Home Home > GIT Browse > SLE12-SP4-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-21 07:07:07 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-21 07:07:07 +0100
commitfd456095c5d885451a41a0a8be01b853af6a8585 (patch)
tree391acd3a1cda8f862bbe617611207cd2f0ec9c2d
parent420216f80ea734f5ce4cb6ea53ccf388e377a877 (diff)
parent5d61b6616aeb0930cb222bbfab1c976a5751ffa5 (diff)
Merge branch 'SLE12-SP4' into SLE12-SP4-AZURE
-rw-r--r--blacklist.conf6
-rw-r--r--patches.arch/hotplug-cpu-Add-operation-queuing-function.patch175
-rw-r--r--patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch222
-rw-r--r--patches.arch/hotplug-cpu-Provide-CPU-readd-operation.patch113
-rw-r--r--patches.arch/hotplug-pmt-Update-topology-after-PMT.patch58
-rw-r--r--patches.arch/mobility-numa-Ensure-numa-update-does-not-overlap.patch70
-rw-r--r--patches.arch/powerpc-pseries-Perform-full-re-add-of-CPU-for-topol.patch113
-rw-r--r--patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch209
-rw-r--r--patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch43
-rw-r--r--patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch71
-rw-r--r--patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch58
-rw-r--r--patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch54
-rw-r--r--patches.drivers/nvme_fc-fix-ctrl-create-failures-racing-with-workq-i.patch2
-rw-r--r--patches.drivers/of-numa-Validate-some-distance-map-rules.patch84
-rw-r--r--patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch123
-rw-r--r--patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch74
-rw-r--r--patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch88
-rw-r--r--patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch76
-rw-r--r--patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch41
-rw-r--r--patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch78
-rw-r--r--patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch57
-rw-r--r--patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch84
-rw-r--r--patches.drivers/scsi-lpfc-Add-log-messages-to-aid-in-debugging-fc4ty.patch123
-rw-r--r--patches.drivers/scsi-lpfc-Correct-MDS-loopback-diagnostics-support.patch144
-rw-r--r--patches.drivers/scsi-lpfc-Fix-discovery-failure-when-PLOGI-is-defere.patch78
-rw-r--r--patches.drivers/scsi-lpfc-Fix-link-state-reporting-for-trunking-when.patch60
-rw-r--r--patches.drivers/scsi-lpfc-Update-lpfc-version-to-12.0.0.10.patch33
-rw-r--r--patches.drivers/scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli.patch40
-rw-r--r--patches.drivers/scsi-lpfc-update-fault-value-on-successful-trunk-eve.patch63
-rw-r--r--patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch39
-rw-r--r--patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch38
-rw-r--r--patches.drm/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch169
-rw-r--r--patches.drm/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch70
-rw-r--r--patches.drm/0005-drm-i915-opregion-fix-version-check.patch73
-rw-r--r--patches.drm/0006-drm-i915-opregion-rvda-is-relative-from-opregion-bas.patch90
-rw-r--r--patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-parameter.patch89
-rw-r--r--patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocation.patch135
-rw-r--r--patches.fixes/ARM-iop32x-n2100-fix-PCI-IRQ-mapping.patch37
-rw-r--r--patches.fixes/ARM-tango-Improve-ARCH_MULTIPLATFORM-compatibility.patch84
-rw-r--r--patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch54
-rw-r--r--patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch2
-rw-r--r--patches.fixes/acpi-nfit-Fix-command-supported-detection.patch2
-rw-r--r--patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch104
-rw-r--r--patches.fixes/blk-mq-fix-a-hung-issue-when-fsync.patch60
-rw-r--r--patches.fixes/bpf-Fix-syscall-s-stackmap-lookup-potential-deadlock.patch66
-rw-r--r--patches.fixes/bpf-enable-access-to-ax-register-also-from-verifier-.patch70
-rw-r--r--patches.fixes/bpf-fix-check_map_access-smin_value-test-when-pointe.patch2
-rw-r--r--patches.fixes/bpf-fix-lockdep-false-positive-in-percpu_freelist.patch305
-rw-r--r--patches.fixes/bpf-move-prev_-insn_idx-into-verifier-env.patch2
-rw-r--r--patches.fixes/bpf-move-tmp-variable-into-ax-register-in-interprete.patch144
-rw-r--r--patches.fixes/bpf-prevent-out-of-bounds-speculation-on-pointer-ari.patch2
-rw-r--r--patches.fixes/bpf-restrict-map-value-pointer-arithmetic-for-unpriv.patch2
-rw-r--r--patches.fixes/bpf-restrict-stack-pointer-arithmetic-for-unprivileg.patch2
-rw-r--r--patches.fixes/bpf-restrict-unknown-scalars-of-mixed-signed-bounds-.patch2
-rw-r--r--patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch32
-rw-r--r--patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch58
-rw-r--r--patches.fixes/lightnvm-fail-fast-on-passthrough-commands.patch36
-rw-r--r--patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch72
-rw-r--r--patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch61
-rw-r--r--patches.fixes/netrom-switch-to-sock-timer-API.patch100
-rw-r--r--patches.fixes/nvme-lock-NS-list-changes-while-handling-command-eff.patch96
-rw-r--r--patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch39
-rw-r--r--patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch103
-rw-r--r--patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch86
-rw-r--r--patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch58
-rw-r--r--patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch44
-rw-r--r--patches.fixes/scsi-lpfc-remove-an-unnecessary-NULL-check.patch37
-rw-r--r--patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch118
-rw-r--r--patches.kabi/nvme-kABI-fix-for-scan_lock.patch32
-rw-r--r--patches.suse/mm-oom-fix-use-after-free-in-oom_kill_process.patch71
-rw-r--r--patches.suse/rcu-Fix-up-pending-cbs-check-in-rcu_prepare_for_idle.patch36
-rw-r--r--patches.suse/rcu-Make-need_resched-respond-to-urgent-RCU-QS-needs.patch59
-rwxr-xr-xrpm/klp-symbols2
-rw-r--r--series.conf71
74 files changed, 4638 insertions, 656 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 63f5cdc439..ab10375f18 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -959,3 +959,9 @@ b1ab5fa309e6c49e4e06270ec67dd7b3e9971d04 # Just a cleanup
967d1dc144b50ad005e5eecdfadfbcfb399ffff6 # Just a cleanup
0a42e99b58a208839626465af194cfe640ef9493 # Just a cleanup
9b3fa47d4a76b1d606a396455f9bbeee083ef008 # Fixes code not present in SLE15
+156baec39732f025dc778e00da95fc10d6e45885 # Fixes an unused debugging option
+a77660d231f8b3d84fd23ed482e0964f7aa546d6 # Fixes an unused debugging option
+7be8c56f8f8a58af92f8791c5a09d48e342d7101 # Fixes comments only
+7d63fb3af87aa67aa7d24466e792f9d7c57d8e79 # Cosmetic fix only
+c5c08bed843c2b2c048c16d1296d7631d7c1620e # Fixes build of a userspace test tool
+da08d8cb8cfc58a340fc5e163385b5dfd714d762 # of: duplicated commit
diff --git a/patches.arch/hotplug-cpu-Add-operation-queuing-function.patch b/patches.arch/hotplug-cpu-Add-operation-queuing-function.patch
deleted file mode 100644
index 705b6e4d36..0000000000
--- a/patches.arch/hotplug-cpu-Add-operation-queuing-function.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From fa1be6a04a67575fc3a23a494400fe2b6d8c6a7d Mon Sep 17 00:00:00 2001
-From: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Date: Sun, 29 Jul 2018 08:19:17 -0500
-Subject: [PATCH] hotplug/cpu: Add operation queuing function
-
-References: FATE#325308
-Patch-mainline: submitted https://patchwork.ozlabs.org/cover/950609/
-
-hotplug/cpu: This patch adds function dlpar_queue_action() which
-will queued up information about a CPU/Memory 'readd' operation
-according to resource type, action code, and DRC index. Examples
-of such operations include 'readd' of CPU and Memory blocks
-identified as having changed their associativity during an LPAR
-migration event.
-
-At a subsequent point, the list of operations can be run/played
-in series from a worker function added to the pseries work queue.
-In the case of 'migration_store', the code has identified a set
-of post migration topology changes to be applied. There may be
-a small number of CPU and memory changes to apply on small systems.
-On large SAP HANA systems though, there may changes to thousands
-and thousands of CPUs and memory blocks. Applying these changes
-may take a significant amount of time -- much longer than the
-timeouts used by an associated HMC. In order to avoid such
-timeout errors, the worker queue implementation allows the code
-to exit 'migration_store' with a good status, and then apply the
-changes to CPUs and memory blocks afterward.
-
-Signed-off-by: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Acked-by: Michal Suchanek <msuchanek@suse.de>
----
- arch/powerpc/include/asm/rtas.h | 2 ++
- arch/powerpc/platforms/pseries/dlpar.c | 57 +++++++++++++++++++++++++++++++
- arch/powerpc/platforms/pseries/mobility.c | 3 ++
- arch/powerpc/platforms/pseries/pseries.h | 2 ++
- 4 files changed, 64 insertions(+)
-
-diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
-index c0212fe9ca9a..58aa66f46533 100644
---- a/arch/powerpc/include/asm/rtas.h
-+++ b/arch/powerpc/include/asm/rtas.h
-@@ -323,12 +323,14 @@ struct pseries_hp_errorlog {
- struct { __be32 count, index; } ic;
- char drc_name[1];
- } _drc_u;
-+ struct list_head list;
- };
-
- #define PSERIES_HP_ELOG_RESOURCE_CPU 1
- #define PSERIES_HP_ELOG_RESOURCE_MEM 2
- #define PSERIES_HP_ELOG_RESOURCE_SLOT 3
- #define PSERIES_HP_ELOG_RESOURCE_PHB 4
-+#define PSERIES_HP_ELOG_RESOURCE_PMT 5
-
- #define PSERIES_HP_ELOG_ACTION_ADD 1
- #define PSERIES_HP_ELOG_ACTION_REMOVE 2
-diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
-index 9598212ab55f..12cba511f5e1 100644
---- a/arch/powerpc/platforms/pseries/dlpar.c
-+++ b/arch/powerpc/platforms/pseries/dlpar.c
-@@ -25,6 +25,7 @@
- #include <asm/prom.h>
- #include <asm/machdep.h>
- #include <linux/uaccess.h>
-+#include <linux/delay.h>
- #include <asm/rtas.h>
-
- static struct workqueue_struct *pseries_hp_wq;
-@@ -340,6 +341,8 @@ int dlpar_release_drc(u32 drc_index)
- return 0;
- }
-
-+static int dlpar_pmt(struct pseries_hp_errorlog *work);
-+
- int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_elog)
- {
- int rc;
-@@ -368,6 +371,9 @@ int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_elog)
- case PSERIES_HP_ELOG_RESOURCE_CPU:
- rc = dlpar_cpu(hp_elog);
- break;
-+ case PSERIES_HP_ELOG_RESOURCE_PMT:
-+ rc = dlpar_pmt(hp_elog);
-+ break;
- default:
- pr_warn_ratelimited("Invalid resource (%d) specified\n",
- hp_elog->resource);
-@@ -407,6 +413,57 @@ void queue_hotplug_event(struct pseries_hp_errorlog *hp_errlog)
- }
- }
-
-+LIST_HEAD(dlpar_delayed_list);
-+
-+int dlpar_queue_action(int resource, int action, u32 drc_index)
-+{
-+ struct pseries_hp_errorlog *hp_errlog;
-+
-+ hp_errlog = kmalloc(sizeof(struct pseries_hp_errorlog), GFP_KERNEL);
-+ if (!hp_errlog)
-+ return -ENOMEM;
-+
-+ hp_errlog->resource = resource;
-+ hp_errlog->action = action;
-+ hp_errlog->id_type = PSERIES_HP_ELOG_ID_DRC_INDEX;
-+ hp_errlog->_drc_u.drc_index = cpu_to_be32(drc_index);
-+
-+ list_add_tail(&hp_errlog->list, &dlpar_delayed_list);
-+
-+ return 0;
-+}
-+
-+static int dlpar_pmt(struct pseries_hp_errorlog *work)
-+{
-+ struct list_head *pos, *q;
-+
-+ list_for_each_safe(pos, q, &dlpar_delayed_list) {
-+ struct pseries_hp_errorlog *tmp;
-+
-+ tmp = list_entry(pos, struct pseries_hp_errorlog, list);
-+ handle_dlpar_errorlog(tmp);
-+
-+ list_del(pos);
-+ kfree(tmp);
-+ }
-+
-+ return 0;
-+}
-+
-+int dlpar_queued_actions_run(void)
-+{
-+ if (!list_empty(&dlpar_delayed_list)) {
-+ struct pseries_hp_errorlog hp_errlog;
-+
-+ hp_errlog.resource = PSERIES_HP_ELOG_RESOURCE_PMT;
-+ hp_errlog.action = 0;
-+ hp_errlog.id_type = 0;
-+
-+ queue_hotplug_event(&hp_errlog);
-+ }
-+ return 0;
-+}
-+
- static int dlpar_parse_resource(char **cmd, struct pseries_hp_errorlog *hp_elog)
- {
- char *arg;
-diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
-index 78277fd7b2b4..093a52abcd95 100644
---- a/arch/powerpc/platforms/pseries/mobility.c
-+++ b/arch/powerpc/platforms/pseries/mobility.c
-@@ -373,6 +373,9 @@ static ssize_t migrate_store(struct class *class, struct class_attribute *attr,
-
- start_topology_update();
-
-+ /* Apply any necessary changes identified during fixup */
-+ dlpar_queued_actions_run();
-+
- return count;
- }
-
-diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h
-index 120b132ede25..d7e3b885dd73 100644
---- a/arch/powerpc/platforms/pseries/pseries.h
-+++ b/arch/powerpc/platforms/pseries/pseries.h
-@@ -55,6 +55,8 @@ extern int dlpar_release_drc(u32 drc_index);
- void queue_hotplug_event(struct pseries_hp_errorlog *hp_errlog);
- int handle_dlpar_errorlog(struct pseries_hp_errorlog *hp_errlog);
-
-+int dlpar_queue_action(int resource, int action, u32 drc_index);
-+int dlpar_queued_actions_run(void);
- #ifdef CONFIG_MEMORY_HOTPLUG
- int dlpar_memory(struct pseries_hp_errorlog *hp_elog);
- #else
---
-2.13.7
-
diff --git a/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch b/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
deleted file mode 100644
index 52f00e430e..0000000000
--- a/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
+++ /dev/null
@@ -1,222 +0,0 @@
-From 4ae6c5e10485dc012976b342a375a75368425b25 Mon Sep 17 00:00:00 2001
-From: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Date: Sun, 29 Jul 2018 08:19:12 -0500
-Subject: [PATCH 1/5] hotplug/cpu: Conditionally acquire/release DRC index
-
-References: FATE#325308
-Patch-mainline: submitted https://patchwork.ozlabs.org/cover/950609/
-
-powerpc/cpu: Modify dlpar_cpu_add and dlpar_cpu_remove to allow the
-skipping of DRC index acquire or release operations during the CPU
-add or remove operations. This is intended to support subsequent
-changes to provide a 'CPU readd' operation.
-
-Signed-off-by: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Acked-by: Michal Suchanek <msuchanek@suse.de>
----
- arch/powerpc/platforms/pseries/hotplug-cpu.c | 71 ++++++++++++++++------------
- 1 file changed, 40 insertions(+), 31 deletions(-)
-
-diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-index 4d2328fb569d..b94d881eab7a 100644
---- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
-+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-@@ -432,7 +432,7 @@ static bool valid_cpu_drc_index(struct device_node *parent, u32 drc_index)
- return found;
- }
-
--static ssize_t dlpar_cpu_add(u32 drc_index)
-+static ssize_t dlpar_cpu_add(u32 drc_index, bool acquire_drc)
- {
- struct device_node *dn, *parent;
- int rc, saved_rc;
-@@ -457,19 +457,22 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
- return -EINVAL;
- }
-
-- rc = dlpar_acquire_drc(drc_index);
-- if (rc) {
-- pr_warn("Failed to acquire DRC, rc: %d, drc index: %x\n",
-- rc, drc_index);
-- of_node_put(parent);
-- return -EINVAL;
-+ if (acquire_drc) {
-+ rc = dlpar_acquire_drc(drc_index);
-+ if (rc) {
-+ pr_warn("Failed to acquire DRC, rc: %d, drc index: %x\n",
-+ rc, drc_index);
-+ of_node_put(parent);
-+ return -EINVAL;
-+ }
- }
-
- dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
- if (!dn) {
- pr_warn("Failed call to configure-connector, drc index: %x\n",
- drc_index);
-- dlpar_release_drc(drc_index);
-+ if (acquire_drc)
-+ dlpar_release_drc(drc_index);
- of_node_put(parent);
- return -EINVAL;
- }
-@@ -484,9 +487,11 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
- pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
- dn->name, rc, drc_index);
-
-- rc = dlpar_release_drc(drc_index);
-- if (!rc)
-- dlpar_free_cc_nodes(dn);
-+ if (acquire_drc) {
-+ rc = dlpar_release_drc(drc_index);
-+ if (!rc)
-+ dlpar_free_cc_nodes(dn);
-+ }
-
- return saved_rc;
- }
-@@ -498,7 +503,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
- dn->name, rc, drc_index);
-
- rc = dlpar_detach_node(dn);
-- if (!rc)
-+ if (!rc && acquire_drc)
- dlpar_release_drc(drc_index);
-
- return saved_rc;
-@@ -566,7 +571,8 @@ static int dlpar_offline_cpu(struct device_node *dn)
-
- }
-
--static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
-+static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index,
-+ bool release_drc)
- {
- int rc;
-
-@@ -579,12 +585,14 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
- return -EINVAL;
- }
-
-- rc = dlpar_release_drc(drc_index);
-- if (rc) {
-- pr_warn("Failed to release drc (%x) for CPU %s, rc: %d\n",
-- drc_index, dn->name, rc);
-- dlpar_online_cpu(dn);
-- return rc;
-+ if (release_drc) {
-+ rc = dlpar_release_drc(drc_index);
-+ if (rc) {
-+ pr_warn("Failed to release drc (%x) for CPU %s, rc: %d\n",
-+ drc_index, dn->name, rc);
-+ dlpar_online_cpu(dn);
-+ return rc;
-+ }
- }
-
- rc = dlpar_detach_node(dn);
-@@ -593,8 +601,9 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
-
- pr_warn("Failed to detach CPU %s, rc: %d", dn->name, rc);
-
-- rc = dlpar_acquire_drc(drc_index);
-- if (!rc)
-+ if (release_drc)
-+ rc = dlpar_acquire_drc(drc_index);
-+ if (!release_drc || !rc)
- dlpar_online_cpu(dn);
-
- return saved_rc;
-@@ -622,7 +631,7 @@ static struct device_node *cpu_drc_index_to_dn(u32 drc_index)
- return dn;
- }
-
--static int dlpar_cpu_remove_by_index(u32 drc_index)
-+static int dlpar_cpu_remove_by_index(u32 drc_index, bool release_drc)
- {
- struct device_node *dn;
- int rc;
-@@ -634,7 +643,7 @@ static int dlpar_cpu_remove_by_index(u32 drc_index)
- return -ENODEV;
- }
-
-- rc = dlpar_cpu_remove(dn, drc_index);
-+ rc = dlpar_cpu_remove(dn, drc_index, release_drc);
- of_node_put(dn);
- return rc;
- }
-@@ -699,7 +708,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
- }
-
- for (i = 0; i < cpus_to_remove; i++) {
-- rc = dlpar_cpu_remove_by_index(cpu_drcs[i]);
-+ rc = dlpar_cpu_remove_by_index(cpu_drcs[i], true);
- if (rc)
- break;
-
-@@ -710,7 +719,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
- pr_warn("CPU hot-remove failed, adding back removed CPUs\n");
-
- for (i = 0; i < cpus_removed; i++)
-- dlpar_cpu_add(cpu_drcs[i]);
-+ dlpar_cpu_add(cpu_drcs[i], true);
-
- rc = -EINVAL;
- } else {
-@@ -780,7 +789,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
- }
-
- for (i = 0; i < cpus_to_add; i++) {
-- rc = dlpar_cpu_add(cpu_drcs[i]);
-+ rc = dlpar_cpu_add(cpu_drcs[i], true);
- if (rc)
- break;
-
-@@ -791,7 +800,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
- pr_warn("CPU hot-add failed, removing any added CPUs\n");
-
- for (i = 0; i < cpus_added; i++)
-- dlpar_cpu_remove_by_index(cpu_drcs[i]);
-+ dlpar_cpu_remove_by_index(cpu_drcs[i], true);
-
- rc = -EINVAL;
- } else {
-@@ -817,7 +826,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
- if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_COUNT)
- rc = dlpar_cpu_remove_by_count(count);
- else if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_INDEX)
-- rc = dlpar_cpu_remove_by_index(drc_index);
-+ rc = dlpar_cpu_remove_by_index(drc_index, true);
- else
- rc = -EINVAL;
- break;
-@@ -825,7 +834,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
- if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_COUNT)
- rc = dlpar_cpu_add_by_count(count);
- else if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_INDEX)
-- rc = dlpar_cpu_add(drc_index);
-+ rc = dlpar_cpu_add(drc_index, true);
- else
- rc = -EINVAL;
- break;
-@@ -850,7 +859,7 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
- if (rc)
- return -EINVAL;
-
-- rc = dlpar_cpu_add(drc_index);
-+ rc = dlpar_cpu_add(drc_index, true);
-
- return rc ? rc : count;
- }
-@@ -871,7 +880,7 @@ static ssize_t dlpar_cpu_release(const char *buf, size_t count)
- return -EINVAL;
- }
-
-- rc = dlpar_cpu_remove(dn, drc_index);
-+ rc = dlpar_cpu_remove(dn, drc_index, true);
- of_node_put(dn);
-
- return rc ? rc : count;
---
-2.13.7
-
diff --git a/patches.arch/hotplug-cpu-Provide-CPU-readd-operation.patch b/patches.arch/hotplug-cpu-Provide-CPU-readd-operation.patch
deleted file mode 100644
index a122c01173..0000000000
--- a/patches.arch/hotplug-cpu-Provide-CPU-readd-operation.patch
+++ /dev/null
@@ -1,113 +0,0 @@
-From 2c0cf6334f70f8c296d174ef5381b58f1e377a6d Mon Sep 17 00:00:00 2001
-From: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Date: Sun, 29 Jul 2018 08:19:24 -0500
-Subject: [PATCH 3/5] hotplug/cpu: Provide CPU readd operation
-
-References: FATE#325308
-Patch-mainline: submitted https://patchwork.ozlabs.org/cover/950609/
-
-powerpc/dlpar: Provide hotplug CPU 'readd by index' operation to
-support LPAR Post Migration state updates. When such changes are
-invoked by the PowerPC 'mobility' code, they will be queued up so
-that modifications to CPU properties will take place after the new
-property value is written to the device-tree.
-
-Signed-off-by: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Acked-by: Michal Suchanek <msuchanek@suse.de>
----
- arch/powerpc/platforms/pseries/hotplug-cpu.c | 58 ++++++++++++++++++++++++++++
- 1 file changed, 58 insertions(+)
-
-diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-index 47719274b21f..01507b11a7c1 100644
---- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
-+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-@@ -305,6 +305,36 @@ static int pseries_add_processor(struct device_node *np)
- return err;
- }
-
-+static int pseries_update_processor(struct of_reconfig_data *pr)
-+{
-+ int old_entries, new_entries, rc = 0;
-+ __be32 *old_assoc, *new_assoc;
-+
-+ /* We only handle changes due to 'ibm,associativity' property
-+ */
-+ old_assoc = pr->old_prop->value;
-+ old_entries = be32_to_cpu(*old_assoc++);
-+
-+ new_assoc = pr->prop->value;
-+ new_entries = be32_to_cpu(*new_assoc++);
-+
-+ if (old_entries == new_entries) {
-+ int sz = old_entries * sizeof(int);
-+
-+ if (memcmp(old_assoc, new_assoc, sz))
-+ rc = dlpar_queue_action(
-+ PSERIES_HP_ELOG_RESOURCE_CPU,
-+ PSERIES_HP_ELOG_ACTION_READD,
-+ pr->dn->phandle);
-+ } else {
-+ rc = dlpar_queue_action(PSERIES_HP_ELOG_RESOURCE_CPU,
-+ PSERIES_HP_ELOG_ACTION_READD,
-+ pr->dn->phandle);
-+ }
-+
-+ return rc;
-+}
-+
- /*
- * Update the present map for a cpu node which is going away, and set
- * the hard id in the paca(s) to -1 to be consistent with boot time
-@@ -646,6 +676,26 @@ static int dlpar_cpu_remove_by_index(u32 drc_index, bool release_drc)
- return rc;
- }
-
-+static int dlpar_cpu_readd_by_index(u32 drc_index)
-+{
-+ int rc = 0;
-+
-+ pr_info("Attempting to re-add CPU, drc index %x\n", drc_index);
-+
-+ rc = dlpar_cpu_remove_by_index(drc_index, false);
-+ if (!rc)
-+ rc = dlpar_cpu_add(drc_index, false);
-+
-+ if (rc)
-+ pr_info("Failed to update cpu at drc_index %lx\n",
-+ (unsigned long int)drc_index);
-+ else
-+ pr_info("CPU at drc_index %lx was updated\n",
-+ (unsigned long int)drc_index);
-+
-+ return rc;
-+}
-+
- static int find_dlpar_cpus_to_remove(u32 *cpu_drcs, int cpus_to_remove)
- {
- struct device_node *dn;
-@@ -836,6 +886,9 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
- else
- rc = -EINVAL;
- break;
-+ case PSERIES_HP_ELOG_ACTION_READD:
-+ rc = dlpar_cpu_readd_by_index(drc_index);
-+ break;
- default:
- pr_err("Invalid action (%d) specified\n", hp_elog->action);
- rc = -EINVAL;
-@@ -899,6 +952,11 @@ static int pseries_smp_notifier(struct notifier_block *nb,
- case OF_RECONFIG_DETACH_NODE:
- pseries_remove_processor(rd->dn);
- break;
-+ case OF_RECONFIG_UPDATE_PROPERTY:
-+ if (!strcmp(rd->dn->type, "cpu") &&
-+ !strcmp(rd->prop->name, "ibm,associativity"))
-+ pseries_update_processor(rd);
-+ break;
- }
- return notifier_from_errno(err);
- }
---
-2.13.7
-
diff --git a/patches.arch/hotplug-pmt-Update-topology-after-PMT.patch b/patches.arch/hotplug-pmt-Update-topology-after-PMT.patch
deleted file mode 100644
index c588189d15..0000000000
--- a/patches.arch/hotplug-pmt-Update-topology-after-PMT.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From 46492a0e634cc9d56c1dbb4502c54480e1fd8f7d Mon Sep 17 00:00:00 2001
-From: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Date: Sun, 29 Jul 2018 08:19:33 -0500
-Subject: [PATCH 5/5] hotplug/pmt: Update topology after PMT
-
-References: FATE#325308
-Patch-mainline: submitted https://patchwork.ozlabs.org/cover/950609/
-
-hotplug/pmt: Invoke rebuild_sched_domains before applying any CPU
-'readd' modifications. The call leads to arch_update_cpu_topology()
-which will recognize and report any changes to the CPU topology
-are now applied, and that the relevant system data structures are
-updated. It may also initialize nodes that were unused in the
-topology of the source migration system. This will avoid some
-locking synchronization issues that were observed during development
-of this patch set. Also, the addition of the explicit call ensures
-that such changes are made even when the automatic topology update
-worker, triggered by a timer, has been disabled.
-
-Signed-off-by: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Acked-by: Michal Suchanek <msuchanek@suse.de>
----
- arch/powerpc/platforms/pseries/dlpar.c | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
-index 9343dbcd2607..a361cfde73d4 100644
---- a/arch/powerpc/platforms/pseries/dlpar.c
-+++ b/arch/powerpc/platforms/pseries/dlpar.c
-@@ -16,6 +16,7 @@
- #include <linux/notifier.h>
- #include <linux/spinlock.h>
- #include <linux/cpu.h>
-+#include <linux/cpuset.h>
- #include <linux/slab.h>
- #include <linux/of.h>
-
-@@ -453,6 +454,17 @@ static int dlpar_pmt(struct pseries_hp_errorlog *work)
- {
- struct list_head *pos, *q;
-
-+ /* Rebuild the domains and init any memoryless nodes
-+ * first to avoid later sync issues with CPU readd.
-+ */
-+ rebuild_sched_domains();
-+ msleep(100);
-+ /* Ensure that the worker for rebuild_sched_domains
-+ * has the opportunity to actually begin work as we
-+ * don't want it delayed by the CPU readd hotplug
-+ * locking.
-+ */
-+
- list_for_each_safe(pos, q, &dlpar_delayed_list) {
- struct pseries_hp_errorlog *tmp;
-
---
-2.13.7
-
diff --git a/patches.arch/mobility-numa-Ensure-numa-update-does-not-overlap.patch b/patches.arch/mobility-numa-Ensure-numa-update-does-not-overlap.patch
deleted file mode 100644
index 54cd56d6be..0000000000
--- a/patches.arch/mobility-numa-Ensure-numa-update-does-not-overlap.patch
+++ /dev/null
@@ -1,70 +0,0 @@
-From 5eb3f7cb759dd5746b9be5fc7523761829b26048 Mon Sep 17 00:00:00 2001
-From: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Date: Sun, 29 Jul 2018 08:19:28 -0500
-Subject: [PATCH 4/5] mobility/numa: Ensure numa update does not overlap
-
-References: FATE#325308
-Patch-mainline: submitted https://patchwork.ozlabs.org/cover/950609/
-
-mobility/numa: Ensure that numa_update_cpu_topology() can not be
-entered multiple times concurrently. It may be accessed through
-many different paths through the code. Without some protection
-against multiple entry, the code may acquire and update associativity
-information from the PHYP in multiple threads, and apply changes
-separately in each thread. Applying the changes concurrently may
-perform considerable work multiple times, but more importantly,
-may acquire locks in other modules concurrently and end up blocking
-each of the competing threads. This patch allows only the first
-entrant to the code to execute the operation and to recognize any
-CPU topology changes.
-
-Signed-off-by: Michael Bringmann <mwb@linux.vnet.ibm.com>
-Acked-by: Michal Suchanek <msuchanek@suse.de>
----
- arch/powerpc/mm/numa.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
-index 5a0a09fbb134..833beb84052a 100644
---- a/arch/powerpc/mm/numa.c
-+++ b/arch/powerpc/mm/numa.c
-@@ -1072,6 +1072,7 @@ static int prrn_enabled;
- static void reset_topology_timer(void);
- static int topology_timer_secs = 1;
- static int topology_inited;
-+static struct mutex topology_update_lock;
-
- /*
- * Change polling interval for associativity changes.
-@@ -1310,6 +1311,11 @@ int numa_update_cpu_topology(bool cpus_locked)
- if (!updates)
- return 0;
-
-+ if (!mutex_trylock(&topology_update_lock)) {
-+ kfree(updates);
-+ return 0;
-+ }
-+
- cpumask_clear(&updated_cpus);
-
- for_each_cpu(cpu, &cpu_associativity_changes_mask) {
-@@ -1413,6 +1419,7 @@ int numa_update_cpu_topology(bool cpus_locked)
-
- out:
- kfree(updates);
-+ mutex_unlock(&topology_update_lock);
- return changed;
- }
-
-@@ -1597,6 +1604,8 @@ static const struct file_operations topology_ops = {
-
- static int topology_update_init(void)
- {
-+ mutex_init(&topology_update_lock);
-+
- /* Do not poll for changes if disabled at boot */
- if (topology_updates_enabled)
- start_topology_update();
---
-2.13.7
-
diff --git a/patches.arch/powerpc-pseries-Perform-full-re-add-of-CPU-for-topol.patch b/patches.arch/powerpc-pseries-Perform-full-re-add-of-CPU-for-topol.patch
new file mode 100644
index 0000000000..6a69eee6ee
--- /dev/null
+++ b/patches.arch/powerpc-pseries-Perform-full-re-add-of-CPU-for-topol.patch
@@ -0,0 +1,113 @@
+From 81b61324922c67f73813d8a9c175f3c153f6a1c6 Mon Sep 17 00:00:00 2001
+From: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Date: Mon, 29 Oct 2018 13:43:36 -0500
+Subject: [PATCH] powerpc/pseries: Perform full re-add of CPU for topology
+ update post-migration
+
+References: bsc#1125728, FATE#325308
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: 81b61324922c67f73813d8a9c175f3c153f6a1c6
+
+On pseries systems, performing a partition migration can result in
+altering the nodes a CPU is assigned to on the destination system. For
+exampl, pre-migration on the source system CPUs are in node 1 and 3,
+post-migration on the destination system CPUs are in nodes 2 and 3.
+
+Handling the node change for a CPU can cause corruption in the slab
+cache if we hit a timing where a CPUs node is changed while cache_reap()
+is invoked. The corruption occurs because the slab cache code appears
+to rely on the CPU and slab cache pages being on the same node.
+
+The current dynamic updating of a CPUs node done in arch/powerpc/mm/numa.c
+does not prevent us from hitting this scenario.
+
+Changing the device tree property update notification handler that
+recognizes an affinity change for a CPU to do a full DLPAR remove and
+add of the CPU instead of dynamically changing its node resolves this
+issue.
+
+Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Michael W. Bringmann <mwb@linux.vnet.ibm.com>
+Tested-by: Michael W. Bringmann <mwb@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/topology.h | 2 ++
+ arch/powerpc/mm/numa.c | 9 +--------
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 19 +++++++++++++++++++
+ 3 files changed, 22 insertions(+), 8 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h
+index a4a718dbfec6..f85e2b01c3df 100644
+--- a/arch/powerpc/include/asm/topology.h
++++ b/arch/powerpc/include/asm/topology.h
+@@ -132,6 +132,8 @@ static inline void shared_proc_topology_init(void) {}
+ #define topology_sibling_cpumask(cpu) (per_cpu(cpu_sibling_map, cpu))
+ #define topology_core_cpumask(cpu) (per_cpu(cpu_core_map, cpu))
+ #define topology_core_id(cpu) (cpu_to_core_id(cpu))
++
++int dlpar_cpu_readd(int cpu);
+ #endif
+ #endif
+
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 87f0dd004295..b5d1c45c1475 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -1460,13 +1460,6 @@ static void reset_topology_timer(void)
+
+ #ifdef CONFIG_SMP
+
+-static void stage_topology_update(int core_id)
+-{
+- cpumask_or(&cpu_associativity_changes_mask,
+- &cpu_associativity_changes_mask, cpu_sibling_mask(core_id));
+- reset_topology_timer();
+-}
+-
+ static int dt_update_callback(struct notifier_block *nb,
+ unsigned long action, void *data)
+ {
+@@ -1479,7 +1472,7 @@ static int dt_update_callback(struct notifier_block *nb,
+ !of_prop_cmp(update->prop->name, "ibm,associativity")) {
+ u32 core_id;
+ of_property_read_u32(update->dn, "reg", &core_id);
+- stage_topology_update(core_id);
++ rc = dlpar_cpu_readd(core_id);
+ rc = NOTIFY_OK;
+ }
+ break;
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 2f8e62163602..97feb6e79f1a 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -802,6 +802,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+ return rc;
+ }
+
++int dlpar_cpu_readd(int cpu)
++{
++ struct device_node *dn;
++ struct device *dev;
++ u32 drc_index;
++ int rc;
++
++ dev = get_cpu_device(cpu);
++ dn = dev->of_node;
++
++ rc = of_property_read_u32(dn, "ibm,my-drc-index", &drc_index);
++
++ rc = dlpar_cpu_remove_by_index(drc_index);
++ if (!rc)
++ rc = dlpar_cpu_add(drc_index);
++
++ return rc;
++}
++
+ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
+ {
+ u32 count, drc_index;
+--
+2.20.1
+
diff --git a/patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch b/patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
new file mode 100644
index 0000000000..97742509ed
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
@@ -0,0 +1,209 @@
+From c0ca5eced22215c1e03e3ad479f8fab0bbb30772 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 20 Feb 2019 16:15:45 +0100
+Subject: [PATCH] ALSA: hda/realtek - Reduce click noise on Dell Precision 5820
+ headphone
+Git-commit: c0ca5eced22215c1e03e3ad479f8fab0bbb30772
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1126131
+
+Dell Precision 5820 with ALC3234 codec (which is equivalent with
+ALC255) shows click noises at (runtime) PM resume on the headphone.
+The biggest source of the noise comes from the cleared headphone pin
+control at resume, which is done via the standard shutup procedure.
+
+Although we have an override of the standard shutup callback to
+replace with NOP, this would skip other needed stuff (e.g. the pull
+down of headset power). So, instead, this "fixes" the behavior of
+alc_fixup_no_shutup() by introducing spec->no_shutup_pins flag.
+When this flag is set, Realtek codec won't call the standard
+snd_hda_shutup_pins() & co. Now alc_fixup_no_shutup() just sets this
+flag instead of overriding spec->shutup callback itself. This allows
+us to apply the similar fix for other entries easily if needed in
+future.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 57 +++++++++++++++++++++++++-----------------
+ 1 file changed, 34 insertions(+), 23 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -122,6 +122,7 @@ struct alc_spec {
+ unsigned int has_alc5505_dsp:1;
+ unsigned int no_depop_delay:1;
+ unsigned int done_hp_init:1;
++ unsigned int no_shutup_pins:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -484,6 +485,14 @@ static void alc_auto_setup_eapd(struct h
+ set_eapd(codec, *p, on);
+ }
+
++static void alc_shutup_pins(struct hda_codec *codec)
++{
++ struct alc_spec *spec = codec->spec;
++
++ if (!spec->no_shutup_pins)
++ snd_hda_shutup_pins(codec);
++}
++
+ /* generic shutup callback;
+ * just turning off EAPD and a little pause for avoiding pop-noise
+ */
+@@ -494,7 +503,7 @@ static void alc_eapd_shutup(struct hda_c
+ alc_auto_setup_eapd(codec, false);
+ if (!spec->no_depop_delay)
+ msleep(200);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ /* generic EAPD initialization */
+@@ -855,7 +864,7 @@ static inline void alc_shutup(struct hda
+ if (spec && spec->shutup)
+ spec->shutup(codec);
+ else
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_reboot_notify(struct hda_codec *codec)
+@@ -2923,7 +2932,7 @@ static void alc269_shutup(struct hda_cod
+ (alc_get_coef0(codec) & 0x00ff) == 0x018) {
+ msleep(150);
+ }
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static struct coef_fw alc282_coefs[] = {
+@@ -3026,14 +3035,15 @@ static void alc282_shutup(struct hda_cod
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x78, coef78);
+ }
+
+@@ -3139,15 +3149,16 @@ static void alc283_shutup(struct hda_cod
+ if (hp_pin_sense)
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+ if (hp_pin_sense)
+ msleep(100);
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ alc_write_coef_idx(codec, 0x43, 0x9614);
+ }
+
+@@ -3213,14 +3224,15 @@ static void alc256_shutup(struct hda_cod
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc225_init(struct hda_codec *codec)
+@@ -3307,7 +3319,7 @@ static void alc225_shutup(struct hda_cod
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc_default_init(struct hda_codec *codec)
+@@ -3361,14 +3373,15 @@ static void alc_default_shutup(struct hd
+ if (hp_pin_sense)
+ msleep(85);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ if (hp_pin_sense)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+- snd_hda_shutup_pins(codec);
++ alc_shutup_pins(codec);
+ }
+
+ static void alc294_hp_init(struct hda_codec *codec)
+@@ -3385,8 +3398,9 @@ static void alc294_hp_init(struct hda_co
+
+ msleep(100);
+
+- snd_hda_codec_write(codec, hp_pin, 0,
+- AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
++ if (!spec->no_shutup_pins)
++ snd_hda_codec_write(codec, hp_pin, 0,
++ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+ alc_update_coef_idx(codec, 0x6f, 0x000f, 0);/* Set HP depop to manual mode */
+ alc_update_coefex_idx(codec, 0x58, 0x00, 0x8000, 0x8000); /* HP depop procedure start */
+@@ -5047,16 +5061,12 @@ static void alc_fixup_auto_mute_via_amp(
+ }
+ }
+
+-static void alc_no_shutup(struct hda_codec *codec)
+-{
+-}
+-
+ static void alc_fixup_no_shutup(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
+ if (action == HDA_FIXUP_ACT_PROBE) {
+ struct alc_spec *spec = codec->spec;
+- spec->shutup = alc_no_shutup;
++ spec->no_shutup_pins = 1;
+ }
+ }
+
+@@ -6652,6 +6662,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1028, 0x0704, "Dell XPS 13 9350", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x0706, "Dell Inspiron 7559", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
+ SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
++ SND_PCI_QUIRK(0x1028, 0x0738, "Dell Precision 5820", ALC269_FIXUP_NO_SHUTUP),
+ SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
+ SND_PCI_QUIRK(0x1028, 0x075c, "Dell XPS 27 7760", ALC298_FIXUP_SPK_VOLUME),
+ SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
diff --git a/patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch b/patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch
new file mode 100644
index 0000000000..2ab9276320
--- /dev/null
+++ b/patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch
@@ -0,0 +1,43 @@
+From 96d7cb932e826219ec41ac02e5af037ffae6098c Mon Sep 17 00:00:00 2001
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Tue, 29 Jan 2019 16:34:04 +0800
+Subject: [PATCH] floppy: check_events callback should not return a negative number
+Git-commit: 96d7cb932e826219ec41ac02e5af037ffae6098c
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+floppy_check_events() is supposed to return bit flags to say which
+events occured. We should return zero to say that no event flags are
+set. Only BIT(0) and BIT(1) are used in the caller. And .check_events
+interface also expect to return an unsigned int value.
+
+However, after commit a0c80efe5956, it may return -EINTR (-4u).
+Here, both BIT(0) and BIT(1) are cleared. So this patch shouldn't
+affect runtime, but it obviously is still worth fixing.
+
+Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
+Fixes: a0c80efe5956 ("floppy: fix lock_fdc() signal handling")
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/block/floppy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 6f2856c6d0f2..55481b40df9a 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -4075,7 +4075,7 @@ static unsigned int floppy_check_events(struct gendisk *disk,
+
+ if (time_after(jiffies, UDRS->last_checked + UDP->checkfreq)) {
+ if (lock_fdc(drive))
+- return -EINTR;
++ return 0;
+ poll_drive(false, 0);
+ process_fd_request();
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch b/patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch
new file mode 100644
index 0000000000..b42321bb97
--- /dev/null
+++ b/patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch
@@ -0,0 +1,71 @@
+From f275a4659484716259cc46268d9043424e51cf0f Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Date: Thu, 27 Dec 2018 16:42:25 +0100
+Subject: [PATCH] i2c: bcm2835: Clear current buffer pointers and counts after a transfer
+Git-commit: f275a4659484716259cc46268d9043424e51cf0f
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+The driver's interrupt handler checks whether a message is currently
+being handled with the curr_msg pointer. When it is NULL, the interrupt
+is considered to be unexpected. Similarly, the i2c_start_transfer
+routine checks for the remaining number of messages to handle in
+num_msgs.
+
+However, these values are never cleared and always keep the message and
+number relevant to the latest transfer (which might be done already and
+the underlying message memory might have been freed).
+
+When an unexpected interrupt hits with the DONE bit set, the isr will
+then try to access the flags field of the curr_msg structure, leading
+to a fatal page fault.
+
+The msg_buf and msg_buf_remaining fields are also never cleared at the
+end of the transfer, which can lead to similar pitfalls.
+
+Fix these issues by introducing a cleanup function and always calling
+it after a transfer is finished.
+
+Fixes: e2474541032d ("i2c: bcm2835: Fix hang for writing messages larger than 16 bytes")
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Acked-by: Stefan Wahren <stefan.wahren@i2se.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-bcm2835.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c
+index ec6e69aa3a8e..d2fbb4bb4a43 100644
+--- a/drivers/i2c/busses/i2c-bcm2835.c
++++ b/drivers/i2c/busses/i2c-bcm2835.c
+@@ -183,6 +183,15 @@ static void bcm2835_i2c_start_transfer(struct bcm2835_i2c_dev *i2c_dev)
+ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C, c);
+ }
+
++static void bcm2835_i2c_finish_transfer(struct bcm2835_i2c_dev *i2c_dev)
++{
++ i2c_dev->curr_msg = NULL;
++ i2c_dev->num_msgs = 0;
++
++ i2c_dev->msg_buf = NULL;
++ i2c_dev->msg_buf_remaining = 0;
++}
++
+ /*
+ * Note about I2C_C_CLEAR on error:
+ * The I2C_C_CLEAR on errors will take some time to resolve -- if you were in
+@@ -283,6 +292,9 @@ static int bcm2835_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
+
+ time_left = wait_for_completion_timeout(&i2c_dev->completion,
+ adap->timeout);
++
++ bcm2835_i2c_finish_transfer(i2c_dev);
++
+ if (!time_left) {
+ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_C,
+ BCM2835_I2C_C_CLEAR);
+--
+2.16.4
+
diff --git a/patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch b/patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch
new file mode 100644
index 0000000000..108ef8617a
--- /dev/null
+++ b/patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch
@@ -0,0 +1,58 @@
+From d358def706880defa4c9e87381c5bf086a97d5f9 Mon Sep 17 00:00:00 2001
+From: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+Date: Tue, 5 Feb 2019 16:42:53 +0530
+Subject: [PATCH] i2c: cadence: Fix the hold bit setting
+Git-commit: d358def706880defa4c9e87381c5bf086a97d5f9
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+In case the hold bit is not needed we are carrying the old values.
+Fix the same by resetting the bit when not needed.
+
+Fixes the sporadic i2c bus lockups on National Instruments
+Zynq-based devices.
+
+Fixes: df8eb5691c48 ("i2c: Add driver for Cadence I2C controller")
+Reported-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Acked-by: Michal Simek <michal.simek@xilinx.com>
+Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
+Tested-by: Kyle Roeschley <kyle.roeschley@ni.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/i2c/busses/i2c-cadence.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
+index b13605718291..d917cefc5a19 100644
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -382,8 +382,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if (id->recv_count > CDNS_I2C_FIFO_DEPTH)
++ if ((id->recv_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
++ else
++ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
+
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+@@ -440,8 +442,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id)
+ * Check for the message size against FIFO depth and set the
+ * 'hold bus' bit if it is greater than FIFO depth.
+ */
+- if (id->send_count > CDNS_I2C_FIFO_DEPTH)
++ if ((id->send_count > CDNS_I2C_FIFO_DEPTH) || id->bus_hold_flag)
+ ctrl_reg |= CDNS_I2C_CR_HOLD;
++ else
++ ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD;
++
+ cdns_i2c_writereg(ctrl_reg, CDNS_I2C_CR_OFFSET);
+
+ /* Clear the interrupts in interrupt status register. */
+--
+2.16.4
+
diff --git a/patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch b/patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch
new file mode 100644
index 0000000000..5253d11f75
--- /dev/null
+++ b/patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch
@@ -0,0 +1,54 @@
+From a74515604a7b171f2702bdcbd1e231225fb456d0 Mon Sep 17 00:00:00 2001
+From: Anderson Luiz Alves <alacn1@gmail.com>
+Date: Fri, 30 Nov 2018 21:58:36 -0200
+Subject: [PATCH] mv88e6060: disable hardware level MAC learning
+Git-commit: a74515604a7b171f2702bdcbd1e231225fb456d0
+Patch-mainline: v4.20-rc6
+References: bsc#1051510
+
+Disable hardware level MAC learning because it breaks station roaming.
+When enabled it drops all frames that arrive from a MAC address
+that is on a different port at learning table.
+
+Signed-off-by: Anderson Luiz Alves <alacn1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/dsa/mv88e6060.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c
+index 65f10fec25b3..0b3e51f248c2 100644
+--- a/drivers/net/dsa/mv88e6060.c
++++ b/drivers/net/dsa/mv88e6060.c
+@@ -116,8 +116,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds)
+ /* Reset the switch. */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+ GLOBAL_ATU_CONTROL_SWRESET |
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ /* Wait up to one second for reset to complete. */
+ timeout = jiffies + 1 * HZ;
+@@ -142,13 +141,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds)
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536);
+
+- /* Enable automatic address learning, set the address
+- * database size to 1024 entries, and set the default aging
+- * time to 5 minutes.
++ /* Disable automatic address learning.
+ */
+ REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL,
+- GLOBAL_ATU_CONTROL_ATUSIZE_1024 |
+- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN);
++ GLOBAL_ATU_CONTROL_LEARNDIS);
+
+ return 0;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/nvme_fc-fix-ctrl-create-failures-racing-with-workq-i.patch b/patches.drivers/nvme_fc-fix-ctrl-create-failures-racing-with-workq-i.patch
index b988724b84..95c2e8b991 100644
--- a/patches.drivers/nvme_fc-fix-ctrl-create-failures-racing-with-workq-i.patch
+++ b/patches.drivers/nvme_fc-fix-ctrl-create-failures-racing-with-workq-i.patch
@@ -2,7 +2,7 @@ From cf25809bec2c7df4b45df5b2196845d9a4a3c89b Mon Sep 17 00:00:00 2001
From: James Smart <jsmart2021@gmail.com>
Date: Tue, 13 Mar 2018 09:48:07 -0700
Subject: [PATCH] nvme_fc: fix ctrl create failures racing with workq items
-Git-commit: 041018c634e44d8697879b241e17a9466f2e83ed
+Git-commit: cf25809bec2c7df4b45df5b2196845d9a4a3c89b
Patch-Mainline: v4.17-rc1
References: bsc#1083750
diff --git a/patches.drivers/of-numa-Validate-some-distance-map-rules.patch b/patches.drivers/of-numa-Validate-some-distance-map-rules.patch
new file mode 100644
index 0000000000..1766f57b42
--- /dev/null
+++ b/patches.drivers/of-numa-Validate-some-distance-map-rules.patch
@@ -0,0 +1,84 @@
+From 89c38422e072bb453e3045b8f1b962a344c3edea Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Thu, 8 Nov 2018 18:17:03 +0800
+Subject: [PATCH] of, numa: Validate some distance map rules
+Git-commit: 89c38422e072bb453e3045b8f1b962a344c3edea
+Patch-mainline: v4.20-rc2
+References: bsc#1051510
+
+Currently the NUMA distance map parsing does not validate the distance
+table for the distance-matrix rules 1-2 in [1].
+
+However the arch NUMA code may enforce some of these rules, but not all.
+Such is the case for the arm64 port, which does not enforce the rule that
+the distance between separates nodes cannot equal LOCAL_DISTANCE.
+
+The patch adds the following rules validation:
+- distance of node to self equals LOCAL_DISTANCE
+- distance of separate nodes > LOCAL_DISTANCE
+
+This change avoids a yet-unresolved crash reported in [2].
+
+A note on dealing with symmetrical distances between nodes:
+
+Validating symmetrical distances between nodes is difficult. If it were
+mandated in the bindings that every distance must be recorded in the
+table, then it would be easy. However, it isn't.
+
+In addition to this, it is also possible to record [b, a] distance only
+(and not [a, b]). So, when processing the table for [b, a], we cannot
+assert that current distance of [a, b] != [b, a] as invalid, as [a, b]
+distance may not be present in the table and current distance would be
+default at REMOTE_DISTANCE.
+
+As such, we maintain the policy that we overwrite distance [a, b] = [b, a]
+for b > a. This policy is different to kernel ACPI SLIT validation, which
+allows non-symmetrical distances (ACPI spec SLIT rules allow it). However,
+the distance debug message is dropped as it may be misleading (for a distance
+which is later overwritten).
+
+Some final notes on semantics:
+
+- It is implied that it is the responsibility of the arch NUMA code to
+ reset the NUMA distance map for an error in distance map parsing.
+
+- It is the responsibility of the FW NUMA topology parsing (whether OF or
+ ACPI) to enforce NUMA distance rules, and not arch NUMA code.
+
+[1] Documents/devicetree/bindings/numa.txt
+[2] https://www.spinics.net/lists/arm-kernel/msg683304.html
+
+Cc: stable@vger.kernel.org # 4.7
+Signed-off-by: John Garry <john.garry@huawei.com>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/of/of_numa.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c
+index 35c64a4295e0..fe6b13608e51 100644
+--- a/drivers/of/of_numa.c
++++ b/drivers/of/of_numa.c
+@@ -104,9 +104,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map)
+ distance = of_read_number(matrix, 1);
+ matrix++;
+
++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) ||
++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) {
++ pr_err("Invalid distance[node%d -> node%d] = %d\n",
++ nodea, nodeb, distance);
++ return -EINVAL;
++ }
++
+ numa_set_distance(nodea, nodeb, distance);
+- pr_debug("distance[node%d -> node%d] = %d\n",
+- nodea, nodeb, distance);
+
+ /* Set default distance of node B->A same as A->B */
+ if (nodeb > nodea)
+--
+2.16.4
+
diff --git a/patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch b/patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch
new file mode 100644
index 0000000000..f2f0895c9f
--- /dev/null
+++ b/patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch
@@ -0,0 +1,123 @@
+From 8894891446c9380709451b99ab45c5c53adfd2fc Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 25 Sep 2018 21:06:24 -0700
+Subject: [PATCH] of: unittest: Disable interrupt node tests for old world MAC systems
+Git-commit: 8894891446c9380709451b99ab45c5c53adfd2fc
+Patch-mainline: v4.19-rc8
+References: bsc#1051510
+
+On systems with OF_IMAP_OLDWORLD_MAC set in of_irq_workarounds, the
+devicetree interrupt parsing code is different, causing unit tests of
+devicetree interrupt nodes to fail. Due to a bug in unittest code, which
+tries to dereference an uninitialized pointer, this results in a crash.
+
+Of: /testcase-data/phandle-tests/consumer-a: arguments longer than property
+Unable to handle kernel paging request for data at address 0x00bc616e
+Faulting instruction address: 0xc08e9468
+Oops: Kernel access of bad area, sig: 11 [#1]
+BE PREEMPT PowerMac
+Modules linked in:
+Cpu: 0 PID: 1 Comm: swapper Not tainted 4.14.72-rc1-yocto-standard+ #1
+Task: cf8e0000 task.stack: cf8da000
+Nip: c08e9468 LR: c08ea5bc CTR: c08ea5ac
+Regs: cf8dbb50 TRAP: 0300 Not tainted (4.14.72-rc1-yocto-standard+)
+Msr: 00001032 <ME,IR,DR,RI> CR: 82004044 XER: 00000000
+Dar: 00bc616e DSISR: 40000000
+Gpr00: c08ea5bc cf8dbc00 cf8e0000 c13ca517 c13ca517 c13ca8a0 00000066 00000002
+Gpr08: 00000063 00bc614e c0b05865 000affff 82004048 00000000 c00047f0 00000000
+Gpr16: c0a80000 c0a9cc34 c13ca517 c0ad1134 05ffffff 000affff c0b05860 c0abeef8
+Gpr24: cecec278 cecec278 c0a8c4d0 c0a885e0 c13ca8a0 05ffffff c13ca8a0 c13ca517
+
+NIP [c08e9468] device_node_gen_full_name+0x30/0x15c
+LR [c08ea5bc] device_node_string+0x190/0x3c8
+Call Trace:
+[cf8dbc00] [c007f670] trace_hardirqs_on_caller+0x118/0x1fc (unreliable)
+[cf8dbc40] [c08ea5bc] device_node_string+0x190/0x3c8
+[cf8dbcb0] [c08eb794] pointer+0x25c/0x4d0
+[cf8dbd00] [c08ebcbc] vsnprintf+0x2b4/0x5ec
+[cf8dbd60] [c08ec00c] vscnprintf+0x18/0x48
+[cf8dbd70] [c008e268] vprintk_store+0x4c/0x22c
+[cf8dbda0] [c008ecac] vprintk_emit+0x94/0x130
+[cf8dbdd0] [c008ff54] printk+0x5c/0x6c
+[cf8dbe10] [c0b8ddd4] of_unittest+0x2220/0x26f8
+[cf8dbea0] [c0004434] do_one_initcall+0x4c/0x184
+[cf8dbf00] [c0b4534c] kernel_init_freeable+0x13c/0x1d8
+[cf8dbf30] [c0004814] kernel_init+0x24/0x118
+[cf8dbf40] [c0013398] ret_from_kernel_thread+0x5c/0x64
+
+The problem was observed when running a qemu test for the g3beige machine
+with devicetree unittests enabled.
+
+Disable interrupt node tests on affected systems to avoid both false
+unittest failures and the crash.
+
+With this patch in place, unittest on the affected system passes with
+the following message.
+
+ dt-test ### end of unittest - 144 passed, 0 failed
+
+Fixes: 53a42093d96ef ("of: Add device tree selftests")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Frank Rowand <frank.rowand@sony.com>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/of/unittest.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
+index 722537e14848..41b49716ac75 100644
+--- a/drivers/of/unittest.c
++++ b/drivers/of/unittest.c
+@@ -771,6 +771,9 @@ static void __init of_unittest_parse_interrupts(void)
+ struct of_phandle_args args;
+ int i, rc;
+
++ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)
++ return;
++
+ np = of_find_node_by_path("/testcase-data/interrupts/interrupts0");
+ if (!np) {
+ pr_err("missing testcase data\n");
+@@ -845,6 +848,9 @@ static void __init of_unittest_parse_interrupts_extended(void)
+ struct of_phandle_args args;
+ int i, rc;
+
++ if (of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)
++ return;
++
+ np = of_find_node_by_path("/testcase-data/interrupts/interrupts-extended0");
+ if (!np) {
+ pr_err("missing testcase data\n");
+@@ -1001,15 +1007,19 @@ static void __init of_unittest_platform_populate(void)
+ pdev = of_find_device_by_node(np);
+ unittest(pdev, "device 1 creation failed\n");
+
+- irq = platform_get_irq(pdev, 0);
+- unittest(irq == -EPROBE_DEFER, "device deferred probe failed - %d\n", irq);
++ if (!(of_irq_workarounds & OF_IMAP_OLDWORLD_MAC)) {
++ irq = platform_get_irq(pdev, 0);
++ unittest(irq == -EPROBE_DEFER,
++ "device deferred probe failed - %d\n", irq);
+
+- /* Test that a parsing failure does not return -EPROBE_DEFER */
+- np = of_find_node_by_path("/testcase-data/testcase-device2");
+- pdev = of_find_device_by_node(np);
+- unittest(pdev, "device 2 creation failed\n");
+- irq = platform_get_irq(pdev, 0);
+- unittest(irq < 0 && irq != -EPROBE_DEFER, "device parsing error failed - %d\n", irq);
++ /* Test that a parsing failure does not return -EPROBE_DEFER */
++ np = of_find_node_by_path("/testcase-data/testcase-device2");
++ pdev = of_find_device_by_node(np);
++ unittest(pdev, "device 2 creation failed\n");
++ irq = platform_get_irq(pdev, 0);
++ unittest(irq < 0 && irq != -EPROBE_DEFER,
++ "device parsing error failed - %d\n", irq);
++ }
+
+ np = of_find_node_by_path("/testcase-data/platform-tests");
+ unittest(np, "No testcase data in device tree\n");
+--
+2.16.4
+
diff --git a/patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch b/patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch
new file mode 100644
index 0000000000..9f778f09d9
--- /dev/null
+++ b/patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch
@@ -0,0 +1,74 @@
+From d7119224bfe6e8efbf821a52db7da9530d790f07 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 19 Jan 2018 17:25:41 +0800
+Subject: [PATCH] phy: allwinner: sun4i-usb: poll vbus changes on A23/A33 when driving VBUS
+Git-commit: d7119224bfe6e8efbf821a52db7da9530d790f07
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+The AXP223 PMIC, like the AXP221, does not generate VBUS change
+interrupts when N_VBUSEN is used to drive VBUS for the OTG port
+on the board.
+
+This was not noticed until recently, as most A23/A33 boards use
+a GPIO pin that does not support interrupts for OTG ID detection.
+This forces the driver to use polling. However the A33-OlinuXino
+uses a pin that does support interrupts, so the driver uses them.
+However the VBUS interrupt never fires, and the driver never gets
+to update the VBUS status. This results in musb timing out waiting
+for VBUS to rise.
+
+This was worked around for the AXP221 by resorting to polling
+changes in commit 91d96f06a760 ("phy-sun4i-usb: Add workaround for
+missing Vbus det interrupts on A31"). This patch adds the A23 and
+A33 to the list of SoCs that need the workaround.
+
+Fixes: fc1f45ed3043 ("phy-sun4i-usb: Add support for the usb-phys on the sun8i-a33 SoC")
+Fixes: 123dfdbcfaf5 ("phy-sun4i-usb: Add support for the usb-phys on the sun8i-a23 SoC")
+Cc: <stable@vger.kernel.org> # 4.3.x: 68dbc2ce77bb phy-sun4i-usb: Use of_match_node to get model specific config data
+Cc: <stable@vger.kernel.org> # 4.3.x: 5cf700ac9d50 phy: phy-sun4i-usb: Fix optional gpios failing probe
+Cc: <stable@vger.kernel.org> # 4.3.x: 04e59a0211ff phy-sun4i-usb: Fix irq free conditions to match request conditions
+Cc: <stable@vger.kernel.org> # 4.3.x: 91d96f06a760 phy-sun4i-usb: Add workaround for missing Vbus det interrupts on A31
+Cc: <stable@vger.kernel.org> # 4.3.x
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index bee798892b21..d4dcd39b8d76 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -411,11 +411,13 @@ static bool sun4i_usb_phy0_poll(struct sun4i_usb_phy_data *data)
+ return true;
+
+ /*
+- * The A31 companion pmic (axp221) does not generate vbus change
+- * interrupts when the board is driving vbus, so we must poll
++ * The A31/A23/A33 companion pmics (AXP221/AXP223) do not
++ * generate vbus change interrupts when the board is driving
++ * vbus using the N_VBUSEN pin on the pmic, so we must poll
+ * when using the pmic for vbus-det _and_ we're driving vbus.
+ */
+- if (data->cfg->type == sun6i_a31_phy &&
++ if ((data->cfg->type == sun6i_a31_phy ||
++ data->cfg->type == sun8i_a33_phy) &&
+ data->vbus_power_supply && data->phys[0].regulator_on)
+ return true;
+
+@@ -886,7 +888,7 @@ static const struct sun4i_usb_phy_cfg sun7i_a20_cfg = {
+
+ static const struct sun4i_usb_phy_cfg sun8i_a23_cfg = {
+ .num_phys = 2,
+- .type = sun4i_a10_phy,
++ .type = sun6i_a31_phy,
+ .disc_thresh = 3,
+ .phyctl_offset = REG_PHYCTL_A10,
+ .dedicated_clocks = true,
+--
+2.16.4
+
diff --git a/patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch b/patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch
new file mode 100644
index 0000000000..7760bcc7ee
--- /dev/null
+++ b/patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch
@@ -0,0 +1,88 @@
+From 8387c576b713bf677d59b7f16be64adb6b2de660 Mon Sep 17 00:00:00 2001
+From: Vivek Gautam <vivek.gautam@codeaurora.org>
+Date: Tue, 20 Jun 2017 11:27:18 +0530
+Subject: [PATCH] phy: qcom-qmp: Fix failure path in phy_init functions
+Git-commit: 8387c576b713bf677d59b7f16be64adb6b2de660
+Patch-mainline: v4.14-rc1
+References: bsc#1051510
+
+Fixing the clk enable failure path in qcom_qmp_phy_init()
+and cleanup the reset control deassertion failure path in
+qcom_qmp_phy_com_init().
+
+Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
+
+Cc: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Vivek Gautam <vivek.gautam@codeaurora.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/qualcomm/phy-qcom-qmp.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index 0c6cb8819200..e17f0351ccc2 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -775,8 +775,6 @@ static int qcom_qmp_phy_com_init(struct qcom_qmp *qmp)
+ if (ret) {
+ dev_err(qmp->dev, "%s reset deassert failed\n",
+ qmp->cfg->reset_list[i]);
+- while (--i >= 0)
+- reset_control_assert(qmp->resets[i]);
+ goto err_rst;
+ }
+ }
+@@ -805,7 +803,7 @@ static int qcom_qmp_phy_com_init(struct qcom_qmp *qmp)
+ if (ret) {
+ dev_err(qmp->dev,
+ "phy common block init timed-out\n");
+- goto err_com_init;
++ goto err_rst;
+ }
+ }
+
+@@ -813,11 +811,11 @@ static int qcom_qmp_phy_com_init(struct qcom_qmp *qmp)
+
+ return 0;
+
+-err_com_init:
++err_rst:
+ while (--i >= 0)
+ reset_control_assert(qmp->resets[i]);
+-err_rst:
+ mutex_unlock(&qmp->phy_mutex);
++
+ return ret;
+ }
+
+@@ -870,14 +868,13 @@ static int qcom_qmp_phy_init(struct phy *phy)
+ if (ret) {
+ dev_err(qmp->dev, "failed to enable %s clk, err=%d\n",
+ qmp->cfg->clk_list[i], ret);
+- while (--i >= 0)
+- clk_disable_unprepare(qmp->clks[i]);
++ goto err_clk;
+ }
+ }
+
+ ret = qcom_qmp_phy_com_init(qmp);
+ if (ret)
+- goto err_com_init;
++ goto err_clk;
+
+ if (cfg->has_lane_rst) {
+ ret = reset_control_deassert(qphy->lane_rst);
+@@ -925,7 +922,7 @@ static int qcom_qmp_phy_init(struct phy *phy)
+ reset_control_assert(qphy->lane_rst);
+ err_lane_rst:
+ qcom_qmp_phy_com_exit(qmp);
+-err_com_init:
++err_clk:
+ while (--i >= 0)
+ clk_disable_unprepare(qmp->clks[i]);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch b/patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch
new file mode 100644
index 0000000000..8805d1f273
--- /dev/null
+++ b/patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch
@@ -0,0 +1,76 @@
+From f8ba22a39e985c93e278709b1d5f20857a26b49b Mon Sep 17 00:00:00 2001
+From: Vivek Gautam <vivek.gautam@codeaurora.org>
+Date: Tue, 16 Jan 2018 16:26:56 +0530
+Subject: [PATCH] phy: qcom-qmp: Fix phy pipe clock gating
+Git-commit: f8ba22a39e985c93e278709b1d5f20857a26b49b
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Pipe clock comes out of the phy and is available as long as
+the phy is turned on. Clock controller fails to gate this
+clock after the phy is turned off and generates a warning.
+
+/ # [ 33.048561] gcc_usb3_phy_pipe_clk status stuck at 'on'
+[ 33.048585] ------------[ cut here ]------------
+[ 33.052621] WARNING: CPU: 1 PID: 18 at ../drivers/clk/qcom/clk-branch.c:97 clk_branch_wait+0xf0/0x108
+[ 33.057384] Modules linked in:
+[ 33.066497] CPU: 1 PID: 18 Comm: kworker/1:0 Tainted: G W 4.12.0-rc7-00024-gfe926e34c36d-dirty #96
+[ 33.069451] Hardware name: Qualcomm Technologies, Inc. DB820c (DT)
+...
+[ 33.278565] [<ffff00000849b27c>] clk_branch_wait+0xf0/0x108
+[ 33.286375] [<ffff00000849b2f4>] clk_branch2_disable+0x28/0x34
+[ 33.291761] [<ffff0000084868dc>] clk_core_disable+0x5c/0x88
+[ 33.297660] [<ffff000008487d68>] clk_core_disable_lock+0x20/0x34
+[ 33.303129] [<ffff000008487d98>] clk_disable+0x1c/0x24
+[ 33.309384] [<ffff0000083ccd78>] qcom_qmp_phy_poweroff+0x20/0x48
+[ 33.314328] [<ffff0000083c53f4>] phy_power_off+0x80/0xdc
+[ 33.320492] [<ffff00000875c950>] dwc3_core_exit+0x94/0xa0
+[ 33.325784] [<ffff00000875c9ac>] dwc3_suspend_common+0x50/0x60
+[ 33.331080] [<ffff00000875ca04>] dwc3_runtime_suspend+0x48/0x6c
+[ 33.336810] [<ffff0000085b82f4>] pm_generic_runtime_suspend+0x28/0x38
+[ 33.342627] [<ffff0000085bace0>] __rpm_callback+0x150/0x254
+[ 33.349222] [<ffff0000085bae08>] rpm_callback+0x24/0x78
+[ 33.354604] [<ffff0000085b9fd8>] rpm_suspend+0xe0/0x4e4
+[ 33.359813] [<ffff0000085bb784>] pm_runtime_work+0xdc/0xf0
+[ 33.365028] [<ffff0000080d7b30>] process_one_work+0x12c/0x28c
+[ 33.370576] [<ffff0000080d7ce8>] worker_thread+0x58/0x3b8
+[ 33.376393] [<ffff0000080dd4a8>] kthread+0x100/0x12c
+[ 33.381776] [<ffff0000080836c0>] ret_from_fork+0x10/0x50
+
+Fix this by disabling it as the first thing in phy_exit().
+
+Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
+Signed-off-by: Vivek Gautam <vivek.gautam@codeaurora.org>
+Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/qualcomm/phy-qcom-qmp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c
+index e17f0351ccc2..2526971f9929 100644
+--- a/drivers/phy/qualcomm/phy-qcom-qmp.c
++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c
+@@ -751,8 +751,6 @@ static int qcom_qmp_phy_poweroff(struct phy *phy)
+ struct qmp_phy *qphy = phy_get_drvdata(phy);
+ struct qcom_qmp *qmp = qphy->qmp;
+
+- clk_disable_unprepare(qphy->pipe_clk);
+-
+ regulator_bulk_disable(qmp->cfg->num_vregs, qmp->vregs);
+
+ return 0;
+@@ -936,6 +934,8 @@ static int qcom_qmp_phy_exit(struct phy *phy)
+ const struct qmp_phy_cfg *cfg = qmp->cfg;
+ int i = cfg->num_clks;
+
++ clk_disable_unprepare(qphy->pipe_clk);
++
+ /* PHY reset */
+ qphy_setbits(qphy->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch b/patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
new file mode 100644
index 0000000000..5937e87154
--- /dev/null
+++ b/patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
@@ -0,0 +1,41 @@
+From 09938ea9d136243e8d1fed6d4d7a257764f28f6d Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 21 Sep 2018 20:53:18 +0900
+Subject: [PATCH] phy: renesas: rcar-gen3-usb2: fix vbus_ctrl for role sysfs
+Git-commit: 09938ea9d136243e8d1fed6d4d7a257764f28f6d
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+This patch fixes and issue that the vbus_ctrl is disabled by
+rcar_gen3_init_from_a_peri_to_a_host(), so a usb host cannot
+supply the vbus.
+
+Note that this condition will exit when the otg irq happens
+even if we don't apply this patch.
+
+Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index 3d57ea1e1437..a6db25c20e2c 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -195,7 +195,7 @@ static void rcar_gen3_init_from_a_peri_to_a_host(struct rcar_gen3_chan *ch)
+ val = readl(usb2_base + USB2_OBINTEN);
+ writel(val & ~USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+
+- rcar_gen3_enable_vbus_ctrl(ch, 0);
++ rcar_gen3_enable_vbus_ctrl(ch, 1);
+ rcar_gen3_init_for_host(ch);
+
+ writel(val | USB2_OBINT_BITS, usb2_base + USB2_OBINTEN);
+--
+2.16.4
+
diff --git a/patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch b/patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch
new file mode 100644
index 0000000000..cdb42ddaac
--- /dev/null
+++ b/patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch
@@ -0,0 +1,78 @@
+From a4781c2a74b249cad814ceea7272997bbd20051e Mon Sep 17 00:00:00 2001
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Thu, 11 Jan 2018 10:40:26 +0800
+Subject: [PATCH] phy: rockchip-emmc: retry calpad busy trimming
+Git-commit: a4781c2a74b249cad814ceea7272997bbd20051e
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+It turns out that 5us isn't enough for all cases, so let's
+retry some more times to wait for caldone.
+
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Tested-by: Ziyuan Xu <xzy.xu@rock-chips.com>
+Signed-off-by: Caesar Wang <wxt@rock-chips.com>
+Reviewed-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/rockchip/phy-rockchip-emmc.c | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/phy/rockchip/phy-rockchip-emmc.c b/drivers/phy/rockchip/phy-rockchip-emmc.c
+index f1b24f18e9b2..b0d10934413f 100644
+--- a/drivers/phy/rockchip/phy-rockchip-emmc.c
++++ b/drivers/phy/rockchip/phy-rockchip-emmc.c
+@@ -76,6 +76,10 @@
+ #define PHYCTRL_OTAPDLYSEL_MASK 0xf
+ #define PHYCTRL_OTAPDLYSEL_SHIFT 0x7
+
++#define PHYCTRL_IS_CALDONE(x) \
++ ((((x) >> PHYCTRL_CALDONE_SHIFT) & \
++ PHYCTRL_CALDONE_MASK) == PHYCTRL_CALDONE_DONE)
++
+ struct rockchip_emmc_phy {
+ unsigned int reg_offset;
+ struct regmap *reg_base;
+@@ -90,6 +94,7 @@ static int rockchip_emmc_phy_power(struct phy *phy, bool on_off)
+ unsigned int freqsel = PHYCTRL_FREQSEL_200M;
+ unsigned long rate;
+ unsigned long timeout;
++ int ret;
+
+ /*
+ * Keep phyctrl_pdb and phyctrl_endll low to allow
+@@ -160,17 +165,19 @@ static int rockchip_emmc_phy_power(struct phy *phy, bool on_off)
+ PHYCTRL_PDB_SHIFT));
+
+ /*
+- * According to the user manual, it asks driver to
+- * wait 5us for calpad busy trimming
++ * According to the user manual, it asks driver to wait 5us for
++ * calpad busy trimming. However it is documented that this value is
++ * PVT(A.K.A process,voltage and temperature) relevant, so some
++ * failure cases are found which indicates we should be more tolerant
++ * to calpad busy trimming.
+ */
+- udelay(5);
+- regmap_read(rk_phy->reg_base,
+- rk_phy->reg_offset + GRF_EMMCPHY_STATUS,
+- &caldone);
+- caldone = (caldone >> PHYCTRL_CALDONE_SHIFT) & PHYCTRL_CALDONE_MASK;
+- if (caldone != PHYCTRL_CALDONE_DONE) {
+- pr_err("rockchip_emmc_phy_power: caldone timeout.\n");
+- return -ETIMEDOUT;
++ ret = regmap_read_poll_timeout(rk_phy->reg_base,
++ rk_phy->reg_offset + GRF_EMMCPHY_STATUS,
++ caldone, PHYCTRL_IS_CALDONE(caldone),
++ 0, 50);
++ if (ret) {
++ pr_err("%s: caldone failed, ret=%d\n", __func__, ret);
++ return ret;
+ }
+
+ /* Set the frequency of the DLL operation */
+--
+2.16.4
+
diff --git a/patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch b/patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch
new file mode 100644
index 0000000000..6d06de5f45
--- /dev/null
+++ b/patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch
@@ -0,0 +1,57 @@
+From 2659392e5c08dff626e6db1d739adff58a94604d Mon Sep 17 00:00:00 2001
+From: Icenowy Zheng <icenowy@aosc.io>
+Date: Thu, 4 Oct 2018 20:28:47 +0800
+Subject: [PATCH] phy: sun4i-usb: add support for missing USB PHY index
+Git-commit: 2659392e5c08dff626e6db1d739adff58a94604d
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+The new Allwinner H6 SoC's USB2 PHY has two holes -- USB1 (which is a
+3.0 port with dedicated PHY) and USB2 (which doesn't exist at all).
+
+Add support for this kind of missing USB PHY index.
+
+Signed-off-by: Icenowy Zheng <icenowy@aosc.io>
+Reviewed-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index d4dcd39b8d76..881078ff73f6 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -126,6 +126,7 @@ struct sun4i_usb_phy_cfg {
+ bool dedicated_clocks;
+ bool enable_pmu_unk1;
+ bool phy0_dual_route;
++ int missing_phys;
+ };
+
+ struct sun4i_usb_phy_data {
+@@ -646,6 +647,9 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev,
+ if (args->args[0] >= data->cfg->num_phys)
+ return ERR_PTR(-ENODEV);
+
++ if (data->cfg->missing_phys & BIT(args->args[0]))
++ return ERR_PTR(-ENODEV);
++
+ return data->phys[args->args[0]].phy;
+ }
+
+@@ -741,6 +745,9 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev)
+ struct sun4i_usb_phy *phy = data->phys + i;
+ char name[16];
+
++ if (data->cfg->missing_phys & BIT(i))
++ continue;
++
+ snprintf(name, sizeof(name), "usb%d_vbus", i);
+ phy->vbus = devm_regulator_get_optional(dev, name);
+ if (IS_ERR(phy->vbus)) {
+--
+2.16.4
+
diff --git a/patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch b/patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch
new file mode 100644
index 0000000000..efef6b8c48
--- /dev/null
+++ b/patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch
@@ -0,0 +1,84 @@
+From b7563e2796f8b23c98afcfea7363194227fa089d Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 12 Jan 2018 11:12:05 +0100
+Subject: [PATCH] phy: work around 'phys' references to usb-nop-xceiv devices
+Git-commit: b7563e2796f8b23c98afcfea7363194227fa089d
+Patch-mainline: v4.15-rc9
+References: bsc#1051510
+
+Stefan Wahren reports a problem with a warning fix that was merged
+for v4.15: we had lots of device nodes with a 'phys' property pointing
+to a device node that is not compliant with the binding documented in
+Documentation/devicetree/bindings/phy/phy-bindings.txt
+
+This generally works because USB HCD drivers that support both the generic
+phy subsystem and the older usb-phy subsystem ignore most errors from
+phy_get() and related calls and then use the usb-phy driver instead.
+
+However, it turns out that making the usb-nop-xceiv device compatible with
+the generic-phy binding changes the phy_get() return code from -EINVAL to
+-EPROBE_DEFER, and the dwc2 usb controller driver for bcm2835 now returns
+-EPROBE_DEFER from its probe function rather than ignoring the failure,
+breaking all USB support on raspberry-pi when CONFIG_GENERIC_PHY is
+enabled. The same code is used in the dwc3 driver and the usb_add_hcd()
+function, so a reasonable assumption would be that many other platforms
+are affected as well.
+
+I have reviewed all the related patches and concluded that "usb-nop-xceiv"
+is the only USB phy that is affected by the change, and since it is by far
+the most commonly referenced phy, all the other USB phy drivers appear
+to be used in ways that are are either safe in DT (they don't use the
+'phys' property), or in the driver (they already ignore -EPROBE_DEFER
+from generic-phy when usb-phy is available).
+
+To work around the problem, this adds a special case to _of_phy_get()
+so we ignore any PHY node that is compatible with "usb-nop-xceiv",
+as we know that this can never load no matter how much we defer. In the
+future, we might implement a generic-phy driver for "usb-nop-xceiv"
+and then remove this workaround.
+
+Since we generally want older kernels to also want to work with the
+fixed devicetree files, it would be good to backport the patch into
+stable kernels as well (3.13+ are possibly affected), even though they
+don't contain any of the patches that may have caused regressions.
+
+Fixes: 014d6da6cb25 ARM: dts: bcm283x: Fix DTC warnings about missing phy-cells
+Fixes: c5bbf358b790 arm: dts: nspire: Add missing #phy-cells to usb-nop-xceiv
+Fixes: 44e5dced2ef6 arm: dts: marvell: Add missing #phy-cells to usb-nop-xceiv
+Fixes: f568f6f554b8 ARM: dts: omap: Add missing #phy-cells to usb-nop-xceiv
+Fixes: d745d5f277bf ARM: dts: imx51-zii-rdu1: Add missing #phy-cells to usb-nop-xceiv
+Fixes: 915fbe59cbf2 ARM: dts: imx: Add missing #phy-cells to usb-nop-xceiv
+Link: https://marc.info/?l=linux-usb&m=151518314314753&w=2
+Link: https://patchwork.kernel.org/patch/10158145/
+Cc: stable@vger.kernel.org
+Cc: Felipe Balbi <balbi@kernel.org>
+Cc: Eric Anholt <eric@anholt.net>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Rob Herring <robh@kernel.org>
+Tested-by: Hans Verkuil <hans.verkuil@cisco.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/phy-core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index b4964b067aec..8f6e8e28996d 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -410,6 +410,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index)
+ if (ret)
+ return ERR_PTR(-ENODEV);
+
++ /* This phy type handled by the usb-phy subsystem for now */
++ if (of_device_is_compatible(args.np, "usb-nop-xceiv"))
++ return ERR_PTR(-ENODEV);
++
+ mutex_lock(&phy_provider_mutex);
+ phy_provider = of_phy_provider_lookup(args.np);
+ if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) {
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-Add-log-messages-to-aid-in-debugging-fc4ty.patch b/patches.drivers/scsi-lpfc-Add-log-messages-to-aid-in-debugging-fc4ty.patch
new file mode 100644
index 0000000000..df1f8db89a
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-Add-log-messages-to-aid-in-debugging-fc4ty.patch
@@ -0,0 +1,123 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 13 Dec 2018 15:17:56 -0800
+Subject: [PATCH] scsi: lpfc: Add log messages to aid in debugging fc4type
+ discovery issues
+Git-commit: 72ca6b2220ed24c0f7b0dd4e3617e82dcda60ef1
+Patch-mainline: v5.0-rc1
+References: bsc#1121317
+
+Current messages report generic actions (like send GID_FT), but misses
+reporting for what protocol type the action is taken.
+
+Revise the messages to reflect the FC4 protocol type being worked on.
+
+[mkp: typo]
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_ct.c | 48 ++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 45 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c
+index deef1a174165..552da8bf43e4 100644
+--- a/drivers/scsi/lpfc/lpfc_ct.c
++++ b/drivers/scsi/lpfc/lpfc_ct.c
+@@ -540,7 +540,17 @@ lpfc_ns_rsp_audit_did(struct lpfc_vport *vport, uint32_t Did, uint8_t fc4_type)
+ struct lpfc_hba *phba = vport->phba;
+ struct lpfc_nodelist *ndlp = NULL;
+ struct Scsi_Host *shost = lpfc_shost_from_vport(vport);
++ char *str;
+
++ if (phba->cfg_ns_query == LPFC_NS_QUERY_GID_FT)
++ str = "GID_FT";
++ else
++ str = "GID_PT";
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
++ "6430 Process %s rsp for %08x type %x %s %s\n",
++ str, Did, fc4_type,
++ (fc4_type == FC_TYPE_FCP) ? "FCP" : " ",
++ (fc4_type == FC_TYPE_NVME) ? "NVME" : " ");
+ /*
+ * To conserve rpi's, filter out addresses for other
+ * vports on the same physical HBAs.
+@@ -1049,6 +1059,13 @@ lpfc_cmpl_ct_cmd_gff_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ CTrsp = (struct lpfc_sli_ct_request *) outp->virt;
+ fbits = CTrsp->un.gff_acc.fbits[FCP_TYPE_FEATURE_OFFSET];
+
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
++ "6431 Process GFF_ID rsp for %08x "
++ "fbits %02x %s %s\n",
++ did, fbits,
++ (fbits & FC4_FEATURE_INIT) ? "Initiator" : " ",
++ (fbits & FC4_FEATURE_TARGET) ? "Target" : " ");
++
+ if (CTrsp->CommandResponse.bits.CmdRsp ==
+ be16_to_cpu(SLI_CT_RESPONSE_FS_ACC)) {
+ if ((fbits & FC4_FEATURE_INIT) &&
+@@ -1171,9 +1188,15 @@ lpfc_cmpl_ct_cmd_gft_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ CTrsp = (struct lpfc_sli_ct_request *)outp->virt;
+ fc4_data_0 = be32_to_cpu(CTrsp->un.gft_acc.fc4_types[0]);
+ fc4_data_1 = be32_to_cpu(CTrsp->un.gft_acc.fc4_types[1]);
++
+ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
+- "3062 DID x%06x GFT Wd0 x%08x Wd1 x%08x\n",
+- did, fc4_data_0, fc4_data_1);
++ "6432 Process GFT_ID rsp for %08x "
++ "Data %08x %08x %s %s\n",
++ did, fc4_data_0, fc4_data_1,
++ (fc4_data_0 & LPFC_FC4_TYPE_BITMASK) ?
++ "FCP" : " ",
++ (fc4_data_1 & LPFC_FC4_TYPE_BITMASK) ?
++ "NVME" : " ");
+
+ ndlp = lpfc_findnode_did(vport, did);
+ if (ndlp) {
+@@ -1504,6 +1527,7 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode,
+ struct ulp_bde64 *bpl;
+ void (*cmpl) (struct lpfc_hba *, struct lpfc_iocbq *,
+ struct lpfc_iocbq *) = NULL;
++ uint32_t *ptr;
+ uint32_t rsp_size = 1024;
+ size_t size;
+ int rc = 0;
+@@ -1642,8 +1666,18 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode,
+ */
+ if ((phba->cfg_enable_fc4_type == LPFC_ENABLE_BOTH) ||
+ (phba->cfg_enable_fc4_type == LPFC_ENABLE_NVME))
+- CtReq->un.rft.rsvd[0] = cpu_to_be32(0x00000100);
++ CtReq->un.rft.rsvd[0] =
++ cpu_to_be32(LPFC_FC4_TYPE_BITMASK);
+
++ ptr = (uint32_t *)CtReq;
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
++ "6433 Issue RFT (%s %s): %08x %08x %08x %08x "
++ "%08x %08x %08x %08x\n",
++ CtReq->un.rft.fcpReg ? "FCP" : " ",
++ CtReq->un.rft.rsvd[0] ? "NVME" : " ",
++ *ptr, *(ptr + 1), *(ptr + 2), *(ptr + 3),
++ *(ptr + 4), *(ptr + 5),
++ *(ptr + 6), *(ptr + 7));
+ cmpl = lpfc_cmpl_ct_cmd_rft_id;
+ break;
+
+@@ -1718,6 +1752,14 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode,
+ else
+ goto ns_cmd_free_bmpvirt;
+
++ ptr = (uint32_t *)CtReq;
++ lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY,
++ "6434 Issue RFF (%s): %08x %08x %08x %08x "
++ "%08x %08x %08x %08x\n",
++ (context == FC_TYPE_NVME) ? "NVME" : "FCP",
++ *ptr, *(ptr + 1), *(ptr + 2), *(ptr + 3),
++ *(ptr + 4), *(ptr + 5),
++ *(ptr + 6), *(ptr + 7));
+ cmpl = lpfc_cmpl_ct_cmd_rff_id;
+ break;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-Correct-MDS-loopback-diagnostics-support.patch b/patches.drivers/scsi-lpfc-Correct-MDS-loopback-diagnostics-support.patch
new file mode 100644
index 0000000000..05eaf28f8a
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-Correct-MDS-loopback-diagnostics-support.patch
@@ -0,0 +1,144 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 13 Dec 2018 15:17:53 -0800
+Subject: [PATCH] scsi: lpfc: Correct MDS loopback diagnostics support
+Git-commit: e817e5d7030c7fcc6e707dba7abe51ee5c47732f
+Patch-mainline: v5.0-rc1
+References: bsc#1121317
+
+The existing MDS loopback diagnostics support processing received frames in
+the slowpath work thread. It caps the number of frames it will process at
+64, before waiting for another event to indicate additional frame
+reception. The net-net is this results in very slow frame processing during
+loopback tests and sometimes orphans an io, causing the loopback test to
+report failure by the switch.
+
+Move MDS loopback frame processing out of the slow path worker thread and
+into the normal RQ processing routines.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 44 ++++++++++++++++++++++++++++++--------------
+ 1 file changed, 30 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 0065e1bdb0c0..113ffce1f7c1 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -13493,6 +13493,8 @@ lpfc_sli4_sp_handle_abort_xri_wcqe(struct lpfc_hba *phba,
+ return workposted;
+ }
+
++#define FC_RCTL_MDS_DIAGS 0xF4
++
+ /**
+ * lpfc_sli4_sp_handle_rcqe - Process a receive-queue completion queue entry
+ * @phba: Pointer to HBA context object.
+@@ -13546,6 +13548,14 @@ lpfc_sli4_sp_handle_rcqe(struct lpfc_hba *phba, struct lpfc_rcqe *rcqe)
+ /* If a NVME LS event (type 0x28), treat it as Fast path */
+ fc_hdr = (struct fc_frame_header *)dma_buf->hbuf.virt;
+
++ if (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS ||
++ fc_hdr->fh_r_ctl == FC_RCTL_DD_UNSOL_DATA) {
++ spin_unlock_irqrestore(&phba->hbalock, iflags);
++ /* Handle MDS Loopback frames */
++ lpfc_sli4_handle_mds_loopback(phba->pport, dma_buf);
++ break;
++ }
++
+ /* save off the frame for the word thread to process */
+ list_add_tail(&dma_buf->cq_event.list,
+ &phba->sli4_hba.sp_queue_event);
+@@ -16953,8 +16963,6 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
+ struct fc_vft_header *fc_vft_hdr;
+ uint32_t *header = (uint32_t *) fc_hdr;
+
+-#define FC_RCTL_MDS_DIAGS 0xF4
+-
+ switch (fc_hdr->fh_r_ctl) {
+ case FC_RCTL_DD_UNCAT: /* uncategorized information */
+ case FC_RCTL_DD_SOL_DATA: /* solicited data */
+@@ -16993,15 +17001,12 @@ lpfc_fc_frame_check(struct lpfc_hba *phba, struct fc_frame_header *fc_hdr)
+ goto drop;
+ }
+
+-#define FC_TYPE_VENDOR_UNIQUE 0xFF
+-
+ switch (fc_hdr->fh_type) {
+ case FC_TYPE_BLS:
+ case FC_TYPE_ELS:
+ case FC_TYPE_FCP:
+ case FC_TYPE_CT:
+ case FC_TYPE_NVME:
+- case FC_TYPE_VENDOR_UNIQUE:
+ break;
+ case FC_TYPE_IP:
+ case FC_TYPE_ILS:
+@@ -17831,6 +17836,7 @@ lpfc_sli4_mds_loopback_cmpl(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb,
+ dma_pool_free(phba->lpfc_drb_pool, pcmd->virt, pcmd->phys);
+ kfree(pcmd);
+ lpfc_sli_release_iocbq(phba, cmdiocb);
++ lpfc_drain_txq(phba);
+ }
+
+ static void
+@@ -17844,14 +17850,23 @@ lpfc_sli4_handle_mds_loopback(struct lpfc_vport *vport,
+ struct lpfc_dmabuf *pcmd = NULL;
+ uint32_t frame_len;
+ int rc;
++ unsigned long iflags;
+
+ fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+ frame_len = bf_get(lpfc_rcqe_length, &dmabuf->cq_event.cqe.rcqe_cmpl);
+
+ /* Send the received frame back */
+ iocbq = lpfc_sli_get_iocbq(phba);
+- if (!iocbq)
+- goto exit;
++ if (!iocbq) {
++ /* Queue cq event and wakeup worker thread to process it */
++ spin_lock_irqsave(&phba->hbalock, iflags);
++ list_add_tail(&dmabuf->cq_event.list,
++ &phba->sli4_hba.sp_queue_event);
++ phba->hba_flag |= HBA_SP_QUEUE_EVT;
++ spin_unlock_irqrestore(&phba->hbalock, iflags);
++ lpfc_worker_wake_up(phba);
++ return;
++ }
+
+ /* Allocate buffer for command payload */
+ pcmd = kmalloc(sizeof(struct lpfc_dmabuf), GFP_KERNEL);
+@@ -17936,6 +17951,14 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
+ /* Process each received buffer */
+ fc_hdr = (struct fc_frame_header *)dmabuf->hbuf.virt;
+
++ if (fc_hdr->fh_r_ctl == FC_RCTL_MDS_DIAGS ||
++ fc_hdr->fh_r_ctl == FC_RCTL_DD_UNSOL_DATA) {
++ vport = phba->pport;
++ /* Handle MDS Loopback frames */
++ lpfc_sli4_handle_mds_loopback(vport, dmabuf);
++ return;
++ }
++
+ /* check to see if this a valid type of frame */
+ if (lpfc_fc_frame_check(phba, fc_hdr)) {
+ lpfc_in_buf_free(phba, &dmabuf->dbuf);
+@@ -17950,13 +17973,6 @@ lpfc_sli4_handle_received_buffer(struct lpfc_hba *phba,
+ fcfi = bf_get(lpfc_rcqe_fcf_id,
+ &dmabuf->cq_event.cqe.rcqe_cmpl);
+
+- if (fc_hdr->fh_r_ctl == 0xF4 && fc_hdr->fh_type == 0xFF) {
+- vport = phba->pport;
+- /* Handle MDS Loopback frames */
+- lpfc_sli4_handle_mds_loopback(vport, dmabuf);
+- return;
+- }
+-
+ /* d_id this frame is directed to */
+ did = sli4_did_from_fc_hdr(fc_hdr);
+
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-Fix-discovery-failure-when-PLOGI-is-defere.patch b/patches.drivers/scsi-lpfc-Fix-discovery-failure-when-PLOGI-is-defere.patch
new file mode 100644
index 0000000000..c8b4a7f887
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-Fix-discovery-failure-when-PLOGI-is-defere.patch
@@ -0,0 +1,78 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 13 Dec 2018 15:17:55 -0800
+Subject: [PATCH] scsi: lpfc: Fix discovery failure when PLOGI is defered
+Git-commit: 00292e0306dc3b23e725acbc70fb0b2581b8b4b3
+Patch-mainline: v5.0-rc1
+References: bsc#1121317
+
+When a target's link dropped, an RSCN was received to communicate the
+change. The driver detected the loss of the target and issued and UNREG_RPI
+mailbox command. While that was being processed, another RSCN was received
+to communicate the port coming back. The driver deferred the PLOGI to the
+port until the mailbox command finishes. When the mailbox command completed
+it saw the pending port and called the routines to issue the
+PLOGI. However, it forgot to clear the UNREG_INP state flag, so the PLOGI
+xmt routine nooped the PLOGI request assuming it needed to wait for the
+mailbox command. At this point, login would never be re-attempted.
+
+Clear UNREG_INP before issuing the deferred PLOGI.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 2 ++
+ drivers/scsi/lpfc/lpfc_sli.c | 8 ++++++--
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 4c1ba88b678a..b183b882d506 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -4802,6 +4802,8 @@ lpfc_nlp_logo_unreg(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ ndlp->nlp_defer_did = NLP_EVT_NOTHING_PENDING;
+ lpfc_issue_els_plogi(vport, ndlp->nlp_DID, 0);
++ } else {
++ ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ }
+ }
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 77a2d9cb745d..f3cb6b4c52ff 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -2512,10 +2512,12 @@ lpfc_sli_def_mbox_cmpl(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+
+ if ((ndlp->nlp_flag & NLP_UNREG_INP) &&
+ (ndlp->nlp_defer_did != NLP_EVT_NOTHING_PENDING)) {
++ ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ ndlp->nlp_defer_did = NLP_EVT_NOTHING_PENDING;
+ lpfc_issue_els_plogi(vport, ndlp->nlp_DID, 0);
++ } else {
++ ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ }
+- ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ }
+ pmb->ctx_ndlp = NULL;
+ }
+@@ -2583,12 +2585,14 @@ lpfc_sli4_unreg_rpi_cmpl_clr(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
+ "NPort x%x Data: x%x %p\n",
+ ndlp->nlp_rpi, ndlp->nlp_DID,
+ ndlp->nlp_defer_did, ndlp);
++ ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ ndlp->nlp_defer_did =
+ NLP_EVT_NOTHING_PENDING;
+ lpfc_issue_els_plogi(
+ vport, ndlp->nlp_DID, 0);
++ } else {
++ ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ }
+- ndlp->nlp_flag &= ~NLP_UNREG_INP;
+ }
+ }
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-Fix-link-state-reporting-for-trunking-when.patch b/patches.drivers/scsi-lpfc-Fix-link-state-reporting-for-trunking-when.patch
new file mode 100644
index 0000000000..913af7a112
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-Fix-link-state-reporting-for-trunking-when.patch
@@ -0,0 +1,60 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 13 Dec 2018 15:17:52 -0800
+Subject: [PATCH] scsi: lpfc: Fix link state reporting for trunking when
+ adapter is offline
+Git-commit: 2977a09512c2867fba8b0e862cc96327dd93431d
+Patch-mainline: v5.0-rc1
+References: bsc#1121317
+
+If the adapter is taken offline, the trunk link port attributes continue to
+report trunk links as up even though all links are down as the adapter is
+offline.
+
+Clear the trunk links state as part of taking the adapter offline.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_hbadisc.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
+index 91189e9c8530..4c1ba88b678a 100644
+--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
+@@ -888,9 +888,15 @@ lpfc_linkdown(struct lpfc_hba *phba)
+ LPFC_MBOXQ_t *mb;
+ int i;
+
+- if (phba->link_state == LPFC_LINK_DOWN)
++ if (phba->link_state == LPFC_LINK_DOWN) {
++ if (phba->sli4_hba.conf_trunk) {
++ phba->trunk_link.link0.state = 0;
++ phba->trunk_link.link1.state = 0;
++ phba->trunk_link.link2.state = 0;
++ phba->trunk_link.link3.state = 0;
++ }
+ return 0;
+-
++ }
+ /* Block all SCSI stack I/Os */
+ lpfc_scsi_dev_block(phba);
+
+@@ -901,6 +907,12 @@ lpfc_linkdown(struct lpfc_hba *phba)
+ spin_unlock_irq(&phba->hbalock);
+ if (phba->link_state > LPFC_LINK_DOWN) {
+ phba->link_state = LPFC_LINK_DOWN;
++ if (phba->sli4_hba.conf_trunk) {
++ phba->trunk_link.link0.state = 0;
++ phba->trunk_link.link1.state = 0;
++ phba->trunk_link.link2.state = 0;
++ phba->trunk_link.link3.state = 0;
++ }
+ spin_lock_irq(shost->host_lock);
+ phba->pport->fc_flag &= ~FC_LBIT;
+ spin_unlock_irq(shost->host_lock);
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-Update-lpfc-version-to-12.0.0.10.patch b/patches.drivers/scsi-lpfc-Update-lpfc-version-to-12.0.0.10.patch
new file mode 100644
index 0000000000..bed081cc71
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-Update-lpfc-version-to-12.0.0.10.patch
@@ -0,0 +1,33 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 13 Dec 2018 15:17:58 -0800
+Subject: [PATCH] scsi: lpfc: Update lpfc version to 12.0.0.10
+Git-commit: 9e1f03e4d318d3e49d4db1d711eb652db727b844
+Patch-mainline: v5.0-rc1
+References: bsc#1121317
+
+Update lpfc version to 12.0.0.10
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_version.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h
+index 7b23895a7ed7..3f4398ffb567 100644
+--- a/drivers/scsi/lpfc/lpfc_version.h
++++ b/drivers/scsi/lpfc/lpfc_version.h
+@@ -20,7 +20,7 @@
+ * included with this package. *
+ *******************************************************************/
+
+-#define LPFC_DRIVER_VERSION "12.0.0.9"
++#define LPFC_DRIVER_VERSION "12.0.0.10"
+ #define LPFC_DRIVER_NAME "lpfc"
+
+ /* Used for SLI 2/3 */
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli.patch b/patches.drivers/scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli.patch
new file mode 100644
index 0000000000..235a38d88f
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli.patch
@@ -0,0 +1,40 @@
+From: "Ewan D. Milne" <emilne@redhat.com>
+Date: Thu, 13 Dec 2018 15:25:16 -0500
+Subject: [PATCH] scsi: lpfc: do not set queue->page_count to 0 if
+ pc_sli4_params.wqpcnt is invalid
+Patch-Mainline: v5.0-rc1
+Git-commit: 4e87eb2f46ea547d12a276b2e696ab934d16cfb6
+References: bsc#1121317
+
+Certain older adapters such as the OneConnect OCe10100 may not have a valid
+wqpcnt value. In this case, do not set queue->page_count to 0 in
+lpfc_sli4_queue_alloc() as this will prevent the driver from initializing.
+
+Fixes: 895427bd01 ("scsi: lpfc: NVME Initiator: Base modifications")
+Cc: stable@vger.kernel.org # 4.11+
+Signed-off-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Laurence Oberman <loberman@redhat.com>
+Tested-by: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 3826a32eec20..a810a15c9070 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -14575,7 +14575,8 @@ lpfc_sli4_queue_alloc(struct lpfc_hba *phba, uint32_t page_size,
+ hw_page_size))/hw_page_size;
+
+ /* If needed, Adjust page count to match the max the adapter supports */
+- if (queue->page_count > phba->sli4_hba.pc_sli4_params.wqpcnt)
++ if (phba->sli4_hba.pc_sli4_params.wqpcnt &&
++ (queue->page_count > phba->sli4_hba.pc_sli4_params.wqpcnt))
+ queue->page_count = phba->sli4_hba.pc_sli4_params.wqpcnt;
+
+ INIT_LIST_HEAD(&queue->list);
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-lpfc-update-fault-value-on-successful-trunk-eve.patch b/patches.drivers/scsi-lpfc-update-fault-value-on-successful-trunk-eve.patch
new file mode 100644
index 0000000000..b5fc800c12
--- /dev/null
+++ b/patches.drivers/scsi-lpfc-update-fault-value-on-successful-trunk-eve.patch
@@ -0,0 +1,63 @@
+From: James Smart <jsmart2021@gmail.com>
+Date: Thu, 13 Dec 2018 15:17:54 -0800
+Subject: [PATCH] scsi: lpfc: update fault value on successful trunk events.
+Git-commit: 529b3ddcfff580a2457eceeda9f248bc77c49246
+Patch-mainline: v5.0-rc1
+References: bsc#1121317
+
+Currently, when a trunk link goes down due to some fault, the driver
+snapshots the fault code. If the link then comes back up, meaning there is
+no fault, the driver is not clearing the fault code so the sysfs link_state
+entry reports old/stale data.
+
+Revise the logic so that on successful link up the fault code is cleared.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index c56ef73463f2..2b8baf190165 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -4707,29 +4707,25 @@ lpfc_update_trunk_link_status(struct lpfc_hba *phba,
+ phba->trunk_link.link0.state =
+ bf_get(lpfc_acqe_fc_la_trunk_link_status_port0, acqe_fc)
+ ? LPFC_LINK_UP : LPFC_LINK_DOWN;
+- if (port_fault & 0x1)
+- phba->trunk_link.link0.fault = err;
++ phba->trunk_link.link0.fault = port_fault & 0x1 ? err : 0;
+ }
+ if (bf_get(lpfc_acqe_fc_la_trunk_config_port1, acqe_fc)) {
+ phba->trunk_link.link1.state =
+ bf_get(lpfc_acqe_fc_la_trunk_link_status_port1, acqe_fc)
+ ? LPFC_LINK_UP : LPFC_LINK_DOWN;
+- if (port_fault & 0x2)
+- phba->trunk_link.link1.fault = err;
++ phba->trunk_link.link1.fault = port_fault & 0x2 ? err : 0;
+ }
+ if (bf_get(lpfc_acqe_fc_la_trunk_config_port2, acqe_fc)) {
+ phba->trunk_link.link2.state =
+ bf_get(lpfc_acqe_fc_la_trunk_link_status_port2, acqe_fc)
+ ? LPFC_LINK_UP : LPFC_LINK_DOWN;
+- if (port_fault & 0x4)
+- phba->trunk_link.link2.fault = err;
++ phba->trunk_link.link2.fault = port_fault & 0x4 ? err : 0;
+ }
+ if (bf_get(lpfc_acqe_fc_la_trunk_config_port3, acqe_fc)) {
+ phba->trunk_link.link3.state =
+ bf_get(lpfc_acqe_fc_la_trunk_link_status_port3, acqe_fc)
+ ? LPFC_LINK_UP : LPFC_LINK_DOWN;
+- if (port_fault & 0x8)
+- phba->trunk_link.link3.fault = err;
++ phba->trunk_link.link3.fault = port_fault & 0x8 ? err : 0;
+ }
+
+ lpfc_printf_log(phba, KERN_ERR, LOG_SLI,
+--
+2.16.4
+
diff --git a/patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch b/patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
new file mode 100644
index 0000000000..a7db868048
--- /dev/null
+++ b/patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
@@ -0,0 +1,39 @@
+From 2c0408dd0d8906b26fe8023889af7adf5e68b2c2 Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <shc_work@mail.ru>
+Date: Thu, 20 Dec 2018 11:06:38 +0300
+Subject: gpu: ipu-v3: Fix i.MX51 CSI control registers offset
+Git-commit: 2c0408dd0d8906b26fe8023889af7adf5e68b2c2
+Patch-mainline: v5.0-rc7
+References: bsc#1113722
+
+The CSI0/CSI1 registers offset is at +0xe030000/+0xe038000 relative
+to the control module registers on IPUv3EX.
+This patch fixes wrong values for i.MX51 CSI0/CSI1.
+
+Fixes: 2ffd48f2e7 ("gpu: ipu-v3: Add Camera Sensor Interface unit")
+
+Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/ipu-v3/ipu-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 474b00e19697..5b7cdbfe062f 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -898,8 +898,8 @@ static struct ipu_devtype ipu_type_imx51 = {
+ .cpmem_ofs = 0x1f000000,
+ .srm_ofs = 0x1f040000,
+ .tpm_ofs = 0x1f060000,
+- .csi0_ofs = 0x1f030000,
+- .csi1_ofs = 0x1f038000,
++ .csi0_ofs = 0x1e030000,
++ .csi1_ofs = 0x1e038000,
+ .ic_ofs = 0x1e020000,
+ .disp0_ofs = 0x1e040000,
+ .disp1_ofs = 0x1e048000,
+--
+2.20.1
+
diff --git a/patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch b/patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
new file mode 100644
index 0000000000..c7184d1897
--- /dev/null
+++ b/patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
@@ -0,0 +1,38 @@
+From bb867d219fda7fbaabea3314702474c4eac2b91d Mon Sep 17 00:00:00 2001
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Tue, 16 Oct 2018 17:31:40 -0700
+Subject: gpu: ipu-v3: Fix CSI offsets for imx53
+Git-commit: bb867d219fda7fbaabea3314702474c4eac2b91d
+Patch-mainline: v5.0-rc7
+References: bsc#1113722
+
+The CSI offsets are wrong for both CSI0 and CSI1. They are at
+physical address 0x1e030000 and 0x1e038000 respectively.
+
+Fixes: 2ffd48f2e7 ("gpu: ipu-v3: Add Camera Sensor Interface unit")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/ipu-v3/ipu-common.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/ipu-v3/ipu-common.c b/drivers/gpu/ipu-v3/ipu-common.c
+index 5b7cdbfe062f..0a7d4395d427 100644
+--- a/drivers/gpu/ipu-v3/ipu-common.c
++++ b/drivers/gpu/ipu-v3/ipu-common.c
+@@ -914,8 +914,8 @@ static struct ipu_devtype ipu_type_imx53 = {
+ .cpmem_ofs = 0x07000000,
+ .srm_ofs = 0x07040000,
+ .tpm_ofs = 0x07060000,
+- .csi0_ofs = 0x07030000,
+- .csi1_ofs = 0x07038000,
++ .csi0_ofs = 0x06030000,
++ .csi1_ofs = 0x06038000,
+ .ic_ofs = 0x06020000,
+ .disp0_ofs = 0x06040000,
+ .disp1_ofs = 0x06048000,
+--
+2.20.1
+
diff --git a/patches.drm/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch b/patches.drm/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
new file mode 100644
index 0000000000..475ac19238
--- /dev/null
+++ b/patches.drm/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
@@ -0,0 +1,169 @@
+From e8a8fedd57fdcebf0e4f24ef0fc7e29323df8e66 Mon Sep 17 00:00:00 2001
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 29 Jan 2019 14:09:59 -0500
+Subject: drm/i915: Block fbdev HPD processing during suspend
+Git-commit: e8a8fedd57fdcebf0e4f24ef0fc7e29323df8e66
+Patch-mainline: v5.0-rc7
+References: bsc#1113722
+
+When resuming, we check whether or not any previously connected
+MST topologies are still present and if so, attempt to resume them. If
+this fails, we disable said MST topologies and fire off a hotplug event
+so that userspace knows to reprobe.
+
+However, sending a hotplug event involves calling
+drm_fb_helper_hotplug_event(), which in turn results in fbcon doing a
+connector reprobe in the caller's thread - something we can't do at the
+point in which i915 calls drm_dp_mst_topology_mgr_resume() since
+hotplugging hasn't been fully initialized yet.
+
+This currently causes some rather subtle but fatal issues. For example,
+on my T480s the laptop dock connected to it usually disappears during a
+suspend cycle, and comes back up a short while after the system has been
+resumed. This guarantees pretty much every suspend and resume cycle,
+drm_dp_mst_topology_mgr_set_mst(mgr, false); will be caused and in turn,
+a connector hotplug will occur. Now it's Rute Goldberg time: when the
+connector hotplug occurs, i915 reprobes /all/ of the connectors,
+including eDP. However, eDP probing requires that we power on the panel
+VDD which in turn, grabs a wakeref to the appropriate power domain on
+the GPU (on my T480s, this is the PORT_DDI_A_IO domain). This is where
+things start breaking, since this all happens before
+intel_power_domains_enable() is called we end up leaking the wakeref
+that was acquired and never releasing it later. Come next suspend/resume
+cycle, this causes us to fail to shut down the GPU properly, which
+causes it not to resume properly and die a horrible complicated death.
+
+(as a note: this only happens when there's both an eDP panel and MST
+topology connected which is removed mid-suspend. One or the other seems
+to always be OK).
+
+We could try to fix the VDD wakeref leak, but this doesn't seem like
+it's worth it at all since we aren't able to handle hotplug detection
+while resuming anyway. So, let's go with a more robust solution inspired
+by nouveau: block fbdev from handling hotplug events until we resume
+fbdev. This allows us to still send sysfs hotplug events to be handled
+later by user space while we're resuming, while also preventing us from
+actually processing any hotplug events we receive until it's safe.
+
+This fixes the wakeref leak observed on the T480s and as such, also
+fixes suspend/resume with MST topologies connected on this machine.
+
+Changes since v2:
+* Don't call drm_fb_helper_hotplug_event() under lock, do it after lock
+ (Chris Wilson)
+* Don't call drm_fb_helper_hotplug_event() in
+ intel_fbdev_output_poll_changed() under lock (Chris Wilson)
+* Always set ifbdev->hpd_waiting (Chris Wilson)
+
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Fixes: 0e32b39ceed6 ("drm/i915: add DP 1.2 MST support (v0.7)")
+Cc: Todd Previte <tprevite@gmail.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: intel-gfx@lists.freedesktop.org
+Cc: <stable@vger.kernel.org> # v3.17+
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190129191001.442-2-lyude@redhat.com
+(cherry picked from commit fe5ec65668cdaa4348631d8ce1766eed43b33c10)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_drv.h | 10 ++++++++++
+ drivers/gpu/drm/i915/intel_fbdev.c | 32 ++++++++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -203,6 +203,16 @@ struct intel_fbdev {
+ struct i915_vma *vma;
+ async_cookie_t cookie;
+ int preferred_bpp;
++
++ /* Whether or not fbdev hpd processing is temporarily suspended */
++ bool hpd_suspended : 1;
++ /* Set when a hotplug was received while HPD processing was
++ * suspended
++ */
++ bool hpd_waiting : 1;
++
++ /* Protects hpd_suspended */
++ struct mutex hpd_lock;
+ };
+
+ struct intel_encoder {
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -672,6 +672,7 @@ int intel_fbdev_init(struct drm_device *
+ if (ifbdev == NULL)
+ return -ENOMEM;
+
++ mutex_init(&ifbdev->hpd_lock);
+ drm_fb_helper_prepare(dev, &ifbdev->helper, &intel_fb_helper_funcs);
+
+ if (!intel_fbdev_init_bios(dev, ifbdev))
+@@ -745,6 +746,26 @@ void intel_fbdev_fini(struct drm_i915_pr
+ intel_fbdev_destroy(ifbdev);
+ }
+
++/* Suspends/resumes fbdev processing of incoming HPD events. When resuming HPD
++ * processing, fbdev will perform a full connector reprobe if a hotplug event
++ * was received while HPD was suspended.
++ */
++static void intel_fbdev_hpd_set_suspend(struct intel_fbdev *ifbdev, int state)
++{
++ bool send_hpd = false;
++
++ mutex_lock(&ifbdev->hpd_lock);
++ ifbdev->hpd_suspended = state == FBINFO_STATE_SUSPENDED;
++ send_hpd = !ifbdev->hpd_suspended && ifbdev->hpd_waiting;
++ ifbdev->hpd_waiting = false;
++ mutex_unlock(&ifbdev->hpd_lock);
++
++ if (send_hpd) {
++ DRM_DEBUG_KMS("Handling delayed fbcon HPD event\n");
++ drm_fb_helper_hotplug_event(&ifbdev->helper);
++ }
++}
++
+ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+@@ -766,6 +787,7 @@ void intel_fbdev_set_suspend(struct drm_
+ */
+ if (state != FBINFO_STATE_RUNNING)
+ flush_work(&dev_priv->fbdev_suspend_work);
++
+ console_lock();
+ } else {
+ /*
+@@ -792,17 +814,27 @@ void intel_fbdev_set_suspend(struct drm_
+
+ drm_fb_helper_set_suspend(&ifbdev->helper, state);
+ console_unlock();
++
++ intel_fbdev_hpd_set_suspend(ifbdev, state);
+ }
+
+ void intel_fbdev_output_poll_changed(struct drm_device *dev)
+ {
+ struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
++ bool send_hpd;
+
+ if (!ifbdev)
+ return;
+
+ intel_fbdev_sync(ifbdev);
+ if (ifbdev->vma)
++
++ mutex_lock(&ifbdev->hpd_lock);
++ send_hpd = !ifbdev->hpd_suspended;
++ ifbdev->hpd_waiting = true;
++ mutex_unlock(&ifbdev->hpd_lock);
++
++ if (send_hpd && (ifbdev->vma || ifbdev->helper.deferred_setup))
+ drm_fb_helper_hotplug_event(&ifbdev->helper);
+ }
+
diff --git a/patches.drm/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch b/patches.drm/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
new file mode 100644
index 0000000000..5279f97203
--- /dev/null
+++ b/patches.drm/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
@@ -0,0 +1,70 @@
+From 2e7bd10e05afb866b5fb13eda25095c35d7a27cc Mon Sep 17 00:00:00 2001
+From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Date: Thu, 7 Feb 2019 10:54:53 +0200
+Subject: drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
+Git-commit: 2e7bd10e05afb866b5fb13eda25095c35d7a27cc
+Patch-mainline: v5.0-rc7
+References: bsc#1113722
+
+Make sure the underlying VMA in the process address space is the
+same as it was during vm_mmap to avoid applying WC to wrong VMA.
+
+A more long-term solution would be to have vm_mmap_locked variant
+in linux/mmap.h for when caller wants to hold mmap_sem for an
+extended duration.
+
+v2:
+- Refactor the compare function
+
+Fixes: 1816f9236303 ("drm/i915: Support creation of unbound wc user mappings for objects")
+Reported-by: Adam Zabrocki <adamza@microsoft.com>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v4.0+
+Cc: Akash Goel <akash.goel@intel.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
+Cc: Adam Zabrocki <adamza@microsoft.com>
+Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> #v1
+Link: https://patchwork.freedesktop.org/patch/msgid/20190207085454.10598-1-joonas.lahtinen@linux.intel.com
+(cherry picked from commit 5c4604e757ba9b193b09768d75a7d2105a5b883f)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/i915_gem.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 216f52b744a6..c882ea94172c 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1824,6 +1824,16 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
+ return 0;
+ }
+
++static inline bool
++__vma_matches(struct vm_area_struct *vma, struct file *filp,
++ unsigned long addr, unsigned long size)
++{
++ if (vma->vm_file != filp)
++ return false;
++
++ return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size;
++}
++
+ /**
+ * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address
+ * it is mapped to.
+@@ -1882,7 +1892,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data,
+ return -EINTR;
+ }
+ vma = find_vma(mm, addr);
+- if (vma)
++ if (vma && __vma_matches(vma, obj->base.filp, addr, args->size))
+ vma->vm_page_prot =
+ pgprot_writecombine(vm_get_page_prot(vma->vm_flags));
+ else
+--
+2.20.1
+
diff --git a/patches.drm/0005-drm-i915-opregion-fix-version-check.patch b/patches.drm/0005-drm-i915-opregion-fix-version-check.patch
new file mode 100644
index 0000000000..b0c40b34d7
--- /dev/null
+++ b/patches.drm/0005-drm-i915-opregion-fix-version-check.patch
@@ -0,0 +1,73 @@
+From fc89a38d99d4b1b33ca5b0e2329f5ddea02ecfb5 Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 8 Feb 2019 20:42:52 +0200
+Subject: drm/i915/opregion: fix version check
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: fc89a38d99d4b1b33ca5b0e2329f5ddea02ecfb5
+Patch-mainline: v5.0-rc7
+References: bsc#1113722
+
+The u32 version field encodes major, minor, revision and reserved. We've
+basically been checking for any non-zero version.
+
+Add opregion version logging while at it.
+
+v2: Fix the fix of the version check
+
+Fixes: 04ebaadb9f2d ("drm/i915/opregion: handle VBT sizes bigger than 6 KB")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190208184254.24123-1-jani.nikula@intel.com
+(cherry picked from commit 98fdaaca9537b997062f1abc0aa87c61b50ce40a)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_opregion.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index b8f106d9ecf8..3035b402973f 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -55,7 +55,12 @@
+ struct opregion_header {
+ u8 signature[16];
+ u32 size;
+- u32 opregion_ver;
++ struct {
++ u8 rsvd;
++ u8 revision;
++ u8 minor;
++ u8 major;
++ } __packed over;
+ u8 bios_ver[32];
+ u8 vbios_ver[16];
+ u8 driver_ver[16];
+@@ -925,6 +930,11 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
+ opregion->header = base;
+ opregion->lid_state = base + ACPI_CLID;
+
++ DRM_DEBUG_DRIVER("ACPI OpRegion version %u.%u.%u\n",
++ opregion->header->over.major,
++ opregion->header->over.minor,
++ opregion->header->over.revision);
++
+ mboxes = opregion->header->mboxes;
+ if (mboxes & MBOX_ACPI) {
+ DRM_DEBUG_DRIVER("Public ACPI methods supported\n");
+@@ -953,7 +963,7 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
+ if (dmi_check_system(intel_no_opregion_vbt))
+ goto out;
+
+- if (opregion->header->opregion_ver >= 2 && opregion->asle &&
++ if (opregion->header->over.major >= 2 && opregion->asle &&
+ opregion->asle->rvda && opregion->asle->rvds) {
+ opregion->rvda = memremap(opregion->asle->rvda,
+ opregion->asle->rvds,
+--
+2.20.1
+
diff --git a/patches.drm/0006-drm-i915-opregion-rvda-is-relative-from-opregion-bas.patch b/patches.drm/0006-drm-i915-opregion-rvda-is-relative-from-opregion-bas.patch
new file mode 100644
index 0000000000..e04d3c7cb7
--- /dev/null
+++ b/patches.drm/0006-drm-i915-opregion-rvda-is-relative-from-opregion-bas.patch
@@ -0,0 +1,90 @@
+From 16eb0f34cdf4cf04cd92762c7a79f98aa51e053f Mon Sep 17 00:00:00 2001
+From: Jani Nikula <jani.nikula@intel.com>
+Date: Fri, 8 Feb 2019 20:42:53 +0200
+Subject: drm/i915/opregion: rvda is relative from opregion base in opregion
+ 2.1+
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 16eb0f34cdf4cf04cd92762c7a79f98aa51e053f
+Patch-mainline: v5.0-rc7
+References: bsc#1113722
+
+Starting from opregion version 2.1 (roughly corresponding to ICL+) the
+RVDA field is relative from the beginning of opregion, not absolute
+address.
+
+Fix the error path while at it.
+
+v2: Make relative vs. absolute conditional on the opregion version,
+ bumped for the purpose. Turned out there are machines relying on
+ absolute RVDA in the wild.
+
+v3: Fix the version checks
+
+Fixes: 04ebaadb9f2d ("drm/i915/opregion: handle VBT sizes bigger than 6 KB")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190208184254.24123-2-jani.nikula@intel.com
+(cherry picked from commit a0f52c3d357af218a9c1f7cd906ab70426176a1a)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_opregion.c | 24 +++++++++++++++++++++---
+ 1 file changed, 21 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_opregion.c b/drivers/gpu/drm/i915/intel_opregion.c
+index 3035b402973f..3ac20153705a 100644
+--- a/drivers/gpu/drm/i915/intel_opregion.c
++++ b/drivers/gpu/drm/i915/intel_opregion.c
+@@ -124,7 +124,8 @@ struct opregion_asle {
+ u64 fdss;
+ u32 fdsp;
+ u32 stat;
+- u64 rvda; /* Physical address of raw vbt data */
++ u64 rvda; /* Physical (2.0) or relative from opregion (2.1+)
++ * address of raw VBT data. */
+ u32 rvds; /* Size of raw vbt data */
+ u8 rsvd[58];
+ } __packed;
+@@ -965,9 +966,24 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
+
+ if (opregion->header->over.major >= 2 && opregion->asle &&
+ opregion->asle->rvda && opregion->asle->rvds) {
+- opregion->rvda = memremap(opregion->asle->rvda,
+- opregion->asle->rvds,
++ resource_size_t rvda = opregion->asle->rvda;
++
++ /*
++ * opregion 2.0: rvda is the physical VBT address.
++ *
++ * opregion 2.1+: rvda is unsigned, relative offset from
++ * opregion base, and should never point within opregion.
++ */
++ if (opregion->header->over.major > 2 ||
++ opregion->header->over.minor >= 1) {
++ WARN_ON(rvda < OPREGION_SIZE);
++
++ rvda += asls;
++ }
++
++ opregion->rvda = memremap(rvda, opregion->asle->rvds,
+ MEMREMAP_WB);
++
+ vbt = opregion->rvda;
+ vbt_size = opregion->asle->rvds;
+ if (intel_bios_is_valid_vbt(vbt, vbt_size)) {
+@@ -977,6 +993,8 @@ int intel_opregion_setup(struct drm_i915_private *dev_priv)
+ goto out;
+ } else {
+ DRM_DEBUG_KMS("Invalid VBT in ACPI OpRegion (RVDA)\n");
++ memunmap(opregion->rvda);
++ opregion->rvda = NULL;
+ }
+ }
+
+--
+2.20.1
+
diff --git a/patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-parameter.patch b/patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-parameter.patch
new file mode 100644
index 0000000000..cb9ef11660
--- /dev/null
+++ b/patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-parameter.patch
@@ -0,0 +1,89 @@
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 14 Feb 2019 11:42:39 +0100
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git
+Git-commit: 357b4da50a62e2fd70eacee21cdbd22d4c7a7b60
+References: bsc#1117645
+Subject: x86: respect memory size limiting via mem= parameter
+
+When limiting memory size via kernel parameter "mem=" this should be
+respected even in case of memory made accessible via a PCI card.
+
+Today this kind of memory won't be made usable in initial memory
+setup as the memory won't be visible in E820 map, but it might be
+added when adding PCI devices due to corresponding ACPI table entries.
+
+Not respecting "mem=" can be corrected by adding a global max_mem_size
+variable set by parse_memopt() which will result in rejecting adding
+memory areas resulting in a memory size above the allowed limit.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Reviewed-by: William Kucharski <william.kucharski@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ arch/x86/kernel/e820.c | 5 +++++
+ include/linux/memory_hotplug.h | 2 ++
+ mm/memory_hotplug.c | 6 ++++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
+index 50895c2f937d..e67513e2cbbb 100644
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -15,6 +15,7 @@
+ #include <linux/firmware-map.h>
+ #include <linux/memblock.h>
+ #include <linux/sort.h>
++#include <linux/memory_hotplug.h>
+
+ #include <asm/e820/api.h>
+ #include <asm/setup.h>
+@@ -859,6 +860,10 @@ static int __init parse_memopt(char *p)
+
+ e820__range_remove(mem_size, ULLONG_MAX - mem_size, E820_TYPE_RAM, 1);
+
++#ifdef CONFIG_MEMORY_HOTPLUG
++ max_mem_size = mem_size;
++#endif
++
+ return 0;
+ }
+ early_param("mem", parse_memopt);
+diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
+index 368267c1b71b..cfd12078172a 100644
+--- a/include/linux/memory_hotplug.h
++++ b/include/linux/memory_hotplug.h
+@@ -114,6 +114,8 @@ extern void __online_page_free(struct page *page);
+
+ extern int try_online_node(int nid);
+
++extern u64 max_mem_size;
++
+ extern bool memhp_auto_online;
+
+ #ifdef CONFIG_MEMORY_HOTREMOVE
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 124e794867c5..519f9db063ff 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -156,10 +156,16 @@ void mem_hotplug_done(void)
+ mutex_unlock(&memory_add_remove_lock);
+ }
+
++u64 max_mem_size = U64_MAX;
++
+ /* add this memory to iomem resource */
+ static struct resource *register_memory_resource(u64 start, u64 size)
+ {
+ struct resource *res, *conflict;
++
++ if (start + size > max_mem_size)
++ return ERR_PTR(-E2BIG);
++
+ res = kzalloc(sizeof(struct resource), GFP_KERNEL);
+ if (!res)
+ return ERR_PTR(-ENOMEM);
+--
+2.16.4
+
diff --git a/patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocation.patch b/patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocation.patch
new file mode 100644
index 0000000000..ac80a7dd99
--- /dev/null
+++ b/patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocation.patch
@@ -0,0 +1,135 @@
+From: Juergen Gross <jgross@suse.com>
+Date: Thu, 14 Feb 2019 11:42:40 +0100
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip.git
+Git-commit: 1d988ed46543ca36c010634c97ac32114362ddb1
+References: bsc#1117645
+Subject: x86/xen: dont add memory above max allowed allocation
+
+Don't allow memory to be added above the allowed maximum allocation
+limit set by Xen.
+
+Trying to do so would result in cases like the following:
+
+[ 584.559652] ------------[ cut here ]------------
+[ 584.564897] WARNING: CPU: 2 PID: 1 at ../arch/x86/xen/multicalls.c:129 xen_alloc_pte+0x1c7/0x390()
+[ 584.575151] Modules linked in:
+[ 584.578643] Supported: Yes
+[ 584.581750] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.4.120-92.70-default #1
+[ 584.590000] Hardware name: Cisco Systems Inc UCSC-C460-M4/UCSC-C460-M4, BIOS C460M4.4.0.1b.0.0629181419 06/29/2018
+[ 584.601862] 0000000000000000 ffffffff813175a0 0000000000000000 ffffffff8184777c
+[ 584.610200] ffffffff8107f4e1 ffff880487eb7000 ffff8801862b79c0 ffff88048608d290
+[ 584.618537] 0000000000487eb7 ffffea0000000201 ffffffff81009de7 ffffffff81068561
+[ 584.626876] Call Trace:
+[ 584.629699] [<ffffffff81019ad9>] dump_trace+0x59/0x340
+[ 584.635645] [<ffffffff81019eaa>] show_stack_log_lvl+0xea/0x170
+[ 584.642391] [<ffffffff8101ac51>] show_stack+0x21/0x40
+[ 584.648238] [<ffffffff813175a0>] dump_stack+0x5c/0x7c
+[ 584.654085] [<ffffffff8107f4e1>] warn_slowpath_common+0x81/0xb0
+[ 584.660932] [<ffffffff81009de7>] xen_alloc_pte+0x1c7/0x390
+[ 584.667289] [<ffffffff810647f0>] pmd_populate_kernel.constprop.6+0x40/0x80
+[ 584.675241] [<ffffffff815ecfe8>] phys_pmd_init+0x210/0x255
+[ 584.681587] [<ffffffff815ed207>] phys_pud_init+0x1da/0x247
+[ 584.687931] [<ffffffff815edb3b>] kernel_physical_mapping_init+0xf5/0x1d4
+[ 584.695682] [<ffffffff815e9bdd>] init_memory_mapping+0x18d/0x380
+[ 584.702631] [<ffffffff81064699>] arch_add_memory+0x59/0xf0
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ arch/x86/xen/setup.c | 13 +++++++++++++
+ drivers/xen/xen-balloon.c | 11 +++++++++++
+ include/xen/xen.h | 4 ++++
+ 3 files changed, 28 insertions(+)
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index d5f303c0e656..548d1e0a5ba1 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -11,6 +11,7 @@
+ #include <linux/memblock.h>
+ #include <linux/cpuidle.h>
+ #include <linux/cpufreq.h>
++#include <linux/memory_hotplug.h>
+
+ #include <asm/elf.h>
+ #include <asm/vdso.h>
+@@ -593,6 +594,14 @@ static void __init xen_align_and_add_e820_region(phys_addr_t start,
+ if (type == E820_TYPE_RAM) {
+ start = PAGE_ALIGN(start);
+ end &= ~((phys_addr_t)PAGE_SIZE - 1);
++#ifdef CONFIG_MEMORY_HOTPLUG
++ /*
++ * Don't allow adding memory not in E820 map while booting the
++ * system. Once the balloon driver is up it will remove that
++ * restriction again.
++ */
++ max_mem_size = end;
++#endif
+ }
+
+ e820__range_add(start, end - start, type);
+@@ -752,6 +761,10 @@ char * __init xen_memory_setup(void)
+ memmap.nr_entries = ARRAY_SIZE(xen_e820_table.entries);
+ set_xen_guest_handle(memmap.buffer, xen_e820_table.entries);
+
++#if defined(CONFIG_MEMORY_HOTPLUG) && defined(CONFIG_XEN_BALLOON)
++ xen_saved_max_mem_size = max_mem_size;
++#endif
++
+ op = xen_initial_domain() ?
+ XENMEM_machine_memory_map :
+ XENMEM_memory_map;
+diff --git a/drivers/xen/xen-balloon.c b/drivers/xen/xen-balloon.c
+index 2acbfe104e46..a67236b02452 100644
+--- a/drivers/xen/xen-balloon.c
++++ b/drivers/xen/xen-balloon.c
+@@ -37,6 +37,7 @@
+ #include <linux/mm_types.h>
+ #include <linux/init.h>
+ #include <linux/capability.h>
++#include <linux/memory_hotplug.h>
+
+ #include <xen/xen.h>
+ #include <xen/interface/xen.h>
+@@ -49,6 +50,10 @@
+
+ #define BALLOON_CLASS_NAME "xen_memory"
+
++#ifdef CONFIG_MEMORY_HOTPLUG
++u64 xen_saved_max_mem_size = 0;
++#endif
++
+ static struct device balloon_dev;
+
+ static int register_balloon(struct device *dev);
+@@ -64,6 +67,12 @@ static void watch_target(struct xenbus_watch *watch,
+ static bool watch_fired;
+ static long target_diff;
+
++#ifdef CONFIG_MEMORY_HOTPLUG
++ /* The balloon driver will take care of adding memory now. */
++ if (xen_saved_max_mem_size)
++ max_mem_size = xen_saved_max_mem_size;
++#endif
++
+ err = xenbus_scanf(XBT_NIL, "memory", "target", "%llu", &new_target);
+ if (err != 1) {
+ /* This is ok (for domain0 at least) - so just return */
+diff --git a/include/xen/xen.h b/include/xen/xen.h
+index 0e2156786ad2..19d032373de5 100644
+--- a/include/xen/xen.h
++++ b/include/xen/xen.h
+@@ -36,4 +36,8 @@ xen_pvh_domain()
+ #define xen_pvh_domain() (0)
+ #endif
+
++#if defined(CONFIG_MEMORY_HOTPLUG) && defined(CONFIG_XEN_BALLOON)
++extern u64 xen_saved_max_mem_size;
++#endif
++
+ #endif /* _XEN_XEN_H */
+--
+2.16.4
+
diff --git a/patches.fixes/ARM-iop32x-n2100-fix-PCI-IRQ-mapping.patch b/patches.fixes/ARM-iop32x-n2100-fix-PCI-IRQ-mapping.patch
new file mode 100644
index 0000000000..958744bd35
--- /dev/null
+++ b/patches.fixes/ARM-iop32x-n2100-fix-PCI-IRQ-mapping.patch
@@ -0,0 +1,37 @@
+From db4090920ba2d61a5827a23e441447926a02ffee Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Fri, 25 Jan 2019 20:10:15 +0000
+Subject: [PATCH] ARM: iop32x/n2100: fix PCI IRQ mapping
+Git-commit: db4090920ba2d61a5827a23e441447926a02ffee
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+Booting 4.20 on a TheCUS N2100 results in a kernel oops while probing
+PCI, due to n2100_pci_map_irq() having been discarded during boot.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Cc: stable@vger.kernel.org # 2.6.18+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/arm/mach-iop32x/n2100.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/arm/mach-iop32x/n2100.c b/arch/arm/mach-iop32x/n2100.c
+index 3b73813c6b04..23e8c93515d4 100644
+--- a/arch/arm/mach-iop32x/n2100.c
++++ b/arch/arm/mach-iop32x/n2100.c
+@@ -75,8 +75,7 @@ void __init n2100_map_io(void)
+ /*
+ * N2100 PCI.
+ */
+-static int __init
+-n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
++static int n2100_pci_map_irq(const struct pci_dev *dev, u8 slot, u8 pin)
+ {
+ int irq;
+
+--
+2.16.4
+
diff --git a/patches.fixes/ARM-tango-Improve-ARCH_MULTIPLATFORM-compatibility.patch b/patches.fixes/ARM-tango-Improve-ARCH_MULTIPLATFORM-compatibility.patch
new file mode 100644
index 0000000000..3239876699
--- /dev/null
+++ b/patches.fixes/ARM-tango-Improve-ARCH_MULTIPLATFORM-compatibility.patch
@@ -0,0 +1,84 @@
+From d0f9f16788e15d9eb40f68b047732d49658c5a3a Mon Sep 17 00:00:00 2001
+From: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Date: Wed, 16 Jan 2019 16:49:58 +0100
+Subject: [PATCH] ARM: tango: Improve ARCH_MULTIPLATFORM compatibility
+Git-commit: d0f9f16788e15d9eb40f68b047732d49658c5a3a
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+Calling platform-specific code unconditionally blows up when running
+an ARCH_MULTIPLATFORM kernel on a different platform. Don't do it.
+
+Reported-by: Paolo Pisati <p.pisati@gmail.com>
+Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Cc: stable@vger.kernel.org # v4.8+
+Fixes: a30eceb7a59d ("ARM: tango: add Suspend-to-RAM support")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/arm/mach-tango/pm.c | 6 ++----
+ arch/arm/mach-tango/pm.h | 7 +++++++
+ arch/arm/mach-tango/setup.c | 2 ++
+ 3 files changed, 11 insertions(+), 4 deletions(-)
+ create mode 100644 arch/arm/mach-tango/pm.h
+
+diff --git a/arch/arm/mach-tango/pm.c b/arch/arm/mach-tango/pm.c
+index 028e50c6383f..a32c3b631484 100644
+--- a/arch/arm/mach-tango/pm.c
++++ b/arch/arm/mach-tango/pm.c
+@@ -3,6 +3,7 @@
+ #include <linux/suspend.h>
+ #include <asm/suspend.h>
+ #include "smc.h"
++#include "pm.h"
+
+ static int tango_pm_powerdown(unsigned long arg)
+ {
+@@ -24,10 +25,7 @@ static const struct platform_suspend_ops tango_pm_ops = {
+ .valid = suspend_valid_only_mem,
+ };
+
+-static int __init tango_pm_init(void)
++void __init tango_pm_init(void)
+ {
+ suspend_set_ops(&tango_pm_ops);
+- return 0;
+ }
+-
+-late_initcall(tango_pm_init);
+diff --git a/arch/arm/mach-tango/pm.h b/arch/arm/mach-tango/pm.h
+new file mode 100644
+index 000000000000..35ea705a0ee2
+--- /dev/null
++++ b/arch/arm/mach-tango/pm.h
+@@ -0,0 +1,7 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifdef CONFIG_SUSPEND
++void __init tango_pm_init(void);
++#else
++#define tango_pm_init NULL
++#endif
+diff --git a/arch/arm/mach-tango/setup.c b/arch/arm/mach-tango/setup.c
+index 677dd7b5efd9..824f90737b04 100644
+--- a/arch/arm/mach-tango/setup.c
++++ b/arch/arm/mach-tango/setup.c
+@@ -2,6 +2,7 @@
+ #include <asm/mach/arch.h>
+ #include <asm/hardware/cache-l2x0.h>
+ #include "smc.h"
++#include "pm.h"
+
+ static void tango_l2c_write(unsigned long val, unsigned int reg)
+ {
+@@ -15,4 +16,5 @@ DT_MACHINE_START(TANGO_DT, "Sigma Tango DT")
+ .dt_compat = tango_dt_compat,
+ .l2c_aux_mask = ~0,
+ .l2c_write_sec = tango_l2c_write,
++ .init_late = tango_pm_init,
+ MACHINE_END
+--
+2.16.4
+
diff --git a/patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch b/patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch
new file mode 100644
index 0000000000..4623625ccb
--- /dev/null
+++ b/patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch
@@ -0,0 +1,54 @@
+From 7f6d6558ae44bc193eb28df3617c364d3bb6df39 Mon Sep 17 00:00:00 2001
+From: Flavio Leitner <fbl@redhat.com>
+Date: Fri, 28 Sep 2018 14:55:34 -0300
+Subject: [PATCH] Revert "openvswitch: Fix template leak in error cases."
+Git-commit: 7f6d6558ae44bc193eb28df3617c364d3bb6df39
+Patch-mainline: v4.19-rc7
+References: bsc#1051510
+
+This reverts commit 90c7afc96cbbd77f44094b5b651261968e97de67.
+
+When the commit was merged, the code used nf_ct_put() to free
+the entry, but later on commit 76644232e612 ("openvswitch: Free
+tmpl with tmpl_free.") replaced that with nf_ct_tmpl_free which
+is a more appropriate. Now the original problem is removed.
+
+Then 44d6e2f27328 ("net: Replace NF_CT_ASSERT() with WARN_ON().")
+replaced a debug assert with a WARN_ON() which is trigged now.
+
+Signed-off-by: Flavio Leitner <fbl@redhat.com>
+Acked-by: Joe Stringer <joe@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/conntrack.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 86a75105af1a..0aeb34c6389d 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1624,10 +1624,6 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
+ OVS_NLERR(log, "Failed to allocate conntrack template");
+ return -ENOMEM;
+ }
+-
+- __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
+- nf_conntrack_get(&ct_info.ct->ct_general);
+-
+ if (helper) {
+ err = ovs_ct_add_helper(&ct_info, helper, key, log);
+ if (err)
+@@ -1639,6 +1635,8 @@ int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
+ if (err)
+ goto err_free_ct;
+
++ __set_bit(IPS_CONFIRMED_BIT, &ct_info.ct->status);
++ nf_conntrack_get(&ct_info.ct->ct_general);
+ return 0;
+ err_free_ct:
+ __ovs_ct_free_action(&ct_info);
+--
+2.16.4
+
diff --git a/patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch b/patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch
index f5bd065fd9..b063d69b57 100644
--- a/patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch
+++ b/patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch
@@ -4,7 +4,7 @@ Date: Mon, 14 Jan 2019 14:07:19 -0800
Subject: [PATCH] acpi/nfit: Block function zero DSMs
Git-commit: 5e9e38d0db1d29efed1dd4cf9a70115d33521be7
Patch-mainline: v5.0-rc4
-References: bsc#1051510
+References: bsc#1051510, bsc#1121789
In preparation for using function number 0 as an error value, prevent it
from being considered a valid function value by acpi_nfit_ctl().
diff --git a/patches.fixes/acpi-nfit-Fix-command-supported-detection.patch b/patches.fixes/acpi-nfit-Fix-command-supported-detection.patch
index c4c1c3bb2a..442ae7ed8e 100644
--- a/patches.fixes/acpi-nfit-Fix-command-supported-detection.patch
+++ b/patches.fixes/acpi-nfit-Fix-command-supported-detection.patch
@@ -4,7 +4,7 @@ Date: Sat, 19 Jan 2019 10:55:04 -0800
Subject: [PATCH] acpi/nfit: Fix command-supported detection
Git-commit: 11189c1089da413aa4b5fd6be4c4d47c78968819
Patch-mainline: v5.0-rc4
-References: bsc#1051510
+References: bsc#1051510, bsc#1121789
The _DSM function number validation only happens to succeed when the
generic Linux command number translation corresponds with a
diff --git a/patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch b/patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
new file mode 100644
index 0000000000..a5618bd955
--- /dev/null
+++ b/patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
@@ -0,0 +1,104 @@
+From 4ffcbfac60642f63ae3d80891f573ba7e94a265c Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 11 Feb 2019 14:41:22 -0800
+Subject: [PATCH] batman-adv: fix uninit-value in batadv_interface_tx()
+Git-commit: 4ffcbfac60642f63ae3d80891f573ba7e94a265c
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+KMSAN reported batadv_interface_tx() was possibly using a
+garbage value [1]
+
+batadv_get_vid() does have a pskb_may_pull() call
+but batadv_interface_tx() does not actually make sure
+this did not fail.
+
+[1]
+Bug: KMSAN: uninit-value in batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231
+Cpu: 0 PID: 10006 Comm: syz-executor469 Not tainted 4.20.0-rc7+ #5
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x173/0x1d0 lib/dump_stack.c:113
+ kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613
+ __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313
+ batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231
+ __netdev_start_xmit include/linux/netdevice.h:4356 [inline]
+ netdev_start_xmit include/linux/netdevice.h:4365 [inline]
+ xmit_one net/core/dev.c:3257 [inline]
+ dev_hard_start_xmit+0x607/0xc40 net/core/dev.c:3273
+ __dev_queue_xmit+0x2e42/0x3bc0 net/core/dev.c:3843
+ dev_queue_xmit+0x4b/0x60 net/core/dev.c:3876
+ packet_snd net/packet/af_packet.c:2928 [inline]
+ packet_sendmsg+0x8306/0x8f30 net/packet/af_packet.c:2953
+ sock_sendmsg_nosec net/socket.c:621 [inline]
+ sock_sendmsg net/socket.c:631 [inline]
+ __sys_sendto+0x8c4/0xac0 net/socket.c:1788
+ __do_sys_sendto net/socket.c:1800 [inline]
+ __se_sys_sendto+0x107/0x130 net/socket.c:1796
+ __x64_sys_sendto+0x6e/0x90 net/socket.c:1796
+ do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x63/0xe7
+Rip: 0033:0x441889
+Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00
+Rsp: 002b:00007ffdda6fd468 EFLAGS: 00000216 ORIG_RAX: 000000000000002c
+Rax: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000441889
+Rdx: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003
+Rbp: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000216 R12: 00007ffdda6fd4c0
+R13: 00007ffdda6fd4b0 R14: 0000000000000000 R15: 0000000000000000
+
+Uninit was created at:
+ kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline]
+ kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158
+ kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176
+ kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185
+ slab_post_alloc_hook mm/slab.h:446 [inline]
+ slab_alloc_node mm/slub.c:2759 [inline]
+ __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383
+ __kmalloc_reserve net/core/skbuff.c:137 [inline]
+ __alloc_skb+0x309/0xa20 net/core/skbuff.c:205
+ alloc_skb include/linux/skbuff.h:998 [inline]
+ alloc_skb_with_frags+0x1c7/0xac0 net/core/skbuff.c:5220
+ sock_alloc_send_pskb+0xafd/0x10e0 net/core/sock.c:2083
+ packet_alloc_skb net/packet/af_packet.c:2781 [inline]
+ packet_snd net/packet/af_packet.c:2872 [inline]
+ packet_sendmsg+0x661a/0x8f30 net/packet/af_packet.c:2953
+ sock_sendmsg_nosec net/socket.c:621 [inline]
+ sock_sendmsg net/socket.c:631 [inline]
+ __sys_sendto+0x8c4/0xac0 net/socket.c:1788
+ __do_sys_sendto net/socket.c:1800 [inline]
+ __se_sys_sendto+0x107/0x130 net/socket.c:1796
+ __x64_sys_sendto+0x6e/0x90 net/socket.c:1796
+ do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291
+ entry_SYSCALL_64_after_hwframe+0x63/0xe7
+
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Marek Lindner <mareklindner@neomailbox.ch>
+Cc: Simon Wunderlich <sw@simonwunderlich.de>
+Cc: Antonio Quartulli <a@unstable.cc>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/soft-interface.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index b85ca809e509..ffc83bebfe40 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -227,6 +227,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+
+ switch (ntohs(ethhdr->h_proto)) {
+ case ETH_P_8021Q:
++ if (!pskb_may_pull(skb, sizeof(*vhdr)))
++ goto dropped;
+ vhdr = vlan_eth_hdr(skb);
+
+ /* drop batman-in-batman packets to prevent loops */
+--
+2.16.4
+
diff --git a/patches.fixes/blk-mq-fix-a-hung-issue-when-fsync.patch b/patches.fixes/blk-mq-fix-a-hung-issue-when-fsync.patch
new file mode 100644
index 0000000000..55a98af0a7
--- /dev/null
+++ b/patches.fixes/blk-mq-fix-a-hung-issue-when-fsync.patch
@@ -0,0 +1,60 @@
+From: Jianchao Wang <jianchao.w.wang@oracle.com>
+Date: Wed, 30 Jan 2019 17:01:56 +0800
+Subject: [PATCH] blk-mq: fix a hung issue when fsync
+References: bsc#1125252
+Git-commit: 85bd6e61f34dffa8ec2dc75ff3c02ee7b2f1cbce
+Patch-Mainline: v5.0-rc1
+
+Florian reported a io hung issue when fsync(). It should be
+triggered by following race condition.
+
+data + post flush a flush
+
+blk_flush_complete_seq
+ case REQ_FSEQ_DATA
+ blk_flush_queue_rq
+ issued to driver blk_mq_dispatch_rq_list
+ try to issue a flush req
+ failed due to NON-NCQ command
+ .queue_rq return BLK_STS_DEV_RESOURCE
+
+request completion
+ req->end_io // doesn't check RESTART
+ mq_flush_data_end_io
+ case REQ_FSEQ_POSTFLUSH
+ blk_kick_flush
+ do nothing because previous flush
+ has not been completed
+ blk_mq_run_hw_queue
+ insert rq to hctx->dispatch
+ due to RESTART is still set, do nothing
+
+To fix this, replace the blk_mq_run_hw_queue in mq_flush_data_end_io
+with blk_mq_sched_restart to check and clear the RESTART flag.
+
+Fixes: bd166ef1 (blk-mq-sched: add framework for MQ capable IO schedulers)
+Reported-by: Florian Stecker <m19@florianstecker.de>
+Tested-by: Florian Stecker <m19@florianstecker.de>
+Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ block/blk-flush.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/blk-flush.c b/block/blk-flush.c
+index a3fc7191c694..6e0f2d97fc6d 100644
+--- a/block/blk-flush.c
++++ b/block/blk-flush.c
+@@ -335,7 +335,7 @@ static void mq_flush_data_end_io(struct request *rq, blk_status_t error)
+ blk_flush_complete_seq(rq, fq, REQ_FSEQ_DATA, error);
+ spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
+
+- blk_mq_run_hw_queue(hctx, true);
++ blk_mq_sched_restart(hctx);
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.fixes/bpf-Fix-syscall-s-stackmap-lookup-potential-deadlock.patch b/patches.fixes/bpf-Fix-syscall-s-stackmap-lookup-potential-deadlock.patch
new file mode 100644
index 0000000000..c559d93791
--- /dev/null
+++ b/patches.fixes/bpf-Fix-syscall-s-stackmap-lookup-potential-deadlock.patch
@@ -0,0 +1,66 @@
+From: Martin KaFai Lau <kafai@fb.com>
+Date: Wed, 30 Jan 2019 18:12:45 -0800
+Subject: bpf: Fix syscall's stackmap lookup potential deadlock
+Patch-mainline: v5.0-rc6
+Git-commit: 7c4cd051add3d00bbff008a133c936c515eaa8fe
+References: bsc#1083647
+
+The map_lookup_elem used to not acquiring spinlock
+in order to optimize the reader.
+
+It was true until commit 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation")
+The syscall's map_lookup_elem(stackmap) calls bpf_stackmap_copy().
+bpf_stackmap_copy() may find the elem no longer needed after the copy is done.
+If that is the case, pcpu_freelist_push() saves this elem for reuse later.
+This push requires a spinlock.
+
+If a tracing bpf_prog got run in the middle of the syscall's
+map_lookup_elem(stackmap) and this tracing bpf_prog is calling
+bpf_get_stackid(stackmap) which also requires the same pcpu_freelist's
+spinlock, it may end up with a dead lock situation as reported by
+Eric Dumazet in https://patchwork.ozlabs.org/patch/1030266/
+
+The situation is the same as the syscall's map_update_elem() which
+needs to acquire the pcpu_freelist's spinlock and could race
+with tracing bpf_prog. Hence, this patch fixes it by protecting
+bpf_stackmap_copy() with this_cpu_inc(bpf_prog_active)
+to prevent tracing bpf_prog from running.
+
+A later syscall's map_lookup_elem commit f1a2e44a3aec ("bpf: add queue and stack maps")
+also acquires a spinlock and races with tracing bpf_prog similarly.
+Hence, this patch is forward looking and protects the majority
+of the map lookups. bpf_map_offload_lookup_elem() is the exception
+since it is for network bpf_prog only (i.e. never called by tracing
+bpf_prog).
+
+Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation")
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Gary Lin <glin@suse.com>
+---
+ kernel/bpf/syscall.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -473,6 +473,8 @@ static int map_lookup_elem(union bpf_att
+ if (!value)
+ goto free_key;
+
++ preempt_disable();
++ this_cpu_inc(bpf_prog_active);
+ if (map->map_type == BPF_MAP_TYPE_PERCPU_HASH ||
+ map->map_type == BPF_MAP_TYPE_LRU_PERCPU_HASH) {
+ err = bpf_percpu_hash_copy(map, key, value);
+@@ -492,6 +494,8 @@ static int map_lookup_elem(union bpf_att
+ rcu_read_unlock();
+ err = ptr ? 0 : -ENOENT;
+ }
++ this_cpu_dec(bpf_prog_active);
++ preempt_enable();
+
+ if (err)
+ goto free_value;
diff --git a/patches.fixes/bpf-enable-access-to-ax-register-also-from-verifier-.patch b/patches.fixes/bpf-enable-access-to-ax-register-also-from-verifier-.patch
new file mode 100644
index 0000000000..3cce51bc75
--- /dev/null
+++ b/patches.fixes/bpf-enable-access-to-ax-register-also-from-verifier-.patch
@@ -0,0 +1,70 @@
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 3 Jan 2019 00:58:29 +0100
+Subject: bpf: enable access to ax register also from verifier rewrite
+Patch-mainline: v5.0-rc1
+Git-commit: 9b73bfdd08e73231d6a90ae6db4b46b3fbf56c30
+References: bsc#1124055 CVE-2019-7308
+
+Right now we are using BPF ax register in JIT for constant blinding as
+well as in interpreter as temporary variable. Verifier will not be able
+to use it simply because its use will get overridden from the former in
+bpf_jit_blind_insn(). However, it can be made to work in that blinding
+will be skipped if there is prior use in either source or destination
+register on the instruction. Taking constraints of ax into account, the
+verifier is then open to use it in rewrites under some constraints. Note,
+ax register already has mappings in every eBPF JIT.
+
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Gary Lin <glin@suse.com>
+---
+ include/linux/filter.h | 7 +------
+ kernel/bpf/core.c | 20 ++++++++++++++++++++
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -48,12 +48,7 @@ struct bpf_prog_aux;
+ #define BPF_REG_X BPF_REG_7
+ #define BPF_REG_TMP BPF_REG_8
+
+-/* Kernel hidden auxiliary/helper register for hardening step.
+- * Only used by eBPF JITs. It's nothing more than a temporary
+- * register that JITs use internally, only that here it's part
+- * of eBPF instructions that have been rewritten for blinding
+- * constants. See JIT pre-step in bpf_jit_blind_constants().
+- */
++/* Kernel hidden auxiliary/helper register. */
+ #define BPF_REG_AX MAX_BPF_REG
+ #define MAX_BPF_EXT_REG (MAX_BPF_REG + 1)
+ #define MAX_BPF_JIT_REG MAX_BPF_EXT_REG
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -557,6 +557,26 @@ static int bpf_jit_blind_insn(const stru
+ BUILD_BUG_ON(BPF_REG_AX + 1 != MAX_BPF_JIT_REG);
+ BUILD_BUG_ON(MAX_BPF_REG + 1 != MAX_BPF_JIT_REG);
+
++ /* Constraints on AX register:
++ *
++ * AX register is inaccessible from user space. It is mapped in
++ * all JITs, and used here for constant blinding rewrites. It is
++ * typically "stateless" meaning its contents are only valid within
++ * the executed instruction, but not across several instructions.
++ * There are a few exceptions however which are further detailed
++ * below.
++ *
++ * Constant blinding is only used by JITs, not in the interpreter.
++ * The interpreter uses AX in some occasions as a local temporary
++ * register e.g. in DIV or MOD instructions.
++ *
++ * In restricted circumstances, the verifier can also use the AX
++ * register for rewrites as long as they do not interfere with
++ * the above cases!
++ */
++ if (from->dst_reg == BPF_REG_AX || from->src_reg == BPF_REG_AX)
++ goto out;
++
+ if (from->imm == 0 &&
+ (from->code == (BPF_ALU | BPF_MOV | BPF_K) ||
+ from->code == (BPF_ALU64 | BPF_MOV | BPF_K))) {
diff --git a/patches.fixes/bpf-fix-check_map_access-smin_value-test-when-pointe.patch b/patches.fixes/bpf-fix-check_map_access-smin_value-test-when-pointe.patch
index 8d11645171..f23eeb2658 100644
--- a/patches.fixes/bpf-fix-check_map_access-smin_value-test-when-pointe.patch
+++ b/patches.fixes/bpf-fix-check_map_access-smin_value-test-when-pointe.patch
@@ -4,7 +4,7 @@ Subject: bpf: fix check_map_access smin_value test when pointer contains
offset
Patch-mainline: v5.0-rc1
Git-commit: b7137c4eab85c1cf3d46acdde90ce1163b28c873
-References: bsc#1068032 CVE-2017-5753
+References: bsc#1068032 CVE-2017-5753 bsc#1124055 CVE-2019-7308
In check_map_access() we probe actual bounds through __check_map_access()
with offset of reg->smin_value + off for lower bound and offset of
diff --git a/patches.fixes/bpf-fix-lockdep-false-positive-in-percpu_freelist.patch b/patches.fixes/bpf-fix-lockdep-false-positive-in-percpu_freelist.patch
new file mode 100644
index 0000000000..ebefeaf125
--- /dev/null
+++ b/patches.fixes/bpf-fix-lockdep-false-positive-in-percpu_freelist.patch
@@ -0,0 +1,305 @@
+From: Alexei Starovoitov <ast@kernel.org>
+Date: Wed, 30 Jan 2019 18:12:43 -0800
+Subject: bpf: fix lockdep false positive in percpu_freelist
+Patch-mainline: v5.0-rc6
+Git-commit: a89fac57b5d080771efd4d71feaae19877cf68f0
+References: bsc#1083647
+
+Lockdep warns about false positive:
+[ 12.492084] 00000000e6b28347 (&head->lock){+...}, at: pcpu_freelist_push+0x2a/0x40
+[ 12.492696] but this lock was taken by another, HARDIRQ-safe lock in the past:
+[ 12.493275] (&rq->lock){-.-.}
+[ 12.493276]
+[ 12.493276]
+[ 12.493276] and interrupts could create inverse lock ordering between them.
+[ 12.493276]
+[ 12.494435]
+[ 12.494435] other info that might help us debug this:
+[ 12.494979] Possible interrupt unsafe locking scenario:
+[ 12.494979]
+[ 12.495518] CPU0 CPU1
+[ 12.495879] ---- ----
+[ 12.496243] lock(&head->lock);
+[ 12.496502] local_irq_disable();
+[ 12.496969] lock(&rq->lock);
+[ 12.497431] lock(&head->lock);
+[ 12.497890] <Interrupt>
+[ 12.498104] lock(&rq->lock);
+[ 12.498368]
+[ 12.498368] *** DEADLOCK ***
+[ 12.498368]
+[ 12.498837] 1 lock held by dd/276:
+[ 12.499110] #0: 00000000c58cb2ee (rcu_read_lock){....}, at: trace_call_bpf+0x5e/0x240
+[ 12.499747]
+[ 12.499747] the shortest dependencies between 2nd lock and 1st lock:
+[ 12.500389] -> (&rq->lock){-.-.} {
+[ 12.500669] IN-HARDIRQ-W at:
+[ 12.500934] _raw_spin_lock+0x2f/0x40
+[ 12.501373] scheduler_tick+0x4c/0xf0
+[ 12.501812] update_process_times+0x40/0x50
+[ 12.502294] tick_periodic+0x27/0xb0
+[ 12.502723] tick_handle_periodic+0x1f/0x60
+[ 12.503203] timer_interrupt+0x11/0x20
+[ 12.503651] __handle_irq_event_percpu+0x43/0x2c0
+[ 12.504167] handle_irq_event_percpu+0x20/0x50
+[ 12.504674] handle_irq_event+0x37/0x60
+[ 12.505139] handle_level_irq+0xa7/0x120
+[ 12.505601] handle_irq+0xa1/0x150
+[ 12.506018] do_IRQ+0x77/0x140
+[ 12.506411] ret_from_intr+0x0/0x1d
+[ 12.506834] _raw_spin_unlock_irqrestore+0x53/0x60
+[ 12.507362] __setup_irq+0x481/0x730
+[ 12.507789] setup_irq+0x49/0x80
+[ 12.508195] hpet_time_init+0x21/0x32
+[ 12.508644] x86_late_time_init+0xb/0x16
+[ 12.509106] start_kernel+0x390/0x42a
+[ 12.509554] secondary_startup_64+0xa4/0xb0
+[ 12.510034] IN-SOFTIRQ-W at:
+[ 12.510305] _raw_spin_lock+0x2f/0x40
+[ 12.510772] try_to_wake_up+0x1c7/0x4e0
+[ 12.511220] swake_up_locked+0x20/0x40
+[ 12.511657] swake_up_one+0x1a/0x30
+[ 12.512070] rcu_process_callbacks+0xc5/0x650
+[ 12.512553] __do_softirq+0xe6/0x47b
+[ 12.512978] irq_exit+0xc3/0xd0
+[ 12.513372] smp_apic_timer_interrupt+0xa9/0x250
+[ 12.513876] apic_timer_interrupt+0xf/0x20
+[ 12.514343] default_idle+0x1c/0x170
+[ 12.514765] do_idle+0x199/0x240
+[ 12.515159] cpu_startup_entry+0x19/0x20
+[ 12.515614] start_kernel+0x422/0x42a
+[ 12.516045] secondary_startup_64+0xa4/0xb0
+[ 12.516521] INITIAL USE at:
+[ 12.516774] _raw_spin_lock_irqsave+0x38/0x50
+[ 12.517258] rq_attach_root+0x16/0xd0
+[ 12.517685] sched_init+0x2f2/0x3eb
+[ 12.518096] start_kernel+0x1fb/0x42a
+[ 12.518525] secondary_startup_64+0xa4/0xb0
+[ 12.518986] }
+[ 12.519132] ... key at: [<ffffffff82b7bc28>] __key.71384+0x0/0x8
+[ 12.519649] ... acquired at:
+[ 12.519892] pcpu_freelist_pop+0x7b/0xd0
+[ 12.520221] bpf_get_stackid+0x1d2/0x4d0
+[ 12.520563] ___bpf_prog_run+0x8b4/0x11a0
+[ 12.520887]
+[ 12.521008] -> (&head->lock){+...} {
+[ 12.521292] HARDIRQ-ON-W at:
+[ 12.521539] _raw_spin_lock+0x2f/0x40
+[ 12.521950] pcpu_freelist_push+0x2a/0x40
+[ 12.522396] bpf_get_stackid+0x494/0x4d0
+[ 12.522828] ___bpf_prog_run+0x8b4/0x11a0
+[ 12.523296] INITIAL USE at:
+[ 12.523537] _raw_spin_lock+0x2f/0x40
+[ 12.523944] pcpu_freelist_populate+0xc0/0x120
+[ 12.524417] htab_map_alloc+0x405/0x500
+[ 12.524835] __do_sys_bpf+0x1a3/0x1a90
+[ 12.525253] do_syscall_64+0x4a/0x180
+[ 12.525659] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 12.526167] }
+[ 12.526311] ... key at: [<ffffffff838f7668>] __key.13130+0x0/0x8
+[ 12.526812] ... acquired at:
+[ 12.527047] __lock_acquire+0x521/0x1350
+[ 12.527371] lock_acquire+0x98/0x190
+[ 12.527680] _raw_spin_lock+0x2f/0x40
+[ 12.527994] pcpu_freelist_push+0x2a/0x40
+[ 12.528325] bpf_get_stackid+0x494/0x4d0
+[ 12.528645] ___bpf_prog_run+0x8b4/0x11a0
+[ 12.528970]
+[ 12.529092]
+[ 12.529092] stack backtrace:
+[ 12.529444] CPU: 0 PID: 276 Comm: dd Not tainted 5.0.0-rc3-00018-g2fa53f892422 #475
+[ 12.530043] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
+[ 12.530750] Call Trace:
+[ 12.530948] dump_stack+0x5f/0x8b
+[ 12.531248] check_usage_backwards+0x10c/0x120
+[ 12.531598] ? ___bpf_prog_run+0x8b4/0x11a0
+[ 12.531935] ? mark_lock+0x382/0x560
+[ 12.532229] mark_lock+0x382/0x560
+[ 12.532496] ? print_shortest_lock_dependencies+0x180/0x180
+[ 12.532928] __lock_acquire+0x521/0x1350
+[ 12.533271] ? find_get_entry+0x17f/0x2e0
+[ 12.533586] ? find_get_entry+0x19c/0x2e0
+[ 12.533902] ? lock_acquire+0x98/0x190
+[ 12.534196] lock_acquire+0x98/0x190
+[ 12.534482] ? pcpu_freelist_push+0x2a/0x40
+[ 12.534810] _raw_spin_lock+0x2f/0x40
+[ 12.535099] ? pcpu_freelist_push+0x2a/0x40
+[ 12.535432] pcpu_freelist_push+0x2a/0x40
+[ 12.535750] bpf_get_stackid+0x494/0x4d0
+[ 12.536062] ___bpf_prog_run+0x8b4/0x11a0
+
+It has been explained that is a false positive here:
+https://lkml.org/lkml/2018/7/25/756
+Recap:
+- stackmap uses pcpu_freelist
+- The lock in pcpu_freelist is a percpu lock
+- stackmap is only used by tracing bpf_prog
+- A tracing bpf_prog cannot be run if another bpf_prog
+ has already been running (ensured by the percpu bpf_prog_active counter).
+
+Eric pointed out that this lockdep splats stops other
+legit lockdep splats in selftests/bpf/test_progs.c.
+
+Fix this by calling local_irq_save/restore for stackmap.
+
+Another false positive had also been worked around by calling
+local_irq_save in commit 89ad2fa3f043 ("bpf: fix lockdep splat").
+That commit added unnecessary irq_save/restore to fast path of
+bpf hash map. irqs are already disabled at that point, since htab
+is holding per bucket spin_lock with irqsave.
+
+Let's reduce overhead for htab by introducing __pcpu_freelist_push/pop
+function w/o irqsave and convert pcpu_freelist_push/pop to irqsave
+to be used elsewhere (right now only in stackmap).
+It stops lockdep false positive in stackmap with a bit of acceptable overhead.
+
+Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation")
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Gary Lin <glin@suse.com>
+---
+ kernel/bpf/hashtab.c | 4 ++--
+ kernel/bpf/percpu_freelist.c | 41 +++++++++++++++++++++++++-----------
+ kernel/bpf/percpu_freelist.h | 4 ++++
+ 3 files changed, 35 insertions(+), 14 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index 4b7c76765d9d..f9274114c88d 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -686,7 +686,7 @@ static void free_htab_elem(struct bpf_htab *htab, struct htab_elem *l)
+ }
+
+ if (htab_is_prealloc(htab)) {
+- pcpu_freelist_push(&htab->freelist, &l->fnode);
++ __pcpu_freelist_push(&htab->freelist, &l->fnode);
+ } else {
+ atomic_dec(&htab->count);
+ l->htab = htab;
+@@ -748,7 +748,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
+ } else {
+ struct pcpu_freelist_node *l;
+
+- l = pcpu_freelist_pop(&htab->freelist);
++ l = __pcpu_freelist_pop(&htab->freelist);
+ if (!l)
+ return ERR_PTR(-E2BIG);
+ l_new = container_of(l, struct htab_elem, fnode);
+diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c
+index 673fa6fe2d73..0c1b4ba9e90e 100644
+--- a/kernel/bpf/percpu_freelist.c
++++ b/kernel/bpf/percpu_freelist.c
+@@ -28,8 +28,8 @@ void pcpu_freelist_destroy(struct pcpu_freelist *s)
+ free_percpu(s->freelist);
+ }
+
+-static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
+- struct pcpu_freelist_node *node)
++static inline void ___pcpu_freelist_push(struct pcpu_freelist_head *head,
++ struct pcpu_freelist_node *node)
+ {
+ raw_spin_lock(&head->lock);
+ node->next = head->first;
+@@ -37,12 +37,22 @@ static inline void __pcpu_freelist_push(struct pcpu_freelist_head *head,
+ raw_spin_unlock(&head->lock);
+ }
+
+-void pcpu_freelist_push(struct pcpu_freelist *s,
++void __pcpu_freelist_push(struct pcpu_freelist *s,
+ struct pcpu_freelist_node *node)
+ {
+ struct pcpu_freelist_head *head = this_cpu_ptr(s->freelist);
+
+- __pcpu_freelist_push(head, node);
++ ___pcpu_freelist_push(head, node);
++}
++
++void pcpu_freelist_push(struct pcpu_freelist *s,
++ struct pcpu_freelist_node *node)
++{
++ unsigned long flags;
++
++ local_irq_save(flags);
++ __pcpu_freelist_push(s, node);
++ local_irq_restore(flags);
+ }
+
+ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+@@ -63,7 +73,7 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+ for_each_possible_cpu(cpu) {
+ again:
+ head = per_cpu_ptr(s->freelist, cpu);
+- __pcpu_freelist_push(head, buf);
++ ___pcpu_freelist_push(head, buf);
+ i++;
+ buf += elem_size;
+ if (i == nr_elems)
+@@ -74,14 +84,12 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+ local_irq_restore(flags);
+ }
+
+-struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s)
+ {
+ struct pcpu_freelist_head *head;
+ struct pcpu_freelist_node *node;
+- unsigned long flags;
+ int orig_cpu, cpu;
+
+- local_irq_save(flags);
+ orig_cpu = cpu = raw_smp_processor_id();
+ while (1) {
+ head = per_cpu_ptr(s->freelist, cpu);
+@@ -89,16 +97,25 @@ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
+ node = head->first;
+ if (node) {
+ head->first = node->next;
+- raw_spin_unlock_irqrestore(&head->lock, flags);
++ raw_spin_unlock(&head->lock);
+ return node;
+ }
+ raw_spin_unlock(&head->lock);
+ cpu = cpumask_next(cpu, cpu_possible_mask);
+ if (cpu >= nr_cpu_ids)
+ cpu = 0;
+- if (cpu == orig_cpu) {
+- local_irq_restore(flags);
++ if (cpu == orig_cpu)
+ return NULL;
+- }
+ }
+ }
++
++struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s)
++{
++ struct pcpu_freelist_node *ret;
++ unsigned long flags;
++
++ local_irq_save(flags);
++ ret = __pcpu_freelist_pop(s);
++ local_irq_restore(flags);
++ return ret;
++}
+diff --git a/kernel/bpf/percpu_freelist.h b/kernel/bpf/percpu_freelist.h
+index 3049aae8ea1e..c3960118e617 100644
+--- a/kernel/bpf/percpu_freelist.h
++++ b/kernel/bpf/percpu_freelist.h
+@@ -22,8 +22,12 @@ struct pcpu_freelist_node {
+ struct pcpu_freelist_node *next;
+ };
+
++/* pcpu_freelist_* do spin_lock_irqsave. */
+ void pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
+ struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *);
++/* __pcpu_freelist_* do spin_lock only. caller must disable irqs. */
++void __pcpu_freelist_push(struct pcpu_freelist *, struct pcpu_freelist_node *);
++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *);
+ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size,
+ u32 nr_elems);
+ int pcpu_freelist_init(struct pcpu_freelist *);
+--
+2.20.1
+
diff --git a/patches.fixes/bpf-move-prev_-insn_idx-into-verifier-env.patch b/patches.fixes/bpf-move-prev_-insn_idx-into-verifier-env.patch
index cba26cdae2..e15ba62757 100644
--- a/patches.fixes/bpf-move-prev_-insn_idx-into-verifier-env.patch
+++ b/patches.fixes/bpf-move-prev_-insn_idx-into-verifier-env.patch
@@ -3,7 +3,7 @@ Date: Thu, 3 Jan 2019 00:58:27 +0100
Subject: bpf: move {prev_,}insn_idx into verifier env
Patch-mainline: v5.0-rc1
Git-commit: c08435ec7f2bc8f4109401f696fd55159b4b40cb
-References: bsc#1068032 CVE-2017-5753
+References: bsc#1068032 CVE-2017-5753 bsc#1124055 CVE-2019-7308
Move prev_insn_idx and insn_idx from the do_check() function into
the verifier environment, so they can be read inside the various
diff --git a/patches.fixes/bpf-move-tmp-variable-into-ax-register-in-interprete.patch b/patches.fixes/bpf-move-tmp-variable-into-ax-register-in-interprete.patch
new file mode 100644
index 0000000000..51961e7db9
--- /dev/null
+++ b/patches.fixes/bpf-move-tmp-variable-into-ax-register-in-interprete.patch
@@ -0,0 +1,144 @@
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Thu, 3 Jan 2019 00:58:28 +0100
+Subject: bpf: move tmp variable into ax register in interpreter
+Patch-mainline: v5.0-rc1
+Git-commit: 144cd91c4c2bced6eb8a7e25e590f6618a11e854
+References: bsc#1124055 CVE-2019-7308
+
+This change moves the on-stack 64 bit tmp variable in ___bpf_prog_run()
+into the hidden ax register. The latter is currently only used in JITs
+for constant blinding as a temporary scratch register, meaning the BPF
+interpreter will never see the use of ax. Therefore it is safe to use
+it for the cases where tmp has been used earlier. This is needed to later
+on allow restricted hidden use of ax in both interpreter and JITs.
+
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Gary Lin <glin@suse.com>
+---
+ include/linux/filter.h | 3 ++-
+ kernel/bpf/core.c | 38 +++++++++++++++++++-------------------
+ 2 files changed, 21 insertions(+), 20 deletions(-)
+
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -55,7 +55,8 @@ struct bpf_prog_aux;
+ * constants. See JIT pre-step in bpf_jit_blind_constants().
+ */
+ #define BPF_REG_AX MAX_BPF_REG
+-#define MAX_BPF_JIT_REG (MAX_BPF_REG + 1)
++#define MAX_BPF_EXT_REG (MAX_BPF_REG + 1)
++#define MAX_BPF_JIT_REG MAX_BPF_EXT_REG
+
+ /* unused opcode to mark special call to bpf_tail_call() helper */
+ #define BPF_TAIL_CALL 0xf0
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -51,6 +51,7 @@
+ #define DST regs[insn->dst_reg]
+ #define SRC regs[insn->src_reg]
+ #define FP regs[BPF_REG_FP]
++#define AX regs[BPF_REG_AX]
+ #define ARG1 regs[BPF_REG_ARG1]
+ #define CTX regs[BPF_REG_CTX]
+ #define IMM insn->imm
+@@ -771,7 +772,6 @@ EXPORT_SYMBOL_GPL(__bpf_call_base);
+ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
+ u64 *stack)
+ {
+- u64 tmp;
+ static const void *jumptable[256] = {
+ [0 ... 255] = &&default_label,
+ /* Now overwrite non-defaults ... */
+@@ -945,22 +945,22 @@ select_insn:
+ ALU64_MOD_X:
+ if (unlikely(SRC == 0))
+ return 0;
+- div64_u64_rem(DST, SRC, &tmp);
+- DST = tmp;
++ div64_u64_rem(DST, SRC, &AX);
++ DST = AX;
+ CONT;
+ ALU_MOD_X:
+ if (unlikely((u32)SRC == 0))
+ return 0;
+- tmp = (u32) DST;
+- DST = do_div(tmp, (u32) SRC);
++ AX = (u32) DST;
++ DST = do_div(AX, (u32) SRC);
+ CONT;
+ ALU64_MOD_K:
+- div64_u64_rem(DST, IMM, &tmp);
+- DST = tmp;
++ div64_u64_rem(DST, IMM, &AX);
++ DST = AX;
+ CONT;
+ ALU_MOD_K:
+- tmp = (u32) DST;
+- DST = do_div(tmp, (u32) IMM);
++ AX = (u32) DST;
++ DST = do_div(AX, (u32) IMM);
+ CONT;
+ ALU64_DIV_X:
+ if (unlikely(SRC == 0))
+@@ -970,17 +970,17 @@ select_insn:
+ ALU_DIV_X:
+ if (unlikely((u32)SRC == 0))
+ return 0;
+- tmp = (u32) DST;
+- do_div(tmp, (u32) SRC);
+- DST = (u32) tmp;
++ AX = (u32) DST;
++ do_div(AX, (u32) SRC);
++ DST = (u32) AX;
+ CONT;
+ ALU64_DIV_K:
+ DST = div64_u64(DST, IMM);
+ CONT;
+ ALU_DIV_K:
+- tmp = (u32) DST;
+- do_div(tmp, (u32) IMM);
+- DST = (u32) tmp;
++ AX = (u32) DST;
++ do_div(AX, (u32) IMM);
++ DST = (u32) AX;
+ CONT;
+ ALU_END_TO_BE:
+ switch (IMM) {
+@@ -1235,7 +1235,7 @@ load_word:
+ * BPF_R0 - 8/16/32-bit skb data converted to cpu endianness
+ */
+
+- ptr = bpf_load_pointer((struct sk_buff *) (unsigned long) CTX, off, 4, &tmp);
++ ptr = bpf_load_pointer((struct sk_buff *) (unsigned long) CTX, off, 4, &AX);
+ if (likely(ptr != NULL)) {
+ BPF_R0 = get_unaligned_be32(ptr);
+ CONT;
+@@ -1245,7 +1245,7 @@ load_word:
+ LD_ABS_H: /* BPF_R0 = ntohs(*(u16 *) (skb->data + imm32)) */
+ off = IMM;
+ load_half:
+- ptr = bpf_load_pointer((struct sk_buff *) (unsigned long) CTX, off, 2, &tmp);
++ ptr = bpf_load_pointer((struct sk_buff *) (unsigned long) CTX, off, 2, &AX);
+ if (likely(ptr != NULL)) {
+ BPF_R0 = get_unaligned_be16(ptr);
+ CONT;
+@@ -1255,7 +1255,7 @@ load_half:
+ LD_ABS_B: /* BPF_R0 = *(u8 *) (skb->data + imm32) */
+ off = IMM;
+ load_byte:
+- ptr = bpf_load_pointer((struct sk_buff *) (unsigned long) CTX, off, 1, &tmp);
++ ptr = bpf_load_pointer((struct sk_buff *) (unsigned long) CTX, off, 1, &AX);
+ if (likely(ptr != NULL)) {
+ BPF_R0 = *(u8 *)ptr;
+ CONT;
+@@ -1284,7 +1284,7 @@ STACK_FRAME_NON_STANDARD(___bpf_prog_run
+ static unsigned int PROG_NAME(stack_size)(const void *ctx, const struct bpf_insn *insn) \
+ { \
+ u64 stack[stack_size / sizeof(u64)]; \
+- u64 regs[MAX_BPF_REG]; \
++ u64 regs[MAX_BPF_EXT_REG]; \
+ \
+ FP = (u64) (unsigned long) &stack[ARRAY_SIZE(stack)]; \
+ ARG1 = (u64) (unsigned long) ctx; \
diff --git a/patches.fixes/bpf-prevent-out-of-bounds-speculation-on-pointer-ari.patch b/patches.fixes/bpf-prevent-out-of-bounds-speculation-on-pointer-ari.patch
index 41f10f4181..16ac5ed040 100644
--- a/patches.fixes/bpf-prevent-out-of-bounds-speculation-on-pointer-ari.patch
+++ b/patches.fixes/bpf-prevent-out-of-bounds-speculation-on-pointer-ari.patch
@@ -3,7 +3,7 @@ Date: Thu, 3 Jan 2019 00:58:34 +0100
Subject: bpf: prevent out of bounds speculation on pointer arithmetic
Patch-mainline: v5.0-rc1
Git-commit: 979d63d50c0c0f7bc537bf821e056cc9fe5abd38
-References: bsc#1068032 CVE-2017-5753
+References: bsc#1068032 CVE-2017-5753 bsc#1124055 CVE-2019-7308
Jann reported that the original commit back in b2157399cc98
("bpf: prevent out-of-bounds speculation") was not sufficient
diff --git a/patches.fixes/bpf-restrict-map-value-pointer-arithmetic-for-unpriv.patch b/patches.fixes/bpf-restrict-map-value-pointer-arithmetic-for-unpriv.patch
index ae75cd0be1..5abfbda004 100644
--- a/patches.fixes/bpf-restrict-map-value-pointer-arithmetic-for-unpriv.patch
+++ b/patches.fixes/bpf-restrict-map-value-pointer-arithmetic-for-unpriv.patch
@@ -3,7 +3,7 @@ Date: Thu, 3 Jan 2019 00:58:30 +0100
Subject: bpf: restrict map value pointer arithmetic for unprivileged
Patch-mainline: v5.0-rc1
Git-commit: 0d6303db7970e6f56ae700fa07e11eb510cda125
-References: bsc#1068032 CVE-2017-5753
+References: bsc#1068032 CVE-2017-5753 bsc#1124055 CVE-2019-7308
Restrict map value pointer arithmetic for unprivileged users in that
arithmetic itself must not go out of bounds as opposed to the actual
diff --git a/patches.fixes/bpf-restrict-stack-pointer-arithmetic-for-unprivileg.patch b/patches.fixes/bpf-restrict-stack-pointer-arithmetic-for-unprivileg.patch
index a7cec82f8d..64348a467e 100644
--- a/patches.fixes/bpf-restrict-stack-pointer-arithmetic-for-unprivileg.patch
+++ b/patches.fixes/bpf-restrict-stack-pointer-arithmetic-for-unprivileg.patch
@@ -3,7 +3,7 @@ Date: Thu, 3 Jan 2019 00:58:31 +0100
Subject: bpf: restrict stack pointer arithmetic for unprivileged
Patch-mainline: v5.0-rc1
Git-commit: e4298d25830a866cc0f427d4bccb858e76715859
-References: bsc#1068032 CVE-2017-5753
+References: bsc#1068032 CVE-2017-5753 bsc#1124055 CVE-2019-7308
Restrict stack pointer arithmetic for unprivileged users in that
arithmetic itself must not go out of bounds as opposed to the actual
diff --git a/patches.fixes/bpf-restrict-unknown-scalars-of-mixed-signed-bounds-.patch b/patches.fixes/bpf-restrict-unknown-scalars-of-mixed-signed-bounds-.patch
index 21985c592a..c5a462e273 100644
--- a/patches.fixes/bpf-restrict-unknown-scalars-of-mixed-signed-bounds-.patch
+++ b/patches.fixes/bpf-restrict-unknown-scalars-of-mixed-signed-bounds-.patch
@@ -3,7 +3,7 @@ Date: Thu, 3 Jan 2019 00:58:32 +0100
Subject: bpf: restrict unknown scalars of mixed signed bounds for unprivileged
Patch-mainline: v5.0-rc1
Git-commit: 9d7eceede769f90b66cfa06ad5b357140d5141ed
-References: bsc#1068032 CVE-2017-5753
+References: bsc#1068032 CVE-2017-5753 bsc#1124055 CVE-2019-7308
For unknown scalars of mixed signed bounds, meaning their smin_value is
negative and their smax_value is positive, we need to reject arithmetic
diff --git a/patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch b/patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch
new file mode 100644
index 0000000000..1b8c99962f
--- /dev/null
+++ b/patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch
@@ -0,0 +1,32 @@
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Thu, 10 Jan 2019 15:41:09 +0800
+Subject: ceph: clear inode pointer when snap realm gets dropped by its inode
+Git-commit: d95e674c01cfb5461e8b9fdeebf6d878c9b80b2f
+Patch-mainline: v5.0-rc4
+References: bsc#1125799
+
+snap realm and corresponding inode have pointers to each other.
+The two pointer should get clear at the same time. Otherwise,
+snap realm's pointer may reference freed inode.
+
+Cc: stable@vger.kernel.org # 4.17+
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Reviewed-by: Luis Henriques <lhenriques@suse.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/caps.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1041,6 +1041,8 @@ static void drop_inode_snap_realm(struct
+ list_del_init(&ci->i_snap_realm_item);
+ ci->i_snap_realm_counter++;
+ ci->i_snap_realm = NULL;
++ if (realm->ino == ci->i_vino.ino)
++ realm->inode = NULL;
+ spin_unlock(&realm->inodes_with_caps_lock);
+ ceph_put_snap_realm(ceph_sb_to_client(ci->vfs_inode.i_sb)->mdsc,
+ realm);
+
diff --git a/patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch b/patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
new file mode 100644
index 0000000000..a7d724227e
--- /dev/null
+++ b/patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
@@ -0,0 +1,58 @@
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Mon, 14 Jan 2019 21:13:10 +0100
+Subject: libceph: avoid KEEPALIVE_PENDING races in ceph_con_keepalive()
+Git-commit: 4aac9228d16458cedcfd90c7fb37211cf3653ac3
+Patch-mainline: v5.0-rc4
+References: bsc#1125800
+
+con_fault() can transition the connection into STANDBY right after
+ceph_con_keepalive() clears STANDBY in clear_standby():
+
+ libceph user thread ceph-msgr worker
+
+ceph_con_keepalive()
+ mutex_lock(&con->mutex)
+ clear_standby(con)
+ mutex_unlock(&con->mutex)
+ mutex_lock(&con->mutex)
+ con_fault()
+ ...
+ if KEEPALIVE_PENDING isn't set
+ set state to STANDBY
+ ...
+ mutex_unlock(&con->mutex)
+ set KEEPALIVE_PENDING
+ set WRITE_PENDING
+
+This triggers warnings in clear_standby() when either ceph_con_send()
+or ceph_con_keepalive() get to clearing STANDBY next time.
+
+I don't see a reason to condition queue_con() call on the previous
+value of KEEPALIVE_PENDING, so move the setting of KEEPALIVE_PENDING
+into the critical section -- unlike WRITE_PENDING, KEEPALIVE_PENDING
+could have been a non-atomic flag.
+
+Reported-by: syzbot+acdeb633f6211ccdf886@syzkaller.appspotmail.com
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Tested-by: Myungho Jung <mhjungk@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ net/ceph/messenger.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -3210,9 +3210,10 @@ void ceph_con_keepalive(struct ceph_conn
+ dout("con_keepalive %p\n", con);
+ mutex_lock(&con->mutex);
+ clear_standby(con);
++ con_flag_set(con, CON_FLAG_KEEPALIVE_PENDING);
+ mutex_unlock(&con->mutex);
+- if (con_flag_test_and_set(con, CON_FLAG_KEEPALIVE_PENDING) == 0 &&
+- con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
++
++ if (con_flag_test_and_set(con, CON_FLAG_WRITE_PENDING) == 0)
+ queue_con(con);
+ }
+ EXPORT_SYMBOL(ceph_con_keepalive);
+
diff --git a/patches.fixes/lightnvm-fail-fast-on-passthrough-commands.patch b/patches.fixes/lightnvm-fail-fast-on-passthrough-commands.patch
new file mode 100644
index 0000000000..1e5eacde6f
--- /dev/null
+++ b/patches.fixes/lightnvm-fail-fast-on-passthrough-commands.patch
@@ -0,0 +1,36 @@
+From: =?UTF-8?q?Javier=20Gonz=C3=A1lez?= <javier@cnexlabs.com>
+Date: Fri, 13 Oct 2017 14:46:46 +0200
+Subject: lightnvm: fail fast on passthrough commands
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 1b839187db62aae22a9254fd9e3ce376149b0918
+Patch-mainline: v4.15-rc1
+References: bsc#1125780
+
+Make LightNVM passhtrough commands fail fast. User space will then take
+care of re-submitting.
+
+Fixes: 84d4add793c6 ('lightnvm: add ioctls for vector I/Os')
+Signed-off-by: Javier González <javier@cnexlabs.com>
+Signed-off-by: Matias Bjørling <m@bjorling.me>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvme/host/lightnvm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
+index 1f79e3f141e6..6017153c2439 100644
+--- a/drivers/nvme/host/lightnvm.c
++++ b/drivers/nvme/host/lightnvm.c
+@@ -600,8 +600,6 @@ static int nvme_nvm_submit_user_cmd(struct request_queue *q,
+
+ rq->timeout = timeout ? timeout : ADMIN_TIMEOUT;
+
+- rq->cmd_flags &= ~REQ_FAILFAST_DRIVER;
+-
+ if (ppa_buf && ppa_len) {
+ ppa_list = dma_pool_alloc(dev->dma_pool, GFP_KERNEL, &ppa_dma);
+ if (!ppa_list) {
+
diff --git a/patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch b/patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
new file mode 100644
index 0000000000..49eb304aaa
--- /dev/null
+++ b/patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
@@ -0,0 +1,72 @@
+From 83e37e0bdd1470bbe6612250b745ad39b1a7b130 Mon Sep 17 00:00:00 2001
+From: Rakesh Pillai <pillair@codeaurora.org>
+Date: Fri, 15 Feb 2019 14:16:02 +0530
+Subject: [PATCH] mac80211: Restore vif beacon interval if start ap fails
+Git-commit: 83e37e0bdd1470bbe6612250b745ad39b1a7b130
+Patch-mainline: v5.0
+References: bsc#1051510
+
+The starting of AP interface can fail due to invalid
+beacon interval, which does not match the minimum gcd
+requirement set by the wifi driver. In such case, the
+beacon interval of that interface gets updated with
+that invalid beacon interval.
+
+The next time that interface is brought up in AP mode,
+an interface combination check is performed and the
+beacon interval is taken from the previously set value.
+
+In a case where an invalid beacon interval, i.e. a beacon
+interval value which does not satisfy the minimum gcd criteria
+set by the driver, is set, all the subsequent trials to
+bring that interface in AP mode will fail, even if the
+subsequent trials have a valid beacon interval.
+
+To avoid this, in case of a failure in bringing up an
+interface in AP mode due to interface combination error,
+the interface beacon interval which is stored in bss
+conf, needs to be restored with the last working value
+of beacon interval.
+
+Tested on ath10k using WCN3990.
+
+Cc: stable@vger.kernel.org
+Fixes: 0c317a02ca98 ("cfg80211: support virtual interfaces with different beacon intervals")
+Signed-off-by: Rakesh Pillai <pillair@codeaurora.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/cfg.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -884,6 +884,7 @@ static int ieee80211_start_ap(struct wip
+ BSS_CHANGED_P2P_PS |
+ BSS_CHANGED_TXPOWER;
+ int err;
++ int prev_beacon_int;
+
+ old = sdata_dereference(sdata->u.ap.beacon, sdata);
+ if (old)
+@@ -906,6 +907,7 @@ static int ieee80211_start_ap(struct wip
+
+ sdata->needed_rx_chains = sdata->local->rx_chains;
+
++ prev_beacon_int = sdata->vif.bss_conf.beacon_int;
+ sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+
+ mutex_lock(&local->mtx);
+@@ -914,8 +916,10 @@ static int ieee80211_start_ap(struct wip
+ if (!err)
+ ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
+ mutex_unlock(&local->mtx);
+- if (err)
++ if (err) {
++ sdata->vif.bss_conf.beacon_int = prev_beacon_int;
+ return err;
++ }
+
+ /*
+ * Apply control port protocol, this allows us to
diff --git a/patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch b/patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch
new file mode 100644
index 0000000000..613522517e
--- /dev/null
+++ b/patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch
@@ -0,0 +1,61 @@
+From 9d0f50b80222dc273e67e4e14410fcfa4130a90c Mon Sep 17 00:00:00 2001
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 29 Jan 2019 11:10:57 +0100
+Subject: [PATCH] mac80211: ensure that mgmt tx skbs have tailroom for encryption
+Git-commit: 9d0f50b80222dc273e67e4e14410fcfa4130a90c
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+Some drivers use IEEE80211_KEY_FLAG_SW_MGMT_TX to indicate that management
+frames need to be software encrypted. Since normal data packets are still
+encrypted by the hardware, crypto_tx_tailroom_needed_cnt gets decremented
+after key upload to hw. This can lead to passing skbs to ccmp_encrypt_skb,
+which don't have the necessary tailroom for software encryption.
+
+Change the code to add tailroom for encrypted management packets, even if
+crypto_tx_tailroom_needed_cnt is 0.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/mac80211/tx.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index f170d6c6629a..928f13a208b0 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -1938,9 +1938,16 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+ int head_need, bool may_encrypt)
+ {
+ struct ieee80211_local *local = sdata->local;
++ struct ieee80211_hdr *hdr;
++ bool enc_tailroom;
+ int tail_need = 0;
+
+- if (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt) {
++ hdr = (struct ieee80211_hdr *) skb->data;
++ enc_tailroom = may_encrypt &&
++ (sdata->crypto_tx_tailroom_needed_cnt ||
++ ieee80211_is_mgmt(hdr->frame_control));
++
++ if (enc_tailroom) {
+ tail_need = IEEE80211_ENCRYPT_TAILROOM;
+ tail_need -= skb_tailroom(skb);
+ tail_need = max_t(int, tail_need, 0);
+@@ -1948,8 +1955,7 @@ static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata,
+
+ if (skb_cloned(skb) &&
+ (!ieee80211_hw_check(&local->hw, SUPPORTS_CLONED_SKBS) ||
+- !skb_clone_writable(skb, ETH_HLEN) ||
+- (may_encrypt && sdata->crypto_tx_tailroom_needed_cnt)))
++ !skb_clone_writable(skb, ETH_HLEN) || enc_tailroom))
+ I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
+ else if (head_need || tail_need)
+ I802_DEBUG_INC(local->tx_expand_skb_head);
+--
+2.16.4
+
diff --git a/patches.fixes/netrom-switch-to-sock-timer-API.patch b/patches.fixes/netrom-switch-to-sock-timer-API.patch
new file mode 100644
index 0000000000..a79a660511
--- /dev/null
+++ b/patches.fixes/netrom-switch-to-sock-timer-API.patch
@@ -0,0 +1,100 @@
+From 63346650c1a94a92be61a57416ac88c0a47c4327 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Thu, 24 Jan 2019 14:18:18 -0800
+Subject: [PATCH] netrom: switch to sock timer API
+Git-commit: 63346650c1a94a92be61a57416ac88c0a47c4327
+Patch-mainline: v5.0-rc5
+References: bsc#1051510
+
+sk_reset_timer() and sk_stop_timer() properly handle
+sock refcnt for timer function. Switching to them
+could fix a refcounting bug reported by syzbot.
+
+Reported-and-tested-by: syzbot+defa700d16f1bd1b9a05@syzkaller.appspotmail.com
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-hams@vger.kernel.org
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/netrom/nr_timer.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/net/netrom/nr_timer.c b/net/netrom/nr_timer.c
+index cbd51ed5a2d7..908e53ab47a4 100644
+--- a/net/netrom/nr_timer.c
++++ b/net/netrom/nr_timer.c
+@@ -52,21 +52,21 @@ void nr_start_t1timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t1timer, jiffies + nr->t1);
++ sk_reset_timer(sk, &nr->t1timer, jiffies + nr->t1);
+ }
+
+ void nr_start_t2timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t2timer, jiffies + nr->t2);
++ sk_reset_timer(sk, &nr->t2timer, jiffies + nr->t2);
+ }
+
+ void nr_start_t4timer(struct sock *sk)
+ {
+ struct nr_sock *nr = nr_sk(sk);
+
+- mod_timer(&nr->t4timer, jiffies + nr->t4);
++ sk_reset_timer(sk, &nr->t4timer, jiffies + nr->t4);
+ }
+
+ void nr_start_idletimer(struct sock *sk)
+@@ -74,37 +74,37 @@ void nr_start_idletimer(struct sock *sk)
+ struct nr_sock *nr = nr_sk(sk);
+
+ if (nr->idle > 0)
+- mod_timer(&nr->idletimer, jiffies + nr->idle);
++ sk_reset_timer(sk, &nr->idletimer, jiffies + nr->idle);
+ }
+
+ void nr_start_heartbeat(struct sock *sk)
+ {
+- mod_timer(&sk->sk_timer, jiffies + 5 * HZ);
++ sk_reset_timer(sk, &sk->sk_timer, jiffies + 5 * HZ);
+ }
+
+ void nr_stop_t1timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t1timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t1timer);
+ }
+
+ void nr_stop_t2timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t2timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t2timer);
+ }
+
+ void nr_stop_t4timer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->t4timer);
++ sk_stop_timer(sk, &nr_sk(sk)->t4timer);
+ }
+
+ void nr_stop_idletimer(struct sock *sk)
+ {
+- del_timer(&nr_sk(sk)->idletimer);
++ sk_stop_timer(sk, &nr_sk(sk)->idletimer);
+ }
+
+ void nr_stop_heartbeat(struct sock *sk)
+ {
+- del_timer(&sk->sk_timer);
++ sk_stop_timer(sk, &sk->sk_timer);
+ }
+
+ int nr_t1timer_running(struct sock *sk)
+--
+2.16.4
+
diff --git a/patches.fixes/nvme-lock-NS-list-changes-while-handling-command-eff.patch b/patches.fixes/nvme-lock-NS-list-changes-while-handling-command-eff.patch
new file mode 100644
index 0000000000..cef94e9e1a
--- /dev/null
+++ b/patches.fixes/nvme-lock-NS-list-changes-while-handling-command-eff.patch
@@ -0,0 +1,96 @@
+From: Keith Busch <keith.busch@intel.com>
+Date: Mon, 28 Jan 2019 09:46:07 -0700
+Subject: [PATCH] nvme: lock NS list changes while handling command effects
+Git-commit: e7ad43c3eda6a1690c4c3c341f95dc1c6898da83
+Patch-Mainline: v5.0-rc6
+References: bsc#1123882
+
+If a controller supports the NS Change Notification, the namespace
+scan_work is automatically triggered after attaching a new namespace.
+
+Occasionally the namespace scan_work may append the new namespace to the
+list before the admin command effects handling is completed. The effects
+handling unfreezes namespaces, but if it unfreezes the newly attached
+namespace, its request_queue freeze depth will be off and we'll hit the
+warning in blk_mq_unfreeze_queue().
+
+On the next namespace add, we will fail to freeze that queue due to the
+previous bad accounting and deadlock waiting for frozen.
+
+Fix that by preventing scan work from altering the namespace list while
+command effects handling needs to pair freeze with unfreeze.
+
+Reported-by: Wen Xiong <wenxiong@us.ibm.com>
+Tested-by: Wen Xiong <wenxiong@us.ibm.com>
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/nvme/host/core.c | 8 +++++++-
+ drivers/nvme/host/nvme.h | 1 +
+ 2 files changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 4d5e81c80cc6..e9bc23326cc1 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -1169,6 +1169,7 @@ static u32 nvme_passthru_start(struct nvme_ctrl *ctrl, struct nvme_ns *ns,
+ * effects say only one namespace is affected.
+ */
+ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
++ mutex_lock(&ctrl->scan_lock);
+ nvme_start_freeze(ctrl);
+ nvme_wait_freeze(ctrl);
+ }
+@@ -1197,8 +1198,10 @@ static void nvme_passthru_end(struct nvme_ctrl *ctrl, u32 effects)
+ */
+ if (effects & NVME_CMD_EFFECTS_LBCC)
+ nvme_update_formats(ctrl);
+- if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK))
++ if (effects & (NVME_CMD_EFFECTS_LBCC | NVME_CMD_EFFECTS_CSE_MASK)) {
+ nvme_unfreeze(ctrl);
++ mutex_unlock(&ctrl->scan_lock);
++ }
+ if (effects & NVME_CMD_EFFECTS_CCC)
+ nvme_init_identify(ctrl);
+ if (effects & (NVME_CMD_EFFECTS_NIC | NVME_CMD_EFFECTS_NCC))
+@@ -3270,6 +3273,7 @@ static void nvme_scan_work(struct work_struct *work)
+ if (nvme_identify_ctrl(ctrl, &id))
+ return;
+
++ mutex_lock(&ctrl->scan_lock);
+ nn = le32_to_cpu(id->nn);
+ if (ctrl->vs >= NVME_VS(1, 1, 0) &&
+ !(ctrl->quirks & NVME_QUIRK_IDENTIFY_CNS)) {
+@@ -3278,6 +3282,7 @@ static void nvme_scan_work(struct work_struct *work)
+ }
+ nvme_scan_ns_sequential(ctrl, nn);
+ out_free_id:
++ mutex_unlock(&ctrl->scan_lock);
+ kfree(id);
+ mutex_lock(&ctrl->namespaces_mutex);
+ list_sort(NULL, &ctrl->namespaces, ns_cmp);
+@@ -3504,6 +3509,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ ctrl->state = NVME_CTRL_NEW;
+ spin_lock_init(&ctrl->lock);
++ mutex_init(&ctrl->scan_lock);
+ INIT_LIST_HEAD(&ctrl->namespaces);
+ mutex_init(&ctrl->namespaces_mutex);
+ ctrl->dev = dev;
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index ce5d75b11cc7..cf12f579ea2e 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -146,6 +146,7 @@ struct nvme_ctrl {
+ enum nvme_ctrl_state state;
+ bool identified;
+ spinlock_t lock;
++ struct mutex scan_lock;
+ const struct nvme_ctrl_ops *ops;
+ struct request_queue *admin_q;
+ struct request_queue *connect_q;
+--
+2.16.4
+
diff --git a/patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch b/patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch
new file mode 100644
index 0000000000..8e6ce7936d
--- /dev/null
+++ b/patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch
@@ -0,0 +1,39 @@
+From 04a4af334b971814eedf4e4a413343ad3287d9a9 Mon Sep 17 00:00:00 2001
+From: Ross Lagerwall <ross.lagerwall@citrix.com>
+Date: Mon, 14 Jan 2019 09:16:56 +0000
+Subject: [PATCH] openvswitch: Avoid OOB read when parsing flow nlattrs
+Git-commit: 04a4af334b971814eedf4e4a413343ad3287d9a9
+Patch-mainline: v5.0-rc3
+References: bsc#1051510
+
+For nested and variable attributes, the expected length of an attribute
+is not known and marked by a negative number. This results in an OOB
+read when the expected length is later used to check if the attribute is
+all zeros. Fix this by using the actual length of the attribute rather
+than the expected length.
+
+Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/flow_netlink.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index 435a4bdf8f89..691da853bef5 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -500,7 +500,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
+ return -EINVAL;
+ }
+
+- if (!nz || !is_all_zero(nla_data(nla), expected_len)) {
++ if (!nz || !is_all_zero(nla_data(nla), nla_len(nla))) {
+ attrs |= 1 << type;
+ a[type] = nla;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch b/patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch
new file mode 100644
index 0000000000..1dbdf20ad5
--- /dev/null
+++ b/patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch
@@ -0,0 +1,103 @@
+From 9382fe71c0058465e942a633869629929102843d Mon Sep 17 00:00:00 2001
+From: Ed Swierk <eswierk@skyportsystems.com>
+Date: Wed, 31 Jan 2018 18:48:02 -0800
+Subject: [PATCH] openvswitch: Remove padding from packet before L3+ conntrack processing
+Git-commit: 9382fe71c0058465e942a633869629929102843d
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+IPv4 and IPv6 packets may arrive with lower-layer padding that is not
+included in the L3 length. For example, a short IPv4 packet may have
+up to 6 bytes of padding following the IP payload when received on an
+Ethernet device with a minimum packet length of 64 bytes.
+
+Higher-layer processing functions in netfilter (e.g. nf_ip_checksum(),
+and help() in nf_conntrack_ftp) assume skb->len reflects the length of
+the L3 header and payload, rather than referring back to
+ip_hdr->tot_len or ipv6_hdr->payload_len, and get confused by
+lower-layer padding.
+
+In the normal IPv4 receive path, ip_rcv() trims the packet to
+ip_hdr->tot_len before invoking netfilter hooks. In the IPv6 receive
+path, ip6_rcv() does the same using ipv6_hdr->payload_len. Similarly
+in the br_netfilter receive path, br_validate_ipv4() and
+br_validate_ipv6() trim the packet to the L3 length before invoking
+netfilter hooks.
+
+Currently in the OVS conntrack receive path, ovs_ct_execute() pulls
+the skb to the L3 header but does not trim it to the L3 length before
+calling nf_conntrack_in(NF_INET_PRE_ROUTING). When
+nf_conntrack_proto_tcp encounters a packet with lower-layer padding,
+nf_ip_checksum() fails causing a "nf_ct_tcp: bad TCP checksum" log
+message. While extra zero bytes don't affect the checksum, the length
+in the IP pseudoheader does. That length is based on skb->len, and
+without trimming, it doesn't match the length the sender used when
+computing the checksum.
+
+In ovs_ct_execute(), trim the skb to the L3 length before higher-layer
+processing.
+
+Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/conntrack.c | 34 ++++++++++++++++++++++++++++++++++
+ 1 file changed, 34 insertions(+)
+
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 62f36cc938ca..c5904f629091 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -1098,6 +1098,36 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key,
+ return 0;
+ }
+
++/* Trim the skb to the length specified by the IP/IPv6 header,
++ * removing any trailing lower-layer padding. This prepares the skb
++ * for higher-layer processing that assumes skb->len excludes padding
++ * (such as nf_ip_checksum). The caller needs to pull the skb to the
++ * network header, and ensure ip_hdr/ipv6_hdr points to valid data.
++ */
++static int ovs_skb_network_trim(struct sk_buff *skb)
++{
++ unsigned int len;
++ int err;
++
++ switch (skb->protocol) {
++ case htons(ETH_P_IP):
++ len = ntohs(ip_hdr(skb)->tot_len);
++ break;
++ case htons(ETH_P_IPV6):
++ len = sizeof(struct ipv6hdr)
++ + ntohs(ipv6_hdr(skb)->payload_len);
++ break;
++ default:
++ len = skb->len;
++ }
++
++ err = pskb_trim_rcsum(skb, len);
++ if (err)
++ kfree_skb(skb);
++
++ return err;
++}
++
+ /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero
+ * value if 'skb' is freed.
+ */
+@@ -1112,6 +1142,10 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb,
+ nh_ofs = skb_network_offset(skb);
+ skb_pull_rcsum(skb, nh_ofs);
+
++ err = ovs_skb_network_trim(skb);
++ if (err)
++ return err;
++
+ if (key->ip.frag != OVS_FRAG_TYPE_NONE) {
+ err = handle_fragments(net, key, info->zone.id, skb);
+ if (err)
+--
+2.16.4
+
diff --git a/patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch b/patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch
new file mode 100644
index 0000000000..b7444d4595
--- /dev/null
+++ b/patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch
@@ -0,0 +1,86 @@
+From 67c8d22a73128ff910e2287567132530abcf5b71 Mon Sep 17 00:00:00 2001
+From: zhangliping <zhangliping02@baidu.com>
+Date: Sat, 25 Nov 2017 22:02:12 +0800
+Subject: [PATCH] openvswitch: fix the incorrect flow action alloc size
+Git-commit: 67c8d22a73128ff910e2287567132530abcf5b71
+Patch-mainline: v4.15-rc2
+References: bsc#1051510
+
+If we want to add a datapath flow, which has more than 500 vxlan outputs'
+action, we will get the following error reports:
+ openvswitch: netlink: Flow action size 32832 bytes exceeds max
+ openvswitch: netlink: Flow action size 32832 bytes exceeds max
+ openvswitch: netlink: Actions may not be safe on all matching packets
+ ... ...
+
+It seems that we can simply enlarge the MAX_ACTIONS_BUFSIZE to fix it, but
+this is not the root cause. For example, for a vxlan output action, we need
+about 60 bytes for the nlattr, but after it is converted to the flow
+action, it only occupies 24 bytes. This means that we can still support
+more than 1000 vxlan output actions for a single datapath flow under the
+the current 32k max limitation.
+
+So even if the nla_len(attr) is larger than MAX_ACTIONS_BUFSIZE, we
+shouldn't report EINVAL and keep it move on, as the judgement can be
+done by the reserve_sfa_size.
+
+Signed-off-by: zhangliping <zhangliping02@baidu.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/openvswitch/flow_netlink.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
+index dc424798ba6f..624ea74353dd 100644
+--- a/net/openvswitch/flow_netlink.c
++++ b/net/openvswitch/flow_netlink.c
+@@ -2241,14 +2241,11 @@ int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb)
+
+ #define MAX_ACTIONS_BUFSIZE (32 * 1024)
+
+-static struct sw_flow_actions *nla_alloc_flow_actions(int size, bool log)
++static struct sw_flow_actions *nla_alloc_flow_actions(int size)
+ {
+ struct sw_flow_actions *sfa;
+
+- if (size > MAX_ACTIONS_BUFSIZE) {
+- OVS_NLERR(log, "Flow action size %u bytes exceeds max", size);
+- return ERR_PTR(-EINVAL);
+- }
++ WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);
+
+ sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);
+ if (!sfa)
+@@ -2321,12 +2318,15 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
+ new_acts_size = ksize(*sfa) * 2;
+
+ if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
+- if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size)
++ if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
++ OVS_NLERR(log, "Flow action size exceeds max %u",
++ MAX_ACTIONS_BUFSIZE);
+ return ERR_PTR(-EMSGSIZE);
++ }
+ new_acts_size = MAX_ACTIONS_BUFSIZE;
+ }
+
+- acts = nla_alloc_flow_actions(new_acts_size, log);
++ acts = nla_alloc_flow_actions(new_acts_size);
+ if (IS_ERR(acts))
+ return (void *)acts;
+
+@@ -3059,7 +3059,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
+ {
+ int err;
+
+- *sfa = nla_alloc_flow_actions(nla_len(attr), log);
++ *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE));
+ if (IS_ERR(*sfa))
+ return PTR_ERR(*sfa);
+
+--
+2.16.4
+
diff --git a/patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch b/patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
new file mode 100644
index 0000000000..d19be755c7
--- /dev/null
+++ b/patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
@@ -0,0 +1,58 @@
+From: Ilya Dryomov <idryomov@gmail.com>
+Date: Tue, 8 Jan 2019 19:47:38 +0100
+Subject: rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
+Git-commit: 85f5a4d666fd9be73856ed16bb36c5af5b406b29
+Patch-mainline: v5.0-rc2
+References: bsc#1125797
+
+There is a window between when RBD_DEV_FLAG_REMOVING is set and when
+the device is removed from rbd_dev_list. During this window, we set
+"already" and return 0.
+
+Returning 0 from write(2) can confuse userspace tools because
+0 indicates that nothing was written. In particular, "rbd unmap"
+will retry the write multiple times a second:
+
+ 10:28:05.463299 write(4, "0", 1) = 0
+ 10:28:05.463509 write(4, "0", 1) = 0
+ 10:28:05.463720 write(4, "0", 1) = 0
+ 10:28:05.463942 write(4, "0", 1) = 0
+ 10:28:05.464155 write(4, "0", 1) = 0
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Tested-by: Dongsheng Yang <dongsheng.yang@easystack.cn>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ drivers/block/rbd.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -6307,7 +6307,6 @@ static ssize_t do_rbd_remove(struct bus_
+ struct list_head *tmp;
+ int dev_id;
+ char opt_buf[6];
+- bool already = false;
+ bool force = false;
+ int ret;
+
+@@ -6340,13 +6339,13 @@ static ssize_t do_rbd_remove(struct bus_
+ spin_lock_irq(&rbd_dev->lock);
+ if (rbd_dev->open_count && !force)
+ ret = -EBUSY;
+- else
+- already = test_and_set_bit(RBD_DEV_FLAG_REMOVING,
+- &rbd_dev->flags);
++ else if (test_and_set_bit(RBD_DEV_FLAG_REMOVING,
++ &rbd_dev->flags))
++ ret = -EINPROGRESS;
+ spin_unlock_irq(&rbd_dev->lock);
+ }
+ spin_unlock(&rbd_dev_list_lock);
+- if (ret < 0 || already)
++ if (ret)
+ return ret;
+
+ if (force) {
+
diff --git a/patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch b/patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch
new file mode 100644
index 0000000000..54ae7387fa
--- /dev/null
+++ b/patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch
@@ -0,0 +1,44 @@
+From: Martin Wilck <mwilck@suse.com>
+Date: Thu, 14 Feb 2019 22:57:41 +0100
+Subject: scsi: core: reset host byte in DID_NEXUS_FAILURE case
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Git-commit: 4a067cf823d9d8e50d41cfb618011c0d4a969c72
+References: bsc#1122764
+
+Up to 4.12, __scsi_error_from_host_byte() would reset the host byte to
+DID_OK for various cases including DID_NEXUS_FAILURE. Commit
+2a842acab109 ("block: introduce new block status code type") replaced this
+function with scsi_result_to_blk_status() and removed the host-byte
+resetting code for the DID_NEXUS_FAILURE case. As the line
+set_host_byte(cmd, DID_OK) was preserved for the other cases, I suppose
+this was an editing mistake.
+
+The fact that the host byte remains set after 4.13 is causing problems with
+the sg_persist tool, which now returns success rather then exit status 24
+when a RESERVATION CONFLICT error is encountered.
+
+Fixes: 2a842acab109 "block: introduce new block status code type"
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+---
+ drivers/scsi/scsi_lib.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 6d65ac5..f8d51c3 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -655,6 +655,7 @@ static blk_status_t scsi_result_to_blk_status(struct scsi_cmnd *cmd, int result)
+ set_host_byte(cmd, DID_OK);
+ return BLK_STS_TARGET;
+ case DID_NEXUS_FAILURE:
++ set_host_byte(cmd, DID_OK);
+ return BLK_STS_NEXUS;
+ case DID_ALLOC_FAILURE:
+ set_host_byte(cmd, DID_OK);
+--
+2.20.1
+
diff --git a/patches.fixes/scsi-lpfc-remove-an-unnecessary-NULL-check.patch b/patches.fixes/scsi-lpfc-remove-an-unnecessary-NULL-check.patch
new file mode 100644
index 0000000000..bf7e804cbf
--- /dev/null
+++ b/patches.fixes/scsi-lpfc-remove-an-unnecessary-NULL-check.patch
@@ -0,0 +1,37 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 23 Aug 2018 16:56:33 +0300
+Subject: [PATCH] scsi: lpfc: remove an unnecessary NULL check
+Git-commit: 26c724a690a1cd10575365da90b5b4040278a6c5
+Patch-Mainline: v4.20-rc1
+References: bsc#1121317
+
+Smatch complains about this code:
+
+ drivers/scsi/lpfc/lpfc_scsi.c:1053 lpfc_get_scsi_buf_s4()
+ warn: variable dereferenced before check 'lpfc_cmd' (see line 1039)
+
+Fortunately the NULL check isn't required so I have removed it.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/lpfc/lpfc_scsi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index 5c7858e735c9..ef20d37e44db 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -1050,7 +1050,7 @@ lpfc_get_scsi_buf_s4(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
+ if (!found)
+ return NULL;
+
+- if (lpfc_ndlp_check_qdepth(phba, ndlp) && lpfc_cmd) {
++ if (lpfc_ndlp_check_qdepth(phba, ndlp)) {
+ atomic_inc(&ndlp->cmd_pending);
+ lpfc_cmd->flags |= LPFC_SBUF_BUMP_QDEPTH;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch b/patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch
new file mode 100644
index 0000000000..f359dd29a8
--- /dev/null
+++ b/patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch
@@ -0,0 +1,118 @@
+From 2fdeee2549231b1f989f011bb18191f5660d3745 Mon Sep 17 00:00:00 2001
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Mon, 11 Feb 2019 21:59:51 -0800
+Subject: [PATCH] team: avoid complex list operations in team_nl_cmd_options_set()
+Git-commit: 2fdeee2549231b1f989f011bb18191f5660d3745
+Patch-mainline: v5.0-rc7
+References: bsc#1051510
+
+The current opt_inst_list operations inside team_nl_cmd_options_set()
+is too complex to track:
+
+ LIST_HEAD(opt_inst_list);
+ nla_for_each_nested(...) {
+ list_for_each_entry(opt_inst, &team->option_inst_list, list) {
+ if (__team_option_inst_tmp_find(&opt_inst_list, opt_inst))
+ continue;
+ list_add(&opt_inst->tmp_list, &opt_inst_list);
+ }
+ }
+ team_nl_send_event_options_get(team, &opt_inst_list);
+
+as while we retrieve 'opt_inst' from team->option_inst_list, it could
+be added to the local 'opt_inst_list' for multiple times. The
+__team_option_inst_tmp_find() doesn't work, as the setter
+team_mode_option_set() still calls team->ops.exit() which uses
+->tmp_list too in __team_options_change_check().
+
+Simplify the list operations by moving the 'opt_inst_list' and
+team_nl_send_event_options_get() into the nla_for_each_nested() loop so
+that it can be guranteed that we won't insert a same list entry for
+multiple times. Therefore, __team_option_inst_tmp_find() can be removed
+too.
+
+Fixes: 4fb0534fb7bb ("team: avoid adding twice the same option to the event list")
+Fixes: 2fcdb2c9e659 ("team: allow to send multiple set events in one message")
+Reported-by: syzbot+4d4af685432dc0e56c91@syzkaller.appspotmail.com
+Reported-by: syzbot+68ee510075cf64260cc4@syzkaller.appspotmail.com
+Cc: Jiri Pirko <jiri@resnulli.us>
+Cc: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Reviewed-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/team/team.c | 27 +++++----------------------
+ 1 file changed, 5 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index afd9d25d1992..958f1cf67282 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -256,17 +256,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
+ }
+ }
+
+-static bool __team_option_inst_tmp_find(const struct list_head *opts,
+- const struct team_option_inst *needle)
+-{
+- struct team_option_inst *opt_inst;
+-
+- list_for_each_entry(opt_inst, opts, tmp_list)
+- if (opt_inst == needle)
+- return true;
+- return false;
+-}
+-
+ static int __team_options_register(struct team *team,
+ const struct team_option *option,
+ size_t option_count)
+@@ -2460,7 +2449,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ int err = 0;
+ int i;
+ struct nlattr *nl_option;
+- LIST_HEAD(opt_inst_list);
+
+ rtnl_lock();
+
+@@ -2480,6 +2468,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
+ struct nlattr *attr;
+ struct nlattr *attr_data;
++ LIST_HEAD(opt_inst_list);
+ enum team_option_type opt_type;
+ int opt_port_ifindex = 0; /* != 0 for per-port options */
+ u32 opt_array_index = 0;
+@@ -2584,23 +2573,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ if (err)
+ goto team_put;
+ opt_inst->changed = true;
+-
+- /* dumb/evil user-space can send us duplicate opt,
+- * keep only the last one
+- */
+- if (__team_option_inst_tmp_find(&opt_inst_list,
+- opt_inst))
+- continue;
+-
+ list_add(&opt_inst->tmp_list, &opt_inst_list);
+ }
+ if (!opt_found) {
+ err = -ENOENT;
+ goto team_put;
+ }
+- }
+
+- err = team_nl_send_event_options_get(team, &opt_inst_list);
++ err = team_nl_send_event_options_get(team, &opt_inst_list);
++ if (err)
++ break;
++ }
+
+ team_put:
+ team_nl_team_put(team);
+--
+2.16.4
+
diff --git a/patches.kabi/nvme-kABI-fix-for-scan_lock.patch b/patches.kabi/nvme-kABI-fix-for-scan_lock.patch
new file mode 100644
index 0000000000..6ca8063342
--- /dev/null
+++ b/patches.kabi/nvme-kABI-fix-for-scan_lock.patch
@@ -0,0 +1,32 @@
+From: Hannes Reinecke <hare@suse.de>
+Date: Tue, 19 Feb 2019 13:43:50 +0100
+Subject: [PATCH] nvme: kABI fix for scan_lock
+Patch-Mainline: never, SLE15 specific kABI fix
+References: bsc#1123882
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/nvme/host/nvme.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -146,7 +146,6 @@ struct nvme_ctrl {
+ enum nvme_ctrl_state state;
+ bool identified;
+ spinlock_t lock;
+- struct mutex scan_lock;
+ const struct nvme_ctrl_ops *ops;
+ struct request_queue *admin_q;
+ struct request_queue *connect_q;
+@@ -235,6 +234,10 @@ struct nvme_ctrl {
+ u16 maxcmd;
+ int nr_reconnects;
+ struct nvmf_ctrl_options *opts;
++
++#ifndef __GENKSYMS__
++ struct mutex scan_lock;
++#endif
+ };
+
+ #ifdef CONFIG_NVME_MULTIPATH
diff --git a/patches.suse/mm-oom-fix-use-after-free-in-oom_kill_process.patch b/patches.suse/mm-oom-fix-use-after-free-in-oom_kill_process.patch
new file mode 100644
index 0000000000..726676f212
--- /dev/null
+++ b/patches.suse/mm-oom-fix-use-after-free-in-oom_kill_process.patch
@@ -0,0 +1,71 @@
+From 47381925ad407e76ba5f11109ae82a19b08e4326 Mon Sep 17 00:00:00 2001
+From: Shakeel Butt <shakeelb@google.com>
+Date: Fri, 1 Feb 2019 14:20:54 -0800
+Subject: [PATCH] mm, oom: fix use-after-free in oom_kill_process
+
+References: git fixes (mm/oom)
+Patch-mainline: v5.0
+Git-commit: cefc7ef3c87d02fc9307835868ff721ea12cc597
+
+Syzbot instance running on upstream kernel found a use-after-free bug in
+oom_kill_process. On further inspection it seems like the process
+selected to be oom-killed has exited even before reaching
+read_lock(&tasklist_lock) in oom_kill_process(). More specifically the
+tsk->usage is 1 which is due to get_task_struct() in oom_evaluate_task()
+and the put_task_struct within for_each_thread() frees the tsk and
+for_each_thread() tries to access the tsk. The easiest fix is to do
+get/put across the for_each_thread() on the selected task.
+
+Now the next question is should we continue with the oom-kill as the
+previously selected task has exited? However before adding more
+complexity and heuristics, let's answer why we even look at the children
+of oom-kill selected task? The select_bad_process() has already selected
+the worst process in the system/memcg. Due to race, the selected
+process might not be the worst at the kill time but does that matter?
+The userspace can use the oom_score_adj interface to prefer children to
+be killed before the parent. I looked at the history but it seems like
+this is there before git history.
+
+Link: http://lkml.kernel.org/r/20190121215850.221745-1-shakeelb@google.com
+Reported-by: syzbot+7fbbfa368521945f0e3d@syzkaller.appspotmail.com
+Fixes: 6b0c81b3be11 ("mm, oom: reduce dependency on tasklist_lock")
+Signed-off-by: Shakeel Butt <shakeelb@google.com>
+Reviewed-by: Roman Gushchin <guro@fb.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: David Rientjes <rientjes@google.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ mm/oom_kill.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index 89b2261e0c10..6806787fdc4b 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -861,6 +861,13 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
+ * still freeing memory.
+ */
+ read_lock(&tasklist_lock);
++
++ /*
++ * The task 'p' might have already exited before reaching here. The
++ * put_task_struct() will free task_struct 'p' while the loop still try
++ * to access the field of 'p', so, get an extra reference.
++ */
++ get_task_struct(p);
+ for_each_thread(p, t) {
+ list_for_each_entry(child, &t->children, sibling) {
+ unsigned int child_points;
+@@ -880,6 +887,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
+ }
+ }
+ }
++ put_task_struct(p);
+ read_unlock(&tasklist_lock);
+
+ p = find_lock_task_mm(victim);
diff --git a/patches.suse/rcu-Fix-up-pending-cbs-check-in-rcu_prepare_for_idle.patch b/patches.suse/rcu-Fix-up-pending-cbs-check-in-rcu_prepare_for_idle.patch
new file mode 100644
index 0000000000..efca565030
--- /dev/null
+++ b/patches.suse/rcu-Fix-up-pending-cbs-check-in-rcu_prepare_for_idle.patch
@@ -0,0 +1,36 @@
+From 295fd5213000841f739ec99e25445d42a9952bdf Mon Sep 17 00:00:00 2001
+From: Neeraj Upadhyay <neeraju@codeaurora.org>
+Date: Mon, 7 Aug 2017 11:20:10 +0530
+Subject: [PATCH] rcu: Fix up pending cbs check in rcu_prepare_for_idle
+
+References: git fixes (kernel/rcu)
+Patch-mainline: v4.15
+Git-commit: 135bd1a230bb69a68c9808a7d25467318900b80a
+
+The pending-callbacks check in rcu_prepare_for_idle() is backwards.
+It should accelerate if there are pending callbacks, but the check
+rather uselessly accelerates only if there are no callbacks. This commit
+therefore inverts this check.
+
+Fixes: 15fecf89e46a ("srcu: Abstract multi-tail callback list handling")
+Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: <stable@vger.kernel.org> # 4.12.x
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ kernel/rcu/tree_plugin.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
+index ee04ef051843..fe3ee9de41ab 100644
+--- a/kernel/rcu/tree_plugin.h
++++ b/kernel/rcu/tree_plugin.h
+@@ -1437,7 +1437,7 @@ static void rcu_prepare_for_idle(void)
+ rdtp->last_accelerate = jiffies;
+ for_each_rcu_flavor(rsp) {
+ rdp = this_cpu_ptr(rsp->rda);
+- if (rcu_segcblist_pend_cbs(&rdp->cblist))
++ if (!rcu_segcblist_pend_cbs(&rdp->cblist))
+ continue;
+ rnp = rdp->mynode;
+ raw_spin_lock_rcu_node(rnp); /* irqs already disabled. */
diff --git a/patches.suse/rcu-Make-need_resched-respond-to-urgent-RCU-QS-needs.patch b/patches.suse/rcu-Make-need_resched-respond-to-urgent-RCU-QS-needs.patch
new file mode 100644
index 0000000000..0bcbd374da
--- /dev/null
+++ b/patches.suse/rcu-Make-need_resched-respond-to-urgent-RCU-QS-needs.patch
@@ -0,0 +1,59 @@
+From 3d6ea130af2832bea1d6dac9f9709f034c43a1c9 Mon Sep 17 00:00:00 2001
+From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+Date: Mon, 9 Jul 2018 13:47:30 -0700
+Subject: [PATCH] rcu: Make need_resched() respond to urgent RCU-QS needs
+
+References: git fixes (kernel/rcu)
+Patch-mainline: v4.20
+Git-commit: 92aa39e9dc77481b90cbef25e547d66cab901496
+
+The per-CPU rcu_dynticks.rcu_urgent_qs variable communicates an urgent
+need for an RCU quiescent state from the force-quiescent-state processing
+within the grace-period kthread to context switches and to cond_resched().
+Unfortunately, such urgent needs are not communicated to need_resched(),
+which is sometimes used to decide when to invoke cond_resched(), for
+but one example, within the KVM vcpu_run() function. As of v4.15, this
+can result in synchronize_sched() being delayed by up to ten seconds,
+which can be problematic, to say nothing of annoying.
+
+This commit therefore checks rcu_dynticks.rcu_urgent_qs from within
+rcu_check_callbacks(), which is invoked from the scheduling-clock
+interrupt handler. If the current task is not an idle task and is
+not executing in usermode, a context switch is forced, and either way,
+the rcu_dynticks.rcu_urgent_qs variable is set to false. If the current
+task is an idle task, then RCU's dyntick-idle code will detect the
+quiescent state, so no further action is required. Similarly, if the
+task is executing in usermode, other code in rcu_check_callbacks() and
+its called functions will report the corresponding quiescent state.
+
+Reported-by: Marius Hillenbrand <mhillenb@amazon.de>
+Reported-by: David Woodhouse <dwmw2@infradead.org>
+Suggested-by: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ kernel/rcu/tree.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
+index a4db6d1574f3..930caa0cc3d0 100644
+--- a/kernel/rcu/tree.c
++++ b/kernel/rcu/tree.c
+@@ -2856,6 +2856,17 @@ void rcu_check_callbacks(int user)
+ {
+ trace_rcu_utilization(TPS("Start scheduler-tick"));
+ increment_cpu_stall_ticks();
++
++ /* The load-acquire pairs with the store-release setting to true. */
++ if (smp_load_acquire(this_cpu_ptr(&rcu_dynticks.rcu_urgent_qs))) {
++ /* Idle and userspace execution already are quiescent states. */
++ if (!is_idle_task(current) && !user) {
++ set_tsk_need_resched(current);
++ set_preempt_need_resched();
++ }
++ __this_cpu_write(rcu_dynticks.rcu_urgent_qs, false);
++ }
++
+ if (user || rcu_is_cpu_rrupt_from_idle()) {
+
+ /*
diff --git a/rpm/klp-symbols b/rpm/klp-symbols
index 012fca43c3..c108030a9e 100755
--- a/rpm/klp-symbols
+++ b/rpm/klp-symbols
@@ -36,7 +36,7 @@ fi
get_symbols()
{
- nm -f posix "$1" | grep -v '\( [UN] \)\|\(\.L\|__crc_\)' | cut -d\ -f1,2
+ nm -f posix "$1" | grep -v '\( [UN] \)\|\(\.L\|__crc_\)' | cut -d\ -f1
}
echo "klp-convert-symbol-data.$KLP_DATA_VERSION" > "$KLP_SYMBOLS"
diff --git a/series.conf b/series.conf
index ee2ba58a9b..2aab073788 100644
--- a/series.conf
+++ b/series.conf
@@ -5338,6 +5338,7 @@
patches.drivers/0001-xhci-add-port-status-tracing.patch
patches.drivers/0021-usb-Increase-root-hub-reset-signaling-time-to-preven.patch
patches.drivers/0022-xhci-rework-bus_resume-and-check-ports-are-suspended.patch
+ patches.drivers/phy-qcom-qmp-Fix-failure-path-in-phy_init-functions.patch
patches.drivers/dt-bindings-phy-sun4i-usb-phy-add-property-descriptions-for-h3.patch
patches.drivers/0037-phy-rockchip-inno-usb2-add-support-for-rockchip-usbg.patch
patches.drivers/0038-phy-rockchip-inno-usb2-add-support-for-otg-mux-inter.patch
@@ -7871,6 +7872,7 @@
patches.fixes/s390-bpf-take-advantage-of-stack_depth-tracking.patch
patches.arch/s390-sles15-02-02-te-ctl.patch
patches.arch/s390-sles15-01-11-s390-noexec-execute-kexec-datamover-without-DAT.patch
+ patches.suse/rcu-Fix-up-pending-cbs-check-in-rcu_prepare_for_idle.patch
patches.fixes/sched-Make-resched_cpu-unconditional.patch
patches.arch/locking-static_keys-improve-uninitialized-key-warning.patch
patches.suse/0001-locking-qrwlock-Use-struct-qrwlock-instead-of-struct.patch
@@ -8264,6 +8266,7 @@
patches.suse/writeback-eliminate-work-item-allocation-in-bd_start_writeback.patch
patches.drivers/block-bfq-Disable-writeback-throttling.patch
patches.fixes/block-set-request_list-for-request.patch
+ patches.fixes/lightnvm-fail-fast-on-passthrough-commands.patch
patches.suse/0015-bcache-Avoid-nested-function-definition.patch
patches.suse/0016-bcache-check-ca-alloc_thread-initialized-before-wake.patch
patches.suse/0017-bcache-fix-a-comments-typo-in-bch_alloc_sectors.patch
@@ -10406,6 +10409,7 @@
patches.fixes/crypto-skcipher-Fix-skcipher_walk_aead_common
patches.drivers/net-thunderx-Fix-TCP-UDP-checksum-offload-for-IPv6-p.patch
patches.fixes/net-openvswitch-datapath-fix-data-type-in-queue_gso_.patch
+ patches.fixes/openvswitch-fix-the-incorrect-flow-action-alloc-size.patch
patches.fixes/sctp-set-sender-next_tsn-for-the-old-result-with-cts.patch
patches.drivers/mac80211-use-QoS-NDP-for-AP-probing
patches.drivers/mac80211-fix-the-update-of-path-metric-for-RANN-fram
@@ -11421,6 +11425,7 @@
patches.arch/powerpc-64s-Allow-control-of-RFI-flush-via-debugfs.patch
patches.arch/powerpc-pseries-include-linux-types.h-in-asm-hvcall.h.patch
patches.fixes/ARM-sunxi_defconfig-Enable-CMA.patch
+ patches.drivers/phy-work-around-phys-references-to-usb-nop-xceiv-dev.patch
patches.fixes/workqueue-avoid-hard-lockups-in-show_workqueue_state.patch
patches.drivers/libata-apply-max_sec_1024-to-all-liteon-ep1-series-devices.patch
patches.drivers/Input-twl4030-vibra-fix-sibling-node-lookup
@@ -13103,6 +13108,7 @@
patches.drivers/net-create-skb_gso_validate_mac_len.patch
patches.drivers/bnx2x-disable-GSO-where-gso_size-is-too-big-for-hard.patch
patches.fixes/tcp_bbr-fix-pacing_gain-to-always-be-unity-when-usin.patch
+ patches.fixes/openvswitch-Remove-padding-from-packet-before-L3-con.patch
patches.suse/rocker-fix-possible-null-pointer-dereference-in-rock.patch
patches.fixes/netfilter-x_tables-fix-pointer-leaks-to-userspace.patch
patches.fixes/netfilter-ipt_CLUSTERIP-fix-out-of-bounds-accesses-i.patch
@@ -14909,6 +14915,9 @@
patches.drivers/usbip-Correct-maximum-value-of-CONFIG_USBIP_VHCI_HC_.patch
patches.drivers/0001-usb-xhci-Clean-up-error-code-in-xhci_dbc_tty_registe.patch
patches.fixes/0001-xhci-zero-usb-device-slot_id-member-when-disabling-a.patch
+ patches.drivers/phy-qcom-qmp-Fix-phy-pipe-clock-gating.patch
+ patches.drivers/phy-rockchip-emmc-retry-calpad-busy-trimming.patch
+ patches.drivers/phy-allwinner-sun4i-usb-poll-vbus-changes-on-A23-A33.patch
patches.drivers/USB-serial-ftdi_sio-add-RT-Systems-VX-8-cable.patch
patches.drivers/USB-serial-cp210x-add-ELDAT-Easywave-RX09-id.patch
patches.drivers/USB-serial-ftdi_sio-add-support-for-Harman-FirmwareH.patch
@@ -19175,6 +19184,7 @@
patches.drivers/smsc95xx-Check-for-Wake-on-LAN-modes.patch
patches.drivers/qlcnic-fix-Tx-descriptor-corruption-on-82xx-devices.patch
patches.fixes/Bluetooth-SMP-fix-crash-in-unpairing.patch
+ patches.fixes/Revert-openvswitch-Fix-template-leak-in-error-cases.patch
patches.drivers/declance-Fix-continuation-with-the-adapter-identific.patch
patches.suse/inet-make-sure-to-grab-rcu_read_lock-before-using-ir.patch
patches.suse/bonding-fix-warning-message.patch
@@ -19243,6 +19253,7 @@
patches.suse/msft-hv-1761-tools-hv-fcopy-set-error-in-case-an-unknown-operatio.patch
patches.drivers/mach64-detect-the-dot-clock-divider-correctly-on-spa.patch
patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages
+ patches.drivers/of-unittest-Disable-interrupt-node-tests-for-old-wor.patch
patches.fixes/0001-dm-cache-destroy-migration_cache-if-cache-target-reg.patch
patches.fixes/0001-dm-fix-report-zone-remapping-to-account-for-partitio.patch
patches.fixes/0001-dm-linear-eliminate-linear_end_io-call-if-CONFIG_DM_.patch
@@ -19332,6 +19343,7 @@
patches.drivers/mailbox-PCC-handle-parse-error.patch
patches.fixes/0001-xen-swiotlb-use-actually-allocated-size-on-check-phy.patch
patches.arch/s390-sthyi-fix-machine-name-validity-indication
+ patches.suse/rcu-Make-need_resched-respond-to-urgent-RCU-QS-needs.patch
patches.fixes/kprobes-Return-error-if-we-fail-to-reuse-kprobe-inst.patch
patches.suse/sched-numa-remove-unused-code-from-update_numa_stats.patch
patches.suse/sched-numa-remove-unused-nr_running-field.patch
@@ -19467,6 +19479,7 @@
patches.arch/x86-PCI-Apply-VMD-s-AERSID-fixup-generically.patch
patches.drivers/pci-iproc-remove-paxc-slot-check-to-allow-vf-support
patches.drivers/pci-vmd-detach-resources-after-stopping-root-bus
+ patches.fixes/scsi-lpfc-remove-an-unnecessary-NULL-check.patch
patches.drivers/scsi-qla2xxx-Fix-process-response-queue-for-ISP26XX-.patch
patches.drivers/scsi-qla2xxx-Fix-incorrect-port-speed-being-set-for-.patch
patches.drivers/scsi-qla2xxx-Use-correct-qpair-for-ABTS-CMD.patch
@@ -19567,6 +19580,7 @@
patches.drivers/RDMA-bnxt_re-Add-missing-spin-lock-initialization.patch
patches.drivers/RDMA-bnxt_re-Avoid-NULL-check-after-accessing-the-po.patch
patches.drivers/RDMA-core-Fix-unwinding-flow-in-case-of-error-to-reg.patch
+ patches.drivers/phy-renesas-rcar-gen3-usb2-fix-vbus_ctrl-for-role-sy.patch
patches.drivers/usb-gadget-udc-atmel-handle-at91sam9rl-PMC.patch
patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
@@ -19777,6 +19791,7 @@
patches.suse/0001-block-make-sure-discard-bio-is-aligned-with-logical-.patch
patches.suse/0001-block-cleanup-__blkdev_issue_discard.patch
patches.suse/0001-block-make-sure-writesame-bio-is-aligned-with-logica.patch
+ patches.drivers/of-numa-Validate-some-distance-map-rules.patch
patches.fixes/lib-raid6-Fix-arm64-test-build.patch
patches.fixes/0001-xen-fix-xen_qlock_wait.patch
patches.drivers/clk-fixed-factor-fix-of_node_get-put-imbalance.patch
@@ -20133,6 +20148,7 @@
patches.suse/net-8139cp-fix-a-BUG-triggered-by-changing-mtu-with-.patch
patches.drivers/net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
patches.suse/sctp-kfree_rcu-asoc.patch
+ patches.drivers/mv88e6060-disable-hardware-level-MAC-learning.patch
patches.suse/net-mlx4_en-Change-min-MTU-size-to-ETH_MIN_MTU.patch
patches.suse/rtnetlink-ndo_dflt_fdb_dump-only-work-for-ARPHRD_ETH.patch
patches.drivers/ethernet-fman-fix-wrong-of_node_put-in-probe-function.patch
@@ -20404,6 +20420,13 @@
patches.drivers/scsi-lpfc-update-driver-version-to-12.0.0.9.patch
patches.drivers/Revert-scsi-lpfc-ls_rjt-erroneus-FLOGIs.patch
patches.drivers/scsi-lpfc-Enable-Management-features-for-IF_TYPE-6.patch
+ patches.drivers/scsi-lpfc-do-not-set-queue-page_count-to-0-if-pc_sli.patch
+ patches.drivers/scsi-lpfc-Fix-link-state-reporting-for-trunking-when.patch
+ patches.drivers/scsi-lpfc-Correct-MDS-loopback-diagnostics-support.patch
+ patches.drivers/scsi-lpfc-update-fault-value-on-successful-trunk-eve.patch
+ patches.drivers/scsi-lpfc-Fix-discovery-failure-when-PLOGI-is-defere.patch
+ patches.drivers/scsi-lpfc-Add-log-messages-to-aid-in-debugging-fc4ty.patch
+ patches.drivers/scsi-lpfc-Update-lpfc-version-to-12.0.0.10.patch
patches.arch/s390-sles12sp4-03-04-21-mlx4-trigger-IB-events-needed-by-SMC.patch
patches.suse/0001-dm-do-not-allow-readahead-to-limit-IO-size.patch
patches.drivers/mmc-atmel-mci-do-not-assume-idle-after-atmci_request.patch
@@ -20430,6 +20453,7 @@
patches.drivers/gpiolib-Fix-return-value-of-gpio_to_desc-stub-if-GPI.patch
patches.drivers/power-supply-olpc_battery-correct-the-temperature-un.patch
patches.drivers/usb-hub-delay-hub-autosuspend-if-USB3-port-is-still-.patch
+ patches.drivers/phy-sun4i-usb-add-support-for-missing-USB-PHY-index.patch
patches.drivers/usb-dwc3-Correct-the-logic-for-checking-TRB-full-in-.patch
patches.drivers/usb-mtu3-fix-the-issue-about-SetFeature-U1-U2_Enable.patch
patches.drivers/usb-dwc2-host-use-hrtimer-for-nak-retries.patch
@@ -20514,6 +20538,8 @@
patches.suse/net-hamradio-6pack-use-mod_timer-to-rearm-timers.patch
patches.drivers/isdn-fix-kernel-infoleak-in-capi_unlocked_ioctl.patch
patches.fixes/bpf-move-prev_-insn_idx-into-verifier-env.patch
+ patches.fixes/bpf-move-tmp-variable-into-ax-register-in-interprete.patch
+ patches.fixes/bpf-enable-access-to-ax-register-also-from-verifier-.patch
patches.fixes/bpf-restrict-map-value-pointer-arithmetic-for-unpriv.patch
patches.fixes/bpf-restrict-stack-pointer-arithmetic-for-unprivileg.patch
patches.fixes/bpf-restrict-unknown-scalars-of-mixed-signed-bounds-.patch
@@ -20550,6 +20576,7 @@
patches.drivers/ALSA-hda-realtek-Disable-headset-Mic-VREF-for-headse.patch
patches.drivers/ACPI-power-Skip-duplicate-power-resource-references-.patch
patches.arch/x86-modpost-replace-last-remnants-of-retpoline-with-config_retpoline.patch
+ patches.fixes/rbd-don-t-return-0-on-unmap-if-rbd_dev_flag_removing-is-set.patch
patches.drivers/i2c-dev-prevent-adapter-retries-and-timeout-being-se.patch
patches.drm/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch
patches.drm/0001-drm-fb-helper-Partially-bring-back-workaround-for-bu.patch
@@ -20587,6 +20614,7 @@
patches.fixes/blockdev-Fix-livelocks-on-loop-device.patch
patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets
patches.fixes/acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbios_id.patch
+ patches.fixes/openvswitch-Avoid-OOB-read-when-parsing-flow-nlattrs.patch
patches.drivers/amd-xgbe-Fix-mdio-access-for-non-zero-ports-and-clau.patch
patches.fixes/bpf-fix-inner-map-masking-to-prevent-oob-under-specu.patch
patches.fixes/pstore-ram-Avoid-allocation-and-leak-of-platform-dat.patch
@@ -20599,6 +20627,8 @@
patches.drivers/ASoC-dma-sh7760-cleanup-a-debug-printk.patch
patches.drivers/ASoC-rt5514-spi-Fix-potential-NULL-pointer-dereferen.patch
patches.drivers/ALSA-hda-Add-mute-LED-support-for-HP-ProBook-470-G5.patch
+ patches.fixes/ceph-clear-inode-pointer-when-snap-realm-gets-dropped-by-its-inode.patch
+ patches.fixes/libceph-avoid-keepalive_pending-races-in-ceph_con_keepalive.patch
patches.drm/drm-i915-gvt-release-shadow-batch-buffer-and-wa_ctx-.patch
patches.fixes/0001-usb-dwc3-gadget-Clear-req-needs_extra_trb-flag-on-cl.patch
patches.drivers/USB-serial-simple-add-Motorola-Tetra-TPG2200-device-.patch
@@ -20620,6 +20650,7 @@
patches.fixes/acpi-nfit-Fix-command-supported-detection.patch
patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch
patches.suse/sched-wait-Fix-rcuwait_wake_up-ordering.patch
+ patches.fixes/netrom-switch-to-sock-timer-API.patch
patches.drivers/gpio-pcf857x-Fix-interrupts-on-multiple-instances.patch
patches.drivers/gpio-altera-a10sr-Set-proper-output-level-for-direct.patch
patches.drivers/gpio-vf610-Mask-all-GPIO-interrupts.patch
@@ -20635,8 +20666,10 @@
patches.fixes/ARM-cns3xxx-Use-actual-size-reads-for-PCIe.patch
patches.drivers/mmc-bcm2835-Fix-DMA-channel-leak-on-probe-error.patch
patches.suse/kernel-exit.c-release-ptraced-tasks-before-zap_pid_n.patch
+ patches.suse/mm-oom-fix-use-after-free-in-oom_kill_process.patch
patches.suse/mm-hwpoison-use-do_send_sig_info-instead-of-force_sig.patch
patches.suse/mm-migrate-don-t-rely-on-__PageMovable-of-newpage-after-unlocking-it.patch
+ patches.fixes/blk-mq-fix-a-hung-issue-when-fsync.patch
patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch
patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch
patches.drivers/ALSA-hda-realtek-Fix-lose-hp_pins-for-disable-auto-m.patch
@@ -20657,9 +20690,15 @@
patches.drivers/usb-phy-am335x-fix-race-condition-in-_probe.patch
patches.drivers/serial-fix-race-between-flush_to_ldisc-and-tty_open.patch
patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
+ patches.fixes/mac80211-ensure-that-mgmt-tx-skbs-have-tailroom-for-.patch
patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
+ patches.fixes/bpf-fix-lockdep-false-positive-in-percpu_freelist.patch
+ patches.fixes/bpf-Fix-syscall-s-stackmap-lookup-potential-deadlock.patch
patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
+ patches.fixes/ARM-iop32x-n2100-fix-PCI-IRQ-mapping.patch
+ patches.fixes/ARM-tango-Improve-ARCH_MULTIPLATFORM-compatibility.patch
+ patches.fixes/nvme-lock-NS-list-changes-while-handling-command-eff.patch
patches.fixes/irqchip-gic-v3-its-Fix-ITT_entry_size-accessor.patch
patches.arch/x86-mce-initialize-mce-bank-in-the-case-of-a-fatal-error-in-mce_no_way_out.patch
patches.drivers/dmaengine-at_xdmac-Fix-wrongfull-report-of-a-channel.patch
@@ -20671,10 +20710,25 @@
patches.drivers/ALSA-hda-Add-quirk-for-HP-EliteBook-840-G5.patch
patches.drivers/ALSA-usb-audio-Fix-implicit-fb-endpoint-setup-by-qui.patch
patches.drivers/ASoC-rsnd-fixup-rsnd_ssi_master_clk_start-user-count.patch
+ patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
+ patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch
+ patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
+ patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
+ patches.drm/0003-drm-i915-Block-fbdev-HPD-processing-during-suspend.patch
+ patches.drm/0004-drm-i915-Prevent-a-race-during-I915_GEM_MMAP-ioctl-w.patch
+ patches.drm/0005-drm-i915-opregion-fix-version-check.patch
+ patches.drm/0006-drm-i915-opregion-rvda-is-relative-from-opregion-bas.patch
+ patches.drivers/floppy-check_events-callback-should-not-return-a-neg.patch
+ patches.drivers/i2c-cadence-Fix-the-hold-bit-setting.patch
+ patches.drivers/i2c-bcm2835-Clear-current-buffer-pointers-and-counts.patch
+ patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
# git://linuxtv.org/media_tree.git
patches.fixes/0001-media-usb-pwc-Don-t-use-coherent-DMA-buffers-for-ISO.patch
+ # powerpc/linux next
+ patches.arch/powerpc-pseries-Perform-full-re-add-of-CPU-for-topol.patch
+
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
patches.suse/0002-efi-Add-EFI-signature-data-types.patch
@@ -20683,6 +20737,9 @@
patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
+ # mkp/scsi 5.0/scsi-fixes
+ patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch
+
# out-of-tree patches
patches.fixes/ext4-close-race-between-direct-IO-and-ext4_break_layouts.patch
patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
@@ -20888,13 +20945,6 @@
patches.arch/selftests-powerpc-Fix-core-pkey-for-default-execute-.patch
patches.arch/selftests-powerpc-Fix-ptrace-pkey-for-default-execut.patch
- # FATE#325308
- patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
- patches.arch/hotplug-cpu-Add-operation-queuing-function.patch
- patches.arch/hotplug-cpu-Provide-CPU-readd-operation.patch
- patches.arch/mobility-numa-Ensure-numa-update-does-not-overlap.patch
- patches.arch/hotplug-pmt-Update-topology-after-PMT.patch
-
########################################################
# cephfs
########################################################
@@ -21094,6 +21144,7 @@
# Sound
##########################################################
patches.drivers/ALSA-hda-Use-standard-device-registration-for-beep.patch
+ patches.drivers/ALSA-hda-realtek-Reduce-click-noise-on-Dell-Precisio.patch
patches.drivers/ASoC-cx2072x-Add-DT-bingings-documentation-for-CX207
patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072
@@ -21293,6 +21344,8 @@
patches.drivers/0001-usb-Add-Xen-pvUSB-protocol-description.patch
patches.drivers/0002-usb-Introduce-Xen-pvUSB-frontend-xen-hcd.patch
patches.suse/xen-disable_hotplug_cpu.patch
+ patches.fixes/0001-x86-respect-memory-size-limiting-via-mem-parameter.patch
+ patches.fixes/0002-x86-xen-dont-add-memory-above-max-allowed-allocation.patch
########################################################
# kABI consistency patches
@@ -21307,7 +21360,9 @@
patches.suse/prepare-arm64-kgraft
patches.suse/powerpc-KABI-add-aux_ptr-to-hole-in-paca_struct-to-e.patch
-
+
+ patches.kabi/nvme-kABI-fix-for-scan_lock.patch
+
patches.kabi/KABI-move-mce_data_buf-into-paca_aux.patch
patches.kabi/KABI-move-the-new-handler-to-end-of-machdep_calls-an.patch
patches.kabi/KABI-powerpc-export-__find_linux_pte-as-__find_linux.patch