Home Home > GIT Browse > SLE15-SP1-AZURE
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-10-19 07:11:20 +0200
committerKernel Build Daemon <kbuild@suse.de>2019-10-19 07:11:20 +0200
commit08f611f9f22529dd5258987e1552ee6742df380a (patch)
treef723164b3915509675bfe1145b9ead56e76fcfba
parentc1416201bfcefc9212b35e69b3b5cee2ea6e3a3b (diff)
parent80200902b44db625b5d74256dcafe9dc1c16939e (diff)
Merge branch 'SLE15-SP1' into SLE15-SP1-AZURESLE15-SP1-AZURE
-rw-r--r--.gitattributes2
-rw-r--r--.gitignore1
-rw-r--r--blacklist.conf4
-rw-r--r--extra-gitconfig9
-rw-r--r--kabi/severities2
-rw-r--r--patches.kabi/Fix-KVM-kABI-after-x86-mmu-backports.patch65
-rw-r--r--patches.kabi/net-sched-act_sample-fix-psample-group-handling-on-o.patch29
-rw-r--r--patches.suse/0001-IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch (renamed from patches.suse/IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch)19
-rw-r--r--patches.suse/0001-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch (renamed from patches.suse/0077-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch)12
-rw-r--r--patches.suse/0001-USB-adutux-fix-NULL-derefs-on-disconnect.patch108
-rw-r--r--patches.suse/0001-USB-adutux-fix-use-after-free-on-disconnect.patch52
-rw-r--r--patches.suse/0001-USB-legousbtower-fix-deadlock-on-disconnect.patch129
-rw-r--r--patches.suse/0001-USB-legousbtower-fix-open-after-failed-reset-request.patch55
-rw-r--r--patches.suse/0001-USB-legousbtower-fix-potential-NULL-deref-on-disconn.patch139
-rw-r--r--patches.suse/0001-USB-legousbtower-fix-slab-info-leak-at-probe.patch42
-rw-r--r--patches.suse/0001-USB-microtek-fix-info-leak-at-probe.patch42
-rw-r--r--patches.suse/0001-USB-usblcd-fix-I-O-after-disconnect.patch132
-rw-r--r--patches.suse/0001-crypto-talitos-fix-missing-break-in-switch-statement.patch37
-rw-r--r--patches.suse/0001-kernel-sysctl.c-do-not-override-max_threads-provided.patch87
-rw-r--r--patches.suse/0001-media-atmel-atmel-isc-fix-asd-memory-allocation.patch42
-rw-r--r--patches.suse/0001-rtlwifi-rtl8192cu-Fix-value-set-in-descriptor.patch35
-rw-r--r--patches.suse/0001-xen-pv-Fix-a-boot-up-hang-revealed-by-int3-self-test.patch116
-rw-r--r--patches.suse/Btrfs-check-for-the-full-sync-flag-while-holding-the.patch86
-rw-r--r--patches.suse/IB-mlx5-Consolidate-use_umr-checks-into-single-funct.patch53
-rw-r--r--patches.suse/IB-mlx5-Fix-MR-re-registration-flow-to-use-UMR-prope.patch35
-rw-r--r--patches.suse/IB-mlx5-Report-correctly-tag-matching-rendezvous-cap.patch65
-rw-r--r--patches.suse/KVM-PPC-Book3S-HV-use-smp_mb-when-setting-clearing-h.patch465
-rw-r--r--patches.suse/RDMA-Fix-goto-target-to-release-the-allocated-memory.patch31
-rw-r--r--patches.suse/RDMA-bnxt_re-Fix-spelling-mistake-missin_resp-missin.patch30
-rw-r--r--patches.suse/blk-wbt-abstract-out-end-IO-completion-handler.patch57
-rw-r--r--patches.suse/blk-wbt-fix-has-sleeper-queueing-check.patch51
-rw-r--r--patches.suse/blk-wbt-improve-waking-of-tasks.patch140
-rw-r--r--patches.suse/blk-wbt-move-disable-check-into-get_limit.patch64
-rw-r--r--patches.suse/blk-wbt-use-wq_has_sleeper-for-wq-active-check.patch51
-rw-r--r--patches.suse/block-add-io-timeout-to-sysfs.patch73
-rw-r--r--patches.suse/block-don-t-show-io_timeout-if-driver-has-no-timeout.patch85
-rw-r--r--patches.suse/bnx2x-Fix-VF-s-VLAN-reconfiguration-in-reload.patch96
-rw-r--r--patches.suse/bridge-mdb-remove-wrong-use-of-NLM_F_MULTI.patch33
-rw-r--r--patches.suse/btrfs-bail-out-gracefully-rather-than-bug_on.patch51
-rw-r--r--patches.suse/cdc_ether-fix-rndis-support-for-Mediatek-based-smart.patch104
-rw-r--r--patches.suse/ceph-fix-directories-inode-i_blkbits-initialization.patch46
-rw-r--r--patches.suse/ceph-reconnect-connection-if-session-hang-in-opening-state.patch43
-rw-r--r--patches.suse/ceph-update-the-mtime-when-truncating-up.patch88
-rw-r--r--patches.suse/cfg80211-wext-avoid-copying-malformed-SSIDs.patch54
-rw-r--r--patches.suse/cxgb4-Signedness-bug-in-init_one.patch29
-rw-r--r--patches.suse/cxgb4-fix-endianness-for-vlan-value-in-cxgb4_tc_flow.patch4
-rw-r--r--patches.suse/cxgb4-offload-VLAN-flows-regardless-of-VLAN-ethtype.patch6
-rw-r--r--patches.suse/cxgb4-reduce-kernel-stack-usage-in-cudbg_collect_mem.patch67
-rw-r--r--patches.suse/cxgb4-smt-Add-lock-for-atomic_dec_and_test.patch45
-rw-r--r--patches.suse/dev-mem-Bail-out-upon-SIGKILL.patch109
-rw-r--r--patches.suse/drm-amdgpu-si-fix-asic-tests.patch51
-rw-r--r--patches.suse/firmware-dmi-fix-unlikely-out-of-bounds-read.patch33
-rw-r--r--patches.suse/hwrng-core-don-t-wait-on-add_early_randomness.patch52
-rw-r--r--patches.suse/ipoib-Do-not-overreact-to-SM-LID-change-even.patch147
-rw-r--r--patches.suse/ipv6-Fix-the-link-time-qualifier-of-ping_v6_proc_exi.patch29
-rw-r--r--patches.suse/ixgbe-Fix-secpath-usage-for-IPsec-TX-offload.patch43
-rw-r--r--patches.suse/ixgbe-Prevent-u8-wrapping-of-ITR-value-to-something-.patch45
-rw-r--r--patches.suse/kvm-convert-kvm_lock-to-a-mutex242
-rw-r--r--patches.suse/kvm-mmu-drop-vcpu-param-in-gpte_access59
-rw-r--r--patches.suse/kvm-x86-add-tracepoints-around-_direct_map-and-fnamefetch142
-rw-r--r--patches.suse/kvm-x86-adjust-kvm_mmu_page-member-to-save-8-bytes56
-rw-r--r--patches.suse/kvm-x86-change-kvm_mmu_page_get_gfn-bug_on-to-warn_on40
-rw-r--r--patches.suse/kvm-x86-do-not-release-the-page-inside-mmu_set_spte134
-rw-r--r--patches.suse/kvm-x86-make-fnamefetch-and-_direct_map-more-similar169
-rw-r--r--patches.suse/kvm-x86-powerpc-do-not-allow-clearing-largepages-debugfs-entry97
-rw-r--r--patches.suse/kvm-x86-remove-now-unneeded-hugepage-gfn-adjustment71
-rw-r--r--patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch3
-rw-r--r--patches.suse/mld-fix-memory-leak-in-mld_del_delrec.patch69
-rw-r--r--patches.suse/msft-hv-1947-PCI-hv-Use-bytes-4-and-5-from-instance-ID-as-the-PCI.patch37
-rw-r--r--patches.suse/msft-hv-1948-scsi-storvsc-setup-1-1-mapping-between-hardware-queu.patch37
-rw-r--r--patches.suse/net-Fix-null-de-reference-of-device-refcount.patch52
-rw-r--r--patches.suse/net-fix-skb-use-after-free-in-netpoll.patch88
-rw-r--r--patches.suse/net-gso-Fix-skb_segment-splat-when-splitting-gso_siz.patch104
-rw-r--r--patches.suse/net-ibmvnic-Fix-EOI-when-running-in-XIVE-mode.patch53
-rw-r--r--patches.suse/net-mlx4_en-fix-a-memory-leak-bug.patch43
-rw-r--r--patches.suse/net-mlx5-Add-device-ID-of-upcoming-BlueField-2.patch29
-rw-r--r--patches.suse/net-mlx5-Fix-error-handling-in-mlx5_load.patch30
-rw-r--r--patches.suse/net-sched-act_sample-fix-psample-group-handling-on-o.patch79
-rw-r--r--patches.suse/net-stmmac-dwmac-rk-Don-t-fail-if-phy-regulator-is-a.patch38
-rw-r--r--patches.suse/nfc-enforce-cap_net_raw-for-raw-sockets.patch39
-rw-r--r--patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch3
-rw-r--r--patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch3
-rw-r--r--patches.suse/objtool-clobber-user-cflags-variable.patch36
-rw-r--r--patches.suse/powerpc-64s-Rename-PPC_INVALIDATE_ERAT-to-PPC_ISA_3_.patch99
-rw-r--r--patches.suse/powerpc-64s-pseries-radix-flush-translations-before-.patch76
-rw-r--r--patches.suse/powerpc-64s-radix-keep-kernel-ERAT-over-local-proces.patch61
-rw-r--r--patches.suse/powerpc-64s-radix-tidy-up-TLB-flushing-code.patch239
-rw-r--r--patches.suse/powerpc-mm-Fixup-tlbie-vs-mtpidr-mtlpidr-ordering-is.patch10
-rw-r--r--patches.suse/powerpc-mm-Properly-invalidate-when-setting-process-.patch55
-rw-r--r--patches.suse/powerpc-mm-book3s64-Move-book3s64-code-to-pgtable-bo.patch173
-rw-r--r--patches.suse/powerpc-mm-mark-more-tlb-functions-as-__always_inlin.patch157
-rw-r--r--patches.suse/powerpc-mm-radix-mark-__radix__flush_tlb_range_psize.patch66
-rw-r--r--patches.suse/powerpc-mm-radix-mark-as-__tlbie_pid-and-friends-as_.patch101
-rw-r--r--patches.suse/powerpc-pseries-Remove-confusing-warning-message.patch50
-rw-r--r--patches.suse/powerpc-pseries-mobility-use-cond_resched-when-updat.patch70
-rw-r--r--patches.suse/powerpc-rtas-allow-rescheduling-while-changing-cpu-s.patch44
-rw-r--r--patches.suse/qed-iWARP-Fix-default-window-size-to-be-based-on-chi.patch96
-rw-r--r--patches.suse/qed-iWARP-Fix-tc-for-MPA-ll2-connection.patch31
-rw-r--r--patches.suse/qed-iWARP-Use-READ_ONCE-and-smp_store_release-to-acc.patch73
-rw-r--r--patches.suse/qed-iWARP-fix-uninitialized-callback.patch28
-rw-r--r--patches.suse/sch_hhf-ensure-quantum-and-hhf_non_hh_weight-are-non.patch38
-rw-r--r--patches.suse/scsi-lpfc-Fix-null-ptr-oops-updating-lpfc_devloss_tm.patch8
-rw-r--r--patches.suse/scsi-lpfc-Fix-propagation-of-devloss_tmo-setting-to-.patch11
-rw-r--r--patches.suse/scsi-lpfc-remove-left-over-BUILD_NVME-defines.patch65
-rw-r--r--patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch3
-rw-r--r--patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch3
-rw-r--r--patches.suse/sctp-Fix-the-link-time-qualifier-of-sctp_ctrlsock_ex.patch30
-rw-r--r--patches.suse/sctp-use-transport-pf_retrans-in-sctp_do_8_2_transpo.patch32
-rw-r--r--patches.suse/sock_diag-fix-autoloading-of-the-raw_diag-module.patch37
-rw-r--r--patches.suse/sock_diag-request-_diag-module-only-when-the-family-.patch205
-rw-r--r--patches.suse/tcp-Don-t-dequeue-SYN-FIN-segments-from-write-queue.patch94
-rw-r--r--patches.suse/tcp-fix-tcp_ecn_withdraw_cwr-to-clear-TCP_ECN_QUEUE_.patch57
-rw-r--r--patches.suse/tcp-inherit-timestamp-on-mtu-probe.patch45
-rw-r--r--patches.suse/tcp-remove-empty-skb-from-write-queue-in-error-cases.patch86
-rw-r--r--patches.suse/tipc-add-NULL-pointer-check-before-calling-kfree_rcu.patch54
-rw-r--r--patches.suse/tracing-Initialize-iter-seq-after-zeroing-in-tracing.patch82
-rw-r--r--patches.suse/tun-fix-use-after-free-when-register-netdev-failed.patch22
-rw-r--r--patches.suse/x86-mm-use-write_once-when-setting-ptes.patch142
-rwxr-xr-xscripts/check-patch-blacklist14
-rwxr-xr-xscripts/git-pre-commit1
-rwxr-xr-xscripts/git_sort/git_sort.py5
-rwxr-xr-xscripts/git_sort/merge_tool.py8
-rwxr-xr-xscripts/git_sort/series_sort.py3
-rwxr-xr-xscripts/install-git-hooks72
-rwxr-xr-xscripts/run_oldconfig.sh3
-rwxr-xr-xscripts/sequence-patch.sh2
-rwxr-xr-xscripts/stableids21
-rwxr-xr-xscripts/supported-conf-fixup6
-rw-r--r--series.conf121
129 files changed, 7967 insertions, 105 deletions
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..e1144dd46d
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+*.changes merge=rpm-changes
+symsets-*.tar.gz diff=symsets
diff --git a/.gitignore b/.gitignore
index f1ef184788..03196c99ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@
# git files that we don't want to ignore even it they are dot-files
!.gitignore
+!.gitattributes
# package directories created by scripts/tar-up_and_run_mbuild.sh
kernel-source
diff --git a/blacklist.conf b/blacklist.conf
index a16618d6d5..eb793884b1 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1350,3 +1350,7 @@ b636fd38dc40113f853337a7d2a6885ad23b8811 # non-functional prereq for c03cd7738a8
aea447141c7e7824b81b49acd1bc785506fba46e # clang not supported
a521c44c3ded9fe184c5de3eed3a442af2d26f00 # book3e not supported
7101949f36fc77b530b73e4c6bd0066a2740d75b # misattributed. Bug does not existed in our kernels.
+2a1a3fa0f29270583f0e6e3100d609e09697add1 # CONFIG_KALLSYMS_ALL is set everywhere
+056d28d135bca0b1d0908990338e00e9dadaf057 # libelf is in the default location in SLES
+3f384d7c490374b2ae8f61a6c67f14deab77bab2 # cosmetic change in logging
+14e3cdbb00a885eedc95c0cf8eda8fe28d26d6b4 # only interesting in completely static builds
diff --git a/extra-gitconfig b/extra-gitconfig
new file mode 100644
index 0000000000..823148ec92
--- /dev/null
+++ b/extra-gitconfig
@@ -0,0 +1,9 @@
+# This file is not automatically read by git. It must be included explicitly,
+# for instance via an include directive in the repository-specific
+# configuration file ($GIT_DIR/config). That directive should be added
+# automatically by scripts/install-git-hooks.
+[merge "rpm-changes"]
+ name = *.changes merge driver
+ driver = scripts/rpm-changes-merge.pl %A %O %B
+[diff "symsets"]
+ textconv = scripts/list-symsets
diff --git a/kabi/severities b/kabi/severities
index 3c5d24a79b..cc1694fcb8 100644
--- a/kabi/severities
+++ b/kabi/severities
@@ -27,6 +27,8 @@ mm_iommu_ua_to_hpa_shift_rm PASS
# functions shared between xive and kvm
xive_cleanup_irq_data PASS
xive_native_populate_irq_data PASS
+# finctions internal to ppc radix mm
+radix__* PASS
# IBM Z internal symbols
# Cf. bsc#894391 / LTC#115441 and bsc#1134730 / LTC#173388
diff --git a/patches.kabi/Fix-KVM-kABI-after-x86-mmu-backports.patch b/patches.kabi/Fix-KVM-kABI-after-x86-mmu-backports.patch
new file mode 100644
index 0000000000..757153ec7c
--- /dev/null
+++ b/patches.kabi/Fix-KVM-kABI-after-x86-mmu-backports.patch
@@ -0,0 +1,65 @@
+From: Joerg Roedel <jroedel@suse.de>
+Date: Wed, 16 Oct 2019 13:46:24 +0200
+Subject: [PATCH] Fix KVM kABI after x86 mmu backports
+References: bsc#1117665
+Patch-mainline: Never, kABI fix only
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/include/asm/kvm_host.h | 4 ++--
+ include/linux/kvm_host.h | 6 +++++-
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 442c7fcb1bf6..66f9b603a6d8 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -276,18 +276,18 @@ struct kvm_rmap_head {
+ struct kvm_mmu_page {
+ struct list_head link;
+ struct hlist_node hash_link;
+- bool unsync;
+
+ /*
+ * The following two entries are used to key the shadow page in the
+ * hash table.
+ */
+- union kvm_mmu_page_role role;
+ gfn_t gfn;
++ union kvm_mmu_page_role role;
+
+ u64 *spt;
+ /* hold the gfn of each spte inside spt */
+ gfn_t *gfns;
++ bool unsync;
+ int root_count; /* Currently serving as active root */
+ unsigned int unsync_children;
+ struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 9635792374a4..2499d43b1600 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -1016,15 +1016,19 @@ enum kvm_stat_kind {
+
+ struct kvm_stat_data {
+ int offset;
+- int mode;
+ struct kvm *kvm;
++#ifndef __GENKSYMS__
++ int mode;
++#endif
+ };
+
+ struct kvm_stats_debugfs_item {
+ const char *name;
+ int offset;
+ enum kvm_stat_kind kind;
++#ifndef __GENKSYMS__
+ int mode;
++#endif
+ };
+ extern struct kvm_stats_debugfs_item debugfs_entries[];
+ extern struct dentry *kvm_debugfs_dir;
+--
+2.16.3
+
diff --git a/patches.kabi/net-sched-act_sample-fix-psample-group-handling-on-o.patch b/patches.kabi/net-sched-act_sample-fix-psample-group-handling-on-o.patch
new file mode 100644
index 0000000000..85cea84d0b
--- /dev/null
+++ b/patches.kabi/net-sched-act_sample-fix-psample-group-handling-on-o.patch
@@ -0,0 +1,29 @@
+From: Jiri Slaby <jslaby@suse.cz>
+Subject: kabi: net: sched: act_sample: fix psample group handling on overwrite
+Patch-mainline: never, kabi
+References: networking-stable-19_09_05
+
+This is a fix for patch:
+patches.suse/net-sched-act_sample-fix-psample-group-handling-on-o.patch
+
+It added a member to struct psample_group. Given it was added to the end
+and this structure is allocated only by psample_group_create, simply
+hide it by __GENKSYMS__.
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/psample.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/net/psample.h
++++ b/include/net/psample.h
+@@ -11,7 +11,9 @@ struct psample_group {
+ u32 group_num;
+ u32 refcount;
+ u32 seq;
++#ifndef __GENKSYMS__
+ struct rcu_head rcu;
++#endif
+ };
+
+ struct psample_group *psample_group_get(struct net *net, u32 group_num);
diff --git a/patches.suse/IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch b/patches.suse/0001-IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch
index ae2c29b865..391e5d84ee 100644
--- a/patches.suse/IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch
+++ b/patches.suse/0001-IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch
@@ -1,9 +1,11 @@
+From 05062a7f448a7b5030643ece5f04f09d556de0c8 Mon Sep 17 00:00:00 2001
From: "Michael J. Ruhl" <michael.j.ruhl@intel.com>
Date: Thu, 17 Jan 2019 12:42:04 -0800
-Subject: IB/hfi1: Remove overly conservative VM_EXEC flag check
-Patch-mainline: v5.0-rc5
+Subject: [PATCH 1/1] IB/hfi1: Remove overly conservative VM_EXEC flag check
+
Git-commit: 7709b0dc265f28695487712c45f02bbd1f98415d
-References: jsc#SLE-4925
+Patch-mainline: v5.0-rc5
+References: jsc#SLE-4925 bsc#1144449
Applications that use the stack for execution purposes cause userspace PSM
jobs to fail during mmap().
@@ -26,14 +28,16 @@ Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
-Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Signed-off-by: Firo Yang <firo.yang@suse.com>
---
- drivers/infiniband/hw/hfi1/file_ops.c | 2 +-
+ drivers/infiniband/hw/hfi1/file_ops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c
+index 05e13868d4cb..6c248c0a3a6e 100644
--- a/drivers/infiniband/hw/hfi1/file_ops.c
+++ b/drivers/infiniband/hw/hfi1/file_ops.c
-@@ -488,7 +488,7 @@ static int hfi1_file_mmap(struct file *f
+@@ -541,7 +541,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma)
vmf = 1;
break;
case STATUS:
@@ -42,3 +46,6 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
ret = -EPERM;
goto done;
}
+--
+2.16.4
+
diff --git a/patches.suse/0077-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch b/patches.suse/0001-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch
index 2b5a3f81dc..d12b186a1d 100644
--- a/patches.suse/0077-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch
+++ b/patches.suse/0001-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch
@@ -1,10 +1,10 @@
+From 524d59f6e30aab5b618da55e604c802ccd83e708 Mon Sep 17 00:00:00 2001
From: Vignesh R <vigneshr@ti.com>
Date: Fri, 29 Dec 2017 17:11:30 +0530
-Subject: PCI: dra7xx: Fix legacy INTD IRQ handling
-
+Subject: [PATCH] PCI: dra7xx: Fix legacy INTD IRQ handling
Git-commit: 524d59f6e30aab5b618da55e604c802ccd83e708
-Patch-mainline: v4.16-rc1
-References: fate#326536, fate#326532
+Patch-mainline: v4.16
+References: bsc#1087092, fate#326536, fate#326532
Legacy INTD IRQ handling is broken on dra7xx due to fact that driver
uses hwirq in range of 1-4 for INTA, INTD whereas IRQ domain is of size
@@ -22,7 +22,7 @@ Reported-by: Chris Welch <Chris.Welch@viavisolutions.com>
Signed-off-by: Vignesh R <vigneshr@ti.com>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
-Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/pci/dwc/pci-dra7xx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
@@ -49,5 +49,5 @@ index 4ab113543923..3321da945f0f 100644
}
--
-2.11.0
+2.16.4
diff --git a/patches.suse/0001-USB-adutux-fix-NULL-derefs-on-disconnect.patch b/patches.suse/0001-USB-adutux-fix-NULL-derefs-on-disconnect.patch
new file mode 100644
index 0000000000..09d193aba5
--- /dev/null
+++ b/patches.suse/0001-USB-adutux-fix-NULL-derefs-on-disconnect.patch
@@ -0,0 +1,108 @@
+From b2fa7baee744fde746c17bc1860b9c6f5c2eebb7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 25 Sep 2019 11:29:13 +0200
+Subject: [PATCH] USB: adutux: fix NULL-derefs on disconnect
+Git-commit: b2fa7baee744fde746c17bc1860b9c6f5c2eebb7
+Patch-mainline: v5.4-rc1
+References: bsc#1142635
+
+The driver was using its struct usb_device pointer as an inverted
+disconnected flag, but was setting it to NULL before making sure all
+completion handlers had run. This could lead to a NULL-pointer
+dereference in a number of dev_dbg statements in the completion handlers
+which relies on said pointer.
+
+The pointer was also dereferenced unconditionally in a dev_dbg statement
+release() something which would lead to a NULL-deref whenever a device
+was disconnected before the final character-device close if debugging
+was enabled.
+
+Fix this by unconditionally stopping all I/O and preventing
+resubmissions by poisoning the interrupt URBs at disconnect and using a
+dedicated disconnected flag.
+
+This also makes sure that all I/O has completed by the time the
+disconnect callback returns.
+
+Fixes: 1ef37c6047fe ("USB: adutux: remove custom debug macro and module parameter")
+Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro")
+Cc: stable <stable@vger.kernel.org> # 3.12
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20190925092913.8608-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/adutux.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -81,6 +81,7 @@ struct adu_device {
+ char serial_number[8];
+
+ int open_count; /* number of times this port has been opened */
++ unsigned long disconnected:1;
+
+ char *read_buffer_primary;
+ int read_buffer_length;
+@@ -122,7 +123,7 @@ static void adu_abort_transfers(struct a
+ {
+ unsigned long flags;
+
+- if (dev->udev == NULL)
++ if (dev->disconnected)
+ return;
+
+ /* shutdown transfer */
+@@ -245,7 +246,7 @@ static int adu_open(struct inode *inode,
+ }
+
+ dev = usb_get_intfdata(interface);
+- if (!dev || !dev->udev) {
++ if (!dev) {
+ retval = -ENODEV;
+ goto exit_no_device;
+ }
+@@ -328,7 +329,7 @@ static int adu_release(struct inode *ino
+ }
+
+ adu_release_internal(dev);
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ /* the device was unplugged before the file was released */
+ if (!dev->open_count) /* ... and we're the last user */
+ adu_delete(dev);
+@@ -357,7 +358,7 @@ static ssize_t adu_read(struct file *fil
+ return -ERESTARTSYS;
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto exit;
+@@ -522,7 +523,7 @@ static ssize_t adu_write(struct file *fi
+ goto exit_nolock;
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto exit;
+@@ -770,11 +771,14 @@ static void adu_disconnect(struct usb_in
+ minor = dev->minor;
+ usb_deregister_dev(interface, &adu_class);
+
++ usb_poison_urb(dev->interrupt_in_urb);
++ usb_poison_urb(dev->interrupt_out_urb);
++
+ mutex_lock(&adutux_mutex);
+ usb_set_intfdata(interface, NULL);
+
+ mutex_lock(&dev->mtx); /* not interruptible */
+- dev->udev = NULL; /* poison */
++ dev->disconnected = 1;
+ mutex_unlock(&dev->mtx);
+
+ /* if the device is not opened, then we clean up right now */
diff --git a/patches.suse/0001-USB-adutux-fix-use-after-free-on-disconnect.patch b/patches.suse/0001-USB-adutux-fix-use-after-free-on-disconnect.patch
new file mode 100644
index 0000000000..9f33f27a22
--- /dev/null
+++ b/patches.suse/0001-USB-adutux-fix-use-after-free-on-disconnect.patch
@@ -0,0 +1,52 @@
+From 44efc269db7929f6275a1fa927ef082e533ecde0 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 25 Sep 2019 11:29:12 +0200
+Subject: [PATCH] USB: adutux: fix use-after-free on disconnect
+Git-commit: 44efc269db7929f6275a1fa927ef082e533ecde0
+References: bsc#1142635
+Patch-mainline: v5.4-rc1
+
+The driver was clearing its struct usb_device pointer, which it used as
+an inverted disconnected flag, before deregistering the character device
+and without serialising against racing release().
+
+This could lead to a use-after-free if a racing release() callback
+observes the cleared pointer and frees the driver data before
+disconnect() is finished with it.
+
+This could also lead to NULL-pointer dereferences in a racing open().
+
+Fixes: f08812d5eb8f ("USB: FIx locks and urb->status in adutux (updated)")
+Cc: stable <stable@vger.kernel.org> # 2.6.24
+Reported-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
+Tested-by: syzbot+0243cb250a51eeefb8cc@syzkaller.appspotmail.com
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20190925092913.8608-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/adutux.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -767,15 +767,16 @@ static void adu_disconnect(struct usb_in
+
+ dev = usb_get_intfdata(interface);
+
+- mutex_lock(&dev->mtx); /* not interruptible */
+- dev->udev = NULL; /* poison */
+ minor = dev->minor;
+ usb_deregister_dev(interface, &adu_class);
+- mutex_unlock(&dev->mtx);
+
+ mutex_lock(&adutux_mutex);
+ usb_set_intfdata(interface, NULL);
+
++ mutex_lock(&dev->mtx); /* not interruptible */
++ dev->udev = NULL; /* poison */
++ mutex_unlock(&dev->mtx);
++
+ /* if the device is not opened, then we clean up right now */
+ if (!dev->open_count)
+ adu_delete(dev);
diff --git a/patches.suse/0001-USB-legousbtower-fix-deadlock-on-disconnect.patch b/patches.suse/0001-USB-legousbtower-fix-deadlock-on-disconnect.patch
new file mode 100644
index 0000000000..317aca39db
--- /dev/null
+++ b/patches.suse/0001-USB-legousbtower-fix-deadlock-on-disconnect.patch
@@ -0,0 +1,129 @@
+From 33a7813219f208f4952ece60ee255fd983272dec Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 19 Sep 2019 10:30:37 +0200
+Subject: [PATCH] USB: legousbtower: fix deadlock on disconnect
+Git-commit: 33a7813219f208f4952ece60ee255fd983272dec
+Patch-mainline: v5.4-rc3
+References: bsc#1142635
+
+Fix a potential deadlock if disconnect races with open.
+
+Since commit d4ead16f50f9 ("USB: prevent char device open/deregister
+race") core holds an rw-semaphore while open is called and when
+releasing the minor number during deregistration. This can lead to an
+ABBA deadlock if a driver takes a lock in open which it also holds
+during deregistration.
+
+This effectively reverts commit 78663ecc344b ("USB: disconnect open race
+in legousbtower") which needlessly introduced this issue after a generic
+fix for this race had been added to core by commit d4ead16f50f9 ("USB:
+prevent char device open/deregister race").
+
+Fixes: 78663ecc344b ("USB: disconnect open race in legousbtower")
+Cc: stable <stable@vger.kernel.org> # 2.6.24
+Reported-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com
+Tested-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20190919083039.30898-3-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/legousbtower.c | 19 ++-----------------
+ 1 file changed, 2 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 1db07d4dc738..773e4188f336 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -179,7 +179,6 @@ static const struct usb_device_id tower_table[] = {
+ };
+
+ MODULE_DEVICE_TABLE (usb, tower_table);
+-static DEFINE_MUTEX(open_disc_mutex);
+
+ #define LEGO_USB_TOWER_MINOR_BASE 160
+
+@@ -332,18 +331,14 @@ static int tower_open (struct inode *inode, struct file *file)
+ goto exit;
+ }
+
+- mutex_lock(&open_disc_mutex);
+ dev = usb_get_intfdata(interface);
+-
+ if (!dev) {
+- mutex_unlock(&open_disc_mutex);
+ retval = -ENODEV;
+ goto exit;
+ }
+
+ /* lock this device */
+ if (mutex_lock_interruptible(&dev->lock)) {
+- mutex_unlock(&open_disc_mutex);
+ retval = -ERESTARTSYS;
+ goto exit;
+ }
+@@ -351,12 +346,10 @@ static int tower_open (struct inode *inode, struct file *file)
+
+ /* allow opening only once */
+ if (dev->open_count) {
+- mutex_unlock(&open_disc_mutex);
+ retval = -EBUSY;
+ goto unlock_exit;
+ }
+ dev->open_count = 1;
+- mutex_unlock(&open_disc_mutex);
+
+ /* reset the tower */
+ result = usb_control_msg (dev->udev,
+@@ -423,10 +416,9 @@ static int tower_release (struct inode *inode, struct file *file)
+
+ if (dev == NULL) {
+ retval = -ENODEV;
+- goto exit_nolock;
++ goto exit;
+ }
+
+- mutex_lock(&open_disc_mutex);
+ if (mutex_lock_interruptible(&dev->lock)) {
+ retval = -ERESTARTSYS;
+ goto exit;
+@@ -456,10 +448,7 @@ static int tower_release (struct inode *inode, struct file *file)
+
+ unlock_exit:
+ mutex_unlock(&dev->lock);
+-
+ exit:
+- mutex_unlock(&open_disc_mutex);
+-exit_nolock:
+ return retval;
+ }
+
+@@ -912,7 +901,6 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ if (retval) {
+ /* something prevented us from registering this driver */
+ dev_err(idev, "Not able to get a minor for this device.\n");
+- usb_set_intfdata (interface, NULL);
+ goto error;
+ }
+ dev->minor = interface->minor;
+@@ -944,16 +932,13 @@ static void tower_disconnect (struct usb_interface *interface)
+ int minor;
+
+ dev = usb_get_intfdata (interface);
+- mutex_lock(&open_disc_mutex);
+- usb_set_intfdata (interface, NULL);
+
+ minor = dev->minor;
+
+- /* give back our minor */
++ /* give back our minor and prevent further open() */
+ usb_deregister_dev (interface, &tower_class);
+
+ mutex_lock(&dev->lock);
+- mutex_unlock(&open_disc_mutex);
+
+ /* if the device is not opened, then we clean up right now */
+ if (!dev->open_count) {
+--
+2.16.4
+
diff --git a/patches.suse/0001-USB-legousbtower-fix-open-after-failed-reset-request.patch b/patches.suse/0001-USB-legousbtower-fix-open-after-failed-reset-request.patch
new file mode 100644
index 0000000000..99d0c6db8c
--- /dev/null
+++ b/patches.suse/0001-USB-legousbtower-fix-open-after-failed-reset-request.patch
@@ -0,0 +1,55 @@
+From 0b074f6986751361ff442bc1127c1648567aa8d6 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 19 Sep 2019 10:30:39 +0200
+Subject: [PATCH] USB: legousbtower: fix open after failed reset request
+Git-commit: 0b074f6986751361ff442bc1127c1648567aa8d6
+Patch-mainline: v5.4-rc3
+References: bsc#1142635
+
+The driver would return with a nonzero open count in case the reset
+control request failed. This would prevent any further attempts to open
+the char dev until the device was disconnected.
+
+Fix this by incrementing the open count only on successful open.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20190919083039.30898-5-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/legousbtower.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 4fa999882635..44d6a3381804 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -348,7 +348,6 @@ static int tower_open (struct inode *inode, struct file *file)
+ retval = -EBUSY;
+ goto unlock_exit;
+ }
+- dev->open_count = 1;
+
+ /* reset the tower */
+ result = usb_control_msg (dev->udev,
+@@ -388,13 +387,14 @@ static int tower_open (struct inode *inode, struct file *file)
+ dev_err(&dev->udev->dev,
+ "Couldn't submit interrupt_in_urb %d\n", retval);
+ dev->interrupt_in_running = 0;
+- dev->open_count = 0;
+ goto unlock_exit;
+ }
+
+ /* save device in the file's private structure */
+ file->private_data = dev;
+
++ dev->open_count = 1;
++
+ unlock_exit:
+ mutex_unlock(&dev->lock);
+
+--
+2.16.4
+
diff --git a/patches.suse/0001-USB-legousbtower-fix-potential-NULL-deref-on-disconn.patch b/patches.suse/0001-USB-legousbtower-fix-potential-NULL-deref-on-disconn.patch
new file mode 100644
index 0000000000..922718df11
--- /dev/null
+++ b/patches.suse/0001-USB-legousbtower-fix-potential-NULL-deref-on-disconn.patch
@@ -0,0 +1,139 @@
+From cd81e6fa8e033e7bcd59415b4a65672b4780030b Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 19 Sep 2019 10:30:38 +0200
+Subject: [PATCH] USB: legousbtower: fix potential NULL-deref on disconnect
+Git-commit: cd81e6fa8e033e7bcd59415b4a65672b4780030b
+Patch-mainline: v5.4-rc3
+References: bsc#1142635
+
+The driver is using its struct usb_device pointer as an inverted
+disconnected flag, but was setting it to NULL before making sure all
+completion handlers had run. This could lead to a NULL-pointer
+dereference in a number of dev_dbg and dev_err statements in the
+completion handlers which relies on said pointer.
+
+Fix this by unconditionally stopping all I/O and preventing
+resubmissions by poisoning the interrupt URBs at disconnect and using a
+dedicated disconnected flag.
+
+This also makes sure that all I/O has completed by the time the
+disconnect callback returns.
+
+Fixes: 9d974b2a06e3 ("USB: legousbtower.c: remove err() usage")
+Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro")
+Fixes: 4dae99638097 ("USB: legotower: remove custom debug macro and module parameter")
+Cc: stable <stable@vger.kernel.org> # 3.5
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20190919083039.30898-4-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/legousbtower.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -196,6 +196,7 @@ struct lego_usb_tower {
+ unsigned char minor; /* the starting minor number for this device */
+
+ int open_count; /* number of times this port has been opened */
++ unsigned long disconnected:1;
+
+ char* read_buffer;
+ size_t read_buffer_length; /* this much came in */
+@@ -295,8 +296,6 @@ static inline void lego_usb_tower_debug_
+ */
+ static inline void tower_delete (struct lego_usb_tower *dev)
+ {
+- tower_abort_transfers (dev);
+-
+ /* free data structures */
+ usb_free_urb(dev->interrupt_in_urb);
+ usb_free_urb(dev->interrupt_out_urb);
+@@ -436,7 +435,8 @@ static int tower_release (struct inode *
+ retval = -ENODEV;
+ goto unlock_exit;
+ }
+- if (dev->udev == NULL) {
++
++ if (dev->disconnected) {
+ /* the device was unplugged before the file was released */
+
+ /* unlock here as tower_delete frees dev */
+@@ -472,10 +472,9 @@ static void tower_abort_transfers (struc
+ if (dev->interrupt_in_running) {
+ dev->interrupt_in_running = 0;
+ mb();
+- if (dev->udev)
+- usb_kill_urb (dev->interrupt_in_urb);
++ usb_kill_urb(dev->interrupt_in_urb);
+ }
+- if (dev->interrupt_out_busy && dev->udev)
++ if (dev->interrupt_out_busy)
+ usb_kill_urb(dev->interrupt_out_urb);
+ }
+
+@@ -511,7 +510,7 @@ static unsigned int tower_poll (struct f
+
+ dev = file->private_data;
+
+- if (!dev->udev)
++ if (dev->disconnected)
+ return POLLERR | POLLHUP;
+
+ poll_wait(file, &dev->read_wait, wait);
+@@ -558,7 +557,7 @@ static ssize_t tower_read (struct file *
+ }
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto unlock_exit;
+@@ -644,7 +643,7 @@ static ssize_t tower_write (struct file
+ }
+
+ /* verify that the device wasn't unplugged */
+- if (dev->udev == NULL) {
++ if (dev->disconnected) {
+ retval = -ENODEV;
+ pr_err("No device or device unplugged %d\n", retval);
+ goto unlock_exit;
+@@ -753,7 +752,7 @@ static void tower_interrupt_in_callback
+
+ resubmit:
+ /* resubmit if we're still running */
+- if (dev->interrupt_in_running && dev->udev) {
++ if (dev->interrupt_in_running) {
+ retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
+ if (retval)
+ dev_err(&dev->udev->dev,
+@@ -818,6 +817,7 @@ static int tower_probe (struct usb_inter
+
+ dev->udev = udev;
+ dev->open_count = 0;
++ dev->disconnected = 0;
+
+ dev->read_buffer = NULL;
+ dev->read_buffer_length = 0;
+@@ -943,6 +943,10 @@ static void tower_disconnect (struct usb
+ /* give back our minor and prevent further open() */
+ usb_deregister_dev (interface, &tower_class);
+
++ /* stop I/O */
++ usb_poison_urb(dev->interrupt_in_urb);
++ usb_poison_urb(dev->interrupt_out_urb);
++
+ mutex_lock(&dev->lock);
+
+ /* if the device is not opened, then we clean up right now */
+@@ -950,7 +954,7 @@ static void tower_disconnect (struct usb
+ mutex_unlock(&dev->lock);
+ tower_delete (dev);
+ } else {
+- dev->udev = NULL;
++ dev->disconnected = 1;
+ /* wake up pollers */
+ wake_up_interruptible_all(&dev->read_wait);
+ wake_up_interruptible_all(&dev->write_wait);
diff --git a/patches.suse/0001-USB-legousbtower-fix-slab-info-leak-at-probe.patch b/patches.suse/0001-USB-legousbtower-fix-slab-info-leak-at-probe.patch
new file mode 100644
index 0000000000..1526a8e0b9
--- /dev/null
+++ b/patches.suse/0001-USB-legousbtower-fix-slab-info-leak-at-probe.patch
@@ -0,0 +1,42 @@
+From 1d427be4a39defadda6dd8f4659bc17f7591740f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 19 Sep 2019 10:30:36 +0200
+Subject: [PATCH] USB: legousbtower: fix slab info leak at probe
+Git-commit: 1d427be4a39defadda6dd8f4659bc17f7591740f
+Patch-mainline: v5.4-rc3
+References: bsc#1142635
+
+Make sure to check for short transfers when retrieving the version
+information at probe to avoid leaking uninitialised slab data when
+logging it.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20190919083039.30898-2-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/legousbtower.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 006cf13b2199..1db07d4dc738 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -891,8 +891,10 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device
+ get_version_reply,
+ sizeof(*get_version_reply),
+ 1000);
+- if (result < 0) {
+- dev_err(idev, "LEGO USB Tower get version control request failed\n");
++ if (result < sizeof(*get_version_reply)) {
++ if (result >= 0)
++ result = -EIO;
++ dev_err(idev, "get version request failed: %d\n", result);
+ retval = result;
+ goto error;
+ }
+--
+2.16.4
+
diff --git a/patches.suse/0001-USB-microtek-fix-info-leak-at-probe.patch b/patches.suse/0001-USB-microtek-fix-info-leak-at-probe.patch
new file mode 100644
index 0000000000..41829d1264
--- /dev/null
+++ b/patches.suse/0001-USB-microtek-fix-info-leak-at-probe.patch
@@ -0,0 +1,42 @@
+From 177238c3d47d54b2ed8f0da7a4290db492f4a057 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 3 Oct 2019 09:09:31 +0200
+Subject: [PATCH] USB: microtek: fix info-leak at probe
+Git-commit: 177238c3d47d54b2ed8f0da7a4290db492f4a057
+Patch-mainline: v5.4-rc1
+References: bsc#1142635
+
+Add missing bulk-in endpoint sanity check to prevent uninitialised stack
+data from being reported to the system log and used as endpoint
+addresses.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org>
+Reported-by: syzbot+5630ca7c3b2be5c9da5e@syzkaller.appspotmail.com
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20191003070931.17009-1-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/image/microtek.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
+index 0a57c2cc8e5a..7a6b122c833f 100644
+--- a/drivers/usb/image/microtek.c
++++ b/drivers/usb/image/microtek.c
+@@ -716,6 +716,10 @@ static int mts_usb_probe(struct usb_interface *intf,
+
+ }
+
++ if (ep_in_current != &ep_in_set[2]) {
++ MTS_WARNING("couldn't find two input bulk endpoints. Bailing out.\n");
++ return -ENODEV;
++ }
+
+ if ( ep_out == -1 ) {
+ MTS_WARNING( "couldn't find an output bulk endpoint. Bailing out.\n" );
+--
+2.16.4
+
diff --git a/patches.suse/0001-USB-usblcd-fix-I-O-after-disconnect.patch b/patches.suse/0001-USB-usblcd-fix-I-O-after-disconnect.patch
new file mode 100644
index 0000000000..3dec9c0545
--- /dev/null
+++ b/patches.suse/0001-USB-usblcd-fix-I-O-after-disconnect.patch
@@ -0,0 +1,132 @@
+From eb7f5a490c5edfe8126f64bc58b9ba2edef0a425 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 26 Sep 2019 11:12:25 +0200
+Subject: [PATCH] USB: usblcd: fix I/O after disconnect
+Git-commit: eb7f5a490c5edfe8126f64bc58b9ba2edef0a425
+Patch-mainline: v5.4-rc3
+References: bsc#1142635
+
+Make sure to stop all I/O on disconnect by adding a disconnected flag
+which is used to prevent new I/O from being started and by stopping all
+ongoing I/O before returning.
+
+This also fixes a potential use-after-free on driver unbind in case the
+driver data is freed before the completion handler has run.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable <stable@vger.kernel.org> # 7bbe990c989e
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Link: https://lore.kernel.org/r/20190926091228.24634-7-johan@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/usb/misc/usblcd.c | 33 +++++++++++++++++++++++++++++++--
+ 1 file changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/misc/usblcd.c b/drivers/usb/misc/usblcd.c
+index 9ba4a4e68d91..aa982d3ca36b 100644
+--- a/drivers/usb/misc/usblcd.c
++++ b/drivers/usb/misc/usblcd.c
+@@ -18,6 +18,7 @@
+ #include <linux/slab.h>
+ #include <linux/errno.h>
+ #include <linux/mutex.h>
++#include <linux/rwsem.h>
+ #include <linux/uaccess.h>
+ #include <linux/usb.h>
+
+@@ -57,6 +58,8 @@ struct usb_lcd {
+ using up all RAM */
+ struct usb_anchor submitted; /* URBs to wait for
+ before suspend */
++ struct rw_semaphore io_rwsem;
++ unsigned long disconnected:1;
+ };
+ #define to_lcd_dev(d) container_of(d, struct usb_lcd, kref)
+
+@@ -142,6 +145,13 @@ static ssize_t lcd_read(struct file *file, char __user * buffer,
+
+ dev = file->private_data;
+
++ down_read(&dev->io_rwsem);
++
++ if (dev->disconnected) {
++ retval = -ENODEV;
++ goto out_up_io;
++ }
++
+ /* do a blocking bulk read to get data from the device */
+ retval = usb_bulk_msg(dev->udev,
+ usb_rcvbulkpipe(dev->udev,
+@@ -158,6 +168,9 @@ static ssize_t lcd_read(struct file *file, char __user * buffer,
+ retval = bytes_read;
+ }
+
++out_up_io:
++ up_read(&dev->io_rwsem);
++
+ return retval;
+ }
+
+@@ -237,11 +250,18 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
+ if (r < 0)
+ return -EINTR;
+
++ down_read(&dev->io_rwsem);
++
++ if (dev->disconnected) {
++ retval = -ENODEV;
++ goto err_up_io;
++ }
++
+ /* create a urb, and a buffer for it, and copy the data to the urb */
+ urb = usb_alloc_urb(0, GFP_KERNEL);
+ if (!urb) {
+ retval = -ENOMEM;
+- goto err_no_buf;
++ goto err_up_io;
+ }
+
+ buf = usb_alloc_coherent(dev->udev, count, GFP_KERNEL,
+@@ -278,6 +298,7 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
+ the USB core will eventually free it entirely */
+ usb_free_urb(urb);
+
++ up_read(&dev->io_rwsem);
+ exit:
+ return count;
+ error_unanchor:
+@@ -285,7 +306,8 @@ static ssize_t lcd_write(struct file *file, const char __user * user_buffer,
+ error:
+ usb_free_coherent(dev->udev, count, buf, urb->transfer_dma);
+ usb_free_urb(urb);
+-err_no_buf:
++err_up_io:
++ up_read(&dev->io_rwsem);
+ up(&dev->limit_sem);
+ return retval;
+ }
+@@ -325,6 +347,7 @@ static int lcd_probe(struct usb_interface *interface,
+
+ kref_init(&dev->kref);
+ sema_init(&dev->limit_sem, USB_LCD_CONCURRENT_WRITES);
++ init_rwsem(&dev->io_rwsem);
+ init_usb_anchor(&dev->submitted);
+
+ dev->udev = usb_get_dev(interface_to_usbdev(interface));
+@@ -422,6 +445,12 @@ static void lcd_disconnect(struct usb_interface *interface)
+ /* give back our minor */
+ usb_deregister_dev(interface, &lcd_class);
+
++ down_write(&dev->io_rwsem);
++ dev->disconnected = 1;
++ up_write(&dev->io_rwsem);
++
++ usb_kill_anchored_urbs(&dev->submitted);
++
+ /* decrement our usage count */
+ kref_put(&dev->kref, lcd_delete);
+
+--
+2.16.4
+
diff --git a/patches.suse/0001-crypto-talitos-fix-missing-break-in-switch-statement.patch b/patches.suse/0001-crypto-talitos-fix-missing-break-in-switch-statement.patch
new file mode 100644
index 0000000000..12bac3bf60
--- /dev/null
+++ b/patches.suse/0001-crypto-talitos-fix-missing-break-in-switch-statement.patch
@@ -0,0 +1,37 @@
+From 5fc194ea6d34dfad9833d3043ce41d6c52aff39a Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Mon, 9 Sep 2019 00:29:52 -0500
+Subject: [PATCH] crypto: talitos - fix missing break in switch statement
+Git-commit: 5fc194ea6d34dfad9833d3043ce41d6c52aff39a
+Patch-mainline: v5.4-rc1
+References: bsc#1142635
+
+Add missing break statement in order to prevent the code from falling
+through to case CRYPTO_ALG_TYPE_AHASH.
+
+Fixes: aeb4c132f33d ("crypto: talitos - Convert to new AEAD interface")
+Cc: stable@vger.kernel.org
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/crypto/talitos.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index cb6c10b1bf36..56e3068c9947 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -3116,6 +3116,7 @@ static int talitos_remove(struct platform_device *ofdev)
+ break;
+ case CRYPTO_ALG_TYPE_AEAD:
+ crypto_unregister_aead(&t_alg->algt.alg.aead);
++ break;
+ case CRYPTO_ALG_TYPE_AHASH:
+ crypto_unregister_ahash(&t_alg->algt.alg.hash);
+ break;
+--
+2.16.4
+
diff --git a/patches.suse/0001-kernel-sysctl.c-do-not-override-max_threads-provided.patch b/patches.suse/0001-kernel-sysctl.c-do-not-override-max_threads-provided.patch
new file mode 100644
index 0000000000..c69b5a4fb1
--- /dev/null
+++ b/patches.suse/0001-kernel-sysctl.c-do-not-override-max_threads-provided.patch
@@ -0,0 +1,87 @@
+From b0f53dbc4bc4c371f38b14c391095a3bb8a0bb40 Mon Sep 17 00:00:00 2001
+From: Michal Hocko <mhocko@suse.com>
+Date: Sun, 6 Oct 2019 17:58:19 -0700
+Subject: [PATCH] kernel/sysctl.c: do not override max_threads provided by
+ userspace
+Git-commit: b0f53dbc4bc4c371f38b14c391095a3bb8a0bb40
+Patch-mainline: v5.4-rc2
+References: bnc#1150875
+
+Partially revert 16db3d3f1170 ("kernel/sysctl.c: threads-max observe
+limits") because the patch is causing a regression to any workload which
+needs to override the auto-tuning of the limit provided by kernel.
+
+set_max_threads is implementing a boot time guesstimate to provide a
+sensible limit of the concurrently running threads so that runaways will
+not deplete all the memory. This is a good thing in general but there
+are workloads which might need to increase this limit for an application
+to run (reportedly WebSpher MQ is affected) and that is simply not
+possible after the mentioned change. It is also very dubious to
+override an admin decision by an estimation that doesn't have any direct
+relation to correctness of the kernel operation.
+
+Fix this by dropping set_max_threads from sysctl_max_threads so any
+value is accepted as long as it fits into MAX_THREADS which is important
+to check because allowing more threads could break internal robust futex
+restriction. While at it, do not use MIN_THREADS as the lower boundary
+because it is also only a heuristic for automatic estimation and admin
+might have a good reason to stop new threads to be created even when
+below this limit.
+
+This became more severe when we switched x86 from 4k to 8k kernel
+stacks. Starting since 6538b8ea886e ("x86_64: expand kernel stack to
+16K") (3.16) we use THREAD_SIZE_ORDER = 2 and that halved the auto-tuned
+value.
+
+In the particular case
+
+ 3.12
+ kernel.threads-max = 515561
+
+ 4.4
+ kernel.threads-max = 200000
+
+Neither of the two values is really insane on 32GB machine.
+
+I am not sure we want/need to tune the max_thread value further. If
+anything the tuning should be removed altogether if proven not useful in
+general. But we definitely need a way to override this auto-tuning.
+
+Link: http://lkml.kernel.org/r/20190922065801.GB18814@dhcp22.suse.cz
+Fixes: 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits")
+Signed-off-by: Michal Hocko <mhocko@suse.com>
+Reviewed-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+---
+ kernel/fork.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 1f6c45f6a734..bcdf53125210 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2925,7 +2925,7 @@ int sysctl_max_threads(struct ctl_table *table, int write,
+ struct ctl_table t;
+ int ret;
+ int threads = max_threads;
+- int min = MIN_THREADS;
++ int min = 1;
+ int max = MAX_THREADS;
+
+ t = *table;
+@@ -2937,7 +2937,7 @@ int sysctl_max_threads(struct ctl_table *table, int write,
+ if (ret || !write)
+ return ret;
+
+- set_max_threads(threads);
++ max_threads = threads;
+
+ return 0;
+ }
+--
+2.12.3
+
diff --git a/patches.suse/0001-media-atmel-atmel-isc-fix-asd-memory-allocation.patch b/patches.suse/0001-media-atmel-atmel-isc-fix-asd-memory-allocation.patch
new file mode 100644
index 0000000000..174443611f
--- /dev/null
+++ b/patches.suse/0001-media-atmel-atmel-isc-fix-asd-memory-allocation.patch
@@ -0,0 +1,42 @@
+From 1e4e25c4959c10728fbfcc6a286f9503d32dfe02 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Fri, 12 Apr 2019 06:19:49 -0400
+Subject: [PATCH] media: atmel: atmel-isc: fix asd memory allocation
+Git-commit: 1e4e25c4959c10728fbfcc6a286f9503d32dfe02
+Patch-mainline: v5.2
+References: bsc#1135642
+
+The subsystem will free the asd memory on notifier cleanup, if the asd is
+added to the notifier.
+However the memory is freed using kfree.
+Thus, we cannot allocate the asd using devm_*
+This can lead to crashes and problems.
+To test this issue, just return an error at probe, but cleanup the
+notifier beforehand.
+
+Fixes: 106267444f ("[media] atmel-isc: add the Image Sensor Controller code")
+
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/media/platform/atmel/atmel-isc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/media/platform/atmel/atmel-isc.c
++++ b/drivers/media/platform/atmel/atmel-isc.c
+@@ -1719,8 +1719,11 @@ static int isc_parse_dt(struct device *d
+ break;
+ }
+
+- subdev_entity->asd = devm_kzalloc(dev,
+- sizeof(*subdev_entity->asd), GFP_KERNEL);
++ /* asd will be freed by the subsystem once it's added to the
++ * notifier list
++ */
++ subdev_entity->asd = kzalloc(sizeof(*subdev_entity->asd),
++ GFP_KERNEL);
+ if (subdev_entity->asd == NULL) {
+ of_node_put(rem);
+ ret = -ENOMEM;
diff --git a/patches.suse/0001-rtlwifi-rtl8192cu-Fix-value-set-in-descriptor.patch b/patches.suse/0001-rtlwifi-rtl8192cu-Fix-value-set-in-descriptor.patch
new file mode 100644
index 0000000000..0727f8a7a3
--- /dev/null
+++ b/patches.suse/0001-rtlwifi-rtl8192cu-Fix-value-set-in-descriptor.patch
@@ -0,0 +1,35 @@
+From 01bb31de526265e51e21e3efcdcbbe7e6906b051 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@lwfinger.net>
+Date: Mon, 12 Aug 2019 14:27:41 -0500
+Subject: [PATCH] rtlwifi: rtl8192cu: Fix value set in descriptor
+Git-commit: 01bb31de526265e51e21e3efcdcbbe7e6906b051
+Patch-mainline: v5.4-rc1
+References: bsc#1142635
+
+In the process of converting the bit manipulation macros were converted
+to use GENMASK(), the compiler reported a value too big for the field.
+The offending statement was trying to write 0x100 into a 5-bit field.
+An accompaning comment says to set bit 3, thus the code is changed
+appropriately.
+
+This error has been in the driver since its initial submission.
+
+Fixes: 29d00a3e46bb ("rtlwifi: rtl8192cu: Add routine trx")
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/trx.c
+@@ -634,7 +634,7 @@ void rtl92cu_fill_fake_txdesc(struct iee
+ SET_TX_DESC_NAV_USE_HDR(pDesc, 1);
+ } else {
+ SET_TX_DESC_HWSEQ_EN(pDesc, 1); /* Hw set sequence number */
+- SET_TX_DESC_PKT_ID(pDesc, 0x100); /* set bit3 to 1. */
++ SET_TX_DESC_PKT_ID(pDesc, BIT(3)); /* set bit3 to 1. */
+ }
+ SET_TX_DESC_USE_RATE(pDesc, 1); /* use data rate which is set by Sw */
+ SET_TX_DESC_OWN(pDesc, 1);
diff --git a/patches.suse/0001-xen-pv-Fix-a-boot-up-hang-revealed-by-int3-self-test.patch b/patches.suse/0001-xen-pv-Fix-a-boot-up-hang-revealed-by-int3-self-test.patch
new file mode 100644
index 0000000000..2f0e18c88e
--- /dev/null
+++ b/patches.suse/0001-xen-pv-Fix-a-boot-up-hang-revealed-by-int3-self-test.patch
@@ -0,0 +1,116 @@
+Patch-mainline: v5.3-rc1
+Git-commit: b23e5844dfe78a80ba672793187d3f52e4b528d7
+References: bsc#1153811
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Sun, 14 Jul 2019 17:15:32 +0800
+Subject: [PATCH] xen/pv: Fix a boot up hang revealed by int3 self test
+
+Commit 7457c0da024b ("x86/alternatives: Add int3_emulate_call()
+selftest") is used to ensure there is a gap setup in int3 exception stack
+which could be used for inserting call return address.
+
+This gap is missed in XEN PV int3 exception entry path, then below panic
+triggered:
+
+[ 0.772876] general protection fault: 0000 [#1] SMP NOPTI
+[ 0.772886] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.2.0+ #11
+[ 0.772893] RIP: e030:int3_magic+0x0/0x7
+[ 0.772905] RSP: 3507:ffffffff82203e98 EFLAGS: 00000246
+[ 0.773334] Call Trace:
+[ 0.773334] alternative_instructions+0x3d/0x12e
+[ 0.773334] check_bugs+0x7c9/0x887
+[ 0.773334] ? __get_locked_pte+0x178/0x1f0
+[ 0.773334] start_kernel+0x4ff/0x535
+[ 0.773334] ? set_init_arg+0x55/0x55
+[ 0.773334] xen_start_kernel+0x571/0x57a
+
+For 64bit PV guests, Xen's ABI enters the kernel with using SYSRET, with
+%rcx/%r11 on the stack. To convert back to "normal" looking exceptions,
+the xen thunks do 'xen_*: pop %rcx; pop %r11; jmp *'.
+
+E.g. Extracting 'xen_pv_trap xenint3' we have:
+xen_xenint3:
+ pop %rcx;
+ pop %r11;
+ jmp xenint3
+
+As xenint3 and int3 entry code are same except xenint3 doesn't generate
+a gap, we can fix it by using int3 and drop useless xenint3.
+
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Reviewed-by: Juergen Gross <jgross@suse.com>
+Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Stefano Stabellini <sstabellini@kernel.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Andrew Cooper <andrew.cooper3@citrix.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ arch/x86/entry/entry_64.S | 1 -
+ arch/x86/include/asm/traps.h | 2 +-
+ arch/x86/xen/enlighten_pv.c | 2 +-
+ arch/x86/xen/xen-asm_64.S | 1 -
+ 4 files changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 0ea4831a72a4..35a66fcfcb91 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -1133,7 +1133,6 @@ idtentry stack_segment do_stack_segment has_error_code=1
+ #ifdef CONFIG_XEN
+ idtentry xennmi do_nmi has_error_code=0
+ idtentry xendebug do_debug has_error_code=0
+-idtentry xenint3 do_int3 has_error_code=0
+ #endif
+
+ idtentry general_protection do_general_protection has_error_code=1
+diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
+index 7d6f3f3fad78..f2bd284abc16 100644
+--- a/arch/x86/include/asm/traps.h
++++ b/arch/x86/include/asm/traps.h
+@@ -57,7 +57,7 @@ asmlinkage void simd_coprocessor_error(void);
+ asmlinkage void xen_divide_error(void);
+ asmlinkage void xen_xennmi(void);
+ asmlinkage void xen_xendebug(void);
+-asmlinkage void xen_xenint3(void);
++asmlinkage void xen_int3(void);
+ asmlinkage void xen_overflow(void);
+ asmlinkage void xen_bounds(void);
+ asmlinkage void xen_invalid_op(void);
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index 5d16824e4dca..bed6bb93c965 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -597,12 +597,12 @@ struct trap_array_entry {
+
+ static struct trap_array_entry trap_array[] = {
+ { debug, xen_xendebug, true },
+- { int3, xen_xenint3, true },
+ { double_fault, xen_double_fault, true },
+ #ifdef CONFIG_X86_MCE
+ { machine_check, xen_machine_check, true },
+ #endif
+ { nmi, xen_xennmi, true },
++ { int3, xen_int3, false },
+ { overflow, xen_overflow, false },
+ #ifdef CONFIG_IA32_EMULATION
+ { entry_INT80_compat, xen_entry_INT80_compat, false },
+diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
+index 1e9ef0ba30a5..ebf610b49c06 100644
+--- a/arch/x86/xen/xen-asm_64.S
++++ b/arch/x86/xen/xen-asm_64.S
+@@ -34,7 +34,6 @@ xen_pv_trap divide_error
+ xen_pv_trap debug
+ xen_pv_trap xendebug
+ xen_pv_trap int3
+-xen_pv_trap xenint3
+ xen_pv_trap xennmi
+ xen_pv_trap overflow
+ xen_pv_trap bounds
+--
+2.16.4
+
diff --git a/patches.suse/Btrfs-check-for-the-full-sync-flag-while-holding-the.patch b/patches.suse/Btrfs-check-for-the-full-sync-flag-while-holding-the.patch
new file mode 100644
index 0000000000..dac2fb9f3e
--- /dev/null
+++ b/patches.suse/Btrfs-check-for-the-full-sync-flag-while-holding-the.patch
@@ -0,0 +1,86 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Wed, 16 Oct 2019 17:28:50 +0100
+Patch-mainline: submitted upstream, https://patchwork.kernel.org/patch/11193633/
+References: bsc#1153713
+Subject: [PATCH] Btrfs: check for the full sync flag while holding the inode
+ lock during fsync
+
+We were checking for the full fsync flag in the inode before locking the
+inode, which is racy, since at that that time it might not be set but
+after we acquire the inode lock some other task set it. One case where
+this can happen is on a system low on memory and some concurrent task
+failed to allocate an extent map and therefore set the full sync flag on
+the inode, to force the next fsync to work in full mode.
+
+A consequence of missing the full fsync flag set is hitting the problems
+fixed by commit 0c713cbab620 ("Btrfs: fix race between ranged fsync and
+writeback of adjacent ranges"), BUG_ON() when dropping extents from a log
+tree, hitting assertion failures at tree-log.c:copy_items() or all sorts
+of weird inconsistencies after replaying a log due to file extents items
+representing ranges that overlap.
+
+So just move the check such that it's done after locking the inode and
+before starting writeback again.
+
+Fixes: 0c713cbab620 ("Btrfs: fix race between ranged fsync and writeback of adjacent ranges")
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+---
+ fs/btrfs/file.c | 35 ++++++++++++++++++-----------------
+ 1 file changed, 18 insertions(+), 17 deletions(-)
+
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 320b01580f2e..901aeb7ee81b 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -2059,23 +2059,6 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ bool full_sync = 0;
+ u64 len;
+
+- /*
+- * If the inode needs a full sync, make sure we use a full range to
+- * avoid log tree corruption, due to hole detection racing with ordered
+- * extent completion for adjacent ranges, and assertion failures during
+- * hole detection.
+- */
+- if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+- &BTRFS_I(inode)->runtime_flags)) {
+- start = 0;
+- end = LLONG_MAX;
+- }
+-
+- /*
+- * The range length can be represented by u64, we have to do the typecasts
+- * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+- */
+- len = (u64)end - (u64)start + 1;
+ trace_btrfs_sync_file(file, datasync);
+
+ /*
+@@ -2092,6 +2075,24 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ atomic_inc(&root->log_batch);
+ full_sync = test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+ &BTRFS_I(inode)->runtime_flags);
++ /*
++ * If the inode needs a full sync, make sure we use a full range to
++ * avoid log tree corruption, due to hole detection racing with ordered
++ * extent completion for adjacent ranges, and assertion failures during
++ * hole detection. Do this while holding the inode lock, to avoid races
++ * with other tasks.
++ */
++ if (full_sync) {
++ start = 0;
++ end = LLONG_MAX;
++ }
++
++ /*
++ * The range length can be represented by u64, we have to do the typecasts
++ * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
++ */
++ len = (u64)end - (u64)start + 1;
++
+ /*
+ * We might have have had more pages made dirty after calling
+ * start_ordered_ops and before acquiring the inode's i_mutex.
+--
+2.16.4
+
diff --git a/patches.suse/IB-mlx5-Consolidate-use_umr-checks-into-single-funct.patch b/patches.suse/IB-mlx5-Consolidate-use_umr-checks-into-single-funct.patch
new file mode 100644
index 0000000000..4a706692e6
--- /dev/null
+++ b/patches.suse/IB-mlx5-Consolidate-use_umr-checks-into-single-funct.patch
@@ -0,0 +1,53 @@
+From: Moni Shoua <monis@mellanox.com>
+Date: Thu, 15 Aug 2019 11:38:31 +0300
+Subject: IB/mlx5: Consolidate use_umr checks into single function
+Patch-mainline: v5.3-rc6
+Git-commit: 0e6613b41edd2f55a4b33234c5f31410c1ed3783
+References: bsc#1093205
+
+Introduce helper function to unify various use_umr checks.
+
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Link: https://lore.kernel.org/r/20190815083834.9245-6-leon@kernel.org
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/mlx5_ib.h | 13 +++++++++++++
+ drivers/infiniband/hw/mlx5/mr.c | 4 +---
+ 2 files changed, 14 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h
++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h
+@@ -1101,4 +1101,18 @@ static inline int get_num_uars(struct ml
+ int bfregn_to_uar_index(struct mlx5_ib_dev *dev,
+ struct mlx5_bfreg_info *bfregi, u32 bfregn,
+ bool dyn_bfreg);
++
++static inline bool mlx5_ib_can_use_umr(struct mlx5_ib_dev *dev,
++ bool do_modify_atomic)
++{
++ if (MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled))
++ return false;
++
++ if (do_modify_atomic &&
++ MLX5_CAP_GEN(dev->mdev, atomic) &&
++ MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled))
++ return false;
++
++ return true;
++}
+ #endif /* MLX5_IB_H */
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1234,9 +1234,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct
+ if (err < 0)
+ return ERR_PTR(err);
+
+- use_umr = !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled) &&
+- (!MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled) ||
+- !MLX5_CAP_GEN(dev->mdev, atomic));
++ use_umr = mlx5_ib_can_use_umr(dev, true);
+
+ if (order <= mr_cache_max_order(dev) && use_umr) {
+ mr = alloc_mr_from_cache(pd, umem, virt_addr, length, ncont,
diff --git a/patches.suse/IB-mlx5-Fix-MR-re-registration-flow-to-use-UMR-prope.patch b/patches.suse/IB-mlx5-Fix-MR-re-registration-flow-to-use-UMR-prope.patch
new file mode 100644
index 0000000000..21ff2d14d6
--- /dev/null
+++ b/patches.suse/IB-mlx5-Fix-MR-re-registration-flow-to-use-UMR-prope.patch
@@ -0,0 +1,35 @@
+From: Moni Shoua <monis@mellanox.com>
+Date: Thu, 15 Aug 2019 11:38:33 +0300
+Subject: IB/mlx5: Fix MR re-registration flow to use UMR properly
+Patch-mainline: v5.3-rc6
+Git-commit: 25a4517214ffa217a443181f7f885b914e6b328f
+References: bsc#1093205
+
+The UMR WQE in the MR re-registration flow requires that
+modify_atomic and modify_entity_size capabilities are enabled.
+Therefore, check that the these capabilities are present before going to
+umr flow and go through slow path if not.
+
+Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities")
+Signed-off-by: Moni Shoua <monis@mellanox.com>
+Reviewed-by: Guy Levi <guyle@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Link: https://lore.kernel.org/r/20190815083834.9245-8-leon@kernel.org
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -1384,7 +1384,8 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *
+ goto err;
+ }
+
+- if (flags & IB_MR_REREG_TRANS && !use_umr_mtt_update(mr, addr, len)) {
++ if (!mlx5_ib_can_use_umr(dev, true) ||
++ (flags & IB_MR_REREG_TRANS && !use_umr_mtt_update(mr, addr, len))) {
+ /*
+ * UMR can't be used - MKey needs to be replaced.
+ */
diff --git a/patches.suse/IB-mlx5-Report-correctly-tag-matching-rendezvous-cap.patch b/patches.suse/IB-mlx5-Report-correctly-tag-matching-rendezvous-cap.patch
new file mode 100644
index 0000000000..eb45cc5959
--- /dev/null
+++ b/patches.suse/IB-mlx5-Report-correctly-tag-matching-rendezvous-cap.patch
@@ -0,0 +1,65 @@
+From: Danit Goldberg <danitg@mellanox.com>
+Date: Fri, 5 Jul 2019 19:21:57 +0300
+Subject: IB/mlx5: Report correctly tag matching rendezvous capability
+Patch-mainline: v5.3-rc1
+Git-commit: 89705e92700170888236555fe91b45e4c1bb0985
+References: bsc#1046305 FATE#322943
+
+Userspace expects the IB_TM_CAP_RC bit to indicate that the device
+supports RC transport tag matching with rendezvous offload. However the
+firmware splits this into two capabilities for eager and rendezvous tag
+matching.
+
+Only if the FW supports both modes should userspace be told the tag
+matching capability is available.
+
+Cc: <stable@vger.kernel.org> # 4.13
+Fixes: eb761894351d ("IB/mlx5: Fill XRQ capabilities")
+Signed-off-by: Danit Goldberg <danitg@mellanox.com>
+Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
+Reviewed-by: Artemy Kovalyov <artemyko@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/main.c | 8 ++++++--
+ include/rdma/ib_verbs.h | 4 ++--
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -781,15 +781,19 @@ static int mlx5_ib_query_device(struct i
+ }
+
+ if (MLX5_CAP_GEN(mdev, tag_matching)) {
+- props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
+ props->tm_caps.max_num_tags =
+ (1 << MLX5_CAP_GEN(mdev, log_tag_matching_list_sz)) - 1;
+- props->tm_caps.flags = IB_TM_CAP_RC;
+ props->tm_caps.max_ops =
+ 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz);
+ props->tm_caps.max_sge = MLX5_TM_MAX_SGE;
+ }
+
++ if (MLX5_CAP_GEN(mdev, tag_matching) &&
++ MLX5_CAP_GEN(mdev, rndv_offload_rc)) {
++ props->tm_caps.flags = IB_TM_CAP_RNDV_RC;
++ props->tm_caps.max_rndv_hdr_size = MLX5_TM_MAX_RNDV_MSG_SIZE;
++ }
++
+ if (MLX5_CAP_GEN(dev->mdev, cq_moderation)) {
+ props->cq_caps.max_cq_moderation_count =
+ MLX5_MAX_CQ_COUNT;
+--- a/include/rdma/ib_verbs.h
++++ b/include/rdma/ib_verbs.h
+@@ -281,8 +281,8 @@ struct ib_rss_caps {
+ };
+
+ enum ib_tm_cap_flags {
+- /* Support tag matching on RC transport */
+- IB_TM_CAP_RC = 1 << 0,
++ /* Support tag matching with rendezvous offload for RC transport */
++ IB_TM_CAP_RNDV_RC = 1 << 0,
+ };
+
+ struct ib_tm_caps {
diff --git a/patches.suse/KVM-PPC-Book3S-HV-use-smp_mb-when-setting-clearing-h.patch b/patches.suse/KVM-PPC-Book3S-HV-use-smp_mb-when-setting-clearing-h.patch
new file mode 100644
index 0000000000..fd55e8ff0a
--- /dev/null
+++ b/patches.suse/KVM-PPC-Book3S-HV-use-smp_mb-when-setting-clearing-h.patch
@@ -0,0 +1,465 @@
+From 3a83f677a6eeff65751b29e3648d7c69c3be83f3 Mon Sep 17 00:00:00 2001
+From: Michael Roth <mdroth@linux.vnet.ibm.com>
+Date: Wed, 11 Sep 2019 17:31:55 -0500
+Subject: [PATCH] KVM: PPC: Book3S HV: use smp_mb() when setting/clearing
+ host_ipi flag
+
+References: bsc#1061840
+Patch-mainline: v5.4-rc1
+Git-commit: 3a83f677a6eeff65751b29e3648d7c69c3be83f3
+
+On a 2-socket Power9 system with 32 cores/128 threads (SMT4) and 1TB
+of memory running the following guest configs:
+
+ guest A:
+ - 224GB of memory
+ - 56 VCPUs (sockets=1,cores=28,threads=2), where:
+ VCPUs 0-1 are pinned to CPUs 0-3,
+ VCPUs 2-3 are pinned to CPUs 4-7,
+ ...
+ VCPUs 54-55 are pinned to CPUs 108-111
+
+ guest B:
+ - 4GB of memory
+ - 4 VCPUs (sockets=1,cores=4,threads=1)
+
+with the following workloads (with KSM and THP enabled in all):
+
+ guest A:
+ stress --cpu 40 --io 20 --vm 20 --vm-bytes 512M
+
+ guest B:
+ stress --cpu 4 --io 4 --vm 4 --vm-bytes 512M
+
+ host:
+ stress --cpu 4 --io 4 --vm 2 --vm-bytes 256M
+
+the below soft-lockup traces were observed after an hour or so and
+persisted until the host was reset (this was found to be reliably
+reproducible for this configuration, for kernels 4.15, 4.18, 5.0,
+and 5.3-rc5):
+
+ [ 1253.183290] rcu: INFO: rcu_sched self-detected stall on CPU
+ [ 1253.183319] rcu: 124-....: (5250 ticks this GP) idle=10a/1/0x4000000000000002 softirq=5408/5408 fqs=1941
+ [ 1256.287426] watchdog: BUG: soft lockup - CPU#105 stuck for 23s! [CPU 52/KVM:19709]
+ [ 1264.075773] watchdog: BUG: soft lockup - CPU#24 stuck for 23s! [worker:19913]
+ [ 1264.079769] watchdog: BUG: soft lockup - CPU#31 stuck for 23s! [worker:20331]
+ [ 1264.095770] watchdog: BUG: soft lockup - CPU#45 stuck for 23s! [worker:20338]
+ [ 1264.131773] watchdog: BUG: soft lockup - CPU#64 stuck for 23s! [avocado:19525]
+ [ 1280.408480] watchdog: BUG: soft lockup - CPU#124 stuck for 22s! [ksmd:791]
+ [ 1316.198012] rcu: INFO: rcu_sched self-detected stall on CPU
+ [ 1316.198032] rcu: 124-....: (21003 ticks this GP) idle=10a/1/0x4000000000000002 softirq=5408/5408 fqs=8243
+ [ 1340.411024] watchdog: BUG: soft lockup - CPU#124 stuck for 22s! [ksmd:791]
+ [ 1379.212609] rcu: INFO: rcu_sched self-detected stall on CPU
+ [ 1379.212629] rcu: 124-....: (36756 ticks this GP) idle=10a/1/0x4000000000000002 softirq=5408/5408 fqs=14714
+ [ 1404.413615] watchdog: BUG: soft lockup - CPU#124 stuck for 22s! [ksmd:791]
+ [ 1442.227095] rcu: INFO: rcu_sched self-detected stall on CPU
+ [ 1442.227115] rcu: 124-....: (52509 ticks this GP) idle=10a/1/0x4000000000000002 softirq=5408/5408 fqs=21403
+ [ 1455.111787] INFO: task worker:19907 blocked for more than 120 seconds.
+ [ 1455.111822] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.111833] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.111884] INFO: task worker:19908 blocked for more than 120 seconds.
+ [ 1455.111905] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.111925] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.111966] INFO: task worker:20328 blocked for more than 120 seconds.
+ [ 1455.111986] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.111998] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.112048] INFO: task worker:20330 blocked for more than 120 seconds.
+ [ 1455.112068] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.112097] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.112138] INFO: task worker:20332 blocked for more than 120 seconds.
+ [ 1455.112159] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.112179] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.112210] INFO: task worker:20333 blocked for more than 120 seconds.
+ [ 1455.112231] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.112242] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.112282] INFO: task worker:20335 blocked for more than 120 seconds.
+ [ 1455.112303] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+ [ 1455.112332] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+ [ 1455.112372] INFO: task worker:20336 blocked for more than 120 seconds.
+ [ 1455.112392] Tainted: G L 5.3.0-rc5-mdr-vanilla+ #1
+
+CPUs 45, 24, and 124 are stuck on spin locks, likely held by
+CPUs 105 and 31.
+
+CPUs 105 and 31 are stuck in smp_call_function_many(), waiting on
+target CPU 42. For instance:
+
+ # CPU 105 registers (via xmon)
+ R00 = c00000000020b20c R16 = 00007d1bcd800000
+ R01 = c00000363eaa7970 R17 = 0000000000000001
+ R02 = c0000000019b3a00 R18 = 000000000000006b
+ R03 = 000000000000002a R19 = 00007d537d7aecf0
+ R04 = 000000000000002a R20 = 60000000000000e0
+ R05 = 000000000000002a R21 = 0801000000000080
+ R06 = c0002073fb0caa08 R22 = 0000000000000d60
+ R07 = c0000000019ddd78 R23 = 0000000000000001
+ R08 = 000000000000002a R24 = c00000000147a700
+ R09 = 0000000000000001 R25 = c0002073fb0ca908
+ R10 = c000008ffeb4e660 R26 = 0000000000000000
+ R11 = c0002073fb0ca900 R27 = c0000000019e2464
+ R12 = c000000000050790 R28 = c0000000000812b0
+ R13 = c000207fff623e00 R29 = c0002073fb0ca808
+ R14 = 00007d1bbee00000 R30 = c0002073fb0ca800
+ R15 = 00007d1bcd600000 R31 = 0000000000000800
+ pc = c00000000020b260 smp_call_function_many+0x3d0/0x460
+ cfar= c00000000020b270 smp_call_function_many+0x3e0/0x460
+ lr = c00000000020b20c smp_call_function_many+0x37c/0x460
+ msr = 900000010288b033 cr = 44024824
+ ctr = c000000000050790 xer = 0000000000000000 trap = 100
+
+CPU 42 is running normally, doing VCPU work:
+
+ # CPU 42 stack trace (via xmon)
+ [link register ] c00800001be17188 kvmppc_book3s_radix_page_fault+0x90/0x2b0 [kvm_hv]
+ [c000008ed3343820] c000008ed3343850 (unreliable)
+ [c000008ed33438d0] c00800001be11b6c kvmppc_book3s_hv_page_fault+0x264/0xe30 [kvm_hv]
+ [c000008ed33439d0] c00800001be0d7b4 kvmppc_vcpu_run_hv+0x8dc/0xb50 [kvm_hv]
+ [c000008ed3343ae0] c00800001c10891c kvmppc_vcpu_run+0x34/0x48 [kvm]
+ [c000008ed3343b00] c00800001c10475c kvm_arch_vcpu_ioctl_run+0x244/0x420 [kvm]
+ [c000008ed3343b90] c00800001c0f5a78 kvm_vcpu_ioctl+0x470/0x7c8 [kvm]
+ [c000008ed3343d00] c000000000475450 do_vfs_ioctl+0xe0/0xc70
+ [c000008ed3343db0] c0000000004760e4 ksys_ioctl+0x104/0x120
+ [c000008ed3343e00] c000000000476128 sys_ioctl+0x28/0x80
+ [c000008ed3343e20] c00000000000b388 system_call+0x5c/0x70
+ --- Exception: c00 (System Call) at 00007d545cfd7694
+ SP (7d53ff7edf50) is in userspace
+
+It was subsequently found that ipi_message[PPC_MSG_CALL_FUNCTION]
+was set for CPU 42 by at least 1 of the CPUs waiting in
+smp_call_function_many(), but somehow the corresponding
+call_single_queue entries were never processed by CPU 42, causing the
+callers to spin in csd_lock_wait() indefinitely.
+
+Nick Piggin suggested something similar to the following sequence as
+a possible explanation (interleaving of CALL_FUNCTION/RESCHEDULE
+IPI messages seems to be most common, but any mix of CALL_FUNCTION and
+!CALL_FUNCTION messages could trigger it):
+
+ CPU
+ X: smp_muxed_ipi_set_message():
+ X: smp_mb()
+ X: message[RESCHEDULE] = 1
+ X: doorbell_global_ipi(42):
+ X: kvmppc_set_host_ipi(42, 1)
+ X: ppc_msgsnd_sync()/smp_mb()
+ X: ppc_msgsnd() -> 42
+ 42: doorbell_exception(): // from CPU X
+ 42: ppc_msgsync()
+ 105: smp_muxed_ipi_set_message():
+ 105: smb_mb()
+ // STORE DEFERRED DUE TO RE-ORDERING
+ --105: message[CALL_FUNCTION] = 1
+ | 105: doorbell_global_ipi(42):
+ | 105: kvmppc_set_host_ipi(42, 1)
+ | 42: kvmppc_set_host_ipi(42, 0)
+ | 42: smp_ipi_demux_relaxed()
+ | 42: // returns to executing guest
+ | // RE-ORDERED STORE COMPLETES
+ ->105: message[CALL_FUNCTION] = 1
+ 105: ppc_msgsnd_sync()/smp_mb()
+ 105: ppc_msgsnd() -> 42
+ 42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
+ 105: // hangs waiting on 42 to process messages/call_single_queue
+
+This can be prevented with an smp_mb() at the beginning of
+kvmppc_set_host_ipi(), such that stores to message[<type>] (or other
+state indicated by the host_ipi flag) are ordered vs. the store to
+to host_ipi.
+
+However, doing so might still allow for the following scenario (not
+yet observed):
+
+ CPU
+ X: smp_muxed_ipi_set_message():
+ X: smp_mb()
+ X: message[RESCHEDULE] = 1
+ X: doorbell_global_ipi(42):
+ X: kvmppc_set_host_ipi(42, 1)
+ X: ppc_msgsnd_sync()/smp_mb()
+ X: ppc_msgsnd() -> 42
+ 42: doorbell_exception(): // from CPU X
+ 42: ppc_msgsync()
+ // STORE DEFERRED DUE TO RE-ORDERING
+ -- 42: kvmppc_set_host_ipi(42, 0)
+ | 42: smp_ipi_demux_relaxed()
+ | 105: smp_muxed_ipi_set_message():
+ | 105: smb_mb()
+ | 105: message[CALL_FUNCTION] = 1
+ | 105: doorbell_global_ipi(42):
+ | 105: kvmppc_set_host_ipi(42, 1)
+ | // RE-ORDERED STORE COMPLETES
+ -> 42: kvmppc_set_host_ipi(42, 0)
+ 42: // returns to executing guest
+ 105: ppc_msgsnd_sync()/smp_mb()
+ 105: ppc_msgsnd() -> 42
+ 42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
+ 105: // hangs waiting on 42 to process messages/call_single_queue
+
+Fixing this scenario would require an smp_mb() *after* clearing
+host_ipi flag in kvmppc_set_host_ipi() to order the store vs.
+subsequent processing of IPI messages.
+
+To handle both cases, this patch splits kvmppc_set_host_ipi() into
+separate set/clear functions, where we execute smp_mb() prior to
+setting host_ipi flag, and after clearing host_ipi flag. These
+functions pair with each other to synchronize the sender and receiver
+sides.
+
+With that change in place the above workload ran for 20 hours without
+triggering any lock-ups.
+
+Fixes: 755563bc79c7 ("powerpc/powernv: Fixes for hypervisor doorbell handling") # v4.0
+Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
+Acked-by: Paul Mackerras <paulus@ozlabs.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190911223155.16045-1-mdroth@linux.vnet.ibm.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/kvm_ppc.h | 100 +++++++++++++++++++++++++-
+ arch/powerpc/kernel/dbell.c | 6 +-
+ arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +-
+ arch/powerpc/platforms/powernv/smp.c | 2 +-
+ arch/powerpc/sysdev/xics/icp-native.c | 6 +-
+ arch/powerpc/sysdev/xics/icp-opal.c | 6 +-
+ 6 files changed, 108 insertions(+), 14 deletions(-)
+
+--- a/arch/powerpc/include/asm/kvm_ppc.h
++++ b/arch/powerpc/include/asm/kvm_ppc.h
+@@ -452,9 +452,100 @@ static inline u32 kvmppc_get_xics_latch(
+ return xirr;
+ }
+
+-static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
++/*
++ * To avoid the need to unnecessarily exit fully to the host kernel, an IPI to
++ * a CPU thread that's running/napping inside of a guest is by default regarded
++ * as a request to wake the CPU (if needed) and continue execution within the
++ * guest, potentially to process new state like externally-generated
++ * interrupts or IPIs sent from within the guest itself (e.g. H_PROD/H_IPI).
++ *
++ * To force an exit to the host kernel, kvmppc_set_host_ipi() must be called
++ * prior to issuing the IPI to set the corresponding 'host_ipi' flag in the
++ * target CPU's PACA. To avoid unnecessary exits to the host, this flag should
++ * be immediately cleared via kvmppc_clear_host_ipi() by the IPI handler on
++ * the receiving side prior to processing the IPI work.
++ *
++ * NOTE:
++ *
++ * We currently issue an smp_mb() at the beginning of kvmppc_set_host_ipi().
++ * This is to guard against sequences such as the following:
++ *
++ * CPU
++ * X: smp_muxed_ipi_set_message():
++ * X: smp_mb()
++ * X: message[RESCHEDULE] = 1
++ * X: doorbell_global_ipi(42):
++ * X: kvmppc_set_host_ipi(42)
++ * X: ppc_msgsnd_sync()/smp_mb()
++ * X: ppc_msgsnd() -> 42
++ * 42: doorbell_exception(): // from CPU X
++ * 42: ppc_msgsync()
++ * 105: smp_muxed_ipi_set_message():
++ * 105: smb_mb()
++ * // STORE DEFERRED DUE TO RE-ORDERING
++ * --105: message[CALL_FUNCTION] = 1
++ * | 105: doorbell_global_ipi(42):
++ * | 105: kvmppc_set_host_ipi(42)
++ * | 42: kvmppc_clear_host_ipi(42)
++ * | 42: smp_ipi_demux_relaxed()
++ * | 42: // returns to executing guest
++ * | // RE-ORDERED STORE COMPLETES
++ * ->105: message[CALL_FUNCTION] = 1
++ * 105: ppc_msgsnd_sync()/smp_mb()
++ * 105: ppc_msgsnd() -> 42
++ * 42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
++ * 105: // hangs waiting on 42 to process messages/call_single_queue
++ *
++ * We also issue an smp_mb() at the end of kvmppc_clear_host_ipi(). This is
++ * to guard against sequences such as the following (as well as to create
++ * a read-side pairing with the barrier in kvmppc_set_host_ipi()):
++ *
++ * CPU
++ * X: smp_muxed_ipi_set_message():
++ * X: smp_mb()
++ * X: message[RESCHEDULE] = 1
++ * X: doorbell_global_ipi(42):
++ * X: kvmppc_set_host_ipi(42)
++ * X: ppc_msgsnd_sync()/smp_mb()
++ * X: ppc_msgsnd() -> 42
++ * 42: doorbell_exception(): // from CPU X
++ * 42: ppc_msgsync()
++ * // STORE DEFERRED DUE TO RE-ORDERING
++ * -- 42: kvmppc_clear_host_ipi(42)
++ * | 42: smp_ipi_demux_relaxed()
++ * | 105: smp_muxed_ipi_set_message():
++ * | 105: smb_mb()
++ * | 105: message[CALL_FUNCTION] = 1
++ * | 105: doorbell_global_ipi(42):
++ * | 105: kvmppc_set_host_ipi(42)
++ * | // RE-ORDERED STORE COMPLETES
++ * -> 42: kvmppc_clear_host_ipi(42)
++ * 42: // returns to executing guest
++ * 105: ppc_msgsnd_sync()/smp_mb()
++ * 105: ppc_msgsnd() -> 42
++ * 42: local_paca->kvm_hstate.host_ipi == 0 // IPI ignored
++ * 105: // hangs waiting on 42 to process messages/call_single_queue
++ */
++static inline void kvmppc_set_host_ipi(int cpu)
+ {
+- paca[cpu].kvm_hstate.host_ipi = host_ipi;
++ /*
++ * order stores of IPI messages vs. setting of host_ipi flag
++ *
++ * pairs with the barrier in kvmppc_clear_host_ipi()
++ */
++ smp_mb();
++ paca[cpu].kvm_hstate.host_ipi = 1;
++}
++
++static inline void kvmppc_clear_host_ipi(int cpu)
++{
++ paca[cpu].kvm_hstate.host_ipi = 0;
++ /*
++ * order clearing of host_ipi flag vs. processing of IPI messages
++ *
++ * pairs with the barrier in kvmppc_set_host_ipi()
++ */
++ smp_mb();
+ }
+
+ static inline void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+@@ -483,7 +574,10 @@ static inline u32 kvmppc_get_xics_latch(
+ return 0;
+ }
+
+-static inline void kvmppc_set_host_ipi(int cpu, u8 host_ipi)
++static inline void kvmppc_set_host_ipi(int cpu)
++{}
++
++static inline void kvmppc_clear_host_ipi(int cpu)
+ {}
+
+ static inline void kvmppc_fast_vcpu_kick(struct kvm_vcpu *vcpu)
+diff --git a/arch/powerpc/kernel/dbell.c b/arch/powerpc/kernel/dbell.c
+index 804b1a6196fa..f17ff1200eaa 100644
+--- a/arch/powerpc/kernel/dbell.c
++++ b/arch/powerpc/kernel/dbell.c
+@@ -33,7 +33,7 @@ void doorbell_global_ipi(int cpu)
+ {
+ u32 tag = get_hard_smp_processor_id(cpu);
+
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ /* Order previous accesses vs. msgsnd, which is treated as a store */
+ ppc_msgsnd_sync();
+ ppc_msgsnd(PPC_DBELL_MSGTYPE, 0, tag);
+@@ -48,7 +48,7 @@ void doorbell_core_ipi(int cpu)
+ {
+ u32 tag = cpu_thread_in_core(cpu);
+
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ /* Order previous accesses vs. msgsnd, which is treated as a store */
+ ppc_msgsnd_sync();
+ ppc_msgsnd(PPC_DBELL_MSGTYPE, 0, tag);
+@@ -84,7 +84,7 @@ void doorbell_exception(struct pt_regs *regs)
+
+ may_hard_irq_enable();
+
+- kvmppc_set_host_ipi(smp_processor_id(), 0);
++ kvmppc_clear_host_ipi(smp_processor_id());
+ __this_cpu_inc(irq_stat.doorbell_irqs);
+
+ smp_ipi_demux_relaxed(); /* already performed the barrier */
+diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+index 4d2ec77d806c..287d5911df0f 100644
+--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c
++++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c
+@@ -58,7 +58,7 @@ static inline void icp_send_hcore_msg(int hcore, struct kvm_vcpu *vcpu)
+ hcpu = hcore << threads_shift;
+ kvmppc_host_rm_ops_hv->rm_core[hcore].rm_data = vcpu;
+ smp_muxed_ipi_set_message(hcpu, PPC_MSG_RM_HOST_ACTION);
+- kvmppc_set_host_ipi(hcpu, 1);
++ kvmppc_set_host_ipi(hcpu);
+ smp_mb();
+ kvmhv_rm_send_ipi(hcpu);
+ }
+diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c
+index 94cd96b9b7bb..fbd6e6b7bbf2 100644
+--- a/arch/powerpc/platforms/powernv/smp.c
++++ b/arch/powerpc/platforms/powernv/smp.c
+@@ -193,7 +193,7 @@ static void pnv_smp_cpu_kill_self(void)
+ * for coming online, which are handled via
+ * generic_check_cpu_restart() calls.
+ */
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+
+ srr1 = pnv_cpu_offline(cpu);
+
+diff --git a/arch/powerpc/sysdev/xics/icp-native.c b/arch/powerpc/sysdev/xics/icp-native.c
+index 485569ff7ef1..7d13d2ef5a90 100644
+--- a/arch/powerpc/sysdev/xics/icp-native.c
++++ b/arch/powerpc/sysdev/xics/icp-native.c
+@@ -140,7 +140,7 @@ static unsigned int icp_native_get_irq(void)
+
+ static void icp_native_cause_ipi(int cpu)
+ {
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ icp_native_set_qirr(cpu, IPI_PRIORITY);
+ }
+
+@@ -179,7 +179,7 @@ void icp_native_flush_interrupt(void)
+ if (vec == XICS_IPI) {
+ /* Clear pending IPI */
+ int cpu = smp_processor_id();
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ icp_native_set_qirr(cpu, 0xff);
+ } else {
+ pr_err("XICS: hw interrupt 0x%x to offline cpu, disabling\n",
+@@ -200,7 +200,7 @@ static irqreturn_t icp_native_ipi_action(int irq, void *dev_id)
+ {
+ int cpu = smp_processor_id();
+
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ icp_native_set_qirr(cpu, 0xff);
+
+ return smp_ipi_demux();
+diff --git a/arch/powerpc/sysdev/xics/icp-opal.c b/arch/powerpc/sysdev/xics/icp-opal.c
+index 8bb8dd7dd6ad..68fd2540b093 100644
+--- a/arch/powerpc/sysdev/xics/icp-opal.c
++++ b/arch/powerpc/sysdev/xics/icp-opal.c
+@@ -126,7 +126,7 @@ static void icp_opal_cause_ipi(int cpu)
+ {
+ int hw_cpu = get_hard_smp_processor_id(cpu);
+
+- kvmppc_set_host_ipi(cpu, 1);
++ kvmppc_set_host_ipi(cpu);
+ opal_int_set_mfrr(hw_cpu, IPI_PRIORITY);
+ }
+
+@@ -134,7 +134,7 @@ static irqreturn_t icp_opal_ipi_action(int irq, void *dev_id)
+ {
+ int cpu = smp_processor_id();
+
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+
+ return smp_ipi_demux();
+@@ -157,7 +157,7 @@ void icp_opal_flush_interrupt(void)
+ if (vec == XICS_IPI) {
+ /* Clear pending IPI */
+ int cpu = smp_processor_id();
+- kvmppc_set_host_ipi(cpu, 0);
++ kvmppc_clear_host_ipi(cpu);
+ opal_int_set_mfrr(get_hard_smp_processor_id(cpu), 0xff);
+ } else {
+ pr_err("XICS: hw interrupt 0x%x to offline cpu, "
+--
+2.23.0
+
diff --git a/patches.suse/RDMA-Fix-goto-target-to-release-the-allocated-memory.patch b/patches.suse/RDMA-Fix-goto-target-to-release-the-allocated-memory.patch
new file mode 100644
index 0000000000..dffd7cd83b
--- /dev/null
+++ b/patches.suse/RDMA-Fix-goto-target-to-release-the-allocated-memory.patch
@@ -0,0 +1,31 @@
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Tue, 10 Sep 2019 17:21:19 -0500
+Subject: RDMA: Fix goto target to release the allocated memory
+Patch-mainline: v5.4-rc1
+Git-commit: 4a9d46a9fe14401f21df69cea97c62396d5fb053
+References: bsc#1050244 FATE#322915
+
+In bnxt_re_create_srq(), when ib_copy_to_udata() fails allocated memory
+should be released by goto fail.
+
+Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters")
+Link: https://lore.kernel.org/r/20190910222120.16517-1-navid.emamdoost@gmail.com
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+@@ -1472,7 +1472,7 @@ struct ib_srq *bnxt_re_create_srq(struct
+ dev_err(rdev_to_dev(rdev), "SRQ copy to udata failed!");
+ bnxt_qplib_destroy_srq(&rdev->qplib_res,
+ &srq->qplib_srq);
+- goto exit;
++ goto fail;
+ }
+ }
+ if (nq)
diff --git a/patches.suse/RDMA-bnxt_re-Fix-spelling-mistake-missin_resp-missin.patch b/patches.suse/RDMA-bnxt_re-Fix-spelling-mistake-missin_resp-missin.patch
new file mode 100644
index 0000000000..551a505074
--- /dev/null
+++ b/patches.suse/RDMA-bnxt_re-Fix-spelling-mistake-missin_resp-missin.patch
@@ -0,0 +1,30 @@
+From: Colin Ian King <colin.king@canonical.com>
+Date: Wed, 11 Sep 2019 10:28:56 +0100
+Subject: RDMA/bnxt_re: Fix spelling mistake "missin_resp" -> "missing_resp"
+Patch-mainline: v5.4-rc1
+Git-commit: d97a3e92f33685768be04b2dfcd812f78f8ef341
+References: bsc#1050244 FATE#322915
+
+There is a spelling mistake in a literal string, fix it.
+
+Fixes: 89f81008baac ("RDMA/bnxt_re: expose detailed stats retrieved from HW")
+Link: https://lore.kernel.org/r/20190911092856.11146-1-colin.king@canonical.com
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/bnxt_re/hw_counters.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/bnxt_re/hw_counters.c
++++ b/drivers/infiniband/hw/bnxt_re/hw_counters.c
+@@ -72,7 +72,7 @@ static const char * const bnxt_re_stat_n
+ [BNXT_RE_SEQ_ERR_NAKS_RCVD] = "seq_err_naks_rcvd",
+ [BNXT_RE_MAX_RETRY_EXCEEDED] = "max_retry_exceeded",
+ [BNXT_RE_RNR_NAKS_RCVD] = "rnr_naks_rcvd",
+- [BNXT_RE_MISSING_RESP] = "missin_resp",
++ [BNXT_RE_MISSING_RESP] = "missing_resp",
+ [BNXT_RE_UNRECOVERABLE_ERR] = "unrecoverable_err",
+ [BNXT_RE_BAD_RESP_ERR] = "bad_resp_err",
+ [BNXT_RE_LOCAL_QP_OP_ERR] = "local_qp_op_err",
diff --git a/patches.suse/blk-wbt-abstract-out-end-IO-completion-handler.patch b/patches.suse/blk-wbt-abstract-out-end-IO-completion-handler.patch
new file mode 100644
index 0000000000..92e18d5a9f
--- /dev/null
+++ b/patches.suse/blk-wbt-abstract-out-end-IO-completion-handler.patch
@@ -0,0 +1,57 @@
+From 061a5427530633de93ace4ef001b99961984af62 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sun, 26 Aug 2018 10:09:06 -0600
+Subject: [PATCH] blk-wbt: abstract out end IO completion handler
+Git-commit: 061a5427530633de93ace4ef001b99961984af62
+Patch-mainline: v4.19-rc2
+References: bsc#1135873
+
+Prep patch for calling the handler from a different context,
+no functional changes in this patch.
+
+Tested-by: Agarwal, Anchal <anchalag@amazon.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ block/blk-wbt.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -118,15 +118,11 @@ static void rwb_wake_all(struct rq_wb *r
+ }
+ }
+
+-void __wbt_done(struct rq_wb *rwb, enum wbt_flags wb_acct)
++static void wbt_rqw_done(struct rq_wb *rwb, struct rq_wait *rqw,
++ enum wbt_flags wb_acct)
+ {
+- struct rq_wait *rqw;
+ int inflight, limit;
+
+- if (!(wb_acct & WBT_TRACKED))
+- return;
+-
+- rqw = get_rq_wait(rwb, wb_acct);
+ inflight = atomic_dec_return(&rqw->inflight);
+
+ /*
+@@ -161,6 +157,17 @@ void __wbt_done(struct rq_wb *rwb, enum
+ }
+ }
+
++void __wbt_done(struct rq_wb *rwb, enum wbt_flags wb_acct)
++{
++ struct rq_wait *rqw;
++
++ if (!(wb_acct & WBT_TRACKED))
++ return;
++
++ rqw = get_rq_wait(rwb, wb_acct);
++ wbt_rqw_done(rwb, rqw, wb_acct);
++}
++
+ /*
+ * Called on completion of a request. Note that it's also called when
+ * a request is merged, when the request gets freed.
diff --git a/patches.suse/blk-wbt-fix-has-sleeper-queueing-check.patch b/patches.suse/blk-wbt-fix-has-sleeper-queueing-check.patch
new file mode 100644
index 0000000000..367ee0e422
--- /dev/null
+++ b/patches.suse/blk-wbt-fix-has-sleeper-queueing-check.patch
@@ -0,0 +1,51 @@
+From c45e6a037a536530bd25781ac7c989e52deb2a63 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 20 Aug 2018 13:22:27 -0600
+Subject: [PATCH] blk-wbt: fix has-sleeper queueing check
+Git-commit: c45e6a037a536530bd25781ac7c989e52deb2a63
+Patch-mainline: v4.19-rc1
+References: bsc#1135873
+
+We need to do this inside the loop as well, or we can allow new
+IO to supersede previous IO.
+
+Tested-by: Anchal Agarwal <anchalag@amazon.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ block/blk-wbt.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -519,8 +519,10 @@ static void __wbt_wait(struct rq_wb *rwb
+ {
+ struct rq_wait *rqw = get_rq_wait(rwb, wb_acct);
+ DECLARE_WAITQUEUE(wait, current);
++ bool has_sleeper;
+
+- if (!wq_has_sleeper(&rqw->wait) &&
++ has_sleeper = wq_has_sleeper(&rqw->wait);
++ if (!has_sleeper &&
+ atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
+ return;
+
+@@ -528,7 +530,8 @@ static void __wbt_wait(struct rq_wb *rwb
+ do {
+ set_current_state(TASK_UNINTERRUPTIBLE);
+
+- if (atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
++ if (!has_sleeper &&
++ atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
+ break;
+
+ if (lock) {
+@@ -537,6 +540,7 @@ static void __wbt_wait(struct rq_wb *rwb
+ spin_lock_irq(lock);
+ } else
+ io_schedule();
++ has_sleeper = false;
+ } while (1);
+
+ __set_current_state(TASK_RUNNING);
diff --git a/patches.suse/blk-wbt-improve-waking-of-tasks.patch b/patches.suse/blk-wbt-improve-waking-of-tasks.patch
new file mode 100644
index 0000000000..915f4e3268
--- /dev/null
+++ b/patches.suse/blk-wbt-improve-waking-of-tasks.patch
@@ -0,0 +1,140 @@
+From 38cfb5a45ee013bfab5d1ae4c4738815e744b440 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sun, 26 Aug 2018 10:10:05 -0600
+Subject: [PATCH] blk-wbt: improve waking of tasks
+Git-commit: 38cfb5a45ee013bfab5d1ae4c4738815e744b440
+Patch-mainline: v4.19-rc2
+References: bsc#1135873
+
+We have two potential issues:
+
+1) After commit 2887e41b910b, we only wake one process at the time when
+ we finish an IO. We really want to wake up as many tasks as can
+ queue IO. Before this commit, we woke up everyone, which could cause
+ a thundering herd issue.
+
+2) A task can potentially consume two wakeups, causing us to (in
+ practice) miss a wakeup.
+
+Fix both by providing our own wakeup function, which stops
+__wake_up_common() from waking up more tasks if we fail to get a
+queueing token. With the strict ordering we have on the wait list, this
+wakes the right tasks and the right amount of tasks.
+
+Based on a patch from Jianchao Wang <jianchao.w.wang@oracle.com>.
+
+Tested-by: Agarwal, Anchal <anchalag@amazon.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ block/blk-wbt.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 56 insertions(+), 6 deletions(-)
+
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -153,7 +152,7 @@ static void wbt_rqw_done(struct rq_wb *r
+ int diff = limit - inflight;
+
+ if (!inflight || diff >= rwb->wb_background / 2)
+- wake_up(&rqw->wait);
++ wake_up_all(&rqw->wait);
+ }
+ }
+
+@@ -516,6 +515,35 @@ static inline unsigned int get_limit(str
+ return limit;
+ }
+
++struct wbt_wait_data {
++ struct wait_queue_entry wq;
++ struct task_struct *task;
++ struct rq_wb *rwb;
++ struct rq_wait *rqw;
++ unsigned long rw;
++ bool got_token;
++};
++
++static int wbt_wake_function(struct wait_queue_entry *curr, unsigned int mode,
++ int wake_flags, void *key)
++{
++ struct wbt_wait_data *data = container_of(curr, struct wbt_wait_data,
++ wq);
++
++ /*
++ * If we fail to get a budget, return -1 to interrupt the wake up
++ * loop in __wake_up_common.
++ */
++ if (!atomic_inc_below(&data->rqw->inflight,
++ get_limit(data->rwb, data->rw)))
++ return -1;
++
++ data->got_token = true;
++ list_del_init(&curr->entry);
++ wake_up_process(data->task);
++ return 1;
++}
++
+ /*
+ * Block if we will exceed our limit, or if we are currently waiting for
+ * the timer to kick off queuing again.
+@@ -525,7 +553,16 @@ static void __wbt_wait(struct rq_wb *rwb
+ __acquires(lock)
+ {
+ struct rq_wait *rqw = get_rq_wait(rwb, wb_acct);
+- DECLARE_WAITQUEUE(wait, current);
++ struct wbt_wait_data data = {
++ .wq = {
++ .func = wbt_wake_function,
++ .entry = LIST_HEAD_INIT(data.wq.entry),
++ },
++ .task = current,
++ .rwb = rwb,
++ .rqw = rqw,
++ .rw = rw,
++ };
+ bool has_sleeper;
+
+ has_sleeper = wq_has_sleeper(&rqw->wait);
+@@ -533,13 +570,25 @@ static void __wbt_wait(struct rq_wb *rwb
+ atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
+ return;
+
+- add_wait_queue_exclusive(&rqw->wait, &wait);
++ prepare_to_wait_exclusive(&rqw->wait, &data.wq, TASK_UNINTERRUPTIBLE);
+ do {
+ set_current_state(TASK_UNINTERRUPTIBLE);
++ if (data.got_token)
++ break;
+
+ if (!has_sleeper &&
+- atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
++ atomic_inc_below(&rqw->inflight, get_limit(rwb, rw))) {
++ finish_wait(&rqw->wait, &data.wq);
++
++ /*
++ * We raced with wbt_wake_function() getting a token,
++ * which means we now have two. Put our local token
++ * and wake anyone else potentially waiting for one.
++ */
++ if (data.got_token)
++ wbt_rqw_done(rwb, rqw, wb_acct);
+ break;
++ }
+
+ if (lock) {
+ spin_unlock_irq(lock);
+@@ -547,11 +596,11 @@ static void __wbt_wait(struct rq_wb *rwb
+ spin_lock_irq(lock);
+ } else
+ io_schedule();
++
+ has_sleeper = false;
+ } while (1);
+
+- __set_current_state(TASK_RUNNING);
+- remove_wait_queue(&rqw->wait, &wait);
++ finish_wait(&rqw->wait, &data.wq);
+ }
+
+ static inline bool wbt_should_throttle(struct rq_wb *rwb, struct bio *bio)
diff --git a/patches.suse/blk-wbt-move-disable-check-into-get_limit.patch b/patches.suse/blk-wbt-move-disable-check-into-get_limit.patch
new file mode 100644
index 0000000000..5d731f2482
--- /dev/null
+++ b/patches.suse/blk-wbt-move-disable-check-into-get_limit.patch
@@ -0,0 +1,64 @@
+From ffa358dcaae1f2f00926484e712e06daa8953cb4 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 20 Aug 2018 13:24:25 -0600
+Subject: [PATCH] blk-wbt: move disable check into get_limit()
+Git-commit: ffa358dcaae1f2f00926484e712e06daa8953cb4
+Patch-mainline: v4.19-rc1
+References: bsc#1135873
+
+Check it in one place, instead of in multiple places.
+
+Tested-by: Anchal Agarwal <anchalag@amazon.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ block/blk-wbt.c | 23 +++++++----------------
+ 1 file changed, 7 insertions(+), 16 deletions(-)
+
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -481,6 +481,13 @@ static inline unsigned int get_limit(str
+ {
+ unsigned int limit;
+
++ /*
++ * If we got disabled, just return UINT_MAX. This ensures that
++ * we'll properly inc a new IO, and dec+wakeup at the end.
++ */
++ if (!rwb_enabled(rwb))
++ return UINT_MAX;
++
+ if ((rw & REQ_OP_MASK) == REQ_OP_DISCARD)
+ return rwb->wb_background;
+
+@@ -513,16 +520,6 @@ static void __wbt_wait(struct rq_wb *rwb
+ struct rq_wait *rqw = get_rq_wait(rwb, wb_acct);
+ DECLARE_WAITQUEUE(wait, current);
+
+- /*
+- * inc it here even if disabled, since we'll dec it at completion.
+- * this only happens if the task was sleeping in __wbt_wait(),
+- * and someone turned it off at the same time.
+- */
+- if (!rwb_enabled(rwb)) {
+- atomic_inc(&rqw->inflight);
+- return;
+- }
+-
+ if (!waitqueue_active(&rqw->wait)
+ && atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
+ return;
+@@ -531,12 +528,6 @@ static void __wbt_wait(struct rq_wb *rwb
+ do {
+ set_current_state(TASK_UNINTERRUPTIBLE);
+
+- if (!rwb_enabled(rwb)) {
+- atomic_inc(&rqw->inflight);
+- break;
+- }
+-
+-
+ if (atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
+ break;
+
diff --git a/patches.suse/blk-wbt-use-wq_has_sleeper-for-wq-active-check.patch b/patches.suse/blk-wbt-use-wq_has_sleeper-for-wq-active-check.patch
new file mode 100644
index 0000000000..1449a79a3e
--- /dev/null
+++ b/patches.suse/blk-wbt-use-wq_has_sleeper-for-wq-active-check.patch
@@ -0,0 +1,51 @@
+From b78820937b4762b7d30b807d7156bec1d89e4dd3 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Mon, 20 Aug 2018 13:20:50 -0600
+Subject: [PATCH] blk-wbt: use wq_has_sleeper() for wq active check
+Git-commit: b78820937b4762b7d30b807d7156bec1d89e4dd3
+Patch-mainline: v4.19-rc1
+References: bsc#1135873
+
+We need the memory barrier before checking the list head,
+use the appropriate helper for this. The matching queue
+side memory barrier is provided by set_current_state().
+
+Tested-by: Anchal Agarwal <anchalag@amazon.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Jan Kara <jack@suse.cz>
+
+---
+ block/blk-wbt.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/block/blk-wbt.c
++++ b/block/blk-wbt.c
+@@ -113,7 +113,7 @@ static void rwb_wake_all(struct rq_wb *r
+ for (i = 0; i < WBT_NUM_RWQ; i++) {
+ struct rq_wait *rqw = &rwb->rq_wait[i];
+
+- if (waitqueue_active(&rqw->wait))
++ if (wq_has_sleeper(&rqw->wait))
+ wake_up_all(&rqw->wait);
+ }
+ }
+@@ -153,7 +153,7 @@ void __wbt_done(struct rq_wb *rwb, enum
+ if (inflight && inflight >= limit)
+ return;
+
+- if (waitqueue_active(&rqw->wait)) {
++ if (wq_has_sleeper(&rqw->wait)) {
+ int diff = limit - inflight;
+
+ if (!inflight || diff >= rwb->wb_background / 2)
+@@ -520,8 +520,8 @@ static void __wbt_wait(struct rq_wb *rwb
+ struct rq_wait *rqw = get_rq_wait(rwb, wb_acct);
+ DECLARE_WAITQUEUE(wait, current);
+
+- if (!waitqueue_active(&rqw->wait)
+- && atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
++ if (!wq_has_sleeper(&rqw->wait) &&
++ atomic_inc_below(&rqw->inflight, get_limit(rwb, rw)))
+ return;
+
+ add_wait_queue_exclusive(&rqw->wait, &wait);
diff --git a/patches.suse/block-add-io-timeout-to-sysfs.patch b/patches.suse/block-add-io-timeout-to-sysfs.patch
new file mode 100644
index 0000000000..ba2d22e571
--- /dev/null
+++ b/patches.suse/block-add-io-timeout-to-sysfs.patch
@@ -0,0 +1,73 @@
+From 65cd1d13b880920054d6c750679baa80b7f9c072 Mon Sep 17 00:00:00 2001
+From: Weiping Zhang <zhangweiping@didiglobal.com>
+Date: Thu, 29 Nov 2018 00:04:39 +0800
+Subject: [PATCH] block: add io timeout to sysfs
+References: bsc#1148410
+Git-commit: 65cd1d13b880920054d6c750679baa80b7f9c072
+Patch-mainline: v5.0-rc1
+
+Give a interface to adjust io timeout(ms) by device.
+
+Signed-off-by: Weiping Zhang <zhangweiping@didiglobal.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Thomas Abraham <tabraham@suse.com>
+[tabraham@suse.com: handled backport. modified for context]
+---
+ block/blk-sysfs.c | 27 +++++++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 80eef48fddc8..9f0cb370b39b 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -417,6 +417,26 @@ static ssize_t queue_poll_store(struct request_queue *q, const char *page,
+ return ret;
+ }
+
++static ssize_t queue_io_timeout_show(struct request_queue *q, char *page)
++{
++ return sprintf(page, "%u\n", jiffies_to_msecs(q->rq_timeout));
++}
++
++static ssize_t queue_io_timeout_store(struct request_queue *q, const char *page,
++ size_t count)
++{
++ unsigned int val;
++ int err;
++
++ err = kstrtou32(page, 10, &val);
++ if (err || val == 0)
++ return -EINVAL;
++
++ blk_queue_rq_timeout(q, msecs_to_jiffies(val));
++
++ return count;
++}
++
+ static ssize_t queue_wb_lat_show(struct request_queue *q, char *page)
+ {
+ if (!q->rq_wb)
+@@ -685,6 +705,12 @@ static struct queue_sysfs_entry queue_dax_entry = {
+ .show = queue_dax_show,
+ };
+
++static struct queue_sysfs_entry queue_io_timeout_entry = {
++ .attr = {.name = "io_timeout", .mode = 0644 },
++ .show = queue_io_timeout_show,
++ .store = queue_io_timeout_store,
++};
++
+ static struct queue_sysfs_entry queue_wb_lat_entry = {
+ .attr = {.name = "wbt_lat_usec", .mode = 0644 },
+ .show = queue_wb_lat_show,
+@@ -734,6 +760,7 @@ static struct attribute *default_attrs[] = {
+ &queue_dax_entry.attr,
+ &queue_wb_lat_entry.attr,
+ &queue_poll_delay_entry.attr,
++ &queue_io_timeout_entry.attr,
+ #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
+ &throtl_sample_time_entry.attr,
+ #endif
+--
+2.16.4
+
diff --git a/patches.suse/block-don-t-show-io_timeout-if-driver-has-no-timeout.patch b/patches.suse/block-don-t-show-io_timeout-if-driver-has-no-timeout.patch
new file mode 100644
index 0000000000..62e2e74ea1
--- /dev/null
+++ b/patches.suse/block-don-t-show-io_timeout-if-driver-has-no-timeout.patch
@@ -0,0 +1,85 @@
+From 4d25339e32a1b6e1f490bb78b1e5b0fa9eb3e073 Mon Sep 17 00:00:00 2001
+From: Weiping Zhang <zhangweiping@didiglobal.com>
+Date: Tue, 2 Apr 2019 21:14:30 +0800
+Subject: [PATCH] block: don't show io_timeout if driver has no timeout handler
+References: bsc#1148410
+Git-commit: 4d25339e32a1b6e1f490bb78b1e5b0fa9eb3e073
+Patch-mainline: v5.2-rc1
+
+If the low level driver has no timeout handler, the
+/sys/block/<disk>/queue/io_timeout will not be displayed.
+
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Weiping Zhang <zhangweiping@didiglobal.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Thomas Abraham <tabraham@suse.com>
+[tabraham@suse.com: handled backport. modified for context]
+---
+ block/blk-sysfs.c | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index 422327089e0f..a16a02c52a85 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -728,7 +728,7 @@ static struct queue_sysfs_entry throtl_sample_time_entry = {
+ };
+ #endif
+
+-static struct attribute *default_attrs[] = {
++static struct attribute *queue_attrs[] = {
+ &queue_requests_entry.attr,
+ &queue_ra_entry.attr,
+ &queue_max_hw_sectors_entry.attr,
+@@ -770,6 +770,25 @@ static struct attribute *default_attrs[] = {
+ NULL,
+ };
+
++static umode_t queue_attr_visible(struct kobject *kobj, struct attribute *attr,
++ int n)
++{
++ struct request_queue *q =
++ container_of(kobj, struct request_queue, kobj);
++
++ if (attr == &queue_io_timeout_entry.attr &&
++ (!q->mq_ops || !q->mq_ops->timeout))
++ return 0;
++
++ return attr->mode;
++}
++
++static struct attribute_group queue_attr_group = {
++ .attrs = queue_attrs,
++ .is_visible = queue_attr_visible,
++};
++
++
+ #define to_queue(atr) container_of((atr), struct queue_sysfs_entry, attr)
+
+ static ssize_t
+@@ -890,7 +909,6 @@ static const struct sysfs_ops queue_sysfs_ops = {
+
+ struct kobj_type blk_queue_ktype = {
+ .sysfs_ops = &queue_sysfs_ops,
+- .default_attrs = default_attrs,
+ .release = blk_release_queue,
+ };
+
+@@ -939,6 +957,14 @@ int blk_register_queue(struct gendisk *disk)
+ goto unlock;
+ }
+
++ ret = sysfs_create_group(&q->kobj, &queue_attr_group);
++ if (ret) {
++ blk_trace_remove_sysfs(dev);
++ kobject_del(&q->kobj);
++ kobject_put(&dev->kobj);
++ goto unlock;
++ }
++
+ if (q->mq_ops) {
+ __blk_mq_register_dev(dev, q);
+ blk_mq_debugfs_register(q);
+--
+2.16.4
+
diff --git a/patches.suse/bnx2x-Fix-VF-s-VLAN-reconfiguration-in-reload.patch b/patches.suse/bnx2x-Fix-VF-s-VLAN-reconfiguration-in-reload.patch
new file mode 100644
index 0000000000..4b543d4b4a
--- /dev/null
+++ b/patches.suse/bnx2x-Fix-VF-s-VLAN-reconfiguration-in-reload.patch
@@ -0,0 +1,96 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Sun, 18 Aug 2019 07:25:48 -0700
+Subject: bnx2x: Fix VF's VLAN reconfiguration in reload.
+Patch-mainline: v5.3-rc6
+Git-commit: 4a4d2d372fb9b9229327e2ed01d5d9572eddf4de
+References: bsc#1086323 FATE#324899
+
+Commit 04f05230c5c13 ("bnx2x: Remove configured vlans as
+part of unload sequence."), introduced a regression in driver
+that as a part of VF's reload flow, VLANs created on the VF
+doesn't get re-configured in hardware as vlan metadata/info
+was not getting cleared for the VFs which causes vlan PING to stop.
+
+This patch clears the vlan metadata/info so that VLANs gets
+re-configured back in the hardware in VF's reload flow and
+PING/traffic continues for VLANs created over the VFs.
+
+Fixes: 04f05230c5c13 ("bnx2x: Remove configured vlans as part of unload sequence.")
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Sudarsana Kalluru <skalluru@marvell.com>
+Signed-off-by: Shahed Shaikh <shshaikh@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 7 ++++---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 ++
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 17 ++++++++++++-----
+ 3 files changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+@@ -3056,12 +3056,13 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
+ /* if VF indicate to PF this function is going down (PF will delete sp
+ * elements and clear initializations
+ */
+- if (IS_VF(bp))
++ if (IS_VF(bp)) {
++ bnx2x_clear_vlan_info(bp);
+ bnx2x_vfpf_close_vf(bp);
+- else if (unload_mode != UNLOAD_RECOVERY)
++ } else if (unload_mode != UNLOAD_RECOVERY) {
+ /* if this is a normal/close unload need to clean up chip*/
+ bnx2x_chip_cleanup(bp, unload_mode, keep_link);
+- else {
++ } else {
+ /* Send the UNLOAD_REQUEST to the MCP */
+ bnx2x_send_unload_req(bp, unload_mode);
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+@@ -425,6 +425,8 @@ void bnx2x_set_reset_global(struct bnx2x
+ void bnx2x_disable_close_the_gate(struct bnx2x *bp);
+ int bnx2x_init_hw_func_cnic(struct bnx2x *bp);
+
++void bnx2x_clear_vlan_info(struct bnx2x *bp);
++
+ /**
+ * bnx2x_sp_event - handle ramrods completion.
+ *
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -8488,11 +8488,21 @@ int bnx2x_set_vlan_one(struct bnx2x *bp,
+ return rc;
+ }
+
++void bnx2x_clear_vlan_info(struct bnx2x *bp)
++{
++ struct bnx2x_vlan_entry *vlan;
++
++ /* Mark that hw forgot all entries */
++ list_for_each_entry(vlan, &bp->vlan_reg, link)
++ vlan->hw = false;
++
++ bp->vlan_cnt = 0;
++}
++
+ static int bnx2x_del_all_vlans(struct bnx2x *bp)
+ {
+ struct bnx2x_vlan_mac_obj *vlan_obj = &bp->sp_objs[0].vlan_obj;
+ unsigned long ramrod_flags = 0, vlan_flags = 0;
+- struct bnx2x_vlan_entry *vlan;
+ int rc;
+
+ __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+@@ -8501,10 +8511,7 @@ static int bnx2x_del_all_vlans(struct bn
+ if (rc)
+ return rc;
+
+- /* Mark that hw forgot all entries */
+- list_for_each_entry(vlan, &bp->vlan_reg, link)
+- vlan->hw = false;
+- bp->vlan_cnt = 0;
++ bnx2x_clear_vlan_info(bp);
+
+ return 0;
+ }
diff --git a/patches.suse/bridge-mdb-remove-wrong-use-of-NLM_F_MULTI.patch b/patches.suse/bridge-mdb-remove-wrong-use-of-NLM_F_MULTI.patch
new file mode 100644
index 0000000000..f6e468ded0
--- /dev/null
+++ b/patches.suse/bridge-mdb-remove-wrong-use-of-NLM_F_MULTI.patch
@@ -0,0 +1,33 @@
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Fri, 6 Sep 2019 11:47:02 +0200
+Subject: bridge/mdb: remove wrong use of NLM_F_MULTI
+Git-commit: 94a72b3f024fc7e9ab640897a1e38583a470659d
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+NLM_F_MULTI must be used only when a NLMSG_DONE message is sent at the end.
+In fact, NLMSG_DONE is sent only at the end of a dump.
+
+Libraries like libnl will wait forever for NLMSG_DONE.
+
+Fixes: 949f1e39a617 ("bridge: mdb: notify on router port add and del")
+CC: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/bridge/br_mdb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_mdb.c
++++ b/net/bridge/br_mdb.c
+@@ -372,7 +372,7 @@ static int nlmsg_populate_rtr_fill(struc
+ struct nlmsghdr *nlh;
+ struct nlattr *nest;
+
+- nlh = nlmsg_put(skb, pid, seq, type, sizeof(*bpm), NLM_F_MULTI);
++ nlh = nlmsg_put(skb, pid, seq, type, sizeof(*bpm), 0);
+ if (!nlh)
+ return -EMSGSIZE;
+
diff --git a/patches.suse/btrfs-bail-out-gracefully-rather-than-bug_on.patch b/patches.suse/btrfs-bail-out-gracefully-rather-than-bug_on.patch
new file mode 100644
index 0000000000..e6f2ea8aa2
--- /dev/null
+++ b/patches.suse/btrfs-bail-out-gracefully-rather-than-bug_on.patch
@@ -0,0 +1,51 @@
+From: Liu Bo <bo.li.liu@oracle.com>
+Date: Mon, 30 Oct 2017 11:14:38 -0600
+Subject: Btrfs: bail out gracefully rather than BUG_ON
+Git-commit: 56a0e706fcf870270878d6d72b71092ae42d229c
+Patch-mainline: v4.15-rc2
+References: bsc#1153646
+
+If a file's DIR_ITEM key is invalid (due to memory errors) and gets
+written to disk, a future lookup_path can end up with kernel panic due
+to BUG_ON().
+
+This gets rid of the BUG_ON(), meanwhile output the corrupted key and
+return ENOENT if it's invalid.
+
+Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
+Reported-by: Guillaume Bouchard <bouchard@mercs-eng.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/inode.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 8525a44a607e..1131db7a0b28 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5445,6 +5445,14 @@ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
+ goto out_err;
+
+ btrfs_dir_item_key_to_cpu(path->nodes[0], di, location);
++ if (location->type != BTRFS_INODE_ITEM_KEY &&
++ location->type != BTRFS_ROOT_ITEM_KEY) {
++ btrfs_warn(root->fs_info,
++"%s gets something invalid in DIR_ITEM (name %s, directory ino %llu, location(%llu %u %llu))",
++ __func__, name, btrfs_ino(BTRFS_I(dir)),
++ location->objectid, location->type, location->offset);
++ goto out_err;
++ }
+ out:
+ btrfs_free_path(path);
+ return ret;
+@@ -5761,8 +5769,6 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
+ return inode;
+ }
+
+- BUG_ON(location.type != BTRFS_ROOT_ITEM_KEY);
+-
+ index = srcu_read_lock(&fs_info->subvol_srcu);
+ ret = fixup_tree_root_location(fs_info, dir, dentry,
+ &location, &sub_root);
+
diff --git a/patches.suse/cdc_ether-fix-rndis-support-for-Mediatek-based-smart.patch b/patches.suse/cdc_ether-fix-rndis-support-for-Mediatek-based-smart.patch
new file mode 100644
index 0000000000..cde0393ed3
--- /dev/null
+++ b/patches.suse/cdc_ether-fix-rndis-support-for-Mediatek-based-smart.patch
@@ -0,0 +1,104 @@
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Thu, 12 Sep 2019 10:42:00 +0200
+Subject: cdc_ether: fix rndis support for Mediatek based smartphones
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 4d7ffcf3bf1be98d876c570cab8fc31d9fa92725
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+A Mediatek based smartphone owner reports problems with USB
+tethering in Linux. The verbose USB listing shows a rndis_host
+interface pair (e0/01/03 + 10/00/00), but the driver fails to
+bind with
+
+[ 355.960428] usb 1-4: bad CDC descriptors
+
+The problem is a failsafe test intended to filter out ACM serial
+functions using the same 02/02/ff class/subclass/protocol as RNDIS.
+The serial functions are recognized by their non-zero bmCapabilities.
+
+No RNDIS function with non-zero bmCapabilities were known at the time
+this failsafe was added. But it turns out that some Wireless class
+RNDIS functions are using the bmCapabilities field. These functions
+are uniquely identified as RNDIS by their class/subclass/protocol, so
+the failing test can safely be disabled. The same applies to the two
+types of Misc class RNDIS functions.
+
+Applying the failsafe to Communication class functions only retains
+the original functionality, and fixes the problem for the Mediatek based
+smartphone.
+
+Tow examples of CDC functional descriptors with non-zero bmCapabilities
+from Wireless class RNDIS functions are:
+
+0e8d:000a Mediatek Crosscall Spider X5 3G Phone
+
+ CDC Header:
+ bcdCDC 1.10
+ CDC ACM:
+ bmCapabilities 0x0f
+ connection notifications
+ sends break
+ line coding and serial state
+ get/set/clear comm features
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 1
+
+and
+
+19d2:1023 ZTE K4201-z
+
+ CDC Header:
+ bcdCDC 1.10
+ CDC ACM:
+ bmCapabilities 0x02
+ line coding and serial state
+ CDC Call Management:
+ bmCapabilities 0x03
+ call management
+ use DataInterface
+ bDataInterface 1
+ CDC Union:
+ bMasterInterface 0
+ bSlaveInterface 1
+
+The Mediatek example is believed to apply to most smartphones with
+Mediatek firmware. The ZTE example is most likely also part of a larger
+family of devices/firmwares.
+
+Suggested-by: Lars Melin <larsm17@gmail.com>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/usb/cdc_ether.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -212,8 +212,15 @@ int usbnet_generic_cdc_bind(struct usbne
+ goto bad_desc;
+ }
+ skip:
+- if ( rndis &&
+- header.usb_cdc_acm_descriptor &&
++ /* Communcation class functions with bmCapabilities are not
++ * RNDIS. But some Wireless class RNDIS functions use
++ * bmCapabilities for their own purpose. The failsafe is
++ * therefore applied only to Communication class RNDIS
++ * functions. The rndis test is redundant, but a cheap
++ * optimization.
++ */
++ if (rndis && is_rndis(&intf->cur_altsetting->desc) &&
++ header.usb_cdc_acm_descriptor &&
+ header.usb_cdc_acm_descriptor->bmCapabilities) {
+ dev_dbg(&intf->dev,
+ "ACM capabilities %02x, not really RNDIS?\n",
diff --git a/patches.suse/ceph-fix-directories-inode-i_blkbits-initialization.patch b/patches.suse/ceph-fix-directories-inode-i_blkbits-initialization.patch
new file mode 100644
index 0000000000..d91eb470fc
--- /dev/null
+++ b/patches.suse/ceph-fix-directories-inode-i_blkbits-initialization.patch
@@ -0,0 +1,46 @@
+From: Luis Henriques <lhenriques@suse.com>
+Date: Tue, 23 Jul 2019 16:50:20 +0100
+Subject: ceph: fix directories inode i_blkbits initialization
+Git-commit: 750670341a24cb714e624e0fd7da30900ad93752
+Patch-mainline: v5.4-rc1
+References: bsc#1153717
+
+When filling an inode with info from the MDS, i_blkbits is being
+initialized using fl_stripe_unit, which contains the stripe unit in
+bytes. Unfortunately, this doesn't make sense for directories as they
+have fl_stripe_unit set to '0'. This means that i_blkbits will be set
+to 0xff, causing an UBSAN undefined behaviour in i_blocksize():
+
+ UBSAN: Undefined behaviour in ./include/linux/fs.h:731:12
+ shift exponent 255 is too large for 32-bit type 'int'
+
+Fix this by initializing i_blkbits to CEPH_BLOCK_SHIFT if fl_stripe_unit
+is zero.
+
+Signed-off-by: Luis Henriques <lhenriques@suse.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+
+---
+ fs/ceph/inode.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 18500edefc56..3b537e7038c7 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -801,7 +801,12 @@ static int fill_inode(struct inode *inode, struct page *locked_page,
+
+ /* update inode */
+ inode->i_rdev = le32_to_cpu(info->rdev);
+- inode->i_blkbits = fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
++ /* directories have fl_stripe_unit set to zero */
++ if (le32_to_cpu(info->layout.fl_stripe_unit))
++ inode->i_blkbits =
++ fls(le32_to_cpu(info->layout.fl_stripe_unit)) - 1;
++ else
++ inode->i_blkbits = CEPH_BLOCK_SHIFT;
+
+ __ceph_update_quota(ci, iinfo->max_bytes, iinfo->max_files);
+
+
diff --git a/patches.suse/ceph-reconnect-connection-if-session-hang-in-opening-state.patch b/patches.suse/ceph-reconnect-connection-if-session-hang-in-opening-state.patch
new file mode 100644
index 0000000000..b1c92fb006
--- /dev/null
+++ b/patches.suse/ceph-reconnect-connection-if-session-hang-in-opening-state.patch
@@ -0,0 +1,43 @@
+From: Erqi Chen <chenerqi@gmail.com>
+Date: Wed, 28 Aug 2019 21:22:45 +0800
+Subject: ceph: reconnect connection if session hang in opening state
+Git-commit: 71a228bc8d65900179e37ac309e678f8c523f133
+Patch-mainline: v5.4-rc1
+References: bsc#1153718
+
+If client mds session is evicted in CEPH_MDS_SESSION_OPENING state,
+mds won't send session msg to client, and delayed_work skip
+CEPH_MDS_SESSION_OPENING state session, the session hang forever.
+
+Allow ceph_con_keepalive to reconnect a session in OPENING to avoid
+session hang. Also, ensure that we skip sessions in RESTARTING and
+REJECTED states since those states can't be resurrected by issuing
+a keepalive.
+
+Link: https://tracker.ceph.com/issues/41551
+Signed-off-by: Erqi Chen chenerqi@gmail.com
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+
+---
+ fs/ceph/mds_client.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 959dcf2ab0b8..a8a8f84f3bbf 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -4088,7 +4088,9 @@ static void delayed_work(struct work_struct *work)
+ pr_info("mds%d hung\n", s->s_mds);
+ }
+ }
+- if (s->s_state < CEPH_MDS_SESSION_OPEN) {
++ if (s->s_state == CEPH_MDS_SESSION_NEW ||
++ s->s_state == CEPH_MDS_SESSION_RESTARTING ||
++ s->s_state == CEPH_MDS_SESSION_REJECTED) {
+ /* this mds is failed or recovering, just wait */
+ ceph_put_mds_session(s);
+ continue;
+
diff --git a/patches.suse/ceph-update-the-mtime-when-truncating-up.patch b/patches.suse/ceph-update-the-mtime-when-truncating-up.patch
new file mode 100644
index 0000000000..68610b2738
--- /dev/null
+++ b/patches.suse/ceph-update-the-mtime-when-truncating-up.patch
@@ -0,0 +1,88 @@
+From: Jeff Layton <jlayton@kernel.org>
+Date: Thu, 25 Jul 2019 13:03:32 -0400
+Subject: ceph: update the mtime when truncating up
+Git-commit: c62498d7f9d37d5e60d61ca2a4e1f88211af7645
+Patch-mainline: v5.4-rc1
+References: bsc#1153719
+
+If we have Fx caps, and the we're truncating the size to be larger, then
+we'll cache the size attribute change, but the mtime won't be updated.
+
+Move the size handling before the mtime, and add ATTR_MTIME to ia_valid
+in that case to make sure the mtime also gets updated.
+
+This fixes xfstest generic/313.
+
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+
+---
+ fs/ceph/inode.c | 41 +++++++++++++++++++++--------------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1966,7 +1966,7 @@ static const struct inode_operations cep
+ int __ceph_setattr(struct inode *inode, struct iattr *attr)
+ {
+ struct ceph_inode_info *ci = ceph_inode(inode);
+- const unsigned int ia_valid = attr->ia_valid;
++ unsigned int ia_valid = attr->ia_valid;
+ struct ceph_mds_request *req;
+ struct ceph_mds_client *mdsc = ceph_sb_to_client(inode->i_sb)->mdsc;
+ struct ceph_cap_flush *prealloc_cf;
+@@ -2071,6 +2071,26 @@ int __ceph_setattr(struct inode *inode,
+ CEPH_CAP_FILE_RD | CEPH_CAP_FILE_WR;
+ }
+ }
++ if (ia_valid & ATTR_SIZE) {
++ dout("setattr %p size %lld -> %lld\n", inode,
++ inode->i_size, attr->ia_size);
++ if ((issued & CEPH_CAP_FILE_EXCL) &&
++ attr->ia_size > inode->i_size) {
++ i_size_write(inode, attr->ia_size);
++ inode->i_blocks = calc_inode_blocks(attr->ia_size);
++ ci->i_reported_size = attr->ia_size;
++ dirtied |= CEPH_CAP_FILE_EXCL;
++ ia_valid |= ATTR_MTIME;
++ } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
++ attr->ia_size != inode->i_size) {
++ req->r_args.setattr.size = cpu_to_le64(attr->ia_size);
++ req->r_args.setattr.old_size =
++ cpu_to_le64(inode->i_size);
++ mask |= CEPH_SETATTR_SIZE;
++ release |= CEPH_CAP_FILE_SHARED | CEPH_CAP_FILE_EXCL |
++ CEPH_CAP_FILE_RD | CEPH_CAP_FILE_WR;
++ }
++ }
+ if (ia_valid & ATTR_MTIME) {
+ dout("setattr %p mtime %ld.%ld -> %ld.%ld\n", inode,
+ inode->i_mtime.tv_sec, inode->i_mtime.tv_nsec,
+@@ -2093,25 +2113,6 @@ int __ceph_setattr(struct inode *inode,
+ CEPH_CAP_FILE_RD | CEPH_CAP_FILE_WR;
+ }
+ }
+- if (ia_valid & ATTR_SIZE) {
+- dout("setattr %p size %lld -> %lld\n", inode,
+- inode->i_size, attr->ia_size);
+- if ((issued & CEPH_CAP_FILE_EXCL) &&
+- attr->ia_size > inode->i_size) {
+- i_size_write(inode, attr->ia_size);
+- inode->i_blocks = calc_inode_blocks(attr->ia_size);
+- ci->i_reported_size = attr->ia_size;
+- dirtied |= CEPH_CAP_FILE_EXCL;
+- } else if ((issued & CEPH_CAP_FILE_SHARED) == 0 ||
+- attr->ia_size != inode->i_size) {
+- req->r_args.setattr.size = cpu_to_le64(attr->ia_size);
+- req->r_args.setattr.old_size =
+- cpu_to_le64(inode->i_size);
+- mask |= CEPH_SETATTR_SIZE;
+- release |= CEPH_CAP_FILE_SHARED | CEPH_CAP_FILE_EXCL |
+- CEPH_CAP_FILE_RD | CEPH_CAP_FILE_WR;
+- }
+- }
+
+ /* these do nothing */
+ if (ia_valid & ATTR_CTIME) {
+
diff --git a/patches.suse/cfg80211-wext-avoid-copying-malformed-SSIDs.patch b/patches.suse/cfg80211-wext-avoid-copying-malformed-SSIDs.patch
new file mode 100644
index 0000000000..60bcddb2f7
--- /dev/null
+++ b/patches.suse/cfg80211-wext-avoid-copying-malformed-SSIDs.patch
@@ -0,0 +1,54 @@
+From: Will Deacon <will@kernel.org>
+Date: Fri, 4 Oct 2019 10:51:32 +0100
+Subject: [PATCH] cfg80211: wext: avoid copying malformed SSIDs
+Patch-mainline: Queued in subsystem maintainer repository
+Git-commit: 4ac2813cc867ae563a1ba5a9414bfb554e5796fa
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
+References: bsc#1153158 CVE-2019-17133
+
+Ensure the SSID element is bounds-checked prior to invoking memcpy()
+with its length field, when copying to userspace.
+
+Cc: <stable@vger.kernel.org>
+Cc: Kees Cook <keescook@chromium.org>
+Reported-by: Nicolas Waisman <nico@semmle.com>
+Signed-off-by: Will Deacon <will@kernel.org>
+Link: https://lore.kernel.org/r/20191004095132.15777-2-will@kernel.org
+[adjust commit log a bit]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Cho, Yu-Chen <acho@suse.com>
+---
+ net/wireless/wext-sme.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/wireless/wext-sme.c
++++ b/net/wireless/wext-sme.c
+@@ -201,6 +201,7 @@ int cfg80211_mgd_wext_giwessid(struct ne
+ struct iw_point *data, char *ssid)
+ {
+ struct wireless_dev *wdev = dev->ieee80211_ptr;
++ int ret = 0;
+
+ /* call only for station! */
+ if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
+@@ -218,7 +219,10 @@ int cfg80211_mgd_wext_giwessid(struct ne
+ if (ie) {
+ data->flags = 1;
+ data->length = ie[1];
+- memcpy(ssid, ie + 2, data->length);
++ if (data->length > IW_ESSID_MAX_SIZE)
++ ret = -EINVAL;
++ else
++ memcpy(ssid, ie + 2, data->length);
+ }
+ rcu_read_unlock();
+ } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
+@@ -228,7 +232,7 @@ int cfg80211_mgd_wext_giwessid(struct ne
+ }
+ wdev_unlock(wdev);
+
+- return 0;
++ return ret;
+ }
+
+ int cfg80211_mgd_wext_siwap(struct net_device *dev,
diff --git a/patches.suse/cxgb4-Signedness-bug-in-init_one.patch b/patches.suse/cxgb4-Signedness-bug-in-init_one.patch
new file mode 100644
index 0000000000..a8a0ae845f
--- /dev/null
+++ b/patches.suse/cxgb4-Signedness-bug-in-init_one.patch
@@ -0,0 +1,29 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 25 Sep 2019 13:54:59 +0300
+Subject: cxgb4: Signedness bug in init_one()
+Patch-mainline: v5.4-rc1
+Git-commit: 286183147666fb76c057836c57d86e9e6f508bca
+References: bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584
+
+The "chip" variable is an enum, and it's treated as unsigned int by GCC
+in this context so the error handling isn't triggered.
+
+Fixes: e8d452923ae6 ("cxgb4: clean up init_one")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -5558,7 +5558,7 @@ static int init_one(struct pci_dev *pdev
+ whoami = t4_read_reg(adapter, PL_WHOAMI_A);
+ pci_read_config_word(pdev, PCI_DEVICE_ID, &device_id);
+ chip = t4_get_chip_type(adapter, CHELSIO_PCI_ID_VER(device_id));
+- if (chip < 0) {
++ if ((int)chip < 0) {
+ dev_err(&pdev->dev, "Device %d is not supported\n", device_id);
+ err = chip;
+ goto out_free_adapter;
diff --git a/patches.suse/cxgb4-fix-endianness-for-vlan-value-in-cxgb4_tc_flow.patch b/patches.suse/cxgb4-fix-endianness-for-vlan-value-in-cxgb4_tc_flow.patch
index 4b757086b1..76b25304cc 100644
--- a/patches.suse/cxgb4-fix-endianness-for-vlan-value-in-cxgb4_tc_flow.patch
+++ b/patches.suse/cxgb4-fix-endianness-for-vlan-value-in-cxgb4_tc_flow.patch
@@ -3,7 +3,7 @@ Date: Wed, 17 Jan 2018 12:13:34 +0530
Subject: cxgb4: fix endianness for vlan value in cxgb4_tc_flower
Patch-mainline: v4.15
Git-commit: 100d39af5048aecb00522a128ec264781ba7ecfa
-References: bsc#1104279 FATE#325938
+References: bsc#1104279 bsc#1064802 bsc#1066129 FATE#325938
Don't change endianness when assigning vlan value in cxgb4_tc_flower
code when processing flow match parameters. The value gets converted
@@ -20,7 +20,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
-@@ -208,8 +208,8 @@ static void cxgb4_process_flow_match(str
+@@ -205,8 +205,8 @@ static void cxgb4_process_flow_match(str
VLAN_PRIO_SHIFT);
vlan_tci_mask = mask->vlan_id | (mask->vlan_priority <<
VLAN_PRIO_SHIFT);
diff --git a/patches.suse/cxgb4-offload-VLAN-flows-regardless-of-VLAN-ethtype.patch b/patches.suse/cxgb4-offload-VLAN-flows-regardless-of-VLAN-ethtype.patch
index c1566df293..59f93bed5e 100644
--- a/patches.suse/cxgb4-offload-VLAN-flows-regardless-of-VLAN-ethtype.patch
+++ b/patches.suse/cxgb4-offload-VLAN-flows-regardless-of-VLAN-ethtype.patch
@@ -3,7 +3,7 @@ Date: Thu, 23 May 2019 20:41:44 +0530
Subject: cxgb4: offload VLAN flows regardless of VLAN ethtype
Patch-mainline: v5.2-rc3
Git-commit: b5730061d1056abf317caea823b94d6e12b5b4f6
-References: bsc#1136345 jsc#SLE-4681
+References: bsc#1064802 bsc#1066129 bsc#1136345 jsc#SLE-4681
VLAN flows never get offloaded unless ivlan_vld is set in filter spec.
It's not compulsory for vlan_ethtype to be set.
@@ -21,7 +21,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
-@@ -228,6 +228,9 @@ static void cxgb4_process_flow_match(str
+@@ -208,6 +208,9 @@ static void cxgb4_process_flow_match(str
fs->val.ivlan = vlan_tci;
fs->mask.ivlan = vlan_tci_mask;
@@ -31,7 +31,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
/* Chelsio adapters use ivlan_vld bit to match vlan packets
* as 802.1Q. Also, when vlan tag is present in packets,
* ethtype match is used then to match on ethtype of inner
-@@ -238,8 +241,6 @@ static void cxgb4_process_flow_match(str
+@@ -218,8 +221,6 @@ static void cxgb4_process_flow_match(str
* ethtype value with ethtype of inner header.
*/
if (fs->val.ethtype == ETH_P_8021Q) {
diff --git a/patches.suse/cxgb4-reduce-kernel-stack-usage-in-cudbg_collect_mem.patch b/patches.suse/cxgb4-reduce-kernel-stack-usage-in-cudbg_collect_mem.patch
new file mode 100644
index 0000000000..458d1c60f3
--- /dev/null
+++ b/patches.suse/cxgb4-reduce-kernel-stack-usage-in-cudbg_collect_mem.patch
@@ -0,0 +1,67 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 12 Jul 2019 11:06:33 +0200
+Subject: cxgb4: reduce kernel stack usage in cudbg_collect_mem_region()
+Patch-mainline: v5.3-rc1
+Git-commit: 752c2ea2d8e7c23b0f64e2e7d4337f3604d44c9f
+References: bsc#1073513
+
+The cudbg_collect_mem_region() and cudbg_read_fw_mem() both use several
+hundred kilobytes of kernel stack space. One gets inlined into the other,
+which causes the stack usage to be combined beyond the warning limit
+when building with clang:
+
+drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c:1057:12: error: stack frame size of 1244 bytes in function 'cudbg_collect_mem_region' [-Werror,-Wframe-larger-than=]
+
+Restructuring cudbg_collect_mem_region() lets clang do the same
+optimization that gcc does and reuse the stack slots as it can
+see that the large variables are never used together.
+
+A better fix might be to avoid using cudbg_meminfo on the stack
+altogether, but that requires a larger rewrite.
+
+Fixes: a1c69520f785 ("cxgb4: collect MC memory dump")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c | 19 +++++++++++++------
+ 1 file changed, 13 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c
+@@ -1047,14 +1047,12 @@ static void cudbg_t4_fwcache(struct cudb
+ }
+ }
+
+-static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
+- struct cudbg_buffer *dbg_buff,
+- struct cudbg_error *cudbg_err,
+- u8 mem_type)
++static unsigned long cudbg_mem_region_size(struct cudbg_init *pdbg_init,
++ struct cudbg_error *cudbg_err,
++ u8 mem_type)
+ {
+ struct adapter *padap = pdbg_init->adap;
+ struct cudbg_meminfo mem_info;
+- unsigned long size;
+ u8 mc_idx;
+ int rc;
+
+@@ -1068,7 +1066,16 @@ static int cudbg_collect_mem_region(stru
+ if (rc)
+ return rc;
+
+- size = mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
++ return mem_info.avail[mc_idx].limit - mem_info.avail[mc_idx].base;
++}
++
++static int cudbg_collect_mem_region(struct cudbg_init *pdbg_init,
++ struct cudbg_buffer *dbg_buff,
++ struct cudbg_error *cudbg_err,
++ u8 mem_type)
++{
++ unsigned long size = cudbg_mem_region_size(pdbg_init, cudbg_err, mem_type);
++
+ return cudbg_read_fw_mem(pdbg_init, dbg_buff, mem_type, size,
+ cudbg_err);
+ }
diff --git a/patches.suse/cxgb4-smt-Add-lock-for-atomic_dec_and_test.patch b/patches.suse/cxgb4-smt-Add-lock-for-atomic_dec_and_test.patch
new file mode 100644
index 0000000000..7694fecaf3
--- /dev/null
+++ b/patches.suse/cxgb4-smt-Add-lock-for-atomic_dec_and_test.patch
@@ -0,0 +1,45 @@
+From: Chuhong Yuan <hslester96@gmail.com>
+Date: Tue, 6 Aug 2019 10:58:46 +0800
+Subject: cxgb4: smt: Add lock for atomic_dec_and_test
+Patch-mainline: v5.4-rc1
+Git-commit: 4a8937b83892cb69524291cae6cdabad4a8be033
+References: bsc#1064802 bsc#1066129
+
+The atomic_dec_and_test() is not safe because it is
+outside of locks.
+Move the locks of t4_smte_free() to its caller,
+cxgb4_smt_release() to protect the atomic decrement.
+
+Fixes: 3bdb376e6944 ("cxgb4: introduce SMT ops to prepare for SMAC rewrite support")
+Signed-off-by: Chuhong Yuan <hslester96@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/chelsio/cxgb4/smt.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/chelsio/cxgb4/smt.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/smt.c
+@@ -98,11 +98,9 @@ found_reuse:
+
+ static void t4_smte_free(struct smt_entry *e)
+ {
+- spin_lock_bh(&e->lock);
+ if (atomic_read(&e->refcnt) == 0) { /* hasn't been recycled */
+ e->state = SMT_STATE_UNUSED;
+ }
+- spin_unlock_bh(&e->lock);
+ }
+
+ /**
+@@ -112,8 +110,10 @@ static void t4_smte_free(struct smt_entr
+ */
+ void cxgb4_smt_release(struct smt_entry *e)
+ {
++ spin_lock_bh(&e->lock);
+ if (atomic_dec_and_test(&e->refcnt))
+ t4_smte_free(e);
++ spin_unlock_bh(&e->lock);
+ }
+ EXPORT_SYMBOL(cxgb4_smt_release);
+
diff --git a/patches.suse/dev-mem-Bail-out-upon-SIGKILL.patch b/patches.suse/dev-mem-Bail-out-upon-SIGKILL.patch
new file mode 100644
index 0000000000..0ef510f2e6
--- /dev/null
+++ b/patches.suse/dev-mem-Bail-out-upon-SIGKILL.patch
@@ -0,0 +1,109 @@
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Mon, 26 Aug 2019 22:13:25 +0900
+Subject: /dev/mem: Bail out upon SIGKILL.
+Git-commit: 8619e5bdeee8b2c685d686281f2d2a6017c4bc15
+Patch-mainline: 5.4-rc1
+References: git-fixes
+
+syzbot found that a thread can stall for minutes inside read_mem() or
+write_mem() after that thread was killed by SIGKILL [1]. Reading from
+iomem areas of /dev/mem can be slow, depending on the hardware.
+While reading 2GB at one read() is legal, delaying termination of killed
+thread for minutes is bad. Thus, allow reading/writing /dev/mem and
+/dev/kmem to be preemptible and killable.
+
+ [ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
+ [ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
+ [ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
+ [ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
+ [ 1336.041897][T20577] read_mem: sz=4096 count=2134549248
+
+Theoretically, reading/writing /dev/mem and /dev/kmem can become
+"interruptible". But this patch chose "killable". Future patch will make
+them "interruptible" so that we can revert to "killable" if some program
+regressed.
+
+[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Cc: stable <stable@vger.kernel.org>
+Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@syzkaller.appspotmail.com>
+Link: https://lore.kernel.org/r/1566825205-10703-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/char/mem.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/char/mem.c
++++ b/drivers/char/mem.c
+@@ -96,6 +96,13 @@ void __weak unxlate_dev_mem_ptr(phys_add
+ }
+ #endif
+
++static inline bool should_stop_iteration(void)
++{
++ if (need_resched())
++ cond_resched();
++ return fatal_signal_pending(current);
++}
++
+ /*
+ * This funcion reads the *physical* memory. The f_pos points directly to the
+ * memory location.
+@@ -174,6 +181,8 @@ static ssize_t read_mem(struct file *fil
+ p += sz;
+ count -= sz;
+ read += sz;
++ if (should_stop_iteration())
++ break;
+ }
+ kfree(bounce);
+
+@@ -250,6 +259,8 @@ static ssize_t write_mem(struct file *fi
+ p += sz;
+ count -= sz;
+ written += sz;
++ if (should_stop_iteration())
++ break;
+ }
+
+ *ppos += written;
+@@ -463,6 +474,10 @@ static ssize_t read_kmem(struct file *fi
+ read += sz;
+ low_count -= sz;
+ count -= sz;
++ if (should_stop_iteration()) {
++ count = 0;
++ break;
++ }
+ }
+ }
+
+@@ -487,6 +502,8 @@ static ssize_t read_kmem(struct file *fi
+ buf += sz;
+ read += sz;
+ p += sz;
++ if (should_stop_iteration())
++ break;
+ }
+ free_page((unsigned long)kbuf);
+ }
+@@ -539,6 +556,8 @@ static ssize_t do_write_kmem(unsigned lo
+ p += sz;
+ count -= sz;
+ written += sz;
++ if (should_stop_iteration())
++ break;
+ }
+
+ *ppos += written;
+@@ -590,6 +609,8 @@ static ssize_t write_kmem(struct file *f
+ buf += sz;
+ virtr += sz;
+ p += sz;
++ if (should_stop_iteration())
++ break;
+ }
+ free_page((unsigned long)kbuf);
+ }
diff --git a/patches.suse/drm-amdgpu-si-fix-asic-tests.patch b/patches.suse/drm-amdgpu-si-fix-asic-tests.patch
new file mode 100644
index 0000000000..05684425db
--- /dev/null
+++ b/patches.suse/drm-amdgpu-si-fix-asic-tests.patch
@@ -0,0 +1,51 @@
+From: Jean Delvare <jdelvare@suse.de>
+Date: Wed, 28 Aug 2019 17:05:57 +0200
+Subject: drm/amdgpu/si: fix ASIC tests
+Git-commit: 77efe48a729588527afb4d5811b9e0acb29f5e51
+Patch-mainline: v5.4
+References: git-fixes
+
+Comparing adev->family with CHIP constants is not correct.
+adev->family can only be compared with AMDGPU_FAMILY constants and
+adev->asic_type is the struct member to compare with CHIP constants.
+They are separate identification spaces.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10")
+Cc: Ken Wang <Qingqing.Wang@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: "David (ChunMing) Zhou" <David1.Zhou@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+---
+ drivers/gpu/drm/amd/amdgpu/si.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/si.c
++++ b/drivers/gpu/drm/amd/amdgpu/si.c
+@@ -1755,7 +1755,7 @@ static void si_program_aspm(struct amdgp
+ if (orig != data)
+ si_pif_phy1_wreg(adev,PB1_PIF_PWRDOWN_1, data);
+
+- if ((adev->family != CHIP_OLAND) && (adev->family != CHIP_HAINAN)) {
++ if ((adev->asic_type != CHIP_OLAND) && (adev->asic_type != CHIP_HAINAN)) {
+ orig = data = si_pif_phy0_rreg(adev,PB0_PIF_PWRDOWN_0);
+ data &= ~PLL_RAMP_UP_TIME_0_MASK;
+ if (orig != data)
+@@ -1804,14 +1804,14 @@ static void si_program_aspm(struct amdgp
+
+ orig = data = si_pif_phy0_rreg(adev,PB0_PIF_CNTL);
+ data &= ~LS2_EXIT_TIME_MASK;
+- if ((adev->family == CHIP_OLAND) || (adev->family == CHIP_HAINAN))
++ if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type == CHIP_HAINAN))
+ data |= LS2_EXIT_TIME(5);
+ if (orig != data)
+ si_pif_phy0_wreg(adev,PB0_PIF_CNTL, data);
+
+ orig = data = si_pif_phy1_rreg(adev,PB1_PIF_CNTL);
+ data &= ~LS2_EXIT_TIME_MASK;
+- if ((adev->family == CHIP_OLAND) || (adev->family == CHIP_HAINAN))
++ if ((adev->asic_type == CHIP_OLAND) || (adev->asic_type == CHIP_HAINAN))
+ data |= LS2_EXIT_TIME(5);
+ if (orig != data)
+ si_pif_phy1_wreg(adev,PB1_PIF_CNTL, data);
diff --git a/patches.suse/firmware-dmi-fix-unlikely-out-of-bounds-read.patch b/patches.suse/firmware-dmi-fix-unlikely-out-of-bounds-read.patch
new file mode 100644
index 0000000000..bdc38a5643
--- /dev/null
+++ b/patches.suse/firmware-dmi-fix-unlikely-out-of-bounds-read.patch
@@ -0,0 +1,33 @@
+From: Jean Delvare <jdelvare@suse.de>
+Date: Mon, 14 Oct 2019 21:41:24 +0200
+Subject: firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices
+Git-commit: 81dde26de9c08bb04c4962a15608778aaffb3cf9
+Patch-mainline: v5.4
+References: git-fixes
+
+Before reading the Extended Size field, we should ensure it fits in
+the DMI record. There is already a record length check but it does
+not cover that field.
+
+It would take a seriously corrupted DMI table to hit that bug, so no
+need to worry, but we should still fix it.
+
+Signed-off-by: Jean Delvare <jdelvare@suse.de>
+Fixes: 6deae96b42eb ("firmware, DMI: Add function to look up a handle and return DIMM size")
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Borislav Petkov <bp@suse.de>
+---
+ drivers/firmware/dmi_scan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -412,7 +412,7 @@ static void __init save_mem_devices(cons
+ bytes = ~0ull;
+ else if (size & 0x8000)
+ bytes = (u64)(size & 0x7fff) << 10;
+- else if (size != 0x7fff)
++ else if (size != 0x7fff || dm->length < 0x20)
+ bytes = (u64)size << 20;
+ else
+ bytes = (u64)get_unaligned((u32 *)&d[0x1C]) << 20;
diff --git a/patches.suse/hwrng-core-don-t-wait-on-add_early_randomness.patch b/patches.suse/hwrng-core-don-t-wait-on-add_early_randomness.patch
new file mode 100644
index 0000000000..44a40d8380
--- /dev/null
+++ b/patches.suse/hwrng-core-don-t-wait-on-add_early_randomness.patch
@@ -0,0 +1,52 @@
+From: Laurent Vivier <lvivier@redhat.com>
+Date: Tue, 17 Sep 2019 11:54:50 +0200
+Subject: hwrng: core - don't wait on add_early_randomness()
+Git-commit: 78887832e76541f77169a24ac238fccb51059b63
+Patch-mainline: 5.4-rc1
+References: git-fixes
+
+add_early_randomness() is called by hwrng_register() when the
+hardware is added. If this hardware and its module are present
+at boot, and if there is no data available the boot hangs until
+data are available and can't be interrupted.
+
+For instance, in the case of virtio-rng, in some cases the host can be
+not able to provide enough entropy for all the guests.
+
+We can have two easy ways to reproduce the problem but they rely on
+misconfiguration of the hypervisor or the egd daemon:
+
+- if virtio-rng device is configured to connect to the egd daemon of the
+host but when the virtio-rng driver asks for data the daemon is not
+connected,
+
+- if virtio-rng device is configured to connect to the egd daemon of the
+host but the egd daemon doesn't provide data.
+
+The guest kernel will hang at boot until the virtio-rng driver provides
+enough data.
+
+To avoid that, call rng_get_data() in non-blocking mode (wait=0)
+from add_early_randomness().
+
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
+Fixes: d9e797261933 ("hwrng: add randomness to system from rng...")
+Cc: <stable@vger.kernel.org>
+Reviewed-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/char/hw_random/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/char/hw_random/core.c
++++ b/drivers/char/hw_random/core.c
+@@ -64,7 +64,7 @@ static void add_early_randomness(struct
+ size_t size = min_t(size_t, 16, rng_buffer_size());
+
+ mutex_lock(&reading_mutex);
+- bytes_read = rng_get_data(rng, rng_buffer, size, 1);
++ bytes_read = rng_get_data(rng, rng_buffer, size, 0);
+ mutex_unlock(&reading_mutex);
+ if (bytes_read > 0)
+ add_device_randomness(rng_buffer, bytes_read);
diff --git a/patches.suse/ipoib-Do-not-overreact-to-SM-LID-change-even.patch b/patches.suse/ipoib-Do-not-overreact-to-SM-LID-change-even.patch
new file mode 100644
index 0000000000..fab2ce1313
--- /dev/null
+++ b/patches.suse/ipoib-Do-not-overreact-to-SM-LID-change-even.patch
@@ -0,0 +1,147 @@
+From ba7d8117f3cca8eb70d579fde3f9ec8cd6a28f39 Mon Sep 17 00:00:00 2001
+From: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Date: Thu, 11 Apr 2019 07:22:35 -0700
+Subject: [PATCH 1/1] IB/core, ipoib: Do not overreact to SM LID change event
+Patch-mainline: v5.2
+Git-commit: ba7d8117f3cca8eb70d579fde3f9ec8cd6a28f39
+References: bsc#1154108
+
+When IPoIB receives an SM LID change event, it reacts by flushing its
+path record cache and rejoining multicast groups. This is the same
+behavior it performs when it receives a reregistration event. This
+behavior is unnecessary as an SM may have database backup or
+synchronization mechanisms which permit the SM location or LID to change
+without loss of multicast membership and without impact to path records.
+
+Both opensm and the OPA FM issue reregistration events if a new SM is
+started (or restarted with a new config) or an SM event occurs which
+results in loss of multicast membership records by the SM (such as
+opensm failover) or the SM encounters new nodes with Active ports (such
+as after joining 2 fabrics by connecting switches via ISLs). Hence this
+event can be depended on as the trigger for IPoIB cache and multicast
+flushing.
+
+It appears that some drivers, such as qib, and hfi1 issue the
+IB_EVENT_SM_CHANGE but other drivers such as mlx4 and mlx5 do not.
+Empirical testing on Mellanox EDR using ibv_asyncwatch has confirmed
+that Mellanox EDR HCAs do not generate SM change events and that opensm
+does generate reregistration.
+
+An SM LID change event is generated by the mentioned drivers to reflect
+that sm_lid and/or sm_sl in the local port info has changed. The intent
+of this event is to permit applications and ULPs which have a local copy
+of this information (or an address handle using it) to update their
+information.
+
+The intent is that the reregistration event (caused by the SM via a bit
+in Set(PortInfo)) be used to inform nodes that they need to rejoin
+multicast groups, resubscribe for notices and potentially update path
+records.
+
+When an SM migrates or fails over, a SM LID change event can occur. In
+response IPoIB discards path records and multicast membership and loses
+connectivity until these records are restored via SA requests. In very
+large fabrics, it may take minutes for the SM to be ready and for the SA
+responses to be supplied. This can result in undesirable and
+unnecessary IPoIB connectivity impacts. It also can result in an
+unnecessary storm of SA queries from all nodes in a cluster potentially
+followed by yet another storm if the SM issues the reregistration
+request.
+
+The fact the Mellanox HCAs do not even generate this event, is further
+evidence that on modern IB fabrics there will be no ill side effects
+from the proposed changes below to reduce the reaction by 3 kernel
+components to this event. So these changes should be benign for Mellanox
+IB fabrics and will benefit OPA fabrics while also making ib_core and
+ULP behavor "correct" as intended by the IBTA spec and kernel RDMA event
+APIs.
+
+Address these issues by removing IB_EVENT_SM_CHANGE handling from ipoib.
+IPoIB does not locally store sm_lid nor sm_sl, so it does not need to do
+anything on SM LID change. IPoIB makes use of other ib_core components
+to issue SA requests for it and those components correctly track SM LID
+and SM LID changes.
+
+Also in ib_core multicast handling, remove the test for
+IB_EVENT_SM_CHANGE. This code is moving all multicast groups to the
+error state, which will trigger rejoins. This code is used by IPoIB as
+well as the connection manager and other clients of multicast groups.
+This kernel module centralizes group membership status and joins since a
+node can only join a given group once but multiple ULPs or applications
+may want to join the same group. It makes use of the sa_query.c
+component in ib_core, which correctly trackes SM LID and SL. This
+component does not track SM LID nor SL itself and hence need not react
+to their changes.
+
+Similarly in the ib_core cache code remove the handling for the
+IB_EVENT_SM_CHANGE. In this function. The ib_cache_update function
+which is ultimately called is updating local copies of the pkey table,
+gid table and lmc. It does not update nor retain sm_lid nor sm_sl. As
+such it does not need to be called on an SM LID change. It technically
+also does not need to be called on a reregistration. The LID_CHANGE,
+PKEY_CHANGE, GID_CHANGE and port state change events (PORT_ERR,
+PORT_ACTICE) should be sufficient triggers.
+
+It is worth noting that the alternative of simply having the hfi1 and
+qib drivers not generate the SM LID change event was explored. While
+this would duplicate what Mellanox drivers do now, it is not the correct
+behavior and removes the ability for an SM to migrate without requiring
+reregistration. Since both opensm and OPA SM have mechanisms to backup
+or synchronize registration information, it is desirable to let them
+perform SM migrations (with LID or SL changes) without requiring
+reregistration when they deem it appropriate.
+
+Suggested-by: Todd Rimmer <todd.rimmer@intel.com>
+Tested-by: Michael Brooks <michael.brooks@intel.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Todd Rimmer <todd.rimmer@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Nicolas Morey-Chaisemartin <NMoreyChaisemartin@suse.com>
+---
+ drivers/infiniband/core/cache.c | 1 -
+ drivers/infiniband/core/multicast.c | 1 -
+ drivers/infiniband/ulp/ipoib/ipoib_verbs.c | 3 +--
+ 3 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
+index 7ebb4924fa85..c0b94aafbdbb 100644
+--- a/drivers/infiniband/core/cache.c
++++ b/drivers/infiniband/core/cache.c
+@@ -1168,7 +1168,6 @@ static void ib_cache_event(struct ib_event_handler *handler,
+ event->event == IB_EVENT_PORT_ACTIVE ||
+ event->event == IB_EVENT_LID_CHANGE ||
+ event->event == IB_EVENT_PKEY_CHANGE ||
+- event->event == IB_EVENT_SM_CHANGE ||
+ event->event == IB_EVENT_CLIENT_REREGISTER ||
+ event->event == IB_EVENT_GID_CHANGE) {
+ work = kmalloc(sizeof *work, GFP_ATOMIC);
+diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c
+index 4eb72ff539fc..8b358ec31cfd 100644
+--- a/drivers/infiniband/core/multicast.c
++++ b/drivers/infiniband/core/multicast.c
+@@ -794,7 +794,6 @@ static void mcast_event_handler(struct ib_event_handler *handler,
+ switch (event->event) {
+ case IB_EVENT_PORT_ERR:
+ case IB_EVENT_LID_CHANGE:
+- case IB_EVENT_SM_CHANGE:
+ case IB_EVENT_CLIENT_REREGISTER:
+ mcast_groups_event(&dev->port[index], MCAST_GROUP_ERROR);
+ break;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+index a1ed25422b72..5e59ca378966 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+@@ -279,8 +279,7 @@ void ipoib_event(struct ib_event_handler *handler,
+ ipoib_dbg(priv, "Event %d on device %s port %d\n", record->event,
+ dev_name(&record->device->dev), record->element.port_num);
+
+- if (record->event == IB_EVENT_SM_CHANGE ||
+- record->event == IB_EVENT_CLIENT_REREGISTER) {
++ if (record->event == IB_EVENT_CLIENT_REREGISTER) {
+ queue_work(ipoib_workqueue, &priv->flush_light);
+ } else if (record->event == IB_EVENT_PORT_ERR ||
+ record->event == IB_EVENT_PORT_ACTIVE ||
+--
+2.21.0
+
diff --git a/patches.suse/ipv6-Fix-the-link-time-qualifier-of-ping_v6_proc_exi.patch b/patches.suse/ipv6-Fix-the-link-time-qualifier-of-ping_v6_proc_exi.patch
new file mode 100644
index 0000000000..447e708f57
--- /dev/null
+++ b/patches.suse/ipv6-Fix-the-link-time-qualifier-of-ping_v6_proc_exi.patch
@@ -0,0 +1,29 @@
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Tue, 10 Sep 2019 13:29:59 +0200
+Subject: ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'
+Git-commit: d23dbc479a8e813db4161a695d67da0e36557846
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+The '.exit' functions from 'pernet_operations' structure should be marked
+as __net_exit, not __net_init.
+
+Fixes: d862e5461423 ("net: ipv6: Implement /proc/net/icmp6.")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/ping.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/ping.c
++++ b/net/ipv6/ping.c
+@@ -233,7 +233,7 @@ static int __net_init ping_v6_proc_init_
+ return ping_proc_register(net, &ping_v6_seq_afinfo);
+ }
+
+-static void __net_init ping_v6_proc_exit_net(struct net *net)
++static void __net_exit ping_v6_proc_exit_net(struct net *net)
+ {
+ return ping_proc_unregister(net, &ping_v6_seq_afinfo);
+ }
diff --git a/patches.suse/ixgbe-Fix-secpath-usage-for-IPsec-TX-offload.patch b/patches.suse/ixgbe-Fix-secpath-usage-for-IPsec-TX-offload.patch
new file mode 100644
index 0000000000..29663e919d
--- /dev/null
+++ b/patches.suse/ixgbe-Fix-secpath-usage-for-IPsec-TX-offload.patch
@@ -0,0 +1,43 @@
+From: Steffen Klassert <steffen.klassert@secunet.com>
+Date: Thu, 12 Sep 2019 13:01:44 +0200
+Subject: ixgbe: Fix secpath usage for IPsec TX offload.
+Patch-mainline: v5.3
+Git-commit: f39b683d35dfa93a58f1b400a8ec0ff81296b37c
+References: bsc#1113994 FATE#326315 FATE#326317 bsc#1151807
+
+The ixgbe driver currently does IPsec TX offloading
+based on an existing secpath. However, the secpath
+can also come from the RX side, in this case it is
+misinterpreted for TX offload and the packets are
+dropped with a "bad sa_idx" error. Fix this by using
+the xfrm_offload() function to test for TX offload.
+
+Fixes: 592594704761 ("ixgbe: process the Tx ipsec offload")
+Reported-by: Michael Marley <michael@michaelmarley.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -61,6 +61,7 @@
+ #include <net/vxlan.h>
+ #include <net/mpls.h>
+ #include <net/xdp_sock.h>
++#include <net/xfrm.h>
+
+ #include "ixgbe.h"
+ #include "ixgbe_common.h"
+@@ -8721,7 +8722,8 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct
+ #endif /* IXGBE_FCOE */
+
+ #ifdef CONFIG_IXGBE_IPSEC
+- if (skb->sp && !ixgbe_ipsec_tx(tx_ring, first, &ipsec_tx))
++ if (xfrm_offload(skb) &&
++ !ixgbe_ipsec_tx(tx_ring, first, &ipsec_tx))
+ goto out_drop;
+ #endif
+ tso = ixgbe_tso(tx_ring, first, &hdr_len, &ipsec_tx);
diff --git a/patches.suse/ixgbe-Prevent-u8-wrapping-of-ITR-value-to-something-.patch b/patches.suse/ixgbe-Prevent-u8-wrapping-of-ITR-value-to-something-.patch
new file mode 100644
index 0000000000..37b3dfe91a
--- /dev/null
+++ b/patches.suse/ixgbe-Prevent-u8-wrapping-of-ITR-value-to-something-.patch
@@ -0,0 +1,45 @@
+From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Date: Wed, 4 Sep 2019 08:07:11 -0700
+Subject: ixgbe: Prevent u8 wrapping of ITR value to something less than 10us
+Patch-mainline: v5.3
+Git-commit: 377228accbbb8b9738f615d791aa803f41c067e0
+References: bsc#1101674 FATE#325150 FATE#325151
+
+There were a couple cases where the ITR value generated via the adaptive
+ITR scheme could exceed 126. This resulted in the value becoming either 0
+or something less than 10. Switching back and forth between a value less
+than 10 and a value greater than 10 can cause issues as certain hardware
+features such as RSC to not function well when the ITR value has dropped
+that low.
+
+CC: stable@vger.kernel.org
+Fixes: b4ded8327fea ("ixgbe: Update adaptive ITR algorithm")
+Reported-by: Gregg Leventhal <gleventhal@janestreet.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -2644,7 +2644,7 @@ adjust_by_size:
+ /* 16K ints/sec to 9.2K ints/sec */
+ avg_wire_size *= 15;
+ avg_wire_size += 11452;
+- } else if (avg_wire_size <= 1980) {
++ } else if (avg_wire_size < 1968) {
+ /* 9.2K ints/sec to 8K ints/sec */
+ avg_wire_size *= 5;
+ avg_wire_size += 22420;
+@@ -2677,6 +2677,8 @@ adjust_by_size:
+ case IXGBE_LINK_SPEED_2_5GB_FULL:
+ case IXGBE_LINK_SPEED_1GB_FULL:
+ case IXGBE_LINK_SPEED_10_FULL:
++ if (avg_wire_size > 8064)
++ avg_wire_size = 8064;
+ itr += DIV_ROUND_UP(avg_wire_size,
+ IXGBE_ITR_ADAPTIVE_MIN_INC * 64) *
+ IXGBE_ITR_ADAPTIVE_MIN_INC;
diff --git a/patches.suse/kvm-convert-kvm_lock-to-a-mutex b/patches.suse/kvm-convert-kvm_lock-to-a-mutex
new file mode 100644
index 0000000000..c998752032
--- /dev/null
+++ b/patches.suse/kvm-convert-kvm_lock-to-a-mutex
@@ -0,0 +1,242 @@
+From: Junaid Shahid <junaids@google.com>
+Date: Thu, 3 Jan 2019 17:14:28 -0800
+Subject: kvm: Convert kvm_lock to a mutex
+Git-commit: 0d9ce162cf46c99628cc5da9510b959c7976735b
+Patch-mainline: v5.3-rc1
+References: bsc#1117665
+
+It doesn't seem as if there is any particular need for kvm_lock to be a
+spinlock, so convert the lock to a mutex so that sleepable functions (in
+particular cond_resched()) can be called while holding it.
+
+Signed-off-by: Junaid Shahid <junaids@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ Documentation/virtual/kvm/locking.txt | 4 +---
+ arch/s390/kvm/kvm-s390.c | 4 ++--
+ arch/x86/kvm/mmu.c | 4 ++--
+ arch/x86/kvm/x86.c | 14 +++++++-------
+ include/linux/kvm_host.h | 2 +-
+ virt/kvm/kvm_main.c | 30 +++++++++++++++---------------
+ 6 files changed, 28 insertions(+), 30 deletions(-)
+
+--- a/Documentation/virtual/kvm/locking.txt
++++ b/Documentation/virtual/kvm/locking.txt
+@@ -15,8 +15,6 @@ The acquisition orders for mutexes are a
+
+ On x86, vcpu->mutex is taken outside kvm->arch.hyperv.hv_lock.
+
+-For spinlocks, kvm_lock is taken outside kvm->mmu_lock.
+-
+ Everything else is a leaf: no other lock is taken inside the critical
+ sections.
+
+@@ -169,7 +167,7 @@ which time it will be set using the Dirt
+ ------------
+
+ Name: kvm_lock
+-Type: spinlock_t
++Type: mutex
+ Arch: any
+ Protects: - vm_list
+
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -1961,13 +1961,13 @@ int kvm_arch_init_vm(struct kvm *kvm, un
+ kvm->arch.sca = (struct bsca_block *) get_zeroed_page(alloc_flags);
+ if (!kvm->arch.sca)
+ goto out_err;
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ sca_offset += 16;
+ if (sca_offset + sizeof(struct bsca_block) > PAGE_SIZE)
+ sca_offset = 0;
+ kvm->arch.sca = (struct bsca_block *)
+ ((char *) kvm->arch.sca + sca_offset);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ sprintf(debug_name, "kvm-%u", current->pid);
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5485,7 +5485,7 @@ mmu_shrink_scan(struct shrinker *shrink,
+ int nr_to_scan = sc->nr_to_scan;
+ unsigned long freed = 0;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ int idx;
+@@ -5535,7 +5535,7 @@ unlock:
+ break;
+ }
+
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ return freed;
+ }
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6147,7 +6147,7 @@ static int kvmclock_cpufreq_notifier(str
+
+ smp_call_function_single(freq->cpu, tsc_khz_changed, freq, 1);
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ kvm_for_each_vcpu(i, vcpu, kvm) {
+ if (vcpu->cpu != freq->cpu)
+@@ -6157,7 +6157,7 @@ static int kvmclock_cpufreq_notifier(str
+ send_ipi = 1;
+ }
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ if (freq->old < freq->new && send_ipi) {
+ /*
+@@ -6294,12 +6294,12 @@ static void pvclock_gtod_update_fn(struc
+ struct kvm_vcpu *vcpu;
+ int i;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list)
+ kvm_for_each_vcpu(i, vcpu, kvm)
+ kvm_make_request(KVM_REQ_MASTERCLOCK_UPDATE, vcpu);
+ atomic_set(&kvm_guest_has_master_clock, 0);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ }
+
+ static DECLARE_WORK(pvclock_gtod_work, pvclock_gtod_update_fn);
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -140,7 +140,7 @@ static inline bool is_error_page(struct
+
+ extern struct kmem_cache *kvm_vcpu_cache;
+
+-extern spinlock_t kvm_lock;
++extern struct mutex kvm_lock;
+ extern struct list_head vm_list;
+
+ struct kvm_io_range {
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -92,7 +92,7 @@ EXPORT_SYMBOL_GPL(halt_poll_ns_shrink);
+ * kvm->lock --> kvm->slots_lock --> kvm->irq_lock
+ */
+
+-DEFINE_SPINLOCK(kvm_lock);
++DEFINE_MUTEX(kvm_lock);
+ static DEFINE_RAW_SPINLOCK(kvm_count_lock);
+ LIST_HEAD(vm_list);
+
+@@ -713,9 +713,9 @@ static struct kvm *kvm_create_vm(unsigne
+ if (r)
+ goto out_err;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_add(&kvm->vm_list, &vm_list);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ preempt_notifier_inc();
+
+@@ -761,9 +761,9 @@ static void kvm_destroy_vm(struct kvm *k
+ kvm_uevent_notify_change(KVM_EVENT_DESTROY_VM, kvm);
+ kvm_destroy_vm_debugfs(kvm);
+ kvm_arch_sync_events(kvm);
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_del(&kvm->vm_list);
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ kvm_free_irq_routing(kvm);
+ for (i = 0; i < KVM_NR_BUSES; i++) {
+ struct kvm_io_bus *bus = kvm_get_bus(kvm, i);
+@@ -3842,13 +3842,13 @@ static int vm_stat_get(void *_offset, u6
+ u64 tmp_val;
+
+ *val = 0;
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vm_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
+ *val += tmp_val;
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ return 0;
+ }
+
+@@ -3861,12 +3861,12 @@ static int vm_stat_clear(void *_offset,
+ if (val)
+ return -EINVAL;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vm_stat_clear_per_vm((void *)&stat_tmp, 0);
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ return 0;
+ }
+@@ -3881,13 +3881,13 @@ static int vcpu_stat_get(void *_offset,
+ u64 tmp_val;
+
+ *val = 0;
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vcpu_stat_get_per_vm((void *)&stat_tmp, &tmp_val);
+ *val += tmp_val;
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+ return 0;
+ }
+
+@@ -3900,12 +3900,12 @@ static int vcpu_stat_clear(void *_offset
+ if (val)
+ return -EINVAL;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ list_for_each_entry(kvm, &vm_list, vm_list) {
+ stat_tmp.kvm = kvm;
+ vcpu_stat_clear_per_vm((void *)&stat_tmp, 0);
+ }
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ return 0;
+ }
+@@ -3926,7 +3926,7 @@ static void kvm_uevent_notify_change(uns
+ if (!kvm_dev.this_device || !kvm)
+ return;
+
+- spin_lock(&kvm_lock);
++ mutex_lock(&kvm_lock);
+ if (type == KVM_EVENT_CREATE_VM) {
+ kvm_createvm_count++;
+ kvm_active_vms++;
+@@ -3935,7 +3935,7 @@ static void kvm_uevent_notify_change(uns
+ }
+ created = kvm_createvm_count;
+ active = kvm_active_vms;
+- spin_unlock(&kvm_lock);
++ mutex_unlock(&kvm_lock);
+
+ env = kzalloc(sizeof(*env), GFP_KERNEL);
+ if (!env)
diff --git a/patches.suse/kvm-mmu-drop-vcpu-param-in-gpte_access b/patches.suse/kvm-mmu-drop-vcpu-param-in-gpte_access
new file mode 100644
index 0000000000..fb2d509884
--- /dev/null
+++ b/patches.suse/kvm-mmu-drop-vcpu-param-in-gpte_access
@@ -0,0 +1,59 @@
+From: Peter Xu <peterx@redhat.com>
+Date: Wed, 18 Jul 2018 15:57:50 +0800
+Subject: KVM: MMU: drop vcpu param in gpte_access
+Git-commit: 42522d08cdba6d8be4247e4f0770f39f4708b71f
+Patch-mainline: v4.19-rc1
+References: bsc#1117665
+
+It's never used. Drop it.
+
+Signed-off-by: Peter Xu <peterx@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/paging_tmpl.h | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
+index 6288e9d7068e..74996fc2fc97 100644
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -181,7 +181,7 @@ static bool FNAME(prefetch_invalid_gpte)(struct kvm_vcpu *vcpu,
+ * set bit 0 if execute only is supported. Here, we repurpose ACC_USER_MASK
+ * to signify readability since it isn't used in the EPT case
+ */
+-static inline unsigned FNAME(gpte_access)(struct kvm_vcpu *vcpu, u64 gpte)
++static inline unsigned FNAME(gpte_access)(u64 gpte)
+ {
+ unsigned access;
+ #if PTTYPE == PTTYPE_EPT
+@@ -394,8 +394,8 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
+ accessed_dirty = have_ad ? pte_access & PT_GUEST_ACCESSED_MASK : 0;
+
+ /* Convert to ACC_*_MASK flags for struct guest_walker. */
+- walker->pt_access = FNAME(gpte_access)(vcpu, pt_access ^ walk_nx_mask);
+- walker->pte_access = FNAME(gpte_access)(vcpu, pte_access ^ walk_nx_mask);
++ walker->pt_access = FNAME(gpte_access)(pt_access ^ walk_nx_mask);
++ walker->pte_access = FNAME(gpte_access)(pte_access ^ walk_nx_mask);
+ errcode = permission_fault(vcpu, mmu, walker->pte_access, pte_pkey, access);
+ if (unlikely(errcode))
+ goto error;
+@@ -508,7 +508,7 @@ FNAME(prefetch_gpte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp,
+ pgprintk("%s: gpte %llx spte %p\n", __func__, (u64)gpte, spte);
+
+ gfn = gpte_to_gfn(gpte);
+- pte_access = sp->role.access & FNAME(gpte_access)(vcpu, gpte);
++ pte_access = sp->role.access & FNAME(gpte_access)(gpte);
+ FNAME(protect_clean_gpte)(&vcpu->arch.mmu, &pte_access, gpte);
+ pfn = pte_prefetch_gfn_to_pfn(vcpu, gfn,
+ no_dirty_log && (pte_access & ACC_WRITE_MASK));
+@@ -1002,7 +1002,7 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
+
+ gfn = gpte_to_gfn(gpte);
+ pte_access = sp->role.access;
+- pte_access &= FNAME(gpte_access)(vcpu, gpte);
++ pte_access &= FNAME(gpte_access)(gpte);
+ FNAME(protect_clean_gpte)(&vcpu->arch.mmu, &pte_access, gpte);
+
+ if (sync_mmio_spte(vcpu, &sp->spt[i], gfn, pte_access,
+
diff --git a/patches.suse/kvm-x86-add-tracepoints-around-_direct_map-and-fnamefetch b/patches.suse/kvm-x86-add-tracepoints-around-_direct_map-and-fnamefetch
new file mode 100644
index 0000000000..35d7a50b15
--- /dev/null
+++ b/patches.suse/kvm-x86-add-tracepoints-around-_direct_map-and-fnamefetch
@@ -0,0 +1,142 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 1 Jul 2019 06:22:57 -0400
+Subject: KVM: x86: add tracepoints around __direct_map and FNAME(fetch)
+Git-commit: 335e192a3fa415e1202c8b9ecdaaecd643f823cc
+Patch-mainline: v5.3-rc1
+References: bsc#1117665
+
+These are useful in debugging shadow paging.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/mmu.c | 13 +++++-----
+ arch/x86/kvm/mmutrace.h | 59 ++++++++++++++++++++++++++++++++++++++++++++++
+ arch/x86/kvm/paging_tmpl.h | 2 ++
+ 3 files changed, 67 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -140,9 +140,6 @@ module_param(dbg, bool, 0644);
+
+ #include <trace/events/kvm.h>
+
+-#define CREATE_TRACE_POINTS
+-#include "mmutrace.h"
+-
+ #define SPTE_HOST_WRITEABLE (1ULL << PT_FIRST_AVAIL_BITS_SHIFT)
+ #define SPTE_MMU_WRITEABLE (1ULL << (PT_FIRST_AVAIL_BITS_SHIFT + 1))
+
+@@ -244,8 +241,13 @@ static u64 __read_mostly shadow_nonprese
+
+
+ static void mmu_spte_set(u64 *sptep, u64 spte);
++static bool is_executable_pte(u64 spte);
+ static void mmu_free_roots(struct kvm_vcpu *vcpu);
+
++#define CREATE_TRACE_POINTS
++#include "mmutrace.h"
++
++
+ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask, u64 mmio_value)
+ {
+ BUG_ON((mmio_mask & mmio_value) != mmio_value);
+@@ -2921,10 +2923,7 @@ static int mmu_set_spte(struct kvm_vcpu
+ ret = RET_PF_EMULATE;
+
+ pgprintk("%s: setting spte %llx\n", __func__, *sptep);
+- pgprintk("instantiating %s PTE (%s) at %llx (%llx) addr %p\n",
+- is_large_pte(*sptep)? "2MB" : "4kB",
+- *sptep & PT_WRITABLE_MASK ? "RW" : "R", gfn,
+- *sptep, sptep);
++ trace_kvm_mmu_set_spte(level, gfn, sptep);
+ if (!was_rmapped && is_large_pte(*sptep))
+ ++vcpu->kvm->stat.lpages;
+
+@@ -3035,6 +3034,7 @@ static int __direct_map(struct kvm_vcpu
+ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
+ return RET_PF_RETRY;
+
++ trace_kvm_mmu_spte_requested(gpa, level, pfn);
+ for_each_shadow_entry(vcpu, gpa, it) {
+ base_gfn = gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
+ if (it.level == level)
+--- a/arch/x86/kvm/mmutrace.h
++++ b/arch/x86/kvm/mmutrace.h
+@@ -324,6 +324,65 @@ TRACE_EVENT(
+ __entry->kvm_gen == __entry->spte_gen
+ )
+ );
++
++TRACE_EVENT(
++ kvm_mmu_set_spte,
++ TP_PROTO(int level, gfn_t gfn, u64 *sptep),
++ TP_ARGS(level, gfn, sptep),
++
++ TP_STRUCT__entry(
++ __field(u64, gfn)
++ __field(u64, spte)
++ __field(u64, sptep)
++ __field(u8, level)
++ /* These depend on page entry type, so compute them now. */
++ __field(bool, r)
++ __field(bool, x)
++ __field(u8, u)
++ ),
++
++ TP_fast_assign(
++ __entry->gfn = gfn;
++ __entry->spte = *sptep;
++ __entry->sptep = virt_to_phys(sptep);
++ __entry->level = level;
++ __entry->r = shadow_present_mask || (__entry->spte & PT_PRESENT_MASK);
++ __entry->x = is_executable_pte(__entry->spte);
++ __entry->u = shadow_user_mask ? !!(__entry->spte & shadow_user_mask) : -1;
++ ),
++
++ TP_printk("gfn %llx spte %llx (%s%s%s%s) level %d at %llx",
++ __entry->gfn, __entry->spte,
++ __entry->r ? "r" : "-",
++ __entry->spte & PT_WRITABLE_MASK ? "w" : "-",
++ __entry->x ? "x" : "-",
++ __entry->u == -1 ? "" : (__entry->u ? "u" : "-"),
++ __entry->level, __entry->sptep
++ )
++);
++
++TRACE_EVENT(
++ kvm_mmu_spte_requested,
++ TP_PROTO(gpa_t addr, int level, kvm_pfn_t pfn),
++ TP_ARGS(addr, level, pfn),
++
++ TP_STRUCT__entry(
++ __field(u64, gfn)
++ __field(u64, pfn)
++ __field(u8, level)
++ ),
++
++ TP_fast_assign(
++ __entry->gfn = addr >> PAGE_SHIFT;
++ __entry->pfn = pfn | (__entry->gfn & (KVM_PAGES_PER_HPAGE(level) - 1));
++ __entry->level = level;
++ ),
++
++ TP_printk("gfn %llx pfn %llx level %d",
++ __entry->gfn, __entry->pfn, __entry->level
++ )
++);
++
+ #endif /* _TRACE_KVMMMU_H */
+
+ #undef TRACE_INCLUDE_PATH
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -642,6 +642,8 @@ static int FNAME(fetch)(struct kvm_vcpu
+
+ base_gfn = gw->gfn;
+
++ trace_kvm_mmu_spte_requested(addr, gw->level, pfn);
++
+ for (; shadow_walk_okay(&it); shadow_walk_next(&it)) {
+ clear_sp_write_flooding_count(it.sptep);
+ base_gfn = gw->gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
diff --git a/patches.suse/kvm-x86-adjust-kvm_mmu_page-member-to-save-8-bytes b/patches.suse/kvm-x86-adjust-kvm_mmu_page-member-to-save-8-bytes
new file mode 100644
index 0000000000..2fbfcb163b
--- /dev/null
+++ b/patches.suse/kvm-x86-adjust-kvm_mmu_page-member-to-save-8-bytes
@@ -0,0 +1,56 @@
+From: Wei Yang <richard.weiyang@gmail.com>
+Date: Thu, 6 Sep 2018 05:58:16 +0800
+Subject: KVM: x86: adjust kvm_mmu_page member to save 8 bytes
+Git-commit: 3ff519f29d98ecdc1961d825d105d68711093b6b
+Patch-mainline: v4.20-rc1
+References: bsc#1117665
+
+On a 64bits machine, struct is naturally aligned with 8 bytes. Since
+kvm_mmu_page member *unsync* and *role* are less then 4 bytes, we can
+rearrange the sequence to compace the struct.
+
+As the comment shows, *role* and *gfn* are used to key the shadow page. In
+order to keep the comment valid, this patch moves the *unsync* up and
+exchange the position of *role* and *gfn*.
+
+>From /proc/slabinfo, it shows the size of kvm_mmu_page is 8 bytes less and
+with one more object per slap after applying this patch.
+
+ # name <active_objs> <num_objs> <objsize> <objperslab>
+ kvm_mmu_page_header 0 0 168 24
+
+ kvm_mmu_page_header 0 0 160 25
+
+Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/include/asm/kvm_host.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 1c09a0d1771f..576ff47a79c4 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -281,18 +281,18 @@ struct kvm_rmap_head {
+ struct kvm_mmu_page {
+ struct list_head link;
+ struct hlist_node hash_link;
++ bool unsync;
+
+ /*
+ * The following two entries are used to key the shadow page in the
+ * hash table.
+ */
+- gfn_t gfn;
+ union kvm_mmu_page_role role;
++ gfn_t gfn;
+
+ u64 *spt;
+ /* hold the gfn of each spte inside spt */
+ gfn_t *gfns;
+- bool unsync;
+ int root_count; /* Currently serving as active root */
+ unsigned int unsync_children;
+ struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */
+
diff --git a/patches.suse/kvm-x86-change-kvm_mmu_page_get_gfn-bug_on-to-warn_on b/patches.suse/kvm-x86-change-kvm_mmu_page_get_gfn-bug_on-to-warn_on
new file mode 100644
index 0000000000..d4aa9d69b4
--- /dev/null
+++ b/patches.suse/kvm-x86-change-kvm_mmu_page_get_gfn-bug_on-to-warn_on
@@ -0,0 +1,40 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Sun, 30 Jun 2019 08:36:21 -0400
+Subject: KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON
+Git-commit: e9f2a760b158551bfbef6db31d2cae45ab8072e5
+Patch-mainline: v5.3-rc1
+References: bsc#1117665
+
+Note that in such a case it is quite likely that KVM will BUG_ON
+in __pte_list_remove when the VM is closed. However, there is no
+immediate risk of memory corruption in the host so a WARN_ON is
+enough and it lets you gather traces for debugging.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/mmu.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -1009,10 +1009,16 @@ static gfn_t kvm_mmu_page_get_gfn(struct
+
+ static void kvm_mmu_page_set_gfn(struct kvm_mmu_page *sp, int index, gfn_t gfn)
+ {
+- if (sp->role.direct)
+- BUG_ON(gfn != kvm_mmu_page_get_gfn(sp, index));
+- else
++ if (!sp->role.direct) {
+ sp->gfns[index] = gfn;
++ return;
++ }
++
++ if (WARN_ON(gfn != kvm_mmu_page_get_gfn(sp, index)))
++ pr_err_ratelimited("gfn mismatch under direct page %llx "
++ "(expected %llx, got %llx)\n",
++ sp->gfn,
++ kvm_mmu_page_get_gfn(sp, index), gfn);
+ }
+
+ /*
diff --git a/patches.suse/kvm-x86-do-not-release-the-page-inside-mmu_set_spte b/patches.suse/kvm-x86-do-not-release-the-page-inside-mmu_set_spte
new file mode 100644
index 0000000000..20b83b2fe5
--- /dev/null
+++ b/patches.suse/kvm-x86-do-not-release-the-page-inside-mmu_set_spte
@@ -0,0 +1,134 @@
+From: Junaid Shahid <junaids@google.com>
+Date: Thu, 3 Jan 2019 16:22:21 -0800
+Subject: kvm: x86: Do not release the page inside mmu_set_spte()
+Git-commit: 43fdcda96e2550c6d1c46fb8a78801aa2f7276ed
+Patch-mainline: v5.3-rc1
+References: bsc#1117665
+
+Release the page at the call-site where it was originally acquired.
+This makes the exit code cleaner for most call sites, since they
+do not need to duplicate code between success and the failure
+label.
+
+Signed-off-by: Junaid Shahid <junaids@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/mmu.c | 18 +++++++-----------
+ arch/x86/kvm/paging_tmpl.h | 8 +++-----
+ 2 files changed, 10 insertions(+), 16 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2930,8 +2930,6 @@ static int mmu_set_spte(struct kvm_vcpu
+ }
+ }
+
+- kvm_release_pfn_clean(pfn);
+-
+ return ret;
+ }
+
+@@ -2966,9 +2964,11 @@ static int direct_pte_prefetch_many(stru
+ if (ret <= 0)
+ return -1;
+
+- for (i = 0; i < ret; i++, gfn++, start++)
++ for (i = 0; i < ret; i++, gfn++, start++) {
+ mmu_set_spte(vcpu, start, access, 0, sp->role.level, gfn,
+ page_to_pfn(pages[i]), true, true);
++ put_page(pages[i]);
++ }
+
+ return 0;
+ }
+@@ -3373,6 +3373,7 @@ static int nonpaging_map(struct kvm_vcpu
+ if (handle_abnormal_pfn(vcpu, v, gfn, pfn, ACC_ALL, &r))
+ return r;
+
++ r = RET_PF_RETRY;
+ spin_lock(&vcpu->kvm->mmu_lock);
+ if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
+ goto out_unlock;
+@@ -3381,14 +3382,11 @@ static int nonpaging_map(struct kvm_vcpu
+ if (likely(!force_pt_level))
+ transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
+ r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
+- spin_unlock(&vcpu->kvm->mmu_lock);
+-
+- return r;
+
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+- return RET_PF_RETRY;
++ return r;
+ }
+
+
+@@ -3965,6 +3963,7 @@ static int tdp_page_fault(struct kvm_vcp
+ if (handle_abnormal_pfn(vcpu, 0, gfn, pfn, ACC_ALL, &r))
+ return r;
+
++ r = RET_PF_RETRY;
+ spin_lock(&vcpu->kvm->mmu_lock);
+ if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
+ goto out_unlock;
+@@ -3973,14 +3972,11 @@ static int tdp_page_fault(struct kvm_vcp
+ if (likely(!force_pt_level))
+ transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
+ r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
+- spin_unlock(&vcpu->kvm->mmu_lock);
+-
+- return r;
+
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+- return RET_PF_RETRY;
++ return r;
+ }
+
+ static void nonpaging_init_context(struct kvm_vcpu *vcpu,
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -515,6 +515,7 @@ FNAME(prefetch_gpte)(struct kvm_vcpu *vc
+ mmu_set_spte(vcpu, spte, pte_access, 0, PT_PAGE_TABLE_LEVEL, gfn, pfn,
+ true, true);
+
++ kvm_release_pfn_clean(pfn);
+ return true;
+ }
+
+@@ -666,7 +667,6 @@ static int FNAME(fetch)(struct kvm_vcpu
+ return ret;
+
+ out_gpte_changed:
+- kvm_release_pfn_clean(pfn);
+ return RET_PF_RETRY;
+ }
+
+@@ -814,6 +814,7 @@ static int FNAME(page_fault)(struct kvm_
+ walker.pte_access &= ~ACC_EXEC_MASK;
+ }
+
++ r = RET_PF_RETRY;
+ spin_lock(&vcpu->kvm->mmu_lock);
+ if (mmu_notifier_retry(vcpu->kvm, mmu_seq))
+ goto out_unlock;
+@@ -827,14 +828,11 @@ static int FNAME(page_fault)(struct kvm_
+ level, pfn, map_writable, prefault);
+ ++vcpu->stat.pf_fixed;
+ kvm_mmu_audit(vcpu, AUDIT_POST_PAGE_FAULT);
+- spin_unlock(&vcpu->kvm->mmu_lock);
+-
+- return r;
+
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+- return RET_PF_RETRY;
++ return r;
+ }
+
+ static gpa_t FNAME(get_level1_sp_gpa)(struct kvm_mmu_page *sp)
diff --git a/patches.suse/kvm-x86-make-fnamefetch-and-_direct_map-more-similar b/patches.suse/kvm-x86-make-fnamefetch-and-_direct_map-more-similar
new file mode 100644
index 0000000000..10304f1683
--- /dev/null
+++ b/patches.suse/kvm-x86-make-fnamefetch-and-_direct_map-more-similar
@@ -0,0 +1,169 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 24 Jun 2019 13:06:21 +0200
+Subject: KVM: x86: make FNAME(fetch) and __direct_map more similar
+Git-commit: 3fcf2d1bdeb6a513523cb2c77012a6b047aa859c
+Patch-mainline: v5.3-rc1
+References: bsc#1117665
+
+These two functions are basically doing the same thing through
+kvm_mmu_get_page, link_shadow_page and mmu_set_spte; yet, for historical
+reasons, their code looks very different. This patch tries to take the
+best of each and make them very similar, so that it is easy to understand
+changes that apply to both of them.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/mmu.c | 53 ++++++++++++++++++++++------------------------
+ arch/x86/kvm/paging_tmpl.h | 30 ++++++++++++--------------
+ 2 files changed, 39 insertions(+), 44 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3016,40 +3016,39 @@ static void direct_pte_prefetch(struct k
+ __direct_pte_prefetch(vcpu, sp, sptep);
+ }
+
+-static int __direct_map(struct kvm_vcpu *vcpu, int write, int map_writable,
+- int level, gfn_t gfn, kvm_pfn_t pfn, bool prefault)
++static int __direct_map(struct kvm_vcpu *vcpu, gpa_t gpa, int write,
++ int map_writable, int level, kvm_pfn_t pfn,
++ bool prefault)
+ {
+- struct kvm_shadow_walk_iterator iterator;
++ struct kvm_shadow_walk_iterator it;
+ struct kvm_mmu_page *sp;
+- int emulate = 0;
+- gfn_t pseudo_gfn;
++ int ret;
++ gfn_t gfn = gpa >> PAGE_SHIFT;
++ gfn_t base_gfn = gfn;
+
+ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
+- return 0;
++ return RET_PF_RETRY;
+
+- for_each_shadow_entry(vcpu, (u64)gfn << PAGE_SHIFT, iterator) {
+- if (iterator.level == level) {
+- emulate = mmu_set_spte(vcpu, iterator.sptep, ACC_ALL,
+- write, level, gfn, pfn, prefault,
+- map_writable);
+- direct_pte_prefetch(vcpu, iterator.sptep);
+- ++vcpu->stat.pf_fixed;
++ for_each_shadow_entry(vcpu, gpa, it) {
++ base_gfn = gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
++ if (it.level == level)
+ break;
+- }
+
+- drop_large_spte(vcpu, iterator.sptep);
+- if (!is_shadow_present_pte(*iterator.sptep)) {
+- u64 base_addr = iterator.addr;
++ drop_large_spte(vcpu, it.sptep);
++ if (!is_shadow_present_pte(*it.sptep)) {
++ sp = kvm_mmu_get_page(vcpu, base_gfn, it.addr,
++ it.level - 1, true, ACC_ALL);
+
+- base_addr &= PT64_LVL_ADDR_MASK(iterator.level);
+- pseudo_gfn = base_addr >> PAGE_SHIFT;
+- sp = kvm_mmu_get_page(vcpu, pseudo_gfn, iterator.addr,
+- iterator.level - 1, 1, ACC_ALL);
+-
+- link_shadow_page(vcpu, iterator.sptep, sp);
++ link_shadow_page(vcpu, it.sptep, sp);
+ }
+ }
+- return emulate;
++
++ ret = mmu_set_spte(vcpu, it.sptep, ACC_ALL,
++ write, level, base_gfn, pfn, prefault,
++ map_writable);
++ direct_pte_prefetch(vcpu, it.sptep);
++ ++vcpu->stat.pf_fixed;
++ return ret;
+ }
+
+ static void kvm_send_hwpoison_signal(unsigned long address, struct task_struct *tsk)
+@@ -3381,8 +3380,7 @@ static int nonpaging_map(struct kvm_vcpu
+ goto out_unlock;
+ if (likely(!force_pt_level))
+ transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
+- r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
+-
++ r = __direct_map(vcpu, v, write, map_writable, level, pfn, prefault);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+@@ -3971,8 +3969,7 @@ static int tdp_page_fault(struct kvm_vcp
+ goto out_unlock;
+ if (likely(!force_pt_level))
+ transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
+- r = __direct_map(vcpu, write, map_writable, level, gfn, pfn, prefault);
+-
++ r = __direct_map(vcpu, gpa, write, map_writable, level, pfn, prefault);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+ kvm_release_pfn_clean(pfn);
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -595,6 +595,7 @@ static int FNAME(fetch)(struct kvm_vcpu
+ struct kvm_shadow_walk_iterator it;
+ unsigned direct_access, access = gw->pt_access;
+ int top_level, ret;
++ gfn_t base_gfn;
+
+ direct_access = gw->pte_access;
+
+@@ -639,31 +640,29 @@ static int FNAME(fetch)(struct kvm_vcpu
+ link_shadow_page(vcpu, it.sptep, sp);
+ }
+
+- for (;
+- shadow_walk_okay(&it) && it.level > hlevel;
+- shadow_walk_next(&it)) {
+- gfn_t direct_gfn;
++ base_gfn = gw->gfn;
+
++ for (; shadow_walk_okay(&it); shadow_walk_next(&it)) {
+ clear_sp_write_flooding_count(it.sptep);
++ base_gfn = gw->gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
++ if (it.level == hlevel)
++ break;
++
+ validate_direct_spte(vcpu, it.sptep, direct_access);
+
+ drop_large_spte(vcpu, it.sptep);
+
+- if (is_shadow_present_pte(*it.sptep))
+- continue;
+-
+- direct_gfn = gw->gfn & ~(KVM_PAGES_PER_HPAGE(it.level) - 1);
+-
+- sp = kvm_mmu_get_page(vcpu, direct_gfn, addr, it.level-1,
+- true, direct_access);
+- link_shadow_page(vcpu, it.sptep, sp);
++ if (!is_shadow_present_pte(*it.sptep)) {
++ sp = kvm_mmu_get_page(vcpu, base_gfn, addr,
++ it.level - 1, true, direct_access);
++ link_shadow_page(vcpu, it.sptep, sp);
++ }
+ }
+
+- clear_sp_write_flooding_count(it.sptep);
+ ret = mmu_set_spte(vcpu, it.sptep, gw->pte_access, write_fault,
+- it.level, gw->gfn, pfn, prefault, map_writable);
++ it.level, base_gfn, pfn, prefault, map_writable);
+ FNAME(pte_prefetch)(vcpu, gw, it.sptep);
+-
++ ++vcpu->stat.pf_fixed;
+ return ret;
+
+ out_gpte_changed:
+@@ -826,7 +825,6 @@ static int FNAME(page_fault)(struct kvm_
+ transparent_hugepage_adjust(vcpu, &walker.gfn, &pfn, &level);
+ r = FNAME(fetch)(vcpu, addr, &walker, write_fault,
+ level, pfn, map_writable, prefault);
+- ++vcpu->stat.pf_fixed;
+ kvm_mmu_audit(vcpu, AUDIT_POST_PAGE_FAULT);
+
+ out_unlock:
diff --git a/patches.suse/kvm-x86-powerpc-do-not-allow-clearing-largepages-debugfs-entry b/patches.suse/kvm-x86-powerpc-do-not-allow-clearing-largepages-debugfs-entry
new file mode 100644
index 0000000000..b31ea1b639
--- /dev/null
+++ b/patches.suse/kvm-x86-powerpc-do-not-allow-clearing-largepages-debugfs-entry
@@ -0,0 +1,97 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 30 Sep 2019 18:48:44 +0200
+Subject: kvm: x86, powerpc: do not allow clearing largepages debugfs entry
+Git-commit: 833b45de69a6016c4b0cebe6765d526a31a81580
+Patch-mainline: v5.4-rc2
+References: bsc#1117665
+
+The largepages debugfs entry is incremented/decremented as shadow
+pages are created or destroyed. Clearing it will result in an
+underflow, which is harmless to KVM but ugly (and could be
+misinterpreted by tools that use debugfs information), so make
+this particular statistic read-only.
+
+Cc: kvm-ppc@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/powerpc/kvm/book3s.c | 8 ++++----
+ arch/x86/kvm/x86.c | 6 +++---
+ include/linux/kvm_host.h | 2 ++
+ virt/kvm/kvm_main.c | 10 +++++++---
+ 4 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -90,8 +90,8 @@ u64 __read_mostly efer_reserved_bits = ~
+ static u64 __read_mostly efer_reserved_bits = ~((u64)EFER_SCE);
+ #endif
+
+-#define VM_STAT(x) offsetof(struct kvm, stat.x), KVM_STAT_VM
+-#define VCPU_STAT(x) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU
++#define VM_STAT(x, ...) offsetof(struct kvm, stat.x), KVM_STAT_VM, ## __VA_ARGS__
++#define VCPU_STAT(x, ...) offsetof(struct kvm_vcpu, stat.x), KVM_STAT_VCPU, ## __VA_ARGS__
+
+ #define KVM_X2APIC_API_VALID_FLAGS (KVM_X2APIC_API_USE_32BIT_IDS | \
+ KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK)
+@@ -194,7 +194,7 @@ struct kvm_stats_debugfs_item debugfs_en
+ { "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
+ { "mmu_unsync", VM_STAT(mmu_unsync) },
+ { "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
+- { "largepages", VM_STAT(lpages) },
++ { "largepages", VM_STAT(lpages, .mode = 0444) },
+ { "max_mmu_page_hash_collisions",
+ VM_STAT(max_mmu_page_hash_collisions) },
+ { NULL }
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -1016,6 +1016,7 @@ enum kvm_stat_kind {
+
+ struct kvm_stat_data {
+ int offset;
++ int mode;
+ struct kvm *kvm;
+ };
+
+@@ -1023,6 +1024,7 @@ struct kvm_stats_debugfs_item {
+ const char *name;
+ int offset;
+ enum kvm_stat_kind kind;
++ int mode;
+ };
+ extern struct kvm_stats_debugfs_item debugfs_entries[];
+ extern struct dentry *kvm_debugfs_dir;
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -642,8 +642,9 @@ static int kvm_create_vm_debugfs(struct
+
+ stat_data->kvm = kvm;
+ stat_data->offset = p->offset;
++ stat_data->mode = p->mode ? p->mode : 0644;
+ kvm->debugfs_stat_data[p - debugfs_entries] = stat_data;
+- if (!debugfs_create_file(p->name, 0644,
++ if (!debugfs_create_file(p->name, stat_data->mode,
+ kvm->debugfs_dentry,
+ stat_data,
+ stat_fops_per_vm[p->kind]))
+@@ -3751,7 +3752,9 @@ static int kvm_debugfs_open(struct inode
+ if (!refcount_inc_not_zero(&stat_data->kvm->users_count))
+ return -ENOENT;
+
+- if (simple_attr_open(inode, file, get, set, fmt)) {
++ if (simple_attr_open(inode, file, get,
++ stat_data->mode & S_IWUGO ? set : NULL,
++ fmt)) {
+ kvm_put_kvm(stat_data->kvm);
+ return -ENOMEM;
+ }
+@@ -4002,7 +4005,8 @@ static int kvm_init_debug(void)
+
+ kvm_debugfs_num_entries = 0;
+ for (p = debugfs_entries; p->name; ++p, kvm_debugfs_num_entries++) {
+- if (!debugfs_create_file(p->name, 0644, kvm_debugfs_dir,
++ int mode = p->mode ? p->mode : 0644;
++ if (!debugfs_create_file(p->name, mode, kvm_debugfs_dir,
+ (void *)(long)p->offset,
+ stat_fops[p->kind]))
+ goto out_dir;
diff --git a/patches.suse/kvm-x86-remove-now-unneeded-hugepage-gfn-adjustment b/patches.suse/kvm-x86-remove-now-unneeded-hugepage-gfn-adjustment
new file mode 100644
index 0000000000..9c01a8225d
--- /dev/null
+++ b/patches.suse/kvm-x86-remove-now-unneeded-hugepage-gfn-adjustment
@@ -0,0 +1,71 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Sun, 23 Jun 2019 19:15:49 +0200
+Subject: KVM: x86: remove now unneeded hugepage gfn adjustment
+Git-commit: d679b32611c0102ce33b9e1a4e4b94854ed1812a
+Patch-mainline: v5.3-rc1
+References: bsc#1117665
+
+After the previous patch, the low bits of the gfn are masked in
+both FNAME(fetch) and __direct_map, so we do not need to clear them
+in transparent_hugepage_adjust.
+
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/mmu.c | 9 +++------
+ arch/x86/kvm/paging_tmpl.h | 2 +-
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3083,11 +3083,10 @@ static int kvm_handle_bad_page(struct kv
+ }
+
+ static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu,
+- gfn_t *gfnp, kvm_pfn_t *pfnp,
++ gfn_t gfn, kvm_pfn_t *pfnp,
+ int *levelp)
+ {
+ kvm_pfn_t pfn = *pfnp;
+- gfn_t gfn = *gfnp;
+ int level = *levelp;
+
+ /*
+@@ -3114,8 +3113,6 @@ static void transparent_hugepage_adjust(
+ mask = KVM_PAGES_PER_HPAGE(level) - 1;
+ VM_BUG_ON((gfn & mask) != (pfn & mask));
+ if (pfn & mask) {
+- gfn &= ~mask;
+- *gfnp = gfn;
+ kvm_release_pfn_clean(pfn);
+ pfn &= ~mask;
+ kvm_get_pfn(pfn);
+@@ -3379,7 +3376,7 @@ static int nonpaging_map(struct kvm_vcpu
+ if (make_mmu_pages_available(vcpu) < 0)
+ goto out_unlock;
+ if (likely(!force_pt_level))
+- transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
++ transparent_hugepage_adjust(vcpu, gfn, &pfn, &level);
+ r = __direct_map(vcpu, v, write, map_writable, level, pfn, prefault);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+@@ -3968,7 +3965,7 @@ static int tdp_page_fault(struct kvm_vcp
+ if (make_mmu_pages_available(vcpu) < 0)
+ goto out_unlock;
+ if (likely(!force_pt_level))
+- transparent_hugepage_adjust(vcpu, &gfn, &pfn, &level);
++ transparent_hugepage_adjust(vcpu, gfn, &pfn, &level);
+ r = __direct_map(vcpu, gpa, write, map_writable, level, pfn, prefault);
+ out_unlock:
+ spin_unlock(&vcpu->kvm->mmu_lock);
+--- a/arch/x86/kvm/paging_tmpl.h
++++ b/arch/x86/kvm/paging_tmpl.h
+@@ -822,7 +822,7 @@ static int FNAME(page_fault)(struct kvm_
+ if (make_mmu_pages_available(vcpu) < 0)
+ goto out_unlock;
+ if (!force_pt_level)
+- transparent_hugepage_adjust(vcpu, &walker.gfn, &pfn, &level);
++ transparent_hugepage_adjust(vcpu, walker.gfn, &pfn, &level);
+ r = FNAME(fetch)(vcpu, addr, &walker, write_fault,
+ level, pfn, map_writable, prefault);
+ kvm_mmu_audit(vcpu, AUDIT_POST_PAGE_FAULT);
diff --git a/patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch b/patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch
index 6a469dc969..4d34c5485f 100644
--- a/patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch
+++ b/patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch
@@ -1,8 +1,7 @@
From: Dave Jiang <dave.jiang@intel.com>
Date: Tue, 24 Sep 2019 10:34:49 -0700
Subject: libnvdimm: prevent nvdimm from requesting key when security is disabled
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm.git
+Patch-mainline: v5.4-rc1
Git-commit: 674f31a352da5e9f621f757b9a89262f486533a0
References: bsc#1137982
diff --git a/patches.suse/mld-fix-memory-leak-in-mld_del_delrec.patch b/patches.suse/mld-fix-memory-leak-in-mld_del_delrec.patch
new file mode 100644
index 0000000000..15269117df
--- /dev/null
+++ b/patches.suse/mld-fix-memory-leak-in-mld_del_delrec.patch
@@ -0,0 +1,69 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 27 Aug 2019 03:33:12 -0700
+Subject: mld: fix memory leak in mld_del_delrec()
+Git-commit: a84d016479896b5526a2cc54784e6ffc41c9d6f6
+Patch-mainline: 5.3-rc7
+References: networking-stable-19_09_05
+
+Similar to the fix done for IPv4 in commit e5b1c6c6277d
+("igmp: fix memory leak in igmpv3_del_delrec()"), we need to
+make sure mca_tomb and mca_sources are not blindly overwritten.
+
+Using swap() then a call to ip6_mc_clear_src() will take care
+of the missing free.
+
+BUG: memory leak
+unreferenced object 0xffff888117d9db00 (size 64):
+ comm "syz-executor247", pid 6918, jiffies 4294943989 (age 25.350s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 fe 88 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<000000005b463030>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
+ [<000000005b463030>] slab_post_alloc_hook mm/slab.h:522 [inline]
+ [<000000005b463030>] slab_alloc mm/slab.c:3319 [inline]
+ [<000000005b463030>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
+ [<00000000939cbf94>] kmalloc include/linux/slab.h:552 [inline]
+ [<00000000939cbf94>] kzalloc include/linux/slab.h:748 [inline]
+ [<00000000939cbf94>] ip6_mc_add1_src net/ipv6/mcast.c:2236 [inline]
+ [<00000000939cbf94>] ip6_mc_add_src+0x31f/0x420 net/ipv6/mcast.c:2356
+ [<00000000d8972221>] ip6_mc_source+0x4a8/0x600 net/ipv6/mcast.c:449
+ [<000000002b203d0d>] do_ipv6_setsockopt.isra.0+0x1b92/0x1dd0 net/ipv6/ipv6_sockglue.c:748
+ [<000000001f1e2d54>] ipv6_setsockopt+0x89/0xd0 net/ipv6/ipv6_sockglue.c:944
+ [<00000000c8f7bdf9>] udpv6_setsockopt+0x4e/0x90 net/ipv6/udp.c:1558
+ [<000000005a9a0c5e>] sock_common_setsockopt+0x38/0x50 net/core/sock.c:3139
+ [<00000000910b37b2>] __sys_setsockopt+0x10f/0x220 net/socket.c:2084
+ [<00000000e9108023>] __do_sys_setsockopt net/socket.c:2100 [inline]
+ [<00000000e9108023>] __se_sys_setsockopt net/socket.c:2097 [inline]
+ [<00000000e9108023>] __x64_sys_setsockopt+0x26/0x30 net/socket.c:2097
+ [<00000000f4818160>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
+ [<000000008d367e8f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: 1666d49e1d41 ("mld: do not remove mld souce list info when set link down")
+Fixes: 9c8bb163ae78 ("igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/mcast.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -773,12 +773,13 @@ static void mld_del_delrec(struct inet6_
+ im->mca_crcount = idev->mc_qrv;
+ im->mca_sfmode = pmc->mca_sfmode;
+ if (pmc->mca_sfmode == MCAST_INCLUDE) {
+- im->mca_tomb = pmc->mca_tomb;
+- im->mca_sources = pmc->mca_sources;
++ swap(im->mca_tomb, pmc->mca_tomb);
++ swap(im->mca_sources, pmc->mca_sources);
+ for (psf = im->mca_sources; psf; psf = psf->sf_next)
+ psf->sf_crcount = im->mca_crcount;
+ }
+ in6_dev_put(pmc->idev);
++ ip6_mc_clear_src(pmc);
+ kfree(pmc);
+ }
+ spin_unlock_bh(&im->mca_lock);
diff --git a/patches.suse/msft-hv-1947-PCI-hv-Use-bytes-4-and-5-from-instance-ID-as-the-PCI.patch b/patches.suse/msft-hv-1947-PCI-hv-Use-bytes-4-and-5-from-instance-ID-as-the-PCI.patch
new file mode 100644
index 0000000000..a8984b73fc
--- /dev/null
+++ b/patches.suse/msft-hv-1947-PCI-hv-Use-bytes-4-and-5-from-instance-ID-as-the-PCI.patch
@@ -0,0 +1,37 @@
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Thu, 15 Aug 2019 17:01:45 +0000
+Patch-mainline: v5.4-rc1
+Subject: PCI: hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers
+Git-commit: f73f8a504e27959576a2f4d85182202561e426f2
+References: bsc#1153263
+
+As recommended by Azure host team, the bytes 4, 5 have more uniqueness
+(info entropy) than bytes 8, 9 so use them as the PCI domain numbers.
+
+On older hosts, bytes 4, 5 can also be used -- no backward compatibility
+issues are introduced and the chance of collision is greatly reduced.
+
+In the rare cases of collision, the driver code detects and finds
+another number that is not in use.
+
+Suggested-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Acked-by: Sasha Levin <sashal@kernel.org>
+Acked-by: Olaf Hering <ohering@suse.de>
+---
+ drivers/pci/host/pci-hyperv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
+--- a/drivers/pci/host/pci-hyperv.c
++++ b/drivers/pci/host/pci-hyperv.c
+@@ -2590,7 +2590,7 @@ static int hv_pci_probe(struct hv_device *hdev,
+ * (2) There will be no overlap between domains (after fixing possible
+ * collisions) in the same VM.
+ */
+- dom_req = hdev->dev_instance.b[8] << 8 | hdev->dev_instance.b[9];
++ dom_req = hdev->dev_instance.b[5] << 8 | hdev->dev_instance.b[4];
+ dom = hv_get_dom_num(dom_req);
+
+ if (dom == HVPCI_DOM_INVALID) {
diff --git a/patches.suse/msft-hv-1948-scsi-storvsc-setup-1-1-mapping-between-hardware-queu.patch b/patches.suse/msft-hv-1948-scsi-storvsc-setup-1-1-mapping-between-hardware-queu.patch
new file mode 100644
index 0000000000..f12668b0c2
--- /dev/null
+++ b/patches.suse/msft-hv-1948-scsi-storvsc-setup-1-1-mapping-between-hardware-queu.patch
@@ -0,0 +1,37 @@
+From: Long Li <longli@microsoft.com>
+Date: Fri, 6 Sep 2019 10:24:20 -0700
+Patch-mainline: v5.4-rc2
+Subject: scsi: storvsc: setup 1:1 mapping between hardware queue and CPU queue
+Git-commit: 0ed8810276907c8a633dc8cecc48dabb6678cd23
+References: bsc#1140729
+
+storvsc doesn't use a dedicated hardware queue for a given CPU queue. When
+issuing I/O, it selects returning CPU (hardware queue) dynamically based on
+vmbus channel usage across all channels.
+
+This patch advertises num_present_cpus() as number of hardware queues. This
+will have upper layer setup 1:1 mapping between hardware queue and CPU
+queue and avoid unnecessary locking when issuing I/O.
+
+Link: https://lore.kernel.org/r/1567790660-48142-1-git-send-email-longli@linuxonhyperv.com
+Signed-off-by: Long Li <longli@microsoft.com>
+Reviewed-by: Michael Kelley <mikelley@microsoft.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Olaf Hering <ohering@suse.de>
+---
+ drivers/scsi/storvsc_drv.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1837,8 +1837,7 @@ static int storvsc_probe(struct hv_device *device,
+ /*
+ * Set the number of HW queues we are supporting.
+ */
+- if (stor_device->num_sc != 0)
+- host->nr_hw_queues = stor_device->num_sc + 1;
++ host->nr_hw_queues = num_present_cpus();
+
+ /*
+ * Set the error handler work queue.
diff --git a/patches.suse/net-Fix-null-de-reference-of-device-refcount.patch b/patches.suse/net-Fix-null-de-reference-of-device-refcount.patch
new file mode 100644
index 0000000000..825d093ba4
--- /dev/null
+++ b/patches.suse/net-Fix-null-de-reference-of-device-refcount.patch
@@ -0,0 +1,52 @@
+From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Date: Tue, 10 Sep 2019 14:02:57 -0600
+Subject: net: Fix null de-reference of device refcount
+Git-commit: 10cc514f451a0f239aa34f91bc9dc954a9397840
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+In event of failure during register_netdevice, free_netdev is
+invoked immediately. free_netdev assumes that all the netdevice
+refcounts have been dropped prior to it being called and as a
+result frees and clears out the refcount pointer.
+
+However, this is not necessarily true as some of the operations
+in the NETDEV_UNREGISTER notifier handlers queue RCU callbacks for
+invocation after a grace period. The IPv4 callback in_dev_rcu_put
+tries to access the refcount after free_netdev is called which
+leads to a null de-reference-
+
+44837.761523: <6> Unable to handle kernel paging request at
+ virtual address 0000004a88287000
+44837.761651: <2> pc : in_dev_finish_destroy+0x4c/0xc8
+44837.761654: <2> lr : in_dev_finish_destroy+0x2c/0xc8
+44837.762393: <2> Call trace:
+44837.762398: <2> in_dev_finish_destroy+0x4c/0xc8
+44837.762404: <2> in_dev_rcu_put+0x24/0x30
+44837.762412: <2> rcu_nocb_kthread+0x43c/0x468
+44837.762418: <2> kthread+0x118/0x128
+44837.762424: <2> ret_from_fork+0x10/0x1c
+
+Fix this by waiting for the completion of the call_rcu() in
+case of register_netdevice errors.
+
+Fixes: 93ee31f14f6f ("[NET]: Fix free_netdev on register_netdev failure.")
+Cc: Sean Tranchetti <stranche@codeaurora.org>
+Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/dev.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -7648,6 +7648,8 @@ int register_netdevice(struct net_device
+ ret = notifier_to_errno(ret);
+ if (ret) {
+ rollback_registered(dev);
++ rcu_barrier();
++
+ dev->reg_state = NETREG_UNREGISTERED;
+ }
+ /*
diff --git a/patches.suse/net-fix-skb-use-after-free-in-netpoll.patch b/patches.suse/net-fix-skb-use-after-free-in-netpoll.patch
new file mode 100644
index 0000000000..140001a86e
--- /dev/null
+++ b/patches.suse/net-fix-skb-use-after-free-in-netpoll.patch
@@ -0,0 +1,88 @@
+From: Feng Sun <loyou85@gmail.com>
+Date: Mon, 26 Aug 2019 14:46:04 +0800
+Subject: net: fix skb use after free in netpoll
+Git-commit: 2c1644cf6d46a8267d79ed95cb9b563839346562
+Patch-mainline: 5.3-rc7
+References: networking-stable-19_09_05
+
+After commit baeababb5b85d5c4e6c917efe2a1504179438d3b
+("tun: return NET_XMIT_DROP for dropped packets"),
+when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP,
+netpoll_send_skb_on_dev will run into following use after free cases:
+1. retry netpoll_start_xmit with freed skb;
+2. queue freed skb in npinfo->txq.
+queue_process will also run into use after free case.
+
+hit netpoll_send_skb_on_dev first case with following kernel log:
+
+[ 117.864773] kernel BUG at mm/slub.c:306!
+[ 117.864773] invalid opcode: 0000 [#1] SMP PTI
+[ 117.864774] CPU: 3 PID: 2627 Comm: loop_printmsg Kdump: loaded Tainted: P OE 5.3.0-050300rc5-generic #201908182231
+[ 117.864775] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+[ 117.864775] RIP: 0010:kmem_cache_free+0x28d/0x2b0
+[ 117.864781] Call Trace:
+[ 117.864781] ? tun_net_xmit+0x21c/0x460
+[ 117.864781] kfree_skbmem+0x4e/0x60
+[ 117.864782] kfree_skb+0x3a/0xa0
+[ 117.864782] tun_net_xmit+0x21c/0x460
+[ 117.864782] netpoll_start_xmit+0x11d/0x1b0
+[ 117.864788] netpoll_send_skb_on_dev+0x1b8/0x200
+[ 117.864789] __br_forward+0x1b9/0x1e0 [bridge]
+[ 117.864789] ? skb_clone+0x53/0xd0
+[ 117.864790] ? __skb_clone+0x2e/0x120
+[ 117.864790] deliver_clone+0x37/0x50 [bridge]
+[ 117.864790] maybe_deliver+0x89/0xc0 [bridge]
+[ 117.864791] br_flood+0x6c/0x130 [bridge]
+[ 117.864791] br_dev_xmit+0x315/0x3c0 [bridge]
+[ 117.864792] netpoll_start_xmit+0x11d/0x1b0
+[ 117.864792] netpoll_send_skb_on_dev+0x1b8/0x200
+[ 117.864792] netpoll_send_udp+0x2c6/0x3e8
+[ 117.864793] write_msg+0xd9/0xf0 [netconsole]
+[ 117.864793] console_unlock+0x386/0x4e0
+[ 117.864793] vprintk_emit+0x17e/0x280
+[ 117.864794] vprintk_default+0x29/0x50
+[ 117.864794] vprintk_func+0x4c/0xbc
+[ 117.864794] printk+0x58/0x6f
+[ 117.864795] loop_fun+0x24/0x41 [printmsg_loop]
+[ 117.864795] kthread+0x104/0x140
+[ 117.864795] ? 0xffffffffc05b1000
+[ 117.864796] ? kthread_park+0x80/0x80
+[ 117.864796] ret_from_fork+0x35/0x40
+
+Signed-off-by: Feng Sun <loyou85@gmail.com>
+Signed-off-by: Xiaojun Zhao <xiaojunzhao141@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/netpoll.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -122,7 +122,7 @@ static void queue_process(struct work_st
+ txq = netdev_get_tx_queue(dev, q_index);
+ HARD_TX_LOCK(dev, txq, smp_processor_id());
+ if (netif_xmit_frozen_or_stopped(txq) ||
+- netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) {
++ !dev_xmit_complete(netpoll_start_xmit(skb, dev, txq))) {
+ skb_queue_head(&npinfo->txq, skb);
+ HARD_TX_UNLOCK(dev, txq);
+ local_irq_restore(flags);
+@@ -357,7 +357,7 @@ void netpoll_send_skb_on_dev(struct netp
+
+ HARD_TX_UNLOCK(dev, txq);
+
+- if (status == NETDEV_TX_OK)
++ if (dev_xmit_complete(status))
+ break;
+
+ }
+@@ -374,7 +374,7 @@ void netpoll_send_skb_on_dev(struct netp
+
+ }
+
+- if (status != NETDEV_TX_OK) {
++ if (!dev_xmit_complete(status)) {
+ skb_queue_tail(&npinfo->txq, skb);
+ schedule_delayed_work(&npinfo->tx_work,0);
+ }
diff --git a/patches.suse/net-gso-Fix-skb_segment-splat-when-splitting-gso_siz.patch b/patches.suse/net-gso-Fix-skb_segment-splat-when-splitting-gso_siz.patch
new file mode 100644
index 0000000000..31c3faa99d
--- /dev/null
+++ b/patches.suse/net-gso-Fix-skb_segment-splat-when-splitting-gso_siz.patch
@@ -0,0 +1,104 @@
+From: Shmulik Ladkani <shmulik@metanetworks.com>
+Date: Fri, 6 Sep 2019 12:23:50 +0300
+Subject: net: gso: Fix skb_segment splat when splitting gso_size mangled skb
+ having linear-headed frag_list
+Git-commit: 3dcbdb134f329842a38f0e6797191b885ab00a00
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+Historically, support for frag_list packets entering skb_segment() was
+limited to frag_list members terminating on exact same gso_size
+boundaries. This is verified with a BUG_ON since commit 89319d3801d1
+("net: Add frag_list support to skb_segment"), quote:
+
+ As such we require all frag_list members terminate on exact MSS
+ boundaries. This is checked using BUG_ON.
+ As there should only be one producer in the kernel of such packets,
+ namely GRO, this requirement should not be difficult to maintain.
+
+However, since commit 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper"),
+the "exact MSS boundaries" assumption no longer holds:
+An eBPF program using bpf_skb_change_proto() DOES modify 'gso_size', but
+leaves the frag_list members as originally merged by GRO with the
+original 'gso_size'. Example of such programs are bpf-based NAT46 or
+NAT64.
+
+This lead to a kernel BUG_ON for flows involving:
+ - GRO generating a frag_list skb
+ - bpf program performing bpf_skb_change_proto() or bpf_skb_adjust_room()
+ - skb_segment() of the skb
+
+See example BUG_ON reports in [0].
+
+In commit 13acc94eff12 ("net: permit skb_segment on head_frag frag_list skb"),
+skb_segment() was modified to support the "gso_size mangling" case of
+a frag_list GRO'ed skb, but *only* for frag_list members having
+head_frag==true (having a page-fragment head).
+
+Alas, GRO packets having frag_list members with a linear kmalloced head
+(head_frag==false) still hit the BUG_ON.
+
+This commit adds support to skb_segment() for a 'head_skb' packet having
+a frag_list whose members are *non* head_frag, with gso_size mangled, by
+disabling SG and thus falling-back to copying the data from the given
+'head_skb' into the generated segmented skbs - as suggested by Willem de
+Bruijn [1].
+
+Since this approach involves the penalty of skb_copy_and_csum_bits()
+when building the segments, care was taken in order to enable this
+solution only when required:
+ - untrusted gso_size, by testing SKB_GSO_DODGY is set
+ (SKB_GSO_DODGY is set by any gso_size mangling functions in
+ net/core/filter.c)
+ - the frag_list is non empty, its item is a non head_frag, *and* the
+ headlen of the given 'head_skb' does not match the gso_size.
+
+[0]
+https://lore.kernel.org/netdev/20190826170724.25ff616f@pixies/
+https://lore.kernel.org/netdev/9265b93f-253d-6b8c-f2b8-4b54eff1835c@fb.com/
+
+[1]
+https://lore.kernel.org/netdev/CA+FuTSfVsgNDi7c=GUU8nMg2hWxF2SjCNLXetHeVPdnxAW5K-w@mail.gmail.com/
+
+Fixes: 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper")
+Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
+Cc: Daniel Borkmann <daniel@iogearbox.net>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Alexander Duyck <alexander.duyck@gmail.com>
+Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Reviewed-by: Willem de Bruijn <willemb@google.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/skbuff.c | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3097,6 +3097,25 @@ struct sk_buff *skb_segment(struct sk_bu
+ int pos;
+ int dummy;
+
++ if (list_skb && !list_skb->head_frag && skb_headlen(list_skb) &&
++ (skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY)) {
++ /* gso_size is untrusted, and we have a frag_list with a linear
++ * non head_frag head.
++ *
++ * (we assume checking the first list_skb member suffices;
++ * i.e if either of the list_skb members have non head_frag
++ * head, then the first one has too).
++ *
++ * If head_skb's headlen does not fit requested gso_size, it
++ * means that the frag_list members do NOT terminate on exact
++ * gso_size boundaries. Hence we cannot perform skb_frag_t page
++ * sharing. Therefore we must fallback to copying the frag_list
++ * skbs; we do so by disabling SG.
++ */
++ if (mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb))
++ features &= ~NETIF_F_SG;
++ }
++
+ __skb_push(head_skb, doffset);
+ proto = skb_network_protocol(head_skb, &dummy);
+ if (unlikely(!proto))
diff --git a/patches.suse/net-ibmvnic-Fix-EOI-when-running-in-XIVE-mode.patch b/patches.suse/net-ibmvnic-Fix-EOI-when-running-in-XIVE-mode.patch
new file mode 100644
index 0000000000..9ceee8b4c0
--- /dev/null
+++ b/patches.suse/net-ibmvnic-Fix-EOI-when-running-in-XIVE-mode.patch
@@ -0,0 +1,53 @@
+From 11d49ce9f7946dfed4dcf5dbde865c78058b50ab Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@kaod.org>
+Date: Fri, 11 Oct 2019 07:52:54 +0200
+Subject: [PATCH] net/ibmvnic: Fix EOI when running in XIVE mode.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+References: bsc#1089644, ltc#166495, ltc#165544, git-fixes
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net
+Git-commit: 11d49ce9f7946dfed4dcf5dbde865c78058b50ab
+
+pSeries machines on POWER9 processors can run with the XICS (legacy)
+interrupt mode or with the XIVE exploitation interrupt mode. These
+interrupt contollers have different interfaces for interrupt
+management : XICS uses hcalls and XIVE loads and stores on a page.
+H_EOI being a XICS interface the enable_scrq_irq() routine can fail
+when the machine runs in XIVE mode.
+
+Fix that by calling the EOI handler of the interrupt chip.
+
+Fixes: f23e0643cd0b ("ibmvnic: Clear pending interrupt after device reset")
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2b073a3c0b84..f59d9a8e35e2 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -2878,12 +2878,10 @@ static int enable_scrq_irq(struct ibmvnic_adapter *adapter,
+
+ if (test_bit(0, &adapter->resetting) &&
+ adapter->reset_reason == VNIC_RESET_MOBILITY) {
+- u64 val = (0xff000000) | scrq->hw_irq;
++ struct irq_desc *desc = irq_to_desc(scrq->irq);
++ struct irq_chip *chip = irq_desc_get_chip(desc);
+
+- rc = plpar_hcall_norets(H_EOI, val);
+- if (rc)
+- dev_err(dev, "H_EOI FAILED irq 0x%llx. rc=%ld\n",
+- val, rc);
++ chip->irq_eoi(&desc->irq_data);
+ }
+
+ rc = plpar_hcall_norets(H_VIOCTL, adapter->vdev->unit_address,
+--
+2.23.0
+
diff --git a/patches.suse/net-mlx4_en-fix-a-memory-leak-bug.patch b/patches.suse/net-mlx4_en-fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..4b5ade091d
--- /dev/null
+++ b/patches.suse/net-mlx4_en-fix-a-memory-leak-bug.patch
@@ -0,0 +1,43 @@
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Mon, 12 Aug 2019 14:11:35 -0500
+Subject: net/mlx4_en: fix a memory leak bug
+Patch-mainline: v5.3-rc6
+Git-commit: 48ec7014c56e5eb2fbf6f479896143622d834f3b
+References: bsc#1046299 FATE#322947
+
+In mlx4_en_config_rss_steer(), 'rss_map->indir_qp' is allocated through
+kzalloc(). After that, mlx4_qp_alloc() is invoked to configure RSS
+indirection. However, if mlx4_qp_alloc() fails, the allocated
+'rss_map->indir_qp' is not deallocated, leading to a memory leak bug.
+
+To fix the above issue, add the 'qp_alloc_err' label to free
+'rss_map->indir_qp'.
+
+Fixes: 4931c6ef04b4 ("net/mlx4_en: Optimized single ring steering")
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -1173,7 +1173,7 @@ int mlx4_en_config_rss_steer(struct mlx4
+ err = mlx4_qp_alloc(mdev->dev, priv->base_qpn, rss_map->indir_qp);
+ if (err) {
+ en_err(priv, "Failed to allocate RSS indirection QP\n");
+- goto rss_err;
++ goto qp_alloc_err;
+ }
+
+ rss_map->indir_qp->event = mlx4_en_sqp_event;
+@@ -1227,6 +1227,7 @@ indir_err:
+ MLX4_QP_STATE_RST, NULL, 0, 0, rss_map->indir_qp);
+ mlx4_qp_remove(mdev->dev, rss_map->indir_qp);
+ mlx4_qp_free(mdev->dev, rss_map->indir_qp);
++qp_alloc_err:
+ kfree(rss_map->indir_qp);
+ rss_map->indir_qp = NULL;
+ rss_err:
diff --git a/patches.suse/net-mlx5-Add-device-ID-of-upcoming-BlueField-2.patch b/patches.suse/net-mlx5-Add-device-ID-of-upcoming-BlueField-2.patch
new file mode 100644
index 0000000000..209646935b
--- /dev/null
+++ b/patches.suse/net-mlx5-Add-device-ID-of-upcoming-BlueField-2.patch
@@ -0,0 +1,29 @@
+From: Bodong Wang <bodong@mellanox.com>
+Date: Mon, 26 Aug 2019 16:34:12 -0500
+Subject: net/mlx5: Add device ID of upcoming BlueField-2
+Patch-mainline: v5.4-rc1
+Git-commit: d19a79ee38c8fda6d297e4227e80db8bf51c71a6
+References: bsc#1046303 FATE#322944
+
+Add the device ID of upcoming BlueField-2 integrated ConnectX-6 Dx
+network controller. Its VFs will be using the generic VF device ID:
+0x101e "ConnectX Family mlx5Gen Virtual Function".
+
+Fixes: 2e9d3e83ab82 ("net/mlx5: Update the list of the PCI supported devices")
+Signed-off-by: Bodong Wang <bodong@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1591,6 +1591,7 @@ static const struct pci_device_id mlx5_c
+ { PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF}, /* ConnectX Family mlx5Gen Virtual Function */
+ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */
+ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */
++ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
+ { 0, }
+ };
+
diff --git a/patches.suse/net-mlx5-Fix-error-handling-in-mlx5_load.patch b/patches.suse/net-mlx5-Fix-error-handling-in-mlx5_load.patch
new file mode 100644
index 0000000000..5279e2b15b
--- /dev/null
+++ b/patches.suse/net-mlx5-Fix-error-handling-in-mlx5_load.patch
@@ -0,0 +1,30 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Thu, 16 May 2019 11:11:11 -0700
+Subject: net/mlx5: Fix error handling in mlx5_load()
+Patch-mainline: v5.2-rc3
+Git-commit: 8788392995e7f1ea87d4efa03c14d872b05f9f25
+References: bsc#1046305 FATE#322943
+
+In case mlx5_core_set_hca_defaults fails, it should jump to
+mlx5_cleanup_fs, fix that.
+
+Fixes: c85023e153e3 ("IB/mlx5: Add raw ethernet local loopback support")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Reviewed-by: Huy Nguyen <huyn@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1153,7 +1153,7 @@ static int mlx5_load_one(struct mlx5_cor
+ err = mlx5_core_set_hca_defaults(dev);
+ if (err) {
+ dev_err(&pdev->dev, "Failed to set hca defaults\n");
+- goto err_fs;
++ goto err_sriov;
+ }
+
+ err = mlx5_sriov_attach(dev);
diff --git a/patches.suse/net-sched-act_sample-fix-psample-group-handling-on-o.patch b/patches.suse/net-sched-act_sample-fix-psample-group-handling-on-o.patch
new file mode 100644
index 0000000000..d7c4140143
--- /dev/null
+++ b/patches.suse/net-sched-act_sample-fix-psample-group-handling-on-o.patch
@@ -0,0 +1,79 @@
+From: Vlad Buslov <vladbu@mellanox.com>
+Date: Tue, 27 Aug 2019 21:49:38 +0300
+Subject: net: sched: act_sample: fix psample group handling on overwrite
+Git-commit: dbf47a2a094edf58983265e323ca4bdcdb58b5ee
+Patch-mainline: 5.3-rc7
+References: networking-stable-19_09_05
+
+Action sample doesn't properly handle psample_group pointer in overwrite
+case. Following issues need to be fixed:
+
+- In tcf_sample_init() function RCU_INIT_POINTER() is used to set
+ s->psample_group, even though we neither setting the pointer to NULL, nor
+ preventing concurrent readers from accessing the pointer in some way.
+ Use rcu_swap_protected() instead to safely reset the pointer.
+
+- Old value of s->psample_group is not released or deallocated in any way,
+ which results resource leak. Use psample_group_put() on non-NULL value
+ obtained with rcu_swap_protected().
+
+- The function psample_group_put() that released reference to struct
+ psample_group pointed by rcu-pointer s->psample_group doesn't respect rcu
+ grace period when deallocating it. Extend struct psample_group with rcu
+ head and use kfree_rcu when freeing it.
+
+[js] in 4.12, rtnl protects the call, use lockdep_rtnl_is_held
+
+Fixes: 5c5670fae430 ("net/sched: Introduce sample tc action")
+Signed-off-by: Vlad Buslov <vladbu@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/psample.h | 1 +
+ net/psample/psample.c | 2 +-
+ net/sched/act_sample.c | 6 +++++-
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/include/net/psample.h
++++ b/include/net/psample.h
+@@ -11,6 +11,7 @@ struct psample_group {
+ u32 group_num;
+ u32 refcount;
+ u32 seq;
++ struct rcu_head rcu;
+ };
+
+ struct psample_group *psample_group_get(struct net *net, u32 group_num);
+--- a/net/psample/psample.c
++++ b/net/psample/psample.c
+@@ -156,7 +156,7 @@ static void psample_group_destroy(struct
+ {
+ psample_group_notify(group, PSAMPLE_CMD_DEL_GROUP);
+ list_del(&group->list);
+- kfree(group);
++ kfree_rcu(group, rcu);
+ }
+
+ static struct psample_group *
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -99,7 +99,8 @@ static int tcf_sample_init(struct net *n
+ s->tcf_action = parm->action;
+ s->rate = rate;
+ s->psample_group_num = psample_group_num;
+- RCU_INIT_POINTER(s->psample_group, psample_group);
++ rcu_swap_protected(s->psample_group, psample_group,
++ lockdep_is_held(&s->tcf_lock));
+
+ if (tb[TCA_SAMPLE_TRUNC_SIZE]) {
+ s->truncate = true;
+@@ -107,6 +108,9 @@ static int tcf_sample_init(struct net *n
+ }
+ spin_unlock_bh(&s->tcf_lock);
+
++ if (psample_group)
++ psample_group_put(psample_group);
++
+ if (ret == ACT_P_CREATED)
+ tcf_idr_insert(tn, *a);
+ return ret;
diff --git a/patches.suse/net-stmmac-dwmac-rk-Don-t-fail-if-phy-regulator-is-a.patch b/patches.suse/net-stmmac-dwmac-rk-Don-t-fail-if-phy-regulator-is-a.patch
new file mode 100644
index 0000000000..aca03871f0
--- /dev/null
+++ b/patches.suse/net-stmmac-dwmac-rk-Don-t-fail-if-phy-regulator-is-a.patch
@@ -0,0 +1,38 @@
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Thu, 29 Aug 2019 11:17:24 +0800
+Subject: net: stmmac: dwmac-rk: Don't fail if phy regulator is absent
+Git-commit: 3b25528e1e355c803e73aa326ce657b5606cda73
+Patch-mainline: 5.3-rc7
+References: networking-stable-19_09_05
+
+The devicetree binding lists the phy phy as optional. As such, the
+driver should not bail out if it can't find a regulator. Instead it
+should just skip the remaining regulator related code and continue
+on normally.
+
+Skip the remainder of phy_power_on() if a regulator supply isn't
+available. This also gets rid of the bogus return code.
+
+Fixes: 2e12f536635f ("net: stmmac: dwmac-rk: Use standard devicetree property for phy regulator")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -886,10 +886,8 @@ static int phy_power_on(struct rk_priv_d
+ int ret;
+ struct device *dev = &bsp_priv->pdev->dev;
+
+- if (!ldo) {
+- dev_err(dev, "no regulator found\n");
+- return -1;
+- }
++ if (!ldo)
++ return 0;
+
+ if (enable) {
+ ret = regulator_enable(ldo);
diff --git a/patches.suse/nfc-enforce-cap_net_raw-for-raw-sockets.patch b/patches.suse/nfc-enforce-cap_net_raw-for-raw-sockets.patch
new file mode 100644
index 0000000000..6b5cb0977f
--- /dev/null
+++ b/patches.suse/nfc-enforce-cap_net_raw-for-raw-sockets.patch
@@ -0,0 +1,39 @@
+From: Ori Nimron <orinimron123@gmail.com>
+Date: Fri, 20 Sep 2019 09:35:49 +0200
+Subject: nfc: enforce CAP_NET_RAW for raw sockets
+Git-commit: 3a359798b176183ef09efb7a3dc59abad1cc7104
+Patch-mainline: v5.4-rc1
+References: bsc#1152788 CVE-2019-17056
+
+When creating a raw AF_NFC socket, CAP_NET_RAW needs to be checked
+first.
+
+Signed-off-by: Ori Nimron <orinimron123@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ net/nfc/llcp_sock.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
+index 9b8742947aff..8dfea26536c9 100644
+--- a/net/nfc/llcp_sock.c
++++ b/net/nfc/llcp_sock.c
+@@ -1004,10 +1004,13 @@ static int llcp_sock_create(struct net *net, struct socket *sock,
+ sock->type != SOCK_RAW)
+ return -ESOCKTNOSUPPORT;
+
+- if (sock->type == SOCK_RAW)
++ if (sock->type == SOCK_RAW) {
++ if (!capable(CAP_NET_RAW))
++ return -EPERM;
+ sock->ops = &llcp_rawsock_ops;
+- else
++ } else {
+ sock->ops = &llcp_sock_ops;
++ }
+
+ sk = nfc_llcp_sock_alloc(sock, sock->type, GFP_ATOMIC, kern);
+ if (sk == NULL)
+
diff --git a/patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch b/patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch
index 2419022f94..e40a9ce72e 100644
--- a/patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch
+++ b/patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch
@@ -3,8 +3,7 @@ Date: Fri, 20 Sep 2019 16:36:45 +1000
Subject: [PATCH] nfsd: degraded slot-count more gracefully as allocation nears
exhaustion.
Git-commit: 2030ca560c5f24138c1f0f8c8a89f1ac3b560613
-Git-repo: git://git.linux-nfs.org/~bfields/linux.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.4-rc1
References: bsc#1150381
This original code in nfsd4_get_drc_mem() would hand out 30
diff --git a/patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch b/patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch
index 5434dc2391..861a17ed8e 100644
--- a/patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch
+++ b/patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch
@@ -2,8 +2,7 @@ From: NeilBrown <neilb@suse.de>
Date: Fri, 20 Sep 2019 16:33:16 +1000
Subject: [PATCH] nfsd: handle drc over-allocation gracefully.
Git-commit: 7f49fd5d7acd82163685559045d04d49433581cc
-Git-repo: git://git.linux-nfs.org/~bfields/linux.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.4-rc1
References: bsc#1150381
Currently, if there are more clients than allowed for by the
diff --git a/patches.suse/objtool-clobber-user-cflags-variable.patch b/patches.suse/objtool-clobber-user-cflags-variable.patch
new file mode 100644
index 0000000000..9d3ab73694
--- /dev/null
+++ b/patches.suse/objtool-clobber-user-cflags-variable.patch
@@ -0,0 +1,36 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 29 Aug 2019 18:28:49 -0500
+Subject: objtool: Clobber user CFLAGS variable
+Git-commit: f73b3cc39c84220e6dccd463b5c8279b03514646
+Patch-mainline: v5.4-rc1
+References: bsc#1153236
+
+If the build user has the CFLAGS variable set in their environment,
+objtool blindly appends to it, which can cause unexpected behavior.
+
+Clobber CFLAGS to ensure consistent objtool compilation behavior.
+
+Reported-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Tested-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/83a276df209962e6058fcb6c615eef9d401c21bc.1567121311.git.jpoimboe@redhat.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ tools/objtool/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -29,7 +29,7 @@ all: $(OBJTOOL)
+ INCLUDES := -I$(srctree)/tools/include \
+ -I$(srctree)/tools/arch/$(HOSTARCH)/include/uapi \
+ -I$(srctree)/tools/objtool/arch/$(ARCH)/include
+-CFLAGS += -Wall -Werror $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -fomit-frame-pointer -O2 -g $(INCLUDES)
++CFLAGS := -Wall -Werror $(EXTRA_WARNINGS) -Wno-switch-default -Wno-switch-enum -fomit-frame-pointer -O2 -g $(INCLUDES)
+ LDFLAGS += -lelf $(LIBSUBCMD)
+
+ # Allow old libelf to be used:
diff --git a/patches.suse/powerpc-64s-Rename-PPC_INVALIDATE_ERAT-to-PPC_ISA_3_.patch b/patches.suse/powerpc-64s-Rename-PPC_INVALIDATE_ERAT-to-PPC_ISA_3_.patch
new file mode 100644
index 0000000000..b374dbd88b
--- /dev/null
+++ b/patches.suse/powerpc-64s-Rename-PPC_INVALIDATE_ERAT-to-PPC_ISA_3_.patch
@@ -0,0 +1,99 @@
+From fe7946ce0808eb0e43711f5db7d2d1599b362d02 Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Sun, 23 Jun 2019 20:41:51 +1000
+Subject: [PATCH] powerpc/64s: Rename PPC_INVALIDATE_ERAT to
+ PPC_ISA_3_0_INVALIDATE_ERAT
+
+References: bsc#1055186
+Patch-mainline: v5.3-rc1
+Git-commit: fe7946ce0808eb0e43711f5db7d2d1599b362d02
+
+This makes it clear to the caller that it can only be used on POWER9
+and later CPUs.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+[mpe: Use "ISA_3_0" rather than "ARCH_300"]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/ppc-opcode.h | 2 +-
+ arch/powerpc/kernel/mce_power.c | 3 +--
+ arch/powerpc/kvm/book3s_hv_builtin.c | 2 +-
+ arch/powerpc/mm/hash_native_64.c | 2 +-
+ arch/powerpc/mm/tlb-radix.c | 8 ++++----
+ arch/powerpc/platforms/powernv/idle.c | 2 +-
+ 6 files changed, 9 insertions(+), 10 deletions(-)
+
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -546,6 +546,6 @@
+
+ #define PPC_SLBIA(IH) stringify_in_c(.long PPC_INST_SLBIA | \
+ ((IH & 0x7) << 21))
+-#define PPC_INVALIDATE_ERAT PPC_SLBIA(7)
++#define PPC_ISA_3_0_INVALIDATE_ERAT PPC_SLBIA(7)
+
+ #endif /* _ASM_POWERPC_PPC_OPCODE_H */
+--- a/arch/powerpc/kernel/mce_power.c
++++ b/arch/powerpc/kernel/mce_power.c
+@@ -65,8 +65,7 @@ static void flush_erat(void)
+ return;
+ }
+ #endif
+- /* PPC_INVALIDATE_ERAT can only be used on ISA v3 and newer */
+- asm volatile(PPC_INVALIDATE_ERAT : : :"memory");
++ asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT : : :"memory");
+ }
+
+ #define MCE_FLUSH_SLB 1
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -116,7 +116,7 @@ static void tlbiel_all_isa300(unsigned i
+
+ asm volatile("ptesync": : :"memory");
+
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
++ asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ void hash__tlbiel_all(unsigned int action)
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -85,7 +85,7 @@ void radix__tlbiel_all(unsigned int acti
+ else
+ WARN(1, "%s called on pre-POWER9 CPU\n", __func__);
+
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
++ asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static __always_inline void __tlbiel_pid(unsigned long pid, int set,
+@@ -260,7 +260,7 @@ static inline void _tlbiel_pid(unsigned
+ __tlbiel_pid(pid, set, RIC_FLUSH_TLB);
+
+ asm volatile("ptesync": : :"memory");
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
++ asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+@@ -312,7 +312,7 @@ static inline void _tlbiel_lpid(unsigned
+ __tlbiel_lpid(lpid, set, RIC_FLUSH_TLB);
+
+ asm volatile("ptesync": : :"memory");
+- asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
++ asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+ static inline void _tlbie_lpid(unsigned long lpid, unsigned long ric)
+--- a/arch/powerpc/kernel/idle_book3s.S
++++ b/arch/powerpc/kernel/idle_book3s.S
+@@ -544,7 +544,7 @@ pnv_restore_hyp_resource_arch300:
+ */
+ blt cr3,1f
+ BEGIN_FTR_SECTION
+- PPC_INVALIDATE_ERAT
++ PPC_ISA_3_0_INVALIDATE_ERAT
+ ld r1,PACAR1(r13)
+ ld r4,_MMCR0(r1)
+ mtspr SPRN_MMCR0,r4
diff --git a/patches.suse/powerpc-64s-pseries-radix-flush-translations-before-.patch b/patches.suse/powerpc-64s-pseries-radix-flush-translations-before-.patch
new file mode 100644
index 0000000000..5fc9720609
--- /dev/null
+++ b/patches.suse/powerpc-64s-pseries-radix-flush-translations-before-.patch
@@ -0,0 +1,76 @@
+From 7e71c428a60e2029585be7d7cc22775f442e5b2c Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 3 Sep 2019 01:29:29 +1000
+Subject: [PATCH] powerpc/64s/pseries: radix flush translations before MMU is
+ enabled at boot
+
+References: bsc#1055186
+Patch-mainline: v5.4-rc1
+Git-commit: 7e71c428a60e2029585be7d7cc22775f442e5b2c
+
+Radix guests are responsible for managing their own translation caches,
+so make them match bare metal radix and hash, and make each CPU flush
+all its translations right before enabling its MMU.
+
+Radix guests may not flush partition scope translations, so in
+tlbiel_all, make these flushes conditional on CPU_FTR_HVMODE. Process
+scope translations are the only type visible to the guest.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190902152931.17840-5-npiggin@gmail.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/pgtable-radix.c | 6 ++----
+ arch/powerpc/mm/tlb-radix.c | 12 ++++++++----
+ 2 files changed, 10 insertions(+), 8 deletions(-)
+
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -536,8 +536,7 @@ void __init radix__early_init_mmu(void)
+ radix_init_pgtable();
+ /* Switch to the guard PID before turning on MMU */
+ radix__switch_mmu_context(NULL, &init_mm);
+- if (cpu_has_feature(CPU_FTR_HVMODE))
+- tlbiel_all();
++ tlbiel_all();
+ }
+
+ void radix__early_init_mmu_secondary(void)
+@@ -557,8 +556,7 @@ void radix__early_init_mmu_secondary(voi
+ radix_init_iamr();
+
+ radix__switch_mmu_context(NULL, &init_mm);
+- if (cpu_has_feature(CPU_FTR_HVMODE))
+- tlbiel_all();
++ tlbiel_all();
+ }
+
+ void radix__mmu_cleanup_all(void)
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 082f90d068ee..f9cf8ae59831 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -51,11 +51,15 @@ static void tlbiel_all_isa300(unsigned int num_sets, unsigned int is)
+ * and partition table entries. Then flush the remaining sets of the
+ * TLB.
+ */
+- tlbiel_radix_set_isa300(0, is, 0, RIC_FLUSH_ALL, 0);
+- for (set = 1; set < num_sets; set++)
+- tlbiel_radix_set_isa300(set, is, 0, RIC_FLUSH_TLB, 0);
+
+- /* Do the same for process scoped entries. */
++ if (early_cpu_has_feature(CPU_FTR_HVMODE)) {
++ /* MSR[HV] should flush partition scope translations first. */
++ tlbiel_radix_set_isa300(0, is, 0, RIC_FLUSH_ALL, 0);
++ for (set = 1; set < num_sets; set++)
++ tlbiel_radix_set_isa300(set, is, 0, RIC_FLUSH_TLB, 0);
++ }
++
++ /* Flush process scoped entries. */
+ tlbiel_radix_set_isa300(0, is, 0, RIC_FLUSH_ALL, 1);
+ for (set = 1; set < num_sets; set++)
+ tlbiel_radix_set_isa300(set, is, 0, RIC_FLUSH_TLB, 1);
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-64s-radix-keep-kernel-ERAT-over-local-proces.patch b/patches.suse/powerpc-64s-radix-keep-kernel-ERAT-over-local-proces.patch
new file mode 100644
index 0000000000..e3caa36f6e
--- /dev/null
+++ b/patches.suse/powerpc-64s-radix-keep-kernel-ERAT-over-local-proces.patch
@@ -0,0 +1,61 @@
+From 6c46fcce39f0eb4830078c5f1db289dd7196f84a Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Sun, 23 Jun 2019 20:41:52 +1000
+Subject: [PATCH] powerpc/64s/radix: keep kernel ERAT over local process/guest
+ invalidates
+
+References: bsc#1055186
+Patch-mainline: v5.3-rc1
+Git-commit: 6c46fcce39f0eb4830078c5f1db289dd7196f84a
+
+ISA v3.0 radix modes provide SLBIA variants which can invalidate ERAT
+for effPID!=0 or for effLPID!=0, which allows user and guest
+invalidations to retain kernel/host ERAT entries.
+
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/ppc-opcode.h | 9 +++++++++
+ arch/powerpc/kvm/book3s_hv_builtin.c | 6 ++++--
+ arch/powerpc/mm/tlb-radix.c | 6 +++---
+ 3 files changed, 16 insertions(+), 5 deletions(-)
+
+--- a/arch/powerpc/include/asm/ppc-opcode.h
++++ b/arch/powerpc/include/asm/ppc-opcode.h
+@@ -546,6 +546,15 @@
+
+ #define PPC_SLBIA(IH) stringify_in_c(.long PPC_INST_SLBIA | \
+ ((IH & 0x7) << 21))
++
++/*
++ * These may only be used on ISA v3.0 or later (aka. CPU_FTR_ARCH_300, radix
++ * implies CPU_FTR_ARCH_300). USER/GUEST invalidates may only be used by radix
++ * mode (on HPT these would also invalidate various SLBEs which may not be
++ * desired).
++ */
+ #define PPC_ISA_3_0_INVALIDATE_ERAT PPC_SLBIA(7)
++#define PPC_RADIX_INVALIDATE_ERAT_USER PPC_SLBIA(3)
++#define PPC_RADIX_INVALIDATE_ERAT_GUEST PPC_SLBIA(6)
+
+ #endif /* _ASM_POWERPC_PPC_OPCODE_H */
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -260,7 +260,7 @@ static inline void _tlbiel_pid(unsigned
+ __tlbiel_pid(pid, set, RIC_FLUSH_TLB);
+
+ asm volatile("ptesync": : :"memory");
+- asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT "; isync" : : :"memory");
++ asm volatile(PPC_RADIX_INVALIDATE_ERAT_USER "; isync" : : :"memory");
+ }
+
+ static inline void _tlbie_pid(unsigned long pid, unsigned long ric)
+@@ -312,7 +312,7 @@ static inline void _tlbiel_lpid(unsigned
+ __tlbiel_lpid(lpid, set, RIC_FLUSH_TLB);
+
+ asm volatile("ptesync": : :"memory");
+- asm volatile(PPC_ISA_3_0_INVALIDATE_ERAT "; isync" : : :"memory");
++ asm volatile(PPC_RADIX_INVALIDATE_ERAT_GUEST "; isync" : : :"memory");
+ }
+
+ static inline void _tlbie_lpid(unsigned long lpid, unsigned long ric)
diff --git a/patches.suse/powerpc-64s-radix-tidy-up-TLB-flushing-code.patch b/patches.suse/powerpc-64s-radix-tidy-up-TLB-flushing-code.patch
new file mode 100644
index 0000000000..08c2b20482
--- /dev/null
+++ b/patches.suse/powerpc-64s-radix-tidy-up-TLB-flushing-code.patch
@@ -0,0 +1,239 @@
+From 99161de3a283af59f2813da6cbdccc1d2784c7de Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 3 Sep 2019 01:29:27 +1000
+Subject: [PATCH] powerpc/64s/radix: tidy up TLB flushing code
+
+References: bsc#1055186
+Patch-mainline: v5.4-rc1
+Git-commit: 99161de3a283af59f2813da6cbdccc1d2784c7de
+
+There should be no functional changes.
+
+- Use calls to existing radix_tlb.c functions in flush_partition.
+
+- Rename radix__flush_tlb_lpid to radix__flush_all_lpid and similar,
+ because they flush everything, matching flush_all_mm rather than
+ flush_tlb_mm for the lpid.
+
+- Remove some unused radix_tlb.c flush primitives.
+
+[Context change in pgtable.c due to missing ultravisor support]
+[Missing radix__flush_tlb_lpid due to missing nested KVM support]
+
+Signed-off: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190902152931.17840-3-npiggin@gmail.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ .../include/asm/book3s/64/tlbflush-radix.h | 12 +-
+ arch/powerpc/kvm/book3s_hv_nested.c | 2 +-
+ arch/powerpc/mm/pgtable-book3s64.c | 13 +-
+ arch/powerpc/mm/tlb-radix.c | 117 ++++--------------
+ 4 files changed, 34 insertions(+), 110 deletions(-)
+
+--- a/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
++++ b/arch/powerpc/include/asm/book3s/64/tlbflush-radix.h
+@@ -49,6 +49,7 @@ extern void radix__flush_tlb_lpid_page(u
+ unsigned long page_size);
+ extern void radix__flush_pwc_lpid(unsigned int lpid);
+ extern void radix__local_flush_tlb_lpid(unsigned int lpid);
+-extern void radix__local_flush_tlb_lpid_guest(unsigned int lpid);
++extern void radix__flush_all_lpid(unsigned int lpid);
++extern void radix__flush_all_lpid_guest(unsigned int lpid);
+
+ #endif
+--- a/arch/powerpc/mm/pgtable-book3s64.c
++++ b/arch/powerpc/mm/pgtable-book3s64.c
+@@ -187,19 +187,16 @@ void mmu_partition_table_set_entry(unsig
+ * The type of flush (hash or radix) depends on what the previous
+ * use of this partition ID was, not the new use.
+ */
+- asm volatile("ptesync" : : : "memory");
+ if (old & PATB_HR) {
+- asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
+- "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+- asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+- "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+- trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
++ radix__flush_all_lpid(lpid);
++ radix__flush_all_lpid_guest(lpid);
+ } else {
++ asm volatile("ptesync" : : : "memory");
+ asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
+ "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
++ /* do we need fixup here ?*/
++ asm volatile("eieio; tlbsync; ptesync" : : : "memory");
+ trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 0);
+ }
+- /* do we need fixup here ?*/
+- asm volatile("eieio; tlbsync; ptesync" : : : "memory");
+ }
+ EXPORT_SYMBOL_GPL(mmu_partition_table_set_entry);
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -118,22 +118,6 @@ static __always_inline void __tlbie_pid(
+ trace_tlbie(0, 0, rb, rs, ric, prs, r);
+ }
+
+-static __always_inline void __tlbiel_lpid(unsigned long lpid, int set,
+- unsigned long ric)
+-{
+- unsigned long rb,rs,prs,r;
+-
+- rb = PPC_BIT(52); /* IS = 2 */
+- rb |= set << PPC_BITLSHIFT(51);
+- rs = 0; /* LPID comes from LPIDR */
+- prs = 0; /* partition scoped */
+- r = 1; /* radix format */
+-
+- asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+- : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+- trace_tlbie(lpid, 1, rb, rs, ric, prs, r);
+-}
+-
+ static __always_inline void __tlbie_lpid(unsigned long lpid, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+@@ -148,23 +132,20 @@ static __always_inline void __tlbie_lpid
+ trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
+ }
+
+-static __always_inline void __tlbiel_lpid_guest(unsigned long lpid, int set,
+- unsigned long ric)
++static __always_inline void __tlbie_lpid_guest(unsigned long lpid, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+ rb = PPC_BIT(52); /* IS = 2 */
+- rb |= set << PPC_BITLSHIFT(51);
+- rs = 0; /* LPID comes from LPIDR */
++ rs = lpid;
+ prs = 1; /* process scoped */
+ r = 1; /* radix format */
+
+- asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
++ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ : : "r"(rb), "i"(r), "i"(prs), "i"(ric), "r"(rs) : "memory");
+- trace_tlbie(lpid, 1, rb, rs, ric, prs, r);
++ trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
+ }
+
+-
+ static __always_inline void __tlbiel_va(unsigned long va, unsigned long pid,
+ unsigned long ap, unsigned long ric)
+ {
+@@ -287,34 +268,6 @@ static inline void _tlbie_pid(unsigned l
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+-static inline void _tlbiel_lpid(unsigned long lpid, unsigned long ric)
+-{
+- int set;
+-
+- VM_BUG_ON(mfspr(SPRN_LPID) != lpid);
+-
+- asm volatile("ptesync": : :"memory");
+-
+- /*
+- * Flush the first set of the TLB, and if we're doing a RIC_FLUSH_ALL,
+- * also flush the entire Page Walk Cache.
+- */
+- __tlbiel_lpid(lpid, 0, ric);
+-
+- /* For PWC, only one flush is needed */
+- if (ric == RIC_FLUSH_PWC) {
+- asm volatile("ptesync": : :"memory");
+- return;
+- }
+-
+- /* For the remaining sets, just flush the TLB */
+- for (set = 1; set < POWER9_TLB_SETS_RADIX ; set++)
+- __tlbiel_lpid(lpid, set, RIC_FLUSH_TLB);
+-
+- asm volatile("ptesync": : :"memory");
+- asm volatile(PPC_RADIX_INVALIDATE_ERAT_GUEST "; isync" : : :"memory");
+-}
+-
+ static inline void _tlbie_lpid(unsigned long lpid, unsigned long ric)
+ {
+ asm volatile("ptesync": : :"memory");
+@@ -339,34 +292,28 @@ static inline void _tlbie_lpid(unsigned
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+-static __always_inline void _tlbiel_lpid_guest(unsigned long lpid, unsigned long ric)
++static __always_inline void _tlbie_lpid_guest(unsigned long lpid, unsigned long ric)
+ {
+- int set;
+-
+- VM_BUG_ON(mfspr(SPRN_LPID) != lpid);
+-
+- asm volatile("ptesync": : :"memory");
+-
+ /*
+- * Flush the first set of the TLB, and if we're doing a RIC_FLUSH_ALL,
+- * also flush the entire Page Walk Cache.
++ * Workaround the fact that the "ric" argument to __tlbie_pid
++ * must be a compile-time contraint to match the "i" constraint
++ * in the asm statement.
+ */
+- __tlbiel_lpid_guest(lpid, 0, ric);
+-
+- /* For PWC, only one flush is needed */
+- if (ric == RIC_FLUSH_PWC) {
+- asm volatile("ptesync": : :"memory");
+- return;
++ switch (ric) {
++ case RIC_FLUSH_TLB:
++ __tlbie_lpid_guest(lpid, RIC_FLUSH_TLB);
++ break;
++ case RIC_FLUSH_PWC:
++ __tlbie_lpid_guest(lpid, RIC_FLUSH_PWC);
++ break;
++ case RIC_FLUSH_ALL:
++ default:
++ __tlbie_lpid_guest(lpid, RIC_FLUSH_ALL);
+ }
+-
+- /* For the remaining sets, just flush the TLB */
+- for (set = 1; set < POWER9_TLB_SETS_RADIX ; set++)
+- __tlbiel_lpid_guest(lpid, set, RIC_FLUSH_TLB);
+-
+- asm volatile("ptesync": : :"memory");
++ fixup_tlbie_lpid(lpid);
++ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+-
+ static inline void __tlbiel_va_range(unsigned long start, unsigned long end,
+ unsigned long pid, unsigned long page_size,
+ unsigned long psize)
+@@ -745,23 +692,18 @@ EXPORT_SYMBOL_GPL(radix__flush_pwc_lpid)
+ /*
+ * Flush partition scoped translations from LPID (=LPIDR)
+ */
+-void radix__local_flush_tlb_lpid(unsigned int lpid)
++void radix__flush_all_lpid(unsigned int lpid)
+ {
+- _tlbiel_lpid(lpid, RIC_FLUSH_ALL);
++ _tlbie_lpid(lpid, RIC_FLUSH_ALL);
+ }
+-EXPORT_SYMBOL_GPL(radix__local_flush_tlb_lpid);
+
+ /*
+- * Flush process scoped translations from LPID (=LPIDR).
+- * Important difference, the guest normally manages its own translations,
+- * but some cases e.g., vCPU CPU migration require KVM to flush.
++ * Flush process scoped translations from LPID (=LPIDR)
+ */
+-void radix__local_flush_tlb_lpid_guest(unsigned int lpid)
++void radix__flush_all_lpid_guest(unsigned int lpid)
+ {
+- _tlbiel_lpid_guest(lpid, RIC_FLUSH_ALL);
++ _tlbie_lpid_guest(lpid, RIC_FLUSH_ALL);
+ }
+-EXPORT_SYMBOL_GPL(radix__local_flush_tlb_lpid_guest);
+-
+
+ static void radix__flush_tlb_pwc_range_psize(struct mm_struct *mm, unsigned long start,
+ unsigned long end, int psize);
diff --git a/patches.suse/powerpc-mm-Fixup-tlbie-vs-mtpidr-mtlpidr-ordering-is.patch b/patches.suse/powerpc-mm-Fixup-tlbie-vs-mtpidr-mtlpidr-ordering-is.patch
index 4611fb8f73..2c9f8bbff2 100644
--- a/patches.suse/powerpc-mm-Fixup-tlbie-vs-mtpidr-mtlpidr-ordering-is.patch
+++ b/patches.suse/powerpc-mm-Fixup-tlbie-vs-mtpidr-mtlpidr-ordering-is.patch
@@ -180,7 +180,7 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
if (lock_tlbie)
--- a/arch/powerpc/mm/tlb-radix.c
+++ b/arch/powerpc/mm/tlb-radix.c
-@@ -213,21 +213,82 @@ static inline void __tlbie_lpid_va(unsig
+@@ -213,21 +213,82 @@ static __always_inline void __tlbie_lpid
trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
}
@@ -309,8 +309,8 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
+ fixup_tlbie_va_range(addr - page_size, pid, ap);
}
- static inline void _tlbie_va(unsigned long va, unsigned long pid,
-@@ -417,7 +482,7 @@ static inline void _tlbie_va(unsigned lo
+ static __always_inline void _tlbie_va(unsigned long va, unsigned long pid,
+@@ -417,7 +482,7 @@ static __always_inline void _tlbie_va(un
asm volatile("ptesync": : :"memory");
__tlbie_va(va, pid, ap, ric);
@@ -319,7 +319,7 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
asm volatile("eieio; tlbsync; ptesync": : :"memory");
}
-@@ -428,7 +493,7 @@ static inline void _tlbie_lpid_va(unsign
+@@ -428,7 +493,7 @@ static __always_inline void _tlbie_lpid_
asm volatile("ptesync": : :"memory");
__tlbie_lpid_va(va, lpid, ap, ric);
@@ -336,7 +336,7 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
asm volatile("eieio; tlbsync; ptesync": : :"memory");
}
-@@ -677,7 +741,7 @@ static inline void __radix__flush_tlb_ra
+@@ -685,7 +749,7 @@ static inline void __radix__flush_tlb_ra
if (gflush)
__tlbie_va_range(gstart, gend, pid,
PUD_SIZE, MMU_PAGE_1G);
diff --git a/patches.suse/powerpc-mm-Properly-invalidate-when-setting-process-.patch b/patches.suse/powerpc-mm-Properly-invalidate-when-setting-process-.patch
new file mode 100644
index 0000000000..eca4aceb4c
--- /dev/null
+++ b/patches.suse/powerpc-mm-Properly-invalidate-when-setting-process-.patch
@@ -0,0 +1,55 @@
+From 7cd2a8695ef9c31e8f51773f0de9e6007d6dc083 Mon Sep 17 00:00:00 2001
+From: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Date: Thu, 3 Aug 2017 14:15:51 +1000
+Subject: [PATCH] powerpc/mm: Properly invalidate when setting process table
+ base
+
+References: bsc#1055186
+Patch-mainline: v4.14-rc1
+Git-commit: 7cd2a8695ef9c31e8f51773f0de9e6007d6dc083
+
+The host process table base is stored in the partition table by calling
+the function native_register_process_table(). Currently this just sets
+the entry in memory and is missing a subsequent cache invalidation
+instruction. Any update to the partition table should be followed by a
+cache invalidation instruction specifying invalidation of the caching of
+any partition table entries (RIC = 2, PRS = 0).
+
+We already have a function to update the partition table with the
+required cache invalidation instructions - mmu_partition_table_set_entry().
+Update the native_register_process_table() function to call
+mmu_partition_table_set_entry(), this ensures all appropriate
+invalidation will be performed.
+
+Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+[mpe: Use a local for patb0 to clean it up slightly]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/pgtable-radix.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
+index c1185c8ecb22..5d8be076f8e5 100644
+--- a/arch/powerpc/mm/pgtable-radix.c
++++ b/arch/powerpc/mm/pgtable-radix.c
+@@ -28,9 +28,13 @@
+ static int native_register_process_table(unsigned long base, unsigned long pg_sz,
+ unsigned long table_size)
+ {
+- unsigned long patb1 = base | table_size | PATB_GR;
++ unsigned long patb0, patb1;
++
++ patb0 = be64_to_cpu(partition_tb[0].patb0);
++ patb1 = base | table_size | PATB_GR;
++
++ mmu_partition_table_set_entry(0, patb0, patb1);
+
+- partition_tb->patb1 = cpu_to_be64(patb1);
+ return 0;
+ }
+
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-mm-book3s64-Move-book3s64-code-to-pgtable-bo.patch b/patches.suse/powerpc-mm-book3s64-Move-book3s64-code-to-pgtable-bo.patch
new file mode 100644
index 0000000000..a3584dfae3
--- /dev/null
+++ b/patches.suse/powerpc-mm-book3s64-Move-book3s64-code-to-pgtable-bo.patch
@@ -0,0 +1,173 @@
+From 59879d542a8e880391863d82cddf38854e3807f4 Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Mon, 16 Apr 2018 16:57:14 +0530
+Subject: [PATCH] powerpc/mm/book3s64: Move book3s64 code to pgtable-book3s64
+
+References: bsc#1055186
+Patch-mainline: v4.18-rc1
+Git-commit: 59879d542a8e880391863d82cddf38854e3807f4
+
+Only code movement and avoid #ifdef.
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/pgtable-book3s64.c | 54 ++++++++++++++++++++++++++++
+ arch/powerpc/mm/pgtable_64.c | 56 ------------------------------
+ 2 files changed, 54 insertions(+), 56 deletions(-)
+
+--- a/arch/powerpc/mm/pgtable-book3s64.c
++++ b/arch/powerpc/mm/pgtable-book3s64.c
+@@ -9,9 +9,12 @@
+
+ #include <linux/sched.h>
+ #include <linux/mm_types.h>
++#include <linux/memblock.h>
+
+ #include <asm/pgalloc.h>
+ #include <asm/tlb.h>
++#include <asm/trace.h>
++#include <asm/powernv.h>
+
+ #include "mmu_decl.h"
+ #include <trace/events/thp.h>
+@@ -146,3 +149,54 @@ int remove_section_mapping(unsigned long
+ return hash__remove_section_mapping(start, end);
+ }
+ #endif /* CONFIG_MEMORY_HOTPLUG */
++
++void __init mmu_partition_table_init(void)
++{
++ unsigned long patb_size = 1UL << PATB_SIZE_SHIFT;
++ unsigned long ptcr;
++
++ BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 36), "Partition table size too large.");
++ partition_tb = __va(memblock_alloc_base(patb_size, patb_size,
++ MEMBLOCK_ALLOC_ANYWHERE));
++
++ /* Initialize the Partition Table with no entries */
++ memset((void *)partition_tb, 0, patb_size);
++
++ /*
++ * update partition table control register,
++ * 64 K size.
++ */
++ ptcr = __pa(partition_tb) | (PATB_SIZE_SHIFT - 12);
++ mtspr(SPRN_PTCR, ptcr);
++ powernv_set_nmmu_ptcr(ptcr);
++}
++
++void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
++ unsigned long dw1)
++{
++ unsigned long old = be64_to_cpu(partition_tb[lpid].patb0);
++
++ partition_tb[lpid].patb0 = cpu_to_be64(dw0);
++ partition_tb[lpid].patb1 = cpu_to_be64(dw1);
++
++ /*
++ * Global flush of TLBs and partition table caches for this lpid.
++ * The type of flush (hash or radix) depends on what the previous
++ * use of this partition ID was, not the new use.
++ */
++ asm volatile("ptesync" : : : "memory");
++ if (old & PATB_HR) {
++ asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
++ "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
++ asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
++ "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
++ trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
++ } else {
++ asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
++ "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
++ trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 0);
++ }
++ /* do we need fixup here ?*/
++ asm volatile("eieio; tlbsync; ptesync" : : : "memory");
++}
++EXPORT_SYMBOL_GPL(mmu_partition_table_set_entry);
+--- a/arch/powerpc/mm/pgtable_64.c
++++ b/arch/powerpc/mm/pgtable_64.c
+@@ -33,7 +33,6 @@
+ #include <linux/swap.h>
+ #include <linux/stddef.h>
+ #include <linux/vmalloc.h>
+-#include <linux/memblock.h>
+ #include <linux/slab.h>
+ #include <linux/hugetlb.h>
+
+@@ -47,13 +46,11 @@
+ #include <asm/smp.h>
+ #include <asm/machdep.h>
+ #include <asm/tlb.h>
+-#include <asm/trace.h>
+ #include <asm/processor.h>
+ #include <asm/cputable.h>
+ #include <asm/sections.h>
+ #include <asm/firmware.h>
+ #include <asm/dma.h>
+-#include <asm/powernv.h>
+
+ #include "mmu_decl.h"
+
+@@ -438,59 +435,6 @@ void pgtable_free_tlb(struct mmu_gather
+ }
+ #endif
+
+-#ifdef CONFIG_PPC_BOOK3S_64
+-void __init mmu_partition_table_init(void)
+-{
+- unsigned long patb_size = 1UL << PATB_SIZE_SHIFT;
+- unsigned long ptcr;
+-
+- BUILD_BUG_ON_MSG((PATB_SIZE_SHIFT > 36), "Partition table size too large.");
+- partition_tb = __va(memblock_alloc_base(patb_size, patb_size,
+- MEMBLOCK_ALLOC_ANYWHERE));
+-
+- /* Initialize the Partition Table with no entries */
+- memset((void *)partition_tb, 0, patb_size);
+-
+- /*
+- * update partition table control register,
+- * 64 K size.
+- */
+- ptcr = __pa(partition_tb) | (PATB_SIZE_SHIFT - 12);
+- mtspr(SPRN_PTCR, ptcr);
+- powernv_set_nmmu_ptcr(ptcr);
+-}
+-
+-void mmu_partition_table_set_entry(unsigned int lpid, unsigned long dw0,
+- unsigned long dw1)
+-{
+- unsigned long old = be64_to_cpu(partition_tb[lpid].patb0);
+-
+- partition_tb[lpid].patb0 = cpu_to_be64(dw0);
+- partition_tb[lpid].patb1 = cpu_to_be64(dw1);
+-
+- /*
+- * Global flush of TLBs and partition table caches for this lpid.
+- * The type of flush (hash or radix) depends on what the previous
+- * use of this partition ID was, not the new use.
+- */
+- asm volatile("ptesync" : : : "memory");
+- if (old & PATB_HR) {
+- asm volatile(PPC_TLBIE_5(%0,%1,2,0,1) : :
+- "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+- asm volatile(PPC_TLBIE_5(%0,%1,2,1,1) : :
+- "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+- trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 1);
+- } else {
+- asm volatile(PPC_TLBIE_5(%0,%1,2,0,0) : :
+- "r" (TLBIEL_INVAL_SET_LPID), "r" (lpid));
+- trace_tlbie(lpid, 0, TLBIEL_INVAL_SET_LPID, lpid, 2, 0, 0);
+- }
+- /* do we need fixup here ?*/
+- asm volatile("eieio; tlbsync; ptesync" : : : "memory");
+-}
+-EXPORT_SYMBOL_GPL(mmu_partition_table_set_entry);
+-#endif /* CONFIG_PPC_BOOK3S_64 */
+-
+ #ifdef CONFIG_STRICT_KERNEL_RWX
+ void mark_rodata_ro(void)
+ {
diff --git a/patches.suse/powerpc-mm-mark-more-tlb-functions-as-__always_inlin.patch b/patches.suse/powerpc-mm-mark-more-tlb-functions-as-__always_inlin.patch
new file mode 100644
index 0000000000..2b14b5b571
--- /dev/null
+++ b/patches.suse/powerpc-mm-mark-more-tlb-functions-as-__always_inlin.patch
@@ -0,0 +1,157 @@
+From 6d3ca7e73642ce17398f4cd5df1780da4a1ccdaf Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 21 May 2019 22:13:24 +0900
+Subject: [PATCH] powerpc/mm: mark more tlb functions as __always_inline
+
+References: bsc#1055186
+Patch-mainline: v5.3-rc1
+Git-commit: 6d3ca7e73642ce17398f4cd5df1780da4a1ccdaf
+
+With CONFIG_OPTIMIZE_INLINING enabled, Laura Abbott reported error
+with gcc 9.1.1:
+
+ arch/powerpc/mm/tlb-radix.c: In function '_tlbiel_pid':
+ arch/powerpc/mm/tlb-radix.c:104:2: warning: asm operand 3 probably doesn't match constraints
+ 104 | asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+ | ^~~
+ arch/powerpc/mm/tlb-radix.c:104:2: error: impossible constraint in 'asm'
+
+Fixing _tlbiel_pid() is enough to address the warning above, but I
+inlined more functions to fix all potential issues.
+
+To meet the "i" (immediate) constraint for the asm operands, functions
+propagating "ric" must be always inlined.
+
+Fixes: 9012d011660e ("compiler: allow all arches to enable CONFIG_OPTIMIZE_INLINING")
+Reported-by: Laura Abbott <labbott@redhat.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Reviewed-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/hash_native_64.c | 2 +-
+ arch/powerpc/mm/tlb-radix.c | 32 +++++++++++++-------------
+ 2 files changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c
+index 0b447d96b911..79e5c814675f 100644
+--- a/arch/powerpc/mm/hash_native_64.c
++++ b/arch/powerpc/mm/hash_native_64.c
+@@ -60,7 +60,7 @@ static inline void tlbiel_hash_set_isa206(unsigned int set, unsigned int is)
+ * tlbiel instruction for hash, set invalidation
+ * i.e., r=1 and is=01 or is=10 or is=11
+ */
+-static inline void tlbiel_hash_set_isa300(unsigned int set, unsigned int is,
++static __always_inline void tlbiel_hash_set_isa300(unsigned int set, unsigned int is,
+ unsigned int pid,
+ unsigned int ric, unsigned int prs)
+ {
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index edf39e9a4ec4..8901f5c8ef8c 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -29,7 +29,7 @@
+ * tlbiel instruction for radix, set invalidation
+ * i.e., r=1 and is=01 or is=10 or is=11
+ */
+-static inline void tlbiel_radix_set_isa300(unsigned int set, unsigned int is,
++static __always_inline void tlbiel_radix_set_isa300(unsigned int set, unsigned int is,
+ unsigned int pid,
+ unsigned int ric, unsigned int prs)
+ {
+@@ -150,8 +150,8 @@ static __always_inline void __tlbie_lpid(unsigned long lpid, unsigned long ric)
+ trace_tlbie(lpid, 0, rb, rs, ric, prs, r);
+ }
+
+-static inline void __tlbiel_lpid_guest(unsigned long lpid, int set,
+- unsigned long ric)
++static __always_inline void __tlbiel_lpid_guest(unsigned long lpid, int set,
++ unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+@@ -167,8 +167,8 @@ static inline void __tlbiel_lpid_guest(unsigned long lpid, int set,
+ }
+
+
+-static inline void __tlbiel_va(unsigned long va, unsigned long pid,
+- unsigned long ap, unsigned long ric)
++static __always_inline void __tlbiel_va(unsigned long va, unsigned long pid,
++ unsigned long ap, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+@@ -183,8 +183,8 @@ static inline void __tlbiel_va(unsigned long va, unsigned long pid,
+ trace_tlbie(0, 1, rb, rs, ric, prs, r);
+ }
+
+-static inline void __tlbie_va(unsigned long va, unsigned long pid,
+- unsigned long ap, unsigned long ric)
++static __always_inline void __tlbie_va(unsigned long va, unsigned long pid,
++ unsigned long ap, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+@@ -199,8 +199,8 @@ static inline void __tlbie_va(unsigned long va, unsigned long pid,
+ trace_tlbie(0, 0, rb, rs, ric, prs, r);
+ }
+
+-static inline void __tlbie_lpid_va(unsigned long va, unsigned long lpid,
+- unsigned long ap, unsigned long ric)
++static __always_inline void __tlbie_lpid_va(unsigned long va, unsigned long lpid,
++ unsigned long ap, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+@@ -239,7 +239,7 @@ static inline void fixup_tlbie_lpid(unsigned long lpid)
+ /*
+ * We use 128 set in radix mode and 256 set in hpt mode.
+ */
+-static inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
++static __always_inline void _tlbiel_pid(unsigned long pid, unsigned long ric)
+ {
+ int set;
+
+@@ -341,7 +341,7 @@ static inline void _tlbie_lpid(unsigned long lpid, unsigned long ric)
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+-static inline void _tlbiel_lpid_guest(unsigned long lpid, unsigned long ric)
++static __always_inline void _tlbiel_lpid_guest(unsigned long lpid, unsigned long ric)
+ {
+ int set;
+
+@@ -381,8 +381,8 @@ static inline void __tlbiel_va_range(unsigned long start, unsigned long end,
+ __tlbiel_va(addr, pid, ap, RIC_FLUSH_TLB);
+ }
+
+-static inline void _tlbiel_va(unsigned long va, unsigned long pid,
+- unsigned long psize, unsigned long ric)
++static __always_inline void _tlbiel_va(unsigned long va, unsigned long pid,
++ unsigned long psize, unsigned long ric)
+ {
+ unsigned long ap = mmu_get_ap(psize);
+
+@@ -413,8 +413,8 @@ static inline void __tlbie_va_range(unsigned long start, unsigned long end,
+ __tlbie_va(addr, pid, ap, RIC_FLUSH_TLB);
+ }
+
+-static inline void _tlbie_va(unsigned long va, unsigned long pid,
+- unsigned long psize, unsigned long ric)
++static __always_inline void _tlbie_va(unsigned long va, unsigned long pid,
++ unsigned long psize, unsigned long ric)
+ {
+ unsigned long ap = mmu_get_ap(psize);
+
+@@ -424,7 +424,7 @@ static inline void _tlbie_va(unsigned long va, unsigned long pid,
+ asm volatile("eieio; tlbsync; ptesync": : :"memory");
+ }
+
+-static inline void _tlbie_lpid_va(unsigned long va, unsigned long lpid,
++static __always_inline void _tlbie_lpid_va(unsigned long va, unsigned long lpid,
+ unsigned long psize, unsigned long ric)
+ {
+ unsigned long ap = mmu_get_ap(psize);
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-mm-radix-mark-__radix__flush_tlb_range_psize.patch b/patches.suse/powerpc-mm-radix-mark-__radix__flush_tlb_range_psize.patch
new file mode 100644
index 0000000000..31396e9c01
--- /dev/null
+++ b/patches.suse/powerpc-mm-radix-mark-__radix__flush_tlb_range_psize.patch
@@ -0,0 +1,66 @@
+From e12d6d7d46a62ccf62f4c60eb6ea6f0f121797c7 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 14 May 2019 15:42:17 -0700
+Subject: [PATCH] powerpc/mm/radix: mark __radix__flush_tlb_range_psize() as
+ __always_inline
+
+References: bsc#1055186
+Patch-mainline: v5.2-rc1
+Git-commit: e12d6d7d46a62ccf62f4c60eb6ea6f0f121797c7
+
+This prepares to move CONFIG_OPTIMIZE_INLINING from x86 to a common
+place. We need to eliminate potential issues beforehand.
+
+If it is enabled for powerpc, the following error is reported:
+
+ arch/powerpc/mm/tlb-radix.c: In function '__radix__flush_tlb_range_psize':
+ arch/powerpc/mm/tlb-radix.c:104:2: error: asm operand 3 probably doesn't match constraints [-Werror]
+ asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+ ^~~
+ arch/powerpc/mm/tlb-radix.c:104:2: error: impossible constraint in 'asm'
+
+Link: http://lkml.kernel.org/r/20190423034959.13525-10-yamada.masahiro@socionext.com
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Boris Brezillon <bbrezillon@kernel.org>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Brian Norris <computersforpeace@gmail.com>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Marek Vasut <marek.vasut@gmail.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Malaterre <malat@debian.org>
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Stefan Agner <stefan@agner.ch>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/tlb-radix.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index 6a23b9ebd2a1..a2b2848f0ae3 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -928,7 +928,7 @@ void radix__tlb_flush(struct mmu_gather *tlb)
+ tlb->need_flush_all = 0;
+ }
+
+-static inline void __radix__flush_tlb_range_psize(struct mm_struct *mm,
++static __always_inline void __radix__flush_tlb_range_psize(struct mm_struct *mm,
+ unsigned long start, unsigned long end,
+ int psize, bool also_pwc)
+ {
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-mm-radix-mark-as-__tlbie_pid-and-friends-as_.patch b/patches.suse/powerpc-mm-radix-mark-as-__tlbie_pid-and-friends-as_.patch
new file mode 100644
index 0000000000..7b9e1beb1d
--- /dev/null
+++ b/patches.suse/powerpc-mm-radix-mark-as-__tlbie_pid-and-friends-as_.patch
@@ -0,0 +1,101 @@
+From efc344c57e39754416731e24e1eadd7d9b9f335e Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 14 May 2019 15:42:21 -0700
+Subject: [PATCH] powerpc/mm/radix: mark as __tlbie_pid() and friends
+ as__always_inline
+
+References: bsc#1055186
+Patch-mainline: v5.2-rc1
+Git-commit: efc344c57e39754416731e24e1eadd7d9b9f335e
+
+This prepares to move CONFIG_OPTIMIZE_INLINING from x86 to a common
+place. We need to eliminate potential issues beforehand.
+
+If it is enabled for powerpc, the following errors are reported:
+
+ arch/powerpc/mm/tlb-radix.c: In function '__tlbie_lpid':
+ arch/powerpc/mm/tlb-radix.c:148:2: warning: asm operand 3 probably doesn't match constraints
+ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ ^~~
+ arch/powerpc/mm/tlb-radix.c:148:2: error: impossible constraint in 'asm'
+ arch/powerpc/mm/tlb-radix.c: In function '__tlbie_pid':
+ arch/powerpc/mm/tlb-radix.c:118:2: warning: asm operand 3 probably doesn't match constraints
+ asm volatile(PPC_TLBIE_5(%0, %4, %3, %2, %1)
+ ^~~
+ arch/powerpc/mm/tlb-radix.c: In function '__tlbiel_pid':
+ arch/powerpc/mm/tlb-radix.c:104:2: warning: asm operand 3 probably doesn't match constraints
+ asm volatile(PPC_TLBIEL(%0, %4, %3, %2, %1)
+ ^~~
+
+Link: http://lkml.kernel.org/r/20190423034959.13525-11-yamada.masahiro@socionext.com
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Arnd Bergmann <arnd@arndb.de>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Boris Brezillon <bbrezillon@kernel.org>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: Brian Norris <computersforpeace@gmail.com>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+Cc: David Woodhouse <dwmw2@infradead.org>
+Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Marek Vasut <marek.vasut@gmail.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Mathieu Malaterre <malat@debian.org>
+Cc: Miquel Raynal <miquel.raynal@bootlin.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Russell King <rmk+kernel@arm.linux.org.uk>
+Cc: Stefan Agner <stefan@agner.ch>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/tlb-radix.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/mm/tlb-radix.c b/arch/powerpc/mm/tlb-radix.c
+index a2b2848f0ae3..4d841369399f 100644
+--- a/arch/powerpc/mm/tlb-radix.c
++++ b/arch/powerpc/mm/tlb-radix.c
+@@ -90,7 +90,7 @@ void radix__tlbiel_all(unsigned int action)
+ asm volatile(PPC_INVALIDATE_ERAT "; isync" : : :"memory");
+ }
+
+-static inline void __tlbiel_pid(unsigned long pid, int set,
++static __always_inline void __tlbiel_pid(unsigned long pid, int set,
+ unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+@@ -106,7 +106,7 @@ static inline void __tlbiel_pid(unsigned long pid, int set,
+ trace_tlbie(0, 1, rb, rs, ric, prs, r);
+ }
+
+-static inline void __tlbie_pid(unsigned long pid, unsigned long ric)
++static __always_inline void __tlbie_pid(unsigned long pid, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+@@ -120,7 +120,7 @@ static inline void __tlbie_pid(unsigned long pid, unsigned long ric)
+ trace_tlbie(0, 0, rb, rs, ric, prs, r);
+ }
+
+-static inline void __tlbiel_lpid(unsigned long lpid, int set,
++static __always_inline void __tlbiel_lpid(unsigned long lpid, int set,
+ unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+@@ -136,7 +136,7 @@ static inline void __tlbiel_lpid(unsigned long lpid, int set,
+ trace_tlbie(lpid, 1, rb, rs, ric, prs, r);
+ }
+
+-static inline void __tlbie_lpid(unsigned long lpid, unsigned long ric)
++static __always_inline void __tlbie_lpid(unsigned long lpid, unsigned long ric)
+ {
+ unsigned long rb,rs,prs,r;
+
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-pseries-Remove-confusing-warning-message.patch b/patches.suse/powerpc-pseries-Remove-confusing-warning-message.patch
new file mode 100644
index 0000000000..e552089bed
--- /dev/null
+++ b/patches.suse/powerpc-pseries-Remove-confusing-warning-message.patch
@@ -0,0 +1,50 @@
+From 4ab8a485f7bc69e04e3e8d75f62bdcac5f4ed02e Mon Sep 17 00:00:00 2001
+From: Laurent Dufour <ldufour@linux.ibm.com>
+Date: Tue, 1 Oct 2019 15:29:28 +0200
+Subject: [PATCH] powerpc/pseries: Remove confusing warning message.
+
+References: bsc#1109158
+Patch-mainline: v5.4-rc3
+Git-commit: 4ab8a485f7bc69e04e3e8d75f62bdcac5f4ed02e
+
+Since commit 1211ee61b4a8 ("powerpc/pseries: Read TLB Block Invalidate
+Characteristics"), a warning message is displayed when booting a guest
+on top of KVM:
+
+ lpar: arch/powerpc/platforms/pseries/lpar.c pseries_lpar_read_hblkrm_characteristics Error calling get-system-parameter (0xfffffffd)
+
+This message is displayed because this hypervisor is not supporting
+the H_BLOCK_REMOVE hcall and thus is not exposing the corresponding
+feature.
+
+Reading the TLB Block Invalidate Characteristics should not be done if
+the feature is not exposed.
+
+Fixes: 1211ee61b4a8 ("powerpc/pseries: Read TLB Block Invalidate Characteristics")
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20191001132928.72555-1-ldufour@linux.ibm.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/pseries/lpar.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index b53359258d99..f87a5c64e24d 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -1419,6 +1419,9 @@ void __init pseries_lpar_read_hblkrm_characteristics(void)
+ unsigned char local_buffer[SPLPAR_TLB_BIC_MAXLENGTH];
+ int call_status, len, idx, bpsize;
+
++ if (!firmware_has_feature(FW_FEATURE_BLOCK_REMOVE))
++ return;
++
+ spin_lock(&rtas_data_buf_lock);
+ memset(rtas_data_buf, 0, RTAS_DATA_BUF_SIZE);
+ call_status = rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-pseries-mobility-use-cond_resched-when-updat.patch b/patches.suse/powerpc-pseries-mobility-use-cond_resched-when-updat.patch
new file mode 100644
index 0000000000..6b9caf015a
--- /dev/null
+++ b/patches.suse/powerpc-pseries-mobility-use-cond_resched-when-updat.patch
@@ -0,0 +1,70 @@
+From ccfb5bd71d3d1228090a8633800ae7cdf42a94ac Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathanl@linux.ibm.com>
+Date: Fri, 2 Aug 2019 14:29:26 -0500
+Subject: [PATCH] powerpc/pseries/mobility: use cond_resched when updating
+ device tree
+
+References: bsc#1153112 ltc#181778
+Patch-mainline: v5.4-rc1
+Git-commit: ccfb5bd71d3d1228090a8633800ae7cdf42a94ac
+
+After a partition migration, pseries_devicetree_update() processes
+changes to the device tree communicated from the platform to
+Linux. This is a relatively heavyweight operation, with multiple
+device tree searches, memory allocations, and conversations with
+partition firmware.
+
+There's a few levels of nested loops which are bounded only by
+decisions made by the platform, outside of Linux's control, and indeed
+we have seen RCU stalls on large systems while executing this call
+graph. Use cond_resched() in these loops so that the cpu is yielded
+when needed.
+
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190802192926.19277-4-nathanl@linux.ibm.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/pseries/mobility.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index fe812bebdf5e..b571285f6c14 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -9,6 +9,7 @@
+ #include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/kobject.h>
++#include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/stat.h>
+ #include <linux/completion.h>
+@@ -207,7 +208,11 @@ static int update_dt_node(__be32 phandle, s32 scope)
+
+ prop_data += vd;
+ }
++
++ cond_resched();
+ }
++
++ cond_resched();
+ } while (rtas_rc == 1);
+
+ of_node_put(dn);
+@@ -310,8 +315,12 @@ int pseries_devicetree_update(s32 scope)
+ add_dt_node(phandle, drc_index);
+ break;
+ }
++
++ cond_resched();
+ }
+ }
++
++ cond_resched();
+ } while (rc == 1);
+
+ kfree(rtas_buf);
+--
+2.23.0
+
diff --git a/patches.suse/powerpc-rtas-allow-rescheduling-while-changing-cpu-s.patch b/patches.suse/powerpc-rtas-allow-rescheduling-while-changing-cpu-s.patch
new file mode 100644
index 0000000000..36647425fd
--- /dev/null
+++ b/patches.suse/powerpc-rtas-allow-rescheduling-while-changing-cpu-s.patch
@@ -0,0 +1,44 @@
+From 10e4850d7c7f2af2e5c40520b8caf73bf9d7e2d1 Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathanl@linux.ibm.com>
+Date: Fri, 2 Aug 2019 14:29:25 -0500
+Subject: [PATCH] powerpc/rtas: allow rescheduling while changing cpu states
+
+References: bsc#1153112 ltc#181778
+Patch-mainline: v5.4-rc1
+Git-commit: 10e4850d7c7f2af2e5c40520b8caf73bf9d7e2d1
+
+rtas_cpu_state_change_mask() potentially operates on scores of cpus,
+so explicitly allow rescheduling in the loop body.
+
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Reviewed-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190802192926.19277-3-nathanl@linux.ibm.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/kernel/rtas.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index ef290d4036ba..c5fa251b8950 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -16,6 +16,7 @@
+ #include <linux/capability.h>
+ #include <linux/delay.h>
+ #include <linux/cpu.h>
++#include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/completion.h>
+ #include <linux/cpumask.h>
+@@ -898,6 +899,7 @@ static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
+ cpumask_clear_cpu(cpu, cpus);
+ }
+ }
++ cond_resched();
+ }
+
+ return ret;
+--
+2.23.0
+
diff --git a/patches.suse/qed-iWARP-Fix-default-window-size-to-be-based-on-chi.patch b/patches.suse/qed-iWARP-Fix-default-window-size-to-be-based-on-chi.patch
new file mode 100644
index 0000000000..2958c21cf9
--- /dev/null
+++ b/patches.suse/qed-iWARP-Fix-default-window-size-to-be-based-on-chi.patch
@@ -0,0 +1,96 @@
+From: Michal Kalderon <michal.kalderon@marvell.com>
+Date: Thu, 13 Jun 2019 11:29:43 +0300
+Subject: qed: iWARP - Fix default window size to be based on chip
+Patch-mainline: v5.3-rc1
+Git-commit: fbce23a8036d995b17f79c31118d3f549ef44be8
+References: bsc#1050536 FATE#322898 bsc#1050545 FATE#322893
+
+The default window size is calculated for best performance based
+on internal hw buffer sizes. The size differs between the
+different chips and modes.
+
+Fixes: 67b40dccc45f ("qed: Implement iWARP initialization, teardown and qp operations")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 39 ++++++++++++++++++++++++----
+ 1 file changed, 34 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -63,7 +63,12 @@ struct mpa_v2_hdr {
+ #define MPA_REV2(_mpa_rev) ((_mpa_rev) == MPA_NEGOTIATION_TYPE_ENHANCED)
+
+ #define QED_IWARP_INVALID_TCP_CID 0xffffffff
+-#define QED_IWARP_RCV_WND_SIZE_DEF (256 * 1024)
++
++#define QED_IWARP_RCV_WND_SIZE_DEF_BB_2P (200 * 1024)
++#define QED_IWARP_RCV_WND_SIZE_DEF_BB_4P (100 * 1024)
++#define QED_IWARP_RCV_WND_SIZE_DEF_AH_2P (150 * 1024)
++#define QED_IWARP_RCV_WND_SIZE_DEF_AH_4P (90 * 1024)
++
+ #define QED_IWARP_RCV_WND_SIZE_MIN (0xffff)
+ #define TIMESTAMP_HEADER_SIZE (12)
+ #define QED_IWARP_MAX_FIN_RT_DEFAULT (2)
+@@ -2604,7 +2609,8 @@ qed_iwarp_ll2_alloc_buffers(struct qed_h
+
+ static int
+ qed_iwarp_ll2_start(struct qed_hwfn *p_hwfn,
+- struct qed_rdma_start_in_params *params)
++ struct qed_rdma_start_in_params *params,
++ u32 rcv_wnd_size)
+ {
+ struct qed_iwarp_info *iwarp_info;
+ struct qed_ll2_acquire_data data;
+@@ -2670,7 +2675,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
+ data.input.conn_type = QED_LL2_TYPE_OOO;
+ data.input.mtu = params->max_mtu;
+
+- n_ooo_bufs = (QED_IWARP_MAX_OOO * QED_IWARP_RCV_WND_SIZE_DEF) /
++ n_ooo_bufs = (QED_IWARP_MAX_OOO * rcv_wnd_size) /
+ iwarp_info->max_mtu;
+ n_ooo_bufs = min_t(u32, n_ooo_bufs, QED_IWARP_LL2_OOO_MAX_RX_SIZE);
+
+@@ -2760,16 +2765,30 @@ err:
+ return rc;
+ }
+
++static struct {
++ u32 two_ports;
++ u32 four_ports;
++} qed_iwarp_rcv_wnd_size[MAX_CHIP_IDS] = {
++ {QED_IWARP_RCV_WND_SIZE_DEF_BB_2P, QED_IWARP_RCV_WND_SIZE_DEF_BB_4P},
++ {QED_IWARP_RCV_WND_SIZE_DEF_AH_2P, QED_IWARP_RCV_WND_SIZE_DEF_AH_4P}
++};
++
+ int qed_iwarp_setup(struct qed_hwfn *p_hwfn,
+ struct qed_rdma_start_in_params *params)
+ {
++ struct qed_dev *cdev = p_hwfn->cdev;
+ struct qed_iwarp_info *iwarp_info;
++ enum chip_ids chip_id;
+ u32 rcv_wnd_size;
+
+ iwarp_info = &p_hwfn->p_rdma_info->iwarp;
+
+ iwarp_info->tcp_flags = QED_IWARP_TS_EN;
+- rcv_wnd_size = QED_IWARP_RCV_WND_SIZE_DEF;
++
++ chip_id = QED_IS_BB(cdev) ? CHIP_BB : CHIP_K2;
++ rcv_wnd_size = (qed_device_num_ports(cdev) == 4) ?
++ qed_iwarp_rcv_wnd_size[chip_id].four_ports :
++ qed_iwarp_rcv_wnd_size[chip_id].two_ports;
+
+ /* value 0 is used for ilog2(QED_IWARP_RCV_WND_SIZE_MIN) */
+ iwarp_info->rcv_wnd_scale = ilog2(rcv_wnd_size) -
+@@ -2792,7 +2820,7 @@ int qed_iwarp_setup(struct qed_hwfn *p_h
+ qed_iwarp_async_event);
+ qed_ooo_setup(p_hwfn);
+
+- return qed_iwarp_ll2_start(p_hwfn, params);
++ return qed_iwarp_ll2_start(p_hwfn, params, rcv_wnd_size);
+ }
+
+ int qed_iwarp_stop(struct qed_hwfn *p_hwfn)
diff --git a/patches.suse/qed-iWARP-Fix-tc-for-MPA-ll2-connection.patch b/patches.suse/qed-iWARP-Fix-tc-for-MPA-ll2-connection.patch
new file mode 100644
index 0000000000..cdba47e639
--- /dev/null
+++ b/patches.suse/qed-iWARP-Fix-tc-for-MPA-ll2-connection.patch
@@ -0,0 +1,31 @@
+From: Michal Kalderon <michal.kalderon@marvell.com>
+Date: Thu, 13 Jun 2019 11:29:42 +0300
+Subject: qed: iWARP - Fix tc for MPA ll2 connection
+Patch-mainline: v5.3-rc1
+Git-commit: cb94d52b93c74fe1f2595734fabeda9f8ae891ee
+References: bsc#1050536 FATE#322898 bsc#1050545 FATE#322893
+
+The driver needs to assign a lossless traffic class for the MPA ll2
+connection to ensure no packets are dropped when returning from the
+driver as they will never be re-transmitted by the peer.
+
+Fixes: ae3488ff37dc ("qed: Add ll2 connection for processing unaligned MPA packets")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -2703,6 +2703,8 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
+ data.input.rx_num_desc = n_ooo_bufs * 2;
+ data.input.tx_num_desc = data.input.rx_num_desc;
+ data.input.tx_max_bds_per_packet = QED_IWARP_MAX_BDS_PER_FPDU;
++ data.input.tx_tc = PKT_LB_TC;
++ data.input.tx_dest = QED_LL2_TX_DEST_LB;
+ data.p_connection_handle = &iwarp_info->ll2_mpa_handle;
+ data.input.secondary_queue = true;
+ data.cbs = &cbs;
diff --git a/patches.suse/qed-iWARP-Use-READ_ONCE-and-smp_store_release-to-acc.patch b/patches.suse/qed-iWARP-Use-READ_ONCE-and-smp_store_release-to-acc.patch
new file mode 100644
index 0000000000..f126479f68
--- /dev/null
+++ b/patches.suse/qed-iWARP-Use-READ_ONCE-and-smp_store_release-to-acc.patch
@@ -0,0 +1,73 @@
+From: Michal Kalderon <michal.kalderon@marvell.com>
+Date: Thu, 13 Jun 2019 11:29:40 +0300
+Subject: qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state
+Patch-mainline: v5.3-rc1
+Git-commit: 6117561e1bb30b2fe7f51e1961f34dbedd0bec8a
+References: bsc#1050536 FATE#322898 bsc#1050545 FATE#322893
+
+Destroy QP waits for it's ep object state to be set to CLOSED
+before proceeding. ep->state can be updated from a different
+context. Add smp_store_release/READ_ONCE to synchronize.
+
+Fixes: fc4c6065e661 ("qed: iWARP implement disconnect flows")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -532,7 +532,8 @@ int qed_iwarp_destroy_qp(struct qed_hwfn
+
+ /* Make sure ep is closed before returning and freeing memory. */
+ if (ep) {
+- while (ep->state != QED_IWARP_EP_CLOSED && wait_count++ < 200)
++ while (READ_ONCE(ep->state) != QED_IWARP_EP_CLOSED &&
++ wait_count++ < 200)
+ msleep(100);
+
+ if (ep->state != QED_IWARP_EP_CLOSED)
+@@ -1023,8 +1024,6 @@ qed_iwarp_mpa_complete(struct qed_hwfn *
+
+ params.ep_context = ep;
+
+- ep->state = QED_IWARP_EP_CLOSED;
+-
+ switch (fw_return_code) {
+ case RDMA_RETURN_OK:
+ ep->qp->max_rd_atomic_req = ep->cm_info.ord;
+@@ -1084,6 +1083,10 @@ qed_iwarp_mpa_complete(struct qed_hwfn *
+ break;
+ }
+
++ if (fw_return_code != RDMA_RETURN_OK)
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ ep->event_cb(ep->cb_context, &params);
+
+ /* on passive side, if there is no associated QP (REJECT) we need to
+@@ -2817,7 +2820,9 @@ static void qed_iwarp_qp_in_error(struct
+ params.status = (fw_return_code == IWARP_QP_IN_ERROR_GOOD_CLOSE) ?
+ 0 : -ECONNRESET;
+
+- ep->state = QED_IWARP_EP_CLOSED;
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
++
+ spin_lock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+ list_del(&ep->list_entry);
+ spin_unlock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock);
+@@ -2906,7 +2911,8 @@ qed_iwarp_tcp_connect_unsuccessful(struc
+ params.event = QED_IWARP_EVENT_ACTIVE_COMPLETE;
+ params.ep_context = ep;
+ params.cm_info = &ep->cm_info;
+- ep->state = QED_IWARP_EP_CLOSED;
++ /* paired with READ_ONCE in destroy_qp */
++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED);
+
+ switch (fw_return_code) {
+ case IWARP_CONN_ERROR_TCP_CONNECT_INVALID_PACKET:
diff --git a/patches.suse/qed-iWARP-fix-uninitialized-callback.patch b/patches.suse/qed-iWARP-fix-uninitialized-callback.patch
new file mode 100644
index 0000000000..28c14fd598
--- /dev/null
+++ b/patches.suse/qed-iWARP-fix-uninitialized-callback.patch
@@ -0,0 +1,28 @@
+From: Michal Kalderon <michal.kalderon@marvell.com>
+Date: Thu, 13 Jun 2019 11:29:41 +0300
+Subject: qed: iWARP - fix uninitialized callback
+Patch-mainline: v5.3-rc1
+Git-commit: 43cf40d93fadbb0d3edf0942a4612f8ff67478a1
+References: bsc#1050536 FATE#322898 bsc#1050545 FATE#322893
+
+Fix uninitialized variable warning by static checker.
+
+Fixes: ae3488ff37dc ("qed: Add ll2 connection for processing unaligned MPA packets")
+Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
+Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+@@ -2632,6 +2632,7 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
+ cbs.rx_release_cb = qed_iwarp_ll2_rel_rx_pkt;
+ cbs.tx_comp_cb = qed_iwarp_ll2_comp_tx_pkt;
+ cbs.tx_release_cb = qed_iwarp_ll2_rel_tx_pkt;
++ cbs.slowpath_cb = NULL;
+ cbs.cookie = p_hwfn;
+
+ memset(&data, 0, sizeof(data));
diff --git a/patches.suse/sch_hhf-ensure-quantum-and-hhf_non_hh_weight-are-non.patch b/patches.suse/sch_hhf-ensure-quantum-and-hhf_non_hh_weight-are-non.patch
new file mode 100644
index 0000000000..96b11fa2ab
--- /dev/null
+++ b/patches.suse/sch_hhf-ensure-quantum-and-hhf_non_hh_weight-are-non.patch
@@ -0,0 +1,38 @@
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Sun, 8 Sep 2019 13:40:51 -0700
+Subject: sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero
+Git-commit: d4d6ec6dac07f263f06d847d6f732d6855522845
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+In case of TCA_HHF_NON_HH_WEIGHT or TCA_HHF_QUANTUM is zero,
+it would make no progress inside the loop in hhf_dequeue() thus
+kernel would get stuck.
+
+Fix this by checking this corner case in hhf_change().
+
+Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc")
+Reported-by: syzbot+bc6297c11f19ee807dc2@syzkaller.appspotmail.com
+Reported-by: syzbot+041483004a7f45f1f20a@syzkaller.appspotmail.com
+Reported-by: syzbot+55be5f513bed37fc4367@syzkaller.appspotmail.com
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Cc: Terry Lam <vtlam@google.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/sched/sch_hhf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -528,7 +528,7 @@ static int hhf_change(struct Qdisc *sch,
+ new_hhf_non_hh_weight = nla_get_u32(tb[TCA_HHF_NON_HH_WEIGHT]);
+
+ non_hh_quantum = (u64)new_quantum * new_hhf_non_hh_weight;
+- if (non_hh_quantum > INT_MAX)
++ if (non_hh_quantum == 0 || non_hh_quantum > INT_MAX)
+ return -EINVAL;
+
+ sch_tree_lock(sch);
diff --git a/patches.suse/scsi-lpfc-Fix-null-ptr-oops-updating-lpfc_devloss_tm.patch b/patches.suse/scsi-lpfc-Fix-null-ptr-oops-updating-lpfc_devloss_tm.patch
index 287cfeedaf..e136139c4a 100644
--- a/patches.suse/scsi-lpfc-Fix-null-ptr-oops-updating-lpfc_devloss_tm.patch
+++ b/patches.suse/scsi-lpfc-Fix-null-ptr-oops-updating-lpfc_devloss_tm.patch
@@ -1,10 +1,10 @@
From: James Smart <jsmart2021@gmail.com>
Date: Wed, 14 Aug 2019 16:56:45 -0700
-Subject: scsi: lpfc: Fix null ptr oops updating lpfc_devloss_tmo via sysfs
+Subject: [PATCH] scsi: lpfc: Fix null ptr oops updating lpfc_devloss_tmo via
+ sysfs attribute
Git-commit: 07f50997d66c3273121dd6b8a7d433cdfb5395c1
-Patch-mainline: v5.4-rc1
-References: bsc#1146215
- attribute
+Patch-Mainline: v5.4-rc1
+References: bsc#1140845 bsc#1146215
If an admin updates lpfc's devloss_tmo sysfs attribute, the kernel will
oops.
diff --git a/patches.suse/scsi-lpfc-Fix-propagation-of-devloss_tmo-setting-to-.patch b/patches.suse/scsi-lpfc-Fix-propagation-of-devloss_tmo-setting-to-.patch
index edb3f492a6..5bfb632a84 100644
--- a/patches.suse/scsi-lpfc-Fix-propagation-of-devloss_tmo-setting-to-.patch
+++ b/patches.suse/scsi-lpfc-Fix-propagation-of-devloss_tmo-setting-to-.patch
@@ -1,9 +1,10 @@
From: James Smart <jsmart2021@gmail.com>
Date: Wed, 14 Aug 2019 16:56:48 -0700
-Subject: scsi: lpfc: Fix propagation of devloss_tmo setting to nvme transport
+Subject: [PATCH] scsi: lpfc: Fix propagation of devloss_tmo setting to nvme
+ transport
Git-commit: a643c6de1441e5cdab88452c46fe7c38b318009e
-Patch-mainline: v5.4-rc1
-References: bsc#1146215
+Patch-Mainline: v5.4-rc1
+References: bsc#1140883 bsc#1146215
If admin changes the devloss_tmo on an rport via the fc_remote_port rport
dev_loss_tmo attribute, the value is on set on scsi stack. The change is
@@ -23,10 +24,10 @@ Acked-by: Hannes Reinecke <hare@suse.com>
1 file changed, 21 insertions(+)
diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
-index 0e71348bf3a3..b527cc60e939 100644
+index e593787fa82b..e401fe1249f4 100644
--- a/drivers/scsi/lpfc/lpfc_attr.c
+++ b/drivers/scsi/lpfc/lpfc_attr.c
-@@ -6845,10 +6845,31 @@ lpfc_get_starget_port_name(struct scsi_target *starget)
+@@ -6503,10 +6503,31 @@ lpfc_get_starget_port_name(struct scsi_target *starget)
static void
lpfc_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout)
{
diff --git a/patches.suse/scsi-lpfc-remove-left-over-BUILD_NVME-defines.patch b/patches.suse/scsi-lpfc-remove-left-over-BUILD_NVME-defines.patch
new file mode 100644
index 0000000000..a8da5dd673
--- /dev/null
+++ b/patches.suse/scsi-lpfc-remove-left-over-BUILD_NVME-defines.patch
@@ -0,0 +1,65 @@
+From: Hannes Reinecke <hare@suse.com>
+Date: Thu, 17 Oct 2019 17:00:19 +0200
+Subject: [PATCH] scsi: lpfc: remove left-over BUILD_NVME defines
+Git-commit: 1052b41b25cbadcb85ff04c3b46663e21168dd3e
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+References: bsc#1154268
+
+The BUILD_NVME define never got defined anywhere, causing NVMe commands to
+be treated as SCSI commands when freeing the buffers. This was causing a
+stuck discovery and a horrible crash in lpfc_set_rrq_active() later on.
+
+Link: https://lore.kernel.org/r/20191017150019.75769-1-hare@suse.de
+Fixes: c00f62e6c546 ("scsi: lpfc: Merge per-protocol WQ/CQ pairs into single per-cpu pair")
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+---
+ drivers/scsi/lpfc/lpfc_init.c | 2 --
+ drivers/scsi/lpfc/lpfc_scsi.c | 2 --
+ 2 files changed, 4 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index de64880c6c60..2c1e085bd3ce 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -9053,7 +9053,6 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
+ }
+ }
+
+-#if defined(BUILD_NVME)
+ /* Clear NVME stats */
+ if (phba->cfg_enable_fc4_type & LPFC_ENABLE_NVME) {
+ for (idx = 0; idx < phba->cfg_hdw_queue; idx++) {
+@@ -9061,7 +9060,6 @@ lpfc_sli4_queue_create(struct lpfc_hba *phba)
+ sizeof(phba->sli4_hba.hdwq[idx].nvme_cstat));
+ }
+ }
+-#endif
+
+ /* Clear SCSI stats */
+ if (phba->cfg_enable_fc4_type & LPFC_ENABLE_FCP) {
+diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
+index fe1097666de4..6822cd9ff8f1 100644
+--- a/drivers/scsi/lpfc/lpfc_scsi.c
++++ b/drivers/scsi/lpfc/lpfc_scsi.c
+@@ -528,7 +528,6 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba *phba,
+ list_del_init(&psb->list);
+ psb->exch_busy = 0;
+ psb->status = IOSTAT_SUCCESS;
+-#ifdef BUILD_NVME
+ if (psb->cur_iocbq.iocb_flag == LPFC_IO_NVME) {
+ qp->abts_nvme_io_bufs--;
+ spin_unlock(&qp->abts_io_buf_list_lock);
+@@ -536,7 +535,6 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba *phba,
+ lpfc_sli4_nvme_xri_aborted(phba, axri, psb);
+ return;
+ }
+-#endif
+ qp->abts_scsi_io_bufs--;
+ spin_unlock(&qp->abts_io_buf_list_lock);
+
+--
+2.16.4
+
diff --git a/patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch b/patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch
index 3da6dea69e..8c7d19f4fb 100644
--- a/patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch
+++ b/patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch
@@ -1,8 +1,7 @@
From: Quinn Tran <qutran@marvell.com>
Date: Thu, 12 Sep 2019 11:09:11 -0700
Subject: scsi: qla2xxx: Fix Nport ID display value
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
+Patch-mainline: v5.4-rc2
Git-commit: 0aabb6b699f72dca96988d3f428e222f932dc889
References: bsc#1123034 bsc#1131304 bsc#1127988
diff --git a/patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch b/patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch
index 0c5f3a71b8..a37f3c9a3a 100644
--- a/patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch
+++ b/patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch
@@ -1,8 +1,7 @@
From: Daniel Wagner <dwagner@suse.de>
Date: Fri, 27 Sep 2019 09:30:31 +0200
Subject: scsi: qla2xxx: Remove WARN_ON_ONCE in qla2x00_status_cont_entry()
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi.git
+Patch-mainline: v5.4 or v5.4-rc4 (next release)
Git-commit: 9bc6157f5fd0e898c94f3018d088a3419bde0d8f
References: bsc#1143706 bsc#1082635 bsc#1123034
diff --git a/patches.suse/sctp-Fix-the-link-time-qualifier-of-sctp_ctrlsock_ex.patch b/patches.suse/sctp-Fix-the-link-time-qualifier-of-sctp_ctrlsock_ex.patch
new file mode 100644
index 0000000000..35575bedd9
--- /dev/null
+++ b/patches.suse/sctp-Fix-the-link-time-qualifier-of-sctp_ctrlsock_ex.patch
@@ -0,0 +1,30 @@
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Wed, 11 Sep 2019 18:02:39 +0200
+Subject: sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()'
+Git-commit: b456d72412ca8797234449c25815e82f4e1426c0
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+The '.exit' functions from 'pernet_operations' structure should be marked
+as __net_exit, not __net_init.
+
+Fixes: 8e2d61e0aed2 ("sctp: fix race on protocol/netns initialization")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/sctp/protocol.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -1346,7 +1346,7 @@ static int __net_init sctp_ctrlsock_init
+ return status;
+ }
+
+-static void __net_init sctp_ctrlsock_exit(struct net *net)
++static void __net_exit sctp_ctrlsock_exit(struct net *net)
+ {
+ /* Free the control endpoint. */
+ inet_ctl_sock_destroy(net->sctp.ctl_sock);
diff --git a/patches.suse/sctp-use-transport-pf_retrans-in-sctp_do_8_2_transpo.patch b/patches.suse/sctp-use-transport-pf_retrans-in-sctp_do_8_2_transpo.patch
new file mode 100644
index 0000000000..d9310076f0
--- /dev/null
+++ b/patches.suse/sctp-use-transport-pf_retrans-in-sctp_do_8_2_transpo.patch
@@ -0,0 +1,32 @@
+From: Xin Long <lucien.xin@gmail.com>
+Date: Mon, 2 Sep 2019 23:24:21 +0800
+Subject: sctp: use transport pf_retrans in sctp_do_8_2_transport_strike
+Git-commit: 10eb56c582c557c629271f1ee31e15e7a9b2558b
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+Transport should use its own pf_retrans to do the error_count
+check, instead of asoc's. Otherwise, it's meaningless to make
+pf_retrans per transport.
+
+Fixes: 5aa93bcf66f4 ("sctp: Implement quick failover draft from tsvwg")
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/sctp/sm_sideeffect.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -541,7 +541,7 @@ static void sctp_do_8_2_transport_strike
+ if (net->sctp.pf_enable &&
+ (transport->state == SCTP_ACTIVE) &&
+ (transport->error_count < transport->pathmaxrxt) &&
+- (transport->error_count > asoc->pf_retrans)) {
++ (transport->error_count > transport->pf_retrans)) {
+
+ sctp_assoc_control_transport(asoc, transport,
+ SCTP_TRANSPORT_PF,
diff --git a/patches.suse/sock_diag-fix-autoloading-of-the-raw_diag-module.patch b/patches.suse/sock_diag-fix-autoloading-of-the-raw_diag-module.patch
new file mode 100644
index 0000000000..c2c51cd6cd
--- /dev/null
+++ b/patches.suse/sock_diag-fix-autoloading-of-the-raw_diag-module.patch
@@ -0,0 +1,37 @@
+From c34c1287778b080ed692c0a46a8e345206cc29e6 Mon Sep 17 00:00:00 2001
+From: Andrei Vagin <avagin@gmail.com>
+Date: Sun, 4 Nov 2018 22:37:15 -0800
+Subject: [PATCH] sock_diag: fix autoloading of the raw_diag module
+References: bsc#1152791
+Git-commit: c34c1287778b080ed692c0a46a8e345206cc29e6
+Patch-mainline: v4.20-rc2
+
+IPPROTO_RAW isn't registred as an inet protocol, so
+inet_protos[protocol] is always NULL for it.
+
+Cc: Cyrill Gorcunov <gorcunov@gmail.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Fixes: bf2ae2e4bf93 ("sock_diag: request _diag module only when the family or proto has been registered")
+Signed-off-by: Andrei Vagin <avagin@gmail.com>
+Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Thomas Abraham <tabraham@suse.com>
+---
+ net/core/sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6fcc4bc07d19..080a880a1761 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3279,6 +3279,7 @@ int sock_load_diag_module(int family, int protocol)
+
+ #ifdef CONFIG_INET
+ if (family == AF_INET &&
++ protocol != IPPROTO_RAW &&
+ !rcu_access_pointer(inet_protos[protocol]))
+ return -ENOENT;
+ #endif
+--
+2.16.4
+
diff --git a/patches.suse/sock_diag-request-_diag-module-only-when-the-family-.patch b/patches.suse/sock_diag-request-_diag-module-only-when-the-family-.patch
new file mode 100644
index 0000000000..7ac8acb19c
--- /dev/null
+++ b/patches.suse/sock_diag-request-_diag-module-only-when-the-family-.patch
@@ -0,0 +1,205 @@
+From bf2ae2e4bf9360e07c0cdfa166bcdc0afd92f4ce Mon Sep 17 00:00:00 2001
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 10 Mar 2018 18:57:50 +0800
+Subject: [PATCH] sock_diag: request _diag module only when the family or proto
+ has been registered
+References: bsc#1152791
+Git-commit: bf2ae2e4bf9360e07c0cdfa166bcdc0afd92f4ce
+Patch-mainline: v4.16-rc7
+
+Now when using 'ss' in iproute, kernel would try to load all _diag
+modules, which also causes corresponding family and proto modules
+to be loaded as well due to module dependencies.
+
+Like after running 'ss', sctp, dccp, af_packet (if it works as a module)
+would be loaded.
+
+For example:
+
+ $ lsmod|grep sctp
+ $ ss
+ $ lsmod|grep sctp
+ sctp_diag 16384 0
+ sctp 323584 5 sctp_diag
+ inet_diag 24576 4 raw_diag,tcp_diag,sctp_diag,udp_diag
+ libcrc32c 16384 3 nf_conntrack,nf_nat,sctp
+
+As these family and proto modules are loaded unintentionally, it
+could cause some problems, like:
+
+- Some debug tools use 'ss' to collect the socket info, which loads all
+ those diag and family and protocol modules. It's noisy for identifying
+ issues.
+
+- Users usually expect to drop sctp init packet silently when they
+ have no sense of sctp protocol instead of sending abort back.
+
+- It wastes resources (especially with multiple netns), and SCTP module
+ can't be unloaded once it's loaded.
+
+...
+
+In short, it's really inappropriate to have these family and proto
+modules loaded unexpectedly when just doing debugging with inet_diag.
+
+This patch is to introduce sock_load_diag_module() where it loads
+the _diag module only when it's corresponding family or proto has
+been already registered.
+
+Note that we can't just load _diag module without the family or
+proto loaded, as some symbols used in _diag module are from the
+family or proto module.
+
+v1->v2:
+ - move inet proto check to inet_diag to avoid a compiling err.
+v2->v3:
+ - define sock_load_diag_module in sock.c and export one symbol
+ only.
+ - improve the changelog.
+
+Reported-by: Sabrina Dubroca <sd@queasysnail.net>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Phil Sutter <phil@nwl.cc>
+Acked-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Thomas Abraham <tabraham@suse.com>
+---
+ include/linux/net.h | 1 +
+ include/net/sock.h | 1 +
+ net/core/sock.c | 21 +++++++++++++++++++++
+ net/core/sock_diag.c | 12 ++++--------
+ net/ipv4/inet_diag.c | 3 +--
+ net/socket.c | 5 +++++
+ 6 files changed, 33 insertions(+), 10 deletions(-)
+
+diff --git a/include/linux/net.h b/include/linux/net.h
+index 91216b16feb7..2a0391eea05c 100644
+--- a/include/linux/net.h
++++ b/include/linux/net.h
+@@ -222,6 +222,7 @@ enum {
+ int sock_wake_async(struct socket_wq *sk_wq, int how, int band);
+ int sock_register(const struct net_proto_family *fam);
+ void sock_unregister(int family);
++bool sock_is_registered(int family);
+ int __sock_create(struct net *net, int family, int type, int proto,
+ struct socket **res, int kern);
+ int sock_create(int family, int type, int proto, struct socket **res);
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 169c92afcafa..ae23f3b389ca 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1137,6 +1137,7 @@ struct proto {
+
+ int proto_register(struct proto *prot, int alloc_slab);
+ void proto_unregister(struct proto *prot);
++int sock_load_diag_module(int family, int protocol);
+
+ #ifdef SOCK_REFCNT_DEBUG
+ static inline void sk_refcnt_debug_inc(struct sock *sk)
+diff --git a/net/core/sock.c b/net/core/sock.c
+index c501499a04fe..85b0b64e7f9d 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -3261,6 +3261,27 @@ void proto_unregister(struct proto *prot)
+ }
+ EXPORT_SYMBOL(proto_unregister);
+
++int sock_load_diag_module(int family, int protocol)
++{
++ if (!protocol) {
++ if (!sock_is_registered(family))
++ return -ENOENT;
++
++ return request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
++ NETLINK_SOCK_DIAG, family);
++ }
++
++#ifdef CONFIG_INET
++ if (family == AF_INET &&
++ !rcu_access_pointer(inet_protos[protocol]))
++ return -ENOENT;
++#endif
++
++ return request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
++ NETLINK_SOCK_DIAG, family, protocol);
++}
++EXPORT_SYMBOL(sock_load_diag_module);
++
+ #ifdef CONFIG_PROC_FS
+ static void *proto_seq_start(struct seq_file *seq, loff_t *pos)
+ __acquires(proto_list_mutex)
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index 146b50e30659..c37b5be7c5e4 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -220,8 +220,7 @@ static int __sock_diag_cmd(struct sk_buff *skb, struct nlmsghdr *nlh)
+ return -EINVAL;
+
+ if (sock_diag_handlers[req->sdiag_family] == NULL)
+- request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+- NETLINK_SOCK_DIAG, req->sdiag_family);
++ sock_load_diag_module(req->sdiag_family, 0);
+
+ mutex_lock(&sock_diag_table_mutex);
+ hndl = sock_diag_handlers[req->sdiag_family];
+@@ -247,8 +246,7 @@ static int sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh,
+ case TCPDIAG_GETSOCK:
+ case DCCPDIAG_GETSOCK:
+ if (inet_rcv_compat == NULL)
+- request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+- NETLINK_SOCK_DIAG, AF_INET);
++ sock_load_diag_module(AF_INET, 0);
+
+ mutex_lock(&sock_diag_table_mutex);
+ if (inet_rcv_compat != NULL)
+@@ -281,14 +279,12 @@ static int sock_diag_bind(struct net *net, int group)
+ case SKNLGRP_INET_TCP_DESTROY:
+ case SKNLGRP_INET_UDP_DESTROY:
+ if (!sock_diag_handlers[AF_INET])
+- request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+- NETLINK_SOCK_DIAG, AF_INET);
++ sock_load_diag_module(AF_INET, 0);
+ break;
+ case SKNLGRP_INET6_TCP_DESTROY:
+ case SKNLGRP_INET6_UDP_DESTROY:
+ if (!sock_diag_handlers[AF_INET6])
+- request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK,
+- NETLINK_SOCK_DIAG, AF_INET6);
++ sock_load_diag_module(AF_INET6, 0);
+ break;
+ }
+ return 0;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index a383f299ce24..4e5bc4b2f14e 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -53,8 +53,7 @@ static DEFINE_MUTEX(inet_diag_table_mutex);
+ static const struct inet_diag_handler *inet_diag_lock_handler(int proto)
+ {
+ if (!inet_diag_table[proto])
+- request_module("net-pf-%d-proto-%d-type-%d-%d", PF_NETLINK,
+- NETLINK_SOCK_DIAG, AF_INET, proto);
++ sock_load_diag_module(AF_INET, proto);
+
+ mutex_lock(&inet_diag_table_mutex);
+ if (!inet_diag_table[proto])
+diff --git a/net/socket.c b/net/socket.c
+index a93c99b518ca..08847c3b8c39 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2587,6 +2587,11 @@ void sock_unregister(int family)
+ }
+ EXPORT_SYMBOL(sock_unregister);
+
++bool sock_is_registered(int family)
++{
++ return family < NPROTO && rcu_access_pointer(net_families[family]);
++}
++
+ static int __init sock_init(void)
+ {
+ int err;
+--
+2.12.3
+
diff --git a/patches.suse/tcp-Don-t-dequeue-SYN-FIN-segments-from-write-queue.patch b/patches.suse/tcp-Don-t-dequeue-SYN-FIN-segments-from-write-queue.patch
new file mode 100644
index 0000000000..e7270ede2d
--- /dev/null
+++ b/patches.suse/tcp-Don-t-dequeue-SYN-FIN-segments-from-write-queue.patch
@@ -0,0 +1,94 @@
+From: Christoph Paasch <cpaasch@apple.com>
+Date: Fri, 13 Sep 2019 13:08:19 -0700
+Subject: tcp: Don't dequeue SYN/FIN-segments from write-queue
+Patch-mainline: 4.14.146
+Git-commit: ba2ddb43f270e6492ccce4fc42fc32c611de8f68
+References: git-gixes
+
+If a SYN/FIN-segment is on the write-queue, skb->len is 0, but the
+segment actually has been transmitted. end_seq and seq of the tcp_skb_cb
+in that case will indicate this difference.
+
+We should not remove such segments from the write-queue as we might be
+in SYN_SENT-state and a retransmission-timer is running. When that one
+fires, packets_out will be 1, but the write-queue would be empty,
+resulting in:
+
+[ 61.280214] ------------[ cut here ]------------
+[ 61.281307] WARNING: CPU: 0 PID: 0 at net/ipv4/tcp_timer.c:429 tcp_retransmit_timer+0x18f9/0x2660
+[ 61.283498] Modules linked in:
+[ 61.284084] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.14.142 #58
+[ 61.285214] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011
+[ 61.286644] task: ffffffff8401e1c0 task.stack: ffffffff84000000
+[ 61.287758] RIP: 0010:tcp_retransmit_timer+0x18f9/0x2660
+[ 61.288715] RSP: 0018:ffff88806ce07cb8 EFLAGS: 00010206
+[ 61.289669] RAX: ffffffff8401e1c0 RBX: ffff88805c998b00 RCX: 0000000000000006
+[ 61.290968] RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88805c9994d8
+[ 61.292314] RBP: ffff88805c99919a R08: ffff88807fff901c R09: ffff88807fff9008
+[ 61.293547] R10: ffff88807fff9017 R11: ffff88807fff9010 R12: ffff88805c998b30
+[ 61.294834] R13: ffffffff844b9380 R14: 0000000000000000 R15: ffff88805c99930c
+[ 61.296086] FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
+[ 61.297523] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 61.298646] CR2: 00007f721da50ff8 CR3: 0000000004014002 CR4: 00000000001606f0
+[ 61.299944] Call Trace:
+[ 61.300403] <IRQ>
+[ 61.300806] ? kvm_sched_clock_read+0x21/0x30
+[ 61.301689] ? sched_clock+0x5/0x10
+[ 61.302433] ? sched_clock_cpu+0x18/0x170
+[ 61.303173] tcp_write_timer_handler+0x2c1/0x7a0
+[ 61.304038] tcp_write_timer+0x13e/0x160
+[ 61.304794] call_timer_fn+0x14a/0x5f0
+[ 61.305480] ? tcp_write_timer_handler+0x7a0/0x7a0
+[ 61.306364] ? __next_timer_interrupt+0x140/0x140
+[ 61.307229] ? _raw_spin_unlock_irq+0x24/0x40
+[ 61.308033] ? tcp_write_timer_handler+0x7a0/0x7a0
+[ 61.308887] ? tcp_write_timer_handler+0x7a0/0x7a0
+[ 61.309760] run_timer_softirq+0xc41/0x1080
+[ 61.310539] ? trigger_dyntick_cpu.isra.33+0x180/0x180
+[ 61.311506] ? ktime_get+0x13f/0x1c0
+[ 61.312232] ? clockevents_program_event+0x10d/0x2f0
+[ 61.313158] __do_softirq+0x20b/0x96b
+[ 61.313889] irq_exit+0x1a7/0x1e0
+[ 61.314513] smp_apic_timer_interrupt+0xfc/0x4d0
+[ 61.315386] apic_timer_interrupt+0x8f/0xa0
+[ 61.316129] </IRQ>
+
+Followed by a panic.
+
+So, before removing an skb with skb->len == 0, let's make sure that the
+skb is really empty by checking the end_seq and seq.
+
+This patch needs to be backported only to 4.14 and older (among those
+that applied the backport of fdfc5c8594c2).
+
+Reported-by: Luis Henriques <lhenriques@suse.com>
+Fixes: fdfc5c8594c2 ("tcp: remove empty skb from write queue in error cases")
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jason Baron <jbaron@akamai.com>
+Cc: Vladimir Rutsky <rutsky@google.com>
+Cc: Soheil Hassas Yeganeh <soheil@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: Christoph Paasch <cpaasch@apple.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/tcp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index efe767e20d01..c1f59a53f68f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -922,7 +922,8 @@ static int tcp_send_mss(struct sock *sk, int *size_goal, int flags)
+ */
+ static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
+ {
+- if (skb && !skb->len) {
++ if (skb && !skb->len &&
++ TCP_SKB_CB(skb)->end_seq == TCP_SKB_CB(skb)->seq) {
+ tcp_unlink_write_queue(skb, sk);
+ tcp_check_send_head(sk, skb);
+ sk_wmem_free_skb(sk, skb);
+--
+2.23.0
+
diff --git a/patches.suse/tcp-fix-tcp_ecn_withdraw_cwr-to-clear-TCP_ECN_QUEUE_.patch b/patches.suse/tcp-fix-tcp_ecn_withdraw_cwr-to-clear-TCP_ECN_QUEUE_.patch
new file mode 100644
index 0000000000..c81b2c0329
--- /dev/null
+++ b/patches.suse/tcp-fix-tcp_ecn_withdraw_cwr-to-clear-TCP_ECN_QUEUE_.patch
@@ -0,0 +1,57 @@
+From: Neal Cardwell <ncardwell@google.com>
+Date: Mon, 9 Sep 2019 16:56:02 -0400
+Subject: tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
+Git-commit: af38d07ed391b21f7405fa1f936ca9686787d6d2
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+Fix tcp_ecn_withdraw_cwr() to clear the correct bit:
+TCP_ECN_QUEUE_CWR.
+
+Rationale: basically, TCP_ECN_DEMAND_CWR is a bit that is purely about
+the behavior of data receivers, and deciding whether to reflect
+incoming IP ECN CE marks as outgoing TCP th->ece marks. The
+TCP_ECN_QUEUE_CWR bit is purely about the behavior of data senders,
+and deciding whether to send CWR. The tcp_ecn_withdraw_cwr() function
+is only called from tcp_undo_cwnd_reduction() by data senders during
+an undo, so it should zero the sender-side state,
+TCP_ECN_QUEUE_CWR. It does not make sense to stop the reflection of
+incoming CE bits on incoming data packets just because outgoing
+packets were spuriously retransmitted.
+
+The bug has been reproduced with packetdrill to manifest in a scenario
+with RFC3168 ECN, with an incoming data packet with CE bit set and
+carrying a TCP timestamp value that causes cwnd undo. Before this fix,
+the IP CE bit was ignored and not reflected in the TCP ECE header bit,
+and sender sent a TCP CWR ('W') bit on the next outgoing data packet,
+even though the cwnd reduction had been undone. After this fix, the
+sender properly reflects the CE bit and does not set the W bit.
+
+Note: the bug actually predates 2005 git history; this Fixes footer is
+chosen to be the oldest SHA1 I have tested (from Sep 2007) for which
+the patch applies cleanly (since before this commit the code was in a
+.h file).
+
+Fixes: bdf1ee5d3bd3 ("[TCP]: Move code from tcp_ecn.h to tcp*.c and tcp.h & remove it")
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Yuchung Cheng <ycheng@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/tcp_input.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -249,7 +249,7 @@ static void tcp_ecn_accept_cwr(struct tc
+
+ static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp)
+ {
+- tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
++ tp->ecn_flags &= ~TCP_ECN_QUEUE_CWR;
+ }
+
+ static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb)
diff --git a/patches.suse/tcp-inherit-timestamp-on-mtu-probe.patch b/patches.suse/tcp-inherit-timestamp-on-mtu-probe.patch
new file mode 100644
index 0000000000..d73578833f
--- /dev/null
+++ b/patches.suse/tcp-inherit-timestamp-on-mtu-probe.patch
@@ -0,0 +1,45 @@
+From: Willem de Bruijn <willemb@google.com>
+Date: Tue, 27 Aug 2019 15:09:33 -0400
+Subject: tcp: inherit timestamp on mtu probe
+Git-commit: 888a5c53c0d8be6e98bc85b677f179f77a647873
+Patch-mainline: 5.3-rc7
+References: networking-stable-19_09_05
+
+TCP associates tx timestamp requests with a byte in the bytestream.
+If merging skbs in tcp_mtu_probe, migrate the tstamp request.
+
+Similar to MSG_EOR, do not allow moving a timestamp from any segment
+in the probe but the last. This to avoid merging multiple timestamps.
+
+Tested with the packetdrill script at
+https://github.com/wdebruij/packetdrill/commits/mtu_probe-1
+
+Link: http://patchwork.ozlabs.org/patch/1143278/#2232897
+Fixes: 4ed2d765dfac ("net-timestamp: TCP timestamping")
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/tcp_output.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2026,7 +2026,7 @@ static bool tcp_can_coalesce_send_queue_
+ if (len <= skb->len)
+ break;
+
+- if (unlikely(TCP_SKB_CB(skb)->eor))
++ if (unlikely(TCP_SKB_CB(skb)->eor) || tcp_has_tx_tstamp(skb))
+ return false;
+
+ len -= skb->len;
+@@ -2149,6 +2149,7 @@ static int tcp_mtu_probe(struct sock *sk
+ * we need to propagate it to the new skb.
+ */
+ TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor;
++ tcp_skb_collapse_tstamp(nskb, skb);
+ tcp_unlink_write_queue(skb, sk);
+ sk_wmem_free_skb(sk, skb);
+ } else {
diff --git a/patches.suse/tcp-remove-empty-skb-from-write-queue-in-error-cases.patch b/patches.suse/tcp-remove-empty-skb-from-write-queue-in-error-cases.patch
new file mode 100644
index 0000000000..b41475cbe8
--- /dev/null
+++ b/patches.suse/tcp-remove-empty-skb-from-write-queue-in-error-cases.patch
@@ -0,0 +1,86 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 26 Aug 2019 09:19:15 -0700
+Subject: tcp: remove empty skb from write queue in error cases
+Git-commit: fdfc5c8594c24c5df883583ebd286321a80e0a67
+Patch-mainline: 5.3-rc7
+References: networking-stable-19_09_05
+
+Vladimir Rutsky reported stuck TCP sessions after memory pressure
+events. Edge Trigger epoll() user would never receive an EPOLLOUT
+notification allowing them to retry a sendmsg().
+
+Jason tested the case of sk_stream_alloc_skb() returning NULL,
+but there are other paths that could lead both sendmsg() and sendpage()
+to return -1 (EAGAIN), with an empty skb queued on the write queue.
+
+This patch makes sure we remove this empty skb so that
+Jason code can detect that the queue is empty, and
+call sk->sk_write_space(sk) accordingly.
+
+Fixes: ce5ec440994b ("tcp: ensure epoll edge trigger wakeup when write queue is empty")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Jason Baron <jbaron@akamai.com>
+Reported-by: Vladimir Rutsky <rutsky@google.com>
+Cc: Soheil Hassas Yeganeh <soheil@google.com>
+Cc: Neal Cardwell <ncardwell@google.com>
+Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv4/tcp.c | 28 +++++++++++++++++++---------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -881,6 +881,21 @@ static int tcp_send_mss(struct sock *sk,
+ return mss_now;
+ }
+
++/* In some cases, both sendpage() and sendmsg() could have added
++ * an skb to the write queue, but failed adding payload on it.
++ * We need to remove it to consume less memory, but more
++ * importantly be able to generate EPOLLOUT for Edge Trigger epoll()
++ * users.
++ */
++static void tcp_remove_empty_skb(struct sock *sk, struct sk_buff *skb)
++{
++ if (skb && !skb->len) {
++ tcp_unlink_write_queue(skb, sk);
++ tcp_check_send_head(sk, skb);
++ sk_wmem_free_skb(sk, skb);
++ }
++}
++
+ ssize_t do_tcp_sendpages(struct sock *sk, struct page *page, int offset,
+ size_t size, int flags)
+ {
+@@ -1001,6 +1016,7 @@ out:
+ return copied;
+
+ do_error:
++ tcp_remove_empty_skb(sk, tcp_write_queue_tail(sk));
+ if (copied)
+ goto out;
+ out_err:
+@@ -1348,17 +1364,11 @@ out_nopush:
+ out_nopush:
+ return copied + copied_syn;
+
++do_error:
++ skb = tcp_write_queue_tail(sk);
+ do_fault:
+- if (!skb->len) {
+- tcp_unlink_write_queue(skb, sk);
+- /* It is the one place in all of TCP, except connection
+- * reset, where we can be unlinking the send_head.
+- */
+- tcp_check_send_head(sk, skb);
+- sk_wmem_free_skb(sk, skb);
+- }
++ tcp_remove_empty_skb(sk, skb);
+
+-do_error:
+ if (copied + copied_syn)
+ goto out;
+ out_err:
diff --git a/patches.suse/tipc-add-NULL-pointer-check-before-calling-kfree_rcu.patch b/patches.suse/tipc-add-NULL-pointer-check-before-calling-kfree_rcu.patch
new file mode 100644
index 0000000000..fc439b7db1
--- /dev/null
+++ b/patches.suse/tipc-add-NULL-pointer-check-before-calling-kfree_rcu.patch
@@ -0,0 +1,54 @@
+From: Xin Long <lucien.xin@gmail.com>
+Date: Tue, 3 Sep 2019 17:53:12 +0800
+Subject: tipc: add NULL pointer check before calling kfree_rcu
+Git-commit: 42dec1dbe38239cf91cc1f4df7830c66276ced37
+Patch-mainline: 5.3
+References: networking-stable-19_09_15
+
+Unlike kfree(p), kfree_rcu(p, rcu) won't do NULL pointer check. When
+tipc_nametbl_remove_publ returns NULL, the panic below happens:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000068
+ RIP: 0010:__call_rcu+0x1d/0x290
+ Call Trace:
+ <IRQ>
+ tipc_publ_notify+0xa9/0x170 [tipc]
+ tipc_node_write_unlock+0x8d/0x100 [tipc]
+ tipc_node_link_down+0xae/0x1d0 [tipc]
+ tipc_node_check_dest+0x3ea/0x8f0 [tipc]
+ ? tipc_disc_rcv+0x2c7/0x430 [tipc]
+ tipc_disc_rcv+0x2c7/0x430 [tipc]
+ ? tipc_rcv+0x6bb/0xf20 [tipc]
+ tipc_rcv+0x6bb/0xf20 [tipc]
+ ? ip_route_input_slow+0x9cf/0xb10
+ tipc_udp_recv+0x195/0x1e0 [tipc]
+ ? tipc_udp_is_known_peer+0x80/0x80 [tipc]
+ udp_queue_rcv_skb+0x180/0x460
+ udp_unicast_rcv_skb.isra.56+0x75/0x90
+ __udp4_lib_rcv+0x4ce/0xb90
+ ip_local_deliver_finish+0x11c/0x210
+ ip_local_deliver+0x6b/0xe0
+ ? ip_rcv_finish+0xa9/0x410
+ ip_rcv+0x273/0x362
+
+Fixes: 97ede29e80ee ("tipc: convert name table read-write lock to RCU")
+Reported-by: Li Shuang <shuali@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/tipc/name_distr.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/tipc/name_distr.c
++++ b/net/tipc/name_distr.c
+@@ -224,7 +224,8 @@ static void tipc_publ_purge(struct net *
+ publ->key);
+ }
+
+- kfree_rcu(p, rcu);
++ if (p)
++ kfree_rcu(p, rcu);
+ }
+
+ /**
diff --git a/patches.suse/tracing-Initialize-iter-seq-after-zeroing-in-tracing.patch b/patches.suse/tracing-Initialize-iter-seq-after-zeroing-in-tracing.patch
new file mode 100644
index 0000000000..bd5fe75584
--- /dev/null
+++ b/patches.suse/tracing-Initialize-iter-seq-after-zeroing-in-tracing.patch
@@ -0,0 +1,82 @@
+From d303de1fcf344ff7c15ed64c3f48a991c9958775 Mon Sep 17 00:00:00 2001
+From: Petr Mladek <pmladek@suse.com>
+Date: Fri, 11 Oct 2019 16:21:34 +0200
+Subject: [PATCH] tracing: Initialize iter->seq after zeroing in
+ tracing_read_pipe()
+Git-commit: d303de1fcf344ff7c15ed64c3f48a991c9958775
+Patch-mainline: v5.4-rc3
+References: bsc#1151508
+
+A customer reported the following softlockup:
+
+[899688.160002] NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [test.sh:16464]
+[899688.160002] CPU: 0 PID: 16464 Comm: test.sh Not tainted 4.12.14-6.23-azure #1 SLE12-SP4
+[899688.160002] RIP: 0010:up_write+0x1a/0x30
+[899688.160002] Kernel panic - not syncing: softlockup: hung tasks
+[899688.160002] RIP: 0010:up_write+0x1a/0x30
+[899688.160002] RSP: 0018:ffffa86784d4fde8 EFLAGS: 00000257 ORIG_RAX: ffffffffffffff12
+[899688.160002] RAX: ffffffff970fea00 RBX: 0000000000000001 RCX: 0000000000000000
+[899688.160002] RDX: ffffffff00000001 RSI: 0000000000000080 RDI: ffffffff970fea00
+[899688.160002] RBP: ffffffffffffffff R08: ffffffffffffffff R09: 0000000000000000
+[899688.160002] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8b59014720d8
+[899688.160002] R13: ffff8b59014720c0 R14: ffff8b5901471090 R15: ffff8b5901470000
+[899688.160002] tracing_read_pipe+0x336/0x3c0
+[899688.160002] __vfs_read+0x26/0x140
+[899688.160002] vfs_read+0x87/0x130
+[899688.160002] SyS_read+0x42/0x90
+[899688.160002] do_syscall_64+0x74/0x160
+
+It caught the process in the middle of trace_access_unlock(). There is
+no loop. So, it must be looping in the caller tracing_read_pipe()
+via the "waitagain" label.
+
+Crashdump analyze uncovered that iter->seq was completely zeroed
+at this point, including iter->seq.seq.size. It means that
+print_trace_line() was never able to print anything and
+there was no forward progress.
+
+The culprit seems to be in the code:
+
+ /* reset all but tr, trace, and overruns */
+ memset(&iter->seq, 0,
+ sizeof(struct trace_iterator) -
+ offsetof(struct trace_iterator, seq));
+
+It was added by the commit 53d0aa773053ab182877 ("ftrace:
+add logic to record overruns"). It was v2.6.27-rc1.
+It was the time when iter->seq looked like:
+
+ struct trace_seq {
+ unsigned char buffer[PAGE_SIZE];
+ unsigned int len;
+ };
+
+There was no "size" variable and zeroing was perfectly fine.
+
+The solution is to reinitialize the structure after or without
+zeroing.
+
+Link: http://lkml.kernel.org/r/20191011142134.11997-1-pmladek@suse.com
+
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+
+---
+ kernel/trace/trace.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 2b4eff383505..6a0ee9178365 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -6036,6 +6036,7 @@ tracing_read_pipe(struct file *filp, char __user *ubuf,
+ sizeof(struct trace_iterator) -
+ offsetof(struct trace_iterator, seq));
+ cpumask_clear(iter->started);
++ trace_seq_init(&iter->seq);
+ iter->pos = -1;
+
+ trace_event_read_lock();
+--
+2.16.4
+
diff --git a/patches.suse/tun-fix-use-after-free-when-register-netdev-failed.patch b/patches.suse/tun-fix-use-after-free-when-register-netdev-failed.patch
index 4e930ce3d5..1798e66869 100644
--- a/patches.suse/tun-fix-use-after-free-when-register-netdev-failed.patch
+++ b/patches.suse/tun-fix-use-after-free-when-register-netdev-failed.patch
@@ -1,10 +1,9 @@
-From 77f22f92dff8e7b45c7786a430626d38071d4670 Mon Sep 17 00:00:00 2001
From: Yang Yingliang <yangyingliang@huawei.com>
Date: Tue, 10 Sep 2019 18:56:57 +0800
-Subject: [PATCH] tun: fix use-after-free when register netdev failed
+Subject: tun: fix use-after-free when register netdev failed
Git-commit: 77f22f92dff8e7b45c7786a430626d38071d4670
-Patch-mainline: v5.3
-References: bsc#1111666
+Patch-mainline: 5.3
+References: bsc#1111666 networking-stable-19_09_15
I got a UAF repport in tun driver when doing fuzzy test:
@@ -132,11 +131,9 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
drivers/net/tun.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
-diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index db16d7a13e00..aab0be40d443 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
-@@ -787,7 +787,8 @@ static void tun_detach_all(struct net_device *dev)
+@@ -632,7 +632,8 @@ static void tun_detach_all(struct net_de
}
static int tun_attach(struct tun_struct *tun, struct file *file,
@@ -146,7 +143,7 @@ index db16d7a13e00..aab0be40d443 100644
{
struct tun_file *tfile = file->private_data;
struct net_device *dev = tun->dev;
-@@ -870,7 +871,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
+@@ -674,7 +675,8 @@ static int tun_attach(struct tun_struct
* initialized tfile; otherwise we risk using half-initialized
* object.
*/
@@ -156,7 +153,7 @@ index db16d7a13e00..aab0be40d443 100644
rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
tun->numqueues++;
tun_set_real_num_queues(tun);
-@@ -2730,7 +2732,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+@@ -1779,7 +1781,7 @@ static int tun_set_iff(struct net *net,
err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER,
ifr->ifr_flags & IFF_NAPI,
@@ -165,7 +162,7 @@ index db16d7a13e00..aab0be40d443 100644
if (err < 0)
return err;
-@@ -2829,13 +2831,17 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
+@@ -1868,13 +1871,17 @@ static int tun_set_iff(struct net *net,
INIT_LIST_HEAD(&tun->disabled);
err = tun_attach(tun, file, false, ifr->ifr_flags & IFF_NAPI,
@@ -184,7 +181,7 @@ index db16d7a13e00..aab0be40d443 100644
}
netif_carrier_on(tun->dev);
-@@ -2978,7 +2984,7 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
+@@ -2020,7 +2027,7 @@ static int tun_set_queue(struct file *fi
if (ret < 0)
goto unlock;
ret = tun_attach(tun, file, false, tun->flags & IFF_NAPI,
@@ -193,6 +190,3 @@ index db16d7a13e00..aab0be40d443 100644
} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
tun = rtnl_dereference(tfile->tun);
if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached)
---
-2.16.4
-
diff --git a/patches.suse/x86-mm-use-write_once-when-setting-ptes.patch b/patches.suse/x86-mm-use-write_once-when-setting-ptes.patch
new file mode 100644
index 0000000000..c0f2b3b380
--- /dev/null
+++ b/patches.suse/x86-mm-use-write_once-when-setting-ptes.patch
@@ -0,0 +1,142 @@
+From: Nadav Amit <namit@vmware.com>
+Date: Sun, 2 Sep 2018 11:14:50 -0700
+Subject: x86/mm: Use WRITE_ONCE() when setting PTEs
+Git-commit: 9bc4f28af75a91aea0ae383f50b0a430c4509303
+Patch-mainline: v4.19-rc3
+References: bsc#1114279
+
+When page-table entries are set, the compiler might optimize their
+assignment by using multiple instructions to set the PTE. This might
+turn into a security hazard if the user somehow manages to use the
+interim PTE. L1TF does not make our lives easier, making even an interim
+non-present PTE a security hazard.
+
+Using WRITE_ONCE() to set PTEs and friends should prevent this potential
+security hazard.
+
+I skimmed the differences in the binary with and without this patch. The
+differences are (obviously) greater when CONFIG_PARAVIRT=n as more
+code optimizations are possible. For better and worse, the impact on the
+binary with this patch is pretty small. Skimming the code did not cause
+anything to jump out as a security hazard, but it seems that at least
+move_soft_dirty_pte() caused set_pte_at() to use multiple writes.
+
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Andi Kleen <ak@linux.intel.com>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: Sean Christopherson <sean.j.christopherson@intel.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180902181451.80520-1-namit@vmware.com
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/pgtable_64.h | 20 ++++++++++----------
+ arch/x86/mm/pgtable.c | 8 ++++----
+ 2 files changed, 14 insertions(+), 14 deletions(-)
+
+--- a/arch/x86/include/asm/pgtable_64.h
++++ b/arch/x86/include/asm/pgtable_64.h
+@@ -53,15 +53,15 @@ struct mm_struct;
+ void set_pte_vaddr_p4d(p4d_t *p4d_page, unsigned long vaddr, pte_t new_pte);
+ void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte);
+
+-static inline void native_pte_clear(struct mm_struct *mm, unsigned long addr,
+- pte_t *ptep)
++static inline void native_set_pte(pte_t *ptep, pte_t pte)
+ {
+- *ptep = native_make_pte(0);
++ WRITE_ONCE(*ptep, pte);
+ }
+
+-static inline void native_set_pte(pte_t *ptep, pte_t pte)
++static inline void native_pte_clear(struct mm_struct *mm, unsigned long addr,
++ pte_t *ptep)
+ {
+- *ptep = pte;
++ native_set_pte(ptep, native_make_pte(0));
+ }
+
+ static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
+@@ -71,7 +71,7 @@ static inline void native_set_pte_atomic
+
+ static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
+ {
+- *pmdp = pmd;
++ WRITE_ONCE(*pmdp, pmd);
+ }
+
+ static inline void native_pmd_clear(pmd_t *pmd)
+@@ -107,7 +107,7 @@ static inline pmd_t native_pmdp_get_and_
+
+ static inline void native_set_pud(pud_t *pudp, pud_t pud)
+ {
+- *pudp = pud;
++ WRITE_ONCE(*pudp, pud);
+ }
+
+ static inline void native_pud_clear(pud_t *pud)
+@@ -219,7 +219,7 @@ static inline void native_set_p4d(p4d_t
+ #if defined(CONFIG_PAGE_TABLE_ISOLATION) && !defined(CONFIG_X86_5LEVEL)
+ p4dp->pgd = pti_set_user_pgd(&p4dp->pgd, p4d.pgd);
+ #else
+- *p4dp = p4d;
++ WRITE_ONCE(*p4dp, p4d);
+ #endif
+ }
+
+@@ -235,9 +235,9 @@ static inline void native_p4d_clear(p4d_
+ static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
+ {
+ #ifdef CONFIG_PAGE_TABLE_ISOLATION
+- *pgdp = pti_set_user_pgd(pgdp, pgd);
++ WRITE_ONCE(*pgdp, pti_set_user_pgd(pgdp, pgd));
+ #else
+- *pgdp = pgd;
++ WRITE_ONCE(*pgdp, pgd);
+ #endif
+ }
+
+--- a/arch/x86/mm/pgtable.c
++++ b/arch/x86/mm/pgtable.c
+@@ -259,7 +259,7 @@ static void pgd_mop_up_pmds(struct mm_st
+ if (pgd_val(pgd) != 0) {
+ pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
+
+- pgdp[i] = native_make_pgd(0);
++ pgd_clear(&pgdp[i]);
+
+ paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
+ pmd_free(mm, pmd);
+@@ -429,7 +429,7 @@ int ptep_set_access_flags(struct vm_area
+ int changed = !pte_same(*ptep, entry);
+
+ if (changed && dirty) {
+- *ptep = entry;
++ set_pte(ptep, entry);
+ pte_update(vma->vm_mm, address, ptep);
+ }
+
+@@ -446,7 +446,7 @@ int pmdp_set_access_flags(struct vm_area
+ VM_BUG_ON(address & ~HPAGE_PMD_MASK);
+
+ if (changed && dirty) {
+- *pmdp = entry;
++ set_pmd(pmdp, entry);
+ /*
+ * We had a write-protection fault here and changed the pmd
+ * to to more permissive. No need to flush the TLB for that,
+@@ -466,7 +466,7 @@ int pudp_set_access_flags(struct vm_area
+ VM_BUG_ON(address & ~HPAGE_PUD_MASK);
+
+ if (changed && dirty) {
+- *pudp = entry;
++ set_pud(pudp, entry);
+ /*
+ * We had a write-protection fault here and changed the pud
+ * to to more permissive. No need to flush the TLB for that,
diff --git a/scripts/check-patch-blacklist b/scripts/check-patch-blacklist
new file mode 100755
index 0000000000..7063dd5af1
--- /dev/null
+++ b/scripts/check-patch-blacklist
@@ -0,0 +1,14 @@
+#!/bin/bash
+# check-patch-blacklist blacklist patch-filename < patch-content
+hash=$(grep -Ei "^Git-commit:[ \t]+[a-f0-9]{40}\>")
+if [ -n "$hash" ] ; then
+ hash=$(echo "${hash#*: }" | head -c 40)
+ blacklist=$(grep -Ei "^$hash\>" < "$1")
+ if [ -n "$blacklist" ]; then
+ echo "Patch $2
+blacklisted: $blacklist
+
+Please remove from blacklist if you really think this patch should be included."
+ exit 1
+ fi
+fi
diff --git a/scripts/git-pre-commit b/scripts/git-pre-commit
index 60b211c327..e8161e9c73 100755
--- a/scripts/git-pre-commit
+++ b/scripts/git-pre-commit
@@ -45,6 +45,7 @@ while read stat file garbage; do
git cat-file blob :$file >"$tmp"
"$dir/check-patchhdr" $update --stdin "$file" <"$tmp" || err=1
"$dir/check-patchfmt" --stdin "$file" <"$tmp" || err=1
+ "$dir/check-patch-blacklist" $(dirname "$dir")/blacklist.conf "$file" <$tmp || err=1
esac
done
diff --git a/scripts/git_sort/git_sort.py b/scripts/git_sort/git_sort.py
index ff30bc74b4..c521dfbcfa 100755
--- a/scripts/git_sort/git_sort.py
+++ b/scripts/git_sort/git_sort.py
@@ -216,6 +216,8 @@ remotes = (
Head(RepoURL("klassert/ipsec.git")),
Head(RepoURL("klassert/ipsec-next.git")),
Head(RepoURL("kvalo/wireless-drivers-next.git")),
+ Head(RepoURL("mkp/scsi.git"), "4.19/scsi-queue"),
+ Head(RepoURL("mkp/scsi.git"), "5.0/scsi-fixes"),
Head(RepoURL("mkp/scsi.git"), "queue"),
Head(RepoURL("mkp/scsi.git"), "fixes"),
Head(RepoURL("git://git.kernel.dk/linux-block.git"), "for-next"),
@@ -228,14 +230,15 @@ remotes = (
Head(RepoURL("viro/vfs.git"), "for-linus"),
Head(RepoURL("viro/vfs.git"), "fixes"),
Head(RepoURL("jeyu/linux.git"), "modules-next"),
+ Head(RepoURL("joro/iommu.git"), "next"),
Head(RepoURL("nvdimm/nvdimm.git"), "libnvdimm-for-next"),
Head(RepoURL("nvdimm/nvdimm.git"), "libnvdimm-fixes"),
Head(RepoURL("djbw/nvdimm.git"), "libnvdimm-pending"),
Head(RepoURL("git://git.linux-nfs.org/projects/anna/linux-nfs.git"), "linux-next"),
Head(RepoURL("acme/linux.git"), "perf/core"),
Head(RepoURL("will/linux.git"), "for-joerg/arm-smmu/updates"),
- Head(RepoURL("joro/iommu.git"), "next"),
Head(RepoURL("herbert/crypto-2.6.git"), "master"),
+ Head(RepoURL("rafael/linux-pm.git")),
Head(RepoURL("git://git.cmpxchg.org/linux-mmots.git"), "master"),
Head(RepoURL("git://git.linux-nfs.org/~bfields/linux.git"), "nfsd-next"),
)
diff --git a/scripts/git_sort/merge_tool.py b/scripts/git_sort/merge_tool.py
index 60433fcbba..933fe3d204 100755
--- a/scripts/git_sort/merge_tool.py
+++ b/scripts/git_sort/merge_tool.py
@@ -94,13 +94,13 @@ if __name__ == "__main__":
inside = [line for line in local[1] if not line.strip() in filter_set]
try:
input_entries = lib.parse_inside(index, inside, False)
+ for name in added - local[3] | moved:
+ entry = lib.InputEntry("\t%s\n" % (name,))
+ entry.from_patch(index, name, lib.git_sort.oot, True)
+ input_entries.append(entry)
except exc.KSError as err:
print("Error: %s" % (err,), file=sys.stderr)
sys.exit(1)
- for name in added - local[3] | moved:
- entry = lib.InputEntry("\t%s\n" % (name,))
- entry.from_patch(index, name, lib.git_sort.oot, True)
- input_entries.append(entry)
try:
sorted_entries = lib.series_sort(index, input_entries)
diff --git a/scripts/git_sort/series_sort.py b/scripts/git_sort/series_sort.py
index 444a24d0e7..7fb19b833e 100755
--- a/scripts/git_sort/series_sort.py
+++ b/scripts/git_sort/series_sort.py
@@ -67,6 +67,9 @@ if __name__ == "__main__":
repo_path = lib.repo_path()
repo = pygit2.Repository(repo_path)
index = git_sort.SortIndex(repo)
+ if git_sort.remotes[0] not in index.repo_heads:
+ print("WARNING: Did not find a remote fetching from \"%s\" in LINUX_GIT remotes." %
+ (git_sort.remotes[0].repo_url.url,))
filter_mode = False
if args.series is None:
diff --git a/scripts/install-git-hooks b/scripts/install-git-hooks
index 0c129b09ee..69bebc942f 100755
--- a/scripts/install-git-hooks
+++ b/scripts/install-git-hooks
@@ -72,8 +72,49 @@ is_eq()
test "$1" -ef "$2" || cmp -s "$1" "$2"
}
+clean_attributes()
+{
+ # Previous versions of this file wrote attributes meant to be distributed
+ # with the repository into $GIT_DIR/info/attributes rather than
+ # .gitattributes. In order to avoid the former potentially overriding the
+ # latter, remove them.
+ # If you intentionally want to override these attributes with these values,
+ # make sure that the line in your "attributes" file differs, for example,
+ # by adding some leading or trailing whitespace to the line.
+ if [ -e "$GIT_DIR"/info/attributes ]; then
+ sed -i -e '
+ /^\*\.changes merge=rpm-changes$/ d
+ /^symsets-\*\.tar\.gz diff=symsets$/ d
+ ' "$GIT_DIR"/info/attributes
+ fi
+}
+
+clean_config()
+{
+ # Previous versions of this file set configuration values meant to be
+ # distributed with the repository into the repository-specific
+ # configuration file (.git/config). Currently, configuration values are set
+ # in a versioned file (extra-gitconfig) which is included from the
+ # repository-specific config. Check if the old scheme is in place and
+ # update it.
+ if ! git config --local --get "include.path" >/dev/null || \
+ ! git config --local --get-all "include.path" | \
+ grep -q "../extra-gitconfig"; then
+ if git config --local --get "merge.rpm-changes.name" >/dev/null; then
+ git config --local --remove_section "merge.rpm-changes"
+ fi
+ if git config --local --get "diff.symsets.textconv" >/dev/null; then
+ git config --local --remove_section "diff.symsets"
+ fi
+ git config --add "include.path" "../extra-gitconfig"
+ fi
+}
+
check_scripts()
{
+ clean_attributes
+ clean_config
+
test -x "$GIT_DIR"/hooks/pre-commit && \
is_eq "$GIT_DIR"/hooks/kernel-source-pre-commit scripts/git-pre-commit
}
@@ -96,31 +137,6 @@ install_scripts()
ln -sf "$dir"/git-pre-commit "$GIT_DIR"/hooks/kernel-source-pre-commit
}
-set_attribute()
-{
- local patten=$1 attribute=$2
-
- if ! grep -qs "$attribute" "$GIT_DIR"/info/attributes; then
- mkdir -p "$GIT_DIR"/info
- echo "$patten $attribute" >>"$GIT_DIR"/info/attributes
- fi
-
-}
-
-install_changes_merger()
-{
- git config merge.rpm-changes.name "*.changes merge driver"
- git config merge.rpm-changes.driver "scripts/rpm-changes-merge.pl %A %O %B"
- set_attribute '*.changes' 'merge=rpm-changes'
-}
-
-install_symsets_textconv()
-{
- git config diff.symsets.textconv scripts/list-symsets
- set_attribute 'symsets-*.tar.gz' 'diff=symsets'
-}
-
-
case "$1" in
--check)
check_snippet && check_scripts
@@ -130,10 +146,8 @@ case "$1" in
echo "Installing git commit hooks."
install_snippet
install_scripts
- echo "Installing kernel-source.changes merge driver."
- install_changes_merger
- echo "Installing symsets diff viewer."
- install_symsets_textconv
+ echo "Installing git config include directive."
+ clean_config
;;
*)
echo "Usage: $0 [--check]" >&2
diff --git a/scripts/run_oldconfig.sh b/scripts/run_oldconfig.sh
index fb49596553..c5d4f532f5 100755
--- a/scripts/run_oldconfig.sh
+++ b/scripts/run_oldconfig.sh
@@ -400,6 +400,9 @@ for config in $config_files; do
armv*/*)
MAKE_ARGS="ARCH=arm"
;;
+ riscv*/*)
+ MAKE_ARGS="ARCH=riscv"
+ ;;
*/um)
MAKE_ARGS="ARCH=um SUBARCH=$cpu_arch"
;;
diff --git a/scripts/sequence-patch.sh b/scripts/sequence-patch.sh
index 8ecbf4a61b..3578d3e6ae 100755
--- a/scripts/sequence-patch.sh
+++ b/scripts/sequence-patch.sh
@@ -210,7 +210,7 @@ if $have_arch_patches; then
else
arch_opt=""
fi
-options=`getopt -o qvd:F: --long quilt,no-quilt,$arch_opt,symbol:,dir:,combine,fast,rapid,vanilla,fuzz,patch-dir:,build-dir:,config:,kabi,ctags,cscope,etags,skip-reverse -- "$@"`
+options=`getopt -o qvd:F: --long quilt,no-quilt,$arch_opt,symbol:,dir:,combine,fast,rapid,vanilla,fuzz:,patch-dir:,build-dir:,config:,kabi,ctags,cscope,etags,skip-reverse -- "$@"`
if [ $? -ne 0 ]
then
diff --git a/scripts/stableids b/scripts/stableids
index c44704959e..2414377d1f 100755
--- a/scripts/stableids
+++ b/scripts/stableids
@@ -6,11 +6,12 @@ use Storable qw(store);
use Term::ANSIColor qw(colored);
if (@ARGV < 2) {
- print "Usage: $0 suse_machine stable_version\n";
+ print "Usage: $0 suse_machine|-d stable_version\n";
exit 1;
}
my $machine = shift;
+my $dump_only = $machine eq '-d';
my $stable_ver = shift;
my $old_version;
my $new_version;
@@ -21,6 +22,7 @@ my %bnc_map = (
'4.1' => '1023711',
'4.4' => '1012382',
'4.12' => '1060662',
+ '5.3' => '1151927',
'other' => '1012628',
);
@@ -44,7 +46,7 @@ my $patchpar = '/dev/shm';
my $patchdir = "patches-$new_version";
my $patchpath = "$patchpar/$patchdir";
my $idsfile = "$patchpath/ids";
-if (!mkdir $patchpath) {
+if (!$dump_only && !mkdir $patchpath) {
die "$patchpath already exists";
}
@@ -56,6 +58,8 @@ my $counter = 1;
my @to_delete;
my $sha_re = qr/[0-9a-f]{40}/;
+print "References: bnc#$bnc $new_version\n" if ($dump_only);
+
foreach my $rev (@revs) {
my ($filename, @commit_log) = $repo->command('show', '--no-patch',
'--format=%f%n%B', $rev);
@@ -89,6 +93,17 @@ foreach my $rev (@revs) {
}
}
+ if ($dump_only) {
+ print "$rev";
+ if (scalar @shas) {
+ print "=", join ' ', @shas;
+ } else {
+ print ' STABLE-ONLY patch: "', $commit_log[0], '"';
+ }
+ print "\n";
+ next;
+ }
+
# better than nothing
if (!scalar @shas) {
push @shas, $rev;
@@ -130,6 +145,8 @@ foreach my $rev (@revs) {
$counter++;
}
+exit 0 if ($dump_only);
+
store(\%ids, $idsfile) or die "cannot write $idsfile";
push @to_delete, $idsfile;
diff --git a/scripts/supported-conf-fixup b/scripts/supported-conf-fixup
index 52511d02ab..e7c7144090 100755
--- a/scripts/supported-conf-fixup
+++ b/scripts/supported-conf-fixup
@@ -106,7 +106,7 @@ sub gather_path
if ($file_or_dir eq "modules.builtin") {
open(BUILTIN, "<$file_or_dir") or die;
while (<BUILTIN>) {
- next unless m,^kernel/(.*)/([^/]+)\.ko$,;
+ next unless m,^kernel/(.*)/([^/]+)\.ko(\.xz)?$,;
$path = $1;
$module = $2;
@@ -124,7 +124,7 @@ sub gather_path
return unless $module_path =~ s,^(.*?/)?kernel/,,;
if (-f $file_or_dir) {
- return unless $module_path =~ m,^(.*)/([^/]+)\.ko$,;
+ return unless $module_path =~ m,^(.*)/([^/]+)\.ko(\.xz)?$,;
$path = $1;
$module = $2;
@@ -264,7 +264,7 @@ sub check_path
return;
}
- unless ($module_path =~ m,^(.*)/([^/]+)(\.ko)$, ||
+ unless ($module_path =~ m,^(.*)/([^/]+)(\.ko)(\.xz)?$, ||
$module_path =~ m,^(.*)/([^/]+)$,) {
print STDERR "$sup_conf_file: $line: Unparsable module path: $module_path\n";
return;
diff --git a/series.conf b/series.conf
index 94b59d169f..bc766a1afc 100644
--- a/series.conf
+++ b/series.conf
@@ -9405,6 +9405,7 @@
patches.suse/powerpc-dlpar-017-pseries-Check-memory-device-state-before-onl.patch
patches.suse/powerpc-64s-Fix-mce-accounting-for-powernv.patch
patches.suse/powerpc-xive-04-Ensure-active-irqd-when-setting-affinit.patch
+ patches.suse/powerpc-mm-Properly-invalidate-when-setting-process-.patch
patches.suse/powerpc-perf-Update-default-sdar_mode-value-for-power9.patch
patches.suse/powerpc-perf-Factor-out-PPMU_ONLY_COUNT_RUN-check-code-from-power8.patch
patches.suse/powerpc-perf-Add-PM_LD_MISS_L1-and-PM_BR_2PATH-to-po.patch
@@ -18008,6 +18009,7 @@
patches.suse/sctp-use-right-member-as-the-param-of-list_for_each_.patch
patches.suse/vxlan-use-__be32-type-for-the-param-vni-in-__vxlan_f.patch
patches.suse/net-sched-cbq-create-block-for-q-link.block.patch
+ patches.suse/btrfs-bail-out-gracefully-rather-than-bug_on.patch
patches.suse/btrfs-move-definition-of-the-function-btrfs_find_new.patch
patches.suse/btrfs-fix-reported-number-of-inode-blocks-after-buff.patch
patches.suse/0011-btrfs-tree-checker-Fix-false-panic-for-sanity-test.patch
@@ -23744,7 +23746,7 @@
patches.suse/0074-PCI-exynos-Remove-deprecated-PHY-initialization-code.patch
patches.suse/0075-PCI-dwc-artpec6-Fix-return-value-check-in-artpec6_ad.patch
patches.suse/0076-PCI-qcom-Account-for-const-type-of-of_device_id.data.patch
- patches.suse/0077-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch
+ patches.suse/0001-PCI-dra7xx-Fix-legacy-INTD-IRQ-handling.patch
patches.suse/0078-PCI-dra7xx-Iterate-over-INTx-status-bits.patch
patches.suse/PCI-iproc-Fix-NULL-pointer-dereference-for-BCMA
patches.suse/PCI-exynos-Fix-a-potential-init_clk_resources-NULL-p
@@ -25183,6 +25185,7 @@
patches.suse/bnxt_en-Return-standard-Linux-error-codes-for-hwrm-f.patch
patches.suse/bnxt_en-close-open-NIC-only-when-the-interface-is-in.patch
patches.suse/bnxt_en-Check-valid-VNIC-ID-in-bnxt_hwrm_vnic_set_tp.patch
+ patches.suse/sock_diag-request-_diag-module-only-when-the-family-.patch
patches.suse/can-m_can-change-comparison-to-bitshift-when-dealing
patches.suse/can-ifi-Check-core-revision-upon-probe
patches.suse/can-ifi-Repair-the-error-handling
@@ -33548,6 +33551,7 @@
patches.suse/powerpc-lib-Fix-feature-fixup-test-of-external-branc.patch
patches.suse/powerpc-lib-Fix-the-feature-fixup-tests-to-actually-.patch
patches.suse/powerpc-kvm-Switch-kvm-pmd-allocator-to-custom-alloc.patch
+ patches.suse/powerpc-mm-book3s64-Move-book3s64-code-to-pgtable-bo.patch
patches.suse/Revert-powerpc-64-Fix-checksum-folding-in-csum_add.patch
patches.suse/powerpc-powernv-Fix-opal_event_shutdown-called-with-.patch
patches.suse/powerpc-perf-Fix-memory-allocation-for-core-imc-base.patch
@@ -39441,6 +39445,7 @@
patches.suse/KVM-PPC-Book3S-HV-Read-kvm-arch.emul_smt_mode-under-.patch
patches.suse/kvm-s390-add-etoken-support-for-guests.patch
patches.suse/msft-hv-1746-KVM-x86-ensure-all-MSRs-can-always-be-KVM_GET-SET_MS.patch
+ patches.suse/kvm-mmu-drop-vcpu-param-in-gpte_access
patches.suse/msft-hv-1747-X86-Hyper-V-Add-flush-HvFlushGuestPhysicalAddressSpa.patch
patches.suse/msft-hv-1748-X86-Hyper-V-Add-hyperv_nested_flush_guest_mapping-ft.patch
patches.suse/kvm-nvmx-fix-fault-vector-for-vmx-operation-at-cpl-0
@@ -39728,6 +39733,9 @@
patches.suse/0001-cifs-check-kmalloc-before-use.patch
patches.suse/01-cifs-update-internal-module-version-number-for-cifs-ko-to-2-12.patch
patches.suse/0238-bcache-release-dc-writeback_lock-properly-in-bch_wri.patch
+ patches.suse/blk-wbt-move-disable-check-into-get_limit.patch
+ patches.suse/blk-wbt-use-wq_has_sleeper-for-wq-active-check.patch
+ patches.suse/blk-wbt-fix-has-sleeper-queueing-check.patch
patches.suse/scripts-modpost-check-memory-allocation-results.patch
patches.suse/reset-imx7-Fix-always-writing-bits-as-0.patch
patches.suse/libnvdimm-introduce-locked-dimm-capacity-support.patch
@@ -39839,6 +39847,8 @@
patches.suse/hwmon-adt7475-Make-adt7475_read_word-return-errors.patch
patches.suse/hwmon-nct6775-Fix-potential-Spectre-v1.patch
patches.suse/mmc-block-fix-unsupported-parallel-dispatch-of-requests.patch
+ patches.suse/blk-wbt-abstract-out-end-IO-completion-handler.patch
+ patches.suse/blk-wbt-improve-waking-of-tasks.patch
patches.suse/0001-xen-blkback-don-t-keep-persistent-grants-too-long.patch
patches.suse/0003-xen-blkfront-cleanup-stale-persistent-grants.patch
patches.suse/0004-xen-blkfront-reorder-tests-in-xlblk_init.patch
@@ -40024,6 +40034,7 @@
patches.suse/x86-microcode-make-sure-boot_cpu_data-microcode-is-up-to-date
patches.suse/x86-microcode-update-the-new-microcode-revision-unconditionally
patches.suse/x86-process-don-t-mix-user-kernel-regs-in-64bit-_show_regs
+ patches.suse/x86-mm-use-write_once-when-setting-ptes.patch
patches.suse/RDMA-ucma-check-fd-type-in-ucma_migrate_id.patch
patches.suse/IB-core-Release-object-lock-if-destroy-failed.patch
patches.suse/iw_cxgb4-only-allow-1-flush-on-user-qps.patch
@@ -42066,6 +42077,7 @@
patches.suse/kvm-s390-fix-locking-for-crypto-setting-error-path.patch
patches.suse/kvm-nvmx-clear-reserved-bits-of-db-exit-qualification
patches.suse/kvm-nvmx-restore-host-state-in-nested_vmx_vmexit-for-vmfail
+ patches.suse/kvm-x86-adjust-kvm_mmu_page-member-to-save-8-bytes
patches.suse/msft-hv-1786-KVM-x86-hyperv-enforce-vp_index-KVM_MAX_VCPUS.patch
patches.suse/msft-hv-1787-KVM-x86-hyperv-optimize-all-cpus-case-in-kvm_hv_flus.patch
patches.suse/msft-hv-1788-KVM-x86-hyperv-consistently-use-hv_vcpu-for-struct-k.patch
@@ -43019,6 +43031,7 @@
patches.suse/net-phy-realtek-fix-RTL8201F-sysfs-name.patch
patches.suse/bonding-802.3ad-fix-link_failure_count-tracking.patch
patches.suse/net-core-netpoll-Enable-netconsole-IPv6-link-local-a.patch
+ patches.suse/sock_diag-fix-autoloading-of-the-raw_diag-module.patch
patches.suse/netfilter-ipv6-fix-oops-when-defragmenting-locally-g.patch
patches.suse/netfilter-conntrack-fix-calculation-of-next-bucket-n.patch
patches.suse/HID-hiddev-fix-potential-Spectre-v1.patch
@@ -44484,6 +44497,7 @@
patches.suse/ext4-force-inode-writes-when-nfsd-calls-commit_metad.patch
patches.suse/ext4-check-for-shutdown-and-r-o-file-system-in-ext4_.patch
patches.suse/dasd-remove-dead-code.patch
+ patches.suse/block-add-io-timeout-to-sysfs.patch
patches.suse/nvme-consolidate-memset-calls-in-the-nvme_setup_cmd-.patch
patches.suse/nvme-add-a-numa_node-field-to-struct-nvme_ctrl.patch
patches.suse/nvme-introduce-ctrl-attributes-enumeration.patch
@@ -45365,7 +45379,7 @@
patches.suse/platform-x86-Fix-unmet-dependency-warning-for-SAMSUN.patch
patches.suse/RDMA-mlx5-Fix-check-for-supported-user-flags-when-cr.patch
patches.suse/IB-mlx4-Fix-using-wrong-function-to-destroy-sqp-AHs-.patch
- patches.suse/IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch
+ patches.suse/0001-IB-hfi1-Remove-overly-conservative-VM_EXEC-flag-chec.patch
patches.suse/IB-hfi1-Add-limit-test-for-RC-UC-send-via-loopback.patch
patches.suse/RDMA-hns-Update-the-kernel-header-file-of-hns.patch
patches.suse/RDMA-umem-Add-missing-initialization-of-owning_mm.patch
@@ -47437,6 +47451,7 @@
patches.suse/Revert-ide-unexport-DISK_EVENT_MEDIA_CHANGE-for-i.patch
patches.suse/Revert-block-unexport-DISK_EVENT_MEDIA_CHANGE-for.patch
patches.suse/block-check_events-don-t-bother-with-events-if-un.patch
+ patches.suse/block-don-t-show-io_timeout-if-driver-has-no-timeout.patch
patches.suse/block-fix-use-after-free-on-gendisk.patch
patches.suse/md-raid-raid5-preserve-the-writeback-action-after-th.patch
patches.suse/0001-bcache-fix-crashes-stopping-bcache-device-before-rea.patch
@@ -48157,6 +48172,7 @@
patches.suse/IB-hfi1-Add-selected-Rcv-counters.patch
patches.suse/RDMA-rxe-Consider-skb-reserve-space-based-on-netdev-.patch
patches.suse/IB-hfi1-Fix-WQ_MEM_RECLAIM-warning.patch
+ patches.suse/ipoib-Do-not-overreact-to-SM-LID-change-even.patch
patches.suse/RDMA-ipoib-Allow-user-space-differentiate-between-va.patch
patches.suse/NFS-Don-t-interrupt-file-writeout-due-to-fatal-error.patch
patches.suse/NFS-make-nfs_match_client-killable.patch
@@ -48276,6 +48292,8 @@
patches.suse/virtio-s390-dma-support-for-virtio-ccw
patches.suse/userfaultfd-use-RCU-to-free-the-task-struct-when-for.patch
patches.suse/mm-mincore-c-make-mincore-more-conservative.patch
+ patches.suse/powerpc-mm-radix-mark-__radix__flush_tlb_range_psize.patch
+ patches.suse/powerpc-mm-radix-mark-as-__tlbie_pid-and-friends-as_.patch
patches.suse/include-linux-bitops.h-sanitize-rotate-primitives.patch
patches.suse/rapidio-fix-a-NULL-pointer-dereference-when-create_w.patch
patches.suse/IB-mlx5-Verify-DEVX-general-object-type-correctly.patch
@@ -48316,6 +48334,7 @@
patches.suse/configfs-fix-possible-use-after-free-in-configfs_reg.patch
patches.suse/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch
patches.suse/media-atmel-atmel-isc-fix-INIT_WORK-misplacement.patch
+ patches.suse/0001-media-atmel-atmel-isc-fix-asd-memory-allocation.patch
patches.suse/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch
patches.suse/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch
patches.suse/dm-zoned-Silence-a-static-checker-warning.patch
@@ -48460,6 +48479,7 @@
patches.suse/llc-fix-skb-leak-in-llc_build_and_send_ui_pkt.patch
patches.suse/net-phy-marvell10g-report-if-the-PHY-fails-to-boot-f.patch
patches.suse/net-core-support-XDP-generic-on-stacked-devices.patch
+ patches.suse/net-mlx5-Fix-error-handling-in-mlx5_load.patch
patches.suse/net-mlx5-Avoid-double-free-in-fs-init-error-unwindin.patch
patches.suse/net-mlx5-Allocate-root-ns-memory-using-kzalloc-to-ma.patch
patches.suse/net-dsa-mv88e6xxx-fix-handling-of-upper-half-of-STAT.patch
@@ -48988,6 +49008,10 @@
patches.suse/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
patches.suse/net-ena-remove-inline-keyword-from-functions-in-.c.patch
patches.suse/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
+ patches.suse/qed-iWARP-Use-READ_ONCE-and-smp_store_release-to-acc.patch
+ patches.suse/qed-iWARP-fix-uninitialized-callback.patch
+ patches.suse/qed-iWARP-Fix-tc-for-MPA-ll2-connection.patch
+ patches.suse/qed-iWARP-Fix-default-window-size-to-be-based-on-chi.patch
patches.suse/net-hns3-delay-setting-of-reset-level-for-hw-errors-.patch
patches.suse/net-hns3-fix-avoid-unnecessary-resetting-for-the-H-W.patch
patches.suse/net-hns3-process-H-W-errors-occurred-before-HNS-dev-.patch
@@ -49209,12 +49233,18 @@
patches.suse/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch
patches.suse/9p-pass-the-correct-prototype-to-read_cache_page.patch
patches.suse/kvm-svm-avic-do-not-send-avic-doorbell-to-self
+ patches.suse/kvm-convert-kvm_lock-to-a-mutex
patches.suse/kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-entry
patches.suse/kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat-with-bad-value
patches.suse/kvm-nvmx-use-adjusted-pin-controls-for-vmcs02
patches.suse/kvm-vmx-check-cpuid-before-allowing-read-write-of-ia32_xss
patches.suse/kvm-nvmx-allow-setting-the-vmfunc-controls-msr
patches.suse/kvm-nvmx-remove-unnecessary-sync_roots-from-handle_invept
+ patches.suse/kvm-x86-do-not-release-the-page-inside-mmu_set_spte
+ patches.suse/kvm-x86-make-fnamefetch-and-_direct_map-more-similar
+ patches.suse/kvm-x86-remove-now-unneeded-hugepage-gfn-adjustment
+ patches.suse/kvm-x86-change-kvm_mmu_page_get_gfn-bug_on-to-warn_on
+ patches.suse/kvm-x86-add-tracepoints-around-_direct_map-and-fnamefetch
patches.suse/kvm-x86-unconditionally-enable-irqs-in-guest-context
patches.suse/s390-cpumf-add-extended-counter-set-definitions-for-model-8561-and-8562
patches.suse/9p-virtio-Add-cleanup-path-in-p9_virtio_init.patch
@@ -49224,6 +49254,7 @@
patches.suse/dm-bufio-fix-deadlock-with-loop-device.patch
patches.suse/net-mlx5e-Rx-Fix-checksum-calculation-for-new-hardwa.patch
patches.suse/net-mlx5e-IPoIB-Add-error-path-in-mlx5_rdma_setup_rn.patch
+ patches.suse/cxgb4-reduce-kernel-stack-usage-in-cudbg_collect_mem.patch
patches.suse/sunhv-Fix-device-naming-inconsistency-between-sunhv_.patch
patches.suse/powerpc-pseries-dlpar-Fix-a-missing-check-in-dlpar_p.patch
patches.suse/powerpc-pseries-Fix-xive-off-command-line.patch
@@ -49233,7 +49264,10 @@
patches.suse/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
patches.suse/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch
patches.suse/powerpc-rtas-retry-when-cpu-offline-races-with-suspe.patch
+ patches.suse/powerpc-64s-Rename-PPC_INVALIDATE_ERAT-to-PPC_ISA_3_.patch
+ patches.suse/powerpc-64s-radix-keep-kernel-ERAT-over-local-proces.patch
patches.suse/KVM-PPC-Book3S-HV-Fix-CR0-setting-in-TM-emulation.patch
+ patches.suse/powerpc-mm-mark-more-tlb-functions-as-__always_inlin.patch
patches.suse/powerpc-mm-hash-4k-Don-t-use-64K-page-size-for-vmemm.patch
patches.suse/powerpc-mm-radix-Use-the-right-page-size-for-vmemmap.patch
patches.suse/powerpc-mm-drconf-Use-NUMA_NO_NODE-on-failures-inste.patch
@@ -49314,6 +49348,7 @@
patches.suse/RDMA-hns-Bugfix-for-calculating-qp-buffer-size.patch
patches.suse/RDMA-hns-Use-pK-format-pointer-print.patch
patches.suse/RDMA-hns-Fixs-hw-access-invalid-dma-memory-error.patch
+ patches.suse/IB-mlx5-Report-correctly-tag-matching-rendezvous-cap.patch
patches.suse/PCI-Return-error-if-cannot-probe-VF.patch
patches.suse/PCI-Always-allow-probing-with-driver_override.patch
patches.suse/PCI-P2PDMA-Fix-missing-check-for-dma_virt_ops.patch
@@ -49425,6 +49460,7 @@
patches.suse/net-bcmgenet-use-promisc-for-unsupported-filters.patch
patches.suse/xdp-fix-possible-cq-entry-leak.patch
patches.suse/tcp-fix-tcp_set_congestion_control-use-from-bpf-hook.patch
+ patches.suse/0001-xen-pv-Fix-a-boot-up-hang-revealed-by-int3-self-test.patch
patches.suse/0001-xen-let-alloc_xenballooned_pages-fail-if-not-enough-.patch
patches.suse/crypto-crypto4xx-fix-a-potential-double-free-in-ppc4.patch
patches.suse/crypto-ccp-memset-structure-fields-to-zero-before-re.patch
@@ -49679,10 +49715,12 @@
patches.suse/tools-bpftool-fix-error-message-prog-object.patch
patches.suse/sctp-fix-the-transport-error_count-check.patch
patches.suse/ibmveth-Convert-multicast-list-size-for-little-endia.patch
+ patches.suse/net-mlx4_en-fix-a-memory-leak-bug.patch
patches.suse/liquidio-add-cleanup-in-octeon_setup_iq.patch
patches.suse/net-packet-fix-race-in-tpacket_snd.patch
patches.suse/lan78xx-Fix-memory-leaks.patch
patches.suse/Bluetooth-btqca-Add-a-short-delay-before-downloading.patch
+ patches.suse/bnx2x-Fix-VF-s-VLAN-reconfiguration-in-reload.patch
patches.suse/cx82310_eth-fix-a-memory-leak-bug.patch
patches.suse/bnxt_en-Fix-VNIC-clearing-logic-for-57500-chips.patch
patches.suse/bnxt_en-Improve-RX-doorbell-sequence.patch
@@ -49716,6 +49754,8 @@
patches.suse/dm-btree-fix-order-of-block-initialization-in-btree_.patch
patches.suse/dm-space-map-metadata-fix-missing-store-of-apply_bop.patch
patches.suse/dm-table-fix-invalid-memory-accesses-with-too-high-s.patch
+ patches.suse/IB-mlx5-Consolidate-use_umr-checks-into-single-funct.patch
+ patches.suse/IB-mlx5-Fix-MR-re-registration-flow-to-use-UMR-prope.patch
patches.suse/drm-nouveau-Don-t-retry-infinitely-when-receiving-no.patch
patches.suse/xfs-fix-missing-ILOCK-unlock-when-xfs_setattr_nonsiz.patch
patches.suse/scsi-qla2xxx-Fix-gnl.l-memory-leak-on-adapter-init-f.patch
@@ -49756,10 +49796,16 @@
patches.suse/ftrace-check-for-successful-allocation-of-hash.patch
patches.suse/i2c-designware-Synchronize-IRQs-when-unregistering-s.patch
patches.suse/i2c-piix4-Fix-port-selection-for-AMD-Family-16h-Mode.patch
+ patches.suse/net-fix-skb-use-after-free-in-netpoll.patch
+ patches.suse/tcp-remove-empty-skb-from-write-queue-in-error-cases.patch
+ patches.suse/mld-fix-memory-leak-in-mld_del_delrec.patch
patches.suse/ibmvnic-Do-not-process-reset-during-or-after-device-.patch
+ patches.suse/net-sched-act_sample-fix-psample-group-handling-on-o.patch
+ patches.suse/tcp-inherit-timestamp-on-mtu-probe.patch
patches.suse/sky2-Disable-MSI-on-yet-another-ASUS-boards-P6Xxxx.patch
patches.suse/mac80211-Don-t-memset-RXCB-prior-to-PAE-intercept.patch
patches.suse/mac80211-Correctly-set-noencrypt-for-PAE-frames.patch
+ patches.suse/net-stmmac-dwmac-rk-Don-t-fail-if-phy-regulator-is-a.patch
patches.suse/batman-adv-Only-read-OGM-tvlv_len-after-buffer-len-c.patch
patches.suse/batman-adv-Only-read-OGM2-tvlv_len-after-buffer-len-.patch
patches.suse/usb-chipidea-udc-don-t-do-hardware-access-if-gadget-.patch
@@ -49790,12 +49836,24 @@
patches.suse/vhost-make-sure-log_num-in_num.patch
patches.suse/Btrfs-fix-assertion-failure-during-fsync-and-use-of-.patch
patches.suse/0001-drm-i915-Restore-relaxed-padding-OCL_OOB_SUPPRES_ENA.patch
+ patches.suse/sctp-use-transport-pf_retrans-in-sctp_do_8_2_transpo.patch
patches.suse/Revert-Bluetooth-validate-BLE-connection-interval-up.patch
+ patches.suse/tipc-add-NULL-pointer-check-before-calling-kfree_rcu.patch
patches.suse/mwifiex-Fix-three-heap-overflow-at-parsing-element.patch
patches.suse/net-ibmvnic-free-reset-work-of-removed-device-from-q.patch
patches.suse/isdn-capi-check-message-length-in-capi_write.patch
+ patches.suse/net-gso-Fix-skb_segment-splat-when-splitting-gso_siz.patch
patches.suse/net-ibmvnic-Fix-missing-in-__ibmvnic_reset.patch
+ patches.suse/bridge-mdb-remove-wrong-use-of-NLM_F_MULTI.patch
+ patches.suse/sch_hhf-ensure-quantum-and-hhf_non_hh_weight-are-non.patch
+ patches.suse/tcp-fix-tcp_ecn_withdraw_cwr-to-clear-TCP_ECN_QUEUE_.patch
+ patches.suse/ixgbe-Prevent-u8-wrapping-of-ITR-value-to-something-.patch
patches.suse/tun-fix-use-after-free-when-register-netdev-failed.patch
+ patches.suse/ipv6-Fix-the-link-time-qualifier-of-ping_v6_proc_exi.patch
+ patches.suse/net-Fix-null-de-reference-of-device-refcount.patch
+ patches.suse/ixgbe-Fix-secpath-usage-for-IPsec-TX-offload.patch
+ patches.suse/sctp-Fix-the-link-time-qualifier-of-sctp_ctrlsock_ex.patch
+ patches.suse/cdc_ether-fix-rndis-support-for-Mediatek-based-smart.patch
patches.suse/tpm_tis_core-Set-TPM_CHIP_FLAG_IRQ-before-probing-fo.patch
patches.suse/edac-amd64-decode-syndrome-before-translating-address.patch
patches.suse/hwmon-lm75-Fix-write-operations-for-negative-tempera.patch
@@ -49806,6 +49864,7 @@
patches.suse/iommu-iova-avoid-false-sharing-on-fq_timer_on
patches.suse/iommu-dma-fix-for-dereferencing-before-null-checking
patches.suse/qla2xxx-remove-SGI-SN2-support.patch
+ patches.suse/objtool-clobber-user-cflags-variable.patch
patches.suse/platform-x86-pmc_atom-Add-Siemens-SIMATIC-IPC227E-to.patch
patches.suse/alarmtimer-Use-EOPNOTSUPP-instead-of-ENOTSUPP.patch
patches.suse/blk-mq-introduce-blk_mq_request_completed.patch
@@ -49851,6 +49910,7 @@
patches.suse/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch
patches.suse/mic-avoid-statically-declaring-a-struct-device.patch
patches.suse/phy-renesas-rcar-gen3-usb2-Disable-clearing-VBUS-in-.patch
+ patches.suse/dev-mem-Bail-out-upon-SIGKILL.patch
patches.suse/crypto-ccp-Reduce-maximum-stack-usage.patch
patches.suse/crypto-qat-Silence-smp_processor_id-warning.patch
patches.suse/crypto-caam-fix-concurrency-issue-in-givencrypt-desc.patch
@@ -49859,11 +49919,13 @@
patches.suse/crypto-skcipher-Unmap-pages-after-an-external-error.patch
patches.suse/crypto-cavium-zip-Add-missing-single_release.patch
patches.suse/bnxt_en-Add-PCI-IDs-for-57500-series-NPAR-devices.patch
+ patches.suse/cxgb4-smt-Add-lock-for-atomic_dec_and_test.patch
patches.suse/libertas_tf-Use-correct-channel-range-in-lbtf_geo_in.patch
patches.suse/Revert-mwifiex-fix-system-hang-problem-after-resume.patch
patches.suse/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch
patches.suse/xsk-avoid-store-tearing-when-assigning-queues.patch
patches.suse/xsk-avoid-store-tearing-when-assigning-umem.patch
+ patches.suse/0001-rtlwifi-rtl8192cu-Fix-value-set-in-descriptor.patch
patches.suse/bcma-fix-incorrect-update-of-BCMA_CORE_PCI_MDIO_DATA.patch
patches.suse/rtlwifi-Fix-file-release-memory-leak.patch
patches.suse/i40e-Add-support-for-X710-device.patch
@@ -49877,6 +49939,7 @@
patches.suse/0001-video-ssd1307fb-Start-page-range-at-page_offset.patch
patches.suse/dma-buf-sw_sync-Synchronize-signal-vs-syncpt-free.patch
patches.suse/0001-drm-imx-Drop-unused-imx-ipuv3-crtc.o-build.patch
+ patches.suse/drm-amdgpu-si-fix-asic-tests.patch
patches.suse/0001-drm-i915-gvt-update-vgpu-workload-head-pointer-corre.patch
patches.suse/0002-drm-nouveau-kms-nv50-Don-t-create-MSTMs-for-eDP-conn.patch
patches.suse/powerpc-pseries-Fix-cpu_hotplug_lock-acquisition-in-.patch
@@ -49888,7 +49951,11 @@
patches.suse/powerpc-64s-radix-Fix-memory-hotplug-section-page-ta.patch
patches.suse/powerpc-64s-radix-Fix-memory-hot-unplug-page-table-s.patch
patches.suse/powerpc-rtas-use-device-model-APIs-and-serialization.patch
+ patches.suse/powerpc-rtas-allow-rescheduling-while-changing-cpu-s.patch
+ patches.suse/powerpc-pseries-mobility-use-cond_resched-when-updat.patch
patches.suse/powerpc-64s-support-nospectre_v2-cmdline-option.patch
+ patches.suse/powerpc-64s-radix-tidy-up-TLB-flushing-code.patch
+ patches.suse/powerpc-64s-pseries-radix-flush-translations-before-.patch
patches.suse/powerpc-pseries-correctly-track-irq-state-in-default.patch
patches.suse/powerpc-xive-Fix-bogus-error-code-returned-by-OPAL.patch
patches.suse/powerpc-dump-kernel-log-before-carrying-out-fadump-o.patch
@@ -49896,6 +49963,8 @@
patches.suse/clk-sunxi-ng-v3s-add-missing-clock-slices-for-MMC2-m.patch
patches.suse/clk-at91-fix-update-bit-maps-on-CFG_MOR-write.patch
patches.suse/printk-Do-not-lose-last-line-in-kmsg-buffer-dump.patch
+ patches.suse/RDMA-Fix-goto-target-to-release-the-allocated-memory.patch
+ patches.suse/RDMA-bnxt_re-Fix-spelling-mistake-missin_resp-missin.patch
patches.suse/scsi-qla2xxx-Remove-unnecessary-null-check.patch
patches.suse/scsi-qla2xxx-Replace-vmalloc-memset-with-vzalloc.patch
patches.suse/scsi-cxlflash-Mark-expected-switch-fall-throughs.patch
@@ -50047,38 +50116,68 @@
patches.suse/quota-fix-wrong-condition-in-is_quota_modification.patch
patches.suse/power-supply-Init-device-wakeup-after-device_add.patch
patches.suse/power-reset-gpio-restart-Fix-typo-when-gpio-reset-is.patch
+ patches.suse/0001-crypto-talitos-fix-missing-break-in-switch-statement.patch
+ patches.suse/hwrng-core-don-t-wait-on-add_early_randomness.patch
patches.suse/livepatch-nullify-obj-mod-in-klp_module_coming-s-error-path.patch
patches.suse/PCI-Add-Amazon-s-Annapurna-Labs-vendor-ID.patch
patches.suse/PCI-Add-ACS-quirk-for-Amazon-Annapurna-Labs-root-por.patch
patches.suse/PCI-VPD-Prevent-VPD-access-for-Amazon-s-Annapurna-La.patch
patches.suse/PCI-Add-quirk-to-disable-MSI-X-support-for-Amazon-s-.patch
patches.suse/suse-hv-PCI-hv-Detect-and-fix-Hyper-V-PCI-domain-number-coll.patch
+ patches.suse/msft-hv-1947-PCI-hv-Use-bytes-4-and-5-from-instance-ID-as-the-PCI.patch
+ patches.suse/ceph-fix-directories-inode-i_blkbits-initialization.patch
+ patches.suse/ceph-update-the-mtime-when-truncating-up.patch
+ patches.suse/ceph-reconnect-connection-if-session-hang-in-opening-state.patch
patches.suse/0003-drm-amd-display-Restore-backlight-brightness-after-s.patch
+ patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch
+ patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch
+ patches.suse/KVM-PPC-Book3S-HV-use-smp_mb-when-setting-clearing-h.patch
patches.suse/powerpc-pseries-Read-TLB-Block-Invalidate-Characteri.patch
patches.suse/powerpc-pseries-Call-H_BLOCK_REMOVE-when-supported.patch
patches.suse/powerpc-book3s64-mm-Don-t-do-tlbie-fixup-for-some-ha.patch
patches.suse/powerpc-book3s64-radix-Rename-CPU_FTR_P9_TLBIE_BUG-f.patch
patches.suse/powerpc-mm-Fixup-tlbie-vs-mtpidr-mtlpidr-ordering-is.patch
+ patches.suse/nfc-enforce-cap_net_raw-for-raw-sockets.patch
patches.suse/net-ibmvnic-unlock-rtnl_lock-in-reset-so-linkwatch_e.patch
patches.suse/net-ibmvnic-prevent-more-than-one-thread-from-runnin.patch
patches.suse/ppp-Fix-memory-leak-in-ppp_write.patch
+ patches.suse/net-mlx5-Add-device-ID-of-upcoming-BlueField-2.patch
+ patches.suse/cxgb4-Signedness-bug-in-init_one.patch
patches.suse/libnvdimm-altmap-track-namespace-boundaries-in-altmap.patch
+ patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch
patches.suse/0001-btrfs-relocation-fix-use-after-free-on-dead-relocati.patch
patches.suse/0001-btrfs-qgroup-Fix-the-wrong-target-io_tree-when-freei.patch
patches.suse/0002-btrfs-qgroup-Fix-reserved-data-space-leak-if-we-have.patch
patches.suse/0001-xen-xenbus-fix-self-deadlock-after-killing-user-proc.patch
+ patches.suse/kvm-x86-powerpc-do-not-allow-clearing-largepages-debugfs-entry
patches.suse/0001-xen-netfront-do-not-use-0U-as-error-return-value-for.patch
+ patches.suse/msft-hv-1948-scsi-storvsc-setup-1-1-mapping-between-hardware-queu.patch
patches.suse/scsi-qla2xxx-Silence-fwdump-template-message.patch
patches.suse/scsi-qla2xxx-Fix-unbound-sleep-in-fcport-delete-path.patch
patches.suse/scsi-qla2xxx-Fix-stale-mem-access-on-driver-unload.patch
patches.suse/scsi-qla2xxx-Optimize-NPIV-tear-down-process.patch
patches.suse/scsi-qla2xxx-Fix-N2N-link-reset.patch
patches.suse/scsi-qla2xxx-Fix-N2N-link-up-fail.patch
+ patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch
+ patches.suse/0001-kernel-sysctl.c-do-not-override-max_threads-provided.patch
patches.suse/RDMA-cxgb4-Do-not-dma-memory-off-of-the-stack.patch
+ patches.suse/powerpc-pseries-Remove-confusing-warning-message.patch
+ patches.suse/0001-USB-microtek-fix-info-leak-at-probe.patch
+ patches.suse/0001-USB-adutux-fix-use-after-free-on-disconnect.patch
+ patches.suse/0001-USB-adutux-fix-NULL-derefs-on-disconnect.patch
+ patches.suse/0001-USB-usblcd-fix-I-O-after-disconnect.patch
+ patches.suse/0001-USB-legousbtower-fix-slab-info-leak-at-probe.patch
+ patches.suse/0001-USB-legousbtower-fix-deadlock-on-disconnect.patch
+ patches.suse/0001-USB-legousbtower-fix-potential-NULL-deref-on-disconn.patch
+ patches.suse/0001-USB-legousbtower-fix-open-after-failed-reset-request.patch
+ patches.suse/tracing-Initialize-iter-seq-after-zeroing-in-tracing.patch
+ patches.suse/firmware-dmi-fix-unlikely-out-of-bounds-read.patch
+ patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch
+
+ # davem/net
+ patches.suse/net-ibmvnic-Fix-EOI-when-running-in-XIVE-mode.patch
# jejb/scsi for-next
- patches.suse/scsi-qla2xxx-Fix-Nport-ID-display-value.patch
- patches.suse/scsi-qla2xxx-Remove-WARN_ON_ONCE-in-qla2x00_status_c.patch
patches.suse/scsi-qla2xxx-remove-redundant-assignment-to-pointer-.patch
# powerpc/linux next
@@ -50101,12 +50200,8 @@
patches.suse/scsi-qla2xxx-Improve-logging-for-scan-thread.patch
patches.suse/scsi-qla2xxx-Update-driver-version-to-10.01.00.20-k.patch
- # nvdimm/nvdimm libnvdimm-for-next
- patches.suse/libnvdimm-prevent-nvdimm-from-requesting-key-when-security.patch
-
- # git://git.linux-nfs.org/~bfields/linux.git nfsd-next
- patches.suse/nfsd-handle-drc-over-allocation-gracefully.patch
- patches.suse/nfsd-degraded-slot-count-more-gracefully-as-allocati.patch
+ # mkp/scsi fixes
+ patches.suse/scsi-lpfc-remove-left-over-BUILD_NVME-defines.patch
# out-of-tree patches
patches.suse/firmware-arm_sdei-fix-wrong-of_node_put-in-init-function.patch
@@ -50152,6 +50247,7 @@
patches.suse/cifs-handle-netapp-error-codes.patch
patches.suse/0001-b2c2-flexcop-usb-add-sanity-checking.patch
patches.suse/scsi-qla2xxx-fix-wait-condition-in-loop.patch
+ patches.suse/Btrfs-check-for-the-full-sync-flag-while-holding-the.patch
########################################################
# end of sorted patches
@@ -50587,6 +50683,7 @@
patches.suse/tcp-fix-tcp_rtx_queue_tail-in-case-of-empty-retransm.patch
patches.kabi/kabi-handle-addition-of-net-hash_mix.patch
patches.kabi/kabi-handle-addition-of-netns_ipv4-ip_id_key.patch
+ patches.suse/tcp-Don-t-dequeue-SYN-FIN-segments-from-write-queue.patch
########################################################
# Netfilter
@@ -50600,6 +50697,7 @@
patches.kabi/mwifiex-ieee-types-kabi-fix.patch
patches.suse/net-ath6kl-Fix-a-NULL-ptr-deref-bug.patch
patches.suse/net-ath10k-Fix-a-NULL-ptr-deref-bug.patch
+ patches.suse/cfg80211-wext-avoid-copying-malformed-SSIDs.patch
########################################################
# ISDN
@@ -50896,6 +50994,9 @@
patches.kabi/kABI-Fix-kABI-for-x86-pci-dma-code.patch
patches.kabi/NFSv4-Fix-OPEN-CLOSE-race.patch
+ patches.kabi/net-sched-act_sample-fix-psample-group-handling-on-o.patch
+
+ patches.kabi/Fix-KVM-kABI-after-x86-mmu-backports.patch
patches.kabi/kabi-fix-vmem_altmap.patch