Home Home > GIT Browse > SLE15-SP1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Tesarik <ptesarik@suse.cz>2019-09-05 21:52:47 +0200
committerPetr Tesarik <ptesarik@suse.cz>2019-09-05 21:52:47 +0200
commitccdea012f12680a7e8eeea173fcf92bc536ee474 (patch)
tree3d8f47d8fae9fbf37a2d73695d925e33197afc83
parent333892614d7d3a108130dfa6d1b966cefe549bbe (diff)
parentb00b9b1a41ea034b4f1d4dd3db08100fc8616673 (diff)
Merge branch 'SLE15-SP1' into SLE12-SP5
Conflicts: patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch patches.suse/drm-mediatek-fix-unbind-functions.patch patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch patches.suse/drm-rockchip-Suspend-DP-late.patch patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch series.conf
-rw-r--r--config/arm64/default5
-rw-r--r--patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch2
-rw-r--r--patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch2
-rw-r--r--patches.suse/ath6kl-add-some-bounds-checking.patch2
-rw-r--r--patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch89
-rw-r--r--patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch141
-rw-r--r--patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch176
-rw-r--r--patches.suse/btrfs-remove-bug-in-add_data_reference.patch35
-rw-r--r--patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch32
-rw-r--r--patches.suse/btrfs-remove-bug-in-print_extent_item.patch36
-rw-r--r--patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch54
-rw-r--r--patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch29
-rw-r--r--patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch9
-rw-r--r--patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch5
-rw-r--r--patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch2
-rw-r--r--patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch2
-rw-r--r--patches.suse/crypto-virtio-read-crypto-services-and-algorithm-masks96
-rw-r--r--patches.suse/crypto-virtio-register-an-algo-only-if-it-s-supported339
-rw-r--r--patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch16
-rw-r--r--patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch20
-rw-r--r--patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch22
-rw-r--r--patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch19
-rw-r--r--patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch9
-rw-r--r--patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch9
-rw-r--r--patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch16
-rw-r--r--patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch9
-rw-r--r--patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch16
-rw-r--r--patches.suse/drm-mediatek-fix-unbind-functions.patch9
-rw-r--r--patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch9
-rw-r--r--patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch18
-rw-r--r--patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch9
-rw-r--r--patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch14
-rw-r--r--patches.suse/drm-rockchip-Suspend-DP-late.patch16
-rw-r--r--patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch48
-rw-r--r--patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch46
-rw-r--r--patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch26
-rw-r--r--patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch17
-rw-r--r--patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch49
-rw-r--r--patches.suse/ftrace-check-for-successful-allocation-of-hash.patch40
-rw-r--r--patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch77
-rw-r--r--patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch2
-rw-r--r--patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch9
-rw-r--r--patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs37
-rw-r--r--patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch68
-rw-r--r--patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch215
-rw-r--r--patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch66
-rw-r--r--patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch59
-rw-r--r--patches.suse/rsi-add-fix-for-crash-during-assertions.patch38
-rw-r--r--series.conf18
49 files changed, 1821 insertions, 261 deletions
diff --git a/config/arm64/default b/config/arm64/default
index a9eddaa351..2dc4677032 100644
--- a/config/arm64/default
+++ b/config/arm64/default
@@ -469,7 +469,8 @@ CONFIG_PCI_PRI=y
CONFIG_PCI_PASID=y
CONFIG_PCI_LABEL=y
CONFIG_HOTPLUG_PCI=y
-# CONFIG_HOTPLUG_PCI_ACPI is not set
+CONFIG_HOTPLUG_PCI_ACPI=y
+# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set
CONFIG_HOTPLUG_PCI_CPCI=y
CONFIG_HOTPLUG_PCI_SHPC=y
@@ -7169,7 +7170,7 @@ CONFIG_ACPI_CUSTOM_DSDT_FILE=""
CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y
CONFIG_ACPI_TABLE_UPGRADE=y
# CONFIG_ACPI_DEBUG is not set
-# CONFIG_ACPI_PCI_SLOT is not set
+CONFIG_ACPI_PCI_SLOT=y
CONFIG_ACPI_CONTAINER=y
CONFIG_ACPI_HED=y
# CONFIG_ACPI_CUSTOM_METHOD is not set
diff --git a/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch b/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
index d0e3a70c51..d9276dc6d6 100644
--- a/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
+++ b/patches.suse/ALSA-usb-audio-Avoid-access-before-bLength-check-in-.patch
@@ -4,7 +4,7 @@ Date: Wed, 19 Dec 2018 12:36:27 +0100
Subject: [PATCH 1/9] ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
Git-commit: f4351a199cc120ff9d59e06d02e8657d08e6cc46
Patch-mainline: v5.0-rc2
-References: bsc#1051510
+References: bsc#1051510, CVE-2019-15927, bsc#1149522
The parser for the processing unit reads bNrInPins field before the
bLength sanity check, which may lead to an out-of-bound access when a
diff --git a/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch b/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch
index 513a00a150..0199ab859d 100644
--- a/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch
+++ b/patches.suse/Bluetooth-hci_ldisc-Postpone-HCI_UART_PROTO_READY-bi.patch
@@ -4,7 +4,7 @@ Date: Sat, 23 Feb 2019 12:33:27 +0800
Subject: [PATCH] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
Git-commit: 56897b217a1d0a91c9920cb418d6b3fe922f590a
Patch-mainline: v5.1-rc1
-References: bsc#1051510
+References: bsc#1051510, CVE-2019-15917, bsc#1149539
task A: task B:
hci_uart_set_proto flush_to_ldisc
diff --git a/patches.suse/ath6kl-add-some-bounds-checking.patch b/patches.suse/ath6kl-add-some-bounds-checking.patch
index f8cfc55857..599d122c81 100644
--- a/patches.suse/ath6kl-add-some-bounds-checking.patch
+++ b/patches.suse/ath6kl-add-some-bounds-checking.patch
@@ -4,7 +4,7 @@ Date: Thu, 4 Apr 2019 11:56:51 +0300
Subject: [PATCH] ath6kl: add some bounds checking
Git-commit: 5d6751eaff672ea77642e74e92e6c0ac7f9709ab
Patch-mainline: v5.3-rc1
-References: bsc#1051510
+References: bsc#1051510, CVE-2019-15926, bsc#1149527
The "ev->traffic_class" and "reply->ac" variables come from the network
and they're used as an offset into the wmi->stream_exist_for_ac[] array.
diff --git a/patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch b/patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch
new file mode 100644
index 0000000000..c90a95e8e3
--- /dev/null
+++ b/patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch
@@ -0,0 +1,89 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:18 -0600
+Subject: Btrfs: add a helper to retrive extent inline ref type
+Git-commit: 167ce953ca55bdee20fe56c3c0fa51002435f745
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+An invalid value of extent inline ref type may be read from a
+malicious image which may force btrfs to crash.
+
+This adds a helper which does sanity check for the ref type, so we can
+know if it's sane, return he type, otherwise return an error.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ minimal tweak const types, causing warnings due to other cleanup patches ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/ctree.h | 11 +++++++++++
+ fs/btrfs/extent-tree.c | 37 +++++++++++++++++++++++++++++++++++++
+ 2 files changed, 48 insertions(+)
+
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2587,6 +2587,17 @@ static inline gfp_t btrfs_alloc_write_ma
+
+ /* extent-tree.c */
+
++enum btrfs_inline_ref_type {
++ BTRFS_REF_TYPE_INVALID = 0,
++ BTRFS_REF_TYPE_BLOCK = 1,
++ BTRFS_REF_TYPE_DATA = 2,
++ BTRFS_REF_TYPE_ANY = 3,
++};
++
++int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
++ struct btrfs_extent_inline_ref *iref,
++ enum btrfs_inline_ref_type is_data);
++
+ u64 btrfs_csum_bytes_to_leaves(struct btrfs_fs_info *fs_info, u64 csum_bytes);
+
+ static inline u64 btrfs_calc_trans_metadata_size(struct btrfs_fs_info *fs_info,
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1147,6 +1147,43 @@ static int convert_extent_item_v0(struct
+ }
+ #endif
+
++/*
++ * is_data == BTRFS_REF_TYPE_BLOCK, tree block type is required,
++ * is_data == BTRFS_REF_TYPE_DATA, data type is requried,
++ * is_data == BTRFS_REF_TYPE_ANY, either type is OK.
++ */
++int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
++ struct btrfs_extent_inline_ref *iref,
++ enum btrfs_inline_ref_type is_data)
++{
++ int type = btrfs_extent_inline_ref_type(eb, iref);
++
++ if (type == BTRFS_TREE_BLOCK_REF_KEY ||
++ type == BTRFS_SHARED_BLOCK_REF_KEY ||
++ type == BTRFS_SHARED_DATA_REF_KEY ||
++ type == BTRFS_EXTENT_DATA_REF_KEY) {
++ if (is_data == BTRFS_REF_TYPE_BLOCK) {
++ if (type == BTRFS_TREE_BLOCK_REF_KEY ||
++ type == BTRFS_SHARED_BLOCK_REF_KEY)
++ return type;
++ } else if (is_data == BTRFS_REF_TYPE_DATA) {
++ if (type == BTRFS_EXTENT_DATA_REF_KEY ||
++ type == BTRFS_SHARED_DATA_REF_KEY)
++ return type;
++ } else {
++ ASSERT(is_data == BTRFS_REF_TYPE_ANY);
++ return type;
++ }
++ }
++
++ btrfs_print_leaf(eb->fs_info, (struct extent_buffer *) eb);
++ btrfs_err(eb->fs_info, "eb %llu invalid extent inline ref type %d",
++ eb->start, type);
++ WARN_ON(1);
++
++ return BTRFS_REF_TYPE_INVALID;
++}
++
+ static u64 hash_extent_data_ref(u64 root_objectid, u64 owner, u64 offset)
+ {
+ u32 high_crc = ~(u32)0;
diff --git a/patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch b/patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch
new file mode 100644
index 0000000000..d9970fdd51
--- /dev/null
+++ b/patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch
@@ -0,0 +1,141 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:24 -0600
+Subject: Btrfs: add one more sanity check for shared ref type
+Git-commit: 64ecdb647ddb83dcff9c8e2a5c40119f171ea004
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Every shared ref has a parent tree block, which can be get from
+btrfs_extent_inline_ref_offset(). And the tree block must be aligned
+to the nodesize, so we'd know this inline ref is not valid if this
+block's bytenr is not aligned to the nodesize, in which case, most
+likely the ref type has been misused.
+
+This adds the above mentioned check and also updates
+print_extent_item() called by btrfs_print_leaf() to point out the
+invalid ref while printing the tree structure.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/extent-tree.c | 29 +++++++++++++++++++++++++----
+ fs/btrfs/print-tree.c | 27 +++++++++++++++++++++------
+ 2 files changed, 46 insertions(+), 10 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 51a691532fd8..96e49fd5b888 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1158,19 +1158,40 @@ int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb,
+ enum btrfs_inline_ref_type is_data)
+ {
+ int type = btrfs_extent_inline_ref_type(eb, iref);
++ u64 offset = btrfs_extent_inline_ref_offset(eb, iref);
+
+ if (type == BTRFS_TREE_BLOCK_REF_KEY ||
+ type == BTRFS_SHARED_BLOCK_REF_KEY ||
+ type == BTRFS_SHARED_DATA_REF_KEY ||
+ type == BTRFS_EXTENT_DATA_REF_KEY) {
+ if (is_data == BTRFS_REF_TYPE_BLOCK) {
+- if (type == BTRFS_TREE_BLOCK_REF_KEY ||
+- type == BTRFS_SHARED_BLOCK_REF_KEY)
++ if (type == BTRFS_TREE_BLOCK_REF_KEY)
+ return type;
++ if (type == BTRFS_SHARED_BLOCK_REF_KEY) {
++ ASSERT(eb->fs_info);
++ /*
++ * Every shared one has parent tree
++ * block, which must be aligned to
++ * nodesize.
++ */
++ if (offset &&
++ IS_ALIGNED(offset, eb->fs_info->nodesize))
++ return type;
++ }
+ } else if (is_data == BTRFS_REF_TYPE_DATA) {
+- if (type == BTRFS_EXTENT_DATA_REF_KEY ||
+- type == BTRFS_SHARED_DATA_REF_KEY)
++ if (type == BTRFS_EXTENT_DATA_REF_KEY)
+ return type;
++ if (type == BTRFS_SHARED_DATA_REF_KEY) {
++ ASSERT(eb->fs_info);
++ /*
++ * Every shared one has parent tree
++ * block, which must be aligned to
++ * nodesize.
++ */
++ if (offset &&
++ IS_ALIGNED(offset, eb->fs_info->nodesize))
++ return type;
++ }
+ } else {
+ ASSERT(is_data == BTRFS_REF_TYPE_ANY);
+ return type;
+diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
+index c1acbdcb476c..569205e651c7 100644
+--- a/fs/btrfs/print-tree.c
++++ b/fs/btrfs/print-tree.c
+@@ -44,7 +44,7 @@ static void print_dev_item(struct extent_buffer *eb,
+ static void print_extent_data_ref(struct extent_buffer *eb,
+ struct btrfs_extent_data_ref *ref)
+ {
+- pr_info("\t\textent data backref root %llu objectid %llu offset %llu count %u\n",
++ pr_cont("extent data backref root %llu objectid %llu offset %llu count %u\n",
+ btrfs_extent_data_ref_root(eb, ref),
+ btrfs_extent_data_ref_objectid(eb, ref),
+ btrfs_extent_data_ref_offset(eb, ref),
+@@ -63,6 +63,7 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ u32 item_size = btrfs_item_size_nr(eb, slot);
+ u64 flags;
+ u64 offset;
++ int ref_index = 0;
+
+ if (item_size < sizeof(*ei)) {
+ #ifdef BTRFS_COMPAT_EXTENT_TREE_V0
+@@ -104,12 +105,20 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+ type = btrfs_extent_inline_ref_type(eb, iref);
+ offset = btrfs_extent_inline_ref_offset(eb, iref);
++ pr_info("\t\tref#%d: ", ref_index++);
+ switch (type) {
+ case BTRFS_TREE_BLOCK_REF_KEY:
+- pr_info("\t\ttree block backref root %llu\n", offset);
++ pr_cont("tree block backref root %llu\n", offset);
+ break;
+ case BTRFS_SHARED_BLOCK_REF_KEY:
+- pr_info("\t\tshared block backref parent %llu\n", offset);
++ pr_cont("shared block backref parent %llu\n", offset);
++ /*
++ * offset is supposed to be a tree block which
++ * must be aligned to nodesize.
++ */
++ if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
++ pr_info("\t\t\t(parent %llu is NOT ALIGNED to nodesize %llu)\n",
++ offset, (unsigned long long)eb->fs_info->nodesize);
+ break;
+ case BTRFS_EXTENT_DATA_REF_KEY:
+ dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+@@ -117,12 +126,18 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ break;
+ case BTRFS_SHARED_DATA_REF_KEY:
+ sref = (struct btrfs_shared_data_ref *)(iref + 1);
+- pr_info("\t\tshared data backref parent %llu count %u\n",
++ pr_cont("shared data backref parent %llu count %u\n",
+ offset, btrfs_shared_data_ref_count(eb, sref));
++ /*
++ * offset is supposed to be a tree block which
++ * must be aligned to nodesize.
++ */
++ if (!IS_ALIGNED(offset, eb->fs_info->nodesize))
++ pr_info("\t\t\t(parent %llu is NOT ALIGNED to nodesize %llu)\n",
++ offset, (unsigned long long)eb->fs_info->nodesize);
+ break;
+ default:
+- btrfs_err(eb->fs_info,
+- "extent %llu has invalid ref type %d",
++ pr_cont("(extent %llu has INVALID ref type %d)\n",
+ eb->start, type);
+ return;
+ }
+
diff --git a/patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch b/patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch
new file mode 100644
index 0000000000..48bb420eed
--- /dev/null
+++ b/patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch
@@ -0,0 +1,176 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:19 -0600
+Subject: Btrfs: convert to use btrfs_get_extent_inline_ref_type
+Git-commit: 3de28d579edbd35294bf44aee8402c804331bc37
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Since we have a helper which can do sanity check, this converts all
+btrfs_extent_inline_ref_type to it.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/backref.c | 11 +++++++++--
+ fs/btrfs/extent-tree.c | 36 ++++++++++++++++++++++++++++++------
+ fs/btrfs/relocation.c | 13 +++++++++++--
+ 3 files changed, 50 insertions(+), 10 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 6bae986bfcfb..b517ef1477ea 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -929,7 +929,11 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info,
+ int type;
+
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- type = btrfs_extent_inline_ref_type(leaf, iref);
++ type = btrfs_get_extent_inline_ref_type(leaf, iref,
++ BTRFS_REF_TYPE_ANY);
++ if (type == BTRFS_REF_TYPE_INVALID)
++ return -EINVAL;
++
+ offset = btrfs_extent_inline_ref_offset(leaf, iref);
+
+ switch (type) {
+@@ -1776,7 +1780,10 @@ static int get_extent_inline_ref(unsigned long *ptr,
+
+ end = (unsigned long)ei + item_size;
+ *out_eiref = (struct btrfs_extent_inline_ref *)(*ptr);
+- *out_type = btrfs_extent_inline_ref_type(eb, *out_eiref);
++ *out_type = btrfs_get_extent_inline_ref_type(eb, *out_eiref,
++ BTRFS_REF_TYPE_ANY);
++ if (*out_type == BTRFS_REF_TYPE_INVALID)
++ return -EINVAL;
+
+ *ptr += btrfs_extent_inline_ref_size(*out_type);
+ WARN_ON(*ptr > end);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 794b06dd824a..51a691532fd8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -1454,12 +1454,18 @@ static noinline u32 extent_data_ref_count(struct btrfs_path *path,
+ struct btrfs_extent_data_ref *ref1;
+ struct btrfs_shared_data_ref *ref2;
+ u32 num_refs = 0;
++ int type;
+
+ leaf = path->nodes[0];
+ btrfs_item_key_to_cpu(leaf, &key, path->slots[0]);
+ if (iref) {
+- if (btrfs_extent_inline_ref_type(leaf, iref) ==
+- BTRFS_EXTENT_DATA_REF_KEY) {
++ /*
++ * If type is invalid, we should have bailed out earlier than
++ * this call.
++ */
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
++ ASSERT(type != BTRFS_REF_TYPE_INVALID);
++ if (type == BTRFS_EXTENT_DATA_REF_KEY) {
+ ref1 = (struct btrfs_extent_data_ref *)(&iref->offset);
+ num_refs = btrfs_extent_data_ref_count(leaf, ref1);
+ } else {
+@@ -1620,6 +1626,7 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
+ int ret;
+ int err = 0;
+ bool skinny_metadata = btrfs_fs_incompat(fs_info, SKINNY_METADATA);
++ int needed;
+
+ key.objectid = bytenr;
+ key.type = BTRFS_EXTENT_ITEM_KEY;
+@@ -1711,6 +1718,11 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
+ BUG_ON(ptr > end);
+ }
+
++ if (owner >= BTRFS_FIRST_FREE_OBJECTID)
++ needed = BTRFS_REF_TYPE_DATA;
++ else
++ needed = BTRFS_REF_TYPE_BLOCK;
++
+ err = -ENOENT;
+ while (1) {
+ if (ptr >= end) {
+@@ -1718,7 +1730,12 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans,
+ break;
+ }
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- type = btrfs_extent_inline_ref_type(leaf, iref);
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, needed);
++ if (type == BTRFS_REF_TYPE_INVALID) {
++ err = -EINVAL;
++ goto out;
++ }
++
+ if (want < type)
+ break;
+ if (want > type) {
+@@ -1910,7 +1927,12 @@ void update_inline_extent_backref(struct btrfs_fs_info *fs_info,
+ if (extent_op)
+ __run_delayed_extent_op(extent_op, leaf, ei);
+
+- type = btrfs_extent_inline_ref_type(leaf, iref);
++ /*
++ * If type is invalid, we should have bailed out after
++ * lookup_inline_extent_backref().
++ */
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_ANY);
++ ASSERT(type != BTRFS_REF_TYPE_INVALID);
+
+ if (type == BTRFS_EXTENT_DATA_REF_KEY) {
+ dref = (struct btrfs_extent_data_ref *)(&iref->offset);
+@@ -3195,6 +3217,7 @@ static noinline int check_committed_ref(struct btrfs_root *root,
+ struct btrfs_extent_item *ei;
+ struct btrfs_key key;
+ u32 item_size;
++ int type;
+ int ret;
+
+ key.objectid = bytenr;
+@@ -3236,8 +3259,9 @@ static noinline int check_committed_ref(struct btrfs_root *root,
+ goto out;
+
+ iref = (struct btrfs_extent_inline_ref *)(ei + 1);
+- if (btrfs_extent_inline_ref_type(leaf, iref) !=
+- BTRFS_EXTENT_DATA_REF_KEY)
++
++ type = btrfs_get_extent_inline_ref_type(leaf, iref, BTRFS_REF_TYPE_DATA);
++ if (type != BTRFS_EXTENT_DATA_REF_KEY)
+ goto out;
+
+ ref = (struct btrfs_extent_data_ref *)(&iref->offset);
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 1a532bb72eab..96f816aa9ed3 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -799,9 +799,17 @@ struct backref_node *build_backref_tree(struct reloc_control *rc,
+ if (ptr < end) {
+ /* update key for inline back ref */
+ struct btrfs_extent_inline_ref *iref;
++ int type;
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- key.type = btrfs_extent_inline_ref_type(eb, iref);
++ type = btrfs_get_extent_inline_ref_type(eb, iref,
++ BTRFS_REF_TYPE_BLOCK);
++ if (type == BTRFS_REF_TYPE_INVALID) {
++ err = -EINVAL;
++ goto out;
++ }
++ key.type = type;
+ key.offset = btrfs_extent_inline_ref_offset(eb, iref);
++
+ WARN_ON(key.type != BTRFS_TREE_BLOCK_REF_KEY &&
+ key.type != BTRFS_SHARED_BLOCK_REF_KEY);
+ }
+@@ -3753,7 +3761,8 @@ int add_data_references(struct reloc_control *rc,
+
+ while (ptr < end) {
+ iref = (struct btrfs_extent_inline_ref *)ptr;
+- key.type = btrfs_extent_inline_ref_type(eb, iref);
++ key.type = btrfs_get_extent_inline_ref_type(eb, iref,
++ BTRFS_REF_TYPE_DATA);
+ if (key.type == BTRFS_SHARED_DATA_REF_KEY) {
+ key.offset = btrfs_extent_inline_ref_offset(eb, iref);
+ ret = __add_tree_block(rc, key.offset, blocksize,
+
diff --git a/patches.suse/btrfs-remove-bug-in-add_data_reference.patch b/patches.suse/btrfs-remove-bug-in-add_data_reference.patch
new file mode 100644
index 0000000000..21948a230e
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug-in-add_data_reference.patch
@@ -0,0 +1,35 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:22 -0600
+Subject: Btrfs: remove BUG() in add_data_reference
+Git-commit: b14c55a191263889c379aeee85223bb72501824d
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Now that we have a helper to report invalid value of extent inline ref
+type, we need to quit gracefully instead of throwing out a kernel panic.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/relocation.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 96f816aa9ed3..1c086d0667be 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -3772,7 +3772,10 @@ int add_data_references(struct reloc_control *rc,
+ ret = find_data_references(rc, extent_key,
+ eb, dref, blocks);
+ } else {
+- BUG();
++ ret = -EINVAL;
++ btrfs_err(rc->extent_root->fs_info,
++ "extent %llu slot %d has an invalid inline ref type",
++ eb->start, path->slots[0]);
+ }
+ if (ret) {
+ err = ret;
+
diff --git a/patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch b/patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch
new file mode 100644
index 0000000000..5e664614b4
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch
@@ -0,0 +1,32 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:20 -0600
+Subject: Btrfs: remove BUG() in btrfs_extent_inline_ref_size
+Git-commit: 4335958de2a43c6790c7f6aa0682aa7189983fa4
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+Now that btrfs_get_extent_inline_ref_type() can report if type is a
+valid one and all callers can gracefully deal with that, we don't need
+to crash here.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/ctree.h | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 542db9d0dbcd..b7cfc74c1757 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1804,7 +1804,6 @@ static inline u32 btrfs_extent_inline_ref_size(int type)
+ if (type == BTRFS_EXTENT_DATA_REF_KEY)
+ return sizeof(struct btrfs_extent_data_ref) +
+ offsetof(struct btrfs_extent_inline_ref, offset);
+- BUG();
+ return 0;
+ }
+
+
diff --git a/patches.suse/btrfs-remove-bug-in-print_extent_item.patch b/patches.suse/btrfs-remove-bug-in-print_extent_item.patch
new file mode 100644
index 0000000000..25e39229ee
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug-in-print_extent_item.patch
@@ -0,0 +1,36 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:21 -0600
+Subject: Btrfs: remove BUG() in print_extent_item
+Git-commit: 07638ea5987e51715b35eb5a9a9e908f18ffabf7
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+btrfs_print_leaf() is used in btrfs_get_extent_inline_ref_type, so
+here we really want to print the invalid value of ref type instead of
+causing a kernel panic.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/print-tree.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/print-tree.c b/fs/btrfs/print-tree.c
+index 6e7a8c40dcd9..c1acbdcb476c 100644
+--- a/fs/btrfs/print-tree.c
++++ b/fs/btrfs/print-tree.c
+@@ -121,7 +121,10 @@ static void print_extent_item(struct extent_buffer *eb, int slot, int type)
+ offset, btrfs_shared_data_ref_count(eb, sref));
+ break;
+ default:
+- BUG();
++ btrfs_err(eb->fs_info,
++ "extent %llu has invalid ref type %d",
++ eb->start, type);
++ return;
+ }
+ ptr += btrfs_extent_inline_ref_size(type);
+ }
+
diff --git a/patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch b/patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch
new file mode 100644
index 0000000000..0e045736ec
--- /dev/null
+++ b/patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch
@@ -0,0 +1,54 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Fri, 18 Aug 2017 15:15:23 -0600
+Subject: Btrfs: remove BUG_ON in __add_tree_block
+Git-commit: cdccee993f2f3466f69a358daec19de744a02f92
+Patch-mainline: v4.14-rc1
+References: bsc#1149325
+
+The BUG_ON() can be triggered when the caller is processing an invalid
+extent inline ref, e.g.
+
+a shared data ref is offered instead of an extent data ref, such that
+it tries to find a non-existent tree block and then btrfs_search_slot
+returns 1 for no such item.
+
+This replaces the BUG_ON() with a WARN() followed by calling
+btrfs_print_leaf() to show more details about what's going on and
+returning -EINVAL to upper callers.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ fs/btrfs/relocation.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -32,6 +32,7 @@
+ #include "free-space-cache.h"
+ #include "inode-map.h"
+ #include "qgroup.h"
++#include "print-tree.h"
+
+ /*
+ * backref_node, mapping_node and tree_block start with this
+@@ -3485,7 +3486,16 @@ again:
+ goto again;
+ }
+ }
+- BUG_ON(ret);
++ if (ret) {
++ ASSERT(ret == 1);
++ btrfs_print_leaf(fs_info, path->nodes[0]);
++ btrfs_err(fs_info,
++ "tree block extent item (%llu) is not found in extent tree",
++ bytenr);
++ WARN_ON(1);
++ ret = -EINVAL;
++ goto out;
++ }
+
+ ret = add_tree_block(rc, &key, path, blocks);
+ out:
diff --git a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch
index 9bed7dc193..6398b525b4 100644
--- a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch
+++ b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-_ceph_build_xattrs_blob.patch
@@ -47,17 +47,15 @@ Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
- fs/ceph/caps.c | 5 ++++-
- fs/ceph/snap.c | 4 +++-
- fs/ceph/super.h | 2 +-
- fs/ceph/xattr.c | 11 ++++++++---
+ fs/ceph/caps.c | 5 ++++-
+ fs/ceph/snap.c | 4 +++-
+ fs/ceph/super.h | 2 +-
+ fs/ceph/xattr.c | 11 ++++++++---
4 files changed, 16 insertions(+), 6 deletions(-)
-diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
-index d98dcd976c80..ce0f5658720a 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
-@@ -1275,6 +1275,7 @@ static int __send_cap(struct ceph_mds_cl
+@@ -1290,6 +1290,7 @@ static int __send_cap(struct ceph_mds_cl
{
struct ceph_inode_info *ci = cap->ci;
struct inode *inode = &ci->vfs_inode;
@@ -65,7 +63,7 @@ index d98dcd976c80..ce0f5658720a 100644
struct cap_msg_args arg;
int held, revoking;
int wake = 0;
-@@ -1339,7 +1340,7 @@ static int __send_cap(struct ceph_mds_cl
+@@ -1354,7 +1355,7 @@ static int __send_cap(struct ceph_mds_cl
ci->i_requested_max_size = arg.max_size;
if (flushing & CEPH_CAP_XATTR_EXCL) {
@@ -74,7 +72,7 @@ index d98dcd976c80..ce0f5658720a 100644
arg.xattr_version = ci->i_xattrs.version;
arg.xattr_buf = ci->i_xattrs.blob;
} else {
-@@ -1376,6 +1377,8 @@ static int __send_cap(struct ceph_mds_cl
+@@ -1389,6 +1390,8 @@ static int __send_cap(struct ceph_mds_cl
spin_unlock(&ci->i_ceph_lock);
@@ -83,8 +81,6 @@ index d98dcd976c80..ce0f5658720a 100644
ret = send_cap_msg(&arg);
if (ret < 0) {
dout("error sending cap msg, must requeue %p\n", inode);
-diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
-index 4c6494eb02b5..ccfcc66aaf44 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -459,6 +459,7 @@ void ceph_queue_cap_snap(struct ceph_ino
@@ -112,11 +108,9 @@ index 4c6494eb02b5..ccfcc66aaf44 100644
kfree(capsnap);
ceph_put_snap_context(old_snapc);
}
-diff --git a/fs/ceph/super.h b/fs/ceph/super.h
-index d2352fd95dbc..6b9f1ee7de85 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
-@@ -899,7 +899,7 @@ extern int ceph_getattr(const struct pat
+@@ -895,7 +895,7 @@ extern int ceph_getattr(const struct pat
int __ceph_setxattr(struct inode *, const char *, const void *, size_t, int);
ssize_t __ceph_getxattr(struct inode *, const char *, void *, size_t);
extern ssize_t ceph_listxattr(struct dentry *, char *, size_t);
@@ -125,11 +119,9 @@ index d2352fd95dbc..6b9f1ee7de85 100644
extern void __ceph_destroy_xattrs(struct ceph_inode_info *ci);
extern const struct xattr_handler *ceph_xattr_handlers[];
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index c083557b3657..939eab7aa219 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
-@@ -738,12 +738,15 @@ static int __get_required_blob_size(stru
+@@ -754,12 +754,15 @@ static int __get_required_blob_size(stru
/*
* If there are dirty xattrs, reencode xattrs into the prealloc_blob
@@ -147,7 +139,7 @@ index c083557b3657..939eab7aa219 100644
void *dest;
dout("__build_xattrs_blob %p\n", &ci->vfs_inode);
-@@ -774,12 +777,14 @@ void __ceph_build_xattrs_blob(struct cep
+@@ -790,12 +793,14 @@ void __ceph_build_xattrs_blob(struct cep
dest - ci->i_xattrs.prealloc_blob->vec.iov_base;
if (ci->i_xattrs.blob)
@@ -163,4 +155,3 @@ index c083557b3657..939eab7aa219 100644
}
static inline int __get_request_mask(struct inode *in) {
-
diff --git a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch
index 9798ed0d0e..6c69fc429a 100644
--- a/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch
+++ b/patches.suse/ceph-fix-buffer-free-while-holding-i_ceph_lock-in-fill_inode.patch
@@ -46,11 +46,9 @@ Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
---
- fs/ceph/inode.c | 7 ++++---
+ fs/ceph/inode.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
-index 791f84a13bb8..18500edefc56 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -744,6 +744,7 @@ static int fill_inode(struct inode *inod
@@ -61,7 +59,7 @@ index 791f84a13bb8..18500edefc56 100644
struct ceph_string *pool_ns = NULL;
struct ceph_cap *new_cap = NULL;
int err = 0;
-@@ -881,7 +882,7 @@ static int fill_inode(struct inode *inod
+@@ -874,7 +875,7 @@ static int fill_inode(struct inode *inod
if ((ci->i_xattrs.version == 0 || !(issued & CEPH_CAP_XATTR_EXCL)) &&
le64_to_cpu(info->xattr_version) > ci->i_xattrs.version) {
if (ci->i_xattrs.blob)
@@ -70,7 +68,7 @@ index 791f84a13bb8..18500edefc56 100644
ci->i_xattrs.blob = xattr_blob;
if (xattr_blob)
memcpy(ci->i_xattrs.blob->vec.iov_base,
-@@ -1020,8 +1021,8 @@ static int fill_inode(struct inode *inod
+@@ -1019,8 +1020,8 @@ static int fill_inode(struct inode *inod
out:
if (new_cap)
ceph_put_cap(mdsc, new_cap);
@@ -81,4 +79,3 @@ index 791f84a13bb8..18500edefc56 100644
ceph_put_string(pool_ns);
return err;
}
-
diff --git a/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch b/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch
index cd66f850e6..b54da58a5e 100644
--- a/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch
+++ b/patches.suse/ceph-fix-ceph-dir-rctime-vxattr-value.patch
@@ -15,11 +15,9 @@ Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Acked-by: Luis Henriques <lhenriques@suse.com>
---
- fs/ceph/xattr.c | 2 +-
+ fs/ceph/xattr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
-index 57350e4b7da0..d2fb9f10720c 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -223,7 +223,7 @@ static size_t ceph_vxattrcb_dir_rbytes(s
@@ -31,4 +29,3 @@ index 57350e4b7da0..d2fb9f10720c 100644
(long)ci->i_rctime.tv_nsec);
}
-
diff --git a/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch b/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch
index 17c5d49528..24b3b641df 100644
--- a/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch
+++ b/patches.suse/cifs-Fix-use-after-free-in-SMB2_read.patch
@@ -3,7 +3,7 @@ Date: Sat, 6 Apr 2019 15:47:39 +0800
Subject: [PATCH] cifs: Fix use-after-free in SMB2_read
Git-commit: 088aaf17aa79300cab14dbee2569c58cfafd7d6e
Patch-mainline: v5.1-rc6
-References: bsc#1144333
+References: bsc#1144333, CVE-2019-15920, bsc#1149626
There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_read+0x1136/0x1190
diff --git a/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch b/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch
index f484ff2a94..48c747ebc5 100644
--- a/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch
+++ b/patches.suse/cifs-Fix-use-after-free-in-SMB2_write.patch
@@ -3,7 +3,7 @@ Date: Sat, 6 Apr 2019 15:47:38 +0800
Subject: [PATCH] cifs: Fix use-after-free in SMB2_write
Git-commit: 6a3eb3360667170988f8a6477f6686242061488a
Patch-mainline: v5.1-rc6
-References: bsc#1144333
+References: bsc#1144333, CVE-2019-15919, bsc#1149552
There is a KASAN use-after-free:
BUG: KASAN: use-after-free in SMB2_write+0x1342/0x1580
diff --git a/patches.suse/crypto-virtio-read-crypto-services-and-algorithm-masks b/patches.suse/crypto-virtio-read-crypto-services-and-algorithm-masks
new file mode 100644
index 0000000000..fb39b0e4c1
--- /dev/null
+++ b/patches.suse/crypto-virtio-read-crypto-services-and-algorithm-masks
@@ -0,0 +1,96 @@
+From: Farhan Ali <alifm@linux.ibm.com>
+Date: Tue, 19 Jun 2018 11:41:33 -0400
+Subject: crypto: virtio - Read crypto services and algorithm masks
+Git-commit: b551bac14acab9c601269e2007a6b6cad2250a4c
+Patch-mainline: v4.19-rc1
+References: jsc#SLE-5844 jsc#SLE-6331 FATE#327377 bsc#1145446 LTC#175307
+
+Read the crypto services and algorithm masks which provides
+information about the services and algorithms supported by
+virtio-crypto backend.
+
+Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
+Acked-by: Gonglei <arei.gonglei@huawei.com>
+Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/crypto/virtio/virtio_crypto_common.h | 14 +++++++++++++
+ drivers/crypto/virtio/virtio_crypto_core.c | 29 +++++++++++++++++++++++++++
+ 2 files changed, 43 insertions(+)
+
+--- a/drivers/crypto/virtio/virtio_crypto_common.h
++++ b/drivers/crypto/virtio/virtio_crypto_common.h
+@@ -55,6 +55,20 @@ struct virtio_crypto {
+ /* Number of queue currently used by the driver */
+ u32 curr_queue;
+
++ /*
++ * Specifies the services mask which the device support,
++ * see VIRTIO_CRYPTO_SERVICE_*
++ */
++ u32 crypto_services;
++
++ /* Detailed algorithms mask */
++ u32 cipher_algo_l;
++ u32 cipher_algo_h;
++ u32 hash_algo;
++ u32 mac_algo_l;
++ u32 mac_algo_h;
++ u32 aead_algo;
++
+ /* Maximum length of cipher key */
+ u32 max_cipher_key_len;
+ /* Maximum length of authenticated key */
+--- a/drivers/crypto/virtio/virtio_crypto_core.c
++++ b/drivers/crypto/virtio/virtio_crypto_core.c
+@@ -329,6 +329,13 @@ static int virtcrypto_probe(struct virti
+ u32 max_data_queues = 0, max_cipher_key_len = 0;
+ u32 max_auth_key_len = 0;
+ u64 max_size = 0;
++ u32 cipher_algo_l = 0;
++ u32 cipher_algo_h = 0;
++ u32 hash_algo = 0;
++ u32 mac_algo_l = 0;
++ u32 mac_algo_h = 0;
++ u32 aead_algo = 0;
++ u32 crypto_services = 0;
+
+ if (!virtio_has_feature(vdev, VIRTIO_F_VERSION_1))
+ return -ENODEV;
+@@ -365,6 +372,20 @@ static int virtcrypto_probe(struct virti
+ max_auth_key_len, &max_auth_key_len);
+ virtio_cread(vdev, struct virtio_crypto_config,
+ max_size, &max_size);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ crypto_services, &crypto_services);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ cipher_algo_l, &cipher_algo_l);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ cipher_algo_h, &cipher_algo_h);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ hash_algo, &hash_algo);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ mac_algo_l, &mac_algo_l);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ mac_algo_h, &mac_algo_h);
++ virtio_cread(vdev, struct virtio_crypto_config,
++ aead_algo, &aead_algo);
+
+ /* Add virtio crypto device to global table */
+ err = virtcrypto_devmgr_add_dev(vcrypto);
+@@ -384,6 +405,14 @@ static int virtcrypto_probe(struct virti
+ vcrypto->max_cipher_key_len = max_cipher_key_len;
+ vcrypto->max_auth_key_len = max_auth_key_len;
+ vcrypto->max_size = max_size;
++ vcrypto->crypto_services = crypto_services;
++ vcrypto->cipher_algo_l = cipher_algo_l;
++ vcrypto->cipher_algo_h = cipher_algo_h;
++ vcrypto->mac_algo_l = mac_algo_l;
++ vcrypto->mac_algo_h = mac_algo_h;
++ vcrypto->hash_algo = hash_algo;
++ vcrypto->aead_algo = aead_algo;
++
+
+ dev_info(&vdev->dev,
+ "max_queues: %u, max_cipher_key_len: %u, max_auth_key_len: %u, max_size 0x%llx\n",
diff --git a/patches.suse/crypto-virtio-register-an-algo-only-if-it-s-supported b/patches.suse/crypto-virtio-register-an-algo-only-if-it-s-supported
new file mode 100644
index 0000000000..4879510a28
--- /dev/null
+++ b/patches.suse/crypto-virtio-register-an-algo-only-if-it-s-supported
@@ -0,0 +1,339 @@
+From: Farhan Ali <alifm@linux.vnet.ibm.com>
+Date: Tue, 19 Jun 2018 11:41:34 -0400
+Subject: crypto: virtio - Register an algo only if it's supported
+Git-commit: d0d859bb87ac3b4df1cb6692531fc95d093357c5
+Patch-mainline: v4.19-rc1
+References: jsc#SLE-5844 jsc#SLE-6331 FATE#327377 bsc#1145446 LTC#175307
+
+Register a crypto algo with the Linux crypto layer only if
+the algorithm is supported by the backend virtio-crypto
+device.
+
+Also route crypto requests to a virtio-crypto
+device, only if it can support the requested service and
+algorithm.
+
+Signed-off-by: Farhan Ali <alifm@linux.ibm.com>
+Acked-by: Gonglei <arei.gonglei@huawei.com>
+Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/crypto/virtio/virtio_crypto_algs.c | 112 ++++++++++++++++++---------
+ drivers/crypto/virtio/virtio_crypto_common.h | 11 +-
+ drivers/crypto/virtio/virtio_crypto_mgr.c | 81 ++++++++++++++++++-
+ 3 files changed, 159 insertions(+), 45 deletions(-)
+
+--- a/drivers/crypto/virtio/virtio_crypto_algs.c
++++ b/drivers/crypto/virtio/virtio_crypto_algs.c
+@@ -27,12 +27,18 @@
+ #include <uapi/linux/virtio_crypto.h>
+ #include "virtio_crypto_common.h"
+
++struct virtio_crypto_algo {
++ uint32_t algonum;
++ uint32_t service;
++ unsigned int active_devs;
++ struct crypto_alg algo;
++};
++
+ /*
+ * The algs_lock protects the below global virtio_crypto_active_devs
+ * and crypto algorithms registion.
+ */
+ static DEFINE_MUTEX(algs_lock);
+-static unsigned int virtio_crypto_active_devs;
+
+ static u64 virtio_crypto_alg_sg_nents_length(struct scatterlist *sg)
+ {
+@@ -255,15 +261,21 @@ static int virtio_crypto_ablkcipher_setk
+ unsigned int keylen)
+ {
+ struct virtio_crypto_ablkcipher_ctx *ctx = crypto_ablkcipher_ctx(tfm);
++ uint32_t alg;
+ int ret;
+
++ ret = virtio_crypto_alg_validate_key(keylen, &alg);
++ if (ret)
++ return ret;
++
+ if (!ctx->vcrypto) {
+ /* New key */
+ int node = virtio_crypto_get_current_node();
+ struct virtio_crypto *vcrypto =
+- virtcrypto_get_dev_node(node);
++ virtcrypto_get_dev_node(node,
++ VIRTIO_CRYPTO_SERVICE_CIPHER, alg);
+ if (!vcrypto) {
+- pr_err("virtio_crypto: Could not find a virtio device in the system");
++ pr_err("virtio_crypto: Could not find a virtio device in the system or unsupported algo\n");
+ return -ENODEV;
+ }
+
+@@ -502,57 +514,85 @@ void virtio_crypto_ablkcipher_finalize_r
+ virtcrypto_clear_request(vc_req);
+ }
+
+-static struct crypto_alg virtio_crypto_algs[] = { {
+- .cra_name = "cbc(aes)",
+- .cra_driver_name = "virtio_crypto_aes_cbc",
+- .cra_priority = 150,
+- .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_ASYNC,
+- .cra_blocksize = AES_BLOCK_SIZE,
+- .cra_ctxsize = sizeof(struct virtio_crypto_ablkcipher_ctx),
+- .cra_alignmask = 0,
+- .cra_module = THIS_MODULE,
+- .cra_type = &crypto_ablkcipher_type,
+- .cra_init = virtio_crypto_ablkcipher_init,
+- .cra_exit = virtio_crypto_ablkcipher_exit,
+- .cra_u = {
+- .ablkcipher = {
+- .setkey = virtio_crypto_ablkcipher_setkey,
+- .decrypt = virtio_crypto_ablkcipher_decrypt,
+- .encrypt = virtio_crypto_ablkcipher_encrypt,
+- .min_keysize = AES_MIN_KEY_SIZE,
+- .max_keysize = AES_MAX_KEY_SIZE,
+- .ivsize = AES_BLOCK_SIZE,
++static struct virtio_crypto_algo virtio_crypto_algs[] = { {
++ .algonum = VIRTIO_CRYPTO_CIPHER_AES_CBC,
++ .service = VIRTIO_CRYPTO_SERVICE_CIPHER,
++ .algo = {
++ .cra_name = "cbc(aes)",
++ .cra_driver_name = "virtio_crypto_aes_cbc",
++ .cra_priority = 150,
++ .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER | CRYPTO_ALG_ASYNC,
++ .cra_blocksize = AES_BLOCK_SIZE,
++ .cra_ctxsize = sizeof(struct virtio_crypto_ablkcipher_ctx),
++ .cra_alignmask = 0,
++ .cra_module = THIS_MODULE,
++ .cra_type = &crypto_ablkcipher_type,
++ .cra_init = virtio_crypto_ablkcipher_init,
++ .cra_exit = virtio_crypto_ablkcipher_exit,
++ .cra_u = {
++ .ablkcipher = {
++ .setkey = virtio_crypto_ablkcipher_setkey,
++ .decrypt = virtio_crypto_ablkcipher_decrypt,
++ .encrypt = virtio_crypto_ablkcipher_encrypt,
++ .min_keysize = AES_MIN_KEY_SIZE,
++ .max_keysize = AES_MAX_KEY_SIZE,
++ .ivsize = AES_BLOCK_SIZE,
++ },
+ },
+ },
+ } };
+
+-int virtio_crypto_algs_register(void)
++int virtio_crypto_algs_register(struct virtio_crypto *vcrypto)
+ {
+ int ret = 0;
++ int i = 0;
+
+ mutex_lock(&algs_lock);
+- if (++virtio_crypto_active_devs != 1)
+- goto unlock;
+
+- ret = crypto_register_algs(virtio_crypto_algs,
+- ARRAY_SIZE(virtio_crypto_algs));
+- if (ret)
+- virtio_crypto_active_devs--;
++ for (i = 0; i < ARRAY_SIZE(virtio_crypto_algs); i++) {
++
++ uint32_t service = virtio_crypto_algs[i].service;
++ uint32_t algonum = virtio_crypto_algs[i].algonum;
++
++ if (!virtcrypto_algo_is_supported(vcrypto, service, algonum))
++ continue;
++
++ if (virtio_crypto_algs[i].active_devs == 0) {
++ ret = crypto_register_alg(&virtio_crypto_algs[i].algo);
++ if (ret)
++ goto unlock;
++ }
++
++ virtio_crypto_algs[i].active_devs++;
++ dev_info(&vcrypto->vdev->dev, "Registered algo %s\n",
++ virtio_crypto_algs[i].algo.cra_name);
++ }
+
+ unlock:
+ mutex_unlock(&algs_lock);
+ return ret;
+ }
+
+-void virtio_crypto_algs_unregister(void)
++void virtio_crypto_algs_unregister(struct virtio_crypto *vcrypto)
+ {
++ int i = 0;
++
+ mutex_lock(&algs_lock);
+- if (--virtio_crypto_active_devs != 0)
+- goto unlock;
+
+- crypto_unregister_algs(virtio_crypto_algs,
+- ARRAY_SIZE(virtio_crypto_algs));
++ for (i = 0; i < ARRAY_SIZE(virtio_crypto_algs); i++) {
++
++ uint32_t service = virtio_crypto_algs[i].service;
++ uint32_t algonum = virtio_crypto_algs[i].algonum;
++
++ if (virtio_crypto_algs[i].active_devs == 0 ||
++ !virtcrypto_algo_is_supported(vcrypto, service, algonum))
++ continue;
++
++ if (virtio_crypto_algs[i].active_devs == 1)
++ crypto_unregister_alg(&virtio_crypto_algs[i].algo);
++
++ virtio_crypto_algs[i].active_devs--;
++ }
+
+-unlock:
+ mutex_unlock(&algs_lock);
+ }
+--- a/drivers/crypto/virtio/virtio_crypto_common.h
++++ b/drivers/crypto/virtio/virtio_crypto_common.h
+@@ -126,7 +126,12 @@ int virtcrypto_dev_in_use(struct virtio_
+ int virtcrypto_dev_get(struct virtio_crypto *vcrypto_dev);
+ void virtcrypto_dev_put(struct virtio_crypto *vcrypto_dev);
+ int virtcrypto_dev_started(struct virtio_crypto *vcrypto_dev);
+-struct virtio_crypto *virtcrypto_get_dev_node(int node);
++bool virtcrypto_algo_is_supported(struct virtio_crypto *vcrypto_dev,
++ uint32_t service,
++ uint32_t algo);
++struct virtio_crypto *virtcrypto_get_dev_node(int node,
++ uint32_t service,
++ uint32_t algo);
+ int virtcrypto_dev_start(struct virtio_crypto *vcrypto);
+ void virtcrypto_dev_stop(struct virtio_crypto *vcrypto);
+ int virtio_crypto_ablkcipher_crypt_req(
+@@ -151,7 +156,7 @@ static inline int virtio_crypto_get_curr
+ return node;
+ }
+
+-int virtio_crypto_algs_register(void);
+-void virtio_crypto_algs_unregister(void);
++int virtio_crypto_algs_register(struct virtio_crypto *vcrypto);
++void virtio_crypto_algs_unregister(struct virtio_crypto *vcrypto);
+
+ #endif /* _VIRTIO_CRYPTO_COMMON_H */
+--- a/drivers/crypto/virtio/virtio_crypto_mgr.c
++++ b/drivers/crypto/virtio/virtio_crypto_mgr.c
+@@ -181,14 +181,20 @@ int virtcrypto_dev_started(struct virtio
+ /*
+ * virtcrypto_get_dev_node() - Get vcrypto_dev on the node.
+ * @node: Node id the driver works.
++ * @service: Crypto service that needs to be supported by the
++ * dev
++ * @algo: The algorithm number that needs to be supported by the
++ * dev
+ *
+- * Function returns the virtio crypto device used fewest on the node.
++ * Function returns the virtio crypto device used fewest on the node,
++ * and supports the given crypto service and algorithm.
+ *
+ * To be used by virtio crypto device specific drivers.
+ *
+ * Return: pointer to vcrypto_dev or NULL if not found.
+ */
+-struct virtio_crypto *virtcrypto_get_dev_node(int node)
++struct virtio_crypto *virtcrypto_get_dev_node(int node, uint32_t service,
++ uint32_t algo)
+ {
+ struct virtio_crypto *vcrypto_dev = NULL, *tmp_dev;
+ unsigned long best = ~0;
+@@ -199,7 +205,8 @@ struct virtio_crypto *virtcrypto_get_dev
+
+ if ((node == dev_to_node(&tmp_dev->vdev->dev) ||
+ dev_to_node(&tmp_dev->vdev->dev) < 0) &&
+- virtcrypto_dev_started(tmp_dev)) {
++ virtcrypto_dev_started(tmp_dev) &&
++ virtcrypto_algo_is_supported(tmp_dev, service, algo)) {
+ ctr = atomic_read(&tmp_dev->ref_count);
+ if (best > ctr) {
+ vcrypto_dev = tmp_dev;
+@@ -214,7 +221,9 @@ struct virtio_crypto *virtcrypto_get_dev
+ /* Get any started device */
+ list_for_each_entry(tmp_dev,
+ virtcrypto_devmgr_get_head(), list) {
+- if (virtcrypto_dev_started(tmp_dev)) {
++ if (virtcrypto_dev_started(tmp_dev) &&
++ virtcrypto_algo_is_supported(tmp_dev,
++ service, algo)) {
+ vcrypto_dev = tmp_dev;
+ break;
+ }
+@@ -240,7 +249,7 @@ struct virtio_crypto *virtcrypto_get_dev
+ */
+ int virtcrypto_dev_start(struct virtio_crypto *vcrypto)
+ {
+- if (virtio_crypto_algs_register()) {
++ if (virtio_crypto_algs_register(vcrypto)) {
+ pr_err("virtio_crypto: Failed to register crypto algs\n");
+ return -EFAULT;
+ }
+@@ -260,5 +269,65 @@ int virtcrypto_dev_start(struct virtio_c
+ */
+ void virtcrypto_dev_stop(struct virtio_crypto *vcrypto)
+ {
+- virtio_crypto_algs_unregister();
++ virtio_crypto_algs_unregister(vcrypto);
++}
++
++/*
++ * vcrypto_algo_is_supported()
++ * @vcrypto: Pointer to virtio crypto device.
++ * @service: The bit number for service validate.
++ * See VIRTIO_CRYPTO_SERVICE_*
++ * @algo : The bit number for the algorithm to validate.
++ *
++ *
++ * Validate if the virtio crypto device supports a service and
++ * algo.
++ *
++ * Return true if device supports a service and algo.
++ */
++
++bool virtcrypto_algo_is_supported(struct virtio_crypto *vcrypto,
++ uint32_t service,
++ uint32_t algo)
++{
++ uint32_t service_mask = 1u << service;
++ uint32_t algo_mask = 0;
++ bool low = true;
++
++ if (algo > 31) {
++ algo -= 32;
++ low = false;
++ }
++
++ if (!(vcrypto->crypto_services & service_mask))
++ return false;
++
++ switch (service) {
++ case VIRTIO_CRYPTO_SERVICE_CIPHER:
++ if (low)
++ algo_mask = vcrypto->cipher_algo_l;
++ else
++ algo_mask = vcrypto->cipher_algo_h;
++ break;
++
++ case VIRTIO_CRYPTO_SERVICE_HASH:
++ algo_mask = vcrypto->hash_algo;
++ break;
++
++ case VIRTIO_CRYPTO_SERVICE_MAC:
++ if (low)
++ algo_mask = vcrypto->mac_algo_l;
++ else
++ algo_mask = vcrypto->mac_algo_h;
++ break;
++
++ case VIRTIO_CRYPTO_SERVICE_AEAD:
++ algo_mask = vcrypto->aead_algo;
++ break;
++ }
++
++ if (!(algo_mask & (1u << algo)))
++ return false;
++
++ return true;
+ }
diff --git a/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch b/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch
index 4c2916382b..69488d740e 100644
--- a/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch
+++ b/patches.suse/drm-amdgpu-psp-move-psp-version-specific-function-po.patch
@@ -1,13 +1,14 @@
From 9d6fea5744d6798353f37ac42a8a653a2607ca69 Mon Sep 17 00:00:00 2001
From: Alex Deucher <alexander.deucher@amd.com>
Date: Wed, 8 May 2019 21:45:06 -0500
-Subject: [PATCH] drm/amdgpu/psp: move psp version specific function pointers to early_init
-Mime-version: 1.0
-Content-type: text/plain; charset=UTF-8
-Content-transfer-encoding: 8bit
+Subject: drm/amdgpu/psp: move psp version specific function pointers to
+ early_init
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
Git-commit: 9d6fea5744d6798353f37ac42a8a653a2607ca69
Patch-mainline: v5.2-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
In case we need to use them for GPU reset prior initializing the
asic. Fixes a crash if the driver attempts to reset the GPU at driver
@@ -16,15 +17,14 @@ load time.
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c
-@@ -37,18 +37,10 @@ static void psp_set_funcs(struct amdgpu_
+@@ -36,18 +36,10 @@ static void psp_set_funcs(struct amdgpu_
static int psp_early_init(void *handle)
{
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
diff --git a/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch b/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
index e1b0330ccd..59d4199528 100644
--- a/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
+++ b/patches.suse/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
@@ -1,10 +1,10 @@
From be132e1375c1fffe48801296279079f8a59a9ed3 Mon Sep 17 00:00:00 2001
From: Lucas Stach <l.stach@pengutronix.de>
Date: Thu, 27 Jun 2019 16:42:00 +0200
-Subject: [PATCH] drm/etnaviv: add missing failure path to destroy suballoc
+Subject: drm/etnaviv: add missing failure path to destroy suballoc
Git-commit: be132e1375c1fffe48801296279079f8a59a9ed3
Patch-mainline: v5.2
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
When something goes wrong in the GPU init after the cmdbuf suballocator
has been constructed, we fail to destroy it properly. This causes havok
@@ -13,17 +13,14 @@ later when the GPU is unbound due to a module unload or similar.
Fixes: e66774dd6f6a (drm/etnaviv: add cmdbuf suballocator)
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Tested-by: Russell King <rmk+kernel@armlinux.org.uk>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 7 +++++--
+ drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
-index 72d01e873160..5418a1a87b2c 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
-@@ -760,7 +760,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+@@ -705,7 +705,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu
if (IS_ERR(gpu->cmdbuf_suballoc)) {
dev_err(gpu->dev, "Failed to create cmdbuf suballocator\n");
ret = PTR_ERR(gpu->cmdbuf_suballoc);
@@ -32,7 +29,7 @@ index 72d01e873160..5418a1a87b2c 100644
}
/* Create buffer: */
-@@ -768,7 +768,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+@@ -713,7 +713,7 @@ int etnaviv_gpu_init(struct etnaviv_gpu
PAGE_SIZE);
if (ret) {
dev_err(gpu->dev, "could not create command buffer\n");
@@ -41,7 +38,7 @@ index 72d01e873160..5418a1a87b2c 100644
}
if (gpu->mmu->version == ETNAVIV_IOMMU_V1 &&
-@@ -800,6 +800,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu *gpu)
+@@ -746,6 +746,9 @@ int etnaviv_gpu_init(struct etnaviv_gpu
free_buffer:
etnaviv_cmdbuf_free(&gpu->buffer);
gpu->buffer.suballoc = NULL;
@@ -51,6 +48,3 @@ index 72d01e873160..5418a1a87b2c 100644
destroy_iommu:
etnaviv_iommu_destroy(gpu->mmu);
gpu->mmu = NULL;
---
-2.16.4
-
diff --git a/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch b/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
index b9fe49c71e..fe17b0dbf0 100644
--- a/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
+++ b/patches.suse/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
@@ -1,11 +1,11 @@
From 73a0ff0b30af79bf0303d557eb82f1d1945bb6ee Mon Sep 17 00:00:00 2001
From: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Date: Fri, 12 Jul 2019 11:19:38 +0300
-Subject: [PATCH] drm/i915: Fix wrong escape clock divisor init for GLK
+Subject: drm/i915: Fix wrong escape clock divisor init for GLK
Git-commit: 73a0ff0b30af79bf0303d557eb82f1d1945bb6ee
Patch-mainline: v5.3-rc4
+References: bsc#1051510 bsc#1142635
No-fix: ce52ad5dd52cfaf3398058384e0ff94134bbd89c
-References: bsc#1051510
According to Bspec clock divisor registers in GeminiLake
should be initialized by shifting 1(<<) to amount of correspondent
@@ -14,8 +14,8 @@ divisor. While i915 was writing all this time that value as is.
Surprisingly that it by accident worked, until we met some issues
with Microtech Etab.
-V2: Added Fixes tag and cc
-V3: Added stable to cc as well.
+v2: Added Fixes tag and cc
+v3: Added stable to cc as well.
Signed-off-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
Reviewed-by: Vandita Kulkarni <vandita.kulkarni@intel.com>
@@ -32,18 +32,15 @@ Cc: stable@vger.kernel.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190712081938.14185-1-stanislav.lisovskiy@intel.com
(cherry picked from commit ce52ad5dd52cfaf3398058384e0ff94134bbd89c)
-
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/i915/display/vlv_dsi_pll.c | 4 ++--
+ drivers/gpu/drm/i915/vlv_dsi_pll.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/drivers/gpu/drm/i915/display/vlv_dsi_pll.c b/drivers/gpu/drm/i915/display/vlv_dsi_pll.c
-index 99cc3e2e9c2c..f016a776a39e 100644
--- a/drivers/gpu/drm/i915/vlv_dsi_pll.c
+++ b/drivers/gpu/drm/i915/vlv_dsi_pll.c
-@@ -396,8 +396,8 @@ static void glk_dsi_program_esc_clock(struct drm_device *dev,
+@@ -422,8 +422,8 @@ static void glk_dsi_program_esc_clock(st
else
txesc2_div = 10;
@@ -54,6 +51,3 @@ index 99cc3e2e9c2c..f016a776a39e 100644
}
/* Program BXT Mipi clocks and dividers */
---
-2.16.4
-
diff --git a/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch b/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
index 0e45493703..09eb704be2 100644
--- a/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
+++ b/patches.suse/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
@@ -1,11 +1,11 @@
From 06c12ae3b401238477e65e8c4e04e065699a6115 Mon Sep 17 00:00:00 2001
From: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Date: Tue, 9 Jul 2019 15:33:39 +0300
-Subject: [PATCH] drm/i915/perf: ensure we keep a reference on the driver
+Subject: drm/i915/perf: ensure we keep a reference on the driver
Git-commit: 06c12ae3b401238477e65e8c4e04e065699a6115
Patch-mainline: v5.3-rc3
+References: bsc#1051510 bsc#1142635
No-fix: a5af1df716c123a09341351008fc497bea137b77
-References: bsc#1051510
The i915 perf stream has its own file descriptor and is tied to
reference of the driver. We haven't taken care of keep the driver
@@ -18,19 +18,15 @@ Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link: https://patchwork.freedesktop.org/patch/msgid/20190709123351.5645-2-lionel.g.landwerlin@intel.com
(cherry picked from commit a5af1df716c123a09341351008fc497bea137b77)
-
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/i915/i915_perf.c | 8 ++++++++
+ drivers/gpu/drm/i915/i915_perf.c | 8 ++++++++
1 file changed, 8 insertions(+)
-diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
-index 1ae06a1b6749..629511ea9a18 100644
--- a/drivers/gpu/drm/i915/i915_perf.c
+++ b/drivers/gpu/drm/i915/i915_perf.c
-@@ -2515,6 +2515,9 @@ static int i915_perf_release(struct inode *inode, struct file *file)
+@@ -2523,6 +2523,9 @@ static int i915_perf_release(struct inod
i915_perf_destroy_locked(stream);
mutex_unlock(&dev_priv->perf.lock);
@@ -40,7 +36,7 @@ index 1ae06a1b6749..629511ea9a18 100644
return 0;
}
-@@ -2650,6 +2653,11 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv,
+@@ -2658,6 +2661,11 @@ i915_perf_open_ioctl_locked(struct drm_i
if (!(param->flags & I915_PERF_FLAG_DISABLED))
i915_perf_enable_locked(stream);
@@ -52,6 +48,3 @@ index 1ae06a1b6749..629511ea9a18 100644
return stream_fd;
err_open:
---
-2.16.4
-
diff --git a/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch b/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch
index 1c2e9dd01d..5c424acc8c 100644
--- a/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch
+++ b/patches.suse/drm-imx-notify-drm-core-before-sending-event-during-.patch
@@ -1,10 +1,10 @@
From 78c68e8f5cd24bd32ba4ca1cdfb0c30cf0642685 Mon Sep 17 00:00:00 2001
From: Robert Beckett <bob.beckett@collabora.com>
Date: Tue, 25 Jun 2019 18:59:13 +0100
-Subject: [PATCH] drm/imx: notify drm core before sending event during crtc disable
+Subject: drm/imx: notify drm core before sending event during crtc disable
Git-commit: 78c68e8f5cd24bd32ba4ca1cdfb0c30cf0642685
Patch-mainline: v5.2
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
Notify drm core before sending pending events during crtc disable.
This fixes the first event after disable having an old stale timestamp
@@ -28,8 +28,7 @@ Fixes: a474478642d5 ("drm/imx: fix crtc vblank state regression")
Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/imx/ipuv3-crtc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
@@ -56,5 +55,5 @@ index 9cc1d678674f..e04d6efff1b5 100644
static void imx_drm_crtc_reset(struct drm_crtc *crtc)
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch b/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
index 2ac3f6b068..40f9da3b6a 100644
--- a/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
+++ b/patches.suse/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
@@ -1,10 +1,10 @@
From 5aeab2bfc9ffa72d3ca73416635cb3785dfc076f Mon Sep 17 00:00:00 2001
From: Robert Beckett <bob.beckett@collabora.com>
Date: Tue, 25 Jun 2019 18:59:15 +0100
-Subject: [PATCH] drm/imx: only send event on crtc disable if kept disabled
+Subject: drm/imx: only send event on crtc disable if kept disabled
Git-commit: 5aeab2bfc9ffa72d3ca73416635cb3785dfc076f
Patch-mainline: v5.2
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
The event will be sent as part of the vblank enable during the modeset
if the crtc is not being kept disabled.
@@ -14,8 +14,7 @@ Fixes: 5f2f911578fb ("drm/imx: atomic phase 3 step 1: Use atomic configuration")
Signed-off-by: Robert Beckett <bob.beckett@collabora.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -34,5 +33,5 @@ index e04d6efff1b5..c436a28d50e4 100644
crtc->state->event = NULL;
}
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch b/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
index fb671f18d2..48fda0cf3d 100644
--- a/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
+++ b/patches.suse/drm-mediatek-call-drm_atomic_helper_shutdown-when-un.patch
@@ -1,27 +1,24 @@
From cf49b24ffa62766f8f04cd1c4cf17b75d29b240a Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:54 +0800
-Subject: [PATCH] drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
+Subject: drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver
Git-commit: cf49b24ffa62766f8f04cd1c4cf17b75d29b240a
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
shutdown all CRTC when unbinding drm driver.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-index e7362bdafa82..8718d123ccaa 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-@@ -311,6 +311,7 @@ static int mtk_drm_kms_init(struct drm_device *drm)
+@@ -265,6 +265,7 @@ err_config_cleanup:
static void mtk_drm_kms_deinit(struct drm_device *drm)
{
drm_kms_helper_poll_fini(drm);
@@ -29,6 +26,3 @@ index e7362bdafa82..8718d123ccaa 100644
component_unbind_all(drm->dev, drm);
drm_mode_config_cleanup(drm);
---
-2.16.4
-
diff --git a/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch b/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
index ff5c60736c..d38353f2b9 100644
--- a/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
+++ b/patches.suse/drm-mediatek-call-mtk_dsi_stop-after-mtk_drm_crtc_at.patch
@@ -1,10 +1,10 @@
From 2458d9d6d94be982b917e93c61a89b4426f32e31 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Thu, 30 May 2019 17:18:47 +0800
-Subject: [PATCH] drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
+Subject: drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable()
Git-commit: 2458d9d6d94be982b917e93c61a89b4426f32e31
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
mtk_dsi_stop() should be called after mtk_drm_crtc_atomic_disable(), which
needs ovl irq for drm_crtc_wait_one_vblank(), since after mtk_dsi_stop() is
@@ -32,8 +32,7 @@ mtk_dsi_stop() called in mtk_dsi_poweroff() when refcount is 0.
Fixes: 0707632b5bac ("drm/mediatek: update DSI sub driver flow for sending commands to panel")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
@@ -67,5 +66,5 @@ index 1ae3be99e0ff..179f2b080342 100644
dsi->enabled = false;
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch b/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch
index 408997ee98..a9ff6630dc 100644
--- a/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch
+++ b/patches.suse/drm-mediatek-clear-num_pipes-when-unbind-driver.patch
@@ -1,10 +1,10 @@
From a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:55 +0800
-Subject: [PATCH] drm/mediatek: clear num_pipes when unbind driver
+Subject: drm/mediatek: clear num_pipes when unbind driver
Git-commit: a4cd1d2b016d5d043ab2c4b9c4ec50a5805f5396
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
num_pipes is used for mutex created in mtk_drm_crtc_create(). If we
don't clear num_pipes count, when rebinding driver, the count will
@@ -14,17 +14,14 @@ be accumulated. From mtk_disp_mutex_get(), there can only be at most
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-index 8718d123ccaa..bbfe3a464aea 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-@@ -400,6 +400,7 @@ static void mtk_drm_unbind(struct device *dev)
+@@ -351,6 +351,7 @@ static void mtk_drm_unbind(struct device
drm_dev_unregister(private->drm);
mtk_drm_kms_deinit(private->drm);
drm_dev_put(private->drm);
@@ -32,6 +29,3 @@ index 8718d123ccaa..bbfe3a464aea 100644
private->drm = NULL;
}
---
-2.16.4
-
diff --git a/patches.suse/drm-mediatek-fix-unbind-functions.patch b/patches.suse/drm-mediatek-fix-unbind-functions.patch
index 29f453ab42..bff0f3d083 100644
--- a/patches.suse/drm-mediatek-fix-unbind-functions.patch
+++ b/patches.suse/drm-mediatek-fix-unbind-functions.patch
@@ -1,10 +1,10 @@
From 8fd7a37b191f93737f6280a9b5de65f98acc12c9 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:52 +0800
-Subject: [PATCH] drm/mediatek: fix unbind functions
+Subject: drm/mediatek: fix unbind functions
Git-commit: 8fd7a37b191f93737f6280a9b5de65f98acc12c9
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
detatch panel in mtk_dsi_destroy_conn_enc(), since .bind will try to
attach it again.
@@ -12,8 +12,7 @@ attach it again.
Fixes: 2e54c14e310f ("drm/mediatek: Add DSI sub driver")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++
1 file changed, 2 insertions(+)
@@ -32,5 +31,5 @@ index b00eb2d2e086..1ae3be99e0ff 100644
static void mtk_dsi_ddp_start(struct mtk_ddp_comp *comp)
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch b/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch
index a3db7b22f1..786a7549b0 100644
--- a/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch
+++ b/patches.suse/drm-mediatek-mtk_drm_drv.c-Add-of_node_put-before-go.patch
@@ -1,10 +1,10 @@
From 165d42c012be69900f0e2f8545626cb9e7d4a832 Mon Sep 17 00:00:00 2001
From: Nishka Dasgupta <nishkadg.linux@gmail.com>
Date: Sat, 6 Jul 2019 19:00:21 +0530
-Subject: [PATCH] drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
+Subject: drm/mediatek: mtk_drm_drv.c: Add of_node_put() before goto
Git-commit: 165d42c012be69900f0e2f8545626cb9e7d4a832
Patch-mainline: v5.3-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
Each iteration of for_each_child_of_node puts the previous
node, but in the case of a goto from the middle of the loop, there is
@@ -16,8 +16,7 @@ Fixes: 119f5173628a (drm/mediatek: Add DRM Driver for Mediatek SoC MT8173)
Signed-off-by: Nishka Dasgupta <nishkadg.linux@gmail.com>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
@@ -44,5 +43,5 @@ index c021d4c8324f..7f5408cb2377 100644
private->ddp_comp[comp_id] = comp;
}
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch b/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
index 05fc9c54aa..98f5c2410c 100644
--- a/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
+++ b/patches.suse/drm-mediatek-unbind-components-in-mtk_drm_unbind.patch
@@ -1,10 +1,10 @@
From f0fd848342802bc0f74620d387eead53e8905804 Mon Sep 17 00:00:00 2001
From: Hsin-Yi Wang <hsinyi@chromium.org>
Date: Wed, 29 May 2019 18:25:53 +0800
-Subject: [PATCH] drm/mediatek: unbind components in mtk_drm_unbind()
+Subject: drm/mediatek: unbind components in mtk_drm_unbind()
Git-commit: f0fd848342802bc0f74620d387eead53e8905804
Patch-mainline: v5.2-rc5
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
Unbinding components (i.e. mtk_dsi and mtk_disp_ovl/rdma/color) will
trigger master(mtk_drm)'s .unbind(), and currently mtk_drm's unbind
@@ -20,17 +20,14 @@ called here.
Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +-----
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
-diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-index 57ce4708ef1b..e7362bdafa82 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
-@@ -397,6 +397,7 @@ static void mtk_drm_unbind(struct device *dev)
+@@ -348,6 +348,7 @@ static void mtk_drm_unbind(struct device
struct mtk_drm_private *private = dev_get_drvdata(dev);
drm_dev_unregister(private->drm);
@@ -38,7 +35,7 @@ index 57ce4708ef1b..e7362bdafa82 100644
drm_dev_put(private->drm);
private->drm = NULL;
}
-@@ -568,13 +569,8 @@ static int mtk_drm_probe(struct platform_device *pdev)
+@@ -497,13 +498,8 @@ err_node:
static int mtk_drm_remove(struct platform_device *pdev)
{
struct mtk_drm_private *private = platform_get_drvdata(pdev);
@@ -52,6 +49,3 @@ index 57ce4708ef1b..e7362bdafa82 100644
component_master_del(&pdev->dev, &mtk_drm_ops);
pm_runtime_disable(&pdev->dev);
of_node_put(private->mutex_node);
---
-2.16.4
-
diff --git a/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch b/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch
index 3ff6bbb579..66a335b904 100644
--- a/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch
+++ b/patches.suse/drm-mediatek-use-correct-device-to-import-PRIME-buff.patch
@@ -1,10 +1,10 @@
From 4c6f3196e6ea111c456c6086dc3f57d4706b0b2d Mon Sep 17 00:00:00 2001
From: Alexandre Courbot <acourbot@chromium.org>
Date: Mon, 29 Jul 2019 14:33:34 +0900
-Subject: [PATCH] drm/mediatek: use correct device to import PRIME buffers
+Subject: drm/mediatek: use correct device to import PRIME buffers
Git-commit: 4c6f3196e6ea111c456c6086dc3f57d4706b0b2d
Patch-mainline: v5.3-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
PRIME buffers should be imported using the DMA device. To this end, use
a custom import function that mimics drm_gem_prime_import_dev(), but
@@ -13,8 +13,7 @@ passes the correct device.
Fixes: 119f5173628aa ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.")
Signed-off-by: Alexandre Courbot <acourbot@chromium.org>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
@@ -52,5 +51,5 @@ index 95fdbd0fbcac..8b18a00a58c7 100644
.gem_prime_import_sg_table = mtk_gem_prime_import_sg_table,
.gem_prime_mmap = mtk_drm_gem_mmap_buf,
--
-2.16.4
+2.22.0
diff --git a/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch b/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch
index 37ca0495b1..4670b0d4ff 100644
--- a/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch
+++ b/patches.suse/drm-msm-mdp5-Fix-mdp5_cfg_init-error-return.patch
@@ -1,10 +1,10 @@
From fc19cbb785d7bbd1a1af26229b5240a3ab332744 Mon Sep 17 00:00:00 2001
From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Date: Tue, 21 May 2019 08:00:30 -0700
-Subject: [PATCH] drm/msm/mdp5: Fix mdp5_cfg_init error return
+Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return
Git-commit: fc19cbb785d7bbd1a1af26229b5240a3ab332744
Patch-mainline: v5.3-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
If mdp5_cfg_init fails because of an unknown major version, a null pointer
dereference occurs. This is because the caller of init expects error
@@ -15,17 +15,14 @@ Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module)
Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
-index ea8f7d7daf7f..52e23780fce1 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_cfg.c
-@@ -721,7 +721,7 @@ struct mdp5_cfg_handler *mdp5_cfg_init(struct mdp5_kms *mdp5_kms,
+@@ -633,7 +633,7 @@ fail:
if (cfg_handler)
mdp5_cfg_destroy(cfg_handler);
@@ -34,6 +31,3 @@ index ea8f7d7daf7f..52e23780fce1 100644
}
static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev)
---
-2.16.4
-
diff --git a/patches.suse/drm-rockchip-Suspend-DP-late.patch b/patches.suse/drm-rockchip-Suspend-DP-late.patch
index 1d86d66a3b..11e56910b9 100644
--- a/patches.suse/drm-rockchip-Suspend-DP-late.patch
+++ b/patches.suse/drm-rockchip-Suspend-DP-late.patch
@@ -1,10 +1,10 @@
From f7ccbed656f78212593ca965d9a8f34bf24e0aab Mon Sep 17 00:00:00 2001
From: Douglas Anderson <dianders@chromium.org>
Date: Fri, 2 Aug 2019 11:46:16 -0700
-Subject: [PATCH] drm/rockchip: Suspend DP late
+Subject: drm/rockchip: Suspend DP late
Git-commit: f7ccbed656f78212593ca965d9a8f34bf24e0aab
Patch-mainline: v5.3-rc4
-References: bsc#1051510
+References: bsc#1051510 bsc#1142635
In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved
resume to be early but left suspend at its normal time. This seems
@@ -22,17 +22,14 @@ Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +-
+ drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
-index 95e5c517a15f..9aae3d8e99ef 100644
--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
+++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c
-@@ -432,7 +432,7 @@ static int rockchip_dp_resume(struct device *dev)
+@@ -428,7 +428,7 @@ static int rockchip_dp_remove(struct pla
static const struct dev_pm_ops rockchip_dp_pm_ops = {
#ifdef CONFIG_PM_SLEEP
@@ -41,6 +38,3 @@ index 95e5c517a15f..9aae3d8e99ef 100644
.resume_early = rockchip_dp_resume,
#endif
};
---
-2.16.4
-
diff --git a/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch b/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch
index 8048420148..8b0896bdc1 100644
--- a/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch
+++ b/patches.suse/drm-udl-introduce-a-macro-to-convert-dev-to-udl.patch
@@ -1,30 +1,27 @@
From fd96e0dba19c53c2d66f2a398716bb74df8ca85e Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Fri, 5 Apr 2019 13:17:14 +1000
-Subject: [PATCH] drm/udl: introduce a macro to convert dev to udl.
+Subject: drm/udl: introduce a macro to convert dev to udl.
Git-commit: fd96e0dba19c53c2d66f2a398716bb74df8ca85e
Patch-mainline: v5.2-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1113722
This just makes it easier to later embed drm into udl.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-3-airlied@gmail.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/udl/udl_drv.h | 2 ++
- drivers/gpu/drm/udl/udl_fb.c | 10 +++++-----
- drivers/gpu/drm/udl/udl_gem.c | 2 +-
- drivers/gpu/drm/udl/udl_main.c | 12 ++++++------
+ drivers/gpu/drm/udl/udl_drv.h | 2 ++
+ drivers/gpu/drm/udl/udl_fb.c | 10 +++++-----
+ drivers/gpu/drm/udl/udl_gem.c | 2 +-
+ drivers/gpu/drm/udl/udl_main.c | 12 ++++++------
4 files changed, 14 insertions(+), 12 deletions(-)
-diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
-index 4ae67d882eae..b3e08e876d62 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
-@@ -71,6 +71,8 @@ struct udl_device {
+@@ -68,6 +68,8 @@ struct udl_device {
atomic_t cpu_kcycles_used; /* transpired during pixel processing */
};
@@ -33,11 +30,9 @@ index 4ae67d882eae..b3e08e876d62 100644
struct udl_gem_object {
struct drm_gem_object base;
struct page **pages;
-diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index f8ff5a6f559e..16593d4f02b4 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
-@@ -82,7 +82,7 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y,
+@@ -82,7 +82,7 @@ int udl_handle_damage(struct udl_framebu
int width, int height)
{
struct drm_device *dev = fb->base.dev;
@@ -46,7 +41,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
int i, ret;
char *cmd;
cycles_t start_cycles, end_cycles;
-@@ -210,7 +210,7 @@ static int udl_fb_open(struct fb_info *info, int user)
+@@ -210,7 +210,7 @@ static int udl_fb_open(struct fb_info *i
{
struct udl_fbdev *ufbdev = info->par;
struct drm_device *dev = ufbdev->ufb.base.dev;
@@ -55,7 +50,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
/* If the USB device is gone, we don't accept new opens */
if (drm_dev_is_unplugged(udl->ddev))
-@@ -437,7 +437,7 @@ static void udl_fbdev_destroy(struct drm_device *dev,
+@@ -442,7 +442,7 @@ static void udl_fbdev_destroy(struct drm
int udl_fbdev_init(struct drm_device *dev)
{
@@ -64,7 +59,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
int bpp_sel = fb_bpp;
struct udl_fbdev *ufbdev;
int ret;
-@@ -476,7 +476,7 @@ int udl_fbdev_init(struct drm_device *dev)
+@@ -481,7 +481,7 @@ free:
void udl_fbdev_cleanup(struct drm_device *dev)
{
@@ -73,7 +68,7 @@ index f8ff5a6f559e..16593d4f02b4 100644
if (!udl->fbdev)
return;
-@@ -487,7 +487,7 @@ void udl_fbdev_cleanup(struct drm_device *dev)
+@@ -492,7 +492,7 @@ void udl_fbdev_cleanup(struct drm_device
void udl_fbdev_unplug(struct drm_device *dev)
{
@@ -82,8 +77,6 @@ index f8ff5a6f559e..16593d4f02b4 100644
struct udl_fbdev *ufbdev;
if (!udl->fbdev)
return;
-diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
-index bb7b58407039..3b3e17652bb2 100644
--- a/drivers/gpu/drm/udl/udl_gem.c
+++ b/drivers/gpu/drm/udl/udl_gem.c
@@ -203,7 +203,7 @@ int udl_gem_mmap(struct drm_file *file, struct drm_device *dev,
@@ -95,8 +88,6 @@ index bb7b58407039..3b3e17652bb2 100644
int ret = 0;
mutex_lock(&udl->gem_lock);
-diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
-index 1f8ef34ade24..862c099d7c4c 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -30,7 +30,7 @@
@@ -108,7 +99,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
char *desc;
char *buf;
char *desc_end;
-@@ -166,7 +166,7 @@ void udl_urb_completion(struct urb *urb)
+@@ -164,7 +164,7 @@ void udl_urb_completion(struct urb *urb)
static void udl_free_urb_list(struct drm_device *dev)
{
@@ -117,7 +108,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
int count = udl->urbs.count;
struct list_head *node;
struct urb_node *unode;
-@@ -199,7 +199,7 @@ static void udl_free_urb_list(struct drm_device *dev)
+@@ -198,7 +198,7 @@ static void udl_free_urb_list(struct drm
static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
{
@@ -126,7 +117,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
struct urb *urb;
struct urb_node *unode;
char *buf;
-@@ -263,7 +263,7 @@ static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size)
+@@ -262,7 +262,7 @@ retry:
struct urb *udl_get_urb(struct drm_device *dev)
{
@@ -135,7 +126,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
int ret = 0;
struct list_head *entry;
struct urb_node *unode;
-@@ -296,7 +296,7 @@ struct urb *udl_get_urb(struct drm_device *dev)
+@@ -296,7 +296,7 @@ error:
int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
{
@@ -144,7 +135,7 @@ index 1f8ef34ade24..862c099d7c4c 100644
int ret;
BUG_ON(len > udl->urbs.size);
-@@ -371,7 +371,7 @@ int udl_drop_usb(struct drm_device *dev)
+@@ -372,7 +372,7 @@ int udl_drop_usb(struct drm_device *dev)
void udl_driver_unload(struct drm_device *dev)
{
@@ -153,6 +144,3 @@ index 1f8ef34ade24..862c099d7c4c 100644
drm_kms_helper_poll_fini(dev);
---
-2.16.4
-
diff --git a/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch b/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch
index 0f44d4a83a..f0da7d6e7a 100644
--- a/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch
+++ b/patches.suse/drm-udl-move-to-embedding-drm-device-inside-udl-devi.patch
@@ -1,10 +1,10 @@
From 6ecac85eadb9d4065b9038fa3d3c66d49038e14b Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@redhat.com>
Date: Fri, 5 Apr 2019 13:17:15 +1000
-Subject: [PATCH] drm/udl: move to embedding drm device inside udl device.
+Subject: drm/udl: move to embedding drm device inside udl device.
Git-commit: 6ecac85eadb9d4065b9038fa3d3c66d49038e14b
Patch-mainline: v5.2-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1113722
This should help with some of the lifetime issues, and move us away
from load/unload.
@@ -12,20 +12,17 @@ from load/unload.
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-4-airlied@gmail.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/udl/udl_drv.c | 56 +++++++++++++++++++++++++++++++++---------
- drivers/gpu/drm/udl/udl_drv.h | 9 +++----
- drivers/gpu/drm/udl/udl_fb.c | 2 +-
- drivers/gpu/drm/udl/udl_main.c | 23 +++--------------
+ drivers/gpu/drm/udl/udl_drv.c | 56 ++++++++++++++++++++++++++++++++---------
+ drivers/gpu/drm/udl/udl_drv.h | 9 ++----
+ drivers/gpu/drm/udl/udl_fb.c | 2 -
+ drivers/gpu/drm/udl/udl_main.c | 23 ++--------------
4 files changed, 53 insertions(+), 37 deletions(-)
-diff --git a/drivers/gpu/drm/udl/udl_drv.c b/drivers/gpu/drm/udl/udl_drv.c
-index b7d01b3664cb..312bf324841a 100644
--- a/drivers/gpu/drm/udl/udl_drv.c
+++ b/drivers/gpu/drm/udl/udl_drv.c
-@@ -48,10 +48,16 @@ static const struct file_operations udl_driver_fops = {
+@@ -48,10 +48,16 @@ static const struct file_operations udl_
.llseek = noop_llseek,
};
@@ -44,7 +41,7 @@ index b7d01b3664cb..312bf324841a 100644
.release = udl_driver_release,
/* gem hooks */
-@@ -75,28 +81,56 @@ static struct drm_driver driver = {
+@@ -77,28 +83,56 @@ static struct drm_driver driver = {
.patchlevel = DRIVER_PATCHLEVEL,
};
@@ -110,11 +107,9 @@ index b7d01b3664cb..312bf324841a 100644
return r;
}
-diff --git a/drivers/gpu/drm/udl/udl_drv.h b/drivers/gpu/drm/udl/udl_drv.h
-index b3e08e876d62..35c1f33fbc1a 100644
--- a/drivers/gpu/drm/udl/udl_drv.h
+++ b/drivers/gpu/drm/udl/udl_drv.h
-@@ -50,8 +50,8 @@ struct urb_list {
+@@ -49,8 +49,8 @@ struct urb_list {
struct udl_fbdev;
struct udl_device {
@@ -124,7 +119,7 @@ index b3e08e876d62..35c1f33fbc1a 100644
struct usb_device *udev;
struct drm_crtc *crtc;
-@@ -71,7 +71,7 @@ struct udl_device {
+@@ -68,7 +68,7 @@ struct udl_device {
atomic_t cpu_kcycles_used; /* transpired during pixel processing */
};
@@ -133,7 +128,7 @@ index b3e08e876d62..35c1f33fbc1a 100644
struct udl_gem_object {
struct drm_gem_object base;
-@@ -104,9 +104,8 @@ struct urb *udl_get_urb(struct drm_device *dev);
+@@ -101,9 +101,8 @@ struct urb *udl_get_urb(struct drm_devic
int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len);
void udl_urb_completion(struct urb *urb);
@@ -145,11 +140,9 @@ index b3e08e876d62..35c1f33fbc1a 100644
int udl_fbdev_init(struct drm_device *dev);
void udl_fbdev_cleanup(struct drm_device *dev);
-diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index 16593d4f02b4..b9b67a546d4c 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
-@@ -213,7 +213,7 @@ static int udl_fb_open(struct fb_info *info, int user)
+@@ -213,7 +213,7 @@ static int udl_fb_open(struct fb_info *i
struct udl_device *udl = to_udl(dev);
/* If the USB device is gone, we don't accept new opens */
@@ -158,11 +151,9 @@ index 16593d4f02b4..b9b67a546d4c 100644
return -ENODEV;
ufbdev->fb_count++;
-diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
-index 862c099d7c4c..6743eaef4594 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
-@@ -311,20 +311,12 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
+@@ -311,20 +311,12 @@ int udl_submit_urb(struct drm_device *de
return ret;
}
@@ -185,7 +176,7 @@ index 862c099d7c4c..6743eaef4594 100644
mutex_init(&udl->gem_lock);
-@@ -358,7 +350,6 @@ int udl_driver_load(struct drm_device *dev, unsigned long flags)
+@@ -359,7 +351,6 @@ err_fb:
err:
if (udl->urbs.count)
udl_free_urb_list(dev);
@@ -193,7 +184,7 @@ index 862c099d7c4c..6743eaef4594 100644
DRM_ERROR("%d\n", ret);
return ret;
}
-@@ -369,7 +360,7 @@ int udl_drop_usb(struct drm_device *dev)
+@@ -370,7 +361,7 @@ int udl_drop_usb(struct drm_device *dev)
return 0;
}
@@ -202,7 +193,7 @@ index 862c099d7c4c..6743eaef4594 100644
{
struct udl_device *udl = to_udl(dev);
-@@ -379,12 +370,4 @@ void udl_driver_unload(struct drm_device *dev)
+@@ -380,12 +371,4 @@ void udl_driver_unload(struct drm_device
udl_free_urb_list(dev);
udl_fbdev_cleanup(dev);
@@ -215,6 +206,3 @@ index 862c099d7c4c..6743eaef4594 100644
- drm_dev_fini(dev);
- kfree(dev);
}
---
-2.16.4
-
diff --git a/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch b/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch
index a85481df2f..35754c6465 100644
--- a/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch
+++ b/patches.suse/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch
@@ -1,10 +1,10 @@
From cc0ba0d8624f210995924bb57a8b181ce8976606 Mon Sep 17 00:00:00 2001
From: Thomas Hellstrom <thellstrom@vmware.com>
Date: Wed, 29 May 2019 08:15:19 +0200
-Subject: [PATCH] drm/vmwgfx: Use the backdoor port if the HB port is not available
+Subject: drm/vmwgfx: Use the backdoor port if the HB port is not available
Git-commit: cc0ba0d8624f210995924bb57a8b181ce8976606
Patch-mainline: v5.2-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
The HB port may not be available for various reasons. Either it has been
disabled by a config option or by the hypervisor for other reasons.
@@ -15,17 +15,14 @@ Cc: stable@vger.kernel.org
Fixes: 89da76fde68d ("drm/vmwgfx: Add VMWare host messaging capability")
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Deepak Rawat <drawat@vmware.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 146 +++++++++++++++++++++++++++++-------
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 146 ++++++++++++++++++++++++++++--------
1 file changed, 117 insertions(+), 29 deletions(-)
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
-index 8b9270f31409..e4e09d47c5c0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
-@@ -136,6 +136,114 @@ static int vmw_close_channel(struct rpc_channel *channel)
+@@ -135,6 +135,114 @@ static int vmw_close_channel(struct rpc_
return 0;
}
@@ -140,7 +137,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
/**
-@@ -148,11 +256,10 @@ static int vmw_close_channel(struct rpc_channel *channel)
+@@ -147,11 +255,10 @@ static int vmw_close_channel(struct rpc_
*/
static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
{
@@ -153,7 +150,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
while (retries < RETRIES) {
retries++;
-@@ -166,23 +273,14 @@ static int vmw_send_msg(struct rpc_channel *channel, const char *msg)
+@@ -165,23 +272,14 @@ static int vmw_send_msg(struct rpc_chann
VMW_HYPERVISOR_MAGIC,
eax, ebx, ecx, edx, si, di);
@@ -181,7 +178,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) != 0) {
return 0;
-@@ -211,7 +309,7 @@ STACK_FRAME_NON_STANDARD(vmw_send_msg);
+@@ -210,7 +308,7 @@ STACK_FRAME_NON_STANDARD(vmw_send_msg);
static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
size_t *msg_len)
{
@@ -190,7 +187,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
char *reply;
size_t reply_len;
int retries = 0;
-@@ -233,8 +331,7 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+@@ -232,8 +330,7 @@ static int vmw_recv_msg(struct rpc_chann
VMW_HYPERVISOR_MAGIC,
eax, ebx, ecx, edx, si, di);
@@ -200,7 +197,7 @@ index 8b9270f31409..e4e09d47c5c0 100644
DRM_ERROR("Failed to get reply size for host message.\n");
return -EINVAL;
}
-@@ -252,17 +349,8 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+@@ -251,17 +348,8 @@ static int vmw_recv_msg(struct rpc_chann
/* Receive buffer */
@@ -220,6 +217,3 @@ index 8b9270f31409..e4e09d47c5c0 100644
if ((HIGH_WORD(ebx) & MESSAGE_STATUS_SUCCESS) == 0) {
kfree(reply);
---
-2.16.4
-
diff --git a/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch b/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch
index e73740852c..67b5e597a7 100644
--- a/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch
+++ b/patches.suse/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch
@@ -1,22 +1,22 @@
From 39916897cd815a0ee07ba1f6820cf88a63e459fc Mon Sep 17 00:00:00 2001
From: Qian Cai <cai@lca.pw>
Date: Mon, 3 Jun 2019 16:44:15 -0400
-Subject: [PATCH] drm/vmwgfx: fix a warning due to missing dma_parms
+Subject: drm/vmwgfx: fix a warning due to missing dma_parms
Git-commit: 39916897cd815a0ee07ba1f6820cf88a63e459fc
Patch-mainline: v5.2-rc6
-References: bsc#1111666
+References: bsc#1111666 bsc#1135642
Booting up with DMA_API_DEBUG_SG=y generates a warning due to the driver
forgot to set dma_parms appropriately. Set it just after vmw_dma_masks()
in vmw_driver_load().
-Dma-api: vmwgfx 0000:00:0f.0: mapping sg segment longer than device
+DMA-API: vmwgfx 0000:00:0f.0: mapping sg segment longer than device
claims to support [len=2097152] [max=65536]
-Warning: CPU: 2 PID: 261 at kernel/dma/debug.c:1232
+WARNING: CPU: 2 PID: 261 at kernel/dma/debug.c:1232
debug_dma_map_sg+0x360/0x480
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 04/13/2018
-Rip: 0010:debug_dma_map_sg+0x360/0x480
+RIP: 0010:debug_dma_map_sg+0x360/0x480
Call Trace:
vmw_ttm_map_dma+0x3b1/0x5b0 [vmwgfx]
vmw_bo_map_dma+0x25/0x30 [vmwgfx]
@@ -57,11 +57,9 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 3 +++
1 file changed, 3 insertions(+)
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index 4ff11a0077e1..9506190a0300 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -747,6 +747,9 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+@@ -758,6 +758,9 @@ static int vmw_driver_load(struct drm_de
if (unlikely(ret != 0))
goto out_err0;
@@ -71,6 +69,3 @@ index 4ff11a0077e1..9506190a0300 100644
if (dev_priv->capabilities & SVGA_CAP_GMR2) {
DRM_INFO("Max GMR ids is %u\n",
(unsigned)dev_priv->max_gmr_ids);
---
-2.16.4
-
diff --git a/patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch b/patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
new file mode 100644
index 0000000000..2ecf741c35
--- /dev/null
+++ b/patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
@@ -0,0 +1,49 @@
+From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
+Date: Fri, 30 Aug 2019 16:30:01 -0400
+Subject: ftrace: Check for empty hash and comment the race with registering
+ probes
+Git-commit: 372e0d01da71c84dcecf7028598a33813b0d5256
+Patch-mainline: v5.3-rc7
+References: bsc#1149418
+
+The race between adding a function probe and reading the probes that exist
+is very subtle. It needs a comment. Also, the issue can also happen if the
+probe has has the EMPTY_HASH as its func_hash.
+
+Cc: stable@vger.kernel.org
+Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/ftrace.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 80beed2cf0da..6200a6fe10e3 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3096,7 +3096,11 @@ t_probe_next(struct seq_file *m, loff_t *pos)
+
+ hash = iter->probe->ops.func_hash->filter_hash;
+
+- if (!hash)
++ /*
++ * A probe being registered may temporarily have an empty hash
++ * and it's at the end of the func_probes list.
++ */
++ if (!hash || hash == EMPTY_HASH)
+ return NULL;
+
+ size = 1 << hash->size_bits;
+@@ -4324,6 +4328,10 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
+
+ mutex_unlock(&ftrace_lock);
+
++ /*
++ * Note, there's a small window here that the func_hash->filter_hash
++ * may be NULL or empty. Need to be carefule when reading the loop.
++ */
+ mutex_lock(&probe->ops.func_hash->regex_lock);
+
+ orig_hash = &probe->ops.func_hash->filter_hash;
+
diff --git a/patches.suse/ftrace-check-for-successful-allocation-of-hash.patch b/patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
new file mode 100644
index 0000000000..35572e2cfe
--- /dev/null
+++ b/patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
@@ -0,0 +1,40 @@
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Thu, 4 Jul 2019 20:04:42 +0530
+Subject: ftrace: Check for successful allocation of hash
+Git-commit: 5b0022dd32b7c2e15edf1827ba80aa1407edf9ff
+Patch-mainline: v5.3-rc7
+References: bsc#1149424
+
+In register_ftrace_function_probe(), we are not checking the return
+value of alloc_and_copy_ftrace_hash(). The subsequent call to
+ftrace_match_records() may end up dereferencing the same. Add a check to
+ensure this doesn't happen.
+
+Link: http://lkml.kernel.org/r/26e92574f25ad23e7cafa3cf5f7a819de1832cbe.1562249521.git.naveen.n.rao@linux.vnet.ibm.com
+
+Cc: stable@vger.kernel.org
+Fixes: 1ec3a81a0cf42 ("ftrace: Have each function probe use its own ftrace_ops")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/ftrace.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 6200a6fe10e3..f9821a3374e9 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -4338,6 +4338,11 @@ register_ftrace_function_probe(char *glob, struct trace_array *tr,
+ old_hash = *orig_hash;
+ hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, old_hash);
+
++ if (!hash) {
++ ret = -ENOMEM;
++ goto out;
++ }
++
+ ret = ftrace_match_records(hash, glob, strlen(glob));
+
+ /* Nothing found? */
+
diff --git a/patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch b/patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
new file mode 100644
index 0000000000..4505f4355b
--- /dev/null
+++ b/patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
@@ -0,0 +1,77 @@
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Thu, 4 Jul 2019 20:04:41 +0530
+Subject: ftrace: Fix NULL pointer dereference in t_probe_next()
+Git-commit: 7bd46644ea0f6021dc396a39a8bfd3a58f6f1f9f
+Patch-mainline: v5.3-rc7
+References: bsc#1149413
+
+LTP testsuite on powerpc results in the below crash:
+
+ Unable to handle kernel paging request for data at address 0x00000000
+ Faulting instruction address: 0xc00000000029d800
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE SMP NR_CPUS=2048 NUMA PowerNV
+ ...
+ CPU: 68 PID: 96584 Comm: cat Kdump: loaded Tainted: G W
+ NIP: c00000000029d800 LR: c00000000029dac4 CTR: c0000000001e6ad0
+ REGS: c0002017fae8ba10 TRAP: 0300 Tainted: G W
+ MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 28022422 XER: 20040000
+ CFAR: c00000000029d90c DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0
+ ...
+ NIP [c00000000029d800] t_probe_next+0x60/0x180
+ LR [c00000000029dac4] t_mod_start+0x1a4/0x1f0
+ Call Trace:
+ [c0002017fae8bc90] [c000000000cdbc40] _cond_resched+0x10/0xb0 (unreliable)
+ [c0002017fae8bce0] [c0000000002a15b0] t_start+0xf0/0x1c0
+ [c0002017fae8bd30] [c0000000004ec2b4] seq_read+0x184/0x640
+ [c0002017fae8bdd0] [c0000000004a57bc] sys_read+0x10c/0x300
+ [c0002017fae8be30] [c00000000000b388] system_call+0x5c/0x70
+
+The test (ftrace_set_ftrace_filter.sh) is part of ftrace stress tests
+and the crash happens when the test does 'cat
+$TRACING_PATH/set_ftrace_filter'.
+
+The address points to the second line below, in t_probe_next(), where
+filter_hash is dereferenced:
+ hash = iter->probe->ops.func_hash->filter_hash;
+ size = 1 << hash->size_bits;
+
+This happens due to a race with register_ftrace_function_probe(). A new
+ftrace_func_probe is created and added into the func_probes list in
+trace_array under ftrace_lock. However, before initializing the filter,
+we drop ftrace_lock, and re-acquire it after acquiring regex_lock. If
+another process is trying to read set_ftrace_filter, it will be able to
+acquire ftrace_lock during this window and it will end up seeing a NULL
+filter_hash.
+
+Fix this by just checking for a NULL filter_hash in t_probe_next(). If
+the filter_hash is NULL, then this probe is just being added and we can
+simply return from here.
+
+Link: http://lkml.kernel.org/r/05e021f757625cbbb006fad41380323dbe4e3b43.1562249521.git.naveen.n.rao@linux.vnet.ibm.com
+
+Cc: stable@vger.kernel.org
+Fixes: 7b60f3d876156 ("ftrace: Dynamically create the probe ftrace_ops for the trace_array")
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/ftrace.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index eca34503f178..80beed2cf0da 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3095,6 +3095,10 @@ t_probe_next(struct seq_file *m, loff_t *pos)
+ hnd = &iter->probe_entry->hlist;
+
+ hash = iter->probe->ops.func_hash->filter_hash;
++
++ if (!hash)
++ return NULL;
++
+ size = 1 << hash->size_bits;
+
+ retry:
+
diff --git a/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch b/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch
index 0df45b8fe5..d414720ca1 100644
--- a/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch
+++ b/patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch
@@ -3,7 +3,7 @@ Date: Thu, 21 Mar 2019 15:02:50 +0800
Subject: genetlink: Fix a memory leak on error path
Git-commit: ceabee6c59943bdd5e1da1a6a20dc7ee5f8113a2
Patch-mainline: v5.1-rc3
-References: networking-stable-19_03_28
+References: networking-stable-19_03_28, CVE-2019-15921, bsc#1149602
In genl_register_family(), when idr_alloc() fails,
we forget to free the memory we possibly allocate for
diff --git a/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch b/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
index ed98088b98..b7f545ed52 100644
--- a/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
+++ b/patches.suse/gpu-ipu-v3-ipu-ic-Fix-saturation-bit-offset-in-TPMEM.patch
@@ -1,10 +1,10 @@
From 3d1f62c686acdedf5ed9642b763f3808d6a47d1e Mon Sep 17 00:00:00 2001
From: Steve Longerbeam <slongerbeam@gmail.com>
Date: Tue, 21 May 2019 18:03:13 -0700
-Subject: [PATCH] gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
+Subject: gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
Git-commit: 3d1f62c686acdedf5ed9642b763f3808d6a47d1e
Patch-mainline: v5.3-rc1
-References: bsc#1111666
+References: bsc#1111666 bsc#1142635
The saturation bit was being set at bit 9 in the second 32-bit word
of the TPMEM CSC. This isn't correct, the saturation bit is bit 42,
@@ -16,8 +16,7 @@ Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
---
drivers/gpu/ipu-v3/ipu-ic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -36,5 +35,5 @@ index 89c3961f0fce..3428b0e72bc5 100644
param = ((a[1] & 0x1f) << 27) | ((c[0][1] & 0x1ff) << 18) |
--
-2.16.4
+2.22.0
diff --git a/patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs b/patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs
new file mode 100644
index 0000000000..3a7dba426d
--- /dev/null
+++ b/patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs
@@ -0,0 +1,37 @@
+From: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Date: Fri, 8 Mar 2019 15:57:20 +0800
+Subject: kvm/x86: Move MSR_IA32_ARCH_CAPABILITIES to array emulated_msrs
+Git-commit: 2bdb76c015df7125783d8394d6339d181cb5bc30
+Patch-mainline: v5.1-rc3
+References: bsc#1134881 bsc#1134882
+
+Since MSR_IA32_ARCH_CAPABILITIES is emualted unconditionally even if
+host doesn't suppot it. We should move it to array emulated_msrs from
+arry msrs_to_save, to report to userspace that guest support this msr.
+
+Signed-off-by: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1010,7 +1010,7 @@ static u32 msrs_to_save[] = {
+ #endif
+ MSR_IA32_TSC, MSR_IA32_CR_PAT, MSR_VM_HSAVE_PA,
+ MSR_IA32_FEATURE_CONTROL, MSR_IA32_BNDCFGS, MSR_TSC_AUX,
+- MSR_IA32_SPEC_CTRL, MSR_IA32_ARCH_CAPABILITIES
++ MSR_IA32_SPEC_CTRL,
+ };
+
+ static unsigned num_msrs_to_save;
+@@ -1033,6 +1033,7 @@ static u32 emulated_msrs[] = {
+
+ MSR_IA32_TSC_ADJUST,
+ MSR_IA32_TSCDEADLINE,
++ MSR_IA32_ARCH_CAPABILITIES,
+ MSR_IA32_MISC_ENABLE,
+ MSR_IA32_MCG_STATUS,
+ MSR_IA32_MCG_CTL,
diff --git a/patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch b/patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch
new file mode 100644
index 0000000000..36df0b9c09
--- /dev/null
+++ b/patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch
@@ -0,0 +1,68 @@
+From d34ad20a798191a6217cf245b85a26b07c0edd01 Mon Sep 17 00:00:00 2001
+From: Michal Suchanek <msuchanek@suse.de>
+Date: Tue, 20 Aug 2019 13:29:45 +0200
+Subject: [PATCH v2] powerpc/fadump: when fadump is supported register the
+ fadump sysfs files.
+To: linuxppc-dev@lists.ozlabs.org
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>, Paul Mackerras <paulus@samba.org>, Michael Ellerman <mpe@ellerman.id.au>, Michal Suchanek <msuchanek@suse.de>, Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>, Hari Bathini <hbathini@linux.vnet.ibm.com>, Christophe Leroy <christophe.leroy@c-s.fr>, Yangtao Li <tiny.windzz@gmail.com>, Thomas Gleixner <tglx@linutronix.de>, linux-kernel@vger.kernel.org
+
+References: bsc#1146352
+Patch-mainline: submitted https://patchwork.ozlabs.org/patch/1154687/
+
+Currently it is not possible to distinguish the case when fadump is
+supported by firmware and disabled in kernel and completely unsupported
+using the kernel sysfs interface. User can investigate the devicetree
+but it is more reasonable to provide sysfs files in case we get some
+fadumpv2 in the future.
+
+With this patch sysfs files are available whenever fadump is supported
+by firmware.
+
+Signed-off-by: Michal Suchanek <msuchanek@suse.de>
+---
+v2: move the sysfs initialization earlier to avoid condition nesting
+---
+ arch/powerpc/kernel/fadump.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
+index 4eab97292cc2..13741380b2f7 100644
+--- a/arch/powerpc/kernel/fadump.c
++++ b/arch/powerpc/kernel/fadump.c
+@@ -1671,16 +1671,20 @@ static void fadump_init_files(void)
+ */
+ int __init setup_fadump(void)
+ {
+- if (!fw_dump.fadump_enabled)
+- return 0;
+-
+- if (!fw_dump.fadump_supported) {
++ if (!fw_dump.fadump_supported && fw_dump.fadump_enabled) {
+ printk(KERN_ERR "Firmware-assisted dump is not supported on"
+ " this hardware\n");
+- return 0;
+ }
+
++ if (!fw_dump.fadump_supported)
++ return 0;
++
++ fadump_init_files();
+ fadump_show_config();
++
++ if (!fw_dump.fadump_enabled)
++ return 1;
++
+ /*
+ * If dump data is available then see if it is valid and prepare for
+ * saving it to the disk.
+@@ -1696,7 +1700,6 @@ int __init setup_fadump(void)
+ /* Initialize the kernel dump memory structure for FAD registration. */
+ else if (fw_dump.reserve_dump_area_size)
+ init_fadump_mem_struct(&fdm, fw_dump.reserve_dump_area_start);
+- fadump_init_files();
+
+ return 1;
+ }
+--
+2.22.0
+
diff --git a/patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch b/patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch
new file mode 100644
index 0000000000..391d8a5049
--- /dev/null
+++ b/patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch
@@ -0,0 +1,215 @@
+From b4868ff55d082bc66b0c287a41e4888f6d3e5f87 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Wed, 14 Aug 2019 17:47:53 +0200
+Subject: [PATCH] powerpc/xive: Fix dump of XIVE interrupt under pseries
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1142019
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: b4868ff55d082bc66b0c287a41e4888f6d3e5f87
+
+The xmon 'dxi' command calls OPAL to query the XIVE configuration of a
+interrupt. This can only be done on baremetal (PowerNV) and it will
+crash a pseries machine.
+
+Introduce a new XIVE get_irq_config() operation which implements a
+different query depending on the platform, PowerNV or pseries, and
+modify xmon to use a top level wrapper.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-3-clg@kaod.org
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/xive.h | 2 +
+ arch/powerpc/sysdev/xive/common.c | 7 ++++
+ arch/powerpc/sysdev/xive/native.c | 15 +++++++
+ arch/powerpc/sysdev/xive/spapr.c | 51 ++++++++++++++++++++++++
+ arch/powerpc/sysdev/xive/xive-internal.h | 2 +
+ arch/powerpc/xmon/xmon.c | 12 +++---
+ 6 files changed, 83 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/xive.h b/arch/powerpc/include/asm/xive.h
+index efb0e597b272..967d6ab3c977 100644
+--- a/arch/powerpc/include/asm/xive.h
++++ b/arch/powerpc/include/asm/xive.h
+@@ -99,6 +99,8 @@ extern void xive_flush_interrupt(void);
+
+ /* xmon hook */
+ extern void xmon_xive_do_dump(int cpu);
++extern int xmon_xive_get_irq_config(u32 irq, u32 *target, u8 *prio,
++ u32 *sw_irq);
+
+ /* APIs used by KVM */
+ extern u32 xive_native_default_eq_shift(void);
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 6b973b7cdd8a..f75a660365e5 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -257,6 +257,13 @@ notrace void xmon_xive_do_dump(int cpu)
+ }
+ #endif
+ }
++
++int xmon_xive_get_irq_config(u32 irq, u32 *target, u8 *prio,
++ u32 *sw_irq)
++{
++ return xive_ops->get_irq_config(irq, target, prio, sw_irq);
++}
++
+ #endif /* CONFIG_XMON */
+
+ static unsigned int xive_get_irq(void)
+diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c
+index 2f26b74f6cfa..4b61e44f0171 100644
+--- a/arch/powerpc/sysdev/xive/native.c
++++ b/arch/powerpc/sysdev/xive/native.c
+@@ -111,6 +111,20 @@ int xive_native_configure_irq(u32 hw_irq, u32 target, u8 prio, u32 sw_irq)
+ }
+ EXPORT_SYMBOL_GPL(xive_native_configure_irq);
+
++static int xive_native_get_irq_config(u32 hw_irq, u32 *target, u8 *prio,
++ u32 *sw_irq)
++{
++ s64 rc;
++ __be64 vp;
++ __be32 lirq;
++
++ rc = opal_xive_get_irq_config(hw_irq, &vp, prio, &lirq);
++
++ *target = be64_to_cpu(vp);
++ *sw_irq = be32_to_cpu(lirq);
++
++ return rc == 0 ? 0 : -ENXIO;
++}
+
+ /* This can be called multiple time to change a queue configuration */
+ int xive_native_configure_queue(u32 vp_id, struct xive_q *q, u8 prio,
+@@ -442,6 +456,7 @@ EXPORT_SYMBOL_GPL(xive_native_sync_queue);
+ static const struct xive_ops xive_native_ops = {
+ .populate_irq_data = xive_native_populate_irq_data,
+ .configure_irq = xive_native_configure_irq,
++ .get_irq_config = xive_native_get_irq_config,
+ .setup_queue = xive_native_setup_queue,
+ .cleanup_queue = xive_native_cleanup_queue,
+ .match = xive_native_match,
+diff --git a/arch/powerpc/sysdev/xive/spapr.c b/arch/powerpc/sysdev/xive/spapr.c
+index 52198131c75e..33c10749edec 100644
+--- a/arch/powerpc/sysdev/xive/spapr.c
++++ b/arch/powerpc/sysdev/xive/spapr.c
+@@ -215,6 +215,38 @@ static long plpar_int_set_source_config(unsigned long flags,
+ return 0;
+ }
+
++static long plpar_int_get_source_config(unsigned long flags,
++ unsigned long lisn,
++ unsigned long *target,
++ unsigned long *prio,
++ unsigned long *sw_irq)
++{
++ unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
++ long rc;
++
++ pr_devel("H_INT_GET_SOURCE_CONFIG flags=%lx lisn=%lx\n", flags, lisn);
++
++ do {
++ rc = plpar_hcall(H_INT_GET_SOURCE_CONFIG, retbuf, flags, lisn,
++ target, prio, sw_irq);
++ } while (plpar_busy_delay(rc));
++
++ if (rc) {
++ pr_err("H_INT_GET_SOURCE_CONFIG lisn=%ld failed %ld\n",
++ lisn, rc);
++ return rc;
++ }
++
++ *target = retbuf[0];
++ *prio = retbuf[1];
++ *sw_irq = retbuf[2];
++
++ pr_devel("H_INT_GET_SOURCE_CONFIG target=%lx prio=%lx sw_irq=%lx\n",
++ retbuf[0], retbuf[1], retbuf[2]);
++
++ return 0;
++}
++
+ static long plpar_int_get_queue_info(unsigned long flags,
+ unsigned long target,
+ unsigned long priority,
+@@ -398,6 +430,24 @@ static int xive_spapr_configure_irq(u32 hw_irq, u32 target, u8 prio, u32 sw_irq)
+ return rc == 0 ? 0 : -ENXIO;
+ }
+
++static int xive_spapr_get_irq_config(u32 hw_irq, u32 *target, u8 *prio,
++ u32 *sw_irq)
++{
++ long rc;
++ unsigned long h_target;
++ unsigned long h_prio;
++ unsigned long h_sw_irq;
++
++ rc = plpar_int_get_source_config(0, hw_irq, &h_target, &h_prio,
++ &h_sw_irq);
++
++ *target = h_target;
++ *prio = h_prio;
++ *sw_irq = h_sw_irq;
++
++ return rc == 0 ? 0 : -ENXIO;
++}
++
+ /* This can be called multiple time to change a queue configuration */
+ static int xive_spapr_configure_queue(u32 target, struct xive_q *q, u8 prio,
+ __be32 *qpage, u32 order)
+@@ -590,6 +640,7 @@ static void xive_spapr_sync_source(u32 hw_irq)
+ static const struct xive_ops xive_spapr_ops = {
+ .populate_irq_data = xive_spapr_populate_irq_data,
+ .configure_irq = xive_spapr_configure_irq,
++ .get_irq_config = xive_spapr_get_irq_config,
+ .setup_queue = xive_spapr_setup_queue,
+ .cleanup_queue = xive_spapr_cleanup_queue,
+ .match = xive_spapr_match,
+diff --git a/arch/powerpc/sysdev/xive/xive-internal.h b/arch/powerpc/sysdev/xive/xive-internal.h
+index 211725dbf364..59cd366e7933 100644
+--- a/arch/powerpc/sysdev/xive/xive-internal.h
++++ b/arch/powerpc/sysdev/xive/xive-internal.h
+@@ -33,6 +33,8 @@ struct xive_cpu {
+ struct xive_ops {
+ int (*populate_irq_data)(u32 hw_irq, struct xive_irq_data *data);
+ int (*configure_irq)(u32 hw_irq, u32 target, u8 prio, u32 sw_irq);
++ int (*get_irq_config)(u32 hw_irq, u32 *target, u8 *prio,
++ u32 *sw_irq);
+ int (*setup_queue)(unsigned int cpu, struct xive_cpu *xc, u8 prio);
+ void (*cleanup_queue)(unsigned int cpu, struct xive_cpu *xc, u8 prio);
+ void (*setup_cpu)(unsigned int cpu, struct xive_cpu *xc);
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 25d4adccf750..4ea53e05053f 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2574,14 +2574,14 @@ static void dump_all_xives(void)
+
+ static void dump_one_xive_irq(u32 num)
+ {
+- s64 rc;
+- __be64 vp;
++ int rc;
++ u32 target;
+ u8 prio;
+- __be32 lirq;
++ u32 lirq;
+
+- rc = opal_xive_get_irq_config(num, &vp, &prio, &lirq);
+- xmon_printf("IRQ 0x%x config: vp=0x%llx prio=%d lirq=0x%x (rc=%lld)\n",
+- num, be64_to_cpu(vp), prio, be32_to_cpu(lirq), rc);
++ rc = xmon_xive_get_irq_config(num, &target, &prio, &lirq);
++ xmon_printf("IRQ 0x%08x : target=0x%x prio=%d lirq=0x%x (rc=%d)\n",
++ num, target, prio, lirq, rc);
+ }
+
+ static void dump_xives(void)
+--
+2.22.0
+
diff --git a/patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch b/patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch
new file mode 100644
index 0000000000..de520390d9
--- /dev/null
+++ b/patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch
@@ -0,0 +1,66 @@
+From 39f14e79b15a40709ef177bc4c07f193b6d3bce3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Wed, 14 Aug 2019 17:47:54 +0200
+Subject: [PATCH] powerpc/xmon: Add a dump of all XIVE interrupts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1142019
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: 39f14e79b15a40709ef177bc4c07f193b6d3bce3
+
+Modify the xmon 'dxi' command to query all interrupts if no IRQ number
+is specified.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-4-clg@kaod.org
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/xmon/xmon.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 4ea53e05053f..dc9832e06256 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2584,6 +2584,25 @@ static void dump_one_xive_irq(u32 num)
+ num, target, prio, lirq, rc);
+ }
+
++static void dump_all_xive_irq(void)
++{
++ unsigned int i;
++ struct irq_desc *desc;
++
++ for_each_irq_desc(i, desc) {
++ struct irq_data *d = irq_desc_get_irq_data(desc);
++ unsigned int hwirq;
++
++ if (!d)
++ continue;
++
++ hwirq = (unsigned int)irqd_to_hwirq(d);
++ /* IPIs are special (HW number 0) */
++ if (hwirq)
++ dump_one_xive_irq(hwirq);
++ }
++}
++
+ static void dump_xives(void)
+ {
+ unsigned long num;
+@@ -2601,6 +2620,8 @@ static void dump_xives(void)
+ } else if (c == 'i') {
+ if (scanhex(&num))
+ dump_one_xive_irq(num);
++ else
++ dump_all_xive_irq();
+ return;
+ }
+
+--
+2.22.0
+
diff --git a/patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch b/patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch
new file mode 100644
index 0000000000..bcea95d6fe
--- /dev/null
+++ b/patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch
@@ -0,0 +1,59 @@
+From c3e0dbd7f780a58c4695f1cd8fc8afde80376737 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Wed, 14 Aug 2019 17:47:52 +0200
+Subject: [PATCH] powerpc/xmon: Check for HV mode when dumping XIVE info from
+ OPAL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1142019
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: c3e0dbd7f780a58c4695f1cd8fc8afde80376737
+
+Currently, the xmon 'dx' command calls OPAL to dump the XIVE state in
+the OPAL logs and also outputs some of the fields of the internal XIVE
+structures in Linux. The OPAL calls can only be done on baremetal
+(PowerNV) and they crash a pseries machine. Fix by checking the
+hypervisor feature of the CPU.
+
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190814154754.23682-2-clg@kaod.org
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/xmon/xmon.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index 14e56c25879f..25d4adccf750 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -2534,13 +2534,16 @@ static void dump_pacas(void)
+ static void dump_one_xive(int cpu)
+ {
+ unsigned int hwid = get_hard_smp_processor_id(cpu);
+-
+- opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
+- opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
+- opal_xive_dump(XIVE_DUMP_VP, hwid);
+- opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ bool hv = cpu_has_feature(CPU_FTR_HVMODE);
++
++ if (hv) {
++ opal_xive_dump(XIVE_DUMP_TM_HYP, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_POOL, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_OS, hwid);
++ opal_xive_dump(XIVE_DUMP_TM_USER, hwid);
++ opal_xive_dump(XIVE_DUMP_VP, hwid);
++ opal_xive_dump(XIVE_DUMP_EMU_STATE, hwid);
++ }
+
+ if (setjmp(bus_error_jmp) != 0) {
+ catch_memory_errors = 0;
+--
+2.22.0
+
diff --git a/patches.suse/rsi-add-fix-for-crash-during-assertions.patch b/patches.suse/rsi-add-fix-for-crash-during-assertions.patch
new file mode 100644
index 0000000000..677a81e06e
--- /dev/null
+++ b/patches.suse/rsi-add-fix-for-crash-during-assertions.patch
@@ -0,0 +1,38 @@
+From abd39c6ded9db53aa44c2540092bdd5fb6590fa8 Mon Sep 17 00:00:00 2001
+From: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
+Date: Tue, 15 May 2018 14:34:30 +0530
+Subject: [PATCH] rsi: add fix for crash during assertions
+Git-commit: abd39c6ded9db53aa44c2540092bdd5fb6590fa8
+Patch-mainline: v4.18-rc1
+References: CVE-2018-21008,bsc#1149591
+
+Observed crash in some scenarios when assertion has occurred,
+this is because hw structure is freed and is tried to get
+accessed in some functions where null check is already
+present. So, avoided the crash by making the hw to NULL after
+freeing.
+
+Signed-off-by: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
+Signed-off-by: Sushant Kumar Mishra <sushant.mishra@redpinesignals.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+index 3faa0449a5ef..bfa7569c85bb 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+@@ -245,6 +245,7 @@ void rsi_mac80211_detach(struct rsi_hw *adapter)
+ ieee80211_stop_queues(hw);
+ ieee80211_unregister_hw(hw);
+ ieee80211_free_hw(hw);
++ adapter->hw = NULL;
+ }
+
+ for (band = 0; band < NUM_NL80211_BANDS; band++) {
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index 3918fa9d35..08ca09b8a8 100644
--- a/series.conf
+++ b/series.conf
@@ -10254,6 +10254,13 @@
patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch
patches.suse/btrfs-incremental-send-fix-emission-of-invalid-clone-operations.patch
patches.suse/btrfs-preserve-i_mode-if-_btrfs_set_acl-fails.patch
+ patches.suse/btrfs-add-a-helper-to-retrive-extent-inline-ref-type.patch
+ patches.suse/btrfs-convert-to-use-btrfs_get_extent_inline_ref_type.patch
+ patches.suse/btrfs-remove-bug-in-btrfs_extent_inline_ref_size.patch
+ patches.suse/btrfs-remove-bug-in-print_extent_item.patch
+ patches.suse/btrfs-remove-bug-in-add_data_reference.patch
+ patches.suse/btrfs-remove-bug_on-in-_add_tree_block.patch
+ patches.suse/btrfs-add-one-more-sanity-check-for-shared-ref-type.patch
patches.suse/sunrpc-Const-ify-instances-of-struct-svc_xprt_ops.patch
patches.suse/svcrdma-Clean-up-svc_rdma_build_read_chunk.patch
patches.suse/svcrdma-Populate-tail-iovec-when-receiving.patch
@@ -33293,6 +33300,7 @@
patches.suse/wil6210-rate-limit-wil_rx_refill-error.patch
patches.suse/mwifiex-correct-histogram-data-with-appropriate-inde
patches.suse/brcmfmac-add-debugfs-entry-for-reading-firmware-capa.patch
+ patches.suse/rsi-add-fix-for-crash-during-assertions.patch
patches.suse/brcmfmac-move-ALLFFMAC-variable-in-flowring-module.patch
patches.suse/rtlwifi-support-accurate-nullfunc-frame-tx-ack-repor.patch
patches.suse/rtlwifi-remove-CONNECTION_MONITOR-flag.patch
@@ -37152,6 +37160,8 @@
patches.suse/msft-hv-1749-hv-netvsc-Fix-NULL-dereference-at-single-queue-mode-.patch
patches.suse/crypto-vmac-require-a-block-cipher-with-128-bit-bloc
patches.suse/crypto-vmac-separate-tfm-and-request-context
+ patches.suse/crypto-virtio-read-crypto-services-and-algorithm-masks
+ patches.suse/crypto-virtio-register-an-algo-only-if-it-s-supported
patches.suse/crypto-skcipher-Fix-Wstringop-truncation-warnings.patch
patches.suse/crypto-x86-sha256-mb-fix-digest-copy-in-sha256_mb_mg
patches.suse/crypto-ccp-Fix-command-completion-detection-race
@@ -47073,6 +47083,7 @@
patches.suse/KVM-Reject-device-ioctls-from-processes-other-than-t.patch
patches.suse/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation
patches.suse/kvm-x86-emulate-msr_ia32_arch_capabilities-on-amd-hosts.patch
+ patches.suse/kvm-x86-move-msr_ia32_arch_capabilities-to-array-emulated_msrs
patches.suse/msft-hv-1857-x86-kvm-hyper-v-avoid-spurious-pending-stimer-on-vCP.patch
patches.suse/KVM-arm-arm64-vgic-its-Take-the-srcu-lock-when-writi.patch
patches.suse/KVM-arm-arm64-vgic-its-Take-the-srcu-lock-when-parsi.patch
@@ -49748,6 +49759,9 @@
patches.suse/mmc-sdhci-of-at91-add-quirk-for-broken-HS200.patch
patches.suse/crypto-ccp-Ignore-unconfigured-CCP-device-on-suspend.patch
patches.suse/kvm-x86-don-t-update-rip-or-do-single-step-on-faulting-emulation
+ patches.suse/ftrace-fix-null-pointer-dereference-in-t_probe_next.patch
+ patches.suse/ftrace-check-for-empty-hash-and-comment-the-race-with-registering-probes.patch
+ patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
patches.suse/mac80211-Don-t-memset-RXCB-prior-to-PAE-intercept.patch
patches.suse/mac80211-Correctly-set-noencrypt-for-PAE-frames.patch
patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch
@@ -49802,6 +49816,9 @@
patches.suse/scsi-lpfc-Update-lpfc-version-to-12.4.0.0.patch
# powerpc/linux next
+ patches.suse/powerpc-xmon-Check-for-HV-mode-when-dumping-XIVE-inf.patch
+ patches.suse/powerpc-xive-Fix-dump-of-XIVE-interrupt-under-pserie.patch
+ patches.suse/powerpc-xmon-Add-a-dump-of-all-XIVE-interrupts.patch
patches.suse/powerpc-rtas-use-device-model-APIs-and-serialization.patch
patches.suse/powerpc-64s-support-nospectre_v2-cmdline-option.patch
@@ -49854,6 +49871,7 @@
patches.suse/0001-x86-speculation-Prepare-entry-code-for-Spectre-v1-sw.patch
patches.suse/0002-x86-speculation-Enable-Spectre-v1-swapgs-mitigations.patch
patches.suse/x86-speculation-swapgs-exclude-ATOMs-from-speculating-through-SWAPGS.patch
+ patches.suse/powerpc-fadump-when-fadump-is-supported-register-the.patch
########################################################
# end of sorted patches