Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOlaf Hering <ohering@suse.de>2018-10-31 16:54:42 +0100
committerOlaf Hering <ohering@suse.de>2018-10-31 16:54:42 +0100
commitc5aea2424ca0b2f08cfde4a2d30eefe45308195d (patch)
tree6d253ab20d002d6643c4586368a547aad72547dc
parentc90a85c46bb1353496184ad8f5a7bf78ab143fb2 (diff)
parent30da91a96dffbfdaa2b6ca793e47dc9355bf2fa7 (diff)
Merge remote-tracking branch 'kerncvs/SLE15' into SLE15-AZURE
-rw-r--r--blacklist.conf16
-rw-r--r--patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch39
-rw-r--r--patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch3
-rw-r--r--patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch3
-rw-r--r--patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch75
-rw-r--r--patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch3
-rw-r--r--patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch3
-rw-r--r--patches.arch/powerpc-pseries-Display-machine-check-error-details.patch3
-rw-r--r--patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch3
-rw-r--r--patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch102
-rw-r--r--patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch18
-rw-r--r--patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch3
-rw-r--r--patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch3
-rw-r--r--patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch3
-rw-r--r--patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch3
-rw-r--r--patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch3
-rw-r--r--patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch3
-rw-r--r--patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch92
-rw-r--r--patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch3
-rw-r--r--patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch5
-rw-r--r--patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch50
-rw-r--r--patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch38
-rw-r--r--patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch94
-rw-r--r--patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID3
-rw-r--r--patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch143
-rw-r--r--patches.drivers/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch43
-rw-r--r--patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch43
-rw-r--r--patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch53
-rw-r--r--patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch77
-rw-r--r--patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch3
-rw-r--r--patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch43
-rw-r--r--patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch43
-rw-r--r--patches.drivers/media-dvb-fix-compat-ioctl-translation.patch77
-rw-r--r--patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch43
-rw-r--r--patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch44
-rw-r--r--patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch69
-rw-r--r--patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch84
-rw-r--r--patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch43
-rw-r--r--patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch59
-rw-r--r--patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch41
-rw-r--r--patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch42
-rw-r--r--patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch56
-rw-r--r--patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch94
-rw-r--r--patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch43
-rw-r--r--patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch90
-rw-r--r--patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch39
-rw-r--r--patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch89
-rw-r--r--patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch45
-rw-r--r--patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch60
-rw-r--r--patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch152
-rw-r--r--patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch100
-rw-r--r--patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch3
-rw-r--r--patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch88
-rw-r--r--patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch41
-rw-r--r--patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch43
-rw-r--r--patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch90
-rw-r--r--patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch59
-rw-r--r--patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch56
-rw-r--r--patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch54
-rw-r--r--patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch54
-rw-r--r--patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch96
-rw-r--r--patches.fixes/0001-x86-boot-KASLR-Work-around-firmware-bugs-by-excludin.patch126
-rw-r--r--patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch104
-rw-r--r--patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch38
-rw-r--r--patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch2
-rw-r--r--patches.fixes/libnvdimm-dimm-maximize-label-transfer-size.patch71
-rw-r--r--patches.fixes/libnvdimm-label-change-nvdimm_num_label_slots-per-uefi-2-7.patch79
-rw-r--r--patches.fixes/libnvdimm-label-fix-sparse-warning.patch46
-rw-r--r--patches.fixes/nvdimm-clarify-comment-in-sizeof_namespace_index.patch40
-rw-r--r--patches.fixes/nvdimm-remove-empty-if-statement.patch38
-rw-r--r--patches.fixes/nvdimm-sanity-check-labeloff.patch36
-rw-r--r--patches.fixes/nvdimm-split-label-init-out-from-the-logic-for-getting-config-data.patch199
-rw-r--r--patches.fixes/nvdimm-use-namespace-index-data-to-reduce-number-of-label-reads-needed.patch181
-rw-r--r--patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch122
-rw-r--r--patches.suse/Revert-drm-nouveau-drm-therm-fan-add-a-fallback-if-n66
-rw-r--r--patches.suse/drm-i915-CFL-NVMe-breakage-workaround.patch50
-rw-r--r--patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch2
-rw-r--r--patches.suse/random-rate-limit-unseeded-randomness-warnings.patch89
-rw-r--r--patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch52
-rw-r--r--patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch57
-rw-r--r--patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch69
-rw-r--r--patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch45
-rw-r--r--patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch97
-rw-r--r--patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch81
-rw-r--r--patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch131
-rw-r--r--patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch38
-rw-r--r--patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch54
-rwxr-xr-xscripts/git_sort/git_sort.py3
-rwxr-xr-xscripts/series2git2
-rw-r--r--series.conf94
90 files changed, 4737 insertions, 148 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 6923bbe93e..4e1f3f276c 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -865,4 +865,18 @@ d3349b6b3c373ac1fbfb040b810fcee5e2adc7e0 # fixes WARN when machine runs OOM
a6795a585929d94ca3e931bc8518f8deb8bbe627 # vfs: reverted in below
f473bf92169633719acc3b43617c1dd20107770a # vfs: reverting (in stable-4.14.y)
fe782affd0f440a4e60e2cc81b8f2eccb2923113 # rpmsg: reverted in below
-13d216167d3d89d882b264857fe1d14c95da1490 # rpmsg: reverting (in stable-4.14.y) \ No newline at end of file
+13d216167d3d89d882b264857fe1d14c95da1490 # rpmsg: reverting (in stable-4.14.y)
+573e1784817ca1f13d76a0df636929e983e5de3c # Cleanup
+078d5039a13dedbd2ed14153a6d764fd75baae07 # Cleanup, kABI incompatible
+df16aaac26e92e97ab7234d3f93c953466adc4b5 # fix for clang
+ae6b289a37890909fea0e4a1666e19377fa0ed2c # fix for clang
+0e410e158e5baa1300bdf678cea4f4e0cf9d8b94 # fix for clang
+0a5f41767444cc3b4fc5573921ab914b4f78baaa # fix for clang
+87e0d4f0f37fb0c8c4aeeac46fff5e957738df79 # fix for clang
+b8fe1120b4ba342b4f156d24e952d6e686b20298 # typo fix
+747df19747bc9752cd40b9cce761e17a033aa5c2 # asoc: sta32x: need a prerequisite commit that breaks kABI
+d52e4d0c0c428bf2ba35074a7495cdb28e2efbae # usb: gadget: need a prerequisite commit that breaks kABI
+af424a410749ed7e0c2bffd3cedbc7c274d0ff6f # usb: dwc2: breaks kABI
+e7c52b84fb18f08ce49b6067ae6285aca79084a8 # kasan fix
+ad1a56f1bf2bd2394f98320baf9ad430f7b1534c # We don't carry the reverted patch.
+d60996ab430c8a6033a0944c068edc5ec5becb9b # Duplicate of 3af71f649d22f359790b4032446456a967a81742
diff --git a/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch b/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
index f44e20d285..52f00e430e 100644
--- a/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
+++ b/patches.arch/hotplug-cpu-Conditionally-acquire-release-DRC-index.patch
@@ -18,10 +18,10 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
1 file changed, 40 insertions(+), 31 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-index 83a551cfa575..47719274b21f 100644
+index 4d2328fb569d..b94d881eab7a 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
-@@ -434,7 +434,7 @@ static bool valid_cpu_drc_index(struct device_node *parent, u32 drc_index)
+@@ -432,7 +432,7 @@ static bool valid_cpu_drc_index(struct device_node *parent, u32 drc_index)
return found;
}
@@ -30,7 +30,7 @@ index 83a551cfa575..47719274b21f 100644
{
struct device_node *dn, *parent;
int rc, saved_rc;
-@@ -459,12 +459,14 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+@@ -457,19 +457,22 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
return -EINVAL;
}
@@ -51,17 +51,16 @@ index 83a551cfa575..47719274b21f 100644
}
dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
-@@ -472,7 +474,8 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
if (!dn) {
pr_warn("Failed call to configure-connector, drc index: %x\n",
drc_index);
- dlpar_release_drc(drc_index);
+ if (acquire_drc)
+ dlpar_release_drc(drc_index);
+ of_node_put(parent);
return -EINVAL;
}
-
-@@ -482,9 +485,11 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+@@ -484,9 +487,11 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
dn->name, rc, drc_index);
@@ -76,7 +75,7 @@ index 83a551cfa575..47719274b21f 100644
return saved_rc;
}
-@@ -496,7 +501,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+@@ -498,7 +503,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
dn->name, rc, drc_index);
rc = dlpar_detach_node(dn);
@@ -85,7 +84,7 @@ index 83a551cfa575..47719274b21f 100644
dlpar_release_drc(drc_index);
return saved_rc;
-@@ -564,7 +569,8 @@ static int dlpar_offline_cpu(struct device_node *dn)
+@@ -566,7 +571,8 @@ static int dlpar_offline_cpu(struct device_node *dn)
}
@@ -95,7 +94,7 @@ index 83a551cfa575..47719274b21f 100644
{
int rc;
-@@ -577,12 +583,14 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
+@@ -579,12 +585,14 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
return -EINVAL;
}
@@ -116,7 +115,7 @@ index 83a551cfa575..47719274b21f 100644
}
rc = dlpar_detach_node(dn);
-@@ -591,8 +599,9 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
+@@ -593,8 +601,9 @@ static ssize_t dlpar_cpu_remove(struct device_node *dn, u32 drc_index)
pr_warn("Failed to detach CPU %s, rc: %d", dn->name, rc);
@@ -128,7 +127,7 @@ index 83a551cfa575..47719274b21f 100644
dlpar_online_cpu(dn);
return saved_rc;
-@@ -620,7 +629,7 @@ static struct device_node *cpu_drc_index_to_dn(u32 drc_index)
+@@ -622,7 +631,7 @@ static struct device_node *cpu_drc_index_to_dn(u32 drc_index)
return dn;
}
@@ -137,7 +136,7 @@ index 83a551cfa575..47719274b21f 100644
{
struct device_node *dn;
int rc;
-@@ -632,7 +641,7 @@ static int dlpar_cpu_remove_by_index(u32 drc_index)
+@@ -634,7 +643,7 @@ static int dlpar_cpu_remove_by_index(u32 drc_index)
return -ENODEV;
}
@@ -146,7 +145,7 @@ index 83a551cfa575..47719274b21f 100644
of_node_put(dn);
return rc;
}
-@@ -697,7 +706,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
+@@ -699,7 +708,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
}
for (i = 0; i < cpus_to_remove; i++) {
@@ -155,7 +154,7 @@ index 83a551cfa575..47719274b21f 100644
if (rc)
break;
-@@ -708,7 +717,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
+@@ -710,7 +719,7 @@ static int dlpar_cpu_remove_by_count(u32 cpus_to_remove)
pr_warn("CPU hot-remove failed, adding back removed CPUs\n");
for (i = 0; i < cpus_removed; i++)
@@ -164,7 +163,7 @@ index 83a551cfa575..47719274b21f 100644
rc = -EINVAL;
} else {
-@@ -778,7 +787,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+@@ -780,7 +789,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
}
for (i = 0; i < cpus_to_add; i++) {
@@ -173,7 +172,7 @@ index 83a551cfa575..47719274b21f 100644
if (rc)
break;
-@@ -789,7 +798,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
+@@ -791,7 +800,7 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
pr_warn("CPU hot-add failed, removing any added CPUs\n");
for (i = 0; i < cpus_added; i++)
@@ -182,7 +181,7 @@ index 83a551cfa575..47719274b21f 100644
rc = -EINVAL;
} else {
-@@ -815,7 +824,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
+@@ -817,7 +826,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_COUNT)
rc = dlpar_cpu_remove_by_count(count);
else if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_INDEX)
@@ -191,7 +190,7 @@ index 83a551cfa575..47719274b21f 100644
else
rc = -EINVAL;
break;
-@@ -823,7 +832,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
+@@ -825,7 +834,7 @@ int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_COUNT)
rc = dlpar_cpu_add_by_count(count);
else if (hp_elog->id_type == PSERIES_HP_ELOG_ID_DRC_INDEX)
@@ -200,7 +199,7 @@ index 83a551cfa575..47719274b21f 100644
else
rc = -EINVAL;
break;
-@@ -848,7 +857,7 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+@@ -850,7 +859,7 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
if (rc)
return -EINVAL;
@@ -209,7 +208,7 @@ index 83a551cfa575..47719274b21f 100644
return rc ? rc : count;
}
-@@ -869,7 +878,7 @@ static ssize_t dlpar_cpu_release(const char *buf, size_t count)
+@@ -871,7 +880,7 @@ static ssize_t dlpar_cpu_release(const char *buf, size_t count)
return -EINVAL;
}
diff --git a/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch b/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch
index a94d40264e..b294221def 100644
--- a/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch
+++ b/patches.arch/powernv-pseries-consolidate-code-for-mce-early-handl.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:23 +0530
Subject: [PATCH 5/7] powernv/pseries: consolidate code for mce early handling.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: db7d31ac04133fc18893725d348fabf91d6e808e
Now that other platforms also implements real mode mce handler,
diff --git a/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch b/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
index 5c946b2014..2a99a71cb8 100644
--- a/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
+++ b/patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
@@ -5,8 +5,7 @@ Subject: [PATCH] powerpc/fadump: re-register firmware-assisted dump if already
registered
References: bsc#1108170, bsc#1108823
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 0823c68b054bca9dc321adea829af5cf36afb30b
Firmware-Assisted Dump (FADump) needs to be registered again after any
diff --git a/patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch b/patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch
new file mode 100644
index 0000000000..af103ba272
--- /dev/null
+++ b/patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch
@@ -0,0 +1,75 @@
+From 6fa504835d6969144b2bd3699684dd447c789ba2 Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Fri, 30 Mar 2018 17:34:08 +0530
+Subject: [PATCH] powerpc/mm/hugetlb: initialize the pagetable cache correctly
+ for hugetlb
+
+References: bsc#1091800
+Patch-mainline: v4.17-rc1
+Git-commit: 6fa504835d6969144b2bd3699684dd447c789ba2
+
+With 64k page size, we have hugetlb pte entries at the pmd and pud level for
+book3s64. We don't need to create a separate page table cache for that. With 4k
+we need to make sure hugepd page table cache for 16M is placed at PUD level
+and 16G at the PGD level.
+
+Simplify all these by not using HUGEPD_PD_SHIFT which is confusing for book3s64.
+
+Without this patch, with 64k page size we create pagetable caches with shift
+value 10 and 7 which are not used at all.
+
+Fixes: 419df06eea5b ("powerpc: Reduce the PTE_INDEX_SIZE")
+
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/hugetlbpage.c | 18 +++++++++++++-----
+ 1 file changed, 13 insertions(+), 5 deletions(-)
+
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index f4153f21d214..99cf86096970 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -122,9 +122,6 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp,
+ #if defined(CONFIG_PPC_FSL_BOOK3E) || defined(CONFIG_PPC_8xx)
+ #define HUGEPD_PGD_SHIFT PGDIR_SHIFT
+ #define HUGEPD_PUD_SHIFT PUD_SHIFT
+-#else
+-#define HUGEPD_PGD_SHIFT PUD_SHIFT
+-#define HUGEPD_PUD_SHIFT PMD_SHIFT
+ #endif
+
+ /*
+@@ -670,15 +667,26 @@ static int __init hugetlbpage_init(void)
+
+ shift = mmu_psize_to_shift(psize);
+
+- if (add_huge_page_size(1ULL << shift) < 0)
++#ifdef CONFIG_PPC_BOOK3S_64
++ if (shift > PGDIR_SHIFT)
+ continue;
+-
++ else if (shift > PUD_SHIFT)
++ pdshift = PGDIR_SHIFT;
++ else if (shift > PMD_SHIFT)
++ pdshift = PUD_SHIFT;
++ else
++ pdshift = PMD_SHIFT;
++#else
+ if (shift < HUGEPD_PUD_SHIFT)
+ pdshift = PMD_SHIFT;
+ else if (shift < HUGEPD_PGD_SHIFT)
+ pdshift = PUD_SHIFT;
+ else
+ pdshift = PGDIR_SHIFT;
++#endif
++
++ if (add_huge_page_size(1ULL << shift) < 0)
++ continue;
+ /*
+ * if we have pdshift and shift value same, we don't
+ * use pgt cache for hugepd.
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch b/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch
index 006175715c..b7279356fd 100644
--- a/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch
+++ b/patches.arch/powerpc-pseries-Define-MCE-error-event-section.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:56:52 +0530
Subject: [PATCH 1/7] powerpc/pseries: Define MCE error event section.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 04fce21c9db54695389200b50b0b7a7866232ba6
On pseries, the machine check error details are part of RTAS extended
diff --git a/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch b/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
index 084a642a56..7d4ae949f8 100644
--- a/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
+++ b/patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
@@ -4,8 +4,7 @@ Date: Mon, 17 Sep 2018 14:14:02 -0500
Subject: [PATCH] powerpc/pseries: Disable CPU hotplug across migrations
References: bsc#1065729
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 85a88cabad57d26d826dd94ea34d3a785824d802
When performing partition migrations all present CPUs must be online
diff --git a/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch b/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch
index de2b9ad5a7..3ca1ddcf23 100644
--- a/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch
+++ b/patches.arch/powerpc-pseries-Display-machine-check-error-details.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:07 +0530
Subject: [PATCH 3/7] powerpc/pseries: Display machine check error details.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 8f0b80561f217e3f379d7819a6c6b429bebdaea6
Extract the MCE error details from RTAS extended log and display it to
diff --git a/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch b/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch
index 3ccdbab62d..53eb8d2f51 100644
--- a/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch
+++ b/patches.arch/powerpc-pseries-Dump-the-SLB-contents-on-SLB-MCE-err.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:15 +0530
Subject: [PATCH 4/7] powerpc/pseries: Dump the SLB contents on SLB MCE errors.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: c6d15258cdf1c197cad7b11b9848e79068dd21e0
If we get a machine check exceptions due to SLB errors then dump the
diff --git a/patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch b/patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch
new file mode 100644
index 0000000000..9f4ac5ca9d
--- /dev/null
+++ b/patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch
@@ -0,0 +1,102 @@
+From 087ff6a5ae3052bb2835e191094b793789cb8817 Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Wed, 20 Sep 2017 17:02:51 -0400
+Subject: [PATCH] powerpc/pseries: Fix "OF: ERROR: Bad of_node_put() on /cpus"
+ during DLPAR
+
+References: FATE#326628, bsc#1113295
+Patch-mainline: v4.14-rc2
+Git-commit: 087ff6a5ae3052bb2835e191094b793789cb8817
+
+Commit 215ee763f8cb ("powerpc: pseries: remove dlpar_attach_node
+dependency on full path") reworked dlpar_attach_node() to no longer
+look up the parent node "/cpus", but instead to have the parent node
+passed by the caller in the function parameter list.
+
+As a result dlpar_attach_node() is no longer responsible for freeing
+the reference to the parent node. However, commit 215ee763f8cb failed
+to remove the of_node_put(parent) call in dlpar_attach_node(), or to
+take into account that the reference to the parent in the caller
+dlpar_cpu_add() needs to be held until after dlpar_attach_node()
+returns.
+
+As a result doing repeated cpu add/remove dlpar operations will
+eventually result in the following error:
+
+ OF: ERROR: Bad of_node_put() on /cpus
+ CPU: 0 PID: 10896 Comm: drmgr Not tainted 4.13.0-autotest #1
+ Call Trace:
+ dump_stack+0x15c/0x1f8 (unreliable)
+ of_node_release+0x1a4/0x1c0
+ kobject_put+0x1a8/0x310
+ kobject_del+0xbc/0xf0
+ __of_detach_node_sysfs+0x144/0x210
+ of_detach_node+0xf0/0x180
+ dlpar_detach_node+0xc4/0x120
+ dlpar_cpu_remove+0x280/0x560
+ dlpar_cpu_release+0xbc/0x1b0
+ arch_cpu_release+0x6c/0xb0
+ cpu_release_store+0xa0/0x100
+ dev_attr_store+0x68/0xa0
+ sysfs_kf_write+0xa8/0xf0
+ kernfs_fop_write+0x2cc/0x400
+ __vfs_write+0x5c/0x340
+ vfs_write+0x1a8/0x3d0
+ SyS_write+0xa8/0x1a0
+ system_call+0x58/0x6c
+
+Fix the issue by removing the of_node_put(parent) call from
+dlpar_attach_node(), and ensuring that the reference to the parent
+node is properly held and released by the caller dlpar_cpu_add().
+
+Fixes: 215ee763f8cb ("powerpc: pseries: remove dlpar_attach_node dependency on full path")
+Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
+[mpe: Add a comment in the code and frob the change log slightly]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 1 -
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 6 +++++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 783f36364690..e45b5f10645a 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -266,7 +266,6 @@ int dlpar_attach_node(struct device_node *dn, struct device_node *parent)
+ return rc;
+ }
+
+- of_node_put(dn->parent);
+ return 0;
+ }
+
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index fc0d8f97c03a..fadb95efbb9e 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -462,15 +462,19 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+ }
+
+ dn = dlpar_configure_connector(cpu_to_be32(drc_index), parent);
+- of_node_put(parent);
+ if (!dn) {
+ pr_warn("Failed call to configure-connector, drc index: %x\n",
+ drc_index);
+ dlpar_release_drc(drc_index);
++ of_node_put(parent);
+ return -EINVAL;
+ }
+
+ rc = dlpar_attach_node(dn, parent);
++
++ /* Regardless we are done with parent now */
++ of_node_put(parent);
++
+ if (rc) {
+ saved_rc = rc;
+ pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch b/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
index 1bbe857ab6..43cc459fc9 100644
--- a/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
+++ b/patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
@@ -1,9 +1,12 @@
+From b537ca6fede69a281dc524983e5e633d79a10a08 Mon Sep 17 00:00:00 2001
From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Date: Wed, 20 Sep 2017 17:02:52 -0400
-Subject: powerpc/pseries: Fix parent_dn reference leak in add_dt_node()
+Subject: [PATCH] powerpc/pseries: Fix parent_dn reference leak in
+ add_dt_node()
+
+References: bsc#1065729
Patch-mainline: v4.14-rc2
Git-commit: b537ca6fede69a281dc524983e5e633d79a10a08
-References: bsc#1065729
A reference to the parent device node is held by add_dt_node() for the
node to be added. If the call to dlpar_configure_connector() fails
@@ -18,12 +21,14 @@ Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
- arch/powerpc/platforms/pseries/mobility.c | 4 +++-
+ arch/powerpc/platforms/pseries/mobility.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 210ce632d63e..f7042ad492ba 100644
--- a/arch/powerpc/platforms/pseries/mobility.c
+++ b/arch/powerpc/platforms/pseries/mobility.c
-@@ -226,8 +226,10 @@ static int add_dt_node(__be32 parent_pha
+@@ -226,8 +226,10 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
return -ENOENT;
dn = dlpar_configure_connector(drc_index, parent_dn);
@@ -33,5 +38,8 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
return -ENOENT;
+ }
- rc = dlpar_attach_node(dn);
+ rc = dlpar_attach_node(dn, parent_dn);
if (rc)
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch b/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch
index 8ddb5fb9a0..1093397763 100644
--- a/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch
+++ b/patches.arch/powerpc-pseries-Flush-SLB-contents-on-SLB-MCE-errors.patch
@@ -4,8 +4,7 @@ Date: Tue, 11 Sep 2018 19:57:00 +0530
Subject: [PATCH 2/7] powerpc/pseries: Flush SLB contents on SLB MCE errors.
References: bsc#1094244
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: a43c1590426c44a5c6bbaf51b70a36a5c6d86914
On pseries, as of today system crashes if we get a machine check
diff --git a/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch b/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch
index 529537cb22..81f8d3c207 100644
--- a/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch
+++ b/patches.arch/powerpc-pseries-Remove-prrn_work-workqueue.patch
@@ -4,8 +4,7 @@ Date: Mon, 10 Sep 2018 09:57:00 -0500
Subject: [PATCH] powerpc/pseries: Remove prrn_work workqueue
References: bsc#1102495, bsc#1109337
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: cd24e457fd8b2d087d9236700c8d2957054598bf
When a PRRN event is received we are already running in a worker
diff --git a/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch b/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch
index d141db2d7c..d808551d1c 100644
--- a/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch
+++ b/patches.arch/powerpc-pseries-Remove-unneeded-uses-of-dlpar-work-q.patch
@@ -4,8 +4,7 @@ Date: Mon, 10 Sep 2018 09:57:07 -0500
Subject: [PATCH] powerpc/pseries: Remove unneeded uses of dlpar work queue
References: bsc#1102495, bsc#1109337
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: fd12527a1da42dcb906b694e01794e8d438f7d10
There are three instances in which dlpar hotplug events are invoked;
diff --git a/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch b/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
index c1ab0c648d..3f0fa36a97 100644
--- a/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
+++ b/patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
@@ -4,8 +4,7 @@ Date: Mon, 20 Aug 2018 16:29:34 +0200
Subject: [PATCH 3/5] powerpc/pseries/mm: Introducing FW_FEATURE_BLOCK_REMOVE
References: bsc#1109158
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 5600fbe340331e2a25d1b277f9c190f5c9948038
This feature tells if the hcall H_BLOCK_REMOVE is available.
diff --git a/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch b/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
index 1133c8175c..9563f702f4 100644
--- a/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
+++ b/patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
@@ -4,8 +4,7 @@ Date: Mon, 20 Aug 2018 16:29:36 +0200
Subject: [PATCH 5/5] powerpc/pseries/mm: call H_BLOCK_REMOVE
References: bsc#1109158
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: ba2dd8a26baa7e140555746d396e32952709c42d
This hypervisor's call allows to remove up to 8 ptes with only call to
diff --git a/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch b/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
index cfb7e8414f..3de8058920 100644
--- a/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
+++ b/patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
@@ -4,8 +4,7 @@ Date: Mon, 20 Aug 2018 16:29:35 +0200
Subject: [PATCH 4/5] powerpc/pseries/mm: factorize PTE slot computation
References: bsc#1109158
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: 0effa488dc1ad082ceed44b5d38c29fd8b3f259e
This part of code will be called also when dealing with H_BLOCK_REMOVE.
diff --git a/patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch b/patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch
new file mode 100644
index 0000000000..554672f938
--- /dev/null
+++ b/patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch
@@ -0,0 +1,92 @@
+From 215ee763f8cb9a2912d411f96f6f67a35d644c6b Mon Sep 17 00:00:00 2001
+From: Rob Herring <robh@kernel.org>
+Date: Mon, 21 Aug 2017 10:16:49 -0500
+Subject: [PATCH] powerpc: pseries: remove dlpar_attach_node dependency on full
+ path
+
+References: FATE#326628, bsc#1113295
+Patch-mainline: v4.14-rc1
+Git-commit: 215ee763f8cb9a2912d411f96f6f67a35d644c6b
+
+In preparation to stop storing the full node path in full_name, remove the
+dependency on full_name from dlpar_attach_node(). Callers of
+dlpar_attach_node() already have the parent device_node, so just pass the
+parent node into dlpar_attach_node instead of the path. This avoids doing
+a lookup of the parent node by the path.
+
+Signed-off-by: Rob Herring <robh@kernel.org>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Cc: linuxppc-dev@lists.ozlabs.org
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/platforms/pseries/dlpar.c | 6 ++----
+ arch/powerpc/platforms/pseries/hotplug-cpu.c | 2 +-
+ arch/powerpc/platforms/pseries/mobility.c | 2 +-
+ arch/powerpc/platforms/pseries/pseries.h | 2 +-
+ 4 files changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 80b84c9c8509..783f36364690 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -254,13 +254,11 @@ struct device_node *dlpar_configure_connector(__be32 drc_index,
+ return first_dn;
+ }
+
+-int dlpar_attach_node(struct device_node *dn)
++int dlpar_attach_node(struct device_node *dn, struct device_node *parent)
+ {
+ int rc;
+
+- dn->parent = pseries_of_derive_parent(dn->full_name);
+- if (IS_ERR(dn->parent))
+- return PTR_ERR(dn->parent);
++ dn->parent = parent;
+
+ rc = of_attach_node(dn);
+ if (rc) {
+diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+index 0a93093fbcef..b357f1ae0b0a 100644
+--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
++++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
+@@ -463,7 +463,7 @@ static ssize_t dlpar_cpu_add(u32 drc_index)
+ return -EINVAL;
+ }
+
+- rc = dlpar_attach_node(dn);
++ rc = dlpar_attach_node(dn, parent);
+ if (rc) {
+ saved_rc = rc;
+ pr_warn("Failed to attach node %s, rc: %d, drc index: %x\n",
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index 2da4851eff99..210ce632d63e 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -229,7 +229,7 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ if (!dn)
+ return -ENOENT;
+
+- rc = dlpar_attach_node(dn);
++ rc = dlpar_attach_node(dn, parent_dn);
+ if (rc)
+ dlpar_free_cc_nodes(dn);
+
+diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h
+index 1361a9db534b..4470a3194311 100644
+--- a/arch/powerpc/platforms/pseries/pseries.h
++++ b/arch/powerpc/platforms/pseries/pseries.h
+@@ -46,7 +46,7 @@ extern void dlpar_free_cc_nodes(struct device_node *);
+ extern void dlpar_free_cc_property(struct property *);
+ extern struct device_node *dlpar_configure_connector(__be32,
+ struct device_node *);
+-extern int dlpar_attach_node(struct device_node *);
++extern int dlpar_attach_node(struct device_node *, struct device_node *);
+ extern int dlpar_detach_node(struct device_node *);
+ extern int dlpar_acquire_drc(u32 drc_index);
+ extern int dlpar_release_drc(u32 drc_index);
+--
+2.13.7
+
diff --git a/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch b/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
index 4d98c5c893..562f500352 100644
--- a/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
+++ b/patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
@@ -5,8 +5,7 @@ Subject: [PATCH] powerpc/rtas: Fix a potential race between CPU-Offline &
Migration
References: bsc#1111870
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v4.20-rc1
Git-commit: dfd718a2ed1f678e66749ffe41bdeafedf3f4314
Live Partition Migrations require all the present CPUs to execute the
diff --git a/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch b/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
index 61676d0cfe..6dc3669036 100644
--- a/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
+++ b/patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
@@ -1,9 +1,8 @@
From: "Cho, Yu-Chen" <acho@suse.com>
Date: Tue, 2 Oct 2018 17:57:04 +0800
Subject: [PATCH] Bluetooth: btsdio: Do not bind to non-removable BCM43430
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
-Git-commit: 3c89f14043962fec1f3197e8b25a70cc0493ea3e
+Patch-mainline: v4.20-rc1
+Git-commit: 70ecdd3d8b36cd2bb960bc4e7ae047fbb94c031b
References: bsc#1103587
BCM43430 devices soldered onto the PCB (non-removable)
diff --git a/patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch b/patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch
new file mode 100644
index 0000000000..ad6ceeecf1
--- /dev/null
+++ b/patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch
@@ -0,0 +1,50 @@
+From 5bf59773aaf36dd62117dc83d50e1bbf9ef432da Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:52 +0200
+Subject: [PATCH] NFC: nfcmrvl_uart: fix OF child-node lookup
+Git-commit: 5bf59773aaf36dd62117dc83d50e1bbf9ef432da
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Use the new of_get_compatible_child() helper to lookup the nfc child
+node instead of using of_find_compatible_node(), which searches the
+entire tree from a given start node and thus can return an unrelated
+(i.e. non-child) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the parent node).
+
+Fixes: e097dc624f78 ("NFC: nfcmrvl: add UART driver")
+Fixes: d8e018c0b321 ("NFC: nfcmrvl: update device tree bindings for Marvell NFC")
+Cc: stable <stable@vger.kernel.org> # 4.2
+Cc: Vincent Cuissard <cuissard@marvell.com>
+Cc: Samuel Ortiz <sameo@linux.intel.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/nfc/nfcmrvl/uart.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c
+index 91162f8e0366..9a22056e8d9e 100644
+--- a/drivers/nfc/nfcmrvl/uart.c
++++ b/drivers/nfc/nfcmrvl/uart.c
+@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node,
+ struct device_node *matched_node;
+ int ret;
+
+- matched_node = of_find_compatible_node(node, NULL, "marvell,nfc-uart");
++ matched_node = of_get_compatible_child(node, "marvell,nfc-uart");
+ if (!matched_node) {
+- matched_node = of_find_compatible_node(node, NULL,
+- "mrvl,nfc-uart");
++ matched_node = of_get_compatible_child(node, "mrvl,nfc-uart");
+ if (!matched_node)
+ return -ENODEV;
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch b/patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
new file mode 100644
index 0000000000..6d4f1aae7d
--- /dev/null
+++ b/patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
@@ -0,0 +1,38 @@
+From 56445eef55cb5904096fed7a73cf87b755dfffc7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Sun, 30 Sep 2018 18:03:11 +0200
+Subject: [PATCH] USB: serial: cypress_m8: fix interrupt-out transfer length
+Git-commit: 56445eef55cb5904096fed7a73cf87b755dfffc7
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Fix interrupt-out transfer length which was being set to the
+transfer-buffer length rather than the size of the outgoing packet.
+
+Note that no slab data was leaked as the whole transfer buffer is always
+cleared before each transfer.
+
+Fixes: 9aa8dae7b1fa ("cypress_m8: use usb_fill_int_urb where appropriate")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/cypress_m8.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index 31c6091be46a..5aaab8f4dd8f 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -769,7 +769,7 @@ static void cypress_send(struct usb_serial_port *port)
+
+ usb_fill_int_urb(port->interrupt_out_urb, port->serial->dev,
+ usb_sndintpipe(port->serial->dev, port->interrupt_out_endpointAddress),
+- port->interrupt_out_buffer, port->interrupt_out_size,
++ port->interrupt_out_buffer, actual_size,
+ cypress_write_int_callback, port, priv->write_urb_interval);
+ result = usb_submit_urb(port->interrupt_out_urb, GFP_ATOMIC);
+ if (result) {
+--
+2.19.1
+
diff --git a/patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch b/patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch
new file mode 100644
index 0000000000..5276d6b3c1
--- /dev/null
+++ b/patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch
@@ -0,0 +1,94 @@
+From 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 3 Oct 2018 17:49:51 +0300
+Subject: [PATCH] drm/i915: Restore vblank interrupts earlier
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 7cada4d0b7a0fb813dbc9777fec092e9ed0546e9
+Patch-mainline: v4.20-rc1
+No-fix: 68bc30deac625b8be8d3950b30dc93d09a3645f5
+References: bsc#1051510
+
+Plane sanitation needs vblank interrupts (on account of CxSR disable).
+So let's restore vblank interrupts earlier.
+
+V2: Make it actually build
+V3: Add comment to explain why we need this (Daniel)
+
+Cc: stable@vger.kernel.org
+Cc: Dennis <dennis.nezic@utoronto.ca>
+Tested-by: Dennis <dennis.nezic@utoronto.ca>
+Tested-by: Peter Nowee <peter.nowee@gmail.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105637
+Fixes: b1e01595a66d ("drm/i915: Redo plane sanitation during readout")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181003144951.4397-1-ville.syrjala@linux.intel.com
+(cherry picked from commit 68bc30deac625b8be8d3950b30dc93d09a3645f5)
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index aa6e79dfd571..ce23b0546407 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -15526,13 +15526,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc,
+ I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK);
+ }
+
+- /* restore vblank interrupts to correct state */
+- drm_crtc_vblank_reset(&crtc->base);
+ if (crtc->active) {
+ struct intel_plane *plane;
+
+- drm_crtc_vblank_on(&crtc->base);
+-
+ /* Disable everything but the primary plane */
+ for_each_intel_plane_on_crtc(dev, crtc, plane) {
+ const struct intel_plane_state *plane_state =
+@@ -15874,7 +15870,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ struct drm_modeset_acquire_ctx *ctx)
+ {
+ struct drm_i915_private *dev_priv = to_i915(dev);
+- enum pipe pipe;
+ struct intel_crtc *crtc;
+ struct intel_encoder *encoder;
+ int i;
+@@ -15887,15 +15882,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev,
+ /* HW state is read out, now we need to sanitize this mess. */
+ get_encoder_power_domains(dev_priv);
+
+- intel_sanitize_plane_mapping(dev_priv);
++ /*
++ * intel_sanitize_plane_mapping() may need to do vblank
++ * waits, so we need vblank interrupts restored beforehand.
++ */
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
++ drm_crtc_vblank_reset(&crtc->base);
+
+- for_each_intel_encoder(dev, encoder) {
+- intel_sanitize_encoder(encoder);
++ if (crtc->active)
++ drm_crtc_vblank_on(&crtc->base);
+ }
+
+- for_each_pipe(dev_priv, pipe) {
+- crtc = intel_get_crtc_for_pipe(dev_priv, pipe);
++ intel_sanitize_plane_mapping(dev_priv);
+
++ for_each_intel_encoder(dev, encoder)
++ intel_sanitize_encoder(encoder);
++
++ for_each_intel_crtc(&dev_priv->drm, crtc) {
+ intel_sanitize_crtc(crtc, ctx);
+ intel_dump_pipe_config(crtc, crtc->config,
+ "[setup_hw_state]");
+--
+2.19.1
+
diff --git a/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID b/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
index 3cb898d43a..e5987270e9 100644
--- a/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
+++ b/patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
@@ -6,8 +6,7 @@ Mime-version: 1.0
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
Git-commit: d0e062ebb3a44b56a7e672da568334c76f763552
-Git-repo: git://anongit.freedesktop.org/drm-intel
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v4.20-rc1
References: FATE#322643
One more CFL ID added to spec.
diff --git a/patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch b/patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch
new file mode 100644
index 0000000000..2d19f28cdf
--- /dev/null
+++ b/patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch
@@ -0,0 +1,143 @@
+From 041444458835d7fb2c9f042598bfe16bf375b15d Mon Sep 17 00:00:00 2001
+From: Manasi Navare <manasi.d.navare@intel.com>
+Date: Tue, 9 Oct 2018 14:28:04 -0700
+Subject: [PATCH] drm/i915/dp: Link train Fallback on eDP only if fallback link BW can fit panel's native mode
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 041444458835d7fb2c9f042598bfe16bf375b15d
+Patch-mainline: v4.20-rc1
+No-fix: 1e712535c51ab025ebc776d4405683d81521996d
+References: bsc#1051510
+
+This patch fixes the original commit c0cfb10d9e1de49 ("drm/i915/edp:
+Do not do link training fallback or prune modes on EDP") that causes
+a blank screen in case of certain eDP panels (Eg: seen on Dell XPS13 9350)
+where first link training fails and a retraining is required by falling
+back to lower link rate/lane count.
+In case of some panels they advertise higher link rate/lane count
+than whats required for supporting the panel's native mode.
+But we always link train at highest link rate/lane count for eDP
+and if that fails we can still fallback to lower link rate/lane count
+as long as the fallback link BW still fits the native mode to avoid
+pruning the panel's native mode yet retraining at fallback values
+to recover from a blank screen.
+
+V3:
+* Add const for fixed_mode (Ville)
+V2:
+* Send uevent if link failure on eDP unconditionally
+
+Fixes: c0cfb10d9e1d ("drm/i915/edp: Do not do link training fallback or prune modes on EDP")
+Cc: Clinton Taylor <clinton.a.taylor@intel.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Lucas De Marchi <lucas.demarchi@intel.com>
+Cc: <stable@vger.kernel.org> # v4.17+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107489
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105338
+Signed-off-by: Manasi Navare <manasi.d.navare@intel.com>
+Tested-by: Alexander Wilson <alexander.wilson@ncf.edu>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181009212804.702-1-manasi.d.navare@intel.com
+(cherry picked from commit 1e712535c51ab025ebc776d4405683d81521996d)
+
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 30 +++++++++++++++++++
+ drivers/gpu/drm/i915/intel_dp_link_training.c | 26 ++++++----------
+ 2 files changed, 39 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
+index 6b4c19123f2a..06e91d7b6d8e 100644
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -557,6 +557,22 @@ static bool intel_dp_link_params_valid(struct intel_dp *intel_dp, int link_rate,
+ return true;
+ }
+
++static bool intel_dp_can_link_train_fallback_for_edp(struct intel_dp *intel_dp,
++ int link_rate,
++ uint8_t lane_count)
++{
++ const struct drm_display_mode *fixed_mode =
++ intel_dp->attached_connector->panel.fixed_mode;
++ int mode_rate, max_rate;
++
++ mode_rate = intel_dp_link_required(fixed_mode->clock, 18);
++ max_rate = intel_dp_max_data_rate(link_rate, lane_count);
++ if (mode_rate > max_rate)
++ return false;
++
++ return true;
++}
++
+ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ int link_rate, uint8_t lane_count)
+ {
+@@ -566,9 +582,23 @@ int intel_dp_get_link_train_fallback_values(struct intel_dp *intel_dp,
+ intel_dp->num_common_rates,
+ link_rate);
+ if (index > 0) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp->common_rates[index - 1],
++ lane_count)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp->common_rates[index - 1];
+ intel_dp->max_link_lane_count = lane_count;
+ } else if (lane_count > 1) {
++ if (intel_dp_is_edp(intel_dp) &&
++ !intel_dp_can_link_train_fallback_for_edp(intel_dp,
++ intel_dp_max_common_rate(intel_dp),
++ lane_count >> 1)) {
++ DRM_DEBUG_KMS("Retrying Link training for eDP with same parameters\n");
++ return 0;
++ }
+ intel_dp->max_link_rate = intel_dp_max_common_rate(intel_dp);
+ intel_dp->max_link_lane_count = lane_count >> 1;
+ } else {
+diff --git a/drivers/gpu/drm/i915/intel_dp_link_training.c b/drivers/gpu/drm/i915/intel_dp_link_training.c
+index a9f40985a621..30be0e39bd5f 100644
+--- a/drivers/gpu/drm/i915/intel_dp_link_training.c
++++ b/drivers/gpu/drm/i915/intel_dp_link_training.c
+@@ -367,22 +367,14 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
+ return;
+
+ failure_handling:
+- /* Dont fallback and prune modes if its eDP */
+- if (!intel_dp_is_edp(intel_dp)) {
+- DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- if (!intel_dp_get_link_train_fallback_values(intel_dp,
+- intel_dp->link_rate,
+- intel_dp->lane_count))
+- /* Schedule a Hotplug Uevent to userspace to start modeset */
+- schedule_work(&intel_connector->modeset_retry_work);
+- } else {
+- DRM_ERROR("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
+- intel_connector->base.base.id,
+- intel_connector->base.name,
+- intel_dp->link_rate, intel_dp->lane_count);
+- }
++ DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Link Training failed at link rate = %d, lane count = %d",
++ intel_connector->base.base.id,
++ intel_connector->base.name,
++ intel_dp->link_rate, intel_dp->lane_count);
++ if (!intel_dp_get_link_train_fallback_values(intel_dp,
++ intel_dp->link_rate,
++ intel_dp->lane_count))
++ /* Schedule a Hotplug Uevent to userspace to start modeset */
++ schedule_work(&intel_connector->modeset_retry_work);
+ return;
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch b/patches.drivers/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch
new file mode 100644
index 0000000000..94aa215f9b
--- /dev/null
+++ b/patches.drivers/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch
@@ -0,0 +1,43 @@
+From 3639c381cdf5fa4340cbc2c7f34e2b526a6f6a6b Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 31 Aug 2018 12:03:28 +0200
+Subject: [PATCH] drm/nouveau: Don't disable polling in fallback mode
+Patch-mainline: Submitted, dri-devel ML
+References: bsc#1103356
+
+When a fan is controlled via linear fallback without cstate, we
+shouldn't stop polling. Otherwise it won't be adjusted again and
+keeps running at an initial crazy pace.
+
+Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1103356
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107447
+Reported-by: Thomas Blume <thomas.blume@suse.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+index 3695cde669f8..07914e36939e 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
+@@ -132,11 +132,12 @@ nvkm_therm_update(struct nvkm_therm *therm, int mode)
+ duty = nvkm_therm_update_linear(therm);
+ break;
+ case NVBIOS_THERM_FAN_OTHER:
+- if (therm->cstate)
++ if (therm->cstate) {
+ duty = therm->cstate;
+- else
++ poll = false;
++ } else {
+ duty = nvkm_therm_update_linear_fallback(therm);
+- poll = false;
++ }
+ break;
+ }
+ immd = false;
+--
+2.18.0
+
diff --git a/patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch b/patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch
new file mode 100644
index 0000000000..fff8d10340
--- /dev/null
+++ b/patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch
@@ -0,0 +1,43 @@
+From bc1b45326223e7e890053cf6266357adfa61942d Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 24 Sep 2018 10:51:43 +0300
+Subject: [PATCH] iio: adc: at91: fix acking DRDY irq on simple conversions
+Git-commit: bc1b45326223e7e890053cf6266357adfa61942d
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+When doing simple conversions, the driver did not acknowledge the DRDY irq.
+If this irq status is not acked, it will be left pending, and as soon as a
+trigger is enabled, the irq handler will be called, it doesn't know why
+this status has occurred because no channel is pending, and then it will go
+int a irq loop and board will hang.
+To avoid this situation, read the LCDR after a raw conversion is done.
+
+Fixes: 0e589d5fb ("ARM: AT91: IIO: Add AT91 ADC driver.")
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/at91_adc.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 44b516863c9d..e3be88e7192c 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -279,6 +279,8 @@ static void handle_adc_eoc_trigger(int irq, struct iio_dev *idev)
+ iio_trigger_poll(idev->trig);
+ } else {
+ st->last_value = at91_adc_readl(st, AT91_ADC_CHAN(st, st->chnb));
++ /* Needed to ACK the DRDY interruption */
++ at91_adc_readl(st, AT91_ADC_LCDR);
+ st->done = true;
+ wake_up_interruptible(&st->wq_data_avail);
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch b/patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch
new file mode 100644
index 0000000000..090581119c
--- /dev/null
+++ b/patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch
@@ -0,0 +1,53 @@
+From aea835f2dc8a682942b859179c49ad1841a6c8b9 Mon Sep 17 00:00:00 2001
+From: Eugen Hristev <eugen.hristev@microchip.com>
+Date: Mon, 24 Sep 2018 10:51:44 +0300
+Subject: [PATCH] iio: adc: at91: fix wrong channel number in triggered buffer mode
+Git-commit: aea835f2dc8a682942b859179c49ad1841a6c8b9
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+When channels are registered, the hardware channel number is not the
+actual iio channel number.
+This is because the driver is probed with a certain number of accessible
+channels. Some pins are routed and some not, depending on the description of
+the board in the DT.
+Because of that, channels 0,1,2,3 can correspond to hardware channels
+2,3,4,5 for example.
+In the buffered triggered case, we need to do the translation accordingly.
+Fixed the channel number to stop reading the wrong channel.
+
+Fixes: 0e589d5fb ("ARM: AT91: IIO: Add AT91 ADC driver.")
+Cc: Maxime Ripard <maxime.ripard@bootlin.com>
+Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/at91_adc.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index e3be88e7192c..75d2f73582a3 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -248,12 +248,14 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
+ struct iio_poll_func *pf = p;
+ struct iio_dev *idev = pf->indio_dev;
+ struct at91_adc_state *st = iio_priv(idev);
++ struct iio_chan_spec const *chan;
+ int i, j = 0;
+
+ for (i = 0; i < idev->masklength; i++) {
+ if (!test_bit(i, idev->active_scan_mask))
+ continue;
+- st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, i));
++ chan = idev->channels + i;
++ st->buffer[j] = at91_adc_readl(st, AT91_ADC_CHAN(st, chan->channel));
+ j++;
+ }
+
+--
+2.19.1
+
diff --git a/patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch b/patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch
new file mode 100644
index 0000000000..0dd5585cb3
--- /dev/null
+++ b/patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch
@@ -0,0 +1,77 @@
+From d3fa21c73c391975488818b085b894c2980ea052 Mon Sep 17 00:00:00 2001
+From: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Date: Sat, 22 Sep 2018 00:58:02 +0300
+Subject: [PATCH] iio: adc: imx25-gcq: Fix leak of device_node in mx25_gcq_setup_cfgs()
+Git-commit: d3fa21c73c391975488818b085b894c2980ea052
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Leaving for_each_child_of_node loop we should release child device node,
+if it is not stored for future use.
+
+Found by Linux Driver Verification project (linuxtesting.org).
+
+Jc: I'm not sending this as a quick fix as it's been wrong for years,
+but good to pick up for stable after the merge window.
+
+Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
+Fixes: 6df2e98c3ea56 ("iio: adc: Add imx25-gcq ADC driver")
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/adc/fsl-imx25-gcq.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/drivers/iio/adc/fsl-imx25-gcq.c b/drivers/iio/adc/fsl-imx25-gcq.c
+index ea264fa9e567..929c617db364 100644
+--- a/drivers/iio/adc/fsl-imx25-gcq.c
++++ b/drivers/iio/adc/fsl-imx25-gcq.c
+@@ -209,12 +209,14 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ ret = of_property_read_u32(child, "reg", &reg);
+ if (ret) {
+ dev_err(dev, "Failed to get reg property\n");
++ of_node_put(child);
+ return ret;
+ }
+
+ if (reg >= MX25_NUM_CFGS) {
+ dev_err(dev,
+ "reg value is greater than the number of available configuration registers\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -228,6 +230,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ if (IS_ERR(priv->vref[refp])) {
+ dev_err(dev, "Error, trying to use external voltage reference without a vref-%s regulator.",
+ mx25_gcq_refp_names[refp]);
++ of_node_put(child);
+ return PTR_ERR(priv->vref[refp]);
+ }
+ priv->channel_vref_mv[reg] =
+@@ -240,6 +243,7 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+ break;
+ default:
+ dev_err(dev, "Invalid positive reference %d\n", refp);
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+@@ -254,10 +258,12 @@ static int mx25_gcq_setup_cfgs(struct platform_device *pdev,
+
+ if ((refp & MX25_ADCQ_CFG_REFP_MASK) != refp) {
+ dev_err(dev, "Invalid fsl,adc-refp property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+ if ((refn & MX25_ADCQ_CFG_REFN_MASK) != refn) {
+ dev_err(dev, "Invalid fsl,adc-refn property value\n");
++ of_node_put(child);
+ return -EINVAL;
+ }
+
+--
+2.19.1
+
diff --git a/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch b/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
index b2143d5ef7..6f39bae9b4 100644
--- a/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
+++ b/patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
@@ -3,8 +3,7 @@ From: Corey Minyard <cminyard@mvista.com>
Date: Thu, 23 Aug 2018 15:22:35 -0500
Subject: [PATCH] ipmi: Move BT capabilities detection to the detect call
Git-commit: c86ba91be75702c013bbf7379542920b6920e98f
-Git-repo: git://github.com/cminyard/linux-ipmi.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v4.19-rc4
References: bsc#1106779
[ backport note: dev_warn() & co are replaced with pr_warn() & co,
diff --git a/patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch b/patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch
new file mode 100644
index 0000000000..1e0ab8e3b5
--- /dev/null
+++ b/patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch
@@ -0,0 +1,43 @@
+From 8f5be0ec23bb9ef3f96659c8dff1340b876600bf Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Mon, 13 Aug 2018 09:52:09 +0300
+Subject: [PATCH] kernfs: update comment about kernfs_path() return value
+Git-commit: 8f5be0ec23bb9ef3f96659c8dff1340b876600bf
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Now it returns the length of the full path or error code.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Fixes: 3abb1d90f5d9 ("kernfs: make kernfs_path*() behave in the style of strlcpy()")
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/kernfs.h | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/kernfs.h b/include/linux/kernfs.h
+index 814643f7ee52..5b36b1287a5a 100644
+--- a/include/linux/kernfs.h
++++ b/include/linux/kernfs.h
+@@ -477,10 +477,11 @@ static inline void kernfs_init(void) { }
+ * @buf: buffer to copy @kn's name into
+ * @buflen: size of @buf
+ *
+- * Builds and returns the full path of @kn in @buf of @buflen bytes. The
+- * path is built from the end of @buf so the returned pointer usually
+- * doesn't match @buf. If @buf isn't long enough, @buf is nul terminated
+- * and %NULL is returned.
++ * If @kn is NULL result will be "(null)".
++ *
++ * Returns the length of the full path. If the full length is equal to or
++ * greater than @buflen, @buf contains the truncated path with the trailing
++ * '\0'. On error, -errno is returned.
+ */
+ static inline int kernfs_path(struct kernfs_node *kn, char *buf, size_t buflen)
+ {
+--
+2.19.1
+
diff --git a/patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch b/patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch
new file mode 100644
index 0000000000..db5cbb9a73
--- /dev/null
+++ b/patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch
@@ -0,0 +1,43 @@
+From 32ae592036d7aeaabcccb2b1715373a68639a768 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Sat, 6 Oct 2018 14:01:42 -0400
+Subject: [PATCH] media: cx231xx: fix potential sign-extension overflow on large shift
+Git-commit: 32ae592036d7aeaabcccb2b1715373a68639a768
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Shifting the u8 value[3] by an int can lead to sign-extension
+overflow. For example, if value[3] is 0xff and the shift is 24 then it
+is promoted to int and then the top bit is sign-extended so that all
+upper 32 bits are set. Fix this by casting value[3] to a u32 before
+the shift.
+
+Detected by CoverityScan, CID#1016522 ("Unintended sign extension")
+
+Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/cx231xx/cx231xx-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c
+index 29160df76cf7..f2f034c5cd62 100644
+--- a/drivers/media/usb/cx231xx/cx231xx-video.c
++++ b/drivers/media/usb/cx231xx/cx231xx-video.c
+@@ -1389,7 +1389,7 @@ int cx231xx_g_register(struct file *file, void *priv,
+ ret = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER,
+ (u16)reg->reg, value, 4);
+ reg->val = value[0] | value[1] << 8 |
+- value[2] << 16 | value[3] << 24;
++ value[2] << 16 | (u32)value[3] << 24;
+ reg->size = 4;
+ break;
+ case 1: /* AFE - read byte */
+--
+2.19.1
+
diff --git a/patches.drivers/media-dvb-fix-compat-ioctl-translation.patch b/patches.drivers/media-dvb-fix-compat-ioctl-translation.patch
new file mode 100644
index 0000000000..85c0bf238f
--- /dev/null
+++ b/patches.drivers/media-dvb-fix-compat-ioctl-translation.patch
@@ -0,0 +1,77 @@
+From 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 27 Aug 2018 15:56:21 -0400
+Subject: [PATCH] media: dvb: fix compat ioctl translation
+Git-commit: 1ccbeeb888ac33627d91f1ccf0b84ef3bcadef24
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The VIDEO_GET_EVENT and VIDEO_STILLPICTURE was added back in 2005 but
+it never worked because the command number is wrong.
+
+Using the right command number means we have a better chance of them
+actually doing the right thing, though clearly nobody has ever tried
+it successfully.
+
+I noticed these while auditing the remaining users of compat_time_t
+for y2038 bugs. This one is fine in that regard, it just never did
+anything.
+
+Fixes: 6e87abd0b8cb ("[DVB]: Add compat ioctl handling.")
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/compat_ioctl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/fs/compat_ioctl.c
++++ b/fs/compat_ioctl.c
+@@ -160,6 +160,7 @@ struct compat_video_event {
+ unsigned int frame_rate;
+ } u;
+ };
++#define VIDEO_GET_EVENT32 _IOR('o', 28, struct compat_video_event)
+
+ static int do_video_get_event(struct file *file,
+ unsigned int cmd, struct compat_video_event __user *up)
+@@ -171,7 +172,7 @@ static int do_video_get_event(struct fil
+ if (kevent == NULL)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long)kevent);
++ err = do_ioctl(file, VIDEO_GET_EVENT, (unsigned long)kevent);
+ if (!err) {
+ err = convert_in_user(&kevent->type, &up->type);
+ err |= convert_in_user(&kevent->timestamp, &up->timestamp);
+@@ -190,6 +191,7 @@ struct compat_video_still_picture {
+ compat_uptr_t iFrame;
+ int32_t size;
+ };
++#define VIDEO_STILLPICTURE32 _IOW('o', 30, struct compat_video_still_picture)
+
+ static int do_video_stillpicture(struct file *file,
+ unsigned int cmd, struct compat_video_still_picture __user *up)
+@@ -212,7 +214,7 @@ static int do_video_stillpicture(struct
+ if (err)
+ return -EFAULT;
+
+- err = do_ioctl(file, cmd, (unsigned long) up_native);
++ err = do_ioctl(file, VIDEO_STILLPICTURE, (unsigned long) up_native);
+
+ return err;
+ }
+@@ -1487,9 +1489,9 @@ static long do_ioctl_trans(unsigned int
+ return rtc_ioctl(file, cmd, argp);
+
+ /* dvb */
+- case VIDEO_GET_EVENT:
++ case VIDEO_GET_EVENT32:
+ return do_video_get_event(file, cmd, argp);
+- case VIDEO_STILLPICTURE:
++ case VIDEO_STILLPICTURE32:
+ return do_video_stillpicture(file, cmd, argp);
+ case VIDEO_SET_SPU_PALETTE:
+ return do_video_set_spu_palette(file, cmd, argp);
diff --git a/patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch b/patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch
new file mode 100644
index 0000000000..75788a0c34
--- /dev/null
+++ b/patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch
@@ -0,0 +1,43 @@
+From 15644bfa195bd166d0a5ed76ae2d587f719c3dac Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Fri, 14 Sep 2018 00:20:21 -0400
+Subject: [PATCH] media: em28xx: fix input name for Terratec AV 350
+Git-commit: 15644bfa195bd166d0a5ed76ae2d587f719c3dac
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Instead of using a register value, use an AMUX name, as otherwise
+VIDIOC_G_AUDIO would fail.
+
+Cc: stable@vger.kernel.org
+Fixes: 766ed64de554 ("V4L/DVB (11827): Add support for Terratec Grabster AV350")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/em28xx/em28xx-cards.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c
+index 06a7e09ded6e..87b887b7604e 100644
+--- a/drivers/media/usb/em28xx/em28xx-cards.c
++++ b/drivers/media/usb/em28xx/em28xx-cards.c
+@@ -2141,13 +2141,13 @@ const struct em28xx_board em28xx_boards[] = {
+ .input = { {
+ .type = EM28XX_VMUX_COMPOSITE,
+ .vmux = TVP5150_COMPOSITE1,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+
+ }, {
+ .type = EM28XX_VMUX_SVIDEO,
+ .vmux = TVP5150_SVIDEO,
+- .amux = EM28XX_AUDIO_SRC_LINE,
++ .amux = EM28XX_AMUX_LINE_IN,
+ .gpio = terratec_av350_unmute_gpio,
+ } },
+ },
+--
+2.19.1
+
diff --git a/patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch b/patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch
new file mode 100644
index 0000000000..42b2caf0aa
--- /dev/null
+++ b/patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch
@@ -0,0 +1,44 @@
+From f823ce2a1202d47110a7ef86b65839f0be8adc38 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 23:22:40 -0400
+Subject: [PATCH] media: em28xx: use a default format if TRY_FMT fails
+Git-commit: f823ce2a1202d47110a7ef86b65839f0be8adc38
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Follow the V4L2 spec, as warned by v4l2-compliance:
+
+ warn: v4l2-test-formats.cpp(732): TRY_FMT cannot handle an invalid pixelformat.
+ warn: v4l2-test-formats.cpp(733): This may or may not be a problem. For more information see:
+
+Warn: v4l2-test-formats.cpp(734): http://www.mail-archive.com/linux-media@vger.kernel.org/msg56550.html
+
+Cc: stable@vger.kernel.org
+Fixes: bddcf63313c6 ("V4L/DVB (9927): em28xx: use a more standard way to specify video formats")
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/media/usb/em28xx/em28xx-video.c b/drivers/media/usb/em28xx/em28xx-video.c
+index fbdfe6762cb2..4b08da45032d 100644
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1471,9 +1471,9 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+
+ fmt = format_by_fourcc(f->fmt.pix.pixelformat);
+ if (!fmt) {
+- em28xx_videodbg("Fourcc format (%08x) invalid.\n",
+- f->fmt.pix.pixelformat);
+- return -EINVAL;
++ fmt = &format[0];
++ em28xx_videodbg("Fourcc format (%08x) invalid. Using default (%08x).\n",
++ f->fmt.pix.pixelformat, fmt->fourcc);
+ }
+
+ if (dev->board.is_em2800) {
+--
+2.19.1
+
diff --git a/patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch b/patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch
new file mode 100644
index 0000000000..a96f2a0ef3
--- /dev/null
+++ b/patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch
@@ -0,0 +1,69 @@
+From c5d59528e24ad22500347b199d52b9368e686a42 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Sun, 9 Sep 2018 12:02:32 -0400
+Subject: [PATCH] media: pci: cx23885: handle adding to list failure
+Git-commit: c5d59528e24ad22500347b199d52b9368e686a42
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+altera_hw_filt_init() which calls append_internal() assumes
+that the node was successfully linked in while in fact it can
+silently fail. So the call-site needs to set return to -ENOMEM
+on append_internal() returning NULL and exit through the err path.
+
+Fixes: 349bcf02e361 ("[media] Altera FPGA based CI driver module")
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/pci/cx23885/altera-ci.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c
+index 62bc8049b320..198c05e83f5c 100644
+--- a/drivers/media/pci/cx23885/altera-ci.c
++++ b/drivers/media/pci/cx23885/altera-ci.c
+@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->filts_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -699,6 +703,7 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr)
+ __func__, ret);
+
+ kfree(pid_filt);
++ kfree(inter);
+
+ return ret;
+ }
+@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr)
+ }
+
+ temp_int = append_internal(inter);
++ if (!temp_int) {
++ ret = -ENOMEM;
++ goto err;
++ }
+ inter->cis_used = 1;
+ inter->dev = config->dev;
+ inter->fpga_rw = config->fpga_rw;
+@@ -801,6 +810,7 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr)
+ ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret);
+
+ kfree(state);
++ kfree(inter);
+
+ return ret;
+ }
+--
+2.19.1
+
diff --git a/patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch b/patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch
new file mode 100644
index 0000000000..12b2ecd447
--- /dev/null
+++ b/patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch
@@ -0,0 +1,84 @@
+From 5c4c4505b716cb782ad7263091edc466c4d1fbd4 Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Date: Thu, 13 Sep 2018 16:49:51 -0400
+Subject: [PATCH] media: tvp5150: avoid going past array on v4l2_querymenu()
+Git-commit: 5c4c4505b716cb782ad7263091edc466c4d1fbd4
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The parameters of v4l2_ctrl_new_std_menu_items() are tricky: instead of
+the number of possible values, it requires the number of the maximum
+value. In other words, the ARRAY_SIZE() value should be decremented,
+otherwise it will go past the array bounds, as warned by KASAN:
+
+[ 279.839688] BUG: KASAN: global-out-of-bounds in v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839709] Read of size 8 at addr ffffffffc10a4cb0 by task v4l2-compliance/16676
+
+[ 279.839736] CPU: 1 PID: 16676 Comm: v4l2-compliance Not tainted 4.18.0-rc2+ #120
+[ 279.839741] Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017
+[ 279.839743] Call Trace:
+[ 279.839758] dump_stack+0x71/0xab
+[ 279.839807] ? v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839817] print_address_description+0x1c9/0x270
+[ 279.839863] ? v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839871] kasan_report+0x237/0x360
+[ 279.839918] v4l2_querymenu+0x10d/0x180 [videodev]
+[ 279.839964] __video_do_ioctl+0x2c8/0x590 [videodev]
+[ 279.840011] ? copy_overflow+0x20/0x20 [videodev]
+[ 279.840020] ? avc_ss_reset+0xa0/0xa0
+[ 279.840028] ? check_stack_object+0x21/0x60
+[ 279.840036] ? __check_object_size+0xe7/0x240
+[ 279.840080] video_usercopy+0xed/0x730 [videodev]
+[ 279.840123] ? copy_overflow+0x20/0x20 [videodev]
+[ 279.840167] ? v4l_enumstd+0x40/0x40 [videodev]
+[ 279.840177] ? __handle_mm_fault+0x9f9/0x1ba0
+[ 279.840186] ? __pmd_alloc+0x2c0/0x2c0
+[ 279.840193] ? __vfs_write+0xb6/0x350
+[ 279.840200] ? kernel_read+0xa0/0xa0
+[ 279.840244] ? video_usercopy+0x730/0x730 [videodev]
+[ 279.840284] v4l2_ioctl+0xa1/0xb0 [videodev]
+[ 279.840295] do_vfs_ioctl+0x117/0x8a0
+[ 279.840303] ? selinux_file_ioctl+0x211/0x2f0
+[ 279.840313] ? ioctl_preallocate+0x120/0x120
+[ 279.840319] ? selinux_capable+0x20/0x20
+[ 279.840332] ksys_ioctl+0x70/0x80
+[ 279.840342] __x64_sys_ioctl+0x3d/0x50
+[ 279.840351] do_syscall_64+0x6d/0x1c0
+[ 279.840361] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+[ 279.840367] RIP: 0033:0x7fdfb46275d7
+[ 279.840369] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
+[ 279.840474] RSP: 002b:00007ffee1179038 EFLAGS: 00000202 ORIG_RAX: 0000000000000010
+[ 279.840483] RAX: ffffffffffffffda RBX: 00007ffee1179180 RCX: 00007fdfb46275d7
+[ 279.840488] RDX: 00007ffee11790c0 RSI: 00000000c02c5625 RDI: 0000000000000003
+[ 279.840493] RBP: 0000000000000002 R08: 0000000000000020 R09: 00000000009f0902
+[ 279.840497] R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffee117a5a0
+[ 279.840501] R13: 00007ffee11790c0 R14: 0000000000000002 R15: 0000000000000000
+
+[ 279.840515] The buggy address belongs to the variable:
+[ 279.840535] tvp5150_test_patterns+0x10/0xffffffffffffe360 [tvp5150]
+
+Fixes: c43875f66140 ("[media] tvp5150: replace MEDIA_ENT_F_CONN_TEST by a control")
+Cc: stable@vger.kernel.org
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/tvp5150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index f337e523821b..57b2102586bc 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -1534,7 +1534,7 @@ static int tvp5150_probe(struct i2c_client *c,
+ 27000000, 1, 27000000);
+ v4l2_ctrl_new_std_menu_items(&core->hdl, &tvp5150_ctrl_ops,
+ V4L2_CID_TEST_PATTERN,
+- ARRAY_SIZE(tvp5150_test_patterns),
++ ARRAY_SIZE(tvp5150_test_patterns) - 1,
+ 0, 0, tvp5150_test_patterns);
+ sd->ctrl_handler = &core->hdl;
+ if (core->hdl.error) {
+--
+2.19.1
+
diff --git a/patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch b/patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch
new file mode 100644
index 0000000000..39a983a11b
--- /dev/null
+++ b/patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch
@@ -0,0 +1,43 @@
+From 2d29bcc8c237874795175b2930fa9a45a115175a Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Thu, 28 Jun 2018 12:20:34 -0400
+Subject: [PATCH] media: tvp5150: fix switch exit in set control handler
+Git-commit: 2d29bcc8c237874795175b2930fa9a45a115175a
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The function only consists of a single switch case block without a
+default case. Unsupported control requests are indicated by the -EINVAL
+return code trough the last return statement at the end of the function. So
+exiting just the switch case block returns the -EINVAL error code but the
+hue control is supported and a zero should be returned instead.
+
+Replace the break by a 'return 0' to fix this behaviour.
+
+Fixes: d183e4efcae8 ("[media] v4l: tvp5150: Add missing break in set
+control handler")
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/tvp5150.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 7dda77a4e6dc..0857f113b21d 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -834,7 +834,7 @@ static int tvp5150_s_ctrl(struct v4l2_ctrl *ctrl)
+ return 0;
+ case V4L2_CID_HUE:
+ tvp5150_write(sd, TVP5150_HUE_CTL, ctrl->val);
+- break;
++ return 0;
+ case V4L2_CID_TEST_PATTERN:
+ decoder->enable = ctrl->val ? false : true;
+ tvp5150_selmux(sd);
+--
+2.19.1
+
diff --git a/patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch b/patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch
new file mode 100644
index 0000000000..e46bd7faed
--- /dev/null
+++ b/patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch
@@ -0,0 +1,59 @@
+From bd24db04101f45a9c1d874fe21b0c7eab7bcadec Mon Sep 17 00:00:00 2001
+From: Marco Felsch <m.felsch@pengutronix.de>
+Date: Thu, 28 Jun 2018 12:20:33 -0400
+Subject: [PATCH] media: tvp5150: fix width alignment during set_selection()
+Git-commit: bd24db04101f45a9c1d874fe21b0c7eab7bcadec
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The driver ignored the width alignment which exists due to the UYVY
+colorspace format. Fix the width alignment and make use of the the
+provided v4l2 helper function to set the width, height and all
+alignments in one.
+
+Fixes: 963ddc63e20d ("[media] media: tvp5150: Add cropping support")
+
+Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/i2c/tvp5150.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
+index 92af47f2565e..7dda77a4e6dc 100644
+--- a/drivers/media/i2c/tvp5150.c
++++ b/drivers/media/i2c/tvp5150.c
+@@ -907,9 +907,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+
+ /* tvp5150 has some special limits */
+ rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT);
+- rect.width = clamp_t(unsigned int, rect.width,
+- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
+- TVP5150_H_MAX - rect.left);
+ rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP);
+
+ /* Calculate height based on current standard */
+@@ -923,9 +920,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd,
+ else
+ hmax = TVP5150_V_MAX_OTHERS;
+
+- rect.height = clamp_t(unsigned int, rect.height,
++ /*
++ * alignments:
++ * - width = 2 due to UYVY colorspace
++ * - height, image = no special alignment
++ */
++ v4l_bound_align_image(&rect.width,
++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left,
++ TVP5150_H_MAX - rect.left, 1, &rect.height,
+ hmax - TVP5150_MAX_CROP_TOP - rect.top,
+- hmax - rect.top);
++ hmax - rect.top, 0, 0);
+
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top);
+ tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP,
+--
+2.19.1
+
diff --git a/patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch b/patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch
new file mode 100644
index 0000000000..602557c8d1
--- /dev/null
+++ b/patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch
@@ -0,0 +1,41 @@
+From 89dd34caf73e28018c58cd193751e41b1f8bdc56 Mon Sep 17 00:00:00 2001
+From: Nadav Amit <namit@vmware.com>
+Date: Mon, 4 Jun 2018 09:47:13 -0400
+Subject: [PATCH] media: uvcvideo: Fix uvc_alloc_entity() allocation alignment
+Git-commit: 89dd34caf73e28018c58cd193751e41b1f8bdc56
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The use of ALIGN() in uvc_alloc_entity() is incorrect, since the size of
+(entity->pads) is not a power of two. As a stop-gap, until a better
+solution is adapted, use roundup() instead.
+
+Found by a static assertion. Compile-tested only.
+
+Fixes: 4ffc2d89f38a ("uvcvideo: Register subdevices for each entity")
+
+Signed-off-by: Nadav Amit <namit@vmware.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/usb/uvc/uvc_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 0692017f0b80..21b0270067c1 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -914,7 +914,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+ unsigned int size;
+ unsigned int i;
+
+- extra_size = ALIGN(extra_size, sizeof(*entity->pads));
++ extra_size = roundup(extra_size, sizeof(*entity->pads));
+ num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
+ size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
+ + num_inputs;
+--
+2.19.1
+
diff --git a/patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch b/patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
new file mode 100644
index 0000000000..c2eac7754d
--- /dev/null
+++ b/patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
@@ -0,0 +1,42 @@
+From 250854eed5d45a73d81e4137dfd85180af6f2ec3 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Mon, 8 Oct 2018 15:08:27 -0400
+Subject: [PATCH] media: v4l2-tpg: fix kernel oops when enabling HFLIP and OSD
+Git-commit: 250854eed5d45a73d81e4137dfd85180af6f2ec3
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+When the OSD is on (i.e. vivid displays text on top of the test pattern), and
+you enable hflip, then the driver crashes.
+
+The cause turned out to be a division of a negative number by an unsigned value.
+You expect that -8 / 2U would be -4, but in reality it is 2147483644 :-(
+
+Fixes: 3e14e7a82c1ef ("vivid-tpg: add hor/vert downsampling support to tpg_gen_text")
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reported-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Cc: <stable@vger.kernel.org> # for v4.1 and up
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+index 76b125ebee6d..fa483b95bc5a 100644
+--- a/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
++++ b/drivers/media/common/v4l2-tpg/v4l2-tpg-core.c
+@@ -1801,7 +1801,7 @@ typedef struct { u16 __; u8 _; } __packed x24;
+ pos[7] = (chr & (0x01 << 0) ? fg : bg); \
+ } \
+ \
+- pos += (tpg->hflip ? -8 : 8) / hdiv; \
++ pos += (tpg->hflip ? -8 : 8) / (int)hdiv; \
+ } \
+ } \
+ } while (0)
+--
+2.19.1
+
diff --git a/patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch b/patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch
new file mode 100644
index 0000000000..bd88fa98c1
--- /dev/null
+++ b/patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch
@@ -0,0 +1,56 @@
+From 9b2798d5b71c50f64c41a40f0cbcae47c3fbd067 Mon Sep 17 00:00:00 2001
+From: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Date: Thu, 26 Oct 2017 02:27:51 -0400
+Subject: [PATCH] media: vsp1: Fix YCbCr planar formats pitch calculation
+Git-commit: 9b2798d5b71c50f64c41a40f0cbcae47c3fbd067
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+YCbCr planar formats can have different pitch values for the luma and
+chroma planes. This isn't taken into account in the driver. Fix it.
+
+Based on a BSP patch from Koji Matsuoka <koji.matsuoka.xm@renesas.com>.
+
+Fixes: 7863ac504bc5 ("drm: rcar-du: Add tri-planar memory formats support")
+[Updated documentation of the struct vsp1_du_atomic_config pitch field]
+
+Signed-off-by: Koji Matsuoka <koji.matsuoka.xm@renesas.com>
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/platform/vsp1/vsp1_drm.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/platform/vsp1/vsp1_drm.c
++++ b/drivers/media/platform/vsp1/vsp1_drm.c
+@@ -260,6 +260,7 @@ int vsp1_du_atomic_update(struct device
+ {
+ struct vsp1_device *vsp1 = dev_get_drvdata(dev);
+ const struct vsp1_format_info *fmtinfo;
++ unsigned int chroma_hsub;
+ struct vsp1_rwpf *rpf;
+
+ if (rpf_index >= vsp1->info->rpf_count)
+@@ -294,10 +295,18 @@ int vsp1_du_atomic_update(struct device
+ return -EINVAL;
+ }
+
++ /*
++ * Only formats with three planes can affect the chroma planes pitch.
++ * All formats with two planes have a horizontal subsampling value of 2,
++ * but combine U and V in a single chroma plane, which thus results in
++ * the luma plane and chroma plane having the same pitch.
++ */
++ chroma_hsub = (fmtinfo->planes == 3) ? fmtinfo->hsub : 1;
++
+ rpf->fmtinfo = fmtinfo;
+ rpf->format.num_planes = fmtinfo->planes;
+ rpf->format.plane_fmt[0].bytesperline = cfg->pitch;
+- rpf->format.plane_fmt[1].bytesperline = cfg->pitch;
++ rpf->format.plane_fmt[1].bytesperline = cfg->pitch / chroma_hsub;
+ rpf->alpha = cfg->alpha;
+
+ rpf->mem.addr[0] = cfg->mem[0];
diff --git a/patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch b/patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch
new file mode 100644
index 0000000000..0656b1e9cf
--- /dev/null
+++ b/patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch
@@ -0,0 +1,94 @@
+From f6aa5beb45be27968a4df90176ca36dfc4363d37 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Mon, 3 Sep 2018 02:44:52 +0200
+Subject: [PATCH] serial: 8250: Fix clearing FIFOs in RS485 mode again
+Git-commit: f6aa5beb45be27968a4df90176ca36dfc4363d37
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The 8250 FIFOs indeed need to be cleared after stopping transmission in
+RS485 mode without SER_RS485_RX_DURING_TX flag set. But there are two
+problems with the approach taken by the previous patch from Fixes tag.
+
+First, serial8250_clear_fifos() should clear fifos, but what it really
+does is it enables the FIFOs unconditionally if present, clears them
+and then sets the FCR register to zero, which effectively disables the
+FIFOs. In case the FIFO is disabled, enabling it and clearing it makes
+no sense and in fact can trigger misbehavior of the 8250 core. Moreover,
+the FCR register may contain other FIFO configuration bits which may not
+be writable unconditionally and writing them incorrectly can trigger
+misbehavior of the 8250 core too. (ie. AM335x UART swallows the first
+byte and retransmits the last byte twice because of this FCR write).
+
+Second, serial8250_clear_and_reinit_fifos() completely reloads the FCR,
+but what really has to happen at the end of the RS485 transmission is
+clearing of the FIFOs and nothing else.
+
+This patch repairs serial8250_clear_fifos() so that it really only
+clears the FIFOs by operating on FCR[2:1] bits and leaves all the
+other bits alone. It also undoes serial8250_clear_and_reinit_fifos()
+from __do_stop_tx_rs485() as serial8250_clear_fifos() is sufficient.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Fixes: 2bed8a8e7072 ("Clearing FIFOs in RS485 emulation mode causes subsequent transmits to break")
+Cc: Daniel Jedrychowski <avistel@gmail.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable <stable@vger.kernel.org> # let it bake a bit before merging
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/tty/serial/8250/8250_port.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
+index 3f779d25ec0c..f776b3eafb96 100644
+--- a/drivers/tty/serial/8250/8250_port.c
++++ b/drivers/tty/serial/8250/8250_port.c
+@@ -552,11 +552,30 @@ static unsigned int serial_icr_read(struct uart_8250_port *up, int offset)
+ */
+ static void serial8250_clear_fifos(struct uart_8250_port *p)
+ {
++ unsigned char fcr;
++ unsigned char clr_mask = UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT;
++
+ if (p->capabilities & UART_CAP_FIFO) {
+- serial_out(p, UART_FCR, UART_FCR_ENABLE_FIFO);
+- serial_out(p, UART_FCR, UART_FCR_ENABLE_FIFO |
+- UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+- serial_out(p, UART_FCR, 0);
++ /*
++ * Make sure to avoid changing FCR[7:3] and ENABLE_FIFO bits.
++ * In case ENABLE_FIFO is not set, there is nothing to flush
++ * so just return. Furthermore, on certain implementations of
++ * the 8250 core, the FCR[7:3] bits may only be changed under
++ * specific conditions and changing them if those conditions
++ * are not met can have nasty side effects. One such core is
++ * the 8250-omap present in TI AM335x.
++ */
++ fcr = serial_in(p, UART_FCR);
++
++ /* FIFO is not enabled, there's nothing to clear. */
++ if (!(fcr & UART_FCR_ENABLE_FIFO))
++ return;
++
++ fcr |= clr_mask;
++ serial_out(p, UART_FCR, fcr);
++
++ fcr &= ~clr_mask;
++ serial_out(p, UART_FCR, fcr);
+ }
+ }
+
+@@ -1448,7 +1467,7 @@ static void __do_stop_tx_rs485(struct uart_8250_port *p)
+ * Enable previously disabled RX interrupts.
+ */
+ if (!(p->port.rs485.flags & SER_RS485_RX_DURING_TX)) {
+- serial8250_clear_and_reinit_fifos(p);
++ serial8250_clear_fifos(p);
+
+ p->ier |= UART_IER_RLSI | UART_IER_RDI;
+ serial_port_out(&p->port, UART_IER, p->ier);
+--
+2.19.1
+
diff --git a/patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch b/patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
new file mode 100644
index 0000000000..4c09159ddf
--- /dev/null
+++ b/patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
@@ -0,0 +1,43 @@
+From 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 15 Nov 2017 10:44:58 +0100
+Subject: [PATCH] soc/tegra: pmc: Fix child-node lookup
+Git-commit: 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Fix child-node lookup during probe, which ended up searching the whole
+device tree depth-first starting at the parent rather than just matching
+on its children.
+
+To make things worse, the parent pmc node could end up being prematurely
+freed as of_find_node_by_name() drops a reference to its first argument.
+
+Fixes: 3568df3d31d6 ("soc: tegra: Add thermal reset (thermtrip) support to PMC")
+Cc: stable <stable@vger.kernel.org> # 4.0
+Cc: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/soc/tegra/pmc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/tegra/pmc.c b/drivers/soc/tegra/pmc.c
+index 2d6f3fcf3211..ed71a4c9c8b2 100644
+--- a/drivers/soc/tegra/pmc.c
++++ b/drivers/soc/tegra/pmc.c
+@@ -1288,7 +1288,7 @@ static void tegra_pmc_init_tsense_reset(struct tegra_pmc *pmc)
+ if (!pmc->soc->has_tsense_reset)
+ return;
+
+- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip");
++ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip");
+ if (!np) {
+ dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled);
+ return;
+--
+2.19.1
+
diff --git a/patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch b/patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch
new file mode 100644
index 0000000000..4b20b64143
--- /dev/null
+++ b/patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch
@@ -0,0 +1,90 @@
+From 1cbca5852d6c16e85a21487a15d211195aacd4a1 Mon Sep 17 00:00:00 2001
+From: "Spencer E. Olson" <olsonse@umich.edu>
+Date: Wed, 3 Oct 2018 14:54:16 -0600
+Subject: [PATCH] staging: comedi: ni_mio_common: protect register write overflow
+Git-commit: 1cbca5852d6c16e85a21487a15d211195aacd4a1
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Fixes two problems introduced as early as
+commit 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code"):
+(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is
+ not unduly overwritten on e-series devices. On e-series devices, the
+ first three of the last four bits are reserved. The last bit defines
+ the output selection of the RGOUT0 pin, otherwise known as
+ RTSI_Sub_Selection. For m-series devices, these last four bits are
+ indeed used as the output selection of the RTSI7 pin (and the
+ RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the
+ RTSI_Trig_Direction register.
+(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI
+ lines.
+
+This patch also cleans up the ni_get_rtsi_routing command for readability.
+
+Fixes: 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code")
+Signed-off-by: Spencer E. Olson <olsonse@umich.edu>
+Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ .../staging/comedi/drivers/ni_mio_common.c | 24 +++++++++++++------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 4dee2fc37aed..44fcb3790113 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -4980,7 +4980,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev,
+ case NI_RTSI_OUTPUT_G_SRC0:
+ case NI_RTSI_OUTPUT_G_GATE0:
+ case NI_RTSI_OUTPUT_RGOUT0:
+- case NI_RTSI_OUTPUT_RTSI_BRD_0:
++ case NI_RTSI_OUTPUT_RTSI_BRD(0):
++ case NI_RTSI_OUTPUT_RTSI_BRD(1):
++ case NI_RTSI_OUTPUT_RTSI_BRD(2):
++ case NI_RTSI_OUTPUT_RTSI_BRD(3):
+ return 1;
+ case NI_RTSI_OUTPUT_RTSI_OSC:
+ return (devpriv->is_m_series) ? 1 : 0;
+@@ -5001,11 +5004,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev,
+ devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg,
+ NISTC_RTSI_TRIGA_OUT_REG);
+- } else if (chan < 8) {
++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan);
+ devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src);
+ ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg,
+ NISTC_RTSI_TRIGB_OUT_REG);
++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ /* probably should never reach this, since the
++ * ni_valid_rtsi_output_source above errors out if chan is too
++ * high
++ */
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+ return 2;
+ }
+@@ -5021,12 +5031,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev,
+ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) {
+ return NISTC_RTSI_TRIG_TO_SRC(chan,
+ devpriv->rtsi_trig_b_output_reg);
+- } else {
+- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN)
+- return NI_RTSI_OUTPUT_RTSI_OSC;
+- dev_err(dev->class_dev, "bug! should never get here?\n");
+- return 0;
++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) {
++ return NI_RTSI_OUTPUT_RTSI_OSC;
+ }
++
++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__);
++ return -EINVAL;
+ }
+
+ static int ni_rtsi_insn_config(struct comedi_device *dev,
+--
+2.19.1
+
diff --git a/patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch b/patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch
new file mode 100644
index 0000000000..ec17f95240
--- /dev/null
+++ b/patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch
@@ -0,0 +1,39 @@
+From 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e Mon Sep 17 00:00:00 2001
+From: Loic Poulain <loic.poulain@linaro.org>
+Date: Tue, 4 Sep 2018 17:18:57 +0200
+Subject: [PATCH] usb: chipidea: Prevent unbalanced IRQ disable
+Git-commit: 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The ChipIdea IRQ is disabled before scheduling the otg work and
+re-enabled on otg work completion. However if the job is already
+scheduled we have to undo the effect of disable_irq int order to
+balance the IRQ disable-depth value.
+
+Fixes: be6b0c1bd0be ("usb: chipidea: using one inline function to cover queue work operations")
+Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
+Signed-off-by: Peter Chen <peter.chen@nxp.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/chipidea/otg.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/chipidea/otg.h b/drivers/usb/chipidea/otg.h
+index 7e7428e48bfa..4f8b8179ec96 100644
+--- a/drivers/usb/chipidea/otg.h
++++ b/drivers/usb/chipidea/otg.h
+@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdrc *ci);
+ static inline void ci_otg_queue_work(struct ci_hdrc *ci)
+ {
+ disable_irq_nosync(ci->irq);
+- queue_work(ci->wq, &ci->work);
++ if (queue_work(ci->wq, &ci->work) == false)
++ enable_irq(ci->irq);
+ }
+
+ #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */
+--
+2.19.1
+
diff --git a/patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch b/patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
new file mode 100644
index 0000000000..df3d80c15f
--- /dev/null
+++ b/patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
@@ -0,0 +1,89 @@
+From 4ab2b48c98f2ec9712452d520a381917f91ac3d2 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 30 Aug 2018 12:16:58 +0200
+Subject: [PATCH] usb: gadget: fsl_udc_core: check allocation return value and cleanup on failure
+Git-commit: 4ab2b48c98f2ec9712452d520a381917f91ac3d2
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The allocation with fsl_alloc_request() and kmalloc() were unchecked
+fixed this up with a NULL check and appropriate cleanup.
+
+Additionally udc->ep_qh_size was reset to 0 on failure of allocation.
+Similar udc->phy_mode is initially 0 (as udc_controller was
+allocated with kzalloc in fsl_udc_probe()) so reset it to 0 as well
+so that this function is side-effect free on failure. Not clear if
+this is necessary or sensible as fsl_udc_release() probably can not
+be called if fsl_udc_probe() failed - but it should not hurt.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: b504882da5 ("USB: add Freescale high-speed USB SOC device controller driver")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c | 30 ++++++++++++++++++++++++++----
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2264,8 +2264,10 @@ static int struct_udc_setup(struct fsl_u
+ udc->phy_mode = pdata->phy_mode;
+
+ udc->eps = kzalloc(sizeof(struct fsl_ep) * udc->max_ep, GFP_KERNEL);
+- if (!udc->eps)
+- return -1;
++ if (!udc->eps) {
++ ERR("kmalloc udc endpoint status failed\n");
++ goto eps_alloc_failed;
++ }
+
+ /* initialized QHs, take care of alignment */
+ size = udc->max_ep * sizeof(struct ep_queue_head);
+@@ -2279,8 +2281,7 @@ static int struct_udc_setup(struct fsl_u
+ &udc->ep_qh_dma, GFP_KERNEL);
+ if (!udc->ep_qh) {
+ ERR("malloc QHs for udc failed\n");
+- kfree(udc->eps);
+- return -1;
++ goto ep_queue_alloc_failed;
+ }
+
+ udc->ep_qh_size = size;
+@@ -2289,8 +2290,17 @@ static int struct_udc_setup(struct fsl_u
+ /* FIXME: fsl_alloc_request() ignores ep argument */
+ udc->status_req = container_of(fsl_alloc_request(NULL, GFP_KERNEL),
+ struct fsl_req, req);
++ if (!udc->status_req) {
++ ERR("kzalloc for udc status request failed\n");
++ goto udc_status_alloc_failed;
++ }
++
+ /* allocate a small amount of memory to get valid address */
+ udc->status_req->req.buf = kmalloc(8, GFP_KERNEL);
++ if (!udc->status_req->req.buf) {
++ ERR("kzalloc for udc request buffer failed\n");
++ goto udc_req_buf_alloc_failed;
++ }
+
+ udc->resume_state = USB_STATE_NOTATTACHED;
+ udc->usb_state = USB_STATE_POWERED;
+@@ -2298,6 +2308,18 @@ static int struct_udc_setup(struct fsl_u
+ udc->remote_wakeup = 0; /* default to 0 on reset */
+
+ return 0;
++
++udc_req_buf_alloc_failed:
++ kfree(udc->status_req);
++udc_status_alloc_failed:
++ kfree(udc->ep_qh);
++ udc->ep_qh_size = 0;
++ep_queue_alloc_failed:
++ kfree(udc->eps);
++eps_alloc_failed:
++ udc->phy_mode = 0;
++ return -1;
++
+ }
+
+ /*----------------------------------------------------------------
diff --git a/patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch b/patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
new file mode 100644
index 0000000000..76d8495966
--- /dev/null
+++ b/patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
@@ -0,0 +1,45 @@
+From 24b804e40f23a199e6d82de5b5571bb642490ca1 Mon Sep 17 00:00:00 2001
+From: Nicholas Mc Guire <hofrat@osadl.org>
+Date: Thu, 30 Aug 2018 12:16:59 +0200
+Subject: [PATCH] usb: gadget: fsl_udc_core: fixup struct_udc_setup documentation
+Git-commit: 24b804e40f23a199e6d82de5b5571bb642490ca1
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+The original implementation from commit b504882da539
+("usb: add Freescale high-speed USB SOC device controller driver")
+returned NULL on failure and an allocated + initialized struct fsl_udc on
+success. The current code introduced in commit 4365831dadfe
+("usb: fsl_usb2_udc: Get max ep number from DCCPARAMS register") only
+provides partial initialization as well as returning 0 on success and -1
+on failures. The function documentation is updated accordingly.
+
+Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
+Fixes: 4365831dadfe ("USB: fsl_usb2_udc: Get max ep number from DCCPARAMS register")
+Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/gadget/udc/fsl_udc_core.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c
+index 845dee3d93d6..20141c3096f6 100644
+--- a/drivers/usb/gadget/udc/fsl_udc_core.c
++++ b/drivers/usb/gadget/udc/fsl_udc_core.c
+@@ -2234,8 +2234,10 @@ static void fsl_udc_release(struct device *dev)
+ Internal structure setup functions
+ *******************************************************************/
+ /*------------------------------------------------------------------
+- * init resource for globle controller
+- * Return the udc handle on success or NULL on failure
++ * init resource for global controller called by fsl_udc_probe()
++ * On success the udc handle is initialized, on failure it is
++ * unchanged (reset).
++ * Return 0 on success and -1 on allocation failure
+ ------------------------------------------------------------------*/
+ static int struct_udc_setup(struct fsl_udc *udc,
+ struct platform_device *pdev)
+--
+2.19.1
+
diff --git a/patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch b/patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch
new file mode 100644
index 0000000000..49be769f0f
--- /dev/null
+++ b/patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch
@@ -0,0 +1,60 @@
+From e325808c0051b16729ffd472ff887c6cae5c6317 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 16 Oct 2018 19:03:43 +0100
+Subject: [PATCH] usbip: tools: fix atoi() on non-null terminated string
+Git-commit: e325808c0051b16729ffd472ff887c6cae5c6317
+Patch-mainline: v4.20-rc1
+References: bsc#1051510
+
+Currently the call to atoi is being passed a single char string
+that is not null terminated, so there is a potential read overrun
+along the stack when parsing for an integer value. Fix this by
+instead using a 2 char string that is initialized to all zeros
+to ensure that a 1 char read into the string is always terminated
+with a \0.
+
+Detected by cppcheck:
+"Invalid atoi() argument nr 1. A nul-terminated string is required."
+
+Fixes: 3391ba0e2792 ("usbip: tools: Extract generic code to be shared with vudc backend")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ tools/usb/usbip/libsrc/usbip_host_common.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/usb/usbip/libsrc/usbip_host_common.c b/tools/usb/usbip/libsrc/usbip_host_common.c
+index dc93fadbee96..d79c7581b175 100644
+--- a/tools/usb/usbip/libsrc/usbip_host_common.c
++++ b/tools/usb/usbip/libsrc/usbip_host_common.c
+@@ -43,7 +43,7 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ int size;
+ int fd;
+ int length;
+- char status;
++ char status[2] = { 0 };
+ int value = 0;
+
+ size = snprintf(status_attr_path, sizeof(status_attr_path),
+@@ -61,14 +61,14 @@ static int32_t read_attr_usbip_status(struct usbip_usb_device *udev)
+ return -1;
+ }
+
+- length = read(fd, &status, 1);
++ length = read(fd, status, 1);
+ if (length < 0) {
+ err("error reading attribute %s", status_attr_path);
+ close(fd);
+ return -1;
+ }
+
+- value = atoi(&status);
++ value = atoi(status);
+
+ return value;
+ }
+--
+2.19.1
+
diff --git a/patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch b/patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch
new file mode 100644
index 0000000000..5c344d491f
--- /dev/null
+++ b/patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch
@@ -0,0 +1,152 @@
+From 93bba24d4b5ad1e5cd8b43f64e66ff9d6355dd20 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 7 Sep 2018 14:16:23 +0800
+Patch-mainline: v4.20
+Git-commit: 93bba24d4b5ad1e5cd8b43f64e66ff9d6355dd20
+References: Dependency for bsc#1113667
+Subject: [PATCH 1/2] btrfs: Enhance btrfs_trim_fs function to handle error
+ better
+
+Function btrfs_trim_fs() doesn't handle errors in a consistent way. If
+error happens when trimming existing block groups, it will skip the
+remaining blocks and continue to trim unallocated space for each device.
+
+The return value will only reflect the final error from device trimming.
+
+This patch will fix such behavior by:
+
+1) Recording the last error from block group or device trimming
+ The return value will also reflect the last error during trimming.
+ Make developer more aware of the problem.
+
+2) Continuing trimming if possible
+ If we failed to trim one block group or device, we could still try
+ the next block group or device.
+
+3) Report number of failures during block group and device trimming
+ It would be less noisy, but still gives user a brief summary of
+ what's going wrong.
+
+Such behavior can avoid confusion for cases like failure to trim the
+first block group and then only unallocated space is trimmed.
+
+Reported-by: Chris Murphy <lists@colorremedies.com>
+CC: stable@vger.kernel.org # 4.4+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+[ add bg_ret and dev_ret to the messages ]
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 49 ++++++++++++++++++++++++++++++++----------
+ 1 file changed, 38 insertions(+), 11 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 528f3308c32b..5dbb3f713125 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10833,6 +10833,15 @@ static int btrfs_trim_free_extents(struct btrfs_device *device,
+ return ret;
+ }
+
++/*
++ * Trim the whole filesystem by:
++ * 1) trimming the free space in each block group
++ * 2) trimming the unallocated space on each device
++ *
++ * This will also continue trimming even if a block group or device encounters
++ * an error. The return value will be the last error, or 0 if nothing bad
++ * happens.
++ */
+ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ {
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -10843,6 +10852,10 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 end;
+ u64 trimmed = 0;
+ u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
++ u64 bg_failed = 0;
++ u64 dev_failed = 0;
++ int bg_ret = 0;
++ int dev_ret = 0;
+ int ret = 0;
+
+ /*
+@@ -10853,7 +10866,7 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ else
+ cache = btrfs_lookup_block_group(fs_info, range->start);
+
+- while (cache) {
++ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+ break;
+@@ -10867,13 +10880,15 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ if (!block_group_cache_done(cache)) {
+ ret = cache_block_group(cache, 0);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ ret = wait_block_group_cache_done(cache);
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+ ret = btrfs_trim_block_group(cache,
+@@ -10884,28 +10899,40 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+
+ trimmed += group_trimmed;
+ if (ret) {
+- btrfs_put_block_group(cache);
+- break;
++ bg_failed++;
++ bg_ret = ret;
++ continue;
+ }
+ }
+-
+- cache = next_block_group(fs_info, cache);
+ }
+
++ if (bg_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu block group(s), last error %d",
++ bg_failed, bg_ret);
+ mutex_lock(&fs_info->fs_devices->device_list_mutex);
+ devices = &fs_info->fs_devices->alloc_list;
+ list_for_each_entry(device, devices, dev_alloc_list) {
+ ret = btrfs_trim_free_extents(device, range->minlen,
+ &group_trimmed);
+- if (ret)
++ if (ret) {
++ dev_failed++;
++ dev_ret = ret;
+ break;
++ }
+
+ trimmed += group_trimmed;
+ }
+ mutex_unlock(&fs_info->fs_devices->device_list_mutex);
+
++ if (dev_failed)
++ btrfs_warn(fs_info,
++ "failed to trim %llu device(s), last error %d",
++ dev_failed, dev_ret);
+ range->len = trimmed;
+- return ret;
++ if (bg_ret)
++ return bg_ret;
++ return dev_ret;
+ }
+
+ /*
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch b/patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch
new file mode 100644
index 0000000000..02da211c31
--- /dev/null
+++ b/patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch
@@ -0,0 +1,100 @@
+From 14b284832e7dea6f54f0adfd7bed105548b94e57 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 8 Oct 2018 17:22:28 +0100
+Subject: drm/amdgpu/powerplay: fix missing break in switch statements
+Git-commit: 14b284832e7dea6f54f0adfd7bed105548b94e57
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+There are several switch statements that are missing break statements.
+Add missing breaks to handle any fall-throughs corner cases.
+
+Detected by CoverityScan, CID#1457175 ("Missing break in switch")
+
+Backporting notes:
+
+ * applied patch in {fiji,iceland,tonga}_smc.c files
+ * fixed similar bug in polaris10_smc.c
+
+Fixes: 18aafc59b106 ("drm/amd/powerplay: implement fw related smu interface for iceland.")
+Acked-by: Huang Rui <ray.huang@amd.com>
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c | 2 ++
+ drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c | 2 ++
+ drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c | 2 ++
+ drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c | 2 ++
+ 4 files changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/fiji_smc.c
+@@ -2193,6 +2193,7 @@ uint32_t fiji_get_offsetof(uint32_t type
+ case UcodeLoadStatus:
+ return offsetof(SMU73_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2204,6 +2205,7 @@ uint32_t fiji_get_offsetof(uint32_t type
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU73_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/iceland_smc.c
+@@ -2140,11 +2140,13 @@ uint32_t iceland_get_offsetof(uint32_t t
+ case UcodeLoadStatus:
+ return offsetof(SMU71_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU71_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smc.c
+@@ -2211,6 +2211,7 @@ uint32_t polaris10_get_offsetof(uint32_t
+ case UcodeLoadStatus:
+ return offsetof(SMU74_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2222,6 +2223,7 @@ uint32_t polaris10_get_offsetof(uint32_t
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU74_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
+--- a/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c
++++ b/drivers/gpu/drm/amd/powerplay/smumgr/tonga_smc.c
+@@ -2683,6 +2683,7 @@ uint32_t tonga_get_offsetof(uint32_t typ
+ case UcodeLoadStatus:
+ return offsetof(SMU72_SoftRegisters, UcodeLoadStatus);
+ }
++ break;
+ case SMU_Discrete_DpmTable:
+ switch (member) {
+ case UvdBootLevel:
+@@ -2694,6 +2695,7 @@ uint32_t tonga_get_offsetof(uint32_t typ
+ case LowSclkInterruptThreshold:
+ return offsetof(SMU72_Discrete_DpmTable, LowSclkInterruptThreshold);
+ }
++ break;
+ }
+ pr_warn("can't get the offset of type %x member %x\n", type, member);
+ return 0;
diff --git a/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch b/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
index 1d85348c12..64d4a6aff4 100644
--- a/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
+++ b/patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
@@ -4,8 +4,7 @@ Date: Fri, 20 Jul 2018 12:48:02 +0200
Subject: drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up
References: bsc#1101822
Git-commit: abf7b30d7f61d981bfcca65d1e8331b27021b475
-Git-repo: git://anongit.freedesktop.org/drm/drm-misc
-Patch-mainline: Queued for upstream in drm-misc-next
+Patch-mainline: v4.20-rc1
In the Cirrus driver, the regular clean-up code also performs the clean-up
of a failed initialization. If the fbdev's framebuffer was not initialized,
diff --git a/patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch b/patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch
new file mode 100644
index 0000000000..0fb9b3daaa
--- /dev/null
+++ b/patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch
@@ -0,0 +1,88 @@
+From 331d880b35a76b5de0eec8cbcecbf615d758a5f9 Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Sat, 22 Sep 2018 01:25:25 +0800
+Subject: drm/hisilicon: hibmc: Do not carry error code in HiBMC framebuffer
+ pointer
+Git-commit: 331d880b35a76b5de0eec8cbcecbf615d758a5f9
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+In hibmc_drm_fb_create(), when the call to hibmc_framebuffer_init() fails
+with error, do not store the error code in the HiBMC device frame-buffer
+pointer, as this will be later checked for non-zero value in
+hibmc_fbdev_destroy() when our intention is to check for a valid function
+pointer.
+
+This fixes the following crash:
+[ 9.699791] Unable to handle kernel NULL pointer dereference at virtual address 000000000000001a
+[ 9.708672] Mem abort info:
+[ 9.711489] ESR = 0x96000004
+[ 9.714570] Exception class = DABT (current EL), IL = 32 bits
+[ 9.720551] SET = 0, FnV = 0
+[ 9.723631] EA = 0, S1PTW = 0
+[ 9.726799] Data abort info:
+[ 9.729702] ISV = 0, ISS = 0x00000004
+[ 9.733573] CM = 0, WnR = 0
+[ 9.736566] [000000000000001a] user address but active_mm is swapper
+[ 9.742987] Internal error: Oops: 96000004 [#1] PREEMPT SMP
+[ 9.748614] Modules linked in:
+[ 9.751694] CPU: 16 PID: 293 Comm: kworker/16:1 Tainted: G W 4.19.0-rc4-next-20180920-00001-g9b0012c #322
+[ 9.762681] Hardware name: Huawei Taishan 2280 /D05, BIOS Hisilicon D05 IT21 Nemo 2.0 RC0 04/18/2018
+[ 9.771915] Workqueue: events work_for_cpu_fn
+[ 9.776312] pstate: 60000005 (nZCv daif -PAN -UAO)
+[ 9.781150] pc : drm_mode_object_put+0x0/0x20
+[ 9.785547] lr : hibmc_fbdev_fini+0x40/0x58
+[ 9.789767] sp : ffff00000af1bcf0
+[ 9.793108] x29: ffff00000af1bcf0 x28: 0000000000000000
+[ 9.798473] x27: 0000000000000000 x26: ffff000008f66630
+[ 9.803838] x25: 0000000000000000 x24: ffff0000095abb98
+[ 9.809203] x23: ffff8017db92fe00 x22: ffff8017d2b13000
+[ 9.814568] x21: ffffffffffffffea x20: ffff8017d2f80018
+[ 9.819933] x19: ffff8017d28a0018 x18: ffffffffffffffff
+[ 9.825297] x17: 0000000000000000 x16: 0000000000000000
+[ 9.830662] x15: ffff0000092296c8 x14: ffff00008939970f
+[ 9.836026] x13: ffff00000939971d x12: ffff000009229940
+[ 9.841391] x11: ffff0000085f8fc0 x10: ffff00000af1b9a0
+[ 9.846756] x9 : 000000000000000d x8 : 6620657a696c6169
+[ 9.852121] x7 : ffff8017d3340580 x6 : ffff8017d4168000
+[ 9.857486] x5 : 0000000000000000 x4 : ffff8017db92fb20
+[ 9.862850] x3 : 0000000000002690 x2 : ffff8017d3340480
+[ 9.868214] x1 : 0000000000000028 x0 : 0000000000000002
+[ 9.873580] Process kworker/16:1 (pid: 293, stack limit = 0x(____ptrval____))
+[ 9.880788] Call trace:
+[ 9.883252] drm_mode_object_put+0x0/0x20
+[ 9.887297] hibmc_unload+0x1c/0x80
+[ 9.890815] hibmc_pci_probe+0x170/0x3c8
+[ 9.894773] local_pci_probe+0x3c/0xb0
+[ 9.898555] work_for_cpu_fn+0x18/0x28
+[ 9.902337] process_one_work+0x1e0/0x318
+[ 9.906382] worker_thread+0x228/0x450
+[ 9.910164] kthread+0x128/0x130
+[ 9.913418] ret_from_fork+0x10/0x18
+[ 9.917024] Code: a94153f3 a8c27bfd d65f03c0 d503201f (f9400c01)
+[ 9.923180] ---[ end trace 2695ffa0af5be375 ]---
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index b92595c477ef..8bd29075ae4e 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj);
+ if (IS_ERR(hi_fbdev->fb)) {
+ ret = PTR_ERR(hi_fbdev->fb);
++ hi_fbdev->fb = NULL;
+ DRM_ERROR("failed to initialize framebuffer: %d\n", ret);
+ goto out_release_fbi;
+ }
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch b/patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch
new file mode 100644
index 0000000000..702f9d11c7
--- /dev/null
+++ b/patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch
@@ -0,0 +1,41 @@
+From 0ff9f49646353ce31312411e7e7bd2281492a40e Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Sat, 22 Sep 2018 01:25:26 +0800
+Subject: drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
+Git-commit: 0ff9f49646353ce31312411e7e7bd2281492a40e
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+Currently the driver overwrites the surface depth provided by the fb
+helper to give an invalid bpp/surface depth combination.
+
+This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy
+bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to
+fail to probe.
+
+Fix by not overwriting the surface depth.
+
+Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Signed-off-by: Xinliang Liu <z.liuxinliang@hisilicon.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+index 8bd29075ae4e..edcca1761500 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c
+@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper,
+ DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n",
+ sizes->surface_width, sizes->surface_height,
+ sizes->surface_bpp);
+- sizes->surface_depth = 32;
+
+ bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8);
+
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch b/patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch
new file mode 100644
index 0000000000..0482da221c
--- /dev/null
+++ b/patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch
@@ -0,0 +1,43 @@
+From 35a5fd9ebfa93758ca579e30f337b6c9126d995b Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Fri, 17 Aug 2018 11:02:41 +0100
+Subject: drm/i915/audio: Hook up component bindings even if displays are
+ disabled
+Git-commit: 35a5fd9ebfa93758ca579e30f337b6c9126d995b
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+If the display has been disabled by modparam, we still want to connect
+together the HW bits and bobs with the associated drivers so that we can
+continue to manage their runtime power gating.
+
+Fixes: 108109444ff6 ("drm/i915: Check num_pipes before initializing audio component")
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Imre Deak <imre.deak@intel.com>
+Cc: Takashi Iwai <tiwai@suse.de>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Elaine Wang <elaine.wang@intel.com>
+Reviewed-by: Imre Deak <imre.deak@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180817100241.4628-1-chris@chris-wilson.co.uk
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_audio.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c
+index bb94172ffc07..f02cb211d3e7 100644
+--- a/drivers/gpu/drm/i915/intel_audio.c
++++ b/drivers/gpu/drm/i915/intel_audio.c
+@@ -960,9 +960,6 @@ void i915_audio_component_init(struct drm_i915_private *dev_priv)
+ {
+ int ret;
+
+- if (INTEL_INFO(dev_priv)->num_pipes == 0)
+- return;
+-
+ ret = component_add(dev_priv->drm.dev, &i915_audio_component_bind_ops);
+ if (ret < 0) {
+ DRM_ERROR("failed to add audio component (%d)\n", ret);
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch b/patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch
new file mode 100644
index 0000000000..a8baf99390
--- /dev/null
+++ b/patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch
@@ -0,0 +1,90 @@
+From d9a515867bdba59ebf196a6ade10faae8e8be36a Mon Sep 17 00:00:00 2001
+From: Imre Deak <imre.deak@intel.com>
+Date: Tue, 16 Oct 2018 19:00:11 +0300
+Subject: drm/i915/gen9+: Fix initial readout for Y tiled framebuffers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: d9a515867bdba59ebf196a6ade10faae8e8be36a
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+If BIOS configured a Y tiled FB we failed to set up the backing object
+tiling accordingly, leading to a lack of GT fence installed and a
+garbled console.
+
+The problem was bisected to
+commit 011f22eb545a ("drm/i915: Do NOT skip the first 4k of stolen memory for pre-allocated buffers v2")
+but it just revealed a pre-existing issue.
+
+Kudos to Ville who suspected a missing fence looking at the corruption
+on the screen.
+
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
+Cc: Hans de Goede <hdegoede@redhat.com>
+Cc: <ronald@innovation.ch>
+Cc: <stable@vger.kernel.org>
+Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Reported-by: <ronald@innovation.ch>
+Tested-by: <ronald@innovation.ch>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108264
+Fixes: bc8d7dffacb1 ("drm/i915/skl: Provide a Skylake version of get_plane_config()")
+Signed-off-by: Imre Deak <imre.deak@intel.com>
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20181016160011.28347-1-imre.deak@intel.com
+(cherry picked from commit 914a4fd8cd28016038ce749a818a836124a8d270)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/i915/intel_display.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2657,6 +2657,17 @@ intel_alloc_initial_plane_obj(struct int
+ if (size_aligned * 2 > dev_priv->stolen_usable_size)
+ return false;
+
++ switch (fb->modifier) {
++ case DRM_FORMAT_MOD_LINEAR:
++ case I915_FORMAT_MOD_X_TILED:
++ case I915_FORMAT_MOD_Y_TILED:
++ break;
++ default:
++ DRM_DEBUG_DRIVER("Unsupported modifier for initial FB: 0x%llx\n",
++ fb->modifier);
++ return false;
++ }
++
+ mutex_lock(&dev->struct_mutex);
+ obj = i915_gem_object_create_stolen_for_preallocated(dev_priv,
+ base_aligned,
+@@ -2666,8 +2677,17 @@ intel_alloc_initial_plane_obj(struct int
+ if (!obj)
+ return false;
+
+- if (plane_config->tiling == I915_TILING_X)
+- obj->tiling_and_stride = fb->pitches[0] | I915_TILING_X;
++ switch (plane_config->tiling) {
++ case I915_TILING_NONE:
++ break;
++ case I915_TILING_X:
++ case I915_TILING_Y:
++ obj->tiling_and_stride = fb->pitches[0] | plane_config->tiling;
++ break;
++ default:
++ MISSING_CASE(plane_config->tiling);
++ return false;
++ }
+
+ mode_cmd.pixel_format = fb->format->format;
+ mode_cmd.width = fb->width;
+@@ -8520,6 +8540,7 @@ skylake_get_initial_plane_config(struct
+ fb->modifier = I915_FORMAT_MOD_X_TILED;
+ break;
+ case PLANE_CTL_TILED_Y:
++ plane_config->tiling = I915_TILING_Y;
+ if (val & PLANE_CTL_DECOMPRESSION_ENABLE)
+ fb->modifier = I915_FORMAT_MOD_Y_TILED_CCS;
+ else
diff --git a/patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch b/patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch
new file mode 100644
index 0000000000..a31fe55c1e
--- /dev/null
+++ b/patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch
@@ -0,0 +1,59 @@
+From ceff2f4dcd44abf35864d9a99f85ac619e89a01d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:46 +0200
+Subject: drm/mediatek: fix OF sibling-node lookup
+Git-commit: ceff2f4dcd44abf35864d9a99f85ac619e89a01d
+Patch-mainline: v4.19-rc2
+References: bsc#1106110
+
+Use the new of_get_compatible_child() helper to lookup the sibling
+instead of using of_find_compatible_node(), which searches the entire
+tree from a given start node and thus can return an unrelated (i.e.
+non-sibling) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the parent device node).
+
+While at it, also fix the related cec-node reference leak.
+
+Backporting notes:
+
+ * adapted patch to context changes in mtk_hdmi.c
+
+Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support")
+Cc: stable <stable@vger.kernel.org> # 4.8
+Cc: Junzhi Zhao <junzhi.zhao@mediatek.com>
+Cc: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: CK Hu <ck.hu@mediatek.com>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/mediatek/mtk_hdmi.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1447,8 +1447,7 @@ static int mtk_hdmi_dt_parse_pdata(struc
+ }
+
+ /* The CEC module handles HDMI hotplug detection */
+- cec_np = of_find_compatible_node(np->parent, NULL,
+- "mediatek,mt8173-cec");
++ cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+ if (!cec_np) {
+ dev_err(dev, "Failed to find CEC node\n");
+ return -EINVAL;
+@@ -1458,8 +1457,10 @@ static int mtk_hdmi_dt_parse_pdata(struc
+ if (!cec_pdev) {
+ dev_err(hdmi->dev, "Waiting for CEC device %s\n",
+ cec_np->full_name);
++ of_node_put(cec_np);
+ return -EPROBE_DEFER;
+ }
++ of_node_put(cec_np);
+ hdmi->cec_dev = &cec_pdev->dev;
+
+ /*
diff --git a/patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch b/patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch
new file mode 100644
index 0000000000..3b0e0f217c
--- /dev/null
+++ b/patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch
@@ -0,0 +1,56 @@
+From f9a7082327e26f54067a49cac2316d31e0cc8ba7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:47 +0200
+Subject: drm/msm: fix OF child-node lookup
+Git-commit: f9a7082327e26f54067a49cac2316d31e0cc8ba7
+Patch-mainline: v4.19-rc2
+References: bsc#1106110
+
+Use the new of_get_compatible_child() helper to lookup the legacy
+pwrlevels child node instead of using of_find_compatible_node(), which
+searches the entire tree from a given start node and thus can return an
+unrelated (i.e. non-child) node.
+
+This also addresses a potential use-after-free (e.g. after probe
+deferral) as the tree-wide helper drops a reference to its first
+argument (i.e. the probed device's node).
+
+While at it, also fix the related child-node reference leak.
+
+Backporting notes:
+
+ * apply changes in adreno_device.c
+
+Fixes: e2af8b6b0ca1 ("drm/msm: gpu: Use OPP tables if we can")
+Cc: stable <stable@vger.kernel.org> # 4.12
+Cc: Jordan Crouse <jcrouse@codeaurora.org>
+Cc: Rob Clark <robdclark@gmail.com>
+Cc: David Airlie <airlied@linux.ie>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/msm/adreno/adreno_device.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/msm/adreno/adreno_device.c
++++ b/drivers/gpu/drm/msm/adreno/adreno_device.c
+@@ -220,8 +220,7 @@ static int adreno_get_legacy_pwrlevels(s
+ struct device_node *child, *node;
+ int ret;
+
+- node = of_find_compatible_node(dev->of_node, NULL,
+- "qcom,gpu-pwrlevels");
++ node = of_get_compatible_child(dev->of_node, "qcom,gpu-pwrlevels");
+ if (!node) {
+ dev_err(dev, "Could not find the GPU powerlevels\n");
+ return -ENXIO;
+@@ -242,6 +241,8 @@ static int adreno_get_legacy_pwrlevels(s
+ dev_pm_opp_add(dev, val, 0);
+ }
+
++ of_node_put(node);
++
+ return 0;
+ }
+
diff --git a/patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch b/patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
new file mode 100644
index 0000000000..f6e9581e09
--- /dev/null
+++ b/patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
@@ -0,0 +1,54 @@
+From 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd Mon Sep 17 00:00:00 2001
+From: Peter Rosin <peda@axentia.se>
+Date: Mon, 6 Aug 2018 08:19:09 +0200
+Subject: drm/sti: do not remove the drm_bridge that was never added
+Git-commit: 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+Removing the drm_bridge_remove call should avoid a NULL dereference
+during list processing in drm_bridge_remove if the error path is ever
+taken.
+
+The more natural approach would perhaps be to add a drm_bridge_add,
+but there are several other bridges that never call drm_bridge_add.
+Just removing the drm_bridge_remove is the easier fix.
+
+Fixes: 84601dbdea36 ("drm: sti: rework init sequence")
+Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Benjamin Gaignard <benjamin.gaignard@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/sti/sti_hda.c | 1 -
+ drivers/gpu/drm/sti/sti_hdmi.c | 1 -
+ 2 files changed, 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c
+index 49438337f70d..19b9b5ed1297 100644
+--- a/drivers/gpu/drm/sti/sti_hda.c
++++ b/drivers/gpu/drm/sti/sti_hda.c
+@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ return -EINVAL;
+ }
+
+diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c
+index 34cdc4644435..ccf718404a1c 100644
+--- a/drivers/gpu/drm/sti/sti_hdmi.c
++++ b/drivers/gpu/drm/sti/sti_hdmi.c
+@@ -1315,7 +1315,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data)
+ return 0;
+
+ err_sysfs:
+- drm_bridge_remove(bridge);
+ hdmi->drm_connector = NULL;
+ return -EINVAL;
+ }
+--
+2.19.1
+
diff --git a/patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch b/patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
new file mode 100644
index 0000000000..c3f3505f42
--- /dev/null
+++ b/patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
@@ -0,0 +1,54 @@
+From 09c4b49457434fa74749ad6194ef28464d9f5df9 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 4 Jul 2018 12:42:50 +0300
+Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
+Git-commit: 09c4b49457434fa74749ad6194ef28464d9f5df9
+Patch-mainline: v4.20-rc1
+References: bsc#1113722
+
+This doesn't affect runtime because in the current code "idx" is always
+valid.
+
+First, we read from "vgdev->capsets[idx].max_size" before checking
+whether "idx" is within bounds. And secondly the bounds check is off by
+one so we could end up reading one element beyond the end of the
+vgdev->capsets[] array.
+
+Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 020070d483d3..4735bd1c7321 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -648,11 +648,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ {
+ struct virtio_gpu_get_capset *cmd_p;
+ struct virtio_gpu_vbuffer *vbuf;
+- int max_size = vgdev->capsets[idx].max_size;
++ int max_size;
+ struct virtio_gpu_drv_cap_cache *cache_ent;
+ void *resp_buf;
+
+- if (idx > vgdev->num_capsets)
++ if (idx >= vgdev->num_capsets)
+ return -EINVAL;
+
+ if (version > vgdev->capsets[idx].max_version)
+@@ -662,6 +662,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev,
+ if (!cache_ent)
+ return -ENOMEM;
+
++ max_size = vgdev->capsets[idx].max_size;
+ cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL);
+ if (!cache_ent->caps_cache) {
+ kfree(cache_ent);
+--
+2.19.1
+
diff --git a/patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch b/patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch
new file mode 100644
index 0000000000..469f7e5b5c
--- /dev/null
+++ b/patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch
@@ -0,0 +1,96 @@
+From 36156f9241cb0f9e37d998052873ca7501ad4b36 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Mon, 27 Aug 2018 10:21:45 +0200
+Subject: of: add helper to lookup compatible child node
+Git-commit: 36156f9241cb0f9e37d998052873ca7501ad4b36
+Patch-mainline: v4.19-rc1
+References: bsc#1106110
+
+Add of_get_compatible_child() helper that can be used to lookup
+compatible child nodes.
+
+Several drivers currently use of_find_compatible_node() to lookup child
+nodes while failing to notice that the of_find_ functions search the
+entire tree depth-first (from a given start node) and therefore can
+match unrelated nodes. The fact that these functions also drop a
+reference to the node they start searching from (e.g. the parent node)
+is typically also overlooked, something which can lead to use-after-free
+bugs.
+
+Backporting notes:
+
+ * backported for ceff3f4dcd44 and f9a7082327e2
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Rob Herring <robh@kernel.org>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/of/base.c | 25 +++++++++++++++++++++++++
+ include/linux/of.h | 8 ++++++++
+ 2 files changed, 33 insertions(+)
+
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 466e3c8582f0..bc420d2aa5f5 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -719,6 +719,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node,
+ }
+ EXPORT_SYMBOL(of_get_next_available_child);
+
++/**
++ * of_get_compatible_child - Find compatible child node
++ * @parent: parent node
++ * @compatible: compatible string
++ *
++ * Lookup child node whose compatible property contains the given compatible
++ * string.
++ *
++ * Returns a node pointer with refcount incremented, use of_node_put() on it
++ * when done; or NULL if not found.
++ */
++struct device_node *of_get_compatible_child(const struct device_node *parent,
++ const char *compatible)
++{
++ struct device_node *child;
++
++ for_each_child_of_node(parent, child) {
++ if (of_device_is_compatible(child, compatible))
++ break;
++ }
++
++ return child;
++}
++EXPORT_SYMBOL(of_get_compatible_child);
++
+ /**
+ * of_get_child_by_name - Find the child node by name for a given parent
+ * @node: parent node
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 4d25e4f952d9..b99a1a8c2952 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -290,6 +290,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node,
+ extern struct device_node *of_get_next_available_child(
+ const struct device_node *node, struct device_node *prev);
+
++extern struct device_node *of_get_compatible_child(const struct device_node *parent,
++ const char *compatible);
+ extern struct device_node *of_get_child_by_name(const struct device_node *node,
+ const char *name);
+
+@@ -632,6 +634,12 @@ static inline bool of_have_populated_dt(void)
+ return false;
+ }
+
++static inline struct device_node *of_get_compatible_child(const struct device_node *parent,
++ const char *compatible)
++{
++ return NULL;
++}
++
+ static inline struct device_node *of_get_child_by_name(
+ const struct device_node *node,
+ const char *name)
+--
+2.19.1
+
diff --git a/patches.fixes/0001-x86-boot-KASLR-Work-around-firmware-bugs-by-excludin.patch b/patches.fixes/0001-x86-boot-KASLR-Work-around-firmware-bugs-by-excludin.patch
new file mode 100644
index 0000000000..de9ac5767f
--- /dev/null
+++ b/patches.fixes/0001-x86-boot-KASLR-Work-around-firmware-bugs-by-excludin.patch
@@ -0,0 +1,126 @@
+From 0982adc746736a313dac9cb8cc936ca51ca3741a Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Mon, 28 Aug 2017 16:30:59 +0900
+Subject: [PATCH] x86/boot/KASLR: Work around firmware bugs by excluding
+ EFI_BOOT_SERVICES_* and EFI_LOADER_* from KASLR's choice
+Git-commit: 0982adc746736a313dac9cb8cc936ca51ca3741a
+Patch-mainline: v4.14-rc1
+References: bnc#1112878
+
+There's a potential bug in how we select the KASLR kernel address n
+the early boot code.
+
+The KASLR boot code currently chooses the kernel image's physical memory
+location from E820_TYPE_RAM regions by walking over all e820 entries.
+
+E820_TYPE_RAM includes EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA
+as well, so those regions can end up hosting the kernel image. According to
+the UEFI spec, all memory regions marked as EfiBootServicesCode and
+EfiBootServicesData are available as free memory after the first call
+to ExitBootServices(). I.e. so such regions should be usable for the
+kernel, per spec.
+
+In real life however, we have workarounds for broken x86 firmware,
+where we keep such regions reserved until SetVirtualAddressMap() is done.
+
+See the following code in should_map_region():
+
+ static bool should_map_region(efi_memory_desc_t *md)
+ {
+ ...
+ /*
+ * Map boot services regions as a workaround for buggy
+ * firmware that accesses them even when they shouldn't.
+ *
+ * See efi_{reserve,free}_boot_services().
+ */
+ if (md->type =3D=3D EFI_BOOT_SERVICES_CODE ||
+ md->type =3D=3D EFI_BOOT_SERVICES_DATA)
+ return false;
+
+This workaround suppressed a boot crash, but potential issues still
+remain because no one prevents the regions from overlapping with kernel
+image by KASLR.
+
+So let's make sure that EFI_BOOT_SERVICES_{CODE|DATA} regions are never
+chosen as kernel memory for the workaround to work fine.
+
+Furthermore, EFI_LOADER_{CODE|DATA} regions are also excluded because
+they can be used after ExitBootServices() as defined in EFI spec.
+
+As a result, we choose kernel address only from EFI_CONVENTIONAL_MEMORY
+which is the only memory type we know to be safely free.
+
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: Baoquan He <bhe@redhat.com>
+Cc: Junichi Nomura <j-nomura@ce.jp.nec.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Garnier <thgarnie@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: fanc.fnst@cn.fujitsu.com
+Cc: izumi.taku@jp.fujitsu.com
+Link: http://lkml.kernel.org/r/20170828074444.GC23181@hori1.linux.bs1.fc.nec.co.jp
+[ Rewrote/fixed/clarified the changelog and the in code comments. ]
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Lee, Chun-Yi <jlee@suse.com>
+---
+ arch/x86/boot/compressed/kaslr.c | 40 ++++++++++++++++++++++++++++++---------
+ 1 file changed, 31 insertions(+), 9 deletions(-)
+
+--- a/arch/x86/boot/compressed/kaslr.c
++++ b/arch/x86/boot/compressed/kaslr.c
+@@ -619,19 +619,41 @@ process_efi_entries(unsigned long minimu
+ for (i = 0; i < nr_desc; i++) {
+ md = efi_early_memdesc_ptr(pmap, e->efi_memdesc_size, i);
+ if (md->attribute & EFI_MEMORY_MORE_RELIABLE) {
+- region.start = md->phys_addr;
+- region.size = md->num_pages << EFI_PAGE_SHIFT;
+- process_mem_region(&region, minimum, image_size);
+ efi_mirror_found = true;
+-
+- if (slot_area_index == MAX_SLOT_AREA) {
+- debug_putstr("Aborted EFI scan (slot_areas full)!\n");
+- break;
+- }
++ break;
+ }
+ }
+
+- return efi_mirror_found;
++ for (i = 0; i < nr_desc; i++) {
++ md = efi_early_memdesc_ptr(pmap, e->efi_memdesc_size, i);
++
++ /*
++ * Here we are more conservative in picking free memory than
++ * the EFI spec allows:
++ *
++ * According to the spec, EFI_BOOT_SERVICES_{CODE|DATA} are also
++ * free memory and thus available to place the kernel image into,
++ * but in practice there's firmware where using that memory leads
++ * to crashes.
++ *
++ * Only EFI_CONVENTIONAL_MEMORY is guaranteed to be free.
++ */
++ if (md->type != EFI_CONVENTIONAL_MEMORY)
++ continue;
++
++ if (efi_mirror_found &&
++ !(md->attribute & EFI_MEMORY_MORE_RELIABLE))
++ continue;
++
++ region.start = md->phys_addr;
++ region.size = md->num_pages << EFI_PAGE_SHIFT;
++ process_mem_region(&region, minimum, image_size);
++ if (slot_area_index == MAX_SLOT_AREA) {
++ debug_putstr("Aborted EFI scan (slot_areas full)!\n");
++ break;
++ }
++ }
++ return true;
+ }
+ #else
+ static inline bool
diff --git a/patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch b/patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch
new file mode 100644
index 0000000000..e1dd1dd586
--- /dev/null
+++ b/patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch
@@ -0,0 +1,104 @@
+From 6ba9fc8e628becf0e3ec94083450d089b0dec5f5 Mon Sep 17 00:00:00 2001
+From: Qu Wenruo <wqu@suse.com>
+Date: Fri, 7 Sep 2018 14:16:24 +0800
+Patch-mainline: v4.20
+Git-commit: 6ba9fc8e628becf0e3ec94083450d089b0dec5f5
+References: bsc#1113667
+Subject: [PATCH 2/2] btrfs: Ensure btrfs_trim_fs can trim the whole filesystem
+
+[BUG]
+fstrim on some btrfs only trims the unallocated space, not trimming any
+space in existing block groups.
+
+[CAUSE]
+Before fstrim_range passed to btrfs_trim_fs(), it gets truncated to
+range [0, super->total_bytes). So later btrfs_trim_fs() will only be
+able to trim block groups in range [0, super->total_bytes).
+
+While for btrfs, any bytenr aligned to sectorsize is valid, since btrfs
+uses its logical address space, there is nothing limiting the location
+where we put block groups.
+
+For filesystem with frequent balance, it's quite easy to relocate all
+block groups and bytenr of block groups will start beyond
+super->total_bytes.
+
+In that case, btrfs will not trim existing block groups.
+
+[FIX]
+Just remove the truncation in btrfs_ioctl_fitrim(), so btrfs_trim_fs()
+can get the unmodified range, which is normally set to [0, U64_MAX].
+
+Reported-by: Chris Murphy <lists@colorremedies.com>
+Fixes: f4c697e6406d ("btrfs: return EINVAL if start > total_bytes in fitrim ioctl")
+CC: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent-tree.c | 10 +---------
+ fs/btrfs/ioctl.c | 11 +++++++----
+ 2 files changed, 8 insertions(+), 13 deletions(-)
+
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 5dbb3f713125..da3257585e29 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10851,21 +10851,13 @@ int btrfs_trim_fs(struct btrfs_fs_info *fs_info, struct fstrim_range *range)
+ u64 start;
+ u64 end;
+ u64 trimmed = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ u64 bg_failed = 0;
+ u64 dev_failed = 0;
+ int bg_ret = 0;
+ int dev_ret = 0;
+ int ret = 0;
+
+- /*
+- * try to trim all FS space, our block group may start from non-zero.
+- */
+- if (range->len == total_bytes)
+- cache = btrfs_lookup_first_block_group(fs_info, range->start);
+- else
+- cache = btrfs_lookup_block_group(fs_info, range->start);
+-
++ cache = btrfs_lookup_first_block_group(fs_info, range->start);
+ for (; cache; cache = next_block_group(fs_info, cache)) {
+ if (cache->key.objectid >= (range->start + range->len)) {
+ btrfs_put_block_group(cache);
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 4905d13dee0a..a990a9045139 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -491,7 +491,6 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ struct fstrim_range range;
+ u64 minlen = ULLONG_MAX;
+ u64 num_devices = 0;
+- u64 total_bytes = btrfs_super_total_bytes(fs_info->super_copy);
+ int ret;
+
+ if (!capable(CAP_SYS_ADMIN))
+@@ -515,11 +514,15 @@ static noinline int btrfs_ioctl_fitrim(struct file *file, void __user *arg)
+ return -EOPNOTSUPP;
+ if (copy_from_user(&range, arg, sizeof(range)))
+ return -EFAULT;
+- if (range.start > total_bytes ||
+- range.len < fs_info->sb->s_blocksize)
++
++ /*
++ * NOTE: Don't truncate the range using super->total_bytes. Bytenr of
++ * block group is in the logical address space, which can be any
++ * sectorsize aligned bytenr in the range [0, U64_MAX].
++ */
++ if (range.len < fs_info->sb->s_blocksize)
+ return -EINVAL;
+
+- range.len = min(range.len, total_bytes - range.start);
+ range.minlen = max(range.minlen, minlen);
+ ret = btrfs_trim_fs(fs_info, &range);
+ if (ret < 0)
+--
+2.19.1
+
diff --git a/patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch b/patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch
new file mode 100644
index 0000000000..467a42aa35
--- /dev/null
+++ b/patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch
@@ -0,0 +1,38 @@
+From e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276 Mon Sep 17 00:00:00 2001
+From: Young_X <YangX92@hotmail.com>
+Date: Wed, 3 Oct 2018 12:54:29 +0000
+Subject: [PATCH] cdrom: fix improper type cast, which can leat to information leak.
+Git-commit: e4f3aa2e1e67bb48dfbaaf1cad59013d5a5bc276
+Patch-mainline: v4.20-rc1
+References: CVE-2018-18710,bsc#1113751
+
+There is another cast from unsigned long to int which causes
+a bounds check to fail with specially crafted input. The value is
+then used as an index in the slot array in cdrom_slot_status().
+
+This issue is similar to CVE-2018-16658 and CVE-2018-10940.
+
+Signed-off-by: Young_X <YangX92@hotmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/cdrom/cdrom.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index a5d5a96479bf..10802d1fc554 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2445,7 +2445,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi,
+ return -ENOSYS;
+
+ if (arg != CDSL_CURRENT && arg != CDSL_NONE) {
+- if ((int)arg >= cdi->capacity)
++ if (arg >= cdi->capacity)
+ return -EINVAL;
+ }
+
+--
+2.19.1
+
diff --git a/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch b/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch
index b7f8953929..57863c3817 100644
--- a/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch
+++ b/patches.fixes/fs-aio-fix-the-increment-of-aio-nr-and-counting-agai.patch
@@ -3,7 +3,7 @@ Date: Wed, 5 Jul 2017 10:53:16 -0300
Subject: fs: aio: fix the increment of aio-nr and counting against aio-max-nr
Patch-mainline: v4.14-rc1
Git-commit: 2a8a98673c13cb2a61a6476153acf8344adfa992
-References: bsc#1068075, bsc#1078921
+References: bsc#1068075, bsc#1078921, bsc#1104124
Currently, aio-nr is incremented in steps of 'num_possible_cpus() * 8'
for io_setup(nr_events, ..) with 'nr_events < num_possible_cpus() * 4':
diff --git a/patches.fixes/libnvdimm-dimm-maximize-label-transfer-size.patch b/patches.fixes/libnvdimm-dimm-maximize-label-transfer-size.patch
new file mode 100644
index 0000000000..e1194a8b8b
--- /dev/null
+++ b/patches.fixes/libnvdimm-dimm-maximize-label-transfer-size.patch
@@ -0,0 +1,71 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Wed, 10 Oct 2018 16:38:24 -0700
+Subject: libnvdimm, dimm: Maximize label transfer size
+Git-commit: d11cf4a7321b538563b0ab30dc0d1f18f9c56226
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+Use kvzalloc() to bypass the arbitrary PAGE_SIZE limit of label transfer
+operations. Given the expense of calling into firmware, maximize the
+amount of label data we transfer per call to be up to the total label
+space if allowed by the firmware.
+
+Instead of limiting based on PAGE_SIZE we can instead simply limit the
+maximum size based on either the config_size int he case of the get
+operation, or the length of the write based on the set operation.
+
+On a system with 24 NVDIMM modules each with a config_size of 128K and a
+maximum transfer size of 64K - 4, this patch reduces the init time for the
+label data from around 24 seconds down to between 4-5 seconds.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/dimm_devs.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/drivers/nvdimm/dimm_devs.c
++++ b/drivers/nvdimm/dimm_devs.c
+@@ -110,8 +110,8 @@ int nvdimm_init_config_data(struct nvdim
+ if (!ndd->data)
+ return -ENOMEM;
+
+- max_cmd_size = min_t(u32, PAGE_SIZE, ndd->nsarea.max_xfer);
+- cmd = kzalloc(max_cmd_size + sizeof(*cmd), GFP_KERNEL);
++ max_cmd_size = min_t(u32, ndd->nsarea.config_size, ndd->nsarea.max_xfer);
++ cmd = kvzalloc(max_cmd_size + sizeof(*cmd), GFP_KERNEL);
+ if (!cmd)
+ return -ENOMEM;
+
+@@ -133,7 +133,7 @@ int nvdimm_init_config_data(struct nvdim
+ memcpy(ndd->data + offset, cmd->out_buf, cmd->in_length);
+ }
+ dev_dbg(ndd->dev, "%s: len: %zu rc: %d\n", __func__, offset, rc);
+- kfree(cmd);
++ kvfree(cmd);
+
+ return rc;
+ }
+@@ -156,9 +156,8 @@ int nvdimm_set_config_data(struct nvdimm
+ if (offset + len > ndd->nsarea.config_size)
+ return -ENXIO;
+
+- max_cmd_size = min_t(u32, PAGE_SIZE, len);
+- max_cmd_size = min_t(u32, max_cmd_size, ndd->nsarea.max_xfer);
+- cmd = kzalloc(max_cmd_size + sizeof(*cmd) + sizeof(u32), GFP_KERNEL);
++ max_cmd_size = min_t(u32, len, ndd->nsarea.max_xfer);
++ cmd = kvzalloc(max_cmd_size + sizeof(*cmd) + sizeof(u32), GFP_KERNEL);
+ if (!cmd)
+ return -ENOMEM;
+
+@@ -182,7 +181,7 @@ int nvdimm_set_config_data(struct nvdimm
+ break;
+ }
+ }
+- kfree(cmd);
++ kvfree(cmd);
+
+ return rc;
+ }
diff --git a/patches.fixes/libnvdimm-label-change-nvdimm_num_label_slots-per-uefi-2-7.patch b/patches.fixes/libnvdimm-label-change-nvdimm_num_label_slots-per-uefi-2-7.patch
new file mode 100644
index 0000000000..2f7a23858b
--- /dev/null
+++ b/patches.fixes/libnvdimm-label-change-nvdimm_num_label_slots-per-uefi-2-7.patch
@@ -0,0 +1,79 @@
+From: Toshi Kani <toshi.kani@hpe.com>
+Date: Fri, 23 Feb 2018 14:59:22 -0700
+Subject: libnvdimm, label: change nvdimm_num_label_slots per UEFI 2.7
+Git-commit: 9e694d9c18dde0fa57ec067043b581bd57c9fb65
+Patch-mainline: v4.17-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+sizeof_namespace_index() fails when NVDIMM devices have the minimum
+1024 bytes label storage area. nvdimm_num_label_slots() returns 3
+slots while the area is only big enough for 2 slots.
+
+Change nvdimm_num_label_slots() to calculate a number of label slots
+according to UEFI 2.7 spec.
+
+Signed-off-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/label.c | 34 ++++++++++++++++++++++++----------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index c858cfadea40..1d28cd656536 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -45,9 +45,27 @@ unsigned sizeof_namespace_label(struct nvdimm_drvdata *ndd)
+ return ndd->nslabel_size;
+ }
+
++static size_t __sizeof_namespace_index(u32 nslot)
++{
++ return ALIGN(sizeof(struct nd_namespace_index) + DIV_ROUND_UP(nslot, 8),
++ NSINDEX_ALIGN);
++}
++
++static int __nvdimm_num_label_slots(struct nvdimm_drvdata *ndd,
++ size_t index_size)
++{
++ return (ndd->nsarea.config_size - index_size * 2) /
++ sizeof_namespace_label(ndd);
++}
++
+ int nvdimm_num_label_slots(struct nvdimm_drvdata *ndd)
+ {
+- return ndd->nsarea.config_size / (sizeof_namespace_label(ndd) + 1);
++ u32 tmp_nslot, n;
++
++ tmp_nslot = ndd->nsarea.config_size / sizeof_namespace_label(ndd);
++ n = __sizeof_namespace_index(tmp_nslot) / NSINDEX_ALIGN;
++
++ return __nvdimm_num_label_slots(ndd, NSINDEX_ALIGN * n);
+ }
+
+ size_t sizeof_namespace_index(struct nvdimm_drvdata *ndd)
+@@ -55,18 +73,14 @@ size_t sizeof_namespace_index(struct nvdimm_drvdata *ndd)
+ u32 nslot, space, size;
+
+ /*
+- * The minimum index space is 512 bytes, with that amount of
+- * index we can describe ~1400 labels which is less than a byte
+- * of overhead per label. Round up to a byte of overhead per
+- * label and determine the size of the index region. Yes, this
+- * starts to waste space at larger config_sizes, but it's
+- * unlikely we'll ever see anything but 128K.
++ * Per UEFI 2.7, the minimum size of the Label Storage Area is large
++ * enough to hold 2 index blocks and 2 labels. The minimum index
++ * block size is 256 bytes, and the minimum label size is 256 bytes.
+ */
+ nslot = nvdimm_num_label_slots(ndd);
+ space = ndd->nsarea.config_size - nslot * sizeof_namespace_label(ndd);
+- size = ALIGN(sizeof(struct nd_namespace_index) + DIV_ROUND_UP(nslot, 8),
+- NSINDEX_ALIGN) * 2;
+- if (size <= space)
++ size = __sizeof_namespace_index(nslot) * 2;
++ if (size <= space && nslot >= 2)
+ return size / 2;
+
+ dev_err(ndd->dev, "label area (%d) too small to host (%d byte) labels\n",
+
diff --git a/patches.fixes/libnvdimm-label-fix-sparse-warning.patch b/patches.fixes/libnvdimm-label-fix-sparse-warning.patch
new file mode 100644
index 0000000000..2dfa8f3626
--- /dev/null
+++ b/patches.fixes/libnvdimm-label-fix-sparse-warning.patch
@@ -0,0 +1,46 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 11 Oct 2018 18:25:20 -0700
+Subject: libnvdimm, label: Fix sparse warning
+Git-commit: 97052c1c31d5bcf08823ce1ea272447edd2d52de
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+The kbuild robot reports:
+
+drivers/nvdimm/label.c:500:32: warning: restricted __le32 degrades to integer
+
+...read 'nslot' into a local u32.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Acked-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/label.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 7f03d117824f..750dbaa6ce82 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -424,6 +424,7 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd)
+ struct nd_namespace_index *nsindex;
+ unsigned int i;
+ int rc = 0;
++ u32 nslot;
+
+ if (ndd->data)
+ return 0;
+@@ -495,9 +496,10 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd)
+
+ /* Determine starting offset for label data */
+ offset = __le64_to_cpu(nsindex->labeloff);
++ nslot = __le32_to_cpu(nsindex->nslot);
+
+ /* Loop through the free list pulling in any active labels */
+- for (i = 0; i < nsindex->nslot; i++, offset += ndd->nslabel_size) {
++ for (i = 0; i < nslot; i++, offset += ndd->nslabel_size) {
+ size_t label_read_size;
+
+ /* zero out the unused labels */
+
diff --git a/patches.fixes/nvdimm-clarify-comment-in-sizeof_namespace_index.patch b/patches.fixes/nvdimm-clarify-comment-in-sizeof_namespace_index.patch
new file mode 100644
index 0000000000..df9ac85d50
--- /dev/null
+++ b/patches.fixes/nvdimm-clarify-comment-in-sizeof_namespace_index.patch
@@ -0,0 +1,40 @@
+From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Date: Wed, 10 Oct 2018 16:38:55 -0700
+Subject: nvdimm: Clarify comment in sizeof_namespace_index
+Git-commit: 1cfeb66e8e137be8e01b88bb4d416e987abda4a4
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+When working on the label code I found it rather confusing to see several
+spots that reference a minimum label size of 256 while working with labels
+that are 128 bytes in size.
+
+This patch is meant to provide a clarification on one of the comments that
+was at the heart of the issue. Specifically for version 1.2 and later of
+the namespace specification the minimum label size is 256, prior to that
+the minimum label size was 128. So we should state that as such to avoid
+confusion.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/label.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 1f5842509dbc..bb813b8e8ace 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -75,7 +75,8 @@ size_t sizeof_namespace_index(struct nvdimm_drvdata *ndd)
+ /*
+ * Per UEFI 2.7, the minimum size of the Label Storage Area is large
+ * enough to hold 2 index blocks and 2 labels. The minimum index
+- * block size is 256 bytes, and the minimum label size is 256 bytes.
++ * block size is 256 bytes. The label size is 128 for namespaces
++ * prior to version 1.2 and at minimum 256 for version 1.2 and later.
+ */
+ nslot = nvdimm_num_label_slots(ndd);
+ space = ndd->nsarea.config_size - nslot * sizeof_namespace_label(ndd);
+
diff --git a/patches.fixes/nvdimm-remove-empty-if-statement.patch b/patches.fixes/nvdimm-remove-empty-if-statement.patch
new file mode 100644
index 0000000000..59914d4a43
--- /dev/null
+++ b/patches.fixes/nvdimm-remove-empty-if-statement.patch
@@ -0,0 +1,38 @@
+From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Date: Wed, 10 Oct 2018 16:39:06 -0700
+Subject: nvdimm: Remove empty if statement
+Git-commit: 19418b024427ec60ba6084addf691a8d93670398
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+This patch removes an empty statement from an if expression and promotes
+the else statement to the if expression with the expression logic reversed.
+
+I feel this is more readable as the empty statement can lead to issues if
+any additional logic was ever added.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/label.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index bb813b8e8ace..43bad0d5bdb6 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -261,9 +261,8 @@ int nd_label_validate(struct nvdimm_drvdata *ndd)
+ void nd_label_copy(struct nvdimm_drvdata *ndd, struct nd_namespace_index *dst,
+ struct nd_namespace_index *src)
+ {
+- if (dst && src)
+- /* pass */;
+- else
++ /* just exit if either destination or source is NULL */
++ if (!dst || !src)
+ return;
+
+ memcpy(dst, src, sizeof_namespace_index(ndd));
+
diff --git a/patches.fixes/nvdimm-sanity-check-labeloff.patch b/patches.fixes/nvdimm-sanity-check-labeloff.patch
new file mode 100644
index 0000000000..9b784ab70b
--- /dev/null
+++ b/patches.fixes/nvdimm-sanity-check-labeloff.patch
@@ -0,0 +1,36 @@
+From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Date: Wed, 10 Oct 2018 16:38:41 -0700
+Subject: nvdimm: Sanity check labeloff
+Git-commit: d86d4d63d88861107d3bfc84be7294552231ecd0
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+This patch adds validation for the labeloff field in the indexes.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/label.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 1d28cd656536..1f5842509dbc 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -183,6 +183,13 @@ static int __nd_label_validate(struct nvdimm_drvdata *ndd)
+ __le64_to_cpu(nsindex[i]->otheroff));
+ continue;
+ }
++ if (__le64_to_cpu(nsindex[i]->labeloff)
++ != 2 * sizeof_namespace_index(ndd)) {
++ dev_dbg(dev, "nsindex%d labeloff: %#llx invalid\n",
++ i, (unsigned long long)
++ __le64_to_cpu(nsindex[i]->labeloff));
++ continue;
++ }
+
+ size = __le64_to_cpu(nsindex[i]->mysize);
+ if (size > sizeof_namespace_index(ndd)
+
diff --git a/patches.fixes/nvdimm-split-label-init-out-from-the-logic-for-getting-config-data.patch b/patches.fixes/nvdimm-split-label-init-out-from-the-logic-for-getting-config-data.patch
new file mode 100644
index 0000000000..b74d58adf0
--- /dev/null
+++ b/patches.fixes/nvdimm-split-label-init-out-from-the-logic-for-getting-config-data.patch
@@ -0,0 +1,199 @@
+From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Date: Wed, 10 Oct 2018 16:39:20 -0700
+Subject: nvdimm: Split label init out from the logic for getting config data
+Git-commit: 2d657d17f72d2ae70c02f0d0ea6a04ad0f016b57
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+This patch splits the initialization of the label data into two functions.
+One for doing the init, and another for reading the actual configuration
+data. The idea behind this is that by doing this we create a symmetry
+between the getting and setting of config data in that we have a function
+for both. In addition it will make it easier for us to identify the bits
+that are related to init versus the pieces that are a wrapper for reading
+data from the ACPI interface.
+
+So for example by splitting things out like this it becomes much more
+obvious that we were performing checks that weren't necessarily related to
+the set/get operations such as relying on ndd->data being present when the
+set and get ops should not care about a locally cached copy of the label
+area.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/dimm.c | 2 -
+ drivers/nvdimm/dimm_devs.c | 49 +++++++++++++++++----------------------------
+ drivers/nvdimm/label.c | 38 ++++++++++++++++++++++++++++++++++
+ drivers/nvdimm/label.h | 1
+ drivers/nvdimm/nd.h | 2 +
+ 5 files changed, 61 insertions(+), 31 deletions(-)
+
+--- a/drivers/nvdimm/dimm.c
++++ b/drivers/nvdimm/dimm.c
+@@ -54,7 +54,7 @@ static int nvdimm_probe(struct device *d
+ if (rc)
+ goto err;
+
+- rc = nvdimm_init_config_data(ndd);
++ rc = nd_label_data_init(ndd);
+ if (rc == -EACCES)
+ nvdimm_set_locked(dev);
+ if (rc)
+--- a/drivers/nvdimm/dimm_devs.c
++++ b/drivers/nvdimm/dimm_devs.c
+@@ -84,55 +84,47 @@ int nvdimm_init_nsarea(struct nvdimm_drv
+ return cmd_rc;
+ }
+
+-int nvdimm_init_config_data(struct nvdimm_drvdata *ndd)
++int nvdimm_get_config_data(struct nvdimm_drvdata *ndd, void *buf,
++ size_t offset, size_t len)
+ {
+ struct nvdimm_bus *nvdimm_bus = walk_to_nvdimm_bus(ndd->dev);
++ struct nvdimm_bus_descriptor *nd_desc = nvdimm_bus->nd_desc;
+ int rc = validate_dimm(ndd), cmd_rc = 0;
+ struct nd_cmd_get_config_data_hdr *cmd;
+- struct nvdimm_bus_descriptor *nd_desc;
+- u32 max_cmd_size, config_size;
+- size_t offset;
++ size_t max_cmd_size, buf_offset;
+
+ if (rc)
+ return rc;
+
+- if (ndd->data)
+- return 0;
+-
+- if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0
+- || ndd->nsarea.config_size < ND_LABEL_MIN_SIZE) {
+- dev_dbg(ndd->dev, "failed to init config data area: (%d:%d)\n",
+- ndd->nsarea.max_xfer, ndd->nsarea.config_size);
++ if (offset + len > ndd->nsarea.config_size)
+ return -ENXIO;
+- }
+-
+- ndd->data = kvmalloc(ndd->nsarea.config_size, GFP_KERNEL);
+- if (!ndd->data)
+- return -ENOMEM;
+
+- max_cmd_size = min_t(u32, ndd->nsarea.config_size, ndd->nsarea.max_xfer);
++ max_cmd_size = min_t(u32, len, ndd->nsarea.max_xfer);
+ cmd = kvzalloc(max_cmd_size + sizeof(*cmd), GFP_KERNEL);
+ if (!cmd)
+ return -ENOMEM;
+
+- nd_desc = nvdimm_bus->nd_desc;
+- for (config_size = ndd->nsarea.config_size, offset = 0;
+- config_size; config_size -= cmd->in_length,
+- offset += cmd->in_length) {
+- cmd->in_length = min(config_size, max_cmd_size);
+- cmd->in_offset = offset;
++ for (buf_offset = 0; len;
++ len -= cmd->in_length, buf_offset += cmd->in_length) {
++ size_t cmd_size;
++
++ cmd->in_offset = offset + buf_offset;
++ cmd->in_length = min(max_cmd_size, len);
++
++ cmd_size = sizeof(*cmd) + cmd->in_length;
++
+ rc = nd_desc->ndctl(nd_desc, to_nvdimm(ndd->dev),
+- ND_CMD_GET_CONFIG_DATA, cmd,
+- cmd->in_length + sizeof(*cmd), &cmd_rc);
++ ND_CMD_GET_CONFIG_DATA, cmd, cmd_size, &cmd_rc);
+ if (rc < 0)
+ break;
+ if (cmd_rc < 0) {
+ rc = cmd_rc;
+ break;
+ }
+- memcpy(ndd->data + offset, cmd->out_buf, cmd->in_length);
++
++ /* out_buf should be valid, copy it into our output buffer */
++ memcpy(buf + buf_offset, cmd->out_buf, cmd->in_length);
+ }
+- dev_dbg(ndd->dev, "%s: len: %zu rc: %d\n", __func__, offset, rc);
+ kvfree(cmd);
+
+ return rc;
+@@ -150,9 +142,6 @@ int nvdimm_set_config_data(struct nvdimm
+ if (rc)
+ return rc;
+
+- if (!ndd->data)
+- return -ENXIO;
+-
+ if (offset + len > ndd->nsarea.config_size)
+ return -ENXIO;
+
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -422,6 +422,44 @@ int nd_label_reserve_dpa(struct nvdimm_d
+ return 0;
+ }
+
++int nd_label_data_init(struct nvdimm_drvdata *ndd)
++{
++ size_t config_size, read_size;
++ int rc = 0;
++
++ if (ndd->data)
++ return 0;
++
++ if (ndd->nsarea.status || ndd->nsarea.max_xfer == 0) {
++ dev_dbg(ndd->dev, "failed to init config data area: (%u:%u)\n",
++ ndd->nsarea.max_xfer, ndd->nsarea.config_size);
++ return -ENXIO;
++ }
++
++ /*
++ * We need to determine the maximum index area as this is the section
++ * we must read and validate before we can start processing labels.
++ *
++ * If the area is too small to contain the two indexes and 2 labels
++ * then we abort.
++ *
++ * Start at a label size of 128 as this should result in the largest
++ * possible namespace index size.
++ */
++ ndd->nslabel_size = 128;
++ read_size = sizeof_namespace_index(ndd) * 2;
++ if (!read_size)
++ return -ENXIO;
++
++ /* Allocate config data */
++ config_size = ndd->nsarea.config_size;
++ ndd->data = kvzalloc(config_size, GFP_KERNEL);
++ if (!ndd->data)
++ return -ENOMEM;
++
++ return nvdimm_get_config_data(ndd, ndd->data, 0, config_size);
++}
++
+ int nd_label_active_count(struct nvdimm_drvdata *ndd)
+ {
+ struct nd_namespace_index *nsindex;
+--- a/drivers/nvdimm/label.h
++++ b/drivers/nvdimm/label.h
+@@ -141,6 +141,7 @@ struct nvdimm_drvdata;
+ int nd_label_validate(struct nvdimm_drvdata *ndd);
+ void nd_label_copy(struct nvdimm_drvdata *ndd, struct nd_namespace_index *dst,
+ struct nd_namespace_index *src);
++int nd_label_data_init(struct nvdimm_drvdata *ndd);
+ size_t sizeof_namespace_index(struct nvdimm_drvdata *ndd);
+ int nd_label_active_count(struct nvdimm_drvdata *ndd);
+ struct nd_namespace_label *nd_label_active(struct nvdimm_drvdata *ndd, int n);
+--- a/drivers/nvdimm/nd.h
++++ b/drivers/nvdimm/nd.h
+@@ -247,6 +247,8 @@ struct nvdimm_drvdata *to_ndd(struct nd_
+ int nvdimm_check_config_data(struct device *dev);
+ int nvdimm_init_nsarea(struct nvdimm_drvdata *ndd);
+ int nvdimm_init_config_data(struct nvdimm_drvdata *ndd);
++int nvdimm_get_config_data(struct nvdimm_drvdata *ndd, void *buf,
++ size_t offset, size_t len);
+ int nvdimm_set_config_data(struct nvdimm_drvdata *ndd, size_t offset,
+ void *buf, size_t len);
+ long nvdimm_clear_poison(struct device *dev, phys_addr_t phys,
diff --git a/patches.fixes/nvdimm-use-namespace-index-data-to-reduce-number-of-label-reads-needed.patch b/patches.fixes/nvdimm-use-namespace-index-data-to-reduce-number-of-label-reads-needed.patch
new file mode 100644
index 0000000000..baaf360b8b
--- /dev/null
+++ b/patches.fixes/nvdimm-use-namespace-index-data-to-reduce-number-of-label-reads-needed.patch
@@ -0,0 +1,181 @@
+From: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Date: Wed, 10 Oct 2018 16:39:35 -0700
+Subject: nvdimm: Use namespace index data to reduce number of label reads
+ needed
+Git-commit: 7d47aad4570e5e6e9a8162bb417ca9b74132f27c
+Patch-mainline: v4.20-rc1
+References: bsc#1111921, bsc#1113408, FATE#326765, bsc#1113972
+
+This patch adds logic that is meant to make use of the namespace index data
+to reduce the number of reads that are needed to initialize a given
+namespace. The general idea is that once we have enough data to validate
+the namespace index we do so and then proceed to fetch only those labels
+that are not listed as being "free". By doing this I am seeing a total time
+reduction from about 4-5 seconds to 2-3 seconds for 24 NVDIMM modules each
+with 128K of label config area.
+
+Reviewed-by: Toshi Kani <toshi.kani@hpe.com>
+Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/dimm.c | 4 ---
+ drivers/nvdimm/label.c | 93 +++++++++++++++++++++++++++++++++++++++++++++++---
+ drivers/nvdimm/label.h | 3 --
+ 3 files changed, 88 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c
+index 07bf96948553..9899c97138a3 100644
+--- a/drivers/nvdimm/dimm.c
++++ b/drivers/nvdimm/dimm.c
+@@ -84,10 +84,6 @@ static int nvdimm_probe(struct device *dev)
+ dev_dbg(dev, "config data size: %d\n", ndd->nsarea.config_size);
+
+ nvdimm_bus_lock(dev);
+- ndd->ns_current = nd_label_validate(ndd);
+- ndd->ns_next = nd_label_next_nsindex(ndd->ns_current);
+- nd_label_copy(ndd, to_next_namespace_index(ndd),
+- to_current_namespace_index(ndd));
+ if (ndd->ns_current >= 0) {
+ rc = nd_label_reserve_dpa(ndd);
+ if (rc == 0)
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index 563f24af01b5..7f03d117824f 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -235,7 +235,7 @@ static int __nd_label_validate(struct nvdimm_drvdata *ndd)
+ return -1;
+ }
+
+-int nd_label_validate(struct nvdimm_drvdata *ndd)
++static int nd_label_validate(struct nvdimm_drvdata *ndd)
+ {
+ /*
+ * In order to probe for and validate namespace index blocks we
+@@ -258,8 +258,9 @@ int nd_label_validate(struct nvdimm_drvdata *ndd)
+ return -1;
+ }
+
+-void nd_label_copy(struct nvdimm_drvdata *ndd, struct nd_namespace_index *dst,
+- struct nd_namespace_index *src)
++static void nd_label_copy(struct nvdimm_drvdata *ndd,
++ struct nd_namespace_index *dst,
++ struct nd_namespace_index *src)
+ {
+ /* just exit if either destination or source is NULL */
+ if (!dst || !src)
+@@ -419,7 +420,9 @@ int nd_label_reserve_dpa(struct nvdimm_drvdata *ndd)
+
+ int nd_label_data_init(struct nvdimm_drvdata *ndd)
+ {
+- size_t config_size, read_size;
++ size_t config_size, read_size, max_xfer, offset;
++ struct nd_namespace_index *nsindex;
++ unsigned int i;
+ int rc = 0;
+
+ if (ndd->data)
+@@ -452,7 +455,87 @@ int nd_label_data_init(struct nvdimm_drvdata *ndd)
+ if (!ndd->data)
+ return -ENOMEM;
+
+- return nvdimm_get_config_data(ndd, ndd->data, 0, config_size);
++ /*
++ * We want to guarantee as few reads as possible while conserving
++ * memory. To do that we figure out how much unused space will be left
++ * in the last read, divide that by the total number of reads it is
++ * going to take given our maximum transfer size, and then reduce our
++ * maximum transfer size based on that result.
++ */
++ max_xfer = min_t(size_t, ndd->nsarea.max_xfer, config_size);
++ if (read_size < max_xfer) {
++ /* trim waste */
++ max_xfer -= ((max_xfer - 1) - (config_size - 1) % max_xfer) /
++ DIV_ROUND_UP(config_size, max_xfer);
++ /* make certain we read indexes in exactly 1 read */
++ if (max_xfer < read_size)
++ max_xfer = read_size;
++ }
++
++ /* Make our initial read size a multiple of max_xfer size */
++ read_size = min(DIV_ROUND_UP(read_size, max_xfer) * max_xfer,
++ config_size);
++
++ /* Read the index data */
++ rc = nvdimm_get_config_data(ndd, ndd->data, 0, read_size);
++ if (rc)
++ goto out_err;
++
++ /* Validate index data, if not valid assume all labels are invalid */
++ ndd->ns_current = nd_label_validate(ndd);
++ if (ndd->ns_current < 0)
++ return 0;
++
++ /* Record our index values */
++ ndd->ns_next = nd_label_next_nsindex(ndd->ns_current);
++
++ /* Copy "current" index on top of the "next" index */
++ nsindex = to_current_namespace_index(ndd);
++ nd_label_copy(ndd, to_next_namespace_index(ndd), nsindex);
++
++ /* Determine starting offset for label data */
++ offset = __le64_to_cpu(nsindex->labeloff);
++
++ /* Loop through the free list pulling in any active labels */
++ for (i = 0; i < nsindex->nslot; i++, offset += ndd->nslabel_size) {
++ size_t label_read_size;
++
++ /* zero out the unused labels */
++ if (test_bit_le(i, nsindex->free)) {
++ memset(ndd->data + offset, 0, ndd->nslabel_size);
++ continue;
++ }
++
++ /* if we already read past here then just continue */
++ if (offset + ndd->nslabel_size <= read_size)
++ continue;
++
++ /* if we haven't read in a while reset our read_size offset */
++ if (read_size < offset)
++ read_size = offset;
++
++ /* determine how much more will be read after this next call. */
++ label_read_size = offset + ndd->nslabel_size - read_size;
++ label_read_size = DIV_ROUND_UP(label_read_size, max_xfer) *
++ max_xfer;
++
++ /* truncate last read if needed */
++ if (read_size + label_read_size > config_size)
++ label_read_size = config_size - read_size;
++
++ /* Read the label data */
++ rc = nvdimm_get_config_data(ndd, ndd->data + read_size,
++ read_size, label_read_size);
++ if (rc)
++ goto out_err;
++
++ /* push read_size to next read offset */
++ read_size += label_read_size;
++ }
++
++ dev_dbg(ndd->dev, "len: %zu rc: %d\n", offset, rc);
++out_err:
++ return rc;
+ }
+
+ int nd_label_active_count(struct nvdimm_drvdata *ndd)
+diff --git a/drivers/nvdimm/label.h b/drivers/nvdimm/label.h
+index 685afb3de0fe..e9a2ad3c2150 100644
+--- a/drivers/nvdimm/label.h
++++ b/drivers/nvdimm/label.h
+@@ -138,9 +138,6 @@ static inline int nd_label_next_nsindex(int index)
+ }
+
+ struct nvdimm_drvdata;
+-int nd_label_validate(struct nvdimm_drvdata *ndd);
+-void nd_label_copy(struct nvdimm_drvdata *ndd, struct nd_namespace_index *dst,
+- struct nd_namespace_index *src);
+ int nd_label_data_init(struct nvdimm_drvdata *ndd);
+ size_t sizeof_namespace_index(struct nvdimm_drvdata *ndd);
+ int nd_label_active_count(struct nvdimm_drvdata *ndd);
+
diff --git a/patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch b/patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch
new file mode 100644
index 0000000000..402e8eb7b6
--- /dev/null
+++ b/patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch
@@ -0,0 +1,122 @@
+From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Date: Sun, 8 Apr 2018 23:35:28 +0200
+Subject: Kbuild: fix # escaping in .cmd files for future Make
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 9564a8cf422d7b58f6e857e3546d346fa970191e
+Patch-mainline: v4.17-rc1
+References: git-fixes
+
+I tried building using a freshly built Make (4.2.1-69-g8a731d1), but
+already the objtool build broke with
+
+orc_dump.c: In function ‘orc_dump’:
+orc_dump.c:106:2: error: ‘elf_getshnum’ is deprecated [-Werror=deprecated-declarations]
+ if (elf_getshdrnum(elf, &nr_sections)) {
+
+Turns out that with that new Make, the backslash was not removed, so cpp
+didn't see a #include directive, grep found nothing, and
+-DLIBELF_USE_DEPRECATED was wrongly put in CFLAGS.
+
+Now, that new Make behaviour is documented in their NEWS file:
+
+ * WARNING: Backward-incompatibility!
+ Number signs (#) appearing inside a macro reference or function invocation
+ no longer introduce comments and should not be escaped with backslashes:
+ thus a call such as:
+ foo := $(shell echo '#')
+ is legal. Previously the number sign needed to be escaped, for example:
+ foo := $(shell echo '\#')
+ Now this latter will resolve to "\#". If you want to write makefiles
+ portable to both versions, assign the number sign to a variable:
+ C := \#
+ foo := $(shell echo '$C')
+ This was claimed to be fixed in 3.81, but wasn't, for some reason.
+ To detect this change search for 'nocomment' in the .FEATURES variable.
+
+This also fixes up the two make-cmd instances to replace # with $(pound)
+rather than with \#. There might very well be other places that need
+similar fixup in preparation for whatever future Make release contains
+the above change, but at least this builds an x86_64 defconfig with the
+new make.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197847
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ scripts/Kbuild.include | 5 +++--
+ tools/build/Build.include | 5 +++--
+ tools/objtool/Makefile | 2 +-
+ tools/scripts/Makefile.include | 2 ++
+ 4 files changed, 9 insertions(+), 5 deletions(-)
+
+--- a/scripts/Kbuild.include
++++ b/scripts/Kbuild.include
+@@ -8,6 +8,7 @@ squote := '
+ empty :=
+ space := $(empty) $(empty)
+ space_escape := _-_SPACE_-_
++pound := \#
+
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -245,11 +246,11 @@ endif
+
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+
+ # Find any prerequisites that is newer than target or that does not exist.
+ # PHONY targets skipped in both cases.
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -12,6 +12,7 @@
+ # Convenient variables
+ comma := ,
+ squote := '
++pound := \#
+
+ ###
+ # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o
+@@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\
+ ###
+ # Replace >$< with >$$< to preserve $ when reloading the .cmd file
+ # (needed for make)
+-# Replace >#< with >\#< to avoid starting a comment in the .cmd file
++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file
+ # (needed for make)
+ # Replace >'< with >'\''< to be able to enclose the whole string in '...'
+ # (needed for the shell)
+-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1)))))
++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1)))))
+
+ ###
+ # Find any prerequisites that is newer than target or that does not exist.
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -33,7 +33,7 @@ CFLAGS += -Wall -Werror $(EXTRA_WARNIN
+ LDFLAGS += -lelf $(LIBSUBCMD)
+
+ # Allow old libelf to be used:
+-elfshdr := $(shell echo '\#include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
++elfshdr := $(shell echo '$(pound)include <libelf.h>' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr)
+ CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED)
+
+ AWK = awk
+--- a/tools/scripts/Makefile.include
++++ b/tools/scripts/Makefile.include
+@@ -104,3 +104,5 @@ ifneq ($(silent),1)
+ QUIET_INSTALL = @printf ' INSTALL %s\n' $1;
+ endif
+ endif
++
++pound := \#
diff --git a/patches.suse/Revert-drm-nouveau-drm-therm-fan-add-a-fallback-if-n b/patches.suse/Revert-drm-nouveau-drm-therm-fan-add-a-fallback-if-n
deleted file mode 100644
index 3253b65a10..0000000000
--- a/patches.suse/Revert-drm-nouveau-drm-therm-fan-add-a-fallback-if-n
+++ /dev/null
@@ -1,66 +0,0 @@
-From: Takashi Iwai <tiwai@suse.de>
-Subject: [PATCH] Revert "drm/nouveau/drm/therm/fan: add a fallback if no fan control is specified in the vbios"
-References: bsc#1103356
-Patch-mainline: Never, a temporary workaround
-
-This reverts commit 800efb4c2857ec543fdc33585bbcb1fd5ef28337.
-Since it is confirmed to be rather harmful, just revert it until the
-problem gets addressed properly in the upstream.
-
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-
----
- .../gpu/drm/nouveau/nvkm/subdev/therm/base.c | 22 +++----------------
- 1 file changed, 3 insertions(+), 19 deletions(-)
-
-diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
-index 3695cde669f8..699dad03bc5d 100644
---- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
-+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c
-@@ -65,9 +65,10 @@ nvkm_therm_update_trip(struct nvkm_therm *therm)
- }
-
- static int
--nvkm_therm_compute_linear_duty(struct nvkm_therm *therm, u8 linear_min_temp,
-- u8 linear_max_temp)
-+nvkm_therm_update_linear(struct nvkm_therm *therm)
- {
-+ u8 linear_min_temp = therm->fan->bios.linear_min_temp;
-+ u8 linear_max_temp = therm->fan->bios.linear_max_temp;
- u8 temp = therm->func->temp_get(therm);
- u16 duty;
-
-@@ -85,21 +86,6 @@ nvkm_therm_compute_linear_duty(struct nvkm_therm *therm, u8 linear_min_temp,
- return duty;
- }
-
--static int
--nvkm_therm_update_linear(struct nvkm_therm *therm)
--{
-- u8 min = therm->fan->bios.linear_min_temp;
-- u8 max = therm->fan->bios.linear_max_temp;
-- return nvkm_therm_compute_linear_duty(therm, min, max);
--}
--
--static int
--nvkm_therm_update_linear_fallback(struct nvkm_therm *therm)
--{
-- u8 max = therm->bios_sensor.thrs_fan_boost.temp;
-- return nvkm_therm_compute_linear_duty(therm, 30, max);
--}
--
- static void
- nvkm_therm_update(struct nvkm_therm *therm, int mode)
- {
-@@ -134,8 +120,6 @@ nvkm_therm_update(struct nvkm_therm *therm, int mode)
- case NVBIOS_THERM_FAN_OTHER:
- if (therm->cstate)
- duty = therm->cstate;
-- else
-- duty = nvkm_therm_update_linear_fallback(therm);
- poll = false;
- break;
- }
---
-2.18.0
-
diff --git a/patches.suse/drm-i915-CFL-NVMe-breakage-workaround.patch b/patches.suse/drm-i915-CFL-NVMe-breakage-workaround.patch
new file mode 100644
index 0000000000..27134da0ae
--- /dev/null
+++ b/patches.suse/drm-i915-CFL-NVMe-breakage-workaround.patch
@@ -0,0 +1,50 @@
+From: Takashi Iwai <tiwai@suse.de>
+Subject: Workaround for mysterious NVMe breakage with i915 CFL
+Patch-mainline: Never, a temporary workaround
+References: bsc#1111040
+
+A temporary workaround for a new CFL that breaks NVMe by some reason
+at detecting the non-existing HDMI-3 port.
+
+This should be removed once when it gets fixed properly in the upstream
+code.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_hdmi.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_hdmi.c
++++ b/drivers/gpu/drm/i915/intel_hdmi.c
+@@ -1629,21 +1629,27 @@ intel_hdmi_set_edid(struct drm_connector
+ static enum drm_connector_status
+ intel_hdmi_detect(struct drm_connector *connector, bool force)
+ {
+- enum drm_connector_status status;
++ enum drm_connector_status status = connector_status_disconnected;
+ struct drm_i915_private *dev_priv = to_i915(connector->dev);
++ struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector);
++ struct intel_encoder *encoder = &hdmi_to_dig_port(intel_hdmi)->base;
++ struct pci_dev *pdev = dev_priv->drm.pdev;
+
+ DRM_DEBUG_KMS("[CONNECTOR:%d:%s]\n",
+ connector->base.id, connector->name);
+
+ intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS);
+
++ if (pdev->device == 0x3e98 &&
++ !intel_digital_port_connected(encoder))
++ goto out;
++
+ intel_hdmi_unset_edid(connector);
+
+ if (intel_hdmi_set_edid(connector))
+ status = connector_status_connected;
+- else
+- status = connector_status_disconnected;
+
++out:
+ intel_display_power_put(dev_priv, POWER_DOMAIN_GMBUS);
+
+ return status;
diff --git a/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch b/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch
index 003a9307aa..ac0bc4dca9 100644
--- a/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch
+++ b/patches.suse/n_tty-fix-EXTPROC-vs-ICANON-interaction-with-TIOCINQ.patch
@@ -3,7 +3,7 @@ Date: Wed, 20 Dec 2017 17:57:06 -0800
Subject: n_tty: fix EXTPROC vs ICANON interaction with TIOCINQ (aka FIONREAD)
Git-commit: 966031f340185eddd05affcf72b740549f056348
Patch-mainline: v4.15-rc6
-References: bnc#1094825 CVE-2018-18386
+References: bnc#1094825 bnc#1094825 bnc#1110711 CVE-2018-18386
We added support for EXTPROC back in 2010 in commit 26df6d13406d ("tty:
Add EXTPROC support for LINEMODE") and the intent was to allow it to
diff --git a/patches.suse/random-rate-limit-unseeded-randomness-warnings.patch b/patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
new file mode 100644
index 0000000000..31e82d03fb
--- /dev/null
+++ b/patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
@@ -0,0 +1,89 @@
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Wed, 25 Apr 2018 01:12:32 -0400
+Subject: random: rate limit unseeded randomness warnings
+Git-commit: 4e00b339e264802851aff8e73cde7d24b57b18ce
+Patch-mainline: v4.17-rc3
+References: git-fixes
+
+On systems without sufficient boot randomness, no point spamming dmesg.
+
+[js] dropped hunk for unseeded_warning as it is not built anyway
+
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/char/random.c | 34 +++++++++++++++++++++++++++++++---
+ 1 file changed, 31 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -262,6 +262,7 @@
+ #include <linux/kmemcheck.h>
+ #include <linux/workqueue.h>
+ #include <linux/irq.h>
++#include <linux/ratelimit.h>
+ #include <linux/syscalls.h>
+ #include <linux/completion.h>
+ #include <linux/uuid.h>
+@@ -439,6 +440,16 @@ static void _crng_backtrack_protect(stru
+ __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
+ static void process_random_ready_list(void);
+
++static struct ratelimit_state unseeded_warning =
++ RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
++static struct ratelimit_state urandom_warning =
++ RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
++
++static int ratelimit_disable __read_mostly;
++
++module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
++MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
++
+ /**********************************************************************
+ *
+ * OS independent entropy store. Here are the functions which handle
+@@ -932,6 +943,18 @@ static void crng_reseed(struct crng_stat
+ process_random_ready_list();
+ wake_up_interruptible(&crng_init_wait);
+ pr_notice("random: crng init done\n");
++ if (unseeded_warning.missed) {
++ pr_notice("random: %d get_random_xx warning(s) missed "
++ "due to ratelimiting\n",
++ unseeded_warning.missed);
++ unseeded_warning.missed = 0;
++ }
++ if (urandom_warning.missed) {
++ pr_notice("random: %d urandom warning(s) missed "
++ "due to ratelimiting\n",
++ urandom_warning.missed);
++ urandom_warning.missed = 0;
++ }
+ }
+ }
+
+@@ -1743,6 +1766,10 @@ static int rand_initialize(void)
+ init_std_data(&blocking_pool);
+ crng_initialize(&primary_crng);
+ crng_global_init_time = jiffies;
++ if (ratelimit_disable) {
++ urandom_warning.interval = 0;
++ unseeded_warning.interval = 0;
++ }
+ return 0;
+ }
+ early_initcall(rand_initialize);
+@@ -1810,9 +1837,10 @@ urandom_read(struct file *file, char __u
+
+ if (!crng_ready() && maxwarn > 0) {
+ maxwarn--;
+- printk(KERN_NOTICE "random: %s: uninitialized urandom read "
+- "(%zd bytes read)\n",
+- current->comm, nbytes);
++ if (__ratelimit(&urandom_warning))
++ printk(KERN_NOTICE "random: %s: uninitialized "
++ "urandom read (%zd bytes read)\n",
++ current->comm, nbytes);
+ spin_lock_irqsave(&primary_crng.lock, flags);
+ crng_init_cnt = 0;
+ spin_unlock_irqrestore(&primary_crng.lock, flags);
diff --git a/patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch b/patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch
new file mode 100644
index 0000000000..eaa580ada5
--- /dev/null
+++ b/patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch
@@ -0,0 +1,52 @@
+From: "Andrew F. Davis" <afd@ti.com>
+Date: Sat, 21 Apr 2018 18:55:29 -0500
+Subject: rpmsg: Correct support for MODULE_DEVICE_TABLE()
+Git-commit: 5b7d127726de6eed4b900bc3bbb167837690818f
+Patch-mainline: v4.18-rc1
+References: git-fixes
+
+Due to missing a missing entry in file2alias.c MODULE_DEVICE_TABLE() are
+not generating the proper module aliases. Add the needed entry here.
+
+Fixes: bcabbccabffe ("rpmsg: add virtio-based remote processor messaging bus")
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Andrew F. Davis <afd@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ scripts/mod/devicetable-offsets.c | 3 +++
+ scripts/mod/file2alias.c | 11 +++++++++++
+ 2 files changed, 14 insertions(+)
+
+--- a/scripts/mod/devicetable-offsets.c
++++ b/scripts/mod/devicetable-offsets.c
+@@ -138,6 +138,9 @@ int main(void)
+ DEVID(hv_vmbus_device_id);
+ DEVID_FIELD(hv_vmbus_device_id, guid);
+
++ DEVID(rpmsg_device_id);
++ DEVID_FIELD(rpmsg_device_id, name);
++
+ DEVID(i2c_device_id);
+ DEVID_FIELD(i2c_device_id, name);
+
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -944,6 +944,17 @@ static int do_vmbus_entry(const char *fi
+ }
+ ADD_TO_DEVTABLE("vmbus", hv_vmbus_device_id, do_vmbus_entry);
+
++/* Looks like: rpmsg:S */
++static int do_rpmsg_entry(const char *filename, void *symval,
++ char *alias)
++{
++ DEF_FIELD_ADDR(symval, rpmsg_device_id, name);
++ sprintf(alias, RPMSG_DEVICE_MODALIAS_FMT, *name);
++
++ return 1;
++}
++ADD_TO_DEVTABLE("rpmsg", rpmsg_device_id, do_rpmsg_entry);
++
+ /* Looks like: i2c:S */
+ static int do_i2c_entry(const char *filename, void *symval,
+ char *alias)
diff --git a/patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch b/patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch
new file mode 100644
index 0000000000..7a5794e599
--- /dev/null
+++ b/patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch
@@ -0,0 +1,57 @@
+From: Paul Menzel <pmenzel@molgen.mpg.de>
+Date: Tue, 5 Jun 2018 19:00:22 +0200
+Subject: tools build: fix # escaping in .cmd files for future Make
+Git-commit: 9feeb638cde083c737e295c0547f1b4f28e99583
+Patch-mainline: v4.18-rc5
+References: git-fixes
+
+In 2016 GNU Make made a backwards incompatible change to the way '#'
+characters were handled in Makefiles when used inside functions or
+macros:
+
+http://git.savannah.gnu.org/cgit/make.git/commit/?id=c6966b323811c37acedff05b57
+
+Due to this change, when attempting to run `make prepare' I get a
+spurious make syntax error:
+
+ /home/earnest/linux/tools/objtool/.fixdep.o.cmd:1: *** missing separator. Stop.
+
+When inspecting `.fixdep.o.cmd' it includes two lines which use
+unescaped comment characters at the top:
+
+ \# cannot find fixdep (/home/earnest/linux/tools/objtool//fixdep)
+ \# using basic dep data
+
+This is because `tools/build/Build.include' prints these '\#'
+characters:
+
+ printf '\# cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \
+ printf '\# using basic dep data\n\n' >> $(dot-target).cmd; \
+
+This completes commit 9564a8cf422d ("Kbuild: fix # escaping in .cmd files
+for future Make").
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=197847
+Cc: Randy Dunlap <rdunlap@infradead.org>
+Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/build/Build.include | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/build/Build.include
++++ b/tools/build/Build.include
+@@ -63,8 +63,8 @@ dep-cmd = $(if $(wildcard $(fixdep)),
+ $(fixdep) $(depfile) $@ '$(make-cmd)' > $(dot-target).tmp; \
+ rm -f $(depfile); \
+ mv -f $(dot-target).tmp $(dot-target).cmd, \
+- printf '\# cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \
+- printf '\# using basic dep data\n\n' >> $(dot-target).cmd; \
++ printf '$(pound) cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \
++ printf '$(pound) using basic dep data\n\n' >> $(dot-target).cmd; \
+ cat $(depfile) >> $(dot-target).cmd; \
+ printf '\n%s\n' 'cmd_$@ := $(make-cmd)' >> $(dot-target).cmd)
+
diff --git a/patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch b/patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
new file mode 100644
index 0000000000..56a77e0543
--- /dev/null
+++ b/patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
@@ -0,0 +1,69 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:54 +0100
+Subject: tty: Hold tty_ldisc_lock() during tty_reopen()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+tty_ldisc_reinit() doesn't race with neither tty_ldisc_hangup()
+nor set_ldisc() nor tty_ldisc_release() as they use tty lock.
+But it races with anyone who expects line discipline to be the same
+after hoding read semaphore in tty_ldisc_ref().
+
+We've seen the following crash on v4.9.108 stable:
+
+BUG: unable to handle kernel paging request at 0000000000002260
+IP: [..] n_tty_receive_buf_common+0x5f/0x86d
+Workqueue: events_unbound flush_to_ldisc
+Call Trace:
+ [..] n_tty_receive_buf2
+ [..] tty_ldisc_receive_buf
+ [..] flush_to_ldisc
+ [..] process_one_work
+ [..] worker_thread
+ [..] kthread
+ [..] ret_from_fork
+
+tty_ldisc_reinit() should be called with ldisc_sem hold for writing,
+which will protect any reader against line discipline changes.
+
+Backport-first: b027e2298bd5 ("tty: fix data race between tty_init_dev
+and flush of buf")
+Cc: stable@vger.kernel.org
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Reviewed-by: Jiri Slaby <jslaby@suse.cz>
+Reported-by: syzbot+3aa9784721dfb90e984d@syzkaller.appspotmail.com
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_io.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1202,15 +1202,20 @@ static int tty_reopen(struct tty_struct
+ if (test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
+ return -EBUSY;
+
+- tty->count++;
++ retval = tty_ldisc_lock(tty, 5 * HZ);
++ if (retval)
++ return retval;
+
++ tty->count++;
+ if (tty->ldisc)
+- return 0;
++ goto out_unlock;
+
+ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+ if (retval)
+ tty->count--;
+
++out_unlock:
++ tty_ldisc_unlock(tty);
+ return retval;
+ }
+
diff --git a/patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch b/patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
new file mode 100644
index 0000000000..10455330f1
--- /dev/null
+++ b/patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
@@ -0,0 +1,45 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:55 +0100
+Subject: tty: Simplify tty->count math in tty_reopen()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+As notted by Jiri, tty_ldisc_reinit() shouldn't rely on tty counter.
+Simplify math by increasing the counter after reinit success.
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Link: lkml.kernel.org/r/<20180829022353.23568-2-dima@arista.com>
+Suggested-by: Jiri Slaby <jslaby@suse.com>
+Reviewed-by: Jiri Slaby <jslaby@suse.cz>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_io.c | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1206,16 +1206,13 @@ static int tty_reopen(struct tty_struct
+ if (retval)
+ return retval;
+
+- tty->count++;
+- if (tty->ldisc)
+- goto out_unlock;
++ if (!tty->ldisc)
++ retval = tty_ldisc_reinit(tty, tty->termios.c_line);
++ tty_ldisc_unlock(tty);
+
+- retval = tty_ldisc_reinit(tty, tty->termios.c_line);
+- if (retval)
+- tty->count--;
++ if (retval == 0)
++ tty->count++;
+
+-out_unlock:
+- tty_ldisc_unlock(tty);
+ return retval;
+ }
+
diff --git a/patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch b/patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch
new file mode 100644
index 0000000000..3f19a51aee
--- /dev/null
+++ b/patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch
@@ -0,0 +1,97 @@
+From: Gaurav Kohli <gkohli@codeaurora.org>
+Date: Tue, 23 Jan 2018 13:16:34 +0530
+Subject: tty: fix data race between tty_init_dev and flush of buf
+Git-commit: b027e2298bd588d6fa36ed2eda97447fb3eac078
+Patch-mainline: v4.16-rc1
+References: bnc#1105428
+
+There can be a race, if receive_buf call comes before
+tty initialization completes in n_tty_open and tty->disc_data
+may be NULL.
+
+CPU0 CPU1
+---- ----
+ 000|n_tty_receive_buf_common() n_tty_open()
+-001|n_tty_receive_buf2() tty_ldisc_open.isra.3()
+-002|tty_ldisc_receive_buf(inline) tty_ldisc_setup()
+
+Using ldisc semaphore lock in tty_init_dev till disc_data
+initializes completely.
+
+Signed-off-by: Gaurav Kohli <gkohli@codeaurora.org>
+Reviewed-by: Alan Cox <alan@linux.intel.com>
+Cc: stable <stable@vger.kernel.org>
+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_io.c | 8 +++++++-
+ drivers/tty/tty_ldisc.c | 4 ++--
+ include/linux/tty.h | 2 ++
+ 3 files changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1258,6 +1258,9 @@ struct tty_struct *tty_init_dev(struct t
+ "%s: %s driver does not set tty->port. This will crash the kernel later. Fix the driver!\n",
+ __func__, tty->driver->name);
+
++ retval = tty_ldisc_lock(tty, 5 * HZ);
++ if (retval)
++ goto err_release_lock;
+ tty->port->itty = tty;
+
+ /*
+@@ -1268,6 +1271,7 @@ struct tty_struct *tty_init_dev(struct t
+ retval = tty_ldisc_setup(tty, tty->link);
+ if (retval)
+ goto err_release_tty;
++ tty_ldisc_unlock(tty);
+ /* Return the tty locked so that it cannot vanish under the caller */
+ return tty;
+
+@@ -1280,9 +1284,11 @@ err_module_put:
+
+ /* call the tty release_tty routine to clean out this slot */
+ err_release_tty:
+- tty_unlock(tty);
++ tty_ldisc_unlock(tty);
+ tty_info_ratelimited(tty, "ldisc open failed (%d), clearing slot %d\n",
+ retval, idx);
++err_release_lock:
++ tty_unlock(tty);
+ release_tty(tty, idx);
+ return ERR_PTR(retval);
+ }
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -336,7 +336,7 @@ static inline void __tty_ldisc_unlock(st
+ ldsem_up_write(&tty->ldisc_sem);
+ }
+
+-static int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
++int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout)
+ {
+ int ret;
+
+@@ -347,7 +347,7 @@ static int tty_ldisc_lock(struct tty_str
+ return 0;
+ }
+
+-static void tty_ldisc_unlock(struct tty_struct *tty)
++void tty_ldisc_unlock(struct tty_struct *tty)
+ {
+ clear_bit(TTY_LDISC_HALTED, &tty->flags);
+ __tty_ldisc_unlock(tty);
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -400,6 +400,8 @@ extern struct tty_struct *get_current_tt
+ /* tty_io.c */
+ extern int __init tty_init(void);
+ extern const char *tty_name(const struct tty_struct *tty);
++extern int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout);
++extern void tty_ldisc_unlock(struct tty_struct *tty);
+ #else
+ static inline void tty_kref_put(struct tty_struct *tty)
+ { }
diff --git a/patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch b/patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
new file mode 100644
index 0000000000..535995a6d9
--- /dev/null
+++ b/patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
@@ -0,0 +1,81 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:57 +0100
+Subject: tty/ldsem: Add lockdep asserts for ldisc_sem
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+Make sure under CONFIG_LOCKDEP that each change to line discipline
+is done with held write semaphor.
+Otherwise potential reader will have a good time dereferencing
+incomplete/uninitialized ldisc.
+
+An exception here is tty_ldisc_open(), as it's called without ldisc_sem
+locked by tty_init_dev() => tty_ldisc_setup() for the tty->link.
+
+It seem valid as tty_init_dev() will call tty_driver_install_tty()
+which will find ops->install(). Install will establish tty->link in
+pty_common_install(), just after allocation of slave tty with
+alloc_tty_struct(). So, no one should have a reference to slave pty yet.
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldisc.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/tty/tty_ldisc.c
++++ b/drivers/tty/tty_ldisc.c
+@@ -483,6 +483,7 @@ static int tty_ldisc_open(struct tty_str
+
+ static void tty_ldisc_close(struct tty_struct *tty, struct tty_ldisc *ld)
+ {
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ WARN_ON(!test_bit(TTY_LDISC_OPEN, &tty->flags));
+ clear_bit(TTY_LDISC_OPEN, &tty->flags);
+ if (ld->ops->close)
+@@ -504,6 +505,7 @@ static int tty_ldisc_failto(struct tty_s
+ struct tty_ldisc *disc = tty_ldisc_get(tty, ld);
+ int r;
+
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ if (IS_ERR(disc))
+ return PTR_ERR(disc);
+ tty->ldisc = disc;
+@@ -626,6 +628,7 @@ err:
+ */
+ static void tty_ldisc_kill(struct tty_struct *tty)
+ {
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ if (!tty->ldisc)
+ return;
+ /*
+@@ -673,6 +676,7 @@ int tty_ldisc_reinit(struct tty_struct *
+ struct tty_ldisc *ld;
+ int retval;
+
++ lockdep_assert_held_exclusive(&tty->ldisc_sem);
+ ld = tty_ldisc_get(tty, disc);
+ if (IS_ERR(ld)) {
+ BUG_ON(disc == N_TTY);
+@@ -772,6 +776,10 @@ int tty_ldisc_setup(struct tty_struct *t
+ return retval;
+
+ if (o_tty) {
++ /*
++ * Called without o_tty->ldisc_sem held, as o_tty has been
++ * just allocated and no one has a reference to it.
++ */
+ retval = tty_ldisc_open(o_tty, o_tty->ldisc);
+ if (retval) {
+ tty_ldisc_close(tty, tty->ldisc);
+@@ -836,6 +844,7 @@ int tty_ldisc_init(struct tty_struct *tt
+ */
+ void tty_ldisc_deinit(struct tty_struct *tty)
+ {
++ /* no ldisc_sem, tty is being destroyed */
+ if (tty->ldisc)
+ tty_ldisc_put(tty->ldisc);
+ tty->ldisc = NULL;
diff --git a/patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch b/patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
new file mode 100644
index 0000000000..ed5f75c2bf
--- /dev/null
+++ b/patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
@@ -0,0 +1,131 @@
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Tue, 18 Sep 2018 00:52:56 +0100
+Subject: tty/ldsem: Convert to regular lockdep annotations
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+For some reason ldsem has its own lockdep wrappers, make them go away.
+
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldsem.c | 51 +++++++++++++-----------------------------------
+ 1 file changed, 14 insertions(+), 37 deletions(-)
+
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -36,29 +36,6 @@
+ #include <linux/sched/task.h>
+
+
+-#ifdef CONFIG_DEBUG_LOCK_ALLOC
+-# define __acq(l, s, t, r, c, n, i) \
+- lock_acquire(&(l)->dep_map, s, t, r, c, n, i)
+-# define __rel(l, n, i) \
+- lock_release(&(l)->dep_map, n, i)
+-#define lockdep_acquire(l, s, t, i) __acq(l, s, t, 0, 1, NULL, i)
+-#define lockdep_acquire_nest(l, s, t, n, i) __acq(l, s, t, 0, 1, n, i)
+-#define lockdep_acquire_read(l, s, t, i) __acq(l, s, t, 1, 1, NULL, i)
+-#define lockdep_release(l, n, i) __rel(l, n, i)
+-#else
+-# define lockdep_acquire(l, s, t, i) do { } while (0)
+-# define lockdep_acquire_nest(l, s, t, n, i) do { } while (0)
+-# define lockdep_acquire_read(l, s, t, i) do { } while (0)
+-# define lockdep_release(l, n, i) do { } while (0)
+-#endif
+-
+-#ifdef CONFIG_LOCK_STAT
+-# define lock_stat(_lock, stat) lock_##stat(&(_lock)->dep_map, _RET_IP_)
+-#else
+-# define lock_stat(_lock, stat) do { } while (0)
+-#endif
+-
+-
+ #if BITS_PER_LONG == 64
+ # define LDSEM_ACTIVE_MASK 0xffffffffL
+ #else
+@@ -334,17 +311,17 @@ static int __ldsem_down_read_nested(stru
+ {
+ long count;
+
+- lockdep_acquire_read(sem, subclass, 0, _RET_IP_);
++ rwsem_acquire_read(&sem->dep_map, subclass, 0, _RET_IP_);
+
+ count = ldsem_atomic_update(LDSEM_READ_BIAS, sem);
+ if (count <= 0) {
+- lock_stat(sem, contended);
++ lock_contended(&sem->dep_map, _RET_IP_);
+ if (!down_read_failed(sem, count, timeout)) {
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+ return 0;
+ }
+ }
+- lock_stat(sem, acquired);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+
+@@ -353,17 +330,17 @@ static int __ldsem_down_write_nested(str
+ {
+ long count;
+
+- lockdep_acquire(sem, subclass, 0, _RET_IP_);
++ rwsem_acquire(&sem->dep_map, subclass, 0, _RET_IP_);
+
+ count = ldsem_atomic_update(LDSEM_WRITE_BIAS, sem);
+ if ((count & LDSEM_ACTIVE_MASK) != LDSEM_ACTIVE_BIAS) {
+- lock_stat(sem, contended);
++ lock_contended(&sem->dep_map, _RET_IP_);
+ if (!down_write_failed(sem, count, timeout)) {
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+ return 0;
+ }
+ }
+- lock_stat(sem, acquired);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+
+@@ -386,8 +363,8 @@ int ldsem_down_read_trylock(struct ld_se
+
+ while (count >= 0) {
+ if (ldsem_cmpxchg(&count, count + LDSEM_READ_BIAS, sem)) {
+- lockdep_acquire_read(sem, 0, 1, _RET_IP_);
+- lock_stat(sem, acquired);
++ rwsem_acquire_read(&sem->dep_map, 0, 1, _RET_IP_);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+ }
+@@ -412,8 +389,8 @@ int ldsem_down_write_trylock(struct ld_s
+
+ while ((count & LDSEM_ACTIVE_MASK) == 0) {
+ if (ldsem_cmpxchg(&count, count + LDSEM_WRITE_BIAS, sem)) {
+- lockdep_acquire(sem, 0, 1, _RET_IP_);
+- lock_stat(sem, acquired);
++ rwsem_acquire(&sem->dep_map, 0, 1, _RET_IP_);
++ lock_acquired(&sem->dep_map, _RET_IP_);
+ return 1;
+ }
+ }
+@@ -427,7 +404,7 @@ void ldsem_up_read(struct ld_semaphore *
+ {
+ long count;
+
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+
+ count = ldsem_atomic_update(-LDSEM_READ_BIAS, sem);
+ if (count < 0 && (count & LDSEM_ACTIVE_MASK) == 0)
+@@ -441,7 +418,7 @@ void ldsem_up_write(struct ld_semaphore
+ {
+ long count;
+
+- lockdep_release(sem, 1, _RET_IP_);
++ rwsem_release(&sem->dep_map, 1, _RET_IP_);
+
+ count = ldsem_atomic_update(-LDSEM_WRITE_BIAS, sem);
+ if (count < 0)
diff --git a/patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch b/patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
new file mode 100644
index 0000000000..1e3fa456c8
--- /dev/null
+++ b/patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
@@ -0,0 +1,38 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:58 +0100
+Subject: tty/ldsem: Decrement wait_readers on timeouted down_read()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+It seems like when ldsem_down_read() fails with timeout, it misses
+update for sem->wait_readers. By that reason, when writer finally
+releases write end of the semaphore __ldsem_wake_readers() does adjust
+sem->count with wrong value:
+sem->wait_readers * (LDSEM_ACTIVE_BIAS - LDSEM_WAIT_BIAS)
+
+I.e, if update comes with 1 missed wait_readers decrement, sem->count
+will be 0x100000001 which means that there is active reader and it'll
+make any further writer to fail in acquiring the semaphore.
+
+It looks like, this is a dead-code, because ldsem_down_read() is never
+called with timeout different than MAX_SCHEDULE_TIMEOUT, so it might be
+worth to delete timeout parameter and error path fall-back..
+
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldsem.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -228,6 +228,7 @@ down_read_failed(struct ld_semaphore *se
+ raw_spin_lock_irq(&sem->wait_lock);
+ if (waiter.task) {
+ ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem);
++ sem->wait_readers--;
+ list_del(&waiter.list);
+ raw_spin_unlock_irq(&sem->wait_lock);
+ put_task_struct(waiter.task);
diff --git a/patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch b/patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
new file mode 100644
index 0000000000..50ea5f03b2
--- /dev/null
+++ b/patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
@@ -0,0 +1,54 @@
+From: Dmitry Safonov <dima@arista.com>
+Date: Tue, 18 Sep 2018 00:52:53 +0100
+Subject: tty/ldsem: Wake up readers after timed out down_write()
+Patch-mainline: Submitted on 2018/09/18
+References: bnc#1105428
+
+ldsem_down_read() will sleep if there is pending writer in the queue.
+If the writer times out, readers in the queue should be woken up,
+otherwise they may miss a chance to acquire the semaphore until the last
+active reader will do ldsem_up_read().
+
+There was a couple of reports where there was one active reader and
+other readers soft locked up:
+ Showing all locks held in the system:
+ 2 locks held by khungtaskd/17:
+ #0: (rcu_read_lock){......}, at: watchdog+0x124/0x6d1
+ #1: (tasklist_lock){.+.+..}, at: debug_show_all_locks+0x72/0x2d3
+ 2 locks held by askfirst/123:
+ #0: (&tty->ldisc_sem){.+.+.+}, at: ldsem_down_read+0x46/0x58
+ #1: (&ldata->atomic_read_lock){+.+...}, at: n_tty_read+0x115/0xbe4
+
+Prevent readers wait for active readers to release ldisc semaphore.
+
+Link: lkml.kernel.org/r/<20171121132855.ajdv4k6swzhvktl6@wfg-t540p.sh.intel.com>
+Link: lkml.kernel.org/r/<20180907045041.GF1110@shao2-debian>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Jiri Slaby <jslaby@suse.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Signed-off-by: Dmitry Safonov <dima@arista.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/tty/tty_ldsem.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/tty/tty_ldsem.c
++++ b/drivers/tty/tty_ldsem.c
+@@ -307,6 +307,16 @@ down_write_failed(struct ld_semaphore *s
+ if (!locked)
+ ldsem_atomic_update(-LDSEM_WAIT_BIAS, sem);
+ list_del(&waiter.list);
++
++ /*
++ * In case of timeout, wake up every reader who gave the right of way
++ * to writer. Prevent separation readers into two groups:
++ * one that helds semaphore and another that sleeps.
++ * (in case of no contention with a writer)
++ */
++ if (!locked && list_empty(&sem->write_wait))
++ __ldsem_wake_readers(sem);
++
+ raw_spin_unlock_irq(&sem->wait_lock);
+
+ __set_current_state(TASK_RUNNING);
diff --git a/scripts/git_sort/git_sort.py b/scripts/git_sort/git_sort.py
index 05f20ed542..abdf30573f 100755
--- a/scripts/git_sort/git_sort.py
+++ b/scripts/git_sort/git_sort.py
@@ -188,6 +188,7 @@ remotes = (
Head(RepoURL("tj/libata.git"), "for-next"),
Head(RepoURL("https://github.com/kdave/btrfs-devel.git"), "misc-next"),
Head(RepoURL("git://people.freedesktop.org/~airlied/linux"), "drm-next"),
+ Head(RepoURL("git://anongit.freedesktop.org/drm/drm-misc"), "drm-misc-next"),
Head(RepoURL("gregkh/tty.git"), "tty-next"),
Head(RepoURL("jj/linux-apparmor.git"), "apparmor-next"),
Head(RepoURL("pablo/nf.git")),
@@ -443,7 +444,7 @@ class Cache(object):
# This detailed check may be needed if an older git-sort (which
# didn't set a cache version) modified the cache.
if (not isinstance(cache_history, list) or
- len(cache_history) < 1 or
+ len(cache_history) < 1 or
len(cache_history[0]) != 4 or
not isinstance(cache_history[0][3], dict)):
raise CInconsistent
diff --git a/scripts/series2git b/scripts/series2git
index defcb51574..e62ccc7e02 100755
--- a/scripts/series2git
+++ b/scripts/series2git
@@ -200,7 +200,7 @@ apply_patch()
GIT_AUTHOR_EMAIL=
;;
esac
- local subject=$(ex_hdr Subject "$patch")
+ local subject=$(ex_hdr Subject "$patch" | sed -es'/\[[^]]*\] //')
GIT_AUTHOR_DATE=$(ex_hdr Date "$patch")
GIT_AUTHOR_DATE=$(ex_hdr Date "$patch" \
| perl -p -e 's/(\d\d:\d\d:\d\d) (\d{4})/$2 $1/;s/:$//')
diff --git a/series.conf b/series.conf
index e8b62b82d5..625fa9a1b6 100644
--- a/series.conf
+++ b/series.conf
@@ -5126,6 +5126,7 @@
patches.suse/0003-x86-boot-KASLR-Rename-process_e820_entry-into-proces.patch
patches.suse/efi-Introduce-efi_early_memdesc_ptr-to-get-pointer-t.patch
patches.arch/x86-boot-KASLR-Prefer-mirrored-memory-regions-for-th.patch
+ patches.fixes/0001-x86-boot-KASLR-Work-around-firmware-bugs-by-excludin.patch
patches.arch/x86-cpu-amd-limit-cpu_core_id-fixup-to-families-older-than-f17h.patch
patches.fixes/x86-cpu-amd-derive-l3-shared_cpu_map-from-cpu_llc_shared_mask.patch
patches.arch/0001-x86-nmi-Use-raw-lock.patch
@@ -6127,6 +6128,7 @@
patches.arch/powerpc-perf-imc-fix-nest-events-on-muti-socket-system.patch
patches.arch/powerpc-Fix-missing-newline-before.patch
patches.arch/powerpc-perf-fix-usage-of-nest_imc_refc.patch
+ patches.arch/powerpc-pseries-remove-dlpar_attach_node-dependency-.patch
patches.arch/powerpc-mm-Move-pgdir-setting-into-a-helper.patch
patches.arch/powerpc-mm-Optimize-detection-of-thread-local-mm-s.patch
patches.arch/powerpc-mm-Make-switch_mm_irqs_off-out-of-line.patch
@@ -6913,6 +6915,7 @@
patches.arch/powerpc-sysrq-Fix-oops-whem-ppmu-is-not-registered.patch
patches.arch/powerpc-tm-Flush-TM-only-if-CPU-has-TM-feature.patch
patches.arch/powerpc-eeh-Create-PHB-PEs-after-EEH-is-initialized.patch
+ patches.arch/powerpc-pseries-Fix-OF-ERROR-Bad-of_node_put-on-cpus.patch
patches.arch/powerpc-pseries-Fix-parent_dn-reference-leak-in-add_.patch
patches.fixes/xen-x86-mark-xen_find_pt_base-as-init.patch
patches.suse/0041-libceph-don-t-allow-bidirectional-swap-of-pg-upmap-items.patch
@@ -11317,6 +11320,7 @@
patches.drivers/cpufreq-powernv-Dont-assume-distinct-pstate-values-f.patch
patches.drivers/PM-devfreq-Propagate-error-from-devfreq_add_device
patches.drivers/PM-devfreq-Fix-potential-NULL-pointer-dereference-in
+ patches.fixes/acpi-pci-pci_link-reduce-verbosity-when-irq-is-enabled.patch
patches.drivers/ACPICA-iasl-Add-SMMUv3-device-ID-mapping-index-suppo.patch
patches.drivers/ACPICA-ACPI-6.0A-Changes-to-the-NFIT-ACPI-table.patch
patches.fixes/ACPI-NUMA-ia64-Parse-all-entries-of-SRAT-memory-affi.patch
@@ -12280,6 +12284,7 @@
patches.drivers/serial-8250_uniphier-fix-error-return-code-in-uniphi
patches.drivers/serial-imx-Only-wakeup-via-RTSDEN-bit-if-the-system-
patches.drivers/serial-core-mark-port-as-initialized-after-successfu
+ patches.suse/tty-fix-data-race-between-tty_init_dev-and-flush-of-.patch
patches.drivers/tty-serial-exar-Relocate-sleep-wake-up-handling.patch
patches.drivers/iio-adc-accel-Fix-up-module-licenses
patches.drivers/iio-health-max30102-Add-power-enable-parameter-to-ge
@@ -14157,6 +14162,7 @@
patches.drivers/ACPICA-acpi-acpica-fix-acpi-operand-cache-leak-in-ns
patches.drivers/ACPICA-Fix-memory-leak-on-unusual-memory-leak
patches.drivers/ACPICA-Events-add-a-return-on-failure-from-acpi_hw_r
+ patches.fixes/acpi-pci-pci_link-allow-the-absence-of-_prs-and-change.patch
patches.fixes/0001-ACPI-scan-Send-change-uevent-with-offine-environment.patch
patches.drivers/ACPI-video-Add-quirk-to-force-acpi-video-backlight-o
patches.fixes/0001-PCMCIA-PM-Avoid-noirq-suspend-aborts-during-suspend-.patch
@@ -14912,6 +14918,7 @@
patches.arch/selftests-powerpc-Fix-copyloops-build-since-Power4-a.patch
patches.arch/powerpc-powernv-Fix-SMT4-forcing-idle-code.patch
patches.arch/powerpc-mm-radix-Update-pte-fragment-count-from-16-t.patch
+ patches.arch/powerpc-mm-hugetlb-initialize-the-pagetable-cache-co.patch
patches.arch/powerpc-mm-radix-Parse-disable_radix-commandline-cor.patch
patches.arch/powerpc-mm-radix-Update-command-line-parsing-for-dis.patch
patches.arch/powerpc-hw_breakpoint-Only-disable-hw-breakpoint-if-.patch
@@ -14996,6 +15003,7 @@
patches.drivers/rtc-hctosys-Ensure-system-time-doesn-t-overflow-time
patches.drivers/rtc-snvs-Fix-usage-of-snvs_rtc_enable
patches.drivers/libnvdimm-label-change-min-label-storage-size-per-uefi-2.7.patch
+ patches.fixes/libnvdimm-label-change-nvdimm_num_label_slots-per-uefi-2-7.patch
patches.drivers/nfit-skip-region-registration-for-incomplete-control-regions.patch
patches.fixes/0001-acpi-nfit-rework-NVDIMM-leaf-method-detection.patch
patches.drivers/nfit-fix-region-registration-vs-block-data-window-ra
@@ -15152,6 +15160,7 @@
patches.fixes/0001-sched-rt-Fix-rq-clock_update_flags-RQCF_ACT_SKIP-war.patch
patches.arch/x86-mm-do-not-forbid-page_rw-before-init-for-_ro_after_init
patches.arch/x86-pgtable-don-t-set-huge-pud-pmd-on-non-leaf-entries
+ patches.suse/Kbuild-fix-escaping-in-.cmd-files-for-future-Make.patch
patches.drivers/scsi-qla2xxx-Fix-small-memory-leak-in-qla2x00_probe_.patch
patches.fixes/scsi-qla2xxx-avoid-double-completion-of-abort-command.patch
patches.drivers/scsi-qla2xxx-Fix-race-condition-between-iocb-timeout.patch
@@ -15269,6 +15278,7 @@
patches.arch/s390-dasd-fix-IO-error-for-newly-defined-devices.patch
patches.arch/s390-correct-module-section-names-for-expoline-code.patch
patches.drivers/random-fix-possible-sleeping-allocation-from-irq-con
+ patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
patches.drivers/ACPI-scan-Initialize-watchdog-before-PNP.patch
patches.drivers/ACPI-watchdog-Prefer-iTCO_wdt-on-Lenovo-Z50-70
patches.drivers/ACPI-button-make-module-loadable-when-booted-in-non-
@@ -15923,6 +15933,7 @@
patches.fixes/ARM-amba-Fix-wrong-indentation-in-driver_override_st.patch
patches.drivers/w1-mxc_w1-Enable-clock-before-calling-clk_get_rate-o
patches.drivers/1wire-family-module-autoload-fails-because-of-upper-
+ patches.suse/rpmsg-Correct-support-for-MODULE_DEVICE_TABLE.patch
patches.suse/msft-hv-1681-Drivers-hv-vmbus-Removed-an-unnecessary-cast-from-vo.patch
patches.drivers/vmw_balloon-fixing-double-free-when-batching-mode-is
patches.drivers/driver-core-Don-t-ignore-class_dir_create_and_add-fa
@@ -16994,6 +17005,7 @@
patches.drivers/ALSA-hda-Handle-pm-failure-during-hotplug
patches.drivers/ALSA-hda-realtek-two-more-lenovo-models-need-fixup-o
patches.arch/ARM-8780-1-ftrace-Only-set-kernel-memory-back-to-rea.patch
+ patches.suse/tools-build-fix-escaping-in-.cmd-files-for-future-Ma.patch
patches.drivers/iw_cxgb4-correctly-enforce-the-max-reg_mr-depth.patch
patches.drivers/RDMA-uverbs-Protect-from-attempts-to-create-flows-on.patch
patches.drivers/IB-hfi1-Fix-incorrect-mixing-of-ERR_PTR-and-NULL-ret.patch
@@ -17178,6 +17190,7 @@
patches.fixes/ext4-fix-inline-data-updates-with-checksums-enabled.patch
patches.fixes/ext4-check-for-allocation-block-validity-with-block-.patch
patches.fixes/ext4-fix-check-to-prevent-initializing-reserved-inod.patch
+ patches.arch/0001-x86-efi-Access-EFI-MMIO-data-as-unencrypted-when-SEV.patch
patches.arch/perf-x86-amd-ibs-don-t-access-non-started-event
patches.fixes/x86-entry-64-remove-ebx-handling-from-error_entry-exit.patch
patches.arch/x86-boot-fix-if_changed-build-flip-flop-bug
@@ -17991,6 +18004,7 @@
patches.arch/x86-nmi-fix-nmi-uaccess-race-against-cr3-switching
patches.fixes/x86-mce-Fix-set_mce_nospec-to-avoid-GP-fault.patch
patches.arch/x86-vdso-fix-lsl-operand-order.patch
+ patches.fixes/0001-of-add-helper-to-lookup-compatible-child-node.patch
patches.fixes/vti6-remove-skb-ignore_df-check-from-vti6_xmit.patch
patches.drivers/net-hns-add-the-code-for-cleaning-pkt-in-chip.patch
patches.drivers/net-hns-add-netif_carrier_off-before-change-speed-an.patch
@@ -18069,6 +18083,7 @@
patches.drivers/drm-nouveau-drm-nouveau-Don-t-forget-to-cancel-hpd_w.patch
patches.drivers/drm-nouveau-TBDdevinit-don-t-fail-when-PMU-PRE_OS-is.patch
patches.drivers/drm-nouveau-disp-fix-DP-disable-race.patch
+ patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
patches.drivers/Revert-PCI-Add-ACS-quirk-for-Intel-300-series
patches.drivers/switchtec-Fix-Spectre-v1-vulnerability.patch
patches.arch/s390-sles15-15-04-crypto-paes-fix.patch
@@ -18283,6 +18298,7 @@
patches.arch/x86-time-correct-the-attribute-on-jiffies-definition
patches.arch/x86-fpu-remove-second-definition-of-fpu-in-_fpu__restore_sig
patches.drivers/i2c-rcar-cleanup-DMA-for-all-kinds-of-failure.patch
+ patches.fixes/cdrom-fix-improper-type-cast-which-can-leat-to-infor.patch
patches.fixes/nvme_fc-add-nvme_discovery-sysfs-attribute-to-fc-tra.patch
patches.fixes/nvme-call-nvme_complete_rq-when-nvmf_check_ready-fai.patch
patches.drivers/ACPI-processor-Fix-the-return-value-of-acpi_processo.patch
@@ -18295,10 +18311,18 @@
patches.drivers/iwlwifi-pcie-gen2-check-iwl_pcie_gen2_set_tb-return-.patch
patches.drivers/mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch
patches.fixes/xfrm-use-complete-IPv6-addresses-for-hash.patch
+ patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
patches.arch/signal-properly-deliver-sigsegv-from-x86-uprobes
patches.fixes/jbd2-fix-use-after-free-in-jbd2_log_do_checkpoint.patch
patches.fixes/Documentation-l1tf-Fix-small-spelling-typo.patch
patches.drivers/mfd-arizona-Correct-calling-of-runtime_put_sync.patch
+ patches.fixes/libnvdimm-dimm-maximize-label-transfer-size.patch
+ patches.fixes/nvdimm-sanity-check-labeloff.patch
+ patches.fixes/nvdimm-clarify-comment-in-sizeof_namespace_index.patch
+ patches.fixes/nvdimm-remove-empty-if-statement.patch
+ patches.fixes/nvdimm-split-label-init-out-from-the-logic-for-getting-config-data.patch
+ patches.fixes/nvdimm-use-namespace-index-data-to-reduce-number-of-label-reads-needed.patch
+ patches.fixes/libnvdimm-label-fix-sparse-warning.patch
patches.drivers/PCI-ASPM-Fix-link_state-teardown-on-device-removal.patch
patches.drivers/scsi-qla2xxx-Fix-process-response-queue-for-ISP26XX-.patch
patches.drivers/scsi-qla2xxx-Fix-incorrect-port-speed-being-set-for-.patch
@@ -18368,11 +18392,15 @@
patches.drivers/crypto-tcrypt-fix-ghash-generic-speed-test.patch
patches.drivers/crypto-lrw-Fix-out-of-bounds-access-on-counter-overf.patch
patches.drivers/hwrng-core-document-the-quality-field.patch
-
- # davem/net-next
- patches.suse/msft-hv-1766-hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch
-
- # powerpc/linux next
+ patches.drivers/usb-gadget-fsl_udc_core-check-allocation-return-valu.patch
+ patches.drivers/usb-gadget-fsl_udc_core-fixup-struct_udc_setup-docum.patch
+ patches.drivers/usb-chipidea-Prevent-unbalanced-IRQ-disable.patch
+ patches.drivers/USB-serial-cypress_m8-fix-interrupt-out-transfer-len.patch
+ patches.drivers/usbip-tools-fix-atoi-on-non-null-terminated-string.patch
+ patches.drivers/kernfs-update-comment-about-kernfs_path-return-value.patch
+ patches.fixes/0001-drm-mediatek-fix-OF-sibling-node-lookup.patch
+ patches.fixes/0001-drm-msm-fix-OF-child-node-lookup.patch
+ patches.drivers/NFC-nfcmrvl_uart-fix-OF-child-node-lookup.patch
patches.arch/powerpc-pseries-mm-Introducing-FW_FEATURE_BLOCK_REMO.patch
patches.arch/powerpc-pseries-mm-factorize-PTE-slot-computation.patch
patches.arch/powerpc-pseries-mm-call-H_BLOCK_REMOVE.patch
@@ -18386,6 +18414,37 @@
patches.arch/powerpc-pseries-Disable-CPU-hotplug-across-migration.patch
patches.arch/powerpc-fadump-re-register-firmware-assisted-dump-if.patch
patches.arch/powerpc-rtas-Fix-a-potential-race-between-CPU-Offlin.patch
+ patches.fixes/0001-drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch
+ patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
+ patches.fixes/0001-drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch
+ patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
+ patches.fixes/0001-drm-i915-audio-Hook-up-component-bindings-even-if-di.patch
+ patches.fixes/0001-drm-hisilicon-hibmc-Do-not-carry-error-code-in-HiBMC.patch
+ patches.fixes/0001-drm-hisilicon-hibmc-Don-t-overwrite-fb-helper-surfac.patch
+ patches.fixes/0001-drm-amdgpu-powerplay-fix-missing-break-in-switch-sta.patch
+ patches.drivers/drm-i915-Restore-vblank-interrupts-earlier.patch
+ patches.drivers/drm-i915-dp-Link-train-Fallback-on-eDP-only-if-fallb.patch
+ patches.fixes/0001-drm-i915-gen9-Fix-initial-readout-for-Y-tiled-frameb.patch
+ patches.drivers/iio-adc-imx25-gcq-Fix-leak-of-device_node-in-mx25_gc.patch
+ patches.drivers/iio-adc-at91-fix-acking-DRDY-irq-on-simple-conversio.patch
+ patches.drivers/iio-adc-at91-fix-wrong-channel-number-in-triggered-b.patch
+ patches.drivers/staging-comedi-ni_mio_common-protect-register-write-.patch
+ patches.drivers/serial-8250-Fix-clearing-FIFOs-in-RS485-mode-again.patch
+ patches.drivers/media-uvcvideo-Fix-uvc_alloc_entity-allocation-align.patch
+ patches.drivers/media-dvb-fix-compat-ioctl-translation.patch
+ patches.drivers/media-tvp5150-avoid-going-past-array-on-v4l2_queryme.patch
+ patches.drivers/media-em28xx-use-a-default-format-if-TRY_FMT-fails.patch
+ patches.drivers/media-em28xx-fix-input-name-for-Terratec-AV-350.patch
+ patches.drivers/media-tvp5150-fix-width-alignment-during-set_selecti.patch
+ patches.drivers/media-tvp5150-fix-switch-exit-in-set-control-handler.patch
+ patches.drivers/media-vsp1-Fix-YCbCr-planar-formats-pitch-calculatio.patch
+ patches.drivers/media-pci-cx23885-handle-adding-to-list-failure.patch
+ patches.drivers/media-cx231xx-fix-potential-sign-extension-overflow-.patch
+ patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
+ patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
+
+ # davem/net-next
+ patches.suse/msft-hv-1766-hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -18396,14 +18455,20 @@
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
# out-of-tree patches
+ ########################################################
+ # end of sorted patches
+ ########################################################
+ patches.suse/tty-ldsem-Wake-up-readers-after-timed-out-down_write.patch
+ patches.suse/tty-Hold-tty_ldisc_lock-during-tty_reopen.patch
+ patches.suse/tty-Simplify-tty-count-math-in-tty_reopen.patch
+ patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
+ patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
+ patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
patches.suse/md-display-timeout-error.patch
patches.suse/nvme-register-ns_id-attributes-as-default-sysfs-grou.patch
patches.fixes/0001-Revert-mm-vmacache-optimize-overflow-system-wide-flu.patch
patches.fixes/nfs-set-acl-perm.patch
- ########################################################
- # end of sorted patches
- ########################################################
########################################################
#
@@ -18633,8 +18698,6 @@
########################################################
patches.arch/acpi_thinkpad_introduce_acpi_root_table_boot_param.patch
patches.arch/acpi_thermal_passive_blacklist.patch
- patches.fixes/acpi-pci-pci_link-reduce-verbosity-when-irq-is-enabled.patch
- patches.fixes/acpi-pci-pci_link-allow-the-absence-of-_prs-and-change.patch
########################################################
# Driver core
@@ -18702,6 +18765,8 @@
patches.fixes/btrfs-check-integrity-Fix-NULL-pointer-dereference-f.patch
patches.fixes/btrfs-scrub-Don-t-use-inode-pages-for-device-replace.patch
patches.fixes/btrfs-scrub-Don-t-use-inode-page-cache-in-scrub_hand.patch
+ patches.fixes/0001-btrfs-Enhance-btrfs_trim_fs-function-to-handle-error.patch
+ patches.fixes/0002-btrfs-Ensure-btrfs_trim_fs-can-trim-the-whole-filesy.patch
patches.suse/0001-btrfs-Refactor-check_leaf-function-for-later-expansi.patch
patches.suse/0002-btrfs-Check-if-item-pointer-overlaps-with-the-item-i.patch
@@ -18837,12 +18902,10 @@
patches.arch/drm-hibmc-Use-set_busid-function-from-drm-core.patch
patches.drivers/drm-hibmc-initialize-the-hibmc_bo_driver_io_mem_pfn.patch
- patches.suse/Revert-drm-nouveau-drm-therm-fan-add-a-fallback-if-n
- # bsc#1101822
- patches.fixes/0001-drm-cirrus-Use-drm_framebuffer_put-to-avoid-kernel-o.patch
+ patches.drivers/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch
+ patches.suse/drm-i915-CFL-NVMe-breakage-workaround.patch
- patches.drivers/drm-i915-cfl-Add-a-new-CFL-PCI-ID
+disable patches.drivers/drm-Add-DRM-client-cap-for-aspect-ratio
+disable patches.drivers/drm-Handle-aspect-ratio-info-in-legacy-modeset-path
+disable patches.drivers/drm-Expose-modes-with-aspect-ratio-only-if-requested
@@ -18897,16 +18960,13 @@
########################################################
# Other driver fixes
########################################################
- patches.drivers/ipmi-Move-BT-capabilities-detection-to-the-detect-ca.patch
patches.suse/tpm-Downgrade-error-level
patches.suse/Input-synaptics-Add-intertouch-blacklist-for-Thinkpa.patch
patches.suse/mmc-version-check-printk-downgrade
patches.drivers/dell_rbu-make-firmware-payload-memory-uncachable
patches.kabi/iio-kabi-fix-for-iio_buffer.patch
- patches.arch/0001-x86-efi-Access-EFI-MMIO-data-as-unencrypted-when-SEV.patch
patches.kabi/power_supply-removing-field-kabi-fix.patch
patches.kabi/strscpy-annotation-drop-kABI-workaround.patch
- patches.drivers/Bluetooth-btsdio-Do-not-bind-to-non-removable-BCM43430.patch
patches.drivers/HID-quirks-fix-support-for-Apple-Magic-Keyboards.patch
########################################################