Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2018-08-08 07:34:19 +0200
committerKernel Build Daemon <kbuild@suse.de>2018-08-08 07:34:19 +0200
commit332f08c70b63e90fa18b271dad811a87fb37a137 (patch)
treedeb58c707eb47dc5868ad7b3538d505e43458f77
parentda75f396846152bf24bbf042afde42d0eefc262c (diff)
parentc298ec12f647e7ad74a9aa7d2c2fb4c9e2e6af1e (diff)
Merge branch 'SLE15' into openSUSE-15.0
-rw-r--r--blacklist.conf1
-rw-r--r--patches.arch/KVM-PPC-Check-if-IOMMU-page-is-contained-in-the-pinn.patch2
-rw-r--r--patches.drivers/ata-do-not-schedule-hot-plug-if-it-is-a-sas-host.patch60
-rw-r--r--patches.drivers/can-dev-increase-bus-off-message-severity49
-rw-r--r--patches.drivers/can-ems_usb-Fix-memory-leak-on-ems_usb_disconnect37
-rw-r--r--patches.drivers/can-m_can-change-comparison-to-bitshift-when-dealing36
-rw-r--r--patches.drivers/clk-renesas-cpg-mssr-Stop-using-printk-format-pCr78
-rw-r--r--patches.drivers/irqchip-brcmstb-l2-Define-an-irq_pm_shutdown-functio39
-rw-r--r--patches.drivers/irqchip-gic-Take-lock-when-updating-irq-type81
-rw-r--r--patches.drivers/irqchip-gic-v3-Change-pr_debug-message-to-pr_devel165
-rw-r--r--patches.drivers/irqchip-gic-v3-Fix-the-driver-probe-fail-due-to-disa95
-rw-r--r--patches.drivers/irqchip-gic-v3-Ignore-disabled-ITS-nodes76
-rw-r--r--patches.drivers/irqchip-gic-v3-Use-wmb-instead-of-smb_wmb-in-gic_rai44
-rw-r--r--patches.drivers/irqchip-qcom-Fix-check-for-spurious-interrupts53
-rw-r--r--patches.drivers/irqchip-qcom-Fix-u32-comparison-with-value-less-than40
-rw-r--r--patches.drivers/iwlwifi-add-more-card-IDs-for-9000-series239
-rw-r--r--patches.drivers/misc-pci_endpoint_test-Avoid-triggering-a-BUG.patch38
-rw-r--r--patches.drivers/scsi-libsas-defer-ata-device-eh-commands-to-libata.patch131
-rw-r--r--patches.fixes/0001-fscache-Allow-cancelled-operations-to-be-enqueued.patch44
-rw-r--r--patches.fixes/0002-cachefiles-Fix-refcounting-bug-in-backing-file-read-.patch117
-rw-r--r--patches.fixes/0003-fscache-Fix-reference-overput-in-fscache_attach_obje.patch176
-rw-r--r--patches.fixes/0004-cachefiles-Fix-missing-clear-of-the-CACHEFILES_OBJEC.patch73
-rw-r--r--patches.fixes/0005-cachefiles-Wait-rather-than-BUG-ing-on-Unexpected-ob.patch36
-rw-r--r--patches.fixes/ARM-davinci-board-omapl138-hawk-fix-GPIO-numbers-for.patch51
-rw-r--r--patches.fixes/audit-fix-potential-null-dereference-context-module.patch54
-rw-r--r--patches.fixes/coccinelle-fix-parallel-build-with-CHECK-scripts-coc.patch86
-rw-r--r--patches.fixes/ibmasm-don-t-write-out-of-bounds-in-read-handler.patch68
-rw-r--r--patches.fixes/kbuild-Handle-builtin-dtb-file-names-containing-hyph.patch74
-rw-r--r--patches.fixes/kbuild-add-fno-stack-check-to-kernel-build-options.patch54
-rw-r--r--patches.fixes/kbuild-pkg-use-transform-option-to-prefix-paths-in-t.patch56
-rw-r--r--patches.fixes/kconfig-display-recursive-dependency-resolution-hint.patch68
-rw-r--r--patches.fixes/kmemleak-add-scheduling-point-to-kmemleak_scan.patch55
-rw-r--r--patches.fixes/mm-kmemleak.c-make-cond_resched-rate-limiting-more-e.patch42
-rw-r--r--patches.suse/sctp-fix-the-issue-that-pathmtu-may-be-set-lower-tha.patch48
-rw-r--r--patches.suse/sctp-introduce-sctp_dst_mtu.patch70
-rw-r--r--patches.suse/x86-Treat-R_X86_64_PLT32-as-R_X86_64_PC32.patch84
-rw-r--r--series.conf34
37 files changed, 2553 insertions, 1 deletions
diff --git a/blacklist.conf b/blacklist.conf
index b5c18a4344..eeae2c4637 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -432,3 +432,4 @@ be0f272bfc83797f70d44faca86954df62e2bbc0 # arm64: no support for ftrace far bran
932b50c7c1c65e6f23002e075b97ee083c4a9e71 # arm64: Falkor: already in with mainline commit id 3060e9f0d14b
acfb3b883f6d6a4b5d27ad7fdded11f6a09ae6dd # arm64: KVM: already in with mainline commit id 20e8175d246e
bb48711800e6d7aedbf4dfd3367e0ab1270a6bea # arm64: we don't support kyro
+6f6060a5c9cc76fdbc22748264e6aa3779ec2427 # apm is not enabled in config
diff --git a/patches.arch/KVM-PPC-Check-if-IOMMU-page-is-contained-in-the-pinn.patch b/patches.arch/KVM-PPC-Check-if-IOMMU-page-is-contained-in-the-pinn.patch
index 65d3258cf7..3e5422d07b 100644
--- a/patches.arch/KVM-PPC-Check-if-IOMMU-page-is-contained-in-the-pinn.patch
+++ b/patches.arch/KVM-PPC-Check-if-IOMMU-page-is-contained-in-the-pinn.patch
@@ -4,7 +4,7 @@ Date: Tue, 24 Jul 2018 15:32:47 +1000
Subject: [PATCH] KVM: PPC: Check if IOMMU page is contained in the pinned
physical page
-References: bsc#1077761, git-fixes
+References: bsc#1077761, git-fixes, bsc#1103948, bsc#1103949
Patch-mainline: v4.18-rc6
Git-commit: 76fa4975f3ed12d15762bc979ca44078598ed8ee
diff --git a/patches.drivers/ata-do-not-schedule-hot-plug-if-it-is-a-sas-host.patch b/patches.drivers/ata-do-not-schedule-hot-plug-if-it-is-a-sas-host.patch
new file mode 100644
index 0000000000..49f81d0009
--- /dev/null
+++ b/patches.drivers/ata-do-not-schedule-hot-plug-if-it-is-a-sas-host.patch
@@ -0,0 +1,60 @@
+From: Jason Yan <yanaijie@huawei.com>
+Date: Wed, 28 Feb 2018 09:11:10 +0800
+Subject: ata: do not schedule hot plug if it is a sas host
+Git-commit: 6f54120e17e311fd7ac42b9ec2a0611caa5b46ad
+Patch-mainline: v4.16-rc7
+References: FATE#326253
+
+We've got a kernel panic when using sata disk with sas controller:
+
+[115946.152283] Unable to handle kernel NULL pointer dereference at virtual address 000007d8
+[115946.223963] CPU: 0 PID: 22175 Comm: kworker/0:1 Tainted: G W OEL 4.14.0 #1
+[115946.232925] Workqueue: events ata_scsi_hotplug
+[115946.237938] task: ffff8021ee50b180 task.stack: ffff00000d5d0000
+[115946.244717] PC is at sas_find_dev_by_rphy+0x44/0x114
+[115946.250224] LR is at sas_find_dev_by_rphy+0x3c/0x114
+......
+[115946.355701] Process kworker/0:1 (pid: 22175, stack limit = 0xffff00000d5d0000)
+[115946.363369] Call trace:
+[115946.456356] [<ffff000008878a9c>] sas_find_dev_by_rphy+0x44/0x114
+[115946.462908] [<ffff000008878b8c>] sas_target_alloc+0x20/0x5c
+[115946.469408] [<ffff00000885a31c>] scsi_alloc_target+0x250/0x308
+[115946.475781] [<ffff00000885ba30>] __scsi_add_device+0xb0/0x154
+[115946.481991] [<ffff0000088b520c>] ata_scsi_scan_host+0x180/0x218
+[115946.488367] [<ffff0000088b53d8>] ata_scsi_hotplug+0xb0/0xcc
+[115946.494801] [<ffff0000080ebd70>] process_one_work+0x144/0x390
+[115946.501115] [<ffff0000080ec100>] worker_thread+0x144/0x418
+[115946.507093] [<ffff0000080f2c98>] kthread+0x10c/0x138
+[115946.512792] [<ffff0000080855dc>] ret_from_fork+0x10/0x18
+
+We found that Ding Xiang has reported a similar bug before:
+https://patchwork.kernel.org/patch/9179817/
+
+And this bug still exists in mainline. Since libsas handles hotplug and
+device adding/removing itself, do not need to schedule ata hot plug task
+here if it is a sas host.
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+Cc: Ding Xiang <dingxiang@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/ata/libata-eh.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 11c3137d7b0a..c016829a38fd 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -815,7 +815,8 @@ void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap)
+
+ if (ap->pflags & ATA_PFLAG_LOADING)
+ ap->pflags &= ~ATA_PFLAG_LOADING;
+- else if (ap->pflags & ATA_PFLAG_SCSI_HOTPLUG)
++ else if ((ap->pflags & ATA_PFLAG_SCSI_HOTPLUG) &&
++ !(ap->flags & ATA_FLAG_SAS_HOST))
+ schedule_delayed_work(&ap->hotplug_task, 0);
+
+ if (ap->pflags & ATA_PFLAG_RECOVERED)
+
diff --git a/patches.drivers/can-dev-increase-bus-off-message-severity b/patches.drivers/can-dev-increase-bus-off-message-severity
new file mode 100644
index 0000000000..525bc0b940
--- /dev/null
+++ b/patches.drivers/can-dev-increase-bus-off-message-severity
@@ -0,0 +1,49 @@
+From 71c23a821c6bcacba71a094efe49ee689605906b Mon Sep 17 00:00:00 2001
+From: Jakob Unterwurzacher <jakob.unterwurzacher@theobroma-systems.com>
+Date: Wed, 18 Apr 2018 16:10:03 +0200
+Subject: [PATCH] can: dev: increase bus-off message severity
+Git-commit: 71c23a821c6bcacba71a094efe49ee689605906b
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+bus-off is usually caused by hardware malfunction or configuration error
+(baud rate mismatch) and causes a complete loss of communication.
+
+Increase the "bus-off" message's severity from netdev_dbg() to
+netdev_info() to make it visible to the user.
+
+A can interface going into bus-off is similar in severity to ethernet's
+"Link is Down" message, which is also printed at info level.
+
+It is debatable whether the the "restarted" message should also be
+changed to netdev_info() to make the interface state changes
+comprehensible from the kernel log. I have chosen to keep the
+"restarted" message at dbg for now as the "bus-off" message should be
+enough for the user to notice and investigate the problem.
+
+Signed-off-by: Jakob Unterwurzacher <jakob.unterwurzacher@theobroma-systems.com>
+Cc: linux-can@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index b1779566c5bb..3c71f1cb205f 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -605,7 +605,7 @@ void can_bus_off(struct net_device *dev)
+ {
+ struct can_priv *priv = netdev_priv(dev);
+
+- netdev_dbg(dev, "bus-off\n");
++ netdev_info(dev, "bus-off\n");
+
+ netif_carrier_off(dev);
+
+--
+2.18.0
+
diff --git a/patches.drivers/can-ems_usb-Fix-memory-leak-on-ems_usb_disconnect b/patches.drivers/can-ems_usb-Fix-memory-leak-on-ems_usb_disconnect
new file mode 100644
index 0000000000..04107c34c7
--- /dev/null
+++ b/patches.drivers/can-ems_usb-Fix-memory-leak-on-ems_usb_disconnect
@@ -0,0 +1,37 @@
+From 72c05f32f4a5055c9c8fe889bb6903ec959c0aad Mon Sep 17 00:00:00 2001
+From: Anton Vasilyev <vasilyev@ispras.ru>
+Date: Fri, 27 Jul 2018 18:50:42 +0300
+Subject: [PATCH] can: ems_usb: Fix memory leak on ems_usb_disconnect()
+Git-commit: 72c05f32f4a5055c9c8fe889bb6903ec959c0aad
+Patch-mainline: v4.18-rc8
+References: bsc#1051510
+
+ems_usb_probe() allocates memory for dev->tx_msg_buffer, but there
+is no its deallocation in ems_usb_disconnect().
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/usb/ems_usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
+index 12ff0020ecd6..b7dfd4109d24 100644
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -1072,6 +1072,7 @@ static void ems_usb_disconnect(struct usb_interface *intf)
+ usb_free_urb(dev->intr_urb);
+
+ kfree(dev->intr_in_buffer);
++ kfree(dev->tx_msg_buffer);
+ }
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/can-m_can-change-comparison-to-bitshift-when-dealing b/patches.drivers/can-m_can-change-comparison-to-bitshift-when-dealing
new file mode 100644
index 0000000000..c228cc898c
--- /dev/null
+++ b/patches.drivers/can-m_can-change-comparison-to-bitshift-when-dealing
@@ -0,0 +1,36 @@
+From b7db978ac283b237835129ac87f26cbac94d04e7 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 6 Feb 2018 09:52:07 +0100
+Subject: [PATCH] can: m_can: change comparison to bitshift when dealing with a mask
+Git-commit: b7db978ac283b237835129ac87f26cbac94d04e7
+Patch-mainline: v4.16-rc7
+References: bsc#1051510
+
+Due to a typo, the mask was destroyed by a comparison instead of a bit
+shift.
+
+Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/m_can/m_can.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 2594f7779c6f..74170b0d23cf 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -253,7 +253,7 @@ enum m_can_mram_cfg {
+
+ /* Rx FIFO 0/1 Configuration (RXF0C/RXF1C) */
+ #define RXFC_FWM_SHIFT 24
+-#define RXFC_FWM_MASK (0x7f < RXFC_FWM_SHIFT)
++#define RXFC_FWM_MASK (0x7f << RXFC_FWM_SHIFT)
+ #define RXFC_FS_SHIFT 16
+ #define RXFC_FS_MASK (0x7f << RXFC_FS_SHIFT)
+
+--
+2.18.0
+
diff --git a/patches.drivers/clk-renesas-cpg-mssr-Stop-using-printk-format-pCr b/patches.drivers/clk-renesas-cpg-mssr-Stop-using-printk-format-pCr
new file mode 100644
index 0000000000..0a014055e8
--- /dev/null
+++ b/patches.drivers/clk-renesas-cpg-mssr-Stop-using-printk-format-pCr
@@ -0,0 +1,78 @@
+From ef4b0be62641d296cf4c0ad8f75ab83ab066ed51 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 1 Jun 2018 11:28:19 +0200
+Subject: [PATCH] clk: renesas: cpg-mssr: Stop using printk format %pCr
+Git-commit: ef4b0be62641d296cf4c0ad8f75ab83ab066ed51
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+Printk format "%pCr" will be removed soon, as clk_get_rate() must not be
+called in atomic context.
+
+Replace it by open-coding the operation. This is safe here, as the code
+runs in task context.
+
+Link: http://lkml.kernel.org/r/1527845302-12159-2-git-send-email-geert+renesas@glider.be
+To: Jia-Ju Bai <baijiaju1990@gmail.com>
+To: Jonathan Corbet <corbet@lwn.net>
+To: Michael Turquette <mturquette@baylibre.com>
+To: Stephen Boyd <sboyd@kernel.org>
+To: Zhang Rui <rui.zhang@intel.com>
+To: Eduardo Valentin <edubezval@gmail.com>
+To: Eric Anholt <eric@anholt.net>
+To: Stefan Wahren <stefan.wahren@i2se.com>
+To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: linux-doc@vger.kernel.org
+Cc: linux-clk@vger.kernel.org
+Cc: linux-pm@vger.kernel.org
+Cc: linux-serial@vger.kernel.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-renesas-soc@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: stable@vger.kernel.org # 4.5+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Petr Mladek <pmladek@suse.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/renesas/renesas-cpg-mssr.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/renesas/renesas-cpg-mssr.c
++++ b/drivers/clk/renesas/renesas-cpg-mssr.c
+@@ -248,8 +248,9 @@ struct clk *cpg_mssr_clk_src_twocell_get
+ dev_err(dev, "Cannot get %s clock %u: %ld", type, clkidx,
+ PTR_ERR(clk));
+ else
+- dev_dbg(dev, "clock (%u, %u) is %pC at %pCr Hz\n",
+- clkspec->args[0], clkspec->args[1], clk, clk);
++ dev_dbg(dev, "clock (%u, %u) is %pC at %lu Hz\n",
++ clkspec->args[0], clkspec->args[1], clk,
++ clk_get_rate(clk));
+ return clk;
+ }
+
+@@ -314,7 +315,7 @@ static void __init cpg_mssr_register_cor
+ if (IS_ERR_OR_NULL(clk))
+ goto fail;
+
+- dev_dbg(dev, "Core clock %pC at %pCr Hz\n", clk, clk);
++ dev_dbg(dev, "Core clock %pC at %lu Hz\n", clk, clk_get_rate(clk));
+ priv->clks[id] = clk;
+ return;
+
+@@ -380,7 +381,7 @@ static void __init cpg_mssr_register_mod
+ if (IS_ERR(clk))
+ goto fail;
+
+- dev_dbg(dev, "Module clock %pC at %pCr Hz\n", clk, clk);
++ dev_dbg(dev, "Module clock %pC at %lu Hz\n", clk, clk_get_rate(clk));
+ priv->clks[id] = clk;
+ return;
+
diff --git a/patches.drivers/irqchip-brcmstb-l2-Define-an-irq_pm_shutdown-functio b/patches.drivers/irqchip-brcmstb-l2-Define-an-irq_pm_shutdown-functio
new file mode 100644
index 0000000000..3c6df8079a
--- /dev/null
+++ b/patches.drivers/irqchip-brcmstb-l2-Define-an-irq_pm_shutdown-functio
@@ -0,0 +1,39 @@
+From c017d21147848fe017772764a77a7f32c5b017f9 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 27 Jul 2017 15:38:17 -0700
+Subject: [PATCH] irqchip: brcmstb-l2: Define an irq_pm_shutdown function
+Git-commit: c017d21147848fe017772764a77a7f32c5b017f9
+Patch-mainline: v4.13-rc6
+References: bsc#1051510
+
+The Broadcom STB platforms support S5 and we allow specific hardware
+wake-up events to take us out of this state. Because we were not
+defining an irq_pm_shutdown() function pointer, we would not be
+correctly masking non-wakeup events, which would result in spurious
+wake-ups from sources that were not explicitly configured for wake-up.
+
+Fixes: 7f646e92766e ("irqchip: brcmstb-l2: Add Broadcom Set Top Box Level-2 interrupt controller")
+Acked-by: Gregory Fong <gregory.0xf0@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-brcmstb-l2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/irqchip/irq-brcmstb-l2.c b/drivers/irqchip/irq-brcmstb-l2.c
+index bddf169c4b37..b009b916a292 100644
+--- a/drivers/irqchip/irq-brcmstb-l2.c
++++ b/drivers/irqchip/irq-brcmstb-l2.c
+@@ -189,6 +189,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,
+
+ ct->chip.irq_suspend = brcmstb_l2_intc_suspend;
+ ct->chip.irq_resume = brcmstb_l2_intc_resume;
++ ct->chip.irq_pm_shutdown = brcmstb_l2_intc_suspend;
+
+ if (data->can_wake) {
+ /* This IRQ chip can wake the system, set all child interrupts
+--
+2.18.0
+
diff --git a/patches.drivers/irqchip-gic-Take-lock-when-updating-irq-type b/patches.drivers/irqchip-gic-Take-lock-when-updating-irq-type
new file mode 100644
index 0000000000..971e70c916
--- /dev/null
+++ b/patches.drivers/irqchip-gic-Take-lock-when-updating-irq-type
@@ -0,0 +1,81 @@
+From aa08192a254d362a4d5317647a81de6996961aef Mon Sep 17 00:00:00 2001
+From: Aniruddha Banerjee <aniruddhab@nvidia.com>
+Date: Wed, 28 Mar 2018 19:12:00 +0530
+Subject: [PATCH] irqchip/gic: Take lock when updating irq type
+Git-commit: aa08192a254d362a4d5317647a81de6996961aef
+Patch-mainline: v4.17-rc1
+References: bsc#1051510
+
+Most MMIO GIC register accesses use a 1-hot bit scheme that
+avoids requiring any form of locking. This isn't true for the
+GICD_ICFGRn registers, which require a RMW sequence.
+
+Unfortunately, we seem to be missing a lock for these particular
+accesses, which could result in a race condition if changing the
+trigger type on any two interrupts within the same set of 16
+interrupts (and thus controlled by the same CFGR register).
+
+Introduce a private lock in the GIC common comde for this
+particular case, making it cover both GIC implementations
+in one go.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Aniruddha Banerjee <aniruddhab@nvidia.com>
+[maz: updated changelog]
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-common.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c
+index 30017df5b54c..01e673c680cd 100644
+--- a/drivers/irqchip/irq-gic-common.c
++++ b/drivers/irqchip/irq-gic-common.c
+@@ -21,6 +21,8 @@
+
+ #include "irq-gic-common.h"
+
++static DEFINE_RAW_SPINLOCK(irq_controller_lock);
++
+ static const struct gic_kvm_info *gic_kvm_info;
+
+ const struct gic_kvm_info *gic_get_kvm_info(void)
+@@ -53,11 +55,13 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
+ u32 confoff = (irq / 16) * 4;
+ u32 val, oldval;
+ int ret = 0;
++ unsigned long flags;
+
+ /*
+ * Read current configuration register, and insert the config
+ * for "irq", depending on "type".
+ */
++ raw_spin_lock_irqsave(&irq_controller_lock, flags);
+ val = oldval = readl_relaxed(base + GIC_DIST_CONFIG + confoff);
+ if (type & IRQ_TYPE_LEVEL_MASK)
+ val &= ~confmask;
+@@ -65,8 +69,10 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
+ val |= confmask;
+
+ /* If the current configuration is the same, then we are done */
+- if (val == oldval)
++ if (val == oldval) {
++ raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
+ return 0;
++ }
+
+ /*
+ * Write back the new configuration, and possibly re-enable
+@@ -84,6 +90,7 @@ int gic_configure_irq(unsigned int irq, unsigned int type,
+ pr_warn("GIC: PPI%d is secure or misconfigured\n",
+ irq - 16);
+ }
++ raw_spin_unlock_irqrestore(&irq_controller_lock, flags);
+
+ if (sync_access)
+ sync_access();
+--
+2.18.0
+
diff --git a/patches.drivers/irqchip-gic-v3-Change-pr_debug-message-to-pr_devel b/patches.drivers/irqchip-gic-v3-Change-pr_debug-message-to-pr_devel
new file mode 100644
index 0000000000..351d7c1b35
--- /dev/null
+++ b/patches.drivers/irqchip-gic-v3-Change-pr_debug-message-to-pr_devel
@@ -0,0 +1,165 @@
+From b6dd4d83dc2f78cebc9a7e6e7e4bc2be4d29b94d Mon Sep 17 00:00:00 2001
+From: Mark Salter <msalter@redhat.com>
+Date: Fri, 2 Feb 2018 09:20:29 -0500
+Subject: [PATCH] irqchip/gic-v3: Change pr_debug message to pr_devel
+Git-commit: b6dd4d83dc2f78cebc9a7e6e7e4bc2be4d29b94d
+Patch-mainline: v4.16-rc2
+References: bsc#1051510
+
+The pr_debug() in gic-v3 gic_send_sgi() can trigger a circular locking
+Warning:
+
+ GICv3: CPU10: ICC_SGI1R_EL1 5000400
+ ======================================================
+ WARNING: possible circular locking dependency detected
+ 4.15.0+ #1 Tainted: G W
+ ------------------------------------------------------
+ dynamic_debug01/1873 is trying to acquire lock:
+ ((console_sem).lock){-...}, at: [<0000000099c891ec>] down_trylock+0x20/0x4c
+
+ but task is already holding lock:
+ (&rq->lock){-.-.}, at: [<00000000842e1587>] __task_rq_lock+0x54/0xdc
+
+ which lock already depends on the new lock.
+
+ the existing dependency chain (in reverse order) is:
+
+ -> #2 (&rq->lock){-.-.}:
+ __lock_acquire+0x3b4/0x6e0
+ lock_acquire+0xf4/0x2a8
+ _raw_spin_lock+0x4c/0x60
+ task_fork_fair+0x3c/0x148
+ sched_fork+0x10c/0x214
+ copy_process.isra.32.part.33+0x4e8/0x14f0
+ _do_fork+0xe8/0x78c
+ kernel_thread+0x48/0x54
+ rest_init+0x34/0x2a4
+ start_kernel+0x45c/0x488
+
+ -> #1 (&p->pi_lock){-.-.}:
+ __lock_acquire+0x3b4/0x6e0
+ lock_acquire+0xf4/0x2a8
+ _raw_spin_lock_irqsave+0x58/0x70
+ try_to_wake_up+0x48/0x600
+ wake_up_process+0x28/0x34
+ __up.isra.0+0x60/0x6c
+ up+0x60/0x68
+ __up_console_sem+0x4c/0x7c
+ console_unlock+0x328/0x634
+ vprintk_emit+0x25c/0x390
+ dev_vprintk_emit+0xc4/0x1fc
+ dev_printk_emit+0x88/0xa8
+ __dev_printk+0x58/0x9c
+ _dev_info+0x84/0xa8
+ usb_new_device+0x100/0x474
+ hub_port_connect+0x280/0x92c
+ hub_event+0x740/0xa84
+ process_one_work+0x240/0x70c
+ worker_thread+0x60/0x400
+ kthread+0x110/0x13c
+ ret_from_fork+0x10/0x18
+
+ -> #0 ((console_sem).lock){-...}:
+ validate_chain.isra.34+0x6e4/0xa20
+ __lock_acquire+0x3b4/0x6e0
+ lock_acquire+0xf4/0x2a8
+ _raw_spin_lock_irqsave+0x58/0x70
+ down_trylock+0x20/0x4c
+ __down_trylock_console_sem+0x3c/0x9c
+ console_trylock+0x20/0xb0
+ vprintk_emit+0x254/0x390
+ vprintk_default+0x58/0x90
+ vprintk_func+0xbc/0x164
+ printk+0x80/0xa0
+ __dynamic_pr_debug+0x84/0xac
+ gic_raise_softirq+0x184/0x18c
+ smp_cross_call+0xac/0x218
+ smp_send_reschedule+0x3c/0x48
+ resched_curr+0x60/0x9c
+ check_preempt_curr+0x70/0xdc
+ wake_up_new_task+0x310/0x470
+ _do_fork+0x188/0x78c
+ SyS_clone+0x44/0x50
+ __sys_trace_return+0x0/0x4
+
+ other info that might help us debug this:
+
+ Chain exists of:
+ (console_sem).lock --> &p->pi_lock --> &rq->lock
+
+ Possible unsafe locking scenario:
+
+ CPU0 CPU1
+ ---- ----
+ lock(&rq->lock);
+ lock(&p->pi_lock);
+ lock(&rq->lock);
+ lock((console_sem).lock);
+
+ *** DEADLOCK ***
+
+ 2 locks held by dynamic_debug01/1873:
+ #0: (&p->pi_lock){-.-.}, at: [<000000001366df53>] wake_up_new_task+0x40/0x470
+ #1: (&rq->lock){-.-.}, at: [<00000000842e1587>] __task_rq_lock+0x54/0xdc
+
+ stack backtrace:
+ CPU: 10 PID: 1873 Comm: dynamic_debug01 Tainted: G W 4.15.0+ #1
+ Hardware name: GIGABYTE R120-T34-00/MT30-GS2-00, BIOS T48 10/02/2017
+ Call trace:
+ dump_backtrace+0x0/0x188
+ show_stack+0x24/0x2c
+ dump_stack+0xa4/0xe0
+ print_circular_bug.isra.31+0x29c/0x2b8
+ check_prev_add.constprop.39+0x6c8/0x6dc
+ validate_chain.isra.34+0x6e4/0xa20
+ __lock_acquire+0x3b4/0x6e0
+ lock_acquire+0xf4/0x2a8
+ _raw_spin_lock_irqsave+0x58/0x70
+ down_trylock+0x20/0x4c
+ __down_trylock_console_sem+0x3c/0x9c
+ console_trylock+0x20/0xb0
+ vprintk_emit+0x254/0x390
+ vprintk_default+0x58/0x90
+ vprintk_func+0xbc/0x164
+ printk+0x80/0xa0
+ __dynamic_pr_debug+0x84/0xac
+ gic_raise_softirq+0x184/0x18c
+ smp_cross_call+0xac/0x218
+ smp_send_reschedule+0x3c/0x48
+ resched_curr+0x60/0x9c
+ check_preempt_curr+0x70/0xdc
+ wake_up_new_task+0x310/0x470
+ _do_fork+0x188/0x78c
+ SyS_clone+0x44/0x50
+ __sys_trace_return+0x0/0x4
+ GICv3: CPU0: ICC_SGI1R_EL1 12000
+
+This could be fixed with printk_deferred() but that might lessen its
+usefulness for debugging. So change it to pr_devel to keep it out of
+production kernels. Developers working on gic-v3 can enable it as
+needed in their kernels.
+
+Signed-off-by: Mark Salter <msalter@redhat.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-v3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index a57c0fbbd34a..d71be9a1f9d2 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -673,7 +673,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq)
+ MPIDR_TO_SGI_RS(cluster_id) |
+ tlist << ICC_SGI1R_TARGET_LIST_SHIFT);
+
+- pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
++ pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val);
+ gic_write_sgi1r(val);
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/irqchip-gic-v3-Fix-the-driver-probe-fail-due-to-disa b/patches.drivers/irqchip-gic-v3-Fix-the-driver-probe-fail-due-to-disa
new file mode 100644
index 0000000000..263333dac7
--- /dev/null
+++ b/patches.drivers/irqchip-gic-v3-Fix-the-driver-probe-fail-due-to-disa
@@ -0,0 +1,95 @@
+From ebe2f8718007d5a1238bb3cb8141b5bb2b4d5773 Mon Sep 17 00:00:00 2001
+From: Shanker Donthineni <shankerd@codeaurora.org>
+Date: Tue, 5 Dec 2017 13:16:21 -0600
+Subject: [PATCH] irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry
+Git-commit: ebe2f8718007d5a1238bb3cb8141b5bb2b4d5773
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+The ACPI specification says OS shouldn't attempt to use GICC configuration
+parameters if the flag ACPI_MADT_ENABLED is cleared. The ARM64-SMP code
+skips the disabled GICC entries but not causing any issue. However the
+current GICv3 driver probe bails out causing kernel panic() instead of
+skipping the disabled GICC interfaces. This issue happens on systems
+where redistributor regions are not in the always-on power domain and
+one of GICC interface marked with ACPI_MADT_ENABLED=0.
+
+This patch does the two things to fix the panic.
+ - Don't return an error in gic_acpi_match_gicc() for disabled GICC entry.
+ - No need to keep GICR region information for disabled GICC entry.
+
+Observed kernel crash on QDF2400 platform GICC entry is disabled.
+Kernel crash traces:
+ Kernel panic - not syncing: No interrupt controller found.
+ CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.13.5 #26
+ [<ffff000008087770>] dump_backtrace+0x0/0x218
+ [<ffff0000080879dc>] show_stack+0x14/0x20
+ [<ffff00000883b078>] dump_stack+0x98/0xb8
+ [<ffff0000080c5c14>] panic+0x118/0x26c
+ [<ffff000008b62348>] init_IRQ+0x24/0x2c
+ [<ffff000008b609fc>] start_kernel+0x230/0x394
+ [<ffff000008b601e4>] __primary_switched+0x64/0x6c
+ ---[ end Kernel panic - not syncing: No interrupt controller found.
+
+Disabled GICC subtable example:
+ Subtable Type : 0B [Generic Interrupt Controller]
+ Length : 50
+ Reserved : 0000
+ CPU Interface Number : 0000003D
+ Processor UID : 0000003D
+ Flags (decoded below) : 00000000
+ Processor Enabled : 0
+ Performance Interrupt Trig Mode : 0
+ Virtual GIC Interrupt Trig Mode : 0
+ Parking Protocol Version : 00000000
+ Performance Interrupt : 00000017
+ Parked Address : 0000000000000000
+ Base Address : 0000000000000000
+ Virtual GIC Base Address : 0000000000000000
+ Hypervisor GIC Base Address : 0000000000000000
+ Virtual GIC Interrupt : 00000019
+ Redistributor Base Address : 0000FFFF88F40000
+ ARM MPIDR : 000000000000000D
+ Efficiency Class : 00
+ Reserved : 000000
+
+Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-v3.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index b56c3e23f0af..a874777e9b9d 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -1331,6 +1331,10 @@ gic_acpi_parse_madt_gicc(struct acpi_subtable_header *header,
+ u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2;
+ void __iomem *redist_base;
+
++ /* GICC entry which has !ACPI_MADT_ENABLED is not unusable so skip */
++ if (!(gicc->flags & ACPI_MADT_ENABLED))
++ return 0;
++
+ redist_base = ioremap(gicc->gicr_base_address, size);
+ if (!redist_base)
+ return -ENOMEM;
+@@ -1380,6 +1384,13 @@ static int __init gic_acpi_match_gicc(struct acpi_subtable_header *header,
+ if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address)
+ return 0;
+
++ /*
++ * It's perfectly valid firmware can pass disabled GICC entry, driver
++ * should not treat as errors, skip the entry instead of probe fail.
++ */
++ if (!(gicc->flags & ACPI_MADT_ENABLED))
++ return 0;
++
+ return -ENODEV;
+ }
+
+--
+2.18.0
+
diff --git a/patches.drivers/irqchip-gic-v3-Ignore-disabled-ITS-nodes b/patches.drivers/irqchip-gic-v3-Ignore-disabled-ITS-nodes
new file mode 100644
index 0000000000..0eff223dd9
--- /dev/null
+++ b/patches.drivers/irqchip-gic-v3-Ignore-disabled-ITS-nodes
@@ -0,0 +1,76 @@
+From 95a2562590c2f64a0398183f978d5cf3db6d0284 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Thu, 1 Feb 2018 09:03:29 -0800
+Subject: [PATCH] irqchip/gic-v3: Ignore disabled ITS nodes
+Git-commit: 95a2562590c2f64a0398183f978d5cf3db6d0284
+Patch-mainline: v4.16-rc2
+References: bsc#1051510
+
+On some platforms there's an ITS available but it's not enabled
+because reading or writing the registers is denied by the
+firmware. In fact, reading or writing them will cause the system
+to reset. We could remove the node from DT in such a case, but
+it's better to skip nodes that are marked as "disabled" in DT so
+that we can describe the hardware that exists and use the status
+property to indicate how the firmware has configured things.
+
+Cc: Stuart Yoder <stuyoder@gmail.com>
+Cc: Laurentiu Tudor <laurentiu.tudor@nxp.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Rajendra Nayak <rnayak@codeaurora.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-v3-its-pci-msi.c | 2 ++
+ drivers/irqchip/irq-gic-v3-its-platform-msi.c | 2 ++
+ drivers/irqchip/irq-gic-v3-its.c | 2 ++
+ drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c | 2 ++
+ 4 files changed, 8 insertions(+)
+
+--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c
++++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c
+@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(vo
+
+ for (np = of_find_matching_node(NULL, its_device_id); np;
+ np = of_find_matching_node(np, its_device_id)) {
++ if (!of_device_is_available(np))
++ continue;
+ if (!of_property_read_bool(np, "msi-controller"))
+ continue;
+
+--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c
++++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c
+@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void
+
+ for (np = of_find_matching_node(NULL, its_device_id); np;
+ np = of_find_matching_node(np, its_device_id)) {
++ if (!of_device_is_available(np))
++ continue;
+ if (!of_property_read_bool(np, "msi-controller"))
+ continue;
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -3311,6 +3311,8 @@ static int __init its_of_probe(struct de
+
+ for (np = of_find_matching_node(node, its_device_id); np;
+ np = of_find_matching_node(np, its_device_id)) {
++ if (!of_device_is_available(np))
++ continue;
+ if (!of_property_read_bool(np, "msi-controller")) {
+ pr_warn("%s: no msi-controller property, ITS ignored\n",
+ np->full_name);
+--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
++++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c
+@@ -75,6 +75,8 @@ int __init its_fsl_mc_msi_init(void)
+
+ for (np = of_find_matching_node(NULL, its_device_id); np;
+ np = of_find_matching_node(np, its_device_id)) {
++ if (!of_device_is_available(np))
++ continue;
+ if (!of_property_read_bool(np, "msi-controller"))
+ continue;
+
diff --git a/patches.drivers/irqchip-gic-v3-Use-wmb-instead-of-smb_wmb-in-gic_rai b/patches.drivers/irqchip-gic-v3-Use-wmb-instead-of-smb_wmb-in-gic_rai
new file mode 100644
index 0000000000..4fec19a42e
--- /dev/null
+++ b/patches.drivers/irqchip-gic-v3-Use-wmb-instead-of-smb_wmb-in-gic_rai
@@ -0,0 +1,44 @@
+From 21ec30c0ef5234fb1039cc7c7737d885bf875a9e Mon Sep 17 00:00:00 2001
+From: Shanker Donthineni <shankerd@codeaurora.org>
+Date: Wed, 31 Jan 2018 18:03:42 -0600
+Subject: [PATCH] irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq()
+Git-commit: 21ec30c0ef5234fb1039cc7c7737d885bf875a9e
+Patch-mainline: v4.16-rc2
+References: bsc#1051510
+
+A DMB instruction can be used to ensure the relative order of only
+memory accesses before and after the barrier. Since writes to system
+registers are not memory operations, barrier DMB is not sufficient
+for observability of memory accesses that occur before ICC_SGI1R_EL1
+writes.
+
+A DSB instruction ensures that no instructions that appear in program
+order after the DSB instruction, can execute until the DSB instruction
+has completed.
+
+Cc: stable@vger.kernel.org
+Acked-by: Will Deacon <will.deacon@arm.com>,
+Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-v3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index d71be9a1f9d2..d99cc07903ec 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -688,7 +688,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq)
+ * Ensure that stores to Normal memory are visible to the
+ * other CPUs before issuing the IPI.
+ */
+- smp_wmb();
++ wmb();
+
+ for_each_cpu(cpu, mask) {
+ u64 cluster_id = MPIDR_TO_SGI_CLUSTER_ID(cpu_logical_map(cpu));
+--
+2.18.0
+
diff --git a/patches.drivers/irqchip-qcom-Fix-check-for-spurious-interrupts b/patches.drivers/irqchip-qcom-Fix-check-for-spurious-interrupts
new file mode 100644
index 0000000000..bbf754d23e
--- /dev/null
+++ b/patches.drivers/irqchip-qcom-Fix-check-for-spurious-interrupts
@@ -0,0 +1,53 @@
+From 1bc2463cee92ef0e2034c813d5e511adeb58b5fd Mon Sep 17 00:00:00 2001
+From: Agustin Vega-Frias <agustinv@codeaurora.org>
+Date: Tue, 1 May 2018 10:14:50 -0400
+Subject: [PATCH] irqchip/qcom: Fix check for spurious interrupts
+Git-commit: 1bc2463cee92ef0e2034c813d5e511adeb58b5fd
+Patch-mainline: v4.17-rc4
+References: bsc#1051510
+
+When the interrupts for a combiner span multiple registers it must be
+checked if any interrupts have been asserted on each register before
+checking for spurious interrupts.
+
+Checking each register seperately leads to false positive warnings.
+
+[ tglx: Massaged changelog ]
+
+Fixes: f20cc9b00c7b ("irqchip/qcom: Add IRQ combiner driver")
+Signed-off-by: Agustin Vega-Frias <agustinv@codeaurora.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: timur@codeaurora.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/1525184090-26143-1-git-send-email-agustinv@codeaurora.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/qcom-irq-combiner.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
+index f31265937439..7f0c0be322e0 100644
+--- a/drivers/irqchip/qcom-irq-combiner.c
++++ b/drivers/irqchip/qcom-irq-combiner.c
+@@ -1,4 +1,4 @@
+-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
++/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+@@ -68,7 +68,7 @@ static void combiner_handle_irq(struct irq_desc *desc)
+
+ bit = readl_relaxed(combiner->regs[reg].addr);
+ status = bit & combiner->regs[reg].enabled;
+- if (!status)
++ if (bit && !status)
+ pr_warn_ratelimited("Unexpected IRQ on CPU%d: (%08x %08lx %p)\n",
+ smp_processor_id(), bit,
+ combiner->regs[reg].enabled,
+--
+2.18.0
+
diff --git a/patches.drivers/irqchip-qcom-Fix-u32-comparison-with-value-less-than b/patches.drivers/irqchip-qcom-Fix-u32-comparison-with-value-less-than
new file mode 100644
index 0000000000..289bcc912b
--- /dev/null
+++ b/patches.drivers/irqchip-qcom-Fix-u32-comparison-with-value-less-than
@@ -0,0 +1,40 @@
+From e9990d70e8a063a7b894c5cbb99f630a0f41200d Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 17 Nov 2017 18:35:53 +0000
+Subject: [PATCH] irqchip/qcom: Fix u32 comparison with value less than zero
+Git-commit: e9990d70e8a063a7b894c5cbb99f630a0f41200d
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+The comparison of u32 nregs being less than zero is never true since
+nregs is unsigned. Fix this by making nregs a signed integer.
+
+Fixes: f20cc9b00c7b ("irqchip/qcom: Add IRQ combiner driver")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: kernel-janitors@vger.kernel.org
+Cc: Jason Cooper <jason@lakedaemon.net>
+Link: https://lkml.kernel.org/r/20171117183553.2739-1-colin.king@canonical.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/qcom-irq-combiner.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c
+index 6aa3ea479214..f31265937439 100644
+--- a/drivers/irqchip/qcom-irq-combiner.c
++++ b/drivers/irqchip/qcom-irq-combiner.c
+@@ -238,7 +238,7 @@ static int __init combiner_probe(struct platform_device *pdev)
+ {
+ struct combiner *combiner;
+ size_t alloc_sz;
+- u32 nregs;
++ int nregs;
+ int err;
+
+ nregs = count_registers(pdev);
+--
+2.18.0
+
diff --git a/patches.drivers/iwlwifi-add-more-card-IDs-for-9000-series b/patches.drivers/iwlwifi-add-more-card-IDs-for-9000-series
new file mode 100644
index 0000000000..1c862e290e
--- /dev/null
+++ b/patches.drivers/iwlwifi-add-more-card-IDs-for-9000-series
@@ -0,0 +1,239 @@
+From 0a5257bc6d89c2ae69b9bf955679cb4f89261874 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 17 Jul 2018 13:43:56 +0300
+Subject: [PATCH] iwlwifi: add more card IDs for 9000 series
+Git-commit: 0a5257bc6d89c2ae69b9bf955679cb4f89261874
+Patch-mainline: v4.18-rc8
+References: bsc#1051510
+
+Add new device IDs for the 9000 series.
+
+Cc: stable@vger.kernel.org # 4.14
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/9000.c | 69 ++++++++++++++++++++++++
+ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 5 +
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 22 +++++++
+ 3 files changed, 96 insertions(+)
+
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c
+@@ -177,6 +177,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = {
+ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
+ };
+
++const struct iwl_cfg iwl9260_killer_2ac_cfg = {
++ .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)",
++ .fw_name_pre = IWL9260A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++};
++
+ const struct iwl_cfg iwl9270_2ac_cfg = {
+ .name = "Intel(R) Dual Band Wireless AC 9270",
+ .fw_name_pre = IWL9260A_FW_PRE,
+@@ -266,6 +277,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc
+ .soc_latency = 5000,
+ };
+
++const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = {
++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++};
++
++const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = {
++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++};
++
+ const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = {
+ .name = "Intel(R) Dual Band Wireless AC 9460",
+ .fw_name_pre = IWL9000A_FW_PRE,
+@@ -316,6 +355,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_sha
+ .fw_name_pre = IWL9000A_FW_PRE,
+ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
+ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
++};
++
++const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = {
++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
++ IWL_DEVICE_9000,
++ .ht_params = &iwl9000_ht_params,
++ .nvm_ver = IWL9000_NVM_VERSION,
++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION,
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K,
++ .integrated = true,
++ .soc_latency = 5000,
++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK
++};
++
++const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = {
++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL9000A_FW_PRE,
++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE,
++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE,
+ IWL_DEVICE_9000,
+ .ht_params = &iwl9000_ht_params,
+ .nvm_ver = IWL9000_NVM_VERSION,
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -472,6 +472,7 @@ extern const struct iwl_cfg iwl8265_2ac_
+ extern const struct iwl_cfg iwl4165_2ac_sdio_cfg;
+ extern const struct iwl_cfg iwl9160_2ac_cfg;
+ extern const struct iwl_cfg iwl9260_2ac_cfg;
++extern const struct iwl_cfg iwl9260_killer_2ac_cfg;
+ extern const struct iwl_cfg iwl9270_2ac_cfg;
+ extern const struct iwl_cfg iwl9460_2ac_cfg;
+ extern const struct iwl_cfg iwl9560_2ac_cfg;
+@@ -479,10 +480,14 @@ extern const struct iwl_cfg iwl9460_2ac_
+ extern const struct iwl_cfg iwl9461_2ac_cfg_soc;
+ extern const struct iwl_cfg iwl9462_2ac_cfg_soc;
+ extern const struct iwl_cfg iwl9560_2ac_cfg_soc;
++extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc;
++extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc;
+ extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk;
+ extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk;
+ extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk;
+ extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk;
++extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk;
++extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk;
+ extern const struct iwl_cfg iwla000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwla000_2ac_cfg_jf;
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -543,6 +543,9 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)},
+@@ -552,6 +555,7 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)},
+@@ -576,6 +580,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)},
+@@ -602,6 +608,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)},
+@@ -628,6 +636,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)},
++ {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)},
+@@ -654,6 +664,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
+@@ -680,6 +692,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)},
+@@ -706,6 +720,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)},
+@@ -741,6 +757,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)},
+@@ -769,6 +787,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)},
+@@ -795,6 +815,8 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)},
+ {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)},
++ {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
++ {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)},
diff --git a/patches.drivers/misc-pci_endpoint_test-Avoid-triggering-a-BUG.patch b/patches.drivers/misc-pci_endpoint_test-Avoid-triggering-a-BUG.patch
new file mode 100644
index 0000000000..41c70ea889
--- /dev/null
+++ b/patches.drivers/misc-pci_endpoint_test-Avoid-triggering-a-BUG.patch
@@ -0,0 +1,38 @@
+From a2db2663bd72053ca1e4b4f36dfd31ba233c3a65 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sat, 30 Sep 2017 11:16:51 +0300
+Subject: [PATCH] misc: pci_endpoint_test: Avoid triggering a BUG()
+Git-commit: a2db2663bd72053ca1e4b4f36dfd31ba233c3a65
+No-fix: 846df244ebefbc9f7b91e9ae7a5e5a2e69fb4772
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+If you call ida_simple_remove(&pci_endpoint_test_ida, id) with a negative
+"id" then it triggers an immediate BUG_ON(). Let's not allow that.
+
+Fixes: 2c156ac71c6b ("misc: Add host side PCI driver for PCI test function device")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/pci_endpoint_test.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/misc/pci_endpoint_test.c b/drivers/misc/pci_endpoint_test.c
+index c0d323077ad0..d40a34f594c7 100644
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -597,6 +597,8 @@ static void pci_endpoint_test_remove(struct pci_dev *pdev)
+
+ if (sscanf(misc_device->name, DRV_MODULE_NAME ".%d", &id) != 1)
+ return;
++ if (id < 0)
++ return;
+
+ misc_deregister(&test->miscdev);
+ ida_simple_remove(&pci_endpoint_test_ida, id);
+--
+2.18.0
+
diff --git a/patches.drivers/scsi-libsas-defer-ata-device-eh-commands-to-libata.patch b/patches.drivers/scsi-libsas-defer-ata-device-eh-commands-to-libata.patch
new file mode 100644
index 0000000000..81b15be4d8
--- /dev/null
+++ b/patches.drivers/scsi-libsas-defer-ata-device-eh-commands-to-libata.patch
@@ -0,0 +1,131 @@
+From: Jason Yan <yanaijie@huawei.com>
+Date: Thu, 8 Mar 2018 10:34:53 +0800
+Subject: scsi: libsas: defer ata device eh commands to libata
+Git-commit: 318aaf34f1179b39fa9c30fa0f3288b645beee39
+Patch-mainline: v4.16-rc7
+References: FATE#326253
+
+When ata device doing EH, some commands still attached with tasks are
+not passed to libata when abort failed or recover failed, so libata did
+not handle these commands. After these commands done, sas task is freed,
+but ata qc is not freed. This will cause ata qc leak and trigger a
+warning like below:
+
+WARNING: CPU: 0 PID: 28512 at drivers/ata/libata-eh.c:4037
+ata_eh_finish+0xb4/0xcc
+CPU: 0 PID: 28512 Comm: kworker/u32:2 Tainted: G W OE 4.14.0#1
+......
+Call trace:
+[<ffff0000088b7bd0>] ata_eh_finish+0xb4/0xcc
+[<ffff0000088b8420>] ata_do_eh+0xc4/0xd8
+[<ffff0000088b8478>] ata_std_error_handler+0x44/0x8c
+[<ffff0000088b8068>] ata_scsi_port_error_handler+0x480/0x694
+[<ffff000008875fc4>] async_sas_ata_eh+0x4c/0x80
+[<ffff0000080f6be8>] async_run_entry_fn+0x4c/0x170
+[<ffff0000080ebd70>] process_one_work+0x144/0x390
+[<ffff0000080ec100>] worker_thread+0x144/0x418
+[<ffff0000080f2c98>] kthread+0x10c/0x138
+[<ffff0000080855dc>] ret_from_fork+0x10/0x18
+
+If ata qc leaked too many, ata tag allocation will fail and io blocked
+for ever.
+
+As suggested by Dan Williams, defer ata device commands to libata and
+merge sas_eh_finish_cmd() with sas_eh_defer_cmd(). libata will handle
+ata qcs correctly after this.
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+CC: Xiaofei Tan <tanxiaofei@huawei.com>
+CC: John Garry <john.garry@huawei.com>
+CC: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/scsi/libsas/sas_scsi_host.c | 33 +++++++++++++--------------------
+ 1 file changed, 13 insertions(+), 20 deletions(-)
+
+diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c
+index 626727207889..a372af68d9a9 100644
+--- a/drivers/scsi/libsas/sas_scsi_host.c
++++ b/drivers/scsi/libsas/sas_scsi_host.c
+@@ -223,6 +223,7 @@ int sas_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
+ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
+ {
+ struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(cmd->device->host);
++ struct domain_device *dev = cmd_to_domain_dev(cmd);
+ struct sas_task *task = TO_SAS_TASK(cmd);
+
+ /* At this point, we only get called following an actual abort
+@@ -231,6 +232,14 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
+ */
+ sas_end_task(cmd, task);
+
++ if (dev_is_sata(dev)) {
++ /* defer commands to libata so that libata EH can
++ * handle ata qcs correctly
++ */
++ list_move_tail(&cmd->eh_entry, &sas_ha->eh_ata_q);
++ return;
++ }
++
+ /* now finish the command and move it on to the error
+ * handler done list, this also takes it off the
+ * error handler pending list.
+@@ -238,22 +247,6 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd)
+ scsi_eh_finish_cmd(cmd, &sas_ha->eh_done_q);
+ }
+
+-static void sas_eh_defer_cmd(struct scsi_cmnd *cmd)
+-{
+- struct domain_device *dev = cmd_to_domain_dev(cmd);
+- struct sas_ha_struct *ha = dev->port->ha;
+- struct sas_task *task = TO_SAS_TASK(cmd);
+-
+- if (!dev_is_sata(dev)) {
+- sas_eh_finish_cmd(cmd);
+- return;
+- }
+-
+- /* report the timeout to libata */
+- sas_end_task(cmd, task);
+- list_move_tail(&cmd->eh_entry, &ha->eh_ata_q);
+-}
+-
+ static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd *my_cmd)
+ {
+ struct scsi_cmnd *cmd, *n;
+@@ -261,7 +254,7 @@ static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd
+ list_for_each_entry_safe(cmd, n, error_q, eh_entry) {
+ if (cmd->device->sdev_target == my_cmd->device->sdev_target &&
+ cmd->device->lun == my_cmd->device->lun)
+- sas_eh_defer_cmd(cmd);
++ sas_eh_finish_cmd(cmd);
+ }
+ }
+
+@@ -618,12 +611,12 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head *
+ case TASK_IS_DONE:
+ SAS_DPRINTK("%s: task 0x%p is done\n", __func__,
+ task);
+- sas_eh_defer_cmd(cmd);
++ sas_eh_finish_cmd(cmd);
+ continue;
+ case TASK_IS_ABORTED:
+ SAS_DPRINTK("%s: task 0x%p is aborted\n",
+ __func__, task);
+- sas_eh_defer_cmd(cmd);
++ sas_eh_finish_cmd(cmd);
+ continue;
+ case TASK_IS_AT_LU:
+ SAS_DPRINTK("task 0x%p is at LU: lu recover\n", task);
+@@ -634,7 +627,7 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head *
+ "recovered\n",
+ SAS_ADDR(task->dev),
+ cmd->device->lun);
+- sas_eh_defer_cmd(cmd);
++ sas_eh_finish_cmd(cmd);
+ sas_scsi_clear_queue_lu(work_q, cmd);
+ goto Again;
+ }
+
diff --git a/patches.fixes/0001-fscache-Allow-cancelled-operations-to-be-enqueued.patch b/patches.fixes/0001-fscache-Allow-cancelled-operations-to-be-enqueued.patch
new file mode 100644
index 0000000000..1a6dd1b8be
--- /dev/null
+++ b/patches.fixes/0001-fscache-Allow-cancelled-operations-to-be-enqueued.patch
@@ -0,0 +1,44 @@
+From: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Date: Wed, 25 Jul 2018 14:31:20 +0100
+Subject: [PATCH 1/5] fscache: Allow cancelled operations to be enqueued
+Git-commit: d0eb06afe712b7b103b6361f40a9a0c638524669
+Patch-mainline: v4.18
+References: bsc#1099858
+
+Alter the state-check assertion in fscache_enqueue_operation() to allow
+cancelled operations to be given processing time so they can be cleaned up.
+
+Also fix a debugging statement that was requiring such operations to have
+an object assigned.
+
+Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem")
+Reported-by: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/fscache/operation.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/fscache/operation.c
++++ b/fs/fscache/operation.c
+@@ -66,7 +66,8 @@ void fscache_enqueue_operation(struct fs
+ ASSERT(op->processor != NULL);
+ ASSERT(fscache_object_is_available(op->object));
+ ASSERTCMP(atomic_read(&op->usage), >, 0);
+- ASSERTCMP(op->state, ==, FSCACHE_OP_ST_IN_PROGRESS);
++ ASSERTIFCMP(op->state != FSCACHE_OP_ST_IN_PROGRESS,
++ op->state, ==, FSCACHE_OP_ST_CANCELLED);
+
+ fscache_stat(&fscache_n_op_enqueue);
+ switch (op->flags & FSCACHE_OP_TYPE) {
+@@ -481,7 +482,8 @@ void fscache_put_operation(struct fscach
+ struct fscache_cache *cache;
+
+ _enter("{OBJ%x OP%x,%d}",
+- op->object->debug_id, op->debug_id, atomic_read(&op->usage));
++ op->object ? op->object->debug_id : 0,
++ op->debug_id, atomic_read(&op->usage));
+
+ ASSERTCMP(atomic_read(&op->usage), >, 0);
+
diff --git a/patches.fixes/0002-cachefiles-Fix-refcounting-bug-in-backing-file-read-.patch b/patches.fixes/0002-cachefiles-Fix-refcounting-bug-in-backing-file-read-.patch
new file mode 100644
index 0000000000..9fa7786605
--- /dev/null
+++ b/patches.fixes/0002-cachefiles-Fix-refcounting-bug-in-backing-file-read-.patch
@@ -0,0 +1,117 @@
+From: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Date: Tue, 18 Jul 2017 16:25:49 -0700
+Subject: [PATCH 2/5] cachefiles: Fix refcounting bug in backing-file read
+ monitoring
+Git-commit: 934140ab028713a61de8bca58c05332416d037d1
+Patch-mainline: v4.18
+References: bsc#1099858
+
+cachefiles_read_waiter() has the right to access a 'monitor' object by
+virtue of being called under the waitqueue lock for one of the pages in its
+purview. However, it has no ref on that monitor object or on the
+associated operation.
+
+What it is allowed to do is to move the monitor object to the operation's
+to_do list, but once it drops the work_lock, it's actually no longer
+permitted to access that object. However, it is trying to enqueue the
+retrieval operation for processing - but it can only do this via a pointer
+in the monitor object, something it shouldn't be doing.
+
+If it doesn't enqueue the operation, the operation may not get processed.
+If the order is flipped so that the enqueue is first, then it's possible
+for the work processor to look at the to_do list before the monitor is
+enqueued upon it.
+
+Fix this by getting a ref on the operation so that we can trust that it
+will still be there once we've added the monitor to the to_do list and
+dropped the work_lock. The op can then be enqueued after the lock is
+dropped.
+
+The bug can manifest in one of a couple of ways. The first manifestation
+looks like:
+
+ FS-Cache:
+ FS-Cache: Assertion failed
+ FS-Cache: 6 == 5 is false
+ ------------[ cut here ]------------
+ kernel BUG at fs/fscache/operation.c:494!
+ RIP: 0010:fscache_put_operation+0x1e3/0x1f0
+ ...
+ fscache_op_work_func+0x26/0x50
+ process_one_work+0x131/0x290
+ worker_thread+0x45/0x360
+ kthread+0xf8/0x130
+ ? create_worker+0x190/0x190
+ ? kthread_cancel_work_sync+0x10/0x10
+ ret_from_fork+0x1f/0x30
+
+This is due to the operation being in the DEAD state (6) rather than
+INITIALISED, COMPLETE or CANCELLED (5) because it's already passed through
+fscache_put_operation().
+
+The bug can also manifest like the following:
+
+ kernel BUG at fs/fscache/operation.c:69!
+ ...
+ [exception RIP: fscache_enqueue_operation+246]
+ ...
+ #7 [ffff883fff083c10] fscache_enqueue_operation at ffffffffa0b793c6
+ #8 [ffff883fff083c28] cachefiles_read_waiter at ffffffffa0b15a48
+ #9 [ffff883fff083c48] __wake_up_common at ffffffff810af028
+
+I'm not entirely certain as to which is line 69 in Lei's kernel, so I'm not
+entirely clear which assertion failed.
+
+Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem")
+Reported-by: Lei Xue <carmark.dlut@gmail.com>
+Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
+Reported-by: Anthony DeRobertis <aderobertis@metrics.net>
+Reported-by: NeilBrown <neilb@suse.com>
+Reported-by: Daniel Axtens <dja@axtens.net>
+Reported-by: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Reviewed-by: Daniel Axtens <dja@axtens.net>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/cachefiles/rdwr.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -27,6 +27,7 @@ static int cachefiles_read_waiter(wait_q
+ struct cachefiles_one_read *monitor =
+ container_of(wait, struct cachefiles_one_read, monitor);
+ struct cachefiles_object *object;
++ struct fscache_retrieval *op = monitor->op;
+ struct wait_bit_key *key = _key;
+ struct page *page = wait->private;
+
+@@ -51,16 +52,22 @@ static int cachefiles_read_waiter(wait_q
+ list_del(&wait->entry);
+
+ /* move onto the action list and queue for FS-Cache thread pool */
+- ASSERT(monitor->op);
++ ASSERT(op);
+
+- object = container_of(monitor->op->op.object,
+- struct cachefiles_object, fscache);
++ /* We need to temporarily bump the usage count as we don't own a ref
++ * here otherwise cachefiles_read_copier() may free the op between the
++ * monitor being enqueued on the op->to_do list and the op getting
++ * enqueued on the work queue.
++ */
++ fscache_get_retrieval(op);
+
++ object = container_of(op->op.object, struct cachefiles_object, fscache);
+ spin_lock(&object->work_lock);
+- list_add_tail(&monitor->op_link, &monitor->op->to_do);
++ list_add_tail(&monitor->op_link, &op->to_do);
+ spin_unlock(&object->work_lock);
+
+- fscache_enqueue_retrieval(monitor->op);
++ fscache_enqueue_retrieval(op);
++ fscache_put_retrieval(op);
+ return 0;
+ }
+
diff --git a/patches.fixes/0003-fscache-Fix-reference-overput-in-fscache_attach_obje.patch b/patches.fixes/0003-fscache-Fix-reference-overput-in-fscache_attach_obje.patch
new file mode 100644
index 0000000000..29d2fcc2d9
--- /dev/null
+++ b/patches.fixes/0003-fscache-Fix-reference-overput-in-fscache_attach_obje.patch
@@ -0,0 +1,176 @@
+From: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Date: Thu, 21 Jun 2018 13:31:44 -0700
+Subject: [PATCH 3/5] fscache: Fix reference overput in fscache_attach_object()
+ error handling
+Git-commit: f29507ce66701084c39aeb1b0ae71690cbff3554
+Patch-mainline: v4.18
+References: bsc#1099858
+
+When a cookie is allocated that causes fscache_object structs to be
+allocated, those objects are initialised with the cookie pointer, but
+aren't blessed with a ref on that cookie unless the attachment is
+successfully completed in fscache_attach_object().
+
+If attachment fails because the parent object was dying or there was a
+collision, fscache_attach_object() returns without incrementing the cookie
+counter - but upon failure of this function, the object is released which
+then puts the cookie, whether or not a ref was taken on the cookie.
+
+Fix this by taking a ref on the cookie when it is assigned in
+fscache_object_init(), even when we're creating a root object.
+
+
+Analysis from Kiran Kumar:
+
+This bug has been seen in 4.4.0-124-generic #148-Ubuntu kernel
+
+Buglink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1776277
+
+fscache cookie ref count updated incorrectly during fscache object
+allocation resulting in following Oops.
+
+kernel BUG at /build/linux-Y09MKI/linux-4.4.0/fs/fscache/internal.h:321!
+kernel BUG at /build/linux-Y09MKI/linux-4.4.0/fs/fscache/cookie.c:639!
+
+[Cause]
+Two threads are trying to do operate on a cookie and two objects.
+
+(1) One thread tries to unmount the filesystem and in process goes over a
+ huge list of objects marking them dead and deleting the objects.
+ cookie->usage is also decremented in following path:
+
+ nfs_fscache_release_super_cookie
+ -> __fscache_relinquish_cookie
+ ->__fscache_cookie_put
+ ->BUG_ON(atomic_read(&cookie->usage) <= 0);
+
+(2) A second thread tries to lookup an object for reading data in following
+ path:
+
+ fscache_alloc_object
+ 1) cachefiles_alloc_object
+ -> fscache_object_init
+ -> assign cookie, but usage not bumped.
+ 2) fscache_attach_object -> fails in cant_attach_object because the
+ cookie's backing object or cookie's->parent object are going away
+ 3) fscache_put_object
+ -> cachefiles_put_object
+ ->fscache_object_destroy
+ ->fscache_cookie_put
+ ->BUG_ON(atomic_read(&cookie->usage) <= 0);
+
+[NOTE from dhowells] It's unclear as to the circumstances in which (2) can
+take place, given that thread (1) is in nfs_kill_super(), however a
+conflicting NFS mount with slightly different parameters that creates a
+different superblock would do it. A backtrace from Kiran seems to show
+that this is a possibility:
+
+ kernel BUG at/build/linux-Y09MKI/linux-4.4.0/fs/fscache/cookie.c:639!
+ ...
+ RIP: __fscache_cookie_put+0x3a/0x40 [fscache]
+ Call Trace:
+ __fscache_relinquish_cookie+0x87/0x120 [fscache]
+ nfs_fscache_release_super_cookie+0x2d/0xb0 [nfs]
+ nfs_kill_super+0x29/0x40 [nfs]
+ deactivate_locked_super+0x48/0x80
+ deactivate_super+0x5c/0x60
+ cleanup_mnt+0x3f/0x90
+ __cleanup_mnt+0x12/0x20
+ task_work_run+0x86/0xb0
+ exit_to_usermode_loop+0xc2/0xd0
+ syscall_return_slowpath+0x4e/0x60
+ int_ret_from_sys_call+0x25/0x9f
+
+[Fix] Bump up the cookie usage in fscache_object_init, when it is first
+being assigned a cookie atomically such that the cookie is added and bumped
+up if its refcount is not zero. Remove the assignment in
+fscache_attach_object().
+
+[Testcase]
+I have run ~100 hours of NFS stress tests and not seen this bug recur.
+
+[Regression Potential]
+ - Limited to fscache/cachefiles.
+
+Fixes: ccc4fc3d11e9 ("FS-Cache: Implement the cookie management part of the netfs API")
+Signed-off-by: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/cachefiles/bind.c | 3 ++-
+ fs/fscache/cache.c | 2 +-
+ fs/fscache/cookie.c | 7 ++++---
+ fs/fscache/object.c | 1 +
+ 4 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/cachefiles/bind.c
++++ b/fs/cachefiles/bind.c
+@@ -218,7 +218,8 @@ static int cachefiles_daemon_add_cache(s
+ "%s",
+ fsdef->dentry->d_sb->s_id);
+
+- fscache_object_init(&fsdef->fscache, NULL, &cache->cache);
++ fscache_object_init(&fsdef->fscache, &fscache_fsdef_index,
++ &cache->cache);
+
+ ret = fscache_add_cache(&cache->cache, &fsdef->fscache, cache->tag);
+ if (ret < 0)
+--- a/fs/fscache/cache.c
++++ b/fs/fscache/cache.c
+@@ -220,6 +220,7 @@ int fscache_add_cache(struct fscache_cac
+ {
+ struct fscache_cache_tag *tag;
+
++ ASSERTCMP(ifsdef->cookie, ==, &fscache_fsdef_index);
+ BUG_ON(!cache->ops);
+ BUG_ON(!ifsdef);
+
+@@ -248,7 +249,6 @@ int fscache_add_cache(struct fscache_cac
+ if (!cache->kobj)
+ goto error;
+
+- ifsdef->cookie = &fscache_fsdef_index;
+ ifsdef->cache = cache;
+ cache->fsdef = ifsdef;
+
+--- a/fs/fscache/cookie.c
++++ b/fs/fscache/cookie.c
+@@ -302,6 +302,7 @@ static int fscache_alloc_object(struct f
+ goto error;
+ }
+
++ ASSERTCMP(object->cookie, ==, cookie);
+ fscache_stat(&fscache_n_object_alloc);
+
+ object->debug_id = atomic_inc_return(&fscache_object_debug_id);
+@@ -357,6 +358,8 @@ static int fscache_attach_object(struct
+
+ _enter("{%s},{OBJ%x}", cookie->def->name, object->debug_id);
+
++ ASSERTCMP(object->cookie, ==, cookie);
++
+ spin_lock(&cookie->lock);
+
+ /* there may be multiple initial creations of this object, but we only
+@@ -396,9 +399,7 @@ static int fscache_attach_object(struct
+ spin_unlock(&cache->object_list_lock);
+ }
+
+- /* attach to the cookie */
+- object->cookie = cookie;
+- atomic_inc(&cookie->usage);
++ /* Attach to the cookie. The object already has a ref on it. */
+ hlist_add_head(&object->cookie_link, &cookie->backing_objects);
+
+ fscache_objlist_add(object);
+--- a/fs/fscache/object.c
++++ b/fs/fscache/object.c
+@@ -318,6 +318,7 @@ void fscache_object_init(struct fscache_
+ object->store_limit_l = 0;
+ object->cache = cache;
+ object->cookie = cookie;
++ atomic_inc(&cookie->usage);
+ object->parent = NULL;
+ #ifdef CONFIG_FSCACHE_OBJECT_LIST
+ RB_CLEAR_NODE(&object->objlist_link);
diff --git a/patches.fixes/0004-cachefiles-Fix-missing-clear-of-the-CACHEFILES_OBJEC.patch b/patches.fixes/0004-cachefiles-Fix-missing-clear-of-the-CACHEFILES_OBJEC.patch
new file mode 100644
index 0000000000..7e6df99392
--- /dev/null
+++ b/patches.fixes/0004-cachefiles-Fix-missing-clear-of-the-CACHEFILES_OBJEC.patch
@@ -0,0 +1,73 @@
+From: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Date: Thu, 21 Jun 2018 13:25:53 -0700
+Subject: [PATCH 4/5] cachefiles: Fix missing clear of the
+ CACHEFILES_OBJECT_ACTIVE flag
+Git-commit: 5ce83d4bb7d8e11e8c1c687d09f4b5ae67ef3ce3
+Patch-mainline: v4.18
+References: bsc#1099858
+
+In cachefiles_mark_object_active(), the new object is marked active and
+then we try to add it to the active object tree. If a conflicting object
+is already present, we want to wait for that to go away. After the wait,
+we go round again and try to re-mark the object as being active - but it's
+already marked active from the first time we went through and a BUG is
+issued.
+
+Fix this by clearing the CACHEFILES_OBJECT_ACTIVE flag before we try again.
+
+Analysis from Kiran Kumar Modukuri:
+
+[Impact]
+Oops during heavy NFS + FSCache + Cachefiles
+
+Cachefiles: Error: Overlong wait for old active object to go away.
+
+Bug: unable to handle kernel NULL pointer dereference at 0000000000000002
+
+Cachefiles: Error: Object already active kernel BUG at
+fs/cachefiles/namei.c:163!
+
+[Cause]
+In a heavily loaded system with big files being read and truncated, an
+fscache object for a cookie is being dropped and a new object being
+looked. The new object being looked for has to wait for the old object
+to go away before the new object is moved to active state.
+
+[Fix]
+Clear the flag 'CACHEFILES_OBJECT_ACTIVE' for the new object when
+retrying the object lookup.
+
+[Testcase]
+Have run ~100 hours of NFS stress tests and have not seen this bug recur.
+
+[Regression Potential]
+ - Limited to fscache/cachefiles.
+
+Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem")
+Signed-off-by: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/cachefiles/namei.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/cachefiles/namei.c
++++ b/fs/cachefiles/namei.c
+@@ -191,6 +191,8 @@ try_again:
+ /* an old object from a previous incarnation is hogging the slot - we
+ * need to wait for it to be destroyed */
+ wait_for_old_object:
++ clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
++
+ if (fscache_object_is_live(&xobject->fscache)) {
+ pr_err("\n");
+ pr_err("Error: Unexpected object collision\n");
+@@ -252,7 +254,6 @@ wait_for_old_object:
+ goto try_again;
+
+ requeue:
+- clear_bit(CACHEFILES_OBJECT_ACTIVE, &object->flags);
+ cache->cache.ops->put_object(&xobject->fscache);
+ _leave(" = -ETIMEDOUT");
+ return -ETIMEDOUT;
diff --git a/patches.fixes/0005-cachefiles-Wait-rather-than-BUG-ing-on-Unexpected-ob.patch b/patches.fixes/0005-cachefiles-Wait-rather-than-BUG-ing-on-Unexpected-ob.patch
new file mode 100644
index 0000000000..dc283b5cb9
--- /dev/null
+++ b/patches.fixes/0005-cachefiles-Wait-rather-than-BUG-ing-on-Unexpected-ob.patch
@@ -0,0 +1,36 @@
+From: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Date: Thu, 21 Jun 2018 13:25:53 -0700
+Subject: [PATCH 5/5] cachefiles: Wait rather than BUG'ing on "Unexpected
+ object collision"
+Git-commit: c2412ac45a8f8f1cd582723c1a139608694d410d
+Patch-mainline: v4.18
+References: bsc#1099858
+
+If we meet a conflicting object that is marked FSCACHE_OBJECT_IS_LIVE in
+the active object tree, we have been emitting a BUG after logging
+information about it and the new object.
+
+Instead, we should wait for the CACHEFILES_OBJECT_ACTIVE flag to be cleared
+on the old object (or return an error). The ACTIVE flag should be cleared
+after it has been removed from the active object tree. A timeout of 60s is
+used in the wait, so we shouldn't be able to get stuck there.
+
+Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem")
+Signed-off-by: Kiran Kumar Modukuri <kiran.modukuri@gmail.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/cachefiles/namei.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/cachefiles/namei.c
++++ b/fs/cachefiles/namei.c
+@@ -197,7 +197,6 @@ wait_for_old_object:
+ pr_err("\n");
+ pr_err("Error: Unexpected object collision\n");
+ cachefiles_printk_object(object, xobject);
+- BUG();
+ }
+ atomic_inc(&xobject->usage);
+ write_unlock(&cache->active_lock);
diff --git a/patches.fixes/ARM-davinci-board-omapl138-hawk-fix-GPIO-numbers-for.patch b/patches.fixes/ARM-davinci-board-omapl138-hawk-fix-GPIO-numbers-for.patch
new file mode 100644
index 0000000000..0cb60f6955
--- /dev/null
+++ b/patches.fixes/ARM-davinci-board-omapl138-hawk-fix-GPIO-numbers-for.patch
@@ -0,0 +1,51 @@
+From d45622c0eaa5992a1a2248cbe93e1ff7a2da7be4 Mon Sep 17 00:00:00 2001
+From: Sekhar Nori <nsekhar@ti.com>
+Date: Tue, 24 Apr 2018 20:05:06 +0530
+Subject: [PATCH] ARM: davinci: board-omapl138-hawk: fix GPIO numbers for MMC/SD lookup
+Git-commit: d45622c0eaa5992a1a2248cbe93e1ff7a2da7be4
+Patch-mainline: v4.17-rc6
+References: bsc#1051510
+
+commit c4dc56be7e26 ("ARM: davinci: fix the GPIO lookup for omapl138-hawk")
+fixed the GPIO chip name for look-up of MMC/SD CD and WP pins, but forgot
+to change the GPIO numbers passed.
+
+The GPIO numbers are not offsets from within a 32 GPIO bank. Fix the
+GPIO numbers as well as remove the misleading comment.
+
+Fixes: c4dc56be7e26 ("ARM: davinci: fix the GPIO lookup for omapl138-hawk")
+Reviewed-by: David Lechner <david@lechnology.com>
+Signed-off-by: Sekhar Nori <nsekhar@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ arch/arm/mach-davinci/board-omapl138-hawk.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c
+index 0d32042b728f..be8b892a6ea7 100644
+--- a/arch/arm/mach-davinci/board-omapl138-hawk.c
++++ b/arch/arm/mach-davinci/board-omapl138-hawk.c
+@@ -123,12 +123,16 @@ static const short hawk_mmcsd0_pins[] = {
+ -1
+ };
+
++#define DA850_HAWK_MMCSD_CD_PIN GPIO_TO_PIN(3, 12)
++#define DA850_HAWK_MMCSD_WP_PIN GPIO_TO_PIN(3, 13)
++
+ static struct gpiod_lookup_table mmc_gpios_table = {
+ .dev_id = "da830-mmc.0",
+ .table = {
+- /* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/
+- GPIO_LOOKUP("davinci_gpio.0", 28, "cd", GPIO_ACTIVE_LOW),
+- GPIO_LOOKUP("davinci_gpio.0", 29, "wp", GPIO_ACTIVE_LOW),
++ GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_CD_PIN, "cd",
++ GPIO_ACTIVE_LOW),
++ GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_WP_PIN, "wp",
++ GPIO_ACTIVE_LOW),
+ },
+ };
+
+--
+2.18.0
+
diff --git a/patches.fixes/audit-fix-potential-null-dereference-context-module.patch b/patches.fixes/audit-fix-potential-null-dereference-context-module.patch
new file mode 100644
index 0000000000..64a0661eaf
--- /dev/null
+++ b/patches.fixes/audit-fix-potential-null-dereference-context-module.patch
@@ -0,0 +1,54 @@
+From b305f7ed0f4f494ad6f3ef5667501535d5a8fa31 Mon Sep 17 00:00:00 2001
+From: Yi Wang <wang.yi59@zte.com.cn>
+Date: Wed, 25 Jul 2018 10:26:19 +0800
+Subject: [PATCH] audit: fix potential null dereference 'context->module.name'
+Git-commit: b305f7ed0f4f494ad6f3ef5667501535d5a8fa31
+Patch-mainline: v4.18-rc8
+References: bsc#1051510
+
+The variable 'context->module.name' may be null pointer when
+kmalloc return null, so it's better to check it before using
+to avoid null dereference.
+Another one more thing this patch does is using kstrdup instead
+of (kmalloc + strcpy), and signal a lost record via audit_log_lost.
+
+Cc: stable@vger.kernel.org # 4.11
+Signed-off-by: Yi Wang <wang.yi59@zte.com.cn>
+Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
+Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/auditsc.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -1271,8 +1271,12 @@ static void show_special(struct audit_co
+ break;
+ case AUDIT_KERN_MODULE:
+ audit_log_format(ab, "name=");
+- audit_log_untrustedstring(ab, context->module.name);
+- kfree(context->module.name);
++ if (context->module.name) {
++ audit_log_untrustedstring(ab, context->module.name);
++ kfree(context->module.name);
++ } else
++ audit_log_format(ab, "(null)");
++
+ break;
+ }
+ audit_log_end(ab);
+@@ -2379,8 +2383,9 @@ void __audit_log_kern_module(char *name)
+ {
+ struct audit_context *context = current->audit_context;
+
+- context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL);
+- strcpy(context->module.name, name);
++ context->module.name = kstrdup(name, GFP_KERNEL);
++ if (!context->module.name)
++ audit_log_lost("out of memory in __audit_log_kern_module");
+ context->type = AUDIT_KERN_MODULE;
+ }
+
diff --git a/patches.fixes/coccinelle-fix-parallel-build-with-CHECK-scripts-coc.patch b/patches.fixes/coccinelle-fix-parallel-build-with-CHECK-scripts-coc.patch
new file mode 100644
index 0000000000..f91ee71876
--- /dev/null
+++ b/patches.fixes/coccinelle-fix-parallel-build-with-CHECK-scripts-coc.patch
@@ -0,0 +1,86 @@
+From d7059ca0147adcd495f3c5b41f260e1ac55bb679 Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Tue, 14 Nov 2017 20:38:07 +0900
+Subject: [PATCH] coccinelle: fix parallel build with CHECK=scripts/coccicheck
+Git-commit: d7059ca0147adcd495f3c5b41f260e1ac55bb679
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+The command "make -j8 C=1 CHECK=scripts/coccicheck" produces
+lots of "coccicheck failed" error messages.
+
+Julia Lawall explained the Coccinelle behavior as follows:
+"The problem on the Coccinelle side is that it uses a subdirectory
+with the name of the semantic patch to store standard output and
+standard error for the different threads. I didn't want to use a
+name with the pid, so that one could easily find this information
+while Coccinelle is running. Normally the subdirectory is cleaned
+up when Coccinelle completes, so there is only one of them at a time.
+Maybe it is best to just add the pid. There is the risk that these
+subdirectories will accumulate if Coccinelle crashes in a way such
+that they don't get cleaned up, but Coccinelle could print a warning
+if it detects this case, rather than failing."
+
+When scripts/coccicheck is used as CHECK tool and -j option is given
+to Make, the whole of build process runs in parallel. So, multiple
+processes try to get access to the same subdirectory.
+
+I notice spatch creates the subdirectory only when it runs in parallel
+(i.e. --jobs <N> is given and <N> is greater than 1).
+
+Setting NPROC=1 is a reasonable solution; spatch does not create the
+subdirectory. Besides, ONLINE=1 mode takes a single file input for
+each spatch invocation, so there is no reason to parallelize it in
+the first place.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/coccicheck | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/scripts/coccicheck b/scripts/coccicheck
+index d5f28d5044e7..ecfac64b39fe 100755
+--- a/scripts/coccicheck
++++ b/scripts/coccicheck
+@@ -30,12 +30,6 @@ else
+ VERBOSE=0
+ fi
+
+-if [ -z "$J" ]; then
+- NPROC=$(getconf _NPROCESSORS_ONLN)
+-else
+- NPROC="$J"
+-fi
+-
+ FLAGS="--very-quiet"
+
+ # You can use SPFLAGS to append extra arguments to coccicheck or override any
+@@ -70,6 +64,9 @@ if [ "$C" = "1" -o "$C" = "2" ]; then
+ # Take only the last argument, which is the C file to test
+ shift $(( $# - 1 ))
+ OPTIONS="$COCCIINCLUDE $1"
++
++ # No need to parallelize Coccinelle since this mode takes one input file.
++ NPROC=1
+ else
+ ONLINE=0
+ if [ "$KBUILD_EXTMOD" = "" ] ; then
+@@ -77,6 +74,12 @@ else
+ else
+ OPTIONS="--dir $KBUILD_EXTMOD $COCCIINCLUDE"
+ fi
++
++ if [ -z "$J" ]; then
++ NPROC=$(getconf _NPROCESSORS_ONLN)
++ else
++ NPROC="$J"
++ fi
+ fi
+
+ if [ "$KBUILD_EXTMOD" != "" ] ; then
+--
+2.18.0
+
diff --git a/patches.fixes/ibmasm-don-t-write-out-of-bounds-in-read-handler.patch b/patches.fixes/ibmasm-don-t-write-out-of-bounds-in-read-handler.patch
new file mode 100644
index 0000000000..3276182ff2
--- /dev/null
+++ b/patches.fixes/ibmasm-don-t-write-out-of-bounds-in-read-handler.patch
@@ -0,0 +1,68 @@
+From a0341fc1981a950c1e902ab901e98f60e0e243f3 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Sat, 7 Jul 2018 04:16:33 +0200
+Subject: [PATCH] ibmasm: don't write out of bounds in read handler
+Git-commit: a0341fc1981a950c1e902ab901e98f60e0e243f3
+Patch-mainline: v4.18-rc5
+References: bsc#1051510
+
+This read handler had a lot of custom logic and wrote outside the bounds of
+the provided buffer. This could lead to kernel and userspace memory
+corruption. Just use simple_read_from_buffer() with a stack buffer.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/ibmasm/ibmasmfs.c | 27 +++------------------------
+ 1 file changed, 3 insertions(+), 24 deletions(-)
+
+diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c
+index e05c3245930a..fa840666bdd1 100644
+--- a/drivers/misc/ibmasm/ibmasmfs.c
++++ b/drivers/misc/ibmasm/ibmasmfs.c
+@@ -507,35 +507,14 @@ static int remote_settings_file_close(struct inode *inode, struct file *file)
+ static ssize_t remote_settings_file_read(struct file *file, char __user *buf, size_t count, loff_t *offset)
+ {
+ void __iomem *address = (void __iomem *)file->private_data;
+- unsigned char *page;
+- int retval;
+ int len = 0;
+ unsigned int value;
+-
+- if (*offset < 0)
+- return -EINVAL;
+- if (count == 0 || count > 1024)
+- return 0;
+- if (*offset != 0)
+- return 0;
+-
+- page = (unsigned char *)__get_free_page(GFP_KERNEL);
+- if (!page)
+- return -ENOMEM;
++ char lbuf[20];
+
+ value = readl(address);
+- len = sprintf(page, "%d\n", value);
+-
+- if (copy_to_user(buf, page, len)) {
+- retval = -EFAULT;
+- goto exit;
+- }
+- *offset += len;
+- retval = len;
++ len = snprintf(lbuf, sizeof(lbuf), "%d\n", value);
+
+-exit:
+- free_page((unsigned long)page);
+- return retval;
++ return simple_read_from_buffer(buf, count, offset, lbuf, len);
+ }
+
+ static ssize_t remote_settings_file_write(struct file *file, const char __user *ubuff, size_t count, loff_t *offset)
+--
+2.18.0
+
diff --git a/patches.fixes/kbuild-Handle-builtin-dtb-file-names-containing-hyph.patch b/patches.fixes/kbuild-Handle-builtin-dtb-file-names-containing-hyph.patch
new file mode 100644
index 0000000000..ae98177984
--- /dev/null
+++ b/patches.fixes/kbuild-Handle-builtin-dtb-file-names-containing-hyph.patch
@@ -0,0 +1,74 @@
+From 55fe6da9efba102866e2fb5b40b04b6a4b26c19e Mon Sep 17 00:00:00 2001
+From: James Hogan <jhogan@kernel.org>
+Date: Thu, 8 Mar 2018 11:02:46 +0000
+Subject: [PATCH] kbuild: Handle builtin dtb file names containing hyphens
+Git-commit: 55fe6da9efba102866e2fb5b40b04b6a4b26c19e
+Patch-mainline: v4.16-rc5
+References: bsc#1051510
+
+cmd_dt_S_dtb constructs the assembly source to incorporate a devicetree
+FDT (that is, the .dtb file) as binary data in the kernel image. This
+assembly source contains labels before and after the binary data. The
+label names incorporate the file name of the corresponding .dtb file.
+Hyphens are not legal characters in labels, so .dtb files built into the
+kernel with hyphens in the file name result in errors like the
+Following:
+
+Bcm3368-netgear-cvg834g.dtb.s: Assembler messages:
+bcm3368-netgear-cvg834g.dtb.S:5: Error: : no such section
+bcm3368-netgear-cvg834g.dtb.S:5: Error: junk at end of line, first unrecognized character is `-'
+bcm3368-netgear-cvg834g.dtb.S:6: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_begin:'
+bcm3368-netgear-cvg834g.dtb.S:8: Error: unrecognized opcode `__dtb_bcm3368-netgear-cvg834g_end:'
+bcm3368-netgear-cvg834g.dtb.S:9: Error: : no such section
+bcm3368-netgear-cvg834g.dtb.S:9: Error: junk at end of line, first unrecognized character is `-'
+
+Fix this by updating cmd_dt_S_dtb to transform all hyphens from the file
+name to underscores when constructing the labels.
+
+As of v4.16-rc2, 1139 .dts files across ARM64, ARM, MIPS and PowerPC
+contain hyphens in their names, but the issue only currently manifests
+on Broadcom MIPS platforms, as that is the only place where such files
+are built into the kernel. For example when CONFIG_DT_NETGEAR_CVG834G=y,
+or on BMIPS kernels when the dtbs target is used (in the latter case it
+admittedly shouldn't really build all the dtb.o files, but thats a
+separate issue).
+
+Fixes: 695835511f96 ("MIPS: BMIPS: rename bcm96358nb4ser to bcm6358-neufbox4-sercom")
+Signed-off-by: James Hogan <jhogan@kernel.org>
+Reviewed-by: Frank Rowand <frowand.list@gmail.com>
+Cc: Rob Herring <robh+dt@kernel.org>
+Cc: Michal Marek <michal.lkml@markovi.net>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Cc: Kevin Cernekee <cernekee@gmail.com>
+Cc: <stable@vger.kernel.org> # 4.9+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/Makefile.lib | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
+index 5589bae34af6..a6f538b31ad6 100644
+--- a/scripts/Makefile.lib
++++ b/scripts/Makefile.lib
+@@ -297,11 +297,11 @@ cmd_dt_S_dtb= \
+ echo '\#include <asm-generic/vmlinux.lds.h>'; \
+ echo '.section .dtb.init.rodata,"a"'; \
+ echo '.balign STRUCT_ALIGNMENT'; \
+- echo '.global __dtb_$(*F)_begin'; \
+- echo '__dtb_$(*F)_begin:'; \
++ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \
++ echo '__dtb_$(subst -,_,$(*F))_begin:'; \
+ echo '.incbin "$<" '; \
+- echo '__dtb_$(*F)_end:'; \
+- echo '.global __dtb_$(*F)_end'; \
++ echo '__dtb_$(subst -,_,$(*F))_end:'; \
++ echo '.global __dtb_$(subst -,_,$(*F))_end'; \
+ echo '.balign STRUCT_ALIGNMENT'; \
+ ) > $@
+
+--
+2.18.0
+
diff --git a/patches.fixes/kbuild-add-fno-stack-check-to-kernel-build-options.patch b/patches.fixes/kbuild-add-fno-stack-check-to-kernel-build-options.patch
new file mode 100644
index 0000000000..850265e6c9
--- /dev/null
+++ b/patches.fixes/kbuild-add-fno-stack-check-to-kernel-build-options.patch
@@ -0,0 +1,54 @@
+From 3ce120b16cc548472f80cf8644f90eda958cf1b6 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Fri, 29 Dec 2017 17:34:43 -0800
+Subject: [PATCH] kbuild: add '-fno-stack-check' to kernel build options
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 3ce120b16cc548472f80cf8644f90eda958cf1b6
+Patch-mainline: v4.15-rc6
+References: bsc#1051510
+
+It appears that hardened gentoo enables "-fstack-check" by default for
+gcc.
+
+That doesn't work _at_all_ for the kernel, because the kernel stack
+doesn't act like a user stack at all: it's much smaller, and it doesn't
+auto-expand on use. So the extra "probe one page below the stack" code
+generated by -fstack-check just breaks the kernel in horrible ways,
+causing infinite double faults etc.
+
+[ I have to say, that the particular code gcc generates looks very
+ stupid even for user space where it works, but that's a separate
+ issue. ]
+
+Reported-and-tested-by: Alexander Tsoy <alexander@tsoy.me>
+Reported-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>
+Cc: stable@kernel.org
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Andy Lutomirski <luto@amacapital.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ Makefile | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Makefile b/Makefile
+index ac8c441866b7..92b74bcd3c2a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -789,6 +789,9 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
+ # disable invalid "can't wrap" optimizations for signed / pointers
+ KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow)
+
++# Make sure -fstack-check isn't enabled (like gentoo apparently did)
++KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,)
++
+ # conserve stack if available
+ KBUILD_CFLAGS += $(call cc-option,-fconserve-stack)
+
+--
+2.18.0
+
diff --git a/patches.fixes/kbuild-pkg-use-transform-option-to-prefix-paths-in-t.patch b/patches.fixes/kbuild-pkg-use-transform-option-to-prefix-paths-in-t.patch
new file mode 100644
index 0000000000..754c12e5bc
--- /dev/null
+++ b/patches.fixes/kbuild-pkg-use-transform-option-to-prefix-paths-in-t.patch
@@ -0,0 +1,56 @@
+From 2dbc644ac62bbcb9ee78e84719953f611be0413d Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Wed, 15 Nov 2017 18:17:07 +0900
+Subject: [PATCH] kbuild: pkg: use --transform option to prefix paths in tar
+Git-commit: 2dbc644ac62bbcb9ee78e84719953f611be0413d
+Patch-mainline: v4.15-rc1
+References: bsc#1051510
+
+For rpm-pkg and deb-pkg, a source tar file is created. All paths in
+the archive must be prefixed with the base name of the tar so that
+everything is contained in the directory when you extract it.
+
+Currently, scripts/package/Makefile uses a symlink for that, and
+removes it after the tar is created.
+
+If you terminate the build during the tar creation, the symlink is
+left over. Then, at the next package build, you will see a warning
+like follows:
+
+ ln: '.' and 'kernel-4.14.0+/.' are the same file
+
+It is possible to fix it by adding -n (--no-dereference) option to
+the "ln" command, but a cleaner way is to use --transform option
+of "tar" command. This option is GNU extension, but it should not
+hurt to use it in the Linux build system.
+
+The 'S' flag is needed to exclude symlinks from the path fixup.
+Without it, symlinks in the kernel are broken.
+
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/package/Makefile | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/scripts/package/Makefile b/scripts/package/Makefile
+index 9ed96aefc72d..c30bcf8e934a 100644
+--- a/scripts/package/Makefile
++++ b/scripts/package/Makefile
+@@ -39,10 +39,9 @@ if test "$(objtree)" != "$(srctree)"; then \
+ false; \
+ fi ; \
+ $(srctree)/scripts/setlocalversion --save-scmversion; \
+-ln -sf $(srctree) $(2); \
+ tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
+- $(addprefix $(2)/,$(TAR_CONTENT) $(3)); \
+-rm -f $(2) $(objtree)/.scmversion
++ --transform 's:^:$(2)/:S' $(TAR_CONTENT) $(3); \
++rm -f $(objtree)/.scmversion
+
+ # rpm-pkg
+ # ---------------------------------------------------------------------------
+--
+2.18.0
+
diff --git a/patches.fixes/kconfig-display-recursive-dependency-resolution-hint.patch b/patches.fixes/kconfig-display-recursive-dependency-resolution-hint.patch
new file mode 100644
index 0000000000..c09bfaa920
--- /dev/null
+++ b/patches.fixes/kconfig-display-recursive-dependency-resolution-hint.patch
@@ -0,0 +1,68 @@
+From e3b03bf29d6b99fab7001fb20c33fe54928c157a Mon Sep 17 00:00:00 2001
+From: Masahiro Yamada <yamada.masahiro@socionext.com>
+Date: Sat, 16 Dec 2017 00:28:42 +0900
+Subject: [PATCH] kconfig: display recursive dependency resolution hint just once
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: e3b03bf29d6b99fab7001fb20c33fe54928c157a
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+Commit 1c199f2878f6 ("kbuild: document recursive dependency limitation
+/ resolution") probably intended to show a hint along with "recursive
+dependency detected!" error, but it missed to add {...} guard, and the
+hint is displayed in every loop of the dep_stack traverse, annoyingly.
+
+This error was detected by GCC's -Wmisleading-indentation when switching
+to build-time generation of lexer/parser.
+
+Scripts/kconfig/symbol.c: In function ‘sym_check_print_recursive’:
+scripts/kconfig/symbol.c:1150:3: warning: this ‘if’ clause does not guard... [-Wmisleading-indentation]
+ if (stack->sym == last_sym)
+ ^~
+scripts/kconfig/symbol.c:1153:4: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the ‘if’
+ fprintf(stderr, "For a resolution refer to Documentation/kbuild/kconfig-language.txt\n");
+ ^~~~~~~
+
+I could simply add {...} to surround the three fprintf(), but I rather
+chose to move the hint after the loop to make the whole message readable.
+
+Fixes: 1c199f2878f6 ("kbuild: document recursive dependency limitation / resolution"
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Luis R. Rodriguez <mcgrof@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/kconfig/symbol.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
+index 3c8bd9bb4267..35e0937aa6a6 100644
+--- a/scripts/kconfig/symbol.c
++++ b/scripts/kconfig/symbol.c
+@@ -1150,8 +1150,7 @@ static void sym_check_print_recursive(struct symbol *last_sym)
+ if (stack->sym == last_sym)
+ fprintf(stderr, "%s:%d:error: recursive dependency detected!\n",
+ prop->file->name, prop->lineno);
+- fprintf(stderr, "For a resolution refer to Documentation/kbuild/kconfig-language.txt\n");
+- fprintf(stderr, "subsection \"Kconfig recursive dependency limitations\"\n");
++
+ if (stack->expr) {
+ fprintf(stderr, "%s:%d:\tsymbol %s %s value contains %s\n",
+ prop->file->name, prop->lineno,
+@@ -1181,6 +1180,11 @@ static void sym_check_print_recursive(struct symbol *last_sym)
+ }
+ }
+
++ fprintf(stderr,
++ "For a resolution refer to Documentation/kbuild/kconfig-language.txt\n"
++ "subsection \"Kconfig recursive dependency limitations\"\n"
++ "\n");
++
+ if (check_top == &cv_stack)
+ dep_stack_remove();
+ }
+--
+2.18.0
+
diff --git a/patches.fixes/kmemleak-add-scheduling-point-to-kmemleak_scan.patch b/patches.fixes/kmemleak-add-scheduling-point-to-kmemleak_scan.patch
new file mode 100644
index 0000000000..c2d6f0cfff
--- /dev/null
+++ b/patches.fixes/kmemleak-add-scheduling-point-to-kmemleak_scan.patch
@@ -0,0 +1,55 @@
+From bde5f6bc68db51128f875a756e9082a6c6ff7b4c Mon Sep 17 00:00:00 2001
+From: Yisheng Xie <xieyisheng1@huawei.com>
+Date: Wed, 29 Nov 2017 16:11:08 -0800
+Subject: [PATCH] kmemleak: add scheduling point to kmemleak_scan()
+Git-commit: bde5f6bc68db51128f875a756e9082a6c6ff7b4c
+Patch-mainline: v4.15-rc2
+References: bsc#1051510
+
+kmemleak_scan() will scan struct page for each node and it can be really
+large and resulting in a soft lockup. We have seen a soft lockup when
+do scan while compile kernel:
+
+ watchdog: BUG: soft lockup - CPU#53 stuck for 22s! [bash:10287]
+ [...]
+ Call Trace:
+ kmemleak_scan+0x21a/0x4c0
+ kmemleak_write+0x312/0x350
+ full_proxy_write+0x5a/0xa0
+ __vfs_write+0x33/0x150
+ vfs_write+0xad/0x1a0
+ SyS_write+0x52/0xc0
+ do_syscall_64+0x61/0x1a0
+ entry_SYSCALL64_slow_path+0x25/0x25
+
+Fix this by adding cond_resched every MAX_SCAN_SIZE.
+
+Link: http://lkml.kernel.org/r/1511439788-20099-1-git-send-email-xieyisheng1@huawei.com
+Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
+Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
+Acked-by: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ mm/kmemleak.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index e4738d5e9b8c..3d4781756d50 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -1523,6 +1523,8 @@ static void kmemleak_scan(void)
+ if (page_count(page) == 0)
+ continue;
+ scan_block(page, page + 1, NULL);
++ if (!(pfn % (MAX_SCAN_SIZE / sizeof(*page))))
++ cond_resched();
+ }
+ }
+ put_online_mems();
+--
+2.18.0
+
diff --git a/patches.fixes/mm-kmemleak.c-make-cond_resched-rate-limiting-more-e.patch b/patches.fixes/mm-kmemleak.c-make-cond_resched-rate-limiting-more-e.patch
new file mode 100644
index 0000000000..def6a21a9b
--- /dev/null
+++ b/patches.fixes/mm-kmemleak.c-make-cond_resched-rate-limiting-more-e.patch
@@ -0,0 +1,42 @@
+From 13ab183d138f607d885e995d625e58d47678bf97 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Thu, 14 Dec 2017 15:32:31 -0800
+Subject: [PATCH] mm/kmemleak.c: make cond_resched() rate-limiting more efficient
+Git-commit: 13ab183d138f607d885e995d625e58d47678bf97
+Patch-mainline: v4.15-rc4
+References: bsc#1051510
+
+Commit bde5f6bc68db ("kmemleak: add scheduling point to
+kmemleak_scan()") tries to rate-limit the frequency of cond_resched()
+calls, but does it in a way which might incur an expensive division
+operation in the inner loop. Simplify this.
+
+Fixes: bde5f6bc68db5 ("kmemleak: add scheduling point to kmemleak_scan()")
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Yisheng Xie <xieyisheng1@huawei.com>
+Cc: Catalin Marinas <catalin.marinas@arm.com>
+Cc: Michal Hocko <mhocko@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ mm/kmemleak.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 3d4781756d50..d73c14294f3a 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -1523,7 +1523,7 @@ static void kmemleak_scan(void)
+ if (page_count(page) == 0)
+ continue;
+ scan_block(page, page + 1, NULL);
+- if (!(pfn % (MAX_SCAN_SIZE / sizeof(*page))))
++ if (!(pfn & 63))
+ cond_resched();
+ }
+ }
+--
+2.18.0
+
diff --git a/patches.suse/sctp-fix-the-issue-that-pathmtu-may-be-set-lower-tha.patch b/patches.suse/sctp-fix-the-issue-that-pathmtu-may-be-set-lower-tha.patch
new file mode 100644
index 0000000000..313aa0a353
--- /dev/null
+++ b/patches.suse/sctp-fix-the-issue-that-pathmtu-may-be-set-lower-tha.patch
@@ -0,0 +1,48 @@
+From: Xin Long <lucien.xin@gmail.com>
+Date: Tue, 3 Jul 2018 16:30:47 +0800
+Subject: sctp: fix the issue that pathmtu may be set lower than MINSEGMENT
+Git-commit: a65925475571953da12a9bc2082aec29d4e2c0e7
+Patch-mainline: v4.18-rc6
+References: git-fixes
+
+After commit b6c5734db070 ("sctp: fix the handling of ICMP Frag Needed
+for too small MTUs"), sctp_transport_update_pmtu would refetch pathmtu
+from the dst and set it to transport's pathmtu without any check.
+
+The new pathmtu may be lower than MINSEGMENT if the dst is obsolete and
+updated by .get_dst() in sctp_transport_update_pmtu. In this case, it
+could have a smaller MTU as well, and thus we should validate it
+against MINSEGMENT instead.
+
+Syzbot reported a warning in sctp_mtu_payload caused by this.
+
+This patch refetches the pathmtu by calling sctp_dst_mtu where it does
+the check against MINSEGMENT.
+
+v1->v2:
+ - refetch the pathmtu by calling sctp_dst_mtu instead as Marcelo's
+ suggestion.
+
+Fixes: b6c5734db070 ("sctp: fix the handling of ICMP Frag Needed for too small MTUs")
+Reported-by: syzbot+f0d9d7cba052f9344b03@syzkaller.appspotmail.com
+Suggested-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Acked-by: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/sctp/transport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -276,7 +276,7 @@ bool sctp_transport_update_pmtu(struct s
+
+ if (dst) {
+ /* Re-fetch, as under layers may have a higher minimum size */
+- pmtu = SCTP_TRUNC4(dst_mtu(dst));
++ pmtu = sctp_dst_mtu(dst);
+ change = t->pathmtu != pmtu;
+ }
+ t->pathmtu = pmtu;
diff --git a/patches.suse/sctp-introduce-sctp_dst_mtu.patch b/patches.suse/sctp-introduce-sctp_dst_mtu.patch
new file mode 100644
index 0000000000..7bcc0b51ec
--- /dev/null
+++ b/patches.suse/sctp-introduce-sctp_dst_mtu.patch
@@ -0,0 +1,70 @@
+From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Date: Thu, 26 Apr 2018 16:58:57 -0300
+Subject: sctp: introduce sctp_dst_mtu
+Git-commit: 6ff0f871c20ec1769a481edca86f23c76b2b06d3
+Patch-mainline: v4.18-rc1
+References: git-fixes
+
+Which makes sure that the MTU respects the minimum value of
+SCTP_DEFAULT_MINSEGMENT and that it is correctly aligned.
+
+Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/sctp/sctp.h | 9 +++++++--
+ net/sctp/associola.c | 6 ++----
+ net/sctp/transport.c | 6 +++---
+ 3 files changed, 12 insertions(+), 9 deletions(-)
+
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -606,10 +606,15 @@ static inline struct dst_entry *sctp_tra
+ return t->dst;
+ }
+
++static inline __u32 sctp_dst_mtu(const struct dst_entry *dst)
++{
++ return SCTP_TRUNC4(max_t(__u32, dst_mtu(dst),
++ SCTP_DEFAULT_MINSEGMENT));
++}
++
+ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t)
+ {
+- __u32 pmtu = max_t(size_t, SCTP_TRUNC4(dst_mtu(t->dst)),
+- SCTP_DEFAULT_MINSEGMENT);
++ __u32 pmtu = sctp_dst_mtu(t->dst);
+
+ if (t->pathmtu == pmtu)
+ return true;
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1451,11 +1451,9 @@ void sctp_assoc_sync_pmtu(struct sctp_as
+ return;
+
+ /* Get the lowest pmtu of all the transports. */
+- list_for_each_entry(t, &asoc->peer.transport_addr_list,
+- transports) {
++ list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) {
+ if (t->pmtu_pending && t->dst) {
+- sctp_transport_update_pmtu(
+- t, SCTP_TRUNC4(dst_mtu(t->dst)));
++ sctp_transport_update_pmtu(t, sctp_dst_mtu(t->dst));
+ t->pmtu_pending = 0;
+ }
+ if (!pmtu || (t->pathmtu < pmtu))
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -245,9 +245,9 @@ void sctp_transport_pmtu(struct sctp_tra
+ &transport->fl, sk);
+ }
+
+- if (transport->dst) {
+- transport->pathmtu = SCTP_TRUNC4(dst_mtu(transport->dst));
+- } else
++ if (transport->dst)
++ transport->pathmtu = sctp_dst_mtu(transport->dst);
++ else
+ transport->pathmtu = SCTP_DEFAULT_MAXSEGMENT;
+ }
+
diff --git a/patches.suse/x86-Treat-R_X86_64_PLT32-as-R_X86_64_PC32.patch b/patches.suse/x86-Treat-R_X86_64_PLT32-as-R_X86_64_PC32.patch
new file mode 100644
index 0000000000..677730943c
--- /dev/null
+++ b/patches.suse/x86-Treat-R_X86_64_PLT32-as-R_X86_64_PC32.patch
@@ -0,0 +1,84 @@
+From: "H.J. Lu" <hjl.tools@gmail.com>
+Date: Wed, 7 Feb 2018 14:20:09 -0800
+Subject: x86: Treat R_X86_64_PLT32 as R_X86_64_PC32
+Git-commit: b21ebf2fb4cde1618915a97cc773e287ff49173e
+Patch-mainline: v4.16-rc3
+References: binutils_2.31
+
+On i386, there are 2 types of PLTs, PIC and non-PIC. PIE and shared
+objects must use PIC PLT. To use PIC PLT, you need to load
+_GLOBAL_OFFSET_TABLE_ into EBX first. There is no need for that on
+x86-64 since x86-64 uses PC-relative PLT.
+
+On x86-64, for 32-bit PC-relative branches, we can generate PLT32
+relocation, instead of PC32 relocation, which can also be used as
+a marker for 32-bit PC-relative branches. Linker can always reduce
+PLT32 relocation to PC32 if function is defined locally. Local
+functions should use PC32 relocation. As far as Linux kernel is
+concerned, R_X86_64_PLT32 can be treated the same as R_X86_64_PC32
+since Linux kernel doesn't use PLT.
+
+R_X86_64_PLT32 for 32-bit PC-relative branches has been enabled in
+binutils master branch which will become binutils 2.31.
+
+[ hjl is working on having better documentation on this all, but a few
+ more notes from him:
+
+ "PLT32 relocation is used as marker for PC-relative branches. Because
+ of EBX, it looks odd to generate PLT32 relocation on i386 when EBX
+ doesn't have GOT.
+
+ As for symbol resolution, PLT32 and PC32 relocations are almost
+ interchangeable. But when linker sees PLT32 relocation against a
+ protected symbol, it can resolved locally at link-time since it is
+ used on a branch instruction. Linker can't do that for PC32
+ relocation"
+
+ but for the kernel use, the two are basically the same, and this
+ commit gets things building and working with the current binutils
+ master - Linus ]
+
+Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/kernel/machine_kexec_64.c | 1 +
+ arch/x86/kernel/module.c | 1 +
+ arch/x86/tools/relocs.c | 3 +++
+ 3 files changed, 5 insertions(+)
+
+--- a/arch/x86/kernel/machine_kexec_64.c
++++ b/arch/x86/kernel/machine_kexec_64.c
+@@ -542,6 +542,7 @@ int arch_kexec_apply_relocations_add(con
+ goto overflow;
+ break;
+ case R_X86_64_PC32:
++ case R_X86_64_PLT32:
+ value -= (u64)address;
+ *(u32 *)location = value;
+ break;
+--- a/arch/x86/kernel/module.c
++++ b/arch/x86/kernel/module.c
+@@ -191,6 +191,7 @@ int apply_relocate_add(Elf64_Shdr *sechd
+ goto overflow;
+ break;
+ case R_X86_64_PC32:
++ case R_X86_64_PLT32:
+ if (*(u32 *)loc != 0)
+ goto invalid_relocation;
+ val -= (u64)loc;
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -769,9 +769,12 @@ static int do_reloc64(struct section *se
+ break;
+
+ case R_X86_64_PC32:
++ case R_X86_64_PLT32:
+ /*
+ * PC relative relocations don't need to be adjusted unless
+ * referencing a percpu symbol.
++ *
++ * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32.
+ */
+ if (is_percpu_sym(sym, symname))
+ add_reloc(&relocs32neg, offset);
diff --git a/series.conf b/series.conf
index 9aa7e28b75..3020e5a609 100644
--- a/series.conf
+++ b/series.conf
@@ -4268,6 +4268,7 @@
patches.suse/irqchip-gic-v3-Honor-forced-affinity-setting.patch
patches.suse/irqchip-gic-v3-its-Remove-ACPICA-version-check-for-A.patch
patches.suse/irqchip-gic-Ensure-we-have-an-ISB-between-ack-and-ha.patch
+ patches.drivers/irqchip-brcmstb-l2-Define-an-irq_pm_shutdown-functio
patches.suse/irqchip-gic-v3-its-Allow-GIC-ITS-number-more-than-MA.patch
patches.suse/irqchip-gic-v3-its-platform-msi-Fix-msi-parent-parsi.patch
patches.arch/clocksource-drivers-arm_arch_timer-Fix-mem-frame-loo.patch
@@ -8872,6 +8873,7 @@
patches.drivers/PCI-ASPM-Account-for-downstream-device-s-Port-Common
patches.drivers/PCI-ASPM-Use-correct-capability-pointer-to-program-L
patches.drivers/PCI-ASPM-Add-L1-Substates-definitions
+ patches.drivers/misc-pci_endpoint_test-Avoid-triggering-a-BUG.patch
patches.drivers/0001-PCI-Add-for_each_pci_bridge-helper.patch
patches.drivers/0001-PCI-Move-pci_hp_add_bridge-to-drivers-pci-probe.c.patch
patches.drivers/0001-PCI-Open-code-the-two-pass-loop-when-scanning-bridge.patch
@@ -9816,6 +9818,8 @@
patches.suse/KVM-SVM-obey-guest-PAT.patch
patches.suse/kvm-vmx-Reinstate-support-for-CPUs-without-virtual-N.patch
patches.suse/kvm-vmx-Allow-disabling-virtual-NMI-support.patch
+ patches.fixes/coccinelle-fix-parallel-build-with-CHECK-scripts-coc.patch
+ patches.fixes/kbuild-pkg-use-transform-option-to-prefix-paths-in-t.patch
patches.suse/0001-timekeeping-Eliminate-the-stale-declaration-of-ktime.patch
patches.suse/0001-objtool-Move-synced-files-to-their-original-relative.patch
patches.suse/0002-objtool-Move-kernel-headers-code-sync-check-to-a-scr.patch
@@ -9831,6 +9835,7 @@
patches.suse/irqchip-gic-v3-Fix-ppi-partitions-lookup.patch
patches.suse/irqchip-gic-v3-pr_err-strings-should-end-with-newlin.patch
patches.suse/irqchip-gic-v4-Add-forward-definition-of-struct-irq_.patch
+ patches.drivers/irqchip-qcom-Fix-u32-comparison-with-value-less-than
patches.fixes/ARM-8721-1-mm-dump-check-hardware-RO-bit-for-LPAE.patch
patches.fixes/ARM-8722-1-mm-make-STRICT_KERNEL_RWX-effective-for-L.patch
patches.fixes/ARM-BUG-if-jumping-to-usermode-address-in-kernel-mod.patch
@@ -9875,6 +9880,7 @@
patches.fixes/v4l2-disable-filesystem-dax-mapping-support.patch
patches.fixes/IB-core-disable-memory-registration-of-filesystem-da.patch
patches.fixes/mm-madvise.c-fix-madvise-infinite-loop-under-special.patch
+ patches.fixes/kmemleak-add-scheduling-point-to-kmemleak_scan.patch
patches.fixes/fs-fat-inode.c-fix-sb_rdonly-change.patch
patches.fixes/mm-hugetlb-fix-NULL-pointer-dereference-on-5-level-p.patch
patches.fixes/fs-hugetlbfs-inode-c-change-put_page-unlock_page-order-in-hugetlbfs_fallocate.patch
@@ -10178,6 +10184,7 @@
patches.drivers/platform-x86-asus-wireless-send-an-EV_SYN-SYN_REPORT
patches.drivers/drm-rework-delayed-connector-cleanup-in-connector_it
patches.fixes/0001-cifs-fix-NULL-deref-in-SMB2_read.patch
+ patches.fixes/mm-kmemleak.c-make-cond_resched-rate-limiting-more-e.patch
patches.fixes/0001-autofs-fix-careless-error-in-recent-commit.patch
patches.suse/mm-page_alloc.c-avoid-excessive-IRQ-disabled-times-in-free_unref_page_list.patch
patches.fixes/mm-frame_vector.c-release-a-semaphore-in-get_vaddr_f.patch
@@ -10492,6 +10499,7 @@
patches.arch/31-x86-mm-dump_pagetables-check-user-space-page-table-for-wx-pages.patch
patches.arch/32-x86-mm-dump_pagetables-allow-dumping-current-pagetables.patch
patches.arch/33-x86-ldt-make-the-ldt-mapping-ro.patch
+ patches.fixes/kbuild-add-fno-stack-check-to-kernel-build-options.patch
patches.drivers/scsi-core-check-for-device-state-in-__scsi_remove_ta.patch
patches.suse/msft-hv-1521-scsi-storvsc-Fix-scsi_cmd-error-assignments-in-storv.patch
patches.fixes/0001-USB-Fix-off-by-one-in-type-specific-length-check-of-.patch
@@ -11004,6 +11012,7 @@
patches.suse/btrfs-avoid-losing-data-raid-profile-when-deleting-a-device.patch
patches.suse/0001-nubus-Avoid-array-underflow-and-overflow.patch
patches.suse/0001-nubus-Fix-up-header-split.patch
+ patches.drivers/irqchip-gic-v3-Fix-the-driver-probe-fail-due-to-disa
patches.drivers/clocksource-drivers-stm32-Fix-kernel-panic-with-mult
patches.suse/hrtimer-Ensure-POSIX-compliance-relative-CLOCK_REALTIME-hrtimers.patch
patches.arch/x86-intel_rdt-enumerate-l2-code-and-data-prioritization-cdp-feature.patch
@@ -11728,6 +11737,7 @@
patches.drivers/Input-synaptics-reset-the-ABS_X-Y-fuzz-after-initial
patches.drivers/Input-synaptics-rmi4-do-not-delete-interrupt-memory-
patches.fixes/Input-synaptics-rmi4-unmask-F03-interrupts-when-port
+ patches.fixes/kconfig-display-recursive-dependency-resolution-hint.patch
patches.fixes/kconfig-Don-t-leak-main-menus-during-parsing
patches.fixes/kconfig-Fix-automatic-menu-creation-mem-leak
patches.fixes/kconfig-Fix-expr_free-E_NOT-leak
@@ -12703,6 +12713,9 @@
patches.drivers/nvmet-Change-return-code-of-discard-command-if-not-s.patch
patches.drivers/nvme-rdma-fix-sysfs-invoked-reset_ctrl-error-flow.patch
patches.fixes/cpumask-Make-for_each_cpu_wrap-available-on-UP-as-well.patch
+ patches.drivers/irqchip-gic-v3-Change-pr_debug-message-to-pr_devel
+ patches.drivers/irqchip-gic-v3-Use-wmb-instead-of-smb_wmb-in-gic_rai
+ patches.drivers/irqchip-gic-v3-Ignore-disabled-ITS-nodes
patches.drivers/mvpp2-fix-multicast-address-filter.patch
patches.fixes/bridge-check-brport-attr-show-in-brport_show.patch
patches.fixes/sctp-do-not-pr_err-for-the-duplicated-node-in-transp.patch
@@ -12723,6 +12736,7 @@
patches.fixes/dn_getsockoptdecnet-move-nf_-get-set-sockopt-outside.patch
patches.fixes/udplite-fix-partial-checksum-initialization.patch
patches.drivers/tg3-APE-heartbeat-changes.patch
+ patches.suse/x86-Treat-R_X86_64_PLT32-as-R_X86_64_PC32.patch
patches.fixes/kernel-relay.c-limit-kmalloc-size-to-KMALLOC_MAX_SIZ
patches.drivers/IB-ipoib-Do-not-warn-if-IPoIB-debugfs-doesn-t-exist.patch
patches.drivers/IB-uverbs-Fix-method-merging-in-uverbs_ioctl_merge.patch
@@ -13068,6 +13082,7 @@
patches.drivers/watchdog-f71808e_wdt-Fix-magic-close-handling
patches.drivers/watchdog-sbsa-use-32-bit-read-for-WCV.patch
patches.drivers/watchdog-hpwdt-Remove-legacy-NMI-sourcing
+ patches.fixes/kbuild-Handle-builtin-dtb-file-names-containing-hyph.patch
patches.drivers/dmaengine-rcar-dmac-fix-max_chunk_size-for-R-Car-Gen
patches.drivers/dmaengine-mv_xor_v2-Fix-clock-resource-by-adding-a-r
patches.suse/objtool-Fix-32-bit-build.patch
@@ -13126,6 +13141,7 @@
patches.drivers/libata-don-t-try-to-pass-through-ncq-commands-to-non-ncq.patch
patches.drivers/libata-apply-nolpm-quirk-to-crucial-mx100-512gb-ssds.patch
patches.drivers/libata-disable-lpm-for-crucial-bx100-ssd-500gb-drive.patch
+ patches.drivers/ata-do-not-schedule-hot-plug-if-it-is-a-sas-host.patch
patches.drivers/ahci-add-pci-id-for-the-highpoint-rocketraid-644l-card.patch
patches.drivers/PCI-Add-function-1-DMA-alias-quirk-for-Highpoint-Roc
patches.drivers/libata-enable-queued-trim-for-samsung-ssd-860.patch
@@ -13134,6 +13150,7 @@
patches.drivers/libata-modify-quirks-for-mx100-to-limit-ncq_trim-quirk-to.patch
patches.fixes/workqueue-use-put_device-instead-of-kfree
patches.arch/kvm-x86-fix-icebp-instruction-handling
+ patches.drivers/scsi-libsas-defer-ata-device-eh-commands-to-libata.patch
patches.drivers/scsi-qla2xxx-Remove-FC_NO_LOOP_ID-for-FCP-and-FC-NVM.patch
patches.drivers/IB-mlx5-Fix-out-of-bounds-read-in-create_raw_packet_.patch
patches.drivers/IB-mlx5-Fix-integer-overflows-in-mlx5_ib_create_srq.patch
@@ -13204,6 +13221,7 @@
patches.drivers/bnxt_en-Return-standard-Linux-error-codes-for-hwrm-f.patch
patches.drivers/bnxt_en-close-open-NIC-only-when-the-interface-is-in.patch
patches.drivers/bnxt_en-Check-valid-VNIC-ID-in-bnxt_hwrm_vnic_set_tp.patch
+ patches.drivers/can-m_can-change-comparison-to-bitshift-when-dealing
patches.drivers/can-ifi-Check-core-revision-upon-probe
patches.drivers/can-ifi-Repair-the-error-handling
patches.drivers/can-peak-pcie_fd-fix-echo_skb-is-occupied-bug
@@ -13688,6 +13706,7 @@
patches.fixes/ext4-move-call-to-ext4_error-into-ext4_xattr_check_b.patch
patches.fixes/ext4-add-bounds-checking-to-ext4_xattr_find_entry.patch
patches.drivers/random-use-a-tighter-cap-in-credit_entropy_bits_safe
+ patches.drivers/irqchip-gic-Take-lock-when-updating-irq-type
patches.drivers/crypto-chelsio-Make-function-aead_ccm_validate_input.patch
patches.drivers/crypto-sunxi-ss-Add-MODULE_ALIAS-to-sun4i-ss
patches.drivers/hwrng-stm32-add-reset-during-probe
@@ -14467,6 +14486,7 @@
patches.drivers/USB-serial-option-adding-support-for-ublox-R410M.patch
patches.drivers/USB-serial-visor-handle-potential-invalid-device-con.patch
patches.drivers/platform-x86-asus-wireless-Fix-NULL-pointer-derefere
+ patches.drivers/irqchip-qcom-Fix-check-for-spurious-interrupts
patches.fixes/doc-Add-vendor-prefix-for-Kieback-Peter-GmbH
patches.drivers/gpio-fix-aspeed_gpio-unmask-irq
patches.drivers/gpioib-do-not-free-unrequested-descriptors
@@ -14503,6 +14523,7 @@
patches.fixes/af_key-Always-verify-length-of-provided-sadb_key.patch
patches.fixes/vti6-Change-minimum-MTU-to-IPV4_MIN_MTU-vti6-can-car.patch
patches.suse/llc-better-deal-with-too-small-mtu.patch
+ patches.drivers/can-dev-increase-bus-off-message-severity
patches.drivers/can-kvaser_usb-Increase-correct-stats-counter-in-kva
patches.drivers/r8169-fix-powering-up-RTL8168h
patches.drivers/qed-Fix-l2-initializations-over-iWARP-personality.patch
@@ -14590,6 +14611,7 @@
patches.drivers/radix-tree-fix-multi-order-iteration-race.patch
patches.fixes/ARM-davinci-board-da830-evm-fix-GPIO-lookup-for-MMC-.patch
patches.fixes/ARM-davinci-board-da850-evm-fix-GPIO-lookup-for-MMC-.patch
+ patches.fixes/ARM-davinci-board-omapl138-hawk-fix-GPIO-numbers-for.patch
patches.fixes/ARM-davinci-board-dm355-evm-fix-broken-networking.patch
patches.drivers/tee-shm-fix-use-after-free-via-temporarily-dropped-r
patches.drivers/tee-check-shm-references-are-consistent-in-offset-si
@@ -14849,6 +14871,7 @@
patches.fixes/kconfig-Avoid-format-overflow-warning-from-GCC-8.1
patches.fixes/ARM-8764-1-kgdb-fix-NUMREGBYTES-so-that-gdb_regs-is-.patch
patches.fixes/printk-fix-possible-reuse-of-va_list-variable.patch
+ patches.drivers/clk-renesas-cpg-mssr-Stop-using-printk-format-pCr
patches.drivers/thermal-bcm2835-Stop-using-printk-format-pCr
patches.drivers/serial-sh-sci-Stop-using-printk-format-pCr
patches.fixes/audit-Fix-wrong-task-in-comparison-of-session-ID.patch
@@ -14862,6 +14885,7 @@
patches.drivers/ixgbe-Drop-support-for-macvlan-specific-unicast-list.patch
patches.drivers/igb-Fix-not-adding-filter-elements-to-the-list.patch
patches.drivers/igb-Fix-queue-selection-on-MAC-filters-on-i210.patch
+ patches.suse/sctp-introduce-sctp_dst_mtu.patch
patches.drivers/bnxt_en-Add-TC-to-hardware-QoS-queue-mapping-logic.patch
patches.drivers/bnxt_en-Remap-TC-to-hardware-queues-when-configuring.patch
patches.drivers/bnxt_en-Check-the-lengths-of-encapsulated-firmware-r.patch
@@ -15371,6 +15395,7 @@
patches.fixes/0001-USB-yurex-fix-out-of-bounds-uaccess-in-read-handler.patch
patches.drivers/staging-rtl8723bs-Prevent-an-underflow-in-rtw_check_
patches.drivers/vmw_balloon-fix-inflation-with-batching
+ patches.fixes/ibmasm-don-t-write-out-of-bounds-in-read-handler.patch
patches.drivers/ahci-Disable-LPM-on-Lenovo-50-series-laptops-with-a-
patches.drivers/acpi-nfit-fix-cmd_rc-for-acpi_nfit_ctl-to-always-ret
patches.drivers/acpi-nfit-Fix-scrub-idle-detection.patch
@@ -15387,6 +15412,7 @@
patches.drivers/pinctrl-nsp-Fix-potential-NULL-dereference
patches.drivers/rtlwifi-Fix-kernel-Oops-Fw-download-fail
patches.drivers/rtlwifi-rtl8821ae-fix-firmware-is-not-ready-to-run
+ patches.suse/sctp-fix-the-issue-that-pathmtu-may-be-set-lower-tha.patch
patches.drivers/smsc75xx-Add-workaround-for-gigabit-link-up-hardware
patches.drivers/qed-Fix-reading-stale-configuration-information.patch
patches.drivers/qed-off-by-one-in-qed_parse_mcp_trace_buf.patch
@@ -15452,6 +15478,11 @@
patches.fixes/tcp-add-tcp_ooo_try_coalesce-helper.patch
patches.drivers/net-mlx4_core-Save-the-qpn-from-the-input-modifier-i.patch
patches.drivers/qmi_wwan-fix-interface-number-for-DW5821e-production
+ patches.fixes/0001-fscache-Allow-cancelled-operations-to-be-enqueued.patch
+ patches.fixes/0002-cachefiles-Fix-refcounting-bug-in-backing-file-read-.patch
+ patches.fixes/0003-fscache-Fix-reference-overput-in-fscache_attach_obje.patch
+ patches.fixes/0004-cachefiles-Fix-missing-clear-of-the-CACHEFILES_OBJEC.patch
+ patches.fixes/0005-cachefiles-Wait-rather-than-BUG-ing-on-Unexpected-ob.patch
patches.drivers/driver-core-Partially-revert-driver-core-correct-dev
patches.drivers/staging-speakup-fix-wraparound-in-uaccess-length-che
patches.drivers/usb-cdc_acm-Add-quirk-for-Castles-VEGA3000.patch
@@ -15466,12 +15497,15 @@
patches.drivers/nvmet-fc-fix-target-sgl-list-on-large-transfers.patch
patches.fixes/nvme-if_ready-checks-to-fail-io-to-deleting-controll.patch
patches.fixes/nvmet-fixup-crash-on-NULL-device-path.patch
+ patches.drivers/can-ems_usb-Fix-memory-leak-on-ems_usb_disconnect
patches.drivers/virtio_balloon-fix-another-race-between-migration-an
patches.fixes/scsi-qla2xxx-fix-unintialized-list-head-crash.patch
patches.fixes/scsi-qla2xxx-fix-npiv-deletion-by-calling-wait_for_sess_deletion.patch
patches.fixes/scsi-qla2xxx-fix-driver-unload-by-shutting-down-chip.patch
patches.fixes/scsi-qla2xxx-return-error-when-tmf-returns.patch
+ patches.fixes/audit-fix-potential-null-dereference-context-module.patch
patches.suse/cpufreq-intel_pstate-Limit-the-scope-of-HWP-dynamic-.patch
+ patches.drivers/iwlwifi-add-more-card-IDs-for-9000-series
patches.drivers/crypto-padlock-aes-Fix-Nano-workaround-data-corrupti
patches.drivers/drm-re-enable-error-handling
patches.drivers/drm-atomic-Check-old_plane_state-crtc-in-drm_atomic_