Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-04-24 07:09:38 +0200
committerKernel Build Daemon <kbuild@suse.de>2019-04-24 07:09:38 +0200
commitf330cc9f4374c1c19f023eef2f5d2624e92996c6 (patch)
tree62db762ad0d2afa5b212e37620749d3054fc0d30
parent97b6905a4e0471ad143c84b1261cfa30867eec07 (diff)
parentab4705620b995574a47da76526a07c44581a8569 (diff)
Merge branch 'SLE15' into openSUSE-15.0openSUSE-15.0
-rw-r--r--blacklist.conf3
-rw-r--r--kabi/severities4
-rw-r--r--patches.arch/intel_idle-add-support-for-Jacobsville.patch33
-rw-r--r--patches.arch/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation146
-rw-r--r--patches.arch/x86-speculation-prevent-deadlock-on-ssb_state-lock.patch69
-rw-r--r--patches.drivers/ALSA-core-Fix-card-races-between-register-and-discon.patch79
-rw-r--r--patches.drivers/ALSA-hda-Initialize-power_state-field-properly.patch37
-rw-r--r--patches.drivers/ALSA-hda-realtek-add-two-more-pin-configuration-sets.patch48
-rw-r--r--patches.drivers/ALSA-info-Fix-racy-addition-deletion-of-nodes.patch57
-rw-r--r--patches.drm/0001-drm-mediatek-Fix-an-error-code-in-mtk_hdmi_dt_parse_.patch34
-rw-r--r--patches.drm/drm-i915-gvt-Annotate-iomem-usage.patch53
-rw-r--r--patches.fixes/0001-PCI-pciehp-Convert-to-threaded-IRQ.patch209
-rw-r--r--patches.fixes/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch54
-rw-r--r--patches.fixes/0001-cxgb4-Add-flag-tc_flower_initialized.patch76
-rw-r--r--patches.fixes/0001-cxgb4-convert-flower-table-to-use-rhashtable.patch232
-rw-r--r--patches.fixes/0001-cxgb4-update-supported-DCB-version.patch87
-rw-r--r--patches.fixes/cgroup-fix-parsing-empty-mount-option-string.patch45
-rw-r--r--patches.fixes/fix-cgroup_do_mount-handling-of-failure-exits.patch103
-rw-r--r--patches.fixes/md-batch-flush-requests.patch169
-rw-r--r--patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch29
-rw-r--r--patches.kabi/fix-kvm-kabi.patch9
-rw-r--r--patches.kabi/kABI-Hide-get_msr_feature-in-kvm_x86_ops.patch8
-rw-r--r--patches.kabi/kvm-x86-kABI-fix-for-vm_alloc-vm_free-changes.patch11
-rw-r--r--patches.kabi/md-batch-flush-requests-kabi.patch36
-rw-r--r--patches.kernel.org/0001-drm-udl-add-a-release-method-and-delay-modeset-teard.patch63
-rw-r--r--series.conf24
26 files changed, 1700 insertions, 18 deletions
diff --git a/blacklist.conf b/blacklist.conf
index c0d1fc1bd4..d047ca90b7 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1071,3 +1071,6 @@ ea145aacf4ae8485cf179a4d0dc502e9f75044f4 # No bugfix, just cleanup
bebd024e4815b1a170fcd21ead9c2222b23ce9e6 # SLE kernels already enable this
23ff6ba8feec5c4bdf993af3fba3937d57883dc8 # applied with rdma/cxgb4: Add support for kernel mode SRQ's
bbbe211c295ffb309247adb7b871dda60d92d2d5 # there is no do_xdp_generic() function, doesn't apply
+1de7edbb59c8f1b46071f66c5c97b8a59569eb51 # not needed
+62461ac2e5b6520b6d65fc6d7d7b4b8df4b848d8 # ditto
+69a330007091ea8a801dd9fcd897ec52f9529586 # breaks module options
diff --git a/kabi/severities b/kabi/severities
index 8af652baf7..9553a5811f 100644
--- a/kabi/severities
+++ b/kabi/severities
@@ -69,3 +69,7 @@ fs/ceph PASS
# no out-of-tree users
drivers/crypto/ccp/* PASS
+
+# intermodule syms shared between cxgb4 and cxgb4vf
+drivers/net/ethernet/chelsio/cxgb4/* PASS
+drivers/net/ethernet/chelsio/cxgb4vf/* PASS
diff --git a/patches.arch/intel_idle-add-support-for-Jacobsville.patch b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
new file mode 100644
index 0000000000..81b2bc5dba
--- /dev/null
+++ b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
@@ -0,0 +1,33 @@
+From dba500ed0d3fa3400f7fe657c6d44e66bd4f5c96 Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Thu, 14 Feb 2019 21:35:06 +0800
+Subject: [PATCH] intel_idle: add support for Jacobsville
+
+References: jsc#SLE-5394
+Patch-mainline: v5.1-rc1
+Git-commit: 04b1d5d098491244f506c4265cc95b87210eef2f
+
+Jacobsville uses the same C-states as Denverton.
+
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/idle/intel_idle.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
+index 216d7ec88c0c..008eb4d58a86 100644
+--- a/drivers/idle/intel_idle.c
++++ b/drivers/idle/intel_idle.c
+@@ -1099,6 +1099,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+ ICPU(INTEL_FAM6_ATOM_GOLDMONT, idle_cpu_bxt),
+ ICPU(INTEL_FAM6_ATOM_GEMINI_LAKE, idle_cpu_bxt),
+ ICPU(INTEL_FAM6_ATOM_DENVERTON, idle_cpu_dnv),
++ ICPU(INTEL_FAM6_ATOM_TREMONT_X, idle_cpu_dnv),
+ {}
+ };
+
+--
+2.20.1
+
diff --git a/patches.arch/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation b/patches.arch/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation
new file mode 100644
index 0000000000..0c59a8995f
--- /dev/null
+++ b/patches.arch/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation
@@ -0,0 +1,146 @@
+From: "Singh, Brijesh" <brijesh.singh@amd.com>
+Date: Fri, 15 Feb 2019 17:24:12 +0000
+Subject: KVM: SVM: Workaround errata#1096 (insn_len maybe zero on SMAP
+ violation)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 05d5a48635259e621ea26d01e8316c6feeb34190
+Patch-mainline: v5.1-rc3
+References: bsc#1133149
+
+Errata#1096:
+
+On a nested data page fault when CR.SMAP=1 and the guest data read
+generates a SMAP violation, GuestInstrBytes field of the VMCB on a
+VMEXIT will incorrectly return 0h instead the correct guest
+instruction bytes .
+
+Recommend Workaround:
+
+To determine what instruction the guest was executing the hypervisor
+will have to decode the instruction at the instruction pointer.
+
+The recommended workaround can not be implemented for the SEV
+guest because guest memory is encrypted with the guest specific key,
+and instruction decoder will not be able to decode the instruction
+bytes. If we hit this errata in the SEV guest then log the message
+and request a guest shutdown.
+
+Reported-by: Venkatesh Srinivas <venkateshs@google.com>
+Cc: Jim Mattson <jmattson@google.com>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Joerg Roedel <joro@8bytes.org>
+Cc: "Radim Krčmář" <rkrcmar@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/include/asm/kvm_host.h | 2 ++
+ arch/x86/kvm/mmu.c | 8 +++++---
+ arch/x86/kvm/svm.c | 32 ++++++++++++++++++++++++++++++++
+ arch/x86/kvm/vmx/vmx.c | 6 ++++++
+ 4 files changed, 45 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1103,6 +1103,8 @@ struct kvm_x86_ops {
+ int (*mem_enc_unreg_region)(struct kvm *kvm, struct kvm_enc_region *argp);
+
+ int (*get_msr_feature)(struct kvm_msr_entry *entry);
++
++ bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu);
+ };
+
+ struct kvm_arch_async_pf {
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -5020,10 +5020,12 @@ emulate:
+ * This can happen if a guest gets a page-fault on data access but the HW
+ * table walker is not able to read the instruction page (e.g instruction
+ * page is not present in memory). In those cases we simply restart the
+- * guest.
++ * guest, with the exception of AMD Erratum 1096 which is unrecoverable.
+ */
+- if (unlikely(insn && !insn_len))
+- return 1;
++ if (unlikely(insn && !insn_len)) {
++ if (!kvm_x86_ops->need_emulation_on_page_fault(vcpu))
++ return 1;
++ }
+
+ er = x86_emulate_instruction(vcpu, cr2, emulation_type, insn, insn_len);
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -6985,6 +6985,36 @@ failed:
+ return ret;
+ }
+
++static bool svm_need_emulation_on_page_fault(struct kvm_vcpu *vcpu)
++{
++ bool is_user, smap;
++
++ is_user = svm_get_cpl(vcpu) == 3;
++ smap = !kvm_read_cr4_bits(vcpu, X86_CR4_SMAP);
++
++ /*
++ * Detect and workaround Errata 1096 Fam_17h_00_0Fh
++ *
++ * In non SEV guest, hypervisor will be able to read the guest
++ * memory to decode the instruction pointer when insn_len is zero
++ * so we return true to indicate that decoding is possible.
++ *
++ * But in the SEV guest, the guest memory is encrypted with the
++ * guest specific key and hypervisor will not be able to decode the
++ * instruction pointer so we will not able to workaround it. Lets
++ * print the error and request to kill the guest.
++ */
++ if (is_user && smap) {
++ if (!sev_guest(vcpu->kvm))
++ return true;
++
++ pr_err_ratelimited("KVM: Guest triggered AMD Erratum 1096\n");
++ kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
++ }
++
++ return false;
++}
++
+ static struct kvm_x86_ops svm_x86_ops __ro_after_init = {
+ .cpu_has_kvm_support = has_svm,
+ .disabled_by_bios = is_disabled,
+@@ -7107,6 +7137,8 @@ static struct kvm_x86_ops svm_x86_ops __
+ .mem_enc_op = svm_mem_enc_op,
+ .mem_enc_reg_region = svm_register_enc_region,
+ .mem_enc_unreg_region = svm_unregister_enc_region,
++
++ .need_emulation_on_page_fault = svm_need_emulation_on_page_fault,
+ };
+
+ static int __init svm_init(void)
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7097,6 +7097,11 @@ void vmx_enable_tdp(void)
+ kvm_enable_tdp();
+ }
+
++static bool vmx_need_emulation_on_page_fault(struct kvm_vcpu *vcpu)
++{
++ return 0;
++}
++
+ static __init int hardware_setup(void)
+ {
+ int r = -ENOMEM, i;
+@@ -12717,6 +12722,7 @@ static struct kvm_x86_ops vmx_x86_ops __
+ .pre_enter_smm = vmx_pre_enter_smm,
+ .pre_leave_smm = vmx_pre_leave_smm,
+ .enable_smi_window = enable_smi_window,
++ .need_emulation_on_page_fault = vmx_need_emulation_on_page_fault,
+ };
+
+ static void vmx_cleanup_l1d_flush(void)
+
diff --git a/patches.arch/x86-speculation-prevent-deadlock-on-ssb_state-lock.patch b/patches.arch/x86-speculation-prevent-deadlock-on-ssb_state-lock.patch
new file mode 100644
index 0000000000..72b3ad5190
--- /dev/null
+++ b/patches.arch/x86-speculation-prevent-deadlock-on-ssb_state-lock.patch
@@ -0,0 +1,69 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Sun, 14 Apr 2019 19:51:06 +0200
+Subject: x86/speculation: Prevent deadlock on ssb_state::lock
+Git-commit: 2f5fb19341883bb6e37da351bc3700489d8506a7
+Patch-mainline: v5.1-rc6
+References: bsc#1114279
+
+Mikhail reported a lockdep splat related to the AMD specific ssb_state
+lock:
+
+ CPU0 CPU1
+ lock(&st->lock);
+ local_irq_disable();
+ lock(&(&sighand->siglock)->rlock);
+ lock(&st->lock);
+ <Interrupt>
+ lock(&(&sighand->siglock)->rlock);
+
+ *** DEADLOCK ***
+
+The connection between sighand->siglock and st->lock comes through seccomp,
+which takes st->lock while holding sighand->siglock.
+
+Make sure interrupts are disabled when __speculation_ctrl_update() is
+invoked via prctl() -> speculation_ctrl_update(). Add a lockdep assert to
+catch future offenders.
+
+Fixes: 1f50ddb4f418 ("x86/speculation: Handle HT correctly on AMD")
+Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Cc: Thomas Lendacky <thomas.lendacky@amd.com>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1904141948200.4917@nanos.tec.linutronix.de
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/process.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
+index 58ac7be52c7a..957eae13b370 100644
+--- a/arch/x86/kernel/process.c
++++ b/arch/x86/kernel/process.c
+@@ -426,6 +426,8 @@ static __always_inline void __speculation_ctrl_update(unsigned long tifp,
+ u64 msr = x86_spec_ctrl_base;
+ bool updmsr = false;
+
++ lockdep_assert_irqs_disabled();
++
+ /*
+ * If TIF_SSBD is different, select the proper mitigation
+ * method. Note that if SSBD mitigation is disabled or permanentely
+@@ -477,10 +479,12 @@ static unsigned long speculation_ctrl_update_tif(struct task_struct *tsk)
+
+ void speculation_ctrl_update(unsigned long tif)
+ {
++ unsigned long flags;
++
+ /* Forced update. Make sure all relevant TIF flags are different */
+- preempt_disable();
++ local_irq_save(flags);
+ __speculation_ctrl_update(~tif, tif);
+- preempt_enable();
++ local_irq_restore(flags);
+ }
+
+ /* Called from seccomp/prctl update */
+
diff --git a/patches.drivers/ALSA-core-Fix-card-races-between-register-and-discon.patch b/patches.drivers/ALSA-core-Fix-card-races-between-register-and-discon.patch
new file mode 100644
index 0000000000..b7b3a9fb0f
--- /dev/null
+++ b/patches.drivers/ALSA-core-Fix-card-races-between-register-and-discon.patch
@@ -0,0 +1,79 @@
+From 2a3f7221acddfe1caa9ff09b3a8158c39b2fdeac Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 17:06:33 +0200
+Subject: [PATCH] ALSA: core: Fix card races between register and disconnect
+Git-commit: 2a3f7221acddfe1caa9ff09b3a8158c39b2fdeac
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+There is a small race window in the card disconnection code that
+allows the registration of another card with the very same card id.
+This leads to a warning in procfs creation as caught by syzkaller.
+
+The problem is that we delete snd_cards and snd_cards_lock entries at
+the very beginning of the disconnection procedure. This makes the
+slot available to be assigned for another card object while the
+disconnection procedure is being processed. Then it becomes possible
+to issue a procfs registration with the existing file name although we
+check the conflict beforehand.
+
+The fix is simply to move the snd_cards and snd_cards_lock clearances
+at the end of the disconnection procedure. The references to these
+entries are merely either from the global proc files like
+/proc/asound/cards or from the card registration / disconnection, so
+it should be fine to shift at the very end.
+
+Reported-by: syzbot+48df349490c36f9f54ab@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/init.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 0c4dc40376a7..079c12d64b0e 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -382,14 +382,7 @@ int snd_card_disconnect(struct snd_card *card)
+ card->shutdown = 1;
+ spin_unlock(&card->files_lock);
+
+- /* phase 1: disable fops (user space) operations for ALSA API */
+- mutex_lock(&snd_card_mutex);
+- snd_cards[card->number] = NULL;
+- clear_bit(card->number, snd_cards_lock);
+- mutex_unlock(&snd_card_mutex);
+-
+- /* phase 2: replace file->f_op with special dummy operations */
+-
++ /* replace file->f_op with special dummy operations */
+ spin_lock(&card->files_lock);
+ list_for_each_entry(mfile, &card->files_list, list) {
+ /* it's critical part, use endless loop */
+@@ -405,7 +398,7 @@ int snd_card_disconnect(struct snd_card *card)
+ }
+ spin_unlock(&card->files_lock);
+
+- /* phase 3: notify all connected devices about disconnection */
++ /* notify all connected devices about disconnection */
+ /* at this point, they cannot respond to any calls except release() */
+
+ #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
+@@ -421,6 +414,13 @@ int snd_card_disconnect(struct snd_card *card)
+ device_del(&card->card_dev);
+ card->registered = false;
+ }
++
++ /* disable fops (user space) operations for ALSA API */
++ mutex_lock(&snd_card_mutex);
++ snd_cards[card->number] = NULL;
++ clear_bit(card->number, snd_cards_lock);
++ mutex_unlock(&snd_card_mutex);
++
+ #ifdef CONFIG_PM
+ wake_up(&card->power_sleep);
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Initialize-power_state-field-properly.patch b/patches.drivers/ALSA-hda-Initialize-power_state-field-properly.patch
new file mode 100644
index 0000000000..f5f455d41e
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Initialize-power_state-field-properly.patch
@@ -0,0 +1,37 @@
+From 183ab39eb0ea9879bb68422a83e65f750f3192f0 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Sat, 13 Apr 2019 10:04:49 +0200
+Subject: [PATCH] ALSA: hda: Initialize power_state field properly
+Git-commit: 183ab39eb0ea9879bb68422a83e65f750f3192f0
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+The recent commit 98081ca62cba ("ALSA: hda - Record the current power
+state before suspend/resume calls") made the HD-audio driver to store
+the PM state in power_state field. This forgot, however, the
+initialization at power up. Although the codec drivers usually don't
+need to refer to this field in the normal operation, let's initialize
+it properly for consistency.
+
+Fixes: 98081ca62cba ("ALSA: hda - Record the current power state before suspend/resume calls")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_codec.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index ec0b8595eb4d..701a69d856f5 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -969,6 +969,7 @@ int snd_hda_codec_device_new(struct hda_bus *bus, struct snd_card *card,
+
+ /* power-up all before initialization */
+ hda_set_power_state(codec, AC_PWRST_D0);
++ codec->core.dev.power.power_state = PMSG_ON;
+
+ snd_hda_codec_proc_new(codec);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-add-two-more-pin-configuration-sets.patch b/patches.drivers/ALSA-hda-realtek-add-two-more-pin-configuration-sets.patch
new file mode 100644
index 0000000000..b524a35feb
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-add-two-more-pin-configuration-sets.patch
@@ -0,0 +1,48 @@
+From b26e36b7ef36a8a3a147b1609b2505f8a4ecf511 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Wed, 17 Apr 2019 16:10:32 +0800
+Subject: [PATCH] ALSA: hda/realtek - add two more pin configuration sets to quirk table
+Git-commit: b26e36b7ef36a8a3a147b1609b2505f8a4ecf511
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+We have two Dell laptops which have the codec 10ec0236 and 10ec0256
+respectively, the headset mic on them can't work, need to apply the
+quirk of ALC255_FIXUP_DELL1_MIC_NO_PRESENCE. So adding their pin
+configurations in the pin quirk table.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 810479766090..f5b510f119ed 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7266,6 +7266,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x12, 0x90a60140},
+ {0x14, 0x90170150},
+ {0x21, 0x02211020}),
++ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x21, 0x02211020}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+ {0x14, 0x90170110},
+ {0x21, 0x02211020}),
+@@ -7376,6 +7378,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC256_STANDARD_PINS),
++ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x14, 0x90170110},
++ {0x1b, 0x01011020},
++ {0x21, 0x0221101f}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1043, "ASUS", ALC256_FIXUP_ASUS_MIC,
+ {0x14, 0x90170110},
+ {0x1b, 0x90a70130},
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-info-Fix-racy-addition-deletion-of-nodes.patch b/patches.drivers/ALSA-info-Fix-racy-addition-deletion-of-nodes.patch
new file mode 100644
index 0000000000..49e6da1cc3
--- /dev/null
+++ b/patches.drivers/ALSA-info-Fix-racy-addition-deletion-of-nodes.patch
@@ -0,0 +1,57 @@
+From 8c2f870890fd28e023b0fcf49dcee333f2c8bad7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 15:25:00 +0200
+Subject: [PATCH] ALSA: info: Fix racy addition/deletion of nodes
+Git-commit: 8c2f870890fd28e023b0fcf49dcee333f2c8bad7
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+The ALSA proc helper manages the child nodes in a linked list, but its
+addition and deletion is done without any lock. This leads to a
+corruption if they are operated concurrently. Usually this isn't a
+problem because the proc entries are added sequentially in the driver
+probe procedure itself. But the card registrations are done often
+asynchronously, and the crash could be actually reproduced with
+syzkaller.
+
+This patch papers over it by protecting the link addition and deletion
+with the parent's mutex. There is "access" mutex that is used for the
+file access, and this can be reused for this purpose as well.
+
+Reported-by: syzbot+48df349490c36f9f54ab@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/info.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -724,8 +724,11 @@ snd_info_create_entry(const char *name,
+ INIT_LIST_HEAD(&entry->children);
+ INIT_LIST_HEAD(&entry->list);
+ entry->parent = parent;
+- if (parent)
++ if (parent) {
++ mutex_lock(&parent->access);
+ list_add_tail(&entry->list, &parent->children);
++ mutex_unlock(&parent->access);
++ }
+ return entry;
+ }
+
+@@ -809,7 +812,12 @@ void snd_info_free_entry(struct snd_info
+ list_for_each_entry_safe(p, n, &entry->children, list)
+ snd_info_free_entry(p);
+
+- list_del(&entry->list);
++ p = entry->parent;
++ if (p) {
++ mutex_lock(&p->access);
++ list_del(&entry->list);
++ mutex_unlock(&p->access);
++ }
+ kfree(entry->name);
+ if (entry->private_free)
+ entry->private_free(entry);
diff --git a/patches.drm/0001-drm-mediatek-Fix-an-error-code-in-mtk_hdmi_dt_parse_.patch b/patches.drm/0001-drm-mediatek-Fix-an-error-code-in-mtk_hdmi_dt_parse_.patch
new file mode 100644
index 0000000000..4008e583b4
--- /dev/null
+++ b/patches.drm/0001-drm-mediatek-Fix-an-error-code-in-mtk_hdmi_dt_parse_.patch
@@ -0,0 +1,34 @@
+From 2d85978341e6a32e7443d9f28639da254d53f400 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 28 Mar 2019 17:31:30 +0300
+Subject: drm/mediatek: Fix an error code in mtk_hdmi_dt_parse_pdata()
+Git-commit: 2d85978341e6a32e7443d9f28639da254d53f400
+Patch-mainline: v5.1-rc5
+References: bsc#1113722
+
+We don't want to overwrite "ret", it already holds the correct error
+code. The "regmap" variable might be a valid pointer as this point.
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 915cc84621ae..543a25e5765e 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1480,7 +1480,6 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ if (IS_ERR(regmap))
+ ret = PTR_ERR(regmap);
+ if (ret) {
+- ret = PTR_ERR(regmap);
+ dev_err(dev,
+ "Failed to get system configuration registers: %d\n",
+ ret);
+--
+2.21.0
+
diff --git a/patches.drm/drm-i915-gvt-Annotate-iomem-usage.patch b/patches.drm/drm-i915-gvt-Annotate-iomem-usage.patch
new file mode 100644
index 0000000000..77d589b48d
--- /dev/null
+++ b/patches.drm/drm-i915-gvt-Annotate-iomem-usage.patch
@@ -0,0 +1,53 @@
+From 196a66275520ffc27513c56ecc06a2d9450fd12f Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu, 4 Apr 2019 08:14:25 +0100
+Subject: [PATCH] drm/i915/gvt: Annotate iomem usage
+Git-commit: 196a66275520ffc27513c56ecc06a2d9450fd12f
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Fix the sparse warning for blithely using iomem with normal memcpy:
+
+drivers/gpu/drm/i915/gvt/kvmgt.c:916:21: warning: incorrect type in assignment (different address spaces)
+drivers/gpu/drm/i915/gvt/kvmgt.c:916:21: expected void *aperture_va
+drivers/gpu/drm/i915/gvt/kvmgt.c:916:21: got void [noderef] <asn:2> *
+drivers/gpu/drm/i915/gvt/kvmgt.c:927:26: warning: incorrect type in argument 1 (different address spaces)
+drivers/gpu/drm/i915/gvt/kvmgt.c:927:26: expected void [noderef] <asn:2> *vaddr
+drivers/gpu/drm/i915/gvt/kvmgt.c:927:26: got void *aperture_va
+
+Fixes: d480b28a41a6 ("drm/i915/gvt: Fix aperture read/write emulation when enable x-no-mmap=on")
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
+Cc: Changbin Du <changbin.du@intel.com>
+Cc: Zhi Wang <zhi.a.wang@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/gvt/kvmgt.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
+@@ -641,7 +641,7 @@ static inline bool intel_vgpu_in_apertur
+ static int intel_vgpu_aperture_rw(struct intel_vgpu *vgpu, uint64_t off,
+ void *buf, unsigned long count, bool is_write)
+ {
+- void *aperture_va;
++ void __iomem *aperture_va;
+
+ if (!intel_vgpu_in_aperture(vgpu, off) ||
+ !intel_vgpu_in_aperture(vgpu, off + count)) {
+@@ -656,9 +656,9 @@ static int intel_vgpu_aperture_rw(struct
+ return -EIO;
+
+ if (is_write)
+- memcpy(aperture_va + offset_in_page(off), buf, count);
++ memcpy_toio(aperture_va + offset_in_page(off), buf, count);
+ else
+- memcpy(buf, aperture_va + offset_in_page(off), count);
++ memcpy_fromio(buf, aperture_va + offset_in_page(off), count);
+
+ io_mapping_unmap(aperture_va);
+
diff --git a/patches.fixes/0001-PCI-pciehp-Convert-to-threaded-IRQ.patch b/patches.fixes/0001-PCI-pciehp-Convert-to-threaded-IRQ.patch
new file mode 100644
index 0000000000..73d3b0c6c8
--- /dev/null
+++ b/patches.fixes/0001-PCI-pciehp-Convert-to-threaded-IRQ.patch
@@ -0,0 +1,209 @@
+From 7b4ce26bcf697e3a4aa9ba2a5b456562e0fb7af4 Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Thu, 19 Jul 2018 17:27:38 -0500
+Subject: [PATCH] PCI: pciehp: Convert to threaded IRQ
+Git-commit: 7b4ce26bcf697e3a4aa9ba2a5b456562e0fb7af4
+Patch-mainline: v4.19
+References: bsc#1133005
+
+pciehp's IRQ handler queues up a work item for each event signaled by
+the hardware. A more modern alternative is to let a long running
+kthread service the events. The IRQ handler's sole job is then to check
+whether the IRQ originated from the device in question, acknowledge its
+receipt to the hardware to quiesce the interrupt and wake up the kthread.
+
+One benefit is reduced latency to handle the IRQ, which is a necessity
+for realtime environments. Another benefit is that we can make pciehp
+simpler and more robust by handling events synchronously in process
+context, rather than asynchronously by queueing up work items. pciehp's
+usage of work items is a historic artifact, it predates the introduction
+of threaded IRQ handlers by two years. (The former was introduced in
+2007 with commit 5d386e1ac402 ("pciehp: Event handling rework"), the
+latter in 2009 with commit 3aa551c9b4c4 ("genirq: add threaded interrupt
+handler support").)
+
+Convert pciehp to threaded IRQ handling by retrieving the pending events
+in pciehp_isr(), saving them for later consumption by the thread handler
+pciehp_ist() and clearing them in the Slot Status register.
+
+By clearing the Slot Status (and thereby acknowledging the events) in
+pciehp_isr(), we can avoid requesting the IRQ with IRQF_ONESHOT, which
+would have the unpleasant side effect of starving devices sharing the
+IRQ until pciehp_ist() has finished.
+
+pciehp_isr() does not count how many times each event occurred, but
+merely records the fact *that* an event occurred. If the same event
+occurs a second time before pciehp_ist() is woken, that second event
+will not be recorded separately, which is problematic according to
+commit fad214b0aa72 ("PCI: pciehp: Process all hotplug events before
+looking for new ones") because we may miss removal of a card in-between
+two back-to-back insertions. We're about to make pciehp_ist() resilient
+to missed events. The present commit regresses the driver's behavior
+temporarily in order to separate the changes into reviewable chunks.
+This doesn't affect regular slow-motion hotplug, only plug-unplug-plug
+operations that happen in a timespan shorter than wakeup of the IRQ
+thread.
+
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Mayurkumar Patel <mayurkumar.patel@intel.com>
+Cc: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/pci/hotplug/pciehp.h | 1
+ drivers/pci/hotplug/pciehp_hpc.c | 70 +++++++++++++++++++++------------------
+ 2 files changed, 39 insertions(+), 32 deletions(-)
+
+--- a/drivers/pci/hotplug/pciehp.h
++++ b/drivers/pci/hotplug/pciehp.h
+@@ -99,6 +99,7 @@ struct controller {
+ unsigned int link_active_reporting:1;
+ unsigned int notification_enabled:1;
+ unsigned int power_fault_detected;
++ atomic_t pending_events;
+ };
+
+ #define INT_PRESENCE_ON 1
+--- a/drivers/pci/hotplug/pciehp_hpc.c
++++ b/drivers/pci/hotplug/pciehp_hpc.c
+@@ -46,7 +46,8 @@ static inline struct pci_dev *ctrl_dev(s
+ return ctrl->pcie->port;
+ }
+
+-static irqreturn_t pcie_isr(int irq, void *dev_id);
++static irqreturn_t pciehp_isr(int irq, void *dev_id);
++static irqreturn_t pciehp_ist(int irq, void *dev_id);
+ static void start_int_poll_timer(struct controller *ctrl, int sec);
+
+ /* This is the interrupt polling timeout function. */
+@@ -55,7 +56,8 @@ static void int_poll_timeout(unsigned lo
+ struct controller *ctrl = (struct controller *)data;
+
+ /* Poll for interrupt events. regs == NULL => polling */
+- pcie_isr(0, ctrl);
++ while (pciehp_isr(IRQ_NOTCONNECTED, ctrl) == IRQ_WAKE_THREAD)
++ pciehp_ist(IRQ_NOTCONNECTED, ctrl);
+
+ init_timer(&ctrl->poll_timer);
+ if (!pciehp_poll_time)
+@@ -89,7 +91,8 @@ static inline int pciehp_request_irq(str
+ }
+
+ /* Installs the interrupt handler */
+- retval = request_irq(irq, pcie_isr, IRQF_SHARED, MY_NAME, ctrl);
++ retval = request_threaded_irq(irq, pciehp_isr, pciehp_ist,
++ IRQF_SHARED, MY_NAME, ctrl);
+ if (retval)
+ ctrl_err(ctrl, "Cannot get irq %d for the hotplug controller\n",
+ irq);
+@@ -562,12 +565,11 @@ static irqreturn_t pciehp_isr(int irq, v
+ {
+ struct controller *ctrl = (struct controller *)dev_id;
+ struct pci_dev *pdev = ctrl_dev(ctrl);
+- struct slot *slot = ctrl->slot;
+ u16 status, events;
+- u8 present;
+- bool link;
+
+- /* Interrupts cannot originate from a controller that's asleep */
++ /*
++ * Interrupts only occur in D3hot or shallower (PCIe r4.0, sec 6.7.3.4).
++ */
+ if (pdev->current_state == PCI_D3cold)
+ return IRQ_NONE;
+
+@@ -595,18 +597,22 @@ static irqreturn_t pciehp_isr(int irq, v
+ if (!events)
+ return IRQ_NONE;
+
+- /* Capture link status before clearing interrupts */
+- if (events & PCI_EXP_SLTSTA_DLLSC)
+- link = pciehp_check_link_active(ctrl);
+-
+ pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, events);
+ ctrl_dbg(ctrl, "pending interrupts %#06x from Slot Status\n", events);
+
+- /* Check Command Complete Interrupt Pending */
++ /*
++ * Command Completed notifications are not deferred to the
++ * IRQ thread because it may be waiting for their arrival.
++ */
+ if (events & PCI_EXP_SLTSTA_CC) {
+ ctrl->cmd_busy = 0;
+ smp_mb();
+ wake_up(&ctrl->queue);
++
++ if (events == PCI_EXP_SLTSTA_CC)
++ return IRQ_HANDLED;
++
++ events &= ~PCI_EXP_SLTSTA_CC;
+ }
+
+ if (pdev->ignore_hotplug) {
+@@ -614,6 +620,24 @@ static irqreturn_t pciehp_isr(int irq, v
+ return IRQ_HANDLED;
+ }
+
++ /* Save pending events for consumption by IRQ thread. */
++ atomic_or(events, &ctrl->pending_events);
++ return IRQ_WAKE_THREAD;
++}
++
++static irqreturn_t pciehp_ist(int irq, void *dev_id)
++{
++ struct controller *ctrl = (struct controller *)dev_id;
++ struct slot *slot = ctrl->slot;
++ u32 events;
++ u8 present;
++ bool link;
++
++ synchronize_hardirq(irq);
++ events = atomic_xchg(&ctrl->pending_events, 0);
++ if (!events)
++ return IRQ_NONE;
++
+ /* Check Attention Button Pressed */
+ if (events & PCI_EXP_SLTSTA_ABP) {
+ ctrl_info(ctrl, "Slot(%s): Attention button pressed\n",
+@@ -628,12 +652,13 @@ static irqreturn_t pciehp_isr(int irq, v
+ * and cause the wrong event to queue.
+ */
+ if (events & PCI_EXP_SLTSTA_DLLSC) {
++ link = pciehp_check_link_active(ctrl);
+ ctrl_info(ctrl, "Slot(%s): Link %s\n", slot_name(slot),
+ link ? "Up" : "Down");
+ pciehp_queue_interrupt_event(slot, link ? INT_LINK_UP :
+ INT_LINK_DOWN);
+ } else if (events & PCI_EXP_SLTSTA_PDC) {
+- present = !!(status & PCI_EXP_SLTSTA_PDS);
++ pciehp_get_adapter_status(slot, &present);
+ ctrl_info(ctrl, "Slot(%s): Card %spresent\n", slot_name(slot),
+ present ? "" : "not ");
+ pciehp_queue_interrupt_event(slot, present ? INT_PRESENCE_ON :
+@@ -650,25 +675,6 @@ static irqreturn_t pciehp_isr(int irq, v
+ return IRQ_HANDLED;
+ }
+
+-static irqreturn_t pcie_isr(int irq, void *dev_id)
+-{
+- irqreturn_t rc, handled = IRQ_NONE;
+-
+- /*
+- * To guarantee that all interrupt events are serviced, we need to
+- * re-inspect Slot Status register after clearing what is presumed
+- * to be the last pending interrupt.
+- */
+- do {
+- rc = pciehp_isr(irq, dev_id);
+- if (rc == IRQ_HANDLED)
+- handled = IRQ_HANDLED;
+- } while (rc == IRQ_HANDLED);
+-
+- /* Return IRQ_HANDLED if we handled one or more events */
+- return handled;
+-}
+-
+ static void pcie_enable_notification(struct controller *ctrl)
+ {
+ u16 cmd, mask;
diff --git a/patches.fixes/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch b/patches.fixes/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch
new file mode 100644
index 0000000000..597efd504a
--- /dev/null
+++ b/patches.fixes/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch
@@ -0,0 +1,54 @@
+From 3943af9d01e94330d0cfac6fccdbc829aad50c92 Mon Sep 17 00:00:00 2001
+From: Sergey Miroshnichenko <s.miroshnichenko@yadro.com>
+Date: Tue, 12 Mar 2019 15:05:48 +0300
+Subject: [PATCH] PCI: pciehp: Ignore Link State Changes after powering off a
+ slot
+Git-commit: 3943af9d01e94330d0cfac6fccdbc829aad50c92
+Patch-mainline: v5.1-rc5
+References: bsc#1133005
+
+During a safe hot remove, the OS powers off the slot, which may cause a
+Data Link Layer State Changed event. The slot has already been set to
+OFF_STATE, so that event results in re-enabling the device, making it
+impossible to safely remove it.
+
+Clear out the Presence Detect Changed and Data Link Layer State Changed
+events when the disabled slot has settled down.
+
+It is still possible to re-enable the device if it remains in the slot
+after pressing the Attention Button by pressing it again.
+
+Fixes the problem that Micah reported below: an NVMe drive power button may
+not actually turn off the drive.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=203237
+Reported-by: Micah Parrish <micah.parrish@hpe.com>
+Tested-by: Micah Parrish <micah.parrish@hpe.com>
+Signed-off-by: Sergey Miroshnichenko <s.miroshnichenko@yadro.com>
+[bhelgaas: changelog, add bugzilla URL]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/pci/hotplug/pciehp_ctrl.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
+index 3f3df4c29f6e..905282a8ddaa 100644
+--- a/drivers/pci/hotplug/pciehp_ctrl.c
++++ b/drivers/pci/hotplug/pciehp_ctrl.c
+@@ -115,6 +115,10 @@ static void remove_board(struct controller *ctrl, bool safe_removal)
+ * removed from the slot/adapter.
+ */
+ msleep(1000);
++
++ /* Ignore link or presence changes caused by power off */
++ atomic_and(~(PCI_EXP_SLTSTA_DLLSC | PCI_EXP_SLTSTA_PDC),
++ &ctrl->pending_events);
+ }
+
+ /* turn off Green LED */
+--
+2.16.4
+
diff --git a/patches.fixes/0001-cxgb4-Add-flag-tc_flower_initialized.patch b/patches.fixes/0001-cxgb4-Add-flag-tc_flower_initialized.patch
new file mode 100644
index 0000000000..914d8067e1
--- /dev/null
+++ b/patches.fixes/0001-cxgb4-Add-flag-tc_flower_initialized.patch
@@ -0,0 +1,76 @@
+From: Casey Leedom <leedom@chelsio.com>
+Subject: cxgb4: Add flag tc_flower_initialized
+Patch-mainline: v4.19-rc1
+Git-commit: a081e11536a716da3fd2b09061e75c09e691b2f8
+References: bsc#1127371
+
+Add flag tc_flower_initialized to indicate the
+completion if tc flower initialization.
+
+Signed-off-by: Casey Leedom <leedom@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 1 +
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c | 5 +++++
+ drivers/net/ethernet/chelsio/cxgb4/sched.c | 3 +++
+ 3 files changed, 9 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+index 534b4ecf02b5..779ff7b8d4e4 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+@@ -1001,6 +1001,7 @@ struct adapter {
+ struct chcr_stats_debug chcr_stats;
+
+ /* TC flower offload */
++ bool tc_flower_initialized;
+ struct rhashtable flower_tbl;
+ struct rhashtable_params flower_ht_params;
+ struct timer_list flower_stats_timer;
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+index 3c0304f18acd..3cc39f83b722 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+@@ -848,6 +848,9 @@ int cxgb4_init_tc_flower(struct adapter *adap)
+ {
+ int ret;
+
++ if (adap->tc_flower_initialized)
++ return -EEXIST;
++
+ adap->flower_ht_params = cxgb4_tc_flower_ht_params;
+ ret = rhashtable_init(&adap->flower_tbl, &adap->flower_ht_params);
+ if (ret)
+@@ -856,6 +859,7 @@ int cxgb4_init_tc_flower(struct adapter *adap)
+ setup_timer(&adap->flower_stats_timer, ch_flower_stats_cb,
+ (unsigned long)adap);
+ mod_timer(&adap->flower_stats_timer, jiffies + STATS_CHECK_PERIOD);
++ adap->tc_flower_initialized = true;
+ return 0;
+ }
+
+@@ -864,4 +868,5 @@ void cxgb4_cleanup_tc_flower(struct adapter *adap)
+ if (adap->flower_stats_timer.function)
+ del_timer_sync(&adap->flower_stats_timer);
+ rhashtable_destroy(&adap->flower_tbl);
++ adap->tc_flower_initialized = false;
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/sched.c b/drivers/net/ethernet/chelsio/cxgb4/sched.c
+index 9148abb7994c..7fc656680299 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/sched.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/sched.c
+@@ -539,6 +539,9 @@ void t4_cleanup_sched(struct adapter *adap)
+ struct port_info *pi = netdev2pinfo(adap->port[j]);
+
+ s = pi->sched_tbl;
++ if (!s)
++ continue;
++
+ for (i = 0; i < s->sched_size; i++) {
+ struct sched_class *e;
+
+--
+2.12.3
+
diff --git a/patches.fixes/0001-cxgb4-convert-flower-table-to-use-rhashtable.patch b/patches.fixes/0001-cxgb4-convert-flower-table-to-use-rhashtable.patch
new file mode 100644
index 0000000000..441b9927f2
--- /dev/null
+++ b/patches.fixes/0001-cxgb4-convert-flower-table-to-use-rhashtable.patch
@@ -0,0 +1,232 @@
+From: Kumar Sanghvi <kumaras@chelsio.com>
+Subject: cxgb4: convert flower table to use rhashtable
+Patch-mainline: v4.15-rc1
+Git-commit: 79e6d46a65abfd721de378bf496833a04ea10afe
+References: bsc#1127371
+
+T6 supports ~500K hash filters and can theoretically climb up to
+~1 million hash filters. Preallocated hash table is not efficient
+in terms of memory usage. So, use rhashtable instead which gives
+the flexibility to grow based on usage.
+
+Signed-off-by: Kumar Sanghvi <kumaras@chelsio.com>
+Signed-off-by: Rahul Lakkireddy <rahul.lakkireddy@chelsio.com>
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4.h | 4 +-
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 4 +-
+ .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c | 92 +++++++++++++++-------
+ .../net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h | 4 +-
+ 4 files changed, 70 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+index ab1f7b4544e0..534b4ecf02b5 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+@@ -46,6 +46,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/timer.h>
+ #include <linux/vmalloc.h>
++#include <linux/rhashtable.h>
+ #include <linux/etherdevice.h>
+ #include <linux/net_tstamp.h>
+ #include <linux/ptp_clock_kernel.h>
+@@ -1000,7 +1001,8 @@ struct adapter {
+ struct chcr_stats_debug chcr_stats;
+
+ /* TC flower offload */
+- DECLARE_HASHTABLE(flower_anymatch_tbl, 9);
++ struct rhashtable flower_tbl;
++ struct rhashtable_params flower_ht_params;
+ struct timer_list flower_stats_timer;
+
+ /* Ethtool Dump */
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+index 905c6fc4fc33..19fc550f5113 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+@@ -5814,7 +5814,9 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ dev_warn(&pdev->dev,
+ "could not offload tc u32, continuing\n");
+
+- cxgb4_init_tc_flower(adapter);
++ if (cxgb4_init_tc_flower(adapter))
++ dev_warn(&pdev->dev,
++ "could not offload tc flower, continuing\n");
+ }
+
+ if (is_offload(adapter) || is_hashfilter(adapter)) {
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+index 305df42d89ca..3c0304f18acd 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+@@ -75,13 +75,8 @@ static struct ch_tc_flower_entry *allocate_flower_entry(void)
+ static struct ch_tc_flower_entry *ch_flower_lookup(struct adapter *adap,
+ unsigned long flower_cookie)
+ {
+- struct ch_tc_flower_entry *flower_entry;
+-
+- hash_for_each_possible_rcu(adap->flower_anymatch_tbl, flower_entry,
+- link, flower_cookie)
+- if (flower_entry->tc_flower_cookie == flower_cookie)
+- return flower_entry;
+- return NULL;
++ return rhashtable_lookup_fast(&adap->flower_tbl, &flower_cookie,
++ adap->flower_ht_params);
+ }
+
+ static void cxgb4_process_flow_match(struct net_device *dev,
+@@ -713,12 +708,17 @@ int cxgb4_tc_flower_replace(struct net_device *dev,
+ goto free_entry;
+ }
+
+- INIT_HLIST_NODE(&ch_flower->link);
+ ch_flower->tc_flower_cookie = cls->cookie;
+ ch_flower->filter_id = ctx.tid;
+- hash_add_rcu(adap->flower_anymatch_tbl, &ch_flower->link, cls->cookie);
++ ret = rhashtable_insert_fast(&adap->flower_tbl, &ch_flower->node,
++ adap->flower_ht_params);
++ if (ret)
++ goto del_filter;
+
+- return ret;
++ return 0;
++
++del_filter:
++ cxgb4_del_filter(dev, ch_flower->filter_id, &ch_flower->fs);
+
+ free_entry:
+ kfree(ch_flower);
+@@ -740,7 +740,12 @@ int cxgb4_tc_flower_destroy(struct net_device *dev,
+ if (ret)
+ goto err;
+
+- hash_del_rcu(&ch_flower->link);
++ ret = rhashtable_remove_fast(&adap->flower_tbl, &ch_flower->node,
++ adap->flower_ht_params);
++ if (ret) {
++ netdev_err(dev, "Flow remove from rhashtable failed");
++ goto err;
++ }
+ kfree_rcu(ch_flower, rcu);
+
+ err:
+@@ -752,29 +757,38 @@ static void ch_flower_stats_cb(unsigned long data)
+ struct adapter *adap = (struct adapter *)data;
+ struct ch_tc_flower_entry *flower_entry;
+ struct ch_tc_flower_stats *ofld_stats;
+- unsigned int i;
++ struct rhashtable_iter iter;
+ u64 packets;
+ u64 bytes;
+ int ret;
+
+- rcu_read_lock();
+- hash_for_each_rcu(adap->flower_anymatch_tbl, i, flower_entry, link) {
+- ret = cxgb4_get_filter_counters(adap->port[0],
+- flower_entry->filter_id,
+- &packets, &bytes,
+- flower_entry->fs.hash);
+- if (!ret) {
+- spin_lock(&flower_entry->lock);
+- ofld_stats = &flower_entry->stats;
+-
+- if (ofld_stats->prev_packet_count != packets) {
+- ofld_stats->prev_packet_count = packets;
+- ofld_stats->last_used = jiffies;
++ rhashtable_walk_enter(&adap->flower_tbl, &iter);
++ do {
++ flower_entry = ERR_PTR(rhashtable_walk_start(&iter));
++ if (IS_ERR(flower_entry))
++ goto walk_stop;
++
++ while ((flower_entry = rhashtable_walk_next(&iter)) &&
++ !IS_ERR(flower_entry)) {
++ ret = cxgb4_get_filter_counters(adap->port[0],
++ flower_entry->filter_id,
++ &packets, &bytes,
++ flower_entry->fs.hash);
++ if (!ret) {
++ spin_lock(&flower_entry->lock);
++ ofld_stats = &flower_entry->stats;
++
++ if (ofld_stats->prev_packet_count != packets) {
++ ofld_stats->prev_packet_count = packets;
++ ofld_stats->last_used = jiffies;
++ }
++ spin_unlock(&flower_entry->lock);
+ }
+- spin_unlock(&flower_entry->lock);
+ }
+- }
+- rcu_read_unlock();
++walk_stop:
++ rhashtable_walk_stop(&iter);
++ } while (flower_entry == ERR_PTR(-EAGAIN));
++ rhashtable_walk_exit(&iter);
+ mod_timer(&adap->flower_stats_timer, jiffies + STATS_CHECK_PERIOD);
+ }
+
+@@ -820,16 +834,34 @@ int cxgb4_tc_flower_stats(struct net_device *dev,
+ return ret;
+ }
+
+-void cxgb4_init_tc_flower(struct adapter *adap)
++static const struct rhashtable_params cxgb4_tc_flower_ht_params = {
++ .nelem_hint = 384,
++ .head_offset = offsetof(struct ch_tc_flower_entry, node),
++ .key_offset = offsetof(struct ch_tc_flower_entry, tc_flower_cookie),
++ .key_len = sizeof(((struct ch_tc_flower_entry *)0)->tc_flower_cookie),
++ .max_size = 524288,
++ .min_size = 512,
++ .automatic_shrinking = true
++};
++
++int cxgb4_init_tc_flower(struct adapter *adap)
+ {
+- hash_init(adap->flower_anymatch_tbl);
++ int ret;
++
++ adap->flower_ht_params = cxgb4_tc_flower_ht_params;
++ ret = rhashtable_init(&adap->flower_tbl, &adap->flower_ht_params);
++ if (ret)
++ return ret;
++
+ setup_timer(&adap->flower_stats_timer, ch_flower_stats_cb,
+ (unsigned long)adap);
+ mod_timer(&adap->flower_stats_timer, jiffies + STATS_CHECK_PERIOD);
++ return 0;
+ }
+
+ void cxgb4_cleanup_tc_flower(struct adapter *adap)
+ {
+ if (adap->flower_stats_timer.function)
+ del_timer_sync(&adap->flower_stats_timer);
++ rhashtable_destroy(&adap->flower_tbl);
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h
+index 202d5c9ec303..050c8a50ae41 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.h
+@@ -48,7 +48,7 @@ struct ch_tc_flower_entry {
+ struct ch_filter_specification fs;
+ struct ch_tc_flower_stats stats;
+ unsigned long tc_flower_cookie;
+- struct hlist_node link;
++ struct rhash_head node;
+ struct rcu_head rcu;
+ spinlock_t lock; /* lock for stats */
+ u32 filter_id;
+@@ -115,6 +115,6 @@ int cxgb4_tc_flower_destroy(struct net_device *dev,
+ int cxgb4_tc_flower_stats(struct net_device *dev,
+ struct tc_cls_flower_offload *cls);
+
+-void cxgb4_init_tc_flower(struct adapter *adap);
++int cxgb4_init_tc_flower(struct adapter *adap);
+ void cxgb4_cleanup_tc_flower(struct adapter *adap);
+ #endif /* __CXGB4_TC_FLOWER_H */
+--
+2.12.3
+
diff --git a/patches.fixes/0001-cxgb4-update-supported-DCB-version.patch b/patches.fixes/0001-cxgb4-update-supported-DCB-version.patch
new file mode 100644
index 0000000000..74e3ee936f
--- /dev/null
+++ b/patches.fixes/0001-cxgb4-update-supported-DCB-version.patch
@@ -0,0 +1,87 @@
+From: Ganesh Goudar <ganeshgr@chelsio.com>
+Subject: cxgb4: update supported DCB version
+Patch-mainline: v4.20-rc1
+Git-commit: c3ec8bcceb07ab81e4ff017b4ebbacc137a5a15e
+References: bsc#1127371
+
+- In CXGB4_DCB_STATE_FW_INCOMPLETE state check if the dcb
+ version is changed and update the dcb supported version.
+
+- Also, fill the priority code point value for priority
+ based flow control.
+
+Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 27 ++++++++++++++++++++++++++
+ drivers/net/ethernet/chelsio/cxgb4/l2t.c | 6 ++++--
+ 2 files changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+index b34f0f077a31..6ba3104ff7eb 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+@@ -114,6 +114,24 @@ void cxgb4_dcb_reset(struct net_device *dev)
+ cxgb4_dcb_state_init(dev);
+ }
+
++/* update the dcb port support, if version is IEEE then set it to
++ * FW_PORT_DCB_VER_IEEE and if DCB_CAP_DCBX_VER_CEE is already set then
++ * clear that. and if it is set to CEE then set dcb supported to
++ * DCB_CAP_DCBX_VER_CEE & if DCB_CAP_DCBX_VER_IEEE is set, clear it
++ */
++static inline void cxgb4_dcb_update_support(struct port_dcb_info *dcb)
++{
++ if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE) {
++ if (dcb->supported & DCB_CAP_DCBX_VER_CEE)
++ dcb->supported &= ~DCB_CAP_DCBX_VER_CEE;
++ dcb->supported |= DCB_CAP_DCBX_VER_IEEE;
++ } else if (dcb->dcb_version == FW_PORT_DCB_VER_CEE1D01) {
++ if (dcb->supported & DCB_CAP_DCBX_VER_IEEE)
++ dcb->supported &= ~DCB_CAP_DCBX_VER_IEEE;
++ dcb->supported |= DCB_CAP_DCBX_VER_CEE;
++ }
++}
++
+ /* Finite State machine for Data Center Bridging.
+ */
+ void cxgb4_dcb_state_fsm(struct net_device *dev,
+@@ -165,6 +183,15 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
+ }
+
+ case CXGB4_DCB_STATE_FW_INCOMPLETE: {
++ if (transition_to != CXGB4_DCB_INPUT_FW_DISABLED) {
++ /* during this CXGB4_DCB_STATE_FW_INCOMPLETE state,
++ * check if the dcb version is changed (there can be
++ * mismatch in default config & the negotiated switch
++ * configuration at FW, so update the dcb support
++ * accordingly.
++ */
++ cxgb4_dcb_update_support(dcb);
++ }
+ switch (transition_to) {
+ case CXGB4_DCB_INPUT_FW_ENABLED: {
+ /* we're alreaady in firmware DCB mode */
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+index 301c4df8a566..99022c0898b5 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+@@ -433,10 +433,12 @@ struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
+ else
+ lport = netdev2pinfo(physdev)->lport;
+
+- if (is_vlan_dev(neigh->dev))
++ if (is_vlan_dev(neigh->dev)) {
+ vlan = vlan_dev_vlan_id(neigh->dev);
+- else
++ vlan |= vlan_dev_get_egress_qos_mask(neigh->dev, priority);
++ } else {
+ vlan = VLAN_NONE;
++ }
+
+ write_lock_bh(&d->lock);
+ for (e = d->l2tab[hash].first; e; e = e->next)
+--
+2.12.3
+
diff --git a/patches.fixes/cgroup-fix-parsing-empty-mount-option-string.patch b/patches.fixes/cgroup-fix-parsing-empty-mount-option-string.patch
new file mode 100644
index 0000000000..66dcfacb5e
--- /dev/null
+++ b/patches.fixes/cgroup-fix-parsing-empty-mount-option-string.patch
@@ -0,0 +1,45 @@
+From e250d91d65750a0c0c62483ac4f9f357e7317617 Mon Sep 17 00:00:00 2001
+From: Ondrej Mosnacek <omosnace@redhat.com>
+Date: Thu, 13 Dec 2018 15:17:37 +0100
+Subject: [PATCH] cgroup: fix parsing empty mount option string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: e250d91d65750a0c0c62483ac4f9f357e7317617
+Patch-mainline: v5.0-rc1
+References: bsc#1133094
+
+This fixes the case where all mount options specified are consumed by an
+LSM and all that's left is an empty string. In this case cgroupfs should
+accept the string and not fail.
+
+How to reproduce (with SELinux enabled):
+
+ # umount /sys/fs/cgroup/unified
+ # mount -o context=system_u:object_r:cgroup_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified
+ mount: /sys/fs/cgroup/unified: wrong fs type, bad option, bad superblock on cgroup2, missing codepage or helper program, or other error.
+ # dmesg | tail -n 1
+ [ 31.575952] cgroup: cgroup2: unknown option ""
+
+Fixes: 67e9c74b8a87 ("cgroup: replace __DEVEL__sane_behavior with cgroup2 fs type")
+[NOTE: should apply on top of commit 5136f6365ce3 ("cgroup: implement "nsdelegate" mount option"), older versions need manual rebase]
+Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
+Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+[mkoutny: adjusted for missing "nsdelegate" option]
+Signed-off-by: Michal Koutný <mkoutny@suse.com>
+---
+ kernel/cgroup/cgroup.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -1801,7 +1801,7 @@ static struct dentry *cgroup_mount(struc
+ cgroup_enable_task_cg_lists();
+
+ if (fs_type == &cgroup2_fs_type) {
+- if (data) {
++ if (data && *(char *)data != '\0') {
+ pr_err("cgroup2: unknown option \"%s\"\n", (char *)data);
+ put_cgroup_ns(ns);
+ return ERR_PTR(-EINVAL);
diff --git a/patches.fixes/fix-cgroup_do_mount-handling-of-failure-exits.patch b/patches.fixes/fix-cgroup_do_mount-handling-of-failure-exits.patch
new file mode 100644
index 0000000000..e13f0dbdc9
--- /dev/null
+++ b/patches.fixes/fix-cgroup_do_mount-handling-of-failure-exits.patch
@@ -0,0 +1,103 @@
+From 399504e21a10be16dd1408ba0147367d9d82a10c Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Sun, 6 Jan 2019 11:41:29 -0500
+Subject: [PATCH] fix cgroup_do_mount() handling of failure exits
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 399504e21a10be16dd1408ba0147367d9d82a10c
+Patch-mainline: v5.1-rc1
+References: bsc#1133095
+
+same story as with last May fixes in sysfs (7b745a4e4051
+"unfuck sysfs_mount()"); new_sb is left uninitialized
+in case of early errors in kernfs_mount_ns() and papering
+over it by treating any error from kernfs_mount_ns() as
+equivalent to !new_ns ends up conflating the cases when
+objects had never been transferred to a superblock with
+ones when that has happened and resulting new superblock
+had been dropped. Easily fixed (same way as in sysfs
+case). Additionally, there's a superblock leak on
+kernfs_node_dentry() failure *and* a dentry leak inside
+kernfs_node_dentry() itself - the latter on probably
+impossible errors, but the former not impossible to trigger
+(as the matter of fact, injecting allocation failures
+at that point *does* trigger it).
+
+Cc: stable@kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Michal Koutný <mkoutny@suse.com>
+---
+ fs/kernfs/mount.c | 8 ++++++--
+ kernel/cgroup/cgroup.c | 9 ++++++---
+ 2 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/fs/kernfs/mount.c b/fs/kernfs/mount.c
+index fdf527b6d79c..d71c9405874a 100644
+--- a/fs/kernfs/mount.c
++++ b/fs/kernfs/mount.c
+@@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn,
+ return dentry;
+
+ knparent = find_next_ancestor(kn, NULL);
+- if (WARN_ON(!knparent))
++ if (WARN_ON(!knparent)) {
++ dput(dentry);
+ return ERR_PTR(-EINVAL);
++ }
+
+ do {
+ struct dentry *dtmp;
+@@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn,
+ if (kn == knparent)
+ return dentry;
+ kntmp = find_next_ancestor(kn, knparent);
+- if (WARN_ON(!kntmp))
++ if (WARN_ON(!kntmp)) {
++ dput(dentry);
+ return ERR_PTR(-EINVAL);
++ }
+ dtmp = lookup_one_len_unlocked(kntmp->name, dentry,
+ strlen(kntmp->name));
+ dput(dentry);
+diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
+index f31bd61c9466..503bba3c4bae 100644
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -2033,7 +2033,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
+ struct cgroup_namespace *ns)
+ {
+ struct dentry *dentry;
+- bool new_sb;
++ bool new_sb = false;
+
+ dentry = kernfs_mount(fs_type, flags, root->kf_root, magic, &new_sb);
+
+@@ -2043,6 +2043,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
+ */
+ if (!IS_ERR(dentry) && ns != &init_cgroup_ns) {
+ struct dentry *nsdentry;
++ struct super_block *sb = dentry->d_sb;
+ struct cgroup *cgrp;
+
+ mutex_lock(&cgroup_mutex);
+@@ -2053,12 +2054,14 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
+ spin_unlock_irq(&css_set_lock);
+ mutex_unlock(&cgroup_mutex);
+
+- nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
++ nsdentry = kernfs_node_dentry(cgrp->kn, sb);
+ dput(dentry);
++ if (IS_ERR(nsdentry))
++ deactivate_locked_super(sb);
+ dentry = nsdentry;
+ }
+
+- if (IS_ERR(dentry) || !new_sb)
++ if (!new_sb)
+ cgroup_put(&root->cgrp);
+
+ return dentry;
+--
+2.16.4
+
diff --git a/patches.fixes/md-batch-flush-requests.patch b/patches.fixes/md-batch-flush-requests.patch
new file mode 100644
index 0000000000..a31b1e8f36
--- /dev/null
+++ b/patches.fixes/md-batch-flush-requests.patch
@@ -0,0 +1,169 @@
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:17 -0700
+Subject: [PATCH] md: batch flush requests.
+Git-commit: 2bc13b83e6298486371761de503faeffd15b7534
+Git-repo: git://git.kernel.dk/linux-block.git
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1119680
+
+Currently if many flush requests are submitted to an md device is quick
+succession, they are serialized and can take a long to process them all.
+We don't really need to call flush all those times - a single flush call
+can satisfy all requests submitted before it started.
+So keep track of when the current flush started and when it finished,
+allow any pending flush that was requested before the flush started
+to complete without waiting any more.
+
+Test results from Xiao:
+
+Test is done on a raid10 device which is created by 4 SSDs. The tool is
+dbench.
+
+1. The latest linux stable kernel
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 10.509 78.305
+ Flush 2078376 0.013 10.094
+ Close 21787697 0.019 18.821
+ LockX 96580 0.007 3.184
+ Mkdir 384 0.008 0.062
+ Rename 1255883 0.191 23.534
+ ReadX 46495589 0.020 14.230
+ WriteX 14790591 7.123 60.706
+ Unlink 5989118 0.440 54.551
+ UnlockX 96580 0.005 2.736
+ FIND_FIRST 10393845 0.042 12.079
+ SET_FILE_INFORMATION 2415558 0.129 10.088
+ QUERY_FILE_INFORMATION 4711725 0.005 8.462
+ QUERY_PATH_INFORMATION 26883327 0.032 21.715
+ QUERY_FS_INFORMATION 4929409 0.010 8.238
+ NTCreateX 29660080 0.100 53.268
+
+Throughput 1034.88 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.712 ms
+
+2. With patch1 "Revert "MD: fix lock contention for flush bios""
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 256 8.326 36.761
+ Flush 693291 3.974 180.269
+ Close 7266404 0.009 36.929
+ LockX 32160 0.006 0.840
+ Mkdir 128 0.008 0.021
+ Rename 418755 0.063 29.945
+ ReadX 15498708 0.007 7.216
+ WriteX 4932310 22.482 267.928
+ Unlink 1997557 0.109 47.553
+ UnlockX 32160 0.004 1.110
+ FIND_FIRST 3465791 0.036 7.320
+ SET_FILE_INFORMATION 805825 0.015 1.561
+ QUERY_FILE_INFORMATION 1570950 0.005 2.403
+ QUERY_PATH_INFORMATION 8965483 0.013 14.277
+ QUERY_FS_INFORMATION 1643626 0.009 3.314
+ NTCreateX 9892174 0.061 41.278
+
+Throughput 345.009 MB/sec (sync open) 128 clients 128 procs
+max_latency=267.939 m
+
+3. With patch1 and patch2
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 9.570 54.588
+ Flush 2061354 0.666 15.102
+ Close 21604811 0.012 25.697
+ LockX 95770 0.007 1.424
+ Mkdir 384 0.008 0.053
+ Rename 1245411 0.096 12.263
+ ReadX 46103198 0.011 12.116
+ WriteX 14667988 7.375 60.069
+ Unlink 5938936 0.173 30.905
+ UnlockX 95770 0.005 4.147
+ FIND_FIRST 10306407 0.041 11.715
+ SET_FILE_INFORMATION 2395987 0.048 7.640
+ QUERY_FILE_INFORMATION 4672371 0.005 9.291
+ QUERY_PATH_INFORMATION 26656735 0.018 19.719
+ QUERY_FS_INFORMATION 4887940 0.010 7.654
+ NTCreateX 29410811 0.059 28.551
+
+Throughput 1026.21 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.075 ms
+
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ drivers/md/md.c | 27 +++++++++++++++++++++++----
+ drivers/md/md.h | 3 +++
+ 2 files changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -434,6 +434,7 @@ static void submit_flushes(struct work_s
+ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+
++ mddev->start_flush = ktime_get_boottime();
+ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
+ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+@@ -474,6 +475,7 @@ static void md_submit_flush_data(struct
+ * could wait for this and below md_handle_request could wait for those
+ * bios because of suspend check
+ */
++ mddev->last_flush = mddev->start_flush;
+ mddev->flush_bio = NULL;
+ wake_up(&mddev->sb_wait);
+
+@@ -488,15 +490,32 @@ static void md_submit_flush_data(struct
+
+ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
++ ktime_t start = ktime_get_boottime();
+ spin_lock_irq(&mddev->lock);
+ wait_event_lock_irq(mddev->sb_wait,
+- !mddev->flush_bio,
++ !mddev->flush_bio ||
++ ktime_after(mddev->last_flush, start),
+ mddev->lock);
+- mddev->flush_bio = bio;
++ if (!ktime_after(mddev->last_flush, start)) {
++ WARN_ON(mddev->flush_bio);
++ mddev->flush_bio = bio;
++ bio = NULL;
++ }
+ spin_unlock_irq(&mddev->lock);
+
+- INIT_WORK(&mddev->flush_work, submit_flushes);
+- queue_work(md_wq, &mddev->flush_work);
++ if (!bio) {
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++ } else {
++ /* flush was performed for some other bio while we waited. */
++ if (bio->bi_iter.bi_size == 0)
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ mddev->pers->make_request(mddev, bio);
++ }
++ }
+ }
+ EXPORT_SYMBOL(md_flush_request);
+
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -466,6 +466,9 @@ struct mddev {
+ */
+ struct bio *flush_bio;
+ atomic_t flush_pending;
++ ktime_t start_flush, last_flush; /* last_flush is when the last completed
++ * flush was started.
++ */
+ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
diff --git a/patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch b/patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch
new file mode 100644
index 0000000000..e065b9b12e
--- /dev/null
+++ b/patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch
@@ -0,0 +1,29 @@
+From: Joerg Roedel <jroedel@suse.de>
+Date: Tue, 23 Apr 2019 17:25:00 +0200
+Subject: [PATCH] KVM: Fix kABI for AMD SMAP Errata workaround
+Patch-mainline: never, kABI workaround
+References: bsc#1133149
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/include/asm/kvm_host.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 1f9311659b4d..d6428246aa6d 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1112,9 +1112,8 @@ struct kvm_x86_ops {
+ int (*get_msr_feature)(struct kvm_msr_entry *entry);
+ struct kvm *(*vm_alloc)(void);
+ void (*vm_free)(struct kvm *);
+-#endif
+-
+ bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu);
++#endif
+ };
+
+ struct kvm_arch_async_pf {
+--
+2.16.3
+
diff --git a/patches.kabi/fix-kvm-kabi.patch b/patches.kabi/fix-kvm-kabi.patch
index 8c430e0fcf..12d3cdf828 100644
--- a/patches.kabi/fix-kvm-kabi.patch
+++ b/patches.kabi/fix-kvm-kabi.patch
@@ -21,7 +21,7 @@ Signed-off-by: Borislav Petkov <bp@suse.de>
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
-@@ -933,7 +933,7 @@ struct kvm_x86_ops {
+@@ -938,7 +938,7 @@ struct kvm_x86_ops {
int (*hardware_setup)(void); /* __init */
void (*hardware_unsetup)(void); /* __exit */
bool (*cpu_has_accelerated_tpr)(void);
@@ -30,14 +30,15 @@ Signed-off-by: Borislav Petkov <bp@suse.de>
void (*cpuid_update)(struct kvm_vcpu *vcpu);
struct kvm *(*vm_alloc)(void);
-@@ -1100,6 +1100,10 @@ struct kvm_x86_ops {
- int (*mem_enc_unreg_region)(struct kvm *kvm, struct kvm_enc_region *argp);
+@@ -1106,6 +1106,11 @@ struct kvm_x86_ops {
int (*get_msr_feature)(struct kvm_msr_entry *entry);
+
+
+#ifndef __GENKSYMS__
+ bool (*has_emulated_msr)(int index);
+#endif
++
+ bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu);
};
- struct kvm_arch_async_pf {
diff --git a/patches.kabi/kABI-Hide-get_msr_feature-in-kvm_x86_ops.patch b/patches.kabi/kABI-Hide-get_msr_feature-in-kvm_x86_ops.patch
index 98c3bb4ff1..f408d05979 100644
--- a/patches.kabi/kABI-Hide-get_msr_feature-in-kvm_x86_ops.patch
+++ b/patches.kabi/kABI-Hide-get_msr_feature-in-kvm_x86_ops.patch
@@ -9,22 +9,18 @@ Signed-off-by: Joerg Roedel <jroedel@suse.de>
arch/x86/include/asm/kvm_host.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index 71e9522a2931..29f1d4c95a0e 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
-@@ -1104,10 +1104,9 @@ struct kvm_x86_ops {
+@@ -1102,11 +1102,10 @@ struct kvm_x86_ops {
int (*mem_enc_reg_region)(struct kvm *kvm, struct kvm_enc_region *argp);
int (*mem_enc_unreg_region)(struct kvm *kvm, struct kvm_enc_region *argp);
- int (*get_msr_feature)(struct kvm_msr_entry *entry);
-
+
#ifndef __GENKSYMS__
bool (*has_emulated_msr)(int index);
+ int (*get_msr_feature)(struct kvm_msr_entry *entry);
struct kvm *(*vm_alloc)(void);
void (*vm_free)(struct kvm *);
#endif
---
-2.16.3
-
diff --git a/patches.kabi/kvm-x86-kABI-fix-for-vm_alloc-vm_free-changes.patch b/patches.kabi/kvm-x86-kABI-fix-for-vm_alloc-vm_free-changes.patch
index 3ca1d8822d..6631c9e436 100644
--- a/patches.kabi/kvm-x86-kABI-fix-for-vm_alloc-vm_free-changes.patch
+++ b/patches.kabi/kvm-x86-kABI-fix-for-vm_alloc-vm_free-changes.patch
@@ -12,11 +12,9 @@ Signed-off-by: Joerg Roedel <jroedel@suse.de>
arch/x86/include/asm/kvm_host.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index eb636fd65c4a..df03a343e18b 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
-@@ -943,8 +943,6 @@ struct kvm_x86_ops {
+@@ -941,8 +941,6 @@ struct kvm_x86_ops {
bool (*cpu_has_high_real_mode_segbase)(void);
void (*cpuid_update)(struct kvm_vcpu *vcpu);
@@ -25,15 +23,12 @@ index eb636fd65c4a..df03a343e18b 100644
int (*vm_init)(struct kvm *kvm);
void (*vm_destroy)(struct kvm *kvm);
-@@ -1108,6 +1106,8 @@ struct kvm_x86_ops {
+@@ -1109,6 +1107,8 @@ struct kvm_x86_ops {
#ifndef __GENKSYMS__
bool (*has_emulated_msr)(int index);
+ struct kvm *(*vm_alloc)(void);
+ void (*vm_free)(struct kvm *);
#endif
- };
---
-2.16.3
-
+ bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu);
diff --git a/patches.kabi/md-batch-flush-requests-kabi.patch b/patches.kabi/md-batch-flush-requests-kabi.patch
new file mode 100644
index 0000000000..b72a850995
--- /dev/null
+++ b/patches.kabi/md-batch-flush-requests-kabi.patch
@@ -0,0 +1,36 @@
+From: NeilBrown <neilb@suse.com>
+Subject: Fix kabi after "md: batch flush requests."
+Patch-mainline: Never, kabi
+References: bsc#1119680
+
+The new fields are private to md, so they can be hidden from the kabi.
+
+Acked-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Neil Brown <neilb@suse.com>
+
+---
+ drivers/md/md.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -466,9 +466,6 @@ struct mddev {
+ */
+ struct bio *flush_bio;
+ atomic_t flush_pending;
+- ktime_t start_flush, last_flush; /* last_flush is when the last completed
+- * flush was started.
+- */
+ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+@@ -477,6 +474,9 @@ struct mddev {
+
+ #ifndef __GENKSYMS__
+ bool has_superblocks:1;
++ ktime_t start_flush, last_flush; /* last_flush is when the last completed
++ * flush was started.
++ */
+ #endif
+ };
+
diff --git a/patches.kernel.org/0001-drm-udl-add-a-release-method-and-delay-modeset-teard.patch b/patches.kernel.org/0001-drm-udl-add-a-release-method-and-delay-modeset-teard.patch
new file mode 100644
index 0000000000..e22842bb77
--- /dev/null
+++ b/patches.kernel.org/0001-drm-udl-add-a-release-method-and-delay-modeset-teard.patch
@@ -0,0 +1,63 @@
+From 9b39b013037fbfa8d4b999345d9e904d8a336fc2 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Fri, 5 Apr 2019 13:17:13 +1000
+Subject: drm/udl: add a release method and delay modeset teardown
+Git-commit: 9b39b013037fbfa8d4b999345d9e904d8a336fc2
+Patch-mainline: v5.1-rc5
+References: bsc#1085536
+
+If we unplug a udl device, the usb callback with deinit the
+mode_config struct, however userspace will still have an open
+file descriptor and a framebuffer on that device. When userspace
+closes the fd, we'll oops because it'll try and look stuff up
+in the object idr which we've destroyed.
+
+This punts destroying the mode objects until release time instead.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190405031715.5959-2-airlied@gmail.com
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/udl/udl_drv.c | 1 +
+ drivers/gpu/drm/udl/udl_drv.h | 1 +
+ drivers/gpu/drm/udl/udl_main.c | 8 +++++++-
+ 3 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/udl/udl_drv.c
++++ b/drivers/gpu/drm/udl/udl_drv.c
+@@ -53,6 +53,7 @@ static struct drm_driver driver = {
+ .load = udl_driver_load,
+ .unload = udl_driver_unload,
+ .set_busid = udl_driver_set_busid,
++ .release = udl_driver_release,
+
+ /* gem hooks */
+ .gem_free_object = udl_gem_free_object,
+--- a/drivers/gpu/drm/udl/udl_drv.h
++++ b/drivers/gpu/drm/udl/udl_drv.h
+@@ -101,6 +101,7 @@ void udl_urb_completion(struct urb *urb)
+
+ int udl_driver_load(struct drm_device *dev, unsigned long flags);
+ void udl_driver_unload(struct drm_device *dev);
++void udl_driver_release(struct drm_device *dev);
+
+ int udl_fbdev_init(struct drm_device *dev);
+ void udl_fbdev_cleanup(struct drm_device *dev);
+--- a/drivers/gpu/drm/udl/udl_main.c
++++ b/drivers/gpu/drm/udl/udl_main.c
+@@ -380,6 +380,12 @@ void udl_driver_unload(struct drm_device
+ udl_free_urb_list(dev);
+
+ udl_fbdev_cleanup(dev);
+- udl_modeset_cleanup(dev);
+ kfree(udl);
+ }
++
++void udl_driver_release(struct drm_device *dev)
++{
++ udl_modeset_cleanup(dev);
++ drm_dev_fini(dev);
++ kfree(dev);
++}
diff --git a/series.conf b/series.conf
index b417fd6cd9..4f2a19b333 100644
--- a/series.conf
+++ b/series.conf
@@ -9171,6 +9171,7 @@
patches.drivers/cxgb4-add-support-to-create-hash-filters.patch
patches.drivers/cxgb4-add-support-to-delete-hash-filter.patch
patches.drivers/cxgb4-add-support-to-retrieve-stats-for-hash-filters.patch
+ patches.fixes/0001-cxgb4-convert-flower-table-to-use-rhashtable.patch
patches.drivers/cxgb4-add-support-to-create-hash-filters-via-tc-flow.patch
patches.fixes/bpf-fix-verifier-memory-leaks.patch
patches.drivers/Bluetooth-btusb-Add-new-NFA344A-entry
@@ -18111,6 +18112,7 @@
patches.fixes/kconfig-fix-the-rule-of-mainmenu_stmt-symbol.patch
patches.arch/x86-i8259-add-missing-include-file
patches.drivers/net-usb-r8152-use-irqsave-in-USB-s-complete-callback.patch
+ patches.fixes/0001-cxgb4-Add-flag-tc_flower_initialized.patch
patches.fixes/0001-cxgb4-Add-new-T5-PCI-device-id-0x50ae.patch
patches.drivers/net-hns3-rename-the-interface-for-init_client_instan.patch
patches.drivers/net-hns3-add-unlikely-for-error-check.patch
@@ -18358,6 +18360,7 @@
patches.drivers/PCI-hotplug-Don-t-leak-pci_slot-on-registration-fail
patches.drivers/PCI-pciehp-Fix-use-after-free-on-unplug
patches.fixes/PCI-pciehp-Fix-unprotected-list-iteration-in-IRQ-han.patch
+ patches.fixes/0001-PCI-pciehp-Convert-to-threaded-IRQ.patch
patches.drivers/PCI-Mark-fall-through-switch-cases-before-enabling-W.patch
patches.drivers/PCI-Convert-device-specific-ACS-quirks-from-NULL-ter.patch
patches.drivers/PCI-Restore-resized-BAR-state-on-resume
@@ -19265,6 +19268,7 @@
patches.drivers/net-hns3-Preserve-vlan-0-in-hardware-table.patch
patches.fixes/0001-Collect-descriptors-of-all-ULD-and-LLD-hardware-queu.patch
patches.fixes/0001-cxgb4-add-per-rx-queue-counter-for-packet-errors.patch
+ patches.fixes/0001-cxgb4-update-supported-DCB-version.patch
patches.arch/s390-qeth-invoke-softirqs-after-napi_schedule
patches.drivers/net-ibm-fix-return-type-of-ndo_start_xmit-function.patch
patches.drivers/net-hns3-Add-support-for-hns3_nic_netdev_ops.ndo_do_.patch
@@ -20465,6 +20469,7 @@
patches.drivers/misc-vexpress-Off-by-one-in-vexpress_syscfg_exec.patch
patches.fixes/genwqe-Fix-size-check.patch
patches.drivers/intel_th-msu-Fix-an-off-by-one-in-attribute-store.patch
+ patches.fixes/cgroup-fix-parsing-empty-mount-option-string.patch
patches.fixes/kconfig-fix-file-name-and-line-number-of-warn_ignore.patch
patches.fixes/kconfig-fix-memory-leak-when-EOF-is-encountered-in-q.patch
patches.suse/sched-fair-Fix-infinite-loop-in-update_blocked_averages-by-reverting-a9e7f6544b9c.patch
@@ -20934,6 +20939,7 @@
patches.drivers/geneve-correctly-handle-ipv6.disable-module-paramete.patch
patches.suse/net-sit-fix-memory-leak-in-sit_init_net.patch
patches.arch/x86-uaccess-don-t-leak-the-ac-flag-into-_put_user-value-evaluation.patch
+ patches.fixes/fix-cgroup_do_mount-handling-of-failure-exits.patch
patches.fixes/copy_mount_string-Limit-string-length-to-PATH_MAX.patch
patches.fixes/exec-Fix-mem-leak-in-kernel_read_file.patch
patches.drivers/mmc-sdhci-esdhc-imx-fix-HS400-timing-issue.patch
@@ -21013,6 +21019,7 @@
patches.arch/x86-cpu-amd-set-the-cpb-bit-unconditionally-on-f17h.patch
patches.drivers/soc-tegra-fuse-Fix-illegal-free-of-IO-base-address.patch
patches.drivers/soc-qcom-gsbi-Fix-error-handling-in-gsbi_probe.patch
+ patches.arch/intel_idle-add-support-for-Jacobsville.patch
patches.arch/powercap-intel_rapl-add-support-for-Jacobsville.patch
patches.drivers/cpufreq-tegra124-add-missing-of_node_put.patch
patches.drivers/ACPI-video-Refactor-and-fix-dmi_is_desktop.patch
@@ -21393,6 +21400,7 @@
patches.drivers/leds-pca9532-fix-a-potential-NULL-pointer-dereferenc.patch
patches.arch/powerpc-pseries-energy-Use-OF-accessor-functions-to-.patch
patches.arch/powerpc-pseries-mce-Fix-misleading-print-for-TLB-mut.patch
+ patches.arch/kvm-svm-workaround-errata-1096-insn_len-maybe-zero-on-smap-violation
patches.arch/kvm-x86-emulate-msr_ia32_arch_capabilities-on-amd-hosts.patch
patches.arch/x86-kvm-hyper-v-avoid-spurious-pending-stimer-on-vcpu-init
patches.fixes/batman-adv-Reduce-claim-hash-refcnt-only-for-removed.patch
@@ -21410,11 +21418,20 @@
patches.drivers/tpm-Fix-the-type-of-the-return-value-in-calc_tpm2_ev.patch
patches.drivers/NFC-nci-Add-some-bounds-checking-in-nci_hci_cmd_rece.patch
patches.drivers/Bluetooth-btusb-request-wake-pin-with-NOAUTOEN.patch
+ patches.kernel.org/0001-drm-udl-add-a-release-method-and-delay-modeset-teard.patch
+ patches.drm/0001-drm-mediatek-Fix-an-error-code-in-mtk_hdmi_dt_parse_.patch
+ patches.drm/drm-i915-gvt-Annotate-iomem-usage.patch
patches.drivers/ALSA-seq-Fix-OOB-reads-from-strlcpy.patch
patches.drivers/ALSA-hda-Add-two-more-machines-to-the-power_save_bla.patch
patches.drivers/iommu-amd-set-exclusion-range-correctly
patches.arch/powerpc-vdso32-fix-CLOCK_MONOTONIC-on-PPC64.patch
+ patches.fixes/0001-PCI-pciehp-Ignore-Link-State-Changes-after-powering-.patch
patches.arch/svm-avic-fix-invalidate-logical-apic-id-entry
+ patches.arch/x86-speculation-prevent-deadlock-on-ssb_state-lock.patch
+ patches.drivers/ALSA-hda-Initialize-power_state-field-properly.patch
+ patches.drivers/ALSA-info-Fix-racy-addition-deletion-of-nodes.patch
+ patches.drivers/ALSA-core-Fix-card-races-between-register-and-discon.patch
+ patches.drivers/ALSA-hda-realtek-add-two-more-pin-configuration-sets.patch
# davem/net
patches.drivers/ibmvnic-Enable-GRO.patch
@@ -21437,6 +21454,9 @@
patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
+ # git://git.kernel.dk/linux-block.git for-next
+ patches.fixes/md-batch-flush-requests.patch
+
# out-of-tree patches
patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
@@ -22180,6 +22200,10 @@
patches.kabi/kabi-protect-vhost_log_write.patch
patches.kabi/kabi-restore-icmp_send.patch
+ patches.kabi/md-batch-flush-requests-kabi.patch
+
+ patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch
+
########################################################
# You'd better have a good reason for adding a patch
# below here.