectre-v2-stibp-mitigation.patch178
-rw-r--r--patches.arch/x86-speculation-enable-prctl-mode-for-spectre_v2_user.patch184
-rw-r--r--patches.arch/x86-speculation-mark-string-arrays-const-correctly.patch70
-rw-r--r--patches.arch/x86-speculation-move-stipb-ibpb-string-conditionals-out-of-cpu_show_common.patch85
-rw-r--r--patches.arch/x86-speculation-prepare-arch_smt_update-for-prctl-mode.patch113
-rw-r--r--patches.arch/x86-speculation-prepare-for-conditional-ibpb-in-switch_mm.patch333
-rw-r--r--patches.arch/x86-speculation-prepare-for-per-task-indirect-branch-speculation-control.patch180
-rw-r--r--patches.arch/x86-speculation-prevent-stale-spec_ctrl-msr-content.patch230
-rw-r--r--patches.arch/x86-speculation-propagate-information-about-rsb-filling-mitigation-to-sysfs.patch44
-rw-r--r--patches.arch/x86-speculation-provide-ibpb-always-command-line-options.patch160
-rw-r--r--patches.arch/x86-speculation-remove-unnecessary-ret-variable-in-cpu_show_common.patch65
-rw-r--r--patches.arch/x86-speculation-rename-ssbd-update-functions.patch139
-rw-r--r--patches.arch/x86-speculation-reorder-the-spec_v2-code.patch261
-rw-r--r--patches.arch/x86-speculation-reorganize-speculation-control-msrs-update.patch118
-rw-r--r--patches.arch/x86-speculation-rework-smt-state-change.patch132
-rw-r--r--patches.arch/x86-speculation-split-out-tif-update.patch112
-rw-r--r--patches.arch/x86-speculation-unify-conditional-spectre-v2-print-functions.patch76
-rw-r--r--patches.arch/x86-speculation-update-the-tif_ssbd-comment.patch53
-rw-r--r--patches.arch/x86-vdso-fix-vdso-build-if-a-retpoline-is-emitted.patch57
-rw-r--r--patches.drivers/0001-ACPI-CPPC-Update-all-pr_-debug-err-messages-to-log-t.patch110
-rw-r--r--patches.drivers/0001-ipmi-ssif-Add-support-for-multi-part-transmit-messag.patch3
-rw-r--r--patches.drivers/0001-target-use-ISCSI_IQN_LEN-in-iscsi_target_stat.patch4
-rw-r--r--patches.drivers/0002-ACPI-CPPC-Check-for-valid-PCC-subspace-only-if-PCC-i.patch115
-rw-r--r--patches.drivers/0002-target-log-Data-Out-timeouts-as-errors.patch4
-rw-r--r--patches.drivers/0003-target-log-NOP-ping-timeouts-as-errors.patch3
-rw-r--r--patches.drivers/0004-cpufreq-CPPC-Add-cpuinfo_cur_freq-support-for-CPPC.patch101
-rw-r--r--patches.drivers/0004-target-split-out-helper-for-cxn-timeout-error-stashi.patch4
-rw-r--r--patches.drivers/0005-target-stash-sess_err_stats-on-Data-Out-timeout.patch4
-rw-r--r--patches.drivers/ALSA-cs46xx-Potential-NULL-dereference-in-probe.patch37
-rw-r--r--patches.drivers/ALSA-emu10k1-Fix-potential-Spectre-v1-vulnerabilitie.patch65
-rw-r--r--patches.drivers/ALSA-emux-Fix-potential-Spectre-v1-vulnerabilities.patch72
-rw-r--r--patches.drivers/ALSA-fireface-fix-for-state-to-fetch-PCM-frames.patch40
-rw-r--r--patches.drivers/ALSA-firewire-lib-fix-wrong-assignment-for-out_packe.patch39
-rw-r--r--patches.drivers/ALSA-firewire-lib-fix-wrong-handling-payload_length-.patch52
-rw-r--r--patches.drivers/ALSA-firewire-lib-use-the-same-print-format-for-with.patch39
-rw-r--r--patches.drivers/ALSA-hda-add-mute-LED-support-for-HP-EliteBook-840-G.patch38
-rw-r--r--patches.drivers/ALSA-hda-ca0132-make-pci_iounmap-call-conditional.patch35
-rw-r--r--patches.drivers/ALSA-hda-fix-front-speakers-on-Huawei-MBXP.patch64
-rw-r--r--patches.drivers/ALSA-hda-realtek-Add-unplug-function-into-unplug-sta.patch34
-rw-r--r--patches.drivers/ALSA-hda-realtek-Disable-headset-Mic-VREF-for-headse.patch67
-rw-r--r--patches.drivers/ALSA-hda-realtek-Enable-audio-jacks-of-ASUS-UX391UA-.patch39
-rw-r--r--patches.drivers/ALSA-hda-realtek-Enable-the-headset-mic-auto-detecti.patch38
-rw-r--r--patches.drivers/ALSA-hda-realtek-Support-Dell-headset-mode-for-New-A.patch34
-rw-r--r--patches.drivers/ALSA-hda-tegra-clear-pending-irq-handlers.patch46
-rw-r--r--patches.drivers/ALSA-pcm-Fix-potential-Spectre-v1-vulnerability.patch54
-rw-r--r--patches.drivers/ALSA-rme9652-Fix-potential-Spectre-v1-vulnerability.patch73
-rw-r--r--patches.drivers/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch51
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-an-out-of-bound-read-in-create_co.patch58
-rw-r--r--patches.drivers/ALSA-x86-Fix-runtime-PM-for-hdmi-lpe-audio.patch41
-rw-r--r--patches.drivers/ARM-bcm2835-Add-GET_THROTTLED-firmware-property.patch4
-rw-r--r--patches.drivers/ASoC-Intel-mrfld-fix-uninitialized-variable-access.patch56
-rw-r--r--patches.drivers/ASoC-dapm-Recalculate-audio-map-forcely-when-card-in.patch59
-rw-r--r--patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-2.patch56
-rw-r--r--patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-qui.patch51
-rw-r--r--patches.drivers/ASoC-omap-abe-twl6040-Fix-missing-audio-card-caused-.patch160
-rw-r--r--patches.drivers/ASoC-omap-dmic-Add-pm_qos-handling-to-avoid-overruns.patch65
-rw-r--r--patches.drivers/ASoC-omap-mcbsp-Fix-latency-value-calculation-for-pm.patch40
-rw-r--r--patches.drivers/ASoC-omap-mcpdm-Add-pm_qos-handling-to-avoid-under-o.patch128
-rw-r--r--patches.drivers/ASoC-rsnd-fixup-clock-start-checker.patch45
-rw-r--r--patches.drivers/ASoC-wm_adsp-Fix-dma-unsafe-read-of-scratch-register.patch90
-rw-r--r--patches.drivers/Input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch35
-rw-r--r--patches.drivers/Input-omap-keypad-fix-keyboard-debounce-configuratio.patch69
-rw-r--r--patches.drivers/Input-synaptics-enable-SMBus-for-HP-15-ay000.patch42
-rw-r--r--patches.drivers/PCI-Add-ACS-quirk-for-APM-X-Gene-devices.patch59
-rw-r--r--patches.drivers/PCI-Add-ACS-quirk-for-Ampere-root-ports.patch61
-rw-r--r--patches.drivers/PCI-Convert-device-specific-ACS-quirks-from-NULL-ter.patch59
-rw-r--r--patches.drivers/PCI-Delay-after-FLR-of-Intel-DC-P3700-NVMe.patch67
-rw-r--r--patches.drivers/PCI-Disable-Samsung-SM961-PM961-NVMe-before-FLR.patch129
-rw-r--r--patches.drivers/PCI-Export-pcie_has_flr.patch50
-rw-r--r--patches.drivers/PCI-Mark-Ceton-InfiniTV4-INTx-masking-as-broken.patch40
-rw-r--r--patches.drivers/PCI-Mark-Intel-XXV710-NIC-INTx-masking-as-broken.patch41
-rw-r--r--patches.drivers/PCI-Mark-fall-through-switch-cases-before-enabling-W.patch91
-rw-r--r--patches.drivers/PCI-iproc-Activate-PAXC-bridge-quirk-for-more-device.patch34
-rw-r--r--patches.drivers/Revert-scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch3
-rw-r--r--patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch71
-rw-r--r--patches.drivers/USB-omap_udc-fix-USB-gadget-functionality-on-Palm-Tu.patch34
-rw-r--r--patches.drivers/USB-omap_udc-fix-crashes-on-probe-error-and-module-r.patch116
-rw-r--r--patches.drivers/USB-omap_udc-fix-omap_udc_start-on-15xx-machines.patch43
-rw-r--r--patches.drivers/USB-omap_udc-use-devm_request_irq.patch104
-rw-r--r--patches.drivers/USB-serial-option-add-Fibocom-NL668-series.patch61
-rw-r--r--patches.drivers/USB-serial-option-add-GosunCn-ZTE-WeLink-ME3630.patch66
-rw-r--r--patches.drivers/USB-serial-option-add-HP-lt4132.patch76
-rw-r--r--patches.drivers/USB-serial-option-add-Simcom-SIM7500-SIM7600-MBIM-mo.patch53
-rw-r--r--patches.drivers/USB-serial-option-add-Telit-LN940-series.patch63
-rw-r--r--patches.drivers/ath10k-don-t-assume-this-is-a-PCI-dev-in-generic-cod.patch49
-rw-r--r--patches.drivers/ath6kl-Only-use-match-sets-when-firmware-supports-it.patch40
-rw-r--r--patches.drivers/b43-Fix-error-in-cordic-routine.patch47
-rw-r--r--patches.drivers/can-flexcan-flexcan_irq-fix-indention.patch38
-rw-r--r--patches.drivers/cdrom-don-t-attempt-to-fiddle-with-cdo-capability.patch80
-rw-r--r--patches.drivers/char_dev-Fix-off-by-one-bugs-in-find_dynamic_major.patch53
-rw-r--r--patches.drivers/char_dev-extend-dynamic-allocation-of-majors-into-a-.patch136
-rw-r--r--patches.drivers/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch45
-rw-r--r--patches.drivers/device-property-Define-type-of-PROPERTY_ENRTY_-macro.patch81
-rw-r--r--patches.drivers/device-property-fix-fwnode_graph_get_next_endpoint-d.patch36
-rw-r--r--patches.drivers/gpio-max7301-fix-driver-for-use-with-CONFIG_VMAP_STA.patch58
-rw-r--r--patches.drivers/gpio-mvebu-only-fail-on-missing-clk-if-pwm-is-actual.patch53
-rw-r--r--patches.drivers/gpiolib-Fix-return-value-of-gpio_to_desc-stub-if-GPI.patch39
-rw-r--r--patches.drivers/gpiolib-acpi-Only-defer-request_irq-for-GpioInt-ACPI.patch301
-rw-r--r--patches.drivers/i2c-axxia-properly-handle-master-timeout.patch175
-rw-r--r--patches.drivers/i2c-scmi-Fix-probe-error-on-devices-with-an-empty-SM.patch73
-rw-r--r--patches.drivers/input-add-official-raspberry-pi-s-touchscreen-driver.patch322
-rw-r--r--patches.drivers/intel_th-msu-Fix-an-off-by-one-in-attribute-store.patch57
-rw-r--r--patches.drivers/iommu-amd-fix-amd_iommu-force_isolation52
-rw-r--r--patches.drivers/iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw58
-rw-r--r--patches.drivers/iwlwifi-add-new-cards-for-9560-9462-9461-and-killer-.patch83
-rw-r--r--patches.drivers/iwlwifi-pcie-don-t-reset-TXQ-write-pointer.patch33
-rw-r--r--patches.drivers/libata-whitelist-all-SAMSUNG-MZ7KM-solid-state-disks.patch36
-rw-r--r--patches.drivers/media-em28xx-Fix-use-after-free-when-disconnecting.patch93
-rw-r--r--patches.drivers/media-em28xx-make-v4l2-compliance-happier-by-startin.patch40
-rw-r--r--patches.drivers/media-omap3isp-Unregister-media-device-as-first.patch45
-rw-r--r--patches.drivers/mmc-bcm2835-reset-host-on-timeout.patch50
-rw-r--r--patches.drivers/mmc-core-Allow-BKOPS-and-CACHE-ctrl-even-if-no-HPI-s.patch51
-rw-r--r--patches.drivers/mmc-core-Reset-HPI-enabled-state-during-re-init-and-.patch42
-rw-r--r--patches.drivers/mmc-core-Use-a-minimum-1600ms-timeout-when-enabling-.patch63
-rw-r--r--patches.drivers/mmc-omap_hsmmc-fix-DMA-API-warning.patch65
-rw-r--r--patches.drivers/platform-msi-Free-descriptors-in-platform_msi_domain.patch93
-rw-r--r--patches.drivers/power-supply-olpc_battery-correct-the-temperature-un.patch55
-rw-r--r--patches.drivers/revert-iommu-io-pgtable-arm-check-for-v7s-incapable-systems42
-rw-r--r--patches.drivers/rtc-m41t80-Correct-alarm-month-range-with-RTC-reads.patch45
-rw-r--r--patches.drivers/rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch57
-rw-r--r--patches.drivers/rtc-snvs-Add-timeouts-to-avoid-kernel-lockups.patch198
-rw-r--r--patches.drivers/rtl8xxxu-Fix-missing-break-in-switch.patch35
-rw-r--r--patches.drivers/scsi-lpfc-Cap-NPIV-vports-to-256.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Correct-LCB-RJT-handling.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Correct-code-setting-non-existent-bits-in-.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Correct-errors-accessing-fw-log.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Correct-loss-of-fc4-type-on-remote-port-ad.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Correct-speeds-on-SFP-swap.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Correct-topology-type-reporting-on-G7-adap.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Defer-LS_ACC-to-FLOGI-on-point-to-point-lo.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Enable-Management-features-for-IF_TYPE-6.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-LOGO-PLOGI-handling-when-triggerd-by-A.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-a-duplicate-0711-log-message-number.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-dif-and-first-burst-use-in-write-comma.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-discovery-failures-during-port-failove.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-driver-release-of-fw-logging-buffers.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-kernel-Oops-due-to-null-pring-pointers.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-lpfc_sli4_read_config-return-value-che.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-odd-recovery-in-duplicate-FLOGIs-in-po.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Fix-panic-when-FW-log-buffsize-is-not-init.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Implement-GID_PT-on-Nameserver-query-to-su.patch3
-rw-r--r--patches.drivers/scsi-lpfc-Reset-link-or-adapter-instead-of-doing-inf.patch3
-rw-r--r--patches.drivers/scsi-lpfc-add-Trunking-support.patch3
-rw-r--r--patches.drivers/scsi-lpfc-fcoe-Fix-link-down-issue-after-1000-link-b.patch3
-rw-r--r--patches.drivers/scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch3
-rw-r--r--patches.drivers/scsi-lpfc-refactor-mailbox-structure-context-fields.patch3
-rw-r--r--patches.drivers/scsi-lpfc-rport-port-swap-discovery-issue.patch3
-rw-r--r--patches.drivers/scsi-lpfc-update-driver-version-to-12.0.0.8.patch3
-rw-r--r--patches.drivers/scsi-lpfc-update-driver-version-to-12.0.0.9.patch3
-rw-r--r--patches.drivers/scsi-lpfc-update-manufacturer-attribute-to-reflect-B.patch3
-rw-r--r--patches.drivers/soc-bcm2835-sync-firmware-properties-with-downstream.patch83
-rw-r--r--patches.drivers/spi-bcm2835-Avoid-finishing-transfer-prematurely-in-.patch64
-rw-r--r--patches.drivers/spi-bcm2835-Fix-book-keeping-of-DMA-termination.patch49
-rw-r--r--patches.drivers/spi-bcm2835-Fix-race-on-DMA-termination.patch66
-rw-r--r--patches.drivers/spi-bcm2835-Unbreak-the-build-of-esoteric-configs.patch45
-rw-r--r--patches.drivers/staging-bcm2835-camera-Abort-probe-if-there-is-no-ca.patch53
-rw-r--r--patches.drivers/staging-wilc1000-fix-missing-read_write-setting-when.patch35
-rw-r--r--patches.drivers/thermal-bcm2835-enable-hwmon-explicitly.patch6
-rw-r--r--patches.drivers/usb-dwc2-host-use-hrtimer-for-nak-retries.patch137
-rw-r--r--patches.drivers/wireless-airo-potential-buffer-overflow-in-sprintf.patch40
-rw-r--r--patches.drivers/wlcore-Fix-the-return-value-in-case-of-error-in-wlco.patch40
-rw-r--r--patches.drivers/x86-PCI-Move-VMD-quirk-to-x86-fixups.patch76
-rw-r--r--patches.drivers/xhci-Don-t-prevent-USB2-bus-suspend-in-state-check-i.patch44
-rw-r--r--patches.drm/0001-drm-amdgpu-gmc8-update-MC-firmware-for-polaris.patch83
-rw-r--r--patches.drm/0001-drm-amdgpu-update-SMC-firmware-image-for-polaris10-v.patch31
-rw-r--r--patches.drm/0001-drm-amdgpu-update-mc-firmware-image-for-polaris12-va.patch50
-rw-r--r--patches.drm/0001-drm-i915-execlists-Apply-a-full-mb-before-execution-.patch53
-rw-r--r--patches.drm/0001-drm-ioctl-Fix-Spectre-v1-vulnerabilities.patch78
-rw-r--r--patches.drm/0001-drm-nouveau-kms-Fix-memory-leak-in-nv50_mstm_del.patch32
-rw-r--r--patches.drm/0001-drm-rcar-du-Fix-external-clock-error-checks.patch46
-rw-r--r--patches.drm/0001-drm-rcar-du-Fix-vblank-initialization.patch31
-rw-r--r--patches.drm/0001-drm-rockchip-psr-do-not-dereference-encoder-before-i.patch43
-rw-r--r--patches.drm/0001-drm-set-is_master-to-0-upon-drm_new_set_master-failu.patch110
-rw-r--r--patches.drm/0001-drm-vc4-Set-is_yuv-to-false-when-num_planes-1.patch40
-rw-r--r--patches.drm/0001-drm-vc4-x_scaling-1-should-never-be-set-to-VC4_SCALI.patch55
-rw-r--r--patches.drm/Revert-drm-bridge-sii8620-fix-display-of-packed-pixel (renamed from patches.drm/drm-bridge-sii8620-Fix-display-of-packed-pixel-modes)0
-rw-r--r--patches.fixes/0001-arm64-Add-work-around-for-Arm-Cortex-A55-Erratum-102.patch155
-rw-r--r--patches.fixes/0001-arm64-atomics-Remove-from-asm-constraint-in-lse-atom.patch36
-rw-r--r--patches.fixes/0001-btrfs-qgroup-Dirty-all-qgroups-before-rescan.patch87
-rw-r--r--patches.fixes/0001-btrfs-tree-checker-Don-t-check-max-block-group-size-.patch77
-rw-r--r--patches.fixes/0001-fbdev-fbcon-Fix-unregister-crash-when-more-than-one-.patch85
-rw-r--r--patches.fixes/0001-fbdev-fbmem-behave-better-with-small-rotated-display.patch63
-rw-r--r--patches.fixes/0001-hwpoison-memory_hotplug-allow-hwpoisoned-pages-to-be.patch3
-rw-r--r--patches.fixes/0001-md-fix-raid10-hang-issue-caused-by-barrier.patch127
-rw-r--r--patches.fixes/0001-mm-only-report-isolation-failures-when-offlining-mem.patch187
-rw-r--r--patches.fixes/0001-mm-print-more-information-about-mapping-in-__dump_pa.patch3
-rw-r--r--patches.fixes/0001-staging-ncpfs-memory-corruption-in-ncp_read_kernel.patch3
-rw-r--r--patches.fixes/0001-x86-speculation-l1tf-Drop-the-swap-storage-limit-res.patch3
-rw-r--r--patches.fixes/0001-xen-netfront-tolerate-frags-with-no-data.patch37
-rw-r--r--patches.fixes/0002-arm64-lse-Add-early-clobbers-to-some-input-output-as.patch155
-rw-r--r--patches.fixes/0002-mm-lower-the-printk-loglevel-for-__dump_page-message.patch3
-rw-r--r--patches.fixes/0003-arm64-cpu_errata-include-required-headers.patch46
-rw-r--r--patches.fixes/0003-mm-memory_hotplug-drop-pointless-block-alignment-che.patch3
-rw-r--r--patches.fixes/0004-arm64-remove-no-op-p-linker-flag.patch55
-rw-r--r--patches.fixes/0004-mm-memory_hotplug-print-reason-for-the-offlining-fai.patch3
-rw-r--r--patches.fixes/0005-arm64-mm-always-enable-CONFIG_HOLES_IN_ZONE.patch107
-rw-r--r--patches.fixes/0005-mm-memory_hotplug-be-more-verbose-for-memory-offline.patch3
-rw-r--r--patches.fixes/0006-arm64-lse-remove-fcall-used-x0-flag.patch43
-rw-r--r--patches.fixes/0008-arm64-numa-Report-correct-memblock-range-for-the-dum.patch38
-rw-r--r--patches.fixes/0009-arm64-numa-Unify-common-error-path-in-numa_init.patch65
-rw-r--r--patches.fixes/0010-arm64-Fix-proc-iomem-for-reserved-but-not-memory-reg.patch134
-rw-r--r--patches.fixes/0011-arm64-dma-mapping-Fix-FORCE_CONTIGUOUS-buffer-cleari.patch40
-rw-r--r--patches.fixes/aio-fix-spectre-gadget-in-lookup_ioctx.patch46
-rw-r--r--patches.fixes/block-copy-ioprio-in-__bio_clone_fast.patch3
-rw-r--r--patches.fixes/bpf-fix-check-of-allowed-specifiers-in-bpf_trace_pri.patch39
-rw-r--r--patches.fixes/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch35
-rw-r--r--patches.fixes/ext4-fix-EXT4_IOC_GROUP_ADD-ioctl.patch44
-rw-r--r--patches.fixes/ext4-fix-possible-use-after-free-in-ext4_quota_enabl.patch41
-rw-r--r--patches.fixes/ext4-missing-unlock-put_page-in-ext4_try_to_write_in.patch42
-rw-r--r--patches.fixes/extable-Consolidate-kernel_text_address-functions.patch52
-rw-r--r--patches.fixes/extable-Enable-RCU-if-it-is-not-watching-in-kernel_t.patch86
-rw-r--r--patches.fixes/filesystem-dax-Fix-dax_layout_busy_page-livelock.patch79
-rw-r--r--patches.fixes/fs-xfs-Use-pS-printk-format-for-direct-addresses.patch38
-rw-r--r--patches.fixes/gfs2-Fix-loop-in-gfs2_rbm_find.patch41
-rw-r--r--patches.fixes/gfs2-Get-rid-of-potential-double-freeing-in-gfs2_cre.patch70
-rw-r--r--patches.fixes/kdb-use-memmove-instead-of-overlapping-memcpy.patch47
-rw-r--r--patches.fixes/libnvdimm-pfn-pad-pfn-namespaces-relative-to-other-regions.patch2
-rw-r--r--patches.fixes/libnvdimm-pmem-Fix-badblocks-population-for-raw-name.patch46
-rw-r--r--patches.fixes/mm-huge_memory-c-reorder-operations-in-_split_huge_page_tail.patch100
-rw-r--r--patches.fixes/mm-huge_memory-fix-lockdep-complaint-on-32-bit-i_size_read.patch99
-rw-r--r--patches.fixes/mm-huge_memory-rename-freeze_page-to-unmap_page.patch87
-rw-r--r--patches.fixes/mm-huge_memory-splitting-set-mapping-index-before-unfreeze.patch66
-rw-r--r--patches.fixes/mm-khugepaged-collapse_shmem-do-not-crash-on-compound.patch48
-rw-r--r--patches.fixes/mm-khugepaged-collapse_shmem-remember-to-clear-holes.patch59
-rw-r--r--patches.fixes/mm-khugepaged-collapse_shmem-stop-if-punched-or-truncated.patch60
-rw-r--r--patches.fixes/mm-khugepaged-collapse_shmem-without-freezing-new_page.patch115
-rw-r--r--patches.fixes/mm-khugepaged-fix-crashes-due-to-misaccounted-holes.patch88
-rw-r--r--patches.fixes/mm-khugepaged-minor-reorderings-in-collapse_shmem.patch232
-rw-r--r--patches.fixes/mm-put_and_wait_on_page_locked-while-page-is-migrated.patch3
-rw-r--r--patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch37
-rw-r--r--patches.fixes/nvme-validate-controller-state-before-rescheduling-k.patch67
-rw-r--r--patches.fixes/rcu-Allow-for-page-faults-in-NMI-handlers.patch67
-rw-r--r--patches.fixes/ring-buffer-Allow-for-rescheduling-when-removing-pag.patch48
-rw-r--r--patches.fixes/ring-buffer-Do-no-reuse-reader-page-if-still-in-use.patch61
-rw-r--r--patches.fixes/ring-buffer-Mask-out-the-info-bits-when-returning-bu.patch59
-rw-r--r--patches.fixes/sched-tracing-Fix-trace_sched_pi_setprio-for-deboost.patch63
-rw-r--r--patches.fixes/scsi-lpfc-fix-block-guard-enablement-on-sli3-adapters.patch2
-rw-r--r--patches.fixes/scsi-target-add-emulate_pr-backstore-attr-to-toggle-.patch214
-rw-r--r--patches.fixes/scsi-target-drop-unused-pi_prot_format-attribute-sto.patch58
-rw-r--r--patches.fixes/shmem-introduce-shmem_inode_acct_block.patch247
-rw-r--r--patches.fixes/shmem-shmem_charge-verify-max_block-is-not-exceeded-before-inode-update.patch78
-rw-r--r--patches.fixes/splice-dont-read-more-than-available-pipe-space.patch60
-rw-r--r--patches.fixes/sunrpc-use-SVC_NET-in-svcauth_gss_-functions.patch53
-rw-r--r--patches.fixes/sunrpc-use-after-free-in-svc_process_common.patch131
-rw-r--r--patches.fixes/target-iscsi-avoid-NULL-dereference-in-CHAP-auth-err.patch38
-rw-r--r--patches.fixes/tools-lib-lockdep-Rename-trywlock-into-trywrlock.patch66
-rw-r--r--patches.fixes/tracing-Fix-bad-use-of-igrab-in-trace_uprobe.c.patch152
-rw-r--r--patches.fixes/tracing-Fix-crash-when-freeing-instances-with-event-.patch74
-rw-r--r--patches.fixes/tracing-Fix-crash-when-it-fails-to-alloc-ring-buffer.patch64
-rw-r--r--patches.fixes/tracing-Fix-double-free-of-event_trigger_data.patch116
-rw-r--r--patches.fixes/tracing-Fix-missing-return-symbol-in-function_graph-.patch89
-rw-r--r--patches.fixes/tracing-Fix-possible-double-free-in-event_enable_tri.patch65
-rw-r--r--patches.fixes/tracing-Fix-possible-double-free-on-failure-of-alloc.patch43
-rw-r--r--patches.fixes/tracing-Fix-regex_match_front-to-not-over-compare-th.patch46
-rw-r--r--patches.fixes/tracing-Fix-trace_pipe-behavior-for-instance-traces.patch51
-rw-r--r--patches.fixes/tracing-Remove-RCU-work-arounds-from-stack-tracer.patch67
-rw-r--r--patches.fixes/ubifs-Handle-re-linking-of-inodes-correctly-while-re.patch96
-rw-r--r--patches.fixes/userfaultfd-shmem-add-i_size-checks.patch8
-rw-r--r--patches.fixes/vfs-Avoid-softlockups-in-drop_pagecache_sb.patch53
-rw-r--r--patches.fixes/vhost-vsock-fix-use-after-free-in-network-stack-call.patch190
-rw-r--r--patches.fixes/x86-mm-Fix-decoy-address-handling-vs-32-bit-builds.patch89
-rw-r--r--patches.fixes/xfs-Align-compat-attrlist_by_handle-with-native-impl.patch57
-rw-r--r--patches.fixes/xfs-Fix-xqmstats-offsets-in-proc-fs-xfs-xqmstat.patch44
-rw-r--r--patches.fixes/xfs-fix-quotacheck-dquot-id-overflow-infinite-loop.patch42
-rw-r--r--patches.fixes/xfs-xfs_buf-drop-useless-LIST_HEAD.patch47
-rw-r--r--patches.kabi/kabi-x86-speculation-fix-cpu_tlbstate-issue.patch52
-rw-r--r--patches.kabi/sunrpc-use-after-free-in-svc_process_common.patch31
-rw-r--r--patches.kabi/target-se_dev_attrib.emulate_pr-ABI-stability.patch34
-rw-r--r--patches.suse/0001-Btrfs-fix-fsync-of-files-with-multiple-hard-links-in.patch156
-rw-r--r--patches.suse/0001-rbtree-cache-leftmost-node-internally.patch3
-rw-r--r--patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch37
-rw-r--r--patches.suse/0001-x86-stacktrace-Do-not-unwind-after-user-regs.patch3
-rw-r--r--patches.suse/0002-rbtree-optimize-root-check-during-rebalancing-loop.patch3
-rw-r--r--patches.suse/0002-x86-stacktrace-Remove-STACKTRACE_DUMP_ONCE.patch3
-rw-r--r--patches.suse/0003-modsign-log-module-name-in-the-event-of-an-error.patch18
-rw-r--r--patches.suse/0003-rbtree-add-some-additional-comments-for-rebalancing-.patch3
-rw-r--r--patches.suse/0003-x86-stacktrace-Clarify-the-reliable-success-paths.patch3
-rw-r--r--patches.suse/0004-MODSIGN-checking-the-blacklisted-hash-before-loading.patch16
-rw-r--r--patches.suse/0004-x86-stacktrace-Do-not-fail-for-ORC-with-regs-on-stac.patch3
-rw-r--r--patches.suse/0006-x86-stacktrace-Enable-HAVE_RELIABLE_STACKTRACE-for-t.patch3
-rw-r--r--patches.suse/0008-sched-deadline-replace-earliest-dl-and-rq-leftmost-c.patch3
-rw-r--r--patches.suse/0009-locking-rtmutex-replace-top-waiter-and-pi_waiters-le.patch3
-rw-r--r--patches.suse/0010-block-cfq-replace-cfq_rb_root-leftmost-caching.patch3
-rw-r--r--patches.suse/0012-lib-interval-tree-correct-comment-wrt-generic-flavor.patch3
-rw-r--r--patches.suse/0013-procfs-use-faster-rb_first_cached.patch3
-rw-r--r--patches.suse/0015-mem-memcg-cache-rightmost-node.patch3
-rw-r--r--patches.suse/0016-block-cfq-cache-rightmost-rb_node.patch3
-rw-r--r--patches.suse/ath10k-QCA9377-firmware-limit.patch40
-rw-r--r--patches.suse/btrfs-always-try-all-copies-when-reading-extent-buffers.patch74
-rw-r--r--patches.suse/btrfs-btrfs-use-the-new-VFS-super_block_dev.patch35
-rw-r--r--patches.suse/btrfs-delete-dead-code-in-btrfs_orphan_add.patch80
-rw-r--r--patches.suse/btrfs-delete-dead-code-in-btrfs_orphan_commit_root.patch51
-rw-r--r--patches.suse/btrfs-do-not-check-inode-s-runtime-flags-under-root-orphan_lock.patch63
-rw-r--r--patches.suse/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch37
-rw-r--r--patches.suse/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch66
-rw-r--r--patches.suse/btrfs-fix-enospc-caused-by-orphan-items-reservations.patch252
-rw-r--r--patches.suse/btrfs-fix-error-handling-in-btrfs_cleanup_ordered_extents.patch125
-rw-r--r--patches.suse/btrfs-fix-error-handling-in-btrfs_truncate.patch79
-rw-r--r--patches.suse/btrfs-fix-error-handling-in-btrfs_truncate_inode_items.patch157
-rw-r--r--patches.suse/btrfs-fix-memory-barriers-usage-with-device-stats-counters.patch97
-rw-r--r--patches.suse/btrfs-fix-use-after-free-on-root-orphan_block_rsv.patch121
-rw-r--r--patches.suse/btrfs-get-rid-of-btrfs_inode_has_orphan_item.patch179
-rw-r--r--patches.suse/btrfs-get-rid-of-unused-orphan-infrastructure.patch240
-rw-r--r--patches.suse/btrfs-move-btrfs_truncate_block-out-of-trans-handle.patch193
-rw-r--r--patches.suse/btrfs-refactor-btrfs_evict_inode-reserve-refill-dance.patch172
-rw-r--r--patches.suse/btrfs-renumber-btrfs_inode_-runtime-flags-and-switch-to-enums.patch51
-rw-r--r--patches.suse/btrfs-reserve-space-for-o_tmpfile-orphan-item-deletion.patch36
-rw-r--r--patches.suse/btrfs-run-delayed-items-before-dropping-the-snapshot.patch88
-rw-r--r--patches.suse/btrfs-stop-creating-orphan-items-for-truncate.patch294
-rw-r--r--patches.suse/btrfs-update-stale-comments-referencing-vmtruncate.patch48
-rw-r--r--patches.suse/cpufreq-CPPC-fix-build-in-absence-of-v3-support.patch34
-rw-r--r--patches.suse/crash-export-paddr_vmcoreinfo_note.patch8
-rw-r--r--patches.suse/mm-don-t-warn-about-large-allocations-for-slab.patch110
-rw-r--r--patches.suse/mm-hugetlb-yield-when-prepping-struct-pages.patch53
-rw-r--r--patches.suse/mm-shmem.c-Correctly-annotate-new-inodes-for-lockdep.patch130
-rw-r--r--patches.suse/rcu-Use-lockdep-to-assert-IRQs-are-disabled-enabled.patch8
-rw-r--r--patches.suse/sched-fair-Fix-infinite-loop-in-update_blocked_averages-by-reverting-a9e7f6544b9c.patch187
-rw-r--r--patches.suse/sched-numa-remove-unused-code-from-update_numa_stats.patch4
-rw-r--r--patches.suse/sched-numa-remove-unused-nr_running-field.patch4
-rw-r--r--patches.suse/tty-Don-t-block-on-IO-when-ldisc-change-is-pending.patch3
-rw-r--r--patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch3
-rw-r--r--patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch3
-rw-r--r--patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch3
-rw-r--r--patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch3
-rw-r--r--patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch3
-rw-r--r--patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch3
-rwxr-xr-x[-rw-r--r--]scripts/git-pre-commit0
-rw-r--r--scripts/git_sort/README.md170
-rwxr-xr-xscripts/git_sort/armor_origin.sh77
-rw-r--r--scripts/git_sort/backport-mode.sh343
-rwxr-xr-xscripts/git_sort/check_missing_fixes.sh17
-rw-r--r--scripts/git_sort/clean_conflicts.awk17
-rwxr-xr-xscripts/git_sort/clean_header.sh17
-rw-r--r--scripts/git_sort/exc.py16
-rwxr-xr-xscripts/git_sort/git-f143
-rwxr-xr-xscripts/git_sort/git-overview90
l---------scripts/git_sort/git-sort1
-rwxr-xr-xscripts/git_sort/git_sort.py17
-rwxr-xr-xscripts/git_sort/ksapply.sh144
-rw-r--r--scripts/git_sort/lib.py17
-rw-r--r--scripts/git_sort/lib.sh17
-rw-r--r--scripts/git_sort/lib_from.sh17
-rw-r--r--scripts/git_sort/lib_tag.sh17
-rwxr-xr-xscripts/git_sort/merge_tool.py17
-rw-r--r--scripts/git_sort/patch.py17
-rw-r--r--scripts/git_sort/patch_body.awk17
-rw-r--r--scripts/git_sort/patch_header.awk17
-rwxr-xr-xscripts/git_sort/pre-commit.sh17
-rwxr-xr-xscripts/git_sort/qcp.py17
-rwxr-xr-xscripts/git_sort/qdupcheck.py17
-rwxr-xr-xscripts/git_sort/qgoto.py17
-rw-r--r--scripts/git_sort/quilt-mode.sh17
-rwxr-xr-xscripts/git_sort/refs_in_series.sh17
-rwxr-xr-xscripts/git_sort/rename_patch.sh82
-rwxr-xr-xscripts/git_sort/sequence-insert.py17
-rwxr-xr-xscripts/git_sort/series_conf.py17
-rwxr-xr-xscripts/git_sort/series_insert.py17
-rwxr-xr-xscripts/git_sort/series_sort.py17
-rwxr-xr-xscripts/git_sort/update-configs.sh75
-rwxr-xr-xscripts/git_sort/update_clone.py17
-rwxr-xr-xscripts/git_sort/vi-conflicts.sh24
-rwxr-xr-xscripts/log25
-rwxr-xr-xscripts/run_oldconfig.sh31
-rwxr-xr-xscripts/sequence-patch.sh26
-rw-r--r--series.conf424
-rw-r--r--supported.conf1
415 files changed, 26159 insertions, 1332 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 0be2606893..b9887b74ea 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -291,6 +291,7 @@ c1e150ceb61e4a585bad156da15c33bfe89f5858 # build fix for NUMA=n
dc24b7b49a53c7ee5502c877b133558acec0b3f8 # arch/s390 CFI macros: v4.16+
62a06994ced17f295fc51ea0815580ee7ccb668d # minor bpf selftest Makefile change
63c859101ec32cbc8fa5b708c7f17de63b15e56e # libbpf Makefile clean up
+1efb6ee3edea57f57f9fb05dba8dcb3f7333f61f # bpf: only prevents WARN() when using wrong format in bpf_trace_printk()
42f46148217865a545e129612075f3d828a2c4e4 # later reverted
5d38f049cee1e1c4a7ac55aa79d37d01ddcc3860 # revert of above
116ceac9741e5ab0337b0c855ba80966bfc899e2 # just noise
@@ -532,7 +533,28 @@ a338f84dc196f44b63ba0863d2f34fd9b1613572 # printk: fixes 719f6a7040f1bdaf96fcc t
d8be75663cec0069b85f80191abd2682ce4a512f # related to kmemcheck removal; not for released products
1f2cac107c591c24b60b115d6050adc213d10fc0 # blktrace: racy init/start-stop/teardown for ages; not worth it
a6da0024ffc19e0d47712bb5ca4fd083f76b07df # blktrace: fix unlocked registration of tracepoints; racy for ages; found by syzcaller; not worth it
+6b7e633fe9c24682df550e5311f47fb524701586 # ring_buffer: just an optimization
7685ab6c58557c6234f3540260195ecbee7fc4b3 # tracing: we do not have support for recording tgid of tasks (bsc#1112221)
+90e406f96f630c07d631a021fd4af10aac913e77 # tracing: just a memory optimization
+68e76e034b6b1c1ce2eece1ab8ae4008e14be470 # tracing: dependency fix found by randconfig; prevents a huge build
+07234021410bbc27b7c86c18de98616c29fbe667 # tracing: incomplete filtering events; new feature
+73c8d8945505acdcbae137c2e00a1232e0be709f # tracing: just a small annoyance when switching buffer snapshot
+57ea2a34adf40f3a6e88409aafcf803b8945619a # tracing/kprobes: old bug; hard to trigger; rather just annoying
+f143641bfef9a4a60c57af30de26c63057e7e695 # tracing: old and not serious bug
+8114865ff82e200b383e46821c25cb0625b842b5 # ftrace: fixes a race when calculating timings in graph_tracer when options/graph-time is set to zero; non-trivial change; let's ignore until anyone complains
+07f7175b43827640d1e69c9eded89aa089a234b4 # ftrace: see above 8114865ff82e200b383
+f1f5b14afd7cce39e6a9b25c685e1ea34c231096 # ftrace: see above 8114865ff82e200b383
+01e0ab2c4ff12358f15a856fd1a7bbea0670972b # ftrace: see above 8114865ff82e200b383
+d48ebb24866edea2c35be02a878f25bc65529370 # ftrace: see above 8114865ff82e200b383
+e949b6db51dc172a35c962bc4414ca148315fe21 # ftrace: see above 8114865ff82e200b383
+18588e1487b19e45bd90bd55ec8d3a1d44f3257f # ftrace: see above 8114865ff82e200b383
+d125f3f866df88da5a85df00291f88f0baa89f7c # ftrace: see above 8114865ff82e200b383
+39eb456dacb543de90d3bc6a8e0ac5cf51ac475e # ftrace: see above 8114865ff82e200b383
+552701dd0fa7c3d448142e87210590ba424694a0 # ftrace: see above 8114865ff82e200b383
+7c6ea35ef50810aa12ab26f21cb858d980881576 # ftrace: see above 8114865ff82e200b383
+b1b35f2e218a5b57d03bbc3b0667d5064570dc60 # ftrace: see above 8114865ff82e200b383
+3cec638b3d793b7cacdec5b8072364b41caeb0e1 # ftrace: memory leak when set_trigger_filter() fails; should not normally happen; not worth it
+2840f84f74035e5a535959d5f17269c69fa6edc5 # ftrace: memory leak in pretty advanced scenario
c4ff91dd40e2253ab6dd028011469c2c694e1e19 # drm/amd/pp: initialize result to before or'ing in data
9c60583c0b0fd6f3a5b61fda3eb604ce218b9d25 # breaks KABI
@@ -952,3 +974,15 @@ e4b069e0945fa14c71cf8b5b89f8b1b2aa68dbc2 # other non-stable patches required
50b977481fce90aa5fbda55e330b9d722733e358 # breaks kabi on enum integrity_status
123664101aa2156d05251704fc63f9bcbf77741a # Requires 03a551734cfc which we don't have
36b6857932f380fcb55c31ac75857e3e81dd583a # breaks kABI
+fb265c9cb49e2074ddcdd4de99728aefdd3b3592 # Intrusive patch, mostly cleanup, fixes only long-standing error code mismatch
+368686a95e55fd66b88542b5b23d802a4886b1aa # Cleanup for buggy driver handling
+6ff9b09e00a441599f3aacdf577254455a048bc9 # we don't allow gfs2 in rw mode
+2d29f6b96d8f80322ed2dd895bca590491c38d34 # we don't allow gfs2 in rw mode
+83bc0f5b432f60394466deef16fc753e27371d0b # Duplicate of 4c9613ce556fdeb671e779668b627ea3a2b61728
+914a4fd8cd28016038ce749a818a836124a8d270 # Duplicate of d9a515867bdba59ebf196a6ade10faae8e8be36a
+7aaf7727235870f497eb928f728f7773d6df3b40 # Minor fix but outside chance it breaks vmstat parsers
+af27d9403f5b80685b79c88425086edccecaf711 # Warning applies to unsupported configuration
+379b03b7fa05f7db521b7732a52692448a3c34fe # Affected code is reverted
+613a5eb5677923fdaecfa582738c7bcf80abe186 # Problem affects debugging builds only and is harmless
+d50d82faa0c964e31f7a946ba8aba7c715ca7ab0 # Problem affects SLUB which is not enabled in kconfig
+8363dae23463df5d27aa3f3430ad64f5c8fcee3e # Not applicable for SLE15
diff --git a/config/arm64/default b/config/arm64/default
index 7a9fcf03c1..12a2dc7204 100644
--- a/config/arm64/default
+++ b/config/arm64/default
@@ -524,6 +524,7 @@ CONFIG_ARM64_ERRATUM_832075=y
CONFIG_ARM64_ERRATUM_834220=y
CONFIG_ARM64_ERRATUM_845719=y
CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_ERRATUM_1024718=y
CONFIG_CAVIUM_ERRATUM_22375=y
CONFIG_CAVIUM_ERRATUM_23144=y
CONFIG_CAVIUM_ERRATUM_23154=y
@@ -3323,7 +3324,69 @@ CONFIG_TABLET_USB_HANWANG=m
CONFIG_TABLET_USB_KBTAB=m
CONFIG_TABLET_USB_PEGASUS=m
CONFIG_TABLET_SERIAL_WACOM4=m
-# CONFIG_INPUT_TOUCHSCREEN is not set
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_PROPERTIES=y
+# CONFIG_TOUCHSCREEN_ADS7846 is not set
+# CONFIG_TOUCHSCREEN_AD7877 is not set
+# CONFIG_TOUCHSCREEN_AD7879 is not set
+# CONFIG_TOUCHSCREEN_AR1021_I2C is not set
+# CONFIG_TOUCHSCREEN_ATMEL_MXT is not set
+# CONFIG_TOUCHSCREEN_AUO_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_BU21013 is not set
+# CONFIG_TOUCHSCREEN_CHIPONE_ICN8318 is not set
+# CONFIG_TOUCHSCREEN_CY8CTMG110 is not set
+# CONFIG_TOUCHSCREEN_CYTTSP_CORE is not set
+# CONFIG_TOUCHSCREEN_CYTTSP4_CORE is not set
+# CONFIG_TOUCHSCREEN_DYNAPRO is not set
+# CONFIG_TOUCHSCREEN_HAMPSHIRE is not set
+# CONFIG_TOUCHSCREEN_EETI is not set
+# CONFIG_TOUCHSCREEN_EGALAX is not set
+# CONFIG_TOUCHSCREEN_EGALAX_SERIAL is not set
+# CONFIG_TOUCHSCREEN_FUJITSU is not set
+# CONFIG_TOUCHSCREEN_GOODIX is not set
+# CONFIG_TOUCHSCREEN_ILI210X is not set
+# CONFIG_TOUCHSCREEN_IPROC is not set
+# CONFIG_TOUCHSCREEN_GUNZE is not set
+# CONFIG_TOUCHSCREEN_EKTF2127 is not set
+# CONFIG_TOUCHSCREEN_ELAN is not set
+# CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
+# CONFIG_TOUCHSCREEN_WACOM_I2C is not set
+# CONFIG_TOUCHSCREEN_MAX11801 is not set
+# CONFIG_TOUCHSCREEN_MCS5000 is not set
+# CONFIG_TOUCHSCREEN_MMS114 is not set
+# CONFIG_TOUCHSCREEN_MELFAS_MIP4 is not set
+# CONFIG_TOUCHSCREEN_MTOUCH is not set
+# CONFIG_TOUCHSCREEN_IMX6UL_TSC is not set
+# CONFIG_TOUCHSCREEN_INEXIO is not set
+# CONFIG_TOUCHSCREEN_MK712 is not set
+# CONFIG_TOUCHSCREEN_PENMOUNT is not set
+# CONFIG_TOUCHSCREEN_EDT_FT5X06 is not set
+CONFIG_TOUCHSCREEN_RASPBERRYPI_FW=m
+# CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
+# CONFIG_TOUCHSCREEN_TOUCHWIN is not set
+# CONFIG_TOUCHSCREEN_TI_AM335X_TSC is not set
+# CONFIG_TOUCHSCREEN_PIXCIR is not set
+# CONFIG_TOUCHSCREEN_WDT87XX_I2C is not set
+# CONFIG_TOUCHSCREEN_WM97XX is not set
+# CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
+# CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TSC_SERIO is not set
+# CONFIG_TOUCHSCREEN_TSC2004 is not set
+# CONFIG_TOUCHSCREEN_TSC2005 is not set
+# CONFIG_TOUCHSCREEN_TSC2007 is not set
+# CONFIG_TOUCHSCREEN_RM_TS is not set
+# CONFIG_TOUCHSCREEN_SILEAD is not set
+# CONFIG_TOUCHSCREEN_SIS_I2C is not set
+# CONFIG_TOUCHSCREEN_ST1232 is not set
+# CONFIG_TOUCHSCREEN_SUN4I is not set
+# CONFIG_TOUCHSCREEN_SUR40 is not set
+# CONFIG_TOUCHSCREEN_SURFACE3_SPI is not set
+# CONFIG_TOUCHSCREEN_SX8654 is not set
+# CONFIG_TOUCHSCREEN_TPS6507X is not set
+# CONFIG_TOUCHSCREEN_ZET6223 is not set
+# CONFIG_TOUCHSCREEN_ZFORCE is not set
+# CONFIG_TOUCHSCREEN_ROHM_BU21023 is not set
CONFIG_INPUT_MISC=y
# CONFIG_INPUT_AD714X is not set
CONFIG_INPUT_ATMEL_CAPTOUCH=m
diff --git a/patches.arch/05-arch-mm-allow-arch_dup_mmap-to-fail.patch b/patches.arch/05-arch-mm-allow-arch_dup_mmap-to-fail.patch
index 58b5b428e9..e8f78620a9 100644
--- a/patches.arch/05-arch-mm-allow-arch_dup_mmap-to-fail.patch
+++ b/patches.arch/05-arch-mm-allow-arch_dup_mmap-to-fail.patch
@@ -59,7 +59,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
+ return 0;
}
- static inline void arch_exit_mmap(struct mm_struct *mm)
+ #ifndef CONFIG_PPC_BOOK3S_64
--- a/arch/um/include/asm/mmu_context.h
+++ b/arch/um/include/asm/mmu_context.h
@@ -15,9 +15,10 @@ extern void uml_setup_stubs(struct mm_st
diff --git a/patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch b/patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch
new file mode 100644
index 0000000000..601578b26e
--- /dev/null
+++ b/patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch
@@ -0,0 +1,151 @@
+From 6c5c7489089608d89b7ce310bca44812e2b0a4a5 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Mon, 10 Dec 2018 15:22:22 -0600
+Subject: [PATCH] ibmvnic: Convert reset work item mutex to spin lock
+
+References: FATE#326521
+Patch-mainline: v4.20
+Git-commit: 6c5c7489089608d89b7ce310bca44812e2b0a4a5
+
+ibmvnic_reset can create and schedule a reset work item from
+an IRQ context, so do not use a mutex, which can sleep. Convert
+the reset work item mutex to a spin lock. Locking debugger generated
+the trace output below.
+
+BUG: sleeping function called from invalid context at kernel/locking/mutex.c:908
+in_atomic(): 1, irqs_disabled(): 1, pid: 120, name: kworker/8:1
+4 locks held by kworker/8:1/120:
+ #0: 0000000017c05720 ((wq_completion)"events"){+.+.}, at: process_one_work+0x188/0x710
+ #1: 00000000ace90706 ((linkwatch_work).work){+.+.}, at: process_one_work+0x188/0x710
+ #2: 000000007632871f (rtnl_mutex){+.+.}, at: rtnl_lock+0x30/0x50
+ #3: 00000000fc36813a (&(&crq->lock)->rlock){..-.}, at: ibmvnic_tasklet+0x88/0x2010 [ibmvnic]
+irq event stamp: 26293
+hardirqs last enabled at (26292): [<c000000000122468>] tasklet_action_common.isra.12+0x78/0x1c0
+hardirqs last disabled at (26293): [<c000000000befce8>] _raw_spin_lock_irqsave+0x48/0xf0
+softirqs last enabled at (26288): [<c000000000a8ac78>] dev_deactivate_queue.constprop.28+0xc8/0x160
+softirqs last disabled at (26289): [<c0000000000306e0>] call_do_softirq+0x14/0x24
+CPU: 8 PID: 120 Comm: kworker/8:1 Kdump: loaded Not tainted 4.20.0-rc6 #6
+Workqueue: events linkwatch_event
+Call Trace:
+[c0000003fffa7a50] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable)
+[c0000003fffa7aa0] [c00000000015ba0c] ___might_sleep+0x2dc/0x320
+[c0000003fffa7b20] [c000000000be960c] __mutex_lock+0x8c/0xb40
+[c0000003fffa7c30] [d000000006202ac8] ibmvnic_reset+0x78/0x330 [ibmvnic]
+[c0000003fffa7cc0] [d0000000062097f4] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic]
+[c0000003fffa7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0
+[c0000003fffa7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c
+[c0000003fffa7f90] [c0000000000306e0] call_do_softirq+0x14/0x24
+[c0000003f3f87980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0
+[c0000003f3f879c0] [c0000000001218a8] do_softirq+0xa8/0x100
+[c0000003f3f879f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180
+[c0000003f3f87a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80
+[c0000003f3f87a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160
+[c0000003f3f87ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520
+[c0000003f3f87b70] [c000000000a8cd40] dev_deactivate+0x40/0x60
+[c0000003f3f87ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0
+[c0000003f3f87bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0
+[c0000003f3f87c30] [c000000000a5e728] linkwatch_event+0x48/0x60
+[c0000003f3f87c50] [c0000000001444e8] process_one_work+0x238/0x710
+[c0000003f3f87d20] [c000000000144a48] worker_thread+0x88/0x4e0
+[c0000003f3f87db0] [c00000000014e3a8] kthread+0x178/0x1c0
+[c0000003f3f87e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 16 +++++++++-------
+ drivers/net/ethernet/ibm/ibmvnic.h | 2 +-
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index ed50b8dee44f..ffc0cab05b0f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1939,8 +1939,9 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ {
+ struct ibmvnic_rwi *rwi;
++ unsigned long flags;
+
+- mutex_lock(&adapter->rwi_lock);
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+
+ if (!list_empty(&adapter->rwi_list)) {
+ rwi = list_first_entry(&adapter->rwi_list, struct ibmvnic_rwi,
+@@ -1950,7 +1951,7 @@ static struct ibmvnic_rwi *get_next_rwi(struct ibmvnic_adapter *adapter)
+ rwi = NULL;
+ }
+
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ return rwi;
+ }
+
+@@ -2025,6 +2026,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ struct list_head *entry, *tmp_entry;
+ struct ibmvnic_rwi *rwi, *tmp;
+ struct net_device *netdev = adapter->netdev;
++ unsigned long flags;
+ int ret;
+
+ if (adapter->state == VNIC_REMOVING ||
+@@ -2041,13 +2043,13 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ goto err;
+ }
+
+- mutex_lock(&adapter->rwi_lock);
++ spin_lock_irqsave(&adapter->rwi_lock, flags);
+
+ list_for_each(entry, &adapter->rwi_list) {
+ tmp = list_entry(entry, struct ibmvnic_rwi, list);
+ if (tmp->reset_reason == reason) {
+ netdev_dbg(netdev, "Skipping matching reset\n");
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ret = EBUSY;
+ goto err;
+ }
+@@ -2055,7 +2057,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+
+ rwi = kzalloc(sizeof(*rwi), GFP_KERNEL);
+ if (!rwi) {
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ibmvnic_close(netdev);
+ ret = ENOMEM;
+ goto err;
+@@ -2069,7 +2071,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ rwi->reset_reason = reason;
+ list_add_tail(&rwi->list, &adapter->rwi_list);
+- mutex_unlock(&adapter->rwi_lock);
++ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ adapter->resetting = true;
+ netdev_dbg(adapter->netdev, "Scheduling reset (reason %d)\n", reason);
+ schedule_work(&adapter->ibmvnic_reset);
+@@ -4759,7 +4761,7 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+
+ INIT_WORK(&adapter->ibmvnic_reset, __ibmvnic_reset);
+ INIT_LIST_HEAD(&adapter->rwi_list);
+- mutex_init(&adapter->rwi_lock);
++ spin_lock_init(&adapter->rwi_lock);
+ adapter->resetting = false;
+
+ adapter->mac_change_pending = false;
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index 99c4f8d331ce..f2018dbebfa5 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -1075,7 +1075,7 @@ struct ibmvnic_adapter {
+ struct tasklet_struct tasklet;
+ enum vnic_state state;
+ enum ibmvnic_reset_reason reset_reason;
+- struct mutex rwi_lock;
++ spinlock_t rwi_lock;
+ struct list_head rwi_list;
+ struct work_struct ibmvnic_reset;
+ bool resetting;
+--
+2.19.2
+
diff --git a/patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch b/patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch
new file mode 100644
index 0000000000..0051061ff5
--- /dev/null
+++ b/patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch
@@ -0,0 +1,70 @@
+From 1d1bbc37f89b0559c9e913682f2489d89cfde6b8 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Mon, 10 Dec 2018 15:22:23 -0600
+Subject: [PATCH] ibmvnic: Fix non-atomic memory allocation in IRQ context
+
+References: FATE#326521
+Patch-mainline: v4.20
+Git-commit: 1d1bbc37f89b0559c9e913682f2489d89cfde6b8
+
+ibmvnic_reset allocated new reset work item objects in a non-atomic
+context. This can be called from a tasklet, generating the output below.
+Allocate work items with the GFP_ATOMIC flag instead.
+
+BUG: sleeping function called from invalid context at mm/slab.h:421
+in_atomic(): 1, irqs_disabled(): 1, pid: 93, name: kworker/0:2
+INFO: lockdep is turned off.
+irq event stamp: 66049
+hardirqs last enabled at (66048): [<c000000000122468>] tasklet_action_common.isra.12+0x78/0x1c0
+hardirqs last disabled at (66049): [<c000000000befce8>] _raw_spin_lock_irqsave+0x48/0xf0
+softirqs last enabled at (66044): [<c000000000a8ac78>] dev_deactivate_queue.constprop.28+0xc8/0x160
+softirqs last disabled at (66045): [<c0000000000306e0>] call_do_softirq+0x14/0x24
+CPU: 0 PID: 93 Comm: kworker/0:2 Kdump: loaded Not tainted 4.20.0-rc6-00001-g1b50a8f03706 #7
+Workqueue: events linkwatch_event
+Call Trace:
+[c0000003fffe7ae0] [c000000000bc83e4] dump_stack+0xe8/0x164 (unreliable)
+[c0000003fffe7b30] [c00000000015ba0c] ___might_sleep+0x2dc/0x320
+[c0000003fffe7bb0] [c000000000391514] kmem_cache_alloc_trace+0x3e4/0x440
+[c0000003fffe7c30] [d000000005b2309c] ibmvnic_reset+0x16c/0x360 [ibmvnic]
+[c0000003fffe7cc0] [d000000005b29834] ibmvnic_tasklet+0x1054/0x2010 [ibmvnic]
+[c0000003fffe7e00] [c0000000001224c8] tasklet_action_common.isra.12+0xd8/0x1c0
+[c0000003fffe7e60] [c000000000bf1238] __do_softirq+0x1a8/0x64c
+[c0000003fffe7f90] [c0000000000306e0] call_do_softirq+0x14/0x24
+[c0000003f3967980] [c00000000001ba50] do_softirq_own_stack+0x60/0xb0
+[c0000003f39679c0] [c0000000001218a8] do_softirq+0xa8/0x100
+[c0000003f39679f0] [c000000000121a74] __local_bh_enable_ip+0x174/0x180
+[c0000003f3967a60] [c000000000bf003c] _raw_spin_unlock_bh+0x5c/0x80
+[c0000003f3967a90] [c000000000a8ac78] dev_deactivate_queue.constprop.28+0xc8/0x160
+[c0000003f3967ad0] [c000000000a8c8b0] dev_deactivate_many+0xd0/0x520
+[c0000003f3967b70] [c000000000a8cd40] dev_deactivate+0x40/0x60
+[c0000003f3967ba0] [c000000000a5e0c4] linkwatch_do_dev+0x74/0xd0
+[c0000003f3967bd0] [c000000000a5e694] __linkwatch_run_queue+0x1a4/0x1f0
+[c0000003f3967c30] [c000000000a5e728] linkwatch_event+0x48/0x60
+[c0000003f3967c50] [c0000000001444e8] process_one_work+0x238/0x710
+[c0000003f3967d20] [c000000000144a48] worker_thread+0x88/0x4e0
+[c0000003f3967db0] [c00000000014e3a8] kthread+0x178/0x1c0
+[c0000003f3967e20] [c00000000000bfd0] ret_from_kernel_thread+0x5c/0x6c
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index ffc0cab05b0f..67cc6d9c8fd7 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2055,7 +2055,7 @@ static int ibmvnic_reset(struct ibmvnic_adapter *adapter,
+ }
+ }
+
+- rwi = kzalloc(sizeof(*rwi), GFP_KERNEL);
++ rwi = kzalloc(sizeof(*rwi), GFP_ATOMIC);
+ if (!rwi) {
+ spin_unlock_irqrestore(&adapter->rwi_lock, flags);
+ ibmvnic_close(netdev);
+--
+2.19.2
+
diff --git a/patches.arch/jump_label-split-out-code-under-the-hotplug-lock.patch b/patches.arch/jump_label-split-out-code-under-the-hotplug-lock.patch
new file mode 100644
index 0000000000..a1d084e4d1
--- /dev/null
+++ b/patches.arch/jump_label-split-out-code-under-the-hotplug-lock.patch
@@ -0,0 +1,96 @@
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Tue, 1 Aug 2017 09:02:55 +0100
+Subject: jump_label: Split out code under the hotplug lock
+Git-commit: 8b7b412807053ab5f059ffae426a280e769a5bda
+Patch-mainline: v4.14-rc1
+References: bsc#1106913
+
+In order to later introduce an "already locked" version of some
+of the static key funcions, let's split the code into the core stuff
+(the *_cpuslocked functions) and the usual helpers, which now
+take/release the hotplug lock and call into the _cpuslocked
+versions.
+
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Leo Yan <leo.yan@linaro.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-arm-kernel@lists.infradead.org
+Link: http://lkml.kernel.org/r/20170801080257.5056-3-marc.zyngier@arm.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ kernel/jump_label.c | 24 ++++++++++++++++++------
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -79,7 +79,7 @@ int static_key_count(struct static_key *
+ }
+ EXPORT_SYMBOL_GPL(static_key_count);
+
+-void static_key_slow_inc(struct static_key *key)
++static void static_key_slow_inc_cpuslocked(struct static_key *key)
+ {
+ int v, v1;
+
+@@ -103,7 +103,6 @@ void static_key_slow_inc(struct static_k
+ return;
+ }
+
+- cpus_read_lock();
+ jump_label_lock();
+ if (atomic_read(&key->enabled) == 0) {
+ atomic_set(&key->enabled, -1);
+@@ -113,6 +112,12 @@ void static_key_slow_inc(struct static_k
+ atomic_inc(&key->enabled);
+ }
+ jump_label_unlock();
++}
++
++void static_key_slow_inc(struct static_key *key)
++{
++ cpus_read_lock();
++ static_key_slow_inc_cpuslocked(key);
+ cpus_read_unlock();
+ }
+ EXPORT_SYMBOL_GPL(static_key_slow_inc);
+@@ -154,10 +159,10 @@ void static_key_disable(struct static_ke
+ }
+ EXPORT_SYMBOL_GPL(static_key_disable);
+
+-static void __static_key_slow_dec(struct static_key *key,
+- unsigned long rate_limit, struct delayed_work *work)
++static void static_key_slow_dec_cpuslocked(struct static_key *key,
++ unsigned long rate_limit,
++ struct delayed_work *work)
+ {
+- cpus_read_lock();
+ /*
+ * The negative count check is valid even when a negative
+ * key->enabled is in use by static_key_slow_inc(); a
+@@ -168,7 +173,6 @@ static void __static_key_slow_dec(struct
+ if (!atomic_dec_and_mutex_lock(&key->enabled, &jump_label_mutex)) {
+ WARN(atomic_read(&key->enabled) < 0,
+ "jump label: negative count!\n");
+- cpus_read_unlock();
+ return;
+ }
+
+@@ -179,6 +183,14 @@ static void __static_key_slow_dec(struct
+ jump_label_update(key);
+ }
+ jump_label_unlock();
++}
++
++static void __static_key_slow_dec(struct static_key *key,
++ unsigned long rate_limit,
++ struct delayed_work *work)
++{
++ cpus_read_lock();
++ static_key_slow_dec_cpuslocked(key, rate_limit, work);
+ cpus_read_unlock();
+ }
+
diff --git a/patches.arch/kvm-x86-fix-scan-ioapic-use-before-initialization b/patches.arch/kvm-x86-fix-scan-ioapic-use-before-initialization
new file mode 100644
index 0000000000..c1f4af46a9
--- /dev/null
+++ b/patches.arch/kvm-x86-fix-scan-ioapic-use-before-initialization
@@ -0,0 +1,104 @@
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Tue, 20 Nov 2018 16:34:18 +0800
+Subject: KVM: X86: Fix scan ioapic use-before-initialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: e97f852fd4561e77721bb9a4e0ea9d98305b1e93
+Patch-mainline: v4.20-rc5
+References: CVE-2018-19407 bsc#1116841
+
+Reported by syzkaller:
+
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000001c8
+ PGD 80000003ec4da067 P4D 80000003ec4da067 PUD 3f7bfa067 PMD 0
+ Oops: 0000 [#1] PREEMPT SMP PTI
+ CPU: 7 PID: 5059 Comm: debug Tainted: G OE 4.19.0-rc5 #16
+ RIP: 0010:__lock_acquire+0x1a6/0x1990
+ Call Trace:
+ lock_acquire+0xdb/0x210
+ _raw_spin_lock+0x38/0x70
+ kvm_ioapic_scan_entry+0x3e/0x110 [kvm]
+ vcpu_enter_guest+0x167e/0x1910 [kvm]
+ kvm_arch_vcpu_ioctl_run+0x35c/0x610 [kvm]
+ kvm_vcpu_ioctl+0x3e9/0x6d0 [kvm]
+ do_vfs_ioctl+0xa5/0x690
+ ksys_ioctl+0x6d/0x80
+ __x64_sys_ioctl+0x1a/0x20
+ do_syscall_64+0x83/0x6e0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The reason is that the testcase writes hyperv synic HV_X64_MSR_SINT6 msr
+and triggers scan ioapic logic to load synic vectors into EOI exit bitmap.
+However, irqchip is not initialized by this simple testcase, ioapic/apic
+objects should not be accessed.
+This can be triggered by the following program:
+
+ #define _GNU_SOURCE
+
+ #include <endian.h>
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+ #include <string.h>
+ #include <sys/syscall.h>
+ #include <sys/types.h>
+ #include <unistd.h>
+
+ uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
+
+ int main(void)
+ {
+ syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);
+ long res = 0;
+ memcpy((void*)0x20000040, "/dev/kvm", 9);
+ res = syscall(__NR_openat, 0xffffffffffffff9c, 0x20000040, 0, 0);
+ if (res != -1)
+ r[0] = res;
+ res = syscall(__NR_ioctl, r[0], 0xae01, 0);
+ if (res != -1)
+ r[1] = res;
+ res = syscall(__NR_ioctl, r[1], 0xae41, 0);
+ if (res != -1)
+ r[2] = res;
+ memcpy(
+ (void*)0x20000080,
+ "\x01\x00\x00\x00\x00\x5b\x61\xbb\x96\x00\x00\x40\x00\x00\x00\x00\x01\x00"
+ "\x08\x00\x00\x00\x00\x00\x0b\x77\xd1\x78\x4d\xd8\x3a\xed\xb1\x5c\x2e\x43"
+ "\xaa\x43\x39\xd6\xff\xf5\xf0\xa8\x98\xf2\x3e\x37\x29\x89\xde\x88\xc6\x33"
+ "\xfc\x2a\xdb\xb7\xe1\x4c\xac\x28\x61\x7b\x9c\xa9\xbc\x0d\xa0\x63\xfe\xfe"
+ "\xe8\x75\xde\xdd\x19\x38\xdc\x34\xf5\xec\x05\xfd\xeb\x5d\xed\x2e\xaf\x22"
+ "\xfa\xab\xb7\xe4\x42\x67\xd0\xaf\x06\x1c\x6a\x35\x67\x10\x55\xcb",
+ 106);
+ syscall(__NR_ioctl, r[2], 0x4008ae89, 0x20000080);
+ syscall(__NR_ioctl, r[2], 0xae80, 0);
+ return 0;
+ }
+
+This patch fixes it by bailing out scan ioapic if ioapic is not initialized in
+kernel.
+
+Reported-by: Wei Wu <ww9210@gmail.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Wei Wu <ww9210@gmail.com>
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6925,7 +6925,8 @@ static void vcpu_scan_ioapic(struct kvm_
+ else {
+ if (kvm_x86_ops->sync_pir_to_irr && vcpu->arch.apicv_active)
+ kvm_x86_ops->sync_pir_to_irr(vcpu);
+- kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
++ if (ioapic_in_kernel(vcpu->kvm))
++ kvm_ioapic_scan_entry(vcpu, vcpu->arch.ioapic_handled_vectors);
+ }
+ bitmap_or((ulong *)eoi_exit_bitmap, vcpu->arch.ioapic_handled_vectors,
+ vcpu_to_synic(vcpu)->vec_bitmap, 256);
diff --git a/patches.arch/locking-static_keys-improve-uninitialized-key-warning.patch b/patches.arch/locking-static_keys-improve-uninitialized-key-warning.patch
new file mode 100644
index 0000000000..b71ed265cd
--- /dev/null
+++ b/patches.arch/locking-static_keys-improve-uninitialized-key-warning.patch
@@ -0,0 +1,207 @@
+From: Borislav Petkov <bp@suse.de>
+Date: Wed, 18 Oct 2017 17:24:28 +0200
+Subject: locking/static_keys: Improve uninitialized key warning
+Git-commit: 5cdda5117e125e0dbb020425cc55a4c143c6febc
+Patch-mainline: v4.15-rc1
+References: bsc#1106913
+
+Right now it says:
+
+ static_key_disable_cpuslocked used before call to jump_label_init
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 0 at kernel/jump_label.c:161 static_key_disable_cpuslocked+0x68/0x70
+ Modules linked in:
+ CPU: 0 PID: 0 Comm: swapper Not tainted 4.14.0-rc5+ #1
+ Hardware name: SGI.COM C2112-4GP3/X10DRT-P-Series, BIOS 2.0a 05/09/2016
+ task: ffffffff81c0e480 task.stack: ffffffff81c00000
+ RIP: 0010:static_key_disable_cpuslocked+0x68/0x70
+ RSP: 0000:ffffffff81c03ef0 EFLAGS: 00010096 ORIG_RAX: 0000000000000000
+ RAX: 0000000000000041 RBX: ffffffff81c32680 RCX: ffffffff81c5cbf8
+ RDX: 0000000000000001 RSI: 0000000000000092 RDI: 0000000000000002
+ RBP: ffff88807fffd240 R08: 726f666562206465 R09: 0000000000000136
+ R10: 0000000000000000 R11: 696e695f6c656261 R12: ffffffff82158900
+ R13: ffffffff8215f760 R14: 0000000000000001 R15: 0000000000000008
+ FS: 0000000000000000(0000) GS:ffff883f7f400000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: ffff88807ffff000 CR3: 0000000001c09000 CR4: 00000000000606b0
+ Call Trace:
+ static_key_disable+0x16/0x20
+ start_kernel+0x15a/0x45d
+ ? load_ucode_intel_bsp+0x11/0x2d
+ secondary_startup_64+0xa5/0xb0
+ Code: 48 c7 c7 a0 15 cf 81 e9 47 53 4b 00 48 89 df e8 5f fc ff ff eb e8 48 c7 c6 \
+ c0 97 83 81 48 c7 c7 d0 ff a2 81 31 c0 e8 c5 9d f5 ff <0f> ff eb a7 0f ff eb \
+ b0 e8 eb a2 4b 00 53 48 89 fb e8 42 0e f0
+
+but it doesn't tell me which key it is. So dump the key's name too:
+
+ static_key_disable_cpuslocked(): static key 'virt_spin_lock_key' used before call to jump_label_init()
+
+And that makes pinpointing which key is causing that a lot easier.
+
+ include/linux/jump_label.h | 14 +++++++-------
+ include/linux/jump_label_ratelimit.h | 6 +++---
+ kernel/jump_label.c | 14 +++++++-------
+ 3 files changed, 17 insertions(+), 17 deletions(-)
+
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Cc: Jason Baron <jbaron@akamai.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20171018152428.ffjgak4o25f7ept6@pd.tnic
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+---
+ include/linux/jump_label.h | 14 +++++++-------
+ include/linux/jump_label_ratelimit.h | 6 +++---
+ kernel/jump_label.c | 14 +++++++-------
+ 3 files changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
+index cd5861651b17..979a2f2d529b 100644
+--- a/include/linux/jump_label.h
++++ b/include/linux/jump_label.h
+@@ -81,9 +81,9 @@
+
+ extern bool static_key_initialized;
+
+-#define STATIC_KEY_CHECK_USE() WARN(!static_key_initialized, \
+- "%s used before call to jump_label_init", \
+- __func__)
++#define STATIC_KEY_CHECK_USE(key) WARN(!static_key_initialized, \
++ "%s(): static key '%pS' used before call to jump_label_init()", \
++ __func__, (key))
+
+ #ifdef HAVE_JUMP_LABEL
+
+@@ -211,13 +211,13 @@ static __always_inline bool static_key_true(struct static_key *key)
+
+ static inline void static_key_slow_inc(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ atomic_inc(&key->enabled);
+ }
+
+ static inline void static_key_slow_dec(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ atomic_dec(&key->enabled);
+ }
+
+@@ -236,7 +236,7 @@ static inline int jump_label_apply_nops(struct module *mod)
+
+ static inline void static_key_enable(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+
+ if (atomic_read(&key->enabled) != 0) {
+ WARN_ON_ONCE(atomic_read(&key->enabled) != 1);
+@@ -247,7 +247,7 @@ static inline void static_key_enable(struct static_key *key)
+
+ static inline void static_key_disable(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+
+ if (atomic_read(&key->enabled) != 1) {
+ WARN_ON_ONCE(atomic_read(&key->enabled) != 0);
+diff --git a/include/linux/jump_label_ratelimit.h b/include/linux/jump_label_ratelimit.h
+index 23da3af459fe..93086df0a847 100644
+--- a/include/linux/jump_label_ratelimit.h
++++ b/include/linux/jump_label_ratelimit.h
+@@ -24,18 +24,18 @@ struct static_key_deferred {
+ };
+ static inline void static_key_slow_dec_deferred(struct static_key_deferred *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ static_key_slow_dec(&key->key);
+ }
+ static inline void static_key_deferred_flush(struct static_key_deferred *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ }
+ static inline void
+ jump_label_rate_limit(struct static_key_deferred *key,
+ unsigned long rl)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ }
+ #endif /* HAVE_JUMP_LABEL */
+ #endif /* _LINUX_JUMP_LABEL_RATELIMIT_H */
+diff --git a/kernel/jump_label.c b/kernel/jump_label.c
+index 0bf2e8f5244a..8ff4ca4665ff 100644
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -83,7 +83,7 @@ static void static_key_slow_inc_cpuslocked(struct static_key *key)
+ {
+ int v, v1;
+
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+
+ /*
+ * Careful if we get concurrent static_key_slow_inc() calls;
+@@ -128,7 +128,7 @@ EXPORT_SYMBOL_GPL(static_key_slow_inc);
+
+ void static_key_enable_cpuslocked(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+
+ if (atomic_read(&key->enabled) > 0) {
+ WARN_ON_ONCE(atomic_read(&key->enabled) != 1);
+@@ -158,7 +158,7 @@ EXPORT_SYMBOL_GPL(static_key_enable);
+
+ void static_key_disable_cpuslocked(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+
+ if (atomic_read(&key->enabled) != 1) {
+ WARN_ON_ONCE(atomic_read(&key->enabled) != 0);
+@@ -224,21 +224,21 @@ static void jump_label_update_timeout(struct work_struct *work)
+
+ void static_key_slow_dec(struct static_key *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ __static_key_slow_dec(key, 0, NULL);
+ }
+ EXPORT_SYMBOL_GPL(static_key_slow_dec);
+
+ void static_key_slow_dec_deferred(struct static_key_deferred *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ __static_key_slow_dec(&key->key, key->timeout, &key->work);
+ }
+ EXPORT_SYMBOL_GPL(static_key_slow_dec_deferred);
+
+ void static_key_deferred_flush(struct static_key_deferred *key)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ flush_delayed_work(&key->work);
+ }
+ EXPORT_SYMBOL_GPL(static_key_deferred_flush);
+@@ -246,7 +246,7 @@ EXPORT_SYMBOL_GPL(static_key_deferred_flush);
+ void jump_label_rate_limit(struct static_key_deferred *key,
+ unsigned long rl)
+ {
+- STATIC_KEY_CHECK_USE();
++ STATIC_KEY_CHECK_USE(key);
+ key->timeout = rl;
+ INIT_DELAYED_WORK(&key->work, jump_label_update_timeout);
+ }
+
diff --git a/patches.arch/powerpc-64s-radix-Fix-process-table-entry-cache-inva.patch b/patches.arch/powerpc-64s-radix-Fix-process-table-entry-cache-inva.patch
new file mode 100644
index 0000000000..b95a007a5f
--- /dev/null
+++ b/patches.arch/powerpc-64s-radix-Fix-process-table-entry-cache-inva.patch
@@ -0,0 +1,117 @@
+From 30b49ec798f0984b905fd94d1957d62530f08578 Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 24 Oct 2017 23:06:54 +1000
+Subject: [PATCH] powerpc/64s/radix: Fix process table entry cache invalidation
+
+References: bsc#1055186, fate#323286, git-fixes
+Patch-mainline: v4.15-rc1
+Git-commit: 30b49ec798f0984b905fd94d1957d62530f08578
+
+According to the architecture, the process table entry cache must be
+flushed with tlbie RIC=2.
+
+Currently the process table entry is set to invalid right before the
+PID is returned to the allocator, with no invalidation. This works on
+existing implementations that are known to not cache the process table
+entry for any except the current PIDR.
+
+It is architecturally correct and cleaner to invalidate with RIC=2
+after clearing the process table entry and before the PID is returned
+to the allocator. This can be done in arch_exit_mmap that runs before
+the final flush, and to ensure the final flush (fullmm) is always a
+RIC=2 variant.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/mmu_context.h | 4 ++++
+ arch/powerpc/mm/mmu_context_book3s64.c | 25 ++++++++++++++++++++-----
+ arch/powerpc/mm/tlb-radix.c | 6 +++++-
+ 3 files changed, 29 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index a0d7145d6cd2..20eae6f76247 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -164,9 +164,13 @@ static inline void arch_dup_mmap(struct mm_struct *oldmm,
+ {
+ }
+
++#ifndef CONFIG_PPC_BOOK3S_64
+ static inline void arch_exit_mmap(struct mm_struct *mm)
+ {
+ }
++#else
++extern void arch_exit_mmap(struct mm_struct *mm);
++#endif
+
+ static inline void arch_unmap(struct mm_struct *mm,
+ struct vm_area_struct *vma,
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index 05e15386d4cb..6d724dab27c2 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -216,19 +216,34 @@ void destroy_context(struct mm_struct *mm)
+ #ifdef CONFIG_SPAPR_TCE_IOMMU
+ WARN_ON_ONCE(!list_empty(&mm->context.iommu_group_mem_list));
+ #endif
++ if (radix_enabled())
++ WARN_ON(process_tb[mm->context.id].prtb0 != 0);
++ else
++ subpage_prot_free(mm);
++ destroy_pagetable_page(mm);
++ __destroy_context(mm->context.id);
++ mm->context.id = MMU_NO_CONTEXT;
++}
++
++void arch_exit_mmap(struct mm_struct *mm)
++{
+ if (radix_enabled()) {
+ /*
+ * Radix doesn't have a valid bit in the process table
+ * entries. However we know that at least P9 implementation
+ * will avoid caching an entry with an invalid RTS field,
+ * and 0 is invalid. So this will do.
++ *
++ * This runs before the "fullmm" tlb flush in exit_mmap,
++ * which does a RIC=2 tlbie to clear the process table
++ * entry. See the "fullmm" comments in tlb-radix.c.
++ *
++ * No barrier required here after the store because
++ * this process will do the invalidate, which starts with
++ * ptesync.
+ */
+ process_tb[mm->context.id].prtb0 = 0;
+- } else
+- subpage_prot_free(mm);
+- destroy_pagetable_page(mm);
+- __destroy_context(mm->context.id);
+- mm->context.id = MMU_NO_CONTEXT;
++ }
+ }
+
+ #ifdef CONFIG_PPC_RADIX_MMU
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 67191fe63283..63e277b6e60c 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -298,10 +298,14 @@ void radix__tlb_flush(struct mmu_gather *tlb)
+ psize = radix_get_mmu_psize(page_size);
+ /*
+ * if page size is not something we understand, do a full mm flush
++ *
++ * A "fullmm" flush must always do a flush_all_mm (RIC=2) flush
++ * that flushes the process table entry cache upon process teardown.
++ * See the comment for radix in arch_exit_mmap().
+ */
+ if (psize != -1 && !tlb->fullmm && !tlb->need_flush_all)
+ radix__flush_tlb_range_psize(mm, tlb->start, tlb->end, psize);
+- else if (tlb->need_flush_all) {
++ else if (tlb->fullmm || tlb->need_flush_all) {
+ tlb->need_flush_all = 0;
+ radix__flush_all_mm(mm);
+ } else
+--
+2.19.2
+
diff --git a/patches.arch/powerpc-pkeys-Fix-handling-of-pkey-state-across-fork.patch b/patches.arch/powerpc-pkeys-Fix-handling-of-pkey-state-across-fork.patch
new file mode 100644
index 0000000000..fe8f641c5a
--- /dev/null
+++ b/patches.arch/powerpc-pkeys-Fix-handling-of-pkey-state-across-fork.patch
@@ -0,0 +1,98 @@
+From d0e24d8a860ebeea797a4eb8b6db410d209fd4fc Mon Sep 17 00:00:00 2001
+From: Ram Pai <linuxram@us.ibm.com>
+Date: Thu, 20 Dec 2018 12:03:30 -0800
+Subject: [PATCH] powerpc/pkeys: Fix handling of pkey state across fork()
+
+References: FATE#322447, bsc#1078248, git-fixes
+Patch-mainline: v5.0-rc1
+Git-commit: 2cd4bd192ee94848695c1c052d87913260e10f36
+
+Protection key tracking information is not copied over to the
+mm_struct of the child during fork(). This can cause the child to
+erroneously allocate keys that were already allocated. Any allocated
+execute-only key is lost aswell.
+
+Add code; called by dup_mmap(), to copy the pkey state from parent to
+child explicitly.
+
+This problem was originally found by Dave Hansen on x86, which turns
+out to be a problem on powerpc aswell.
+
+Fixes: cf43d3b26452 ("powerpc: Enable pkey subsystem")
+Cc: stable@vger.kernel.org # v4.16+
+Reviewed-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
+Signed-off-by: Ram Pai <linuxram@us.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/mmu_context.h | 15 +++++++++------
+ arch/powerpc/mm/pkeys.c | 10 ++++++++++
+ 2 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index 3bd2c2fd3b6f..01ef7ee12aeb 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -174,12 +174,6 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
+ #endif
+ }
+
+-static inline int arch_dup_mmap(struct mm_struct *oldmm,
+- struct mm_struct *mm)
+-{
+- return 0;
+-}
+-
+ #ifndef CONFIG_PPC_BOOK3S_64
+ static inline void arch_exit_mmap(struct mm_struct *mm)
+ {
+@@ -204,6 +198,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
+ #ifdef CONFIG_PPC_MEM_KEYS
+ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
+ bool execute, bool foreign);
++void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);
+ #else /* CONFIG_PPC_MEM_KEYS */
+ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ bool write, bool execute, bool foreign)
+@@ -216,6 +211,7 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,
+ #define thread_pkey_regs_save(thread)
+ #define thread_pkey_regs_restore(new_thread, old_thread)
+ #define thread_pkey_regs_init(thread)
++#define arch_dup_pkeys(oldmm, mm)
+
+ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
+ {
+@@ -224,5 +220,12 @@ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)
+
+ #endif /* CONFIG_PPC_MEM_KEYS */
+
++static inline int arch_dup_mmap(struct mm_struct *oldmm,
++ struct mm_struct *mm)
++{
++ arch_dup_pkeys(oldmm, mm);
++ return 0;
++}
++
+ #endif /* __KERNEL__ */
+ #endif /* __ASM_POWERPC_MMU_CONTEXT_H */
+diff --git a/arch/powerpc/mm/pkeys.c b/arch/powerpc/mm/pkeys.c
+index b271b283c785..25a8dd9cd71d 100644
+--- a/arch/powerpc/mm/pkeys.c
++++ b/arch/powerpc/mm/pkeys.c
+@@ -414,3 +414,13 @@ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,
+
+ return pkey_access_permitted(vma_pkey(vma), write, execute);
+ }
++
++void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm)
++{
++ if (static_branch_likely(&pkey_disabled))
++ return;
++
++ /* Duplicate the oldmm pkey state in mm: */
++ mm_pkey_allocation_map(mm) = mm_pkey_allocation_map(oldmm);
++ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
++}
+--
+2.19.2
+
diff --git a/patches.arch/powerpc-powernv-Fix-save-restore-of-SPRG3-on-entry-e.patch b/patches.arch/powerpc-powernv-Fix-save-restore-of-SPRG3-on-entry-e.patch
new file mode 100644
index 0000000000..e073d20b78
--- /dev/null
+++ b/patches.arch/powerpc-powernv-Fix-save-restore-of-SPRG3-on-entry-e.patch
@@ -0,0 +1,53 @@
+From b03897cf318dfc47de33a7ecbc7655584266f034 Mon Sep 17 00:00:00 2001
+From: "Gautham R. Shenoy" <ego@linux.vnet.ibm.com>
+Date: Wed, 18 Jul 2018 14:03:16 +0530
+Subject: [PATCH] powerpc/powernv: Fix save/restore of SPRG3 on entry/exit from
+ stop (idle)
+
+References: bsc#1055121
+Patch-mainline: v4.18-rc6
+Git-commit: b03897cf318dfc47de33a7ecbc7655584266f034
+
+On 64-bit servers, SPRN_SPRG3 and its userspace read-only mirror
+SPRN_USPRG3 are used as userspace VDSO write and read registers
+respectively.
+
+SPRN_SPRG3 is lost when we enter stop4 and above, and is currently not
+restored. As a result, any read from SPRN_USPRG3 returns zero on an
+exit from stop4 (Power9 only) and above.
+
+Thus in this situation, on POWER9, any call from sched_getcpu() always
+returns zero, as on powerpc, we call __kernel_getcpu() which relies
+upon SPRN_USPRG3 to report the CPU and NUMA node information.
+
+Fix this by restoring SPRN_SPRG3 on wake up from a deep stop state
+with the sprg_vdso value that is cached in PACA.
+
+Fixes: e1c1cfed5432 ("powerpc/powernv: Save/Restore additional SPRs for stop4 cpuidle")
+Cc: stable@vger.kernel.org # v4.14+
+Reported-by: Florian Weimer <fweimer@redhat.com>
+Signed-off-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Reviewed-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/kernel/idle_book3s.S | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S
+index e734f6e45abc..689306118b48 100644
+--- a/arch/powerpc/kernel/idle_book3s.S
++++ b/arch/powerpc/kernel/idle_book3s.S
+@@ -144,7 +144,9 @@ power9_restore_additional_sprs:
+ mtspr SPRN_MMCR1, r4
+
+ ld r3, STOP_MMCR2(r13)
++ ld r4, PACA_SPRG_VDSO(r13)
+ mtspr SPRN_MMCR2, r3
++ mtspr SPRN_SPRG3, r4
+ blr
+
+ /*
+--
+2.19.2
+
diff --git a/patches.arch/ptrace-remove-unused-ptrace_may_access_sched-and-mode_ibrs.patch b/patches.arch/ptrace-remove-unused-ptrace_may_access_sched-and-mode_ibrs.patch
new file mode 100644
index 0000000000..6ee8988b3e
--- /dev/null
+++ b/patches.arch/ptrace-remove-unused-ptrace_may_access_sched-and-mode_ibrs.patch
@@ -0,0 +1,113 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:50 +0100
+Subject: ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS
+Git-commit: 46f7ecb1e7359f183f5bbd1e08b90e10e52164f9
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The IBPB control code in x86 removed the usage. Remove the functionality
+which was introduced for this.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.559149393@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ include/linux/ptrace.h | 17 -----------------
+ kernel/ptrace.c | 10 ----------
+ 2 files changed, 27 deletions(-)
+
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index 6c2ffed907f5..de20ede2c5c8 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -64,15 +64,12 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
+ #define PTRACE_MODE_NOAUDIT 0x04
+ #define PTRACE_MODE_FSCREDS 0x08
+ #define PTRACE_MODE_REALCREDS 0x10
+-#define PTRACE_MODE_SCHED 0x20
+-#define PTRACE_MODE_IBPB 0x40
+
+ /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
+ #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
+ #define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS)
+ #define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS)
+ #define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS)
+-#define PTRACE_MODE_SPEC_IBPB (PTRACE_MODE_ATTACH_REALCREDS | PTRACE_MODE_IBPB)
+
+ /**
+ * ptrace_may_access - check whether the caller is permitted to access
+@@ -90,20 +87,6 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
+ */
+ extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
+
+-/**
+- * ptrace_may_access - check whether the caller is permitted to access
+- * a target task.
+- * @task: target task
+- * @mode: selects type of access and caller credentials
+- *
+- * Returns true on success, false on denial.
+- *
+- * Similar to ptrace_may_access(). Only to be called from context switch
+- * code. Does not call into audit and the regular LSM hooks due to locking
+- * constraints.
+- */
+-extern bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode);
+-
+ static inline int ptrace_reparented(struct task_struct *child)
+ {
+ return !same_thread_group(child->real_parent, child->parent);
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 80b34dffdfb9..c2cee9db5204 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -261,9 +261,6 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
+
+ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
+ {
+- if (mode & PTRACE_MODE_SCHED)
+- return false;
+-
+ if (mode & PTRACE_MODE_NOAUDIT)
+ return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
+ else
+@@ -331,16 +328,9 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ !ptrace_has_cap(mm->user_ns, mode)))
+ return -EPERM;
+
+- if (mode & PTRACE_MODE_SCHED)
+- return 0;
+ return security_ptrace_access_check(task, mode);
+ }
+
+-bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode)
+-{
+- return __ptrace_may_access(task, mode | PTRACE_MODE_SCHED);
+-}
+-
+ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
+ {
+ int err;
+
diff --git a/patches.arch/s390-dasd-simplify-locking-in-dasd_times_out.patch b/patches.arch/s390-dasd-simplify-locking-in-dasd_times_out.patch
new file mode 100644
index 0000000000..963b9e77b6
--- /dev/null
+++ b/patches.arch/s390-dasd-simplify-locking-in-dasd_times_out.patch
@@ -0,0 +1,101 @@
+From: Sebastian Ott <sebott@linux.ibm.com>
+Date: Wed, 16 May 2018 11:25:21 +0200
+Subject: [PATCH] s390/dasd: simplify locking in dasd_times_out
+Git-commit: 1bcdb5354aee2c0abcd13d912be35ae39a4144b6
+Patch-mainline: v4.18-rc1
+References: bsc#1104967,FATE#325924
+
+Provide __dasd_cancel_req that is called with the ccw device lock
+held to simplify the locking in dasd_times_out. Also this removes
+the following sparse warning:
+context imbalance in 'dasd_times_out' - different lock contexts for basic block
+
+Note: with this change dasd_schedule_device_bh is now called (via
+dasd_cancel_req) with the ccw device lock held. But is is already
+the case for other codepaths.
+
+Signed-off-by: Sebastian Ott <sebott@linux.ibm.com>
+Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/s390/block/dasd.c | 30 +++++++++++++++++-------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -2553,14 +2553,11 @@ EXPORT_SYMBOL(dasd_sleep_on_immediatly);
+ * Cancellation of a request is an asynchronous operation! The calling
+ * function has to wait until the request is properly returned via callback.
+ */
+-int dasd_cancel_req(struct dasd_ccw_req *cqr)
++static int __dasd_cancel_req(struct dasd_ccw_req *cqr)
+ {
+ struct dasd_device *device = cqr->startdev;
+- unsigned long flags;
+- int rc;
++ int rc = 0;
+
+- rc = 0;
+- spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
+ switch (cqr->status) {
+ case DASD_CQR_QUEUED:
+ /* request was not started - just set to cleared */
+@@ -2580,10 +2577,21 @@ int dasd_cancel_req(struct dasd_ccw_req
+ default: /* already finished or clear pending - do nothing */
+ break;
+ }
+- spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
+ dasd_schedule_device_bh(device);
+ return rc;
+ }
++
++int dasd_cancel_req(struct dasd_ccw_req *cqr)
++{
++ struct dasd_device *device = cqr->startdev;
++ unsigned long flags;
++ int rc;
++
++ spin_lock_irqsave(get_ccwdev_lock(device->cdev), flags);
++ rc = __dasd_cancel_req(cqr);
++ spin_unlock_irqrestore(get_ccwdev_lock(device->cdev), flags);
++ return rc;
++}
+ EXPORT_SYMBOL(dasd_cancel_req);
+
+ /*
+@@ -3082,12 +3090,10 @@ enum blk_eh_timer_return dasd_times_out(
+ cqr->retries = -1;
+ cqr->intrc = -ETIMEDOUT;
+ if (cqr->status >= DASD_CQR_QUEUED) {
+- spin_unlock(get_ccwdev_lock(device->cdev));
+- rc = dasd_cancel_req(cqr);
++ rc = __dasd_cancel_req(cqr);
+ } else if (cqr->status == DASD_CQR_FILLED ||
+ cqr->status == DASD_CQR_NEED_ERP) {
+ cqr->status = DASD_CQR_TERMINATED;
+- spin_unlock(get_ccwdev_lock(device->cdev));
+ } else if (cqr->status == DASD_CQR_IN_ERP) {
+ struct dasd_ccw_req *searchcqr, *nextcqr, *tmpcqr;
+
+@@ -3102,9 +3108,7 @@ enum blk_eh_timer_return dasd_times_out(
+ searchcqr->retries = -1;
+ searchcqr->intrc = -ETIMEDOUT;
+ if (searchcqr->status >= DASD_CQR_QUEUED) {
+- spin_unlock(get_ccwdev_lock(device->cdev));
+- rc = dasd_cancel_req(searchcqr);
+- spin_lock(get_ccwdev_lock(device->cdev));
++ rc = __dasd_cancel_req(searchcqr);
+ } else if ((searchcqr->status == DASD_CQR_FILLED) ||
+ (searchcqr->status == DASD_CQR_NEED_ERP)) {
+ searchcqr->status = DASD_CQR_TERMINATED;
+@@ -3118,8 +3122,8 @@ enum blk_eh_timer_return dasd_times_out(
+ }
+ break;
+ }
+- spin_unlock(get_ccwdev_lock(device->cdev));
+ }
++ spin_unlock(get_ccwdev_lock(device->cdev));
+ dasd_schedule_block_bh(block);
+ spin_unlock(&block->queue_lock);
+
diff --git a/patches.arch/s390-scsi-zfcp-fix-posting-too-many-status-read-buffers.patch b/patches.arch/s390-scsi-zfcp-fix-posting-too-many-status-read-buffers.patch
new file mode 100644
index 0000000000..2ebd17950b
--- /dev/null
+++ b/patches.arch/s390-scsi-zfcp-fix-posting-too-many-status-read-buffers.patch
@@ -0,0 +1,93 @@
+From: Steffen Maier <maier@linux.ibm.com>
+Date: Thu, 6 Dec 2018 17:31:20 +0100
+Subject: scsi: zfcp: fix posting too many status read buffers leading to
+ adapter shutdown
+Git-commit: 60a161b7e5b2a252ff0d4c622266a7d8da1120ce
+Patch-mainline: v4.20 or v4.20-rc7 (next release)
+References: bsc#1121483, LTC#174588
+
+Suppose adapter (open) recovery is between opened QDIO queues and before
+(the end of) initial posting of status read buffers (SRBs). This time
+window can be seconds long due to FSF_PROT_HOST_CONNECTION_INITIALIZING
+causing by design looping with exponential increase sleeps in the function
+performing exchange config data during recovery
+[zfcp_erp_adapter_strat_fsf_xconf()]. Recovery triggered by local link up.
+
+Suppose an event occurs for which the FCP channel would send an unsolicited
+notification to zfcp by means of a previously posted SRB. We saw it with
+local cable pull (link down) in multi-initiator zoning with multiple
+NPIV-enabled subchannels of the same shared FCP channel.
+
+As soon as zfcp_erp_adapter_strategy_open_fsf() starts posting the initial
+status read buffers from within the adapter's ERP thread, the channel does
+send an unsolicited notification.
+
+Since v2.6.27 commit d26ab06ede83 ("[SCSI] zfcp: receiving an unsolicted
+status can lead to I/O stall"), zfcp_fsf_status_read_handler() schedules
+adapter->stat_work to re-fill the just consumed SRB from a work item.
+
+Now the ERP thread and the work item post SRBs in parallel. Both contexts
+call the helper function zfcp_status_read_refill(). The tracking of
+missing (to be posted / re-filled) SRBs is not thread-safe due to separate
+atomic_read() and atomic_dec(), in order to depend on posting
+success. Hence, both contexts can see
+atomic_read(&adapter->stat_miss) == 1. One of the two contexts posts
+one too many SRB. Zfcp gets QDIO_ERROR_SLSB_STATE on the output queue
+(trace tag "qdireq1") leading to zfcp_erp_adapter_shutdown() in
+zfcp_qdio_handler_error().
+
+An obvious and seemingly clean fix would be to schedule stat_work from the
+ERP thread and wait for it to finish. This would serialize all SRB
+re-fills. However, we already have another work item wait on the ERP
+thread: adapter->scan_work runs zfcp_fc_scan_ports() which calls
+zfcp_fc_eval_gpn_ft(). The latter calls zfcp_erp_wait() to wait for all the
+open port recoveries during zfcp auto port scan, but in fact it waits for
+any pending recovery including an adapter recovery. This approach leads to
+a deadlock. [see also v3.19 commit 18f87a67e6d6 ("zfcp: auto port scan
+resiliency"); v2.6.37 commit d3e1088d6873
+("[SCSI] zfcp: No ERP escalation on gpn_ft eval");
+v2.6.28 commit fca55b6fb587
+("[SCSI] zfcp: fix deadlock between wq triggered port scan and ERP")
+fixing v2.6.27 commit c57a39a45a76
+("[SCSI] zfcp: wait until adapter is finished with ERP during auto-port");
+v2.6.27 commit cc8c282963bd
+("[SCSI] zfcp: Automatically attach remote ports")]
+
+Instead make the accounting of missing SRBs atomic for parallel execution
+in both the ERP thread and adapter->stat_work.
+
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Fixes: d26ab06ede83 ("[SCSI] zfcp: receiving an unsolicted status can lead to I/O stall")
+Cc: <stable@vger.kernel.org> #2.6.27+
+Reviewed-by: Jens Remus <jremus@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/scsi/zfcp_aux.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
+index df10f4e07a4a..882789fff574 100644
+--- a/drivers/s390/scsi/zfcp_aux.c
++++ b/drivers/s390/scsi/zfcp_aux.c
+@@ -271,16 +271,16 @@ static void zfcp_free_low_mem_buffers(struct zfcp_adapter *adapter)
+ */
+ int zfcp_status_read_refill(struct zfcp_adapter *adapter)
+ {
+- while (atomic_read(&adapter->stat_miss) > 0)
++ while (atomic_add_unless(&adapter->stat_miss, -1, 0))
+ if (zfcp_fsf_status_read(adapter->qdio)) {
++ atomic_inc(&adapter->stat_miss); /* undo add -1 */
+ if (atomic_read(&adapter->stat_miss) >=
+ adapter->stat_read_buf_num) {
+ zfcp_erp_adapter_reopen(adapter, 0, "axsref1");
+ return 1;
+ }
+ break;
+- } else
+- atomic_dec(&adapter->stat_miss);
++ }
+ return 0;
+ }
+
+
diff --git a/patches.arch/s390-sles15-17-01-01-s390-kdump-Fix-elfcorehdr-size-calculation.patch b/patches.arch/s390-sles15-17-01-01-s390-kdump-Fix-elfcorehdr-size-calculation.patch
new file mode 100644
index 0000000000..8bd69bfd7f
--- /dev/null
+++ b/patches.arch/s390-sles15-17-01-01-s390-kdump-Fix-elfcorehdr-size-calculation.patch
@@ -0,0 +1,199 @@
+From: Philipp Rudo <prudo@linux.ibm.com>
+Subject: s390/kdump: Fix elfcorehdr size calculation
+Patch-mainline: v4.19-rc1
+Git-commit: 8cce437fbb5c1f2af2f63834fa05082596beca5d
+References: bsc#1117953, LTC#171112
+
+Description: s390/kdump: Fix elfcorehdr size calculation
+Symptom: BUG_ON triggeres kernel panic in crash kernel.
+Problem: When the crash kernel allocates memory for the elfcorehdr, the
+ assumed per-cpu memory is too small. The mis-calculation is
+ usually countered by enough spare memory in the overhead
+ (Elf_Ehdr, vmcoreinfo, etc.). However, with a growing overhead
+ and/or huge cpu count the calculated size gets too small
+ triggering the BUG_ON.
+Solution: Properly calculate the required size.
+Reproduction: -
+
+Upstream-Description:
+
+ s390/kdump: Fix elfcorehdr size calculation
+
+ Before the memory for the elfcorehdr is allocated the required size is
+ estimated with
+
+ alloc_size = 0x1000 + get_cpu_cnt() * 0x4a0 +
+ mem_chunk_cnt * sizeof(Elf64_Phdr);
+
+ Where 0x4a0 is used as size for the ELF notes to store the register
+ contend. This size is 8 bytes too small. Usually this does not immediately
+ cause a problem because the page reserved for overhead (Elf_Ehdr,
+ vmcoreinfo, etc.) is pretty generous. So usually there is enough spare
+ memory to counter the mis-calculated per cpu size. However, with growing
+ overhead and/or a huge cpu count the allocated size gets too small for the
+ elfcorehdr. Ultimately a BUG_ON is triggered causing the crash kernel to
+ panic.
+
+ Fix this by properly calculating the required size instead of relying on
+ magic numbers.
+
+ Fixes: a62bc07392539 ("s390/kdump: add support for vector extension")
+ Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
+ Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+
+Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/crash_dump.c | 104 +++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 98 insertions(+), 6 deletions(-)
+
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -305,6 +305,15 @@ static void *kzalloc_panic(int len)
+ return rc;
+ }
+
++static const char *nt_name(Elf64_Word type)
++{
++ const char *name = "LINUX";
++
++ if (type == NT_PRPSINFO || type == NT_PRSTATUS || type == NT_PRFPREG)
++ name = KEXEC_CORE_NOTE_NAME;
++ return name;
++}
++
+ /*
+ * Initialize ELF note
+ */
+@@ -331,11 +340,26 @@ static void *nt_init_name(void *buf, Elf
+
+ static inline void *nt_init(void *buf, Elf64_Word type, void *desc, int d_len)
+ {
+- const char *note_name = "LINUX";
++ return nt_init_name(buf, type, desc, d_len, nt_name(type));
++}
+
+- if (type == NT_PRPSINFO || type == NT_PRSTATUS || type == NT_PRFPREG)
+- note_name = KEXEC_CORE_NOTE_NAME;
+- return nt_init_name(buf, type, desc, d_len, note_name);
++/*
++ * Calculate the size of ELF note
++ */
++static size_t nt_size_name(int d_len, const char *name)
++{
++ size_t size;
++
++ size = sizeof(Elf64_Nhdr);
++ size += roundup(strlen(name) + 1, 4);
++ size += roundup(d_len, 4);
++
++ return size;
++}
++
++static inline size_t nt_size(Elf64_Word type, int d_len)
++{
++ return nt_size_name(d_len, nt_name(type));
+ }
+
+ /*
+@@ -374,6 +398,29 @@ static void *fill_cpu_elf_notes(void *pt
+ }
+
+ /*
++ * Calculate size of ELF notes per cpu
++ */
++static size_t get_cpu_elf_notes_size(void)
++{
++ struct save_area *sa = NULL;
++ size_t size;
++
++ size = nt_size(NT_PRSTATUS, sizeof(struct elf_prstatus));
++ size += nt_size(NT_PRFPREG, sizeof(elf_fpregset_t));
++ size += nt_size(NT_S390_TIMER, sizeof(sa->timer));
++ size += nt_size(NT_S390_TODCMP, sizeof(sa->todcmp));
++ size += nt_size(NT_S390_TODPREG, sizeof(sa->todpreg));
++ size += nt_size(NT_S390_CTRS, sizeof(sa->ctrs));
++ size += nt_size(NT_S390_PREFIX, sizeof(sa->prefix));
++ if (MACHINE_HAS_VX) {
++ size += nt_size(NT_S390_VXRS_HIGH, sizeof(sa->vxrs_high));
++ size += nt_size(NT_S390_VXRS_LOW, sizeof(sa->vxrs_low));
++ }
++
++ return size;
++}
++
++/*
+ * Initialize prpsinfo note (new kernel)
+ */
+ static void *nt_prpsinfo(void *ptr)
+@@ -428,6 +475,30 @@ static void *nt_vmcoreinfo(void *ptr)
+ return nt_init_name(ptr, 0, vmcoreinfo, size, "VMCOREINFO");
+ }
+
++static size_t nt_vmcoreinfo_size(void)
++{
++ const char *name = "VMCOREINFO";
++ char nt_name[11];
++ Elf64_Nhdr note;
++ void *addr;
++
++ if (copy_oldmem_kernel(&addr, &S390_lowcore.vmcore_info, sizeof(addr)))
++ return 0;
++
++ if (copy_oldmem_kernel(&note, addr, sizeof(note)))
++ return 0;
++
++ memset(nt_name, 0, sizeof(nt_name));
++ if (copy_oldmem_kernel(nt_name, addr + sizeof(note),
++ sizeof(nt_name) - 1))
++ return 0;
++
++ if (strcmp(nt_name, name) != 0)
++ return 0;
++
++ return nt_size_name(note.n_descsz, name);
++}
++
+ /*
+ * Initialize final note (needed for /proc/vmcore code)
+ */
+@@ -538,6 +609,27 @@ static void *notes_init(Elf64_Phdr *phdr
+ return ptr;
+ }
+
++static size_t get_elfcorehdr_size(int mem_chunk_cnt)
++{
++ size_t size;
++
++ size = sizeof(Elf64_Ehdr);
++ /* PT_NOTES */
++ size += sizeof(Elf64_Phdr);
++ /* nt_prpsinfo */
++ size += nt_size(NT_PRPSINFO, sizeof(struct elf_prpsinfo));
++ /* regsets */
++ size += get_cpu_cnt() * get_cpu_elf_notes_size();
++ /* nt_vmcoreinfo */
++ size += nt_vmcoreinfo_size();
++ /* nt_final */
++ size += sizeof(Elf64_Nhdr);
++ /* PT_LOADS */
++ size += mem_chunk_cnt * sizeof(Elf64_Phdr);
++
++ return size;
++}
++
+ /*
+ * Create ELF core header (new kernel)
+ */
+@@ -565,8 +657,8 @@ int elfcorehdr_alloc(unsigned long long
+
+ mem_chunk_cnt = get_mem_chunk_cnt();
+
+- alloc_size = 0x1000 + get_cpu_cnt() * 0x4a0 +
+- mem_chunk_cnt * sizeof(Elf64_Phdr);
++ alloc_size = get_elfcorehdr_size(mem_chunk_cnt);
++
+ hdr = kzalloc_panic(alloc_size);
+ /* Init elf header */
+ ptr = ehdr_init(hdr, mem_chunk_cnt);
diff --git a/patches.arch/s390-sles15-17-01-02-s390-kdump-Make-elfcorehdr-size-calculation-ABI-comp.patch b/patches.arch/s390-sles15-17-01-02-s390-kdump-Make-elfcorehdr-size-calculation-ABI-comp.patch
new file mode 100644
index 0000000000..371cb1290f
--- /dev/null
+++ b/patches.arch/s390-sles15-17-01-02-s390-kdump-Make-elfcorehdr-size-calculation-ABI-comp.patch
@@ -0,0 +1,79 @@
+From: Philipp Rudo <prudo@linux.ibm.com>
+Subject: s390/kdump: Make elfcorehdr size calculation ABI compliant
+Patch-mainline: v4.19-rc1
+Git-commit: 263b0e480c9b0fda77a89f5d6375d8a39de5c166
+References: bsc#1117953, LTC#171112
+
+Description: s390/kdump: Fix elfcorehdr size calculation
+Symptom: BUG_ON triggeres kernel panic in crash kernel.
+Problem: When the crash kernel allocates memory for the elfcorehdr, the
+ assumed per-cpu memory is too small. The mis-calculation is
+ usually countered by enough spare memory in the overhead
+ (Elf_Ehdr, vmcoreinfo, etc.). However, with a growing overhead
+ and/or huge cpu count the calculated size gets too small
+ triggering the BUG_ON.
+Solution: Properly calculate the required size.
+Reproduction: -
+
+Upstream-Description:
+
+ s390/kdump: Make elfcorehdr size calculation ABI compliant
+
+ There are two ways to pass the vmcoreinfo to the crash kernel 1) via the
+ os_info mechanism and 2) via the lowcore->vmcore_info field. In the Linux
+ kernel only the second way is used. However, the first way is ABI for
+ stand-alone kdump. So other OSes use it to pass additional debug info. Make
+ the elfcorehdr size calculation aware of both possible ways.
+
+ Fixes: 8cce437fbb5c ("s390/kdump: Fix elfcorehdr size calculation")
+ Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
+ Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+ Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+
+
+Signed-off-by: Philipp Rudo <prudo@linux.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/crash_dump.c | 28 +++++++++++-----------------
+ 1 file changed, 11 insertions(+), 17 deletions(-)
+
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -477,26 +477,20 @@ static void *nt_vmcoreinfo(void *ptr)
+
+ static size_t nt_vmcoreinfo_size(void)
+ {
+- const char *name = "VMCOREINFO";
+- char nt_name[11];
+- Elf64_Nhdr note;
+- void *addr;
++ const char *name = VMCOREINFO_NOTE_NAME;
++ unsigned long size;
++ void *vmcoreinfo;
++
++ vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size);
++ if (vmcoreinfo)
++ return nt_size_name(size, name);
+
+- if (copy_oldmem_kernel(&addr, &S390_lowcore.vmcore_info, sizeof(addr)))
++ vmcoreinfo = get_vmcoreinfo_old(&size);
++ if (!vmcoreinfo)
+ return 0;
+
+- if (copy_oldmem_kernel(&note, addr, sizeof(note)))
+- return 0;
+-
+- memset(nt_name, 0, sizeof(nt_name));
+- if (copy_oldmem_kernel(nt_name, addr + sizeof(note),
+- sizeof(nt_name) - 1))
+- return 0;
+-
+- if (strcmp(nt_name, name) != 0)
+- return 0;
+-
+- return nt_size_name(note.n_descsz, name);
++ kfree(vmcoreinfo);
++ return nt_size_name(size, name);
+ }
+
+ /*
diff --git a/patches.arch/s390-sles15-17-02-01-s390-qeth-remove-outdated-portname-debug-msg.patch b/patches.arch/s390-sles15-17-02-01-s390-qeth-remove-outdated-portname-debug-msg.patch
new file mode 100644
index 0000000000..fd377b8737
--- /dev/null
+++ b/patches.arch/s390-sles15-17-02-01-s390-qeth-remove-outdated-portname-debug-msg.patch
@@ -0,0 +1,48 @@
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Subject: s390/qeth: remove outdated portname debug msg
+Patch-mainline: v4.17-rc1
+Git-commit: d857e11193a24d6623bb562e9b26cde582bd877f
+References: bsc#1117953, LTC#172960
+
+Description: qeth: sanitize strings in debug messages
+Symptom: Use-after free when reading from s390 debug files.
+Problem: Pointers in sprintf-formatted s390dbf debug files are
+ dereferenced whenever the trace file is read from.
+ If the referenced data has a shorter life-time than the trace
+ file, any read operation can result in a use-after-free.
+Solution: Sanitize the debug entries, remove all usage of indirect data.
+Reproduction: Workload that creates and removes many qeth-based network
+ interfaces, while reading from s390 debug files.
+
+Upstream-Description:
+
+ s390/qeth: remove outdated portname debug msg
+
+ The 'portname' attribute is deprecated and setting it has no effect.
+
+ Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
+ Signed-off-by: David S. Miller <davem@davemloft.net>
+
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/net/qeth_core_main.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -719,11 +719,8 @@ static int qeth_check_idx_response(struc
+
+ QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN);
+ if ((buffer[2] & 0xc0) == 0xc0) {
+- QETH_DBF_MESSAGE(2, "received an IDX TERMINATE "
+- "with cause code 0x%02x%s\n",
+- buffer[4],
+- ((buffer[4] == 0x22) ?
+- " -- try another portname" : ""));
++ QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#02x\n",
++ buffer[4]);
+ QETH_CARD_TEXT(card, 2, "ckidxres");
+ QETH_CARD_TEXT(card, 2, " idxterm");
+ QETH_CARD_TEXT_(card, 2, " rc%d", -EIO);
diff --git a/patches.arch/s390-sles15-17-02-02-s390-qeth-sanitize-strings-in-debug-messages.patch b/patches.arch/s390-sles15-17-02-02-s390-qeth-sanitize-strings-in-debug-messages.patch
new file mode 100644
index 0000000000..624f9b88bb
--- /dev/null
+++ b/patches.arch/s390-sles15-17-02-02-s390-qeth-sanitize-strings-in-debug-messages.patch
@@ -0,0 +1,642 @@
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Subject: s390/qeth: sanitize strings in debug messages
+Patch-mainline: v4.20-rc2
+Git-commit: e19e5be8b4cafa8b3f8b0cd1b1dfe20fa0145b83
+References: bsc#1117953, LTC#172960
+
+Description: qeth: sanitize strings in debug messages
+Symptom: Use-after free when reading from s390 debug files.
+Problem: Pointers in sprintf-formatted s390dbf debug files are
+ dereferenced whenever the trace file is read from.
+ If the referenced data has a shorter life-time than the trace
+ file, any read operation can result in a use-after-free.
+Solution: Sanitize the debug entries, remove all usage of indirect data.
+Reproduction: Workload that creates and removes many qeth-based network
+ interfaces, while reading from s390 debug files.
+
+Upstream-Description:
+
+ s390/qeth: sanitize strings in debug messages
+
+ As Documentation/s390/s390dbf.txt states quite clearly, using any
+ pointer in sprinf-formatted s390dbf debug entries is dangerous.
+ The pointers are dereferenced whenever the trace file is read from.
+ So if the referenced data has a shorter life-time than the trace file,
+ any read operation can result in a use-after-free.
+
+ So rip out all hazardous use of indirect data, and replace any usage of
+ dev_name() and such by the Bus ID number.
+
+ Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+ Signed-off-by: David S. Miller <davem@davemloft.net>
+
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/net/qeth_core.h | 15 ++++
+ drivers/s390/net/qeth_core_main.c | 127 +++++++++++++++++---------------------
+ drivers/s390/net/qeth_l2_main.c | 25 +++----
+ drivers/s390/net/qeth_l3_main.c | 104 ++++++++++---------------------
+ 4 files changed, 119 insertions(+), 152 deletions(-)
+
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -84,6 +84,18 @@ struct qeth_dbf_info {
+ #define SENSE_RESETTING_EVENT_BYTE 1
+ #define SENSE_RESETTING_EVENT_FLAG 0x80
+
++static inline u32 qeth_get_device_id(struct ccw_device *cdev)
++{
++ struct ccw_dev_id dev_id;
++ u32 id;
++
++ ccw_device_get_id(cdev, &dev_id);
++ id = dev_id.devno;
++ id |= (u32) (dev_id.ssid << 16);
++
++ return id;
++}
++
+ /*
+ * Common IO related definitions
+ */
+@@ -94,7 +106,8 @@ struct qeth_dbf_info {
+ #define CARD_RDEV_ID(card) dev_name(&card->read.ccwdev->dev)
+ #define CARD_WDEV_ID(card) dev_name(&card->write.ccwdev->dev)
+ #define CARD_DDEV_ID(card) dev_name(&card->data.ccwdev->dev)
+-#define CHANNEL_ID(channel) dev_name(&channel->ccwdev->dev)
++#define CCW_DEVID(cdev) (qeth_get_device_id(cdev))
++#define CARD_DEVID(card) (CCW_DEVID(CARD_RDEV(card)))
+
+ /**
+ * card stuff
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -545,8 +545,8 @@ static int __qeth_issue_next_read(struct
+ if (!iob) {
+ dev_warn(&card->gdev->dev, "The qeth device driver "
+ "failed to recover an error on the device\n");
+- QETH_DBF_MESSAGE(2, "%s issue_next_read failed: no iob "
+- "available\n", dev_name(&card->gdev->dev));
++ QETH_DBF_MESSAGE(2, "issue_next_read on device %x failed: no iob available\n",
++ CARD_DEVID(card));
+ return -ENOMEM;
+ }
+ qeth_setup_ccw(&card->read, iob->data, QETH_BUFSIZE);
+@@ -554,8 +554,8 @@ static int __qeth_issue_next_read(struct
+ rc = ccw_device_start(card->read.ccwdev, &card->read.ccw,
+ (addr_t) iob, 0, 0);
+ if (rc) {
+- QETH_DBF_MESSAGE(2, "%s error in starting next read ccw! "
+- "rc=%i\n", dev_name(&card->gdev->dev), rc);
++ QETH_DBF_MESSAGE(2, "error %i on device %x when starting next read ccw!\n",
++ rc, CARD_DEVID(card));
+ atomic_set(&card->read.irq_pending, 0);
+ card->read_or_write_problem = 1;
+ qeth_schedule_recovery(card);
+@@ -607,16 +607,14 @@ static void qeth_issue_ipa_msg(struct qe
+ const char *ipa_name;
+ int com = cmd->hdr.command;
+ ipa_name = qeth_get_ipa_cmd_name(com);
++
+ if (rc)
+- QETH_DBF_MESSAGE(2, "IPA: %s(x%X) for %s/%s returned "
+- "x%X \"%s\"\n",
+- ipa_name, com, dev_name(&card->gdev->dev),
+- QETH_CARD_IFNAME(card), rc,
+- qeth_get_ipa_msg(rc));
++ QETH_DBF_MESSAGE(2, "IPA: %s(%#x) for device %x returned %#x \"%s\"\n",
++ ipa_name, com, CARD_DEVID(card), rc,
++ qeth_get_ipa_msg(rc));
+ else
+- QETH_DBF_MESSAGE(5, "IPA: %s(x%X) for %s/%s succeeded\n",
+- ipa_name, com, dev_name(&card->gdev->dev),
+- QETH_CARD_IFNAME(card));
++ QETH_DBF_MESSAGE(5, "IPA: %s(%#x) for device %x succeeded\n",
++ ipa_name, com, CARD_DEVID(card));
+ }
+
+ static struct qeth_ipa_cmd *qeth_check_ipa_data(struct qeth_card *card,
+@@ -726,7 +724,7 @@ static int qeth_check_idx_response(struc
+
+ QETH_DBF_HEX(CTRL, 2, buffer, QETH_DBF_CTRL_LEN);
+ if ((buffer[2] & 0xc0) == 0xc0) {
+- QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#02x\n",
++ QETH_DBF_MESSAGE(2, "received an IDX TERMINATE with cause code %#04x\n",
+ buffer[4]);
+ QETH_CARD_TEXT(card, 2, "ckidxres");
+ QETH_CARD_TEXT(card, 2, " idxterm");
+@@ -1033,8 +1031,8 @@ static int qeth_get_problem(struct ccw_d
+ QETH_CARD_TEXT(card, 2, "CGENCHK");
+ dev_warn(&cdev->dev, "The qeth device driver "
+ "failed to recover an error on the device\n");
+- QETH_DBF_MESSAGE(2, "%s check on device dstat=x%x, cstat=x%x\n",
+- dev_name(&cdev->dev), dstat, cstat);
++ QETH_DBF_MESSAGE(2, "check on channel %x with dstat=%#x, cstat=%#x\n",
++ CCW_DEVID(cdev), dstat, cstat);
+ print_hex_dump(KERN_WARNING, "qeth: irb ", DUMP_PREFIX_OFFSET,
+ 16, 1, irb, 64, 1);
+ return 1;
+@@ -1077,8 +1075,8 @@ static long __qeth_check_irb_error(struc
+
+ switch (PTR_ERR(irb)) {
+ case -EIO:
+- QETH_DBF_MESSAGE(2, "%s i/o-error on device\n",
+- dev_name(&cdev->dev));
++ QETH_DBF_MESSAGE(2, "i/o-error on channel %x\n",
++ CCW_DEVID(cdev));
+ QETH_CARD_TEXT(card, 2, "ckirberr");
+ QETH_CARD_TEXT_(card, 2, " rc%d", -EIO);
+ break;
+@@ -1095,8 +1093,8 @@ static long __qeth_check_irb_error(struc
+ }
+ break;
+ default:
+- QETH_DBF_MESSAGE(2, "%s unknown error %ld on device\n",
+- dev_name(&cdev->dev), PTR_ERR(irb));
++ QETH_DBF_MESSAGE(2, "unknown error %ld on channel %x\n",
++ PTR_ERR(irb), CCW_DEVID(cdev));
+ QETH_CARD_TEXT(card, 2, "ckirberr");
+ QETH_CARD_TEXT(card, 2, " rc???");
+ }
+@@ -1165,9 +1163,9 @@ static void qeth_irq(struct ccw_device *
+ dev_warn(&channel->ccwdev->dev,
+ "The qeth device driver failed to recover "
+ "an error on the device\n");
+- QETH_DBF_MESSAGE(2, "%s sense data available. cstat "
+- "0x%X dstat 0x%X\n",
+- dev_name(&channel->ccwdev->dev), cstat, dstat);
++ QETH_DBF_MESSAGE(2, "sense data available on channel %x: cstat %#X dstat %#X\n",
++ CCW_DEVID(channel->ccwdev), cstat,
++ dstat);
+ print_hex_dump(KERN_WARNING, "qeth: irb ",
+ DUMP_PREFIX_OFFSET, 16, 1, irb, 32, 1);
+ print_hex_dump(KERN_WARNING, "qeth: sense data ",
+@@ -1921,8 +1919,8 @@ static int qeth_idx_activate_channel(str
+ if (channel->state != CH_STATE_ACTIVATING) {
+ dev_warn(&channel->ccwdev->dev, "The qeth device driver"
+ " failed to recover an error on the device\n");
+- QETH_DBF_MESSAGE(2, "%s IDX activate timed out\n",
+- dev_name(&channel->ccwdev->dev));
++ QETH_DBF_MESSAGE(2, "IDX activate timed out on channel %x\n",
++ CCW_DEVID(channel->ccwdev));
+ QETH_DBF_TEXT_(SETUP, 2, "2err%d", -ETIME);
+ qeth_clear_cmd_buffers(channel);
+ return -ETIME;
+@@ -1959,17 +1957,15 @@ static void qeth_idx_write_cb(struct qet
+ "The adapter is used exclusively by another "
+ "host\n");
+ else
+- QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on write channel:"
+- " negative reply\n",
+- dev_name(&card->write.ccwdev->dev));
++ QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: negative reply\n",
++ CCW_DEVID(channel->ccwdev));
+ goto out;
+ }
+ memcpy(&temp, QETH_IDX_ACT_FUNC_LEVEL(iob->data), 2);
+ if ((temp & ~0x0100) != qeth_peer_func_level(card->info.func_level)) {
+- QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on write channel: "
+- "function level mismatch (sent: 0x%x, received: "
+- "0x%x)\n", dev_name(&card->write.ccwdev->dev),
+- card->info.func_level, temp);
++ QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: function level mismatch (sent: %#x, received: %#x)\n",
++ CCW_DEVID(channel->ccwdev),
++ card->info.func_level, temp);
+ goto out;
+ }
+ channel->state = CH_STATE_UP;
+@@ -2007,9 +2003,8 @@ static void qeth_idx_read_cb(struct qeth
+ "insufficient authorization\n");
+ break;
+ default:
+- QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on read channel:"
+- " negative reply\n",
+- dev_name(&card->read.ccwdev->dev));
++ QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: negative reply\n",
++ CCW_DEVID(channel->ccwdev));
+ }
+ QETH_CARD_TEXT_(card, 2, "idxread%c",
+ QETH_IDX_ACT_CAUSE_CODE(iob->data));
+@@ -2018,10 +2013,9 @@ static void qeth_idx_read_cb(struct qeth
+
+ memcpy(&temp, QETH_IDX_ACT_FUNC_LEVEL(iob->data), 2);
+ if (temp != qeth_peer_func_level(card->info.func_level)) {
+- QETH_DBF_MESSAGE(2, "%s IDX_ACTIVATE on read channel: function "
+- "level mismatch (sent: 0x%x, received: 0x%x)\n",
+- dev_name(&card->read.ccwdev->dev),
+- card->info.func_level, temp);
++ QETH_DBF_MESSAGE(2, "IDX_ACTIVATE on channel %x: function level mismatch (sent: %#x, received: %#x)\n",
++ CCW_DEVID(channel->ccwdev),
++ card->info.func_level, temp);
+ goto out;
+ }
+ memcpy(&card->token.issuer_rm_r,
+@@ -2129,9 +2123,8 @@ int qeth_send_control_data(struct qeth_c
+ (addr_t) iob, 0, 0);
+ spin_unlock_irqrestore(get_ccwdev_lock(card->write.ccwdev), flags);
+ if (rc) {
+- QETH_DBF_MESSAGE(2, "%s qeth_send_control_data: "
+- "ccw_device_start rc = %i\n",
+- dev_name(&card->write.ccwdev->dev), rc);
++ QETH_DBF_MESSAGE(2, "qeth_send_control_data on device %x: ccw_device_start rc = %i\n",
++ CARD_DEVID(card), rc);
+ QETH_CARD_TEXT_(card, 2, " err%d", rc);
+ spin_lock_irqsave(&card->lock, flags);
+ list_del_init(&reply->list);
+@@ -2936,8 +2929,8 @@ struct qeth_cmd_buffer *qeth_get_ipacmd_
+ } else {
+ dev_warn(&card->gdev->dev,
+ "The qeth driver ran out of channel command buffers\n");
+- QETH_DBF_MESSAGE(1, "%s The qeth driver ran out of channel command buffers",
+- dev_name(&card->gdev->dev));
++ QETH_DBF_MESSAGE(1, "device %x ran out of channel command buffers",
++ CARD_DEVID(card));
+ }
+
+ return iob;
+@@ -3081,10 +3074,9 @@ static int qeth_query_ipassists_cb(struc
+ return -0;
+ default:
+ if (cmd->hdr.return_code) {
+- QETH_DBF_MESSAGE(1, "%s IPA_CMD_QIPASSIST: Unhandled "
+- "rc=%d\n",
+- dev_name(&card->gdev->dev),
+- cmd->hdr.return_code);
++ QETH_DBF_MESSAGE(1, "IPA_CMD_QIPASSIST on device %x: Unhandled rc=%#x\n",
++ CARD_DEVID(card),
++ cmd->hdr.return_code);
+ return 0;
+ }
+ }
+@@ -3096,8 +3088,8 @@ static int qeth_query_ipassists_cb(struc
+ card->options.ipa6.supported_funcs = cmd->hdr.ipa_supported;
+ card->options.ipa6.enabled_funcs = cmd->hdr.ipa_enabled;
+ } else
+- QETH_DBF_MESSAGE(1, "%s IPA_CMD_QIPASSIST: Flawed LIC detected"
+- "\n", dev_name(&card->gdev->dev));
++ QETH_DBF_MESSAGE(1, "IPA_CMD_QIPASSIST on device %x: Flawed LIC detected\n",
++ CARD_DEVID(card));
+ return 0;
+ }
+
+@@ -4320,10 +4312,9 @@ static int qeth_setadpparms_set_access_c
+ cmd->data.setadapterparms.hdr.return_code);
+ if (cmd->data.setadapterparms.hdr.return_code !=
+ SET_ACCESS_CTRL_RC_SUCCESS)
+- QETH_DBF_MESSAGE(3, "ERR:SET_ACCESS_CTRL(%s,%d)==%d\n",
+- card->gdev->dev.kobj.name,
+- access_ctrl_req->subcmd_code,
+- cmd->data.setadapterparms.hdr.return_code);
++ QETH_DBF_MESSAGE(3, "ERR:SET_ACCESS_CTRL(%#x) on device %x: %#x\n",
++ access_ctrl_req->subcmd_code, CARD_DEVID(card),
++ cmd->data.setadapterparms.hdr.return_code);
+ switch (cmd->data.setadapterparms.hdr.return_code) {
+ case SET_ACCESS_CTRL_RC_SUCCESS:
+ if (card->options.isolation == ISOLATION_MODE_NONE) {
+@@ -4335,14 +4326,14 @@ static int qeth_setadpparms_set_access_c
+ }
+ break;
+ case SET_ACCESS_CTRL_RC_ALREADY_NOT_ISOLATED:
+- QETH_DBF_MESSAGE(2, "%s QDIO data connection isolation already "
+- "deactivated\n", dev_name(&card->gdev->dev));
++ QETH_DBF_MESSAGE(2, "QDIO data connection isolation on device %x already deactivated\n",
++ CARD_DEVID(card));
+ if (fallback)
+ card->options.isolation = card->options.prev_isolation;
+ break;
+ case SET_ACCESS_CTRL_RC_ALREADY_ISOLATED:
+- QETH_DBF_MESSAGE(2, "%s QDIO data connection isolation already"
+- " activated\n", dev_name(&card->gdev->dev));
++ QETH_DBF_MESSAGE(2, "QDIO data connection isolation on device %x already activated\n",
++ CARD_DEVID(card));
+ if (fallback)
+ card->options.isolation = card->options.prev_isolation;
+ break;
+@@ -4428,10 +4419,8 @@ int qeth_set_access_ctrl_online(struct q
+ rc = qeth_setadpparms_set_access_ctrl(card,
+ card->options.isolation, fallback);
+ if (rc) {
+- QETH_DBF_MESSAGE(3,
+- "IPA(SET_ACCESS_CTRL,%s,%d) sent failed\n",
+- card->gdev->dev.kobj.name,
+- rc);
++ QETH_DBF_MESSAGE(3, "IPA(SET_ACCESS_CTRL(%d) on device %x: sent failed\n",
++ rc, CARD_DEVID(card));
+ rc = -EOPNOTSUPP;
+ }
+ } else if (card->options.isolation != ISOLATION_MODE_NONE) {
+@@ -4657,8 +4646,8 @@ static int qeth_snmp_command(struct qeth
+ rc = qeth_send_ipa_snmp_cmd(card, iob, QETH_SETADP_BASE_LEN + req_len,
+ qeth_snmp_command_cb, (void *)&qinfo);
+ if (rc)
+- QETH_DBF_MESSAGE(2, "SNMP command failed on %s: (0x%x)\n",
+- QETH_CARD_IFNAME(card), rc);
++ QETH_DBF_MESSAGE(2, "SNMP command failed on device %x: (%#x)\n",
++ CARD_DEVID(card), rc);
+ else {
+ if (copy_to_user(udata, qinfo.udata, qinfo.udata_len))
+ rc = -EFAULT;
+@@ -4892,8 +4881,8 @@ static void qeth_determine_capabilities(
+
+ rc = qeth_read_conf_data(card, (void **) &prcd, &length);
+ if (rc) {
+- QETH_DBF_MESSAGE(2, "%s qeth_read_conf_data returned %i\n",
+- dev_name(&card->gdev->dev), rc);
++ QETH_DBF_MESSAGE(2, "qeth_read_conf_data on device %x returned %i\n",
++ CARD_DEVID(card), rc);
+ QETH_DBF_TEXT_(SETUP, 2, "5err%d", rc);
+ goto out_offline;
+ }
+@@ -5118,8 +5107,8 @@ int qeth_core_hardsetup_card(struct qeth
+ qeth_update_from_chp_desc(card);
+ retry:
+ if (retries < 3)
+- QETH_DBF_MESSAGE(2, "%s Retrying to do IDX activates.\n",
+- dev_name(&card->gdev->dev));
++ QETH_DBF_MESSAGE(2, "Retrying to do IDX activates on device %x.\n",
++ CARD_DEVID(card));
+ rc = qeth_qdio_clear_card(card, card->info.type != QETH_CARD_TYPE_IQD);
+ ccw_device_set_offline(CARD_DDEV(card));
+ ccw_device_set_offline(CARD_WDEV(card));
+@@ -5217,8 +5206,8 @@ retriable:
+ out:
+ dev_warn(&card->gdev->dev, "The qeth device driver failed to recover "
+ "an error on the device\n");
+- QETH_DBF_MESSAGE(2, "%s Initialization in hardsetup failed! rc=%d\n",
+- dev_name(&card->gdev->dev), rc);
++ QETH_DBF_MESSAGE(2, "Initialization for device %x failed in hardsetup! rc=%d\n",
++ CARD_DEVID(card), rc);
+ return rc;
+ }
+ EXPORT_SYMBOL_GPL(qeth_core_hardsetup_card);
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -164,11 +164,11 @@ static int qeth_l2_send_setgroupmac(stru
+ QETH_CARD_TEXT(card, 2, "L2Sgmac");
+ rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_SETGMAC);
+ if (rc == -EEXIST)
+- QETH_DBF_MESSAGE(2, "Group MAC %pM already existing on %s\n",
+- mac, QETH_CARD_IFNAME(card));
++ QETH_DBF_MESSAGE(2, "MAC already registered on device %x\n",
++ CARD_DEVID(card));
+ else if (rc)
+- QETH_DBF_MESSAGE(2, "Could not set group MAC %pM on %s: %d\n",
+- mac, QETH_CARD_IFNAME(card), rc);
++ QETH_DBF_MESSAGE(2, "Failed to register MAC on device %x: %d\n",
++ CARD_DEVID(card), rc);
+ return rc;
+ }
+
+@@ -179,9 +179,8 @@ static int qeth_l2_send_delgroupmac(stru
+ QETH_CARD_TEXT(card, 2, "L2Dgmac");
+ rc = qeth_l2_send_setdelmac(card, mac, IPA_CMD_DELGMAC);
+ if (rc)
+- QETH_DBF_MESSAGE(2,
+- "Could not delete group MAC %pM on %s: %d\n",
+- mac, QETH_CARD_IFNAME(card), rc);
++ QETH_DBF_MESSAGE(2, "Failed to delete MAC on device %u: %d\n",
++ CARD_DEVID(card), rc);
+ return rc;
+ }
+
+@@ -304,9 +303,9 @@ static int qeth_l2_send_setdelvlan_cb(st
+
+ QETH_CARD_TEXT(card, 2, "L2sdvcb");
+ if (cmd->hdr.return_code) {
+- QETH_DBF_MESSAGE(2, "Error in processing VLAN %i on %s: 0x%x.\n",
++ QETH_DBF_MESSAGE(2, "Error in processing VLAN %u on device %x: %#x.\n",
+ cmd->data.setdelvlan.vlan_id,
+- QETH_CARD_IFNAME(card), cmd->hdr.return_code);
++ CARD_DEVID(card), cmd->hdr.return_code);
+ QETH_CARD_TEXT_(card, 2, "L2VL%4x", cmd->hdr.command);
+ QETH_CARD_TEXT_(card, 2, "err%d", cmd->hdr.return_code);
+ }
+@@ -518,8 +517,8 @@ static int qeth_l2_request_initial_mac(s
+ rc = qeth_vm_request_mac(card);
+ if (!rc)
+ goto out;
+- QETH_DBF_MESSAGE(2, "z/VM MAC Service failed on device %s: x%x\n",
+- CARD_BUS_ID(card), rc);
++ QETH_DBF_MESSAGE(2, "z/VM MAC Service failed on device %x: %#x\n",
++ CARD_DEVID(card), rc);
+ QETH_DBF_TEXT_(SETUP, 2, "err%04x", rc);
+ /* fall back to alternative mechanism: */
+ }
+@@ -530,8 +529,8 @@ static int qeth_l2_request_initial_mac(s
+ card->info.guestlan) {
+ rc = qeth_setadpparms_change_macaddr(card);
+ if (rc) {
+- QETH_DBF_MESSAGE(2, "couldn't get MAC address on "
+- "device %s: x%x\n", CARD_BUS_ID(card), rc);
++ QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %x: %#x\n",
++ CARD_DEVID(card), rc);
+ QETH_DBF_TEXT_(SETUP, 2, "1err%04x", rc);
+ return rc;
+ }
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -560,9 +560,8 @@ int qeth_l3_setrouting_v4(struct qeth_ca
+ QETH_PROT_IPV4);
+ if (rc) {
+ card->options.route4.type = NO_ROUTER;
+- QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
+- " on %s. Type set to 'no router'.\n", rc,
+- QETH_CARD_IFNAME(card));
++ QETH_DBF_MESSAGE(2, "Error (%#06x) while setting routing type on device %x. Type set to 'no router'.\n",
++ rc, CARD_DEVID(card));
+ }
+ return rc;
+ }
+@@ -585,9 +584,8 @@ int qeth_l3_setrouting_v6(struct qeth_ca
+ QETH_PROT_IPV6);
+ if (rc) {
+ card->options.route6.type = NO_ROUTER;
+- QETH_DBF_MESSAGE(2, "Error (0x%04x) while setting routing type"
+- " on %s. Type set to 'no router'.\n", rc,
+- QETH_CARD_IFNAME(card));
++ QETH_DBF_MESSAGE(2, "Error (%#06x) while setting routing type on device %x. Type set to 'no router'.\n",
++ rc, CARD_DEVID(card));
+ }
+ #endif
+ return rc;
+@@ -1290,8 +1288,8 @@ qeth_diags_trace_cb(struct qeth_card *ca
+ }
+ break;
+ default:
+- QETH_DBF_MESSAGE(2, "Unknown sniffer action (0x%04x) on %s\n",
+- cmd->data.diagass.action, QETH_CARD_IFNAME(card));
++ QETH_DBF_MESSAGE(2, "Unknown sniffer action (%#06x) on device %x\n",
++ cmd->data.diagass.action, CARD_DEVID(card));
+ }
+
+ return 0;
+@@ -1973,32 +1971,25 @@ static void qeth_l3_set_multicast_list(s
+ qeth_l3_handle_promisc_mode(card);
+ }
+
+-static const char *qeth_l3_arp_get_error_cause(int *rc)
++static int qeth_l3_arp_makerc(int rc)
+ {
+- switch (*rc) {
+- case QETH_IPA_ARP_RC_FAILED:
+- *rc = -EIO;
+- return "operation failed";
++ switch (rc) {
++ case IPA_RC_SUCCESS:
++ return 0;
+ case QETH_IPA_ARP_RC_NOTSUPP:
+- *rc = -EOPNOTSUPP;
+- return "operation not supported";
+- case QETH_IPA_ARP_RC_OUT_OF_RANGE:
+- *rc = -EINVAL;
+- return "argument out of range";
+ case QETH_IPA_ARP_RC_Q_NOTSUPP:
+- *rc = -EOPNOTSUPP;
+- return "query operation not supported";
++ return -EOPNOTSUPP;
++ case QETH_IPA_ARP_RC_OUT_OF_RANGE:
++ return -EINVAL;
+ case QETH_IPA_ARP_RC_Q_NO_DATA:
+- *rc = -ENOENT;
+- return "no query data available";
++ return -ENOENT;
+ default:
+- return "unknown error";
++ return -EIO;
+ }
+ }
+
+ static int qeth_l3_arp_set_no_entries(struct qeth_card *card, int no_entries)
+ {
+- int tmp;
+ int rc;
+
+ QETH_CARD_TEXT(card, 3, "arpstnoe");
+@@ -2016,13 +2007,10 @@ static int qeth_l3_arp_set_no_entries(st
+ rc = qeth_send_simple_setassparms(card, IPA_ARP_PROCESSING,
+ IPA_CMD_ASS_ARP_SET_NO_ENTRIES,
+ no_entries);
+- if (rc) {
+- tmp = rc;
+- QETH_DBF_MESSAGE(2, "Could not set number of ARP entries on "
+- "%s: %s (0x%x/%d)\n", QETH_CARD_IFNAME(card),
+- qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+- }
+- return rc;
++ if (rc)
++ QETH_DBF_MESSAGE(2, "Could not set number of ARP entries on device %x: %#x\n",
++ CARD_DEVID(card), rc);
++ return qeth_l3_arp_makerc(rc);
+ }
+
+ static __u32 get_arp_entry_size(struct qeth_card *card,
+@@ -2172,7 +2160,6 @@ static int qeth_l3_query_arp_cache_info(
+ {
+ struct qeth_cmd_buffer *iob;
+ struct qeth_ipa_cmd *cmd;
+- int tmp;
+ int rc;
+
+ QETH_CARD_TEXT_(card, 3, "qarpipv%i", prot);
+@@ -2191,15 +2178,10 @@ static int qeth_l3_query_arp_cache_info(
+ rc = qeth_l3_send_ipa_arp_cmd(card, iob,
+ QETH_SETASS_BASE_LEN+QETH_ARP_CMD_LEN,
+ qeth_l3_arp_query_cb, (void *)qinfo);
+- if (rc) {
+- tmp = rc;
+- QETH_DBF_MESSAGE(2,
+- "Error while querying ARP cache on %s: %s "
+- "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
+- qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+- }
+-
+- return rc;
++ if (rc)
++ QETH_DBF_MESSAGE(2, "Error while querying ARP cache on device %x: %#x\n",
++ CARD_DEVID(card), rc);
++ return qeth_l3_arp_makerc(rc);
+ }
+
+ static int qeth_l3_arp_query(struct qeth_card *card, char __user *udata)
+@@ -2255,8 +2237,6 @@ static int qeth_l3_arp_add_entry(struct
+ struct qeth_arp_cache_entry *entry)
+ {
+ struct qeth_cmd_buffer *iob;
+- char buf[16];
+- int tmp;
+ int rc;
+
+ QETH_CARD_TEXT(card, 3, "arpadent");
+@@ -2282,14 +2262,10 @@ static int qeth_l3_arp_add_entry(struct
+ sizeof(struct qeth_arp_cache_entry),
+ (unsigned long) entry,
+ qeth_setassparms_cb, NULL);
+- if (rc) {
+- tmp = rc;
+- qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
+- QETH_DBF_MESSAGE(2, "Could not add ARP entry for address %s "
+- "on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
+- qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+- }
+- return rc;
++ if (rc)
++ QETH_DBF_MESSAGE(2, "Could not add ARP entry on device %x: %#x\n",
++ CARD_DEVID(card), rc);
++ return qeth_l3_arp_makerc(rc);
+ }
+
+ static int qeth_l3_arp_remove_entry(struct qeth_card *card,
+@@ -2297,7 +2273,6 @@ static int qeth_l3_arp_remove_entry(stru
+ {
+ struct qeth_cmd_buffer *iob;
+ char buf[16] = {0, };
+- int tmp;
+ int rc;
+
+ QETH_CARD_TEXT(card, 3, "arprment");
+@@ -2322,21 +2297,15 @@ static int qeth_l3_arp_remove_entry(stru
+ rc = qeth_send_setassparms(card, iob,
+ 12, (unsigned long)buf,
+ qeth_setassparms_cb, NULL);
+- if (rc) {
+- tmp = rc;
+- memset(buf, 0, 16);
+- qeth_l3_ipaddr4_to_string((u8 *)entry->ipaddr, buf);
+- QETH_DBF_MESSAGE(2, "Could not delete ARP entry for address %s"
+- " on %s: %s (0x%x/%d)\n", buf, QETH_CARD_IFNAME(card),
+- qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+- }
+- return rc;
++ if (rc)
++ QETH_DBF_MESSAGE(2, "Could not delete ARP entry on device %x: %#x\n",
++ CARD_DEVID(card), rc);
++ return qeth_l3_arp_makerc(rc);
+ }
+
+ static int qeth_l3_arp_flush_cache(struct qeth_card *card)
+ {
+ int rc;
+- int tmp;
+
+ QETH_CARD_TEXT(card, 3, "arpflush");
+
+@@ -2352,13 +2321,10 @@ static int qeth_l3_arp_flush_cache(struc
+ }
+ rc = qeth_send_simple_setassparms(card, IPA_ARP_PROCESSING,
+ IPA_CMD_ASS_ARP_FLUSH_CACHE, 0);
+- if (rc) {
+- tmp = rc;
+- QETH_DBF_MESSAGE(2, "Could not flush ARP cache on %s: %s "
+- "(0x%x/%d)\n", QETH_CARD_IFNAME(card),
+- qeth_l3_arp_get_error_cause(&rc), tmp, tmp);
+- }
+- return rc;
++ if (rc)
++ QETH_DBF_MESSAGE(2, "Could not flush ARP cache on device %x: %#x\n",
++ CARD_DEVID(card), rc);
++ return qeth_l3_arp_makerc(rc);
+ }
+
+ static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
diff --git a/patches.arch/s390-sles15-17-03-s390-qeth-fix-length-check-in-SNMP-processing.patch b/patches.arch/s390-sles15-17-03-s390-qeth-fix-length-check-in-SNMP-processing.patch
new file mode 100644
index 0000000000..7504033828
--- /dev/null
+++ b/patches.arch/s390-sles15-17-03-s390-qeth-fix-length-check-in-SNMP-processing.patch
@@ -0,0 +1,107 @@
+From: Julian Wiedmann <jwi@linux.ibm.com>
+Subject: s390/qeth: fix length check in SNMP processing
+Patch-mainline: v4.20-rc5
+Git-commit: 9a764c1e59684c0358e16ccaafd870629f2cfe67
+References: bsc#1117953, LTC#173657
+
+Description: qeth: fix length check in SNMP processing
+Symptom: Undefined behaviour.
+Problem: The response for a SNMP request can consist of multiple parts,
+ which the cmd callback stages into a kernel buffer until all
+ parts have been received. If the callback detects that the
+ staging buffer provides insufficient space, it bails out with
+ error.
+ This processing is buggy for the first part of the response -
+ while it initially checks for a length of 'data_len', it later
+ copies an additional amount of
+ 'offsetof(struct qeth_snmp_cmd, data)' bytes.
+Solution: Fix the calculation of 'data_len' for the first part of the
+ response.
+Reproduction: -
+
+Upstream-Description:
+
+ s390/qeth: fix length check in SNMP processing
+
+ The response for a SNMP request can consist of multiple parts, which
+ the cmd callback stages into a kernel buffer until all parts have been
+ received. If the callback detects that the staging buffer provides
+ insufficient space, it bails out with error.
+ This processing is buggy for the first part of the response - while it
+ initially checks for a length of 'data_len', it later copies an
+ additional amount of 'offsetof(struct qeth_snmp_cmd, data)' bytes.
+
+ Fix the calculation of 'data_len' for the first part of the response.
+ This also nicely cleans up the memcpy code.
+
+ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+ Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+ Reviewed-by: Ursula Braun <ubraun@linux.ibm.com>
+ Signed-off-by: David S. Miller <davem@davemloft.net>
+
+
+Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/net/qeth_core_main.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -4541,8 +4541,8 @@ static int qeth_snmp_command_cb(struct q
+ {
+ struct qeth_ipa_cmd *cmd;
+ struct qeth_arp_query_info *qinfo;
+- struct qeth_snmp_cmd *snmp;
+ unsigned char *data;
++ void *snmp_data;
+ __u16 data_len;
+
+ QETH_CARD_TEXT(card, 3, "snpcmdcb");
+@@ -4550,7 +4550,6 @@ static int qeth_snmp_command_cb(struct q
+ cmd = (struct qeth_ipa_cmd *) sdata;
+ data = (unsigned char *)((char *)cmd - reply->offset);
+ qinfo = (struct qeth_arp_query_info *) reply->param;
+- snmp = &cmd->data.setadapterparms.data.snmp;
+
+ if (cmd->hdr.return_code) {
+ QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code);
+@@ -4563,10 +4562,15 @@ static int qeth_snmp_command_cb(struct q
+ return 0;
+ }
+ data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data));
+- if (cmd->data.setadapterparms.hdr.seq_no == 1)
+- data_len -= (__u16)((char *)&snmp->data - (char *)cmd);
+- else
+- data_len -= (__u16)((char *)&snmp->request - (char *)cmd);
++ if (cmd->data.setadapterparms.hdr.seq_no == 1) {
++ snmp_data = &cmd->data.setadapterparms.data.snmp;
++ data_len -= offsetof(struct qeth_ipa_cmd,
++ data.setadapterparms.data.snmp);
++ } else {
++ snmp_data = &cmd->data.setadapterparms.data.snmp.request;
++ data_len -= offsetof(struct qeth_ipa_cmd,
++ data.setadapterparms.data.snmp.request);
++ }
+
+ /* check if there is enough room in userspace */
+ if ((qinfo->udata_len - qinfo->udata_offset) < data_len) {
+@@ -4579,16 +4583,9 @@ static int qeth_snmp_command_cb(struct q
+ QETH_CARD_TEXT_(card, 4, "sseqn%i",
+ cmd->data.setadapterparms.hdr.seq_no);
+ /*copy entries to user buffer*/
+- if (cmd->data.setadapterparms.hdr.seq_no == 1) {
+- memcpy(qinfo->udata + qinfo->udata_offset,
+- (char *)snmp,
+- data_len + offsetof(struct qeth_snmp_cmd, data));
+- qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data);
+- } else {
+- memcpy(qinfo->udata + qinfo->udata_offset,
+- (char *)&snmp->request, data_len);
+- }
++ memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len);
+ qinfo->udata_offset += data_len;
++
+ /* check if all replies received ... */
+ QETH_CARD_TEXT_(card, 4, "srtot%i",
+ cmd->data.setadapterparms.hdr.used_total);
diff --git a/patches.arch/s390-sles15-dasd-fix-deadlock-in-dasd_times_out.patch b/patches.arch/s390-sles15-dasd-fix-deadlock-in-dasd_times_out.patch
new file mode 100644
index 0000000000..6f812bb09f
--- /dev/null
+++ b/patches.arch/s390-sles15-dasd-fix-deadlock-in-dasd_times_out.patch
@@ -0,0 +1,62 @@
+From: Stefan Haberland <sth@linux.ibm.com>
+Subject: dasd: fix deadlock in dasd_times_out
+Patch-mainline: never, fixed differently
+References: bsc#1121477, LTC#174111
+
+Description: dasd: fix deadlock in dasd_times_out
+Symptom: System does not respond after disk timeout.
+Problem: The dasd_times_out function processes requests that have an
+ internal timeout as well as an external timeout called through
+ dasd_ioctl_abortio().
+ For the latter type of requests the CQR may be already in a final
+ state. The if-else path in dasd_times_out does not handle CQRs in
+ the final states DASD_CQR_DONE, DASD_CQR_FAILED and
+ DASD_CQR_TERMINATED and therefore the ccw device lock is never
+ freed.
+Solution: Provide __dasd_cancel_req that is called with the ccw device lock
+ held to simplify the locking in dasd_times_out and fix the
+ deadlock issue. Also ensure that interrupts are disabled. The
+ function may get called with interrupts enabled or already
+ disabled.
+Reproduction: Run IO on disks that do not respond to IO requests in a given
+ amount of time for example due to hardware failure or reserved
+ disk state.
+
+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+[ ptesarik: Commit 1bcdb5354aee2c0abcd13d912be35ae39a4144b6 is backported
+ separately. The interrupt disable issue is fixed in mainline by commit
+ e443343e509aac82e7281020f25bf8fa0dd46ab7; not backported to SLE15. ]
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/block/dasd.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/block/dasd.c
++++ b/drivers/s390/block/dasd.c
+@@ -3072,6 +3072,7 @@ enum blk_eh_timer_return dasd_times_out(
+ struct dasd_ccw_req *cqr = req->completion_data;
+ struct dasd_block *block = req->q->queuedata;
+ struct dasd_device *device;
++ unsigned long flags;
+ int rc = 0;
+
+ if (!cqr)
+@@ -3084,7 +3085,7 @@ enum blk_eh_timer_return dasd_times_out(
+ " dasd_times_out cqr %p status %x",
+ cqr, cqr->status);
+
+- spin_lock(&block->queue_lock);
++ spin_lock_irqsave(&block->queue_lock, flags);
+ spin_lock(get_ccwdev_lock(device->cdev));
+ cqr->retries = -1;
+ cqr->intrc = -ETIMEDOUT;
+@@ -3124,7 +3125,7 @@ enum blk_eh_timer_return dasd_times_out(
+ }
+ spin_unlock(get_ccwdev_lock(device->cdev));
+ dasd_schedule_block_bh(block);
+- spin_unlock(&block->queue_lock);
++ spin_unlock_irqrestore(&block->queue_lock, flags);
+
+ return rc ? BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED;
+ }
diff --git a/patches.arch/sched-core-fix-cpu-max-vs-cpuhotplug-deadlock.patch b/patches.arch/sched-core-fix-cpu-max-vs-cpuhotplug-deadlock.patch
new file mode 100644
index 0000000000..3edcb512b5
--- /dev/null
+++ b/patches.arch/sched-core-fix-cpu-max-vs-cpuhotplug-deadlock.patch
@@ -0,0 +1,121 @@
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 22 Jan 2018 22:53:28 +0100
+Subject: sched/core: Fix cpu.max vs. cpuhotplug deadlock
+Git-commit: ce48c146495a1a50e48cdbfbfaba3e708be7c07c
+Patch-mainline: v4.15
+References: bsc#1106913
+
+Tejun reported the following cpu-hotplug lock (percpu-rwsem) read recursion:
+
+ tg_set_cfs_bandwidth()
+ get_online_cpus()
+ cpus_read_lock()
+
+ cfs_bandwidth_usage_inc()
+ static_key_slow_inc()
+ cpus_read_lock()
+
+Reported-by: Tejun Heo <tj@kernel.org>
+Tested-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180122215328.GP3397@worktop
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ include/linux/jump_label.h | 7 +++++++
+ kernel/jump_label.c | 12 +++++++++---
+ kernel/sched/fair.c | 4 ++--
+ 3 files changed, 18 insertions(+), 5 deletions(-)
+
+--- a/include/linux/jump_label.h
++++ b/include/linux/jump_label.h
+@@ -159,6 +159,8 @@ extern void arch_jump_label_transform_st
+ extern int jump_label_text_reserved(void *start, void *end);
+ extern void static_key_slow_inc(struct static_key *key);
+ extern void static_key_slow_dec(struct static_key *key);
++extern void static_key_slow_inc_cpuslocked(struct static_key *key);
++extern void static_key_slow_dec_cpuslocked(struct static_key *key);
+ extern void jump_label_apply_nops(struct module *mod);
+ extern int static_key_count(struct static_key *key);
+ extern void static_key_enable(struct static_key *key);
+@@ -221,6 +223,9 @@ static inline void static_key_slow_dec(s
+ atomic_dec(&key->enabled);
+ }
+
++#define static_key_slow_inc_cpuslocked(key) static_key_slow_inc(key)
++#define static_key_slow_dec_cpuslocked(key) static_key_slow_dec(key)
++
+ static inline int jump_label_text_reserved(void *start, void *end)
+ {
+ return 0;
+@@ -415,6 +420,8 @@ extern bool ____wrong_branch_error(void)
+
+ #define static_branch_inc(x) static_key_slow_inc(&(x)->key)
+ #define static_branch_dec(x) static_key_slow_dec(&(x)->key)
++#define static_branch_inc_cpuslocked(x) static_key_slow_inc_cpuslocked(&(x)->key)
++#define static_branch_dec_cpuslocked(x) static_key_slow_dec_cpuslocked(&(x)->key)
+
+ /*
+ * Normal usage; boolean enable/disable.
+--- a/kernel/jump_label.c
++++ b/kernel/jump_label.c
+@@ -79,7 +79,7 @@ int static_key_count(struct static_key *
+ }
+ EXPORT_SYMBOL_GPL(static_key_count);
+
+-static void static_key_slow_inc_cpuslocked(struct static_key *key)
++void static_key_slow_inc_cpuslocked(struct static_key *key)
+ {
+ int v, v1;
+
+@@ -174,7 +174,7 @@ void static_key_disable(struct static_ke
+ }
+ EXPORT_SYMBOL_GPL(static_key_disable);
+
+-static void static_key_slow_dec_cpuslocked(struct static_key *key,
++static void __static_key_slow_dec_cpuslocked(struct static_key *key,
+ unsigned long rate_limit,
+ struct delayed_work *work)
+ {
+@@ -205,7 +205,7 @@ static void __static_key_slow_dec(struct
+ struct delayed_work *work)
+ {
+ cpus_read_lock();
+- static_key_slow_dec_cpuslocked(key, rate_limit, work);
++ __static_key_slow_dec_cpuslocked(key, rate_limit, work);
+ cpus_read_unlock();
+ }
+
+@@ -223,6 +223,12 @@ void static_key_slow_dec(struct static_k
+ }
+ EXPORT_SYMBOL_GPL(static_key_slow_dec);
+
++void static_key_slow_dec_cpuslocked(struct static_key *key)
++{
++ STATIC_KEY_CHECK_USE(key);
++ __static_key_slow_dec_cpuslocked(key, 0, NULL);
++}
++
+ void static_key_slow_dec_deferred(struct static_key_deferred *key)
+ {
+ STATIC_KEY_CHECK_USE(key);
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4380,12 +4380,12 @@ static inline bool cfs_bandwidth_used(vo
+
+ void cfs_bandwidth_usage_inc(void)
+ {
+- static_key_slow_inc(&__cfs_bandwidth_used);
++ static_key_slow_inc_cpuslocked(&__cfs_bandwidth_used);
+ }
+
+ void cfs_bandwidth_usage_dec(void)
+ {
+- static_key_slow_dec(&__cfs_bandwidth_used);
++ static_key_slow_dec_cpuslocked(&__cfs_bandwidth_used);
+ }
+ #else /* HAVE_JUMP_LABEL */
+ static bool cfs_bandwidth_used(void)
diff --git a/patches.arch/sched-smt-expose-sched_smt_present-static-key.patch b/patches.arch/sched-smt-expose-sched_smt_present-static-key.patch
new file mode 100644
index 0000000000..76cfad59b7
--- /dev/null
+++ b/patches.arch/sched-smt-expose-sched_smt_present-static-key.patch
@@ -0,0 +1,83 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:38 +0100
+Subject: sched/smt: Expose sched_smt_present static key
+Git-commit: 321a874a7ef85655e93b3206d0f36b4a6097f948
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Make the scheduler's 'sched_smt_present' static key globaly available, so
+it can be used in the x86 speculation control code.
+
+Provide a query function and a stub for the CONFIG_SMP=n case.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.430168326@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ include/linux/sched/smt.h | 18 ++++++++++++++++++
+ kernel/sched/sched.h | 4 +---
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+--- /dev/null
++++ b/include/linux/sched/smt.h
+@@ -0,0 +1,18 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _LINUX_SCHED_SMT_H
++#define _LINUX_SCHED_SMT_H
++
++#include <linux/static_key.h>
++
++#ifdef CONFIG_SCHED_SMT
++extern struct static_key_false sched_smt_present;
++
++static __always_inline bool sched_smt_active(void)
++{
++ return static_branch_likely(&sched_smt_present);
++}
++#else
++static inline bool sched_smt_active(void) { return false; }
++#endif
++
++#endif
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -11,6 +11,7 @@
+ #include <linux/sched/numa_balancing.h>
+ #include <linux/sched/mm.h>
+ #include <linux/sched/cpufreq.h>
++#include <linux/sched/smt.h>
+ #include <linux/sched/stat.h>
+ #include <linux/sched/nohz.h>
+ #include <linux/sched/debug.h>
+@@ -794,9 +795,6 @@ static inline int cpu_of(struct rq *rq)
+
+
+ #ifdef CONFIG_SCHED_SMT
+-
+-extern struct static_key_false sched_smt_present;
+-
+ extern void __update_idle_core(struct rq *rq);
+
+ static inline void update_idle_core(struct rq *rq)
diff --git a/patches.arch/sched-smt-make-sched_smt_present-track-topology.patch b/patches.arch/sched-smt-make-sched_smt_present-track-topology.patch
new file mode 100644
index 0000000000..d14f256029
--- /dev/null
+++ b/patches.arch/sched-smt-make-sched_smt_present-track-topology.patch
@@ -0,0 +1,84 @@
+From: "Peter Zijlstra (Intel)" <peterz@infradead.org>
+Date: Sun, 25 Nov 2018 19:33:36 +0100
+Subject: sched/smt: Make sched_smt_present track topology
+Git-commit: c5511d03ec090980732e929c318a7a6374b5550e
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Currently the 'sched_smt_present' static key is enabled when at CPU bringup
+SMT topology is observed, but it is never disabled. However there is demand
+to also disable the key when the topology changes such that there is no SMT
+present anymore.
+
+Implement this by making the key count the number of cores that have SMT
+enabled.
+
+In particular, the SMT topology bits are set before interrrupts are enabled
+and similarly, are cleared after interrupts are disabled for the last time
+and the CPU dies.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.246110444@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ kernel/sched/core.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5829,15 +5829,10 @@ int sched_cpu_activate(unsigned int cpu)
+
+ #ifdef CONFIG_SCHED_SMT
+ /*
+- * The sched_smt_present static key needs to be evaluated on every
+- * hotplug event because at boot time SMT might be disabled when
+- * the number of booted CPUs is limited.
+- *
+- * If then later a sibling gets hotplugged, then the key would stay
+- * off and SMT scheduling would never be functional.
++ * When going up, increment the number of cores with SMT present.
+ */
+- if (cpumask_weight(cpu_smt_mask(cpu)) > 1)
+- static_branch_enable_cpuslocked(&sched_smt_present);
++ if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
++ static_branch_inc_cpuslocked(&sched_smt_present);
+ #endif
+ set_cpu_active(cpu, true);
+
+@@ -5887,6 +5882,14 @@ int sched_cpu_deactivate(unsigned int cp
+ else
+ synchronize_rcu();
+
++#ifdef CONFIG_SCHED_SMT
++ /*
++ * When going down, decrement the number of cores with SMT present.
++ */
++ if (cpumask_weight(cpu_smt_mask(cpu)) == 2)
++ static_branch_dec_cpuslocked(&sched_smt_present);
++#endif
++
+ if (!sched_smp_initialized)
+ return 0;
+
diff --git a/patches.arch/x86-PCI-Add-additional-VMD-device-root-ports-to-VMD-.patch b/patches.arch/x86-PCI-Add-additional-VMD-device-root-ports-to-VMD-.patch
new file mode 100644
index 0000000000..8b4f4bf736
--- /dev/null
+++ b/patches.arch/x86-PCI-Add-additional-VMD-device-root-ports-to-VMD-.patch
@@ -0,0 +1,40 @@
+From a5ad57e6b831a5ea99e128aae4372b5b72323c08 Mon Sep 17 00:00:00 2001
+From: Jon Derrick <jonathan.derrick@intel.com>
+Date: Fri, 18 May 2018 13:28:01 -0600
+Subject: [PATCH] x86/PCI: Add additional VMD device root ports to VMD AER quirk
+Git-commit: a5ad57e6b831a5ea99e128aae4372b5b72323c08
+Patch-mainline: v4.18-rc1
+References: bsc#1120058
+
+VMD devices change the source id of messages from child devices to the
+VMD endpoint. This patch adds additional VMD root port device ids to the
+AER quirk which requires walking the bus to determine which devices were
+throwing the error.
+
+Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 54ef19e90705..13f4485ca388 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -636,6 +636,10 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2030, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2031, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2032, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334a, quirk_no_aersid);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334b, quirk_no_aersid);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334c, quirk_no_aersid);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334d, quirk_no_aersid);
+
+ #ifdef CONFIG_PHYS_ADDR_T_64BIT
+
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Add-pci-big_root_window-option-for-AMD-64-bi.patch b/patches.arch/x86-PCI-Add-pci-big_root_window-option-for-AMD-64-bi.patch
new file mode 100644
index 0000000000..fd5c9cf19b
--- /dev/null
+++ b/patches.arch/x86-PCI-Add-pci-big_root_window-option-for-AMD-64-bi.patch
@@ -0,0 +1,109 @@
+From f32ab7547161b9fa7ebfbc4f18ea1eb3fd49fe25 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=3D=3FUTF-8=3Fq=3FChristian=3D20K=3DC3=3DB6nig=3F=3D?= <ckoenig.leichtzumerken@gmail.com>
+Date: Thu, 11 Jan 2018 14:23:29 +0100
+Subject: [PATCH] x86/PCI: Add "pci=big_root_window" option for AMD 64-bit windows
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: f32ab7547161b9fa7ebfbc4f18ea1eb3fd49fe25
+Patch-mainline: v4.15-rc8
+References: bsc#1120058
+
+Only try to enable a 64-bit window on AMD CPUs when "pci=big_root_window"
+is specified.
+
+This taints the kernel because the new 64-bit window uses address space we
+don't know anything about, and it may contain unreported devices or memory
+that would conflict with the window.
+
+The pci_amd_enable_64bit_bar() quirk that enables the window is specific to
+AMD CPUs. The generic solution would be to have the firmware enable the
+window and describe it in the host bridge's _CRS method, or at least
+describe it in the _PRS method so the OS would have the option of enabling
+it.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+[bhelgaas: changelog, extend doc, mention taint in dmesg]
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ Documentation/admin-guide/kernel-parameters.txt | 6 ++++++
+ arch/x86/include/asm/pci_x86.h | 1 +
+ arch/x86/pci/common.c | 5 +++++
+ arch/x86/pci/fixup.c | 7 ++++++-
+ 4 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
+index 6571fbfdb2a1..619638362416 100644
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3094,6 +3094,12 @@
+ pcie_scan_all Scan all possible PCIe devices. Otherwise we
+ only look for one device below a PCIe downstream
+ port.
++ big_root_window Try to add a big 64bit memory window to the PCIe
++ root complex on AMD CPUs. Some GFX hardware
++ can resize a BAR to allow access to all VRAM.
++ Adding the window is slightly risky (it may
++ conflict with unreported devices), so this
++ taints the kernel.
+
+ pcie_aspm= [PCIE] Forcibly enable or disable PCIe Active State Power
+ Management.
+diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
+index 7a5d6695abd3..eb66fa9cd0fc 100644
+--- a/arch/x86/include/asm/pci_x86.h
++++ b/arch/x86/include/asm/pci_x86.h
+@@ -38,6 +38,7 @@ do { \
+ #define PCI_NOASSIGN_ROMS 0x80000
+ #define PCI_ROOT_NO_CRS 0x100000
+ #define PCI_NOASSIGN_BARS 0x200000
++#define PCI_BIG_ROOT_WINDOW 0x400000
+
+ extern unsigned int pci_probe;
+ extern unsigned long pirq_table_addr;
+diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
+index 7a5350d08cef..563049c483a1 100644
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -594,6 +594,11 @@ char *__init pcibios_setup(char *str)
+ } else if (!strcmp(str, "nocrs")) {
+ pci_probe |= PCI_ROOT_NO_CRS;
+ return NULL;
++#ifdef CONFIG_PHYS_ADDR_T_64BIT
++ } else if (!strcmp(str, "big_root_window")) {
++ pci_probe |= PCI_BIG_ROOT_WINDOW;
++ return NULL;
++#endif
+ } else if (!strcmp(str, "earlydump")) {
+ pci_early_dump_regs = 1;
+ return NULL;
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index e663d6bf1328..8bad19c7473d 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -667,6 +667,9 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ struct resource *res, *conflict;
+ struct pci_dev *other;
+
++ if (!(pci_probe & PCI_BIG_ROOT_WINDOW))
++ return;
++
+ /* Check that we are the only device of that type */
+ other = pci_get_device(dev->vendor, dev->device, NULL);
+ if (other != dev ||
+@@ -714,7 +717,9 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ res->start = conflict->end + 1;
+ }
+
+- dev_info(&dev->dev, "adding root bus resource %pR\n", res);
++ dev_info(&dev->dev, "adding root bus resource %pR (tainting kernel)\n",
++ res);
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
+
+ base = ((res->start >> 8) & AMD_141b_MMIO_BASE_MMIOBASE_MASK) |
+ AMD_141b_MMIO_BASE_RE_MASK | AMD_141b_MMIO_BASE_WE_MASK;
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Apply-VMD-s-AERSID-fixup-generically.patch b/patches.arch/x86-PCI-Apply-VMD-s-AERSID-fixup-generically.patch
new file mode 100644
index 0000000000..9165297924
--- /dev/null
+++ b/patches.arch/x86-PCI-Apply-VMD-s-AERSID-fixup-generically.patch
@@ -0,0 +1,48 @@
+From 4f475e8e0a6d4f5d430350d1f74f7e4899fb1692 Mon Sep 17 00:00:00 2001
+From: Jon Derrick <jonathan.derrick@intel.com>
+Date: Fri, 7 Sep 2018 13:22:30 -0600
+Subject: [PATCH] x86/PCI: Apply VMD's AERSID fixup generically
+Git-commit: 4f475e8e0a6d4f5d430350d1f74f7e4899fb1692
+Patch-mainline: v4.20-rc1
+References: bsc#1120058
+
+A root port Device ID changed between simulation and production. Rather
+than match Device IDs which may not be future-proof if left unmaintained,
+match all root ports which exist in a VMD domain.
+
+Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 13f4485ca388..30a5111ae5fd 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -629,17 +629,11 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x8c10, quirk_apple_mbp_poweroff);
+ static void quirk_no_aersid(struct pci_dev *pdev)
+ {
+ /* VMD Domain */
+- if (is_vmd(pdev->bus))
++ if (is_vmd(pdev->bus) && pci_is_root_bus(pdev->bus))
+ pdev->bus->bus_flags |= PCI_BUS_FLAGS_NO_AERSID;
+ }
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2030, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2031, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2032, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334a, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334b, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334c, quirk_no_aersid);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x334d, quirk_no_aersid);
++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID,
++ PCI_CLASS_BRIDGE_PCI, 8, quirk_no_aersid);
+
+ #ifdef CONFIG_PHYS_ADDR_T_64BIT
+
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Avoid-AMD-SB7xx-EHCI-USB-wakeup-defect.patch b/patches.arch/x86-PCI-Avoid-AMD-SB7xx-EHCI-USB-wakeup-defect.patch
new file mode 100644
index 0000000000..70aa6cb5c1
--- /dev/null
+++ b/patches.arch/x86-PCI-Avoid-AMD-SB7xx-EHCI-USB-wakeup-defect.patch
@@ -0,0 +1,59 @@
+From 0bf3730bbc41f155543fa63becb4ff436d6a00a9 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Fri, 16 Jun 2017 17:40:54 +0800
+Subject: [PATCH] x86/PCI: Avoid AMD SB7xx EHCI USB wakeup defect
+Git-commit: 0bf3730bbc41f155543fa63becb4ff436d6a00a9
+Patch-mainline: v4.13-rc1
+References: bsc#1120058
+
+On an AMD Carrizo laptop, when EHCI runtime PM is enabled, EHCI ports do
+not assert PME# for device plug/unplug events while in D3.
+
+As Alan Stern points out [1], the PME signal is not enabled when controller
+is in D3, therefore it's not being woken up when new devices get plugged
+in.
+
+Testing shows PME signal works when the EHCI power state is D2.
+
+Clear the PCI_PM_CAP_PME_D3 and PCI_PM_CAP_PME_D3cold bits in
+dev->pme_support to indicate the device will not assert PME# from those
+states.
+
+[1] http://lkml.kernel.org/r/Pine.LNX.4.44L0.1706121010010.2092-100000@iolanthe.rowland.org
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=196091
+Link: https://support.amd.com/TechDocs/46837.pdf (Section 23)
+Link: https://support.amd.com/TechDocs/42413.pdf (Appendix A2)
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+[bhelgaas: changelog, add parens in quirk]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -573,6 +573,21 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_IN
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar);
+
+ /*
++ * Device [1022:7808]
++ * 23. USB Wake on Connect/Disconnect with Low Speed Devices
++ * https://support.amd.com/TechDocs/46837.pdf
++ * Appendix A2
++ * https://support.amd.com/TechDocs/42413.pdf
++ */
++static void pci_fixup_amd_ehci_pme(struct pci_dev *dev)
++{
++ dev_info(&dev->dev, "PME# does not work under D3, disabling it\n");
++ dev->pme_support &= ~((PCI_PM_CAP_PME_D3 | PCI_PM_CAP_PME_D3cold)
++ >> PCI_PM_CAP_PME_SHIFT);
++}
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7808, pci_fixup_amd_ehci_pme);
++
++/*
+ * Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff]
+ *
+ * Using the [mem 0x7fa00000-0x7fbfffff] region, e.g., by assigning it to
diff --git a/patches.arch/x86-PCI-Enable-AMD-64-bit-window-on-resume.patch b/patches.arch/x86-PCI-Enable-AMD-64-bit-window-on-resume.patch
new file mode 100644
index 0000000000..fa1f18c9f5
--- /dev/null
+++ b/patches.arch/x86-PCI-Enable-AMD-64-bit-window-on-resume.patch
@@ -0,0 +1,98 @@
+From 838cda3697073982acd276ac43387b2a0aed04b4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=3D=3FUTF-8=3Fq=3FChristian=3D20K=3DC3=3DB6nig=3F=3D?= <ckoenig.leichtzumerken@gmail.com>
+Date: Tue, 16 Jan 2018 10:43:17 +0100
+Subject: [PATCH] x86/PCI: Enable AMD 64-bit window on resume
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 838cda3697073982acd276ac43387b2a0aed04b4
+Patch-mainline: v4.15
+References: bsc#1120058
+
+Reenable the 64-bit window during resume.
+
+Fixes: fa564ad96366 ("x86/PCI: Enable a 64bit BAR on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)")
+Reported-by: Tom St Denis <tom.stdenis@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 32 ++++++++++++++++++++------------
+ 1 file changed, 20 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index f6a26e3cb476..54ef19e90705 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -662,11 +662,11 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
+ */
+ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ {
++ static const char *name = "PCI Bus 0000:00";
++ struct resource *res, *conflict;
+ u32 base, limit, high;
+ struct pci_dev *other;
+- struct resource *res;
+ unsigned i;
+- int r;
+
+ if (!(pci_probe & PCI_BIG_ROOT_WINDOW))
+ return;
+@@ -707,21 +707,26 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ * Allocate a 256GB window directly below the 0xfd00000000 hardware
+ * limit (see AMD Family 15h Models 30h-3Fh BKDG, sec 2.4.6).
+ */
+- res->name = "PCI Bus 0000:00";
++ res->name = name;
+ res->flags = IORESOURCE_PREFETCH | IORESOURCE_MEM |
+ IORESOURCE_MEM_64 | IORESOURCE_WINDOW;
+ res->start = 0xbd00000000ull;
+ res->end = 0xfd00000000ull - 1;
+
+- r = request_resource(&iomem_resource, res);
+- if (r) {
++ conflict = request_resource_conflict(&iomem_resource, res);
++ if (conflict) {
+ kfree(res);
+- return;
+- }
++ if (conflict->name != name)
++ return;
+
+- dev_info(&dev->dev, "adding root bus resource %pR (tainting kernel)\n",
+- res);
+- add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
++ /* We are resuming from suspend; just reenable the window */
++ res = conflict;
++ } else {
++ dev_info(&dev->dev, "adding root bus resource %pR (tainting kernel)\n",
++ res);
++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
++ pci_bus_add_resource(dev->bus, res, 0);
++ }
+
+ base = ((res->start >> 8) & AMD_141b_MMIO_BASE_MMIOBASE_MASK) |
+ AMD_141b_MMIO_BASE_RE_MASK | AMD_141b_MMIO_BASE_WE_MASK;
+@@ -733,13 +738,16 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ pci_write_config_dword(dev, AMD_141b_MMIO_HIGH(i), high);
+ pci_write_config_dword(dev, AMD_141b_MMIO_LIMIT(i), limit);
+ pci_write_config_dword(dev, AMD_141b_MMIO_BASE(i), base);
+-
+- pci_bus_add_resource(dev->bus, res, 0);
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
+
+ #endif
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Enable-a-64bit-BAR-on-AMD-Family-15h-Models-.patch b/patches.arch/x86-PCI-Enable-a-64bit-BAR-on-AMD-Family-15h-Models-.patch
new file mode 100644
index 0000000000..8b0a4551b1
--- /dev/null
+++ b/patches.arch/x86-PCI-Enable-a-64bit-BAR-on-AMD-Family-15h-Models-.patch
@@ -0,0 +1,121 @@
+From fa564ad9636651fd11ec2c79c48dee844066f73a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Tue, 24 Oct 2017 14:40:29 -0500
+Subject: [PATCH] x86/PCI: Enable a 64bit BAR on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: fa564ad9636651fd11ec2c79c48dee844066f73a
+Patch-mainline: v4.15-rc1
+References: bsc#1120058
+
+Manually enable a 64GB 64-bit BAR so we have enough room for graphics
+devices with large framebuffers.
+
+Most BIOSes don't enable this for compatibility reasons.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 85 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 85 insertions(+)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index f2228b150faa..e59378bf37d9 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -635,3 +635,88 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2030, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2031, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2032, quirk_no_aersid);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
++
++#ifdef CONFIG_PHYS_ADDR_T_64BIT
++
++#define AMD_141b_MMIO_BASE(x) (0x80 + (x) * 0x8)
++#define AMD_141b_MMIO_BASE_RE_MASK BIT(0)
++#define AMD_141b_MMIO_BASE_WE_MASK BIT(1)
++#define AMD_141b_MMIO_BASE_MMIOBASE_MASK GENMASK(31,8)
++
++#define AMD_141b_MMIO_LIMIT(x) (0x84 + (x) * 0x8)
++#define AMD_141b_MMIO_LIMIT_MMIOLIMIT_MASK GENMASK(31,8)
++
++#define AMD_141b_MMIO_HIGH(x) (0x180 + (x) * 0x4)
++#define AMD_141b_MMIO_HIGH_MMIOBASE_MASK GENMASK(7,0)
++#define AMD_141b_MMIO_HIGH_MMIOLIMIT_SHIFT 16
++#define AMD_141b_MMIO_HIGH_MMIOLIMIT_MASK GENMASK(23,16)
++
++/*
++ * The PCI Firmware Spec, rev 3.2, notes that ACPI should optionally allow
++ * configuring host bridge windows using the _PRS and _SRS methods.
++ *
++ * But this is rarely implemented, so we manually enable a large 64bit BAR for
++ * PCIe device on AMD Family 15h (Models 00h-1fh, 30h-3fh, 60h-7fh) Processors
++ * here.
++ */
++static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
++{
++ unsigned i;
++ u32 base, limit, high;
++ struct resource *res, *conflict;
++
++ for (i = 0; i < 8; i++) {
++ pci_read_config_dword(dev, AMD_141b_MMIO_BASE(i), &base);
++ pci_read_config_dword(dev, AMD_141b_MMIO_HIGH(i), &high);
++
++ /* Is this slot free? */
++ if (!(base & (AMD_141b_MMIO_BASE_RE_MASK |
++ AMD_141b_MMIO_BASE_WE_MASK)))
++ break;
++
++ base >>= 8;
++ base |= high << 24;
++
++ /* Abort if a slot already configures a 64bit BAR. */
++ if (base > 0x10000)
++ return;
++ }
++ if (i == 8)
++ return;
++
++ res = kzalloc(sizeof(*res), GFP_KERNEL);
++ if (!res)
++ return;
++
++ res->name = "PCI Bus 0000:00";
++ res->flags = IORESOURCE_PREFETCH | IORESOURCE_MEM |
++ IORESOURCE_MEM_64 | IORESOURCE_WINDOW;
++ res->start = 0x100000000ull;
++ res->end = 0xfd00000000ull - 1;
++
++ /* Just grab the free area behind system memory for this */
++ while ((conflict = request_resource_conflict(&iomem_resource, res)))
++ res->start = conflict->end + 1;
++
++ dev_info(&dev->dev, "adding root bus resource %pR\n", res);
++
++ base = ((res->start >> 8) & AMD_141b_MMIO_BASE_MMIOBASE_MASK) |
++ AMD_141b_MMIO_BASE_RE_MASK | AMD_141b_MMIO_BASE_WE_MASK;
++ limit = ((res->end + 1) >> 8) & AMD_141b_MMIO_LIMIT_MMIOLIMIT_MASK;
++ high = ((res->start >> 40) & AMD_141b_MMIO_HIGH_MMIOBASE_MASK) |
++ ((((res->end + 1) >> 40) << AMD_141b_MMIO_HIGH_MMIOLIMIT_SHIFT)
++ & AMD_141b_MMIO_HIGH_MMIOLIMIT_MASK);
++
++ pci_write_config_dword(dev, AMD_141b_MMIO_HIGH(i), high);
++ pci_write_config_dword(dev, AMD_141b_MMIO_LIMIT(i), limit);
++ pci_write_config_dword(dev, AMD_141b_MMIO_BASE(i), base);
++
++ pci_bus_add_resource(dev->bus, res, 0);
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
++
++#endif
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Fix-infinite-loop-in-search-for-64bit-BAR-pl.patch b/patches.arch/x86-PCI-Fix-infinite-loop-in-search-for-64bit-BAR-pl.patch
new file mode 100644
index 0000000000..6185c80525
--- /dev/null
+++ b/patches.arch/x86-PCI-Fix-infinite-loop-in-search-for-64bit-BAR-pl.patch
@@ -0,0 +1,43 @@
+From 470195f82e4ea550b7c37736a12bf3fa565295ea Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Wed, 29 Nov 2017 15:12:27 +0100
+Subject: [PATCH] x86/PCI: Fix infinite loop in search for 64bit BAR placement
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 470195f82e4ea550b7c37736a12bf3fa565295ea
+Patch-mainline: v4.15-rc4
+References: bsc#1120058
+
+Break the loop if we can't find some address space for a 64bit BAR.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 1e996df687a3..5328e86f73eb 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -696,8 +696,13 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ res->end = 0xfd00000000ull - 1;
+
+ /* Just grab the free area behind system memory for this */
+- while ((conflict = request_resource_conflict(&iomem_resource, res)))
++ while ((conflict = request_resource_conflict(&iomem_resource, res))) {
++ if (conflict->end >= res->end) {
++ kfree(res);
++ return;
++ }
+ res->start = conflict->end + 1;
++ }
+
+ dev_info(&dev->dev, "adding root bus resource %pR\n", res);
+
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Move-and-shrink-AMD-64-bit-window-to-avoid-c.patch b/patches.arch/x86-PCI-Move-and-shrink-AMD-64-bit-window-to-avoid-c.patch
new file mode 100644
index 0000000000..943b0c556b
--- /dev/null
+++ b/patches.arch/x86-PCI-Move-and-shrink-AMD-64-bit-window-to-avoid-c.patch
@@ -0,0 +1,83 @@
+From 03a551734cfc2b93f83950a595974e3c9cbd82fd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=3D=3FUTF-8=3Fq=3FChristian=3D20K=3DC3=3DB6nig=3F=3D?= <ckoenig.leichtzumerken@gmail.com>
+Date: Thu, 11 Jan 2018 14:23:30 +0100
+Subject: [PATCH] x86/PCI: Move and shrink AMD 64-bit window to avoid conflict
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 03a551734cfc2b93f83950a595974e3c9cbd82fd
+Patch-mainline: v4.15-rc8
+References: bsc#1120058
+
+Avoid problems with BIOS implementations which don't report all used
+resources to the OS by only allocating a 256GB window directly below the
+hardware limit (from the BKDG, sec 2.4.6).
+
+Fixes a silent reboot loop reported by Aaro Koskinen <aaro.koskinen@iki.fi>
+on an AMD-based MSI MS-7699/760GA-P43(FX) system. This was apparently
+caused by RAM or other unreported hardware that conflicted with the new
+window.
+
+Link: https://support.amd.com/TechDocs/49125_15h_Models_30h-3Fh_BKDG.pdf
+Link: https://lkml.kernel.org/r/20180105220412.fzpwqe4zljdawr36@darkstar.musicnaut.iki.fi
+Fixes: fa564ad96366 ("x86/PCI: Enable a 64bit BAR on AMD Family 15h (Models 00-1f, 30-3f, 60-7f)")
+Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+[bhelgaas: changelog, comment, Fixes:]
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 8bad19c7473d..f6a26e3cb476 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -662,10 +662,11 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2033, quirk_no_aersid);
+ */
+ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ {
+- unsigned i;
+ u32 base, limit, high;
+- struct resource *res, *conflict;
+ struct pci_dev *other;
++ struct resource *res;
++ unsigned i;
++ int r;
+
+ if (!(pci_probe & PCI_BIG_ROOT_WINDOW))
+ return;
+@@ -702,19 +703,20 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ if (!res)
+ return;
+
++ /*
++ * Allocate a 256GB window directly below the 0xfd00000000 hardware
++ * limit (see AMD Family 15h Models 30h-3Fh BKDG, sec 2.4.6).
++ */
+ res->name = "PCI Bus 0000:00";
+ res->flags = IORESOURCE_PREFETCH | IORESOURCE_MEM |
+ IORESOURCE_MEM_64 | IORESOURCE_WINDOW;
+- res->start = 0x100000000ull;
++ res->start = 0xbd00000000ull;
+ res->end = 0xfd00000000ull - 1;
+
+- /* Just grab the free area behind system memory for this */
+- while ((conflict = request_resource_conflict(&iomem_resource, res))) {
+- if (conflict->end >= res->end) {
+- kfree(res);
+- return;
+- }
+- res->start = conflict->end + 1;
++ r = request_resource(&iomem_resource, res);
++ if (r) {
++ kfree(res);
++ return;
+ }
+
+ dev_info(&dev->dev, "adding root bus resource %pR (tainting kernel)\n",
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Only-enable-a-64bit-BAR-on-single-socket-AMD.patch b/patches.arch/x86-PCI-Only-enable-a-64bit-BAR-on-single-socket-AMD.patch
new file mode 100644
index 0000000000..de3e040660
--- /dev/null
+++ b/patches.arch/x86-PCI-Only-enable-a-64bit-BAR-on-single-socket-AMD.patch
@@ -0,0 +1,63 @@
+From a19e2696135efb471981c1ae1ec3cb2b70c41a2e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Wed, 29 Nov 2017 15:12:28 +0100
+Subject: [PATCH] x86/PCI: Only enable a 64bit BAR on single-socket AMD Family 15h
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: a19e2696135efb471981c1ae1ec3cb2b70c41a2e
+Patch-mainline: v4.15-rc4
+References: bsc#1120058
+
+When we have a multi-socket system, each CPU core needs the same setup.
+Since this is tricky to do in the fixup code, don't enable a 64bit BAR on
+multi-socket systems for now.
+
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 5328e86f73eb..e663d6bf1328 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -665,6 +665,16 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+ unsigned i;
+ u32 base, limit, high;
+ struct resource *res, *conflict;
++ struct pci_dev *other;
++
++ /* Check that we are the only device of that type */
++ other = pci_get_device(dev->vendor, dev->device, NULL);
++ if (other != dev ||
++ (other = pci_get_device(dev->vendor, dev->device, other))) {
++ /* This is a multi-socket system, don't touch it for now */
++ pci_dev_put(other);
++ return;
++ }
+
+ for (i = 0; i < 8; i++) {
+ pci_read_config_dword(dev, AMD_141b_MMIO_BASE(i), &base);
+@@ -719,10 +729,10 @@ static void pci_amd_enable_64bit_bar(struct pci_dev *dev)
+
+ pci_bus_add_resource(dev->bus, res, 0);
+ }
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
+-DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1401, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x141b, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1571, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x15b1, pci_amd_enable_64bit_bar);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x1601, pci_amd_enable_64bit_bar);
+
+ #endif
+--
+2.20.1
+
diff --git a/patches.arch/x86-PCI-Use-is_vmd-rather-than-relying-on-the-domain.patch b/patches.arch/x86-PCI-Use-is_vmd-rather-than-relying-on-the-domain.patch
new file mode 100644
index 0000000000..61919e25bb
--- /dev/null
+++ b/patches.arch/x86-PCI-Use-is_vmd-rather-than-relying-on-the-domain.patch
@@ -0,0 +1,35 @@
+From c37f23d44e866d079d30399cb358dd19617562a1 Mon Sep 17 00:00:00 2001
+From: Jon Derrick <jonathan.derrick@intel.com>
+Date: Thu, 17 Aug 2017 12:10:13 -0600
+Subject: [PATCH] x86/PCI: Use is_vmd() rather than relying on the domain number
+Git-commit: c37f23d44e866d079d30399cb358dd19617562a1
+Patch-mainline: v4.14-rc1
+References: bsc#1120058
+
+Use the is_vmd() predicate to identify devices below a VMD host rather than
+relying on the domain number.
+
+Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/pci/fixup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
+index 4c2e318845ba..f2228b150faa 100644
+--- a/arch/x86/pci/fixup.c
++++ b/arch/x86/pci/fixup.c
+@@ -628,7 +628,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x8c10, quirk_apple_mbp_poweroff);
+ static void quirk_no_aersid(struct pci_dev *pdev)
+ {
+ /* VMD Domain */
+- if (pdev->bus->sysdata && pci_domain_nr(pdev->bus) >= 0x10000)
++ if (is_vmd(pdev->bus))
+ pdev->bus->bus_flags |= PCI_BUS_FLAGS_NO_AERSID;
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2030, quirk_no_aersid);
+--
+2.20.1
+
diff --git a/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch b/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch
new file mode 100644
index 0000000000..ad6d385a05
--- /dev/null
+++ b/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch
@@ -0,0 +1,156 @@
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 1 Jun 2018 10:59:20 -0400
+Subject: x86/bugs: Add AMD's SPEC_CTRL MSR usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 6ac2f49edb1ef5446089c7c660017732886d62d6
+Patch-mainline: v4.18-rc1
+References: bsc#1106913
+
+The AMD document outlining the SSBD handling
+124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf
+mentions that if CPUID 8000_0008.EBX[24] is set we should be using
+the SPEC_CTRL MSR (0x48) over the VIRT SPEC_CTRL MSR (0xC001_011f)
+for speculative store bypass disable.
+
+This in effect means we should clear the X86_FEATURE_VIRT_SSBD
+flag so that we would prefer the SPEC_CTRL MSR.
+
+See the document titled:
+ 124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf
+
+A copy of this document is available at
+ https://bugzilla.kernel.org/show_bug.cgi?id=199889
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
+Cc: kvm@vger.kernel.org
+Cc: KarimAllah Ahmed <karahmed@amazon.de>
+Cc: andrew.cooper3@citrix.com
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Kees Cook <keescook@chromium.org>
+Link: https://lkml.kernel.org/r/20180601145921.9500-3-konrad.wilk@oracle.com
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/cpufeatures.h | 1 +
+ arch/x86/kernel/cpu/bugs.c | 12 +++++++-----
+ arch/x86/kernel/cpu/common.c | 6 ++++++
+ arch/x86/kvm/cpuid.c | 9 +++++++--
+ arch/x86/kvm/svm.c | 8 +++++---
+ 5 files changed, 26 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -283,6 +283,7 @@
+ #define X86_FEATURE_AMD_IBPB (13*32+12) /* "" Indirect Branch Prediction Barrier */
+ #define X86_FEATURE_AMD_IBRS (13*32+14) /* "" Indirect Branch Restricted Speculation */
+ #define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */
++#define X86_FEATURE_AMD_SSBD (13*32+24) /* "" Speculative Store Bypass Disable */
+ #define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */
+
+ /* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -528,18 +528,20 @@ static enum ssb_mitigation __init __ssb_
+ if (mode == SPEC_STORE_BYPASS_DISABLE) {
+ setup_force_cpu_cap(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE);
+ /*
+- * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD uses
+- * a completely different MSR and bit dependent on family.
++ * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD may
++ * use a completely different MSR and bit dependent on family.
+ */
+ switch (boot_cpu_data.x86_vendor) {
+ case X86_VENDOR_INTEL:
++ case X86_VENDOR_AMD:
++ if (!static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) {
++ x86_amd_ssb_disable();
++ break;
++ }
+ x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
+ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+ break;
+- case X86_VENDOR_AMD:
+- x86_amd_ssb_disable();
+- break;
+ }
+ }
+
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -766,6 +766,12 @@ static void init_speculation_control(str
+ set_cpu_cap(c, X86_FEATURE_STIBP);
+ set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL);
+ }
++
++ if (cpu_has(c, X86_FEATURE_AMD_SSBD)) {
++ set_cpu_cap(c, X86_FEATURE_SSBD);
++ set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL);
++ clear_cpu_cap(c, X86_FEATURE_VIRT_SSBD);
++ }
+ }
+
+ void get_cpu_cap(struct cpuinfo_x86 *c)
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -367,7 +367,7 @@ static inline int __do_cpuid_ent(struct
+
+ /* cpuid 0x80000008.ebx */
+ const u32 kvm_cpuid_8000_0008_ebx_x86_features =
+- F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD);
++ F(AMD_IBPB) | F(AMD_IBRS) | F(AMD_SSBD) | F(VIRT_SSBD);
+
+ /* cpuid 0xC0000001.edx */
+ const u32 kvm_cpuid_C000_0001_edx_x86_features =
+@@ -648,7 +648,12 @@ static inline int __do_cpuid_ent(struct
+ entry->ebx |= F(VIRT_SSBD);
+ entry->ebx &= kvm_cpuid_8000_0008_ebx_x86_features;
+ cpuid_mask(&entry->ebx, CPUID_8000_0008_EBX);
+- if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD))
++ /*
++ * The preference is to use SPEC CTRL MSR instead of the
++ * VIRT_SPEC MSR.
++ */
++ if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD) &&
++ !boot_cpu_has(X86_FEATURE_AMD_SSBD))
+ entry->ebx |= F(VIRT_SSBD);
+ break;
+ }
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4062,7 +4062,8 @@ static int svm_get_msr(struct kvm_vcpu *
+ break;
+ case MSR_IA32_SPEC_CTRL:
+ if (!msr_info->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS))
++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
+ return 1;
+
+ msr_info->data = svm->spec_ctrl;
+@@ -4170,11 +4171,12 @@ static int svm_set_msr(struct kvm_vcpu *
+ break;
+ case MSR_IA32_SPEC_CTRL:
+ if (!msr->host_initiated &&
+- !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS))
++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS) &&
++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_SSBD))
+ return 1;
+
+ /* The STIBP bit doesn't fault even if it's not advertised */
+- if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP))
++ if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD))
+ return 1;
+
+ svm->spec_ctrl = data;
diff --git a/patches.arch/x86-bugs-fix-the-amd-ssbd-usage-of-the-spec_ctrl-msr.patch b/patches.arch/x86-bugs-fix-the-amd-ssbd-usage-of-the-spec_ctrl-msr.patch
new file mode 100644
index 0000000000..4c487b8255
--- /dev/null
+++ b/patches.arch/x86-bugs-fix-the-amd-ssbd-usage-of-the-spec_ctrl-msr.patch
@@ -0,0 +1,58 @@
+From: Tom Lendacky <thomas.lendacky@amd.com>
+Date: Mon, 2 Jul 2018 16:36:02 -0500
+Subject: x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
+Git-commit: 612bc3b3d4be749f73a513a17d9b3ee1330d3487
+Patch-mainline: v4.18-rc4
+References: bsc#1106913
+
+On AMD, the presence of the MSR_SPEC_CTRL feature does not imply that the
+SSBD mitigation support should use the SPEC_CTRL MSR. Other features could
+have caused the MSR_SPEC_CTRL feature to be set, while a different SSBD
+mitigation option is in place.
+
+Update the SSBD support to check for the actual SSBD features that will
+use the SPEC_CTRL MSR.
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Borislav Petkov <bpetkov@suse.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Fixes: 6ac2f49edb1e ("x86/bugs: Add AMD's SPEC_CTRL MSR usage")
+Link: http://lkml.kernel.org/r/20180702213602.29202.33151.stgit@tlendack-t1.amdoffice.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 404df26b7de8..5c0ea39311fe 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -155,7 +155,8 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ guestval |= guest_spec_ctrl & x86_spec_ctrl_mask;
+
+ /* SSBD controlled in MSR_SPEC_CTRL */
+- if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD))
++ if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
++ static_cpu_has(X86_FEATURE_AMD_SSBD))
+ hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
+
+ if (hostval != guestval) {
+@@ -533,9 +534,10 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD may
+ * use a completely different MSR and bit dependent on family.
+ */
+- if (!static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
++ if (!static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) &&
++ !static_cpu_has(X86_FEATURE_AMD_SSBD)) {
+ x86_amd_ssb_disable();
+- else {
++ } else {
+ x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
+ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+
diff --git a/patches.arch/x86-bugs-switch-the-selection-of-mitigation-from-cpu-vendor-to-cpu-features.patch b/patches.arch/x86-bugs-switch-the-selection-of-mitigation-from-cpu-vendor-to-cpu-features.patch
new file mode 100644
index 0000000000..12ab108000
--- /dev/null
+++ b/patches.arch/x86-bugs-switch-the-selection-of-mitigation-from-cpu-vendor-to-cpu-features.patch
@@ -0,0 +1,55 @@
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 1 Jun 2018 10:59:21 -0400
+Subject: x86/bugs: Switch the selection of mitigation from CPU vendor to CPU
+ features
+Git-commit: 108fab4b5c8f12064ef86e02cb0459992affb30f
+Patch-mainline: v4.18-rc1
+References: bsc#1106913
+
+Both AMD and Intel can have SPEC_CTRL_MSR for SSBD.
+
+However AMD also has two more other ways of doing it - which
+are !SPEC_CTRL MSR ways.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: kvm@vger.kernel.org
+Cc: KarimAllah Ahmed <karahmed@amazon.de>
+Cc: andrew.cooper3@citrix.com
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Link: https://lkml.kernel.org/r/20180601145921.9500-4-konrad.wilk@oracle.com
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 11 +++--------
+ 1 file changed, 3 insertions(+), 8 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 6bea81855cdd..cd0fda1fff6d 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -532,17 +532,12 @@ static enum ssb_mitigation __init __ssb_select_mitigation(void)
+ * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD may
+ * use a completely different MSR and bit dependent on family.
+ */
+- switch (boot_cpu_data.x86_vendor) {
+- case X86_VENDOR_INTEL:
+- case X86_VENDOR_AMD:
+- if (!static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) {
+- x86_amd_ssb_disable();
+- break;
+- }
++ if (!static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL))
++ x86_amd_ssb_disable();
++ else {
+ x86_spec_ctrl_base |= SPEC_CTRL_SSBD;
+ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD;
+ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+- break;
+ }
+ }
+
+
diff --git a/patches.arch/x86-build-Fix-compiler-support-check-for-CONFIG_RETP.patch b/patches.arch/x86-build-Fix-compiler-support-check-for-CONFIG_RETP.patch
new file mode 100644
index 0000000000..b90a3879f9
--- /dev/null
+++ b/patches.arch/x86-build-Fix-compiler-support-check-for-CONFIG_RETP.patch
@@ -0,0 +1,70 @@
+From 25896d073d8a0403b07e6dec56f58e6c33678207 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Wed, 5 Dec 2018 15:27:19 +0900
+Subject: [PATCH] x86/build: Fix compiler support check for CONFIG_RETPOLINE
+Git-commit: 25896d073d8a0403b07e6dec56f58e6c33678207
+Patch-mainline: v4.20-rc6
+References: bsc#1121017
+
+It is troublesome to add a diagnostic like this to the Makefile
+parse stage because the top-level Makefile could be parsed with
+a stale include/config/auto.conf.
+
+Once you are hit by the error about non-retpoline compiler, the
+compilation still breaks even after disabling CONFIG_RETPOLINE.
+
+The easiest fix is to move this check to the "archprepare" like
+this commit did:
+
+ 829fe4aa9ac1 ("x86: Allow generating user-space headers without a compiler")
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Fixes: 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support")
+Link: http://lkml.kernel.org/r/1543991239-18476-1-git-send-email-yamada.masahiro@socionext.com
+Link: https://lkml.org/lkml/2018/12/4/206
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/x86/Makefile | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -230,9 +230,6 @@ KBUILD_AFLAGS += $(mflags-y)
+ # Avoid indirect branches in kernel to deal with Spectre
+ ifdef CONFIG_RETPOLINE
+ RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
+-ifeq ($(RETPOLINE_CFLAGS),)
+- $(error You are building kernel with non-retpoline compiler, please update your compiler.)
+- endif
+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+ endif
+
+@@ -308,9 +305,18 @@ install:
+ $(Q)$(MAKE) $(build)=$(boot) $@
+
+ PHONY += vdso_install
++
+ vdso_install:
+ $(Q)$(MAKE) $(build)=arch/x86/entry/vdso $@
+
++ifdef CONFIG_RETPOLINE
++ifeq ($(RETPOLINE_CFLAGS),)
++ @echo "You are building kernel with non-retpoline compiler." >&2
++ @echo "Please update your compiler." >&2
++ @false
++endif
++endif
++
+ archclean:
+ $(Q)rm -rf $(objtree)/arch/i386
+ $(Q)rm -rf $(objtree)/arch/x86_64
diff --git a/patches.arch/x86-l1tf-show-actual-smt-state.patch b/patches.arch/x86-l1tf-show-actual-smt-state.patch
new file mode 100644
index 0000000000..1a9c35c007
--- /dev/null
+++ b/patches.arch/x86-l1tf-show-actual-smt-state.patch
@@ -0,0 +1,63 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:40 +0100
+Subject: x86/l1tf: Show actual SMT state
+Git-commit: 130d6f946f6f2a972ee3ec8540b7243ab99abe97
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Use the now exposed real SMT state, not the SMT sysfs control knob
+state. This reflects the state of the system when the mitigation status is
+queried.
+
+This does not change the warning in the VMX launch code. There the
+dependency on the control knob makes sense because siblings could be
+brought online anytime after launching the VM.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.613357354@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -847,13 +847,14 @@ static ssize_t l1tf_show_state(char *buf
+
+ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED ||
+ (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER &&
+- cpu_smt_control == CPU_SMT_ENABLED))
++ sched_smt_active())) {
+ return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG,
+ l1tf_vmx_states[l1tf_vmx_mitigation]);
++ }
+
+ return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG,
+ l1tf_vmx_states[l1tf_vmx_mitigation],
+- cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled");
++ sched_smt_active() ? "vulnerable" : "disabled");
+ }
+ #else
+ static ssize_t l1tf_show_state(char *buf)
diff --git a/patches.arch/x86-process-consolidate-and-simplify-switch_to_xtra-code.patch b/patches.arch/x86-process-consolidate-and-simplify-switch_to_xtra-code.patch
new file mode 100644
index 0000000000..67772210ea
--- /dev/null
+++ b/patches.arch/x86-process-consolidate-and-simplify-switch_to_xtra-code.patch
@@ -0,0 +1,200 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:47 +0100
+Subject: x86/process: Consolidate and simplify switch_to_xtra() code
+Git-commit: ff16701a29cba3aafa0bd1656d766813b2d0a811
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Move the conditional invocation of __switch_to_xtra() into an inline
+function so the logic can be shared between 32 and 64 bit.
+
+Remove the handthrough of the TSS pointer and retrieve the pointer directly
+in the bitmap handling function. Use this_cpu_ptr() instead of the
+per_cpu() indirection.
+
+This is a preparatory change so integration of conditional indirect branch
+speculation optimization happens only in one place.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.280855518@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/switch_to.h | 3 ---
+ arch/x86/kernel/process.c | 12 +++++++-----
+ arch/x86/kernel/process.h | 24 ++++++++++++++++++++++++
+ arch/x86/kernel/process_32.c | 10 +++-------
+ arch/x86/kernel/process_64.c | 10 +++-------
+ 5 files changed, 37 insertions(+), 22 deletions(-)
+
+--- a/arch/x86/include/asm/switch_to.h
++++ b/arch/x86/include/asm/switch_to.h
+@@ -10,9 +10,6 @@ struct task_struct *__switch_to_asm(stru
+
+ __visible struct task_struct *__switch_to(struct task_struct *prev,
+ struct task_struct *next);
+-struct tss_struct;
+-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+- struct tss_struct *tss);
+
+ /* This runs runs on the previous thread's stack. */
+ static inline void prepare_switch_to(struct task_struct *prev,
+--- a/arch/x86/kernel/process_32.c
++++ b/arch/x86/kernel/process_32.c
+@@ -59,6 +59,8 @@
+ #include <asm/intel_rdt_sched.h>
+ #include <asm/proto.h>
+
++#include "process.h"
++
+ void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
+ {
+ unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L;
+@@ -234,7 +236,6 @@ __switch_to(struct task_struct *prev_p,
+ struct fpu *prev_fpu = &prev->fpu;
+ struct fpu *next_fpu = &next->fpu;
+ int cpu = smp_processor_id();
+- struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
+
+ /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
+
+@@ -266,12 +267,7 @@ __switch_to(struct task_struct *prev_p,
+ if (get_kernel_rpl() && unlikely(prev->iopl != next->iopl))
+ set_iopl_mask(next->iopl);
+
+- /*
+- * Now maybe handle debug registers and/or IO bitmaps
+- */
+- if (unlikely(task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV ||
+- task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT))
+- __switch_to_xtra(prev_p, next_p, tss);
++ switch_to_extra(prev_p, next_p);
+
+ /*
+ * Leave lazy mode, flushing any hypercalls made here.
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -61,6 +61,8 @@
+
+ __visible DEFINE_PER_CPU(unsigned long, rsp_scratch);
+
++#include "process.h"
++
+ /* Prints also some state that isn't saved in the pt_regs */
+ void __show_regs(struct pt_regs *regs, enum show_regs_mode mode)
+ {
+@@ -408,7 +410,6 @@ __switch_to(struct task_struct *prev_p,
+ struct fpu *prev_fpu = &prev->fpu;
+ struct fpu *next_fpu = &next->fpu;
+ int cpu = smp_processor_id();
+- struct tss_struct *tss = &per_cpu(cpu_tss_rw, cpu);
+
+ WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) &&
+ this_cpu_read(irq_count) != -1);
+@@ -475,12 +476,7 @@ __switch_to(struct task_struct *prev_p,
+ /* Reload sp0. */
+ update_sp0(next_p);
+
+- /*
+- * Now maybe reload the debug registers and handle I/O bitmaps
+- */
+- if (unlikely(task_thread_info(next_p)->flags & _TIF_WORK_CTXSW_NEXT ||
+- task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
+- __switch_to_xtra(prev_p, next_p, tss);
++ switch_to_extra(prev_p, next_p);
+
+ #ifdef CONFIG_XEN_PV
+ /*
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -40,6 +40,8 @@
+ #include <asm/prctl.h>
+ #include <asm/spec-ctrl.h>
+
++#include "process.h"
++
+ /*
+ * per-CPU TSS segments. Threads are completely 'soft' on Linux,
+ * no more per-task TSS's. The TSS size is kept cacheline-aligned
+@@ -254,11 +256,12 @@ void arch_setup_new_exec(void)
+ enable_cpuid();
+ }
+
+-static inline void switch_to_bitmap(struct tss_struct *tss,
+- struct thread_struct *prev,
++static inline void switch_to_bitmap(struct thread_struct *prev,
+ struct thread_struct *next,
+ unsigned long tifp, unsigned long tifn)
+ {
++ struct tss_struct *tss = this_cpu_ptr(&cpu_tss_rw);
++
+ if (tifn & _TIF_IO_BITMAP) {
+ /*
+ * Copy the relevant range of the IO bitmap.
+@@ -450,8 +453,7 @@ void speculation_ctrl_update(unsigned lo
+ preempt_enable();
+ }
+
+-void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+- struct tss_struct *tss)
++void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
+ {
+ struct thread_struct *prev, *next;
+ unsigned long tifp, tifn;
+@@ -461,7 +463,7 @@ void __switch_to_xtra(struct task_struct
+
+ tifn = READ_ONCE(task_thread_info(next_p)->flags);
+ tifp = READ_ONCE(task_thread_info(prev_p)->flags);
+- switch_to_bitmap(tss, prev, next, tifp, tifn);
++ switch_to_bitmap(prev, next, tifp, tifn);
+
+ propagate_user_return_notify(prev_p, next_p);
+
+--- /dev/null
++++ b/arch/x86/kernel/process.h
+@@ -0,0 +1,24 @@
++// SPDX-License-Identifier: GPL-2.0
++//
++// Code shared between 32 and 64 bit
++
++void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p);
++
++/*
++ * This needs to be inline to optimize for the common case where no extra
++ * work needs to be done.
++ */
++static inline void switch_to_extra(struct task_struct *prev,
++ struct task_struct *next)
++{
++ unsigned long next_tif = task_thread_info(next)->flags;
++ unsigned long prev_tif = task_thread_info(prev)->flags;
++
++ /*
++ * __switch_to_xtra() handles debug registers, i/o bitmaps,
++ * speculation mitigations etc.
++ */
++ if (unlikely(next_tif & _TIF_WORK_CTXSW_NEXT ||
++ prev_tif & _TIF_WORK_CTXSW_PREV))
++ __switch_to_xtra(prev, next);
++}
diff --git a/patches.arch/x86-retpoline-make-config_retpoline-depend-on-compiler-support.patch b/patches.arch/x86-retpoline-make-config_retpoline-depend-on-compiler-support.patch
new file mode 100644
index 0000000000..0792befa86
--- /dev/null
+++ b/patches.arch/x86-retpoline-make-config_retpoline-depend-on-compiler-support.patch
@@ -0,0 +1,123 @@
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Fri, 2 Nov 2018 01:45:41 -0700
+Subject: x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
+Git-commit: 4cd24de3a0980bf3100c9dcb08ef65ca7c31af48
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Since retpoline capable compilers are widely available, make
+CONFIG_RETPOLINE hard depend on the compiler capability.
+
+Break the build when CONFIG_RETPOLINE is enabled and the compiler does not
+support it. Emit an error message in that case:
+
+ "arch/x86/Makefile:226: *** You are building kernel with non-retpoline
+ compiler, please update your compiler.. Stop."
+
+[dwmw: Fail the build with non-retpoline compiler]
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Michal Marek <michal.lkml@markovi.net>
+Cc: <srinivas.eeda@oracle.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/cca0cb20-f9e2-4094-840b-fb0f8810cd34@default
+
+[
+ Leave -DRETPOLINE in KBUILD_CFLAGS now so as to avoid a kABI breakage:
+
+ KABI: symbol xen_xlate_map_ballooned_pages(vmlinux) changed crc from 0xfdc88b7f to 0x5466f030
+
+ Proper fix will come later.
+ ]
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/Kconfig | 4 ----
+ arch/x86/Makefile | 5 +++--
+ arch/x86/include/asm/nospec-branch.h | 10 ++++++----
+ arch/x86/kernel/cpu/bugs.c | 2 +-
+ 4 files changed, 10 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -162,11 +162,12 @@
+ _ASM_PTR " 999b\n\t" \
+ ".popsection\n\t"
+
+-#if defined(CONFIG_X86_64) && defined(RETPOLINE)
++#ifdef CONFIG_RETPOLINE
++#ifdef CONFIG_X86_64
+
+ /*
+- * Since the inline asm uses the %V modifier which is only in newer GCC,
+- * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE.
++ * Inline asm uses the %V modifier which is only in newer GCC
++ * which is ensured when CONFIG_RETPOLINE is defined.
+ */
+ # define CALL_NOSPEC \
+ ANNOTATE_NOSPEC_ALTERNATIVE \
+@@ -177,7 +178,7 @@
+ X86_FEATURE_RETPOLINE)
+ # define THUNK_TARGET(addr) [thunk_target] "r" (addr)
+
+-#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE)
++#else /* CONFIG_X86_32 */
+ /*
+ * For i386 we use the original ret-equivalent retpoline, because
+ * otherwise we'll run out of registers. We don't care about CET
+@@ -202,6 +203,7 @@
+ X86_FEATURE_RETPOLINE)
+
+ # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
++#endif
+ #else /* No retpoline for C / inline asm */
+ # define CALL_NOSPEC "call *%[thunk_target]\n"
+ # define THUNK_TARGET(addr) [thunk_target] "rm" (addr)
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -429,10 +429,6 @@ config RETPOLINE
+ branches. Requires a compiler with -mindirect-branch=thunk-extern
+ support for full protection. The kernel may run slower.
+
+- Without compiler support, at least indirect branches in assembler
+- code are eliminated. Since this includes the syscall entry path,
+- it is not entirely pointless.
+-
+ config INTEL_RDT
+ bool "Intel Resource Director Technology support"
+ default n
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -368,7 +368,7 @@ static void __init spec2_print_if_secure
+
+ static inline bool retp_compiler(void)
+ {
+- return __is_defined(RETPOLINE);
++ return __is_defined(CONFIG_RETPOLINE);
+ }
+
+ static inline bool match_option(const char *arg, int arglen, const char *opt)
+--- a/arch/x86/Makefile
++++ b/arch/x86/Makefile
+@@ -230,9 +230,10 @@ KBUILD_AFLAGS += $(mflags-y)
+ # Avoid indirect branches in kernel to deal with Spectre
+ ifdef CONFIG_RETPOLINE
+ RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
+- ifneq ($(RETPOLINE_CFLAGS),)
+- KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
++ifeq ($(RETPOLINE_CFLAGS),)
++ $(error You are building kernel with non-retpoline compiler, please update your compiler.)
+ endif
++ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
+ endif
+
+ archscripts: scripts_basic
diff --git a/patches.arch/x86-retpoline-remove-minimal-retpoline-support.patch b/patches.arch/x86-retpoline-remove-minimal-retpoline-support.patch
new file mode 100644
index 0000000000..89801e8275
--- /dev/null
+++ b/patches.arch/x86-retpoline-remove-minimal-retpoline-support.patch
@@ -0,0 +1,79 @@
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Fri, 2 Nov 2018 01:45:41 -0700
+Subject: x86/retpoline: Remove minimal retpoline support
+Git-commit: ef014aae8f1cd2793e4e014bbb102bed53f852b7
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Now that CONFIG_RETPOLINE hard depends on compiler support, there is no
+reason to keep the minimal retpoline support around which only provided
+basic protection in the assembly files.
+
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: <srinivas.eeda@oracle.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/f06f0a89-5587-45db-8ed2-0a9d6638d5c0@default
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/nospec-branch.h | 2 --
+ arch/x86/kernel/cpu/bugs.c | 13 ++-----------
+ 2 files changed, 2 insertions(+), 13 deletions(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -212,8 +212,6 @@
+ /* The Spectre V2 mitigation variants */
+ enum spectre_v2_mitigation {
+ SPECTRE_V2_NONE,
+- SPECTRE_V2_RETPOLINE_MINIMAL,
+- SPECTRE_V2_RETPOLINE_MINIMAL_AMD,
+ SPECTRE_V2_RETPOLINE_GENERIC,
+ SPECTRE_V2_RETPOLINE_AMD,
+ SPECTRE_V2_IBRS,
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -134,8 +134,6 @@ enum spectre_v2_mitigation_cmd {
+
+ static const char *spectre_v2_strings[] = {
+ [SPECTRE_V2_NONE] = "Vulnerable",
+- [SPECTRE_V2_RETPOLINE_MINIMAL] = "Vulnerable: Minimal generic ASM retpoline",
+- [SPECTRE_V2_RETPOLINE_MINIMAL_AMD] = "Vulnerable: Minimal AMD ASM retpoline",
+ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
+ [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
+@@ -366,11 +364,6 @@ static void __init spec2_print_if_secure
+ pr_info("%s selected on command line.\n", reason);
+ }
+
+-static inline bool retp_compiler(void)
+-{
+- return __is_defined(CONFIG_RETPOLINE);
+-}
+-
+ static inline bool match_option(const char *arg, int arglen, const char *opt)
+ {
+ int len = strlen(opt);
+@@ -548,14 +541,12 @@ retpoline_auto:
+ pr_err("Spectre mitigation: LFENCE not serializing, switching to generic retpoline\n");
+ goto retpoline_generic;
+ }
+- mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD :
+- SPECTRE_V2_RETPOLINE_MINIMAL_AMD;
++ mode = SPECTRE_V2_RETPOLINE_AMD;
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD);
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+ } else {
+ retpoline_generic:
+- mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC :
+- SPECTRE_V2_RETPOLINE_MINIMAL;
++ mode = SPECTRE_V2_RETPOLINE_GENERIC;
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+ }
+
diff --git a/patches.arch/x86-speculataion-mark-command-line-parser-data-_initdata.patch b/patches.arch/x86-speculataion-mark-command-line-parser-data-_initdata.patch
new file mode 100644
index 0000000000..266e13a2c4
--- /dev/null
+++ b/patches.arch/x86-speculataion-mark-command-line-parser-data-_initdata.patch
@@ -0,0 +1,58 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:43 +0100
+Subject: x86/speculataion: Mark command line parser data __initdata
+Git-commit: 30ba72a990f5096ae08f284de17986461efcc408
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+No point to keep that around.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.893886356@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -364,7 +364,7 @@ static const struct {
+ const char *option;
+ enum spectre_v2_mitigation_cmd cmd;
+ bool secure;
+-} mitigation_options[] = {
++} mitigation_options[] __initdata = {
+ { "off", SPECTRE_V2_CMD_NONE, false },
+ { "on", SPECTRE_V2_CMD_FORCE, true },
+ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
+@@ -617,7 +617,7 @@ static const char * const ssb_strings[]
+ static const struct {
+ const char *option;
+ enum ssb_mitigation_cmd cmd;
+-} ssb_mitigation_options[] = {
++} ssb_mitigation_options[] __initdata = {
+ { "auto", SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */
+ { "on", SPEC_STORE_BYPASS_CMD_ON }, /* Disable Speculative Store Bypass */
+ { "off", SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */
diff --git a/patches.arch/x86-speculation-add-command-line-control-for-indirect-branch-speculation.patch b/patches.arch/x86-speculation-add-command-line-control-for-indirect-branch-speculation.patch
new file mode 100644
index 0000000000..0a81da60e3
--- /dev/null
+++ b/patches.arch/x86-speculation-add-command-line-control-for-indirect-branch-speculation.patch
@@ -0,0 +1,328 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:45 +0100
+Subject: x86/speculation: Add command line control for indirect branch
+ speculation
+Git-commit: fa1202ef224391b6f5b26cdd44cc50495e8fab54
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Add command line control for user space indirect branch speculation
+mitigations. The new option is: spectre_v2_user=
+
+The initial options are:
+
+ - on: Unconditionally enabled
+ - off: Unconditionally disabled
+ -auto: Kernel selects mitigation (default off for now)
+
+When the spectre_v2= command line argument is either 'on' or 'off' this
+implies that the application to application control follows that state even
+if a contradicting spectre_v2_user= argument is supplied.
+
+Originally-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.082720373@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 32 +++++
+ arch/x86/include/asm/nospec-branch.h | 10 +
+ arch/x86/kernel/cpu/bugs.c | 133 ++++++++++++++++++++----
+ 3 files changed, 156 insertions(+), 19 deletions(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -3,6 +3,8 @@
+ #ifndef __NOSPEC_BRANCH_H__
+ #define __NOSPEC_BRANCH_H__
+
++#include <linux/static_key.h>
++
+ #include <asm/alternative.h>
+ #include <asm/alternative-asm.h>
+ #include <asm/cpufeatures.h>
+@@ -218,6 +220,12 @@ enum spectre_v2_mitigation {
+ SPECTRE_V2_IBRS_ENHANCED,
+ };
+
++/* The indirect branch speculation control variants */
++enum spectre_v2_user_mitigation {
++ SPECTRE_V2_USER_NONE,
++ SPECTRE_V2_USER_STRICT,
++};
++
+ /* The Speculative Store Bypass disable variants */
+ enum ssb_mitigation {
+ SPEC_STORE_BYPASS_NONE,
+@@ -295,6 +303,8 @@ do { \
+ preempt_enable(); \
+ } while (0)
+
++DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
++
+ #endif /* __ASSEMBLY__ */
+
+ /*
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -53,6 +53,9 @@ static u64 __ro_after_init x86_spec_ctrl
+ u64 __ro_after_init x86_amd_ls_cfg_base;
+ u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask;
+
++/* Control conditional STIPB in switch_to() */
++DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
++
+ void __init check_bugs(void)
+ {
+ identify_boot_cpu();
+@@ -315,6 +318,9 @@ early_param("l1tf", l1tf_cmdline);
+ static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+ SPECTRE_V2_NONE;
+
++static enum spectre_v2_user_mitigation spectre_v2_user __ro_after_init =
++ SPECTRE_V2_USER_NONE;
++
+ #ifdef RETPOLINE
+ static bool spectre_v2_bad_module;
+
+@@ -353,6 +359,104 @@ enum spectre_v2_mitigation_cmd {
+ SPECTRE_V2_CMD_RETPOLINE_AMD,
+ };
+
++enum spectre_v2_user_cmd {
++ SPECTRE_V2_USER_CMD_NONE,
++ SPECTRE_V2_USER_CMD_AUTO,
++ SPECTRE_V2_USER_CMD_FORCE,
++};
++
++static const char * const spectre_v2_user_strings[] = {
++ [SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
++ [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
++};
++
++static const struct {
++ const char *option;
++ enum spectre_v2_user_cmd cmd;
++ bool secure;
++} v2_user_options[] __initdata = {
++ { "auto", SPECTRE_V2_USER_CMD_AUTO, false },
++ { "off", SPECTRE_V2_USER_CMD_NONE, false },
++ { "on", SPECTRE_V2_USER_CMD_FORCE, true },
++};
++
++static void __init spec_v2_user_print_cond(const char *reason, bool secure)
++{
++ if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
++ pr_info("spectre_v2_user=%s forced on command line.\n", reason);
++}
++
++static enum spectre_v2_user_cmd __init
++spectre_v2_parse_user_cmdline(enum spectre_v2_mitigation_cmd v2_cmd)
++{
++ char arg[20];
++ int ret, i;
++
++ switch (v2_cmd) {
++ case SPECTRE_V2_CMD_NONE:
++ return SPECTRE_V2_USER_CMD_NONE;
++ case SPECTRE_V2_CMD_FORCE:
++ return SPECTRE_V2_USER_CMD_FORCE;
++ default:
++ break;
++ }
++
++ ret = cmdline_find_option(boot_command_line, "spectre_v2_user",
++ arg, sizeof(arg));
++ if (ret < 0)
++ return SPECTRE_V2_USER_CMD_AUTO;
++
++ for (i = 0; i < ARRAY_SIZE(v2_user_options); i++) {
++ if (match_option(arg, ret, v2_user_options[i].option)) {
++ spec_v2_user_print_cond(v2_user_options[i].option,
++ v2_user_options[i].secure);
++ return v2_user_options[i].cmd;
++ }
++ }
++
++ pr_err("Unknown user space protection option (%s). Switching to AUTO select\n", arg);
++ return SPECTRE_V2_USER_CMD_AUTO;
++}
++
++static void __init
++spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
++{
++ enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
++ bool smt_possible = IS_ENABLED(CONFIG_SMP);
++
++ if (!boot_cpu_has(X86_FEATURE_IBPB) && !boot_cpu_has(X86_FEATURE_STIBP))
++ return;
++
++ if (cpu_smt_control == CPU_SMT_FORCE_DISABLED ||
++ cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
++ smt_possible = false;
++
++ switch (spectre_v2_parse_user_cmdline(v2_cmd)) {
++ case SPECTRE_V2_USER_CMD_AUTO:
++ case SPECTRE_V2_USER_CMD_NONE:
++ goto set_mode;
++ case SPECTRE_V2_USER_CMD_FORCE:
++ mode = SPECTRE_V2_USER_STRICT;
++ break;
++ }
++
++ /* Initialize Indirect Branch Prediction Barrier */
++ if (boot_cpu_has(X86_FEATURE_IBPB)) {
++ setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
++ pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
++ }
++
++ /* If enhanced IBRS is enabled no STIPB required */
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return;
++
++set_mode:
++ spectre_v2_user = mode;
++ /* Only print the STIBP mode when SMT possible */
++ if (smt_possible)
++ pr_info("%s\n", spectre_v2_user_strings[mode]);
++}
++
+ static const char * const spectre_v2_strings[] = {
+ [SPECTRE_V2_NONE] = "Vulnerable",
+ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+@@ -516,12 +620,6 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW);
+ pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n");
+
+- /* Initialize Indirect Branch Prediction Barrier if supported */
+- if (boot_cpu_has(X86_FEATURE_IBPB)) {
+- setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+- pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
+- }
+-
+ /*
+ * Retpoline means the kernel is safe because it has no indirect
+ * branches. Enhanced IBRS protects firmware too, so, enable restricted
+@@ -538,23 +636,21 @@ specv2_set_mode:
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
+
++ /* Set up IBPB and STIBP depending on the general spectre V2 command */
++ spectre_v2_user_select_mitigation(cmd);
++
+ /* Enable STIBP if appropriate */
+ arch_smt_update();
+ }
+
+ static bool stibp_needed(void)
+ {
+- if (spectre_v2_enabled == SPECTRE_V2_NONE)
+- return false;
+-
+ /* Enhanced IBRS makes using STIBP unnecessary. */
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+ return false;
+
+- if (!boot_cpu_has(X86_FEATURE_STIBP))
+- return false;
+-
+- return true;
++ /* Check for strict user mitigation mode */
++ return spectre_v2_user == SPECTRE_V2_USER_STRICT;
+ }
+
+ static void update_stibp_msr(void *info)
+@@ -859,10 +955,13 @@ static char *stibp_state(void)
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+ return "";
+
+- if (x86_spec_ctrl_base & SPEC_CTRL_STIBP)
+- return ", STIBP";
+- else
+- return "";
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ return ", STIBP: disabled";
++ case SPECTRE_V2_USER_STRICT:
++ return ", STIBP: forced";
++ }
++ return "";
+ }
+
+ static char *ibpb_state(void)
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3963,9 +3963,13 @@
+
+ spectre_v2= [X86] Control mitigation of Spectre variant 2
+ (indirect branch speculation) vulnerability.
++ The default operation protects the kernel from
++ user space attacks.
+
+- on - unconditionally enable
+- off - unconditionally disable
++ on - unconditionally enable, implies
++ spectre_v2_user=on
++ off - unconditionally disable, implies
++ spectre_v2_user=off
+ auto - kernel detects whether your CPU model is
+ vulnerable
+
+@@ -3975,6 +3979,12 @@
+ CONFIG_RETPOLINE configuration option, and the
+ compiler with which the kernel was built.
+
++ Selecting 'on' will also enable the mitigation
++ against user space to user space task attacks.
++
++ Selecting 'off' will disable both the kernel and
++ the user space protections.
++
+ Specific mitigations can also be selected manually:
+
+ retpoline - replace indirect branches
+@@ -3984,6 +3994,24 @@
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
+
++ spectre_v2_user=
++ [X86] Control mitigation of Spectre variant 2
++ (indirect branch speculation) vulnerability between
++ user space tasks
++
++ on - Unconditionally enable mitigations. Is
++ enforced by spectre_v2=on
++
++ off - Unconditionally disable mitigations. Is
++ enforced by spectre_v2=off
++
++ auto - Kernel selects the mitigation depending on
++ the available CPU features and vulnerability.
++ Default is off.
++
++ Not specifying this option is equivalent to
++ spectre_v2_user=auto.
++
+ spec_store_bypass_disable=
+ [HW] Control Speculative Store Bypass (SSB) Disable mitigation
+ (Speculative Store Bypass vulnerability)
diff --git a/patches.arch/x86-speculation-add-prctl-control-for-indirect-branch-speculation.patch b/patches.arch/x86-speculation-add-prctl-control-for-indirect-branch-speculation.patch
new file mode 100644
index 0000000000..d65efc2eb7
--- /dev/null
+++ b/patches.arch/x86-speculation-add-prctl-control-for-indirect-branch-speculation.patch
@@ -0,0 +1,249 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:53 +0100
+Subject: x86/speculation: Add prctl() control for indirect branch speculation
+Git-commit: 9137bb27e60e554dab694eafa4cca241fa3a694f
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Add the PR_SPEC_INDIRECT_BRANCH option for the PR_GET_SPECULATION_CTRL and
+PR_SET_SPECULATION_CTRL prctls to allow fine grained per task control of
+indirect branch speculation via STIBP and IBPB.
+
+Invocations:
+ Check indirect branch speculation status with
+ - prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0);
+
+ Enable indirect branch speculation with
+ - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0);
+
+ Disable indirect branch speculation with
+ - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0);
+
+ Force disable indirect branch speculation with
+ - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
+
+See Documentation/userspace-api/spec_ctrl.rst.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.866780996@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/userspace-api/spec_ctrl.rst | 9 ++++
+ arch/x86/include/asm/nospec-branch.h | 1
+ arch/x86/kernel/cpu/bugs.c | 67 ++++++++++++++++++++++++++++++
+ arch/x86/kernel/process.c | 5 ++
+ include/linux/sched.h | 9 ++++
+ include/uapi/linux/prctl.h | 1
+ 6 files changed, 92 insertions(+)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -224,6 +224,7 @@ enum spectre_v2_mitigation {
+ enum spectre_v2_user_mitigation {
+ SPECTRE_V2_USER_NONE,
+ SPECTRE_V2_USER_STRICT,
++ SPECTRE_V2_USER_PRCTL,
+ };
+
+ /* The Speculative Store Bypass disable variants */
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -697,6 +697,8 @@ void arch_smt_update(void)
+ case SPECTRE_V2_USER_STRICT:
+ update_stibp_strict();
+ break;
++ case SPECTRE_V2_USER_PRCTL:
++ break;
+ }
+
+ mutex_unlock(&spec_ctrl_mutex);
+@@ -885,12 +887,50 @@ static int ssb_prctl_set(struct task_str
+ return 0;
+ }
+
++static int ib_prctl_set(struct task_struct *task, unsigned long ctrl)
++{
++ switch (ctrl) {
++ case PR_SPEC_ENABLE:
++ if (spectre_v2_user == SPECTRE_V2_USER_NONE)
++ return 0;
++ /*
++ * Indirect branch speculation is always disabled in strict
++ * mode.
++ */
++ if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
++ return -EPERM;
++ task_clear_spec_ib_disable(task);
++ task_update_spec_tif(task);
++ break;
++ case PR_SPEC_DISABLE:
++ case PR_SPEC_FORCE_DISABLE:
++ /*
++ * Indirect branch speculation is always allowed when
++ * mitigation is force disabled.
++ */
++ if (spectre_v2_user == SPECTRE_V2_USER_NONE)
++ return -EPERM;
++ if (spectre_v2_user == SPECTRE_V2_USER_STRICT)
++ return 0;
++ task_set_spec_ib_disable(task);
++ if (ctrl == PR_SPEC_FORCE_DISABLE)
++ task_set_spec_ib_force_disable(task);
++ task_update_spec_tif(task);
++ break;
++ default:
++ return -ERANGE;
++ }
++ return 0;
++}
++
+ int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which,
+ unsigned long ctrl)
+ {
+ switch (which) {
+ case PR_SPEC_STORE_BYPASS:
+ return ssb_prctl_set(task, ctrl);
++ case PR_SPEC_INDIRECT_BRANCH:
++ return ib_prctl_set(task, ctrl);
+ default:
+ return -ENODEV;
+ }
+@@ -923,11 +963,34 @@ static int ssb_prctl_get(struct task_str
+ }
+ }
+
++static int ib_prctl_get(struct task_struct *task)
++{
++ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
++ return PR_SPEC_NOT_AFFECTED;
++
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ return PR_SPEC_ENABLE;
++ case SPECTRE_V2_USER_PRCTL:
++ if (task_spec_ib_force_disable(task))
++ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
++ if (task_spec_ib_disable(task))
++ return PR_SPEC_PRCTL | PR_SPEC_DISABLE;
++ return PR_SPEC_PRCTL | PR_SPEC_ENABLE;
++ case SPECTRE_V2_USER_STRICT:
++ return PR_SPEC_DISABLE;
++ default:
++ return PR_SPEC_NOT_AFFECTED;
++ }
++}
++
+ int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which)
+ {
+ switch (which) {
+ case PR_SPEC_STORE_BYPASS:
+ return ssb_prctl_get(task);
++ case PR_SPEC_INDIRECT_BRANCH:
++ return ib_prctl_get(task);
+ default:
+ return -ENODEV;
+ }
+@@ -989,6 +1052,8 @@ static char *stibp_state(void)
+ return ", STIBP: disabled";
+ case SPECTRE_V2_USER_STRICT:
+ return ", STIBP: forced";
++ case SPECTRE_V2_USER_PRCTL:
++ return "";
+ }
+ return "";
+ }
+@@ -1001,6 +1066,8 @@ static char *ibpb_state(void)
+ return ", IBPB: disabled";
+ case SPECTRE_V2_USER_STRICT:
+ return ", IBPB: always-on";
++ case SPECTRE_V2_USER_PRCTL:
++ return "";
+ }
+ }
+ return "";
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -452,6 +452,11 @@ static unsigned long speculation_ctrl_up
+ set_tsk_thread_flag(tsk, TIF_SSBD);
+ else
+ clear_tsk_thread_flag(tsk, TIF_SSBD);
++
++ if (task_spec_ib_disable(tsk))
++ set_tsk_thread_flag(tsk, TIF_SPEC_IB);
++ else
++ clear_tsk_thread_flag(tsk, TIF_SPEC_IB);
+ }
+ /* Return the updated threadinfo flags*/
+ return task_thread_info(tsk)->flags;
+--- a/Documentation/userspace-api/spec_ctrl.rst
++++ b/Documentation/userspace-api/spec_ctrl.rst
+@@ -92,3 +92,12 @@ Speculation misfeature controls
+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0);
+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
+ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0);
++
++- PR_SPEC_INDIR_BRANCH: Indirect Branch Speculation in User Processes
++ (Mitigate Spectre V2 style attacks against user processes)
++
++ Invocations:
++ * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, 0, 0, 0);
++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_ENABLE, 0, 0);
++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_DISABLE, 0, 0);
++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_INDIRECT_BRANCH, PR_SPEC_FORCE_DISABLE, 0, 0);
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1294,6 +1294,8 @@ extern struct pid *cad_pid;
+ #define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */
+ #define PFA_SPEC_SSB_DISABLE 3 /* Speculative Store Bypass disabled */
+ #define PFA_SPEC_SSB_FORCE_DISABLE 4 /* Speculative Store Bypass force disabled*/
++#define PFA_SPEC_IB_DISABLE 5 /* Indirect branch speculation restricted */
++#define PFA_SPEC_IB_FORCE_DISABLE 6 /* Indirect branch speculation permanently restricted */
+
+ #define TASK_PFA_TEST(name, func) \
+ static inline bool task_##func(struct task_struct *p) \
+@@ -1325,6 +1327,13 @@ TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ss
+ TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
+ TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable)
+
++TASK_PFA_TEST(SPEC_IB_DISABLE, spec_ib_disable)
++TASK_PFA_SET(SPEC_IB_DISABLE, spec_ib_disable)
++TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable)
++
++TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
++TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
++
+ static inline void
+ current_restore_flags(unsigned long orig_flags, unsigned long flags)
+ {
+--- a/include/uapi/linux/prctl.h
++++ b/include/uapi/linux/prctl.h
+@@ -202,6 +202,7 @@ struct prctl_mm_map {
+ #define PR_SET_SPECULATION_CTRL 53
+ /* Speculation control variants */
+ # define PR_SPEC_STORE_BYPASS 0
++# define PR_SPEC_INDIRECT_BRANCH 1
+ /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
+ # define PR_SPEC_NOT_AFFECTED 0
+ # define PR_SPEC_PRCTL (1UL << 0)
diff --git a/patches.arch/x86-speculation-add-seccomp-spectre-v2-user-space-protection-mode.patch b/patches.arch/x86-speculation-add-seccomp-spectre-v2-user-space-protection-mode.patch
new file mode 100644
index 0000000000..d21343ee97
--- /dev/null
+++ b/patches.arch/x86-speculation-add-seccomp-spectre-v2-user-space-protection-mode.patch
@@ -0,0 +1,183 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:55 +0100
+Subject: x86/speculation: Add seccomp Spectre v2 user space protection mode
+Git-commit: 6b3e64c237c072797a9ec918654a60e3a46488e2
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+If 'prctl' mode of user space protection from spectre v2 is selected
+on the kernel command-line, STIBP and IBPB are applied on tasks which
+restrict their indirect branch speculation via prctl.
+
+SECCOMP enables the SSBD mitigation for sandboxed tasks already, so it
+makes sense to prevent spectre v2 user space to user space attacks as
+well.
+
+The Intel mitigation guide documents how STIPB works:
+
+ Setting bit 1 (STIBP) of the IA32_SPEC_CTRL MSR on a logical processor
+ prevents the predicted targets of indirect branches on any logical
+ processor of that core from being controlled by software that executes
+ (or executed previously) on another logical processor of the same core.
+
+Ergo setting STIBP protects the task itself from being attacked from a task
+running on a different hyper-thread and protects the tasks running on
+different hyper-threads from being attacked.
+
+While the document suggests that the branch predictors are shielded between
+the logical processors, the observed performance regressions suggest that
+STIBP simply disables the branch predictor more or less completely. Of
+course the document wording is vague, but the fact that there is also no
+requirement for issuing IBPB when STIBP is used points clearly in that
+direction. The kernel still issues IBPB even when STIBP is used until Intel
+clarifies the whole mechanism.
+
+IBPB is issued when the task switches out, so malicious sandbox code cannot
+mistrain the branch predictor for the next user space task on the same
+logical processor.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185006.051663132@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 9 ++++++++-
+ arch/x86/include/asm/nospec-branch.h | 1 +
+ arch/x86/kernel/cpu/bugs.c | 17 ++++++++++++++++-
+ 3 files changed, 25 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -225,6 +225,7 @@ enum spectre_v2_user_mitigation {
+ SPECTRE_V2_USER_NONE,
+ SPECTRE_V2_USER_STRICT,
+ SPECTRE_V2_USER_PRCTL,
++ SPECTRE_V2_USER_SECCOMP,
+ };
+
+ /* The Speculative Store Bypass disable variants */
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -372,12 +372,14 @@ enum spectre_v2_user_cmd {
+ SPECTRE_V2_USER_CMD_AUTO,
+ SPECTRE_V2_USER_CMD_FORCE,
+ SPECTRE_V2_USER_CMD_PRCTL,
++ SPECTRE_V2_USER_CMD_SECCOMP,
+ };
+
+ static const char * const spectre_v2_user_strings[] = {
+ [SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
+ [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
+ [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl",
++ [SPECTRE_V2_USER_SECCOMP] = "User space: Mitigation: STIBP via seccomp and prctl",
+ };
+
+ static const struct {
+@@ -389,6 +391,7 @@ static const struct {
+ { "off", SPECTRE_V2_USER_CMD_NONE, false },
+ { "on", SPECTRE_V2_USER_CMD_FORCE, true },
+ { "prctl", SPECTRE_V2_USER_CMD_PRCTL, false },
++ { "seccomp", SPECTRE_V2_USER_CMD_SECCOMP, false },
+ };
+
+ static void __init spec_v2_user_print_cond(const char *reason, bool secure)
+@@ -448,10 +451,16 @@ spectre_v2_user_select_mitigation(enum s
+ case SPECTRE_V2_USER_CMD_FORCE:
+ mode = SPECTRE_V2_USER_STRICT;
+ break;
+- case SPECTRE_V2_USER_CMD_AUTO:
+ case SPECTRE_V2_USER_CMD_PRCTL:
+ mode = SPECTRE_V2_USER_PRCTL;
+ break;
++ case SPECTRE_V2_USER_CMD_AUTO:
++ case SPECTRE_V2_USER_CMD_SECCOMP:
++ if (IS_ENABLED(CONFIG_SECCOMP))
++ mode = SPECTRE_V2_USER_SECCOMP;
++ else
++ mode = SPECTRE_V2_USER_PRCTL;
++ break;
+ }
+
+ /* Initialize Indirect Branch Prediction Barrier */
+@@ -463,6 +472,7 @@ spectre_v2_user_select_mitigation(enum s
+ static_branch_enable(&switch_mm_always_ibpb);
+ break;
+ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
+ static_branch_enable(&switch_mm_cond_ibpb);
+ break;
+ default:
+@@ -722,6 +732,7 @@ void arch_smt_update(void)
+ update_stibp_strict();
+ break;
+ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
+ update_indir_branch_cond();
+ break;
+ }
+@@ -966,6 +977,8 @@ void arch_seccomp_spec_mitigate(struct t
+ {
+ if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP)
+ ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE);
++ if (spectre_v2_user == SPECTRE_V2_USER_SECCOMP)
++ ib_prctl_set(task, PR_SPEC_FORCE_DISABLE);
+ }
+ #endif
+
+@@ -997,6 +1010,7 @@ static int ib_prctl_get(struct task_stru
+ case SPECTRE_V2_USER_NONE:
+ return PR_SPEC_ENABLE;
+ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
+ if (task_spec_ib_force_disable(task))
+ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE;
+ if (task_spec_ib_disable(task))
+@@ -1078,6 +1092,7 @@ static char *stibp_state(void)
+ case SPECTRE_V2_USER_STRICT:
+ return ", STIBP: forced";
+ case SPECTRE_V2_USER_PRCTL:
++ case SPECTRE_V2_USER_SECCOMP:
+ if (static_key_enabled(&switch_to_cond_stibp))
+ return ", STIBP: conditional";
+ }
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4010,9 +4010,16 @@
+ per thread. The mitigation control state
+ is inherited on fork.
+
++ seccomp
++ - Same as "prctl" above, but all seccomp
++ threads will enable the mitigation unless
++ they explicitly opt out.
++
+ auto - Kernel selects the mitigation depending on
+ the available CPU features and vulnerability.
+- Default is prctl.
++
++ Default mitigation:
++ If CONFIG_SECCOMP=y then "seccomp", otherwise "prctl"
+
+ Not specifying this option is equivalent to
+ spectre_v2_user=auto.
diff --git a/patches.arch/x86-speculation-apply-ibpb-more-strictly-to-avoid-cross-process-data-leak.patch b/patches.arch/x86-speculation-apply-ibpb-more-strictly-to-avoid-cross-process-data-leak.patch
new file mode 100644
index 0000000000..e63780c10c
--- /dev/null
+++ b/patches.arch/x86-speculation-apply-ibpb-more-strictly-to-avoid-cross-process-data-leak.patch
@@ -0,0 +1,180 @@
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Tue, 25 Sep 2018 14:38:18 +0200
+Subject: x86/speculation: Apply IBPB more strictly to avoid cross-process data
+ leak
+Git-commit: dbfe2953f63c640463c630746cd5d9de8b2f63ae
+Patch-mainline: v4.20-rc1
+References: bsc#1106913
+
+Currently, IBPB is only issued in cases when switching into a non-dumpable
+process, the rationale being to protect such 'important and security
+sensitive' processess (such as GPG) from data leaking into a different
+userspace process via spectre v2.
+
+This is however completely insufficient to provide proper userspace-to-userpace
+spectrev2 protection, as any process can poison branch buffers before being
+scheduled out, and the newly scheduled process immediately becomes spectrev2
+victim.
+
+In order to minimize the performance impact (for usecases that do require
+spectrev2 protection), issue the barrier only in cases when switching between
+processess where the victim can't be ptraced by the potential attacker (as in
+such cases, the attacker doesn't have to bother with branch buffers at all).
+
+[ tglx: Split up PTRACE_MODE_NOACCESS_CHK into PTRACE_MODE_SCHED and
+ PTRACE_MODE_IBPB to be able to do ptrace() context tracking reasonably
+ fine-grained ]
+
+Fixes: 18bf3c3ea8 ("x86/speculation: Use Indirect Branch Prediction Barrier in context switch")
+Originally-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: "WoodhouseDavid" <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: "SchauflerCasey" <casey.schaufler@intel.com>
+Link: https://lkml.kernel.org/r/nycvar.YFH.7.76.1809251437340.15880@cbobk.fhfr.pm
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/mm/tlb.c | 31 ++++++++++++++++++++-----------
+ include/linux/ptrace.h | 21 +++++++++++++++++++--
+ kernel/ptrace.c | 10 ++++++++++
+ 3 files changed, 49 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index e96b99eb800c..073b8df349a0 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -7,6 +7,7 @@
+ #include <linux/export.h>
+ #include <linux/cpu.h>
+ #include <linux/debugfs.h>
++#include <linux/ptrace.h>
+
+ #include <asm/tlbflush.h>
+ #include <asm/mmu_context.h>
+@@ -180,6 +181,19 @@ static void sync_current_stack_to_mm(struct mm_struct *mm)
+ }
+ }
+
++static bool ibpb_needed(struct task_struct *tsk, u64 last_ctx_id)
++{
++ /*
++ * Check if the current (previous) task has access to the memory
++ * of the @tsk (next) task. If access is denied, make sure to
++ * issue a IBPB to stop user->user Spectre-v2 attacks.
++ *
++ * Note: __ptrace_may_access() returns 0 or -ERRNO.
++ */
++ return (tsk && tsk->mm && tsk->mm->context.ctx_id != last_ctx_id &&
++ ptrace_may_access_sched(tsk, PTRACE_MODE_SPEC_IBPB));
++}
++
+ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ struct task_struct *tsk)
+ {
+@@ -262,18 +276,13 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+ * one process from doing Spectre-v2 attacks on another.
+ *
+ * As an optimization, flush indirect branches only when
+- * switching into processes that disable dumping. This
+- * protects high value processes like gpg, without having
+- * too high performance overhead. IBPB is *expensive*!
+- *
+- * This will not flush branches when switching into kernel
+- * threads. It will also not flush if we switch to idle
+- * thread and back to the same process. It will flush if we
+- * switch to a different non-dumpable process.
++ * switching into a processes that can't be ptrace by the
++ * current one (as in such case, attacker has much more
++ * convenient way how to tamper with the next process than
++ * branch buffer poisoning).
+ */
+- if (tsk && tsk->mm &&
+- tsk->mm->context.ctx_id != last_ctx_id &&
+- get_dumpable(tsk->mm) != SUID_DUMP_USER)
++ if (static_cpu_has(X86_FEATURE_USE_IBPB) &&
++ ibpb_needed(tsk, last_ctx_id))
+ indirect_branch_prediction_barrier();
+
+ if (IS_ENABLED(CONFIG_VMAP_STACK)) {
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index 4f36431c380b..e5e5ef513df3 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -62,14 +62,17 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
+ #define PTRACE_MODE_READ 0x01
+ #define PTRACE_MODE_ATTACH 0x02
+ #define PTRACE_MODE_NOAUDIT 0x04
+-#define PTRACE_MODE_FSCREDS 0x08
+-#define PTRACE_MODE_REALCREDS 0x10
++#define PTRACE_MODE_FSCREDS 0x08
++#define PTRACE_MODE_REALCREDS 0x10
++#define PTRACE_MODE_SCHED 0x20
++#define PTRACE_MODE_IBPB 0x40
+
+ /* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
+ #define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
+ #define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS)
+ #define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS)
+ #define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS)
++#define PTRACE_MODE_SPEC_IBPB (PTRACE_MODE_ATTACH_REALCREDS | PTRACE_MODE_IBPB)
+
+ /**
+ * ptrace_may_access - check whether the caller is permitted to access
+@@ -87,6 +90,20 @@ extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead);
+ */
+ extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
+
++/**
++ * ptrace_may_access - check whether the caller is permitted to access
++ * a target task.
++ * @task: target task
++ * @mode: selects type of access and caller credentials
++ *
++ * Returns true on success, false on denial.
++ *
++ * Similar to ptrace_may_access(). Only to be called from context switch
++ * code. Does not call into audit and the regular LSM hooks due to locking
++ * constraints.
++ */
++extern bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode);
++
+ static inline int ptrace_reparented(struct task_struct *child)
+ {
+ return !same_thread_group(child->real_parent, child->parent);
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index 21fec73d45d4..99cfddde6a55 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -261,6 +261,9 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
+
+ static int ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
+ {
++ if (mode & PTRACE_MODE_SCHED)
++ return false;
++
+ if (mode & PTRACE_MODE_NOAUDIT)
+ return has_ns_capability_noaudit(current, ns, CAP_SYS_PTRACE);
+ else
+@@ -328,9 +331,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ !ptrace_has_cap(mm->user_ns, mode)))
+ return -EPERM;
+
++ if (mode & PTRACE_MODE_SCHED)
++ return 0;
+ return security_ptrace_access_check(task, mode);
+ }
+
++bool ptrace_may_access_sched(struct task_struct *task, unsigned int mode)
++{
++ return __ptrace_may_access(task, mode | PTRACE_MODE_SCHED);
++}
++
+ bool ptrace_may_access(struct task_struct *task, unsigned int mode)
+ {
+ int err;
+
diff --git a/patches.arch/x86-speculation-avoid-_switch_to_xtra-calls.patch b/patches.arch/x86-speculation-avoid-_switch_to_xtra-calls.patch
new file mode 100644
index 0000000000..f4bdffdb5c
--- /dev/null
+++ b/patches.arch/x86-speculation-avoid-_switch_to_xtra-calls.patch
@@ -0,0 +1,106 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:48 +0100
+Subject: x86/speculation: Avoid __switch_to_xtra() calls
+Git-commit: 5635d99953f04b550738f6f4c1c532667c3fd872
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The TIF_SPEC_IB bit does not need to be evaluated in the decision to invoke
+__switch_to_xtra() when:
+
+ - CONFIG_SMP is disabled
+
+ - The conditional STIPB mode is disabled
+
+The TIF_SPEC_IB bit still controls IBPB in both cases so the TIF work mask
+checks might invoke __switch_to_xtra() for nothing if TIF_SPEC_IB is the
+only set bit in the work masks.
+
+Optimize it out by masking the bit at compile time for CONFIG_SMP=n and at
+run time when the static key controlling the conditional STIBP mode is
+disabled.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.374062201@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/thread_info.h | 13 +++++++++++--
+ arch/x86/kernel/process.h | 15 +++++++++++++++
+ 2 files changed, 26 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -145,9 +145,18 @@ struct thread_info {
+ _TIF_PATCH_PENDING | _TIF_NOHZ | _TIF_SYSCALL_TRACEPOINT)
+
+ /* flags to check in __switch_to() */
+-#define _TIF_WORK_CTXSW \
++#define _TIF_WORK_CTXSW_BASE \
+ (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP| \
+- _TIF_SSBD|_TIF_SPEC_IB)
++ _TIF_SSBD)
++
++/*
++ * Avoid calls to __switch_to_xtra() on UP as STIBP is not evaluated.
++ */
++#ifdef CONFIG_SMP
++# define _TIF_WORK_CTXSW (_TIF_WORK_CTXSW_BASE | _TIF_SPEC_IB)
++#else
++# define _TIF_WORK_CTXSW (_TIF_WORK_CTXSW_BASE)
++#endif
+
+ #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
+ #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
+--- a/arch/x86/kernel/process.h
++++ b/arch/x86/kernel/process.h
+@@ -2,6 +2,8 @@
+ //
+ // Code shared between 32 and 64 bit
+
++#include <asm/spec-ctrl.h>
++
+ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p);
+
+ /*
+@@ -14,6 +16,19 @@ static inline void switch_to_extra(struc
+ unsigned long next_tif = task_thread_info(next)->flags;
+ unsigned long prev_tif = task_thread_info(prev)->flags;
+
++ if (IS_ENABLED(CONFIG_SMP)) {
++ /*
++ * Avoid __switch_to_xtra() invocation when conditional
++ * STIPB is disabled and the only different bit is
++ * TIF_SPEC_IB. For CONFIG_SMP=n TIF_SPEC_IB is not
++ * in the TIF_WORK_CTXSW masks.
++ */
++ if (!static_branch_likely(&switch_to_cond_stibp)) {
++ prev_tif &= ~_TIF_SPEC_IB;
++ next_tif &= ~_TIF_SPEC_IB;
++ }
++ }
++
+ /*
+ * __switch_to_xtra() handles debug registers, i/o bitmaps,
+ * speculation mitigations etc.
diff --git a/patches.arch/x86-speculation-clean-up-spectre_v2_parse_cmdline.patch b/patches.arch/x86-speculation-clean-up-spectre_v2_parse_cmdline.patch
new file mode 100644
index 0000000000..ae91bcb15e
--- /dev/null
+++ b/patches.arch/x86-speculation-clean-up-spectre_v2_parse_cmdline.patch
@@ -0,0 +1,80 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:30 +0100
+Subject: x86/speculation: Clean up spectre_v2_parse_cmdline()
+Git-commit: 24848509aa55eac39d524b587b051f4e86df3c12
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Remove the unnecessary 'else' statement in spectre_v2_parse_cmdline()
+to save an indentation level.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185003.688010903@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 7f6d8159398e..839ab4103e89 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -276,22 +276,21 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+
+ if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
+ return SPECTRE_V2_CMD_NONE;
+- else {
+- ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
+- if (ret < 0)
+- return SPECTRE_V2_CMD_AUTO;
+
+- for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
+- if (!match_option(arg, ret, mitigation_options[i].option))
+- continue;
+- cmd = mitigation_options[i].cmd;
+- break;
+- }
++ ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, sizeof(arg));
++ if (ret < 0)
++ return SPECTRE_V2_CMD_AUTO;
+
+- if (i >= ARRAY_SIZE(mitigation_options)) {
+- pr_err("unknown option (%s). Switching to AUTO select\n", arg);
+- return SPECTRE_V2_CMD_AUTO;
+- }
++ for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) {
++ if (!match_option(arg, ret, mitigation_options[i].option))
++ continue;
++ cmd = mitigation_options[i].cmd;
++ break;
++ }
++
++ if (i >= ARRAY_SIZE(mitigation_options)) {
++ pr_err("unknown option (%s). Switching to AUTO select\n", arg);
++ return SPECTRE_V2_CMD_AUTO;
+ }
+
+ if ((cmd == SPECTRE_V2_CMD_RETPOLINE ||
+
diff --git a/patches.arch/x86-speculation-disable-stibp-when-enhanced-ibrs-is-in-use.patch b/patches.arch/x86-speculation-disable-stibp-when-enhanced-ibrs-is-in-use.patch
new file mode 100644
index 0000000000..af24c9827a
--- /dev/null
+++ b/patches.arch/x86-speculation-disable-stibp-when-enhanced-ibrs-is-in-use.patch
@@ -0,0 +1,67 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:33 +0100
+Subject: x86/speculation: Disable STIBP when enhanced IBRS is in use
+Git-commit: 34bce7c9690b1d897686aac89604ba7adc365556
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+If enhanced IBRS is active, STIBP is redundant for mitigating Spectre v2
+user space exploits from hyperthread sibling.
+
+Disable STIBP when enhanced IBRS is used.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185003.966801480@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index a1502bce9eb8..924cd06dd43b 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -321,6 +321,10 @@ static bool stibp_needed(void)
+ if (spectre_v2_enabled == SPECTRE_V2_NONE)
+ return false;
+
++ /* Enhanced IBRS makes using STIBP unnecessary. */
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return false;
++
+ if (!boot_cpu_has(X86_FEATURE_STIBP))
+ return false;
+
+@@ -846,6 +850,9 @@ static ssize_t l1tf_show_state(char *buf)
+
+ static char *stibp_state(void)
+ {
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return "";
++
+ if (x86_spec_ctrl_base & SPEC_CTRL_STIBP)
+ return ", STIBP";
+ else
+
diff --git a/patches.arch/x86-speculation-enable-cross-hyperthread-spectre-v2-stibp-mitigation.patch b/patches.arch/x86-speculation-enable-cross-hyperthread-spectre-v2-stibp-mitigation.patch
new file mode 100644
index 0000000000..c479d4c241
--- /dev/null
+++ b/patches.arch/x86-speculation-enable-cross-hyperthread-spectre-v2-stibp-mitigation.patch
@@ -0,0 +1,178 @@
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Tue, 25 Sep 2018 14:38:55 +0200
+Subject: x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
+Git-commit: 53c613fe6349994f023245519265999eed75957f
+Patch-mainline: v4.20-rc1
+References: bsc#1106913
+
+STIBP is a feature provided by certain Intel ucodes / CPUs. This feature
+(once enabled) prevents cross-hyperthread control of decisions made by
+indirect branch predictors.
+
+Enable this feature if
+
+- the CPU is vulnerable to spectre v2
+- the CPU supports SMT and has SMT siblings online
+- spectre_v2 mitigation autoselection is enabled (default)
+
+After some previous discussion, this leaves STIBP on all the time, as wrmsr
+on crossing kernel boundary is a no-no. This could perhaps later be a bit
+more optimized (like disabling it in NOHZ, experiment with disabling it in
+idle, etc) if needed.
+
+Note that the synchronization of the mask manipulation via newly added
+spec_ctrl_mutex is currently not strictly needed, as the only updater is
+already being serialized by cpu_add_remove_lock, but let's make this a
+little bit more future-proof.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: "WoodhouseDavid" <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: "SchauflerCasey" <casey.schaufler@intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/nycvar.YFH.7.76.1809251438240.15880@cbobk.fhfr.pm
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 57 ++++++++++++++++++++++++++++++++++++++++-----
+ kernel/cpu.c | 11 +++++++-
+ 2 files changed, 61 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -34,12 +34,10 @@ static void __init spectre_v2_select_mit
+ static void __init ssb_select_mitigation(void);
+ static void __init l1tf_select_mitigation(void);
+
+-/*
+- * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any
+- * writes to SPEC_CTRL contain whatever reserved bits have been set.
+- */
+-u64 __ro_after_init x86_spec_ctrl_base;
++/* The base value of the SPEC_CTRL MSR that always has to be preserved. */
++u64 x86_spec_ctrl_base;
+ EXPORT_SYMBOL_GPL(x86_spec_ctrl_base);
++static DEFINE_MUTEX(spec_ctrl_mutex);
+
+ /*
+ * The vendor and possibly platform specific bits which can be modified in
+@@ -458,6 +456,46 @@ static bool __init is_skylake_era(void)
+ return false;
+ }
+
++static bool stibp_needed(void)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_NONE)
++ return false;
++
++ if (!boot_cpu_has(X86_FEATURE_STIBP))
++ return false;
++
++ return true;
++}
++
++static void update_stibp_msr(void *info)
++{
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++}
++
++void arch_smt_update(void)
++{
++ u64 mask;
++
++ if (!stibp_needed())
++ return;
++
++ mutex_lock(&spec_ctrl_mutex);
++ mask = x86_spec_ctrl_base;
++ if (cpu_smt_control == CPU_SMT_ENABLED)
++ mask |= SPEC_CTRL_STIBP;
++ else
++ mask &= ~SPEC_CTRL_STIBP;
++
++ if (mask != x86_spec_ctrl_base) {
++ pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
++ cpu_smt_control == CPU_SMT_ENABLED ?
++ "Enabling" : "Disabling");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
++ }
++ mutex_unlock(&spec_ctrl_mutex);
++}
++
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -557,6 +595,9 @@ specv2_set_mode:
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
++
++ /* Enable STIBP if appropriate */
++ arch_smt_update();
+ }
+
+ #undef pr_fmt
+@@ -831,6 +872,8 @@ static ssize_t l1tf_show_state(char *buf
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
++ int ret;
++
+ if (!boot_cpu_has_bug(bug))
+ return sprintf(buf, "Not affected\n");
+
+@@ -849,10 +892,12 @@ static ssize_t cpu_show_common(struct de
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
++ (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+ spectre_v2_module_string());
++ return ret;
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -1836,6 +1836,12 @@ static void cpuhp_online_cpu_device(unsi
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
++/*
++ * Architectures that need SMT-specific errata handling during SMT hotplug
++ * should override this.
++ */
++void __weak arch_smt_update(void) { };
++
+ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
+@@ -1862,8 +1868,10 @@ static int cpuhp_smt_disable(enum cpuhp_
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret)
++ if (!ret) {
+ cpu_smt_control = ctrlval;
++ arch_smt_update();
++ }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -1874,6 +1882,7 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
++ arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
diff --git a/patches.arch/x86-speculation-enable-prctl-mode-for-spectre_v2_user.patch b/patches.arch/x86-speculation-enable-prctl-mode-for-spectre_v2_user.patch
new file mode 100644
index 0000000000..6ddc3ae20f
--- /dev/null
+++ b/patches.arch/x86-speculation-enable-prctl-mode-for-spectre_v2_user.patch
@@ -0,0 +1,184 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:54 +0100
+Subject: x86/speculation: Enable prctl mode for spectre_v2_user
+Git-commit: 7cc765a67d8e04ef7d772425ca5a2a1e2b894c15
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Now that all prerequisites are in place:
+
+ - Add the prctl command line option
+
+ - Default the 'auto' mode to 'prctl'
+
+ - When SMT state changes, update the static key which controls the
+ conditional STIBP evaluation on context switch.
+
+ - At init update the static key which controls the conditional IBPB
+ evaluation on context switch.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.958421388@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 7 +++-
+ arch/x86/kernel/cpu/bugs.c | 41 ++++++++++++++++++------
+ 2 files changed, 38 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -371,11 +371,13 @@ enum spectre_v2_user_cmd {
+ SPECTRE_V2_USER_CMD_NONE,
+ SPECTRE_V2_USER_CMD_AUTO,
+ SPECTRE_V2_USER_CMD_FORCE,
++ SPECTRE_V2_USER_CMD_PRCTL,
+ };
+
+ static const char * const spectre_v2_user_strings[] = {
+ [SPECTRE_V2_USER_NONE] = "User space: Vulnerable",
+ [SPECTRE_V2_USER_STRICT] = "User space: Mitigation: STIBP protection",
++ [SPECTRE_V2_USER_PRCTL] = "User space: Mitigation: STIBP via prctl",
+ };
+
+ static const struct {
+@@ -386,6 +388,7 @@ static const struct {
+ { "auto", SPECTRE_V2_USER_CMD_AUTO, false },
+ { "off", SPECTRE_V2_USER_CMD_NONE, false },
+ { "on", SPECTRE_V2_USER_CMD_FORCE, true },
++ { "prctl", SPECTRE_V2_USER_CMD_PRCTL, false },
+ };
+
+ static void __init spec_v2_user_print_cond(const char *reason, bool secure)
+@@ -440,12 +443,15 @@ spectre_v2_user_select_mitigation(enum s
+ smt_possible = false;
+
+ switch (spectre_v2_parse_user_cmdline(v2_cmd)) {
+- case SPECTRE_V2_USER_CMD_AUTO:
+ case SPECTRE_V2_USER_CMD_NONE:
+ goto set_mode;
+ case SPECTRE_V2_USER_CMD_FORCE:
+ mode = SPECTRE_V2_USER_STRICT;
+ break;
++ case SPECTRE_V2_USER_CMD_AUTO:
++ case SPECTRE_V2_USER_CMD_PRCTL:
++ mode = SPECTRE_V2_USER_PRCTL;
++ break;
+ }
+
+ /* Initialize Indirect Branch Prediction Barrier */
+@@ -456,6 +462,9 @@ spectre_v2_user_select_mitigation(enum s
+ case SPECTRE_V2_USER_STRICT:
+ static_branch_enable(&switch_mm_always_ibpb);
+ break;
++ case SPECTRE_V2_USER_PRCTL:
++ static_branch_enable(&switch_mm_cond_ibpb);
++ break;
+ default:
+ break;
+ }
+@@ -468,6 +477,12 @@ spectre_v2_user_select_mitigation(enum s
+ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+ return;
+
++ /*
++ * If SMT is not possible or STIBP is not available clear the STIPB
++ * mode.
++ */
++ if (!smt_possible || !boot_cpu_has(X86_FEATURE_STIBP))
++ mode = SPECTRE_V2_USER_NONE;
+ set_mode:
+ spectre_v2_user = mode;
+ /* Only print the STIBP mode when SMT possible */
+@@ -683,6 +698,15 @@ static void update_stibp_strict(void)
+ on_each_cpu(update_stibp_msr, NULL, 1);
+ }
+
++/* Update the static key controlling the evaluation of TIF_SPEC_IB */
++static void update_indir_branch_cond(void)
++{
++ if (sched_smt_active())
++ static_branch_enable(&switch_to_cond_stibp);
++ else
++ static_branch_disable(&switch_to_cond_stibp);
++}
++
+ void arch_smt_update(void)
+ {
+ /* Enhanced IBRS implies STIBP. No update required. */
+@@ -698,6 +722,7 @@ void arch_smt_update(void)
+ update_stibp_strict();
+ break;
+ case SPECTRE_V2_USER_PRCTL:
++ update_indir_branch_cond();
+ break;
+ }
+
+@@ -1053,7 +1078,8 @@ static char *stibp_state(void)
+ case SPECTRE_V2_USER_STRICT:
+ return ", STIBP: forced";
+ case SPECTRE_V2_USER_PRCTL:
+- return "";
++ if (static_key_enabled(&switch_to_cond_stibp))
++ return ", STIBP: conditional";
+ }
+ return "";
+ }
+@@ -1061,14 +1087,11 @@ static char *stibp_state(void)
+ static char *ibpb_state(void)
+ {
+ if (boot_cpu_has(X86_FEATURE_IBPB)) {
+- switch (spectre_v2_user) {
+- case SPECTRE_V2_USER_NONE:
+- return ", IBPB: disabled";
+- case SPECTRE_V2_USER_STRICT:
++ if (static_key_enabled(&switch_mm_always_ibpb))
+ return ", IBPB: always-on";
+- case SPECTRE_V2_USER_PRCTL:
+- return "";
+- }
++ if (static_key_enabled(&switch_mm_cond_ibpb))
++ return ", IBPB: conditional";
++ return ", IBPB: disabled";
+ }
+ return "";
+ }
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4005,9 +4005,14 @@
+ off - Unconditionally disable mitigations. Is
+ enforced by spectre_v2=off
+
++ prctl - Indirect branch speculation is enabled,
++ but mitigation can be enabled via prctl
++ per thread. The mitigation control state
++ is inherited on fork.
++
+ auto - Kernel selects the mitigation depending on
+ the available CPU features and vulnerability.
+- Default is off.
++ Default is prctl.
+
+ Not specifying this option is equivalent to
+ spectre_v2_user=auto.
diff --git a/patches.arch/x86-speculation-mark-string-arrays-const-correctly.patch b/patches.arch/x86-speculation-mark-string-arrays-const-correctly.patch
new file mode 100644
index 0000000000..85d4dc3701
--- /dev/null
+++ b/patches.arch/x86-speculation-mark-string-arrays-const-correctly.patch
@@ -0,0 +1,70 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:42 +0100
+Subject: x86/speculation: Mark string arrays const correctly
+Git-commit: 8770709f411763884535662744a3786a1806afd3
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+checkpatch.pl muttered when reshuffling the code:
+ WARNING: static const char * array should probably be static const char * const
+
+Fix up all the string arrays.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.800018931@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -353,7 +353,7 @@ enum spectre_v2_mitigation_cmd {
+ SPECTRE_V2_CMD_RETPOLINE_AMD,
+ };
+
+-static const char *spectre_v2_strings[] = {
++static const char * const spectre_v2_strings[] = {
+ [SPECTRE_V2_NONE] = "Vulnerable",
+ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
+@@ -607,7 +607,7 @@ enum ssb_mitigation_cmd {
+ SPEC_STORE_BYPASS_CMD_SECCOMP,
+ };
+
+-static const char *ssb_strings[] = {
++static const char * const ssb_strings[] = {
+ [SPEC_STORE_BYPASS_NONE] = "Vulnerable",
+ [SPEC_STORE_BYPASS_DISABLE] = "Mitigation: Speculative Store Bypass disabled",
+ [SPEC_STORE_BYPASS_PRCTL] = "Mitigation: Speculative Store Bypass disabled via prctl",
+@@ -831,7 +831,7 @@ void x86_spec_ctrl_setup_ap(void)
+ #define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion"
+
+ #if IS_ENABLED(CONFIG_KVM_INTEL)
+-static const char *l1tf_vmx_states[] = {
++static const char * const l1tf_vmx_states[] = {
+ [VMENTER_L1D_FLUSH_AUTO] = "auto",
+ [VMENTER_L1D_FLUSH_NEVER] = "vulnerable",
+ [VMENTER_L1D_FLUSH_COND] = "conditional cache flushes",
diff --git a/patches.arch/x86-speculation-move-stipb-ibpb-string-conditionals-out-of-cpu_show_common.patch b/patches.arch/x86-speculation-move-stipb-ibpb-string-conditionals-out-of-cpu_show_common.patch
new file mode 100644
index 0000000000..32eafee3b7
--- /dev/null
+++ b/patches.arch/x86-speculation-move-stipb-ibpb-string-conditionals-out-of-cpu_show_common.patch
@@ -0,0 +1,85 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:32 +0100
+Subject: x86/speculation: Move STIPB/IBPB string conditionals out of
+ cpu_show_common()
+Git-commit: a8f76ae41cd633ac00be1b3019b1eb4741be3828
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The Spectre V2 printout in cpu_show_common() handles conditionals for the
+various mitigation methods directly in the sprintf() argument list. That's
+hard to read and will become unreadable if more complex decisions need to
+be made for a particular method.
+
+Move the conditionals for STIBP and IBPB string selection into helper
+functions, so they can be extended later on.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185003.874479208@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index b52a48966e01..a1502bce9eb8 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -844,6 +844,22 @@ static ssize_t l1tf_show_state(char *buf)
+ }
+ #endif
+
++static char *stibp_state(void)
++{
++ if (x86_spec_ctrl_base & SPEC_CTRL_STIBP)
++ return ", STIBP";
++ else
++ return "";
++}
++
++static char *ibpb_state(void)
++{
++ if (boot_cpu_has(X86_FEATURE_USE_IBPB))
++ return ", IBPB";
++ else
++ return "";
++}
++
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+@@ -865,9 +881,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+
+ case X86_BUG_SPECTRE_V2:
+ return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+- boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
++ ibpb_state(),
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+- (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
++ stibp_state(),
+ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+ spectre_v2_module_string());
+
+
diff --git a/patches.arch/x86-speculation-prepare-arch_smt_update-for-prctl-mode.patch b/patches.arch/x86-speculation-prepare-arch_smt_update-for-prctl-mode.patch
new file mode 100644
index 0000000000..eabf975280
--- /dev/null
+++ b/patches.arch/x86-speculation-prepare-arch_smt_update-for-prctl-mode.patch
@@ -0,0 +1,113 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:52 +0100
+Subject: x86/speculation: Prepare arch_smt_update() for PRCTL mode
+Git-commit: 6893a959d7fdebbab5f5aa112c277d5a44435ba1
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The upcoming fine grained per task STIBP control needs to be updated on CPU
+hotplug as well.
+
+Split out the code which controls the strict mode so the prctl control code
+can be added later. Mark the SMP function call argument __unused while at it.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.759457117@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 46 +++++++++++++++++++++++++---------------------
+ 1 file changed, 25 insertions(+), 21 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 29f40a92f5a8..9cab538e10f1 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -530,40 +530,44 @@ static void __init spectre_v2_select_mitigation(void)
+ arch_smt_update();
+ }
+
+-static bool stibp_needed(void)
++static void update_stibp_msr(void * __unused)
+ {
+- /* Enhanced IBRS makes using STIBP unnecessary. */
+- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+- return false;
+-
+- /* Check for strict user mitigation mode */
+- return spectre_v2_user == SPECTRE_V2_USER_STRICT;
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+ }
+
+-static void update_stibp_msr(void *info)
++/* Update x86_spec_ctrl_base in case SMT state changed. */
++static void update_stibp_strict(void)
+ {
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ u64 mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
++
++ if (sched_smt_active())
++ mask |= SPEC_CTRL_STIBP;
++
++ if (mask == x86_spec_ctrl_base)
++ return;
++
++ pr_info("Update user space SMT mitigation: STIBP %s\n",
++ mask & SPEC_CTRL_STIBP ? "always-on" : "off");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
+ }
+
+ void arch_smt_update(void)
+ {
+- u64 mask;
+-
+- if (!stibp_needed())
++ /* Enhanced IBRS implies STIBP. No update required. */
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+ return;
+
+ mutex_lock(&spec_ctrl_mutex);
+
+- mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
+- if (sched_smt_active())
+- mask |= SPEC_CTRL_STIBP;
+-
+- if (mask != x86_spec_ctrl_base) {
+- pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
+- mask & SPEC_CTRL_STIBP ? "Enabling" : "Disabling");
+- x86_spec_ctrl_base = mask;
+- on_each_cpu(update_stibp_msr, NULL, 1);
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ break;
++ case SPECTRE_V2_USER_STRICT:
++ update_stibp_strict();
++ break;
+ }
++
+ mutex_unlock(&spec_ctrl_mutex);
+ }
+
+
diff --git a/patches.arch/x86-speculation-prepare-for-conditional-ibpb-in-switch_mm.patch b/patches.arch/x86-speculation-prepare-for-conditional-ibpb-in-switch_mm.patch
new file mode 100644
index 0000000000..846446fb75
--- /dev/null
+++ b/patches.arch/x86-speculation-prepare-for-conditional-ibpb-in-switch_mm.patch
@@ -0,0 +1,333 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:49 +0100
+Subject: x86/speculation: Prepare for conditional IBPB in switch_mm()
+Git-commit: 4c71a2b6fd7e42814aa68a6dec88abf3b42ea573
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The IBPB speculation barrier is issued from switch_mm() when the kernel
+switches to a user space task with a different mm than the user space task
+which ran last on the same CPU.
+
+An additional optimization is to avoid IBPB when the incoming task can be
+ptraced by the outgoing task. This optimization only works when switching
+directly between two user space tasks. When switching from a kernel task to
+a user space task the optimization fails because the previous task cannot
+be accessed anymore. So for quite some scenarios the optimization is just
+adding overhead.
+
+The upcoming conditional IBPB support will issue IBPB only for user space
+tasks which have the TIF_SPEC_IB bit set. This requires to handle the
+following cases:
+
+ 1) Switch from a user space task (potential attacker) which has
+ TIF_SPEC_IB set to a user space task (potential victim) which has
+ TIF_SPEC_IB not set.
+
+ 2) Switch from a user space task (potential attacker) which has
+ TIF_SPEC_IB not set to a user space task (potential victim) which has
+ TIF_SPEC_IB set.
+
+This needs to be optimized for the case where the IBPB can be avoided when
+only kernel threads ran in between user space tasks which belong to the
+same process.
+
+The current check whether two tasks belong to the same context is using the
+tasks context id. While correct, it's simpler to use the mm pointer because
+it allows to mangle the TIF_SPEC_IB bit into it. The context id based
+mechanism requires extra storage, which creates worse code.
+
+When a task is scheduled out its TIF_SPEC_IB bit is mangled as bit 0 into
+the per CPU storage which is used to track the last user space mm which was
+running on a CPU. This bit can be used together with the TIF_SPEC_IB bit of
+the incoming task to make the decision whether IBPB needs to be issued or
+not to cover the two cases above.
+
+As conditional IBPB is going to be the default, remove the dubious ptrace
+check for the IBPB always case and simply issue IBPB always when the
+process changes.
+
+Move the storage to a different place in the struct as the original one
+created a hole.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.466447057@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/nospec-branch.h | 2
+ arch/x86/include/asm/tlbflush.h | 8 +-
+ arch/x86/kernel/cpu/bugs.c | 29 +++++++-
+ arch/x86/mm/tlb.c | 115 ++++++++++++++++++++++++++---------
+ 4 files changed, 118 insertions(+), 36 deletions(-)
+
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -304,6 +304,8 @@ do { \
+ } while (0)
+
+ DECLARE_STATIC_KEY_FALSE(switch_to_cond_stibp);
++DECLARE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
++DECLARE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
+ #endif /* __ASSEMBLY__ */
+
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -184,10 +184,14 @@ struct tlb_state {
+
+ #define LOADED_MM_SWITCHING ((struct mm_struct *)1)
+
++ /* Last user mm for optimizing IBPB */
++ union {
++ struct mm_struct *last_user_mm;
++ unsigned long last_user_mm_ibpb;
++ };
++
+ u16 loaded_mm_asid;
+ u16 next_asid;
+- /* last user mm's ctx id */
+- u64 last_ctx_id;
+
+ /*
+ * We can be in one of several states:
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -55,6 +55,10 @@ u64 __ro_after_init x86_amd_ls_cfg_ssbd_
+
+ /* Control conditional STIPB in switch_to() */
+ DEFINE_STATIC_KEY_FALSE(switch_to_cond_stibp);
++/* Control conditional IBPB in switch_mm() */
++DEFINE_STATIC_KEY_FALSE(switch_mm_cond_ibpb);
++/* Control unconditional IBPB in switch_mm() */
++DEFINE_STATIC_KEY_FALSE(switch_mm_always_ibpb);
+
+ void __init check_bugs(void)
+ {
+@@ -447,7 +451,17 @@ spectre_v2_user_select_mitigation(enum s
+ /* Initialize Indirect Branch Prediction Barrier */
+ if (boot_cpu_has(X86_FEATURE_IBPB)) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+- pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n");
++
++ switch (mode) {
++ case SPECTRE_V2_USER_STRICT:
++ static_branch_enable(&switch_mm_always_ibpb);
++ break;
++ default:
++ break;
++ }
++
++ pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
++ mode == SPECTRE_V2_USER_STRICT ? "always-on" : "conditional");
+ }
+
+ /* If enhanced IBRS is enabled no STIPB required */
+@@ -970,10 +984,15 @@ static char *stibp_state(void)
+
+ static char *ibpb_state(void)
+ {
+- if (boot_cpu_has(X86_FEATURE_USE_IBPB))
+- return ", IBPB";
+- else
+- return "";
++ if (boot_cpu_has(X86_FEATURE_IBPB)) {
++ switch (spectre_v2_user) {
++ case SPECTRE_V2_USER_NONE:
++ return ", IBPB: disabled";
++ case SPECTRE_V2_USER_STRICT:
++ return ", IBPB: always-on";
++ }
++ }
++ return "";
+ }
+
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -7,7 +7,6 @@
+ #include <linux/export.h>
+ #include <linux/cpu.h>
+ #include <linux/debugfs.h>
+-#include <linux/ptrace.h>
+
+ #include <asm/tlbflush.h>
+ #include <asm/mmu_context.h>
+@@ -31,6 +30,12 @@
+ */
+
+ /*
++ * Use bit 0 to mangle the TIF_SPEC_IB state into the mm pointer which is
++ * stored in cpu_tlb_state.last_user_mm_ibpb.
++ */
++#define LAST_USER_MM_IBPB 0x1UL
++
++/*
+ * We get here when we do something requiring a TLB invalidation
+ * but could not go invalidate all of the contexts. We do the
+ * necessary invalidation by clearing out the 'ctx_id' which
+@@ -181,17 +186,87 @@ static void sync_current_stack_to_mm(str
+ }
+ }
+
+-static bool ibpb_needed(struct task_struct *tsk, u64 last_ctx_id)
++static inline unsigned long mm_mangle_tif_spec_ib(struct task_struct *next)
++{
++ unsigned long next_tif = task_thread_info(next)->flags;
++ unsigned long ibpb = (next_tif >> TIF_SPEC_IB) & LAST_USER_MM_IBPB;
++
++ return (unsigned long)next->mm | ibpb;
++}
++
++static void cond_ibpb(struct task_struct *next)
+ {
++ if (!next || !next->mm)
++ return;
++
+ /*
+- * Check if the current (previous) task has access to the memory
+- * of the @tsk (next) task. If access is denied, make sure to
+- * issue a IBPB to stop user->user Spectre-v2 attacks.
+- *
+- * Note: __ptrace_may_access() returns 0 or -ERRNO.
++ * Both, the conditional and the always IBPB mode use the mm
++ * pointer to avoid the IBPB when switching between tasks of the
++ * same process. Using the mm pointer instead of mm->context.ctx_id
++ * opens a hypothetical hole vs. mm_struct reuse, which is more or
++ * less impossible to control by an attacker. Aside of that it
++ * would only affect the first schedule so the theoretically
++ * exposed data is not really interesting.
+ */
+- return (tsk && tsk->mm && tsk->mm->context.ctx_id != last_ctx_id &&
+- ptrace_may_access_sched(tsk, PTRACE_MODE_SPEC_IBPB));
++ if (static_branch_likely(&switch_mm_cond_ibpb)) {
++ unsigned long prev_mm, next_mm;
++
++ /*
++ * This is a bit more complex than the always mode because
++ * it has to handle two cases:
++ *
++ * 1) Switch from a user space task (potential attacker)
++ * which has TIF_SPEC_IB set to a user space task
++ * (potential victim) which has TIF_SPEC_IB not set.
++ *
++ * 2) Switch from a user space task (potential attacker)
++ * which has TIF_SPEC_IB not set to a user space task
++ * (potential victim) which has TIF_SPEC_IB set.
++ *
++ * This could be done by unconditionally issuing IBPB when
++ * a task which has TIF_SPEC_IB set is either scheduled in
++ * or out. Though that results in two flushes when:
++ *
++ * - the same user space task is scheduled out and later
++ * scheduled in again and only a kernel thread ran in
++ * between.
++ *
++ * - a user space task belonging to the same process is
++ * scheduled in after a kernel thread ran in between
++ *
++ * - a user space task belonging to the same process is
++ * scheduled in immediately.
++ *
++ * Optimize this with reasonably small overhead for the
++ * above cases. Mangle the TIF_SPEC_IB bit into the mm
++ * pointer of the incoming task which is stored in
++ * cpu_tlbstate.last_user_mm_ibpb for comparison.
++ */
++ next_mm = mm_mangle_tif_spec_ib(next);
++ prev_mm = this_cpu_read(cpu_tlbstate.last_user_mm_ibpb);
++
++ /*
++ * Issue IBPB only if the mm's are different and one or
++ * both have the IBPB bit set.
++ */
++ if (next_mm != prev_mm &&
++ (next_mm | prev_mm) & LAST_USER_MM_IBPB)
++ indirect_branch_prediction_barrier();
++
++ this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, next_mm);
++ }
++
++ if (static_branch_unlikely(&switch_mm_always_ibpb)) {
++ /*
++ * Only flush when switching to a user space task with a
++ * different context than the user space task which ran
++ * last on this CPU.
++ */
++ if (this_cpu_read(cpu_tlbstate.last_user_mm) != next->mm) {
++ indirect_branch_prediction_barrier();
++ this_cpu_write(cpu_tlbstate.last_user_mm, next->mm);
++ }
++ }
+ }
+
+ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next,
+@@ -262,22 +337,12 @@ void switch_mm_irqs_off(struct mm_struct
+ } else {
+ u16 new_asid;
+ bool need_flush;
+- u64 last_ctx_id = this_cpu_read(cpu_tlbstate.last_ctx_id);
+-
+ /*
+ * Avoid user/user BTB poisoning by flushing the branch
+ * predictor when switching between processes. This stops
+ * one process from doing Spectre-v2 attacks on another.
+- *
+- * As an optimization, flush indirect branches only when
+- * switching into a processes that can't be ptrace by the
+- * current one (as in such case, attacker has much more
+- * convenient way how to tamper with the next process than
+- * branch buffer poisoning).
+ */
+- if (static_cpu_has(X86_FEATURE_USE_IBPB) &&
+- ibpb_needed(tsk, last_ctx_id))
+- indirect_branch_prediction_barrier();
++ cond_ibpb(tsk);
+
+ if (IS_ENABLED(CONFIG_VMAP_STACK)) {
+ /*
+@@ -327,14 +392,6 @@ void switch_mm_irqs_off(struct mm_struct
+ trace_tlb_flush_rcuidle(TLB_FLUSH_ON_TASK_SWITCH, 0);
+ }
+
+- /*
+- * Record last user mm's context id, so we can avoid
+- * flushing branch buffer with IBPB if we switch back
+- * to the same user.
+- */
+- if (next != &init_mm)
+- this_cpu_write(cpu_tlbstate.last_ctx_id, next->context.ctx_id);
+-
+ /* Make sure we write CR3 before loaded_mm. */
+ barrier();
+
+@@ -451,7 +508,7 @@ void initialize_tlbstate_and_flush(void)
+ write_cr3(build_cr3(mm->pgd, 0));
+
+ /* Reinitialize tlbstate. */
+- this_cpu_write(cpu_tlbstate.last_ctx_id, mm->context.ctx_id);
++ this_cpu_write(cpu_tlbstate.last_user_mm_ibpb, LAST_USER_MM_IBPB);
+ this_cpu_write(cpu_tlbstate.loaded_mm_asid, 0);
+ this_cpu_write(cpu_tlbstate.next_asid, 1);
+ this_cpu_write(cpu_tlbstate.ctxs[0].ctx_id, mm->context.ctx_id);
diff --git a/patches.arch/x86-speculation-prepare-for-per-task-indirect-branch-speculation-control.patch b/patches.arch/x86-speculation-prepare-for-per-task-indirect-branch-speculation-control.patch
new file mode 100644
index 0000000000..4eb5c013e3
--- /dev/null
+++ b/patches.arch/x86-speculation-prepare-for-per-task-indirect-branch-speculation-control.patch
@@ -0,0 +1,180 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:46 +0100
+Subject: x86/speculation: Prepare for per task indirect branch speculation
+ control
+Git-commit: 5bfbe3ad5840d941b89bcac54b821ba14f50a0ba
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+To avoid the overhead of STIBP always on, it's necessary to allow per task
+control of STIBP.
+
+Add a new task flag TIF_SPEC_IB and evaluate it during context switch if
+SMT is active and flag evaluation is enabled by the speculation control
+code. Add the conditional evaluation to x86_virt_spec_ctrl() as well so the
+guest/host switch works properly.
+
+This has no effect because TIF_SPEC_IB cannot be set yet and the static key
+which controls evaluation is off. Preparatory patch for adding the control
+code.
+
+[ tglx: Simplify the context switch logic and make the TIF evaluation
+ depend on SMP=y and on the static key controlling the conditional
+ update. Rename it to TIF_SPEC_IB because it controls both STIBP and
+ IBPB ]
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.176917199@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/msr-index.h | 5 +++--
+ arch/x86/include/asm/spec-ctrl.h | 12 ++++++++++++
+ arch/x86/include/asm/thread_info.h | 5 ++++-
+ arch/x86/kernel/cpu/bugs.c | 4 ++++
+ arch/x86/kernel/process.c | 20 ++++++++++++++++++--
+ 5 files changed, 41 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -40,9 +40,10 @@
+
+ #define MSR_IA32_SPEC_CTRL 0x00000048 /* Speculation Control */
+ #define SPEC_CTRL_IBRS (1 << 0) /* Indirect Branch Restricted Speculation */
+-#define SPEC_CTRL_STIBP (1 << 1) /* Single Thread Indirect Branch Predictors */
++#define SPEC_CTRL_STIBP_SHIFT 1 /* Single Thread Indirect Branch Predictor (STIBP) bit */
++#define SPEC_CTRL_STIBP (1 << SPEC_CTRL_STIBP_SHIFT) /* STIBP mask */
+ #define SPEC_CTRL_SSBD_SHIFT 2 /* Speculative Store Bypass Disable bit */
+-#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
++#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */
+
+ #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */
+ #define PRED_CMD_IBPB (1 << 0) /* Indirect Branch Prediction Barrier */
+--- a/arch/x86/include/asm/spec-ctrl.h
++++ b/arch/x86/include/asm/spec-ctrl.h
+@@ -53,12 +53,24 @@ static inline u64 ssbd_tif_to_spec_ctrl(
+ return (tifn & _TIF_SSBD) >> (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
+ }
+
++static inline u64 stibp_tif_to_spec_ctrl(u64 tifn)
++{
++ BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
++ return (tifn & _TIF_SPEC_IB) >> (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
++}
++
+ static inline unsigned long ssbd_spec_ctrl_to_tif(u64 spec_ctrl)
+ {
+ BUILD_BUG_ON(TIF_SSBD < SPEC_CTRL_SSBD_SHIFT);
+ return (spec_ctrl & SPEC_CTRL_SSBD) << (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT);
+ }
+
++static inline unsigned long stibp_spec_ctrl_to_tif(u64 spec_ctrl)
++{
++ BUILD_BUG_ON(TIF_SPEC_IB < SPEC_CTRL_STIBP_SHIFT);
++ return (spec_ctrl & SPEC_CTRL_STIBP) << (TIF_SPEC_IB - SPEC_CTRL_STIBP_SHIFT);
++}
++
+ static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn)
+ {
+ return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL;
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -84,6 +84,7 @@ struct thread_info {
+ #define TIF_SYSCALL_EMU 6 /* syscall emulation active */
+ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */
+ #define TIF_SECCOMP 8 /* secure computing */
++#define TIF_SPEC_IB 9 /* Indirect branch speculation mitigation */
+ #define TIF_USER_RETURN_NOTIFY 11 /* notify kernel of userspace return */
+ #define TIF_UPROBE 12 /* breakpointed or singlestepping */
+ #define TIF_PATCH_PENDING 13 /* pending live patching update */
+@@ -110,6 +111,7 @@ struct thread_info {
+ #define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU)
+ #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
+ #define _TIF_SECCOMP (1 << TIF_SECCOMP)
++#define _TIF_SPEC_IB (1 << TIF_SPEC_IB)
+ #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
+ #define _TIF_UPROBE (1 << TIF_UPROBE)
+ #define _TIF_PATCH_PENDING (1 << TIF_PATCH_PENDING)
+@@ -144,7 +146,8 @@ struct thread_info {
+
+ /* flags to check in __switch_to() */
+ #define _TIF_WORK_CTXSW \
+- (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|_TIF_SSBD)
++ (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP| \
++ _TIF_SSBD|_TIF_SPEC_IB)
+
+ #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY)
+ #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW)
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -147,6 +147,10 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl,
+ static_cpu_has(X86_FEATURE_AMD_SSBD))
+ hostval |= ssbd_tif_to_spec_ctrl(ti->flags);
+
++ /* Conditional STIBP enabled? */
++ if (static_branch_unlikely(&switch_to_cond_stibp))
++ hostval |= stibp_tif_to_spec_ctrl(ti->flags);
++
+ if (hostval != guestval) {
+ msrval = setguest ? guestval : hostval;
+ wrmsrl(MSR_IA32_SPEC_CTRL, msrval);
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -406,11 +406,17 @@ static __always_inline void amd_set_ssb_
+ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+ unsigned long tifn)
+ {
++ unsigned long tif_diff = tifp ^ tifn;
+ u64 msr = x86_spec_ctrl_base;
+ bool updmsr = false;
+
+- /* If TIF_SSBD is different, select the proper mitigation method */
+- if ((tifp ^ tifn) & _TIF_SSBD) {
++ /*
++ * If TIF_SSBD is different, select the proper mitigation
++ * method. Note that if SSBD mitigation is disabled or permanentely
++ * enabled this branch can't be taken because nothing can set
++ * TIF_SSBD.
++ */
++ if (tif_diff & _TIF_SSBD) {
+ if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
+ amd_set_ssb_virt_state(tifn);
+ } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
+@@ -422,6 +428,16 @@ static __always_inline void __speculatio
+ }
+ }
+
++ /*
++ * Only evaluate TIF_SPEC_IB if conditional STIBP is enabled,
++ * otherwise avoid the MSR write.
++ */
++ if (IS_ENABLED(CONFIG_SMP) &&
++ static_branch_unlikely(&switch_to_cond_stibp)) {
++ updmsr |= !!(tif_diff & _TIF_SPEC_IB);
++ msr |= stibp_tif_to_spec_ctrl(tifn);
++ }
++
+ if (updmsr)
+ wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+ }
diff --git a/patches.arch/x86-speculation-prevent-stale-spec_ctrl-msr-content.patch b/patches.arch/x86-speculation-prevent-stale-spec_ctrl-msr-content.patch
new file mode 100644
index 0000000000..65dbd2c966
--- /dev/null
+++ b/patches.arch/x86-speculation-prevent-stale-spec_ctrl-msr-content.patch
@@ -0,0 +1,230 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 28 Nov 2018 10:56:57 +0100
+Subject: x86/speculation: Prevent stale SPEC_CTRL msr content
+Git-commit: 6d991ba509ebcfcc908e009d1db51972a4f7a064
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The seccomp speculation control operates on all tasks of a process, but
+only the current task of a process can update the MSR immediately. For the
+other threads the update is deferred to the next context switch.
+
+This creates the following situation with Process A and B:
+
+Process A task 2 and Process B task 1 are pinned on CPU1. Process A task 2
+does not have the speculation control TIF bit set. Process B task 1 has the
+speculation control TIF bit set.
+
+CPU0 CPU1
+ MSR bit is set
+ ProcB.T1 schedules out
+ ProcA.T2 schedules in
+ MSR bit is cleared
+ProcA.T1
+ seccomp_update()
+ set TIF bit on ProcA.T2
+ ProcB.T1 schedules in
+ MSR is not updated <-- FAIL
+
+This happens because the context switch code tries to avoid the MSR update
+if the speculation control TIF bits of the incoming and the outgoing task
+are the same. In the worst case ProcB.T1 and ProcA.T2 are the only tasks
+scheduling back and forth on CPU1, which keeps the MSR stale forever.
+
+In theory this could be remedied by IPIs, but chasing the remote task which
+could be migrated is complex and full of races.
+
+The straight forward solution is to avoid the asychronous update of the TIF
+bit and defer it to the next context switch. The speculation control state
+is stored in task_struct::atomic_flags by the prctl and seccomp updates
+already.
+
+Add a new TIF_SPEC_FORCE_UPDATE bit and set this after updating the
+atomic_flags. Check the bit on context switch and force a synchronous
+update of the speculation control if set. Use the same mechanism for
+updating the current task.
+
+Reported-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1811272247140.1875@nanos.tec.linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/spec-ctrl.h | 6 +-----
+ arch/x86/include/asm/thread_info.h | 4 +++-
+ arch/x86/kernel/cpu/bugs.c | 18 +++++++-----------
+ arch/x86/kernel/process.c | 30 +++++++++++++++++++++++++++++-
+ 4 files changed, 40 insertions(+), 18 deletions(-)
+
+diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h
+index 27b0bce3933b..5393babc0598 100644
+--- a/arch/x86/include/asm/spec-ctrl.h
++++ b/arch/x86/include/asm/spec-ctrl.h
+@@ -83,10 +83,6 @@ static inline void speculative_store_bypass_ht_init(void) { }
+ #endif
+
+ extern void speculation_ctrl_update(unsigned long tif);
+-
+-static inline void speculation_ctrl_update_current(void)
+-{
+- speculation_ctrl_update(current_thread_info()->flags);
+-}
++extern void speculation_ctrl_update_current(void);
+
+ #endif
+diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
+index 6d201699c651..82b73b75d67c 100644
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -84,6 +84,7 @@ struct thread_info {
+ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */
+ #define TIF_SECCOMP 8 /* secure computing */
+ #define TIF_SPEC_IB 9 /* Indirect branch speculation mitigation */
++#define TIF_SPEC_FORCE_UPDATE 10 /* Force speculation MSR update in context switch */
+ #define TIF_USER_RETURN_NOTIFY 11 /* notify kernel of userspace return */
+ #define TIF_UPROBE 12 /* breakpointed or singlestepping */
+ #define TIF_PATCH_PENDING 13 /* pending live patching update */
+@@ -112,6 +113,7 @@ struct thread_info {
+ #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT)
+ #define _TIF_SECCOMP (1 << TIF_SECCOMP)
+ #define _TIF_SPEC_IB (1 << TIF_SPEC_IB)
++#define _TIF_SPEC_FORCE_UPDATE (1 << TIF_SPEC_FORCE_UPDATE)
+ #define _TIF_USER_RETURN_NOTIFY (1 << TIF_USER_RETURN_NOTIFY)
+ #define _TIF_UPROBE (1 << TIF_UPROBE)
+ #define _TIF_PATCH_PENDING (1 << TIF_PATCH_PENDING)
+@@ -149,7 +151,7 @@ struct thread_info {
+ /* flags to check in __switch_to() */
+ #define _TIF_WORK_CTXSW_BASE \
+ (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP| \
+- _TIF_SSBD)
++ _TIF_SSBD | _TIF_SPEC_FORCE_UPDATE)
+
+ /*
+ * Avoid calls to __switch_to_xtra() on UP as STIBP is not evaluated.
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 3b65a53d2c33..29f40a92f5a8 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -702,14 +702,10 @@ static void ssb_select_mitigation(void)
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Speculation prctl: " fmt
+
+-static void task_update_spec_tif(struct task_struct *tsk, int tifbit, bool on)
++static void task_update_spec_tif(struct task_struct *tsk)
+ {
+- bool update;
+-
+- if (on)
+- update = !test_and_set_tsk_thread_flag(tsk, tifbit);
+- else
+- update = test_and_clear_tsk_thread_flag(tsk, tifbit);
++ /* Force the update of the real TIF bits */
++ set_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE);
+
+ /*
+ * Immediately update the speculation control MSRs for the current
+@@ -719,7 +715,7 @@ static void task_update_spec_tif(struct task_struct *tsk, int tifbit, bool on)
+ * This can only happen for SECCOMP mitigation. For PRCTL it's
+ * always the current task.
+ */
+- if (tsk == current && update)
++ if (tsk == current)
+ speculation_ctrl_update_current();
+ }
+
+@@ -735,16 +731,16 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (task_spec_ssb_force_disable(task))
+ return -EPERM;
+ task_clear_spec_ssb_disable(task);
+- task_update_spec_tif(task, TIF_SSBD, false);
++ task_update_spec_tif(task);
+ break;
+ case PR_SPEC_DISABLE:
+ task_set_spec_ssb_disable(task);
+- task_update_spec_tif(task, TIF_SSBD, true);
++ task_update_spec_tif(task);
+ break;
+ case PR_SPEC_FORCE_DISABLE:
+ task_set_spec_ssb_disable(task);
+ task_set_spec_ssb_force_disable(task);
+- task_update_spec_tif(task, TIF_SSBD, true);
++ task_update_spec_tif(task);
+ break;
+ default:
+ return -ERANGE;
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index cdf8e6694f71..afbe2eb4a1c6 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -443,6 +443,18 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+ wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+ }
+
++static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
++{
++ if (test_and_clear_tsk_thread_flag(tsk, TIF_SPEC_FORCE_UPDATE)) {
++ if (task_spec_ssb_disable(tsk))
++ set_tsk_thread_flag(tsk, TIF_SSBD);
++ else
++ clear_tsk_thread_flag(tsk, TIF_SSBD);
++ }
++ /* Return the updated threadinfo flags*/
++ return task_thread_info(tsk)->flags;
++}
++
+ void speculation_ctrl_update(unsigned long tif)
+ {
+ /* Forced update. Make sure all relevant TIF flags are different */
+@@ -451,6 +463,14 @@ void speculation_ctrl_update(unsigned long tif)
+ preempt_enable();
+ }
+
++/* Called from seccomp/prctl update */
++void speculation_ctrl_update_current(void)
++{
++ preempt_disable();
++ speculation_ctrl_update(speculation_ctrl_update_tif(current));
++ preempt_enable();
++}
++
+ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
+ {
+ struct thread_struct *prev, *next;
+@@ -482,7 +502,15 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p)
+ if ((tifp ^ tifn) & _TIF_NOCPUID)
+ set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
+
+- __speculation_ctrl_update(tifp, tifn);
++ if (likely(!((tifp | tifn) & _TIF_SPEC_FORCE_UPDATE))) {
++ __speculation_ctrl_update(tifp, tifn);
++ } else {
++ speculation_ctrl_update_tif(prev_p);
++ tifn = speculation_ctrl_update_tif(next_p);
++
++ /* Enforce MSR update to ensure consistent state */
++ __speculation_ctrl_update(~tifn, tifn);
++ }
+ }
+
+ /*
+
diff --git a/patches.arch/x86-speculation-propagate-information-about-rsb-filling-mitigation-to-sysfs.patch b/patches.arch/x86-speculation-propagate-information-about-rsb-filling-mitigation-to-sysfs.patch
new file mode 100644
index 0000000000..76d74769dc
--- /dev/null
+++ b/patches.arch/x86-speculation-propagate-information-about-rsb-filling-mitigation-to-sysfs.patch
@@ -0,0 +1,44 @@
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Tue, 25 Sep 2018 14:39:28 +0200
+Subject: x86/speculation: Propagate information about RSB filling mitigation
+ to sysfs
+Git-commit: bb4b3b7762735cdaba5a40fd94c9303d9ffa147a
+Patch-mainline: v4.20-rc1
+References: bsc#1106913
+
+If spectrev2 mitigation has been enabled, RSB is filled on context switch
+in order to protect from various classes of spectrev2 attacks.
+
+If this mitigation is enabled, say so in sysfs for spectrev2.
+
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: "WoodhouseDavid" <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: "SchauflerCasey" <casey.schaufler@intel.com>
+Link: https://lkml.kernel.org/r/nycvar.YFH.7.76.1809251438580.15880@cbobk.fhfr.pm
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -892,10 +892,11 @@ static ssize_t cpu_show_common(struct de
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- ret = sprintf(buf, "%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+ (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
++ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+ spectre_v2_module_string());
+ return ret;
+
diff --git a/patches.arch/x86-speculation-provide-ibpb-always-command-line-options.patch b/patches.arch/x86-speculation-provide-ibpb-always-command-line-options.patch
new file mode 100644
index 0000000000..c2169e699e
--- /dev/null
+++ b/patches.arch/x86-speculation-provide-ibpb-always-command-line-options.patch
@@ -0,0 +1,160 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:56 +0100
+Subject: x86/speculation: Provide IBPB always command line options
+Git-commit: 55a974021ec952ee460dc31ca08722158639de72
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Provide the possibility to enable IBPB always in combination with 'prctl'
+and 'seccomp'.
+
+Add the extra command line options and rework the IBPB selection to
+evaluate the command instead of the mode selected by the STIPB switch case.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185006.144047038@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ Documentation/admin-guide/kernel-parameters.txt | 12 ++++++++
+ arch/x86/kernel/cpu/bugs.c | 34 ++++++++++++++++--------
+ 2 files changed, 35 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -372,7 +372,9 @@ enum spectre_v2_user_cmd {
+ SPECTRE_V2_USER_CMD_AUTO,
+ SPECTRE_V2_USER_CMD_FORCE,
+ SPECTRE_V2_USER_CMD_PRCTL,
++ SPECTRE_V2_USER_CMD_PRCTL_IBPB,
+ SPECTRE_V2_USER_CMD_SECCOMP,
++ SPECTRE_V2_USER_CMD_SECCOMP_IBPB,
+ };
+
+ static const char * const spectre_v2_user_strings[] = {
+@@ -387,11 +389,13 @@ static const struct {
+ enum spectre_v2_user_cmd cmd;
+ bool secure;
+ } v2_user_options[] __initdata = {
+- { "auto", SPECTRE_V2_USER_CMD_AUTO, false },
+- { "off", SPECTRE_V2_USER_CMD_NONE, false },
+- { "on", SPECTRE_V2_USER_CMD_FORCE, true },
+- { "prctl", SPECTRE_V2_USER_CMD_PRCTL, false },
+- { "seccomp", SPECTRE_V2_USER_CMD_SECCOMP, false },
++ { "auto", SPECTRE_V2_USER_CMD_AUTO, false },
++ { "off", SPECTRE_V2_USER_CMD_NONE, false },
++ { "on", SPECTRE_V2_USER_CMD_FORCE, true },
++ { "prctl", SPECTRE_V2_USER_CMD_PRCTL, false },
++ { "prctl,ibpb", SPECTRE_V2_USER_CMD_PRCTL_IBPB, false },
++ { "seccomp", SPECTRE_V2_USER_CMD_SECCOMP, false },
++ { "seccomp,ibpb", SPECTRE_V2_USER_CMD_SECCOMP_IBPB, false },
+ };
+
+ static void __init spec_v2_user_print_cond(const char *reason, bool secure)
+@@ -437,6 +441,7 @@ spectre_v2_user_select_mitigation(enum s
+ {
+ enum spectre_v2_user_mitigation mode = SPECTRE_V2_USER_NONE;
+ bool smt_possible = IS_ENABLED(CONFIG_SMP);
++ enum spectre_v2_user_cmd cmd;
+
+ if (!boot_cpu_has(X86_FEATURE_IBPB) && !boot_cpu_has(X86_FEATURE_STIBP))
+ return;
+@@ -445,17 +450,20 @@ spectre_v2_user_select_mitigation(enum s
+ cpu_smt_control == CPU_SMT_NOT_SUPPORTED)
+ smt_possible = false;
+
+- switch (spectre_v2_parse_user_cmdline(v2_cmd)) {
++ cmd = spectre_v2_parse_user_cmdline(v2_cmd);
++ switch (cmd) {
+ case SPECTRE_V2_USER_CMD_NONE:
+ goto set_mode;
+ case SPECTRE_V2_USER_CMD_FORCE:
+ mode = SPECTRE_V2_USER_STRICT;
+ break;
+ case SPECTRE_V2_USER_CMD_PRCTL:
++ case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+ mode = SPECTRE_V2_USER_PRCTL;
+ break;
+ case SPECTRE_V2_USER_CMD_AUTO:
+ case SPECTRE_V2_USER_CMD_SECCOMP:
++ case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+ if (IS_ENABLED(CONFIG_SECCOMP))
+ mode = SPECTRE_V2_USER_SECCOMP;
+ else
+@@ -467,12 +475,15 @@ spectre_v2_user_select_mitigation(enum s
+ if (boot_cpu_has(X86_FEATURE_IBPB)) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+
+- switch (mode) {
+- case SPECTRE_V2_USER_STRICT:
++ switch (cmd) {
++ case SPECTRE_V2_USER_CMD_FORCE:
++ case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
++ case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+ static_branch_enable(&switch_mm_always_ibpb);
+ break;
+- case SPECTRE_V2_USER_PRCTL:
+- case SPECTRE_V2_USER_SECCOMP:
++ case SPECTRE_V2_USER_CMD_PRCTL:
++ case SPECTRE_V2_USER_CMD_AUTO:
++ case SPECTRE_V2_USER_CMD_SECCOMP:
+ static_branch_enable(&switch_mm_cond_ibpb);
+ break;
+ default:
+@@ -480,7 +491,8 @@ spectre_v2_user_select_mitigation(enum s
+ }
+
+ pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+- mode == SPECTRE_V2_USER_STRICT ? "always-on" : "conditional");
++ static_key_enabled(&switch_mm_always_ibpb) ?
++ "always-on" : "conditional");
+ }
+
+ /* If enhanced IBRS is enabled no STIPB required */
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -4010,11 +4010,23 @@
+ per thread. The mitigation control state
+ is inherited on fork.
+
++ prctl,ibpb
++ - Like "prctl" above, but only STIBP is
++ controlled per thread. IBPB is issued
++ always when switching between different user
++ space processes.
++
+ seccomp
+ - Same as "prctl" above, but all seccomp
+ threads will enable the mitigation unless
+ they explicitly opt out.
+
++ seccomp,ibpb
++ - Like "seccomp" above, but only STIBP is
++ controlled per thread. IBPB is issued
++ always when switching between different
++ user space processes.
++
+ auto - Kernel selects the mitigation depending on
+ the available CPU features and vulnerability.
+
diff --git a/patches.arch/x86-speculation-remove-unnecessary-ret-variable-in-cpu_show_common.patch b/patches.arch/x86-speculation-remove-unnecessary-ret-variable-in-cpu_show_common.patch
new file mode 100644
index 0000000000..5da39c48e7
--- /dev/null
+++ b/patches.arch/x86-speculation-remove-unnecessary-ret-variable-in-cpu_show_common.patch
@@ -0,0 +1,65 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:31 +0100
+Subject: x86/speculation: Remove unnecessary ret variable in cpu_show_common()
+Git-commit: b86bda0426853bfe8a3506c7d2a5b332760ae46b
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185003.783903657@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 839ab4103e89..b52a48966e01 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -847,8 +847,6 @@ static ssize_t l1tf_show_state(char *buf)
+ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
+ char *buf, unsigned int bug)
+ {
+- int ret;
+-
+ if (!boot_cpu_has_bug(bug))
+ return sprintf(buf, "Not affected\n");
+
+@@ -866,13 +864,12 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
+ return sprintf(buf, "Mitigation: __user pointer sanitization\n");
+
+ case X86_BUG_SPECTRE_V2:
+- ret = sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
++ return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
+ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "",
+ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",
+ (x86_spec_ctrl_base & SPEC_CTRL_STIBP) ? ", STIBP" : "",
+ boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",
+ spectre_v2_module_string());
+- return ret;
+
+ case X86_BUG_SPEC_STORE_BYPASS:
+ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
+
diff --git a/patches.arch/x86-speculation-rename-ssbd-update-functions.patch b/patches.arch/x86-speculation-rename-ssbd-update-functions.patch
new file mode 100644
index 0000000000..c3db494bd6
--- /dev/null
+++ b/patches.arch/x86-speculation-rename-ssbd-update-functions.patch
@@ -0,0 +1,139 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:34 +0100
+Subject: x86/speculation: Rename SSBD update functions
+Git-commit: 26c4d75b234040c11728a8acb796b3a85ba7507c
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+During context switch, the SSBD bit in SPEC_CTRL MSR is updated according
+to changes of the TIF_SSBD flag in the current and next running task.
+
+Currently, only the bit controlling speculative store bypass disable in
+SPEC_CTRL MSR is updated and the related update functions all have
+"speculative_store" or "ssb" in their names.
+
+For enhanced mitigation control other bits in SPEC_CTRL MSR need to be
+updated as well, which makes the SSB names inadequate.
+
+Rename the "speculative_store*" functions to a more generic name. No
+functional change.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.058866968@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/spec-ctrl.h | 6 +++---
+ arch/x86/kernel/cpu/bugs.c | 4 ++--
+ arch/x86/kernel/process.c | 12 ++++++------
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h
+index ae7c2c5cd7f0..8e2f8411c7a7 100644
+--- a/arch/x86/include/asm/spec-ctrl.h
++++ b/arch/x86/include/asm/spec-ctrl.h
+@@ -70,11 +70,11 @@ extern void speculative_store_bypass_ht_init(void);
+ static inline void speculative_store_bypass_ht_init(void) { }
+ #endif
+
+-extern void speculative_store_bypass_update(unsigned long tif);
++extern void speculation_ctrl_update(unsigned long tif);
+
+-static inline void speculative_store_bypass_update_current(void)
++static inline void speculation_ctrl_update_current(void)
+ {
+- speculative_store_bypass_update(current_thread_info()->flags);
++ speculation_ctrl_update(current_thread_info()->flags);
+ }
+
+ #endif
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 924cd06dd43b..a723af0c4400 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -200,7 +200,7 @@ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) :
+ ssbd_spec_ctrl_to_tif(hostval);
+
+- speculative_store_bypass_update(tif);
++ speculation_ctrl_update(tif);
+ }
+ }
+ EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl);
+@@ -632,7 +632,7 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+ * mitigation until it is next scheduled.
+ */
+ if (task == current && update)
+- speculative_store_bypass_update_current();
++ speculation_ctrl_update_current();
+
+ return 0;
+ }
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index c93fcfdf1673..8aa49604f9ae 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -395,27 +395,27 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
+ wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn));
+ }
+
+-static __always_inline void intel_set_ssb_state(unsigned long tifn)
++static __always_inline void spec_ctrl_update_msr(unsigned long tifn)
+ {
+ u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+
+ wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+ }
+
+-static __always_inline void __speculative_store_bypass_update(unsigned long tifn)
++static __always_inline void __speculation_ctrl_update(unsigned long tifn)
+ {
+ if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
+ amd_set_ssb_virt_state(tifn);
+ else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
+ amd_set_core_ssb_state(tifn);
+ else
+- intel_set_ssb_state(tifn);
++ spec_ctrl_update_msr(tifn);
+ }
+
+-void speculative_store_bypass_update(unsigned long tif)
++void speculation_ctrl_update(unsigned long tif)
+ {
+ preempt_disable();
+- __speculative_store_bypass_update(tif);
++ __speculation_ctrl_update(tif);
+ preempt_enable();
+ }
+
+@@ -452,7 +452,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+ set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
+
+ if ((tifp ^ tifn) & _TIF_SSBD)
+- __speculative_store_bypass_update(tifn);
++ __speculation_ctrl_update(tifn);
+ }
+
+ /*
+
diff --git a/patches.arch/x86-speculation-reorder-the-spec_v2-code.patch b/patches.arch/x86-speculation-reorder-the-spec_v2-code.patch
new file mode 100644
index 0000000000..9283f2d817
--- /dev/null
+++ b/patches.arch/x86-speculation-reorder-the-spec_v2-code.patch
@@ -0,0 +1,261 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:41 +0100
+Subject: x86/speculation: Reorder the spec_v2 code
+Git-commit: 15d6b7aab0793b2de8a05d8a828777dd24db424e
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+Reorder the code so it is better grouped. No functional change.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.707122879@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 168 ++++++++++++++++++++++-----------------------
+ 1 file changed, 84 insertions(+), 84 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -123,29 +123,6 @@ void __init check_bugs(void)
+ #endif
+ }
+
+-/* The kernel command line selection */
+-enum spectre_v2_mitigation_cmd {
+- SPECTRE_V2_CMD_NONE,
+- SPECTRE_V2_CMD_AUTO,
+- SPECTRE_V2_CMD_FORCE,
+- SPECTRE_V2_CMD_RETPOLINE,
+- SPECTRE_V2_CMD_RETPOLINE_GENERIC,
+- SPECTRE_V2_CMD_RETPOLINE_AMD,
+-};
+-
+-static const char *spectre_v2_strings[] = {
+- [SPECTRE_V2_NONE] = "Vulnerable",
+- [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+- [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
+- [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
+-};
+-
+-#undef pr_fmt
+-#define pr_fmt(fmt) "Spectre V2 : " fmt
+-
+-static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
+- SPECTRE_V2_NONE;
+-
+ void
+ x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
+ {
+@@ -332,6 +309,12 @@ static int __init l1tf_cmdline(char *str
+ early_param("l1tf", l1tf_cmdline);
+
+
++#undef pr_fmt
++#define pr_fmt(fmt) "Spectre V2 : " fmt
++
++static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
++ SPECTRE_V2_NONE;
++
+ #ifdef RETPOLINE
+ static bool spectre_v2_bad_module;
+
+@@ -353,18 +336,6 @@ static inline const char *spectre_v2_mod
+ static inline const char *spectre_v2_module_string(void) { return ""; }
+ #endif
+
+-static void __init spec2_print_if_insecure(const char *reason)
+-{
+- if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+- pr_info("%s selected on command line.\n", reason);
+-}
+-
+-static void __init spec2_print_if_secure(const char *reason)
+-{
+- if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+- pr_info("%s selected on command line.\n", reason);
+-}
+-
+ static inline bool match_option(const char *arg, int arglen, const char *opt)
+ {
+ int len = strlen(opt);
+@@ -372,24 +343,53 @@ static inline bool match_option(const ch
+ return len == arglen && !strncmp(arg, opt, len);
+ }
+
++/* The kernel command line selection for spectre v2 */
++enum spectre_v2_mitigation_cmd {
++ SPECTRE_V2_CMD_NONE,
++ SPECTRE_V2_CMD_AUTO,
++ SPECTRE_V2_CMD_FORCE,
++ SPECTRE_V2_CMD_RETPOLINE,
++ SPECTRE_V2_CMD_RETPOLINE_GENERIC,
++ SPECTRE_V2_CMD_RETPOLINE_AMD,
++};
++
++static const char *spectre_v2_strings[] = {
++ [SPECTRE_V2_NONE] = "Vulnerable",
++ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
++ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
++ [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
++};
++
+ static const struct {
+ const char *option;
+ enum spectre_v2_mitigation_cmd cmd;
+ bool secure;
+ } mitigation_options[] = {
+- { "off", SPECTRE_V2_CMD_NONE, false },
+- { "on", SPECTRE_V2_CMD_FORCE, true },
+- { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
+- { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false },
+- { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
+- { "auto", SPECTRE_V2_CMD_AUTO, false },
++ { "off", SPECTRE_V2_CMD_NONE, false },
++ { "on", SPECTRE_V2_CMD_FORCE, true },
++ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
++ { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false },
++ { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
++ { "auto", SPECTRE_V2_CMD_AUTO, false },
+ };
+
++static void __init spec2_print_if_insecure(const char *reason)
++{
++ if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
++ pr_info("%s selected on command line.\n", reason);
++}
++
++static void __init spec2_print_if_secure(const char *reason)
++{
++ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
++ pr_info("%s selected on command line.\n", reason);
++}
++
+ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ {
++ enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
+ char arg[20];
+ int ret, i;
+- enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO;
+
+ if (cmdline_find_option_bool(boot_command_line, "nospectre_v2"))
+ return SPECTRE_V2_CMD_NONE;
+@@ -449,48 +449,6 @@ static bool __init is_skylake_era(void)
+ return false;
+ }
+
+-static bool stibp_needed(void)
+-{
+- if (spectre_v2_enabled == SPECTRE_V2_NONE)
+- return false;
+-
+- /* Enhanced IBRS makes using STIBP unnecessary. */
+- if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
+- return false;
+-
+- if (!boot_cpu_has(X86_FEATURE_STIBP))
+- return false;
+-
+- return true;
+-}
+-
+-static void update_stibp_msr(void *info)
+-{
+- wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+-}
+-
+-void arch_smt_update(void)
+-{
+- u64 mask;
+-
+- if (!stibp_needed())
+- return;
+-
+- mutex_lock(&spec_ctrl_mutex);
+-
+- mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
+- if (sched_smt_active())
+- mask |= SPEC_CTRL_STIBP;
+-
+- if (mask != x86_spec_ctrl_base) {
+- pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
+- mask & SPEC_CTRL_STIBP ? "Enabling" : "Disabling");
+- x86_spec_ctrl_base = mask;
+- on_each_cpu(update_stibp_msr, NULL, 1);
+- }
+- mutex_unlock(&spec_ctrl_mutex);
+-}
+-
+ static void __init spectre_v2_select_mitigation(void)
+ {
+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline();
+@@ -593,6 +551,48 @@ specv2_set_mode:
+ arch_smt_update();
+ }
+
++static bool stibp_needed(void)
++{
++ if (spectre_v2_enabled == SPECTRE_V2_NONE)
++ return false;
++
++ /* Enhanced IBRS makes using STIBP unnecessary. */
++ if (spectre_v2_enabled == SPECTRE_V2_IBRS_ENHANCED)
++ return false;
++
++ if (!boot_cpu_has(X86_FEATURE_STIBP))
++ return false;
++
++ return true;
++}
++
++static void update_stibp_msr(void *info)
++{
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++}
++
++void arch_smt_update(void)
++{
++ u64 mask;
++
++ if (!stibp_needed())
++ return;
++
++ mutex_lock(&spec_ctrl_mutex);
++
++ mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
++ if (sched_smt_active())
++ mask |= SPEC_CTRL_STIBP;
++
++ if (mask != x86_spec_ctrl_base) {
++ pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
++ mask & SPEC_CTRL_STIBP ? "Enabling" : "Disabling");
++ x86_spec_ctrl_base = mask;
++ on_each_cpu(update_stibp_msr, NULL, 1);
++ }
++ mutex_unlock(&spec_ctrl_mutex);
++}
++
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Speculative Store Bypass: " fmt
+
diff --git a/patches.arch/x86-speculation-reorganize-speculation-control-msrs-update.patch b/patches.arch/x86-speculation-reorganize-speculation-control-msrs-update.patch
new file mode 100644
index 0000000000..99ecd7aff5
--- /dev/null
+++ b/patches.arch/x86-speculation-reorganize-speculation-control-msrs-update.patch
@@ -0,0 +1,118 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:35 +0100
+Subject: x86/speculation: Reorganize speculation control MSRs update
+Git-commit: 01daf56875ee0cd50ed496a09b20eb369b45dfa5
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The logic to detect whether there's a change in the previous and next
+task's flag relevant to update speculation control MSRs is spread out
+across multiple functions.
+
+Consolidate all checks needed for updating speculation control MSRs into
+the new __speculation_ctrl_update() helper function.
+
+This makes it easy to pick the right speculation control MSR and the bits
+in MSR_IA32_SPEC_CTRL that need updating based on TIF flags changes.
+
+Originally-by: Thomas Lendacky <Thomas.Lendacky@amd.com>
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.151077005@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/process.c | 46 +++++++++++++++++++++++++++++-----------------
+ 1 file changed, 29 insertions(+), 17 deletions(-)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 8aa49604f9ae..70e9832379e1 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -395,27 +395,40 @@ static __always_inline void amd_set_ssb_virt_state(unsigned long tifn)
+ wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn));
+ }
+
+-static __always_inline void spec_ctrl_update_msr(unsigned long tifn)
+-{
+- u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn);
+-
+- wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+-}
++/*
++ * Update the MSRs managing speculation control, during context switch.
++ *
++ * tifp: Previous task's thread flags
++ * tifn: Next task's thread flags
++ */
++static __always_inline void __speculation_ctrl_update(unsigned long tifp,
++ unsigned long tifn)
++{
++ u64 msr = x86_spec_ctrl_base;
++ bool updmsr = false;
++
++ /* If TIF_SSBD is different, select the proper mitigation method */
++ if ((tifp ^ tifn) & _TIF_SSBD) {
++ if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) {
++ amd_set_ssb_virt_state(tifn);
++ } else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) {
++ amd_set_core_ssb_state(tifn);
++ } else if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD) ||
++ static_cpu_has(X86_FEATURE_AMD_SSBD)) {
++ msr |= ssbd_tif_to_spec_ctrl(tifn);
++ updmsr = true;
++ }
++ }
+
+-static __always_inline void __speculation_ctrl_update(unsigned long tifn)
+-{
+- if (static_cpu_has(X86_FEATURE_VIRT_SSBD))
+- amd_set_ssb_virt_state(tifn);
+- else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD))
+- amd_set_core_ssb_state(tifn);
+- else
+- spec_ctrl_update_msr(tifn);
++ if (updmsr)
++ wrmsrl(MSR_IA32_SPEC_CTRL, msr);
+ }
+
+ void speculation_ctrl_update(unsigned long tif)
+ {
++ /* Forced update. Make sure all relevant TIF flags are different */
+ preempt_disable();
+- __speculation_ctrl_update(tif);
++ __speculation_ctrl_update(~tif, tif);
+ preempt_enable();
+ }
+
+@@ -451,8 +464,7 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
+ if ((tifp ^ tifn) & _TIF_NOCPUID)
+ set_cpuid_faulting(!!(tifn & _TIF_NOCPUID));
+
+- if ((tifp ^ tifn) & _TIF_SSBD)
+- __speculation_ctrl_update(tifn);
++ __speculation_ctrl_update(tifp, tifn);
+ }
+
+ /*
+
diff --git a/patches.arch/x86-speculation-rework-smt-state-change.patch b/patches.arch/x86-speculation-rework-smt-state-change.patch
new file mode 100644
index 0000000000..696f880e36
--- /dev/null
+++ b/patches.arch/x86-speculation-rework-smt-state-change.patch
@@ -0,0 +1,132 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:39 +0100
+Subject: x86/speculation: Rework SMT state change
+Git-commit: a74cfffb03b73d41e08f84c2e5c87dec0ce3db9f
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+arch_smt_update() is only called when the sysfs SMT control knob is
+changed. This means that when SMT is enabled in the sysfs control knob the
+system is considered to have SMT active even if all siblings are offline.
+
+To allow finegrained control of the speculation mitigations, the actual SMT
+state is more interesting than the fact that siblings could be enabled.
+
+Rework the code, so arch_smt_update() is invoked from each individual CPU
+hotplug function, and simplify the update function while at it.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.521974984@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 11 +++++------
+ include/linux/sched/smt.h | 2 ++
+ kernel/cpu.c | 14 ++++++++------
+ 3 files changed, 15 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -13,6 +13,7 @@
+ #include <linux/module.h>
+ #include <linux/nospec.h>
+ #include <linux/prctl.h>
++#include <linux/sched/smt.h>
+
+ #include <asm/spec-ctrl.h>
+ #include <asm/cmdline.h>
+@@ -476,16 +477,14 @@ void arch_smt_update(void)
+ return;
+
+ mutex_lock(&spec_ctrl_mutex);
+- mask = x86_spec_ctrl_base;
+- if (cpu_smt_control == CPU_SMT_ENABLED)
++
++ mask = x86_spec_ctrl_base & ~SPEC_CTRL_STIBP;
++ if (sched_smt_active())
+ mask |= SPEC_CTRL_STIBP;
+- else
+- mask &= ~SPEC_CTRL_STIBP;
+
+ if (mask != x86_spec_ctrl_base) {
+ pr_info("Spectre v2 cross-process SMT mitigation: %s STIBP\n",
+- cpu_smt_control == CPU_SMT_ENABLED ?
+- "Enabling" : "Disabling");
++ mask & SPEC_CTRL_STIBP ? "Enabling" : "Disabling");
+ x86_spec_ctrl_base = mask;
+ on_each_cpu(update_stibp_msr, NULL, 1);
+ }
+--- a/include/linux/sched/smt.h
++++ b/include/linux/sched/smt.h
+@@ -15,4 +15,6 @@ static __always_inline bool sched_smt_ac
+ static inline bool sched_smt_active(void) { return false; }
+ #endif
+
++void arch_smt_update(void);
++
+ #endif
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -10,6 +10,7 @@
+ #include <linux/sched/signal.h>
+ #include <linux/sched/hotplug.h>
+ #include <linux/sched/task.h>
++#include <linux/sched/smt.h>
+ #include <linux/unistd.h>
+ #include <linux/cpu.h>
+ #include <linux/oom.h>
+@@ -345,6 +346,12 @@ void cpu_hotplug_enable(void)
+ EXPORT_SYMBOL_GPL(cpu_hotplug_enable);
+ #endif /* CONFIG_HOTPLUG_CPU */
+
++/*
++ * Architectures that need SMT-specific errata handling during SMT hotplug
++ * should override this.
++ */
++void __weak arch_smt_update(void) { }
++
+ #ifdef CONFIG_HOTPLUG_SMT
+ enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
+ EXPORT_SYMBOL_GPL(cpu_smt_control);
+@@ -1009,6 +1016,7 @@ static int _cpu_up(unsigned int cpu, int
+ ret = cpuhp_up_callbacks(cpu, st, target);
+ out:
+ cpus_write_unlock();
++ arch_smt_update();
+ return ret;
+ }
+
+@@ -1836,12 +1844,6 @@ static void cpuhp_online_cpu_device(unsi
+ kobject_uevent(&dev->kobj, KOBJ_ONLINE);
+ }
+
+-/*
+- * Architectures that need SMT-specific errata handling during SMT hotplug
+- * should override this.
+- */
+-void __weak arch_smt_update(void) { };
+-
+ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ {
+ int cpu, ret = 0;
diff --git a/patches.arch/x86-speculation-split-out-tif-update.patch b/patches.arch/x86-speculation-split-out-tif-update.patch
new file mode 100644
index 0000000000..fd0ff18229
--- /dev/null
+++ b/patches.arch/x86-speculation-split-out-tif-update.patch
@@ -0,0 +1,112 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:51 +0100
+Subject: x86/speculation: Split out TIF update
+Git-commit: e6da8bb6f9abb2628381904b24163c770e630bac
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+The update of the TIF_SSBD flag and the conditional speculation control MSR
+update is done in the ssb_prctl_set() function directly. The upcoming prctl
+support for controlling indirect branch speculation via STIBP needs the
+same mechanism.
+
+Split the code out and make it reusable. Reword the comment about updates
+for other tasks.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185005.652305076@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 35 +++++++++++++++++++++++------------
+ 1 file changed, 23 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 7c946a9af947..3b65a53d2c33 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -702,10 +702,29 @@ static void ssb_select_mitigation(void)
+ #undef pr_fmt
+ #define pr_fmt(fmt) "Speculation prctl: " fmt
+
+-static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
++static void task_update_spec_tif(struct task_struct *tsk, int tifbit, bool on)
+ {
+ bool update;
+
++ if (on)
++ update = !test_and_set_tsk_thread_flag(tsk, tifbit);
++ else
++ update = test_and_clear_tsk_thread_flag(tsk, tifbit);
++
++ /*
++ * Immediately update the speculation control MSRs for the current
++ * task, but for a non-current task delay setting the CPU
++ * mitigation until it is scheduled next.
++ *
++ * This can only happen for SECCOMP mitigation. For PRCTL it's
++ * always the current task.
++ */
++ if (tsk == current && update)
++ speculation_ctrl_update_current();
++}
++
++static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
++{
+ if (ssb_mode != SPEC_STORE_BYPASS_PRCTL &&
+ ssb_mode != SPEC_STORE_BYPASS_SECCOMP)
+ return -ENXIO;
+@@ -716,28 +735,20 @@ static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl)
+ if (task_spec_ssb_force_disable(task))
+ return -EPERM;
+ task_clear_spec_ssb_disable(task);
+- update = test_and_clear_tsk_thread_flag(task, TIF_SSBD);
++ task_update_spec_tif(task, TIF_SSBD, false);
+ break;
+ case PR_SPEC_DISABLE:
+ task_set_spec_ssb_disable(task);
+- update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
++ task_update_spec_tif(task, TIF_SSBD, true);
+ break;
+ case PR_SPEC_FORCE_DISABLE:
+ task_set_spec_ssb_disable(task);
+ task_set_spec_ssb_force_disable(task);
+- update = !test_and_set_tsk_thread_flag(task, TIF_SSBD);
++ task_update_spec_tif(task, TIF_SSBD, true);
+ break;
+ default:
+ return -ERANGE;
+ }
+-
+- /*
+- * If being set on non-current task, delay setting the CPU
+- * mitigation until it is next scheduled.
+- */
+- if (task == current && update)
+- speculation_ctrl_update_current();
+-
+ return 0;
+ }
+
+
diff --git a/patches.arch/x86-speculation-unify-conditional-spectre-v2-print-functions.patch b/patches.arch/x86-speculation-unify-conditional-spectre-v2-print-functions.patch
new file mode 100644
index 0000000000..60856b5952
--- /dev/null
+++ b/patches.arch/x86-speculation-unify-conditional-spectre-v2-print-functions.patch
@@ -0,0 +1,76 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 25 Nov 2018 19:33:44 +0100
+Subject: x86/speculation: Unify conditional spectre v2 print functions
+Git-commit: 495d470e9828500e0155027f230449ac5e29c025
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+There is no point in having two functions and a conditional at the call
+site.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185004.986890749@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/bugs.c | 17 ++++-------------
+ 1 file changed, 4 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 9279cbabe16e..4f5a6319dca6 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -257,15 +257,9 @@ static const struct {
+ { "auto", SPECTRE_V2_CMD_AUTO, false },
+ };
+
+-static void __init spec2_print_if_insecure(const char *reason)
++static void __init spec_v2_print_cond(const char *reason, bool secure)
+ {
+- if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
+- pr_info("%s selected on command line.\n", reason);
+-}
+-
+-static void __init spec2_print_if_secure(const char *reason)
+-{
+- if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
++ if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2) != secure)
+ pr_info("%s selected on command line.\n", reason);
+ }
+
+@@ -309,11 +303,8 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void)
+ return SPECTRE_V2_CMD_AUTO;
+ }
+
+- if (mitigation_options[i].secure)
+- spec2_print_if_secure(mitigation_options[i].option);
+- else
+- spec2_print_if_insecure(mitigation_options[i].option);
+-
++ spec_v2_print_cond(mitigation_options[i].option,
++ mitigation_options[i].secure);
+ return cmd;
+ }
+
+
diff --git a/patches.arch/x86-speculation-update-the-tif_ssbd-comment.patch b/patches.arch/x86-speculation-update-the-tif_ssbd-comment.patch
new file mode 100644
index 0000000000..f04287ae88
--- /dev/null
+++ b/patches.arch/x86-speculation-update-the-tif_ssbd-comment.patch
@@ -0,0 +1,53 @@
+From: Tim Chen <tim.c.chen@linux.intel.com>
+Date: Sun, 25 Nov 2018 19:33:29 +0100
+Subject: x86/speculation: Update the TIF_SSBD comment
+Git-commit: 8eb729b77faf83ac4c1f363a9ad68d042415f24c
+Patch-mainline: v4.20-rc5
+References: bsc#1106913
+
+"Reduced Data Speculation" is an obsolete term. The correct new name is
+"Speculative store bypass disable" - which is abbreviated into SSBD.
+
+Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Ingo Molnar <mingo@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Casey Schaufler <casey.schaufler@intel.com>
+Cc: Asit Mallick <asit.k.mallick@intel.com>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Jon Masters <jcm@redhat.com>
+Cc: Waiman Long <longman9394@gmail.com>
+Cc: Greg KH <gregkh@linuxfoundation.org>
+Cc: Dave Stewart <david.c.stewart@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20181125185003.593893901@linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/thread_info.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
+index 2ff2a30a264f..523c69efc38a 100644
+--- a/arch/x86/include/asm/thread_info.h
++++ b/arch/x86/include/asm/thread_info.h
+@@ -79,7 +79,7 @@ struct thread_info {
+ #define TIF_SIGPENDING 2 /* signal pending */
+ #define TIF_NEED_RESCHED 3 /* rescheduling necessary */
+ #define TIF_SINGLESTEP 4 /* reenable singlestep on user return*/
+-#define TIF_SSBD 5 /* Reduced data speculation */
++#define TIF_SSBD 5 /* Speculative store bypass disable */
+ #define TIF_SYSCALL_EMU 6 /* syscall emulation active */
+ #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */
+ #define TIF_SECCOMP 8 /* secure computing */
+
diff --git a/patches.arch/x86-vdso-fix-vdso-build-if-a-retpoline-is-emitted.patch b/patches.arch/x86-vdso-fix-vdso-build-if-a-retpoline-is-emitted.patch
index 00cc3c9e74..d7dd90e98a 100644
--- a/patches.arch/x86-vdso-fix-vdso-build-if-a-retpoline-is-emitted.patch
+++ b/patches.arch/x86-vdso-fix-vdso-build-if-a-retpoline-is-emitted.patch
@@ -3,7 +3,7 @@ Date: Thu, 16 Aug 2018 12:41:15 -0700
Subject: x86/vdso: Fix vDSO build if a retpoline is emitted
Git-commit: 2e549b2ee0e358bc758480e716b881f9cabedb6a
Patch-mainline: v4.19-rc1
-References: git-fixes 76b043848fd2
+References: bsc#1114648
Currently, if the vDSO ends up containing an indirect branch or
call, GCC will emit the "external thunk" style of retpoline, and it
@@ -28,49 +28,10 @@ Link: https://lkml.kernel.org/r/c76538cd3afbe19c6246c2d1715bc6a60bd63985.1534448
Acked-by: Borislav Petkov <bp@suse.de>
---
- Makefile | 12 ++++++++++++
- arch/x86/Makefile | 8 --------
+ Makefile | 5 +++++
arch/x86/entry/vdso/Makefile | 6 ++++--
- 3 files changed, 16 insertions(+), 10 deletions(-)
+ 2 files changed, 9 insertions(+), 2 deletions(-)
---- a/Makefile
-+++ b/Makefile
-@@ -727,6 +727,18 @@ KBUILD_CFLAGS += $(call cc-disable-warni
- KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
- endif
-
-+# Avoid indirect branches in kernel to deal with Spectre
-+ifdef CONFIG_RETPOLINE
-+ RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
-+ ifneq ($(RETPOLINE_CFLAGS),)
-+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
-+ endif
-+RETPOLINE_VDSO_CFLAGS_GCC := -mindirect-branch=thunk-inline -mindirect-branch-register
-+RETPOLINE_VDSO_CFLAGS := $(call cc-option,$(RETPOLINE_VDSO_CFLAGS_GCC))
-+export RETPOLINE_CFLAGS
-+export RETPOLINE_VDSO_CFLAGS
-+endif
-+
- ifdef CONFIG_FRAME_POINTER
- KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls
- else
---- a/arch/x86/Makefile
-+++ b/arch/x86/Makefile
-@@ -218,14 +218,6 @@ KBUILD_CFLAGS += -fno-asynchronous-unwin
- KBUILD_CFLAGS += $(mflags-y)
- KBUILD_AFLAGS += $(mflags-y)
-
--# Avoid indirect branches in kernel to deal with Spectre
--ifdef CONFIG_RETPOLINE
-- RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register)
-- ifneq ($(RETPOLINE_CFLAGS),)
-- KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE
-- endif
--endif
--
- archscripts: scripts_basic
- $(Q)$(MAKE) $(build)=arch/x86/tools relocs
-
--- a/arch/x86/entry/vdso/Makefile
+++ b/arch/x86/entry/vdso/Makefile
@@ -73,9 +73,9 @@ $(obj)/vdso-image-%.c: $(obj)/vdso%.so.d
@@ -99,3 +60,15 @@ Acked-by: Borislav Petkov <bp@suse.de>
$(obj)/vdso32.so.dbg: KBUILD_CFLAGS = $(KBUILD_CFLAGS_32)
$(obj)/vdso32.so.dbg: FORCE \
+--- a/Makefile
++++ b/Makefile
+ KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable)
+ endif
+
++RETPOLINE_VDSO_CFLAGS_GCC := -mindirect-branch=thunk-inline -mindirect-branch-register
++RETPOLINE_VDSO_CFLAGS := $(call cc-option,$(RETPOLINE_VDSO_CFLAGS_GCC))
++export RETPOLINE_VDSO_CFLAGS
++
+ # Support for using generic headers in asm-generic
+ PHONY += asm-generic
+ asm-generic:
diff --git a/patches.drivers/0001-ACPI-CPPC-Update-all-pr_-debug-err-messages-to-log-t.patch b/patches.drivers/0001-ACPI-CPPC-Update-all-pr_-debug-err-messages-to-log-t.patch
new file mode 100644
index 0000000000..c8ab4715ab
--- /dev/null
+++ b/patches.drivers/0001-ACPI-CPPC-Update-all-pr_-debug-err-messages-to-log-t.patch
@@ -0,0 +1,110 @@
+From: George Cherian <george.cherian@cavium.com>
+Date: Tue, 20 Feb 2018 11:16:03 +0000
+Subject: ACPI / CPPC: Update all pr_(debug/err) messages to log the susbspace
+ id
+
+Git-commit: d29abc836843b8c9537b4d778eb2d429a804a5ed
+Patch-mainline: v4.17-rc1
+References: bsc#1117115
+
+CPPC dirver is aware of multiple PCC subspace IDs. Enhance the debug
+and error messages in the driver to print the subspace id. In case of
+error it will be helpful to find which particular subspace is failing.
+
+Signed-off-by: George Cherian <george.cherian@cavium.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
+---
+ drivers/acpi/cppc_acpi.c | 27 ++++++++++++++++-----------
+ 1 file changed, 16 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c
+index 0afbb2658cbc..735c74a4cbdb 100644
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -227,7 +227,8 @@ static int check_pcc_chan(int pcc_ss_id, bool chk_err_bit)
+ if (likely(!ret))
+ pcc_ss_data->platform_owns_pcc = false;
+ else
+- pr_err("PCC check channel failed. Status=%x\n", status);
++ pr_err("PCC check channel failed for ss: %d. Status=%x\n",
++ pcc_ss_id, status);
+
+ return ret;
+ }
+@@ -291,7 +292,8 @@ static int send_pcc_cmd(int pcc_ss_id, u16 cmd)
+ time_delta = ktime_ms_delta(ktime_get(),
+ pcc_ss_data->last_mpar_reset);
+ if ((time_delta < 60 * MSEC_PER_SEC) && pcc_ss_data->last_mpar_reset) {
+- pr_debug("PCC cmd not sent due to MPAR limit");
++ pr_debug("PCC cmd for subspace %d not sent due to MPAR limit",
++ pcc_ss_id);
+ ret = -EIO;
+ goto end;
+ }
+@@ -312,8 +314,8 @@ static int send_pcc_cmd(int pcc_ss_id, u16 cmd)
+ /* Ring doorbell */
+ ret = mbox_send_message(pcc_ss_data->pcc_channel, &cmd);
+ if (ret < 0) {
+- pr_err("Err sending PCC mbox message. cmd:%d, ret:%d\n",
+- cmd, ret);
++ pr_err("Err sending PCC mbox message. ss: %d cmd:%d, ret:%d\n",
++ pcc_ss_id, cmd, ret);
+ goto end;
+ }
+
+@@ -553,7 +555,8 @@ static int register_pcc_channel(int pcc_ss_idx)
+ pcc_mbox_request_channel(&cppc_mbox_cl, pcc_ss_idx);
+
+ if (IS_ERR(pcc_data[pcc_ss_idx]->pcc_channel)) {
+- pr_err("Failed to find PCC communication channel\n");
++ pr_err("Failed to find PCC channel for subspace %d\n",
++ pcc_ss_idx);
+ return -ENODEV;
+ }
+
+@@ -566,7 +569,8 @@ static int register_pcc_channel(int pcc_ss_idx)
+ cppc_ss = (pcc_data[pcc_ss_idx]->pcc_channel)->con_priv;
+
+ if (!cppc_ss) {
+- pr_err("No PCC subspace found for CPPC\n");
++ pr_err("No PCC subspace found for %d CPPC\n",
++ pcc_ss_idx);
+ return -ENODEV;
+ }
+
+@@ -584,7 +588,8 @@ static int register_pcc_channel(int pcc_ss_idx)
+ pcc_data[pcc_ss_idx]->pcc_comm_addr =
+ acpi_os_ioremap(cppc_ss->base_address, cppc_ss->length);
+ if (!pcc_data[pcc_ss_idx]->pcc_comm_addr) {
+- pr_err("Failed to ioremap PCC comm region mem\n");
++ pr_err("Failed to ioremap PCC comm region mem for %d\n",
++ pcc_ss_idx);
+ return -ENOMEM;
+ }
+
+@@ -973,8 +978,8 @@ static int cpc_read(int cpu, struct cpc_register_resource *reg_res, u64 *val)
+ *val = readq_relaxed(vaddr);
+ break;
+ default:
+- pr_debug("Error: Cannot read %u bit width from PCC\n",
+- reg->bit_width);
++ pr_debug("Error: Cannot read %u bit width from PCC for ss: %d\n",
++ reg->bit_width, pcc_ss_id);
+ ret_val = -EFAULT;
+ }
+
+@@ -1012,8 +1017,8 @@ static int cpc_write(int cpu, struct cpc_register_resource *reg_res, u64 val)
+ writeq_relaxed(val, vaddr);
+ break;
+ default:
+- pr_debug("Error: Cannot write %u bit width to PCC\n",
+- reg->bit_width);
++ pr_debug("Error: Cannot write %u bit width to PCC for ss: %d\n",
++ reg->bit_width, pcc_ss_id);
+ ret_val = -EFAULT;
+ break;
+ }
+--
+2.11.0
+
diff --git a/patches.drivers/0001-ipmi-ssif-Add-support-for-multi-part-transmit-messag.patch b/patches.drivers/0001-ipmi-ssif-Add-support-for-multi-part-transmit-messag.patch
index 800cc6622e..0f1a6ad611 100644
--- a/patches.drivers/0001-ipmi-ssif-Add-support-for-multi-part-transmit-messag.patch
+++ b/patches.drivers/0001-ipmi-ssif-Add-support-for-multi-part-transmit-messag.patch
@@ -3,8 +3,7 @@ Date: Fri, 27 Jul 2018 07:36:20 -0500
Subject: ipmi:ssif: Add support for multi-part transmit messages > 2 parts
Git-commit: 10042504ed92c06077b8a20a4edd67ba784847d4
-Patch-mainline: Queued
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
+Patch-mainline: v4.20-rc1
References: bsc#1103308
The spec was fairly confusing about how multi-part transmit messages
diff --git a/patches.drivers/0001-target-use-ISCSI_IQN_LEN-in-iscsi_target_stat.patch b/patches.drivers/0001-target-use-ISCSI_IQN_LEN-in-iscsi_target_stat.patch
index 55474079d0..a166b1dbb2 100644
--- a/patches.drivers/0001-target-use-ISCSI_IQN_LEN-in-iscsi_target_stat.patch
+++ b/patches.drivers/0001-target-use-ISCSI_IQN_LEN-in-iscsi_target_stat.patch
@@ -3,14 +3,14 @@ From: David Disseldorp <ddiss@suse.de>
Date: Mon, 8 Oct 2018 13:53:29 +0200
Subject: [PATCH 1/5] target: use ISCSI_IQN_LEN in iscsi_target_stat
References: bsc#1095805
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Patch-mainline: v4.20-rc1
Git-commit: df711553f4440e16af5b731ed41841dee1e2abb4
Move the ISCSI_IQN_LEN definition up, so that it can be used in more
places instead of a hardcoded value.
Signed-off-by: David Disseldorp <ddiss@suse.de>
+
---
drivers/target/iscsi/iscsi_target_stat.c | 4 ++--
include/target/iscsi/iscsi_target_core.h | 6 +++---
diff --git a/patches.drivers/0002-ACPI-CPPC-Check-for-valid-PCC-subspace-only-if-PCC-i.patch b/patches.drivers/0002-ACPI-CPPC-Check-for-valid-PCC-subspace-only-if-PCC-i.patch
new file mode 100644
index 0000000000..7a3ce90a25
--- /dev/null
+++ b/patches.drivers/0002-ACPI-CPPC-Check-for-valid-PCC-subspace-only-if-PCC-i.patch
@@ -0,0 +1,115 @@
+From: Prashanth Prakash <pprakash@codeaurora.org>
+Date: Wed, 4 Apr 2018 12:14:51 -0600
+Subject: ACPI / CPPC: Check for valid PCC subspace only if PCC is used
+
+Git-commit: 6fa12d584dcba18f67425ce17e9317311a624f81
+Patch-mainline: v4.18-rc1
+References: bsc#1117115
+
+Changes the behavior where we return error if there are no valid PCC
+subspace for a given performance domain.
+
+The ACPI spec does not mandate the use PCC, so it is possible to have
+platforms where a PCC subspace may not be present, so we need to check
+for a valid PCC subspace ID only if the register is a PCC register.
+
+Signed-off-by: Prashanth Prakash <pprakash@codeaurora.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
+---
+ drivers/acpi/cppc_acpi.c | 30 +++++++++++++++++++++---------
+ 1 file changed, 21 insertions(+), 9 deletions(-)
+
+--- a/drivers/acpi/cppc_acpi.c
++++ b/drivers/acpi/cppc_acpi.c
+@@ -1040,15 +1040,14 @@ int cppc_get_perf_caps(int cpunum, struc
+ *lowest_non_linear_reg, *nominal_reg;
+ u64 high, low, nom, min_nonlinear;
+ int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
+- struct cppc_pcc_data *pcc_ss_data;
++ struct cppc_pcc_data *pcc_ss_data = NULL;
+ int ret = 0, regs_in_pcc = 0;
+
+- if (!cpc_desc || pcc_ss_id < 0) {
++ if (!cpc_desc) {
+ pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
+ return -ENODEV;
+ }
+
+- pcc_ss_data = pcc_data[pcc_ss_id];
+ highest_reg = &cpc_desc->cpc_regs[HIGHEST_PERF];
+ lowest_reg = &cpc_desc->cpc_regs[LOWEST_PERF];
+ lowest_non_linear_reg = &cpc_desc->cpc_regs[LOW_NON_LINEAR_PERF];
+@@ -1057,6 +1056,11 @@ int cppc_get_perf_caps(int cpunum, struc
+ /* Are any of the regs PCC ?*/
+ if (CPC_IN_PCC(highest_reg) || CPC_IN_PCC(lowest_reg) ||
+ CPC_IN_PCC(lowest_non_linear_reg) || CPC_IN_PCC(nominal_reg)) {
++ if (pcc_ss_id < 0) {
++ pr_debug("Invalid pcc_ss_id\n");
++ return -ENODEV;
++ }
++ pcc_ss_data = pcc_data[pcc_ss_id];
+ regs_in_pcc = 1;
+ down_write(&pcc_ss_data->pcc_lock);
+ /* Ring doorbell once to update PCC subspace */
+@@ -1101,16 +1105,15 @@ int cppc_get_perf_ctrs(int cpunum, struc
+ struct cpc_register_resource *delivered_reg, *reference_reg,
+ *ref_perf_reg, *ctr_wrap_reg;
+ int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpunum);
+- struct cppc_pcc_data *pcc_ss_data;
++ struct cppc_pcc_data *pcc_ss_data = NULL;
+ u64 delivered, reference, ref_perf, ctr_wrap_time;
+ int ret = 0, regs_in_pcc = 0;
+
+- if (!cpc_desc || pcc_ss_id < 0) {
++ if (!cpc_desc) {
+ pr_debug("No CPC descriptor for CPU:%d\n", cpunum);
+ return -ENODEV;
+ }
+
+- pcc_ss_data = pcc_data[pcc_ss_id];
+ delivered_reg = &cpc_desc->cpc_regs[DELIVERED_CTR];
+ reference_reg = &cpc_desc->cpc_regs[REFERENCE_CTR];
+ ref_perf_reg = &cpc_desc->cpc_regs[REFERENCE_PERF];
+@@ -1126,6 +1129,11 @@ int cppc_get_perf_ctrs(int cpunum, struc
+ /* Are any of the regs PCC ?*/
+ if (CPC_IN_PCC(delivered_reg) || CPC_IN_PCC(reference_reg) ||
+ CPC_IN_PCC(ctr_wrap_reg) || CPC_IN_PCC(ref_perf_reg)) {
++ if (pcc_ss_id < 0) {
++ pr_debug("Invalid pcc_ss_id\n");
++ return -ENODEV;
++ }
++ pcc_ss_data = pcc_data[pcc_ss_id];
+ down_write(&pcc_ss_data->pcc_lock);
+ regs_in_pcc = 1;
+ /* Ring doorbell once to update PCC subspace */
+@@ -1176,15 +1184,14 @@ int cppc_set_perf(int cpu, struct cppc_p
+ struct cpc_desc *cpc_desc = per_cpu(cpc_desc_ptr, cpu);
+ struct cpc_register_resource *desired_reg;
+ int pcc_ss_id = per_cpu(cpu_pcc_subspace_idx, cpu);
+- struct cppc_pcc_data *pcc_ss_data;
++ struct cppc_pcc_data *pcc_ss_data = NULL;
+ int ret = 0;
+
+- if (!cpc_desc || pcc_ss_id < 0) {
++ if (!cpc_desc) {
+ pr_debug("No CPC descriptor for CPU:%d\n", cpu);
+ return -ENODEV;
+ }
+
+- pcc_ss_data = pcc_data[pcc_ss_id];
+ desired_reg = &cpc_desc->cpc_regs[DESIRED_PERF];
+
+ /*
+@@ -1195,6 +1202,11 @@ int cppc_set_perf(int cpu, struct cppc_p
+ * achieve that goal here
+ */
+ if (CPC_IN_PCC(desired_reg)) {
++ if (pcc_ss_id < 0) {
++ pr_debug("Invalid pcc_ss_id\n");
++ return -ENODEV;
++ }
++ pcc_ss_data = pcc_data[pcc_ss_id];
+ down_read(&pcc_ss_data->pcc_lock); /* BEGIN Phase-I */
+ if (pcc_ss_data->platform_owns_pcc) {
+ ret = check_pcc_chan(pcc_ss_id, false);
diff --git a/patches.drivers/0002-target-log-Data-Out-timeouts-as-errors.patch b/patches.drivers/0002-target-log-Data-Out-timeouts-as-errors.patch
index 3080ade3c6..bd79b96894 100644
--- a/patches.drivers/0002-target-log-Data-Out-timeouts-as-errors.patch
+++ b/patches.drivers/0002-target-log-Data-Out-timeouts-as-errors.patch
@@ -3,14 +3,14 @@ From: David Disseldorp <ddiss@suse.de>
Date: Mon, 8 Oct 2018 14:15:17 +0200
Subject: [PATCH 2/5] target: log Data-Out timeouts as errors
References: bsc#1095805
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Patch-mainline: v4.20-rc1
Git-commit: d9a771fd42712cd530544674b04bc3e42cc7927a
Data-Out timeouts resulting in connection outages should be logged as
errors. Include the I_T Nexus in the message to aid path identification.
Signed-off-by: David Disseldorp <ddiss@suse.de>
+
---
drivers/target/iscsi/iscsi_target_erl1.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/patches.drivers/0003-target-log-NOP-ping-timeouts-as-errors.patch b/patches.drivers/0003-target-log-NOP-ping-timeouts-as-errors.patch
index 9ac0514e66..61e423eff7 100644
--- a/patches.drivers/0003-target-log-NOP-ping-timeouts-as-errors.patch
+++ b/patches.drivers/0003-target-log-NOP-ping-timeouts-as-errors.patch
@@ -3,8 +3,7 @@ From: David Disseldorp <ddiss@suse.de>
Date: Mon, 8 Oct 2018 14:23:27 +0200
Subject: [PATCH 3/5] target: log NOP ping timeouts as errors
References: bsc#1095805
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Patch-mainline: v4.20-rc1
Git-commit: c62ae3005b3551078a8cf959de8018a2852708bd
Events resulting in connection outages like this should be logged as
diff --git a/patches.drivers/0004-cpufreq-CPPC-Add-cpuinfo_cur_freq-support-for-CPPC.patch b/patches.drivers/0004-cpufreq-CPPC-Add-cpuinfo_cur_freq-support-for-CPPC.patch
new file mode 100644
index 0000000000..e1483a4be1
--- /dev/null
+++ b/patches.drivers/0004-cpufreq-CPPC-Add-cpuinfo_cur_freq-support-for-CPPC.patch
@@ -0,0 +1,101 @@
+From: George Cherian <george.cherian@cavium.com>
+Date: Wed, 11 Jul 2018 23:07:55 -0700
+Subject: cpufreq / CPPC: Add cpuinfo_cur_freq support for CPPC
+
+Git-commit: 33477d84c26bbfa626da2c032e567a90dd70a528
+Patch-mainline: v4.19-rc1
+References: bsc#1117115
+
+Per Section 8.4.7.1.3 of ACPI 6.2, the platform provides performance
+feedback via set of performance counters. To determine the actual
+performance level delivered over time, OSPM may read a set of
+performance counters from the Reference Performance Counter Register
+and the Delivered Performance Counter Register.
+
+OSPM calculates the delivered performance over a given time period by
+taking a beginning and ending snapshot of both the reference and
+delivered performance counters, and calculating:
+
+delivered_perf = reference_perf X (delta of delivered_perf counter / delta of reference_perf counter).
+
+Implement the above and hook this up to the cpufreq->get method.
+
+Signed-off-by: George Cherian <george.cherian@cavium.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Acked-by: Prashanth Prakash <pprakash@codeaurora.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
+---
+ drivers/cpufreq/cppc_cpufreq.c | 52 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 52 insertions(+)
+
+diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c
+index a9d3eec32795..30f302149730 100644
+--- a/drivers/cpufreq/cppc_cpufreq.c
++++ b/drivers/cpufreq/cppc_cpufreq.c
+@@ -296,10 +296,62 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy)
+ return ret;
+ }
+
++static inline u64 get_delta(u64 t1, u64 t0)
++{
++ if (t1 > t0 || t0 > ~(u32)0)
++ return t1 - t0;
++
++ return (u32)t1 - (u32)t0;
++}
++
++static int cppc_get_rate_from_fbctrs(struct cppc_cpudata *cpu,
++ struct cppc_perf_fb_ctrs fb_ctrs_t0,
++ struct cppc_perf_fb_ctrs fb_ctrs_t1)
++{
++ u64 delta_reference, delta_delivered;
++ u64 reference_perf, delivered_perf;
++
++ reference_perf = fb_ctrs_t0.reference_perf;
++
++ delta_reference = get_delta(fb_ctrs_t1.reference,
++ fb_ctrs_t0.reference);
++ delta_delivered = get_delta(fb_ctrs_t1.delivered,
++ fb_ctrs_t0.delivered);
++
++ /* Check to avoid divide-by zero */
++ if (delta_reference || delta_delivered)
++ delivered_perf = (reference_perf * delta_delivered) /
++ delta_reference;
++ else
++ delivered_perf = cpu->perf_ctrls.desired_perf;
++
++ return cppc_cpufreq_perf_to_khz(cpu, delivered_perf);
++}
++
++static unsigned int cppc_cpufreq_get_rate(unsigned int cpunum)
++{
++ struct cppc_perf_fb_ctrs fb_ctrs_t0 = {0}, fb_ctrs_t1 = {0};
++ struct cppc_cpudata *cpu = all_cpu_data[cpunum];
++ int ret;
++
++ ret = cppc_get_perf_ctrs(cpunum, &fb_ctrs_t0);
++ if (ret)
++ return ret;
++
++ udelay(2); /* 2usec delay between sampling */
++
++ ret = cppc_get_perf_ctrs(cpunum, &fb_ctrs_t1);
++ if (ret)
++ return ret;
++
++ return cppc_get_rate_from_fbctrs(cpu, fb_ctrs_t0, fb_ctrs_t1);
++}
++
+ static struct cpufreq_driver cppc_cpufreq_driver = {
+ .flags = CPUFREQ_CONST_LOOPS,
+ .verify = cppc_verify_policy,
+ .target = cppc_cpufreq_set_target,
++ .get = cppc_cpufreq_get_rate,
+ .init = cppc_cpufreq_cpu_init,
+ .stop_cpu = cppc_cpufreq_stop_cpu,
+ .name = "cppc_cpufreq",
+--
+2.11.0
+
diff --git a/patches.drivers/0004-target-split-out-helper-for-cxn-timeout-error-stashi.patch b/patches.drivers/0004-target-split-out-helper-for-cxn-timeout-error-stashi.patch
index 07cfab785b..b996efc7c7 100644
--- a/patches.drivers/0004-target-split-out-helper-for-cxn-timeout-error-stashi.patch
+++ b/patches.drivers/0004-target-split-out-helper-for-cxn-timeout-error-stashi.patch
@@ -3,13 +3,13 @@ From: David Disseldorp <ddiss@suse.de>
Date: Thu, 11 Oct 2018 11:02:49 +0200
Subject: [PATCH 4/5] target: split out helper for cxn timeout error stashing
References: bsc#1095805
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Patch-mainline: v4.20-rc1
Git-commit: dce6190ca78adf7cf6fe794833653e4cb1cb2b73
Replace existing nested code blocks with helper function calls.
Signed-off-by: David Disseldorp <ddiss@suse.de>
+
---
drivers/target/iscsi/iscsi_target_erl0.c | 15 +------------
drivers/target/iscsi/iscsi_target_util.c | 36 ++++++++++++++++++--------------
diff --git a/patches.drivers/0005-target-stash-sess_err_stats-on-Data-Out-timeout.patch b/patches.drivers/0005-target-stash-sess_err_stats-on-Data-Out-timeout.patch
index 4decbfe2b1..7880eaaa3f 100644
--- a/patches.drivers/0005-target-stash-sess_err_stats-on-Data-Out-timeout.patch
+++ b/patches.drivers/0005-target-stash-sess_err_stats-on-Data-Out-timeout.patch
@@ -3,8 +3,7 @@ From: David Disseldorp <ddiss@suse.de>
Date: Mon, 8 Oct 2018 14:17:53 +0200
Subject: [PATCH 5/5] target: stash sess_err_stats on Data-Out timeout
References: bsc#1095805
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Patch-mainline: v4.20-rc1
Git-commit: 33b3f8ca510a2181574d6dcbd312c2b07dd9f0fa
sess_err_stats are currently filled on NOP ping timeout, but not
@@ -12,6 +11,7 @@ Data-Out timeout. Stash details of Data-Out timeouts using a
ISCSI_SESS_ERR_CXN_TIMEOUT value for last_sess_failure_type.
Signed-off-by: David Disseldorp <ddiss@suse.de>
+
---
drivers/target/iscsi/iscsi_target_erl1.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/patches.drivers/ALSA-cs46xx-Potential-NULL-dereference-in-probe.patch b/patches.drivers/ALSA-cs46xx-Potential-NULL-dereference-in-probe.patch
new file mode 100644
index 0000000000..9666bb581c
--- /dev/null
+++ b/patches.drivers/ALSA-cs46xx-Potential-NULL-dereference-in-probe.patch
@@ -0,0 +1,37 @@
+From 1524f4e47f90b27a3ac84efbdd94c63172246a6f Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 8 Jan 2019 10:43:30 +0300
+Subject: [PATCH 6/9] ALSA: cs46xx: Potential NULL dereference in probe
+Git-commit: 1524f4e47f90b27a3ac84efbdd94c63172246a6f
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+The "chip->dsp_spos_instance" can be NULL on some of the ealier error
+paths in snd_cs46xx_create().
+
+Reported-by: "Yavuz, Tuba" <tuba@ece.ufl.edu>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/cs46xx/dsp_spos.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/sound/pci/cs46xx/dsp_spos.c b/sound/pci/cs46xx/dsp_spos.c
+index 598d140bb7cb..5fc497c6d738 100644
+--- a/sound/pci/cs46xx/dsp_spos.c
++++ b/sound/pci/cs46xx/dsp_spos.c
+@@ -903,6 +903,9 @@ int cs46xx_dsp_proc_done (struct snd_cs46xx *chip)
+ struct dsp_spos_instance * ins = chip->dsp_spos_instance;
+ int i;
+
++ if (!ins)
++ return 0;
++
+ snd_info_free_entry(ins->proc_sym_info_entry);
+ ins->proc_sym_info_entry = NULL;
+
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-emu10k1-Fix-potential-Spectre-v1-vulnerabilitie.patch b/patches.drivers/ALSA-emu10k1-Fix-potential-Spectre-v1-vulnerabilitie.patch
new file mode 100644
index 0000000000..f34247940f
--- /dev/null
+++ b/patches.drivers/ALSA-emu10k1-Fix-potential-Spectre-v1-vulnerabilitie.patch
@@ -0,0 +1,65 @@
+From 5ae4f61f012a097df93de2285070ec8e34716d29 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Dec 2018 11:52:16 -0600
+Subject: [PATCH] ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
+Git-commit: 5ae4f61f012a097df93de2285070ec8e34716d29
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+ipcm->substream is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/pci/emu10k1/emufx.c:1031 snd_emu10k1_ipcm_poke() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
+sound/pci/emu10k1/emufx.c:1075 snd_emu10k1_ipcm_peek() warn: potential spectre issue 'emu->fx8010.pcm' [r] (local cap)
+
+Fix this by sanitizing ipcm->substream before using it to index emu->fx8010.pcm
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/emu10k1/emufx.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
+index 6ebe817801ea..1f25e6d029d8 100644
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -36,6 +36,7 @@
+ #include <linux/init.h>
+ #include <linux/mutex.h>
+ #include <linux/moduleparam.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/tlv.h>
+@@ -1026,6 +1027,8 @@ static int snd_emu10k1_ipcm_poke(struct snd_emu10k1 *emu,
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ if (ipcm->channels > 32)
+ return -EINVAL;
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+@@ -1072,6 +1075,8 @@ static int snd_emu10k1_ipcm_peek(struct snd_emu10k1 *emu,
+
+ if (ipcm->substream >= EMU10K1_FX8010_PCM_COUNT)
+ return -EINVAL;
++ ipcm->substream = array_index_nospec(ipcm->substream,
++ EMU10K1_FX8010_PCM_COUNT);
+ pcm = &emu->fx8010.pcm[ipcm->substream];
+ mutex_lock(&emu->fx8010.lock);
+ spin_lock_irq(&emu->reg_lock);
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-emux-Fix-potential-Spectre-v1-vulnerabilities.patch b/patches.drivers/ALSA-emux-Fix-potential-Spectre-v1-vulnerabilities.patch
new file mode 100644
index 0000000000..4cee0c1a4b
--- /dev/null
+++ b/patches.drivers/ALSA-emux-Fix-potential-Spectre-v1-vulnerabilities.patch
@@ -0,0 +1,72 @@
+From 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 12 Dec 2018 11:20:49 -0600
+Subject: [PATCH] ALSA: emux: Fix potential Spectre v1 vulnerabilities
+Git-commit: 4aea96f4237cea0c51a8bc87c0db31f0f932f1f0
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+info.mode and info.port are indirectly controlled by user-space,
+hence leading to a potential exploitation of the Spectre variant 1
+vulnerability.
+
+These issues were detected with the help of Smatch:
+
+sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap)
+sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap)
+sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap)
+
+Fix this by sanitizing both info.mode and info.port before using them
+to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and
+emu->portptrs.
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/synth/emux/emux_hwdep.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/synth/emux/emux_hwdep.c b/sound/synth/emux/emux_hwdep.c
+index e557946718a9..d9fcae071b47 100644
+--- a/sound/synth/emux/emux_hwdep.c
++++ b/sound/synth/emux/emux_hwdep.c
+@@ -22,9 +22,9 @@
+ #include <sound/core.h>
+ #include <sound/hwdep.h>
+ #include <linux/uaccess.h>
++#include <linux/nospec.h>
+ #include "emux_voice.h"
+
+-
+ #define TMP_CLIENT_ID 0x1001
+
+ /*
+@@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux *emu, void __user *arg)
+ return -EFAULT;
+ if (info.mode < 0 || info.mode >= EMUX_MD_END)
+ return -EINVAL;
++ info.mode = array_index_nospec(info.mode, EMUX_MD_END);
+
+ if (info.port < 0) {
+ for (i = 0; i < emu->num_ports; i++)
+ emu->portptrs[i]->ctrls[info.mode] = info.value;
+ } else {
+- if (info.port < emu->num_ports)
++ if (info.port < emu->num_ports) {
++ info.port = array_index_nospec(info.port, emu->num_ports);
+ emu->portptrs[info.port]->ctrls[info.mode] = info.value;
++ }
+ }
+ return 0;
+ }
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-fireface-fix-for-state-to-fetch-PCM-frames.patch b/patches.drivers/ALSA-fireface-fix-for-state-to-fetch-PCM-frames.patch
new file mode 100644
index 0000000000..b987886f5e
--- /dev/null
+++ b/patches.drivers/ALSA-fireface-fix-for-state-to-fetch-PCM-frames.patch
@@ -0,0 +1,40 @@
+From 3d16200a3e55a39caa1c88419cb559c00316f721 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:06:48 +0900
+Subject: [PATCH] ALSA: fireface: fix for state to fetch PCM frames
+Git-commit: 3d16200a3e55a39caa1c88419cb559c00316f721
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+According to my memo at hand and saved records, writing 0x00000001 to
+SND_FF_REG_FETCH_PCM_FRAMES disables fetching PCM frames in corresponding
+channel, however current implement uses reversed logic. This results in
+muted volume in device side during playback.
+
+This commit corrects the bug.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: 76fdb3a9e13a ('ALSA: fireface: add support for Fireface 400')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/fireface/ff-protocol-ff400.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
+index 8f34174ee813..fd257051d4a4 100644
+--- a/sound/firewire/fireface/ff-protocol-ff400.c
++++ b/sound/firewire/fireface/ff-protocol-ff400.c
+@@ -86,7 +86,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
+ if (reg == NULL)
+ return -ENOMEM;
+
+- if (enable) {
++ if (!enable) {
+ /*
+ * Each quadlet is corresponding to data channels in a data
+ * blocks in reverse order. Precisely, quadlets for available
+--
+2.19.2
+
diff --git a/patches.drivers/ALSA-firewire-lib-fix-wrong-assignment-for-out_packe.patch b/patches.drivers/ALSA-firewire-lib-fix-wrong-assignment-for-out_packe.patch
new file mode 100644
index 0000000000..35dbf46871
--- /dev/null
+++ b/patches.drivers/ALSA-firewire-lib-fix-wrong-assignment-for-out_packe.patch
@@ -0,0 +1,39 @@
+From aa9a9e39b4f65733bf19d90cbd026e85a74efb99 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:03:20 +0900
+Subject: [PATCH] ALSA: firewire-lib: fix wrong assignment for 'out_packet_without_header' tracepoint
+Git-commit: aa9a9e39b4f65733bf19d90cbd026e85a74efb99
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+An initial commit to add tracepoints for packets without CIP headers
+introduces a wrong assignment to 'data_blocks' value of
+'out_packet_without_header' tracepoint.
+
+This commit fixes the bug.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: b164d2fd6e49 ('ALSA: firewire_lib: add tracepoints for packets without CIP headers')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/amdtp-stream-trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h
+index 54cdd4ffa9ce..c05b3da0aa1c 100644
+--- a/sound/firewire/amdtp-stream-trace.h
++++ b/sound/firewire/amdtp-stream-trace.h
+@@ -169,7 +169,7 @@ TRACE_EVENT(out_packet_without_header,
+ __entry->dest = fw_parent_device(s->unit)->node_id;
+ __entry->payload_quadlets = payload_length / 4;
+ __entry->data_blocks = data_blocks,
+- __entry->data_blocks = s->data_block_counter,
++ __entry->data_block_counter = s->data_block_counter,
+ __entry->packet_index = s->packet_index;
+ __entry->irq = !!in_interrupt();
+ __entry->index = index;
+--
+2.19.2
+
diff --git a/patches.drivers/ALSA-firewire-lib-fix-wrong-handling-payload_length-.patch b/patches.drivers/ALSA-firewire-lib-fix-wrong-handling-payload_length-.patch
new file mode 100644
index 0000000000..0714ae7784
--- /dev/null
+++ b/patches.drivers/ALSA-firewire-lib-fix-wrong-handling-payload_length-.patch
@@ -0,0 +1,52 @@
+From ada79fa5a0b374dd2c2262137c734da7524a8263 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:03:19 +0900
+Subject: [PATCH] ALSA: firewire-lib: fix wrong handling payload_length as payload_quadlet
+Git-commit: ada79fa5a0b374dd2c2262137c734da7524a8263
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+In IEC 61883-1/6 engine of ALSA firewire stack, a packet handler has a
+second argument for 'the number of bytes in payload of isochronous
+packet'. However, an incoming packet handler without CIP header uses the
+value as 'the number of quadlets in the payload'. This brings userspace
+applications to receive the number of PCM frames as four times against
+real time.
+
+This commit fixes the bug.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: 3b196c394dd ('ALSA: firewire-lib: add no-header packet processing')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/amdtp-stream.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c
+index 9be76c808fcc..3ada55ed5381 100644
+--- a/sound/firewire/amdtp-stream.c
++++ b/sound/firewire/amdtp-stream.c
+@@ -654,15 +654,17 @@ static int handle_in_packet(struct amdtp_stream *s,
+ }
+
+ static int handle_in_packet_without_header(struct amdtp_stream *s,
+- unsigned int payload_quadlets, unsigned int cycle,
++ unsigned int payload_length, unsigned int cycle,
+ unsigned int index)
+ {
+ __be32 *buffer;
++ unsigned int payload_quadlets;
+ unsigned int data_blocks;
+ struct snd_pcm_substream *pcm;
+ unsigned int pcm_frames;
+
+ buffer = s->buffer.packets[s->packet_index].buffer;
++ payload_quadlets = payload_length / 4;
+ data_blocks = payload_quadlets / s->data_block_quadlets;
+
+ trace_in_packet_without_header(s, cycle, payload_quadlets, data_blocks,
+--
+2.19.2
+
diff --git a/patches.drivers/ALSA-firewire-lib-use-the-same-print-format-for-with.patch b/patches.drivers/ALSA-firewire-lib-use-the-same-print-format-for-with.patch
new file mode 100644
index 0000000000..cc1a1968d7
--- /dev/null
+++ b/patches.drivers/ALSA-firewire-lib-use-the-same-print-format-for-with.patch
@@ -0,0 +1,39 @@
+From 5ef108c53e6efd695e32aad969638ccbc35b4be9 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Sat, 15 Dec 2018 19:03:21 +0900
+Subject: [PATCH] ALSA: firewire-lib: use the same print format for 'without_header' tracepoints
+Git-commit: 5ef108c53e6efd695e32aad969638ccbc35b4be9
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+An initial commit to add tracepoints for packets without CIP headers
+uses different print formats for added tracepoints. However this is not
+convenient for users/developers to prepare debug tools.
+
+This commit uses the same format for the two tracepoints.
+
+Cc: <stable@vger.kernel.org> # v4.12+
+Fixes: b164d2fd6e49 ('ALSA: firewire_lib: add tracepoints for packets without CIP headers')
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/amdtp-stream-trace.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-stream-trace.h b/sound/firewire/amdtp-stream-trace.h
+index c05b3da0aa1c..ac20acf48fc6 100644
+--- a/sound/firewire/amdtp-stream-trace.h
++++ b/sound/firewire/amdtp-stream-trace.h
+@@ -131,7 +131,7 @@ TRACE_EVENT(in_packet_without_header,
+ __entry->index = index;
+ ),
+ TP_printk(
+- "%02u %04u %04x %04x %02d %03u %3u %3u %02u %01u %02u",
++ "%02u %04u %04x %04x %02d %03u %02u %03u %02u %01u %02u",
+ __entry->second,
+ __entry->cycle,
+ __entry->src,
+--
+2.19.2
+
diff --git a/patches.drivers/ALSA-hda-add-mute-LED-support-for-HP-EliteBook-840-G.patch b/patches.drivers/ALSA-hda-add-mute-LED-support-for-HP-EliteBook-840-G.patch
new file mode 100644
index 0000000000..d6de73f13e
--- /dev/null
+++ b/patches.drivers/ALSA-hda-add-mute-LED-support-for-HP-EliteBook-840-G.patch
@@ -0,0 +1,38 @@
+From 40906ebe3af6a48457151b3c6726b480f6a6cb13 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mantas=20Mikul=C4=97nas?= <grawity@gmail.com>
+Date: Sun, 16 Dec 2018 15:44:47 +0200
+Subject: [PATCH] ALSA: hda: add mute LED support for HP EliteBook 840 G4
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 40906ebe3af6a48457151b3c6726b480f6a6cb13
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Tested with 4.19.9.
+
+V2: Changed from CXT_FIXUP_MUTE_LED_GPIO to CXT_FIXUP_HP_DOCK because that's what the existing fixups for EliteBooks use.
+
+Signed-off-by: Mantas Mikulėnas <grawity@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_conexant.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 950e02e71766..51cc6589443f 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -923,6 +923,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK),
++ SND_PCI_QUIRK(0x103c, 0x828c, "HP EliteBook 840 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK),
+ SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-hda-ca0132-make-pci_iounmap-call-conditional.patch b/patches.drivers/ALSA-hda-ca0132-make-pci_iounmap-call-conditional.patch
new file mode 100644
index 0000000000..88b369453b
--- /dev/null
+++ b/patches.drivers/ALSA-hda-ca0132-make-pci_iounmap-call-conditional.patch
@@ -0,0 +1,35 @@
+From 1e73359a24fad529b0794515b46cbfff99e5fbe6 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 10 Dec 2018 21:54:25 +0100
+Subject: [PATCH] ALSA: hda/ca0132 - make pci_iounmap() call conditional
+Git-commit: 1e73359a24fad529b0794515b46cbfff99e5fbe6
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+When building without CONFIG_PCI, we can (depending on the architecture)
+get a link failure:
+
+Error: "pci_iounmap" [sound/pci/hda/snd-hda-codec-ca0132.ko] undefined!
+
+Adding a compile-time check for PCI gets it to work correctly on
+32-bit ARM.
+
+Fixes: d99501b8575d ("ALSA: hda/ca0132 - Call pci_iounmap() instead of iounmap()")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_ca0132.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -7326,7 +7326,7 @@ static void ca0132_free(struct hda_codec
+ break;
+ }
+ snd_hda_power_down(codec);
+- if (spec->mem_base)
++ if (IS_ENABLED(CONFIG_PCI) && spec->mem_base)
+ pci_iounmap(codec->bus->pci, spec->mem_base);
+ kfree(spec->spec_init_verbs);
+ kfree(codec->spec);
diff --git a/patches.drivers/ALSA-hda-fix-front-speakers-on-Huawei-MBXP.patch b/patches.drivers/ALSA-hda-fix-front-speakers-on-Huawei-MBXP.patch
new file mode 100644
index 0000000000..d31cb2cce9
--- /dev/null
+++ b/patches.drivers/ALSA-hda-fix-front-speakers-on-Huawei-MBXP.patch
@@ -0,0 +1,64 @@
+From 8ac51bbc4cfec4ef08b03bef24b31e2d50ef8b37 Mon Sep 17 00:00:00 2001
+From: Ayman Bagabas <ayman.bagabas@gmail.com>
+Date: Wed, 12 Dec 2018 18:07:57 -0500
+Subject: [PATCH] ALSA: hda: fix front speakers on Huawei MBXP
+Git-commit: 8ac51bbc4cfec4ef08b03bef24b31e2d50ef8b37
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+This patch solves bug 200501 'Only 2 of 4 speakers playing sound.'
+It enables the front speakers on Huawei Matebook X Pro laptops.
+These laptops come with Dolby Atmos sound system and these pins
+configuration enables the front speakers.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200501
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Ayman Bagabas <ayman.bagabas@gmail.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5594,6 +5594,7 @@ enum {
+ ALC298_FIXUP_TPT470_DOCK,
+ ALC255_FIXUP_DUMMY_LINEOUT_VERB,
+ ALC255_FIXUP_DELL_HEADSET_MIC,
++ ALC256_FIXUP_HUAWEI_MBXP_PINS,
+ ALC295_FIXUP_HP_X360,
+ ALC221_FIXUP_HP_HEADSET_MIC,
+ ALC285_FIXUP_LENOVO_HEADPHONE_NOISE,
+@@ -5878,6 +5879,22 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MIC
+ },
++ [ALC256_FIXUP_HUAWEI_MBXP_PINS] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ {0x12, 0x90a60130},
++ {0x13, 0x40000000},
++ {0x14, 0x90170110},
++ {0x18, 0x411111f0},
++ {0x19, 0x04a11040},
++ {0x1a, 0x411111f0},
++ {0x1b, 0x90170112},
++ {0x1d, 0x40759a05},
++ {0x1e, 0x411111f0},
++ {0x21, 0x04211020},
++ { }
++ },
++ },
+ [ALC269_FIXUP_ASUS_X101_FUNC] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc269_fixup_x101_headset_mic,
+@@ -6767,6 +6784,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK),
+ SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
++ SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MBXP", ALC256_FIXUP_HUAWEI_MBXP_PINS),
+ SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+
+ #if 0
diff --git a/patches.drivers/ALSA-hda-realtek-Add-unplug-function-into-unplug-sta.patch b/patches.drivers/ALSA-hda-realtek-Add-unplug-function-into-unplug-sta.patch
new file mode 100644
index 0000000000..8138859726
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Add-unplug-function-into-unplug-sta.patch
@@ -0,0 +1,34 @@
+From 4d4b0c52bde470c379f5d168d5c139ad866cb808 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Wed, 9 Jan 2019 16:23:37 +0800
+Subject: [PATCH 8/9] ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225
+Git-commit: 4d4b0c52bde470c379f5d168d5c139ad866cb808
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+Forgot to add unplug function to unplug state of headset mode
+for ALC225.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 396ec43a2a54..2c5c8ad84783 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4102,6 +4102,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec)
+ case 0x10ec0295:
+ case 0x10ec0289:
+ case 0x10ec0299:
++ alc_process_coef_fw(codec, alc225_pre_hsmode);
+ alc_process_coef_fw(codec, coef0225);
+ break;
+ case 0x10ec0867:
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-hda-realtek-Disable-headset-Mic-VREF-for-headse.patch b/patches.drivers/ALSA-hda-realtek-Disable-headset-Mic-VREF-for-headse.patch
new file mode 100644
index 0000000000..3790d397a3
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Disable-headset-Mic-VREF-for-headse.patch
@@ -0,0 +1,67 @@
+From d1dd42110d2727e81b9265841a62bc84c454c3a2 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Wed, 9 Jan 2019 17:05:24 +0800
+Subject: [PATCH 9/9] ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
+Git-commit: d1dd42110d2727e81b9265841a62bc84c454c3a2
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+Disable Headset Mic VREF for headset mode of ALC225.
+This will be controlled by coef bits of headset mode functions.
+
+[ Fixed a compile warning and code simplification -- tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5460,6 +5460,13 @@ static void alc285_fixup_invalidate_dacs
+ snd_hda_override_wcaps(codec, 0x03, 0);
+ }
+
++static void alc_fixup_disable_mic_vref(struct hda_codec *codec,
++ const struct hda_fixup *fix, int action)
++{
++ if (action == HDA_FIXUP_ACT_PRE_PROBE)
++ snd_hda_codec_set_pin_target(codec, 0x19, PIN_VREFHIZ);
++}
++
+ /* for hda_fixup_thinkpad_acpi() */
+ #include "thinkpad_helper.c"
+
+@@ -5572,6 +5579,7 @@ enum {
+ ALC293_FIXUP_LENOVO_SPK_NOISE,
+ ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ ALC255_FIXUP_DELL_SPK_NOISE,
++ ALC225_FIXUP_DISABLE_MIC_VREF,
+ ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC295_FIXUP_DISABLE_DAC3,
+ ALC280_FIXUP_HP_HEADSET_MIC,
+@@ -6293,6 +6301,12 @@ static const struct hda_fixup alc269_fix
+ .chained = true,
+ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ },
++ [ALC225_FIXUP_DISABLE_MIC_VREF] = {
++ .type = HDA_FIXUP_FUNC,
++ .v.func = alc_fixup_disable_mic_vref,
++ .chained = true,
++ .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ },
+ [ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -6302,7 +6316,7 @@ static const struct hda_fixup alc269_fix
+ {}
+ },
+ .chained = true,
+- .chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++ .chain_id = ALC225_FIXUP_DISABLE_MIC_VREF
+ },
+ [ALC280_FIXUP_HP_HEADSET_MIC] = {
+ .type = HDA_FIXUP_FUNC,
diff --git a/patches.drivers/ALSA-hda-realtek-Enable-audio-jacks-of-ASUS-UX391UA-.patch b/patches.drivers/ALSA-hda-realtek-Enable-audio-jacks-of-ASUS-UX391UA-.patch
new file mode 100644
index 0000000000..168a81c21c
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Enable-audio-jacks-of-ASUS-UX391UA-.patch
@@ -0,0 +1,39 @@
+From 9cf6533e8060d3896b88ea14b27f620e6504b84b Mon Sep 17 00:00:00 2001
+From: Wandrille RONCE <w@ndrille.fr>
+Date: Wed, 19 Dec 2018 14:52:44 +0100
+Subject: [PATCH] ALSA: hda/realtek: Enable audio jacks of ASUS UX391UA with ALC294
+Git-commit: 9cf6533e8060d3896b88ea14b27f620e6504b84b
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+By default, there is no sound on Asus UX391UA on Linux.
+
+This patch adds sound support on Asus UX391UA. Tested working by three
+different users.
+
+The problem has also been described at
+https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1784485
+
+Signed-off-by: Wandrille RONCE <w@ndrille.fr>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 129ebd857892..a4f4a9dd488d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6654,6 +6654,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
++ SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-hda-realtek-Enable-the-headset-mic-auto-detecti.patch b/patches.drivers/ALSA-hda-realtek-Enable-the-headset-mic-auto-detecti.patch
new file mode 100644
index 0000000000..78f7139239
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Enable-the-headset-mic-auto-detecti.patch
@@ -0,0 +1,38 @@
+From 82b01149ec94d746867d7f9156c44d775d4d2d67 Mon Sep 17 00:00:00 2001
+From: Jian-Hong Pan <jian-hong@endlessm.com>
+Date: Thu, 27 Dec 2018 16:46:31 +0800
+Subject: [PATCH] ALSA: hda/realtek: Enable the headset mic auto detection for ASUS laptops
+Git-commit: 82b01149ec94d746867d7f9156c44d775d4d2d67
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The headset mic of ASUS laptops like UX533FD, UX433FN and UX333FA, whose
+CODEC is Realtek ALC294 has jack auto detection feature. This patch
+enables the feature.
+
+Fixes: 4e051106730d ("ALSA: hda/realtek: Enable audio jacks of ASUS UX533FD with ALC294")
+Signed-off-by: Daniel Drake <drake@endlessm.com>
+Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a4f4a9dd488d..aee4cbd29d53 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6501,7 +6501,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ [ALC294_FIXUP_ASUS_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+- { 0x19, 0x01a1113c }, /* use as headset mic, without its own jack detect */
++ { 0x19, 0x01a1103c }, /* use as headset mic */
+ { }
+ },
+ .chained = true,
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-hda-realtek-Support-Dell-headset-mode-for-New-A.patch b/patches.drivers/ALSA-hda-realtek-Support-Dell-headset-mode-for-New-A.patch
new file mode 100644
index 0000000000..7a24572096
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Support-Dell-headset-mode-for-New-A.patch
@@ -0,0 +1,34 @@
+From c2a7c55a04065c3b0c32d23b099db7ea1dbf6250 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Thu, 3 Jan 2019 15:53:39 +0800
+Subject: [PATCH 5/9] ALSA: hda/realtek - Support Dell headset mode for New AIO platform
+Git-commit: c2a7c55a04065c3b0c32d23b099db7ea1dbf6250
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+Dell has new platform for ALC274.
+This will support to enable headset mode.
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index aee4cbd29d53..396ec43a2a54 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6584,6 +6584,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB),
++ SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
+ SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-hda-tegra-clear-pending-irq-handlers.patch b/patches.drivers/ALSA-hda-tegra-clear-pending-irq-handlers.patch
new file mode 100644
index 0000000000..f76e0bdc2a
--- /dev/null
+++ b/patches.drivers/ALSA-hda-tegra-clear-pending-irq-handlers.patch
@@ -0,0 +1,46 @@
+From 63d2a9ec310d8bcc955574220d4631aa55c1a80c Mon Sep 17 00:00:00 2001
+From: Sameer Pujar <spujar@nvidia.com>
+Date: Wed, 26 Dec 2018 16:04:49 +0530
+Subject: [PATCH] ALSA: hda/tegra: clear pending irq handlers
+Git-commit: 63d2a9ec310d8bcc955574220d4631aa55c1a80c
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Even after disabling interrupts on the module, it could be possible
+that irq handlers are still running. System hang is seen during
+suspend path. It was found that, there were pending writes on the
+HDA bus and clock was disabled by that time.
+
+Above mentioned issue is fixed by clearing any pending irq handlers
+before disabling clocks and returning from hda suspend.
+
+Suggested-by: Mohan Kumar <mkumard@nvidia.com>
+Suggested-by: Dara Ramesh <dramesh@nvidia.com>
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_tegra.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
+index 83befd8d43e8..97a176d817a0 100644
+--- a/sound/pci/hda/hda_tegra.c
++++ b/sound/pci/hda/hda_tegra.c
+@@ -234,10 +234,12 @@ static int hda_tegra_suspend(struct device *dev)
+ struct snd_card *card = dev_get_drvdata(dev);
+ struct azx *chip = card->private_data;
+ struct hda_tegra *hda = container_of(chip, struct hda_tegra, chip);
++ struct hdac_bus *bus = azx_bus(chip);
+
+ snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+
+ azx_stop_chip(chip);
++ synchronize_irq(bus->irq);
+ azx_enter_link_reset(chip);
+ hda_tegra_disable_clocks(hda);
+
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-pcm-Fix-potential-Spectre-v1-vulnerability.patch b/patches.drivers/ALSA-pcm-Fix-potential-Spectre-v1-vulnerability.patch
new file mode 100644
index 0000000000..df69b56e1f
--- /dev/null
+++ b/patches.drivers/ALSA-pcm-Fix-potential-Spectre-v1-vulnerability.patch
@@ -0,0 +1,54 @@
+From 94ffb030b6d31ec840bb811be455dd2e26a4f43e Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 12 Dec 2018 15:36:28 -0600
+Subject: [PATCH] ALSA: pcm: Fix potential Spectre v1 vulnerability
+Git-commit: 94ffb030b6d31ec840bb811be455dd2e26a4f43e
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+stream is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/core/pcm.c:140 snd_pcm_control_ioctl() warn: potential spectre issue 'pcm->streams' [r] (local cap)
+
+Fix this by sanitizing stream before using it to index pcm->streams
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/pcm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/core/pcm.c b/sound/core/pcm.c
+index fdb9b92fc8d6..01b9d62eef14 100644
+--- a/sound/core/pcm.c
++++ b/sound/core/pcm.c
+@@ -25,6 +25,7 @@
+ #include <linux/time.h>
+ #include <linux/mutex.h>
+ #include <linux/device.h>
++#include <linux/nospec.h>
+ #include <sound/core.h>
+ #include <sound/minors.h>
+ #include <sound/pcm.h>
+@@ -129,6 +130,7 @@ static int snd_pcm_control_ioctl(struct snd_card *card,
+ return -EFAULT;
+ if (stream < 0 || stream > 1)
+ return -EINVAL;
++ stream = array_index_nospec(stream, 2);
+ if (get_user(subdevice, &info->subdevice))
+ return -EFAULT;
+ mutex_lock(&register_mutex);
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-rme9652-Fix-potential-Spectre-v1-vulnerability.patch b/patches.drivers/ALSA-rme9652-Fix-potential-Spectre-v1-vulnerability.patch
new file mode 100644
index 0000000000..09ded5f0fc
--- /dev/null
+++ b/patches.drivers/ALSA-rme9652-Fix-potential-Spectre-v1-vulnerability.patch
@@ -0,0 +1,73 @@
+From 0b84304ef5da92add8dc75a1b07879c5374cdb05 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 18 Dec 2018 11:18:34 -0600
+Subject: [PATCH] ALSA: rme9652: Fix potential Spectre v1 vulnerability
+Git-commit: 0b84304ef5da92add8dc75a1b07879c5374cdb05
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+info->channel is indirectly controlled by user-space, hence leading to
+a potential exploitation of the Spectre variant 1 vulnerability.
+
+This issue was detected with the help of Smatch:
+
+sound/pci/rme9652/hdsp.c:4100 snd_hdsp_channel_info() warn: potential spectre issue 'hdsp->channel_map' [r] (local cap)
+
+Fix this by sanitizing info->channel before using it to index hdsp->channel_map
+
+Notice that given that speculation windows are large, the policy is
+to kill the speculation on the first load and not worry if it can be
+completed with a dependent load/store [1].
+
+Also, notice that I refactored the code a bit in order to get rid of the
+following checkpatch warning:
+
+Error: do not use assignment in if condition
+File: sound/pci/rme9652/hdsp.c:4103: if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
+
+[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/rme9652/hdsp.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/sound/pci/rme9652/hdsp.c b/sound/pci/rme9652/hdsp.c
+index 1bff4b1b39cd..ba99ff0e93e0 100644
+--- a/sound/pci/rme9652/hdsp.c
++++ b/sound/pci/rme9652/hdsp.c
+@@ -30,6 +30,7 @@
+ #include <linux/math64.h>
+ #include <linux/vmalloc.h>
+ #include <linux/io.h>
++#include <linux/nospec.h>
+
+ #include <sound/core.h>
+ #include <sound/control.h>
+@@ -4092,15 +4093,16 @@ static int snd_hdsp_channel_info(struct snd_pcm_substream *substream,
+ struct snd_pcm_channel_info *info)
+ {
+ struct hdsp *hdsp = snd_pcm_substream_chip(substream);
+- int mapped_channel;
++ unsigned int channel = info->channel;
+
+- if (snd_BUG_ON(info->channel >= hdsp->max_channels))
++ if (snd_BUG_ON(channel >= hdsp->max_channels))
+ return -EINVAL;
++ channel = array_index_nospec(channel, hdsp->max_channels);
+
+- if ((mapped_channel = hdsp->channel_map[info->channel]) < 0)
++ if (hdsp->channel_map[channel] < 0)
+ return -EINVAL;
+
+- info->offset = mapped_channel * HDSP_CHANNEL_BUFFER_BYTES;
++ info->offset = hdsp->channel_map[channel] * HDSP_CHANNEL_BUFFER_BYTES;
+ info->first = 0;
+ info->step = 32;
+ return 0;
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch b/patches.drivers/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
new file mode 100644
index 0000000000..d0e3a70c51
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
@@ -0,0 +1,51 @@
+From f4351a199cc120ff9d59e06d02e8657d08e6cc46 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 19 Dec 2018 12:36:27 +0100
+Subject: [PATCH 1/9] ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
+Git-commit: f4351a199cc120ff9d59e06d02e8657d08e6cc46
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+The parser for the processing unit reads bNrInPins field before the
+bLength sanity check, which may lead to an out-of-bound access when a
+malformed descriptor is given. Fix it by assignment after the bLength
+check.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index c63c84b54969..0131de348cf6 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2314,7 +2314,7 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ char *name)
+ {
+ struct uac_processing_unit_descriptor *desc = raw_desc;
+- int num_ins = desc->bNrInPins;
++ int num_ins;
+ struct usb_mixer_elem_info *cval;
+ struct snd_kcontrol *kctl;
+ int i, err, nameid, type, len;
+@@ -2329,7 +2329,13 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ 0, NULL, default_value_info
+ };
+
+- if (desc->bLength < 13 || desc->bLength < 13 + num_ins ||
++ if (desc->bLength < 13) {
++ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
++ return -EINVAL;
++ }
++
++ num_ins = desc->bNrInPins;
++ if (desc->bLength < 13 + num_ins ||
+ desc->bLength < num_ins + uac_processing_unit_bControlSize(desc, state->mixer->protocol)) {
+ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+ return -EINVAL;
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-an-out-of-bound-read-in-create_co.patch b/patches.drivers/ALSA-usb-audio-Fix-an-out-of-bound-read-in-create_co.patch
new file mode 100644
index 0000000000..710a45a0a7
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-an-out-of-bound-read-in-create_co.patch
@@ -0,0 +1,58 @@
+From cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184 Mon Sep 17 00:00:00 2001
+From: Hui Peng <benquike@163.com>
+Date: Tue, 25 Dec 2018 18:11:52 -0500
+Subject: [PATCH 4/9] ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
+Git-commit: cbb2ebf70daf7f7d97d3811a2ff8e39655b8c184
+Patch-mainline: v5.0-rc2
+References: bsc#1051510
+
+In `create_composite_quirk`, the terminating condition of for loops is
+`quirk->ifnum < 0`. So any composite quirks should end with `struct
+snd_usb_audio_quirk` object with ifnum < 0.
+
+ for (quirk = quirk_comp->data; quirk->ifnum >= 0; ++quirk) {
+
+ .....
+ }
+
+the data field of Bower's & Wilkins PX headphones usb device device quirks
+do not end with {.ifnum = -1}, wihch may result in out-of-bound read.
+
+This Patch fix the bug by adding an ending quirk object.
+
+Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones")
+Signed-off-by: Hui Peng <benquike@163.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/quirks-table.h | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 37fc0447c071..b345beb447bd 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -3326,6 +3326,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ }
+ },
++ {
++ .ifnum = -1
++ },
+ }
+ }
+ },
+@@ -3369,6 +3372,9 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
+ }
+ }
+ },
++ {
++ .ifnum = -1
++ },
+ }
+ }
+ },
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-x86-Fix-runtime-PM-for-hdmi-lpe-audio.patch b/patches.drivers/ALSA-x86-Fix-runtime-PM-for-hdmi-lpe-audio.patch
new file mode 100644
index 0000000000..0edb5282a7
--- /dev/null
+++ b/patches.drivers/ALSA-x86-Fix-runtime-PM-for-hdmi-lpe-audio.patch
@@ -0,0 +1,41 @@
+From 8dfb839cfe737a17def8e5f88ee13c295230364a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 24 Oct 2018 18:48:24 +0300
+Subject: [PATCH] ALSA: x86: Fix runtime PM for hdmi-lpe-audio
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 8dfb839cfe737a17def8e5f88ee13c295230364a
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Commit 46e831abe864 ("drm/i915/lpe: Mark LPE audio runtime pm as
+"no callbacks"") broke runtime PM with lpe audio. We can no longer
+runtime suspend the GPU since the sysfs power/control for the
+lpe-audio device no longer exists and the device is considered
+always active. We can fix this by not marking the device as
+active.
+
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Fixes: 46e831abe864 ("drm/i915/lpe: Mark LPE audio runtime pm as "no callbacks"")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181024154825.18185-1-ville.syrjala@linux.intel.com
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/x86/intel_hdmi_audio.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/sound/x86/intel_hdmi_audio.c
++++ b/sound/x86/intel_hdmi_audio.c
+@@ -1819,7 +1819,6 @@ static int hdmi_lpe_audio_probe(struct p
+
+ pm_runtime_use_autosuspend(&pdev->dev);
+ pm_runtime_mark_last_busy(&pdev->dev);
+- pm_runtime_set_active(&pdev->dev);
+
+ dev_dbg(&pdev->dev, "%s: handle pending notification\n", __func__);
+ schedule_work(&ctx->hdmi_audio_wq);
diff --git a/patches.drivers/ARM-bcm2835-Add-GET_THROTTLED-firmware-property.patch b/patches.drivers/ARM-bcm2835-Add-GET_THROTTLED-firmware-property.patch
index 45e0337b22..e361855286 100644
--- a/patches.drivers/ARM-bcm2835-Add-GET_THROTTLED-firmware-property.patch
+++ b/patches.drivers/ARM-bcm2835-Add-GET_THROTTLED-firmware-property.patch
@@ -30,9 +30,9 @@ Signed-off-by: Matthias Brugger <mbrugger@suse.com>
--- a/include/soc/bcm2835/raspberrypi-firmware.h
+++ b/include/soc/bcm2835/raspberrypi-firmware.h
-@@ -73,6 +73,7 @@ enum rpi_firmware_property_tag {
- RPI_FIRMWARE_GET_DISPMANX_RESOURCE_MEM_HANDLE = 0x00030014,
+@@ -75,6 +75,7 @@ enum rpi_firmware_property_tag {
RPI_FIRMWARE_GET_EDID_BLOCK = 0x00030020,
+ RPI_FIRMWARE_GET_CUSTOMER_OTP = 0x00030021,
RPI_FIRMWARE_GET_DOMAIN_STATE = 0x00030030,
+ RPI_FIRMWARE_GET_THROTTLED = 0x00030046,
RPI_FIRMWARE_SET_CLOCK_STATE = 0x00038001,
diff --git a/patches.drivers/ASoC-Intel-mrfld-fix-uninitialized-variable-access.patch b/patches.drivers/ASoC-Intel-mrfld-fix-uninitialized-variable-access.patch
new file mode 100644
index 0000000000..a5e95bab91
--- /dev/null
+++ b/patches.drivers/ASoC-Intel-mrfld-fix-uninitialized-variable-access.patch
@@ -0,0 +1,56 @@
+From 1539c7f23f256120f89f8b9ec53160790bce9ed2 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Sat, 3 Nov 2018 22:21:22 +0100
+Subject: [PATCH] ASoC: Intel: mrfld: fix uninitialized variable access
+Git-commit: 1539c7f23f256120f89f8b9ec53160790bce9ed2
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Randconfig testing revealed a very old bug, with gcc-8:
+
+Sound/soc/intel/atom/sst/sst_loader.c: In function 'sst_load_fw':
+sound/soc/intel/atom/sst/sst_loader.c:357:5: error: 'fw' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ if (fw == NULL) {
+ ^
+sound/soc/intel/atom/sst/sst_loader.c:354:25: note: 'fw' was declared here
+ const struct firmware *fw;
+
+We must check the return code of request_firmware() before we look at the
+pointer result that may be uninitialized when the function fails.
+
+Fixes: 9012c9544eea ("ASoC: Intel: mrfld - Add DSP load and management")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/intel/atom/sst/sst_loader.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/intel/atom/sst/sst_loader.c b/sound/soc/intel/atom/sst/sst_loader.c
+index 27413ebae956..b8c456753f01 100644
+--- a/sound/soc/intel/atom/sst/sst_loader.c
++++ b/sound/soc/intel/atom/sst/sst_loader.c
+@@ -354,14 +354,14 @@ static int sst_request_fw(struct intel_sst_drv *sst)
+ const struct firmware *fw;
+
+ retval = request_firmware(&fw, sst->firmware_name, sst->dev);
+- if (fw == NULL) {
+- dev_err(sst->dev, "fw is returning as null\n");
+- return -EINVAL;
+- }
+ if (retval) {
+ dev_err(sst->dev, "request fw failed %d\n", retval);
+ return retval;
+ }
++ if (fw == NULL) {
++ dev_err(sst->dev, "fw is returning as null\n");
++ return -EINVAL;
++ }
+ mutex_lock(&sst->sst_lock);
+ retval = sst_cache_and_parse_fw(sst, fw);
+ mutex_unlock(&sst->sst_lock);
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-dapm-Recalculate-audio-map-forcely-when-card-in.patch b/patches.drivers/ASoC-dapm-Recalculate-audio-map-forcely-when-card-in.patch
new file mode 100644
index 0000000000..e94b924b83
--- /dev/null
+++ b/patches.drivers/ASoC-dapm-Recalculate-audio-map-forcely-when-card-in.patch
@@ -0,0 +1,59 @@
+From 882eab6c28d23a970ae73b7eb831b169a672d456 Mon Sep 17 00:00:00 2001
+From: Tzung-Bi Shih <tzungbi@google.com>
+Date: Wed, 14 Nov 2018 17:06:13 +0800
+Subject: [PATCH] ASoC: dapm: Recalculate audio map forcely when card instantiated
+Git-commit: 882eab6c28d23a970ae73b7eb831b169a672d456
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+Audio map are possible in wrong state before card->instantiated has
+been set to true. Imaging the following examples:
+
+time 1: at the beginning
+
+ in:-1 in:-1 in:-1 in:-1
+ out:-1 out:-1 out:-1 out:-1
+ SIGGEN A B Spk
+
+time 2: after someone called snd_soc_dapm_new_widgets()
+(e.g. create_fill_widget_route_map() in sound/soc/codecs/hdac_hdmi.c)
+
+ in:1 in:0 in:0 in:0
+ out:0 out:0 out:0 out:1
+ SIGGEN A B Spk
+
+time 3: routes added
+
+ in:1 in:0 in:0 in:0
+ out:0 out:0 out:0 out:1
+ SIGGEN -----> A -----> B ---> Spk
+
+In the end, the path should be powered on but it did not. At time 3,
+"in" of SIGGEN and "out" of Spk did not propagate to their neighbors
+because snd_soc_dapm_add_path() will not invalidate the paths if
+the card has not instantiated (i.e. card->instantiated is false).
+To correct the state of audio map, recalculate the whole map forcely.
+
+Signed-off-by: Tzung-Bi Shih <tzungbi@google.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index 6ddcf12bc030..b29d0f65611e 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2131,6 +2131,7 @@ static int snd_soc_instantiate_card(struct snd_soc_card *card)
+ }
+
+ card->instantiated = 1;
++ dapm_mark_endpoints_dirty(card);
+ snd_soc_dapm_sync(&card->dapm);
+ mutex_unlock(&card->mutex);
+ mutex_unlock(&client_mutex);
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-2.patch b/patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-2.patch
new file mode 100644
index 0000000000..3a74a3d662
--- /dev/null
+++ b/patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-2.patch
@@ -0,0 +1,56 @@
+From 94ea56cff506c769a509c5dd87904c7fe3806a81 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 3 Dec 2018 21:45:14 +0100
+Subject: [PATCH] ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Gnawty
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 94ea56cff506c769a509c5dd87904c7fe3806a81
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The Gnawty model Chromebook uses pmc_plt_clk_0 instead of pmc_plt_clk_3
+for the mclk, just like the Clapper and Swanky models.
+
+This commit adds a DMI based quirk for this.
+
+This fixing audio no longer working on these devices after
+commit 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+that commit fixes us unnecessary keeping unused clocks on, but in case of
+the Gnawty that was breaking audio support since we were not using the
+right clock in the cht_bsw_max98090_ti machine driver.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=201787
+Cc: stable@vger.kernel.org
+Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+Reported-and-tested-by: Jaime Pérez <19.jaime.91@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/intel/boards/cht_bsw_max98090_ti.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+index ad0c98383853..08a5152e635a 100644
+--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+@@ -396,6 +396,13 @@ static const struct dmi_system_id cht_max98090_quirk_table[] = {
+ },
+ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
+ },
++ {
++ /* Gnawty model Chromebook (Acer Chromebook CB3-111) */
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "Gnawty"),
++ },
++ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
++ },
+ {
+ /* Swanky model Chromebook (Toshiba Chromebook 2) */
+ .matches = {
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-qui.patch b/patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-qui.patch
new file mode 100644
index 0000000000..83235c8eac
--- /dev/null
+++ b/patches.drivers/ASoC-intel-cht_bsw_max98090_ti-Add-pmc_plt_clk_0-qui.patch
@@ -0,0 +1,51 @@
+From 984bfb398a3af6fa9b7e80165e524933b0616686 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Sun, 2 Dec 2018 13:21:22 +0100
+Subject: [PATCH] ASoC: intel: cht_bsw_max98090_ti: Add pmc_plt_clk_0 quirk for Chromebook Clapper
+Git-commit: 984bfb398a3af6fa9b7e80165e524933b0616686
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The Clapper model Chromebook uses pmc_plt_clk_0 instead of pmc_plt_clk_3
+for the mclk, just like the Swanky model.
+
+This commit adds a DMI based quirk for this.
+
+This fixing audio no longer working on these devices after
+commit 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+that commit fixes us unnecessary keeping unused clocks on, but in case of
+the Clapper that was breaking audio support since we were not using the
+right clock in the cht_bsw_max98090_ti machine driver.
+
+Cc: stable@vger.kernel.org
+Fixes: 648e921888ad ("clk: x86: Stop marking clocks as CLK_IS_CRITICAL")
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/intel/boards/cht_bsw_max98090_ti.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+index 9d9f6e41d81c..ad0c98383853 100644
+--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c
++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c
+@@ -389,6 +389,13 @@ static struct snd_soc_card snd_soc_card_cht = {
+ };
+
+ static const struct dmi_system_id cht_max98090_quirk_table[] = {
++ {
++ /* Clapper model Chromebook */
++ .matches = {
++ DMI_MATCH(DMI_PRODUCT_NAME, "Clapper"),
++ },
++ .driver_data = (void *)QUIRK_PMC_PLT_CLK_0,
++ },
+ {
+ /* Swanky model Chromebook (Toshiba Chromebook 2) */
+ .matches = {
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-omap-abe-twl6040-Fix-missing-audio-card-caused-.patch b/patches.drivers/ASoC-omap-abe-twl6040-Fix-missing-audio-card-caused-.patch
new file mode 100644
index 0000000000..96fdd5e584
--- /dev/null
+++ b/patches.drivers/ASoC-omap-abe-twl6040-Fix-missing-audio-card-caused-.patch
@@ -0,0 +1,160 @@
+From 76836fd354922ebe4798a64fda01f8dc6a8b0984 Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 14 Nov 2018 14:58:20 +0200
+Subject: [PATCH] ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing
+Git-commit: 76836fd354922ebe4798a64fda01f8dc6a8b0984
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+The machine driver fails to probe in next-20181113 with:
+
+[ 2.539093] omap-abe-twl6040 sound: ASoC: CODEC DAI twl6040-legacy not registered
+[ 2.546630] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -517
+...
+[ 3.693206] omap-abe-twl6040 sound: ASoC: Both platform name/of_node are set for TWL6040
+[ 3.701446] omap-abe-twl6040 sound: ASoC: failed to init link TWL6040
+[ 3.708007] omap-abe-twl6040 sound: devm_snd_soc_register_card() failed: -22
+[ 3.715148] omap-abe-twl6040: probe of sound failed with error -22
+
+Bisect pointed to a merge commit:
+first bad commit: [0f688ab20a540aafa984c5dbd68a71debebf4d7f] Merge remote-tracking branch 'net-next/master'
+
+and a diff between a working kernel does not reveal anything which would
+explain the change in behavior.
+
+Further investigation showed that on the second try of loading fails
+because the dai_link->platform is no longer NULL and it might be pointing
+to uninitialized memory.
+
+The fix is to move the snd_soc_dai_link and snd_soc_card inside of the
+abe_twl6040 struct, which is dynamically allocated every time the driver
+probes.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/omap/omap-abe-twl6040.c | 67 +++++++++++++------------------
+ 1 file changed, 29 insertions(+), 38 deletions(-)
+
+diff --git a/sound/soc/omap/omap-abe-twl6040.c b/sound/soc/omap/omap-abe-twl6040.c
+index d5ae9eb8c756..fed45b41f9d3 100644
+--- a/sound/soc/omap/omap-abe-twl6040.c
++++ b/sound/soc/omap/omap-abe-twl6040.c
+@@ -36,6 +36,8 @@
+ #include "../codecs/twl6040.h"
+
+ struct abe_twl6040 {
++ struct snd_soc_card card;
++ struct snd_soc_dai_link dai_links[2];
+ int jack_detection; /* board can detect jack events */
+ int mclk_freq; /* MCLK frequency speed for twl6040 */
+ };
+@@ -208,40 +210,10 @@ static int omap_abe_dmic_init(struct snd_soc_pcm_runtime *rtd)
+ ARRAY_SIZE(dmic_audio_map));
+ }
+
+-/* Digital audio interface glue - connects codec <--> CPU */
+-static struct snd_soc_dai_link abe_twl6040_dai_links[] = {
+- {
+- .name = "TWL6040",
+- .stream_name = "TWL6040",
+- .codec_dai_name = "twl6040-legacy",
+- .codec_name = "twl6040-codec",
+- .init = omap_abe_twl6040_init,
+- .ops = &omap_abe_ops,
+- },
+- {
+- .name = "DMIC",
+- .stream_name = "DMIC Capture",
+- .codec_dai_name = "dmic-hifi",
+- .codec_name = "dmic-codec",
+- .init = omap_abe_dmic_init,
+- .ops = &omap_abe_dmic_ops,
+- },
+-};
+-
+-/* Audio machine driver */
+-static struct snd_soc_card omap_abe_card = {
+- .owner = THIS_MODULE,
+-
+- .dapm_widgets = twl6040_dapm_widgets,
+- .num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets),
+- .dapm_routes = audio_map,
+- .num_dapm_routes = ARRAY_SIZE(audio_map),
+-};
+-
+ static int omap_abe_probe(struct platform_device *pdev)
+ {
+ struct device_node *node = pdev->dev.of_node;
+- struct snd_soc_card *card = &omap_abe_card;
++ struct snd_soc_card *card;
+ struct device_node *dai_node;
+ struct abe_twl6040 *priv;
+ int num_links = 0;
+@@ -252,12 +224,18 @@ static int omap_abe_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- card->dev = &pdev->dev;
+-
+ priv = devm_kzalloc(&pdev->dev, sizeof(struct abe_twl6040), GFP_KERNEL);
+ if (priv == NULL)
+ return -ENOMEM;
+
++ card = &priv->card;
++ card->dev = &pdev->dev;
++ card->owner = THIS_MODULE;
++ card->dapm_widgets = twl6040_dapm_widgets;
++ card->num_dapm_widgets = ARRAY_SIZE(twl6040_dapm_widgets);
++ card->dapm_routes = audio_map;
++ card->num_dapm_routes = ARRAY_SIZE(audio_map);
++
+ if (snd_soc_of_parse_card_name(card, "ti,model")) {
+ dev_err(&pdev->dev, "Card name is not provided\n");
+ return -ENODEV;
+@@ -274,14 +252,27 @@ static int omap_abe_probe(struct platform_device *pdev)
+ dev_err(&pdev->dev, "McPDM node is not provided\n");
+ return -EINVAL;
+ }
+- abe_twl6040_dai_links[0].cpu_of_node = dai_node;
+- abe_twl6040_dai_links[0].platform_of_node = dai_node;
++
++ priv->dai_links[0].name = "DMIC";
++ priv->dai_links[0].stream_name = "TWL6040";
++ priv->dai_links[0].cpu_of_node = dai_node;
++ priv->dai_links[0].platform_of_node = dai_node;
++ priv->dai_links[0].codec_dai_name = "twl6040-legacy";
++ priv->dai_links[0].codec_name = "twl6040-codec";
++ priv->dai_links[0].init = omap_abe_twl6040_init;
++ priv->dai_links[0].ops = &omap_abe_ops;
+
+ dai_node = of_parse_phandle(node, "ti,dmic", 0);
+ if (dai_node) {
+ num_links = 2;
+- abe_twl6040_dai_links[1].cpu_of_node = dai_node;
+- abe_twl6040_dai_links[1].platform_of_node = dai_node;
++ priv->dai_links[1].name = "TWL6040";
++ priv->dai_links[1].stream_name = "DMIC Capture";
++ priv->dai_links[1].cpu_of_node = dai_node;
++ priv->dai_links[1].platform_of_node = dai_node;
++ priv->dai_links[1].codec_dai_name = "dmic-hifi";
++ priv->dai_links[1].codec_name = "dmic-codec";
++ priv->dai_links[1].init = omap_abe_dmic_init;
++ priv->dai_links[1].ops = &omap_abe_dmic_ops;
+ } else {
+ num_links = 1;
+ }
+@@ -300,7 +291,7 @@ static int omap_abe_probe(struct platform_device *pdev)
+ return -ENODEV;
+ }
+
+- card->dai_link = abe_twl6040_dai_links;
++ card->dai_link = priv->dai_links;
+ card->num_links = num_links;
+
+ snd_soc_card_set_drvdata(card, priv);
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-omap-dmic-Add-pm_qos-handling-to-avoid-overruns.patch b/patches.drivers/ASoC-omap-dmic-Add-pm_qos-handling-to-avoid-overruns.patch
new file mode 100644
index 0000000000..ebcdbd2d28
--- /dev/null
+++ b/patches.drivers/ASoC-omap-dmic-Add-pm_qos-handling-to-avoid-overruns.patch
@@ -0,0 +1,65 @@
+From ffdcc3638c58d55a6fa68b6e5dfd4fb4109652eb Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 14 Nov 2018 13:06:23 +0200
+Subject: [PATCH] ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
+Git-commit: ffdcc3638c58d55a6fa68b6e5dfd4fb4109652eb
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+We need to block sleep states which would require longer time to leave than
+the time the DMA must react to the DMA request in order to keep the FIFO
+serviced without overrun.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/omap/omap-dmic.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/sound/soc/omap/omap-dmic.c b/sound/soc/omap/omap-dmic.c
+index fe966272bd0c..cba9645b6487 100644
+--- a/sound/soc/omap/omap-dmic.c
++++ b/sound/soc/omap/omap-dmic.c
+@@ -48,6 +48,8 @@ struct omap_dmic {
+ struct device *dev;
+ void __iomem *io_base;
+ struct clk *fclk;
++ struct pm_qos_request pm_qos_req;
++ int latency;
+ int fclk_freq;
+ int out_freq;
+ int clk_div;
+@@ -124,6 +126,8 @@ static void omap_dmic_dai_shutdown(struct snd_pcm_substream *substream,
+
+ mutex_lock(&dmic->mutex);
+
++ pm_qos_remove_request(&dmic->pm_qos_req);
++
+ if (!dai->active)
+ dmic->active = 0;
+
+@@ -228,6 +232,8 @@ static int omap_dmic_dai_hw_params(struct snd_pcm_substream *substream,
+ /* packet size is threshold * channels */
+ dma_data = snd_soc_dai_get_dma_data(dai, substream);
+ dma_data->maxburst = dmic->threshold * channels;
++ dmic->latency = (OMAP_DMIC_THRES_MAX - dmic->threshold) * USEC_PER_SEC /
++ params_rate(params);
+
+ return 0;
+ }
+@@ -238,6 +244,9 @@ static int omap_dmic_dai_prepare(struct snd_pcm_substream *substream,
+ struct omap_dmic *dmic = snd_soc_dai_get_drvdata(dai);
+ u32 ctrl;
+
++ if (pm_qos_request_active(&dmic->pm_qos_req))
++ pm_qos_update_request(&dmic->pm_qos_req, dmic->latency);
++
+ /* Configure uplink threshold */
+ omap_dmic_write(dmic, OMAP_DMIC_FIFO_CTRL_REG, dmic->threshold);
+
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-omap-mcbsp-Fix-latency-value-calculation-for-pm.patch b/patches.drivers/ASoC-omap-mcbsp-Fix-latency-value-calculation-for-pm.patch
new file mode 100644
index 0000000000..463fa98f32
--- /dev/null
+++ b/patches.drivers/ASoC-omap-mcbsp-Fix-latency-value-calculation-for-pm.patch
@@ -0,0 +1,40 @@
+From dd2f52d8991af9fe0928d59ec502ba52be7bc38d Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 14 Nov 2018 13:06:21 +0200
+Subject: [PATCH] ASoC: omap-mcbsp: Fix latency value calculation for pm_qos
+Git-commit: dd2f52d8991af9fe0928d59ec502ba52be7bc38d
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+The latency number is in usec for the pm_qos. Correct the calculation to
+give us the time in usec
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/omap/omap-mcbsp.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/omap/omap-mcbsp.c b/sound/soc/omap/omap-mcbsp.c
+index d0ebb6b9bfac..2d6decbfc99e 100644
+--- a/sound/soc/omap/omap-mcbsp.c
++++ b/sound/soc/omap/omap-mcbsp.c
+@@ -308,9 +308,9 @@ static int omap_mcbsp_dai_hw_params(struct snd_pcm_substream *substream,
+ pkt_size = channels;
+ }
+
+- latency = ((((buffer_size - pkt_size) / channels) * 1000)
+- / (params->rate_num / params->rate_den));
+-
++ latency = (buffer_size - pkt_size) / channels;
++ latency = latency * USEC_PER_SEC /
++ (params->rate_num / params->rate_den);
+ mcbsp->latency[substream->stream] = latency;
+
+ omap_mcbsp_set_threshold(substream, pkt_size);
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-omap-mcpdm-Add-pm_qos-handling-to-avoid-under-o.patch b/patches.drivers/ASoC-omap-mcpdm-Add-pm_qos-handling-to-avoid-under-o.patch
new file mode 100644
index 0000000000..cbb3a62114
--- /dev/null
+++ b/patches.drivers/ASoC-omap-mcpdm-Add-pm_qos-handling-to-avoid-under-o.patch
@@ -0,0 +1,128 @@
+From 373a500e34aea97971c9d71e45edad458d3da98f Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Wed, 14 Nov 2018 13:06:22 +0200
+Subject: [PATCH] ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
+Git-commit: 373a500e34aea97971c9d71e45edad458d3da98f
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+We need to block sleep states which would require longer time to leave than
+the time the DMA must react to the DMA request in order to keep the FIFO
+serviced without under of overrun.
+
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Acked-by: Jarkko Nikula <jarkko.nikula@bitmer.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/omap/omap-mcpdm.c | 43 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 42 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
+index 4c1be36c2207..7d5bdc5a2890 100644
+--- a/sound/soc/omap/omap-mcpdm.c
++++ b/sound/soc/omap/omap-mcpdm.c
+@@ -54,6 +54,8 @@ struct omap_mcpdm {
+ unsigned long phys_base;
+ void __iomem *io_base;
+ int irq;
++ struct pm_qos_request pm_qos_req;
++ int latency[2];
+
+ struct mutex mutex;
+
+@@ -277,6 +279,9 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
++ int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
++ int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
++ int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
+
+ mutex_lock(&mcpdm->mutex);
+
+@@ -289,6 +294,14 @@ static void omap_mcpdm_dai_shutdown(struct snd_pcm_substream *substream,
+ }
+ }
+
++ if (mcpdm->latency[stream2])
++ pm_qos_update_request(&mcpdm->pm_qos_req,
++ mcpdm->latency[stream2]);
++ else if (mcpdm->latency[stream1])
++ pm_qos_remove_request(&mcpdm->pm_qos_req);
++
++ mcpdm->latency[stream1] = 0;
++
+ mutex_unlock(&mcpdm->mutex);
+ }
+
+@@ -300,7 +313,7 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
+ int stream = substream->stream;
+ struct snd_dmaengine_dai_dma_data *dma_data;
+ u32 threshold;
+- int channels;
++ int channels, latency;
+ int link_mask = 0;
+
+ channels = params_channels(params);
+@@ -344,14 +357,25 @@ static int omap_mcpdm_dai_hw_params(struct snd_pcm_substream *substream,
+
+ dma_data->maxburst =
+ (MCPDM_DN_THRES_MAX - threshold) * channels;
++ latency = threshold;
+ } else {
+ /* If playback is not running assume a stereo stream to come */
+ if (!mcpdm->config[!stream].link_mask)
+ mcpdm->config[!stream].link_mask = (0x3 << 3);
+
+ dma_data->maxburst = threshold * channels;
++ latency = (MCPDM_DN_THRES_MAX - threshold);
+ }
+
++ /*
++ * The DMA must act to a DMA request within latency time (usec) to avoid
++ * under/overflow
++ */
++ mcpdm->latency[stream] = latency * USEC_PER_SEC / params_rate(params);
++
++ if (!mcpdm->latency[stream])
++ mcpdm->latency[stream] = 10;
++
+ /* Check if we need to restart McPDM with this stream */
+ if (mcpdm->config[stream].link_mask &&
+ mcpdm->config[stream].link_mask != link_mask)
+@@ -366,6 +390,20 @@ static int omap_mcpdm_prepare(struct snd_pcm_substream *substream,
+ struct snd_soc_dai *dai)
+ {
+ struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
++ struct pm_qos_request *pm_qos_req = &mcpdm->pm_qos_req;
++ int tx = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK);
++ int stream1 = tx ? SNDRV_PCM_STREAM_PLAYBACK : SNDRV_PCM_STREAM_CAPTURE;
++ int stream2 = tx ? SNDRV_PCM_STREAM_CAPTURE : SNDRV_PCM_STREAM_PLAYBACK;
++ int latency = mcpdm->latency[stream2];
++
++ /* Prevent omap hardware from hitting off between FIFO fills */
++ if (!latency || mcpdm->latency[stream1] < latency)
++ latency = mcpdm->latency[stream1];
++
++ if (pm_qos_request_active(pm_qos_req))
++ pm_qos_update_request(pm_qos_req, latency);
++ else if (latency)
++ pm_qos_add_request(pm_qos_req, PM_QOS_CPU_DMA_LATENCY, latency);
+
+ if (!omap_mcpdm_active(mcpdm)) {
+ omap_mcpdm_start(mcpdm);
+@@ -427,6 +465,9 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
+ free_irq(mcpdm->irq, (void *)mcpdm);
+ pm_runtime_disable(mcpdm->dev);
+
++ if (pm_qos_request_active(&mcpdm->pm_qos_req))
++ pm_qos_remove_request(&mcpdm->pm_qos_req);
++
+ return 0;
+ }
+
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-rsnd-fixup-clock-start-checker.patch b/patches.drivers/ASoC-rsnd-fixup-clock-start-checker.patch
new file mode 100644
index 0000000000..ffd5affb9f
--- /dev/null
+++ b/patches.drivers/ASoC-rsnd-fixup-clock-start-checker.patch
@@ -0,0 +1,45 @@
+From 3ee9a76a8c5a10e1bfb04b81db767c6d562ddaf3 Mon Sep 17 00:00:00 2001
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Date: Wed, 31 Oct 2018 00:48:12 +0000
+Subject: [PATCH] ASoC: rsnd: fixup clock start checker
+Git-commit: 3ee9a76a8c5a10e1bfb04b81db767c6d562ddaf3
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+commit 4d230d12710646 ("ASoC: rsnd: fixup not to call clk_get/set under
+non-atomic") fixuped clock start timing. But it exchanged clock start
+checker from ssi->usrcnt to ssi->rate.
+
+Current rsnd_ssi_master_clk_start() is called from .prepare,
+but some player (for example GStreamer) might calls it many times.
+In such case, the checker might returns error even though it was not
+error. It should check ssi->usrcnt instead of ssi->rate.
+This patch fixup it. Without this patch, GStreamer can't switch
+48kHz / 44.1kHz.
+
+Reported-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Tested-by: Yusuke Goda <yusuke.goda.sx@renesas.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/sh/rcar/ssi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index fcb4df23248c..6ec78f3096dd 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -306,7 +306,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
+ if (rsnd_ssi_is_multi_slave(mod, io))
+ return 0;
+
+- if (ssi->rate) {
++ if (ssi->usrcnt > 1) {
+ if (ssi->rate != rate) {
+ dev_err(dev, "SSI parent/child should use same rate\n");
+ return -EINVAL;
+--
+2.19.2
+
diff --git a/patches.drivers/ASoC-wm_adsp-Fix-dma-unsafe-read-of-scratch-register.patch b/patches.drivers/ASoC-wm_adsp-Fix-dma-unsafe-read-of-scratch-register.patch
new file mode 100644
index 0000000000..34b0079d9c
--- /dev/null
+++ b/patches.drivers/ASoC-wm_adsp-Fix-dma-unsafe-read-of-scratch-register.patch
@@ -0,0 +1,90 @@
+From 20e00db2f59bdddf8a8e241473ef8be94631d3ae Mon Sep 17 00:00:00 2001
+From: Richard Fitzgerald <rf@opensource.cirrus.com>
+Date: Mon, 12 Nov 2018 13:36:38 +0000
+Subject: [PATCH] ASoC: wm_adsp: Fix dma-unsafe read of scratch registers
+Git-commit: 20e00db2f59bdddf8a8e241473ef8be94631d3ae
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+Stack memory isn't DMA-safe so it isn't safe to use either
+regmap_raw_read or regmap_bulk_read to read into stack memory.
+
+The two functions to read the scratch registers were using
+stack memory and regmap_raw_read. It's not worth allocating
+memory just for this trivial read, and it isn't time-critical.
+A simple regmap_read for each register is sufficient.
+
+Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/wm_adsp.c | 37 ++++++++++++++++++++-----------------
+ 1 file changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index a53dc174bbf0..66501b8dc46f 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -765,38 +765,41 @@ static unsigned int wm_adsp_region_to_reg(struct wm_adsp_region const *mem,
+
+ static void wm_adsp2_show_fw_status(struct wm_adsp *dsp)
+ {
+- u16 scratch[4];
++ unsigned int scratch[4];
++ unsigned int addr = dsp->base + ADSP2_SCRATCH0;
++ unsigned int i;
+ int ret;
+
+- ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2_SCRATCH0,
+- scratch, sizeof(scratch));
+- if (ret) {
+- adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
+- return;
++ for (i = 0; i < ARRAY_SIZE(scratch); ++i) {
++ ret = regmap_read(dsp->regmap, addr + i, &scratch[i]);
++ if (ret) {
++ adsp_err(dsp, "Failed to read SCRATCH%u: %d\n", i, ret);
++ return;
++ }
+ }
+
+ adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
+- be16_to_cpu(scratch[0]),
+- be16_to_cpu(scratch[1]),
+- be16_to_cpu(scratch[2]),
+- be16_to_cpu(scratch[3]));
++ scratch[0], scratch[1], scratch[2], scratch[3]);
+ }
+
+ static void wm_adsp2v2_show_fw_status(struct wm_adsp *dsp)
+ {
+- u32 scratch[2];
++ unsigned int scratch[2];
+ int ret;
+
+- ret = regmap_raw_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
+- scratch, sizeof(scratch));
+-
++ ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH0_1,
++ &scratch[0]);
+ if (ret) {
+- adsp_err(dsp, "Failed to read SCRATCH regs: %d\n", ret);
++ adsp_err(dsp, "Failed to read SCRATCH0_1: %d\n", ret);
+ return;
+ }
+
+- scratch[0] = be32_to_cpu(scratch[0]);
+- scratch[1] = be32_to_cpu(scratch[1]);
++ ret = regmap_read(dsp->regmap, dsp->base + ADSP2V2_SCRATCH2_3,
++ &scratch[1]);
++ if (ret) {
++ adsp_err(dsp, "Failed to read SCRATCH2_3: %d\n", ret);
++ return;
++ }
+
+ adsp_dbg(dsp, "FW SCRATCH 0:0x%x 1:0x%x 2:0x%x 3:0x%x\n",
+ scratch[0] & 0xFFFF,
+--
+2.19.2
+
diff --git a/patches.drivers/Input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch b/patches.drivers/Input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
new file mode 100644
index 0000000000..683b8e1070
--- /dev/null
+++ b/patches.drivers/Input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch
@@ -0,0 +1,35 @@
+From 4d8f727b83bcd6702c2d210330872c9122d2d360 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 21 Dec 2018 00:38:30 -0800
+Subject: [PATCH] Input: nomadik-ske-keypad - fix a loop timeout test
+Git-commit: 4d8f727b83bcd6702c2d210330872c9122d2d360
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The loop exits with "timeout" set to -1 not to 0.
+
+Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/keyboard/nomadik-ske-keypad.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c
+index 8567ee47761e..ae3b04557074 100644
+--- a/drivers/input/keyboard/nomadik-ske-keypad.c
++++ b/drivers/input/keyboard/nomadik-ske-keypad.c
+@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad)
+ while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--)
+ cpu_relax();
+
+- if (!timeout)
++ if (timeout == -1)
+ return -EINVAL;
+
+ /*
+--
+2.19.2
+
diff --git a/patches.drivers/Input-omap-keypad-fix-keyboard-debounce-configuratio.patch b/patches.drivers/Input-omap-keypad-fix-keyboard-debounce-configuratio.patch
new file mode 100644
index 0000000000..56076734f2
--- /dev/null
+++ b/patches.drivers/Input-omap-keypad-fix-keyboard-debounce-configuratio.patch
@@ -0,0 +1,69 @@
+From 6c3516fed7b61a3527459ccfa67fab130d910610 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 3 Dec 2018 11:24:30 -0800
+Subject: [PATCH] Input: omap-keypad - fix keyboard debounce configuration
+Git-commit: 6c3516fed7b61a3527459ccfa67fab130d910610
+Patch-mainline: v4.20-rc6
+References: bsc#1051510
+
+I noticed that the Android v3.0.8 kernel on droid4 is using different
+keypad values from the mainline kernel and does not have issues with
+keys occasionally being stuck until pressed again. Turns out there was
+an earlier patch posted to fix this as "Input: omap-keypad: errata i689:
+Correct debounce time", but it was never reposted to fix use macros
+for timing calculations.
+
+This updated version is using macros, and also fixes the use of the
+input clock rate to use 32768KiHz instead of 32000KiHz. And we want to
+use the known good Android kernel values of 3 and 6 instead of 2 and 6
+in the earlier patch.
+
+Reported-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/keyboard/omap4-keypad.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
+index 940d38b08e6b..ce8e2baf31bb 100644
+--- a/drivers/input/keyboard/omap4-keypad.c
++++ b/drivers/input/keyboard/omap4-keypad.c
+@@ -60,8 +60,18 @@
+
+ /* OMAP4 values */
+ #define OMAP4_VAL_IRQDISABLE 0x0
+-#define OMAP4_VAL_DEBOUNCINGTIME 0x7
+-#define OMAP4_VAL_PVT 0x7
++
++/*
++ * Errata i689: If a key is released for a time shorter than debounce time,
++ * the keyboard will idle and never detect the key release. The workaround
++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
++ * "26.4.6.2 Keyboard Controller Timer" for more information.
++ */
++#define OMAP4_KEYPAD_PTV_DIV_128 0x6
++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \
++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \
++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
+
+ enum {
+ KBD_REVISION_OMAP4 = 0,
+@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
+
+ kbd_writel(keypad_data, OMAP4_KBD_CTRL,
+ OMAP4_DEF_CTRL_NOSOFTMODE |
+- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
+ kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
+- OMAP4_VAL_DEBOUNCINGTIME);
++ OMAP4_VAL_DEBOUNCINGTIME_16MS);
+ /* clear pending interrupts */
+ kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
+ kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
+--
+2.19.2
+
diff --git a/patches.drivers/Input-synaptics-enable-SMBus-for-HP-15-ay000.patch b/patches.drivers/Input-synaptics-enable-SMBus-for-HP-15-ay000.patch
new file mode 100644
index 0000000000..b842427096
--- /dev/null
+++ b/patches.drivers/Input-synaptics-enable-SMBus-for-HP-15-ay000.patch
@@ -0,0 +1,42 @@
+From 5a6dab15f7a79817cab4af612ddd99eda793fce6 Mon Sep 17 00:00:00 2001
+From: Teika Kazura <teika@gmx.com>
+Date: Mon, 3 Dec 2018 11:26:03 -0800
+Subject: [PATCH] Input: synaptics - enable SMBus for HP 15-ay000
+Git-commit: 5a6dab15f7a79817cab4af612ddd99eda793fce6
+Patch-mainline: v4.20-rc6
+References: bsc#1051510
+
+SMBus works fine for the touchpad with id SYN3221, used in the HP 15-ay000
+series,
+
+This device has been reported in these messages in the "linux-input"
+mailing list:
+* https://marc.info/?l=linux-input&m=152016683003369&w=2
+* https://www.spinics.net/lists/linux-input/msg52525.html
+
+Reported-by: Nitesh Debnath <niteshkd1999@gmail.com>
+Reported-by: Teika Kazura <teika@gmx.com>
+Signed-off-by: Teika Kazura <teika@gmx.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/mouse/synaptics.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index c42813d50591..2bd5bb11c8ba 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -178,6 +178,7 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "SYN3221", /* HP 15-ay000 */
+ NULL
+ };
+
+--
+2.19.2
+
diff --git a/patches.drivers/PCI-Add-ACS-quirk-for-APM-X-Gene-devices.patch b/patches.drivers/PCI-Add-ACS-quirk-for-APM-X-Gene-devices.patch
new file mode 100644
index 0000000000..829cc833b2
--- /dev/null
+++ b/patches.drivers/PCI-Add-ACS-quirk-for-APM-X-Gene-devices.patch
@@ -0,0 +1,59 @@
+From a0418aa262dfbe4011df85c8d40993bf21d53cd2 Mon Sep 17 00:00:00 2001
+From: Feng Kan <fkan@apm.com>
+Date: Thu, 10 Aug 2017 16:06:33 -0500
+Subject: [PATCH] PCI: Add ACS quirk for APM X-Gene devices
+Git-commit: a0418aa262dfbe4011df85c8d40993bf21d53cd2
+Patch-mainline: v4.14-rc1
+References: bsc#1120058
+
+The APM X-Gene PCIe root port does not support ACS at this point. However,
+the hardware provides isolation and source validation through the SMMU.
+The stream ID generated by the PCIe ports contain both the bus/device/
+function number as well as the port ID in its 3 most significant bits.
+Turn on ACS but disable all the peer-to-peer features.
+
+Signed-off-by: Feng Kan <fkan@apm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Tanmay Inamdar <tinamdar@apm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 15ee4e9af633..92bea8accc35 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4137,6 +4137,18 @@ static int pci_quirk_cavium_acs(struct pci_dev *dev, u16 acs_flags)
+ return acs_flags ? 0 : 1;
+ }
+
++static int pci_quirk_xgene_acs(struct pci_dev *dev, u16 acs_flags)
++{
++ /*
++ * X-Gene root matching this quirk do not allow peer-to-peer
++ * transactions with others, allowing masking out these bits as if they
++ * were unimplemented in the ACS capability.
++ */
++ acs_flags &= ~(PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
++
++ return acs_flags ? 0 : 1;
++}
++
+ /*
+ * Many Intel PCH root ports do provide ACS-like features to disable peer
+ * transactions and validate bus numbers in requests, but do not provide an
+@@ -4385,6 +4397,8 @@ static const struct pci_dev_acs_enabled {
+ { 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */
+ /* Cavium ThunderX */
+ { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
++ /* APM X-Gene */
++ { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
+ { 0 }
+ };
+
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-Add-ACS-quirk-for-Ampere-root-ports.patch b/patches.drivers/PCI-Add-ACS-quirk-for-Ampere-root-ports.patch
new file mode 100644
index 0000000000..6035cc7ba9
--- /dev/null
+++ b/patches.drivers/PCI-Add-ACS-quirk-for-Ampere-root-ports.patch
@@ -0,0 +1,61 @@
+From 4ef76ad0462cf25ce948541c8724eaa8a8365e1d Mon Sep 17 00:00:00 2001
+From: Feng Kan <fkan@apm.com>
+Date: Tue, 20 Feb 2018 19:19:27 -0800
+Subject: [PATCH] PCI: Add ACS quirk for Ampere root ports
+Git-commit: 4ef76ad0462cf25ce948541c8724eaa8a8365e1d
+Patch-mainline: v4.17-rc1
+References: bsc#1120058
+
+The Ampere Computing PCIe root port does not support ACS at this point.
+However, the hardware provides isolation and source validation through the
+SMMU. The stream ID generated by the PCIe ports contain both the
+bus/device/function number as well as the port ID in its 3 most significant
+bits. Turn on ACS but disable all the peer-to-peer features.
+
+APM is being rebranded to Ampere. The Vendor and Device IDs change, but
+the functionality stays the same.
+
+Signed-off-by: Feng Kan <fkan@apm.com>
+Signed-off-by: Bjorn Helgaas <helgaas@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 9 +++++++++
+ include/linux/pci_ids.h | 1 +
+ 2 files changed, 10 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index fc734014206f..57748a3b83f0 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4514,6 +4514,15 @@ static const struct pci_dev_acs_enabled {
+ { PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
+ /* APM X-Gene */
+ { PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
++ /* Ampere Computing */
++ { PCI_VENDOR_ID_AMPERE, 0xE005, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE006, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE007, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE008, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE009, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE00A, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE00B, pci_quirk_xgene_acs },
++ { PCI_VENDOR_ID_AMPERE, 0xE00C, pci_quirk_xgene_acs },
+ { 0 }
+ };
+
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index a6b30667a331..c875d4223f44 100644
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -1333,6 +1333,7 @@
+ #define PCI_DEVICE_ID_IMS_TT3D 0x9135
+
+ #define PCI_VENDOR_ID_AMCC 0x10e8
++#define PCI_VENDOR_ID_AMPERE 0x1def
+
+ #define PCI_VENDOR_ID_INTERG 0x10ea
+ #define PCI_DEVICE_ID_INTERG_1682 0x1682
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-Convert-device-specific-ACS-quirks-from-NULL-ter.patch b/patches.drivers/PCI-Convert-device-specific-ACS-quirks-from-NULL-ter.patch
new file mode 100644
index 0000000000..17928e5c0e
--- /dev/null
+++ b/patches.drivers/PCI-Convert-device-specific-ACS-quirks-from-NULL-ter.patch
@@ -0,0 +1,59 @@
+From 3b269185c19268027ac79388b03c9d7322518e4c Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Thu, 9 Aug 2018 16:45:47 -0500
+Subject: [PATCH] PCI: Convert device-specific ACS quirks from NULL termination to ARRAY_SIZE
+Git-commit: 3b269185c19268027ac79388b03c9d7322518e4c
+Patch-mainline: v4.19-rc1
+References: bsc#1120058
+
+Convert the search for device-specific ACS enable quirks from searching a
+NULL-terminated array to iterating through the array, which is always
+fixed-size anyway. No functional change intended.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+[bhelgaas: changelog, split to separate patch for reviewability]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f439de848658..823d8e4b4b37 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4560,20 +4560,20 @@ static const struct pci_dev_enable_acs {
+ } pci_dev_enable_acs[] = {
+ { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, pci_quirk_enable_intel_pch_acs },
+ { PCI_VENDOR_ID_INTEL, PCI_ANY_ID, pci_quirk_enable_intel_spt_pch_acs },
+- { 0 }
+ };
+
+ int pci_dev_specific_enable_acs(struct pci_dev *dev)
+ {
+- const struct pci_dev_enable_acs *i;
+- int ret;
++ const struct pci_dev_enable_acs *p;
++ int i, ret;
+
+- for (i = pci_dev_enable_acs; i->enable_acs; i++) {
+- if ((i->vendor == dev->vendor ||
+- i->vendor == (u16)PCI_ANY_ID) &&
+- (i->device == dev->device ||
+- i->device == (u16)PCI_ANY_ID)) {
+- ret = i->enable_acs(dev);
++ for (i = 0; i < ARRAY_SIZE(pci_dev_enable_acs); i++) {
++ p = &pci_dev_enable_acs[i];
++ if ((p->vendor == dev->vendor ||
++ p->vendor == (u16)PCI_ANY_ID) &&
++ (p->device == dev->device ||
++ p->device == (u16)PCI_ANY_ID)) {
++ ret = p->enable_acs(dev);
+ if (ret >= 0)
+ return ret;
+ }
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-Delay-after-FLR-of-Intel-DC-P3700-NVMe.patch b/patches.drivers/PCI-Delay-after-FLR-of-Intel-DC-P3700-NVMe.patch
new file mode 100644
index 0000000000..37a3c9b43d
--- /dev/null
+++ b/patches.drivers/PCI-Delay-after-FLR-of-Intel-DC-P3700-NVMe.patch
@@ -0,0 +1,67 @@
+From 51ba09452d11b17248d80c740c2fd14c9fdc2c99 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Thu, 9 Aug 2018 14:04:31 -0600
+Subject: [PATCH] PCI: Delay after FLR of Intel DC P3700 NVMe
+Git-commit: 51ba09452d11b17248d80c740c2fd14c9fdc2c99
+Patch-mainline: v4.19-rc1
+References: bsc#1120058
+
+Add a device-specific reset for Intel DC P3700 NVMe device which exhibits a
+timeout failure in drivers waiting for the ready status to update after
+NVMe enable if the driver interacts with the device too soon after FLR. As
+this has been observed in device assignment scenarios, resolve this with a
+device-specific reset quirk to add an additional, heuristically determined,
+delay after the FLR completes.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1592654
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index e249676fbf04..deb051583eda 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3746,6 +3746,27 @@ static int nvme_disable_and_flr(struct pci_dev *dev, int probe)
+ return 0;
+ }
+
++/*
++ * Intel DC P3700 NVMe controller will timeout waiting for ready status
++ * to change after NVMe enable if the driver starts interacting with the
++ * device too soon after FLR. A 250ms delay after FLR has heuristically
++ * proven to produce reliably working results for device assignment cases.
++ */
++static int delay_250ms_after_flr(struct pci_dev *dev, int probe)
++{
++ if (!pcie_has_flr(dev))
++ return -ENOTTY;
++
++ if (probe)
++ return 0;
++
++ pcie_flr(dev);
++
++ msleep(250);
++
++ return 0;
++}
++
+ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82599_SFP_VF,
+ reset_intel_82599_sfp_virtfn },
+@@ -3754,6 +3775,7 @@ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IVB_M2_VGA,
+ reset_ivb_igd },
+ { PCI_VENDOR_ID_SAMSUNG, 0xa804, nvme_disable_and_flr },
++ { PCI_VENDOR_ID_INTEL, 0x0953, delay_250ms_after_flr },
+ { PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+ reset_chelsio_generic_dev },
+ { 0 }
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-Disable-Samsung-SM961-PM961-NVMe-before-FLR.patch b/patches.drivers/PCI-Disable-Samsung-SM961-PM961-NVMe-before-FLR.patch
new file mode 100644
index 0000000000..2acee583d2
--- /dev/null
+++ b/patches.drivers/PCI-Disable-Samsung-SM961-PM961-NVMe-before-FLR.patch
@@ -0,0 +1,129 @@
+From ffb0863426eb91a14101376051cfafa5527e665d Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Thu, 9 Aug 2018 15:18:33 -0500
+Subject: [PATCH] PCI: Disable Samsung SM961/PM961 NVMe before FLR
+Git-commit: ffb0863426eb91a14101376051cfafa5527e665d
+Patch-mainline: v4.19-rc1
+References: bsc#1120058
+
+The Samsung SM961/PM961 (960 EVO) sometimes fails to return from FLR with
+the PCI config space reading back as -1. A reproducible instance of this
+behavior is resolved by clearing the enable bit in the NVMe configuration
+register and waiting for the ready status to clear (disabling the NVMe
+controller) prior to FLR.
+
+Link: https://bugzilla.redhat.com/show_bug.cgi?id=1542494
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 83 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -25,6 +25,7 @@
+ #include <linux/sched.h>
+ #include <linux/ktime.h>
+ #include <linux/mm.h>
++#include <linux/nvme.h>
+ #include <asm/dma.h> /* isa_dma_bridge_buggy */
+ #include "pci.h"
+
+@@ -3832,6 +3833,87 @@ static int reset_chelsio_generic_dev(str
+ #define PCI_DEVICE_ID_INTEL_IVB_M_VGA 0x0156
+ #define PCI_DEVICE_ID_INTEL_IVB_M2_VGA 0x0166
+
++/*
++ * The Samsung SM961/PM961 controller can sometimes enter a fatal state after
++ * FLR where config space reads from the device return -1. We seem to be
++ * able to avoid this condition if we disable the NVMe controller prior to
++ * FLR. This quirk is generic for any NVMe class device requiring similar
++ * assistance to quiesce the device prior to FLR.
++ *
++ * NVMe specification: https://nvmexpress.org/resources/specifications/
++ * Revision 1.0e:
++ * Chapter 2: Required and optional PCI config registers
++ * Chapter 3: NVMe control registers
++ * Chapter 7.3: Reset behavior
++ */
++static int nvme_disable_and_flr(struct pci_dev *dev, int probe)
++{
++ void __iomem *bar;
++ u16 cmd;
++ u32 cfg;
++
++ if (dev->class != PCI_CLASS_STORAGE_EXPRESS ||
++ !pcie_has_flr(dev) || !pci_resource_start(dev, 0))
++ return -ENOTTY;
++
++ if (probe)
++ return 0;
++
++ bar = pci_iomap(dev, 0, NVME_REG_CC + sizeof(cfg));
++ if (!bar)
++ return -ENOTTY;
++
++ pci_read_config_word(dev, PCI_COMMAND, &cmd);
++ pci_write_config_word(dev, PCI_COMMAND, cmd | PCI_COMMAND_MEMORY);
++
++ cfg = readl(bar + NVME_REG_CC);
++
++ /* Disable controller if enabled */
++ if (cfg & NVME_CC_ENABLE) {
++ u32 cap = readl(bar + NVME_REG_CAP);
++ unsigned long timeout;
++
++ /*
++ * Per nvme_disable_ctrl() skip shutdown notification as it
++ * could complete commands to the admin queue. We only intend
++ * to quiesce the device before reset.
++ */
++ cfg &= ~(NVME_CC_SHN_MASK | NVME_CC_ENABLE);
++
++ writel(cfg, bar + NVME_REG_CC);
++
++ /*
++ * Some controllers require an additional delay here, see
++ * NVME_QUIRK_DELAY_BEFORE_CHK_RDY. None of those are yet
++ * supported by this quirk.
++ */
++
++ /* Cap register provides max timeout in 500ms increments */
++ timeout = ((NVME_CAP_TIMEOUT(cap) + 1) * HZ / 2) + jiffies;
++
++ for (;;) {
++ u32 status = readl(bar + NVME_REG_CSTS);
++
++ /* Ready status becomes zero on disable complete */
++ if (!(status & NVME_CSTS_RDY))
++ break;
++
++ msleep(100);
++
++ if (time_after(jiffies, timeout)) {
++ dev_warn(&dev->dev, "Timeout waiting for NVMe ready status to clear after disable\n");
++ break;
++ }
++ }
++ }
++
++ pci_iounmap(dev, bar);
++
++ pcie_flr(dev);
++
++ return 0;
++}
++
+ static const struct pci_dev_reset_methods pci_dev_reset_methods[] = {
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82599_SFP_VF,
+ reset_intel_82599_sfp_virtfn },
+@@ -3839,6 +3921,7 @@ static const struct pci_dev_reset_method
+ reset_ivb_igd },
+ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IVB_M2_VGA,
+ reset_ivb_igd },
++ { PCI_VENDOR_ID_SAMSUNG, 0xa804, nvme_disable_and_flr },
+ { PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID,
+ reset_chelsio_generic_dev },
+ { 0 }
diff --git a/patches.drivers/PCI-Export-pcie_has_flr.patch b/patches.drivers/PCI-Export-pcie_has_flr.patch
new file mode 100644
index 0000000000..92031d6b49
--- /dev/null
+++ b/patches.drivers/PCI-Export-pcie_has_flr.patch
@@ -0,0 +1,50 @@
+From 2d2917f7747805a1f4188672f308d82a8ba01700 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Thu, 9 Aug 2018 14:04:14 -0600
+Subject: [PATCH] PCI: Export pcie_has_flr()
+Git-commit: 2d2917f7747805a1f4188672f308d82a8ba01700
+Patch-mainline: v4.19-rc1
+References: bsc#1120058
+
+pcie_flr() suggests pcie_has_flr() to ensure that PCIe FLR support is
+present prior to calling. pcie_flr() is exported while pcie_has_flr()
+is not. Resolve this.
+
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pci.c | 3 ++-
+ include/linux/pci.h | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -4050,7 +4050,7 @@ static void pci_flr_wait(struct pci_dev
+ * Returns true if the device advertises support for PCIe function level
+ * resets.
+ */
+-static bool pcie_has_flr(struct pci_dev *dev)
++bool pcie_has_flr(struct pci_dev *dev)
+ {
+ u32 cap;
+
+@@ -4060,6 +4060,7 @@ static bool pcie_has_flr(struct pci_dev
+ pcie_capability_read_dword(dev, PCI_EXP_DEVCAP, &cap);
+ return cap & PCI_EXP_DEVCAP_FLR;
+ }
++EXPORT_SYMBOL_GPL(pcie_has_flr);
+
+ /**
+ * pcie_flr - initiate a PCIe function level reset
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -1062,6 +1062,7 @@ int pcie_get_mps(struct pci_dev *dev);
+ int pcie_set_mps(struct pci_dev *dev, int mps);
+ int pcie_get_minimum_link(struct pci_dev *dev, enum pci_bus_speed *speed,
+ enum pcie_link_width *width);
++bool pcie_has_flr(struct pci_dev *dev);
+ void pcie_flr(struct pci_dev *dev);
+ int __pci_reset_function(struct pci_dev *dev);
+ int __pci_reset_function_locked(struct pci_dev *dev);
diff --git a/patches.drivers/PCI-Mark-Ceton-InfiniTV4-INTx-masking-as-broken.patch b/patches.drivers/PCI-Mark-Ceton-InfiniTV4-INTx-masking-as-broken.patch
new file mode 100644
index 0000000000..3fb2cb1f52
--- /dev/null
+++ b/patches.drivers/PCI-Mark-Ceton-InfiniTV4-INTx-masking-as-broken.patch
@@ -0,0 +1,40 @@
+From 7c1efb686817881d7dc0b06572785ec8f17d2823 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Fri, 15 Dec 2017 14:51:44 -0600
+Subject: [PATCH] PCI: Mark Ceton InfiniTV4 INTx masking as broken
+Git-commit: 7c1efb686817881d7dc0b06572785ec8f17d2823
+Patch-mainline: v4.16-rc1
+References: bsc#1120058
+
+PCI_COMMAND_INTX_DISABLE is writable on the Ceton InfiniTV4, indicating
+that the device supports disabling the INTx# signal, but it apparently
+doesn't work.
+
+Mark the device so we know we can't use PCI_COMMAND_INTX_DISABLE to disable
+its interrupts.
+
+Link: https://lkml.kernel.org/r/92a65068-60b2-c1a8-9e17-ac41fe3c5c93@code.jackst.com
+Reported-by: John Strader <strader.john@code.jackst.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 10684b17d0bd..bb9737ec64b5 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3215,6 +3215,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x0030,
+ quirk_broken_intx_masking);
+ DECLARE_PCI_FIXUP_FINAL(0x1814, 0x0601, /* Ralink RT2800 802.11n PCI */
+ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(0x1b7c, 0x0004, /* Ceton InfiniTV4 */
++ quirk_broken_intx_masking);
+
+ /*
+ * Realtek RTL8169 PCI Gigabit Ethernet Controller (rev 10)
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-Mark-Intel-XXV710-NIC-INTx-masking-as-broken.patch b/patches.drivers/PCI-Mark-Intel-XXV710-NIC-INTx-masking-as-broken.patch
new file mode 100644
index 0000000000..c3e86c6820
--- /dev/null
+++ b/patches.drivers/PCI-Mark-Intel-XXV710-NIC-INTx-masking-as-broken.patch
@@ -0,0 +1,41 @@
+From d40b7fd2cbcbeeff36e52aef2aa44e03a2ab7345 Mon Sep 17 00:00:00 2001
+From: Alex Williamson <alex.williamson@redhat.com>
+Date: Wed, 7 Jun 2017 13:00:48 -0600
+Subject: [PATCH] PCI: Mark Intel XXV710 NIC INTx masking as broken
+Git-commit: d40b7fd2cbcbeeff36e52aef2aa44e03a2ab7345
+Patch-mainline: v4.13-rc1
+References: bsc#1120058
+
+Just like the other XL710 and X710 variants, the XXV710 device IDs appear
+to have the same hardware bug, the status register doesn't report pending
+interrupts resulting in "irq xx: nobody cared..." errors from the spurious
+interrupt handler when we try to use it with device assignment.
+
+Reported-by: Stefan Assmann <sassmann@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 085fb787aa9e..fb8214938c0d 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3236,6 +3236,10 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1588,
+ quirk_broken_intx_masking);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1589,
+ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x158a,
++ quirk_broken_intx_masking);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x158b,
++ quirk_broken_intx_masking);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d0,
+ quirk_broken_intx_masking);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x37d1,
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-Mark-fall-through-switch-cases-before-enabling-W.patch b/patches.drivers/PCI-Mark-fall-through-switch-cases-before-enabling-W.patch
new file mode 100644
index 0000000000..6ebdd97a44
--- /dev/null
+++ b/patches.drivers/PCI-Mark-fall-through-switch-cases-before-enabling-W.patch
@@ -0,0 +1,91 @@
+From d6488ac19aabcc6c85a74b69eaf1b7301124c323 Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Thu, 5 Jul 2018 09:56:00 -0500
+Subject: [PATCH] PCI: Mark fall-through switch cases before enabling -Wimplicit-fallthrough
+Git-commit: d6488ac19aabcc6c85a74b69eaf1b7301124c323
+Patch-mainline: v4.19-rc1
+References: bsc#1120058
+
+In preparation to enabling -Wimplicit-fallthrough, mark switch cases where
+we are expecting to fall through.
+
+Warning level 2 was used: -Wimplicit-fallthrough=2
+
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/hotplug/pciehp_ctrl.c | 2 ++
+ drivers/pci/hotplug/shpchp_ctrl.c | 2 ++
+ drivers/pci/pci.c | 1 +
+ drivers/pci/quirks.c | 1 +
+ 4 files changed, 6 insertions(+)
+
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index c684faa43387..cfc46e82ceca 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -436,6 +436,7 @@ int pciehp_sysfs_enable_slot(struct slot *p_slot)
+ switch (p_slot->state) {
+ case BLINKINGON_STATE:
+ cancel_delayed_work(&p_slot->work);
++ /* fall through */
+ case STATIC_STATE:
+ p_slot->state = POWERON_STATE;
+ mutex_unlock(&p_slot->lock);
+@@ -473,6 +474,7 @@ int pciehp_sysfs_disable_slot(struct slot *p_slot)
+ switch (p_slot->state) {
+ case BLINKINGOFF_STATE:
+ cancel_delayed_work(&p_slot->work);
++ /* fall through */
+ case STATIC_STATE:
+ p_slot->state = POWEROFF_STATE;
+ mutex_unlock(&p_slot->lock);
+diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
+index 1047b56e5730..1267dcc5a531 100644
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -654,6 +654,7 @@ int shpchp_sysfs_enable_slot(struct slot *p_slot)
+ switch (p_slot->state) {
+ case BLINKINGON_STATE:
+ cancel_delayed_work(&p_slot->work);
++ /* fall through */
+ case STATIC_STATE:
+ p_slot->state = POWERON_STATE;
+ mutex_unlock(&p_slot->lock);
+@@ -689,6 +690,7 @@ int shpchp_sysfs_disable_slot(struct slot *p_slot)
+ switch (p_slot->state) {
+ case BLINKINGOFF_STATE:
+ cancel_delayed_work(&p_slot->work);
++ /* fall through */
+ case STATIC_STATE:
+ p_slot->state = POWEROFF_STATE;
+ mutex_unlock(&p_slot->lock);
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 97acba712e4e..f5c6ab14fb31 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -2045,6 +2045,7 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)
+ case PCI_D2:
+ if (pci_no_d1d2(dev))
+ break;
++ /* else: fall through */
+ default:
+ target_state = state;
+ }
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index f439de848658..502275c092ae 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2105,6 +2105,7 @@ static void quirk_netmos(struct pci_dev *dev)
+ if (dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
+ dev->subsystem_device == 0x0299)
+ return;
++ /* else: fall through */
+ case PCI_DEVICE_ID_NETMOS_9735:
+ case PCI_DEVICE_ID_NETMOS_9745:
+ case PCI_DEVICE_ID_NETMOS_9845:
+--
+2.20.1
+
diff --git a/patches.drivers/PCI-iproc-Activate-PAXC-bridge-quirk-for-more-device.patch b/patches.drivers/PCI-iproc-Activate-PAXC-bridge-quirk-for-more-device.patch
new file mode 100644
index 0000000000..cca837ed4d
--- /dev/null
+++ b/patches.drivers/PCI-iproc-Activate-PAXC-bridge-quirk-for-more-device.patch
@@ -0,0 +1,34 @@
+From b95e2cd021938d2c3455fd2fce69b4845de0b85f Mon Sep 17 00:00:00 2001
+From: Ray Jui <ray.jui@broadcom.com>
+Date: Mon, 11 Jun 2018 17:21:03 -0700
+Subject: [PATCH] PCI: iproc: Activate PAXC bridge quirk for more devices
+Git-commit: b95e2cd021938d2c3455fd2fce69b4845de0b85f
+Patch-mainline: v4.19-rc1
+References: bsc#1120058
+
+Activate PAXC bridge quirk for more PAXC based PCIe root complex with
+the following PCIe device ID:
+0xd750, 0xd802, 0xd804
+
+Signed-off-by: Ray Jui <ray.jui@broadcom.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Oza Pawandeep <poza@codeaurora.org>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2298,6 +2298,9 @@ static void quirk_paxc_bridge(struct pci
+ }
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16cd, quirk_paxc_bridge);
+ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0x16f0, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd750, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd802, quirk_paxc_bridge);
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_BROADCOM, 0xd804, quirk_paxc_bridge);
+ #endif
+
+ /* Originally in EDAC sources for i82875P:
diff --git a/patches.drivers/Revert-scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch b/patches.drivers/Revert-scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch
index 9e8ea70b4e..da62927ba3 100644
--- a/patches.drivers/Revert-scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch
+++ b/patches.drivers/Revert-scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch
@@ -2,8 +2,7 @@ From: "Martin K. Petersen" <martin.petersen@oracle.com>
Date: Wed, 12 Dec 2018 20:26:56 -0500
Subject: [PATCH] Revert "scsi: lpfc: ls_rjt erroneus FLOGIs"
Git-commit: 2d1036aea463e34d03b402e6a918ec89a742b2bb
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.0-rc1
References: bsc#1119322
This reverts commit 287aba2592870fa5b76134b28173b77f1f7a4492.
diff --git a/patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch b/patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch
new file mode 100644
index 0000000000..99d4a03696
--- /dev/null
+++ b/patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch
@@ -0,0 +1,71 @@
+From 5146f95df782b0ac61abde36567e718692725c89 Mon Sep 17 00:00:00 2001
+From: Hui Peng <benquike@gmail.com>
+Date: Wed, 12 Dec 2018 12:42:24 +0100
+Subject: [PATCH] USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
+Git-commit: 5146f95df782b0ac61abde36567e718692725c89
+Patch-mainline: v4.20
+References: bsc#1051510, CVE-2018-19985, bsc#1120743
+
+The function hso_probe reads if_num from the USB device (as an u8) and uses
+it without a length check to index an array, resulting in an OOB memory read
+in hso_probe or hso_get_config_data.
+
+Add a length check for both locations and updated hso_probe to bail on
+error.
+
+This issue has been assigned CVE-2018-19985.
+
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/usb/hso.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 184c24baca15..d6916f787fce 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2807,6 +2807,12 @@ static int hso_get_config_data(struct usb_interface *interface)
+ return -EIO;
+ }
+
++ /* check if we have a valid interface */
++ if (if_num > 16) {
++ kfree(config_data);
++ return -EINVAL;
++ }
++
+ switch (config_data[if_num]) {
+ case 0x0:
+ result = 0;
+@@ -2877,10 +2883,18 @@ static int hso_probe(struct usb_interface *interface,
+
+ /* Get the interface/port specification from either driver_info or from
+ * the device itself */
+- if (id->driver_info)
++ if (id->driver_info) {
++ /* if_num is controlled by the device, driver_info is a 0 terminated
++ * array. Make sure, the access is in bounds! */
++ for (i = 0; i <= if_num; ++i)
++ if (((u32 *)(id->driver_info))[i] == 0)
++ goto exit;
+ port_spec = ((u32 *)(id->driver_info))[if_num];
+- else
++ } else {
+ port_spec = hso_get_config_data(interface);
++ if (port_spec < 0)
++ goto exit;
++ }
+
+ /* Check if we need to switch to alt interfaces prior to port
+ * configuration */
+--
+2.19.2
+
diff --git a/patches.drivers/USB-omap_udc-fix-USB-gadget-functionality-on-Palm-Tu.patch b/patches.drivers/USB-omap_udc-fix-USB-gadget-functionality-on-Palm-Tu.patch
new file mode 100644
index 0000000000..b904cdbe27
--- /dev/null
+++ b/patches.drivers/USB-omap_udc-fix-USB-gadget-functionality-on-Palm-Tu.patch
@@ -0,0 +1,34 @@
+From 2c2322fbcab8102b8cadc09d66714700a2da42c2 Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Sun, 25 Nov 2018 00:17:07 +0200
+Subject: [PATCH] USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
+Git-commit: 2c2322fbcab8102b8cadc09d66714700a2da42c2
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+On Palm TE nothing happens when you try to use gadget drivers and plug
+the USB cable. Fix by adding the board to the vbus sense quirk list.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/omap_udc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
+index 33250e569af8..9b23e04c8f02 100644
+--- a/drivers/usb/gadget/udc/omap_udc.c
++++ b/drivers/usb/gadget/udc/omap_udc.c
+@@ -2033,6 +2033,7 @@ static inline int machine_without_vbus_sense(void)
+ {
+ return machine_is_omap_innovator()
+ || machine_is_omap_osk()
++ || machine_is_omap_palmte()
+ || machine_is_sx1()
+ /* No known omap7xx boards with vbus sense */
+ || cpu_is_omap7xx();
+--
+2.19.2
+
diff --git a/patches.drivers/USB-omap_udc-fix-crashes-on-probe-error-and-module-r.patch b/patches.drivers/USB-omap_udc-fix-crashes-on-probe-error-and-module-r.patch
new file mode 100644
index 0000000000..555d88f06a
--- /dev/null
+++ b/patches.drivers/USB-omap_udc-fix-crashes-on-probe-error-and-module-r.patch
@@ -0,0 +1,116 @@
+From 99f700366fcea1aa2fa3c49c99f371670c3c62f8 Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Sun, 25 Nov 2018 00:17:05 +0200
+Subject: [PATCH] USB: omap_udc: fix crashes on probe error and module removal
+Git-commit: 99f700366fcea1aa2fa3c49c99f371670c3c62f8
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+We currently crash if usb_add_gadget_udc_release() fails, since the
+udc->done is not initialized until in the remove function.
+Furthermore, on module removal the udc data is accessed although
+the release function is already triggered by usb_del_gadget_udc()
+early in the function.
+
+Fix by rewriting the release and remove functions, basically moving
+all the cleanup into the release function, and doing the completion
+only in the module removal case.
+
+The patch fixes omap_udc module probe with a failing gadged, and also
+allows the removal of omap_udc. Tested by running "modprobe omap_udc;
+modprobe -r omap_udc" in a loop.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/omap_udc.c | 50 ++++++++++++-------------------
+ 1 file changed, 19 insertions(+), 31 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
+index 1c77218c82af..240ccba44592 100644
+--- a/drivers/usb/gadget/udc/omap_udc.c
++++ b/drivers/usb/gadget/udc/omap_udc.c
+@@ -2593,9 +2593,22 @@ omap_ep_setup(char *name, u8 addr, u8 type,
+
+ static void omap_udc_release(struct device *dev)
+ {
+- complete(udc->done);
++ pullup_disable(udc);
++ if (!IS_ERR_OR_NULL(udc->transceiver)) {
++ usb_put_phy(udc->transceiver);
++ udc->transceiver = NULL;
++ }
++ omap_writew(0, UDC_SYSCON1);
++ remove_proc_file();
++ if (udc->dc_clk) {
++ if (udc->clk_requested)
++ omap_udc_enable_clock(0);
++ clk_put(udc->hhc_clk);
++ clk_put(udc->dc_clk);
++ }
++ if (udc->done)
++ complete(udc->done);
+ kfree(udc);
+- udc = NULL;
+ }
+
+ static int
+@@ -2900,12 +2913,8 @@ static int omap_udc_probe(struct platform_device *pdev)
+ }
+
+ create_proc_file();
+- status = usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
+- omap_udc_release);
+- if (!status)
+- return 0;
+-
+- remove_proc_file();
++ return usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
++ omap_udc_release);
+
+ cleanup1:
+ kfree(udc);
+@@ -2932,36 +2941,15 @@ static int omap_udc_remove(struct platform_device *pdev)
+ {
+ DECLARE_COMPLETION_ONSTACK(done);
+
+- if (!udc)
+- return -ENODEV;
+-
+- usb_del_gadget_udc(&udc->gadget);
+- if (udc->driver)
+- return -EBUSY;
+-
+ udc->done = &done;
+
+- pullup_disable(udc);
+- if (!IS_ERR_OR_NULL(udc->transceiver)) {
+- usb_put_phy(udc->transceiver);
+- udc->transceiver = NULL;
+- }
+- omap_writew(0, UDC_SYSCON1);
+-
+- remove_proc_file();
++ usb_del_gadget_udc(&udc->gadget);
+
+- if (udc->dc_clk) {
+- if (udc->clk_requested)
+- omap_udc_enable_clock(0);
+- clk_put(udc->hhc_clk);
+- clk_put(udc->dc_clk);
+- }
++ wait_for_completion(&done);
+
+ release_mem_region(pdev->resource[0].start,
+ pdev->resource[0].end - pdev->resource[0].start + 1);
+
+- wait_for_completion(&done);
+-
+ return 0;
+ }
+
+--
+2.19.2
+
diff --git a/patches.drivers/USB-omap_udc-fix-omap_udc_start-on-15xx-machines.patch b/patches.drivers/USB-omap_udc-fix-omap_udc_start-on-15xx-machines.patch
new file mode 100644
index 0000000000..7d206410da
--- /dev/null
+++ b/patches.drivers/USB-omap_udc-fix-omap_udc_start-on-15xx-machines.patch
@@ -0,0 +1,43 @@
+From 6ca6695f576b8453fe68865e84d25946d63b10ad Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Sun, 25 Nov 2018 00:17:06 +0200
+Subject: [PATCH] USB: omap_udc: fix omap_udc_start() on 15xx machines
+Git-commit: 6ca6695f576b8453fe68865e84d25946d63b10ad
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+On OMAP 15xx machines there are no transceivers, and omap_udc_start()
+always fails as it forgot to adjust the default return value.
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/omap_udc.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
+index 240ccba44592..33250e569af8 100644
+--- a/drivers/usb/gadget/udc/omap_udc.c
++++ b/drivers/usb/gadget/udc/omap_udc.c
+@@ -2041,7 +2041,7 @@ static inline int machine_without_vbus_sense(void)
+ static int omap_udc_start(struct usb_gadget *g,
+ struct usb_gadget_driver *driver)
+ {
+- int status = -ENODEV;
++ int status;
+ struct omap_ep *ep;
+ unsigned long flags;
+
+@@ -2079,6 +2079,7 @@ static int omap_udc_start(struct usb_gadget *g,
+ goto done;
+ }
+ } else {
++ status = 0;
+ if (can_pullup(udc))
+ pullup_enable(udc);
+ else
+--
+2.19.2
+
diff --git a/patches.drivers/USB-omap_udc-use-devm_request_irq.patch b/patches.drivers/USB-omap_udc-use-devm_request_irq.patch
new file mode 100644
index 0000000000..b2ea9cee05
--- /dev/null
+++ b/patches.drivers/USB-omap_udc-use-devm_request_irq.patch
@@ -0,0 +1,104 @@
+From 286afdde1640d8ea8916a0f05e811441fbbf4b9d Mon Sep 17 00:00:00 2001
+From: Aaro Koskinen <aaro.koskinen@iki.fi>
+Date: Sun, 25 Nov 2018 00:17:04 +0200
+Subject: [PATCH] USB: omap_udc: use devm_request_irq()
+Git-commit: 286afdde1640d8ea8916a0f05e811441fbbf4b9d
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+The current code fails to release the third irq on the error path
+(observed by reading the code), and we get also multiple WARNs with
+failing gadget drivers due to duplicate IRQ releases. Fix by using
+devm_request_irq().
+
+Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/omap_udc.c | 37 +++++++++----------------------
+ 1 file changed, 10 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/omap_udc.c b/drivers/usb/gadget/udc/omap_udc.c
+index 3a16431da321..1c77218c82af 100644
+--- a/drivers/usb/gadget/udc/omap_udc.c
++++ b/drivers/usb/gadget/udc/omap_udc.c
+@@ -2867,8 +2867,8 @@ static int omap_udc_probe(struct platform_device *pdev)
+ udc->clr_halt = UDC_RESET_EP;
+
+ /* USB general purpose IRQ: ep0, state changes, dma, etc */
+- status = request_irq(pdev->resource[1].start, omap_udc_irq,
+- 0, driver_name, udc);
++ status = devm_request_irq(&pdev->dev, pdev->resource[1].start,
++ omap_udc_irq, 0, driver_name, udc);
+ if (status != 0) {
+ ERR("can't get irq %d, err %d\n",
+ (int) pdev->resource[1].start, status);
+@@ -2876,20 +2876,20 @@ static int omap_udc_probe(struct platform_device *pdev)
+ }
+
+ /* USB "non-iso" IRQ (PIO for all but ep0) */
+- status = request_irq(pdev->resource[2].start, omap_udc_pio_irq,
+- 0, "omap_udc pio", udc);
++ status = devm_request_irq(&pdev->dev, pdev->resource[2].start,
++ omap_udc_pio_irq, 0, "omap_udc pio", udc);
+ if (status != 0) {
+ ERR("can't get irq %d, err %d\n",
+ (int) pdev->resource[2].start, status);
+- goto cleanup2;
++ goto cleanup1;
+ }
+ #ifdef USE_ISO
+- status = request_irq(pdev->resource[3].start, omap_udc_iso_irq,
+- 0, "omap_udc iso", udc);
++ status = devm_request_irq(&pdev->dev, pdev->resource[3].start,
++ omap_udc_iso_irq, 0, "omap_udc iso", udc);
+ if (status != 0) {
+ ERR("can't get irq %d, err %d\n",
+ (int) pdev->resource[3].start, status);
+- goto cleanup3;
++ goto cleanup1;
+ }
+ #endif
+ if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
+@@ -2902,22 +2902,11 @@ static int omap_udc_probe(struct platform_device *pdev)
+ create_proc_file();
+ status = usb_add_gadget_udc_release(&pdev->dev, &udc->gadget,
+ omap_udc_release);
+- if (status)
+- goto cleanup4;
+-
+- return 0;
++ if (!status)
++ return 0;
+
+-cleanup4:
+ remove_proc_file();
+
+-#ifdef USE_ISO
+-cleanup3:
+- free_irq(pdev->resource[2].start, udc);
+-#endif
+-
+-cleanup2:
+- free_irq(pdev->resource[1].start, udc);
+-
+ cleanup1:
+ kfree(udc);
+ udc = NULL;
+@@ -2961,12 +2950,6 @@ static int omap_udc_remove(struct platform_device *pdev)
+
+ remove_proc_file();
+
+-#ifdef USE_ISO
+- free_irq(pdev->resource[3].start, udc);
+-#endif
+- free_irq(pdev->resource[2].start, udc);
+- free_irq(pdev->resource[1].start, udc);
+-
+ if (udc->dc_clk) {
+ if (udc->clk_requested)
+ omap_udc_enable_clock(0);
+--
+2.19.2
+
diff --git a/patches.drivers/USB-serial-option-add-Fibocom-NL668-series.patch b/patches.drivers/USB-serial-option-add-Fibocom-NL668-series.patch
new file mode 100644
index 0000000000..01ed1d9f7a
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-Fibocom-NL668-series.patch
@@ -0,0 +1,61 @@
+From 30360224441ce89a98ed627861e735beb4010775 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Wed, 12 Dec 2018 21:47:36 +0100
+Subject: [PATCH] USB: serial: option: add Fibocom NL668 series
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 30360224441ce89a98ed627861e735beb4010775
+Patch-mainline: v4.20
+References: bsc#1051510
+
+Added USB serial option driver support for Fibocom NL668 series cellular
+modules. Reserved USB endpoints 4, 5 and 6 for network + ADB interfaces.
+
+usb-devices output (QMI mode)
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1508 ProdID=1001 Rev=03.18
+S: Manufacturer=Nodecom NL668 Modem
+S: Product=Nodecom NL668-CN Modem
+S: SerialNumber=
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+usb-devices output (ECM mode)
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 17 Spd=480 MxCh= 0
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+I: If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 53e8de5f8acd..2304433d5021 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1949,6 +1949,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
++ { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 */
++ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+2.19.2
+
diff --git a/patches.drivers/USB-serial-option-add-GosunCn-ZTE-WeLink-ME3630.patch b/patches.drivers/USB-serial-option-add-GosunCn-ZTE-WeLink-ME3630.patch
new file mode 100644
index 0000000000..4bb2f0712d
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-GosunCn-ZTE-WeLink-ME3630.patch
@@ -0,0 +1,66 @@
+From 70a7444c550a75584ffcfae95267058817eff6a7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Tue, 11 Dec 2018 18:28:28 +0100
+Subject: [PATCH] USB: serial: option: add GosunCn ZTE WeLink ME3630
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 70a7444c550a75584ffcfae95267058817eff6a7
+Patch-mainline: v4.20
+References: bsc#1051510
+
+Added USB serial option driver support for GosunCn ZTE WeLink ME3630
+series cellular modules for USB modes ECM/NCM and MBIM.
+
+usb-devices output MBIM mode:
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=19d2 ProdID=0602 Rev=03.18
+S: Manufacturer=Android
+S: Product=Android
+S: SerialNumber=
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+usb-devices output ECM/NCM mode:
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
+P: Vendor=19d2 ProdID=1476 Rev=03.18
+I: If#= 3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 642624fc75ad..f7b96f15d938 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1328,6 +1328,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0414, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0417, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x0602, 0xff) }, /* GosunCn ZTE WeLink ME3630 (MBIM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+@@ -1531,6 +1532,7 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = RSVD(2) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
+ .driver_info = RSVD(2) },
++ { USB_DEVICE_INTERFACE_CLASS(ZTE_VENDOR_ID, 0x1476, 0xff) }, /* GosunCn ZTE WeLink ME3630 (ECM/NCM mode) */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+--
+2.19.2
+
diff --git a/patches.drivers/USB-serial-option-add-HP-lt4132.patch b/patches.drivers/USB-serial-option-add-HP-lt4132.patch
new file mode 100644
index 0000000000..5181234e2f
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-HP-lt4132.patch
@@ -0,0 +1,76 @@
+From d57ec3c83b5153217a70b561d4fb6ed96f2f7a25 Mon Sep 17 00:00:00 2001
+From: Tore Anderson <tore@fud.no>
+Date: Sat, 8 Dec 2018 19:05:12 +0100
+Subject: [PATCH] USB: serial: option: add HP lt4132
+Git-commit: d57ec3c83b5153217a70b561d4fb6ed96f2f7a25
+Patch-mainline: v4.20
+References: bsc#1051510
+
+The HP lt4132 is a rebranded Huawei ME906s-158 LTE modem.
+
+The interface with protocol 0x16 is "CDC ECM & NCM" according to the *.inf
+files included with the Windows driver. Attaching the option driver to it
+doesn't result in a /dev/ttyUSB* device being created, so I've excluded it.
+Note that it is also excluded for corresponding Huawei-branded devices, cf.
+commit d544db293a44 ("USB: support new huawei devices in option.c").
+
+T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 3 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=ff MxPS=64 #Cfgs= 3
+P: Vendor=03f0 ProdID=a31d Rev=01.02
+S: Manufacturer=HP Inc.
+S: Product=HP lt4132 LTE/HSPA+ 4G Module
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=2mA
+I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option
+I: If#=0x1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option
+I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option
+I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=06 Prot=16 Driver=(none)
+I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
+I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option
+
+C: #Ifs= 7 Cfg#= 2 Atr=a0 MxPwr=2mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
+I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=06 Prot=00 Driver=cdc_ether
+I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=06 Prot=10 Driver=option
+I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=13 Driver=option
+I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=12 Driver=option
+I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
+I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=1b Driver=option
+
+C: #Ifs= 3 Cfg#= 3 Atr=a0 MxPwr=2mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=06 Prot=14 Driver=option
+
+Signed-off-by: Tore Anderson <tore@fud.no>
+Cc: stable@vger.kernel.org
+[ johan: drop id defines ]
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e24ff16d4147..642624fc75ad 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1940,7 +1940,12 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) },
+- { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x10) }, /* HP lt4132 (Huawei ME906s-158) */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x12) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x13) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x14) },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0xa31d, 0xff, 0x06, 0x1b) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+--
+2.19.2
+
diff --git a/patches.drivers/USB-serial-option-add-Simcom-SIM7500-SIM7600-MBIM-mo.patch b/patches.drivers/USB-serial-option-add-Simcom-SIM7500-SIM7600-MBIM-mo.patch
new file mode 100644
index 0000000000..4ab851dcbd
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-Simcom-SIM7500-SIM7600-MBIM-mo.patch
@@ -0,0 +1,53 @@
+From cc6730df08a291e51e145bc65e24ffb5e2f17ab6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Wed, 12 Dec 2018 08:39:39 +0100
+Subject: [PATCH] USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: cc6730df08a291e51e145bc65e24ffb5e2f17ab6
+Patch-mainline: v4.20
+References: bsc#1051510
+
+Added USB serial option driver support for Simcom SIM7500/SIM7600 series
+cellular modules exposing MBIM interface (VID 0x1e0e,PID 0x9003)
+
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 14 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1e0e ProdID=9003 Rev=03.18
+S: Manufacturer=SimTech, Incorporated
+S: Product=SimTech, Incorporated
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 5 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 6 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index f7b96f15d938..53e8de5f8acd 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1760,6 +1760,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
+ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+ .driver_info = RSVD(5) | RSVD(6) },
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+--
+2.19.2
+
diff --git a/patches.drivers/USB-serial-option-add-Telit-LN940-series.patch b/patches.drivers/USB-serial-option-add-Telit-LN940-series.patch
new file mode 100644
index 0000000000..39f59489a7
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-Telit-LN940-series.patch
@@ -0,0 +1,63 @@
+From 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Thu, 13 Dec 2018 17:32:08 +0100
+Subject: [PATCH] USB: serial: option: add Telit LN940 series
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 28a86092b1753b802ef7e3de8a4c4a69a9c1bb03
+Patch-mainline: v4.20
+References: bsc#1051510
+
+Added USB serial option driver support for Telit LN940 series cellular
+modules. Covering both QMI and MBIM modes.
+
+usb-devices output (0x1900):
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1900 Rev=03.10
+S: Manufacturer=Telit
+S: Product=Telit LN940 Mobile Broadband
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+
+usb-devices output (0x1901):
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 20 Spd=480 MxCh= 0
+P: Vendor=1bc7 ProdID=1901 Rev=03.10
+C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
+I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 2304433d5021..1ce27f3ff7a7 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1164,6 +1164,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
++ .driver_info = NCTRL(0) | RSVD(1) },
++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
++ .driver_info = NCTRL(0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
+ .driver_info = RSVD(1) },
+--
+2.19.2
+
diff --git a/patches.drivers/ath10k-don-t-assume-this-is-a-PCI-dev-in-generic-cod.patch b/patches.drivers/ath10k-don-t-assume-this-is-a-PCI-dev-in-generic-cod.patch
new file mode 100644
index 0000000000..32947ff4a3
--- /dev/null
+++ b/patches.drivers/ath10k-don-t-assume-this-is-a-PCI-dev-in-generic-cod.patch
@@ -0,0 +1,49 @@
+From 79169f14865503fb3c1571ae3f9c456c3ca74865 Mon Sep 17 00:00:00 2001
+From: Brian Norris <briannorris@chromium.org>
+Date: Fri, 2 Nov 2018 10:17:48 -0700
+Subject: [PATCH] ath10k: don't assume this is a PCI dev in generic code
+Git-commit: 79169f14865503fb3c1571ae3f9c456c3ca74865
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Not all devices using this driver are backed by a PCI device, so it's
+not fair to assume 'to_pci_dev()' is valid. Fortunately, we only were
+using this to convert straight back to a bare 'device', which means we
+were only doing no-op pointer arithmetic, and not actually accessing
+potentially out-of-bounds memory. But this is still bad practice.
+
+Just use 'ar->dev' directly, since that's really all we're looking for.
+
+Fixes: 209b2a68de76 ("ath10k: add platform regulatory domain support")
+Signed-off-by: Brian Norris <briannorris@chromium.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 2b8c8bf80b0d..c5130fa264eb 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -8317,7 +8317,6 @@ static u32 ath10k_mac_wrdd_get_mcc(struct ath10k *ar, union acpi_object *wrdd)
+
+ static int ath10k_mac_get_wrdd_regulatory(struct ath10k *ar, u16 *rd)
+ {
+- struct pci_dev __maybe_unused *pdev = to_pci_dev(ar->dev);
+ acpi_handle root_handle;
+ acpi_handle handle;
+ struct acpi_buffer wrdd = {ACPI_ALLOCATE_BUFFER, NULL};
+@@ -8325,7 +8324,7 @@ static int ath10k_mac_get_wrdd_regulatory(struct ath10k *ar, u16 *rd)
+ u32 alpha2_code;
+ char alpha2[3];
+
+- root_handle = ACPI_HANDLE(&pdev->dev);
++ root_handle = ACPI_HANDLE(ar->dev);
+ if (!root_handle)
+ return -EOPNOTSUPP;
+
+--
+2.19.2
+
diff --git a/patches.drivers/ath6kl-Only-use-match-sets-when-firmware-supports-it.patch b/patches.drivers/ath6kl-Only-use-match-sets-when-firmware-supports-it.patch
new file mode 100644
index 0000000000..e208b7952d
--- /dev/null
+++ b/patches.drivers/ath6kl-Only-use-match-sets-when-firmware-supports-it.patch
@@ -0,0 +1,40 @@
+From fb376a495fbdb886f38cfaf5a3805401b9e46f13 Mon Sep 17 00:00:00 2001
+From: Kyle Roeschley <kyle.roeschley@ni.com>
+Date: Wed, 5 Dec 2018 09:43:11 +0200
+Subject: [PATCH] ath6kl: Only use match sets when firmware supports it
+Git-commit: fb376a495fbdb886f38cfaf5a3805401b9e46f13
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Commit dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+merged the probed and matched SSID lists before sending them to the
+firmware. In the process, it assumed match set support is always available
+in ath6kl_set_probed_ssids, which breaks scans for hidden SSIDs. Now, check
+that the firmware supports matching SSIDs in scheduled scans before setting
+MATCH_SSID_FLAG.
+
+Fixes: dd45b7598f1c ("ath6kl: Include match ssid list in scheduled scan")
+Signed-off-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath6kl/cfg80211.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+index e121187f371f..6c98d7903ffb 100644
+--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
++++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
+@@ -939,7 +939,7 @@ static int ath6kl_set_probed_ssids(struct ath6kl *ar,
+ else
+ ssid_list[i].flag = ANY_SSID_FLAG;
+
+- if (n_match_ssid == 0)
++ if (ar->wiphy->max_match_sets != 0 && n_match_ssid == 0)
+ ssid_list[i].flag |= MATCH_SSID_FLAG;
+ }
+
+--
+2.19.2
+
diff --git a/patches.drivers/b43-Fix-error-in-cordic-routine.patch b/patches.drivers/b43-Fix-error-in-cordic-routine.patch
new file mode 100644
index 0000000000..6d7fd93a6a
--- /dev/null
+++ b/patches.drivers/b43-Fix-error-in-cordic-routine.patch
@@ -0,0 +1,47 @@
+From 8ea3819c0bbef57a51d8abe579e211033e861677 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 19 Nov 2018 20:01:24 +0200
+Subject: [PATCH] b43: Fix error in cordic routine
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 8ea3819c0bbef57a51d8abe579e211033e861677
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The cordic routine for calculating sines and cosines that was added in
+commit 6f98e62a9f1b ("b43: update cordic code to match current specs")
+contains an error whereby a quantity declared u32 can in fact go negative.
+
+This problem was detected by Priit Laes who is switching b43 to use the
+routine in the library functions of the kernel.
+
+Fixes: 986504540306 ("b43: make cordic common (LP-PHY and N-PHY need it)")
+Reported-by: Priit Laes <plaes@plaes.org>
+Cc: Rafał Miłecki <zajec5@gmail.com>
+Cc: Stable <stable@vger.kernel.org> # 2.6.34
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Priit Laes <plaes@plaes.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/broadcom/b43/phy_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/broadcom/b43/phy_common.c b/drivers/net/wireless/broadcom/b43/phy_common.c
+index 85f2ca989565..ef3ffa5ad466 100644
+--- a/drivers/net/wireless/broadcom/b43/phy_common.c
++++ b/drivers/net/wireless/broadcom/b43/phy_common.c
+@@ -616,7 +616,7 @@ struct b43_c32 b43_cordic(int theta)
+ u8 i;
+ s32 tmp;
+ s8 signx = 1;
+- u32 angle = 0;
++ s32 angle = 0;
+ struct b43_c32 ret = { .i = 39797, .q = 0, };
+
+ while (theta > (180 << 16))
+--
+2.19.2
+
diff --git a/patches.drivers/can-flexcan-flexcan_irq-fix-indention.patch b/patches.drivers/can-flexcan-flexcan_irq-fix-indention.patch
new file mode 100644
index 0000000000..b71de1fd90
--- /dev/null
+++ b/patches.drivers/can-flexcan-flexcan_irq-fix-indention.patch
@@ -0,0 +1,38 @@
+From bc8ad651516df40bd013ba787ad19f60dac61523 Mon Sep 17 00:00:00 2001
+From: Marc Kleine-Budde <mkl@pengutronix.de>
+Date: Wed, 28 Nov 2018 15:45:27 +0100
+Subject: [PATCH] can: flexcan: flexcan_irq(): fix indention
+Git-commit: bc8ad651516df40bd013ba787ad19f60dac61523
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The patch fixes the indention by replacing space by tabs, as noted by
+Checkpatch:
+
+| ERROR: code indent should use tabs where possible
+| #980: FILE: drivers/net/can/flexcan.c:980:
+
+Fixes: da49a8075c00 ("can: flexcan: implement error passive state quirk")
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/flexcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index f4614a787ca6..9dc14bc37b40 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -821,7 +821,7 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ /* state change interrupt or broken error state quirk fix is enabled */
+ if ((reg_esr & FLEXCAN_ESR_ERR_STATE) ||
+ (priv->devtype_data->quirks & (FLEXCAN_QUIRK_BROKEN_WERR_STATE |
+- FLEXCAN_QUIRK_BROKEN_PERR_STATE)))
++ FLEXCAN_QUIRK_BROKEN_PERR_STATE)))
+ flexcan_irq_state(dev, reg_esr);
+
+ /* bus error IRQ - handle if bus error reporting is activated */
+--
+2.19.2
+
diff --git a/patches.drivers/cdrom-don-t-attempt-to-fiddle-with-cdo-capability.patch b/patches.drivers/cdrom-don-t-attempt-to-fiddle-with-cdo-capability.patch
new file mode 100644
index 0000000000..82bdac76af
--- /dev/null
+++ b/patches.drivers/cdrom-don-t-attempt-to-fiddle-with-cdo-capability.patch
@@ -0,0 +1,80 @@
+From 8f94004e2a51a3ea195cf3447eb5d5906f36d8b3 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sun, 14 Oct 2018 13:20:48 -0600
+Subject: [PATCH] cdrom: don't attempt to fiddle with cdo->capability
+Git-commit: 8f94004e2a51a3ea195cf3447eb5d5906f36d8b3
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+We can't modify cdo->capability as it is defined as a const.
+Change the modification hack to just WARN_ON_ONCE() if we hit
+any of the invalid combinations.
+
+This fixes a regression for pcd, which doesn't work after the
+constify patch.
+
+Fixes: 853fe1bf7554 ("cdrom: Make device operations read-only")
+Tested-by: Ondrej Zary <linux@rainbow-software.org>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cdrom/cdrom.c | 27 +++++++++++++--------------
+ 1 file changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index 10802d1fc554..614ecdbb4ab7 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -410,10 +410,10 @@ static int cdrom_get_disc_info(struct cdrom_device_info *cdi,
+ * hack to have the capability flags defined const, while we can still
+ * change it here without gcc complaining at every line.
+ */
+-#define ENSURE(call, bits) \
+-do { \
+- if (cdo->call == NULL) \
+- *change_capability &= ~(bits); \
++#define ENSURE(cdo, call, bits) \
++do { \
++ if (cdo->call == NULL) \
++ WARN_ON_ONCE((cdo)->capability & (bits)); \
+ } while (0)
+
+ /*
+@@ -589,7 +589,6 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ {
+ static char banner_printed;
+ const struct cdrom_device_ops *cdo = cdi->ops;
+- int *change_capability = (int *)&cdo->capability; /* hack */
+
+ cd_dbg(CD_OPEN, "entering register_cdrom\n");
+
+@@ -601,16 +600,16 @@ int register_cdrom(struct cdrom_device_info *cdi)
+ cdrom_sysctl_register();
+ }
+
+- ENSURE(drive_status, CDC_DRIVE_STATUS);
++ ENSURE(cdo, drive_status, CDC_DRIVE_STATUS);
+ if (cdo->check_events == NULL && cdo->media_changed == NULL)
+- *change_capability = ~(CDC_MEDIA_CHANGED | CDC_SELECT_DISC);
+- ENSURE(tray_move, CDC_CLOSE_TRAY | CDC_OPEN_TRAY);
+- ENSURE(lock_door, CDC_LOCK);
+- ENSURE(select_speed, CDC_SELECT_SPEED);
+- ENSURE(get_last_session, CDC_MULTI_SESSION);
+- ENSURE(get_mcn, CDC_MCN);
+- ENSURE(reset, CDC_RESET);
+- ENSURE(generic_packet, CDC_GENERIC_PACKET);
++ WARN_ON_ONCE(cdo->capability & (CDC_MEDIA_CHANGED | CDC_SELECT_DISC));
++ ENSURE(cdo, tray_move, CDC_CLOSE_TRAY | CDC_OPEN_TRAY);
++ ENSURE(cdo, lock_door, CDC_LOCK);
++ ENSURE(cdo, select_speed, CDC_SELECT_SPEED);
++ ENSURE(cdo, get_last_session, CDC_MULTI_SESSION);
++ ENSURE(cdo, get_mcn, CDC_MCN);
++ ENSURE(cdo, reset, CDC_RESET);
++ ENSURE(cdo, generic_packet, CDC_GENERIC_PACKET);
+ cdi->mc_flags = 0;
+ cdi->options = CDO_USE_FFLAGS;
+
+--
+2.19.2
+
diff --git a/patches.drivers/char_dev-Fix-off-by-one-bugs-in-find_dynamic_major.patch b/patches.drivers/char_dev-Fix-off-by-one-bugs-in-find_dynamic_major.patch
new file mode 100644
index 0000000000..7bd3fdb2df
--- /dev/null
+++ b/patches.drivers/char_dev-Fix-off-by-one-bugs-in-find_dynamic_major.patch
@@ -0,0 +1,53 @@
+From 652d703b21eb1caf2673c10bd58e4b0121dc7c50 Mon Sep 17 00:00:00 2001
+From: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
+Date: Mon, 5 Feb 2018 18:25:09 -0800
+Subject: [PATCH] char_dev: Fix off-by-one bugs in find_dynamic_major()
+Git-commit: 652d703b21eb1caf2673c10bd58e4b0121dc7c50
+Patch-mainline: v4.17-rc1
+References: bsc#1121058
+
+CHRDEV_MAJOR_DYN_END and CHRDEV_MAJOR_DYN_EXT_END are valid major
+numbers. So fix the loop iteration to include them in the search for
+free major numbers.
+
+While at it, also remove a redundant if condition ("cd->major != i"),
+as it will never be true.
+
+Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/char_dev.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/char_dev.c b/fs/char_dev.c
+index a65e4a56318c..33c938542160 100644
+--- a/fs/char_dev.c
++++ b/fs/char_dev.c
+@@ -67,18 +67,18 @@ static int find_dynamic_major(void)
+ int i;
+ struct char_device_struct *cd;
+
+- for (i = ARRAY_SIZE(chrdevs)-1; i > CHRDEV_MAJOR_DYN_END; i--) {
++ for (i = ARRAY_SIZE(chrdevs)-1; i >= CHRDEV_MAJOR_DYN_END; i--) {
+ if (chrdevs[i] == NULL)
+ return i;
+ }
+
+ for (i = CHRDEV_MAJOR_DYN_EXT_START;
+- i > CHRDEV_MAJOR_DYN_EXT_END; i--) {
++ i >= CHRDEV_MAJOR_DYN_EXT_END; i--) {
+ for (cd = chrdevs[major_to_index(i)]; cd; cd = cd->next)
+ if (cd->major == i)
+ break;
+
+- if (cd == NULL || cd->major != i)
++ if (cd == NULL)
+ return i;
+ }
+
+--
+2.20.1
+
diff --git a/patches.drivers/char_dev-extend-dynamic-allocation-of-majors-into-a-.patch b/patches.drivers/char_dev-extend-dynamic-allocation-of-majors-into-a-.patch
new file mode 100644
index 0000000000..785e48f485
--- /dev/null
+++ b/patches.drivers/char_dev-extend-dynamic-allocation-of-majors-into-a-.patch
@@ -0,0 +1,136 @@
+From a5d31a3f81c6fb13b381951bf6163444c0257e8b Mon Sep 17 00:00:00 2001
+From: Logan Gunthorpe <logang@deltatee.com>
+Date: Thu, 15 Jun 2017 14:05:20 -0600
+Subject: [PATCH] char_dev: extend dynamic allocation of majors into a higher range
+Git-commit: a5d31a3f81c6fb13b381951bf6163444c0257e8b
+Patch-mainline: v4.14-rc1
+References: bsc#1121058
+
+We've run into problems with running out of dynamicly assign char
+device majors particullarly on automated test systems with
+all-yes-configs. Roughly 40 dynamic assignments can be made with such
+kernels at this time while space is reserved for only 20.
+
+Currently, the kernel only prints a warning when dynamic allocation
+overflows the reserved region. And when this happens drivers that have
+fixed assignments can randomly fail depending on the order of
+initialization of other drivers. Thus, adding a new char device can cause
+unexpected failures in completely unrelated parts of the kernel.
+
+This patch solves the problem by extending dynamic major number
+allocations down from 511 once the 234-254 region fills up. Fixed
+majors already exist above 255 so the infrastructure to support
+high number majors is already in place. The patch reserves an
+additional 128 major numbers which should hopefully last us a while.
+
+Kernels that don't require more than 20 dynamic majors assigned (which
+is pretty typical) should not be affected by this change.
+
+Signed-off-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Alan Cox <alan@linux.intel.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lkml.org/lkml/2017/6/4/107
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ Documentation/admin-guide/devices.txt | 5 ++++
+ fs/char_dev.c | 41 ++++++++++++++++++---------
+ include/linux/fs.h | 4 +++
+ 3 files changed, 37 insertions(+), 13 deletions(-)
+
+diff --git a/Documentation/admin-guide/devices.txt b/Documentation/admin-guide/devices.txt
+index 6b71852dadc2..4ec843123cc3 100644
+--- a/Documentation/admin-guide/devices.txt
++++ b/Documentation/admin-guide/devices.txt
+@@ -3081,3 +3081,8 @@
+ 1 = /dev/osd1 Second OSD Device
+ ...
+ 255 = /dev/osd255 256th OSD Device
++
++ 384-511 char RESERVED FOR DYNAMIC ASSIGNMENT
++ Character devices that request a dynamic allocation of major
++ number will take numbers starting from 511 and downward,
++ once the 234-254 range is full.
+diff --git a/fs/char_dev.c b/fs/char_dev.c
+index fb8507f521b2..c9d18362e89d 100644
+--- a/fs/char_dev.c
++++ b/fs/char_dev.c
+@@ -59,6 +59,29 @@ void chrdev_show(struct seq_file *f, off_t offset)
+
+ #endif /* CONFIG_PROC_FS */
+
++static int find_dynamic_major(void)
++{
++ int i;
++ struct char_device_struct *cd;
++
++ for (i = ARRAY_SIZE(chrdevs)-1; i > CHRDEV_MAJOR_DYN_END; i--) {
++ if (chrdevs[i] == NULL)
++ return i;
++ }
++
++ for (i = CHRDEV_MAJOR_DYN_EXT_START;
++ i > CHRDEV_MAJOR_DYN_EXT_END; i--) {
++ for (cd = chrdevs[major_to_index(i)]; cd; cd = cd->next)
++ if (cd->major == i)
++ break;
++
++ if (cd == NULL || cd->major != i)
++ return i;
++ }
++
++ return -EBUSY;
++}
++
+ /*
+ * Register a single major with a specified minor range.
+ *
+@@ -84,22 +107,14 @@ __register_chrdev_region(unsigned int major, unsigned int baseminor,
+
+ mutex_lock(&chrdevs_lock);
+
+- /* temporary */
+ if (major == 0) {
+- for (i = ARRAY_SIZE(chrdevs)-1; i > 0; i--) {
+- if (chrdevs[i] == NULL)
+- break;
+- }
+-
+- if (i < CHRDEV_MAJOR_DYN_END)
+- pr_warn("CHRDEV \"%s\" major number %d goes below the dynamic allocation range\n",
+- name, i);
+-
+- if (i == 0) {
+- ret = -EBUSY;
++ ret = find_dynamic_major();
++ if (ret < 0) {
++ pr_err("CHRDEV \"%s\" dynamic allocation region is full\n",
++ name);
+ goto out;
+ }
+- major = i;
++ major = ret;
+ }
+
+ cd->major = major;
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 7b5d6816542b..1773dcf1e318 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -2473,6 +2473,10 @@ static inline void bd_unlink_disk_holder(struct block_device *bdev,
+ #define CHRDEV_MAJOR_HASH_SIZE 255
+ /* Marks the bottom of the first segment of free char majors */
+ #define CHRDEV_MAJOR_DYN_END 234
++/* Marks the top and bottom of the second segment of free char majors */
++#define CHRDEV_MAJOR_DYN_EXT_START 511
++#define CHRDEV_MAJOR_DYN_EXT_END 384
++
+ extern int alloc_chrdev_region(dev_t *, unsigned, unsigned, const char *);
+ extern int register_chrdev_region(dev_t, unsigned, const char *);
+ extern int __register_chrdev(unsigned int major, unsigned int baseminor,
+--
+2.20.1
+
diff --git a/patches.drivers/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch b/patches.drivers/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch
new file mode 100644
index 0000000000..f27c332abb
--- /dev/null
+++ b/patches.drivers/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch
@@ -0,0 +1,45 @@
+From 4f0129d13e69bad0363fd75553fb22897b32c379 Mon Sep 17 00:00:00 2001
+From: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+Date: Tue, 6 Nov 2018 13:58:58 +0530
+Subject: [PATCH] crypto: bcm - fix normal/non key hash algorithm failure
+Git-commit: 4f0129d13e69bad0363fd75553fb22897b32c379
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+Remove setkey() callback handler for normal/non key
+hash algorithms and keep it for AES-CBC/CMAC which needs key.
+
+Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
+Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/bcm/cipher.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c
+index 2d1f1db9f807..4d67e22a4664 100644
+--- a/drivers/crypto/bcm/cipher.c
++++ b/drivers/crypto/bcm/cipher.c
+@@ -4652,12 +4652,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg)
+ hash->halg.statesize = sizeof(struct spu_hash_export_s);
+
+ if (driver_alg->auth_info.mode != HASH_MODE_HMAC) {
+- hash->setkey = ahash_setkey;
+ hash->init = ahash_init;
+ hash->update = ahash_update;
+ hash->final = ahash_final;
+ hash->finup = ahash_finup;
+ hash->digest = ahash_digest;
++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) &&
++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) ||
++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) {
++ hash->setkey = ahash_setkey;
++ }
+ } else {
+ hash->setkey = ahash_hmac_setkey;
+ hash->init = ahash_hmac_init;
+--
+2.19.2
+
diff --git a/patches.drivers/device-property-Define-type-of-PROPERTY_ENRTY_-macro.patch b/patches.drivers/device-property-Define-type-of-PROPERTY_ENRTY_-macro.patch
new file mode 100644
index 0000000000..9aac4d1b37
--- /dev/null
+++ b/patches.drivers/device-property-Define-type-of-PROPERTY_ENRTY_-macro.patch
@@ -0,0 +1,81 @@
+From c505cbd45f6e9c539d57dd171d95ec7e5e9f9cd0 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Mon, 22 Jan 2018 18:01:42 +0200
+Subject: [PATCH] device property: Define type of PROPERTY_ENRTY_*() macros
+Git-commit: c505cbd45f6e9c539d57dd171d95ec7e5e9f9cd0
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+Some of the drivers may use the macro at runtime flow, like
+
+ struct property_entry p[10];
+...
+ p[index++] = PROPERTY_ENTRY_U8("u8 property", u8_data);
+
+In that case and absence of the data type compiler fails the build:
+
+drivers/char/ipmi/ipmi_dmi.c:79:29: error: Expected ; at end of statement
+drivers/char/ipmi/ipm