Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Tesarik <ptesarik@suse.cz>2019-05-16 13:31:27 +0200
committerPetr Tesarik <ptesarik@suse.cz>2019-05-16 18:51:29 +0200
commit43cb3c80c70d6f496165f1cf5101080783768092 (patch)
tree8884d8c2420d676e0a304695af1fe50bcd60f17c
parente0071c0721d159e65b5797e47becffb79445c8ab (diff)
parent99503d8cd1887f0497e6c5037cc1e504206de437 (diff)
Merge branch 'SLE15' into SLE15-SP1-UPDATE
- Refresh patches.arch/intel_idle-add-support-for-Jacobsville.patch - Refresh patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch - Refresh patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch - Refresh patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch - Refresh patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch - Refresh patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch - Refresh patches.kabi/md-batch-flush-requests-kabi.patch - Refresh patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch - Refresh patches.suse/tun-properly-test-for-IFF_UP.patch Conflicts: blacklist.conf patches.arch/intel_idle-add-support-for-Jacobsville.patch patches.arch/kvm-x86-report-stibp-on-get_supported_cpuid.patch patches.arch/locking-atomics-asm-generic-move-some-macros-from-linux-bitops-h-to-a-new-linux-bits-h-file.patch patches.arch/x86-cpu-Add-Atom-Tremont-Jacobsville.patch patches.arch/x86-cpu-sanitize-fam6_atom-naming.patch patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch patches.arch/x86-msr-index-cleanup-bit-defines.patch patches.arch/x86-speculation-consolidate-cpu-whitelists.patch patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch patches.arch/x86-speculation-mds-add-bug_msbds_only.patch patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch patches.arch/x86-speculation-mds-add-smt-warning-message.patch patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch patches.arch/x86-speculation-simplify-the-cpu-bug-detection-logic.patch patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
-rw-r--r--blacklist.conf3
-rw-r--r--patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/intel_idle-add-support-for-Jacobsville.patch7
-rw-r--r--patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch3
-rw-r--r--patches.arch/powerpc-numa-improve-control-of-topology-updates.patch3
-rw-r--r--patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch4
-rw-r--r--patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch91
-rw-r--r--patches.arch/s390-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch2
-rw-r--r--patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch2
-rw-r--r--patches.arch/x86-mce-handle-varying-mca-bank-counts.patch3
-rw-r--r--patches.arch/x86-msr-index-cleanup-bit-defines.patch2
-rw-r--r--patches.arch/x86-speculation-consolidate-cpu-whitelists.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-bug_msbds_only.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch3
-rw-r--r--patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch3
-rw-r--r--patches.arch/x86-speculation-mds-add-smt-warning-message.patch3
-rw-r--r--patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch2
-rw-r--r--patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch4
-rw-r--r--patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch2
-rw-r--r--patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch3
-rw-r--r--patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch3
-rw-r--r--patches.arch/x86-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch181
-rw-r--r--patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch50
-rw-r--r--patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch64
-rw-r--r--patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch61
-rw-r--r--patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch48
-rw-r--r--patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch3
-rw-r--r--patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch43
-rw-r--r--patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch39
-rw-r--r--patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch64
-rw-r--r--patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch50
-rw-r--r--patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch40
-rw-r--r--patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch103
-rw-r--r--patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch54
-rw-r--r--patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch132
-rw-r--r--patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch277
-rw-r--r--patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch141
-rw-r--r--patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch75
-rw-r--r--patches.drivers/ALSA-timer-Coding-style-fixes.patch71
-rw-r--r--patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch148
-rw-r--r--patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch70
-rw-r--r--patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch80
-rw-r--r--patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch129
-rw-r--r--patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch125
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch43
-rw-r--r--patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch37
-rw-r--r--patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch44
-rw-r--r--patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch66
-rw-r--r--patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch135
-rw-r--r--patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch39
-rw-r--r--patches.drivers/ASoC-fix-valid-stream-condition.patch40
-rw-r--r--patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch32
-rw-r--r--patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch175
-rw-r--r--patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch57
-rw-r--r--patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch39
-rw-r--r--patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch110
-rw-r--r--patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch49
-rw-r--r--patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch64
-rw-r--r--patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch35
-rw-r--r--patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch69
-rw-r--r--patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch58
-rw-r--r--patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch38
-rw-r--r--patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch43
-rw-r--r--patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch38
-rw-r--r--patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch51
-rw-r--r--patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch69
-rw-r--r--patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch50
-rw-r--r--patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch85
-rw-r--r--patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch92
-rw-r--r--patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch45
-rw-r--r--patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch90
-rw-r--r--patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch39
-rw-r--r--patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch3
-rw-r--r--patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch38
-rw-r--r--patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock101
-rw-r--r--patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu42
-rw-r--r--patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly49
-rw-r--r--patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch2
-rw-r--r--patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch37
-rw-r--r--patches.drivers/media-cx23885-check-allocation-return.patch43
-rw-r--r--patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch78
-rw-r--r--patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch37
-rw-r--r--patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch39
-rw-r--r--patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch141
-rw-r--r--patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch46
-rw-r--r--patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch41
-rw-r--r--patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch40
-rw-r--r--patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch64
-rw-r--r--patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch38
-rw-r--r--patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch46
-rw-r--r--patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch34
-rw-r--r--patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch40
-rw-r--r--patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch160
-rw-r--r--patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch66
-rw-r--r--patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch64
-rw-r--r--patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch50
-rw-r--r--patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch38
-rw-r--r--patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch45
-rw-r--r--patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch49
-rw-r--r--patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch61
-rw-r--r--patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch57
-rw-r--r--patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch277
-rw-r--r--patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch54
-rw-r--r--patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch44
-rw-r--r--patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch144
-rw-r--r--patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch48
-rw-r--r--patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch56
-rw-r--r--patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch49
-rw-r--r--patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch45
-rw-r--r--patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch38
-rw-r--r--patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch99
-rw-r--r--patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch92
-rw-r--r--patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch2
-rw-r--r--patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch39
-rw-r--r--patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch53
-rw-r--r--patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch57
-rw-r--r--patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch42
-rw-r--r--patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch48
-rw-r--r--patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch74
-rw-r--r--patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch43
-rw-r--r--patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch5
-rw-r--r--patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch37
-rw-r--r--patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch61
-rw-r--r--patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch73
-rw-r--r--patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch186
-rw-r--r--patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch41
-rw-r--r--patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch56
-rw-r--r--patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch93
-rw-r--r--patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch72
-rw-r--r--patches.fixes/md-batch-flush-requests.patch3
-rw-r--r--patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch143
-rw-r--r--patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch14
-rw-r--r--patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch3
-rw-r--r--patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch82
-rw-r--r--patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch51
-rw-r--r--patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch106
-rw-r--r--patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch85
-rw-r--r--patches.fixes/scripts-override-locale-from-environment-when-runnin.patch43
-rw-r--r--patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp64
-rw-r--r--patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch40
-rw-r--r--patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch77
-rw-r--r--patches.fixes/vfio-pci-use-correct-format-characters.patch83
-rw-r--r--patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch69
-rw-r--r--patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch (renamed from patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch)19
-rw-r--r--patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch66
-rw-r--r--patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch46
-rw-r--r--patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch70
-rw-r--r--patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch103
-rw-r--r--patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch109
-rw-r--r--patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch37
-rw-r--r--patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch190
-rw-r--r--patches.fixes/xfs-kill-meaningless-variable-zero.patch49
-rw-r--r--patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch8
-rw-r--r--patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch2
-rw-r--r--patches.fixes/xfs-remove-xfs_zero_range.patch170
-rw-r--r--patches.kabi/Re-export-snd_cards-for-kABI.patch26
-rw-r--r--patches.kabi/md-batch-flush-requests-kabi.patch12
-rw-r--r--patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch50
-rw-r--r--patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch85
-rw-r--r--patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch86
-rw-r--r--patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch187
-rw-r--r--patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch87
-rw-r--r--patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch404
-rw-r--r--patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch33
-rw-r--r--patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch75
-rw-r--r--patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch83
-rw-r--r--patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch130
-rw-r--r--patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch73
-rw-r--r--patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch124
-rw-r--r--patches.suse/0003-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch213
-rw-r--r--patches.suse/0004-btrfs-Open-code-add_delayed_tree_ref.patch128
-rw-r--r--patches.suse/0004-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch124
-rw-r--r--patches.suse/0004-btrfs-move-ref_mod-modification-into-the-if-ref-logi.patch46
-rw-r--r--patches.suse/0005-btrfs-Open-code-add_delayed_data_ref.patch125
-rw-r--r--patches.suse/0005-btrfs-move-all-ref-head-cleanup-to-the-helper-functi.patch211
-rw-r--r--patches.suse/0006-btrfs-Introduce-init_delayed_ref_head.patch102
-rw-r--r--patches.suse/0006-btrfs-extent-tree-Use-btrfs_ref-to-refactor-add_pinn.patch70
-rw-r--r--patches.suse/0006-btrfs-remove-delayed_ref_node-from-ref_head.patch780
-rw-r--r--patches.suse/0007-btrfs-Use-init_delayed_ref_head-in-add_delayed_ref_h.patch102
-rw-r--r--patches.suse/0007-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_in.patch370
-rw-r--r--patches.suse/0008-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_fr.patch257
-rw-r--r--patches.suse/0008-btrfs-split-delayed-ref-head-initialization-and-addi.patch159
-rw-r--r--patches.suse/0009-btrfs-qgroup-Don-t-scan-leaf-if-we-re-modifying-relo.patch68
-rw-r--r--patches.suse/Revert-block-unexport-DISK_EVENT_MEDIA_CHANGE-for.patch (renamed from patches.fixes/Revert-block-unexport-DISK_EVENT_MEDIA_CHANGE-for.patch)4
-rw-r--r--patches.suse/block-check_events-don-t-bother-with-events-if-un.patch (renamed from patches.fixes/block-check_events-don-t-bother-with-events-if-un.patch)10
-rw-r--r--patches.suse/block-disk_events-introduce-event-flags.patch (renamed from patches.fixes/block-disk_events-introduce-event-flags.patch)4
-rw-r--r--patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch19
-rw-r--r--patches.suse/btrfs-fix-race-condition-between-delayed-refs-and-blockgroup-removal.patch82
-rw-r--r--patches.suse/dccp-do-not-use-ipv6-header-for-ipv4-flow.patch37
-rw-r--r--patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch45
-rw-r--r--patches.suse/lpfc-validate-command-in-lpfc_sli4_scmd_to_wqidx_dis.patch32
-rw-r--r--patches.suse/net-aquantia-fix-rx-checksum-offload-for-UDP-TCP-ove.patch39
-rw-r--r--patches.suse/net-rose-fix-a-possible-stack-overflow.patch129
-rw-r--r--patches.suse/net-stmmac-fix-memory-corruption-with-large-MTUs.patch62
-rw-r--r--patches.suse/packets-Always-register-packet-sk-in-the-same-order.patch69
-rw-r--r--patches.suse/revert-btrfs-qgroup-move-half-of-the-qgroup-accounting-time-out-of-commit-trans.patch106
-rw-r--r--patches.suse/sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch38
-rw-r--r--patches.suse/tcp-do-not-use-ipv6-header-for-ipv4-flow.patch43
-rw-r--r--patches.suse/thunderx-eliminate-extra-calls-to-put_page-for-pages.patch62
-rw-r--r--patches.suse/thunderx-enable-page-recycling-for-non-XDP-case.patch62
-rw-r--r--patches.suse/tun-add-a-missing-rcu_read_unlock-in-error-path.patch29
-rw-r--r--patches.suse/tun-properly-test-for-IFF_UP.patch87
-rw-r--r--patches.suse/vxlan-Don-t-call-gro_cells_destroy-before-device-is-.patch45
-rw-r--r--series.conf247
211 files changed, 14279 insertions, 338 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 3db323666a..f92d248c3b 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -58,6 +58,7 @@ tools/testing/selftests/ # Selftests should be run from upstream
fs/f2fs/ # Not compiled, has some fatal flaws (see bsc#1109665)
security/smack # we don't enable Smack
+drivers/ide # IDE not shipped since SLE12
# Blacklisted CVE entries
# -----------------------
@@ -1022,3 +1023,5 @@ f58213637206e190453e3bd91f98f535566290a3 # regulator: missing regulator_lock() A
f7a621728a6a23bfd2c6ac4d3e42e1303aefde0f # regulator: missing regulator_lock() API in SLE15
8be64b6d87bd47d81753b60ddafe70102ebfd76b # regulator: missing regulator_lock() API in SLE15
e69b394703e032e56a140172440ec4f9890b536d # regulator: missing regulator_lock() API in SLE15
+98fdaaca9537b997062f1abc0aa87c61b50ce40a # Duplicate of fc89a38d99d4b1b33ca5b0e2329f5ddea02ecfb5: drm/i915/opregion: fix version check
+a0f52c3d357af218a9c1f7cd906ab70426176a1a # Duplicate of 16eb0f34cdf4cf04cd92762c7a79f98aa51e053f: drm/i915/opregion: rvda is relative from opregion base in opregion 2.1+
diff --git a/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch b/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
index 58fd60fc29..ef4fcccace 100644
--- a/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
+++ b/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:28 -0500
Subject: cpu/speculation: Add 'mitigations=' cmdline option
Git-commit: 98af8452945c55652de68536afdde3b520fec429
-Patch-mainline: queued in subsystem tree
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Keeping track of the number of mitigations for all the CPU speculation
diff --git a/patches.arch/intel_idle-add-support-for-Jacobsville.patch b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
index 22f5b9abb5..1b3a1882c3 100644
--- a/patches.arch/intel_idle-add-support-for-Jacobsville.patch
+++ b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
@@ -13,14 +13,12 @@ Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/idle/intel_idle.c | 1 +
+ drivers/idle/intel_idle.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
-index 8b5d85c..b8647b5 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
-@@ -1103,6 +1103,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+@@ -1099,6 +1099,7 @@ static const struct x86_cpu_id intel_idl
ICPU(INTEL_FAM6_ATOM_GOLDMONT, idle_cpu_bxt),
ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, idle_cpu_bxt),
ICPU(INTEL_FAM6_ATOM_GOLDMONT_X, idle_cpu_dnv),
@@ -28,4 +26,3 @@ index 8b5d85c..b8647b5 100644
{}
};
-
diff --git a/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch b/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch
index ce83ac8841..9f5a29a14b 100644
--- a/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch
+++ b/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch
@@ -5,8 +5,7 @@ Subject: [PATCH] powerpc/numa: document topology_updates_enabled, disable by
default
References: bsc#1133584
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v5.2-rc1
Git-commit: 558f86493df09f68f79fe056d9028d317a3ce8ab
Changing the NUMA associations for CPUs and memory at runtime is
diff --git a/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch b/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch
index f62c6c2bae..3a04a469dd 100644
--- a/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch
+++ b/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch
@@ -4,8 +4,7 @@ Date: Thu, 18 Apr 2019 13:56:57 -0500
Subject: [PATCH] powerpc/numa: improve control of topology updates
References: bsc#1133584
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v5.2-rc1
Git-commit: 2d4d9b308f8f8dec68f6dbbff18c68ec7c6bd26f
When booted with "topology_updates=no", or when "off" is written to
diff --git a/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch b/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
index cdab5ca429..50b4452a92 100644
--- a/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
+++ b/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
@@ -4,7 +4,8 @@ Date: Tue, 2 Oct 2018 10:35:59 -0500
Subject: [PATCH] powerpc/pseries: Track LMB nid instead of using device tree
References: bsc#1108270
-Patch-mainline: submitted https://patchwork.ozlabs.org/patch/977943/
+Patch-mainline: v5.2-rc1
+Git-commit: b2d3b5ee66f2a04a918cc043cec0c9ed3de58f40
When removing memory we need to remove the memory from the node
it was added to instead of looking up the node it should be in
@@ -49,6 +50,7 @@ it is added to the system so we can remove it from that node instead
of the node that the device tree indicates it should belong to.
Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/include/asm/drmem.h | 26 +++++++++++++++++++
diff --git a/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch b/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
index f9072b1237..bb925ed307 100644
--- a/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:30 -0500
Subject: powerpc/speculation: Support 'mitigations=' cmdline option
Git-commit: 782e69efb3dfed6e8360bc612e8c7827a901a8f9
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure powerpc CPU runtime speculation bug mitigations in accordance
diff --git a/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch b/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
index ef765a6203..0eb3f926d5 100644
--- a/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
+++ b/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
@@ -1,59 +1,63 @@
-From patchwork Wed Jan 16 16:47:44 2019
-Subject: powerpc/tm: Avoid machine crash on rt_sigreturn
-X-Patchwork-Id: 1026032
-Date: Wed, 16 Jan 2019 14:47:44 -0200
+From e620d45065c7b5b8d6ae11217c09c09380103b83 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
+Date: Wed, 16 Jan 2019 14:47:44 -0200
+Subject: [PATCH] powerpc/tm: Avoid machine crash on rt_sigreturn()
References: bsc#1118338
-Patch-mainline: submitted https://patchwork.ozlabs.org/patch/1026032/
+Patch-mainline: v5.2-rc1
+Git-commit: e620d45065c7b5b8d6ae11217c09c09380103b83
-There is a kernel crash that happens if rt_sigreturn is called inside a
-transactional block.
+There is a kernel crash that happens if rt_sigreturn() is called inside
+a transactional block.
This crash happens if the kernel hits an in-kernel page fault when
-accessing userspace memory, usually through copy_ckvsx_to_user(). A major
-page fault calls might_sleep() function, which can cause a task reschedule.
-A task reschedule (switch_to()) reclaim and recheckpoint the TM states,
-but, in the signal return path, the checkpointed memory was already
-reclaimed, thus the exception stack has MSR that points to MSR[TS]=0.
+accessing userspace memory, usually through copy_ckvsx_to_user(). A
+major page fault calls might_sleep() function, which can cause a task
+reschedule. A task reschedule (switch_to()) reclaim and recheckpoint
+the TM states, but, in the signal return path, the checkpointed memory
+was already reclaimed, thus the exception stack has MSR that points to
+MSR[TS]=0.
-When the code returns from might_sleep() and a task reschedule happened,
-then this task is returned with the memory recheckpointed, and
-CPU MSR[TS] = suspended.
+When the code returns from might_sleep() and a task reschedule
+happened, then this task is returned with the memory recheckpointed,
+and CPU MSR[TS] = suspended.
-This means that there is a side effect at might_sleep() if it is called
-with CPU MSR[TS] = 0 and the task has regs->msr[TS] != 0.
+This means that there is a side effect at might_sleep() if it is
+called with CPU MSR[TS] = 0 and the task has regs->msr[TS] != 0.
-This side effect can cause a TM bad thing, since at the exception entrance,
-the stack saves MSR[TS]=0, and this is what will be used at RFID, but,
-the processor has MSR[TS] = Suspended, and this transition will be invalid
-and a TM Bad thing will be raised, causing the following crash:
+This side effect can cause a TM bad thing, since at the exception
+entrance, the stack saves MSR[TS]=0, and this is what will be used at
+RFID, but, the processor has MSR[TS] = Suspended, and this transition
+will be invalid and a TM Bad thing will be raised, causing the
+following crash:
- Unexpected TM Bad Thing exception at c00000000000e9ec (msr 0x8000000302a03031) tm_scratch=800000010280b033
- cpu 0xc: Vector: 700 (Program Check) at [c00000003ff1fd70]
- pc: c00000000000e9ec: fast_exception_return+0x100/0x1bc
- lr: c000000000032948: handle_rt_signal64+0xb8/0xaf0
- sp: c0000004263ebc40
- msr: 8000000302a03031
- current = 0xc000000415050300
- paca = 0xc00000003ffc4080 irqmask: 0x03 irq_happened: 0x01
- pid = 25006, comm = sigfuz
- Linux version 5.0.0-rc1-00001-g3bd6e94bec12 (breno@debian) (gcc version 8.2.0 (Debian 8.2.0-3)) #899 SMP Mon Jan 7 11:30:07 EST 2019
- WARNING: exception is not recoverable, can't continue
- enter ? for help
- [c0000004263ebc40] c000000000032948 handle_rt_signal64+0xb8/0xaf0 (unreliable)
- [c0000004263ebd30] c000000000022780 do_notify_resume+0x2f0/0x430
- [c0000004263ebe20] c00000000000e844 ret_from_except_lite+0x70/0x74
- --- Exception: c00 (System Call) at 00007fffbaac400c
- SP (7fffeca90f40) is in userspace
+ Unexpected TM Bad Thing exception at c00000000000e9ec (msr 0x8000000302a03031) tm_scratch=800000010280b033
+ cpu 0xc: Vector: 700 (Program Check) at [c00000003ff1fd70]
+ pc: c00000000000e9ec: fast_exception_return+0x100/0x1bc
+ lr: c000000000032948: handle_rt_signal64+0xb8/0xaf0
+ sp: c0000004263ebc40
+ msr: 8000000302a03031
+ current = 0xc000000415050300
+ paca = 0xc00000003ffc4080 irqmask: 0x03 irq_happened: 0x01
+ pid = 25006, comm = sigfuz
+ Linux version 5.0.0-rc1-00001-g3bd6e94bec12 (breno@debian) (gcc version 8.2.0 (Debian 8.2.0-3)) #899 SMP Mon Jan 7 11:30:07 EST 2019
+ WARNING: exception is not recoverable, can't continue
+ enter ? for help
+ [c0000004263ebc40] c000000000032948 handle_rt_signal64+0xb8/0xaf0 (unreliable)
+ [c0000004263ebd30] c000000000022780 do_notify_resume+0x2f0/0x430
+ [c0000004263ebe20] c00000000000e844 ret_from_except_lite+0x70/0x74
+ --- Exception: c00 (System Call) at 00007fffbaac400c
+ SP (7fffeca90f40) is in userspace
The solution for this problem is running the sigreturn code with
-regs->msr[TS] disabled, thus, avoiding hitting the side effect above. This
-does not seem to be a problem since regs->msr will be replaced by the
-ucontext value, so, it is being flushed already. In this case, it is
-flushed earlier.
+regs->msr[TS] disabled, thus, avoiding hitting the side effect above.
+This does not seem to be a problem since regs->msr will be replaced by
+the ucontext value, so, it is being flushed already. In this case, it
+is flushed earlier.
Signed-off-by: Breno Leitao <leitao@debian.org>
+Acked-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/kernel/signal_64.c | 27 ++++++++++++++++++++++++++-
@@ -104,3 +108,6 @@ index 6794466f6420..06c299ef6132 100644
if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
goto badframe;
if (MSR_TM_ACTIVE(msr)) {
+--
+2.20.1
+
diff --git a/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch b/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
index 232c182f03..71c8954d67 100644
--- a/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:31 -0500
Subject: s390/speculation: Support 'mitigations=' cmdline option
Git-commit: 0336e04a6520bdaefdb0769d2a70084fa52e81ed
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure s390 runtime CPU speculation bug mitigations in accordance
diff --git a/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch b/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
index 8c82273415..81e943fc30 100644
--- a/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
+++ b/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
@@ -2,7 +2,7 @@ From: Andi Kleen <ak@linux.intel.com>
Date: Fri, 18 Jan 2019 16:50:23 -0800
Subject: x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
Git-commit: 6c4dbbd14730c43f4ed808a9c42ca41625925c22
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
X86_FEATURE_MD_CLEAR is a new CPUID bit which is set when microcode
diff --git a/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch b/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
index 92d1e7ac68..bd2e7c97e7 100644
--- a/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
+++ b/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 27 Feb 2019 12:48:14 +0100
Subject: x86/kvm/vmx: Add MDS protection when L1D Flush is not active
Git-commit: 650b68a0622f933444a6d66936abb3103029413b
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
CPUs which are affected by L1TF and MDS mitigate MDS with the L1D Flush on
diff --git a/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch b/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
index 04a118cca2..383dd4c1c0 100644
--- a/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
+++ b/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
@@ -2,8 +2,7 @@ From: Yazen Ghannam <yazen.ghannam@amd.com>
Date: Fri, 27 Jul 2018 16:40:09 -0500
Subject: x86/mce: Handle varying MCA bank counts
Git-commit: 006c077041dc73b9490fffc4c6af5befe0687110
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: Queued in tip
+Patch-mainline: v5.2-rc1
References: bsc#1128415
Linux reads MCG_CAP[Count] to find the number of MCA banks visible to a
diff --git a/patches.arch/x86-msr-index-cleanup-bit-defines.patch b/patches.arch/x86-msr-index-cleanup-bit-defines.patch
index 6f134cb78c..8552aa7dfe 100644
--- a/patches.arch/x86-msr-index-cleanup-bit-defines.patch
+++ b/patches.arch/x86-msr-index-cleanup-bit-defines.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 21 Feb 2019 12:36:50 +0100
Subject: x86/msr-index: Cleanup bit defines
Git-commit: d8eabc37310a92df40d07c5a8afc53cebf996716
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Greg pointed out that speculation related bit defines are using (1 << N)
diff --git a/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch b/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
index 02798b9d0a..86279e374c 100644
--- a/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
+++ b/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 27 Feb 2019 10:10:23 +0100
Subject: x86/speculation: Consolidate CPU whitelists
Git-commit: 36ad35131adacc29b328b9c8b6277a8bf0d6fd5d
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
The CPU vulnerability whitelists have some overlap and there are more
diff --git a/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch b/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
index e7acb5921a..c6e0023444 100644
--- a/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
@@ -2,7 +2,7 @@ From: Andi Kleen <ak@linux.intel.com>
Date: Fri, 18 Jan 2019 16:50:16 -0800
Subject: x86/speculation/mds: Add basic bug infrastructure for MDS
Git-commit: ed5194c2732c8084af9fd159c146ea92bf137128
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Microarchitectural Data Sampling (MDS), is a class of side channel attacks
diff --git a/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch b/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
index d516b9076c..60dc73ace2 100644
--- a/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
+++ b/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 1 Mar 2019 20:21:08 +0100
Subject: x86/speculation/mds: Add BUG_MSBDS_ONLY
Git-commit: e261f209c3666e842fd645a1e31f001c3a26def9
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
This bug bit is set on CPUs which are only affected by Microarchitectural
diff --git a/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch b/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
index ace13f6551..5c918bf56f 100644
--- a/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
+++ b/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
@@ -1,9 +1,8 @@
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Tue, 2 Apr 2019 09:59:33 -0500
Subject: x86/speculation/mds: Add mds=full,nosmt cmdline option
-Git-repo: tip/tip
Git-commit: d71eb0ce109a124b0fa714832823b9452f2762cf
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add the mds=full,nosmt cmdline option. This is like mds=full, but with
diff --git a/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch b/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
index be7aa07101..acb480422a 100644
--- a/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
+++ b/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 23:13:06 +0100
Subject: x86/speculation/mds: Add mds_clear_cpu_buffers()
Git-commit: 6a9e529272517755904b7afa639f6db59ddb793e
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
The Microarchitectural Data Sampling (MDS) vulernabilities are mitigated by
diff --git a/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch b/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
index 5ba6fa6b6f..dff5a6ac26 100644
--- a/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 22:04:08 +0100
Subject: x86/speculation/mds: Add mitigation control for MDS
Git-commit: bc1241700acd82ec69fde98c5763ce51086269f8
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Now that the mitigations are in place, add a command line parameter to
diff --git a/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch b/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
index 2892354690..1e3397de1c 100644
--- a/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
+++ b/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 20 Feb 2019 09:40:40 +0100
Subject: x86/speculation/mds: Add mitigation mode VMWERV
Git-commit: 22dd8365088b6403630b82423cf906491859b65e
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
In virtualized environments it can happen that the host has the microcode
diff --git a/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch b/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
index ee8d12f86b..abb38f06fe 100644
--- a/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
@@ -1,9 +1,8 @@
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Wed, 17 Apr 2019 16:39:02 -0500
Subject: x86/speculation/mds: Add 'mitigations=' support for MDS
-Git-repo: tip/tip
Git-commit: 5c14068f87d04adc73ba3f41c2a303d3c3d1fa12
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add MDS to the new 'mitigations=' cmdline option.
diff --git a/patches.arch/x86-speculation-mds-add-smt-warning-message.patch b/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
index bb34433e23..fd6806f607 100644
--- a/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
+++ b/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Tue, 2 Apr 2019 10:00:51 -0500
Subject: x86/speculation/mds: Add SMT warning message
Git-commit: 39226ef02bfb43248b7db12a4fdccb39d95318e3
-Git-repo: tip/tip
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
MDS is vulnerable with SMT. Make that clear with a one-time printk
diff --git a/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch b/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
index 90f30b7b44..163d8311e7 100644
--- a/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 22:51:43 +0100
Subject: x86/speculation/mds: Add sysfs reporting for MDS
Git-commit: 8a4b06d391b0a42a373808979b5028f5c84d9c6a
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add the sysfs reporting file for MDS. It exposes the vulnerability and
diff --git a/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch b/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
index 4317019839..2236a9acca 100644
--- a/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
+++ b/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 23:42:51 +0100
Subject: x86/speculation/mds: Clear CPU buffers on exit to user
Git-commit: 04dcbdb8057827b043b3c71aa397c4c63e67d086
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add a static key which controls the invocation of the CPU buffer clear
@@ -118,7 +118,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
#include <asm/mpx.h>
#include <asm/vm86.h>
#include <asm/umip.h>
-@@ -394,6 +395,13 @@ dotraplinkage void do_double_fault(struc
+@@ -393,6 +394,13 @@ dotraplinkage void do_double_fault(struc
regs->ip = (unsigned long)general_protection;
regs->sp = (unsigned long)&gpregs->orig_ax;
diff --git a/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch b/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
index 9102f2349d..09385844b6 100644
--- a/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
+++ b/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 23:04:01 +0100
Subject: x86/speculation/mds: Conditionally clear CPU buffers on idle entry
Git-commit: 07f07f55a29cb705e221eda7894dd67ab81ef343
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add a static key which controls the invocation of the CPU buffer clear
diff --git a/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch b/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
index ef3abeb1f2..080d53e2d0 100644
--- a/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
+++ b/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
@@ -1,9 +1,8 @@
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date: Fri, 12 Apr 2019 17:50:58 -0400
Subject: x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
-Git-repo: tip/tip
Git-commit: e2c3c94788b08891dcf3dbe608f9880523ecd71b
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
This code is only for CPUs which are affected by MSBDS, but are *not*
diff --git a/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch b/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
index c8c1edd2a8..a0516bdfdc 100644
--- a/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
+++ b/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
@@ -1,9 +1,8 @@
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Tue, 2 Apr 2019 10:00:14 -0500
Subject: x86/speculation: Move arch_smt_update() call to after mitigation decisions
-Git-repo: tip/tip
Git-commit: 7c3658b20194a5b3209a143f63bc9c643c6a3ae2
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
arch_smt_update() now has a dependency on both Spectre v2 and MDS
diff --git a/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch b/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
index 8fda421f64..a7c8d4052b 100644
--- a/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:29 -0500
Subject: x86/speculation: Support 'mitigations=' cmdline option
Git-commit: d68be4c4d31295ff6ae34a8ddfaa4c1a8ff42812
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure x86 runtime CPU speculation bug mitigations in accordance with
diff --git a/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch b/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch
new file mode 100644
index 0000000000..bb88b39836
--- /dev/null
+++ b/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch
@@ -0,0 +1,181 @@
+From f4fa968950aef7efb98a0899bb0132405e2edaf1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 18:18:47 +0200
+Subject: [PATCH] ALSA: core: Don't refer to snd_cards array directly
+Git-commit: f4fa968950aef7efb98a0899bb0132405e2edaf1
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The snd_cards[] array holds the card pointers that have been currently
+registered, and it's exported for the external modules that may need
+to refer a card object. But accessing to this array can be racy
+against the driver probe or removal, as the card registration or free
+may happen concurrently.
+
+This patch gets rid of the direct access to snd_cards[] array and
+provides a helper function to give the card object from the index
+number with a refcount management. Then the caller can access to the
+given card object safely, and releases it via snd_card_unref().
+
+While we're at it, add a proper comment to snd_card_unref() and make
+it an inlined function for type-safety, too.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/core.h | 16 ++++++++++++++--
+ sound/core/init.c | 23 +++++++++++++++++++++--
+ sound/core/oss/mixer_oss.c | 16 ++++++++++++----
+ sound/core/sound.c | 5 ++++-
+ sound/last.c | 10 +++++++---
+ 5 files changed, 58 insertions(+), 12 deletions(-)
+
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -241,7 +241,6 @@ int copy_from_user_toio(volatile void __
+
+ /* init.c */
+
+-extern struct snd_card *snd_cards[SNDRV_CARDS];
+ int snd_card_locked(int card);
+ #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
+ #define SND_MIXER_OSS_NOTIFY_REGISTER 0
+@@ -265,7 +264,20 @@ int snd_card_add_dev_attr(struct snd_car
+ int snd_component_add(struct snd_card *card, const char *component);
+ int snd_card_file_add(struct snd_card *card, struct file *file);
+ int snd_card_file_remove(struct snd_card *card, struct file *file);
+-#define snd_card_unref(card) put_device(&(card)->card_dev)
++
++struct snd_card *snd_card_ref(int card);
++
++/**
++ * snd_card_unref - Unreference the card object
++ * @card: the card object to unreference
++ *
++ * Call this function for the card object that was obtained via snd_card_ref()
++ * or snd_lookup_minor_data().
++ */
++static inline void snd_card_unref(struct snd_card *card)
++{
++ put_device(&card->card_dev);
++}
+
+ #define snd_card_set_dev(card, devptr) ((card)->dev = (devptr))
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -49,8 +49,7 @@ static const struct file_operations snd_
+
+ /* locked for registering/using */
+ static DECLARE_BITMAP(snd_cards_lock, SNDRV_CARDS);
+-struct snd_card *snd_cards[SNDRV_CARDS];
+-EXPORT_SYMBOL(snd_cards);
++static struct snd_card *snd_cards[SNDRV_CARDS];
+
+ static DEFINE_MUTEX(snd_card_mutex);
+
+@@ -294,6 +293,26 @@ int snd_card_new(struct device *parent,
+ }
+ EXPORT_SYMBOL(snd_card_new);
+
++/**
++ * snd_card_ref - Get the card object from the index
++ * @idx: the card index
++ *
++ * Returns a card object corresponding to the given index or NULL if not found.
++ * Release the object via snd_card_unref().
++ */
++struct snd_card *snd_card_ref(int idx)
++{
++ struct snd_card *card;
++
++ mutex_lock(&snd_card_mutex);
++ card = snd_cards[idx];
++ if (card)
++ get_device(&card->card_dev);
++ mutex_unlock(&snd_card_mutex);
++ return card;
++}
++EXPORT_SYMBOL_GPL(snd_card_ref);
++
+ /* return non-zero if a card is already locked */
+ int snd_card_locked(int card)
+ {
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -1402,24 +1402,32 @@ static int snd_mixer_oss_notify_handler(
+
+ static int __init alsa_mixer_oss_init(void)
+ {
++ struct snd_card *card;
+ int idx;
+
+ snd_mixer_oss_notify_callback = snd_mixer_oss_notify_handler;
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- if (snd_cards[idx])
+- snd_mixer_oss_notify_handler(snd_cards[idx], SND_MIXER_OSS_NOTIFY_REGISTER);
++ card = snd_card_ref(idx);
++ if (card) {
++ snd_mixer_oss_notify_handler(card, SND_MIXER_OSS_NOTIFY_REGISTER);
++ snd_card_unref(card);
++ }
+ }
+ return 0;
+ }
+
+ static void __exit alsa_mixer_oss_exit(void)
+ {
++ struct snd_card *card;
+ int idx;
+
+ snd_mixer_oss_notify_callback = NULL;
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- if (snd_cards[idx])
+- snd_mixer_oss_notify_handler(snd_cards[idx], SND_MIXER_OSS_NOTIFY_FREE);
++ card = snd_card_ref(idx);
++ if (card) {
++ snd_mixer_oss_notify_handler(card, SND_MIXER_OSS_NOTIFY_FREE);
++ snd_card_unref(card);
++ }
+ }
+ }
+
+--- a/sound/core/sound.c
++++ b/sound/core/sound.c
+@@ -136,8 +136,11 @@ static struct snd_minor *autoload_device
+ if (dev == SNDRV_MINOR_CONTROL) {
+ /* /dev/aloadC? */
+ int card = SNDRV_MINOR_CARD(minor);
+- if (snd_cards[card] == NULL)
++ struct snd_card *ref = snd_card_ref(card);
++ if (!ref)
+ snd_request_card(card);
++ else
++ snd_card_unref(ref);
+ } else if (dev == SNDRV_MINOR_GLOBAL) {
+ /* /dev/aloadSEQ */
+ snd_request_other(minor);
+--- a/sound/last.c
++++ b/sound/last.c
+@@ -24,14 +24,18 @@
+
+ static int __init alsa_sound_last_init(void)
+ {
++ struct snd_card *card;
+ int idx, ok = 0;
+
+ printk(KERN_INFO "ALSA device list:\n");
+- for (idx = 0; idx < SNDRV_CARDS; idx++)
+- if (snd_cards[idx] != NULL) {
+- printk(KERN_INFO " #%i: %s\n", idx, snd_cards[idx]->longname);
++ for (idx = 0; idx < SNDRV_CARDS; idx++) {
++ card = snd_card_ref(idx);
++ if (card) {
++ printk(KERN_INFO " #%i: %s\n", idx, card->longname);
++ snd_card_unref(card);
+ ok++;
+ }
++ }
+ if (ok == 0)
+ printk(KERN_INFO " No soundcards found.\n");
+ return 0;
diff --git a/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch b/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch
new file mode 100644
index 0000000000..506e41c6fc
--- /dev/null
+++ b/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch
@@ -0,0 +1,50 @@
+From c989954938761a2939a21fcbc768af182de6be58 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 18:01:46 +0200
+Subject: [PATCH] ALSA: emu10k1: Drop superfluous id-uniquification behavior
+Git-commit: c989954938761a2939a21fcbc768af182de6be58
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The emu10k1 driver tries to create a unique id string by itself when
+it's copied from the card list, but it's rather superfluous, as the
+same thing will be done in ALSA core side at the card registration.
+Let's drop the code. This allows us removing snd_cards export.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/emu10k1/emu10k1_main.c | 16 +---------------
+ 1 file changed, 1 insertion(+), 15 deletions(-)
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index 61f85ff91cd9..0419c75bdf5a 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -1882,22 +1882,8 @@ int snd_emu10k1_create(struct snd_card *card,
+ c->name, pci->vendor, pci->device,
+ emu->serial);
+
+- if (!*card->id && c->id) {
+- int i, n = 0;
++ if (!*card->id && c->id)
+ strlcpy(card->id, c->id, sizeof(card->id));
+- for (;;) {
+- for (i = 0; i < snd_ecards_limit; i++) {
+- if (snd_cards[i] && !strcmp(snd_cards[i]->id, card->id))
+- break;
+- }
+- if (i >= snd_ecards_limit)
+- break;
+- n++;
+- if (n >= SNDRV_CARDS)
+- break;
+- snprintf(card->id, sizeof(card->id), "%s_%d", c->id, n);
+- }
+- }
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch b/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch
new file mode 100644
index 0000000000..73e136f881
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch
@@ -0,0 +1,64 @@
+From f495222e28275222ab6fd93813bd3d462e16d340 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Apr 2019 12:18:28 +0200
+Subject: [PATCH] ALSA: hda - Register irq handler after the chip initialization
+Git-commit: f495222e28275222ab6fd93813bd3d462e16d340
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently the IRQ handler in HD-audio controller driver is registered
+before the chip initialization. That is, we have some window opened
+between the azx_acquire_irq() call and the CORB/RIRB setup. If an
+interrupt is triggered in this small window, the IRQ handler may
+access to the uninitialized RIRB buffer, which leads to a NULL
+dereference Oops.
+
+This is usually no big problem since most of Intel chips do register
+the IRQ via MSI, and we've already fixed the order of the IRQ
+enablement and the CORB/RIRB setup in the former commit b61749a89f82
+("sound: enable interrupt after dma buffer initialization"), hence the
+IRQ won't be triggered in that room. However, some platforms use a
+shared IRQ, and this may allow the IRQ trigger by another source.
+
+Another possibility is the kdump environment: a stale interrupt might
+be present in there, the IRQ handler can be falsely triggered as well.
+
+For covering this small race, let's move the azx_acquire_irq() call
+after hda_intel_init_chip() call. Although this is a bit radical
+change, it can cover more widely than checking the CORB/RIRB setup
+locally in the callee side.
+
+Reported-by: Liwei Song <liwei.song@windriver.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 2ec91085fa3e..789308f54785 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1788,9 +1788,6 @@ static int azx_first_init(struct azx *chip)
+ chip->msi = 0;
+ }
+
+- if (azx_acquire_irq(chip, 0) < 0)
+- return -EBUSY;
+-
+ pci_set_master(pci);
+ synchronize_irq(bus->irq);
+
+@@ -1904,6 +1901,9 @@ static int azx_first_init(struct azx *chip)
+ return -ENODEV;
+ }
+
++ if (azx_acquire_irq(chip, 0) < 0)
++ return -EBUSY;
++
+ strcpy(card->driver, "HDA-Intel");
+ strlcpy(card->shortname, driver_short_names[chip->driver_type],
+ sizeof(card->shortname));
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch b/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch
new file mode 100644
index 0000000000..53a39fc7f4
--- /dev/null
+++ b/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch
@@ -0,0 +1,61 @@
+From 7f641e26a6df9269cb25dd7a4b0a91d6586ed441 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 6 May 2019 22:09:32 +0800
+Subject: [PATCH] ALSA: hda/hdmi - Consider eld_valid when reporting jack event
+Git-commit: 7f641e26a6df9269cb25dd7a4b0a91d6586ed441
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On the machines with AMD GPU or Nvidia GPU, we often meet this issue:
+after s3, there are 4 HDMI/DP audio devices in the gnome-sound-setting
+even there is no any monitors plugged.
+
+When this problem happens, we check the /proc/asound/cardX/eld#N.M, we
+will find the monitor_present=1, eld_valid=0.
+
+The root cause is BIOS or GPU driver makes the PRESENCE valid even no
+monitor plugged, and of course the driver will not get the valid
+eld_data subsequently.
+
+In this situation, we should not report the jack_plugged event, to do
+so, let us change the function hdmi_present_sense_via_verbs(). In this
+function, it reads the pin_sense via snd_hda_pin_sense(), after
+calling this function, the jack_dirty is 0, and before exiting
+via_verbs(), we change the shadow pin_sense according to both
+monitor_present and eld_valid, then in the snd_hda_jack_report_sync(),
+since the jack_dirty is still 0, it will report jack event according
+to this modified shadow pin_sense.
+
+After this change, the driver will not report Jack_is_plugged event
+through hdmi_present_sense_via_verbs() if monitor_present is 1 and
+eld_valid is 0.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_hdmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 380001d6e797..0c61c05503f5 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1551,9 +1551,11 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
+ ret = !repoll || !eld->monitor_present || eld->eld_valid;
+
+ jack = snd_hda_jack_tbl_get(codec, pin_nid);
+- if (jack)
++ if (jack) {
+ jack->block_report = !ret;
+-
++ jack->pin_sense = (eld->monitor_present && eld->eld_valid) ?
++ AC_PINSENSE_PRESENCE : 0;
++ }
+ mutex_unlock(&per_pin->lock);
+ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch b/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch
new file mode 100644
index 0000000000..76fad87bac
--- /dev/null
+++ b/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch
@@ -0,0 +1,48 @@
+From 8c2e6728c2bf95765b724e07d0278ae97cd1ee0d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 6 May 2019 22:09:31 +0800
+Subject: [PATCH] ALSA: hda/hdmi - Read the pin sense from register when repolling
+Git-commit: 8c2e6728c2bf95765b724e07d0278ae97cd1ee0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The driver will check the monitor presence when resuming from suspend,
+starting poll or interrupt triggers. In these 3 situations, the
+jack_dirty will be set to 1 first, then the hda_jack.c reads the
+pin_sense from register, after reading the register, the jack_dirty
+will be set to 0. But hdmi_repoll_work() is enabled in these 3
+situations, It will read the pin_sense a couple of times subsequently,
+since the jack_dirty is 0 now, It does not read the register anymore,
+instead it uses the shadow pin_sense which is read at the first time.
+
+It is meaningless to check the shadow pin_sense a couple of times,
+we need to read the register to check the real plugging state, so
+we set the jack_dirty to 1 in the hdmi_repoll_work().
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 8b3ac690efa3..380001d6e797 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1663,6 +1663,11 @@ static void hdmi_repoll_eld(struct work_struct *work)
+ container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
+ struct hda_codec *codec = per_pin->codec;
+ struct hdmi_spec *spec = codec->spec;
++ struct hda_jack_tbl *jack;
++
++ jack = snd_hda_jack_tbl_get(codec, per_pin->pin_nid);
++ if (jack)
++ jack->jack_dirty = 1;
+
+ if (per_pin->repoll_count++ > 6)
+ per_pin->repoll_count = 0;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch b/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
index 5cab8e57c9..605e0fc1fe 100644
--- a/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
+++ b/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
@@ -4,8 +4,7 @@ Date: Tue, 2 Apr 2019 15:52:04 +0200
Subject: [PATCH] ALSA: hda/realtek - Add quirk for Tuxedo XC 1509
References: bsc#1131442
Git-commit: 80690a276f444a68a332136d98bfea1c338bc263
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.1-rc5
This adds a SND_PCI_QUIRK(...) line for the Tuxedo XC 1509.
diff --git a/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch b/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch
new file mode 100644
index 0000000000..6d185debc3
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch
@@ -0,0 +1,43 @@
+From 607ca3bd220f4022e6f5356026b19dafc363863a Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Fri, 26 Apr 2019 16:35:41 +0800
+Subject: [PATCH] ALSA: hda/realtek - EAPD turn on later
+Git-commit: 607ca3bd220f4022e6f5356026b19dafc363863a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Let EAPD turn on after set pin output.
+
+[ NOTE: This change is supposed to reduce the possible click noises at
+ (runtime) PM resume. The functionality should be same (i.e. the
+ verbs are executed correctly) no matter which order is, so this
+ should be safe to apply for all codecs -- tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 810479766090..674ddff65bef 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -803,11 +803,10 @@ static int alc_init(struct hda_codec *codec)
+ if (spec->init_hook)
+ spec->init_hook(codec);
+
++ snd_hda_gen_init(codec);
+ alc_fix_pll(codec);
+ alc_auto_init_amp(codec, spec->init_amp);
+
+- snd_hda_gen_init(codec);
+-
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+
+ return 0;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch b/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch
new file mode 100644
index 0000000000..ba0da7343e
--- /dev/null
+++ b/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch
@@ -0,0 +1,39 @@
+From 80a5052db75131423b67f38b21958555d7d970e4 Mon Sep 17 00:00:00 2001
+From: Jeremy Soller <jeremy@system76.com>
+Date: Tue, 7 May 2019 17:11:08 -0400
+Subject: [PATCH] ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
+Git-commit: 80a5052db75131423b67f38b21958555d7d970e4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On the System76 Gazelle (gaze14), there is a headset microphone input
+attached to 0x1a that does not have a jack detect. In order to get it
+working, the pin configuration needs to be set correctly, and the
+ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied. This is
+identical to the patch already applied for the System76 Darter Pro
+(darp5).
+
+Signed-off-by: Jeremy Soller <jeremy@system76.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e733d323f1a7..dacccacb5fe0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6948,6 +6948,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8550, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch b/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch
new file mode 100644
index 0000000000..50c6da90b1
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch
@@ -0,0 +1,64 @@
+From 4b24b960b10b6a4e30beba3ce097fa867b4a085f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 15:55:08 +0100
+Subject: [PATCH] ALSA: seq: Align temporary re-locking with irqsave version
+Git-commit: 4b24b960b10b6a4e30beba3ce097fa867b4a085f
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In a few places in sequencer core, we temporarily unlock / re-lock the
+pool spin lock while waiting for the allocation in the blocking mode.
+There spin_unlock_irq() / spin_lock_irq() pairs are called while
+initially spin_lock_irqsave() is used (and spin_lock_irqrestore() at
+the end of the function again). This is likely OK for now, but it's a
+bit confusing and error-prone.
+
+This patch replaces these temporary relocking lines with the irqsave
+variant to make the lock/unlock sequence more consistently.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_fifo.c | 4 ++--
+ sound/core/seq/seq_memory.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 72c0302a55d2..613ae10d33b8 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -195,9 +195,9 @@ int snd_seq_fifo_cell_out(struct snd_seq_fifo *f,
+ }
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&f->input_sleep, &wait);
+- spin_unlock_irq(&f->lock);
++ spin_unlock_irqrestore(&f->lock, flags);
+ schedule();
+- spin_lock_irq(&f->lock);
++ spin_lock_irqsave(&f->lock, flags);
+ remove_wait_queue(&f->input_sleep, &wait);
+ if (signal_pending(current)) {
+ spin_unlock_irqrestore(&f->lock, flags);
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index 6ea4d8a5a71e..ae0b8971f6ce 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -244,13 +244,13 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
+
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&pool->output_sleep, &wait);
+- spin_unlock_irq(&pool->lock);
++ spin_unlock_irqrestore(&pool->lock, flags);
+ if (mutexp)
+ mutex_unlock(mutexp);
+ schedule();
+ if (mutexp)
+ mutex_lock(mutexp);
+- spin_lock_irq(&pool->lock);
++ spin_lock_irqsave(&pool->lock, flags);
+ remove_wait_queue(&pool->output_sleep, &wait);
+ /* interrupted? */
+ if (signal_pending(current)) {
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch b/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch
new file mode 100644
index 0000000000..308af2814c
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch
@@ -0,0 +1,50 @@
+From b5fd12d6c0fc64c2c2b5ae095e63824083d27151 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Apr 2019 09:03:01 +0200
+Subject: [PATCH] ALSA: seq: Correct unlock sequence at snd_seq_client_ioctl_unlock()
+Git-commit: b5fd12d6c0fc64c2c2b5ae095e63824083d27151
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The doubly unlock sequence at snd_seq_client_ioctl_unlock() is tricky.
+I took a direct unref call since I thought it would avoid
+misunderstanding, but rather this seems more confusing. Let's use
+snd_seq_client_unlock() consistently even if they look strange to be
+called twice, and add more comments for avoiding reader's confusion.
+
+Fixes: 6b580f523172 ("ALSA: seq: Protect racy pool manipulation from OSS sequencer")
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 3acd80e718f2..c0227a672442 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -191,6 +191,7 @@ bool snd_seq_client_ioctl_lock(int clientid)
+ if (!client)
+ return false;
+ mutex_lock(&client->ioctl_mutex);
++ /* The client isn't unrefed here; see snd_seq_client_ioctl_unlock() */
+ return true;
+ }
+ EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock);
+@@ -204,7 +205,11 @@ void snd_seq_client_ioctl_unlock(int clientid)
+ if (WARN_ON(!client))
+ return;
+ mutex_unlock(&client->ioctl_mutex);
+- snd_use_lock_free(&client->use_lock);
++ /* The doubly unrefs below are intentional; the first one releases the
++ * leftover from snd_seq_client_ioctl_lock() above, and the second one
++ * is for releasing snd_seq_client_use_ptr() in this function
++ */
++ snd_seq_client_unlock(client);
+ snd_seq_client_unlock(client);
+ }
+ EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch b/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch
new file mode 100644
index 0000000000..19f83f1555
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch
@@ -0,0 +1,40 @@
+From 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 11:37:19 +0200
+Subject: [PATCH] ALSA: seq: Cover unsubscribe_port() in list_mutex
+Git-commit: 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call of unsubscribe_port() which manages the group count and
+module refcount from delete_and_unsubscribe_port() looks racy; it's
+not covered by the group list lock, and it's likely a cause of the
+reported unbalance at port deletion. Let's move the call inside the
+group list_mutex to plug the hole.
+
+Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_ports.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index d964d728681e..ac7556ab531c 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -547,10 +547,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+ list_del_init(list);
+ grp->exclusive = 0;
+ write_unlock_irq(&grp->list_lock);
+- up_write(&grp->list_mutex);
+
+ if (!empty)
+ unsubscribe_port(client, port, grp, &subs->info, ack);
++ up_write(&grp->list_mutex);
+ }
+
+ /* connect two ports */
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch b/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
new file mode 100644
index 0000000000..9c7cc9bf17
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
@@ -0,0 +1,103 @@
+From 2eabc5ec8ab4d4748a82050dfcb994119b983750 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 18:04:17 +0200
+Subject: [PATCH] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
+Git-commit: 2eabc5ec8ab4d4748a82050dfcb994119b983750
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The snd_seq_ioctl_get_subscription() retrieves the port subscriber
+information as a pointer, while the object isn't protected, hence it
+may be deleted before the actual reference. This race was spotted by
+syzkaller and may lead to a UAF.
+
+The fix is simply copying the data in the lookup function that
+performs in the rwsem to protect against the deletion.
+
+Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 10 ++--------
+ sound/core/seq/seq_ports.c | 13 ++++++++-----
+ sound/core/seq/seq_ports.h | 5 +++--
+ 3 files changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 976404691261..f256704dc401 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1897,20 +1897,14 @@ static int snd_seq_ioctl_get_subscription(struct snd_seq_client *client,
+ int result;
+ struct snd_seq_client *sender = NULL;
+ struct snd_seq_client_port *sport = NULL;
+- struct snd_seq_subscribers *p;
+
+ result = -EINVAL;
+ if ((sender = snd_seq_client_use_ptr(subs->sender.client)) == NULL)
+ goto __end;
+ if ((sport = snd_seq_port_use_ptr(sender, subs->sender.port)) == NULL)
+ goto __end;
+- p = snd_seq_port_get_subscription(&sport->c_src, &subs->dest);
+- if (p) {
+- result = 0;
+- *subs = p->info;
+- } else
+- result = -ENOENT;
+-
++ result = snd_seq_port_get_subscription(&sport->c_src, &subs->dest,
++ subs);
+ __end:
+ if (sport)
+ snd_seq_port_unlock(sport);
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 1e2239240f21..d964d728681e 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -632,20 +632,23 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr)
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs)
+ {
+- struct snd_seq_subscribers *s, *found = NULL;
++ struct snd_seq_subscribers *s;
++ int err = -ENOENT;
+
+ down_read(&src_grp->list_mutex);
+ list_for_each_entry(s, &src_grp->list_head, src_list) {
+ if (addr_match(dest_addr, &s->info.dest)) {
+- found = s;
++ *subs = s->info;
++ err = 0;
+ break;
+ }
+ }
+ up_read(&src_grp->list_mutex);
+- return found;
++ return err;
+ }
+
+ /*
+diff --git a/sound/core/seq/seq_ports.h b/sound/core/seq/seq_ports.h
+index 26bd71f36c41..06003b36652e 100644
+--- a/sound/core/seq/seq_ports.h
++++ b/sound/core/seq/seq_ports.h
+@@ -135,7 +135,8 @@ int snd_seq_port_subscribe(struct snd_seq_client_port *port,
+ struct snd_seq_port_subscribe *info);
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr);
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs);
+
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch b/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
new file mode 100644
index 0000000000..47ed8949b1
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
@@ -0,0 +1,54 @@
+From feb689025fbb6f0aa6297d3ddf97de945ea4ad32 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 17:35:22 +0200
+Subject: [PATCH] ALSA: seq: Protect in-kernel ioctl calls with mutex
+Git-commit: feb689025fbb6f0aa6297d3ddf97de945ea4ad32
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+ALSA OSS sequencer calls the ioctl function indirectly via
+snd_seq_kernel_client_ctl(). While we already applied the protection
+against races between the normal ioctls and writes via the client's
+ioctl_mutex, this code path was left untouched. And this seems to be
+the cause of still remaining some rare UAF as spontaneously triggered
+by syzkaller.
+
+For the sake of robustness, wrap the ioctl_mutex also for the call via
+snd_seq_kernel_client_ctl(), too.
+
+Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 933bde3843d9..976404691261 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2340,14 +2340,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ {
+ const struct ioctl_handler *handler;
+ struct snd_seq_client *client;
++ int err;
+
+ client = clientptr(clientid);
+ if (client == NULL)
+ return -ENXIO;
+
+ for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
+- if (handler->cmd == cmd)
+- return handler->func(client, arg);
++ if (handler->cmd == cmd) {
++ mutex_lock(&client->ioctl_mutex);
++ err = handler->func(client, arg);
++ mutex_unlock(&client->ioctl_mutex);
++ return err;
++ }
+ }
+
+ pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch b/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch
new file mode 100644
index 0000000000..2c9eaf349b
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch
@@ -0,0 +1,132 @@
+From 6b580f523172f2c738b661069a57c23c74a75f88 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 12:44:39 +0200
+Subject: [PATCH] ALSA: seq: Protect racy pool manipulation from OSS sequencer
+Git-commit: 6b580f523172f2c738b661069a57c23c74a75f88
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+OSS sequencer emulation still allows to queue and issue the events
+that manipulate the client pool concurrently in a racy way. This
+patch serializes the access like the normal sequencer write / ioctl
+via taking the client ioctl_mutex. Since the access to the sequencer
+client is done indirectly via a client id number, a new helper to
+take/release the mutex is introduced.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/oss/seq_oss_device.h | 10 ++++++++--
+ sound/core/seq/seq_clientmgr.c | 40 ++++++++++++++++++++++++++++++++++---
+ sound/core/seq/seq_clientmgr.h | 4 ++++
+ 3 files changed, 49 insertions(+), 5 deletions(-)
+
+diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
+index 2d0e9eaf13aa..77eb1fe1155c 100644
+--- a/sound/core/seq/oss/seq_oss_device.h
++++ b/sound/core/seq/oss/seq_oss_device.h
+@@ -30,6 +30,7 @@
+ #include <sound/rawmidi.h>
+ #include <sound/seq_kernel.h>
+ #include <sound/info.h>
++#include "../seq_clientmgr.h"
+
+ /* max. applications */
+ #define SNDRV_SEQ_OSS_MAX_CLIENTS 16
+@@ -150,11 +151,16 @@ snd_seq_oss_dispatch(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, int a
+ return snd_seq_kernel_client_dispatch(dp->cseq, ev, atomic, hop);
+ }
+
+-/* ioctl */
++/* ioctl for writeq */
+ static inline int
+ snd_seq_oss_control(struct seq_oss_devinfo *dp, unsigned int type, void *arg)
+ {
+- return snd_seq_kernel_client_ctl(dp->cseq, type, arg);
++ int err;
++
++ snd_seq_client_ioctl_lock(dp->cseq);
++ err = snd_seq_kernel_client_ctl(dp->cseq, type, arg);
++ snd_seq_client_ioctl_unlock(dp->cseq);
++ return err;
+ }
+
+ /* fill the addresses in header */
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 0af5b1440b33..a5c9d59eb5b8 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -179,6 +179,36 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ return client;
+ }
+
++/* Take refcount and perform ioctl_mutex lock on the given client;
++ * used only for OSS sequencer
++ * Unlock via snd_seq_client_ioctl_unlock() below
++ */
++bool snd_seq_client_ioctl_lock(int clientid)
++{
++ struct snd_seq_client *client;
++
++ client = snd_seq_client_use_ptr(clientid);
++ if (!client)
++ return false;
++ mutex_lock(&client->ioctl_mutex);
++ return true;
++}
++EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock);
++
++/* Unlock and unref the given client; for OSS sequencer use only */
++void snd_seq_client_ioctl_unlock(int clientid)
++{
++ struct snd_seq_client *client;
++
++ client = snd_seq_client_use_ptr(clientid);
++ if (WARN_ON(!client))
++ return;
++ mutex_unlock(&client->ioctl_mutex);
++ snd_use_lock_free(&client->use_lock);
++ snd_seq_client_unlock(client);
++}
++EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock);
++
+ static void usage_alloc(struct snd_seq_usage *res, int num)
+ {
+ res->cur += num;
+@@ -2247,11 +2277,15 @@ int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
+ if (cptr == NULL)
+ return -EINVAL;
+
+- if (! cptr->accept_output)
++ if (!cptr->accept_output) {
+ result = -EPERM;
+- else /* send it */
++ } else { /* send it */
++ mutex_lock(&cptr->ioctl_mutex);
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+- false, 0, NULL);
++ false, 0,
++ &cptr->ioctl_mutex);
++ mutex_unlock(&cptr->ioctl_mutex);
++ }
+
+ snd_seq_client_unlock(cptr);
+ return result;
+diff --git a/sound/core/seq/seq_clientmgr.h b/sound/core/seq/seq_clientmgr.h
+index 66ad3d547916..28a51dcc0190 100644
+--- a/sound/core/seq/seq_clientmgr.h
++++ b/sound/core/seq/seq_clientmgr.h
+@@ -97,6 +97,10 @@ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table
+ int snd_seq_client_notify_subscription(int client, int port,
+ struct snd_seq_port_subscribe *info, int evtype);
+
++/* only for OSS sequencer */
++bool snd_seq_client_ioctl_lock(int clientid);
++void snd_seq_client_ioctl_unlock(int clientid);
++
+ extern int seq_client_load[15];
+
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch b/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch
new file mode 100644
index 0000000000..f0ff02fb78
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch
@@ -0,0 +1,277 @@
+From f823b8a75527dca0b93cf577bbabbe47fd79b2a8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 16:21:01 +0100
+Subject: [PATCH] ALSA: seq: Remove superfluous irqsave flags
+Git-commit: f823b8a75527dca0b93cf577bbabbe47fd79b2a8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+spin_lock_irqsave() is used unnecessarily in various places in
+sequencer core code although it's pretty obvious that the context is
+sleepable. Remove irqsave and use the plain spin_lock_irq() in such
+places for simplicity.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 19 ++++++++-----------
+ sound/core/seq/seq_fifo.c | 10 ++++------
+ sound/core/seq/seq_memory.c | 16 +++++++---------
+ sound/core/seq/seq_ports.c | 15 ++++++---------
+ 4 files changed, 25 insertions(+), 35 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -203,7 +203,6 @@ int __init client_init_data(void)
+
+ static struct snd_seq_client *seq_create_client1(int client_index, int poolsize)
+ {
+- unsigned long flags;
+ int c;
+ struct snd_seq_client *client;
+
+@@ -224,7 +223,7 @@ static struct snd_seq_client *seq_create
+ mutex_init(&client->ioctl_mutex);
+
+ /* find free slot in the client table */
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ if (client_index < 0) {
+ for (c = SNDRV_SEQ_DYNAMIC_CLIENTS_BEGIN;
+ c < SNDRV_SEQ_MAX_CLIENTS;
+@@ -232,17 +231,17 @@ static struct snd_seq_client *seq_create
+ if (clienttab[c] || clienttablock[c])
+ continue;
+ clienttab[client->number = c] = client;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return client;
+ }
+ } else {
+ if (clienttab[client_index] == NULL && !clienttablock[client_index]) {
+ clienttab[client->number = client_index] = client;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return client;
+ }
+ }
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ snd_seq_pool_delete(&client->pool);
+ kfree(client);
+ return NULL; /* no free slot found or busy, return failure code */
+@@ -251,23 +250,21 @@ static struct snd_seq_client *seq_create
+
+ static int seq_free_client1(struct snd_seq_client *client)
+ {
+- unsigned long flags;
+-
+ if (!client)
+ return 0;
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ clienttablock[client->number] = 1;
+ clienttab[client->number] = NULL;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ snd_seq_delete_all_ports(client);
+ snd_seq_queue_client_leave(client->number);
+ snd_use_lock_sync(&client->use_lock);
+ snd_seq_queue_client_termination(client->number);
+ if (client->pool)
+ snd_seq_pool_delete(&client->pool);
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ clienttablock[client->number] = 0;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return 0;
+ }
+
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -98,18 +98,17 @@ static struct snd_seq_event_cell *fifo_c
+ void snd_seq_fifo_clear(struct snd_seq_fifo *f)
+ {
+ struct snd_seq_event_cell *cell;
+- unsigned long flags;
+
+ /* clear overflow flag */
+ atomic_set(&f->overflow, 0);
+
+ snd_use_lock_sync(&f->use_lock);
+- spin_lock_irqsave(&f->lock, flags);
++ spin_lock_irq(&f->lock);
+ /* drain the fifo */
+ while ((cell = fifo_cell_out(f)) != NULL) {
+ snd_seq_cell_free(cell);
+ }
+- spin_unlock_irqrestore(&f->lock, flags);
++ spin_unlock_irq(&f->lock);
+ }
+
+
+@@ -239,7 +238,6 @@ int snd_seq_fifo_poll_wait(struct snd_se
+ /* change the size of pool; all old events are removed */
+ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
+ {
+- unsigned long flags;
+ struct snd_seq_pool *newpool, *oldpool;
+ struct snd_seq_event_cell *cell, *next, *oldhead;
+
+@@ -255,7 +253,7 @@ int snd_seq_fifo_resize(struct snd_seq_f
+ return -ENOMEM;
+ }
+
+- spin_lock_irqsave(&f->lock, flags);
++ spin_lock_irq(&f->lock);
+ /* remember old pool */
+ oldpool = f->pool;
+ oldhead = f->head;
+@@ -265,7 +263,7 @@ int snd_seq_fifo_resize(struct snd_seq_f
+ f->tail = NULL;
+ f->cells = 0;
+ /* NOTE: overflow flag is not cleared */
+- spin_unlock_irqrestore(&f->lock, flags);
++ spin_unlock_irq(&f->lock);
+
+ /* close the old pool and wait until all users are gone */
+ snd_seq_pool_mark_closing(oldpool);
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -386,7 +386,6 @@ int snd_seq_pool_init(struct snd_seq_poo
+ {
+ int cell;
+ struct snd_seq_event_cell *cellptr;
+- unsigned long flags;
+
+ if (snd_BUG_ON(!pool))
+ return -EINVAL;
+@@ -396,9 +395,9 @@ int snd_seq_pool_init(struct snd_seq_poo
+ return -ENOMEM;
+
+ /* add new cells to the free cell list */
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ if (pool->ptr) {
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+ vfree(cellptr);
+ return 0;
+ }
+@@ -417,7 +416,7 @@ int snd_seq_pool_init(struct snd_seq_poo
+ /* init statistics */
+ pool->max_used = 0;
+ pool->total_elements = pool->size;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+ return 0;
+ }
+
+@@ -436,7 +435,6 @@ void snd_seq_pool_mark_closing(struct sn
+ /* remove events */
+ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+- unsigned long flags;
+ struct snd_seq_event_cell *ptr;
+
+ if (snd_BUG_ON(!pool))
+@@ -450,18 +448,18 @@ int snd_seq_pool_done(struct snd_seq_poo
+ schedule_timeout_uninterruptible(1);
+
+ /* release all resources */
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ ptr = pool->ptr;
+ pool->ptr = NULL;
+ pool->free = NULL;
+ pool->total_elements = 0;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+
+ vfree(ptr);
+
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ pool->closing = 0;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+
+ return 0;
+ }
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -128,7 +128,6 @@ static void port_subs_info_init(struct s
+ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+ int port)
+ {
+- unsigned long flags;
+ struct snd_seq_client_port *new_port, *p;
+ int num = -1;
+
+@@ -157,7 +156,7 @@ struct snd_seq_client_port *snd_seq_crea
+
+ num = port >= 0 ? port : 0;
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ list_for_each_entry(p, &client->ports_list_head, list) {
+ if (p->addr.port > num)
+ break;
+@@ -169,7 +168,7 @@ struct snd_seq_client_port *snd_seq_crea
+ client->num_ports++;
+ new_port->addr.port = num; /* store the port number in the port */
+ sprintf(new_port->name, "port-%d", num);
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+ mutex_unlock(&client->ports_mutex);
+
+ return new_port;
+@@ -283,11 +282,10 @@ static int port_delete(struct snd_seq_cl
+ /* delete a port with the given port id */
+ int snd_seq_delete_port(struct snd_seq_client *client, int port)
+ {
+- unsigned long flags;
+ struct snd_seq_client_port *found = NULL, *p;
+
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ list_for_each_entry(p, &client->ports_list_head, list) {
+ if (p->addr.port == port) {
+ /* ok found. delete from the list at first */
+@@ -297,7 +295,7 @@ int snd_seq_delete_port(struct snd_seq_c
+ break;
+ }
+ }
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+ mutex_unlock(&client->ports_mutex);
+ if (found)
+ return port_delete(client, found);
+@@ -308,7 +306,6 @@ int snd_seq_delete_port(struct snd_seq_c
+ /* delete the all ports belonging to the given client */
+ int snd_seq_delete_all_ports(struct snd_seq_client *client)
+ {
+- unsigned long flags;
+ struct list_head deleted_list;
+ struct snd_seq_client_port *port, *tmp;
+
+@@ -316,7 +313,7 @@ int snd_seq_delete_all_ports(struct snd_
+ * clear the port list in the client data.
+ */
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ if (! list_empty(&client->ports_list_head)) {
+ list_add(&deleted_list, &client->ports_list_head);
+ list_del_init(&client->ports_list_head);
+@@ -324,7 +321,7 @@ int snd_seq_delete_all_ports(struct snd_
+ INIT_LIST_HEAD(&deleted_list);
+ }
+ client->num_ports = 0;
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+
+ /* remove each port in deleted_list */
+ list_for_each_entry_safe(port, tmp, &deleted_list, list) {
diff --git a/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch b/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch
new file mode 100644
index 0000000000..1463d8facb
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch
@@ -0,0 +1,141 @@
+From 6740ea6776e97274627e3c261469d1c4ba0a0cb5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 12:10:14 +0200
+Subject: [PATCH] ALSA: seq: Simplify snd_seq_kernel_client_enqueue() helper
+Git-commit: 6740ea6776e97274627e3c261469d1c4ba0a0cb5
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We have two helpers for queuing a sequencer event from the kernel
+client, and both are used only from OSS sequencer layer without any
+hop and atomic set. Let's simplify and unify two helpers into one.
+
+No functional change, just a call pattern change.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/seq_kernel.h | 3 +-
+ sound/core/seq/oss/seq_oss_rw.c | 11 +++-------
+ sound/core/seq/oss/seq_oss_writeq.c | 2 -
+ sound/core/seq/seq_clientmgr.c | 37 ++++++------------------------------
+ sound/core/seq/seq_clientmgr.h | 4 ---
+ 5 files changed, 14 insertions(+), 43 deletions(-)
+
+--- a/include/sound/seq_kernel.h
++++ b/include/sound/seq_kernel.h
+@@ -73,7 +73,8 @@ __printf(3, 4)
+ int snd_seq_create_kernel_client(struct snd_card *card, int client_index,
+ const char *name_fmt, ...);
+ int snd_seq_delete_kernel_client(int client);
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, int atomic, int hop);
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ struct file *file, bool blocking);
+ int snd_seq_kernel_client_dispatch(int client, struct snd_seq_event *ev, int atomic, int hop);
+ int snd_seq_kernel_client_ctl(int client, unsigned int cmd, void *arg);
+
+--- a/sound/core/seq/oss/seq_oss_rw.c
++++ b/sound/core/seq/oss/seq_oss_rw.c
+@@ -180,14 +180,11 @@ insert_queue(struct seq_oss_devinfo *dp,
+ return 0; /* invalid event - no need to insert queue */
+
+ event.time.tick = snd_seq_oss_timer_cur_tick(dp->timer);
+- if (dp->timer->realtime || !dp->timer->running) {
++ if (dp->timer->realtime || !dp->timer->running)
+ snd_seq_oss_dispatch(dp, &event, 0, 0);
+- } else {
+- if (is_nonblock_mode(dp->file_mode))
+- rc = snd_seq_kernel_client_enqueue(dp->cseq, &event, 0, 0);
+- else
+- rc = snd_seq_kernel_client_enqueue_blocking(dp->cseq, &event, opt, 0, 0);
+- }
++ else
++ rc = snd_seq_kernel_client_enqueue(dp->cseq, &event, opt,
++ !is_nonblock_mode(dp->file_mode));
+ return rc;
+ }
+
+--- a/sound/core/seq/oss/seq_oss_writeq.c
++++ b/sound/core/seq/oss/seq_oss_writeq.c
+@@ -116,7 +116,7 @@ snd_seq_oss_writeq_sync(struct seq_oss_w
+ rec->t.code = SEQ_SYNCTIMER;
+ rec->t.time = time;
+ q->sync_event_put = 1;
+- snd_seq_kernel_client_enqueue_blocking(dp->cseq, &ev, NULL, 0, 0);
++ snd_seq_kernel_client_enqueue(dp->cseq, &ev, NULL, true);
+ }
+
+ wait_event_interruptible_timeout(q->sync_sleep, ! q->sync_event_put, HZ);
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2225,12 +2225,13 @@ int snd_seq_delete_kernel_client(int cli
+ }
+ EXPORT_SYMBOL(snd_seq_delete_kernel_client);
+
+-/* skeleton to enqueue event, called from snd_seq_kernel_client_enqueue
+- * and snd_seq_kernel_client_enqueue_blocking
++/*
++ * exported, called by kernel clients to enqueue events (w/o blocking)
++ *
++ * RETURN VALUE: zero if succeed, negative if error
+ */
+-static int kernel_client_enqueue(int client, struct snd_seq_event *ev,
+- struct file *file, int blocking,
+- int atomic, int hop)
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ struct file *file, bool blocking)
+ {
+ struct snd_seq_client *cptr;
+ int result;
+@@ -2250,37 +2251,13 @@ static int kernel_client_enqueue(int cli
+ result = -EPERM;
+ else /* send it */
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+- atomic, hop, NULL);
++ false, 0, NULL);
+
+ snd_seq_client_unlock(cptr);
+ return result;
+ }
+-
+-/*
+- * exported, called by kernel clients to enqueue events (w/o blocking)
+- *
+- * RETURN VALUE: zero if succeed, negative if error
+- */
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event * ev,
+- int atomic, int hop)
+-{
+- return kernel_client_enqueue(client, ev, NULL, 0, atomic, hop);
+-}
+ EXPORT_SYMBOL(snd_seq_kernel_client_enqueue);
+
+-/*
+- * exported, called by kernel clients to enqueue events (with blocking)
+- *
+- * RETURN VALUE: zero if succeed, negative if error
+- */
+-int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event * ev,
+- struct file *file,
+- int atomic, int hop)
+-{
+- return kernel_client_enqueue(client, ev, file, 1, atomic, hop);
+-}
+-EXPORT_SYMBOL(snd_seq_kernel_client_enqueue_blocking);
+-
+ /*
+ * exported, called by kernel clients to dispatch events directly to other
+ * clients, bypassing the queues. Event time-stamp will be updated.
+--- a/sound/core/seq/seq_clientmgr.h
++++ b/sound/core/seq/seq_clientmgr.h
+@@ -93,10 +93,6 @@ struct snd_seq_client *snd_seq_client_us
+ /* dispatch event to client(s) */
+ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop);
+
+-/* exported to other modules */
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, int atomic, int hop);
+-int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event * ev,
+- struct file *file, int atomic, int hop);
+ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table *wait);
+ int snd_seq_client_notify_subscription(int client, int port,
+ struct snd_seq_port_subscribe *info, int evtype);
diff --git a/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch b/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch
new file mode 100644
index 0000000000..1f10ef4c39
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch
@@ -0,0 +1,75 @@
+From a7588c896b05444929ecb3d0115481988720abf6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:56:08 +0100
+Subject: [PATCH] ALSA: timer: Check ack_list emptiness instead of bit flag
+Git-commit: a7588c896b05444929ecb3d0115481988720abf6
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+For checking the pending timer instance that is still left on the
+timer object that is being closed, we set/clear a bit flag
+SNDRV_TIMER_IFLG_CALLBACK around the call of callbacks. This can be
+simplified by replace with the list_empty() call for ti->ack_list.
+This covers the existence more comprehensively and safely.
+
+A gratis bonus is that we can get rid of SNDRV_TIMER_IFLG_CALLBACK bit
+flag definition as well.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/timer.h | 1 -
+ sound/core/timer.c | 10 ++++------
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/include/sound/timer.h b/include/sound/timer.h
+index 7ae226ab6990..bcfee20ea226 100644
+--- a/include/sound/timer.h
++++ b/include/sound/timer.h
+@@ -43,7 +43,6 @@
+ #define SNDRV_TIMER_IFLG_START 0x00000004
+ #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */
+ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */
+-#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */
+ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */
+ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 107d8ebeeb2e..e343de0e4f9e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -366,7 +366,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+ spin_lock_irq(&timer->lock);
+- while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
++ while (!list_empty(&timeri->ack_list)) {
+ spin_unlock_irq(&timer->lock);
+ udelay(10);
+ spin_lock_irq(&timer->lock);
+@@ -731,19 +731,17 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
+- /* remove from ack_list and make empty */
+- list_del_init(&ti->ack_list);
+-
+ ticks = ti->pticks;
+ ti->pticks = 0;
+ resolution = ti->resolution;
+
+- ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+ spin_unlock(&timer->lock);
+ if (ti->callback)
+ ti->callback(ti, resolution, ticks);
+ spin_lock(&timer->lock);
+- ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
++
++ /* remove from ack_list and make empty */
++ list_del_init(&ti->ack_list);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Coding-style-fixes.patch b/patches.drivers/ALSA-timer-Coding-style-fixes.patch
new file mode 100644
index 0000000000..8d5ed3d0f3
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Coding-style-fixes.patch
@@ -0,0 +1,71 @@
+From 5d704b0d3b4855734f029337e516b829c473801c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 17:44:53 +0100
+Subject: [PATCH] ALSA: timer: Coding style fixes
+Git-commit: 5d704b0d3b4855734f029337e516b829c473801c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Avoid old school C style but do plain and clear way.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 0eed4fe0da21..d23efec35660 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1909,7 +1909,10 @@ static int snd_timer_user_start(struct file *file)
+ snd_timer_stop(tu->timeri);
+ tu->timeri->lost = 0;
+ tu->last_resolution = 0;
+- return (err = snd_timer_start(tu->timeri, tu->ticks)) < 0 ? err : 0;
++ err = snd_timer_start(tu->timeri, tu->ticks);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_stop(struct file *file)
+@@ -1920,7 +1923,10 @@ static int snd_timer_user_stop(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
+- return (err = snd_timer_stop(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_stop(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_continue(struct file *file)
+@@ -1935,7 +1941,10 @@ static int snd_timer_user_continue(struct file *file)
+ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+ return snd_timer_user_start(file);
+ tu->timeri->lost = 0;
+- return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_continue(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_pause(struct file *file)
+@@ -1946,7 +1955,10 @@ static int snd_timer_user_pause(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
+- return (err = snd_timer_pause(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_pause(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ enum {
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch b/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch
new file mode 100644
index 0000000000..b0431af7c3
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch
@@ -0,0 +1,148 @@
+From fe1b26c93d430400ac37d820425e2468218ae8b2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 17:02:40 +0100
+Subject: [PATCH] ALSA: timer: Make snd_timer_close() really kill pending actions
+Git-commit: fe1b26c93d430400ac37d820425e2468218ae8b2
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+snd_timer_close() is supposed to close the timer instance and sync
+with the deactivation of pending actions. However, there are still
+some overlooked cases:
+
+- It calls snd_timer_stop() at the beginning, but some other might
+ re-trigger the timer right after that.
+
+- snd_timer_stop() calls del_timer_sync() only when all belonging
+ instances are closed. If multiple instances were assigned to a
+ timer object and one is closed, the timer is still running. Then
+ the pending action assigned to this timer might be left.
+
+Actually either of the above is the likely cause of the reported
+syzkaller UAF.
+
+This patch plug these holes by introducing SNDRV_TIMER_IFLG_DEAD
+flag. This is set at the beginning of snd_timer_close(), and the flag
+is checked at snd_timer_start*() and else, so that no longer new
+action is left after snd_timer_close().
+
+Reported-by: syzbot+d5136d4d3240cbe45a2a@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 45 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 12 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index e343de0e4f9e..bb7e90ab90f8 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -38,6 +38,7 @@
+
+ /* internal flags */
+ #define SNDRV_TIMER_IFLG_PAUSED 0x00010000
++#define SNDRV_TIMER_IFLG_DEAD 0x00020000
+
+ #if IS_ENABLED(CONFIG_SND_HRTIMER)
+ #define DEFAULT_TIMER_LIMIT 4
+@@ -353,15 +354,20 @@ EXPORT_SYMBOL(snd_timer_open);
+ */
+ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ {
+- struct snd_timer *timer = NULL;
++ struct snd_timer *timer = timeri->timer;
+ struct snd_timer_instance *slave, *tmp;
+
++ if (timer) {
++ spin_lock_irq(&timer->lock);
++ timeri->flags |= SNDRV_TIMER_IFLG_DEAD;
++ spin_unlock_irq(&timer->lock);
++ }
++
+ list_del(&timeri->open_list);
+
+ /* force to stop the timer */
+ snd_timer_stop(timeri);
+
+- timer = timeri->timer;
+ if (timer) {
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+@@ -497,6 +503,10 @@ static int snd_timer_start1(struct snd_timer_instance *timeri,
+ return -EINVAL;
+
+ spin_lock_irqsave(&timer->lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD) {
++ result = -EINVAL;
++ goto unlock;
++ }
+ if (timer->card && timer->card->shutdown) {
+ result = -ENODEV;
+ goto unlock;
+@@ -541,11 +551,16 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri,
+ bool start)
+ {
+ unsigned long flags;
++ int err;
+
+ spin_lock_irqsave(&slave_active_lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD) {
++ err = -EINVAL;
++ goto unlock;
++ }
+ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
+- spin_unlock_irqrestore(&slave_active_lock, flags);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
+ if (timeri->master && timeri->timer) {
+@@ -556,8 +571,10 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri,
+ SNDRV_TIMER_EVENT_CONTINUE);
+ spin_unlock(&timeri->timer->lock);
+ }
++ err = 1; /* delayed start */
++ unlock:
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+- return 1; /* delayed start */
++ return err;
+ }
+
+ /* stop/pause a master timer */
+@@ -731,14 +748,16 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
+- ticks = ti->pticks;
+- ti->pticks = 0;
+- resolution = ti->resolution;
++ if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) {
++ ticks = ti->pticks;
++ ti->pticks = 0;
++ resolution = ti->resolution;
+
+- spin_unlock(&timer->lock);
+- if (ti->callback)
+- ti->callback(ti, resolution, ticks);
+- spin_lock(&timer->lock);
++ spin_unlock(&timer->lock);
++ if (ti->callback)
++ ti->callback(ti, resolution, ticks);
++ spin_lock(&timer->lock);
++ }
+
+ /* remove from ack_list and make empty */
+ list_del_init(&ti->ack_list);
+@@ -810,6 +829,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ */
+ list_for_each_entry_safe(ti, tmp, &timer->active_list_head,
+ active_list) {
++ if (ti->flags & SNDRV_TIMER_IFLG_DEAD)
++ continue;
+ if (!(ti->flags & SNDRV_TIMER_IFLG_RUNNING))
+ continue;
+ ti->pticks += ticks_left;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch b/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch
new file mode 100644
index 0000000000..4b25eac9fb
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch
@@ -0,0 +1,70 @@
+From 7bb4a8a2cc9382da720b46988bc976ebccaa49fd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:51:58 +0100
+Subject: [PATCH] ALSA: timer: Make sure to clear pending ack list
+Git-commit: 7bb4a8a2cc9382da720b46988bc976ebccaa49fd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+When a card is under disconnection, we bail out immediately at each
+timer interrupt or tasklet. This might leave some items left in ack
+list. For a better integration of the upcoming change to check
+ack_list emptiness, clear out the whole list upon the emergency exit
+route.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index fdcddfb756b4..107d8ebeeb2e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -747,6 +747,18 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ }
+ }
+
++/* clear pending instances from ack list */
++static void snd_timer_clear_callbacks(struct snd_timer *timer,
++ struct list_head *head)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ while (!list_empty(head))
++ list_del_init(head->next);
++ spin_unlock_irqrestore(&timer->lock, flags);
++}
++
+ /*
+ * timer tasklet
+ *
+@@ -756,8 +768,10 @@ static void snd_timer_tasklet(unsigned long arg)
+ struct snd_timer *timer = (struct snd_timer *) arg;
+ unsigned long flags;
+
+- if (timer->card && timer->card->shutdown)
++ if (timer->card && timer->card->shutdown) {
++ snd_timer_clear_callbacks(timer, &timer->sack_list_head);
+ return;
++ }
+
+ spin_lock_irqsave(&timer->lock, flags);
+ snd_timer_process_callbacks(timer, &timer->sack_list_head);
+@@ -781,8 +795,10 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ if (timer == NULL)
+ return;
+
+- if (timer->card && timer->card->shutdown)
++ if (timer->card && timer->card->shutdown) {
++ snd_timer_clear_callbacks(timer, &timer->ack_list_head);
+ return;
++ }
+
+ spin_lock_irqsave(&timer->lock, flags);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch b/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch
new file mode 100644
index 0000000000..e777a63511
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch
@@ -0,0 +1,80 @@
+From df55531b8b0eea9d2473f5697ae4f38d0df6bec7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 12:25:32 +0200
+Subject: [PATCH] ALSA: timer: Revert active callback sync check at close
+Git-commit: df55531b8b0eea9d2473f5697ae4f38d0df6bec7
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This is essentially a revert of the commit a7588c896b05 ("ALSA: timer:
+Check ack_list emptiness instead of bit flag"). The intended change
+by the commit turns out to be insufficient, as snd_timer_close*()
+always calls snd_timer_stop() that deletes the ack_list beforehand.
+
+In theory, we can change the behavior of snd_timer_stop() to sync the
+pending ack_list, but this will become a deadlock for the callback
+like sequencer that calls again snd_timer_stop() from itself. So,
+reverting the change is a more straightforward solution.
+
+Fixes: a7588c896b05 ("ALSA: timer: Check ack_list emptiness instead of bit flag")
+Reported-by: syzbot+58813d77154713f4de15@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/timer.h | 1 +
+ sound/core/timer.c | 11 ++++++-----
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/include/sound/timer.h b/include/sound/timer.h
+index bcfee20ea226..7ae226ab6990 100644
+--- a/include/sound/timer.h
++++ b/include/sound/timer.h
+@@ -43,6 +43,7 @@
+ #define SNDRV_TIMER_IFLG_START 0x00000004
+ #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */
+ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */
++#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */
+ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */
+ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index bb7e90ab90f8..df52d2960179 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -372,7 +372,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+ spin_lock_irq(&timer->lock);
+- while (!list_empty(&timeri->ack_list)) {
++ while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
+ spin_unlock_irq(&timer->lock);
+ udelay(10);
+ spin_lock_irq(&timer->lock);
+@@ -748,19 +748,20 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
++ /* remove from ack_list and make empty */
++ list_del_init(&ti->ack_list);
++
+ if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) {
+ ticks = ti->pticks;
+ ti->pticks = 0;
+ resolution = ti->resolution;
+-
++ ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+ spin_unlock(&timer->lock);
+ if (ti->callback)
+ ti->callback(ti, resolution, ticks);
+ spin_lock(&timer->lock);
++ ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+ }
+-
+- /* remove from ack_list and make empty */
+- list_del_init(&ti->ack_list);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch b/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch
new file mode 100644
index 0000000000..cb39b66622
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch
@@ -0,0 +1,129 @@
+From 41672c0c24a62699d20aab53b98d843b16483053 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 17:11:10 +0100
+Subject: [PATCH] ALSA: timer: Simplify error path in snd_timer_open()
+Git-commit: 41672c0c24a62699d20aab53b98d843b16483053
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Just a minor refactoring to use the standard goto for error paths in
+snd_timer_open() instead of open code. The first mutex_lock() is
+moved to the beginning of the function to make the code clearer.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 39 ++++++++++++++++++++-------------------
+ 1 file changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index df52d2960179..0eed4fe0da21 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -255,19 +255,20 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ struct snd_timer_instance *timeri = NULL;
+ int err;
+
++ mutex_lock(&register_mutex);
+ if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
+ /* open a slave instance */
+ if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE ||
+ tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) {
+ pr_debug("ALSA: timer: invalid slave class %i\n",
+ tid->dev_sclass);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock;
+ }
+- mutex_lock(&register_mutex);
+ timeri = snd_timer_instance_new(owner, NULL);
+ if (!timeri) {
+- mutex_unlock(&register_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ timeri->slave_class = tid->dev_sclass;
+ timeri->slave_id = tid->device;
+@@ -278,13 +279,10 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ snd_timer_close_locked(timeri);
+ timeri = NULL;
+ }
+- mutex_unlock(&register_mutex);
+- *ti = timeri;
+- return err;
++ goto unlock;
+ }
+
+ /* open a master instance */
+- mutex_lock(&register_mutex);
+ timer = snd_timer_find(tid);
+ #ifdef CONFIG_MODULES
+ if (!timer) {
+@@ -295,25 +293,26 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ }
+ #endif
+ if (!timer) {
+- mutex_unlock(&register_mutex);
+- return -ENODEV;
++ err = -ENODEV;
++ goto unlock;
+ }
+ if (!list_empty(&timer->open_list_head)) {
+ timeri = list_entry(timer->open_list_head.next,
+ struct snd_timer_instance, open_list);
+ if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+- mutex_unlock(&register_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ timeri = NULL;
++ goto unlock;
+ }
+ }
+ if (timer->num_instances >= timer->max_instances) {
+- mutex_unlock(&register_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri = snd_timer_instance_new(owner, timer);
+ if (!timeri) {
+- mutex_unlock(&register_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ /* take a card refcount for safe disconnection */
+ if (timer->card)
+@@ -322,16 +321,16 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ timeri->slave_id = slave_id;
+
+ if (list_empty(&timer->open_list_head) && timer->hw.open) {
+- int err = timer->hw.open(timer);
++ err = timer->hw.open(timer);
+ if (err) {
+ kfree(timeri->owner);
+ kfree(timeri);
++ timeri = NULL;
+
+ if (timer->card)
+ put_device(&timer->card->card_dev);
+ module_put(timer->module);
+- mutex_unlock(&register_mutex);
+- return err;
++ goto unlock;
+ }
+ }
+
+@@ -342,6 +341,8 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ snd_timer_close_locked(timeri);
+ timeri = NULL;
+ }
++
++ unlock:
+ mutex_unlock(&register_mutex);
+ *ti = timeri;
+ return err;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch b/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch
new file mode 100644
index 0000000000..4520626121
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch
@@ -0,0 +1,125 @@
+From 8748b850beccdbc87aa8776d63abd6b5628720c8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:42:51 +0100
+Subject: [PATCH] ALSA: timer: Unify timer callback process code
+Git-commit: 8748b850beccdbc87aa8776d63abd6b5628720c8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The timer core has two almost identical code for processing callbacks:
+once in snd_timer_interrupt() for fast callbacks and another in
+snd_timer_tasklet() for delayed callbacks. Let's unify them.
+
+In the new version, the resolution is read from ti->resolution at each
+call, and this must be fine; ti->resolution is set in the preparation
+step in snd_timer_interrupt().
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 62 +++++++++++++++++++++++-------------------------------
+ 1 file changed, 26 insertions(+), 36 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 61a0cec6e1f6..fdcddfb756b4 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -720,29 +720,19 @@ static void snd_timer_reschedule(struct snd_timer * timer, unsigned long ticks_l
+ timer->sticks = ticks;
+ }
+
+-/*
+- * timer tasklet
+- *
+- */
+-static void snd_timer_tasklet(unsigned long arg)
++/* call callbacks in timer ack list */
++static void snd_timer_process_callbacks(struct snd_timer *timer,
++ struct list_head *head)
+ {
+- struct snd_timer *timer = (struct snd_timer *) arg;
+ struct snd_timer_instance *ti;
+- struct list_head *p;
+ unsigned long resolution, ticks;
+- unsigned long flags;
+
+- if (timer->card && timer->card->shutdown)
+- return;
+-
+- spin_lock_irqsave(&timer->lock, flags);
+- /* now process all callbacks */
+- while (!list_empty(&timer->sack_list_head)) {
+- p = timer->sack_list_head.next; /* get first item */
+- ti = list_entry(p, struct snd_timer_instance, ack_list);
++ while (!list_empty(head)) {
++ ti = list_first_entry(head, struct snd_timer_instance,
++ ack_list);
+
+ /* remove from ack_list and make empty */
+- list_del_init(p);
++ list_del_init(&ti->ack_list);
+
+ ticks = ti->pticks;
+ ti->pticks = 0;
+@@ -755,6 +745,22 @@ static void snd_timer_tasklet(unsigned long arg)
+ spin_lock(&timer->lock);
+ ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+ }
++}
++
++/*
++ * timer tasklet
++ *
++ */
++static void snd_timer_tasklet(unsigned long arg)
++{
++ struct snd_timer *timer = (struct snd_timer *) arg;
++ unsigned long flags;
++
++ if (timer->card && timer->card->shutdown)
++ return;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ snd_timer_process_callbacks(timer, &timer->sack_list_head);
+ spin_unlock_irqrestore(&timer->lock, flags);
+ }
+
+@@ -767,8 +773,8 @@ static void snd_timer_tasklet(unsigned long arg)
+ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ {
+ struct snd_timer_instance *ti, *ts, *tmp;
+- unsigned long resolution, ticks;
+- struct list_head *p, *ack_list_head;
++ unsigned long resolution;
++ struct list_head *ack_list_head;
+ unsigned long flags;
+ int use_tasklet = 0;
+
+@@ -839,23 +845,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ }
+
+ /* now process all fast callbacks */
+- while (!list_empty(&timer->ack_list_head)) {
+- p = timer->ack_list_head.next; /* get first item */
+- ti = list_entry(p, struct snd_timer_instance, ack_list);
+-
+- /* remove from ack_list and make empty */
+- list_del_init(p);
+-
+- ticks = ti->pticks;
+- ti->pticks = 0;
+-
+- ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+- spin_unlock(&timer->lock);
+- if (ti->callback)
+- ti->callback(ti, resolution, ticks);
+- spin_lock(&timer->lock);
+- ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+- }
++ snd_timer_process_callbacks(timer, &timer->ack_list_head);
+
+ /* do we have any slow callbacks? */
+ use_tasklet = !list_empty(&timer->sack_list_head);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch b/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..fc07a4c050
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch
@@ -0,0 +1,43 @@
+From cb5173594d50c72b7bfa14113dfc5084b4d2f726 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Sat, 27 Apr 2019 01:06:46 -0500
+Subject: [PATCH] ALSA: usb-audio: Fix a memory leak bug
+Git-commit: cb5173594d50c72b7bfa14113dfc5084b4d2f726
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In parse_audio_selector_unit(), the string array 'namelist' is allocated
+through kmalloc_array(), and each string pointer in this array, i.e.,
+'namelist[]', is allocated through kmalloc() in the following for loop.
+Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
+an error occurs during the creation process, the string array 'namelist',
+including all string pointers in the array 'namelist[]', should be freed,
+before the error code ENOMEM is returned. However, the current code does
+not free 'namelist[]', resulting in memory leaks.
+
+To fix the above issue, free all string pointers 'namelist[]' in a loop.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index c095d9751924..e003b5e7b01a 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
+ if (! kctl) {
+ usb_audio_err(state->chip, "cannot malloc kcontrol\n");
++ for (i = 0; i < desc->bNrInPins; i++)
++ kfree(namelist[i]);
+ kfree(namelist);
+ kfree(cval);
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch b/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch
new file mode 100644
index 0000000000..4c98cb5ba8
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch
@@ -0,0 +1,37 @@
+From 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: [PATCH] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
+Git-commit: 328e9f6973be2ee67862cb17bf6c0c5c5918cd72
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error. Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 73d7dff425c1..c095d9751924 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3490,7 +3490,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ if (err < 0)
+ goto _error;
+
+- snd_usb_mixer_apply_create_quirk(mixer);
++ err = snd_usb_mixer_apply_create_quirk(mixer);
++ if (err < 0)
++ goto _error;
+
+ err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ if (err < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch b/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch
new file mode 100644
index 0000000000..314b39fb2f
--- /dev/null
+++ b/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch
@@ -0,0 +1,44 @@
+From cbb88db76a1536e02e93e5bd37ebbfbb6c4043a9 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Mon, 29 Apr 2019 12:45:40 -0500
+Subject: [PATCH] ALSA: usx2y: fix a double free bug
+Git-commit: cbb88db76a1536e02e93e5bd37ebbfbb6c4043a9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In usX2Y_In04_init(), a new urb is firstly created through usb_alloc_urb()
+and saved to 'usX2Y->In04urb'. Then, a buffer is allocated through
+kmalloc() and saved to 'usX2Y->In04Buf'. If the allocation of the buffer
+fails, the error code ENOMEM is returned after usb_free_urb(), which frees
+the created urb. However, the urb is actually freed at card->private_free
+callback, i.e., snd_usX2Y_card_private_free(). So the free operation here
+leads to a double free bug.
+
+To fix the above issue, simply remove usb_free_urb().
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/usx2y/usbusx2y.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
+index 9f7bbed2c0f0..e8687b3bd3c8 100644
+--- a/sound/usb/usx2y/usbusx2y.c
++++ b/sound/usb/usx2y/usbusx2y.c
+@@ -293,10 +293,8 @@ int usX2Y_In04_init(struct usX2Ydev *usX2Y)
+ if (! (usX2Y->In04urb = usb_alloc_urb(0, GFP_KERNEL)))
+ return -ENOMEM;
+
+- if (! (usX2Y->In04Buf = kmalloc(21, GFP_KERNEL))) {
+- usb_free_urb(usX2Y->In04urb);
++ if (! (usX2Y->In04Buf = kmalloc(21, GFP_KERNEL)))
+ return -ENOMEM;
+- }
+
+ init_waitqueue_head(&usX2Y->In04WaitQueue);
+ usb_fill_int_urb(usX2Y->In04urb, usX2Y->dev, usb_rcvintpipe(usX2Y->dev, 0x4),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch b/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch
new file mode 100644
index 0000000000..c16be9fb1c
--- /dev/null
+++ b/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch
@@ -0,0 +1,66 @@
+From 0efa3334d65b7f421ba12382dfa58f6ff5bf83c4 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <zwisler@chromium.org>
+Date: Mon, 29 Apr 2019 12:25:17 -0600
+Subject: [PATCH] ASoC: Intel: avoid Oops if DMA setup fails
+Git-commit: 0efa3334d65b7f421ba12382dfa58f6ff5bf83c4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently in sst_dsp_new() if we get an error return from sst_dma_new()
+we just print an error message and then still complete the function
+successfully. This means that we are trying to run without sst->dma
+properly set up, which will result in NULL pointer dereference when
+sst->dma is later used. This was happening for me in
+Sst_dsp_dma_get_channel():
+
+ struct sst_dma *dma = dsp->dma;
+ ...
+ dma->ch = dma_request_channel(mask, dma_chan_filter, dsp);
+
+This resulted in:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
+ IP: sst_dsp_dma_get_channel+0x4f/0x125 [snd_soc_sst_firmware]
+
+Fix this by adding proper error handling for the case where we fail to
+set up DMA.
+
+This change only affects Haswell and Broadwell systems. Baytrail
+systems explicilty opt-out of DMA via sst->pdata->resindex_dma_base
+being set to -1.
+
+Signed-off-by: Ross Zwisler <zwisler@google.com>
+Cc: stable@vger.kernel.org
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/intel/common/sst-firmware.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/common/sst-firmware.c b/sound/soc/intel/common/sst-firmware.c
+index 1e067504b604..f830e59f93ea 100644
+--- a/sound/soc/intel/common/sst-firmware.c
++++ b/sound/soc/intel/common/sst-firmware.c
+@@ -1251,11 +1251,15 @@ struct sst_dsp *sst_dsp_new(struct device *dev,
+ goto irq_err;
+
+ err = sst_dma_new(sst);
+- if (err)
+- dev_warn(dev, "sst_dma_new failed %d\n", err);
++ if (err) {
++ dev_err(dev, "sst_dma_new failed %d\n", err);
++ goto dma_err;
++ }
+
+ return sst;
+
++dma_err:
++ free_irq(sst->irq, sst);
+ irq_err:
+ if (sst->ops->free)
+ sst->ops->free(sst);
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch b/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch
new file mode 100644
index 0000000000..7a5d6c171c
--- /dev/null
+++ b/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch
@@ -0,0 +1,135 @@
+From a46eb523220e242affb9a6bc9bb8efc05f4f7459 Mon Sep 17 00:00:00 2001
+From: Curtis Malainey <cujomalainey@chromium.org>
+Date: Fri, 3 May 2019 12:32:14 -0700
+Subject: [PATCH] ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
+Git-commit: a46eb523220e242affb9a6bc9bb8efc05f4f7459
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The current algorithm allows 3 types of transfers, 16bit, 32bit and
+burst. According to Realtek, 16bit transfers have a special restriction
+in that it is restricted to the memory region of
+0x18020000 ~ 0x18021000. This region is the memory location of the I2C
+registers. The current algorithm does not uphold this restriction and
+therefore fails to complete writes.
+
+Since this has been broken for some time it likely no one is using it.
+Better to simply disable the 16 bit writes. This will allow users to
+properly load firmware over SPI without data corruption.
+
+Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Ben Zhang <benzh@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5677-spi.c | 35 ++++++++++++++++-------------------
+ 1 file changed, 16 insertions(+), 19 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c
+index 167a02773a0b..84b6bd8b50e1 100644
+--- a/sound/soc/codecs/rt5677-spi.c
++++ b/sound/soc/codecs/rt5677-spi.c
+@@ -58,13 +58,15 @@ static DEFINE_MUTEX(spi_mutex);
+ * RT5677_SPI_READ/WRITE_32: Transfer 4 bytes
+ * RT5677_SPI_READ/WRITE_BURST: Transfer any multiples of 8 bytes
+ *
+- * For example, reading 260 bytes at 0x60030002 uses the following commands:
+- * 0x60030002 RT5677_SPI_READ_16 2 bytes
++ * Note:
++ * 16 Bit writes and reads are restricted to the address range
++ * 0x18020000 ~ 0x18021000
++ *
++ * For example, reading 256 bytes at 0x60030004 uses the following commands:
+ * 0x60030004 RT5677_SPI_READ_32 4 bytes
+ * 0x60030008 RT5677_SPI_READ_BURST 240 bytes
+ * 0x600300F8 RT5677_SPI_READ_BURST 8 bytes
+ * 0x60030100 RT5677_SPI_READ_32 4 bytes
+- * 0x60030104 RT5677_SPI_READ_16 2 bytes
+ *
+ * Input:
+ * @read: true for read commands; false for write commands
+@@ -79,15 +81,13 @@ static u8 rt5677_spi_select_cmd(bool read, u32 align, u32 remain, u32 *len)
+ {
+ u8 cmd;
+
+- if (align == 2 || align == 6 || remain == 2) {
+- cmd = RT5677_SPI_READ_16;
+- *len = 2;
+- } else if (align == 4 || remain <= 6) {
++ if (align == 4 || remain <= 4) {
+ cmd = RT5677_SPI_READ_32;
+ *len = 4;
+ } else {
+ cmd = RT5677_SPI_READ_BURST;
+- *len = min_t(u32, remain & ~7, RT5677_SPI_BURST_LEN);
++ *len = (((remain - 1) >> 3) + 1) << 3;
++ *len = min_t(u32, *len, RT5677_SPI_BURST_LEN);
+ }
+ return read ? cmd : cmd + 1;
+ }
+@@ -108,7 +108,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen)
+ }
+ }
+
+-/* Read DSP address space using SPI. addr and len have to be 2-byte aligned. */
++/* Read DSP address space using SPI. addr and len have to be 4-byte aligned. */
+ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ {
+ u32 offset;
+@@ -124,7 +124,7 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if ((addr & 1) || (len & 1)) {
++ if ((addr & 3) || (len & 3)) {
+ dev_err(&g_spi->dev, "Bad read align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+@@ -159,13 +159,13 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ }
+ EXPORT_SYMBOL_GPL(rt5677_spi_read);
+
+-/* Write DSP address space using SPI. addr has to be 2-byte aligned.
+- * If len is not 2-byte aligned, an extra byte of zero is written at the end
++/* Write DSP address space using SPI. addr has to be 4-byte aligned.
++ * If len is not 4-byte aligned, then extra zeros are written at the end
+ * as padding.
+ */
+ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ {
+- u32 offset, len_with_pad = len;
++ u32 offset;
+ int status = 0;
+ struct spi_transfer t;
+ struct spi_message m;
+@@ -178,22 +178,19 @@ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if (addr & 1) {
++ if (addr & 3) {
+ dev_err(&g_spi->dev, "Bad write align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+
+- if (len & 1)
+- len_with_pad = len + 1;
+-
+ memset(&t, 0, sizeof(t));
+ t.tx_buf = buf;
+ t.speed_hz = RT5677_SPI_FREQ;
+ spi_message_init_with_transfers(&m, &t, 1);
+
+- for (offset = 0; offset < len_with_pad;) {
++ for (offset = 0; offset < len;) {
+ spi_cmd = rt5677_spi_select_cmd(false, (addr + offset) & 7,
+- len_with_pad - offset, &t.len);
++ len - offset, &t.len);
+
+ /* Construct SPI message header */
+ buf[0] = spi_cmd;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch b/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch
new file mode 100644
index 0000000000..ce8a28c0b2
--- /dev/null
+++ b/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch
@@ -0,0 +1,39 @@
+From f0f2338a9cfaf71db895fa989ea7234e8a9b471d Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Wed, 20 Mar 2019 22:41:56 +0100
+Subject: [PATCH] ASoC: cs4270: Set auto-increment bit for register writes
+Git-commit: f0f2338a9cfaf71db895fa989ea7234e8a9b471d
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The CS4270 does not by default increment the register address on
+consecutive writes. During normal operation it doesn't matter as all
+register accesses are done individually. At resume time after suspend,
+however, the regcache code gathers the biggest possible block of
+registers to sync and sends them one on one go.
+
+To fix this, set the INCR bit in all cases.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/cs4270.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index 33d74f163bd7..793a14d58667 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
+ .reg_defaults = cs4270_reg_defaults,
+ .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults),
+ .cache_type = REGCACHE_RBTREE,
++ .write_flag_mask = CS4270_I2C_INCR,
+
+ .readable_reg = cs4270_reg_is_readable,
+ .volatile_reg = cs4270_reg_is_volatile,
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-fix-valid-stream-condition.patch b/patches.drivers/ASoC-fix-valid-stream-condition.patch
new file mode 100644
index 0000000000..9894d2938c
--- /dev/null
+++ b/patches.drivers/ASoC-fix-valid-stream-condition.patch
@@ -0,0 +1,40 @@
+From 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: [PATCH] ASoC: fix valid stream condition
+Git-commit: 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index d21247546f7f..57088bd69e5d 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -43,8 +43,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ else
+ codec_stream = &dai->driver->capture;
+
+- /* If the codec specifies any rate at all, it supports the stream. */
+- return codec_stream->rates;
++ /* If the codec specifies any channels at all, it supports the stream */
++ return codec_stream->channels_min;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch b/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch
new file mode 100644
index 0000000000..7cb42d7524
--- /dev/null
+++ b/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch
@@ -0,0 +1,32 @@
+From 903c220b1ece12f17c868e43f2243b8f81ff2d4c Mon Sep 17 00:00:00 2001
+From: "S.j. Wang" <shengjiu.wang@nxp.com>
+Date: Sun, 28 Apr 2019 02:24:27 +0000
+Subject: [PATCH] ASoC: fsl_esai: Fix missing break in switch statement
+Git-commit: 903c220b1ece12f17c868e43f2243b8f81ff2d4c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+case ESAI_HCKT_EXTAL and case ESAI_HCKR_EXTAL should be
+independent of each other, so replace fall-through with break.
+
+Fixes: 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/fsl/fsl_esai.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -249,6 +249,7 @@ static int fsl_esai_set_dai_sysclk(struc
+ break;
+ case ESAI_HCKT_EXTAL:
+ ecr |= ESAI_ECR_ETI;
++ break;
+ case ESAI_HCKR_EXTAL:
+ ecr |= ESAI_ECR_ERI;
+ break;
diff --git a/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch b/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch
new file mode 100644
index 0000000000..8980b2d8bb
--- /dev/null
+++ b/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch
@@ -0,0 +1,175 @@
+From 2e95f984aae4cf0608d0ba2189c756f2bd50b44a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 28 Feb 2019 15:30:34 +0000
+Subject: [PATCH] ASoC: hdmi-codec: fix S/PDIF DAI
+Git-commit: 2e95f984aae4cf0608d0ba2189c756f2bd50b44a
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+When using the S/PDIF DAI, there is no requirement to call
+snd_soc_dai_set_fmt() as there is no DAI format definition that defines
+S/PDIF. In any case, S/PDIF does not have separate clocks, this is
+embedded into the data stream.
+
+Consequently, when attempting to use TDA998x in S/PDIF mode, the attempt
+to configure TDA998x via the hw_params callback fails as the
+hdmi_codec_daifmt is left initialised to zero.
+
+Since the S/PDIF DAI will only be used by S/PDIF, prepare the
+hdmi_codec_daifmt structure for this format.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/hdmi-codec.c | 122 +++++++++++++++++++++---------------------
+ 1 file changed, 61 insertions(+), 61 deletions(-)
+
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -549,73 +549,71 @@ static int hdmi_codec_set_fmt(struct snd
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
+ struct hdmi_codec_daifmt cf = { 0 };
+- int ret = 0;
+
+ dev_dbg(dai->dev, "%s()\n", __func__);
+
+- if (dai->id == DAI_ID_SPDIF) {
+- cf.fmt = HDMI_SPDIF;
+- } else {
+- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+- case SND_SOC_DAIFMT_CBM_CFM:
+- cf.bit_clk_master = 1;
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFM:
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBM_CFS:
+- cf.bit_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFS:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+- case SND_SOC_DAIFMT_NB_NF:
+- break;
+- case SND_SOC_DAIFMT_NB_IF:
+- cf.frame_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_NF:
+- cf.bit_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_IF:
+- cf.frame_clk_inv = 1;
+- cf.bit_clk_inv = 1;
+- break;
+- }
+-
+- switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+- case SND_SOC_DAIFMT_I2S:
+- cf.fmt = HDMI_I2S;
+- break;
+- case SND_SOC_DAIFMT_DSP_A:
+- cf.fmt = HDMI_DSP_A;
+- break;
+- case SND_SOC_DAIFMT_DSP_B:
+- cf.fmt = HDMI_DSP_B;
+- break;
+- case SND_SOC_DAIFMT_RIGHT_J:
+- cf.fmt = HDMI_RIGHT_J;
+- break;
+- case SND_SOC_DAIFMT_LEFT_J:
+- cf.fmt = HDMI_LEFT_J;
+- break;
+- case SND_SOC_DAIFMT_AC97:
+- cf.fmt = HDMI_AC97;
+- break;
+- default:
+- dev_err(dai->dev, "Invalid DAI interface format\n");
+- return -EINVAL;
+- }
++ if (dai->id == DAI_ID_SPDIF)
++ return 0;
++
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBM_CFM:
++ cf.bit_clk_master = 1;
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFM:
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBM_CFS:
++ cf.bit_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFS:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
++ case SND_SOC_DAIFMT_NB_NF:
++ break;
++ case SND_SOC_DAIFMT_NB_IF:
++ cf.frame_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_NF:
++ cf.bit_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_IF:
++ cf.frame_clk_inv = 1;
++ cf.bit_clk_inv = 1;
++ break;
++ }
++
++ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++ case SND_SOC_DAIFMT_I2S:
++ cf.fmt = HDMI_I2S;
++ break;
++ case SND_SOC_DAIFMT_DSP_A:
++ cf.fmt = HDMI_DSP_A;
++ break;
++ case SND_SOC_DAIFMT_DSP_B:
++ cf.fmt = HDMI_DSP_B;
++ break;
++ case SND_SOC_DAIFMT_RIGHT_J:
++ cf.fmt = HDMI_RIGHT_J;
++ break;
++ case SND_SOC_DAIFMT_LEFT_J:
++ cf.fmt = HDMI_LEFT_J;
++ break;
++ case SND_SOC_DAIFMT_AC97:
++ cf.fmt = HDMI_AC97;
++ break;
++ default:
++ dev_err(dai->dev, "Invalid DAI interface format\n");
++ return -EINVAL;
+ }
+
+ hcp->daifmt[dai->id] = cf;
+
+- return ret;
++ return 0;
+ }
+
+ static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
+@@ -771,8 +769,10 @@ static int hdmi_codec_probe(struct platf
+ i++;
+ }
+
+- if (hcd->spdif)
++ if (hcd->spdif) {
+ hcp->daidrv[i] = hdmi_spdif_dai;
++ hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
++ }
+
+ ret = snd_soc_register_codec(dev, &hdmi_codec, hcp->daidrv,
+ dai_count);
diff --git a/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch b/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch
new file mode 100644
index 0000000000..96463a8eb6
--- /dev/null
+++ b/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch
@@ -0,0 +1,57 @@
+From ecb2795c08bc825ebd604997e5be440b060c5b18 Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Wed, 1 May 2019 15:29:38 +0100
+Subject: [PATCH] ASoC: max98090: Fix restore of DAPM Muxes
+Git-commit: ecb2795c08bc825ebd604997e5be440b060c5b18
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The max98090 driver defines 3 DAPM muxes; one for the right line output
+(LINMOD Mux), one for the left headphone mixer source (MIXHPLSEL Mux)
+and one for the right headphone mixer source (MIXHPRSEL Mux). The same
+bit is used for the mux as well as the DAPM enable, and although the mux
+can be correctly configured, after playback has completed, the mux will
+be reset during the disable phase. This is preventing the state of these
+muxes from being saved and restored correctly on system reboot. Fix this
+by marking these muxes as SND_SOC_NOPM.
+
+Note this has been verified this on the Tegra124 Nyan Big which features
+the MAX98090 codec.
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/max98090.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 30c242c38d99..7619ea31ab50 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1194,14 +1194,14 @@ static const struct snd_soc_dapm_widget max98090_dapm_widgets[] = {
+ &max98090_right_rcv_mixer_controls[0],
+ ARRAY_SIZE(max98090_right_rcv_mixer_controls)),
+
+- SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER,
+- M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux),
++ SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_linmod_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhplsel_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhprsel_mux),
+
+ SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE,
+ M98090_HPLEN_SHIFT, 0, NULL, 0),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch b/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
new file mode 100644
index 0000000000..a990c633ed
--- /dev/null
+++ b/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
@@ -0,0 +1,39 @@
+From 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Wed, 13 Mar 2019 16:23:44 +0800
+Subject: [PATCH] ASoC: nau8810: fix the issue of widget with prefixed name
+Git-commit: 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The driver changes the stream name of DAC and ADC to avoid the issue of
+widget with prefixed name. When the machine adds prefixed name for codec,
+the stream name of DAI may not find the widgets.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/nau8810.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
+index bfd74b86c9d2..645aa0794123 100644
+--- a/sound/soc/codecs/nau8810.c
++++ b/sound/soc/codecs/nau8810.c
+@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
+ SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
+ NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
+ ARRAY_SIZE(nau8810_mono_mixer_controls)),
+- SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
++ SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
+ NAU8810_DAC_EN_SFT, 0),
+- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
++ SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
+ NAU8810_ADC_EN_SFT, 0),
+ SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
+ NAU8810_NSPK_EN_SFT, 0, NULL, 0),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch b/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
new file mode 100644
index 0000000000..cdcf1c8efa
--- /dev/null
+++ b/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
@@ -0,0 +1,110 @@
+From 844a4a362dbec166b44d6b9b3dd45b08cb273703 Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Mon, 11 Mar 2019 09:36:45 +0800
+Subject: [PATCH] ASoC: nau8824: fix the issue of the widget with prefix name
+Git-commit: 844a4a362dbec166b44d6b9b3dd45b08cb273703
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The driver has two issues when machine add prefix name for codec.
+(1)The stream name of DAI can't find the AIF widgets.
+(2)The drivr can enable/disalbe the MICBIAS and SAR widgets.
+
+The patch will fix these issues caused by prefixed name added.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/nau8824.c | 46 ++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 87ed3dc496dc..5ab05e75edea 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+ SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+ NAU8824_ADCR_EN_SFT, 0),
+
+- SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+- SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+ NAU8824_DACL_EN_SFT, 0),
+@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
+ }
+ }
+
++static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_disable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_disable_pin(dapm, pin);
++ }
++}
++
++static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_force_enable_pin(dapm, pin);
++ }
++}
++
+ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ {
+ struct snd_soc_dapm_context *dapm = nau8824->dapm;
+@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ /* Clear all interruption status */
+ nau8824_int_status_clear_all(regmap);
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+
+ /* Enable the insertion interruption, disable the ejection
+@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ struct regmap *regmap = nau8824->regmap;
+ int adc_value, event = 0, event_mask = 0;
+
+- snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+- snd_soc_dapm_force_enable_pin(dapm, "SAR");
++ nau8824_dapm_enable_pin(nau8824, "MICBIAS");
++ nau8824_dapm_enable_pin(nau8824, "SAR");
+ snd_soc_dapm_sync(dapm);
+
+ msleep(100);
+@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ if (adc_value < HEADSET_SARADC_THD) {
+ event |= SND_JACK_HEADPHONE;
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+ } else {
+ event |= SND_JACK_HEADSET;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch b/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch
new file mode 100644
index 0000000000..4689137bd0
--- /dev/null
+++ b/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch
@@ -0,0 +1,49 @@
+From 2b13bee3884926cba22061efa75bd315e871de24 Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Tue, 12 Mar 2019 18:40:06 +0100
+Subject: [PATCH] ASoC: samsung: odroid: Fix clock configuration for 44100 sample rate
+Git-commit: 2b13bee3884926cba22061efa75bd315e871de24
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+After commit fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate
+handling") the audio root clock frequency is configured improperly for
+44100 sample rate. Due to clock rate rounding it's 20070401 Hz instead
+of 22579000 Hz. This results in a too low value of the PSR clock divider
+in the CPU DAI driver and too fast actual sample rate for fs=44100. E.g.
+1 kHz tone has actual 1780 Hz frequency (1 kHz * 20070401/22579000 * 2).
+
+Fix this by increasing the correction passed to clk_set_rate() to take
+into account inaccuracy of the EPLL frequency properly.
+
+Fixes: fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate handling")
+Reported-by: JaeChul Lee <jcsing.lee@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/samsung/odroid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index 694512f980fd..1dc54c4206f0 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -91,11 +91,11 @@ static int odroid_card_be_hw_params(struct snd_pcm_substream *substream,
+ return ret;
+
+ /*
+- * We add 1 to the rclk_freq value in order to avoid too low clock
++ * We add 2 to the rclk_freq value in order to avoid too low clock
+ * frequency values due to the EPLL output frequency not being exact
+ * multiple of the audio sampling rate.
+ */
+- rclk_freq = params_rate(params) * rfs + 1;
++ rclk_freq = params_rate(params) * rfs + 2;
+
+ ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
+ if (ret < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch b/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch
new file mode 100644
index 0000000000..091c8a4aae
--- /dev/null
+++ b/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch
@@ -0,0 +1,64 @@
+From 570f18b6a8d1f0e60e8caf30e66161b6438dcc91 Mon Sep 17 00:00:00 2001
+From: Rander Wang <rander.wang@linux.intel.com>
+Date: Fri, 8 Mar 2019 16:38:57 +0800
+Subject: [PATCH] ASoC:soc-pcm:fix a codec fixup issue in TDM case
+Git-commit: 570f18b6a8d1f0e60e8caf30e66161b6438dcc91
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+On HDaudio platforms, if playback is started when capture is working,
+there is no audible output.
+
+This can be root-caused to the use of the rx|tx_mask to store an HDaudio
+stream tag.
+
+If capture is stared before playback, rx_mask would be non-zero on HDaudio
+platform, then the channel number of playback, which is in the same codec
+dai with the capture, would be changed by soc_pcm_codec_params_fixup based
+on the tx_mask at first, then overwritten by this function based on rx_mask
+at last.
+
+According to the author of tx|rx_mask, tx_mask is for playback and rx_mask
+is for capture. And stream direction is checked at all other references of
+tx|rx_mask in ASoC, so here should be an error. This patch checks stream
+direction for tx|rx_mask for fixup function.
+
+This issue would affect not only HDaudio+ASoC, but also I2S codecs if the
+channel number based on rx_mask is not equal to the one for tx_mask. It could
+be rarely reproduecd because most drivers in kernel set the same channel number
+to tx|rx_mask or rx_mask is zero.
+
+Tested on all platforms using stream_tag & HDaudio and intel I2S platforms.
+
+Signed-off-by: Rander Wang <rander.wang@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index a5b40e82dea4..e70555a4ea06 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -954,10 +954,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ codec_params = *params;
+
+ /* fixup params based on TDM slot masks */
+- if (codec_dai->tx_mask)
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++ codec_dai->tx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->tx_mask);
+- if (codec_dai->rx_mask)
++
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
++ codec_dai->rx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->rx_mask);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch b/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch
new file mode 100644
index 0000000000..0d36cb72b5
--- /dev/null
+++ b/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch
@@ -0,0 +1,35 @@
+From c63adb28f6d913310430f14c69f0a2ea55eed0cc Mon Sep 17 00:00:00 2001
+From: Annaliese McDermond <nh6z@nh6z.net>
+Date: Sat, 30 Mar 2019 09:02:02 -0700
+Subject: [PATCH] ASoC: tlv320aic32x4: Fix Common Pins
+Git-commit: c63adb28f6d913310430f14c69f0a2ea55eed0cc
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The common pins were mistakenly not added to the DAPM graph.
+Adding these pins will allow valid graphs to be created.
+
+Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/tlv320aic32x4.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index 96f1526cb258..5520044929f4 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -490,6 +490,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("IN2_R"),
+ SND_SOC_DAPM_INPUT("IN3_L"),
+ SND_SOC_DAPM_INPUT("IN3_R"),
++ SND_SOC_DAPM_INPUT("CM_L"),
++ SND_SOC_DAPM_INPUT("CM_R"),
+ };
+
+ static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch b/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch
new file mode 100644
index 0000000000..d1a65f1134
--- /dev/null
+++ b/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch
@@ -0,0 +1,69 @@
+From a2225a6d155fcb247fe4c6d87f7c91807462966d Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Tue, 19 Mar 2019 11:52:06 +0000
+Subject: [PATCH] ASoC: wm_adsp: Add locking to wm_adsp2_bus_error
+Git-commit: a2225a6d155fcb247fe4c6d87f7c91807462966d
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Best to lock across handling the bus error to ensure the DSP doesn't
+change power state as we are reading the status registers.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/wm_adsp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index b3348a213c18..c19a8a041d4d 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -3922,11 +3922,13 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ struct regmap *regmap = dsp->regmap;
+ int ret = 0;
+
++ mutex_lock(&dsp->pwr_lock);
++
+ ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+ if (ret) {
+ adsp_err(dsp,
+ "Failed to read Region Lock Ctrl register: %d\n", ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+@@ -3945,7 +3947,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Bus Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "bus error address = 0x%x\n",
+@@ -3958,7 +3960,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Pmem Xmem Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "xmem error address = 0x%x\n",
+@@ -3971,6 +3973,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+ ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
++error:
++ mutex_unlock(&dsp->pwr_lock);
++
+ return IRQ_HANDLED;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch b/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch
new file mode 100644
index 0000000000..9d6139897f
--- /dev/null
+++ b/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch
@@ -0,0 +1,58 @@
+From d5bb334a8e171b262e48f378bd2096c0ea458265 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Wed, 24 Apr 2019 22:19:17 +0200
+Subject: [PATCH] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
+Git-commit: d5bb334a8e171b262e48f378bd2096c0ea458265
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The minimum encryption key size for LE connections is 56 bits and to
+align LE with BR/EDR, enforce 56 bits of minimum encryption key size for
+BR/EDR connections as well.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/net/bluetooth/hci_core.h | 3 +++
+ net/bluetooth/hci_conn.c | 8 ++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 094e61e07030..05b1b96f4d9e 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -190,6 +190,9 @@ struct adv_info {
+
+ #define HCI_MAX_SHORT_NAME_LENGTH 10
+
++/* Min encryption key size to match with SMP */
++#define HCI_MIN_ENC_KEY_SIZE 7
++
+ /* Default LE RPA expiry time, 15 minutes */
+ #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index bd4978ce8c45..3cf0764d5793 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1276,6 +1276,14 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
++ /* The minimum encryption key size needs to be enforced by the
++ * host stack before establishing any L2CAP connections. The
++ * specification in theory allows a minimum of 1, but to align
++ * BR/EDR and LE transports, a minimum of 7 is chosen.
++ */
++ if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
++ return 0;
++
+ return 1;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch b/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch
new file mode 100644
index 0000000000..62087c0f46
--- /dev/null
+++ b/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch
@@ -0,0 +1,38 @@
+From a1616a5ac99ede5d605047a9012481ce7ff18b16 Mon Sep 17 00:00:00 2001
+From: Young Xiao <YangX92@hotmail.com>
+Date: Fri, 12 Apr 2019 15:24:30 +0800
+Subject: [PATCH] Bluetooth: hidp: fix buffer overflow
+Git-commit: a1616a5ac99ede5d605047a9012481ce7ff18b16
+Patch-mainline: v5.2-rc1
+References: bsc#1051510, CVE-2019-11884, bsc#1134848
+
+Struct ca is copied from userspace. It is not checked whether the "name"
+field is NULL terminated, which allows local users to obtain potentially
+sensitive information from kernel stack memory, via a HIDPCONNADD command.
+
+This vulnerability is similar to CVE-2011-1079.
+
+Signed-off-by: Young Xiao <YangX92@hotmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/bluetooth/hidp/sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
+index 9f85a1943be9..2151913892ce 100644
+--- a/net/bluetooth/hidp/sock.c
++++ b/net/bluetooth/hidp/sock.c
+@@ -75,6 +75,7 @@ static int do_hidp_sock_ioctl(struct socket *sock, unsigned int cmd, void __user
+ sockfd_put(csock);
+ return err;
+ }
++ ca.name[sizeof(ca.name)-1] = 0;
+
+ err = hidp_connection_add(&ca, csock, isock);
+ if (!err && copy_to_user(argp, &ca, sizeof(ca)))
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch b/patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
new file mode 100644
index 0000000000..3bb25cc55a
--- /dev/null
+++ b/patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
@@ -0,0 +1,43 @@
+From d28ca864c493637f3c957f4ed9348a94fca6de60 Mon Sep 17 00:00:00 2001
+From: Nikolai Kostrigin <nickel@altlinux.org>
+Date: Mon, 8 Apr 2019 13:37:25 +0300
+Subject: [PATCH] PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken
+Git-commit: d28ca864c493637f3c957f4ed9348a94fca6de60
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+ATS is broken on the Radeon R7 GPU (at least for Stoney Ridge based laptop)
+and causes IOMMU stalls and system failure. Disable ATS on these devices
+to make them usable again with IOMMU enabled.
+
+Thanks to Joerg Roedel <jroedel@suse.de> for help.
+
+[bhelgaas: In the email thread mentioned below, Alex suspects the real
+problem is in sbios or iommu, so it may affect only certain systems, and it
+may affect other devices in those systems as well. However, per Joerg we
+lack the ability to debug further, so this quirk is the best we can do for
+now.]
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=194521
+Link: https://lore.kernel.org/lkml/20190408103725.30426-1-nickel@altlinux.org
+Fixes: 9b44b0b09dec ("PCI: Mark AMD Stoney GPU ATS as broken")
+Signed-off-by: Nikolai Kostrigin <nickel@altlinux.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4983,6 +4983,7 @@ static void quirk_no_ats(struct pci_dev
+
+ /* AMD Stoney platform GPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
diff --git a/patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch b/patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
new file mode 100644
index 0000000000..39d5025202
--- /dev/null
+++ b/patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
@@ -0,0 +1,38 @@
+From 6afb7e26978da5e86e57e540fdce65c8b04f398a Mon Sep 17 00:00:00 2001
+From: James Prestwood <james.prestwood@linux.intel.com>
+Date: Mon, 7 Jan 2019 13:32:48 -0800
+Subject: [PATCH] PCI: Mark Atheros AR9462 to avoid bus reset
+Git-commit: 6afb7e26978da5e86e57e540fdce65c8b04f398a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+When using PCI passthrough with this device, the host machine locks up
+completely when starting the VM, requiring a hard reboot. Add a quirk to
+avoid bus resets on this device.
+
+Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset")
+Link: https://lore.kernel.org/linux-pci/20190107213248.3034-1-james.prestwood@linux.intel.com
+Signed-off-by: James Prestwood <james.prestwood@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v3.14+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 68bee35fcafa..9b9e28854a58 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3408,6 +3408,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+
+ /*
+ * Root port on some Cavium CN8xxx chips do not successfully complete a bus
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch b/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
new file mode 100644
index 0000000000..b33d241243
--- /dev/null
+++ b/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
@@ -0,0 +1,51 @@
+From f0654ba94e33699b295ce4f3dc73094db6209035 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Apr 2019 19:58:32 +0200
+Subject: [PATCH] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
+Git-commit: f0654ba94e33699b295ce4f3dc73094db6209035
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This reverts commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32.
+
+The fix attempt was incorrect, leading to the mutex deadlock through
+the close of OSS sequencer client. The proper fix needs more
+consideration, so let's revert it now.
+
+Fixes: feb689025fbb ("ALSA: seq: Protect in-kernel ioctl calls with mutex")
+Reported-by: syzbot+47ded6c0f23016cde310@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index f256704dc401..de320b1b90de 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2334,19 +2334,14 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ {
+ const struct ioctl_handler *handler;
+ struct snd_seq_client *client;
+- int err;
+
+ client = clientptr(clientid);
+ if (client == NULL)
+ return -ENXIO;
+
+ for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
+- if (handler->cmd == cmd) {
+- mutex_lock(&client->ioctl_mutex);
+- err = handler->func(client, arg);
+- mutex_unlock(&client->ioctl_mutex);
+- return err;
+- }
++ if (handler->cmd == cmd)
++ return handler->func(client, arg);
+ }
+
+ pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch b/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
new file mode 100644
index 0000000000..675eb7ea9f
--- /dev/null
+++ b/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
@@ -0,0 +1,69 @@
+From 0eae4686a128d87503863a261e84887750c8bc68 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 29 Mar 2019 15:47:40 +0100
+Subject: [PATCH] Revert "tty: pty: Fix race condition between release_one_tty and pty_write"
+Git-commit: 0eae4686a128d87503863a261e84887750c8bc68
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This reverts commit b9ca5f8560af244489b4a1bc1ae88b341f24bc95 as 0-day
+shows it has a circular locking dependency.
+
+Fixes: b9ca5f8560af ("tty: pty: Fix race condition between release_one_tty and pty_write")
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Sahara <keun-o.park@darkmatter.ae>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/pty.c | 7 -------
+ drivers/tty/tty_io.c | 3 ---
+ 2 files changed, 10 deletions(-)
+
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index ef72031ab5b9..00099a8439d2 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -116,12 +116,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ if (tty->stopped)
+ return 0;
+
+- mutex_lock(&tty_mutex);
+- if (to->magic != TTY_MAGIC) {
+- mutex_unlock(&tty_mutex);
+- return -EIO;
+- }
+-
+ if (c > 0) {
+ spin_lock_irqsave(&to->port->lock, flags);
+ /* Stuff the data into the input queue of the other end */
+@@ -131,7 +125,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ tty_flip_buffer_push(to->port);
+ spin_unlock_irqrestore(&to->port->lock, flags);
+ }
+- mutex_unlock(&tty_mutex);
+ return c;
+ }
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index c27777f3b8c4..5fa250157025 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1448,13 +1448,10 @@ static void release_one_tty(struct work_struct *work)
+ struct tty_driver *driver = tty->driver;
+ struct module *owner = driver->owner;
+
+- mutex_lock(&tty_mutex);
+ if (tty->ops->cleanup)
+ tty->ops->cleanup(tty);
+
+ tty->magic = 0;
+- mutex_unlock(&tty_mutex);
+-
+ tty_driver_kref_put(driver);
+ module_put(owner);
+
+--
+2.16.4
+
diff --git a/patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch b/patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch
new file mode 100644
index 0000000000..9ad535a87b
--- /dev/null
+++ b/patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch
@@ -0,0 +1,50 @@
+From d3f48ec0954c6aac736ab21c34a35d7554409112 Mon Sep 17 00:00:00 2001
+From: Brian Masney <masneyb@onstation.org>
+Date: Wed, 24 Apr 2019 05:25:03 -0400
+Subject: [PATCH] backlight: lm3630a: Return 0 on success in update_status functions
+Git-commit: d3f48ec0954c6aac736ab21c34a35d7554409112
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
+both return the brightness value if the brightness was successfully
+updated. Writing to these attributes via sysfs would cause a 'Bad
+address' error to be returned. These functions should return 0 on
+success, so let's change it to correct that error.
+
+Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/backlight/lm3630a_bl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 2030a6b77a09..ef2553f452ca 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access\n");
+@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+--
+2.16.4
+
diff --git a/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch b/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch
new file mode 100644
index 0000000000..8d127b34a4
--- /dev/null
+++ b/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch
@@ -0,0 +1,85 @@
+From 00c0cd9e59d265b393553e9afa54fee8b10e8158 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 11 Apr 2019 06:55:55 -0700
+Subject: [PATCH] clk: rockchip: Fix video codec clocks on rk3288
+Git-commit: 00c0cd9e59d265b393553e9afa54fee8b10e8158
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It appears that there is a typo in the rk3288 TRM. For
+GRF_SOC_CON0[7] it says that 0 means "vepu" and 1 means "vdpu". It's
+the other way around.
+
+How do I know? Here's my evidence:
+
+1. Prior to commit 4d3e84f99628 ("clk: rockchip: describe aclk_vcodec
+ using the new muxgrf type on rk3288") we always pretended that we
+ were using "aclk_vdpu" and the comment in the code said that this
+ matched the default setting in the system. In fact the default
+ setting is 0 according to the TRM and according to reading memory
+ at bootup. In addition rk3288-based Chromebooks ran like this and
+ the video codecs worked.
+2. With the existing clock code if you boot up and try to enable the
+ new VIDEO_ROCKCHIP_VPU as a module (and without "clk_ignore_unused"
+ on the command line), you get errors like "failed to get ack on
+ domain 'pd_video', val=0x80208". After flipping vepu/vdpu things
+ init OK.
+3. If I export and add both the vepu and vdpu to the list of clocks
+ for RK3288_PD_VIDEO I can get past the power domain errors, but now
+ I freeze when the vpu_mmu gets initted.
+4. If I just mark the "vdpu" as IGNORE_UNUSED then everything boots up
+ and probes OK showing that somehow the "vdpu" was important to keep
+ enabled. This is because we were actually using it as a parent.
+5. After this change I can hack "aclk_vcodec_pre" to parent from
+ "aclk_vepu" using assigned-clocks and the video codec still probes
+ OK.
+6. Rockchip has said so on the mailing list [1].
+
+...so let's fix it.
+
+Let's also add CLK_SET_RATE_PARENT to "aclk_vcodec_pre" as suggested
+by Jonas Karlman. Prior to the same commit you could do
+clk_set_rate() on "aclk_vcodec" and it would change "aclk_vdpu".
+That's because "aclk_vcodec" was a simple gate clock (always gets
+CLK_SET_RATE_PARENT) and its direct parent was "aclk_vdpu". After
+that commit "aclk_vcodec_pre" gets in the way so we need to add
+CLK_SET_RATE_PARENT to it too.
+
+[1] https://lkml.kernel.org/r/1d17b015-9e17-34b9-baf8-c285dc1957aa@rock-chips.com
+
+Fixes: 4d3e84f99628 ("clk: rockchip: describe aclk_vcodec using the new muxgrf type on rk3288")
+Suggested-by: Jonas Karlman <jonas@kwiboo.se>
+Suggested-by: Randy Li <ayaka@soulik.info>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3288.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index f47d514cba36..94cbcb0aa49f 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -219,7 +219,7 @@ PNAME(mux_hsadcout_p) = { "hsadc_src", "ext_hsadc" };
+ PNAME(mux_edp_24m_p) = { "ext_edp_24m", "xin24m" };
+ PNAME(mux_tspout_p) = { "cpll", "gpll", "npll", "xin27m" };
+
+-PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vepu", "aclk_vdpu" };
++PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vdpu", "aclk_vepu" };
+ PNAME(mux_usbphy480m_p) = { "sclk_otgphy1_480m", "sclk_otgphy2_480m",
+ "sclk_otgphy0_480m" };
+ PNAME(mux_hsicphy480m_p) = { "cpll", "gpll", "usbphy480m_src" };
+@@ -420,7 +420,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb480m_p, 0,
+ RK3288_CLKSEL_CON(32), 14, 2, MFLAGS, 8, 5, DFLAGS,
+ RK3288_CLKGATE_CON(3), 11, GFLAGS),
+- MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, 0,
++ MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, CLK_SET_RATE_PARENT,
+ RK3288_GRF_SOC_CON(0), 7, 1, MFLAGS),
+ GATE(ACLK_VCODEC, "aclk_vcodec", "aclk_vcodec_pre", 0,
+ RK3288_CLKGATE_CON(9), 0, GFLAGS),
+--
+2.16.4
+
diff --git a/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch b/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
new file mode 100644
index 0000000000..42552ae89c
--- /dev/null
+++ b/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
@@ -0,0 +1,92 @@
+From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: [PATCH] clk: rockchip: fix wrong clock definitions for rk3328
+Git-commit: fb903392131a324a243c7731389277db1cd9f8df
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", CLK_IGNORE_UNUSED,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -894,7 +894,7 @@ static void __init rk3328_clk_init(struc
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
diff --git a/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch b/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch
new file mode 100644
index 0000000000..647bf4914e
--- /dev/null
+++ b/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch
@@ -0,0 +1,45 @@
+From 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: [PATCH] dmaengine: axi-dmac: Don't check the number of frames for alignment
+Git-commit: 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index eecb367b4f3e..cdbef59a9542 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -526,7 +526,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+
+ if (chan->hw_2d) {
+ if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+- !axi_dmac_check_len(chan, xt->numf))
++ xt->numf == 0)
+ return NULL;
+ if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ xt->sgl[0].size + src_icg > chan->max_length)
+--
+2.16.4
+
diff --git a/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch b/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch
new file mode 100644
index 0000000000..ebb023a581
--- /dev/null
+++ b/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch
@@ -0,0 +1,90 @@
+From f030e419501cb95e961e9ed35c493b5d46a04eca Mon Sep 17 00:00:00 2001
+From: Sameer Pujar <spujar@nvidia.com>
+Date: Thu, 2 May 2019 18:25:16 +0530
+Subject: [PATCH] dmaengine: tegra210-dma: free dma controller in remove()
+Git-commit: f030e419501cb95e961e9ed35c493b5d46a04eca
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Following kernel panic is seen during DMA driver unload->load sequence
+==========================================================================
+Unable to handle kernel paging request at virtual address ffffff8001198880
+Internal error: Oops: 86000007 [#1] PREEMPT SMP
+Cpu: 0 PID: 5907 Comm: HwBinder:4123_1 Tainted: G C 4.9.128-tegra-g065839f
+Hardware name: galen (DT)
+Task: ffffffc3590d1a80 task.stack: ffffffc3d0678000
+PC is at 0xffffff8001198880
+LR is at of_dma_request_slave_channel+0xd8/0x1f8
+pc : [<ffffff8001198880>] lr : [<ffffff8008746f30>] pstate: 60400045
+sp : ffffffc3d067b710
+X29: ffffffc3d067b710 x28: 000000000000002f
+X27: ffffff800949e000 x26: ffffff800949e750
+X25: ffffff800949e000 x24: ffffffbefe817d84
+X23: ffffff8009f77cb0 x22: 0000000000000028
+X21: ffffffc3ffda49c8 x20: 0000000000000029
+X19: 0000000000000001 x18: ffffffffffffffff
+X17: 0000000000000000 x16: ffffff80082b66a0
+X15: ffffff8009e78250 x14: 000000000000000a
+X13: 0000000000000038 x12: 0101010101010101
+X11: 0000000000000030 x10: 0101010101010101
+x9 : fffffffffffffffc x8 : 7f7f7f7f7f7f7f7f
+x7 : 62ff726b6b64622c x6 : 0000000000008064
+x5 : 6400000000000000 x4 : ffffffbefe817c44
+x3 : ffffffc3ffda3e08 x2 : ffffff8001198880
+x1 : ffffffc3d48323c0 x0 : ffffffc3d067b788
+
+Process HwBinder:4123_1 (pid: 5907, stack limit = 0xffffffc3d0678028)
+Call trace:
+[<ffffff8001198880>] 0xffffff8001198880
+[<ffffff80087459f8>] dma_request_chan+0x50/0x1f0
+[<ffffff8008745bc0>] dma_request_slave_channel+0x28/0x40
+[<ffffff8001552c44>] tegra_alt_pcm_open+0x114/0x170
+[<ffffff8008d65fa4>] soc_pcm_open+0x10c/0x878
+[<ffffff8008d18618>] snd_pcm_open_substream+0xc0/0x170
+[<ffffff8008d1878c>] snd_pcm_open+0xc4/0x240
+[<ffffff8008d189e0>] snd_pcm_playback_open+0x58/0x80
+[<ffffff8008cfc6d4>] snd_open+0xb4/0x178
+[<ffffff8008250628>] chrdev_open+0xb8/0x1d0
+[<ffffff8008246fdc>] do_dentry_open+0x214/0x318
+[<ffffff80082485d0>] vfs_open+0x58/0x88
+[<ffffff800825bce0>] do_last+0x450/0xde0
+[<ffffff800825c718>] path_openat+0xa8/0x368
+[<ffffff800825dd84>] do_filp_open+0x8c/0x110
+[<ffffff8008248a74>] do_sys_open+0x164/0x220
+[<ffffff80082b66dc>] compat_SyS_openat+0x3c/0x50
+[<ffffff8008083040>] el0_svc_naked+0x34/0x38
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---[ end trace 67e6d544e65b5145 ]---
+Kernel panic - not syncing: Fatal exception
+==========================================================================
+
+In device probe(), of_dma_controller_register() registers DMA controller.
+But when driver is removed, this is not freed. During driver reload this
+results in data abort and kernel panic. Add of_dma_controller_free() in
+driver remove path to fix the issue.
+
+Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index f26c458d584e..953669d35479 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -888,6 +888,7 @@ static int tegra_adma_remove(struct platform_device *pdev)
+ struct tegra_adma *tdma = platform_get_drvdata(pdev);
+ int i;
+
++ of_dma_controller_free(pdev->dev.of_node);
+ dma_async_device_unregister(&tdma->dma_dev);
+
+ for (i = 0; i < tdma->nr_channels; ++i)
+--
+2.16.4
+
diff --git a/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch b/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch
new file mode 100644
index 0000000000..1103708253
--- /dev/null
+++ b/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch
@@ -0,0 +1,39 @@
+From 5acb4b970184d189d901192d075997c933b82260 Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
+Date: Fri, 22 Feb 2019 15:49:19 +0400
+Subject: [PATCH] dwc2: gadget: Fix completed transfer size calculation in DDMA
+Git-commit: 5acb4b970184d189d901192d075997c933b82260
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Fix calculation of transfer size on completion in function
+dwc2_gadget_get_xfersize_ddma().
+
+Added increment of descriptor pointer to move to next descriptor in
+the loop.
+
+Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")
+
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc2/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index a17e444e467b..16ffd9fd9361 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2325,6 +2325,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ if (status & DEV_DMA_STS_MASK)
+ dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ i, status & DEV_DMA_STS_MASK);
++ desc++;
+ }
+
+ return bytes_rem;
+--
+2.16.4
+
diff --git a/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch b/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
index 5ddcb5196e..ddb42f7bbf 100644
--- a/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
+++ b/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
@@ -4,8 +4,7 @@ Date: Tue, 19 Mar 2019 10:28:51 -0300
Subject: [PATCH] ibmvnic: Report actual backing device speed and duplex values
References: bsc#1129923
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Patch-mainline: v5.2-rc1
Git-commit: f8d6ae0d27ec1e81e4be454e63bc96086bbf8e6b
The ibmvnic driver currently reports a fixed value for both speed and
diff --git a/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch b/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch
new file mode 100644
index 0000000000..6fe6f153d8
--- /dev/null
+++ b/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch
@@ -0,0 +1,38 @@
+From e60e9a4b231a20a199d7a61caadc48693c30d695 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:36 +0300
+Subject: [PATCH] intel_th: pci: Add Comet Lake support
+Git-commit: e60e9a4b231a20a199d7a61caadc48693c30d695
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This adds support for Intel TH on Comet Lake.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 1cf6290d6435..70f2cb90adc5 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -165,6 +165,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x34a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Comet Lake */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+--
+2.16.4
+
diff --git a/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock b/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
new file mode 100644
index 0000000000..02ec82e57c
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
@@ -0,0 +1,101 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Fri, 19 Apr 2019 14:43:29 +0800
+Subject: iommu/vt-d: Don't request page request irq under dmar_global_lock
+Git-commit: a7755c3cfa5df755e39447b08c28203e011fb98c
+References: bsc#1135006
+Patch-mainline: v5.2-rc1
+
+Requesting page reqest irq under dmar_global_lock could cause
+potential lock race condition (caught by lockdep).
+
+[ 4.100055] ======================================================
+[ 4.100063] WARNING: possible circular locking dependency detected
+[ 4.100072] 5.1.0-rc4+ #2169 Not tainted
+[ 4.100078] ------------------------------------------------------
+[ 4.100086] swapper/0/1 is trying to acquire lock:
+[ 4.100094] 000000007dcbe3c3 (dmar_lock){+.+.}, at: dmar_alloc_hwirq+0x35/0x140
+[ 4.100112] but task is already holding lock:
+[ 4.100120] 0000000060bbe946 (dmar_global_lock){++++}, at: intel_iommu_init+0x191/0x1438
+[ 4.100136] which lock already depends on the new lock.
+[ 4.100146] the existing dependency chain (in reverse order) is:
+[ 4.100155]
+ -> #2 (dmar_global_lock){++++}:
+[ 4.100169] down_read+0x44/0xa0
+[ 4.100178] intel_irq_remapping_alloc+0xb2/0x7b0
+[ 4.100186] mp_irqdomain_alloc+0x9e/0x2e0
+[ 4.100195] __irq_domain_alloc_irqs+0x131/0x330
+[ 4.100203] alloc_isa_irq_from_domain.isra.4+0x9a/0xd0
+[ 4.100212] mp_map_pin_to_irq+0x244/0x310
+[ 4.100221] setup_IO_APIC+0x757/0x7ed
+[ 4.100229] x86_late_time_init+0x17/0x1c
+[ 4.100238] start_kernel+0x425/0x4e3
+[ 4.100247] secondary_startup_64+0xa4/0xb0
+[ 4.100254]
+ -> #1 (irq_domain_mutex){+.+.}:
+[ 4.100265] __mutex_lock+0x7f/0x9d0
+[ 4.100273] __irq_domain_add+0x195/0x2b0
+[ 4.100280] irq_domain_create_hierarchy+0x3d/0x40
+[ 4.100289] msi_create_irq_domain+0x32/0x110
+[ 4.100297] dmar_alloc_hwirq+0x111/0x140
+[ 4.100305] dmar_set_interrupt.part.14+0x1a/0x70
+[ 4.100314] enable_drhd_fault_handling+0x2c/0x6c
+[ 4.100323] apic_bsp_setup+0x75/0x7a
+[ 4.100330] x86_late_time_init+0x17/0x1c
+[ 4.100338] start_kernel+0x425/0x4e3
+[ 4.100346] secondary_startup_64+0xa4/0xb0
+[ 4.100352]
+ -> #0 (dmar_lock){+.+.}:
+[ 4.100364] lock_acquire+0xb4/0x1c0
+[ 4.100372] __mutex_lock+0x7f/0x9d0
+[ 4.100379] dmar_alloc_hwirq+0x35/0x140
+[ 4.100389] intel_svm_enable_prq+0x61/0x180
+[ 4.100397] intel_iommu_init+0x1128/0x1438
+[ 4.100406] pci_iommu_init+0x16/0x3f
+[ 4.100414] do_one_initcall+0x5d/0x2be
+[ 4.100422] kernel_init_freeable+0x1f0/0x27c
+[ 4.100431] kernel_init+0xa/0x110
+[ 4.100438] ret_from_fork+0x3a/0x50
+[ 4.100444]
+ other info that might help us debug this:
+
+[ 4.100454] Chain exists of:
+ dmar_lock --> irq_domain_mutex --> dmar_global_lock
+[ 4.100469] Possible unsafe locking scenario:
+
+[ 4.100476] CPU0 CPU1
+[ 4.100483] ---- ----
+[ 4.100488] lock(dmar_global_lock);
+[ 4.100495] lock(irq_domain_mutex);
+[ 4.100503] lock(dmar_global_lock);
+[ 4.100512] lock(dmar_lock);
+[ 4.100518]
+ *** DEADLOCK ***
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Fixes: a222a7f0bb6c9 ("iommu/vt-d: Implement page request handling")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3435,7 +3435,13 @@ domains_done:
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ if (pasid_enabled(iommu) && ecap_prs(iommu->ecap)) {
++ /*
++ * Call dmar_alloc_hwirq() with dmar_global_lock held,
++ * could cause possible lock race condition.
++ */
++ up_write(&dmar_global_lock);
+ ret = intel_svm_enable_prq(iommu);
++ down_write(&dmar_global_lock);
+ if (ret)
+ goto free_iommu;
+ }
+
diff --git a/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu b/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu
new file mode 100644
index 0000000000..4ede87ac04
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu
@@ -0,0 +1,42 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+Git-commit: 5daab58043ee2bca861068e2595564828f3bc663
+References: bsc#1135007
+Patch-mainline: v5.2-rc1
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used. This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3351,9 +3351,12 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_ALL;
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+- iommu_identity_mapping |= IDENTMAP_GFX;
++ dmar_map_gfx = 0;
+ #endif
+
++ if (!dmar_map_gfx)
++ iommu_identity_mapping |= IDENTMAP_GFX;
++
+ check_tylersburg_isoch();
+
+ if (iommu_identity_mapping) {
+
diff --git a/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly b/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly
new file mode 100644
index 0000000000..f84fdbca56
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly
@@ -0,0 +1,49 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 2 May 2019 09:34:25 +0800
+Subject: iommu/vt-d: Set intel_iommu_gfx_mapped correctly
+Git-commit: cf1ec4539a50bdfe688caad4615ca47646884316
+References: bsc#1135008
+Patch-mainline: v5.2-rc1
+
+The intel_iommu_gfx_mapped flag is exported by the Intel
+IOMMU driver to indicate whether an IOMMU is used for the
+graphic device. In a virtualized IOMMU environment (e.g.
+QEMU), an include-all IOMMU is used for graphic device.
+This flag is found to be clear even the IOMMU is used.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4131,9 +4131,7 @@ static void __init init_no_remapping_dev
+
+ /* This IOMMU has *only* gfx devices. Either bypass it or
+ set the gfx_mapped flag, as appropriate */
+- if (dmar_map_gfx) {
+- intel_iommu_gfx_mapped = 1;
+- } else {
++ if (!dmar_map_gfx) {
+ drhd->ignored = 1;
+ for_each_active_dev_scope(drhd->devices,
+ drhd->devices_cnt, i, dev)
+@@ -4933,6 +4931,9 @@ int __init intel_iommu_init(void)
+ goto out_free_reserved_range;
+ }
+
++ if (dmar_map_gfx)
++ intel_iommu_gfx_mapped = 1;
++
+ init_no_remapping_devices();
+
+ ret = init_dmars();
+
diff --git a/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch b/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
index 60159f93ca..db21f5422c 100644
--- a/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
+++ b/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
@@ -4,7 +4,7 @@ Date: Wed, 24 Apr 2019 11:50:43 +0000
Subject: [PATCH] ipmi:ssif: compare block number correctly for multi-part return messages
Git-commit: 55be8658c7e2feb11a5b5b33ee031791dbd23a69
Patch-mainline: v5.2-rc1
-References: bsc#1051510
+References: bsc#1051510, bsc#1135120
According to ipmi spec, block number is a number that is incremented,
starting with 0, for each new block of message data returned using the
diff --git a/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch b/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
new file mode 100644
index 0000000000..fd62d631a3
--- /dev/null
+++ b/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
@@ -0,0 +1,37 @@
+From 7afb0df554292dca7568446f619965fb8153085d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: [PATCH] media: cx18: update *pos correctly in cx18_read_pos()
+Git-commit: 7afb0df554292dca7568446f619965fb8153085d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We should be updating *pos. The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index f778965a2eb8..59e78fb17575 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+
+ CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-cx23885-check-allocation-return.patch b/patches.drivers/media-cx23885-check-allocation-return.patch
new file mode 100644
index 0000000000..5dffa95e6c
--- /dev/null
+++ b/patches.drivers/media-cx23885-check-allocation-return.patch
@@ -0,0 +1,43 @@
+From a3d7f22ef34ec4206b50ee121384d5c8bebd5591 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: [PATCH] media: cx23885: check allocation return
+Git-commit: a3d7f22ef34ec4206b50ee121384d5c8bebd5591
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here. While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 0d0929c54f93..e2e63f05645e 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1474,8 +1474,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ if (fe0->dvb.frontend != NULL) {
+ struct i2c_adapter *tun_i2c;
+
+- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++ if (!fe0->dvb.frontend->sec_priv)
++ return -ENOMEM;
+ tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ return -ENODEV;
+--
+2.16.4
+
diff --git a/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch b/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch
new file mode 100644
index 0000000000..b11b752246
--- /dev/null
+++ b/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch
@@ -0,0 +1,78 @@
+From 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: [PATCH] media: davinci-isif: avoid uninitialized variable use
+Git-commit: 0e633f97162c1c74c68e2eb20bbd9259dce87cd9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+ [-Werror,-Wuninitialized]
+ dm365_vpss_set_pg_frame_size(frame_size);
+ ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+ struct vpss_pg_frame_size frame_size;
+ ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 47cecd10eb9f..2dee9af6d413 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -884,9 +884,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+- struct vpss_pg_frame_size frame_size;
+ u32 modeset = 0, ccdcfg = 0;
+- struct vpss_sync_pol sync;
+
+ dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+
+@@ -974,13 +972,6 @@ static int isif_config_ycbcr(void)
+ /* two fields are interleaved in memory */
+ regw(0x00000249, SDOFST);
+
+- /* Setup test pattern if enabled */
+- if (isif_cfg.bayer.config_params.test_pat_gen) {
+- sync.ccdpg_hdpol = params->hd_pol;
+- sync.ccdpg_vdpol = params->vd_pol;
+- dm365_vpss_set_sync_pol(sync);
+- dm365_vpss_set_pg_frame_size(frame_size);
+- }
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch b/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
new file mode 100644
index 0000000000..fcdf04ad5c
--- /dev/null
+++ b/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
@@ -0,0 +1,37 @@
+From f8e579f3ca0973daef263f513da5edff520a6c0d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: [PATCH] media: ivtv: update *pos correctly in ivtv_read_pos()
+Git-commit: f8e579f3ca0973daef263f513da5edff520a6c0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 6196daae4b3e..043ac0ae9ed0 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+
+ IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch b/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
new file mode 100644
index 0000000000..5c64655395
--- /dev/null
+++ b/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
@@ -0,0 +1,39 @@
+From 384538bda10913e5c94ec5b5d34bd3075931bcf4 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: [PATCH] media: ov2659: fix unbalanced mutex_lock/unlock
+Git-commit: 384538bda10913e5c94ec5b5d34bd3075931bcf4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index a1e9a980a445..5ed2413eac8a 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1132,7 +1132,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ *mf = fmt->format;
+ #else
+- return -ENOTTY;
++ ret = -ENOTTY;
+ #endif
+ } else {
+ s64 val;
+--
+2.16.4
+
diff --git a/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch b/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch
new file mode 100644
index 0000000000..538bbec145
--- /dev/null
+++ b/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch
@@ -0,0 +1,141 @@
+From 56cd26b618855c9af48c8301aa6754ced8dd0beb Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 5 Mar 2019 00:40:26 -0500
+Subject: [PATCH] media: serial_ir: Fix use-after-free in serial_ir_init_module
+Git-commit: 56cd26b618855c9af48c8301aa6754ced8dd0beb
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Syzkaller report this:
+
+Bug: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
+Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249
+
+Cpu: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xfa/0x1ce lib/dump_stack.c:113
+ print_address_description+0x65/0x270 mm/kasan/report.c:187
+ kasan_report+0x149/0x18d mm/kasan/report.c:317
+ ? 0xffffffffc1728000
+ sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
+ sysfs_remove_file include/linux/sysfs.h:519 [inline]
+ driver_remove_file+0x40/0x50 drivers/base/driver.c:122
+ remove_bind_files drivers/base/bus.c:585 [inline]
+ bus_remove_driver+0x186/0x220 drivers/base/bus.c:725
+ driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
+ serial_ir_init_module+0x169/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+Rip: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+Rsp: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+Rax: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+Rdx: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
+Rbp: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc
+R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
+
+Allocated by task 6249:
+ set_track mm/kasan/common.c:85 [inline]
+ __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
+ kmalloc include/linux/slab.h:545 [inline]
+ kzalloc include/linux/slab.h:740 [inline]
+ bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
+ driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
+ serial_ir_init_module+0xe8/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Freed by task 6249:
+ set_track mm/kasan/common.c:85 [inline]
+ __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
+ slab_free_hook mm/slub.c:1430 [inline]
+ slab_free_freelist_hook mm/slub.c:1457 [inline]
+ slab_free mm/slub.c:3005 [inline]
+ kfree+0xe1/0x270 mm/slub.c:3957
+ kobject_cleanup lib/kobject.c:662 [inline]
+ kobject_release lib/kobject.c:691 [inline]
+ kref_put include/linux/kref.h:67 [inline]
+ kobject_put+0x146/0x240 lib/kobject.c:708
+ bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
+ driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
+ serial_ir_init_module+0x14c/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The buggy address belongs to the object at ffff8881dc7ae000
+ which belongs to the cache kmalloc-256 of size 256
+The buggy address is located 48 bytes inside of
+ 256-byte region [ffff8881dc7ae000, ffff8881dc7ae100)
+The buggy address belongs to the page:
+page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
+Flags: 0x2fffc0000000200(slab)
+Raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00
+Raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
+
+There are already cleanup handlings in serial_ir_init error path,
+no need to call serial_ir_exit do it again in serial_ir_init_module,
+otherwise will trigger a use-after-free issue.
+
+Fixes: fa5dc29c1fcc ("[media] lirc_serial: move out of staging and rename to serial_ir")
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/rc/serial_ir.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
+index ffe2c672d105..3998ba29beb6 100644
+--- a/drivers/media/rc/serial_ir.c
++++ b/drivers/media/rc/serial_ir.c
+@@ -773,8 +773,6 @@ static void serial_ir_exit(void)
+
+ static int __init serial_ir_init_module(void)
+ {
+- int result;
+-
+ switch (type) {
+ case IR_HOMEBREW:
+ case IR_IRDEO:
+@@ -802,12 +800,7 @@ static int __init serial_ir_init_module(void)
+ if (sense != -1)
+ sense = !!sense;
+
+- result = serial_ir_init();
+- if (!result)
+- return 0;
+-
+- serial_ir_exit();
+- return result;
++ return serial_ir_init();
+ }
+
+ static void __exit serial_ir_exit_module(void)
+--
+2.16.4
+
diff --git a/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch b/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch
new file mode 100644
index 0000000000..903cea3e5a
--- /dev/null
+++ b/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch
@@ -0,0 +1,46 @@
+From 2e7682ebfc750177a4944eeb56e97a3f05734528 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 14 Mar 2019 22:01:24 -0400
+Subject: [PATCH] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
+Git-commit: 2e7682ebfc750177a4944eeb56e97a3f05734528
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+'vb' null check should be done before dereferencing it in
+tw5864_handle_frame, otherwise a NULL pointer dereference
+may occur.
+
+Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index 5a1f3aa4101a..434d313a3c15 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ input->vb = NULL;
+ spin_unlock_irqrestore(&input->slock, flags);
+
+- v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ if (!vb) { /* Gone because of disabling */
+ dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ return;
+ }
+
++ v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ /*
+ * Check for space.
+ * Mind the overhead of startcode emulation prevention.
+--
+2.16.4
+
diff --git a/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch b/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch
new file mode 100644
index 0000000000..7dbf7f646c
--- /dev/null
+++ b/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch
@@ -0,0 +1,41 @@
+From dad7e270ba712ba1c99cd2d91018af6044447a06 Mon Sep 17 00:00:00 2001
+From: Alexander Potapenko <glider@google.com>
+Date: Thu, 4 Apr 2019 10:56:46 -0400
+Subject: [PATCH] media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
+Git-commit: dad7e270ba712ba1c99cd2d91018af6044447a06
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+syzkaller reported crashes on kfree() called from
+vivid_vid_cap_s_selection(). This looks like a simple typo, as
+dev->bitmap_cap is allocated with vzalloc() throughout the file.
+
+Fixes: ef834f7836ec0 ("[media] vivid: add the video capture and output
+parts")
+
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Reported-by: Syzbot <syzbot+6c0effb5877f6b0344e2@syzkaller.appspotmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/vivid/vivid-vid-cap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 52eeda624d7e..530ac8decb25 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -1007,7 +1007,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect);
+ if (dev->bitmap_cap && (compose->width != s->r.width ||
+ compose->height != s->r.height)) {
+- kfree(dev->bitmap_cap);
++ vfree(dev->bitmap_cap);
+ dev->bitmap_cap = NULL;
+ }
+ *compose = s->r;
+--
+2.16.4
+
diff --git a/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch b/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch
new file mode 100644
index 0000000000..08ab610d26
--- /dev/null
+++ b/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch
@@ -0,0 +1,40 @@
+From ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: [PATCH] media: wl128x: Fix an error code in fm_download_firmware()
+Git-commit: ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 3c8987af3772..1614809f7d35 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1268,8 +1268,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+
+ switch (action->type) {
+ case ACTION_SEND_COMMAND: /* Send */
+- if (fmc_send_cmd(fmdev, 0, 0, action->data,
+- action->size, NULL, NULL))
++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++ action->size, NULL, NULL);
++ if (ret)
+ goto rel_fw;
+
+ cmd_cnt++;
+--
+2.16.4
+
diff --git a/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch b/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch
new file mode 100644
index 0000000000..238ca550b4
--- /dev/null
+++ b/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch
@@ -0,0 +1,64 @@
+From 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 26 Mar 2019 01:12:07 -0400
+Subject: [PATCH] media: wl128x: prevent two potential buffer overflows
+Git-commit: 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
+can copy up to 255 bytes and we only have room for two bytes. Even
+if this comes from the firmware and we trust it, the new policy
+generally is just to fix it as kernel hardenning.
+
+I can't test this code so I tried to be very conservative. I considered
+not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
+whole variable but in the end I decided to allow it and manually
+initialized "asic_id" and "asic_ver" to zero.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 1614809f7d35..a1fcb80a2191 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload,
+ return -EIO;
+ }
+ /* Send response data to caller */
+- if (response != NULL && response_len != NULL && evt_hdr->dlen) {
++ if (response != NULL && response_len != NULL && evt_hdr->dlen &&
++ evt_hdr->dlen <= payload_len) {
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+ memcpy(response, skb->data, evt_hdr->dlen);
+@@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
+ return;
+
+ fm_evt_hdr = (void *)skb->data;
++ if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag))
++ return;
+
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+@@ -1309,7 +1312,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev)
+ static int fm_power_up(struct fmdev *fmdev, u8 mode)
+ {
+ u16 payload;
+- __be16 asic_id, asic_ver;
++ __be16 asic_id = 0, asic_ver = 0;
+ int resp_len, ret;
+ u8 fw_name[50];
+
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch b/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch
new file mode 100644
index 0000000000..1d78c24e1c
--- /dev/null
+++ b/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch
@@ -0,0 +1,38 @@
+From 32937a82f36c7bbe08db4052de94bc7ade4e3c51 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 23 Jan 2019 14:58:27 +0800
+Subject: [PATCH] mtd: docg3: Fix passing zero to 'PTR_ERR' warning in doc_probe_device
+Git-commit: 32937a82f36c7bbe08db4052de94bc7ade4e3c51
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Fix a static code checker warning:
+drivers/mtd/devices/docg3.c:1875
+ doc_probe_device() warn: passing zero to 'ERR_PTR'
+
+Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/devices/docg3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 4c94fc096696..60ddc38a5431 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1872,7 +1872,7 @@ doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev)
+ nomem2:
+ kfree(docg3);
+ nomem1:
+- return ERR_PTR(ret);
++ return ret ? ERR_PTR(ret) : NULL;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch b/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch
new file mode 100644
index 0000000000..cc6078d719
--- /dev/null
+++ b/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch
@@ -0,0 +1,46 @@
+From b0dd77a796423ad3c609b6708260adca85a0798f Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 25 Jan 2019 10:12:42 +0800
+Subject: [PATCH] mtd: docg3: fix a possible memory leak of mtd->name
+Git-commit: b0dd77a796423ad3c609b6708260adca85a0798f
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+In case DOC_CHIPID_G3, mtd->name is not freed in err handling path,
+which is alloced by kasprintf(). Fix this by using devm_kasprintf().
+
+Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/devices/docg3.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 60ddc38a5431..7754803e3463 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1767,8 +1767,8 @@ static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
+
+ switch (chip_id) {
+ case DOC_CHIPID_G3:
+- mtd->name = kasprintf(GFP_KERNEL, "docg3.%d",
+- docg3->device_id);
++ mtd->name = devm_kasprintf(docg3->dev, GFP_KERNEL, "docg3.%d",
++ docg3->device_id);
+ if (!mtd->name)
+ return -ENOMEM;
+ docg3->max_block = 2047;
+@@ -1886,7 +1886,6 @@ static void doc_release_device(struct mtd_info *mtd)
+ mtd_device_unregister(mtd);
+ kfree(docg3->bbt);
+ kfree(docg3);
+- kfree(mtd->name);
+ kfree(mtd);
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch b/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
new file mode 100644
index 0000000000..8caac6e39d
--- /dev/null
+++ b/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
@@ -0,0 +1,34 @@
+From e90a619fb7e1acb5e18f1ab618c6d10b08f0fc70 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Thu, 7 Feb 2019 15:28:24 +0100
+Subject: [PATCH] mtd: nand: omap: Fix comment in platform data using wrong Kconfig symbol
+Git-commit: e90a619fb7e1acb5e18f1ab618c6d10b08f0fc70
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The symbol that is being used in the #if/#endif block is not the one
+which is mentioned at the bottom.
+
+Fixes: 93af53b8633c ("nand: omap2: Remove horrible ifdefs to fix module probe")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/platform_data/elm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/platform_data/elm.h b/include/linux/platform_data/elm.h
+index b8686c00f15f..fef4b081b736 100644
+--- a/include/linux/platform_data/elm.h
++++ b/include/linux/platform_data/elm.h
+@@ -60,6 +60,6 @@ static inline int elm_config(struct device *dev, enum bch_ecc bch_type,
+ {
+ return -ENOSYS;
+ }
+-#endif /* CONFIG_MTD_NAND_ECC_BCH */
++#endif /* CONFIG_MTD_NAND_OMAP_BCH */
+
+ #endif /* __ELM_H */
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch b/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
new file mode 100644
index 0000000000..053b532d9a
--- /dev/null
+++ b/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
@@ -0,0 +1,40 @@
+From 3008ba87093852f3756c5d33f584602e5e2a4aa4 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 31 Jan 2019 14:08:20 +0000
+Subject: [PATCH] mtd: part: fix incorrect format specifier for an unsigned long long
+Git-commit: 3008ba87093852f3756c5d33f584602e5e2a4aa4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+An unsigned long long is being formatted with %lld instead of the unsigned
+version %llu. Fix this.
+
+Clean up cppcheck warning:
+%lld in format string (no. 1) requires 'long long' but the argument type
+is 'unsigned long long'.
+
+Fixes: a62c24d75529 ("mtd: part: Add sysfs variable for offset of partition")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/mtdpart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 37f174ccbcec..dfa241ad018b 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -572,7 +572,7 @@ static ssize_t mtd_partition_offset_show(struct device *dev,
+ {
+ struct mtd_info *mtd = dev_get_drvdata(dev);
+ struct mtd_part *part = mtd_to_part(mtd);
+- return snprintf(buf, PAGE_SIZE, "%lld\n", part->offset);
++ return snprintf(buf, PAGE_SIZE, "%llu\n", part->offset);
+ }
+
+ static DEVICE_ATTR(offset, S_IRUGO, mtd_partition_offset_show, NULL);
+--
+2.16.4
+
diff --git a/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch b/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch
new file mode 100644
index 0000000000..f91883fe2c
--- /dev/null
+++ b/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch
@@ -0,0 +1,160 @@
+From 62740e97881c78b45a117a358a866fb32975def6 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 9 May 2019 23:13:43 -0500
+Subject: [PATCH] net/ibmvnic: Update MAC address settings after adapter reset
+
+References: bsc#1134760
+Patch-mainline: v5.2-rc1
+Git-commit: 62740e97881c78b45a117a358a866fb32975def6
+
+It was discovered in testing that the underlying hardware MAC
+address will revert to initial settings following a device reset,
+but the driver fails to resend the current OS MAC settings. This
+oversight can result in dropped packets should the scenario occur.
+Fix this by informing hardware of current MAC address settings
+following any adapter initialization or resets.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 53 ++++++++++++++++--------------
+ drivers/net/ethernet/ibm/ibmvnic.h | 2 --
+ 2 files changed, 28 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index b398d6c94dbd..2be3bcd0192f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -118,7 +118,7 @@ static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter);
+ static int ibmvnic_init(struct ibmvnic_adapter *);
+ static int ibmvnic_reset_init(struct ibmvnic_adapter *);
+ static void release_crq_queue(struct ibmvnic_adapter *);
+-static int __ibmvnic_set_mac(struct net_device *netdev, struct sockaddr *p);
++static int __ibmvnic_set_mac(struct net_device *, u8 *);
+ static int init_crq_queue(struct ibmvnic_adapter *adapter);
+ static int send_query_phys_parms(struct ibmvnic_adapter *adapter);
+
+@@ -849,11 +849,7 @@ static int ibmvnic_login(struct net_device *netdev)
+ }
+ } while (retry);
+
+- /* handle pending MAC address changes after successful login */
+- if (adapter->mac_change_pending) {
+- __ibmvnic_set_mac(netdev, &adapter->desired.mac);
+- adapter->mac_change_pending = false;
+- }
++ __ibmvnic_set_mac(netdev, adapter->mac_addr);
+
+ return 0;
+ }
+@@ -1686,28 +1682,40 @@ static void ibmvnic_set_multi(struct net_device *netdev)
+ }
+ }
+
+-static int __ibmvnic_set_mac(struct net_device *netdev, struct sockaddr *p)
++static int __ibmvnic_set_mac(struct net_device *netdev, u8 *dev_addr)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+- struct sockaddr *addr = p;
+ union ibmvnic_crq crq;
+ int rc;
+
+- if (!is_valid_ether_addr(addr->sa_data))
+- return -EADDRNOTAVAIL;
++ if (!is_valid_ether_addr(dev_addr)) {
++ rc = -EADDRNOTAVAIL;
++ goto err;
++ }
+
+ memset(&crq, 0, sizeof(crq));
+ crq.change_mac_addr.first = IBMVNIC_CRQ_CMD;
+ crq.change_mac_addr.cmd = CHANGE_MAC_ADDR;
+- ether_addr_copy(&crq.change_mac_addr.mac_addr[0], addr->sa_data);
++ ether_addr_copy(&crq.change_mac_addr.mac_addr[0], dev_addr);
+
+ init_completion(&adapter->fw_done);
+ rc = ibmvnic_send_crq(adapter, &crq);
+- if (rc)
+- return rc;
++ if (rc) {
++ rc = -EIO;
++ goto err;
++ }
++
+ wait_for_completion(&adapter->fw_done);
+ /* netdev->dev_addr is changed in handle_change_mac_rsp function */
+- return adapter->fw_done_rc ? -EIO : 0;
++ if (adapter->fw_done_rc) {
++ rc = -EIO;
++ goto err;
++ }
++
++ return 0;
++err:
++ ether_addr_copy(adapter->mac_addr, netdev->dev_addr);
++ return rc;
+ }
+
+ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
+@@ -1716,13 +1724,10 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
+ struct sockaddr *addr = p;
+ int rc;
+
+- if (adapter->state == VNIC_PROBED) {
+- memcpy(&adapter->desired.mac, addr, sizeof(struct sockaddr));
+- adapter->mac_change_pending = true;
+- return 0;
+- }
+-
+- rc = __ibmvnic_set_mac(netdev, addr);
++ rc = 0;
++ ether_addr_copy(adapter->mac_addr, addr->sa_data);
++ if (adapter->state != VNIC_PROBED)
++ rc = __ibmvnic_set_mac(netdev, addr->sa_data);
+
+ return rc;
+ }
+@@ -3937,8 +3942,8 @@ static int handle_change_mac_rsp(union ibmvnic_crq *crq,
+ dev_err(dev, "Error %ld in CHANGE_MAC_ADDR_RSP\n", rc);
+ goto out;
+ }
+- memcpy(netdev->dev_addr, &crq->change_mac_addr_rsp.mac_addr[0],
+- ETH_ALEN);
++ ether_addr_copy(netdev->dev_addr,
++ &crq->change_mac_addr_rsp.mac_addr[0]);
+ out:
+ complete(&adapter->fw_done);
+ return rc;
+@@ -4852,8 +4857,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ init_completion(&adapter->init_done);
+ adapter->resetting = false;
+
+- adapter->mac_change_pending = false;
+-
+ do {
+ rc = init_crq_queue(adapter);
+ if (rc) {
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index cffdac372a33..dcf2eb6d9290 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -969,7 +969,6 @@ struct ibmvnic_tunables {
+ u64 rx_entries;
+ u64 tx_entries;
+ u64 mtu;
+- struct sockaddr mac;
+ };
+
+ struct ibmvnic_adapter {
+@@ -1091,7 +1090,6 @@ struct ibmvnic_adapter {
+ bool resetting;
+ bool napi_enabled, from_passive_init;
+
+- bool mac_change_pending;
+ bool failover_pending;
+ bool force_reset_recovery;
+
+--
+2.20.1
+
diff --git a/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch b/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch
new file mode 100644
index 0000000000..5acb3e95be
--- /dev/null
+++ b/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch
@@ -0,0 +1,66 @@
+From 0655f9943df2f2d71f406fd77b51d05548134fc2 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 9 May 2019 23:13:44 -0500
+Subject: [PATCH] net/ibmvnic: Update carrier state after link state change
+
+References: bsc#1135100
+Patch-mainline: v5.2-rc1
+Git-commit: 0655f9943df2f2d71f406fd77b51d05548134fc2
+
+Only set the device carrier state to on after receiving an up link
+state indication from the underlying adapter. Likewise, if a down
+link indication is receieved, update the carrier state accordingly.
+This fix ensures that accurate carrier state is reported by the driver
+following a link state update by the underlying adapter.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2be3bcd0192f..3dcd9c3d8781 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1111,7 +1111,6 @@ static int ibmvnic_open(struct net_device *netdev)
+ }
+
+ rc = __ibmvnic_open(netdev);
+- netif_carrier_on(netdev);
+
+ return rc;
+ }
+@@ -1864,8 +1863,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
+
+- netif_carrier_on(netdev);
+-
+ return 0;
+ }
+
+@@ -1935,8 +1932,6 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ return 0;
+ }
+
+- netif_carrier_on(netdev);
+-
+ return 0;
+ }
+
+@@ -4480,6 +4475,10 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ crq->link_state_indication.phys_link_state;
+ adapter->logical_link_state =
+ crq->link_state_indication.logical_link_state;
++ if (adapter->phys_link_state && adapter->logical_link_state)
++ netif_carrier_on(netdev);
++ else
++ netif_carrier_off(netdev);
+ break;
+ case CHANGE_MAC_ADDR_RSP:
+ netdev_dbg(netdev, "Got MAC address change Response\n");
+--
+2.20.1
+
diff --git a/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch b/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch
new file mode 100644
index 0000000000..40a103d589
--- /dev/null
+++ b/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch
@@ -0,0 +1,64 @@
+From 787a79230a0f9984e59549b9baa4daf274973a0d Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: [PATCH] omapfb: add missing of_node_put after of_device_is_available
+Git-commit: 787a79230a0f9984e59549b9baa4daf274973a0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Add an of_node_put when a tested device node is not available.
+
+The semantic patch that fixes this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+identifier f;
+local idexpression e;
+expression x;
+@@
+
+e = f(...);
+... when != of_node_put(e)
+ when != x = e
+ when != e = x
+ when any
+if (<+...of_device_is_available(e)...+>) {
+ ... when != of_node_put(e)
+(
+ return e;
+|
++ of_node_put(e);
+ return ...;
+)
+}
+// </smpl>
+
+Fixes: f76ee892a99e6 ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
+index 136d30484d02..cb6acbac9c47 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
+@@ -193,8 +193,10 @@ static int __init omapdss_boot_init(void)
+
+ dss = of_find_matching_node(NULL, omapdss_of_match);
+
+- if (dss == NULL || !of_device_is_available(dss))
++ if (dss == NULL || !of_device_is_available(dss)) {
++ of_node_put(dss);
+ return 0;
++ }
+
+ omapdss_walk_device(dss, true);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch b/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch
new file mode 100644
index 0000000000..84e3a9aa93
--- /dev/null
+++ b/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch
@@ -0,0 +1,50 @@
+From e6f32efb1b128344a2c7df9875bc1a1abaa1d395 Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Date: Thu, 14 Mar 2019 14:05:18 +0100
+Subject: [PATCH] phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
+Git-commit: e6f32efb1b128344a2c7df9875bc1a1abaa1d395
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On platforms where the MUSB and HCI controllers share PHY0, PHY passby
+is required when using the HCI controller with the PHY, but it must be
+disabled when the MUSB controller is used instead.
+
+Without this, PHY0 passby is always enabled, which results in broken
+peripheral mode on such platforms (e.g. H3/H5).
+
+Fixes: ba4bdc9e1dc0 ("PHY: sunxi: Add driver for sunxi usb phy")
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 5163097b43df..7b23920e0068 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -551,6 +551,7 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ struct sun4i_usb_phy_data *data =
+ container_of(work, struct sun4i_usb_phy_data, detect.work);
+ struct phy *phy0 = data->phys[0].phy;
++ struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
+ bool force_session_end, id_notify = false, vbus_notify = false;
+ int id_det, vbus_det;
+
+@@ -607,6 +608,9 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ mutex_unlock(&phy0->mutex);
+ }
+
++ /* Enable PHY0 passby for host mode only. */
++ sun4i_usb_phy_passby(phy, !id_det);
++
+ /* Re-route PHY0 if necessary */
+ if (data->cfg->phy0_dual_route)
+ sun4i_usb_phy0_reroute(data, id_det);
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch b/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
new file mode 100644
index 0000000000..e0e651a6f1
--- /dev/null
+++ b/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
@@ -0,0 +1,38 @@
+From 6d1f8b3d75419a8659ac916a1e9543bb3513a882 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: [PATCH] platform/x86: alienware-wmi: printing the wrong error code
+Git-commit: 6d1f8b3d75419a8659ac916a1e9543bb3513a882
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The "out_data" variable is uninitialized at the point. Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index c0d1555735cd..83fd7677af24 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -587,7 +587,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ return scnprintf(buf, PAGE_SIZE,
+ "input [gpu] unknown\n");
+ }
+- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch b/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch
new file mode 100644
index 0000000000..de90109446
--- /dev/null
+++ b/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch
@@ -0,0 +1,45 @@
+From e28f296ea155da36f710eb1f1173d8780fbac49d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Valdis=20Kl=20=C4=93=20tnieks?= <valdis.kletnieks@vt.edu>
+Date: Tue, 12 Mar 2019 07:26:06 -0400
+Subject: [PATCH] platform/x86: dell-rbtn: Add missing #include
+Git-commit: e28f296ea155da36f710eb1f1173d8780fbac49d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Building with W=1 complains:
+ CC [M] drivers/platform/x86/dell-rbtn.o
+drivers/platform/x86/dell-rbtn.c:345:5: warning: no previous prototype for 'dell_rbtn_notifier_register' [-Wmissing-prototypes]
+ 345 | int dell_rbtn_notifier_register(struct notifier_block *nb)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/platform/x86/dell-rbtn.c:371:5: warning: no previous prototype for 'dell_rbtn_notifier_unregister' [-Wmissing-prototypes]
+ 371 | int dell_rbtn_notifier_unregister(struct notifier_block *nb)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The real problem is a missing include. Add it to keep dell-rbtn.c and .h in sync.
+
+Fixes: b05ffc95f9ed ("dell-rbtn: Export notifier for other kernel modules")
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+[andy: massaged commit message, added Fixes tag]
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/dell-rbtn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/dell-rbtn.c b/drivers/platform/x86/dell-rbtn.c
+index f3afe778001e..56535d7222dd 100644
+--- a/drivers/platform/x86/dell-rbtn.c
++++ b/drivers/platform/x86/dell-rbtn.c
+@@ -18,6 +18,8 @@
+ #include <linux/rfkill.h>
+ #include <linux/input.h>
+
++#include "dell-rbtn.h"
++
+ enum rbtn_type {
+ RBTN_UNKNOWN,
+ RBTN_TOGGLE,
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch b/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch
new file mode 100644
index 0000000000..16ef664c18
--- /dev/null
+++ b/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch
@@ -0,0 +1,49 @@
+From e61985d0550df8c2078310202aaad9b41049c36c Mon Sep 17 00:00:00 2001
+From: Junxiao Chang <junxiao.chang@intel.com>
+Date: Mon, 8 Apr 2019 17:40:22 +0800
+Subject: [PATCH] platform/x86: intel_pmc_ipc: adding error handling
+Git-commit: e61985d0550df8c2078310202aaad9b41049c36c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+If punit or telemetry device initialization fails, pmc driver should
+unregister and return failure.
+
+This change is to fix a kernel panic when removing kernel module
+intel_pmc_ipc.
+
+Fixes: 48c1917088ba ("platform:x86: Add Intel telemetry platform device")
+Signed-off-by: Junxiao Chang <junxiao.chang@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/intel_pmc_ipc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
+index 7964ba22ef8d..d37cbd1cf58c 100644
+--- a/drivers/platform/x86/intel_pmc_ipc.c
++++ b/drivers/platform/x86/intel_pmc_ipc.c
+@@ -771,13 +771,17 @@ static int ipc_create_pmc_devices(void)
+ if (ret) {
+ dev_err(ipcdev.dev, "Failed to add punit platform device\n");
+ platform_device_unregister(ipcdev.tco_dev);
++ return ret;
+ }
+
+ if (!ipcdev.telem_res_inval) {
+ ret = ipc_create_telemetry_device();
+- if (ret)
++ if (ret) {
+ dev_warn(ipcdev.dev,
+ "Failed to add telemetry platform device\n");
++ platform_device_unregister(ipcdev.punit_dev);
++ platform_device_unregister(ipcdev.tco_dev);
++ }
+ }
+
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch b/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch
new file mode 100644
index 0000000000..b650374073
--- /dev/null
+++ b/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch
@@ -0,0 +1,61 @@
+From 0e5e80043b0db4c292aaf0ea86415da6193f861a Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 9 Apr 2019 14:25:15 +0300
+Subject: [PATCH] platform/x86: intel_punit_ipc: Revert "Fix resource ioremap warning"
+Git-commit: 0e5e80043b0db4c292aaf0ea86415da6193f861a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Since we have a proper fix for intel_pmc_ipc driver for resource management,
+get rid of unneeded commit in the intel_punit_ipc driver.
+
+This reverts commit 6cc8cbbc8868033f279b63e98b26b75eaa0006ab.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/intel_punit_ipc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index 79671927f4ef..ab7ae1950867 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -252,28 +252,28 @@ static int intel_punit_get_bars(struct platform_device *pdev)
+ * - GTDRIVER_IPC BASE_IFACE
+ */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[ISPDRIVER_IPC][BASE_DATA] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 3);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[ISPDRIVER_IPC][BASE_IFACE] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 4);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[GTDRIVER_IPC][BASE_DATA] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 5);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[GTDRIVER_IPC][BASE_IFACE] = addr;
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch b/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch
new file mode 100644
index 0000000000..b8e921de15
--- /dev/null
+++ b/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch
@@ -0,0 +1,57 @@
+From 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 24 Apr 2019 13:09:34 -0500
+Subject: [PATCH] platform/x86: sony-laptop: Fix unintentional fall-through
+Git-commit: 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It seems that the default case should return AE_CTRL_TERMINATE, instead
+of falling through to case ACPI_RESOURCE_TYPE_END_TAG and returning AE_OK;
+otherwise the line of code at the end of the function is unreachable and
+makes no sense:
+
+return AE_CTRL_TERMINATE;
+
+This fix is based on the following thread of discussion:
+
+https://lore.kernel.org/patchwork/patch/959782/
+
+Fixes: 33a04454527e ("sony-laptop: Add SNY6001 device handling (sonypi reimplementation)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/sony-laptop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index 4bfbfa3f78e6..2058445fc456 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
+ }
+ return AE_OK;
+ }
++
++ case ACPI_RESOURCE_TYPE_END_TAG:
++ return AE_OK;
++
+ default:
+ dprintk("Resource %d isn't an IRQ nor an IO port\n",
+ resource->type);
++ return AE_CTRL_TERMINATE;
+
+- case ACPI_RESOURCE_TYPE_END_TAG:
+- return AE_OK;
+ }
+- return AE_CTRL_TERMINATE;
+ }
+
+ static int sony_pic_possible_resources(struct acpi_device *device)
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch b/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
new file mode 100644
index 0000000000..3ef35ff60f
--- /dev/null
+++ b/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
@@ -0,0 +1,277 @@
+From 347ab9480313737c0f1aaa08e8f2e1a791235535 Mon Sep 17 00:00:00 2001
+From: Phong Hoang <phong.hoang.wz@renesas.com>
+Date: Tue, 19 Mar 2019 19:40:08 +0900
+Subject: [PATCH] pwm: Fix deadlock warning when removing PWM device
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 347ab9480313737c0f1aaa08e8f2e1a791235535
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This patch fixes deadlock warning if removing PWM device
+when CONFIG_PROVE_LOCKING is enabled.
+
+This issue can be reproceduced by the following steps on
+the R-Car H3 Salvator-X board if the backlight is disabled:
+
+ # cd /sys/class/pwm/pwmchip0
+ # echo 0 > export
+ # ls
+ device export npwm power pwm0 subsystem uevent unexport
+ # cd device/driver
+ # ls
+ bind e6e31000.pwm uevent unbind
+ # echo e6e31000.pwm > unbind
+
+[ 87.659974] ======================================================
+[ 87.666149] WARNING: possible circular locking dependency detected
+[ 87.672327] 5.0.0 #7 Not tainted
+[ 87.675549] ------------------------------------------------------
+[ 87.681723] bash/2986 is trying to acquire lock:
+[ 87.686337] 000000005ea0e178 (kn->count#58){++++}, at: kernfs_remove_by_name_ns+0x50/0xa0
+[ 87.694528]
+[ 87.694528] but task is already holding lock:
+[ 87.700353] 000000006313b17c (pwm_lock){+.+.}, at: pwmchip_remove+0x28/0x13c
+[ 87.707405]
+[ 87.707405] which lock already depends on the new lock.
+[ 87.707405]
+[ 87.715574]
+[ 87.715574] the existing dependency chain (in reverse order) is:
+[ 87.723048]
+[ 87.723048] -> #1 (pwm_lock){+.+.}:
+[ 87.728017] __mutex_lock+0x70/0x7e4
+[ 87.732108] mutex_lock_nested+0x1c/0x24
+[ 87.736547] pwm_request_from_chip.part.6+0x34/0x74
+[ 87.741940] pwm_request_from_chip+0x20/0x40
+[ 87.746725] export_store+0x6c/0x1f4
+[ 87.750820] dev_attr_store+0x18/0x28
+[ 87.754998] sysfs_kf_write+0x54/0x64
+[ 87.759175] kernfs_fop_write+0xe4/0x1e8
+[ 87.763615] __vfs_write+0x40/0x184
+[ 87.767619] vfs_write+0xa8/0x19c
+[ 87.771448] ksys_write+0x58/0xbc
+[ 87.775278] __arm64_sys_write+0x18/0x20
+[ 87.779721] el0_svc_common+0xd0/0x124
+[ 87.783986] el0_svc_compat_handler+0x1c/0x24
+[ 87.788858] el0_svc_compat+0x8/0x18
+[ 87.792947]
+[ 87.792947] -> #0 (kn->count#58){++++}:
+[ 87.798260] lock_acquire+0xc4/0x22c
+[ 87.802353] __kernfs_remove+0x258/0x2c4
+[ 87.806790] kernfs_remove_by_name_ns+0x50/0xa0
+[ 87.811836] remove_files.isra.1+0x38/0x78
+[ 87.816447] sysfs_remove_group+0x48/0x98
+[ 87.820971] sysfs_remove_groups+0x34/0x4c
+[ 87.825583] device_remove_attrs+0x6c/0x7c
+[ 87.830197] device_del+0x11c/0x33c
+[ 87.834201] device_unregister+0x14/0x2c
+[ 87.838638] pwmchip_sysfs_unexport+0x40/0x4c
+[ 87.843509] pwmchip_remove+0xf4/0x13c
+[ 87.847773] rcar_pwm_remove+0x28/0x34
+[ 87.852039] platform_drv_remove+0x24/0x64
+[ 87.856651] device_release_driver_internal+0x18c/0x21c
+[ 87.862391] device_release_driver+0x14/0x1c
+[ 87.867175] unbind_store+0xe0/0x124
+[ 87.871265] drv_attr_store+0x20/0x30
+[ 87.875442] sysfs_kf_write+0x54/0x64
+[ 87.879618] kernfs_fop_write+0xe4/0x1e8
+[ 87.884055] __vfs_write+0x40/0x184
+[ 87.888057] vfs_write+0xa8/0x19c
+[ 87.891887] ksys_write+0x58/0xbc
+[ 87.895716] __arm64_sys_write+0x18/0x20
+[ 87.900154] el0_svc_common+0xd0/0x124
+[ 87.904417] el0_svc_compat_handler+0x1c/0x24
+[ 87.909289] el0_svc_compat+0x8/0x18
+[ 87.913378]
+[ 87.913378] other info that might help us debug this:
+[ 87.913378]
+[ 87.921374] Possible unsafe locking scenario:
+[ 87.921374]
+[ 87.927286] CPU0 CPU1
+[ 87.931808] ---- ----
+[ 87.936331] lock(pwm_lock);
+[ 87.939293] lock(kn->count#58);
+[ 87.945120] lock(pwm_lock);
+[ 87.950599] lock(kn->count#58);
+[ 87.953908]
+[ 87.953908] *** DEADLOCK ***
+[ 87.953908]
+[ 87.959821] 4 locks held by bash/2986:
+[ 87.963563] #0: 00000000ace7bc30 (sb_writers#6){.+.+}, at: vfs_write+0x188/0x19c
+[ 87.971044] #1: 00000000287991b2 (&of->mutex){+.+.}, at: kernfs_fop_write+0xb4/0x1e8
+[ 87.978872] #2: 00000000f739d016 (&dev->mutex){....}, at: device_release_driver_internal+0x40/0x21c
+[ 87.988001] #3: 000000006313b17c (pwm_lock){+.+.}, at: pwmchip_remove+0x28/0x13c
+[ 87.995481]
+[ 87.995481] stack backtrace:
+[ 87.999836] CPU: 0 PID: 2986 Comm: bash Not tainted 5.0.0 #7
+[ 88.005489] Hardware name: Renesas Salvator-X board based on r8a7795 ES1.x (DT)
+[ 88.012791] Call trace:
+[ 88.015235] dump_backtrace+0x0/0x190
+[ 88.018891] show_stack+0x14/0x1c
+[ 88.022204] dump_stack+0xb0/0xec
+[ 88.025514] print_circular_bug.isra.32+0x1d0/0x2e0
+[ 88.030385] __lock_acquire+0x1318/0x1864
+[ 88.034388] lock_acquire+0xc4/0x22c
+[ 88.037958] __kernfs_remove+0x258/0x2c4
+[ 88.041874] kernfs_remove_by_name_ns+0x50/0xa0
+[ 88.046398] remove_files.isra.1+0x38/0x78
+[ 88.050487] sysfs_remove_group+0x48/0x98
+[ 88.054490] sysfs_remove_groups+0x34/0x4c
+[ 88.058580] device_remove_attrs+0x6c/0x7c
+[ 88.062671] device_del+0x11c/0x33c
+[ 88.066154] device_unregister+0x14/0x2c
+[ 88.070070] pwmchip_sysfs_unexport+0x40/0x4c
+[ 88.074421] pwmchip_remove+0xf4/0x13c
+[ 88.078163] rcar_pwm_remove+0x28/0x34
+[ 88.081906] platform_drv_remove+0x24/0x64
+[ 88.085996] device_release_driver_internal+0x18c/0x21c
+[ 88.091215] device_release_driver+0x14/0x1c
+[ 88.095478] unbind_store+0xe0/0x124
+[ 88.099048] drv_attr_store+0x20/0x30
+[ 88.102704] sysfs_kf_write+0x54/0x64
+[ 88.106359] kernfs_fop_write+0xe4/0x1e8
+[ 88.110275] __vfs_write+0x40/0x184
+[ 88.113757] vfs_write+0xa8/0x19c
+[ 88.117065] ksys_write+0x58/0xbc
+[ 88.120374] __arm64_sys_write+0x18/0x20
+[ 88.124291] el0_svc_common+0xd0/0x124
+[ 88.128034] el0_svc_compat_handler+0x1c/0x24
+[ 88.132384] el0_svc_compat+0x8/0x18
+
+The sysfs unexport in pwmchip_remove() is completely asymmetric
+to what we do in pwmchip_add_with_polarity() and commit 0733424c9ba9
+("pwm: Unexport children before chip removal") is a strong indication
+that this was wrong to begin with. We should just move
+pwmchip_sysfs_unexport() where it belongs, which is right after
+pwmchip_sysfs_unexport_children(). In that case, we do not need
+separate functions anymore either.
+
+We also really want to remove sysfs irrespective of whether or not
+the chip will be removed as a result of pwmchip_remove(). We can only
+assume that the driver will be gone after that, so we shouldn't leave
+any dangling sysfs files around.
+
+This warning disappears if we move pwmchip_sysfs_unexport() to
+the top of pwmchip_remove(), pwmchip_sysfs_unexport_children().
+That way it is also outside of the pwm_lock section, which indeed
+doesn't seem to be needed.
+
+Moving the pwmchip_sysfs_export() call outside of that section also
+seems fine and it'd be perfectly symmetric with pwmchip_remove() again.
+
+So, this patch fixes them.
+
+Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
+[shimoda: revise the commit log and code]
+Fixes: 76abbdde2d95 ("pwm: Add sysfs interface")
+Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Hoan Nguyen An <na-hoan@jinso.co.jp>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/core.c | 10 +++++-----
+ drivers/pwm/sysfs.c | 14 +-------------
+ include/linux/pwm.h | 5 -----
+ 3 files changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index 3149204567f3..8c9200a0df5e 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -311,10 +311,12 @@ int pwmchip_add_with_polarity(struct pwm_chip *chip,
+ if (IS_ENABLED(CONFIG_OF))
+ of_pwmchip_add(chip);
+
+- pwmchip_sysfs_export(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
++
++ if (!ret)
++ pwmchip_sysfs_export(chip);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pwmchip_add_with_polarity);
+@@ -348,7 +350,7 @@ int pwmchip_remove(struct pwm_chip *chip)
+ unsigned int i;
+ int ret = 0;
+
+- pwmchip_sysfs_unexport_children(chip);
++ pwmchip_sysfs_unexport(chip);
+
+ mutex_lock(&pwm_lock);
+
+@@ -368,8 +370,6 @@ int pwmchip_remove(struct pwm_chip *chip)
+
+ free_pwms(chip);
+
+- pwmchip_sysfs_unexport(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
+ return ret;
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index ceb233dd6048..13d9bd54dfce 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -409,19 +409,6 @@ void pwmchip_sysfs_export(struct pwm_chip *chip)
+ }
+
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+-{
+- struct device *parent;
+-
+- parent = class_find_device(&pwm_class, NULL, chip,
+- pwmchip_sysfs_match);
+- if (parent) {
+- /* for class_find_device() */
+- put_device(parent);
+- device_unregister(parent);
+- }
+-}
+-
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ {
+ struct device *parent;
+ unsigned int i;
+@@ -439,6 +426,7 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ }
+
+ put_device(parent);
++ device_unregister(parent);
+ }
+
+ static int __init pwm_sysfs_init(void)
+diff --git a/include/linux/pwm.h b/include/linux/pwm.h
+index b628abfffacc..eaa5c6e3fc9f 100644
+--- a/include/linux/pwm.h
++++ b/include/linux/pwm.h
+@@ -596,7 +596,6 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num)
+ #ifdef CONFIG_PWM_SYSFS
+ void pwmchip_sysfs_export(struct pwm_chip *chip);
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip);
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
+ #else
+ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ {
+@@ -605,10 +604,6 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+ {
+ }
+-
+-static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+-{
+-}
+ #endif /* CONFIG_PWM_SYSFS */
+
+ #endif /* __LINUX_PWM_H */
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch b/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
new file mode 100644
index 0000000000..ea93de3c0f
--- /dev/null
+++ b/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
@@ -0,0 +1,54 @@
+From 51496e4446875726d50a5617a6e0e0dabbc2e6da Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 1 Apr 2019 20:18:16 +0200
+Subject: [PATCH] pwm: meson: Consider 128 a valid pre-divider
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 51496e4446875726d50a5617a6e0e0dabbc2e6da
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The pre-divider allows configuring longer PWM periods compared to using
+the input clock directly. The pre-divider is 7 bit wide, meaning it's
+maximum value is 128 (the register value is off-by-one: 0x7f or 127).
+
+Change the loop to also allow for the maximum possible value to be
+considered valid.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index c1ed641b3e26..aaae48ab484e 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -184,7 +184,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ do_div(fin_ps, fin_freq);
+
+ /* Calc pre_div with the period */
+- for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
++ for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
+ cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
+ fin_ps * (pre_div + 1));
+ dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
+@@ -193,7 +193,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ break;
+ }
+
+- if (pre_div == MISC_CLK_DIV_MASK) {
++ if (pre_div > MISC_CLK_DIV_MASK) {
+ dev_err(meson->chip.dev, "unable to get period pre_div\n");
+ return -EINVAL;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch b/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch
new file mode 100644
index 0000000000..f69c349142
--- /dev/null
+++ b/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch
@@ -0,0 +1,44 @@
+From a279345807e1e0ae79567a52cfdd9d30c9174a3c Mon Sep 17 00:00:00 2001
+From: Bichao Zheng <bichao.zheng@amlogic.com>
+Date: Mon, 1 Apr 2019 20:18:17 +0200
+Subject: [PATCH] pwm: meson: Don't disable PWM when setting duty repeatedly
+Git-commit: a279345807e1e0ae79567a52cfdd9d30c9174a3c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+There is an abnormally low about 20ms,when setting duty repeatedly.
+Because setting the duty will disable PWM and then enable. Delete
+this operation now.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
+[ Dropped code instead of hiding it behind a comment ]
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index aaae48ab484e..2ab3d216b35a 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -314,11 +314,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->period != channel->state.period ||
+ state->duty_cycle != channel->state.duty_cycle ||
+ state->polarity != channel->state.polarity) {
+- if (channel->state.enabled) {
+- meson_pwm_disable(meson, pwm->hwpwm);
+- channel->state.enabled = false;
+- }
+-
+ if (state->polarity != channel->state.polarity) {
+ if (state->polarity == PWM_POLARITY_NORMAL)
+ meson->inverter_mask |= BIT(pwm->hwpwm);
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch b/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch
new file mode 100644
index 0000000000..742eba0206
--- /dev/null
+++ b/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch
@@ -0,0 +1,144 @@
+From f173747fffdf037c791405ab4f1ec0eb392fc48e Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 1 Apr 2019 19:57:48 +0200
+Subject: [PATCH] pwm: meson: Use the spin-lock only to protect register modifications
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: f173747fffdf037c791405ab4f1ec0eb392fc48e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Holding the spin-lock for all of the code in meson_pwm_apply() can
+result in a "BUG: scheduling while atomic". This can happen because
+clk_get_rate() (which is called from meson_pwm_calc()) may sleep.
+Only hold the spin-lock when modifying registers to solve this.
+
+The reason why we need a spin-lock in the driver is because the
+REG_MISC_AB register is shared between the two channels provided by one
+PWM controller. The only functions where REG_MISC_AB is modified are
+meson_pwm_enable() and meson_pwm_disable() so the register reads/writes
+in there need to be protected by the spin-lock.
+
+The original code also used the spin-lock to protect the values in
+struct meson_pwm_channel. This could be necessary if two consumers can
+use the same PWM channel. However, PWM core doesn't allow this so we
+don't need to protect the values in struct meson_pwm_channel with a
+lock.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 2ab3d216b35a..e247ab632530 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -111,6 +111,10 @@ struct meson_pwm {
+ const struct meson_pwm_data *data;
+ void __iomem *base;
+ u8 inverter_mask;
++ /*
++ * Protects register (write) access to the REG_MISC_AB register
++ * that is shared between the two PWMs.
++ */
+ spinlock_t lock;
+ };
+
+@@ -235,6 +239,7 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ {
+ u32 value, clk_shift, clk_enable, enable;
+ unsigned int offset;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -255,6 +260,8 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~(MISC_CLK_DIV_MASK << clk_shift);
+ value |= channel->pre_div << clk_shift;
+@@ -267,11 +274,14 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ value = readl(meson->base + REG_MISC_AB);
+ value |= enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ {
+ u32 value, enable;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -286,9 +296,13 @@ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+@@ -296,19 +310,16 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ {
+ struct meson_pwm_channel *channel = pwm_get_chip_data(pwm);
+ struct meson_pwm *meson = to_meson_pwm(chip);
+- unsigned long flags;
+ int err = 0;
+
+ if (!state)
+ return -EINVAL;
+
+- spin_lock_irqsave(&meson->lock, flags);
+-
+ if (!state->enabled) {
+ meson_pwm_disable(meson, pwm->hwpwm);
+ channel->state.enabled = false;
+
+- goto unlock;
++ return 0;
+ }
+
+ if (state->period != channel->state.period ||
+@@ -324,7 +335,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ err = meson_pwm_calc(meson, channel, pwm->hwpwm,
+ state->duty_cycle, state->period);
+ if (err < 0)
+- goto unlock;
++ return err;
+
+ channel->state.polarity = state->polarity;
+ channel->state.period = state->period;
+@@ -336,9 +347,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ channel->state.enabled = true;
+ }
+
+-unlock:
+- spin_unlock_irqrestore(&meson->lock, flags);
+- return err;
++ return 0;
+ }
+
+ static void meson_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch b/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
new file mode 100644
index 0000000000..df57e12413
--- /dev/null
+++ b/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
@@ -0,0 +1,48 @@
+From b00ef53053191d3025c15e8041699f8c9d132daf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christoph=20Vogtl=C3=A4nder?= <c.vogtlaender@sigma-surface-science.com>
+Date: Tue, 12 Mar 2019 14:38:46 +0530
+Subject: [PATCH] pwm: tiehrpwm: Update shadow register for disabling PWMs
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: b00ef53053191d3025c15e8041699f8c9d132daf
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It must be made sure that immediate mode is not already set, when
+modifying shadow register value in ehrpwm_pwm_disable(). Otherwise
+modifications to the action-qualifier continuous S/W force
+register(AQSFRC) will be done in the active register.
+This may happen when both channels are being disabled. In this case,
+only the first channel state will be recorded as disabled in the shadow
+register. Later, when enabling the first channel again, the second
+channel would be enabled as well. Setting RLDCSF to zero, first, ensures
+that the shadow register is updated as desired.
+
+Fixes: 38dabd91ff0b ("pwm: tiehrpwm: Fix disabling of output of PWMs")
+Signed-off-by: Christoph Vogtländer <c.vogtlaender@sigma-surface-science.com>
+[vigneshr@ti.com: Improve commit message]
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-tiehrpwm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index f7b8a86fa5c5..ad4a40c0f27c 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -382,6 +382,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ }
+
+ /* Update shadow register first before modifying active register */
++ ehrpwm_modify(pc->mmio_base, AQSFRC, AQSFRC_RLDCSF_MASK,
++ AQSFRC_RLDCSF_ZRO);
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+ /*
+ * Changes to immediate action on Action Qualifier. This puts
+--
+2.16.4
+
diff --git a/patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch b/patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch
new file mode 100644
index 0000000000..491ea3ab55
--- /dev/null
+++ b/patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch
@@ -0,0 +1,56 @@
+From ac0cdb3d990108df795b676cd0d0e65ac34b2273 Mon Sep 17 00:00:00 2001
+From: Mao Wenan <maowenan@huawei.com>
+Date: Fri, 8 Mar 2019 22:08:31 +0800
+Subject: [PATCH] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
+Git-commit: ac0cdb3d990108df795b676cd0d0e65ac34b2273
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+Add the missing uart_unregister_driver() and i2c_del_driver() before return
+from sc16is7xx_init() in the error handling case.
+
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 635178cf3eed..09a183dfc526 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1507,7 +1507,7 @@ static int __init sc16is7xx_init(void)
+ ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver);
+ if (ret < 0) {
+ pr_err("failed to init sc16is7xx i2c --> %d\n", ret);
+- return ret;
++ goto err_i2c;
+ }
+ #endif
+
+@@ -1515,10 +1515,18 @@ static int __init sc16is7xx_init(void)
+ ret = spi_register_driver(&sc16is7xx_spi_uart_driver);
+ if (ret < 0) {
+ pr_err("failed to init sc16is7xx spi --> %d\n", ret);
+- return ret;
++ goto err_spi;
+ }
+ #endif
+ return ret;
++
++err_spi:
++#ifdef CONFIG_SERIAL_SC16IS7XX_I2C
++ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
++#endif
++err_i2c:
++ uart_unregister_driver(&sc16is7xx_uart);
++ return ret;
+ }
+ module_init(sc16is7xx_init);
+
+--
+2.16.4
+
diff --git a/patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch b/patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch
new file mode 100644
index 0000000000..da56092523
--- /dev/null
+++ b/patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch
@@ -0,0 +1,49 @@
+From e00164a0f000de893944981f41a568c981aca658 Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Tue, 9 Apr 2019 16:16:38 +0800
+Subject: [PATCH] sc16is7xx: move label 'err_spi' to correct section
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: e00164a0f000de893944981f41a568c981aca658
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+err_spi is used when SERIAL_SC16IS7XX_SPI is enabled, so make
+the label only available under SERIAL_SC16IS7XX_SPI option.
+Otherwise, the below warning appears.
+
+drivers/tty/serial/sc16is7xx.c:1523:1: warning: label ‘err_spi’ defined but not used [-Wunused-label]
+ err_spi:
+ ^~~~~~~
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Fixes: ac0cdb3d9901 ("sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 09a183dfc526..22381a8c72e4 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1520,10 +1520,12 @@ static int __init sc16is7xx_init(void)
+ #endif
+ return ret;
+
++#ifdef CONFIG_SERIAL_SC16IS7XX_SPI
+ err_spi:
+ #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+ #endif
++#endif
+ err_i2c:
+ uart_unregister_driver(&sc16is7xx_uart);
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch b/patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch
new file mode 100644
index 0000000000..9106802a4e
--- /dev/null
+++ b/patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch
@@ -0,0 +1,45 @@
+From c53051128bb0e8754e13345d782ca69e5e1ce36d Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Thu, 18 Apr 2019 10:01:55 +0800
+Subject: [PATCH] sc16is7xx: put err_spi and err_i2c into correct #ifdef
+Git-commit: c53051128bb0e8754e13345d782ca69e5e1ce36d
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+err_spi is only called within SERIAL_SC16IS7XX_SPI
+while err_i2c is called inside SERIAL_SC16IS7XX_I2C.
+So we need to put err_spi and err_i2c into each #ifdef
+accordingly.
+
+This change fixes ("sc16is7xx: move label 'err_spi'
+to correct section").
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 22381a8c72e4..a31db15cd7c0 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1522,11 +1522,11 @@ static int __init sc16is7xx_init(void)
+
+ #ifdef CONFIG_SERIAL_SC16IS7XX_SPI
+ err_spi:
++#endif
+ #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+-#endif
+-#endif
+ err_i2c:
++#endif
+ uart_unregister_driver(&sc16is7xx_uart);
+ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch b/patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch
new file mode 100644
index 0000000000..32776f6247
--- /dev/null
+++ b/patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch
@@ -0,0 +1,38 @@
+From 44a5f423e70374e5b42cecd85e78f2d79334e0f2 Mon Sep 17 00:00:00 2001
+From: Maxime Chevallier <maxime.chevallier@smile.fr>
+Date: Wed, 17 Jan 2018 17:15:25 +0100
+Subject: [PATCH] spi: a3700: Clear DATA_OUT when performing a read
+Git-commit: 44a5f423e70374e5b42cecd85e78f2d79334e0f2
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+When performing a read using FIFO mode, the spi controller shifts out
+the last 2 bytes that were written in a previous transfer on MOSI.
+
+This undocumented behaviour can cause devices to misinterpret the
+transfer, so we explicitly clear the WFIFO before each read.
+
+This behaviour was noticed on EspressoBin.
+
+Signed-off-by: Maxime Chevallier <maxime.chevallier@smile.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi-armada-3700.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/spi/spi-armada-3700.c
++++ b/drivers/spi/spi-armada-3700.c
+@@ -668,6 +668,11 @@ static int a3700_spi_transfer_one(struct
+ a3700_spi_pin_mode_set(a3700_spi, nbits, xfer->rx_buf ? true : false);
+
+ if (xfer->rx_buf) {
++ /* Clear WFIFO, since it's last 2 bytes are shifted out during
++ * a read operation
++ */
++ spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, 0);
++
+ /* Set read data length */
+ spireg_write(a3700_spi, A3700_SPI_IF_DIN_CNT_REG,
+ a3700_spi->buf_len);
diff --git a/patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch b/patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch
new file mode 100644
index 0000000000..209ffbc911
--- /dev/null
+++ b/patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch
@@ -0,0 +1,99 @@
+From b2c01aab9646ed8ffb7c549afe55d5349c482425 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 6 Mar 2019 19:56:58 +0800
+Subject: [PATCH] ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
+Git-commit: b2c01aab9646ed8ffb7c549afe55d5349c482425
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Syzkaller report this:
+
+Kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] SMP KASAN PTI
+Cpu: 0 PID: 4492 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Rip: 0010:sysfs_remove_file_ns+0x27/0x70 fs/sysfs/file.c:468
+Code: 00 00 00 41 54 55 48 89 fd 53 49 89 d4 48 89 f3 e8 ee 76 9c ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 2d 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 8b 6d
+Rsp: 0018:ffff8881e9d9fc00 EFLAGS: 00010206
+Rax: dffffc0000000000 RBX: ffffffff900367e0 RCX: ffffffff81a95952
+Rdx: 0000000000000006 RSI: ffffc90001405000 RDI: 0000000000000030
+Rbp: 0000000000000000 R08: fffffbfff1fa22ed R09: fffffbfff1fa22ed
+R10: 0000000000000001 R11: fffffbfff1fa22ec R12: 0000000000000000
+R13: ffffffffc1abdac0 R14: 1ffff1103d3b3f8b R15: 0000000000000000
+Fs: 00007fe409dc1700(0000) GS:ffff8881f1200000(0000) knlGS:0000000000000000
+Cs: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Cr2: 0000001b2d721000 CR3: 00000001e98b6005 CR4: 00000000007606f0
+Dr0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+Dr3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Pkru: 55555554
+Call Trace:
+ sysfs_remove_file include/linux/sysfs.h:519 [inline]
+ driver_remove_file+0x40/0x50 drivers/base/driver.c:122
+ pcmcia_remove_newid_file drivers/pcmcia/ds.c:163 [inline]
+ pcmcia_unregister_driver+0x7d/0x2b0 drivers/pcmcia/ds.c:209
+ ssb_modexit+0xa/0x1b [ssb]
+ __do_sys_delete_module kernel/module.c:1018 [inline]
+ __se_sys_delete_module kernel/module.c:961 [inline]
+ __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+Rip: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+Rsp: 002b:00007fe409dc0c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0
+Rax: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+Rdx: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
+Rbp: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe409dc16bc
+R13: 00000000004bccaa R14: 00000000006f6bc8 R15: 00000000ffffffff
+Modules linked in: ssb(-) 3c59x nvme_core macvlan tap pata_hpt3x3 rt2x00pci null_blk tsc40 pm_notifier_error_inject notifier_error_inject mdio cdc_wdm nf_reject_ipv4 ath9k_common ath9k_hw ath pppox ppp_generic slhc ehci_platform wl12xx wlcore tps6507x_ts ioc4 nf_synproxy_core ide_gd_mod ax25 can_dev iwlwifi can_raw atm tm2_touchkey can_gw can sundance adp5588_keys rt2800mmio rt2800lib rt2x00mmio rt2x00lib eeprom_93cx6 pn533 lru_cache elants_i2c ip_set nfnetlink gameport tipc hampshire nhc_ipv6 nhc_hop nhc_udp nhc_fragment nhc_routing nhc_mobility nhc_dest 6lowpan silead brcmutil nfc mt76_usb mt76 mac80211 iptable_security iptable_raw iptable_mangle iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_gre sit hsr veth vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon vcan bridge stp llc ip6_gre ip6_tunnel tunnel6 tun joydev mousedev serio_raw ide_pci_generic piix floppy ide_core sch_fq_codel ip_tables x_tables ipv6
+ [last unloaded: 3c59x]
+Dumping ftrace buffer:
+ (ftrace buffer empty)
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---[ end trace 3913cbf8011e1c05 ]---
+
+In ssb_modinit, it does not fail SSB init when ssb_host_pcmcia_init failed,
+however in ssb_modexit, ssb_host_pcmcia_exit calls pcmcia_unregister_driver
+unconditionally, which may tigger a NULL pointer dereference issue as above.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 399500da18f7 ("ssb: pick PCMCIA host code support from b43 driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/ssb/bridge_pcmcia_80211.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ssb/bridge_pcmcia_80211.c b/drivers/ssb/bridge_pcmcia_80211.c
+index f51f150307df..ffa379efff83 100644
+--- a/drivers/ssb/bridge_pcmcia_80211.c
++++ b/drivers/ssb/bridge_pcmcia_80211.c
+@@ -113,16 +113,21 @@ static struct pcmcia_driver ssb_host_pcmcia_driver = {
+ .resume = ssb_host_pcmcia_resume,
+ };
+
++static int pcmcia_init_failed;
++
+ /*
+ * These are not module init/exit functions!
+ * The module_pcmcia_driver() helper cannot be used here.
+ */
+ int ssb_host_pcmcia_init(void)
+ {
+- return pcmcia_register_driver(&ssb_host_pcmcia_driver);
++ pcmcia_init_failed = pcmcia_register_driver(&ssb_host_pcmcia_driver);
++
++ return pcmcia_init_failed;
+ }
+
+ void ssb_host_pcmcia_exit(void)
+ {
+- pcmcia_unregister_driver(&ssb_host_pcmcia_driver);
++ if (!pcmcia_init_failed)
++ pcmcia_unregister_driver(&ssb_host_pcmcia_driver);
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch b/patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch
new file mode 100644
index 0000000000..095d58d072
--- /dev/null
+++ b/patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch
@@ -0,0 +1,92 @@
+From 747668dbc061b3e62bc1982767a3a1f9815fcf0e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 15 Apr 2019 13:19:25 -0400
+Subject: [PATCH] usb-storage: Set virt_boundary_mask to avoid SG overflows
+Git-commit: 747668dbc061b3e62bc1982767a3a1f9815fcf0e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The USB subsystem has always had an unusual requirement for its
+scatter-gather transfers: Each element in the scatterlist (except the
+last one) must have a length divisible by the bulk maxpacket size.
+This is a particular issue for USB mass storage, which uses SG lists
+created by the block layer rather than setting up its own.
+
+So far we have scraped by okay because most devices have a logical
+block size of 512 bytes or larger, and the bulk maxpacket sizes for
+USB 2 and below are all <= 512. However, USB 3 has a bulk maxpacket
+size of 1024. Since the xhci-hcd driver includes native SG support,
+this hasn't mattered much. But now people are trying to use USB-3
+mass storage devices with USBIP, and the vhci-hcd driver currently
+does not have full SG support.
+
+The result is an overflow error, when the driver attempts to implement
+an SG transfer of 63 512-byte blocks as a single
+3584-byte (7 blocks) transfer followed by seven 4096-byte (8 blocks)
+transfers. The device instead sends 31 1024-byte packets followed by
+a 512-byte packet, and this overruns the first SG buffer.
+
+Ideally this would be fixed by adding better SG support to vhci-hcd.
+But for now it appears we can work around the problem by
+asking the block layer to respect the maxpacket limitation, through
+the use of the virt_boundary_mask.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Seth Bollinger <Seth.Bollinger@digi.com>
+Tested-by: Seth Bollinger <Seth.Bollinger@digi.com>
+Cc: Ming Lei <tom.leiming@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/storage/scsiglue.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index a73ea495d5a7..59190d88fa9f 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -65,6 +65,7 @@ static const char* host_info(struct Scsi_Host *host)
+ static int slave_alloc (struct scsi_device *sdev)
+ {
+ struct us_data *us = host_to_us(sdev->host);
++ int maxp;
+
+ /*
+ * Set the INQUIRY transfer length to 36. We don't use any of
+@@ -74,20 +75,17 @@ static int slave_alloc (struct scsi_device *sdev)
+ sdev->inquiry_len = 36;
+
+ /*
+- * USB has unusual DMA-alignment requirements: Although the
+- * starting address of each scatter-gather element doesn't matter,
+- * the length of each element except the last must be divisible
+- * by the Bulk maxpacket value. There's currently no way to
+- * express this by block-layer constraints, so we'll cop out
+- * and simply require addresses to be aligned at 512-byte
+- * boundaries. This is okay since most block I/O involves
+- * hardware sectors that are multiples of 512 bytes in length,
+- * and since host controllers up through USB 2.0 have maxpacket
+- * values no larger than 512.
+- *
+- * But it doesn't suffice for Wireless USB, where Bulk maxpacket
+- * values can be as large as 2048. To make that work properly
+- * will require changes to the block layer.
++ * USB has unusual scatter-gather requirements: the length of each
++ * scatterlist element except the last must be divisible by the
++ * Bulk maxpacket value. Fortunately this value is always a
++ * power of 2. Inform the block layer about this requirement.
++ */
++ maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0);
++ blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
++
++ /*
++ * Some host controllers may have alignment requirements.
++ * We'll play it safe by requiring 512-byte alignment always.
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
+--
+2.16.4
+
diff --git a/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch b/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch
index b92d55bb53..643bb857f6 100644
--- a/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch
+++ b/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch
@@ -4,7 +4,7 @@ Date: Fri, 11 Jan 2019 13:58:53 +0800
Subject: drm/i915/gvt: Fix mmap range check
Git-commit: 51b00d8509dc69c98740da2ad07308b630d3eb7d
Patch-mainline: v5.0-rc3
-References: bsc#1120902
+References: bsc#1120902, CVE-2019-11085, bsc#1135278
This is to fix missed mmap range check on vGPU bar2 region
and only allow to map vGPU allocated GMADDR range, which means
diff --git a/patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch b/patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch
new file mode 100644
index 0000000000..63913ed9a6
--- /dev/null
+++ b/patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch
@@ -0,0 +1,39 @@
+From 2bfc4975083ace0e5777116514c3a75e59b3dbcd Mon Sep 17 00:00:00 2001
+From: Colin Xu <colin.xu@intel.com>
+Date: Mon, 1 Apr 2019 14:13:53 +0800
+Subject: drm/i915/gvt: Fix incorrect mask of mmio 0x22028 in gen8/9 mmio list
+Git-commit: 2bfc4975083ace0e5777116514c3a75e59b3dbcd
+Patch-mainline: v5.2-rc1
+References: bnc#1113722
+
+According to GFX PRM on 01.org, bit 31:16 of mmio 0x22028 should be masks.
+
+Fixes: 178657139307 ("drm/i915/gvt: vGPU context switch")
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Colin Xu <colin.xu@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/gvt/mmio_context.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
++++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
+@@ -79,7 +79,7 @@ static struct engine_mmio gen8_engine_mm
+ {BCS, RING_MI_MODE(BLT_RING_BASE), 0xffff, false}, /* 0x2209c */
+ {BCS, RING_INSTPM(BLT_RING_BASE), 0xffff, false}, /* 0x220c0 */
+ {BCS, RING_HWSTAM(BLT_RING_BASE), 0x0, false}, /* 0x22098 */
+- {BCS, RING_EXCC(BLT_RING_BASE), 0x0, false}, /* 0x22028 */
++ {BCS, RING_EXCC(BLT_RING_BASE), 0xffff, false}, /* 0x22028 */
+ {RCS, INVALID_MMIO_REG, 0, false } /* Terminated */
+ };
+
+@@ -130,7 +130,7 @@ static struct engine_mmio gen9_engine_mm
+ {BCS, RING_MI_MODE(BLT_RING_BASE), 0xffff, false}, /* 0x2209c */
+ {BCS, RING_INSTPM(BLT_RING_BASE), 0xffff, false}, /* 0x220c0 */
+ {BCS, RING_HWSTAM(BLT_RING_BASE), 0x0, false}, /* 0x22098 */
+- {BCS, RING_EXCC(BLT_RING_BASE), 0x0, false}, /* 0x22028 */
++ {BCS, RING_EXCC(BLT_RING_BASE), 0xffff, false}, /* 0x22028 */
+
+ {VCS2, RING_EXCC(GEN8_BSD2_RING_BASE), 0xffff, false}, /* 0x1c028 */
+
diff --git a/patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch b/patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch
new file mode 100644
index 0000000000..b575b39a69
--- /dev/null
+++ b/patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch
@@ -0,0 +1,53 @@
+From 852ce7285c99e3f7b56e76511e1b33c645a2b648 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Mon, 8 Apr 2019 11:01:37 +0200
+Subject: drm/meson: add size and alignment requirements for dumb buffers
+Git-commit: 852ce7285c99e3f7b56e76511e1b33c645a2b648
+Patch-mainline: v5.2-rc1
+References: bnc#1113722
+
+The Amlogic SoCs Canvas buffers stride must be aligned on 64bytes
+and overall size should be aligned on PAGE width.
+
+Adds a custom dumb_create op to adds these requirements.
+
+Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
+Suggested-by: Sky Zhou <sky.zhou@amlogic.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Sky Zhou <sky.zhou@amlogic.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190408090137.2402-1-narmstrong@baylibre.com
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -93,6 +93,18 @@ static irqreturn_t meson_irq(int irq, vo
+ return IRQ_HANDLED;
+ }
+
++static int meson_dumb_create(struct drm_file *file, struct drm_device *dev,
++ struct drm_mode_create_dumb *args)
++{
++ /*
++ * We need 64bytes aligned stride, and PAGE aligned size
++ */
++ args->pitch = ALIGN(DIV_ROUND_UP(args->width * args->bpp, 8), SZ_64);
++ args->size = PAGE_ALIGN(args->pitch * args->height);
++
++ return drm_gem_cma_dumb_create_internal(file, dev, args);
++}
++
+ DEFINE_DRM_GEM_CMA_FOPS(fops);
+
+ static struct drm_driver meson_driver = {
+@@ -115,7 +127,7 @@ static struct drm_driver meson_driver =
+ .gem_prime_mmap = drm_gem_cma_prime_mmap,
+
+ /* GEM Ops */
+- .dumb_create = drm_gem_cma_dumb_create,
++ .dumb_create = meson_dumb_create,
+ .gem_free_object_unlocked = drm_gem_cma_free_object,
+ .gem_vm_ops = &drm_gem_cma_vm_ops,
+
diff --git a/patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch b/patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch
new file mode 100644
index 0000000000..85fc07e12d
--- /dev/null
+++ b/patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch
@@ -0,0 +1,57 @@
+From 65a102f68005891d7f39354cfd79099908df6d51 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Tue, 26 Mar 2019 18:55:32 +0100
+Subject: [PATCH] drm/fb-helper: dpms_legacy(): Only set on connectors in use
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 65a102f68005891d7f39354cfd79099908df6d51
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+For each enabled crtc the functions sets dpms on all registered connectors.
+Limit this to only doing it once and on the connectors actually in use.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Fixes: 023eb571a1d0 ("drm: correctly update connector DPMS status in drm_fb_helper")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190326175546.18126-3-noralf@tronnes.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index a6d88f8b7a52..0d8384e30e16 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -639,20 +639,19 @@ static struct sysrq_key_op sysrq_drm_fb_helper_restore_op = { };
+ static void dpms_legacy(struct drm_fb_helper *fb_helper, int dpms_mode)
+ {
+ struct drm_device *dev = fb_helper->dev;
+- struct drm_crtc *crtc;
+ struct drm_connector *connector;
++ struct drm_mode_set *modeset;
+ int i, j;
+
+ drm_modeset_lock_all(dev);
+ for (i = 0; i < fb_helper->crtc_count; i++) {
+- crtc = fb_helper->crtc_info[i].mode_set.crtc;
++ modeset = &fb_helper->crtc_info[i].mode_set;
+
+- if (!crtc->enabled)
++ if (!modeset->crtc->enabled)
+ continue;
+
+- /* Walk the connectors & encoders on this fb turning them on/off */
+- drm_fb_helper_for_each_connector(fb_helper, j) {
+- connector = fb_helper->connector_info[j]->connector;
++ for (j = 0; j < modeset->num_connectors; j++) {
++ connector = modeset->connectors[j];
+ connector->funcs->dpms(connector, dpms_mode);
+ drm_object_property_set_value(&connector->base,
+ dev->mode_config.dpms_property, dpms_mode);
+--
+2.16.4
+
diff --git a/patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch b/patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch
new file mode 100644
index 0000000000..5ce2396909
--- /dev/null
+++ b/patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch
@@ -0,0 +1,42 @@
+From d90c06d57027203f73021bb7ddb30b800d65c636 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 1 Mar 2019 14:03:47 +0000
+Subject: [PATCH] drm/i915: Fix I915_EXEC_RING_MASK
+Git-commit: d90c06d57027203f73021bb7ddb30b800d65c636
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This was supposed to be a mask of all known rings, but it is being used
+by execbuffer to filter out invalid rings, and so is instead mapping high
+unused values onto valid rings. Instead of a mask of all known rings,
+we need it to be the mask of all possible rings.
+
+Fixes: 549f7365820a ("drm/i915: Enable SandyBridge blitter ring")
+Fixes: de1add360522 ("drm/i915: Decouple execbuf uAPI from internal implementation")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: <stable@vger.kernel.org> # v4.6+
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190301140404.26690-21-chris@chris-wilson.co.uk
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/uapi/drm/i915_drm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
+index b10eea3f6d24..1a60642c1d61 100644
+--- a/include/uapi/drm/i915_drm.h
++++ b/include/uapi/drm/i915_drm.h
+@@ -979,7 +979,7 @@ struct drm_i915_gem_execbuffer2 {
+ * struct drm_i915_gem_exec_fence *fences.
+ */
+ __u64 cliprects_ptr;
+-#define I915_EXEC_RING_MASK (7<<0)
++#define I915_EXEC_RING_MASK (0x3f)
+ #define I915_EXEC_DEFAULT (0<<0)
+ #define I915_EXEC_RENDER (1<<0)
+ #define I915_EXEC_BSD (2<<0)
+--
+2.16.4
+
diff --git a/patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch b/patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch
new file mode 100644
index 0000000000..5cdf570357
--- /dev/null
+++ b/patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch
@@ -0,0 +1,48 @@
+From 2ae2c3316fb77dcf64275d011596b60104c45426 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 4 Apr 2019 00:04:09 +0800
+Subject: [PATCH] drm/mediatek: fix possible object reference leak
+Git-commit: 2ae2c3316fb77dcf64275d011596b60104c45426
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The call to of_parse_phandle returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+drivers/gpu/drm/mediatek/mtk_hdmi.c:1521:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function.
+drivers/gpu/drm/mediatek/mtk_hdmi.c:1524:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-mediatek@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 543a25e5765e..e04e6c293d39 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1515,6 +1515,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ of_node_put(remote);
+
+ hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
++ of_node_put(i2c_np);
+ if (!hdmi->ddc_adpt) {
+ dev_err(dev, "Failed to get ddc i2c adapter by node\n");
+ return -EINVAL;
+--
+2.16.4
+
diff --git a/patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch b/patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch
new file mode 100644
index 0000000000..bb379c2f0e
--- /dev/null
+++ b/patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch
@@ -0,0 +1,74 @@
+From b8f9d7f37b6af829c34c49d1a4f73ce6ed58e403 Mon Sep 17 00:00:00 2001
+From: Vicente Bergas <vicencb@gmail.com>
+Date: Tue, 2 Apr 2019 13:37:53 +0200
+Subject: [PATCH] drm/rockchip: shutdown drm subsystem on shutdown
+Git-commit: b8f9d7f37b6af829c34c49d1a4f73ce6ed58e403
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+As explained by Robin Murphy:
+> the IOMMU shutdown disables paging, so if the VOP is still
+> scanning out then that will result in whatever IOVAs it was using now going
+> straight out onto the bus as physical addresses.
+
+We had a more radical approach before in commit
+7f3ef5dedb14 ("drm/rockchip: Allow driver to be shutdown on reboot/kexec")
+but that resulted in new warnings and oopses on shutdown on rk3399
+chromeos devices.
+
+So second try is resurrecting Vicentes shutdown change which should
+achieve the same result but in a less drastic way.
+
+Fixes: 63238173b2fa ("Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"")
+Cc: Jeffy Chen <jeffy.chen@rock-chips.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Doug Anderson <dianders@chromium.org>
+Cc: stable@vger.kernel.org
+Suggested-by: JeffyChen <jeffy.chen@rock-chips.com>
+Suggested-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+[adapted commit message to explain the history]
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Tested-by: Brian Norris <briannorris@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190402113753.10118-1-heiko@sntech.de
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+index 8d7a634c12c2..cb938d3cd3c2 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -448,6 +448,14 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ struct drm_device *drm = platform_get_drvdata(pdev);
++
++ if (drm)
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -457,6 +465,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
+--
+2.16.4
+
diff --git a/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch b/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
index a1afb3c4ac..ca0ac6e584 100644
--- a/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
+++ b/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
@@ -102,24 +102,25 @@ Fixes: f64d5ca86821 ("btrfs: delayed_ref: Add new function to record reserved sp
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
---
- fs/btrfs/delayed-ref.c | 12 ++++--------
+ fs/btrfs/delayed-ref.c | 14 ++++----------
fs/btrfs/delayed-ref.h | 11 -----------
fs/btrfs/extent-tree.c | 3 ---
fs/btrfs/qgroup.c | 19 +++++++++++++++----
fs/btrfs/qgroup.h | 18 +++++++++++-------
include/trace/events/btrfs.h | 29 -----------------------------
- 6 files changed, 30 insertions(+), 62 deletions(-)
+ 6 files changed, 30 insertions(+), 64 deletions(-)
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
-@@ -618,14 +618,12 @@ add_delayed_ref_head(struct btrfs_fs_inf
- INIT_LIST_HEAD(&head_ref->ref_add_list);
+@@ -590,15 +590,13 @@ static void init_delayed_ref_head(struct
+ RB_CLEAR_NODE(&head_ref->href_node);
head_ref->processing = 0;
head_ref->total_ref_mod = count_mod;
- head_ref->qgroup_reserved = 0;
- head_ref->qgroup_ref_root = 0;
+ spin_lock_init(&head_ref->lock);
+ mutex_init(&head_ref->mutex);
- /* Record qgroup extent info if provided */
if (qrecord) {
if (ref_root && reserved) {
- head_ref->qgroup_ref_root = ref_root;
@@ -129,16 +130,18 @@ Signed-off-by: David Sterba <dsterba@suse.com>
}
qrecord->bytenr = bytenr;
-@@ -647,8 +645,6 @@ add_delayed_ref_head(struct btrfs_fs_inf
+@@ -641,10 +639,6 @@ add_delayed_ref_head(struct btrfs_fs_inf
existing = htree_insert(&delayed_refs->href_root,
&head_ref->href_node);
if (existing) {
-- WARN_ON(ref_root && reserved && existing->qgroup_ref_root
+- WARN_ON(qrecord && head_ref->qgroup_ref_root
+- && head_ref->qgroup_reserved
+- && existing->qgroup_ref_root
- && existing->qgroup_reserved);
- update_existing_head_ref(delayed_refs, &existing->node, ref,
+ update_existing_head_ref(delayed_refs, existing, head_ref,
old_ref_mod);
/*
-@@ -815,7 +811,7 @@ int btrfs_add_delayed_tree_ref(struct bt
+@@ -764,7 +758,7 @@ int btrfs_add_delayed_tree_ref(struct bt
if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) &&
is_fstree(ref_root)) {
@@ -147,7 +150,7 @@ Signed-off-by: David Sterba <dsterba@suse.com>
if (!record)
goto free_head_ref;
}
-@@ -878,7 +874,7 @@ int btrfs_add_delayed_data_ref(struct bt
+@@ -848,7 +842,7 @@ int btrfs_add_delayed_data_ref(struct bt
if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) &&
is_fstree(ref_root)) {
@@ -158,8 +161,8 @@ Signed-off-by: David Sterba <dsterba@suse.com>
kmem_cache_free(btrfs_delayed_ref_head_cachep,
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
-@@ -116,17 +116,6 @@ struct btrfs_delayed_ref_head {
- int total_ref_mod;
+@@ -115,17 +115,6 @@ struct btrfs_delayed_ref_head {
+ int ref_mod;
/*
- * For qgroup reserved space freeing.
@@ -178,16 +181,16 @@ Signed-off-by: David Sterba <dsterba@suse.com>
* until the delayed ref is processed. must_insert_reserved is
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
-@@ -2465,9 +2465,6 @@ static int run_one_delayed_ref(struct bt
- }
+@@ -2563,9 +2563,6 @@ static int cleanup_ref_head(struct btrfs
}
-
-- /* Also free its reserved qgroup space */
-- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
-- head->qgroup_reserved);
- return ret;
}
+- /* Also free its reserved qgroup space */
+- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
+- head->qgroup_reserved);
+ btrfs_delayed_ref_unlock(head);
+ btrfs_put_delayed_ref_head(head);
+ return 0;
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1488,12 +1488,18 @@ int btrfs_qgroup_trace_extent_nolock(str
@@ -269,7 +272,7 @@ Signed-off-by: David Sterba <dsterba@suse.com>
int btrfs_verify_qgroup_counts(struct btrfs_fs_info *fs_info, u64 qgroupid,
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
-@@ -1516,35 +1516,6 @@ DEFINE_EVENT(btrfs__qgroup_rsv_data, btr
+@@ -1513,35 +1513,6 @@ DEFINE_EVENT(btrfs__qgroup_rsv_data, btr
TP_ARGS(inode, start, len, reserved, op)
);
diff --git a/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch b/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch
index 4dae97abe4..4d5eb8d080 100644
--- a/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch
+++ b/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch
@@ -1,8 +1,9 @@
From e8fd2e459649ab5105cc627018dd25ea395719de Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Mon, 18 Mar 2019 10:37:22 +0800
-Patch-mainline: Submitted, for v5.1
-References: bsc#1129497
+Patch-mainline: v5.2-rc1
+Git-commit: 10995c0491204c861948c9850939a7f4e90760a4
+References: bsc#1129497 bsc#1134651
Subject: [PATCH] btrfs: reloc: Fix NULL pointer dereference due to expanded
reloc_root lifespan
diff --git a/patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch b/patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch
new file mode 100644
index 0000000000..af7026daec
--- /dev/null
+++ b/patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch
@@ -0,0 +1,37 @@
+From 822dd046d7e22a8d01728200a003da230e4c6f7f Mon Sep 17 00:00:00 2001
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Tue, 7 May 2019 17:35:55 +0200
+Subject: [PATCH] dt-bindings: net: Fix a typo in the phy-mode list for
+ ethernet bindings
+Git-commit: 822dd046d7e22a8d01728200a003da230e4c6f7f
+Patch-mainline: v5.1
+References: bsc#1129770
+
+The phy_mode "2000base-x" is actually supposed to be "1000base-x", even
+though the commit title of the original patch says otherwise.
+
+Fixes: 55601a880690 ("net: phy: Add 2000base-x, 2500base-x and rxaui modes")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Reviewed-by: Fabian Baumanis <fabian.baumanis@suse.com>
+---
+ Documentation/devicetree/bindings/net/ethernet.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/net/ethernet.txt b/Documentation/devicetree/bindings/net/ethernet.txt
+index a68621580584..d45b5b56fa39 100644
+--- a/Documentation/devicetree/bindings/net/ethernet.txt
++++ b/Documentation/devicetree/bindings/net/ethernet.txt
+@@ -36,7 +36,7 @@ Documentation/devicetree/bindings/phy/phy-bindings.txt.
+ * "smii"
+ * "xgmii"
+ * "trgmii"
+- * "2000base-x",
++ * "1000base-x",
+ * "2500base-x",
+ * "rxaui"
+ * "xaui"
+--
+2.16.4
+
diff --git a/patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch b/patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch
new file mode 100644
index 0000000000..408b10e725
--- /dev/null
+++ b/patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch
@@ -0,0 +1,61 @@
+From c1ced46c7b49ad7bc064e68d966e0ad303f917fb Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 8 Apr 2019 05:52:38 -0400
+Subject: [PATCH] media: pvrusb2: Prevent a buffer overflow
+Git-commit: c1ced46c7b49ad7bc064e68d966e0ad303f917fb
+Patch-mainline: v5.1
+References: bsc#1129770
+
+The ctrl_check_input() function is called from pvr2_ctrl_range_check().
+It's supposed to validate user supplied input and return true or false
+depending on whether the input is valid or not. The problem is that
+negative shifts or shifts greater than 31 are undefined in C. In
+practice with GCC they result in shift wrapping so this function returns
+true for some inputs which are not valid and this could result in a
+buffer overflow:
+
+ drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname()
+ warn: uncapped user index 'names[val]'
+
+The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create()
+and the highest valid bit is BIT(4).
+
+Fixes: 7fb20fa38caa ("V4L/DVB (7299): pvrusb2: Improve logic which handles input choice availability")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 ++
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 51112b7988e4..816c85786c2a 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -666,6 +666,8 @@ static int ctrl_get_input(struct pvr2_ctrl *cptr,int *vp)
+
+ static int ctrl_check_input(struct pvr2_ctrl *cptr,int v)
+ {
++ if (v < 0 || v > PVR2_CVAL_INPUT_MAX)
++ return 0;
+ return ((1 << v) & cptr->hdw->input_allowed_mask) != 0;
+ }
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
+index 25648add77e5..bd2b7a67b732 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
+@@ -50,6 +50,7 @@
+ #define PVR2_CVAL_INPUT_COMPOSITE 2
+ #define PVR2_CVAL_INPUT_SVIDEO 3
+ #define PVR2_CVAL_INPUT_RADIO 4
++#define PVR2_CVAL_INPUT_MAX PVR2_CVAL_INPUT_RADIO
+
+ enum pvr2_config {
+ pvr2_config_empty, /* No configuration */
+--
+2.16.4
+
diff --git a/patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch b/patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch
new file mode 100644
index 0000000000..14339e2271
--- /dev/null
+++ b/patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch
@@ -0,0 +1,73 @@
+From 2b75ebeea6f4937d4d05ec4982c471cef9a29b7f Mon Sep 17 00:00:00 2001
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Tue, 19 Mar 2019 17:18:07 +0000
+Subject: [PATCH] mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary
+ on read/write
+Git-commit: 2b75ebeea6f4937d4d05ec4982c471cef9a29b7f
+Patch-mainline: v5.1
+References: bsc#1129770
+
+It was observed that reads crossing 4K address boundary are failing.
+
+This limitation is mentioned in Intel documents:
+
+Intel(R) 9 Series Chipset Family Platform Controller Hub (PCH) Datasheet:
+
+"5.26.3 Flash Access
+Program Register Access:
+* Program Register Accesses are not allowed to cross a 4 KB boundary..."
+
+Enhanced Serial Peripheral Interface (eSPI)
+Interface Base Specification (for Client and Server Platforms):
+
+"5.1.4 Address
+For other memory transactions, the address may start or end at any byte
+boundary. However, the address and payload length combination must not
+cross the naturally aligned address boundary of the corresponding Maximum
+Payload Size. It must not cross a 4 KB address boundary."
+
+Avoid this by splitting an operation crossing the boundary into two
+operations.
+
+Fixes: 8afda8b26d01 ("spi-nor: Add support for Intel SPI serial flash controller")
+Cc: stable@vger.kernel.org
+Reported-by: Romain Porte <romain.porte@nokia.com>
+Tested-by: Pascal Fabreges <pascal.fabreges@nokia.com>
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/mtd/spi-nor/intel-spi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/mtd/spi-nor/intel-spi.c b/drivers/mtd/spi-nor/intel-spi.c
+index af0a22019516..d60cbf23d9aa 100644
+--- a/drivers/mtd/spi-nor/intel-spi.c
++++ b/drivers/mtd/spi-nor/intel-spi.c
+@@ -632,6 +632,10 @@ static ssize_t intel_spi_read(struct spi_nor *nor, loff_t from, size_t len,
+ while (len > 0) {
+ block_size = min_t(size_t, len, INTEL_SPI_FIFO_SZ);
+
++ /* Read cannot cross 4K boundary */
++ block_size = min_t(loff_t, from + block_size,
++ round_up(from + 1, SZ_4K)) - from;
++
+ writel(from, ispi->base + FADDR);
+
+ val = readl(ispi->base + HSFSTS_CTL);
+@@ -685,6 +689,10 @@ static ssize_t intel_spi_write(struct spi_nor *nor, loff_t to, size_t len,
+ while (len > 0) {
+ block_size = min_t(size_t, len, INTEL_SPI_FIFO_SZ);
+
++ /* Write cannot cross 4K boundary */
++ block_size = min_t(loff_t, to + block_size,
++ round_up(to + 1, SZ_4K)) - to;
++
+ writel(to, ispi->base + FADDR);
+
+ val = readl(ispi->base + HSFSTS_CTL);
+--
+2.16.4
+
diff --git a/patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch b/patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch
new file mode 100644
index 0000000000..39873058a0
--- /dev/null
+++ b/patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch
@@ -0,0 +1,186 @@
+From: Aurelien Aptel <aaptel@suse.com>
+Date: Fri, 29 Mar 2019 10:49:12 +0100
+Subject: [PATCH] CIFS: keep FileInfo handle live during oplock break
+Git-commit: b98749cac4a695f084a5ff076f4510b23e353ecd
+References: bsc#1106284, bsc#1131565
+Patch-mainline: v5.1-rc6
+
+In the oplock break handler, writing pending changes from pages puts
+the FileInfo handle. If the refcount reaches zero it closes the handle
+and waits for any oplock break handler to return, thus causing a deadlock.
+
+To prevent this situation:
+
+* We add a wait flag to cifsFileInfo_put() to decide whether we should
+ wait for running/pending oplock break handlers
+
+* We keep an additionnal reference of the SMB FileInfo handle so that
+ for the rest of the handler putting the handle won't close it.
+ - The ref is bumped everytime we queue the handler via the
+ cifs_queue_oplock_break() helper.
+ - The ref is decremented at the end of the handler
+
+This bug was triggered by xfstest 464.
+
+Also important fix to address the various reports of
+oops in smb2_push_mandatory_locks
+
+Signed-off-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+---
+ fs/cifs/cifsglob.h | 2 ++
+ fs/cifs/file.c | 30 +++++++++++++++++++++++++-----
+ fs/cifs/misc.c | 25 +++++++++++++++++++++++--
+ fs/cifs/smb2misc.c | 6 +++---
+ 4 files changed, 53 insertions(+), 10 deletions(-)
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 5b18d4585740..585ad3207cb1 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1333,6 +1333,7 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
+ }
+
+ struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file);
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr);
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+
+ #define CIFS_CACHE_READ_FLG 1
+@@ -1855,6 +1856,7 @@ GLOBAL_EXTERN spinlock_t gidsidlock;
+ #endif /* CONFIG_CIFS_ACL */
+
+ void cifs_oplock_break(struct work_struct *work);
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile);
+
+ extern const struct slow_work_ops cifs_oplock_break_ops;
+ extern struct workqueue_struct *cifsiod_wq;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 89006e044973..9c0ccc06d172 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -360,12 +360,30 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file)
+ return cifs_file;
+ }
+
+-/*
+- * Release a reference on the file private data. This may involve closing
+- * the filehandle out on the server. Must be called without holding
+- * tcon->open_file_lock and cifs_file->file_info_lock.
++/**
++ * cifsFileInfo_put - release a reference of file priv data
++ *
++ * Always potentially wait for oplock handler. See _cifsFileInfo_put().
+ */
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
++{
++ _cifsFileInfo_put(cifs_file, true);
++}
++
++/**
++ * _cifsFileInfo_put - release a reference of file priv data
++ *
++ * This may involve closing the filehandle @cifs_file out on the
++ * server. Must be called without holding tcon->open_file_lock and
++ * cifs_file->file_info_lock.
++ *
++ * If @wait_for_oplock_handler is true and we are releasing the last
++ * reference, wait for any running oplock break handler of the file
++ * and cancel any pending one. If calling this function from the
++ * oplock break handler, you need to pass false.
++ *
++ */
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ {
+ struct inode *inode = d_inode(cifs_file->dentry);
+ struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+@@ -414,7 +432,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+
+ spin_unlock(&tcon->open_file_lock);
+
+- oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
++ oplock_break_cancelled = wait_oplock_handler ?
++ cancel_work_sync(&cifs_file->oplock_break) : false;
+
+ if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ struct TCP_Server_Info *server = tcon->ses->server;
+@@ -4603,6 +4622,7 @@ void cifs_oplock_break(struct work_struct *work)
+ cinode);
+ cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+ }
++ _cifsFileInfo_put(cfile, false /* do not wait for ourself */);
+ cifs_done_oplock_break(cinode);
+ }
+
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index bee203055b30..1e1626a2cfc3 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -501,8 +501,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &pCifsInode->flags);
+
+- queue_work(cifsoplockd_wq,
+- &netfile->oplock_break);
++ cifs_queue_oplock_break(netfile);
+ netfile->oplock_break_cancelled = false;
+
+ spin_unlock(&tcon->open_file_lock);
+@@ -607,6 +606,28 @@ void cifs_put_writer(struct cifsInodeInfo *cinode)
+ spin_unlock(&cinode->writers_lock);
+ }
+
++/**
++ * cifs_queue_oplock_break - queue the oplock break handler for cfile
++ *
++ * This function is called from the demultiplex thread when it
++ * receives an oplock break for @cfile.
++ *
++ * Assumes the tcon->open_file_lock is held.
++ * Assumes cfile->file_info_lock is NOT held.
++ */
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile)
++{
++ /*
++ * Bump the handle refcount now while we hold the
++ * open_file_lock to enforce the validity of it for the oplock
++ * break handler. The matching put is done at the end of the
++ * handler.
++ */
++ cifsFileInfo_get(cfile);
++
++ queue_work(cifsoplockd_wq, &cfile->oplock_break);
++}
++
+ void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
+ {
+ clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 0e3570e40ff8..e311f58dc1c8 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -555,7 +555,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+
+- queue_work(cifsoplockd_wq, &cfile->oplock_break);
++ cifs_queue_oplock_break(cfile);
+ kfree(lw);
+ return true;
+ }
+@@ -712,8 +712,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+ spin_unlock(&cfile->file_info_lock);
+- queue_work(cifsoplockd_wq,
+- &cfile->oplock_break);
++
++ cifs_queue_oplock_break(cfile);
+
+ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+--
+2.16.4
+
+
diff --git a/patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch b/patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch
deleted file mode 100644
index 8f2f809fd5..0000000000
--- a/patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Hannes Reinecke <hare@suse.de>
-Date: Wed, 20 Mar 2019 08:58:07 +0100
-Subject: [PATCH] block_dev: fix crash on chained bios with O_DIRECT
-Patch-Mainline: submitted linux-block 2019/03/20
-References: bsc#1128094
-
-__blkdev_direct_IO_simple() is allocating a bio on the stack.
-When that bio needs to be split bio_chain_endio() invokes bio_put()
-on this bio, causing the kernel to crash in mempool_free() as the
-bio was never allocated from a mempool in the first place.
-So call bio_get() before submitting to avoid this problem.
-
-Signed-off-by: Hannes Reinecke <hare@suse.com>
----
- fs/block_dev.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 7a9a14df1d82..4acd35663ae7 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -256,6 +256,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
- task_io_account_write(ret);
- }
-
-+ bio_get(&bio);
- qc = submit_bio(&bio);
- for (;;) {
- set_current_state(TASK_UNINTERRUPTIBLE);
-@@ -275,7 +276,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
-
- if (unlikely(bio.bi_status))
- ret = blk_status_to_errno(bio.bi_status);
--
-+ bio_put(&bio);
- out:
- if (vecs != inline_vecs)
- kfree(vecs);
---
-2.16.4
-
diff --git a/patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch b/patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch
new file mode 100644
index 0000000000..83779f34ed
--- /dev/null
+++ b/patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch
@@ -0,0 +1,56 @@
+From 8cf7630b29701d364f8df4a50e4f1f5e752b2778 Mon Sep 17 00:00:00 2001
+From: Zev Weiss <zev@bewilderbeest.net>
+Date: Mon, 11 Mar 2019 23:28:02 -0700
+Subject: [PATCH] kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
+Git-commit: 8cf7630b29701d364f8df4a50e4f1f5e752b2778
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+This bug has apparently existed since the introduction of this function
+in the pre-git era (4500e91754d3 in Thomas Gleixner's history.git,
+"[net]: Add proc_dointvec_userhz_jiffies, use it for proper handling of
+neighbour sysctls.").
+
+As a minimal fix we can simply duplicate the corresponding check in
+do_proc_dointvec_conv().
+
+Link: http://lkml.kernel.org/r/20190207123426.9202-3-zev@bewilderbeest.net
+Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
+Cc: Brendan Higgins <brendanhiggins@google.com>
+Cc: Iurii Zaikin <yzaikin@google.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: <stable@vger.kernel.org> [2.6.2+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/sysctl.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 7bb3988425ee..0854197e0e67 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2645,7 +2645,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
+ {
+ struct do_proc_dointvec_minmax_conv_param *param = data;
+ if (write) {
+- int val = *negp ? -*lvalp : *lvalp;
++ int val;
++ if (*negp) {
++ if (*lvalp > (unsigned long) INT_MAX + 1)
++ return -EINVAL;
++ val = -*lvalp;
++ } else {
++ if (*lvalp > (unsigned long) INT_MAX)
++ return -EINVAL;
++ val = *lvalp;
++ }
+ if ((param->min && *param->min > val) ||
+ (param->max && *param->max < val))
+ return -EINVAL;
+--
+2.16.4
+
diff --git a/patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch b/patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch
new file mode 100644
index 0000000000..2060de230a
--- /dev/null
+++ b/patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch
@@ -0,0 +1,93 @@
+From 9002b21465fa4d829edfc94a5a441005cffaa972 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 5 Apr 2019 18:39:38 -0700
+Subject: [PATCH] kernel/sysctl.c: fix out-of-bounds access when setting file-max
+Git-commit: 9002b21465fa4d829edfc94a5a441005cffaa972
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+Commit 32a5ad9c2285 ("sysctl: handle overflow for file-max") hooked up
+min/max values for the file-max sysctl parameter via the .extra1 and
+.extra2 fields in the corresponding struct ctl_table entry.
+
+Unfortunately, the minimum value points at the global 'zero' variable,
+which is an int. This results in a KASAN splat when accessed as a long
+by proc_doulongvec_minmax on 64-bit architectures:
+
+ | BUG: KASAN: global-out-of-bounds in __do_proc_doulongvec_minmax+0x5d8/0x6a0
+ | Read of size 8 at addr ffff2000133d1c20 by task systemd/1
+ |
+ | CPU: 0 PID: 1 Comm: systemd Not tainted 5.1.0-rc3-00012-g40b114779944 #2
+ | Hardware name: linux,dummy-virt (DT)
+ | Call trace:
+ | dump_backtrace+0x0/0x228
+ | show_stack+0x14/0x20
+ | dump_stack+0xe8/0x124
+ | print_address_description+0x60/0x258
+ | kasan_report+0x140/0x1a0
+ | __asan_report_load8_noabort+0x18/0x20
+ | __do_proc_doulongvec_minmax+0x5d8/0x6a0
+ | proc_doulongvec_minmax+0x4c/0x78
+ | proc_sys_call_handler.isra.19+0x144/0x1d8
+ | proc_sys_write+0x34/0x58
+ | __vfs_write+0x54/0xe8
+ | vfs_write+0x124/0x3c0
+ | ksys_write+0xbc/0x168
+ | __arm64_sys_write+0x68/0x98
+ | el0_svc_common+0x100/0x258
+ | el0_svc_handler+0x48/0xc0
+ | el0_svc+0x8/0xc
+ |
+ | The buggy address belongs to the variable:
+ | zero+0x0/0x40
+ |
+ | Memory state around the buggy address:
+ | ffff2000133d1b00: 00 00 00 00 00 00 00 00 fa fa fa fa 04 fa fa fa
+ | ffff2000133d1b80: fa fa fa fa 04 fa fa fa fa fa fa fa 04 fa fa fa
+ | >ffff2000133d1c00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
+ | ^
+ | ffff2000133d1c80: fa fa fa fa 00 fa fa fa fa fa fa fa 00 00 00 00
+ | ffff2000133d1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+
+Fix the splat by introducing a unsigned long 'zero_ul' and using that
+instead.
+
+Link: http://lkml.kernel.org/r/20190403153409.17307-1-will.deacon@arm.com
+Fixes: 32a5ad9c2285 ("sysctl: handle overflow for file-max")
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Christian Brauner <christian@brauner.io>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/sysctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index e5da394d1ca3..c9ec050bcf46 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -128,6 +128,7 @@ static int zero;
+ static int __maybe_unused one = 1;
+ static int __maybe_unused two = 2;
+ static int __maybe_unused four = 4;
++static unsigned long zero_ul;
+ static unsigned long one_ul = 1;
+ static unsigned long long_max = LONG_MAX;
+ static int one_hundred = 100;
+@@ -1750,7 +1751,7 @@ static struct ctl_table fs_table[] = {
+ .maxlen = sizeof(files_stat.max_files),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+- .extra1 = &zero,
++ .extra1 = &zero_ul,
+ .extra2 = &long_max,
+ },
+ {
+--
+2.16.4
+
diff --git a/patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch b/patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch
new file mode 100644
index 0000000000..bfbac90a9e
--- /dev/null
+++ b/patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch
@@ -0,0 +1,72 @@
+From a0fe2c6479aab5723239b315ef1b552673f434a3 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Fri, 29 Mar 2019 22:46:49 +0100
+Subject: [PATCH] linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
+Git-commit: a0fe2c6479aab5723239b315ef1b552673f434a3
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Use parentheses around uses of the argument in u64_to_user_ptr() to
+ensure that the cast doesn't apply to part of the argument.
+
+There are existing uses of the macro of the form
+
+ u64_to_user_ptr(A + B)
+
+which expands to
+
+ (void __user *)(uintptr_t)A + B
+
+(the cast applies to the first operand of the addition, the addition
+is a pointer addition). This happens to still work as intended, the
+semantic difference doesn't cause a difference in behavior.
+
+But I want to use u64_to_user_ptr() with a ternary operator in the
+argument, like so:
+
+ u64_to_user_ptr(A ? B : C)
+
+This currently doesn't work as intended.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Cc: Andrei Vagin <avagin@openvz.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qiaowei Ren <qiaowei.ren@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20190329214652.258477-1-jannh@google.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/kernel.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 34a5036debd3..2d14e21c16c0 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -47,8 +47,8 @@
+
+ #define u64_to_user_ptr(x) ( \
+ { \
+- typecheck(u64, x); \
+- (void __user *)(uintptr_t)x; \
++ typecheck(u64, (x)); \
++ (void __user *)(uintptr_t)(x); \
+ } \
+ )
+
+--
+2.16.4
+
diff --git a/patches.fixes/md-batch-flush-requests.patch b/patches.fixes/md-batch-flush-requests.patch
index a31b1e8f36..e8985ce383 100644
--- a/patches.fixes/md-batch-flush-requests.patch
+++ b/patches.fixes/md-batch-flush-requests.patch
@@ -2,8 +2,7 @@ From: NeilBrown <neilb@suse.com>
Date: Fri, 29 Mar 2019 10:46:17 -0700
Subject: [PATCH] md: batch flush requests.
Git-commit: 2bc13b83e6298486371761de503faeffd15b7534
-Git-repo: git://git.kernel.dk/linux-block.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.2-rc1
References: bsc#1119680
Currently if many flush requests are submitted to an md device is quick
diff --git a/patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch b/patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch
new file mode 100644
index 0000000000..bb5d3efa51
--- /dev/null
+++ b/patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch
@@ -0,0 +1,143 @@
+From: Mao Wenan <maowenan@huawei.com>
+Date: Thu, 28 Mar 2019 17:10:56 +0800
+Subject: net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().
+Patch-mainline: v5.1-rc4
+Git-commit: cb66ddd156203daefb8d71158036b27b0e2caf63
+References: CVE-2019-11815 bsc#1134537
+
+When it is to cleanup net namespace, rds_tcp_exit_net() will call
+rds_tcp_kill_sock(), if t_sock is NULL, it will not call
+rds_conn_destroy(), rds_conn_path_destroy() and rds_tcp_conn_free() to free
+connection, and the worker cp_conn_w is not stopped, afterwards the net is freed in
+net_drop_ns(); While cp_conn_w rds_connect_worker() will call rds_tcp_conn_path_connect()
+and reference 'net' which has already been freed.
+
+In rds_tcp_conn_path_connect(), rds_tcp_set_callbacks() will set t_sock = sock before
+sock->ops->connect, but if connect() is failed, it will call
+rds_tcp_restore_callbacks() and set t_sock = NULL, if connect is always
+failed, rds_connect_worker() will try to reconnect all the time, so
+rds_tcp_kill_sock() will never to cancel worker cp_conn_w and free the
+connections.
+
+Therefore, the condition !tc->t_sock is not needed if it is going to do
+cleanup_net->rds_tcp_exit_net->rds_tcp_kill_sock, because tc->t_sock is always
+NULL, and there is on other path to cancel cp_conn_w and free
+connection. So this patch is to fix this.
+
+rds_tcp_kill_sock():
+...
+if (net != c_net || !tc->t_sock)
+...
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+
+==================================================================
+BUG: KASAN: use-after-free in inet_create+0xbcc/0xd28
+net/ipv4/af_inet.c:340
+Read of size 4 at addr ffff8003496a4684 by task kworker/u8:4/3721
+
+CPU: 3 PID: 3721 Comm: kworker/u8:4 Not tainted 5.1.0 #11
+Hardware name: linux,dummy-virt (DT)
+Workqueue: krdsd rds_connect_worker
+Call trace:
+ dump_backtrace+0x0/0x3c0 arch/arm64/kernel/time.c:53
+ show_stack+0x28/0x38 arch/arm64/kernel/traps.c:152
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x120/0x188 lib/dump_stack.c:113
+ print_address_description+0x68/0x278 mm/kasan/report.c:253
+ kasan_report_error mm/kasan/report.c:351 [inline]
+ kasan_report+0x21c/0x348 mm/kasan/report.c:409
+ __asan_report_load4_noabort+0x30/0x40 mm/kasan/report.c:429
+ inet_create+0xbcc/0xd28 net/ipv4/af_inet.c:340
+ __sock_create+0x4f8/0x770 net/socket.c:1276
+ sock_create_kern+0x50/0x68 net/socket.c:1322
+ rds_tcp_conn_path_connect+0x2b4/0x690 net/rds/tcp_connect.c:114
+ rds_connect_worker+0x108/0x1d0 net/rds/threads.c:175
+ process_one_work+0x6e8/0x1700 kernel/workqueue.c:2153
+ worker_thread+0x3b0/0xdd0 kernel/workqueue.c:2296
+ kthread+0x2f0/0x378 kernel/kthread.c:255
+ ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1117
+
+Allocated by task 687:
+ save_stack mm/kasan/kasan.c:448 [inline]
+ set_track mm/kasan/kasan.c:460 [inline]
+ kasan_kmalloc+0xd4/0x180 mm/kasan/kasan.c:553
+ kasan_slab_alloc+0x14/0x20 mm/kasan/kasan.c:490
+ slab_post_alloc_hook mm/slab.h:444 [inline]
+ slab_alloc_node mm/slub.c:2705 [inline]
+ slab_alloc mm/slub.c:2713 [inline]
+ kmem_cache_alloc+0x14c/0x388 mm/slub.c:2718
+ kmem_cache_zalloc include/linux/slab.h:697 [inline]
+ net_alloc net/core/net_namespace.c:384 [inline]
+ copy_net_ns+0xc4/0x2d0 net/core/net_namespace.c:424
+ create_new_namespaces+0x300/0x658 kernel/nsproxy.c:107
+ unshare_nsproxy_namespaces+0xa0/0x198 kernel/nsproxy.c:206
+ ksys_unshare+0x340/0x628 kernel/fork.c:2577
+ __do_sys_unshare kernel/fork.c:2645 [inline]
+ __se_sys_unshare kernel/fork.c:2643 [inline]
+ __arm64_sys_unshare+0x38/0x58 kernel/fork.c:2643
+ __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
+ invoke_syscall arch/arm64/kernel/syscall.c:47 [inline]
+ el0_svc_common+0x168/0x390 arch/arm64/kernel/syscall.c:83
+ el0_svc_handler+0x60/0xd0 arch/arm64/kernel/syscall.c:129
+ el0_svc+0x8/0xc arch/arm64/kernel/entry.S:960
+
+Freed by task 264:
+ save_stack mm/kasan/kasan.c:448 [inline]
+ set_track mm/kasan/kasan.c:460 [inline]
+ __kasan_slab_free+0x114/0x220 mm/kasan/kasan.c:521
+ kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528
+ slab_free_hook mm/slub.c:1370 [inline]
+ slab_free_freelist_hook mm/slub.c:1397 [inline]
+ slab_free mm/slub.c:2952 [inline]
+ kmem_cache_free+0xb8/0x3a8 mm/slub.c:2968
+ net_free net/core/net_namespace.c:400 [inline]
+ net_drop_ns.part.6+0x78/0x90 net/core/net_namespace.c:407
+ net_drop_ns net/core/net_namespace.c:406 [inline]
+ cleanup_net+0x53c/0x6d8 net/core/net_namespace.c:569
+ process_one_work+0x6e8/0x1700 kernel/workqueue.c:2153
+ worker_thread+0x3b0/0xdd0 kernel/workqueue.c:2296
+ kthread+0x2f0/0x378 kernel/kthread.c:255
+ ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1117
+
+The buggy address belongs to the object at ffff8003496a3f80
+ which belongs to the cache net_namespace of size 7872
+The buggy address is located 1796 bytes inside of
+ 7872-byte region [ffff8003496a3f80, ffff8003496a5e40)
+The buggy address belongs to the page:
+page:ffff7e000d25a800 count:1 mapcount:0 mapping:ffff80036ce4b000
+index:0x0 compound_mapcount: 0
+flags: 0xffffe0000008100(slab|head)
+raw: 0ffffe0000008100 dead000000000100 dead000000000200 ffff80036ce4b000
+raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8003496a4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8003496a4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+>ffff8003496a4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff8003496a4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8003496a4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+
+Fixes: 467fa15356ac("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Kubecek <mkubecek@suse.cz>
+
+---
+ net/rds/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -509,7 +509,7 @@ static void rds_tcp_kill_sock(struct net *net)
+ list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+ struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+
+- if (net != c_net || !tc->t_sock)
++ if (net != c_net)
+ continue;
+ if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
+ list_move_tail(&tc->t_tcp_node, &tmp_list);
diff --git a/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch b/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
index 9fe8cb20d6..f066dbf5a6 100644
--- a/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
+++ b/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
@@ -1,8 +1,12 @@
+From 8a03b27ea61c2ab9de16a8a195822ef05e799748 Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
-Date: Fri, 29 Mar 2019 10:57:54 +0100
+Date: Fri, 3 May 2019 15:37:35 +0200
Subject: [PATCH] nvme-multipath: avoid crash on invalid subsystem cntlid
enumeration
-Patch-Mainline: submitted linux-nvme 2019/04/04
+
+Git-commit: 8a03b27ea61c2ab9de16a8a195822ef05e799748
+Patch-Mainline: queued in subsystem maintainer repository
+Git-repo: git://git.infradead.org/nvme.git
References: bsc#1129273
A process holding an open reference to a removed disk prevents it
@@ -11,12 +15,14 @@ gendisk creation may have the same cntlid which risks collision when
using that for the name. Use the unique ctrl->instance instead.
Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
---
drivers/nvme/host/multipath.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
-index f0716f6ce41f..2551264ef2b5 100644
+index 5c9429d41120..499acf07d61a 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -31,7 +31,7 @@ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
@@ -29,5 +35,5 @@ index f0716f6ce41f..2551264ef2b5 100644
} else {
sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance,
--
-2.16.4
+2.20.1
diff --git a/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch b/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
index 67fa11cf5e..da6a698744 100644
--- a/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
+++ b/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
@@ -3,8 +3,7 @@ Date: Tue, 30 Apr 2019 18:57:09 +0200
Subject: [PATCH] nvme-multipath: split bios with the ns_head bio_set before
submitting
Git-commit: 525aa5a705d86e193726ee465d1a975265fabf19
-Git-repo: git://git.infradead.org/nvme.git
-Patch-Mainline: queued in subsystem maintainer tree
+Patch-Mainline: v5.2-rc1
References: bsc#1103259, bsc#1131673
If the bio is moved to a different queue via blk_steal_bios() and
diff --git a/patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch b/patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch
new file mode 100644
index 0000000000..d3de7d9dc5
--- /dev/null
+++ b/patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch
@@ -0,0 +1,82 @@
+From 3955333df9a50e8783d115613a397ae55d905080 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Fri, 11 May 2018 16:01:57 -0700
+Subject: [PATCH] proc/kcore: don't bounds check against address 0
+Git-commit: 3955333df9a50e8783d115613a397ae55d905080
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+The existing kcore code checks for bad addresses against __va(0) with
+the assumption that this is the lowest address on the system. This may
+not hold true on some systems (e.g. arm64) and produce overflows and
+crashes. Switch to using other functions to validate the address range.
+
+It's currently only seen on arm64 and it's not clear if anyone wants to
+use that particular combination on a stable release. So this is not
+urgent for stable.
+
+Link: http://lkml.kernel.org/r/20180501201143.15121-1-labbott@redhat.com
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Tested-by: Dave Anderson <anderson@redhat.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>a
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/proc/kcore.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index d1e82761de81..e64ecb9f2720 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -209,25 +209,34 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg)
+ {
+ struct list_head *head = (struct list_head *)arg;
+ struct kcore_list *ent;
++ struct page *p;
++
++ if (!pfn_valid(pfn))
++ return 1;
++
++ p = pfn_to_page(pfn);
++ if (!memmap_valid_within(pfn, p, page_zone(p)))
++ return 1;
+
+ ent = kmalloc(sizeof(*ent), GFP_KERNEL);
+ if (!ent)
+ return -ENOMEM;
+- ent->addr = (unsigned long)__va((pfn << PAGE_SHIFT));
++ ent->addr = (unsigned long)page_to_virt(p);
+ ent->size = nr_pages << PAGE_SHIFT;
+
+- /* Sanity check: Can happen in 32bit arch...maybe */
+- if (ent->addr < (unsigned long) __va(0))
++ if (!virt_addr_valid(ent->addr))
+ goto free_out;
+
+ /* cut not-mapped area. ....from ppc-32 code. */
+ if (ULONG_MAX - ent->addr < ent->size)
+ ent->size = ULONG_MAX - ent->addr;
+
+- /* cut when vmalloc() area is higher than direct-map area */
+- if (VMALLOC_START > (unsigned long)__va(0)) {
+- if (ent->addr > VMALLOC_START)
+- goto free_out;
++ /*
++ * We've already checked virt_addr_valid so we know this address
++ * is a valid pointer, therefore we can check against it to determine
++ * if we need to trim
++ */
++ if (VMALLOC_START > ent->addr) {
+ if (VMALLOC_START - ent->addr < ent->size)
+ ent->size = VMALLOC_START - ent->addr;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch b/patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch
new file mode 100644
index 0000000000..a90c5ee9c1
--- /dev/null
+++ b/patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch
@@ -0,0 +1,51 @@
+From 2e0ad552f5f8cd0fda02bc45fcd2b89821c62fd1 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Fri, 20 Apr 2018 14:56:03 -0700
+Subject: [PATCH] proc: revalidate kernel thread inodes to root:root
+Git-commit: 2e0ad552f5f8cd0fda02bc45fcd2b89821c62fd1
+Patch-mainline: v4.17-rc2
+References: bsc#1051510
+
+task_dump_owner() has the following code:
+
+ mm = task->mm;
+ if (mm) {
+ if (get_dumpable(mm) != SUID_DUMP_USER) {
+ uid = ...
+ }
+ }
+
+Check for ->mm is buggy -- kernel thread might be borrowing mm
+and inode will go to some random uid:gid pair.
+
+Link: http://lkml.kernel.org/r/20180412220109.GA20978@avx2
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/proc/base.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index eafa39a3a88c..1b2ede6abcdf 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode,
+ kuid_t uid;
+ kgid_t gid;
+
++ if (unlikely(task->flags & PF_KTHREAD)) {
++ *ruid = GLOBAL_ROOT_UID;
++ *rgid = GLOBAL_ROOT_GID;
++ return;
++ }
++
+ /* Default to the tasks effective ownership */
+ rcu_read_lock();
+ cred = __task_cred(task);
+--
+2.16.4
+
diff --git a/patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch b/patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch
new file mode 100644
index 0000000000..45ab1411ed
--- /dev/null
+++ b/patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch
@@ -0,0 +1,106 @@
+From 09be178400829dddc1189b50a7888495dd26aa84 Mon Sep 17 00:00:00 2001
+From: Cheng Lin <cheng.lin130@zte.com.cn>
+Date: Thu, 3 Jan 2019 15:26:13 -0800
+Subject: [PATCH] proc/sysctl: fix return error for proc_doulongvec_minmax()
+Git-commit: 09be178400829dddc1189b50a7888495dd26aa84
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+If the number of input parameters is less than the total parameters, an
+EINVAL error will be returned.
+
+For example, we use proc_doulongvec_minmax to pass up to two parameters
+with kern_table:
+
+{
+ .procname = "monitor_signals",
+ .data = &monitor_sigs,
+ .maxlen = 2*sizeof(unsigned long),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+},
+
+Reproduce:
+
+When passing two parameters, it's work normal. But passing only one
+parameter, an error "Invalid argument"(EINVAL) is returned.
+
+ [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 1 2
+ [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
+ -bash: echo: write error: Invalid argument
+ [root@cl150 ~]# echo $?
+ 1
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 3 2
+ [root@cl150 ~]#
+
+The following is the result after apply this patch. No error is
+returned when the number of input parameters is less than the total
+parameters.
+
+ [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 1 2
+ [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
+ [root@cl150 ~]# echo $?
+ 0
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 3 2
+ [root@cl150 ~]#
+
+There are three processing functions dealing with digital parameters,
+__do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax.
+
+This patch deals with __do_proc_doulongvec_minmax, just as
+__do_proc_dointvec does, adding a check for parameters 'left'. In
+__do_proc_douintvec, its code implementation explicitly does not support
+multiple inputs.
+
+static int __do_proc_douintvec(...){
+ ...
+ /*
+ * Arrays are not supported, keep this simple. *Do not* add
+ * support for them.
+ */
+ if (vleft != 1) {
+ *lenp = 0;
+ return -EINVAL;
+ }
+ ...
+}
+
+So, just __do_proc_doulongvec_minmax has the problem. And most use of
+proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one
+parameter.
+
+Link: http://lkml.kernel.org/r/1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn
+Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/sysctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 1825f712e73b..7f6c1a3b3485 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2787,6 +2787,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ bool neg;
+
+ left -= proc_skip_spaces(&p);
++ if (!left)
++ break;
+
+ err = proc_get_long(&p, &left, &val, &neg,
+ proc_wspace_sep,
+--
+2.16.4
+
diff --git a/patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch b/patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch
new file mode 100644
index 0000000000..729629f11c
--- /dev/null
+++ b/patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch
@@ -0,0 +1,85 @@
+From 60b8cdf315ea4731ef66a69669f9727e739c6e17 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Thu, 9 May 2019 15:07:48 +0200
+Subject: [PATCH] qla2xxx: always allocate qla_tgt_wq
+References: bsc#1131451
+Patch-Mainline: submitted linux-scsi 2019/05/09
+
+The 'qla_tgt_wq' workqueue is used for generic command aborts,
+not just target-related functions. So allocate the workqueue
+always to avoid a kernel crash when aborting commands.
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 403f96583e3f..1339a647805a 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -7423,6 +7423,13 @@ int __init qlt_init(void)
+ return -EINVAL;
+ }
+
++ qla_tgt_wq = alloc_workqueue("qla_tgt_wq", 0, 0);
++ if (!qla_tgt_wq) {
++ ql_log(ql_log_fatal, NULL, 0xe06f,
++ "alloc_workqueue for qla_tgt_wq failed\n");
++ return -ENOMEM;
++ }
++
+ if (!QLA_TGT_MODE_ENABLED())
+ return 0;
+
+@@ -7432,7 +7439,8 @@ int __init qlt_init(void)
+ if (!qla_tgt_mgmt_cmd_cachep) {
+ ql_log(ql_log_fatal, NULL, 0xd04b,
+ "kmem_cache_create for qla_tgt_mgmt_cmd_cachep failed\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto out_workqueue;
+ }
+
+ qla_tgt_plogi_cachep = kmem_cache_create("qla_tgt_plogi_cachep",
+@@ -7455,33 +7463,27 @@ int __init qlt_init(void)
+ goto out_plogi_cachep;
+ }
+
+- qla_tgt_wq = alloc_workqueue("qla_tgt_wq", 0, 0);
+- if (!qla_tgt_wq) {
+- ql_log(ql_log_fatal, NULL, 0xe06f,
+- "alloc_workqueue for qla_tgt_wq failed\n");
+- ret = -ENOMEM;
+- goto out_cmd_mempool;
+- }
+ /*
+ * Return 1 to signal that initiator-mode is being disabled
+ */
+ return (ql2x_ini_mode == QLA2XXX_INI_MODE_DISABLED) ? 1 : 0;
+
+-out_cmd_mempool:
+- mempool_destroy(qla_tgt_mgmt_cmd_mempool);
+ out_plogi_cachep:
+ kmem_cache_destroy(qla_tgt_plogi_cachep);
+ out_mgmt_cmd_cachep:
+ kmem_cache_destroy(qla_tgt_mgmt_cmd_cachep);
++out_workqueue:
++ destroy_workqueue(qla_tgt_wq);
+ return ret;
+ }
+
+ void qlt_exit(void)
+ {
++ destroy_workqueue(qla_tgt_wq);
++
+ if (!QLA_TGT_MODE_ENABLED())
+ return;
+
+- destroy_workqueue(qla_tgt_wq);
+ mempool_destroy(qla_tgt_mgmt_cmd_mempool);
+ kmem_cache_destroy(qla_tgt_plogi_cachep);
+ kmem_cache_destroy(qla_tgt_mgmt_cmd_cachep);
+--
+2.16.4
+
diff --git a/patches.fixes/scripts-override-locale-from-environment-when-runnin.patch b/patches.fixes/scripts-override-locale-from-environment-when-runnin.patch
new file mode 100644
index 0000000000..8cd7a39e5a
--- /dev/null
+++ b/patches.fixes/scripts-override-locale-from-environment-when-runnin.patch
@@ -0,0 +1,43 @@
+From e46b94d228458aefc2553ee7c34ab18c2e3288e3 Mon Sep 17 00:00:00 2001
+From: Daniel Dadap <ddadap@nvidia.com>
+Date: Sat, 27 Apr 2019 11:21:34 -0400
+Subject: [PATCH] scripts: override locale from environment when running recordmcount.pl
+Git-commit: e46b94d228458aefc2553ee7c34ab18c2e3288e3
+Patch-mainline: v5.2-rc1
+References: bsc#1134354
+
+recordmcount.pl uses a set of regular expressions to parse the output of
+objdump(1). However, if objdump(1) output is localized, it may not match
+the regular expressions, thereby preventing recordmcount.pl from parsing
+object files correctly.
+
+In order to allow recordmcount.pl to function correctly regardless of the
+current locale settings, set LANG=C when running objdump(1). LC_ALL is
+already unset in the top-level Makefile, so it is not necessary to also
+override that environment variable.
+
+Signed-off-by: Daniel Dadap <ddadap@nvidia.com>
+Reviewed-by: Robert Morell <rmorell@nvidia.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/recordmcount.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 68841d01162c..ffea46287f83 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -493,7 +493,7 @@ sub update_funcs
+ #
+ # Step 2: find the sections and mcount call sites
+ #
+-open(IN, "$objdump -hdr $inputfile|") || die "error running $objdump";
++open(IN, "LANG=C $objdump -hdr $inputfile|") || die "error running $objdump";
+
+ my $text;
+
+--
+2.16.4
+
diff --git a/patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp b/patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp
new file mode 100644
index 0000000000..275b1ccadf
--- /dev/null
+++ b/patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp
@@ -0,0 +1,64 @@
+From dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <paulo@paulo.ac>
+Date: Sun, 24 Feb 2019 21:55:28 -0300
+Git-commit: dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e
+Patch-mainline: v5.1
+References: bsc#1134810
+Subject: selinux: use kernel linux/socket.h for genheaders and mdp
+
+When compiling genheaders and mdp from a newer host kernel, the
+following error happens:
+
+ In file included from scripts/selinux/genheaders/genheaders.c:18:
+ ./security/selinux/include/classmap.h:238:2: error: #error New
+ address family defined, please update secclass_map. #error New
+ address family defined, please update secclass_map. ^~~~~
+ make[3]: *** [scripts/Makefile.host:107:
+ scripts/selinux/genheaders/genheaders] Error 1 make[2]: ***
+ [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2
+ make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2
+ make[1]: *** Waiting for unfinished jobs....
+
+Instead of relying on the host definition, include linux/socket.h in
+classmap.h to have PF_MAX.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Paulo Alcantara <paulo@paulo.ac>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+[PM: manually merge in mdp.c, subject line tweaks]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+---
+ scripts/selinux/genheaders/genheaders.c | 1 -
+ scripts/selinux/mdp/mdp.c | 1 -
+ security/selinux/include/classmap.h | 1 +
+ 3 files changed, 1 insertion(+), 2 deletions(-)
+
+--- a/scripts/selinux/genheaders/genheaders.c
++++ b/scripts/selinux/genheaders/genheaders.c
+@@ -8,7 +8,6 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <ctype.h>
+-#include <sys/socket.h>
+
+ struct security_class_mapping {
+ const char *name;
+--- a/scripts/selinux/mdp/mdp.c
++++ b/scripts/selinux/mdp/mdp.c
+@@ -32,7 +32,6 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <string.h>
+-#include <sys/socket.h>
+
+ static void usage(char *name)
+ {
+--- a/security/selinux/include/classmap.h
++++ b/security/selinux/include/classmap.h
+@@ -1,4 +1,5 @@
+ #include <linux/capability.h>
++#include <linux/socket.h>
+
+ #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
+ "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append"
diff --git a/patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch b/patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch
new file mode 100644
index 0000000000..f66cb88c0a
--- /dev/null
+++ b/patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch
@@ -0,0 +1,40 @@
+From 60e7f2c3fe9919cee9534b422865eed49f4efb15 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Tue, 30 Apr 2019 17:49:28 -0500
+Subject: [PATCH] vfio/mdev: Avoid release parent reference during error path
+Git-commit: 60e7f2c3fe9919cee9534b422865eed49f4efb15
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+During mdev parent registration in mdev_register_device(),
+if parent device is duplicate, it releases the reference of existing
+parent device.
+This is incorrect. Existing parent device should not be touched.
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/mdev/mdev_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index b96fedc77ee5..1299d2e72ce2 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -181,6 +181,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
+ /* Check for duplicate */
+ parent = __find_parent_device(dev);
+ if (parent) {
++ parent = NULL;
+ ret = -EEXIST;
+ goto add_dev_err;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch b/patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch
new file mode 100644
index 0000000000..10f8724bda
--- /dev/null
+++ b/patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch
@@ -0,0 +1,77 @@
+From 6093e348a5e2475c5bb2e571346460f939998670 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Tue, 30 Apr 2019 17:49:33 -0500
+Subject: [PATCH] vfio/mdev: Fix aborting mdev child device removal if one fails
+Git-commit: 6093e348a5e2475c5bb2e571346460f939998670
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+device_for_each_child() stops executing callback function for remaining
+child devices, if callback hits an error.
+Each child mdev device is independent of each other.
+While unregistering parent device, mdev core must remove all child mdev
+devices.
+Therefore, mdev_device_remove_cb() always returns success so that
+device_for_each_child doesn't abort if one child removal hits error.
+
+While at it, improve remove and unregister functions for below simplicity.
+
+There isn't need to pass forced flag pointer during mdev parent
+removal which invokes mdev_device_remove(). So simplify the flow.
+
+mdev_device_remove() is called from two paths.
+1. mdev_unregister_driver()
+ mdev_device_remove_cb()
+ mdev_device_remove()
+2. remove_store()
+ mdev_device_remove()
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/mdev/mdev_core.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 836d31985f14..1a317e409355 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -149,10 +149,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
+
+ static int mdev_device_remove_cb(struct device *dev, void *data)
+ {
+- if (!dev_is_mdev(dev))
+- return 0;
++ if (dev_is_mdev(dev))
++ mdev_device_remove(dev, true);
+
+- return mdev_device_remove(dev, data ? *(bool *)data : true);
++ return 0;
+ }
+
+ /*
+@@ -240,7 +240,6 @@ EXPORT_SYMBOL(mdev_register_device);
+ void mdev_unregister_device(struct device *dev)
+ {
+ struct mdev_parent *parent;
+- bool force_remove = true;
+
+ mutex_lock(&parent_list_lock);
+ parent = __find_parent_device(dev);
+@@ -254,8 +253,7 @@ void mdev_unregister_device(struct device *dev)
+ list_del(&parent->next);
+ class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
+
+- device_for_each_child(dev, (void *)&force_remove,
+- mdev_device_remove_cb);
++ device_for_each_child(dev, NULL, mdev_device_remove_cb);
+
+ parent_remove_sysfs_files(parent);
+
+--
+2.16.4
+
diff --git a/patches.fixes/vfio-pci-use-correct-format-characters.patch b/patches.fixes/vfio-pci-use-correct-format-characters.patch
new file mode 100644
index 0000000000..5cb3f7ce88
--- /dev/null
+++ b/patches.fixes/vfio-pci-use-correct-format-characters.patch
@@ -0,0 +1,83 @@
+From 426b046b748d1f47e096e05bdcc6fb4172791307 Mon Sep 17 00:00:00 2001
+From: Louis Taylor <louis@kragniz.eu>
+Date: Wed, 3 Apr 2019 12:36:20 -0600
+Subject: [PATCH] vfio/pci: use correct format characters
+Git-commit: 426b046b748d1f47e096e05bdcc6fb4172791307
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+When compiling with -Wformat, clang emits the following warnings:
+
+drivers/vfio/pci/vfio_pci.c:1601:5: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1601:13: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1601:21: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1601:32: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:5: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:13: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:21: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:32: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+The types of these arguments are unconditionally defined, so this patch
+updates the format character to the correct ones for unsigned ints.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/378
+Signed-off-by: Louis Taylor <louis@kragniz.eu>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/pci/vfio_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index a25659b5a5d1..3fa20e95a6bb 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1661,11 +1661,11 @@ static void __init vfio_pci_fill_ids(void)
+ rc = pci_add_dynid(&vfio_pci_driver, vendor, device,
+ subvendor, subdevice, class, class_mask, 0);
+ if (rc)
+- pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",
++ pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
+ vendor, device, subvendor, subdevice,
+ class, class_mask, rc);
+ else
+- pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",
++ pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
+ vendor, device, subvendor, subdevice,
+ class, class_mask);
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch b/patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch
new file mode 100644
index 0000000000..f02cf91a42
--- /dev/null
+++ b/patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch
@@ -0,0 +1,69 @@
+From 0cfd027be1d6def4a462cdc180c055143af24069 Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Fri, 15 Feb 2019 17:16:06 +0100
+Subject: [PATCH] vfio_pci: Enable memory accesses before calling pci_map_rom
+Git-commit: 0cfd027be1d6def4a462cdc180c055143af24069
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
+In case the Memory Space accesses were disabled, readw() is likely
+to trigger a synchronous external abort on some platforms.
+
+In case memory accesses were disabled, re-enable them before the
+call and disable them back again just after.
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 84b593b9fb1f..a25659b5a5d1 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -759,6 +759,7 @@ static long vfio_pci_ioctl(void *device_data,
+ {
+ void __iomem *io;
+ size_t size;
++ u16 orig_cmd;
+
+ info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ info.flags = 0;
+@@ -774,15 +775,23 @@ static long vfio_pci_ioctl(void *device_data,
+ break;
+ }
+
+- /* Is it really there? */
++ /*
++ * Is it really there? Enable memory decode for
++ * implicit access in pci_map_rom().
++ */
++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++ pci_write_config_word(pdev, PCI_COMMAND,
++ orig_cmd | PCI_COMMAND_MEMORY);
++
+ io = pci_map_rom(pdev, &size);
+- if (!io || !size) {
++ if (io) {
++ info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_unmap_rom(pdev, io);
++ } else {
+ info.size = 0;
+- break;
+ }
+- pci_unmap_rom(pdev, io);
+
+- info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ break;
+ }
+ case VFIO_PCI_VGA_REGION_INDEX:
+--
+2.16.4
+
diff --git a/patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch b/patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
index b49a7cc7f5..9a119bf8a4 100644
--- a/patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
+++ b/patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
@@ -1,9 +1,10 @@
+From c38f57da428b033f2721b611d84b1f40bde674a8 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 6 Dec 2018 19:14:34 +0000
-Subject: vhost/vsock: fix reset orphans race with close timeout
-Patch-mainline: v4.20-rc6
+Subject: [PATCH] vhost/vsock: fix reset orphans race with close timeout
Git-commit: c38f57da428b033f2721b611d84b1f40bde674a8
-References: bsc#1109837
+Patch-mainline: v4.20-rc6
+References: bsc#1051510 bsc#1109837
If a local process has closed a connected socket and hasn't received a
RST packet yet, then the socket remains in the table until a timeout
@@ -20,14 +21,17 @@ Reported-by: Maximilian Riemensberger <riemensberger@cadami.net>
Cc: Graham Whaley <graham.whaley@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
---
- drivers/vhost/vsock.c | 22 +++++++++++++++-------
+ drivers/vhost/vsock.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 34bc3ab40c6d..731e2ea2aeca 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
-@@ -561,13 +561,21 @@ static void vhost_vsock_reset_orphans(st
+@@ -563,13 +563,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
* executing.
*/
@@ -56,3 +60,6 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
}
static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
+--
+2.16.4
+
diff --git a/patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch b/patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch
new file mode 100644
index 0000000000..66063e9369
--- /dev/null
+++ b/patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch
@@ -0,0 +1,66 @@
+From cf94db21905333e610e479688add629397a4b384 Mon Sep 17 00:00:00 2001
+From: Cornelia Huck <cohuck@redhat.com>
+Date: Mon, 8 Apr 2019 14:33:22 +0200
+Subject: [PATCH] virtio: Honour 'may_reduce_num' in vring_create_virtqueue
+Git-commit: cf94db21905333e610e479688add629397a4b384
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+vring_create_virtqueue() allows the caller to specify via the
+may_reduce_num parameter whether the vring code is allowed to
+allocate a smaller ring than specified.
+
+However, the split ring allocation code tries to allocate a
+smaller ring on allocation failure regardless of what the
+caller specified. This may cause trouble for e.g. virtio-pci
+in legacy mode, which does not support ring resizing. (The
+packed ring code does not resize in any case.)
+
+Let's fix this by bailing out immediately in the split ring code
+if the requested size cannot be allocated and may_reduce_num has
+not been specified.
+
+While at it, fix a typo in the usage instructions.
+
+Fixes: 2a2d1382fe9d ("virtio: Add improved queue allocation API")
+Cc: stable@vger.kernel.org # v4.6+
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
+Reviewed-by: Jens Freimann <jfreimann@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/virtio/virtio_ring.c | 2 ++
+ include/linux/virtio_ring.h | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 18846afb39da..5df92c308286 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -882,6 +882,8 @@ static struct virtqueue *vring_create_virtqueue_split(
+ GFP_KERNEL|__GFP_NOWARN|__GFP_ZERO);
+ if (queue)
+ break;
++ if (!may_reduce_num)
++ return NULL;
+ }
+
+ if (!num)
+diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
+index fab02133a919..3dc70adfe5f5 100644
+--- a/include/linux/virtio_ring.h
++++ b/include/linux/virtio_ring.h
+@@ -63,7 +63,7 @@ struct virtqueue;
+ /*
+ * Creates a virtqueue and allocates the descriptor ring. If
+ * may_reduce_num is set, then this may allocate a smaller ring than
+- * expected. The caller should query virtqueue_get_ring_size to learn
++ * expected. The caller should query virtqueue_get_vring_size to learn
+ * the actual size of the ring.
+ */
+ struct virtqueue *vring_create_virtqueue(unsigned int index,
+--
+2.16.4
+
diff --git a/patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch b/patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch
new file mode 100644
index 0000000000..0cce08e17f
--- /dev/null
+++ b/patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch
@@ -0,0 +1,46 @@
+From bf348f9b78d413e75bb079462751a1d86b6de36c Mon Sep 17 00:00:00 2001
+From: Dongli Zhang <dongli.zhang@oracle.com>
+Date: Wed, 27 Mar 2019 18:36:34 +0800
+Subject: [PATCH] virtio-blk: limit number of hw queues by nr_cpu_ids
+Git-commit: bf348f9b78d413e75bb079462751a1d86b6de36c
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+When tag_set->nr_maps is 1, the block layer limits the number of hw queues
+by nr_cpu_ids. No matter how many hw queues are used by virtio-blk, as it
+has (tag_set->nr_maps == 1), it can use at most nr_cpu_ids hw queues.
+
+In addition, specifically for pci scenario, when the 'num-queues' specified
+by qemu is more than maxcpus, virtio-blk would not be able to allocate more
+than maxcpus vectors in order to have a vector for each queue. As a result,
+it falls back into MSI-X with one vector for config and one shared for
+queues.
+
+Considering above reasons, this patch limits the number of hw queues used
+by virtio-blk by nr_cpu_ids.
+
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/block/virtio_blk.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 4bc083b7c9b5..2a7ca4a1e6f7 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -513,6 +513,8 @@ static int init_vq(struct virtio_blk *vblk)
+ if (err)
+ num_vqs = 1;
+
++ num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
++
+ vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
+ if (!vblk->vqs)
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch b/patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch
new file mode 100644
index 0000000000..ce22aa40e9
--- /dev/null
+++ b/patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch
@@ -0,0 +1,70 @@
+From 6a8aae68c87349dbbcd46eac380bc43cdb98a13b Mon Sep 17 00:00:00 2001
+From: Longpeng <longpeng2@huawei.com>
+Date: Sat, 9 Mar 2019 15:17:40 +0800
+Subject: [PATCH] virtio_pci: fix a NULL pointer reference in vp_del_vqs
+Git-commit: 6a8aae68c87349dbbcd46eac380bc43cdb98a13b
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+If the msix_affinity_masks is alloced failed, then we'll
+try to free some resources in vp_free_vectors() that may
+access it directly.
+
+We met the following stack in our production:
+[ 29.296767] BUG: unable to handle kernel NULL pointer dereference at (null)
+[ 29.311151] IP: [<ffffffffc04fe35a>] vp_free_vectors+0x6a/0x150 [virtio_pci]
+[ 29.324787] PGD 0
+[ 29.333224] Oops: 0000 [#1] SMP
+[...]
+[ 29.425175] RIP: 0010:[<ffffffffc04fe35a>] [<ffffffffc04fe35a>] vp_free_vectors+0x6a/0x150 [virtio_pci]
+[ 29.441405] RSP: 0018:ffff9a55c2dcfa10 EFLAGS: 00010206
+[ 29.453491] RAX: 0000000000000000 RBX: ffff9a55c322c400 RCX: 0000000000000000
+[ 29.467488] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9a55c322c400
+[ 29.481461] RBP: ffff9a55c2dcfa20 R08: 0000000000000000 R09: ffffc1b6806ff020
+[ 29.495427] R10: 0000000000000e95 R11: 0000000000aaaaaa R12: 0000000000000000
+[ 29.509414] R13: 0000000000010000 R14: ffff9a55bd2d9e98 R15: ffff9a55c322c400
+[ 29.523407] FS: 00007fdcba69f8c0(0000) GS:ffff9a55c2840000(0000) knlGS:0000000000000000
+[ 29.538472] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 29.551621] CR2: 0000000000000000 CR3: 000000003ce52000 CR4: 00000000003607a0
+[ 29.565886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 29.580055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 29.594122] Call Trace:
+[ 29.603446] [<ffffffffc04fe8a2>] vp_request_msix_vectors+0xe2/0x260 [virtio_pci]
+[ 29.618017] [<ffffffffc04fedc5>] vp_try_to_find_vqs+0x95/0x3b0 [virtio_pci]
+[ 29.632152] [<ffffffffc04ff117>] vp_find_vqs+0x37/0xb0 [virtio_pci]
+[ 29.645582] [<ffffffffc057bf63>] init_vq+0x153/0x260 [virtio_blk]
+[ 29.658831] [<ffffffffc057c1e8>] virtblk_probe+0xe8/0x87f [virtio_blk]
+[...]
+
+Cc: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Longpeng <longpeng2@huawei.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Gonglei <arei.gonglei@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/virtio/virtio_pci_common.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index d0584c040c60..7a0398bb84f7 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev)
+ for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+ free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+- for (i = 0; i < vp_dev->msix_vectors; i++)
+- if (vp_dev->msix_affinity_masks[i])
+- free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ if (vp_dev->msix_affinity_masks) {
++ for (i = 0; i < vp_dev->msix_vectors; i++)
++ if (vp_dev->msix_affinity_masks[i])
++ free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ }
+
+ if (vp_dev->msix_enabled) {
+ /* Disable the vector used for configuration */
+--
+2.16.4
+
diff --git a/patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch b/patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch
new file mode 100644
index 0000000000..b6fe226c01
--- /dev/null
+++ b/patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch
@@ -0,0 +1,103 @@
+From 22b5c0b63f32568e130fa2df4ba23efce3eb495b Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 1 Feb 2019 12:42:06 +0100
+Subject: [PATCH] vsock/virtio: fix kernel panic after device hot-unplug
+Git-commit: 22b5c0b63f32568e130fa2df4ba23efce3eb495b
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+virtio_vsock_remove() invokes the vsock_core_exit() also if there
+are opened sockets for the AF_VSOCK protocol family. In this way
+the vsock "transport" pointer is set to NULL, triggering the
+kernel panic at the first socket activity.
+
+This patch move the vsock_core_init()/vsock_core_exit() in the
+virtio_vsock respectively in module_init and module_exit functions,
+that cannot be invoked until there are open sockets.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1609699
+Reported-by: Yan Fu <yafu@redhat.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/vmw_vsock/virtio_transport.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 5d3cce9e8744..9dae54698737 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
+ {
+ struct virtio_vsock *vsock = virtio_vsock_get();
+
++ if (!vsock)
++ return VMADDR_CID_ANY;
++
+ return vsock->guest_cid;
+ }
+
+@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+
+ virtio_vsock_update_guest_cid(vsock);
+
+- ret = vsock_core_init(&virtio_transport.transport);
+- if (ret < 0)
+- goto out_vqs;
+-
+ vsock->rx_buf_nr = 0;
+ vsock->rx_buf_max_nr = 0;
+ atomic_set(&vsock->queued_replies, 0);
+@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ mutex_unlock(&the_virtio_vsock_mutex);
+ return 0;
+
+-out_vqs:
+- vsock->vdev->config->del_vqs(vsock->vdev);
+ out:
+ kfree(vsock);
+ mutex_unlock(&the_virtio_vsock_mutex);
+@@ -669,7 +666,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+
+ mutex_lock(&the_virtio_vsock_mutex);
+ the_virtio_vsock = NULL;
+- vsock_core_exit();
+ mutex_unlock(&the_virtio_vsock_mutex);
+
+ vdev->config->del_vqs(vdev);
+@@ -702,14 +698,28 @@ static int __init virtio_vsock_init(void)
+ virtio_vsock_workqueue = alloc_workqueue("virtio_vsock", 0, 0);
+ if (!virtio_vsock_workqueue)
+ return -ENOMEM;
++
+ ret = register_virtio_driver(&virtio_vsock_driver);
+ if (ret)
+- destroy_workqueue(virtio_vsock_workqueue);
++ goto out_wq;
++
++ ret = vsock_core_init(&virtio_transport.transport);
++ if (ret)
++ goto out_vdr;
++
++ return 0;
++
++out_vdr:
++ unregister_virtio_driver(&virtio_vsock_driver);
++out_wq:
++ destroy_workqueue(virtio_vsock_workqueue);
+ return ret;
++
+ }
+
+ static void __exit virtio_vsock_exit(void)
+ {
++ vsock_core_exit();
+ unregister_virtio_driver(&virtio_vsock_driver);
+ destroy_workqueue(virtio_vsock_workqueue);
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch b/patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch
new file mode 100644
index 0000000000..c7fa6c3fb5
--- /dev/null
+++ b/patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch
@@ -0,0 +1,109 @@
+From 4c404ce23358d5d8fbdeb7a6021a9b33d3c3c167 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Adalbert=20Laz=C4=83r?= <alazar@bitdefender.com>
+Date: Wed, 6 Mar 2019 12:13:53 +0200
+Subject: [PATCH] vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 4c404ce23358d5d8fbdeb7a6021a9b33d3c3c167
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Previous to commit 22b5c0b63f32 ("vsock/virtio: fix kernel panic
+after device hot-unplug"), vsock_core_init() was called from
+virtio_vsock_probe(). Now, virtio_transport_reset_no_sock() can be called
+before vsock_core_init() has the chance to run.
+
+[Wed Feb 27 14:17:09 2019] BUG: unable to handle kernel NULL pointer dereference at 0000000000000110
+[Wed Feb 27 14:17:09 2019] #PF error: [normal kernel read fault]
+[Wed Feb 27 14:17:09 2019] PGD 0 P4D 0
+[Wed Feb 27 14:17:09 2019] Oops: 0000 [#1] SMP PTI
+[Wed Feb 27 14:17:09 2019] CPU: 3 PID: 59 Comm: kworker/3:1 Not tainted 5.0.0-rc7-390-generic-hvi #390
+[Wed Feb 27 14:17:09 2019] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+[Wed Feb 27 14:17:09 2019] Workqueue: virtio_vsock virtio_transport_rx_work [vmw_vsock_virtio_transport]
+[Wed Feb 27 14:17:09 2019] RIP: 0010:virtio_transport_reset_no_sock+0x8c/0xc0 [vmw_vsock_virtio_transport_common]
+[Wed Feb 27 14:17:09 2019] Code: 35 8b 4f 14 48 8b 57 08 31 f6 44 8b 4f 10 44 8b 07 48 8d 7d c8 e8 84 f8 ff ff 48 85 c0 48 89 c3 74 2a e8 f7 31 03 00 48 89 df <48> 8b 80 10 01 00 00 e8 68 fb 69 ed 48 8b 75 f0 65 48 33 34 25 28
+[Wed Feb 27 14:17:09 2019] RSP: 0018:ffffb42701ab7d40 EFLAGS: 00010282
+[Wed Feb 27 14:17:09 2019] RAX: 0000000000000000 RBX: ffff9d79637ee080 RCX: 0000000000000003
+[Wed Feb 27 14:17:09 2019] RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff9d79637ee080
+[Wed Feb 27 14:17:09 2019] RBP: ffffb42701ab7d78 R08: ffff9d796fae70e0 R09: ffff9d796f403500
+[Wed Feb 27 14:17:09 2019] R10: ffffb42701ab7d90 R11: 0000000000000000 R12: ffff9d7969d09240
+[Wed Feb 27 14:17:09 2019] R13: ffff9d79624e6840 R14: ffff9d7969d09318 R15: ffff9d796d48ff80
+[Wed Feb 27 14:17:09 2019] FS: 0000000000000000(0000) GS:ffff9d796fac0000(0000) knlGS:0000000000000000
+[Wed Feb 27 14:17:09 2019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[Wed Feb 27 14:17:09 2019] CR2: 0000000000000110 CR3: 0000000427f22000 CR4: 00000000000006e0
+[Wed Feb 27 14:17:09 2019] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[Wed Feb 27 14:17:09 2019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[Wed Feb 27 14:17:09 2019] Call Trace:
+[Wed Feb 27 14:17:09 2019] virtio_transport_recv_pkt+0x63/0x820 [vmw_vsock_virtio_transport_common]
+[Wed Feb 27 14:17:09 2019] ? kfree+0x17e/0x190
+[Wed Feb 27 14:17:09 2019] ? detach_buf_split+0x145/0x160
+[Wed Feb 27 14:17:09 2019] ? __switch_to_asm+0x40/0x70
+[Wed Feb 27 14:17:09 2019] virtio_transport_rx_work+0xa0/0x106 [vmw_vsock_virtio_transport]
+[Wed Feb 27 14:17:09 2019] NET: Registered protocol family 40
+[Wed Feb 27 14:17:09 2019] process_one_work+0x167/0x410
+[Wed Feb 27 14:17:09 2019] worker_thread+0x4d/0x460
+[Wed Feb 27 14:17:09 2019] kthread+0x105/0x140
+[Wed Feb 27 14:17:09 2019] ? rescuer_thread+0x360/0x360
+[Wed Feb 27 14:17:09 2019] ? kthread_destroy_worker+0x50/0x50
+[Wed Feb 27 14:17:09 2019] ret_from_fork+0x35/0x40
+[Wed Feb 27 14:17:09 2019] Modules linked in: vmw_vsock_virtio_transport vmw_vsock_virtio_transport_common input_leds vsock serio_raw i2c_piix4 mac_hid qemu_fw_cfg autofs4 cirrus ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops virtio_net psmouse drm net_failover pata_acpi virtio_blk failover floppy
+
+Fixes: 22b5c0b63f32 ("vsock/virtio: fix kernel panic after device hot-unplug")
+Reported-by: Alexandru Herghelegiu <aherghelegiu@bitdefender.com>
+Signed-off-by: Adalbert Lazăr <alazar@bitdefender.com>
+Co-developed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/vmw_vsock/virtio_transport_common.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 3ae3a33da70b..602715fc9a75 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -662,6 +662,8 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
+ */
+ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ {
++ const struct virtio_transport *t;
++ struct virtio_vsock_pkt *reply;
+ struct virtio_vsock_pkt_info info = {
+ .op = VIRTIO_VSOCK_OP_RST,
+ .type = le16_to_cpu(pkt->hdr.type),
+@@ -672,15 +674,21 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ if (le16_to_cpu(pkt->hdr.op) == VIRTIO_VSOCK_OP_RST)
+ return 0;
+
+- pkt = virtio_transport_alloc_pkt(&info, 0,
+- le64_to_cpu(pkt->hdr.dst_cid),
+- le32_to_cpu(pkt->hdr.dst_port),
+- le64_to_cpu(pkt->hdr.src_cid),
+- le32_to_cpu(pkt->hdr.src_port));
+- if (!pkt)
++ reply = virtio_transport_alloc_pkt(&info, 0,
++ le64_to_cpu(pkt->hdr.dst_cid),
++ le32_to_cpu(pkt->hdr.dst_port),
++ le64_to_cpu(pkt->hdr.src_cid),
++ le32_to_cpu(pkt->hdr.src_port));
++ if (!reply)
+ return -ENOMEM;
+
+- return virtio_transport_get_ops()->send_pkt(pkt);
++ t = virtio_transport_get_ops();
++ if (!t) {
++ virtio_transport_free_pkt(reply);
++ return -ENOTCONN;
++ }
++
++ return t->send_pkt(reply);
+ }
+
+ static void virtio_transport_wait_close(struct sock *sk, long timeout)
+--
+2.16.4
+
diff --git a/patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch b/patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch
new file mode 100644
index 0000000000..13a23d699f
--- /dev/null
+++ b/patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch
@@ -0,0 +1,37 @@
+From 85965487abc540368393a15491e6e7fcd230039d Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 1 Feb 2019 12:42:07 +0100
+Subject: [PATCH] vsock/virtio: reset connected sockets on device removal
+Git-commit: 85965487abc540368393a15491e6e7fcd230039d
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+When the virtio transport device disappear, we should reset all
+connected sockets in order to inform the users.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/vmw_vsock/virtio_transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 9dae54698737..15eb5d3d4750 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -634,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ flush_work(&vsock->event_work);
+ flush_work(&vsock->send_pkt_work);
+
++ /* Reset all connected sockets when the device disappear */
++ vsock_for_each_connected_socket(virtio_vsock_reset_sock);
++
+ vdev->config->reset(vdev);
+
+ mutex_lock(&vsock->rx_lock);
+--
+2.16.4
+
diff --git a/patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch b/patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch
new file mode 100644
index 0000000000..cff1ae58be
--- /dev/null
+++ b/patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch
@@ -0,0 +1,190 @@
+From 2e9e6481e2a78de3a85083beccfbf6eda2689922 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Thu, 19 Jul 2018 12:29:13 -0700
+Subject: [PATCH] xfs: detect and fix bad summary counts at mount
+Git-commit: 2e9e6481e2a78de3a85083beccfbf6eda2689922
+Patch-mainline: v4.19-rc1
+References: bsc#1114427
+
+Filippo Giunchedi complained that xfs doesn't even perform basic sanity
+checks of the fs summary counters at mount time. Therefore, recalculate
+the summary counters from the AGFs after log recovery if the counts were
+bad (or we had to recover the fs). Enhance the recalculation routine to
+fail the mount entirely if the new values are also obviously incorrect.
+
+We use a mount state flag to record the "bad summary count" state so
+that the (subsequent) online fsck patches can detect subtlely incorrect
+counts and set the flag; clear it userspace asks for a repair; or force
+a recalculation at the next mount if nobody fixes it by unmount time.
+
+Reported-by: Filippo Giunchedi <fgiunchedi@wikimedia.org>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/libxfs/xfs_sb.c | 21 +++++++++++--
+ fs/xfs/xfs_mount.c | 80 ++++++++++++++++++++++++++++++++++----------------
+ fs/xfs/xfs_mount.h | 1 +
+ 3 files changed, 73 insertions(+), 29 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
+index 350119eeaecb..b3ad15956366 100644
+--- a/fs/xfs/libxfs/xfs_sb.c
++++ b/fs/xfs/libxfs/xfs_sb.c
+@@ -804,6 +804,7 @@ xfs_initialize_perag_data(
+ uint64_t bfree = 0;
+ uint64_t bfreelst = 0;
+ uint64_t btree = 0;
++ uint64_t fdblocks;
+ int error;
+
+ for (index = 0; index < agcount; index++) {
+@@ -827,17 +828,31 @@ xfs_initialize_perag_data(
+ btree += pag->pagf_btreeblks;
+ xfs_perag_put(pag);
+ }
++ fdblocks = bfree + bfreelst + btree;
++
++ /*
++ * If the new summary counts are obviously incorrect, fail the
++ * mount operation because that implies the AGFs are also corrupt.
++ * Clear BAD_SUMMARY so that we don't unmount with a dirty log, which
++ * will prevent xfs_repair from fixing anything.
++ */
++ if (fdblocks > sbp->sb_dblocks || ifree > ialloc) {
++ xfs_alert(mp, "AGF corruption. Please run xfs_repair.");
++ error = -EFSCORRUPTED;
++ goto out;
++ }
+
+ /* Overwrite incore superblock counters with just-read data */
+ spin_lock(&mp->m_sb_lock);
+ sbp->sb_ifree = ifree;
+ sbp->sb_icount = ialloc;
+- sbp->sb_fdblocks = bfree + bfreelst + btree;
++ sbp->sb_fdblocks = fdblocks;
+ spin_unlock(&mp->m_sb_lock);
+
+ xfs_reinit_percpu_counters(mp);
+-
+- return 0;
++out:
++ mp->m_flags &= ~XFS_MOUNT_BAD_SUMMARY;
++ return error;
+ }
+
+ /*
+diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
+index a3378252baa1..60462c35ad4b 100644
+--- a/fs/xfs/xfs_mount.c
++++ b/fs/xfs/xfs_mount.c
+@@ -606,6 +606,56 @@ xfs_default_resblks(xfs_mount_t *mp)
+ return resblks;
+ }
+
++/* Ensure the summary counts are correct. */
++STATIC int
++xfs_check_summary_counts(
++ struct xfs_mount *mp)
++{
++ /*
++ * The AG0 superblock verifier rejects in-progress filesystems,
++ * so we should never see the flag set this far into mounting.
++ */
++ if (mp->m_sb.sb_inprogress) {
++ xfs_err(mp, "sb_inprogress set after log recovery??");
++ WARN_ON(1);
++ return -EFSCORRUPTED;
++ }
++
++ /*
++ * Now the log is mounted, we know if it was an unclean shutdown or
++ * not. If it was, with the first phase of recovery has completed, we
++ * have consistent AG blocks on disk. We have not recovered EFIs yet,
++ * but they are recovered transactionally in the second recovery phase
++ * later.
++ *
++ * If the log was clean when we mounted, we can check the summary
++ * counters. If any of them are obviously incorrect, we can recompute
++ * them from the AGF headers in the next step.
++ */
++ if (XFS_LAST_UNMOUNT_WAS_CLEAN(mp) &&
++ (mp->m_sb.sb_fdblocks > mp->m_sb.sb_dblocks ||
++ mp->m_sb.sb_ifree > mp->m_sb.sb_icount))
++ mp->m_flags |= XFS_MOUNT_BAD_SUMMARY;
++
++ /*
++ * We can safely re-initialise incore superblock counters from the
++ * per-ag data. These may not be correct if the filesystem was not
++ * cleanly unmounted, so we waited for recovery to finish before doing
++ * this.
++ *
++ * If the filesystem was cleanly unmounted or the previous check did
++ * not flag anything weird, then we can trust the values in the
++ * superblock to be correct and we don't need to do anything here.
++ * Otherwise, recalculate the summary counters.
++ */
++ if ((!xfs_sb_version_haslazysbcount(&mp->m_sb) ||
++ XFS_LAST_UNMOUNT_WAS_CLEAN(mp)) &&
++ !(mp->m_flags & XFS_MOUNT_BAD_SUMMARY))
++ return 0;
++
++ return xfs_initialize_perag_data(mp, mp->m_sb.sb_agcount);
++}
++
+ /*
+ * This function does the following on an initial mount of a file system:
+ * - reads the superblock from disk and init the mount struct
+@@ -831,32 +881,10 @@ xfs_mountfs(
+ goto out_fail_wait;
+ }
+
+- /*
+- * Now the log is mounted, we know if it was an unclean shutdown or
+- * not. If it was, with the first phase of recovery has completed, we
+- * have consistent AG blocks on disk. We have not recovered EFIs yet,
+- * but they are recovered transactionally in the second recovery phase
+- * later.
+- *
+- * Hence we can safely re-initialise incore superblock counters from
+- * the per-ag data. These may not be correct if the filesystem was not
+- * cleanly unmounted, so we need to wait for recovery to finish before
+- * doing this.
+- *
+- * If the filesystem was cleanly unmounted, then we can trust the
+- * values in the superblock to be correct and we don't need to do
+- * anything here.
+- *
+- * If we are currently making the filesystem, the initialisation will
+- * fail as the perag data is in an undefined state.
+- */
+- if (xfs_sb_version_haslazysbcount(&mp->m_sb) &&
+- !XFS_LAST_UNMOUNT_WAS_CLEAN(mp) &&
+- !mp->m_sb.sb_inprogress) {
+- error = xfs_initialize_perag_data(mp, sbp->sb_agcount);
+- if (error)
+- goto out_log_dealloc;
+- }
++ /* Make sure the summary counts are ok. */
++ error = xfs_check_summary_counts(mp);
++ if (error)
++ goto out_log_dealloc;
+
+ /*
+ * Get and sanity-check the root inode.
+diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
+index 245349d1e23f..f08907db9c61 100644
+--- a/fs/xfs/xfs_mount.h
++++ b/fs/xfs/xfs_mount.h
+@@ -202,6 +202,7 @@ typedef struct xfs_mount {
+ must be synchronous except
+ for space allocations */
+ #define XFS_MOUNT_UNMOUNTING (1ULL << 1) /* filesystem is unmounting */
++#define XFS_MOUNT_BAD_SUMMARY (1ULL << 2) /* summary counters are bad */
+ #define XFS_MOUNT_WAS_CLEAN (1ULL << 3)
+ #define XFS_MOUNT_FS_SHUTDOWN (1ULL << 4) /* atomic stop of all filesystem
+ operations, typically for
+--
+2.16.4
+
diff --git a/patches.fixes/xfs-kill-meaningless-variable-zero.patch b/patches.fixes/xfs-kill-meaningless-variable-zero.patch
new file mode 100644
index 0000000000..8a6f7a1d20
--- /dev/null
+++ b/patches.fixes/xfs-kill-meaningless-variable-zero.patch
@@ -0,0 +1,49 @@
+From 64671bafbdd984535aa382bccadd91fbe7be0e80 Mon Sep 17 00:00:00 2001
+From: Eryu Guan <eguan@redhat.com>
+Date: Mon, 18 Sep 2017 11:38:58 -0700
+Subject: [PATCH] xfs: kill meaningless variable 'zero'
+Git-commit: 64671bafbdd984535aa382bccadd91fbe7be0e80
+Patch-mainline: v4.14-rc3
+References: bsc#1106011
+
+In xfs_file_aio_write_checks(), variable 'zero' is there only to
+satisfy xfs_zero_eof(), the result of it is ignored. Now, with
+iomap_zero_range() based xfs_zero_eof(), we can safely pass NULL as
+the last param of it and kill 'zero'.
+
+Signed-off-by: Eryu Guan <eguan@redhat.com>
+Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/xfs_file.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index ebdd0bd2b261..261d83f1db76 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -377,8 +377,6 @@ xfs_file_aio_write_checks(
+ */
+ spin_lock(&ip->i_flags_lock);
+ if (iocb->ki_pos > i_size_read(inode)) {
+- bool zero = false;
+-
+ spin_unlock(&ip->i_flags_lock);
+ if (!drained_dio) {
+ if (*iolock == XFS_IOLOCK_SHARED) {
+@@ -399,7 +397,7 @@ xfs_file_aio_write_checks(
+ drained_dio = true;
+ goto restart;
+ }
+- error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), &zero);
++ error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), NULL);
+ if (error)
+ return error;
+ } else
+--
+2.16.4
+
diff --git a/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch b/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch
index 315528a2e4..dc8b2aea0d 100644
--- a/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch
+++ b/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch
@@ -4,7 +4,7 @@ Date: Tue, 20 Mar 2018 14:42:38 -0700
Subject: [PATCH] xfs: prepare xfs_break_layouts() for another layout type
Git-commit: 69eb5fa10eb283e9fcae3ce6f8aaf103b8f0c28d
Patch-mainline: v4.18-rc1
-References: bsc#1104888
+References: bsc#1104888 bsc#1106011
When xfs is operating as the back-end of a pNFS block server, it
prevents collisions between local and remote operations by requiring a
@@ -123,9 +123,9 @@ Acked-by: Jan Kara <jack@suse.cz>
* directory, group of new file is set to that of the parent, and
* new subdirectory gets S_ISGID bit from parent.
@@ -448,6 +462,8 @@ int xfs_zero_range(struct xfs_inode *ip,
- xfs_fsize_t isize, bool *did_zeroing);
- int xfs_zero_range(struct xfs_inode *ip, xfs_off_t pos, xfs_off_t count,
- bool *did_zero);
+
+ int xfs_update_prealloc_flags(struct xfs_inode *ip,
+ enum xfs_prealloc_flags flags);
+int xfs_break_layouts(struct inode *inode, uint *iolock,
+ enum layout_break_reason reason);
diff --git a/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch b/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
index be05d138ae..3c0c19093b 100644
--- a/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
+++ b/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
@@ -5,7 +5,7 @@ Subject: [PATCH] xfs: prepare xfs_break_layouts() to be called with
XFS_MMAPLOCK_EXCL
Git-commit: c63a8eae63d3859c9c7067aa239a4cfd7423a665
Patch-mainline: v4.18-rc1
-References: bsc#1104888
+References: bsc#1104888 bsc#1106011
In preparation for adding coordination between extent unmap operations
and busy dax-pages, update xfs_break_layouts() to permit it to be called
diff --git a/patches.fixes/xfs-remove-xfs_zero_range.patch b/patches.fixes/xfs-remove-xfs_zero_range.patch
new file mode 100644
index 0000000000..3adfa5f762
--- /dev/null
+++ b/patches.fixes/xfs-remove-xfs_zero_range.patch
@@ -0,0 +1,170 @@
+From f5c54717bf2b9e052bb69d6ee19fe22e87817079 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Tue, 13 Mar 2018 23:15:32 -0700
+Subject: [PATCH] xfs: remove xfs_zero_range
+Git-commit: f5c54717bf2b9e052bb69d6ee19fe22e87817079
+Patch-mainline: v4.17-rc1
+References: bsc#1106011
+
+This helper doesn't add any real value over just calling iomap_zero_range
+directly, so remove it.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/xfs_bmap_util.c | 11 ++++-------
+ fs/xfs/xfs_file.c | 48 +++++++-----------------------------------------
+ fs/xfs/xfs_inode.h | 4 ----
+ fs/xfs/xfs_iops.c | 4 +++-
+ 4 files changed, 14 insertions(+), 53 deletions(-)
+
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 19ea7d086cf8..05dee8fdd895 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1208,18 +1208,15 @@ xfs_free_file_space(
+
+ /*
+ * Now that we've unmap all full blocks we'll have to zero out any
+- * partial block at the beginning and/or end. xfs_zero_range is
+- * smart enough to skip any holes, including those we just created,
+- * but we must take care not to zero beyond EOF and enlarge i_size.
++ * partial block at the beginning and/or end. iomap_zero_range is smart
++ * enough to skip any holes, including those we just created, but we
++ * must take care not to zero beyond EOF and enlarge i_size.
+ */
+-
+ if (offset >= XFS_ISIZE(ip))
+ return 0;
+-
+ if (offset + len > XFS_ISIZE(ip))
+ len = XFS_ISIZE(ip) - offset;
+-
+- return xfs_zero_range(ip, offset, len, NULL);
++ return iomap_zero_range(VFS_I(ip), offset, len, NULL, &xfs_iomap_ops);
+ }
+
+ /*
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index f5c5dbbf1792..299aee4b7b0b 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -48,20 +48,6 @@
+
+ static const struct vm_operations_struct xfs_file_vm_ops;
+
+-/*
+- * Clear the specified ranges to zero through either the pagecache or DAX.
+- * Holes and unwritten extents will be left as-is as they already are zeroed.
+- */
+-int
+-xfs_zero_range(
+- struct xfs_inode *ip,
+- xfs_off_t pos,
+- xfs_off_t count,
+- bool *did_zero)
+-{
+- return iomap_zero_range(VFS_I(ip), pos, count, did_zero, &xfs_iomap_ops);
+-}
+-
+ int
+ xfs_update_prealloc_flags(
+ struct xfs_inode *ip,
+@@ -300,31 +286,6 @@ xfs_file_read_iter(
+ return ret;
+ }
+
+-/*
+- * Zero any on disk space between the current EOF and the new, larger EOF.
+- *
+- * This handles the normal case of zeroing the remainder of the last block in
+- * the file and the unusual case of zeroing blocks out beyond the size of the
+- * file. This second case only happens with fixed size extents and when the
+- * system crashes before the inode size was updated but after blocks were
+- * allocated.
+- *
+- * Expects the iolock to be held exclusive, and will take the ilock internally.
+- */
+-int /* error (positive) */
+-xfs_zero_eof(
+- struct xfs_inode *ip,
+- xfs_off_t offset, /* starting I/O offset */
+- xfs_fsize_t isize, /* current inode size */
+- bool *did_zeroing)
+-{
+- ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
+- ASSERT(offset > isize);
+-
+- trace_xfs_zero_eof(ip, isize, offset - isize);
+- return xfs_zero_range(ip, isize, offset - isize, did_zeroing);
+-}
+-
+ /*
+ * Common pre-write limit and setup checks.
+ *
+@@ -344,6 +305,7 @@ xfs_file_aio_write_checks(
+ ssize_t error = 0;
+ size_t count = iov_iter_count(from);
+ bool drained_dio = false;
++ loff_t isize;
+
+ restart:
+ error = generic_write_checks(iocb, from);
+@@ -380,7 +342,8 @@ xfs_file_aio_write_checks(
+ * and hence be able to correctly determine if we need to run zeroing.
+ */
+ spin_lock(&ip->i_flags_lock);
+- if (iocb->ki_pos > i_size_read(inode)) {
++ isize = i_size_read(inode);
++ if (iocb->ki_pos > isize) {
+ spin_unlock(&ip->i_flags_lock);
+ if (!drained_dio) {
+ if (*iolock == XFS_IOLOCK_SHARED) {
+@@ -401,7 +364,10 @@ xfs_file_aio_write_checks(
+ drained_dio = true;
+ goto restart;
+ }
+- error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), NULL);
++
++ trace_xfs_zero_eof(ip, isize, iocb->ki_pos - isize);
++ error = iomap_zero_range(inode, isize, iocb->ki_pos - isize,
++ NULL, &xfs_iomap_ops);
+ if (error)
+ return error;
+ } else
+diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
+index 3e8dc990d41c..132d8aa2afc4 100644
+--- a/fs/xfs/xfs_inode.h
++++ b/fs/xfs/xfs_inode.h
+@@ -443,10 +443,6 @@ enum xfs_prealloc_flags {
+
+ int xfs_update_prealloc_flags(struct xfs_inode *ip,
+ enum xfs_prealloc_flags flags);
+-int xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
+- xfs_fsize_t isize, bool *did_zeroing);
+-int xfs_zero_range(struct xfs_inode *ip, xfs_off_t pos, xfs_off_t count,
+- bool *did_zero);
+
+ /* from xfs_iops.c */
+ extern void xfs_setup_inode(struct xfs_inode *ip);
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index 8567951eff10..e0307fbff911 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -875,7 +875,9 @@ xfs_setattr_size(
+ * truncate.
+ */
+ if (newsize > oldsize) {
+- error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
++ trace_xfs_zero_eof(ip, oldsize, newsize - oldsize);
++ error = iomap_zero_range(inode, oldsize, newsize - oldsize,
++ &did_zeroing, &xfs_iomap_ops);
+ } else {
+ error = iomap_truncate_page(inode, newsize, &did_zeroing,
+ &xfs_iomap_ops);
+--
+2.16.4
+
diff --git a/patches.kabi/Re-export-snd_cards-for-kABI.patch b/patches.kabi/Re-export-snd_cards-for-kABI.patch
new file mode 100644
index 0000000000..0fd3b42980
--- /dev/null
+++ b/patches.kabi/Re-export-snd_cards-for-kABI.patch
@@ -0,0 +1,26 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: Re-export snd_cards for kABI compatibility
+Patch-mainline: Never, kABI compatibility
+References: bsc#1051510
+
+Re-export snd_cards object only for kABI compatibility with SLE15.
+It's not declared in the header.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -49,7 +49,8 @@ static const struct file_operations snd_
+
+ /* locked for registering/using */
+ static DECLARE_BITMAP(snd_cards_lock, SNDRV_CARDS);
+-static struct snd_card *snd_cards[SNDRV_CARDS];
++struct snd_card *snd_cards[SNDRV_CARDS];
++EXPORT_SYMBOL(snd_cards); /* XXX exported only for SLE15 kABI compatibility */
+
+ static DEFINE_MUTEX(snd_card_mutex);
+
diff --git a/patches.kabi/md-batch-flush-requests-kabi.patch b/patches.kabi/md-batch-flush-requests-kabi.patch
index b72a850995..8df435fdb0 100644
--- a/patches.kabi/md-batch-flush-requests-kabi.patch
+++ b/patches.kabi/md-batch-flush-requests-kabi.patch
@@ -9,8 +9,8 @@ Acked-by: NeilBrown <neilb@suse.com>
Signed-off-by: Neil Brown <neilb@suse.com>
---
- drivers/md/md.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
+ drivers/md/md.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -24,13 +24,15 @@ Signed-off-by: Neil Brown <neilb@suse.com>
struct work_struct flush_work;
struct work_struct event_work; /* used by dm to report failure event */
void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
-@@ -477,6 +474,9 @@ struct mddev {
+@@ -476,6 +473,11 @@ struct mddev {
+ unsigned int good_device_nr; /* good device num within cluster raid */
- #ifndef __GENKSYMS__
bool has_superblocks:1;
++#ifndef __GENKSYMS__
+ ktime_t start_flush, last_flush; /* last_flush is when the last completed
+ * flush was started.
+ */
- #endif
++#endif
};
+ enum recovery_flags {
diff --git a/patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch b/patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch
new file mode 100644
index 0000000000..22d8af8e48
--- /dev/null
+++ b/patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch
@@ -0,0 +1,50 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: kABI workaround for snd_seq_kernel_client_enqueue() API changes
+Patch-mainline: Never, ugly kABI workaround
+References: bsc#1051510
+
+The snd_seq_kernel_client_enqueue() API function was changed to take
+fewer arguments. Rename it and provide the old API functions to keep
+the kABI compatibility with SLE15.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/seq_kernel.h | 2 ++
+ sound/core/seq/seq_clientmgr.c | 17 +++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+--- a/include/sound/seq_kernel.h
++++ b/include/sound/seq_kernel.h
+@@ -73,6 +73,8 @@ __printf(3, 4)
+ int snd_seq_create_kernel_client(struct snd_card *card, int client_index,
+ const char *name_fmt, ...);
+ int snd_seq_delete_kernel_client(int client);
++/* XXX kABI compatibility for SLE15 XXX */
++#define snd_seq_kernel_client_enqueue __snd_seq_kernel_client_enqueue
+ int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
+ struct file *file, bool blocking);
+ int snd_seq_kernel_client_dispatch(int client, struct snd_seq_event *ev, int atomic, int hop);
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2557,3 +2557,20 @@ void __exit snd_sequencer_device_done(vo
+ snd_unregister_device(&seq_dev);
+ put_device(&seq_dev);
+ }
++
++/* XXX kABI compatibility for SLE15 XXX */
++#undef snd_seq_kernel_client_enqueue
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ int atomic, int hop)
++{
++ return __snd_seq_kernel_client_enqueue(client, ev, NULL, false);
++}
++EXPORT_SYMBOL(snd_seq_kernel_client_enqueue);
++
++int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event *ev,
++ struct file *file, int atomic,
++ int hop)
++{
++ return __snd_seq_kernel_client_enqueue(client, ev, file, true);
++}
++EXPORT_SYMBOL(snd_seq_kernel_client_enqueue_blocking);
diff --git a/patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch b/patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch
new file mode 100644
index 0000000000..7683027899
--- /dev/null
+++ b/patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch
@@ -0,0 +1,85 @@
+From cb49a87b2a4edb469e4d295eca4b1d106f64083e Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:17 +0300
+Git-commit: cb49a87b2a4edb469e4d295eca4b1d106f64083e
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 1/8] btrfs: Factor out common delayed refs init code
+
+THe majority of the init code for struct btrfs_delayed_ref_node is
+duplicated in add_delayed_data_ref and add_delayed_tree_ref. Factor out
+the common bits in init_delayed_ref_common. This function is going to be
+used in future patches to clean that up. No functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 51 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 4fb041e14742..a0dc255792c7 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -644,6 +644,57 @@ add_delayed_ref_head(struct btrfs_trans_handle *trans,
+ return head_ref;
+ }
+
++/*
++ * init_delayed_ref_common - Initialize the structure which represents a
++ * modification to a an extent.
++ *
++ * @fs_info: Internal to the mounted filesystem mount structure.
++ *
++ * @ref: The structure which is going to be initialized.
++ *
++ * @bytenr: The logical address of the extent for which a modification is
++ * going to be recorded.
++ *
++ * @num_bytes: Size of the extent whose modification is being recorded.
++ *
++ * @ref_root: The id of the root where this modification has originated, this
++ * can be either one of the well-known metadata trees or the
++ * subvolume id which references this extent.
++ *
++ * @action: Can be one of BTRFS_ADD_DELAYED_REF/BTRFS_DROP_DELAYED_REF or
++ * BTRFS_ADD_DELAYED_EXTENT
++ *
++ * @ref_type: Holds the type of the extent which is being recorded, can be
++ * one of BTRFS_SHARED_BLOCK_REF_KEY/BTRFS_TREE_BLOCK_REF_KEY
++ * when recording a metadata extent or BTRFS_SHARED_DATA_REF_KEY/
++ * BTRFS_EXTENT_DATA_REF_KEY when recording data extent
++ */
++static void init_delayed_ref_common(struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_node *ref,
++ u64 bytenr, u64 num_bytes, u64 ref_root,
++ int action, u8 ref_type)
++{
++ u64 seq = 0;
++
++ if (action == BTRFS_ADD_DELAYED_EXTENT)
++ action = BTRFS_ADD_DELAYED_REF;
++
++ if (is_fstree(ref_root))
++ seq = atomic64_read(&fs_info->tree_mod_seq);
++
++ refcount_set(&ref->refs, 1);
++ ref->bytenr = bytenr;
++ ref->num_bytes = num_bytes;
++ ref->ref_mod = 1;
++ ref->action = action;
++ ref->is_head = 0;
++ ref->in_tree = 1;
++ ref->seq = seq;
++ ref->type = ref_type;
++ RB_CLEAR_NODE(&ref->ref_node);
++ INIT_LIST_HEAD(&ref->add_list);
++}
++
+ /*
+ * helper to insert a delayed tree ref into the rbtree.
+ */
+--
+2.21.0
+
diff --git a/patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch b/patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch
new file mode 100644
index 0000000000..90af0de646
--- /dev/null
+++ b/patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch
@@ -0,0 +1,86 @@
+From 2eadaa22c17ac3c546850f70d9d20fa19459dbce Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:52 -0400
+Git-commit: 2eadaa22c17ac3c546850f70d9d20fa19459dbce
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 1/7] btrfs: add a helper to return a head ref
+
+Simplify the error handling in __btrfs_run_delayed_refs by breaking out
+the code used to return a head back to the delayed_refs tree for
+processing into a helper function.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 29 ++++++++++++++---------------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 52d246994341..3e4a6a4b0505 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2575,6 +2575,16 @@ select_delayed_ref(struct btrfs_delayed_ref_head *head)
+ return ref;
+ }
+
++static void unselect_delayed_ref_head(struct btrfs_delayed_ref_root *delayed_refs,
++ struct btrfs_delayed_ref_head *head)
++{
++ spin_lock(&delayed_refs->lock);
++ head->processing = 0;
++ delayed_refs->num_heads_ready++;
++ spin_unlock(&delayed_refs->lock);
++ btrfs_delayed_ref_unlock(head);
++}
++
+ /*
+ * Returns 0 on success or if called with an already aborted transaction.
+ * Returns -ENOMEM or -EIO on failure and will abort the transaction.
+@@ -2648,11 +2658,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ if (ref && ref->seq &&
+ btrfs_check_delayed_seq(fs_info, delayed_refs, ref->seq)) {
+ spin_unlock(&locked_ref->lock);
+- spin_lock(&delayed_refs->lock);
+- locked_ref->processing = 0;
+- delayed_refs->num_heads_ready++;
+- spin_unlock(&delayed_refs->lock);
+- btrfs_delayed_ref_unlock(locked_ref);
++ unselect_delayed_ref_head(delayed_refs, locked_ref);
+ locked_ref = NULL;
+ cond_resched();
+ count++;
+@@ -2698,14 +2704,11 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ */
+ if (must_insert_reserved)
+ locked_ref->must_insert_reserved = 1;
+- spin_lock(&delayed_refs->lock);
+- locked_ref->processing = 0;
+- delayed_refs->num_heads_ready++;
+- spin_unlock(&delayed_refs->lock);
++ unselect_delayed_ref_head(delayed_refs,
++ locked_ref);
+ btrfs_debug(fs_info,
+ "run_delayed_extent_op returned %d",
+ ret);
+- btrfs_delayed_ref_unlock(locked_ref);
+ return ret;
+ }
+ continue;
+@@ -2763,11 +2766,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+
+ btrfs_free_delayed_extent_op(extent_op);
+ if (ret) {
+- spin_lock(&delayed_refs->lock);
+- locked_ref->processing = 0;
+- delayed_refs->num_heads_ready++;
+- spin_unlock(&delayed_refs->lock);
+- btrfs_delayed_ref_unlock(locked_ref);
++ unselect_delayed_ref_head(delayed_refs, locked_ref);
+ btrfs_put_delayed_ref(ref);
+ btrfs_debug(fs_info, "run_one_delayed_ref returned %d",
+ ret);
+--
+2.21.0
+
diff --git a/patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch b/patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch
new file mode 100644
index 0000000000..8ef20a6718
--- /dev/null
+++ b/patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch
@@ -0,0 +1,187 @@
+From b28b1f0ce44c1b9ebc1c43e3eba18c1f1f5d9cec Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Git-commit: b28b1f0ce44c1b9ebc1c43e3eba18c1f1f5d9cec
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Date: Thu, 4 Apr 2019 14:45:29 +0800
+Subject: [PATCH 1/9] btrfs: delayed-ref: Introduce better documented delayed
+ ref structures
+
+Current delayed ref interface has several problems:
+
+- Longer and longer parameter lists
+ bytenr
+ num_bytes
+ parent
+ ---------- so far so good
+ ref_root
+ owner
+ offset
+ ---------- I don't feel good now
+
+- Different interpretation of the same parameter
+
+ Above @owner for data ref is inode number (u64),
+ while for tree ref, it's level (int).
+
+ They are even in different size range.
+ For level we only need 0 ~ 8, while for ino it's
+ BTRFS_FIRST_FREE_OBJECTID ~ BTRFS_LAST_FREE_OBJECTID.
+
+ And @offset doesn't even make sense for tree ref.
+
+ Such parameter reuse may look clever as an hidden union, but it
+ destroys code readability.
+
+To solve both problems, we introduce a new structure, btrfs_ref to solve
+them:
+
+- Structure instead of long parameter list
+ This makes later expansion easier, and is better documented.
+
+- Use btrfs_ref::type to distinguish data and tree ref
+
+- Use proper union to store data/tree ref specific structures.
+
+- Use separate functions to fill data/tree ref data, with a common generic
+ function to fill common bytenr/num_bytes members.
+
+All parameters will find its place in btrfs_ref, and an extra member,
+@real_root, inspired by ref-verify code, is newly introduced for later
+qgroup code, to record which tree is triggered by this extent modification.
+
+This patch doesn't touch any code, but provides the basis for further
+refactoring.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.h | 109 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 109 insertions(+)
+
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -189,6 +189,83 @@ struct btrfs_delayed_ref_root {
+ u64 qgroup_to_skip;
+ };
+
++enum btrfs_ref_type {
++ BTRFS_REF_NOT_SET,
++ BTRFS_REF_DATA,
++ BTRFS_REF_METADATA,
++ BTRFS_REF_LAST,
++};
++
++struct btrfs_data_ref {
++ /* For EXTENT_DATA_REF */
++
++ /* Root which refers to this data extent */
++ u64 ref_root;
++
++ /* Inode which refers to this data extent */
++ u64 ino;
++
++ /*
++ * file_offset - extent_offset
++ *
++ * file_offset is the key.offset of the EXTENT_DATA key.
++ * extent_offset is btrfs_file_extent_offset() of the EXTENT_DATA data.
++ */
++ u64 offset;
++};
++
++struct btrfs_tree_ref {
++ /*
++ * Level of this tree block
++ *
++ * Shared for skinny (TREE_BLOCK_REF) and normal tree ref.
++ */
++ int level;
++
++ /*
++ * Root which refers to this tree block.
++ *
++ * For TREE_BLOCK_REF (skinny metadata, either inline or keyed)
++ */
++ u64 root;
++
++ /* For non-skinny metadata, no special member needed */
++};
++
++struct btrfs_ref {
++ enum btrfs_ref_type type;
++ int action;
++
++ /*
++ * Whether this extent should go through qgroup record.
++ *
++ * Normally false, but for certain cases like delayed subtree scan,
++ * setting this flag can hugely reduce qgroup overhead.
++ */
++ bool skip_qgroup;
++
++ /*
++ * Optional. For which root is this modification.
++ * Mostly used for qgroup optimization.
++ *
++ * When unset, data/tree ref init code will populate it.
++ * In certain cases, we're modifying reference for a different root.
++ * E.g. COW fs tree blocks for balance.
++ * In that case, tree_ref::root will be fs tree, but we're doing this
++ * for reloc tree, then we should set @real_root to reloc tree.
++ */
++ u64 real_root;
++ u64 bytenr;
++ u64 len;
++
++ /* Bytenr of the parent tree block */
++ u64 parent;
++ union {
++ struct btrfs_data_ref data_ref;
++ struct btrfs_tree_ref tree_ref;
++ };
++};
++
+ extern struct kmem_cache *btrfs_delayed_ref_head_cachep;
+ extern struct kmem_cache *btrfs_delayed_tree_ref_cachep;
+ extern struct kmem_cache *btrfs_delayed_data_ref_cachep;
+@@ -197,6 +274,38 @@ extern struct kmem_cache *btrfs_delayed_
+ int btrfs_delayed_ref_init(void);
+ void btrfs_delayed_ref_exit(void);
+
++static inline void btrfs_init_generic_ref(struct btrfs_ref *generic_ref,
++ int action, u64 bytenr, u64 len, u64 parent)
++{
++ generic_ref->action = action;
++ generic_ref->bytenr = bytenr;
++ generic_ref->len = len;
++ generic_ref->parent = parent;
++}
++
++static inline void btrfs_init_tree_ref(struct btrfs_ref *generic_ref,
++ int level, u64 root)
++{
++ /* If @real_root not set, use @root as fallback */
++ if (!generic_ref->real_root)
++ generic_ref->real_root = root;
++ generic_ref->tree_ref.level = level;
++ generic_ref->tree_ref.root = root;
++ generic_ref->type = BTRFS_REF_METADATA;
++}
++
++static inline void btrfs_init_data_ref(struct btrfs_ref *generic_ref,
++ u64 ref_root, u64 ino, u64 offset)
++{
++ /* If @real_root not set, use @root as fallback */
++ if (!generic_ref->real_root)
++ generic_ref->real_root = ref_root;
++ generic_ref->data_ref.ref_root = ref_root;
++ generic_ref->data_ref.ino = ino;
++ generic_ref->data_ref.offset = offset;
++ generic_ref->type = BTRFS_REF_DATA;
++}
++
+ static inline struct btrfs_delayed_extent_op *
+ btrfs_alloc_delayed_extent_op(void)
+ {
diff --git a/patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch b/patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch
new file mode 100644
index 0000000000..6eac1cfa99
--- /dev/null
+++ b/patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch
@@ -0,0 +1,87 @@
+From 965fe8a6e29ede784cb38b97bb894aac1e8337a6 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 10 May 2019 12:45:05 +0800
+Patch-mainline: Submitted, 10 May 2019
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Subject: [PATCH] btrfs: extent-tree: Fix a bug that btrfs is unable to add
+ pinned bytes
+
+Commit ddf30cf03fb5 ("btrfs: extent-tree: Use btrfs_ref to refactor
+add_pinned_bytes()") refactored add_pinned_bytes(), but during that
+refactor, there are two callers which add the pinned bytes instead
+of subtracting.
+
+That refactor misses those two caller, causing incorrect pinned bytes
+calculation and resulting unexpected ENOSPC error.
+
+Fix it by refactoring add_pinned_bytes() to add_pinned_bytes() and
+sub_pinned_bytes() to explicitly show what we're doing.
+
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Fixes: ddf30cf03fb5 ("btrfs: extent-tree: Use btrfs_ref to refactor add_pinned_bytes()")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 36 ++++++++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -767,25 +767,37 @@ static struct btrfs_space_info *__find_s
+ return NULL;
+ }
+
++static u64 generic_ref_to_space_flags(struct btrfs_ref *ref)
++{
++ if (ref->type == BTRFS_REF_METADATA) {
++ if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID)
++ return BTRFS_BLOCK_GROUP_SYSTEM;
++ else
++ return BTRFS_BLOCK_GROUP_METADATA;
++ }
++ return BTRFS_BLOCK_GROUP_DATA;
++}
++
+ static void add_pinned_bytes(struct btrfs_fs_info *fs_info,
+ struct btrfs_ref *ref)
+ {
+ struct btrfs_space_info *space_info;
+- s64 num_bytes = -ref->len;
+- u64 flags;
++ u64 flags = generic_ref_to_space_flags(ref);
+
+- if (ref->type == BTRFS_REF_METADATA) {
+- if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID)
+- flags = BTRFS_BLOCK_GROUP_SYSTEM;
+- else
+- flags = BTRFS_BLOCK_GROUP_METADATA;
+- } else {
+- flags = BTRFS_BLOCK_GROUP_DATA;
+- }
++ space_info = __find_space_info(fs_info, flags);
++ ASSERT(space_info);
++ percpu_counter_add(&space_info->total_bytes_pinned, ref->len);
++}
++
++static void sub_pinned_bytes(struct btrfs_fs_info *fs_info,
++ struct btrfs_ref *ref)
++{
++ struct btrfs_space_info *space_info;
++ u64 flags = generic_ref_to_space_flags(ref);
+
+ space_info = __find_space_info(fs_info, flags);
+ ASSERT(space_info);
+- percpu_counter_add(&space_info->total_bytes_pinned, num_bytes);
++ percpu_counter_add(&space_info->total_bytes_pinned, -ref->len);
+ }
+
+ /*
+@@ -2129,7 +2141,7 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ &old_ref_mod, &new_ref_mod);
+
+ if (ret == 0 && old_ref_mod < 0 && new_ref_mod >= 0)
+- add_pinned_bytes(fs_info, generic_ref);
++ sub_pinned_bytes(fs_info, generic_ref);
+
+ return ret;
+ }
diff --git a/patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch b/patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch
new file mode 100644
index 0000000000..ff33d5ddc5
--- /dev/null
+++ b/patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch
@@ -0,0 +1,404 @@
+From 0e0adbcfdc908684317c99a9bf5e13383f03b7ec Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Git-commit: 0e0adbcfdc908684317c99a9bf5e13383f03b7ec
+Patch-mainline: v4.15
+References: bsc#1134813
+Date: Thu, 19 Oct 2017 14:16:00 -0400
+Subject: [PATCH] btrfs: track refs in a rb_tree instead of a list
+
+If we get a significant amount of delayed refs for a single block (think
+modifying multiple snapshots) we can end up spending an ungodly amount
+of time looping through all of the entries trying to see if they can be
+merged. This is because we only add them to a list, so we have O(2n)
+for every ref head. This doesn't make any sense as we likely have refs
+for different roots, and so they cannot be merged. Tracking in a tree
+will allow us to break as soon as we hit an entry that doesn't match,
+making our worst case O(n).
+
+With this we can also merge entries more easily. Before we had to hope
+that matching refs were on the ends of our list, but with the tree we
+can search down to exact matches and merge them at insert time.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/backref.c | 5 +-
+ fs/btrfs/delayed-ref.c | 108 +++++++++++++++++++++--------------------
+ fs/btrfs/delayed-ref.h | 5 +-
+ fs/btrfs/disk-io.c | 10 ++--
+ fs/btrfs/extent-tree.c | 21 +++++---
+ 5 files changed, 82 insertions(+), 67 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 523d2dba7745..7d0dc100a09a 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -773,6 +773,7 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ struct btrfs_key key;
+ struct btrfs_key tmp_op_key;
+ struct btrfs_key *op_key = NULL;
++ struct rb_node *n;
+ int count;
+ int ret = 0;
+
+@@ -782,7 +783,9 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ }
+
+ spin_lock(&head->lock);
+- list_for_each_entry(node, &head->ref_list, list) {
++ for (n = rb_first(&head->ref_tree); n; n = rb_next(n)) {
++ node = rb_entry(n, struct btrfs_delayed_ref_node,
++ ref_node);
+ if (node->seq > seq)
+ continue;
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 8c7d7db01f7a..83be8f9fd906 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -143,6 +143,34 @@ static struct btrfs_delayed_ref_head *htree_insert(struct rb_root *root,
+ return NULL;
+ }
+
++static struct btrfs_delayed_ref_node* tree_insert(struct rb_root *root,
++ struct btrfs_delayed_ref_node *ins)
++{
++ struct rb_node **p = &root->rb_node;
++ struct rb_node *node = &ins->ref_node;
++ struct rb_node *parent_node = NULL;
++ struct btrfs_delayed_ref_node *entry;
++
++ while (*p) {
++ int comp;
++
++ parent_node = *p;
++ entry = rb_entry(parent_node, struct btrfs_delayed_ref_node,
++ ref_node);
++ comp = comp_refs(ins, entry, true);
++ if (comp < 0)
++ p = &(*p)->rb_left;
++ else if (comp > 0)
++ p = &(*p)->rb_right;
++ else
++ return entry;
++ }
++
++ rb_link_node(node, parent_node, p);
++ rb_insert_color(node, root);
++ return NULL;
++}
++
+ /*
+ * find an head entry based on bytenr. This returns the delayed ref
+ * head if it was able to find one, or NULL if nothing was in that spot.
+@@ -212,7 +240,8 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_node *ref)
+ {
+ assert_spin_locked(&head->lock);
+- list_del(&ref->list);
++ rb_erase(&ref->ref_node, &head->ref_tree);
++ RB_CLEAR_NODE(&ref->ref_node);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+ ref->in_tree = 0;
+@@ -229,24 +258,18 @@ static bool merge_ref(struct btrfs_trans_handle *trans,
+ u64 seq)
+ {
+ struct btrfs_delayed_ref_node *next;
++ struct rb_node *node = rb_next(&ref->ref_node);
+ bool done = false;
+
+- next = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node,
+- list);
+- while (!done && &next->list != &head->ref_list) {
++ while (!done && node) {
+ int mod;
+- struct btrfs_delayed_ref_node *next2;
+-
+- next2 = list_next_entry(next, list);
+-
+- if (next == ref)
+- goto next;
+
++ next = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
++ node = rb_next(node);
+ if (seq && next->seq >= seq)
+- goto next;
+-
++ break;
+ if (comp_refs(ref, next, false))
+- goto next;
++ break;
+
+ if (ref->action == next->action) {
+ mod = next->ref_mod;
+@@ -270,8 +293,6 @@ static bool merge_ref(struct btrfs_trans_handle *trans,
+ WARN_ON(ref->type == BTRFS_TREE_BLOCK_REF_KEY ||
+ ref->type == BTRFS_SHARED_BLOCK_REF_KEY);
+ }
+-next:
+- next = next2;
+ }
+
+ return done;
+@@ -283,11 +304,12 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head)
+ {
+ struct btrfs_delayed_ref_node *ref;
++ struct rb_node *node;
+ u64 seq = 0;
+
+ assert_spin_locked(&head->lock);
+
+- if (list_empty(&head->ref_list))
++ if (RB_EMPTY_ROOT(&head->ref_tree))
+ return;
+
+ /* We don't have too many refs to merge for data. */
+@@ -304,22 +326,13 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+ }
+ spin_unlock(&fs_info->tree_mod_seq_lock);
+
+- ref = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node,
+- list);
+- while (&ref->list != &head->ref_list) {
++again:
++ for (node = rb_first(&head->ref_tree); node; node = rb_next(node)) {
++ ref = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
+ if (seq && ref->seq >= seq)
+- goto next;
+-
+- if (merge_ref(trans, delayed_refs, head, ref, seq)) {
+- if (list_empty(&head->ref_list))
+- break;
+- ref = list_first_entry(&head->ref_list,
+- struct btrfs_delayed_ref_node,
+- list);
+ continue;
+- }
+-next:
+- ref = list_next_entry(ref, list);
++ if (merge_ref(trans, delayed_refs, head, ref, seq))
++ goto again;
+ }
+ }
+
+@@ -402,25 +415,19 @@ btrfs_select_ref_head(struct btrfs_trans_handle *trans)
+ * Return 0 for insert.
+ * Return >0 for merge.
+ */
+-static int
+-add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+- struct btrfs_delayed_ref_root *root,
+- struct btrfs_delayed_ref_head *href,
+- struct btrfs_delayed_ref_node *ref)
++static int insert_delayed_ref(struct btrfs_trans_handle *trans,
++ struct btrfs_delayed_ref_root *root,
++ struct btrfs_delayed_ref_head *href,
++ struct btrfs_delayed_ref_node *ref)
+ {
+ struct btrfs_delayed_ref_node *exist;
+ int mod;
+ int ret = 0;
+
+ spin_lock(&href->lock);
+- /* Check whether we can merge the tail node with ref */
+- if (list_empty(&href->ref_list))
+- goto add_tail;
+- exist = list_entry(href->ref_list.prev, struct btrfs_delayed_ref_node,
+- list);
+- /* No need to compare bytenr nor is_head */
+- if (comp_refs(exist, ref, true))
+- goto add_tail;
++ exist = tree_insert(&href->ref_tree, ref);
++ if (!exist)
++ goto inserted;
+
+ /* Now we are sure we can merge */
+ ret = 1;
+@@ -451,9 +458,7 @@ add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+ drop_delayed_ref(trans, root, href, exist);
+ spin_unlock(&href->lock);
+ return ret;
+-
+-add_tail:
+- list_add_tail(&ref->list, &href->ref_list);
++inserted:
+ if (ref->action == BTRFS_ADD_DELAYED_REF)
+ list_add_tail(&ref->add_list, &href->ref_add_list);
+ atomic_inc(&root->num_entries);
+@@ -593,7 +598,7 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
+ head_ref->ref_mod = count_mod;
+ head_ref->must_insert_reserved = must_insert_reserved;
+ head_ref->is_data = is_data;
+- INIT_LIST_HEAD(&head_ref->ref_list);
++ head_ref->ref_tree = RB_ROOT;
+ INIT_LIST_HEAD(&head_ref->ref_add_list);
+ RB_CLEAR_NODE(&head_ref->href_node);
+ head_ref->processing = 0;
+@@ -685,7 +690,7 @@ add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ ref->is_head = 0;
+ ref->in_tree = 1;
+ ref->seq = seq;
+- INIT_LIST_HEAD(&ref->list);
++ RB_CLEAR_NODE(&ref->ref_node);
+ INIT_LIST_HEAD(&ref->add_list);
+
+ full_ref = btrfs_delayed_node_to_tree_ref(ref);
+@@ -699,7 +704,7 @@ add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+
+ trace_add_delayed_tree_ref(fs_info, ref, full_ref, action);
+
+- ret = add_delayed_ref_tail_merge(trans, delayed_refs, head_ref, ref);
++ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+
+ /*
+ * XXX: memory should be freed at the same level allocated.
+@@ -742,7 +747,7 @@ add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+ ref->is_head = 0;
+ ref->in_tree = 1;
+ ref->seq = seq;
+- INIT_LIST_HEAD(&ref->list);
++ RB_CLEAR_NODE(&ref->ref_node);
+ INIT_LIST_HEAD(&ref->add_list);
+
+ full_ref = btrfs_delayed_node_to_data_ref(ref);
+@@ -758,8 +763,7 @@ add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+
+ trace_add_delayed_data_ref(fs_info, ref, full_ref, action);
+
+- ret = add_delayed_ref_tail_merge(trans, delayed_refs, head_ref, ref);
+-
++ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+ if (ret > 0)
+ kmem_cache_free(btrfs_delayed_data_ref_cachep, full_ref);
+ }
+diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
+index 1ce11858d727..a43af432f859 100644
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -27,8 +27,7 @@
+ #define BTRFS_UPDATE_DELAYED_HEAD 4 /* not changing ref count on head ref */
+
+ struct btrfs_delayed_ref_node {
+- /*data/tree ref use list, stored in ref_head->ref_list. */
+- struct list_head list;
++ struct rb_node ref_node;
+ /*
+ * If action is BTRFS_ADD_DELAYED_REF, also link this node to
+ * ref_head->ref_add_list, then we do not need to iterate the
+@@ -92,7 +91,7 @@ struct btrfs_delayed_ref_head {
+ struct mutex mutex;
+
+ spinlock_t lock;
+- struct list_head ref_list;
++ struct rb_root ref_tree;
+ /* accumulate add BTRFS_ADD_DELAYED_REF nodes to this ref_add_list. */
+ struct list_head ref_add_list;
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index d1f396f72979..efce9a2fa9be 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4113,7 +4113,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+
+ while ((node = rb_first(&delayed_refs->href_root)) != NULL) {
+ struct btrfs_delayed_ref_head *head;
+- struct btrfs_delayed_ref_node *tmp;
++ struct rb_node *n;
+ bool pin_bytes = false;
+
+ head = rb_entry(node, struct btrfs_delayed_ref_head,
+@@ -4129,10 +4129,12 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+ continue;
+ }
+ spin_lock(&head->lock);
+- list_for_each_entry_safe_reverse(ref, tmp, &head->ref_list,
+- list) {
++ while ((n = rb_first(&head->ref_tree)) != NULL) {
++ ref = rb_entry(n, struct btrfs_delayed_ref_node,
++ ref_node);
+ ref->in_tree = 0;
+- list_del(&ref->list);
++ rb_erase(&ref->ref_node, &head->ref_tree);
++ RB_CLEAR_NODE(&ref->ref_node);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+ atomic_dec(&delayed_refs->num_entries);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index fc9720e28005..673ac4e01dd0 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2519,7 +2519,7 @@ select_delayed_ref(struct btrfs_delayed_ref_head *head)
+ {
+ struct btrfs_delayed_ref_node *ref;
+
+- if (list_empty(&head->ref_list))
++ if (RB_EMPTY_ROOT(&head->ref_tree))
+ return NULL;
+
+ /*
+@@ -2532,8 +2532,8 @@ select_delayed_ref(struct btrfs_delayed_ref_head *head)
+ return list_first_entry(&head->ref_add_list,
+ struct btrfs_delayed_ref_node, add_list);
+
+- ref = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node,
+- list);
++ ref = rb_entry(rb_first(&head->ref_tree),
++ struct btrfs_delayed_ref_node, ref_node);
+ ASSERT(list_empty(&ref->add_list));
+ return ref;
+ }
+@@ -2593,7 +2593,7 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ spin_unlock(&head->lock);
+ spin_lock(&delayed_refs->lock);
+ spin_lock(&head->lock);
+- if (!list_empty(&head->ref_list) || head->extent_op) {
++ if (!RB_EMPTY_ROOT(&head->ref_tree) || head->extent_op) {
+ spin_unlock(&head->lock);
+ spin_unlock(&delayed_refs->lock);
+ return 1;
+@@ -2740,7 +2740,8 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+
+ actual_count++;
+ ref->in_tree = 0;
+- list_del(&ref->list);
++ rb_erase(&ref->ref_node, &locked_ref->ref_tree);
++ RB_CLEAR_NODE(&ref->ref_node);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+ /*
+@@ -3138,6 +3139,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ struct btrfs_delayed_data_ref *data_ref;
+ struct btrfs_delayed_ref_root *delayed_refs;
+ struct btrfs_transaction *cur_trans;
++ struct rb_node *node;
+ int ret = 0;
+
+ cur_trans = root->fs_info->running_transaction;
+@@ -3170,7 +3172,12 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ spin_unlock(&delayed_refs->lock);
+
+ spin_lock(&head->lock);
+- list_for_each_entry(ref, &head->ref_list, list) {
++ /*
++ * XXX: We should replace this with a proper search function in the
++ * future.
++ */
++ for (node = rb_first(&head->ref_tree); node; node = rb_next(node)) {
++ ref = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
+ /* If it's a shared ref we know a cross reference exists */
+ if (ref->type != BTRFS_EXTENT_DATA_REF_KEY) {
+ ret = 1;
+@@ -7141,7 +7148,7 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
+ goto out_delayed_unlock;
+
+ spin_lock(&head->lock);
+- if (!list_empty(&head->ref_list))
++ if (!RB_EMPTY_ROOT(&head->ref_tree))
+ goto out;
+
+ if (head->extent_op) {
+--
+2.21.0
+
diff --git a/patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch b/patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch
new file mode 100644
index 0000000000..70f8444815
--- /dev/null
+++ b/patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch
@@ -0,0 +1,33 @@
+From d719a1ff8391101ba5cb0998943dfb3f77d47e7f Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 14 May 2019 12:37:31 +0200
+Subject: drm/ttm: Remove warning about inconsistent mapping information
+Patch-mainline: Never, local cleanup
+References: bnc#1131488
+
+Fixing the issue of bnc1131488 requires changing a significant amount
+of the fbdev emulation. As the problem is rather cosmetical, we drop
+the warning for now.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/ttm/ttm_bo_vm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 622dab6c4347..90a56c6724b5 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -284,8 +284,6 @@ static void ttm_bo_vm_open(struct vm_area_struct *vma)
+ struct ttm_buffer_object *bo =
+ (struct ttm_buffer_object *)vma->vm_private_data;
+
+- WARN_ON(bo->bdev->dev_mapping != vma->vm_file->f_mapping);
+-
+ ttm_bo_get(bo);
+ }
+
+--
+2.21.0
+
diff --git a/patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch b/patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch
new file mode 100644
index 0000000000..c03208f122
--- /dev/null
+++ b/patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch
@@ -0,0 +1,75 @@
+From 646f4dd76fb3ac0d1e8677890522d4c044ee2f06 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:18 +0300
+Git-commit: 646f4dd76fb3ac0d1e8677890522d4c044ee2f06
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 2/8] btrfs: Use init_delayed_ref_common in
+ add_delayed_tree_ref
+
+Use the newly introduced common helper. No functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 35 +++++++++++------------------------
+ 1 file changed, 11 insertions(+), 24 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index a0dc255792c7..1c27d3322198 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -708,38 +708,25 @@ add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ {
+ struct btrfs_delayed_tree_ref *full_ref;
+ struct btrfs_delayed_ref_root *delayed_refs;
+- u64 seq = 0;
++ u8 ref_type;
+ int ret;
+
+- if (action == BTRFS_ADD_DELAYED_EXTENT)
+- action = BTRFS_ADD_DELAYED_REF;
+-
+- if (is_fstree(ref_root))
+- seq = atomic64_read(&fs_info->tree_mod_seq);
+ delayed_refs = &trans->transaction->delayed_refs;
+-
+- /* first set the basic ref node struct up */
+- refcount_set(&ref->refs, 1);
+- ref->bytenr = bytenr;
+- ref->num_bytes = num_bytes;
+- ref->ref_mod = 1;
+- ref->action = action;
+- ref->is_head = 0;
+- ref->in_tree = 1;
+- ref->seq = seq;
+- RB_CLEAR_NODE(&ref->ref_node);
+- INIT_LIST_HEAD(&ref->add_list);
+-
+ full_ref = btrfs_delayed_node_to_tree_ref(ref);
+- full_ref->parent = parent;
+- full_ref->root = ref_root;
+ if (parent)
+- ref->type = BTRFS_SHARED_BLOCK_REF_KEY;
++ ref_type = BTRFS_SHARED_BLOCK_REF_KEY;
+ else
+- ref->type = BTRFS_TREE_BLOCK_REF_KEY;
++ ref_type = BTRFS_TREE_BLOCK_REF_KEY;
++
++ init_delayed_ref_common(fs_info, ref, bytenr, num_bytes, ref_root,
++ action, ref_type);
++ full_ref->root = ref_root;
++ full_ref->parent = parent;
+ full_ref->level = level;
+
+- trace_add_delayed_tree_ref(fs_info, ref, full_ref, action);
++ trace_add_delayed_tree_ref(fs_info, ref, full_ref,
++ action == BTRFS_ADD_DELAYED_EXTENT ?
++ BTRFS_ADD_DELAYED_REF : action);
+
+ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+
+--
+2.21.0
+
diff --git a/patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch b/patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch
new file mode 100644
index 0000000000..b57a910b3b
--- /dev/null
+++ b/patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch
@@ -0,0 +1,83 @@
+From dd28b6a5aad306c417477db700ed0848c923a31c Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:30 +0800
+Git-commit: dd28b6a5aad306c417477db700ed0848c923a31c
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 2/9] btrfs: extent-tree: Open-code process_func in
+ __btrfs_mod_ref
+
+The process_func function pointer is local to __btrfs_mod_ref() and
+points to either btrfs_inc_extent_ref() or btrfs_free_extent().
+
+Open code it to make later delayed ref refactor easier, so we can
+refactor btrfs_inc_extent_ref() and btrfs_free_extent() in different
+patches.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3275,10 +3275,6 @@ static int __btrfs_mod_ref(struct btrfs_
+ int i;
+ int level;
+ int ret = 0;
+- int (*process_func)(struct btrfs_trans_handle *,
+- struct btrfs_fs_info *,
+- u64, u64, u64, u64, u64, u64);
+-
+
+ if (btrfs_is_testing(fs_info))
+ return 0;
+@@ -3290,11 +3286,6 @@ static int __btrfs_mod_ref(struct btrfs_
+ if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state) && level == 0)
+ return 0;
+
+- if (inc)
+- process_func = btrfs_inc_extent_ref;
+- else
+- process_func = btrfs_free_extent;
+-
+ if (full_backref)
+ parent = buf->start;
+ else
+@@ -3316,16 +3307,27 @@ static int __btrfs_mod_ref(struct btrfs_
+
+ num_bytes = btrfs_file_extent_disk_num_bytes(buf, fi);
+ key.offset -= btrfs_file_extent_offset(buf, fi);
+- ret = process_func(trans, fs_info, bytenr, num_bytes,
+- parent, ref_root, key.objectid,
+- key.offset);
++ if (inc)
++ ret = btrfs_inc_extent_ref(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ key.objectid, key.offset);
++ else
++ ret = btrfs_free_extent(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ key.objectid, key.offset);
+ if (ret)
+ goto fail;
+ } else {
+ bytenr = btrfs_node_blockptr(buf, i);
+ num_bytes = fs_info->nodesize;
+- ret = process_func(trans, fs_info, bytenr, num_bytes,
+- parent, ref_root, level - 1, 0);
++ if (inc)
++ ret = btrfs_inc_extent_ref(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ level - 1, 0);
++ else
++ ret = btrfs_free_extent(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ level - 1, 0);
+ if (ret)
+ goto fail;
+ }
diff --git a/patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch b/patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch
new file mode 100644
index 0000000000..7595f806b4
--- /dev/null
+++ b/patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch
@@ -0,0 +1,130 @@
+From b00e62507ec6a9b63d9b3019795584e694085b65 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:53 -0400
+Git-commit: b00e62507ec6a9b63d9b3019795584e694085b65
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 2/7] btrfs: move extent_op cleanup to a helper
+
+Move the extent_op cleanup for an empty head ref to a helper function to
+help simplify __btrfs_run_delayed_refs.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 77 ++++++++++++++++++++++--------------------
+ 1 file changed, 40 insertions(+), 37 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 3e4a6a4b0505..e5ed90f20805 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2585,6 +2585,26 @@ static void unselect_delayed_ref_head(struct btrfs_delayed_ref_root *delayed_ref
+ btrfs_delayed_ref_unlock(head);
+ }
+
++static int cleanup_extent_op(struct btrfs_trans_handle *trans,
++ struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_head *head)
++{
++ struct btrfs_delayed_extent_op *extent_op = head->extent_op;
++ int ret;
++
++ if (!extent_op)
++ return 0;
++ head->extent_op = NULL;
++ if (head->must_insert_reserved) {
++ btrfs_free_delayed_extent_op(extent_op);
++ return 0;
++ }
++ spin_unlock(&head->lock);
++ ret = run_delayed_extent_op(trans, fs_info, &head->node, extent_op);
++ btrfs_free_delayed_extent_op(extent_op);
++ return ret ? ret : 1;
++}
++
+ /*
+ * Returns 0 on success or if called with an already aborted transaction.
+ * Returns -ENOMEM or -EIO on failure and will abort the transaction.
+@@ -2665,16 +2685,6 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ continue;
+ }
+
+- /*
+- * record the must insert reserved flag before we
+- * drop the spin lock.
+- */
+- must_insert_reserved = locked_ref->must_insert_reserved;
+- locked_ref->must_insert_reserved = 0;
+-
+- extent_op = locked_ref->extent_op;
+- locked_ref->extent_op = NULL;
+-
+ if (!ref) {
+
+
+@@ -2684,33 +2694,17 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ */
+ ref = &locked_ref->node;
+
+- if (extent_op && must_insert_reserved) {
+- btrfs_free_delayed_extent_op(extent_op);
+- extent_op = NULL;
+- }
+-
+- if (extent_op) {
+- spin_unlock(&locked_ref->lock);
+- ret = run_delayed_extent_op(trans, fs_info,
+- ref, extent_op);
+- btrfs_free_delayed_extent_op(extent_op);
+-
+- if (ret) {
+- /*
+- * Need to reset must_insert_reserved if
+- * there was an error so the abort stuff
+- * can cleanup the reserved space
+- * properly.
+- */
+- if (must_insert_reserved)
+- locked_ref->must_insert_reserved = 1;
+- unselect_delayed_ref_head(delayed_refs,
+- locked_ref);
+- btrfs_debug(fs_info,
+- "run_delayed_extent_op returned %d",
+- ret);
+- return ret;
+- }
++ ret = cleanup_extent_op(trans, fs_info, locked_ref);
++ if (ret < 0) {
++ unselect_delayed_ref_head(delayed_refs,
++ locked_ref);
++ btrfs_debug(fs_info,
++ "run_delayed_extent_op returned %d",
++ ret);
++ return ret;
++ } else if (ret > 0) {
++ /* We dropped our lock, we need to loop. */
++ ret = 0;
+ continue;
+ }
+
+@@ -2759,6 +2753,15 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ WARN_ON(1);
+ }
+ }
++ /*
++ * Record the must-insert_reserved flag before we drop the spin
++ * lock.
++ */
++ must_insert_reserved = locked_ref->must_insert_reserved;
++ locked_ref->must_insert_reserved = 0;
++
++ extent_op = locked_ref->extent_op;
++ locked_ref->extent_op = NULL;
+ spin_unlock(&locked_ref->lock);
+
+ ret = run_one_delayed_ref(trans, fs_info, ref, extent_op,
+--
+2.21.0
+
diff --git a/patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch b/patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch
new file mode 100644
index 0000000000..8396e83151
--- /dev/null
+++ b/patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch
@@ -0,0 +1,73 @@
+From c812c8a857a00acae78341d5d4702eb8d7d02661 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:19 +0300
+Git-commit: c812c8a857a00acae78341d5d4702eb8d7d02661
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 3/8] btrfs: Use init_delayed_ref_common in
+ add_delayed_data_ref
+
+Use the newly introduced helper and remove the duplicate code. No
+functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 33 ++++++++++-----------------------
+ 1 file changed, 10 insertions(+), 23 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -768,41 +768,28 @@ add_delayed_data_ref(struct btrfs_fs_inf
+ {
+ struct btrfs_delayed_data_ref *full_ref;
+ struct btrfs_delayed_ref_root *delayed_refs;
+- u64 seq = 0;
++ u8 ref_type;
+ int ret;
+
+- if (action == BTRFS_ADD_DELAYED_EXTENT)
+- action = BTRFS_ADD_DELAYED_REF;
+-
+ delayed_refs = &trans->transaction->delayed_refs;
+
+- if (is_fstree(ref_root))
+- seq = atomic64_read(&fs_info->tree_mod_seq);
+-
+- /* first set the basic ref node struct up */
+- refcount_set(&ref->refs, 1);
+- ref->bytenr = bytenr;
+- ref->num_bytes = num_bytes;
+- ref->ref_mod = 1;
+- ref->action = action;
+- ref->is_head = 0;
+- ref->in_tree = 1;
+- ref->seq = seq;
+- RB_CLEAR_NODE(&ref->ref_node);
+- INIT_LIST_HEAD(&ref->add_list);
+
+ full_ref = btrfs_delayed_node_to_data_ref(ref);
+- full_ref->parent = parent;
+- full_ref->root = ref_root;
+ if (parent)
+- ref->type = BTRFS_SHARED_DATA_REF_KEY;
++ ref_type = BTRFS_SHARED_DATA_REF_KEY;
+ else
+- ref->type = BTRFS_EXTENT_DATA_REF_KEY;
++ ref_type = BTRFS_EXTENT_DATA_REF_KEY;
+
++ init_delayed_ref_common(fs_info, ref, bytenr, num_bytes,
++ ref_root, action, ref_type);
++ full_ref->root = ref_root;
++ full_ref->parent = parent;
+ full_ref->objectid = owner;
+ full_ref->offset = offset;
+
+- trace_add_delayed_data_ref(fs_info, ref, full_ref, action);
++ trace_add_delayed_data_ref(fs_info, ref, full_ref,
++ action == BTRFS_ADD_DELAYED_EXTENT ?
++ BTRFS_ADD_DELAYED_REF : action);
+
+ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+ if (ret > 0)
diff --git a/patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch b/patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch
new file mode 100644
index 0000000000..006adddba8
--- /dev/null
+++ b/patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch
@@ -0,0 +1,124 @@
+From 194ab0bc21cc99c5b804040aa785e0bdcc214656 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:54 -0400
+Git-commit: 194ab0bc21cc99c5b804040aa785e0bdcc214656
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 3/7] btrfs: breakout empty head cleanup to a helper
+
+Move this code out to a helper function to further simplivy
+__btrfs_run_delayed_refs.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 79 ++++++++++++++++++++++++------------------
+ 1 file changed, 45 insertions(+), 34 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index e5ed90f20805..5e61e9287b0e 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2605,6 +2605,43 @@ static int cleanup_extent_op(struct btrfs_trans_handle *trans,
+ return ret ? ret : 1;
+ }
+
++static int cleanup_ref_head(struct btrfs_trans_handle *trans,
++ struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_head *head)
++{
++ struct btrfs_delayed_ref_root *delayed_refs;
++ int ret;
++
++ delayed_refs = &trans->transaction->delayed_refs;
++
++ ret = cleanup_extent_op(trans, fs_info, head);
++ if (ret < 0) {
++ unselect_delayed_ref_head(delayed_refs, head);
++ btrfs_debug(fs_info, "run_delayed_extent_op returned %d", ret);
++ return ret;
++ } else if (ret) {
++ return ret;
++ }
++
++ /*
++ * Need to drop our head ref lock and re-acquire the delayed ref lock
++ * and then re-check to make sure nobody got added.
++ */
++ spin_unlock(&head->lock);
++ spin_lock(&delayed_refs->lock);
++ spin_lock(&head->lock);
++ if (!list_empty(&head->ref_list) || head->extent_op) {
++ spin_unlock(&head->lock);
++ spin_unlock(&delayed_refs->lock);
++ return 1;
++ }
++ head->node.in_tree = 0;
++ delayed_refs->num_heads--;
++ rb_erase(&head->href_node, &delayed_refs->href_root);
++ spin_unlock(&delayed_refs->lock);
++ return 0;
++}
++
+ /*
+ * Returns 0 on success or if called with an already aborted transaction.
+ * Returns -ENOMEM or -EIO on failure and will abort the transaction.
+@@ -2686,47 +2723,21 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ }
+
+ if (!ref) {
+-
+-
+- /* All delayed refs have been processed, Go ahead
+- * and send the head node to run_one_delayed_ref,
+- * so that any accounting fixes can happen
+- */
+- ref = &locked_ref->node;
+-
+- ret = cleanup_extent_op(trans, fs_info, locked_ref);
+- if (ret < 0) {
+- unselect_delayed_ref_head(delayed_refs,
+- locked_ref);
+- btrfs_debug(fs_info,
+- "run_delayed_extent_op returned %d",
+- ret);
+- return ret;
+- } else if (ret > 0) {
++ ret = cleanup_ref_head(trans, fs_info, locked_ref);
++ if (ret > 0 ) {
+ /* We dropped our lock, we need to loop. */
+ ret = 0;
+ continue;
++ } else if (ret) {
++ return ret;
+ }
+
+ /*
+- * Need to drop our head ref lock and re-acquire the
+- * delayed ref lock and then re-check to make sure
+- * nobody got added.
++ * All delayed refs have been processed, Go ahead and
++ * send the head node to run_one_delayed_ref, so that
++ * any accounting fixes can happen
+ */
+- spin_unlock(&locked_ref->lock);
+- spin_lock(&delayed_refs->lock);
+- spin_lock(&locked_ref->lock);
+- if (!list_empty(&locked_ref->ref_list) ||
+- locked_ref->extent_op) {
+- spin_unlock(&locked_ref->lock);
+- spin_unlock(&delayed_refs->lock);
+- continue;
+- }
+- ref->in_tree = 0;
+- delayed_refs->num_heads--;
+- rb_erase(&locked_ref->href_node,
+- &delayed_refs->href_root);
+- spin_unlock(&delayed_refs->lock);
++ ref = &locked_ref->node;
+ } else {
+ actual_count++;
+ ref->in_tree = 0;
+--
+2.21.0
+
diff --git a/patches.suse/0003-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch b/patches.suse/0003-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch
new file mode 100644
index 0000000000..7b7a9005e9
--- /dev/null
+++ b/patches.suse/0003-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch
@@ -0,0 +1,213 @@
+From ed4f255b9bacb774c99ded17647f138c3f61546d Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:31 +0800
+Git-commit: ed4f255b9bacb774c99ded17647f138c3f61546d
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 3/9] btrfs: delayed-ref: Use btrfs_ref to refactor
+ btrfs_add_delayed_tree_ref()
+
+btrfs_add_delayed_tree_ref() has a longer and longer parameter list, and
+some callers like btrfs_inc_extent_ref() are using @owner as level for
+delayed tree ref.
+
+Instead of making the parameter list longer, use btrfs_ref to refactor
+it, so each parameter assignment should be self-explaining without dirty
+level/owner trick, and provides the basis for later refactoring.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 24 +++++++++++++++++-------
+ fs/btrfs/delayed-ref.h | 3 +--
+ fs/btrfs/extent-tree.c | 48 ++++++++++++++++++++++++++++--------------------
+ 3 files changed, 46 insertions(+), 29 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -723,8 +723,7 @@ static void init_delayed_ref_common(stru
+ */
+ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+- u64 bytenr, u64 num_bytes, u64 parent,
+- u64 ref_root, int level, int action,
++ struct btrfs_ref *generic_ref,
+ struct btrfs_delayed_extent_op *extent_op,
+ int *old_ref_mod, int *new_ref_mod)
+ {
+@@ -733,10 +732,18 @@ int btrfs_add_delayed_tree_ref(struct bt
+ struct btrfs_delayed_ref_root *delayed_refs;
+ struct btrfs_qgroup_extent_record *record = NULL;
+ int qrecord_inserted;
+- bool is_system = (ref_root == BTRFS_CHUNK_TREE_OBJECTID);
++ bool is_system;
++ int action = generic_ref->action;
++ int level = generic_ref->tree_ref.level;
+ int ret;
++ u64 bytenr = generic_ref->bytenr;
++ u64 num_bytes = generic_ref->len;
++ u64 parent = generic_ref->parent;
+ u8 ref_type;
+
++ is_system = (generic_ref->real_root == BTRFS_CHUNK_TREE_OBJECTID);
++
++ ASSERT(generic_ref->type == BTRFS_REF_METADATA && generic_ref->action);
+ BUG_ON(extent_op && extent_op->is_data);
+ ref = kmem_cache_alloc(btrfs_delayed_tree_ref_cachep, GFP_NOFS);
+ if (!ref)
+@@ -747,8 +754,8 @@ int btrfs_add_delayed_tree_ref(struct bt
+ else
+ ref_type = BTRFS_TREE_BLOCK_REF_KEY;
+ init_delayed_ref_common(fs_info, &ref->node, bytenr, num_bytes,
+- ref_root, action, ref_type);
+- ref->root = ref_root;
++ generic_ref->tree_ref.root, action, ref_type);
++ ref->root = generic_ref->tree_ref.root;
+ ref->parent = parent;
+ ref->level = level;
+
+@@ -757,14 +764,17 @@ int btrfs_add_delayed_tree_ref(struct bt
+ goto free_ref;
+
+ if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) &&
+- is_fstree(ref_root)) {
++ is_fstree(generic_ref->real_root) &&
++ is_fstree(generic_ref->tree_ref.root) &&
++ !generic_ref->skip_qgroup) {
+ record = kzalloc(sizeof(*record), GFP_NOFS);
+ if (!record)
+ goto free_head_ref;
+ }
+
+ init_delayed_ref_head(head_ref, record, bytenr, num_bytes,
+- ref_root, 0, action, false, is_system);
++ generic_ref->tree_ref.root, 0, action, false,
++ is_system);
+ head_ref->extent_op = extent_op;
+
+ delayed_refs = &trans->transaction->delayed_refs;
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -346,8 +346,7 @@ static inline void btrfs_put_delayed_ref
+
+ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+- u64 bytenr, u64 num_bytes, u64 parent,
+- u64 ref_root, int level, int action,
++ struct btrfs_ref *generic_ref,
+ struct btrfs_delayed_extent_op *extent_op,
+ int *old_ref_mod, int *new_ref_mod);
+ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2113,18 +2113,20 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ u64 bytenr, u64 num_bytes, u64 parent,
+ u64 root_objectid, u64 owner, u64 offset)
+ {
++ struct btrfs_ref generic_ref = { 0 };
+ int old_ref_mod, new_ref_mod;
+ int ret;
+
+ BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID &&
+ root_objectid == BTRFS_TREE_LOG_OBJECTID);
+
++ btrfs_init_generic_ref(&generic_ref, BTRFS_ADD_DELAYED_REF, bytenr,
++ num_bytes, parent);
++ generic_ref.real_root = root_objectid;
+ if (owner < BTRFS_FIRST_FREE_OBJECTID) {
+- ret = btrfs_add_delayed_tree_ref(fs_info, trans, bytenr,
+- num_bytes, parent,
+- root_objectid, (int)owner,
+- BTRFS_ADD_DELAYED_REF, NULL,
+- &old_ref_mod, &new_ref_mod);
++ btrfs_init_tree_ref(&generic_ref, (int)owner, root_objectid);
++ ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
++ NULL, &old_ref_mod, &new_ref_mod);
+ } else {
+ ret = btrfs_add_delayed_data_ref(fs_info, trans, bytenr,
+ num_bytes, parent,
+@@ -7121,18 +7123,20 @@ void btrfs_free_tree_block(struct btrfs_
+ u64 parent, int last_ref)
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
++ struct btrfs_ref generic_ref = { 0 };
+ int pin = 1;
+ int ret;
+
++ btrfs_init_generic_ref(&generic_ref, BTRFS_DROP_DELAYED_REF,
++ buf->start, buf->len, parent);
++ btrfs_init_tree_ref(&generic_ref, btrfs_header_level(buf),
++ root->root_key.objectid);
++
+ if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID) {
+ int old_ref_mod, new_ref_mod;
+
+- ret = btrfs_add_delayed_tree_ref(fs_info, trans, buf->start,
+- buf->len, parent,
+- root->root_key.objectid,
+- btrfs_header_level(buf),
+- BTRFS_DROP_DELAYED_REF, NULL,
+- &old_ref_mod, &new_ref_mod);
++ ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref, NULL,
++ &old_ref_mod, &new_ref_mod);
+ BUG_ON(ret); /* -ENOMEM */
+ pin = old_ref_mod >= 0 && new_ref_mod < 0;
+ }
+@@ -7183,6 +7187,7 @@ int btrfs_free_extent(struct btrfs_trans
+ u64 bytenr, u64 num_bytes, u64 parent, u64 root_objectid,
+ u64 owner, u64 offset)
+ {
++ struct btrfs_ref generic_ref = { 0 };
+ int old_ref_mod, new_ref_mod;
+ int ret;
+
+@@ -7190,6 +7195,9 @@ int btrfs_free_extent(struct btrfs_trans
+ return 0;
+
+
++ btrfs_init_generic_ref(&generic_ref, BTRFS_DROP_DELAYED_REF, bytenr,
++ num_bytes, parent);
++ generic_ref.real_root = root_objectid;
+ /*
+ * tree log blocks never actually go into the extent allocation
+ * tree, just update pinning info and exit early.
+@@ -7201,11 +7209,9 @@ int btrfs_free_extent(struct btrfs_trans
+ old_ref_mod = new_ref_mod = 0;
+ ret = 0;
+ } else if (owner < BTRFS_FIRST_FREE_OBJECTID) {
+- ret = btrfs_add_delayed_tree_ref(fs_info, trans, bytenr,
+- num_bytes, parent,
+- root_objectid, (int)owner,
+- BTRFS_DROP_DELAYED_REF, NULL,
+- &old_ref_mod, &new_ref_mod);
++ btrfs_init_tree_ref(&generic_ref, (int)owner, root_objectid);
++ ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
++ NULL, &old_ref_mod, &new_ref_mod);
+ } else {
+ ret = btrfs_add_delayed_data_ref(fs_info, trans, bytenr,
+ num_bytes, parent,
+@@ -8335,6 +8341,7 @@ struct extent_buffer *btrfs_alloc_tree_b
+ struct btrfs_block_rsv *block_rsv;
+ struct extent_buffer *buf;
+ struct btrfs_delayed_extent_op *extent_op;
++ struct btrfs_ref generic_ref = { 0 };
+ u64 flags = 0;
+ int ret;
+ u32 blocksize = fs_info->nodesize;
+@@ -8388,10 +8395,11 @@ struct extent_buffer *btrfs_alloc_tree_b
+ extent_op->is_data = false;
+ extent_op->level = level;
+
+- ret = btrfs_add_delayed_tree_ref(fs_info, trans, ins.objectid,
+- ins.offset, parent,
+- root_objectid, level,
+- BTRFS_ADD_DELAYED_EXTENT,
++ btrfs_init_generic_ref(&generic_ref, BTRFS_ADD_DELAYED_EXTENT,
++ ins.objectid, ins.offset, parent);
++ generic_ref.real_root = root->root_key.objectid;
++ btrfs_init_tree_ref(&generic_ref, level, root_objectid);
++ ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
+ extent_op, NULL, NULL);
+ if (ret)
+ goto out_free_delayed;
diff --git a/patches.suse/0004-btrfs-Open-code-add_delayed_tree_ref.patch b/patches.suse/0004-btrfs-Open-code-add_delayed_tree_ref.patch
new file mode 100644
index 0000000000..b154cc6d0a
--- /dev/null
+++ b/patches.suse/0004-btrfs-Open-code-add_delayed_tree_ref.patch
@@ -0,0 +1,128 @@
+From 70d640004ab5c2597084f6463dd39b36f4f026f8 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:20 +0300
+Git-commit: 70d640004ab5c2597084f6463dd39b36f4f026f8
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 4/8] btrfs: Open-code add_delayed_tree_ref
+
+Now that the initialization part and the critical section code have been
+split it's a lot easier to open code add_delayed_tree_ref. Do so in the
+following manner:
+
+1. The comming init code is put immediately after memory-to-be-initialized
+ is allocated, followed by the ref-specific member initialization.
+
+2. The only piece of code that remains in the critical section is
+ insert_delayed_ref call.
+
+3. Tracing and memory freeing code is put outside of the critical
+ section as well.
+
+The only real change here is an overall shorter critical section when
+dealing with delayed tree refs. From functional point of view - the code
+is unchanged.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 65 +++++++++++++++----------------------------------
+ 1 file changed, 20 insertions(+), 45 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -713,49 +713,6 @@ static void init_delayed_ref_common(stru
+ }
+
+ /*
+- * helper to insert a delayed tree ref into the rbtree.
+- */
+-static noinline void
+-add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+- struct btrfs_trans_handle *trans,
+- struct btrfs_delayed_ref_head *head_ref,
+- struct btrfs_delayed_ref_node *ref, u64 bytenr,
+- u64 num_bytes, u64 parent, u64 ref_root, int level,
+- int action)
+-{
+- struct btrfs_delayed_tree_ref *full_ref;
+- struct btrfs_delayed_ref_root *delayed_refs;
+- u8 ref_type;
+- int ret;
+-
+- delayed_refs = &trans->transaction->delayed_refs;
+- full_ref = btrfs_delayed_node_to_tree_ref(ref);
+- if (parent)
+- ref_type = BTRFS_SHARED_BLOCK_REF_KEY;
+- else
+- ref_type = BTRFS_TREE_BLOCK_REF_KEY;
+-
+- init_delayed_ref_common(fs_info, ref, bytenr, num_bytes, ref_root,
+- action, ref_type);
+- full_ref->root = ref_root;
+- full_ref->parent = parent;
+- full_ref->level = level;
+-
+- trace_add_delayed_tree_ref(fs_info, ref, full_ref,
+- action == BTRFS_ADD_DELAYED_EXTENT ?
+- BTRFS_ADD_DELAYED_REF : action);
+-
+- ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+-
+- /*
+- * XXX: memory should be freed at the same level allocated.
+- * But bad practice is anywhere... Follow it now. Need cleanup.
+- */
+- if (ret > 0)
+- kmem_cache_free(btrfs_delayed_tree_ref_cachep, full_ref);
+-}
+-
+-/*
+ * helper to insert a delayed data ref into the rbtree.
+ */
+ static noinline void
+@@ -814,12 +771,24 @@ int btrfs_add_delayed_tree_ref(struct bt
+ struct btrfs_qgroup_extent_record *record = NULL;
+ int qrecord_inserted;
+ int is_system = (ref_root == BTRFS_CHUNK_TREE_OBJECTID);
++ int ret;
++ u8 ref_type;
+
+ BUG_ON(extent_op && extent_op->is_data);
+ ref = kmem_cache_alloc(btrfs_delayed_tree_ref_cachep, GFP_NOFS);
+ if (!ref)
+ return -ENOMEM;
+
++ if (parent)
++ ref_type = BTRFS_SHARED_BLOCK_REF_KEY;
++ else
++ ref_type = BTRFS_TREE_BLOCK_REF_KEY;
++ init_delayed_ref_common(fs_info, &ref->node, bytenr, num_bytes,
++ ref_root, action, ref_type);
++ ref->root = ref_root;
++ ref->parent = parent;
++ ref->level = level;
++
+ head_ref = kmem_cache_alloc(btrfs_delayed_ref_head_cachep, GFP_NOFS);
+ if (!head_ref)
+ goto free_ref;
+@@ -845,10 +814,16 @@ int btrfs_add_delayed_tree_ref(struct bt
+ is_system, &qrecord_inserted,
+ old_ref_mod, new_ref_mod);
+
+- add_delayed_tree_ref(fs_info, trans, head_ref, &ref->node, bytenr,
+- num_bytes, parent, ref_root, level, action);
++
++ ret = insert_delayed_ref(trans, delayed_refs, head_ref, &ref->node);
+ spin_unlock(&delayed_refs->lock);
+
++ trace_add_delayed_tree_ref(fs_info, &ref->node, ref,
++ action == BTRFS_ADD_DELAYED_EXTENT ?
++ BTRFS_ADD_DELAYED_REF : action);
++ if (ret > 0)
++ kmem_cache_free(btrfs_delayed_tree_ref_cachep, ref);
++
+ if (qrecord_inserted)
+ return btrfs_qgroup_trace_extent_post(fs_info, record);
+ return 0;
diff --git a/patches.suse/0004-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch b/patches.suse/0004-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch
new file mode 100644
index 0000000000..cefdb23914
--- /dev/null
+++ b/patches.suse/0004-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch
@@ -0,0 +1,124 @@
+From 76675593b69f2fcd57e24d9dd2a9b278f0130d0b Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:32 +0800
+Git-commit: 76675593b69f2fcd57e24d9dd2a9b278f0130d0b
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 4/9] btrfs: delayed-ref: Use btrfs_ref to refactor
+ btrfs_add_delayed_data_ref()
+
+Just like btrfs_add_delayed_tree_ref(), use btrfs_ref to refactor
+btrfs_add_delayed_data_ref().
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 16 ++++++++++++----
+ fs/btrfs/delayed-ref.h | 4 +---
+ fs/btrfs/extent-tree.c | 22 ++++++++++------------
+ 3 files changed, 23 insertions(+), 19 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -815,9 +815,7 @@ free_ref:
+ */
+ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+- u64 bytenr, u64 num_bytes,
+- u64 parent, u64 ref_root,
+- u64 owner, u64 offset, u64 reserved, int action,
++ struct btrfs_ref *generic_ref, u64 reserved,
+ int *old_ref_mod, int *new_ref_mod)
+ {
+ struct btrfs_delayed_data_ref *ref;
+@@ -825,9 +823,17 @@ int btrfs_add_delayed_data_ref(struct bt
+ struct btrfs_delayed_ref_root *delayed_refs;
+ struct btrfs_qgroup_extent_record *record = NULL;
+ int qrecord_inserted;
++ int action = generic_ref->action;
+ int ret;
++ u64 bytenr = generic_ref->bytenr;
++ u64 num_bytes = generic_ref->len;
++ u64 parent = generic_ref->parent;
++ u64 ref_root = generic_ref->data_ref.ref_root;
++ u64 owner = generic_ref->data_ref.ino;
++ u64 offset = generic_ref->data_ref.offset;
+ u8 ref_type;
+
++ ASSERT(generic_ref->type == BTRFS_REF_DATA && action);
+ ref = kmem_cache_alloc(btrfs_delayed_data_ref_cachep, GFP_NOFS);
+ if (!ref)
+ return -ENOMEM;
+@@ -851,7 +857,9 @@ int btrfs_add_delayed_data_ref(struct bt
+ }
+
+ if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) &&
+- is_fstree(ref_root)) {
++ is_fstree(ref_root) &&
++ is_fstree(generic_ref->real_root) &&
++ !generic_ref->skip_qgroup) {
+ record = kzalloc(sizeof(*record), GFP_NOFS);
+ if (!record) {
+ kmem_cache_free(btrfs_delayed_data_ref_cachep, ref);
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -351,9 +351,7 @@ int btrfs_add_delayed_tree_ref(struct bt
+ int *old_ref_mod, int *new_ref_mod);
+ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+- u64 bytenr, u64 num_bytes,
+- u64 parent, u64 ref_root,
+- u64 owner, u64 offset, u64 reserved, int action,
++ struct btrfs_ref *generic_ref, u64 reserved,
+ int *old_ref_mod, int *new_ref_mod);
+ int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2128,10 +2128,8 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
+ NULL, &old_ref_mod, &new_ref_mod);
+ } else {
+- ret = btrfs_add_delayed_data_ref(fs_info, trans, bytenr,
+- num_bytes, parent,
+- root_objectid, owner, offset,
+- 0, BTRFS_ADD_DELAYED_REF,
++ btrfs_init_data_ref(&generic_ref, root_objectid, owner, offset);
++ ret = btrfs_add_delayed_data_ref(fs_info, trans, &generic_ref, 0,
+ &old_ref_mod, &new_ref_mod);
+ }
+
+@@ -7213,10 +7211,8 @@ int btrfs_free_extent(struct btrfs_trans
+ ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
+ NULL, &old_ref_mod, &new_ref_mod);
+ } else {
+- ret = btrfs_add_delayed_data_ref(fs_info, trans, bytenr,
+- num_bytes, parent,
+- root_objectid, owner, offset,
+- 0, BTRFS_DROP_DELAYED_REF,
++ btrfs_init_data_ref(&generic_ref, root_objectid, owner, offset);
++ ret = btrfs_add_delayed_data_ref(fs_info, trans, &generic_ref, 0,
+ &old_ref_mod, &new_ref_mod);
+ }
+
+@@ -8167,14 +8163,16 @@ int btrfs_alloc_reserved_file_extent(str
+ struct btrfs_key *ins)
+ {
+ struct btrfs_fs_info *fs_info = trans->fs_info;
++ struct btrfs_ref generic_ref = { 0 };
+ int ret;
+
+ BUG_ON(root_objectid == BTRFS_TREE_LOG_OBJECTID);
+
+- ret = btrfs_add_delayed_data_ref(fs_info, trans, ins->objectid,
+- ins->offset, 0, root_objectid, owner,
+- offset, ram_bytes,
+- BTRFS_ADD_DELAYED_EXTENT, NULL, NULL);
++ btrfs_init_generic_ref(&generic_ref, BTRFS_ADD_DELAYED_EXTENT,
++ ins->objectid, ins->offset, 0);
++ btrfs_init_data_ref(&generic_ref, root_objectid, owner, offset);
++ ret = btrfs_add_delayed_data_ref(fs_info, trans, &generic_ref,
++ ram_bytes, NULL, NULL);
+ return ret;
+ }
+
diff --git a/patches.suse/0004-btrfs-move-ref_mod-modification-into-the-if-ref-logi.patch b/patches.suse/0004-btrfs-move-ref_mod-modification-into-the-if-ref-logi.patch
new file mode 100644
index 0000000000..6ec779dbd3
--- /dev/null
+++ b/patches.suse/0004-btrfs-move-ref_mod-modification-into-the-if-ref-logi.patch
@@ -0,0 +1,46 @@
+From 1ce7a5ec44c8b148c4600e25c696a135319734db Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:55 -0400
+Git-commit: 1ce7a5ec44c8b148c4600e25c696a135319734db
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 4/7] btrfs: move ref_mod modification into the if (ref) logic
+
+We only use this logic if our ref isn't a ref_head, so move it up into
+the if (ref) case since we know that this is a normal ref and not a
+delayed ref head.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 5e61e9287b0e..0dcbbeacaadc 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2744,10 +2744,6 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ list_del(&ref->list);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+- }
+- atomic_dec(&delayed_refs->num_entries);
+-
+- if (!btrfs_delayed_ref_is_head(ref)) {
+ /*
+ * when we play the delayed ref, also correct the
+ * ref_mod on head
+@@ -2764,6 +2760,8 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ WARN_ON(1);
+ }
+ }
++ atomic_dec(&delayed_refs->num_entries);
++
+ /*
+ * Record the must-insert_reserved flag before we drop the spin
+ * lock.
+--
+2.21.0
+
diff --git a/patches.suse/0005-btrfs-Open-code-add_delayed_data_ref.patch b/patches.suse/0005-btrfs-Open-code-add_delayed_data_ref.patch
new file mode 100644
index 0000000000..4bb5260040
--- /dev/null
+++ b/patches.suse/0005-btrfs-Open-code-add_delayed_data_ref.patch
@@ -0,0 +1,125 @@
+From cd7f9699b113434467434580ebb8d9b328152fb8 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:21 +0300
+Git-commit: cd7f9699b113434467434580ebb8d9b328152fb8
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 5/8] btrfs: Open-code add_delayed_data_ref
+
+Now that the initialization part and the critical section code have been
+split it's a lot easier to open code add_delayed_data_ref. Do so in the
+following manner:
+
+1. The common init function is put immediately after memory-to-be-initialized
+ is allocated, followed by the specific data ref initialization.
+
+2. The only piece of code that remains in the critical section is
+ insert_delayed_ref call.
+
+3. Tracing and memory freeing code is moved outside of the critical
+ section.
+
+No functional changes, just an overall shorter critical section.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 65 +++++++++++++++----------------------------------
+ 1 file changed, 21 insertions(+), 44 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -713,47 +713,6 @@ static void init_delayed_ref_common(stru
+ }
+
+ /*
+- * helper to insert a delayed data ref into the rbtree.
+- */
+-static noinline void
+-add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+- struct btrfs_trans_handle *trans,
+- struct btrfs_delayed_ref_head *head_ref,
+- struct btrfs_delayed_ref_node *ref, u64 bytenr,
+- u64 num_bytes, u64 parent, u64 ref_root, u64 owner,
+- u64 offset, int action)
+-{
+- struct btrfs_delayed_data_ref *full_ref;
+- struct btrfs_delayed_ref_root *delayed_refs;
+- u8 ref_type;
+- int ret;
+-
+- delayed_refs = &trans->transaction->delayed_refs;
+-
+-
+- full_ref = btrfs_delayed_node_to_data_ref(ref);
+- if (parent)
+- ref_type = BTRFS_SHARED_DATA_REF_KEY;
+- else
+- ref_type = BTRFS_EXTENT_DATA_REF_KEY;
+-
+- init_delayed_ref_common(fs_info, ref, bytenr, num_bytes,
+- ref_root, action, ref_type);
+- full_ref->root = ref_root;
+- full_ref->parent = parent;
+- full_ref->objectid = owner;
+- full_ref->offset = offset;
+-
+- trace_add_delayed_data_ref(fs_info, ref, full_ref,
+- action == BTRFS_ADD_DELAYED_EXTENT ?
+- BTRFS_ADD_DELAYED_REF : action);
+-
+- ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+- if (ret > 0)
+- kmem_cache_free(btrfs_delayed_data_ref_cachep, full_ref);
+-}
+-
+-/*
+ * add a delayed tree ref. This does all of the accounting required
+ * to make sure the delayed ref is eventually processed before this
+ * transaction commits.
+@@ -851,11 +810,25 @@ int btrfs_add_delayed_data_ref(struct bt
+ struct btrfs_delayed_ref_root *delayed_refs;
+ struct btrfs_qgroup_extent_record *record = NULL;
+ int qrecord_inserted;
++ int ret;
++ u8 ref_type;
+
+ ref = kmem_cache_alloc(btrfs_delayed_data_ref_cachep, GFP_NOFS);
+ if (!ref)
+ return -ENOMEM;
+
++ if (parent)
++ ref_type = BTRFS_SHARED_DATA_REF_KEY;
++ else
++ ref_type = BTRFS_EXTENT_DATA_REF_KEY;
++ init_delayed_ref_common(fs_info, &ref->node, bytenr, num_bytes,
++ ref_root, action, ref_type);
++ ref->root = ref_root;
++ ref->parent = parent;
++ ref->objectid = owner;
++ ref->offset = offset;
++
++
+ head_ref = kmem_cache_alloc(btrfs_delayed_ref_head_cachep, GFP_NOFS);
+ if (!head_ref) {
+ kmem_cache_free(btrfs_delayed_data_ref_cachep, ref);
+@@ -887,11 +860,15 @@ int btrfs_add_delayed_data_ref(struct bt
+ action, 1, 0, &qrecord_inserted,
+ old_ref_mod, new_ref_mod);
+
+- add_delayed_data_ref(fs_info, trans, head_ref, &ref->node, bytenr,
+- num_bytes, parent, ref_root, owner, offset,
+- action);
++ ret = insert_delayed_ref(trans, delayed_refs, head_ref, &ref->node);
+ spin_unlock(&delayed_refs->lock);
+
++ trace_add_delayed_data_ref(trans->fs_info, &ref->node, ref,
++ action == BTRFS_ADD_DELAYED_EXTENT ?
++ BTRFS_ADD_DELAYED_REF : action);
++ if (ret > 0)
++ kmem_cache_free(btrfs_delayed_data_ref_cachep, ref);
++
+ if (qrecord_inserted)
+ return btrfs_qgroup_trace_extent_post(fs_info, record);
+ return 0;
diff --git a/patches.suse/0005-btrfs-move-all-ref-head-cleanup-to-the-helper-functi.patch b/patches.suse/0005-btrfs-move-all-ref-head-cleanup-to-the-helper-functi.patch
new file mode 100644
index 0000000000..6be92b2214
--- /dev/null
+++ b/patches.suse/0005-btrfs-move-all-ref-head-cleanup-to-the-helper-functi.patch
@@ -0,0 +1,211 @@
+From c1103f7a5d7a544dfdaca6102de68792909dc834 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:56 -0400
+Git-commit: c1103f7a5d7a544dfdaca6102de68792909dc834
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 5/7] btrfs: move all ref head cleanup to the helper function
+
+We do a couple different cleanup operations on the ref head. We adjust
+counters, we'll free any reserved space if we didn't end up using the
+ref, and we clear the pending csum bytes. Move all these disparate
+things into cleanup_ref_head and clean up the logic in
+__btrfs_run_delayed_refs so that it handles the !ref case a lot cleaner,
+as well as making run_one_delayed_ref() only deal with real refs and not
+the ref head.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 145 ++++++++++++++++++-----------------------
+ 1 file changed, 64 insertions(+), 81 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 0dcbbeacaadc..628ae71094f2 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2500,44 +2500,6 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
+- if (btrfs_delayed_ref_is_head(node)) {
+- struct btrfs_delayed_ref_head *head;
+- /*
+- * we've hit the end of the chain and we were supposed
+- * to insert this extent into the tree. But, it got
+- * deleted before we ever needed to insert it, so all
+- * we have to do is clean up the accounting
+- */
+- BUG_ON(extent_op);
+- head = btrfs_delayed_node_to_head(node);
+- trace_run_delayed_ref_head(fs_info, node, head, node->action);
+-
+- if (head->total_ref_mod < 0) {
+- struct btrfs_block_group_cache *cache;
+-
+- cache = btrfs_lookup_block_group(fs_info, node->bytenr);
+- ASSERT(cache);
+- percpu_counter_add(&cache->space_info->total_bytes_pinned,
+- -node->num_bytes);
+- btrfs_put_block_group(cache);
+- }
+-
+- if (insert_reserved) {
+- btrfs_pin_extent(fs_info, node->bytenr,
+- node->num_bytes, 1);
+- if (head->is_data) {
+- ret = btrfs_del_csums(trans, fs_info,
+- node->bytenr,
+- node->num_bytes);
+- }
+- }
+-
+- /* Also free its reserved qgroup space */
+- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
+- head->qgroup_reserved);
+- return ret;
+- }
+-
+ if (node->type == BTRFS_TREE_BLOCK_REF_KEY ||
+ node->type == BTRFS_SHARED_BLOCK_REF_KEY)
+ ret = run_delayed_tree_ref(trans, fs_info, node, extent_op,
+@@ -2639,6 +2601,43 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ delayed_refs->num_heads--;
+ rb_erase(&head->href_node, &delayed_refs->href_root);
+ spin_unlock(&delayed_refs->lock);
++ spin_unlock(&head->lock);
++ atomic_dec(&delayed_refs->num_entries);
++
++ trace_run_delayed_ref_head(fs_info, &head->node, head,
++ head->node.action);
++
++ if (head->total_ref_mod < 0) {
++ struct btrfs_block_group_cache *cache;
++
++ cache = btrfs_lookup_block_group(fs_info, head->node.bytenr);
++ ASSERT(cache);
++ percpu_counter_add(&cache->space_info->total_bytes_pinned,
++ -head->node.num_bytes);
++ btrfs_put_block_group(cache);
++
++ if (head->is_data) {
++ spin_lock(&delayed_refs->lock);
++ delayed_refs->pending_csums -= head->node.num_bytes;
++ spin_unlock(&delayed_refs->lock);
++ }
++ }
++
++ if (head->must_insert_reserved) {
++ btrfs_pin_extent(fs_info, head->node.bytenr,
++ head->node.num_bytes, 1);
++ if (head->is_data) {
++ ret = btrfs_del_csums(trans, fs_info,
++ head->node.bytenr,
++ head->node.num_bytes);
++ }
++ }
++
++ /* Also free its reserved qgroup space */
++ btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
++ head->qgroup_reserved);
++ btrfs_delayed_ref_unlock(head);
++ btrfs_put_delayed_ref(&head->node);
+ return 0;
+ }
+
+@@ -2722,6 +2721,10 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ continue;
+ }
+
++ /*
++ * We're done processing refs in this ref_head, clean everything
++ * up and move on to the next ref_head.
++ */
+ if (!ref) {
+ ret = cleanup_ref_head(trans, fs_info, locked_ref);
+ if (ret > 0 ) {
+@@ -2731,34 +2734,30 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ } else if (ret) {
+ return ret;
+ }
++ locked_ref = NULL;
++ count++;
++ continue;
++ }
+
+- /*
+- * All delayed refs have been processed, Go ahead and
+- * send the head node to run_one_delayed_ref, so that
+- * any accounting fixes can happen
+- */
+- ref = &locked_ref->node;
+- } else {
+- actual_count++;
+- ref->in_tree = 0;
+- list_del(&ref->list);
+- if (!list_empty(&ref->add_list))
+- list_del(&ref->add_list);
+- /*
+- * when we play the delayed ref, also correct the
+- * ref_mod on head
+- */
+- switch (ref->action) {
+- case BTRFS_ADD_DELAYED_REF:
+- case BTRFS_ADD_DELAYED_EXTENT:
+- locked_ref->node.ref_mod -= ref->ref_mod;
+- break;
+- case BTRFS_DROP_DELAYED_REF:
+- locked_ref->node.ref_mod += ref->ref_mod;
+- break;
+- default:
+- WARN_ON(1);
+- }
++ actual_count++;
++ ref->in_tree = 0;
++ list_del(&ref->list);
++ if (!list_empty(&ref->add_list))
++ list_del(&ref->add_list);
++ /*
++ * When we play the delayed ref, also correct the ref_mod on
++ * head
++ */
++ switch (ref->action) {
++ case BTRFS_ADD_DELAYED_REF:
++ case BTRFS_ADD_DELAYED_EXTENT:
++ locked_ref->node.ref_mod -= ref->ref_mod;
++ break;
++ case BTRFS_DROP_DELAYED_REF:
++ locked_ref->node.ref_mod += ref->ref_mod;
++ break;
++ default:
++ WARN_ON(1);
+ }
+ atomic_dec(&delayed_refs->num_entries);
+
+@@ -2785,22 +2784,6 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ return ret;
+ }
+
+- /*
+- * If this node is a head, that means all the refs in this head
+- * have been dealt with, and we will pick the next head to deal
+- * with, so we must unlock the head and drop it from the cluster
+- * list before we release it.
+- */
+- if (btrfs_delayed_ref_is_head(ref)) {
+- if (locked_ref->is_data &&
+- locked_ref->total_ref_mod < 0) {
+- spin_lock(&delayed_refs->lock);
+- delayed_refs->pending_csums -= ref->num_bytes;
+- spin_unlock(&delayed_refs->lock);
+- }
+- btrfs_delayed_ref_unlock(locked_ref);
+- locked_ref = NULL;
+- }
+ btrfs_put_delayed_ref(ref);
+ count++;
+ cond_resched();
+--
+2.21.0
+
diff --git a/patches.suse/0006-btrfs-Introduce-init_delayed_ref_head.patch b/patches.suse/0006-btrfs-Introduce-init_delayed_ref_head.patch
new file mode 100644
index 0000000000..1593956fc0
--- /dev/null
+++ b/patches.suse/0006-btrfs-Introduce-init_delayed_ref_head.patch
@@ -0,0 +1,102 @@
+From a2e569b3f2b138f2c25b4598cf4b18af8af39abd Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:22 +0300
+Git-commit: a2e569b3f2b138f2c25b4598cf4b18af8af39abd
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 6/8] btrfs: Introduce init_delayed_ref_head
+
+add_delayed_ref_head implements the logic to both initialize a head_ref
+structure as well as perform the necessary operations to add it to the
+delayed ref machinery. This has resulted in a very cumebrsome interface
+with loads of parameters and code, which at first glance, looks very
+unwieldy. Begin untangling it by first extracting the initialization
+only code in its own function. It's more or less verbatim copy of the
+first part of add_delayed_ref_head.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 65 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 65 insertions(+)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 3fa8ea5cbbc6..227094efd050 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -526,6 +526,71 @@ update_existing_head_ref(struct btrfs_delayed_ref_root *delayed_refs,
+ spin_unlock(&existing->lock);
+ }
+
++static void init_delayed_ref_head(struct btrfs_delayed_ref_head *head_ref,
++ struct btrfs_qgroup_extent_record *qrecord,
++ u64 bytenr, u64 num_bytes, u64 ref_root,
++ u64 reserved, int action, bool is_data,
++ bool is_system)
++{
++ int count_mod = 1;
++ int must_insert_reserved = 0;
++
++ /* If reserved is provided, it must be a data extent. */
++ BUG_ON(!is_data && reserved);
++
++ /*
++ * The head node stores the sum of all the mods, so dropping a ref
++ * should drop the sum in the head node by one.
++ */
++ if (action == BTRFS_UPDATE_DELAYED_HEAD)
++ count_mod = 0;
++ else if (action == BTRFS_DROP_DELAYED_REF)
++ count_mod = -1;
++
++ /*
++ * BTRFS_ADD_DELAYED_EXTENT means that we need to update the reserved
++ * accounting when the extent is finally added, or if a later
++ * modification deletes the delayed ref without ever inserting the
++ * extent into the extent allocation tree. ref->must_insert_reserved
++ * is the flag used to record that accounting mods are required.
++ *
++ * Once we record must_insert_reserved, switch the action to
++ * BTRFS_ADD_DELAYED_REF because other special casing is not required.
++ */
++ if (action == BTRFS_ADD_DELAYED_EXTENT)
++ must_insert_reserved = 1;
++ else
++ must_insert_reserved = 0;
++
++ refcount_set(&head_ref->refs, 1);
++ head_ref->bytenr = bytenr;
++ head_ref->num_bytes = num_bytes;
++ head_ref->ref_mod = count_mod;
++ head_ref->must_insert_reserved = must_insert_reserved;
++ head_ref->is_data = is_data;
++ head_ref->is_system = is_system;
++ head_ref->ref_tree = RB_ROOT;
++ INIT_LIST_HEAD(&head_ref->ref_add_list);
++ RB_CLEAR_NODE(&head_ref->href_node);
++ head_ref->processing = 0;
++ head_ref->total_ref_mod = count_mod;
++ head_ref->qgroup_reserved = 0;
++ head_ref->qgroup_ref_root = 0;
++ spin_lock_init(&head_ref->lock);
++ mutex_init(&head_ref->mutex);
++
++ if (qrecord) {
++ if (ref_root && reserved) {
++ head_ref->qgroup_ref_root = ref_root;
++ head_ref->qgroup_reserved = reserved;
++ }
++
++ qrecord->bytenr = bytenr;
++ qrecord->num_bytes = num_bytes;
++ qrecord->old_roots = NULL;
++ }
++}
++
+ /*
+ * helper function to actually insert a head node into the rbtree.
+ * this does all the dirty work in terms of maintaining the correct
+--
+2.21.0
+
diff --git a/patches.suse/0006-btrfs-extent-tree-Use-btrfs_ref-to-refactor-add_pinn.patch b/patches.suse/0006-btrfs-extent-tree-Use-btrfs_ref-to-refactor-add_pinn.patch
new file mode 100644
index 0000000000..7eaad9adcd
--- /dev/null
+++ b/patches.suse/0006-btrfs-extent-tree-Use-btrfs_ref-to-refactor-add_pinn.patch
@@ -0,0 +1,70 @@
+From ddf30cf03fb53b9a0ad0f355a69dbedf416edde9 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:34 +0800
+Git-commit: ddf30cf03fb53b9a0ad0f355a69dbedf416edde9
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 6/9] btrfs: extent-tree: Use btrfs_ref to refactor
+ add_pinned_bytes()
+
+Since add_pinned_bytes() only needs to know if the extent is metadata
+and if it's a chunk tree extent, btrfs_ref is a perfect match for it, as
+we don't need various owner/level trick to determine extent type.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -767,14 +767,15 @@ static struct btrfs_space_info *__find_s
+ return NULL;
+ }
+
+-static void add_pinned_bytes(struct btrfs_fs_info *fs_info, s64 num_bytes,
+- u64 owner, u64 root_objectid)
++static void add_pinned_bytes(struct btrfs_fs_info *fs_info,
++ struct btrfs_ref *ref)
+ {
+ struct btrfs_space_info *space_info;
++ s64 num_bytes = -ref->len;
+ u64 flags;
+
+- if (owner < BTRFS_FIRST_FREE_OBJECTID) {
+- if (root_objectid == BTRFS_CHUNK_TREE_OBJECTID)
++ if (ref->type == BTRFS_REF_METADATA) {
++ if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID)
+ flags = BTRFS_BLOCK_GROUP_SYSTEM;
+ else
+ flags = BTRFS_BLOCK_GROUP_METADATA;
+@@ -2134,7 +2135,7 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ }
+
+ if (ret == 0 && old_ref_mod < 0 && new_ref_mod >= 0)
+- add_pinned_bytes(fs_info, -num_bytes, owner, root_objectid);
++ add_pinned_bytes(fs_info, &generic_ref);
+
+ return ret;
+ }
+@@ -7167,8 +7168,7 @@ void btrfs_free_tree_block(struct btrfs_
+ }
+ out:
+ if (pin)
+- add_pinned_bytes(fs_info, buf->len, btrfs_header_level(buf),
+- root->root_key.objectid);
++ add_pinned_bytes(fs_info, &generic_ref);
+
+ if (last_ref) {
+ /*
+@@ -7217,7 +7217,7 @@ int btrfs_free_extent(struct btrfs_trans
+ }
+
+ if (ret == 0 && old_ref_mod >= 0 && new_ref_mod < 0)
+- add_pinned_bytes(fs_info, num_bytes, owner, root_objectid);
++ add_pinned_bytes(fs_info, &generic_ref);
+
+ return ret;
+ }
diff --git a/patches.suse/0006-btrfs-remove-delayed_ref_node-from-ref_head.patch b/patches.suse/0006-btrfs-remove-delayed_ref_node-from-ref_head.patch
new file mode 100644
index 0000000000..72ff11a51c
--- /dev/null
+++ b/patches.suse/0006-btrfs-remove-delayed_ref_node-from-ref_head.patch
@@ -0,0 +1,780 @@
+From d278850eff3053ef166cf64c16f798dfe36278a2 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:57 -0400
+Git-commit: d278850eff3053ef166cf64c16f798dfe36278a2
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 6/7] btrfs: remove delayed_ref_node from ref_head
+
+This is just excessive information in the ref_head, and makes the code
+complicated. It is a relic from when we had the heads and the refs in
+the same tree, which is no longer the case. With this removal I've
+cleaned up a bunch of the cruft around this old assumption as well.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/backref.c | 4 +-
+ fs/btrfs/delayed-ref.c | 126 +++++++++++++++--------------------
+ fs/btrfs/delayed-ref.h | 49 +++++---------
+ fs/btrfs/disk-io.c | 12 ++--
+ fs/btrfs/extent-tree.c | 90 ++++++++++---------------
+ include/trace/events/btrfs.h | 13 ++--
+ 6 files changed, 119 insertions(+), 175 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index b517ef1477ea..33cba1abf8b6 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1178,7 +1178,7 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
+ head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
+ if (head) {
+ if (!mutex_trylock(&head->mutex)) {
+- refcount_inc(&head->node.refs);
++ refcount_inc(&head->refs);
+ spin_unlock(&delayed_refs->lock);
+
+ btrfs_release_path(path);
+@@ -1189,7 +1189,7 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans,
+ */
+ mutex_lock(&head->mutex);
+ mutex_unlock(&head->mutex);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ goto again;
+ }
+ spin_unlock(&delayed_refs->lock);
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 93ffa898df6d..b9b41c838da4 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -96,15 +96,15 @@ static struct btrfs_delayed_ref_head *htree_insert(struct rb_root *root,
+ u64 bytenr;
+
+ ins = rb_entry(node, struct btrfs_delayed_ref_head, href_node);
+- bytenr = ins->node.bytenr;
++ bytenr = ins->bytenr;
+ while (*p) {
+ parent_node = *p;
+ entry = rb_entry(parent_node, struct btrfs_delayed_ref_head,
+ href_node);
+
+- if (bytenr < entry->node.bytenr)
++ if (bytenr < entry->bytenr)
+ p = &(*p)->rb_left;
+- else if (bytenr > entry->node.bytenr)
++ else if (bytenr > entry->bytenr)
+ p = &(*p)->rb_right;
+ else
+ return entry;
+@@ -133,15 +133,15 @@ find_ref_head(struct rb_root *root, u64 bytenr,
+ while (n) {
+ entry = rb_entry(n, struct btrfs_delayed_ref_head, href_node);
+
+- if (bytenr < entry->node.bytenr)
++ if (bytenr < entry->bytenr)
+ n = n->rb_left;
+- else if (bytenr > entry->node.bytenr)
++ else if (bytenr > entry->bytenr)
+ n = n->rb_right;
+ else
+ return entry;
+ }
+ if (entry && return_bigger) {
+- if (bytenr > entry->node.bytenr) {
++ if (bytenr > entry->bytenr) {
+ n = rb_next(&entry->href_node);
+ if (!n)
+ n = rb_first(root);
+@@ -164,17 +164,17 @@ int btrfs_delayed_ref_lock(struct btrfs_trans_handle *trans,
+ if (mutex_trylock(&head->mutex))
+ return 0;
+
+- refcount_inc(&head->node.refs);
++ refcount_inc(&head->refs);
+ spin_unlock(&delayed_refs->lock);
+
+ mutex_lock(&head->mutex);
+ spin_lock(&delayed_refs->lock);
+- if (!head->node.in_tree) {
++ if (RB_EMPTY_NODE(&head->href_node)) {
+ mutex_unlock(&head->mutex);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ return -EAGAIN;
+ }
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ return 0;
+ }
+
+@@ -183,15 +183,10 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head,
+ struct btrfs_delayed_ref_node *ref)
+ {
+- if (btrfs_delayed_ref_is_head(ref)) {
+- head = btrfs_delayed_node_to_head(ref);
+- rb_erase(&head->href_node, &delayed_refs->href_root);
+- } else {
+- assert_spin_locked(&head->lock);
+- list_del(&ref->list);
+- if (!list_empty(&ref->add_list))
+- list_del(&ref->add_list);
+- }
++ assert_spin_locked(&head->lock);
++ list_del(&ref->list);
++ if (!list_empty(&ref->add_list))
++ list_del(&ref->add_list);
+ ref->in_tree = 0;
+ btrfs_put_delayed_ref(ref);
+ atomic_dec(&delayed_refs->num_entries);
+@@ -380,8 +375,8 @@ btrfs_select_ref_head(struct btrfs_trans_handle *trans)
+ head->processing = 1;
+ WARN_ON(delayed_refs->num_heads_ready == 0);
+ delayed_refs->num_heads_ready--;
+- delayed_refs->run_delayed_start = head->node.bytenr +
+- head->node.num_bytes;
++ delayed_refs->run_delayed_start = head->bytenr +
++ head->num_bytes;
+ return head;
+ }
+
+@@ -469,20 +464,16 @@ add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+ */
+ static noinline void
+ update_existing_head_ref(struct btrfs_delayed_ref_root *delayed_refs,
+- struct btrfs_delayed_ref_node *existing,
+- struct btrfs_delayed_ref_node *update,
++ struct btrfs_delayed_ref_head *existing,
++ struct btrfs_delayed_ref_head *update,
+ int *old_ref_mod_ret)
+ {
+- struct btrfs_delayed_ref_head *existing_ref;
+- struct btrfs_delayed_ref_head *ref;
+ int old_ref_mod;
+
+- existing_ref = btrfs_delayed_node_to_head(existing);
+- ref = btrfs_delayed_node_to_head(update);
+- BUG_ON(existing_ref->is_data != ref->is_data);
++ BUG_ON(existing->is_data != update->is_data);
+
+- spin_lock(&existing_ref->lock);
+- if (ref->must_insert_reserved) {
++ spin_lock(&existing->lock);
++ if (update->must_insert_reserved) {
+ /* if the extent was freed and then
+ * reallocated before the delayed ref
+ * entries were processed, we can end up
+@@ -490,7 +481,7 @@ update_existing_head_ref(struct btrfs_delayed_ref_root *delayed_refs,
+ * the must_insert_reserved flag set.
+ * Set it again here
+ */
+- existing_ref->must_insert_reserved = ref->must_insert_reserved;
++ existing->must_insert_reserved = update->must_insert_reserved;
+
+ /*
+ * update the num_bytes so we make sure the accounting
+@@ -500,22 +491,22 @@ update_existing_head_ref(struct btrfs_delayed_ref_root *delayed_refs,
+
+ }
+
+- if (ref->extent_op) {
+- if (!existing_ref->extent_op) {
+- existing_ref->extent_op = ref->extent_op;
++ if (update->extent_op) {
++ if (!existing->extent_op) {
++ existing->extent_op = update->extent_op;
+ } else {
+- if (ref->extent_op->update_key) {
+- memcpy(&existing_ref->extent_op->key,
+- &ref->extent_op->key,
+- sizeof(ref->extent_op->key));
+- existing_ref->extent_op->update_key = true;
++ if (update->extent_op->update_key) {
++ memcpy(&existing->extent_op->key,
++ &update->extent_op->key,
++ sizeof(update->extent_op->key));
++ existing->extent_op->update_key = true;
+ }
+- if (ref->extent_op->update_flags) {
+- existing_ref->extent_op->flags_to_set |=
+- ref->extent_op->flags_to_set;
+- existing_ref->extent_op->update_flags = true;
++ if (update->extent_op->update_flags) {
++ existing->extent_op->flags_to_set |=
++ update->extent_op->flags_to_set;
++ existing->extent_op->update_flags = true;
+ }
+- btrfs_free_delayed_extent_op(ref->extent_op);
++ btrfs_free_delayed_extent_op(update->extent_op);
+ }
+ }
+ /*
+@@ -523,23 +514,23 @@ update_existing_head_ref(struct btrfs_delayed_ref_root *delayed_refs,
+ * only need the lock for this case cause we could be processing it
+ * currently, for refs we just added we know we're a-ok.
+ */
+- old_ref_mod = existing_ref->total_ref_mod;
++ old_ref_mod = existing->total_ref_mod;
+ if (old_ref_mod_ret)
+ *old_ref_mod_ret = old_ref_mod;
+ existing->ref_mod += update->ref_mod;
+- existing_ref->total_ref_mod += update->ref_mod;
++ existing->total_ref_mod += update->ref_mod;
+
+ /*
+ * If we are going to from a positive ref mod to a negative or vice
+ * versa we need to make sure to adjust pending_csums accordingly.
+ */
+- if (existing_ref->is_data) {
+- if (existing_ref->total_ref_mod >= 0 && old_ref_mod < 0)
++ if (existing->is_data) {
++ if (existing->total_ref_mod >= 0 && old_ref_mod < 0)
+ delayed_refs->pending_csums -= existing->num_bytes;
+- if (existing_ref->total_ref_mod < 0 && old_ref_mod >= 0)
++ if (existing->total_ref_mod < 0 && old_ref_mod >= 0)
+ delayed_refs->pending_csums += existing->num_bytes;
+ }
+- spin_unlock(&existing_ref->lock);
++ spin_unlock(&existing->lock);
+ }
+
+ /*
+@@ -550,14 +541,13 @@ update_existing_head_ref(struct btrfs_delayed_ref_root *delayed_refs,
+ static noinline struct btrfs_delayed_ref_head *
+ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+- struct btrfs_delayed_ref_node *ref,
++ struct btrfs_delayed_ref_head *head_ref,
+ struct btrfs_qgroup_extent_record *qrecord,
+ u64 bytenr, u64 num_bytes, u64 ref_root, u64 reserved,
+ int action, int is_data, int *qrecord_inserted_ret,
+ int *old_ref_mod, int *new_ref_mod)
+ {
+ struct btrfs_delayed_ref_head *existing;
+- struct btrfs_delayed_ref_head *head_ref = NULL;
+ struct btrfs_delayed_ref_root *delayed_refs;
+ int count_mod = 1;
+ int must_insert_reserved = 0;
+@@ -593,26 +583,21 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
+
+ delayed_refs = &trans->transaction->delayed_refs;
+
+- /* first set the basic ref node struct up */
+- refcount_set(&ref->refs, 1);
+- ref->bytenr = bytenr;
+- ref->num_bytes = num_bytes;
+- ref->ref_mod = count_mod;
+- ref->type = 0;
+- ref->action = 0;
+- ref->is_head = 1;
+- ref->in_tree = 1;
+- ref->seq = 0;
+-
+- head_ref = btrfs_delayed_node_to_head(ref);
++ refcount_set(&head_ref->refs, 1);
++ head_ref->bytenr = bytenr;
++ head_ref->num_bytes = num_bytes;
++ head_ref->ref_mod = count_mod;
+ head_ref->must_insert_reserved = must_insert_reserved;
+ head_ref->is_data = is_data;
+ INIT_LIST_HEAD(&head_ref->ref_list);
+ INIT_LIST_HEAD(&head_ref->ref_add_list);
++ RB_CLEAR_NODE(&head_ref->href_node);
+ head_ref->processing = 0;
+ head_ref->total_ref_mod = count_mod;
+ head_ref->qgroup_reserved = 0;
+ head_ref->qgroup_ref_root = 0;
++ spin_lock_init(&head_ref->lock);
++ mutex_init(&head_ref->mutex);
+
+ /* Record qgroup extent info if provided */
+ if (qrecord) {
+@@ -632,17 +617,14 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
+ qrecord_inserted = 1;
+ }
+
+- spin_lock_init(&head_ref->lock);
+- mutex_init(&head_ref->mutex);
+-
+- trace_add_delayed_ref_head(fs_info, ref, head_ref, action);
++ trace_add_delayed_ref_head(fs_info, head_ref, action);
+
+ existing = htree_insert(&delayed_refs->href_root,
+ &head_ref->href_node);
+ if (existing) {
+ WARN_ON(ref_root && reserved && existing->qgroup_ref_root
+ && existing->qgroup_reserved);
+- update_existing_head_ref(delayed_refs, &existing->node, ref,
++ update_existing_head_ref(delayed_refs, existing, head_ref,
+ old_ref_mod);
+ /*
+ * we've updated the existing ref, free the newly
+@@ -821,7 +803,7 @@ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ * insert both the head node and the new ref without dropping
+ * the spin lock
+ */
+- head_ref = add_delayed_ref_head(fs_info, trans, &head_ref->node, record,
++ head_ref = add_delayed_ref_head(fs_info, trans, head_ref, record,
+ bytenr, num_bytes, 0, 0, action, 0,
+ &qrecord_inserted, old_ref_mod,
+ new_ref_mod);
+@@ -888,7 +870,7 @@ int btrfs_add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+ * insert both the head node and the new ref without dropping
+ * the spin lock
+ */
+- head_ref = add_delayed_ref_head(fs_info, trans, &head_ref->node, record,
++ head_ref = add_delayed_ref_head(fs_info, trans, head_ref, record,
+ bytenr, num_bytes, ref_root, reserved,
+ action, 1, &qrecord_inserted,
+ old_ref_mod, new_ref_mod);
+@@ -920,7 +902,7 @@ int btrfs_add_delayed_extent_op(struct btrfs_fs_info *fs_info,
+ delayed_refs = &trans->transaction->delayed_refs;
+ spin_lock(&delayed_refs->lock);
+
+- add_delayed_ref_head(fs_info, trans, &head_ref->node, NULL, bytenr,
++ add_delayed_ref_head(fs_info, trans, head_ref, NULL, bytenr,
+ num_bytes, 0, 0, BTRFS_UPDATE_DELAYED_HEAD,
+ extent_op->is_data, NULL, NULL, NULL);
+
+diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
+index ce88e4ac5276..1ce11858d727 100644
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -26,15 +26,6 @@
+ #define BTRFS_ADD_DELAYED_EXTENT 3 /* record a full extent allocation */
+ #define BTRFS_UPDATE_DELAYED_HEAD 4 /* not changing ref count on head ref */
+
+-/*
+- * XXX: Qu: I really hate the design that ref_head and tree/data ref shares the
+- * same ref_node structure.
+- * Ref_head is in a higher logic level than tree/data ref, and duplicated
+- * bytenr/num_bytes in ref_node is really a waste or memory, they should be
+- * referred from ref_head.
+- * This gets more disgusting after we use list to store tree/data ref in
+- * ref_head. Must clean this mess up later.
+- */
+ struct btrfs_delayed_ref_node {
+ /*data/tree ref use list, stored in ref_head->ref_list. */
+ struct list_head list;
+@@ -91,8 +82,9 @@ struct btrfs_delayed_extent_op {
+ * reference count modifications we've queued up.
+ */
+ struct btrfs_delayed_ref_head {
+- struct btrfs_delayed_ref_node node;
+-
++ u64 bytenr;
++ u64 num_bytes;
++ refcount_t refs;
+ /*
+ * the mutex is held while running the refs, and it is also
+ * held when checking the sum of reference modifications.
+@@ -115,6 +107,14 @@ struct btrfs_delayed_ref_head {
+ */
+ int total_ref_mod;
+
++ /*
++ * This is the current outstanding mod references for this bytenr. This
++ * is used with lookup_extent_info to get an accurate reference count
++ * for a bytenr, so it is adjusted as delayed refs are run so that any
++ * on disk reference count + ref_mod is accurate.
++ */
++ int ref_mod;
++
+ /*
+ * For qgroup reserved space freeing.
+ *
+@@ -234,15 +234,18 @@ static inline void btrfs_put_delayed_ref(struct btrfs_delayed_ref_node *ref)
+ case BTRFS_SHARED_DATA_REF_KEY:
+ kmem_cache_free(btrfs_delayed_data_ref_cachep, ref);
+ break;
+- case 0:
+- kmem_cache_free(btrfs_delayed_ref_head_cachep, ref);
+- break;
+ default:
+ BUG();
+ }
+ }
+ }
+
++static inline void btrfs_put_delayed_ref_head(struct btrfs_delayed_ref_head *head)
++{
++ if (refcount_dec_and_test(&head->refs))
++ kmem_cache_free(btrfs_delayed_ref_head_cachep, head);
++}
++
+ int btrfs_add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ struct btrfs_trans_handle *trans,
+ u64 bytenr, u64 num_bytes, u64 parent,
+@@ -282,36 +285,18 @@ int btrfs_check_delayed_seq(struct btrfs_fs_info *fs_info,
+ struct btrfs_delayed_ref_root *delayed_refs,
+ u64 seq);
+
+-/*
+- * a node might live in a head or a regular ref, this lets you
+- * test for the proper type to use.
+- */
+-static int btrfs_delayed_ref_is_head(struct btrfs_delayed_ref_node *node)
+-{
+- return node->is_head;
+-}
+-
+ /*
+ * helper functions to cast a node into its container
+ */
+ static inline struct btrfs_delayed_tree_ref *
+ btrfs_delayed_node_to_tree_ref(struct btrfs_delayed_ref_node *node)
+ {
+- WARN_ON(btrfs_delayed_ref_is_head(node));
+ return container_of(node, struct btrfs_delayed_tree_ref, node);
+ }
+
+ static inline struct btrfs_delayed_data_ref *
+ btrfs_delayed_node_to_data_ref(struct btrfs_delayed_ref_node *node)
+ {
+- WARN_ON(btrfs_delayed_ref_is_head(node));
+ return container_of(node, struct btrfs_delayed_data_ref, node);
+ }
+-
+-static inline struct btrfs_delayed_ref_head *
+-btrfs_delayed_node_to_head(struct btrfs_delayed_ref_node *node)
+-{
+- WARN_ON(!btrfs_delayed_ref_is_head(node));
+- return container_of(node, struct btrfs_delayed_ref_head, node);
+-}
+ #endif
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index f971d5680e6f..69ce738c00d0 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4121,12 +4121,12 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+ head = rb_entry(node, struct btrfs_delayed_ref_head,
+ href_node);
+ if (!mutex_trylock(&head->mutex)) {
+- refcount_inc(&head->node.refs);
++ refcount_inc(&head->refs);
+ spin_unlock(&delayed_refs->lock);
+
+ mutex_lock(&head->mutex);
+ mutex_unlock(&head->mutex);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ spin_lock(&delayed_refs->lock);
+ continue;
+ }
+@@ -4147,16 +4147,16 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+ if (head->processing == 0)
+ delayed_refs->num_heads_ready--;
+ atomic_dec(&delayed_refs->num_entries);
+- head->node.in_tree = 0;
+ rb_erase(&head->href_node, &delayed_refs->href_root);
++ RB_CLEAR_NODE(&head->href_node);
+ spin_unlock(&head->lock);
+ spin_unlock(&delayed_refs->lock);
+ mutex_unlock(&head->mutex);
+
+ if (pin_bytes)
+- btrfs_pin_extent(fs_info, head->node.bytenr,
+- head->node.num_bytes, 1);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_pin_extent(fs_info, head->bytenr,
++ head->num_bytes, 1);
++ btrfs_put_delayed_ref_head(head);
+ cond_resched();
+ spin_lock(&delayed_refs->lock);
+ }
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 628ae71094f2..423d89145bac 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -912,7 +912,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
+ head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
+ if (head) {
+ if (!mutex_trylock(&head->mutex)) {
+- refcount_inc(&head->node.refs);
++ refcount_inc(&head->refs);
+ spin_unlock(&delayed_refs->lock);
+
+ btrfs_release_path(path);
+@@ -923,7 +923,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
+ */
+ mutex_lock(&head->mutex);
+ mutex_unlock(&head->mutex);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ goto search_again;
+ }
+ spin_lock(&head->lock);
+@@ -932,7 +932,7 @@ int btrfs_lookup_extent_info(struct btrfs_trans_handle *trans,
+ else
+ BUG_ON(num_refs == 0);
+
+- num_refs += head->node.ref_mod;
++ num_refs += head->ref_mod;
+ spin_unlock(&head->lock);
+ mutex_unlock(&head->mutex);
+ }
+@@ -2337,7 +2337,7 @@ static void __run_delayed_extent_op(struct btrfs_delayed_extent_op *extent_op,
+
+ static int run_delayed_extent_op(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info,
+- struct btrfs_delayed_ref_node *node,
++ struct btrfs_delayed_ref_head *head,
+ struct btrfs_delayed_extent_op *extent_op)
+ {
+ struct btrfs_key key;
+@@ -2359,14 +2359,14 @@ static int run_delayed_extent_op(struct btrfs_trans_handle *trans,
+ if (!path)
+ return -ENOMEM;
+
+- key.objectid = node->bytenr;
++ key.objectid = head->bytenr;
+
+ if (metadata) {
+ key.type = BTRFS_METADATA_ITEM_KEY;
+ key.offset = extent_op->level;
+ } else {
+ key.type = BTRFS_EXTENT_ITEM_KEY;
+- key.offset = node->num_bytes;
++ key.offset = head->num_bytes;
+ }
+
+ again:
+@@ -2383,17 +2383,17 @@ static int run_delayed_extent_op(struct btrfs_trans_handle *trans,
+ path->slots[0]--;
+ btrfs_item_key_to_cpu(path->nodes[0], &key,
+ path->slots[0]);
+- if (key.objectid == node->bytenr &&
++ if (key.objectid == head->bytenr &&
+ key.type == BTRFS_EXTENT_ITEM_KEY &&
+- key.offset == node->num_bytes)
++ key.offset == head->num_bytes)
+ ret = 0;
+ }
+ if (ret > 0) {
+ btrfs_release_path(path);
+ metadata = 0;
+
+- key.objectid = node->bytenr;
+- key.offset = node->num_bytes;
++ key.objectid = head->bytenr;
++ key.offset = head->num_bytes;
+ key.type = BTRFS_EXTENT_ITEM_KEY;
+ goto again;
+ }
+@@ -2562,7 +2562,7 @@ static int cleanup_extent_op(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+ spin_unlock(&head->lock);
+- ret = run_delayed_extent_op(trans, fs_info, &head->node, extent_op);
++ ret = run_delayed_extent_op(trans, fs_info, head, extent_op);
+ btrfs_free_delayed_extent_op(extent_op);
+ return ret ? ret : 1;
+ }
+@@ -2597,39 +2597,37 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ spin_unlock(&delayed_refs->lock);
+ return 1;
+ }
+- head->node.in_tree = 0;
+ delayed_refs->num_heads--;
+ rb_erase(&head->href_node, &delayed_refs->href_root);
++ RB_CLEAR_NODE(&head->href_node);
+ spin_unlock(&delayed_refs->lock);
+ spin_unlock(&head->lock);
+ atomic_dec(&delayed_refs->num_entries);
+
+- trace_run_delayed_ref_head(fs_info, &head->node, head,
+- head->node.action);
++ trace_run_delayed_ref_head(fs_info, head, 0);
+
+ if (head->total_ref_mod < 0) {
+ struct btrfs_block_group_cache *cache;
+
+- cache = btrfs_lookup_block_group(fs_info, head->node.bytenr);
++ cache = btrfs_lookup_block_group(fs_info, head->bytenr);
+ ASSERT(cache);
+ percpu_counter_add(&cache->space_info->total_bytes_pinned,
+- -head->node.num_bytes);
++ -head->num_bytes);
+ btrfs_put_block_group(cache);
+
+ if (head->is_data) {
+ spin_lock(&delayed_refs->lock);
+- delayed_refs->pending_csums -= head->node.num_bytes;
++ delayed_refs->pending_csums -= head->num_bytes;
+ spin_unlock(&delayed_refs->lock);
+ }
+ }
+
+ if (head->must_insert_reserved) {
+- btrfs_pin_extent(fs_info, head->node.bytenr,
+- head->node.num_bytes, 1);
++ btrfs_pin_extent(fs_info, head->bytenr,
++ head->num_bytes, 1);
+ if (head->is_data) {
+- ret = btrfs_del_csums(trans, fs_info,
+- head->node.bytenr,
+- head->node.num_bytes);
++ ret = btrfs_del_csums(trans, fs_info, head->bytenr,
++ head->num_bytes);
+ }
+ }
+
+@@ -2637,7 +2635,7 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
+ head->qgroup_reserved);
+ btrfs_delayed_ref_unlock(head);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ return 0;
+ }
+
+@@ -2751,10 +2749,10 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ switch (ref->action) {
+ case BTRFS_ADD_DELAYED_REF:
+ case BTRFS_ADD_DELAYED_EXTENT:
+- locked_ref->node.ref_mod -= ref->ref_mod;
++ locked_ref->ref_mod -= ref->ref_mod;
+ break;
+ case BTRFS_DROP_DELAYED_REF:
+- locked_ref->node.ref_mod += ref->ref_mod;
++ locked_ref->ref_mod += ref->ref_mod;
+ break;
+ default:
+ WARN_ON(1);
+@@ -3087,33 +3085,16 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ spin_unlock(&delayed_refs->lock);
+ goto out;
+ }
++ head = rb_entry(node, struct btrfs_delayed_ref_head,
++ href_node);
++ refcount_inc(&head->refs);
++ spin_unlock(&delayed_refs->lock);
+
+- while (node) {
+- head = rb_entry(node, struct btrfs_delayed_ref_head,
+- href_node);
+- if (btrfs_delayed_ref_is_head(&head->node)) {
+- struct btrfs_delayed_ref_node *ref;
+-
+- ref = &head->node;
+- refcount_inc(&ref->refs);
+-
+- spin_unlock(&delayed_refs->lock);
+- /*
+- * Mutex was contended, block until it's
+- * released and try again
+- */
+- mutex_lock(&head->mutex);
+- mutex_unlock(&head->mutex);
++ /* Mutex was contended, block until it's released and retry. */
++ mutex_lock(&head->mutex);
++ mutex_unlock(&head->mutex);
+
+- btrfs_put_delayed_ref(ref);
+- cond_resched();
+- goto again;
+- } else {
+- WARN_ON(1);
+- }
+- node = rb_next(node);
+- }
+- spin_unlock(&delayed_refs->lock);
++ btrfs_put_delayed_ref_head(head);
+ cond_resched();
+ goto again;
+ }
+@@ -3171,7 +3152,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ }
+
+ if (!mutex_trylock(&head->mutex)) {
+- refcount_inc(&head->node.refs);
++ refcount_inc(&head->refs);
+ spin_unlock(&delayed_refs->lock);
+
+ btrfs_release_path(path);
+@@ -3182,7 +3163,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ */
+ mutex_lock(&head->mutex);
+ mutex_unlock(&head->mutex);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ return -EAGAIN;
+ }
+ spin_unlock(&delayed_refs->lock);
+@@ -7235,9 +7216,8 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
+ * at this point we have a head with no other entries. Go
+ * ahead and process it.
+ */
+- head->node.in_tree = 0;
+ rb_erase(&head->href_node, &delayed_refs->href_root);
+-
++ RB_CLEAR_NODE(&head->href_node);
+ atomic_dec(&delayed_refs->num_entries);
+
+ /*
+@@ -7256,7 +7236,7 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
+ ret = 1;
+
+ mutex_unlock(&head->mutex);
+- btrfs_put_delayed_ref(&head->node);
++ btrfs_put_delayed_ref_head(head);
+ return ret;
+ out:
+ spin_unlock(&head->lock);
+diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
+index 77437f545c63..bfe2f23b578c 100644
+--- a/include/trace/events/btrfs.h
++++ b/include/trace/events/btrfs.h
+@@ -798,11 +798,10 @@ DEFINE_EVENT(btrfs_delayed_data_ref, run_delayed_data_ref,
+ DECLARE_EVENT_CLASS(btrfs_delayed_ref_head,
+
+ TP_PROTO(const struct btrfs_fs_info *fs_info,
+- const struct btrfs_delayed_ref_node *ref,
+ const struct btrfs_delayed_ref_head *head_ref,
+ int action),
+
+- TP_ARGS(fs_info, ref, head_ref, action),
++ TP_ARGS(fs_info, head_ref, action),
+
+ TP_STRUCT__entry_btrfs(
+ __field( u64, bytenr )
+@@ -812,8 +811,8 @@ DECLARE_EVENT_CLASS(btrfs_delayed_ref_head,
+ ),
+
+ TP_fast_assign_btrfs(fs_info,
+- __entry->bytenr = ref->bytenr;
+- __entry->num_bytes = ref->num_bytes;
++ __entry->bytenr = head_ref->bytenr;
++ __entry->num_bytes = head_ref->num_bytes;
+ __entry->action = action;
+ __entry->is_data = head_ref->is_data;
+ ),
+@@ -828,21 +827,19 @@ DECLARE_EVENT_CLASS(btrfs_delayed_ref_head,
+ DEFINE_EVENT(btrfs_delayed_ref_head, add_delayed_ref_head,
+
+ TP_PROTO(const struct btrfs_fs_info *fs_info,
+- const struct btrfs_delayed_ref_node *ref,
+ const struct btrfs_delayed_ref_head *head_ref,
+ int action),
+
+- TP_ARGS(fs_info, ref, head_ref, action)
++ TP_ARGS(fs_info, head_ref, action)
+ );
+
+ DEFINE_EVENT(btrfs_delayed_ref_head, run_delayed_ref_head,
+
+ TP_PROTO(const struct btrfs_fs_info *fs_info,
+- const struct btrfs_delayed_ref_node *ref,
+ const struct btrfs_delayed_ref_head *head_ref,
+ int action),
+
+- TP_ARGS(fs_info, ref, head_ref, action)
++ TP_ARGS(fs_info, head_ref, action)
+ );
+
+ #define show_chunk_type(type) \
+--
+2.21.0
+
diff --git a/patches.suse/0007-btrfs-Use-init_delayed_ref_head-in-add_delayed_ref_h.patch b/patches.suse/0007-btrfs-Use-init_delayed_ref_head-in-add_delayed_ref_h.patch
new file mode 100644
index 0000000000..d41cf73dd5
--- /dev/null
+++ b/patches.suse/0007-btrfs-Use-init_delayed_ref_head-in-add_delayed_ref_h.patch
@@ -0,0 +1,102 @@
+From eb86ec73b968b2895ffede893b33bf49bbc9bf5c Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:23 +0300
+Git-commit: eb86ec73b968b2895ffede893b33bf49bbc9bf5c
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 7/8] btrfs: Use init_delayed_ref_head in add_delayed_ref_head
+
+Use the newly introduced function when initialising the head_ref in
+add_delayed_ref_head. No functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 61 +++----------------------------------------------
+ 1 file changed, 4 insertions(+), 57 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -625,69 +625,16 @@ add_delayed_ref_head(struct btrfs_fs_inf
+ {
+ struct btrfs_delayed_ref_head *existing;
+ struct btrfs_delayed_ref_root *delayed_refs;
+- int count_mod = 1;
+- int must_insert_reserved = 0;
+ int qrecord_inserted = 0;
+
+- /* If reserved is provided, it must be a data extent. */
+- BUG_ON(!is_data && reserved);
+-
+- /*
+- * the head node stores the sum of all the mods, so dropping a ref
+- * should drop the sum in the head node by one.
+- */
+- if (action == BTRFS_UPDATE_DELAYED_HEAD)
+- count_mod = 0;
+- else if (action == BTRFS_DROP_DELAYED_REF)
+- count_mod = -1;
+-
+- /*
+- * BTRFS_ADD_DELAYED_EXTENT means that we need to update
+- * the reserved accounting when the extent is finally added, or
+- * if a later modification deletes the delayed ref without ever
+- * inserting the extent into the extent allocation tree.
+- * ref->must_insert_reserved is the flag used to record
+- * that accounting mods are required.
+- *
+- * Once we record must_insert_reserved, switch the action to
+- * BTRFS_ADD_DELAYED_REF because other special casing is not required.
+- */
+- if (action == BTRFS_ADD_DELAYED_EXTENT)
+- must_insert_reserved = 1;
+- else
+- must_insert_reserved = 0;
+-
+ delayed_refs = &trans->transaction->delayed_refs;
+
+- refcount_set(&head_ref->refs, 1);
+- head_ref->bytenr = bytenr;
+- head_ref->num_bytes = num_bytes;
+- head_ref->ref_mod = count_mod;
+- head_ref->must_insert_reserved = must_insert_reserved;
+- head_ref->is_data = is_data;
+- head_ref->is_system = is_system;
+- head_ref->ref_tree = RB_ROOT;
+- INIT_LIST_HEAD(&head_ref->ref_add_list);
+- RB_CLEAR_NODE(&head_ref->href_node);
+- head_ref->processing = 0;
+- head_ref->total_ref_mod = count_mod;
+- head_ref->qgroup_reserved = 0;
+- head_ref->qgroup_ref_root = 0;
+- spin_lock_init(&head_ref->lock);
+- mutex_init(&head_ref->mutex);
++ init_delayed_ref_head(head_ref, qrecord, bytenr, num_bytes, ref_root,
++ reserved, action, is_data, is_system);
+
+ /* Record qgroup extent info if provided */
+ if (qrecord) {
+- if (ref_root && reserved) {
+- head_ref->qgroup_ref_root = ref_root;
+- head_ref->qgroup_reserved = reserved;
+- }
+-
+- qrecord->bytenr = bytenr;
+- qrecord->num_bytes = num_bytes;
+- qrecord->old_roots = NULL;
+-
+- if(btrfs_qgroup_trace_extent_nolock(fs_info,
++ if (btrfs_qgroup_trace_extent_nolock(fs_info,
+ delayed_refs, qrecord))
+ kfree(qrecord);
+ else
+@@ -712,7 +659,7 @@ add_delayed_ref_head(struct btrfs_fs_inf
+ } else {
+ if (old_ref_mod)
+ *old_ref_mod = 0;
+- if (is_data && count_mod < 0)
++ if (is_data && head_ref->ref_mod < 0)
+ delayed_refs->pending_csums += num_bytes;
+ delayed_refs->num_heads++;
+ delayed_refs->num_heads_ready++;
diff --git a/patches.suse/0007-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_in.patch b/patches.suse/0007-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_in.patch
new file mode 100644
index 0000000000..4920713e43
--- /dev/null
+++ b/patches.suse/0007-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_in.patch
@@ -0,0 +1,370 @@
+From 82fa113fccc41fe5204b4ce35341d69ebde0020f Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:35 +0800
+Git-commit: 82fa113fccc41fe5204b4ce35341d69ebde0020f
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 7/9] btrfs: extent-tree: Use btrfs_ref to refactor
+ btrfs_inc_extent_ref()
+
+Use the new btrfs_ref structure and replace parameter list to clean up
+the usage of owner and level to distinguish the extent types.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/ctree.h | 4 +--
+ fs/btrfs/extent-tree.c | 54 +++++++++++++++++++++++++++++--------------------
+ fs/btrfs/file.c | 18 +++++++++++-----
+ fs/btrfs/inode.c | 10 +++++----
+ fs/btrfs/ioctl.c | 15 +++++++++----
+ fs/btrfs/relocation.c | 41 ++++++++++++++++++++++++-------------
+ fs/btrfs/tree-log.c | 12 ++++++++--
+ 7 files changed, 99 insertions(+), 55 deletions(-)
+
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -53,6 +53,7 @@ extern struct kmem_cache *btrfs_bit_radi
+ extern struct kmem_cache *btrfs_path_cachep;
+ extern struct kmem_cache *btrfs_free_space_cachep;
+ struct btrfs_ordered_sum;
++struct btrfs_ref;
+
+ #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+ #define STATIC noinline
+@@ -2731,8 +2732,7 @@ int btrfs_finish_extent_commit(struct bt
+ struct btrfs_fs_info *fs_info);
+ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info,
+- u64 bytenr, u64 num_bytes, u64 parent,
+- u64 root_objectid, u64 owner, u64 offset);
++ struct btrfs_ref *generic_ref);
+
+ int btrfs_start_dirty_block_groups(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info);
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2111,31 +2111,25 @@ int btrfs_discard_extent(struct btrfs_fs
+ /* Can return -ENOMEM */
+ int btrfs_inc_extent_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info,
+- u64 bytenr, u64 num_bytes, u64 parent,
+- u64 root_objectid, u64 owner, u64 offset)
++ struct btrfs_ref *generic_ref)
+ {
+- struct btrfs_ref generic_ref = { 0 };
+ int old_ref_mod, new_ref_mod;
+ int ret;
+
+- BUG_ON(owner < BTRFS_FIRST_FREE_OBJECTID &&
+- root_objectid == BTRFS_TREE_LOG_OBJECTID);
++ ASSERT(generic_ref->type != BTRFS_REF_NOT_SET &&
++ generic_ref->action);
++ BUG_ON(generic_ref->type == BTRFS_REF_METADATA &&
++ generic_ref->tree_ref.root == BTRFS_TREE_LOG_OBJECTID);
+
+- btrfs_init_generic_ref(&generic_ref, BTRFS_ADD_DELAYED_REF, bytenr,
+- num_bytes, parent);
+- generic_ref.real_root = root_objectid;
+- if (owner < BTRFS_FIRST_FREE_OBJECTID) {
+- btrfs_init_tree_ref(&generic_ref, (int)owner, root_objectid);
+- ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
++ if (generic_ref->type == BTRFS_REF_METADATA)
++ ret = btrfs_add_delayed_tree_ref(fs_info, trans, generic_ref,
+ NULL, &old_ref_mod, &new_ref_mod);
+- } else {
+- btrfs_init_data_ref(&generic_ref, root_objectid, owner, offset);
+- ret = btrfs_add_delayed_data_ref(fs_info, trans, &generic_ref, 0,
++ else
++ ret = btrfs_add_delayed_data_ref(fs_info, trans, generic_ref, 0,
+ &old_ref_mod, &new_ref_mod);
+- }
+
+ if (ret == 0 && old_ref_mod < 0 && new_ref_mod >= 0)
+- add_pinned_bytes(fs_info, &generic_ref);
++ add_pinned_bytes(fs_info, generic_ref);
+
+ return ret;
+ }
+@@ -3254,7 +3248,10 @@ static int __btrfs_mod_ref(struct btrfs_
+ u32 nritems;
+ struct btrfs_key key;
+ struct btrfs_file_extent_item *fi;
++ struct btrfs_ref generic_ref = { 0 };
++ bool for_reloc = btrfs_header_flag(buf, BTRFS_HEADER_FLAG_RELOC);
+ int i;
++ int action;
+ int level;
+ int ret = 0;
+
+@@ -3272,6 +3269,10 @@ static int __btrfs_mod_ref(struct btrfs_
+ parent = buf->start;
+ else
+ parent = 0;
++ if (inc)
++ action = BTRFS_ADD_DELAYED_REF;
++ else
++ action = BTRFS_DROP_DELAYED_REF;
+
+ for (i = 0; i < nritems; i++) {
+ if (level == 0) {
+@@ -3289,10 +3290,15 @@ static int __btrfs_mod_ref(struct btrfs_
+
+ num_bytes = btrfs_file_extent_disk_num_bytes(buf, fi);
+ key.offset -= btrfs_file_extent_offset(buf, fi);
++ btrfs_init_generic_ref(&generic_ref, action, bytenr,
++ num_bytes, parent);
++ btrfs_init_data_ref(&generic_ref, ref_root, key.objectid,
++ key.offset);
++ generic_ref.real_root = root->root_key.objectid;
++ generic_ref.skip_qgroup = for_reloc;
+ if (inc)
+- ret = btrfs_inc_extent_ref(trans, fs_info, bytenr,
+- num_bytes, parent, ref_root,
+- key.objectid, key.offset);
++ ret = btrfs_inc_extent_ref(trans, fs_info,
++ &generic_ref);
+ else
+ ret = btrfs_free_extent(trans, fs_info, bytenr,
+ num_bytes, parent, ref_root,
+@@ -3302,10 +3308,14 @@ static int __btrfs_mod_ref(struct btrfs_
+ } else {
+ bytenr = btrfs_node_blockptr(buf, i);
+ num_bytes = fs_info->nodesize;
++ btrfs_init_generic_ref(&generic_ref, action, bytenr,
++ num_bytes, parent);
++ generic_ref.real_root = root->root_key.objectid;
++ btrfs_init_tree_ref(&generic_ref, level - 1, ref_root);
++ generic_ref.skip_qgroup = for_reloc;
+ if (inc)
+- ret = btrfs_inc_extent_ref(trans, fs_info, bytenr,
+- num_bytes, parent, ref_root,
+- level - 1, 0);
++ ret = btrfs_inc_extent_ref(trans, fs_info,
++ &generic_ref);
+ else
+ ret = btrfs_free_extent(trans, fs_info, bytenr,
+ num_bytes, parent, ref_root,
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -762,6 +762,7 @@ int __btrfs_drop_extents(struct btrfs_tr
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct extent_buffer *leaf;
+ struct btrfs_file_extent_item *fi;
++ struct btrfs_ref ref = { 0 };
+ struct btrfs_key key;
+ struct btrfs_key new_key;
+ u64 ino = btrfs_ino(BTRFS_I(inode));
+@@ -918,11 +919,15 @@ next_slot:
+ btrfs_mark_buffer_dirty(leaf);
+
+ if (update_refs && disk_bytenr > 0) {
+- ret = btrfs_inc_extent_ref(trans, fs_info,
+- disk_bytenr, num_bytes, 0,
++ btrfs_init_generic_ref(&ref,
++ BTRFS_ADD_DELAYED_REF,
++ disk_bytenr, num_bytes, 0);
++ btrfs_init_data_ref(&ref,
+ root->root_key.objectid,
+ new_key.objectid,
+ start - extent_offset);
++ ret = btrfs_inc_extent_ref(trans, fs_info,
++ &ref);
+ BUG_ON(ret); /* -ENOMEM */
+ }
+ key.offset = start;
+@@ -1151,6 +1156,7 @@ int btrfs_mark_extent_written(struct btr
+ struct extent_buffer *leaf;
+ struct btrfs_path *path;
+ struct btrfs_file_extent_item *fi;
++ struct btrfs_ref ref = { 0 };
+ struct btrfs_key key;
+ struct btrfs_key new_key;
+ u64 bytenr;
+@@ -1296,9 +1302,11 @@ again:
+ extent_end - split);
+ btrfs_mark_buffer_dirty(leaf);
+
+- ret = btrfs_inc_extent_ref(trans, fs_info, bytenr, num_bytes,
+- 0, root->root_key.objectid,
+- ino, orig_offset);
++ btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF, bytenr,
++ num_bytes, 0);
++ btrfs_init_data_ref(&ref, root->root_key.objectid, ino,
++ orig_offset);
++ ret = btrfs_inc_extent_ref(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ goto out;
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -2519,6 +2519,7 @@ static noinline int relink_extent_backre
+ struct btrfs_file_extent_item *item;
+ struct btrfs_ordered_extent *ordered;
+ struct btrfs_trans_handle *trans;
++ struct btrfs_ref ref = { 0 };
+ struct btrfs_root *root;
+ struct btrfs_key key;
+ struct extent_buffer *leaf;
+@@ -2689,10 +2690,11 @@ again:
+ inode_add_bytes(inode, len);
+ btrfs_release_path(path);
+
+- ret = btrfs_inc_extent_ref(trans, fs_info, new->bytenr,
+- new->disk_len, 0,
+- backref->root_id, backref->inum,
+- new->file_pos); /* start - extent_offset */
++ btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF, new->bytenr,
++ new->disk_len, 0);
++ btrfs_init_data_ref(&ref, backref->root_id, backref->inum,
++ new->file_pos); /* start - extent_offset */
++ ret = btrfs_inc_extent_ref(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ goto out_free_path;
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -3774,13 +3774,18 @@ process_slot:
+ datal);
+
+ if (disko) {
++ struct btrfs_ref ref = { 0 };
++
+ inode_add_bytes(inode, datal);
++ btrfs_init_generic_ref(&ref,
++ BTRFS_ADD_DELAYED_REF, disko,
++ diskl, 0);
++ btrfs_init_data_ref(&ref,
++ root->root_key.objectid,
++ btrfs_ino(BTRFS_I(inode)),
++ new_key.offset - datao);
+ ret = btrfs_inc_extent_ref(trans,
+- fs_info,
+- disko, diskl, 0,
+- root->root_key.objectid,
+- btrfs_ino(BTRFS_I(inode)),
+- new_key.offset - datao);
++ fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans,
+ ret);
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1679,6 +1679,8 @@ int replace_file_extents(struct btrfs_tr
+
+ nritems = btrfs_header_nritems(leaf);
+ for (i = 0; i < nritems; i++) {
++ struct btrfs_ref ref = { 0 };
++
+ cond_resched();
+ btrfs_item_key_to_cpu(leaf, &key, i);
+ if (key.type != BTRFS_EXTENT_DATA_KEY)
+@@ -1739,10 +1741,12 @@ int replace_file_extents(struct btrfs_tr
+ dirty = 1;
+
+ key.offset -= btrfs_file_extent_offset(leaf, fi);
+- ret = btrfs_inc_extent_ref(trans, fs_info, new_bytenr,
+- num_bytes, parent,
+- btrfs_header_owner(leaf),
+- key.objectid, key.offset);
++ btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF, new_bytenr,
++ num_bytes, parent);
++ ref.real_root = root->root_key.objectid;
++ btrfs_init_data_ref(&ref, btrfs_header_owner(leaf),
++ key.objectid, key.offset);
++ ret = btrfs_inc_extent_ref(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ break;
+@@ -1792,6 +1796,7 @@ int replace_path(struct btrfs_trans_hand
+ struct btrfs_fs_info *fs_info = dest->fs_info;
+ struct extent_buffer *eb;
+ struct extent_buffer *parent;
++ struct btrfs_ref ref = { 0 };
+ struct btrfs_key key;
+ u64 old_bytenr;
+ u64 new_bytenr;
+@@ -1950,13 +1955,17 @@ again:
+ path->slots[level], old_ptr_gen);
+ btrfs_mark_buffer_dirty(path->nodes[level]);
+
+- ret = btrfs_inc_extent_ref(trans, fs_info, old_bytenr,
+- blocksize, path->nodes[level]->start,
+- src->root_key.objectid, level - 1, 0);
++ btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF, old_bytenr,
++ blocksize, path->nodes[level]->start);
++ ref.skip_qgroup = true;
++ btrfs_init_tree_ref(&ref, level - 1, src->root_key.objectid);
++ ret = btrfs_inc_extent_ref(trans, fs_info, &ref);
+ BUG_ON(ret);
+- ret = btrfs_inc_extent_ref(trans, fs_info, new_bytenr,
+- blocksize, 0, dest->root_key.objectid,
+- level - 1, 0);
++ btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF, new_bytenr,
++ blocksize, 0);
++ ref.skip_qgroup = true;
++ btrfs_init_tree_ref(&ref, level - 1, dest->root_key.objectid);
++ ret = btrfs_inc_extent_ref(trans, fs_info, &ref);
+ BUG_ON(ret);
+
+ ret = btrfs_free_extent(trans, fs_info, new_bytenr, blocksize,
+@@ -2756,6 +2765,7 @@ static int do_relocation(struct btrfs_tr
+ rc->backref_cache.path[node->level] = node;
+ list_for_each_entry(edge, &node->upper, list[LOWER]) {
+ struct btrfs_key first_key;
++ struct btrfs_ref ref = { 0 };
+
+ cond_resched();
+
+@@ -2853,11 +2863,14 @@ static int do_relocation(struct btrfs_tr
+ trans->transid);
+ btrfs_mark_buffer_dirty(upper->eb);
+
++ btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF,
++ node->eb->start, blocksize,
++ upper->eb->start);
++ ref.real_root = root->root_key.objectid;
++ btrfs_init_tree_ref(&ref, node->level,
++ btrfs_header_owner(upper->eb));
+ ret = btrfs_inc_extent_ref(trans, root->fs_info,
+- node->eb->start, blocksize,
+- upper->eb->start,
+- btrfs_header_owner(upper->eb),
+- node->level, 0);
++ &ref);
+ BUG_ON(ret);
+
+ ret = btrfs_drop_subtree(trans, root, eb, upper->eb);
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -717,9 +717,11 @@ static noinline int replay_one_extent(st
+ goto out;
+
+ if (ins.objectid > 0) {
++ struct btrfs_ref ref = { 0 };
+ u64 csum_start;
+ u64 csum_end;
+ LIST_HEAD(ordered_sums);
++
+ /*
+ * is this extent already allocated in the extent
+ * allocation tree? If so, just add a reference
+@@ -727,10 +729,14 @@ static noinline int replay_one_extent(st
+ ret = btrfs_lookup_data_extent(fs_info, ins.objectid,
+ ins.offset);
+ if (ret == 0) {
+- ret = btrfs_inc_extent_ref(trans, fs_info,
+- ins.objectid, ins.offset,
+- 0, root->root_key.objectid,
++ btrfs_init_generic_ref(&ref,
++ BTRFS_ADD_DELAYED_REF,
++ ins.objectid, ins.offset, 0);
++ btrfs_init_data_ref(&ref,
++ root->root_key.objectid,
+ key->objectid, offset);
++ ret = btrfs_inc_extent_ref(trans, fs_info,
++ &ref);
+ if (ret)
+ goto out;
+ } else {
diff --git a/patches.suse/0008-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_fr.patch b/patches.suse/0008-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_fr.patch
new file mode 100644
index 0000000000..26e00ced78
--- /dev/null
+++ b/patches.suse/0008-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_fr.patch
@@ -0,0 +1,257 @@
+From ffd4bb2a19cd29681f5b70a200654ab92619de8a Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:36 +0800
+Git-commit: ffd4bb2a19cd29681f5b70a200654ab92619de8a
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 8/9] btrfs: extent-tree: Use btrfs_ref to refactor
+ btrfs_free_extent()
+
+Similar to btrfs_inc_extent_ref(), use btrfs_ref to replace the long
+parameter list and the confusing @owner parameter.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/ctree.h | 3 +--
+ fs/btrfs/extent-tree.c | 44 +++++++++++++++++++-------------------------
+ fs/btrfs/file.c | 23 +++++++++++++----------
+ fs/btrfs/inode.c | 13 +++++++++----
+ fs/btrfs/relocation.c | 25 ++++++++++++++++---------
+ 5 files changed, 58 insertions(+), 50 deletions(-)
+
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -2720,8 +2720,7 @@ int btrfs_set_disk_extent_flags(struct b
+ int level, int is_data);
+ int btrfs_free_extent(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info,
+- u64 bytenr, u64 num_bytes, u64 parent, u64 root_objectid,
+- u64 owner, u64 offset);
++ struct btrfs_ref *ref);
+
+ int btrfs_free_reserved_extent(struct btrfs_fs_info *fs_info,
+ u64 start, u64 len, int delalloc);
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3298,9 +3298,8 @@ static int __btrfs_mod_ref(struct btrfs_
+ ret = btrfs_inc_extent_ref(trans, fs_info,
+ &generic_ref);
+ else
+- ret = btrfs_free_extent(trans, fs_info, bytenr,
+- num_bytes, parent, ref_root,
+- key.objectid, key.offset);
++ ret = btrfs_free_extent(trans, fs_info,
++ &generic_ref);
+ if (ret)
+ goto fail;
+ } else {
+@@ -3315,9 +3314,8 @@ static int __btrfs_mod_ref(struct btrfs_
+ ret = btrfs_inc_extent_ref(trans, fs_info,
+ &generic_ref);
+ else
+- ret = btrfs_free_extent(trans, fs_info, bytenr,
+- num_bytes, parent, ref_root,
+- level - 1, 0);
++ ret = btrfs_free_extent(trans, fs_info,
++ &generic_ref);
+ if (ret)
+ goto fail;
+ }
+@@ -7190,42 +7188,36 @@ out:
+ /* Can return -ENOMEM */
+ int btrfs_free_extent(struct btrfs_trans_handle *trans,
+ struct btrfs_fs_info *fs_info,
+- u64 bytenr, u64 num_bytes, u64 parent, u64 root_objectid,
+- u64 owner, u64 offset)
++ struct btrfs_ref *ref)
+ {
+- struct btrfs_ref generic_ref = { 0 };
+ int old_ref_mod, new_ref_mod;
+ int ret;
+
+ if (btrfs_is_testing(fs_info))
+ return 0;
+
+-
+- btrfs_init_generic_ref(&generic_ref, BTRFS_DROP_DELAYED_REF, bytenr,
+- num_bytes, parent);
+- generic_ref.real_root = root_objectid;
+ /*
+ * tree log blocks never actually go into the extent allocation
+ * tree, just update pinning info and exit early.
+ */
+- if (root_objectid == BTRFS_TREE_LOG_OBJECTID) {
+- WARN_ON(owner >= BTRFS_FIRST_FREE_OBJECTID);
++ if ((ref->type == BTRFS_REF_METADATA &&
++ ref->tree_ref.root == BTRFS_TREE_LOG_OBJECTID) ||
++ (ref->type == BTRFS_REF_DATA &&
++ ref->data_ref.ref_root == BTRFS_TREE_LOG_OBJECTID)) {
+ /* unlocks the pinned mutex */
+- btrfs_pin_extent(fs_info, bytenr, num_bytes, 1);
++ btrfs_pin_extent(fs_info, ref->bytenr, ref->len, 1);
+ old_ref_mod = new_ref_mod = 0;
+ ret = 0;
+- } else if (owner < BTRFS_FIRST_FREE_OBJECTID) {
+- btrfs_init_tree_ref(&generic_ref, (int)owner, root_objectid);
+- ret = btrfs_add_delayed_tree_ref(fs_info, trans, &generic_ref,
++ } else if (ref->type == BTRFS_REF_METADATA) {
++ ret = btrfs_add_delayed_tree_ref(fs_info, trans, ref,
+ NULL, &old_ref_mod, &new_ref_mod);
+ } else {
+- btrfs_init_data_ref(&generic_ref, root_objectid, owner, offset);
+- ret = btrfs_add_delayed_data_ref(fs_info, trans, &generic_ref, 0,
++ ret = btrfs_add_delayed_data_ref(fs_info, trans, ref, 0,
+ &old_ref_mod, &new_ref_mod);
+ }
+
+ if (ret == 0 && old_ref_mod >= 0 && new_ref_mod < 0)
+- add_pinned_bytes(fs_info, &generic_ref);
++ add_pinned_bytes(fs_info, ref);
+
+ return ret;
+ }
+@@ -8652,6 +8644,7 @@ static noinline int do_walk_down(struct
+ u32 blocksize;
+ struct btrfs_key key;
+ struct btrfs_key first_key;
++ struct btrfs_ref ref = { 0 };
+ struct extent_buffer *next;
+ int level = wc->level;
+ int reada = 0;
+@@ -8825,9 +8818,10 @@ skip:
+ wc->drop_level = level;
+ find_next_key(path, level, &wc->drop_progress);
+
+- ret = btrfs_free_extent(trans, fs_info, bytenr, blocksize,
+- parent, root->root_key.objectid,
+- level - 1, 0);
++ btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, bytenr,
++ fs_info->nodesize, parent);
++ btrfs_init_tree_ref(&ref, level - 1, root->root_key.objectid);
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ if (ret)
+ goto out_unlock;
+ }
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1007,11 +1007,15 @@ delete_extent_item:
+ extent_end = ALIGN(extent_end,
+ fs_info->sectorsize);
+ } else if (update_refs && disk_bytenr > 0) {
+- ret = btrfs_free_extent(trans, fs_info,
+- disk_bytenr, num_bytes, 0,
++ btrfs_init_generic_ref(&ref,
++ BTRFS_DROP_DELAYED_REF,
++ disk_bytenr, num_bytes, 0);
++ btrfs_init_data_ref(&ref,
+ root->root_key.objectid,
+- key.objectid, key.offset -
+- extent_offset);
++ key.objectid,
++ key.offset - extent_offset);
++ ret = btrfs_free_extent(trans, fs_info,
++ &ref);
+ BUG_ON(ret); /* -ENOMEM */
+ inode_sub_bytes(inode,
+ extent_end - key.offset);
+@@ -1328,6 +1332,9 @@ again:
+
+ other_start = end;
+ other_end = 0;
++ btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, bytenr,
++ num_bytes, 0);
++ btrfs_init_data_ref(&ref, root->root_key.objectid, ino, orig_offset);
+ if (extent_mergeable(leaf, path->slots[0] + 1,
+ ino, bytenr, orig_offset,
+ &other_start, &other_end)) {
+@@ -1338,9 +1345,7 @@ again:
+ extent_end = other_end;
+ del_slot = path->slots[0] + 1;
+ del_nr++;
+- ret = btrfs_free_extent(trans, fs_info, bytenr, num_bytes,
+- 0, root->root_key.objectid,
+- ino, orig_offset);
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ goto out;
+@@ -1358,9 +1363,7 @@ again:
+ key.offset = other_start;
+ del_slot = path->slots[0];
+ del_nr++;
+- ret = btrfs_free_extent(trans, fs_info, bytenr, num_bytes,
+- 0, root->root_key.objectid,
+- ino, orig_offset);
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ goto out;
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -4476,12 +4476,17 @@ delete:
+ if (found_extent &&
+ (test_bit(BTRFS_ROOT_REF_COWS, &root->state) ||
+ root == fs_info->tree_root)) {
++ struct btrfs_ref ref = { 0 };
++
+ btrfs_set_path_blocking(path);
+ bytes_deleted += extent_num_bytes;
+- ret = btrfs_free_extent(trans, fs_info, extent_start,
+- extent_num_bytes, 0,
+- btrfs_header_owner(leaf),
+- ino, extent_offset);
++
++ btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF,
++ extent_start, extent_num_bytes, 0);
++ ref.real_root = root->root_key.objectid;
++ btrfs_init_data_ref(&ref, btrfs_header_owner(leaf),
++ ino, extent_offset);
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ break;
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1752,9 +1752,12 @@ int replace_file_extents(struct btrfs_tr
+ break;
+ }
+
+- ret = btrfs_free_extent(trans, fs_info, bytenr, num_bytes,
+- parent, btrfs_header_owner(leaf),
+- key.objectid, key.offset);
++ btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, bytenr,
++ num_bytes, parent);
++ ref.real_root = root->root_key.objectid;
++ btrfs_init_data_ref(&ref, btrfs_header_owner(leaf),
++ key.objectid, key.offset);
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ if (ret) {
+ btrfs_abort_transaction(trans, ret);
+ break;
+@@ -1968,14 +1971,18 @@ again:
+ ret = btrfs_inc_extent_ref(trans, fs_info, &ref);
+ BUG_ON(ret);
+
+- ret = btrfs_free_extent(trans, fs_info, new_bytenr, blocksize,
+- path->nodes[level]->start,
+- src->root_key.objectid, level - 1, 0);
++ btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, new_bytenr,
++ blocksize, path->nodes[level]->start);
++ btrfs_init_tree_ref(&ref, level - 1, src->root_key.objectid);
++ ref.skip_qgroup = true;
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ BUG_ON(ret);
+
+- ret = btrfs_free_extent(trans, fs_info, old_bytenr, blocksize,
+- 0, dest->root_key.objectid, level - 1,
+- 0);
++ btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, old_bytenr,
++ blocksize, 0);
++ btrfs_init_tree_ref(&ref, level - 1, dest->root_key.objectid);
++ ref.skip_qgroup = true;
++ ret = btrfs_free_extent(trans, fs_info, &ref);
+ BUG_ON(ret);
+
+ btrfs_unlock_up_safe(path, 0);
diff --git a/patches.suse/0008-btrfs-split-delayed-ref-head-initialization-and-addi.patch b/patches.suse/0008-btrfs-split-delayed-ref-head-initialization-and-addi.patch
new file mode 100644
index 0000000000..7620fc154c
--- /dev/null
+++ b/patches.suse/0008-btrfs-split-delayed-ref-head-initialization-and-addi.patch
@@ -0,0 +1,159 @@
+From 2335efafa63f0c675ebb4f8908fff9e972fb8a58 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:24 +0300
+Git-commit: 2335efafa63f0c675ebb4f8908fff9e972fb8a58
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 8/8] btrfs: split delayed ref head initialization and addition
+
+add_delayed_ref_head really performed 2 independent operations -
+initialisting the ref head and adding it to a list. Now that the init
+part is in a separate function let's complete the separation between
+both operations. This results in a lot simpler interface for
+add_delayed_ref_head since the function now deals solely with either
+adding the newly initialised delayed ref head or merging it into an
+existing delayed ref head. This results in vastly simplified function
+signature since 5 arguments are dropped. The only other thing worth
+mentioning is that due to this split the WARN_ON catching reinit of
+existing. In this patch the condition is extended such that:
+
+ qrecord && head_ref->qgroup_ref_root && head_ref->qgroup_reserved
+
+is added. This is done because the two qgroup_* prefixed member are
+set only if both ref_root and reserved are passed. So functionally
+it's equivalent to the old WARN_ON and allows to remove the two args
+from add_delayed_ref_head.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 42 ++++++++++++++++++++----------------------
+ 1 file changed, 20 insertions(+), 22 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -617,9 +617,7 @@ add_delayed_ref_head(struct btrfs_fs_inf
+ struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head_ref,
+ struct btrfs_qgroup_extent_record *qrecord,
+- u64 bytenr, u64 num_bytes, u64 ref_root, u64 reserved,
+- int action, int is_data, int is_system,
+- int *qrecord_inserted_ret,
++ int action, int *qrecord_inserted_ret,
+ int *old_ref_mod, int *new_ref_mod)
+
+ {
+@@ -629,9 +627,6 @@ add_delayed_ref_head(struct btrfs_fs_inf
+
+ delayed_refs = &trans->transaction->delayed_refs;
+
+- init_delayed_ref_head(head_ref, qrecord, bytenr, num_bytes, ref_root,
+- reserved, action, is_data, is_system);
+-
+ /* Record qgroup extent info if provided */
+ if (qrecord) {
+ if (btrfs_qgroup_trace_extent_nolock(fs_info,
+@@ -646,7 +641,9 @@ add_delayed_ref_head(struct btrfs_fs_inf
+ existing = htree_insert(&delayed_refs->href_root,
+ &head_ref->href_node);
+ if (existing) {
+- WARN_ON(ref_root && reserved && existing->qgroup_ref_root
++ WARN_ON(qrecord && head_ref->qgroup_ref_root
++ && head_ref->qgroup_reserved
++ && existing->qgroup_ref_root
+ && existing->qgroup_reserved);
+ update_existing_head_ref(delayed_refs, existing, head_ref,
+ old_ref_mod);
+@@ -659,8 +656,8 @@ add_delayed_ref_head(struct btrfs_fs_inf
+ } else {
+ if (old_ref_mod)
+ *old_ref_mod = 0;
+- if (is_data && head_ref->ref_mod < 0)
+- delayed_refs->pending_csums += num_bytes;
++ if (head_ref->is_data && head_ref->ref_mod < 0)
++ delayed_refs->pending_csums += head_ref->num_bytes;
+ delayed_refs->num_heads++;
+ delayed_refs->num_heads_ready++;
+ atomic_inc(&delayed_refs->num_entries);
+@@ -670,6 +667,7 @@ add_delayed_ref_head(struct btrfs_fs_inf
+ *qrecord_inserted_ret = qrecord_inserted;
+ if (new_ref_mod)
+ *new_ref_mod = head_ref->total_ref_mod;
++
+ return head_ref;
+ }
+
+@@ -741,7 +739,7 @@ int btrfs_add_delayed_tree_ref(struct bt
+ struct btrfs_delayed_ref_root *delayed_refs;
+ struct btrfs_qgroup_extent_record *record = NULL;
+ int qrecord_inserted;
+- int is_system = (ref_root == BTRFS_CHUNK_TREE_OBJECTID);
++ bool is_system = (ref_root == BTRFS_CHUNK_TREE_OBJECTID);
+ int ret;
+ u8 ref_type;
+
+@@ -771,6 +769,8 @@ int btrfs_add_delayed_tree_ref(struct bt
+