Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-08-16 07:19:38 +0200
committerKernel Build Daemon <kbuild@suse.de>2019-08-16 07:19:38 +0200
commit37159a078e6b2d830531774f1c8976b766981cd5 (patch)
tree17d24edfc8c29b0b5e8e379e7b324bc1cf9ac9c2
parent1c60c8c3968420cd646d7f0ce61038fe2ac5578a (diff)
parentc1822f240a06b1a952dd59d59c622feedcece6c5 (diff)
Merge branch 'SLE15-SP1' into openSUSE-15.1
-rw-r--r--blacklist.conf12
-rw-r--r--patches.arch/KVM-PPC-Book3S-HV-Fix-CR0-setting-in-TM-emulation.patch63
-rw-r--r--patches.arch/kvm-fix-leak-vcpu-s-vmcs-value-into-other-pcpu198
-rw-r--r--patches.arch/kvm-lapic-fix-pending-interrupt-in-irr-blocked-by-software-disable-lapic139
-rw-r--r--patches.arch/kvm-nvmx-allow-setting-the-vmfunc-controls-msr33
-rw-r--r--patches.arch/kvm-nvmx-do-not-use-dangling-shadow-vmcs-after-guest-reset63
-rw-r--r--patches.arch/kvm-nvmx-remove-unnecessary-sync_roots-from-handle_invept60
-rw-r--r--patches.arch/kvm-nvmx-use-adjusted-pin-controls-for-vmcs0254
-rw-r--r--patches.arch/kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat-with-bad-value36
-rw-r--r--patches.arch/kvm-vmx-check-cpuid-before-allowing-read-write-of-ia32_xss53
-rw-r--r--patches.arch/kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-entry88
-rw-r--r--patches.arch/kvm-x86-degrade-warn-to-pr_warn_ratelimited44
-rw-r--r--patches.arch/kvm-x86-unconditionally-enable-irqs-in-guest-context66
-rw-r--r--patches.arch/kvm-x86-vpmu-refine-kvm_pmu-err-msg-when-event-creation-failed38
-rw-r--r--patches.arch/mm-vmalloc-sync-unmappings-in-_purge_vmap_area_lazy55
-rw-r--r--patches.arch/powerpc-64s-Include-cpu-header.patch48
-rw-r--r--patches.arch/powerpc-book3s-64-check-for-NULL-pointer-in-pgd_allo.patch62
-rw-r--r--patches.arch/powerpc-lib-Fix-feature-fixup-test-of-external-branc.patch53
-rw-r--r--patches.arch/powerpc-mm-Handle-page-table-allocation-failures.patch62
-rw-r--r--patches.arch/powerpc-perf-Add-constraints-for-power9-l2-l3-bus-ev.patch194
-rw-r--r--patches.arch/powerpc-perf-Cleanup-cache_sel-bits-comment.patch45
-rw-r--r--patches.arch/powerpc-perf-Fix-thresholding-counter-data-for-unkno.patch46
-rw-r--r--patches.arch/powerpc-perf-Remove-PM_BR_CMPL_ALT-from-power9-event.patch36
-rw-r--r--patches.arch/powerpc-perf-Update-perf_regs-structure-to-include-S.patch141
-rw-r--r--patches.arch/powerpc-powernv-Return-for-invalid-IMC-domain.patch52
-rw-r--r--patches.arch/powerpc-powernv-opal-dump-Use-IRQ_HANDLED-instead-of.patch63
-rw-r--r--patches.arch/powerpc-pseries-add-missing-cpumask.h-include-file.patch42
-rw-r--r--patches.arch/powerpc-xive-Fix-loop-exit-condition-in-xive_find_ta.patch124
-rw-r--r--patches.arch/s390-dasd-fix-endless-loop-after-read-unit-address-c.patch95
-rw-r--r--patches.arch/s390-sles15sp1-00-08-46-s390-cio-fix-ccw_device_start_timeout-API.patch44
-rw-r--r--patches.arch/x86-microcode-fix-the-microcode-load-on-cpu-hotplug-for-real.patch65
-rw-r--r--patches.arch/x86-mm-check-for-pfn-instead-of-page-in-vmalloc_sync_one31
-rw-r--r--patches.arch/x86-mm-sync-also-unmappings-in-vmalloc_sync_all61
-rw-r--r--patches.drivers/ALSA-firewire-fix-a-memory-leak-bug.patch42
-rw-r--r--patches.drivers/ALSA-hda-Don-t-override-global-PCM-hw-info-flag.patch45
-rw-r--r--patches.drivers/ALSA-hda-Workaround-for-crackled-sound-on-AMD-contro.patch209
-rw-r--r--patches.drivers/ALSA-hiface-fix-multiple-memory-leak-bugs.patch61
-rw-r--r--patches.drivers/ASoC-dapm-Fix-handling-of-custom_stop_condition-on-D.patch78
-rw-r--r--patches.drivers/HID-Add-quirk-for-HP-X1200-PIXART-OEM-mouse.patch45
-rw-r--r--patches.drivers/IB-mlx5-Fix-MR-registration-flow-to-use-UMR-properly.patch103
-rw-r--r--patches.drivers/PCI-Restore-Resizable-BAR-size-bits-correctly-for-1M.patch58
-rw-r--r--patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch10
-rw-r--r--patches.drivers/gpio-gpio-omap-add-check-for-off-wake-capable-gpios.patch84
-rw-r--r--patches.drivers/hwmon-nct7802-Fix-wrong-detection-of-in4-presence.patch60
-rw-r--r--patches.drivers/iommu-amd-add-support-for-x2apic-iommu-interrupts168
-rw-r--r--patches.drivers/iwlwifi-don-t-unmap-as-page-memory-that-was-mapped-a.patch41
-rw-r--r--patches.drivers/iwlwifi-mvm-fix-an-out-of-bound-access.patch42
-rw-r--r--patches.drivers/mfd-intel-lpss-Add-Intel-Comet-Lake-PCI-IDs.patch48
-rw-r--r--patches.drivers/mmc-cavium-Add-the-missing-dma-unmap-when-the-dma-ha.patch75
-rw-r--r--patches.drivers/mmc-cavium-Set-the-correct-dma-max-segment-size-for-.patch84
-rw-r--r--patches.drivers/mmc-sdhci-pci-Add-support-for-Intel-CML.patch48
-rw-r--r--patches.drivers/mmc-sdhci-pci-add-support-for-intel-icp.patch2
-rw-r--r--patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch2
-rw-r--r--patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch2
-rw-r--r--patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch2
-rw-r--r--patches.drivers/net-ena-add-good-checksum-counter.patch2
-rw-r--r--patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch2
-rw-r--r--patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch2
-rw-r--r--patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch2
-rw-r--r--patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch2
-rw-r--r--patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch6
-rw-r--r--patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch4
-rw-r--r--patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch16
-rw-r--r--patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch10
-rw-r--r--patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch2
-rw-r--r--patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch2
-rw-r--r--patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch2
-rw-r--r--patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch2
-rw-r--r--patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch2
-rw-r--r--patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch4
-rw-r--r--patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch2
-rw-r--r--patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch4
-rw-r--r--patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch2
-rw-r--r--patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch4
-rw-r--r--patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch2
-rw-r--r--patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch2
-rw-r--r--patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch6
-rw-r--r--patches.drivers/net-mlx4_core-Zero-out-lkey-field-in-SW2HW_MPT-fw-co.patch2
-rw-r--r--patches.drivers/qede-fix-write-to-free-d-pointer-error-and-double-fr.patch2
-rw-r--r--patches.drivers/regulator-qcom_spmi-Fix-math-of-spmi_regulator_set_v.patch67
-rw-r--r--patches.drivers/sis900-fix-TX-completion.patch119
-rw-r--r--patches.drivers/sound-fix-a-memory-leak-bug.patch42
-rw-r--r--patches.drivers/tpm-Fix-TPM-1.2-Shutdown-sequence-to-prevent-future-.patch50
-rw-r--r--patches.drivers/tpm-Fix-off-by-one-when-reading-binary_bios_measurem.patch78
-rw-r--r--patches.drivers/tpm-Unify-the-send-callback-behaviour.patch237
-rw-r--r--patches.drivers/tpm-tpm_i2c_atmel-Return-E2BIG-when-the-transfer-is-.patch41
-rw-r--r--patches.drivers/tpm-vtpm_proxy-Suppress-error-logging-when-in-closed.patch57
-rw-r--r--patches.drivers/usb-host-xhci-rcar-Fix-timeout-in-xhci_suspend.patch50
-rw-r--r--patches.drivers/usb-iowarrior-fix-deadlock-on-disconnect.patch55
-rw-r--r--patches.drivers/usb-yurex-Fix-use-after-free-in-yurex_delete.patch160
-rw-r--r--patches.drivers/watchdog-core-fix-null-pointer-dereference-when-rele.patch48
-rw-r--r--patches.drivers/watchdog-f71808e_wdt-fix-F81866-bit-operation.patch58
-rw-r--r--patches.drm/drm-i915-userptr-Acquire-the-page-lock-around-set_pa.patch56
-rw-r--r--patches.drm/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch43
-rw-r--r--patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch15
-rw-r--r--patches.fixes/0001-s390-qeth-be-drop-monitor-friendly.patch26
-rw-r--r--patches.fixes/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch46
-rw-r--r--patches.fixes/NFS-Fix-the-inode-request-accounting-when-pages-have.patch79
-rw-r--r--patches.fixes/crypto-ccp-Fix-oops-by-properly-managing-allocated-s.patch43
-rw-r--r--patches.fixes/crypto-ccp-Ignore-tag-length-when-decrypting-GCM-cip.patch38
-rw-r--r--patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch3
-rw-r--r--patches.fixes/ehea-Fix-a-copy-paste-err-in-ehea_init_port_res.patch38
-rw-r--r--patches.fixes/fsl-fman-Use-GFP_ATOMIC-in-memac-tgec-_add_hash_mac_.patch75
-rw-r--r--patches.fixes/jbd2-flush_descriptor-Do-not-decrease-buffer-head-s-ref-count.patch61
-rw-r--r--patches.fixes/sched-fair-Don-t-free-p-numa_faults-with-concurrent-.patch141
-rw-r--r--patches.fixes/sched-fair-Use-RCU-accessors-consistently-for-numa_g.patch385
-rw-r--r--patches.kabi/KVM-Fix-kABI.patch (renamed from patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch)15
-rw-r--r--patches.kabi/kABI-Fix-kABI-for-struct-amd_iommu.patch29
-rw-r--r--patches.kabi/kabi-x86-microcode-hotplug-state-fix.patch8
-rw-r--r--patches.suse/0001-btrfs-Split-btrfs_del_delalloc_inode-into-2-function.patch70
-rw-r--r--patches.suse/0001-irqchip-gic-v3-its-fix-build-warnings.patch61
-rw-r--r--patches.suse/0002-btrfs-Fix-delalloc-inodes-invalidation-during-transa.patch133
-rw-r--r--patches.suse/0002-btrfs-Remove-fsid-metadata_fsid-fields-from-btrfs_in.patch2
-rw-r--r--patches.suse/0003-btrfs-add-cleanup_ref_head_accounting-helper.patch117
-rw-r--r--patches.suse/0004-btrfs-handle-delayed-ref-head-accounting-cleanup-in-.patch136
-rw-r--r--patches.suse/0005-btrfs-clean-up-pending-block-groups-when-transaction.patch119
-rw-r--r--patches.suse/0006-btrfs-fix-pinned-underflow-after-transaction-aborted.patch104
-rw-r--r--patches.suse/0007-btrfs-start-readahead-also-in-seed-devices.patch52
-rw-r--r--patches.suse/0031-bcache-add-return-value-check-to-bch_cached_dev_run.patch2
-rw-r--r--patches.suse/Btrfs-fix-race-between-send-and-deduplication-that-l.patch242
-rw-r--r--patches.suse/Btrfs-prevent-send-failures-and-crashes-due-to-concu.patch182
-rw-r--r--patches.suse/btrfs-prevent-ioctls-from-interfering-with-a-swap-file.patch10
-rw-r--r--patches.suse/btrfs-track-running-balance-in-a-simpler-way.patch159
-rw-r--r--patches.suse/objtool-add-rewind_stack_do_exit-to-the-noreturn-list.patch33
-rw-r--r--patches.suse/objtool-fix-segfault-in-cold-detection-with-ffunction-sections.patch2
-rw-r--r--patches.suse/objtool-support-gcc-9-cold-subfunction-naming-scheme.patch50
-rw-r--r--patches.suse/xfs-dump-transaction-usage-details-on-log-reservation-overrun.patch162
-rw-r--r--patches.suse/xfs-eliminate-duplicate-icreate-tx-reservation-functions.patch143
-rw-r--r--patches.suse/xfs-fix-semicolon-cocci-warnings.patch39
-rw-r--r--patches.suse/xfs-fix-up-agi-unlinked-list-reservations.patch62
-rw-r--r--patches.suse/xfs-include-an-allocfree-res-for-inobt-modifications.patch214
-rw-r--r--patches.suse/xfs-include-inobt-buffers-in-ifree-tx-log-reservation.patch84
-rw-r--r--patches.suse/xfs-print-transaction-log-reservation-on-overrun.patch47
-rw-r--r--patches.suse/xfs-refactor-inode-chunk-alloc-free-tx-reservation.patch169
-rw-r--r--patches.suse/xfs-refactor-xlog_cil_insert_items-to-facilitate-transaction-dump.patch134
-rw-r--r--patches.suse/xfs-separate-shutdown-from-ticket-reservation-print-helper.patch81
-rw-r--r--patches.suse/xfs-truncate-transaction-does-not-modify-the-inobt.patch49
-rw-r--r--series.conf103
-rw-r--r--supported.conf2
139 files changed, 8405 insertions, 182 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 8ed31055d2..ee3d783e9a 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -162,6 +162,7 @@ drivers/ide # IDE not shipped since SLE12
CVE-2018-16880 # bsc#1122767, needed only for SLE15-SP1+
CVE-2019-9003 # bsc#1126704, needed only for SLE15-SP1+
CVE-2019-11811 # bsc#1134397, needed only for SLE15-SP1+
+CVE-2019-12817 # bsc#1138263, bsc#1139619, needed only for SLE15-SP1+
# Blacklisted Commits
# -------------------
@@ -1268,3 +1269,14 @@ f9927000cb35f250051f0f1878db12ee2626eea1 # ASoC: sun4i: not applicable
fd14f4436fd47d5418023c90e933e66d3645552e # ASoC: davinci: not applicable
12209993e98c5fa1855c467f22a24e3d5b8be205 # kABI breaks
1b7aebf0487613033aff26420e32fa2076d52846 # warning fix
+6ae865615fc43d014da2fd1f1bba7e81ee622d1b # UBSAN bug which we don't use
+81c7ed296dcd02bc0b4488246d040e03e633737a # We don't support CONFIG_X86_5LEVEL
+c1887159eb48ba40e775584cfb2a443962cf1a05 # Clang fix
+684fb246578b9e81fc7b4ca5c71eae22edb650b2 # clang fix
+5564597d51c8ff5b88d95c76255e18b13b760879 # no support for powermacs
+fe60522ec60082a1dd735691b82c64f65d4ad15e # not needed (bsc#1088804)
+73aca179d78eaa11604ba0783a6d8b2125fbc332 # do not want to alter vermagic on released product
+8adddf349fda0d3de2f6bb41ddf838cbf36a8ad2 # config-only fix
+3e3ebed3fef4878e6f1680ff98088db1a9688831 # config-only fix
+d065ee93aab6ef4c2a5af5c455b5044bd5136547 # config-only fix
+2b874a5c7b75fdc90fdd1e2ffaa3ec5a9d21e253 # config-only fix
diff --git a/patches.arch/KVM-PPC-Book3S-HV-Fix-CR0-setting-in-TM-emulation.patch b/patches.arch/KVM-PPC-Book3S-HV-Fix-CR0-setting-in-TM-emulation.patch
new file mode 100644
index 0000000000..ae6f8f875e
--- /dev/null
+++ b/patches.arch/KVM-PPC-Book3S-HV-Fix-CR0-setting-in-TM-emulation.patch
@@ -0,0 +1,63 @@
+From 4f50d1fdd77ea1e2db084b8282ed81a7d6c87a26 Mon Sep 17 00:00:00 2001
+From: Michael Neuling <mikey@neuling.org>
+Date: Thu, 20 Jun 2019 16:00:40 +1000
+Subject: [PATCH] KVM: PPC: Book3S HV: Fix CR0 setting in TM emulation
+
+References: bsc#1061840
+Patch-mainline: v5.3-rc1
+Git-commit: 3fefd1cd95df04da67c83c1cb93b663f04b3324f
+
+When emulating tsr, treclaim and trechkpt, we incorrectly set CR0. The
+code currently sets:
+ CR0 <- 00 || MSR[TS]
+but according to the ISA it should be:
+ CR0 <- 0 || MSR[TS] || 0
+
+This fixes the bit shift to put the bits in the correct location.
+
+This is a data integrity issue as CR0 is corrupted.
+
+Fixes: 4bb3c7a0208f ("KVM: PPC: Book3S HV: Work around transactional memory bugs in POWER9")
+Cc: stable@vger.kernel.org # v4.17+
+Tested-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
+Signed-off-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/kvm/book3s_hv_tm.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/powerpc/kvm/book3s_hv_tm.c b/arch/powerpc/kvm/book3s_hv_tm.c
+index 008285058f9b..d23a0131b016 100644
+--- a/arch/powerpc/kvm/book3s_hv_tm.c
++++ b/arch/powerpc/kvm/book3s_hv_tm.c
+@@ -131,7 +131,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+ }
+ /* Set CR0 to indicate previous transactional state */
+ vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ /* L=1 => tresume, L=0 => tsuspend */
+ if (instr & (1 << 21)) {
+ if (MSR_TM_SUSPENDED(msr))
+@@ -175,7 +175,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+
+ /* Set CR0 to indicate previous transactional state */
+ vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ vcpu->arch.shregs.msr &= ~MSR_TS_MASK;
+ return RESUME_GUEST;
+
+@@ -205,7 +205,7 @@ int kvmhv_p9_tm_emulation(struct kvm_vcpu *vcpu)
+
+ /* Set CR0 to indicate previous transactional state */
+ vcpu->arch.cr = (vcpu->arch.cr & 0x0fffffff) |
+- (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 28);
++ (((msr & MSR_TS_MASK) >> MSR_TS_S_LG) << 29);
+ vcpu->arch.shregs.msr = msr | MSR_TS_S;
+ return RESUME_GUEST;
+ }
+--
+2.22.0
+
diff --git a/patches.arch/kvm-fix-leak-vcpu-s-vmcs-value-into-other-pcpu b/patches.arch/kvm-fix-leak-vcpu-s-vmcs-value-into-other-pcpu
new file mode 100644
index 0000000000..a5edda6d99
--- /dev/null
+++ b/patches.arch/kvm-fix-leak-vcpu-s-vmcs-value-into-other-pcpu
@@ -0,0 +1,198 @@
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Mon, 5 Aug 2019 10:03:19 +0800
+Subject: KVM: Fix leak vCPU's VMCS value into other pCPU
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 17e433b54393a6269acbcb792da97791fe1592d8
+Patch-mainline: v5.3-rc4
+References: bsc#1145388
+
+After commit d73eb57b80b (KVM: Boost vCPUs that are delivering interrupts), a
+five years old bug is exposed. Running ebizzy benchmark in three 80 vCPUs VMs
+on one 80 pCPUs Skylake server, a lot of rcu_sched stall warning splatting
+in the VMs after stress testing:
+
+ INFO: rcu_sched detected stalls on CPUs/tasks: { 4 41 57 62 77} (detected by 15, t=60004 jiffies, g=899, c=898, q=15073)
+ Call Trace:
+ flush_tlb_mm_range+0x68/0x140
+ tlb_flush_mmu.part.75+0x37/0xe0
+ tlb_finish_mmu+0x55/0x60
+ zap_page_range+0x142/0x190
+ SyS_madvise+0x3cd/0x9c0
+ system_call_fastpath+0x1c/0x21
+
+swait_active() sustains to be true before finish_swait() is called in
+kvm_vcpu_block(), voluntarily preempted vCPUs are taken into account
+by kvm_vcpu_on_spin() loop greatly increases the probability condition
+kvm_arch_vcpu_runnable(vcpu) is checked and can be true, when APICv
+is enabled the yield-candidate vCPU's VMCS RVI field leaks(by
+vmx_sync_pir_to_irr()) into spinning-on-a-taken-lock vCPU's current
+VMCS.
+
+This patch fixes it by checking conservatively a subset of events.
+
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Christian Borntraeger <borntraeger@de.ibm.com>
+Cc: Marc Zyngier <Marc.Zyngier@arm.com>
+Cc: stable@vger.kernel.org
+Fixes: 98f4a1467 (KVM: add kvm_arch_vcpu_runnable() test to kvm_vcpu_on_spin() loop)
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/powerpc/kvm/powerpc.c | 5 +++++
+ arch/x86/include/asm/kvm_host.h | 1 +
+ arch/x86/kvm/svm.c | 6 ++++++
+ arch/x86/kvm/vmx/vmx.c | 6 ++++++
+ arch/x86/kvm/x86.c | 16 ++++++++++++++++
+ include/linux/kvm_host.h | 1 +
+ virt/kvm/kvm_main.c | 25 ++++++++++++++++++++++++-
+ 7 files changed, 59 insertions(+), 1 deletion(-)
+
+--- a/arch/powerpc/kvm/powerpc.c
++++ b/arch/powerpc/kvm/powerpc.c
+@@ -62,6 +62,11 @@ int kvm_arch_vcpu_runnable(struct kvm_vc
+ return !!(v->arch.pending_exceptions) || kvm_request_pending(v);
+ }
+
++bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ return kvm_arch_vcpu_runnable(vcpu);
++}
++
+ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
+ {
+ return false;
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -1090,6 +1090,7 @@ struct kvm_x86_ops {
+ int (*update_pi_irte)(struct kvm *kvm, unsigned int host_irq,
+ uint32_t guest_irq, bool set);
+ void (*apicv_post_state_restore)(struct kvm_vcpu *vcpu);
++ bool (*dy_apicv_has_pending_interrupt)(struct kvm_vcpu *vcpu);
+
+ int (*set_hv_timer)(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc);
+ void (*cancel_hv_timer)(struct kvm_vcpu *vcpu);
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -5086,6 +5086,11 @@ static void svm_deliver_avic_intr(struct
+ kvm_vcpu_wake_up(vcpu);
+ }
+
++static bool svm_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
++{
++ return false;
++}
++
+ static void svm_ir_list_del(struct vcpu_svm *svm, struct amd_iommu_pi_data *pi)
+ {
+ unsigned long flags;
+@@ -7161,6 +7166,7 @@ static struct kvm_x86_ops svm_x86_ops __
+
+ .pmu_ops = &amd_pmu_ops,
+ .deliver_posted_interrupt = svm_deliver_avic_intr,
++ .dy_apicv_has_pending_interrupt = svm_dy_apicv_has_pending_interrupt,
+ .update_pi_irte = svm_update_pi_irte,
+ .setup_mce = svm_setup_mce,
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -9395,6 +9395,11 @@ static int vmx_sync_pir_to_irr(struct kv
+ return max_irr;
+ }
+
++static bool vmx_dy_apicv_has_pending_interrupt(struct kvm_vcpu *vcpu)
++{
++ return pi_test_on(vcpu_to_pi_desc(vcpu));
++}
++
+ static void vmx_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
+ {
+ if (!kvm_vcpu_apicv_active(vcpu))
+@@ -12819,6 +12824,7 @@ static struct kvm_x86_ops vmx_x86_ops __
+ .hwapic_isr_update = vmx_hwapic_isr_update,
+ .sync_pir_to_irr = vmx_sync_pir_to_irr,
+ .deliver_posted_interrupt = vmx_deliver_posted_interrupt,
++ .dy_apicv_has_pending_interrupt = vmx_dy_apicv_has_pending_interrupt,
+
+ .set_tss_addr = vmx_set_tss_addr,
+ .get_tdp_level = get_ept_level,
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -8799,6 +8799,22 @@ int kvm_arch_vcpu_runnable(struct kvm_vc
+ return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);
+ }
+
++bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ if (READ_ONCE(vcpu->arch.pv.pv_unhalted))
++ return true;
++
++ if (kvm_test_request(KVM_REQ_NMI, vcpu) ||
++ kvm_test_request(KVM_REQ_SMI, vcpu) ||
++ kvm_test_request(KVM_REQ_EVENT, vcpu))
++ return true;
++
++ if (vcpu->arch.apicv_active && kvm_x86_ops->dy_apicv_has_pending_interrupt(vcpu))
++ return true;
++
++ return false;
++}
++
+ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu)
+ {
+ return vcpu->arch.preempted_in_kernel;
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -807,6 +807,7 @@ void kvm_arch_check_processor_compat(voi
+ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu);
+ bool kvm_arch_vcpu_in_kernel(struct kvm_vcpu *vcpu);
+ int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu);
++bool kvm_arch_dy_runnable(struct kvm_vcpu *vcpu);
+
+ #ifndef __KVM_HAVE_ARCH_VM_ALLOC
+ /*
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -2358,6 +2358,29 @@ static bool kvm_vcpu_eligible_for_direct
+ #endif
+ }
+
++/*
++ * Unlike kvm_arch_vcpu_runnable, this function is called outside
++ * a vcpu_load/vcpu_put pair. However, for most architectures
++ * kvm_arch_vcpu_runnable does not require vcpu_load.
++ */
++bool __weak kvm_arch_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ return kvm_arch_vcpu_runnable(vcpu);
++}
++
++static bool vcpu_dy_runnable(struct kvm_vcpu *vcpu)
++{
++ if (kvm_arch_dy_runnable(vcpu))
++ return true;
++
++#ifdef CONFIG_KVM_ASYNC_PF
++ if (!list_empty_careful(&vcpu->async_pf.done))
++ return true;
++#endif
++
++ return false;
++}
++
+ void kvm_vcpu_on_spin(struct kvm_vcpu *me, bool yield_to_kernel_mode)
+ {
+ struct kvm *kvm = me->kvm;
+@@ -2387,7 +2410,7 @@ void kvm_vcpu_on_spin(struct kvm_vcpu *m
+ continue;
+ if (vcpu == me)
+ continue;
+- if (swait_active(&vcpu->wq) && !kvm_arch_vcpu_runnable(vcpu))
++ if (swait_active(&vcpu->wq) && !vcpu_dy_runnable(vcpu))
+ continue;
+ if (yield_to_kernel_mode && !kvm_arch_vcpu_in_kernel(vcpu))
+ continue;
+
diff --git a/patches.arch/kvm-lapic-fix-pending-interrupt-in-irr-blocked-by-software-disable-lapic b/patches.arch/kvm-lapic-fix-pending-interrupt-in-irr-blocked-by-software-disable-lapic
new file mode 100644
index 0000000000..cf36e49a12
--- /dev/null
+++ b/patches.arch/kvm-lapic-fix-pending-interrupt-in-irr-blocked-by-software-disable-lapic
@@ -0,0 +1,139 @@
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Tue, 2 Jul 2019 17:25:02 +0800
+Subject: KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable
+ LAPIC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: bb34e690e9340bc155ebed5a3d75fc63ff69e082
+Patch-mainline: v5.2
+References: bsc#1145408
+
+Thomas reported that:
+
+ | Background:
+ |
+ | In preparation of supporting IPI shorthands I changed the CPU offline
+ | code to software disable the local APIC instead of just masking it.
+ | That's done by clearing the APIC_SPIV_APIC_ENABLED bit in the APIC_SPIV
+ | register.
+ |
+ | Failure:
+ |
+ | When the CPU comes back online the startup code triggers occasionally
+ | the warning in apic_pending_intr_clear(). That complains that the IRRs
+ | are not empty.
+ |
+ | The offending vector is the local APIC timer vector who's IRR bit is set
+ | and stays set.
+ |
+ | It took me quite some time to reproduce the issue locally, but now I can
+ | see what happens.
+ |
+ | It requires apicv_enabled=0, i.e. full apic emulation. With apicv_enabled=1
+ | (and hardware support) it behaves correctly.
+ |
+ | Here is the series of events:
+ |
+ | Guest CPU
+ |
+ | goes down
+ |
+ | native_cpu_disable()
+ |
+ | apic_soft_disable();
+ |
+ | play_dead()
+ |
+ | ....
+ |
+ | startup()
+ |
+ | if (apic_enabled())
+ | apic_pending_intr_clear() <- Not taken
+ |
+ | enable APIC
+ |
+ | apic_pending_intr_clear() <- Triggers warning because IRR is stale
+ |
+ | When this happens then the deadline timer or the regular APIC timer -
+ | happens with both, has fired shortly before the APIC is disabled, but the
+ | interrupt was not serviced because the guest CPU was in an interrupt
+ | disabled region at that point.
+ |
+ | The state of the timer vector ISR/IRR bits:
+ |
+ | ISR IRR
+ | before apic_soft_disable() 0 1
+ | after apic_soft_disable() 0 1
+ |
+ | On startup 0 1
+ |
+ | Now one would assume that the IRR is cleared after the INIT reset, but this
+ | happens only on CPU0.
+ |
+ | Why?
+ |
+ | Because our CPU0 hotplug is just for testing to make sure nothing breaks
+ | and goes through an NMI wakeup vehicle because INIT would send it through
+ | the boots-trap code which is not really working if that CPU was not
+ | physically unplugged.
+ |
+ | Now looking at a real world APIC the situation in that case is:
+ |
+ | ISR IRR
+ | before apic_soft_disable() 0 1
+ | after apic_soft_disable() 0 1
+ |
+ | On startup 0 0
+ |
+ | Why?
+ |
+ | Once the dying CPU reenables interrupts the pending interrupt gets
+ | delivered as a spurious interupt and then the state is clear.
+ |
+ | While that CPU0 hotplug test case is surely an esoteric issue, the APIC
+ | emulation is still wrong, Even if the play_dead() code would not enable
+ | interrupts then the pending IRR bit would turn into an ISR .. interrupt
+ | when the APIC is reenabled on startup.
+
+>From SDM 10.4.7.2 Local APIC State After It Has Been Software Disabled
+* Pending interrupts in the IRR and ISR registers are held and require
+ masking or handling by the CPU.
+
+In Thomas's testing, hardware cpu will not respect soft disable LAPIC
+when IRR has already been set or APICv posted-interrupt is in flight,
+so we can skip soft disable APIC checking when clearing IRR and set ISR,
+continue to respect soft disable APIC when attempting to set IRR.
+
+Reported-by: Rong Chen <rong.a.chen@intel.com>
+Reported-by: Feng Tang <feng.tang@intel.com>
+Reported-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Rong Chen <rong.a.chen@intel.com>
+Cc: Feng Tang <feng.tang@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/lapic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index a21c440ff356..4dabc318adb8 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2339,7 +2339,7 @@ int kvm_apic_has_interrupt(struct kvm_vcpu *vcpu)
+ struct kvm_lapic *apic = vcpu->arch.apic;
+ u32 ppr;
+
+- if (!apic_enabled(apic))
++ if (!kvm_apic_hw_enabled(apic))
+ return -1;
+
+ __apic_update_ppr(apic, &ppr);
+
diff --git a/patches.arch/kvm-nvmx-allow-setting-the-vmfunc-controls-msr b/patches.arch/kvm-nvmx-allow-setting-the-vmfunc-controls-msr
new file mode 100644
index 0000000000..67907d960c
--- /dev/null
+++ b/patches.arch/kvm-nvmx-allow-setting-the-vmfunc-controls-msr
@@ -0,0 +1,33 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 2 Jul 2019 14:40:40 +0200
+Subject: KVM: nVMX: allow setting the VMFUNC controls MSR
+Git-commit: e8a70bd4e92525de459acfa5668c8e1f24664331
+Patch-mainline: v5.3-rc1
+References: bsc#1145389
+
+Allow userspace to set a custom value for the VMFUNC controls MSR, as long
+as the capabilities it advertises do not exceed those of the host.
+
+Fixes: 27c42a1bb ("KVM: nVMX: Enable VMFUNC for the L1 hypervisor", 2017-08-03)
+Reviewed-by: Liran Alon <liran.alon@oracle.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/nested.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3341,6 +3341,11 @@ static int vmx_set_vmx_msr(struct kvm_vc
+ case MSR_IA32_VMX_VMCS_ENUM:
+ vmx->nested.nested_vmx_vmcs_enum = data;
+ return 0;
++ case MSR_IA32_VMX_VMFUNC:
++ if (data & ~vmx->nested.nested_vmx_vmfunc_controls)
++ return -EINVAL;
++ vmx->nested.nested_vmx_vmfunc_controls = data;
++ return 0;
+ default:
+ /*
+ * The rest of the VMX capability MSRs do not support restore.
+
diff --git a/patches.arch/kvm-nvmx-do-not-use-dangling-shadow-vmcs-after-guest-reset b/patches.arch/kvm-nvmx-do-not-use-dangling-shadow-vmcs-after-guest-reset
new file mode 100644
index 0000000000..1b67bcfc46
--- /dev/null
+++ b/patches.arch/kvm-nvmx-do-not-use-dangling-shadow-vmcs-after-guest-reset
@@ -0,0 +1,63 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 19 Jul 2019 18:41:10 +0200
+Subject: KVM: nVMX: do not use dangling shadow VMCS after guest reset
+Git-commit: 88dddc11a8d6b09201b4db9d255b3394d9bc9e57
+Patch-mainline: v5.3-rc1
+References: bsc#1145390
+
+If a KVM guest is reset while running a nested guest, free_nested will
+disable the shadow VMCS execution control in the vmcs01. However,
+on the next KVM_RUN vmx_vcpu_run would nevertheless try to sync
+the VMCS12 to the shadow VMCS which has since been freed.
+
+This causes a vmptrld of a NULL pointer on my machime, but Jan reports
+the host to hang altogether. Let's see how much this trivial patch fixes.
+
+Reported-by: Jan Kiszka <jan.kiszka@siemens.com>
+Cc: Liran Alon <liran.alon@oracle.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/nested.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -7661,6 +7661,7 @@ static void vmx_disable_shadow_vmcs(stru
+ {
+ vmcs_clear_bits(SECONDARY_VM_EXEC_CONTROL, SECONDARY_EXEC_SHADOW_VMCS);
+ vmcs_write64(VMCS_LINK_POINTER, -1ull);
++ vmx->nested.sync_shadow_vmcs = false;
+ }
+
+ static inline void nested_release_vmcs12(struct vcpu_vmx *vmx)
+@@ -7672,7 +7673,6 @@ static inline void nested_release_vmcs12
+ /* copy to memory all shadowed fields in case
+ they were modified */
+ copy_shadow_to_vmcs12(vmx);
+- vmx->nested.sync_shadow_vmcs = false;
+ vmx_disable_shadow_vmcs(vmx);
+ }
+ vmx->nested.posted_intr_nv = -1;
+@@ -7859,6 +7859,9 @@ static void copy_shadow_to_vmcs12(struct
+ const unsigned long *fields = shadow_read_write_fields;
+ const int num_fields = max_shadow_read_write_fields;
+
++ if (WARN_ON(!shadow_vmcs))
++ return;
++
+ preempt_disable();
+
+ vmcs_load(shadow_vmcs);
+@@ -7906,6 +7909,9 @@ static void copy_vmcs12_to_shadow(struct
+ u64 field_value = 0;
+ struct vmcs *shadow_vmcs = vmx->vmcs01.shadow_vmcs;
+
++ if (WARN_ON(!shadow_vmcs))
++ return;
++
+ vmcs_load(shadow_vmcs);
+
+ for (q = 0; q < ARRAY_SIZE(fields); q++) {
+
diff --git a/patches.arch/kvm-nvmx-remove-unnecessary-sync_roots-from-handle_invept b/patches.arch/kvm-nvmx-remove-unnecessary-sync_roots-from-handle_invept
new file mode 100644
index 0000000000..b09087d218
--- /dev/null
+++ b/patches.arch/kvm-nvmx-remove-unnecessary-sync_roots-from-handle_invept
@@ -0,0 +1,60 @@
+From: Jim Mattson <jmattson@google.com>
+Date: Thu, 13 Jun 2019 09:16:08 -0700
+Subject: kvm: nVMX: Remove unnecessary sync_roots from handle_invept
+Git-commit: b119019847fbcac36ed1384f166c91f177d070e7
+Patch-mainline: v5.3-rc1
+References: bsc#1145391
+
+When L0 is executing handle_invept(), the TDP MMU is active. Emulating
+an L1 INVEPT does require synchronizing the appropriate shadow EPT
+root(s), but a call to kvm_mmu_sync_roots in this context won't do
+that. Similarly, the hardware TLB and paging-structure-cache entries
+associated with the appropriate shadow EPT root(s) must be flushed,
+but requesting a TLB_FLUSH from this context won't do that either.
+
+How did this ever work? KVM always does a sync_roots and TLB flush (in
+the correct context) when transitioning from L1 to L2. That isn't the
+best choice for nested VM performance, but it effectively papers over
+the mistakes here.
+
+Remove the unnecessary operations and leave a comment to try to do
+better in the future.
+
+Reported-by: Junaid Shahid <junaids@google.com>
+Fixes: bfd0a56b90005f ("nEPT: Nested INVEPT")
+Cc: Xiao Guangrong <xiaoguangrong@linux.vnet.ibm.com>
+Cc: Nadav Har'El <nyh@il.ibm.com>
+Cc: Jun Nakajima <jun.nakajima@intel.com>
+Cc: Xinhao Xu <xinhao.xu@intel.com>
+Cc: Yang Zhang <yang.z.zhang@Intel.com>
+Cc: Gleb Natapov <gleb@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by Peter Shier <pshier@google.com>
+Reviewed-by: Junaid Shahid <junaids@google.com>
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/nested.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -8190,13 +8190,11 @@ static int handle_invept(struct kvm_vcpu
+
+ switch (type) {
+ case VMX_EPT_EXTENT_GLOBAL:
++ case VMX_EPT_EXTENT_CONTEXT:
+ /*
+- * TODO: track mappings and invalidate
+- * single context requests appropriately
++ * TODO: Sync the necessary shadow EPT roots here, rather than
++ * at the next emulated VM-entry.
+ */
+- case VMX_EPT_EXTENT_CONTEXT:
+- kvm_mmu_sync_roots(vcpu);
+- kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu);
+ nested_vmx_succeed(vcpu);
+ break;
+ default:
+
diff --git a/patches.arch/kvm-nvmx-use-adjusted-pin-controls-for-vmcs02 b/patches.arch/kvm-nvmx-use-adjusted-pin-controls-for-vmcs02
new file mode 100644
index 0000000000..05e3957719
--- /dev/null
+++ b/patches.arch/kvm-nvmx-use-adjusted-pin-controls-for-vmcs02
@@ -0,0 +1,54 @@
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Tue, 7 May 2019 12:17:53 -0700
+Subject: KVM: nVMX: Use adjusted pin controls for vmcs02
+Git-commit: c075c3e49d7ae3599106f1af53352268030469db
+Patch-mainline: v5.3-rc1
+References: bsc#1145392
+
+KVM provides a module parameter to allow disabling virtual NMI support
+to simplify testing (hardware *without* virtual NMI support is hard to
+come by but it does have users). When preparing vmcs02, use the accessor
+for pin controls to ensure that the module param is respected for nested
+guests.
+
+Opportunistically swap the order of applying L0's and L1's pin controls
+to better align with other controls and to prepare for a future patche
+that will ignore L1's, but not L0's, preemption timer flag.
+
+Fixes: d02fcf50779ec ("kvm: vmx: Allow disabling virtual NMI support")
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/nested.c | 5 ++---
+ arch/x86/kvm/vmx/vmx.c | 2 +-
+ arch/x86/kvm/vmx/vmx.h | 1 +
+ 3 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -5608,7 +5608,7 @@ static void set_cr4_guest_host_mask(stru
+ vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);
+ }
+
+-static u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
++u32 vmx_pin_based_exec_ctrl(struct vcpu_vmx *vmx)
+ {
+ u32 pin_based_exec_ctrl = vmcs_config.pin_based_exec_ctrl;
+
+@@ -10981,11 +10981,11 @@ static int prepare_vmcs02(struct kvm_vcp
+ vmcs_write64(XSS_EXIT_BITMAP, vmcs12->xss_exit_bitmap);
+ vmcs_write64(VMCS_LINK_POINTER, -1ull);
+
+- exec_control = vmcs12->pin_based_vm_exec_control;
++ exec_control = vmx_pin_based_exec_ctrl(vmx);
++ exec_control |= vmcs12->pin_based_vm_exec_control;
+
+ /* Preemption timer setting is only taken from vmcs01. */
+ exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+- exec_control |= vmcs_config.pin_based_exec_ctrl;
+ if (vmx->hv_deadline_tsc == -1)
+ exec_control &= ~PIN_BASED_VMX_PREEMPTION_TIMER;
+
+
diff --git a/patches.arch/kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat-with-bad-value b/patches.arch/kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat-with-bad-value
new file mode 100644
index 0000000000..1f4b7ba327
--- /dev/null
+++ b/patches.arch/kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat-with-bad-value
@@ -0,0 +1,36 @@
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Tue, 7 May 2019 09:06:27 -0700
+Subject: KVM: VMX: Always signal #GP on WRMSR to MSR_IA32_CR_PAT with bad value
+Git-commit: d28f4290b53a157191ed9991ad05dffe9e8c0c89
+Patch-mainline: v5.3-rc1
+References: bsc#1145393
+
+The behavior of WRMSR is in no way dependent on whether or not KVM
+consumes the value.
+
+Fixes: 4566654bb9be9 ("KVM: vmx: Inject #GP on invalid PAT CR")
+Cc: stable@vger.kernel.org
+Cc: Nadav Amit <nadav.amit@gmail.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/vmx.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3641,9 +3641,10 @@ static int vmx_set_msr(struct kvm_vcpu *
+ MSR_TYPE_W);
+ break;
+ case MSR_IA32_CR_PAT:
++ if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
++ return 1;
++
+ if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) {
+- if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
+- return 1;
+ vmcs_write64(GUEST_IA32_PAT, data);
+ vcpu->arch.pat = data;
+ break;
+
diff --git a/patches.arch/kvm-vmx-check-cpuid-before-allowing-read-write-of-ia32_xss b/patches.arch/kvm-vmx-check-cpuid-before-allowing-read-write-of-ia32_xss
new file mode 100644
index 0000000000..a98aee0b2e
--- /dev/null
+++ b/patches.arch/kvm-vmx-check-cpuid-before-allowing-read-write-of-ia32_xss
@@ -0,0 +1,53 @@
+From: Wanpeng Li <wanpengli@tencent.com>
+Date: Thu, 20 Jun 2019 17:00:02 +0800
+Subject: KVM: VMX: check CPUID before allowing read/write of IA32_XSS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 4d763b168e9c5c366b05812c7bba7662e5ea3669
+Patch-mainline: v5.3-rc1
+References: bsc#1145394
+
+Raise #GP when guest read/write IA32_XSS, but the CPUID bits
+say that it shouldn't exist.
+
+Fixes: 203000993de5 (kvm: vmx: add MSR logic for XSAVES)
+Reported-by: Xiaoyao Li <xiaoyao.li@linux.intel.com>
+Reported-by: Tao Xu <tao3.xu@intel.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Wanpeng Li <wanpengli@tencent.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/vmx.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3507,7 +3507,10 @@ static int vmx_get_msr(struct kvm_vcpu *
+ return 1;
+ return vmx_get_vmx_msr(vcpu, msr_info->index, &msr_info->data);
+ case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported())
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+ return 1;
+ msr_info->data = vcpu->arch.ia32_xss;
+ break;
+@@ -3678,7 +3681,10 @@ static int vmx_set_msr(struct kvm_vcpu *
+ return 1;
+ return vmx_set_vmx_msr(vcpu, msr_index, data);
+ case MSR_IA32_XSS:
+- if (!vmx_xsaves_supported())
++ if (!vmx_xsaves_supported() ||
++ (!msr_info->host_initiated &&
++ !(guest_cpuid_has(vcpu, X86_FEATURE_XSAVE) &&
++ guest_cpuid_has(vcpu, X86_FEATURE_XSAVES))))
+ return 1;
+ /*
+ * The only supported bit as of Skylake is bit 8, but
+
diff --git a/patches.arch/kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-entry b/patches.arch/kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-entry
new file mode 100644
index 0000000000..4a7a196234
--- /dev/null
+++ b/patches.arch/kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-entry
@@ -0,0 +1,88 @@
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Fri, 19 Apr 2019 22:50:55 -0700
+Subject: KVM: VMX: Fix handling of #MC that occurs during VM-Entry
+Git-commit: beb8d93b3e423043e079ef3dda19dad7b28467a8
+Patch-mainline: v5.3-rc1
+References: bsc#1145395
+
+A previous fix to prevent KVM from consuming stale VMCS state after a
+failed VM-Entry inadvertantly blocked KVM's handling of machine checks
+that occur during VM-Entry.
+
+Per Intel's SDM, a #MC during VM-Entry is handled in one of three ways,
+depending on when the #MC is recognoized. As it pertains to this bug
+fix, the third case explicitly states EXIT_REASON_MCE_DURING_VMENTRY
+is handled like any other VM-Exit during VM-Entry, i.e. sets bit 31 to
+indicate the VM-Entry failed.
+
+If a machine-check event occurs during a VM entry, one of the following occurs:
+ - The machine-check event is handled as if it occurred before the VM entry:
+ ...
+ - The machine-check event is handled after VM entry completes:
+ ...
+ - A VM-entry failure occurs as described in Section 26.7. The basic
+ exit reason is 41, for "VM-entry failure due to machine-check event".
+
+Explicitly handle EXIT_REASON_MCE_DURING_VMENTRY as a one-off case in
+vmx_vcpu_run() instead of binning it into vmx_complete_atomic_exit().
+Doing so allows vmx_vcpu_run() to handle VMX_EXIT_REASONS_FAILED_VMENTRY
+in a sane fashion and also simplifies vmx_complete_atomic_exit() since
+VMCS.VM_EXIT_INTR_INFO is guaranteed to be fresh.
+
+Fixes: b060ca3b2e9e7 ("kvm: vmx: Handle VMLAUNCH/VMRESUME failure properly")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Reviewed-by: Jim Mattson <jmattson@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx/vmx.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -9400,28 +9400,21 @@ static void vmx_apicv_post_state_restore
+
+ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx)
+ {
+- u32 exit_intr_info = 0;
+- u16 basic_exit_reason = (u16)vmx->exit_reason;
+-
+- if (!(basic_exit_reason == EXIT_REASON_MCE_DURING_VMENTRY
+- || basic_exit_reason == EXIT_REASON_EXCEPTION_NMI))
++ if (vmx->exit_reason != EXIT_REASON_EXCEPTION_NMI)
+ return;
+
+- if (!(vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+- exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+- vmx->exit_intr_info = exit_intr_info;
++ vmx->exit_intr_info = vmcs_read32(VM_EXIT_INTR_INFO);
+
+ /* if exit due to PF check for async PF */
+- if (is_page_fault(exit_intr_info))
++ if (is_page_fault(vmx->exit_intr_info))
+ vmx->vcpu.arch.apf.host_apf_reason = kvm_read_and_reset_pf_reason();
+
+ /* Handle machine checks before interrupts are enabled */
+- if (basic_exit_reason == EXIT_REASON_MCE_DURING_VMENTRY ||
+- is_machine_check(exit_intr_info))
++ if (is_machine_check(vmx->exit_intr_info))
+ kvm_machine_check();
+
+ /* We need to handle NMIs before interrupts are enabled */
+- if (is_nmi(exit_intr_info)) {
++ if (is_nmi(vmx->exit_intr_info)) {
+ kvm_before_handle_nmi(&vmx->vcpu);
+ asm("int $2");
+ kvm_after_handle_nmi(&vmx->vcpu);
+@@ -9926,6 +9919,9 @@ static void __noclone vmx_vcpu_run(struc
+ vmx->idt_vectoring_info = 0;
+
+ vmx->exit_reason = vmx->fail ? 0xdead : vmcs_read32(VM_EXIT_REASON);
++ if ((u16)vmx->exit_reason == EXIT_REASON_MCE_DURING_VMENTRY)
++ kvm_machine_check();
++
+ if (vmx->fail || (vmx->exit_reason & VMX_EXIT_REASONS_FAILED_VMENTRY))
+ return;
+
+
diff --git a/patches.arch/kvm-x86-degrade-warn-to-pr_warn_ratelimited b/patches.arch/kvm-x86-degrade-warn-to-pr_warn_ratelimited
new file mode 100644
index 0000000000..08cd7e5d0e
--- /dev/null
+++ b/patches.arch/kvm-x86-degrade-warn-to-pr_warn_ratelimited
@@ -0,0 +1,44 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 26 Jun 2019 14:16:13 +0200
+Subject: KVM: x86: degrade WARN to pr_warn_ratelimited
+Git-commit: 3f16a5c318392cbb5a0c7a3d19dff8c8ef3c38ee
+Patch-mainline: v5.2
+References: bsc#1145409
+
+This warning can be triggered easily by userspace, so it should certainly not
+cause a panic if panic_on_warn is set.
+
+Reported-by: syzbot+c03f30b4f4c46bdf8575@syzkaller.appspotmail.com
+Suggested-by: Alexander Potapenko <glider@google.com>
+Acked-by: Alexander Potapenko <glider@google.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 9857992d4e58..fafd81d2c9ea 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1554,7 +1554,7 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
+ vcpu->arch.tsc_always_catchup = 1;
+ return 0;
+ } else {
+- WARN(1, "user requested TSC rate below hardware speed\n");
++ pr_warn_ratelimited("user requested TSC rate below hardware speed\n");
+ return -1;
+ }
+ }
+@@ -1564,8 +1564,8 @@ static int set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz, bool scale)
+ user_tsc_khz, tsc_khz);
+
+ if (ratio == 0 || ratio >= kvm_max_tsc_scaling_ratio) {
+- WARN_ONCE(1, "Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
+- user_tsc_khz);
++ pr_warn_ratelimited("Invalid TSC scaling ratio - virtual-tsc-khz=%u\n",
++ user_tsc_khz);
+ return -1;
+ }
+
+
diff --git a/patches.arch/kvm-x86-unconditionally-enable-irqs-in-guest-context b/patches.arch/kvm-x86-unconditionally-enable-irqs-in-guest-context
new file mode 100644
index 0000000000..b50f8161a5
--- /dev/null
+++ b/patches.arch/kvm-x86-unconditionally-enable-irqs-in-guest-context
@@ -0,0 +1,66 @@
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Wed, 10 Jul 2019 09:07:34 -0700
+Subject: KVM: x86: Unconditionally enable irqs in guest context
+Git-commit: d7a08882a0a4b4e176691331ee3f492996579534
+Patch-mainline: v5.3-rc1
+References: bsc#1145396
+
+On VMX, KVM currently does not re-enable irqs until after it has exited
+the guest context. As a result, a tick that fires in the window between
+VM-Exit and guest_exit_irqoff() will be accounted as system time. While
+said window is relatively small, it's large enough to be problematic in
+some configurations, e.g. if VM-Exits are consistently occurring a hair
+earlier than the tick irq.
+
+Intentionally toggle irqs back off so that guest_exit_irqoff() can be
+used in lieu of guest_exit() in order to avoid the save/restore of flags
+in guest_exit(). On my Haswell system, "nop; cli; sti" is ~6 cycles,
+versus ~28 cycles for "pushf; pop <reg>; cli; push <reg>; popf".
+
+Fixes: f2485b3e0c6c0 ("KVM: x86: use guest_exit_irqoff")
+Reported-by: Wei Yang <w90p710@gmail.com>
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 10 +---------
+ arch/x86/kvm/x86.c | 11 +++++++++++
+ 2 files changed, 12 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -6060,13 +6060,7 @@ out:
+
+ static void svm_handle_external_intr(struct kvm_vcpu *vcpu)
+ {
+- local_irq_enable();
+- /*
+- * We must have an instruction with interrupts enabled, so
+- * the timer interrupt isn't delayed by the interrupt shadow.
+- */
+- asm("nop");
+- local_irq_disable();
++
+ }
+
+ static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu)
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7273,7 +7273,16 @@ static int vcpu_enter_guest(struct kvm_v
+
+ kvm_x86_ops->handle_external_intr(vcpu);
+
++ /*
++ * Consume any pending interrupts, including the possible source of
++ * VM-Exit on SVM and any ticks that occur between VM-Exit and now.
++ * An instruction is required after local_irq_enable() to fully unblock
++ * interrupts on processors that implement an interrupt shadow, the
++ * stat.exits increment will do nicely.
++ */
++ local_irq_enable();
+ ++vcpu->stat.exits;
++ local_irq_disable();
+
+ guest_exit_irqoff();
+
+
diff --git a/patches.arch/kvm-x86-vpmu-refine-kvm_pmu-err-msg-when-event-creation-failed b/patches.arch/kvm-x86-vpmu-refine-kvm_pmu-err-msg-when-event-creation-failed
new file mode 100644
index 0000000000..d18c7cf489
--- /dev/null
+++ b/patches.arch/kvm-x86-vpmu-refine-kvm_pmu-err-msg-when-event-creation-failed
@@ -0,0 +1,38 @@
+From: Like Xu <like.xu@linux.intel.com>
+Date: Thu, 18 Jul 2019 13:35:14 +0800
+Subject: KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
+Git-commit: 6fc3977ccc5d3c22e851f2dce2d3ce2a0a843842
+Patch-mainline: v5.3-rc1
+References: bsc#1145397
+
+If a perf_event creation fails due to any reason of the host perf
+subsystem, it has no chance to log the corresponding event for guest
+which may cause abnormal sampling data in guest result. In debug mode,
+this message helps to understand the state of vPMC and we may not
+limit the number of occurrences but not in a spamming style.
+
+Suggested-by: Joe Perches <joe@perches.com>
+Signed-off-by: Like Xu <like.xu@linux.intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/pmu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kvm/pmu.c b/arch/x86/kvm/pmu.c
+index aa5a2597305a..cedaa01ceb6f 100644
+--- a/arch/x86/kvm/pmu.c
++++ b/arch/x86/kvm/pmu.c
+@@ -131,8 +131,8 @@ static void pmc_reprogram_counter(struct kvm_pmc *pmc, u32 type,
+ intr ? kvm_perf_overflow_intr :
+ kvm_perf_overflow, pmc);
+ if (IS_ERR(event)) {
+- printk_once("kvm_pmu: event creation failed %ld\n",
+- PTR_ERR(event));
++ pr_debug_ratelimited("kvm_pmu: event creation failed %ld for pmc->idx = %d\n",
++ PTR_ERR(event), pmc->idx);
+ return;
+ }
+
+
diff --git a/patches.arch/mm-vmalloc-sync-unmappings-in-_purge_vmap_area_lazy b/patches.arch/mm-vmalloc-sync-unmappings-in-_purge_vmap_area_lazy
new file mode 100644
index 0000000000..4a572bc9c4
--- /dev/null
+++ b/patches.arch/mm-vmalloc-sync-unmappings-in-_purge_vmap_area_lazy
@@ -0,0 +1,55 @@
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 19 Jul 2019 20:46:52 +0200
+Subject: mm/vmalloc: Sync unmappings in __purge_vmap_area_lazy()
+Git-commit: 3f8fd02b1bf1d7ba964485a56f2f4b53ae88c167
+Patch-mainline: v5.3-rc2
+References: bsc#1118689
+
+On x86-32 with PTI enabled, parts of the kernel page-tables are not shared
+between processes. This can cause mappings in the vmalloc/ioremap area to
+persist in some page-tables after the region is unmapped and released.
+
+When the region is re-used the processes with the old mappings do not fault
+in the new mappings but still access the old ones.
+
+This causes undefined behavior, in reality often data corruption, kernel
+oopses and panics and even spontaneous reboots.
+
+Fix this problem by activly syncing unmaps in the vmalloc/ioremap area to
+all page-tables in the system before the regions can be re-used.
+
+References: https://bugzilla.suse.com/show_bug.cgi?id=1118689
+Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20190719184652.11391-4-joro@8bytes.org
+---
+ mm/vmalloc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1761,6 +1761,12 @@ void *__vmalloc_node_range(unsigned long
+ return NULL;
+
+ /*
++ * First make sure the mappings are removed from all page-tables
++ * before they are freed.
++ */
++ vmalloc_sync_all();
++
++ /*
+ * In this function, newly allocated vm_struct has VM_UNINITIALIZED
+ * flag. It means that vm_struct is not fully initialized.
+ * Now, it is fully initialized, so remove this flag here.
+@@ -2305,6 +2311,9 @@ EXPORT_SYMBOL(remap_vmalloc_range);
+ /*
+ * Implement a stub for vmalloc_sync_all() if the architecture chose not to
+ * have one.
++ *
++ * The purpose of this function is to make sure the vmalloc area
++ * mappings are identical in all page-tables in the system.
+ */
+ void __weak vmalloc_sync_all(void)
+ {
diff --git a/patches.arch/powerpc-64s-Include-cpu-header.patch b/patches.arch/powerpc-64s-Include-cpu-header.patch
new file mode 100644
index 0000000000..3a46b73921
--- /dev/null
+++ b/patches.arch/powerpc-64s-Include-cpu-header.patch
@@ -0,0 +1,48 @@
+From 42e2acde1237878462b028f5a27d9cc5bea7502c Mon Sep 17 00:00:00 2001
+From: Breno Leitao <leitao@debian.org>
+Date: Mon, 22 Oct 2018 11:54:12 -0300
+Subject: [PATCH] powerpc/64s: Include cpu header
+
+References: bsc#1065729
+Patch-mainline: v5.0-rc1
+Git-commit: 42e2acde1237878462b028f5a27d9cc5bea7502c
+
+Current powerpc security.c file is defining functions, as
+cpu_show_meltdown(), cpu_show_spectre_v{1,2} and others, that are being
+declared at linux/cpu.h header without including the header file that
+contains these declarations.
+
+This is being reported by sparse, which thinks that these functions are
+static, due to the lack of declaration:
+
+ arch/powerpc/kernel/security.c:105:9: warning: symbol 'cpu_show_meltdown' was not declared. Should it be static?
+ arch/powerpc/kernel/security.c:139:9: warning: symbol 'cpu_show_spectre_v1' was not declared. Should it be static?
+ arch/powerpc/kernel/security.c:161:9: warning: symbol 'cpu_show_spectre_v2' was not declared. Should it be static?
+ arch/powerpc/kernel/security.c:209:6: warning: symbol 'stf_barrier' was not declared. Should it be static?
+ arch/powerpc/kernel/security.c:289:9: warning: symbol 'cpu_show_spec_store_bypass' was not declared. Should it be static?
+
+This patch simply includes the proper header (linux/cpu.h) to match
+function definition and declaration.
+
+Signed-off-by: Breno Leitao <leitao@debian.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/kernel/security.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
+index f6f469fc4073..9703dce36307 100644
+--- a/arch/powerpc/kernel/security.c
++++ b/arch/powerpc/kernel/security.c
+@@ -4,6 +4,7 @@
+ //
+ // Copyright 2018, Michael Ellerman, IBM Corporation.
+
++#include <linux/cpu.h>
+ #include <linux/kernel.h>
+ #include <linux/device.h>
+ #include <linux/seq_buf.h>
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-book3s-64-check-for-NULL-pointer-in-pgd_allo.patch b/patches.arch/powerpc-book3s-64-check-for-NULL-pointer-in-pgd_allo.patch
new file mode 100644
index 0000000000..1622f946ac
--- /dev/null
+++ b/patches.arch/powerpc-book3s-64-check-for-NULL-pointer-in-pgd_allo.patch
@@ -0,0 +1,62 @@
+From c3b1a2d51133149814d2bd08578796d3651ecb31 Mon Sep 17 00:00:00 2001
+From: Rick Lindsley <ricklind@linux.vnet.ibm.com>
+Date: Sun, 5 May 2019 17:20:43 -0700
+Subject: [PATCH] powerpc/book3s/64: check for NULL pointer in pgd_alloc()
+
+References: FATE#322447, bsc#1078248, git-fixes
+Patch-mainline: v5.2-rc1
+Git-commit: f39356261c265a0689d7ee568132d516e8b6cecc
+
+When the memset code was added to pgd_alloc(), it failed to consider
+that kmem_cache_alloc() can return NULL. It's uncommon, but not
+impossible under heavy memory contention. Example oops:
+
+ Unable to handle kernel paging request for data at address 0x00000000
+ Faulting instruction address: 0xc0000000000a4000
+ Oops: Kernel access of bad area, sig: 11 [#1]
+ LE SMP NR_CPUS=2048 NUMA pSeries
+ CPU: 70 PID: 48471 Comm: entrypoint.sh Kdump: loaded Not tainted 4.14.0-115.6.1.el7a.ppc64le #1
+ task: c000000334a00000 task.stack: c000000331c00000
+ NIP: c0000000000a4000 LR: c00000000012f43c CTR: 0000000000000020
+ REGS: c000000331c039c0 TRAP: 0300 Not tainted (4.14.0-115.6.1.el7a.ppc64le)
+ MSR: 800000010280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]> CR: 44022840 XER: 20040000
+ CFAR: c000000000008874 DAR: 0000000000000000 DSISR: 42000000 SOFTE: 1
+ ...
+ NIP [c0000000000a4000] memset+0x68/0x104
+ LR [c00000000012f43c] mm_init+0x27c/0x2f0
+ Call Trace:
+ mm_init+0x260/0x2f0 (unreliable)
+ copy_mm+0x11c/0x638
+ copy_process.isra.28.part.29+0x6fc/0x1080
+ _do_fork+0xdc/0x4c0
+ ppc_clone+0x8/0xc
+ Instruction dump:
+ 409e000c b0860000 38c60002 409d000c 90860000 38c60004 78a0d183 78a506a0
+ 7c0903a6 41820034 60000000 60420000 <f8860000> f8860008 f8860010 f8860018
+
+Fixes: fc5c2f4a55a2 ("powerpc/mm/hash64: Zero PGD pages on allocation")
+Cc: stable@vger.kernel.org # v4.16+
+Signed-off-by: Rick Lindsley <ricklind@vnet.linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/book3s/64/pgalloc.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h
+index 09e7df35566d..e506c79ffe31 100644
+--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h
++++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h
+@@ -80,6 +80,9 @@ static inline pgd_t *pgd_alloc(struct mm_struct *mm)
+ return radix__pgd_alloc(mm);
+
+ pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), GFP_KERNEL);
++ if (unlikely(!pgd))
++ return pgd;
++
+ /*
+ * With hugetlb, we don't clear the second half of the page table.
+ * If we share the same slab cache with the pmd or pud level table,
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-lib-Fix-feature-fixup-test-of-external-branc.patch b/patches.arch/powerpc-lib-Fix-feature-fixup-test-of-external-branc.patch
new file mode 100644
index 0000000000..8665f8d06d
--- /dev/null
+++ b/patches.arch/powerpc-lib-Fix-feature-fixup-test-of-external-branc.patch
@@ -0,0 +1,53 @@
+From 32810d91325ec76b8ef4df463f8a0e9baf353322 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Tue, 17 Apr 2018 00:39:02 +1000
+Subject: [PATCH] powerpc/lib: Fix feature fixup test of external branch
+
+References: bsc#1065729
+Patch-mainline: v4.18-rc1
+Git-commit: 32810d91325ec76b8ef4df463f8a0e9baf353322
+
+The expected case for this test was wrong, the source of the alternate
+code sequence is:
+
+ FTR_SECTION_ELSE
+ 2: or 2,2,2
+ PPC_LCMPI r3,1
+ beq 3f
+ blt 2b
+ b 3f
+ b 1b
+ ALT_FTR_SECTION_END(0, 1)
+ 3: or 1,1,1
+ or 2,2,2
+ 4: or 3,3,3
+
+So when it's patched the '3' label should still be on the 'or 1,1,1',
+and the 4 label is irrelevant and can be removed.
+
+Fixes: 362e7701fd18 ("powerpc: Add self-tests of the feature fixup code")
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/lib/feature-fixups-test.S | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/lib/feature-fixups-test.S b/arch/powerpc/lib/feature-fixups-test.S
+index f4613118132e..12ff0f673956 100644
+--- a/arch/powerpc/lib/feature-fixups-test.S
++++ b/arch/powerpc/lib/feature-fixups-test.S
+@@ -167,9 +167,9 @@ globl(ftr_fixup_test6_expected)
+ blt 2b
+ b 3f
+ b 1b
+-2: or 1,1,1
++3: or 1,1,1
+ or 2,2,2
+-3: or 3,3,3
++ or 3,3,3
+
+
+ #if 0
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-mm-Handle-page-table-allocation-failures.patch b/patches.arch/powerpc-mm-Handle-page-table-allocation-failures.patch
new file mode 100644
index 0000000000..fe98289069
--- /dev/null
+++ b/patches.arch/powerpc-mm-Handle-page-table-allocation-failures.patch
@@ -0,0 +1,62 @@
+From 3d3cbaa572e21ab7e9dc1c9025351e05640ec044 Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com>
+Date: Tue, 28 May 2019 11:06:24 +0530
+Subject: [PATCH] powerpc/mm: Handle page table allocation failures
+
+References: bsc#1065729
+Patch-mainline: v5.3-rc1
+Git-commit: 2230ebf6e6dd0b7751e2921b40f6cfe34f09bb16
+
+This fixes kernel crash that arises due to not handling page table allocation
+failures while allocating hugetlb page table.
+
+Fixes: e2b3d202d1db ("powerpc: Switch 16GB and 16MB explicit hugepages to a different page table format")
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/hugetlbpage.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 5f7998bd6101..769e276b4840 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -171,6 +171,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
+ else {
+ pdshift = PUD_SHIFT;
+ pu = pud_alloc(mm, pg, addr);
++ if (!pu)
++ return NULL;
+ if (pshift == PUD_SHIFT)
+ return (pte_t *)pu;
+ else if (pshift > PMD_SHIFT)
+@@ -178,6 +180,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
+ else {
+ pdshift = PMD_SHIFT;
+ pm = pmd_alloc(mm, pu, addr);
++ if (!pm)
++ return NULL;
+ if (pshift == PMD_SHIFT)
+ /* 16MB hugepage */
+ return (pte_t *)pm;
+@@ -191,11 +195,16 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz
+ } else {
+ pdshift = PUD_SHIFT;
+ pu = pud_alloc(mm, pg, addr);
++ if (!pu)
++ return NULL;
+ if (pshift >= HUGEPD_PUD_SHIFT) {
+ hpdp = (hugepd_t *)pu;
+ } else {
+ pdshift = PMD_SHIFT;
+ pm = pmd_alloc(mm, pu, addr);
++ if (!pm)
++ return NULL;
++ ptl = pmd_lockptr(mm, pm);
+ hpdp = (hugepd_t *)pm;
+ }
+ }
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-perf-Add-constraints-for-power9-l2-l3-bus-ev.patch b/patches.arch/powerpc-perf-Add-constraints-for-power9-l2-l3-bus-ev.patch
new file mode 100644
index 0000000000..74e377c116
--- /dev/null
+++ b/patches.arch/powerpc-perf-Add-constraints-for-power9-l2-l3-bus-ev.patch
@@ -0,0 +1,194 @@
+From 59029136d75022cb8b7c7bebd1738ae70232416e Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Sun, 10 Jun 2018 19:57:01 +0530
+Subject: [PATCH] powerpc/perf: Add constraints for power9 l2/l3 bus events
+
+References: bsc#1056686
+Patch-mainline: v5.0-rc1
+Git-commit: 59029136d75022cb8b7c7bebd1738ae70232416e
+
+In previous generation processors, both bus events and direct
+events of performance monitoring unit can be individually
+programmabled and monitored in PMCs.
+
+But in Power9, L2/L3 bus events are always available as a
+"bank" of 4 events. To obtain the counts for any of the
+l2/l3 bus events in a given bank, the user will have to
+program PMC4 with corresponding l2/l3 bus event for that
+bank.
+
+Patch enforce two contraints incase of L2/L3 bus events.
+
+1)Any L2/L3 event when programmed is also expected to program corresponding
+PMC4 event from that group.
+2)PMC4 event should always been programmed first due to group constraint
+logic limitation
+
+For ex. consider these L3 bus events
+
+PM_L3_PF_ON_CHIP_MEM (0x460A0),
+PM_L3_PF_MISS_L3 (0x160A0),
+PM_L3_CO_MEM (0x260A0),
+PM_L3_PF_ON_CHIP_CACHE (0x360A0),
+
+1) This is an INVALID group for L3 Bus event monitoring,
+since it is missing PMC4 event.
+ perf stat -e "{r160A0,r260A0,r360A0}" < >
+
+And this is a VALID group for L3 Bus events:
+ perf stat -e "{r460A0,r160A0,r260A0,r360A0}" < >
+
+2) This is an INVALID group for L3 Bus event monitoring,
+since it is missing PMC4 event.
+ perf stat -e "{r260A0,r360A0}" < >
+
+And this is a VALID group for L3 Bus events:
+ perf stat -e "{r460A0,r260A0,r360A0}" < >
+
+3) This is an INVALID group for L3 Bus event monitoring,
+since it is missing PMC4 event.
+ perf stat -e "{r360A0}" < >
+
+And this is a VALID group for L3 Bus events:
+ perf stat -e "{r460A0,r360A0}" < >
+
+Patch here implements group constraint logic suggested by Michael Ellerman.
+
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/perf_event_server.h | 2 ++
+ arch/powerpc/perf/core-book3s.c | 20 ++++++++++----
+ arch/powerpc/perf/isa207-common.c | 28 +++++++++++++-------
+ arch/powerpc/perf/isa207-common.h | 5 ++++
+ arch/powerpc/perf/power9-pmu.c | 2 ++
+ 5 files changed, 42 insertions(+), 15 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/perf_event_server.h b/arch/powerpc/include/asm/perf_event_server.h
+index 67a8a9585d50..e60aeb46d6a0 100644
+--- a/arch/powerpc/include/asm/perf_event_server.h
++++ b/arch/powerpc/include/asm/perf_event_server.h
+@@ -41,6 +41,8 @@ struct power_pmu {
+ void (*get_mem_data_src)(union perf_mem_data_src *dsrc,
+ u32 flags, struct pt_regs *regs);
+ void (*get_mem_weight)(u64 *weight);
++ unsigned long group_constraint_mask;
++ unsigned long group_constraint_val;
+ u64 (*bhrb_filter_map)(u64 branch_sample_type);
+ void (*config_bhrb)(u64 pmu_bhrb_filter);
+ void (*disable_pmc)(unsigned int pmc, unsigned long mmcr[]);
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index b4976cae1005..383cc3640ac6 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -872,6 +872,8 @@ static int power_check_constraints(struct cpu_hw_events *cpuhw,
+ int i, j;
+ unsigned long addf = ppmu->add_fields;
+ unsigned long tadd = ppmu->test_adder;
++ unsigned long grp_mask = ppmu->group_constraint_mask;
++ unsigned long grp_val = ppmu->group_constraint_val;
+
+ if (n_ev > ppmu->n_counter)
+ return -1;
+@@ -892,15 +894,23 @@ static int power_check_constraints(struct cpu_hw_events *cpuhw,
+ for (i = 0; i < n_ev; ++i) {
+ nv = (value | cpuhw->avalues[i][0]) +
+ (value & cpuhw->avalues[i][0] & addf);
+- if ((((nv + tadd) ^ value) & mask) != 0 ||
+- (((nv + tadd) ^ cpuhw->avalues[i][0]) &
+- cpuhw->amasks[i][0]) != 0)
++
++ if (((((nv + tadd) ^ value) & mask) & (~grp_mask)) != 0)
++ break;
++
++ if (((((nv + tadd) ^ cpuhw->avalues[i][0]) & cpuhw->amasks[i][0])
++ & (~grp_mask)) != 0)
+ break;
++
+ value = nv;
+ mask |= cpuhw->amasks[i][0];
+ }
+- if (i == n_ev)
+- return 0; /* all OK */
++ if (i == n_ev) {
++ if ((value & mask & grp_mask) != (mask & grp_val))
++ return -1;
++ else
++ return 0; /* all OK */
++ }
+
+ /* doesn't work, gather alternatives... */
+ if (!ppmu->get_alternatives)
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 053b8e9aa9e7..a6c24d866b2f 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -287,17 +287,25 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+ }
+
+ if (unit >= 6 && unit <= 9) {
+- /*
+- * L2/L3 events contain a cache selector field, which is
+- * supposed to be programmed into MMCRC. However MMCRC is only
+- * HV writable, and there is no API for guest kernels to modify
+- * it. The solution is for the hypervisor to initialise the
+- * field to zeroes, and for us to only ever allow events that
+- * have a cache selector of zero. The bank selector (bit 3) is
+- * irrelevant, as long as the rest of the value is 0.
+- */
+- if (!cpu_has_feature(CPU_FTR_ARCH_300) && (cache & 0x7))
++ if (cpu_has_feature(CPU_FTR_ARCH_300)) {
++ mask |= CNST_CACHE_GROUP_MASK;
++ value |= CNST_CACHE_GROUP_VAL(event & 0xff);
++
++ mask |= CNST_CACHE_PMC4_MASK;
++ if (pmc == 4)
++ value |= CNST_CACHE_PMC4_VAL;
++ } else if (cache & 0x7) {
++ /*
++ * L2/L3 events contain a cache selector field, which is
++ * supposed to be programmed into MMCRC. However MMCRC is only
++ * HV writable, and there is no API for guest kernels to modify
++ * it. The solution is for the hypervisor to initialise the
++ * field to zeroes, and for us to only ever allow events that
++ * have a cache selector of zero. The bank selector (bit 3) is
++ * irrelevant, as long as the rest of the value is 0.
++ */
+ return -1;
++ }
+
+ } else if (cpu_has_feature(CPU_FTR_ARCH_300) || (event & EVENT_IS_L1)) {
+ mask |= CNST_L1_QUAL_MASK;
+diff --git a/arch/powerpc/perf/isa207-common.h b/arch/powerpc/perf/isa207-common.h
+index e5a621699a6d..91350f42a662 100644
+--- a/arch/powerpc/perf/isa207-common.h
++++ b/arch/powerpc/perf/isa207-common.h
+@@ -134,6 +134,11 @@
+ #define CNST_SAMPLE_VAL(v) (((v) & EVENT_SAMPLE_MASK) << 16)
+ #define CNST_SAMPLE_MASK CNST_SAMPLE_VAL(EVENT_SAMPLE_MASK)
+
++#define CNST_CACHE_GROUP_VAL(v) (((v) & 0xffull) << 55)
++#define CNST_CACHE_GROUP_MASK CNST_CACHE_GROUP_VAL(0xff)
++#define CNST_CACHE_PMC4_VAL (1ull << 54)
++#define CNST_CACHE_PMC4_MASK CNST_CACHE_PMC4_VAL
++
+ /*
+ * For NC we are counting up to 4 events. This requires three bits, and we need
+ * the fifth event to overflow and set the 4th bit. To achieve that we bias the
+diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
+index a5f8c563001b..deffe1c3c518 100644
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -419,6 +419,8 @@ static struct power_pmu power9_pmu = {
+ .n_counter = MAX_PMU_COUNTERS,
+ .add_fields = ISA207_ADD_FIELDS,
+ .test_adder = ISA207_TEST_ADDER,
++ .group_constraint_mask = CNST_CACHE_PMC4_MASK,
++ .group_constraint_val = CNST_CACHE_PMC4_VAL,
+ .compute_mmcr = isa207_compute_mmcr,
+ .config_bhrb = power9_config_bhrb,
+ .bhrb_filter_map = power9_bhrb_filter_map,
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-perf-Cleanup-cache_sel-bits-comment.patch b/patches.arch/powerpc-perf-Cleanup-cache_sel-bits-comment.patch
new file mode 100644
index 0000000000..661383aa67
--- /dev/null
+++ b/patches.arch/powerpc-perf-Cleanup-cache_sel-bits-comment.patch
@@ -0,0 +1,45 @@
+From 8c31459d6138b07537346d976e7c30c760a1de01 Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Mon, 9 Oct 2017 19:42:39 +0530
+Subject: [PATCH] powerpc/perf: Cleanup cache_sel bits comment
+
+References: bsc#1056686
+Patch-mainline: v5.0-rc1
+Git-commit: 8c31459d6138b07537346d976e7c30c760a1de01
+
+Update the raw event code comment in power9-pmu.c with respect to
+"cache" bits, since power9 MMCRC does not support these.
+
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/perf/power9-pmu.c | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
+index e012b1030a5b..a5f8c563001b 100644
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -63,16 +63,8 @@
+ * MMCRA[9:11] = thresh_cmp[0:2]
+ * MMCRA[12:18] = thresh_cmp[3:9]
+ *
+- * if unit == 6 or unit == 7
+- * MMCRC[53:55] = cache_sel[1:3] (L2EVENT_SEL)
+- * else if unit == 8 or unit == 9:
+- * if cache_sel[0] == 0: # L3 bank
+- * MMCRC[47:49] = cache_sel[1:3] (L3EVENT_SEL0)
+- * else if cache_sel[0] == 1:
+- * MMCRC[50:51] = cache_sel[2:3] (L3EVENT_SEL1)
+- * else if cache_sel[1]: # L1 event
+- * MMCR1[16] = cache_sel[2]
+- * MMCR1[17] = cache_sel[3]
++ * MMCR1[16] = cache_sel[2]
++ * MMCR1[17] = cache_sel[3]
+ *
+ * if mark:
+ * MMCRA[63] = 1 (SAMPLE_ENABLE)
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-perf-Fix-thresholding-counter-data-for-unkno.patch b/patches.arch/powerpc-perf-Fix-thresholding-counter-data-for-unkno.patch
new file mode 100644
index 0000000000..a9112f5b65
--- /dev/null
+++ b/patches.arch/powerpc-perf-Fix-thresholding-counter-data-for-unkno.patch
@@ -0,0 +1,46 @@
+From 17cfccc91545682513541924245abb876d296063 Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Sun, 9 Dec 2018 14:48:15 +0530
+Subject: [PATCH] powerpc/perf: Fix thresholding counter data for unknown type
+
+References: bsc#1056686
+Patch-mainline: v5.0-rc1
+Git-commit: 17cfccc91545682513541924245abb876d296063
+
+MMCRA[34:36] and MMCRA[38:44] expose the thresholding counter value.
+Thresholding counter can be used to count latency cycles such as
+load miss to reload. But threshold counter value is not relevant
+when the sampled instruction type is unknown or reserved. Patch to
+fix the thresholding counter value to zero when sampled instruction
+type is unknown or reserved.
+
+Fixes: 170a315f41c6('powerpc/perf: Support to export MMCRA[TEC*] field to userspace')
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/perf/isa207-common.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
+index 177de814286f..6a2f65d3d088 100644
+--- a/arch/powerpc/perf/isa207-common.c
++++ b/arch/powerpc/perf/isa207-common.c
+@@ -226,8 +226,13 @@ void isa207_get_mem_weight(u64 *weight)
+ u64 mmcra = mfspr(SPRN_MMCRA);
+ u64 exp = MMCRA_THR_CTR_EXP(mmcra);
+ u64 mantissa = MMCRA_THR_CTR_MANT(mmcra);
++ u64 sier = mfspr(SPRN_SIER);
++ u64 val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT;
+
+- *weight = mantissa << (2 * exp);
++ if (val == 0 || val == 7)
++ *weight = 0;
++ else
++ *weight = mantissa << (2 * exp);
+ }
+
+ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-perf-Remove-PM_BR_CMPL_ALT-from-power9-event.patch b/patches.arch/powerpc-perf-Remove-PM_BR_CMPL_ALT-from-power9-event.patch
new file mode 100644
index 0000000000..c9f4ae1d3d
--- /dev/null
+++ b/patches.arch/powerpc-perf-Remove-PM_BR_CMPL_ALT-from-power9-event.patch
@@ -0,0 +1,36 @@
+From 659a6e38db0b422c63fd68ca7e78a8daadca061e Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Mon, 1 Apr 2019 11:50:39 +0530
+Subject: [PATCH] powerpc/perf: Remove PM_BR_CMPL_ALT from power9 event list
+
+References: fate#321438, bsc#1047238, bsc#1056686
+Patch-mainline: v5.2-rc1
+Git-commit: 659a6e38db0b422c63fd68ca7e78a8daadca061e
+
+PM_BR_CMPL_ALT event is not supported, remove it from the power9 event
+list.
+
+Fixes: 24bedcb7c811 ("powerpc/perf: Fix branch event code for power9")
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/perf/power9-events-list.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/arch/powerpc/perf/power9-events-list.h b/arch/powerpc/perf/power9-events-list.h
+index 063c9d9f2516..6b1dc9a83ede 100644
+--- a/arch/powerpc/perf/power9-events-list.h
++++ b/arch/powerpc/perf/power9-events-list.h
+@@ -63,8 +63,6 @@ EVENT(PM_RUN_CYC_ALT, 0x200f4)
+ /* Instruction Dispatched */
+ EVENT(PM_INST_DISP, 0x200f2)
+ EVENT(PM_INST_DISP_ALT, 0x300f2)
+-/* Alternate Branch event code */
+-EVENT(PM_BR_CMPL_ALT, 0x10012)
+ /* Branch event that are not strongly biased */
+ EVENT(PM_BR_2PATH, 0x20036)
+ /* ALternate branch event that are not strongly biased */
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-perf-Update-perf_regs-structure-to-include-S.patch b/patches.arch/powerpc-perf-Update-perf_regs-structure-to-include-S.patch
new file mode 100644
index 0000000000..59191147dd
--- /dev/null
+++ b/patches.arch/powerpc-perf-Update-perf_regs-structure-to-include-S.patch
@@ -0,0 +1,141 @@
+From 333804dc3b7a92158ab63a48febff0d8ef89ada3 Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Sun, 9 Dec 2018 14:55:35 +0530
+Subject: [PATCH] powerpc/perf: Update perf_regs structure to include SIER
+
+References: bsc#1056686
+Patch-mainline: v5.0-rc1
+Git-commit: 333804dc3b7a92158ab63a48febff0d8ef89ada3
+
+On each sample, Sample Instruction Event Register (SIER) content
+is saved in pt_regs. SIER does not have a entry as-is in the pt_regs
+but instead, SIER content is saved in the "dar" register of pt_regs.
+
+Patch adds another entry to the perf_regs structure to include the "SIER"
+printing which internally maps to the "dar" of pt_regs.
+
+It also check for the SIER availability in the platform and present
+value accordingly
+
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/perf_event.h | 3 +++
+ arch/powerpc/include/uapi/asm/perf_regs.h | 1 +
+ arch/powerpc/perf/core-book3s.c | 8 ++++++++
+ arch/powerpc/perf/perf_regs.c | 7 +++++++
+ tools/arch/powerpc/include/uapi/asm/perf_regs.h | 1 +
+ tools/perf/arch/powerpc/include/perf_regs.h | 3 ++-
+ tools/perf/arch/powerpc/util/perf_regs.c | 1 +
+ 7 files changed, 23 insertions(+), 1 deletion(-)
+
+diff --git a/arch/powerpc/include/asm/perf_event.h b/arch/powerpc/include/asm/perf_event.h
+index 16a49819da9a..35926cd6cd0b 100644
+--- a/arch/powerpc/include/asm/perf_event.h
++++ b/arch/powerpc/include/asm/perf_event.h
+@@ -39,4 +39,7 @@
+ (regs)->gpr[1] = current_stack_pointer(); \
+ asm volatile("mfmsr %0" : "=r" ((regs)->msr)); \
+ } while (0)
++
++/* To support perf_regs sier update */
++extern bool is_sier_available(void);
+ #endif
+diff --git a/arch/powerpc/include/uapi/asm/perf_regs.h b/arch/powerpc/include/uapi/asm/perf_regs.h
+index 9e52c86ccbd3..ff91192407d1 100644
+--- a/arch/powerpc/include/uapi/asm/perf_regs.h
++++ b/arch/powerpc/include/uapi/asm/perf_regs.h
+@@ -46,6 +46,7 @@ enum perf_event_powerpc_regs {
+ PERF_REG_POWERPC_TRAP,
+ PERF_REG_POWERPC_DAR,
+ PERF_REG_POWERPC_DSISR,
++ PERF_REG_POWERPC_SIER,
+ PERF_REG_POWERPC_MAX,
+ };
+ #endif /* _UAPI_ASM_POWERPC_PERF_REGS_H */
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 81f8a0c838ae..b4976cae1005 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -130,6 +130,14 @@ static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {}
+ static void pmao_restore_workaround(bool ebb) { }
+ #endif /* CONFIG_PPC32 */
+
++bool is_sier_available(void)
++{
++ if (ppmu->flags & PPMU_HAS_SIER)
++ return true;
++
++ return false;
++}
++
+ static bool regs_use_siar(struct pt_regs *regs)
+ {
+ /*
+diff --git a/arch/powerpc/perf/perf_regs.c b/arch/powerpc/perf/perf_regs.c
+index 09ceea6175ba..5c36b3a8d47a 100644
+--- a/arch/powerpc/perf/perf_regs.c
++++ b/arch/powerpc/perf/perf_regs.c
+@@ -69,6 +69,7 @@ static unsigned int pt_regs_offset[PERF_REG_POWERPC_MAX] = {
+ PT_REGS_OFFSET(PERF_REG_POWERPC_TRAP, trap),
+ PT_REGS_OFFSET(PERF_REG_POWERPC_DAR, dar),
+ PT_REGS_OFFSET(PERF_REG_POWERPC_DSISR, dsisr),
++ PT_REGS_OFFSET(PERF_REG_POWERPC_SIER, dar),
+ };
+
+ u64 perf_reg_value(struct pt_regs *regs, int idx)
+@@ -76,6 +77,12 @@ u64 perf_reg_value(struct pt_regs *regs, int idx)
+ if (WARN_ON_ONCE(idx >= PERF_REG_POWERPC_MAX))
+ return 0;
+
++ if (idx == PERF_REG_POWERPC_SIER &&
++ (IS_ENABLED(CONFIG_FSL_EMB_PERF_EVENT) ||
++ IS_ENABLED(CONFIG_PPC32) ||
++ !is_sier_available()))
++ return 0;
++
+ return regs_get_register(regs, pt_regs_offset[idx]);
+ }
+
+diff --git a/tools/arch/powerpc/include/uapi/asm/perf_regs.h b/tools/arch/powerpc/include/uapi/asm/perf_regs.h
+index 9e52c86ccbd3..ff91192407d1 100644
+--- a/tools/arch/powerpc/include/uapi/asm/perf_regs.h
++++ b/tools/arch/powerpc/include/uapi/asm/perf_regs.h
+@@ -46,6 +46,7 @@ enum perf_event_powerpc_regs {
+ PERF_REG_POWERPC_TRAP,
+ PERF_REG_POWERPC_DAR,
+ PERF_REG_POWERPC_DSISR,
++ PERF_REG_POWERPC_SIER,
+ PERF_REG_POWERPC_MAX,
+ };
+ #endif /* _UAPI_ASM_POWERPC_PERF_REGS_H */
+diff --git a/tools/perf/arch/powerpc/include/perf_regs.h b/tools/perf/arch/powerpc/include/perf_regs.h
+index 00e37b106913..1076393e6f43 100644
+--- a/tools/perf/arch/powerpc/include/perf_regs.h
++++ b/tools/perf/arch/powerpc/include/perf_regs.h
+@@ -62,7 +62,8 @@ static const char *reg_names[] = {
+ [PERF_REG_POWERPC_SOFTE] = "softe",
+ [PERF_REG_POWERPC_TRAP] = "trap",
+ [PERF_REG_POWERPC_DAR] = "dar",
+- [PERF_REG_POWERPC_DSISR] = "dsisr"
++ [PERF_REG_POWERPC_DSISR] = "dsisr",
++ [PERF_REG_POWERPC_SIER] = "sier"
+ };
+
+ static inline const char *perf_reg_name(int id)
+diff --git a/tools/perf/arch/powerpc/util/perf_regs.c b/tools/perf/arch/powerpc/util/perf_regs.c
+index ec50939b0418..07fcd977d93e 100644
+--- a/tools/perf/arch/powerpc/util/perf_regs.c
++++ b/tools/perf/arch/powerpc/util/perf_regs.c
+@@ -52,6 +52,7 @@ const struct sample_reg sample_reg_masks[] = {
+ SMPL_REG(trap, PERF_REG_POWERPC_TRAP),
+ SMPL_REG(dar, PERF_REG_POWERPC_DAR),
+ SMPL_REG(dsisr, PERF_REG_POWERPC_DSISR),
++ SMPL_REG(sier, PERF_REG_POWERPC_SIER),
+ SMPL_REG_END
+ };
+
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-powernv-Return-for-invalid-IMC-domain.patch b/patches.arch/powerpc-powernv-Return-for-invalid-IMC-domain.patch
new file mode 100644
index 0000000000..50623e0cbd
--- /dev/null
+++ b/patches.arch/powerpc-powernv-Return-for-invalid-IMC-domain.patch
@@ -0,0 +1,52 @@
+From e66ec5e9303ae62fb3402088cca8d64e167bed69 Mon Sep 17 00:00:00 2001
+From: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Date: Mon, 20 May 2019 14:27:53 +0530
+Subject: [PATCH] powerpc/powernv: Return for invalid IMC domain
+
+References: bsc1054914, fate#322448, git-fixes
+Patch-mainline: v5.2-rc3
+Git-commit: b59bd3527fe3c1939340df558d7f9d568fc9f882
+
+Currently init_imc_pmu() can fail either because we try to register an
+IMC unit with an invalid domain (i.e an IMC node not supported by the
+kernel) or something went wrong while registering a valid IMC unit. In
+both the cases kernel provides a 'Register failed' error message.
+
+For example when trace-imc node is not supported by the kernel, but
+skiboot advertises a trace-imc node we print:
+
+ IMC Unknown Device type
+ IMC PMU (null) Register failed
+
+To avoid confusion just print the unknown device type message, before
+attempting PMU registration, so the second message isn't printed.
+
+Fixes: 8f95faaac56c ("powerpc/powernv: Detect and create IMC device")
+Reported-by: Pavaman Subramaniyam <pavsubra@in.ibm.com>
+Signed-off-by: Anju T Sudhakar <anju@linux.vnet.ibm.com>
+Reviewed-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+[mpe: Reword change log a bit]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/powernv/opal-imc.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c
+index 38eccc66c7f4..600d863f7dd2 100644
+--- a/arch/powerpc/platforms/powernv/opal-imc.c
++++ b/arch/powerpc/platforms/powernv/opal-imc.c
+@@ -87,6 +87,10 @@ static int imc_pmu_create(struct device_node *parent, int pmu_index, int domain)
+ struct imc_pmu *pmu_ptr;
+ u32 offset;
+
++ /* Return for unknown domain */
++ if (domain < 0)
++ return -EINVAL;
++
+ /* memory for pmu */
+ pmu_ptr = kzalloc(sizeof(struct imc_pmu), GFP_KERNEL);
+ if (!pmu_ptr)
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-powernv-opal-dump-Use-IRQ_HANDLED-instead-of.patch b/patches.arch/powerpc-powernv-opal-dump-Use-IRQ_HANDLED-instead-of.patch
new file mode 100644
index 0000000000..739810536b
--- /dev/null
+++ b/patches.arch/powerpc-powernv-opal-dump-Use-IRQ_HANDLED-instead-of.patch
@@ -0,0 +1,63 @@
+From b29336c0e1785a28bc40a9fd47c2321671e9792e Mon Sep 17 00:00:00 2001
+From: Mukesh Ojha <mukesh02@linux.vnet.ibm.com>
+Date: Mon, 20 Feb 2017 18:52:11 +0530
+Subject: [PATCH] powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of
+ numbers in interrupt handler
+
+References: bsc#1065729
+Patch-mainline: v4.19-rc1
+Git-commit: b29336c0e1785a28bc40a9fd47c2321671e9792e
+
+Fixes: 8034f715f ("powernv/opal-dump: Convert to irq domain")
+
+Converts all the return explicit number to a more proper IRQ_HANDLED,
+which looks proper incase of interrupt handler returning case.
+
+Here, It also removes error message like "nobody cared" which was
+getting unveiled while returning -1 or 0 from handler.
+
+Signed-off-by: Mukesh Ojha <mukesh02@linux.vnet.ibm.com>
+Reviewed-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/powernv/opal-dump.c | 9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
+index a792966ab0f2..198143833f00 100644
+--- a/arch/powerpc/platforms/powernv/opal-dump.c
++++ b/arch/powerpc/platforms/powernv/opal-dump.c
+@@ -371,13 +371,12 @@ static irqreturn_t process_dump(int irq, void *data)
+ {
+ int rc;
+ uint32_t dump_id, dump_size, dump_type;
+- struct dump_obj *dump;
+ char name[22];
+ struct kobject *kobj;
+
+ rc = dump_read_info(&dump_id, &dump_size, &dump_type);
+ if (rc != OPAL_SUCCESS)
+- return rc;
++ return IRQ_HANDLED;
+
+ sprintf(name, "0x%x-0x%x", dump_type, dump_id);
+
+@@ -389,12 +388,10 @@ static irqreturn_t process_dump(int irq, void *data)
+ if (kobj) {
+ /* Drop reference added by kset_find_obj() */
+ kobject_put(kobj);
+- return 0;
++ return IRQ_HANDLED;
+ }
+
+- dump = create_dump_obj(dump_id, dump_size, dump_type);
+- if (!dump)
+- return -1;
++ create_dump_obj(dump_id, dump_size, dump_type);
+
+ return IRQ_HANDLED;
+ }
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-pseries-add-missing-cpumask.h-include-file.patch b/patches.arch/powerpc-pseries-add-missing-cpumask.h-include-file.patch
new file mode 100644
index 0000000000..fa9a058991
--- /dev/null
+++ b/patches.arch/powerpc-pseries-add-missing-cpumask.h-include-file.patch
@@ -0,0 +1,42 @@
+From 8dce6b2215eaa91dbf04463e11098a48748da5ab Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Mon, 22 Oct 2018 20:32:12 -0500
+Subject: [PATCH] powerpc/pseries: add missing cpumask.h include file
+
+References: bsc#1065729
+Patch-mainline: v4.20-rc1
+Git-commit: 8dce6b2215eaa91dbf04463e11098a48748da5ab
+
+Build error is encountered when inlcuding <asm/rtas.h> if no explicit or
+implicit include of cpumask.h exists in the including file.
+
+In file included from arch/powerpc/platforms/pseries/hotplug-pci.c:3:0:
+./arch/powerpc/include/asm/rtas.h:360:34: error: unknown type name 'cpumask_var_t'
+ extern int rtas_online_cpus_mask(cpumask_var_t cpus);
+ ^
+./arch/powerpc/include/asm/rtas.h:361:35: error: unknown type name 'cpumask_var_t'
+ extern int rtas_offline_cpus_mask(cpumask_var_t cpus);
+
+Fixes: 120496ac2d2d ("powerpc: Bring all threads online prior to migration/hibernation")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/include/asm/rtas.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
+index bb38dd67d47d..1b06add4f092 100644
+--- a/arch/powerpc/include/asm/rtas.h
++++ b/arch/powerpc/include/asm/rtas.h
+@@ -5,6 +5,7 @@
+ #include <linux/spinlock.h>
+ #include <asm/page.h>
+ #include <linux/time.h>
++#include <linux/cpumask.h>
+
+ /*
+ * Definitions for talking to the RTAS on CHRP machines.
+--
+2.22.0
+
diff --git a/patches.arch/powerpc-xive-Fix-loop-exit-condition-in-xive_find_ta.patch b/patches.arch/powerpc-xive-Fix-loop-exit-condition-in-xive_find_ta.patch
new file mode 100644
index 0000000000..11db4b9a74
--- /dev/null
+++ b/patches.arch/powerpc-xive-Fix-loop-exit-condition-in-xive_find_ta.patch
@@ -0,0 +1,124 @@
+From 4d202c8c8ed3822327285747db1765967110b274 Mon Sep 17 00:00:00 2001
+From: "Gautham R. Shenoy" <ego@linux.vnet.ibm.com>
+Date: Wed, 17 Jul 2019 16:05:24 +0530
+Subject: [PATCH] powerpc/xive: Fix loop exit-condition in
+ xive_find_target_in_mask()
+
+References: FATE#322438, bsc#1085030, bsc#1145189, LTC#179762
+Patch-mainline: v5.3-rc2
+Git-commit: 4d202c8c8ed3822327285747db1765967110b274
+
+xive_find_target_in_mask() has the following for(;;) loop which has a
+bug when @first == cpumask_first(@mask) and condition 1 fails to hold
+for every CPU in @mask. In this case we loop forever in the for-loop.
+
+ first = cpu;
+ for (;;) {
+ if (cpu_online(cpu) && xive_try_pick_target(cpu)) // condition 1
+ return cpu;
+ cpu = cpumask_next(cpu, mask);
+ if (cpu == first) // condition 2
+ break;
+
+ if (cpu >= nr_cpu_ids) // condition 3
+ cpu = cpumask_first(mask);
+ }
+
+This is because, when @first == cpumask_first(@mask), we never hit the
+condition 2 (cpu == first) since prior to this check, we would have
+executed "cpu = cpumask_next(cpu, mask)" which will set the value of
+@cpu to a value greater than @first or to nr_cpus_ids. When this is
+coupled with the fact that condition 1 is not met, we will never exit
+this loop.
+
+This was discovered by the hard-lockup detector while running LTP test
+concurrently with SMT switch tests.
+
+ watchdog: CPU 12 detected hard LOCKUP on other CPUs 68
+ watchdog: CPU 12 TB:85587019220796, last SMP heartbeat TB:85578827223399 (15999ms ago)
+ watchdog: CPU 68 Hard LOCKUP
+ watchdog: CPU 68 TB:85587019361273, last heartbeat TB:85576815065016 (19930ms ago)
+ CPU: 68 PID: 45050 Comm: hxediag Kdump: loaded Not tainted 4.18.0-100.el8.ppc64le #1
+ NIP: c0000000006f5578 LR: c000000000cba9ec CTR: 0000000000000000
+ REGS: c000201fff3c7d80 TRAP: 0100 Not tainted (4.18.0-100.el8.ppc64le)
+ MSR: 9000000002883033 <SF,HV,VEC,VSX,FP,ME,IR,DR,RI,LE> CR: 24028424 XER: 00000000
+ CFAR: c0000000006f558c IRQMASK: 1
+ GPR00: c0000000000afc58 c000201c01c43400 c0000000015ce500 c000201cae26ec18
+ GPR04: 0000000000000800 0000000000000540 0000000000000800 00000000000000f8
+ GPR08: 0000000000000020 00000000000000a8 0000000080000000 c00800001a1beed8
+ GPR12: c0000000000b1410 c000201fff7f4c00 0000000000000000 0000000000000000
+ GPR16: 0000000000000000 0000000000000000 0000000000000540 0000000000000001
+ GPR20: 0000000000000048 0000000010110000 c00800001a1e3780 c000201cae26ed18
+ GPR24: 0000000000000000 c000201cae26ed8c 0000000000000001 c000000001116bc0
+ GPR28: c000000001601ee8 c000000001602494 c000201cae26ec18 000000000000001f
+ NIP [c0000000006f5578] find_next_bit+0x38/0x90
+ LR [c000000000cba9ec] cpumask_next+0x2c/0x50
+ Call Trace:
+ [c000201c01c43400] [c000201cae26ec18] 0xc000201cae26ec18 (unreliable)
+ [c000201c01c43420] [c0000000000afc58] xive_find_target_in_mask+0x1b8/0x240
+ [c000201c01c43470] [c0000000000b0228] xive_pick_irq_target.isra.3+0x168/0x1f0
+ [c000201c01c435c0] [c0000000000b1470] xive_irq_startup+0x60/0x260
+ [c000201c01c43640] [c0000000001d8328] __irq_startup+0x58/0xf0
+ [c000201c01c43670] [c0000000001d844c] irq_startup+0x8c/0x1a0
+ [c000201c01c436b0] [c0000000001d57b0] __setup_irq+0x9f0/0xa90
+ [c000201c01c43760] [c0000000001d5aa0] request_threaded_irq+0x140/0x220
+ [c000201c01c437d0] [c00800001a17b3d4] bnx2x_nic_load+0x188c/0x3040 [bnx2x]
+ [c000201c01c43950] [c00800001a187c44] bnx2x_self_test+0x1fc/0x1f70 [bnx2x]
+ [c000201c01c43a90] [c000000000adc748] dev_ethtool+0x11d8/0x2cb0
+ [c000201c01c43b60] [c000000000b0b61c] dev_ioctl+0x5ac/0xa50
+ [c000201c01c43bf0] [c000000000a8d4ec] sock_do_ioctl+0xbc/0x1b0
+ [c000201c01c43c60] [c000000000a8dfb8] sock_ioctl+0x258/0x4f0
+ [c000201c01c43d20] [c0000000004c9704] do_vfs_ioctl+0xd4/0xa70
+ [c000201c01c43de0] [c0000000004ca274] sys_ioctl+0xc4/0x160
+ [c000201c01c43e30] [c00000000000b388] system_call+0x5c/0x70
+ Instruction dump:
+ 78aad182 54a806be 3920ffff 78a50664 794a1f24 7d294036 7d43502a 7d295039
+ 4182001c 48000034 78a9d182 79291f24 <7d23482a> 2fa90000 409e0020 38a50040
+
+To fix this, move the check for condition 2 after the check for
+condition 3, so that we are able to break out of the loop soon after
+iterating through all the CPUs in the @mask in the problem case. Use
+do..while() to achieve this.
+
+Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller")
+Cc: stable@vger.kernel.org # v4.12+
+Reported-by: Indira P. Joga <indira.priya@in.ibm.com>
+Signed-off-by: Gautham R. Shenoy <ego@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/1563359724-13931-1-git-send-email-ego@linux.vnet.ibm.com
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/sysdev/xive/common.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
+index 082c7e1c20f0..1cdb39575eae 100644
+--- a/arch/powerpc/sysdev/xive/common.c
++++ b/arch/powerpc/sysdev/xive/common.c
+@@ -479,7 +479,7 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
+ * Now go through the entire mask until we find a valid
+ * target.
+ */
+- for (;;) {
++ do {
+ /*
+ * We re-check online as the fallback case passes us
+ * an untested affinity mask
+@@ -487,12 +487,11 @@ static int xive_find_target_in_mask(const struct cpumask *mask,
+ if (cpu_online(cpu) && xive_try_pick_target(cpu))
+ return cpu;
+ cpu = cpumask_next(cpu, mask);
+- if (cpu == first)
+- break;
+ /* Wrap around */
+ if (cpu >= nr_cpu_ids)
+ cpu = cpumask_first(mask);
+- }
++ } while (cpu != first);
++
+ return -1;
+ }
+
+--
+2.22.0
+
diff --git a/patches.arch/s390-dasd-fix-endless-loop-after-read-unit-address-c.patch b/patches.arch/s390-dasd-fix-endless-loop-after-read-unit-address-c.patch
new file mode 100644
index 0000000000..46ee8eece3
--- /dev/null
+++ b/patches.arch/s390-dasd-fix-endless-loop-after-read-unit-address-c.patch
@@ -0,0 +1,95 @@
+From 41995342b40c418a47603e1321256d2c4a2ed0fb Mon Sep 17 00:00:00 2001
+From: Stefan Haberland <sth@linux.ibm.com>
+Date: Thu, 1 Aug 2019 13:06:30 +0200
+Subject: [PATCH] s390/dasd: fix endless loop after read unit address
+ configuration
+
+References: bsc#1144912 LTC#179907
+Patch-mainline: v5.3-rc3
+Git-commit: 41995342b40c418a47603e1321256d2c4a2ed0fb
+
+Description: dasd: fix endless loop after read unit address configuration
+Symptom: After getting a storage server event that causes the
+ DASD device driver to update its unit address
+ configuration during a device shutdown there is the
+ possibility of an endless loop in the device driver.
+ In the system log there will be ongoing DASD error
+ messages with RC: -19.
+Problem: The loop starting the ruac request only terminates when
+ the retry counter is decreased to 0. But in the
+ sleep_on function there are early exit paths that do
+ not decrease the retry counter.
+Solution: Prevent an endless loop by handling those cases separately.
+ Remove the unnecessary do..while loop since the
+ sleep_on function takes care of retries by itself.
+Reproduction: Disable a device when a storage server event causes
+ unit address configuration updates.
+
+After getting a storage server event that causes the DASD device driver
+to update its unit address configuration during a device shutdown there is
+the possibility of an endless loop in the device driver.
+
+In the system log there will be ongoing DASD error messages with RC: -19.
+
+The reason is that the loop starting the ruac request only terminates when
+the retry counter is decreased to 0. But in the sleep_on function there are
+early exit paths that do not decrease the retry counter.
+
+Prevent an endless loop by handling those cases separately.
+
+Remove the unnecessary do..while loop since the sleep_on function takes
+care of retries by itself.
+
+Fixes: 8e09f21574ea ("[S390] dasd: add hyper PAV support to DASD device driver, part 1")
+Cc: stable@vger.kernel.org # 2.6.25+
+Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
+Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/s390/block/dasd_alias.c | 22 ++++++++++++++++------
+ 1 file changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index b9ce93e9df89..99f86612f775 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -383,6 +383,20 @@ suborder_not_supported(struct dasd_ccw_req *cqr)
+ char msg_format;
+ char msg_no;
+
++ /*
++ * intrc values ENODEV, ENOLINK and EPERM
++ * will be optained from sleep_on to indicate that no
++ * IO operation can be started
++ */
++ if (cqr->intrc == -ENODEV)
++ return 1;
++
++ if (cqr->intrc == -ENOLINK)
++ return 1;
++
++ if (cqr->intrc == -EPERM)
++ return 1;
++
+ sense = dasd_get_sense(&cqr->irb);
+ if (!sense)
+ return 0;
+@@ -447,12 +461,8 @@ static int read_unit_address_configuration(struct dasd_device *device,
+ lcu->flags &= ~NEED_UAC_UPDATE;
+ spin_unlock_irqrestore(&lcu->lock, flags);
+
+- do {
+- rc = dasd_sleep_on(cqr);
+- if (rc && suborder_not_supported(cqr))
+- return -EOPNOTSUPP;
+- } while (rc && (cqr->retries > 0));
+- if (rc) {
++ rc = dasd_sleep_on(cqr);
++ if (rc && !suborder_not_supported(cqr)) {
+ spin_lock_irqsave(&lcu->lock, flags);
+ lcu->flags |= NEED_UAC_UPDATE;
+ spin_unlock_irqrestore(&lcu->lock, flags);
+--
+2.22.0
+
diff --git a/patches.arch/s390-sles15sp1-00-08-46-s390-cio-fix-ccw_device_start_timeout-API.patch b/patches.arch/s390-sles15sp1-00-08-46-s390-cio-fix-ccw_device_start_timeout-API.patch
index ea034a8b8e..79e0b44931 100644
--- a/patches.arch/s390-sles15sp1-00-08-46-s390-cio-fix-ccw_device_start_timeout-API.patch
+++ b/patches.arch/s390-sles15sp1-00-08-46-s390-cio-fix-ccw_device_start_timeout-API.patch
@@ -1,40 +1,22 @@
-From: Julian Wiedmann <jwi@linux.ibm.com>
+From: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Date: Tue, 6 Feb 2018 14:59:43 +0100
Subject: s390/cio: fix ccw_device_start_timeout API
-Patch-mainline: v4.16-rc5
Git-commit: f97a6b6c47d2f329a24f92cc0ca3c6df5727ba73
-References: FATE#326350, LTC#169511, bsc#1113509
-
-Summary: qeth: performance improvements
-Description: This adds recent functional and performance improvements for the
- qeth network driver.
- Primarily this brings Scatter-Gather support for HiperSockets,
- reduced CPU consumption in the L3 IPv4 transmit path for OSA,
- improved Promiscuous Mode performance due to IFF_UNICAST_FLT,
- support for Scatter-Gather on z/VM virtual NICs, and
- support for delayed GRO flushing.
-
- For sanity & stability reasons, this effectively constitutes a
- backport of the qeth device driver from 4.19 mainline.
-
-
-Upstream-Description:
-
- s390/cio: fix ccw_device_start_timeout API
-
- There are cases a device driver can't start IO because the device is
- currently in use by cio. In this case the device driver is notified
- when the device is usable again.
+Patch-mainline: v4.16-rc5
+References: bsc#1142109 LTC#179339
- Using ccw_device_start_timeout we would set the timeout (and change
- an existing timeout) before we test for internal usage. Worst case
- this could lead to an unexpected timer deletion.
+There are cases a device driver can't start IO because the device is
+currently in use by cio. In this case the device driver is notified
+when the device is usable again.
- Fix this by setting the timeout after we test for internal usage.
+Using ccw_device_start_timeout we would set the timeout (and change
+an existing timeout) before we test for internal usage. Worst case
+this could lead to an unexpected timer deletion.
- Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
- Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Fix this by setting the timeout after we test for internal usage.
-Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
+Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Acked-by: Petr Tesarik <ptesarik@suse.com>
---
drivers/s390/cio/device_ops.c | 72 ++++++++++++++++++------------------------
diff --git a/patches.arch/x86-microcode-fix-the-microcode-load-on-cpu-hotplug-for-real.patch b/patches.arch/x86-microcode-fix-the-microcode-load-on-cpu-hotplug-for-real.patch
new file mode 100644
index 0000000000..36d7d31b73
--- /dev/null
+++ b/patches.arch/x86-microcode-fix-the-microcode-load-on-cpu-hotplug-for-real.patch
@@ -0,0 +1,65 @@
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Tue, 18 Jun 2019 22:31:40 +0200
+Subject: x86/microcode: Fix the microcode load on CPU hotplug for real
+Git-commit: 5423f5ce5ca410b3646f355279e4e937d452e622
+Patch-mainline: v5.2-rc7
+References: bsc#1114279
+
+A recent change moved the microcode loader hotplug callback into the early
+startup phase which is running with interrupts disabled. It missed that
+the callbacks invoke sysfs functions which might sleep causing nice 'might
+sleep' splats with proper debugging enabled.
+
+Split the callbacks and only load the microcode in the early startup phase
+and move the sysfs handling back into the later threaded and preemptible
+bringup phase where it was before.
+
+Fixes: 78f4e932f776 ("x86/microcode, cpuhotplug: Add a microcode loader CPU hotplug callback")
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: stable@vger.kernel.org
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/alpine.DEB.2.21.1906182228350.1766@nanos.tec.linutronix.de
+---
+ arch/x86/kernel/cpu/microcode/core.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
+index a813987b5552..cb0fdcaf1415 100644
+--- a/arch/x86/kernel/cpu/microcode/core.c
++++ b/arch/x86/kernel/cpu/microcode/core.c
+@@ -789,13 +789,16 @@ static struct syscore_ops mc_syscore_ops = {
+ .resume = mc_bp_resume,
+ };
+
+-static int mc_cpu_online(unsigned int cpu)
++static int mc_cpu_starting(unsigned int cpu)
+ {
+- struct device *dev;
+-
+- dev = get_cpu_device(cpu);
+ microcode_update_cpu(cpu);
+ pr_debug("CPU%d added\n", cpu);
++ return 0;
++}
++
++static int mc_cpu_online(unsigned int cpu)
++{
++ struct device *dev = get_cpu_device(cpu);
+
+ if (sysfs_create_group(&dev->kobj, &mc_attr_group))
+ pr_err("Failed to create group for CPU%d\n", cpu);
+@@ -872,7 +875,9 @@ int __init microcode_init(void)
+ goto out_ucode_group;
+
+ register_syscore_ops(&mc_syscore_ops);
+- cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:online",
++ cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting",
++ mc_cpu_starting, NULL);
++ cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/microcode:online",
+ mc_cpu_online, mc_cpu_down_prep);
+
+ pr_info("Microcode Update Driver: v%s.", DRIVER_VERSION);
+
diff --git a/patches.arch/x86-mm-check-for-pfn-instead-of-page-in-vmalloc_sync_one b/patches.arch/x86-mm-check-for-pfn-instead-of-page-in-vmalloc_sync_one
new file mode 100644
index 0000000000..865721c0cc
--- /dev/null
+++ b/patches.arch/x86-mm-check-for-pfn-instead-of-page-in-vmalloc_sync_one
@@ -0,0 +1,31 @@
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 19 Jul 2019 20:46:50 +0200
+Subject: x86/mm: Check for pfn instead of page in vmalloc_sync_one()
+Git-commit: 51b75b5b563a2637f9d8dc5bd02a31b2ff9e5ea0
+Patch-mainline: v5.3-rc2
+References: bsc#1118689
+
+Do not require a struct page for the mapped memory location because it
+might not exist. This can happen when an ioremapped region is mapped with
+2MB pages.
+
+Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20190719184652.11391-2-joro@8bytes.org
+---
+ arch/x86/mm/fault.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -265,7 +265,7 @@ static inline pmd_t *vmalloc_sync_one(pg
+ if (!pmd_present(*pmd))
+ set_pmd(pmd, *pmd_k);
+ else
+- BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k));
++ BUG_ON(pmd_pfn(*pmd) != pmd_pfn(*pmd_k));
+
+ return pmd_k;
+ }
diff --git a/patches.arch/x86-mm-sync-also-unmappings-in-vmalloc_sync_all b/patches.arch/x86-mm-sync-also-unmappings-in-vmalloc_sync_all
new file mode 100644
index 0000000000..2a6f479e57
--- /dev/null
+++ b/patches.arch/x86-mm-sync-also-unmappings-in-vmalloc_sync_all
@@ -0,0 +1,61 @@
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 19 Jul 2019 20:46:51 +0200
+Subject: x86/mm: Sync also unmappings in vmalloc_sync_all()
+Git-commit: 8e998fc24de47c55b47a887f6c95ab91acd4a720
+Patch-mainline: v5.3-rc2
+References: bsc#1118689
+
+With huge-page ioremap areas the unmappings also need to be synced between
+all page-tables. Otherwise it can cause data corruption when a region is
+unmapped and later re-used.
+
+Make the vmalloc_sync_one() function ready to sync unmappings and make sure
+vmalloc_sync_all() iterates over all page-tables even when an unmapped PMD
+is found.
+
+Fixes: 5d72b4fba40ef ('x86, mm: support huge I/O mapping capability I/F')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
+Link: https://lkml.kernel.org/r/20190719184652.11391-3-joro@8bytes.org
+---
+ arch/x86/mm/fault.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -259,11 +259,12 @@ static inline pmd_t *vmalloc_sync_one(pg
+
+ pmd = pmd_offset(pud, address);
+ pmd_k = pmd_offset(pud_k, address);
+- if (!pmd_present(*pmd_k))
+- return NULL;
+
+- if (!pmd_present(*pmd))
++ if (pmd_present(*pmd) != pmd_present(*pmd_k))
+ set_pmd(pmd, *pmd_k);
++
++ if (!pmd_present(*pmd_k))
++ return NULL;
+ else
+ BUG_ON(pmd_pfn(*pmd) != pmd_pfn(*pmd_k));
+
+@@ -285,17 +286,13 @@ void vmalloc_sync_all(void)
+ spin_lock(&pgd_lock);
+ list_for_each_entry(page, &pgd_list, lru) {
+ spinlock_t *pgt_lock;
+- pmd_t *ret;
+
+ /* the pgt_lock only for Xen */
+ pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
+
+ spin_lock(pgt_lock);
+- ret = vmalloc_sync_one(page_address(page), address);
++ vmalloc_sync_one(page_address(page), address);
+ spin_unlock(pgt_lock);
+-
+- if (!ret)
+- break;
+ }
+ spin_unlock(&pgd_lock);
+ }
diff --git a/patches.drivers/ALSA-firewire-fix-a-memory-leak-bug.patch b/patches.drivers/ALSA-firewire-fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..21d2f6a3a1
--- /dev/null
+++ b/patches.drivers/ALSA-firewire-fix-a-memory-leak-bug.patch
@@ -0,0 +1,42 @@
+From 1be3c1fae6c1e1f5bb982b255d2034034454527a Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Thu, 8 Aug 2019 00:50:58 -0500
+Subject: [PATCH] ALSA: firewire: fix a memory leak bug
+Git-commit: 1be3c1fae6c1e1f5bb982b255d2034034454527a
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+In iso_packets_buffer_init(), 'b->packets' is allocated through
+kmalloc_array(). Then, the aligned packet size is checked. If it is
+larger than PAGE_SIZE, -EINVAL will be returned to indicate the error.
+However, the allocated 'b->packets' is not deallocated on this path,
+leading to a memory leak.
+
+To fix the above issue, free 'b->packets' before returning the error code.
+
+Fixes: 31ef9134eb52 ("ALSA: add LaCie FireWire Speakers/Griffin FireWave Surround driver")
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Cc: <stable@vger.kernel.org> # v2.6.39+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/packets-buffer.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/packets-buffer.c b/sound/firewire/packets-buffer.c
+index 0d35359d25cd..0ecafd0c6722 100644
+--- a/sound/firewire/packets-buffer.c
++++ b/sound/firewire/packets-buffer.c
+@@ -37,7 +37,7 @@ int iso_packets_buffer_init(struct iso_packets_buffer *b, struct fw_unit *unit,
+ packets_per_page = PAGE_SIZE / packet_size;
+ if (WARN_ON(!packets_per_page)) {
+ err = -EINVAL;
+- goto error;
++ goto err_packets;
+ }
+ pages = DIV_ROUND_UP(count, packets_per_page);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Don-t-override-global-PCM-hw-info-flag.patch b/patches.drivers/ALSA-hda-Don-t-override-global-PCM-hw-info-flag.patch
new file mode 100644
index 0000000000..7d6e7beac8
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Don-t-override-global-PCM-hw-info-flag.patch
@@ -0,0 +1,45 @@
+From c1c6c877b0c79fd7e05c931435aa42211eaeebaf Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 6 Aug 2019 14:03:56 +0200
+Subject: [PATCH] ALSA: hda - Don't override global PCM hw info flag
+Git-commit: c1c6c877b0c79fd7e05c931435aa42211eaeebaf
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+The commit bfcba288b97f ("ALSA - hda: Add support for link audio time
+reporting") introduced the conditional PCM hw info setup, but it
+overwrites the global azx_pcm_hw object. This will cause a problem if
+any other HD-audio controller, as it'll inherit the same bit flag
+although another controller doesn't support that feature.
+
+Fix the bug by setting the PCM hw info flag locally.
+
+Fixes: bfcba288b97f ("ALSA - hda: Add support for link audio time reporting")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_controller.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index c8d1b4316245..2fbdde239936 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -598,11 +598,9 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ }
+ runtime->private_data = azx_dev;
+
+- if (chip->gts_present)
+- azx_pcm_hw.info = azx_pcm_hw.info |
+- SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
+-
+ runtime->hw = azx_pcm_hw;
++ if (chip->gts_present)
++ runtime->hw.info |= SNDRV_PCM_INFO_HAS_LINK_SYNCHRONIZED_ATIME;
+ runtime->hw.channels_min = hinfo->channels_min;
+ runtime->hw.channels_max = hinfo->channels_max;
+ runtime->hw.formats = hinfo->formats;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Workaround-for-crackled-sound-on-AMD-contro.patch b/patches.drivers/ALSA-hda-Workaround-for-crackled-sound-on-AMD-contro.patch
new file mode 100644
index 0000000000..6bc0a85827
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Workaround-for-crackled-sound-on-AMD-contro.patch
@@ -0,0 +1,209 @@
+From c02f77d32d2c45cfb1b2bb99eabd8a78f5ecc7db Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 6 Aug 2019 17:31:48 +0200
+Subject: [PATCH] ALSA: hda - Workaround for crackled sound on AMD controller (1022:1457)
+Git-commit: c02f77d32d2c45cfb1b2bb99eabd8a78f5ecc7db
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+A long-time problem on the recent AMD chip (X370, X470, B450, etc with
+PCI ID 1022:1457) with Realtek codecs is the crackled or distorted
+sound for capture streams, as well as occasional playback hiccups.
+After lengthy debugging sessions, the workarounds we've found are like
+the following:
+
+- Set up the proper driver caps for this controller, similar as the
+ other AMD controller.
+
+- Correct the DMA position reporting with the fixed FIFO size, which
+ is similar like as workaround used for VIA chip set.
+
+- Even after the position correction, PulseAudio still shows
+ mysterious stalls of playback streams when a capture is triggered in
+ timer-scheduled mode. Since we have no clear way to eliminate the
+ stall, pass the BATCH PCM flag for PA to suppress the tsched mode as
+ a temporary workaround.
+
+This patch implements the workarounds. For the driver caps, it
+defines a new preset, AXZ_DCAPS_PRESET_AMD_SB. It enables the FIFO-
+corrected position reporting (corresponding to the new position_fix=6)
+and enforces the SNDRV_PCM_INFO_BATCH flag.
+
+Note that the current implementation is merely a workaround.
+Hopefully we'll find a better alternative in future, especially about
+removing the BATCH flag hack again.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=195303
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_controller.c | 7 +++++
+ sound/pci/hda/hda_controller.h | 2 +-
+ sound/pci/hda/hda_intel.c | 63 +++++++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 70 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
+index 2fbdde239936..48d863736b3c 100644
+--- a/sound/pci/hda/hda_controller.c
++++ b/sound/pci/hda/hda_controller.c
+@@ -613,6 +613,13 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
+ 20,
+ 178000000);
+
++ /* by some reason, the playback stream stalls on PulseAudio with
++ * tsched=1 when a capture stream triggers. Until we figure out the
++ * real cause, disable tsched mode by telling the PCM info flag.
++ */
++ if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND)
++ runtime->hw.info |= SNDRV_PCM_INFO_BATCH;
++
+ if (chip->align_buffer_size)
+ /* constrain buffer sizes to be multiple of 128
+ bytes. This is more efficient in terms of memory
+diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
+index baa15374fbcb..f2a6df5e6bcb 100644
+--- a/sound/pci/hda/hda_controller.h
++++ b/sound/pci/hda/hda_controller.h
+@@ -31,7 +31,7 @@
+ /* 14 unused */
+ #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */
+ #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */
+-/* 17 unused */
++#define AZX_DCAPS_AMD_WORKAROUND (1 << 17) /* AMD-specific workaround */
+ #define AZX_DCAPS_NO_64BIT (1 << 18) /* No 64bit address */
+ #define AZX_DCAPS_SYNC_WRITE (1 << 19) /* sync each cmd write */
+ #define AZX_DCAPS_OLD_SSYNC (1 << 20) /* Old SSYNC reg for ICH */
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 1e14d7270adf..a6d8c0d77b84 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -64,6 +64,7 @@ enum {
+ POS_FIX_VIACOMBO,
+ POS_FIX_COMBO,
+ POS_FIX_SKL,
++ POS_FIX_FIFO,
+ };
+
+ /* Defines for ATI HD Audio support in SB450 south bridge */
+@@ -135,7 +136,7 @@ module_param_array(model, charp, NULL, 0444);
+ MODULE_PARM_DESC(model, "Use the given board model.");
+ module_param_array(position_fix, int, NULL, 0444);
+ MODULE_PARM_DESC(position_fix, "DMA pointer read method."
+- "(-1 = system default, 0 = auto, 1 = LPIB, 2 = POSBUF, 3 = VIACOMBO, 4 = COMBO, 5 = SKL+).");
++ "(-1 = system default, 0 = auto, 1 = LPIB, 2 = POSBUF, 3 = VIACOMBO, 4 = COMBO, 5 = SKL+, 6 = FIFO).");
+ module_param_array(bdl_pos_adj, int, NULL, 0644);
+ MODULE_PARM_DESC(bdl_pos_adj, "BDL position adjustment offset.");
+ module_param_array(probe_mask, int, NULL, 0444);
+@@ -332,6 +333,11 @@ enum {
+ #define AZX_DCAPS_PRESET_ATI_HDMI_NS \
+ (AZX_DCAPS_PRESET_ATI_HDMI | AZX_DCAPS_SNOOP_OFF)
+
++/* quirks for AMD SB */
++#define AZX_DCAPS_PRESET_AMD_SB \
++ (AZX_DCAPS_NO_TCSEL | AZX_DCAPS_SYNC_WRITE | AZX_DCAPS_AMD_WORKAROUND |\
++ AZX_DCAPS_SNOOP_TYPE(ATI) | AZX_DCAPS_PM_RUNTIME)
++
+ /* quirks for Nvidia */
+ #define AZX_DCAPS_PRESET_NVIDIA \
+ (AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\
+@@ -841,6 +847,49 @@ static unsigned int azx_via_get_position(struct azx *chip,
+ return bound_pos + mod_dma_pos;
+ }
+
++#define AMD_FIFO_SIZE 32
++
++/* get the current DMA position with FIFO size correction */
++static unsigned int azx_get_pos_fifo(struct azx *chip, struct azx_dev *azx_dev)
++{
++ struct snd_pcm_substream *substream = azx_dev->core.substream;
++ struct snd_pcm_runtime *runtime = substream->runtime;
++ unsigned int pos, delay;
++
++ pos = snd_hdac_stream_get_pos_lpib(azx_stream(azx_dev));
++ if (!runtime)
++ return pos;
++
++ runtime->delay = AMD_FIFO_SIZE;
++ delay = frames_to_bytes(runtime, AMD_FIFO_SIZE);
++ if (azx_dev->insufficient) {
++ if (pos < delay) {
++ delay = pos;
++ runtime->delay = bytes_to_frames(runtime, pos);
++ } else {
++ azx_dev->insufficient = 0;
++ }
++ }
++
++ /* correct the DMA position for capture stream */
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) {
++ if (pos < delay)
++ pos += azx_dev->core.bufsize;
++ pos -= delay;
++ }
++
++ return pos;
++}
++
++static int azx_get_delay_from_fifo(struct azx *chip, struct azx_dev *azx_dev,
++ unsigned int pos)
++{
++ struct snd_pcm_substream *substream = azx_dev->core.substream;
++
++ /* just read back the calculated value in the above */
++ return substream->runtime->delay;
++}
++
+ static unsigned int azx_skl_get_dpib_pos(struct azx *chip,
+ struct azx_dev *azx_dev)
+ {
+@@ -1417,6 +1466,7 @@ static int check_position_fix(struct azx *chip, int fix)
+ case POS_FIX_VIACOMBO:
+ case POS_FIX_COMBO:
+ case POS_FIX_SKL:
++ case POS_FIX_FIFO:
+ return fix;
+ }
+
+@@ -1433,6 +1483,10 @@ static int check_position_fix(struct azx *chip, int fix)
+ dev_dbg(chip->card->dev, "Using VIACOMBO position fix\n");
+ return POS_FIX_VIACOMBO;
+ }
++ if (chip->driver_caps & AZX_DCAPS_AMD_WORKAROUND) {
++ dev_dbg(chip->card->dev, "Using FIFO position fix\n");
++ return POS_FIX_FIFO;
++ }
+ if (chip->driver_caps & AZX_DCAPS_POSFIX_LPIB) {
+ dev_dbg(chip->card->dev, "Using LPIB position fix\n");
+ return POS_FIX_LPIB;
+@@ -1453,6 +1507,7 @@ static void assign_position_fix(struct azx *chip, int fix)
+ [POS_FIX_VIACOMBO] = azx_via_get_position,
+ [POS_FIX_COMBO] = azx_get_pos_lpib,
+ [POS_FIX_SKL] = azx_get_pos_skl,
++ [POS_FIX_FIFO] = azx_get_pos_fifo,
+ };
+
+ chip->get_position[0] = chip->get_position[1] = callbacks[fix];
+@@ -1467,6 +1522,9 @@ static void assign_position_fix(struct azx *chip, int fix)
+ azx_get_delay_from_lpib;
+ }
+
++ if (fix == POS_FIX_FIFO)
++ chip->get_delay[0] = chip->get_delay[1] =
++ azx_get_delay_from_fifo;
+ }
+
+ /*
+@@ -2447,6 +2505,9 @@ static const struct pci_device_id azx_ids[] = {
+ /* AMD Hudson */
+ { PCI_DEVICE(0x1022, 0x780d),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++ /* AMD, X370 & co */
++ { PCI_DEVICE(0x1022, 0x1457),
++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_AMD_SB },
+ /* AMD Stoney */
+ { PCI_DEVICE(0x1022, 0x157a),
+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hiface-fix-multiple-memory-leak-bugs.patch b/patches.drivers/ALSA-hiface-fix-multiple-memory-leak-bugs.patch
new file mode 100644
index 0000000000..efe5dd5d46
--- /dev/null
+++ b/patches.drivers/ALSA-hiface-fix-multiple-memory-leak-bugs.patch
@@ -0,0 +1,61 @@
+From 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Wed, 7 Aug 2019 04:08:51 -0500
+Subject: [PATCH] ALSA: hiface: fix multiple memory leak bugs
+Git-commit: 3d92aa45fbfd7319e3a19f4ec59fd32b3862b723
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+In hiface_pcm_init(), 'rt' is firstly allocated through kzalloc(). Later
+on, hiface_pcm_init_urb() is invoked to initialize 'rt->out_urbs[i]'. In
+hiface_pcm_init_urb(), 'rt->out_urbs[i].buffer' is allocated through
+kzalloc(). However, if hiface_pcm_init_urb() fails, both 'rt' and
+'rt->out_urbs[i].buffer' are not deallocated, leading to memory leak bugs.
+Also, 'rt->out_urbs[i].buffer' is not deallocated if snd_pcm_new() fails.
+
+To fix the above issues, free 'rt' and 'rt->out_urbs[i].buffer'.
+
+Fixes: a91c3fb2f842 ("Add M2Tech hiFace USB-SPDIF driver")
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/hiface/pcm.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/sound/usb/hiface/pcm.c b/sound/usb/hiface/pcm.c
+index 14fc1e1d5d13..c406497c5919 100644
+--- a/sound/usb/hiface/pcm.c
++++ b/sound/usb/hiface/pcm.c
+@@ -600,14 +600,13 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
+ ret = hiface_pcm_init_urb(&rt->out_urbs[i], chip, OUT_EP,
+ hiface_pcm_out_urb_handler);
+ if (ret < 0)
+- return ret;
++ goto error;
+ }
+
+ ret = snd_pcm_new(chip->card, "USB-SPDIF Audio", 0, 1, 0, &pcm);
+ if (ret < 0) {
+- kfree(rt);
+ dev_err(&chip->dev->dev, "Cannot create pcm instance\n");
+- return ret;
++ goto error;
+ }
+
+ pcm->private_data = rt;
+@@ -620,4 +619,10 @@ int hiface_pcm_init(struct hiface_chip *chip, u8 extra_freq)
+
+ chip->pcm = rt;
+ return 0;
++
++error:
++ for (i = 0; i < PCM_N_URBS; i++)
++ kfree(rt->out_urbs[i].buffer);
++ kfree(rt);
++ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-dapm-Fix-handling-of-custom_stop_condition-on-D.patch b/patches.drivers/ASoC-dapm-Fix-handling-of-custom_stop_condition-on-D.patch
new file mode 100644
index 0000000000..6ac3d8e931
--- /dev/null
+++ b/patches.drivers/ASoC-dapm-Fix-handling-of-custom_stop_condition-on-D.patch
@@ -0,0 +1,78 @@
+From 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77 Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Thu, 18 Jul 2019 09:43:33 +0100
+Subject: [PATCH] ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks
+Git-commit: 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+DPCM uses snd_soc_dapm_dai_get_connected_widgets to build a
+list of the widgets connected to a specific front end DAI so it
+can search through this list for available back end DAIs. The
+custom_stop_condition was added to is_connected_ep to facilitate this
+list not containing more widgets than is necessary. Doing so both
+speeds up the DPCM handling as less widgets need to be searched and
+avoids issues with CODEC to CODEC links as these would be confused
+with back end DAIs if they appeared in the list of available widgets.
+
+custom_stop_condition was implemented by aborting the graph walk
+when the condition is triggered, however there is an issue with this
+approach. Whilst walking the graph is_connected_ep should update the
+endpoints cache on each widget, if the walk is aborted the number
+of attached end points is unknown for that sub-graph. When the stop
+condition triggered, the original patch ignored the triggering widget
+and returned zero connected end points; a later patch updated this
+to set the triggering widget's cache to 1 and return that. Both of
+these approaches result in inaccurate values being stored in various
+end point caches as the values propagate back through the graph,
+which can result in later issues with widgets powering/not powering
+unexpectedly.
+
+As the original goal was to reduce the size of the widget list passed
+to the DPCM code, the simplest solution is to limit the functionality
+of the custom_stop_condition to the widget list. This means the rest
+of the graph will still be processed resulting in correct end point
+caches, but only widgets up to the stop condition will be added to the
+returned widget list.
+
+Fixes: 6742064aef7f ("ASoC: dapm: support user-defined stop condition in dai_get_connected_widgets")
+Fixes: 5fdd022c2026 ("ASoC: dpcm: play nice with CODEC<->CODEC links")
+Fixes: 09464974eaa8 ("ASoC: dapm: Fix to return correct path list in is_connected_ep.")
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/20190718084333.15598-1-ckeepax@opensource.cirrus.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-dapm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 6b44b4a78b8e..9cd87e47ee8f 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -1157,8 +1157,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ list_add_tail(&widget->work_list, list);
+
+ if (custom_stop_condition && custom_stop_condition(widget, dir)) {
+- widget->endpoints[dir] = 1;
+- return widget->endpoints[dir];
++ list = NULL;
++ custom_stop_condition = NULL;
+ }
+
+ if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) {
+@@ -1195,8 +1195,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget,
+ *
+ * Optionally, can be supplied with a function acting as a stopping condition.
+ * This function takes the dapm widget currently being examined and the walk
+- * direction as an arguments, it should return true if the walk should be
+- * stopped and false otherwise.
++ * direction as an arguments, it should return true if widgets from that point
++ * in the graph onwards should not be added to the widget list.
+ */
+ static int is_connected_output_ep(struct snd_soc_dapm_widget *widget,
+ struct list_head *list,
+--
+2.16.4
+
diff --git a/patches.drivers/HID-Add-quirk-for-HP-X1200-PIXART-OEM-mouse.patch b/patches.drivers/HID-Add-quirk-for-HP-X1200-PIXART-OEM-mouse.patch
new file mode 100644
index 0000000000..5c4535dbef
--- /dev/null
+++ b/patches.drivers/HID-Add-quirk-for-HP-X1200-PIXART-OEM-mouse.patch
@@ -0,0 +1,45 @@
+From 49869d2ea9eecc105a10724c1abf035151a3c4e2 Mon Sep 17 00:00:00 2001
+From: Sebastian Parschauer <s.parschauer@gmx.de>
+Date: Wed, 24 Jul 2019 20:40:03 +0200
+Subject: [PATCH] HID: Add quirk for HP X1200 PIXART OEM mouse
+Git-commit: 49869d2ea9eecc105a10724c1abf035151a3c4e2
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+The PixArt OEM mice are known for disconnecting every minute in
+runlevel 1 or 3 if they are not always polled. So add quirk
+ALWAYS_POLL for this one as well.
+
+Jonathan Teh (@jonathan-teh) reported and tested the quirk.
+Reference: https://github.com/sriemer/fix-linux-mouse/issues/15
+
+Signed-off-by: Sebastian Parschauer <s.parschauer@gmx.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hid/hid-ids.h | 1 +
+ drivers/hid/usbhid/hid-quirks.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -529,6 +529,7 @@
+ #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
+ #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a
++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641
+
+ #define USB_VENDOR_ID_HUION 0x256c
+ #define USB_DEVICE_ID_HUION_TABLET 0x006e
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -100,6 +100,7 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A, HID_QUIRK_ALWAYS_POLL },
++ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL },
diff --git a/patches.drivers/IB-mlx5-Fix-MR-registration-flow-to-use-UMR-properly.patch b/patches.drivers/IB-mlx5-Fix-MR-registration-flow-to-use-UMR-properly.patch
new file mode 100644
index 0000000000..490eba7e45
--- /dev/null
+++ b/patches.drivers/IB-mlx5-Fix-MR-registration-flow-to-use-UMR-properly.patch
@@ -0,0 +1,103 @@
+From: Guy Levi <guyle@mellanox.com>
+Date: Wed, 31 Jul 2019 11:19:29 +0300
+Subject: IB/mlx5: Fix MR registration flow to use UMR properly
+Patch-mainline: v5.3-rc3
+Git-commit: e5366d309a772fef264ec85e858f9ea46f939848
+References: bsc#1093205 bsc#1145678
+
+Driver shouldn't allow to use UMR to register a MR when
+umr_modify_atomic_disabled is set. Otherwise it will always end up with a
+failure in the post send flow which sets the UMR WQE to modify atomic access
+right.
+
+Fixes: c8d75a980fab ("IB/mlx5: Respect new UMR capabilities")
+Signed-off-by: Guy Levi <guyle@mellanox.com>
+Reviewed-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Link: https://lore.kernel.org/r/20190731081929.32559-1-leon@kernel.org
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 27 +++++++++------------------
+ 1 file changed, 9 insertions(+), 18 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -51,22 +51,12 @@ static int clean_mr(struct mlx5_ib_dev *
+ static void dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+ static int mr_cache_max_order(struct mlx5_ib_dev *dev);
+ static int unreg_umr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr);
+-static bool umr_can_modify_entity_size(struct mlx5_ib_dev *dev)
+-{
+- return !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled);
+-}
+
+ static bool umr_can_use_indirect_mkey(struct mlx5_ib_dev *dev)
+ {
+ return !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled);
+ }
+
+-static bool use_umr(struct mlx5_ib_dev *dev, int order)
+-{
+- return order <= mr_cache_max_order(dev) &&
+- umr_can_modify_entity_size(dev);
+-}
+-
+ static int destroy_mkey(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr)
+ {
+ int err = mlx5_core_destroy_mkey(dev->mdev, &mr->mmkey);
+@@ -1211,7 +1201,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct
+ {
+ struct mlx5_ib_dev *dev = to_mdev(pd->device);
+ struct mlx5_ib_mr *mr = NULL;
+- bool populate_mtts = false;
++ bool use_umr;
+ struct ib_umem *umem;
+ int page_shift;
+ int npages;
+@@ -1244,29 +1234,30 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct
+ if (err < 0)
+ return ERR_PTR(err);
+
+- if (use_umr(dev, order)) {
++ use_umr = !MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled) &&
++ (!MLX5_CAP_GEN(dev->mdev, umr_modify_atomic_disabled) ||
++ !MLX5_CAP_GEN(dev->mdev, atomic));
++
++ if (order <= mr_cache_max_order(dev) && use_umr) {
+ mr = alloc_mr_from_cache(pd, umem, virt_addr, length, ncont,
+ page_shift, order, access_flags);
+ if (PTR_ERR(mr) == -EAGAIN) {
+ mlx5_ib_dbg(dev, "cache empty for order %d\n", order);
+ mr = NULL;
+ }
+- populate_mtts = false;
+ } else if (!MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset)) {
+ if (access_flags & IB_ACCESS_ON_DEMAND) {
+ err = -EINVAL;
+ pr_err("Got MR registration for ODP MR > 512MB, not supported for Connect-IB\n");
+ goto error;
+ }
+- populate_mtts = true;
++ use_umr = false;
+ }
+
+ if (!mr) {
+- if (!umr_can_modify_entity_size(dev))
+- populate_mtts = true;
+ mutex_lock(&dev->slow_path_mutex);
+ mr = reg_create(NULL, pd, virt_addr, length, umem, ncont,
+- page_shift, access_flags, populate_mtts);
++ page_shift, access_flags, !use_umr);
+ mutex_unlock(&dev->slow_path_mutex);
+ }
+
+@@ -1284,7 +1275,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct
+ update_odp_mr(mr);
+ #endif
+
+- if (!populate_mtts) {
++ if (use_umr) {
+ int update_xlt_flags = MLX5_IB_UPD_XLT_ENABLE;
+
+ if (access_flags & IB_ACCESS_ON_DEMAND)
diff --git a/patches.drivers/PCI-Restore-Resizable-BAR-size-bits-correctly-for-1M.patch b/patches.drivers/PCI-Restore-Resizable-BAR-size-bits-correctly-for-1M.patch
new file mode 100644
index 0000000000..4255967a75
--- /dev/null
+++ b/patches.drivers/PCI-Restore-Resizable-BAR-size-bits-correctly-for-1M.patch
@@ -0,0 +1,58 @@
+From e0d3b85ea196092e97817b431ff17880652c993e Mon Sep 17 00:00:00 2001
+From: Sumit Saxena <sumit.saxena@broadcom.com>
+Date: Fri, 26 Jul 2019 00:55:52 +0530
+Subject: [PATCH] PCI: Restore Resizable BAR size bits correctly for 1MB BARs
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: e0d3b85ea196092e97817b431ff17880652c993e
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci.git
+Patch-mainline: Queued in subsystem maintainer repository
+References: bsc#1143841
+
+In a Resizable BAR Control Register, bits 13:8 control the size of the BAR.
+The encoded values of these bits are as follows (see PCIe r5.0, sec
+7.8.6.3):
+
+ Value BAR size
+ 0 1 MB (2^20 bytes)
+ 1 2 MB (2^21 bytes)
+ 2 4 MB (2^22 bytes)
+ ...
+ 43 8 EB (2^63 bytes)
+
+Previously we incorrectly set the BAR size bits for a 1 MB BAR to 0x1f
+instead of 0, so devices that support that size, e.g., new megaraid_sas and
+mpt3sas adapters, fail to initialize during resume from S3 sleep.
+
+Correctly calculate the BAR size bits for Resizable BAR control registers.
+
+Link: https://lore.kernel.org/r/20190725192552.24295-1-sumit.saxena@broadcom.com
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203939
+Fixes: d3252ace0bc6 ("PCI: Restore resized BAR state on resume")
+Signed-off-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pci.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index da3241bb4479..5836eb576d96 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -1438,7 +1438,7 @@ static void pci_restore_rebar_state(struct pci_dev *pdev)
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CTRL, &ctrl);
+ bar_idx = ctrl & PCI_REBAR_CTRL_BAR_IDX;
+ res = pdev->resource + bar_idx;
+- size = order_base_2((resource_size(res) >> 20) | 1) - 1;
++ size = ilog2(resource_size(res)) - 20;
+ ctrl &= ~PCI_REBAR_CTRL_BAR_SIZE;
+ ctrl |= size << PCI_REBAR_CTRL_BAR_SHIFT;
+ pci_write_config_dword(pdev, pos + PCI_REBAR_CTRL, ctrl);
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch b/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch
index d37b73ff19..cb4e2084c0 100644
--- a/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch
+++ b/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch
@@ -4,7 +4,7 @@ Subject: Revert "net: ena: ethtool: add extra properties retrieval via
get_priv_flags"
Patch-mainline: v5.3-rc1
Git-commit: eb203bae834efc6aff05da49f61edda0f3bc3e01
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
This reverts commit 315c28d2b714 ("net: ena: ethtool: add extra properties retrieval via get_priv_flags").
@@ -322,7 +322,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
void ena_set_ethtool_ops(struct net_device *netdev)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -2474,14 +2474,6 @@ err:
+@@ -2473,14 +2473,6 @@ err:
ena_com_delete_debug_area(adapter->ena_dev);
}
@@ -337,7 +337,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static void ena_get_stats64(struct net_device *netdev,
struct rtnl_link_stats64 *stats)
{
-@@ -3580,9 +3572,6 @@ static int ena_probe(struct pci_dev *pde
+@@ -3579,9 +3571,6 @@ static int ena_probe(struct pci_dev *pde
ena_config_debug_area(adapter);
@@ -347,7 +347,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
memcpy(adapter->netdev->perm_addr, adapter->mac_addr, netdev->addr_len);
netif_carrier_off(netdev);
-@@ -3623,7 +3612,6 @@ static int ena_probe(struct pci_dev *pde
+@@ -3622,7 +3611,6 @@ static int ena_probe(struct pci_dev *pde
return 0;
err_rss:
@@ -355,7 +355,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
ena_com_delete_debug_area(ena_dev);
ena_com_rss_destroy(ena_dev);
err_free_msix:
-@@ -3716,8 +3704,6 @@ static void ena_remove(struct pci_dev *p
+@@ -3715,8 +3703,6 @@ static void ena_remove(struct pci_dev *p
ena_com_delete_host_info(ena_dev);
diff --git a/patches.drivers/gpio-gpio-omap-add-check-for-off-wake-capable-gpios.patch b/patches.drivers/gpio-gpio-omap-add-check-for-off-wake-capable-gpios.patch
new file mode 100644
index 0000000000..d486d73b80
--- /dev/null
+++ b/patches.drivers/gpio-gpio-omap-add-check-for-off-wake-capable-gpios.patch
@@ -0,0 +1,84 @@
+From da38ef3ed10a09248e13ae16530c2c6d448dc47d Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Mon, 25 Mar 2019 15:43:18 -0700
+Subject: [PATCH] gpio: gpio-omap: add check for off wake capable gpios
+Git-commit: da38ef3ed10a09248e13ae16530c2c6d448dc47d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We are currently assuming all GPIOs are non-wakeup capable GPIOs as we
+not configuring the bank->non_wakeup_gpios like we used to earlier with
+platform_data.
+
+Let's add omap_gpio_is_off_wakeup_capable() to make the handling clearer
+while considering that later patches may want to configure SoC specific
+bank->non_wakeup_gpios for the GPIOs in wakeup domain.
+
+Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: Keerthy <j-keerthy@ti.com>
+Cc: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Cc: Russell King <rmk+kernel@armlinux.org.uk>
+Cc: Tero Kristo <t-kristo@ti.com>
+Reported-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-omap.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
+index a28196453029..4d1bf884fcbc 100644
+--- a/drivers/gpio/gpio-omap.c
++++ b/drivers/gpio/gpio-omap.c
+@@ -352,6 +352,22 @@ static void omap_clear_gpio_debounce(struct gpio_bank *bank, unsigned offset)
+ }
+ }
+
++/*
++ * Off mode wake-up capable GPIOs in bank(s) that are in the wakeup domain.
++ * See TRM section for GPIO for "Wake-Up Generation" for the list of GPIOs
++ * in wakeup domain. If bank->non_wakeup_gpios is not configured, assume none
++ * are capable waking up the system from off mode.
++ */
++static bool omap_gpio_is_off_wakeup_capable(struct gpio_bank *bank, u32 gpio_mask)
++{
++ u32 no_wake = bank->non_wakeup_gpios;
++
++ if (no_wake)
++ return !!(~no_wake & gpio_mask);
++
++ return false;
++}
++
+ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio,
+ unsigned trigger)
+ {
+@@ -383,13 +399,7 @@ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio,
+ }
+
+ /* This part needs to be executed always for OMAP{34xx, 44xx} */
+- if (!bank->regs->irqctrl) {
+- /* On omap24xx proceed only when valid GPIO bit is set */
+- if (bank->non_wakeup_gpios) {
+- if (!(bank->non_wakeup_gpios & gpio_bit))
+- goto exit;
+- }
+-
++ if (!bank->regs->irqctrl && !omap_gpio_is_off_wakeup_capable(bank, gpio)) {
+ /*
+ * Log the edge gpio and manually trigger the IRQ
+ * after resume if the input level changes
+@@ -402,7 +412,6 @@ static inline void omap_set_gpio_trigger(struct gpio_bank *bank, int gpio,
+ bank->enabled_non_wakeup_gpios &= ~gpio_bit;
+ }
+
+-exit:
+ bank->level_mask =
+ readl_relaxed(bank->base + bank->regs->leveldetect0) |
+ readl_relaxed(bank->base + bank->regs->leveldetect1);
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-nct7802-Fix-wrong-detection-of-in4-presence.patch b/patches.drivers/hwmon-nct7802-Fix-wrong-detection-of-in4-presence.patch
new file mode 100644
index 0000000000..559f22b779
--- /dev/null
+++ b/patches.drivers/hwmon-nct7802-Fix-wrong-detection-of-in4-presence.patch
@@ -0,0 +1,60 @@
+From 38ada2f406a9b81fb1249c5c9227fa657e7d5671 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Fri, 26 Jul 2019 08:00:49 -0700
+Subject: [PATCH] hwmon: (nct7802) Fix wrong detection of in4 presence
+Git-commit: 38ada2f406a9b81fb1249c5c9227fa657e7d5671
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+The code to detect if in4 is present is wrong; if in4 is not present,
+the in4_input sysfs attribute is still present.
+
+In detail:
+
+- Ihen RTD3_MD=11 (VSEN3 present), everything is as expected (no bug).
+- If we have RTD3_MD!=11 (no VSEN3), we unexpectedly have a in4_input
+ file under /sys and the "sensors" command displays in4_input.
+ But as expected, we have no in4_min, in4_max, in4_alarm, in4_beep.
+
+Fix is_visible function to detect and report in4_input visibility
+as expected.
+
+Reported-by: Gilles Buloz <Gilles.Buloz@kontron.com>
+Cc: Gilles Buloz <Gilles.Buloz@kontron.com>
+Cc: stable@vger.kernel.org
+Fixes: 3434f37835804 ("hwmon: Driver for Nuvoton NCT7802Y")
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwmon/nct7802.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index ec7bcf8d7cd6..f3dd2a17bd42 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -704,7 +704,7 @@ static struct attribute *nct7802_in_attrs[] = {
+ &sensor_dev_attr_in3_alarm.dev_attr.attr,
+ &sensor_dev_attr_in3_beep.dev_attr.attr,
+
+- &sensor_dev_attr_in4_input.dev_attr.attr, /* 17 */
++ &sensor_dev_attr_in4_input.dev_attr.attr, /* 16 */
+ &sensor_dev_attr_in4_min.dev_attr.attr,
+ &sensor_dev_attr_in4_max.dev_attr.attr,
+ &sensor_dev_attr_in4_alarm.dev_attr.attr,
+@@ -730,9 +730,9 @@ static umode_t nct7802_in_is_visible(struct kobject *kobj,
+
+ if (index >= 6 && index < 11 && (reg & 0x03) != 0x03) /* VSEN1 */
+ return 0;
+- if (index >= 11 && index < 17 && (reg & 0x0c) != 0x0c) /* VSEN2 */
++ if (index >= 11 && index < 16 && (reg & 0x0c) != 0x0c) /* VSEN2 */
+ return 0;
+- if (index >= 17 && (reg & 0x30) != 0x30) /* VSEN3 */
++ if (index >= 16 && (reg & 0x30) != 0x30) /* VSEN3 */
+ return 0;
+
+ return attr->mode;
+--
+2.16.4
+
diff --git a/patches.drivers/iommu-amd-add-support-for-x2apic-iommu-interrupts b/patches.drivers/iommu-amd-add-support-for-x2apic-iommu-interrupts
new file mode 100644
index 0000000000..4cf69d9b89
--- /dev/null
+++ b/patches.drivers/iommu-amd-add-support-for-x2apic-iommu-interrupts
@@ -0,0 +1,168 @@
+From: "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@amd.com>
+Date: Tue, 16 Jul 2019 04:29:16 +0000
+Subject: iommu/amd: Add support for X2APIC IOMMU interrupts
+Git-commit: 66929812955bbec808c94d7a3916f41638a98a0a
+Patch-mainline: v5.3-rc2
+References: bsc#1145010
+
+AMD IOMMU requires IntCapXT registers to be setup in order to generate
+its own interrupts (for Event Log, PPR Log, and GA Log) with 32-bit
+APIC destination ID. Without this support, AMD IOMMU MSI interrupts
+will not be routed correctly when booting the system in X2APIC mode.
+
+Cc: Joerg Roedel <joro@8bytes.org>
+Fixes: 90fcffd9cf5e ('iommu/amd: Add support for IOMMU XT mode')
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu_init.c | 90 +++++++++++++++++++++++++++++++++++++++++
+ drivers/iommu/amd_iommu_types.h | 9 +++++
+ 2 files changed, 99 insertions(+)
+
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -32,6 +32,8 @@
+ #include <linux/mem_encrypt.h>
+ #include <asm/pci-direct.h>
+ #include <asm/iommu.h>
++#include <asm/apic.h>
++#include <asm/msidef.h>
+ #include <asm/gart.h>
+ #include <asm/x86_init.h>
+ #include <asm/iommu_table.h>
+@@ -1925,6 +1927,90 @@ static int iommu_setup_msi(struct amd_io
+ return 0;
+ }
+
++#define XT_INT_DEST_MODE(x) (((x) & 0x1ULL) << 2)
++#define XT_INT_DEST_LO(x) (((x) & 0xFFFFFFULL) << 8)
++#define XT_INT_VEC(x) (((x) & 0xFFULL) << 32)
++#define XT_INT_DEST_HI(x) ((((x) >> 24) & 0xFFULL) << 56)
++
++/**
++ * Setup the IntCapXT registers with interrupt routing information
++ * based on the PCI MSI capability block registers, accessed via
++ * MMIO MSI address low/hi and MSI data registers.
++ */
++static void iommu_update_intcapxt(struct amd_iommu *iommu)
++{
++ u64 val;
++ u32 addr_lo = readl(iommu->mmio_base + MMIO_MSI_ADDR_LO_OFFSET);
++ u32 addr_hi = readl(iommu->mmio_base + MMIO_MSI_ADDR_HI_OFFSET);
++ u32 data = readl(iommu->mmio_base + MMIO_MSI_DATA_OFFSET);
++ bool dm = (addr_lo >> MSI_ADDR_DEST_MODE_SHIFT) & 0x1;
++ u32 dest = ((addr_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xFF);
++
++ if (x2apic_enabled())
++ dest |= MSI_ADDR_EXT_DEST_ID(addr_hi);
++
++ val = XT_INT_VEC(data & 0xFF) |
++ XT_INT_DEST_MODE(dm) |
++ XT_INT_DEST_LO(dest) |
++ XT_INT_DEST_HI(dest);
++
++ /**
++ * Current IOMMU implemtation uses the same IRQ for all
++ * 3 IOMMU interrupts.
++ */
++ writeq(val, iommu->mmio_base + MMIO_INTCAPXT_EVT_OFFSET);
++ writeq(val, iommu->mmio_base + MMIO_INTCAPXT_PPR_OFFSET);
++ writeq(val, iommu->mmio_base + MMIO_INTCAPXT_GALOG_OFFSET);
++}
++
++static void _irq_notifier_notify(struct irq_affinity_notify *notify,
++ const cpumask_t *mask)
++{
++ struct amd_iommu *iommu;
++
++ for_each_iommu(iommu) {
++ if (iommu->dev->irq == notify->irq) {
++ iommu_update_intcapxt(iommu);
++ break;
++ }
++ }
++}
++
++static void _irq_notifier_release(struct kref *ref)
++{
++}
++
++static int iommu_init_intcapxt(struct amd_iommu *iommu)
++{
++ int ret;
++ struct irq_affinity_notify *notify = &iommu->intcapxt_notify;
++
++ /**
++ * IntCapXT requires XTSup=1, which can be inferred
++ * amd_iommu_xt_mode.
++ */
++ if (amd_iommu_xt_mode != IRQ_REMAP_X2APIC_MODE)
++ return 0;
++
++ /**
++ * Also, we need to setup notifier to update the IntCapXT registers
++ * whenever the irq affinity is changed from user-space.
++ */
++ notify->irq = iommu->dev->irq;
++ notify->notify = _irq_notifier_notify,
++ notify->release = _irq_notifier_release,
++ ret = irq_set_affinity_notifier(iommu->dev->irq, notify);
++ if (ret) {
++ pr_err("Failed to register irq affinity notifier (devid=%#x, irq %d)\n",
++ iommu->devid, iommu->dev->irq);
++ return ret;
++ }
++
++ iommu_update_intcapxt(iommu);
++ iommu_feature_enable(iommu, CONTROL_INTCAPXT_EN);
++ return ret;
++}
++
+ static int iommu_init_msi(struct amd_iommu *iommu)
+ {
+ int ret;
+@@ -1941,6 +2027,10 @@ static int iommu_init_msi(struct amd_iom
+ return ret;
+
+ enable_faults:
++ ret = iommu_init_intcapxt(iommu);
++ if (ret)
++ return ret;
++
+ iommu_feature_enable(iommu, CONTROL_EVT_INT_EN);
+
+ if (iommu->ppr_log != NULL)
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -72,6 +72,12 @@
+ #define MMIO_PPR_LOG_OFFSET 0x0038
+ #define MMIO_GA_LOG_BASE_OFFSET 0x00e0
+ #define MMIO_GA_LOG_TAIL_OFFSET 0x00e8
++#define MMIO_MSI_ADDR_LO_OFFSET 0x015C
++#define MMIO_MSI_ADDR_HI_OFFSET 0x0160
++#define MMIO_MSI_DATA_OFFSET 0x0164
++#define MMIO_INTCAPXT_EVT_OFFSET 0x0170
++#define MMIO_INTCAPXT_PPR_OFFSET 0x0178
++#define MMIO_INTCAPXT_GALOG_OFFSET 0x0180
+ #define MMIO_CMD_HEAD_OFFSET 0x2000
+ #define MMIO_CMD_TAIL_OFFSET 0x2008
+ #define MMIO_EVT_HEAD_OFFSET 0x2010
+@@ -160,6 +166,7 @@
+ #define CONTROL_GALOG_EN 0x1CULL
+ #define CONTROL_GAINT_EN 0x1DULL
+ #define CONTROL_XT_EN 0x32ULL
++#define CONTROL_INTCAPXT_EN 0x33ULL
+
+ #define CTRL_INV_TO_MASK (7 << CONTROL_INV_TIMEOUT)
+ #define CTRL_INV_TO_NONE 0
+@@ -595,6 +602,9 @@ struct amd_iommu {
+
+ u32 flags;
+ volatile u64 __aligned(8) cmd_sem;
++
++ /* IRQ notifier for IntCapXT interrupt */
++ struct irq_affinity_notify intcapxt_notify;
+ };
+
+ static inline struct amd_iommu *dev_to_amd_iommu(struct device *dev)
+
diff --git a/patches.drivers/iwlwifi-don-t-unmap-as-page-memory-that-was-mapped-a.patch b/patches.drivers/iwlwifi-don-t-unmap-as-page-memory-that-was-mapped-a.patch
new file mode 100644
index 0000000000..bf6d16f453
--- /dev/null
+++ b/patches.drivers/iwlwifi-don-t-unmap-as-page-memory-that-was-mapped-a.patch
@@ -0,0 +1,41 @@
+From 87e7e25aee6b59fef740856f4e86d4b60496c9e1 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Sun, 21 Jul 2019 14:02:27 +0300
+Subject: [PATCH] iwlwifi: don't unmap as page memory that was mapped as single
+Git-commit: 87e7e25aee6b59fef740856f4e86d4b60496c9e1
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+In order to remember how to unmap a memory (as single or
+as page), we maintain a bit per Transmit Buffer (TBs) in
+the meta data (structure iwl_cmd_meta).
+We maintain a bitmap: 1 bit per TB.
+If the TB is set, we will free the memory as a page.
+This bitmap was never cleared. Fix this.
+
+Cc: stable@vger.kernel.org
+Fixes: 3cd1980b0cdf ("iwlwifi: pcie: introduce new tfd and tb formats")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+index fa4245d0d4a8..2f0ba7ef53b8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+@@ -435,6 +435,8 @@ static void iwl_pcie_tfd_unmap(struct iwl_trans *trans,
+ DMA_TO_DEVICE);
+ }
+
++ meta->tbs = 0;
++
+ if (trans->cfg->use_tfh) {
+ struct iwl_tfh_tfd *tfd_fh = (void *)tfd;
+
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-mvm-fix-an-out-of-bound-access.patch b/patches.drivers/iwlwifi-mvm-fix-an-out-of-bound-access.patch
new file mode 100644
index 0000000000..b1e26e3163
--- /dev/null
+++ b/patches.drivers/iwlwifi-mvm-fix-an-out-of-bound-access.patch
@@ -0,0 +1,42 @@
+From ba3224db78034435e9ff0247277cce7c7bb1756c Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 22 Jul 2019 12:47:27 +0300
+Subject: [PATCH] iwlwifi: mvm: fix an out-of-bound access
+Git-commit: ba3224db78034435e9ff0247277cce7c7bb1756c
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+The index for the elements of the ACPI object we dereference
+was static. This means that if we called the function twice
+we wouldn't start from 3 again, but rather from the latest
+index we reached in the previous call.
+This was dutifully reported by KASAN.
+
+Fix this.
+
+Cc: stable@vger.kernel.org
+Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 00c89bcfdf6a..5de54d1559dd 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -755,7 +755,7 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+
+ for (i = 0; i < n_profiles; i++) {
+ /* the tables start at element 3 */
+- static int pos = 3;
++ int pos = 3;
+
+ /* The EWRD profiles officially go from 2 to 4, but we
+ * save them in sar_profiles[1-3] (because we don't
+--
+2.16.4
+
diff --git a/patches.drivers/mfd-intel-lpss-Add-Intel-Comet-Lake-PCI-IDs.patch b/patches.drivers/mfd-intel-lpss-Add-Intel-Comet-Lake-PCI-IDs.patch
new file mode 100644
index 0000000000..abb82daedc
--- /dev/null
+++ b/patches.drivers/mfd-intel-lpss-Add-Intel-Comet-Lake-PCI-IDs.patch
@@ -0,0 +1,48 @@
+From dd6629073a97e5ee125eacbd22eea62281891c67 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 30 Apr 2019 19:56:26 +0300
+Subject: [PATCH] mfd: intel-lpss: Add Intel Comet Lake PCI IDs
+Git-commit: dd6629073a97e5ee125eacbd22eea62281891c67
+Patch-mainline: v5.2-rc1
+References: jsc#SLE-4875
+
+Intel Comet Lake has the same LPSS than Intel Cannon Lake.
+Add the new IDs to the list of supported devices.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
+Tested-by: Evan Green <evgreen@chromium.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c
+index cba2eb166650..6b111be944d9 100644
+--- a/drivers/mfd/intel-lpss-pci.c
++++ b/drivers/mfd/intel-lpss-pci.c
+@@ -129,6 +129,19 @@ static const struct intel_lpss_platform_info cnl_i2c_info = {
+ };
+
+ static const struct pci_device_id intel_lpss_pci_ids[] = {
++ /* CML */
++ { PCI_VDEVICE(INTEL, 0x02a8), (kernel_ulong_t)&spt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x02a9), (kernel_ulong_t)&spt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x02aa), (kernel_ulong_t)&spt_info },
++ { PCI_VDEVICE(INTEL, 0x02ab), (kernel_ulong_t)&spt_info },
++ { PCI_VDEVICE(INTEL, 0x02c5), (kernel_ulong_t)&cnl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x02c6), (kernel_ulong_t)&cnl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x02c7), (kernel_ulong_t)&spt_uart_info },
++ { PCI_VDEVICE(INTEL, 0x02e8), (kernel_ulong_t)&cnl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x02e9), (kernel_ulong_t)&cnl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x02ea), (kernel_ulong_t)&cnl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x02eb), (kernel_ulong_t)&cnl_i2c_info },
++ { PCI_VDEVICE(INTEL, 0x02fb), (kernel_ulong_t)&spt_info },
+ /* BXT A-Step */
+ { PCI_VDEVICE(INTEL, 0x0aac), (kernel_ulong_t)&bxt_i2c_info },
+ { PCI_VDEVICE(INTEL, 0x0aae), (kernel_ulong_t)&bxt_i2c_info },
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-cavium-Add-the-missing-dma-unmap-when-the-dma-ha.patch b/patches.drivers/mmc-cavium-Add-the-missing-dma-unmap-when-the-dma-ha.patch
new file mode 100644
index 0000000000..72d29576b2
--- /dev/null
+++ b/patches.drivers/mmc-cavium-Add-the-missing-dma-unmap-when-the-dma-ha.patch
@@ -0,0 +1,75 @@
+From b803974a86039913d5280add083d730b2b9ed8ec Mon Sep 17 00:00:00 2001
+From: Kevin Hao <haokexin@gmail.com>
+Date: Fri, 26 Jul 2019 10:30:49 +0800
+Subject: [PATCH] mmc: cavium: Add the missing dma unmap when the dma has finished.
+Git-commit: b803974a86039913d5280add083d730b2b9ed8ec
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+This fixes the below calltrace when the CONFIG_DMA_API_DEBUG is enabled.
+ DMA-API: thunderx_mmc 0000:01:01.4: cpu touching an active dma mapped cacheline [cln=0x000000002fdf9800]
+ WARNING: CPU: 21 PID: 1 at kernel/dma/debug.c:596 debug_dma_assert_idle+0x1f8/0x270
+ Modules linked in:
+ CPU: 21 PID: 1 Comm: init Not tainted 5.3.0-rc1-next-20190725-yocto-standard+ #64
+ Hardware name: Marvell OcteonTX CN96XX board (DT)
+ pstate: 80400009 (Nzcv daif +PAN -UAO)
+ pc : debug_dma_assert_idle+0x1f8/0x270
+ lr : debug_dma_assert_idle+0x1f8/0x270
+ sp : ffff0000113cfc10
+ x29: ffff0000113cfc10 x28: 0000ffff8c880000
+ x27: ffff800bc72a0000 x26: ffff000010ff8000
+ x25: ffff000010ff8940 x24: ffff000010ff8968
+ x23: 0000000000000000 x22: ffff000010e83700
+ x21: ffff000010ea2000 x20: ffff000010e835c8
+ x19: ffff800bc2c73300 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: ffff000010e835c8 x14: 6d20616d64206576
+ x13: 69746361206e6120 x12: 676e696863756f74
+ x11: 20757063203a342e x10: 31303a31303a3030
+ x9 : 303020636d6d5f78 x8 : 3230303030303030
+ x7 : 00000000000002fd x6 : ffff000010fd57d0
+ x5 : 0000000000000000 x4 : ffff0000106c5210
+ x3 : 00000000ffffffff x2 : 0000800bee9c0000
+ x1 : 57d5843f4aa62800 x0 : 0000000000000000
+ Call trace:
+ debug_dma_assert_idle+0x1f8/0x270
+ wp_page_copy+0xb0/0x688
+ do_wp_page+0xa8/0x5b8
+ __handle_mm_fault+0x600/0xd00
+ handle_mm_fault+0x118/0x1e8
+ do_page_fault+0x200/0x500
+ do_mem_abort+0x50/0xb0
+ el0_da+0x20/0x24
+ ---[ end trace a005534bd23e109f ]---
+ DMA-API: Mapped at:
+ debug_dma_map_sg+0x94/0x350
+ cvm_mmc_request+0x3c4/0x988
+ __mmc_start_request+0x9c/0x1f8
+ mmc_start_request+0x7c/0xb0
+ mmc_blk_mq_issue_rq+0x5c4/0x7b8
+
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/cavium.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
+index c956813bc6bd..89deb451e0ac 100644
+--- a/drivers/mmc/host/cavium.c
++++ b/drivers/mmc/host/cavium.c
+@@ -374,6 +374,7 @@ static int finish_dma_single(struct cvm_mmc_host *host, struct mmc_data *data)
+ {
+ data->bytes_xfered = data->blocks * data->blksz;
+ data->error = 0;
++ dma_unmap_sg(host->dev, data->sg, data->sg_len, get_dma_dir(data));
+ return 1;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-cavium-Set-the-correct-dma-max-segment-size-for-.patch b/patches.drivers/mmc-cavium-Set-the-correct-dma-max-segment-size-for-.patch
new file mode 100644
index 0000000000..d89170dcc1
--- /dev/null
+++ b/patches.drivers/mmc-cavium-Set-the-correct-dma-max-segment-size-for-.patch
@@ -0,0 +1,84 @@
+From fa25eba6993b3750f417baabba169afaba076178 Mon Sep 17 00:00:00 2001
+From: Kevin Hao <haokexin@gmail.com>
+Date: Fri, 26 Jul 2019 10:30:48 +0800
+Subject: [PATCH] mmc: cavium: Set the correct dma max segment size for mmc_host
+Git-commit: fa25eba6993b3750f417baabba169afaba076178
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+We have set the mmc_host.max_seg_size to 8M, but the dma max segment
+size of PCI device is set to 64K by default in function pci_device_add().
+The mmc_host.max_seg_size is used to set the max segment size of
+the blk queue. Then this mismatch will trigger a calltrace like below
+when a bigger than 64K segment request arrives at mmc dev. So we should
+consider the limitation of the cvm_mmc_host when setting the
+mmc_host.max_seg_size.
+ DMA-API: thunderx_mmc 0000:01:01.4: mapping sg segment longer than device claims to support [len=131072] [max=65536]
+ WARNING: CPU: 6 PID: 238 at kernel/dma/debug.c:1221 debug_dma_map_sg+0x2b8/0x350
+ Modules linked in:
+ CPU: 6 PID: 238 Comm: kworker/6:1H Not tainted 5.3.0-rc1-next-20190724-yocto-standard+ #62
+ Hardware name: Marvell OcteonTX CN96XX board (DT)
+ Workqueue: kblockd blk_mq_run_work_fn
+ pstate: 80c00009 (Nzcv daif +PAN +UAO)
+ pc : debug_dma_map_sg+0x2b8/0x350
+ lr : debug_dma_map_sg+0x2b8/0x350
+ sp : ffff00001770f9e0
+ x29: ffff00001770f9e0 x28: ffffffff00000000
+ x27: 00000000ffffffff x26: ffff800bc2c73180
+ x25: ffff000010e83700 x24: 0000000000000002
+ x23: 0000000000000001 x22: 0000000000000001
+ x21: 0000000000000000 x20: ffff800bc48ba0b0
+ x19: ffff800bc97e8c00 x18: ffffffffffffffff
+ x17: 0000000000000000 x16: 0000000000000000
+ x15: ffff000010e835c8 x14: 6874207265676e6f
+ x13: 6c20746e656d6765 x12: 7320677320676e69
+ x11: 7070616d203a342e x10: 31303a31303a3030
+ x9 : 303020636d6d5f78 x8 : 35363d78616d5b20
+ x7 : 00000000000002fd x6 : ffff000010fd57dc
+ x5 : 0000000000000000 x4 : ffff0000106c61f0
+ x3 : 00000000ffffffff x2 : 0000800bee060000
+ x1 : 7010678df3041a00 x0 : 0000000000000000
+ Call trace:
+ debug_dma_map_sg+0x2b8/0x350
+ cvm_mmc_request+0x3c4/0x988
+ __mmc_start_request+0x9c/0x1f8
+ mmc_start_request+0x7c/0xb0
+ mmc_blk_mq_issue_rq+0x5c4/0x7b8
+ mmc_mq_queue_rq+0x11c/0x278
+ blk_mq_dispatch_rq_list+0xb0/0x568
+ blk_mq_do_dispatch_sched+0x6c/0x108
+ blk_mq_sched_dispatch_requests+0x110/0x1b8
+ __blk_mq_run_hw_queue+0xb0/0x118
+ blk_mq_run_work_fn+0x28/0x38
+ process_one_work+0x210/0x490
+ worker_thread+0x48/0x458
+ kthread+0x130/0x138
+ ret_from_fork+0x10/0x1c
+
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/cavium.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/mmc/host/cavium.c b/drivers/mmc/host/cavium.c
+index ed5cefb83768..c956813bc6bd 100644
+--- a/drivers/mmc/host/cavium.c
++++ b/drivers/mmc/host/cavium.c
+@@ -1046,7 +1046,8 @@ int cvm_mmc_of_slot_probe(struct device *dev, struct cvm_mmc_host *host)
+ mmc->max_segs = 1;
+
+ /* DMA size field can address up to 8 MB */
+- mmc->max_seg_size = 8 * 1024 * 1024;
++ mmc->max_seg_size = min_t(unsigned int, 8 * 1024 * 1024,
++ dma_get_max_seg_size(host->dev));
+ mmc->max_req_size = mmc->max_seg_size;
+ /* External DMA is in 512 byte blocks */
+ mmc->max_blk_size = 512;
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-sdhci-pci-Add-support-for-Intel-CML.patch b/patches.drivers/mmc-sdhci-pci-Add-support-for-Intel-CML.patch
new file mode 100644
index 0000000000..1babd02db8
--- /dev/null
+++ b/patches.drivers/mmc-sdhci-pci-Add-support-for-Intel-CML.patch
@@ -0,0 +1,48 @@
+From 765c59675ab571caf7ada456bbfd23a73136b535 Mon Sep 17 00:00:00 2001
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Mon, 8 Apr 2019 11:32:11 +0300
+Subject: [PATCH] mmc: sdhci-pci: Add support for Intel CML
+Git-commit: 765c59675ab571caf7ada456bbfd23a73136b535
+Patch-mainline: v5.2-rc1
+References: jsc#SLE-4875
+
+Add PCI Ids for Intel CML.
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/host/sdhci-pci-core.c | 2 ++
+ drivers/mmc/host/sdhci-pci.h | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 99b0fec2836b..a3d7a9db76c5 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -1576,6 +1576,8 @@ static const struct pci_device_id pci_ids[] = {
+ SDHCI_PCI_DEVICE(INTEL, CNPH_SD, intel_byt_sd),
+ SDHCI_PCI_DEVICE(INTEL, ICP_EMMC, intel_glk_emmc),
+ SDHCI_PCI_DEVICE(INTEL, ICP_SD, intel_byt_sd),
++ SDHCI_PCI_DEVICE(INTEL, CML_EMMC, intel_glk_emmc),
++ SDHCI_PCI_DEVICE(INTEL, CML_SD, intel_byt_sd),
+ SDHCI_PCI_DEVICE(O2, 8120, o2),
+ SDHCI_PCI_DEVICE(O2, 8220, o2),
+ SDHCI_PCI_DEVICE(O2, 8221, o2),
+diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
+index 4ddb69a15cd7..e5dc6e44c7a4 100644
+--- a/drivers/mmc/host/sdhci-pci.h
++++ b/drivers/mmc/host/sdhci-pci.h
+@@ -50,6 +50,8 @@
+ #define PCI_DEVICE_ID_INTEL_CNPH_SD 0xa375
+ #define PCI_DEVICE_ID_INTEL_ICP_EMMC 0x34c4
+ #define PCI_DEVICE_ID_INTEL_ICP_SD 0x34f8
++#define PCI_DEVICE_ID_INTEL_CML_EMMC 0x02c4
++#define PCI_DEVICE_ID_INTEL_CML_SD 0x02f5
+
+ #define PCI_DEVICE_ID_SYSKONNECT_8000 0x8000
+ #define PCI_DEVICE_ID_VIA_95D0 0x95d0
+--
+2.16.4
+
diff --git a/patches.drivers/mmc-sdhci-pci-add-support-for-intel-icp.patch b/patches.drivers/mmc-sdhci-pci-add-support-for-intel-icp.patch
index 900a625b5c..c64acd2395 100644
--- a/patches.drivers/mmc-sdhci-pci-add-support-for-intel-icp.patch
+++ b/patches.drivers/mmc-sdhci-pci-add-support-for-intel-icp.patch
@@ -3,7 +3,7 @@ Date: Wed, 20 Jun 2018 09:23:13 +0300
Subject: mmc: sdhci-pci: Add support for Intel ICP
Git-commit: 5637ffadf6719576fcba0e02026f80fd54466265
Patch-mainline: v4.19-rc1
-References: FATE#326299
+References: FATE#326299 jsc#SLE-4875
Add PCI Ids for Intel ICP.
diff --git a/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch b/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch
index c649b0b65e..f825620d52 100644
--- a/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch
+++ b/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch
@@ -3,7 +3,7 @@ Date: Sun, 23 Jun 2019 10:11:10 +0300
Subject: net: ena: Fix bug where ring allocation backoff stopped too late
Patch-mainline: v5.3-rc1
Git-commit: 3e5bfb189e1a65df132fd0e3fa00fbb6feec1431
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
The current code of create_queues_with_size_backoff() allows the ring size
to become as small as ENA_MIN_RING_SIZE/2. This is a bug since we don't
diff --git a/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch b/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch
index d09228bb3c..8bbf85dd3f 100644
--- a/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch
+++ b/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:05 +0300
Subject: net: ena: add MAX_QUEUES_EXT get feature admin command
Patch-mainline: v5.3-rc1
Git-commit: ba8ef506fb91005fc4808370b7587ab7bf4bd918
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Add a new admin command to support different queue size for Tx/Rx
queues (the change also support different SQ/CQ sizes)
diff --git a/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch b/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
index c1e74804af..caefa40572 100644
--- a/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
+++ b/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:09 +0300
Subject: net: ena: add ethtool function for changing io queue sizes
Patch-mainline: v5.3-rc1
Git-commit: eece4d2ab9d214e3b12f5ac1ed189a05793b28a5
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Implement the set_ringparam() function of the ethtool interface
to enable the changing of io queue sizes.
diff --git a/patches.drivers/net-ena-add-good-checksum-counter.patch b/patches.drivers/net-ena-add-good-checksum-counter.patch
index 6df07bbdd8..79963d22bf 100644
--- a/patches.drivers/net-ena-add-good-checksum-counter.patch
+++ b/patches.drivers/net-ena-add-good-checksum-counter.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:28 +0300
Subject: net: ena: add good checksum counter
Patch-mainline: v5.3-rc1
Git-commit: d2eecc6ee8c92053797513e34931334dd0e85e18
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Add a new statistics to ETHTOOL to specify if the device calculated
and validated the Rx csum.
diff --git a/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch b/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch
index ed2dd52121..ba3b7a7142 100644
--- a/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch
+++ b/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:19 +0300
Subject: net: ena: add handling of llq max tx burst size
Patch-mainline: v5.3-rc1
Git-commit: 05d62ca218f8425c70389d0416c15bd0d455b416
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
There is a maximum TX burst size that the ENA device can handle.
It is exposed by the device to the driver and the driver
diff --git a/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch b/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch
index a923b11fde..5a8898fbd2 100644
--- a/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch
+++ b/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:23 +0300
Subject: net: ena: add newline at the end of pr_err prints
Patch-mainline: v5.3-rc1
Git-commit: 9cb9c0de266f1ea52f01589f2f4019f163c01cd1
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Some pr_err prints lacked '\n' in the end. Added where missing.
diff --git a/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch b/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch
index ac08f46e6f..65dcec7aff 100644
--- a/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch
+++ b/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:26 +0300
Subject: net: ena: add support for changing max_header_size in LLQ mode
Patch-mainline: v5.3-rc1
Git-commit: cdf449eccc5946d5dd4145b38347874a7423c50d
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Up until now the driver always used a single setting for the sizes
of the different parts of the llq entry - 128 for entry size, 2 for
diff --git a/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch b/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch
index 905727ceb8..257686821b 100644
--- a/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch
+++ b/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:25 +0300
Subject: net: ena: allow automatic fallback to polling mode
Patch-mainline: v5.3-rc1
Git-commit: a4e262cde3cda4491ce666e7c5270954c4d926b9
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Enable fallback to polling mode for Admin queue
when identified a command response arrival
diff --git a/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch b/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch
index a2dec63ff1..5587f54cbd 100644
--- a/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch
+++ b/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:08 +0300
Subject: net: ena: allow queue allocation backoff when low on memory
Patch-mainline: v5.3-rc1
Git-commit: 13ca32a69e29f3a0fe72094dd930f312b3f3ee44
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
If there is not enough memory to allocate io queues the driver will
try to allocate smaller queues.
@@ -262,7 +262,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
ena_free_io_irq(adapter);
err_req_irq:
ena_del_napi(adapter);
-@@ -3298,17 +3384,14 @@ static int ena_calc_queue_size(struct en
+@@ -3297,17 +3383,14 @@ static int ena_calc_queue_size(struct en
max_tx_queue_size = rounddown_pow_of_two(max_tx_queue_size);
max_rx_queue_size = rounddown_pow_of_two(max_rx_queue_size);
@@ -284,7 +284,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
ctx->max_tx_queue_size = max_tx_queue_size;
ctx->max_rx_queue_size = max_rx_queue_size;
ctx->tx_queue_size = tx_queue_size;
-@@ -3438,8 +3521,8 @@ static int ena_probe(struct pci_dev *pde
+@@ -3437,8 +3520,8 @@ static int ena_probe(struct pci_dev *pde
adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE);
adapter->reset_reason = ENA_REGS_RESET_NORMAL;
diff --git a/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch b/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch
index e5ee5f3b52..472fa4e345 100644
--- a/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch
+++ b/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch
@@ -4,7 +4,7 @@ Subject: net: ena: arrange ena_probe() function variables in reverse christmas
tree
Patch-mainline: v5.3-rc1
Git-commit: 83b9240428a66da3c8e24e719b985d533cf58067
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Reverse christmas tree arrangement is when strings are written from longer
to shorter with each line. Most of our functions are abiding this
@@ -23,7 +23,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -3283,17 +3283,17 @@ static int ena_calc_queue_size(struct pc
+@@ -3282,17 +3282,17 @@ static int ena_calc_queue_size(struct pc
static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
{
struct ena_com_dev_get_features_ctx get_feat_ctx;
diff --git a/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch b/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch
index db8ca2f2b4..630f0e03ae 100644
--- a/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch
+++ b/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:06 +0300
Subject: net: ena: enable negotiating larger Rx ring size
Patch-mainline: v5.3-rc1
Git-commit: 31aa9857f1733403f2eb12d51c1cec20a22483d9
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Use MAX_QUEUES_EXT get feature capability to query the device.
@@ -18,7 +18,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -2467,13 +2467,6 @@ static int ena_device_validate_params(st
+@@ -2466,13 +2466,6 @@ static int ena_device_validate_params(st
return -EINVAL;
}
@@ -32,7 +32,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
if (get_feat_ctx->dev_attr.max_mtu < netdev->mtu) {
netif_err(adapter, drv, netdev,
"Error, device max mtu is smaller than netdev MTU\n");
-@@ -3047,18 +3040,32 @@ static int ena_calc_io_queue_num(struct
+@@ -3046,18 +3039,32 @@ static int ena_calc_io_queue_num(struct
struct ena_com_dev *ena_dev,
struct ena_com_dev_get_features_ctx *get_feat_ctx)
{
@@ -73,7 +73,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
/* 1 IRQ for for mgmnt and 1 IRQs for each IO direction */
io_queue_num = min_t(int, io_queue_num, pci_msix_vec_count(pdev) - 1);
if (unlikely(!io_queue_num)) {
-@@ -3241,36 +3248,73 @@ static inline void set_default_llq_confi
+@@ -3240,36 +3247,73 @@ static inline void set_default_llq_confi
llq_config->llq_ring_entry_size_value = 128;
}
@@ -170,7 +170,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
}
/* ena_probe - Device Initialization Routine
-@@ -3286,6 +3330,7 @@ static int ena_calc_queue_size(struct pc
+@@ -3285,6 +3329,7 @@ static int ena_calc_queue_size(struct pc
static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
{
struct ena_com_dev_get_features_ctx get_feat_ctx;
@@ -178,7 +178,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
struct ena_llq_configurations llq_config;
struct ena_com_dev *ena_dev = NULL;
struct ena_adapter *adapter;
-@@ -3293,9 +3338,6 @@ static int ena_probe(struct pci_dev *pde
+@@ -3292,9 +3337,6 @@ static int ena_probe(struct pci_dev *pde
struct net_device *netdev;
static int adapters_found;
char *queue_type_str;
@@ -188,7 +188,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
bool wd_state;
dev_dbg(&pdev->dev, "%s\n", __func__);
-@@ -3352,20 +3394,25 @@ static int ena_probe(struct pci_dev *pde
+@@ -3351,20 +3393,25 @@ static int ena_probe(struct pci_dev *pde
goto err_device_destroy;
}
@@ -219,7 +219,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
(ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) ?
"ENABLED" : "DISABLED");
-@@ -3391,11 +3438,10 @@ static int ena_probe(struct pci_dev *pde
+@@ -3390,11 +3437,10 @@ static int ena_probe(struct pci_dev *pde
adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE);
adapter->reset_reason = ENA_REGS_RESET_NORMAL;
diff --git a/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch b/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch
index 580a162447..ceedfb52a1 100644
--- a/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch
+++ b/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:20 +0300
Subject: net: ena: ethtool: add extra properties retrieval via get_priv_flags
Patch-mainline: v5.3-rc1
Git-commit: 315c28d2b714f2c52c0b22f38dbf9b44f8f0c9e4
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
This commit adds a mechanism for exposing different device
properties via ethtool's priv_flags. The strings are provided
@@ -337,7 +337,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
void ena_set_ethtool_ops(struct net_device *netdev)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -2371,6 +2371,14 @@ err:
+@@ -2370,6 +2370,14 @@ err:
ena_com_delete_debug_area(adapter->ena_dev);
}
@@ -352,7 +352,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static void ena_get_stats64(struct net_device *netdev,
struct rtnl_link_stats64 *stats)
{
-@@ -3426,6 +3434,9 @@ static int ena_probe(struct pci_dev *pde
+@@ -3425,6 +3433,9 @@ static int ena_probe(struct pci_dev *pde
ena_config_debug_area(adapter);
@@ -362,7 +362,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
memcpy(adapter->netdev->perm_addr, adapter->mac_addr, netdev->addr_len);
netif_carrier_off(netdev);
-@@ -3466,6 +3477,7 @@ static int ena_probe(struct pci_dev *pde
+@@ -3465,6 +3476,7 @@ static int ena_probe(struct pci_dev *pde
return 0;
err_rss:
@@ -370,7 +370,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
ena_com_delete_debug_area(ena_dev);
ena_com_rss_destroy(ena_dev);
err_free_msix:
-@@ -3558,6 +3570,8 @@ static void ena_remove(struct pci_dev *p
+@@ -3557,6 +3569,8 @@ static void ena_remove(struct pci_dev *p
ena_com_delete_host_info(ena_dev);
diff --git a/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch b/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch
index bd1c06eb07..9c146d3fe7 100644
--- a/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch
+++ b/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch
@@ -3,7 +3,7 @@ Date: Wed, 1 May 2019 16:47:05 +0300
Subject: net: ena: fix: Free napi resources when ena_up() fails
Patch-mainline: v5.2-rc1
Git-commit: b287cdbd1cedfc9606682c6e02b58d00ff3a33ae
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
ena_up() calls ena_init_napi() but does not call ena_del_napi() in
case of failure. This causes a segmentation fault upon rmmod when
diff --git a/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch b/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
index b9574894ed..71087e6ffe 100644
--- a/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
+++ b/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
@@ -3,7 +3,7 @@ Date: Wed, 1 May 2019 16:47:09 +0300
Subject: net: ena: fix ena_com_fill_hash_function() implementation
Patch-mainline: v5.2-rc1
Git-commit: 11bd7a00c0d8ffe33d1e926f8e789b4aea787186
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
ena_com_fill_hash_function() didn't configure the rss->hash_func.
diff --git a/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch b/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
index dbe7a86a99..89ce0ffee0 100644
--- a/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
+++ b/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
@@ -3,7 +3,7 @@ Date: Wed, 1 May 2019 16:47:06 +0300
Subject: net: ena: fix incorrect test of supported hash function
Patch-mainline: v5.2-rc1
Git-commit: d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
ena_com_set_hash_function() tests if a hash function is supported
by the device before setting it.
diff --git a/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch b/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch
index f43e2f2a80..27f278a687 100644
--- a/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch
+++ b/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch
@@ -4,7 +4,7 @@ Subject: net: ena: fix: set freed objects to NULL to avoid failing future
allocations
Patch-mainline: v5.2-rc1
Git-commit: 8ee8ee7fe87bf64738ab4e31be036a7165608b27
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
In some cases when a queue related allocation fails, successful past
allocations are freed but the pointer that pointed to them is not
diff --git a/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch b/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
index 37c269447b..be7322acd1 100644
--- a/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
+++ b/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
@@ -4,7 +4,7 @@ Subject: net: ena: fix swapped parameters when calling
ena_com_indirect_table_fill_entry
Patch-mainline: v5.2-rc1
Git-commit: 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
second parameter should be the index of the table rather than the value.
diff --git a/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch b/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch
index 73130e2966..5a32397c2e 100644
--- a/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch
+++ b/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch
@@ -3,7 +3,7 @@ Date: Wed, 1 May 2019 16:47:10 +0300
Subject: net: ena: gcc 8: fix compilation warning
Patch-mainline: v5.2-rc1
Git-commit: f913308879bc6ae437ce64d878c7b05643ddea44
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
GCC 8 contains a number of new warnings as well as enhancements to existing
checkers. The warning - Wstringop-truncation - warns for calls to bounded
@@ -31,7 +31,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -2299,7 +2299,7 @@ static void ena_config_host_info(struct
+@@ -2298,7 +2298,7 @@ static void ena_config_host_info(struct
host_info->bdf = (pdev->bus->number << 8) | pdev->devfn;
host_info->os_type = ENA_ADMIN_OS_LINUX;
host_info->kernel_ver = LINUX_VERSION_CODE;
diff --git a/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch b/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch
index a3af8f25d0..a7341277fa 100644
--- a/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch
+++ b/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch
@@ -4,7 +4,7 @@ Subject: net: ena: improve latency by disabling adaptive interrupt moderation
by default
Patch-mainline: v5.2-rc1
Git-commit: 78cb421d185cfb4fcea94e7c3ff6e6ea77bb8c11
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Adaptive interrupt moderation was erroneously enabled by default
in the driver.
diff --git a/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch b/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch
index 922bc0eed3..3d39dc175b 100644
--- a/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch
+++ b/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:07 +0300
Subject: net: ena: make ethtool show correct current and max queue sizes
Patch-mainline: v5.3-rc1
Git-commit: 9f9ae3f98b8d8b8aa709831057759dbb52ba5083
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Currently ethtool -g shows the same size for current and max queue
sizes.
@@ -39,7 +39,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
static u32 ena_flow_hash_to_flow_type(u16 hash_fields)
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -3440,6 +3440,8 @@ static int ena_probe(struct pci_dev *pde
+@@ -3439,6 +3439,8 @@ static int ena_probe(struct pci_dev *pde
adapter->tx_ring_size = calc_queue_ctx.tx_queue_size;
adapter->rx_ring_size = calc_queue_ctx.rx_queue_size;
diff --git a/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch b/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch
index f2663cf7c0..41a38c9a61 100644
--- a/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch
+++ b/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:27 +0300
Subject: net: ena: optimise calculations for CQ doorbell
Patch-mainline: v5.3-rc1
Git-commit: d91860989dd4bce582ed6c3647a0d41d6fd895b3
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
This patch initially checks if CQ doorbell
is needed before proceeding with the calculations.
diff --git a/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch b/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch
index 696148cdac..dbf4939507 100644
--- a/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch
+++ b/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:10 +0300
Subject: net: ena: remove inline keyword from functions in *.c
Patch-mainline: v5.3-rc1
Git-commit: c2b542044761965db0e4cc400ab6abf670fc25b7
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Let the compiler decide if the function should be inline in *.c files
@@ -229,7 +229,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
struct ena_ring *rx_ring)
{
int cpu = get_cpu();
-@@ -3339,7 +3339,7 @@ static void ena_release_bars(struct ena_
+@@ -3338,7 +3338,7 @@ static void ena_release_bars(struct ena_
pci_release_selected_regions(pdev, release_bars);
}
diff --git a/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch b/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch
index 19efdc8424..06e2b97408 100644
--- a/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch
+++ b/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch
@@ -4,7 +4,7 @@ Subject: net: ena: replace free_tx/rx_ids union with single free_ids field in
ena_ring
Patch-mainline: v5.3-rc1
Git-commit: f917249833c7a00ea8be39b1bcb3ec8ef3aea45f
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
struct ena_ring holds a union of free_rx_ids and free_tx_ids.
Both of the above fields mean the exact same thing and are used
diff --git a/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch b/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
index 4241be0a9c..cdd07d45dd 100644
--- a/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
+++ b/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
@@ -3,7 +3,7 @@ Date: Tue, 11 Jun 2019 14:58:11 +0300
Subject: net: ena: update driver version from 2.0.3 to 2.1.0
Patch-mainline: v5.3-rc1
Git-commit: dbbc6e6877768a03092751edf89d012d561b4553
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Update driver version to match device specification.
diff --git a/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch b/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch
index bbcdfa9c62..20597e4ad4 100644
--- a/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch
+++ b/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch
@@ -3,7 +3,7 @@ Date: Mon, 3 Jun 2019 17:43:29 +0300
Subject: net: ena: use dev_info_once instead of static variable
Patch-mainline: v5.3-rc1
Git-commit: 1e9c3fbad83a70e0b00806df3f4dd2db0bc04cc4
-References: bsc#1138879
+References: bsc#1138879 bsc#1139020 bsc#1139021
Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
@@ -14,7 +14,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
+++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
-@@ -3289,7 +3289,6 @@ static int ena_probe(struct pci_dev *pde
+@@ -3288,7 +3288,6 @@ static int ena_probe(struct pci_dev *pde
struct ena_llq_configurations llq_config;
struct ena_com_dev *ena_dev = NULL;
struct ena_adapter *adapter;
@@ -22,7 +22,7 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
int io_queue_num, bars, rc;
struct net_device *netdev;
static int adapters_found;
-@@ -3301,8 +3300,7 @@ static int ena_probe(struct pci_dev *pde
+@@ -3300,8 +3299,7 @@ static int ena_probe(struct pci_dev *pde
dev_dbg(&pdev->dev, "%s\n", __func__);
diff --git a/patches.drivers/net-mlx4_core-Zero-out-lkey-field-in-SW2HW_MPT-fw-co.patch b/patches.drivers/net-mlx4_core-Zero-out-lkey-field-in-SW2HW_MPT-fw-co.patch
index d14f5e73c4..a05e6cf1ec 100644
--- a/patches.drivers/net-mlx4_core-Zero-out-lkey-field-in-SW2HW_MPT-fw-co.patch
+++ b/patches.drivers/net-mlx4_core-Zero-out-lkey-field-in-SW2HW_MPT-fw-co.patch
@@ -3,7 +3,7 @@ Date: Thu, 15 Nov 2018 18:05:13 +0200
Subject: net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
Patch-mainline: v4.20-rc4
Git-commit: bd85fbc2038a1bbe84990b23ff69b6fc81a32b2c
-References: bsc#1103989 FATE#326004
+References: bsc#1103989 FATE#326004 bsc#1145678
When re-registering a user mr, the mpt information for the
existing mr when running SRIOV is obtained via the QUERY_MPT
diff --git a/patches.drivers/qede-fix-write-to-free-d-pointer-error-and-double-fr.patch b/patches.drivers/qede-fix-write-to-free-d-pointer-error-and-double-fr.patch
index 17fe640d30..9c008fe473 100644
--- a/patches.drivers/qede-fix-write-to-free-d-pointer-error-and-double-fr.patch
+++ b/patches.drivers/qede-fix-write-to-free-d-pointer-error-and-double-fr.patch
@@ -3,7 +3,7 @@ Date: Fri, 12 Apr 2019 15:13:27 +0100
Subject: qede: fix write to free'd pointer error and double free of ptp
Patch-mainline: v5.1-rc6
Git-commit: 1dc2b3d65523780ed1972d446c76e62e13f3e8f5
-References: bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692
+References: bsc#1051510 bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692
The err2 error return path calls qede_ptp_disable that cleans up
on an error and frees ptp. After this, the free'd ptp is dereferenced
diff --git a/patches.drivers/regulator-qcom_spmi-Fix-math-of-spmi_regulator_set_v.patch b/patches.drivers/regulator-qcom_spmi-Fix-math-of-spmi_regulator_set_v.patch
new file mode 100644
index 0000000000..a33f1cc196
--- /dev/null
+++ b/patches.drivers/regulator-qcom_spmi-Fix-math-of-spmi_regulator_set_v.patch
@@ -0,0 +1,67 @@
+From 61d7fdc49f03f4ec990974d1d2a8b05e64afeae4 Mon Sep 17 00:00:00 2001
+From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Date: Wed, 19 Jun 2019 11:56:36 -0700
+Subject: [PATCH] regulator: qcom_spmi: Fix math of spmi_regulator_set_voltage_time_sel
+Git-commit: 61d7fdc49f03f4ec990974d1d2a8b05e64afeae4
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+spmi_regulator_set_voltage_time_sel() calculates the amount of delay
+needed as the result of setting a new voltage. Essentially this is the
+absolute difference of the old and new voltages, divided by the slew rate.
+
+The implementation of spmi_regulator_set_voltage_time_sel() is wrong.
+
+It attempts to calculate the difference in voltages by using the
+difference in selectors and multiplying by the voltage step between
+selectors. This ignores the possibility that the old and new selectors
+might be from different ranges, which have different step values. Also,
+the difference between the selectors may encapsulate N ranges inbetween,
+so a summation of each selector change from old to new would be needed.
+
+Lets avoid all of that complexity, and just get the actual voltage
+represented by both the old and new selector, and use those to directly
+compute the voltage delta. This is more straight forward, and has the
+side benifit of avoiding issues with regulator implementations that don't
+have hardware register support to get the current configured range.
+
+Fixes: e92a4047419c ("regulator: Add QCOM SPMI regulator driver")
+Reported-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Reported-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+Reported-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Tested-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/regulator/qcom_spmi-regulator.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -754,18 +754,17 @@ spmi_regulator_common_set_voltage(struct
+ return spmi_vreg_write(vreg, SPMI_COMMON_REG_VOLTAGE_RANGE, buf, 2);
+ }
+
++static int spmi_regulator_common_list_voltage(struct regulator_dev *rdev,
++ unsigned selector);
++
+ static int spmi_regulator_set_voltage_time_sel(struct regulator_dev *rdev,
+ unsigned int old_selector, unsigned int new_selector)
+ {
+ struct spmi_regulator *vreg = rdev_get_drvdata(rdev);
+- const struct spmi_voltage_range *range;
+ int diff_uV;
+
+- range = spmi_regulator_find_range(vreg);
+- if (!range)
+- return -EINVAL;
+-
+- diff_uV = abs(new_selector - old_selector) * range->step_uV;
++ diff_uV = abs(spmi_regulator_common_list_voltage(rdev, new_selector) -
++ spmi_regulator_common_list_voltage(rdev, old_selector));
+
+ return DIV_ROUND_UP(diff_uV, vreg->slew_rate);
+ }
diff --git a/patches.drivers/sis900-fix-TX-completion.patch b/patches.drivers/sis900-fix-TX-completion.patch
new file mode 100644
index 0000000000..0323494e0b
--- /dev/null
+++ b/patches.drivers/sis900-fix-TX-completion.patch
@@ -0,0 +1,119 @@
+From 8ac8a01092b2added0749ef937037bf1912e13e3 Mon Sep 17 00:00:00 2001
+From: Sergej Benilov <sergej.benilov@googlemail.com>
+Date: Thu, 20 Jun 2019 11:02:18 +0200
+Subject: [PATCH] sis900: fix TX completion
+Git-commit: 8ac8a01092b2added0749ef937037bf1912e13e3
+Patch-mainline: v5.2-rc7
+References: bsc#1051510
+
+Since commit 605ad7f184b60cfaacbc038aa6c55ee68dee3c89 "tcp: refine TSO autosizing",
+outbound throughput is dramatically reduced for some connections, as sis900
+is doing TX completion within idle states only.
+
+Make TX completion happen after every transmitted packet.
+
+Test:
+netperf
+
+before patch:
+> netperf -H remote -l -2000000 -- -s 1000000
+MIGRATED TCP STREAM TEST from 0.0.0.0 () port 0 AF_INET to 95.223.112.76 () port 0 AF_INET : demo
+Recv Send Send
+Socket Socket Message Elapsed
+Size Size Size Time Throughput
+bytes bytes bytes secs. 10^6bits/sec
+
+ 87380 327680 327680 253.44 0.06
+
+after patch:
+> netperf -H remote -l -10000000 -- -s 1000000
+MIGRATED TCP STREAM TEST from 0.0.0.0 () port 0 AF_INET to 95.223.112.76 () port 0 AF_INET : demo
+Recv Send Send
+Socket Socket Message Elapsed
+Size Size Size Time Throughput
+bytes bytes bytes secs. 10^6bits/sec
+
+ 87380 327680 327680 5.38 14.89
+
+Thx to Dave Miller and Eric Dumazet for helpful hints
+
+Signed-off-by: Sergej Benilov <sergej.benilov@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ethernet/sis/sis900.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/sis/sis900.c b/drivers/net/ethernet/sis/sis900.c
+index 67f9bb6e941b..9b036c857b1d 100644
+--- a/drivers/net/ethernet/sis/sis900.c
++++ b/drivers/net/ethernet/sis/sis900.c
+@@ -1057,7 +1057,7 @@ sis900_open(struct net_device *net_dev)
+ sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
+
+ /* Enable all known interrupts by setting the interrupt mask. */
+- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
++ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
+ sw32(cr, RxENA | sr32(cr));
+ sw32(ier, IE);
+
+@@ -1578,7 +1578,7 @@ static void sis900_tx_timeout(struct net_device *net_dev)
+ sw32(txdp, sis_priv->tx_ring_dma);
+
+ /* Enable all known interrupts by setting the interrupt mask. */
+- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
++ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
+ }
+
+ /**
+@@ -1618,7 +1618,7 @@ sis900_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
+ spin_unlock_irqrestore(&sis_priv->lock, flags);
+ return NETDEV_TX_OK;
+ }
+- sis_priv->tx_ring[entry].cmdsts = (OWN | skb->len);
++ sis_priv->tx_ring[entry].cmdsts = (OWN | INTR | skb->len);
+ sw32(cr, TxENA | sr32(cr));
+
+ sis_priv->cur_tx ++;
+@@ -1674,7 +1674,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
+ do {
+ status = sr32(isr);
+
+- if ((status & (HIBERR|TxURN|TxERR|TxIDLE|RxORN|RxERR|RxOK)) == 0)
++ if ((status & (HIBERR|TxURN|TxERR|TxIDLE|TxDESC|RxORN|RxERR|RxOK)) == 0)
+ /* nothing intresting happened */
+ break;
+ handled = 1;
+@@ -1684,7 +1684,7 @@ static irqreturn_t sis900_interrupt(int irq, void *dev_instance)
+ /* Rx interrupt */
+ sis900_rx(net_dev);
+
+- if (status & (TxURN | TxERR | TxIDLE))
++ if (status & (TxURN | TxERR | TxIDLE | TxDESC))
+ /* Tx interrupt */
+ sis900_finish_xmit(net_dev);
+
+@@ -1896,8 +1896,8 @@ static void sis900_finish_xmit (struct net_device *net_dev)
+
+ if (tx_status & OWN) {
+ /* The packet is not transmitted yet (owned by hardware) !
+- * Note: the interrupt is generated only when Tx Machine
+- * is idle, so this is an almost impossible case */
++ * Note: this is an almost impossible condition
++ * in case of TxDESC ('descriptor interrupt') */
+ break;
+ }
+
+@@ -2473,7 +2473,7 @@ static int sis900_resume(struct pci_dev *pci_dev)
+ sis900_set_mode(sis_priv, HW_SPEED_10_MBPS, FDX_CAPABLE_HALF_SELECTED);
+
+ /* Enable all known interrupts by setting the interrupt mask. */
+- sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE);
++ sw32(imr, RxSOVR | RxORN | RxERR | RxOK | TxURN | TxERR | TxIDLE | TxDESC);
+ sw32(cr, RxENA | sr32(cr));
+ sw32(ier, IE);
+
+--
+2.16.4
+
diff --git a/patches.drivers/sound-fix-a-memory-leak-bug.patch b/patches.drivers/sound-fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..cf0a3ce36e
--- /dev/null
+++ b/patches.drivers/sound-fix-a-memory-leak-bug.patch
@@ -0,0 +1,42 @@
+From c7cd7c748a3250ca33509f9235efab9c803aca09 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wenwen@cs.uga.edu>
+Date: Thu, 8 Aug 2019 00:15:21 -0500
+Subject: [PATCH] sound: fix a memory leak bug
+Git-commit: c7cd7c748a3250ca33509f9235efab9c803aca09
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+In sound_insert_unit(), the controlling structure 's' is allocated through
+kmalloc(). Then it is added to the sound driver list by invoking
+__sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is
+removed from the list through __sound_remove_unit(). If 'index' is not less
+than 0, -EBUSY is returned to indicate the error. However, 's' is not
+deallocated on this execution path, leading to a memory leak bug.
+
+To fix the above issue, free 's' before -EBUSY is returned.
+
+Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/sound_core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/sound/sound_core.c b/sound/sound_core.c
+index b730d97c4de6..90d118cd9164 100644
+--- a/sound/sound_core.c
++++ b/sound/sound_core.c
+@@ -275,7 +275,8 @@ static int sound_insert_unit(struct sound_unit **list, const struct file_operati
+ goto retry;
+ }
+ spin_unlock(&sound_loader_lock);
+- return -EBUSY;
++ r = -EBUSY;
++ goto fail;
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/tpm-Fix-TPM-1.2-Shutdown-sequence-to-prevent-future-.patch b/patches.drivers/tpm-Fix-TPM-1.2-Shutdown-sequence-to-prevent-future-.patch
new file mode 100644
index 0000000000..5bb348c29f
--- /dev/null
+++ b/patches.drivers/tpm-Fix-TPM-1.2-Shutdown-sequence-to-prevent-future-.patch
@@ -0,0 +1,50 @@
+From b39914384da5469bef5323ba67543d61d6360773 Mon Sep 17 00:00:00 2001
+From: Vadim Sukhomlinov <sukhomlinov@google.com>
+Date: Mon, 10 Jun 2019 15:01:18 -0700
+Subject: [PATCH 1/1] tpm: Fix TPM 1.2 Shutdown sequence to prevent future TPM
+ operations
+
+References: bsc#1082555
+Patch-mainline: v5.3-rc1
+Git-commit: db4d8cb9c9f2af71c4d087817160d866ed572cc9
+
+TPM 2.0 Shutdown involve sending TPM2_Shutdown to TPM chip and disabling
+future TPM operations. TPM 1.2 behavior was different, future TPM
+operations weren't disabled, causing rare issues. This patch ensures
+that future TPM operations are disabled.
+
+Fixes: d1bd4a792d39 ("tpm: Issue a TPM2_Shutdown for TPM2 devices.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vadim Sukhomlinov <sukhomlinov@google.com>
+[dianders: resolved merge conflicts with mainline]
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/char/tpm/tpm-chip.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
+index 67ec9d3d04f5..5ed5d9174994 100644
+--- a/drivers/char/tpm/tpm-chip.c
++++ b/drivers/char/tpm/tpm-chip.c
+@@ -158,12 +158,12 @@ static int tpm_class_shutdown(struct device *dev)
+ {
+ struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev);
+
++ down_write(&chip->ops_sem);
+ if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+- down_write(&chip->ops_sem);
+ tpm2_shutdown(chip, TPM2_SU_CLEAR);
+- chip->ops = NULL;
+- up_write(&chip->ops_sem);
+ }
++ chip->ops = NULL;
++ up_write(&chip->ops_sem);
+ /* Allow bus- and device-specific code to run. Note: since chip->ops
+ * is NULL, more-specific shutdown code will not be able to issue TPM
+ * commands.
+--
+2.22.0
+
diff --git a/patches.drivers/tpm-Fix-off-by-one-when-reading-binary_bios_measurem.patch b/patches.drivers/tpm-Fix-off-by-one-when-reading-binary_bios_measurem.patch
new file mode 100644
index 0000000000..82ba570157
--- /dev/null
+++ b/patches.drivers/tpm-Fix-off-by-one-when-reading-binary_bios_measurem.patch
@@ -0,0 +1,78 @@
+From 2301bec1b71e0944181cff486b2b66bcb5808850 Mon Sep 17 00:00:00 2001
+From: Jia Zhang <zhang.jia@linux.alibaba.com>
+Date: Fri, 11 Jan 2019 16:59:33 +0800
+Subject: [PATCH 1/1] tpm: Fix off-by-one when reading binary_bios_measurements
+
+References: bsc#1082555
+Patch-mainline: v5.1-rc1
+Git-commit: 64494d39ff630a63b5308042b20132b491e3706b
+
+It is unable to read the entry when it is the only one in
+binary_bios_measurements:
+
+00000000 00 00 00 00 08 00 00 00 c4 2f ed ad 26 82 00 cb
+00000010 1d 15 f9 78 41 c3 44 e7 9d ae 33 20 00 00 00 00
+00000020
+
+This is obviously a firmware problem on my linux machine:
+
+ Manufacturer: Inspur
+ Product Name: SA5212M4
+ Version: 01
+
+However, binary_bios_measurements should return it any way,
+rather than nothing, after all its content is completely
+valid.
+
+Fixes: 55a82ab3181b ("tpm: add bios measurement log")
+Signed-off-by: Jia Zhang <zhang.jia@linux.alibaba.com>
+Reviewd-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/char/tpm/tpm1_eventlog.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm1_eventlog.c b/drivers/char/tpm/tpm1_eventlog.c
+index 9a8605e500b5..d168307e4f56 100644
+--- a/drivers/char/tpm/tpm1_eventlog.c
++++ b/drivers/char/tpm/tpm1_eventlog.c
+@@ -101,7 +101,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
+ }
+
+ /* now check if current entry is valid */
+- if ((addr + sizeof(struct tcpa_event)) >= limit)
++ if ((addr + sizeof(struct tcpa_event)) > limit)
+ return NULL;
+
+ event = addr;
+@@ -111,7 +111,7 @@ static void *tpm_bios_measurements_start(struct seq_file *m, loff_t *pos)
+
+ if (((converted_event_type == 0) && (converted_event_size == 0))
+ || ((addr + sizeof(struct tcpa_event) + converted_event_size)
+- >= limit))
++ > limit))
+ return NULL;
+
+ return addr;
+@@ -132,7 +132,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
+ v += sizeof(struct tcpa_event) + converted_event_size;
+
+ /* now check if current entry is valid */
+- if ((v + sizeof(struct tcpa_event)) >= limit)
++ if ((v + sizeof(struct tcpa_event)) > limit)
+ return NULL;
+
+ event = v;
+@@ -141,7 +141,7 @@ static void *tpm_bios_measurements_next(struct seq_file *m, void *v,
+ converted_event_type = do_endian_conversion(event->event_type);
+
+ if (((converted_event_type == 0) && (converted_event_size == 0)) ||
+- ((v + sizeof(struct tcpa_event) + converted_event_size) >= limit))
++ ((v + sizeof(struct tcpa_event) + converted_event_size) > limit))
+ return NULL;
+
+ (*pos)++;
+--
+2.22.0
+
diff --git a/patches.drivers/tpm-Unify-the-send-callback-behaviour.patch b/patches.drivers/tpm-Unify-the-send-callback-behaviour.patch
new file mode 100644
index 0000000000..0aa0b1d48e
--- /dev/null
+++ b/patches.drivers/tpm-Unify-the-send-callback-behaviour.patch
@@ -0,0 +1,237 @@
+From f5595f5baa30e009bf54d0d7653a9a0cc465be60 Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Date: Fri, 8 Feb 2019 18:30:58 +0200
+Subject: [PATCH] tpm: Unify the send callback behaviour
+
+References: bsc#1082555
+Patch-mainline: v5.1-rc1
+Git-commit: f5595f5baa30e009bf54d0d7653a9a0cc465be60
+
+The send() callback should never return length as it does not in every
+driver except tpm_crb in the success case. The reason is that the main
+transmit functionality only cares about whether the transmit was
+successful or not and ignores the count completely.
+
+Suggested-by: Stefan Berger <stefanb@linux.ibm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Tested-by: Alexander Steffen <Alexander.Steffen@infineon.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/char/tpm/st33zp24/st33zp24.c | 2 +-
+ drivers/char/tpm/tpm-interface.c | 11 ++++++++++-
+ drivers/char/tpm/tpm_atmel.c | 2 +-
+ drivers/char/tpm/tpm_i2c_atmel.c | 6 +++++-
+ drivers/char/tpm/tpm_i2c_infineon.c | 2 +-
+ drivers/char/tpm/tpm_i2c_nuvoton.c | 2 +-
+ drivers/char/tpm/tpm_ibmvtpm.c | 8 ++++----
+ drivers/char/tpm/tpm_infineon.c | 2 +-
+ drivers/char/tpm/tpm_nsc.c | 2 +-
+ drivers/char/tpm/tpm_tis_core.c | 2 +-
+ drivers/char/tpm/tpm_vtpm_proxy.c | 3 +--
+ drivers/char/tpm/xen-tpmfront.c | 2 +-
+ 12 files changed, 28 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c
+index 64dc560859f2..13dc614b7ebc 100644
+--- a/drivers/char/tpm/st33zp24/st33zp24.c
++++ b/drivers/char/tpm/st33zp24/st33zp24.c
+@@ -436,7 +436,7 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
+ goto out_err;
+ }
+
+- return len;
++ return 0;
+ out_err:
+ st33zp24_cancel(chip);
+ release_locality(chip);
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index d9439f9abe78..88d2e01a651d 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -230,10 +230,19 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip,
+ if (rc < 0) {
+ if (rc != -EPIPE)
+ dev_err(&chip->dev,
+- "%s: tpm_send: error %d\n", __func__, rc);
++ "%s: send(): error %d\n", __func__, rc);
+ goto out;
+ }
+
++ /* A sanity check. send() should just return zero on success e.g.
++ * not the command length.
++ */
++ if (rc > 0) {
++ dev_warn(&chip->dev,
++ "%s: send(): invalid value %d\n", __func__, rc);
++ rc = 0;
++ }
++
+ if (chip->flags & TPM_CHIP_FLAG_IRQ)
+ goto out_recv;
+
+diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
+index 66a14526aaf4..a290b30a0c35 100644
+--- a/drivers/char/tpm/tpm_atmel.c
++++ b/drivers/char/tpm/tpm_atmel.c
+@@ -105,7 +105,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ iowrite8(buf[i], priv->iobase);
+ }
+
+- return count;
++ return 0;
+ }
+
+ static void tpm_atml_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
+index 95ce2e9ccdc6..32a8e27c5382 100644
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -65,7 +65,11 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ dev_dbg(&chip->dev,
+ "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__,
+ (int)min_t(size_t, 64, len), buf, len, status);
+- return status;
++
++ if (status < 0)
++ return status;
++
++ return 0;
+ }
+
+ static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
+index 3b490d9d90e7..3b4e9672ff6c 100644
+--- a/drivers/char/tpm/tpm_i2c_infineon.c
++++ b/drivers/char/tpm/tpm_i2c_infineon.c
+@@ -588,7 +588,7 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ /* go and do it */
+ iic_tpm_write(TPM_STS(tpm_dev.locality), &sts, 1);
+
+- return len;
++ return 0;
+ out_err:
+ tpm_tis_i2c_ready(chip);
+ /* The TPM needs some time to clean up here,
+diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c
+index 5700cc2ddee1..315a3b4548f7 100644
+--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
+@@ -465,7 +465,7 @@ static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ }
+
+ dev_dbg(dev, "%s() -> %zd\n", __func__, len);
+- return len;
++ return 0;
+ }
+
+ static bool i2c_nuvoton_req_canceled(struct tpm_chip *chip, u8 status)
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 07b5a487d0c8..757ca45b39b8 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -139,14 +139,14 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+ }
+
+ /**
+- * tpm_ibmvtpm_send - Send tpm request
+- *
++ * tpm_ibmvtpm_send() - Send a TPM command
+ * @chip: tpm chip struct
+ * @buf: buffer contains data to send
+ * @count: size of buffer
+ *
+ * Return:
+- * Number of bytes sent or < 0 on error.
++ * 0 on success,
++ * -errno on error
+ */
+ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+@@ -192,7 +192,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ rc = 0;
+ ibmvtpm->tpm_processing_cmd = false;
+ } else
+- rc = count;
++ rc = 0;
+
+ spin_unlock(&ibmvtpm->rtce_lock);
+ return rc;
+diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
+index d8f10047fbba..97f6d4fe0aee 100644
+--- a/drivers/char/tpm/tpm_infineon.c
++++ b/drivers/char/tpm/tpm_infineon.c
+@@ -354,7 +354,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
+ for (i = 0; i < count; i++) {
+ wait_and_send(chip, buf[i]);
+ }
+- return count;
++ return 0;
+ }
+
+ static void tpm_inf_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
+index 5d6cce74cd3f..9bee3c5eb4bf 100644
+--- a/drivers/char/tpm/tpm_nsc.c
++++ b/drivers/char/tpm/tpm_nsc.c
+@@ -226,7 +226,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
+ }
+ outb(NSC_COMMAND_EOC, priv->base + NSC_COMMAND);
+
+- return count;
++ return 0;
+ }
+
+ static void tpm_nsc_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index bf7e49cfa643..bb0c2e160562 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -481,7 +481,7 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)
+ goto out_err;
+ }
+ }
+- return len;
++ return 0;
+ out_err:
+ tpm_tis_ready(chip);
+ return rc;
+diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c
+index 87a0ce47f201..ecbb63f8d231 100644
+--- a/drivers/char/tpm/tpm_vtpm_proxy.c
++++ b/drivers/char/tpm/tpm_vtpm_proxy.c
+@@ -335,7 +335,6 @@ static int vtpm_proxy_is_driver_command(struct tpm_chip *chip,
+ static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ {
+ struct proxy_dev *proxy_dev = dev_get_drvdata(&chip->dev);
+- int rc = 0;
+
+ if (count > sizeof(proxy_dev->buffer)) {
+ dev_err(&chip->dev,
+@@ -366,7 +365,7 @@ static int vtpm_proxy_tpm_op_send(struct tpm_chip *chip, u8 *buf, size_t count)
+
+ wake_up_interruptible(&proxy_dev->wq);
+
+- return rc;
++ return 0;
+ }
+
+ static void vtpm_proxy_tpm_op_cancel(struct tpm_chip *chip)
+diff --git a/drivers/char/tpm/xen-tpmfront.c b/drivers/char/tpm/xen-tpmfront.c
+index b150f87f38f5..5a327eb7f63a 100644
+--- a/drivers/char/tpm/xen-tpmfront.c
++++ b/drivers/char/tpm/xen-tpmfront.c
+@@ -173,7 +173,7 @@ static int vtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
+ return -ETIME;
+ }
+
+- return count;
++ return 0;
+ }
+
+ static int vtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+--
+2.22.0
+
diff --git a/patches.drivers/tpm-tpm_i2c_atmel-Return-E2BIG-when-the-transfer-is-.patch b/patches.drivers/tpm-tpm_i2c_atmel-Return-E2BIG-when-the-transfer-is-.patch
new file mode 100644
index 0000000000..d2789b8adb
--- /dev/null
+++ b/patches.drivers/tpm-tpm_i2c_atmel-Return-E2BIG-when-the-transfer-is-.patch
@@ -0,0 +1,41 @@
+From 442601e87a4769a8daba4976ec3afa5222ca211d Mon Sep 17 00:00:00 2001
+From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Date: Fri, 8 Feb 2019 18:30:59 +0200
+Subject: [PATCH] tpm/tpm_i2c_atmel: Return -E2BIG when the transfer is
+ incomplete
+
+References: bsc#1082555
+Patch-mainline: v5.1-rc1
+Git-commit: 442601e87a4769a8daba4976ec3afa5222ca211d
+
+Return -E2BIG when the transfer is incomplete. The upper layer does
+not retry, so not doing that is incorrect behaviour.
+
+Cc: stable@vger.kernel.org
+Fixes: a2871c62e186 ("tpm: Add support for Atmel I2C TPMs")
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
+Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/char/tpm/tpm_i2c_atmel.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
+index 32a8e27c5382..cc4e642d3180 100644
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -69,6 +69,10 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ if (status < 0)
+ return status;
+
++ /* The upper layer does not support incomplete sends. */
++ if (status != len)
++ return -E2BIG;
++
+ return 0;
+ }
+
+--
+2.22.0
+
diff --git a/patches.drivers/tpm-vtpm_proxy-Suppress-error-logging-when-in-closed.patch b/patches.drivers/tpm-vtpm_proxy-Suppress-error-logging-when-in-closed.patch
new file mode 100644
index 0000000000..a2f622cd4d
--- /dev/null
+++ b/patches.drivers/tpm-vtpm_proxy-Suppress-error-logging-when-in-closed.patch
@@ -0,0 +1,57 @@
+From 402149c6470d9562fe6891e0165df7f5f6bff7a7 Mon Sep 17 00:00:00 2001
+From: Stefan Berger <stefanb@linux.vnet.ibm.com>
+Date: Thu, 25 May 2017 18:29:13 -0400
+Subject: [PATCH] tpm: vtpm_proxy: Suppress error logging when in closed state
+
+References: bsc#1082555
+Patch-mainline: v4.13-rc1
+Git-commit: 402149c6470d9562fe6891e0165df7f5f6bff7a7
+
+Suppress the error logging when the core TPM driver sends commands
+to the VTPM proxy driver and -EPIPE is returned in case the VTPM
+proxy driver is 'closed' (closed anonymous file descriptor). This
+error code is only returned by the send function and by tpm_transmit
+when the VTPM proxy driver is being used.
+
+Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
+Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/char/tpm/tpm-interface.c | 5 +++--
+ drivers/char/tpm/tpm2-cmd.c | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index be5415923886..a965a9f0e5d2 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -429,8 +429,9 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+
+ rc = chip->ops->send(chip, (u8 *) buf, count);
+ if (rc < 0) {
+- dev_err(&chip->dev,
+- "tpm_transmit: tpm_send: error %d\n", rc);
++ if (rc != -EPIPE)
++ dev_err(&chip->dev,
++ "%s: tpm_send: error %d\n", __func__, rc);
+ goto out;
+ }
+
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index 3ee6883f26c1..3a9964326279 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -840,7 +840,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
+ /* In places where shutdown command is sent there's no much we can do
+ * except print the error code on a system failure.
+ */
+- if (rc < 0)
++ if (rc < 0 && rc != -EPIPE)
+ dev_warn(&chip->dev, "transmit returned %d while stopping the TPM",
+ rc);
+ }
+--
+2.22.0
+
diff --git a/patches.drivers/usb-host-xhci-rcar-Fix-timeout-in-xhci_suspend.patch b/patches.drivers/usb-host-xhci-rcar-Fix-timeout-in-xhci_suspend.patch
new file mode 100644
index 0000000000..1fcb438dfd
--- /dev/null
+++ b/patches.drivers/usb-host-xhci-rcar-Fix-timeout-in-xhci_suspend.patch
@@ -0,0 +1,50 @@
+From 783bda5e41acc71f98336e1a402c180f9748e5dc Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 2 Aug 2019 17:33:35 +0900
+Subject: [PATCH] usb: host: xhci-rcar: Fix timeout in xhci_suspend()
+Git-commit: 783bda5e41acc71f98336e1a402c180f9748e5dc
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+When a USB device is connected to the host controller and
+the system enters suspend, the following error happens
+in xhci_suspend():
+
+ xhci-hcd ee000000.usb: WARN: xHC CMD_RUN timeout
+
+Since the firmware/internal CPU control the USBSTS.STS_HALT
+and the process speed is down when the roothub port enters U3,
+long delay for the handshake of STS_HALT is neeed in xhci_suspend().
+So, this patch adds to set the XHCI_SLOW_SUSPEND.
+
+Fixes: 435cc1138ec9 ("usb: host: xhci-plat: set resume_quirk() for R-Car controllers")
+Cc: <stable@vger.kernel.org> # v4.12+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1564734815-17964-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/host/xhci-rcar.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/host/xhci-rcar.c
++++ b/drivers/usb/host/xhci-rcar.c
+@@ -191,10 +191,15 @@ int xhci_rcar_init_quirk(struct usb_hcd
+ * pointers. So, this driver clears the AC64 bit of xhci->hcc_params
+ * to call dma_set_coherent_mask(dev, DMA_BIT_MASK(32)) in
+ * xhci_gen_setup().
++ *
++ * And, since the firmware/internal CPU control the USBSTS.STS_HALT
++ * and the process speed is down when the roothub port enters U3,
++ * long delay for the handshake of STS_HALT is neeed in xhci_suspend().
+ */
+ if (xhci_rcar_is_gen2(hcd->self.controller) ||
+- xhci_rcar_is_gen3(hcd->self.controller))
+- xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
++ xhci_rcar_is_gen3(hcd->self.controller)) {
++ xhci->quirks |= XHCI_NO_64BIT_SUPPORT | XHCI_SLOW_SUSPEND;
++ }
+
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ return xhci_rcar_download_firmware(hcd);
diff --git a/patches.drivers/usb-iowarrior-fix-deadlock-on-disconnect.patch b/patches.drivers/usb-iowarrior-fix-deadlock-on-disconnect.patch
new file mode 100644
index 0000000000..5170ecbfb6
--- /dev/null
+++ b/patches.drivers/usb-iowarrior-fix-deadlock-on-disconnect.patch
@@ -0,0 +1,55 @@
+From c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 8 Aug 2019 11:27:28 +0200
+Subject: [PATCH] usb: iowarrior: fix deadlock on disconnect
+Git-commit: c468a8aa790e0dfe0a7f8a39db282d39c2c00b46
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+We have to drop the mutex before we close() upon disconnect()
+as close() needs the lock. This is safe to do by dropping the
+mutex as intfdata is already set to NULL, so open() will fail.
+
+Fixes: 03f36e885fc26 ("USB: open disconnect race in iowarrior")
+Reported-by: syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/misc/iowarrior.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index ba05dd80a020..f5bed9f29e56 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -866,19 +866,20 @@ static void iowarrior_disconnect(struct usb_interface *interface)
+ dev = usb_get_intfdata(interface);
+ mutex_lock(&iowarrior_open_disc_lock);
+ usb_set_intfdata(interface, NULL);
++ /* prevent device read, write and ioctl */
++ dev->present = 0;
+
+ minor = dev->minor;
++ mutex_unlock(&iowarrior_open_disc_lock);
++ /* give back our minor - this will call close() locks need to be dropped at this point*/
+
+- /* give back our minor */
+ usb_deregister_dev(interface, &iowarrior_class);
+
+ mutex_lock(&dev->mutex);
+
+ /* prevent device read, write and ioctl */
+- dev->present = 0;
+
+ mutex_unlock(&dev->mutex);
+- mutex_unlock(&iowarrior_open_disc_lock);
+
+ if (dev->opened) {
+ /* There is a process that holds a filedescriptor to the device ,
+--
+2.16.4
+
diff --git a/patches.drivers/usb-yurex-Fix-use-after-free-in-yurex_delete.patch b/patches.drivers/usb-yurex-Fix-use-after-free-in-yurex_delete.patch
new file mode 100644
index 0000000000..f41b87a83e
--- /dev/null
+++ b/patches.drivers/usb-yurex-Fix-use-after-free-in-yurex_delete.patch
@@ -0,0 +1,160 @@
+From fc05481b2fcabaaeccf63e32ac1baab54e5b6963 Mon Sep 17 00:00:00 2001
+From: Suzuki K Poulose <suzuki.poulose@arm.com>
+Date: Mon, 5 Aug 2019 12:15:28 +0100
+Subject: [PATCH] usb: yurex: Fix use-after-free in yurex_delete
+Git-commit: fc05481b2fcabaaeccf63e32ac1baab54e5b6963
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+syzbot reported the following crash [0]:
+
+Bug: KASAN: use-after-free in usb_free_coherent+0x79/0x80
+drivers/usb/core/usb.c:928
+Read of size 8 at addr ffff8881b18599c8 by task syz-executor.4/16007
+
+Cpu: 0 PID: 16007 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #23
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xca/0x13e lib/dump_stack.c:113
+ print_address_description+0x6a/0x32c mm/kasan/report.c:351
+ __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482
+ kasan_report+0xe/0x12 mm/kasan/common.c:612
+ usb_free_coherent+0x79/0x80 drivers/usb/core/usb.c:928
+ yurex_delete+0x138/0x330 drivers/usb/misc/yurex.c:100
+ kref_put include/linux/kref.h:65 [inline]
+ yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392
+ __fput+0x2d7/0x840 fs/file_table.c:280
+ task_work_run+0x13f/0x1c0 kernel/task_work.c:113
+ tracehook_notify_resume include/linux/tracehook.h:188 [inline]
+ exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
+ prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
+ syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
+ do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+Rip: 0033:0x413511
+Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48
+83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48
+89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
+Rsp: 002b:00007ffc424ea2e0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
+Rax: 0000000000000000 RBX: 0000000000000007 RCX: 0000000000413511
+Rdx: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
+Rbp: 0000000000000001 R08: 0000000029a2fc22 R09: 0000000029a2fc26
+R10: 00007ffc424ea3c0 R11: 0000000000000293 R12: 000000000075c9a0
+R13: 000000000075c9a0 R14: 0000000000761938 R15: ffffffffffffffff
+
+Allocated by task 2776:
+ save_stack+0x1b/0x80 mm/kasan/common.c:69
+ set_track mm/kasan/common.c:77 [inline]
+ __kasan_kmalloc mm/kasan/common.c:487 [inline]
+ __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:460
+ kmalloc include/linux/slab.h:552 [inline]
+ kzalloc include/linux/slab.h:748 [inline]
+ usb_alloc_dev+0x51/0xf95 drivers/usb/core/usb.c:583
+ hub_port_connect drivers/usb/core/hub.c:5004 [inline]
+ hub_port_connect_change drivers/usb/core/hub.c:5213 [inline]
+ port_event drivers/usb/core/hub.c:5359 [inline]
+ hub_event+0x15c0/0x3640 drivers/usb/core/hub.c:5441
+ process_one_work+0x92b/0x1530 kernel/workqueue.c:2269
+ worker_thread+0x96/0xe20 kernel/workqueue.c:2415
+ kthread+0x318/0x420 kernel/kthread.c:255
+ ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
+
+Freed by task 16007:
+ save_stack+0x1b/0x80 mm/kasan/common.c:69
+ set_track mm/kasan/common.c:77 [inline]
+ __kasan_slab_free+0x130/0x180 mm/kasan/common.c:449
+ slab_free_hook mm/slub.c:1423 [inline]
+ slab_free_freelist_hook mm/slub.c:1470 [inline]
+ slab_free mm/slub.c:3012 [inline]
+ kfree+0xe4/0x2f0 mm/slub.c:3953
+ device_release+0x71/0x200 drivers/base/core.c:1064
+ kobject_cleanup lib/kobject.c:693 [inline]
+ kobject_release lib/kobject.c:722 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0x171/0x280 lib/kobject.c:739
+ put_device+0x1b/0x30 drivers/base/core.c:2213
+ usb_put_dev+0x1f/0x30 drivers/usb/core/usb.c:725
+ yurex_delete+0x40/0x330 drivers/usb/misc/yurex.c:95
+ kref_put include/linux/kref.h:65 [inline]
+ yurex_release+0x66/0x90 drivers/usb/misc/yurex.c:392
+ __fput+0x2d7/0x840 fs/file_table.c:280
+ task_work_run+0x13f/0x1c0 kernel/task_work.c:113
+ tracehook_notify_resume include/linux/tracehook.h:188 [inline]
+ exit_to_usermode_loop+0x1d2/0x200 arch/x86/entry/common.c:163
+ prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
+ syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
+ do_syscall_64+0x45f/0x580 arch/x86/entry/common.c:299
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The buggy address belongs to the object at ffff8881b1859980
+ which belongs to the cache kmalloc-2k of size 2048
+The buggy address is located 72 bytes inside of
+ 2048-byte region [ffff8881b1859980, ffff8881b185a180)
+The buggy address belongs to the page:
+page:ffffea0006c61600 refcount:1 mapcount:0 mapping:ffff8881da00c000
+index:0x0 compound_mapcount: 0
+Flags: 0x200000000010200(slab|head)
+Raw: 0200000000010200 0000000000000000 0000000100000001 ffff8881da00c000
+Raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8881b1859880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+ ffff8881b1859900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
+> ffff8881b1859980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff8881b1859a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8881b1859a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+
+A quick look at the yurex_delete() shows that we drop the reference
+to the usb_device before releasing any buffers associated with the
+device. Delay the reference drop until we have finished the cleanup.
+
+[0] https://lore.kernel.org/lkml/0000000000003f86d8058f0bd671@google.com/
+
+Fixes: 6bc235a2e24a5e ("USB: add driver for Meywa-Denki & Kayac YUREX")
+Cc: Jiri Kosina <jkosina@suse.cz>
+Cc: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
+Cc: Oliver Neukum <oneukum@suse.com>
+Cc: andreyknvl@google.com
+Cc: gregkh@linuxfoundation.org
+Cc: Alan Stern <stern@rowland.harvard.edu>
+Cc: syzkaller-bugs@googlegroups.com
+Cc: dtor@chromium.org
+Reported-by: syzbot+d1fedb1c1fdb07fca507@syzkaller.appspotmail.com
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20190805111528.6758-1-suzuki.poulose@arm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/misc/yurex.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
+index 7b306aa22d25..6715a128e6c8 100644
+--- a/drivers/usb/misc/yurex.c
++++ b/drivers/usb/misc/yurex.c
+@@ -92,7 +92,6 @@ static void yurex_delete(struct kref *kref)
+
+ dev_dbg(&dev->interface->dev, "%s\n", __func__);
+
+- usb_put_dev(dev->udev);
+ if (dev->cntl_urb) {
+ usb_kill_urb(dev->cntl_urb);
+ kfree(dev->cntl_req);
+@@ -108,6 +107,7 @@ static void yurex_delete(struct kref *kref)
+ dev->int_buffer, dev->urb->transfer_dma);
+ usb_free_urb(dev->urb);
+ }
++ usb_put_dev(dev->udev);
+ kfree(dev);
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/watchdog-core-fix-null-pointer-dereference-when-rele.patch b/patches.drivers/watchdog-core-fix-null-pointer-dereference-when-rele.patch
new file mode 100644
index 0000000000..448fb4d6cc
--- /dev/null
+++ b/patches.drivers/watchdog-core-fix-null-pointer-dereference-when-rele.patch
@@ -0,0 +1,48 @@
+From 953b9dd7725bad55a922a35e75bff7bebf7b9978 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 28 Aug 2018 12:13:47 +0200
+Subject: [PATCH] watchdog: core: fix null pointer dereference when releasing cdev
+Git-commit: 953b9dd7725bad55a922a35e75bff7bebf7b9978
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+watchdog_stop() calls watchdog_update_worker() which needs a valid
+wdd->wd_data pointer. So, when unregistering the cdev, clear the
+pointers after we call watchdog_stop(), not before.
+
+Fixes: bb292ac1c602 ("watchdog: Introduce watchdog_stop_on_unregister helper")
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/watchdog/watchdog_dev.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -984,16 +984,16 @@ static void watchdog_cdev_unregister(str
+ old_wd_data = NULL;
+ }
+
+- mutex_lock(&wd_data->lock);
+- wd_data->wdd = NULL;
+- wdd->wd_data = NULL;
+- mutex_unlock(&wd_data->lock);
+-
+ if (watchdog_active(wdd) &&
+ test_bit(WDOG_STOP_ON_UNREGISTER, &wdd->status)) {
+ watchdog_stop(wdd);
+ }
+
++ mutex_lock(&wd_data->lock);
++ wd_data->wdd = NULL;
++ wdd->wd_data = NULL;
++ mutex_unlock(&wd_data->lock);
++
+ cancel_delayed_work_sync(&wd_data->work);
+
+ kref_put(&wd_data->kref, watchdog_core_data_release);
diff --git a/patches.drivers/watchdog-f71808e_wdt-fix-F81866-bit-operation.patch b/patches.drivers/watchdog-f71808e_wdt-fix-F81866-bit-operation.patch
new file mode 100644
index 0000000000..964d8ffadf
--- /dev/null
+++ b/patches.drivers/watchdog-f71808e_wdt-fix-F81866-bit-operation.patch
@@ -0,0 +1,58 @@
+From e347afa5fb488132be61f1222e4cf6b87255021c Mon Sep 17 00:00:00 2001
+From: "Ji-Ze Hong (Peter Hong)" <hpeter@gmail.com>
+Date: Wed, 27 Mar 2019 14:42:51 +0800
+Subject: [PATCH] watchdog: f71808e_wdt: fix F81866 bit operation
+Git-commit: e347afa5fb488132be61f1222e4cf6b87255021c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Fix error bit operation in watchdog_start()
+
+Fixes: 14b24a88a3660 ("watchdog: f71808e_wdt: Add F81866 support")
+Signed-off-by: Ji-Ze Hong (Peter Hong) <hpeter+linux_kernel@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/watchdog/f71808e_wdt.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/watchdog/f71808e_wdt.c
++++ b/drivers/watchdog/f71808e_wdt.c
+@@ -329,6 +329,8 @@ static int f71862fg_pin_configure(unsign
+
+ static int watchdog_start(void)
+ {
++ u8 tmp;
++
+ /* Make sure we don't die as soon as the watchdog is enabled below */
+ int err = watchdog_keepalive();
+ if (err)
+@@ -376,19 +378,18 @@ static int watchdog_start(void)
+ break;
+
+ case f81866:
+- /* Set pin 70 to WDTRST# */
+- superio_clear_bit(watchdog.sioaddr, SIO_F81866_REG_PORT_SEL,
+- BIT(3) | BIT(0));
+- superio_set_bit(watchdog.sioaddr, SIO_F81866_REG_PORT_SEL,
+- BIT(2));
+ /*
+ * GPIO1 Control Register when 27h BIT3:2 = 01 & BIT0 = 0.
+ * The PIN 70(GPIO15/WDTRST) is controlled by 2Ch:
+ * BIT5: 0 -> WDTRST#
+ * 1 -> GPIO15
+ */
+- superio_clear_bit(watchdog.sioaddr, SIO_F81866_REG_GPIO1,
+- BIT(5));
++ tmp = superio_inb(watchdog.sioaddr, SIO_F81866_REG_PORT_SEL);
++ tmp &= ~(BIT(3) | BIT(0));
++ tmp |= BIT(2);
++ superio_outb(watchdog.sioaddr, SIO_F81866_REG_PORT_SEL, tmp);
++
++ superio_clear_bit(watchdog.sioaddr, SIO_F81866_REG_GPIO1, 5);
+ break;
+
+ default:
diff --git a/patches.drm/drm-i915-userptr-Acquire-the-page-lock-around-set_pa.patch b/patches.drm/drm-i915-userptr-Acquire-the-page-lock-around-set_pa.patch
deleted file mode 100644
index 02b297e411..0000000000
--- a/patches.drm/drm-i915-userptr-Acquire-the-page-lock-around-set_pa.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From aa56a292ce623734ddd30f52d73f527d1f3529b5 Mon Sep 17 00:00:00 2001
-From: Chris Wilson <chris@chris-wilson.co.uk>
-Date: Mon, 8 Jul 2019 15:03:27 +0100
-Subject: [PATCH] drm/i915/userptr: Acquire the page lock around set_page_dirty()
-Git-commit: aa56a292ce623734ddd30f52d73f527d1f3529b5
-Patch-mainline: v5.3-rc3
-No-fix: cb6d7c7dc7ff8cace666ddec66334117a6068ce2
-References: bsc#1051510
-
-set_page_dirty says:
-
- For pages with a mapping this should be done under the page lock
- for the benefit of asynchronous memory errors who prefer a
- consistent dirty state. This rule can be broken in some special
- cases, but should be better not to.
-
-Under those rules, it is only safe for us to use the plain set_page_dirty
-calls for shmemfs/anonymous memory. Userptr may be used with real
-mappings and so needs to use the locked version (set_page_dirty_lock).
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203317
-Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl")
-References: 6dcc693bc57f ("ext4: warn when page is dirtied without buffers")
-Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Cc: stable@vger.kernel.org
-Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20190708140327.26825-1-chris@chris-wilson.co.uk
-(cherry picked from commit cb6d7c7dc7ff8cace666ddec66334117a6068ce2)
-
-Signed-off-by: Jani Nikula <jani.nikula@intel.com>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/i915/i915_gem_userptr.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
---- a/drivers/gpu/drm/i915/i915_gem_userptr.c
-+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
-@@ -703,7 +703,15 @@ i915_gem_userptr_put_pages(struct drm_i9
-
- for_each_sgt_page(page, sgt_iter, pages) {
- if (obj->mm.dirty)
-- set_page_dirty(page);
-+ /*
-+ * As this may not be anonymous memory (e.g. shmem)
-+ * but exist on a real mapping, we have to lock
-+ * the page in order to dirty it -- holding
-+ * the page reference is not sufficient to
-+ * prevent the inode from being truncated.
-+ * Play safe and take the lock.
-+ */
-+ set_page_dirty_lock(page);
-
- mark_page_accessed(page);
- put_page(page);
diff --git a/patches.drm/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch b/patches.drm/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
new file mode 100644
index 0000000000..ea75de0ce6
--- /dev/null
+++ b/patches.drm/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
@@ -0,0 +1,43 @@
+From 6b7c3b86f0b63134b2ab56508921a0853ffa687a Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 24 Jun 2019 09:39:59 -0700
+Subject: [PATCH] drm/vmwgfx: fix memory leak when too many retries have occurred
+Git-commit: 6b7c3b86f0b63134b2ab56508921a0853ffa687a
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+Currently when too many retries have occurred there is a memory
+leak on the allocation for reply on the error return path. Fix
+this by kfree'ing reply before returning.
+
+Addresses-coverity: ("Resource leak")
+Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+index e4e09d47c5c0..59e9d05ab928 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+@@ -389,8 +389,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg,
+ break;
+ }
+
+- if (retries == RETRIES)
++ if (retries == RETRIES) {
++ kfree(reply);
+ return -EINVAL;
++ }
+
+ *msg_len = reply_len;
+ *msg = reply;
+--
+2.16.4
+
diff --git a/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch b/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
index ca0ac6e584..ceb01837a8 100644
--- a/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
+++ b/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
@@ -104,11 +104,11 @@ Signed-off-by: David Sterba <dsterba@suse.com>
---
fs/btrfs/delayed-ref.c | 14 ++++----------
fs/btrfs/delayed-ref.h | 11 -----------
- fs/btrfs/extent-tree.c | 3 ---
+ fs/btrfs/extent-tree.c | 4 ----
fs/btrfs/qgroup.c | 19 +++++++++++++++----
fs/btrfs/qgroup.h | 18 +++++++++++-------
include/trace/events/btrfs.h | 29 -----------------------------
- 6 files changed, 30 insertions(+), 64 deletions(-)
+ 6 files changed, 30 insertions(+), 65 deletions(-)
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -181,16 +181,17 @@ Signed-off-by: David Sterba <dsterba@suse.com>
* until the delayed ref is processed. must_insert_reserved is
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
-@@ -2563,9 +2563,6 @@ static int cleanup_ref_head(struct btrfs
+@@ -2519,10 +2519,6 @@ void btrfs_cleanup_ref_head_accounting(s
+ spin_unlock(&delayed_refs->lock);
}
}
-
+-
- /* Also free its reserved qgroup space */
- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
- head->qgroup_reserved);
- btrfs_delayed_ref_unlock(head);
- btrfs_put_delayed_ref_head(head);
- return 0;
+ }
+
+ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1488,12 +1488,18 @@ int btrfs_qgroup_trace_extent_nolock(str
diff --git a/patches.fixes/0001-s390-qeth-be-drop-monitor-friendly.patch b/patches.fixes/0001-s390-qeth-be-drop-monitor-friendly.patch
index 0044fa0983..456efdec9d 100644
--- a/patches.fixes/0001-s390-qeth-be-drop-monitor-friendly.patch
+++ b/patches.fixes/0001-s390-qeth-be-drop-monitor-friendly.patch
@@ -1,8 +1,9 @@
From: Julian Wiedmann <jwi@linux.ibm.com>
+Date: Mon, 18 Mar 2019 16:40:56 +0100
Subject: s390/qeth: be drop monitor friendly
Git-commit: 104b48592b5441c722dcd95c38ab9300f2d94856
Patch-mainline: v5.1-rc3
-References: bsc#1142115 LTC#179337
+References: bsc#1142220 LTC#179335
As part of the TX completion path, qeth_release_skbs() frees the completed
skbs with __skb_queue_purge(). This ends in kfree_skb(), reporting every
@@ -17,18 +18,16 @@ packets in the tx_errors statistics.
Fixes: dc149e3764d8 ("s390/qeth: replace open-coded skb_queue_walk()")
Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
---
- drivers/s390/net/qeth_core_main.c | 5 ++++-
- drivers/s390/net/qeth_l2_main.c | 3 +--
- drivers/s390/net/qeth_l3_main.c | 3 +--
+ drivers/s390/net/qeth_core_main.c | 5 ++++-
+ drivers/s390/net/qeth_l2_main.c | 3 +--
+ drivers/s390/net/qeth_l3_main.c | 3 +--
3 files changed, 6 insertions(+), 5 deletions(-)
-diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
-index d7ca9c81edde..253ff106c928 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
-@@ -1166,13 +1166,16 @@ static void qeth_notify_skbs(struct qeth_qdio_out_q *q,
+@@ -1198,13 +1198,16 @@ static void qeth_notify_skbs(struct qeth
static void qeth_release_skbs(struct qeth_qdio_out_buffer *buf)
{
@@ -46,11 +45,9 @@ index d7ca9c81edde..253ff106c928 100644
}
static void qeth_clear_output_buffer(struct qeth_qdio_out_q *queue,
-diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
-index 9a203dbf0cc9..413f7a355579 100644
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
-@@ -730,8 +730,7 @@ static netdev_tx_t qeth_l2_hard_start_xmit(struct sk_buff *skb,
+@@ -730,8 +730,7 @@ static netdev_tx_t qeth_l2_hard_start_xm
tx_drop:
card->stats.tx_dropped++;
@@ -60,11 +57,9 @@ index 9a203dbf0cc9..413f7a355579 100644
netif_wake_queue(dev);
return NETDEV_TX_OK;
}
-diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
-index a71f396e3e9d..e55706184378 100644
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
-@@ -2229,8 +2229,7 @@ static netdev_tx_t qeth_l3_hard_start_xmit(struct sk_buff *skb,
+@@ -2229,8 +2229,7 @@ static netdev_tx_t qeth_l3_hard_start_xm
tx_drop:
card->stats.tx_dropped++;
@@ -74,6 +69,3 @@ index a71f396e3e9d..e55706184378 100644
netif_wake_queue(dev);
return NETDEV_TX_OK;
}
---
-2.21.0
-
diff --git a/patches.fixes/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch b/patches.fixes/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch
new file mode 100644
index 0000000000..a1982273ad
--- /dev/null
+++ b/patches.fixes/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch
@@ -0,0 +1,46 @@
+Patch-mainline: v5.3-rc3
+Git-commit: 50f6393f9654c561df4cdcf8e6cfba7260143601
+References: bsc#1065600
+From: Juergen Gross <jgross@suse.com>
+Date: Fri, 14 Jun 2019 07:46:02 +0200
+Subject: [PATCH] xen/swiotlb: fix condition for calling
+ xen_destroy_contiguous_region()
+
+The condition in xen_swiotlb_free_coherent() for deciding whether to
+call xen_destroy_contiguous_region() is wrong: in case the region to
+be freed is not contiguous calling xen_destroy_contiguous_region() is
+the wrong thing to do: it would result in inconsistent mappings of
+multiple PFNs to the same MFN. This will lead to various strange
+crashes or data corruption.
+
+Instead of calling xen_destroy_contiguous_region() in that case a
+warning should be issued as that situation should never occur.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
+Reviewed-by: Jan Beulich <jbeulich@suse.com>
+Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ drivers/xen/swiotlb-xen.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c
+index d53f3493a6b9..50fd7de54969 100644
+--- a/drivers/xen/swiotlb-xen.c
++++ b/drivers/xen/swiotlb-xen.c
+@@ -361,8 +361,8 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+ /* Convert the size to actually allocated. */
+ size = 1UL << (order + XEN_PAGE_SHIFT);
+
+- if (((dev_addr + size - 1 <= dma_mask)) ||
+- range_straddles_page_boundary(phys, size))
++ if (!WARN_ON((dev_addr + size - 1 > dma_mask) ||
++ range_straddles_page_boundary(phys, size)))
+ xen_destroy_contiguous_region(phys, order);
+
+ xen_free_coherent_pages(hwdev, size, vaddr, (dma_addr_t)phys, attrs);
+--
+2.16.4
+
diff --git a/patches.fixes/NFS-Fix-the-inode-request-accounting-when-pages-have.patch b/patches.fixes/NFS-Fix-the-inode-request-accounting-when-pages-have.patch
new file mode 100644
index 0000000000..b2a8a61880
--- /dev/null
+++ b/patches.fixes/NFS-Fix-the-inode-request-accounting-when-pages-have.patch
@@ -0,0 +1,79 @@
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Tue, 18 Jul 2017 15:22:12 -0400
+Subject: [PATCH] NFS: Fix the inode request accounting when pages have
+ subrequests
+Git-commit: b66aaa8dfeda7b5c7df513cf3b36e1290fa84055
+Patch-mainline: v4.14
+References: bsc#1140012
+
+Both nfs_destroy_unlinked_subrequests() and nfs_lock_and_join_requests()
+manipulate the inode flags adjusting the NFS_I(inode)->nrequests.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Acked-by: NeilBrown <neilb@suse.com>
+
+---
+ fs/nfs/write.c | 27 +++++++++++++++------------
+ 1 file changed, 15 insertions(+), 12 deletions(-)
+
+--- a/fs/nfs/write.c
++++ b/fs/nfs/write.c
+@@ -362,7 +362,8 @@ nfs_unroll_locks_and_wait(struct inode *
+ */
+ static void
+ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,
+- struct nfs_page *old_head)
++ struct nfs_page *old_head,
++ struct inode *inode)
+ {
+ while (destroy_list) {
+ struct nfs_page *subreq = destroy_list;
+@@ -387,9 +388,12 @@ nfs_destroy_unlinked_subrequests(struct
+ nfs_page_group_clear_bits(subreq);
+
+ /* release the PG_INODE_REF reference */
+- if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags))
++ if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags)) {
+ nfs_release_request(subreq);
+- else
++ spin_lock(&inode->i_lock);
++ NFS_I(inode)->nrequests--;
++ spin_unlock(&inode->i_lock);
++ } else
+ WARN_ON_ONCE(1);
+ } else {
+ WARN_ON_ONCE(test_bit(PG_CLEAN, &subreq->wb_flags));
+@@ -518,25 +522,24 @@ try_again:
+ head->wb_bytes = total_bytes;
+ }
+
++ /* Postpone destruction of this request */
++ if (test_and_clear_bit(PG_REMOVE, &head->wb_flags)) {
++ set_bit(PG_INODE_REF, &head->wb_flags);
++ kref_get(&head->wb_kref);
++ NFS_I(inode)->nrequests++;
++ }
++
+ /*
+ * prepare head request to be added to new pgio descriptor
+ */
+ nfs_page_group_clear_bits(head);
+
+- /*
+- * some part of the group was still on the inode list - otherwise
+- * the group wouldn't be involved in async write.
+- * grab a reference for the head request, iff it needs one.
+- */
+- if (!test_and_set_bit(PG_INODE_REF, &head->wb_flags))
+- kref_get(&head->wb_kref);
+-
+ nfs_page_group_unlock(head);
+
+ /* drop lock to clean uprequests on destroy list */
+ spin_unlock(&inode->i_lock);
+
+- nfs_destroy_unlinked_subrequests(destroy_list, head);
++ nfs_destroy_unlinked_subrequests(destroy_list, head, inode);
+
+ /* still holds ref on head from nfs_page_find_head_request_locked
+ * and still has lock on head from lock loop */
diff --git a/patches.fixes/crypto-ccp-Fix-oops-by-properly-managing-allocated-s.patch b/patches.fixes/crypto-ccp-Fix-oops-by-properly-managing-allocated-s.patch
new file mode 100644
index 0000000000..7023bcb024
--- /dev/null
+++ b/patches.fixes/crypto-ccp-Fix-oops-by-properly-managing-allocated-s.patch
@@ -0,0 +1,43 @@
+From 25e44338321af545ab34243a6081c3f0fc6107d0 Mon Sep 17 00:00:00 2001
+From: Gary R Hook <gary.hook@amd.com>
+Date: Tue, 30 Jul 2019 16:05:22 +0000
+Subject: [PATCH] crypto: ccp - Fix oops by properly managing allocated structures
+Git-commit: 25e44338321af545ab34243a6081c3f0fc6107d0
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+A plaintext or ciphertext length of 0 is allowed in AES, in which case
+no encryption occurs. Ensure that we don't clean up data structures
+that were never allocated.
+
+Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/ccp/ccp-ops.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index 3ebe031773d5..59f9849c3662 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -859,11 +859,11 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ ccp_dm_free(&final_wa);
+
+ e_dst:
+- if (aes->src_len && !in_place)
++ if (ilen > 0 && !in_place)
+ ccp_free_data(&dst, cmd_q);
+
+ e_src:
+- if (aes->src_len)
++ if (ilen > 0)
+ ccp_free_data(&src, cmd_q);
+
+ e_aad:
+--
+2.16.4
+
diff --git a/patches.fixes/crypto-ccp-Ignore-tag-length-when-decrypting-GCM-cip.patch b/patches.fixes/crypto-ccp-Ignore-tag-length-when-decrypting-GCM-cip.patch
new file mode 100644
index 0000000000..a96810345e
--- /dev/null
+++ b/patches.fixes/crypto-ccp-Ignore-tag-length-when-decrypting-GCM-cip.patch
@@ -0,0 +1,38 @@
+From e2664ecbb2f26225ac6646876f2899558ffb2604 Mon Sep 17 00:00:00 2001
+From: Gary R Hook <gary.hook@amd.com>
+Date: Tue, 30 Jul 2019 16:05:26 +0000
+Subject: [PATCH] crypto: ccp - Ignore tag length when decrypting GCM ciphertext
+Git-commit: e2664ecbb2f26225ac6646876f2899558ffb2604
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+AES GCM input buffers for decryption contain AAD+CTEXT+TAG. Only
+decrypt the ciphertext, and use the tag for comparison.
+
+Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Gary R Hook <gary.hook@amd.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/crypto/ccp/ccp-ops.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
+index ef723e2722a8..76e1b4dcd193 100644
+--- a/drivers/crypto/ccp/ccp-ops.c
++++ b/drivers/crypto/ccp/ccp-ops.c
+@@ -782,8 +782,7 @@ static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q,
+ while (src.sg_wa.bytes_left) {
+ ccp_prepare_data(&src, &dst, &op, AES_BLOCK_SIZE, true);
+ if (!src.sg_wa.bytes_left) {
+- unsigned int nbytes = aes->src_len
+- % AES_BLOCK_SIZE;
++ unsigned int nbytes = ilen % AES_BLOCK_SIZE;
+
+ if (nbytes) {
+ op.eom = 1;
+--
+2.16.4
+
diff --git a/patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch b/patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch
index 9a90cf0384..e9a6a7bbb9 100644
--- a/patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch
+++ b/patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch
@@ -2,7 +2,8 @@ From: Muchun Song <smuchun@gmail.com>
Date: Sat, 27 Jul 2019 11:21:22 +0800
Subject: [PATCH] driver core: Fix use-after-free and double free on glue
directory
-Patch-mainline: Not yet, submitted https://lkml.org/lkml/2019/7/26/1461
+Git-commit: ac43432cb1f5c2950408534987e57c2071e24d8f
+Patch-mainline: v5.3-rc4
References: bsc#1131281
There is a race condition between removing glue directory and adding a new
diff --git a/patches.fixes/ehea-Fix-a-copy-paste-err-in-ehea_init_port_res.patch b/patches.fixes/ehea-Fix-a-copy-paste-err-in-ehea_init_port_res.patch
new file mode 100644
index 0000000000..05283200b0
--- /dev/null
+++ b/patches.fixes/ehea-Fix-a-copy-paste-err-in-ehea_init_port_res.patch
@@ -0,0 +1,38 @@
+From c8f191282f819ab4e9b47b22a65c6c29734cefce Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 3 Apr 2019 15:47:59 +0800
+Subject: [PATCH] ehea: Fix a copy-paste err in ehea_init_port_res
+Git-commit: c8f191282f819ab4e9b47b22a65c6c29734cefce
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+pr->tx_bytes should be assigned to tx_bytes other than
+rx_bytes.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: ce45b873028f ("ehea: Fixing statistics")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+index 90b62c1412c8..707c8ba120c2 100644
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1463,7 +1463,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr,
+
+ memset(pr, 0, sizeof(struct ehea_port_res));
+
+- pr->tx_bytes = rx_bytes;
++ pr->tx_bytes = tx_bytes;
+ pr->tx_packets = tx_packets;
+ pr->rx_bytes = rx_bytes;
+ pr->rx_packets = rx_packets;
+--
+2.16.4
+
diff --git a/patches.fixes/fsl-fman-Use-GFP_ATOMIC-in-memac-tgec-_add_hash_mac_.patch b/patches.fixes/fsl-fman-Use-GFP_ATOMIC-in-memac-tgec-_add_hash_mac_.patch
new file mode 100644
index 0000000000..92175ddd73
--- /dev/null
+++ b/patches.fixes/fsl-fman-Use-GFP_ATOMIC-in-memac-tgec-_add_hash_mac_.patch
@@ -0,0 +1,75 @@
+From 0d9c9a238faf925823bde866182c663b6d734f2e Mon Sep 17 00:00:00 2001
+From: Scott Wood <oss@buserror.net>
+Date: Thu, 27 Dec 2018 18:29:09 -0600
+Subject: [PATCH] fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
+Git-commit: 0d9c9a238faf925823bde866182c663b6d734f2e
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+These functions are called from atomic context:
+
+[ 9.150239] BUG: sleeping function called from invalid context at /home/scott/git/linux/mm/slab.h:421
+[ 9.158159] in_atomic(): 1, irqs_disabled(): 0, pid: 4432, name: ip
+[ 9.163128] CPU: 8 PID: 4432 Comm: ip Not tainted 4.20.0-rc2-00169-g63d86876f324 #29
+[ 9.163130] Call Trace:
+[ 9.170701] [c0000002e899a980] [c0000000009c1068] .dump_stack+0xa8/0xec (unreliable)
+[ 9.177140] [c0000002e899aa10] [c00000000007a7b4] .___might_sleep+0x138/0x164
+[ 9.184440] [c0000002e899aa80] [c0000000001d5bac] .kmem_cache_alloc_trace+0x238/0x30c
+[ 9.191216] [c0000002e899ab40] [c00000000065ea1c] .memac_add_hash_mac_address+0x104/0x198
+[ 9.199464] [c0000002e899abd0] [c00000000065a788] .set_multi+0x1c8/0x218
+[ 9.206242] [c0000002e899ac80] [c0000000006615ec] .dpaa_set_rx_mode+0xdc/0x17c
+[ 9.213544] [c0000002e899ad00] [c00000000083d2b0] .__dev_set_rx_mode+0x80/0xd4
+[ 9.219535] [c0000002e899ad90] [c00000000083d334] .dev_set_rx_mode+0x30/0x54
+[ 9.225271] [c0000002e899ae10] [c00000000083d4a0] .__dev_open+0x148/0x1c8
+[ 9.230751] [c0000002e899aeb0] [c00000000083d934] .__dev_change_flags+0x19c/0x1e0
+[ 9.230755] [c0000002e899af60] [c00000000083d9a4] .dev_change_flags+0x2c/0x80
+[ 9.242752] [c0000002e899aff0] [c0000000008554ec] .do_setlink+0x350/0xf08
+[ 9.248228] [c0000002e899b170] [c000000000857ad0] .rtnl_newlink+0x588/0x7e0
+[ 9.253965] [c0000002e899b740] [c000000000852424] .rtnetlink_rcv_msg+0x3e0/0x498
+[ 9.261440] [c0000002e899b820] [c000000000884790] .netlink_rcv_skb+0x134/0x14c
+[ 9.267607] [c0000002e899b8e0] [c000000000851840] .rtnetlink_rcv+0x18/0x2c
+[ 9.274558] [c0000002e899b950] [c000000000883c8c] .netlink_unicast+0x214/0x318
+[ 9.281163] [c0000002e899ba00] [c000000000884220] .netlink_sendmsg+0x348/0x444
+[ 9.287076] [c0000002e899bae0] [c00000000080d13c] .sock_sendmsg+0x2c/0x54
+[ 9.287080] [c0000002e899bb50] [c0000000008106c0] .___sys_sendmsg+0x2d0/0x2d8
+[ 9.298375] [c0000002e899bd30] [c000000000811a80] .__sys_sendmsg+0x5c/0xb0
+[ 9.303939] [c0000002e899be20] [c0000000000006b0] system_call+0x60/0x6c
+
+Signed-off-by: Scott Wood <oss@buserror.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ethernet/freescale/fman/fman_memac.c | 2 +-
+ drivers/net/ethernet/freescale/fman/fman_tgec.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index bc6eb30aa20f..41c6fa200e74 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -928,7 +928,7 @@ int memac_add_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr)
+ hash = get_mac_addr_hash_code(addr) & HASH_CTRL_ADDR_MASK;
+
+ /* Create element to be added to the driver hash table */
+- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
+ if (!hash_entry)
+ return -ENOMEM;
+ hash_entry->addr = addr;
+diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+index 40705938eecc..f75b9c11b2d2 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c
++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c
+@@ -553,7 +553,7 @@ int tgec_add_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr)
+ hash = (crc >> TGEC_HASH_MCAST_SHIFT) & TGEC_HASH_ADR_MSK;
+
+ /* Create element to be added to the driver hash table */
+- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL);
++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC);
+ if (!hash_entry)
+ return -ENOMEM;
+ hash_entry->addr = addr;
+--
+2.16.4
+
diff --git a/patches.fixes/jbd2-flush_descriptor-Do-not-decrease-buffer-head-s-ref-count.patch b/patches.fixes/jbd2-flush_descriptor-Do-not-decrease-buffer-head-s-ref-count.patch
new file mode 100644
index 0000000000..599f825761
--- /dev/null
+++ b/patches.fixes/jbd2-flush_descriptor-Do-not-decrease-buffer-head-s-ref-count.patch
@@ -0,0 +1,61 @@
+From: Chandan Rajendra <chandan@linux.ibm.com>
+Subject: [PATCH V2] jbd2: flush_descriptor(): Do not decrease buffer head's ref count
+Patch-mainline: Not yet, in ext4 tree
+References: bsc#1143843
+
+When executing generic/388 on a ppc64le machine, we notice the following
+call trace,
+
+VFS: brelse: Trying to free free buffer
+WARNING: CPU: 0 PID: 6637 at /root/repos/linux/fs/buffer.c:1195 __brelse+0x84/0xc0
+
+Call Trace:
+ __brelse+0x80/0xc0 (unreliable)
+ invalidate_bh_lru+0x78/0xc0
+ on_each_cpu_mask+0xa8/0x130
+ on_each_cpu_cond_mask+0x130/0x170
+ invalidate_bh_lrus+0x44/0x60
+ invalidate_bdev+0x38/0x70
+ ext4_put_super+0x294/0x560
+ generic_shutdown_super+0xb0/0x170
+ kill_block_super+0x38/0xb0
+ deactivate_locked_super+0xa4/0xf0
+ cleanup_mnt+0x164/0x1d0
+ task_work_run+0x110/0x160
+ do_notify_resume+0x414/0x460
+ ret_from_except_lite+0x70/0x74
+
+The warning happens because flush_descriptor() drops bh reference it
+does not own. The bh reference acquired by
+jbd2_journal_get_descriptor_buffer() is owned by the log_bufs list and
+gets released when this list is processed. The reference for doing IO is
+only acquired in write_dirty_buffer() later in flush_descriptor().
+
+Reported-by: Harish Sriram <harish@linux.ibm.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Chandan Rajendra <chandan@linux.ibm.com>
+Acked-by: Jan Kara <jack@suse.cz>
+---
+ fs/jbd2/revoke.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/jbd2/revoke.c b/fs/jbd2/revoke.c
+index 69b9bc329964..f08073d7bbf5 100644
+--- a/fs/jbd2/revoke.c
++++ b/fs/jbd2/revoke.c
+@@ -638,10 +638,8 @@ static void flush_descriptor(journal_t *journal,
+ {
+ jbd2_journal_revoke_header_t *header;
+
+- if (is_journal_aborted(journal)) {
+- put_bh(descriptor);
++ if (is_journal_aborted(journal))
+ return;
+- }
+
+ header = (jbd2_journal_revoke_header_t *)descriptor->b_data;
+ header->r_count = cpu_to_be32(offset);
+--
+2.19.1
+
+
diff --git a/patches.fixes/sched-fair-Don-t-free-p-numa_faults-with-concurrent-.patch b/patches.fixes/sched-fair-Don-t-free-p-numa_faults-with-concurrent-.patch
new file mode 100644
index 0000000000..23b53dbdd0
--- /dev/null
+++ b/patches.fixes/sched-fair-Don-t-free-p-numa_faults-with-concurrent-.patch
@@ -0,0 +1,141 @@
+From 497f3fac6f3ed3ca78e485df41829c94661735a2 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 16 Jul 2019 17:20:45 +0200
+Subject: [PATCH] sched/fair: Don't free p->numa_faults with concurrent
+ readers
+Patch-mainline: v5.3-rc2
+Git-commit: 16d51a590a8ce3befb1308e0e7ab77f3b661af33
+References: bsc#1144920
+
+When going through execve(), zero out the NUMA fault statistics instead of
+freeing them.
+
+During execve, the task is reachable through procfs and the scheduler. A
+concurrent /proc/*/sched reader can read data from a freed ->numa_faults
+allocation (confirmed by KASAN) and write it back to userspace.
+I believe that it would also be possible for a use-after-free read to occur
+through a race between a NUMA fault and execve(): task_numa_fault() can
+lead to task_numa_compare(), which invokes task_weight() on the currently
+running task of a different CPU.
+
+Another way to fix this would be to make ->numa_faults RCU-managed or add
+extra locking, but it seems easier to wipe the NUMA fault statistics on
+execve.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will@kernel.org>
+Fixes: 82727018b0d3 ("sched/numa: Call task_numa_free() from do_execve()")
+Link: https://lkml.kernel.org/r/20190716152047.14424-1-jannh@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Matt Fleming <mfleming@suse.de>
+---
+ fs/exec.c | 2 +-
+ include/linux/sched/numa_balancing.h | 4 ++--
+ kernel/fork.c | 2 +-
+ kernel/sched/fair.c | 24 ++++++++++++++++++++----
+ 4 files changed, 24 insertions(+), 8 deletions(-)
+
+diff --git a/fs/exec.c b/fs/exec.c
+index 04d473edbd1a..1eb10ef0792b 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1795,7 +1795,7 @@ static int do_execveat_common(int fd, struct filename *filename,
+ current->fs->in_exec = 0;
+ current->in_execve = 0;
+ acct_update_integrals(current);
+- task_numa_free(current);
++ task_numa_free(current, false);
+ free_bprm(bprm);
+ kfree(pathbuf);
+ putname(filename);
+diff --git a/include/linux/sched/numa_balancing.h b/include/linux/sched/numa_balancing.h
+index 35d5fc77b4be..fbb107f3afcd 100644
+--- a/include/linux/sched/numa_balancing.h
++++ b/include/linux/sched/numa_balancing.h
+@@ -18,7 +18,7 @@
+ extern void task_numa_fault(int last_node, int node, int pages, int flags);
+ extern pid_t task_numa_group_id(struct task_struct *p);
+ extern void set_numabalancing_state(bool enabled);
+-extern void task_numa_free(struct task_struct *p);
++extern void task_numa_free(struct task_struct *p, bool final);
+ extern bool should_numa_migrate_memory(struct task_struct *p, struct page *page,
+ int src_nid, int dst_cpu);
+ #else
+@@ -33,7 +33,7 @@ static inline pid_t task_numa_group_id(struct task_struct *p)
+ static inline void set_numabalancing_state(bool enabled)
+ {
+ }
+-static inline void task_numa_free(struct task_struct *p)
++static inline void task_numa_free(struct task_struct *p, bool final)
+ {
+ }
+ static inline bool should_numa_migrate_memory(struct task_struct *p,
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 75ee3bcd22ff..11a880b869a9 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -461,7 +461,7 @@ void __put_task_struct(struct task_struct *tsk)
+ WARN_ON(tsk == current);
+
+ cgroup_free(tsk);
+- task_numa_free(tsk);
++ task_numa_free(tsk, true);
+ security_task_free(tsk);
+ exit_creds(tsk);
+ delayacct_tsk_free(tsk);
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 6df619254579..cdf90892937a 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -2347,13 +2347,23 @@ static void task_numa_group(struct task_struct *p, int cpupid, int flags,
+ return;
+ }
+
+-void task_numa_free(struct task_struct *p)
++/*
++ * Get rid of NUMA staticstics associated with a task (either current or dead).
++ * If @final is set, the task is dead and has reached refcount zero, so we can
++ * safely free all relevant data structures. Otherwise, there might be
++ * concurrent reads from places like load balancing and procfs, and we should
++ * reset the data back to default state without freeing ->numa_faults.
++ */
++void task_numa_free(struct task_struct *p, bool final)
+ {
+ struct numa_group *grp = p->numa_group;
+- void *numa_faults = p->numa_faults;
++ unsigned long *numa_faults = p->numa_faults;
+ unsigned long flags;
+ int i;
+
++ if (!numa_faults)
++ return;
++
+ if (grp) {
+ spin_lock_irqsave(&grp->lock, flags);
+ for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
+@@ -2366,8 +2376,14 @@ void task_numa_free(struct task_struct *p)
+ put_numa_group(grp);
+ }
+
+- p->numa_faults = NULL;
+- kfree(numa_faults);
++ if (final) {
++ p->numa_faults = NULL;
++ kfree(numa_faults);
++ } else {
++ p->total_numa_faults = 0;
++ for (i = 0; i < NR_NUMA_HINT_FAULT_STATS * nr_node_ids; i++)
++ numa_faults[i] = 0;
++ }
+ }
+
+ /*
+--
+2.13.7
+
diff --git a/patches.fixes/sched-fair-Use-RCU-accessors-consistently-for-numa_g.patch b/patches.fixes/sched-fair-Use-RCU-accessors-consistently-for-numa_g.patch
new file mode 100644
index 0000000000..f6b1b8847f
--- /dev/null
+++ b/patches.fixes/sched-fair-Use-RCU-accessors-consistently-for-numa_g.patch
@@ -0,0 +1,385 @@
+From f4633b4f7f4675b34001f817323010c3bfd5e6aa Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 16 Jul 2019 17:20:47 +0200
+Subject: [PATCH 2/2] sched/fair: Use RCU accessors consistently for
+ ->numa_group
+Patch-mainline: v5.3-rc2
+Git-commit: cb361d8cdef69990f6b4504dc1fd9a594d983c97
+References: bsc#1144920
+
+The old code used RCU annotations and accessors inconsistently for
+->numa_group, which can lead to use-after-frees and NULL dereferences.
+
+Let all accesses to ->numa_group use proper RCU helpers to prevent such
+issues.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Will Deacon <will@kernel.org>
+Fixes: 8c8a743c5087 ("sched/numa: Use {cpu, pid} to create task groups for shared faults")
+Link: https://lkml.kernel.org/r/20190716152047.14424-3-jannh@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Matt Fleming <mfleming@suse.de>
+---
+ include/linux/sched.h | 10 +++-
+ kernel/sched/fair.c | 120 +++++++++++++++++++++++++++++++++-----------------
+ 2 files changed, 90 insertions(+), 40 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -921,7 +921,15 @@ struct task_struct {
+ u64 last_sum_exec_runtime;
+ struct callback_head numa_work;
+
+- struct numa_group *numa_group;
++ /*
++ * This pointer is only modified for current in syscall and
++ * pagefault context (and for tasks being destroyed), so it can be read
++ * from any of the following contexts:
++ * - RCU read-side critical section
++ * - current->numa_group from everywhere
++ * - task's runqueue locked, task not running
++ */
++ struct numa_group __rcu *numa_group;
+
+ /*
+ * numa_faults is an array split into four regions:
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -1081,6 +1081,21 @@ struct numa_group {
+ unsigned long faults[0];
+ };
+
++/*
++ * For functions that can be called in multiple contexts that permit reading
++ * ->numa_group (see struct task_struct for locking rules).
++ */
++static struct numa_group *deref_task_numa_group(struct task_struct *p)
++{
++ return rcu_dereference_check(p->numa_group, p == current ||
++ (lockdep_is_held(&task_rq(p)->lock) && !READ_ONCE(p->on_cpu)));
++}
++
++static struct numa_group *deref_curr_numa_group(struct task_struct *p)
++{
++ return rcu_dereference_protected(p->numa_group, p == current);
++}
++
+ static inline unsigned long group_faults_priv(struct numa_group *ng);
+ static inline unsigned long group_faults_shared(struct numa_group *ng);
+
+@@ -1124,10 +1139,12 @@ static unsigned int task_scan_start(stru
+ {
+ unsigned long smin = task_scan_min(p);
+ unsigned long period = smin;
++ struct numa_group *ng;
+
+ /* Scale the maximum scan period with the amount of shared memory. */
+- if (p->numa_group) {
+- struct numa_group *ng = p->numa_group;
++ rcu_read_lock();
++ ng = rcu_dereference(p->numa_group);
++ if (ng) {
+ unsigned long shared = group_faults_shared(ng);
+ unsigned long private = group_faults_priv(ng);
+
+@@ -1135,6 +1152,7 @@ static unsigned int task_scan_start(stru
+ period *= shared + 1;
+ period /= private + shared + 1;
+ }
++ rcu_read_unlock();
+
+ return max(smin, period);
+ }
+@@ -1143,13 +1161,14 @@ static unsigned int task_scan_max(struct
+ {
+ unsigned long smin = task_scan_min(p);
+ unsigned long smax;
++ struct numa_group *ng;
+
+ /* Watch for min being lower than max due to floor calculations */
+ smax = sysctl_numa_balancing_scan_period_max / task_nr_scan_windows(p);
+
+ /* Scale the maximum scan period with the amount of shared memory. */
+- if (p->numa_group) {
+- struct numa_group *ng = p->numa_group;
++ ng = deref_curr_numa_group(p);
++ if (ng) {
+ unsigned long shared = group_faults_shared(ng);
+ unsigned long private = group_faults_priv(ng);
+ unsigned long period = smax;
+@@ -1181,7 +1200,7 @@ void init_numa_balancing(unsigned long c
+ p->numa_scan_period = sysctl_numa_balancing_scan_delay;
+ p->numa_work.next = &p->numa_work;
+ p->numa_faults = NULL;
+- p->numa_group = NULL;
++ RCU_INIT_POINTER(p->numa_group, NULL);
+ p->last_task_numa_placement = 0;
+ p->last_sum_exec_runtime = 0;
+
+@@ -1228,7 +1247,16 @@ static void account_numa_dequeue(struct
+
+ pid_t task_numa_group_id(struct task_struct *p)
+ {
+- return p->numa_group ? p->numa_group->gid : 0;
++ struct numa_group *ng;
++ pid_t gid = 0;
++
++ rcu_read_lock();
++ ng = rcu_dereference(p->numa_group);
++ if (ng)
++ gid = ng->gid;
++ rcu_read_unlock();
++
++ return gid;
+ }
+
+ /*
+@@ -1253,11 +1281,13 @@ static inline unsigned long task_faults(
+
+ static inline unsigned long group_faults(struct task_struct *p, int nid)
+ {
+- if (!p->numa_group)
++ struct numa_group *ng = deref_task_numa_group(p);
++
++ if (!ng)
+ return 0;
+
+- return p->numa_group->faults[task_faults_idx(NUMA_MEM, nid, 0)] +
+- p->numa_group->faults[task_faults_idx(NUMA_MEM, nid, 1)];
++ return ng->faults[task_faults_idx(NUMA_MEM, nid, 0)] +
++ ng->faults[task_faults_idx(NUMA_MEM, nid, 1)];
+ }
+
+ static inline unsigned long group_faults_cpu(struct numa_group *group, int nid)
+@@ -1395,12 +1425,13 @@ static inline unsigned long task_weight(
+ static inline unsigned long group_weight(struct task_struct *p, int nid,
+ int dist)
+ {
++ struct numa_group *ng = deref_task_numa_group(p);
+ unsigned long faults, total_faults;
+
+- if (!p->numa_group)
++ if (!ng)
+ return 0;
+
+- total_faults = p->numa_group->total_faults;
++ total_faults = ng->total_faults;
+
+ if (!total_faults)
+ return 0;
+@@ -1414,7 +1445,7 @@ static inline unsigned long group_weight
+ bool should_numa_migrate_memory(struct task_struct *p, struct page * page,
+ int src_nid, int dst_cpu)
+ {
+- struct numa_group *ng = p->numa_group;
++ struct numa_group *ng = deref_curr_numa_group(p);
+ int dst_nid = cpu_to_node(dst_cpu);
+ int last_cpupid, this_cpupid;
+
+@@ -1598,13 +1629,14 @@ static bool load_too_imbalanced(long src
+ static void task_numa_compare(struct task_numa_env *env,
+ long taskimp, long groupimp, bool maymove)
+ {
++ struct numa_group *cur_ng, *p_ng = deref_curr_numa_group(env->p);
+ struct rq *dst_rq = cpu_rq(env->dst_cpu);
++ long imp = p_ng ? groupimp : taskimp;
+ struct task_struct *cur;
+ long src_load, dst_load;
+- long load;
+- long imp = env->p->numa_group ? groupimp : taskimp;
+- long moveimp = imp;
+ int dist = env->dist;
++ long moveimp = imp;
++ long load;
+
+ if (READ_ONCE(dst_rq->numa_migrate_on))
+ return;
+@@ -1643,21 +1675,22 @@ static void task_numa_compare(struct tas
+ * If dst and source tasks are in the same NUMA group, or not
+ * in any group then look only at task weights.
+ */
+- if (cur->numa_group == env->p->numa_group) {
++ cur_ng = rcu_dereference(cur->numa_group);
++ if (cur_ng == p_ng) {
+ imp = taskimp + task_weight(cur, env->src_nid, dist) -
+ task_weight(cur, env->dst_nid, dist);
+ /*
+ * Add some hysteresis to prevent swapping the
+ * tasks within a group over tiny differences.
+ */
+- if (cur->numa_group)
++ if (cur_ng)
+ imp -= imp / 16;
+ } else {
+ /*
+ * Compare the group weights. If a task is all by itself
+ * (not part of a group), use the task weight instead.
+ */
+- if (cur->numa_group && env->p->numa_group)
++ if (cur_ng && p_ng)
+ imp += group_weight(cur, env->src_nid, dist) -
+ group_weight(cur, env->dst_nid, dist);
+ else
+@@ -1755,11 +1788,12 @@ static int task_numa_migrate(struct task
+ .best_imp = 0,
+ .best_cpu = -1,
+ };
++ unsigned long taskweight, groupweight;
+ struct sched_domain *sd;
++ long taskimp, groupimp;
++ struct numa_group *ng;
+ struct rq *best_rq;
+- unsigned long taskweight, groupweight;
+ int nid, ret, dist;
+- long taskimp, groupimp;
+
+ /*
+ * Pick the lowest SD_NUMA domain, as that would have the smallest
+@@ -1805,7 +1839,8 @@ static int task_numa_migrate(struct task
+ * multiple NUMA nodes; in order to better consolidate the group,
+ * we need to check other locations.
+ */
+- if (env.best_cpu == -1 || (p->numa_group && p->numa_group->active_nodes > 1)) {
++ ng = deref_curr_numa_group(p);
++ if (env.best_cpu == -1 || (ng && ng->active_nodes > 1)) {
+ for_each_online_node(nid) {
+ if (nid == env.src_nid || nid == p->numa_preferred_nid)
+ continue;
+@@ -1838,7 +1873,7 @@ static int task_numa_migrate(struct task
+ * A task that migrated to a second choice node will be better off
+ * trying for a better one later. Do not set the preferred node here.
+ */
+- if (p->numa_group) {
++ if (ng) {
+ if (env.best_cpu == -1)
+ nid = env.src_nid;
+ else
+@@ -2129,6 +2164,7 @@ static void task_numa_placement(struct t
+ unsigned long total_faults;
+ u64 runtime, period;
+ spinlock_t *group_lock = NULL;
++ struct numa_group *ng;
+
+ /*
+ * The p->mm->numa_scan_seq field gets updated without
+@@ -2146,8 +2182,9 @@ static void task_numa_placement(struct t
+ runtime = numa_get_avg_runtime(p, &period);
+
+ /* If the task is part of a group prevent parallel updates to group stats */
+- if (p->numa_group) {
+- group_lock = &p->numa_group->lock;
++ ng = deref_curr_numa_group(p);
++ if (ng) {
++ group_lock = &ng->lock;
+ spin_lock_irq(group_lock);
+ }
+
+@@ -2188,7 +2225,7 @@ static void task_numa_placement(struct t
+ p->numa_faults[cpu_idx] += f_diff;
+ faults += p->numa_faults[mem_idx];
+ p->total_numa_faults += diff;
+- if (p->numa_group) {
++ if (ng) {
+ /*
+ * safe because we can only change our own group
+ *
+@@ -2196,14 +2233,14 @@ static void task_numa_placement(struct t
+ * nid and priv in a specific region because it
+ * is at the beginning of the numa_faults array.
+ */
+- p->numa_group->faults[mem_idx] += diff;
+- p->numa_group->faults_cpu[mem_idx] += f_diff;
+- p->numa_group->total_faults += diff;
+- group_faults += p->numa_group->faults[mem_idx];
++ ng->faults[mem_idx] += diff;
++ ng->faults_cpu[mem_idx] += f_diff;
++ ng->total_faults += diff;
++ group_faults += ng->faults[mem_idx];
+ }
+ }
+
+- if (!p->numa_group) {
++ if (!ng) {
+ if (faults > max_faults) {
+ max_faults = faults;
+ max_nid = nid;
+@@ -2214,8 +2251,8 @@ static void task_numa_placement(struct t
+ }
+ }
+
+- if (p->numa_group) {
+- numa_group_count_active_nodes(p->numa_group);
++ if (ng) {
++ numa_group_count_active_nodes(ng);
+ spin_unlock_irq(group_lock);
+ max_nid = preferred_group_nid(p, max_nid);
+ }
+@@ -2249,7 +2286,7 @@ static void task_numa_group(struct task_
+ int cpu = cpupid_to_cpu(cpupid);
+ int i;
+
+- if (unlikely(!p->numa_group)) {
++ if (unlikely(!deref_curr_numa_group(p))) {
+ unsigned int size = sizeof(struct numa_group) +
+ 4*nr_node_ids*sizeof(unsigned long);
+
+@@ -2285,7 +2322,7 @@ static void task_numa_group(struct task_
+ if (!grp)
+ goto no_join;
+
+- my_grp = p->numa_group;
++ my_grp = deref_curr_numa_group(p);
+ if (grp == my_grp)
+ goto no_join;
+
+@@ -2356,7 +2393,8 @@ no_join:
+ */
+ void task_numa_free(struct task_struct *p, bool final)
+ {
+- struct numa_group *grp = p->numa_group;
++ /* safe: p either is current or is being freed by current */
++ struct numa_group *grp = rcu_dereference_raw(p->numa_group);
+ unsigned long *numa_faults = p->numa_faults;
+ unsigned long flags;
+ int i;
+@@ -2436,7 +2474,7 @@ void task_numa_fault(int last_cpupid, in
+ * actively using should be counted as local. This allows the
+ * scan rate to slow down when a workload has settled down.
+ */
+- ng = p->numa_group;
++ ng = deref_curr_numa_group(p);
+ if (!priv && !local && ng && ng->active_nodes > 1 &&
+ numa_is_active_node(cpu_node, ng) &&
+ numa_is_active_node(mem_node, ng))
+@@ -10001,18 +10039,22 @@ void show_numa_stats(struct task_struct
+ {
+ int node;
+ unsigned long tsf = 0, tpf = 0, gsf = 0, gpf = 0;
++ struct numa_group *ng;
+
++ rcu_read_lock();
++ ng = rcu_dereference(p->numa_group);
+ for_each_online_node(node) {
+ if (p->numa_faults) {
+ tsf = p->numa_faults[task_faults_idx(NUMA_MEM, node, 0)];
+ tpf = p->numa_faults[task_faults_idx(NUMA_MEM, node, 1)];
+ }
+- if (p->numa_group) {
+- gsf = p->numa_group->faults[task_faults_idx(NUMA_MEM, node, 0)],
+- gpf = p->numa_group->faults[task_faults_idx(NUMA_MEM, node, 1)];
++ if (ng) {
++ gsf = ng->faults[task_faults_idx(NUMA_MEM, node, 0)],
++ gpf = ng->faults[task_faults_idx(NUMA_MEM, node, 1)];
+ }
+ print_numa_stats(m, node, tsf, tpf, gsf, gpf);
+ }
++ rcu_read_unlock();
+ }
+ #endif /* CONFIG_NUMA_BALANCING */
+ #endif /* CONFIG_SCHED_DEBUG */
diff --git a/patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch b/patches.kabi/KVM-Fix-kABI.patch
index 0b14c1e692..3eb7a1eb9e 100644
--- a/patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch
+++ b/patches.kabi/KVM-Fix-kABI.patch
@@ -6,17 +6,26 @@ References: bsc#1133149
Signed-off-by: Joerg Roedel <jroedel@suse.de>
---
- arch/x86/include/asm/kvm_host.h | 2 ++
- 1 file changed, 2 insertions(+)
+ arch/x86/include/asm/kvm_host.h | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
-@@ -1118,7 +1118,9 @@ struct kvm_x86_ops {
+@@ -1110,7 +1110,6 @@ struct kvm_x86_ops {
+ int (*update_pi_irte)(struct kvm *kvm, unsigned int host_irq,
+ uint32_t guest_irq, bool set);
+ void (*apicv_post_state_restore)(struct kvm_vcpu *vcpu);
+- bool (*dy_apicv_has_pending_interrupt)(struct kvm_vcpu *vcpu);
+
+ int (*set_hv_timer)(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc);
+ void (*cancel_hv_timer)(struct kvm_vcpu *vcpu);
+@@ -1128,7 +1127,10 @@ struct kvm_x86_ops {
int (*get_msr_feature)(struct kvm_msr_entry *entry);
+#ifndef __GENKSYMS__
bool (*need_emulation_on_page_fault)(struct kvm_vcpu *vcpu);
++ bool (*dy_apicv_has_pending_interrupt)(struct kvm_vcpu *vcpu);
+#endif
};
diff --git a/patches.kabi/kABI-Fix-kABI-for-struct-amd_iommu.patch b/patches.kabi/kABI-Fix-kABI-for-struct-amd_iommu.patch
new file mode 100644
index 0000000000..bf3171a415
--- /dev/null
+++ b/patches.kabi/kABI-Fix-kABI-for-struct-amd_iommu.patch
@@ -0,0 +1,29 @@
+From: Joerg Roedel <jroedel@suse.de>
+Date: Fri, 9 Aug 2019 10:38:35 +0200
+Subject: [PATCH] kABI: Fix kABI for 'struct amd_iommu'
+Patch-mainline: no, kABI fix only
+References: bsc#1145010
+
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu_types.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index 379fe8e31dbd..9a505104b1cf 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -603,8 +603,10 @@ struct amd_iommu {
+ u32 flags;
+ volatile u64 __aligned(8) cmd_sem;
+
++#ifndef __GENKSYMS__
+ /* IRQ notifier for IntCapXT interrupt */
+ struct irq_affinity_notify intcapxt_notify;
++#endif
+ };
+
+ static inline struct amd_iommu *dev_to_amd_iommu(struct device *dev)
+--
+2.16.3
+
diff --git a/patches.kabi/kabi-x86-microcode-hotplug-state-fix.patch b/patches.kabi/kabi-x86-microcode-hotplug-state-fix.patch
index e180f9a6e5..894263fe9d 100644
--- a/patches.kabi/kabi-x86-microcode-hotplug-state-fix.patch
+++ b/patches.kabi/kabi-x86-microcode-hotplug-state-fix.patch
@@ -16,16 +16,16 @@ Signed-off-by: Borislav Petkov <bp@suse.de>
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
-@@ -853,6 +853,9 @@ int __init microcode_init(void)
+@@ -856,6 +856,9 @@ int __init microcode_init(void)
goto out_ucode_group;
register_syscore_ops(&mc_syscore_ops);
+
+#define CPUHP_AP_MICROCODE_LOADER CPUHP_AP_ARM_MVEBU_COHERENCY
+
- cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:online",
- mc_cpu_online, mc_cpu_down_prep);
-
+ cpuhp_setup_state_nocalls(CPUHP_AP_MICROCODE_LOADER, "x86/microcode:starting",
+ mc_cpu_starting, NULL);
+ cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, "x86/microcode:online",
--- a/include/linux/cpuhotplug.h
+++ b/include/linux/cpuhotplug.h
@@ -83,8 +83,7 @@ enum cpuhp_state {
diff --git a/patches.suse/0001-btrfs-Split-btrfs_del_delalloc_inode-into-2-function.patch b/patches.suse/0001-btrfs-Split-btrfs_del_delalloc_inode-into-2-function.patch
new file mode 100644
index 0000000000..e7502b2da4
--- /dev/null
+++ b/patches.suse/0001-btrfs-Split-btrfs_del_delalloc_inode-into-2-function.patch
@@ -0,0 +1,70 @@
+From 704b6d7b66634dcd8ea19ccf3475d5d22e1f3749 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Fri, 27 Apr 2018 12:21:51 +0300
+Subject: btrfs: Split btrfs_del_delalloc_inode into 2 functions
+Git-commit: 2b8773313494ede83a26fb372466e634564002ed
+Patch-mainline: v4.17-rc6
+References: bsc#1050911
+
+This is in preparation of fixing delalloc inodes leakage on transaction
+abort. Also export the new function.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/ctree.h | 2 ++
+ fs/btrfs/inode.c | 13 ++++++++++---
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index cabd87614a39..e9890a8932d3 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -3229,6 +3229,8 @@ static inline void btrfs_force_ra(struct address_space *mapping,
+ page_cache_sync_readahead(mapping, ra, file, offset, req_size);
+ }
+
++void __btrfs_del_delalloc_inode(struct btrfs_root *root,
++ struct btrfs_inode *inode);
+ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry);
+ int btrfs_set_inode_index(struct btrfs_inode *dir, u64 *index);
+ int btrfs_unlink_inode(struct btrfs_trans_handle *trans,
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 5f35f47ac107..ab75777b6a6b 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1741,12 +1741,12 @@ static void btrfs_add_delalloc_inodes(struct btrfs_root *root,
+ spin_unlock(&root->delalloc_lock);
+ }
+
+-static void btrfs_del_delalloc_inode(struct btrfs_root *root,
+- struct btrfs_inode *inode)
++
++void __btrfs_del_delalloc_inode(struct btrfs_root *root,
++ struct btrfs_inode *inode)
+ {
+ struct btrfs_fs_info *fs_info = btrfs_sb(inode->vfs_inode.i_sb);
+
+- spin_lock(&root->delalloc_lock);
+ if (!list_empty(&inode->delalloc_inodes)) {
+ list_del_init(&inode->delalloc_inodes);
+ clear_bit(BTRFS_INODE_IN_DELALLOC_LIST,
+@@ -1759,6 +1759,13 @@ static void btrfs_del_delalloc_inode(struct btrfs_root *root,
+ spin_unlock(&fs_info->delalloc_root_lock);
+ }
+ }
++}
++
++static void btrfs_del_delalloc_inode(struct btrfs_root *root,
++ struct btrfs_inode *inode)
++{
++ spin_lock(&root->delalloc_lock);
++ __btrfs_del_delalloc_inode(root, inode);
+ spin_unlock(&root->delalloc_lock);
+ }
+
+--
+2.17.1
+
diff --git a/patches.suse/0001-irqchip-gic-v3-its-fix-build-warnings.patch b/patches.suse/0001-irqchip-gic-v3-its-fix-build-warnings.patch
new file mode 100644
index 0000000000..d5791326f4
--- /dev/null
+++ b/patches.suse/0001-irqchip-gic-v3-its-fix-build-warnings.patch
@@ -0,0 +1,61 @@
+From fdcd2a57f4dba25d1a0bb5c8b4f36c1f7f949137 Mon Sep 17 00:00:00 2001
+From: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
+Date: Thu, 8 Aug 2019 15:04:08 +0200
+Subject: [PATCH] irqchip/gic-v3-its: fix build warnings
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Patch-mainline: Never, Build warnings due to missing patch
+References: bsc#1144880
+
+Following warnings are fixed:
+drivers/irqchip/irq-gic-v3-its.c: In function ‘its_irq_domain_activate’:
+drivers/irqchip/irq-gic-v3-its.c:2323:11: warning: ‘return’ with a value, in function returning void
+ return -EINVAL;
+ ^
+drivers/irqchip/irq-gic-v3-its.c:2307:13: note: declared here
+ static void its_irq_domain_activate(struct irq_domain *domain,
+ ^~~~~~~~~~~~~~~~~~~~~~~
+ LD drivers/net/ethernet/allwinner/built-in.o
+drivers/irqchip/irq-gic-v3-its.c: In function ‘its_vpe_irq_domain_activate’:
+drivers/irqchip/irq-gic-v3-its.c:2838:10: warning: ‘return’ with a value, in function returning void
+ return 0;
+ ^
+drivers/irqchip/irq-gic-v3-its.c:2830:13: note: declared here
+ static void its_vpe_irq_domain_activate(struct irq_domain *domain,
+
+Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
+---
+ drivers/irqchip/irq-gic-v3-its.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index fbda05bbd9ee..03ace8f3ac65 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2319,8 +2319,10 @@ static void its_irq_domain_activate(struct irq_domain *domain,
+ /* Bind the LPI to the first possible CPU */
+ cpu = cpumask_first_and(cpu_mask, cpu_online_mask);
+ if (cpu >= nr_cpu_ids) {
+- if (its_dev->its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144)
+- return -EINVAL;
++ if (its_dev->its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) {
++ pr_err("ITS: Can't bind LPI to non-local node CPU due to Cavium erratum 23144\n");
++ return;
++ }
+
+ cpu = cpumask_first(cpu_online_mask);
+ }
+@@ -2835,7 +2837,7 @@ static void its_vpe_irq_domain_activate(struct irq_domain *domain,
+
+ /* If we use the list map, we issue VMAPP on demand... */
+ if (its_list_map)
+- return 0;
++ return;
+
+ /* Map the VPE to the first possible CPU */
+ vpe->col_idx = cpumask_first(cpu_online_mask);
+--
+2.11.0
+
diff --git a/patches.suse/0002-btrfs-Fix-delalloc-inodes-invalidation-during-transa.patch b/patches.suse/0002-btrfs-Fix-delalloc-inodes-invalidation-during-transa.patch
new file mode 100644
index 0000000000..e2a859c5e5
--- /dev/null
+++ b/patches.suse/0002-btrfs-Fix-delalloc-inodes-invalidation-during-transa.patch
@@ -0,0 +1,133 @@
+From d2de315f8739000aa006b77c412527ab96fc96d6 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Fri, 27 Apr 2018 12:21:53 +0300
+Subject: btrfs: Fix delalloc inodes invalidation during transaction abort
+Git-commit: fe816d0f1d4c31c4c31d42ca78a87660565fc800
+Patch-mainline: v4.17-rc6
+References: bsc#1050911
+
+When a transaction is aborted btrfs_cleanup_transaction is called to
+cleanup all the various in-flight bits and pieces which migth be
+active. One of those is delalloc inodes - inodes which have dirty
+pages which haven't been persisted yet. Currently the process of
+freeing such delalloc inodes in exceptional circumstances such as
+transaction abort boiled down to calling btrfs_invalidate_inodes whose
+sole job is to invalidate the dentries for all inodes related to a
+root. This is in fact wrong and insufficient since such delalloc inodes
+will likely have pending pages or ordered-extents and will be linked to
+the sb->s_inode_list. This means that unmounting a btrfs instance with
+an aborted transaction could potentially lead inodes/their pages
+visible to the system long after their superblock has been freed. This
+in turn leads to a "use-after-free" situation once page shrink is
+triggered. This situation could be simulated by running generic/019
+which would cause such inodes to be left hanging, followed by
+generic/176 which causes memory pressure and page eviction which lead
+to touching the freed super block instance. This situation is
+additionally detected by the unmount code of VFS with the following
+message:
+
+"VFS: Busy inodes after unmount of Self-destruct in 5 seconds. Have a nice day..."
+
+Additionally btrfs hits WARN_ON(!RB_EMPTY_ROOT(&root->inode_tree));
+in free_fs_root for the same reason.
+
+This patch aims to rectify the sitaution by doing the following:
+
+1. Change btrfs_destroy_delalloc_inodes so that it calls
+invalidate_inode_pages2 for every inode on the delalloc list, this
+ensures that all the pages of the inode are released. This function
+boils down to calling btrfs_releasepage. During test I observed cases
+where inodes on the delalloc list were having an i_count of 0, so this
+necessitates using igrab to be sure we are working on a non-freed inode.
+
+2. Since calling btrfs_releasepage might queue delayed iputs move the
+call out to btrfs_cleanup_transaction in btrfs_error_commit_super before
+calling run_delayed_iputs for the last time. This is necessary to ensure
+that delayed iputs are run.
+
+Note: this patch is tagged for 4.14 stable but the fix applies to older
+versions too but needs to be backported manually due to conflicts.
+
+CC: stable@vger.kernel.org # 4.14.x: 2b8773313494: btrfs: Split btrfs_del_delalloc_inode into 2 functions
+CC: stable@vger.kernel.org # 4.14.x
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ add comment to igrab ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/disk-io.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index a82243503743..2e1d93e3d1b1 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3897,6 +3897,7 @@ void close_ctree(struct btrfs_fs_info *fs_info)
+ set_bit(BTRFS_FS_CLOSING_DONE, &fs_info->flags);
+
+ btrfs_free_qgroup_config(fs_info);
++ ASSERT(list_empty(&fs_info->delalloc_roots));
+
+ if (percpu_counter_sum(&fs_info->delalloc_bytes)) {
+ btrfs_info(fs_info, "at unmount delalloc count %lld",
+@@ -4200,15 +4201,15 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info)
+
+ static void btrfs_error_commit_super(struct btrfs_fs_info *fs_info)
+ {
++ /* cleanup FS via transaction */
++ btrfs_cleanup_transaction(fs_info);
++
+ mutex_lock(&fs_info->cleaner_mutex);
+ btrfs_run_delayed_iputs(fs_info);
+ mutex_unlock(&fs_info->cleaner_mutex);
+
+ down_write(&fs_info->cleanup_work_sem);
+ up_write(&fs_info->cleanup_work_sem);
+-
+- /* cleanup FS via transaction */
+- btrfs_cleanup_transaction(fs_info);
+ }
+
+ static void btrfs_destroy_ordered_extents(struct btrfs_root *root)
+@@ -4333,19 +4334,23 @@ static void btrfs_destroy_delalloc_inodes(struct btrfs_root *root)
+ list_splice_init(&root->delalloc_inodes, &splice);
+
+ while (!list_empty(&splice)) {
++ struct inode *inode = NULL;
+ btrfs_inode = list_first_entry(&splice, struct btrfs_inode,
+ delalloc_inodes);
+-
+- list_del_init(&btrfs_inode->delalloc_inodes);
+- clear_bit(BTRFS_INODE_IN_DELALLOC_LIST,
+- &btrfs_inode->runtime_flags);
++ __btrfs_del_delalloc_inode(root, btrfs_inode);
+ spin_unlock(&root->delalloc_lock);
+
+- btrfs_invalidate_inodes(btrfs_inode->root);
+-
++ /*
++ * Make sure we get a live inode and that it'll not disappear
++ * meanwhile.
++ */
++ inode = igrab(&btrfs_inode->vfs_inode);
++ if (inode) {
++ invalidate_inode_pages2(inode->i_mapping);
++ iput(inode);
++ }
+ spin_lock(&root->delalloc_lock);
+ }
+-
+ spin_unlock(&root->delalloc_lock);
+ }
+
+@@ -4361,7 +4366,6 @@ static void btrfs_destroy_all_delalloc_inodes(struct btrfs_fs_info *fs_info)
+ while (!list_empty(&splice)) {
+ root = list_first_entry(&splice, struct btrfs_root,
+ delalloc_root);
+- list_del_init(&root->delalloc_root);
+ root = btrfs_grab_fs_root(root);
+ BUG_ON(!root);
+ spin_unlock(&fs_info->delalloc_root_lock);
+--
+2.17.1
+
diff --git a/patches.suse/0002-btrfs-Remove-fsid-metadata_fsid-fields-from-btrfs_in.patch b/patches.suse/0002-btrfs-Remove-fsid-metadata_fsid-fields-from-btrfs_in.patch
index f785bfcbf4..f820543afe 100644
--- a/patches.suse/0002-btrfs-Remove-fsid-metadata_fsid-fields-from-btrfs_in.patch
+++ b/patches.suse/0002-btrfs-Remove-fsid-metadata_fsid-fields-from-btrfs_in.patch
@@ -92,7 +92,7 @@ Signed-off-by: Nikolay Borisov <nborisov@suse.com>
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -728,8 +728,6 @@ struct btrfs_delayed_root;
- #define BTRFS_FS_NEED_ASYNC_COMMIT 17
+ #define BTRFS_FS_BALANCE_RUNNING 18
struct btrfs_fs_info {
- u8 fsid[BTRFS_FSID_SIZE];
diff --git a/patches.suse/0003-btrfs-add-cleanup_ref_head_accounting-helper.patch b/patches.suse/0003-btrfs-add-cleanup_ref_head_accounting-helper.patch
new file mode 100644
index 0000000000..7e1d5f0ec3
--- /dev/null
+++ b/patches.suse/0003-btrfs-add-cleanup_ref_head_accounting-helper.patch
@@ -0,0 +1,117 @@
+From f3bb88ef7fd926f9bf93a1f6a7aa2ffbfe59bbf5 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <jbacik@fb.com>
+Date: Mon, 3 Dec 2018 10:20:30 -0500
+Subject: btrfs: add cleanup_ref_head_accounting helper
+Git-commit: 07c47775f410168c259494ecb8f62cee0a84ec81
+Patch-mainline: v5.0-rc1
+References: bsc#1050911
+
+We were missing some quota cleanups in check_ref_cleanup, so break the
+ref head accounting cleanup into a helper and call that from both
+check_ref_cleanup and cleanup_ref_head. This will hopefully ensure that
+we don't screw up accounting in the future for other things that we add.
+
+Reviewed-by: Omar Sandoval <osandov@fb.com>
+Reviewed-by: Liu Bo <bo.liu@linux.alibaba.com>
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/extent-tree.c | 64 +++++++++++++++++++++++++++++--------------------
+ 1 file changed, 38 insertions(+), 26 deletions(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2494,6 +2494,40 @@ static int cleanup_extent_op(struct btrf
+ return ret ? ret : 1;
+ }
+
++static void cleanup_ref_head_accounting(struct btrfs_trans_handle *trans,
++ struct btrfs_delayed_ref_head *head)
++{
++ struct btrfs_fs_info *fs_info = trans->fs_info;
++ struct btrfs_delayed_ref_root *delayed_refs =
++ &trans->transaction->delayed_refs;
++
++ if (head->total_ref_mod < 0) {
++ struct btrfs_space_info *space_info;
++ u64 flags;
++
++ if (head->is_data)
++ flags = BTRFS_BLOCK_GROUP_DATA;
++ else if (head->is_system)
++ flags = BTRFS_BLOCK_GROUP_SYSTEM;
++ else
++ flags = BTRFS_BLOCK_GROUP_METADATA;
++ space_info = __find_space_info(fs_info, flags);
++ ASSERT(space_info);
++ percpu_counter_add(&space_info->total_bytes_pinned,
++ -head->num_bytes);
++
++ if (head->is_data) {
++ spin_lock(&delayed_refs->lock);
++ delayed_refs->pending_csums -= head->num_bytes;
++ spin_unlock(&delayed_refs->lock);
++ }
++ }
++
++ /* Also free its reserved qgroup space */
++ btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
++ head->qgroup_reserved);
++}
++
+ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info,
+ struct btrfs_delayed_ref_head *head)
+@@ -2531,29 +2565,6 @@ static int cleanup_ref_head(struct btrfs
+ spin_unlock(&head->lock);
+ atomic_dec(&delayed_refs->num_entries);
+
+- trace_run_delayed_ref_head(fs_info, head, 0);
+-
+- if (head->total_ref_mod < 0) {
+- struct btrfs_space_info *space_info;
+- u64 flags;
+-
+- if (head->is_data)
+- flags = BTRFS_BLOCK_GROUP_DATA;
+- else if (head->is_system)
+- flags = BTRFS_BLOCK_GROUP_SYSTEM;
+- else
+- flags = BTRFS_BLOCK_GROUP_METADATA;
+- space_info = __find_space_info(fs_info, flags);
+- ASSERT(space_info);
+- percpu_counter_add(&space_info->total_bytes_pinned,
+- -head->num_bytes);
+- if (head->is_data) {
+- spin_lock(&delayed_refs->lock);
+- delayed_refs->pending_csums -= head->num_bytes;
+- spin_unlock(&delayed_refs->lock);
+- }
+- }
+-
+ if (head->must_insert_reserved) {
+ btrfs_pin_extent(fs_info, head->bytenr,
+ head->num_bytes, 1);
+@@ -2563,9 +2574,9 @@ static int cleanup_ref_head(struct btrfs
+ }
+ }
+
+- /* Also free its reserved qgroup space */
+- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
+- head->qgroup_reserved);
++ cleanup_ref_head_accounting(trans, head);
++
++ trace_run_delayed_ref_head(fs_info, head, 0);
+ btrfs_delayed_ref_unlock(head);
+ btrfs_put_delayed_ref_head(head);
+ return 0;
+@@ -7105,6 +7116,7 @@ static noinline int check_ref_cleanup(st
+ if (head->must_insert_reserved)
+ ret = 1;
+
++ cleanup_ref_head_accounting(trans, head);
+ mutex_unlock(&head->mutex);
+ btrfs_put_delayed_ref_head(head);
+ return ret;
diff --git a/patches.suse/0004-btrfs-handle-delayed-ref-head-accounting-cleanup-in-.patch b/patches.suse/0004-btrfs-handle-delayed-ref-head-accounting-cleanup-in-.patch
new file mode 100644
index 0000000000..e1be6f2cf4
--- /dev/null
+++ b/patches.suse/0004-btrfs-handle-delayed-ref-head-accounting-cleanup-in-.patch
@@ -0,0 +1,136 @@
+From 974b9401bf44bbceca3c8e0462c3e913db1bf3c2 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Wed, 21 Nov 2018 14:05:41 -0500
+Subject: btrfs: handle delayed ref head accounting cleanup in abort
+Git-commit: 31890da0bfdd24b135a258404b93c58a65510c7a
+Patch-mainline: v5.0-rc3
+References: bsc#1050911
+
+We weren't doing any of the accounting cleanup when we aborted
+transactions. Fix this by making cleanup_ref_head_accounting global and
+calling it from the abort code, this fixes the issue where our
+accounting was all wrong after the fs aborts.
+
+The test generic/475 on a 2G VM can trigger the problems eg.:
+
+ [ 8502.136957] WARNING: CPU: 0 PID: 11064 at fs/btrfs/extent-tree.c:5986 btrfs_free_block_grou +ps+0x3dc/0x410 [btrfs]
+ [ 8502.148372] CPU: 0 PID: 11064 Comm: umount Not tainted 5.0.0-rc1-default+ #394
+ [ 8502.150807] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626 +cc-prebuilt.qemu-project.org 04/01/2014
+ [ 8502.154317] RIP: 0010:btrfs_free_block_groups+0x3dc/0x410 [btrfs]
+ [ 8502.160623] RSP: 0018:ffffb1ab84b93de8 EFLAGS: 00010206
+ [ 8502.161906] RAX: 0000000001000000 RBX: ffff9f34b1756400 RCX: 0000000000000000
+ [ 8502.163448] RDX: 0000000000000002 RSI: 0000000000000001 RDI: ffff9f34b1755400
+ [ 8502.164906] RBP: ffff9f34b7e8c000 R08: 0000000000000001 R09: 0000000000000000
+ [ 8502.166716] R10: 0000000000000000 R11: 0000000000000001 R12: ffff9f34b7e8c108
+ [ 8502.168498] R13: ffff9f34b7e8c158 R14: 0000000000000000 R15: dead000000000100
+ [ 8502.170296] FS: 00007fb1cf15ffc0(0000) GS:ffff9f34bd400000(0000) knlGS:0000000000000000
+ [ 8502.172439] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 8502.173669] CR2: 00007fb1ced507b0 CR3: 000000002f7a6000 CR4: 00000000000006f0
+ [ 8502.175094] Call Trace:
+ [ 8502.175759] close_ctree+0x17f/0x350 [btrfs]
+ [ 8502.176721] generic_shutdown_super+0x64/0x100
+ [ 8502.177702] kill_anon_super+0x14/0x30
+ [ 8502.178607] btrfs_kill_super+0x12/0xa0 [btrfs]
+ [ 8502.179602] deactivate_locked_super+0x29/0x60
+ [ 8502.180595] cleanup_mnt+0x3b/0x70
+ [ 8502.181406] task_work_run+0x98/0xc0
+ [ 8502.182255] exit_to_usermode_loop+0x83/0x90
+ [ 8502.183113] do_syscall_64+0x15b/0x180
+ [ 8502.183919] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Corresponding to
+
+ release_global_block_rsv() {
+ ...
+ WARN_ON(fs_info->delayed_refs_rsv.reserved > 0);
+
+CC: stable@vger.kernel.org
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+[ add log dump ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/ctree.h | 4 ++++
+ fs/btrfs/disk-io.c | 1 +
+ fs/btrfs/extent-tree.c | 13 +++++--------
+ fs/btrfs/transaction.c | 2 +-
+ 4 files changed, 11 insertions(+), 9 deletions(-)
+
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -47,6 +47,7 @@
+ struct btrfs_trans_handle;
+ struct btrfs_transaction;
+ struct btrfs_pending_snapshot;
++struct btrfs_delayed_ref_root;
+ extern struct kmem_cache *btrfs_trans_handle_cachep;
+ extern struct kmem_cache *btrfs_transaction_cachep;
+ extern struct kmem_cache *btrfs_bit_radix_cachep;
+@@ -2645,6 +2646,9 @@ int btrfs_run_delayed_refs(struct btrfs_
+ struct btrfs_fs_info *fs_info, unsigned long count);
+ int btrfs_async_run_delayed_refs(struct btrfs_fs_info *fs_info,
+ unsigned long count, u64 transid, int wait);
++void btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_root *delayed_refs,
++ struct btrfs_delayed_ref_head *head);
+ int btrfs_lookup_data_extent(struct btrfs_fs_info *fs_info, u64 start, u64 len);
+ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info, u64 bytenr,
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4296,6 +4296,7 @@ static int btrfs_destroy_delayed_refs(st
+ if (pin_bytes)
+ btrfs_pin_extent(fs_info, head->bytenr,
+ head->num_bytes, 1);
++ btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);
+ btrfs_put_delayed_ref_head(head);
+ cond_resched();
+ spin_lock(&delayed_refs->lock);
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2494,13 +2494,10 @@ static int cleanup_extent_op(struct btrf
+ return ret ? ret : 1;
+ }
+
+-static void cleanup_ref_head_accounting(struct btrfs_trans_handle *trans,
+- struct btrfs_delayed_ref_head *head)
++void btrfs_cleanup_ref_head_accounting(struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_root *delayed_refs,
++ struct btrfs_delayed_ref_head *head)
+ {
+- struct btrfs_fs_info *fs_info = trans->fs_info;
+- struct btrfs_delayed_ref_root *delayed_refs =
+- &trans->transaction->delayed_refs;
+-
+ if (head->total_ref_mod < 0) {
+ struct btrfs_space_info *space_info;
+ u64 flags;
+@@ -2574,7 +2571,7 @@ static int cleanup_ref_head(struct btrfs
+ }
+ }
+
+- cleanup_ref_head_accounting(trans, head);
++ btrfs_cleanup_ref_head_accounting(fs_info, delayed_refs, head);
+
+ trace_run_delayed_ref_head(fs_info, head, 0);
+ btrfs_delayed_ref_unlock(head);
+@@ -7116,7 +7113,7 @@ static noinline int check_ref_cleanup(st
+ if (head->must_insert_reserved)
+ ret = 1;
+
+- cleanup_ref_head_accounting(trans, head);
++ btrfs_cleanup_ref_head_accounting(trans->fs_info, delayed_refs, head);
+ mutex_unlock(&head->mutex);
+ btrfs_put_delayed_ref_head(head);
+ return ret;
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -542,7 +542,7 @@ again:
+ * and then we deadlock with somebody doing a freeze.
+ *
+ * If we are ATTACH, it means we just want to catch the current
+- * transaction and commit it, so we needn't do sb_start_intwrite().
++ * transaction and commit it, so we needn't do sb_start_intwrite().
+ */
+ if (type & __TRANS_FREEZABLE)
+ sb_start_intwrite(fs_info->sb);
diff --git a/patches.suse/0005-btrfs-clean-up-pending-block-groups-when-transaction.patch b/patches.suse/0005-btrfs-clean-up-pending-block-groups-when-transaction.patch
new file mode 100644
index 0000000000..50b131b3c1
--- /dev/null
+++ b/patches.suse/0005-btrfs-clean-up-pending-block-groups-when-transaction.patch
@@ -0,0 +1,119 @@
+From 911b2df58508bbff3315960193dfdfbce6dc9a5b Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.com>
+Date: Wed, 23 Jan 2019 17:09:16 +0100
+Subject: btrfs: clean up pending block groups when transaction commit aborts
+Git-commit: c7cc64a98512ffc41df86d14a414eb3b09bf7481
+Patch-mainline: v5.0-rc5
+References: bsc#1050911
+
+The fstests generic/475 stresses transaction aborts and can reveal
+space accounting or use-after-free bugs regarding block goups.
+
+In this case the pending block groups that remain linked to the
+structures after transaction commit aborts in the middle.
+
+The corrupted slabs lead to failures in following tests, eg. generic/476
+
+ [ 8172.752887] BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
+ [ 8172.755799] #PF error: [normal kernel read fault]
+ [ 8172.757571] PGD 661ae067 P4D 661ae067 PUD 3db8e067 PMD 0
+ [ 8172.759000] Oops: 0000 [#1] PREEMPT SMP
+ [ 8172.760209] CPU: 0 PID: 39 Comm: kswapd0 Tainted: G W 5.0.0-rc2-default #408
+ [ 8172.762495] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014
+ [ 8172.765772] RIP: 0010:shrink_page_list+0x2f9/0xe90
+ [ 8172.770453] RSP: 0018:ffff967f00663b18 EFLAGS: 00010287
+ [ 8172.771184] RAX: 0000000000000000 RBX: ffff967f00663c20 RCX: 0000000000000000
+ [ 8172.772850] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8c0620ab20e0
+ [ 8172.774629] RBP: ffff967f00663dd8 R08: 0000000000000000 R09: 0000000000000000
+ [ 8172.776094] R10: ffff8c0620ab22f8 R11: ffff8c063f772688 R12: ffff967f00663b78
+ [ 8172.777533] R13: ffff8c063f625600 R14: ffff8c063f625608 R15: dead000000000200
+ [ 8172.778886] FS: 0000000000000000(0000) GS:ffff8c063d400000(0000) knlGS:0000000000000000
+ [ 8172.780545] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 8172.781787] CR2: 0000000000000058 CR3: 000000004e962000 CR4: 00000000000006f0
+ [ 8172.783547] Call Trace:
+ [ 8172.784112] shrink_inactive_list+0x194/0x410
+ [ 8172.784747] shrink_node_memcg.constprop.85+0x3a5/0x6a0
+ [ 8172.785472] shrink_node+0x62/0x1e0
+ [ 8172.786011] balance_pgdat+0x216/0x460
+ [ 8172.786577] kswapd+0xe3/0x4a0
+ [ 8172.787085] ? finish_wait+0x80/0x80
+ [ 8172.787795] ? balance_pgdat+0x460/0x460
+ [ 8172.788799] kthread+0x116/0x130
+ [ 8172.789640] ? kthread_create_on_node+0x60/0x60
+ [ 8172.790323] ret_from_fork+0x24/0x30
+ [ 8172.794253] CR2: 0000000000000058
+
+or accounting errors at umount time:
+
+ [ 8159.537251] WARNING: CPU: 2 PID: 19031 at fs/btrfs/extent-tree.c:5987 btrfs_free_block_groups+0x3d5/0x410 [btrfs]
+ [ 8159.543325] CPU: 2 PID: 19031 Comm: umount Tainted: G W 5.0.0-rc2-default #408
+ [ 8159.545472] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626cc-prebuilt.qemu-project.org 04/01/2014
+ [ 8159.548155] RIP: 0010:btrfs_free_block_groups+0x3d5/0x410 [btrfs]
+ [ 8159.554030] RSP: 0018:ffff967f079cbde8 EFLAGS: 00010206
+ [ 8159.555144] RAX: 0000000001000000 RBX: ffff8c06366cf800 RCX: 0000000000000000
+ [ 8159.556730] RDX: 0000000000000002 RSI: 0000000000000001 RDI: ffff8c06255ad800
+ [ 8159.558279] RBP: ffff8c0637ac0000 R08: 0000000000000001 R09: 0000000000000000
+ [ 8159.559797] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8c0637ac0108
+ [ 8159.561296] R13: ffff8c0637ac0158 R14: 0000000000000000 R15: dead000000000100
+ [ 8159.562852] FS: 00007f7f693b9fc0(0000) GS:ffff8c063d800000(0000) knlGS:0000000000000000
+ [ 8159.564839] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 8159.566160] CR2: 00007f7f68fab7b0 CR3: 000000000aec7000 CR4: 00000000000006e0
+ [ 8159.567898] Call Trace:
+ [ 8159.568597] close_ctree+0x17f/0x350 [btrfs]
+ [ 8159.569628] generic_shutdown_super+0x64/0x100
+ [ 8159.570808] kill_anon_super+0x14/0x30
+ [ 8159.571857] btrfs_kill_super+0x12/0xa0 [btrfs]
+ [ 8159.573063] deactivate_locked_super+0x29/0x60
+ [ 8159.574234] cleanup_mnt+0x3b/0x70
+ [ 8159.575176] task_work_run+0x98/0xc0
+ [ 8159.576177] exit_to_usermode_loop+0x83/0x90
+ [ 8159.577315] do_syscall_64+0x15b/0x180
+ [ 8159.578339] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+This fix is based on 2 Josef's patches that used sideefects of
+btrfs_create_pending_block_groups, this fix introduces the helper that
+does what we need.
+
+CC: stable@vger.kernel.org # 4.4+
+CC: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/transaction.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index 8351b40af552..5ce9180030e6 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1921,6 +1921,18 @@ static void cleanup_transaction(struct btrfs_trans_handle *trans,
+ kmem_cache_free(btrfs_trans_handle_cachep, trans);
+ }
+
++/*
++ * Release reserved delayed ref space of all pending block groups of the
++ * transaction and remove them from the list
++ */
++static void btrfs_cleanup_pending_block_groups(struct btrfs_trans_handle *trans)
++{
++ struct btrfs_block_group_cache *block_group, *tmp;
++
++ list_for_each_entry_safe(block_group, tmp, &trans->new_bgs, bg_list)
++ list_del_init(&block_group->bg_list);
++}
++
+ static inline int btrfs_start_delalloc_flush(struct btrfs_fs_info *fs_info)
+ {
+ if (btrfs_test_opt(fs_info, FLUSHONCOMMIT))
+@@ -2322,6 +2334,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans)
+ btrfs_scrub_continue(fs_info);
+ cleanup_transaction:
+ btrfs_trans_release_metadata(trans, fs_info);
++ btrfs_cleanup_pending_block_groups(trans);
+ btrfs_trans_release_chunk_metadata(trans);
+ trans->block_rsv = NULL;
+ btrfs_warn(fs_info, "Skipping commit of aborted transaction.");
+--
+2.17.1
+
diff --git a/patches.suse/0006-btrfs-fix-pinned-underflow-after-transaction-aborted.patch b/patches.suse/0006-btrfs-fix-pinned-underflow-after-transaction-aborted.patch
new file mode 100644
index 0000000000..5e151ea36e
--- /dev/null
+++ b/patches.suse/0006-btrfs-fix-pinned-underflow-after-transaction-aborted.patch
@@ -0,0 +1,104 @@
+From 9f533811c4d8f8fc30b65e689bb384395c9cae15 Mon Sep 17 00:00:00 2001
+From: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
+Date: Wed, 24 Oct 2018 20:24:03 +0800
+Subject: btrfs: fix pinned underflow after transaction aborted
+Git-commit: fcd5e74288f7d36991b1f0fb96b8c57079645e38
+Patch-mainline: v4.20-rc2
+References: bsc#1050911
+
+When running generic/475, we may get the following warning in dmesg:
+
+[ 6902.102154] WARNING: CPU: 3 PID: 18013 at fs/btrfs/extent-tree.c:9776 btrfs_free_block_groups+0x2af/0x3b0 [btrfs]
+[ 6902.109160] CPU: 3 PID: 18013 Comm: umount Tainted: G W O 4.19.0-rc8+ #8
+[ 6902.110971] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
+[ 6902.112857] RIP: 0010:btrfs_free_block_groups+0x2af/0x3b0 [btrfs]
+[ 6902.118921] RSP: 0018:ffffc9000459bdb0 EFLAGS: 00010286
+[ 6902.120315] RAX: ffff880175050bb0 RBX: ffff8801124a8000 RCX: 0000000000170007
+[ 6902.121969] RDX: 0000000000000002 RSI: 0000000000170007 RDI: ffffffff8125fb74
+[ 6902.123716] RBP: ffff880175055d10 R08: 0000000000000000 R09: 0000000000000000
+[ 6902.125417] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880175055d88
+[ 6902.127129] R13: ffff880175050bb0 R14: 0000000000000000 R15: dead000000000100
+[ 6902.129060] FS: 00007f4507223780(0000) GS:ffff88017ba00000(0000) knlGS:0000000000000000
+[ 6902.130996] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 6902.132558] CR2: 00005623599cac78 CR3: 000000014b700001 CR4: 00000000003606e0
+[ 6902.134270] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 6902.135981] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 6902.137836] Call Trace:
+[ 6902.138939] close_ctree+0x171/0x330 [btrfs]
+[ 6902.140181] ? kthread_stop+0x146/0x1f0
+[ 6902.141277] generic_shutdown_super+0x6c/0x100
+[ 6902.142517] kill_anon_super+0x14/0x30
+[ 6902.143554] btrfs_kill_super+0x13/0x100 [btrfs]
+[ 6902.144790] deactivate_locked_super+0x2f/0x70
+[ 6902.146014] cleanup_mnt+0x3b/0x70
+[ 6902.147020] task_work_run+0x9e/0xd0
+[ 6902.148036] do_syscall_64+0x470/0x600
+[ 6902.149142] ? trace_hardirqs_off_thunk+0x1a/0x1c
+[ 6902.150375] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 6902.151640] RIP: 0033:0x7f45077a6a7b
+[ 6902.157324] RSP: 002b:00007ffd589f3e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
+[ 6902.159187] RAX: 0000000000000000 RBX: 000055e8eec732b0 RCX: 00007f45077a6a7b
+[ 6902.160834] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000055e8eec73490
+[ 6902.162526] RBP: 0000000000000000 R08: 000055e8eec734b0 R09: 00007ffd589f26c0
+[ 6902.164141] R10: 0000000000000000 R11: 0000000000000246 R12: 000055e8eec73490
+[ 6902.165815] R13: 00007f4507ac61a4 R14: 0000000000000000 R15: 00007ffd589f40d8
+[ 6902.167553] irq event stamp: 0
+[ 6902.168998] hardirqs last enabled at (0): [<0000000000000000>] (null)
+[ 6902.170731] hardirqs last disabled at (0): [<ffffffff810cd810>] copy_process.part.55+0x3b0/0x1f00
+[ 6902.172773] softirqs last enabled at (0): [<ffffffff810cd810>] copy_process.part.55+0x3b0/0x1f00
+[ 6902.174671] softirqs last disabled at (0): [<0000000000000000>] (null)
+[ 6902.176407] ---[ end trace 463138c2986b275c ]---
+[ 6902.177636] BTRFS info (device dm-3): space_info 4 has 273465344 free, is not full
+[ 6902.179453] BTRFS info (device dm-3): space_info total=276824064, used=4685824, pinned=18446744073708158976, reserved=0, may_use=0, readonly=65536
+
+In the above line there's "pinned=18446744073708158976" which is an
+unsigned u64 value of -1392640, an obvious underflow.
+
+When transaction_kthread is running cleanup_transaction(), another
+fsstress is running btrfs_commit_transaction(). The
+btrfs_finish_extent_commit() may get the same range as
+btrfs_destroy_pinned_extent() got, which causes the pinned underflow.
+
+Fixes: d4b450cd4b33 ("Btrfs: fix race between transaction commit and empty block group removal")
+CC: stable@vger.kernel.org # 4.4+
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Signed-off-by: Lu Fengqi <lufq.fnst@cn.fujitsu.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/disk-io.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 1264ad35702e..106a032fc9cf 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4424,13 +4424,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info,
+ unpin = pinned_extents;
+ again:
+ while (1) {
++ /*
++ * The btrfs_finish_extent_commit() may get the same range as
++ * ours between find_first_extent_bit and clear_extent_dirty.
++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin
++ * the same extent range.
++ */
++ mutex_lock(&fs_info->unused_bg_unpin_mutex);
+ ret = find_first_extent_bit(unpin, 0, &start, &end,
+ EXTENT_DIRTY, NULL);
+- if (ret)
++ if (ret) {
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ break;
++ }
+
+ clear_extent_dirty(unpin, start, end);
+ btrfs_error_unpin_extent_range(fs_info, start, end);
++ mutex_unlock(&fs_info->unused_bg_unpin_mutex);
+ cond_resched();
+ }
+
+--
+2.17.1
+
diff --git a/patches.suse/0007-btrfs-start-readahead-also-in-seed-devices.patch b/patches.suse/0007-btrfs-start-readahead-also-in-seed-devices.patch
new file mode 100644
index 0000000000..081393fdd0
--- /dev/null
+++ b/patches.suse/0007-btrfs-start-readahead-also-in-seed-devices.patch
@@ -0,0 +1,52 @@
+From 4d5715676e477faf96c876516715a39960ca72d6 Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naohiro.aota@wdc.com>
+Date: Thu, 6 Jun 2019 16:54:44 +0900
+Subject: btrfs: start readahead also in seed devices
+Git-commit: c4e0540d0ad49c8ceab06cceed1de27c4fe29f6e
+Patch-mainline: v5.2-rc6
+References: bsc#1144886
+
+Currently, btrfs does not consult seed devices to start readahead. As a
+result, if readahead zone is added to the seed devices, btrfs_reada_wait()
+indefinitely wait for the reada_ctl to finish.
+
+You can reproduce the hung by modifying btrfs/163 to have larger initial
+file size (e.g. xfs_io pwrite 4M instead of current 256K).
+
+Fixes: 7414a03fbf9e ("btrfs: initial readahead code and prototypes")
+Cc: stable@vger.kernel.org # 3.2+: ce7791ffee1e: Btrfs: fix race between readahead and device replace/removal
+Cc: stable@vger.kernel.org # 3.2+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/btrfs/reada.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c
+index a17e775a4a89..ea4d24381c70 100644
+--- a/fs/btrfs/reada.c
++++ b/fs/btrfs/reada.c
+@@ -760,6 +760,7 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
+ u64 total = 0;
+ int i;
+
++again:
+ do {
+ enqueued = 0;
+ mutex_lock(&fs_devices->device_list_mutex);
+@@ -771,6 +772,10 @@ static void __reada_start_machine(struct btrfs_fs_info *fs_info)
+ mutex_unlock(&fs_devices->device_list_mutex);
+ total += enqueued;
+ } while (enqueued && total < 10000);
++ if (fs_devices->seed) {
++ fs_devices = fs_devices->seed;
++ goto again;
++ }
+
+ if (enqueued == 0)
+ return;
+--
+2.17.1
+
diff --git a/patches.suse/0031-bcache-add-return-value-check-to-bch_cached_dev_run.patch b/patches.suse/0031-bcache-add-return-value-check-to-bch_cached_dev_run.patch
index 7b73475e5c..0b7dd5bfa6 100644
--- a/patches.suse/0031-bcache-add-return-value-check-to-bch_cached_dev_run.patch
+++ b/patches.suse/0031-bcache-add-return-value-check-to-bch_cached_dev_run.patch
@@ -137,7 +137,7 @@ Signed-off-by: Jens Axboe <axboe@kernel.dk>
/* Flash only volumes */
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
-@@ -324,8 +324,11 @@ STORE(__cached_dev)
+@@ -328,8 +328,11 @@ STORE(__cached_dev)
bch_cache_accounting_clear(&dc->accounting);
if (attr == &sysfs_running &&
diff --git a/patches.suse/Btrfs-fix-race-between-send-and-deduplication-that-l.patch b/patches.suse/Btrfs-fix-race-between-send-and-deduplication-that-l.patch
new file mode 100644
index 0000000000..2a3fc9382b
--- /dev/null
+++ b/patches.suse/Btrfs-fix-race-between-send-and-deduplication-that-l.patch
@@ -0,0 +1,242 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 22 Apr 2019 16:43:42 +0100
+Git-commit: 62d54f3a7fa27ef6a74d6cdf643ce04beba3afa7
+Patch-mainline: 5.2
+References: bsc#1145059
+Subject: [PATCH] Btrfs: fix race between send and deduplication that lead
+ to failures and crashes
+
+Send operates on read only trees and expects them to never change while it
+is using them. This is part of its initial design, and this expection is
+due to two different reasons:
+
+1) When it was introduced, no operations were allowed to modifiy read-only
+ subvolumes/snapshots (including defrag for example).
+
+2) It keeps send from having an impact on other filesystem operations.
+ Namely send does not need to keep locks on the trees nor needs to hold on
+ to transaction handles and delay transaction commits. This ends up being
+ a consequence of the former reason.
+
+However the deduplication feature was introduced later (on September 2013,
+while send was introduced in July 2012) and it allowed for deduplication
+with destination files that belong to read-only trees (subvolumes and
+snapshots).
+
+That means that having a send operation (either full or incremental) running
+in parallel with a deduplication that has the destination inode in one of
+the trees used by the send operation, can result in tree nodes and leaves
+getting freed and reused while send is using them. This problem is similar
+to the problem solved for the root nodes getting freed and reused when a
+snapshot is made against one tree that is currenly being used by a send
+operation, fixed in commits [1] and [2]. These commits explain in detail
+how the problem happens and the explanation is valid for any node or leaf
+that is not the root of a tree as well. This problem was also discussed
+and explained recently in a thread [3].
+
+The problem is very easy to reproduce when using send with large trees
+(snapshots) and just a few concurrent deduplication operations that target
+files in the trees used by send. A stress test case is being sent for
+fstests that triggers the issue easily. The most common error to hit is
+the send ioctl return -EIO with the following messages in dmesg/syslog:
+
+ [1631617.204075] BTRFS error (device sdc): did not find backref in send_root. inode=63292, offset=0, disk_byte=5228134400 found extent=5228134400
+ [1631633.251754] BTRFS error (device sdc): parent transid verify failed on 32243712 wanted 24 found 27
+
+The first one is very easy to hit while the second one happens much less
+frequently, except for very large trees (in that test case, snapshots
+with 100000 files having large xattrs to get deep and wide trees).
+Less frequently, at least one BUG_ON can be hit:
+
+ [1631742.130080] ------------[ cut here ]------------
+ [1631742.130625] kernel BUG at fs/btrfs/ctree.c:1806!
+ [1631742.131188] invalid opcode: 0000 [#6] SMP DEBUG_PAGEALLOC PTI
+ [1631742.131726] CPU: 1 PID: 13394 Comm: btrfs Tainted: G B D W 5.0.0-rc8-btrfs-next-45 #1
+ [1631742.132265] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014
+ [1631742.133399] RIP: 0010:read_node_slot+0x122/0x130 [btrfs]
+ (...)
+ [1631742.135061] RSP: 0018:ffffb530021ebaa0 EFLAGS: 00010246
+ [1631742.135615] RAX: ffff93ac8912e000 RBX: 000000000000009d RCX: 0000000000000002
+ [1631742.136173] RDX: 000000000000009d RSI: ffff93ac564b0d08 RDI: ffff93ad5b48c000
+ [1631742.136759] RBP: ffffb530021ebb7d R08: 0000000000000001 R09: ffffb530021ebb7d
+ [1631742.137324] R10: ffffb530021eba70 R11: 0000000000000000 R12: ffff93ac87d0a708
+ [1631742.137900] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
+ [1631742.138455] FS: 00007f4cdb1528c0(0000) GS:ffff93ad76a80000(0000) knlGS:0000000000000000
+ [1631742.139010] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [1631742.139568] CR2: 00007f5acb3d0420 CR3: 000000012be3e006 CR4: 00000000003606e0
+ [1631742.140131] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [1631742.140719] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [1631742.141272] Call Trace:
+ [1631742.141826] ? do_raw_spin_unlock+0x49/0xc0
+ [1631742.142390] tree_advance+0x173/0x1d0 [btrfs]
+ [1631742.142948] btrfs_compare_trees+0x268/0x690 [btrfs]
+ [1631742.143533] ? process_extent+0x1070/0x1070 [btrfs]
+ [1631742.144088] btrfs_ioctl_send+0x1037/0x1270 [btrfs]
+ [1631742.144645] _btrfs_ioctl_send+0x80/0x110 [btrfs]
+ [1631742.145161] ? trace_sched_stick_numa+0xe0/0xe0
+ [1631742.145685] btrfs_ioctl+0x13fe/0x3120 [btrfs]
+ [1631742.146179] ? account_entity_enqueue+0xd3/0x100
+ [1631742.146662] ? reweight_entity+0x154/0x1a0
+ [1631742.147135] ? update_curr+0x20/0x2a0
+ [1631742.147593] ? check_preempt_wakeup+0x103/0x250
+ [1631742.148053] ? do_vfs_ioctl+0xa2/0x6f0
+ [1631742.148510] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
+ [1631742.148942] do_vfs_ioctl+0xa2/0x6f0
+ [1631742.149361] ? __fget+0x113/0x200
+ [1631742.149767] ksys_ioctl+0x70/0x80
+ [1631742.150159] __x64_sys_ioctl+0x16/0x20
+ [1631742.150543] do_syscall_64+0x60/0x1b0
+ [1631742.150931] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [1631742.151326] RIP: 0033:0x7f4cd9f5add7
+ (...)
+ [1631742.152509] RSP: 002b:00007ffe91017708 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+ [1631742.152892] RAX: ffffffffffffffda RBX: 0000000000000105 RCX: 00007f4cd9f5add7
+ [1631742.153268] RDX: 00007ffe91017790 RSI: 0000000040489426 RDI: 0000000000000007
+ [1631742.153633] RBP: 0000000000000007 R08: 00007f4cd9e79700 R09: 00007f4cd9e79700
+ [1631742.153999] R10: 00007f4cd9e799d0 R11: 0000000000000202 R12: 0000000000000003
+ [1631742.154365] R13: 0000555dfae53020 R14: 0000000000000000 R15: 0000000000000001
+ (...)
+ [1631742.156696] ---[ end trace 5dac9f96dcc3fd6b ]---
+
+That BUG_ON happens because while send is using a node, that node is COWed
+by a concurrent deduplication, gets freed and gets reused as a leaf (because
+a transaction commit happened in between), so when it attempts to read a
+slot from the extent buffer, at ctree.c:read_node_slot(), the extent buffer
+contents were wiped out and it now matches a leaf (which can even belong to
+some other tree now), hitting the BUG_ON(level == 0).
+
+Fix this concurrency issue by not allowing send and deduplication to run
+in parallel if both operate on the same readonly trees, returning EAGAIN
+to user space and logging an exlicit warning in dmesg/syslog.
+
+[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be6821f82c3cc36e026f5afd10249988852b35ea
+[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6f2f0b394b54e2b159ef969a0b5274e9bbf82ff2
+[3] https://lore.kernel.org/linux-btrfs/CAL3q7H7iqSEEyFaEtpRZw3cp613y+4k2Q8b4W7mweR3tZA05bQ@mail.gmail.com/
+
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/ctree.h | 6 ++++++
+ fs/btrfs/ioctl.c | 17 +++++++++++++++++
+ fs/btrfs/send.c | 26 ++++++++++++++++++++++++++
+ 3 files changed, 49 insertions(+)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index cabd87614a39..670372003915 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1321,6 +1321,12 @@ struct btrfs_root {
+ * manipulation with the read-only status via SUBVOL_SETFLAGS
+ */
+ int send_in_progress;
++ /*
++ * Number of currently running deduplication operations that have a
++ * destination inode belonging to this root. Protected by the lock
++ * root_item_lock.
++ */
++ int dedupe_in_progress;
+ struct btrfs_subvolume_writers *subv_writers;
+ atomic_t will_be_snapshoted;
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 24040eefc41c..0ec8da43835d 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3237,10 +3237,23 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
+ int num_pages = PAGE_ALIGN(BTRFS_MAX_DEDUPE_LEN) >> PAGE_SHIFT;
+ bool same_inode = (src == dst);
+ u64 i, tail_len, chunk_count;
++ struct btrfs_root *root_dst = BTRFS_I(dst)->root;
+
+ if (olen == 0)
+ return 0;
+
++ spin_lock(&root_dst->root_item_lock);
++ if (root_dst->send_in_progress) {
++ btrfs_warn_rl(root_dst->fs_info,
++"cannot deduplicate to root %llu while send operations are using it (%d in progress)",
++ root_dst->root_key.objectid,
++ root_dst->send_in_progress);
++ spin_unlock(&root_dst->root_item_lock);
++ return -EAGAIN;
++ }
++ root_dst->dedupe_in_progress++;
++ spin_unlock(&root_dst->root_item_lock);
++
+ if (same_inode)
+ inode_lock(src);
+ else
+@@ -3304,6 +3317,10 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
+ else
+ unlock_two_nondirectories(src, dst);
+
++ spin_lock(&root_dst->root_item_lock);
++ root_dst->dedupe_in_progress--;
++ spin_unlock(&root_dst->root_item_lock);
++
+ return ret;
+ }
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 0cfad0b15c4e..20e1db78dff0 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6621,6 +6621,13 @@ static void btrfs_root_dec_send_in_progress(struct btrfs_root* root)
+ spin_unlock(&root->root_item_lock);
+ }
+
++static void dedupe_in_progress_warn(const struct btrfs_root *root)
++{
++ btrfs_warn_rl(root->fs_info,
++"cannot use root %llu for send while deduplications on it are in progress (%d in progress)",
++ root->root_key.objectid, root->dedupe_in_progress);
++}
++
+ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ {
+ int ret = 0;
+@@ -6645,6 +6652,11 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ * making it RW. This also protects against deletion.
+ */
+ spin_lock(&send_root->root_item_lock);
++ if (btrfs_root_readonly(send_root) && send_root->dedupe_in_progress) {
++ dedupe_in_progress_warn(send_root);
++ spin_unlock(&send_root->root_item_lock);
++ return -EAGAIN;
++ }
+ send_root->send_in_progress++;
+ spin_unlock(&send_root->root_item_lock);
+
+@@ -6789,6 +6801,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ ret = -EPERM;
+ goto out;
+ }
++ if (clone_root->dedupe_in_progress) {
++ dedupe_in_progress_warn(clone_root);
++ spin_unlock(&clone_root->root_item_lock);
++ srcu_read_unlock(&fs_info->subvol_srcu, index);
++ ret = -EAGAIN;
++ goto out;
++ }
+ clone_root->send_in_progress++;
+ spin_unlock(&clone_root->root_item_lock);
+ srcu_read_unlock(&fs_info->subvol_srcu, index);
+@@ -6823,6 +6842,13 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ ret = -EPERM;
+ goto out;
+ }
++ if (sctx->parent_root->dedupe_in_progress) {
++ dedupe_in_progress_warn(sctx->parent_root);
++ spin_unlock(&sctx->parent_root->root_item_lock);
++ srcu_read_unlock(&fs_info->subvol_srcu, index);
++ ret = -EAGAIN;
++ goto out;
++ }
+ spin_unlock(&sctx->parent_root->root_item_lock);
+
+ srcu_read_unlock(&fs_info->subvol_srcu, index);
+--
+2.16.4
+
diff --git a/patches.suse/Btrfs-prevent-send-failures-and-crashes-due-to-concu.patch b/patches.suse/Btrfs-prevent-send-failures-and-crashes-due-to-concu.patch
new file mode 100644
index 0000000000..b73e18b2a6
--- /dev/null
+++ b/patches.suse/Btrfs-prevent-send-failures-and-crashes-due-to-concu.patch
@@ -0,0 +1,182 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 22 Apr 2019 16:44:09 +0100
+Git-commit: 9e967495e0e0ae8bb08f52aa71b29affc7075d31
+Patch-mainline: 5.3-rc1
+References: bsc#1145059
+Subject: [PATCH] Btrfs: prevent send failures and crashes due to
+ concurrent relocation
+
+Send always operates on read-only trees and always expected that while it
+is in progress, nothing changes in those trees. Due to that expectation
+and the fact that send is a read-only operation, it operates on commit
+roots and does not hold transaction handles. However relocation can COW
+nodes and leafs from read-only trees, which can cause unexpected failures
+and crashes (hitting BUG_ONs). while send using a node/leaf, it gets
+COWed, the transaction used to COW it is committed, a new transaction
+starts, the extent previously used for that node/leaf gets allocated,
+possibly for another tree, and the respective extent buffer' content
+changes while send is still using it. When this happens send normally
+fails with EIO being returned to user space and messages like the
+following are found in dmesg/syslog:
+
+ [ 3408.699121] BTRFS error (device sdc): parent transid verify failed on 58703872 wanted 250 found 253
+ [ 3441.523123] BTRFS error (device sdc): did not find backref in send_root. inode=63211, offset=0, disk_byte=5222825984 found extent=5222825984
+
+Other times, less often, we hit a BUG_ON() because an extent buffer that
+send is using used to be a node, and while send is still using it, it
+got COWed and got reused as a leaf while send is still using, producing
+the following trace:
+
+ [ 3478.466280] ------------[ cut here ]------------
+ [ 3478.466282] kernel BUG at fs/btrfs/ctree.c:1806!
+ [ 3478.466965] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
+ [ 3478.467635] CPU: 0 PID: 2165 Comm: btrfs Not tainted 5.0.0-btrfs-next-46 #1
+ [ 3478.468311] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.2-0-gf9626ccb91-prebuilt.qemu-project.org 04/01/2014
+ [ 3478.469681] RIP: 0010:read_node_slot+0x122/0x130 [btrfs]
+ (...)
+ [ 3478.471758] RSP: 0018:ffffa437826bfaa0 EFLAGS: 00010246
+ [ 3478.472457] RAX: ffff961416ed7000 RBX: 000000000000003d RCX: 0000000000000002
+ [ 3478.473151] RDX: 000000000000003d RSI: ffff96141e387408 RDI: ffff961599b30000
+ [ 3478.473837] RBP: ffffa437826bfb8e R08: 0000000000000001 R09: ffffa437826bfb8e
+ [ 3478.474515] R10: ffffa437826bfa70 R11: 0000000000000000 R12: ffff9614385c8708
+ [ 3478.475186] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ [ 3478.475840] FS: 00007f8e0e9cc8c0(0000) GS:ffff9615b6a00000(0000) knlGS:0000000000000000
+ [ 3478.476489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 3478.477127] CR2: 00007f98b67a056e CR3: 0000000005df6005 CR4: 00000000003606f0
+ [ 3478.477762] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [ 3478.478385] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [ 3478.479003] Call Trace:
+ [ 3478.479600] ? do_raw_spin_unlock+0x49/0xc0
+ [ 3478.480202] tree_advance+0x173/0x1d0 [btrfs]
+ [ 3478.480810] btrfs_compare_trees+0x30c/0x690 [btrfs]
+ [ 3478.481388] ? process_extent+0x1280/0x1280 [btrfs]
+ [ 3478.481954] btrfs_ioctl_send+0x1037/0x1270 [btrfs]
+ [ 3478.482510] _btrfs_ioctl_send+0x80/0x110 [btrfs]
+ [ 3478.483062] btrfs_ioctl+0x13fe/0x3120 [btrfs]
+ [ 3478.483581] ? rq_clock_task+0x2e/0x60
+ [ 3478.484086] ? wake_up_new_task+0x1f3/0x370
+ [ 3478.484582] ? do_vfs_ioctl+0xa2/0x6f0
+ [ 3478.485075] ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
+ [ 3478.485552] do_vfs_ioctl+0xa2/0x6f0
+ [ 3478.486016] ? __fget+0x113/0x200
+ [ 3478.486467] ksys_ioctl+0x70/0x80
+ [ 3478.486911] __x64_sys_ioctl+0x16/0x20
+ [ 3478.487337] do_syscall_64+0x60/0x1b0
+ [ 3478.487751] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+ [ 3478.488159] RIP: 0033:0x7f8e0d7d4dd7
+ (...)
+ [ 3478.489349] RSP: 002b:00007ffcf6fb4908 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+ [ 3478.489742] RAX: ffffffffffffffda RBX: 0000000000000105 RCX: 00007f8e0d7d4dd7
+ [ 3478.490142] RDX: 00007ffcf6fb4990 RSI: 0000000040489426 RDI: 0000000000000005
+ [ 3478.490548] RBP: 0000000000000005 R08: 00007f8e0d6f3700 R09: 00007f8e0d6f3700
+ [ 3478.490953] R10: 00007f8e0d6f39d0 R11: 0000000000000202 R12: 0000000000000005
+ [ 3478.491343] R13: 00005624e0780020 R14: 0000000000000000 R15: 0000000000000001
+ (...)
+ [ 3478.493352] ---[ end trace d5f537302be4f8c8 ]---
+
+Another possibility, much less likely to happen, is that send will not
+fail but the contents of the stream it produces may not be correct.
+
+To avoid this, do not allow send and relocation (balance) to run in
+parallel. In the long term the goal is to allow for both to be able to
+run concurrently without any problems, but that will take a significant
+effort in development and testing.
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/ctree.h | 7 +++++++
+ fs/btrfs/disk-io.c | 2 ++
+ fs/btrfs/send.c | 14 ++++++++++++++
+ fs/btrfs/volumes.c | 8 ++++++++
+ 4 files changed, 31 insertions(+)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index d1ea5233f80c..aaa1e485fe84 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -753,6 +753,7 @@ struct btrfs_delayed_root;
+ /*
+ * Indicate that balance has been set up from the ioctl and is in the main
+ * phase. The fs_info::balance_ctl is initialized.
++ * Set and cleared while holding fs_info::balance_mutex.
+ */
+ #define BTRFS_FS_BALANCE_RUNNING 18
+
+@@ -1150,6 +1151,12 @@ struct btrfs_fs_info {
+ u32 nodesize;
+ u32 sectorsize;
+ u32 stripesize;
++
++ /*
++ * Number of send operations in progress.
++ * Updated while holding fs_info::balance_mutex.
++ */
++ int send_in_progress;
+ };
+
+ static inline struct btrfs_fs_info *btrfs_sb(struct super_block *sb)
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 2a0043d5ce83..3586ae036823 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2665,6 +2665,8 @@ int open_ctree(struct super_block *sb,
+ fs_info->sectorsize = 4096;
+ fs_info->stripesize = 4096;
+
++ fs_info->send_in_progress = 0;
++
+ ret = btrfs_alloc_stripe_hash_table(fs_info);
+ if (ret) {
+ err = ret;
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 20e1db78dff0..bb1861ca7ddf 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6875,9 +6875,23 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+ if (ret)
+ goto out;
+
++ mutex_lock(&fs_info->balance_mutex);
++ if (test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags)) {
++ mutex_unlock(&fs_info->balance_mutex);
++ btrfs_warn_rl(fs_info,
++ "cannot run send because a balance operation is in progress");
++ ret = -EAGAIN;
++ goto out;
++ }
++ fs_info->send_in_progress++;
++ mutex_unlock(&fs_info->balance_mutex);
++
+ current->journal_info = BTRFS_SEND_TRANS_STUB;
+ ret = send_subvol(sctx);
+ current->journal_info = NULL;
++ mutex_lock(&fs_info->balance_mutex);
++ fs_info->send_in_progress--;
++ mutex_unlock(&fs_info->balance_mutex);
+ if (ret < 0)
+ goto out;
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index ec42bb0abba2..ffe57f600e74 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -3946,6 +3946,14 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
+ bctl->sys.target));
+ }
+
++ if (fs_info->send_in_progress) {
++ btrfs_warn_rl(fs_info,
++"cannot run balance while send operations are in progress (%d in progress)",
++ fs_info->send_in_progress);
++ ret = -EAGAIN;
++ goto out;
++ }
++
+ ret = insert_balance_item(fs_info, bctl);
+ if (ret && ret != -EEXIST)
+ goto out;
+--
+2.16.4
+
diff --git a/patches.suse/btrfs-prevent-ioctls-from-interfering-with-a-swap-file.patch b/patches.suse/btrfs-prevent-ioctls-from-interfering-with-a-swap-file.patch
index 217a0347e5..0d66119bc8 100644
--- a/patches.suse/btrfs-prevent-ioctls-from-interfering-with-a-swap-file.patch
+++ b/patches.suse/btrfs-prevent-ioctls-from-interfering-with-a-swap-file.patch
@@ -79,9 +79,9 @@ Acked-by: Nikolay Borisov <nborisov@suse.com>
#define BTRFS_FS_CLOSING_START 2
#define BTRFS_FS_CLOSING_DONE 3
@@ -1143,6 +1165,10 @@ struct btrfs_fs_info {
- u32 nodesize;
- u32 sectorsize;
- u32 stripesize;
+ * Updated while holding fs_info::balance_mutex.
+ */
+ int send_in_progress;
+
+ /* Block groups and devices containing active swapfiles. */
+ spinlock_t swapfile_pins_lock;
@@ -129,8 +129,8 @@ Acked-by: Nikolay Borisov <nborisov@suse.com>
root->log_transid_committed = -1;
root->last_log_commit = 0;
@@ -2675,6 +2676,9 @@ int open_ctree(struct super_block *sb,
- fs_info->sectorsize = 4096;
- fs_info->stripesize = 4096;
+
+ fs_info->send_in_progress = 0;
+ spin_lock_init(&fs_info->swapfile_pins_lock);
+ fs_info->swapfile_pins = RB_ROOT;
diff --git a/patches.suse/btrfs-track-running-balance-in-a-simpler-way.patch b/patches.suse/btrfs-track-running-balance-in-a-simpler-way.patch
new file mode 100644
index 0000000000..22eba0aadb
--- /dev/null
+++ b/patches.suse/btrfs-track-running-balance-in-a-simpler-way.patch
@@ -0,0 +1,159 @@
+From: David Sterba <dsterba@suse.com>
+Date: Wed, 21 Mar 2018 01:31:04 +0100
+Git-commit: 3009a62f3b18230a000d1a91e9a676036487e834
+Patch-mainline: 4.18
+References: bsc#1145059
+Subject: [PATCH] btrfs: track running balance in a simpler way
+
+Currently fs_info::balance_running is 0 or 1 and does not use the
+semantics of atomics. The pause and cancel check for 0, that can happen
+only after __btrfs_balance exits for whatever reason.
+
+Parallel calls to balance ioctl may enter btrfs_ioctl_balance multiple
+times but will block on the balance_mutex that protects the
+fs_info::flags bit.
+
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+---
+ fs/btrfs/ctree.h | 7 ++++++-
+ fs/btrfs/disk-io.c | 1 -
+ fs/btrfs/ioctl.c | 6 +++---
+ fs/btrfs/volumes.c | 18 ++++++++++--------
+ 4 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 670372003915..d1ea5233f80c 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -750,6 +750,12 @@ struct btrfs_delayed_root;
+ */
+ #define BTRFS_FS_NEED_ASYNC_COMMIT 17
+
++/*
++ * Indicate that balance has been set up from the ioctl and is in the main
++ * phase. The fs_info::balance_ctl is initialized.
++ */
++#define BTRFS_FS_BALANCE_RUNNING 18
++
+ struct btrfs_fs_info {
+ u8 fsid[BTRFS_FSID_SIZE];
+ u8 chunk_tree_uuid[BTRFS_UUID_SIZE];
+@@ -1030,7 +1036,6 @@ struct btrfs_fs_info {
+ /* restriper state */
+ spinlock_t balance_lock;
+ struct mutex balance_mutex;
+- atomic_t balance_running;
+ atomic_t balance_pause_req;
+ atomic_t balance_cancel_req;
+ struct btrfs_balance_control *balance_ctl;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index a82243503743..2a0043d5ce83 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -2208,7 +2208,6 @@ static void btrfs_init_balance(struct btrfs_fs_info *fs_info)
+ {
+ spin_lock_init(&fs_info->balance_lock);
+ mutex_init(&fs_info->balance_mutex);
+- atomic_set(&fs_info->balance_running, 0);
+ atomic_set(&fs_info->balance_pause_req, 0);
+ atomic_set(&fs_info->balance_cancel_req, 0);
+ fs_info->balance_ctl = NULL;
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 0ec8da43835d..1a2ea0d188f1 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -4693,7 +4693,7 @@ void update_ioctl_balance_args(struct btrfs_fs_info *fs_info, int lock,
+
+ bargs->flags = bctl->flags;
+
+- if (atomic_read(&fs_info->balance_running))
++ if (test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags))
+ bargs->state |= BTRFS_BALANCE_STATE_RUNNING;
+ if (atomic_read(&fs_info->balance_pause_req))
+ bargs->state |= BTRFS_BALANCE_STATE_PAUSE_REQ;
+@@ -4746,14 +4746,14 @@ static long btrfs_ioctl_balance(struct file *file, void __user *arg)
+ mutex_lock(&fs_info->balance_mutex);
+ if (fs_info->balance_ctl) {
+ /* this is either (2) or (3) */
+- if (!atomic_read(&fs_info->balance_running)) {
++ if (!test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags)) {
+ mutex_unlock(&fs_info->balance_mutex);
+ if (!mutex_trylock(&fs_info->volume_mutex))
+ goto again;
+ mutex_lock(&fs_info->balance_mutex);
+
+ if (fs_info->balance_ctl &&
+- !atomic_read(&fs_info->balance_running)) {
++ !test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags)) {
+ /* this is (3) */
+ need_unlock = false;
+ goto locked;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index c82c50b2467f..ec42bb0abba2 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -3960,13 +3960,14 @@ int btrfs_balance(struct btrfs_balance_control *bctl,
+ spin_unlock(&fs_info->balance_lock);
+ }
+
+- atomic_inc(&fs_info->balance_running);
++ ASSERT(!test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
++ set_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags);
+ mutex_unlock(&fs_info->balance_mutex);
+
+ ret = __btrfs_balance(fs_info);
+
+ mutex_lock(&fs_info->balance_mutex);
+- atomic_dec(&fs_info->balance_running);
++ clear_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags);
+
+ if (bctl->sys.flags & BTRFS_BALANCE_ARGS_CONVERT) {
+ fs_info->num_tolerated_disk_barrier_failures =
+@@ -4105,16 +4106,16 @@ int btrfs_pause_balance(struct btrfs_fs_info *fs_info)
+ return -ENOTCONN;
+ }
+
+- if (atomic_read(&fs_info->balance_running)) {
++ if (test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags)) {
+ atomic_inc(&fs_info->balance_pause_req);
+ mutex_unlock(&fs_info->balance_mutex);
+
+ wait_event(fs_info->balance_wait_q,
+- atomic_read(&fs_info->balance_running) == 0);
++ !test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
+
+ mutex_lock(&fs_info->balance_mutex);
+ /* we are good with balance_ctl ripped off from under us */
+- BUG_ON(atomic_read(&fs_info->balance_running));
++ BUG_ON(test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
+ atomic_dec(&fs_info->balance_pause_req);
+ } else {
+ ret = -ENOTCONN;
+@@ -4140,10 +4141,10 @@ int btrfs_cancel_balance(struct btrfs_fs_info *fs_info)
+ * if we are running just wait and return, balance item is
+ * deleted in btrfs_balance in this case
+ */
+- if (atomic_read(&fs_info->balance_running)) {
++ if (test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags)) {
+ mutex_unlock(&fs_info->balance_mutex);
+ wait_event(fs_info->balance_wait_q,
+- atomic_read(&fs_info->balance_running) == 0);
++ !test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
+ mutex_lock(&fs_info->balance_mutex);
+ } else {
+ /* __cancel_balance needs volume_mutex */
+@@ -4157,7 +4158,8 @@ int btrfs_cancel_balance(struct btrfs_fs_info *fs_info)
+ mutex_unlock(&fs_info->volume_mutex);
+ }
+
+- BUG_ON(fs_info->balance_ctl || atomic_read(&fs_info->balance_running));
++ BUG_ON(fs_info->balance_ctl ||
++ test_bit(BTRFS_FS_BALANCE_RUNNING, &fs_info->flags));
+ atomic_dec(&fs_info->balance_cancel_req);
+ mutex_unlock(&fs_info->balance_mutex);
+ return 0;
+--
+2.16.4
+
diff --git a/patches.suse/objtool-add-rewind_stack_do_exit-to-the-noreturn-list.patch b/patches.suse/objtool-add-rewind_stack_do_exit-to-the-noreturn-list.patch
new file mode 100644
index 0000000000..9b57b093c0
--- /dev/null
+++ b/patches.suse/objtool-add-rewind_stack_do_exit-to-the-noreturn-list.patch
@@ -0,0 +1,33 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Thu, 4 Apr 2019 12:17:35 -0500
+Subject: objtool: Add rewind_stack_do_exit() to the noreturn list
+Git-commit: 4fa5ecda2bf96be7464eb406df8aba9d89260227
+Patch-mainline: v5.1-rc5
+References: bsc#1145302
+
+This fixes the following warning seen on GCC 7.3:
+
+ arch/x86/kernel/dumpstack.o: warning: objtool: oops_end() falls through to next function show_regs()
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/3418ebf5a5a9f6ed7e80954c741c0b904b67b5dc.1554398240.git.jpoimboe@redhat.com
+
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ tools/objtool/check.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/objtool/check.c
++++ b/tools/objtool/check.c
+@@ -163,6 +163,7 @@ static int __dead_end_function(struct ob
+ "__reiserfs_panic",
+ "lbug_with_loc",
+ "fortify_panic",
++ "rewind_stack_do_exit",
+ };
+
+ if (func->bind == STB_WEAK)
+
diff --git a/patches.suse/objtool-fix-segfault-in-cold-detection-with-ffunction-sections.patch b/patches.suse/objtool-fix-segfault-in-cold-detection-with-ffunction-sections.patch
index 58f55f4e56..c96f8397a0 100644
--- a/patches.suse/objtool-fix-segfault-in-cold-detection-with-ffunction-sections.patch
+++ b/patches.suse/objtool-fix-segfault-in-cold-detection-with-ffunction-sections.patch
@@ -49,7 +49,7 @@ Acked-by: Miroslav Benes <mbenes@suse.cz>
if (sym->type != STT_FUNC)
continue;
sym->pfunc = sym->cfunc = sym;
- coldstr = strstr(sym->name, ".cold.");
+ coldstr = strstr(sym->name, ".cold");
if (coldstr) {
- coldstr[0] = '\0';
- pfunc = find_symbol_by_name(elf, sym->name);
diff --git a/patches.suse/objtool-support-gcc-9-cold-subfunction-naming-scheme.patch b/patches.suse/objtool-support-gcc-9-cold-subfunction-naming-scheme.patch
new file mode 100644
index 0000000000..de45b55c6a
--- /dev/null
+++ b/patches.suse/objtool-support-gcc-9-cold-subfunction-naming-scheme.patch
@@ -0,0 +1,50 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Wed, 31 Oct 2018 21:57:30 -0500
+Subject: objtool: Support GCC 9 cold subfunction naming scheme
+Git-commit: bcb6fb5da77c2a228adf07cc9cb1a0c2aa2001c6
+Patch-mainline: v4.20-rc1
+References: bsc#1145300
+
+Starting with GCC 8, a lot of unlikely code was moved out of line to
+"cold" subfunctions in .text.unlikely.
+
+For example, the unlikely bits of:
+
+ irq_do_set_affinity()
+
+are moved out to the following subfunction:
+
+ irq_do_set_affinity.cold.49()
+
+Starting with GCC 9, the numbered suffix has been removed. So in the
+above example, the cold subfunction is instead:
+
+ irq_do_set_affinity.cold()
+
+Tweak the objtool subfunction detection logic so that it detects both
+GCC 8 and GCC 9 naming schemes.
+
+Reported-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/015e9544b1f188d36a7f02fa31e9e95629aa5f50.1541040800.git.jpoimboe@redhat.com
+
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ tools/objtool/elf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/objtool/elf.c
++++ b/tools/objtool/elf.c
+@@ -301,7 +301,7 @@ static int read_symbols(struct elf *elf)
+ if (sym->type != STT_FUNC)
+ continue;
+ sym->pfunc = sym->cfunc = sym;
+- coldstr = strstr(sym->name, ".cold.");
++ coldstr = strstr(sym->name, ".cold");
+ if (coldstr) {
+ coldstr[0] = '\0';
+ pfunc = find_symbol_by_name(elf, sym->name);
+
diff --git a/patches.suse/xfs-dump-transaction-usage-details-on-log-reservation-overrun.patch b/patches.suse/xfs-dump-transaction-usage-details-on-log-reservation-overrun.patch
new file mode 100644
index 0000000000..e0e3d666fd
--- /dev/null
+++ b/patches.suse/xfs-dump-transaction-usage-details-on-log-reservation-overrun.patch
@@ -0,0 +1,162 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Wed, 14 Jun 2017 21:29:50 -0700
+Subject: xfs: dump transaction usage details on log reservation overrun
+Git-commit: d4ca1d550d052accec85ae26ac5b9d3d8b8f81f1
+Patch-mainline: v4.13-rc1
+References: bsc#1145235
+
+If a transaction log reservation overrun occurs, the ticket data
+associated with the reservation is dumped in xfs_log_commit_cil().
+This occurs long after the transaction items and details have been
+removed from the transaction and effectively lost. This limited set
+of ticket data provides very little information to support debugging
+transaction overruns based on the typical report.
+
+To improve transaction log reservation overrun reporting, create a
+helper to dump transaction details such as log items, log vector
+data, etc., as well as the underlying ticket data for the
+transaction. Move the overrun detection from xfs_log_commit_cil() to
+xlog_cil_insert_items() so it occurs prior to migration of the
+logged items to the CIL. Call the new helper such that it is able to
+dump this transaction data before it is lost.
+
+Also, warn on overrun to provide callstack context for the offending
+transaction and include a few additional messages from
+xlog_cil_insert_items() to display the reservation consumed locally
+for overhead such as log vector headers, split region headers and
+the context ticket. This provides a complete general breakdown of
+the reservation consumption of a transaction when/if it happens to
+overrun the reservation.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/xfs_log.c | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
+ fs/xfs/xfs_log_cil.c | 24 ++++++++++++++++++------
+ fs/xfs/xfs_log_priv.h | 1 +
+ 3 files changed, 68 insertions(+), 6 deletions(-)
+
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index 8b283f7cefea..c8d048103347 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -2047,6 +2047,55 @@ xlog_print_tic_res(
+ }
+ }
+
++/*
++ * Print a summary of the transaction.
++ */
++void
++xlog_print_trans(
++ struct xfs_trans *tp)
++{
++ struct xfs_mount *mp = tp->t_mountp;
++ struct xfs_log_item_desc *lidp;
++
++ /* dump core transaction and ticket info */
++ xfs_warn(mp, "transaction summary:");
++ xfs_warn(mp, " flags = 0x%x", tp->t_flags);
++
++ xlog_print_tic_res(mp, tp->t_ticket);
++
++ /* dump each log item */
++ list_for_each_entry(lidp, &tp->t_items, lid_trans) {
++ struct xfs_log_item *lip = lidp->lid_item;
++ struct xfs_log_vec *lv = lip->li_lv;
++ struct xfs_log_iovec *vec;
++ int i;
++
++ xfs_warn(mp, "log item: ");
++ xfs_warn(mp, " type = 0x%x", lip->li_type);
++ xfs_warn(mp, " flags = 0x%x", lip->li_flags);
++ if (!lv)
++ continue;
++ xfs_warn(mp, " niovecs = %d", lv->lv_niovecs);
++ xfs_warn(mp, " size = %d", lv->lv_size);
++ xfs_warn(mp, " bytes = %d", lv->lv_bytes);
++ xfs_warn(mp, " buf len = %d", lv->lv_buf_len);
++
++ /* dump each iovec for the log item */
++ vec = lv->lv_iovecp;
++ for (i = 0; i < lv->lv_niovecs; i++) {
++ int dumplen = min(vec->i_len, 32);
++
++ xfs_warn(mp, " iovec[%d]", i);
++ xfs_warn(mp, " type = 0x%x", vec->i_type);
++ xfs_warn(mp, " len = %d", vec->i_len);
++ xfs_warn(mp, " first %d bytes of iovec[%d]:", dumplen, i);
++ xfs_hex_dump(vec->i_addr, dumplen);;
++
++ vec++;
++ }
++ }
++}
++
+ /*
+ * Calculate the potential space needed by the log vector. Each region gets
+ * its own xlog_op_header_t and may need to be double word aligned.
+diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
+index 8de3baa7d3f0..04b389210cc7 100644
+--- a/fs/xfs/xfs_log_cil.c
++++ b/fs/xfs/xfs_log_cil.c
+@@ -459,6 +459,21 @@ xlog_cil_insert_items(
+ tp->t_ticket->t_curr_res -= len;
+ ctx->space_used += len;
+
++ /*
++ * If we've overrun the reservation, dump the tx details before we move
++ * the log items. Shutdown is imminent...
++ */
++ if (WARN_ON(tp->t_ticket->t_curr_res < 0)) {
++ xfs_warn(log->l_mp, "Transaction log reservation overrun:");
++ xfs_warn(log->l_mp,
++ " log items: %d bytes (iov hdrs: %d bytes)",
++ len, iovhdr_res);
++ xfs_warn(log->l_mp, " split region headers: %d bytes",
++ split_res);
++ xfs_warn(log->l_mp, " ctx ticket: %d bytes", ctx_res);
++ xlog_print_trans(tp);
++ }
++
+ /*
+ * Now (re-)position everything modified at the tail of the CIL.
+ * We do this here so we only need to take the CIL lock once during
+@@ -481,6 +496,9 @@ xlog_cil_insert_items(
+ }
+
+ spin_unlock(&cil->xc_cil_lock);
++
++ if (tp->t_ticket->t_curr_res < 0)
++ xfs_force_shutdown(log->l_mp, SHUTDOWN_LOG_IO_ERROR);
+ }
+
+ static void
+@@ -988,12 +1006,6 @@ xfs_log_commit_cil(
+
+ xlog_cil_insert_items(log, tp);
+
+- /* check we didn't blow the reservation */
+- if (tp->t_ticket->t_curr_res < 0) {
+- xlog_print_tic_res(mp, tp->t_ticket);
+- xfs_force_shutdown(log->l_mp, SHUTDOWN_LOG_IO_ERROR);
+- }
+-
+ tp->t_commit_lsn = cil->xc_ctx->sequence;
+ if (commit_lsn)
+ *commit_lsn = tp->t_commit_lsn;
+diff --git a/fs/xfs/xfs_log_priv.h b/fs/xfs/xfs_log_priv.h
+index c2604a5366f2..62113a5d2504 100644
+--- a/fs/xfs/xfs_log_priv.h
++++ b/fs/xfs/xfs_log_priv.h
+@@ -456,6 +456,7 @@ xlog_write_adv_cnt(void **ptr, int *len, int *off, size_t bytes)
+ }
+
+ void xlog_print_tic_res(struct xfs_mount *mp, struct xlog_ticket *ticket);
++void xlog_print_trans(struct xfs_trans *);
+ int
+ xlog_write(
+ struct xlog *log,
+
diff --git a/patches.suse/xfs-eliminate-duplicate-icreate-tx-reservation-functions.patch b/patches.suse/xfs-eliminate-duplicate-icreate-tx-reservation-functions.patch
new file mode 100644
index 0000000000..281d636218
--- /dev/null
+++ b/patches.suse/xfs-eliminate-duplicate-icreate-tx-reservation-functions.patch
@@ -0,0 +1,143 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:38 -0800
+Subject: xfs: eliminate duplicate icreate tx reservation functions
+Git-commit: c017cb5ddfd6326032570d5eba83308c8a9c13a9
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+The create transaction reservation calculation has two different
+branches of code depending on whether the filesystem is a v5 format
+fs or older. Each branch considers the max reservation between the
+allocation case (new chunk allocation + record insert) and the
+modify case (chunk exists, record modification) of inode allocation.
+
+The modify case is the same for both superblock versions with the
+exception of the finobt. The finobt helper checks the feature bit,
+however, and so the modify case already shares the same code.
+
+Now that inode chunk allocation has been refactored into a helper
+that checks the superblock version to calculate the appropriate
+reservation for the create transaction, the only remaining
+difference between the create and icreate branches is the call to
+the finobt helper. As noted above, the finobt helper is a no-op when
+the feature is not enabled. Therefore, these branches are
+effectively duplicate and can be condensed.
+
+Remove the xfs_calc_create_*() branch of functions and update the
+various callers to use the xfs_calc_icreate_*() variant. The latter
+creates the same reservation size for v4 create transactions as the
+removed branch. As such, this patch does not result in transaction
+reservation changes.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/libxfs/xfs_trans_resv.c | 52 +++++-------------------------------------
+ 1 file changed, 6 insertions(+), 46 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index 75259a1346eb..5f17641f040f 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -413,39 +413,13 @@ xfs_calc_create_resv_modify(
+ xfs_calc_finobt_res(mp);
+ }
+
+-/*
+- * For create we can allocate some inodes giving:
+- * the agi and agf of the ag getting the new inodes: 2 * sectorsize
+- * the superblock for the nlink flag: sector size
+- * the inode chunk (allocation/init)
+- * the inode btree (record insertion)
+- */
+-STATIC uint
+-xfs_calc_create_resv_alloc(
+- struct xfs_mount *mp)
+-{
+- return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
+- mp->m_sb.sb_sectsize +
+- xfs_calc_inode_chunk_res(mp, _ALLOC) +
+- xfs_calc_inobt_res(mp);
+-}
+-
+-STATIC uint
+-__xfs_calc_create_reservation(
+- struct xfs_mount *mp)
+-{
+- return XFS_DQUOT_LOGRES(mp) +
+- MAX(xfs_calc_create_resv_alloc(mp),
+- xfs_calc_create_resv_modify(mp));
+-}
+-
+ /*
+ * For icreate we can allocate some inodes giving:
+ * the agi and agf of the ag getting the new inodes: 2 * sectorsize
+ * the superblock for the nlink flag: sector size
+- * the inode chunk (allocation, no init)
++ * the inode chunk (allocation, optional init)
+ * the inobt (record insertion)
+- * the finobt (record insertion)
++ * the finobt (optional, record insertion)
+ */
+ STATIC uint
+ xfs_calc_icreate_resv_alloc(
+@@ -466,27 +440,13 @@ xfs_calc_icreate_reservation(xfs_mount_t *mp)
+ xfs_calc_create_resv_modify(mp));
+ }
+
+-STATIC uint
+-xfs_calc_create_reservation(
+- struct xfs_mount *mp)
+-{
+- if (xfs_sb_version_hascrc(&mp->m_sb))
+- return xfs_calc_icreate_reservation(mp);
+- return __xfs_calc_create_reservation(mp);
+-
+-}
+-
+ STATIC uint
+ xfs_calc_create_tmpfile_reservation(
+ struct xfs_mount *mp)
+ {
+ uint res = XFS_DQUOT_LOGRES(mp);
+
+- if (xfs_sb_version_hascrc(&mp->m_sb))
+- res += xfs_calc_icreate_resv_alloc(mp);
+- else
+- res += xfs_calc_create_resv_alloc(mp);
+-
++ res += xfs_calc_icreate_resv_alloc(mp);
+ return res + xfs_calc_iunlink_add_reservation(mp);
+ }
+
+@@ -497,7 +457,7 @@ STATIC uint
+ xfs_calc_mkdir_reservation(
+ struct xfs_mount *mp)
+ {
+- return xfs_calc_create_reservation(mp);
++ return xfs_calc_icreate_reservation(mp);
+ }
+
+
+@@ -510,7 +470,7 @@ STATIC uint
+ xfs_calc_symlink_reservation(
+ struct xfs_mount *mp)
+ {
+- return xfs_calc_create_reservation(mp) +
++ return xfs_calc_icreate_reservation(mp) +
+ xfs_calc_buf_res(1, XFS_SYMLINK_MAXLEN);
+ }
+
+@@ -869,7 +829,7 @@ xfs_trans_resv_calc(
+ resp->tr_symlink.tr_logcount = XFS_SYMLINK_LOG_COUNT;
+ resp->tr_symlink.tr_logflags |= XFS_TRANS_PERM_LOG_RES;
+
+- resp->tr_create.tr_logres = xfs_calc_create_reservation(mp);
++ resp->tr_create.tr_logres = xfs_calc_icreate_reservation(mp);
+ resp->tr_create.tr_logcount = XFS_CREATE_LOG_COUNT;
+ resp->tr_create.tr_logflags |= XFS_TRANS_PERM_LOG_RES;
+
+
diff --git a/patches.suse/xfs-fix-semicolon-cocci-warnings.patch b/patches.suse/xfs-fix-semicolon-cocci-warnings.patch
new file mode 100644
index 0000000000..585d5c3390
--- /dev/null
+++ b/patches.suse/xfs-fix-semicolon-cocci-warnings.patch
@@ -0,0 +1,39 @@
+From: kbuild test robot <fengguang.wu@intel.com>
+Date: Mon, 26 Jun 2017 08:54:16 -0700
+Subject: xfs: fix semicolon.cocci warnings
+Git-commit: 244e3dea58818e9520bf3dbaf4404a60b105bfb1
+Patch-mainline: v4.13-rc1
+References: bsc#1145235
+
+fs/xfs/xfs_log.c:2092:38-39: Unneeded semicolon
+
+
+ Remove unneeded semicolon.
+
+Generated by: scripts/coccinelle/misc/semicolon.cocci
+
+Fixes: d4ca1d550d05 ("xfs: dump transaction usage details on log reservation overrun")
+CC: Brian Foster <bfoster@redhat.com>
+Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/xfs_log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index 31f11be42f01..0053bcf2b10a 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -2085,7 +2085,7 @@ xlog_print_trans(
+ xfs_warn(mp, " type = 0x%x", vec->i_type);
+ xfs_warn(mp, " len = %d", vec->i_len);
+ xfs_warn(mp, " first %d bytes of iovec[%d]:", dumplen, i);
+- xfs_hex_dump(vec->i_addr, dumplen);;
++ xfs_hex_dump(vec->i_addr, dumplen);
+
+ vec++;
+ }
+
diff --git a/patches.suse/xfs-fix-up-agi-unlinked-list-reservations.patch b/patches.suse/xfs-fix-up-agi-unlinked-list-reservations.patch
new file mode 100644
index 0000000000..48e787add4
--- /dev/null
+++ b/patches.suse/xfs-fix-up-agi-unlinked-list-reservations.patch
@@ -0,0 +1,62 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:36 -0800
+Subject: xfs: fix up agi unlinked list reservations
+Git-commit: e8341d9f6348640dff01d8c4a33695dc82bab5a3
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+The current AGI unlinked list addition and removal reservations do
+not reflect the worst case log usage. An unlinked list removal can
+log up to two on-disk inode clusters but only includes reservation
+for one. An unlinked list addition logs the on-disk cluster but
+includes reservation for an in-core inode.
+
+Update the AGI unlinked list reservation helpers to calculate the
+correct worst case reservation for the associated operations.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/libxfs/xfs_trans_resv.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index 838566b85622..173b1bc13ffe 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -282,13 +282,14 @@ xfs_calc_rename_reservation(
+ * For removing an inode from unlinked list at first, we can modify:
+ * the agi hash list and counters: sector size
+ * the on disk inode before ours in the agi hash list: inode cluster size
++ * the on disk inode in the agi hash list: inode cluster size
+ */
+ STATIC uint
+ xfs_calc_iunlink_remove_reservation(
+ struct xfs_mount *mp)
+ {
+ return xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
+- max_t(uint, XFS_FSB_TO_B(mp, 1), mp->m_inode_cluster_size);
++ 2 * max_t(uint, XFS_FSB_TO_B(mp, 1), mp->m_inode_cluster_size);
+ }
+
+ /*
+@@ -320,13 +321,13 @@ xfs_calc_link_reservation(
+ /*
+ * For adding an inode to unlinked list we can modify:
+ * the agi hash list: sector size
+- * the unlinked inode: inode size
++ * the on disk inode: inode cluster size
+ */
+ STATIC uint
+ xfs_calc_iunlink_add_reservation(xfs_mount_t *mp)
+ {
+ return xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
+- xfs_calc_inode_res(mp, 1);
++ max_t(uint, XFS_FSB_TO_B(mp, 1), mp->m_inode_cluster_size);
+ }
+
+ /*
+
diff --git a/patches.suse/xfs-include-an-allocfree-res-for-inobt-modifications.patch b/patches.suse/xfs-include-an-allocfree-res-for-inobt-modifications.patch
new file mode 100644
index 0000000000..9475c7b1b6
--- /dev/null
+++ b/patches.suse/xfs-include-an-allocfree-res-for-inobt-modifications.patch
@@ -0,0 +1,214 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:37 -0800
+Subject: xfs: include an allocfree res for inobt modifications
+Git-commit: f03c78f39710995d2766236f229295d91b8de9dd
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+Analysis of recent reports of log reservation overruns and code
+inspection has uncovered that the reservations associated with inode
+operations may not cover the worst case scenarios. In particular,
+many cases only include one allocfree res. for a particular
+operation even though said operations may also entail AGFL fixups
+and inode btree block allocations in addition to the actual inode
+chunk allocation. This can easily turn into two or three block
+allocations (or frees) per operation.
+
+In theory, the only way to define the worst case reservation is to
+include an allocfree res for each individual allocation in a
+transaction. Since that is impractical (we can perform multiple agfl
+fixups per tx and not every allocation results in a full tree
+operation), we need to find a reasonable compromise that addresses
+the deficiency in practice without blowing out the size of the
+transactions.
+
+Since the inode btrees are not filled by the AGFL, record insertion
+and removal can directly result in block allocations and frees
+depending on the shape of the tree. These allocations and frees
+occur in the same transaction context as the inobt update itself,
+but are separate from the allocation/free that might be required for
+an inode chunk. Therefore, it makes sense to assume that an [f]inobt
+insert/remove can directly result in one or more block allocations
+on behalf of the tree.
+
+Refactor the inode transaction reservations to include one allocfree
+res. per inode btree modification to cover allocations required by
+the tree itself. This separates the reservation required to allocate
+the inode chunk from the reservation required for inobt record
+insertion/removal. Apply the same logic to the finobt. This results
+in killing off the finobt modify condition because we no longer
+assume that the broader transaction reservation will cover finobt
+block allocations and finobt shape changes can occur in either of
+the inobt allocation or modify situations.
+
+Suggested-by: Dave Chinner <david@fromorbit.com>
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/libxfs/xfs_trans_resv.c | 84 +++++++++++++++++++++---------------------
+ 1 file changed, 43 insertions(+), 41 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index 037a1295d289..19f3a226a357 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -132,44 +132,43 @@ xfs_calc_inode_res(
+ }
+
+ /*
+- * The free inode btree is a conditional feature and the log reservation
+- * requirements differ slightly from that of the traditional inode allocation
+- * btree. The finobt tracks records for inode chunks with at least one free
+- * inode. A record can be removed from the tree for an inode allocation
+- * or free and thus the finobt reservation is unconditional across:
++ * Inode btree record insertion/removal modifies the inode btree and free space
++ * btrees (since the inobt does not use the agfl). This requires the following
++ * reservation:
+ *
+- * - inode allocation
+- * - inode free
+- * - inode chunk allocation
++ * the inode btree: max depth * blocksize
++ * the allocation btrees: 2 trees * (max depth - 1) * block size
+ *
+- * The 'modify' param indicates to include the record modification scenario. The
+- * 'alloc' param indicates to include the reservation for free space btree
+- * modifications on behalf of finobt modifications. This is required only for
+- * transactions that do not already account for free space btree modifications.
++ * The caller must account for SB and AG header modifications, etc.
++ */
++STATIC uint
++xfs_calc_inobt_res(
++ struct xfs_mount *mp)
++{
++ return xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
++ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
++ XFS_FSB_TO_B(mp, 1));
++}
++
++/*
++ * The free inode btree is a conditional feature. The behavior differs slightly
++ * from that of the traditional inode btree in that the finobt tracks records
++ * for inode chunks with at least one free inode. A record can be removed from
++ * the tree during individual inode allocation. Therefore the finobt
++ * reservation is unconditional for both the inode chunk allocation and
++ * individual inode allocation (modify) cases.
+ *
+- * the free inode btree: max depth * block size
+- * the allocation btrees: 2 trees * (max depth - 1) * block size
+- * the free inode btree entry: block size
++ * Behavior aside, the reservation for finobt modification is equivalent to the
++ * traditional inobt: cover a full finobt shape change plus block allocation.
+ */
+ STATIC uint
+ xfs_calc_finobt_res(
+- struct xfs_mount *mp,
+- int alloc,
+- int modify)
++ struct xfs_mount *mp)
+ {
+- uint res;
+-
+ if (!xfs_sb_version_hasfinobt(&mp->m_sb))
+ return 0;
+
+- res = xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1));
+- if (alloc)
+- res += xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+- XFS_FSB_TO_B(mp, 1));
+- if (modify)
+- res += (uint)XFS_FSB_TO_B(mp, 1);
+-
+- return res;
++ return xfs_calc_inobt_res(mp);
+ }
+
+ /*
+@@ -373,7 +372,7 @@ xfs_calc_create_resv_modify(
+ xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
+ (uint)XFS_FSB_TO_B(mp, 1) +
+ xfs_calc_buf_res(XFS_DIROP_LOG_COUNT(mp), XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_finobt_res(mp, 1, 1);
++ xfs_calc_finobt_res(mp);
+ }
+
+ /*
+@@ -381,8 +380,8 @@ xfs_calc_create_resv_modify(
+ * the agi and agf of the ag getting the new inodes: 2 * sectorsize
+ * the superblock for the nlink flag: sector size
+ * the inode blocks allocated: mp->m_ialloc_blks * blocksize
+- * the inode btree: max depth * blocksize
+ * the allocation btrees: 2 trees * (max depth - 1) * block size
++ * the inode btree (record insertion)
+ */
+ STATIC uint
+ xfs_calc_create_resv_alloc(
+@@ -391,9 +390,9 @@ xfs_calc_create_resv_alloc(
+ return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
+ mp->m_sb.sb_sectsize +
+ xfs_calc_buf_res(mp->m_ialloc_blks, XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
+ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+- XFS_FSB_TO_B(mp, 1));
++ XFS_FSB_TO_B(mp, 1)) +
++ xfs_calc_inobt_res(mp);
+ }
+
+ STATIC uint
+@@ -409,8 +408,8 @@ __xfs_calc_create_reservation(
+ * For icreate we can allocate some inodes giving:
+ * the agi and agf of the ag getting the new inodes: 2 * sectorsize
+ * the superblock for the nlink flag: sector size
+- * the inode btree: max depth * blocksize
+ * the allocation btrees: 2 trees * (max depth - 1) * block size
++ * the inobt (record insertion)
+ * the finobt (record insertion)
+ */
+ STATIC uint
+@@ -419,10 +418,10 @@ xfs_calc_icreate_resv_alloc(
+ {
+ return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
+ mp->m_sb.sb_sectsize +
+- xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
+ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+ XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_finobt_res(mp, 0, 0);
++ xfs_calc_inobt_res(mp) +
++ xfs_calc_finobt_res(mp);
+ }
+
+ STATIC uint
+@@ -487,9 +486,14 @@ xfs_calc_symlink_reservation(
+ * the super block free inode counter, AGF and AGFL: sector size
+ * the on disk inode (agi unlinked list removal)
+ * the inode chunk is marked stale (headers only)
+- * the inode btree: max depth * blocksize
+- * the allocation btrees: 2 trees * (max depth - 1) * block size
++ * the inode btree
+ * the finobt (record insertion, removal or modification)
++ *
++ * Note that the allocfree res. for the inode chunk itself is not included
++ * because the extent free occurs after a transaction roll. We could take the
++ * maximum of the pre/post roll operations, but the pre-roll reservation already
++ * includes at least one allocfree res. for the inobt and is thus guaranteed to
++ * be larger.
+ */
+ STATIC uint
+ xfs_calc_ifree_reservation(
+@@ -500,10 +504,8 @@ xfs_calc_ifree_reservation(
+ xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
+ xfs_calc_iunlink_remove_reservation(mp) +
+ xfs_calc_buf_res(mp->m_ialloc_blks, 0) +
+- xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+- XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_finobt_res(mp, 0, 1);
++ xfs_calc_inobt_res(mp) +
++ xfs_calc_finobt_res(mp);
+ }
+
+ /*
+
diff --git a/patches.suse/xfs-include-inobt-buffers-in-ifree-tx-log-reservation.patch b/patches.suse/xfs-include-inobt-buffers-in-ifree-tx-log-reservation.patch
new file mode 100644
index 0000000000..de75d36e6f
--- /dev/null
+++ b/patches.suse/xfs-include-inobt-buffers-in-ifree-tx-log-reservation.patch
@@ -0,0 +1,84 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:36 -0800
+Subject: xfs: include inobt buffers in ifree tx log reservation
+Git-commit: a6f485908d5210a5662f7a031bd1deeb3867e466
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+The tr_ifree transaction handles inode unlinks and inode chunk
+frees. The current transaction calculation does not accurately
+reflect worst case changes to the inode btree, however. The inobt
+portion of the current transaction reservation only covers
+modification of a single inobt buffer (for the particular inode
+record). This is a historical artifact from the days before XFS
+supported full inode chunk removal.
+
+When support for inode chunk removal was added in commit
+254f6311ed1b ("Implement deletion of inode clusters in XFS."), the
+additional log reservation required for chunk removal was not added
+correctly. The new reservation only considered the header overhead
+of associated buffers rather than the full contents of the btrees
+and AGF and AGFL buffers affected by the transaction. The
+reservation for the free space btrees was subsequently fixed up in
+commit 5fe6abb82f76 ("Add space for inode and allocation btrees to
+ITRUNCATE log reservation"), but the res. for full inobt joins has
+never been added.
+
+Further review of the ifree reservation uncovered a couple more
+problems:
+
+- The undocumented +2 blocks are intended for the AGF and AGFL, but
+ are also not sized correctly and should be logged as full sectors
+ (not FSBs).
+- The additional single block header is undocumented and serves no
+ apparent purpose.
+
+Update xfs_calc_ifree_reservation() to include a full inobt join in
+the reservation calculation. Refactor the undocumented blocks
+appropriately and fix up the comments to reflect the current
+calculation.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/libxfs/xfs_trans_resv.c | 15 ++++++---------
+ 1 file changed, 6 insertions(+), 9 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index 6bd916bd35e2..838566b85622 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -490,10 +490,9 @@ xfs_calc_symlink_reservation(
+ /*
+ * In freeing an inode we can modify:
+ * the inode being freed: inode size
+- * the super block free inode counter: sector size
+- * the agi hash list and counters: sector size
+- * the inode btree entry: block size
+- * the on disk inode before ours in the agi hash list: inode cluster size
++ * the super block free inode counter, AGF and AGFL: sector size
++ * the on disk inode (agi unlinked list removal)
++ * the inode chunk is marked stale (headers only)
+ * the inode btree: max depth * blocksize
+ * the allocation btrees: 2 trees * (max depth - 1) * block size
+ * the finobt (record insertion, removal or modification)
+@@ -504,12 +503,10 @@ xfs_calc_ifree_reservation(
+ {
+ return XFS_DQUOT_LOGRES(mp) +
+ xfs_calc_inode_res(mp, 1) +
+- xfs_calc_buf_res(1, mp->m_sb.sb_sectsize) +
+- xfs_calc_buf_res(1, XFS_FSB_TO_B(mp, 1)) +
++ xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
+ xfs_calc_iunlink_remove_reservation(mp) +
+- xfs_calc_buf_res(1, 0) +
+- xfs_calc_buf_res(2 + mp->m_ialloc_blks +
+- mp->m_in_maxlevels, 0) +
++ xfs_calc_buf_res(mp->m_ialloc_blks, 0) +
++ xfs_calc_buf_res(mp->m_in_maxlevels, XFS_FSB_TO_B(mp, 1)) +
+ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+ XFS_FSB_TO_B(mp, 1)) +
+ xfs_calc_finobt_res(mp, 0, 1);
+
diff --git a/patches.suse/xfs-print-transaction-log-reservation-on-overrun.patch b/patches.suse/xfs-print-transaction-log-reservation-on-overrun.patch
new file mode 100644
index 0000000000..d191d5db19
--- /dev/null
+++ b/patches.suse/xfs-print-transaction-log-reservation-on-overrun.patch
@@ -0,0 +1,47 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:35 -0800
+Subject: xfs: print transaction log reservation on overrun
+Git-commit: 2c8f6265397642bb150d933fa46b1f7c294f4ffe
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+The transaction dump code displays the content and reservation
+consumption of a particular transaction in the event of an overrun.
+It currently displays the reservation associated with the
+transaction ticket, but not the original reservation attached to the
+transaction.
+
+The latter value reflects the original transaction reservation
+calculation before additional reservation overhead is assigned, such
+as for the CIL context header and potential split region headers.
+
+Update xlog_print_trans() to also print the original transaction
+reservation in the event of overrun. This provides a reference point
+to identify how much reservation overhead was added to a particular
+ticket by xfs_log_calc_unit_res().
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/xfs_log.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index a503af96d780..047df85528b0 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -2117,7 +2117,9 @@ xlog_print_trans(
+
+ /* dump core transaction and ticket info */
+ xfs_warn(mp, "transaction summary:");
+- xfs_warn(mp, " flags = 0x%x", tp->t_flags);
++ xfs_warn(mp, " log res = %d", tp->t_log_res);
++ xfs_warn(mp, " log count = %d", tp->t_log_count);
++ xfs_warn(mp, " flags = 0x%x", tp->t_flags);
+
+ xlog_print_tic_res(mp, tp->t_ticket);
+
+
diff --git a/patches.suse/xfs-refactor-inode-chunk-alloc-free-tx-reservation.patch b/patches.suse/xfs-refactor-inode-chunk-alloc-free-tx-reservation.patch
new file mode 100644
index 0000000000..36a8507176
--- /dev/null
+++ b/patches.suse/xfs-refactor-inode-chunk-alloc-free-tx-reservation.patch
@@ -0,0 +1,169 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:38 -0800
+Subject: xfs: refactor inode chunk alloc/free tx reservation
+Git-commit: 57af33e451b73f56feb428f5856cdf6e4e0c60cd
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+The reservation for the various forms of inode allocation is
+scattered across several different functions. This includes two
+variants of chunk allocation (v5 icreate transactions vs. older
+create transactions) and the inode free transaction.
+
+To clean up some of this code and clarify the purpose of specific
+allocfree reservations, continue the pattern of defining helper
+functions for smaller operational units of broader transactions.
+Refactor the reservation into an inode chunk alloc/free helper that
+considers the various conditions based on filesystem format.
+
+An inode chunk free involves an extent free and buffer
+invalidations. The latter requires reservation for log headers only.
+An inode chunk allocation modifies the free space btrees and logs
+the chunk on v4 supers. v5 supers initialize the inode chunk using
+ordered buffers and so do not log the chunk.
+
+As a side effect of this refactoring, add one more allocfree res to
+the ifree transaction. Technically this does not serve a specific
+purpose because inode chunks are freed via deferred operations and
+thus occur after a transaction roll. tr_ifree has a bit of a history
+of tx overruns caused by too many agfl fixups during sustained file
+deletion workloads, so add this extra reservation as a form of
+padding nonetheless.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/libxfs/xfs_trans_resv.c | 64 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 49 insertions(+), 15 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index 19f3a226a357..75259a1346eb 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -34,6 +34,9 @@
+ #include "xfs_trans_space.h"
+ #include "xfs_trace.h"
+
++#define _ALLOC true
++#define _FREE false
++
+ /*
+ * A buffer has a format structure overhead in the log in addition
+ * to the data, so we need to take this into account when reserving
+@@ -171,6 +174,41 @@ xfs_calc_finobt_res(
+ return xfs_calc_inobt_res(mp);
+ }
+
++/*
++ * Calculate the reservation required to allocate or free an inode chunk. This
++ * includes:
++ *
++ * the allocation btrees: 2 trees * (max depth - 1) * block size
++ * the inode chunk: m_ialloc_blks * N
++ *
++ * The size N of the inode chunk reservation depends on whether it is for
++ * allocation or free and which type of create transaction is in use. An inode
++ * chunk free always invalidates the buffers and only requires reservation for
++ * headers (N == 0). An inode chunk allocation requires a chunk sized
++ * reservation on v4 and older superblocks to initialize the chunk. No chunk
++ * reservation is required for allocation on v5 supers, which use ordered
++ * buffers to initialize.
++ */
++STATIC uint
++xfs_calc_inode_chunk_res(
++ struct xfs_mount *mp,
++ bool alloc)
++{
++ uint res, size = 0;
++
++ res = xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
++ XFS_FSB_TO_B(mp, 1));
++ if (alloc) {
++ /* icreate tx uses ordered buffers */
++ if (xfs_sb_version_hascrc(&mp->m_sb))
++ return res;
++ size = XFS_FSB_TO_B(mp, 1);
++ }
++
++ res += xfs_calc_buf_res(mp->m_ialloc_blks, size);
++ return res;
++}
++
+ /*
+ * Various log reservation values.
+ *
+@@ -379,8 +417,7 @@ xfs_calc_create_resv_modify(
+ * For create we can allocate some inodes giving:
+ * the agi and agf of the ag getting the new inodes: 2 * sectorsize
+ * the superblock for the nlink flag: sector size
+- * the inode blocks allocated: mp->m_ialloc_blks * blocksize
+- * the allocation btrees: 2 trees * (max depth - 1) * block size
++ * the inode chunk (allocation/init)
+ * the inode btree (record insertion)
+ */
+ STATIC uint
+@@ -389,9 +426,7 @@ xfs_calc_create_resv_alloc(
+ {
+ return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
+ mp->m_sb.sb_sectsize +
+- xfs_calc_buf_res(mp->m_ialloc_blks, XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+- XFS_FSB_TO_B(mp, 1)) +
++ xfs_calc_inode_chunk_res(mp, _ALLOC) +
+ xfs_calc_inobt_res(mp);
+ }
+
+@@ -408,7 +443,7 @@ __xfs_calc_create_reservation(
+ * For icreate we can allocate some inodes giving:
+ * the agi and agf of the ag getting the new inodes: 2 * sectorsize
+ * the superblock for the nlink flag: sector size
+- * the allocation btrees: 2 trees * (max depth - 1) * block size
++ * the inode chunk (allocation, no init)
+ * the inobt (record insertion)
+ * the finobt (record insertion)
+ */
+@@ -418,8 +453,7 @@ xfs_calc_icreate_resv_alloc(
+ {
+ return xfs_calc_buf_res(2, mp->m_sb.sb_sectsize) +
+ mp->m_sb.sb_sectsize +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+- XFS_FSB_TO_B(mp, 1)) +
++ xfs_calc_inode_chunk_res(mp, _ALLOC) +
+ xfs_calc_inobt_res(mp) +
+ xfs_calc_finobt_res(mp);
+ }
+@@ -485,15 +519,15 @@ xfs_calc_symlink_reservation(
+ * the inode being freed: inode size
+ * the super block free inode counter, AGF and AGFL: sector size
+ * the on disk inode (agi unlinked list removal)
+- * the inode chunk is marked stale (headers only)
++ * the inode chunk (invalidated, headers only)
+ * the inode btree
+ * the finobt (record insertion, removal or modification)
+ *
+- * Note that the allocfree res. for the inode chunk itself is not included
+- * because the extent free occurs after a transaction roll. We could take the
+- * maximum of the pre/post roll operations, but the pre-roll reservation already
+- * includes at least one allocfree res. for the inobt and is thus guaranteed to
+- * be larger.
++ * Note that the inode chunk res. includes an allocfree res. for freeing of the
++ * inode chunk. This is technically extraneous because the inode chunk free is
++ * deferred (it occurs after a transaction roll). Include the extra reservation
++ * anyways since we've had reports of ifree transaction overruns due to too many
++ * agfl fixups during inode chunk frees.
+ */
+ STATIC uint
+ xfs_calc_ifree_reservation(
+@@ -503,7 +537,7 @@ xfs_calc_ifree_reservation(
+ xfs_calc_inode_res(mp, 1) +
+ xfs_calc_buf_res(3, mp->m_sb.sb_sectsize) +
+ xfs_calc_iunlink_remove_reservation(mp) +
+- xfs_calc_buf_res(mp->m_ialloc_blks, 0) +
++ xfs_calc_inode_chunk_res(mp, _FREE) +
+ xfs_calc_inobt_res(mp) +
+ xfs_calc_finobt_res(mp);
+ }
+
diff --git a/patches.suse/xfs-refactor-xlog_cil_insert_items-to-facilitate-transaction-dump.patch b/patches.suse/xfs-refactor-xlog_cil_insert_items-to-facilitate-transaction-dump.patch
new file mode 100644
index 0000000000..39d8e36e13
--- /dev/null
+++ b/patches.suse/xfs-refactor-xlog_cil_insert_items-to-facilitate-transaction-dump.patch
@@ -0,0 +1,134 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Wed, 14 Jun 2017 21:29:49 -0700
+Subject: xfs: refactor xlog_cil_insert_items() to facilitate transaction dump
+Git-commit: e2f2342639a414b60de3876a8b437eac2b795dbe
+Patch-mainline: v4.13-rc1
+References: bsc#1145235
+
+Transaction reservation overrun detection currently occurs too late
+to print useful information about the offending transaction.
+Ideally, the transaction data is printed before the associated log
+items are moved from the transaction to the CIL, which occurs in
+xlog_cil_insert_items(), such that details of the items logged by
+the transaction are available for analysis.
+
+Refactor xlog_cil_insert_items() to facilitate moving tx overrun
+detection to this function. Update the function to track each bit of
+extra log reservation stolen from the transaction (i.e., such as for
+the CIL context ticket) and perform the log item migration as the
+last operation before the CIL lock is released. This creates a
+context where the transaction reservation consumption has been fully
+calculated when the log items are moved to the CIL. This patch makes
+no functional changes.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/xfs_log_cil.c | 62 +++++++++++++++++++++++++++-------------------------
+ 1 file changed, 32 insertions(+), 30 deletions(-)
+
+diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
+index 52fe04229aa6..8de3baa7d3f0 100644
+--- a/fs/xfs/xfs_log_cil.c
++++ b/fs/xfs/xfs_log_cil.c
+@@ -410,6 +410,7 @@ xlog_cil_insert_items(
+ int len = 0;
+ int diff_iovecs = 0;
+ int iclog_space;
++ int iovhdr_res = 0, split_res = 0, ctx_res = 0;
+
+ ASSERT(tp);
+
+@@ -419,30 +420,11 @@ xlog_cil_insert_items(
+ */
+ xlog_cil_insert_format_items(log, tp, &len, &diff_iovecs);
+
+- /*
+- * Now (re-)position everything modified at the tail of the CIL.
+- * We do this here so we only need to take the CIL lock once during
+- * the transaction commit.
+- */
+ spin_lock(&cil->xc_cil_lock);
+- list_for_each_entry(lidp, &tp->t_items, lid_trans) {
+- struct xfs_log_item *lip = lidp->lid_item;
+-
+- /* Skip items which aren't dirty in this transaction. */
+- if (!(lidp->lid_flags & XFS_LID_DIRTY))
+- continue;
+-
+- /*
+- * Only move the item if it isn't already at the tail. This is
+- * to prevent a transient list_empty() state when reinserting
+- * an item that is already the only item in the CIL.
+- */
+- if (!list_is_last(&lip->li_cil, &cil->xc_cil))
+- list_move_tail(&lip->li_cil, &cil->xc_cil);
+- }
+
+ /* account for space used by new iovec headers */
+- len += diff_iovecs * sizeof(xlog_op_header_t);
++ iovhdr_res = diff_iovecs * sizeof(xlog_op_header_t);
++ len += iovhdr_res;
+ ctx->nvecs += diff_iovecs;
+
+ /* attach the transaction to the CIL if it has any busy extents */
+@@ -457,27 +439,47 @@ xlog_cil_insert_items(
+ * during the transaction commit.
+ */
+ if (ctx->ticket->t_curr_res == 0) {
+- ctx->ticket->t_curr_res = ctx->ticket->t_unit_res;
+- tp->t_ticket->t_curr_res -= ctx->ticket->t_unit_res;
++ ctx_res = ctx->ticket->t_unit_res;
++ ctx->ticket->t_curr_res = ctx_res;
++ tp->t_ticket->t_curr_res -= ctx_res;
+ }
+
+ /* do we need space for more log record headers? */
+ iclog_space = log->l_iclog_size - log->l_iclog_hsize;
+ if (len > 0 && (ctx->space_used / iclog_space !=
+ (ctx->space_used + len) / iclog_space)) {
+- int hdrs;
+-
+- hdrs = (len + iclog_space - 1) / iclog_space;
++ split_res = (len + iclog_space - 1) / iclog_space;
+ /* need to take into account split region headers, too */
+- hdrs *= log->l_iclog_hsize + sizeof(struct xlog_op_header);
+- ctx->ticket->t_unit_res += hdrs;
+- ctx->ticket->t_curr_res += hdrs;
+- tp->t_ticket->t_curr_res -= hdrs;
++ split_res *= log->l_iclog_hsize + sizeof(struct xlog_op_header);
++ ctx->ticket->t_unit_res += split_res;
++ ctx->ticket->t_curr_res += split_res;
++ tp->t_ticket->t_curr_res -= split_res;
+ ASSERT(tp->t_ticket->t_curr_res >= len);
+ }
+ tp->t_ticket->t_curr_res -= len;
+ ctx->space_used += len;
+
++ /*
++ * Now (re-)position everything modified at the tail of the CIL.
++ * We do this here so we only need to take the CIL lock once during
++ * the transaction commit.
++ */
++ list_for_each_entry(lidp, &tp->t_items, lid_trans) {
++ struct xfs_log_item *lip = lidp->lid_item;
++
++ /* Skip items which aren't dirty in this transaction. */
++ if (!(lidp->lid_flags & XFS_LID_DIRTY))
++ continue;
++
++ /*
++ * Only move the item if it isn't already at the tail. This is
++ * to prevent a transient list_empty() state when reinserting
++ * an item that is already the only item in the CIL.
++ */
++ if (!list_is_last(&lip->li_cil, &cil->xc_cil))
++ list_move_tail(&lip->li_cil, &cil->xc_cil);
++ }
++
+ spin_unlock(&cil->xc_cil_lock);
+ }
+
+
diff --git a/patches.suse/xfs-separate-shutdown-from-ticket-reservation-print-helper.patch b/patches.suse/xfs-separate-shutdown-from-ticket-reservation-print-helper.patch
new file mode 100644
index 0000000000..746f98c4ab
--- /dev/null
+++ b/patches.suse/xfs-separate-shutdown-from-ticket-reservation-print-helper.patch
@@ -0,0 +1,81 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Wed, 14 Jun 2017 21:29:48 -0700
+Subject: xfs: separate shutdown from ticket reservation print helper
+Git-commit: 7d2d5653460443e0586bd7d2e07811b4f4095e36
+Patch-mainline: v4.13-rc1
+References: bsc#1145235
+
+xlog_print_tic_res() pre-dates delayed logging and the committed
+items list (CIL) and thus retains some factoring warts, such as hard
+coded function names in the output and the fact that it induces a
+shutdown.
+
+In preparation for more detailed logging of regular transaction
+overrun situations, refactor xlog_print_tic_res() to be slightly
+more generic. Reword some of the warning messages and pull the
+shutdown into the callers.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/xfs_log.c | 12 ++++++------
+ fs/xfs/xfs_log_cil.c | 4 +++-
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
+index 3731f13f63e9..8b283f7cefea 100644
+--- a/fs/xfs/xfs_log.c
++++ b/fs/xfs/xfs_log.c
+@@ -2024,7 +2024,7 @@ xlog_print_tic_res(
+ };
+ #undef REG_TYPE_STR
+
+- xfs_warn(mp, "xlog_write: reservation summary:");
++ xfs_warn(mp, "ticket reservation summary:");
+ xfs_warn(mp, " unit res = %d bytes",
+ ticket->t_unit_res);
+ xfs_warn(mp, " current res = %d bytes",
+@@ -2045,10 +2045,6 @@ xlog_print_tic_res(
+ "bad-rtype" : res_type_str[r_type]),
+ ticket->t_res_arr[i].r_len);
+ }
+-
+- xfs_alert_tag(mp, XFS_PTAG_LOGRES,
+- "xlog_write: reservation ran out. Need to up reservation");
+- xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR);
+ }
+
+ /*
+@@ -2321,8 +2317,12 @@ xlog_write(
+ if (flags & (XLOG_COMMIT_TRANS | XLOG_UNMOUNT_TRANS))
+ ticket->t_curr_res -= sizeof(xlog_op_header_t);
+
+- if (ticket->t_curr_res < 0)
++ if (ticket->t_curr_res < 0) {
++ xfs_alert_tag(log->l_mp, XFS_PTAG_LOGRES,
++ "ctx ticket reservation ran out. Need to up reservation");
+ xlog_print_tic_res(log->l_mp, ticket);
++ xfs_force_shutdown(log->l_mp, SHUTDOWN_LOG_IO_ERROR);
++ }
+
+ index = 0;
+ lv = log_vector;
+diff --git a/fs/xfs/xfs_log_cil.c b/fs/xfs/xfs_log_cil.c
+index 82f1cbcc4de1..52fe04229aa6 100644
+--- a/fs/xfs/xfs_log_cil.c
++++ b/fs/xfs/xfs_log_cil.c
+@@ -987,8 +987,10 @@ xfs_log_commit_cil(
+ xlog_cil_insert_items(log, tp);
+
+ /* check we didn't blow the reservation */
+- if (tp->t_ticket->t_curr_res < 0)
++ if (tp->t_ticket->t_curr_res < 0) {
+ xlog_print_tic_res(mp, tp->t_ticket);
++ xfs_force_shutdown(log->l_mp, SHUTDOWN_LOG_IO_ERROR);
++ }
+
+ tp->t_commit_lsn = cil->xc_ctx->sequence;
+ if (commit_lsn)
+
diff --git a/patches.suse/xfs-truncate-transaction-does-not-modify-the-inobt.patch b/patches.suse/xfs-truncate-transaction-does-not-modify-the-inobt.patch
new file mode 100644
index 0000000000..5ddc43efa5
--- /dev/null
+++ b/patches.suse/xfs-truncate-transaction-does-not-modify-the-inobt.patch
@@ -0,0 +1,49 @@
+From: Brian Foster <bfoster@redhat.com>
+Date: Mon, 8 Jan 2018 10:41:37 -0800
+Subject: xfs: truncate transaction does not modify the inobt
+Git-commit: a606ebdb859e78beb757dfefa08001df366e2ef5
+Patch-mainline: v4.16-rc1
+References: bsc#1145235
+
+The truncate transaction does not ever modify the inode btree, but
+includes an associated log reservation. Update
+xfs_calc_itruncate_reservation() to remove the reservation
+associated with inobt updates.
+
+Signed-off-by: Brian Foster <bfoster@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Nikolay Borisov <nborisov@suse.com>
+---
+ fs/xfs/libxfs/xfs_trans_resv.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_trans_resv.c b/fs/xfs/libxfs/xfs_trans_resv.c
+index 173b1bc13ffe..037a1295d289 100644
+--- a/fs/xfs/libxfs/xfs_trans_resv.c
++++ b/fs/xfs/libxfs/xfs_trans_resv.c
+@@ -232,8 +232,6 @@ xfs_calc_write_reservation(
+ * the super block to reflect the freed blocks: sector size
+ * worst case split in allocation btrees per extent assuming 4 extents:
+ * 4 exts * 2 trees * (2 * max depth - 1) * block size
+- * the inode btree: max depth * blocksize
+- * the allocation btrees: 2 trees * (max depth - 1) * block size
+ */
+ STATIC uint
+ xfs_calc_itruncate_reservation(
+@@ -245,12 +243,7 @@ xfs_calc_itruncate_reservation(
+ XFS_FSB_TO_B(mp, 1))),
+ (xfs_calc_buf_res(9, mp->m_sb.sb_sectsize) +
+ xfs_calc_buf_res(xfs_allocfree_log_count(mp, 4),
+- XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_buf_res(5, 0) +
+- xfs_calc_buf_res(xfs_allocfree_log_count(mp, 1),
+- XFS_FSB_TO_B(mp, 1)) +
+- xfs_calc_buf_res(2 + mp->m_ialloc_blks +
+- mp->m_in_maxlevels, 0)));
++ XFS_FSB_TO_B(mp, 1))));
+ }
+
+ /*
+
diff --git a/series.conf b/series.conf
index 1d2ff84d64..978c3f9809 100644
--- a/series.conf
+++ b/series.conf
@@ -1680,6 +1680,7 @@
patches.drivers/tpm-177-tis-Fix-IRQ-autoprobing-when-using-platform_devi.patch
patches.drivers/tpm-178-tis-Use-platform_get_irq.patch
patches.drivers/tpm_tis-consolidate-the-platform-and-acpi-probe-flow.patch
+ patches.drivers/tpm-vtpm_proxy-Suppress-error-logging-when-in-closed.patch
patches.drivers/tpm-Introduce-flag-TPM_TRANSMIT_RAW.patch
patches.drivers/tpm-vtpm_proxy-Implement-request_locality-function.patch
patches.fixes/ima-Add-cgroups2-to-the-defaults-list.patch
@@ -5180,6 +5181,9 @@
patches.drivers/HID-wacom-fix-mistake-in-printk.patch
patches.suse/0011-btrfs-nowait-aio-Correct-assignment-of-pos.patch
patches.fixes/0058-xfs-refactor-dir2-leaf-readahead-shadow-buffer-cleve.patch
+ patches.suse/xfs-separate-shutdown-from-ticket-reservation-print-helper.patch
+ patches.suse/xfs-refactor-xlog_cil_insert_items-to-facilitate-transaction-dump.patch
+ patches.suse/xfs-dump-transaction-usage-details-on-log-reservation-overrun.patch
patches.fixes/xfs-release-bli-from-transaction-properly-on-fs-shut.patch
patches.fixes/xfs-remove-bli-from-AIL-before-release-on-transactio.patch
patches.fixes/xfs-remove-double-underscore-integer-types.patch
@@ -5192,6 +5196,7 @@
patches.fixes/xfs-remove-unneeded-parameter-from-XFS_TEST_ERROR.patch
patches.fixes/xfs-convert-drop_writes-to-use-the-errortag-mechanis.patch
patches.fixes/xfs-replace-log_badcrc_factor-knob-with-error-inject.patch
+ patches.suse/xfs-fix-semicolon-cocci-warnings.patch
patches.fixes/xfs-rewrite-xfs_dq_get_next_id-using-xfs_iext_lookup.patch
patches.fixes/vfs-Add-page_cache_seek_hole_data-helper.patch
patches.fixes/vfs-Add-iomap_seek_hole-and-iomap_seek_data-helpers.patch
@@ -10394,6 +10399,7 @@
patches.drivers/libnvdimm-btt-clean-up-warning-and-error-messages.patch
patches.drivers/libnvdimm-btt-fix-format-string-warnings.patch
patches.arch/signal-testing-Don-t-look-for-__SI_FAULT-in-userspac.patch
+ patches.fixes/NFS-Fix-the-inode-request-accounting-when-pages-have.patch
patches.drivers/SUNRPC-Don-t-hold-the-transport-lock-across-socket-c.patch
patches.drivers/SUNRPC-Add-a-separate-spinlock-to-protect-the-RPC-re.patch
patches.fixes/0001-NFSv4.1-don-t-use-machine-credentials-for-CLOSE-when.patch
@@ -19846,6 +19852,13 @@
patches.drivers/usx2y-don-t-bother-with-memdup_user-for-16-byte-stru.patch
patches.drivers/new-primitive-vmemdup_user
patches.fixes/0006-jffs2-Fix-use-after-free-bug-in-jffs2_iget-s-error-h.patch
+ patches.suse/xfs-print-transaction-log-reservation-on-overrun.patch
+ patches.suse/xfs-include-inobt-buffers-in-ifree-tx-log-reservation.patch
+ patches.suse/xfs-fix-up-agi-unlinked-list-reservations.patch
+ patches.suse/xfs-truncate-transaction-does-not-modify-the-inobt.patch
+ patches.suse/xfs-include-an-allocfree-res-for-inobt-modifications.patch
+ patches.suse/xfs-refactor-inode-chunk-alloc-free-tx-reservation.patch
+ patches.suse/xfs-eliminate-duplicate-icreate-tx-reservation-functions.patch
patches.fixes/0004-iomap-report-collisions-between-directio-and-buffere.patch
patches.fixes/xfs-call-xfs_qm_dqattach-before-performing-reflink-o.patch
patches.fixes/xfs-preserve-i_rdev-when-recycling-a-reclaimable-inode.patch
@@ -30199,6 +30212,8 @@
patches.suse/btrfs-fix-xattr-loss-after-power-failure.patch
patches.suse/btrfs-fix-duplicate-extents-after-fsync-of-file-with.patch
patches.suse/0002-btrfs-fix-reading-stale-metadata-blocks-after-degrad.patch
+ patches.suse/0001-btrfs-Split-btrfs_del_delalloc_inode-into-2-function.patch
+ patches.suse/0002-btrfs-Fix-delalloc-inodes-invalidation-during-transa.patch
patches.fixes/0009-packet-in-packet_snd-start-writing-at-link-layer-all.patch
patches.drivers/qede-Fix-ref-cnt-usage-count.patch
patches.suse/netfilter-nf_tables-nft_compat-fix-refcount-leak-on-.patch
@@ -30652,6 +30667,7 @@
patches.drivers/spi-Add-missing-pm_runtime_put_noidle-after-failed-g.patch
patches.drivers/0044-mtd-devices-m25p80-Use-spi_mem_set_drvdata-instead-o.patch
patches.drivers/regmap-skip-clk_put-for-attached-clocks-when-freeing-context
+ patches.suse/btrfs-track-running-balance-in-a-simpler-way.patch
patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch
patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch
patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch
@@ -33347,6 +33363,7 @@
patches.arch/powerpc-xive-shutdown-XIVE-when-kexec-or-kdump-is-pe.patch
patches.arch/powerpc-xive-prepare-all-hcalls-to-support-long-busy.patch
patches.suse/powerpc-livepatch-implement-reliable-stack-tracing-for-the-consistency-model.patch
+ patches.arch/powerpc-lib-Fix-feature-fixup-test-of-external-branc.patch
patches.arch/powerpc-lib-Fix-the-feature-fixup-tests-to-actually-.patch
patches.arch/powerpc-kvm-Switch-kvm-pmd-allocator-to-custom-alloc.patch
patches.arch/Revert-powerpc-64-Fix-checksum-folding-in-csum_add.patch
@@ -38535,6 +38552,7 @@
patches.arch/powerpc-mm-Increase-MAX_PHYSMEM_BITS-to-128TB-with-S.patch
patches.arch/powerpc-tm-Update-function-prototype-comment.patch
patches.arch/powerpc-tm-Remove-struct-thread_info-param-from-tm_r.patch
+ patches.arch/powerpc-powernv-opal-dump-Use-IRQ_HANDLED-instead-of.patch
patches.arch/powerpc-pseries-fix-EEH-recovery-of-some-IOV-devices.patch
patches.arch/powerpc-powernv-Fix-concurrency-issue-with-npu-mmio_.patch
patches.arch/powerpc-pseries-Avoid-using-the-size-greater-than-RT.patch
@@ -42175,6 +42193,7 @@
patches.suse/0003-watchdog-hpwdt-Display-module-parameters.patch
patches.suse/0004-watchdog-hpwdt-Module-paramerter-alias.patch
patches.suse/0005-watchdog-hpwdt-Update-version-number.patch
+ patches.drivers/watchdog-core-fix-null-pointer-dereference-when-rele.patch
patches.suse/0006-watchdog-hpwdt-Disable-PreTimeout-when-Timeout-is-sm.patch
patches.drm/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
patches.drm/0031-dma-buf-Remove-requirement-for-ops-map-from-dma_buf_.patch
@@ -42580,6 +42599,7 @@
patches.fixes/vfs-allow-dedupe-of-user-owned-read-only-files.patch
patches.fixes/vfs-dedupe-should-return-EPERM-if-permission-is-not-.patch
patches.arch/powerpc-pseries-Export-maximum-memory-value.patch
+ patches.arch/powerpc-pseries-add-missing-cpumask.h-include-file.patch
patches.fixes/vfs-vfs_clone_file_prep_inodes-should-return-EINVAL-.patch
patches.fixes/vfs-exit-early-from-zero-length-remap-operations.patch
patches.fixes/vfs-avoid-problematic-remapping-requests-into-partia.patch
@@ -42620,6 +42640,7 @@
patches.arch/x86-cpufeatures-enumerate-movdir64b-instruction.patch
patches.arch/x86-mm-pat-disable-preemption-around-_flush_tlb_all.patch
patches.suse/x86-numa_emulation-fix-uniform-split-numa-emulation.patch
+ patches.suse/objtool-support-gcc-9-cold-subfunction-naming-scheme.patch
patches.drivers/net-drop-skb-on-failure-in-ip_check_defrag.patch
patches.drivers/net-document-skb-parameter-in-function-skb_gso_size_.patch
patches.drivers/usbnet-smsc95xx-disable-carrier-check-while-suspendi.patch
@@ -42708,6 +42729,7 @@
patches.fixes/ext4-fix-buffer-leak-in-ext4_xattr_move_to_block-on-.patch
patches.fixes/ext4-fix-buffer-leak-in-__ext4_read_dirblock-on-erro.patch
patches.suse/0004-Btrfs-fix-cur_offset-in-the-error-case-for-nocow.patch
+ patches.suse/0006-btrfs-fix-pinned-underflow-after-transaction-aborted.patch
patches.suse/0009-Btrfs-fix-deadlock-on-tree-root-leaf-when-finding-fr.patch
patches.suse/0010-Btrfs-fix-infinite-loop-on-inode-eviction-after-dedu.patch
patches.suse/0011-Btrfs-fix-data-corruption-due-to-cloning-of-eof-bloc.patch
@@ -43734,8 +43756,13 @@
patches.arch/x86-umip-print-umip-line-only-once.patch
patches.arch/x86-umip-make-the-umip-activated-message-generic.patch
patches.arch/x86-mm-drop-usage-of-_flush_tlb_all-in-kernel_physical_mapping_init.patch
+ patches.arch/powerpc-64s-Include-cpu-header.patch
patches.arch/powerpc-xmon-Fix-invocation-inside-lock-region.patch
+ patches.arch/powerpc-perf-Fix-thresholding-counter-data-for-unkno.patch
+ patches.arch/powerpc-perf-Update-perf_regs-structure-to-include-S.patch
+ patches.arch/powerpc-perf-Cleanup-cache_sel-bits-comment.patch
patches.arch/powerpc-perf-Fix-unit_sel-cache_sel-checks.patch
+ patches.arch/powerpc-perf-Add-constraints-for-power9-l2-l3-bus-ev.patch
patches.arch/powerpc-perf-Remove-l2-bus-events-from-HW-cache-even.patch
patches.arch/powerpc-fsl-Fix-spectre_v2-mitigations-reporting.patch
patches.arch/powerpc-powernv-ioda-Allocate-indirect-TCE-levels-of.patch
@@ -44072,6 +44099,7 @@
patches.fixes/gfs2-Fix-loop-in-gfs2_rbm_find.patch
patches.suse/0001-Btrfs-fix-fsync-of-files-with-multiple-hard-links-in.patch
patches.suse/btrfs-fix-error-handling-in-btrfs_cleanup_ordered_extents.patch
+ patches.suse/0003-btrfs-add-cleanup_ref_head_accounting-helper.patch
patches.suse/btrfs-run-delayed-items-before-dropping-the-snapshot.patch
patches.suse/0011-Btrfs-send-fix-race-with-transaction-commits-that-cr.patch
patches.fixes/dlm-Don-t-swamp-the-CPU-with-callbacks-queued-during.patch
@@ -44542,6 +44570,7 @@
patches.drivers/niu-fix-missing-checks-of-niu_pci_eeprom_read.patch
patches.fixes/ethtool-check-the-return-value-of-get_regs_len.patch
patches.drivers/isdn-hisax-hfc_pci-Fix-a-possible-concurrency-use-af.patch
+ patches.fixes/fsl-fman-Use-GFP_ATOMIC-in-memac-tgec-_add_hash_mac_.patch
patches.suse/ax25-fix-a-use-after-free-in-ax25_fillin_cb.patch
patches.suse/net-wan-fix-a-double-free-in-x25_asy_open_tty.patch
patches.suse/netrom-fix-locking-in-nr_find_socket.patch
@@ -44748,6 +44777,7 @@
patches.fixes/libnvdimm-dimm-fix-security-capability-detection-for-non-intel-nvdimms.patch
patches.fixes/acpi-nfit-fix-race-accessing-memdev-in-nfit_get_smbios_id.patch
patches.fixes/libnvdimm-security-fix-nvdimm_security_state-state-request-selection.patch
+ patches.suse/0004-btrfs-handle-delayed-ref-head-accounting-cleanup-in-.patch
patches.fixes/0008-netfilter-nf_tables-fix-leaking-object-reference-cou.patch
patches.suse/net-ipv4-Fix-memory-leak-in-network-namespace-disman.patch
patches.drivers/Revert-igb-reduce-CPU0-latency-when-updating-statist.patch
@@ -44930,6 +44960,7 @@
patches.fixes/md-raid5-fix-out-of-memory-during-raid-cache-recover.patch
patches.fixes/blk-mq-fix-a-hung-issue-when-fsync.patch
patches.suse/0002-Btrfs-fix-deadlock-when-allocating-tree-block-during.patch
+ patches.suse/0005-btrfs-clean-up-pending-block-groups-when-transaction.patch
patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch
patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch
patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch
@@ -46001,6 +46032,9 @@
patches.fixes/tools-lib-traceevent-fix-buffer-overflow-in-arg_eval.patch
patches.drivers/tpm-tpm_crb-Avoid-unaligned-reads-in-crb_recv.patch
patches.drivers/tpm-Fix-some-name-collisions-with-drivers-char-tpm.h.patch
+ patches.drivers/tpm-Unify-the-send-callback-behaviour.patch
+ patches.drivers/tpm-tpm_i2c_atmel-Return-E2BIG-when-the-transfer-is-.patch
+ patches.drivers/tpm-Fix-off-by-one-when-reading-binary_bios_measurem.patch
patches.fixes/tipc-fix-RDM-DGRAM-connect-regression.patch
patches.drivers/net-hns3-Fix-a-logical-vs-bitwise-typo.patch
patches.fixes/0001-ipv4-route-fail-early-when-inet-dev-is-missing.patch
@@ -46478,6 +46512,7 @@
patches.drivers/ASoC-stm32-fix-sai-driver-name-initialisation.patch
patches.drivers/iommu-amd-set-exclusion-range-correctly
patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch
+ patches.suse/objtool-add-rewind_stack_do_exit-to-the-noreturn-list.patch
patches.fixes/genirq-Respect-IRQCHIP_SKIP_SET_WAKE-in-irq_chip_set.patch
patches.arch/x86-perf-amd-resolve-race-condition-when-disabling-pmc.patch
patches.arch/x86-perf-amd-resolve-nmi-latency-issues-for-active-pmcs.patch
@@ -46768,6 +46803,7 @@
patches.suse/0008-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_fr.patch
patches.suse/0009-btrfs-qgroup-Don-t-scan-leaf-if-we-re-modifying-relo.patch
patches.suse/btrfs-send-flush-dellaloc-in-order-to-avoid-data-los.patch
+ patches.suse/Btrfs-fix-race-between-send-and-deduplication-that-l.patch
patches.suse/btrfs-improve-performance-on-fsync-of-files-with-mul.patch
patches.drivers/scsi-be2iscsi-be_iscsi-mark-expected-switch-fall-through
patches.drivers/scsi-be2iscsi-be_main-mark-expected-switch-fall-through
@@ -46777,6 +46813,7 @@
patches.drivers/mmc-sdhci-of-esdhc-add-erratum-A-009204-support.patch
patches.drivers/mmc_spi-add-a-status-check-for-spi_sync_locked.patch
patches.drivers/mmc-core-make-pwrseq_emmc-partially-support-sleepy-G.patch
+ patches.drivers/mmc-sdhci-pci-Add-support-for-Intel-CML.patch
patches.drivers/mmc-core-fix-possible-use-after-free-of-host.patch
patches.drivers/mmc-core-Verify-SD-bus-width.patch
patches.drivers/mmc-mmci-Prevent-polling-for-busy-detection-in-IRQ-c.patch
@@ -46921,6 +46958,7 @@
patches.drivers/net-hns3-prevent-change-MTU-when-resetting.patch
patches.drivers/net-hns3-modify-HNS3_NIC_STATE_INITED-flag-in-hns3_r.patch
patches.drivers/net-hns3-split-function-hnae3_match_n_instantiate.patch
+ patches.fixes/ehea-Fix-a-copy-paste-err-in-ehea_init_port_res.patch
patches.drivers/ibmvnic-remove-set-but-not-used-variable-netdev.patch
patches.drivers/net-hns-fix-unsigned-comparison-to-less-than-zero.patch
patches.drivers/cxgb4-Don-t-return-EAGAIN-when-TCAM-is-full.patch
@@ -47432,6 +47470,8 @@
patches.arch/powerpc-powernv-idle-Restore-IAMR-after-idle.patch
patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
+ patches.arch/powerpc-perf-Remove-PM_BR_CMPL_ALT-from-power9-event.patch
+ patches.arch/powerpc-book3s-64-check-for-NULL-pointer-in-pgd_allo.patch
patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
@@ -47454,11 +47494,13 @@
patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch
patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch
patches.drivers/gpio-Remove-obsolete-comment-about-gpiochip_free_hog.patch
+ patches.drivers/gpio-gpio-omap-add-check-for-off-wake-capable-gpios.patch
patches.drivers/platform-chrome-cros_ec_proto-check-for-NULL-transfe.patch
patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch
patches.drivers/spi-nor-intel-spi-Add-support-for-Intel-Comet-Lake-S.patch
patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
+ patches.drivers/watchdog-f71808e_wdt-fix-F81866-bit-operation.patch
patches.drivers/watchdog-imx2_wdt-Fix-set_timeout-for-big-timeout-va.patch
patches.drivers/iommu-arm-smmu-v3-Don-t-disable-SMMU-in-kdump-kernel.patch
patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
@@ -47511,6 +47553,7 @@
patches.drivers/mfd-intel-lpss-Set-the-device-in-reset-state-when-in.patch
patches.drivers/mfd-tps65912-spi-Add-missing-of-table-registration.patch
patches.drivers/mfd-da9063-Fix-OTP-control-register-names-to-match-d.patch
+ patches.drivers/mfd-intel-lpss-Add-Intel-Comet-Lake-PCI-IDs.patch
patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch
patches.suse/virtio-s390-use-vring_create_virtqueue
patches.suse/virtio-s390-dma-support-for-virtio-ccw
@@ -47710,6 +47753,7 @@
patches.drivers/i2c-mlxcpld-Fix-wrong-initialization-order-in-probe.patch
patches.drivers/i2c-synquacer-fix-synquacer_i2c_doxfer-return-value.patch
patches.arch/KVM-PPC-Book3S-HV-XIVE-Do-not-clear-IRQ-data-of-pass.patch
+ patches.arch/powerpc-powernv-Return-for-invalid-IMC-domain.patch
patches.arch/powerpc-perf-Fix-MMCRA-corruption-by-bhrb_filter.patch
patches.fixes/efi-x86-Add-missing-error-handling-to-old_memmap-1-1.patch
patches.arch/x86-cpu-amd-don-t-force-the-cpb-cap-when-running-under-a-hypervisor.patch
@@ -47854,6 +47898,7 @@
patches.fixes/tcp-add-tcp_min_snd_mss-sysctl.patch
patches.fixes/tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch
patches.suse/btrfs-fix-race-between-block-group-removal-and-block.patch
+ patches.suse/0007-btrfs-start-readahead-also-in-seed-devices.patch
patches.drivers/Input-elantech-enable-middle-button-support-on-2-Thi.patch
patches.drivers/Input-uinput-add-compat-ioctl-number-translation-for.patch
patches.drivers/Input-imx_keypad-make-sure-keyboard-can-always-wake-.patch
@@ -47884,6 +47929,7 @@
patches.drivers/ppp-mppe-Add-softdep-to-arc4.patch
patches.suse/net-stmmac-fixed-new-system-time-seconds-value-calcu.patch
patches.suse/net-stmmac-set-IC-bit-when-transmitting-frames-with-.patch
+ patches.drivers/sis900-fix-TX-completion.patch
patches.suse/tipc-change-to-use-register_pernet_device.patch
patches.drivers/net-sched-cbs-Fix-error-path-of-cbs_module_init.patch
patches.drivers/net-tls-fix-page-double-free-on-TX-cleanup.patch
@@ -47898,6 +47944,7 @@
patches.fixes/mm-soft-offline-return-EBUSY-if-set_hwpoison_free_bu.patch
patches.fixes/mm-hugetlb-soft-offline-dissolve_free_huge_page-retu.patch
patches.fixes/efi-bgrt-Drop-BGRT-status-field-reserved-bits-check.patch
+ patches.arch/x86-microcode-fix-the-microcode-load-on-cpu-hotplug-for-real.patch
patches.fixes/Bluetooth-Fix-faulty-expression-for-minimum-encrypti.patch
patches.suse/ftrace-x86-remove-possible-deadlock-between-register_kprobe-and-ftrace_run_update_code.patch
patches.suse/tracing-snapshot-resize-spare-buffer-if-size-changed.patch
@@ -47917,6 +47964,8 @@
patches.drm/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch
patches.drm/drm-imx-notify-drm-core-before-sending-event-during-.patch
patches.drm/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch
+ patches.arch/kvm-x86-degrade-warn-to-pr_warn_ratelimited
+ patches.arch/kvm-lapic-fix-pending-interrupt-in-irr-blocked-by-software-disable-lapic
patches.fixes/scsi-target-iblock-fix-overrun-in-write-same-emulation
patches.drivers/dmaengine-imx-sdma-remove-BD_INTR-for-channel0.patch
patches.fixes/acpi-arm64-ignore-5.1-FADTs-that-are-reported-as-5.0.patch
@@ -47954,6 +48003,7 @@
patches.suse/hwmon-coretemp-Cosmetic-Rename-internal-variables-to.patch
patches.suse/perf-x86-intel-uncore-Cosmetic-renames-in-response-t.patch
patches.suse/perf-x86-intel-rapl-Cosmetic-rename-internal-variabl.patch
+ patches.drivers/tpm-Fix-TPM-1.2-Shutdown-sequence-to-prevent-future-.patch
patches.fixes/crypto-ccp-fix-AES-CFB-error-exposed-by-new-test-vec.patch
patches.fixes/crypto-ccp-Fix-3DES-complaint-from-ccp-crypto-module.patch
patches.fixes/crypto-talitos-fix-skcipher-failure-due-to-wrong-out.patch
@@ -47976,6 +48026,7 @@
patches.drivers/gpio-omap-fix-lack-of-irqstatus_raw0-for-OMAP4.patch
patches.fixes/regmap-fix-bulk-writes-on-paged-registers.patch
patches.drivers/regulator-s2mps11-Fix-buck7-and-buck8-wrong-voltages.patch
+ patches.drivers/regulator-qcom_spmi-Fix-math-of-spmi_regulator_set_v.patch
patches.drivers/iommu-vt-d-remove-unnecessary-rcu_read_locks
patches.drivers/iommu-fix-a-leak-in-iommu_insert_resv_region
patches.drivers/iommu-vt-d-duplicate-iommu_resv_region-objects-per-device-list
@@ -48232,6 +48283,13 @@
patches.fixes/0003-ocfs2-add-first-lock-wait-time-in-locking_state.patch
patches.fixes/9p-pass-the-correct-prototype-to-read_cache_page.patch
patches.arch/kvm-svm-avic-do-not-send-avic-doorbell-to-self
+ patches.arch/kvm-vmx-fix-handling-of-mc-that-occurs-during-vm-entry
+ patches.arch/kvm-vmx-always-signal-gp-on-wrmsr-to-msr_ia32_cr_pat-with-bad-value
+ patches.arch/kvm-nvmx-use-adjusted-pin-controls-for-vmcs02
+ patches.arch/kvm-vmx-check-cpuid-before-allowing-read-write-of-ia32_xss
+ patches.arch/kvm-nvmx-allow-setting-the-vmfunc-controls-msr
+ patches.arch/kvm-nvmx-remove-unnecessary-sync_roots-from-handle_invept
+ patches.arch/kvm-x86-unconditionally-enable-irqs-in-guest-context
patches.suse/s390-cpumf-add-extended-counter-set-definitions-for-model-8561-and-8562
patches.fixes/9p-virtio-Add-cleanup-path-in-p9_virtio_init.patch
patches.fixes/9p-xen-Add-cleanup-path-in-p9_trans_xen_init.patch
@@ -48247,6 +48305,7 @@
patches.arch/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch
patches.arch/powerpc-watchpoint-Restore-NV-GPRs-while-returning-f.patch
patches.arch/powerpc-rtas-retry-when-cpu-offline-races-with-suspe.patch
+ patches.arch/KVM-PPC-Book3S-HV-Fix-CR0-setting-in-TM-emulation.patch
patches.arch/powerpc-mm-hash-4k-Don-t-use-64K-page-size-for-vmemm.patch
patches.arch/powerpc-mm-radix-Use-the-right-page-size-for-vmemmap.patch
patches.arch/powerpc-mm-drconf-Use-NUMA_NO_NODE-on-failures-inste.patch
@@ -48255,6 +48314,7 @@
patches.arch/powerpc-mm-nvdimm-Add-an-informative-message-if-we-f.patch
patches.arch/powerpc-pseries-scm-Mark-the-region-volatile-if-cach.patch
patches.arch/powerpc-nvdimm-Add-support-for-multibyte-read-write-.patch
+ patches.arch/powerpc-mm-Handle-page-table-allocation-failures.patch
patches.drivers/mailbox-handle-failed-named-mailbox-channel-request.patch
patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch
@@ -48315,6 +48375,7 @@
patches.suse/msft-hv-1895-PCI-hv-Fix-a-use-after-free-bug-in-hv_eject_device_w.patch
patches.fixes/0001-PCI-qcom-Ensure-that-PERST-is-asserted-for-at-least-.patch
patches.fixes/0001-PCI-xilinx-nwl-Fix-Multi-MSI-data-programming.patch
+ patches.suse/Btrfs-prevent-send-failures-and-crashes-due-to-concu.patch
patches.drivers/0022-drivers-rapidio-devices-rio_mport_cdev.c-NUL-termina.patch
patches.drivers/dmaengine-hsu-Revert-set-HSU_CH_MTSR-to-memory-width.patch
patches.drivers/0008-dmaengine-rcar-dmac-Reject-zero-length-slave-DMA-req.patch
@@ -48353,6 +48414,8 @@
patches.drm/drm-nouveau-fix-memory-leak-in-nouveau_conn_reset.patch
patches.drivers/firmware-ti_sci-Always-request-response-from-firmwar.patch
patches.arch/kvm-svm-fix-detection-of-amd-errata-1096
+ patches.arch/kvm-x86-vpmu-refine-kvm_pmu-err-msg-when-event-creation-failed
+ patches.arch/kvm-nvmx-do-not-use-dangling-shadow-vmcs-after-guest-reset
patches.drivers/Input-synaptics-whitelist-Lenovo-T580-SMBus-intertou.patch
patches.drivers/Input-gtco-bounds-check-collection-indent-level.patch
patches.drivers/Input-alps-don-t-handle-ALPS-cs19-trackpoint-only-de.patch
@@ -48362,11 +48425,13 @@
patches.drivers/bnx2x-Prevent-load-reordering-in-tx-completion-proce.patch
patches.drivers/be2net-Synchronize-be_update_queues-with-dev_watchdo.patch
patches.fixes/tcp-be-more-careful-in-tcp_fragment.patch
+ patches.arch/powerpc-xive-Fix-loop-exit-condition-in-xive_find_ta.patch
patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch
patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch
patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch
patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch
patches.drivers/hwmon-nct6775-Fix-register-address-and-added-missed-.patch
+ patches.drivers/iommu-amd-add-support-for-x2apic-iommu-interrupts
patches.drivers/ALSA-hda-Optimize-resume-for-codecs-without-jack-det.patch
patches.drivers/ALSA-line6-Fix-wrong-altsetting-for-LINE6_PODHD500_1.patch
patches.drivers/ALSA-line6-Fix-a-typo.patch
@@ -48384,6 +48449,11 @@
patches.fixes/libnvdimm-region-register-badblocks-before-namespaces.patch
patches.arch/s390-dma-provide-proper-ARCH_ZONE_DMA_BITS
patches.drivers/tty-ldsem-locking-rwsem-Add-missing-ACQUIRE-to-read_.patch
+ patches.fixes/sched-fair-Don-t-free-p-numa_faults-with-concurrent-.patch
+ patches.fixes/sched-fair-Use-RCU-accessors-consistently-for-numa_g.patch
+ patches.arch/x86-mm-check-for-pfn-instead-of-page-in-vmalloc_sync_one
+ patches.arch/x86-mm-sync-also-unmappings-in-vmalloc_sync_all
+ patches.arch/mm-vmalloc-sync-unmappings-in-_purge_vmap_area_lazy
patches.drivers/usb-pci-quirks-Correct-AMD-PLL-quirk-detection.patch
patches.drivers/usb-wusbcore-fix-unbalanced-get-put-cluster_id.patch
patches.fixes/hpet-Fix-division-by-zero-in-hpet_time_div.patch
@@ -48397,17 +48467,20 @@
patches.drivers/ALSA-pcm-fix-lost-wakeup-event-scenarios-in-snd_pcm_.patch
patches.drivers/ALSA-usb-audio-Fix-gpf-in-snd_usb_pipe_sanity_check.patch
patches.drivers/ACPI-PM-Fix-regression-in-acpi_device_set_power.patch
+ patches.drivers/IB-mlx5-Fix-MR-registration-flow-to-use-UMR-properly.patch
patches.drivers/libata-zpodd-Fix-small-read-overflow-in-zpodd_get_me.patch
patches.drivers/ata-libahci-do-not-complain-in-case-of-deferred-prob.patch
+ patches.arch/s390-dasd-fix-endless-loop-after-read-unit-address-c.patch
patches.drivers/scsi-mpt3sas-Use-63-bit-DMA-addressing-on-SAS35-HBA.patch
+ patches.fixes/0001-xen-swiotlb-fix-condition-for-calling-xen_destroy_co.patch
patches.drm/drm-i915-perf-fix-ICL-perf-register-offsets.patch
- patches.drm/drm-i915-userptr-Acquire-the-page-lock-around-set_pa.patch
patches.drm/drm-i915-perf-ensure-we-keep-a-reference-on-the-driv.patch
patches.drm/drm-i915-Fix-GEN8_MCR_SELECTOR-programming.patch
patches.drm/drm-i915-gvt-fix-incorrect-cache-entry-for-guest-pag.patch
patches.drm/drm-bridge-lvds-encoder-Fix-build-error-while-CONFIG.patch
patches.drm/drm-exynos-fix-missing-decrement-of-retry-counter.patch
patches.drivers/0013-HID-wacom-fix-bit-shift-for-Cintiq-Companion-2.patch
+ patches.drivers/HID-Add-quirk-for-HP-X1200-PIXART-OEM-mouse.patch
patches.drivers/hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch
patches.fixes/bonding-Force-slave-speed-check-after-link-state-rec.patch
patches.drivers/sky2-Disable-MSI-on-ASUS-P6T.patch
@@ -48419,9 +48492,28 @@
patches.drivers/mwifiex-fix-802.11n-WPA-detection.patch
patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-on-version.patch
patches.fixes/0001-iwlwifi-mvm-fix-version-check-for-GEO_TX_POWER_LIMIT.patch
+ patches.drivers/iwlwifi-don-t-unmap-as-page-memory-that-was-mapped-a.patch
+ patches.drivers/iwlwifi-mvm-fix-an-out-of-bound-access.patch
+ patches.drivers/hwmon-nct7802-Fix-wrong-detection-of-in4-presence.patch
+ patches.fixes/crypto-ccp-Fix-oops-by-properly-managing-allocated-s.patch
+ patches.fixes/crypto-ccp-Ignore-tag-length-when-decrypting-GCM-cip.patch
+ patches.drivers/ASoC-dapm-Fix-handling-of-custom_stop_condition-on-D.patch
patches.drivers/ALSA-usb-audio-fix-a-memory-leak-bug.patch
+ patches.drivers/ALSA-hda-Don-t-override-global-PCM-hw-info-flag.patch
+ patches.drivers/ALSA-hiface-fix-multiple-memory-leak-bugs.patch
+ patches.drivers/ALSA-hda-Workaround-for-crackled-sound-on-AMD-contro.patch
+ patches.drivers/sound-fix-a-memory-leak-bug.patch
+ patches.drivers/ALSA-firewire-fix-a-memory-leak-bug.patch
+ patches.drivers/mmc-cavium-Set-the-correct-dma-max-segment-size-for-.patch
+ patches.drivers/mmc-cavium-Add-the-missing-dma-unmap-when-the-dma-ha.patch
+ patches.drm/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch
patches.drm/drm-rockchip-Suspend-DP-late.patch
patches.drm/drm-i915-Fix-wrong-escape-clock-divisor-init-for-GLK.patch
+ patches.arch/kvm-fix-leak-vcpu-s-vmcs-value-into-other-pcpu
+ patches.drivers/usb-host-xhci-rcar-Fix-timeout-in-xhci_suspend.patch
+ patches.drivers/usb-yurex-Fix-use-after-free-in-yurex_delete.patch
+ patches.drivers/usb-iowarrior-fix-deadlock-on-disconnect.patch
+ patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -48742,11 +48834,11 @@
########################################################
patches.drivers/0001-module-warn-if-module-init-probe-takes-long.patch
patches.suse/irq-stub-affinity.patch
- patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch
########################################################
# Device drivers
########################################################
+ patches.drivers/PCI-Restore-Resizable-BAR-size-bits-correctly-for-1M.patch
# Cavium CN99xx AHCI errata
# Out-of-tree
@@ -48805,6 +48897,8 @@
patches.drivers/Linux-v5.0-rc7-bcm2835-MMC-issues.patch
+ patches.suse/0001-irqchip-gic-v3-its-fix-build-warnings.patch
+
########################################################
# Filesystem
########################################################
@@ -48839,6 +48933,7 @@
patches.suse/xfs-add-option-to-mount-with-barrier-0-or-barrier-1.patch
patches.suse/ext4-dont-warn-when-enabling-DAX.patch
+ patches.fixes/jbd2-flush_descriptor-Do-not-decrease-buffer-head-s-ref-count.patch
########################################################
# NFS
@@ -49171,7 +49266,7 @@
+hare patches.kabi/md-batch-flush-requests-kabi.patch
- patches.kabi/KVM-Fix-kABI-for-AMD-SMAP-Errata-workaround.patch
+ patches.kabi/KVM-Fix-kABI.patch
patches.kabi/usb_interface-reveive-pm_usage_cnt-for-kabi.patch
patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch
@@ -49204,6 +49299,8 @@
patches.kabi/s390-airq-use-dma-memory-for-adapter-interrupts
patches.kabi/iommu-helper-mark-iommu_is_span_boundary-as-inline
+ patches.kabi/kABI-Fix-kABI-for-struct-amd_iommu.patch
+
########################################################
# You'd better have a good reason for adding a patch
# below here.
diff --git a/supported.conf b/supported.conf
index c62facec91..06c3285f48 100644
--- a/supported.conf
+++ b/supported.conf
@@ -2176,6 +2176,8 @@
- drivers/spmi/*
drivers/ssb/ssb
- drivers/staging/ccree/ccree.ko
+ drivers/staging/fsl-dpaa2/ethernet/fsl-dpaa2-eth
+ drivers/staging/fsl-mc/bus/dpio/fsl-mc-dpio
- drivers/staging/ks7010/ks7010.ko
- drivers/staging/lustre/lnet/klnds/o2iblnd/ko2iblnd.ko
- drivers/staging/lustre/lnet/klnds/socklnd/ksocklnd.ko