Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-05-17 07:16:03 +0200
committerKernel Build Daemon <kbuild@suse.de>2019-05-17 07:16:03 +0200
commit5257c298a487bd1ef470b23727b24b771e3824ef (patch)
tree101c7db49959c5e0e6157d287418f60c05c27bec
parent1b16d036819b25f1d2ccaf577e17070890d79b41 (diff)
parent43cb3c80c70d6f496165f1cf5101080783768092 (diff)
Merge branch 'SLE15-SP1-UPDATE' into openSUSE-15.1-UPDATE
-rw-r--r--blacklist.conf3
-rw-r--r--patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/intel_idle-add-support-for-Jacobsville.patch7
-rw-r--r--patches.arch/perf-x86-amd-add-event-map-for-amd-family-17h.patch103
-rw-r--r--patches.arch/perf-x86-amd-update-generic-hardware-cache-events-for-family-17h.patch276
-rw-r--r--patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch3
-rw-r--r--patches.arch/powerpc-numa-improve-control-of-topology-updates.patch3
-rw-r--r--patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch4
-rw-r--r--patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch91
-rw-r--r--patches.arch/s390-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch2
-rw-r--r--patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch2
-rw-r--r--patches.arch/x86-mce-handle-varying-mca-bank-counts.patch3
-rw-r--r--patches.arch/x86-msr-index-cleanup-bit-defines.patch2
-rw-r--r--patches.arch/x86-perf-amd-remove-need-to-check-running-bit-in-nmi-handler.patch129
-rw-r--r--patches.arch/x86-perf-amd-resolve-nmi-latency-issues-for-active-pmcs.patch142
-rw-r--r--patches.arch/x86-perf-amd-resolve-race-condition-when-disabling-pmc.patch152
-rw-r--r--patches.arch/x86-speculation-consolidate-cpu-whitelists.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-bug_msbds_only.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch3
-rw-r--r--patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch2
-rw-r--r--patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch3
-rw-r--r--patches.arch/x86-speculation-mds-add-smt-warning-message.patch3
-rw-r--r--patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch2
-rw-r--r--patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch4
-rw-r--r--patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch2
-rw-r--r--patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch3
-rw-r--r--patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch3
-rw-r--r--patches.arch/x86-speculation-support-mitigations-cmdline-option.patch3
-rw-r--r--patches.drivers/0027-spi-spi-mem-Add-devm_spi_mem_dirmap_-create-destroy.patch17
-rw-r--r--patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch181
-rw-r--r--patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch50
-rw-r--r--patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch64
-rw-r--r--patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch61
-rw-r--r--patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch48
-rw-r--r--patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch3
-rw-r--r--patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch43
-rw-r--r--patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-ALC256.patch116
-rw-r--r--patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-for-A.patch156
-rw-r--r--patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch39
-rw-r--r--patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch64
-rw-r--r--patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch50
-rw-r--r--patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch40
-rw-r--r--patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch103
-rw-r--r--patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch54
-rw-r--r--patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch132
-rw-r--r--patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch277
-rw-r--r--patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch141
-rw-r--r--patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch75
-rw-r--r--patches.drivers/ALSA-timer-Coding-style-fixes.patch71
-rw-r--r--patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch148
-rw-r--r--patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch70
-rw-r--r--patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch80
-rw-r--r--patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch129
-rw-r--r--patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch125
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch43
-rw-r--r--patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch37
-rw-r--r--patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch44
-rw-r--r--patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch66
-rw-r--r--patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch135
-rw-r--r--patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch39
-rw-r--r--patches.drivers/ASoC-fix-valid-stream-condition.patch40
-rw-r--r--patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch32
-rw-r--r--patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch175
-rw-r--r--patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch57
-rw-r--r--patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch39
-rw-r--r--patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch110
-rw-r--r--patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch49
-rw-r--r--patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch64
-rw-r--r--patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch35
-rw-r--r--patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch69
-rw-r--r--patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch58
-rw-r--r--patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch38
-rw-r--r--patches.drivers/PCI-Init-PCIe-feature-bits-for-managed-host-bridge-a.patch77
-rw-r--r--patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch43
-rw-r--r--patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch38
-rw-r--r--patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch51
-rw-r--r--patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch69
-rw-r--r--patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch50
-rw-r--r--patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch85
-rw-r--r--patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch92
-rw-r--r--patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch45
-rw-r--r--patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch90
-rw-r--r--patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch39
-rw-r--r--patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch3
-rw-r--r--patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch38
-rw-r--r--patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock101
-rw-r--r--patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu42
-rw-r--r--patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly49
-rw-r--r--patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch2
-rw-r--r--patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch37
-rw-r--r--patches.drivers/media-cx23885-check-allocation-return.patch43
-rw-r--r--patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch78
-rw-r--r--patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch37
-rw-r--r--patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch39
-rw-r--r--patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch141
-rw-r--r--patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch46
-rw-r--r--patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch41
-rw-r--r--patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch40
-rw-r--r--patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch64
-rw-r--r--patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch38
-rw-r--r--patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch46
-rw-r--r--patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch34
-rw-r--r--patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch40
-rw-r--r--patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch160
-rw-r--r--patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch66
-rw-r--r--patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch64
-rw-r--r--patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch50
-rw-r--r--patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch38
-rw-r--r--patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch45
-rw-r--r--patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch49
-rw-r--r--patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch61
-rw-r--r--patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch57
-rw-r--r--patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch277
-rw-r--r--patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch54
-rw-r--r--patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch44
-rw-r--r--patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch144
-rw-r--r--patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch48
-rw-r--r--patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch56
-rw-r--r--patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch49
-rw-r--r--patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch45
-rw-r--r--patches.drivers/spi-Add-missing-pm_runtime_put_noidle-after-failed-g.patch35
-rw-r--r--patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch38
-rw-r--r--patches.drivers/spi-mem-fix-kernel-doc-for-spi_mem_dirmap_-read-writ.patch40
-rw-r--r--patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch99
-rw-r--r--patches.drivers/staging-rtlwifi-Fix-potential-NULL-pointer-dereferen.patch37
-rw-r--r--patches.drivers/staging-rtlwifi-rtl8822b-fix-to-avoid-potential-NULL.patch37
-rw-r--r--patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch92
-rw-r--r--patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch2
-rw-r--r--patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch39
-rw-r--r--patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch53
-rw-r--r--patches.drm/drm-amd-display-fix-cursor-black-issue.patch42
-rw-r--r--patches.drm/drm-doc-Drop-content-type-from-the-legacy-kms-proper.patch43
-rw-r--r--patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch57
-rw-r--r--patches.drm/drm-fb-helper-generic-Call-drm_client_add-after-setu.patch47
-rw-r--r--patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch42
-rw-r--r--patches.drm/drm-i915-icl-Whitelist-GEN9_SLICE_COMMON_ECO_CHICKEN.patch59
-rw-r--r--patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch48
-rw-r--r--patches.drm/drm-rcar-du-Fix-rcar_du_crtc-structure-documentation.patch32
-rw-r--r--patches.drm/drm-rockchip-fix-for-mailbox-read-validation.patch39
-rw-r--r--patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch74
-rw-r--r--patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch73
-rw-r--r--patches.drm/drm-tegra-gem-Fix-CPU-cache-maintenance-for-BO-s-all.patch55
-rw-r--r--patches.drm/drm-tegra-hub-Fix-dereference-before-check.patch41
-rw-r--r--patches.drm/drm-vmwgfx-Remove-set-but-not-used-variable-restart.patch61
-rw-r--r--patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch43
-rw-r--r--patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch5
-rw-r--r--patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch37
-rw-r--r--patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch61
-rw-r--r--patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch73
-rw-r--r--patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch186
-rw-r--r--patches.fixes/Revert-ide-unexport-DISK_EVENT_MEDIA_CHANGE-for-i.patch73
-rw-r--r--patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch41
-rw-r--r--patches.fixes/ceph-ensure-d_name-stability-in-ceph_dentry_hash.patch42
-rw-r--r--patches.fixes/ceph-fix-ci-i_head_snapc-leak.patch56
-rw-r--r--patches.fixes/ceph-fix-use-after-free-on-symlink-traversal.patch38
-rw-r--r--patches.fixes/ceph-only-use-d_name-directly-when-parent-is-locked.patch163
-rw-r--r--patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch56
-rw-r--r--patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch93
-rw-r--r--patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch72
-rw-r--r--patches.fixes/md-batch-flush-requests.patch3
-rw-r--r--patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch143
-rw-r--r--patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch14
-rw-r--r--patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch3
-rw-r--r--patches.fixes/overflow-Fix-Wtype-limits-compilation-warnings.patch78
-rw-r--r--patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch82
-rw-r--r--patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch51
-rw-r--r--patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch106
-rw-r--r--patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch85
-rw-r--r--patches.fixes/scripts-override-locale-from-environment-when-runnin.patch43
-rw-r--r--patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp64
-rw-r--r--patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch40
-rw-r--r--patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch77
-rw-r--r--patches.fixes/vfio-pci-use-correct-format-characters.patch83
-rw-r--r--patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch69
-rw-r--r--patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch (renamed from patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch)19
-rw-r--r--patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch66
-rw-r--r--patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch46
-rw-r--r--patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch70
-rw-r--r--patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch103
-rw-r--r--patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch109
-rw-r--r--patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch37
-rw-r--r--patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch190
-rw-r--r--patches.fixes/xfs-kill-meaningless-variable-zero.patch49
-rw-r--r--patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch8
-rw-r--r--patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch2
-rw-r--r--patches.fixes/xfs-remove-xfs_zero_range.patch170
-rw-r--r--patches.kabi/Re-export-snd_cards-for-kABI.patch26
-rw-r--r--patches.kabi/md-batch-flush-requests-kabi.patch12
-rw-r--r--patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch50
-rw-r--r--patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch85
-rw-r--r--patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch86
-rw-r--r--patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch187
-rw-r--r--patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch87
-rw-r--r--patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch404
-rw-r--r--patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch33
-rw-r--r--patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch75
-rw-r--r--patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch83
-rw-r--r--patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch130
-rw-r--r--patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch73
-rw-r--r--patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch124
-rw-r--r--patches.suse/0003-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch213
-rw-r--r--patches.suse/0004-btrfs-Open-code-add_delayed_tree_ref.patch128
-rw-r--r--patches.suse/0004-btrfs-delayed-ref-Use-btrfs_ref-to-refactor-btrfs_ad.patch124
-rw-r--r--patches.suse/0004-btrfs-move-ref_mod-modification-into-the-if-ref-logi.patch46
-rw-r--r--patches.suse/0005-btrfs-Open-code-add_delayed_data_ref.patch125
-rw-r--r--patches.suse/0005-btrfs-move-all-ref-head-cleanup-to-the-helper-functi.patch211
-rw-r--r--patches.suse/0006-btrfs-Introduce-init_delayed_ref_head.patch102
-rw-r--r--patches.suse/0006-btrfs-extent-tree-Use-btrfs_ref-to-refactor-add_pinn.patch70
-rw-r--r--patches.suse/0006-btrfs-remove-delayed_ref_node-from-ref_head.patch780
-rw-r--r--patches.suse/0007-btrfs-Use-init_delayed_ref_head-in-add_delayed_ref_h.patch102
-rw-r--r--patches.suse/0007-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_in.patch370
-rw-r--r--patches.suse/0008-btrfs-extent-tree-Use-btrfs_ref-to-refactor-btrfs_fr.patch257
-rw-r--r--patches.suse/0008-btrfs-split-delayed-ref-head-initialization-and-addi.patch159
-rw-r--r--patches.suse/0009-btrfs-qgroup-Don-t-scan-leaf-if-we-re-modifying-relo.patch68
-rw-r--r--patches.suse/Revert-block-unexport-DISK_EVENT_MEDIA_CHANGE-for.patch145
-rw-r--r--patches.suse/block-check_events-don-t-bother-with-events-if-un.patch99
-rw-r--r--patches.suse/block-disk_events-introduce-event-flags.patch133
-rw-r--r--patches.suse/btrfs-Take-trans-lock-before-access-running-trans-in.patch19
-rw-r--r--patches.suse/btrfs-fix-race-condition-between-delayed-refs-and-blockgroup-removal.patch82
-rw-r--r--patches.suse/dccp-do-not-use-ipv6-header-for-ipv4-flow.patch37
-rw-r--r--patches.suse/genetlink-Fix-a-memory-leak-on-error-path.patch45
-rw-r--r--patches.suse/lpfc-validate-command-in-lpfc_sli4_scmd_to_wqidx_dis.patch32
-rw-r--r--patches.suse/net-aquantia-fix-rx-checksum-offload-for-UDP-TCP-ove.patch39
-rw-r--r--patches.suse/net-rose-fix-a-possible-stack-overflow.patch129
-rw-r--r--patches.suse/net-stmmac-fix-memory-corruption-with-large-MTUs.patch62
-rw-r--r--patches.suse/packets-Always-register-packet-sk-in-the-same-order.patch69
-rw-r--r--patches.suse/revert-btrfs-qgroup-move-half-of-the-qgroup-accounting-time-out-of-commit-trans.patch106
-rw-r--r--patches.suse/sctp-get-sctphdr-by-offset-in-sctp_compute_cksum.patch38
-rw-r--r--patches.suse/tcp-do-not-use-ipv6-header-for-ipv4-flow.patch43
-rw-r--r--patches.suse/thunderx-eliminate-extra-calls-to-put_page-for-pages.patch62
-rw-r--r--patches.suse/thunderx-enable-page-recycling-for-non-XDP-case.patch62
-rw-r--r--patches.suse/tun-add-a-missing-rcu_read_unlock-in-error-path.patch29
-rw-r--r--patches.suse/tun-properly-test-for-IFF_UP.patch87
-rw-r--r--patches.suse/vxlan-Don-t-call-gro_cells_destroy-before-device-is-.patch45
-rw-r--r--series.conf270
240 files changed, 16921 insertions, 337 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 3db323666a..f92d248c3b 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -58,6 +58,7 @@ tools/testing/selftests/ # Selftests should be run from upstream
fs/f2fs/ # Not compiled, has some fatal flaws (see bsc#1109665)
security/smack # we don't enable Smack
+drivers/ide # IDE not shipped since SLE12
# Blacklisted CVE entries
# -----------------------
@@ -1022,3 +1023,5 @@ f58213637206e190453e3bd91f98f535566290a3 # regulator: missing regulator_lock() A
f7a621728a6a23bfd2c6ac4d3e42e1303aefde0f # regulator: missing regulator_lock() API in SLE15
8be64b6d87bd47d81753b60ddafe70102ebfd76b # regulator: missing regulator_lock() API in SLE15
e69b394703e032e56a140172440ec4f9890b536d # regulator: missing regulator_lock() API in SLE15
+98fdaaca9537b997062f1abc0aa87c61b50ce40a # Duplicate of fc89a38d99d4b1b33ca5b0e2329f5ddea02ecfb5: drm/i915/opregion: fix version check
+a0f52c3d357af218a9c1f7cd906ab70426176a1a # Duplicate of 16eb0f34cdf4cf04cd92762c7a79f98aa51e053f: drm/i915/opregion: rvda is relative from opregion base in opregion 2.1+
diff --git a/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch b/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
index 58fd60fc29..ef4fcccace 100644
--- a/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
+++ b/patches.arch/cpu-speculation-add-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:28 -0500
Subject: cpu/speculation: Add 'mitigations=' cmdline option
Git-commit: 98af8452945c55652de68536afdde3b520fec429
-Patch-mainline: queued in subsystem tree
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Keeping track of the number of mitigations for all the CPU speculation
diff --git a/patches.arch/intel_idle-add-support-for-Jacobsville.patch b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
index 22f5b9abb5..1b3a1882c3 100644
--- a/patches.arch/intel_idle-add-support-for-Jacobsville.patch
+++ b/patches.arch/intel_idle-add-support-for-Jacobsville.patch
@@ -13,14 +13,12 @@ Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- drivers/idle/intel_idle.c | 1 +
+ drivers/idle/intel_idle.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
-index 8b5d85c..b8647b5 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
-@@ -1103,6 +1103,7 @@ static const struct x86_cpu_id intel_idle_ids[] __initconst = {
+@@ -1099,6 +1099,7 @@ static const struct x86_cpu_id intel_idl
ICPU(INTEL_FAM6_ATOM_GOLDMONT, idle_cpu_bxt),
ICPU(INTEL_FAM6_ATOM_GOLDMONT_PLUS, idle_cpu_bxt),
ICPU(INTEL_FAM6_ATOM_GOLDMONT_X, idle_cpu_dnv),
@@ -28,4 +26,3 @@ index 8b5d85c..b8647b5 100644
{}
};
-
diff --git a/patches.arch/perf-x86-amd-add-event-map-for-amd-family-17h.patch b/patches.arch/perf-x86-amd-add-event-map-for-amd-family-17h.patch
new file mode 100644
index 0000000000..356c7ffbbc
--- /dev/null
+++ b/patches.arch/perf-x86-amd-add-event-map-for-amd-family-17h.patch
@@ -0,0 +1,103 @@
+From: Kim Phillips <kim.phillips@amd.com>
+Date: Thu, 21 Mar 2019 21:15:22 +0000
+Subject: perf/x86/amd: Add event map for AMD Family 17h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 3fe3331bb285700ab2253dbb07f8e478fcea2f1b
+Patch-mainline: v5.1-rc6
+References: bsc#1134223
+
+Family 17h differs from prior families by:
+
+ - Does not support an L2 cache miss event
+ - It has re-enumerated PMC counters for:
+ - L2 cache references
+ - front & back end stalled cycles
+
+So we add a new amd_f17h_perfmon_event_map[] so that the generic
+perf event names will resolve to the correct h/w events on
+family 17h and above processors.
+
+Reference sections 2.1.13.3.3 (stalls) and 2.1.13.3.6 (L2):
+
+ https://www.amd.com/system/files/TechDocs/54945_PPR_Family_17h_Models_00h-0Fh.pdf
+
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Cc: <stable@vger.kernel.org> # v4.9+
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Martin Liška <mliska@suse.cz>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Pu Wen <puwen@hygon.cn>
+Cc: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-kernel@vger.kernel.org
+Fixes: e40ed1542dd7 ("perf/x86: Add perf support for AMD family-17h processors")
+[ Improved the formatting a bit. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Tony Jones <tonyj@suse.de>
+---
+ arch/x86/events/amd/core.c | 35 ++++++++++++++++++++++++++---------
+ 1 file changed, 26 insertions(+), 9 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 0ecfac84ba91..d45f3fbd232e 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -117,22 +117,39 @@ static __initconst const u64 amd_hw_cache_event_ids
+ };
+
+ /*
+- * AMD Performance Monitor K7 and later.
++ * AMD Performance Monitor K7 and later, up to and including Family 16h:
+ */
+ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
+ {
+- [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
+- [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
+- [PERF_COUNT_HW_CACHE_REFERENCES] = 0x077d,
+- [PERF_COUNT_HW_CACHE_MISSES] = 0x077e,
+- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
+- [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
+- [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */
+- [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x00d1, /* "Dispatch stalls" event */
++ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
++ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
++ [PERF_COUNT_HW_CACHE_REFERENCES] = 0x077d,
++ [PERF_COUNT_HW_CACHE_MISSES] = 0x077e,
++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
++ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
++ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x00d0, /* "Decoder empty" event */
++ [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x00d1, /* "Dispatch stalls" event */
++};
++
++/*
++ * AMD Performance Monitor Family 17h and later:
++ */
++static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] =
++{
++ [PERF_COUNT_HW_CPU_CYCLES] = 0x0076,
++ [PERF_COUNT_HW_INSTRUCTIONS] = 0x00c0,
++ [PERF_COUNT_HW_CACHE_REFERENCES] = 0xff60,
++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = 0x00c2,
++ [PERF_COUNT_HW_BRANCH_MISSES] = 0x00c3,
++ [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND] = 0x0287,
++ [PERF_COUNT_HW_STALLED_CYCLES_BACKEND] = 0x0187,
+ };
+
+ static u64 amd_pmu_event_map(int hw_event)
+ {
++ if (boot_cpu_data.x86 >= 0x17)
++ return amd_f17h_perfmon_event_map[hw_event];
++
+ return amd_perfmon_event_map[hw_event];
+ }
+
+
diff --git a/patches.arch/perf-x86-amd-update-generic-hardware-cache-events-for-family-17h.patch b/patches.arch/perf-x86-amd-update-generic-hardware-cache-events-for-family-17h.patch
new file mode 100644
index 0000000000..1f0ea78491
--- /dev/null
+++ b/patches.arch/perf-x86-amd-update-generic-hardware-cache-events-for-family-17h.patch
@@ -0,0 +1,276 @@
+From: Kim Phillips <kim.phillips@amd.com>
+Date: Thu, 2 May 2019 15:29:47 +0000
+Subject: perf/x86/amd: Update generic hardware cache events for Family 17h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 0e3b74e26280f2cf8753717a950b97d424da6046
+Patch-mainline: v5.1
+References: bsc#1134223
+
+Add a new amd_hw_cache_event_ids_f17h assignment structure set
+for AMD families 17h and above, since a lot has changed. Specifically:
+
+L1 Data Cache
+
+The data cache access counter remains the same on Family 17h.
+
+For DC misses, PMCx041's definition changes with Family 17h,
+so instead we use the L2 cache accesses from L1 data cache
+misses counter (PMCx060,umask=0xc8).
+
+For DC hardware prefetch events, Family 17h breaks compatibility
+for PMCx067 "Data Prefetcher", so instead, we use PMCx05a "Hardware
+Prefetch DC Fills."
+
+L1 Instruction Cache
+
+PMCs 0x80 and 0x81 (32-byte IC fetches and misses) are backward
+compatible on Family 17h.
+
+For prefetches, we remove the erroneous PMCx04B assignment which
+counts how many software data cache prefetch load instructions were
+dispatched.
+
+LL - Last Level Cache
+
+Removing PMCs 7D, 7E, and 7F assignments, as they do not exist
+on Family 17h, where the last level cache is L3. L3 counters
+can be accessed using the existing AMD Uncore driver.
+
+Data TLB
+
+On Intel machines, data TLB accesses ("dTLB-loads") are assigned
+to counters that count load/store instructions retired. This
+is inconsistent with instruction TLB accesses, where Intel
+implementations report iTLB misses that hit in the STLB.
+
+Ideally, dTLB-loads would count higher level dTLB misses that hit
+in lower level TLBs, and dTLB-load-misses would report those
+that also missed in those lower-level TLBs, therefore causing
+a page table walk. That would be consistent with instruction
+TLB operation, remove the redundancy between dTLB-loads and
+L1-dcache-loads, and prevent perf from producing artificially
+low percentage ratios, i.e. the "0.01%" below:
+
+ 42,550,869 L1-dcache-loads
+ 41,591,860 dTLB-loads
+ 4,802 dTLB-load-misses # 0.01% of all dTLB cache hits
+ 7,283,682 L1-dcache-stores
+ 7,912,392 dTLB-stores
+ 310 dTLB-store-misses
+
+On AMD Families prior to 17h, the "Data Cache Accesses" counter is
+used, which is slightly better than load/store instructions retired,
+but still counts in terms of individual load/store operations
+instead of TLB operations.
+
+So, for AMD Families 17h and higher, this patch assigns "dTLB-loads"
+to a counter for L1 dTLB misses that hit in the L2 dTLB, and
+"dTLB-load-misses" to a counter for L1 DTLB misses that caused
+L2 DTLB misses and therefore also caused page table walks. This
+results in a much more accurate view of data TLB performance:
+
+ 60,961,781 L1-dcache-loads
+ 4,601 dTLB-loads
+ 963 dTLB-load-misses # 20.93% of all dTLB cache hits
+
+Note that for all AMD families, data loads and stores are combined
+in a single accesses counter, so no 'L1-dcache-stores' are reported
+separately, and stores are counted with loads in 'L1-dcache-loads'.
+
+Also note that the "% of all dTLB cache hits" string is misleading
+because (a) "dTLB cache": although TLBs can be considered caches for
+page tables, in this context, it can be misinterpreted as data cache
+hits because the figures are similar (at least on Intel), and (b) not
+all those loads (technically accesses) technically "hit" at that
+hardware level. "% of all dTLB accesses" would be more clear/accurate.
+
+Instruction TLB
+
+On Intel machines, 'iTLB-loads' measure iTLB misses that hit in the
+STLB, and 'iTLB-load-misses' measure iTLB misses that also missed in
+the STLB and completed a page table walk.
+
+For AMD Family 17h and above, for 'iTLB-loads' we replace the
+erroneous instruction cache fetches counter with PMCx084
+"L1 ITLB Miss, L2 ITLB Hit".
+
+For 'iTLB-load-misses' we still use PMCx085 "L1 ITLB Miss,
+L2 ITLB Miss", but set a 0xff umask because without it the event
+does not get counted.
+
+Branch Predictor (BPU)
+
+PMCs 0xc2 and 0xc3 continue to be valid across all AMD Families.
+
+Node Level Events
+
+Family 17h does not have a PMCx0e9 counter, and corresponding counters
+have not been made available publicly, so for now, we mark them as
+unsupported for Families 17h and above.
+
+Reference:
+
+ "Open-Source Register Reference For AMD Family 17h Processors Models 00h-2Fh"
+ Released 7/17/2018, Publication #56255, Revision 3.03:
+ https://www.amd.com/system/files/TechDocs/56255_OSRR.pdf
+
+[ mingo: tidied up the line breaks. ]
+Signed-off-by: Kim Phillips <kim.phillips@amd.com>
+Cc: <stable@vger.kernel.org> # v4.9+
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Martin Liška <mliska@suse.cz>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Pu Wen <puwen@hygon.cn>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Thomas Lendacky <Thomas.Lendacky@amd.com>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-perf-users@vger.kernel.org
+Fixes: e40ed1542dd7 ("perf/x86: Add perf support for AMD family-17h processors")
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Tony Jones <tonyj@suse.de>
+---
+ arch/x86/events/amd/core.c | 111 +++++++++++++++++++++++++++++++++++++++++++--
+ 1 file changed, 108 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index d45f3fbd232e..f15441b07dad 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -116,6 +116,110 @@ static __initconst const u64 amd_hw_cache_event_ids
+ },
+ };
+
++static __initconst const u64 amd_hw_cache_event_ids_f17h
++ [PERF_COUNT_HW_CACHE_MAX]
++ [PERF_COUNT_HW_CACHE_OP_MAX]
++ [PERF_COUNT_HW_CACHE_RESULT_MAX] = {
++[C(L1D)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x0040, /* Data Cache Accesses */
++ [C(RESULT_MISS)] = 0xc860, /* L2$ access from DC Miss */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0xff5a, /* h/w prefetch DC Fills */
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(L1I)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x0080, /* Instruction cache fetches */
++ [C(RESULT_MISS)] = 0x0081, /* Instruction cache misses */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(LL)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(DTLB)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0xff45, /* All L2 DTLB accesses */
++ [C(RESULT_MISS)] = 0xf045, /* L2 DTLB misses (PT walks) */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++},
++[C(ITLB)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x0084, /* L1 ITLB misses, L2 ITLB hits */
++ [C(RESULT_MISS)] = 0xff85, /* L1 ITLB misses, L2 misses */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++},
++[C(BPU)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0x00c2, /* Retired Branch Instr. */
++ [C(RESULT_MISS)] = 0x00c3, /* Retired Mispredicted BI */
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++},
++[C(NODE)] = {
++ [C(OP_READ)] = {
++ [C(RESULT_ACCESS)] = 0,
++ [C(RESULT_MISS)] = 0,
++ },
++ [C(OP_WRITE)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++ [C(OP_PREFETCH)] = {
++ [C(RESULT_ACCESS)] = -1,
++ [C(RESULT_MISS)] = -1,
++ },
++},
++};
++
+ /*
+ * AMD Performance Monitor K7 and later, up to and including Family 16h:
+ */
+@@ -865,9 +969,10 @@ __init int amd_pmu_init(void)
+ x86_pmu.amd_nb_constraints = 0;
+ }
+
+- /* Events are common for all AMDs */
+- memcpy(hw_cache_event_ids, amd_hw_cache_event_ids,
+- sizeof(hw_cache_event_ids));
++ if (boot_cpu_data.x86 >= 0x17)
++ memcpy(hw_cache_event_ids, amd_hw_cache_event_ids_f17h, sizeof(hw_cache_event_ids));
++ else
++ memcpy(hw_cache_event_ids, amd_hw_cache_event_ids, sizeof(hw_cache_event_ids));
+
+ return 0;
+ }
+
diff --git a/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch b/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch
index ce83ac8841..9f5a29a14b 100644
--- a/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch
+++ b/patches.arch/powerpc-numa-document-topology_updates_enabled-disab.patch
@@ -5,8 +5,7 @@ Subject: [PATCH] powerpc/numa: document topology_updates_enabled, disable by
default
References: bsc#1133584
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v5.2-rc1
Git-commit: 558f86493df09f68f79fe056d9028d317a3ce8ab
Changing the NUMA associations for CPUs and memory at runtime is
diff --git a/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch b/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch
index f62c6c2bae..3a04a469dd 100644
--- a/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch
+++ b/patches.arch/powerpc-numa-improve-control-of-topology-updates.patch
@@ -4,8 +4,7 @@ Date: Thu, 18 Apr 2019 13:56:57 -0500
Subject: [PATCH] powerpc/numa: improve control of topology updates
References: bsc#1133584
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v5.2-rc1
Git-commit: 2d4d9b308f8f8dec68f6dbbff18c68ec7c6bd26f
When booted with "topology_updates=no", or when "off" is written to
diff --git a/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch b/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
index cdab5ca429..50b4452a92 100644
--- a/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
+++ b/patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
@@ -4,7 +4,8 @@ Date: Tue, 2 Oct 2018 10:35:59 -0500
Subject: [PATCH] powerpc/pseries: Track LMB nid instead of using device tree
References: bsc#1108270
-Patch-mainline: submitted https://patchwork.ozlabs.org/patch/977943/
+Patch-mainline: v5.2-rc1
+Git-commit: b2d3b5ee66f2a04a918cc043cec0c9ed3de58f40
When removing memory we need to remove the memory from the node
it was added to instead of looking up the node it should be in
@@ -49,6 +50,7 @@ it is added to the system so we can remove it from that node instead
of the node that the device tree indicates it should belong to.
Signed-off-by: Nathan Fontenot <nfont@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/include/asm/drmem.h | 26 +++++++++++++++++++
diff --git a/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch b/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
index f9072b1237..bb925ed307 100644
--- a/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/powerpc-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:30 -0500
Subject: powerpc/speculation: Support 'mitigations=' cmdline option
Git-commit: 782e69efb3dfed6e8360bc612e8c7827a901a8f9
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure powerpc CPU runtime speculation bug mitigations in accordance
diff --git a/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch b/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
index ef765a6203..0eb3f926d5 100644
--- a/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
+++ b/patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
@@ -1,59 +1,63 @@
-From patchwork Wed Jan 16 16:47:44 2019
-Subject: powerpc/tm: Avoid machine crash on rt_sigreturn
-X-Patchwork-Id: 1026032
-Date: Wed, 16 Jan 2019 14:47:44 -0200
+From e620d45065c7b5b8d6ae11217c09c09380103b83 Mon Sep 17 00:00:00 2001
From: Breno Leitao <leitao@debian.org>
+Date: Wed, 16 Jan 2019 14:47:44 -0200
+Subject: [PATCH] powerpc/tm: Avoid machine crash on rt_sigreturn()
References: bsc#1118338
-Patch-mainline: submitted https://patchwork.ozlabs.org/patch/1026032/
+Patch-mainline: v5.2-rc1
+Git-commit: e620d45065c7b5b8d6ae11217c09c09380103b83
-There is a kernel crash that happens if rt_sigreturn is called inside a
-transactional block.
+There is a kernel crash that happens if rt_sigreturn() is called inside
+a transactional block.
This crash happens if the kernel hits an in-kernel page fault when
-accessing userspace memory, usually through copy_ckvsx_to_user(). A major
-page fault calls might_sleep() function, which can cause a task reschedule.
-A task reschedule (switch_to()) reclaim and recheckpoint the TM states,
-but, in the signal return path, the checkpointed memory was already
-reclaimed, thus the exception stack has MSR that points to MSR[TS]=0.
+accessing userspace memory, usually through copy_ckvsx_to_user(). A
+major page fault calls might_sleep() function, which can cause a task
+reschedule. A task reschedule (switch_to()) reclaim and recheckpoint
+the TM states, but, in the signal return path, the checkpointed memory
+was already reclaimed, thus the exception stack has MSR that points to
+MSR[TS]=0.
-When the code returns from might_sleep() and a task reschedule happened,
-then this task is returned with the memory recheckpointed, and
-CPU MSR[TS] = suspended.
+When the code returns from might_sleep() and a task reschedule
+happened, then this task is returned with the memory recheckpointed,
+and CPU MSR[TS] = suspended.
-This means that there is a side effect at might_sleep() if it is called
-with CPU MSR[TS] = 0 and the task has regs->msr[TS] != 0.
+This means that there is a side effect at might_sleep() if it is
+called with CPU MSR[TS] = 0 and the task has regs->msr[TS] != 0.
-This side effect can cause a TM bad thing, since at the exception entrance,
-the stack saves MSR[TS]=0, and this is what will be used at RFID, but,
-the processor has MSR[TS] = Suspended, and this transition will be invalid
-and a TM Bad thing will be raised, causing the following crash:
+This side effect can cause a TM bad thing, since at the exception
+entrance, the stack saves MSR[TS]=0, and this is what will be used at
+RFID, but, the processor has MSR[TS] = Suspended, and this transition
+will be invalid and a TM Bad thing will be raised, causing the
+following crash:
- Unexpected TM Bad Thing exception at c00000000000e9ec (msr 0x8000000302a03031) tm_scratch=800000010280b033
- cpu 0xc: Vector: 700 (Program Check) at [c00000003ff1fd70]
- pc: c00000000000e9ec: fast_exception_return+0x100/0x1bc
- lr: c000000000032948: handle_rt_signal64+0xb8/0xaf0
- sp: c0000004263ebc40
- msr: 8000000302a03031
- current = 0xc000000415050300
- paca = 0xc00000003ffc4080 irqmask: 0x03 irq_happened: 0x01
- pid = 25006, comm = sigfuz
- Linux version 5.0.0-rc1-00001-g3bd6e94bec12 (breno@debian) (gcc version 8.2.0 (Debian 8.2.0-3)) #899 SMP Mon Jan 7 11:30:07 EST 2019
- WARNING: exception is not recoverable, can't continue
- enter ? for help
- [c0000004263ebc40] c000000000032948 handle_rt_signal64+0xb8/0xaf0 (unreliable)
- [c0000004263ebd30] c000000000022780 do_notify_resume+0x2f0/0x430
- [c0000004263ebe20] c00000000000e844 ret_from_except_lite+0x70/0x74
- --- Exception: c00 (System Call) at 00007fffbaac400c
- SP (7fffeca90f40) is in userspace
+ Unexpected TM Bad Thing exception at c00000000000e9ec (msr 0x8000000302a03031) tm_scratch=800000010280b033
+ cpu 0xc: Vector: 700 (Program Check) at [c00000003ff1fd70]
+ pc: c00000000000e9ec: fast_exception_return+0x100/0x1bc
+ lr: c000000000032948: handle_rt_signal64+0xb8/0xaf0
+ sp: c0000004263ebc40
+ msr: 8000000302a03031
+ current = 0xc000000415050300
+ paca = 0xc00000003ffc4080 irqmask: 0x03 irq_happened: 0x01
+ pid = 25006, comm = sigfuz
+ Linux version 5.0.0-rc1-00001-g3bd6e94bec12 (breno@debian) (gcc version 8.2.0 (Debian 8.2.0-3)) #899 SMP Mon Jan 7 11:30:07 EST 2019
+ WARNING: exception is not recoverable, can't continue
+ enter ? for help
+ [c0000004263ebc40] c000000000032948 handle_rt_signal64+0xb8/0xaf0 (unreliable)
+ [c0000004263ebd30] c000000000022780 do_notify_resume+0x2f0/0x430
+ [c0000004263ebe20] c00000000000e844 ret_from_except_lite+0x70/0x74
+ --- Exception: c00 (System Call) at 00007fffbaac400c
+ SP (7fffeca90f40) is in userspace
The solution for this problem is running the sigreturn code with
-regs->msr[TS] disabled, thus, avoiding hitting the side effect above. This
-does not seem to be a problem since regs->msr will be replaced by the
-ucontext value, so, it is being flushed already. In this case, it is
-flushed earlier.
+regs->msr[TS] disabled, thus, avoiding hitting the side effect above.
+This does not seem to be a problem since regs->msr will be replaced by
+the ucontext value, so, it is being flushed already. In this case, it
+is flushed earlier.
Signed-off-by: Breno Leitao <leitao@debian.org>
+Acked-by: Michael Neuling <mikey@neuling.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/kernel/signal_64.c | 27 ++++++++++++++++++++++++++-
@@ -104,3 +108,6 @@ index 6794466f6420..06c299ef6132 100644
if (__get_user(msr, &uc->uc_mcontext.gp_regs[PT_MSR]))
goto badframe;
if (MSR_TM_ACTIVE(msr)) {
+--
+2.20.1
+
diff --git a/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch b/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
index 232c182f03..71c8954d67 100644
--- a/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/s390-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:31 -0500
Subject: s390/speculation: Support 'mitigations=' cmdline option
Git-commit: 0336e04a6520bdaefdb0769d2a70084fa52e81ed
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure s390 runtime CPU speculation bug mitigations in accordance
diff --git a/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch b/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
index 8c82273415..81e943fc30 100644
--- a/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
+++ b/patches.arch/x86-kvm-expose-x86_feature_md_clear-to-guests.patch
@@ -2,7 +2,7 @@ From: Andi Kleen <ak@linux.intel.com>
Date: Fri, 18 Jan 2019 16:50:23 -0800
Subject: x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests
Git-commit: 6c4dbbd14730c43f4ed808a9c42ca41625925c22
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
X86_FEATURE_MD_CLEAR is a new CPUID bit which is set when microcode
diff --git a/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch b/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
index 92d1e7ac68..bd2e7c97e7 100644
--- a/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
+++ b/patches.arch/x86-kvm-vmx-add-mds-protection-when-l1d-flush-is-not-active.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 27 Feb 2019 12:48:14 +0100
Subject: x86/kvm/vmx: Add MDS protection when L1D Flush is not active
Git-commit: 650b68a0622f933444a6d66936abb3103029413b
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
CPUs which are affected by L1TF and MDS mitigate MDS with the L1D Flush on
diff --git a/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch b/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
index 04a118cca2..383dd4c1c0 100644
--- a/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
+++ b/patches.arch/x86-mce-handle-varying-mca-bank-counts.patch
@@ -2,8 +2,7 @@ From: Yazen Ghannam <yazen.ghannam@amd.com>
Date: Fri, 27 Jul 2018 16:40:09 -0500
Subject: x86/mce: Handle varying MCA bank counts
Git-commit: 006c077041dc73b9490fffc4c6af5befe0687110
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: Queued in tip
+Patch-mainline: v5.2-rc1
References: bsc#1128415
Linux reads MCG_CAP[Count] to find the number of MCA banks visible to a
diff --git a/patches.arch/x86-msr-index-cleanup-bit-defines.patch b/patches.arch/x86-msr-index-cleanup-bit-defines.patch
index 6f134cb78c..8552aa7dfe 100644
--- a/patches.arch/x86-msr-index-cleanup-bit-defines.patch
+++ b/patches.arch/x86-msr-index-cleanup-bit-defines.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Thu, 21 Feb 2019 12:36:50 +0100
Subject: x86/msr-index: Cleanup bit defines
Git-commit: d8eabc37310a92df40d07c5a8afc53cebf996716
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Greg pointed out that speculation related bit defines are using (1 << N)
diff --git a/patches.arch/x86-perf-amd-remove-need-to-check-running-bit-in-nmi-handler.patch b/patches.arch/x86-perf-amd-remove-need-to-check-running-bit-in-nmi-handler.patch
new file mode 100644
index 0000000000..ebd5bea2e3
--- /dev/null
+++ b/patches.arch/x86-perf-amd-remove-need-to-check-running-bit-in-nmi-handler.patch
@@ -0,0 +1,129 @@
+From: "Lendacky, Thomas" <Thomas.Lendacky@amd.com>
+Date: Tue, 2 Apr 2019 15:21:18 +0000
+Subject: x86/perf/amd: Remove need to check "running" bit in NMI handler
+Git-commit: 3966c3feca3fd10b2935caa0b4a08c7dd59469e5
+Patch-mainline: v5.1-rc5
+References: bsc#1131438
+
+Spurious interrupt support was added to perf in the following commit, almost
+a decade ago:
+
+ 63e6be6d98e1 ("perf, x86: Catch spurious interrupts after disabling counters")
+
+The two previous patches (resolving the race condition when disabling a
+PMC and NMI latency mitigation) allow for the removal of this older
+spurious interrupt support.
+
+Currently in x86_pmu_stop(), the bit for the PMC in the active_mask bitmap
+is cleared before disabling the PMC, which sets up a race condition. This
+race condition was mitigated by introducing the running bitmap. That race
+condition can be eliminated by first disabling the PMC, waiting for PMC
+reset on overflow and then clearing the bit for the PMC in the active_mask
+bitmap. The NMI handler will not re-enable a disabled counter.
+
+If x86_pmu_stop() is called from the perf NMI handler, the NMI latency
+mitigation support will guard against any unhandled NMI messages.
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: <stable@vger.kernel.org> # 4.14.x-
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Link: https://lkml.kernel.org/r/Message-ID:
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Tony Jones <tonyj@suse.de>
+---
+ arch/x86/events/amd/core.c | 21 +++++++++++++++++++--
+ arch/x86/events/core.c | 13 +++----------
+ 2 files changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 34c191453ce3..0ecfac84ba91 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -4,8 +4,8 @@
+ #include <linux/init.h>
+ #include <linux/slab.h>
+ #include <linux/delay.h>
+-#include <linux/nmi.h>
+ #include <asm/apicdef.h>
++#include <asm/nmi.h>
+
+ #include "../perf_event.h"
+
+@@ -491,6 +491,23 @@ static void amd_pmu_disable_all(void)
+ }
+ }
+
++static void amd_pmu_disable_event(struct perf_event *event)
++{
++ x86_pmu_disable_event(event);
++
++ /*
++ * This can be called from NMI context (via x86_pmu_stop). The counter
++ * may have overflowed, but either way, we'll never see it get reset
++ * by the NMI if we're already in the NMI. And the NMI latency support
++ * below will take care of any pending NMI that might have been
++ * generated by the overflow.
++ */
++ if (in_nmi())
++ return;
++
++ amd_pmu_wait_on_overflow(event->hw.idx);
++}
++
+ /*
+ * Because of NMI latency, if multiple PMC counters are active or other sources
+ * of NMIs are received, the perf NMI handler can handle one or more overflowed
+@@ -738,7 +755,7 @@ static __initconst const struct x86_pmu amd_pmu = {
+ .disable_all = amd_pmu_disable_all,
+ .enable_all = x86_pmu_enable_all,
+ .enable = x86_pmu_enable_event,
+- .disable = x86_pmu_disable_event,
++ .disable = amd_pmu_disable_event,
+ .hw_config = amd_pmu_hw_config,
+ .schedule_events = x86_schedule_events,
+ .eventsel = MSR_K7_EVNTSEL0,
+diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
+index e2b1447192a8..81911e11a15d 100644
+--- a/arch/x86/events/core.c
++++ b/arch/x86/events/core.c
+@@ -1349,8 +1349,9 @@ void x86_pmu_stop(struct perf_event *event, int flags)
+ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+ struct hw_perf_event *hwc = &event->hw;
+
+- if (__test_and_clear_bit(hwc->idx, cpuc->active_mask)) {
++ if (test_bit(hwc->idx, cpuc->active_mask)) {
+ x86_pmu.disable(event);
++ __clear_bit(hwc->idx, cpuc->active_mask);
+ cpuc->events[hwc->idx] = NULL;
+ WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
+ hwc->state |= PERF_HES_STOPPED;
+@@ -1447,16 +1448,8 @@ int x86_pmu_handle_irq(struct pt_regs *regs)
+ apic_write(APIC_LVTPC, APIC_DM_NMI);
+
+ for (idx = 0; idx < x86_pmu.num_counters; idx++) {
+- if (!test_bit(idx, cpuc->active_mask)) {
+- /*
+- * Though we deactivated the counter some cpus
+- * might still deliver spurious interrupts still
+- * in flight. Catch them:
+- */
+- if (__test_and_clear_bit(idx, cpuc->running))
+- handled++;
++ if (!test_bit(idx, cpuc->active_mask))
+ continue;
+- }
+
+ event = cpuc->events[idx];
+
+
diff --git a/patches.arch/x86-perf-amd-resolve-nmi-latency-issues-for-active-pmcs.patch b/patches.arch/x86-perf-amd-resolve-nmi-latency-issues-for-active-pmcs.patch
new file mode 100644
index 0000000000..ca3059a9ea
--- /dev/null
+++ b/patches.arch/x86-perf-amd-resolve-nmi-latency-issues-for-active-pmcs.patch
@@ -0,0 +1,142 @@
+From: "Lendacky, Thomas" <Thomas.Lendacky@amd.com>
+Date: Tue, 2 Apr 2019 15:21:16 +0000
+Subject: x86/perf/amd: Resolve NMI latency issues for active PMCs
+Git-commit: 6d3edaae16c6c7d238360f2841212c2b26774d5e
+Patch-mainline: v5.1-rc5
+References: bsc#1131438
+
+On AMD processors, the detection of an overflowed PMC counter in the NMI
+handler relies on the current value of the PMC. So, for example, to check
+for overflow on a 48-bit counter, bit 47 is checked to see if it is 1 (not
+overflowed) or 0 (overflowed).
+
+When the perf NMI handler executes it does not know in advance which PMC
+counters have overflowed. As such, the NMI handler will process all active
+PMC counters that have overflowed. NMI latency in newer AMD processors can
+result in multiple overflowed PMC counters being processed in one NMI and
+then a subsequent NMI, that does not appear to be a back-to-back NMI, not
+finding any PMC counters that have overflowed. This may appear to be an
+unhandled NMI resulting in either a panic or a series of messages,
+depending on how the kernel was configured.
+
+To mitigate this issue, add an AMD handle_irq callback function,
+amd_pmu_handle_irq(), that will invoke the common x86_pmu_handle_irq()
+function and upon return perform some additional processing that will
+indicate if the NMI has been handled or would have been handled had an
+earlier NMI not handled the overflowed PMC. Using a per-CPU variable, a
+minimum value of the number of active PMCs or 2 will be set whenever a
+PMC is active. This is used to indicate the possible number of NMIs that
+can still occur. The value of 2 is used for when an NMI does not arrive
+at the LAPIC in time to be collapsed into an already pending NMI. Each
+time the function is called without having handled an overflowed counter,
+the per-CPU value is checked. If the value is non-zero, it is decremented
+and the NMI indicates that it handled the NMI. If the value is zero, then
+the NMI indicates that it did not handle the NMI.
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: <stable@vger.kernel.org> # 4.14.x-
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Link: https://lkml.kernel.org/r/Message-ID:
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Tony Jones <tonyj@suse.de>
+---
+ arch/x86/events/amd/core.c | 56 +++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 55 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index c09ee88b0eed..34c191453ce3 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -4,10 +4,13 @@
+ #include <linux/init.h>
+ #include <linux/slab.h>
+ #include <linux/delay.h>
++#include <linux/nmi.h>
+ #include <asm/apicdef.h>
+
+ #include "../perf_event.h"
+
++static DEFINE_PER_CPU(unsigned int, perf_nmi_counter);
++
+ static __initconst const u64 amd_hw_cache_event_ids
+ [PERF_COUNT_HW_CACHE_MAX]
+ [PERF_COUNT_HW_CACHE_OP_MAX]
+@@ -488,6 +491,57 @@ static void amd_pmu_disable_all(void)
+ }
+ }
+
++/*
++ * Because of NMI latency, if multiple PMC counters are active or other sources
++ * of NMIs are received, the perf NMI handler can handle one or more overflowed
++ * PMC counters outside of the NMI associated with the PMC overflow. If the NMI
++ * doesn't arrive at the LAPIC in time to become a pending NMI, then the kernel
++ * back-to-back NMI support won't be active. This PMC handler needs to take into
++ * account that this can occur, otherwise this could result in unknown NMI
++ * messages being issued. Examples of this is PMC overflow while in the NMI
++ * handler when multiple PMCs are active or PMC overflow while handling some
++ * other source of an NMI.
++ *
++ * Attempt to mitigate this by using the number of active PMCs to determine
++ * whether to return NMI_HANDLED if the perf NMI handler did not handle/reset
++ * any PMCs. The per-CPU perf_nmi_counter variable is set to a minimum of the
++ * number of active PMCs or 2. The value of 2 is used in case an NMI does not
++ * arrive at the LAPIC in time to be collapsed into an already pending NMI.
++ */
++static int amd_pmu_handle_irq(struct pt_regs *regs)
++{
++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
++ int active, handled;
++
++ /*
++ * Obtain the active count before calling x86_pmu_handle_irq() since
++ * it is possible that x86_pmu_handle_irq() may make a counter
++ * inactive (through x86_pmu_stop).
++ */
++ active = __bitmap_weight(cpuc->active_mask, X86_PMC_IDX_MAX);
++
++ /* Process any counter overflows */
++ handled = x86_pmu_handle_irq(regs);
++
++ /*
++ * If a counter was handled, record the number of possible remaining
++ * NMIs that can occur.
++ */
++ if (handled) {
++ this_cpu_write(perf_nmi_counter,
++ min_t(unsigned int, 2, active));
++
++ return handled;
++ }
++
++ if (!this_cpu_read(perf_nmi_counter))
++ return NMI_DONE;
++
++ this_cpu_dec(perf_nmi_counter);
++
++ return NMI_HANDLED;
++}
++
+ static struct event_constraint *
+ amd_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+ struct perf_event *event)
+@@ -680,7 +734,7 @@ static ssize_t amd_event_sysfs_show(char *page, u64 config)
+
+ static __initconst const struct x86_pmu amd_pmu = {
+ .name = "AMD",
+- .handle_irq = x86_pmu_handle_irq,
++ .handle_irq = amd_pmu_handle_irq,
+ .disable_all = amd_pmu_disable_all,
+ .enable_all = x86_pmu_enable_all,
+ .enable = x86_pmu_enable_event,
+
diff --git a/patches.arch/x86-perf-amd-resolve-race-condition-when-disabling-pmc.patch b/patches.arch/x86-perf-amd-resolve-race-condition-when-disabling-pmc.patch
new file mode 100644
index 0000000000..e941fe0313
--- /dev/null
+++ b/patches.arch/x86-perf-amd-resolve-race-condition-when-disabling-pmc.patch
@@ -0,0 +1,152 @@
+From: "Lendacky, Thomas" <Thomas.Lendacky@amd.com>
+Date: Tue, 2 Apr 2019 15:21:14 +0000
+Subject: x86/perf/amd: Resolve race condition when disabling PMC
+Git-commit: 914123fa39042e651d79eaf86bbf63a1b938dddf
+Patch-mainline: v5.1-rc5
+References: bsc#1131438
+
+On AMD processors, the detection of an overflowed counter in the NMI
+handler relies on the current value of the counter. So, for example, to
+check for overflow on a 48 bit counter, bit 47 is checked to see if it
+is 1 (not overflowed) or 0 (overflowed).
+
+There is currently a race condition present when disabling and then
+updating the PMC. Increased NMI latency in newer AMD processors makes this
+race condition more pronounced. If the counter value has overflowed, it is
+possible to update the PMC value before the NMI handler can run. The
+updated PMC value is not an overflowed value, so when the perf NMI handler
+does run, it will not find an overflowed counter. This may appear as an
+unknown NMI resulting in either a panic or a series of messages, depending
+on how the kernel is configured.
+
+To eliminate this race condition, the PMC value must be checked after
+disabling the counter. Add an AMD function, amd_pmu_disable_all(), that
+will wait for the NMI handler to reset any active and overflowed counter
+after calling x86_pmu_disable_all().
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: <stable@vger.kernel.org> # 4.14.x-
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Link: https://lkml.kernel.org/r/Message-ID:
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Tony Jones <tonyj@suse.de>
+---
+ arch/x86/events/amd/core.c | 65 +++++++++++++++++++++++++++++++++++++++++++---
+ 1 file changed, 62 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index 7d2d7c801dba..c09ee88b0eed 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -3,6 +3,7 @@
+ #include <linux/types.h>
+ #include <linux/init.h>
+ #include <linux/slab.h>
++#include <linux/delay.h>
+ #include <asm/apicdef.h>
+
+ #include "../perf_event.h"
+@@ -429,6 +430,64 @@ static void amd_pmu_cpu_dead(int cpu)
+ }
+ }
+
++/*
++ * When a PMC counter overflows, an NMI is used to process the event and
++ * reset the counter. NMI latency can result in the counter being updated
++ * before the NMI can run, which can result in what appear to be spurious
++ * NMIs. This function is intended to wait for the NMI to run and reset
++ * the counter to avoid possible unhandled NMI messages.
++ */
++#define OVERFLOW_WAIT_COUNT 50
++
++static void amd_pmu_wait_on_overflow(int idx)
++{
++ unsigned int i;
++ u64 counter;
++
++ /*
++ * Wait for the counter to be reset if it has overflowed. This loop
++ * should exit very, very quickly, but just in case, don't wait
++ * forever...
++ */
++ for (i = 0; i < OVERFLOW_WAIT_COUNT; i++) {
++ rdmsrl(x86_pmu_event_addr(idx), counter);
++ if (counter & (1ULL << (x86_pmu.cntval_bits - 1)))
++ break;
++
++ /* Might be in IRQ context, so can't sleep */
++ udelay(1);
++ }
++}
++
++static void amd_pmu_disable_all(void)
++{
++ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
++ int idx;
++
++ x86_pmu_disable_all();
++
++ /*
++ * This shouldn't be called from NMI context, but add a safeguard here
++ * to return, since if we're in NMI context we can't wait for an NMI
++ * to reset an overflowed counter value.
++ */
++ if (in_nmi())
++ return;
++
++ /*
++ * Check each counter for overflow and wait for it to be reset by the
++ * NMI if it has overflowed. This relies on the fact that all active
++ * counters are always enabled when this function is caled and
++ * ARCH_PERFMON_EVENTSEL_INT is always set.
++ */
++ for (idx = 0; idx < x86_pmu.num_counters; idx++) {
++ if (!test_bit(idx, cpuc->active_mask))
++ continue;
++
++ amd_pmu_wait_on_overflow(idx);
++ }
++}
++
+ static struct event_constraint *
+ amd_get_event_constraints(struct cpu_hw_events *cpuc, int idx,
+ struct perf_event *event)
+@@ -622,7 +681,7 @@ static ssize_t amd_event_sysfs_show(char *page, u64 config)
+ static __initconst const struct x86_pmu amd_pmu = {
+ .name = "AMD",
+ .handle_irq = x86_pmu_handle_irq,
+- .disable_all = x86_pmu_disable_all,
++ .disable_all = amd_pmu_disable_all,
+ .enable_all = x86_pmu_enable_all,
+ .enable = x86_pmu_enable_event,
+ .disable = x86_pmu_disable_event,
+@@ -732,7 +791,7 @@ void amd_pmu_enable_virt(void)
+ cpuc->perf_ctr_virt_mask = 0;
+
+ /* Reload all events */
+- x86_pmu_disable_all();
++ amd_pmu_disable_all();
+ x86_pmu_enable_all(0);
+ }
+ EXPORT_SYMBOL_GPL(amd_pmu_enable_virt);
+@@ -750,7 +809,7 @@ void amd_pmu_disable_virt(void)
+ cpuc->perf_ctr_virt_mask = AMD64_EVENTSEL_HOSTONLY;
+
+ /* Reload all events */
+- x86_pmu_disable_all();
++ amd_pmu_disable_all();
+ x86_pmu_enable_all(0);
+ }
+ EXPORT_SYMBOL_GPL(amd_pmu_disable_virt);
+
diff --git a/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch b/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
index 02798b9d0a..86279e374c 100644
--- a/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
+++ b/patches.arch/x86-speculation-consolidate-cpu-whitelists.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 27 Feb 2019 10:10:23 +0100
Subject: x86/speculation: Consolidate CPU whitelists
Git-commit: 36ad35131adacc29b328b9c8b6277a8bf0d6fd5d
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
The CPU vulnerability whitelists have some overlap and there are more
diff --git a/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch b/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
index e7acb5921a..c6e0023444 100644
--- a/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-basic-bug-infrastructure-for-mds.patch
@@ -2,7 +2,7 @@ From: Andi Kleen <ak@linux.intel.com>
Date: Fri, 18 Jan 2019 16:50:16 -0800
Subject: x86/speculation/mds: Add basic bug infrastructure for MDS
Git-commit: ed5194c2732c8084af9fd159c146ea92bf137128
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Microarchitectural Data Sampling (MDS), is a class of side channel attacks
diff --git a/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch b/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
index d516b9076c..60dc73ace2 100644
--- a/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
+++ b/patches.arch/x86-speculation-mds-add-bug_msbds_only.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Fri, 1 Mar 2019 20:21:08 +0100
Subject: x86/speculation/mds: Add BUG_MSBDS_ONLY
Git-commit: e261f209c3666e842fd645a1e31f001c3a26def9
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
This bug bit is set on CPUs which are only affected by Microarchitectural
diff --git a/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch b/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
index ace13f6551..5c918bf56f 100644
--- a/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
+++ b/patches.arch/x86-speculation-mds-add-mds-full-nosmt-cmdline-option.patch
@@ -1,9 +1,8 @@
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Tue, 2 Apr 2019 09:59:33 -0500
Subject: x86/speculation/mds: Add mds=full,nosmt cmdline option
-Git-repo: tip/tip
Git-commit: d71eb0ce109a124b0fa714832823b9452f2762cf
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add the mds=full,nosmt cmdline option. This is like mds=full, but with
diff --git a/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch b/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
index be7aa07101..acb480422a 100644
--- a/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
+++ b/patches.arch/x86-speculation-mds-add-mds_clear_cpu_buffers.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 23:13:06 +0100
Subject: x86/speculation/mds: Add mds_clear_cpu_buffers()
Git-commit: 6a9e529272517755904b7afa639f6db59ddb793e
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
The Microarchitectural Data Sampling (MDS) vulernabilities are mitigated by
diff --git a/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch b/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
index 5ba6fa6b6f..dff5a6ac26 100644
--- a/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-mitigation-control-for-mds.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 22:04:08 +0100
Subject: x86/speculation/mds: Add mitigation control for MDS
Git-commit: bc1241700acd82ec69fde98c5763ce51086269f8
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Now that the mitigations are in place, add a command line parameter to
diff --git a/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch b/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
index 2892354690..1e3397de1c 100644
--- a/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
+++ b/patches.arch/x86-speculation-mds-add-mitigation-mode-vmwerv.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Wed, 20 Feb 2019 09:40:40 +0100
Subject: x86/speculation/mds: Add mitigation mode VMWERV
Git-commit: 22dd8365088b6403630b82423cf906491859b65e
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
In virtualized environments it can happen that the host has the microcode
diff --git a/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch b/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
index ee8d12f86b..abb38f06fe 100644
--- a/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-mitigations-support-for-mds.patch
@@ -1,9 +1,8 @@
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Wed, 17 Apr 2019 16:39:02 -0500
Subject: x86/speculation/mds: Add 'mitigations=' support for MDS
-Git-repo: tip/tip
Git-commit: 5c14068f87d04adc73ba3f41c2a303d3c3d1fa12
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add MDS to the new 'mitigations=' cmdline option.
diff --git a/patches.arch/x86-speculation-mds-add-smt-warning-message.patch b/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
index bb34433e23..fd6806f607 100644
--- a/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
+++ b/patches.arch/x86-speculation-mds-add-smt-warning-message.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Tue, 2 Apr 2019 10:00:51 -0500
Subject: x86/speculation/mds: Add SMT warning message
Git-commit: 39226ef02bfb43248b7db12a4fdccb39d95318e3
-Git-repo: tip/tip
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
MDS is vulnerable with SMT. Make that clear with a one-time printk
diff --git a/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch b/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
index 90f30b7b44..163d8311e7 100644
--- a/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
+++ b/patches.arch/x86-speculation-mds-add-sysfs-reporting-for-mds.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 22:51:43 +0100
Subject: x86/speculation/mds: Add sysfs reporting for MDS
Git-commit: 8a4b06d391b0a42a373808979b5028f5c84d9c6a
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add the sysfs reporting file for MDS. It exposes the vulnerability and
diff --git a/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch b/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
index 4317019839..2236a9acca 100644
--- a/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
+++ b/patches.arch/x86-speculation-mds-clear-cpu-buffers-on-exit-to-user.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 23:42:51 +0100
Subject: x86/speculation/mds: Clear CPU buffers on exit to user
Git-commit: 04dcbdb8057827b043b3c71aa397c4c63e67d086
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add a static key which controls the invocation of the CPU buffer clear
@@ -118,7 +118,7 @@ Acked-by: Borislav Petkov <bp@suse.de>
#include <asm/mpx.h>
#include <asm/vm86.h>
#include <asm/umip.h>
-@@ -394,6 +395,13 @@ dotraplinkage void do_double_fault(struc
+@@ -393,6 +394,13 @@ dotraplinkage void do_double_fault(struc
regs->ip = (unsigned long)general_protection;
regs->sp = (unsigned long)&gpregs->orig_ax;
diff --git a/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch b/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
index 9102f2349d..09385844b6 100644
--- a/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
+++ b/patches.arch/x86-speculation-mds-conditionally-clear-cpu-buffers-on-idle-entry.patch
@@ -2,7 +2,7 @@ From: Thomas Gleixner <tglx@linutronix.de>
Date: Mon, 18 Feb 2019 23:04:01 +0100
Subject: x86/speculation/mds: Conditionally clear CPU buffers on idle entry
Git-commit: 07f07f55a29cb705e221eda7894dd67ab81ef343
-Patch-mainline: v5.1-rc1
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
Add a static key which controls the invocation of the CPU buffer clear
diff --git a/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch b/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
index ef3abeb1f2..080d53e2d0 100644
--- a/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
+++ b/patches.arch/x86-speculation-mds-print-smt-vulnerable-on-msbds-with-mitigations-off.patch
@@ -1,9 +1,8 @@
From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Date: Fri, 12 Apr 2019 17:50:58 -0400
Subject: x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off
-Git-repo: tip/tip
Git-commit: e2c3c94788b08891dcf3dbe608f9880523ecd71b
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
This code is only for CPUs which are affected by MSBDS, but are *not*
diff --git a/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch b/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
index c8c1edd2a8..a0516bdfdc 100644
--- a/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
+++ b/patches.arch/x86-speculation-move-arch_smt_update-call-to-after-mitigation-decisions.patch
@@ -1,9 +1,8 @@
From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Tue, 2 Apr 2019 10:00:14 -0500
Subject: x86/speculation: Move arch_smt_update() call to after mitigation decisions
-Git-repo: tip/tip
Git-commit: 7c3658b20194a5b3209a143f63bc9c643c6a3ae2
-Patch-mainline: Queued in a subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1111331, CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
arch_smt_update() now has a dependency on both Spectre v2 and MDS
diff --git a/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch b/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
index 8fda421f64..a7c8d4052b 100644
--- a/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
+++ b/patches.arch/x86-speculation-support-mitigations-cmdline-option.patch
@@ -2,8 +2,7 @@ From: Josh Poimboeuf <jpoimboe@redhat.com>
Date: Fri, 12 Apr 2019 15:39:29 -0500
Subject: x86/speculation: Support 'mitigations=' cmdline option
Git-commit: d68be4c4d31295ff6ae34a8ddfaa4c1a8ff42812
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
-Patch-mainline: queued in subsystem tree
+Patch-mainline: v5.2-rc1
References: bsc#1112178
Configure x86 runtime CPU speculation bug mitigations in accordance with
diff --git a/patches.drivers/0027-spi-spi-mem-Add-devm_spi_mem_dirmap_-create-destroy.patch b/patches.drivers/0027-spi-spi-mem-Add-devm_spi_mem_dirmap_-create-destroy.patch
index ff7decec88..15af587749 100644
--- a/patches.drivers/0027-spi-spi-mem-Add-devm_spi_mem_dirmap_-create-destroy.patch
+++ b/patches.drivers/0027-spi-spi-mem-Add-devm_spi_mem_dirmap_-create-destroy.patch
@@ -16,15 +16,13 @@ Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Mian Yousaf Kaukab <yousaf.kaukab@suse.com>
---
- drivers/spi/spi-mem.c | 69 +++++++++++++++++++++++++++++++++++++++++++++
- include/linux/spi/spi-mem.h | 5 ++++
+ drivers/spi/spi-mem.c | 69 ++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/spi/spi-mem.h | 5 +++
2 files changed, 74 insertions(+)
-diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c
-index 5217a5628be2..08e326a124cc 100644
--- a/drivers/spi/spi-mem.c
+++ b/drivers/spi/spi-mem.c
-@@ -551,6 +551,75 @@ void spi_mem_dirmap_destroy(struct spi_mem_dirmap_desc *desc)
+@@ -552,6 +552,75 @@ void spi_mem_dirmap_destroy(struct spi_m
}
EXPORT_SYMBOL_GPL(spi_mem_dirmap_destroy);
@@ -98,13 +96,11 @@ index 5217a5628be2..08e326a124cc 100644
+EXPORT_SYMBOL_GPL(devm_spi_mem_dirmap_destroy);
+
/**
- * spi_mem_dirmap_dirmap_read() - Read data through a direct mapping
+ * spi_mem_dirmap_read() - Read data through a direct mapping
* @desc: direct mapping descriptor
-diff --git a/include/linux/spi/spi-mem.h b/include/linux/spi/spi-mem.h
-index 3fe24500c5ee..3703d0dcac2e 100644
--- a/include/linux/spi/spi-mem.h
+++ b/include/linux/spi/spi-mem.h
-@@ -330,6 +330,11 @@ ssize_t spi_mem_dirmap_read(struct spi_mem_dirmap_desc *desc,
+@@ -328,6 +328,11 @@ ssize_t spi_mem_dirmap_read(struct spi_m
u64 offs, size_t len, void *buf);
ssize_t spi_mem_dirmap_write(struct spi_mem_dirmap_desc *desc,
u64 offs, size_t len, const void *buf);
@@ -116,6 +112,3 @@ index 3fe24500c5ee..3703d0dcac2e 100644
int spi_mem_driver_register_with_owner(struct spi_mem_driver *drv,
struct module *owner);
---
-2.11.0
-
diff --git a/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch b/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch
new file mode 100644
index 0000000000..bb88b39836
--- /dev/null
+++ b/patches.drivers/ALSA-core-Don-t-refer-to-snd_cards-array-directly.patch
@@ -0,0 +1,181 @@
+From f4fa968950aef7efb98a0899bb0132405e2edaf1 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 18:18:47 +0200
+Subject: [PATCH] ALSA: core: Don't refer to snd_cards array directly
+Git-commit: f4fa968950aef7efb98a0899bb0132405e2edaf1
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The snd_cards[] array holds the card pointers that have been currently
+registered, and it's exported for the external modules that may need
+to refer a card object. But accessing to this array can be racy
+against the driver probe or removal, as the card registration or free
+may happen concurrently.
+
+This patch gets rid of the direct access to snd_cards[] array and
+provides a helper function to give the card object from the index
+number with a refcount management. Then the caller can access to the
+given card object safely, and releases it via snd_card_unref().
+
+While we're at it, add a proper comment to snd_card_unref() and make
+it an inlined function for type-safety, too.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/core.h | 16 ++++++++++++++--
+ sound/core/init.c | 23 +++++++++++++++++++++--
+ sound/core/oss/mixer_oss.c | 16 ++++++++++++----
+ sound/core/sound.c | 5 ++++-
+ sound/last.c | 10 +++++++---
+ 5 files changed, 58 insertions(+), 12 deletions(-)
+
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -241,7 +241,6 @@ int copy_from_user_toio(volatile void __
+
+ /* init.c */
+
+-extern struct snd_card *snd_cards[SNDRV_CARDS];
+ int snd_card_locked(int card);
+ #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
+ #define SND_MIXER_OSS_NOTIFY_REGISTER 0
+@@ -265,7 +264,20 @@ int snd_card_add_dev_attr(struct snd_car
+ int snd_component_add(struct snd_card *card, const char *component);
+ int snd_card_file_add(struct snd_card *card, struct file *file);
+ int snd_card_file_remove(struct snd_card *card, struct file *file);
+-#define snd_card_unref(card) put_device(&(card)->card_dev)
++
++struct snd_card *snd_card_ref(int card);
++
++/**
++ * snd_card_unref - Unreference the card object
++ * @card: the card object to unreference
++ *
++ * Call this function for the card object that was obtained via snd_card_ref()
++ * or snd_lookup_minor_data().
++ */
++static inline void snd_card_unref(struct snd_card *card)
++{
++ put_device(&card->card_dev);
++}
+
+ #define snd_card_set_dev(card, devptr) ((card)->dev = (devptr))
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -49,8 +49,7 @@ static const struct file_operations snd_
+
+ /* locked for registering/using */
+ static DECLARE_BITMAP(snd_cards_lock, SNDRV_CARDS);
+-struct snd_card *snd_cards[SNDRV_CARDS];
+-EXPORT_SYMBOL(snd_cards);
++static struct snd_card *snd_cards[SNDRV_CARDS];
+
+ static DEFINE_MUTEX(snd_card_mutex);
+
+@@ -294,6 +293,26 @@ int snd_card_new(struct device *parent,
+ }
+ EXPORT_SYMBOL(snd_card_new);
+
++/**
++ * snd_card_ref - Get the card object from the index
++ * @idx: the card index
++ *
++ * Returns a card object corresponding to the given index or NULL if not found.
++ * Release the object via snd_card_unref().
++ */
++struct snd_card *snd_card_ref(int idx)
++{
++ struct snd_card *card;
++
++ mutex_lock(&snd_card_mutex);
++ card = snd_cards[idx];
++ if (card)
++ get_device(&card->card_dev);
++ mutex_unlock(&snd_card_mutex);
++ return card;
++}
++EXPORT_SYMBOL_GPL(snd_card_ref);
++
+ /* return non-zero if a card is already locked */
+ int snd_card_locked(int card)
+ {
+--- a/sound/core/oss/mixer_oss.c
++++ b/sound/core/oss/mixer_oss.c
+@@ -1402,24 +1402,32 @@ static int snd_mixer_oss_notify_handler(
+
+ static int __init alsa_mixer_oss_init(void)
+ {
++ struct snd_card *card;
+ int idx;
+
+ snd_mixer_oss_notify_callback = snd_mixer_oss_notify_handler;
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- if (snd_cards[idx])
+- snd_mixer_oss_notify_handler(snd_cards[idx], SND_MIXER_OSS_NOTIFY_REGISTER);
++ card = snd_card_ref(idx);
++ if (card) {
++ snd_mixer_oss_notify_handler(card, SND_MIXER_OSS_NOTIFY_REGISTER);
++ snd_card_unref(card);
++ }
+ }
+ return 0;
+ }
+
+ static void __exit alsa_mixer_oss_exit(void)
+ {
++ struct snd_card *card;
+ int idx;
+
+ snd_mixer_oss_notify_callback = NULL;
+ for (idx = 0; idx < SNDRV_CARDS; idx++) {
+- if (snd_cards[idx])
+- snd_mixer_oss_notify_handler(snd_cards[idx], SND_MIXER_OSS_NOTIFY_FREE);
++ card = snd_card_ref(idx);
++ if (card) {
++ snd_mixer_oss_notify_handler(card, SND_MIXER_OSS_NOTIFY_FREE);
++ snd_card_unref(card);
++ }
+ }
+ }
+
+--- a/sound/core/sound.c
++++ b/sound/core/sound.c
+@@ -136,8 +136,11 @@ static struct snd_minor *autoload_device
+ if (dev == SNDRV_MINOR_CONTROL) {
+ /* /dev/aloadC? */
+ int card = SNDRV_MINOR_CARD(minor);
+- if (snd_cards[card] == NULL)
++ struct snd_card *ref = snd_card_ref(card);
++ if (!ref)
+ snd_request_card(card);
++ else
++ snd_card_unref(ref);
+ } else if (dev == SNDRV_MINOR_GLOBAL) {
+ /* /dev/aloadSEQ */
+ snd_request_other(minor);
+--- a/sound/last.c
++++ b/sound/last.c
+@@ -24,14 +24,18 @@
+
+ static int __init alsa_sound_last_init(void)
+ {
++ struct snd_card *card;
+ int idx, ok = 0;
+
+ printk(KERN_INFO "ALSA device list:\n");
+- for (idx = 0; idx < SNDRV_CARDS; idx++)
+- if (snd_cards[idx] != NULL) {
+- printk(KERN_INFO " #%i: %s\n", idx, snd_cards[idx]->longname);
++ for (idx = 0; idx < SNDRV_CARDS; idx++) {
++ card = snd_card_ref(idx);
++ if (card) {
++ printk(KERN_INFO " #%i: %s\n", idx, card->longname);
++ snd_card_unref(card);
+ ok++;
+ }
++ }
+ if (ok == 0)
+ printk(KERN_INFO " No soundcards found.\n");
+ return 0;
diff --git a/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch b/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch
new file mode 100644
index 0000000000..506e41c6fc
--- /dev/null
+++ b/patches.drivers/ALSA-emu10k1-Drop-superfluous-id-uniquification-beha.patch
@@ -0,0 +1,50 @@
+From c989954938761a2939a21fcbc768af182de6be58 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Apr 2019 18:01:46 +0200
+Subject: [PATCH] ALSA: emu10k1: Drop superfluous id-uniquification behavior
+Git-commit: c989954938761a2939a21fcbc768af182de6be58
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The emu10k1 driver tries to create a unique id string by itself when
+it's copied from the card list, but it's rather superfluous, as the
+same thing will be done in ALSA core side at the card registration.
+Let's drop the code. This allows us removing snd_cards export.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/emu10k1/emu10k1_main.c | 16 +---------------
+ 1 file changed, 1 insertion(+), 15 deletions(-)
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index 61f85ff91cd9..0419c75bdf5a 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -1882,22 +1882,8 @@ int snd_emu10k1_create(struct snd_card *card,
+ c->name, pci->vendor, pci->device,
+ emu->serial);
+
+- if (!*card->id && c->id) {
+- int i, n = 0;
++ if (!*card->id && c->id)
+ strlcpy(card->id, c->id, sizeof(card->id));
+- for (;;) {
+- for (i = 0; i < snd_ecards_limit; i++) {
+- if (snd_cards[i] && !strcmp(snd_cards[i]->id, card->id))
+- break;
+- }
+- if (i >= snd_ecards_limit)
+- break;
+- n++;
+- if (n >= SNDRV_CARDS)
+- break;
+- snprintf(card->id, sizeof(card->id), "%s_%d", c->id, n);
+- }
+- }
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch b/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch
new file mode 100644
index 0000000000..73e136f881
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Register-irq-handler-after-the-chip-initial.patch
@@ -0,0 +1,64 @@
+From f495222e28275222ab6fd93813bd3d462e16d340 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 30 Apr 2019 12:18:28 +0200
+Subject: [PATCH] ALSA: hda - Register irq handler after the chip initialization
+Git-commit: f495222e28275222ab6fd93813bd3d462e16d340
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently the IRQ handler in HD-audio controller driver is registered
+before the chip initialization. That is, we have some window opened
+between the azx_acquire_irq() call and the CORB/RIRB setup. If an
+interrupt is triggered in this small window, the IRQ handler may
+access to the uninitialized RIRB buffer, which leads to a NULL
+dereference Oops.
+
+This is usually no big problem since most of Intel chips do register
+the IRQ via MSI, and we've already fixed the order of the IRQ
+enablement and the CORB/RIRB setup in the former commit b61749a89f82
+("sound: enable interrupt after dma buffer initialization"), hence the
+IRQ won't be triggered in that room. However, some platforms use a
+shared IRQ, and this may allow the IRQ trigger by another source.
+
+Another possibility is the kdump environment: a stale interrupt might
+be present in there, the IRQ handler can be falsely triggered as well.
+
+For covering this small race, let's move the azx_acquire_irq() call
+after hda_intel_init_chip() call. Although this is a bit radical
+change, it can cover more widely than checking the CORB/RIRB setup
+locally in the callee side.
+
+Reported-by: Liwei Song <liwei.song@windriver.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 2ec91085fa3e..789308f54785 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -1788,9 +1788,6 @@ static int azx_first_init(struct azx *chip)
+ chip->msi = 0;
+ }
+
+- if (azx_acquire_irq(chip, 0) < 0)
+- return -EBUSY;
+-
+ pci_set_master(pci);
+ synchronize_irq(bus->irq);
+
+@@ -1904,6 +1901,9 @@ static int azx_first_init(struct azx *chip)
+ return -ENODEV;
+ }
+
++ if (azx_acquire_irq(chip, 0) < 0)
++ return -EBUSY;
++
+ strcpy(card->driver, "HDA-Intel");
+ strlcpy(card->shortname, driver_short_names[chip->driver_type],
+ sizeof(card->shortname));
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch b/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch
new file mode 100644
index 0000000000..53a39fc7f4
--- /dev/null
+++ b/patches.drivers/ALSA-hda-hdmi-Consider-eld_valid-when-reporting-jack.patch
@@ -0,0 +1,61 @@
+From 7f641e26a6df9269cb25dd7a4b0a91d6586ed441 Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 6 May 2019 22:09:32 +0800
+Subject: [PATCH] ALSA: hda/hdmi - Consider eld_valid when reporting jack event
+Git-commit: 7f641e26a6df9269cb25dd7a4b0a91d6586ed441
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On the machines with AMD GPU or Nvidia GPU, we often meet this issue:
+after s3, there are 4 HDMI/DP audio devices in the gnome-sound-setting
+even there is no any monitors plugged.
+
+When this problem happens, we check the /proc/asound/cardX/eld#N.M, we
+will find the monitor_present=1, eld_valid=0.
+
+The root cause is BIOS or GPU driver makes the PRESENCE valid even no
+monitor plugged, and of course the driver will not get the valid
+eld_data subsequently.
+
+In this situation, we should not report the jack_plugged event, to do
+so, let us change the function hdmi_present_sense_via_verbs(). In this
+function, it reads the pin_sense via snd_hda_pin_sense(), after
+calling this function, the jack_dirty is 0, and before exiting
+via_verbs(), we change the shadow pin_sense according to both
+monitor_present and eld_valid, then in the snd_hda_jack_report_sync(),
+since the jack_dirty is still 0, it will report jack event according
+to this modified shadow pin_sense.
+
+After this change, the driver will not report Jack_is_plugged event
+through hdmi_present_sense_via_verbs() if monitor_present is 1 and
+eld_valid is 0.
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_hdmi.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 380001d6e797..0c61c05503f5 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1551,9 +1551,11 @@ static bool hdmi_present_sense_via_verbs(struct hdmi_spec_per_pin *per_pin,
+ ret = !repoll || !eld->monitor_present || eld->eld_valid;
+
+ jack = snd_hda_jack_tbl_get(codec, pin_nid);
+- if (jack)
++ if (jack) {
+ jack->block_report = !ret;
+-
++ jack->pin_sense = (eld->monitor_present && eld->eld_valid) ?
++ AC_PINSENSE_PRESENCE : 0;
++ }
+ mutex_unlock(&per_pin->lock);
+ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch b/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch
new file mode 100644
index 0000000000..76fad87bac
--- /dev/null
+++ b/patches.drivers/ALSA-hda-hdmi-Read-the-pin-sense-from-register-when-.patch
@@ -0,0 +1,48 @@
+From 8c2e6728c2bf95765b724e07d0278ae97cd1ee0d Mon Sep 17 00:00:00 2001
+From: Hui Wang <hui.wang@canonical.com>
+Date: Mon, 6 May 2019 22:09:31 +0800
+Subject: [PATCH] ALSA: hda/hdmi - Read the pin sense from register when repolling
+Git-commit: 8c2e6728c2bf95765b724e07d0278ae97cd1ee0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The driver will check the monitor presence when resuming from suspend,
+starting poll or interrupt triggers. In these 3 situations, the
+jack_dirty will be set to 1 first, then the hda_jack.c reads the
+pin_sense from register, after reading the register, the jack_dirty
+will be set to 0. But hdmi_repoll_work() is enabled in these 3
+situations, It will read the pin_sense a couple of times subsequently,
+since the jack_dirty is 0 now, It does not read the register anymore,
+instead it uses the shadow pin_sense which is read at the first time.
+
+It is meaningless to check the shadow pin_sense a couple of times,
+we need to read the register to check the real plugging state, so
+we set the jack_dirty to 1 in the hdmi_repoll_work().
+
+Signed-off-by: Hui Wang <hui.wang@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_hdmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 8b3ac690efa3..380001d6e797 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1663,6 +1663,11 @@ static void hdmi_repoll_eld(struct work_struct *work)
+ container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
+ struct hda_codec *codec = per_pin->codec;
+ struct hdmi_spec *spec = codec->spec;
++ struct hda_jack_tbl *jack;
++
++ jack = snd_hda_jack_tbl_get(codec, per_pin->pin_nid);
++ if (jack)
++ jack->jack_dirty = 1;
+
+ if (per_pin->repoll_count++ > 6)
+ per_pin->repoll_count = 0;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch b/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
index 5cab8e57c9..605e0fc1fe 100644
--- a/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
+++ b/patches.drivers/ALSA-hda-realtek-Add-quirk-for-Tuxedo-XC-1509.patch
@@ -4,8 +4,7 @@ Date: Tue, 2 Apr 2019 15:52:04 +0200
Subject: [PATCH] ALSA: hda/realtek - Add quirk for Tuxedo XC 1509
References: bsc#1131442
Git-commit: 80690a276f444a68a332136d98bfea1c338bc263
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.1-rc5
This adds a SND_PCI_QUIRK(...) line for the Tuxedo XC 1509.
diff --git a/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch b/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch
new file mode 100644
index 0000000000..6d185debc3
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-EAPD-turn-on-later.patch
@@ -0,0 +1,43 @@
+From 607ca3bd220f4022e6f5356026b19dafc363863a Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Fri, 26 Apr 2019 16:35:41 +0800
+Subject: [PATCH] ALSA: hda/realtek - EAPD turn on later
+Git-commit: 607ca3bd220f4022e6f5356026b19dafc363863a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Let EAPD turn on after set pin output.
+
+[ NOTE: This change is supposed to reduce the possible click noises at
+ (runtime) PM resume. The functionality should be same (i.e. the
+ verbs are executed correctly) no matter which order is, so this
+ should be safe to apply for all codecs -- tiwai ]
+
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 810479766090..674ddff65bef 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -803,11 +803,10 @@ static int alc_init(struct hda_codec *codec)
+ if (spec->init_hook)
+ spec->init_hook(codec);
+
++ snd_hda_gen_init(codec);
+ alc_fix_pll(codec);
+ alc_auto_init_amp(codec, spec->init_amp);
+
+- snd_hda_gen_init(codec);
+-
+ snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
+
+ return 0;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-ALC256.patch b/patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-ALC256.patch
new file mode 100644
index 0000000000..bc4ae08ccc
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-ALC256.patch
@@ -0,0 +1,116 @@
+From 6447c962bc47a58c5ddb27d1c7c7dc45ca90bad0 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Wed, 8 May 2019 16:27:03 +0800
+Subject: [PATCH] ALSA: hda/realtek - Support low power consumption for ALC256
+Git-commit: 6447c962bc47a58c5ddb27d1c7c7dc45ca90bad0
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Remove hp_pin = 0 return. Add the default pin 0x21 as headphone.
+Supported low power consumption, it must do depop procedure when
+headset jack was plugged or unplugged.
+So, alc256_init() and alc256_shutup() must run delay when headset jack
+was plugged or unplugged.
+If depop procedure not run with delay, it will have a chance to let
+power consumption raise high.
+
+[ NOTE: this is a quite quite similar change for ALC295 by commit
+ d3ba58bb8959 ("ALSA: hda/realtek - Support low power consumption for
+ ALC295"), but applied to ALC256 codec instead -- tiwai ]
+
+Fixes: 8983eb602af5 ("ALSA: hda/realtek - Move to ACT_INIT state")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index dacccacb5fe0..c53ca589c930 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3197,7 +3197,7 @@ static void alc256_init(struct hda_codec *codec)
+ bool hp_pin_sense;
+
+ if (!hp_pin)
+- return;
++ hp_pin = 0x21;
+
+ msleep(30);
+
+@@ -3207,17 +3207,25 @@ static void alc256_init(struct hda_codec *codec)
+ msleep(2);
+
+ alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
++ if (spec->ultra_low_power) {
++ alc_update_coef_idx(codec, 0x03, 1<<1, 1<<1);
++ alc_update_coef_idx(codec, 0x08, 3<<2, 3<<2);
++ alc_update_coef_idx(codec, 0x08, 7<<4, 0);
++ alc_update_coef_idx(codec, 0x3b, 1<<15, 0);
++ alc_update_coef_idx(codec, 0x0e, 7<<6, 7<<6);
++ msleep(30);
++ }
+
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+- if (hp_pin_sense)
++ if (hp_pin_sense || spec->ultra_low_power)
+ msleep(85);
+
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+
+- if (hp_pin_sense)
++ if (hp_pin_sense || spec->ultra_low_power)
+ msleep(100);
+
+ alc_update_coef_idx(codec, 0x46, 3 << 12, 0);
+@@ -3232,10 +3240,8 @@ static void alc256_shutup(struct hda_codec *codec)
+ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp_pin_sense;
+
+- if (!hp_pin) {
+- alc269_shutup(codec);
+- return;
+- }
++ if (!hp_pin)
++ hp_pin = 0x21;
+
+ hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+
+@@ -3245,7 +3251,7 @@ static void alc256_shutup(struct hda_codec *codec)
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+- if (hp_pin_sense)
++ if (hp_pin_sense || spec->ultra_low_power)
+ msleep(85);
+
+ /* 3k pull low control for Headset jack. */
+@@ -3256,11 +3262,20 @@ static void alc256_shutup(struct hda_codec *codec)
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+- if (hp_pin_sense)
++ if (hp_pin_sense || spec->ultra_low_power)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+ alc_shutup_pins(codec);
++ if (spec->ultra_low_power) {
++ msleep(50);
++ alc_update_coef_idx(codec, 0x03, 1<<1, 0);
++ alc_update_coef_idx(codec, 0x08, 7<<4, 7<<4);
++ alc_update_coef_idx(codec, 0x08, 3<<2, 0);
++ alc_update_coef_idx(codec, 0x3b, 1<<15, 1<<15);
++ alc_update_coef_idx(codec, 0x0e, 7<<6, 0);
++ msleep(30);
++ }
+ }
+
+ static void alc225_init(struct hda_codec *codec)
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-for-A.patch b/patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-for-A.patch
new file mode 100644
index 0000000000..a122a47977
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Support-low-power-consumption-for-A.patch
@@ -0,0 +1,156 @@
+From d3ba58bb895915f7f9105e0844441d2ca7d83340 Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Mon, 6 May 2019 15:09:42 +0800
+Subject: [PATCH] ALSA: hda/realtek - Support low power consumption for ALC295
+Git-commit: d3ba58bb895915f7f9105e0844441d2ca7d83340
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Enter to close more power control widgets at suspend.
+Remove hp_pin check. Add the default pin 0x21 as headphone.
+Supported low power consumption, it must do depop procedure when
+headset jack was plugged or unplugged.
+So, alc225_init() and alc225_shutup() must run delay when headset
+jack was plugged or unplugged.
+If depop procedure not run with delay, it will have a chance to let
+power consumption raise high.
+
+[ A few compile fixes by tiwai ]
+
+Fixes: 8983eb602af5 ("ALSA: hda/realtek - Move to ACT_INIT state")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 46 +++++++++++++++++++++++++++++--------------
+ 1 file changed, 31 insertions(+), 15 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d743f2b0e3cf..e733d323f1a7 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -119,6 +119,7 @@ struct alc_spec {
+ unsigned int no_depop_delay:1;
+ unsigned int done_hp_init:1;
+ unsigned int no_shutup_pins:1;
++ unsigned int ultra_low_power:1;
+
+ /* for PLL fix */
+ hda_nid_t pll_nid;
+@@ -3269,8 +3270,7 @@ static void alc225_init(struct hda_codec *codec)
+ bool hp1_pin_sense, hp2_pin_sense;
+
+ if (!hp_pin)
+- return;
+-
++ hp_pin = 0x21;
+ msleep(30);
+
+ hp1_pin_sense = snd_hda_jack_detect(codec, hp_pin);
+@@ -3280,25 +3280,31 @@ static void alc225_init(struct hda_codec *codec)
+ msleep(2);
+
+ alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
++ if (spec->ultra_low_power) {
++ alc_update_coef_idx(codec, 0x08, 0x0f << 2, 3<<2);
++ alc_update_coef_idx(codec, 0x0e, 7<<6, 7<<6);
++ alc_update_coef_idx(codec, 0x33, 1<<11, 0);
++ msleep(30);
++ }
+
+- if (hp1_pin_sense)
++ if (hp1_pin_sense || spec->ultra_low_power)
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+ if (hp2_pin_sense)
+ snd_hda_codec_write(codec, 0x16, 0,
+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+- if (hp1_pin_sense || hp2_pin_sense)
++ if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
+ msleep(85);
+
+- if (hp1_pin_sense)
++ if (hp1_pin_sense || spec->ultra_low_power)
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+ if (hp2_pin_sense)
+ snd_hda_codec_write(codec, 0x16, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_OUT);
+
+- if (hp1_pin_sense || hp2_pin_sense)
++ if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
+ msleep(100);
+
+ alc_update_coef_idx(codec, 0x4a, 3 << 10, 0);
+@@ -3311,11 +3317,8 @@ static void alc225_shutup(struct hda_codec *codec)
+ hda_nid_t hp_pin = alc_get_hp_pin(spec);
+ bool hp1_pin_sense, hp2_pin_sense;
+
+- if (!hp_pin) {
+- alc269_shutup(codec);
+- return;
+- }
+-
++ if (!hp_pin)
++ hp_pin = 0x21;
+ /* 3k pull low control for Headset jack. */
+ alc_update_coef_idx(codec, 0x4a, 0, 3 << 10);
+
+@@ -3325,28 +3328,36 @@ static void alc225_shutup(struct hda_codec *codec)
+ if (hp1_pin_sense || hp2_pin_sense)
+ msleep(2);
+
+- if (hp1_pin_sense)
++ if (hp1_pin_sense || spec->ultra_low_power)
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+ if (hp2_pin_sense)
+ snd_hda_codec_write(codec, 0x16, 0,
+ AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
+
+- if (hp1_pin_sense || hp2_pin_sense)
++ if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
+ msleep(85);
+
+- if (hp1_pin_sense)
++ if (hp1_pin_sense || spec->ultra_low_power)
+ snd_hda_codec_write(codec, hp_pin, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+ if (hp2_pin_sense)
+ snd_hda_codec_write(codec, 0x16, 0,
+ AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
+
+- if (hp1_pin_sense || hp2_pin_sense)
++ if (hp1_pin_sense || hp2_pin_sense || spec->ultra_low_power)
+ msleep(100);
+
+ alc_auto_setup_eapd(codec, false);
+ alc_shutup_pins(codec);
++ if (spec->ultra_low_power) {
++ msleep(50);
++ alc_update_coef_idx(codec, 0x08, 0x0f << 2, 0x0c << 2);
++ alc_update_coef_idx(codec, 0x0e, 7<<6, 0);
++ alc_update_coef_idx(codec, 0x33, 1<<11, 1<<11);
++ alc_update_coef_idx(codec, 0x4a, 3<<4, 2<<4);
++ msleep(30);
++ }
+ }
+
+ static void alc_default_init(struct hda_codec *codec)
+@@ -5526,7 +5537,12 @@ static void alc_fixup_headset_jack(struct hda_codec *codec,
+ static void alc295_fixup_chromebook(struct hda_codec *codec,
+ const struct hda_fixup *fix, int action)
+ {
++ struct alc_spec *spec = codec->spec;
++
+ switch (action) {
++ case HDA_FIXUP_ACT_PRE_PROBE:
++ spec->ultra_low_power = true;
++ break;
+ case HDA_FIXUP_ACT_INIT:
+ switch (codec->core.vendor_id) {
+ case 0x10ec0295:
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch b/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch
new file mode 100644
index 0000000000..ba0da7343e
--- /dev/null
+++ b/patches.drivers/ALSA-hdea-realtek-Headset-fixup-for-System76-Gazelle.patch
@@ -0,0 +1,39 @@
+From 80a5052db75131423b67f38b21958555d7d970e4 Mon Sep 17 00:00:00 2001
+From: Jeremy Soller <jeremy@system76.com>
+Date: Tue, 7 May 2019 17:11:08 -0400
+Subject: [PATCH] ALSA: hdea/realtek - Headset fixup for System76 Gazelle (gaze14)
+Git-commit: 80a5052db75131423b67f38b21958555d7d970e4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On the System76 Gazelle (gaze14), there is a headset microphone input
+attached to 0x1a that does not have a jack detect. In order to get it
+working, the pin configuration needs to be set correctly, and the
+ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC fixup needs to be applied. This is
+identical to the patch already applied for the System76 Darter Pro
+(darp5).
+
+Signed-off-by: Jeremy Soller <jeremy@system76.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index e733d323f1a7..dacccacb5fe0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6948,6 +6948,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8550, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
+ SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch b/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch
new file mode 100644
index 0000000000..50c6da90b1
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Align-temporary-re-locking-with-irqsave-ver.patch
@@ -0,0 +1,64 @@
+From 4b24b960b10b6a4e30beba3ce097fa867b4a085f Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 15:55:08 +0100
+Subject: [PATCH] ALSA: seq: Align temporary re-locking with irqsave version
+Git-commit: 4b24b960b10b6a4e30beba3ce097fa867b4a085f
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In a few places in sequencer core, we temporarily unlock / re-lock the
+pool spin lock while waiting for the allocation in the blocking mode.
+There spin_unlock_irq() / spin_lock_irq() pairs are called while
+initially spin_lock_irqsave() is used (and spin_lock_irqrestore() at
+the end of the function again). This is likely OK for now, but it's a
+bit confusing and error-prone.
+
+This patch replaces these temporary relocking lines with the irqsave
+variant to make the lock/unlock sequence more consistently.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_fifo.c | 4 ++--
+ sound/core/seq/seq_memory.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c
+index 72c0302a55d2..613ae10d33b8 100644
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -195,9 +195,9 @@ int snd_seq_fifo_cell_out(struct snd_seq_fifo *f,
+ }
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&f->input_sleep, &wait);
+- spin_unlock_irq(&f->lock);
++ spin_unlock_irqrestore(&f->lock, flags);
+ schedule();
+- spin_lock_irq(&f->lock);
++ spin_lock_irqsave(&f->lock, flags);
+ remove_wait_queue(&f->input_sleep, &wait);
+ if (signal_pending(current)) {
+ spin_unlock_irqrestore(&f->lock, flags);
+diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
+index 6ea4d8a5a71e..ae0b8971f6ce 100644
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -244,13 +244,13 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
+
+ set_current_state(TASK_INTERRUPTIBLE);
+ add_wait_queue(&pool->output_sleep, &wait);
+- spin_unlock_irq(&pool->lock);
++ spin_unlock_irqrestore(&pool->lock, flags);
+ if (mutexp)
+ mutex_unlock(mutexp);
+ schedule();
+ if (mutexp)
+ mutex_lock(mutexp);
+- spin_lock_irq(&pool->lock);
++ spin_lock_irqsave(&pool->lock, flags);
+ remove_wait_queue(&pool->output_sleep, &wait);
+ /* interrupted? */
+ if (signal_pending(current)) {
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch b/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch
new file mode 100644
index 0000000000..308af2814c
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Correct-unlock-sequence-at-snd_seq_client_i.patch
@@ -0,0 +1,50 @@
+From b5fd12d6c0fc64c2c2b5ae095e63824083d27151 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 15 Apr 2019 09:03:01 +0200
+Subject: [PATCH] ALSA: seq: Correct unlock sequence at snd_seq_client_ioctl_unlock()
+Git-commit: b5fd12d6c0fc64c2c2b5ae095e63824083d27151
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The doubly unlock sequence at snd_seq_client_ioctl_unlock() is tricky.
+I took a direct unref call since I thought it would avoid
+misunderstanding, but rather this seems more confusing. Let's use
+snd_seq_client_unlock() consistently even if they look strange to be
+called twice, and add more comments for avoiding reader's confusion.
+
+Fixes: 6b580f523172 ("ALSA: seq: Protect racy pool manipulation from OSS sequencer")
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 3acd80e718f2..c0227a672442 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -191,6 +191,7 @@ bool snd_seq_client_ioctl_lock(int clientid)
+ if (!client)
+ return false;
+ mutex_lock(&client->ioctl_mutex);
++ /* The client isn't unrefed here; see snd_seq_client_ioctl_unlock() */
+ return true;
+ }
+ EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock);
+@@ -204,7 +205,11 @@ void snd_seq_client_ioctl_unlock(int clientid)
+ if (WARN_ON(!client))
+ return;
+ mutex_unlock(&client->ioctl_mutex);
+- snd_use_lock_free(&client->use_lock);
++ /* The doubly unrefs below are intentional; the first one releases the
++ * leftover from snd_seq_client_ioctl_lock() above, and the second one
++ * is for releasing snd_seq_client_use_ptr() in this function
++ */
++ snd_seq_client_unlock(client);
+ snd_seq_client_unlock(client);
+ }
+ EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch b/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch
new file mode 100644
index 0000000000..19f83f1555
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Cover-unsubscribe_port-in-list_mutex.patch
@@ -0,0 +1,40 @@
+From 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 11:37:19 +0200
+Subject: [PATCH] ALSA: seq: Cover unsubscribe_port() in list_mutex
+Git-commit: 7c32ae35fbf9cffb7aa3736f44dec10c944ca18e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The call of unsubscribe_port() which manages the group count and
+module refcount from delete_and_unsubscribe_port() looks racy; it's
+not covered by the group list lock, and it's likely a cause of the
+reported unbalance at port deletion. Let's move the call inside the
+group list_mutex to plug the hole.
+
+Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_ports.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index d964d728681e..ac7556ab531c 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -547,10 +547,10 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
+ list_del_init(list);
+ grp->exclusive = 0;
+ write_unlock_irq(&grp->list_lock);
+- up_write(&grp->list_mutex);
+
+ if (!empty)
+ unsubscribe_port(client, port, grp, &subs->info, ack);
++ up_write(&grp->list_mutex);
+ }
+
+ /* connect two ports */
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch b/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
new file mode 100644
index 0000000000..9c7cc9bf17
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Fix-race-of-get-subscription-call-vs-port-d.patch
@@ -0,0 +1,103 @@
+From 2eabc5ec8ab4d4748a82050dfcb994119b983750 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 18:04:17 +0200
+Subject: [PATCH] ALSA: seq: Fix race of get-subscription call vs port-delete ioctls
+Git-commit: 2eabc5ec8ab4d4748a82050dfcb994119b983750
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The snd_seq_ioctl_get_subscription() retrieves the port subscriber
+information as a pointer, while the object isn't protected, hence it
+may be deleted before the actual reference. This race was spotted by
+syzkaller and may lead to a UAF.
+
+The fix is simply copying the data in the lookup function that
+performs in the rwsem to protect against the deletion.
+
+Reported-by: syzbot+9437020c82413d00222d@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 10 ++--------
+ sound/core/seq/seq_ports.c | 13 ++++++++-----
+ sound/core/seq/seq_ports.h | 5 +++--
+ 3 files changed, 13 insertions(+), 15 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 976404691261..f256704dc401 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -1897,20 +1897,14 @@ static int snd_seq_ioctl_get_subscription(struct snd_seq_client *client,
+ int result;
+ struct snd_seq_client *sender = NULL;
+ struct snd_seq_client_port *sport = NULL;
+- struct snd_seq_subscribers *p;
+
+ result = -EINVAL;
+ if ((sender = snd_seq_client_use_ptr(subs->sender.client)) == NULL)
+ goto __end;
+ if ((sport = snd_seq_port_use_ptr(sender, subs->sender.port)) == NULL)
+ goto __end;
+- p = snd_seq_port_get_subscription(&sport->c_src, &subs->dest);
+- if (p) {
+- result = 0;
+- *subs = p->info;
+- } else
+- result = -ENOENT;
+-
++ result = snd_seq_port_get_subscription(&sport->c_src, &subs->dest,
++ subs);
+ __end:
+ if (sport)
+ snd_seq_port_unlock(sport);
+diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
+index 1e2239240f21..d964d728681e 100644
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -632,20 +632,23 @@ int snd_seq_port_disconnect(struct snd_seq_client *connector,
+
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr)
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs)
+ {
+- struct snd_seq_subscribers *s, *found = NULL;
++ struct snd_seq_subscribers *s;
++ int err = -ENOENT;
+
+ down_read(&src_grp->list_mutex);
+ list_for_each_entry(s, &src_grp->list_head, src_list) {
+ if (addr_match(dest_addr, &s->info.dest)) {
+- found = s;
++ *subs = s->info;
++ err = 0;
+ break;
+ }
+ }
+ up_read(&src_grp->list_mutex);
+- return found;
++ return err;
+ }
+
+ /*
+diff --git a/sound/core/seq/seq_ports.h b/sound/core/seq/seq_ports.h
+index 26bd71f36c41..06003b36652e 100644
+--- a/sound/core/seq/seq_ports.h
++++ b/sound/core/seq/seq_ports.h
+@@ -135,7 +135,8 @@ int snd_seq_port_subscribe(struct snd_seq_client_port *port,
+ struct snd_seq_port_subscribe *info);
+
+ /* get matched subscriber */
+-struct snd_seq_subscribers *snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
+- struct snd_seq_addr *dest_addr);
++int snd_seq_port_get_subscription(struct snd_seq_port_subs_info *src_grp,
++ struct snd_seq_addr *dest_addr,
++ struct snd_seq_port_subscribe *subs);
+
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch b/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
new file mode 100644
index 0000000000..47ed8949b1
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Protect-in-kernel-ioctl-calls-with-mutex.patch
@@ -0,0 +1,54 @@
+From feb689025fbb6f0aa6297d3ddf97de945ea4ad32 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 17:35:22 +0200
+Subject: [PATCH] ALSA: seq: Protect in-kernel ioctl calls with mutex
+Git-commit: feb689025fbb6f0aa6297d3ddf97de945ea4ad32
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+ALSA OSS sequencer calls the ioctl function indirectly via
+snd_seq_kernel_client_ctl(). While we already applied the protection
+against races between the normal ioctls and writes via the client's
+ioctl_mutex, this code path was left untouched. And this seems to be
+the cause of still remaining some rare UAF as spontaneously triggered
+by syzkaller.
+
+For the sake of robustness, wrap the ioctl_mutex also for the call via
+snd_seq_kernel_client_ctl(), too.
+
+Reported-by: syzbot+e4c8abb920efa77bace9@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 933bde3843d9..976404691261 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2340,14 +2340,19 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ {
+ const struct ioctl_handler *handler;
+ struct snd_seq_client *client;
++ int err;
+
+ client = clientptr(clientid);
+ if (client == NULL)
+ return -ENXIO;
+
+ for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
+- if (handler->cmd == cmd)
+- return handler->func(client, arg);
++ if (handler->cmd == cmd) {
++ mutex_lock(&client->ioctl_mutex);
++ err = handler->func(client, arg);
++ mutex_unlock(&client->ioctl_mutex);
++ return err;
++ }
+ }
+
+ pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch b/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch
new file mode 100644
index 0000000000..2c9eaf349b
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Protect-racy-pool-manipulation-from-OSS-seq.patch
@@ -0,0 +1,132 @@
+From 6b580f523172f2c738b661069a57c23c74a75f88 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 12:44:39 +0200
+Subject: [PATCH] ALSA: seq: Protect racy pool manipulation from OSS sequencer
+Git-commit: 6b580f523172f2c738b661069a57c23c74a75f88
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+OSS sequencer emulation still allows to queue and issue the events
+that manipulate the client pool concurrently in a racy way. This
+patch serializes the access like the normal sequencer write / ioctl
+via taking the client ioctl_mutex. Since the access to the sequencer
+client is done indirectly via a client id number, a new helper to
+take/release the mutex is introduced.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/oss/seq_oss_device.h | 10 ++++++++--
+ sound/core/seq/seq_clientmgr.c | 40 ++++++++++++++++++++++++++++++++++---
+ sound/core/seq/seq_clientmgr.h | 4 ++++
+ 3 files changed, 49 insertions(+), 5 deletions(-)
+
+diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
+index 2d0e9eaf13aa..77eb1fe1155c 100644
+--- a/sound/core/seq/oss/seq_oss_device.h
++++ b/sound/core/seq/oss/seq_oss_device.h
+@@ -30,6 +30,7 @@
+ #include <sound/rawmidi.h>
+ #include <sound/seq_kernel.h>
+ #include <sound/info.h>
++#include "../seq_clientmgr.h"
+
+ /* max. applications */
+ #define SNDRV_SEQ_OSS_MAX_CLIENTS 16
+@@ -150,11 +151,16 @@ snd_seq_oss_dispatch(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, int a
+ return snd_seq_kernel_client_dispatch(dp->cseq, ev, atomic, hop);
+ }
+
+-/* ioctl */
++/* ioctl for writeq */
+ static inline int
+ snd_seq_oss_control(struct seq_oss_devinfo *dp, unsigned int type, void *arg)
+ {
+- return snd_seq_kernel_client_ctl(dp->cseq, type, arg);
++ int err;
++
++ snd_seq_client_ioctl_lock(dp->cseq);
++ err = snd_seq_kernel_client_ctl(dp->cseq, type, arg);
++ snd_seq_client_ioctl_unlock(dp->cseq);
++ return err;
+ }
+
+ /* fill the addresses in header */
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index 0af5b1440b33..a5c9d59eb5b8 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -179,6 +179,36 @@ struct snd_seq_client *snd_seq_client_use_ptr(int clientid)
+ return client;
+ }
+
++/* Take refcount and perform ioctl_mutex lock on the given client;
++ * used only for OSS sequencer
++ * Unlock via snd_seq_client_ioctl_unlock() below
++ */
++bool snd_seq_client_ioctl_lock(int clientid)
++{
++ struct snd_seq_client *client;
++
++ client = snd_seq_client_use_ptr(clientid);
++ if (!client)
++ return false;
++ mutex_lock(&client->ioctl_mutex);
++ return true;
++}
++EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_lock);
++
++/* Unlock and unref the given client; for OSS sequencer use only */
++void snd_seq_client_ioctl_unlock(int clientid)
++{
++ struct snd_seq_client *client;
++
++ client = snd_seq_client_use_ptr(clientid);
++ if (WARN_ON(!client))
++ return;
++ mutex_unlock(&client->ioctl_mutex);
++ snd_use_lock_free(&client->use_lock);
++ snd_seq_client_unlock(client);
++}
++EXPORT_SYMBOL_GPL(snd_seq_client_ioctl_unlock);
++
+ static void usage_alloc(struct snd_seq_usage *res, int num)
+ {
+ res->cur += num;
+@@ -2247,11 +2277,15 @@ int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
+ if (cptr == NULL)
+ return -EINVAL;
+
+- if (! cptr->accept_output)
++ if (!cptr->accept_output) {
+ result = -EPERM;
+- else /* send it */
++ } else { /* send it */
++ mutex_lock(&cptr->ioctl_mutex);
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+- false, 0, NULL);
++ false, 0,
++ &cptr->ioctl_mutex);
++ mutex_unlock(&cptr->ioctl_mutex);
++ }
+
+ snd_seq_client_unlock(cptr);
+ return result;
+diff --git a/sound/core/seq/seq_clientmgr.h b/sound/core/seq/seq_clientmgr.h
+index 66ad3d547916..28a51dcc0190 100644
+--- a/sound/core/seq/seq_clientmgr.h
++++ b/sound/core/seq/seq_clientmgr.h
+@@ -97,6 +97,10 @@ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table
+ int snd_seq_client_notify_subscription(int client, int port,
+ struct snd_seq_port_subscribe *info, int evtype);
+
++/* only for OSS sequencer */
++bool snd_seq_client_ioctl_lock(int clientid);
++void snd_seq_client_ioctl_unlock(int clientid);
++
+ extern int seq_client_load[15];
+
+ #endif
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch b/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch
new file mode 100644
index 0000000000..f0ff02fb78
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Remove-superfluous-irqsave-flags.patch
@@ -0,0 +1,277 @@
+From f823b8a75527dca0b93cf577bbabbe47fd79b2a8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 16:21:01 +0100
+Subject: [PATCH] ALSA: seq: Remove superfluous irqsave flags
+Git-commit: f823b8a75527dca0b93cf577bbabbe47fd79b2a8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+spin_lock_irqsave() is used unnecessarily in various places in
+sequencer core code although it's pretty obvious that the context is
+sleepable. Remove irqsave and use the plain spin_lock_irq() in such
+places for simplicity.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 19 ++++++++-----------
+ sound/core/seq/seq_fifo.c | 10 ++++------
+ sound/core/seq/seq_memory.c | 16 +++++++---------
+ sound/core/seq/seq_ports.c | 15 ++++++---------
+ 4 files changed, 25 insertions(+), 35 deletions(-)
+
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -203,7 +203,6 @@ int __init client_init_data(void)
+
+ static struct snd_seq_client *seq_create_client1(int client_index, int poolsize)
+ {
+- unsigned long flags;
+ int c;
+ struct snd_seq_client *client;
+
+@@ -224,7 +223,7 @@ static struct snd_seq_client *seq_create
+ mutex_init(&client->ioctl_mutex);
+
+ /* find free slot in the client table */
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ if (client_index < 0) {
+ for (c = SNDRV_SEQ_DYNAMIC_CLIENTS_BEGIN;
+ c < SNDRV_SEQ_MAX_CLIENTS;
+@@ -232,17 +231,17 @@ static struct snd_seq_client *seq_create
+ if (clienttab[c] || clienttablock[c])
+ continue;
+ clienttab[client->number = c] = client;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return client;
+ }
+ } else {
+ if (clienttab[client_index] == NULL && !clienttablock[client_index]) {
+ clienttab[client->number = client_index] = client;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return client;
+ }
+ }
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ snd_seq_pool_delete(&client->pool);
+ kfree(client);
+ return NULL; /* no free slot found or busy, return failure code */
+@@ -251,23 +250,21 @@ static struct snd_seq_client *seq_create
+
+ static int seq_free_client1(struct snd_seq_client *client)
+ {
+- unsigned long flags;
+-
+ if (!client)
+ return 0;
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ clienttablock[client->number] = 1;
+ clienttab[client->number] = NULL;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ snd_seq_delete_all_ports(client);
+ snd_seq_queue_client_leave(client->number);
+ snd_use_lock_sync(&client->use_lock);
+ snd_seq_queue_client_termination(client->number);
+ if (client->pool)
+ snd_seq_pool_delete(&client->pool);
+- spin_lock_irqsave(&clients_lock, flags);
++ spin_lock_irq(&clients_lock);
+ clienttablock[client->number] = 0;
+- spin_unlock_irqrestore(&clients_lock, flags);
++ spin_unlock_irq(&clients_lock);
+ return 0;
+ }
+
+--- a/sound/core/seq/seq_fifo.c
++++ b/sound/core/seq/seq_fifo.c
+@@ -98,18 +98,17 @@ static struct snd_seq_event_cell *fifo_c
+ void snd_seq_fifo_clear(struct snd_seq_fifo *f)
+ {
+ struct snd_seq_event_cell *cell;
+- unsigned long flags;
+
+ /* clear overflow flag */
+ atomic_set(&f->overflow, 0);
+
+ snd_use_lock_sync(&f->use_lock);
+- spin_lock_irqsave(&f->lock, flags);
++ spin_lock_irq(&f->lock);
+ /* drain the fifo */
+ while ((cell = fifo_cell_out(f)) != NULL) {
+ snd_seq_cell_free(cell);
+ }
+- spin_unlock_irqrestore(&f->lock, flags);
++ spin_unlock_irq(&f->lock);
+ }
+
+
+@@ -239,7 +238,6 @@ int snd_seq_fifo_poll_wait(struct snd_se
+ /* change the size of pool; all old events are removed */
+ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize)
+ {
+- unsigned long flags;
+ struct snd_seq_pool *newpool, *oldpool;
+ struct snd_seq_event_cell *cell, *next, *oldhead;
+
+@@ -255,7 +253,7 @@ int snd_seq_fifo_resize(struct snd_seq_f
+ return -ENOMEM;
+ }
+
+- spin_lock_irqsave(&f->lock, flags);
++ spin_lock_irq(&f->lock);
+ /* remember old pool */
+ oldpool = f->pool;
+ oldhead = f->head;
+@@ -265,7 +263,7 @@ int snd_seq_fifo_resize(struct snd_seq_f
+ f->tail = NULL;
+ f->cells = 0;
+ /* NOTE: overflow flag is not cleared */
+- spin_unlock_irqrestore(&f->lock, flags);
++ spin_unlock_irq(&f->lock);
+
+ /* close the old pool and wait until all users are gone */
+ snd_seq_pool_mark_closing(oldpool);
+--- a/sound/core/seq/seq_memory.c
++++ b/sound/core/seq/seq_memory.c
+@@ -386,7 +386,6 @@ int snd_seq_pool_init(struct snd_seq_poo
+ {
+ int cell;
+ struct snd_seq_event_cell *cellptr;
+- unsigned long flags;
+
+ if (snd_BUG_ON(!pool))
+ return -EINVAL;
+@@ -396,9 +395,9 @@ int snd_seq_pool_init(struct snd_seq_poo
+ return -ENOMEM;
+
+ /* add new cells to the free cell list */
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ if (pool->ptr) {
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+ vfree(cellptr);
+ return 0;
+ }
+@@ -417,7 +416,7 @@ int snd_seq_pool_init(struct snd_seq_poo
+ /* init statistics */
+ pool->max_used = 0;
+ pool->total_elements = pool->size;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+ return 0;
+ }
+
+@@ -436,7 +435,6 @@ void snd_seq_pool_mark_closing(struct sn
+ /* remove events */
+ int snd_seq_pool_done(struct snd_seq_pool *pool)
+ {
+- unsigned long flags;
+ struct snd_seq_event_cell *ptr;
+
+ if (snd_BUG_ON(!pool))
+@@ -450,18 +448,18 @@ int snd_seq_pool_done(struct snd_seq_poo
+ schedule_timeout_uninterruptible(1);
+
+ /* release all resources */
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ ptr = pool->ptr;
+ pool->ptr = NULL;
+ pool->free = NULL;
+ pool->total_elements = 0;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+
+ vfree(ptr);
+
+- spin_lock_irqsave(&pool->lock, flags);
++ spin_lock_irq(&pool->lock);
+ pool->closing = 0;
+- spin_unlock_irqrestore(&pool->lock, flags);
++ spin_unlock_irq(&pool->lock);
+
+ return 0;
+ }
+--- a/sound/core/seq/seq_ports.c
++++ b/sound/core/seq/seq_ports.c
+@@ -128,7 +128,6 @@ static void port_subs_info_init(struct s
+ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
+ int port)
+ {
+- unsigned long flags;
+ struct snd_seq_client_port *new_port, *p;
+ int num = -1;
+
+@@ -157,7 +156,7 @@ struct snd_seq_client_port *snd_seq_crea
+
+ num = port >= 0 ? port : 0;
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ list_for_each_entry(p, &client->ports_list_head, list) {
+ if (p->addr.port > num)
+ break;
+@@ -169,7 +168,7 @@ struct snd_seq_client_port *snd_seq_crea
+ client->num_ports++;
+ new_port->addr.port = num; /* store the port number in the port */
+ sprintf(new_port->name, "port-%d", num);
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+ mutex_unlock(&client->ports_mutex);
+
+ return new_port;
+@@ -283,11 +282,10 @@ static int port_delete(struct snd_seq_cl
+ /* delete a port with the given port id */
+ int snd_seq_delete_port(struct snd_seq_client *client, int port)
+ {
+- unsigned long flags;
+ struct snd_seq_client_port *found = NULL, *p;
+
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ list_for_each_entry(p, &client->ports_list_head, list) {
+ if (p->addr.port == port) {
+ /* ok found. delete from the list at first */
+@@ -297,7 +295,7 @@ int snd_seq_delete_port(struct snd_seq_c
+ break;
+ }
+ }
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+ mutex_unlock(&client->ports_mutex);
+ if (found)
+ return port_delete(client, found);
+@@ -308,7 +306,6 @@ int snd_seq_delete_port(struct snd_seq_c
+ /* delete the all ports belonging to the given client */
+ int snd_seq_delete_all_ports(struct snd_seq_client *client)
+ {
+- unsigned long flags;
+ struct list_head deleted_list;
+ struct snd_seq_client_port *port, *tmp;
+
+@@ -316,7 +313,7 @@ int snd_seq_delete_all_ports(struct snd_
+ * clear the port list in the client data.
+ */
+ mutex_lock(&client->ports_mutex);
+- write_lock_irqsave(&client->ports_lock, flags);
++ write_lock_irq(&client->ports_lock);
+ if (! list_empty(&client->ports_list_head)) {
+ list_add(&deleted_list, &client->ports_list_head);
+ list_del_init(&client->ports_list_head);
+@@ -324,7 +321,7 @@ int snd_seq_delete_all_ports(struct snd_
+ INIT_LIST_HEAD(&deleted_list);
+ }
+ client->num_ports = 0;
+- write_unlock_irqrestore(&client->ports_lock, flags);
++ write_unlock_irq(&client->ports_lock);
+
+ /* remove each port in deleted_list */
+ list_for_each_entry_safe(port, tmp, &deleted_list, list) {
diff --git a/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch b/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch
new file mode 100644
index 0000000000..1463d8facb
--- /dev/null
+++ b/patches.drivers/ALSA-seq-Simplify-snd_seq_kernel_client_enqueue-help.patch
@@ -0,0 +1,141 @@
+From 6740ea6776e97274627e3c261469d1c4ba0a0cb5 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 12 Apr 2019 12:10:14 +0200
+Subject: [PATCH] ALSA: seq: Simplify snd_seq_kernel_client_enqueue() helper
+Git-commit: 6740ea6776e97274627e3c261469d1c4ba0a0cb5
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We have two helpers for queuing a sequencer event from the kernel
+client, and both are used only from OSS sequencer layer without any
+hop and atomic set. Let's simplify and unify two helpers into one.
+
+No functional change, just a call pattern change.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/seq_kernel.h | 3 +-
+ sound/core/seq/oss/seq_oss_rw.c | 11 +++-------
+ sound/core/seq/oss/seq_oss_writeq.c | 2 -
+ sound/core/seq/seq_clientmgr.c | 37 ++++++------------------------------
+ sound/core/seq/seq_clientmgr.h | 4 ---
+ 5 files changed, 14 insertions(+), 43 deletions(-)
+
+--- a/include/sound/seq_kernel.h
++++ b/include/sound/seq_kernel.h
+@@ -73,7 +73,8 @@ __printf(3, 4)
+ int snd_seq_create_kernel_client(struct snd_card *card, int client_index,
+ const char *name_fmt, ...);
+ int snd_seq_delete_kernel_client(int client);
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, int atomic, int hop);
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ struct file *file, bool blocking);
+ int snd_seq_kernel_client_dispatch(int client, struct snd_seq_event *ev, int atomic, int hop);
+ int snd_seq_kernel_client_ctl(int client, unsigned int cmd, void *arg);
+
+--- a/sound/core/seq/oss/seq_oss_rw.c
++++ b/sound/core/seq/oss/seq_oss_rw.c
+@@ -180,14 +180,11 @@ insert_queue(struct seq_oss_devinfo *dp,
+ return 0; /* invalid event - no need to insert queue */
+
+ event.time.tick = snd_seq_oss_timer_cur_tick(dp->timer);
+- if (dp->timer->realtime || !dp->timer->running) {
++ if (dp->timer->realtime || !dp->timer->running)
+ snd_seq_oss_dispatch(dp, &event, 0, 0);
+- } else {
+- if (is_nonblock_mode(dp->file_mode))
+- rc = snd_seq_kernel_client_enqueue(dp->cseq, &event, 0, 0);
+- else
+- rc = snd_seq_kernel_client_enqueue_blocking(dp->cseq, &event, opt, 0, 0);
+- }
++ else
++ rc = snd_seq_kernel_client_enqueue(dp->cseq, &event, opt,
++ !is_nonblock_mode(dp->file_mode));
+ return rc;
+ }
+
+--- a/sound/core/seq/oss/seq_oss_writeq.c
++++ b/sound/core/seq/oss/seq_oss_writeq.c
+@@ -116,7 +116,7 @@ snd_seq_oss_writeq_sync(struct seq_oss_w
+ rec->t.code = SEQ_SYNCTIMER;
+ rec->t.time = time;
+ q->sync_event_put = 1;
+- snd_seq_kernel_client_enqueue_blocking(dp->cseq, &ev, NULL, 0, 0);
++ snd_seq_kernel_client_enqueue(dp->cseq, &ev, NULL, true);
+ }
+
+ wait_event_interruptible_timeout(q->sync_sleep, ! q->sync_event_put, HZ);
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2225,12 +2225,13 @@ int snd_seq_delete_kernel_client(int cli
+ }
+ EXPORT_SYMBOL(snd_seq_delete_kernel_client);
+
+-/* skeleton to enqueue event, called from snd_seq_kernel_client_enqueue
+- * and snd_seq_kernel_client_enqueue_blocking
++/*
++ * exported, called by kernel clients to enqueue events (w/o blocking)
++ *
++ * RETURN VALUE: zero if succeed, negative if error
+ */
+-static int kernel_client_enqueue(int client, struct snd_seq_event *ev,
+- struct file *file, int blocking,
+- int atomic, int hop)
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ struct file *file, bool blocking)
+ {
+ struct snd_seq_client *cptr;
+ int result;
+@@ -2250,37 +2251,13 @@ static int kernel_client_enqueue(int cli
+ result = -EPERM;
+ else /* send it */
+ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+- atomic, hop, NULL);
++ false, 0, NULL);
+
+ snd_seq_client_unlock(cptr);
+ return result;
+ }
+-
+-/*
+- * exported, called by kernel clients to enqueue events (w/o blocking)
+- *
+- * RETURN VALUE: zero if succeed, negative if error
+- */
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event * ev,
+- int atomic, int hop)
+-{
+- return kernel_client_enqueue(client, ev, NULL, 0, atomic, hop);
+-}
+ EXPORT_SYMBOL(snd_seq_kernel_client_enqueue);
+
+-/*
+- * exported, called by kernel clients to enqueue events (with blocking)
+- *
+- * RETURN VALUE: zero if succeed, negative if error
+- */
+-int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event * ev,
+- struct file *file,
+- int atomic, int hop)
+-{
+- return kernel_client_enqueue(client, ev, file, 1, atomic, hop);
+-}
+-EXPORT_SYMBOL(snd_seq_kernel_client_enqueue_blocking);
+-
+ /*
+ * exported, called by kernel clients to dispatch events directly to other
+ * clients, bypassing the queues. Event time-stamp will be updated.
+--- a/sound/core/seq/seq_clientmgr.h
++++ b/sound/core/seq/seq_clientmgr.h
+@@ -93,10 +93,6 @@ struct snd_seq_client *snd_seq_client_us
+ /* dispatch event to client(s) */
+ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop);
+
+-/* exported to other modules */
+-int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev, int atomic, int hop);
+-int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event * ev,
+- struct file *file, int atomic, int hop);
+ int snd_seq_kernel_client_write_poll(int clientid, struct file *file, poll_table *wait);
+ int snd_seq_client_notify_subscription(int client, int port,
+ struct snd_seq_port_subscribe *info, int evtype);
diff --git a/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch b/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch
new file mode 100644
index 0000000000..1f10ef4c39
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Check-ack_list-emptiness-instead-of-bit-f.patch
@@ -0,0 +1,75 @@
+From a7588c896b05444929ecb3d0115481988720abf6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:56:08 +0100
+Subject: [PATCH] ALSA: timer: Check ack_list emptiness instead of bit flag
+Git-commit: a7588c896b05444929ecb3d0115481988720abf6
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+For checking the pending timer instance that is still left on the
+timer object that is being closed, we set/clear a bit flag
+SNDRV_TIMER_IFLG_CALLBACK around the call of callbacks. This can be
+simplified by replace with the list_empty() call for ti->ack_list.
+This covers the existence more comprehensively and safely.
+
+A gratis bonus is that we can get rid of SNDRV_TIMER_IFLG_CALLBACK bit
+flag definition as well.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/timer.h | 1 -
+ sound/core/timer.c | 10 ++++------
+ 2 files changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/include/sound/timer.h b/include/sound/timer.h
+index 7ae226ab6990..bcfee20ea226 100644
+--- a/include/sound/timer.h
++++ b/include/sound/timer.h
+@@ -43,7 +43,6 @@
+ #define SNDRV_TIMER_IFLG_START 0x00000004
+ #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */
+ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */
+-#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */
+ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */
+ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 107d8ebeeb2e..e343de0e4f9e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -366,7 +366,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+ spin_lock_irq(&timer->lock);
+- while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
++ while (!list_empty(&timeri->ack_list)) {
+ spin_unlock_irq(&timer->lock);
+ udelay(10);
+ spin_lock_irq(&timer->lock);
+@@ -731,19 +731,17 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
+- /* remove from ack_list and make empty */
+- list_del_init(&ti->ack_list);
+-
+ ticks = ti->pticks;
+ ti->pticks = 0;
+ resolution = ti->resolution;
+
+- ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+ spin_unlock(&timer->lock);
+ if (ti->callback)
+ ti->callback(ti, resolution, ticks);
+ spin_lock(&timer->lock);
+- ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
++
++ /* remove from ack_list and make empty */
++ list_del_init(&ti->ack_list);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Coding-style-fixes.patch b/patches.drivers/ALSA-timer-Coding-style-fixes.patch
new file mode 100644
index 0000000000..8d5ed3d0f3
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Coding-style-fixes.patch
@@ -0,0 +1,71 @@
+From 5d704b0d3b4855734f029337e516b829c473801c Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 17:44:53 +0100
+Subject: [PATCH] ALSA: timer: Coding style fixes
+Git-commit: 5d704b0d3b4855734f029337e516b829c473801c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Avoid old school C style but do plain and clear way.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 0eed4fe0da21..d23efec35660 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1909,7 +1909,10 @@ static int snd_timer_user_start(struct file *file)
+ snd_timer_stop(tu->timeri);
+ tu->timeri->lost = 0;
+ tu->last_resolution = 0;
+- return (err = snd_timer_start(tu->timeri, tu->ticks)) < 0 ? err : 0;
++ err = snd_timer_start(tu->timeri, tu->ticks);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_stop(struct file *file)
+@@ -1920,7 +1923,10 @@ static int snd_timer_user_stop(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
+- return (err = snd_timer_stop(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_stop(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_continue(struct file *file)
+@@ -1935,7 +1941,10 @@ static int snd_timer_user_continue(struct file *file)
+ if (!(tu->timeri->flags & SNDRV_TIMER_IFLG_PAUSED))
+ return snd_timer_user_start(file);
+ tu->timeri->lost = 0;
+- return (err = snd_timer_continue(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_continue(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ static int snd_timer_user_pause(struct file *file)
+@@ -1946,7 +1955,10 @@ static int snd_timer_user_pause(struct file *file)
+ tu = file->private_data;
+ if (!tu->timeri)
+ return -EBADFD;
+- return (err = snd_timer_pause(tu->timeri)) < 0 ? err : 0;
++ err = snd_timer_pause(tu->timeri);
++ if (err < 0)
++ return err;
++ return 0;
+ }
+
+ enum {
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch b/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch
new file mode 100644
index 0000000000..b0431af7c3
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Make-snd_timer_close-really-kill-pending-.patch
@@ -0,0 +1,148 @@
+From fe1b26c93d430400ac37d820425e2468218ae8b2 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 17:02:40 +0100
+Subject: [PATCH] ALSA: timer: Make snd_timer_close() really kill pending actions
+Git-commit: fe1b26c93d430400ac37d820425e2468218ae8b2
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+snd_timer_close() is supposed to close the timer instance and sync
+with the deactivation of pending actions. However, there are still
+some overlooked cases:
+
+- It calls snd_timer_stop() at the beginning, but some other might
+ re-trigger the timer right after that.
+
+- snd_timer_stop() calls del_timer_sync() only when all belonging
+ instances are closed. If multiple instances were assigned to a
+ timer object and one is closed, the timer is still running. Then
+ the pending action assigned to this timer might be left.
+
+Actually either of the above is the likely cause of the reported
+syzkaller UAF.
+
+This patch plug these holes by introducing SNDRV_TIMER_IFLG_DEAD
+flag. This is set at the beginning of snd_timer_close(), and the flag
+is checked at snd_timer_start*() and else, so that no longer new
+action is left after snd_timer_close().
+
+Reported-by: syzbot+d5136d4d3240cbe45a2a@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 45 +++++++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 12 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index e343de0e4f9e..bb7e90ab90f8 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -38,6 +38,7 @@
+
+ /* internal flags */
+ #define SNDRV_TIMER_IFLG_PAUSED 0x00010000
++#define SNDRV_TIMER_IFLG_DEAD 0x00020000
+
+ #if IS_ENABLED(CONFIG_SND_HRTIMER)
+ #define DEFAULT_TIMER_LIMIT 4
+@@ -353,15 +354,20 @@ EXPORT_SYMBOL(snd_timer_open);
+ */
+ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ {
+- struct snd_timer *timer = NULL;
++ struct snd_timer *timer = timeri->timer;
+ struct snd_timer_instance *slave, *tmp;
+
++ if (timer) {
++ spin_lock_irq(&timer->lock);
++ timeri->flags |= SNDRV_TIMER_IFLG_DEAD;
++ spin_unlock_irq(&timer->lock);
++ }
++
+ list_del(&timeri->open_list);
+
+ /* force to stop the timer */
+ snd_timer_stop(timeri);
+
+- timer = timeri->timer;
+ if (timer) {
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+@@ -497,6 +503,10 @@ static int snd_timer_start1(struct snd_timer_instance *timeri,
+ return -EINVAL;
+
+ spin_lock_irqsave(&timer->lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD) {
++ result = -EINVAL;
++ goto unlock;
++ }
+ if (timer->card && timer->card->shutdown) {
+ result = -ENODEV;
+ goto unlock;
+@@ -541,11 +551,16 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri,
+ bool start)
+ {
+ unsigned long flags;
++ int err;
+
+ spin_lock_irqsave(&slave_active_lock, flags);
++ if (timeri->flags & SNDRV_TIMER_IFLG_DEAD) {
++ err = -EINVAL;
++ goto unlock;
++ }
+ if (timeri->flags & SNDRV_TIMER_IFLG_RUNNING) {
+- spin_unlock_irqrestore(&slave_active_lock, flags);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
+ if (timeri->master && timeri->timer) {
+@@ -556,8 +571,10 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri,
+ SNDRV_TIMER_EVENT_CONTINUE);
+ spin_unlock(&timeri->timer->lock);
+ }
++ err = 1; /* delayed start */
++ unlock:
+ spin_unlock_irqrestore(&slave_active_lock, flags);
+- return 1; /* delayed start */
++ return err;
+ }
+
+ /* stop/pause a master timer */
+@@ -731,14 +748,16 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
+- ticks = ti->pticks;
+- ti->pticks = 0;
+- resolution = ti->resolution;
++ if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) {
++ ticks = ti->pticks;
++ ti->pticks = 0;
++ resolution = ti->resolution;
+
+- spin_unlock(&timer->lock);
+- if (ti->callback)
+- ti->callback(ti, resolution, ticks);
+- spin_lock(&timer->lock);
++ spin_unlock(&timer->lock);
++ if (ti->callback)
++ ti->callback(ti, resolution, ticks);
++ spin_lock(&timer->lock);
++ }
+
+ /* remove from ack_list and make empty */
+ list_del_init(&ti->ack_list);
+@@ -810,6 +829,8 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ */
+ list_for_each_entry_safe(ti, tmp, &timer->active_list_head,
+ active_list) {
++ if (ti->flags & SNDRV_TIMER_IFLG_DEAD)
++ continue;
+ if (!(ti->flags & SNDRV_TIMER_IFLG_RUNNING))
+ continue;
+ ti->pticks += ticks_left;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch b/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch
new file mode 100644
index 0000000000..4b25eac9fb
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Make-sure-to-clear-pending-ack-list.patch
@@ -0,0 +1,70 @@
+From 7bb4a8a2cc9382da720b46988bc976ebccaa49fd Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:51:58 +0100
+Subject: [PATCH] ALSA: timer: Make sure to clear pending ack list
+Git-commit: 7bb4a8a2cc9382da720b46988bc976ebccaa49fd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+When a card is under disconnection, we bail out immediately at each
+timer interrupt or tasklet. This might leave some items left in ack
+list. For a better integration of the upcoming change to check
+ack_list emptiness, clear out the whole list upon the emergency exit
+route.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 20 ++++++++++++++++++--
+ 1 file changed, 18 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index fdcddfb756b4..107d8ebeeb2e 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -747,6 +747,18 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ }
+ }
+
++/* clear pending instances from ack list */
++static void snd_timer_clear_callbacks(struct snd_timer *timer,
++ struct list_head *head)
++{
++ unsigned long flags;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ while (!list_empty(head))
++ list_del_init(head->next);
++ spin_unlock_irqrestore(&timer->lock, flags);
++}
++
+ /*
+ * timer tasklet
+ *
+@@ -756,8 +768,10 @@ static void snd_timer_tasklet(unsigned long arg)
+ struct snd_timer *timer = (struct snd_timer *) arg;
+ unsigned long flags;
+
+- if (timer->card && timer->card->shutdown)
++ if (timer->card && timer->card->shutdown) {
++ snd_timer_clear_callbacks(timer, &timer->sack_list_head);
+ return;
++ }
+
+ spin_lock_irqsave(&timer->lock, flags);
+ snd_timer_process_callbacks(timer, &timer->sack_list_head);
+@@ -781,8 +795,10 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ if (timer == NULL)
+ return;
+
+- if (timer->card && timer->card->shutdown)
++ if (timer->card && timer->card->shutdown) {
++ snd_timer_clear_callbacks(timer, &timer->ack_list_head);
+ return;
++ }
+
+ spin_lock_irqsave(&timer->lock, flags);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch b/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch
new file mode 100644
index 0000000000..e777a63511
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Revert-active-callback-sync-check-at-clos.patch
@@ -0,0 +1,80 @@
+From df55531b8b0eea9d2473f5697ae4f38d0df6bec7 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 9 Apr 2019 12:25:32 +0200
+Subject: [PATCH] ALSA: timer: Revert active callback sync check at close
+Git-commit: df55531b8b0eea9d2473f5697ae4f38d0df6bec7
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This is essentially a revert of the commit a7588c896b05 ("ALSA: timer:
+Check ack_list emptiness instead of bit flag"). The intended change
+by the commit turns out to be insufficient, as snd_timer_close*()
+always calls snd_timer_stop() that deletes the ack_list beforehand.
+
+In theory, we can change the behavior of snd_timer_stop() to sync the
+pending ack_list, but this will become a deadlock for the callback
+like sequencer that calls again snd_timer_stop() from itself. So,
+reverting the change is a more straightforward solution.
+
+Fixes: a7588c896b05 ("ALSA: timer: Check ack_list emptiness instead of bit flag")
+Reported-by: syzbot+58813d77154713f4de15@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/timer.h | 1 +
+ sound/core/timer.c | 11 ++++++-----
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/include/sound/timer.h b/include/sound/timer.h
+index bcfee20ea226..7ae226ab6990 100644
+--- a/include/sound/timer.h
++++ b/include/sound/timer.h
+@@ -43,6 +43,7 @@
+ #define SNDRV_TIMER_IFLG_START 0x00000004
+ #define SNDRV_TIMER_IFLG_AUTO 0x00000008 /* auto restart */
+ #define SNDRV_TIMER_IFLG_FAST 0x00000010 /* fast callback (do not use tasklet) */
++#define SNDRV_TIMER_IFLG_CALLBACK 0x00000020 /* timer callback is active */
+ #define SNDRV_TIMER_IFLG_EXCLUSIVE 0x00000040 /* exclusive owner - no more instances */
+ #define SNDRV_TIMER_IFLG_EARLY_EVENT 0x00000080 /* write early event to the poll queue */
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index bb7e90ab90f8..df52d2960179 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -372,7 +372,7 @@ static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+ timer->num_instances--;
+ /* wait, until the active callback is finished */
+ spin_lock_irq(&timer->lock);
+- while (!list_empty(&timeri->ack_list)) {
++ while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
+ spin_unlock_irq(&timer->lock);
+ udelay(10);
+ spin_lock_irq(&timer->lock);
+@@ -748,19 +748,20 @@ static void snd_timer_process_callbacks(struct snd_timer *timer,
+ ti = list_first_entry(head, struct snd_timer_instance,
+ ack_list);
+
++ /* remove from ack_list and make empty */
++ list_del_init(&ti->ack_list);
++
+ if (!(ti->flags & SNDRV_TIMER_IFLG_DEAD)) {
+ ticks = ti->pticks;
+ ti->pticks = 0;
+ resolution = ti->resolution;
+-
++ ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+ spin_unlock(&timer->lock);
+ if (ti->callback)
+ ti->callback(ti, resolution, ticks);
+ spin_lock(&timer->lock);
++ ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+ }
+-
+- /* remove from ack_list and make empty */
+- list_del_init(&ti->ack_list);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch b/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch
new file mode 100644
index 0000000000..cb39b66622
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Simplify-error-path-in-snd_timer_open.patch
@@ -0,0 +1,129 @@
+From 41672c0c24a62699d20aab53b98d843b16483053 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 28 Mar 2019 17:11:10 +0100
+Subject: [PATCH] ALSA: timer: Simplify error path in snd_timer_open()
+Git-commit: 41672c0c24a62699d20aab53b98d843b16483053
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Just a minor refactoring to use the standard goto for error paths in
+snd_timer_open() instead of open code. The first mutex_lock() is
+moved to the beginning of the function to make the code clearer.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 39 ++++++++++++++++++++-------------------
+ 1 file changed, 20 insertions(+), 19 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index df52d2960179..0eed4fe0da21 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -255,19 +255,20 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ struct snd_timer_instance *timeri = NULL;
+ int err;
+
++ mutex_lock(&register_mutex);
+ if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
+ /* open a slave instance */
+ if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE ||
+ tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) {
+ pr_debug("ALSA: timer: invalid slave class %i\n",
+ tid->dev_sclass);
+- return -EINVAL;
++ err = -EINVAL;
++ goto unlock;
+ }
+- mutex_lock(&register_mutex);
+ timeri = snd_timer_instance_new(owner, NULL);
+ if (!timeri) {
+- mutex_unlock(&register_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ timeri->slave_class = tid->dev_sclass;
+ timeri->slave_id = tid->device;
+@@ -278,13 +279,10 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ snd_timer_close_locked(timeri);
+ timeri = NULL;
+ }
+- mutex_unlock(&register_mutex);
+- *ti = timeri;
+- return err;
++ goto unlock;
+ }
+
+ /* open a master instance */
+- mutex_lock(&register_mutex);
+ timer = snd_timer_find(tid);
+ #ifdef CONFIG_MODULES
+ if (!timer) {
+@@ -295,25 +293,26 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ }
+ #endif
+ if (!timer) {
+- mutex_unlock(&register_mutex);
+- return -ENODEV;
++ err = -ENODEV;
++ goto unlock;
+ }
+ if (!list_empty(&timer->open_list_head)) {
+ timeri = list_entry(timer->open_list_head.next,
+ struct snd_timer_instance, open_list);
+ if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+- mutex_unlock(&register_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ timeri = NULL;
++ goto unlock;
+ }
+ }
+ if (timer->num_instances >= timer->max_instances) {
+- mutex_unlock(&register_mutex);
+- return -EBUSY;
++ err = -EBUSY;
++ goto unlock;
+ }
+ timeri = snd_timer_instance_new(owner, timer);
+ if (!timeri) {
+- mutex_unlock(&register_mutex);
+- return -ENOMEM;
++ err = -ENOMEM;
++ goto unlock;
+ }
+ /* take a card refcount for safe disconnection */
+ if (timer->card)
+@@ -322,16 +321,16 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ timeri->slave_id = slave_id;
+
+ if (list_empty(&timer->open_list_head) && timer->hw.open) {
+- int err = timer->hw.open(timer);
++ err = timer->hw.open(timer);
+ if (err) {
+ kfree(timeri->owner);
+ kfree(timeri);
++ timeri = NULL;
+
+ if (timer->card)
+ put_device(&timer->card->card_dev);
+ module_put(timer->module);
+- mutex_unlock(&register_mutex);
+- return err;
++ goto unlock;
+ }
+ }
+
+@@ -342,6 +341,8 @@ int snd_timer_open(struct snd_timer_instance **ti,
+ snd_timer_close_locked(timeri);
+ timeri = NULL;
+ }
++
++ unlock:
+ mutex_unlock(&register_mutex);
+ *ti = timeri;
+ return err;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch b/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch
new file mode 100644
index 0000000000..4520626121
--- /dev/null
+++ b/patches.drivers/ALSA-timer-Unify-timer-callback-process-code.patch
@@ -0,0 +1,125 @@
+From 8748b850beccdbc87aa8776d63abd6b5628720c8 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 27 Mar 2019 16:42:51 +0100
+Subject: [PATCH] ALSA: timer: Unify timer callback process code
+Git-commit: 8748b850beccdbc87aa8776d63abd6b5628720c8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The timer core has two almost identical code for processing callbacks:
+once in snd_timer_interrupt() for fast callbacks and another in
+snd_timer_tasklet() for delayed callbacks. Let's unify them.
+
+In the new version, the resolution is read from ti->resolution at each
+call, and this must be fine; ti->resolution is set in the preparation
+step in snd_timer_interrupt().
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/timer.c | 62 +++++++++++++++++++++++-------------------------------
+ 1 file changed, 26 insertions(+), 36 deletions(-)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 61a0cec6e1f6..fdcddfb756b4 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -720,29 +720,19 @@ static void snd_timer_reschedule(struct snd_timer * timer, unsigned long ticks_l
+ timer->sticks = ticks;
+ }
+
+-/*
+- * timer tasklet
+- *
+- */
+-static void snd_timer_tasklet(unsigned long arg)
++/* call callbacks in timer ack list */
++static void snd_timer_process_callbacks(struct snd_timer *timer,
++ struct list_head *head)
+ {
+- struct snd_timer *timer = (struct snd_timer *) arg;
+ struct snd_timer_instance *ti;
+- struct list_head *p;
+ unsigned long resolution, ticks;
+- unsigned long flags;
+
+- if (timer->card && timer->card->shutdown)
+- return;
+-
+- spin_lock_irqsave(&timer->lock, flags);
+- /* now process all callbacks */
+- while (!list_empty(&timer->sack_list_head)) {
+- p = timer->sack_list_head.next; /* get first item */
+- ti = list_entry(p, struct snd_timer_instance, ack_list);
++ while (!list_empty(head)) {
++ ti = list_first_entry(head, struct snd_timer_instance,
++ ack_list);
+
+ /* remove from ack_list and make empty */
+- list_del_init(p);
++ list_del_init(&ti->ack_list);
+
+ ticks = ti->pticks;
+ ti->pticks = 0;
+@@ -755,6 +745,22 @@ static void snd_timer_tasklet(unsigned long arg)
+ spin_lock(&timer->lock);
+ ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+ }
++}
++
++/*
++ * timer tasklet
++ *
++ */
++static void snd_timer_tasklet(unsigned long arg)
++{
++ struct snd_timer *timer = (struct snd_timer *) arg;
++ unsigned long flags;
++
++ if (timer->card && timer->card->shutdown)
++ return;
++
++ spin_lock_irqsave(&timer->lock, flags);
++ snd_timer_process_callbacks(timer, &timer->sack_list_head);
+ spin_unlock_irqrestore(&timer->lock, flags);
+ }
+
+@@ -767,8 +773,8 @@ static void snd_timer_tasklet(unsigned long arg)
+ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ {
+ struct snd_timer_instance *ti, *ts, *tmp;
+- unsigned long resolution, ticks;
+- struct list_head *p, *ack_list_head;
++ unsigned long resolution;
++ struct list_head *ack_list_head;
+ unsigned long flags;
+ int use_tasklet = 0;
+
+@@ -839,23 +845,7 @@ void snd_timer_interrupt(struct snd_timer * timer, unsigned long ticks_left)
+ }
+
+ /* now process all fast callbacks */
+- while (!list_empty(&timer->ack_list_head)) {
+- p = timer->ack_list_head.next; /* get first item */
+- ti = list_entry(p, struct snd_timer_instance, ack_list);
+-
+- /* remove from ack_list and make empty */
+- list_del_init(p);
+-
+- ticks = ti->pticks;
+- ti->pticks = 0;
+-
+- ti->flags |= SNDRV_TIMER_IFLG_CALLBACK;
+- spin_unlock(&timer->lock);
+- if (ti->callback)
+- ti->callback(ti, resolution, ticks);
+- spin_lock(&timer->lock);
+- ti->flags &= ~SNDRV_TIMER_IFLG_CALLBACK;
+- }
++ snd_timer_process_callbacks(timer, &timer->ack_list_head);
+
+ /* do we have any slow callbacks? */
+ use_tasklet = !list_empty(&timer->sack_list_head);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch b/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch
new file mode 100644
index 0000000000..fc07a4c050
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-a-memory-leak-bug.patch
@@ -0,0 +1,43 @@
+From cb5173594d50c72b7bfa14113dfc5084b4d2f726 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Sat, 27 Apr 2019 01:06:46 -0500
+Subject: [PATCH] ALSA: usb-audio: Fix a memory leak bug
+Git-commit: cb5173594d50c72b7bfa14113dfc5084b4d2f726
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In parse_audio_selector_unit(), the string array 'namelist' is allocated
+through kmalloc_array(), and each string pointer in this array, i.e.,
+'namelist[]', is allocated through kmalloc() in the following for loop.
+Then, a control instance 'kctl' is created by invoking snd_ctl_new1(). If
+an error occurs during the creation process, the string array 'namelist',
+including all string pointers in the array 'namelist[]', should be freed,
+before the error code ENOMEM is returned. However, the current code does
+not free 'namelist[]', resulting in memory leaks.
+
+To fix the above issue, free all string pointers 'namelist[]' in a loop.
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index c095d9751924..e003b5e7b01a 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2675,6 +2675,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid,
+ kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
+ if (! kctl) {
+ usb_audio_err(state->chip, "cannot malloc kcontrol\n");
++ for (i = 0; i < desc->bNrInPins; i++)
++ kfree(namelist[i]);
+ kfree(namelist);
+ kfree(cval);
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch b/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch
new file mode 100644
index 0000000000..4c98cb5ba8
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Handle-the-error-from-snd_usb_mixer_a.patch
@@ -0,0 +1,37 @@
+From 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 24 Apr 2019 13:00:03 +0200
+Subject: [PATCH] ALSA: usb-audio: Handle the error from snd_usb_mixer_apply_create_quirk()
+Git-commit: 328e9f6973be2ee67862cb17bf6c0c5c5918cd72
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The error from snd_usb_mixer_apply_create_quirk() is ignored in the
+current usb-audio driver code, which will continue the probing even
+after the error. Let's take it more serious.
+
+Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 73d7dff425c1..c095d9751924 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -3490,7 +3490,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
+ if (err < 0)
+ goto _error;
+
+- snd_usb_mixer_apply_create_quirk(mixer);
++ err = snd_usb_mixer_apply_create_quirk(mixer);
++ if (err < 0)
++ goto _error;
+
+ err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
+ if (err < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch b/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch
new file mode 100644
index 0000000000..314b39fb2f
--- /dev/null
+++ b/patches.drivers/ALSA-usx2y-fix-a-double-free-bug.patch
@@ -0,0 +1,44 @@
+From cbb88db76a1536e02e93e5bd37ebbfbb6c4043a9 Mon Sep 17 00:00:00 2001
+From: Wenwen Wang <wang6495@umn.edu>
+Date: Mon, 29 Apr 2019 12:45:40 -0500
+Subject: [PATCH] ALSA: usx2y: fix a double free bug
+Git-commit: cbb88db76a1536e02e93e5bd37ebbfbb6c4043a9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In usX2Y_In04_init(), a new urb is firstly created through usb_alloc_urb()
+and saved to 'usX2Y->In04urb'. Then, a buffer is allocated through
+kmalloc() and saved to 'usX2Y->In04Buf'. If the allocation of the buffer
+fails, the error code ENOMEM is returned after usb_free_urb(), which frees
+the created urb. However, the urb is actually freed at card->private_free
+callback, i.e., snd_usX2Y_card_private_free(). So the free operation here
+leads to a double free bug.
+
+To fix the above issue, simply remove usb_free_urb().
+
+Signed-off-by: Wenwen Wang <wang6495@umn.edu>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/usx2y/usbusx2y.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/sound/usb/usx2y/usbusx2y.c b/sound/usb/usx2y/usbusx2y.c
+index 9f7bbed2c0f0..e8687b3bd3c8 100644
+--- a/sound/usb/usx2y/usbusx2y.c
++++ b/sound/usb/usx2y/usbusx2y.c
+@@ -293,10 +293,8 @@ int usX2Y_In04_init(struct usX2Ydev *usX2Y)
+ if (! (usX2Y->In04urb = usb_alloc_urb(0, GFP_KERNEL)))
+ return -ENOMEM;
+
+- if (! (usX2Y->In04Buf = kmalloc(21, GFP_KERNEL))) {
+- usb_free_urb(usX2Y->In04urb);
++ if (! (usX2Y->In04Buf = kmalloc(21, GFP_KERNEL)))
+ return -ENOMEM;
+- }
+
+ init_waitqueue_head(&usX2Y->In04WaitQueue);
+ usb_fill_int_urb(usX2Y->In04urb, usX2Y->dev, usb_rcvintpipe(usX2Y->dev, 0x4),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch b/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch
new file mode 100644
index 0000000000..c16be9fb1c
--- /dev/null
+++ b/patches.drivers/ASoC-Intel-avoid-Oops-if-DMA-setup-fails.patch
@@ -0,0 +1,66 @@
+From 0efa3334d65b7f421ba12382dfa58f6ff5bf83c4 Mon Sep 17 00:00:00 2001
+From: Ross Zwisler <zwisler@chromium.org>
+Date: Mon, 29 Apr 2019 12:25:17 -0600
+Subject: [PATCH] ASoC: Intel: avoid Oops if DMA setup fails
+Git-commit: 0efa3334d65b7f421ba12382dfa58f6ff5bf83c4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Currently in sst_dsp_new() if we get an error return from sst_dma_new()
+we just print an error message and then still complete the function
+successfully. This means that we are trying to run without sst->dma
+properly set up, which will result in NULL pointer dereference when
+sst->dma is later used. This was happening for me in
+Sst_dsp_dma_get_channel():
+
+ struct sst_dma *dma = dsp->dma;
+ ...
+ dma->ch = dma_request_channel(mask, dma_chan_filter, dsp);
+
+This resulted in:
+
+ BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
+ IP: sst_dsp_dma_get_channel+0x4f/0x125 [snd_soc_sst_firmware]
+
+Fix this by adding proper error handling for the case where we fail to
+set up DMA.
+
+This change only affects Haswell and Broadwell systems. Baytrail
+systems explicilty opt-out of DMA via sst->pdata->resindex_dma_base
+being set to -1.
+
+Signed-off-by: Ross Zwisler <zwisler@google.com>
+Cc: stable@vger.kernel.org
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/intel/common/sst-firmware.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/intel/common/sst-firmware.c b/sound/soc/intel/common/sst-firmware.c
+index 1e067504b604..f830e59f93ea 100644
+--- a/sound/soc/intel/common/sst-firmware.c
++++ b/sound/soc/intel/common/sst-firmware.c
+@@ -1251,11 +1251,15 @@ struct sst_dsp *sst_dsp_new(struct device *dev,
+ goto irq_err;
+
+ err = sst_dma_new(sst);
+- if (err)
+- dev_warn(dev, "sst_dma_new failed %d\n", err);
++ if (err) {
++ dev_err(dev, "sst_dma_new failed %d\n", err);
++ goto dma_err;
++ }
+
+ return sst;
+
++dma_err:
++ free_irq(sst->irq, sst);
+ irq_err:
+ if (sst->ops->free)
+ sst->ops->free(sst);
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch b/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch
new file mode 100644
index 0000000000..7a5d6c171c
--- /dev/null
+++ b/patches.drivers/ASoC-RT5677-SPI-Disable-16Bit-SPI-Transfers.patch
@@ -0,0 +1,135 @@
+From a46eb523220e242affb9a6bc9bb8efc05f4f7459 Mon Sep 17 00:00:00 2001
+From: Curtis Malainey <cujomalainey@chromium.org>
+Date: Fri, 3 May 2019 12:32:14 -0700
+Subject: [PATCH] ASoC: RT5677-SPI: Disable 16Bit SPI Transfers
+Git-commit: a46eb523220e242affb9a6bc9bb8efc05f4f7459
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The current algorithm allows 3 types of transfers, 16bit, 32bit and
+burst. According to Realtek, 16bit transfers have a special restriction
+in that it is restricted to the memory region of
+0x18020000 ~ 0x18021000. This region is the memory location of the I2C
+registers. The current algorithm does not uphold this restriction and
+therefore fails to complete writes.
+
+Since this has been broken for some time it likely no one is using it.
+Better to simply disable the 16 bit writes. This will allow users to
+properly load firmware over SPI without data corruption.
+
+Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
+Reviewed-by: Ben Zhang <benzh@chromium.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/rt5677-spi.c | 35 ++++++++++++++++-------------------
+ 1 file changed, 16 insertions(+), 19 deletions(-)
+
+diff --git a/sound/soc/codecs/rt5677-spi.c b/sound/soc/codecs/rt5677-spi.c
+index 167a02773a0b..84b6bd8b50e1 100644
+--- a/sound/soc/codecs/rt5677-spi.c
++++ b/sound/soc/codecs/rt5677-spi.c
+@@ -58,13 +58,15 @@ static DEFINE_MUTEX(spi_mutex);
+ * RT5677_SPI_READ/WRITE_32: Transfer 4 bytes
+ * RT5677_SPI_READ/WRITE_BURST: Transfer any multiples of 8 bytes
+ *
+- * For example, reading 260 bytes at 0x60030002 uses the following commands:
+- * 0x60030002 RT5677_SPI_READ_16 2 bytes
++ * Note:
++ * 16 Bit writes and reads are restricted to the address range
++ * 0x18020000 ~ 0x18021000
++ *
++ * For example, reading 256 bytes at 0x60030004 uses the following commands:
+ * 0x60030004 RT5677_SPI_READ_32 4 bytes
+ * 0x60030008 RT5677_SPI_READ_BURST 240 bytes
+ * 0x600300F8 RT5677_SPI_READ_BURST 8 bytes
+ * 0x60030100 RT5677_SPI_READ_32 4 bytes
+- * 0x60030104 RT5677_SPI_READ_16 2 bytes
+ *
+ * Input:
+ * @read: true for read commands; false for write commands
+@@ -79,15 +81,13 @@ static u8 rt5677_spi_select_cmd(bool read, u32 align, u32 remain, u32 *len)
+ {
+ u8 cmd;
+
+- if (align == 2 || align == 6 || remain == 2) {
+- cmd = RT5677_SPI_READ_16;
+- *len = 2;
+- } else if (align == 4 || remain <= 6) {
++ if (align == 4 || remain <= 4) {
+ cmd = RT5677_SPI_READ_32;
+ *len = 4;
+ } else {
+ cmd = RT5677_SPI_READ_BURST;
+- *len = min_t(u32, remain & ~7, RT5677_SPI_BURST_LEN);
++ *len = (((remain - 1) >> 3) + 1) << 3;
++ *len = min_t(u32, *len, RT5677_SPI_BURST_LEN);
+ }
+ return read ? cmd : cmd + 1;
+ }
+@@ -108,7 +108,7 @@ static void rt5677_spi_reverse(u8 *dst, u32 dstlen, const u8 *src, u32 srclen)
+ }
+ }
+
+-/* Read DSP address space using SPI. addr and len have to be 2-byte aligned. */
++/* Read DSP address space using SPI. addr and len have to be 4-byte aligned. */
+ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ {
+ u32 offset;
+@@ -124,7 +124,7 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if ((addr & 1) || (len & 1)) {
++ if ((addr & 3) || (len & 3)) {
+ dev_err(&g_spi->dev, "Bad read align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+@@ -159,13 +159,13 @@ int rt5677_spi_read(u32 addr, void *rxbuf, size_t len)
+ }
+ EXPORT_SYMBOL_GPL(rt5677_spi_read);
+
+-/* Write DSP address space using SPI. addr has to be 2-byte aligned.
+- * If len is not 2-byte aligned, an extra byte of zero is written at the end
++/* Write DSP address space using SPI. addr has to be 4-byte aligned.
++ * If len is not 4-byte aligned, then extra zeros are written at the end
+ * as padding.
+ */
+ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ {
+- u32 offset, len_with_pad = len;
++ u32 offset;
+ int status = 0;
+ struct spi_transfer t;
+ struct spi_message m;
+@@ -178,22 +178,19 @@ int rt5677_spi_write(u32 addr, const void *txbuf, size_t len)
+ if (!g_spi)
+ return -ENODEV;
+
+- if (addr & 1) {
++ if (addr & 3) {
+ dev_err(&g_spi->dev, "Bad write align 0x%x(%zu)\n", addr, len);
+ return -EACCES;
+ }
+
+- if (len & 1)
+- len_with_pad = len + 1;
+-
+ memset(&t, 0, sizeof(t));
+ t.tx_buf = buf;
+ t.speed_hz = RT5677_SPI_FREQ;
+ spi_message_init_with_transfers(&m, &t, 1);
+
+- for (offset = 0; offset < len_with_pad;) {
++ for (offset = 0; offset < len;) {
+ spi_cmd = rt5677_spi_select_cmd(false, (addr + offset) & 7,
+- len_with_pad - offset, &t.len);
++ len - offset, &t.len);
+
+ /* Construct SPI message header */
+ buf[0] = spi_cmd;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch b/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch
new file mode 100644
index 0000000000..ce8a28c0b2
--- /dev/null
+++ b/patches.drivers/ASoC-cs4270-Set-auto-increment-bit-for-register-writ.patch
@@ -0,0 +1,39 @@
+From f0f2338a9cfaf71db895fa989ea7234e8a9b471d Mon Sep 17 00:00:00 2001
+From: Daniel Mack <daniel@zonque.org>
+Date: Wed, 20 Mar 2019 22:41:56 +0100
+Subject: [PATCH] ASoC: cs4270: Set auto-increment bit for register writes
+Git-commit: f0f2338a9cfaf71db895fa989ea7234e8a9b471d
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The CS4270 does not by default increment the register address on
+consecutive writes. During normal operation it doesn't matter as all
+register accesses are done individually. At resume time after suspend,
+however, the regcache code gathers the biggest possible block of
+registers to sync and sends them one on one go.
+
+To fix this, set the INCR bit in all cases.
+
+Signed-off-by: Daniel Mack <daniel@zonque.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/cs4270.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/soc/codecs/cs4270.c b/sound/soc/codecs/cs4270.c
+index 33d74f163bd7..793a14d58667 100644
+--- a/sound/soc/codecs/cs4270.c
++++ b/sound/soc/codecs/cs4270.c
+@@ -642,6 +642,7 @@ static const struct regmap_config cs4270_regmap = {
+ .reg_defaults = cs4270_reg_defaults,
+ .num_reg_defaults = ARRAY_SIZE(cs4270_reg_defaults),
+ .cache_type = REGCACHE_RBTREE,
++ .write_flag_mask = CS4270_I2C_INCR,
+
+ .readable_reg = cs4270_reg_is_readable,
+ .volatile_reg = cs4270_reg_is_volatile,
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-fix-valid-stream-condition.patch b/patches.drivers/ASoC-fix-valid-stream-condition.patch
new file mode 100644
index 0000000000..9894d2938c
--- /dev/null
+++ b/patches.drivers/ASoC-fix-valid-stream-condition.patch
@@ -0,0 +1,40 @@
+From 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Mon, 29 Apr 2019 11:47:49 +0200
+Subject: [PATCH] ASoC: fix valid stream condition
+Git-commit: 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+A stream may specify a rate range using 'rate_min' and 'rate_max', so a
+stream may be valid and not specify any rates. However, as stream cannot
+be valid and not have any channel. Let's use this condition instead to
+determine if a stream is valid or not.
+
+Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index d21247546f7f..57088bd69e5d 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -43,8 +43,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream)
+ else
+ codec_stream = &dai->driver->capture;
+
+- /* If the codec specifies any rate at all, it supports the stream. */
+- return codec_stream->rates;
++ /* If the codec specifies any channels at all, it supports the stream */
++ return codec_stream->channels_min;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch b/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch
new file mode 100644
index 0000000000..7cb42d7524
--- /dev/null
+++ b/patches.drivers/ASoC-fsl_esai-Fix-missing-break-in-switch-statement.patch
@@ -0,0 +1,32 @@
+From 903c220b1ece12f17c868e43f2243b8f81ff2d4c Mon Sep 17 00:00:00 2001
+From: "S.j. Wang" <shengjiu.wang@nxp.com>
+Date: Sun, 28 Apr 2019 02:24:27 +0000
+Subject: [PATCH] ASoC: fsl_esai: Fix missing break in switch statement
+Git-commit: 903c220b1ece12f17c868e43f2243b8f81ff2d4c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+case ESAI_HCKT_EXTAL and case ESAI_HCKR_EXTAL should be
+independent of each other, so replace fall-through with break.
+
+Fixes: 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/fsl/fsl_esai.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/fsl/fsl_esai.c
++++ b/sound/soc/fsl/fsl_esai.c
+@@ -249,6 +249,7 @@ static int fsl_esai_set_dai_sysclk(struc
+ break;
+ case ESAI_HCKT_EXTAL:
+ ecr |= ESAI_ECR_ETI;
++ break;
+ case ESAI_HCKR_EXTAL:
+ ecr |= ESAI_ECR_ERI;
+ break;
diff --git a/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch b/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch
new file mode 100644
index 0000000000..8980b2d8bb
--- /dev/null
+++ b/patches.drivers/ASoC-hdmi-codec-fix-S-PDIF-DAI.patch
@@ -0,0 +1,175 @@
+From 2e95f984aae4cf0608d0ba2189c756f2bd50b44a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 28 Feb 2019 15:30:34 +0000
+Subject: [PATCH] ASoC: hdmi-codec: fix S/PDIF DAI
+Git-commit: 2e95f984aae4cf0608d0ba2189c756f2bd50b44a
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+When using the S/PDIF DAI, there is no requirement to call
+snd_soc_dai_set_fmt() as there is no DAI format definition that defines
+S/PDIF. In any case, S/PDIF does not have separate clocks, this is
+embedded into the data stream.
+
+Consequently, when attempting to use TDA998x in S/PDIF mode, the attempt
+to configure TDA998x via the hw_params callback fails as the
+hdmi_codec_daifmt is left initialised to zero.
+
+Since the S/PDIF DAI will only be used by S/PDIF, prepare the
+hdmi_codec_daifmt structure for this format.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Jyri Sarha <jsarha@ti.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/hdmi-codec.c | 122 +++++++++++++++++++++---------------------
+ 1 file changed, 61 insertions(+), 61 deletions(-)
+
+--- a/sound/soc/codecs/hdmi-codec.c
++++ b/sound/soc/codecs/hdmi-codec.c
+@@ -549,73 +549,71 @@ static int hdmi_codec_set_fmt(struct snd
+ {
+ struct hdmi_codec_priv *hcp = snd_soc_dai_get_drvdata(dai);
+ struct hdmi_codec_daifmt cf = { 0 };
+- int ret = 0;
+
+ dev_dbg(dai->dev, "%s()\n", __func__);
+
+- if (dai->id == DAI_ID_SPDIF) {
+- cf.fmt = HDMI_SPDIF;
+- } else {
+- switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
+- case SND_SOC_DAIFMT_CBM_CFM:
+- cf.bit_clk_master = 1;
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFM:
+- cf.frame_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBM_CFS:
+- cf.bit_clk_master = 1;
+- break;
+- case SND_SOC_DAIFMT_CBS_CFS:
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
+- case SND_SOC_DAIFMT_NB_NF:
+- break;
+- case SND_SOC_DAIFMT_NB_IF:
+- cf.frame_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_NF:
+- cf.bit_clk_inv = 1;
+- break;
+- case SND_SOC_DAIFMT_IB_IF:
+- cf.frame_clk_inv = 1;
+- cf.bit_clk_inv = 1;
+- break;
+- }
+-
+- switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
+- case SND_SOC_DAIFMT_I2S:
+- cf.fmt = HDMI_I2S;
+- break;
+- case SND_SOC_DAIFMT_DSP_A:
+- cf.fmt = HDMI_DSP_A;
+- break;
+- case SND_SOC_DAIFMT_DSP_B:
+- cf.fmt = HDMI_DSP_B;
+- break;
+- case SND_SOC_DAIFMT_RIGHT_J:
+- cf.fmt = HDMI_RIGHT_J;
+- break;
+- case SND_SOC_DAIFMT_LEFT_J:
+- cf.fmt = HDMI_LEFT_J;
+- break;
+- case SND_SOC_DAIFMT_AC97:
+- cf.fmt = HDMI_AC97;
+- break;
+- default:
+- dev_err(dai->dev, "Invalid DAI interface format\n");
+- return -EINVAL;
+- }
++ if (dai->id == DAI_ID_SPDIF)
++ return 0;
++
++ switch (fmt & SND_SOC_DAIFMT_MASTER_MASK) {
++ case SND_SOC_DAIFMT_CBM_CFM:
++ cf.bit_clk_master = 1;
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFM:
++ cf.frame_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBM_CFS:
++ cf.bit_clk_master = 1;
++ break;
++ case SND_SOC_DAIFMT_CBS_CFS:
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ switch (fmt & SND_SOC_DAIFMT_INV_MASK) {
++ case SND_SOC_DAIFMT_NB_NF:
++ break;
++ case SND_SOC_DAIFMT_NB_IF:
++ cf.frame_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_NF:
++ cf.bit_clk_inv = 1;
++ break;
++ case SND_SOC_DAIFMT_IB_IF:
++ cf.frame_clk_inv = 1;
++ cf.bit_clk_inv = 1;
++ break;
++ }
++
++ switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
++ case SND_SOC_DAIFMT_I2S:
++ cf.fmt = HDMI_I2S;
++ break;
++ case SND_SOC_DAIFMT_DSP_A:
++ cf.fmt = HDMI_DSP_A;
++ break;
++ case SND_SOC_DAIFMT_DSP_B:
++ cf.fmt = HDMI_DSP_B;
++ break;
++ case SND_SOC_DAIFMT_RIGHT_J:
++ cf.fmt = HDMI_RIGHT_J;
++ break;
++ case SND_SOC_DAIFMT_LEFT_J:
++ cf.fmt = HDMI_LEFT_J;
++ break;
++ case SND_SOC_DAIFMT_AC97:
++ cf.fmt = HDMI_AC97;
++ break;
++ default:
++ dev_err(dai->dev, "Invalid DAI interface format\n");
++ return -EINVAL;
+ }
+
+ hcp->daifmt[dai->id] = cf;
+
+- return ret;
++ return 0;
+ }
+
+ static int hdmi_codec_digital_mute(struct snd_soc_dai *dai, int mute)
+@@ -771,8 +769,10 @@ static int hdmi_codec_probe(struct platf
+ i++;
+ }
+
+- if (hcd->spdif)
++ if (hcd->spdif) {
+ hcp->daidrv[i] = hdmi_spdif_dai;
++ hcp->daifmt[DAI_ID_SPDIF].fmt = HDMI_SPDIF;
++ }
+
+ ret = snd_soc_register_codec(dev, &hdmi_codec, hcp->daidrv,
+ dai_count);
diff --git a/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch b/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch
new file mode 100644
index 0000000000..96463a8eb6
--- /dev/null
+++ b/patches.drivers/ASoC-max98090-Fix-restore-of-DAPM-Muxes.patch
@@ -0,0 +1,57 @@
+From ecb2795c08bc825ebd604997e5be440b060c5b18 Mon Sep 17 00:00:00 2001
+From: Jon Hunter <jonathanh@nvidia.com>
+Date: Wed, 1 May 2019 15:29:38 +0100
+Subject: [PATCH] ASoC: max98090: Fix restore of DAPM Muxes
+Git-commit: ecb2795c08bc825ebd604997e5be440b060c5b18
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The max98090 driver defines 3 DAPM muxes; one for the right line output
+(LINMOD Mux), one for the left headphone mixer source (MIXHPLSEL Mux)
+and one for the right headphone mixer source (MIXHPRSEL Mux). The same
+bit is used for the mux as well as the DAPM enable, and although the mux
+can be correctly configured, after playback has completed, the mux will
+be reset during the disable phase. This is preventing the state of these
+muxes from being saved and restored correctly on system reboot. Fix this
+by marking these muxes as SND_SOC_NOPM.
+
+Note this has been verified this on the Tegra124 Nyan Big which features
+the MAX98090 codec.
+
+Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/max98090.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index 30c242c38d99..7619ea31ab50 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -1194,14 +1194,14 @@ static const struct snd_soc_dapm_widget max98090_dapm_widgets[] = {
+ &max98090_right_rcv_mixer_controls[0],
+ ARRAY_SIZE(max98090_right_rcv_mixer_controls)),
+
+- SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER,
+- M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux),
++ SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_linmod_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhplsel_mux),
+
+- SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL,
+- M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux),
++ SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0,
++ &max98090_mixhprsel_mux),
+
+ SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE,
+ M98090_HPLEN_SHIFT, 0, NULL, 0),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch b/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
new file mode 100644
index 0000000000..a990c633ed
--- /dev/null
+++ b/patches.drivers/ASoC-nau8810-fix-the-issue-of-widget-with-prefixed-n.patch
@@ -0,0 +1,39 @@
+From 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Wed, 13 Mar 2019 16:23:44 +0800
+Subject: [PATCH] ASoC: nau8810: fix the issue of widget with prefixed name
+Git-commit: 54d1cf78b0f4ba348a7c7fb8b7d0708d71b6cc8a
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The driver changes the stream name of DAC and ADC to avoid the issue of
+widget with prefixed name. When the machine adds prefixed name for codec,
+the stream name of DAI may not find the widgets.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/nau8810.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8810.c b/sound/soc/codecs/nau8810.c
+index bfd74b86c9d2..645aa0794123 100644
+--- a/sound/soc/codecs/nau8810.c
++++ b/sound/soc/codecs/nau8810.c
+@@ -411,9 +411,9 @@ static const struct snd_soc_dapm_widget nau8810_dapm_widgets[] = {
+ SND_SOC_DAPM_MIXER("Mono Mixer", NAU8810_REG_POWER3,
+ NAU8810_MOUTMX_EN_SFT, 0, &nau8810_mono_mixer_controls[0],
+ ARRAY_SIZE(nau8810_mono_mixer_controls)),
+- SND_SOC_DAPM_DAC("DAC", "HiFi Playback", NAU8810_REG_POWER3,
++ SND_SOC_DAPM_DAC("DAC", "Playback", NAU8810_REG_POWER3,
+ NAU8810_DAC_EN_SFT, 0),
+- SND_SOC_DAPM_ADC("ADC", "HiFi Capture", NAU8810_REG_POWER2,
++ SND_SOC_DAPM_ADC("ADC", "Capture", NAU8810_REG_POWER2,
+ NAU8810_ADC_EN_SFT, 0),
+ SND_SOC_DAPM_PGA("SpkN Out", NAU8810_REG_POWER3,
+ NAU8810_NSPK_EN_SFT, 0, NULL, 0),
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch b/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
new file mode 100644
index 0000000000..cdcf1c8efa
--- /dev/null
+++ b/patches.drivers/ASoC-nau8824-fix-the-issue-of-the-widget-with-prefix.patch
@@ -0,0 +1,110 @@
+From 844a4a362dbec166b44d6b9b3dd45b08cb273703 Mon Sep 17 00:00:00 2001
+From: John Hsu <KCHSU0@nuvoton.com>
+Date: Mon, 11 Mar 2019 09:36:45 +0800
+Subject: [PATCH] ASoC: nau8824: fix the issue of the widget with prefix name
+Git-commit: 844a4a362dbec166b44d6b9b3dd45b08cb273703
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The driver has two issues when machine add prefix name for codec.
+(1)The stream name of DAI can't find the AIF widgets.
+(2)The drivr can enable/disalbe the MICBIAS and SAR widgets.
+
+The patch will fix these issues caused by prefixed name added.
+
+Signed-off-by: John Hsu <KCHSU0@nuvoton.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/nau8824.c | 46 ++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 38 insertions(+), 8 deletions(-)
+
+diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c
+index 87ed3dc496dc..5ab05e75edea 100644
+--- a/sound/soc/codecs/nau8824.c
++++ b/sound/soc/codecs/nau8824.c
+@@ -681,8 +681,8 @@ static const struct snd_soc_dapm_widget nau8824_dapm_widgets[] = {
+ SND_SOC_DAPM_ADC("ADCR", NULL, NAU8824_REG_ANALOG_ADC_2,
+ NAU8824_ADCR_EN_SFT, 0),
+
+- SND_SOC_DAPM_AIF_OUT("AIFTX", "HiFi Capture", 0, SND_SOC_NOPM, 0, 0),
+- SND_SOC_DAPM_AIF_IN("AIFRX", "HiFi Playback", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_OUT("AIFTX", "Capture", 0, SND_SOC_NOPM, 0, 0),
++ SND_SOC_DAPM_AIF_IN("AIFRX", "Playback", 0, SND_SOC_NOPM, 0, 0),
+
+ SND_SOC_DAPM_DAC("DACL", NULL, NAU8824_REG_RDAC,
+ NAU8824_DACL_EN_SFT, 0),
+@@ -831,6 +831,36 @@ static void nau8824_int_status_clear_all(struct regmap *regmap)
+ }
+ }
+
++static void nau8824_dapm_disable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_disable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_disable_pin(dapm, pin);
++ }
++}
++
++static void nau8824_dapm_enable_pin(struct nau8824 *nau8824, const char *pin)
++{
++ struct snd_soc_dapm_context *dapm = nau8824->dapm;
++ const char *prefix = dapm->component->name_prefix;
++ char prefixed_pin[80];
++
++ if (prefix) {
++ snprintf(prefixed_pin, sizeof(prefixed_pin), "%s %s",
++ prefix, pin);
++ snd_soc_dapm_force_enable_pin(dapm, prefixed_pin);
++ } else {
++ snd_soc_dapm_force_enable_pin(dapm, pin);
++ }
++}
++
+ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ {
+ struct snd_soc_dapm_context *dapm = nau8824->dapm;
+@@ -839,8 +869,8 @@ static void nau8824_eject_jack(struct nau8824 *nau8824)
+ /* Clear all interruption status */
+ nau8824_int_status_clear_all(regmap);
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+
+ /* Enable the insertion interruption, disable the ejection
+@@ -870,8 +900,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ struct regmap *regmap = nau8824->regmap;
+ int adc_value, event = 0, event_mask = 0;
+
+- snd_soc_dapm_force_enable_pin(dapm, "MICBIAS");
+- snd_soc_dapm_force_enable_pin(dapm, "SAR");
++ nau8824_dapm_enable_pin(nau8824, "MICBIAS");
++ nau8824_dapm_enable_pin(nau8824, "SAR");
+ snd_soc_dapm_sync(dapm);
+
+ msleep(100);
+@@ -882,8 +912,8 @@ static void nau8824_jdet_work(struct work_struct *work)
+ if (adc_value < HEADSET_SARADC_THD) {
+ event |= SND_JACK_HEADPHONE;
+
+- snd_soc_dapm_disable_pin(dapm, "SAR");
+- snd_soc_dapm_disable_pin(dapm, "MICBIAS");
++ nau8824_dapm_disable_pin(nau8824, "SAR");
++ nau8824_dapm_disable_pin(nau8824, "MICBIAS");
+ snd_soc_dapm_sync(dapm);
+ } else {
+ event |= SND_JACK_HEADSET;
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch b/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch
new file mode 100644
index 0000000000..4689137bd0
--- /dev/null
+++ b/patches.drivers/ASoC-samsung-odroid-Fix-clock-configuration-for-4410.patch
@@ -0,0 +1,49 @@
+From 2b13bee3884926cba22061efa75bd315e871de24 Mon Sep 17 00:00:00 2001
+From: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Date: Tue, 12 Mar 2019 18:40:06 +0100
+Subject: [PATCH] ASoC: samsung: odroid: Fix clock configuration for 44100 sample rate
+Git-commit: 2b13bee3884926cba22061efa75bd315e871de24
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+After commit fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate
+handling") the audio root clock frequency is configured improperly for
+44100 sample rate. Due to clock rate rounding it's 20070401 Hz instead
+of 22579000 Hz. This results in a too low value of the PSR clock divider
+in the CPU DAI driver and too fast actual sample rate for fs=44100. E.g.
+1 kHz tone has actual 1780 Hz frequency (1 kHz * 20070401/22579000 * 2).
+
+Fix this by increasing the correction passed to clk_set_rate() to take
+into account inaccuracy of the EPLL frequency properly.
+
+Fixes: fbeec965b8d1c ("ASoC: samsung: odroid: Fix 32000 sample rate handling")
+Reported-by: JaeChul Lee <jcsing.lee@samsung.com>
+Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/samsung/odroid.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c
+index 694512f980fd..1dc54c4206f0 100644
+--- a/sound/soc/samsung/odroid.c
++++ b/sound/soc/samsung/odroid.c
+@@ -91,11 +91,11 @@ static int odroid_card_be_hw_params(struct snd_pcm_substream *substream,
+ return ret;
+
+ /*
+- * We add 1 to the rclk_freq value in order to avoid too low clock
++ * We add 2 to the rclk_freq value in order to avoid too low clock
+ * frequency values due to the EPLL output frequency not being exact
+ * multiple of the audio sampling rate.
+ */
+- rclk_freq = params_rate(params) * rfs + 1;
++ rclk_freq = params_rate(params) * rfs + 2;
+
+ ret = clk_set_rate(priv->sclk_i2s, rclk_freq);
+ if (ret < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch b/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch
new file mode 100644
index 0000000000..091c8a4aae
--- /dev/null
+++ b/patches.drivers/ASoC-soc-pcm-fix-a-codec-fixup-issue-in-TDM-case.patch
@@ -0,0 +1,64 @@
+From 570f18b6a8d1f0e60e8caf30e66161b6438dcc91 Mon Sep 17 00:00:00 2001
+From: Rander Wang <rander.wang@linux.intel.com>
+Date: Fri, 8 Mar 2019 16:38:57 +0800
+Subject: [PATCH] ASoC:soc-pcm:fix a codec fixup issue in TDM case
+Git-commit: 570f18b6a8d1f0e60e8caf30e66161b6438dcc91
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+On HDaudio platforms, if playback is started when capture is working,
+there is no audible output.
+
+This can be root-caused to the use of the rx|tx_mask to store an HDaudio
+stream tag.
+
+If capture is stared before playback, rx_mask would be non-zero on HDaudio
+platform, then the channel number of playback, which is in the same codec
+dai with the capture, would be changed by soc_pcm_codec_params_fixup based
+on the tx_mask at first, then overwritten by this function based on rx_mask
+at last.
+
+According to the author of tx|rx_mask, tx_mask is for playback and rx_mask
+is for capture. And stream direction is checked at all other references of
+tx|rx_mask in ASoC, so here should be an error. This patch checks stream
+direction for tx|rx_mask for fixup function.
+
+This issue would affect not only HDaudio+ASoC, but also I2S codecs if the
+channel number based on rx_mask is not equal to the one for tx_mask. It could
+be rarely reproduecd because most drivers in kernel set the same channel number
+to tx|rx_mask or rx_mask is zero.
+
+Tested on all platforms using stream_tag & HDaudio and intel I2S platforms.
+
+Signed-off-by: Rander Wang <rander.wang@linux.intel.com>
+Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/soc-pcm.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
+index a5b40e82dea4..e70555a4ea06 100644
+--- a/sound/soc/soc-pcm.c
++++ b/sound/soc/soc-pcm.c
+@@ -954,10 +954,13 @@ static int soc_pcm_hw_params(struct snd_pcm_substream *substream,
+ codec_params = *params;
+
+ /* fixup params based on TDM slot masks */
+- if (codec_dai->tx_mask)
++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK &&
++ codec_dai->tx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->tx_mask);
+- if (codec_dai->rx_mask)
++
++ if (substream->stream == SNDRV_PCM_STREAM_CAPTURE &&
++ codec_dai->rx_mask)
+ soc_pcm_codec_params_fixup(&codec_params,
+ codec_dai->rx_mask);
+
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch b/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch
new file mode 100644
index 0000000000..0d36cb72b5
--- /dev/null
+++ b/patches.drivers/ASoC-tlv320aic32x4-Fix-Common-Pins.patch
@@ -0,0 +1,35 @@
+From c63adb28f6d913310430f14c69f0a2ea55eed0cc Mon Sep 17 00:00:00 2001
+From: Annaliese McDermond <nh6z@nh6z.net>
+Date: Sat, 30 Mar 2019 09:02:02 -0700
+Subject: [PATCH] ASoC: tlv320aic32x4: Fix Common Pins
+Git-commit: c63adb28f6d913310430f14c69f0a2ea55eed0cc
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The common pins were mistakenly not added to the DAPM graph.
+Adding these pins will allow valid graphs to be created.
+
+Signed-off-by: Annaliese McDermond <nh6z@nh6z.net>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/tlv320aic32x4.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
+index 96f1526cb258..5520044929f4 100644
+--- a/sound/soc/codecs/tlv320aic32x4.c
++++ b/sound/soc/codecs/tlv320aic32x4.c
+@@ -490,6 +490,8 @@ static const struct snd_soc_dapm_widget aic32x4_dapm_widgets[] = {
+ SND_SOC_DAPM_INPUT("IN2_R"),
+ SND_SOC_DAPM_INPUT("IN3_L"),
+ SND_SOC_DAPM_INPUT("IN3_R"),
++ SND_SOC_DAPM_INPUT("CM_L"),
++ SND_SOC_DAPM_INPUT("CM_R"),
+ };
+
+ static const struct snd_soc_dapm_route aic32x4_dapm_routes[] = {
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch b/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch
new file mode 100644
index 0000000000..d1a65f1134
--- /dev/null
+++ b/patches.drivers/ASoC-wm_adsp-Add-locking-to-wm_adsp2_bus_error.patch
@@ -0,0 +1,69 @@
+From a2225a6d155fcb247fe4c6d87f7c91807462966d Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.cirrus.com>
+Date: Tue, 19 Mar 2019 11:52:06 +0000
+Subject: [PATCH] ASoC: wm_adsp: Add locking to wm_adsp2_bus_error
+Git-commit: a2225a6d155fcb247fe4c6d87f7c91807462966d
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Best to lock across handling the bus error to ensure the DSP doesn't
+change power state as we are reading the status registers.
+
+Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/wm_adsp.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
+index b3348a213c18..c19a8a041d4d 100644
+--- a/sound/soc/codecs/wm_adsp.c
++++ b/sound/soc/codecs/wm_adsp.c
+@@ -3922,11 +3922,13 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ struct regmap *regmap = dsp->regmap;
+ int ret = 0;
+
++ mutex_lock(&dsp->pwr_lock);
++
+ ret = regmap_read(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL, &val);
+ if (ret) {
+ adsp_err(dsp,
+ "Failed to read Region Lock Ctrl register: %d\n", ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ if (val & ADSP2_WDT_TIMEOUT_STS_MASK) {
+@@ -3945,7 +3947,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Bus Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "bus error address = 0x%x\n",
+@@ -3958,7 +3960,7 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ adsp_err(dsp,
+ "Failed to read Pmem Xmem Err Addr register: %d\n",
+ ret);
+- return IRQ_HANDLED;
++ goto error;
+ }
+
+ adsp_err(dsp, "xmem error address = 0x%x\n",
+@@ -3971,6 +3973,9 @@ irqreturn_t wm_adsp2_bus_error(struct wm_adsp *dsp)
+ regmap_update_bits(regmap, dsp->base + ADSP2_LOCK_REGION_CTRL,
+ ADSP2_CTRL_ERR_EINT, ADSP2_CTRL_ERR_EINT);
+
++error:
++ mutex_unlock(&dsp->pwr_lock);
++
+ return IRQ_HANDLED;
+ }
+ EXPORT_SYMBOL_GPL(wm_adsp2_bus_error);
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch b/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch
new file mode 100644
index 0000000000..9d6139897f
--- /dev/null
+++ b/patches.drivers/Bluetooth-Align-minimum-encryption-key-size-for-LE-a.patch
@@ -0,0 +1,58 @@
+From d5bb334a8e171b262e48f378bd2096c0ea458265 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Wed, 24 Apr 2019 22:19:17 +0200
+Subject: [PATCH] Bluetooth: Align minimum encryption key size for LE and BR/EDR connections
+Git-commit: d5bb334a8e171b262e48f378bd2096c0ea458265
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The minimum encryption key size for LE connections is 56 bits and to
+align LE with BR/EDR, enforce 56 bits of minimum encryption key size for
+BR/EDR connections as well.
+
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/net/bluetooth/hci_core.h | 3 +++
+ net/bluetooth/hci_conn.c | 8 ++++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 094e61e07030..05b1b96f4d9e 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -190,6 +190,9 @@ struct adv_info {
+
+ #define HCI_MAX_SHORT_NAME_LENGTH 10
+
++/* Min encryption key size to match with SMP */
++#define HCI_MIN_ENC_KEY_SIZE 7
++
+ /* Default LE RPA expiry time, 15 minutes */
+ #define HCI_DEFAULT_RPA_TIMEOUT (15 * 60)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index bd4978ce8c45..3cf0764d5793 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1276,6 +1276,14 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
++ /* The minimum encryption key size needs to be enforced by the
++ * host stack before establishing any L2CAP connections. The
++ * specification in theory allows a minimum of 1, but to align
++ * BR/EDR and LE transports, a minimum of 7 is chosen.
++ */
++ if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
++ return 0;
++
+ return 1;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch b/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch
new file mode 100644
index 0000000000..62087c0f46
--- /dev/null
+++ b/patches.drivers/Bluetooth-hidp-fix-buffer-overflow.patch
@@ -0,0 +1,38 @@
+From a1616a5ac99ede5d605047a9012481ce7ff18b16 Mon Sep 17 00:00:00 2001
+From: Young Xiao <YangX92@hotmail.com>
+Date: Fri, 12 Apr 2019 15:24:30 +0800
+Subject: [PATCH] Bluetooth: hidp: fix buffer overflow
+Git-commit: a1616a5ac99ede5d605047a9012481ce7ff18b16
+Patch-mainline: v5.2-rc1
+References: bsc#1051510, CVE-2019-11884, bsc#1134848
+
+Struct ca is copied from userspace. It is not checked whether the "name"
+field is NULL terminated, which allows local users to obtain potentially
+sensitive information from kernel stack memory, via a HIDPCONNADD command.
+
+This vulnerability is similar to CVE-2011-1079.
+
+Signed-off-by: Young Xiao <YangX92@hotmail.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/bluetooth/hidp/sock.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/bluetooth/hidp/sock.c b/net/bluetooth/hidp/sock.c
+index 9f85a1943be9..2151913892ce 100644
+--- a/net/bluetooth/hidp/sock.c
++++ b/net/bluetooth/hidp/sock.c
+@@ -75,6 +75,7 @@ static int do_hidp_sock_ioctl(struct socket *sock, unsigned int cmd, void __user
+ sockfd_put(csock);
+ return err;
+ }
++ ca.name[sizeof(ca.name)-1] = 0;
+
+ err = hidp_connection_add(&ca, csock, isock);
+ if (!err && copy_to_user(argp, &ca, sizeof(ca)))
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-Init-PCIe-feature-bits-for-managed-host-bridge-a.patch b/patches.drivers/PCI-Init-PCIe-feature-bits-for-managed-host-bridge-a.patch
new file mode 100644
index 0000000000..5dc50903bf
--- /dev/null
+++ b/patches.drivers/PCI-Init-PCIe-feature-bits-for-managed-host-bridge-a.patch
@@ -0,0 +1,77 @@
+From 6302bf3ef78dd210b5ff4a922afcb7d8eff8a211 Mon Sep 17 00:00:00 2001
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Date: Mon, 18 Mar 2019 16:07:18 +0000
+Subject: [PATCH] PCI: Init PCIe feature bits for managed host bridge alloc
+Git-commit: 6302bf3ef78dd210b5ff4a922afcb7d8eff8a211
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+Two functions allocate a host bridge: devm_pci_alloc_host_bridge() and
+pci_alloc_host_bridge(). At the moment, only the unmanaged one initializes
+the PCIe feature bits, which prevents from using features such as hotplug
+or AER on some systems, when booting with device tree. Make the
+initialization code common.
+
+Fixes: 02bfeb484230 ("PCI/portdrv: Simplify PCIe feature permission checking")
+Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v4.17+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/probe.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 2ec0df04e0dc..012250a78da7 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -586,16 +586,9 @@ static void pci_release_host_bridge_dev(struct device *dev)
+ kfree(to_pci_host_bridge(dev));
+ }
+
+-struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
++static void pci_init_host_bridge(struct pci_host_bridge *bridge)
+ {
+- struct pci_host_bridge *bridge;
+-
+- bridge = kzalloc(sizeof(*bridge) + priv, GFP_KERNEL);
+- if (!bridge)
+- return NULL;
+-
+ INIT_LIST_HEAD(&bridge->windows);
+- bridge->dev.release = pci_release_host_bridge_dev;
+
+ /*
+ * We assume we can manage these PCIe features. Some systems may
+@@ -608,6 +601,18 @@ struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
+ bridge->native_shpc_hotplug = 1;
+ bridge->native_pme = 1;
+ bridge->native_ltr = 1;
++}
++
++struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
++{
++ struct pci_host_bridge *bridge;
++
++ bridge = kzalloc(sizeof(*bridge) + priv, GFP_KERNEL);
++ if (!bridge)
++ return NULL;
++
++ pci_init_host_bridge(bridge);
++ bridge->dev.release = pci_release_host_bridge_dev;
+
+ return bridge;
+ }
+@@ -622,7 +627,7 @@ struct pci_host_bridge *devm_pci_alloc_host_bridge(struct device *dev,
+ if (!bridge)
+ return NULL;
+
+- INIT_LIST_HEAD(&bridge->windows);
++ pci_init_host_bridge(bridge);
+ bridge->dev.release = devm_pci_release_host_bridge_dev;
+
+ return bridge;
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch b/patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
new file mode 100644
index 0000000000..3bb25cc55a
--- /dev/null
+++ b/patches.drivers/PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
@@ -0,0 +1,43 @@
+From d28ca864c493637f3c957f4ed9348a94fca6de60 Mon Sep 17 00:00:00 2001
+From: Nikolai Kostrigin <nickel@altlinux.org>
+Date: Mon, 8 Apr 2019 13:37:25 +0300
+Subject: [PATCH] PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken
+Git-commit: d28ca864c493637f3c957f4ed9348a94fca6de60
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+ATS is broken on the Radeon R7 GPU (at least for Stoney Ridge based laptop)
+and causes IOMMU stalls and system failure. Disable ATS on these devices
+to make them usable again with IOMMU enabled.
+
+Thanks to Joerg Roedel <jroedel@suse.de> for help.
+
+[bhelgaas: In the email thread mentioned below, Alex suspects the real
+problem is in sbios or iommu, so it may affect only certain systems, and it
+may affect other devices in those systems as well. However, per Joerg we
+lack the ability to debug further, so this quirk is the best we can do for
+now.]
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=194521
+Link: https://lore.kernel.org/lkml/20190408103725.30426-1-nickel@altlinux.org
+Fixes: 9b44b0b09dec ("PCI: Mark AMD Stoney GPU ATS as broken")
+Signed-off-by: Nikolai Kostrigin <nickel@altlinux.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+Cc: stable@vger.kernel.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4983,6 +4983,7 @@ static void quirk_no_ats(struct pci_dev
+
+ /* AMD Stoney platform GPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
diff --git a/patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch b/patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
new file mode 100644
index 0000000000..39d5025202
--- /dev/null
+++ b/patches.drivers/PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
@@ -0,0 +1,38 @@
+From 6afb7e26978da5e86e57e540fdce65c8b04f398a Mon Sep 17 00:00:00 2001
+From: James Prestwood <james.prestwood@linux.intel.com>
+Date: Mon, 7 Jan 2019 13:32:48 -0800
+Subject: [PATCH] PCI: Mark Atheros AR9462 to avoid bus reset
+Git-commit: 6afb7e26978da5e86e57e540fdce65c8b04f398a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+When using PCI passthrough with this device, the host machine locks up
+completely when starting the VM, requiring a hard reboot. Add a quirk to
+avoid bus resets on this device.
+
+Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset")
+Link: https://lore.kernel.org/linux-pci/20190107213248.3034-1-james.prestwood@linux.intel.com
+Signed-off-by: James Prestwood <james.prestwood@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: stable@vger.kernel.org # v3.14+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 68bee35fcafa..9b9e28854a58 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3408,6 +3408,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+
+ /*
+ * Root port on some Cavium CN8xxx chips do not successfully complete a bus
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch b/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
new file mode 100644
index 0000000000..b33d241243
--- /dev/null
+++ b/patches.drivers/Revert-ALSA-seq-Protect-in-kernel-ioctl-calls-with-m.patch
@@ -0,0 +1,51 @@
+From f0654ba94e33699b295ce4f3dc73094db6209035 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 11 Apr 2019 19:58:32 +0200
+Subject: [PATCH] Revert "ALSA: seq: Protect in-kernel ioctl calls with mutex"
+Git-commit: f0654ba94e33699b295ce4f3dc73094db6209035
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This reverts commit feb689025fbb6f0aa6297d3ddf97de945ea4ad32.
+
+The fix attempt was incorrect, leading to the mutex deadlock through
+the close of OSS sequencer client. The proper fix needs more
+consideration, so let's revert it now.
+
+Fixes: feb689025fbb ("ALSA: seq: Protect in-kernel ioctl calls with mutex")
+Reported-by: syzbot+47ded6c0f23016cde310@syzkaller.appspotmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/seq_clientmgr.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
+index f256704dc401..de320b1b90de 100644
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2334,19 +2334,14 @@ int snd_seq_kernel_client_ctl(int clientid, unsigned int cmd, void *arg)
+ {
+ const struct ioctl_handler *handler;
+ struct snd_seq_client *client;
+- int err;
+
+ client = clientptr(clientid);
+ if (client == NULL)
+ return -ENXIO;
+
+ for (handler = ioctl_handlers; handler->cmd > 0; ++handler) {
+- if (handler->cmd == cmd) {
+- mutex_lock(&client->ioctl_mutex);
+- err = handler->func(client, arg);
+- mutex_unlock(&client->ioctl_mutex);
+- return err;
+- }
++ if (handler->cmd == cmd)
++ return handler->func(client, arg);
+ }
+
+ pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n",
+--
+2.16.4
+
diff --git a/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch b/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
new file mode 100644
index 0000000000..675eb7ea9f
--- /dev/null
+++ b/patches.drivers/Revert-tty-pty-Fix-race-condition-between-release_on.patch
@@ -0,0 +1,69 @@
+From 0eae4686a128d87503863a261e84887750c8bc68 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 29 Mar 2019 15:47:40 +0100
+Subject: [PATCH] Revert "tty: pty: Fix race condition between release_one_tty and pty_write"
+Git-commit: 0eae4686a128d87503863a261e84887750c8bc68
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This reverts commit b9ca5f8560af244489b4a1bc1ae88b341f24bc95 as 0-day
+shows it has a circular locking dependency.
+
+Fixes: b9ca5f8560af ("tty: pty: Fix race condition between release_one_tty and pty_write")
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: Sahara <keun-o.park@darkmatter.ae>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/pty.c | 7 -------
+ drivers/tty/tty_io.c | 3 ---
+ 2 files changed, 10 deletions(-)
+
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index ef72031ab5b9..00099a8439d2 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -116,12 +116,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ if (tty->stopped)
+ return 0;
+
+- mutex_lock(&tty_mutex);
+- if (to->magic != TTY_MAGIC) {
+- mutex_unlock(&tty_mutex);
+- return -EIO;
+- }
+-
+ if (c > 0) {
+ spin_lock_irqsave(&to->port->lock, flags);
+ /* Stuff the data into the input queue of the other end */
+@@ -131,7 +125,6 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
+ tty_flip_buffer_push(to->port);
+ spin_unlock_irqrestore(&to->port->lock, flags);
+ }
+- mutex_unlock(&tty_mutex);
+ return c;
+ }
+
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index c27777f3b8c4..5fa250157025 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1448,13 +1448,10 @@ static void release_one_tty(struct work_struct *work)
+ struct tty_driver *driver = tty->driver;
+ struct module *owner = driver->owner;
+
+- mutex_lock(&tty_mutex);
+ if (tty->ops->cleanup)
+ tty->ops->cleanup(tty);
+
+ tty->magic = 0;
+- mutex_unlock(&tty_mutex);
+-
+ tty_driver_kref_put(driver);
+ module_put(owner);
+
+--
+2.16.4
+
diff --git a/patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch b/patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch
new file mode 100644
index 0000000000..9ad535a87b
--- /dev/null
+++ b/patches.drivers/backlight-lm3630a-Return-0-on-success-in-update_stat.patch
@@ -0,0 +1,50 @@
+From d3f48ec0954c6aac736ab21c34a35d7554409112 Mon Sep 17 00:00:00 2001
+From: Brian Masney <masneyb@onstation.org>
+Date: Wed, 24 Apr 2019 05:25:03 -0400
+Subject: [PATCH] backlight: lm3630a: Return 0 on success in update_status functions
+Git-commit: d3f48ec0954c6aac736ab21c34a35d7554409112
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status()
+both return the brightness value if the brightness was successfully
+updated. Writing to these attributes via sysfs would cause a 'Bad
+address' error to be returned. These functions should return 0 on
+success, so let's change it to correct that error.
+
+Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision")
+Signed-off-by: Brian Masney <masneyb@onstation.org>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Acked-by: Daniel Thompson <daniel.thompson@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/backlight/lm3630a_bl.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c
+index 2030a6b77a09..ef2553f452ca 100644
+--- a/drivers/video/backlight/lm3630a_bl.c
++++ b/drivers/video/backlight/lm3630a_bl.c
+@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl)
+ LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access\n");
+@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl)
+ LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
+ if (ret < 0)
+ goto out_i2c_err;
+- return bl->props.brightness;
++ return 0;
+
+ out_i2c_err:
+ dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
+--
+2.16.4
+
diff --git a/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch b/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch
new file mode 100644
index 0000000000..8d127b34a4
--- /dev/null
+++ b/patches.drivers/clk-rockchip-Fix-video-codec-clocks-on-rk3288.patch
@@ -0,0 +1,85 @@
+From 00c0cd9e59d265b393553e9afa54fee8b10e8158 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 11 Apr 2019 06:55:55 -0700
+Subject: [PATCH] clk: rockchip: Fix video codec clocks on rk3288
+Git-commit: 00c0cd9e59d265b393553e9afa54fee8b10e8158
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It appears that there is a typo in the rk3288 TRM. For
+GRF_SOC_CON0[7] it says that 0 means "vepu" and 1 means "vdpu". It's
+the other way around.
+
+How do I know? Here's my evidence:
+
+1. Prior to commit 4d3e84f99628 ("clk: rockchip: describe aclk_vcodec
+ using the new muxgrf type on rk3288") we always pretended that we
+ were using "aclk_vdpu" and the comment in the code said that this
+ matched the default setting in the system. In fact the default
+ setting is 0 according to the TRM and according to reading memory
+ at bootup. In addition rk3288-based Chromebooks ran like this and
+ the video codecs worked.
+2. With the existing clock code if you boot up and try to enable the
+ new VIDEO_ROCKCHIP_VPU as a module (and without "clk_ignore_unused"
+ on the command line), you get errors like "failed to get ack on
+ domain 'pd_video', val=0x80208". After flipping vepu/vdpu things
+ init OK.
+3. If I export and add both the vepu and vdpu to the list of clocks
+ for RK3288_PD_VIDEO I can get past the power domain errors, but now
+ I freeze when the vpu_mmu gets initted.
+4. If I just mark the "vdpu" as IGNORE_UNUSED then everything boots up
+ and probes OK showing that somehow the "vdpu" was important to keep
+ enabled. This is because we were actually using it as a parent.
+5. After this change I can hack "aclk_vcodec_pre" to parent from
+ "aclk_vepu" using assigned-clocks and the video codec still probes
+ OK.
+6. Rockchip has said so on the mailing list [1].
+
+...so let's fix it.
+
+Let's also add CLK_SET_RATE_PARENT to "aclk_vcodec_pre" as suggested
+by Jonas Karlman. Prior to the same commit you could do
+clk_set_rate() on "aclk_vcodec" and it would change "aclk_vdpu".
+That's because "aclk_vcodec" was a simple gate clock (always gets
+CLK_SET_RATE_PARENT) and its direct parent was "aclk_vdpu". After
+that commit "aclk_vcodec_pre" gets in the way so we need to add
+CLK_SET_RATE_PARENT to it too.
+
+[1] https://lkml.kernel.org/r/1d17b015-9e17-34b9-baf8-c285dc1957aa@rock-chips.com
+
+Fixes: 4d3e84f99628 ("clk: rockchip: describe aclk_vcodec using the new muxgrf type on rk3288")
+Suggested-by: Jonas Karlman <jonas@kwiboo.se>
+Suggested-by: Randy Li <ayaka@soulik.info>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3288.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index f47d514cba36..94cbcb0aa49f 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -219,7 +219,7 @@ PNAME(mux_hsadcout_p) = { "hsadc_src", "ext_hsadc" };
+ PNAME(mux_edp_24m_p) = { "ext_edp_24m", "xin24m" };
+ PNAME(mux_tspout_p) = { "cpll", "gpll", "npll", "xin27m" };
+
+-PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vepu", "aclk_vdpu" };
++PNAME(mux_aclk_vcodec_pre_p) = { "aclk_vdpu", "aclk_vepu" };
+ PNAME(mux_usbphy480m_p) = { "sclk_otgphy1_480m", "sclk_otgphy2_480m",
+ "sclk_otgphy0_480m" };
+ PNAME(mux_hsicphy480m_p) = { "cpll", "gpll", "usbphy480m_src" };
+@@ -420,7 +420,7 @@ static struct rockchip_clk_branch rk3288_clk_branches[] __initdata = {
+ COMPOSITE(0, "aclk_vdpu", mux_pll_src_cpll_gpll_usb480m_p, 0,
+ RK3288_CLKSEL_CON(32), 14, 2, MFLAGS, 8, 5, DFLAGS,
+ RK3288_CLKGATE_CON(3), 11, GFLAGS),
+- MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, 0,
++ MUXGRF(0, "aclk_vcodec_pre", mux_aclk_vcodec_pre_p, CLK_SET_RATE_PARENT,
+ RK3288_GRF_SOC_CON(0), 7, 1, MFLAGS),
+ GATE(ACLK_VCODEC, "aclk_vcodec", "aclk_vcodec_pre", 0,
+ RK3288_CLKGATE_CON(9), 0, GFLAGS),
+--
+2.16.4
+
diff --git a/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch b/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
new file mode 100644
index 0000000000..42552ae89c
--- /dev/null
+++ b/patches.drivers/clk-rockchip-fix-wrong-clock-definitions-for-rk3328.patch
@@ -0,0 +1,92 @@
+From fb903392131a324a243c7731389277db1cd9f8df Mon Sep 17 00:00:00 2001
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: [PATCH] clk: rockchip: fix wrong clock definitions for rk3328
+Git-commit: fb903392131a324a243c7731389277db1cd9f8df
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", CLK_IGNORE_UNUSED,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -894,7 +894,7 @@ static void __init rk3328_clk_init(struc
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
diff --git a/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch b/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch
new file mode 100644
index 0000000000..647bf4914e
--- /dev/null
+++ b/patches.drivers/dmaengine-axi-dmac-Don-t-check-the-number-of-frames-.patch
@@ -0,0 +1,45 @@
+From 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 Mon Sep 17 00:00:00 2001
+From: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Date: Tue, 26 Mar 2019 16:05:20 +0200
+Subject: [PATCH] dmaengine: axi-dmac: Don't check the number of frames for alignment
+Git-commit: 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+In 2D transfers (for the AXI DMAC), the number of frames (numf) represents
+Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful
+for video transfers where screen resolutions ( X * Y ) are typically
+aligned for X, but not for Y.
+
+There is no requirement for Y_LENGTH to be aligned to the bus-width (or
+anything), and this is also true for AXI DMAC.
+
+Checking the Y_LENGTH for alignment causes false errors when initiating DMA
+transfers. This change fixes this by checking only that the Y_LENGTH is
+non-zero.
+
+Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller")
+Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/dma-axi-dmac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c
+index eecb367b4f3e..cdbef59a9542 100644
+--- a/drivers/dma/dma-axi-dmac.c
++++ b/drivers/dma/dma-axi-dmac.c
+@@ -526,7 +526,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved(
+
+ if (chan->hw_2d) {
+ if (!axi_dmac_check_len(chan, xt->sgl[0].size) ||
+- !axi_dmac_check_len(chan, xt->numf))
++ xt->numf == 0)
+ return NULL;
+ if (xt->sgl[0].size + dst_icg > chan->max_length ||
+ xt->sgl[0].size + src_icg > chan->max_length)
+--
+2.16.4
+
diff --git a/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch b/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch
new file mode 100644
index 0000000000..ebb023a581
--- /dev/null
+++ b/patches.drivers/dmaengine-tegra210-dma-free-dma-controller-in-remove.patch
@@ -0,0 +1,90 @@
+From f030e419501cb95e961e9ed35c493b5d46a04eca Mon Sep 17 00:00:00 2001
+From: Sameer Pujar <spujar@nvidia.com>
+Date: Thu, 2 May 2019 18:25:16 +0530
+Subject: [PATCH] dmaengine: tegra210-dma: free dma controller in remove()
+Git-commit: f030e419501cb95e961e9ed35c493b5d46a04eca
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Following kernel panic is seen during DMA driver unload->load sequence
+==========================================================================
+Unable to handle kernel paging request at virtual address ffffff8001198880
+Internal error: Oops: 86000007 [#1] PREEMPT SMP
+Cpu: 0 PID: 5907 Comm: HwBinder:4123_1 Tainted: G C 4.9.128-tegra-g065839f
+Hardware name: galen (DT)
+Task: ffffffc3590d1a80 task.stack: ffffffc3d0678000
+PC is at 0xffffff8001198880
+LR is at of_dma_request_slave_channel+0xd8/0x1f8
+pc : [<ffffff8001198880>] lr : [<ffffff8008746f30>] pstate: 60400045
+sp : ffffffc3d067b710
+X29: ffffffc3d067b710 x28: 000000000000002f
+X27: ffffff800949e000 x26: ffffff800949e750
+X25: ffffff800949e000 x24: ffffffbefe817d84
+X23: ffffff8009f77cb0 x22: 0000000000000028
+X21: ffffffc3ffda49c8 x20: 0000000000000029
+X19: 0000000000000001 x18: ffffffffffffffff
+X17: 0000000000000000 x16: ffffff80082b66a0
+X15: ffffff8009e78250 x14: 000000000000000a
+X13: 0000000000000038 x12: 0101010101010101
+X11: 0000000000000030 x10: 0101010101010101
+x9 : fffffffffffffffc x8 : 7f7f7f7f7f7f7f7f
+x7 : 62ff726b6b64622c x6 : 0000000000008064
+x5 : 6400000000000000 x4 : ffffffbefe817c44
+x3 : ffffffc3ffda3e08 x2 : ffffff8001198880
+x1 : ffffffc3d48323c0 x0 : ffffffc3d067b788
+
+Process HwBinder:4123_1 (pid: 5907, stack limit = 0xffffffc3d0678028)
+Call trace:
+[<ffffff8001198880>] 0xffffff8001198880
+[<ffffff80087459f8>] dma_request_chan+0x50/0x1f0
+[<ffffff8008745bc0>] dma_request_slave_channel+0x28/0x40
+[<ffffff8001552c44>] tegra_alt_pcm_open+0x114/0x170
+[<ffffff8008d65fa4>] soc_pcm_open+0x10c/0x878
+[<ffffff8008d18618>] snd_pcm_open_substream+0xc0/0x170
+[<ffffff8008d1878c>] snd_pcm_open+0xc4/0x240
+[<ffffff8008d189e0>] snd_pcm_playback_open+0x58/0x80
+[<ffffff8008cfc6d4>] snd_open+0xb4/0x178
+[<ffffff8008250628>] chrdev_open+0xb8/0x1d0
+[<ffffff8008246fdc>] do_dentry_open+0x214/0x318
+[<ffffff80082485d0>] vfs_open+0x58/0x88
+[<ffffff800825bce0>] do_last+0x450/0xde0
+[<ffffff800825c718>] path_openat+0xa8/0x368
+[<ffffff800825dd84>] do_filp_open+0x8c/0x110
+[<ffffff8008248a74>] do_sys_open+0x164/0x220
+[<ffffff80082b66dc>] compat_SyS_openat+0x3c/0x50
+[<ffffff8008083040>] el0_svc_naked+0x34/0x38
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---[ end trace 67e6d544e65b5145 ]---
+Kernel panic - not syncing: Fatal exception
+==========================================================================
+
+In device probe(), of_dma_controller_register() registers DMA controller.
+But when driver is removed, this is not freed. During driver reload this
+results in data abort and kernel panic. Add of_dma_controller_free() in
+driver remove path to fix the issue.
+
+Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA")
+Signed-off-by: Sameer Pujar <spujar@nvidia.com>
+Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+---
+ drivers/dma/tegra210-adma.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c
+index f26c458d584e..953669d35479 100644
+--- a/drivers/dma/tegra210-adma.c
++++ b/drivers/dma/tegra210-adma.c
+@@ -888,6 +888,7 @@ static int tegra_adma_remove(struct platform_device *pdev)
+ struct tegra_adma *tdma = platform_get_drvdata(pdev);
+ int i;
+
++ of_dma_controller_free(pdev->dev.of_node);
+ dma_async_device_unregister(&tdma->dma_dev);
+
+ for (i = 0; i < tdma->nr_channels; ++i)
+--
+2.16.4
+
diff --git a/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch b/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch
new file mode 100644
index 0000000000..1103708253
--- /dev/null
+++ b/patches.drivers/dwc2-gadget-Fix-completed-transfer-size-calculation-.patch
@@ -0,0 +1,39 @@
+From 5acb4b970184d189d901192d075997c933b82260 Mon Sep 17 00:00:00 2001
+From: Minas Harutyunyan <minas.harutyunyan@synopsys.com>
+Date: Fri, 22 Feb 2019 15:49:19 +0400
+Subject: [PATCH] dwc2: gadget: Fix completed transfer size calculation in DDMA
+Git-commit: 5acb4b970184d189d901192d075997c933b82260
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Fix calculation of transfer size on completion in function
+dwc2_gadget_get_xfersize_ddma().
+
+Added increment of descriptor pointer to move to next descriptor in
+the loop.
+
+Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete")
+
+Signed-off-by: Minas Harutyunyan <hminas@synopsys.com>
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/dwc2/gadget.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
+index a17e444e467b..16ffd9fd9361 100644
+--- a/drivers/usb/dwc2/gadget.c
++++ b/drivers/usb/dwc2/gadget.c
+@@ -2325,6 +2325,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
+ if (status & DEV_DMA_STS_MASK)
+ dev_err(hsotg->dev, "descriptor %d closed with %x\n",
+ i, status & DEV_DMA_STS_MASK);
++ desc++;
+ }
+
+ return bytes_rem;
+--
+2.16.4
+
diff --git a/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch b/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
index 5ddcb5196e..ddb42f7bbf 100644
--- a/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
+++ b/patches.drivers/ibmvnic-Report-actual-backing-device-speed-and-duple.patch
@@ -4,8 +4,7 @@ Date: Tue, 19 Mar 2019 10:28:51 -0300
Subject: [PATCH] ibmvnic: Report actual backing device speed and duplex values
References: bsc#1129923
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Patch-mainline: v5.2-rc1
Git-commit: f8d6ae0d27ec1e81e4be454e63bc96086bbf8e6b
The ibmvnic driver currently reports a fixed value for both speed and
diff --git a/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch b/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch
new file mode 100644
index 0000000000..6fe6f153d8
--- /dev/null
+++ b/patches.drivers/intel_th-pci-Add-Comet-Lake-support.patch
@@ -0,0 +1,38 @@
+From e60e9a4b231a20a199d7a61caadc48693c30d695 Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:36 +0300
+Subject: [PATCH] intel_th: pci: Add Comet Lake support
+Git-commit: e60e9a4b231a20a199d7a61caadc48693c30d695
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This adds support for Intel TH on Comet Lake.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/hwtracing/intel_th/pci.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
+index 1cf6290d6435..70f2cb90adc5 100644
+--- a/drivers/hwtracing/intel_th/pci.c
++++ b/drivers/hwtracing/intel_th/pci.c
+@@ -165,6 +165,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x34a6),
+ .driver_data = (kernel_ulong_t)&intel_th_2x,
+ },
++ {
++ /* Comet Lake */
++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x02a6),
++ .driver_data = (kernel_ulong_t)&intel_th_2x,
++ },
+ { 0 },
+ };
+
+--
+2.16.4
+
diff --git a/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock b/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
new file mode 100644
index 0000000000..02ec82e57c
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-don-t-request-page-request-irq-under-dmar_global_lock
@@ -0,0 +1,101 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Fri, 19 Apr 2019 14:43:29 +0800
+Subject: iommu/vt-d: Don't request page request irq under dmar_global_lock
+Git-commit: a7755c3cfa5df755e39447b08c28203e011fb98c
+References: bsc#1135006
+Patch-mainline: v5.2-rc1
+
+Requesting page reqest irq under dmar_global_lock could cause
+potential lock race condition (caught by lockdep).
+
+[ 4.100055] ======================================================
+[ 4.100063] WARNING: possible circular locking dependency detected
+[ 4.100072] 5.1.0-rc4+ #2169 Not tainted
+[ 4.100078] ------------------------------------------------------
+[ 4.100086] swapper/0/1 is trying to acquire lock:
+[ 4.100094] 000000007dcbe3c3 (dmar_lock){+.+.}, at: dmar_alloc_hwirq+0x35/0x140
+[ 4.100112] but task is already holding lock:
+[ 4.100120] 0000000060bbe946 (dmar_global_lock){++++}, at: intel_iommu_init+0x191/0x1438
+[ 4.100136] which lock already depends on the new lock.
+[ 4.100146] the existing dependency chain (in reverse order) is:
+[ 4.100155]
+ -> #2 (dmar_global_lock){++++}:
+[ 4.100169] down_read+0x44/0xa0
+[ 4.100178] intel_irq_remapping_alloc+0xb2/0x7b0
+[ 4.100186] mp_irqdomain_alloc+0x9e/0x2e0
+[ 4.100195] __irq_domain_alloc_irqs+0x131/0x330
+[ 4.100203] alloc_isa_irq_from_domain.isra.4+0x9a/0xd0
+[ 4.100212] mp_map_pin_to_irq+0x244/0x310
+[ 4.100221] setup_IO_APIC+0x757/0x7ed
+[ 4.100229] x86_late_time_init+0x17/0x1c
+[ 4.100238] start_kernel+0x425/0x4e3
+[ 4.100247] secondary_startup_64+0xa4/0xb0
+[ 4.100254]
+ -> #1 (irq_domain_mutex){+.+.}:
+[ 4.100265] __mutex_lock+0x7f/0x9d0
+[ 4.100273] __irq_domain_add+0x195/0x2b0
+[ 4.100280] irq_domain_create_hierarchy+0x3d/0x40
+[ 4.100289] msi_create_irq_domain+0x32/0x110
+[ 4.100297] dmar_alloc_hwirq+0x111/0x140
+[ 4.100305] dmar_set_interrupt.part.14+0x1a/0x70
+[ 4.100314] enable_drhd_fault_handling+0x2c/0x6c
+[ 4.100323] apic_bsp_setup+0x75/0x7a
+[ 4.100330] x86_late_time_init+0x17/0x1c
+[ 4.100338] start_kernel+0x425/0x4e3
+[ 4.100346] secondary_startup_64+0xa4/0xb0
+[ 4.100352]
+ -> #0 (dmar_lock){+.+.}:
+[ 4.100364] lock_acquire+0xb4/0x1c0
+[ 4.100372] __mutex_lock+0x7f/0x9d0
+[ 4.100379] dmar_alloc_hwirq+0x35/0x140
+[ 4.100389] intel_svm_enable_prq+0x61/0x180
+[ 4.100397] intel_iommu_init+0x1128/0x1438
+[ 4.100406] pci_iommu_init+0x16/0x3f
+[ 4.100414] do_one_initcall+0x5d/0x2be
+[ 4.100422] kernel_init_freeable+0x1f0/0x27c
+[ 4.100431] kernel_init+0xa/0x110
+[ 4.100438] ret_from_fork+0x3a/0x50
+[ 4.100444]
+ other info that might help us debug this:
+
+[ 4.100454] Chain exists of:
+ dmar_lock --> irq_domain_mutex --> dmar_global_lock
+[ 4.100469] Possible unsafe locking scenario:
+
+[ 4.100476] CPU0 CPU1
+[ 4.100483] ---- ----
+[ 4.100488] lock(dmar_global_lock);
+[ 4.100495] lock(irq_domain_mutex);
+[ 4.100503] lock(dmar_global_lock);
+[ 4.100512] lock(dmar_lock);
+[ 4.100518]
+ *** DEADLOCK ***
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Dave Jiang <dave.jiang@intel.com>
+Fixes: a222a7f0bb6c9 ("iommu/vt-d: Implement page request handling")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3435,7 +3435,13 @@ domains_done:
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+ if (pasid_enabled(iommu) && ecap_prs(iommu->ecap)) {
++ /*
++ * Call dmar_alloc_hwirq() with dmar_global_lock held,
++ * could cause possible lock race condition.
++ */
++ up_write(&dmar_global_lock);
+ ret = intel_svm_enable_prq(iommu);
++ down_write(&dmar_global_lock);
+ if (ret)
+ goto free_iommu;
+ }
+
diff --git a/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu b/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu
new file mode 100644
index 0000000000..4ede87ac04
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-viommu
@@ -0,0 +1,42 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 2 May 2019 09:34:26 +0800
+Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU
+Git-commit: 5daab58043ee2bca861068e2595564828f3bc663
+References: bsc#1135007
+Patch-mainline: v5.2-rc1
+
+The kernel parameter igfx_off is used by users to disable
+DMA remapping for the Intel integrated graphic device. It
+was designed for bare metal cases where a dedicated IOMMU
+is used for graphic. This doesn't apply to virtual IOMMU
+case where an include-all IOMMU is used. This makes the
+kernel parameter work with virtual IOMMU as well.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Tested-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3351,9 +3351,12 @@ static int __init init_dmars(void)
+ iommu_identity_mapping |= IDENTMAP_ALL;
+
+ #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA
+- iommu_identity_mapping |= IDENTMAP_GFX;
++ dmar_map_gfx = 0;
+ #endif
+
++ if (!dmar_map_gfx)
++ iommu_identity_mapping |= IDENTMAP_GFX;
++
+ check_tylersburg_isoch();
+
+ if (iommu_identity_mapping) {
+
diff --git a/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly b/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly
new file mode 100644
index 0000000000..f84fdbca56
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-set-intel_iommu_gfx_mapped-correctly
@@ -0,0 +1,49 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Thu, 2 May 2019 09:34:25 +0800
+Subject: iommu/vt-d: Set intel_iommu_gfx_mapped correctly
+Git-commit: cf1ec4539a50bdfe688caad4615ca47646884316
+References: bsc#1135008
+Patch-mainline: v5.2-rc1
+
+The intel_iommu_gfx_mapped flag is exported by the Intel
+IOMMU driver to indicate whether an IOMMU is used for the
+graphic device. In a virtualized IOMMU environment (e.g.
+QEMU), an include-all IOMMU is used for graphic device.
+This flag is found to be clear even the IOMMU is used.
+
+Cc: Ashok Raj <ashok.raj@intel.com>
+Cc: Jacob Pan <jacob.jun.pan@linux.intel.com>
+Cc: Kevin Tian <kevin.tian@intel.com>
+Reported-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.")
+Suggested-by: Kevin Tian <kevin.tian@intel.com>
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -4131,9 +4131,7 @@ static void __init init_no_remapping_dev
+
+ /* This IOMMU has *only* gfx devices. Either bypass it or
+ set the gfx_mapped flag, as appropriate */
+- if (dmar_map_gfx) {
+- intel_iommu_gfx_mapped = 1;
+- } else {
++ if (!dmar_map_gfx) {
+ drhd->ignored = 1;
+ for_each_active_dev_scope(drhd->devices,
+ drhd->devices_cnt, i, dev)
+@@ -4933,6 +4931,9 @@ int __init intel_iommu_init(void)
+ goto out_free_reserved_range;
+ }
+
++ if (dmar_map_gfx)
++ intel_iommu_gfx_mapped = 1;
++
+ init_no_remapping_devices();
+
+ ret = init_dmars();
+
diff --git a/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch b/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
index 60159f93ca..db21f5422c 100644
--- a/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
+++ b/patches.drivers/ipmi-ssif-compare-block-number-correctly-for-multi-p.patch
@@ -4,7 +4,7 @@ Date: Wed, 24 Apr 2019 11:50:43 +0000
Subject: [PATCH] ipmi:ssif: compare block number correctly for multi-part return messages
Git-commit: 55be8658c7e2feb11a5b5b33ee031791dbd23a69
Patch-mainline: v5.2-rc1
-References: bsc#1051510
+References: bsc#1051510, bsc#1135120
According to ipmi spec, block number is a number that is incremented,
starting with 0, for each new block of message data returned using the
diff --git a/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch b/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
new file mode 100644
index 0000000000..fd62d631a3
--- /dev/null
+++ b/patches.drivers/media-cx18-update-pos-correctly-in-cx18_read_pos.patch
@@ -0,0 +1,37 @@
+From 7afb0df554292dca7568446f619965fb8153085d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Feb 2019 01:37:02 -0500
+Subject: [PATCH] media: cx18: update *pos correctly in cx18_read_pos()
+Git-commit: 7afb0df554292dca7568446f619965fb8153085d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We should be updating *pos. The current code is a no-op.
+
+Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx18/cx18-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c
+index f778965a2eb8..59e78fb17575 100644
+--- a/drivers/media/pci/cx18/cx18-fileops.c
++++ b/drivers/media/pci/cx18/cx18-fileops.c
+@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf,
+
+ CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-cx23885-check-allocation-return.patch b/patches.drivers/media-cx23885-check-allocation-return.patch
new file mode 100644
index 0000000000..5dffa95e6c
--- /dev/null
+++ b/patches.drivers/media-cx23885-check-allocation-return.patch
@@ -0,0 +1,43 @@
+From a3d7f22ef34ec4206b50ee121384d5c8bebd5591 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sat, 19 Jan 2019 22:52:23 -0500
+Subject: [PATCH] media: cx23885: check allocation return
+Git-commit: a3d7f22ef34ec4206b50ee121384d5c8bebd5591
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Checking of kmalloc() seems to have been committed - as
+cx23885_dvb_register() is checking for != 0 return, returning
+-ENOMEM should be fine here. While at it address the coccicheck
+suggestion to move to kmemdup rather than using kmalloc+memcpy.
+
+Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
+index 0d0929c54f93..e2e63f05645e 100644
+--- a/drivers/media/pci/cx23885/cx23885-dvb.c
++++ b/drivers/media/pci/cx23885/cx23885-dvb.c
+@@ -1474,8 +1474,9 @@ static int dvb_register(struct cx23885_tsport *port)
+ if (fe0->dvb.frontend != NULL) {
+ struct i2c_adapter *tun_i2c;
+
+- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL);
+- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops));
++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL);
++ if (!fe0->dvb.frontend->sec_priv)
++ return -ENOMEM;
+ tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1);
+ if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config))
+ return -ENODEV;
+--
+2.16.4
+
diff --git a/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch b/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch
new file mode 100644
index 0000000000..b11b752246
--- /dev/null
+++ b/patches.drivers/media-davinci-isif-avoid-uninitialized-variable-use.patch
@@ -0,0 +1,78 @@
+From 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 22 Mar 2019 10:34:22 -0400
+Subject: [PATCH] media: davinci-isif: avoid uninitialized variable use
+Git-commit: 0e633f97162c1c74c68e2eb20bbd9259dce87cd9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+clang warns about a possible variable use that gcc never
+complained about:
+
+drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here
+ [-Werror,-Wuninitialized]
+ dm365_vpss_set_pg_frame_size(frame_size);
+ ^~~~~~~~~~
+drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here
+ struct vpss_pg_frame_size frame_size;
+ ^
+1 error generated.
+
+There is no initialization for this variable at all, and there
+has never been one in the mainline kernel, so we really should
+not put that stack data into an mmio register.
+
+On the other hand, I suspect that gcc checks the condition
+more closely and notices that the global
+isif_cfg.bayer.config_params.test_pat_gen flag is initialized
+to zero and never written to from any code path, so anything
+depending on it can be eliminated.
+
+To shut up the clang warning, just remove the dead code manually,
+it has probably never been used because any attempt to do so
+would have resulted in undefined behavior.
+
+Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/davinci/isif.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c
+index 47cecd10eb9f..2dee9af6d413 100644
+--- a/drivers/media/platform/davinci/isif.c
++++ b/drivers/media/platform/davinci/isif.c
+@@ -884,9 +884,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params)
+ static int isif_config_ycbcr(void)
+ {
+ struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
+- struct vpss_pg_frame_size frame_size;
+ u32 modeset = 0, ccdcfg = 0;
+- struct vpss_sync_pol sync;
+
+ dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
+
+@@ -974,13 +972,6 @@ static int isif_config_ycbcr(void)
+ /* two fields are interleaved in memory */
+ regw(0x00000249, SDOFST);
+
+- /* Setup test pattern if enabled */
+- if (isif_cfg.bayer.config_params.test_pat_gen) {
+- sync.ccdpg_hdpol = params->hd_pol;
+- sync.ccdpg_vdpol = params->vd_pol;
+- dm365_vpss_set_sync_pol(sync);
+- dm365_vpss_set_pg_frame_size(frame_size);
+- }
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch b/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
new file mode 100644
index 0000000000..fcdf04ad5c
--- /dev/null
+++ b/patches.drivers/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch
@@ -0,0 +1,37 @@
+From f8e579f3ca0973daef263f513da5edff520a6c0d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 22 Feb 2019 01:36:41 -0500
+Subject: [PATCH] media: ivtv: update *pos correctly in ivtv_read_pos()
+Git-commit: f8e579f3ca0973daef263f513da5edff520a6c0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We had intended to update *pos, but the current code is a no-op.
+
+Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/ivtv/ivtv-fileops.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
+index 6196daae4b3e..043ac0ae9ed0 100644
+--- a/drivers/media/pci/ivtv/ivtv-fileops.c
++++ b/drivers/media/pci/ivtv/ivtv-fileops.c
+@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co
+
+ IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
+ if (rc > 0)
+- pos += rc;
++ *pos += rc;
+ return rc;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch b/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
new file mode 100644
index 0000000000..5c64655395
--- /dev/null
+++ b/patches.drivers/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch
@@ -0,0 +1,39 @@
+From 384538bda10913e5c94ec5b5d34bd3075931bcf4 Mon Sep 17 00:00:00 2001
+From: Akinobu Mita <akinobu.mita@gmail.com>
+Date: Sat, 30 Mar 2019 10:01:32 -0400
+Subject: [PATCH] media: ov2659: fix unbalanced mutex_lock/unlock
+Git-commit: 384538bda10913e5c94ec5b5d34bd3075931bcf4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Avoid returning with mutex locked.
+
+Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API")
+
+Cc: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
+Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
+Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/ov2659.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c
+index a1e9a980a445..5ed2413eac8a 100644
+--- a/drivers/media/i2c/ov2659.c
++++ b/drivers/media/i2c/ov2659.c
+@@ -1132,7 +1132,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd,
+ mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad);
+ *mf = fmt->format;
+ #else
+- return -ENOTTY;
++ ret = -ENOTTY;
+ #endif
+ } else {
+ s64 val;
+--
+2.16.4
+
diff --git a/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch b/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch
new file mode 100644
index 0000000000..538bbec145
--- /dev/null
+++ b/patches.drivers/media-serial_ir-Fix-use-after-free-in-serial_ir_init.patch
@@ -0,0 +1,141 @@
+From 56cd26b618855c9af48c8301aa6754ced8dd0beb Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 5 Mar 2019 00:40:26 -0500
+Subject: [PATCH] media: serial_ir: Fix use-after-free in serial_ir_init_module
+Git-commit: 56cd26b618855c9af48c8301aa6754ced8dd0beb
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Syzkaller report this:
+
+Bug: KASAN: use-after-free in sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
+Read of size 8 at addr ffff8881dc7ae030 by task syz-executor.0/6249
+
+Cpu: 1 PID: 6249 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0xfa/0x1ce lib/dump_stack.c:113
+ print_address_description+0x65/0x270 mm/kasan/report.c:187
+ kasan_report+0x149/0x18d mm/kasan/report.c:317
+ ? 0xffffffffc1728000
+ sysfs_remove_file_ns+0x5f/0x70 fs/sysfs/file.c:468
+ sysfs_remove_file include/linux/sysfs.h:519 [inline]
+ driver_remove_file+0x40/0x50 drivers/base/driver.c:122
+ remove_bind_files drivers/base/bus.c:585 [inline]
+ bus_remove_driver+0x186/0x220 drivers/base/bus.c:725
+ driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
+ serial_ir_init_module+0x169/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+Rip: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+Rsp: 002b:00007f9450132c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
+Rax: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+Rdx: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000000003
+Rbp: 00007f9450132c70 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94501336bc
+R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004
+
+Allocated by task 6249:
+ set_track mm/kasan/common.c:85 [inline]
+ __kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:495
+ kmalloc include/linux/slab.h:545 [inline]
+ kzalloc include/linux/slab.h:740 [inline]
+ bus_add_driver+0xc0/0x610 drivers/base/bus.c:651
+ driver_register+0x1bb/0x3f0 drivers/base/driver.c:170
+ serial_ir_init_module+0xe8/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Freed by task 6249:
+ set_track mm/kasan/common.c:85 [inline]
+ __kasan_slab_free+0x130/0x180 mm/kasan/common.c:457
+ slab_free_hook mm/slub.c:1430 [inline]
+ slab_free_freelist_hook mm/slub.c:1457 [inline]
+ slab_free mm/slub.c:3005 [inline]
+ kfree+0xe1/0x270 mm/slub.c:3957
+ kobject_cleanup lib/kobject.c:662 [inline]
+ kobject_release lib/kobject.c:691 [inline]
+ kref_put include/linux/kref.h:67 [inline]
+ kobject_put+0x146/0x240 lib/kobject.c:708
+ bus_remove_driver+0x10e/0x220 drivers/base/bus.c:732
+ driver_unregister+0x6c/0xa0 drivers/base/driver.c:197
+ serial_ir_init_module+0x14c/0x1000 [serial_ir]
+ do_one_initcall+0xfa/0x5ca init/main.c:887
+ do_init_module+0x204/0x5f6 kernel/module.c:3460
+ load_module+0x66b2/0x8570 kernel/module.c:3808
+ __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+The buggy address belongs to the object at ffff8881dc7ae000
+ which belongs to the cache kmalloc-256 of size 256
+The buggy address is located 48 bytes inside of
+ 256-byte region [ffff8881dc7ae000, ffff8881dc7ae100)
+The buggy address belongs to the page:
+page:ffffea000771eb80 count:1 mapcount:0 mapping:ffff8881f6c02e00 index:0x0
+Flags: 0x2fffc0000000200(slab)
+Raw: 02fffc0000000200 ffffea0007d14800 0000000400000002 ffff8881f6c02e00
+Raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8881dc7adf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+ ffff8881dc7adf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+>ffff8881dc7ae000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881dc7ae080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881dc7ae100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
+
+There are already cleanup handlings in serial_ir_init error path,
+no need to call serial_ir_exit do it again in serial_ir_init_module,
+otherwise will trigger a use-after-free issue.
+
+Fixes: fa5dc29c1fcc ("[media] lirc_serial: move out of staging and rename to serial_ir")
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/rc/serial_ir.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+diff --git a/drivers/media/rc/serial_ir.c b/drivers/media/rc/serial_ir.c
+index ffe2c672d105..3998ba29beb6 100644
+--- a/drivers/media/rc/serial_ir.c
++++ b/drivers/media/rc/serial_ir.c
+@@ -773,8 +773,6 @@ static void serial_ir_exit(void)
+
+ static int __init serial_ir_init_module(void)
+ {
+- int result;
+-
+ switch (type) {
+ case IR_HOMEBREW:
+ case IR_IRDEO:
+@@ -802,12 +800,7 @@ static int __init serial_ir_init_module(void)
+ if (sense != -1)
+ sense = !!sense;
+
+- result = serial_ir_init();
+- if (!result)
+- return 0;
+-
+- serial_ir_exit();
+- return result;
++ return serial_ir_init();
+ }
+
+ static void __exit serial_ir_exit_module(void)
+--
+2.16.4
+
diff --git a/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch b/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch
new file mode 100644
index 0000000000..903cea3e5a
--- /dev/null
+++ b/patches.drivers/media-tw5864-Fix-possible-NULL-pointer-dereference-i.patch
@@ -0,0 +1,46 @@
+From 2e7682ebfc750177a4944eeb56e97a3f05734528 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Thu, 14 Mar 2019 22:01:24 -0400
+Subject: [PATCH] media: tw5864: Fix possible NULL pointer dereference in tw5864_handle_frame
+Git-commit: 2e7682ebfc750177a4944eeb56e97a3f05734528
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+'vb' null check should be done before dereferencing it in
+tw5864_handle_frame, otherwise a NULL pointer dereference
+may occur.
+
+Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/tw5864/tw5864-video.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c
+index 5a1f3aa4101a..434d313a3c15 100644
+--- a/drivers/media/pci/tw5864/tw5864-video.c
++++ b/drivers/media/pci/tw5864/tw5864-video.c
+@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame)
+ input->vb = NULL;
+ spin_unlock_irqrestore(&input->slock, flags);
+
+- v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
+-
+ if (!vb) { /* Gone because of disabling */
+ dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n");
+ return;
+ }
+
++ v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf);
++
+ /*
+ * Check for space.
+ * Mind the overhead of startcode emulation prevention.
+--
+2.16.4
+
diff --git a/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch b/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch
new file mode 100644
index 0000000000..7dbf7f646c
--- /dev/null
+++ b/patches.drivers/media-vivid-use-vfree-instead-of-kfree-for-dev-bitma.patch
@@ -0,0 +1,41 @@
+From dad7e270ba712ba1c99cd2d91018af6044447a06 Mon Sep 17 00:00:00 2001
+From: Alexander Potapenko <glider@google.com>
+Date: Thu, 4 Apr 2019 10:56:46 -0400
+Subject: [PATCH] media: vivid: use vfree() instead of kfree() for dev->bitmap_cap
+Git-commit: dad7e270ba712ba1c99cd2d91018af6044447a06
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+syzkaller reported crashes on kfree() called from
+vivid_vid_cap_s_selection(). This looks like a simple typo, as
+dev->bitmap_cap is allocated with vzalloc() throughout the file.
+
+Fixes: ef834f7836ec0 ("[media] vivid: add the video capture and output
+parts")
+
+Signed-off-by: Alexander Potapenko <glider@google.com>
+Reported-by: Syzbot <syzbot+6c0effb5877f6b0344e2@syzkaller.appspotmail.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/vivid/vivid-vid-cap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/vivid/vivid-vid-cap.c b/drivers/media/platform/vivid/vivid-vid-cap.c
+index 52eeda624d7e..530ac8decb25 100644
+--- a/drivers/media/platform/vivid/vivid-vid-cap.c
++++ b/drivers/media/platform/vivid/vivid-vid-cap.c
+@@ -1007,7 +1007,7 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection
+ v4l2_rect_map_inside(&s->r, &dev->fmt_cap_rect);
+ if (dev->bitmap_cap && (compose->width != s->r.width ||
+ compose->height != s->r.height)) {
+- kfree(dev->bitmap_cap);
++ vfree(dev->bitmap_cap);
+ dev->bitmap_cap = NULL;
+ }
+ *compose = s->r;
+--
+2.16.4
+
diff --git a/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch b/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch
new file mode 100644
index 0000000000..08ab610d26
--- /dev/null
+++ b/patches.drivers/media-wl128x-Fix-an-error-code-in-fm_download_firmwa.patch
@@ -0,0 +1,40 @@
+From ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 6 Mar 2019 02:27:43 -0500
+Subject: [PATCH] media: wl128x: Fix an error code in fm_download_firmware()
+Git-commit: ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+We forgot to set "ret" on this error path.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 3c8987af3772..1614809f7d35 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -1268,8 +1268,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
+
+ switch (action->type) {
+ case ACTION_SEND_COMMAND: /* Send */
+- if (fmc_send_cmd(fmdev, 0, 0, action->data,
+- action->size, NULL, NULL))
++ ret = fmc_send_cmd(fmdev, 0, 0, action->data,
++ action->size, NULL, NULL);
++ if (ret)
+ goto rel_fw;
+
+ cmd_cnt++;
+--
+2.16.4
+
diff --git a/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch b/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch
new file mode 100644
index 0000000000..238ca550b4
--- /dev/null
+++ b/patches.drivers/media-wl128x-prevent-two-potential-buffer-overflows.patch
@@ -0,0 +1,64 @@
+From 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 26 Mar 2019 01:12:07 -0400
+Subject: [PATCH] media: wl128x: prevent two potential buffer overflows
+Git-commit: 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
+can copy up to 255 bytes and we only have room for two bytes. Even
+if this comes from the firmware and we trust it, the new policy
+generally is just to fix it as kernel hardenning.
+
+I can't test this code so I tried to be very conservative. I considered
+not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
+whole variable but in the end I decided to allow it and manually
+initialized "asic_id" and "asic_ver" to zero.
+
+Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/radio/wl128x/fmdrv_common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
+index 1614809f7d35..a1fcb80a2191 100644
+--- a/drivers/media/radio/wl128x/fmdrv_common.c
++++ b/drivers/media/radio/wl128x/fmdrv_common.c
+@@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload,
+ return -EIO;
+ }
+ /* Send response data to caller */
+- if (response != NULL && response_len != NULL && evt_hdr->dlen) {
++ if (response != NULL && response_len != NULL && evt_hdr->dlen &&
++ evt_hdr->dlen <= payload_len) {
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+ memcpy(response, skb->data, evt_hdr->dlen);
+@@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
+ return;
+
+ fm_evt_hdr = (void *)skb->data;
++ if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag))
++ return;
+
+ /* Skip header info and copy only response data */
+ skb_pull(skb, sizeof(struct fm_event_msg_hdr));
+@@ -1309,7 +1312,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev)
+ static int fm_power_up(struct fmdev *fmdev, u8 mode)
+ {
+ u16 payload;
+- __be16 asic_id, asic_ver;
++ __be16 asic_id = 0, asic_ver = 0;
+ int resp_len, ret;
+ u8 fw_name[50];
+
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch b/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch
new file mode 100644
index 0000000000..1d78c24e1c
--- /dev/null
+++ b/patches.drivers/mtd-docg3-Fix-passing-zero-to-PTR_ERR-warning-in-doc.patch
@@ -0,0 +1,38 @@
+From 32937a82f36c7bbe08db4052de94bc7ade4e3c51 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 23 Jan 2019 14:58:27 +0800
+Subject: [PATCH] mtd: docg3: Fix passing zero to 'PTR_ERR' warning in doc_probe_device
+Git-commit: 32937a82f36c7bbe08db4052de94bc7ade4e3c51
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Fix a static code checker warning:
+drivers/mtd/devices/docg3.c:1875
+ doc_probe_device() warn: passing zero to 'ERR_PTR'
+
+Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/devices/docg3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 4c94fc096696..60ddc38a5431 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1872,7 +1872,7 @@ doc_probe_device(struct docg3_cascade *cascade, int floor, struct device *dev)
+ nomem2:
+ kfree(docg3);
+ nomem1:
+- return ERR_PTR(ret);
++ return ret ? ERR_PTR(ret) : NULL;
+ }
+
+ /**
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch b/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch
new file mode 100644
index 0000000000..cc6078d719
--- /dev/null
+++ b/patches.drivers/mtd-docg3-fix-a-possible-memory-leak-of-mtd-name.patch
@@ -0,0 +1,46 @@
+From b0dd77a796423ad3c609b6708260adca85a0798f Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 25 Jan 2019 10:12:42 +0800
+Subject: [PATCH] mtd: docg3: fix a possible memory leak of mtd->name
+Git-commit: b0dd77a796423ad3c609b6708260adca85a0798f
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+In case DOC_CHIPID_G3, mtd->name is not freed in err handling path,
+which is alloced by kasprintf(). Fix this by using devm_kasprintf().
+
+Fixes: ae9d4934b2d7 ("mtd: docg3: add multiple floor support")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Boris Brezillon <bbrezillon@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/devices/docg3.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/devices/docg3.c b/drivers/mtd/devices/docg3.c
+index 60ddc38a5431..7754803e3463 100644
+--- a/drivers/mtd/devices/docg3.c
++++ b/drivers/mtd/devices/docg3.c
+@@ -1767,8 +1767,8 @@ static int __init doc_set_driver_info(int chip_id, struct mtd_info *mtd)
+
+ switch (chip_id) {
+ case DOC_CHIPID_G3:
+- mtd->name = kasprintf(GFP_KERNEL, "docg3.%d",
+- docg3->device_id);
++ mtd->name = devm_kasprintf(docg3->dev, GFP_KERNEL, "docg3.%d",
++ docg3->device_id);
+ if (!mtd->name)
+ return -ENOMEM;
+ docg3->max_block = 2047;
+@@ -1886,7 +1886,6 @@ static void doc_release_device(struct mtd_info *mtd)
+ mtd_device_unregister(mtd);
+ kfree(docg3->bbt);
+ kfree(docg3);
+- kfree(mtd->name);
+ kfree(mtd);
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch b/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
new file mode 100644
index 0000000000..8caac6e39d
--- /dev/null
+++ b/patches.drivers/mtd-nand-omap-Fix-comment-in-platform-data-using-wro.patch
@@ -0,0 +1,34 @@
+From e90a619fb7e1acb5e18f1ab618c6d10b08f0fc70 Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Thu, 7 Feb 2019 15:28:24 +0100
+Subject: [PATCH] mtd: nand: omap: Fix comment in platform data using wrong Kconfig symbol
+Git-commit: e90a619fb7e1acb5e18f1ab618c6d10b08f0fc70
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The symbol that is being used in the #if/#endif block is not the one
+which is mentioned at the bottom.
+
+Fixes: 93af53b8633c ("nand: omap2: Remove horrible ifdefs to fix module probe")
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/platform_data/elm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/platform_data/elm.h b/include/linux/platform_data/elm.h
+index b8686c00f15f..fef4b081b736 100644
+--- a/include/linux/platform_data/elm.h
++++ b/include/linux/platform_data/elm.h
+@@ -60,6 +60,6 @@ static inline int elm_config(struct device *dev, enum bch_ecc bch_type,
+ {
+ return -ENOSYS;
+ }
+-#endif /* CONFIG_MTD_NAND_ECC_BCH */
++#endif /* CONFIG_MTD_NAND_OMAP_BCH */
+
+ #endif /* __ELM_H */
+--
+2.16.4
+
diff --git a/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch b/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
new file mode 100644
index 0000000000..053b532d9a
--- /dev/null
+++ b/patches.drivers/mtd-part-fix-incorrect-format-specifier-for-an-unsig.patch
@@ -0,0 +1,40 @@
+From 3008ba87093852f3756c5d33f584602e5e2a4aa4 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 31 Jan 2019 14:08:20 +0000
+Subject: [PATCH] mtd: part: fix incorrect format specifier for an unsigned long long
+Git-commit: 3008ba87093852f3756c5d33f584602e5e2a4aa4
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+An unsigned long long is being formatted with %lld instead of the unsigned
+version %llu. Fix this.
+
+Clean up cppcheck warning:
+%lld in format string (no. 1) requires 'long long' but the argument type
+is 'unsigned long long'.
+
+Fixes: a62c24d75529 ("mtd: part: Add sysfs variable for offset of partition")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mtd/mtdpart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index 37f174ccbcec..dfa241ad018b 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -572,7 +572,7 @@ static ssize_t mtd_partition_offset_show(struct device *dev,
+ {
+ struct mtd_info *mtd = dev_get_drvdata(dev);
+ struct mtd_part *part = mtd_to_part(mtd);
+- return snprintf(buf, PAGE_SIZE, "%lld\n", part->offset);
++ return snprintf(buf, PAGE_SIZE, "%llu\n", part->offset);
+ }
+
+ static DEVICE_ATTR(offset, S_IRUGO, mtd_partition_offset_show, NULL);
+--
+2.16.4
+
diff --git a/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch b/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch
new file mode 100644
index 0000000000..f91883fe2c
--- /dev/null
+++ b/patches.drivers/net-ibmvnic-Update-MAC-address-settings-after-adapte.patch
@@ -0,0 +1,160 @@
+From 62740e97881c78b45a117a358a866fb32975def6 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 9 May 2019 23:13:43 -0500
+Subject: [PATCH] net/ibmvnic: Update MAC address settings after adapter reset
+
+References: bsc#1134760
+Patch-mainline: v5.2-rc1
+Git-commit: 62740e97881c78b45a117a358a866fb32975def6
+
+It was discovered in testing that the underlying hardware MAC
+address will revert to initial settings following a device reset,
+but the driver fails to resend the current OS MAC settings. This
+oversight can result in dropped packets should the scenario occur.
+Fix this by informing hardware of current MAC address settings
+following any adapter initialization or resets.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 53 ++++++++++++++++--------------
+ drivers/net/ethernet/ibm/ibmvnic.h | 2 --
+ 2 files changed, 28 insertions(+), 27 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index b398d6c94dbd..2be3bcd0192f 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -118,7 +118,7 @@ static int init_sub_crq_irqs(struct ibmvnic_adapter *adapter);
+ static int ibmvnic_init(struct ibmvnic_adapter *);
+ static int ibmvnic_reset_init(struct ibmvnic_adapter *);
+ static void release_crq_queue(struct ibmvnic_adapter *);
+-static int __ibmvnic_set_mac(struct net_device *netdev, struct sockaddr *p);
++static int __ibmvnic_set_mac(struct net_device *, u8 *);
+ static int init_crq_queue(struct ibmvnic_adapter *adapter);
+ static int send_query_phys_parms(struct ibmvnic_adapter *adapter);
+
+@@ -849,11 +849,7 @@ static int ibmvnic_login(struct net_device *netdev)
+ }
+ } while (retry);
+
+- /* handle pending MAC address changes after successful login */
+- if (adapter->mac_change_pending) {
+- __ibmvnic_set_mac(netdev, &adapter->desired.mac);
+- adapter->mac_change_pending = false;
+- }
++ __ibmvnic_set_mac(netdev, adapter->mac_addr);
+
+ return 0;
+ }
+@@ -1686,28 +1682,40 @@ static void ibmvnic_set_multi(struct net_device *netdev)
+ }
+ }
+
+-static int __ibmvnic_set_mac(struct net_device *netdev, struct sockaddr *p)
++static int __ibmvnic_set_mac(struct net_device *netdev, u8 *dev_addr)
+ {
+ struct ibmvnic_adapter *adapter = netdev_priv(netdev);
+- struct sockaddr *addr = p;
+ union ibmvnic_crq crq;
+ int rc;
+
+- if (!is_valid_ether_addr(addr->sa_data))
+- return -EADDRNOTAVAIL;
++ if (!is_valid_ether_addr(dev_addr)) {
++ rc = -EADDRNOTAVAIL;
++ goto err;
++ }
+
+ memset(&crq, 0, sizeof(crq));
+ crq.change_mac_addr.first = IBMVNIC_CRQ_CMD;
+ crq.change_mac_addr.cmd = CHANGE_MAC_ADDR;
+- ether_addr_copy(&crq.change_mac_addr.mac_addr[0], addr->sa_data);
++ ether_addr_copy(&crq.change_mac_addr.mac_addr[0], dev_addr);
+
+ init_completion(&adapter->fw_done);
+ rc = ibmvnic_send_crq(adapter, &crq);
+- if (rc)
+- return rc;
++ if (rc) {
++ rc = -EIO;
++ goto err;
++ }
++
+ wait_for_completion(&adapter->fw_done);
+ /* netdev->dev_addr is changed in handle_change_mac_rsp function */
+- return adapter->fw_done_rc ? -EIO : 0;
++ if (adapter->fw_done_rc) {
++ rc = -EIO;
++ goto err;
++ }
++
++ return 0;
++err:
++ ether_addr_copy(adapter->mac_addr, netdev->dev_addr);
++ return rc;
+ }
+
+ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
+@@ -1716,13 +1724,10 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
+ struct sockaddr *addr = p;
+ int rc;
+
+- if (adapter->state == VNIC_PROBED) {
+- memcpy(&adapter->desired.mac, addr, sizeof(struct sockaddr));
+- adapter->mac_change_pending = true;
+- return 0;
+- }
+-
+- rc = __ibmvnic_set_mac(netdev, addr);
++ rc = 0;
++ ether_addr_copy(adapter->mac_addr, addr->sa_data);
++ if (adapter->state != VNIC_PROBED)
++ rc = __ibmvnic_set_mac(netdev, addr->sa_data);
+
+ return rc;
+ }
+@@ -3937,8 +3942,8 @@ static int handle_change_mac_rsp(union ibmvnic_crq *crq,
+ dev_err(dev, "Error %ld in CHANGE_MAC_ADDR_RSP\n", rc);
+ goto out;
+ }
+- memcpy(netdev->dev_addr, &crq->change_mac_addr_rsp.mac_addr[0],
+- ETH_ALEN);
++ ether_addr_copy(netdev->dev_addr,
++ &crq->change_mac_addr_rsp.mac_addr[0]);
+ out:
+ complete(&adapter->fw_done);
+ return rc;
+@@ -4852,8 +4857,6 @@ static int ibmvnic_probe(struct vio_dev *dev, const struct vio_device_id *id)
+ init_completion(&adapter->init_done);
+ adapter->resetting = false;
+
+- adapter->mac_change_pending = false;
+-
+ do {
+ rc = init_crq_queue(adapter);
+ if (rc) {
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
+index cffdac372a33..dcf2eb6d9290 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.h
++++ b/drivers/net/ethernet/ibm/ibmvnic.h
+@@ -969,7 +969,6 @@ struct ibmvnic_tunables {
+ u64 rx_entries;
+ u64 tx_entries;
+ u64 mtu;
+- struct sockaddr mac;
+ };
+
+ struct ibmvnic_adapter {
+@@ -1091,7 +1090,6 @@ struct ibmvnic_adapter {
+ bool resetting;
+ bool napi_enabled, from_passive_init;
+
+- bool mac_change_pending;
+ bool failover_pending;
+ bool force_reset_recovery;
+
+--
+2.20.1
+
diff --git a/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch b/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch
new file mode 100644
index 0000000000..5acb3e95be
--- /dev/null
+++ b/patches.drivers/net-ibmvnic-Update-carrier-state-after-link-state-ch.patch
@@ -0,0 +1,66 @@
+From 0655f9943df2f2d71f406fd77b51d05548134fc2 Mon Sep 17 00:00:00 2001
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Thu, 9 May 2019 23:13:44 -0500
+Subject: [PATCH] net/ibmvnic: Update carrier state after link state change
+
+References: bsc#1135100
+Patch-mainline: v5.2-rc1
+Git-commit: 0655f9943df2f2d71f406fd77b51d05548134fc2
+
+Only set the device carrier state to on after receiving an up link
+state indication from the underlying adapter. Likewise, if a down
+link indication is receieved, update the carrier state accordingly.
+This fix ensures that accurate carrier state is reported by the driver
+following a link state update by the underlying adapter.
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 2be3bcd0192f..3dcd9c3d8781 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1111,7 +1111,6 @@ static int ibmvnic_open(struct net_device *netdev)
+ }
+
+ rc = __ibmvnic_open(netdev);
+- netif_carrier_on(netdev);
+
+ return rc;
+ }
+@@ -1864,8 +1863,6 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
+ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
+
+- netif_carrier_on(netdev);
+-
+ return 0;
+ }
+
+@@ -1935,8 +1932,6 @@ static int do_hard_reset(struct ibmvnic_adapter *adapter,
+ return 0;
+ }
+
+- netif_carrier_on(netdev);
+-
+ return 0;
+ }
+
+@@ -4480,6 +4475,10 @@ static void ibmvnic_handle_crq(union ibmvnic_crq *crq,
+ crq->link_state_indication.phys_link_state;
+ adapter->logical_link_state =
+ crq->link_state_indication.logical_link_state;
++ if (adapter->phys_link_state && adapter->logical_link_state)
++ netif_carrier_on(netdev);
++ else
++ netif_carrier_off(netdev);
+ break;
+ case CHANGE_MAC_ADDR_RSP:
+ netdev_dbg(netdev, "Got MAC address change Response\n");
+--
+2.20.1
+
diff --git a/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch b/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch
new file mode 100644
index 0000000000..40a103d589
--- /dev/null
+++ b/patches.drivers/omapfb-add-missing-of_node_put-after-of_device_is_av.patch
@@ -0,0 +1,64 @@
+From 787a79230a0f9984e59549b9baa4daf274973a0d Mon Sep 17 00:00:00 2001
+From: Julia Lawall <Julia.Lawall@lip6.fr>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: [PATCH] omapfb: add missing of_node_put after of_device_is_available
+Git-commit: 787a79230a0f9984e59549b9baa4daf274973a0d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Add an of_node_put when a tested device node is not available.
+
+The semantic patch that fixes this problem is as follows
+(http://coccinelle.lip6.fr):
+
+// <smpl>
+@@
+identifier f;
+local idexpression e;
+expression x;
+@@
+
+e = f(...);
+... when != of_node_put(e)
+ when != x = e
+ when != e = x
+ when any
+if (<+...of_device_is_available(e)...+>) {
+ ... when != of_node_put(e)
+(
+ return e;
+|
++ of_node_put(e);
+ return ...;
+)
+}
+// </smpl>
+
+Fixes: f76ee892a99e6 ("omapfb: copy omapdss & displays for omapfb")
+Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
+index 136d30484d02..cb6acbac9c47 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/omapdss-boot-init.c
+@@ -193,8 +193,10 @@ static int __init omapdss_boot_init(void)
+
+ dss = of_find_matching_node(NULL, omapdss_of_match);
+
+- if (dss == NULL || !of_device_is_available(dss))
++ if (dss == NULL || !of_device_is_available(dss)) {
++ of_node_put(dss);
+ return 0;
++ }
+
+ omapdss_walk_device(dss, true);
+
+--
+2.16.4
+
diff --git a/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch b/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch
new file mode 100644
index 0000000000..84e3a9aa93
--- /dev/null
+++ b/patches.drivers/phy-sun4i-usb-Make-sure-to-disable-PHY0-passby-for-p.patch
@@ -0,0 +1,50 @@
+From e6f32efb1b128344a2c7df9875bc1a1abaa1d395 Mon Sep 17 00:00:00 2001
+From: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Date: Thu, 14 Mar 2019 14:05:18 +0100
+Subject: [PATCH] phy: sun4i-usb: Make sure to disable PHY0 passby for peripheral mode
+Git-commit: e6f32efb1b128344a2c7df9875bc1a1abaa1d395
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+On platforms where the MUSB and HCI controllers share PHY0, PHY passby
+is required when using the HCI controller with the PHY, but it must be
+disabled when the MUSB controller is used instead.
+
+Without this, PHY0 passby is always enabled, which results in broken
+peripheral mode on such platforms (e.g. H3/H5).
+
+Fixes: ba4bdc9e1dc0 ("PHY: sunxi: Add driver for sunxi usb phy")
+
+Signed-off-by: Paul Kocialkowski <paul.kocialkowski@bootlin.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/phy/allwinner/phy-sun4i-usb.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c
+index 5163097b43df..7b23920e0068 100644
+--- a/drivers/phy/allwinner/phy-sun4i-usb.c
++++ b/drivers/phy/allwinner/phy-sun4i-usb.c
+@@ -551,6 +551,7 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ struct sun4i_usb_phy_data *data =
+ container_of(work, struct sun4i_usb_phy_data, detect.work);
+ struct phy *phy0 = data->phys[0].phy;
++ struct sun4i_usb_phy *phy = phy_get_drvdata(phy0);
+ bool force_session_end, id_notify = false, vbus_notify = false;
+ int id_det, vbus_det;
+
+@@ -607,6 +608,9 @@ static void sun4i_usb_phy0_id_vbus_det_scan(struct work_struct *work)
+ mutex_unlock(&phy0->mutex);
+ }
+
++ /* Enable PHY0 passby for host mode only. */
++ sun4i_usb_phy_passby(phy, !id_det);
++
+ /* Re-route PHY0 if necessary */
+ if (data->cfg->phy0_dual_route)
+ sun4i_usb_phy0_reroute(data, id_det);
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch b/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
new file mode 100644
index 0000000000..e0e651a6f1
--- /dev/null
+++ b/patches.drivers/platform-x86-alienware-wmi-printing-the-wrong-error-.patch
@@ -0,0 +1,38 @@
+From 6d1f8b3d75419a8659ac916a1e9543bb3513a882 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 24 Apr 2019 12:44:18 +0300
+Subject: [PATCH] platform/x86: alienware-wmi: printing the wrong error code
+Git-commit: 6d1f8b3d75419a8659ac916a1e9543bb3513a882
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The "out_data" variable is uninitialized at the point. Originally, this
+used to print "status" instead and that seems like the correct thing to
+print.
+
+Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@dell.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/alienware-wmi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index c0d1555735cd..83fd7677af24 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -587,7 +587,7 @@ static ssize_t show_hdmi_source(struct device *dev,
+ return scnprintf(buf, PAGE_SIZE,
+ "input [gpu] unknown\n");
+ }
+- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
+ return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch b/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch
new file mode 100644
index 0000000000..de90109446
--- /dev/null
+++ b/patches.drivers/platform-x86-dell-rbtn-Add-missing-include.patch
@@ -0,0 +1,45 @@
+From e28f296ea155da36f710eb1f1173d8780fbac49d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Valdis=20Kl=20=C4=93=20tnieks?= <valdis.kletnieks@vt.edu>
+Date: Tue, 12 Mar 2019 07:26:06 -0400
+Subject: [PATCH] platform/x86: dell-rbtn: Add missing #include
+Git-commit: e28f296ea155da36f710eb1f1173d8780fbac49d
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Building with W=1 complains:
+ CC [M] drivers/platform/x86/dell-rbtn.o
+drivers/platform/x86/dell-rbtn.c:345:5: warning: no previous prototype for 'dell_rbtn_notifier_register' [-Wmissing-prototypes]
+ 345 | int dell_rbtn_notifier_register(struct notifier_block *nb)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/platform/x86/dell-rbtn.c:371:5: warning: no previous prototype for 'dell_rbtn_notifier_unregister' [-Wmissing-prototypes]
+ 371 | int dell_rbtn_notifier_unregister(struct notifier_block *nb)
+ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The real problem is a missing include. Add it to keep dell-rbtn.c and .h in sync.
+
+Fixes: b05ffc95f9ed ("dell-rbtn: Export notifier for other kernel modules")
+Signed-off-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
+[andy: massaged commit message, added Fixes tag]
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/dell-rbtn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/platform/x86/dell-rbtn.c b/drivers/platform/x86/dell-rbtn.c
+index f3afe778001e..56535d7222dd 100644
+--- a/drivers/platform/x86/dell-rbtn.c
++++ b/drivers/platform/x86/dell-rbtn.c
+@@ -18,6 +18,8 @@
+ #include <linux/rfkill.h>
+ #include <linux/input.h>
+
++#include "dell-rbtn.h"
++
+ enum rbtn_type {
+ RBTN_UNKNOWN,
+ RBTN_TOGGLE,
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch b/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch
new file mode 100644
index 0000000000..16ef664c18
--- /dev/null
+++ b/patches.drivers/platform-x86-intel_pmc_ipc-adding-error-handling.patch
@@ -0,0 +1,49 @@
+From e61985d0550df8c2078310202aaad9b41049c36c Mon Sep 17 00:00:00 2001
+From: Junxiao Chang <junxiao.chang@intel.com>
+Date: Mon, 8 Apr 2019 17:40:22 +0800
+Subject: [PATCH] platform/x86: intel_pmc_ipc: adding error handling
+Git-commit: e61985d0550df8c2078310202aaad9b41049c36c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+If punit or telemetry device initialization fails, pmc driver should
+unregister and return failure.
+
+This change is to fix a kernel panic when removing kernel module
+intel_pmc_ipc.
+
+Fixes: 48c1917088ba ("platform:x86: Add Intel telemetry platform device")
+Signed-off-by: Junxiao Chang <junxiao.chang@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/intel_pmc_ipc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/intel_pmc_ipc.c b/drivers/platform/x86/intel_pmc_ipc.c
+index 7964ba22ef8d..d37cbd1cf58c 100644
+--- a/drivers/platform/x86/intel_pmc_ipc.c
++++ b/drivers/platform/x86/intel_pmc_ipc.c
+@@ -771,13 +771,17 @@ static int ipc_create_pmc_devices(void)
+ if (ret) {
+ dev_err(ipcdev.dev, "Failed to add punit platform device\n");
+ platform_device_unregister(ipcdev.tco_dev);
++ return ret;
+ }
+
+ if (!ipcdev.telem_res_inval) {
+ ret = ipc_create_telemetry_device();
+- if (ret)
++ if (ret) {
+ dev_warn(ipcdev.dev,
+ "Failed to add telemetry platform device\n");
++ platform_device_unregister(ipcdev.punit_dev);
++ platform_device_unregister(ipcdev.tco_dev);
++ }
+ }
+
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch b/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch
new file mode 100644
index 0000000000..b650374073
--- /dev/null
+++ b/patches.drivers/platform-x86-intel_punit_ipc-Revert-Fix-resource-ior.patch
@@ -0,0 +1,61 @@
+From 0e5e80043b0db4c292aaf0ea86415da6193f861a Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 9 Apr 2019 14:25:15 +0300
+Subject: [PATCH] platform/x86: intel_punit_ipc: Revert "Fix resource ioremap warning"
+Git-commit: 0e5e80043b0db4c292aaf0ea86415da6193f861a
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Since we have a proper fix for intel_pmc_ipc driver for resource management,
+get rid of unneeded commit in the intel_punit_ipc driver.
+
+This reverts commit 6cc8cbbc8868033f279b63e98b26b75eaa0006ab.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/intel_punit_ipc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c
+index 79671927f4ef..ab7ae1950867 100644
+--- a/drivers/platform/x86/intel_punit_ipc.c
++++ b/drivers/platform/x86/intel_punit_ipc.c
+@@ -252,28 +252,28 @@ static int intel_punit_get_bars(struct platform_device *pdev)
+ * - GTDRIVER_IPC BASE_IFACE
+ */
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 2);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[ISPDRIVER_IPC][BASE_DATA] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 3);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[ISPDRIVER_IPC][BASE_IFACE] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 4);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[GTDRIVER_IPC][BASE_DATA] = addr;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 5);
+- if (res && resource_size(res) > 1) {
++ if (res) {
+ addr = devm_ioremap_resource(&pdev->dev, res);
+ if (!IS_ERR(addr))
+ punit_ipcdev->base[GTDRIVER_IPC][BASE_IFACE] = addr;
+--
+2.16.4
+
diff --git a/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch b/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch
new file mode 100644
index 0000000000..b8e921de15
--- /dev/null
+++ b/patches.drivers/platform-x86-sony-laptop-Fix-unintentional-fall-thro.patch
@@ -0,0 +1,57 @@
+From 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Wed, 24 Apr 2019 13:09:34 -0500
+Subject: [PATCH] platform/x86: sony-laptop: Fix unintentional fall-through
+Git-commit: 1cbd7a64959d33e7a2a1fa2bf36a62b350a9fcbd
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It seems that the default case should return AE_CTRL_TERMINATE, instead
+of falling through to case ACPI_RESOURCE_TYPE_END_TAG and returning AE_OK;
+otherwise the line of code at the end of the function is unreachable and
+makes no sense:
+
+return AE_CTRL_TERMINATE;
+
+This fix is based on the following thread of discussion:
+
+https://lore.kernel.org/patchwork/patch/959782/
+
+Fixes: 33a04454527e ("sony-laptop: Add SNY6001 device handling (sonypi reimplementation)")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/platform/x86/sony-laptop.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
+index 4bfbfa3f78e6..2058445fc456 100644
+--- a/drivers/platform/x86/sony-laptop.c
++++ b/drivers/platform/x86/sony-laptop.c
+@@ -4424,14 +4424,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
+ }
+ return AE_OK;
+ }
++
++ case ACPI_RESOURCE_TYPE_END_TAG:
++ return AE_OK;
++
+ default:
+ dprintk("Resource %d isn't an IRQ nor an IO port\n",
+ resource->type);
++ return AE_CTRL_TERMINATE;
+
+- case ACPI_RESOURCE_TYPE_END_TAG:
+- return AE_OK;
+ }
+- return AE_CTRL_TERMINATE;
+ }
+
+ static int sony_pic_possible_resources(struct acpi_device *device)
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch b/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
new file mode 100644
index 0000000000..3ef35ff60f
--- /dev/null
+++ b/patches.drivers/pwm-Fix-deadlock-warning-when-removing-PWM-device.patch
@@ -0,0 +1,277 @@
+From 347ab9480313737c0f1aaa08e8f2e1a791235535 Mon Sep 17 00:00:00 2001
+From: Phong Hoang <phong.hoang.wz@renesas.com>
+Date: Tue, 19 Mar 2019 19:40:08 +0900
+Subject: [PATCH] pwm: Fix deadlock warning when removing PWM device
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 347ab9480313737c0f1aaa08e8f2e1a791235535
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This patch fixes deadlock warning if removing PWM device
+when CONFIG_PROVE_LOCKING is enabled.
+
+This issue can be reproceduced by the following steps on
+the R-Car H3 Salvator-X board if the backlight is disabled:
+
+ # cd /sys/class/pwm/pwmchip0
+ # echo 0 > export
+ # ls
+ device export npwm power pwm0 subsystem uevent unexport
+ # cd device/driver
+ # ls
+ bind e6e31000.pwm uevent unbind
+ # echo e6e31000.pwm > unbind
+
+[ 87.659974] ======================================================
+[ 87.666149] WARNING: possible circular locking dependency detected
+[ 87.672327] 5.0.0 #7 Not tainted
+[ 87.675549] ------------------------------------------------------
+[ 87.681723] bash/2986 is trying to acquire lock:
+[ 87.686337] 000000005ea0e178 (kn->count#58){++++}, at: kernfs_remove_by_name_ns+0x50/0xa0
+[ 87.694528]
+[ 87.694528] but task is already holding lock:
+[ 87.700353] 000000006313b17c (pwm_lock){+.+.}, at: pwmchip_remove+0x28/0x13c
+[ 87.707405]
+[ 87.707405] which lock already depends on the new lock.
+[ 87.707405]
+[ 87.715574]
+[ 87.715574] the existing dependency chain (in reverse order) is:
+[ 87.723048]
+[ 87.723048] -> #1 (pwm_lock){+.+.}:
+[ 87.728017] __mutex_lock+0x70/0x7e4
+[ 87.732108] mutex_lock_nested+0x1c/0x24
+[ 87.736547] pwm_request_from_chip.part.6+0x34/0x74
+[ 87.741940] pwm_request_from_chip+0x20/0x40
+[ 87.746725] export_store+0x6c/0x1f4
+[ 87.750820] dev_attr_store+0x18/0x28
+[ 87.754998] sysfs_kf_write+0x54/0x64
+[ 87.759175] kernfs_fop_write+0xe4/0x1e8
+[ 87.763615] __vfs_write+0x40/0x184
+[ 87.767619] vfs_write+0xa8/0x19c
+[ 87.771448] ksys_write+0x58/0xbc
+[ 87.775278] __arm64_sys_write+0x18/0x20
+[ 87.779721] el0_svc_common+0xd0/0x124
+[ 87.783986] el0_svc_compat_handler+0x1c/0x24
+[ 87.788858] el0_svc_compat+0x8/0x18
+[ 87.792947]
+[ 87.792947] -> #0 (kn->count#58){++++}:
+[ 87.798260] lock_acquire+0xc4/0x22c
+[ 87.802353] __kernfs_remove+0x258/0x2c4
+[ 87.806790] kernfs_remove_by_name_ns+0x50/0xa0
+[ 87.811836] remove_files.isra.1+0x38/0x78
+[ 87.816447] sysfs_remove_group+0x48/0x98
+[ 87.820971] sysfs_remove_groups+0x34/0x4c
+[ 87.825583] device_remove_attrs+0x6c/0x7c
+[ 87.830197] device_del+0x11c/0x33c
+[ 87.834201] device_unregister+0x14/0x2c
+[ 87.838638] pwmchip_sysfs_unexport+0x40/0x4c
+[ 87.843509] pwmchip_remove+0xf4/0x13c
+[ 87.847773] rcar_pwm_remove+0x28/0x34
+[ 87.852039] platform_drv_remove+0x24/0x64
+[ 87.856651] device_release_driver_internal+0x18c/0x21c
+[ 87.862391] device_release_driver+0x14/0x1c
+[ 87.867175] unbind_store+0xe0/0x124
+[ 87.871265] drv_attr_store+0x20/0x30
+[ 87.875442] sysfs_kf_write+0x54/0x64
+[ 87.879618] kernfs_fop_write+0xe4/0x1e8
+[ 87.884055] __vfs_write+0x40/0x184
+[ 87.888057] vfs_write+0xa8/0x19c
+[ 87.891887] ksys_write+0x58/0xbc
+[ 87.895716] __arm64_sys_write+0x18/0x20
+[ 87.900154] el0_svc_common+0xd0/0x124
+[ 87.904417] el0_svc_compat_handler+0x1c/0x24
+[ 87.909289] el0_svc_compat+0x8/0x18
+[ 87.913378]
+[ 87.913378] other info that might help us debug this:
+[ 87.913378]
+[ 87.921374] Possible unsafe locking scenario:
+[ 87.921374]
+[ 87.927286] CPU0 CPU1
+[ 87.931808] ---- ----
+[ 87.936331] lock(pwm_lock);
+[ 87.939293] lock(kn->count#58);
+[ 87.945120] lock(pwm_lock);
+[ 87.950599] lock(kn->count#58);
+[ 87.953908]
+[ 87.953908] *** DEADLOCK ***
+[ 87.953908]
+[ 87.959821] 4 locks held by bash/2986:
+[ 87.963563] #0: 00000000ace7bc30 (sb_writers#6){.+.+}, at: vfs_write+0x188/0x19c
+[ 87.971044] #1: 00000000287991b2 (&of->mutex){+.+.}, at: kernfs_fop_write+0xb4/0x1e8
+[ 87.978872] #2: 00000000f739d016 (&dev->mutex){....}, at: device_release_driver_internal+0x40/0x21c
+[ 87.988001] #3: 000000006313b17c (pwm_lock){+.+.}, at: pwmchip_remove+0x28/0x13c
+[ 87.995481]
+[ 87.995481] stack backtrace:
+[ 87.999836] CPU: 0 PID: 2986 Comm: bash Not tainted 5.0.0 #7
+[ 88.005489] Hardware name: Renesas Salvator-X board based on r8a7795 ES1.x (DT)
+[ 88.012791] Call trace:
+[ 88.015235] dump_backtrace+0x0/0x190
+[ 88.018891] show_stack+0x14/0x1c
+[ 88.022204] dump_stack+0xb0/0xec
+[ 88.025514] print_circular_bug.isra.32+0x1d0/0x2e0
+[ 88.030385] __lock_acquire+0x1318/0x1864
+[ 88.034388] lock_acquire+0xc4/0x22c
+[ 88.037958] __kernfs_remove+0x258/0x2c4
+[ 88.041874] kernfs_remove_by_name_ns+0x50/0xa0
+[ 88.046398] remove_files.isra.1+0x38/0x78
+[ 88.050487] sysfs_remove_group+0x48/0x98
+[ 88.054490] sysfs_remove_groups+0x34/0x4c
+[ 88.058580] device_remove_attrs+0x6c/0x7c
+[ 88.062671] device_del+0x11c/0x33c
+[ 88.066154] device_unregister+0x14/0x2c
+[ 88.070070] pwmchip_sysfs_unexport+0x40/0x4c
+[ 88.074421] pwmchip_remove+0xf4/0x13c
+[ 88.078163] rcar_pwm_remove+0x28/0x34
+[ 88.081906] platform_drv_remove+0x24/0x64
+[ 88.085996] device_release_driver_internal+0x18c/0x21c
+[ 88.091215] device_release_driver+0x14/0x1c
+[ 88.095478] unbind_store+0xe0/0x124
+[ 88.099048] drv_attr_store+0x20/0x30
+[ 88.102704] sysfs_kf_write+0x54/0x64
+[ 88.106359] kernfs_fop_write+0xe4/0x1e8
+[ 88.110275] __vfs_write+0x40/0x184
+[ 88.113757] vfs_write+0xa8/0x19c
+[ 88.117065] ksys_write+0x58/0xbc
+[ 88.120374] __arm64_sys_write+0x18/0x20
+[ 88.124291] el0_svc_common+0xd0/0x124
+[ 88.128034] el0_svc_compat_handler+0x1c/0x24
+[ 88.132384] el0_svc_compat+0x8/0x18
+
+The sysfs unexport in pwmchip_remove() is completely asymmetric
+to what we do in pwmchip_add_with_polarity() and commit 0733424c9ba9
+("pwm: Unexport children before chip removal") is a strong indication
+that this was wrong to begin with. We should just move
+pwmchip_sysfs_unexport() where it belongs, which is right after
+pwmchip_sysfs_unexport_children(). In that case, we do not need
+separate functions anymore either.
+
+We also really want to remove sysfs irrespective of whether or not
+the chip will be removed as a result of pwmchip_remove(). We can only
+assume that the driver will be gone after that, so we shouldn't leave
+any dangling sysfs files around.
+
+This warning disappears if we move pwmchip_sysfs_unexport() to
+the top of pwmchip_remove(), pwmchip_sysfs_unexport_children().
+That way it is also outside of the pwm_lock section, which indeed
+doesn't seem to be needed.
+
+Moving the pwmchip_sysfs_export() call outside of that section also
+seems fine and it'd be perfectly symmetric with pwmchip_remove() again.
+
+So, this patch fixes them.
+
+Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
+[shimoda: revise the commit log and code]
+Fixes: 76abbdde2d95 ("pwm: Add sysfs interface")
+Fixes: 0733424c9ba9 ("pwm: Unexport children before chip removal")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Tested-by: Hoan Nguyen An <na-hoan@jinso.co.jp>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/core.c | 10 +++++-----
+ drivers/pwm/sysfs.c | 14 +-------------
+ include/linux/pwm.h | 5 -----
+ 3 files changed, 6 insertions(+), 23 deletions(-)
+
+diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
+index 3149204567f3..8c9200a0df5e 100644
+--- a/drivers/pwm/core.c
++++ b/drivers/pwm/core.c
+@@ -311,10 +311,12 @@ int pwmchip_add_with_polarity(struct pwm_chip *chip,
+ if (IS_ENABLED(CONFIG_OF))
+ of_pwmchip_add(chip);
+
+- pwmchip_sysfs_export(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
++
++ if (!ret)
++ pwmchip_sysfs_export(chip);
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(pwmchip_add_with_polarity);
+@@ -348,7 +350,7 @@ int pwmchip_remove(struct pwm_chip *chip)
+ unsigned int i;
+ int ret = 0;
+
+- pwmchip_sysfs_unexport_children(chip);
++ pwmchip_sysfs_unexport(chip);
+
+ mutex_lock(&pwm_lock);
+
+@@ -368,8 +370,6 @@ int pwmchip_remove(struct pwm_chip *chip)
+
+ free_pwms(chip);
+
+- pwmchip_sysfs_unexport(chip);
+-
+ out:
+ mutex_unlock(&pwm_lock);
+ return ret;
+diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
+index ceb233dd6048..13d9bd54dfce 100644
+--- a/drivers/pwm/sysfs.c
++++ b/drivers/pwm/sysfs.c
+@@ -409,19 +409,6 @@ void pwmchip_sysfs_export(struct pwm_chip *chip)
+ }
+
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+-{
+- struct device *parent;
+-
+- parent = class_find_device(&pwm_class, NULL, chip,
+- pwmchip_sysfs_match);
+- if (parent) {
+- /* for class_find_device() */
+- put_device(parent);
+- device_unregister(parent);
+- }
+-}
+-
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ {
+ struct device *parent;
+ unsigned int i;
+@@ -439,6 +426,7 @@ void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+ }
+
+ put_device(parent);
++ device_unregister(parent);
+ }
+
+ static int __init pwm_sysfs_init(void)
+diff --git a/include/linux/pwm.h b/include/linux/pwm.h
+index b628abfffacc..eaa5c6e3fc9f 100644
+--- a/include/linux/pwm.h
++++ b/include/linux/pwm.h
+@@ -596,7 +596,6 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num)
+ #ifdef CONFIG_PWM_SYSFS
+ void pwmchip_sysfs_export(struct pwm_chip *chip);
+ void pwmchip_sysfs_unexport(struct pwm_chip *chip);
+-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
+ #else
+ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ {
+@@ -605,10 +604,6 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
+ static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
+ {
+ }
+-
+-static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
+-{
+-}
+ #endif /* CONFIG_PWM_SYSFS */
+
+ #endif /* __LINUX_PWM_H */
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch b/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
new file mode 100644
index 0000000000..ea93de3c0f
--- /dev/null
+++ b/patches.drivers/pwm-meson-Consider-128-a-valid-pre-divider.patch
@@ -0,0 +1,54 @@
+From 51496e4446875726d50a5617a6e0e0dabbc2e6da Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 1 Apr 2019 20:18:16 +0200
+Subject: [PATCH] pwm: meson: Consider 128 a valid pre-divider
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 51496e4446875726d50a5617a6e0e0dabbc2e6da
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The pre-divider allows configuring longer PWM periods compared to using
+the input clock directly. The pre-divider is 7 bit wide, meaning it's
+maximum value is 128 (the register value is off-by-one: 0x7f or 127).
+
+Change the loop to also allow for the maximum possible value to be
+considered valid.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index c1ed641b3e26..aaae48ab484e 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -184,7 +184,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ do_div(fin_ps, fin_freq);
+
+ /* Calc pre_div with the period */
+- for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) {
++ for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) {
+ cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000,
+ fin_ps * (pre_div + 1));
+ dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n",
+@@ -193,7 +193,7 @@ static int meson_pwm_calc(struct meson_pwm *meson,
+ break;
+ }
+
+- if (pre_div == MISC_CLK_DIV_MASK) {
++ if (pre_div > MISC_CLK_DIV_MASK) {
+ dev_err(meson->chip.dev, "unable to get period pre_div\n");
+ return -EINVAL;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch b/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch
new file mode 100644
index 0000000000..f69c349142
--- /dev/null
+++ b/patches.drivers/pwm-meson-Don-t-disable-PWM-when-setting-duty-repeat.patch
@@ -0,0 +1,44 @@
+From a279345807e1e0ae79567a52cfdd9d30c9174a3c Mon Sep 17 00:00:00 2001
+From: Bichao Zheng <bichao.zheng@amlogic.com>
+Date: Mon, 1 Apr 2019 20:18:17 +0200
+Subject: [PATCH] pwm: meson: Don't disable PWM when setting duty repeatedly
+Git-commit: a279345807e1e0ae79567a52cfdd9d30c9174a3c
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+There is an abnormally low about 20ms,when setting duty repeatedly.
+Because setting the duty will disable PWM and then enable. Delete
+this operation now.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
+[ Dropped code instead of hiding it behind a comment ]
+
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index aaae48ab484e..2ab3d216b35a 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -314,11 +314,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ if (state->period != channel->state.period ||
+ state->duty_cycle != channel->state.duty_cycle ||
+ state->polarity != channel->state.polarity) {
+- if (channel->state.enabled) {
+- meson_pwm_disable(meson, pwm->hwpwm);
+- channel->state.enabled = false;
+- }
+-
+ if (state->polarity != channel->state.polarity) {
+ if (state->polarity == PWM_POLARITY_NORMAL)
+ meson->inverter_mask |= BIT(pwm->hwpwm);
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch b/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch
new file mode 100644
index 0000000000..742eba0206
--- /dev/null
+++ b/patches.drivers/pwm-meson-Use-the-spin-lock-only-to-protect-register.patch
@@ -0,0 +1,144 @@
+From f173747fffdf037c791405ab4f1ec0eb392fc48e Mon Sep 17 00:00:00 2001
+From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Date: Mon, 1 Apr 2019 19:57:48 +0200
+Subject: [PATCH] pwm: meson: Use the spin-lock only to protect register modifications
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: f173747fffdf037c791405ab4f1ec0eb392fc48e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Holding the spin-lock for all of the code in meson_pwm_apply() can
+result in a "BUG: scheduling while atomic". This can happen because
+clk_get_rate() (which is called from meson_pwm_calc()) may sleep.
+Only hold the spin-lock when modifying registers to solve this.
+
+The reason why we need a spin-lock in the driver is because the
+REG_MISC_AB register is shared between the two channels provided by one
+PWM controller. The only functions where REG_MISC_AB is modified are
+meson_pwm_enable() and meson_pwm_disable() so the register reads/writes
+in there need to be protected by the spin-lock.
+
+The original code also used the spin-lock to protect the values in
+struct meson_pwm_channel. This could be necessary if two consumers can
+use the same PWM channel. However, PWM core doesn't allow this so we
+don't need to protect the values in struct meson_pwm_channel with a
+lock.
+
+Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller")
+Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-meson.c | 25 +++++++++++++++++--------
+ 1 file changed, 17 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c
+index 2ab3d216b35a..e247ab632530 100644
+--- a/drivers/pwm/pwm-meson.c
++++ b/drivers/pwm/pwm-meson.c
+@@ -111,6 +111,10 @@ struct meson_pwm {
+ const struct meson_pwm_data *data;
+ void __iomem *base;
+ u8 inverter_mask;
++ /*
++ * Protects register (write) access to the REG_MISC_AB register
++ * that is shared between the two PWMs.
++ */
+ spinlock_t lock;
+ };
+
+@@ -235,6 +239,7 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ {
+ u32 value, clk_shift, clk_enable, enable;
+ unsigned int offset;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -255,6 +260,8 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~(MISC_CLK_DIV_MASK << clk_shift);
+ value |= channel->pre_div << clk_shift;
+@@ -267,11 +274,14 @@ static void meson_pwm_enable(struct meson_pwm *meson,
+ value = readl(meson->base + REG_MISC_AB);
+ value |= enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ {
+ u32 value, enable;
++ unsigned long flags;
+
+ switch (id) {
+ case 0:
+@@ -286,9 +296,13 @@ static void meson_pwm_disable(struct meson_pwm *meson, unsigned int id)
+ return;
+ }
+
++ spin_lock_irqsave(&meson->lock, flags);
++
+ value = readl(meson->base + REG_MISC_AB);
+ value &= ~enable;
+ writel(value, meson->base + REG_MISC_AB);
++
++ spin_unlock_irqrestore(&meson->lock, flags);
+ }
+
+ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+@@ -296,19 +310,16 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ {
+ struct meson_pwm_channel *channel = pwm_get_chip_data(pwm);
+ struct meson_pwm *meson = to_meson_pwm(chip);
+- unsigned long flags;
+ int err = 0;
+
+ if (!state)
+ return -EINVAL;
+
+- spin_lock_irqsave(&meson->lock, flags);
+-
+ if (!state->enabled) {
+ meson_pwm_disable(meson, pwm->hwpwm);
+ channel->state.enabled = false;
+
+- goto unlock;
++ return 0;
+ }
+
+ if (state->period != channel->state.period ||
+@@ -324,7 +335,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ err = meson_pwm_calc(meson, channel, pwm->hwpwm,
+ state->duty_cycle, state->period);
+ if (err < 0)
+- goto unlock;
++ return err;
+
+ channel->state.polarity = state->polarity;
+ channel->state.period = state->period;
+@@ -336,9 +347,7 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
+ channel->state.enabled = true;
+ }
+
+-unlock:
+- spin_unlock_irqrestore(&meson->lock, flags);
+- return err;
++ return 0;
+ }
+
+ static void meson_pwm_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
+--
+2.16.4
+
diff --git a/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch b/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
new file mode 100644
index 0000000000..df57e12413
--- /dev/null
+++ b/patches.drivers/pwm-tiehrpwm-Update-shadow-register-for-disabling-PW.patch
@@ -0,0 +1,48 @@
+From b00ef53053191d3025c15e8041699f8c9d132daf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christoph=20Vogtl=C3=A4nder?= <c.vogtlaender@sigma-surface-science.com>
+Date: Tue, 12 Mar 2019 14:38:46 +0530
+Subject: [PATCH] pwm: tiehrpwm: Update shadow register for disabling PWMs
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: b00ef53053191d3025c15e8041699f8c9d132daf
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+It must be made sure that immediate mode is not already set, when
+modifying shadow register value in ehrpwm_pwm_disable(). Otherwise
+modifications to the action-qualifier continuous S/W force
+register(AQSFRC) will be done in the active register.
+This may happen when both channels are being disabled. In this case,
+only the first channel state will be recorded as disabled in the shadow
+register. Later, when enabling the first channel again, the second
+channel would be enabled as well. Setting RLDCSF to zero, first, ensures
+that the shadow register is updated as desired.
+
+Fixes: 38dabd91ff0b ("pwm: tiehrpwm: Fix disabling of output of PWMs")
+Signed-off-by: Christoph Vogtländer <c.vogtlaender@sigma-surface-science.com>
+[vigneshr@ti.com: Improve commit message]
+Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
+Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pwm/pwm-tiehrpwm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pwm/pwm-tiehrpwm.c b/drivers/pwm/pwm-tiehrpwm.c
+index f7b8a86fa5c5..ad4a40c0f27c 100644
+--- a/drivers/pwm/pwm-tiehrpwm.c
++++ b/drivers/pwm/pwm-tiehrpwm.c
+@@ -382,6 +382,8 @@ static void ehrpwm_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
+ }
+
+ /* Update shadow register first before modifying active register */
++ ehrpwm_modify(pc->mmio_base, AQSFRC, AQSFRC_RLDCSF_MASK,
++ AQSFRC_RLDCSF_ZRO);
+ ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
+ /*
+ * Changes to immediate action on Action Qualifier. This puts
+--
+2.16.4
+
diff --git a/patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch b/patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch
new file mode 100644
index 0000000000..491ea3ab55
--- /dev/null
+++ b/patches.drivers/sc16is7xx-missing-unregister-delete-driver-on-error-.patch
@@ -0,0 +1,56 @@
+From ac0cdb3d990108df795b676cd0d0e65ac34b2273 Mon Sep 17 00:00:00 2001
+From: Mao Wenan <maowenan@huawei.com>
+Date: Fri, 8 Mar 2019 22:08:31 +0800
+Subject: [PATCH] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()
+Git-commit: ac0cdb3d990108df795b676cd0d0e65ac34b2273
+Patch-mainline: v5.1-rc3
+References: bsc#1051510
+
+Add the missing uart_unregister_driver() and i2c_del_driver() before return
+from sc16is7xx_init() in the error handling case.
+
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Reviewed-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 635178cf3eed..09a183dfc526 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1507,7 +1507,7 @@ static int __init sc16is7xx_init(void)
+ ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver);
+ if (ret < 0) {
+ pr_err("failed to init sc16is7xx i2c --> %d\n", ret);
+- return ret;
++ goto err_i2c;
+ }
+ #endif
+
+@@ -1515,10 +1515,18 @@ static int __init sc16is7xx_init(void)
+ ret = spi_register_driver(&sc16is7xx_spi_uart_driver);
+ if (ret < 0) {
+ pr_err("failed to init sc16is7xx spi --> %d\n", ret);
+- return ret;
++ goto err_spi;
+ }
+ #endif
+ return ret;
++
++err_spi:
++#ifdef CONFIG_SERIAL_SC16IS7XX_I2C
++ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
++#endif
++err_i2c:
++ uart_unregister_driver(&sc16is7xx_uart);
++ return ret;
+ }
+ module_init(sc16is7xx_init);
+
+--
+2.16.4
+
diff --git a/patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch b/patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch
new file mode 100644
index 0000000000..da56092523
--- /dev/null
+++ b/patches.drivers/sc16is7xx-move-label-err_spi-to-correct-section.patch
@@ -0,0 +1,49 @@
+From e00164a0f000de893944981f41a568c981aca658 Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Tue, 9 Apr 2019 16:16:38 +0800
+Subject: [PATCH] sc16is7xx: move label 'err_spi' to correct section
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: e00164a0f000de893944981f41a568c981aca658
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+err_spi is used when SERIAL_SC16IS7XX_SPI is enabled, so make
+the label only available under SERIAL_SC16IS7XX_SPI option.
+Otherwise, the below warning appears.
+
+drivers/tty/serial/sc16is7xx.c:1523:1: warning: label ‘err_spi’ defined but not used [-Wunused-label]
+ err_spi:
+ ^~~~~~~
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Fixes: ac0cdb3d9901 ("sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init()")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 09a183dfc526..22381a8c72e4 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1520,10 +1520,12 @@ static int __init sc16is7xx_init(void)
+ #endif
+ return ret;
+
++#ifdef CONFIG_SERIAL_SC16IS7XX_SPI
+ err_spi:
+ #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+ #endif
++#endif
+ err_i2c:
+ uart_unregister_driver(&sc16is7xx_uart);
+ return ret;
+--
+2.16.4
+
diff --git a/patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch b/patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch
new file mode 100644
index 0000000000..9106802a4e
--- /dev/null
+++ b/patches.drivers/sc16is7xx-put-err_spi-and-err_i2c-into-correct-ifdef.patch
@@ -0,0 +1,45 @@
+From c53051128bb0e8754e13345d782ca69e5e1ce36d Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Thu, 18 Apr 2019 10:01:55 +0800
+Subject: [PATCH] sc16is7xx: put err_spi and err_i2c into correct #ifdef
+Git-commit: c53051128bb0e8754e13345d782ca69e5e1ce36d
+Patch-mainline: v5.1-rc6
+References: bsc#1051510
+
+err_spi is only called within SERIAL_SC16IS7XX_SPI
+while err_i2c is called inside SERIAL_SC16IS7XX_I2C.
+So we need to put err_spi and err_i2c into each #ifdef
+accordingly.
+
+This change fixes ("sc16is7xx: move label 'err_spi'
+to correct section").
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/sc16is7xx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
+index 22381a8c72e4..a31db15cd7c0 100644
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1522,11 +1522,11 @@ static int __init sc16is7xx_init(void)
+
+ #ifdef CONFIG_SERIAL_SC16IS7XX_SPI
+ err_spi:
++#endif
+ #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
+ i2c_del_driver(&sc16is7xx_i2c_uart_driver);
+-#endif
+-#endif
+ err_i2c:
++#endif
+ uart_unregister_driver(&sc16is7xx_uart);
+ return ret;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/spi-Add-missing-pm_runtime_put_noidle-after-failed-g.patch b/patches.drivers/spi-Add-missing-pm_runtime_put_noidle-after-failed-g.patch
new file mode 100644
index 0000000000..8bb8250f9d
--- /dev/null
+++ b/patches.drivers/spi-Add-missing-pm_runtime_put_noidle-after-failed-g.patch
@@ -0,0 +1,35 @@
+From 7e48e23a1f4a50f93ac1073f1326e0a73829b631 Mon Sep 17 00:00:00 2001
+From: Tony Lindgren <tony@atomide.com>
+Date: Fri, 18 May 2018 10:30:07 -0700
+Subject: [PATCH] spi: Add missing pm_runtime_put_noidle() after failed get
+Git-commit: 7e48e23a1f4a50f93ac1073f1326e0a73829b631
+Patch-mainline: v4.18-rc1
+References: bsc#1111666
+
+If pm_runtime_get_sync() fails we should call pm_runtime_put_noidle().
+This is probably not a critical fix as we should only hit this when
+things are broken elsewhere.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 8ee1ba13eb23..20b5b2754830 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1212,6 +1212,7 @@ static void __spi_pump_messages(struct spi_controller *ctlr, bool in_kthread)
+ if (!was_busy && ctlr->auto_runtime_pm) {
+ ret = pm_runtime_get_sync(ctlr->dev.parent);
+ if (ret < 0) {
++ pm_runtime_put_noidle(ctlr->dev.parent);
+ dev_err(&ctlr->dev, "Failed to power device: %d\n",
+ ret);
+ mutex_unlock(&ctlr->io_mutex);
+--
+2.16.4
+
diff --git a/patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch b/patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch
new file mode 100644
index 0000000000..32776f6247
--- /dev/null
+++ b/patches.drivers/spi-a3700-Clear-DATA_OUT-when-performing-a-read.patch
@@ -0,0 +1,38 @@
+From 44a5f423e70374e5b42cecd85e78f2d79334e0f2 Mon Sep 17 00:00:00 2001
+From: Maxime Chevallier <maxime.chevallier@smile.fr>
+Date: Wed, 17 Jan 2018 17:15:25 +0100
+Subject: [PATCH] spi: a3700: Clear DATA_OUT when performing a read
+Git-commit: 44a5f423e70374e5b42cecd85e78f2d79334e0f2
+Patch-mainline: v4.16-rc1
+References: bsc#1051510
+
+When performing a read using FIFO mode, the spi controller shifts out
+the last 2 bytes that were written in a previous transfer on MOSI.
+
+This undocumented behaviour can cause devices to misinterpret the
+transfer, so we explicitly clear the WFIFO before each read.
+
+This behaviour was noticed on EspressoBin.
+
+Signed-off-by: Maxime Chevallier <maxime.chevallier@smile.fr>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi-armada-3700.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/spi/spi-armada-3700.c
++++ b/drivers/spi/spi-armada-3700.c
+@@ -668,6 +668,11 @@ static int a3700_spi_transfer_one(struct
+ a3700_spi_pin_mode_set(a3700_spi, nbits, xfer->rx_buf ? true : false);
+
+ if (xfer->rx_buf) {
++ /* Clear WFIFO, since it's last 2 bytes are shifted out during
++ * a read operation
++ */
++ spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, 0);
++
+ /* Set read data length */
+ spireg_write(a3700_spi, A3700_SPI_IF_DIN_CNT_REG,
+ a3700_spi->buf_len);
diff --git a/patches.drivers/spi-mem-fix-kernel-doc-for-spi_mem_dirmap_-read-writ.patch b/patches.drivers/spi-mem-fix-kernel-doc-for-spi_mem_dirmap_-read-writ.patch
new file mode 100644
index 0000000000..f0e5005caf
--- /dev/null
+++ b/patches.drivers/spi-mem-fix-kernel-doc-for-spi_mem_dirmap_-read-writ.patch
@@ -0,0 +1,40 @@
+From 9d8371e287b9bd8f5b28386e6d7e8e9514a40aad Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Sat, 6 Apr 2019 21:33:29 +0300
+Subject: [PATCH] spi-mem: fix kernel-doc for spi_mem_dirmap_{read|write}()
+Git-commit: 9d8371e287b9bd8f5b28386e6d7e8e9514a40aad
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+The function names in the kernel-doc comments were mistyped, with a word
+"dirmap" being repeated twice, so fix them.
+
+Fixes: aa167f3fed0c ("spi: spi-mem: Add a new API to support direct mapping")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/spi/spi-mem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/spi/spi-mem.c
++++ b/drivers/spi/spi-mem.c
+@@ -552,7 +552,7 @@ void spi_mem_dirmap_destroy(struct spi_m
+ EXPORT_SYMBOL_GPL(spi_mem_dirmap_destroy);
+
+ /**
+- * spi_mem_dirmap_dirmap_read() - Read data through a direct mapping
++ * spi_mem_dirmap_read() - Read data through a direct mapping
+ * @desc: direct mapping descriptor
+ * @offs: offset to start reading from. Note that this is not an absolute
+ * offset, but the offset within the direct mapping which already has
+@@ -598,7 +598,7 @@ ssize_t spi_mem_dirmap_read(struct spi_m
+ EXPORT_SYMBOL_GPL(spi_mem_dirmap_read);
+
+ /**
+- * spi_mem_dirmap_dirmap_write() - Write data through a direct mapping
++ * spi_mem_dirmap_write() - Write data through a direct mapping
+ * @desc: direct mapping descriptor
+ * @offs: offset to start writing from. Note that this is not an absolute
+ * offset, but the offset within the direct mapping which already has
diff --git a/patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch b/patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch
new file mode 100644
index 0000000000..209ffbc911
--- /dev/null
+++ b/patches.drivers/ssb-Fix-possible-NULL-pointer-dereference-in-ssb_hos.patch
@@ -0,0 +1,99 @@
+From b2c01aab9646ed8ffb7c549afe55d5349c482425 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Wed, 6 Mar 2019 19:56:58 +0800
+Subject: [PATCH] ssb: Fix possible NULL pointer dereference in ssb_host_pcmcia_exit
+Git-commit: b2c01aab9646ed8ffb7c549afe55d5349c482425
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Syzkaller report this:
+
+Kasan: GPF could be caused by NULL-ptr deref or user memory access
+general protection fault: 0000 [#1] SMP KASAN PTI
+Cpu: 0 PID: 4492 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
+Rip: 0010:sysfs_remove_file_ns+0x27/0x70 fs/sysfs/file.c:468
+Code: 00 00 00 41 54 55 48 89 fd 53 49 89 d4 48 89 f3 e8 ee 76 9c ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 2d 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 8b 6d
+Rsp: 0018:ffff8881e9d9fc00 EFLAGS: 00010206
+Rax: dffffc0000000000 RBX: ffffffff900367e0 RCX: ffffffff81a95952
+Rdx: 0000000000000006 RSI: ffffc90001405000 RDI: 0000000000000030
+Rbp: 0000000000000000 R08: fffffbfff1fa22ed R09: fffffbfff1fa22ed
+R10: 0000000000000001 R11: fffffbfff1fa22ec R12: 0000000000000000
+R13: ffffffffc1abdac0 R14: 1ffff1103d3b3f8b R15: 0000000000000000
+Fs: 00007fe409dc1700(0000) GS:ffff8881f1200000(0000) knlGS:0000000000000000
+Cs: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+Cr2: 0000001b2d721000 CR3: 00000001e98b6005 CR4: 00000000007606f0
+Dr0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+Dr3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Pkru: 55555554
+Call Trace:
+ sysfs_remove_file include/linux/sysfs.h:519 [inline]
+ driver_remove_file+0x40/0x50 drivers/base/driver.c:122
+ pcmcia_remove_newid_file drivers/pcmcia/ds.c:163 [inline]
+ pcmcia_unregister_driver+0x7d/0x2b0 drivers/pcmcia/ds.c:209
+ ssb_modexit+0xa/0x1b [ssb]
+ __do_sys_delete_module kernel/module.c:1018 [inline]
+ __se_sys_delete_module kernel/module.c:961 [inline]
+ __x64_sys_delete_module+0x3dc/0x5e0 kernel/module.c:961
+ do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+Rip: 0033:0x462e99
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
+Rsp: 002b:00007fe409dc0c58 EFLAGS: 00000246 ORIG_RAX: 00000000000000b0
+Rax: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
+Rdx: 0000000000000000 RSI: 0000000000000000 RDI: 00000000200000c0
+Rbp: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe409dc16bc
+R13: 00000000004bccaa R14: 00000000006f6bc8 R15: 00000000ffffffff
+Modules linked in: ssb(-) 3c59x nvme_core macvlan tap pata_hpt3x3 rt2x00pci null_blk tsc40 pm_notifier_error_inject notifier_error_inject mdio cdc_wdm nf_reject_ipv4 ath9k_common ath9k_hw ath pppox ppp_generic slhc ehci_platform wl12xx wlcore tps6507x_ts ioc4 nf_synproxy_core ide_gd_mod ax25 can_dev iwlwifi can_raw atm tm2_touchkey can_gw can sundance adp5588_keys rt2800mmio rt2800lib rt2x00mmio rt2x00lib eeprom_93cx6 pn533 lru_cache elants_i2c ip_set nfnetlink gameport tipc hampshire nhc_ipv6 nhc_hop nhc_udp nhc_fragment nhc_routing nhc_mobility nhc_dest 6lowpan silead brcmutil nfc mt76_usb mt76 mac80211 iptable_security iptable_raw iptable_mangle iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_gre sit hsr veth vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon vcan bridge stp llc ip6_gre ip6_tunnel tunnel6 tun joydev mousedev serio_raw ide_pci_generic piix floppy ide_core sch_fq_codel ip_tables x_tables ipv6
+ [last unloaded: 3c59x]
+Dumping ftrace buffer:
+ (ftrace buffer empty)
+
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---[ end trace 3913cbf8011e1c05 ]---
+
+In ssb_modinit, it does not fail SSB init when ssb_host_pcmcia_init failed,
+however in ssb_modexit, ssb_host_pcmcia_exit calls pcmcia_unregister_driver
+unconditionally, which may tigger a NULL pointer dereference issue as above.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 399500da18f7 ("ssb: pick PCMCIA host code support from b43 driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/ssb/bridge_pcmcia_80211.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/ssb/bridge_pcmcia_80211.c b/drivers/ssb/bridge_pcmcia_80211.c
+index f51f150307df..ffa379efff83 100644
+--- a/drivers/ssb/bridge_pcmcia_80211.c
++++ b/drivers/ssb/bridge_pcmcia_80211.c
+@@ -113,16 +113,21 @@ static struct pcmcia_driver ssb_host_pcmcia_driver = {
+ .resume = ssb_host_pcmcia_resume,
+ };
+
++static int pcmcia_init_failed;
++
+ /*
+ * These are not module init/exit functions!
+ * The module_pcmcia_driver() helper cannot be used here.
+ */
+ int ssb_host_pcmcia_init(void)
+ {
+- return pcmcia_register_driver(&ssb_host_pcmcia_driver);
++ pcmcia_init_failed = pcmcia_register_driver(&ssb_host_pcmcia_driver);
++
++ return pcmcia_init_failed;
+ }
+
+ void ssb_host_pcmcia_exit(void)
+ {
+- pcmcia_unregister_driver(&ssb_host_pcmcia_driver);
++ if (!pcmcia_init_failed)
++ pcmcia_unregister_driver(&ssb_host_pcmcia_driver);
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/staging-rtlwifi-Fix-potential-NULL-pointer-dereferen.patch b/patches.drivers/staging-rtlwifi-Fix-potential-NULL-pointer-dereferen.patch
new file mode 100644
index 0000000000..babd2c0cd8
--- /dev/null
+++ b/patches.drivers/staging-rtlwifi-Fix-potential-NULL-pointer-dereferen.patch
@@ -0,0 +1,37 @@
+From 6a8ca24590a2136921439b376c926c11a6effc0e Mon Sep 17 00:00:00 2001
+From: Aditya Pakki <pakki001@umn.edu>
+Date: Wed, 20 Mar 2019 10:42:32 -0500
+Subject: [PATCH] staging: rtlwifi: Fix potential NULL pointer dereference of kzalloc
+Git-commit: 6a8ca24590a2136921439b376c926c11a6effc0e
+Patch-mainline: v5.1-rc3
+References: bsc#1111666
+
+phydm.internal is allocated using kzalloc which is used multiple
+times without a check for NULL pointer. This patch avoids such a
+scenario by returning 0, consistent with the failure case.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/rtlwifi/phydm/rtl_phydm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/rtlwifi/phydm/rtl_phydm.c b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+index 9930ed954abb..4cc77b2016e1 100644
+--- a/drivers/staging/rtlwifi/phydm/rtl_phydm.c
++++ b/drivers/staging/rtlwifi/phydm/rtl_phydm.c
+@@ -180,6 +180,8 @@ static int rtl_phydm_init_priv(struct rtl_priv *rtlpriv,
+
+ rtlpriv->phydm.internal =
+ kzalloc(sizeof(struct phy_dm_struct), GFP_KERNEL);
++ if (!rtlpriv->phydm.internal)
++ return 0;
+
+ _rtl_phydm_init_com_info(rtlpriv, ic, params);
+
+--
+2.16.4
+
diff --git a/patches.drivers/staging-rtlwifi-rtl8822b-fix-to-avoid-potential-NULL.patch b/patches.drivers/staging-rtlwifi-rtl8822b-fix-to-avoid-potential-NULL.patch
new file mode 100644
index 0000000000..79b9a6da84
--- /dev/null
+++ b/patches.drivers/staging-rtlwifi-rtl8822b-fix-to-avoid-potential-NULL.patch
@@ -0,0 +1,37 @@
+From d70d70aec9632679dd00dcc1b1e8b2517e2c7da0 Mon Sep 17 00:00:00 2001
+From: Aditya Pakki <pakki001@umn.edu>
+Date: Wed, 20 Mar 2019 12:02:49 -0500
+Subject: [PATCH] staging: rtlwifi: rtl8822b: fix to avoid potential NULL pointer dereference
+Git-commit: d70d70aec9632679dd00dcc1b1e8b2517e2c7da0
+Patch-mainline: v5.1-rc3
+References: bsc#1111666
+
+skb allocated via dev_alloc_skb can fail and return a NULL pointer.
+This patch avoids such a scenario and returns, consistent with other
+invocations.
+
+Signed-off-by: Aditya Pakki <pakki001@umn.edu>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/staging/rtlwifi/rtl8822be/fw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c b/drivers/staging/rtlwifi/rtl8822be/fw.c
+index f061dd1382aa..cf6b7a80b753 100644
+--- a/drivers/staging/rtlwifi/rtl8822be/fw.c
++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c
+@@ -743,6 +743,8 @@ void rtl8822be_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+ u1_rsvd_page_loc, 3);
+
+ skb = dev_alloc_skb(totalpacketlen);
++ if (!skb)
++ return;
+ memcpy((u8 *)skb_put(skb, totalpacketlen), &reserved_page_packet,
+ totalpacketlen);
+
+--
+2.16.4
+
diff --git a/patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch b/patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch
new file mode 100644
index 0000000000..095d58d072
--- /dev/null
+++ b/patches.drivers/usb-storage-Set-virt_boundary_mask-to-avoid-SG-overf.patch
@@ -0,0 +1,92 @@
+From 747668dbc061b3e62bc1982767a3a1f9815fcf0e Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon, 15 Apr 2019 13:19:25 -0400
+Subject: [PATCH] usb-storage: Set virt_boundary_mask to avoid SG overflows
+Git-commit: 747668dbc061b3e62bc1982767a3a1f9815fcf0e
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The USB subsystem has always had an unusual requirement for its
+scatter-gather transfers: Each element in the scatterlist (except the
+last one) must have a length divisible by the bulk maxpacket size.
+This is a particular issue for USB mass storage, which uses SG lists
+created by the block layer rather than setting up its own.
+
+So far we have scraped by okay because most devices have a logical
+block size of 512 bytes or larger, and the bulk maxpacket sizes for
+USB 2 and below are all <= 512. However, USB 3 has a bulk maxpacket
+size of 1024. Since the xhci-hcd driver includes native SG support,
+this hasn't mattered much. But now people are trying to use USB-3
+mass storage devices with USBIP, and the vhci-hcd driver currently
+does not have full SG support.
+
+The result is an overflow error, when the driver attempts to implement
+an SG transfer of 63 512-byte blocks as a single
+3584-byte (7 blocks) transfer followed by seven 4096-byte (8 blocks)
+transfers. The device instead sends 31 1024-byte packets followed by
+a 512-byte packet, and this overruns the first SG buffer.
+
+Ideally this would be fixed by adding better SG support to vhci-hcd.
+But for now it appears we can work around the problem by
+asking the block layer to respect the maxpacket limitation, through
+the use of the virt_boundary_mask.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Reported-by: Seth Bollinger <Seth.Bollinger@digi.com>
+Tested-by: Seth Bollinger <Seth.Bollinger@digi.com>
+Cc: Ming Lei <tom.leiming@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/storage/scsiglue.c | 26 ++++++++++++--------------
+ 1 file changed, 12 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index a73ea495d5a7..59190d88fa9f 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -65,6 +65,7 @@ static const char* host_info(struct Scsi_Host *host)
+ static int slave_alloc (struct scsi_device *sdev)
+ {
+ struct us_data *us = host_to_us(sdev->host);
++ int maxp;
+
+ /*
+ * Set the INQUIRY transfer length to 36. We don't use any of
+@@ -74,20 +75,17 @@ static int slave_alloc (struct scsi_device *sdev)
+ sdev->inquiry_len = 36;
+
+ /*
+- * USB has unusual DMA-alignment requirements: Although the
+- * starting address of each scatter-gather element doesn't matter,
+- * the length of each element except the last must be divisible
+- * by the Bulk maxpacket value. There's currently no way to
+- * express this by block-layer constraints, so we'll cop out
+- * and simply require addresses to be aligned at 512-byte
+- * boundaries. This is okay since most block I/O involves
+- * hardware sectors that are multiples of 512 bytes in length,
+- * and since host controllers up through USB 2.0 have maxpacket
+- * values no larger than 512.
+- *
+- * But it doesn't suffice for Wireless USB, where Bulk maxpacket
+- * values can be as large as 2048. To make that work properly
+- * will require changes to the block layer.
++ * USB has unusual scatter-gather requirements: the length of each
++ * scatterlist element except the last must be divisible by the
++ * Bulk maxpacket value. Fortunately this value is always a
++ * power of 2. Inform the block layer about this requirement.
++ */
++ maxp = usb_maxpacket(us->pusb_dev, us->recv_bulk_pipe, 0);
++ blk_queue_virt_boundary(sdev->request_queue, maxp - 1);
++
++ /*
++ * Some host controllers may have alignment requirements.
++ * We'll play it safe by requiring 512-byte alignment always.
+ */
+ blk_queue_update_dma_alignment(sdev->request_queue, (512 - 1));
+
+--
+2.16.4
+
diff --git a/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch b/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch
index b92d55bb53..643bb857f6 100644
--- a/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch
+++ b/patches.drm/0001-drm-i915-gvt-Fix-mmap-range-check.patch
@@ -4,7 +4,7 @@ Date: Fri, 11 Jan 2019 13:58:53 +0800
Subject: drm/i915/gvt: Fix mmap range check
Git-commit: 51b00d8509dc69c98740da2ad07308b630d3eb7d
Patch-mainline: v5.0-rc3
-References: bsc#1120902
+References: bsc#1120902, CVE-2019-11085, bsc#1135278
This is to fix missed mmap range check on vGPU bar2 region
and only allow to map vGPU allocated GMADDR range, which means
diff --git a/patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch b/patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch
new file mode 100644
index 0000000000..63913ed9a6
--- /dev/null
+++ b/patches.drm/0004-drm-i915-gvt-Fix-incorrect-mask-of-mmio-0x22028-in-g.patch
@@ -0,0 +1,39 @@
+From 2bfc4975083ace0e5777116514c3a75e59b3dbcd Mon Sep 17 00:00:00 2001
+From: Colin Xu <colin.xu@intel.com>
+Date: Mon, 1 Apr 2019 14:13:53 +0800
+Subject: drm/i915/gvt: Fix incorrect mask of mmio 0x22028 in gen8/9 mmio list
+Git-commit: 2bfc4975083ace0e5777116514c3a75e59b3dbcd
+Patch-mainline: v5.2-rc1
+References: bnc#1113722
+
+According to GFX PRM on 01.org, bit 31:16 of mmio 0x22028 should be masks.
+
+Fixes: 178657139307 ("drm/i915/gvt: vGPU context switch")
+Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Signed-off-by: Colin Xu <colin.xu@intel.com>
+Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/gvt/mmio_context.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gvt/mmio_context.c
++++ b/drivers/gpu/drm/i915/gvt/mmio_context.c
+@@ -79,7 +79,7 @@ static struct engine_mmio gen8_engine_mm
+ {BCS, RING_MI_MODE(BLT_RING_BASE), 0xffff, false}, /* 0x2209c */
+ {BCS, RING_INSTPM(BLT_RING_BASE), 0xffff, false}, /* 0x220c0 */
+ {BCS, RING_HWSTAM(BLT_RING_BASE), 0x0, false}, /* 0x22098 */
+- {BCS, RING_EXCC(BLT_RING_BASE), 0x0, false}, /* 0x22028 */
++ {BCS, RING_EXCC(BLT_RING_BASE), 0xffff, false}, /* 0x22028 */
+ {RCS, INVALID_MMIO_REG, 0, false } /* Terminated */
+ };
+
+@@ -130,7 +130,7 @@ static struct engine_mmio gen9_engine_mm
+ {BCS, RING_MI_MODE(BLT_RING_BASE), 0xffff, false}, /* 0x2209c */
+ {BCS, RING_INSTPM(BLT_RING_BASE), 0xffff, false}, /* 0x220c0 */
+ {BCS, RING_HWSTAM(BLT_RING_BASE), 0x0, false}, /* 0x22098 */
+- {BCS, RING_EXCC(BLT_RING_BASE), 0x0, false}, /* 0x22028 */
++ {BCS, RING_EXCC(BLT_RING_BASE), 0xffff, false}, /* 0x22028 */
+
+ {VCS2, RING_EXCC(GEN8_BSD2_RING_BASE), 0xffff, false}, /* 0x1c028 */
+
diff --git a/patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch b/patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch
new file mode 100644
index 0000000000..b575b39a69
--- /dev/null
+++ b/patches.drm/0005-drm-meson-add-size-and-alignment-requirements-for-du.patch
@@ -0,0 +1,53 @@
+From 852ce7285c99e3f7b56e76511e1b33c645a2b648 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Mon, 8 Apr 2019 11:01:37 +0200
+Subject: drm/meson: add size and alignment requirements for dumb buffers
+Git-commit: 852ce7285c99e3f7b56e76511e1b33c645a2b648
+Patch-mainline: v5.2-rc1
+References: bnc#1113722
+
+The Amlogic SoCs Canvas buffers stride must be aligned on 64bytes
+and overall size should be aligned on PAGE width.
+
+Adds a custom dumb_create op to adds these requirements.
+
+Fixes: bbbe775ec5b5 ("drm: Add support for Amlogic Meson Graphic Controller")
+Suggested-by: Sky Zhou <sky.zhou@amlogic.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Sky Zhou <sky.zhou@amlogic.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190408090137.2402-1-narmstrong@baylibre.com
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/meson/meson_drv.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -93,6 +93,18 @@ static irqreturn_t meson_irq(int irq, vo
+ return IRQ_HANDLED;
+ }
+
++static int meson_dumb_create(struct drm_file *file, struct drm_device *dev,
++ struct drm_mode_create_dumb *args)
++{
++ /*
++ * We need 64bytes aligned stride, and PAGE aligned size
++ */
++ args->pitch = ALIGN(DIV_ROUND_UP(args->width * args->bpp, 8), SZ_64);
++ args->size = PAGE_ALIGN(args->pitch * args->height);
++
++ return drm_gem_cma_dumb_create_internal(file, dev, args);
++}
++
+ DEFINE_DRM_GEM_CMA_FOPS(fops);
+
+ static struct drm_driver meson_driver = {
+@@ -115,7 +127,7 @@ static struct drm_driver meson_driver =
+ .gem_prime_mmap = drm_gem_cma_prime_mmap,
+
+ /* GEM Ops */
+- .dumb_create = drm_gem_cma_dumb_create,
++ .dumb_create = meson_dumb_create,
+ .gem_free_object_unlocked = drm_gem_cma_free_object,
+ .gem_vm_ops = &drm_gem_cma_vm_ops,
+
diff --git a/patches.drm/drm-amd-display-fix-cursor-black-issue.patch b/patches.drm/drm-amd-display-fix-cursor-black-issue.patch
new file mode 100644
index 0000000000..272aec51f0
--- /dev/null
+++ b/patches.drm/drm-amd-display-fix-cursor-black-issue.patch
@@ -0,0 +1,42 @@
+From c1cefe115d1cdc460014483319d440b2f0d07c68 Mon Sep 17 00:00:00 2001
+From: tiancyin <tianci.yin@amd.com>
+Date: Mon, 1 Apr 2019 10:15:31 +0800
+Subject: [PATCH] drm/amd/display: fix cursor black issue
+Git-commit: c1cefe115d1cdc460014483319d440b2f0d07c68
+Patch-mainline: v5.1-rc5
+References: bsc#1111666
+
+[Why]
+the member sdr_white_level of struct dc_cursor_attributes was not
+initialized, then the random value result that
+dcn10_set_cursor_sdr_white_level() set error hw_scale value 0x20D9(normal
+value is 0x3c00), this cause the black cursor issue.
+
+[how]
+just initilize the obj of struct dc_cursor_attributes to zero to avoid
+the random value.
+
+Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
+Signed-off-by: Tianci Yin <tianci.yin@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+index 81127f7d6ed1..3082b55b1e77 100644
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -4533,6 +4533,7 @@ static void handle_cursor_update(struct drm_plane *plane,
+ amdgpu_crtc->cursor_width = plane->state->crtc_w;
+ amdgpu_crtc->cursor_height = plane->state->crtc_h;
+
++ memset(&attributes, 0, sizeof(attributes));
+ attributes.address.high_part = upper_32_bits(address);
+ attributes.address.low_part = lower_32_bits(address);
+ attributes.width = plane->state->crtc_w;
+--
+2.16.4
+
diff --git a/patches.drm/drm-doc-Drop-content-type-from-the-legacy-kms-proper.patch b/patches.drm/drm-doc-Drop-content-type-from-the-legacy-kms-proper.patch
new file mode 100644
index 0000000000..87ba650d73
--- /dev/null
+++ b/patches.drm/drm-doc-Drop-content-type-from-the-legacy-kms-proper.patch
@@ -0,0 +1,43 @@
+From f0f0657b108c4691af1d4549148ca8fef2207088 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Tue, 26 Mar 2019 10:05:55 +0100
+Subject: [PATCH] drm/doc: Drop "content type" from the legacy kms property table
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: f0f0657b108c4691af1d4549148ca8fef2207088
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+We want new stuff documented in more verbose form, this table is
+deprecated. "content type" is already documented properly.
+
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Fixes: 50525c332b55 ("drm: content-type property for HDMI connector")
+Cc: Hans Verkuil <hans.verkuil@cisco.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190326090555.5969-1-daniel.vetter@ffwll.ch
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ Documentation/gpu/kms-properties.csv | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/Documentation/gpu/kms-properties.csv b/Documentation/gpu/kms-properties.csv
+index bfde04eddd14..07ed22ea3bd6 100644
+--- a/Documentation/gpu/kms-properties.csv
++++ b/Documentation/gpu/kms-properties.csv
+@@ -17,7 +17,6 @@ Owner Module/Drivers,Group,Property Name,Type,Property Values,Object attached,De
+ ,Virtual GPU,“suggested X”,RANGE,"Min=0, Max=0xffffffff",Connector,property to suggest an X offset for a connector
+ ,,“suggested Y”,RANGE,"Min=0, Max=0xffffffff",Connector,property to suggest an Y offset for a connector
+ ,Optional,"""aspect ratio""",ENUM,"{ ""None"", ""4:3"", ""16:9"" }",Connector,TDB
+-,Optional,"""content type""",ENUM,"{ ""No Data"", ""Graphics"", ""Photo"", ""Cinema"", ""Game"" }",Connector,TBD
+ i915,Generic,"""Broadcast RGB""",ENUM,"{ ""Automatic"", ""Full"", ""Limited 16:235"" }",Connector,"When this property is set to Limited 16:235 and CTM is set, the hardware will be programmed with the result of the multiplication of CTM by the limited range matrix to ensure the pixels normaly in the range 0..1.0 are remapped to the range 16/255..235/255."
+ ,,“audio”,ENUM,"{ ""force-dvi"", ""off"", ""auto"", ""on"" }",Connector,TBD
+ ,SDVO-TV,“mode”,ENUM,"{ ""NTSC_M"", ""NTSC_J"", ""NTSC_443"", ""PAL_B"" } etc.",Connector,TBD
+--
+2.16.4
+
diff --git a/patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch b/patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch
new file mode 100644
index 0000000000..85fc07e12d
--- /dev/null
+++ b/patches.drm/drm-fb-helper-dpms_legacy-Only-set-on-connectors-in-.patch
@@ -0,0 +1,57 @@
+From 65a102f68005891d7f39354cfd79099908df6d51 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Tue, 26 Mar 2019 18:55:32 +0100
+Subject: [PATCH] drm/fb-helper: dpms_legacy(): Only set on connectors in use
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 65a102f68005891d7f39354cfd79099908df6d51
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+For each enabled crtc the functions sets dpms on all registered connectors.
+Limit this to only doing it once and on the connectors actually in use.
+
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Fixes: 023eb571a1d0 ("drm: correctly update connector DPMS status in drm_fb_helper")
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190326175546.18126-3-noralf@tronnes.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index a6d88f8b7a52..0d8384e30e16 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -639,20 +639,19 @@ static struct sysrq_key_op sysrq_drm_fb_helper_restore_op = { };
+ static void dpms_legacy(struct drm_fb_helper *fb_helper, int dpms_mode)
+ {
+ struct drm_device *dev = fb_helper->dev;
+- struct drm_crtc *crtc;
+ struct drm_connector *connector;
++ struct drm_mode_set *modeset;
+ int i, j;
+
+ drm_modeset_lock_all(dev);
+ for (i = 0; i < fb_helper->crtc_count; i++) {
+- crtc = fb_helper->crtc_info[i].mode_set.crtc;
++ modeset = &fb_helper->crtc_info[i].mode_set;
+
+- if (!crtc->enabled)
++ if (!modeset->crtc->enabled)
+ continue;
+
+- /* Walk the connectors & encoders on this fb turning them on/off */
+- drm_fb_helper_for_each_connector(fb_helper, j) {
+- connector = fb_helper->connector_info[j]->connector;
++ for (j = 0; j < modeset->num_connectors; j++) {
++ connector = modeset->connectors[j];
+ connector->funcs->dpms(connector, dpms_mode);
+ drm_object_property_set_value(&connector->base,
+ dev->mode_config.dpms_property, dpms_mode);
+--
+2.16.4
+
diff --git a/patches.drm/drm-fb-helper-generic-Call-drm_client_add-after-setu.patch b/patches.drm/drm-fb-helper-generic-Call-drm_client_add-after-setu.patch
new file mode 100644
index 0000000000..2af3e75c9a
--- /dev/null
+++ b/patches.drm/drm-fb-helper-generic-Call-drm_client_add-after-setu.patch
@@ -0,0 +1,47 @@
+From 6e3f17ee73f7e3c2ef0e2c8fd8624b2ece8ef2c9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= <noralf@tronnes.org>
+Date: Mon, 1 Apr 2019 16:13:58 +0200
+Subject: [PATCH] drm/fb-helper: generic: Call drm_client_add() after setup is done
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 6e3f17ee73f7e3c2ef0e2c8fd8624b2ece8ef2c9
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+Hotplug can happen while drm_fbdev_generic_setup() is running so move
+drm_client_add() call after setup is done to avoid
+drm_fbdev_client_hotplug() running in two threads at the same time.
+
+Fixes: 9060d7f49376 ("drm/fb-helper: Finish the generic fbdev emulation")
+Cc: stable@vger.kernel.org
+Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190401141358.25309-1-noralf@tronnes.org
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/drm_fb_helper.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -3225,8 +3225,6 @@ int drm_fbdev_generic_setup(struct drm_d
+ return ret;
+ }
+
+- drm_client_add(&fb_helper->client);
+-
+ if (!preferred_bpp)
+ preferred_bpp = dev->mode_config.preferred_depth;
+ if (!preferred_bpp)
+@@ -3235,6 +3233,8 @@ int drm_fbdev_generic_setup(struct drm_d
+
+ drm_fbdev_client_hotplug(&fb_helper->client);
+
++ drm_client_add(&fb_helper->client);
++
+ return 0;
+ }
+ EXPORT_SYMBOL(drm_fbdev_generic_setup);
diff --git a/patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch b/patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch
new file mode 100644
index 0000000000..5ce2396909
--- /dev/null
+++ b/patches.drm/drm-i915-Fix-I915_EXEC_RING_MASK.patch
@@ -0,0 +1,42 @@
+From d90c06d57027203f73021bb7ddb30b800d65c636 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 1 Mar 2019 14:03:47 +0000
+Subject: [PATCH] drm/i915: Fix I915_EXEC_RING_MASK
+Git-commit: d90c06d57027203f73021bb7ddb30b800d65c636
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+This was supposed to be a mask of all known rings, but it is being used
+by execbuffer to filter out invalid rings, and so is instead mapping high
+unused values onto valid rings. Instead of a mask of all known rings,
+we need it to be the mask of all possible rings.
+
+Fixes: 549f7365820a ("drm/i915: Enable SandyBridge blitter ring")
+Fixes: de1add360522 ("drm/i915: Decouple execbuf uAPI from internal implementation")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: <stable@vger.kernel.org> # v4.6+
+Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190301140404.26690-21-chris@chris-wilson.co.uk
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/uapi/drm/i915_drm.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
+index b10eea3f6d24..1a60642c1d61 100644
+--- a/include/uapi/drm/i915_drm.h
++++ b/include/uapi/drm/i915_drm.h
+@@ -979,7 +979,7 @@ struct drm_i915_gem_execbuffer2 {
+ * struct drm_i915_gem_exec_fence *fences.
+ */
+ __u64 cliprects_ptr;
+-#define I915_EXEC_RING_MASK (7<<0)
++#define I915_EXEC_RING_MASK (0x3f)
+ #define I915_EXEC_DEFAULT (0<<0)
+ #define I915_EXEC_RENDER (1<<0)
+ #define I915_EXEC_BSD (2<<0)
+--
+2.16.4
+
diff --git a/patches.drm/drm-i915-icl-Whitelist-GEN9_SLICE_COMMON_ECO_CHICKEN.patch b/patches.drm/drm-i915-icl-Whitelist-GEN9_SLICE_COMMON_ECO_CHICKEN.patch
new file mode 100644
index 0000000000..80a942f2a1
--- /dev/null
+++ b/patches.drm/drm-i915-icl-Whitelist-GEN9_SLICE_COMMON_ECO_CHICKEN.patch
@@ -0,0 +1,59 @@
+From 9628e15ca9d5f7595ba886173e98a139d0a56cd1 Mon Sep 17 00:00:00 2001
+From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Date: Thu, 18 Apr 2019 11:06:34 +0100
+Subject: [PATCH] drm/i915/icl: Whitelist GEN9_SLICE_COMMON_ECO_CHICKEN1
+Git-commit: 9628e15ca9d5f7595ba886173e98a139d0a56cd1
+Patch-mainline: v5.2-rc1
+No-fix: 0fc2273b9ab7f07cdef448e99525e481535e1ab0
+References: bsc#1111666
+
+WaEnableStateCacheRedirectToCS context workaround configures the L3 cache
+to benefit 3d workloads but media has different requirements.
+
+Remove the workaround and whitelist the register to allow any userspace
+configure the behaviour to their liking.
+
+V2: * Remove the workaround apart from adding the whitelist.
+
+Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
+Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Cc: kevin.ma@intel.com
+Cc: xiaogang.li@intel.com
+Acked-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
+Acked-by: Anuj Phogat <anuj.phogat@gmail.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190418100634.984-1-tvrtko.ursulin@linux.intel.com
+Fixes: f63c7b4880aa ("drm/i915/icl: WaEnableStateCacheRedirectToCS")
+Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+[tursulin: Anuj reported no GPU hangs or performance regressions with old Mesa on patched kernel.]
+(cherry picked from commit 0fc2273b9ab7f07cdef448e99525e481535e1ab0)
+
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_workarounds.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_workarounds.c
++++ b/drivers/gpu/drm/i915/intel_workarounds.c
+@@ -513,10 +513,6 @@ static int icl_ctx_workarounds_init(stru
+ WA_SET_BIT_MASKED(GEN7_ROW_CHICKEN2,
+ GEN11_TDL_CLOCK_GATING_FIX_DISABLE);
+
+- /* WaEnableStateCacheRedirectToCS:icl */
+- WA_SET_BIT_MASKED(GEN9_SLICE_COMMON_ECO_CHICKEN1,
+- GEN11_STATE_CACHE_REDIRECT_TO_CS);
+-
+ /* Wa_2006665173:icl (pre-prod) */
+ if (IS_ICL_REVID(dev_priv, ICL_REVID_A0, ICL_REVID_A0))
+ WA_SET_BIT_MASKED(GEN11_COMMON_SLICE_CHICKEN3,
+@@ -1071,6 +1067,9 @@ static void icl_whitelist_build(struct w
+
+ /* WaAllowUMDToModifySamplerMode:icl */
+ whitelist_reg(w, GEN10_SAMPLER_MODE);
++
++ /* WaEnableStateCacheRedirectToCS:icl */
++ whitelist_reg(w, GEN9_SLICE_COMMON_ECO_CHICKEN1);
+ }
+
+ static struct whitelist *whitelist_build(struct intel_engine_cs *engine,
diff --git a/patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch b/patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch
new file mode 100644
index 0000000000..5cdf570357
--- /dev/null
+++ b/patches.drm/drm-mediatek-fix-possible-object-reference-leak.patch
@@ -0,0 +1,48 @@
+From 2ae2c3316fb77dcf64275d011596b60104c45426 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 4 Apr 2019 00:04:09 +0800
+Subject: [PATCH] drm/mediatek: fix possible object reference leak
+Git-commit: 2ae2c3316fb77dcf64275d011596b60104c45426
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+The call to of_parse_phandle returns a node pointer with refcount
+incremented thus it must be explicitly decremented after the last
+usage.
+
+Detected by coccinelle with the following warnings:
+drivers/gpu/drm/mediatek/mtk_hdmi.c:1521:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function.
+drivers/gpu/drm/mediatek/mtk_hdmi.c:1524:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1509, but without a corresponding object release within this function.
+
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-mediatek@lists.infradead.org
+Cc: linux-kernel@vger.kernel.org
+Signed-off-by: CK Hu <ck.hu@mediatek.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index 543a25e5765e..e04e6c293d39 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1515,6 +1515,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ of_node_put(remote);
+
+ hdmi->ddc_adpt = of_find_i2c_adapter_by_node(i2c_np);
++ of_node_put(i2c_np);
+ if (!hdmi->ddc_adpt) {
+ dev_err(dev, "Failed to get ddc i2c adapter by node\n");
+ return -EINVAL;
+--
+2.16.4
+
diff --git a/patches.drm/drm-rcar-du-Fix-rcar_du_crtc-structure-documentation.patch b/patches.drm/drm-rcar-du-Fix-rcar_du_crtc-structure-documentation.patch
new file mode 100644
index 0000000000..b3255758ca
--- /dev/null
+++ b/patches.drm/drm-rcar-du-Fix-rcar_du_crtc-structure-documentation.patch
@@ -0,0 +1,32 @@
+From 12a85f994d848947084e0c4add79117bf8bfa46b Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Thu, 21 Feb 2019 03:15:27 +0200
+Subject: [PATCH] drm: rcar-du: Fix rcar_du_crtc structure documentation
+Git-commit: 12a85f994d848947084e0c4add79117bf8bfa46b
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+The rcar_du_crtc structure index field contains the CRTC hardware index,
+not the hardware and software index. Update the documentation
+accordingly.
+
+Fixes: 5361cc7f8e91 ("drm: rcar-du: Split CRTC handling to support hardware indexing")
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/rcar-du/rcar_du_crtc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h
+@@ -30,7 +30,7 @@ struct rcar_du_vsp;
+ * @clock: the CRTC functional clock
+ * @extclock: external pixel dot clock (optional)
+ * @mmio_offset: offset of the CRTC registers in the DU MMIO block
+- * @index: CRTC software and hardware index
++ * @index: CRTC hardware index
+ * @initialized: whether the CRTC has been initialized and clocks enabled
+ * @event: event to post when the pending page flip completes
+ * @flip_wait: wait queue used to signal page flip completion
diff --git a/patches.drm/drm-rockchip-fix-for-mailbox-read-validation.patch b/patches.drm/drm-rockchip-fix-for-mailbox-read-validation.patch
new file mode 100644
index 0000000000..8a696877e5
--- /dev/null
+++ b/patches.drm/drm-rockchip-fix-for-mailbox-read-validation.patch
@@ -0,0 +1,39 @@
+From e4056bbb6719fe713bfc4030ac78e8e97ddf7574 Mon Sep 17 00:00:00 2001
+From: Damian Kos <dkos@cadence.com>
+Date: Mon, 19 Nov 2018 15:14:14 +0000
+Subject: [PATCH] drm/rockchip: fix for mailbox read validation.
+Git-commit: e4056bbb6719fe713bfc4030ac78e8e97ddf7574
+Patch-mainline: v5.1-rc1
+References: bsc#1111666
+
+This is basically the same fix as in
+commit fa68d4f8476b ("drm/rockchip: fix for mailbox read size")
+but for cdn_dp_mailbox_validate_receive function.
+
+See patchwork.kernel.org/patch/10671981/ for details.
+
+Signed-off-by: Damian Kos <dkos@cadence.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://patchwork.freedesktop.org/patch/msgid/1542640463-18332-1-git-send-email-dkos@cadence.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+index 5a485489a1e2..6c8b14fb1d2f 100644
+--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c
++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c
+@@ -113,7 +113,7 @@ static int cdp_dp_mailbox_write(struct cdn_dp_device *dp, u8 val)
+
+ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
+ u8 module_id, u8 opcode,
+- u8 req_size)
++ u16 req_size)
+ {
+ u32 mbox_size, i;
+ u8 header[4];
+--
+2.16.4
+
diff --git a/patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch b/patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch
new file mode 100644
index 0000000000..bb379c2f0e
--- /dev/null
+++ b/patches.drm/drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch
@@ -0,0 +1,74 @@
+From b8f9d7f37b6af829c34c49d1a4f73ce6ed58e403 Mon Sep 17 00:00:00 2001
+From: Vicente Bergas <vicencb@gmail.com>
+Date: Tue, 2 Apr 2019 13:37:53 +0200
+Subject: [PATCH] drm/rockchip: shutdown drm subsystem on shutdown
+Git-commit: b8f9d7f37b6af829c34c49d1a4f73ce6ed58e403
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+As explained by Robin Murphy:
+> the IOMMU shutdown disables paging, so if the VOP is still
+> scanning out then that will result in whatever IOVAs it was using now going
+> straight out onto the bus as physical addresses.
+
+We had a more radical approach before in commit
+7f3ef5dedb14 ("drm/rockchip: Allow driver to be shutdown on reboot/kexec")
+but that resulted in new warnings and oopses on shutdown on rk3399
+chromeos devices.
+
+So second try is resurrecting Vicentes shutdown change which should
+achieve the same result but in a less drastic way.
+
+Fixes: 63238173b2fa ("Revert "drm/rockchip: Allow driver to be shutdown on reboot/kexec"")
+Cc: Jeffy Chen <jeffy.chen@rock-chips.com>
+Cc: Robin Murphy <robin.murphy@arm.com>
+Cc: Marc Zyngier <marc.zyngier@arm.com>
+Cc: Brian Norris <briannorris@chromium.org>
+Cc: Doug Anderson <dianders@chromium.org>
+Cc: stable@vger.kernel.org
+Suggested-by: JeffyChen <jeffy.chen@rock-chips.com>
+Suggested-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Vicente Bergas <vicencb@gmail.com>
+[adapted commit message to explain the history]
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Tested-by: Brian Norris <briannorris@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190402113753.10118-1-heiko@sntech.de
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/rockchip/rockchip_drm_drv.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+index 8d7a634c12c2..cb938d3cd3c2 100644
+--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c
+@@ -448,6 +448,14 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev)
+ return 0;
+ }
+
++static void rockchip_drm_platform_shutdown(struct platform_device *pdev)
++{
++ struct drm_device *drm = platform_get_drvdata(pdev);
++
++ if (drm)
++ drm_atomic_helper_shutdown(drm);
++}
++
+ static const struct of_device_id rockchip_drm_dt_ids[] = {
+ { .compatible = "rockchip,display-subsystem", },
+ { /* sentinel */ },
+@@ -457,6 +465,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids);
+ static struct platform_driver rockchip_drm_platform_driver = {
+ .probe = rockchip_drm_platform_probe,
+ .remove = rockchip_drm_platform_remove,
++ .shutdown = rockchip_drm_platform_shutdown,
+ .driver = {
+ .name = "rockchip-drm",
+ .of_match_table = rockchip_drm_dt_ids,
+--
+2.16.4
+
diff --git a/patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch b/patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch
new file mode 100644
index 0000000000..c9c3d515d4
--- /dev/null
+++ b/patches.drm/drm-sun4i-tcon-top-Fix-NULL-invalid-pointer-derefere.patch
@@ -0,0 +1,73 @@
+From 1a07a94b47b1f528f39c3e6187b5eaf02efe44ea Mon Sep 17 00:00:00 2001
+From: Ondrej Jirman <megous@megous.com>
+Date: Sat, 6 Apr 2019 01:30:48 +0200
+Subject: [PATCH] drm/sun4i: tcon top: Fix NULL/invalid pointer dereference in sun8i_tcon_top_un/bind
+Git-commit: 1a07a94b47b1f528f39c3e6187b5eaf02efe44ea
+Patch-mainline: v5.1-rc5
+References: bsc#1111666
+
+There are two problems here:
+
+1. Not all clk_data->hws[] need to be initialized, depending on various
+ configured quirks. This leads to NULL ptr deref in
+ clk_hw_unregister_gate() in sun8i_tcon_top_unbind()
+2. If there is error when registering the clk_data->hws[],
+ err_unregister_gates error path will try to unregister
+ IS_ERR()=true (invalid) pointer.
+
+For problem (1) I have this stack trace:
+
+Unable to handle kernel NULL pointer dereference at virtual
+ address 0000000000000008
+Call trace:
+ clk_hw_unregister+0x8/0x18
+ clk_hw_unregister_gate+0x14/0x28
+ sun8i_tcon_top_unbind+0x2c/0x60
+ component_unbind.isra.4+0x2c/0x50
+ component_bind_all+0x1d4/0x230
+ sun4i_drv_bind+0xc4/0x1a0
+ try_to_bring_up_master+0x164/0x1c0
+ __component_add+0xa0/0x168
+ component_add+0x10/0x18
+ sun8i_dw_hdmi_probe+0x18/0x20
+ platform_drv_probe+0x3c/0x70
+ really_probe+0xcc/0x278
+ driver_probe_device+0x34/0xa8
+
+Problem (2) was identified by head scratching.
+
+Signed-off-by: Ondrej Jirman <megous@megous.com>
+Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20190405233048.3823-1-megous@megous.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+index fc36e0c10a37..b1e7c76e9c17 100644
+--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c
+@@ -227,7 +227,7 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master,
+
+ err_unregister_gates:
+ for (i = 0; i < CLK_NUM; i++)
+- if (clk_data->hws[i])
++ if (!IS_ERR_OR_NULL(clk_data->hws[i]))
+ clk_hw_unregister_gate(clk_data->hws[i]);
+ clk_disable_unprepare(tcon_top->bus);
+ err_assert_reset:
+@@ -245,7 +245,8 @@ static void sun8i_tcon_top_unbind(struct device *dev, struct device *master,
+
+ of_clk_del_provider(dev->of_node);
+ for (i = 0; i < CLK_NUM; i++)
+- clk_hw_unregister_gate(clk_data->hws[i]);
++ if (clk_data->hws[i])
++ clk_hw_unregister_gate(clk_data->hws[i]);
+
+ clk_disable_unprepare(tcon_top->bus);
+ reset_control_assert(tcon_top->rst);
+--
+2.16.4
+
diff --git a/patches.drm/drm-tegra-gem-Fix-CPU-cache-maintenance-for-BO-s-all.patch b/patches.drm/drm-tegra-gem-Fix-CPU-cache-maintenance-for-BO-s-all.patch
new file mode 100644
index 0000000000..b0c6589de2
--- /dev/null
+++ b/patches.drm/drm-tegra-gem-Fix-CPU-cache-maintenance-for-BO-s-all.patch
@@ -0,0 +1,55 @@
+From 61b51fb51c01a519a249d28ec55c6513a13be5a3 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Thu, 7 Mar 2019 01:55:19 +0300
+Subject: [PATCH] drm/tegra: gem: Fix CPU-cache maintenance for BO's allocated using get_pages()
+Git-commit: 61b51fb51c01a519a249d28ec55c6513a13be5a3
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+The allocated pages need to be invalidated in CPU caches. On ARM32 the
+DMA_BIDIRECTIONAL flag only ensures that data is written-back to DRAM and
+the data stays in CPU cache lines. While the DMA_FROM_DEVICE flag ensures
+that the corresponding CPU cache lines are getting invalidated and nothing
+more, that's exactly what is needed for a newly allocated pages.
+
+This fixes randomly failing rendercheck tests on Tegra30 using the
+Opentegra driver for tests that use small-sized pixmaps (10x10 and less,
+i.e. 1-2 memory pages) because apparently CPU reads out stale data from
+caches and/or that data is getting evicted to DRAM at the time of HW job
+execution.
+
+Fixes: bd43c9f0fa1f ("drm/tegra: gem: Map pages via the DMA API")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/tegra/gem.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c
+index 4f80100ff5f3..4cce11fd8836 100644
+--- a/drivers/gpu/drm/tegra/gem.c
++++ b/drivers/gpu/drm/tegra/gem.c
+@@ -204,7 +204,7 @@ static void tegra_bo_free(struct drm_device *drm, struct tegra_bo *bo)
+ {
+ if (bo->pages) {
+ dma_unmap_sg(drm->dev, bo->sgt->sgl, bo->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ DMA_FROM_DEVICE);
+ drm_gem_put_pages(&bo->gem, bo->pages, true, true);
+ sg_free_table(bo->sgt);
+ kfree(bo->sgt);
+@@ -230,7 +230,7 @@ static int tegra_bo_get_pages(struct drm_device *drm, struct tegra_bo *bo)
+ }
+
+ err = dma_map_sg(drm->dev, bo->sgt->sgl, bo->sgt->nents,
+- DMA_BIDIRECTIONAL);
++ DMA_FROM_DEVICE);
+ if (err == 0) {
+ err = -EFAULT;
+ goto free_sgt;
+--
+2.16.4
+
diff --git a/patches.drm/drm-tegra-hub-Fix-dereference-before-check.patch b/patches.drm/drm-tegra-hub-Fix-dereference-before-check.patch
new file mode 100644
index 0000000000..b4702f538a
--- /dev/null
+++ b/patches.drm/drm-tegra-hub-Fix-dereference-before-check.patch
@@ -0,0 +1,41 @@
+From 7cf77b273a8fc51e7de622fa6691abd4436a9a6b Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Mon, 11 Feb 2019 11:51:20 +0100
+Subject: [PATCH] drm/tegra: hub: Fix dereference before check
+Git-commit: 7cf77b273a8fc51e7de622fa6691abd4436a9a6b
+Patch-mainline: v5.1-rc3
+References: bsc#1111666
+
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/tegra/hub.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c
+index ba9b3cfb8c3d..b3436c2aed68 100644
+--- a/drivers/gpu/drm/tegra/hub.c
++++ b/drivers/gpu/drm/tegra/hub.c
+@@ -378,14 +378,16 @@ static int tegra_shared_plane_atomic_check(struct drm_plane *plane,
+ static void tegra_shared_plane_atomic_disable(struct drm_plane *plane,
+ struct drm_plane_state *old_state)
+ {
+- struct tegra_dc *dc = to_tegra_dc(old_state->crtc);
+ struct tegra_plane *p = to_tegra_plane(plane);
++ struct tegra_dc *dc;
+ u32 value;
+
+ /* rien ne va plus */
+ if (!old_state || !old_state->crtc)
+ return;
+
++ dc = to_tegra_dc(old_state->crtc);
++
+ /*
+ * XXX Legacy helpers seem to sometimes call ->atomic_disable() even
+ * on planes that are already disabled. Make sure we fallback to the
+--
+2.16.4
+
diff --git a/patches.drm/drm-vmwgfx-Remove-set-but-not-used-variable-restart.patch b/patches.drm/drm-vmwgfx-Remove-set-but-not-used-variable-restart.patch
new file mode 100644
index 0000000000..f533fc1ce4
--- /dev/null
+++ b/patches.drm/drm-vmwgfx-Remove-set-but-not-used-variable-restart.patch
@@ -0,0 +1,61 @@
+From b2130cca9c8db5073b71d832da2a6c8311a8f3bb Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 1 Mar 2019 09:47:43 -0800
+Subject: [PATCH] drm/vmwgfx: Remove set but not used variable 'restart'
+Git-commit: b2130cca9c8db5073b71d832da2a6c8311a8f3bb
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+Drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c: In function 'vmw_cmdbuf_work_func':
+drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c:514:7: warning:
+ variable 'restart' set but not used [-Wunused-but-set-variable]
+
+It not used any more after commit dc366364c4ef ("drm/vmwgfx: Fix multiple
+command buffer context use")
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Signed-off-by: Deepak Rawat <drawat@vmware.com>
+Fixes: dc366364c4ef ("drm/vmwgfx: Fix multiple command buffer context use")
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+index 70dab55e7888..ed15655eacd2 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c
+@@ -511,17 +511,14 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ container_of(work, struct vmw_cmdbuf_man, work);
+ struct vmw_cmdbuf_header *entry, *next;
+ uint32_t dummy;
+- bool restart[SVGA_CB_CONTEXT_MAX];
+ bool send_fence = false;
+ struct list_head restart_head[SVGA_CB_CONTEXT_MAX];
+ int i;
+ struct vmw_cmdbuf_context *ctx;
+ bool global_block = false;
+
+- for_each_cmdbuf_ctx(man, i, ctx) {
++ for_each_cmdbuf_ctx(man, i, ctx)
+ INIT_LIST_HEAD(&restart_head[i]);
+- restart[i] = false;
+- }
+
+ mutex_lock(&man->error_mutex);
+ spin_lock(&man->lock);
+@@ -533,7 +530,6 @@ static void vmw_cmdbuf_work_func(struct work_struct *work)
+ const char *cmd_name;
+
+ list_del_init(&entry->list);
+- restart[entry->cb_context] = true;
+ global_block = true;
+
+ if (!vmw_cmd_describe(header, &error_cmd_size, &cmd_name)) {
+--
+2.16.4
+
diff --git a/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch b/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
index a1afb3c4ac..ca0ac6e584 100644
--- a/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
+++ b/patches.fixes/0001-btrfs-qgroup-Move-reserved-data-accounting-from-btrf.patch
@@ -102,24 +102,25 @@ Fixes: f64d5ca86821 ("btrfs: delayed_ref: Add new function to record reserved sp
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
---
- fs/btrfs/delayed-ref.c | 12 ++++--------
+ fs/btrfs/delayed-ref.c | 14 ++++----------
fs/btrfs/delayed-ref.h | 11 -----------
fs/btrfs/extent-tree.c | 3 ---
fs/btrfs/qgroup.c | 19 +++++++++++++++----
fs/btrfs/qgroup.h | 18 +++++++++++-------
include/trace/events/btrfs.h | 29 -----------------------------
- 6 files changed, 30 insertions(+), 62 deletions(-)
+ 6 files changed, 30 insertions(+), 64 deletions(-)
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
-@@ -618,14 +618,12 @@ add_delayed_ref_head(struct btrfs_fs_inf
- INIT_LIST_HEAD(&head_ref->ref_add_list);
+@@ -590,15 +590,13 @@ static void init_delayed_ref_head(struct
+ RB_CLEAR_NODE(&head_ref->href_node);
head_ref->processing = 0;
head_ref->total_ref_mod = count_mod;
- head_ref->qgroup_reserved = 0;
- head_ref->qgroup_ref_root = 0;
+ spin_lock_init(&head_ref->lock);
+ mutex_init(&head_ref->mutex);
- /* Record qgroup extent info if provided */
if (qrecord) {
if (ref_root && reserved) {
- head_ref->qgroup_ref_root = ref_root;
@@ -129,16 +130,18 @@ Signed-off-by: David Sterba <dsterba@suse.com>
}
qrecord->bytenr = bytenr;
-@@ -647,8 +645,6 @@ add_delayed_ref_head(struct btrfs_fs_inf
+@@ -641,10 +639,6 @@ add_delayed_ref_head(struct btrfs_fs_inf
existing = htree_insert(&delayed_refs->href_root,
&head_ref->href_node);
if (existing) {
-- WARN_ON(ref_root && reserved && existing->qgroup_ref_root
+- WARN_ON(qrecord && head_ref->qgroup_ref_root
+- && head_ref->qgroup_reserved
+- && existing->qgroup_ref_root
- && existing->qgroup_reserved);
- update_existing_head_ref(delayed_refs, &existing->node, ref,
+ update_existing_head_ref(delayed_refs, existing, head_ref,
old_ref_mod);
/*
-@@ -815,7 +811,7 @@ int btrfs_add_delayed_tree_ref(struct bt
+@@ -764,7 +758,7 @@ int btrfs_add_delayed_tree_ref(struct bt
if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) &&
is_fstree(ref_root)) {
@@ -147,7 +150,7 @@ Signed-off-by: David Sterba <dsterba@suse.com>
if (!record)
goto free_head_ref;
}
-@@ -878,7 +874,7 @@ int btrfs_add_delayed_data_ref(struct bt
+@@ -848,7 +842,7 @@ int btrfs_add_delayed_data_ref(struct bt
if (test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags) &&
is_fstree(ref_root)) {
@@ -158,8 +161,8 @@ Signed-off-by: David Sterba <dsterba@suse.com>
kmem_cache_free(btrfs_delayed_ref_head_cachep,
--- a/fs/btrfs/delayed-ref.h
+++ b/fs/btrfs/delayed-ref.h
-@@ -116,17 +116,6 @@ struct btrfs_delayed_ref_head {
- int total_ref_mod;
+@@ -115,17 +115,6 @@ struct btrfs_delayed_ref_head {
+ int ref_mod;
/*
- * For qgroup reserved space freeing.
@@ -178,16 +181,16 @@ Signed-off-by: David Sterba <dsterba@suse.com>
* until the delayed ref is processed. must_insert_reserved is
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
-@@ -2465,9 +2465,6 @@ static int run_one_delayed_ref(struct bt
- }
+@@ -2563,9 +2563,6 @@ static int cleanup_ref_head(struct btrfs
}
-
-- /* Also free its reserved qgroup space */
-- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
-- head->qgroup_reserved);
- return ret;
}
+- /* Also free its reserved qgroup space */
+- btrfs_qgroup_free_delayed_ref(fs_info, head->qgroup_ref_root,
+- head->qgroup_reserved);
+ btrfs_delayed_ref_unlock(head);
+ btrfs_put_delayed_ref_head(head);
+ return 0;
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -1488,12 +1488,18 @@ int btrfs_qgroup_trace_extent_nolock(str
@@ -269,7 +272,7 @@ Signed-off-by: David Sterba <dsterba@suse.com>
int btrfs_verify_qgroup_counts(struct btrfs_fs_info *fs_info, u64 qgroupid,
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
-@@ -1516,35 +1516,6 @@ DEFINE_EVENT(btrfs__qgroup_rsv_data, btr
+@@ -1513,35 +1513,6 @@ DEFINE_EVENT(btrfs__qgroup_rsv_data, btr
TP_ARGS(inode, start, len, reserved, op)
);
diff --git a/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch b/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch
index 4dae97abe4..4d5eb8d080 100644
--- a/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch
+++ b/patches.fixes/0001-btrfs-reloc-Fix-NULL-pointer-dereference-due-to-expa.patch
@@ -1,8 +1,9 @@
From e8fd2e459649ab5105cc627018dd25ea395719de Mon Sep 17 00:00:00 2001
From: Qu Wenruo <wqu@suse.com>
Date: Mon, 18 Mar 2019 10:37:22 +0800
-Patch-mainline: Submitted, for v5.1
-References: bsc#1129497
+Patch-mainline: v5.2-rc1
+Git-commit: 10995c0491204c861948c9850939a7f4e90760a4
+References: bsc#1129497 bsc#1134651
Subject: [PATCH] btrfs: reloc: Fix NULL pointer dereference due to expanded
reloc_root lifespan
diff --git a/patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch b/patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch
new file mode 100644
index 0000000000..af7026daec
--- /dev/null
+++ b/patches.fixes/0001-dt-bindings-net-Fix-a-typo-in-the-phy-mode-list-for-.patch
@@ -0,0 +1,37 @@
+From 822dd046d7e22a8d01728200a003da230e4c6f7f Mon Sep 17 00:00:00 2001
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Tue, 7 May 2019 17:35:55 +0200
+Subject: [PATCH] dt-bindings: net: Fix a typo in the phy-mode list for
+ ethernet bindings
+Git-commit: 822dd046d7e22a8d01728200a003da230e4c6f7f
+Patch-mainline: v5.1
+References: bsc#1129770
+
+The phy_mode "2000base-x" is actually supposed to be "1000base-x", even
+though the commit title of the original patch says otherwise.
+
+Fixes: 55601a880690 ("net: phy: Add 2000base-x, 2500base-x and rxaui modes")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Reviewed-by: Fabian Baumanis <fabian.baumanis@suse.com>
+---
+ Documentation/devicetree/bindings/net/ethernet.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Documentation/devicetree/bindings/net/ethernet.txt b/Documentation/devicetree/bindings/net/ethernet.txt
+index a68621580584..d45b5b56fa39 100644
+--- a/Documentation/devicetree/bindings/net/ethernet.txt
++++ b/Documentation/devicetree/bindings/net/ethernet.txt
+@@ -36,7 +36,7 @@ Documentation/devicetree/bindings/phy/phy-bindings.txt.
+ * "smii"
+ * "xgmii"
+ * "trgmii"
+- * "2000base-x",
++ * "1000base-x",
+ * "2500base-x",
+ * "rxaui"
+ * "xaui"
+--
+2.16.4
+
diff --git a/patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch b/patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch
new file mode 100644
index 0000000000..408b10e725
--- /dev/null
+++ b/patches.fixes/0001-media-pvrusb2-Prevent-a-buffer-overflow.patch
@@ -0,0 +1,61 @@
+From c1ced46c7b49ad7bc064e68d966e0ad303f917fb Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 8 Apr 2019 05:52:38 -0400
+Subject: [PATCH] media: pvrusb2: Prevent a buffer overflow
+Git-commit: c1ced46c7b49ad7bc064e68d966e0ad303f917fb
+Patch-mainline: v5.1
+References: bsc#1129770
+
+The ctrl_check_input() function is called from pvr2_ctrl_range_check().
+It's supposed to validate user supplied input and return true or false
+depending on whether the input is valid or not. The problem is that
+negative shifts or shifts greater than 31 are undefined in C. In
+practice with GCC they result in shift wrapping so this function returns
+true for some inputs which are not valid and this could result in a
+buffer overflow:
+
+ drivers/media/usb/pvrusb2/pvrusb2-ctrl.c:205 pvr2_ctrl_get_valname()
+ warn: uncapped user index 'names[val]'
+
+The cptr->hdw->input_allowed_mask mask is configured in pvr2_hdw_create()
+and the highest valid bit is BIT(4).
+
+Fixes: 7fb20fa38caa ("V4L/DVB (7299): pvrusb2: Improve logic which handles input choice availability")
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 2 ++
+ drivers/media/usb/pvrusb2/pvrusb2-hdw.h | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 51112b7988e4..816c85786c2a 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -666,6 +666,8 @@ static int ctrl_get_input(struct pvr2_ctrl *cptr,int *vp)
+
+ static int ctrl_check_input(struct pvr2_ctrl *cptr,int v)
+ {
++ if (v < 0 || v > PVR2_CVAL_INPUT_MAX)
++ return 0;
+ return ((1 << v) & cptr->hdw->input_allowed_mask) != 0;
+ }
+
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
+index 25648add77e5..bd2b7a67b732 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
+@@ -50,6 +50,7 @@
+ #define PVR2_CVAL_INPUT_COMPOSITE 2
+ #define PVR2_CVAL_INPUT_SVIDEO 3
+ #define PVR2_CVAL_INPUT_RADIO 4
++#define PVR2_CVAL_INPUT_MAX PVR2_CVAL_INPUT_RADIO
+
+ enum pvr2_config {
+ pvr2_config_empty, /* No configuration */
+--
+2.16.4
+
diff --git a/patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch b/patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch
new file mode 100644
index 0000000000..14339e2271
--- /dev/null
+++ b/patches.fixes/0001-mtd-spi-nor-intel-spi-Avoid-crossing-4K-address-boun.patch
@@ -0,0 +1,73 @@
+From 2b75ebeea6f4937d4d05ec4982c471cef9a29b7f Mon Sep 17 00:00:00 2001
+From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Date: Tue, 19 Mar 2019 17:18:07 +0000
+Subject: [PATCH] mtd: spi-nor: intel-spi: Avoid crossing 4K address boundary
+ on read/write
+Git-commit: 2b75ebeea6f4937d4d05ec4982c471cef9a29b7f
+Patch-mainline: v5.1
+References: bsc#1129770
+
+It was observed that reads crossing 4K address boundary are failing.
+
+This limitation is mentioned in Intel documents:
+
+Intel(R) 9 Series Chipset Family Platform Controller Hub (PCH) Datasheet:
+
+"5.26.3 Flash Access
+Program Register Access:
+* Program Register Accesses are not allowed to cross a 4 KB boundary..."
+
+Enhanced Serial Peripheral Interface (eSPI)
+Interface Base Specification (for Client and Server Platforms):
+
+"5.1.4 Address
+For other memory transactions, the address may start or end at any byte
+boundary. However, the address and payload length combination must not
+cross the naturally aligned address boundary of the corresponding Maximum
+Payload Size. It must not cross a 4 KB address boundary."
+
+Avoid this by splitting an operation crossing the boundary into two
+operations.
+
+Fixes: 8afda8b26d01 ("spi-nor: Add support for Intel SPI serial flash controller")
+Cc: stable@vger.kernel.org
+Reported-by: Romain Porte <romain.porte@nokia.com>
+Tested-by: Pascal Fabreges <pascal.fabreges@nokia.com>
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
+Reviewed-by: Tudor Ambarus <tudor.ambarus@microchip.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/mtd/spi-nor/intel-spi.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/mtd/spi-nor/intel-spi.c b/drivers/mtd/spi-nor/intel-spi.c
+index af0a22019516..d60cbf23d9aa 100644
+--- a/drivers/mtd/spi-nor/intel-spi.c
++++ b/drivers/mtd/spi-nor/intel-spi.c
+@@ -632,6 +632,10 @@ static ssize_t intel_spi_read(struct spi_nor *nor, loff_t from, size_t len,
+ while (len > 0) {
+ block_size = min_t(size_t, len, INTEL_SPI_FIFO_SZ);
+
++ /* Read cannot cross 4K boundary */
++ block_size = min_t(loff_t, from + block_size,
++ round_up(from + 1, SZ_4K)) - from;
++
+ writel(from, ispi->base + FADDR);
+
+ val = readl(ispi->base + HSFSTS_CTL);
+@@ -685,6 +689,10 @@ static ssize_t intel_spi_write(struct spi_nor *nor, loff_t to, size_t len,
+ while (len > 0) {
+ block_size = min_t(size_t, len, INTEL_SPI_FIFO_SZ);
+
++ /* Write cannot cross 4K boundary */
++ block_size = min_t(loff_t, to + block_size,
++ round_up(to + 1, SZ_4K)) - to;
++
+ writel(to, ispi->base + FADDR);
+
+ val = readl(ispi->base + HSFSTS_CTL);
+--
+2.16.4
+
diff --git a/patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch b/patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch
new file mode 100644
index 0000000000..39873058a0
--- /dev/null
+++ b/patches.fixes/CIFS-keep-FileInfo-handle-live-during-oplock-break.patch
@@ -0,0 +1,186 @@
+From: Aurelien Aptel <aaptel@suse.com>
+Date: Fri, 29 Mar 2019 10:49:12 +0100
+Subject: [PATCH] CIFS: keep FileInfo handle live during oplock break
+Git-commit: b98749cac4a695f084a5ff076f4510b23e353ecd
+References: bsc#1106284, bsc#1131565
+Patch-mainline: v5.1-rc6
+
+In the oplock break handler, writing pending changes from pages puts
+the FileInfo handle. If the refcount reaches zero it closes the handle
+and waits for any oplock break handler to return, thus causing a deadlock.
+
+To prevent this situation:
+
+* We add a wait flag to cifsFileInfo_put() to decide whether we should
+ wait for running/pending oplock break handlers
+
+* We keep an additionnal reference of the SMB FileInfo handle so that
+ for the rest of the handler putting the handle won't close it.
+ - The ref is bumped everytime we queue the handler via the
+ cifs_queue_oplock_break() helper.
+ - The ref is decremented at the end of the handler
+
+This bug was triggered by xfstest 464.
+
+Also important fix to address the various reports of
+oops in smb2_push_mandatory_locks
+
+Signed-off-by: Aurelien Aptel <aaptel@suse.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+---
+ fs/cifs/cifsglob.h | 2 ++
+ fs/cifs/file.c | 30 +++++++++++++++++++++++++-----
+ fs/cifs/misc.c | 25 +++++++++++++++++++++++--
+ fs/cifs/smb2misc.c | 6 +++---
+ 4 files changed, 53 insertions(+), 10 deletions(-)
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 5b18d4585740..585ad3207cb1 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1333,6 +1333,7 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
+ }
+
+ struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file);
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr);
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+
+ #define CIFS_CACHE_READ_FLG 1
+@@ -1855,6 +1856,7 @@ GLOBAL_EXTERN spinlock_t gidsidlock;
+ #endif /* CONFIG_CIFS_ACL */
+
+ void cifs_oplock_break(struct work_struct *work);
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile);
+
+ extern const struct slow_work_ops cifs_oplock_break_ops;
+ extern struct workqueue_struct *cifsiod_wq;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 89006e044973..9c0ccc06d172 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -360,12 +360,30 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file)
+ return cifs_file;
+ }
+
+-/*
+- * Release a reference on the file private data. This may involve closing
+- * the filehandle out on the server. Must be called without holding
+- * tcon->open_file_lock and cifs_file->file_info_lock.
++/**
++ * cifsFileInfo_put - release a reference of file priv data
++ *
++ * Always potentially wait for oplock handler. See _cifsFileInfo_put().
+ */
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
++{
++ _cifsFileInfo_put(cifs_file, true);
++}
++
++/**
++ * _cifsFileInfo_put - release a reference of file priv data
++ *
++ * This may involve closing the filehandle @cifs_file out on the
++ * server. Must be called without holding tcon->open_file_lock and
++ * cifs_file->file_info_lock.
++ *
++ * If @wait_for_oplock_handler is true and we are releasing the last
++ * reference, wait for any running oplock break handler of the file
++ * and cancel any pending one. If calling this function from the
++ * oplock break handler, you need to pass false.
++ *
++ */
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ {
+ struct inode *inode = d_inode(cifs_file->dentry);
+ struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+@@ -414,7 +432,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+
+ spin_unlock(&tcon->open_file_lock);
+
+- oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
++ oplock_break_cancelled = wait_oplock_handler ?
++ cancel_work_sync(&cifs_file->oplock_break) : false;
+
+ if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ struct TCP_Server_Info *server = tcon->ses->server;
+@@ -4603,6 +4622,7 @@ void cifs_oplock_break(struct work_struct *work)
+ cinode);
+ cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+ }
++ _cifsFileInfo_put(cfile, false /* do not wait for ourself */);
+ cifs_done_oplock_break(cinode);
+ }
+
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index bee203055b30..1e1626a2cfc3 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -501,8 +501,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &pCifsInode->flags);
+
+- queue_work(cifsoplockd_wq,
+- &netfile->oplock_break);
++ cifs_queue_oplock_break(netfile);
+ netfile->oplock_break_cancelled = false;
+
+ spin_unlock(&tcon->open_file_lock);
+@@ -607,6 +606,28 @@ void cifs_put_writer(struct cifsInodeInfo *cinode)
+ spin_unlock(&cinode->writers_lock);
+ }
+
++/**
++ * cifs_queue_oplock_break - queue the oplock break handler for cfile
++ *
++ * This function is called from the demultiplex thread when it
++ * receives an oplock break for @cfile.
++ *
++ * Assumes the tcon->open_file_lock is held.
++ * Assumes cfile->file_info_lock is NOT held.
++ */
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile)
++{
++ /*
++ * Bump the handle refcount now while we hold the
++ * open_file_lock to enforce the validity of it for the oplock
++ * break handler. The matching put is done at the end of the
++ * handler.
++ */
++ cifsFileInfo_get(cfile);
++
++ queue_work(cifsoplockd_wq, &cfile->oplock_break);
++}
++
+ void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
+ {
+ clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 0e3570e40ff8..e311f58dc1c8 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -555,7 +555,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+
+- queue_work(cifsoplockd_wq, &cfile->oplock_break);
++ cifs_queue_oplock_break(cfile);
+ kfree(lw);
+ return true;
+ }
+@@ -712,8 +712,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ &cinode->flags);
+ spin_unlock(&cfile->file_info_lock);
+- queue_work(cifsoplockd_wq,
+- &cfile->oplock_break);
++
++ cifs_queue_oplock_break(cfile);
+
+ spin_unlock(&tcon->open_file_lock);
+ spin_unlock(&cifs_tcp_ses_lock);
+--
+2.16.4
+
+
diff --git a/patches.fixes/Revert-ide-unexport-DISK_EVENT_MEDIA_CHANGE-for-i.patch b/patches.fixes/Revert-ide-unexport-DISK_EVENT_MEDIA_CHANGE-for-i.patch
new file mode 100644
index 0000000000..645e6bd3c6
--- /dev/null
+++ b/patches.fixes/Revert-ide-unexport-DISK_EVENT_MEDIA_CHANGE-for-i.patch
@@ -0,0 +1,73 @@
+From 10fbb65794ebfdbae6c87d08a270503487866715 Mon Sep 17 00:00:00 2001
+From: Martin Wilck <mwilck@suse.com>
+Date: Thu, 17 Jan 2019 22:46:56 +0100
+Subject: [PATCH v2 2/4] Revert "ide: unexport DISK_EVENT_MEDIA_CHANGE for
+ ide-gd and ide-cd"
+Patch-mainline: v5.2-rc1
+Git-commit: 3c12c8e94ca04d668ad0cded7857fea2637834b3
+References: bsc#1110946, bsc#1119843
+
+This reverts commit 7eec77a1816a7042591a6cbdb4820e9e7ebffe0e.
+
+Instead of leaving disk->events completely empty, we now export the supported
+events again, and tell the block layer not to forward events to user space by
+not setting DISK_EVENT_FLAG_UEVENT. This allows the block layer to distinguish
+between devices that for which events should be handled in kernel only, and
+devices which don't support any meda change events at all.
+
+Changed wrt v1: fixed editing error made during revert.
+
+Cc: Borislav Petkov <bp@alien8.de>
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+---
+ drivers/ide/ide-cd.c | 1 +
+ drivers/ide/ide-cd_ioctl.c | 5 +++--
+ drivers/ide/ide-gd.c | 6 ++++--
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/ide/ide-cd.c
++++ b/drivers/ide/ide-cd.c
+@@ -1792,6 +1792,7 @@ static int ide_cd_probe(ide_drive_t *dri
+ ide_cd_read_toc(drive);
+ g->fops = &idecd_ops;
+ g->flags |= GENHD_FL_REMOVABLE | GENHD_FL_BLOCK_EVENTS_ON_EXCL_WRITE;
++ g->events = DISK_EVENT_MEDIA_CHANGE;
+ device_add_disk(&drive->gendev, g, NULL);
+ return 0;
+
+--- a/drivers/ide/ide-cd_ioctl.c
++++ b/drivers/ide/ide-cd_ioctl.c
+@@ -81,8 +81,9 @@ int ide_cdrom_drive_status(struct cdrom_
+
+ /*
+ * ide-cd always generates media changed event if media is missing, which
+- * makes it impossible to use for proper event reporting, so disk->events
+- * is cleared to 0 and the following function is used only to trigger
++ * makes it impossible to use for proper event reporting, so
++ * DISK_EVENT_FLAG_UEVENT is cleared in disk->events
++ * and the following function is used only to trigger
+ * revalidation and never propagated to userland.
+ */
+ unsigned int ide_cdrom_check_events_real(struct cdrom_device_info *cdi,
+--- a/drivers/ide/ide-gd.c
++++ b/drivers/ide/ide-gd.c
+@@ -299,8 +299,9 @@ static unsigned int ide_gd_check_events(
+ /*
+ * The following is used to force revalidation on the first open on
+ * removeable devices, and never gets reported to userland as
+- * genhd->events is 0. This is intended as removeable ide disk
+- * can't really detect MEDIA_CHANGE events.
++ * DISK_EVENT_FLAG_UEVENT isn't set in genhd->events.
++ * This is intended as removeable ide disk can't really detect
++ * MEDIA_CHANGE events.
+ */
+ ret = drive->dev_flags & IDE_DFLAG_MEDIA_CHANGED;
+ drive->dev_flags &= ~IDE_DFLAG_MEDIA_CHANGED;
+@@ -416,6 +417,7 @@ static int ide_gd_probe(ide_drive_t *dri
+ if (drive->dev_flags & IDE_DFLAG_REMOVABLE)
+ g->flags = GENHD_FL_REMOVABLE;
+ g->fops = &ide_gd_ops;
++ g->events = DISK_EVENT_MEDIA_CHANGE;
+ device_add_disk(&drive->gendev, g, NULL);
+ return 0;
+
diff --git a/patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch b/patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch
deleted file mode 100644
index 8f2f809fd5..0000000000
--- a/patches.fixes/block_dev-fix-crash-on-chained-bios-with-O_DIRECT.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From: Hannes Reinecke <hare@suse.de>
-Date: Wed, 20 Mar 2019 08:58:07 +0100
-Subject: [PATCH] block_dev: fix crash on chained bios with O_DIRECT
-Patch-Mainline: submitted linux-block 2019/03/20
-References: bsc#1128094
-
-__blkdev_direct_IO_simple() is allocating a bio on the stack.
-When that bio needs to be split bio_chain_endio() invokes bio_put()
-on this bio, causing the kernel to crash in mempool_free() as the
-bio was never allocated from a mempool in the first place.
-So call bio_get() before submitting to avoid this problem.
-
-Signed-off-by: Hannes Reinecke <hare@suse.com>
----
- fs/block_dev.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 7a9a14df1d82..4acd35663ae7 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -256,6 +256,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
- task_io_account_write(ret);
- }
-
-+ bio_get(&bio);
- qc = submit_bio(&bio);
- for (;;) {
- set_current_state(TASK_UNINTERRUPTIBLE);
-@@ -275,7 +276,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter,
-
- if (unlikely(bio.bi_status))
- ret = blk_status_to_errno(bio.bi_status);
--
-+ bio_put(&bio);
- out:
- if (vecs != inline_vecs)
- kfree(vecs);
---
-2.16.4
-
diff --git a/patches.fixes/ceph-ensure-d_name-stability-in-ceph_dentry_hash.patch b/patches.fixes/ceph-ensure-d_name-stability-in-ceph_dentry_hash.patch
new file mode 100644
index 0000000000..2d0b2b3956
--- /dev/null
+++ b/patches.fixes/ceph-ensure-d_name-stability-in-ceph_dentry_hash.patch
@@ -0,0 +1,42 @@
+From: Jeff Layton <jlayton@kernel.org>
+Date: Wed, 17 Apr 2019 12:58:28 -0400
+Subject: ceph: ensure d_name stability in ceph_dentry_hash()
+Git-commit: 76a495d666e5043ffc315695f8241f5e94a98849
+Patch-mainline: v5.1-rc7
+References: bsc#1134461
+
+Take the d_lock here to ensure that d_name doesn't change.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/dir.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -1466,6 +1466,7 @@ void ceph_dentry_lru_del(struct dentry *
+ unsigned ceph_dentry_hash(struct inode *dir, struct dentry *dn)
+ {
+ struct ceph_inode_info *dci = ceph_inode(dir);
++ unsigned hash;
+
+ switch (dci->i_dir_layout.dl_dir_hash) {
+ case 0: /* for backward compat */
+@@ -1473,8 +1474,11 @@ unsigned ceph_dentry_hash(struct inode *
+ return dn->d_name.hash;
+
+ default:
+- return ceph_str_hash(dci->i_dir_layout.dl_dir_hash,
++ spin_lock(&dn->d_lock);
++ hash = ceph_str_hash(dci->i_dir_layout.dl_dir_hash,
+ dn->d_name.name, dn->d_name.len);
++ spin_unlock(&dn->d_lock);
++ return hash;
+ }
+ }
+
+
diff --git a/patches.fixes/ceph-fix-ci-i_head_snapc-leak.patch b/patches.fixes/ceph-fix-ci-i_head_snapc-leak.patch
new file mode 100644
index 0000000000..00e3b4cca6
--- /dev/null
+++ b/patches.fixes/ceph-fix-ci-i_head_snapc-leak.patch
@@ -0,0 +1,56 @@
+From: "Yan, Zheng" <zyan@redhat.com>
+Date: Thu, 18 Apr 2019 11:24:57 +0800
+Subject: ceph: fix ci->i_head_snapc leak
+Git-commit: 37659182bff1eeaaeadcfc8f853c6d2b6dbc3f47
+Patch-mainline: v5.1-rc7
+References: bsc#1122776
+
+We missed two places that i_wrbuffer_ref_head, i_wr_ref, i_dirty_caps
+and i_flushing_caps may change. When they are all zeros, we should free
+i_head_snapc.
+
+Cc: stable@vger.kernel.org
+Link: https://tracker.ceph.com/issues/38224
+Reported-and-tested-by: Luis Henriques <lhenriques@suse.com>
+Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/mds_client.c | 9 +++++++++
+ fs/ceph/snap.c | 7 ++++++-
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1259,6 +1259,15 @@ static int remove_session_caps_cb(struct
+ list_add(&ci->i_prealloc_cap_flush->i_list, &to_remove);
+ ci->i_prealloc_cap_flush = NULL;
+ }
++
++ if (drop &&
++ ci->i_wrbuffer_ref_head == 0 &&
++ ci->i_wr_ref == 0 &&
++ ci->i_dirty_caps == 0 &&
++ ci->i_flushing_caps == 0) {
++ ceph_put_snap_context(ci->i_head_snapc);
++ ci->i_head_snapc = NULL;
++ }
+ }
+ spin_unlock(&ci->i_ceph_lock);
+ while (!list_empty(&to_remove)) {
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -567,7 +567,12 @@ void ceph_queue_cap_snap(struct ceph_ino
+ old_snapc = NULL;
+
+ update_snapc:
+- if (ci->i_head_snapc) {
++ if (ci->i_wrbuffer_ref_head == 0 &&
++ ci->i_wr_ref == 0 &&
++ ci->i_dirty_caps == 0 &&
++ ci->i_flushing_caps == 0) {
++ ci->i_head_snapc = NULL;
++ } else {
+ ci->i_head_snapc = ceph_get_snap_context(new_snapc);
+ dout(" new snapc is %p\n", new_snapc);
+ }
diff --git a/patches.fixes/ceph-fix-use-after-free-on-symlink-traversal.patch b/patches.fixes/ceph-fix-use-after-free-on-symlink-traversal.patch
new file mode 100644
index 0000000000..5741476ec1
--- /dev/null
+++ b/patches.fixes/ceph-fix-use-after-free-on-symlink-traversal.patch
@@ -0,0 +1,38 @@
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Tue, 26 Mar 2019 01:38:58 +0000
+Subject: ceph: fix use-after-free on symlink traversal
+Git-commit: daf5cc27eed99afdea8d96e71b89ba41f5406ef6
+Patch-mainline: v5.1-rc3
+References: bsc#1134459
+
+free the symlink body after the same RCU delay we have for freeing the
+struct inode itself, so that traversal during RCU pathwalk wouldn't step
+into freed memory.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -523,6 +523,7 @@ static void ceph_i_callback(struct rcu_h
+ struct inode *inode = container_of(head, struct inode, i_rcu);
+ struct ceph_inode_info *ci = ceph_inode(inode);
+
++ kfree(ci->i_symlink);
+ kmem_cache_free(ceph_inode_cachep, ci);
+ }
+
+@@ -560,7 +561,6 @@ void ceph_destroy_inode(struct inode *in
+ ceph_put_snap_realm(mdsc, realm);
+ }
+
+- kfree(ci->i_symlink);
+ while ((n = rb_first(&ci->i_fragtree)) != NULL) {
+ frag = rb_entry(n, struct ceph_inode_frag, node);
+ rb_erase(n, &ci->i_fragtree);
+
diff --git a/patches.fixes/ceph-only-use-d_name-directly-when-parent-is-locked.patch b/patches.fixes/ceph-only-use-d_name-directly-when-parent-is-locked.patch
new file mode 100644
index 0000000000..3e5ee57a77
--- /dev/null
+++ b/patches.fixes/ceph-only-use-d_name-directly-when-parent-is-locked.patch
@@ -0,0 +1,163 @@
+From: Jeff Layton <jlayton@kernel.org>
+Date: Mon, 15 Apr 2019 12:00:42 -0400
+Subject: ceph: only use d_name directly when parent is locked
+Git-commit: 1bcb344086f3ecf8d6705f6d708441baa823beb3
+Patch-mainline: v5.1-rc7
+References: bsc#1134460
+
+Ben reported tripping the BUG_ON in create_request_message during some
+performance testing. Analysis of the vmcore showed that the length of
+the r_dentry->d_name string changed after we allocated the buffer, but
+before we encoded it.
+
+build_dentry_path returns pointers to d_name in the common case of
+non-snapped dentries, but this optimization isn't safe unless the parent
+directory is locked. When it isn't, have the code make a copy of the
+d_name while holding the d_lock.
+
+Cc: stable@vger.kernel.org
+Reported-by: Ben England <bengland@redhat.com>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+---
+ fs/ceph/mds_client.c | 61 +++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 50 insertions(+), 11 deletions(-)
+
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -1912,10 +1912,39 @@ retry:
+ return path;
+ }
+
++/* Duplicate the dentry->d_name.name safely */
++static int clone_dentry_name(struct dentry *dentry, const char **ppath,
++ int *ppathlen)
++{
++ u32 len;
++ char *name;
++
++retry:
++ len = READ_ONCE(dentry->d_name.len);
++ name = kmalloc(len + 1, GFP_NOFS);
++ if (!name)
++ return -ENOMEM;
++
++ spin_lock(&dentry->d_lock);
++ if (dentry->d_name.len != len) {
++ spin_unlock(&dentry->d_lock);
++ kfree(name);
++ goto retry;
++ }
++ memcpy(name, dentry->d_name.name, len);
++ spin_unlock(&dentry->d_lock);
++
++ name[len] = '\0';
++ *ppath = name;
++ *ppathlen = len;
++ return 0;
++}
++
+ static int build_dentry_path(struct dentry *dentry, struct inode *dir,
+ const char **ppath, int *ppathlen, u64 *pino,
+- int *pfreepath)
++ bool *pfreepath, bool parent_locked)
+ {
++ int ret;
+ char *path;
+
+ rcu_read_lock();
+@@ -1924,8 +1953,15 @@ static int build_dentry_path(struct dent
+ if (dir && ceph_snap(dir) == CEPH_NOSNAP) {
+ *pino = ceph_ino(dir);
+ rcu_read_unlock();
+- *ppath = dentry->d_name.name;
+- *ppathlen = dentry->d_name.len;
++ if (parent_locked) {
++ *ppath = dentry->d_name.name;
++ *ppathlen = dentry->d_name.len;
++ } else {
++ ret = clone_dentry_name(dentry, ppath, ppathlen);
++ if (ret)
++ return ret;
++ *pfreepath = true;
++ }
+ return 0;
+ }
+ rcu_read_unlock();
+@@ -1933,13 +1969,13 @@ static int build_dentry_path(struct dent
+ if (IS_ERR(path))
+ return PTR_ERR(path);
+ *ppath = path;
+- *pfreepath = 1;
++ *pfreepath = true;
+ return 0;
+ }
+
+ static int build_inode_path(struct inode *inode,
+ const char **ppath, int *ppathlen, u64 *pino,
+- int *pfreepath)
++ bool *pfreepath)
+ {
+ struct dentry *dentry;
+ char *path;
+@@ -1955,7 +1991,7 @@ static int build_inode_path(struct inode
+ if (IS_ERR(path))
+ return PTR_ERR(path);
+ *ppath = path;
+- *pfreepath = 1;
++ *pfreepath = true;
+ return 0;
+ }
+
+@@ -1966,7 +2002,7 @@ static int build_inode_path(struct inode
+ static int set_request_path_attr(struct inode *rinode, struct dentry *rdentry,
+ struct inode *rdiri, const char *rpath,
+ u64 rino, const char **ppath, int *pathlen,
+- u64 *ino, int *freepath)
++ u64 *ino, bool *freepath, bool parent_locked)
+ {
+ int r = 0;
+
+@@ -1976,7 +2012,7 @@ static int set_request_path_attr(struct
+ ceph_snap(rinode));
+ } else if (rdentry) {
+ r = build_dentry_path(rdentry, rdiri, ppath, pathlen, ino,
+- freepath);
++ freepath, parent_locked);
+ dout(" dentry %p %llx/%.*s\n", rdentry, *ino, *pathlen,
+ *ppath);
+ } else if (rpath || rino) {
+@@ -2002,7 +2038,7 @@ static struct ceph_msg *create_request_m
+ const char *path2 = NULL;
+ u64 ino1 = 0, ino2 = 0;
+ int pathlen1 = 0, pathlen2 = 0;
+- int freepath1 = 0, freepath2 = 0;
++ bool freepath1 = false, freepath2 = false;
+ int len;
+ u16 releases;
+ void *p, *end;
+@@ -2010,16 +2046,19 @@ static struct ceph_msg *create_request_m
+
+ ret = set_request_path_attr(req->r_inode, req->r_dentry,
+ req->r_parent, req->r_path1, req->r_ino1.ino,
+- &path1, &pathlen1, &ino1, &freepath1);
++ &path1, &pathlen1, &ino1, &freepath1,
++ test_bit(CEPH_MDS_R_PARENT_LOCKED,
++ &req->r_req_flags));
+ if (ret < 0) {
+ msg = ERR_PTR(ret);
+ goto out;
+ }
+
++ /* If r_old_dentry is set, then assume that its parent is locked */
+ ret = set_request_path_attr(NULL, req->r_old_dentry,
+ req->r_old_dentry_dir,
+ req->r_path2, req->r_ino2.ino,
+- &path2, &pathlen2, &ino2, &freepath2);
++ &path2, &pathlen2, &ino2, &freepath2, true);
+ if (ret < 0) {
+ msg = ERR_PTR(ret);
+ goto out_free1;
+
diff --git a/patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch b/patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch
new file mode 100644
index 0000000000..83779f34ed
--- /dev/null
+++ b/patches.fixes/kernel-sysctl.c-add-missing-range-check-in-do_proc_d.patch
@@ -0,0 +1,56 @@
+From 8cf7630b29701d364f8df4a50e4f1f5e752b2778 Mon Sep 17 00:00:00 2001
+From: Zev Weiss <zev@bewilderbeest.net>
+Date: Mon, 11 Mar 2019 23:28:02 -0700
+Subject: [PATCH] kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
+Git-commit: 8cf7630b29701d364f8df4a50e4f1f5e752b2778
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+This bug has apparently existed since the introduction of this function
+in the pre-git era (4500e91754d3 in Thomas Gleixner's history.git,
+"[net]: Add proc_dointvec_userhz_jiffies, use it for proper handling of
+neighbour sysctls.").
+
+As a minimal fix we can simply duplicate the corresponding check in
+do_proc_dointvec_conv().
+
+Link: http://lkml.kernel.org/r/20190207123426.9202-3-zev@bewilderbeest.net
+Signed-off-by: Zev Weiss <zev@bewilderbeest.net>
+Cc: Brendan Higgins <brendanhiggins@google.com>
+Cc: Iurii Zaikin <yzaikin@google.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Luis Chamberlain <mcgrof@kernel.org>
+Cc: <stable@vger.kernel.org> [2.6.2+]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/sysctl.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 7bb3988425ee..0854197e0e67 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2645,7 +2645,16 @@ static int do_proc_dointvec_minmax_conv(bool *negp, unsigned long *lvalp,
+ {
+ struct do_proc_dointvec_minmax_conv_param *param = data;
+ if (write) {
+- int val = *negp ? -*lvalp : *lvalp;
++ int val;
++ if (*negp) {
++ if (*lvalp > (unsigned long) INT_MAX + 1)
++ return -EINVAL;
++ val = -*lvalp;
++ } else {
++ if (*lvalp > (unsigned long) INT_MAX)
++ return -EINVAL;
++ val = *lvalp;
++ }
+ if ((param->min && *param->min > val) ||
+ (param->max && *param->max < val))
+ return -EINVAL;
+--
+2.16.4
+
diff --git a/patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch b/patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch
new file mode 100644
index 0000000000..2060de230a
--- /dev/null
+++ b/patches.fixes/kernel-sysctl.c-fix-out-of-bounds-access-when-settin.patch
@@ -0,0 +1,93 @@
+From 9002b21465fa4d829edfc94a5a441005cffaa972 Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Fri, 5 Apr 2019 18:39:38 -0700
+Subject: [PATCH] kernel/sysctl.c: fix out-of-bounds access when setting file-max
+Git-commit: 9002b21465fa4d829edfc94a5a441005cffaa972
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+Commit 32a5ad9c2285 ("sysctl: handle overflow for file-max") hooked up
+min/max values for the file-max sysctl parameter via the .extra1 and
+.extra2 fields in the corresponding struct ctl_table entry.
+
+Unfortunately, the minimum value points at the global 'zero' variable,
+which is an int. This results in a KASAN splat when accessed as a long
+by proc_doulongvec_minmax on 64-bit architectures:
+
+ | BUG: KASAN: global-out-of-bounds in __do_proc_doulongvec_minmax+0x5d8/0x6a0
+ | Read of size 8 at addr ffff2000133d1c20 by task systemd/1
+ |
+ | CPU: 0 PID: 1 Comm: systemd Not tainted 5.1.0-rc3-00012-g40b114779944 #2
+ | Hardware name: linux,dummy-virt (DT)
+ | Call trace:
+ | dump_backtrace+0x0/0x228
+ | show_stack+0x14/0x20
+ | dump_stack+0xe8/0x124
+ | print_address_description+0x60/0x258
+ | kasan_report+0x140/0x1a0
+ | __asan_report_load8_noabort+0x18/0x20
+ | __do_proc_doulongvec_minmax+0x5d8/0x6a0
+ | proc_doulongvec_minmax+0x4c/0x78
+ | proc_sys_call_handler.isra.19+0x144/0x1d8
+ | proc_sys_write+0x34/0x58
+ | __vfs_write+0x54/0xe8
+ | vfs_write+0x124/0x3c0
+ | ksys_write+0xbc/0x168
+ | __arm64_sys_write+0x68/0x98
+ | el0_svc_common+0x100/0x258
+ | el0_svc_handler+0x48/0xc0
+ | el0_svc+0x8/0xc
+ |
+ | The buggy address belongs to the variable:
+ | zero+0x0/0x40
+ |
+ | Memory state around the buggy address:
+ | ffff2000133d1b00: 00 00 00 00 00 00 00 00 fa fa fa fa 04 fa fa fa
+ | ffff2000133d1b80: fa fa fa fa 04 fa fa fa fa fa fa fa 04 fa fa fa
+ | >ffff2000133d1c00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
+ | ^
+ | ffff2000133d1c80: fa fa fa fa 00 fa fa fa fa fa fa fa 00 00 00 00
+ | ffff2000133d1d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+
+Fix the splat by introducing a unsigned long 'zero_ul' and using that
+instead.
+
+Link: http://lkml.kernel.org/r/20190403153409.17307-1-will.deacon@arm.com
+Fixes: 32a5ad9c2285 ("sysctl: handle overflow for file-max")
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Acked-by: Christian Brauner <christian@brauner.io>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: Matteo Croce <mcroce@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/sysctl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index e5da394d1ca3..c9ec050bcf46 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -128,6 +128,7 @@ static int zero;
+ static int __maybe_unused one = 1;
+ static int __maybe_unused two = 2;
+ static int __maybe_unused four = 4;
++static unsigned long zero_ul;
+ static unsigned long one_ul = 1;
+ static unsigned long long_max = LONG_MAX;
+ static int one_hundred = 100;
+@@ -1750,7 +1751,7 @@ static struct ctl_table fs_table[] = {
+ .maxlen = sizeof(files_stat.max_files),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+- .extra1 = &zero,
++ .extra1 = &zero_ul,
+ .extra2 = &long_max,
+ },
+ {
+--
+2.16.4
+
diff --git a/patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch b/patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch
new file mode 100644
index 0000000000..bfbac90a9e
--- /dev/null
+++ b/patches.fixes/linux-kernel.h-Use-parentheses-around-argument-in-u6.patch
@@ -0,0 +1,72 @@
+From a0fe2c6479aab5723239b315ef1b552673f434a3 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Fri, 29 Mar 2019 22:46:49 +0100
+Subject: [PATCH] linux/kernel.h: Use parentheses around argument in u64_to_user_ptr()
+Git-commit: a0fe2c6479aab5723239b315ef1b552673f434a3
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+Use parentheses around uses of the argument in u64_to_user_ptr() to
+ensure that the cast doesn't apply to part of the argument.
+
+There are existing uses of the macro of the form
+
+ u64_to_user_ptr(A + B)
+
+which expands to
+
+ (void __user *)(uintptr_t)A + B
+
+(the cast applies to the first operand of the addition, the addition
+is a pointer addition). This happens to still work as intended, the
+semantic difference doesn't cause a difference in behavior.
+
+But I want to use u64_to_user_ptr() with a ternary operator in the
+argument, like so:
+
+ u64_to_user_ptr(A ? B : C)
+
+This currently doesn't work as intended.
+
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Cc: Andrei Vagin <avagin@openvz.org>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Qiaowei Ren <qiaowei.ren@intel.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/20190329214652.258477-1-jannh@google.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/kernel.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 34a5036debd3..2d14e21c16c0 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -47,8 +47,8 @@
+
+ #define u64_to_user_ptr(x) ( \
+ { \
+- typecheck(u64, x); \
+- (void __user *)(uintptr_t)x; \
++ typecheck(u64, (x)); \
++ (void __user *)(uintptr_t)(x); \
+ } \
+ )
+
+--
+2.16.4
+
diff --git a/patches.fixes/md-batch-flush-requests.patch b/patches.fixes/md-batch-flush-requests.patch
index a31b1e8f36..e8985ce383 100644
--- a/patches.fixes/md-batch-flush-requests.patch
+++ b/patches.fixes/md-batch-flush-requests.patch
@@ -2,8 +2,7 @@ From: NeilBrown <neilb@suse.com>
Date: Fri, 29 Mar 2019 10:46:17 -0700
Subject: [PATCH] md: batch flush requests.
Git-commit: 2bc13b83e6298486371761de503faeffd15b7534
-Git-repo: git://git.kernel.dk/linux-block.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.2-rc1
References: bsc#1119680
Currently if many flush requests are submitted to an md device is quick
diff --git a/patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch b/patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch
new file mode 100644
index 0000000000..bb5d3efa51
--- /dev/null
+++ b/patches.fixes/net-rds-force-to-destroy-connection-if-t_sock-is-NUL.patch
@@ -0,0 +1,143 @@
+From: Mao Wenan <maowenan@huawei.com>
+Date: Thu, 28 Mar 2019 17:10:56 +0800
+Subject: net: rds: force to destroy connection if t_sock is NULL in rds_tcp_kill_sock().
+Patch-mainline: v5.1-rc4
+Git-commit: cb66ddd156203daefb8d71158036b27b0e2caf63
+References: CVE-2019-11815 bsc#1134537
+
+When it is to cleanup net namespace, rds_tcp_exit_net() will call
+rds_tcp_kill_sock(), if t_sock is NULL, it will not call
+rds_conn_destroy(), rds_conn_path_destroy() and rds_tcp_conn_free() to free
+connection, and the worker cp_conn_w is not stopped, afterwards the net is freed in
+net_drop_ns(); While cp_conn_w rds_connect_worker() will call rds_tcp_conn_path_connect()
+and reference 'net' which has already been freed.
+
+In rds_tcp_conn_path_connect(), rds_tcp_set_callbacks() will set t_sock = sock before
+sock->ops->connect, but if connect() is failed, it will call
+rds_tcp_restore_callbacks() and set t_sock = NULL, if connect is always
+failed, rds_connect_worker() will try to reconnect all the time, so
+rds_tcp_kill_sock() will never to cancel worker cp_conn_w and free the
+connections.
+
+Therefore, the condition !tc->t_sock is not needed if it is going to do
+cleanup_net->rds_tcp_exit_net->rds_tcp_kill_sock, because tc->t_sock is always
+NULL, and there is on other path to cancel cp_conn_w and free
+connection. So this patch is to fix this.
+
+rds_tcp_kill_sock():
+...
+if (net != c_net || !tc->t_sock)
+...
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+
+==================================================================
+BUG: KASAN: use-after-free in inet_create+0xbcc/0xd28
+net/ipv4/af_inet.c:340
+Read of size 4 at addr ffff8003496a4684 by task kworker/u8:4/3721
+
+CPU: 3 PID: 3721 Comm: kworker/u8:4 Not tainted 5.1.0 #11
+Hardware name: linux,dummy-virt (DT)
+Workqueue: krdsd rds_connect_worker
+Call trace:
+ dump_backtrace+0x0/0x3c0 arch/arm64/kernel/time.c:53
+ show_stack+0x28/0x38 arch/arm64/kernel/traps.c:152
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x120/0x188 lib/dump_stack.c:113
+ print_address_description+0x68/0x278 mm/kasan/report.c:253
+ kasan_report_error mm/kasan/report.c:351 [inline]
+ kasan_report+0x21c/0x348 mm/kasan/report.c:409
+ __asan_report_load4_noabort+0x30/0x40 mm/kasan/report.c:429
+ inet_create+0xbcc/0xd28 net/ipv4/af_inet.c:340
+ __sock_create+0x4f8/0x770 net/socket.c:1276
+ sock_create_kern+0x50/0x68 net/socket.c:1322
+ rds_tcp_conn_path_connect+0x2b4/0x690 net/rds/tcp_connect.c:114
+ rds_connect_worker+0x108/0x1d0 net/rds/threads.c:175
+ process_one_work+0x6e8/0x1700 kernel/workqueue.c:2153
+ worker_thread+0x3b0/0xdd0 kernel/workqueue.c:2296
+ kthread+0x2f0/0x378 kernel/kthread.c:255
+ ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1117
+
+Allocated by task 687:
+ save_stack mm/kasan/kasan.c:448 [inline]
+ set_track mm/kasan/kasan.c:460 [inline]
+ kasan_kmalloc+0xd4/0x180 mm/kasan/kasan.c:553
+ kasan_slab_alloc+0x14/0x20 mm/kasan/kasan.c:490
+ slab_post_alloc_hook mm/slab.h:444 [inline]
+ slab_alloc_node mm/slub.c:2705 [inline]
+ slab_alloc mm/slub.c:2713 [inline]
+ kmem_cache_alloc+0x14c/0x388 mm/slub.c:2718
+ kmem_cache_zalloc include/linux/slab.h:697 [inline]
+ net_alloc net/core/net_namespace.c:384 [inline]
+ copy_net_ns+0xc4/0x2d0 net/core/net_namespace.c:424
+ create_new_namespaces+0x300/0x658 kernel/nsproxy.c:107
+ unshare_nsproxy_namespaces+0xa0/0x198 kernel/nsproxy.c:206
+ ksys_unshare+0x340/0x628 kernel/fork.c:2577
+ __do_sys_unshare kernel/fork.c:2645 [inline]
+ __se_sys_unshare kernel/fork.c:2643 [inline]
+ __arm64_sys_unshare+0x38/0x58 kernel/fork.c:2643
+ __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
+ invoke_syscall arch/arm64/kernel/syscall.c:47 [inline]
+ el0_svc_common+0x168/0x390 arch/arm64/kernel/syscall.c:83
+ el0_svc_handler+0x60/0xd0 arch/arm64/kernel/syscall.c:129
+ el0_svc+0x8/0xc arch/arm64/kernel/entry.S:960
+
+Freed by task 264:
+ save_stack mm/kasan/kasan.c:448 [inline]
+ set_track mm/kasan/kasan.c:460 [inline]
+ __kasan_slab_free+0x114/0x220 mm/kasan/kasan.c:521
+ kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528
+ slab_free_hook mm/slub.c:1370 [inline]
+ slab_free_freelist_hook mm/slub.c:1397 [inline]
+ slab_free mm/slub.c:2952 [inline]
+ kmem_cache_free+0xb8/0x3a8 mm/slub.c:2968
+ net_free net/core/net_namespace.c:400 [inline]
+ net_drop_ns.part.6+0x78/0x90 net/core/net_namespace.c:407
+ net_drop_ns net/core/net_namespace.c:406 [inline]
+ cleanup_net+0x53c/0x6d8 net/core/net_namespace.c:569
+ process_one_work+0x6e8/0x1700 kernel/workqueue.c:2153
+ worker_thread+0x3b0/0xdd0 kernel/workqueue.c:2296
+ kthread+0x2f0/0x378 kernel/kthread.c:255
+ ret_from_fork+0x10/0x18 arch/arm64/kernel/entry.S:1117
+
+The buggy address belongs to the object at ffff8003496a3f80
+ which belongs to the cache net_namespace of size 7872
+The buggy address is located 1796 bytes inside of
+ 7872-byte region [ffff8003496a3f80, ffff8003496a5e40)
+The buggy address belongs to the page:
+page:ffff7e000d25a800 count:1 mapcount:0 mapping:ffff80036ce4b000
+index:0x0 compound_mapcount: 0
+flags: 0xffffe0000008100(slab|head)
+raw: 0ffffe0000008100 dead000000000100 dead000000000200 ffff80036ce4b000
+raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8003496a4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8003496a4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+>ffff8003496a4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff8003496a4700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8003496a4780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+==================================================================
+
+Fixes: 467fa15356ac("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Kubecek <mkubecek@suse.cz>
+
+---
+ net/rds/tcp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -509,7 +509,7 @@ static void rds_tcp_kill_sock(struct net *net)
+ list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+ struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+
+- if (net != c_net || !tc->t_sock)
++ if (net != c_net)
+ continue;
+ if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
+ list_move_tail(&tc->t_tcp_node, &tmp_list);
diff --git a/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch b/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
index 9fe8cb20d6..f066dbf5a6 100644
--- a/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
+++ b/patches.fixes/nvme-multipath-avoid-crash-on-invalid-subsystem-cntl.patch
@@ -1,8 +1,12 @@
+From 8a03b27ea61c2ab9de16a8a195822ef05e799748 Mon Sep 17 00:00:00 2001
From: Hannes Reinecke <hare@suse.de>
-Date: Fri, 29 Mar 2019 10:57:54 +0100
+Date: Fri, 3 May 2019 15:37:35 +0200
Subject: [PATCH] nvme-multipath: avoid crash on invalid subsystem cntlid
enumeration
-Patch-Mainline: submitted linux-nvme 2019/04/04
+
+Git-commit: 8a03b27ea61c2ab9de16a8a195822ef05e799748
+Patch-Mainline: queued in subsystem maintainer repository
+Git-repo: git://git.infradead.org/nvme.git
References: bsc#1129273
A process holding an open reference to a removed disk prevents it
@@ -11,12 +15,14 @@ gendisk creation may have the same cntlid which risks collision when
using that for the name. Use the unique ctrl->instance instead.
Signed-off-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
---
drivers/nvme/host/multipath.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
-index f0716f6ce41f..2551264ef2b5 100644
+index 5c9429d41120..499acf07d61a 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -31,7 +31,7 @@ void nvme_set_disk_name(char *disk_name, struct nvme_ns *ns,
@@ -29,5 +35,5 @@ index f0716f6ce41f..2551264ef2b5 100644
} else {
sprintf(disk_name, "nvme%dn%d", ctrl->subsys->instance,
--
-2.16.4
+2.20.1
diff --git a/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch b/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
index 67fa11cf5e..da6a698744 100644
--- a/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
+++ b/patches.fixes/nvme-multipath-split-bios-with-the-ns_head-bio_set-b.patch
@@ -3,8 +3,7 @@ Date: Tue, 30 Apr 2019 18:57:09 +0200
Subject: [PATCH] nvme-multipath: split bios with the ns_head bio_set before
submitting
Git-commit: 525aa5a705d86e193726ee465d1a975265fabf19
-Git-repo: git://git.infradead.org/nvme.git
-Patch-Mainline: queued in subsystem maintainer tree
+Patch-Mainline: v5.2-rc1
References: bsc#1103259, bsc#1131673
If the bio is moved to a different queue via blk_steal_bios() and
diff --git a/patches.fixes/overflow-Fix-Wtype-limits-compilation-warnings.patch b/patches.fixes/overflow-Fix-Wtype-limits-compilation-warnings.patch
new file mode 100644
index 0000000000..9431d7b3ab
--- /dev/null
+++ b/patches.fixes/overflow-Fix-Wtype-limits-compilation-warnings.patch
@@ -0,0 +1,78 @@
+From dc7fe518b0493faa0af0568d6d8c2a33c00f58d0 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Sun, 17 Mar 2019 12:11:14 +0200
+Subject: [PATCH] overflow: Fix -Wtype-limits compilation warnings
+Git-commit: dc7fe518b0493faa0af0568d6d8c2a33c00f58d0
+Patch-mainline: v5.2-rc1
+References: bsc#1111666
+
+Attempt to use check_shl_overflow() with inputs of unsigned type
+produces the following compilation warnings.
+
+Drivers/infiniband/hw/mlx5/qp.c: In function _set_user_rq_size_:
+./include/linux/overflow.h:230:6: warning: comparison of unsigned
+expression >= 0 is always true [-Wtype-limits]
+ _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \
+ ^~
+drivers/infiniband/hw/mlx5/qp.c:5820:6: note: in expansion of macro _check_shl_overflow_
+ if (check_shl_overflow(rwq->wqe_count, rwq->wqe_shift,
+&rwq->buf_size))
+ ^~~~~~~~~~~~~~~~~~
+./include/linux/overflow.h:232:26: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits]
+ (_to_shift != _s || *_d < 0 || _a < 0 || \
+ ^
+drivers/infiniband/hw/mlx5/qp.c:5820:6: note: in expansion of macro _check_shl_overflow_
+ if (check_shl_overflow(rwq->wqe_count, rwq->wqe_shift, &rwq->buf_size))
+ ^~~~~~~~~~~~~~~~~~
+./include/linux/overflow.h:232:36: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits]
+ (_to_shift != _s || *_d < 0 || _a < 0 || \
+ ^
+drivers/infiniband/hw/mlx5/qp.c:5820:6: note: in expansion of macro _check_shl_overflow_
+ if (check_shl_overflow(rwq->wqe_count, rwq->wqe_shift,&rwq->buf_size))
+ ^~~~~~~~~~~~~~~~~~
+
+Fixes: 0c66847793d1 ("overflow.h: Add arithmetic shift helper")
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/overflow.h | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/overflow.h b/include/linux/overflow.h
+index 40b48e2133cb..15eb85de9226 100644
+--- a/include/linux/overflow.h
++++ b/include/linux/overflow.h
+@@ -36,6 +36,12 @@
+ #define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
+ #define type_min(T) ((T)((T)-type_max(T)-(T)1))
+
++/*
++ * Avoids triggering -Wtype-limits compilation warning,
++ * while using unsigned data types to check a < 0.
++ */
++#define is_non_negative(a) ((a) > 0 || (a) == 0)
++#define is_negative(a) (!(is_non_negative(a)))
+
+ #ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
+ /*
+@@ -227,10 +233,10 @@
+ typeof(d) _d = d; \
+ u64 _a_full = _a; \
+ unsigned int _to_shift = \
+- _s >= 0 && _s < 8 * sizeof(*d) ? _s : 0; \
++ is_non_negative(_s) && _s < 8 * sizeof(*d) ? _s : 0; \
+ *_d = (_a_full << _to_shift); \
+- (_to_shift != _s || *_d < 0 || _a < 0 || \
+- (*_d >> _to_shift) != _a); \
++ (_to_shift != _s || is_negative(*_d) || is_negative(_a) || \
++ (*_d >> _to_shift) != _a); \
+ })
+
+ /**
+--
+2.16.4
+
diff --git a/patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch b/patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch
new file mode 100644
index 0000000000..d3de7d9dc5
--- /dev/null
+++ b/patches.fixes/proc-kcore-don-t-bounds-check-against-address-0.patch
@@ -0,0 +1,82 @@
+From 3955333df9a50e8783d115613a397ae55d905080 Mon Sep 17 00:00:00 2001
+From: Laura Abbott <labbott@redhat.com>
+Date: Fri, 11 May 2018 16:01:57 -0700
+Subject: [PATCH] proc/kcore: don't bounds check against address 0
+Git-commit: 3955333df9a50e8783d115613a397ae55d905080
+Patch-mainline: v4.17-rc5
+References: bsc#1051510
+
+The existing kcore code checks for bad addresses against __va(0) with
+the assumption that this is the lowest address on the system. This may
+not hold true on some systems (e.g. arm64) and produce overflows and
+crashes. Switch to using other functions to validate the address range.
+
+It's currently only seen on arm64 and it's not clear if anyone wants to
+use that particular combination on a stable release. So this is not
+urgent for stable.
+
+Link: http://lkml.kernel.org/r/20180501201143.15121-1-labbott@redhat.com
+Signed-off-by: Laura Abbott <labbott@redhat.com>
+Tested-by: Dave Anderson <anderson@redhat.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: Andi Kleen <andi@firstfloor.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>a
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/proc/kcore.c | 23 ++++++++++++++++-------
+ 1 file changed, 16 insertions(+), 7 deletions(-)
+
+diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
+index d1e82761de81..e64ecb9f2720 100644
+--- a/fs/proc/kcore.c
++++ b/fs/proc/kcore.c
+@@ -209,25 +209,34 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg)
+ {
+ struct list_head *head = (struct list_head *)arg;
+ struct kcore_list *ent;
++ struct page *p;
++
++ if (!pfn_valid(pfn))
++ return 1;
++
++ p = pfn_to_page(pfn);
++ if (!memmap_valid_within(pfn, p, page_zone(p)))
++ return 1;
+
+ ent = kmalloc(sizeof(*ent), GFP_KERNEL);
+ if (!ent)
+ return -ENOMEM;
+- ent->addr = (unsigned long)__va((pfn << PAGE_SHIFT));
++ ent->addr = (unsigned long)page_to_virt(p);
+ ent->size = nr_pages << PAGE_SHIFT;
+
+- /* Sanity check: Can happen in 32bit arch...maybe */
+- if (ent->addr < (unsigned long) __va(0))
++ if (!virt_addr_valid(ent->addr))
+ goto free_out;
+
+ /* cut not-mapped area. ....from ppc-32 code. */
+ if (ULONG_MAX - ent->addr < ent->size)
+ ent->size = ULONG_MAX - ent->addr;
+
+- /* cut when vmalloc() area is higher than direct-map area */
+- if (VMALLOC_START > (unsigned long)__va(0)) {
+- if (ent->addr > VMALLOC_START)
+- goto free_out;
++ /*
++ * We've already checked virt_addr_valid so we know this address
++ * is a valid pointer, therefore we can check against it to determine
++ * if we need to trim
++ */
++ if (VMALLOC_START > ent->addr) {
+ if (VMALLOC_START - ent->addr < ent->size)
+ ent->size = VMALLOC_START - ent->addr;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch b/patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch
new file mode 100644
index 0000000000..a90c5ee9c1
--- /dev/null
+++ b/patches.fixes/proc-revalidate-kernel-thread-inodes-to-root-root.patch
@@ -0,0 +1,51 @@
+From 2e0ad552f5f8cd0fda02bc45fcd2b89821c62fd1 Mon Sep 17 00:00:00 2001
+From: Alexey Dobriyan <adobriyan@gmail.com>
+Date: Fri, 20 Apr 2018 14:56:03 -0700
+Subject: [PATCH] proc: revalidate kernel thread inodes to root:root
+Git-commit: 2e0ad552f5f8cd0fda02bc45fcd2b89821c62fd1
+Patch-mainline: v4.17-rc2
+References: bsc#1051510
+
+task_dump_owner() has the following code:
+
+ mm = task->mm;
+ if (mm) {
+ if (get_dumpable(mm) != SUID_DUMP_USER) {
+ uid = ...
+ }
+ }
+
+Check for ->mm is buggy -- kernel thread might be borrowing mm
+and inode will go to some random uid:gid pair.
+
+Link: http://lkml.kernel.org/r/20180412220109.GA20978@avx2
+Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
+Cc: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/proc/base.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index eafa39a3a88c..1b2ede6abcdf 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1693,6 +1693,12 @@ void task_dump_owner(struct task_struct *task, umode_t mode,
+ kuid_t uid;
+ kgid_t gid;
+
++ if (unlikely(task->flags & PF_KTHREAD)) {
++ *ruid = GLOBAL_ROOT_UID;
++ *rgid = GLOBAL_ROOT_GID;
++ return;
++ }
++
+ /* Default to the tasks effective ownership */
+ rcu_read_lock();
+ cred = __task_cred(task);
+--
+2.16.4
+
diff --git a/patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch b/patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch
new file mode 100644
index 0000000000..45ab1411ed
--- /dev/null
+++ b/patches.fixes/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch
@@ -0,0 +1,106 @@
+From 09be178400829dddc1189b50a7888495dd26aa84 Mon Sep 17 00:00:00 2001
+From: Cheng Lin <cheng.lin130@zte.com.cn>
+Date: Thu, 3 Jan 2019 15:26:13 -0800
+Subject: [PATCH] proc/sysctl: fix return error for proc_doulongvec_minmax()
+Git-commit: 09be178400829dddc1189b50a7888495dd26aa84
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+If the number of input parameters is less than the total parameters, an
+EINVAL error will be returned.
+
+For example, we use proc_doulongvec_minmax to pass up to two parameters
+with kern_table:
+
+{
+ .procname = "monitor_signals",
+ .data = &monitor_sigs,
+ .maxlen = 2*sizeof(unsigned long),
+ .mode = 0644,
+ .proc_handler = proc_doulongvec_minmax,
+},
+
+Reproduce:
+
+When passing two parameters, it's work normal. But passing only one
+parameter, an error "Invalid argument"(EINVAL) is returned.
+
+ [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 1 2
+ [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
+ -bash: echo: write error: Invalid argument
+ [root@cl150 ~]# echo $?
+ 1
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 3 2
+ [root@cl150 ~]#
+
+The following is the result after apply this patch. No error is
+returned when the number of input parameters is less than the total
+parameters.
+
+ [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 1 2
+ [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals
+ [root@cl150 ~]# echo $?
+ 0
+ [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals
+ 3 2
+ [root@cl150 ~]#
+
+There are three processing functions dealing with digital parameters,
+__do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax.
+
+This patch deals with __do_proc_doulongvec_minmax, just as
+__do_proc_dointvec does, adding a check for parameters 'left'. In
+__do_proc_douintvec, its code implementation explicitly does not support
+multiple inputs.
+
+static int __do_proc_douintvec(...){
+ ...
+ /*
+ * Arrays are not supported, keep this simple. *Do not* add
+ * support for them.
+ */
+ if (vleft != 1) {
+ *lenp = 0;
+ return -EINVAL;
+ }
+ ...
+}
+
+So, just __do_proc_doulongvec_minmax has the problem. And most use of
+proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one
+parameter.
+
+Link: http://lkml.kernel.org/r/1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn
+Signed-off-by: Cheng Lin <cheng.lin130@zte.com.cn>
+Acked-by: Luis Chamberlain <mcgrof@kernel.org>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Cc: Alexey Dobriyan <adobriyan@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/sysctl.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 1825f712e73b..7f6c1a3b3485 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2787,6 +2787,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int
+ bool neg;
+
+ left -= proc_skip_spaces(&p);
++ if (!left)
++ break;
+
+ err = proc_get_long(&p, &left, &val, &neg,
+ proc_wspace_sep,
+--
+2.16.4
+
diff --git a/patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch b/patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch
new file mode 100644
index 0000000000..729629f11c
--- /dev/null
+++ b/patches.fixes/qla2xxx-always-allocate-qla_tgt_wq.patch
@@ -0,0 +1,85 @@
+From 60b8cdf315ea4731ef66a69669f9727e739c6e17 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Thu, 9 May 2019 15:07:48 +0200
+Subject: [PATCH] qla2xxx: always allocate qla_tgt_wq
+References: bsc#1131451
+Patch-Mainline: submitted linux-scsi 2019/05/09
+
+The 'qla_tgt_wq' workqueue is used for generic command aborts,
+not just target-related functions. So allocate the workqueue
+always to avoid a kernel crash when aborting commands.
+
+Signed-off-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 24 +++++++++++++-----------
+ 1 file changed, 13 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 403f96583e3f..1339a647805a 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -7423,6 +7423,13 @@ int __init qlt_init(void)
+ return -EINVAL;
+ }
+
++ qla_tgt_wq = alloc_workqueue("qla_tgt_wq", 0, 0);
++ if (!qla_tgt_wq) {
++ ql_log(ql_log_fatal, NULL, 0xe06f,
++ "alloc_workqueue for qla_tgt_wq failed\n");
++ return -ENOMEM;
++ }
++
+ if (!QLA_TGT_MODE_ENABLED())
+ return 0;
+
+@@ -7432,7 +7439,8 @@ int __init qlt_init(void)
+ if (!qla_tgt_mgmt_cmd_cachep) {
+ ql_log(ql_log_fatal, NULL, 0xd04b,
+ "kmem_cache_create for qla_tgt_mgmt_cmd_cachep failed\n");
+- return -ENOMEM;
++ ret = -ENOMEM;
++ goto out_workqueue;
+ }
+
+ qla_tgt_plogi_cachep = kmem_cache_create("qla_tgt_plogi_cachep",
+@@ -7455,33 +7463,27 @@ int __init qlt_init(void)
+ goto out_plogi_cachep;
+ }
+
+- qla_tgt_wq = alloc_workqueue("qla_tgt_wq", 0, 0);
+- if (!qla_tgt_wq) {
+- ql_log(ql_log_fatal, NULL, 0xe06f,
+- "alloc_workqueue for qla_tgt_wq failed\n");
+- ret = -ENOMEM;
+- goto out_cmd_mempool;
+- }
+ /*
+ * Return 1 to signal that initiator-mode is being disabled
+ */
+ return (ql2x_ini_mode == QLA2XXX_INI_MODE_DISABLED) ? 1 : 0;
+
+-out_cmd_mempool:
+- mempool_destroy(qla_tgt_mgmt_cmd_mempool);
+ out_plogi_cachep:
+ kmem_cache_destroy(qla_tgt_plogi_cachep);
+ out_mgmt_cmd_cachep:
+ kmem_cache_destroy(qla_tgt_mgmt_cmd_cachep);
++out_workqueue:
++ destroy_workqueue(qla_tgt_wq);
+ return ret;
+ }
+
+ void qlt_exit(void)
+ {
++ destroy_workqueue(qla_tgt_wq);
++
+ if (!QLA_TGT_MODE_ENABLED())
+ return;
+
+- destroy_workqueue(qla_tgt_wq);
+ mempool_destroy(qla_tgt_mgmt_cmd_mempool);
+ kmem_cache_destroy(qla_tgt_plogi_cachep);
+ kmem_cache_destroy(qla_tgt_mgmt_cmd_cachep);
+--
+2.16.4
+
diff --git a/patches.fixes/scripts-override-locale-from-environment-when-runnin.patch b/patches.fixes/scripts-override-locale-from-environment-when-runnin.patch
new file mode 100644
index 0000000000..8cd7a39e5a
--- /dev/null
+++ b/patches.fixes/scripts-override-locale-from-environment-when-runnin.patch
@@ -0,0 +1,43 @@
+From e46b94d228458aefc2553ee7c34ab18c2e3288e3 Mon Sep 17 00:00:00 2001
+From: Daniel Dadap <ddadap@nvidia.com>
+Date: Sat, 27 Apr 2019 11:21:34 -0400
+Subject: [PATCH] scripts: override locale from environment when running recordmcount.pl
+Git-commit: e46b94d228458aefc2553ee7c34ab18c2e3288e3
+Patch-mainline: v5.2-rc1
+References: bsc#1134354
+
+recordmcount.pl uses a set of regular expressions to parse the output of
+objdump(1). However, if objdump(1) output is localized, it may not match
+the regular expressions, thereby preventing recordmcount.pl from parsing
+object files correctly.
+
+In order to allow recordmcount.pl to function correctly regardless of the
+current locale settings, set LANG=C when running objdump(1). LC_ALL is
+already unset in the top-level Makefile, so it is not necessary to also
+override that environment variable.
+
+Signed-off-by: Daniel Dadap <ddadap@nvidia.com>
+Reviewed-by: Robert Morell <rmorell@nvidia.com>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ scripts/recordmcount.pl | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 68841d01162c..ffea46287f83 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -493,7 +493,7 @@ sub update_funcs
+ #
+ # Step 2: find the sections and mcount call sites
+ #
+-open(IN, "$objdump -hdr $inputfile|") || die "error running $objdump";
++open(IN, "LANG=C $objdump -hdr $inputfile|") || die "error running $objdump";
+
+ my $text;
+
+--
+2.16.4
+
diff --git a/patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp b/patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp
new file mode 100644
index 0000000000..275b1ccadf
--- /dev/null
+++ b/patches.fixes/selinux-use-kernel-linux-socket.h-for-genheaders-and-mdp
@@ -0,0 +1,64 @@
+From dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <paulo@paulo.ac>
+Date: Sun, 24 Feb 2019 21:55:28 -0300
+Git-commit: dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e
+Patch-mainline: v5.1
+References: bsc#1134810
+Subject: selinux: use kernel linux/socket.h for genheaders and mdp
+
+When compiling genheaders and mdp from a newer host kernel, the
+following error happens:
+
+ In file included from scripts/selinux/genheaders/genheaders.c:18:
+ ./security/selinux/include/classmap.h:238:2: error: #error New
+ address family defined, please update secclass_map. #error New
+ address family defined, please update secclass_map. ^~~~~
+ make[3]: *** [scripts/Makefile.host:107:
+ scripts/selinux/genheaders/genheaders] Error 1 make[2]: ***
+ [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2
+ make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2
+ make[1]: *** Waiting for unfinished jobs....
+
+Instead of relying on the host definition, include linux/socket.h in
+classmap.h to have PF_MAX.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Paulo Alcantara <paulo@paulo.ac>
+Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
+[PM: manually merge in mdp.c, subject line tweaks]
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+---
+ scripts/selinux/genheaders/genheaders.c | 1 -
+ scripts/selinux/mdp/mdp.c | 1 -
+ security/selinux/include/classmap.h | 1 +
+ 3 files changed, 1 insertion(+), 2 deletions(-)
+
+--- a/scripts/selinux/genheaders/genheaders.c
++++ b/scripts/selinux/genheaders/genheaders.c
+@@ -8,7 +8,6 @@
+ #include <string.h>
+ #include <errno.h>
+ #include <ctype.h>
+-#include <sys/socket.h>
+
+ struct security_class_mapping {
+ const char *name;
+--- a/scripts/selinux/mdp/mdp.c
++++ b/scripts/selinux/mdp/mdp.c
+@@ -32,7 +32,6 @@
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include <string.h>
+-#include <sys/socket.h>
+
+ static void usage(char *name)
+ {
+--- a/security/selinux/include/classmap.h
++++ b/security/selinux/include/classmap.h
+@@ -1,4 +1,5 @@
+ #include <linux/capability.h>
++#include <linux/socket.h>
+
+ #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \
+ "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append"
diff --git a/patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch b/patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch
new file mode 100644
index 0000000000..f66cb88c0a
--- /dev/null
+++ b/patches.fixes/vfio-mdev-Avoid-release-parent-reference-during-erro.patch
@@ -0,0 +1,40 @@
+From 60e7f2c3fe9919cee9534b422865eed49f4efb15 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Tue, 30 Apr 2019 17:49:28 -0500
+Subject: [PATCH] vfio/mdev: Avoid release parent reference during error path
+Git-commit: 60e7f2c3fe9919cee9534b422865eed49f4efb15
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+During mdev parent registration in mdev_register_device(),
+if parent device is duplicate, it releases the reference of existing
+parent device.
+This is incorrect. Existing parent device should not be touched.
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/mdev/mdev_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index b96fedc77ee5..1299d2e72ce2 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -181,6 +181,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops)
+ /* Check for duplicate */
+ parent = __find_parent_device(dev);
+ if (parent) {
++ parent = NULL;
+ ret = -EEXIST;
+ goto add_dev_err;
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch b/patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch
new file mode 100644
index 0000000000..10f8724bda
--- /dev/null
+++ b/patches.fixes/vfio-mdev-Fix-aborting-mdev-child-device-removal-if-.patch
@@ -0,0 +1,77 @@
+From 6093e348a5e2475c5bb2e571346460f939998670 Mon Sep 17 00:00:00 2001
+From: Parav Pandit <parav@mellanox.com>
+Date: Tue, 30 Apr 2019 17:49:33 -0500
+Subject: [PATCH] vfio/mdev: Fix aborting mdev child device removal if one fails
+Git-commit: 6093e348a5e2475c5bb2e571346460f939998670
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+device_for_each_child() stops executing callback function for remaining
+child devices, if callback hits an error.
+Each child mdev device is independent of each other.
+While unregistering parent device, mdev core must remove all child mdev
+devices.
+Therefore, mdev_device_remove_cb() always returns success so that
+device_for_each_child doesn't abort if one child removal hits error.
+
+While at it, improve remove and unregister functions for below simplicity.
+
+There isn't need to pass forced flag pointer during mdev parent
+removal which invokes mdev_device_remove(). So simplify the flow.
+
+mdev_device_remove() is called from two paths.
+1. mdev_unregister_driver()
+ mdev_device_remove_cb()
+ mdev_device_remove()
+2. remove_store()
+ mdev_device_remove()
+
+Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/mdev/mdev_core.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c
+index 836d31985f14..1a317e409355 100644
+--- a/drivers/vfio/mdev/mdev_core.c
++++ b/drivers/vfio/mdev/mdev_core.c
+@@ -149,10 +149,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove)
+
+ static int mdev_device_remove_cb(struct device *dev, void *data)
+ {
+- if (!dev_is_mdev(dev))
+- return 0;
++ if (dev_is_mdev(dev))
++ mdev_device_remove(dev, true);
+
+- return mdev_device_remove(dev, data ? *(bool *)data : true);
++ return 0;
+ }
+
+ /*
+@@ -240,7 +240,6 @@ EXPORT_SYMBOL(mdev_register_device);
+ void mdev_unregister_device(struct device *dev)
+ {
+ struct mdev_parent *parent;
+- bool force_remove = true;
+
+ mutex_lock(&parent_list_lock);
+ parent = __find_parent_device(dev);
+@@ -254,8 +253,7 @@ void mdev_unregister_device(struct device *dev)
+ list_del(&parent->next);
+ class_compat_remove_link(mdev_bus_compat_class, dev, NULL);
+
+- device_for_each_child(dev, (void *)&force_remove,
+- mdev_device_remove_cb);
++ device_for_each_child(dev, NULL, mdev_device_remove_cb);
+
+ parent_remove_sysfs_files(parent);
+
+--
+2.16.4
+
diff --git a/patches.fixes/vfio-pci-use-correct-format-characters.patch b/patches.fixes/vfio-pci-use-correct-format-characters.patch
new file mode 100644
index 0000000000..5cb3f7ce88
--- /dev/null
+++ b/patches.fixes/vfio-pci-use-correct-format-characters.patch
@@ -0,0 +1,83 @@
+From 426b046b748d1f47e096e05bdcc6fb4172791307 Mon Sep 17 00:00:00 2001
+From: Louis Taylor <louis@kragniz.eu>
+Date: Wed, 3 Apr 2019 12:36:20 -0600
+Subject: [PATCH] vfio/pci: use correct format characters
+Git-commit: 426b046b748d1f47e096e05bdcc6fb4172791307
+Patch-mainline: v5.1-rc4
+References: bsc#1051510
+
+When compiling with -Wformat, clang emits the following warnings:
+
+drivers/vfio/pci/vfio_pci.c:1601:5: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1601:13: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1601:21: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1601:32: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:5: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:13: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:21: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+
+drivers/vfio/pci/vfio_pci.c:1605:32: warning: format specifies type
+ 'unsigned short' but the argument has type 'unsigned int' [-Wformat]
+ vendor, device, subvendor, subdevice,
+ ^~~~~~~~~
+The types of these arguments are unconditionally defined, so this patch
+updates the format character to the correct ones for unsigned ints.
+
+Link: https://github.com/ClangBuiltLinux/linux/issues/378
+Signed-off-by: Louis Taylor <louis@kragniz.eu>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/pci/vfio_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index a25659b5a5d1..3fa20e95a6bb 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -1661,11 +1661,11 @@ static void __init vfio_pci_fill_ids(void)
+ rc = pci_add_dynid(&vfio_pci_driver, vendor, device,
+ subvendor, subdevice, class, class_mask, 0);
+ if (rc)
+- pr_warn("failed to add dynamic id [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x (%d)\n",
++ pr_warn("failed to add dynamic id [%04x:%04x[%04x:%04x]] class %#08x/%08x (%d)\n",
+ vendor, device, subvendor, subdevice,
+ class, class_mask, rc);
+ else
+- pr_info("add [%04hx:%04hx[%04hx:%04hx]] class %#08x/%08x\n",
++ pr_info("add [%04x:%04x[%04x:%04x]] class %#08x/%08x\n",
+ vendor, device, subvendor, subdevice,
+ class, class_mask);
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch b/patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch
new file mode 100644
index 0000000000..f02cf91a42
--- /dev/null
+++ b/patches.fixes/vfio_pci-Enable-memory-accesses-before-calling-pci_m.patch
@@ -0,0 +1,69 @@
+From 0cfd027be1d6def4a462cdc180c055143af24069 Mon Sep 17 00:00:00 2001
+From: Eric Auger <eric.auger@redhat.com>
+Date: Fri, 15 Feb 2019 17:16:06 +0100
+Subject: [PATCH] vfio_pci: Enable memory accesses before calling pci_map_rom
+Git-commit: 0cfd027be1d6def4a462cdc180c055143af24069
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+pci_map_rom/pci_get_rom_size() performs memory access in the ROM.
+In case the Memory Space accesses were disabled, readw() is likely
+to trigger a synchronous external abort on some platforms.
+
+In case memory accesses were disabled, re-enable them before the
+call and disable them back again just after.
+
+Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Suggested-by: Alex Williamson <alex.williamson@redhat.com>
+Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++-----
+ 1 file changed, 14 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 84b593b9fb1f..a25659b5a5d1 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -759,6 +759,7 @@ static long vfio_pci_ioctl(void *device_data,
+ {
+ void __iomem *io;
+ size_t size;
++ u16 orig_cmd;
+
+ info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index);
+ info.flags = 0;
+@@ -774,15 +775,23 @@ static long vfio_pci_ioctl(void *device_data,
+ break;
+ }
+
+- /* Is it really there? */
++ /*
++ * Is it really there? Enable memory decode for
++ * implicit access in pci_map_rom().
++ */
++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd);
++ pci_write_config_word(pdev, PCI_COMMAND,
++ orig_cmd | PCI_COMMAND_MEMORY);
++
+ io = pci_map_rom(pdev, &size);
+- if (!io || !size) {
++ if (io) {
++ info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_unmap_rom(pdev, io);
++ } else {
+ info.size = 0;
+- break;
+ }
+- pci_unmap_rom(pdev, io);
+
+- info.flags = VFIO_REGION_INFO_FLAG_READ;
++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd);
+ break;
+ }
+ case VFIO_PCI_VGA_REGION_INDEX:
+--
+2.16.4
+
diff --git a/patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch b/patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
index b49a7cc7f5..9a119bf8a4 100644
--- a/patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
+++ b/patches.fixes/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
@@ -1,9 +1,10 @@
+From c38f57da428b033f2721b611d84b1f40bde674a8 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Thu, 6 Dec 2018 19:14:34 +0000
-Subject: vhost/vsock: fix reset orphans race with close timeout
-Patch-mainline: v4.20-rc6
+Subject: [PATCH] vhost/vsock: fix reset orphans race with close timeout
Git-commit: c38f57da428b033f2721b611d84b1f40bde674a8
-References: bsc#1109837
+Patch-mainline: v4.20-rc6
+References: bsc#1051510 bsc#1109837
If a local process has closed a connected socket and hasn't received a
RST packet yet, then the socket remains in the table until a timeout
@@ -20,14 +21,17 @@ Reported-by: Maximilian Riemensberger <riemensberger@cadami.net>
Cc: Graham Whaley <graham.whaley@gmail.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
-Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
---
- drivers/vhost/vsock.c | 22 +++++++++++++++-------
+ drivers/vhost/vsock.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
+diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
+index 34bc3ab40c6d..731e2ea2aeca 100644
--- a/drivers/vhost/vsock.c
+++ b/drivers/vhost/vsock.c
-@@ -561,13 +561,21 @@ static void vhost_vsock_reset_orphans(st
+@@ -563,13 +563,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk)
* executing.
*/
@@ -56,3 +60,6 @@ Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
}
static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
+--
+2.16.4
+
diff --git a/patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch b/patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch
new file mode 100644
index 0000000000..66063e9369
--- /dev/null
+++ b/patches.fixes/virtio-Honour-may_reduce_num-in-vring_create_virtque.patch
@@ -0,0 +1,66 @@
+From cf94db21905333e610e479688add629397a4b384 Mon Sep 17 00:00:00 2001
+From: Cornelia Huck <cohuck@redhat.com>
+Date: Mon, 8 Apr 2019 14:33:22 +0200
+Subject: [PATCH] virtio: Honour 'may_reduce_num' in vring_create_virtqueue
+Git-commit: cf94db21905333e610e479688add629397a4b384
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+vring_create_virtqueue() allows the caller to specify via the
+may_reduce_num parameter whether the vring code is allowed to
+allocate a smaller ring than specified.
+
+However, the split ring allocation code tries to allocate a
+smaller ring on allocation failure regardless of what the
+caller specified. This may cause trouble for e.g. virtio-pci
+in legacy mode, which does not support ring resizing. (The
+packed ring code does not resize in any case.)
+
+Let's fix this by bailing out immediately in the split ring code
+if the requested size cannot be allocated and may_reduce_num has
+not been specified.
+
+While at it, fix a typo in the usage instructions.
+
+Fixes: 2a2d1382fe9d ("virtio: Add improved queue allocation API")
+Cc: stable@vger.kernel.org # v4.6+
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
+Reviewed-by: Jens Freimann <jfreimann@redhat.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/virtio/virtio_ring.c | 2 ++
+ include/linux/virtio_ring.h | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
+index 18846afb39da..5df92c308286 100644
+--- a/drivers/virtio/virtio_ring.c
++++ b/drivers/virtio/virtio_ring.c
+@@ -882,6 +882,8 @@ static struct virtqueue *vring_create_virtqueue_split(
+ GFP_KERNEL|__GFP_NOWARN|__GFP_ZERO);
+ if (queue)
+ break;
++ if (!may_reduce_num)
++ return NULL;
+ }
+
+ if (!num)
+diff --git a/include/linux/virtio_ring.h b/include/linux/virtio_ring.h
+index fab02133a919..3dc70adfe5f5 100644
+--- a/include/linux/virtio_ring.h
++++ b/include/linux/virtio_ring.h
+@@ -63,7 +63,7 @@ struct virtqueue;
+ /*
+ * Creates a virtqueue and allocates the descriptor ring. If
+ * may_reduce_num is set, then this may allocate a smaller ring than
+- * expected. The caller should query virtqueue_get_ring_size to learn
++ * expected. The caller should query virtqueue_get_vring_size to learn
+ * the actual size of the ring.
+ */
+ struct virtqueue *vring_create_virtqueue(unsigned int index,
+--
+2.16.4
+
diff --git a/patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch b/patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch
new file mode 100644
index 0000000000..0cce08e17f
--- /dev/null
+++ b/patches.fixes/virtio-blk-limit-number-of-hw-queues-by-nr_cpu_ids.patch
@@ -0,0 +1,46 @@
+From bf348f9b78d413e75bb079462751a1d86b6de36c Mon Sep 17 00:00:00 2001
+From: Dongli Zhang <dongli.zhang@oracle.com>
+Date: Wed, 27 Mar 2019 18:36:34 +0800
+Subject: [PATCH] virtio-blk: limit number of hw queues by nr_cpu_ids
+Git-commit: bf348f9b78d413e75bb079462751a1d86b6de36c
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+When tag_set->nr_maps is 1, the block layer limits the number of hw queues
+by nr_cpu_ids. No matter how many hw queues are used by virtio-blk, as it
+has (tag_set->nr_maps == 1), it can use at most nr_cpu_ids hw queues.
+
+In addition, specifically for pci scenario, when the 'num-queues' specified
+by qemu is more than maxcpus, virtio-blk would not be able to allocate more
+than maxcpus vectors in order to have a vector for each queue. As a result,
+it falls back into MSI-X with one vector for config and one shared for
+queues.
+
+Considering above reasons, this patch limits the number of hw queues used
+by virtio-blk by nr_cpu_ids.
+
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/block/virtio_blk.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
+index 4bc083b7c9b5..2a7ca4a1e6f7 100644
+--- a/drivers/block/virtio_blk.c
++++ b/drivers/block/virtio_blk.c
+@@ -513,6 +513,8 @@ static int init_vq(struct virtio_blk *vblk)
+ if (err)
+ num_vqs = 1;
+
++ num_vqs = min_t(unsigned int, nr_cpu_ids, num_vqs);
++
+ vblk->vqs = kmalloc_array(num_vqs, sizeof(*vblk->vqs), GFP_KERNEL);
+ if (!vblk->vqs)
+ return -ENOMEM;
+--
+2.16.4
+
diff --git a/patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch b/patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch
new file mode 100644
index 0000000000..ce22aa40e9
--- /dev/null
+++ b/patches.fixes/virtio_pci-fix-a-NULL-pointer-reference-in-vp_del_vq.patch
@@ -0,0 +1,70 @@
+From 6a8aae68c87349dbbcd46eac380bc43cdb98a13b Mon Sep 17 00:00:00 2001
+From: Longpeng <longpeng2@huawei.com>
+Date: Sat, 9 Mar 2019 15:17:40 +0800
+Subject: [PATCH] virtio_pci: fix a NULL pointer reference in vp_del_vqs
+Git-commit: 6a8aae68c87349dbbcd46eac380bc43cdb98a13b
+Patch-mainline: v5.1-rc5
+References: bsc#1051510
+
+If the msix_affinity_masks is alloced failed, then we'll
+try to free some resources in vp_free_vectors() that may
+access it directly.
+
+We met the following stack in our production:
+[ 29.296767] BUG: unable to handle kernel NULL pointer dereference at (null)
+[ 29.311151] IP: [<ffffffffc04fe35a>] vp_free_vectors+0x6a/0x150 [virtio_pci]
+[ 29.324787] PGD 0
+[ 29.333224] Oops: 0000 [#1] SMP
+[...]
+[ 29.425175] RIP: 0010:[<ffffffffc04fe35a>] [<ffffffffc04fe35a>] vp_free_vectors+0x6a/0x150 [virtio_pci]
+[ 29.441405] RSP: 0018:ffff9a55c2dcfa10 EFLAGS: 00010206
+[ 29.453491] RAX: 0000000000000000 RBX: ffff9a55c322c400 RCX: 0000000000000000
+[ 29.467488] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9a55c322c400
+[ 29.481461] RBP: ffff9a55c2dcfa20 R08: 0000000000000000 R09: ffffc1b6806ff020
+[ 29.495427] R10: 0000000000000e95 R11: 0000000000aaaaaa R12: 0000000000000000
+[ 29.509414] R13: 0000000000010000 R14: ffff9a55bd2d9e98 R15: ffff9a55c322c400
+[ 29.523407] FS: 00007fdcba69f8c0(0000) GS:ffff9a55c2840000(0000) knlGS:0000000000000000
+[ 29.538472] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 29.551621] CR2: 0000000000000000 CR3: 000000003ce52000 CR4: 00000000003607a0
+[ 29.565886] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 29.580055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 29.594122] Call Trace:
+[ 29.603446] [<ffffffffc04fe8a2>] vp_request_msix_vectors+0xe2/0x260 [virtio_pci]
+[ 29.618017] [<ffffffffc04fedc5>] vp_try_to_find_vqs+0x95/0x3b0 [virtio_pci]
+[ 29.632152] [<ffffffffc04ff117>] vp_find_vqs+0x37/0xb0 [virtio_pci]
+[ 29.645582] [<ffffffffc057bf63>] init_vq+0x153/0x260 [virtio_blk]
+[ 29.658831] [<ffffffffc057c1e8>] virtblk_probe+0xe8/0x87f [virtio_blk]
+[...]
+
+Cc: Gonglei <arei.gonglei@huawei.com>
+Signed-off-by: Longpeng <longpeng2@huawei.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Reviewed-by: Gonglei <arei.gonglei@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/virtio/virtio_pci_common.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
+index d0584c040c60..7a0398bb84f7 100644
+--- a/drivers/virtio/virtio_pci_common.c
++++ b/drivers/virtio/virtio_pci_common.c
+@@ -255,9 +255,11 @@ void vp_del_vqs(struct virtio_device *vdev)
+ for (i = 0; i < vp_dev->msix_used_vectors; ++i)
+ free_irq(pci_irq_vector(vp_dev->pci_dev, i), vp_dev);
+
+- for (i = 0; i < vp_dev->msix_vectors; i++)
+- if (vp_dev->msix_affinity_masks[i])
+- free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ if (vp_dev->msix_affinity_masks) {
++ for (i = 0; i < vp_dev->msix_vectors; i++)
++ if (vp_dev->msix_affinity_masks[i])
++ free_cpumask_var(vp_dev->msix_affinity_masks[i]);
++ }
+
+ if (vp_dev->msix_enabled) {
+ /* Disable the vector used for configuration */
+--
+2.16.4
+
diff --git a/patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch b/patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch
new file mode 100644
index 0000000000..b6fe226c01
--- /dev/null
+++ b/patches.fixes/vsock-virtio-fix-kernel-panic-after-device-hot-unplu.patch
@@ -0,0 +1,103 @@
+From 22b5c0b63f32568e130fa2df4ba23efce3eb495b Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 1 Feb 2019 12:42:06 +0100
+Subject: [PATCH] vsock/virtio: fix kernel panic after device hot-unplug
+Git-commit: 22b5c0b63f32568e130fa2df4ba23efce3eb495b
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+virtio_vsock_remove() invokes the vsock_core_exit() also if there
+are opened sockets for the AF_VSOCK protocol family. In this way
+the vsock "transport" pointer is set to NULL, triggering the
+kernel panic at the first socket activity.
+
+This patch move the vsock_core_init()/vsock_core_exit() in the
+virtio_vsock respectively in module_init and module_exit functions,
+that cannot be invoked until there are open sockets.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1609699
+Reported-by: Yan Fu <yafu@redhat.com>
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/vmw_vsock/virtio_transport.c | 26 ++++++++++++++++++--------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 5d3cce9e8744..9dae54698737 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -75,6 +75,9 @@ static u32 virtio_transport_get_local_cid(void)
+ {
+ struct virtio_vsock *vsock = virtio_vsock_get();
+
++ if (!vsock)
++ return VMADDR_CID_ANY;
++
+ return vsock->guest_cid;
+ }
+
+@@ -584,10 +587,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+
+ virtio_vsock_update_guest_cid(vsock);
+
+- ret = vsock_core_init(&virtio_transport.transport);
+- if (ret < 0)
+- goto out_vqs;
+-
+ vsock->rx_buf_nr = 0;
+ vsock->rx_buf_max_nr = 0;
+ atomic_set(&vsock->queued_replies, 0);
+@@ -618,8 +617,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ mutex_unlock(&the_virtio_vsock_mutex);
+ return 0;
+
+-out_vqs:
+- vsock->vdev->config->del_vqs(vsock->vdev);
+ out:
+ kfree(vsock);
+ mutex_unlock(&the_virtio_vsock_mutex);
+@@ -669,7 +666,6 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+
+ mutex_lock(&the_virtio_vsock_mutex);
+ the_virtio_vsock = NULL;
+- vsock_core_exit();
+ mutex_unlock(&the_virtio_vsock_mutex);
+
+ vdev->config->del_vqs(vdev);
+@@ -702,14 +698,28 @@ static int __init virtio_vsock_init(void)
+ virtio_vsock_workqueue = alloc_workqueue("virtio_vsock", 0, 0);
+ if (!virtio_vsock_workqueue)
+ return -ENOMEM;
++
+ ret = register_virtio_driver(&virtio_vsock_driver);
+ if (ret)
+- destroy_workqueue(virtio_vsock_workqueue);
++ goto out_wq;
++
++ ret = vsock_core_init(&virtio_transport.transport);
++ if (ret)
++ goto out_vdr;
++
++ return 0;
++
++out_vdr:
++ unregister_virtio_driver(&virtio_vsock_driver);
++out_wq:
++ destroy_workqueue(virtio_vsock_workqueue);
+ return ret;
++
+ }
+
+ static void __exit virtio_vsock_exit(void)
+ {
++ vsock_core_exit();
+ unregister_virtio_driver(&virtio_vsock_driver);
+ destroy_workqueue(virtio_vsock_workqueue);
+ }
+--
+2.16.4
+
diff --git a/patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch b/patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch
new file mode 100644
index 0000000000..c7fa6c3fb5
--- /dev/null
+++ b/patches.fixes/vsock-virtio-fix-kernel-panic-from-virtio_transport_.patch
@@ -0,0 +1,109 @@
+From 4c404ce23358d5d8fbdeb7a6021a9b33d3c3c167 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Adalbert=20Laz=C4=83r?= <alazar@bitdefender.com>
+Date: Wed, 6 Mar 2019 12:13:53 +0200
+Subject: [PATCH] vsock/virtio: fix kernel panic from virtio_transport_reset_no_sock
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 4c404ce23358d5d8fbdeb7a6021a9b33d3c3c167
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Previous to commit 22b5c0b63f32 ("vsock/virtio: fix kernel panic
+after device hot-unplug"), vsock_core_init() was called from
+virtio_vsock_probe(). Now, virtio_transport_reset_no_sock() can be called
+before vsock_core_init() has the chance to run.
+
+[Wed Feb 27 14:17:09 2019] BUG: unable to handle kernel NULL pointer dereference at 0000000000000110
+[Wed Feb 27 14:17:09 2019] #PF error: [normal kernel read fault]
+[Wed Feb 27 14:17:09 2019] PGD 0 P4D 0
+[Wed Feb 27 14:17:09 2019] Oops: 0000 [#1] SMP PTI
+[Wed Feb 27 14:17:09 2019] CPU: 3 PID: 59 Comm: kworker/3:1 Not tainted 5.0.0-rc7-390-generic-hvi #390
+[Wed Feb 27 14:17:09 2019] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+[Wed Feb 27 14:17:09 2019] Workqueue: virtio_vsock virtio_transport_rx_work [vmw_vsock_virtio_transport]
+[Wed Feb 27 14:17:09 2019] RIP: 0010:virtio_transport_reset_no_sock+0x8c/0xc0 [vmw_vsock_virtio_transport_common]
+[Wed Feb 27 14:17:09 2019] Code: 35 8b 4f 14 48 8b 57 08 31 f6 44 8b 4f 10 44 8b 07 48 8d 7d c8 e8 84 f8 ff ff 48 85 c0 48 89 c3 74 2a e8 f7 31 03 00 48 89 df <48> 8b 80 10 01 00 00 e8 68 fb 69 ed 48 8b 75 f0 65 48 33 34 25 28
+[Wed Feb 27 14:17:09 2019] RSP: 0018:ffffb42701ab7d40 EFLAGS: 00010282
+[Wed Feb 27 14:17:09 2019] RAX: 0000000000000000 RBX: ffff9d79637ee080 RCX: 0000000000000003
+[Wed Feb 27 14:17:09 2019] RDX: 0000000000000001 RSI: 0000000000000002 RDI: ffff9d79637ee080
+[Wed Feb 27 14:17:09 2019] RBP: ffffb42701ab7d78 R08: ffff9d796fae70e0 R09: ffff9d796f403500
+[Wed Feb 27 14:17:09 2019] R10: ffffb42701ab7d90 R11: 0000000000000000 R12: ffff9d7969d09240
+[Wed Feb 27 14:17:09 2019] R13: ffff9d79624e6840 R14: ffff9d7969d09318 R15: ffff9d796d48ff80
+[Wed Feb 27 14:17:09 2019] FS: 0000000000000000(0000) GS:ffff9d796fac0000(0000) knlGS:0000000000000000
+[Wed Feb 27 14:17:09 2019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[Wed Feb 27 14:17:09 2019] CR2: 0000000000000110 CR3: 0000000427f22000 CR4: 00000000000006e0
+[Wed Feb 27 14:17:09 2019] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[Wed Feb 27 14:17:09 2019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[Wed Feb 27 14:17:09 2019] Call Trace:
+[Wed Feb 27 14:17:09 2019] virtio_transport_recv_pkt+0x63/0x820 [vmw_vsock_virtio_transport_common]
+[Wed Feb 27 14:17:09 2019] ? kfree+0x17e/0x190
+[Wed Feb 27 14:17:09 2019] ? detach_buf_split+0x145/0x160
+[Wed Feb 27 14:17:09 2019] ? __switch_to_asm+0x40/0x70
+[Wed Feb 27 14:17:09 2019] virtio_transport_rx_work+0xa0/0x106 [vmw_vsock_virtio_transport]
+[Wed Feb 27 14:17:09 2019] NET: Registered protocol family 40
+[Wed Feb 27 14:17:09 2019] process_one_work+0x167/0x410
+[Wed Feb 27 14:17:09 2019] worker_thread+0x4d/0x460
+[Wed Feb 27 14:17:09 2019] kthread+0x105/0x140
+[Wed Feb 27 14:17:09 2019] ? rescuer_thread+0x360/0x360
+[Wed Feb 27 14:17:09 2019] ? kthread_destroy_worker+0x50/0x50
+[Wed Feb 27 14:17:09 2019] ret_from_fork+0x35/0x40
+[Wed Feb 27 14:17:09 2019] Modules linked in: vmw_vsock_virtio_transport vmw_vsock_virtio_transport_common input_leds vsock serio_raw i2c_piix4 mac_hid qemu_fw_cfg autofs4 cirrus ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops virtio_net psmouse drm net_failover pata_acpi virtio_blk failover floppy
+
+Fixes: 22b5c0b63f32 ("vsock/virtio: fix kernel panic after device hot-unplug")
+Reported-by: Alexandru Herghelegiu <aherghelegiu@bitdefender.com>
+Signed-off-by: Adalbert Lazăr <alazar@bitdefender.com>
+Co-developed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/vmw_vsock/virtio_transport_common.c | 22 +++++++++++++++-------
+ 1 file changed, 15 insertions(+), 7 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 3ae3a33da70b..602715fc9a75 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -662,6 +662,8 @@ static int virtio_transport_reset(struct vsock_sock *vsk,
+ */
+ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ {
++ const struct virtio_transport *t;
++ struct virtio_vsock_pkt *reply;
+ struct virtio_vsock_pkt_info info = {
+ .op = VIRTIO_VSOCK_OP_RST,
+ .type = le16_to_cpu(pkt->hdr.type),
+@@ -672,15 +674,21 @@ static int virtio_transport_reset_no_sock(struct virtio_vsock_pkt *pkt)
+ if (le16_to_cpu(pkt->hdr.op) == VIRTIO_VSOCK_OP_RST)
+ return 0;
+
+- pkt = virtio_transport_alloc_pkt(&info, 0,
+- le64_to_cpu(pkt->hdr.dst_cid),
+- le32_to_cpu(pkt->hdr.dst_port),
+- le64_to_cpu(pkt->hdr.src_cid),
+- le32_to_cpu(pkt->hdr.src_port));
+- if (!pkt)
++ reply = virtio_transport_alloc_pkt(&info, 0,
++ le64_to_cpu(pkt->hdr.dst_cid),
++ le32_to_cpu(pkt->hdr.dst_port),
++ le64_to_cpu(pkt->hdr.src_cid),
++ le32_to_cpu(pkt->hdr.src_port));
++ if (!reply)
+ return -ENOMEM;
+
+- return virtio_transport_get_ops()->send_pkt(pkt);
++ t = virtio_transport_get_ops();
++ if (!t) {
++ virtio_transport_free_pkt(reply);
++ return -ENOTCONN;
++ }
++
++ return t->send_pkt(reply);
+ }
+
+ static void virtio_transport_wait_close(struct sock *sk, long timeout)
+--
+2.16.4
+
diff --git a/patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch b/patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch
new file mode 100644
index 0000000000..13a23d699f
--- /dev/null
+++ b/patches.fixes/vsock-virtio-reset-connected-sockets-on-device-remov.patch
@@ -0,0 +1,37 @@
+From 85965487abc540368393a15491e6e7fcd230039d Mon Sep 17 00:00:00 2001
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 1 Feb 2019 12:42:07 +0100
+Subject: [PATCH] vsock/virtio: reset connected sockets on device removal
+Git-commit: 85965487abc540368393a15491e6e7fcd230039d
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+When the virtio transport device disappear, we should reset all
+connected sockets in order to inform the users.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/vmw_vsock/virtio_transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 9dae54698737..15eb5d3d4750 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -634,6 +634,9 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ flush_work(&vsock->event_work);
+ flush_work(&vsock->send_pkt_work);
+
++ /* Reset all connected sockets when the device disappear */
++ vsock_for_each_connected_socket(virtio_vsock_reset_sock);
++
+ vdev->config->reset(vdev);
+
+ mutex_lock(&vsock->rx_lock);
+--
+2.16.4
+
diff --git a/patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch b/patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch
new file mode 100644
index 0000000000..cff1ae58be
--- /dev/null
+++ b/patches.fixes/xfs-detect-and-fix-bad-summary-counts-at-mount.patch
@@ -0,0 +1,190 @@
+From 2e9e6481e2a78de3a85083beccfbf6eda2689922 Mon Sep 17 00:00:00 2001
+From: "Darrick J. Wong" <darrick.wong@oracle.com>
+Date: Thu, 19 Jul 2018 12:29:13 -0700
+Subject: [PATCH] xfs: detect and fix bad summary counts at mount
+Git-commit: 2e9e6481e2a78de3a85083beccfbf6eda2689922
+Patch-mainline: v4.19-rc1
+References: bsc#1114427
+
+Filippo Giunchedi complained that xfs doesn't even perform basic sanity
+checks of the fs summary counters at mount time. Therefore, recalculate
+the summary counters from the AGFs after log recovery if the counts were
+bad (or we had to recover the fs). Enhance the recalculation routine to
+fail the mount entirely if the new values are also obviously incorrect.
+
+We use a mount state flag to record the "bad summary count" state so
+that the (subsequent) online fsck patches can detect subtlely incorrect
+counts and set the flag; clear it userspace asks for a repair; or force
+a recalculation at the next mount if nobody fixes it by unmount time.
+
+Reported-by: Filippo Giunchedi <fgiunchedi@wikimedia.org>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/libxfs/xfs_sb.c | 21 +++++++++++--
+ fs/xfs/xfs_mount.c | 80 ++++++++++++++++++++++++++++++++++----------------
+ fs/xfs/xfs_mount.h | 1 +
+ 3 files changed, 73 insertions(+), 29 deletions(-)
+
+diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
+index 350119eeaecb..b3ad15956366 100644
+--- a/fs/xfs/libxfs/xfs_sb.c
++++ b/fs/xfs/libxfs/xfs_sb.c
+@@ -804,6 +804,7 @@ xfs_initialize_perag_data(
+ uint64_t bfree = 0;
+ uint64_t bfreelst = 0;
+ uint64_t btree = 0;
++ uint64_t fdblocks;
+ int error;
+
+ for (index = 0; index < agcount; index++) {
+@@ -827,17 +828,31 @@ xfs_initialize_perag_data(
+ btree += pag->pagf_btreeblks;
+ xfs_perag_put(pag);
+ }
++ fdblocks = bfree + bfreelst + btree;
++
++ /*
++ * If the new summary counts are obviously incorrect, fail the
++ * mount operation because that implies the AGFs are also corrupt.
++ * Clear BAD_SUMMARY so that we don't unmount with a dirty log, which
++ * will prevent xfs_repair from fixing anything.
++ */
++ if (fdblocks > sbp->sb_dblocks || ifree > ialloc) {
++ xfs_alert(mp, "AGF corruption. Please run xfs_repair.");
++ error = -EFSCORRUPTED;
++ goto out;
++ }
+
+ /* Overwrite incore superblock counters with just-read data */
+ spin_lock(&mp->m_sb_lock);
+ sbp->sb_ifree = ifree;
+ sbp->sb_icount = ialloc;
+- sbp->sb_fdblocks = bfree + bfreelst + btree;
++ sbp->sb_fdblocks = fdblocks;
+ spin_unlock(&mp->m_sb_lock);
+
+ xfs_reinit_percpu_counters(mp);
+-
+- return 0;
++out:
++ mp->m_flags &= ~XFS_MOUNT_BAD_SUMMARY;
++ return error;
+ }
+
+ /*
+diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
+index a3378252baa1..60462c35ad4b 100644
+--- a/fs/xfs/xfs_mount.c
++++ b/fs/xfs/xfs_mount.c
+@@ -606,6 +606,56 @@ xfs_default_resblks(xfs_mount_t *mp)
+ return resblks;
+ }
+
++/* Ensure the summary counts are correct. */
++STATIC int
++xfs_check_summary_counts(
++ struct xfs_mount *mp)
++{
++ /*
++ * The AG0 superblock verifier rejects in-progress filesystems,
++ * so we should never see the flag set this far into mounting.
++ */
++ if (mp->m_sb.sb_inprogress) {
++ xfs_err(mp, "sb_inprogress set after log recovery??");
++ WARN_ON(1);
++ return -EFSCORRUPTED;
++ }
++
++ /*
++ * Now the log is mounted, we know if it was an unclean shutdown or
++ * not. If it was, with the first phase of recovery has completed, we
++ * have consistent AG blocks on disk. We have not recovered EFIs yet,
++ * but they are recovered transactionally in the second recovery phase
++ * later.
++ *
++ * If the log was clean when we mounted, we can check the summary
++ * counters. If any of them are obviously incorrect, we can recompute
++ * them from the AGF headers in the next step.
++ */
++ if (XFS_LAST_UNMOUNT_WAS_CLEAN(mp) &&
++ (mp->m_sb.sb_fdblocks > mp->m_sb.sb_dblocks ||
++ mp->m_sb.sb_ifree > mp->m_sb.sb_icount))
++ mp->m_flags |= XFS_MOUNT_BAD_SUMMARY;
++
++ /*
++ * We can safely re-initialise incore superblock counters from the
++ * per-ag data. These may not be correct if the filesystem was not
++ * cleanly unmounted, so we waited for recovery to finish before doing
++ * this.
++ *
++ * If the filesystem was cleanly unmounted or the previous check did
++ * not flag anything weird, then we can trust the values in the
++ * superblock to be correct and we don't need to do anything here.
++ * Otherwise, recalculate the summary counters.
++ */
++ if ((!xfs_sb_version_haslazysbcount(&mp->m_sb) ||
++ XFS_LAST_UNMOUNT_WAS_CLEAN(mp)) &&
++ !(mp->m_flags & XFS_MOUNT_BAD_SUMMARY))
++ return 0;
++
++ return xfs_initialize_perag_data(mp, mp->m_sb.sb_agcount);
++}
++
+ /*
+ * This function does the following on an initial mount of a file system:
+ * - reads the superblock from disk and init the mount struct
+@@ -831,32 +881,10 @@ xfs_mountfs(
+ goto out_fail_wait;
+ }
+
+- /*
+- * Now the log is mounted, we know if it was an unclean shutdown or
+- * not. If it was, with the first phase of recovery has completed, we
+- * have consistent AG blocks on disk. We have not recovered EFIs yet,
+- * but they are recovered transactionally in the second recovery phase
+- * later.
+- *
+- * Hence we can safely re-initialise incore superblock counters from
+- * the per-ag data. These may not be correct if the filesystem was not
+- * cleanly unmounted, so we need to wait for recovery to finish before
+- * doing this.
+- *
+- * If the filesystem was cleanly unmounted, then we can trust the
+- * values in the superblock to be correct and we don't need to do
+- * anything here.
+- *
+- * If we are currently making the filesystem, the initialisation will
+- * fail as the perag data is in an undefined state.
+- */
+- if (xfs_sb_version_haslazysbcount(&mp->m_sb) &&
+- !XFS_LAST_UNMOUNT_WAS_CLEAN(mp) &&
+- !mp->m_sb.sb_inprogress) {
+- error = xfs_initialize_perag_data(mp, sbp->sb_agcount);
+- if (error)
+- goto out_log_dealloc;
+- }
++ /* Make sure the summary counts are ok. */
++ error = xfs_check_summary_counts(mp);
++ if (error)
++ goto out_log_dealloc;
+
+ /*
+ * Get and sanity-check the root inode.
+diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
+index 245349d1e23f..f08907db9c61 100644
+--- a/fs/xfs/xfs_mount.h
++++ b/fs/xfs/xfs_mount.h
+@@ -202,6 +202,7 @@ typedef struct xfs_mount {
+ must be synchronous except
+ for space allocations */
+ #define XFS_MOUNT_UNMOUNTING (1ULL << 1) /* filesystem is unmounting */
++#define XFS_MOUNT_BAD_SUMMARY (1ULL << 2) /* summary counters are bad */
+ #define XFS_MOUNT_WAS_CLEAN (1ULL << 3)
+ #define XFS_MOUNT_FS_SHUTDOWN (1ULL << 4) /* atomic stop of all filesystem
+ operations, typically for
+--
+2.16.4
+
diff --git a/patches.fixes/xfs-kill-meaningless-variable-zero.patch b/patches.fixes/xfs-kill-meaningless-variable-zero.patch
new file mode 100644
index 0000000000..8a6f7a1d20
--- /dev/null
+++ b/patches.fixes/xfs-kill-meaningless-variable-zero.patch
@@ -0,0 +1,49 @@
+From 64671bafbdd984535aa382bccadd91fbe7be0e80 Mon Sep 17 00:00:00 2001
+From: Eryu Guan <eguan@redhat.com>
+Date: Mon, 18 Sep 2017 11:38:58 -0700
+Subject: [PATCH] xfs: kill meaningless variable 'zero'
+Git-commit: 64671bafbdd984535aa382bccadd91fbe7be0e80
+Patch-mainline: v4.14-rc3
+References: bsc#1106011
+
+In xfs_file_aio_write_checks(), variable 'zero' is there only to
+satisfy xfs_zero_eof(), the result of it is ignored. Now, with
+iomap_zero_range() based xfs_zero_eof(), we can safely pass NULL as
+the last param of it and kill 'zero'.
+
+Signed-off-by: Eryu Guan <eguan@redhat.com>
+Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/xfs_file.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index ebdd0bd2b261..261d83f1db76 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -377,8 +377,6 @@ xfs_file_aio_write_checks(
+ */
+ spin_lock(&ip->i_flags_lock);
+ if (iocb->ki_pos > i_size_read(inode)) {
+- bool zero = false;
+-
+ spin_unlock(&ip->i_flags_lock);
+ if (!drained_dio) {
+ if (*iolock == XFS_IOLOCK_SHARED) {
+@@ -399,7 +397,7 @@ xfs_file_aio_write_checks(
+ drained_dio = true;
+ goto restart;
+ }
+- error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), &zero);
++ error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), NULL);
+ if (error)
+ return error;
+ } else
+--
+2.16.4
+
diff --git a/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch b/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch
index 315528a2e4..dc8b2aea0d 100644
--- a/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch
+++ b/patches.fixes/xfs-prepare-xfs_break_layouts-for-another-layout-typ.patch
@@ -4,7 +4,7 @@ Date: Tue, 20 Mar 2018 14:42:38 -0700
Subject: [PATCH] xfs: prepare xfs_break_layouts() for another layout type
Git-commit: 69eb5fa10eb283e9fcae3ce6f8aaf103b8f0c28d
Patch-mainline: v4.18-rc1
-References: bsc#1104888
+References: bsc#1104888 bsc#1106011
When xfs is operating as the back-end of a pNFS block server, it
prevents collisions between local and remote operations by requiring a
@@ -123,9 +123,9 @@ Acked-by: Jan Kara <jack@suse.cz>
* directory, group of new file is set to that of the parent, and
* new subdirectory gets S_ISGID bit from parent.
@@ -448,6 +462,8 @@ int xfs_zero_range(struct xfs_inode *ip,
- xfs_fsize_t isize, bool *did_zeroing);
- int xfs_zero_range(struct xfs_inode *ip, xfs_off_t pos, xfs_off_t count,
- bool *did_zero);
+
+ int xfs_update_prealloc_flags(struct xfs_inode *ip,
+ enum xfs_prealloc_flags flags);
+int xfs_break_layouts(struct inode *inode, uint *iolock,
+ enum layout_break_reason reason);
diff --git a/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch b/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
index be05d138ae..3c0c19093b 100644
--- a/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
+++ b/patches.fixes/xfs-prepare-xfs_break_layouts-to-be-called-with-XFS_.patch
@@ -5,7 +5,7 @@ Subject: [PATCH] xfs: prepare xfs_break_layouts() to be called with
XFS_MMAPLOCK_EXCL
Git-commit: c63a8eae63d3859c9c7067aa239a4cfd7423a665
Patch-mainline: v4.18-rc1
-References: bsc#1104888
+References: bsc#1104888 bsc#1106011
In preparation for adding coordination between extent unmap operations
and busy dax-pages, update xfs_break_layouts() to permit it to be called
diff --git a/patches.fixes/xfs-remove-xfs_zero_range.patch b/patches.fixes/xfs-remove-xfs_zero_range.patch
new file mode 100644
index 0000000000..3adfa5f762
--- /dev/null
+++ b/patches.fixes/xfs-remove-xfs_zero_range.patch
@@ -0,0 +1,170 @@
+From f5c54717bf2b9e052bb69d6ee19fe22e87817079 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Tue, 13 Mar 2018 23:15:32 -0700
+Subject: [PATCH] xfs: remove xfs_zero_range
+Git-commit: f5c54717bf2b9e052bb69d6ee19fe22e87817079
+Patch-mainline: v4.17-rc1
+References: bsc#1106011
+
+This helper doesn't add any real value over just calling iomap_zero_range
+directly, so remove it.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
+Acked-by: Anthony Iliopoulos <ailiopoulos@suse.com>
+
+---
+ fs/xfs/xfs_bmap_util.c | 11 ++++-------
+ fs/xfs/xfs_file.c | 48 +++++++-----------------------------------------
+ fs/xfs/xfs_inode.h | 4 ----
+ fs/xfs/xfs_iops.c | 4 +++-
+ 4 files changed, 14 insertions(+), 53 deletions(-)
+
+diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
+index 19ea7d086cf8..05dee8fdd895 100644
+--- a/fs/xfs/xfs_bmap_util.c
++++ b/fs/xfs/xfs_bmap_util.c
+@@ -1208,18 +1208,15 @@ xfs_free_file_space(
+
+ /*
+ * Now that we've unmap all full blocks we'll have to zero out any
+- * partial block at the beginning and/or end. xfs_zero_range is
+- * smart enough to skip any holes, including those we just created,
+- * but we must take care not to zero beyond EOF and enlarge i_size.
++ * partial block at the beginning and/or end. iomap_zero_range is smart
++ * enough to skip any holes, including those we just created, but we
++ * must take care not to zero beyond EOF and enlarge i_size.
+ */
+-
+ if (offset >= XFS_ISIZE(ip))
+ return 0;
+-
+ if (offset + len > XFS_ISIZE(ip))
+ len = XFS_ISIZE(ip) - offset;
+-
+- return xfs_zero_range(ip, offset, len, NULL);
++ return iomap_zero_range(VFS_I(ip), offset, len, NULL, &xfs_iomap_ops);
+ }
+
+ /*
+diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
+index f5c5dbbf1792..299aee4b7b0b 100644
+--- a/fs/xfs/xfs_file.c
++++ b/fs/xfs/xfs_file.c
+@@ -48,20 +48,6 @@
+
+ static const struct vm_operations_struct xfs_file_vm_ops;
+
+-/*
+- * Clear the specified ranges to zero through either the pagecache or DAX.
+- * Holes and unwritten extents will be left as-is as they already are zeroed.
+- */
+-int
+-xfs_zero_range(
+- struct xfs_inode *ip,
+- xfs_off_t pos,
+- xfs_off_t count,
+- bool *did_zero)
+-{
+- return iomap_zero_range(VFS_I(ip), pos, count, did_zero, &xfs_iomap_ops);
+-}
+-
+ int
+ xfs_update_prealloc_flags(
+ struct xfs_inode *ip,
+@@ -300,31 +286,6 @@ xfs_file_read_iter(
+ return ret;
+ }
+
+-/*
+- * Zero any on disk space between the current EOF and the new, larger EOF.
+- *
+- * This handles the normal case of zeroing the remainder of the last block in
+- * the file and the unusual case of zeroing blocks out beyond the size of the
+- * file. This second case only happens with fixed size extents and when the
+- * system crashes before the inode size was updated but after blocks were
+- * allocated.
+- *
+- * Expects the iolock to be held exclusive, and will take the ilock internally.
+- */
+-int /* error (positive) */
+-xfs_zero_eof(
+- struct xfs_inode *ip,
+- xfs_off_t offset, /* starting I/O offset */
+- xfs_fsize_t isize, /* current inode size */
+- bool *did_zeroing)
+-{
+- ASSERT(xfs_isilocked(ip, XFS_IOLOCK_EXCL));
+- ASSERT(offset > isize);
+-
+- trace_xfs_zero_eof(ip, isize, offset - isize);
+- return xfs_zero_range(ip, isize, offset - isize, did_zeroing);
+-}
+-
+ /*
+ * Common pre-write limit and setup checks.
+ *
+@@ -344,6 +305,7 @@ xfs_file_aio_write_checks(
+ ssize_t error = 0;
+ size_t count = iov_iter_count(from);
+ bool drained_dio = false;
++ loff_t isize;
+
+ restart:
+ error = generic_write_checks(iocb, from);
+@@ -380,7 +342,8 @@ xfs_file_aio_write_checks(
+ * and hence be able to correctly determine if we need to run zeroing.
+ */
+ spin_lock(&ip->i_flags_lock);
+- if (iocb->ki_pos > i_size_read(inode)) {
++ isize = i_size_read(inode);
++ if (iocb->ki_pos > isize) {
+ spin_unlock(&ip->i_flags_lock);
+ if (!drained_dio) {
+ if (*iolock == XFS_IOLOCK_SHARED) {
+@@ -401,7 +364,10 @@ xfs_file_aio_write_checks(
+ drained_dio = true;
+ goto restart;
+ }
+- error = xfs_zero_eof(ip, iocb->ki_pos, i_size_read(inode), NULL);
++
++ trace_xfs_zero_eof(ip, isize, iocb->ki_pos - isize);
++ error = iomap_zero_range(inode, isize, iocb->ki_pos - isize,
++ NULL, &xfs_iomap_ops);
+ if (error)
+ return error;
+ } else
+diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
+index 3e8dc990d41c..132d8aa2afc4 100644
+--- a/fs/xfs/xfs_inode.h
++++ b/fs/xfs/xfs_inode.h
+@@ -443,10 +443,6 @@ enum xfs_prealloc_flags {
+
+ int xfs_update_prealloc_flags(struct xfs_inode *ip,
+ enum xfs_prealloc_flags flags);
+-int xfs_zero_eof(struct xfs_inode *ip, xfs_off_t offset,
+- xfs_fsize_t isize, bool *did_zeroing);
+-int xfs_zero_range(struct xfs_inode *ip, xfs_off_t pos, xfs_off_t count,
+- bool *did_zero);
+
+ /* from xfs_iops.c */
+ extern void xfs_setup_inode(struct xfs_inode *ip);
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index 8567951eff10..e0307fbff911 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -875,7 +875,9 @@ xfs_setattr_size(
+ * truncate.
+ */
+ if (newsize > oldsize) {
+- error = xfs_zero_eof(ip, newsize, oldsize, &did_zeroing);
++ trace_xfs_zero_eof(ip, oldsize, newsize - oldsize);
++ error = iomap_zero_range(inode, oldsize, newsize - oldsize,
++ &did_zeroing, &xfs_iomap_ops);
+ } else {
+ error = iomap_truncate_page(inode, newsize, &did_zeroing,
+ &xfs_iomap_ops);
+--
+2.16.4
+
diff --git a/patches.kabi/Re-export-snd_cards-for-kABI.patch b/patches.kabi/Re-export-snd_cards-for-kABI.patch
new file mode 100644
index 0000000000..0fd3b42980
--- /dev/null
+++ b/patches.kabi/Re-export-snd_cards-for-kABI.patch
@@ -0,0 +1,26 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: Re-export snd_cards for kABI compatibility
+Patch-mainline: Never, kABI compatibility
+References: bsc#1051510
+
+Re-export snd_cards object only for kABI compatibility with SLE15.
+It's not declared in the header.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -49,7 +49,8 @@ static const struct file_operations snd_
+
+ /* locked for registering/using */
+ static DECLARE_BITMAP(snd_cards_lock, SNDRV_CARDS);
+-static struct snd_card *snd_cards[SNDRV_CARDS];
++struct snd_card *snd_cards[SNDRV_CARDS];
++EXPORT_SYMBOL(snd_cards); /* XXX exported only for SLE15 kABI compatibility */
+
+ static DEFINE_MUTEX(snd_card_mutex);
+
diff --git a/patches.kabi/md-batch-flush-requests-kabi.patch b/patches.kabi/md-batch-flush-requests-kabi.patch
index b72a850995..8df435fdb0 100644
--- a/patches.kabi/md-batch-flush-requests-kabi.patch
+++ b/patches.kabi/md-batch-flush-requests-kabi.patch
@@ -9,8 +9,8 @@ Acked-by: NeilBrown <neilb@suse.com>
Signed-off-by: Neil Brown <neilb@suse.com>
---
- drivers/md/md.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
+ drivers/md/md.h | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -24,13 +24,15 @@ Signed-off-by: Neil Brown <neilb@suse.com>
struct work_struct flush_work;
struct work_struct event_work; /* used by dm to report failure event */
void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
-@@ -477,6 +474,9 @@ struct mddev {
+@@ -476,6 +473,11 @@ struct mddev {
+ unsigned int good_device_nr; /* good device num within cluster raid */
- #ifndef __GENKSYMS__
bool has_superblocks:1;
++#ifndef __GENKSYMS__
+ ktime_t start_flush, last_flush; /* last_flush is when the last completed
+ * flush was started.
+ */
- #endif
++#endif
};
+ enum recovery_flags {
diff --git a/patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch b/patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch
new file mode 100644
index 0000000000..22d8af8e48
--- /dev/null
+++ b/patches.kabi/snd_seq_kernel_client_enqueue-kabi-compat.patch
@@ -0,0 +1,50 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: kABI workaround for snd_seq_kernel_client_enqueue() API changes
+Patch-mainline: Never, ugly kABI workaround
+References: bsc#1051510
+
+The snd_seq_kernel_client_enqueue() API function was changed to take
+fewer arguments. Rename it and provide the old API functions to keep
+the kABI compatibility with SLE15.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/sound/seq_kernel.h | 2 ++
+ sound/core/seq/seq_clientmgr.c | 17 +++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+--- a/include/sound/seq_kernel.h
++++ b/include/sound/seq_kernel.h
+@@ -73,6 +73,8 @@ __printf(3, 4)
+ int snd_seq_create_kernel_client(struct snd_card *card, int client_index,
+ const char *name_fmt, ...);
+ int snd_seq_delete_kernel_client(int client);
++/* XXX kABI compatibility for SLE15 XXX */
++#define snd_seq_kernel_client_enqueue __snd_seq_kernel_client_enqueue
+ int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
+ struct file *file, bool blocking);
+ int snd_seq_kernel_client_dispatch(int client, struct snd_seq_event *ev, int atomic, int hop);
+--- a/sound/core/seq/seq_clientmgr.c
++++ b/sound/core/seq/seq_clientmgr.c
+@@ -2557,3 +2557,20 @@ void __exit snd_sequencer_device_done(vo
+ snd_unregister_device(&seq_dev);
+ put_device(&seq_dev);
+ }
++
++/* XXX kABI compatibility for SLE15 XXX */
++#undef snd_seq_kernel_client_enqueue
++int snd_seq_kernel_client_enqueue(int client, struct snd_seq_event *ev,
++ int atomic, int hop)
++{
++ return __snd_seq_kernel_client_enqueue(client, ev, NULL, false);
++}
++EXPORT_SYMBOL(snd_seq_kernel_client_enqueue);
++
++int snd_seq_kernel_client_enqueue_blocking(int client, struct snd_seq_event *ev,
++ struct file *file, int atomic,
++ int hop)
++{
++ return __snd_seq_kernel_client_enqueue(client, ev, file, true);
++}
++EXPORT_SYMBOL(snd_seq_kernel_client_enqueue_blocking);
diff --git a/patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch b/patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch
new file mode 100644
index 0000000000..7683027899
--- /dev/null
+++ b/patches.suse/0001-btrfs-Factor-out-common-delayed-refs-init-code.patch
@@ -0,0 +1,85 @@
+From cb49a87b2a4edb469e4d295eca4b1d106f64083e Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:17 +0300
+Git-commit: cb49a87b2a4edb469e4d295eca4b1d106f64083e
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 1/8] btrfs: Factor out common delayed refs init code
+
+THe majority of the init code for struct btrfs_delayed_ref_node is
+duplicated in add_delayed_data_ref and add_delayed_tree_ref. Factor out
+the common bits in init_delayed_ref_common. This function is going to be
+used in future patches to clean that up. No functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 51 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 51 insertions(+)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 4fb041e14742..a0dc255792c7 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -644,6 +644,57 @@ add_delayed_ref_head(struct btrfs_trans_handle *trans,
+ return head_ref;
+ }
+
++/*
++ * init_delayed_ref_common - Initialize the structure which represents a
++ * modification to a an extent.
++ *
++ * @fs_info: Internal to the mounted filesystem mount structure.
++ *
++ * @ref: The structure which is going to be initialized.
++ *
++ * @bytenr: The logical address of the extent for which a modification is
++ * going to be recorded.
++ *
++ * @num_bytes: Size of the extent whose modification is being recorded.
++ *
++ * @ref_root: The id of the root where this modification has originated, this
++ * can be either one of the well-known metadata trees or the
++ * subvolume id which references this extent.
++ *
++ * @action: Can be one of BTRFS_ADD_DELAYED_REF/BTRFS_DROP_DELAYED_REF or
++ * BTRFS_ADD_DELAYED_EXTENT
++ *
++ * @ref_type: Holds the type of the extent which is being recorded, can be
++ * one of BTRFS_SHARED_BLOCK_REF_KEY/BTRFS_TREE_BLOCK_REF_KEY
++ * when recording a metadata extent or BTRFS_SHARED_DATA_REF_KEY/
++ * BTRFS_EXTENT_DATA_REF_KEY when recording data extent
++ */
++static void init_delayed_ref_common(struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_node *ref,
++ u64 bytenr, u64 num_bytes, u64 ref_root,
++ int action, u8 ref_type)
++{
++ u64 seq = 0;
++
++ if (action == BTRFS_ADD_DELAYED_EXTENT)
++ action = BTRFS_ADD_DELAYED_REF;
++
++ if (is_fstree(ref_root))
++ seq = atomic64_read(&fs_info->tree_mod_seq);
++
++ refcount_set(&ref->refs, 1);
++ ref->bytenr = bytenr;
++ ref->num_bytes = num_bytes;
++ ref->ref_mod = 1;
++ ref->action = action;
++ ref->is_head = 0;
++ ref->in_tree = 1;
++ ref->seq = seq;
++ ref->type = ref_type;
++ RB_CLEAR_NODE(&ref->ref_node);
++ INIT_LIST_HEAD(&ref->add_list);
++}
++
+ /*
+ * helper to insert a delayed tree ref into the rbtree.
+ */
+--
+2.21.0
+
diff --git a/patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch b/patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch
new file mode 100644
index 0000000000..90af0de646
--- /dev/null
+++ b/patches.suse/0001-btrfs-add-a-helper-to-return-a-head-ref.patch
@@ -0,0 +1,86 @@
+From 2eadaa22c17ac3c546850f70d9d20fa19459dbce Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:52 -0400
+Git-commit: 2eadaa22c17ac3c546850f70d9d20fa19459dbce
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 1/7] btrfs: add a helper to return a head ref
+
+Simplify the error handling in __btrfs_run_delayed_refs by breaking out
+the code used to return a head back to the delayed_refs tree for
+processing into a helper function.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 29 ++++++++++++++---------------
+ 1 file changed, 14 insertions(+), 15 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 52d246994341..3e4a6a4b0505 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2575,6 +2575,16 @@ select_delayed_ref(struct btrfs_delayed_ref_head *head)
+ return ref;
+ }
+
++static void unselect_delayed_ref_head(struct btrfs_delayed_ref_root *delayed_refs,
++ struct btrfs_delayed_ref_head *head)
++{
++ spin_lock(&delayed_refs->lock);
++ head->processing = 0;
++ delayed_refs->num_heads_ready++;
++ spin_unlock(&delayed_refs->lock);
++ btrfs_delayed_ref_unlock(head);
++}
++
+ /*
+ * Returns 0 on success or if called with an already aborted transaction.
+ * Returns -ENOMEM or -EIO on failure and will abort the transaction.
+@@ -2648,11 +2658,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ if (ref && ref->seq &&
+ btrfs_check_delayed_seq(fs_info, delayed_refs, ref->seq)) {
+ spin_unlock(&locked_ref->lock);
+- spin_lock(&delayed_refs->lock);
+- locked_ref->processing = 0;
+- delayed_refs->num_heads_ready++;
+- spin_unlock(&delayed_refs->lock);
+- btrfs_delayed_ref_unlock(locked_ref);
++ unselect_delayed_ref_head(delayed_refs, locked_ref);
+ locked_ref = NULL;
+ cond_resched();
+ count++;
+@@ -2698,14 +2704,11 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ */
+ if (must_insert_reserved)
+ locked_ref->must_insert_reserved = 1;
+- spin_lock(&delayed_refs->lock);
+- locked_ref->processing = 0;
+- delayed_refs->num_heads_ready++;
+- spin_unlock(&delayed_refs->lock);
++ unselect_delayed_ref_head(delayed_refs,
++ locked_ref);
+ btrfs_debug(fs_info,
+ "run_delayed_extent_op returned %d",
+ ret);
+- btrfs_delayed_ref_unlock(locked_ref);
+ return ret;
+ }
+ continue;
+@@ -2763,11 +2766,7 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+
+ btrfs_free_delayed_extent_op(extent_op);
+ if (ret) {
+- spin_lock(&delayed_refs->lock);
+- locked_ref->processing = 0;
+- delayed_refs->num_heads_ready++;
+- spin_unlock(&delayed_refs->lock);
+- btrfs_delayed_ref_unlock(locked_ref);
++ unselect_delayed_ref_head(delayed_refs, locked_ref);
+ btrfs_put_delayed_ref(ref);
+ btrfs_debug(fs_info, "run_one_delayed_ref returned %d",
+ ret);
+--
+2.21.0
+
diff --git a/patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch b/patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch
new file mode 100644
index 0000000000..8ef20a6718
--- /dev/null
+++ b/patches.suse/0001-btrfs-delayed-ref-Introduce-better-documented-delaye.patch
@@ -0,0 +1,187 @@
+From b28b1f0ce44c1b9ebc1c43e3eba18c1f1f5d9cec Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Git-commit: b28b1f0ce44c1b9ebc1c43e3eba18c1f1f5d9cec
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Date: Thu, 4 Apr 2019 14:45:29 +0800
+Subject: [PATCH 1/9] btrfs: delayed-ref: Introduce better documented delayed
+ ref structures
+
+Current delayed ref interface has several problems:
+
+- Longer and longer parameter lists
+ bytenr
+ num_bytes
+ parent
+ ---------- so far so good
+ ref_root
+ owner
+ offset
+ ---------- I don't feel good now
+
+- Different interpretation of the same parameter
+
+ Above @owner for data ref is inode number (u64),
+ while for tree ref, it's level (int).
+
+ They are even in different size range.
+ For level we only need 0 ~ 8, while for ino it's
+ BTRFS_FIRST_FREE_OBJECTID ~ BTRFS_LAST_FREE_OBJECTID.
+
+ And @offset doesn't even make sense for tree ref.
+
+ Such parameter reuse may look clever as an hidden union, but it
+ destroys code readability.
+
+To solve both problems, we introduce a new structure, btrfs_ref to solve
+them:
+
+- Structure instead of long parameter list
+ This makes later expansion easier, and is better documented.
+
+- Use btrfs_ref::type to distinguish data and tree ref
+
+- Use proper union to store data/tree ref specific structures.
+
+- Use separate functions to fill data/tree ref data, with a common generic
+ function to fill common bytenr/num_bytes members.
+
+All parameters will find its place in btrfs_ref, and an extra member,
+@real_root, inspired by ref-verify code, is newly introduced for later
+qgroup code, to record which tree is triggered by this extent modification.
+
+This patch doesn't touch any code, but provides the basis for further
+refactoring.
+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.h | 109 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 109 insertions(+)
+
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -189,6 +189,83 @@ struct btrfs_delayed_ref_root {
+ u64 qgroup_to_skip;
+ };
+
++enum btrfs_ref_type {
++ BTRFS_REF_NOT_SET,
++ BTRFS_REF_DATA,
++ BTRFS_REF_METADATA,
++ BTRFS_REF_LAST,
++};
++
++struct btrfs_data_ref {
++ /* For EXTENT_DATA_REF */
++
++ /* Root which refers to this data extent */
++ u64 ref_root;
++
++ /* Inode which refers to this data extent */
++ u64 ino;
++
++ /*
++ * file_offset - extent_offset
++ *
++ * file_offset is the key.offset of the EXTENT_DATA key.
++ * extent_offset is btrfs_file_extent_offset() of the EXTENT_DATA data.
++ */
++ u64 offset;
++};
++
++struct btrfs_tree_ref {
++ /*
++ * Level of this tree block
++ *
++ * Shared for skinny (TREE_BLOCK_REF) and normal tree ref.
++ */
++ int level;
++
++ /*
++ * Root which refers to this tree block.
++ *
++ * For TREE_BLOCK_REF (skinny metadata, either inline or keyed)
++ */
++ u64 root;
++
++ /* For non-skinny metadata, no special member needed */
++};
++
++struct btrfs_ref {
++ enum btrfs_ref_type type;
++ int action;
++
++ /*
++ * Whether this extent should go through qgroup record.
++ *
++ * Normally false, but for certain cases like delayed subtree scan,
++ * setting this flag can hugely reduce qgroup overhead.
++ */
++ bool skip_qgroup;
++
++ /*
++ * Optional. For which root is this modification.
++ * Mostly used for qgroup optimization.
++ *
++ * When unset, data/tree ref init code will populate it.
++ * In certain cases, we're modifying reference for a different root.
++ * E.g. COW fs tree blocks for balance.
++ * In that case, tree_ref::root will be fs tree, but we're doing this
++ * for reloc tree, then we should set @real_root to reloc tree.
++ */
++ u64 real_root;
++ u64 bytenr;
++ u64 len;
++
++ /* Bytenr of the parent tree block */
++ u64 parent;
++ union {
++ struct btrfs_data_ref data_ref;
++ struct btrfs_tree_ref tree_ref;
++ };
++};
++
+ extern struct kmem_cache *btrfs_delayed_ref_head_cachep;
+ extern struct kmem_cache *btrfs_delayed_tree_ref_cachep;
+ extern struct kmem_cache *btrfs_delayed_data_ref_cachep;
+@@ -197,6 +274,38 @@ extern struct kmem_cache *btrfs_delayed_
+ int btrfs_delayed_ref_init(void);
+ void btrfs_delayed_ref_exit(void);
+
++static inline void btrfs_init_generic_ref(struct btrfs_ref *generic_ref,
++ int action, u64 bytenr, u64 len, u64 parent)
++{
++ generic_ref->action = action;
++ generic_ref->bytenr = bytenr;
++ generic_ref->len = len;
++ generic_ref->parent = parent;
++}
++
++static inline void btrfs_init_tree_ref(struct btrfs_ref *generic_ref,
++ int level, u64 root)
++{
++ /* If @real_root not set, use @root as fallback */
++ if (!generic_ref->real_root)
++ generic_ref->real_root = root;
++ generic_ref->tree_ref.level = level;
++ generic_ref->tree_ref.root = root;
++ generic_ref->type = BTRFS_REF_METADATA;
++}
++
++static inline void btrfs_init_data_ref(struct btrfs_ref *generic_ref,
++ u64 ref_root, u64 ino, u64 offset)
++{
++ /* If @real_root not set, use @root as fallback */
++ if (!generic_ref->real_root)
++ generic_ref->real_root = ref_root;
++ generic_ref->data_ref.ref_root = ref_root;
++ generic_ref->data_ref.ino = ino;
++ generic_ref->data_ref.offset = offset;
++ generic_ref->type = BTRFS_REF_DATA;
++}
++
+ static inline struct btrfs_delayed_extent_op *
+ btrfs_alloc_delayed_extent_op(void)
+ {
diff --git a/patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch b/patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch
new file mode 100644
index 0000000000..6eac1cfa99
--- /dev/null
+++ b/patches.suse/0001-btrfs-extent-tree-Fix-a-bug-that-btrfs-is-unable-to-.patch
@@ -0,0 +1,87 @@
+From 965fe8a6e29ede784cb38b97bb894aac1e8337a6 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 10 May 2019 12:45:05 +0800
+Patch-mainline: Submitted, 10 May 2019
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Subject: [PATCH] btrfs: extent-tree: Fix a bug that btrfs is unable to add
+ pinned bytes
+
+Commit ddf30cf03fb5 ("btrfs: extent-tree: Use btrfs_ref to refactor
+add_pinned_bytes()") refactored add_pinned_bytes(), but during that
+refactor, there are two callers which add the pinned bytes instead
+of subtracting.
+
+That refactor misses those two caller, causing incorrect pinned bytes
+calculation and resulting unexpected ENOSPC error.
+
+Fix it by refactoring add_pinned_bytes() to add_pinned_bytes() and
+sub_pinned_bytes() to explicitly show what we're doing.
+
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Fixes: ddf30cf03fb5 ("btrfs: extent-tree: Use btrfs_ref to refactor add_pinned_bytes()")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 36 ++++++++++++++++++++++++------------
+ 1 file changed, 24 insertions(+), 12 deletions(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -767,25 +767,37 @@ static struct btrfs_space_info *__find_s
+ return NULL;
+ }
+
++static u64 generic_ref_to_space_flags(struct btrfs_ref *ref)
++{
++ if (ref->type == BTRFS_REF_METADATA) {
++ if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID)
++ return BTRFS_BLOCK_GROUP_SYSTEM;
++ else
++ return BTRFS_BLOCK_GROUP_METADATA;
++ }
++ return BTRFS_BLOCK_GROUP_DATA;
++}
++
+ static void add_pinned_bytes(struct btrfs_fs_info *fs_info,
+ struct btrfs_ref *ref)
+ {
+ struct btrfs_space_info *space_info;
+- s64 num_bytes = -ref->len;
+- u64 flags;
++ u64 flags = generic_ref_to_space_flags(ref);
+
+- if (ref->type == BTRFS_REF_METADATA) {
+- if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID)
+- flags = BTRFS_BLOCK_GROUP_SYSTEM;
+- else
+- flags = BTRFS_BLOCK_GROUP_METADATA;
+- } else {
+- flags = BTRFS_BLOCK_GROUP_DATA;
+- }
++ space_info = __find_space_info(fs_info, flags);
++ ASSERT(space_info);
++ percpu_counter_add(&space_info->total_bytes_pinned, ref->len);
++}
++
++static void sub_pinned_bytes(struct btrfs_fs_info *fs_info,
++ struct btrfs_ref *ref)
++{
++ struct btrfs_space_info *space_info;
++ u64 flags = generic_ref_to_space_flags(ref);
+
+ space_info = __find_space_info(fs_info, flags);
+ ASSERT(space_info);
+- percpu_counter_add(&space_info->total_bytes_pinned, num_bytes);
++ percpu_counter_add(&space_info->total_bytes_pinned, -ref->len);
+ }
+
+ /*
+@@ -2129,7 +2141,7 @@ int btrfs_inc_extent_ref(struct btrfs_tr
+ &old_ref_mod, &new_ref_mod);
+
+ if (ret == 0 && old_ref_mod < 0 && new_ref_mod >= 0)
+- add_pinned_bytes(fs_info, generic_ref);
++ sub_pinned_bytes(fs_info, generic_ref);
+
+ return ret;
+ }
diff --git a/patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch b/patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch
new file mode 100644
index 0000000000..ff33d5ddc5
--- /dev/null
+++ b/patches.suse/0001-btrfs-track-refs-in-a-rb_tree-instead-of-a-list.patch
@@ -0,0 +1,404 @@
+From 0e0adbcfdc908684317c99a9bf5e13383f03b7ec Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Git-commit: 0e0adbcfdc908684317c99a9bf5e13383f03b7ec
+Patch-mainline: v4.15
+References: bsc#1134813
+Date: Thu, 19 Oct 2017 14:16:00 -0400
+Subject: [PATCH] btrfs: track refs in a rb_tree instead of a list
+
+If we get a significant amount of delayed refs for a single block (think
+modifying multiple snapshots) we can end up spending an ungodly amount
+of time looping through all of the entries trying to see if they can be
+merged. This is because we only add them to a list, so we have O(2n)
+for every ref head. This doesn't make any sense as we likely have refs
+for different roots, and so they cannot be merged. Tracking in a tree
+will allow us to break as soon as we hit an entry that doesn't match,
+making our worst case O(n).
+
+With this we can also merge entries more easily. Before we had to hope
+that matching refs were on the ends of our list, but with the tree we
+can search down to exact matches and merge them at insert time.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/backref.c | 5 +-
+ fs/btrfs/delayed-ref.c | 108 +++++++++++++++++++++--------------------
+ fs/btrfs/delayed-ref.h | 5 +-
+ fs/btrfs/disk-io.c | 10 ++--
+ fs/btrfs/extent-tree.c | 21 +++++---
+ 5 files changed, 82 insertions(+), 67 deletions(-)
+
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index 523d2dba7745..7d0dc100a09a 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -773,6 +773,7 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ struct btrfs_key key;
+ struct btrfs_key tmp_op_key;
+ struct btrfs_key *op_key = NULL;
++ struct rb_node *n;
+ int count;
+ int ret = 0;
+
+@@ -782,7 +783,9 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info,
+ }
+
+ spin_lock(&head->lock);
+- list_for_each_entry(node, &head->ref_list, list) {
++ for (n = rb_first(&head->ref_tree); n; n = rb_next(n)) {
++ node = rb_entry(n, struct btrfs_delayed_ref_node,
++ ref_node);
+ if (node->seq > seq)
+ continue;
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index 8c7d7db01f7a..83be8f9fd906 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -143,6 +143,34 @@ static struct btrfs_delayed_ref_head *htree_insert(struct rb_root *root,
+ return NULL;
+ }
+
++static struct btrfs_delayed_ref_node* tree_insert(struct rb_root *root,
++ struct btrfs_delayed_ref_node *ins)
++{
++ struct rb_node **p = &root->rb_node;
++ struct rb_node *node = &ins->ref_node;
++ struct rb_node *parent_node = NULL;
++ struct btrfs_delayed_ref_node *entry;
++
++ while (*p) {
++ int comp;
++
++ parent_node = *p;
++ entry = rb_entry(parent_node, struct btrfs_delayed_ref_node,
++ ref_node);
++ comp = comp_refs(ins, entry, true);
++ if (comp < 0)
++ p = &(*p)->rb_left;
++ else if (comp > 0)
++ p = &(*p)->rb_right;
++ else
++ return entry;
++ }
++
++ rb_link_node(node, parent_node, p);
++ rb_insert_color(node, root);
++ return NULL;
++}
++
+ /*
+ * find an head entry based on bytenr. This returns the delayed ref
+ * head if it was able to find one, or NULL if nothing was in that spot.
+@@ -212,7 +240,8 @@ static inline void drop_delayed_ref(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_node *ref)
+ {
+ assert_spin_locked(&head->lock);
+- list_del(&ref->list);
++ rb_erase(&ref->ref_node, &head->ref_tree);
++ RB_CLEAR_NODE(&ref->ref_node);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+ ref->in_tree = 0;
+@@ -229,24 +258,18 @@ static bool merge_ref(struct btrfs_trans_handle *trans,
+ u64 seq)
+ {
+ struct btrfs_delayed_ref_node *next;
++ struct rb_node *node = rb_next(&ref->ref_node);
+ bool done = false;
+
+- next = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node,
+- list);
+- while (!done && &next->list != &head->ref_list) {
++ while (!done && node) {
+ int mod;
+- struct btrfs_delayed_ref_node *next2;
+-
+- next2 = list_next_entry(next, list);
+-
+- if (next == ref)
+- goto next;
+
++ next = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
++ node = rb_next(node);
+ if (seq && next->seq >= seq)
+- goto next;
+-
++ break;
+ if (comp_refs(ref, next, false))
+- goto next;
++ break;
+
+ if (ref->action == next->action) {
+ mod = next->ref_mod;
+@@ -270,8 +293,6 @@ static bool merge_ref(struct btrfs_trans_handle *trans,
+ WARN_ON(ref->type == BTRFS_TREE_BLOCK_REF_KEY ||
+ ref->type == BTRFS_SHARED_BLOCK_REF_KEY);
+ }
+-next:
+- next = next2;
+ }
+
+ return done;
+@@ -283,11 +304,12 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+ struct btrfs_delayed_ref_head *head)
+ {
+ struct btrfs_delayed_ref_node *ref;
++ struct rb_node *node;
+ u64 seq = 0;
+
+ assert_spin_locked(&head->lock);
+
+- if (list_empty(&head->ref_list))
++ if (RB_EMPTY_ROOT(&head->ref_tree))
+ return;
+
+ /* We don't have too many refs to merge for data. */
+@@ -304,22 +326,13 @@ void btrfs_merge_delayed_refs(struct btrfs_trans_handle *trans,
+ }
+ spin_unlock(&fs_info->tree_mod_seq_lock);
+
+- ref = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node,
+- list);
+- while (&ref->list != &head->ref_list) {
++again:
++ for (node = rb_first(&head->ref_tree); node; node = rb_next(node)) {
++ ref = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
+ if (seq && ref->seq >= seq)
+- goto next;
+-
+- if (merge_ref(trans, delayed_refs, head, ref, seq)) {
+- if (list_empty(&head->ref_list))
+- break;
+- ref = list_first_entry(&head->ref_list,
+- struct btrfs_delayed_ref_node,
+- list);
+ continue;
+- }
+-next:
+- ref = list_next_entry(ref, list);
++ if (merge_ref(trans, delayed_refs, head, ref, seq))
++ goto again;
+ }
+ }
+
+@@ -402,25 +415,19 @@ btrfs_select_ref_head(struct btrfs_trans_handle *trans)
+ * Return 0 for insert.
+ * Return >0 for merge.
+ */
+-static int
+-add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+- struct btrfs_delayed_ref_root *root,
+- struct btrfs_delayed_ref_head *href,
+- struct btrfs_delayed_ref_node *ref)
++static int insert_delayed_ref(struct btrfs_trans_handle *trans,
++ struct btrfs_delayed_ref_root *root,
++ struct btrfs_delayed_ref_head *href,
++ struct btrfs_delayed_ref_node *ref)
+ {
+ struct btrfs_delayed_ref_node *exist;
+ int mod;
+ int ret = 0;
+
+ spin_lock(&href->lock);
+- /* Check whether we can merge the tail node with ref */
+- if (list_empty(&href->ref_list))
+- goto add_tail;
+- exist = list_entry(href->ref_list.prev, struct btrfs_delayed_ref_node,
+- list);
+- /* No need to compare bytenr nor is_head */
+- if (comp_refs(exist, ref, true))
+- goto add_tail;
++ exist = tree_insert(&href->ref_tree, ref);
++ if (!exist)
++ goto inserted;
+
+ /* Now we are sure we can merge */
+ ret = 1;
+@@ -451,9 +458,7 @@ add_delayed_ref_tail_merge(struct btrfs_trans_handle *trans,
+ drop_delayed_ref(trans, root, href, exist);
+ spin_unlock(&href->lock);
+ return ret;
+-
+-add_tail:
+- list_add_tail(&ref->list, &href->ref_list);
++inserted:
+ if (ref->action == BTRFS_ADD_DELAYED_REF)
+ list_add_tail(&ref->add_list, &href->ref_add_list);
+ atomic_inc(&root->num_entries);
+@@ -593,7 +598,7 @@ add_delayed_ref_head(struct btrfs_fs_info *fs_info,
+ head_ref->ref_mod = count_mod;
+ head_ref->must_insert_reserved = must_insert_reserved;
+ head_ref->is_data = is_data;
+- INIT_LIST_HEAD(&head_ref->ref_list);
++ head_ref->ref_tree = RB_ROOT;
+ INIT_LIST_HEAD(&head_ref->ref_add_list);
+ RB_CLEAR_NODE(&head_ref->href_node);
+ head_ref->processing = 0;
+@@ -685,7 +690,7 @@ add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ ref->is_head = 0;
+ ref->in_tree = 1;
+ ref->seq = seq;
+- INIT_LIST_HEAD(&ref->list);
++ RB_CLEAR_NODE(&ref->ref_node);
+ INIT_LIST_HEAD(&ref->add_list);
+
+ full_ref = btrfs_delayed_node_to_tree_ref(ref);
+@@ -699,7 +704,7 @@ add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+
+ trace_add_delayed_tree_ref(fs_info, ref, full_ref, action);
+
+- ret = add_delayed_ref_tail_merge(trans, delayed_refs, head_ref, ref);
++ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+
+ /*
+ * XXX: memory should be freed at the same level allocated.
+@@ -742,7 +747,7 @@ add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+ ref->is_head = 0;
+ ref->in_tree = 1;
+ ref->seq = seq;
+- INIT_LIST_HEAD(&ref->list);
++ RB_CLEAR_NODE(&ref->ref_node);
+ INIT_LIST_HEAD(&ref->add_list);
+
+ full_ref = btrfs_delayed_node_to_data_ref(ref);
+@@ -758,8 +763,7 @@ add_delayed_data_ref(struct btrfs_fs_info *fs_info,
+
+ trace_add_delayed_data_ref(fs_info, ref, full_ref, action);
+
+- ret = add_delayed_ref_tail_merge(trans, delayed_refs, head_ref, ref);
+-
++ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+ if (ret > 0)
+ kmem_cache_free(btrfs_delayed_data_ref_cachep, full_ref);
+ }
+diff --git a/fs/btrfs/delayed-ref.h b/fs/btrfs/delayed-ref.h
+index 1ce11858d727..a43af432f859 100644
+--- a/fs/btrfs/delayed-ref.h
++++ b/fs/btrfs/delayed-ref.h
+@@ -27,8 +27,7 @@
+ #define BTRFS_UPDATE_DELAYED_HEAD 4 /* not changing ref count on head ref */
+
+ struct btrfs_delayed_ref_node {
+- /*data/tree ref use list, stored in ref_head->ref_list. */
+- struct list_head list;
++ struct rb_node ref_node;
+ /*
+ * If action is BTRFS_ADD_DELAYED_REF, also link this node to
+ * ref_head->ref_add_list, then we do not need to iterate the
+@@ -92,7 +91,7 @@ struct btrfs_delayed_ref_head {
+ struct mutex mutex;
+
+ spinlock_t lock;
+- struct list_head ref_list;
++ struct rb_root ref_tree;
+ /* accumulate add BTRFS_ADD_DELAYED_REF nodes to this ref_add_list. */
+ struct list_head ref_add_list;
+
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index d1f396f72979..efce9a2fa9be 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4113,7 +4113,7 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+
+ while ((node = rb_first(&delayed_refs->href_root)) != NULL) {
+ struct btrfs_delayed_ref_head *head;
+- struct btrfs_delayed_ref_node *tmp;
++ struct rb_node *n;
+ bool pin_bytes = false;
+
+ head = rb_entry(node, struct btrfs_delayed_ref_head,
+@@ -4129,10 +4129,12 @@ static int btrfs_destroy_delayed_refs(struct btrfs_transaction *trans,
+ continue;
+ }
+ spin_lock(&head->lock);
+- list_for_each_entry_safe_reverse(ref, tmp, &head->ref_list,
+- list) {
++ while ((n = rb_first(&head->ref_tree)) != NULL) {
++ ref = rb_entry(n, struct btrfs_delayed_ref_node,
++ ref_node);
+ ref->in_tree = 0;
+- list_del(&ref->list);
++ rb_erase(&ref->ref_node, &head->ref_tree);
++ RB_CLEAR_NODE(&ref->ref_node);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+ atomic_dec(&delayed_refs->num_entries);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index fc9720e28005..673ac4e01dd0 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2519,7 +2519,7 @@ select_delayed_ref(struct btrfs_delayed_ref_head *head)
+ {
+ struct btrfs_delayed_ref_node *ref;
+
+- if (list_empty(&head->ref_list))
++ if (RB_EMPTY_ROOT(&head->ref_tree))
+ return NULL;
+
+ /*
+@@ -2532,8 +2532,8 @@ select_delayed_ref(struct btrfs_delayed_ref_head *head)
+ return list_first_entry(&head->ref_add_list,
+ struct btrfs_delayed_ref_node, add_list);
+
+- ref = list_first_entry(&head->ref_list, struct btrfs_delayed_ref_node,
+- list);
++ ref = rb_entry(rb_first(&head->ref_tree),
++ struct btrfs_delayed_ref_node, ref_node);
+ ASSERT(list_empty(&ref->add_list));
+ return ref;
+ }
+@@ -2593,7 +2593,7 @@ static int cleanup_ref_head(struct btrfs_trans_handle *trans,
+ spin_unlock(&head->lock);
+ spin_lock(&delayed_refs->lock);
+ spin_lock(&head->lock);
+- if (!list_empty(&head->ref_list) || head->extent_op) {
++ if (!RB_EMPTY_ROOT(&head->ref_tree) || head->extent_op) {
+ spin_unlock(&head->lock);
+ spin_unlock(&delayed_refs->lock);
+ return 1;
+@@ -2740,7 +2740,8 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+
+ actual_count++;
+ ref->in_tree = 0;
+- list_del(&ref->list);
++ rb_erase(&ref->ref_node, &locked_ref->ref_tree);
++ RB_CLEAR_NODE(&ref->ref_node);
+ if (!list_empty(&ref->add_list))
+ list_del(&ref->add_list);
+ /*
+@@ -3138,6 +3139,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ struct btrfs_delayed_data_ref *data_ref;
+ struct btrfs_delayed_ref_root *delayed_refs;
+ struct btrfs_transaction *cur_trans;
++ struct rb_node *node;
+ int ret = 0;
+
+ cur_trans = root->fs_info->running_transaction;
+@@ -3170,7 +3172,12 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
+ spin_unlock(&delayed_refs->lock);
+
+ spin_lock(&head->lock);
+- list_for_each_entry(ref, &head->ref_list, list) {
++ /*
++ * XXX: We should replace this with a proper search function in the
++ * future.
++ */
++ for (node = rb_first(&head->ref_tree); node; node = rb_next(node)) {
++ ref = rb_entry(node, struct btrfs_delayed_ref_node, ref_node);
+ /* If it's a shared ref we know a cross reference exists */
+ if (ref->type != BTRFS_EXTENT_DATA_REF_KEY) {
+ ret = 1;
+@@ -7141,7 +7148,7 @@ static noinline int check_ref_cleanup(struct btrfs_trans_handle *trans,
+ goto out_delayed_unlock;
+
+ spin_lock(&head->lock);
+- if (!list_empty(&head->ref_list))
++ if (!RB_EMPTY_ROOT(&head->ref_tree))
+ goto out;
+
+ if (head->extent_op) {
+--
+2.21.0
+
diff --git a/patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch b/patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch
new file mode 100644
index 0000000000..70f8444815
--- /dev/null
+++ b/patches.suse/0001-drm-ttm-Remove-warning-about-inconsistent-mapping-in.patch
@@ -0,0 +1,33 @@
+From d719a1ff8391101ba5cb0998943dfb3f77d47e7f Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Tue, 14 May 2019 12:37:31 +0200
+Subject: drm/ttm: Remove warning about inconsistent mapping information
+Patch-mainline: Never, local cleanup
+References: bnc#1131488
+
+Fixing the issue of bnc1131488 requires changing a significant amount
+of the fbdev emulation. As the problem is rather cosmetical, we drop
+the warning for now.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/ttm/ttm_bo_vm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+index 622dab6c4347..90a56c6724b5 100644
+--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
+@@ -284,8 +284,6 @@ static void ttm_bo_vm_open(struct vm_area_struct *vma)
+ struct ttm_buffer_object *bo =
+ (struct ttm_buffer_object *)vma->vm_private_data;
+
+- WARN_ON(bo->bdev->dev_mapping != vma->vm_file->f_mapping);
+-
+ ttm_bo_get(bo);
+ }
+
+--
+2.21.0
+
diff --git a/patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch b/patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch
new file mode 100644
index 0000000000..c03208f122
--- /dev/null
+++ b/patches.suse/0002-btrfs-Use-init_delayed_ref_common-in-add_delayed_tre.patch
@@ -0,0 +1,75 @@
+From 646f4dd76fb3ac0d1e8677890522d4c044ee2f06 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:18 +0300
+Git-commit: 646f4dd76fb3ac0d1e8677890522d4c044ee2f06
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 2/8] btrfs: Use init_delayed_ref_common in
+ add_delayed_tree_ref
+
+Use the newly introduced common helper. No functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 35 +++++++++++------------------------
+ 1 file changed, 11 insertions(+), 24 deletions(-)
+
+diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
+index a0dc255792c7..1c27d3322198 100644
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -708,38 +708,25 @@ add_delayed_tree_ref(struct btrfs_fs_info *fs_info,
+ {
+ struct btrfs_delayed_tree_ref *full_ref;
+ struct btrfs_delayed_ref_root *delayed_refs;
+- u64 seq = 0;
++ u8 ref_type;
+ int ret;
+
+- if (action == BTRFS_ADD_DELAYED_EXTENT)
+- action = BTRFS_ADD_DELAYED_REF;
+-
+- if (is_fstree(ref_root))
+- seq = atomic64_read(&fs_info->tree_mod_seq);
+ delayed_refs = &trans->transaction->delayed_refs;
+-
+- /* first set the basic ref node struct up */
+- refcount_set(&ref->refs, 1);
+- ref->bytenr = bytenr;
+- ref->num_bytes = num_bytes;
+- ref->ref_mod = 1;
+- ref->action = action;
+- ref->is_head = 0;
+- ref->in_tree = 1;
+- ref->seq = seq;
+- RB_CLEAR_NODE(&ref->ref_node);
+- INIT_LIST_HEAD(&ref->add_list);
+-
+ full_ref = btrfs_delayed_node_to_tree_ref(ref);
+- full_ref->parent = parent;
+- full_ref->root = ref_root;
+ if (parent)
+- ref->type = BTRFS_SHARED_BLOCK_REF_KEY;
++ ref_type = BTRFS_SHARED_BLOCK_REF_KEY;
+ else
+- ref->type = BTRFS_TREE_BLOCK_REF_KEY;
++ ref_type = BTRFS_TREE_BLOCK_REF_KEY;
++
++ init_delayed_ref_common(fs_info, ref, bytenr, num_bytes, ref_root,
++ action, ref_type);
++ full_ref->root = ref_root;
++ full_ref->parent = parent;
+ full_ref->level = level;
+
+- trace_add_delayed_tree_ref(fs_info, ref, full_ref, action);
++ trace_add_delayed_tree_ref(fs_info, ref, full_ref,
++ action == BTRFS_ADD_DELAYED_EXTENT ?
++ BTRFS_ADD_DELAYED_REF : action);
+
+ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+
+--
+2.21.0
+
diff --git a/patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch b/patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch
new file mode 100644
index 0000000000..b57a910b3b
--- /dev/null
+++ b/patches.suse/0002-btrfs-extent-tree-Open-code-process_func-in-__btrfs_.patch
@@ -0,0 +1,83 @@
+From dd28b6a5aad306c417477db700ed0848c923a31c Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Thu, 4 Apr 2019 14:45:30 +0800
+Git-commit: dd28b6a5aad306c417477db700ed0848c923a31c
+References: bsc#1063638 bsc#1128052 bsc#1108838
+Patch-mainline: v5.2-rc1
+Subject: [PATCH 2/9] btrfs: extent-tree: Open-code process_func in
+ __btrfs_mod_ref
+
+The process_func function pointer is local to __btrfs_mod_ref() and
+points to either btrfs_inc_extent_ref() or btrfs_free_extent().
+
+Open code it to make later delayed ref refactor easier, so we can
+refactor btrfs_inc_extent_ref() and btrfs_free_extent() in different
+patches.
+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 30 ++++++++++++++++--------------
+ 1 file changed, 16 insertions(+), 14 deletions(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3275,10 +3275,6 @@ static int __btrfs_mod_ref(struct btrfs_
+ int i;
+ int level;
+ int ret = 0;
+- int (*process_func)(struct btrfs_trans_handle *,
+- struct btrfs_fs_info *,
+- u64, u64, u64, u64, u64, u64);
+-
+
+ if (btrfs_is_testing(fs_info))
+ return 0;
+@@ -3290,11 +3286,6 @@ static int __btrfs_mod_ref(struct btrfs_
+ if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state) && level == 0)
+ return 0;
+
+- if (inc)
+- process_func = btrfs_inc_extent_ref;
+- else
+- process_func = btrfs_free_extent;
+-
+ if (full_backref)
+ parent = buf->start;
+ else
+@@ -3316,16 +3307,27 @@ static int __btrfs_mod_ref(struct btrfs_
+
+ num_bytes = btrfs_file_extent_disk_num_bytes(buf, fi);
+ key.offset -= btrfs_file_extent_offset(buf, fi);
+- ret = process_func(trans, fs_info, bytenr, num_bytes,
+- parent, ref_root, key.objectid,
+- key.offset);
++ if (inc)
++ ret = btrfs_inc_extent_ref(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ key.objectid, key.offset);
++ else
++ ret = btrfs_free_extent(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ key.objectid, key.offset);
+ if (ret)
+ goto fail;
+ } else {
+ bytenr = btrfs_node_blockptr(buf, i);
+ num_bytes = fs_info->nodesize;
+- ret = process_func(trans, fs_info, bytenr, num_bytes,
+- parent, ref_root, level - 1, 0);
++ if (inc)
++ ret = btrfs_inc_extent_ref(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ level - 1, 0);
++ else
++ ret = btrfs_free_extent(trans, fs_info, bytenr,
++ num_bytes, parent, ref_root,
++ level - 1, 0);
+ if (ret)
+ goto fail;
+ }
diff --git a/patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch b/patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch
new file mode 100644
index 0000000000..7595f806b4
--- /dev/null
+++ b/patches.suse/0002-btrfs-move-extent_op-cleanup-to-a-helper.patch
@@ -0,0 +1,130 @@
+From b00e62507ec6a9b63d9b3019795584e694085b65 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:53 -0400
+Git-commit: b00e62507ec6a9b63d9b3019795584e694085b65
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 2/7] btrfs: move extent_op cleanup to a helper
+
+Move the extent_op cleanup for an empty head ref to a helper function to
+help simplify __btrfs_run_delayed_refs.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 77 ++++++++++++++++++++++--------------------
+ 1 file changed, 40 insertions(+), 37 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 3e4a6a4b0505..e5ed90f20805 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2585,6 +2585,26 @@ static void unselect_delayed_ref_head(struct btrfs_delayed_ref_root *delayed_ref
+ btrfs_delayed_ref_unlock(head);
+ }
+
++static int cleanup_extent_op(struct btrfs_trans_handle *trans,
++ struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_head *head)
++{
++ struct btrfs_delayed_extent_op *extent_op = head->extent_op;
++ int ret;
++
++ if (!extent_op)
++ return 0;
++ head->extent_op = NULL;
++ if (head->must_insert_reserved) {
++ btrfs_free_delayed_extent_op(extent_op);
++ return 0;
++ }
++ spin_unlock(&head->lock);
++ ret = run_delayed_extent_op(trans, fs_info, &head->node, extent_op);
++ btrfs_free_delayed_extent_op(extent_op);
++ return ret ? ret : 1;
++}
++
+ /*
+ * Returns 0 on success or if called with an already aborted transaction.
+ * Returns -ENOMEM or -EIO on failure and will abort the transaction.
+@@ -2665,16 +2685,6 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ continue;
+ }
+
+- /*
+- * record the must insert reserved flag before we
+- * drop the spin lock.
+- */
+- must_insert_reserved = locked_ref->must_insert_reserved;
+- locked_ref->must_insert_reserved = 0;
+-
+- extent_op = locked_ref->extent_op;
+- locked_ref->extent_op = NULL;
+-
+ if (!ref) {
+
+
+@@ -2684,33 +2694,17 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ */
+ ref = &locked_ref->node;
+
+- if (extent_op && must_insert_reserved) {
+- btrfs_free_delayed_extent_op(extent_op);
+- extent_op = NULL;
+- }
+-
+- if (extent_op) {
+- spin_unlock(&locked_ref->lock);
+- ret = run_delayed_extent_op(trans, fs_info,
+- ref, extent_op);
+- btrfs_free_delayed_extent_op(extent_op);
+-
+- if (ret) {
+- /*
+- * Need to reset must_insert_reserved if
+- * there was an error so the abort stuff
+- * can cleanup the reserved space
+- * properly.
+- */
+- if (must_insert_reserved)
+- locked_ref->must_insert_reserved = 1;
+- unselect_delayed_ref_head(delayed_refs,
+- locked_ref);
+- btrfs_debug(fs_info,
+- "run_delayed_extent_op returned %d",
+- ret);
+- return ret;
+- }
++ ret = cleanup_extent_op(trans, fs_info, locked_ref);
++ if (ret < 0) {
++ unselect_delayed_ref_head(delayed_refs,
++ locked_ref);
++ btrfs_debug(fs_info,
++ "run_delayed_extent_op returned %d",
++ ret);
++ return ret;
++ } else if (ret > 0) {
++ /* We dropped our lock, we need to loop. */
++ ret = 0;
+ continue;
+ }
+
+@@ -2759,6 +2753,15 @@ static noinline int __btrfs_run_delayed_refs(struct btrfs_trans_handle *trans,
+ WARN_ON(1);
+ }
+ }
++ /*
++ * Record the must-insert_reserved flag before we drop the spin
++ * lock.
++ */
++ must_insert_reserved = locked_ref->must_insert_reserved;
++ locked_ref->must_insert_reserved = 0;
++
++ extent_op = locked_ref->extent_op;
++ locked_ref->extent_op = NULL;
+ spin_unlock(&locked_ref->lock);
+
+ ret = run_one_delayed_ref(trans, fs_info, ref, extent_op,
+--
+2.21.0
+
diff --git a/patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch b/patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch
new file mode 100644
index 0000000000..8396e83151
--- /dev/null
+++ b/patches.suse/0003-btrfs-Use-init_delayed_ref_common-in-add_delayed_dat.patch
@@ -0,0 +1,73 @@
+From c812c8a857a00acae78341d5d4702eb8d7d02661 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <nborisov@suse.com>
+Date: Tue, 24 Apr 2018 17:18:19 +0300
+Git-commit: c812c8a857a00acae78341d5d4702eb8d7d02661
+Patch-mainline: v4.18
+References: bsc#1134813
+Subject: [PATCH 3/8] btrfs: Use init_delayed_ref_common in
+ add_delayed_data_ref
+
+Use the newly introduced helper and remove the duplicate code. No
+functional changes.
+
+Signed-off-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/delayed-ref.c | 33 ++++++++++-----------------------
+ 1 file changed, 10 insertions(+), 23 deletions(-)
+
+--- a/fs/btrfs/delayed-ref.c
++++ b/fs/btrfs/delayed-ref.c
+@@ -768,41 +768,28 @@ add_delayed_data_ref(struct btrfs_fs_inf
+ {
+ struct btrfs_delayed_data_ref *full_ref;
+ struct btrfs_delayed_ref_root *delayed_refs;
+- u64 seq = 0;
++ u8 ref_type;
+ int ret;
+
+- if (action == BTRFS_ADD_DELAYED_EXTENT)
+- action = BTRFS_ADD_DELAYED_REF;
+-
+ delayed_refs = &trans->transaction->delayed_refs;
+
+- if (is_fstree(ref_root))
+- seq = atomic64_read(&fs_info->tree_mod_seq);
+-
+- /* first set the basic ref node struct up */
+- refcount_set(&ref->refs, 1);
+- ref->bytenr = bytenr;
+- ref->num_bytes = num_bytes;
+- ref->ref_mod = 1;
+- ref->action = action;
+- ref->is_head = 0;
+- ref->in_tree = 1;
+- ref->seq = seq;
+- RB_CLEAR_NODE(&ref->ref_node);
+- INIT_LIST_HEAD(&ref->add_list);
+
+ full_ref = btrfs_delayed_node_to_data_ref(ref);
+- full_ref->parent = parent;
+- full_ref->root = ref_root;
+ if (parent)
+- ref->type = BTRFS_SHARED_DATA_REF_KEY;
++ ref_type = BTRFS_SHARED_DATA_REF_KEY;
+ else
+- ref->type = BTRFS_EXTENT_DATA_REF_KEY;
++ ref_type = BTRFS_EXTENT_DATA_REF_KEY;
+
++ init_delayed_ref_common(fs_info, ref, bytenr, num_bytes,
++ ref_root, action, ref_type);
++ full_ref->root = ref_root;
++ full_ref->parent = parent;
+ full_ref->objectid = owner;
+ full_ref->offset = offset;
+
+- trace_add_delayed_data_ref(fs_info, ref, full_ref, action);
++ trace_add_delayed_data_ref(fs_info, ref, full_ref,
++ action == BTRFS_ADD_DELAYED_EXTENT ?
++ BTRFS_ADD_DELAYED_REF : action);
+
+ ret = insert_delayed_ref(trans, delayed_refs, head_ref, ref);
+ if (ret > 0)
diff --git a/patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch b/patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch
new file mode 100644
index 0000000000..006adddba8
--- /dev/null
+++ b/patches.suse/0003-btrfs-breakout-empty-head-cleanup-to-a-helper.patch
@@ -0,0 +1,124 @@
+From 194ab0bc21cc99c5b804040aa785e0bdcc214656 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Fri, 29 Sep 2017 15:43:54 -0400
+Git-commit: 194ab0bc21cc99c5b804040aa785e0bdcc214656
+Patch-mainline: 4.15
+References: bsc#1134813
+Subject: [PATCH 3/7] btrfs: breakout empty head cleanup to a helper
+
+Move this code out to a helper function to further simplivy
+__btrfs_run_delayed_refs.
+
+Signed-off-by: Josef Bacik <jbacik@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 79 ++++++++++++++++++++++++------------------
+ 1 file changed, 45 insertions(+), 34 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index e5ed90f20805..5e61e9287b0e 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -2605,6 +2605,43 @@ static int cleanup_extent_op(struct btrfs_trans_handle *trans,
+ return ret ? ret : 1;
+ }
+
++static int cleanup_ref_head(struct btrfs_trans_handle *trans,
++ struct btrfs_fs_info *fs_info,
++ struct btrfs_delayed_ref_head *head)
++{
++ struct btrfs_delayed_ref_root *delayed_refs;
++ int ret;
++
++ delayed_refs = &trans->transaction->delayed_refs;
++
++ ret = cleanup_extent_op(trans, fs_info, head);
++ if (ret < 0) {
++ unselect_delayed_ref_head(delayed_refs, head);
++ btrfs_debug(fs_info, "run_delayed_extent_op returned %d", ret);
++ return ret;
++ } else if (ret) {
++ return ret;
++ }
++
++ /*
++ * Need to drop our head ref lock and re-acquire the delayed ref lock
++ * and then re-check to make sure nobody got added.
++ */
++ spin_unlock(&head->lock);
++ spin_lock(&delayed_refs->lock);
++ spin_lock(&head->lock);
++ if (!list_empty(&head->ref_list) || head->extent_op) {
++ spin_unlock(&head->lock);
++ spin_unlock(&delayed_refs->lock);
++ return 1;
++ }
++ head->node.in_tree = 0;
++ delayed_refs->num_heads--;
++ rb_erase(&head->href_node, &delayed_refs->href_root);
++ spin_unlock(&delayed_refs->lock);
++ return 0;
++}
++
+ /*