Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-05-26 10:57:36 +0200
committerJiri Slaby <jslaby@suse.cz>2019-05-26 11:03:25 +0200
commitbde30e19785c484a4b2410a8f27ce4f72a231685 (patch)
treecc0bf511d95e13aa2ef2c57dbddf12893b463adc
parented1f493b64c1a30bcdd2eb4b16768faef028abc1 (diff)
- Linux 5.1.5 (bnc#1012628).stable
- ipv6: fix src addr routing with the exception table (bnc#1012628). - ipv6: prevent possible fib6 leaks (bnc#1012628). - net: Always descend into dsa/ (bnc#1012628). - net: avoid weird emergency message (bnc#1012628). - net/mlx4_core: Change the error print to info print (bnc#1012628). - net: test nouarg before dereferencing zerocopy pointers (bnc#1012628). - net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions (bnc#1012628). - nfp: flower: add rcu locks when accessing netdev for tunnels (bnc#1012628). - ppp: deflate: Fix possible crash in deflate_init (bnc#1012628). - rtnetlink: always put IFLA_LINK for links with a link-netnsid (bnc#1012628). - tipc: switch order of device registration to fix a crash (bnc#1012628). - vsock/virtio: free packets during the socket release (bnc#1012628). - tipc: fix modprobe tipc failed after switch order of device registration (bnc#1012628). - mlxsw: core: Prevent QSFP module initialization for old hardware (bnc#1012628). - mlxsw: core: Prevent reading unsupported slave address from SFP EEPROM (bnc#1012628). - flow_offload: support CVLAN match (bnc#1012628). - net/mlx5e: Fix calling wrong function to get inner vlan key and mask (bnc#1012628). - net/mlx5: Fix peer pf disable hca command (bnc#1012628). - vsock/virtio: Initialize core virtio vsock before registering the driver (bnc#1012628). - net/mlx5e: Add missing ethtool driver info for representors (bnc#1012628). - net/mlx5e: Additional check for flow destination comparison (bnc#1012628). - net/mlx5: Imply MLXFW in mlx5_core (bnc#1012628). - net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is disabled (bnc#1012628). - blk-mq: free hw queue's resource in hctx's release handler (bnc#1012628). - regulator: core: fix error path for regulator_set_voltage_unlocked (bnc#1012628). - parisc: Export running_on_qemu symbol for modules (bnc#1012628). - parisc: Add memory clobber to TLB purges (bnc#1012628). - parisc: Skip registering LED when running in QEMU (bnc#1012628). - parisc: Add memory barrier to asm pdc and sync instructions (bnc#1012628). - parisc: Allow live-patching of __meminit functions (bnc#1012628). - parisc: Use PA_ASM_LEVEL in boot code (bnc#1012628). - parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code (bnc#1012628). - stm class: Fix channel free in stm output free path (bnc#1012628). - stm class: Fix channel bitmap on 32-bit systems (bnc#1012628). - brd: re-enable __GFP_HIGHMEM in brd_insert_page() (bnc#1012628). - proc: prevent changes to overridden credentials (bnc#1012628). - Revert "MD: fix lock contention for flush bios" (bnc#1012628). - md: batch flush requests (bnc#1012628). - md: add mddev->pers to avoid potential NULL pointer dereference (bnc#1012628). - md: add a missing endianness conversion in check_sb_changes (bnc#1012628). - dcache: sort the freeing-without-RCU-delay mess for good (bnc#1012628). - intel_th: msu: Fix single mode with IOMMU (bnc#1012628). - p54: drop device reference count if fails to enable device (bnc#1012628). - of: fix clang -Wunsequenced for be32_to_cpu() (bnc#1012628). - brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 mini PCs (bnc#1012628). - cifs: fix credits leak for SMB1 oplock breaks (bnc#1012628). - cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() (bnc#1012628). - phy: ti-pipe3: fix missing bit-wise or operator when assigning val (bnc#1012628). - media: ov6650: Fix sensor possibly not detected on probe (bnc#1012628). - media: seco-cec: fix building with RC_CORE=m (bnc#1012628). - media: imx: csi: Allow unknown nearest upstream entities (bnc#1012628). - media: imx: Clear fwnode link struct for each endpoint iteration (bnc#1012628). - media: imx: Rename functions that add IPU-internal subdevs (bnc#1012628). - media: imx: Don't register IPU subdevs/links if CSI port missing (bnc#1012628). - RDMA/mlx5: Use get_zeroed_page() for clock_info (bnc#1012628). - RDMA/ipoib: Allow user space differentiate between valid dev_port (bnc#1012628). - NFS4: Fix v4.0 client state corruption when mount (bnc#1012628). - PNFS fallback to MDS if no deviceid found (bnc#1012628). - clk: hi3660: Mark clk_gate_ufs_subsys as critical (bnc#1012628). - clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider (bnc#1012628). - clk: mediatek: Disable tuner_en before change PLL rate (bnc#1012628). - clk: rockchip: fix wrong clock definitions for rk3328 (bnc#1012628). - udlfb: delete the unused parameter for dlfb_handle_damage (bnc#1012628). - udlfb: fix sleeping inside spinlock (bnc#1012628). - udlfb: introduce a rendering mutex (bnc#1012628). - fuse: fix writepages on 32bit (bnc#1012628). - fuse: honor RLIMIT_FSIZE in fuse_file_fallocate (bnc#1012628). - ovl: fix missing upper fs freeze protection on copy up for ioctl (bnc#1012628). - fsnotify: fix unlink performance regression (bnc#1012628). - gcc-plugins: arm_ssp_per_task_plugin: Fix for older GCC < 6 (bnc#1012628). - iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114 (bnc#1012628). - ceph: flush dirty inodes before proceeding with remount (bnc#1012628). - x86_64: Add gap to int3 to allow for call emulation (bnc#1012628). - x86_64: Allow breakpoints to emulate call instructions (bnc#1012628). - ftrace/x86_64: Emulate call function while updating in breakpoint handler (bnc#1012628). - tracing: Fix partial reading of trace event's id file (bnc#1012628). - tracing: probeevent: Fix to make the type of $comm string (bnc#1012628). - memory: tegra: Fix integer overflow on tick value calculation (bnc#1012628). - perf intel-pt: Fix instructions sampling rate (bnc#1012628). - perf intel-pt: Fix improved sample timestamp (bnc#1012628). - perf intel-pt: Fix sample timestamp wrt non-taken branches (bnc#1012628). - MIPS: perf: Fix build with CONFIG_CPU_BMIPS5000 enabled (bnc#1012628). - objtool: Allow AR to be overridden with HOSTAR (bnc#1012628). - x86/mpx, mm/core: Fix recursive munmap() corruption (bnc#1012628). - fbdev/efifb: Ignore framebuffer memmap entries that lack any memory types (bnc#1012628). - fbdev: sm712fb: fix brightness control on reboot, don't set SR30 (bnc#1012628). - fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75 (bnc#1012628). - fbdev: sm712fb: fix white screen of death on reboot, don't set CR3B-CR3F (bnc#1012628). - fbdev: sm712fb: fix boot screen glitch when sm712fb replaces VGA (bnc#1012628). - fbdev: sm712fb: fix crashes during framebuffer writes by correctly mapping VRAM (bnc#1012628). - fbdev: sm712fb: fix support for 1024x768-16 mode (bnc#1012628). - fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix garbled display (bnc#1012628). - fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting (bnc#1012628). - PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken (bnc#1012628). - PCI: Mark Atheros AR9462 to avoid bus reset (bnc#1012628). - PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary (bnc#1012628). - PCI: Init PCIe feature bits for managed host bridge alloc (bnc#1012628). - PCI/AER: Change pci_aer_init() stub to return void (bnc#1012628). - PCI: rcar: Add the initialization of PCIe link in resume_noirq() (bnc#1012628). - PCI: Factor out pcie_retrain_link() function (bnc#1012628). - PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link erratum (bnc#1012628). - dm cache metadata: Fix loading discard bitset (bnc#1012628). - dm zoned: Fix zone report handling (bnc#1012628). - dm init: fix max devices/targets checks (bnc#1012628). - dm delay: fix a crash when invalid device is specified (bnc#1012628). - dm crypt: move detailed message into debug level (bnc#1012628). - dm integrity: correctly calculate the size of metadata area (bnc#1012628). - dm ioctl: fix hang in early create error condition (bnc#1012628). - dm mpath: always free attached_handler_name in parse_path() (bnc#1012628). - fuse: Add FOPEN_STREAM to use stream_open() (bnc#1012628). - md/raid: raid5 preserve the writeback action after the parity check (bnc#1012628). - dmaengine: imx-sdma: Only check ratio on parts that support 1:1 (bnc#1012628). - driver core: Postpone DMA tear-down until after devres release for probe failure (bnc#1012628). - bpf: relax inode permission check for retrieving bpf program (bnc#1012628). - bpf: add map_lookup_elem_sys_only for lookups from syscall side (bnc#1012628). - bpf, lru: avoid messing with eviction heuristics upon syscall lookup (bnc#1012628). - y2038: Make CONFIG_64BIT_TIME unconditional (bnc#1012628). - btrfs: reloc: Fix NULL pointer dereference due to expanded reloc_root lifespan (bnc#1012628). - ARM: dts: imx6q-logicpd: Reduce inrush current on USBH1 (bnc#1012628). - ARM: dts: imx6q-logicpd: Reduce inrush current on start (bnc#1012628). - fbdev: sm712fb: fix memory frequency by avoiding a switch/case fallthrough (bnc#1012628). - Update config files.
-rw-r--r--config/arm64/default2
-rw-r--r--config/armv6hl/default2
-rw-r--r--config/armv7hl/default2
-rw-r--r--config/armv7hl/lpae2
-rw-r--r--config/i386/pae2
-rw-r--r--config/ppc64/default2
-rw-r--r--config/ppc64le/default2
-rw-r--r--config/s390x/default2
-rw-r--r--config/s390x/zfcpdump2
-rw-r--r--config/x86_64/default2
-rw-r--r--patches.kernel.org/5.1.5-001-ipv6-fix-src-addr-routing-with-the-exception-ta.patch143
-rw-r--r--patches.kernel.org/5.1.5-002-ipv6-prevent-possible-fib6-leaks.patch116
-rw-r--r--patches.kernel.org/5.1.5-003-net-Always-descend-into-dsa.patch44
-rw-r--r--patches.kernel.org/5.1.5-004-net-avoid-weird-emergency-message.patch44
-rw-r--r--patches.kernel.org/5.1.5-005-net-mlx4_core-Change-the-error-print-to-info-pr.patch38
-rw-r--r--patches.kernel.org/5.1.5-006-net-test-nouarg-before-dereferencing-zerocopy-p.patch62
-rw-r--r--patches.kernel.org/5.1.5-007-net-usb-qmi_wwan-add-Telit-0x1260-and-0x1261-co.patch39
-rw-r--r--patches.kernel.org/5.1.5-008-nfp-flower-add-rcu-locks-when-accessing-netdev-.patch88
-rw-r--r--patches.kernel.org/5.1.5-009-ppp-deflate-Fix-possible-crash-in-deflate_init.patch92
-rw-r--r--patches.kernel.org/5.1.5-010-rtnetlink-always-put-IFLA_LINK-for-links-with-a.patch101
-rw-r--r--patches.kernel.org/5.1.5-011-tipc-switch-order-of-device-registration-to-fix.patch100
-rw-r--r--patches.kernel.org/5.1.5-012-vsock-virtio-free-packets-during-the-socket-rel.patch48
-rw-r--r--patches.kernel.org/5.1.5-013-tipc-fix-modprobe-tipc-failed-after-switch-orde.patch99
-rw-r--r--patches.kernel.org/5.1.5-014-mlxsw-core-Prevent-QSFP-module-initialization-f.patch103
-rw-r--r--patches.kernel.org/5.1.5-015-mlxsw-core-Prevent-reading-unsupported-slave-ad.patch85
-rw-r--r--patches.kernel.org/5.1.5-016-flow_offload-support-CVLAN-match.patch54
-rw-r--r--patches.kernel.org/5.1.5-017-net-mlx5e-Fix-calling-wrong-function-to-get-inn.patch46
-rw-r--r--patches.kernel.org/5.1.5-018-net-mlx5-Fix-peer-pf-disable-hca-command.patch39
-rw-r--r--patches.kernel.org/5.1.5-019-vsock-virtio-Initialize-core-virtio-vsock-befor.patch115
-rw-r--r--patches.kernel.org/5.1.5-020-net-mlx5e-Add-missing-ethtool-driver-info-for-r.patch68
-rw-r--r--patches.kernel.org/5.1.5-021-net-mlx5e-Additional-check-for-flow-destination.patch48
-rw-r--r--patches.kernel.org/5.1.5-022-net-mlx5-Imply-MLXFW-in-mlx5_core.patch38
-rw-r--r--patches.kernel.org/5.1.5-023-net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG.patch65
-rw-r--r--patches.kernel.org/5.1.5-024-blk-mq-free-hw-queue-s-resource-in-hctx-s-relea.patch141
-rw-r--r--patches.kernel.org/5.1.5-025-regulator-core-fix-error-path-for-regulator_set.patch60
-rw-r--r--patches.kernel.org/5.1.5-026-parisc-Export-running_on_qemu-symbol-for-module.patch32
-rw-r--r--patches.kernel.org/5.1.5-027-parisc-Add-memory-clobber-to-TLB-purges.patch48
-rw-r--r--patches.kernel.org/5.1.5-028-parisc-Skip-registering-LED-when-running-in-QEM.patch36
-rw-r--r--patches.kernel.org/5.1.5-029-parisc-Add-memory-barrier-to-asm-pdc-and-sync-i.patch41
-rw-r--r--patches.kernel.org/5.1.5-030-parisc-Allow-live-patching-of-__meminit-functio.patch37
-rw-r--r--patches.kernel.org/5.1.5-031-parisc-Use-PA_ASM_LEVEL-in-boot-code.patch54
-rw-r--r--patches.kernel.org/5.1.5-032-parisc-Rename-LEVEL-to-PA_ASM_LEVEL-to-avoid-na.patch85
-rw-r--r--patches.kernel.org/5.1.5-033-stm-class-Fix-channel-free-in-stm-output-free-p.patch45
-rw-r--r--patches.kernel.org/5.1.5-034-stm-class-Fix-channel-bitmap-on-32-bit-systems.patch50
-rw-r--r--patches.kernel.org/5.1.5-035-brd-re-enable-__GFP_HIGHMEM-in-brd_insert_page.patch48
-rw-r--r--patches.kernel.org/5.1.5-036-proc-prevent-changes-to-overridden-credentials.patch46
-rw-r--r--patches.kernel.org/5.1.5-037-Revert-MD-fix-lock-contention-for-flush-bios.patch319
-rw-r--r--patches.kernel.org/5.1.5-038-md-batch-flush-requests.patch177
-rw-r--r--patches.kernel.org/5.1.5-039-md-add-mddev-pers-to-avoid-potential-NULL-point.patch47
-rw-r--r--patches.kernel.org/5.1.5-040-md-add-a-missing-endianness-conversion-in-check.patch39
-rw-r--r--patches.kernel.org/5.1.5-041-dcache-sort-the-freeing-without-RCU-delay-mess-.patch182
-rw-r--r--patches.kernel.org/5.1.5-042-intel_th-msu-Fix-single-mode-with-IOMMU.patch109
-rw-r--r--patches.kernel.org/5.1.5-043-p54-drop-device-reference-count-if-fails-to-ena.patch47
-rw-r--r--patches.kernel.org/5.1.5-044-of-fix-clang-Wunsequenced-for-be32_to_cpu.patch61
-rw-r--r--patches.kernel.org/5.1.5-045-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC.patch81
-rw-r--r--patches.kernel.org/5.1.5-046-cifs-fix-credits-leak-for-SMB1-oplock-breaks.patch86
-rw-r--r--patches.kernel.org/5.1.5-047-cifs-fix-strcat-buffer-overflow-and-reduce-raci.patch68
-rw-r--r--patches.kernel.org/5.1.5-048-phy-ti-pipe3-fix-missing-bit-wise-or-operator-w.patch39
-rw-r--r--patches.kernel.org/5.1.5-049-media-ov6650-Fix-sensor-possibly-not-detected-o.patch52
-rw-r--r--patches.kernel.org/5.1.5-050-media-seco-cec-fix-building-with-RC_CORE-m.patch50
-rw-r--r--patches.kernel.org/5.1.5-051-media-imx-csi-Allow-unknown-nearest-upstream-en.patch75
-rw-r--r--patches.kernel.org/5.1.5-052-media-imx-Clear-fwnode-link-struct-for-each-end.patch61
-rw-r--r--patches.kernel.org/5.1.5-053-media-imx-Rename-functions-that-add-IPU-interna.patch173
-rw-r--r--patches.kernel.org/5.1.5-054-media-imx-Don-t-register-IPU-subdevs-links-if-C.patch220
-rw-r--r--patches.kernel.org/5.1.5-055-RDMA-mlx5-Use-get_zeroed_page-for-clock_info.patch107
-rw-r--r--patches.kernel.org/5.1.5-056-RDMA-ipoib-Allow-user-space-differentiate-betwe.patch62
-rw-r--r--patches.kernel.org/5.1.5-057-NFS4-Fix-v4.0-client-state-corruption-when-moun.patch52
-rw-r--r--patches.kernel.org/5.1.5-058-PNFS-fallback-to-MDS-if-no-deviceid-found.patch39
-rw-r--r--patches.kernel.org/5.1.5-059-clk-hi3660-Mark-clk_gate_ufs_subsys-as-critical.patch49
-rw-r--r--patches.kernel.org/5.1.5-060-clk-tegra-Fix-PLLM-programming-on-Tegra124-when.patch45
-rw-r--r--patches.kernel.org/5.1.5-061-clk-mediatek-Disable-tuner_en-before-change-PLL.patch118
-rw-r--r--patches.kernel.org/5.1.5-062-clk-rockchip-fix-wrong-clock-definitions-for-rk.patch98
-rw-r--r--patches.kernel.org/5.1.5-063-udlfb-delete-the-unused-parameter-for-dlfb_hand.patch107
-rw-r--r--patches.kernel.org/5.1.5-064-udlfb-fix-sleeping-inside-spinlock.patch154
-rw-r--r--patches.kernel.org/5.1.5-065-udlfb-introduce-a-rendering-mutex.patch156
-rw-r--r--patches.kernel.org/5.1.5-066-fuse-fix-writepages-on-32bit.patch41
-rw-r--r--patches.kernel.org/5.1.5-067-fuse-honor-RLIMIT_FSIZE-in-fuse_file_fallocate.patch45
-rw-r--r--patches.kernel.org/5.1.5-068-ovl-fix-missing-upper-fs-freeze-protection-on-c.patch99
-rw-r--r--patches.kernel.org/5.1.5-069-fsnotify-fix-unlink-performance-regression.patch151
-rw-r--r--patches.kernel.org/5.1.5-070-gcc-plugins-arm_ssp_per_task_plugin-Fix-for-old.patch54
-rw-r--r--patches.kernel.org/5.1.5-071-iommu-tegra-smmu-Fix-invalid-ASID-bits-on-Tegra.patch86
-rw-r--r--patches.kernel.org/5.1.5-072-ceph-flush-dirty-inodes-before-proceeding-with-.patch53
-rw-r--r--patches.kernel.org/5.1.5-073-x86_64-Add-gap-to-int3-to-allow-for-call-emulat.patch81
-rw-r--r--patches.kernel.org/5.1.5-074-x86_64-Allow-breakpoints-to-emulate-call-instru.patch99
-rw-r--r--patches.kernel.org/5.1.5-075-ftrace-x86_64-Emulate-call-function-while-updat.patch158
-rw-r--r--patches.kernel.org/5.1.5-076-tracing-Fix-partial-reading-of-trace-event-s-id.patch82
-rw-r--r--patches.kernel.org/5.1.5-077-tracing-probeevent-Fix-to-make-the-type-of-comm.patch57
-rw-r--r--patches.kernel.org/5.1.5-078-memory-tegra-Fix-integer-overflow-on-tick-value.patch39
-rw-r--r--patches.kernel.org/5.1.5-079-perf-intel-pt-Fix-instructions-sampling-rate.patch96
-rw-r--r--patches.kernel.org/5.1.5-080-perf-intel-pt-Fix-improved-sample-timestamp.patch101
-rw-r--r--patches.kernel.org/5.1.5-081-perf-intel-pt-Fix-sample-timestamp-wrt-non-take.patch52
-rw-r--r--patches.kernel.org/5.1.5-082-MIPS-perf-Fix-build-with-CONFIG_CPU_BMIPS5000-e.patch106
-rw-r--r--patches.kernel.org/5.1.5-083-objtool-Allow-AR-to-be-overridden-with-HOSTAR.patch62
-rw-r--r--patches.kernel.org/5.1.5-084-x86-mpx-mm-core-Fix-recursive-munmap-corruption.patch374
-rw-r--r--patches.kernel.org/5.1.5-085-fbdev-efifb-Ignore-framebuffer-memmap-entries-t.patch81
-rw-r--r--patches.kernel.org/5.1.5-086-fbdev-sm712fb-fix-brightness-control-on-reboot-.patch52
-rw-r--r--patches.kernel.org/5.1.5-087-fbdev-sm712fb-fix-VRAM-detection-don-t-set-SR70.patch49
-rw-r--r--patches.kernel.org/5.1.5-088-fbdev-sm712fb-fix-white-screen-of-death-on-rebo.patch57
-rw-r--r--patches.kernel.org/5.1.5-089-fbdev-sm712fb-fix-boot-screen-glitch-when-sm712.patch47
-rw-r--r--patches.kernel.org/5.1.5-090-fbdev-sm712fb-fix-crashes-during-framebuffer-wr.patch155
-rw-r--r--patches.kernel.org/5.1.5-091-fbdev-sm712fb-fix-support-for-1024x768-16-mode.patch100
-rw-r--r--patches.kernel.org/5.1.5-092-fbdev-sm712fb-use-1024x768-by-default-on-non-MI.patch132
-rw-r--r--patches.kernel.org/5.1.5-093-fbdev-sm712fb-fix-crashes-and-garbled-display-d.patch146
-rw-r--r--patches.kernel.org/5.1.5-094-PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch49
-rw-r--r--patches.kernel.org/5.1.5-095-PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch39
-rw-r--r--patches.kernel.org/5.1.5-096-PCI-Reset-Lenovo-ThinkPad-P50-nvgpu-at-boot-if-.patch156
-rw-r--r--patches.kernel.org/5.1.5-097-PCI-Init-PCIe-feature-bits-for-managed-host-bri.patch78
-rw-r--r--patches.kernel.org/5.1.5-098-PCI-AER-Change-pci_aer_init-stub-to-return-void.patch40
-rw-r--r--patches.kernel.org/5.1.5-099-PCI-rcar-Add-the-initialization-of-PCIe-link-in.patch97
-rw-r--r--patches.kernel.org/5.1.5-100-PCI-Factor-out-pcie_retrain_link-function.patch93
-rw-r--r--patches.kernel.org/5.1.5-101-PCI-Work-around-Pericom-PCIe-to-PCI-bridge-Retr.patch111
-rw-r--r--patches.kernel.org/5.1.5-102-dm-cache-metadata-Fix-loading-discard-bitset.patch52
-rw-r--r--patches.kernel.org/5.1.5-103-dm-zoned-Fix-zone-report-handling.patch62
-rw-r--r--patches.kernel.org/5.1.5-104-dm-init-fix-max-devices-targets-checks.patch54
-rw-r--r--patches.kernel.org/5.1.5-105-dm-delay-fix-a-crash-when-invalid-device-is-spe.patch39
-rw-r--r--patches.kernel.org/5.1.5-106-dm-crypt-move-detailed-message-into-debug-level.patch78
-rw-r--r--patches.kernel.org/5.1.5-107-dm-integrity-correctly-calculate-the-size-of-me.patch53
-rw-r--r--patches.kernel.org/5.1.5-108-dm-ioctl-fix-hang-in-early-create-error-conditi.patch55
-rw-r--r--patches.kernel.org/5.1.5-109-dm-mpath-always-free-attached_handler_name-in-p.patch51
-rw-r--r--patches.kernel.org/5.1.5-110-fuse-Add-FOPEN_STREAM-to-use-stream_open.patch94
-rw-r--r--patches.kernel.org/5.1.5-111-dm-make-sure-to-obey-max_io_len_target_boundary.patch (renamed from patches.suse/dm-make-sure-to-obey-max_io_len_target_boundary.patch)21
-rw-r--r--patches.kernel.org/5.1.5-112-Revert-Don-t-jump-to-compute_result-state-from-.patch (renamed from patches.suse/Revert-Don-t-jump-to-compute_result-state-from-check.patch)14
-rw-r--r--patches.kernel.org/5.1.5-113-md-raid-raid5-preserve-the-writeback-action-aft.patch58
-rw-r--r--patches.kernel.org/5.1.5-114-dmaengine-imx-sdma-Only-check-ratio-on-parts-th.patch84
-rw-r--r--patches.kernel.org/5.1.5-115-driver-core-Postpone-DMA-tear-down-until-after-.patch123
-rw-r--r--patches.kernel.org/5.1.5-116-bpf-relax-inode-permission-check-for-retrieving.patch43
-rw-r--r--patches.kernel.org/5.1.5-117-bpf-add-map_lookup_elem_sys_only-for-lookups-fr.patch61
-rw-r--r--patches.kernel.org/5.1.5-118-bpf-lru-avoid-messing-with-eviction-heuristics-.patch112
-rw-r--r--patches.kernel.org/5.1.5-119-y2038-Make-CONFIG_64BIT_TIME-unconditional.patch62
-rw-r--r--patches.kernel.org/5.1.5-120-btrfs-reloc-Fix-NULL-pointer-dereference-due-to.patch91
-rw-r--r--patches.kernel.org/5.1.5-121-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch39
-rw-r--r--patches.kernel.org/5.1.5-122-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch41
-rw-r--r--patches.kernel.org/5.1.5-123-fbdev-sm712fb-fix-memory-frequency-by-avoiding-.patch52
-rw-r--r--patches.kernel.org/5.1.5-124-Linux-5.1.5.patch28
-rw-r--r--series.conf126
135 files changed, 10078 insertions, 24 deletions
diff --git a/config/arm64/default b/config/arm64/default
index 5aed903ccf..3814eaad8d 100644
--- a/config/arm64/default
+++ b/config/arm64/default
@@ -714,7 +714,7 @@ CONFIG_ARCH_MMAP_RND_COMPAT_BITS=11
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_COMPAT_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
CONFIG_HAVE_ARCH_VMAP_STACK=y
diff --git a/config/armv6hl/default b/config/armv6hl/default
index 462810ce3d..54b656fccf 100644
--- a/config/armv6hl/default
+++ b/config/armv6hl/default
@@ -644,7 +644,7 @@ CONFIG_ARCH_MMAP_RND_BITS=8
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
# CONFIG_HAVE_ARCH_VMAP_STACK is not set
diff --git a/config/armv7hl/default b/config/armv7hl/default
index e9fd29be1f..2deb3c6bd1 100644
--- a/config/armv7hl/default
+++ b/config/armv7hl/default
@@ -924,7 +924,7 @@ CONFIG_ARCH_MMAP_RND_BITS=8
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
# CONFIG_HAVE_ARCH_VMAP_STACK is not set
diff --git a/config/armv7hl/lpae b/config/armv7hl/lpae
index 5bcc70b791..951022687c 100644
--- a/config/armv7hl/lpae
+++ b/config/armv7hl/lpae
@@ -883,7 +883,7 @@ CONFIG_ARCH_MMAP_RND_BITS=8
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
# CONFIG_HAVE_ARCH_VMAP_STACK is not set
diff --git a/config/i386/pae b/config/i386/pae
index 29454f79e5..c87646184b 100644
--- a/config/i386/pae
+++ b/config/i386/pae
@@ -789,7 +789,7 @@ CONFIG_ISA_BUS_API=y
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
# CONFIG_HAVE_ARCH_VMAP_STACK is not set
diff --git a/config/ppc64/default b/config/ppc64/default
index 5e148cfe52..cb66dd74f7 100644
--- a/config/ppc64/default
+++ b/config/ppc64/default
@@ -607,7 +607,7 @@ CONFIG_HAVE_ARCH_NVRAM_OPS=y
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND=y
CONFIG_COMPAT_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
# CONFIG_HAVE_ARCH_VMAP_STACK is not set
diff --git a/config/ppc64le/default b/config/ppc64le/default
index 00f1c51939..3cf9b767f6 100644
--- a/config/ppc64le/default
+++ b/config/ppc64le/default
@@ -549,7 +549,7 @@ CONFIG_HAVE_ARCH_NVRAM_OPS=y
CONFIG_CLONE_BACKWARDS=y
CONFIG_OLD_SIGSUSPEND=y
CONFIG_COMPAT_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
# CONFIG_HAVE_ARCH_VMAP_STACK is not set
diff --git a/config/s390x/default b/config/s390x/default
index cfc629f71b..7584c563b5 100644
--- a/config/s390x/default
+++ b/config/s390x/default
@@ -432,7 +432,7 @@ CONFIG_CLONE_BACKWARDS2=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_OLD_SIGACTION=y
CONFIG_COMPAT_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
CONFIG_CPU_NO_EFFICIENT_FFS=y
CONFIG_HAVE_ARCH_VMAP_STACK=y
diff --git a/config/s390x/zfcpdump b/config/s390x/zfcpdump
index e583f9c6bc..99f953f8e1 100644
--- a/config/s390x/zfcpdump
+++ b/config/s390x/zfcpdump
@@ -366,7 +366,7 @@ CONFIG_CLONE_BACKWARDS2=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_OLD_SIGACTION=y
CONFIG_COMPAT_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
CONFIG_CPU_NO_EFFICIENT_FFS=y
CONFIG_HAVE_ARCH_VMAP_STACK=y
diff --git a/config/x86_64/default b/config/x86_64/default
index 158910d47a..06dc04b5be 100644
--- a/config/x86_64/default
+++ b/config/x86_64/default
@@ -778,7 +778,7 @@ CONFIG_HAVE_RELIABLE_STACKTRACE=y
CONFIG_ISA_BUS_API=y
CONFIG_OLD_SIGSUSPEND3=y
CONFIG_COMPAT_OLD_SIGACTION=y
-# CONFIG_64BIT_TIME is not set
+CONFIG_64BIT_TIME=y
CONFIG_COMPAT_32BIT_TIME=y
# CONFIG_CPU_NO_EFFICIENT_FFS is not set
CONFIG_HAVE_ARCH_VMAP_STACK=y
diff --git a/patches.kernel.org/5.1.5-001-ipv6-fix-src-addr-routing-with-the-exception-ta.patch b/patches.kernel.org/5.1.5-001-ipv6-fix-src-addr-routing-with-the-exception-ta.patch
new file mode 100644
index 0000000000..a34237d963
--- /dev/null
+++ b/patches.kernel.org/5.1.5-001-ipv6-fix-src-addr-routing-with-the-exception-ta.patch
@@ -0,0 +1,143 @@
+From: Wei Wang <weiwan@google.com>
+Date: Thu, 16 May 2019 13:30:54 -0700
+Subject: [PATCH] ipv6: fix src addr routing with the exception table
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 510e2ceda031eed97a7a0f9aad65d271a58b460d
+
+[ Upstream commit 510e2ceda031eed97a7a0f9aad65d271a58b460d ]
+
+When inserting route cache into the exception table, the key is
+generated with both src_addr and dest_addr with src addr routing.
+However, current logic always assumes the src_addr used to generate the
+key is a /128 host address. This is not true in the following scenarios:
+1. When the route is a gateway route or does not have next hop.
+ (rt6_is_gw_or_nonexthop() == false)
+2. When calling ip6_rt_cache_alloc(), saddr is passed in as NULL.
+This means, when looking for a route cache in the exception table, we
+have to do the lookup twice: first time with the passed in /128 host
+address, second time with the src_addr stored in fib6_info.
+
+This solves the pmtu discovery issue reported by Mikael Magnusson where
+a route cache with a lower mtu info is created for a gateway route with
+src addr. However, the lookup code is not able to find this route cache.
+
+Fixes: 2b760fcf5cfb ("ipv6: hook up exception table to store dst cache")
+Reported-by: Mikael Magnusson <mikael.kernel@lists.m7n.se>
+Bisected-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Wei Wang <weiwan@google.com>
+Cc: Martin Lau <kafai@fb.com>
+Cc: Eric Dumazet <edumazet@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/ipv6/route.c | 51 +++++++++++++++++++++++++-----------------------
+ 1 file changed, 27 insertions(+), 24 deletions(-)
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 0520aca3354b..4ede79018481 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -110,8 +110,8 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
+ int iif, int type, u32 portid, u32 seq,
+ unsigned int flags);
+ static struct rt6_info *rt6_find_cached_rt(struct fib6_info *rt,
+- struct in6_addr *daddr,
+- struct in6_addr *saddr);
++ const struct in6_addr *daddr,
++ const struct in6_addr *saddr);
+
+ #ifdef CONFIG_IPV6_ROUTE_INFO
+ static struct fib6_info *rt6_add_route_info(struct net *net,
+@@ -1529,31 +1529,44 @@ out:
+ * Caller has to hold rcu_read_lock()
+ */
+ static struct rt6_info *rt6_find_cached_rt(struct fib6_info *rt,
+- struct in6_addr *daddr,
+- struct in6_addr *saddr)
++ const struct in6_addr *daddr,
++ const struct in6_addr *saddr)
+ {
++ const struct in6_addr *src_key = NULL;
+ struct rt6_exception_bucket *bucket;
+- struct in6_addr *src_key = NULL;
+ struct rt6_exception *rt6_ex;
+ struct rt6_info *res = NULL;
+
+- bucket = rcu_dereference(rt->rt6i_exception_bucket);
+-
+ #ifdef CONFIG_IPV6_SUBTREES
+ /* rt6i_src.plen != 0 indicates rt is in subtree
+ * and exception table is indexed by a hash of
+ * both rt6i_dst and rt6i_src.
+- * Otherwise, the exception table is indexed by
+- * a hash of only rt6i_dst.
++ * However, the src addr used to create the hash
++ * might not be exactly the passed in saddr which
++ * is a /128 addr from the flow.
++ * So we need to use f6i->fib6_src to redo lookup
++ * if the passed in saddr does not find anything.
++ * (See the logic in ip6_rt_cache_alloc() on how
++ * rt->rt6i_src is updated.)
+ */
+ if (rt->fib6_src.plen)
+ src_key = saddr;
++find_ex:
+ #endif
++ bucket = rcu_dereference(rt->rt6i_exception_bucket);
+ rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
+
+ if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
+ res = rt6_ex->rt6i;
+
++#ifdef CONFIG_IPV6_SUBTREES
++ /* Use fib6_src as src_key and redo lookup */
++ if (!res && src_key && src_key != &rt->fib6_src.addr) {
++ src_key = &rt->fib6_src.addr;
++ goto find_ex;
++ }
++#endif
++
+ return res;
+ }
+
+@@ -2608,10 +2621,8 @@ out:
+ u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
+ struct in6_addr *saddr)
+ {
+- struct rt6_exception_bucket *bucket;
+- struct rt6_exception *rt6_ex;
+- struct in6_addr *src_key;
+ struct inet6_dev *idev;
++ struct rt6_info *rt;
+ u32 mtu = 0;
+
+ if (unlikely(fib6_metric_locked(f6i, RTAX_MTU))) {
+@@ -2620,18 +2631,10 @@ u32 ip6_mtu_from_fib6(struct fib6_info *f6i, struct in6_addr *daddr,
+ goto out;
+ }
+
+- src_key = NULL;
+-#ifdef CONFIG_IPV6_SUBTREES
+- if (f6i->fib6_src.plen)
+- src_key = saddr;
+-#endif
+-
+- bucket = rcu_dereference(f6i->rt6i_exception_bucket);
+- rt6_ex = __rt6_find_exception_rcu(&bucket, daddr, src_key);
+- if (rt6_ex && !rt6_check_expired(rt6_ex->rt6i))
+- mtu = dst_metric_raw(&rt6_ex->rt6i->dst, RTAX_MTU);
+-
+- if (likely(!mtu)) {
++ rt = rt6_find_cached_rt(f6i, daddr, saddr);
++ if (unlikely(rt)) {
++ mtu = dst_metric_raw(&rt->dst, RTAX_MTU);
++ } else {
+ struct net_device *dev = fib6_info_nh_dev(f6i);
+
+ mtu = IPV6_MIN_MTU;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-002-ipv6-prevent-possible-fib6-leaks.patch b/patches.kernel.org/5.1.5-002-ipv6-prevent-possible-fib6-leaks.patch
new file mode 100644
index 0000000000..b00a2ec69a
--- /dev/null
+++ b/patches.kernel.org/5.1.5-002-ipv6-prevent-possible-fib6-leaks.patch
@@ -0,0 +1,116 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 15 May 2019 19:39:52 -0700
+Subject: [PATCH] ipv6: prevent possible fib6 leaks
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 61fb0d01680771f72cc9d39783fb2c122aaad51e
+
+[ Upstream commit 61fb0d01680771f72cc9d39783fb2c122aaad51e ]
+
+At ipv6 route dismantle, fib6_drop_pcpu_from() is responsible
+for finding all percpu routes and set their ->from pointer
+to NULL, so that fib6_ref can reach its expected value (1).
+
+The problem right now is that other cpus can still catch the
+route being deleted, since there is no rcu grace period
+between the route deletion and call to fib6_drop_pcpu_from()
+
+This can leak the fib6 and associated resources, since no
+notifier will take care of removing the last reference(s).
+
+I decided to add another boolean (fib6_destroying) instead
+of reusing/renaming exception_bucket_flushed to ease stable backports,
+and properly document the memory barriers used to implement this fix.
+
+This patch has been co-developped with Wei Wang.
+
+Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Wei Wang <weiwan@google.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Martin Lau <kafai@fb.com>
+Acked-by: Wei Wang <weiwan@google.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Reviewed-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/ip6_fib.h | 3 ++-
+ net/ipv6/ip6_fib.c | 12 +++++++++---
+ net/ipv6/route.c | 7 +++++++
+ 3 files changed, 18 insertions(+), 4 deletions(-)
+
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 84097010237c..b5e3add90e99 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -171,7 +171,8 @@ struct fib6_info {
+ dst_nocount:1,
+ dst_nopolicy:1,
+ dst_host:1,
+- unused:3;
++ fib6_destroying:1,
++ unused:2;
+
+ struct fib6_nh fib6_nh;
+ struct rcu_head rcu;
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 91247a6fc67f..9915f64b38a0 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -909,6 +909,12 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
+ {
+ int cpu;
+
++ /* Make sure rt6_make_pcpu_route() wont add other percpu routes
++ * while we are cleaning them here.
++ */
++ f6i->fib6_destroying = 1;
++ mb(); /* paired with the cmpxchg() in rt6_make_pcpu_route() */
++
+ /* release the reference to this fib entry from
+ * all of its cached pcpu routes
+ */
+@@ -932,6 +938,9 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
+ {
+ struct fib6_table *table = rt->fib6_table;
+
++ if (rt->rt6i_pcpu)
++ fib6_drop_pcpu_from(rt, table);
++
+ if (atomic_read(&rt->fib6_ref) != 1) {
+ /* This route is used as dummy address holder in some split
+ * nodes. It is not leaked, but it still holds other resources,
+@@ -953,9 +962,6 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
+ fn = rcu_dereference_protected(fn->parent,
+ lockdep_is_held(&table->tb6_lock));
+ }
+-
+- if (rt->rt6i_pcpu)
+- fib6_drop_pcpu_from(rt, table);
+ }
+ }
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 4ede79018481..e470589fb93b 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1260,6 +1260,13 @@ static struct rt6_info *rt6_make_pcpu_route(struct net *net,
+ prev = cmpxchg(p, NULL, pcpu_rt);
+ BUG_ON(prev);
+
++ if (rt->fib6_destroying) {
++ struct fib6_info *from;
++
++ from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
++ fib6_info_release(from);
++ }
++
+ return pcpu_rt;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-003-net-Always-descend-into-dsa.patch b/patches.kernel.org/5.1.5-003-net-Always-descend-into-dsa.patch
new file mode 100644
index 0000000000..45a9d89334
--- /dev/null
+++ b/patches.kernel.org/5.1.5-003-net-Always-descend-into-dsa.patch
@@ -0,0 +1,44 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 13 May 2019 14:06:24 -0700
+Subject: [PATCH] net: Always descend into dsa/
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 0fe9f173d6cda95874edeb413b1fa9907b5ae830
+
+[ Upstream commit 0fe9f173d6cda95874edeb413b1fa9907b5ae830 ]
+
+Jiri reported that with a kernel built with CONFIG_FIXED_PHY=y,
+CONFIG_NET_DSA=m and CONFIG_NET_DSA_LOOP=m, we would not get to a
+functional state where the mock-up driver is registered. Turns out that
+we are not descending into drivers/net/dsa/ unconditionally, and we
+won't be able to link-in dsa_loop_bdinfo.o which does the actual mock-up
+mdio device registration.
+
+Reported-by: Jiri Pirko <jiri@resnulli.us>
+Fixes: 40013ff20b1b ("net: dsa: Fix functional dsa-loop dependency on FIXED_PHY")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Vivien Didelot <vivien.didelot@gmail.com>
+Tested-by: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/Makefile b/drivers/net/Makefile
+index 21cde7e78621..0d3ba056cda3 100644
+--- a/drivers/net/Makefile
++++ b/drivers/net/Makefile
+@@ -40,7 +40,7 @@ obj-$(CONFIG_ARCNET) += arcnet/
+ obj-$(CONFIG_DEV_APPLETALK) += appletalk/
+ obj-$(CONFIG_CAIF) += caif/
+ obj-$(CONFIG_CAN) += can/
+-obj-$(CONFIG_NET_DSA) += dsa/
++obj-y += dsa/
+ obj-$(CONFIG_ETHERNET) += ethernet/
+ obj-$(CONFIG_FDDI) += fddi/
+ obj-$(CONFIG_HIPPI) += hippi/
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-004-net-avoid-weird-emergency-message.patch b/patches.kernel.org/5.1.5-004-net-avoid-weird-emergency-message.patch
new file mode 100644
index 0000000000..7d55b1b1ff
--- /dev/null
+++ b/patches.kernel.org/5.1.5-004-net-avoid-weird-emergency-message.patch
@@ -0,0 +1,44 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 16 May 2019 08:09:57 -0700
+Subject: [PATCH] net: avoid weird emergency message
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: d7c04b05c9ca14c55309eb139430283a45c4c25f
+
+[ Upstream commit d7c04b05c9ca14c55309eb139430283a45c4c25f ]
+
+When host is under high stress, it is very possible thread
+running netdev_wait_allrefs() returns from msleep(250)
+10 seconds late.
+
+This leads to these messages in the syslog :
+
+[...] unregister_netdevice: waiting for syz_tun to become free. Usage count = 0
+
+If the device refcount is zero, the wait is over.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index f409406254dd..255f99cb7c48 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8911,7 +8911,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
+
+ refcnt = netdev_refcnt_read(dev);
+
+- if (time_after(jiffies, warning_time + 10 * HZ)) {
++ if (refcnt && time_after(jiffies, warning_time + 10 * HZ)) {
+ pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
+ dev->name, refcnt);
+ warning_time = jiffies;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-005-net-mlx4_core-Change-the-error-print-to-info-pr.patch b/patches.kernel.org/5.1.5-005-net-mlx4_core-Change-the-error-print-to-info-pr.patch
new file mode 100644
index 0000000000..dd54c6536c
--- /dev/null
+++ b/patches.kernel.org/5.1.5-005-net-mlx4_core-Change-the-error-print-to-info-pr.patch
@@ -0,0 +1,38 @@
+From: Yunjian Wang <wangyunjian@huawei.com>
+Date: Tue, 14 May 2019 19:03:19 +0800
+Subject: [PATCH] net/mlx4_core: Change the error print to info print
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 00f9fec48157f3734e52130a119846e67a12314b
+
+[ Upstream commit 00f9fec48157f3734e52130a119846e67a12314b ]
+
+The error print within mlx4_flow_steer_promisc_add() should
+be a info print.
+
+Fixes: 592e49dda812 ('net/mlx4: Implement promiscuous mode with device managed flow-steering')
+Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlx4/mcg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+index ffed2d4c9403..9c481823b3e8 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
+@@ -1492,7 +1492,7 @@ int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port,
+ rule.port = port;
+ rule.qpn = qpn;
+ INIT_LIST_HEAD(&rule.list);
+- mlx4_err(dev, "going promisc on %x\n", port);
++ mlx4_info(dev, "going promisc on %x\n", port);
+
+ return mlx4_flow_attach(dev, &rule, regid_p);
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-006-net-test-nouarg-before-dereferencing-zerocopy-p.patch b/patches.kernel.org/5.1.5-006-net-test-nouarg-before-dereferencing-zerocopy-p.patch
new file mode 100644
index 0000000000..4317bd3204
--- /dev/null
+++ b/patches.kernel.org/5.1.5-006-net-test-nouarg-before-dereferencing-zerocopy-p.patch
@@ -0,0 +1,62 @@
+From: Willem de Bruijn <willemb@google.com>
+Date: Wed, 15 May 2019 13:29:16 -0400
+Subject: [PATCH] net: test nouarg before dereferencing zerocopy pointers
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 185ce5c38ea76f29b6bd9c7c8c7a5e5408834920
+
+[ Upstream commit 185ce5c38ea76f29b6bd9c7c8c7a5e5408834920 ]
+
+Zerocopy skbs without completion notification were added for packet
+sockets with PACKET_TX_RING user buffers. Those signal completion
+through the TP_STATUS_USER bit in the ring. Zerocopy annotation was
+added only to avoid premature notification after clone or orphan, by
+triggering a copy on these paths for these packets.
+
+The mechanism had to define a special "no-uarg" mode because packet
+sockets already use skb_uarg(skb) == skb_shinfo(skb)->destructor_arg
+for a different pointer.
+
+Before deferencing skb_uarg(skb), verify that it is a real pointer.
+
+Fixes: 5cd8d46ea1562 ("packet: copy user buffers before orphan or clone")
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/linux/skbuff.h | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 9027a8c4219f..20a4c2280308 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1425,10 +1425,12 @@ static inline void skb_zcopy_clear(struct sk_buff *skb, bool zerocopy)
+ struct ubuf_info *uarg = skb_zcopy(skb);
+
+ if (uarg) {
+- if (uarg->callback == sock_zerocopy_callback) {
++ if (skb_zcopy_is_nouarg(skb)) {
++ /* no notification callback */
++ } else if (uarg->callback == sock_zerocopy_callback) {
+ uarg->zerocopy = uarg->zerocopy && zerocopy;
+ sock_zerocopy_put(uarg);
+- } else if (!skb_zcopy_is_nouarg(skb)) {
++ } else {
+ uarg->callback(uarg, zerocopy);
+ }
+
+@@ -2683,7 +2685,8 @@ static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
+ {
+ if (likely(!skb_zcopy(skb)))
+ return 0;
+- if (skb_uarg(skb)->callback == sock_zerocopy_callback)
++ if (!skb_zcopy_is_nouarg(skb) &&
++ skb_uarg(skb)->callback == sock_zerocopy_callback)
+ return 0;
+ return skb_copy_ubufs(skb, gfp_mask);
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-007-net-usb-qmi_wwan-add-Telit-0x1260-and-0x1261-co.patch b/patches.kernel.org/5.1.5-007-net-usb-qmi_wwan-add-Telit-0x1260-and-0x1261-co.patch
new file mode 100644
index 0000000000..d18d1f8470
--- /dev/null
+++ b/patches.kernel.org/5.1.5-007-net-usb-qmi_wwan-add-Telit-0x1260-and-0x1261-co.patch
@@ -0,0 +1,39 @@
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Wed, 15 May 2019 17:29:43 +0200
+Subject: [PATCH] net: usb: qmi_wwan: add Telit 0x1260 and 0x1261 compositions
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b4e467c82f8c12af78b6f6fa5730cb7dea7af1b4
+
+[ Upstream commit b4e467c82f8c12af78b6f6fa5730cb7dea7af1b4 ]
+
+Added support for Telit LE910Cx 0x1260 and 0x1261 compositions.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/usb/qmi_wwan.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 679e404a5224..366217263d70 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1250,6 +1250,8 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
+ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)}, /* Telit LE910Cx */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)}, /* Telit LE910Cx */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)}, /* Telit LN940 series */
+ {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */
+ {QMI_FIXED_INTF(0x1c9e, 0x9803, 4)}, /* Telewell TW-3G HSPA+ */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-008-nfp-flower-add-rcu-locks-when-accessing-netdev-.patch b/patches.kernel.org/5.1.5-008-nfp-flower-add-rcu-locks-when-accessing-netdev-.patch
new file mode 100644
index 0000000000..7e38217b1e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-008-nfp-flower-add-rcu-locks-when-accessing-netdev-.patch
@@ -0,0 +1,88 @@
+From: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Date: Tue, 14 May 2019 14:28:19 -0700
+Subject: [PATCH] nfp: flower: add rcu locks when accessing netdev for tunnels
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: cb07d915bf278a7a3938b983bbcb4921366b5eff
+
+[ Upstream commit cb07d915bf278a7a3938b983bbcb4921366b5eff ]
+
+Add rcu locks when accessing netdev when processing route request
+and tunnel keep alive messages received from hardware.
+
+Fixes: 8e6a9046b66a ("nfp: flower vxlan neighbour offload")
+Fixes: 856f5b135758 ("nfp: flower vxlan neighbour keep-alive")
+Signed-off-by: Pieter Jansen van Vuuren <pieter.jansenvanvuuren@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: John Hurley <john.hurley@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ .../ethernet/netronome/nfp/flower/tunnel_conf.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+index 4d78be4ec4e9..843ddf548f26 100644
+--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
++++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+@@ -168,6 +168,7 @@ void nfp_tunnel_keep_alive(struct nfp_app *app, struct sk_buff *skb)
+ return;
+ }
+
++ rcu_read_lock();
+ for (i = 0; i < count; i++) {
+ ipv4_addr = payload->tun_info[i].ipv4;
+ port = be32_to_cpu(payload->tun_info[i].egress_port);
+@@ -183,6 +184,7 @@ void nfp_tunnel_keep_alive(struct nfp_app *app, struct sk_buff *skb)
+ neigh_event_send(n, NULL);
+ neigh_release(n);
+ }
++ rcu_read_unlock();
+ }
+
+ static int
+@@ -366,9 +368,10 @@ void nfp_tunnel_request_route(struct nfp_app *app, struct sk_buff *skb)
+
+ payload = nfp_flower_cmsg_get_data(skb);
+
++ rcu_read_lock();
+ netdev = nfp_app_repr_get(app, be32_to_cpu(payload->ingress_port));
+ if (!netdev)
+- goto route_fail_warning;
++ goto fail_rcu_unlock;
+
+ flow.daddr = payload->ipv4_addr;
+ flow.flowi4_proto = IPPROTO_UDP;
+@@ -378,21 +381,23 @@ void nfp_tunnel_request_route(struct nfp_app *app, struct sk_buff *skb)
+ rt = ip_route_output_key(dev_net(netdev), &flow);
+ err = PTR_ERR_OR_ZERO(rt);
+ if (err)
+- goto route_fail_warning;
++ goto fail_rcu_unlock;
+ #else
+- goto route_fail_warning;
++ goto fail_rcu_unlock;
+ #endif
+
+ /* Get the neighbour entry for the lookup */
+ n = dst_neigh_lookup(&rt->dst, &flow.daddr);
+ ip_rt_put(rt);
+ if (!n)
+- goto route_fail_warning;
+- nfp_tun_write_neigh(n->dev, app, &flow, n, GFP_KERNEL);
++ goto fail_rcu_unlock;
++ nfp_tun_write_neigh(n->dev, app, &flow, n, GFP_ATOMIC);
+ neigh_release(n);
++ rcu_read_unlock();
+ return;
+
+-route_fail_warning:
++fail_rcu_unlock:
++ rcu_read_unlock();
+ nfp_flower_cmsg_warn(app, "Requested route not found.\n");
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-009-ppp-deflate-Fix-possible-crash-in-deflate_init.patch b/patches.kernel.org/5.1.5-009-ppp-deflate-Fix-possible-crash-in-deflate_init.patch
new file mode 100644
index 0000000000..c5ef4be755
--- /dev/null
+++ b/patches.kernel.org/5.1.5-009-ppp-deflate-Fix-possible-crash-in-deflate_init.patch
@@ -0,0 +1,92 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 14 May 2019 22:55:32 +0800
+Subject: [PATCH] ppp: deflate: Fix possible crash in deflate_init
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 3ebe1bca58c85325c97a22d4fc3f5b5420752e6f
+
+[ Upstream commit 3ebe1bca58c85325c97a22d4fc3f5b5420752e6f ]
+
+BUG: unable to handle kernel paging request at ffffffffa018f000
+PGD 3270067 P4D 3270067 PUD 3271063 PMD 2307eb067 PTE 0
+Oops: 0000 [#1] PREEMPT SMP
+CPU: 0 PID: 4138 Comm: modprobe Not tainted 5.1.0-rc7+ #1
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
+rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
+RIP: 0010:ppp_register_compressor+0x3e/0xd0 [ppp_generic]
+Code: 98 4a 3f e2 48 8b 15 c1 67 00 00 41 8b 0c 24 48 81 fa 40 f0 19 a0
+75 0e eb 35 48 8b 12 48 81 fa 40 f0 19 a0 74
+RSP: 0018:ffffc90000d93c68 EFLAGS: 00010287
+RAX: ffffffffa018f000 RBX: ffffffffa01a3000 RCX: 000000000000001a
+RDX: ffff888230c750a0 RSI: 0000000000000000 RDI: ffffffffa019f000
+RBP: ffffc90000d93c80 R08: 0000000000000001 R09: 0000000000000000
+R10: 0000000000000000 R11: 0000000000000000 R12: ffffffffa0194080
+R13: ffff88822ee1a700 R14: 0000000000000000 R15: ffffc90000d93e78
+FS: 00007f2339557540(0000) GS:ffff888237a00000(0000)
+knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffffffffa018f000 CR3: 000000022bde4000 CR4: 00000000000006f0
+Call Trace:
+ ? 0xffffffffa01a3000
+ deflate_init+0x11/0x1000 [ppp_deflate]
+ ? 0xffffffffa01a3000
+ do_one_initcall+0x6c/0x3cc
+ ? kmem_cache_alloc_trace+0x248/0x3b0
+ do_init_module+0x5b/0x1f1
+ load_module+0x1db1/0x2690
+ ? m_show+0x1d0/0x1d0
+ __do_sys_finit_module+0xc5/0xd0
+ __x64_sys_finit_module+0x15/0x20
+ do_syscall_64+0x6b/0x1d0
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+If ppp_deflate fails to register in deflate_init,
+module initialization failed out, however
+ppp_deflate_draft may has been regiestred and not
+unregistered before return.
+Then the seconed modprobe will trigger crash like this.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ppp/ppp_deflate.c | 20 ++++++++++++++------
+ 1 file changed, 14 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
+index b5edc7f96a39..685e875f5164 100644
+--- a/drivers/net/ppp/ppp_deflate.c
++++ b/drivers/net/ppp/ppp_deflate.c
+@@ -610,12 +610,20 @@ static struct compressor ppp_deflate_draft = {
+
+ static int __init deflate_init(void)
+ {
+- int answer = ppp_register_compressor(&ppp_deflate);
+- if (answer == 0)
+- printk(KERN_INFO
+- "PPP Deflate Compression module registered\n");
+- ppp_register_compressor(&ppp_deflate_draft);
+- return answer;
++ int rc;
++
++ rc = ppp_register_compressor(&ppp_deflate);
++ if (rc)
++ return rc;
++
++ rc = ppp_register_compressor(&ppp_deflate_draft);
++ if (rc) {
++ ppp_unregister_compressor(&ppp_deflate);
++ return rc;
++ }
++
++ pr_info("PPP Deflate Compression module registered\n");
++ return 0;
+ }
+
+ static void __exit deflate_cleanup(void)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-010-rtnetlink-always-put-IFLA_LINK-for-links-with-a.patch b/patches.kernel.org/5.1.5-010-rtnetlink-always-put-IFLA_LINK-for-links-with-a.patch
new file mode 100644
index 0000000000..5e8dbae946
--- /dev/null
+++ b/patches.kernel.org/5.1.5-010-rtnetlink-always-put-IFLA_LINK-for-links-with-a.patch
@@ -0,0 +1,101 @@
+From: Sabrina Dubroca <sd@queasysnail.net>
+Date: Tue, 14 May 2019 15:12:19 +0200
+Subject: [PATCH] rtnetlink: always put IFLA_LINK for links with a link-netnsid
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: feadc4b6cf42a53a8a93c918a569a0b7e62bd350
+
+[ Upstream commit feadc4b6cf42a53a8a93c918a569a0b7e62bd350 ]
+
+Currently, nla_put_iflink() doesn't put the IFLA_LINK attribute when
+iflink == ifindex.
+
+In some cases, a device can be created in a different netns with the
+same ifindex as its parent. That device will not dump its IFLA_LINK
+attribute, which can confuse some userspace software that expects it.
+For example, if the last ifindex created in init_net and foo are both
+8, these commands will trigger the issue:
+
+ ip link add parent type dummy # ifindex 9
+ ip link add link parent netns foo type macvlan # ifindex 9 in ns foo
+
+So, in case a device puts the IFLA_LINK_NETNSID attribute in a dump,
+always put the IFLA_LINK attribute as well.
+
+Thanks to Dan Winship for analyzing the original OpenShift bug down to
+the missing netlink attribute.
+
+v2: change Fixes tag, it's been here forever, as Nicolas Dichtel said
+ add Nicolas' ack
+v3: change Fixes tag
+ fix subject typo, spotted by Edward Cree
+
+Analyzed-by: Dan Winship <danw@redhat.com>
+Fixes: d8a5ec672768 ("[NET]: netlink support for moving devices between network namespaces.")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/core/rtnetlink.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 220c56e93659..467d771ac6ba 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1496,14 +1496,15 @@ static int put_master_ifindex(struct sk_buff *skb, struct net_device *dev)
+ return ret;
+ }
+
+-static int nla_put_iflink(struct sk_buff *skb, const struct net_device *dev)
++static int nla_put_iflink(struct sk_buff *skb, const struct net_device *dev,
++ bool force)
+ {
+ int ifindex = dev_get_iflink(dev);
+
+- if (dev->ifindex == ifindex)
+- return 0;
++ if (force || dev->ifindex != ifindex)
++ return nla_put_u32(skb, IFLA_LINK, ifindex);
+
+- return nla_put_u32(skb, IFLA_LINK, ifindex);
++ return 0;
+ }
+
+ static noinline_for_stack int nla_put_ifalias(struct sk_buff *skb,
+@@ -1520,6 +1521,8 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+ const struct net_device *dev,
+ struct net *src_net)
+ {
++ bool put_iflink = false;
++
+ if (dev->rtnl_link_ops && dev->rtnl_link_ops->get_link_net) {
+ struct net *link_net = dev->rtnl_link_ops->get_link_net(dev);
+
+@@ -1528,10 +1531,12 @@ static int rtnl_fill_link_netnsid(struct sk_buff *skb,
+
+ if (nla_put_s32(skb, IFLA_LINK_NETNSID, id))
+ return -EMSGSIZE;
++
++ put_iflink = true;
+ }
+ }
+
+- return 0;
++ return nla_put_iflink(skb, dev, put_iflink);
+ }
+
+ static int rtnl_fill_link_af(struct sk_buff *skb,
+@@ -1617,7 +1622,6 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb,
+ #ifdef CONFIG_RPS
+ nla_put_u32(skb, IFLA_NUM_RX_QUEUES, dev->num_rx_queues) ||
+ #endif
+- nla_put_iflink(skb, dev) ||
+ put_master_ifindex(skb, dev) ||
+ nla_put_u8(skb, IFLA_CARRIER, netif_carrier_ok(dev)) ||
+ (dev->qdisc &&
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-011-tipc-switch-order-of-device-registration-to-fix.patch b/patches.kernel.org/5.1.5-011-tipc-switch-order-of-device-registration-to-fix.patch
new file mode 100644
index 0000000000..c0114b0c36
--- /dev/null
+++ b/patches.kernel.org/5.1.5-011-tipc-switch-order-of-device-registration-to-fix.patch
@@ -0,0 +1,100 @@
+From: Junwei Hu <hujunwei4@huawei.com>
+Date: Thu, 16 May 2019 10:51:15 +0800
+Subject: [PATCH] tipc: switch order of device registration to fix a crash
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 7e27e8d6130c5e88fac9ddec4249f7f2337fe7f8
+
+[ Upstream commit 7e27e8d6130c5e88fac9ddec4249f7f2337fe7f8 ]
+
+When tipc is loaded while many processes try to create a TIPC socket,
+a crash occurs:
+ PANIC: Unable to handle kernel paging request at virtual
+ address "dfff20000000021d"
+ pc : tipc_sk_create+0x374/0x1180 [tipc]
+ lr : tipc_sk_create+0x374/0x1180 [tipc]
+ Exception class = DABT (current EL), IL = 32 bits
+ Call trace:
+ tipc_sk_create+0x374/0x1180 [tipc]
+ __sock_create+0x1cc/0x408
+ __sys_socket+0xec/0x1f0
+ __arm64_sys_socket+0x74/0xa8
+ ...
+
+This is due to race between sock_create and unfinished
+register_pernet_device. tipc_sk_insert tries to do
+"net_generic(net, tipc_net_id)".
+but tipc_net_id is not initialized yet.
+
+So switch the order of the two to close the race.
+
+This can be reproduced with multiple processes doing socket(AF_TIPC, ...)
+and one process doing module removal.
+
+Fixes: a62fbccecd62 ("tipc: make subscriber server support net namespace")
+Signed-off-by: Junwei Hu <hujunwei4@huawei.com>
+Reported-by: Wang Wang <wangwang2@huawei.com>
+Reviewed-by: Xiaogang Wang <wangxiaogang3@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/tipc/core.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index 5b38f5164281..dbfc1e8b2866 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -129,10 +129,6 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_netlink_compat;
+
+- err = tipc_socket_init();
+- if (err)
+- goto out_socket;
+-
+ err = tipc_register_sysctl();
+ if (err)
+ goto out_sysctl;
+@@ -141,6 +137,10 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_pernet;
+
++ err = tipc_socket_init();
++ if (err)
++ goto out_socket;
++
+ err = tipc_bearer_setup();
+ if (err)
+ goto out_bearer;
+@@ -148,12 +148,12 @@ static int __init tipc_init(void)
+ pr_info("Started in single node mode\n");
+ return 0;
+ out_bearer:
++ tipc_socket_stop();
++out_socket:
+ unregister_pernet_subsys(&tipc_net_ops);
+ out_pernet:
+ tipc_unregister_sysctl();
+ out_sysctl:
+- tipc_socket_stop();
+-out_socket:
+ tipc_netlink_compat_stop();
+ out_netlink_compat:
+ tipc_netlink_stop();
+@@ -165,10 +165,10 @@ out_netlink:
+ static void __exit tipc_exit(void)
+ {
+ tipc_bearer_cleanup();
++ tipc_socket_stop();
+ unregister_pernet_subsys(&tipc_net_ops);
+ tipc_netlink_stop();
+ tipc_netlink_compat_stop();
+- tipc_socket_stop();
+ tipc_unregister_sysctl();
+
+ pr_info("Deactivated\n");
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-012-vsock-virtio-free-packets-during-the-socket-rel.patch b/patches.kernel.org/5.1.5-012-vsock-virtio-free-packets-during-the-socket-rel.patch
new file mode 100644
index 0000000000..9acde120aa
--- /dev/null
+++ b/patches.kernel.org/5.1.5-012-vsock-virtio-free-packets-during-the-socket-rel.patch
@@ -0,0 +1,48 @@
+From: Stefano Garzarella <sgarzare@redhat.com>
+Date: Fri, 17 May 2019 16:45:43 +0200
+Subject: [PATCH] vsock/virtio: free packets during the socket release
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ac03046ece2b158ebd204dfc4896fd9f39f0e6c8
+
+[ Upstream commit ac03046ece2b158ebd204dfc4896fd9f39f0e6c8 ]
+
+When the socket is released, we should free all packets
+queued in the per-socket list in order to avoid a memory
+leak.
+
+Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/vmw_vsock/virtio_transport_common.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
+index 602715fc9a75..f3f3d06cb6d8 100644
+--- a/net/vmw_vsock/virtio_transport_common.c
++++ b/net/vmw_vsock/virtio_transport_common.c
+@@ -786,12 +786,19 @@ static bool virtio_transport_close(struct vsock_sock *vsk)
+
+ void virtio_transport_release(struct vsock_sock *vsk)
+ {
++ struct virtio_vsock_sock *vvs = vsk->trans;
++ struct virtio_vsock_pkt *pkt, *tmp;
+ struct sock *sk = &vsk->sk;
+ bool remove_sock = true;
+
+ lock_sock(sk);
+ if (sk->sk_type == SOCK_STREAM)
+ remove_sock = virtio_transport_close(vsk);
++
++ list_for_each_entry_safe(pkt, tmp, &vvs->rx_queue, list) {
++ list_del(&pkt->list);
++ virtio_transport_free_pkt(pkt);
++ }
+ release_sock(sk);
+
+ if (remove_sock)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-013-tipc-fix-modprobe-tipc-failed-after-switch-orde.patch b/patches.kernel.org/5.1.5-013-tipc-fix-modprobe-tipc-failed-after-switch-orde.patch
new file mode 100644
index 0000000000..30c4bad067
--- /dev/null
+++ b/patches.kernel.org/5.1.5-013-tipc-fix-modprobe-tipc-failed-after-switch-orde.patch
@@ -0,0 +1,99 @@
+From: Junwei Hu <hujunwei4@huawei.com>
+Date: Fri, 17 May 2019 19:27:34 +0800
+Subject: [PATCH] tipc: fix modprobe tipc failed after switch order of device
+ registration
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 532b0f7ece4cb2ffd24dc723ddf55242d1188e5e
+
+[ Upstream commit 532b0f7ece4cb2ffd24dc723ddf55242d1188e5e ]
+
+Error message printed:
+modprobe: ERROR: could not insert 'tipc': Address family not
+supported by protocol.
+when modprobe tipc after the following patch: switch order of
+device registration, commit 7e27e8d6130c
+("tipc: switch order of device registration to fix a crash")
+
+Because sock_create_kern(net, AF_TIPC, ...) is called by
+tipc_topsrv_create_listener() in the initialization process
+of tipc_net_ops, tipc_socket_init() must be execute before that.
+
+I move tipc_socket_init() into function tipc_init_net().
+
+Fixes: 7e27e8d6130c
+("tipc: switch order of device registration to fix a crash")
+Signed-off-by: Junwei Hu <hujunwei4@huawei.com>
+Reported-by: Wang Wang <wangwang2@huawei.com>
+Reviewed-by: Kang Zhou <zhoukang7@huawei.com>
+Reviewed-by: Suanming Mou <mousuanming@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/tipc/core.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index dbfc1e8b2866..d7b0688c98dd 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -66,6 +66,10 @@ static int __net_init tipc_init_net(struct net *net)
+ INIT_LIST_HEAD(&tn->node_list);
+ spin_lock_init(&tn->node_list_lock);
+
++ err = tipc_socket_init();
++ if (err)
++ goto out_socket;
++
+ err = tipc_sk_rht_init(net);
+ if (err)
+ goto out_sk_rht;
+@@ -92,6 +96,8 @@ out_subscr:
+ out_nametbl:
+ tipc_sk_rht_destroy(net);
+ out_sk_rht:
++ tipc_socket_stop();
++out_socket:
+ return err;
+ }
+
+@@ -102,6 +108,7 @@ static void __net_exit tipc_exit_net(struct net *net)
+ tipc_bcast_stop(net);
+ tipc_nametbl_stop(net);
+ tipc_sk_rht_destroy(net);
++ tipc_socket_stop();
+ }
+
+ static struct pernet_operations tipc_net_ops = {
+@@ -137,10 +144,6 @@ static int __init tipc_init(void)
+ if (err)
+ goto out_pernet;
+
+- err = tipc_socket_init();
+- if (err)
+- goto out_socket;
+-
+ err = tipc_bearer_setup();
+ if (err)
+ goto out_bearer;
+@@ -148,8 +151,6 @@ static int __init tipc_init(void)
+ pr_info("Started in single node mode\n");
+ return 0;
+ out_bearer:
+- tipc_socket_stop();
+-out_socket:
+ unregister_pernet_subsys(&tipc_net_ops);
+ out_pernet:
+ tipc_unregister_sysctl();
+@@ -165,7 +166,6 @@ out_netlink:
+ static void __exit tipc_exit(void)
+ {
+ tipc_bearer_cleanup();
+- tipc_socket_stop();
+ unregister_pernet_subsys(&tipc_net_ops);
+ tipc_netlink_stop();
+ tipc_netlink_compat_stop();
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-014-mlxsw-core-Prevent-QSFP-module-initialization-f.patch b/patches.kernel.org/5.1.5-014-mlxsw-core-Prevent-QSFP-module-initialization-f.patch
new file mode 100644
index 0000000000..43b1b6cd55
--- /dev/null
+++ b/patches.kernel.org/5.1.5-014-mlxsw-core-Prevent-QSFP-module-initialization-f.patch
@@ -0,0 +1,103 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Sat, 18 May 2019 18:58:28 +0300
+Subject: [PATCH] mlxsw: core: Prevent QSFP module initialization for old
+ hardware
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: c52ecff7e6439ca8c9b03282e8869a005aa94831
+
+[ Upstream commit c52ecff7e6439ca8c9b03282e8869a005aa94831 ]
+
+Old Mellanox silicons, like switchx-2, switch-ib do not support reading
+QSFP modules temperature through MTMP register. Attempt to access this
+register on systems equipped with the this kind of silicon will cause
+initialization flow failure.
+Test for hardware resource capability is added in order to distinct
+between old and new silicon - old silicons do not have such capability.
+
+Fixes: 6a79507cfe94 ("mlxsw: core: Extend thermal module with per QSFP module thermal zones")
+Fixes: 5c42eaa07bd0 ("mlxsw: core: Extend hwmon interface with QSFP module temperature attributes")
+Reported-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 6 ++++++
+ drivers/net/ethernet/mellanox/mlxsw/core.h | 2 ++
+ drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c | 3 +++
+ drivers/net/ethernet/mellanox/mlxsw/core_thermal.c | 6 ++++++
+ 4 files changed, 17 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
+index f26a4ca29363..0b56291d22c6 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -122,6 +122,12 @@ void *mlxsw_core_driver_priv(struct mlxsw_core *mlxsw_core)
+ }
+ EXPORT_SYMBOL(mlxsw_core_driver_priv);
+
++bool mlxsw_core_res_query_enabled(const struct mlxsw_core *mlxsw_core)
++{
++ return mlxsw_core->driver->res_query_enabled;
++}
++EXPORT_SYMBOL(mlxsw_core_res_query_enabled);
++
+ struct mlxsw_rx_listener_item {
+ struct list_head list;
+ struct mlxsw_rx_listener rxl;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.h b/drivers/net/ethernet/mellanox/mlxsw/core.h
+index 8ec53f027575..62b8de9305af 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.h
+@@ -28,6 +28,8 @@ unsigned int mlxsw_core_max_ports(const struct mlxsw_core *mlxsw_core);
+
+ void *mlxsw_core_driver_priv(struct mlxsw_core *mlxsw_core);
+
++bool mlxsw_core_res_query_enabled(const struct mlxsw_core *mlxsw_core);
++
+ int mlxsw_core_driver_register(struct mlxsw_driver *mlxsw_driver);
+ void mlxsw_core_driver_unregister(struct mlxsw_driver *mlxsw_driver);
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+index 6956bbebe2f1..496dc904c5ed 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c
+@@ -518,6 +518,9 @@ static int mlxsw_hwmon_module_init(struct mlxsw_hwmon *mlxsw_hwmon)
+ u8 width;
+ int err;
+
++ if (!mlxsw_core_res_query_enabled(mlxsw_hwmon->core))
++ return 0;
++
+ /* Add extra attributes for module temperature. Sensor index is
+ * assigned to sensor_count value, while all indexed before
+ * sensor_count are already utilized by the sensors connected through
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
+index 472f63f9fac5..d3e851e7ca72 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
+@@ -740,6 +740,9 @@ mlxsw_thermal_modules_init(struct device *dev, struct mlxsw_core *core,
+ struct mlxsw_thermal_module *module_tz;
+ int i, err;
+
++ if (!mlxsw_core_res_query_enabled(core))
++ return 0;
++
+ thermal->tz_module_arr = kcalloc(module_count,
+ sizeof(*thermal->tz_module_arr),
+ GFP_KERNEL);
+@@ -776,6 +779,9 @@ mlxsw_thermal_modules_fini(struct mlxsw_thermal *thermal)
+ unsigned int module_count = mlxsw_core_max_ports(thermal->core);
+ int i;
+
++ if (!mlxsw_core_res_query_enabled(thermal->core))
++ return;
++
+ for (i = module_count - 1; i >= 0; i--)
+ mlxsw_thermal_module_fini(&thermal->tz_module_arr[i]);
+ kfree(thermal->tz_module_arr);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-015-mlxsw-core-Prevent-reading-unsupported-slave-ad.patch b/patches.kernel.org/5.1.5-015-mlxsw-core-Prevent-reading-unsupported-slave-ad.patch
new file mode 100644
index 0000000000..ea930ea047
--- /dev/null
+++ b/patches.kernel.org/5.1.5-015-mlxsw-core-Prevent-reading-unsupported-slave-ad.patch
@@ -0,0 +1,85 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Sat, 18 May 2019 18:58:29 +0300
+Subject: [PATCH] mlxsw: core: Prevent reading unsupported slave address from
+ SFP EEPROM
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: f1436c8036fa3632b2ee78841cf5184b7ef0ad87
+
+[ Upstream commit f1436c8036fa3632b2ee78841cf5184b7ef0ad87 ]
+
+Prevent reading unsupported slave address from SFP EEPROM by testing
+Diagnostic Monitoring Type byte in EEPROM. Read only page zero of
+EEPROM, in case this byte is zero.
+
+If some SFP transceiver does not support Digital Optical Monitoring
+(DOM), reading SFP EEPROM slave address 0x51 could return an error.
+Availability of DOM support is verified by reading from zero page
+Diagnostic Monitoring Type byte describing how diagnostic monitoring is
+implemented by transceiver. If bit 6 of this byte is set, it indicates
+that digital diagnostic monitoring has been implemented. Otherwise it is
+not and transceiver could fail to reply to transaction for slave address
+0x51 [1010001X (A2h)], which is used to access measurements page.
+
+Such issue has been observed when reading cable MCP2M00-xxxx,
+MCP7F00-xxxx, and few others.
+
+Fixes: 2ea109039cd3 ("mlxsw: spectrum: Add support for access cable info via ethtool")
+Fixes: 4400081b631a ("mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core_env.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_env.c b/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+index c1c1965d7acc..72539a9a3847 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+@@ -3,6 +3,7 @@
+
+ #include <linux/kernel.h>
+ #include <linux/err.h>
++#include <linux/sfp.h>
+
+ #include "core.h"
+ #include "core_env.h"
+@@ -162,7 +163,7 @@ int mlxsw_env_get_module_info(struct mlxsw_core *mlxsw_core, int module,
+ {
+ u8 module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE];
+ u16 offset = MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE;
+- u8 module_rev_id, module_id;
++ u8 module_rev_id, module_id, diag_mon;
+ unsigned int read_size;
+ int err;
+
+@@ -195,8 +196,21 @@ int mlxsw_env_get_module_info(struct mlxsw_core *mlxsw_core, int module,
+ }
+ break;
+ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP:
++ /* Verify if transceiver provides diagnostic monitoring page */
++ err = mlxsw_env_query_module_eeprom(mlxsw_core, module,
++ SFP_DIAGMON, 1, &diag_mon,
++ &read_size);
++ if (err)
++ return err;
++
++ if (read_size < 1)
++ return -EIO;
++
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ if (diag_mon)
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ else
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN / 2;
+ break;
+ default:
+ return -EINVAL;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-016-flow_offload-support-CVLAN-match.patch b/patches.kernel.org/5.1.5-016-flow_offload-support-CVLAN-match.patch
new file mode 100644
index 0000000000..3061410bef
--- /dev/null
+++ b/patches.kernel.org/5.1.5-016-flow_offload-support-CVLAN-match.patch
@@ -0,0 +1,54 @@
+From: Edward Cree <ecree@solarflare.com>
+Date: Tue, 14 May 2019 21:18:12 +0100
+Subject: [PATCH] flow_offload: support CVLAN match
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: bae9ed69029c7d499c57485593b2faae475fd704
+
+[ Upstream commit bae9ed69029c7d499c57485593b2faae475fd704 ]
+
+Plumb it through from the flow_dissector.
+
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/net/flow_offload.h | 2 ++
+ net/core/flow_offload.c | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h
+index d035183c8d03..cc32b9d9ecec 100644
+--- a/include/net/flow_offload.h
++++ b/include/net/flow_offload.h
+@@ -71,6 +71,8 @@ void flow_rule_match_eth_addrs(const struct flow_rule *rule,
+ struct flow_match_eth_addrs *out);
+ void flow_rule_match_vlan(const struct flow_rule *rule,
+ struct flow_match_vlan *out);
++void flow_rule_match_cvlan(const struct flow_rule *rule,
++ struct flow_match_vlan *out);
+ void flow_rule_match_ipv4_addrs(const struct flow_rule *rule,
+ struct flow_match_ipv4_addrs *out);
+ void flow_rule_match_ipv6_addrs(const struct flow_rule *rule,
+diff --git a/net/core/flow_offload.c b/net/core/flow_offload.c
+index c3a00eac4804..5ce7d47a960e 100644
+--- a/net/core/flow_offload.c
++++ b/net/core/flow_offload.c
+@@ -54,6 +54,13 @@ void flow_rule_match_vlan(const struct flow_rule *rule,
+ }
+ EXPORT_SYMBOL(flow_rule_match_vlan);
+
++void flow_rule_match_cvlan(const struct flow_rule *rule,
++ struct flow_match_vlan *out)
++{
++ FLOW_DISSECTOR_MATCH(rule, FLOW_DISSECTOR_KEY_CVLAN, out);
++}
++EXPORT_SYMBOL(flow_rule_match_cvlan);
++
+ void flow_rule_match_ipv4_addrs(const struct flow_rule *rule,
+ struct flow_match_ipv4_addrs *out)
+ {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-017-net-mlx5e-Fix-calling-wrong-function-to-get-inn.patch b/patches.kernel.org/5.1.5-017-net-mlx5e-Fix-calling-wrong-function-to-get-inn.patch
new file mode 100644
index 0000000000..f51f6a384b
--- /dev/null
+++ b/patches.kernel.org/5.1.5-017-net-mlx5e-Fix-calling-wrong-function-to-get-inn.patch
@@ -0,0 +1,46 @@
+From: Jianbo Liu <jianbol@mellanox.com>
+Date: Tue, 14 May 2019 21:18:50 +0100
+Subject: [PATCH] net/mlx5e: Fix calling wrong function to get inner vlan key
+ and mask
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 12d5cbf89a6599f6bbd7b373dba0e74b5bd9c505
+
+[ Upstream commit 12d5cbf89a6599f6bbd7b373dba0e74b5bd9c505 ]
+
+When flow_rule_match_XYZ() functions were first introduced,
+flow_rule_match_cvlan() for inner vlan is missing.
+
+In mlx5_core driver, to get inner vlan key and mask, flow_rule_match_vlan()
+is just called, which is wrong because it obtains outer vlan information by
+FLOW_DISSECTOR_KEY_VLAN.
+
+This commit fixes this by changing to call flow_rule_match_cvlan() after
+it's added.
+
+Fixes: 8f2566225ae2 ("flow_offload: add flow_rule and flow_match structures and use them")
+Signed-off-by: Jianbo Liu <jianbol@mellanox.com>
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index d75dc44eb2ff..4cb23631616b 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -1561,7 +1561,7 @@ static int __parse_cls_flower(struct mlx5e_priv *priv,
+ if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CVLAN)) {
+ struct flow_match_vlan match;
+
+- flow_rule_match_vlan(rule, &match);
++ flow_rule_match_cvlan(rule, &match);
+ if (match.mask->vlan_id ||
+ match.mask->vlan_priority ||
+ match.mask->vlan_tpid) {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-018-net-mlx5-Fix-peer-pf-disable-hca-command.patch b/patches.kernel.org/5.1.5-018-net-mlx5-Fix-peer-pf-disable-hca-command.patch
new file mode 100644
index 0000000000..4317b37e0e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-018-net-mlx5-Fix-peer-pf-disable-hca-command.patch
@@ -0,0 +1,39 @@
+From: Bodong Wang <bodong@mellanox.com>
+Date: Mon, 29 Apr 2019 09:56:18 -0500
+Subject: [PATCH] net/mlx5: Fix peer pf disable hca command
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: dd06486710d251140edc86ec3bbef0c25dcec1cb
+
+[ Upstream commit dd06486710d251140edc86ec3bbef0c25dcec1cb ]
+
+The command was mistakenly using enable_hca in embedded CPU field.
+
+Fixes: 22e939a91dcb (net/mlx5: Update enable HCA dependency)
+Signed-off-by: Bodong Wang <bodong@mellanox.com>
+Reported-by: Alex Rosenbaum <alexr@mellanox.com>
+Signed-off-by: Alex Rosenbaum <alexr@mellanox.com>
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/ecpf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c b/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c
+index 4746f2d28fb6..0ccd6d40baf7 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/ecpf.c
+@@ -26,7 +26,7 @@ static int mlx5_peer_pf_disable_hca(struct mlx5_core_dev *dev)
+
+ MLX5_SET(disable_hca_in, in, opcode, MLX5_CMD_OP_DISABLE_HCA);
+ MLX5_SET(disable_hca_in, in, function_id, 0);
+- MLX5_SET(enable_hca_in, in, embedded_cpu_function, 0);
++ MLX5_SET(disable_hca_in, in, embedded_cpu_function, 0);
+ return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out));
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-019-vsock-virtio-Initialize-core-virtio-vsock-befor.patch b/patches.kernel.org/5.1.5-019-vsock-virtio-Initialize-core-virtio-vsock-befor.patch
new file mode 100644
index 0000000000..2f7c3075f2
--- /dev/null
+++ b/patches.kernel.org/5.1.5-019-vsock-virtio-Initialize-core-virtio-vsock-befor.patch
@@ -0,0 +1,115 @@
+From: "Jorge E. Moreira" <jemoreira@google.com>
+Date: Thu, 16 May 2019 13:51:07 -0700
+Subject: [PATCH] vsock/virtio: Initialize core virtio vsock before registering
+ the driver
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ba95e5dfd36647622d8897a2a0470dde60e59ffd
+
+[ Upstream commit ba95e5dfd36647622d8897a2a0470dde60e59ffd ]
+
+Avoid a race in which static variables in net/vmw_vsock/af_vsock.c are
+accessed (while handling interrupts) before they are initialized.
+
+[ 4.201410] BUG: unable to handle kernel paging request at ffffffffffffffe8
+[ 4.207829] IP: vsock_addr_equals_addr+0x3/0x20
+[ 4.211379] PGD 28210067 P4D 28210067 PUD 28212067 PMD 0
+[ 4.211379] Oops: 0000 [#1] PREEMPT SMP PTI
+[ 4.211379] Modules linked in:
+[ 4.211379] CPU: 1 PID: 30 Comm: kworker/1:1 Not tainted 4.14.106-419297-gd7e28cc1f241 #1
+[ 4.211379] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
+[ 4.211379] Workqueue: virtio_vsock virtio_transport_rx_work
+[ 4.211379] task: ffffa3273d175280 task.stack: ffffaea1800e8000
+[ 4.211379] RIP: 0010:vsock_addr_equals_addr+0x3/0x20
+[ 4.211379] RSP: 0000:ffffaea1800ebd28 EFLAGS: 00010286
+[ 4.211379] RAX: 0000000000000002 RBX: 0000000000000000 RCX: ffffffffb94e42f0
+[ 4.211379] RDX: 0000000000000400 RSI: ffffffffffffffe0 RDI: ffffaea1800ebdd0
+[ 4.211379] RBP: ffffaea1800ebd58 R08: 0000000000000001 R09: 0000000000000001
+[ 4.211379] R10: 0000000000000000 R11: ffffffffb89d5d60 R12: ffffaea1800ebdd0
+[ 4.211379] R13: 00000000828cbfbf R14: 0000000000000000 R15: ffffaea1800ebdc0
+[ 4.211379] FS: 0000000000000000(0000) GS:ffffa3273fd00000(0000) knlGS:0000000000000000
+[ 4.211379] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 4.211379] CR2: ffffffffffffffe8 CR3: 000000002820e001 CR4: 00000000001606e0
+[ 4.211379] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 4.211379] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 4.211379] Call Trace:
+[ 4.211379] ? vsock_find_connected_socket+0x6c/0xe0
+[ 4.211379] virtio_transport_recv_pkt+0x15f/0x740
+[ 4.211379] ? detach_buf+0x1b5/0x210
+[ 4.211379] virtio_transport_rx_work+0xb7/0x140
+[ 4.211379] process_one_work+0x1ef/0x480
+[ 4.211379] worker_thread+0x312/0x460
+[ 4.211379] kthread+0x132/0x140
+[ 4.211379] ? process_one_work+0x480/0x480
+[ 4.211379] ? kthread_destroy_worker+0xd0/0xd0
+[ 4.211379] ret_from_fork+0x35/0x40
+[ 4.211379] Code: c7 47 08 00 00 00 00 66 c7 07 28 00 c7 47 08 ff ff ff ff c7 47 04 ff ff ff ff c3 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 8b 47 08 <3b> 46 08 75 0a 8b 47 04 3b 46 04 0f 94 c0 c3 31 c0 c3 90 66 2e
+[ 4.211379] RIP: vsock_addr_equals_addr+0x3/0x20 RSP: ffffaea1800ebd28
+[ 4.211379] CR2: ffffffffffffffe8
+[ 4.211379] ---[ end trace f31cc4a2e6df3689 ]---
+[ 4.211379] Kernel panic - not syncing: Fatal exception in interrupt
+[ 4.211379] Kernel Offset: 0x37000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
+[ 4.211379] Rebooting in 5 seconds..
+
+Fixes: 22b5c0b63f32 ("vsock/virtio: fix kernel panic after device hot-unplug")
+Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Cc: Stefano Garzarella <sgarzare@redhat.com>
+Cc: "David S. Miller" <davem@davemloft.net>
+Cc: kvm@vger.kernel.org
+Cc: virtualization@lists.linux-foundation.org
+Cc: netdev@vger.kernel.org
+Cc: kernel-team@android.com
+Cc: stable@vger.kernel.org [4.9+]
+Signed-off-by: Jorge E. Moreira <jemoreira@google.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ net/vmw_vsock/virtio_transport.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 15eb5d3d4750..96ab344f17bb 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -702,28 +702,27 @@ static int __init virtio_vsock_init(void)
+ if (!virtio_vsock_workqueue)
+ return -ENOMEM;
+
+- ret = register_virtio_driver(&virtio_vsock_driver);
++ ret = vsock_core_init(&virtio_transport.transport);
+ if (ret)
+ goto out_wq;
+
+- ret = vsock_core_init(&virtio_transport.transport);
++ ret = register_virtio_driver(&virtio_vsock_driver);
+ if (ret)
+- goto out_vdr;
++ goto out_vci;
+
+ return 0;
+
+-out_vdr:
+- unregister_virtio_driver(&virtio_vsock_driver);
++out_vci:
++ vsock_core_exit();
+ out_wq:
+ destroy_workqueue(virtio_vsock_workqueue);
+ return ret;
+-
+ }
+
+ static void __exit virtio_vsock_exit(void)
+ {
+- vsock_core_exit();
+ unregister_virtio_driver(&virtio_vsock_driver);
++ vsock_core_exit();
+ destroy_workqueue(virtio_vsock_workqueue);
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-020-net-mlx5e-Add-missing-ethtool-driver-info-for-r.patch b/patches.kernel.org/5.1.5-020-net-mlx5e-Add-missing-ethtool-driver-info-for-r.patch
new file mode 100644
index 0000000000..93536a8e09
--- /dev/null
+++ b/patches.kernel.org/5.1.5-020-net-mlx5e-Add-missing-ethtool-driver-info-for-r.patch
@@ -0,0 +1,68 @@
+From: Dmytro Linkin <dmitrolin@mellanox.com>
+Date: Thu, 25 Apr 2019 08:52:02 +0000
+Subject: [PATCH] net/mlx5e: Add missing ethtool driver info for representors
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: cf83c8fdcd4756644595521f48748ec22f7efede
+
+[ Upstream commit cf83c8fdcd4756644595521f48748ec22f7efede ]
+
+For all representors added firmware version info to show in
+ethtool driver info.
+For uplink representor, because only it is tied to the pci device
+sysfs, added pci bus info.
+
+Fixes: ff9b85de5d5d ("net/mlx5e: Add some ethtool port control entries to the uplink rep netdev")
+Signed-off-by: Dmytro Linkin <dmitrolin@mellanox.com>
+Reviewed-by: Gavi Teitz <gavi@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ .../net/ethernet/mellanox/mlx5/core/en_rep.c | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index a66b6ed80b30..0b09fa91019d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -65,9 +65,26 @@ static void mlx5e_rep_indr_unregister_block(struct mlx5e_rep_priv *rpriv,
+ static void mlx5e_rep_get_drvinfo(struct net_device *dev,
+ struct ethtool_drvinfo *drvinfo)
+ {
++ struct mlx5e_priv *priv = netdev_priv(dev);
++ struct mlx5_core_dev *mdev = priv->mdev;
++
+ strlcpy(drvinfo->driver, mlx5e_rep_driver_name,
+ sizeof(drvinfo->driver));
+ strlcpy(drvinfo->version, UTS_RELEASE, sizeof(drvinfo->version));
++ snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
++ "%d.%d.%04d (%.16s)",
++ fw_rev_maj(mdev), fw_rev_min(mdev),
++ fw_rev_sub(mdev), mdev->board_id);
++}
++
++static void mlx5e_uplink_rep_get_drvinfo(struct net_device *dev,
++ struct ethtool_drvinfo *drvinfo)
++{
++ struct mlx5e_priv *priv = netdev_priv(dev);
++
++ mlx5e_rep_get_drvinfo(dev, drvinfo);
++ strlcpy(drvinfo->bus_info, pci_name(priv->mdev->pdev),
++ sizeof(drvinfo->bus_info));
+ }
+
+ static const struct counter_desc sw_rep_stats_desc[] = {
+@@ -363,7 +380,7 @@ static const struct ethtool_ops mlx5e_vf_rep_ethtool_ops = {
+ };
+
+ static const struct ethtool_ops mlx5e_uplink_rep_ethtool_ops = {
+- .get_drvinfo = mlx5e_rep_get_drvinfo,
++ .get_drvinfo = mlx5e_uplink_rep_get_drvinfo,
+ .get_link = ethtool_op_get_link,
+ .get_strings = mlx5e_rep_get_strings,
+ .get_sset_count = mlx5e_rep_get_sset_count,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-021-net-mlx5e-Additional-check-for-flow-destination.patch b/patches.kernel.org/5.1.5-021-net-mlx5e-Additional-check-for-flow-destination.patch
new file mode 100644
index 0000000000..6008f4ea8e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-021-net-mlx5e-Additional-check-for-flow-destination.patch
@@ -0,0 +1,48 @@
+From: Dmytro Linkin <dmitrolin@mellanox.com>
+Date: Thu, 2 May 2019 15:21:38 +0000
+Subject: [PATCH] net/mlx5e: Additional check for flow destination comparison
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: c979c445a88e1c9dd7d8f90838c10456ae4ecd09
+
+[ Upstream commit c979c445a88e1c9dd7d8f90838c10456ae4ecd09 ]
+
+Flow destination comparison has an inaccuracy: code see no
+difference between same vf ports, which belong to different pfs.
+
+Example: If start ping from VF0 (PF1) to VF1 (PF1) and mirror
+all traffic to VF0 (PF2), icmp reply to VF0 (PF1) and mirrored
+flow to VF0 (PF2) would be determined as same destination. It lead
+to creating flow handler with rule nodes, which not added to node
+tree. When later driver try to delete this flow rules we got
+kernel crash.
+
+Add comparison of vhca_id field to avoid this.
+
+Fixes: 1228e912c934 ("net/mlx5: Consider encapsulation properties when comparing destinations")
+Signed-off-by: Dmytro Linkin <dmitrolin@mellanox.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Reviewed-by: Vlad Buslov <vladbu@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+index 0be3eb86dd84..581cc145795d 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+@@ -1386,6 +1386,8 @@ static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1,
+ if ((d1->type == MLX5_FLOW_DESTINATION_TYPE_VPORT &&
+ d1->vport.num == d2->vport.num &&
+ d1->vport.flags == d2->vport.flags &&
++ ((d1->vport.flags & MLX5_FLOW_DEST_VPORT_VHCA_ID) ?
++ (d1->vport.vhca_id == d2->vport.vhca_id) : true) &&
+ ((d1->vport.flags & MLX5_FLOW_DEST_VPORT_REFORMAT_ID) ?
+ (d1->vport.reformat_id == d2->vport.reformat_id) : true)) ||
+ (d1->type == MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE &&
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-022-net-mlx5-Imply-MLXFW-in-mlx5_core.patch b/patches.kernel.org/5.1.5-022-net-mlx5-Imply-MLXFW-in-mlx5_core.patch
new file mode 100644
index 0000000000..39ed22e066
--- /dev/null
+++ b/patches.kernel.org/5.1.5-022-net-mlx5-Imply-MLXFW-in-mlx5_core.patch
@@ -0,0 +1,38 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Tue, 7 May 2019 13:15:20 -0700
+Subject: [PATCH] net/mlx5: Imply MLXFW in mlx5_core
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: bad861f31bb15a99becef31aab59640eaeb247e2
+
+[ Upstream commit bad861f31bb15a99becef31aab59640eaeb247e2 ]
+
+mlxfw can be compiled as external module while mlx5_core can be
+builtin, in such case mlx5 will act like mlxfw is disabled.
+
+Since mlxfw is just a service library for mlx* drivers,
+imply it in mlx5_core to make it always reachable if it was enabled.
+
+Fixes: 3ffaabecd1a1 ("net/mlx5e: Support the flash device ethtool callback")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+index 6debffb8336b..430c2eab6fc3 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
++++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+@@ -7,6 +7,7 @@ config MLX5_CORE
+ depends on PCI
+ imply PTP_1588_CLOCK
+ imply VXLAN
++ imply MLXFW
+ default n
+ ---help---
+ Core driver for low level functionality of the ConnectX-4 and
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-023-net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG.patch b/patches.kernel.org/5.1.5-023-net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG.patch
new file mode 100644
index 0000000000..322335b199
--- /dev/null
+++ b/patches.kernel.org/5.1.5-023-net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG.patch
@@ -0,0 +1,65 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Tue, 7 May 2019 12:59:38 -0700
+Subject: [PATCH] net/mlx5e: Fix ethtool rxfh commands when
+ CONFIG_MLX5_EN_RXNFC is disabled
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 8f0916c6dc5cd5e3bc52416fa2a9ff4075080180
+
+[ Upstream commit 8f0916c6dc5cd5e3bc52416fa2a9ff4075080180 ]
+
+ethtool user spaces needs to know ring count via ETHTOOL_GRXRINGS when
+executing (ethtool -x) which is retrieved via ethtool get_rxnfc callback,
+in mlx5 this callback is disabled when CONFIG_MLX5_EN_RXNFC=n.
+
+This patch allows only ETHTOOL_GRXRINGS command on mlx5e_get_rxnfc() when
+CONFIG_MLX5_EN_RXNFC is disabled, so ethtool -x will continue working.
+
+Fixes: fe6d86b3c316 ("net/mlx5e: Add CONFIG_MLX5_EN_RXNFC for ethtool rx nfc")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ .../ethernet/mellanox/mlx5/core/en_ethtool.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+index 78dc8fe2a83c..2821208119c0 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1901,6 +1901,22 @@ static int mlx5e_flash_device(struct net_device *dev,
+ return mlx5e_ethtool_flash_device(priv, flash);
+ }
+
++#ifndef CONFIG_MLX5_EN_RXNFC
++/* When CONFIG_MLX5_EN_RXNFC=n we only support ETHTOOL_GRXRINGS
++ * otherwise this function will be defined from en_fs_ethtool.c
++ */
++static int mlx5e_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info, u32 *rule_locs)
++{
++ struct mlx5e_priv *priv = netdev_priv(dev);
++
++ if (info->cmd != ETHTOOL_GRXRINGS)
++ return -EOPNOTSUPP;
++ /* ring_count is needed by ethtool -x */
++ info->data = priv->channels.params.num_channels;
++ return 0;
++}
++#endif
++
+ const struct ethtool_ops mlx5e_ethtool_ops = {
+ .get_drvinfo = mlx5e_get_drvinfo,
+ .get_link = ethtool_op_get_link,
+@@ -1919,8 +1935,8 @@ const struct ethtool_ops mlx5e_ethtool_ops = {
+ .get_rxfh_indir_size = mlx5e_get_rxfh_indir_size,
+ .get_rxfh = mlx5e_get_rxfh,
+ .set_rxfh = mlx5e_set_rxfh,
+-#ifdef CONFIG_MLX5_EN_RXNFC
+ .get_rxnfc = mlx5e_get_rxnfc,
++#ifdef CONFIG_MLX5_EN_RXNFC
+ .set_rxnfc = mlx5e_set_rxnfc,
+ #endif
+ .flash_device = mlx5e_flash_device,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-024-blk-mq-free-hw-queue-s-resource-in-hctx-s-relea.patch b/patches.kernel.org/5.1.5-024-blk-mq-free-hw-queue-s-resource-in-hctx-s-relea.patch
new file mode 100644
index 0000000000..212b8ca2a4
--- /dev/null
+++ b/patches.kernel.org/5.1.5-024-blk-mq-free-hw-queue-s-resource-in-hctx-s-relea.patch
@@ -0,0 +1,141 @@
+From: Ming Lei <ming.lei@redhat.com>
+Date: Tue, 30 Apr 2019 09:52:25 +0800
+Subject: [PATCH] blk-mq: free hw queue's resource in hctx's release handler
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: c7e2d94b3d1634988a95ac4d77a72dc7487ece06
+
+commit c7e2d94b3d1634988a95ac4d77a72dc7487ece06 upstream.
+
+Once blk_cleanup_queue() returns, tags shouldn't be used any more,
+because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2
+("blk-mq: Fix a use-after-free") fixes this issue exactly.
+
+However, that commit introduces another issue. Before 45a9c9d909b2,
+we are allowed to run queue during cleaning up queue if the queue's
+kobj refcount is held. After that commit, queue can't be run during
+queue cleaning up, otherwise oops can be triggered easily because
+some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue().
+
+We have invented ways for addressing this kind of issue before, such as:
+
+ 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done")
+ c2856ae2f315 ("blk-mq: quiesce queue before freeing queue")
+
+But still can't cover all cases, recently James reports another such
+kind of issue:
+
+ https://marc.info/?l=linux-scsi&m=155389088124782&w=2
+
+This issue can be quite hard to address by previous way, given
+scsi_run_queue() may run requeues for other LUNs.
+
+Fixes the above issue by freeing hctx's resources in its release handler, and this
+way is safe becasue tags isn't needed for freeing such hctx resource.
+
+This approach follows typical design pattern wrt. kobject's release handler.
+
+Cc: Dongli Zhang <dongli.zhang@oracle.com>
+Cc: James Smart <james.smart@broadcom.com>
+Cc: Bart Van Assche <bart.vanassche@wdc.com>
+Cc: linux-scsi@vger.kernel.org,
+Cc: Martin K . Petersen <martin.petersen@oracle.com>,
+Cc: Christoph Hellwig <hch@lst.de>,
+Cc: James E . J . Bottomley <jejb@linux.vnet.ibm.com>,
+Reported-by: James Smart <james.smart@broadcom.com>
+Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free")
+Cc: stable@vger.kernel.org
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Tested-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ block/blk-core.c | 2 +-
+ block/blk-mq-sysfs.c | 6 ++++++
+ block/blk-mq.c | 8 ++------
+ block/blk-mq.h | 2 +-
+ 4 files changed, 10 insertions(+), 8 deletions(-)
+
+diff --git a/block/blk-core.c b/block/blk-core.c
+index a55389ba8779..b375cfea024c 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -375,7 +375,7 @@ void blk_cleanup_queue(struct request_queue *q)
+ blk_exit_queue(q);
+
+ if (queue_is_mq(q))
+- blk_mq_free_queue(q);
++ blk_mq_exit_queue(q);
+
+ percpu_ref_exit(&q->q_usage_counter);
+
+diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
+index 3f9c3f4ac44c..4040e62c3737 100644
+--- a/block/blk-mq-sysfs.c
++++ b/block/blk-mq-sysfs.c
+@@ -10,6 +10,7 @@
+ #include <linux/smp.h>
+
+ #include <linux/blk-mq.h>
++#include "blk.h"
+ #include "blk-mq.h"
+ #include "blk-mq-tag.h"
+
+@@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj)
+ {
+ struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx,
+ kobj);
++
++ if (hctx->flags & BLK_MQ_F_BLOCKING)
++ cleanup_srcu_struct(hctx->srcu);
++ blk_free_flush_queue(hctx->fq);
++ sbitmap_free(&hctx->ctx_map);
+ free_cpumask_var(hctx->cpumask);
+ kfree(hctx->ctxs);
+ kfree(hctx);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index fc60ed7e940e..b0e5e67e20a2 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2267,12 +2267,7 @@ static void blk_mq_exit_hctx(struct request_queue *q,
+ if (set->ops->exit_hctx)
+ set->ops->exit_hctx(hctx, hctx_idx);
+
+- if (hctx->flags & BLK_MQ_F_BLOCKING)
+- cleanup_srcu_struct(hctx->srcu);
+-
+ blk_mq_remove_cpuhp(hctx);
+- blk_free_flush_queue(hctx->fq);
+- sbitmap_free(&hctx->ctx_map);
+ }
+
+ static void blk_mq_exit_hw_queues(struct request_queue *q,
+@@ -2905,7 +2900,8 @@ err_exit:
+ }
+ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+
+-void blk_mq_free_queue(struct request_queue *q)
++/* tags can _not_ be used after returning from blk_mq_exit_queue */
++void blk_mq_exit_queue(struct request_queue *q)
+ {
+ struct blk_mq_tag_set *set = q->tag_set;
+
+diff --git a/block/blk-mq.h b/block/blk-mq.h
+index 423ea88ab6fb..633a5a77ee8b 100644
+--- a/block/blk-mq.h
++++ b/block/blk-mq.h
+@@ -37,7 +37,7 @@ struct blk_mq_ctx {
+ struct kobject kobj;
+ } ____cacheline_aligned_in_smp;
+
+-void blk_mq_free_queue(struct request_queue *q);
++void blk_mq_exit_queue(struct request_queue *q);
+ int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr);
+ void blk_mq_wake_waiters(struct request_queue *q);
+ bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-025-regulator-core-fix-error-path-for-regulator_set.patch b/patches.kernel.org/5.1.5-025-regulator-core-fix-error-path-for-regulator_set.patch
new file mode 100644
index 0000000000..28fc021505
--- /dev/null
+++ b/patches.kernel.org/5.1.5-025-regulator-core-fix-error-path-for-regulator_set.patch
@@ -0,0 +1,60 @@
+From: Steve Twiss <stwiss.opensource@diasemi.com>
+Date: Mon, 18 Mar 2019 16:17:57 +0000
+Subject: [PATCH] regulator: core: fix error path for
+ regulator_set_voltage_unlocked
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 70b464918e5331e488058870fcc6821d54c4e541
+
+commit 70b464918e5331e488058870fcc6821d54c4e541 upstream.
+
+During several error paths in the function
+regulator_set_voltage_unlocked() the value of 'ret' can take on negative
+error values. However, in calls that go through the 'goto out' statement,
+this return value is lost and return 0 is used instead, indicating a
+'pass'.
+
+There are several cases where this function should legitimately return a
+fail instead of a pass: one such case includes constraints check during
+voltage selection in the call to regulator_check_voltage(), which can
+have -EINVAL for the case when an unsupported voltage is incorrectly
+requested. In that case, -22 is expected as the return value, not 0.
+
+Fixes: 9243a195be7a ("regulator: core: Change voltage setting path")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Steve Twiss <stwiss.opensource@diasemi.com>
+Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/regulator/core.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 68473d0cc57e..968dcd9d7a07 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3322,15 +3322,12 @@ static int regulator_set_voltage_unlocked(struct regulator *regulator,
+
+ /* for not coupled regulators this will just set the voltage */
+ ret = regulator_balance_voltage(rdev, state);
+- if (ret < 0)
+- goto out2;
++ if (ret < 0) {
++ voltage->min_uV = old_min_uV;
++ voltage->max_uV = old_max_uV;
++ }
+
+ out:
+- return 0;
+-out2:
+- voltage->min_uV = old_min_uV;
+- voltage->max_uV = old_max_uV;
+-
+ return ret;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-026-parisc-Export-running_on_qemu-symbol-for-module.patch b/patches.kernel.org/5.1.5-026-parisc-Export-running_on_qemu-symbol-for-module.patch
new file mode 100644
index 0000000000..16770b2664
--- /dev/null
+++ b/patches.kernel.org/5.1.5-026-parisc-Export-running_on_qemu-symbol-for-module.patch
@@ -0,0 +1,32 @@
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 6 Apr 2019 16:45:14 +0200
+Subject: [PATCH] parisc: Export running_on_qemu symbol for modules
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 3e1120f4b57bc12437048494ab56648edaa5b57d
+
+commit 3e1120f4b57bc12437048494ab56648edaa5b57d upstream.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/parisc/kernel/process.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/parisc/kernel/process.c b/arch/parisc/kernel/process.c
+index 841db71958cd..97c206734e24 100644
+--- a/arch/parisc/kernel/process.c
++++ b/arch/parisc/kernel/process.c
+@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *tsk, elf_fpregset_t *r)
+ */
+
+ int running_on_qemu __read_mostly;
++EXPORT_SYMBOL(running_on_qemu);
+
+ void __cpuidle arch_cpu_idle_dead(void)
+ {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-027-parisc-Add-memory-clobber-to-TLB-purges.patch b/patches.kernel.org/5.1.5-027-parisc-Add-memory-clobber-to-TLB-purges.patch
new file mode 100644
index 0000000000..cc8917166e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-027-parisc-Add-memory-clobber-to-TLB-purges.patch
@@ -0,0 +1,48 @@
+From: John David Anglin <dave.anglin@bell.net>
+Date: Sun, 21 Apr 2019 19:47:17 -0400
+Subject: [PATCH] parisc: Add memory clobber to TLB purges
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 44224bdb99150ad17cf394973b25736cb92c246a
+
+commit 44224bdb99150ad17cf394973b25736cb92c246a upstream.
+
+The pdtlb and pitlb instructions are strongly ordered. The asms invoking
+these instructions should be compiler memory barriers to ensure the
+compiler doesn't reorder memory operations around these instructions.
+
+Signed-off-by: John David Anglin <dave.anglin@bell.net>
+CC: stable@vger.kernel.org # v4.20+
+Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/parisc/include/asm/cache.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
+index 006fb939cac8..c18351cf5876 100644
+--- a/arch/parisc/include/asm/cache.h
++++ b/arch/parisc/include/asm/cache.h
+@@ -44,14 +44,14 @@ void parisc_setup_cache_timing(void);
+
+ #define pdtlb(addr) asm volatile("pdtlb 0(%%sr1,%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define pitlb(addr) asm volatile("pitlb 0(%%sr1,%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+ ALTERNATIVE(ALT_COND_NO_SPLIT_TLB, INSN_NOP) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define pdtlb_kernel(addr) asm volatile("pdtlb 0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+
+ #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-028-parisc-Skip-registering-LED-when-running-in-QEM.patch b/patches.kernel.org/5.1.5-028-parisc-Skip-registering-LED-when-running-in-QEM.patch
new file mode 100644
index 0000000000..51698e11fb
--- /dev/null
+++ b/patches.kernel.org/5.1.5-028-parisc-Skip-registering-LED-when-running-in-QEM.patch
@@ -0,0 +1,36 @@
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 2 Apr 2019 12:17:08 +0200
+Subject: [PATCH] parisc: Skip registering LED when running in QEMU
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b438749044356dd1329c45e9b5a9377b6ea13eb2
+
+commit b438749044356dd1329c45e9b5a9377b6ea13eb2 upstream.
+
+No need to spend CPU cycles when we run on QEMU.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+CC: stable@vger.kernel.org # v4.9+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/parisc/led.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/parisc/led.c b/drivers/parisc/led.c
+index 0c6e8b44b4ed..c60b465f6fe4 100644
+--- a/drivers/parisc/led.c
++++ b/drivers/parisc/led.c
+@@ -568,6 +568,9 @@ int __init register_led_driver(int model, unsigned long cmd_reg, unsigned long d
+ break;
+
+ case DISPLAY_MODEL_LASI:
++ /* Skip to register LED in QEMU */
++ if (running_on_qemu)
++ return 1;
+ LED_DATA_REG = data_reg;
+ led_func_ptr = led_LASI_driver;
+ printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-029-parisc-Add-memory-barrier-to-asm-pdc-and-sync-i.patch b/patches.kernel.org/5.1.5-029-parisc-Add-memory-barrier-to-asm-pdc-and-sync-i.patch
new file mode 100644
index 0000000000..8f5ba186af
--- /dev/null
+++ b/patches.kernel.org/5.1.5-029-parisc-Add-memory-barrier-to-asm-pdc-and-sync-i.patch
@@ -0,0 +1,41 @@
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 27 Apr 2019 23:57:49 +0200
+Subject: [PATCH] parisc: Add memory barrier to asm pdc and sync instructions
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 2d94a832e246ac00fd32eec241e6f1aa6fbc5700
+
+commit 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 upstream.
+
+Add compiler memory barriers to ensure the compiler doesn't reorder memory
+operations around these instructions.
+
+Cc: stable@vger.kernel.org # v4.20+
+Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/parisc/include/asm/cache.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/include/asm/cache.h b/arch/parisc/include/asm/cache.h
+index c18351cf5876..4016fe1c65a9 100644
+--- a/arch/parisc/include/asm/cache.h
++++ b/arch/parisc/include/asm/cache.h
+@@ -56,10 +56,10 @@ void parisc_setup_cache_timing(void);
+ #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) \
+- : : "r" (addr))
++ : : "r" (addr) : "memory")
+ #define asm_io_sync() asm volatile("sync" \
+ ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \
+- ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :: )
++ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :::"memory")
+
+ #endif /* ! __ASSEMBLY__ */
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-030-parisc-Allow-live-patching-of-__meminit-functio.patch b/patches.kernel.org/5.1.5-030-parisc-Allow-live-patching-of-__meminit-functio.patch
new file mode 100644
index 0000000000..406ef81082
--- /dev/null
+++ b/patches.kernel.org/5.1.5-030-parisc-Allow-live-patching-of-__meminit-functio.patch
@@ -0,0 +1,37 @@
+From: Helge Deller <deller@gmx.de>
+Date: Wed, 1 May 2019 14:59:58 +0200
+Subject: [PATCH] parisc: Allow live-patching of __meminit functions
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: d19a12906e5e558c0f6b6cfece7b7caf1012ef95
+
+commit d19a12906e5e558c0f6b6cfece7b7caf1012ef95 upstream.
+
+When making the text sections writeable with set_kernel_text_rw(1),
+include all text sections including those in the __init section.
+Otherwise functions marked with __meminit will stay read-only.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # 4.20+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/parisc/mm/init.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
+index d0b166256f1a..14147eb7a142 100644
+--- a/arch/parisc/mm/init.c
++++ b/arch/parisc/mm/init.c
+@@ -495,7 +495,7 @@ static void __init map_pages(unsigned long start_vaddr,
+
+ void __init set_kernel_text_rw(int enable_read_write)
+ {
+- unsigned long start = (unsigned long) _text;
++ unsigned long start = (unsigned long) __init_begin;
+ unsigned long end = (unsigned long) &data_start;
+
+ map_pages(start, __pa(start), end-start,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-031-parisc-Use-PA_ASM_LEVEL-in-boot-code.patch b/patches.kernel.org/5.1.5-031-parisc-Use-PA_ASM_LEVEL-in-boot-code.patch
new file mode 100644
index 0000000000..20ca319e51
--- /dev/null
+++ b/patches.kernel.org/5.1.5-031-parisc-Use-PA_ASM_LEVEL-in-boot-code.patch
@@ -0,0 +1,54 @@
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:55:02 +0200
+Subject: [PATCH] parisc: Use PA_ASM_LEVEL in boot code
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67
+
+commit bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 upstream.
+
+The LEVEL define clashed with the DRBD code.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # v4.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/parisc/boot/compressed/head.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/arch/parisc/boot/compressed/head.S b/arch/parisc/boot/compressed/head.S
+index 5aba20fa48aa..e8b798fd0cf0 100644
+--- a/arch/parisc/boot/compressed/head.S
++++ b/arch/parisc/boot/compressed/head.S
+@@ -22,7 +22,7 @@
+ __HEAD
+
+ ENTRY(startup)
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ #define PSW_W_SM 0x200
+ #define PSW_W_BIT 36
+@@ -63,7 +63,7 @@ $bss_loop:
+ load32 BOOTADDR(decompress_kernel),%r3
+
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ ssm PSW_W_SM, %r0 /* set W-bit */
+ depdi 0, 31, 32, %r3
+ #endif
+@@ -72,7 +72,7 @@ $bss_loop:
+
+ startup_continue:
+ #ifdef CONFIG_64BIT
+- .level LEVEL
++ .level PA_ASM_LEVEL
+ rsm PSW_W_SM, %r0 /* clear W-bit */
+ #endif
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-032-parisc-Rename-LEVEL-to-PA_ASM_LEVEL-to-avoid-na.patch b/patches.kernel.org/5.1.5-032-parisc-Rename-LEVEL-to-PA_ASM_LEVEL-to-avoid-na.patch
new file mode 100644
index 0000000000..2b1c90393d
--- /dev/null
+++ b/patches.kernel.org/5.1.5-032-parisc-Rename-LEVEL-to-PA_ASM_LEVEL-to-avoid-na.patch
@@ -0,0 +1,85 @@
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 5 May 2019 23:54:34 +0200
+Subject: [PATCH] parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with
+ DRBD code
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 1829dda0e87f4462782ca81be474c7890efe31ce
+
+commit 1829dda0e87f4462782ca81be474c7890efe31ce upstream.
+
+LEVEL is a very common word, and now after many years it suddenly
+clashed with another LEVEL define in the DRBD code.
+Rename it to PA_ASM_LEVEL instead.
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/parisc/include/asm/assembly.h | 6 +++---
+ arch/parisc/kernel/head.S | 4 ++--
+ arch/parisc/kernel/syscall.S | 2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/arch/parisc/include/asm/assembly.h b/arch/parisc/include/asm/assembly.h
+index c17ec0ee6e7c..d85738a7bbe6 100644
+--- a/arch/parisc/include/asm/assembly.h
++++ b/arch/parisc/include/asm/assembly.h
+@@ -61,14 +61,14 @@
+ #define LDCW ldcw,co
+ #define BL b,l
+ # ifdef CONFIG_64BIT
+-# define LEVEL 2.0w
++# define PA_ASM_LEVEL 2.0w
+ # else
+-# define LEVEL 2.0
++# define PA_ASM_LEVEL 2.0
+ # endif
+ #else
+ #define LDCW ldcw
+ #define BL bl
+-#define LEVEL 1.1
++#define PA_ASM_LEVEL 1.1
+ #endif
+
+ #ifdef __ASSEMBLY__
+diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S
+index fbb4e43fda05..f56cbab64ac1 100644
+--- a/arch/parisc/kernel/head.S
++++ b/arch/parisc/kernel/head.S
+@@ -22,7 +22,7 @@
+ #include <linux/linkage.h>
+ #include <linux/init.h>
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ __INITDATA
+ ENTRY(boot_args)
+@@ -258,7 +258,7 @@ stext_pdc_ret:
+ ldo R%PA(fault_vector_11)(%r10),%r10
+
+ $is_pa20:
+- .level LEVEL /* restore 1.1 || 2.0w */
++ .level PA_ASM_LEVEL /* restore 1.1 || 2.0w */
+ #endif /*!CONFIG_64BIT*/
+ load32 PA(fault_vector_20),%r10
+
+diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
+index 4f77bd9be66b..93cc36d98875 100644
+--- a/arch/parisc/kernel/syscall.S
++++ b/arch/parisc/kernel/syscall.S
+@@ -48,7 +48,7 @@ registers).
+ */
+ #define KILL_INSN break 0,0
+
+- .level LEVEL
++ .level PA_ASM_LEVEL
+
+ .text
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-033-stm-class-Fix-channel-free-in-stm-output-free-p.patch b/patches.kernel.org/5.1.5-033-stm-class-Fix-channel-free-in-stm-output-free-p.patch
new file mode 100644
index 0000000000..01ec1f4535
--- /dev/null
+++ b/patches.kernel.org/5.1.5-033-stm-class-Fix-channel-free-in-stm-output-free-p.patch
@@ -0,0 +1,45 @@
+From: Tingwei Zhang <tingwei@codeaurora.org>
+Date: Wed, 17 Apr 2019 10:35:34 +0300
+Subject: [PATCH] stm class: Fix channel free in stm output free path
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ee496da4c3915de3232b5f5cd20e21ae3e46fe8d
+
+commit ee496da4c3915de3232b5f5cd20e21ae3e46fe8d upstream.
+
+Number of free masters is not set correctly in stm
+free path. Fix this by properly adding the number
+of output channels before setting them to 0 in
+stm_output_disclaim().
+
+Currently it is equivalent to doing nothing since
+master->nr_free is incremented by 0.
+
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Signed-off-by: Tingwei Zhang <tingwei@codeaurora.org>
+Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hwtracing/stm/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index c7ba8acfd4d5..5b5807cbcf7c 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -218,8 +218,8 @@ stm_output_disclaim(struct stm_device *stm, struct stm_output *output)
+ bitmap_release_region(&master->chan_map[0], output->channel,
+ ilog2(output->nr_chans));
+
+- output->nr_chans = 0;
+ master->nr_free += output->nr_chans;
++ output->nr_chans = 0;
+ }
+
+ /*
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-034-stm-class-Fix-channel-bitmap-on-32-bit-systems.patch b/patches.kernel.org/5.1.5-034-stm-class-Fix-channel-bitmap-on-32-bit-systems.patch
new file mode 100644
index 0000000000..3dd9dea71a
--- /dev/null
+++ b/patches.kernel.org/5.1.5-034-stm-class-Fix-channel-bitmap-on-32-bit-systems.patch
@@ -0,0 +1,50 @@
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Wed, 17 Apr 2019 10:35:35 +0300
+Subject: [PATCH] stm class: Fix channel bitmap on 32-bit systems
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 51e0f227812ed81a368de54157ebe14396b4be03
+
+commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream.
+
+Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace
+Module devices") naively calculates the channel bitmap size in 64-bit
+chunks regardless of the size of underlying unsigned long, making the
+bitmap half as big on a 32-bit system. This leads to an out of bounds
+access with the upper half of the bitmap.
+
+Fix this by using BITS_TO_LONGS. While at it, convert to using
+struct_size() for the total size calculation of the master struct.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+Reported-by: Mulu He <muluhe@codeaurora.org>
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hwtracing/stm/core.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
+index 5b5807cbcf7c..e55b902560de 100644
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsigned int idx)
+ static int stp_master_alloc(struct stm_device *stm, unsigned int idx)
+ {
+ struct stp_master *master;
+- size_t size;
+
+- size = ALIGN(stm->data->sw_nchannels, 8) / 8;
+- size += sizeof(struct stp_master);
+- master = kzalloc(size, GFP_ATOMIC);
++ master = kzalloc(struct_size(master, chan_map,
++ BITS_TO_LONGS(stm->data->sw_nchannels)),
++ GFP_ATOMIC);
+ if (!master)
+ return -ENOMEM;
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-035-brd-re-enable-__GFP_HIGHMEM-in-brd_insert_page.patch b/patches.kernel.org/5.1.5-035-brd-re-enable-__GFP_HIGHMEM-in-brd_insert_page.patch
new file mode 100644
index 0000000000..cc66e5d96e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-035-brd-re-enable-__GFP_HIGHMEM-in-brd_insert_page.patch
@@ -0,0 +1,48 @@
+From: Hou Tao <houtao1@huawei.com>
+Date: Mon, 22 Apr 2019 21:23:21 +0800
+Subject: [PATCH] brd: re-enable __GFP_HIGHMEM in brd_insert_page()
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: f6b50160a06d4a0d6a3999ab0c5aec4f52dba248
+
+commit f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 upstream.
+
+__GFP_HIGHMEM is disabled if dax is enabled on brd, however
+dax support for brd has been removed since commit (7a862fbbdec6
+"brd: remove dax support"), so restore __GFP_HIGHMEM in
+brd_insert_page().
+
+Also remove the no longer applicable comments about DAX and highmem.
+
+Cc: stable@vger.kernel.org
+Fixes: 7a862fbbdec6 ("brd: remove dax support")
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/block/brd.c | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/drivers/block/brd.c b/drivers/block/brd.c
+index c18586fccb6f..17defbf4f332 100644
+--- a/drivers/block/brd.c
++++ b/drivers/block/brd.c
+@@ -96,13 +96,8 @@ static struct page *brd_insert_page(struct brd_device *brd, sector_t sector)
+ /*
+ * Must use NOIO because we don't want to recurse back into the
+ * block or filesystem layers from page reclaim.
+- *
+- * Cannot support DAX and highmem, because our ->direct_access
+- * routine for DAX must return memory that is always addressable.
+- * If DAX was reworked to use pfns and kmap throughout, this
+- * restriction might be able to be lifted.
+ */
+- gfp_flags = GFP_NOIO | __GFP_ZERO;
++ gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM;
+ page = alloc_page(gfp_flags);
+ if (!page)
+ return NULL;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-036-proc-prevent-changes-to-overridden-credentials.patch b/patches.kernel.org/5.1.5-036-proc-prevent-changes-to-overridden-credentials.patch
new file mode 100644
index 0000000000..fae66946ed
--- /dev/null
+++ b/patches.kernel.org/5.1.5-036-proc-prevent-changes-to-overridden-credentials.patch
@@ -0,0 +1,46 @@
+From: Paul Moore <paul@paul-moore.com>
+Date: Fri, 19 Apr 2019 14:55:12 -0400
+Subject: [PATCH] proc: prevent changes to overridden credentials
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 35a196bef449b5824033865b963ed9a43fb8c730
+
+commit 35a196bef449b5824033865b963ed9a43fb8c730 upstream.
+
+Prevent userspace from changing the the /proc/PID/attr values if the
+task's credentials are currently overriden. This not only makes sense
+conceptually, it also prevents some really bizarre error cases caused
+when trying to commit credentials to a task with overridden
+credentials.
+
+Cc: <stable@vger.kernel.org>
+Reported-by: "chengjian (D)" <cj.chengjian@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Acked-by: John Johansen <john.johansen@canonical.com>
+Acked-by: James Morris <james.morris@microsoft.com>
+Acked-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/proc/base.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 6a803a0b75df..0c9bef89ac43 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -2540,6 +2540,11 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
+ rcu_read_unlock();
+ return -EACCES;
+ }
++ /* Prevent changes to overridden credentials. */
++ if (current_cred() != current_real_cred()) {
++ rcu_read_unlock();
++ return -EBUSY;
++ }
+ rcu_read_unlock();
+
+ if (count > PAGE_SIZE)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-037-Revert-MD-fix-lock-contention-for-flush-bios.patch b/patches.kernel.org/5.1.5-037-Revert-MD-fix-lock-contention-for-flush-bios.patch
new file mode 100644
index 0000000000..2b3d091e23
--- /dev/null
+++ b/patches.kernel.org/5.1.5-037-Revert-MD-fix-lock-contention-for-flush-bios.patch
@@ -0,0 +1,319 @@
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:16 -0700
+Subject: [PATCH] Revert "MD: fix lock contention for flush bios"
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 4bc034d35377196c854236133b07730a777c4aba
+
+commit 4bc034d35377196c854236133b07730a777c4aba upstream.
+
+This reverts commit 5a409b4f56d50b212334f338cb8465d65550cd85.
+
+This patch has two problems.
+
+1/ it make multiple calls to submit_bio() from inside a make_request_fn.
+ The bios thus submitted will be queued on current->bio_list and not
+ submitted immediately. As the bios are allocated from a mempool,
+ this can theoretically result in a deadlock - all the pool of requests
+ could be in various ->bio_list queues and a subsequent mempool_alloc
+ could block waiting for one of them to be released.
+
+2/ It aims to handle a case when there are many concurrent flush requests.
+ It handles this by submitting many requests in parallel - all of which
+ are identical and so most of which do nothing useful.
+ It would be more efficient to just send one lower-level request, but
+ allow that to satisfy multiple upper-level requests.
+
+Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios")
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/md.c | 159 +++++++++++++++++-------------------------------
+ drivers/md/md.h | 22 +++----
+ 2 files changed, 62 insertions(+), 119 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 05ffffb8b769..021e522001c1 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev *mddev)
+ mddev->sync_speed_max : sysctl_speed_limit_max;
+ }
+
+-static void * flush_info_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_info), gfp_flags);
+-}
+-static void flush_info_free(void *flush_info, void *data)
+-{
+- kfree(flush_info);
+-}
+-
+-static void * flush_bio_alloc(gfp_t gfp_flags, void *data)
+-{
+- return kzalloc(sizeof(struct flush_bio), gfp_flags);
+-}
+-static void flush_bio_free(void *flush_bio, void *data)
+-{
+- kfree(flush_bio);
+-}
+-
+ static struct ctl_table_header *raid_table_header;
+
+ static struct ctl_table raid_table[] = {
+@@ -423,54 +405,30 @@ static int md_congested(void *data, int bits)
+ /*
+ * Generic flush handling for md
+ */
+-static void submit_flushes(struct work_struct *ws)
+-{
+- struct flush_info *fi = container_of(ws, struct flush_info, flush_work);
+- struct mddev *mddev = fi->mddev;
+- struct bio *bio = fi->bio;
+-
+- bio->bi_opf &= ~REQ_PREFLUSH;
+- md_handle_request(mddev, bio);
+-
+- mempool_free(fi, mddev->flush_pool);
+-}
+
+-static void md_end_flush(struct bio *fbio)
++static void md_end_flush(struct bio *bio)
+ {
+- struct flush_bio *fb = fbio->bi_private;
+- struct md_rdev *rdev = fb->rdev;
+- struct flush_info *fi = fb->fi;
+- struct bio *bio = fi->bio;
+- struct mddev *mddev = fi->mddev;
++ struct md_rdev *rdev = bio->bi_private;
++ struct mddev *mddev = rdev->mddev;
+
+ rdev_dec_pending(rdev, mddev);
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++ if (atomic_dec_and_test(&mddev->flush_pending)) {
++ /* The pre-request flush has finished */
++ queue_work(md_wq, &mddev->flush_work);
+ }
+-
+- mempool_free(fb, mddev->flush_bio_pool);
+- bio_put(fbio);
++ bio_put(bio);
+ }
+
+-void md_flush_request(struct mddev *mddev, struct bio *bio)
++static void md_submit_flush_data(struct work_struct *ws);
++
++static void submit_flushes(struct work_struct *ws)
+ {
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+- struct flush_info *fi;
+-
+- fi = mempool_alloc(mddev->flush_pool, GFP_NOIO);
+-
+- fi->bio = bio;
+- fi->mddev = mddev;
+- atomic_set(&fi->flush_pending, 1);
+
++ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
++ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+ rdev_for_each_rcu(rdev, mddev)
+ if (rdev->raid_disk >= 0 &&
+@@ -480,40 +438,59 @@ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ * we reclaim rcu_read_lock
+ */
+ struct bio *bi;
+- struct flush_bio *fb;
+ atomic_inc(&rdev->nr_pending);
+ atomic_inc(&rdev->nr_pending);
+ rcu_read_unlock();
+-
+- fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO);
+- fb->fi = fi;
+- fb->rdev = rdev;
+-
+ bi = bio_alloc_mddev(GFP_NOIO, 0, mddev);
+- bio_set_dev(bi, rdev->bdev);
+ bi->bi_end_io = md_end_flush;
+- bi->bi_private = fb;
++ bi->bi_private = rdev;
++ bio_set_dev(bi, rdev->bdev);
+ bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH;
+-
+- atomic_inc(&fi->flush_pending);
++ atomic_inc(&mddev->flush_pending);
+ submit_bio(bi);
+-
+ rcu_read_lock();
+ rdev_dec_pending(rdev, mddev);
+ }
+ rcu_read_unlock();
++ if (atomic_dec_and_test(&mddev->flush_pending))
++ queue_work(md_wq, &mddev->flush_work);
++}
+
+- if (atomic_dec_and_test(&fi->flush_pending)) {
+- if (bio->bi_iter.bi_size == 0) {
+- /* an empty barrier - all done */
+- bio_endio(bio);
+- mempool_free(fi, mddev->flush_pool);
+- } else {
+- INIT_WORK(&fi->flush_work, submit_flushes);
+- queue_work(md_wq, &fi->flush_work);
+- }
++static void md_submit_flush_data(struct work_struct *ws)
++{
++ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
++ struct bio *bio = mddev->flush_bio;
++
++ /*
++ * must reset flush_bio before calling into md_handle_request to avoid a
++ * deadlock, because other bios passed md_handle_request suspend check
++ * could wait for this and below md_handle_request could wait for those
++ * bios because of suspend check
++ */
++ mddev->flush_bio = NULL;
++ wake_up(&mddev->sb_wait);
++
++ if (bio->bi_iter.bi_size == 0) {
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ } else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ md_handle_request(mddev, bio);
+ }
+ }
++
++void md_flush_request(struct mddev *mddev, struct bio *bio)
++{
++ spin_lock_irq(&mddev->lock);
++ wait_event_lock_irq(mddev->sb_wait,
++ !mddev->flush_bio,
++ mddev->lock);
++ mddev->flush_bio = bio;
++ spin_unlock_irq(&mddev->lock);
++
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++}
+ EXPORT_SYMBOL(md_flush_request);
+
+ static inline struct mddev *mddev_get(struct mddev *mddev)
+@@ -560,6 +537,7 @@ void mddev_init(struct mddev *mddev)
+ atomic_set(&mddev->openers, 0);
+ atomic_set(&mddev->active_io, 0);
+ spin_lock_init(&mddev->lock);
++ atomic_set(&mddev->flush_pending, 0);
+ init_waitqueue_head(&mddev->sb_wait);
+ init_waitqueue_head(&mddev->recovery_wait);
+ mddev->reshape_position = MaxSector;
+@@ -5511,22 +5489,6 @@ int md_run(struct mddev *mddev)
+ if (err)
+ return err;
+ }
+- if (mddev->flush_pool == NULL) {
+- mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc,
+- flush_info_free, mddev);
+- if (!mddev->flush_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+- if (mddev->flush_bio_pool == NULL) {
+- mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc,
+- flush_bio_free, mddev);
+- if (!mddev->flush_bio_pool) {
+- err = -ENOMEM;
+- goto abort;
+- }
+- }
+
+ spin_lock(&pers_lock);
+ pers = find_pers(mddev->level, mddev->clevel);
+@@ -5686,11 +5648,8 @@ int md_run(struct mddev *mddev)
+ return 0;
+
+ abort:
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+-
++ bioset_exit(&mddev->bio_set);
++ bioset_exit(&mddev->sync_set);
+ return err;
+ }
+ EXPORT_SYMBOL_GPL(md_run);
+@@ -5894,14 +5853,6 @@ static void __md_stop(struct mddev *mddev)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(pers->owner);
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+- if (mddev->flush_bio_pool) {
+- mempool_destroy(mddev->flush_bio_pool);
+- mddev->flush_bio_pool = NULL;
+- }
+- if (mddev->flush_pool) {
+- mempool_destroy(mddev->flush_pool);
+- mddev->flush_pool = NULL;
+- }
+ }
+
+ void md_stop(struct mddev *mddev)
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index c52afb52c776..2deb84fa93f9 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -252,19 +252,6 @@ enum mddev_sb_flags {
+ MD_SB_NEED_REWRITE, /* metadata write needs to be repeated */
+ };
+
+-#define NR_FLUSH_INFOS 8
+-#define NR_FLUSH_BIOS 64
+-struct flush_info {
+- struct bio *bio;
+- struct mddev *mddev;
+- struct work_struct flush_work;
+- atomic_t flush_pending;
+-};
+-struct flush_bio {
+- struct flush_info *fi;
+- struct md_rdev *rdev;
+-};
+-
+ struct mddev {
+ void *private;
+ struct md_personality *pers;
+@@ -470,8 +457,13 @@ struct mddev {
+ * metadata and bitmap writes
+ */
+
+- mempool_t *flush_pool;
+- mempool_t *flush_bio_pool;
++ /* Generic flush handling.
++ * The last to finish preflush schedules a worker to submit
++ * the rest of the request (without the REQ_PREFLUSH flag).
++ */
++ struct bio *flush_bio;
++ atomic_t flush_pending;
++ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+ struct md_cluster_info *cluster_info;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-038-md-batch-flush-requests.patch b/patches.kernel.org/5.1.5-038-md-batch-flush-requests.patch
new file mode 100644
index 0000000000..be27cc0c53
--- /dev/null
+++ b/patches.kernel.org/5.1.5-038-md-batch-flush-requests.patch
@@ -0,0 +1,177 @@
+From: NeilBrown <neilb@suse.com>
+Date: Fri, 29 Mar 2019 10:46:17 -0700
+Subject: [PATCH] md: batch flush requests.
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 2bc13b83e6298486371761de503faeffd15b7534
+
+commit 2bc13b83e6298486371761de503faeffd15b7534 upstream.
+
+Currently if many flush requests are submitted to an md device is quick
+succession, they are serialized and can take a long to process them all.
+We don't really need to call flush all those times - a single flush call
+can satisfy all requests submitted before it started.
+So keep track of when the current flush started and when it finished,
+allow any pending flush that was requested before the flush started
+to complete without waiting any more.
+
+Test results from Xiao:
+
+Test is done on a raid10 device which is created by 4 SSDs. The tool is
+dbench.
+
+1. The latest linux stable kernel
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 10.509 78.305
+ Flush 2078376 0.013 10.094
+ Close 21787697 0.019 18.821
+ LockX 96580 0.007 3.184
+ Mkdir 384 0.008 0.062
+ Rename 1255883 0.191 23.534
+ ReadX 46495589 0.020 14.230
+ WriteX 14790591 7.123 60.706
+ Unlink 5989118 0.440 54.551
+ UnlockX 96580 0.005 2.736
+ FIND_FIRST 10393845 0.042 12.079
+ SET_FILE_INFORMATION 2415558 0.129 10.088
+ QUERY_FILE_INFORMATION 4711725 0.005 8.462
+ QUERY_PATH_INFORMATION 26883327 0.032 21.715
+ QUERY_FS_INFORMATION 4929409 0.010 8.238
+ NTCreateX 29660080 0.100 53.268
+
+Throughput 1034.88 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.712 ms
+
+2. With patch1 "Revert "MD: fix lock contention for flush bios""
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 256 8.326 36.761
+ Flush 693291 3.974 180.269
+ Close 7266404 0.009 36.929
+ LockX 32160 0.006 0.840
+ Mkdir 128 0.008 0.021
+ Rename 418755 0.063 29.945
+ ReadX 15498708 0.007 7.216
+ WriteX 4932310 22.482 267.928
+ Unlink 1997557 0.109 47.553
+ UnlockX 32160 0.004 1.110
+ FIND_FIRST 3465791 0.036 7.320
+ SET_FILE_INFORMATION 805825 0.015 1.561
+ QUERY_FILE_INFORMATION 1570950 0.005 2.403
+ QUERY_PATH_INFORMATION 8965483 0.013 14.277
+ QUERY_FS_INFORMATION 1643626 0.009 3.314
+ NTCreateX 9892174 0.061 41.278
+
+Throughput 345.009 MB/sec (sync open) 128 clients 128 procs
+max_latency=267.939 m
+
+3. With patch1 and patch2
+ Operation Count AvgLat MaxLat
+ --------------------------------------------------
+ Deltree 768 9.570 54.588
+ Flush 2061354 0.666 15.102
+ Close 21604811 0.012 25.697
+ LockX 95770 0.007 1.424
+ Mkdir 384 0.008 0.053
+ Rename 1245411 0.096 12.263
+ ReadX 46103198 0.011 12.116
+ WriteX 14667988 7.375 60.069
+ Unlink 5938936 0.173 30.905
+ UnlockX 95770 0.005 4.147
+ FIND_FIRST 10306407 0.041 11.715
+ SET_FILE_INFORMATION 2395987 0.048 7.640
+ QUERY_FILE_INFORMATION 4672371 0.005 9.291
+ QUERY_PATH_INFORMATION 26656735 0.018 19.719
+ QUERY_FS_INFORMATION 4887940 0.010 7.654
+ NTCreateX 29410811 0.059 28.551
+
+Throughput 1026.21 MB/sec (sync open) 128 clients 128 procs
+max_latency=60.075 ms
+
+Cc: <stable@vger.kernel.org> # v4.19+
+Tested-by: Xiao Ni <xni@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/md.c | 27 +++++++++++++++++++++++----
+ drivers/md/md.h | 3 +++
+ 2 files changed, 26 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 021e522001c1..d0f688399a56 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -427,6 +427,7 @@ static void submit_flushes(struct work_struct *ws)
+ struct mddev *mddev = container_of(ws, struct mddev, flush_work);
+ struct md_rdev *rdev;
+
++ mddev->start_flush = ktime_get_boottime();
+ INIT_WORK(&mddev->flush_work, md_submit_flush_data);
+ atomic_set(&mddev->flush_pending, 1);
+ rcu_read_lock();
+@@ -467,6 +468,7 @@ static void md_submit_flush_data(struct work_struct *ws)
+ * could wait for this and below md_handle_request could wait for those
+ * bios because of suspend check
+ */
++ mddev->last_flush = mddev->start_flush;
+ mddev->flush_bio = NULL;
+ wake_up(&mddev->sb_wait);
+
+@@ -481,15 +483,32 @@ static void md_submit_flush_data(struct work_struct *ws)
+
+ void md_flush_request(struct mddev *mddev, struct bio *bio)
+ {
++ ktime_t start = ktime_get_boottime();
+ spin_lock_irq(&mddev->lock);
+ wait_event_lock_irq(mddev->sb_wait,
+- !mddev->flush_bio,
++ !mddev->flush_bio ||
++ ktime_after(mddev->last_flush, start),
+ mddev->lock);
+- mddev->flush_bio = bio;
++ if (!ktime_after(mddev->last_flush, start)) {
++ WARN_ON(mddev->flush_bio);
++ mddev->flush_bio = bio;
++ bio = NULL;
++ }
+ spin_unlock_irq(&mddev->lock);
+
+- INIT_WORK(&mddev->flush_work, submit_flushes);
+- queue_work(md_wq, &mddev->flush_work);
++ if (!bio) {
++ INIT_WORK(&mddev->flush_work, submit_flushes);
++ queue_work(md_wq, &mddev->flush_work);
++ } else {
++ /* flush was performed for some other bio while we waited. */
++ if (bio->bi_iter.bi_size == 0)
++ /* an empty barrier - all done */
++ bio_endio(bio);
++ else {
++ bio->bi_opf &= ~REQ_PREFLUSH;
++ mddev->pers->make_request(mddev, bio);
++ }
++ }
+ }
+ EXPORT_SYMBOL(md_flush_request);
+
+diff --git a/drivers/md/md.h b/drivers/md/md.h
+index 2deb84fa93f9..257cb4c9e22b 100644
+--- a/drivers/md/md.h
++++ b/drivers/md/md.h
+@@ -463,6 +463,9 @@ struct mddev {
+ */
+ struct bio *flush_bio;
+ atomic_t flush_pending;
++ ktime_t start_flush, last_flush; /* last_flush is when the last completed
++ * flush was started.
++ */
+ struct work_struct flush_work;
+ struct work_struct event_work; /* used by dm to report failure event */
+ void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-039-md-add-mddev-pers-to-avoid-potential-NULL-point.patch b/patches.kernel.org/5.1.5-039-md-add-mddev-pers-to-avoid-potential-NULL-point.patch
new file mode 100644
index 0000000000..ced04758ee
--- /dev/null
+++ b/patches.kernel.org/5.1.5-039-md-add-mddev-pers-to-avoid-potential-NULL-point.patch
@@ -0,0 +1,47 @@
+From: Yufen Yu <yuyufen@huawei.com>
+Date: Tue, 2 Apr 2019 14:22:14 +0800
+Subject: [PATCH] md: add mddev->pers to avoid potential NULL pointer
+ dereference
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ee37e62191a59d253fc916b9fc763deb777211e2
+
+commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream.
+
+When doing re-add, we need to ensure rdev->mddev->pers is not NULL,
+which can avoid potential NULL pointer derefence in fallowing
+add_bound_rdev().
+
+Fixes: a6da4ef85cef ("md: re-add a failed disk")
+Cc: Xiao Ni <xni@redhat.com>
+Cc: NeilBrown <neilb@suse.com>
+Cc: <stable@vger.kernel.org> # 4.4+
+Reviewed-by: NeilBrown <neilb@suse.com>
+Signed-off-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/md.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index d0f688399a56..6a98e882382c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -2852,8 +2852,10 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len)
+ err = 0;
+ }
+ } else if (cmd_match(buf, "re-add")) {
+- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
+- rdev->saved_raid_disk >= 0) {
++ if (!rdev->mddev->pers)
++ err = -EINVAL;
++ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) &&
++ rdev->saved_raid_disk >= 0) {
+ /* clear_bit is performed _after_ all the devices
+ * have their local Faulty bit cleared. If any writes
+ * happen in the meantime in the local node, they
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-040-md-add-a-missing-endianness-conversion-in-check.patch b/patches.kernel.org/5.1.5-040-md-add-a-missing-endianness-conversion-in-check.patch
new file mode 100644
index 0000000000..997a1433d2
--- /dev/null
+++ b/patches.kernel.org/5.1.5-040-md-add-a-missing-endianness-conversion-in-check.patch
@@ -0,0 +1,39 @@
+From: Christoph Hellwig <hch@lst.de>
+Date: Thu, 4 Apr 2019 18:56:10 +0200
+Subject: [PATCH] md: add a missing endianness conversion in check_sb_changes
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452
+
+commit ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 upstream.
+
+The on-disk value is little endian and we need to convert it to
+native endian before storing the value in the in-core structure.
+
+Fixes: 7564beda19b36 ("md-cluster/raid10: support add disk under grow mode")
+Cc: <stable@vger.kernel.org> # 4.20+
+Acked-by: Guoqing Jiang <gqjiang@suse.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/md.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 6a98e882382c..295ff09cff4c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -9229,7 +9229,7 @@ static void check_sb_changes(struct mddev *mddev, struct md_rdev *rdev)
+ * reshape is happening in the remote node, we need to
+ * update reshape_position and call start_reshape.
+ */
+- mddev->reshape_position = sb->reshape_position;
++ mddev->reshape_position = le64_to_cpu(sb->reshape_position);
+ if (mddev->pers->update_reshape_pos)
+ mddev->pers->update_reshape_pos(mddev);
+ if (mddev->pers->start_reshape)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-041-dcache-sort-the-freeing-without-RCU-delay-mess-.patch b/patches.kernel.org/5.1.5-041-dcache-sort-the-freeing-without-RCU-delay-mess-.patch
new file mode 100644
index 0000000000..74f48989b4
--- /dev/null
+++ b/patches.kernel.org/5.1.5-041-dcache-sort-the-freeing-without-RCU-delay-mess-.patch
@@ -0,0 +1,182 @@
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Fri, 15 Mar 2019 22:23:19 -0400
+Subject: [PATCH] dcache: sort the freeing-without-RCU-delay mess for good.
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 5467a68cbf6884c9a9d91e2a89140afb1839c835
+
+commit 5467a68cbf6884c9a9d91e2a89140afb1839c835 upstream.
+
+For lockless accesses to dentries we don't have pinned we rely
+(among other things) upon having an RCU delay between dropping
+the last reference and actually freeing the memory.
+
+On the other hand, for things like pipes and sockets we neither
+do that kind of lockless access, nor want to deal with the
+overhead of an RCU delay every time a socket gets closed.
+
+So delay was made optional - setting DCACHE_RCUACCESS in ->d_flags
+made sure it would happen. We tried to avoid setting it unless
+we knew we need it. Unfortunately, that had led to recurring
+class of bugs, in which we missed the need to set it.
+
+We only really need it for dentries that are created by
+d_alloc_pseudo(), so let's not bother with trying to be smart -
+just make having an RCU delay the default. The ones that do
+*not* get it set the replacement flag (DCACHE_NORCU) and we'd
+better use that sparingly. d_alloc_pseudo() is the only
+such user right now.
+
+FWIW, the race that finally prompted that switch had been
+between __lock_parent() of immediate subdirectory of what's
+currently the root of a disconnected tree (e.g. from
+open-by-handle in progress) racing with d_splice_alias()
+elsewhere picking another alias for the same inode, either
+on outright corrupted fs image, or (in case of open-by-handle
+on NFS) that subdirectory having been just moved on server.
+It's not easy to hit, so the sky is not falling, but that's
+not the first race on similar missed cases and the logics
+for settinf DCACHE_RCUACCESS has gotten ridiculously
+convoluted.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ Documentation/filesystems/porting | 5 +++++
+ fs/dcache.c | 24 +++++++++++++-----------
+ fs/nsfs.c | 3 +--
+ include/linux/dcache.h | 2 +-
+ 4 files changed, 20 insertions(+), 14 deletions(-)
+
+diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting
+index cf43bc4dbf31..a60fa516d4cb 100644
+--- a/Documentation/filesystems/porting
++++ b/Documentation/filesystems/porting
+@@ -638,3 +638,8 @@ in your dentry operations instead.
+ inode to d_splice_alias() will also do the right thing (equivalent of
+ d_add(dentry, NULL); return NULL;), so that kind of special cases
+ also doesn't need a separate treatment.
++--
++[mandatory]
++ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the
++ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any
++ business doing so.
+diff --git a/fs/dcache.c b/fs/dcache.c
+index aac41adf4743..c663c602f9ef 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *dentry)
+ }
+ }
+ /* if dentry was never visible to RCU, immediate free is OK */
+- if (!(dentry->d_flags & DCACHE_RCUACCESS))
++ if (dentry->d_flags & DCACHE_NORCU)
+ __d_free(&dentry->d_u.d_rcu);
+ else
+ call_rcu(&dentry->d_u.d_rcu, __d_free);
+@@ -1701,7 +1701,6 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
+ struct dentry *dentry = __d_alloc(parent->d_sb, name);
+ if (!dentry)
+ return NULL;
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ spin_lock(&parent->d_lock);
+ /*
+ * don't need child lock because it is not subject
+@@ -1726,7 +1725,7 @@ struct dentry *d_alloc_cursor(struct dentry * parent)
+ {
+ struct dentry *dentry = d_alloc_anon(parent->d_sb);
+ if (dentry) {
+- dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR;
++ dentry->d_flags |= DCACHE_DENTRY_CURSOR;
+ dentry->d_parent = dget(parent);
+ }
+ return dentry;
+@@ -1739,10 +1738,17 @@ struct dentry *d_alloc_cursor(struct dentry * parent)
+ *
+ * For a filesystem that just pins its dentries in memory and never
+ * performs lookups at all, return an unhashed IS_ROOT dentry.
++ * This is used for pipes, sockets et.al. - the stuff that should
++ * never be anyone's children or parents. Unlike all other
++ * dentries, these will not have RCU delay between dropping the
++ * last reference and freeing them.
+ */
+ struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name)
+ {
+- return __d_alloc(sb, name);
++ struct dentry *dentry = __d_alloc(sb, name);
++ if (likely(dentry))
++ dentry->d_flags |= DCACHE_NORCU;
++ return dentry;
+ }
+ EXPORT_SYMBOL(d_alloc_pseudo);
+
+@@ -1911,12 +1917,10 @@ struct dentry *d_make_root(struct inode *root_inode)
+
+ if (root_inode) {
+ res = d_alloc_anon(root_inode->i_sb);
+- if (res) {
+- res->d_flags |= DCACHE_RCUACCESS;
++ if (res)
+ d_instantiate(res, root_inode);
+- } else {
++ else
+ iput(root_inode);
+- }
+ }
+ return res;
+ }
+@@ -2781,9 +2785,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+ copy_name(dentry, target);
+ target->d_hash.pprev = NULL;
+ dentry->d_parent->d_lockref.count++;
+- if (dentry == old_parent)
+- dentry->d_flags |= DCACHE_RCUACCESS;
+- else
++ if (dentry != old_parent) /* wasn't IS_ROOT */
+ WARN_ON(!--old_parent->d_lockref.count);
+ } else {
+ target->d_parent = old_parent;
+diff --git a/fs/nsfs.c b/fs/nsfs.c
+index 60702d677bd4..30d150a4f0c6 100644
+--- a/fs/nsfs.c
++++ b/fs/nsfs.c
+@@ -85,13 +85,12 @@ slow:
+ inode->i_fop = &ns_file_operations;
+ inode->i_private = ns;
+
+- dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name);
++ dentry = d_alloc_anon(mnt->mnt_sb);
+ if (!dentry) {
+ iput(inode);
+ return ERR_PTR(-ENOMEM);
+ }
+ d_instantiate(dentry, inode);
+- dentry->d_flags |= DCACHE_RCUACCESS;
+ dentry->d_fsdata = (void *)ns->ops;
+ d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
+ if (d) {
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 60996e64c579..6e1e8e6602c6 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -176,7 +176,6 @@ struct dentry_operations {
+ * typically using d_splice_alias. */
+
+ #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */
+-#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */
+
+ #define DCACHE_CANT_MOUNT 0x00000100
+ #define DCACHE_GENOCIDE 0x00000200
+@@ -217,6 +216,7 @@ struct dentry_operations {
+
+ #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */
+ #define DCACHE_DENTRY_CURSOR 0x20000000
++#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */
+
+ extern seqlock_t rename_lock;
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-042-intel_th-msu-Fix-single-mode-with-IOMMU.patch b/patches.kernel.org/5.1.5-042-intel_th-msu-Fix-single-mode-with-IOMMU.patch
new file mode 100644
index 0000000000..f6ac1defda
--- /dev/null
+++ b/patches.kernel.org/5.1.5-042-intel_th-msu-Fix-single-mode-with-IOMMU.patch
@@ -0,0 +1,109 @@
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Fri, 3 May 2019 11:44:34 +0300
+Subject: [PATCH] intel_th: msu: Fix single mode with IOMMU
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 4e0eaf239fb33ebc671303e2b736fa043462e2f4
+
+commit 4e0eaf239fb33ebc671303e2b736fa043462e2f4 upstream.
+
+Currently, the pages that are allocated for the single mode of MSC are not
+mapped into the device's dma space and the code is incorrectly using
+*_to_phys() in place of a dma address. This fails with IOMMU enabled and
+is otherwise bad practice.
+
+Fix the single mode buffer allocation to map the pages into the device's
+DMA space.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver")
+Cc: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/hwtracing/intel_th/msu.c | 35 +++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
+index ba7aaf421f36..8ff326c0c406 100644
+--- a/drivers/hwtracing/intel_th/msu.c
++++ b/drivers/hwtracing/intel_th/msu.c
+@@ -84,6 +84,7 @@ struct msc_iter {
+ * @reg_base: register window base address
+ * @thdev: intel_th_device pointer
+ * @win_list: list of windows in multiblock mode
++ * @single_sgt: single mode buffer
+ * @nr_pages: total number of pages allocated for this buffer
+ * @single_sz: amount of data in single mode
+ * @single_wrap: single mode wrap occurred
+@@ -104,6 +105,7 @@ struct msc {
+ struct intel_th_device *thdev;
+
+ struct list_head win_list;
++ struct sg_table single_sgt;
+ unsigned long nr_pages;
+ unsigned long single_sz;
+ unsigned int single_wrap : 1;
+@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(struct intel_th_device *thdev)
+ */
+ static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size)
+ {
++ unsigned long nr_pages = size >> PAGE_SHIFT;
+ unsigned int order = get_order(size);
+ struct page *page;
++ int ret;
+
+ if (!size)
+ return 0;
+
++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL);
++ if (ret)
++ goto err_out;
++
++ ret = -ENOMEM;
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+- return -ENOMEM;
++ goto err_free_sgt;
+
+ split_page(page, order);
+- msc->nr_pages = size >> PAGE_SHIFT;
++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size);
++
++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1,
++ DMA_FROM_DEVICE);
++ if (ret < 0)
++ goto err_free_pages;
++
++ msc->nr_pages = nr_pages;
+ msc->base = page_address(page);
+- msc->base_addr = page_to_phys(page);
++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl);
+
+ return 0;
++
++err_free_pages:
++ __free_pages(page, order);
++
++err_free_sgt:
++ sg_free_table(&msc->single_sgt);
++
++err_out:
++ return ret;
+ }
+
+ /**
+@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struct msc *msc)
+ {
+ unsigned long off;
+
++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl,
++ 1, DMA_FROM_DEVICE);
++ sg_free_table(&msc->single_sgt);
++
+ for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) {
+ struct page *page = virt_to_page(msc->base + off);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-043-p54-drop-device-reference-count-if-fails-to-ena.patch b/patches.kernel.org/5.1.5-043-p54-drop-device-reference-count-if-fails-to-ena.patch
new file mode 100644
index 0000000000..84ec621f94
--- /dev/null
+++ b/patches.kernel.org/5.1.5-043-p54-drop-device-reference-count-if-fails-to-ena.patch
@@ -0,0 +1,47 @@
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 17 Apr 2019 17:41:23 +0800
+Subject: [PATCH] p54: drop device reference count if fails to enable device
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 8149069db81853570a665f5e5648c0e526dc0e43
+
+commit 8149069db81853570a665f5e5648c0e526dc0e43 upstream.
+
+The function p54p_probe takes an extra reference count of the PCI
+device. However, the extra reference count is not dropped when it fails
+to enable the PCI device. This patch fixes the bug.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Acked-by: Christian Lamparter <chunkeey@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/intersil/p54/p54pci.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intersil/p54/p54pci.c b/drivers/net/wireless/intersil/p54/p54pci.c
+index 27a49068d32d..57ad56435dda 100644
+--- a/drivers/net/wireless/intersil/p54/p54pci.c
++++ b/drivers/net/wireless/intersil/p54/p54pci.c
+@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pdev,
+ err = pci_enable_device(pdev);
+ if (err) {
+ dev_err(&pdev->dev, "Cannot enable new PCI device\n");
+- return err;
++ goto err_put;
+ }
+
+ mem_addr = pci_resource_start(pdev, 0);
+@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pdev,
+ pci_release_regions(pdev);
+ err_disable_dev:
+ pci_disable_device(pdev);
++err_put:
+ pci_dev_put(pdev);
+ return err;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-044-of-fix-clang-Wunsequenced-for-be32_to_cpu.patch b/patches.kernel.org/5.1.5-044-of-fix-clang-Wunsequenced-for-be32_to_cpu.patch
new file mode 100644
index 0000000000..53d2ceff5b
--- /dev/null
+++ b/patches.kernel.org/5.1.5-044-of-fix-clang-Wunsequenced-for-be32_to_cpu.patch
@@ -0,0 +1,61 @@
+From: Phong Tran <tranmanphong@gmail.com>
+Date: Tue, 30 Apr 2019 21:56:24 +0700
+Subject: [PATCH] of: fix clang -Wunsequenced for be32_to_cpu()
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 440868661f36071886ed360d91de83bd67c73b4f
+
+commit 440868661f36071886ed360d91de83bd67c73b4f upstream.
+
+Now, make the loop explicit to avoid clang warning.
+
+./include/linux/of.h:238:37: warning: multiple unsequenced modifications
+to 'cell' [-Wunsequenced]
+ r = (r << 32) | be32_to_cpu(*(cell++));
+ ^~
+./include/linux/byteorder/generic.h:95:21: note: expanded from macro
+'be32_to_cpu'
+ ^
+./include/uapi/linux/byteorder/little_endian.h:40:59: note: expanded
+from macro '__be32_to_cpu'
+ ^
+./include/uapi/linux/swab.h:118:21: note: expanded from macro '__swab32'
+ ___constant_swab32(x) : \
+ ^
+./include/uapi/linux/swab.h:18:12: note: expanded from macro
+'___constant_swab32'
+ (((__u32)(x) & (__u32)0x000000ffUL) << 24) | \
+ ^
+
+Signed-off-by: Phong Tran <tranmanphong@gmail.com>
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://github.com/ClangBuiltLinux/linux/issues/460
+Suggested-by: David Laight <David.Laight@ACULAB.COM>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Cc: stable@vger.kernel.org
+[robh: fix up whitespace]
+Signed-off-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/linux/of.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/of.h b/include/linux/of.h
+index e240992e5cb6..074913002e39 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -234,8 +234,8 @@ extern struct device_node *of_find_all_nodes(struct device_node *prev);
+ static inline u64 of_read_number(const __be32 *cell, int size)
+ {
+ u64 r = 0;
+- while (size--)
+- r = (r << 32) | be32_to_cpu(*(cell++));
++ for (; size--; cell++)
++ r = (r << 32) | be32_to_cpu(*cell);
+ return r;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-045-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC.patch b/patches.kernel.org/5.1.5-045-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC.patch
new file mode 100644
index 0000000000..525142abaf
--- /dev/null
+++ b/patches.kernel.org/5.1.5-045-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC.patch
@@ -0,0 +1,81 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Mon, 22 Apr 2019 22:41:23 +0200
+Subject: [PATCH] brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11
+ mini PCs
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe
+
+commit b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe upstream.
+
+The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor
+and product_name DMI strings, without this patch brcmfmac will try to load:
+"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which
+is way too generic.
+
+The DMI strings on which we are matching are somewhat generic too, but
+"To be filled by O.E.M." is less common then "Default string" and the
+system-sku and bios-version strings are pretty unique. Beside the DMI
+strings we also check the wifi-module chip-id and revision. I'm confident
+that the combination of all this is unique.
+
+Both the T8 and T11 use the same wifi-module, this commit adds DMI
+quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt .
+
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ .../broadcom/brcm80211/brcmfmac/dmi.c | 26 +++++++++++++++++++
+ 1 file changed, 26 insertions(+)
+
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+index 7535cb0d4ac0..9f1417e00073 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -31,6 +31,10 @@ struct brcmf_dmi_data {
+
+ /* NOTE: Please keep all entries sorted alphabetically */
+
++static const struct brcmf_dmi_data acepc_t8_data = {
++ BRCM_CC_4345_CHIP_ID, 6, "acepc-t8"
++};
++
+ static const struct brcmf_dmi_data gpd_win_pocket_data = {
+ BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket"
+ };
+@@ -48,6 +52,28 @@ static const struct brcmf_dmi_data pov_tab_p1006w_data = {
+ };
+
+ static const struct dmi_system_id dmi_platform_data[] = {
++ {
++ /* ACEPC T8 Cherry Trail Z8350 mini PC */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ .driver_data = (void *)&acepc_t8_data,
++ },
++ {
++ /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */
++ .matches = {
++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."),
++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"),
++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"),
++ /* also match on somewhat unique bios-version */
++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"),
++ },
++ .driver_data = (void *)&acepc_t8_data,
++ },
+ {
+ /* Match for the GPDwin which unfortunately uses somewhat
+ * generic dmi strings, which is why we test for 4 strings.
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-046-cifs-fix-credits-leak-for-SMB1-oplock-breaks.patch b/patches.kernel.org/5.1.5-046-cifs-fix-credits-leak-for-SMB1-oplock-breaks.patch
new file mode 100644
index 0000000000..0e3491b5ad
--- /dev/null
+++ b/patches.kernel.org/5.1.5-046-cifs-fix-credits-leak-for-SMB1-oplock-breaks.patch
@@ -0,0 +1,86 @@
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+Date: Wed, 1 May 2019 12:03:41 +1000
+Subject: [PATCH] cifs: fix credits leak for SMB1 oplock breaks
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: d69cb728e70c40268762182a62f5d5d6fa51c5b2
+
+commit d69cb728e70c40268762182a62f5d5d6fa51c5b2 upstream.
+
+For SMB1 oplock breaks we would grab one credit while sending the PDU
+but we would never relese the credit back since we will never receive a
+response to this from the server. Eventuallt this would lead to a hang
+once all credits are leaked.
+
+Fix this by defining a new flag CIFS_NO_SRV_RSP which indicates that there
+is no server response to this command and thus we need to add any credits back
+immediately after sending the PDU.
+
+CC: Stable <stable@vger.kernel.org> #v5.0+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/cifs/cifsglob.h | 1 +
+ fs/cifs/cifssmb.c | 2 +-
+ fs/cifs/transport.c | 10 +++++-----
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 585ad3207cb1..607468948f72 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1687,6 +1687,7 @@ static inline bool is_retryable_error(int error)
+
+ #define CIFS_HAS_CREDITS 0x0400 /* already has credits */
+ #define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */
++#define CIFS_NO_SRV_RSP 0x1000 /* there is no server response */
+
+ /* Security Flags: indicate type of session setup needed */
+ #define CIFSSEC_MAY_SIGN 0x00001
+diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
+index f43747c062a7..6050851edcb8 100644
+--- a/fs/cifs/cifssmb.c
++++ b/fs/cifs/cifssmb.c
+@@ -2540,7 +2540,7 @@ CIFSSMBLock(const unsigned int xid, struct cifs_tcon *tcon,
+
+ if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) {
+ /* no response expected */
+- flags = CIFS_ASYNC_OP | CIFS_OBREAK_OP;
++ flags = CIFS_NO_SRV_RSP | CIFS_ASYNC_OP | CIFS_OBREAK_OP;
+ pSMB->Timeout = 0;
+ } else if (waitFlag) {
+ flags = CIFS_BLOCKING_OP; /* blocking operation, no timeout */
+diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
+index 1de8e996e566..72e242c49ca1 100644
+--- a/fs/cifs/transport.c
++++ b/fs/cifs/transport.c
+@@ -1054,8 +1054,11 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+
+ mutex_unlock(&ses->server->srv_mutex);
+
+- if (rc < 0) {
+- /* Sending failed for some reason - return credits back */
++ /*
++ * If sending failed for some reason or it is an oplock break that we
++ * will not receive a response to - return credits back
++ */
++ if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) {
+ for (i = 0; i < num_rqst; i++)
+ add_credits(ses->server, &credits[i], optype);
+ goto out;
+@@ -1076,9 +1079,6 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,
+ smb311_update_preauth_hash(ses, rqst[0].rq_iov,
+ rqst[0].rq_nvec);
+
+- if ((flags & CIFS_TIMEOUT_MASK) == CIFS_ASYNC_OP)
+- goto out;
+-
+ for (i = 0; i < num_rqst; i++) {
+ rc = wait_for_response(ses->server, midQ[i]);
+ if (rc != 0)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-047-cifs-fix-strcat-buffer-overflow-and-reduce-raci.patch b/patches.kernel.org/5.1.5-047-cifs-fix-strcat-buffer-overflow-and-reduce-raci.patch
new file mode 100644
index 0000000000..8cc5fead47
--- /dev/null
+++ b/patches.kernel.org/5.1.5-047-cifs-fix-strcat-buffer-overflow-and-reduce-raci.patch
@@ -0,0 +1,68 @@
+From: Christoph Probst <kernel@probst.it>
+Date: Tue, 7 May 2019 17:16:40 +0200
+Subject: [PATCH] cifs: fix strcat buffer overflow and reduce raciness in
+ smb21_set_oplock_level()
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb
+
+commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream.
+
+Change strcat to strncpy in the "None" case to fix a buffer overflow
+when cinode->oplock is reset to 0 by another thread accessing the same
+cinode. It is never valid to append "None" to any other message.
+
+Consolidate multiple writes to cinode->oplock to reduce raciness.
+
+Signed-off-by: Christoph Probst <kernel@probst.it>
+Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+CC: Stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/cifs/smb2ops.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index c36ff0d1fe2a..aa61dcf471b3 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -2917,26 +2917,28 @@ smb21_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ unsigned int epoch, bool *purge_cache)
+ {
+ char message[5] = {0};
++ unsigned int new_oplock = 0;
+
+ oplock &= 0xFF;
+ if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
+ return;
+
+- cinode->oplock = 0;
+ if (oplock & SMB2_LEASE_READ_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_READ_FLG;
++ new_oplock |= CIFS_CACHE_READ_FLG;
+ strcat(message, "R");
+ }
+ if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
++ new_oplock |= CIFS_CACHE_HANDLE_FLG;
+ strcat(message, "H");
+ }
+ if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
+- cinode->oplock |= CIFS_CACHE_WRITE_FLG;
++ new_oplock |= CIFS_CACHE_WRITE_FLG;
+ strcat(message, "W");
+ }
+- if (!cinode->oplock)
+- strcat(message, "None");
++ if (!new_oplock)
++ strncpy(message, "None", sizeof(message));
++
++ cinode->oplock = new_oplock;
+ cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
+ &cinode->vfs_inode);
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-048-phy-ti-pipe3-fix-missing-bit-wise-or-operator-w.patch b/patches.kernel.org/5.1.5-048-phy-ti-pipe3-fix-missing-bit-wise-or-operator-w.patch
new file mode 100644
index 0000000000..f57d134661
--- /dev/null
+++ b/patches.kernel.org/5.1.5-048-phy-ti-pipe3-fix-missing-bit-wise-or-operator-w.patch
@@ -0,0 +1,39 @@
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 19 Feb 2019 14:53:49 +0000
+Subject: [PATCH] phy: ti-pipe3: fix missing bit-wise or operator when
+ assigning val
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6
+
+commit e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 upstream.
+
+There seems to be a missing bit-wise or operator when setting val,
+fix this by adding it in.
+
+Fixes: 2796ceb0c18a ("phy: ti-pipe3: Update pcie phy settings")
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/phy/ti/phy-ti-pipe3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/phy/ti/phy-ti-pipe3.c b/drivers/phy/ti/phy-ti-pipe3.c
+index 68ce4a082b9b..693acc167351 100644
+--- a/drivers/phy/ti/phy-ti-pipe3.c
++++ b/drivers/phy/ti/phy-ti-pipe3.c
+@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti_pipe3 *phy)
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY);
+ val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV);
+- val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
++ val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT);
+ ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val);
+
+ val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-049-media-ov6650-Fix-sensor-possibly-not-detected-o.patch b/patches.kernel.org/5.1.5-049-media-ov6650-Fix-sensor-possibly-not-detected-o.patch
new file mode 100644
index 0000000000..b8eae07a15
--- /dev/null
+++ b/patches.kernel.org/5.1.5-049-media-ov6650-Fix-sensor-possibly-not-detected-o.patch
@@ -0,0 +1,52 @@
+From: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Date: Sun, 24 Mar 2019 20:21:12 -0400
+Subject: [PATCH] media: ov6650: Fix sensor possibly not detected on probe
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0
+
+commit 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 upstream.
+
+After removal of clock_start() from before soc_camera_init_i2c() in
+soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch
+I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650
+driver could no longer probe the sensor successfully because its clock
+was no longer turned on in advance. The issue was initially worked
+around by adding that missing clock_start() equivalent to OMAP1 camera
+interface driver - the only user of this sensor - but a propoer fix
+should be rather implemented in the sensor driver code itself.
+
+Fix the issue by inserting a delay between the clock is turned on and
+the sensor I2C registers are read for the first time.
+
+Tested on Amstrad Delta with now out of tree but still locally
+maintained omap1_camera host driver.
+
+Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk")
+
+Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/media/i2c/ov6650.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/media/i2c/ov6650.c b/drivers/media/i2c/ov6650.c
+index c33fd584cb44..f9359b11fa5c 100644
+--- a/drivers/media/i2c/ov6650.c
++++ b/drivers/media/i2c/ov6650.c
+@@ -814,6 +814,8 @@ static int ov6650_video_probe(struct i2c_client *client)
+ if (ret < 0)
+ return ret;
+
++ msleep(20);
++
+ /*
+ * check and show product ID and manufacturer ID
+ */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-050-media-seco-cec-fix-building-with-RC_CORE-m.patch b/patches.kernel.org/5.1.5-050-media-seco-cec-fix-building-with-RC_CORE-m.patch
new file mode 100644
index 0000000000..456cc2e99c
--- /dev/null
+++ b/patches.kernel.org/5.1.5-050-media-seco-cec-fix-building-with-RC_CORE-m.patch
@@ -0,0 +1,50 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 13 Mar 2019 17:18:07 -0400
+Subject: [PATCH] media: seco-cec: fix building with RC_CORE=m
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 63604a143fe168094fbbccba56f6e3241683e399
+
+commit 63604a143fe168094fbbccba56f6e3241683e399 upstream.
+
+I previously added an RC_CORE dependency here, but missed the corner
+case of CONFIG_VIDEO_SECO_CEC=y with CONFIG_RC_CORE=m, which still
+causes a link error:
+
+drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_probe':
+seco-cec.c:(.text+0x1b8): undefined reference to `devm_rc_allocate_device'
+seco-cec.c:(.text+0x2e8): undefined reference to `devm_rc_register_device'
+drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_irq_handler':
+seco-cec.c:(.text+0xa2c): undefined reference to `rc_keydown'
+
+Refine the dependency to disallow building the RC subdriver in this case.
+This is the same logic we apply in other drivers like it.
+
+Fixes: f27dd0ad6885 ("media: seco-cec: fix RC_CORE dependency")
+
+Cc: <stable@vger.kernel.org> # 5.1
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sean Young <sean@mess.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/media/platform/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
+index 4acbed189644..67e48ff10532 100644
+--- a/drivers/media/platform/Kconfig
++++ b/drivers/media/platform/Kconfig
+@@ -649,7 +649,7 @@ config VIDEO_SECO_CEC
+ config VIDEO_SECO_RC
+ bool "SECO Boards IR RC5 support"
+ depends on VIDEO_SECO_CEC
+- depends on RC_CORE
++ depends on RC_CORE=y || RC_CORE = VIDEO_SECO_CEC
+ help
+ If you say yes here you will get support for the
+ SECO Boards Consumer-IR in seco-cec driver.
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-051-media-imx-csi-Allow-unknown-nearest-upstream-en.patch b/patches.kernel.org/5.1.5-051-media-imx-csi-Allow-unknown-nearest-upstream-en.patch
new file mode 100644
index 0000000000..45df27618c
--- /dev/null
+++ b/patches.kernel.org/5.1.5-051-media-imx-csi-Allow-unknown-nearest-upstream-en.patch
@@ -0,0 +1,75 @@
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:29 -0500
+Subject: [PATCH] media: imx: csi: Allow unknown nearest upstream entities
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 904371f90b2c0c749a5ab75478c129a4682ac3d8
+
+commit 904371f90b2c0c749a5ab75478c129a4682ac3d8 upstream.
+
+On i.MX6, the nearest upstream entity to the CSI can only be the
+CSI video muxes or the Synopsys DW MIPI CSI-2 receiver.
+
+However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver.
+So allow for the nearest upstream entity to the CSI to be something
+other than those.
+
+Fixes: bf3cfaa712e5c ("media: staging/imx: get CSI bus type from nearest
+upstream entity")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/staging/media/imx/imx-media-csi.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c
+index 3b7517348666..41965d8b56c4 100644
+--- a/drivers/staging/media/imx/imx-media-csi.c
++++ b/drivers/staging/media/imx/imx-media-csi.c
+@@ -154,9 +154,10 @@ static inline bool requires_passthrough(struct v4l2_fwnode_endpoint *ep,
+ /*
+ * Parses the fwnode endpoint from the source pad of the entity
+ * connected to this CSI. This will either be the entity directly
+- * upstream from the CSI-2 receiver, or directly upstream from the
+- * video mux. The endpoint is needed to determine the bus type and
+- * bus config coming into the CSI.
++ * upstream from the CSI-2 receiver, directly upstream from the
++ * video mux, or directly upstream from the CSI itself. The endpoint
++ * is needed to determine the bus type and bus config coming into
++ * the CSI.
+ */
+ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ struct v4l2_fwnode_endpoint *ep)
+@@ -172,7 +173,8 @@ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ if (!priv->src_sd)
+ return -EPIPE;
+
+- src = &priv->src_sd->entity;
++ sd = priv->src_sd;
++ src = &sd->entity;
+
+ if (src->function == MEDIA_ENT_F_VID_MUX) {
+ /*
+@@ -186,6 +188,14 @@ static int csi_get_upstream_endpoint(struct csi_priv *priv,
+ src = &sd->entity;
+ }
+
++ /*
++ * If the source is neither the video mux nor the CSI-2 receiver,
++ * get the source pad directly upstream from CSI itself.
++ */
++ if (src->function != MEDIA_ENT_F_VID_MUX &&
++ sd->grp_id != IMX_MEDIA_GRP_ID_CSI2)
++ src = &priv->sd.entity;
++
+ /* get source pad of entity directly upstream from src */
+ pad = imx_media_find_upstream_pad(priv->md, src, 0);
+ if (IS_ERR(pad))
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-052-media-imx-Clear-fwnode-link-struct-for-each-end.patch b/patches.kernel.org/5.1.5-052-media-imx-Clear-fwnode-link-struct-for-each-end.patch
new file mode 100644
index 0000000000..37f615ff3f
--- /dev/null
+++ b/patches.kernel.org/5.1.5-052-media-imx-Clear-fwnode-link-struct-for-each-end.patch
@@ -0,0 +1,61 @@
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:30 -0500
+Subject: [PATCH] media: imx: Clear fwnode link struct for each endpoint
+ iteration
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 107927fa597c99eaeee4f51865ca0956ec71b6a2
+
+commit 107927fa597c99eaeee4f51865ca0956ec71b6a2 upstream.
+
+In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must
+be cleared for each endpoint iteration, otherwise if the remote port
+has no "reg" property, link.remote_port will not be reset to zero.
+This was discovered on the i.MX53 SMD board, since the OV5642 connects
+directly to ipu1_csi0 and has a single source port with no "reg"
+property.
+
+Fixes: 621b08eabcddb ("media: staging/imx: remove static media link arrays")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/staging/media/imx/imx-media-of.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c
+index 03446335ac03..a26bdeb1af34 100644
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -145,15 +145,18 @@ int imx_media_create_csi_of_links(struct imx_media_dev *imxmd,
+ struct v4l2_subdev *csi)
+ {
+ struct device_node *csi_np = csi->dev->of_node;
+- struct fwnode_handle *fwnode, *csi_ep;
+- struct v4l2_fwnode_link link;
+ struct device_node *ep;
+- int ret;
+-
+- link.local_node = of_fwnode_handle(csi_np);
+- link.local_port = CSI_SINK_PAD;
+
+ for_each_child_of_node(csi_np, ep) {
++ struct fwnode_handle *fwnode, *csi_ep;
++ struct v4l2_fwnode_link link;
++ int ret;
++
++ memset(&link, 0, sizeof(link));
++
++ link.local_node = of_fwnode_handle(csi_np);
++ link.local_port = CSI_SINK_PAD;
++
+ csi_ep = of_fwnode_handle(ep);
+
+ fwnode = fwnode_graph_get_remote_endpoint(csi_ep);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-053-media-imx-Rename-functions-that-add-IPU-interna.patch b/patches.kernel.org/5.1.5-053-media-imx-Rename-functions-that-add-IPU-interna.patch
new file mode 100644
index 0000000000..9c0c35d2aa
--- /dev/null
+++ b/patches.kernel.org/5.1.5-053-media-imx-Rename-functions-that-add-IPU-interna.patch
@@ -0,0 +1,173 @@
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:31 -0500
+Subject: [PATCH] media: imx: Rename functions that add IPU-internal subdevs
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 085b26da62211cb77622008082adff56aefa771d
+
+commit 085b26da62211cb77622008082adff56aefa771d upstream.
+
+For the functions that add and remove the internal IPU subdevice
+descriptors, rename them to make clear they are the subdevs internal
+to the IPU. Also rename the platform data structure for the internal
+IPU subdevices. No functional changes.
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Acked-by: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/staging/media/imx/imx-ic-common.c | 2 +-
+ drivers/staging/media/imx/imx-media-dev.c | 8 ++++----
+ drivers/staging/media/imx/imx-media-internal-sd.c | 12 ++++++------
+ drivers/staging/media/imx/imx-media-vdic.c | 2 +-
+ drivers/staging/media/imx/imx-media.h | 6 +++---
+ 5 files changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-ic-common.c b/drivers/staging/media/imx/imx-ic-common.c
+index 765919487a73..90a926891eb9 100644
+--- a/drivers/staging/media/imx/imx-ic-common.c
++++ b/drivers/staging/media/imx/imx-ic-common.c
+@@ -26,7 +26,7 @@ static struct imx_ic_ops *ic_ops[IC_NUM_OPS] = {
+
+ static int imx_ic_probe(struct platform_device *pdev)
+ {
+- struct imx_media_internal_sd_platformdata *pdata;
++ struct imx_media_ipu_internal_sd_pdata *pdata;
+ struct imx_ic_priv *priv;
+ int ret;
+
+diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
+index 28a3d23aad5b..fc35508d9396 100644
+--- a/drivers/staging/media/imx/imx-media-dev.c
++++ b/drivers/staging/media/imx/imx-media-dev.c
+@@ -477,10 +477,10 @@ static int imx_media_probe(struct platform_device *pdev)
+ goto cleanup;
+ }
+
+- ret = imx_media_add_internal_subdevs(imxmd);
++ ret = imx_media_add_ipu_internal_subdevs(imxmd);
+ if (ret) {
+ v4l2_err(&imxmd->v4l2_dev,
+- "add_internal_subdevs failed with %d\n", ret);
++ "add_ipu_internal_subdevs failed with %d\n", ret);
+ goto cleanup;
+ }
+
+@@ -491,7 +491,7 @@ static int imx_media_probe(struct platform_device *pdev)
+ return 0;
+
+ del_int:
+- imx_media_remove_internal_subdevs(imxmd);
++ imx_media_remove_ipu_internal_subdevs(imxmd);
+ cleanup:
+ v4l2_async_notifier_cleanup(&imxmd->notifier);
+ v4l2_device_unregister(&imxmd->v4l2_dev);
+@@ -508,7 +508,7 @@ static int imx_media_remove(struct platform_device *pdev)
+ v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n");
+
+ v4l2_async_notifier_unregister(&imxmd->notifier);
+- imx_media_remove_internal_subdevs(imxmd);
++ imx_media_remove_ipu_internal_subdevs(imxmd);
+ v4l2_async_notifier_cleanup(&imxmd->notifier);
+ media_device_unregister(&imxmd->md);
+ v4l2_device_unregister(&imxmd->v4l2_dev);
+diff --git a/drivers/staging/media/imx/imx-media-internal-sd.c b/drivers/staging/media/imx/imx-media-internal-sd.c
+index 5e10d95e5529..e620f4adb755 100644
+--- a/drivers/staging/media/imx/imx-media-internal-sd.c
++++ b/drivers/staging/media/imx/imx-media-internal-sd.c
+@@ -1,7 +1,7 @@
+ /*
+ * Media driver for Freescale i.MX5/6 SOC
+ *
+- * Adds the internal subdevices and the media links between them.
++ * Adds the IPU internal subdevices and the media links between them.
+ *
+ * Copyright (c) 2016 Mentor Graphics Inc.
+ *
+@@ -192,7 +192,7 @@ static struct v4l2_subdev *find_sink(struct imx_media_dev *imxmd,
+
+ /*
+ * retrieve IPU id from subdev name, note: can't get this from
+- * struct imx_media_internal_sd_platformdata because if src is
++ * struct imx_media_ipu_internal_sd_pdata because if src is
+ * a CSI, it has different struct ipu_client_platformdata which
+ * does not contain IPU id.
+ */
+@@ -270,7 +270,7 @@ static int add_internal_subdev(struct imx_media_dev *imxmd,
+ const struct internal_subdev *isd,
+ int ipu_id)
+ {
+- struct imx_media_internal_sd_platformdata pdata;
++ struct imx_media_ipu_internal_sd_pdata pdata;
+ struct platform_device_info pdevinfo = {};
+ struct platform_device *pdev;
+
+@@ -328,7 +328,7 @@ static int add_ipu_internal_subdevs(struct imx_media_dev *imxmd, int ipu_id)
+ return 0;
+ }
+
+-int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd)
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd)
+ {
+ int ret;
+
+@@ -343,11 +343,11 @@ int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd)
+ return 0;
+
+ remove:
+- imx_media_remove_internal_subdevs(imxmd);
++ imx_media_remove_ipu_internal_subdevs(imxmd);
+ return ret;
+ }
+
+-void imx_media_remove_internal_subdevs(struct imx_media_dev *imxmd)
++void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd)
+ {
+ struct imx_media_async_subdev *imxasd;
+ struct v4l2_async_subdev *asd;
+diff --git a/drivers/staging/media/imx/imx-media-vdic.c b/drivers/staging/media/imx/imx-media-vdic.c
+index 2808662e2597..8a9af4688fd4 100644
+--- a/drivers/staging/media/imx/imx-media-vdic.c
++++ b/drivers/staging/media/imx/imx-media-vdic.c
+@@ -934,7 +934,7 @@ static const struct v4l2_subdev_internal_ops vdic_internal_ops = {
+
+ static int imx_vdic_probe(struct platform_device *pdev)
+ {
+- struct imx_media_internal_sd_platformdata *pdata;
++ struct imx_media_ipu_internal_sd_pdata *pdata;
+ struct vdic_priv *priv;
+ int ret;
+
+diff --git a/drivers/staging/media/imx/imx-media.h b/drivers/staging/media/imx/imx-media.h
+index ae964c8d5be1..ccbfc4438c85 100644
+--- a/drivers/staging/media/imx/imx-media.h
++++ b/drivers/staging/media/imx/imx-media.h
+@@ -115,7 +115,7 @@ struct imx_media_pad_vdev {
+ struct list_head list;
+ };
+
+-struct imx_media_internal_sd_platformdata {
++struct imx_media_ipu_internal_sd_pdata {
+ char sd_name[V4L2_SUBDEV_NAME_SIZE];
+ u32 grp_id;
+ int ipu_id;
+@@ -252,10 +252,10 @@ struct imx_media_fim *imx_media_fim_init(struct v4l2_subdev *sd);
+ void imx_media_fim_free(struct imx_media_fim *fim);
+
+ /* imx-media-internal-sd.c */
+-int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd);
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd);
+ int imx_media_create_ipu_internal_links(struct imx_media_dev *imxmd,
+ struct v4l2_subdev *sd);
+-void imx_media_remove_internal_subdevs(struct imx_media_dev *imxmd);
++void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd);
+
+ /* imx-media-of.c */
+ int imx_media_add_of_subdevs(struct imx_media_dev *dev,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-054-media-imx-Don-t-register-IPU-subdevs-links-if-C.patch b/patches.kernel.org/5.1.5-054-media-imx-Don-t-register-IPU-subdevs-links-if-C.patch
new file mode 100644
index 0000000000..88c5115c04
--- /dev/null
+++ b/patches.kernel.org/5.1.5-054-media-imx-Don-t-register-IPU-subdevs-links-if-C.patch
@@ -0,0 +1,220 @@
+From: Steve Longerbeam <slongerbeam@gmail.com>
+Date: Wed, 20 Feb 2019 18:53:32 -0500
+Subject: [PATCH] media: imx: Don't register IPU subdevs/links if CSI port
+ missing
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: dee747f88167124884a918855c1f438e2f7f39e2
+
+commit dee747f88167124884a918855c1f438e2f7f39e2 upstream.
+
+The second IPU internal sub-devices were being registered and links
+to them created even when the second IPU is not present. This is wrong
+for i.MX6 S/DL and i.MX53 which have only a single IPU.
+
+Fixes: e130291212df5 ("[media] media: Add i.MX media core driver")
+
+Signed-off-by: Steve Longerbeam <slongerbeam@gmail.com>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/staging/media/imx/imx-media-dev.c | 7 ---
+ .../staging/media/imx/imx-media-internal-sd.c | 22 ++-----
+ drivers/staging/media/imx/imx-media-of.c | 58 +++++++++++++------
+ drivers/staging/media/imx/imx-media.h | 3 +-
+ drivers/staging/media/imx/imx7-media-csi.c | 2 +-
+ 5 files changed, 46 insertions(+), 46 deletions(-)
+
+diff --git a/drivers/staging/media/imx/imx-media-dev.c b/drivers/staging/media/imx/imx-media-dev.c
+index fc35508d9396..10a63a4fa90b 100644
+--- a/drivers/staging/media/imx/imx-media-dev.c
++++ b/drivers/staging/media/imx/imx-media-dev.c
+@@ -477,13 +477,6 @@ static int imx_media_probe(struct platform_device *pdev)
+ goto cleanup;
+ }
+
+- ret = imx_media_add_ipu_internal_subdevs(imxmd);
+- if (ret) {
+- v4l2_err(&imxmd->v4l2_dev,
+- "add_ipu_internal_subdevs failed with %d\n", ret);
+- goto cleanup;
+- }
+-
+ ret = imx_media_dev_notifier_register(imxmd);
+ if (ret)
+ goto del_int;
+diff --git a/drivers/staging/media/imx/imx-media-internal-sd.c b/drivers/staging/media/imx/imx-media-internal-sd.c
+index e620f4adb755..dc510dcfe160 100644
+--- a/drivers/staging/media/imx/imx-media-internal-sd.c
++++ b/drivers/staging/media/imx/imx-media-internal-sd.c
+@@ -298,13 +298,14 @@ static int add_internal_subdev(struct imx_media_dev *imxmd,
+ }
+
+ /* adds the internal subdevs in one ipu */
+-static int add_ipu_internal_subdevs(struct imx_media_dev *imxmd, int ipu_id)
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd,
++ int ipu_id)
+ {
+ enum isd_enum i;
++ int ret;
+
+ for (i = 0; i < num_isd; i++) {
+ const struct internal_subdev *isd = &int_subdev[i];
+- int ret;
+
+ /*
+ * the CSIs are represented in the device-tree, so those
+@@ -322,25 +323,10 @@ static int add_ipu_internal_subdevs(struct imx_media_dev *imxmd, int ipu_id)
+ }
+
+ if (ret)
+- return ret;
++ goto remove;
+ }
+
+ return 0;
+-}
+-
+-int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd)
+-{
+- int ret;
+-
+- ret = add_ipu_internal_subdevs(imxmd, 0);
+- if (ret)
+- goto remove;
+-
+- ret = add_ipu_internal_subdevs(imxmd, 1);
+- if (ret)
+- goto remove;
+-
+- return 0;
+
+ remove:
+ imx_media_remove_ipu_internal_subdevs(imxmd);
+diff --git a/drivers/staging/media/imx/imx-media-of.c b/drivers/staging/media/imx/imx-media-of.c
+index a26bdeb1af34..12383f4785ad 100644
+--- a/drivers/staging/media/imx/imx-media-of.c
++++ b/drivers/staging/media/imx/imx-media-of.c
+@@ -23,36 +23,25 @@
+ int imx_media_of_add_csi(struct imx_media_dev *imxmd,
+ struct device_node *csi_np)
+ {
+- int ret;
+-
+ if (!of_device_is_available(csi_np)) {
+ dev_dbg(imxmd->md.dev, "%s: %pOFn not enabled\n", __func__,
+ csi_np);
+- /* unavailable is not an error */
+- return 0;
++ return -ENODEV;
+ }
+
+ /* add CSI fwnode to async notifier */
+- ret = imx_media_add_async_subdev(imxmd, of_fwnode_handle(csi_np), NULL);
+- if (ret) {
+- if (ret == -EEXIST) {
+- /* already added, everything is fine */
+- return 0;
+- }
+-
+- /* other error, can't continue */
+- return ret;
+- }
+-
+- return 0;
++ return imx_media_add_async_subdev(imxmd, of_fwnode_handle(csi_np),
++ NULL);
+ }
+ EXPORT_SYMBOL_GPL(imx_media_of_add_csi);
+
+ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd,
+ struct device_node *np)
+ {
++ bool ipu_found[2] = {false, false};
+ struct device_node *csi_np;
+ int i, ret;
++ u32 ipu_id;
+
+ for (i = 0; ; i++) {
+ csi_np = of_parse_phandle(np, "ports", i);
+@@ -60,12 +49,43 @@ int imx_media_add_of_subdevs(struct imx_media_dev *imxmd,
+ break;
+
+ ret = imx_media_of_add_csi(imxmd, csi_np);
+- of_node_put(csi_np);
+- if (ret)
+- return ret;
++ if (ret) {
++ /* unavailable or already added is not an error */
++ if (ret == -ENODEV || ret == -EEXIST) {
++ of_node_put(csi_np);
++ continue;
++ }
++
++ /* other error, can't continue */
++ goto err_out;
++ }
++
++ ret = of_alias_get_id(csi_np->parent, "ipu");
++ if (ret < 0)
++ goto err_out;
++ if (ret > 1) {
++ ret = -EINVAL;
++ goto err_out;
++ }
++
++ ipu_id = ret;
++
++ if (!ipu_found[ipu_id]) {
++ ret = imx_media_add_ipu_internal_subdevs(imxmd,
++ ipu_id);
++ if (ret)
++ goto err_out;
++ }
++
++ ipu_found[ipu_id] = true;
+ }
+
+ return 0;
++
++err_out:
++ imx_media_remove_ipu_internal_subdevs(imxmd);
++ of_node_put(csi_np);
++ return ret;
+ }
+
+ /*
+diff --git a/drivers/staging/media/imx/imx-media.h b/drivers/staging/media/imx/imx-media.h
+index ccbfc4438c85..dd603a6b3a70 100644
+--- a/drivers/staging/media/imx/imx-media.h
++++ b/drivers/staging/media/imx/imx-media.h
+@@ -252,7 +252,8 @@ struct imx_media_fim *imx_media_fim_init(struct v4l2_subdev *sd);
+ void imx_media_fim_free(struct imx_media_fim *fim);
+
+ /* imx-media-internal-sd.c */
+-int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd);
++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd,
++ int ipu_id);
+ int imx_media_create_ipu_internal_links(struct imx_media_dev *imxmd,
+ struct v4l2_subdev *sd);
+ void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd);
+diff --git a/drivers/staging/media/imx/imx7-media-csi.c b/drivers/staging/media/imx/imx7-media-csi.c
+index 3fba7c27c0ec..1ba62fcdcae8 100644
+--- a/drivers/staging/media/imx/imx7-media-csi.c
++++ b/drivers/staging/media/imx/imx7-media-csi.c
+@@ -1271,7 +1271,7 @@ static int imx7_csi_probe(struct platform_device *pdev)
+ platform_set_drvdata(pdev, &csi->sd);
+
+ ret = imx_media_of_add_csi(imxmd, node);
+- if (ret < 0)
++ if (ret < 0 && ret != -ENODEV && ret != -EEXIST)
+ goto cleanup;
+
+ ret = imx_media_dev_notifier_register(imxmd);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-055-RDMA-mlx5-Use-get_zeroed_page-for-clock_info.patch b/patches.kernel.org/5.1.5-055-RDMA-mlx5-Use-get_zeroed_page-for-clock_info.patch
new file mode 100644
index 0000000000..1b5112b78f
--- /dev/null
+++ b/patches.kernel.org/5.1.5-055-RDMA-mlx5-Use-get_zeroed_page-for-clock_info.patch
@@ -0,0 +1,107 @@
+From: Jason Gunthorpe <jgg@mellanox.com>
+Date: Tue, 16 Apr 2019 14:07:29 +0300
+Subject: [PATCH] RDMA/mlx5: Use get_zeroed_page() for clock_info
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ddcdc368b1033e19fd3a5f750752e10e28a87826
+
+commit ddcdc368b1033e19fd3a5f750752e10e28a87826 upstream.
+
+get_zeroed_page() returns a virtual address for the page which is better
+than allocating a struct page and doing a permanent kmap on it.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/infiniband/hw/mlx5/main.c | 5 ++--
+ .../ethernet/mellanox/mlx5/core/lib/clock.c | 30 +++++++------------
+ include/linux/mlx5/driver.h | 1 -
+ 3 files changed, 14 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index d3dd290ae1b1..da81402992bc 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2070,11 +2070,12 @@ static int mlx5_ib_mmap_clock_info_page(struct mlx5_ib_dev *dev,
+ return -EPERM;
+ vma->vm_flags &= ~VM_MAYWRITE;
+
+- if (!dev->mdev->clock_info_page)
++ if (!dev->mdev->clock_info)
+ return -EOPNOTSUPP;
+
+ return rdma_user_mmap_page(&context->ibucontext, vma,
+- dev->mdev->clock_info_page, PAGE_SIZE);
++ virt_to_page(dev->mdev->clock_info),
++ PAGE_SIZE);
+ }
+
+ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+index ca0ee9916e9e..0059b290e095 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
+@@ -535,23 +535,16 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev)
+ do_div(ns, NSEC_PER_SEC / HZ);
+ clock->overflow_period = ns;
+
+- mdev->clock_info_page = alloc_page(GFP_KERNEL);
+- if (mdev->clock_info_page) {
+- mdev->clock_info = kmap(mdev->clock_info_page);
+- if (!mdev->clock_info) {
+- __free_page(mdev->clock_info_page);
+- mlx5_core_warn(mdev, "failed to map clock page\n");
+- } else {
+- mdev->clock_info->sign = 0;
+- mdev->clock_info->nsec = clock->tc.nsec;
+- mdev->clock_info->cycles = clock->tc.cycle_last;
+- mdev->clock_info->mask = clock->cycles.mask;
+- mdev->clock_info->mult = clock->nominal_c_mult;
+- mdev->clock_info->shift = clock->cycles.shift;
+- mdev->clock_info->frac = clock->tc.frac;
+- mdev->clock_info->overflow_period =
+- clock->overflow_period;
+- }
++ mdev->clock_info =
++ (struct mlx5_ib_clock_info *)get_zeroed_page(GFP_KERNEL);
++ if (mdev->clock_info) {
++ mdev->clock_info->nsec = clock->tc.nsec;
++ mdev->clock_info->cycles = clock->tc.cycle_last;
++ mdev->clock_info->mask = clock->cycles.mask;
++ mdev->clock_info->mult = clock->nominal_c_mult;
++ mdev->clock_info->shift = clock->cycles.shift;
++ mdev->clock_info->frac = clock->tc.frac;
++ mdev->clock_info->overflow_period = clock->overflow_period;
+ }
+
+ INIT_WORK(&clock->pps_info.out_work, mlx5_pps_out);
+@@ -599,8 +592,7 @@ void mlx5_cleanup_clock(struct mlx5_core_dev *mdev)
+ cancel_delayed_work_sync(&clock->overflow_work);
+
+ if (mdev->clock_info) {
+- kunmap(mdev->clock_info_page);
+- __free_page(mdev->clock_info_page);
++ free_page((unsigned long)mdev->clock_info);
+ mdev->clock_info = NULL;
+ }
+
+diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
+index 0d0729648844..9ffc53acaec1 100644
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -681,7 +681,6 @@ struct mlx5_core_dev {
+ #endif
+ struct mlx5_clock clock;
+ struct mlx5_ib_clock_info *clock_info;
+- struct page *clock_info_page;
+ struct mlx5_fw_tracer *tracer;
+ };
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-056-RDMA-ipoib-Allow-user-space-differentiate-betwe.patch b/patches.kernel.org/5.1.5-056-RDMA-ipoib-Allow-user-space-differentiate-betwe.patch
new file mode 100644
index 0000000000..6631248760
--- /dev/null
+++ b/patches.kernel.org/5.1.5-056-RDMA-ipoib-Allow-user-space-differentiate-betwe.patch
@@ -0,0 +1,62 @@
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Mon, 6 May 2019 14:23:04 +0300
+Subject: [PATCH] RDMA/ipoib: Allow user space differentiate between valid
+ dev_port
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b79656ed44c6865e17bcd93472ec39488bcc4984
+
+commit b79656ed44c6865e17bcd93472ec39488bcc4984 upstream.
+
+Systemd triggers the following warning during IPoIB device load:
+
+ mlx5_core 0000:00:0c.0 ib0: "systemd-udevd" wants to know my dev_id.
+ Should it look at dev_port instead?
+ See Documentation/ABI/testing/sysfs-class-net for more info.
+
+This is caused due to user space attempt to differentiate old systems
+without dev_port and new systems with dev_port. In case dev_port will be
+zero, the systemd will try to read dev_id instead.
+
+There is no need to print a warning in such case, because it is valid
+situation and it is needed to ensure systemd compatibility with old
+kernels.
+
+Link: https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
+Cc: <stable@vger.kernel.org> # 4.19
+Fixes: f6350da41dc7 ("IB/ipoib: Log sysfs 'dev_id' accesses from userspace")
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 48eda16db1a7..9b5e11d3fb85 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -2402,7 +2402,18 @@ static ssize_t dev_id_show(struct device *dev,
+ {
+ struct net_device *ndev = to_net_dev(dev);
+
+- if (ndev->dev_id == ndev->dev_port)
++ /*
++ * ndev->dev_port will be equal to 0 in old kernel prior to commit
++ * 9b8b2a323008 ("IB/ipoib: Use dev_port to expose network interface
++ * port numbers") Zero was chosen as special case for user space
++ * applications to fallback and query dev_id to check if it has
++ * different value or not.
++ *
++ * Don't print warning in such scenario.
++ *
++ * https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
++ */
++ if (ndev->dev_port && ndev->dev_id == ndev->dev_port)
+ netdev_info_once(ndev,
+ "\"%s\" wants to know my dev_id. Should it look at dev_port instead? See Documentation/ABI/testing/sysfs-class-net for more info.\n",
+ current->comm);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-057-NFS4-Fix-v4.0-client-state-corruption-when-moun.patch b/patches.kernel.org/5.1.5-057-NFS4-Fix-v4.0-client-state-corruption-when-moun.patch
new file mode 100644
index 0000000000..534e54a9b2
--- /dev/null
+++ b/patches.kernel.org/5.1.5-057-NFS4-Fix-v4.0-client-state-corruption-when-moun.patch
@@ -0,0 +1,52 @@
+From: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Date: Mon, 6 May 2019 11:57:03 +0800
+Subject: [PATCH] NFS4: Fix v4.0 client state corruption when mount
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: f02f3755dbd14fb935d24b14650fff9ba92243b8
+
+commit f02f3755dbd14fb935d24b14650fff9ba92243b8 upstream.
+
+stat command with soft mount never return after server is stopped.
+
+When alloc a new client, the state of the client will be set to
+NFS4CLNT_LEASE_EXPIRED.
+
+When the server is stopped, the state manager will work, and accord
+the state to recover. But the state is NFS4CLNT_LEASE_EXPIRED, it
+will drain the slot table and lead other task to wait queue, until
+the client recovered. Then the stat command is hung.
+
+When discover server trunking, the client will renew the lease,
+but check the client state, it lead the client state corruption.
+
+So, we need to call state manager to recover it when detect server
+ip trunking.
+
+Signed-off-by: ZhangXiaoxu <zhangxiaoxu5@huawei.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/nfs/nfs4state.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 3de36479ed7a..f502f1c054cf 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -159,6 +159,10 @@ int nfs40_discover_server_trunking(struct nfs_client *clp,
+ /* Sustain the lease, even if it's empty. If the clientid4
+ * goes stale it's of no use for trunking discovery. */
+ nfs4_schedule_state_renewal(*result);
++
++ /* If the client state need to recover, do it. */
++ if (clp->cl_state)
++ nfs4_schedule_state_manager(clp);
+ }
+ out:
+ return status;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-058-PNFS-fallback-to-MDS-if-no-deviceid-found.patch b/patches.kernel.org/5.1.5-058-PNFS-fallback-to-MDS-if-no-deviceid-found.patch
new file mode 100644
index 0000000000..12d4ea12d0
--- /dev/null
+++ b/patches.kernel.org/5.1.5-058-PNFS-fallback-to-MDS-if-no-deviceid-found.patch
@@ -0,0 +1,39 @@
+From: Olga Kornievskaia <kolga@netapp.com>
+Date: Tue, 7 May 2019 13:41:49 -0400
+Subject: [PATCH] PNFS fallback to MDS if no deviceid found
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b1029c9bc078a6f1515f55dd993b507dcc7e3440
+
+commit b1029c9bc078a6f1515f55dd993b507dcc7e3440 upstream.
+
+If we fail to find a good deviceid while trying to pnfs instead of
+propogating an error back fallback to doing IO to the MDS. Currently,
+code with fals the IO with EINVAL.
+
+Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
+Fixes: 8d40b0f14846f ("NFS filelayout:call GETDEVICEINFO after pnfs_layout_process completes"
+Cc: stable@vger.kernel.org # v4.11+
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/nfs/filelayout/filelayout.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index 61f46facb39c..b3e8ba3bd654 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -904,7 +904,7 @@ fl_pnfs_update_layout(struct inode *ino,
+ status = filelayout_check_deviceid(lo, fl, gfp_flags);
+ if (status) {
+ pnfs_put_lseg(lseg);
+- lseg = ERR_PTR(status);
++ lseg = NULL;
+ }
+ out:
+ return lseg;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-059-clk-hi3660-Mark-clk_gate_ufs_subsys-as-critical.patch b/patches.kernel.org/5.1.5-059-clk-hi3660-Mark-clk_gate_ufs_subsys-as-critical.patch
new file mode 100644
index 0000000000..c5164af8cd
--- /dev/null
+++ b/patches.kernel.org/5.1.5-059-clk-hi3660-Mark-clk_gate_ufs_subsys-as-critical.patch
@@ -0,0 +1,49 @@
+From: Leo Yan <leo.yan@linaro.org>
+Date: Wed, 20 Mar 2019 18:05:08 +0800
+Subject: [PATCH] clk: hi3660: Mark clk_gate_ufs_subsys as critical
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa
+
+commit 9f77a60669d13ed4ddfa6cd7374c9d88da378ffa upstream.
+
+clk_gate_ufs_subsys is a system bus clock, turning off it will
+introduce lockup issue during system suspend flow. Let's mark
+clk_gate_ufs_subsys as critical clock, thus keeps it on during
+system suspend and resume.
+
+Fixes: d374e6fd5088 ("clk: hisilicon: Add clock driver for hi3660 SoC")
+Cc: stable@vger.kernel.org
+Cc: Zhong Kaihua <zhongkaihua@huawei.com>
+Cc: John Stultz <john.stultz@linaro.org>
+Cc: Zhangfei Gao <zhangfei.gao@linaro.org>
+Suggested-by: Dong Zhang <zhangdong46@hisilicon.com>
+Signed-off-by: Leo Yan <leo.yan@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/clk/hisilicon/clk-hi3660.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/clk/hisilicon/clk-hi3660.c b/drivers/clk/hisilicon/clk-hi3660.c
+index f40419959656..794eeff0d5d2 100644
+--- a/drivers/clk/hisilicon/clk-hi3660.c
++++ b/drivers/clk/hisilicon/clk-hi3660.c
+@@ -163,8 +163,12 @@ static const struct hisi_gate_clock hi3660_crgctrl_gate_sep_clks[] = {
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 17, 0, },
+ { HI3660_CLK_GATE_ISP_SNCLK2, "clk_gate_isp_snclk2",
+ "clk_isp_snclk_mux", CLK_SET_RATE_PARENT, 0x50, 18, 0, },
++ /*
++ * clk_gate_ufs_subsys is a system bus clock, mark it as critical
++ * clock and keep it on for system suspend and resume.
++ */
+ { HI3660_CLK_GATE_UFS_SUBSYS, "clk_gate_ufs_subsys", "clk_div_sysbus",
+- CLK_SET_RATE_PARENT, 0x50, 21, 0, },
++ CLK_SET_RATE_PARENT | CLK_IS_CRITICAL, 0x50, 21, 0, },
+ { HI3660_PCLK_GATE_DSI0, "pclk_gate_dsi0", "clk_div_cfgbus",
+ CLK_SET_RATE_PARENT, 0x50, 28, 0, },
+ { HI3660_PCLK_GATE_DSI1, "pclk_gate_dsi1", "clk_div_cfgbus",
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-060-clk-tegra-Fix-PLLM-programming-on-Tegra124-when.patch b/patches.kernel.org/5.1.5-060-clk-tegra-Fix-PLLM-programming-on-Tegra124-when.patch
new file mode 100644
index 0000000000..c29a7f6edf
--- /dev/null
+++ b/patches.kernel.org/5.1.5-060-clk-tegra-Fix-PLLM-programming-on-Tegra124-when.patch
@@ -0,0 +1,45 @@
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 00:48:34 +0300
+Subject: [PATCH] clk: tegra: Fix PLLM programming on Tegra124+ when PMC
+ overrides divider
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 40db569d6769ffa3864fd1b89616b1a7323568a8
+
+commit 40db569d6769ffa3864fd1b89616b1a7323568a8 upstream.
+
+There are wrongly set parenthesis in the code that are resulting in a
+wrong configuration being programmed for PLLM. The original fix was made
+by Danny Huang in the downstream kernel. The patch was tested on Nyan Big
+Tegra124 chromebook, PLLM rate changing works correctly now and system
+doesn't lock up after changing the PLLM rate due to EMC scaling.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-By: Peter De Schrijver <pdeschrijver@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/clk/tegra/clk-pll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
+index b50b7460014b..3e67cbcd80da 100644
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -663,8 +663,8 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll,
+ pll_override_writel(val, params->pmc_divp_reg, pll);
+
+ val = pll_override_readl(params->pmc_divnm_reg, pll);
+- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
+- ~(divn_mask(pll) << div_nmp->override_divn_shift);
++ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
++ (divn_mask(pll) << div_nmp->override_divn_shift));
+ val |= (cfg->m << div_nmp->override_divm_shift) |
+ (cfg->n << div_nmp->override_divn_shift);
+ pll_override_writel(val, params->pmc_divnm_reg, pll);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-061-clk-mediatek-Disable-tuner_en-before-change-PLL.patch b/patches.kernel.org/5.1.5-061-clk-mediatek-Disable-tuner_en-before-change-PLL.patch
new file mode 100644
index 0000000000..a8efa60d4e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-061-clk-mediatek-Disable-tuner_en-before-change-PLL.patch
@@ -0,0 +1,118 @@
+From: Owen Chen <owen.chen@mediatek.com>
+Date: Tue, 5 Mar 2019 13:05:38 +0800
+Subject: [PATCH] clk: mediatek: Disable tuner_en before change PLL rate
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb
+
+commit be17ca6ac76a5cfd07cc3a0397dd05d6929fcbbb upstream.
+
+PLLs with tuner_en bit, such as APLL1, need to disable
+tuner_en before apply new frequency settings, or the new frequency
+settings (pcw) will not be applied.
+The tuner_en bit will be disabled during changing PLL rate
+and be restored after new settings applied.
+
+Fixes: e2f744a82d725 (clk: mediatek: Add MT2712 clock support)
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Owen Chen <owen.chen@mediatek.com>
+Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com>
+Reviewed-by: James Liao <jamesjj.liao@mediatek.com>
+Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/clk/mediatek/clk-pll.c | 48 ++++++++++++++++++++++++----------
+ 1 file changed, 34 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/clk/mediatek/clk-pll.c b/drivers/clk/mediatek/clk-pll.c
+index f54e4015b0b1..18842d660317 100644
+--- a/drivers/clk/mediatek/clk-pll.c
++++ b/drivers/clk/mediatek/clk-pll.c
+@@ -88,6 +88,32 @@ static unsigned long __mtk_pll_recalc_rate(struct mtk_clk_pll *pll, u32 fin,
+ return ((unsigned long)vco + postdiv - 1) / postdiv;
+ }
+
++static void __mtk_pll_tuner_enable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
++static void __mtk_pll_tuner_disable(struct mtk_clk_pll *pll)
++{
++ u32 r;
++
++ if (pll->tuner_en_addr) {
++ r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
++ writel(r, pll->tuner_en_addr);
++ } else if (pll->tuner_addr) {
++ r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
++ writel(r, pll->tuner_addr);
++ }
++}
++
+ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+ int postdiv)
+ {
+@@ -96,6 +122,9 @@ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+
+ pll_en = readl(pll->base_addr + REG_CON0) & CON0_BASE_EN;
+
++ /* disable tuner */
++ __mtk_pll_tuner_disable(pll);
++
+ /* set postdiv */
+ val = readl(pll->pd_addr);
+ val &= ~(POSTDIV_MASK << pll->data->pd_shift);
+@@ -122,6 +151,9 @@ static void mtk_pll_set_rate_regs(struct mtk_clk_pll *pll, u32 pcw,
+ if (pll->tuner_addr)
+ writel(con1 + 1, pll->tuner_addr);
+
++ /* restore tuner_en */
++ __mtk_pll_tuner_enable(pll);
++
+ if (pll_en)
+ udelay(20);
+ }
+@@ -228,13 +260,7 @@ static int mtk_pll_prepare(struct clk_hw *hw)
+ r |= pll->data->en_mask;
+ writel(r, pll->base_addr + REG_CON0);
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) | BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) | AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_enable(pll);
+
+ udelay(20);
+
+@@ -258,13 +284,7 @@ static void mtk_pll_unprepare(struct clk_hw *hw)
+ writel(r, pll->base_addr + REG_CON0);
+ }
+
+- if (pll->tuner_en_addr) {
+- r = readl(pll->tuner_en_addr) & ~BIT(pll->data->tuner_en_bit);
+- writel(r, pll->tuner_en_addr);
+- } else if (pll->tuner_addr) {
+- r = readl(pll->tuner_addr) & ~AUDPLL_TUNER_EN;
+- writel(r, pll->tuner_addr);
+- }
++ __mtk_pll_tuner_disable(pll);
+
+ r = readl(pll->base_addr + REG_CON0);
+ r &= ~CON0_BASE_EN;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-062-clk-rockchip-fix-wrong-clock-definitions-for-rk.patch b/patches.kernel.org/5.1.5-062-clk-rockchip-fix-wrong-clock-definitions-for-rk.patch
new file mode 100644
index 0000000000..a79e951c1b
--- /dev/null
+++ b/patches.kernel.org/5.1.5-062-clk-rockchip-fix-wrong-clock-definitions-for-rk.patch
@@ -0,0 +1,98 @@
+From: Jonas Karlman <jonas@kwiboo.se>
+Date: Sun, 10 Mar 2019 12:00:45 +0000
+Subject: [PATCH] clk: rockchip: fix wrong clock definitions for rk3328
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: fb903392131a324a243c7731389277db1cd9f8df
+
+commit fb903392131a324a243c7731389277db1cd9f8df upstream.
+
+This patch fixes definition of several clock gate and select register
+that is wrong for rk3328 referring to the TRM and vendor kernel.
+Also use correct number of softrst registers.
+
+Fix clock definition for:
+- clk_crypto
+- aclk_h265
+- pclk_h265
+- aclk_h264
+- hclk_h264
+- aclk_axisram
+- aclk_gmac
+- aclk_usb3otg
+
+Fixes: fe3511ad8a1c ("clk: rockchip: add clock controller for rk3328")
+Cc: stable@vger.kernel.org
+Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
+Tested-by: Peter Geis <pgwipeout@gmail.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/clk/rockchip/clk-rk3328.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c
+index 65ab5c2f48b0..f12142d9cea2 100644
+--- a/drivers/clk/rockchip/clk-rk3328.c
++++ b/drivers/clk/rockchip/clk-rk3328.c
+@@ -458,7 +458,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ RK3328_CLKSEL_CON(35), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ RK3328_CLKGATE_CON(2), 12, GFLAGS),
+ COMPOSITE(SCLK_CRYPTO, "clk_crypto", mux_2plls_p, 0,
+- RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 7, DFLAGS,
++ RK3328_CLKSEL_CON(20), 7, 1, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(2), 4, GFLAGS),
+ COMPOSITE_NOMUX(SCLK_TSADC, "clk_tsadc", "clk_24m", 0,
+ RK3328_CLKSEL_CON(22), 0, 10, DFLAGS,
+@@ -550,15 +550,15 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+ GATE(0, "hclk_rkvenc_niu", "hclk_rkvenc", 0,
+ RK3328_CLKGATE_CON(25), 1, GFLAGS),
+ GATE(ACLK_H265, "aclk_h265", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 2, GFLAGS),
+ GATE(PCLK_H265, "pclk_h265", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 3, GFLAGS),
+ GATE(ACLK_H264, "aclk_h264", "aclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 4, GFLAGS),
+ GATE(HCLK_H264, "hclk_h264", "hclk_rkvenc", 0,
+- RK3328_CLKGATE_CON(25), 1, GFLAGS),
++ RK3328_CLKGATE_CON(25), 5, GFLAGS),
+ GATE(ACLK_AXISRAM, "aclk_axisram", "aclk_rkvenc", CLK_IGNORE_UNUSED,
+- RK3328_CLKGATE_CON(25), 0, GFLAGS),
++ RK3328_CLKGATE_CON(25), 6, GFLAGS),
+
+ COMPOSITE(SCLK_VENC_CORE, "sclk_venc_core", mux_4plls_p, 0,
+ RK3328_CLKSEL_CON(51), 14, 2, MFLAGS, 8, 5, DFLAGS,
+@@ -663,7 +663,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+
+ /* PD_GMAC */
+ COMPOSITE(ACLK_GMAC, "aclk_gmac", mux_2plls_hdmiphy_p, 0,
+- RK3328_CLKSEL_CON(35), 6, 2, MFLAGS, 0, 5, DFLAGS,
++ RK3328_CLKSEL_CON(25), 6, 2, MFLAGS, 0, 5, DFLAGS,
+ RK3328_CLKGATE_CON(3), 2, GFLAGS),
+ COMPOSITE_NOMUX(PCLK_GMAC, "pclk_gmac", "aclk_gmac", 0,
+ RK3328_CLKSEL_CON(25), 8, 3, DFLAGS,
+@@ -733,7 +733,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = {
+
+ /* PD_PERI */
+ GATE(0, "aclk_peri_noc", "aclk_peri", CLK_IGNORE_UNUSED, RK3328_CLKGATE_CON(19), 11, GFLAGS),
+- GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 4, GFLAGS),
++ GATE(ACLK_USB3OTG, "aclk_usb3otg", "aclk_peri", 0, RK3328_CLKGATE_CON(19), 14, GFLAGS),
+
+ GATE(HCLK_SDMMC, "hclk_sdmmc", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 0, GFLAGS),
+ GATE(HCLK_SDIO, "hclk_sdio", "hclk_peri", 0, RK3328_CLKGATE_CON(19), 1, GFLAGS),
+@@ -913,7 +913,7 @@ static void __init rk3328_clk_init(struct device_node *np)
+ &rk3328_cpuclk_data, rk3328_cpuclk_rates,
+ ARRAY_SIZE(rk3328_cpuclk_rates));
+
+- rockchip_register_softrst(np, 11, reg_base + RK3328_SOFTRST_CON(0),
++ rockchip_register_softrst(np, 12, reg_base + RK3328_SOFTRST_CON(0),
+ ROCKCHIP_SOFTRST_HIWORD_MASK);
+
+ rockchip_register_restart_notifier(ctx, RK3328_GLB_SRST_FST, NULL);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-063-udlfb-delete-the-unused-parameter-for-dlfb_hand.patch b/patches.kernel.org/5.1.5-063-udlfb-delete-the-unused-parameter-for-dlfb_hand.patch
new file mode 100644
index 0000000000..12e1174b7e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-063-udlfb-delete-the-unused-parameter-for-dlfb_hand.patch
@@ -0,0 +1,107 @@
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: [PATCH] udlfb: delete the unused parameter for dlfb_handle_damage
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63
+
+commit bd86b6c5c60711dbd4fa21bdb497a188ecb6cf63 upstream.
+
+Remove the unused parameter "data" and unused variable "ret".
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/udlfb.c | 21 +++++++++------------
+ 1 file changed, 9 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index 1d034dddc556..cf4e9928001c 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -594,10 +594,9 @@ static int dlfb_render_hline(struct dlfb_data *dlfb, struct urb **urb_ptr,
+ return 0;
+ }
+
+-static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+- int width, int height, char *data)
++static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+- int i, ret;
++ int i;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+ int bytes_sent = 0;
+@@ -641,7 +640,7 @@ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y,
+ *cmd++ = 0xAF;
+ /* Send partial buffer remaining before exiting */
+ len = cmd - (char *) urb->transfer_buffer;
+- ret = dlfb_submit_urb(dlfb, urb, len);
++ dlfb_submit_urb(dlfb, urb, len);
+ bytes_sent += len;
+ } else
+ dlfb_urb_completion(urb);
+@@ -679,7 +678,7 @@ static ssize_t dlfb_ops_write(struct fb_info *info, const char __user *buf,
+ (u32)info->var.yres);
+
+ dlfb_handle_damage(dlfb, 0, start, info->var.xres,
+- lines, info->screen_base);
++ lines);
+ }
+
+ return result;
+@@ -695,7 +694,7 @@ static void dlfb_ops_copyarea(struct fb_info *info,
+ sys_copyarea(info, area);
+
+ dlfb_handle_damage(dlfb, area->dx, area->dy,
+- area->width, area->height, info->screen_base);
++ area->width, area->height);
+ }
+
+ static void dlfb_ops_imageblit(struct fb_info *info,
+@@ -706,7 +705,7 @@ static void dlfb_ops_imageblit(struct fb_info *info,
+ sys_imageblit(info, image);
+
+ dlfb_handle_damage(dlfb, image->dx, image->dy,
+- image->width, image->height, info->screen_base);
++ image->width, image->height);
+ }
+
+ static void dlfb_ops_fillrect(struct fb_info *info,
+@@ -717,7 +716,7 @@ static void dlfb_ops_fillrect(struct fb_info *info,
+ sys_fillrect(info, rect);
+
+ dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
+- rect->height, info->screen_base);
++ rect->height);
+ }
+
+ /*
+@@ -859,8 +858,7 @@ static int dlfb_ops_ioctl(struct fb_info *info, unsigned int cmd,
+ if (area.y > info->var.yres)
+ area.y = info->var.yres;
+
+- dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, area.x, area.y, area.w, area.h);
+ }
+
+ return 0;
+@@ -1065,8 +1063,7 @@ static int dlfb_ops_set_par(struct fb_info *info)
+ pix_framebuffer[i] = 0x37e6;
+ }
+
+- dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres,
+- info->screen_base);
++ dlfb_handle_damage(dlfb, 0, 0, info->var.xres, info->var.yres);
+
+ return 0;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-064-udlfb-fix-sleeping-inside-spinlock.patch b/patches.kernel.org/5.1.5-064-udlfb-fix-sleeping-inside-spinlock.patch
new file mode 100644
index 0000000000..e18682cc2f
--- /dev/null
+++ b/patches.kernel.org/5.1.5-064-udlfb-fix-sleeping-inside-spinlock.patch
@@ -0,0 +1,154 @@
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:56 +0200
+Subject: [PATCH] udlfb: fix sleeping inside spinlock
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 6b11f9d8433b471fdd3ebed232b43a4b723be6ff
+
+commit 6b11f9d8433b471fdd3ebed232b43a4b723be6ff upstream.
+
+If a framebuffer device is used as a console, the rendering calls
+(copyarea, fillrect, imageblit) may be done with the console spinlock
+held. On udlfb, these function call dlfb_handle_damage that takes a
+blocking semaphore before acquiring an URB.
+
+In order to fix the bug, this patch changes the calls copyarea, fillrect
+and imageblit to offload USB work to a workqueue.
+
+A side effect of this patch is 3x improvement in console scrolling speed
+because the device doesn't have to be updated after each copyarea call.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/udlfb.c | 56 +++++++++++++++++++++++++++++++++++--
+ include/video/udlfb.h | 6 ++++
+ 2 files changed, 59 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index cf4e9928001c..ce30fa710244 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -657,6 +657,50 @@ error:
+ return 0;
+ }
+
++static void dlfb_init_damage(struct dlfb_data *dlfb)
++{
++ dlfb->damage_x = INT_MAX;
++ dlfb->damage_x2 = 0;
++ dlfb->damage_y = INT_MAX;
++ dlfb->damage_y2 = 0;
++}
++
++static void dlfb_damage_work(struct work_struct *w)
++{
++ struct dlfb_data *dlfb = container_of(w, struct dlfb_data, damage_work);
++ int x, x2, y, y2;
++
++ spin_lock_irq(&dlfb->damage_lock);
++ x = dlfb->damage_x;
++ x2 = dlfb->damage_x2;
++ y = dlfb->damage_y;
++ y2 = dlfb->damage_y2;
++ dlfb_init_damage(dlfb);
++ spin_unlock_irq(&dlfb->damage_lock);
++
++ if (x < x2 && y < y2)
++ dlfb_handle_damage(dlfb, x, y, x2 - x, y2 - y);
++}
++
++static void dlfb_offload_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
++{
++ unsigned long flags;
++ int x2 = x + width;
++ int y2 = y + height;
++
++ if (x >= x2 || y >= y2)
++ return;
++
++ spin_lock_irqsave(&dlfb->damage_lock, flags);
++ dlfb->damage_x = min(x, dlfb->damage_x);
++ dlfb->damage_x2 = max(x2, dlfb->damage_x2);
++ dlfb->damage_y = min(y, dlfb->damage_y);
++ dlfb->damage_y2 = max(y2, dlfb->damage_y2);
++ spin_unlock_irqrestore(&dlfb->damage_lock, flags);
++
++ schedule_work(&dlfb->damage_work);
++}
++
+ /*
+ * Path triggered by usermode clients who write to filesystem
+ * e.g. cat filename > /dev/fb1
+@@ -693,7 +737,7 @@ static void dlfb_ops_copyarea(struct fb_info *info,
+
+ sys_copyarea(info, area);
+
+- dlfb_handle_damage(dlfb, area->dx, area->dy,
++ dlfb_offload_damage(dlfb, area->dx, area->dy,
+ area->width, area->height);
+ }
+
+@@ -704,7 +748,7 @@ static void dlfb_ops_imageblit(struct fb_info *info,
+
+ sys_imageblit(info, image);
+
+- dlfb_handle_damage(dlfb, image->dx, image->dy,
++ dlfb_offload_damage(dlfb, image->dx, image->dy,
+ image->width, image->height);
+ }
+
+@@ -715,7 +759,7 @@ static void dlfb_ops_fillrect(struct fb_info *info,
+
+ sys_fillrect(info, rect);
+
+- dlfb_handle_damage(dlfb, rect->dx, rect->dy, rect->width,
++ dlfb_offload_damage(dlfb, rect->dx, rect->dy, rect->width,
+ rect->height);
+ }
+
+@@ -940,6 +984,8 @@ static void dlfb_ops_destroy(struct fb_info *info)
+ {
+ struct dlfb_data *dlfb = info->par;
+
++ cancel_work_sync(&dlfb->damage_work);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1636,6 +1682,10 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ dlfb_init_damage(dlfb);
++ spin_lock_init(&dlfb->damage_lock);
++ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
++
+ INIT_LIST_HEAD(&info->modelist);
+
+ if (!dlfb_alloc_urb_list(dlfb, WRITES_IN_FLIGHT, MAX_TRANSFER)) {
+diff --git a/include/video/udlfb.h b/include/video/udlfb.h
+index 7d09e54ae54e..a3724f1fca1c 100644
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,12 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ int damage_x;
++ int damage_y;
++ int damage_x2;
++ int damage_y2;
++ spinlock_t damage_lock;
++ struct work_struct damage_work;
+ struct fb_ops ops;
+ /* blit-only rendering path metrics, exposed through sysfs */
+ atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-065-udlfb-introduce-a-rendering-mutex.patch b/patches.kernel.org/5.1.5-065-udlfb-introduce-a-rendering-mutex.patch
new file mode 100644
index 0000000000..640b67c591
--- /dev/null
+++ b/patches.kernel.org/5.1.5-065-udlfb-introduce-a-rendering-mutex.patch
@@ -0,0 +1,156 @@
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Mon, 1 Apr 2019 17:46:57 +0200
+Subject: [PATCH] udlfb: introduce a rendering mutex
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: babc250e278eac7b0e671bdaedf833759b43bb78
+
+commit babc250e278eac7b0e671bdaedf833759b43bb78 upstream.
+
+Rendering calls may be done simultaneously from the workqueue,
+dlfb_ops_write, dlfb_ops_ioctl, dlfb_ops_set_par and dlfb_dpy_deferred_io.
+The code is robust enough so that it won't crash on concurrent rendering.
+
+However, concurrent rendering may cause display corruption if the same
+pixel is simultaneously being rendered. In order to avoid this corruption,
+this patch adds a mutex around the rendering calls.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: Bernie Thompson <bernie@plugable.com>
+Cc: Ladislav Michl <ladis@linux-mips.org>
+Cc: <stable@vger.kernel.org>
+[b.zolnierkie: replace "dlfb:" with "uldfb:" in the patch summary]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/udlfb.c | 41 +++++++++++++++++++++++++++----------
+ include/video/udlfb.h | 1 +
+ 2 files changed, 31 insertions(+), 11 deletions(-)
+
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index ce30fa710244..5a0d6fb02bbc 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -596,7 +596,7 @@ static int dlfb_render_hline(struct dlfb_data *dlfb, struct urb **urb_ptr,
+
+ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, int height)
+ {
+- int i;
++ int i, ret;
+ char *cmd;
+ cycles_t start_cycles, end_cycles;
+ int bytes_sent = 0;
+@@ -606,21 +606,29 @@ static int dlfb_handle_damage(struct dlfb_data *dlfb, int x, int y, int width, i
+
+ start_cycles = get_cycles();
+
++ mutex_lock(&dlfb->render_mutex);
++
+ aligned_x = DL_ALIGN_DOWN(x, sizeof(unsigned long));
+ width = DL_ALIGN_UP(width + (x-aligned_x), sizeof(unsigned long));
+ x = aligned_x;
+
+ if ((width <= 0) ||
+ (x + width > dlfb->info->var.xres) ||
+- (y + height > dlfb->info->var.yres))
+- return -EINVAL;
++ (y + height > dlfb->info->var.yres)) {
++ ret = -EINVAL;
++ goto unlock_ret;
++ }
+
+- if (!atomic_read(&dlfb->usb_active))
+- return 0;
++ if (!atomic_read(&dlfb->usb_active)) {
++ ret = 0;
++ goto unlock_ret;
++ }
+
+ urb = dlfb_get_urb(dlfb);
+- if (!urb)
+- return 0;
++ if (!urb) {
++ ret = 0;
++ goto unlock_ret;
++ }
+ cmd = urb->transfer_buffer;
+
+ for (i = y; i < y + height ; i++) {
+@@ -654,7 +662,11 @@ error:
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
+
+- return 0;
++ ret = 0;
++
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
++ return ret;
+ }
+
+ static void dlfb_init_damage(struct dlfb_data *dlfb)
+@@ -782,17 +794,19 @@ static void dlfb_dpy_deferred_io(struct fb_info *info,
+ int bytes_identical = 0;
+ int bytes_rendered = 0;
+
++ mutex_lock(&dlfb->render_mutex);
++
+ if (!fb_defio)
+- return;
++ goto unlock_ret;
+
+ if (!atomic_read(&dlfb->usb_active))
+- return;
++ goto unlock_ret;
+
+ start_cycles = get_cycles();
+
+ urb = dlfb_get_urb(dlfb);
+ if (!urb)
+- return;
++ goto unlock_ret;
+
+ cmd = urb->transfer_buffer;
+
+@@ -825,6 +839,8 @@ error:
+ atomic_add(((unsigned int) ((end_cycles - start_cycles)
+ >> 10)), /* Kcycles */
+ &dlfb->cpu_kcycles_used);
++unlock_ret:
++ mutex_unlock(&dlfb->render_mutex);
+ }
+
+ static int dlfb_get_edid(struct dlfb_data *dlfb, char *edid, int len)
+@@ -986,6 +1002,8 @@ static void dlfb_ops_destroy(struct fb_info *info)
+
+ cancel_work_sync(&dlfb->damage_work);
+
++ mutex_destroy(&dlfb->render_mutex);
++
+ if (info->cmap.len != 0)
+ fb_dealloc_cmap(&info->cmap);
+ if (info->monspecs.modedb)
+@@ -1682,6 +1700,7 @@ static int dlfb_usb_probe(struct usb_interface *intf,
+ dlfb->ops = dlfb_ops;
+ info->fbops = &dlfb->ops;
+
++ mutex_init(&dlfb->render_mutex);
+ dlfb_init_damage(dlfb);
+ spin_lock_init(&dlfb->damage_lock);
+ INIT_WORK(&dlfb->damage_work, dlfb_damage_work);
+diff --git a/include/video/udlfb.h b/include/video/udlfb.h
+index a3724f1fca1c..58fb5732831a 100644
+--- a/include/video/udlfb.h
++++ b/include/video/udlfb.h
+@@ -48,6 +48,7 @@ struct dlfb_data {
+ int base8;
+ u32 pseudo_palette[256];
+ int blank_mode; /*one of FB_BLANK_ */
++ struct mutex render_mutex;
+ int damage_x;
+ int damage_y;
+ int damage_x2;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-066-fuse-fix-writepages-on-32bit.patch b/patches.kernel.org/5.1.5-066-fuse-fix-writepages-on-32bit.patch
new file mode 100644
index 0000000000..b813cb09ab
--- /dev/null
+++ b/patches.kernel.org/5.1.5-066-fuse-fix-writepages-on-32bit.patch
@@ -0,0 +1,41 @@
+From: Miklos Szeredi <mszeredi@redhat.com>
+Date: Wed, 24 Apr 2019 17:05:06 +0200
+Subject: [PATCH] fuse: fix writepages on 32bit
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2
+
+commit 9de5be06d0a89ca97b5ab902694d42dfd2bb77d2 upstream.
+
+Writepage requests were cropped to i_size & 0xffffffff, which meant that
+mmaped writes to any file larger than 4G might be silently discarded.
+
+Fix by storing the file size in a properly sized variable (loff_t instead
+of size_t).
+
+Reported-by: Antonio SJ Musumeci <trapexit@spawn.link>
+Fixes: 6eaf4782eb09 ("fuse: writepages: crop secondary requests")
+Cc: <stable@vger.kernel.org> # v3.13
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/fuse/file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 06096b60f1df..5428c81879b2 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -1586,7 +1586,7 @@ __acquires(fi->lock)
+ {
+ struct fuse_conn *fc = get_fuse_conn(inode);
+ struct fuse_inode *fi = get_fuse_inode(inode);
+- size_t crop = i_size_read(inode);
++ loff_t crop = i_size_read(inode);
+ struct fuse_req *req;
+
+ while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-067-fuse-honor-RLIMIT_FSIZE-in-fuse_file_fallocate.patch b/patches.kernel.org/5.1.5-067-fuse-honor-RLIMIT_FSIZE-in-fuse_file_fallocate.patch
new file mode 100644
index 0000000000..92412588f3
--- /dev/null
+++ b/patches.kernel.org/5.1.5-067-fuse-honor-RLIMIT_FSIZE-in-fuse_file_fallocate.patch
@@ -0,0 +1,45 @@
+From: Liu Bo <bo.liu@linux.alibaba.com>
+Date: Thu, 18 Apr 2019 04:04:41 +0800
+Subject: [PATCH] fuse: honor RLIMIT_FSIZE in fuse_file_fallocate
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 0cbade024ba501313da3b7e5dd2a188a6bc491b5
+
+commit 0cbade024ba501313da3b7e5dd2a188a6bc491b5 upstream.
+
+fstests generic/228 reported this failure that fuse fallocate does not
+honor what 'ulimit -f' has set.
+
+This adds the necessary inode_newsize_ok() check.
+
+Signed-off-by: Liu Bo <bo.liu@linux.alibaba.com>
+Fixes: 05ba1f082300 ("fuse: add FALLOCATE operation")
+Cc: <stable@vger.kernel.org> # v3.5
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/fuse/file.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index 5428c81879b2..f811af4f6507 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -3044,6 +3044,13 @@ static long fuse_file_fallocate(struct file *file, int mode, loff_t offset,
+ }
+ }
+
++ if (!(mode & FALLOC_FL_KEEP_SIZE) &&
++ offset + length > i_size_read(inode)) {
++ err = inode_newsize_ok(inode, offset + length);
++ if (err)
++ return err;
++ }
++
+ if (!(mode & FALLOC_FL_KEEP_SIZE))
+ set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-068-ovl-fix-missing-upper-fs-freeze-protection-on-c.patch b/patches.kernel.org/5.1.5-068-ovl-fix-missing-upper-fs-freeze-protection-on-c.patch
new file mode 100644
index 0000000000..37f955ade4
--- /dev/null
+++ b/patches.kernel.org/5.1.5-068-ovl-fix-missing-upper-fs-freeze-protection-on-c.patch
@@ -0,0 +1,99 @@
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Tue, 22 Jan 2019 07:01:39 +0200
+Subject: [PATCH] ovl: fix missing upper fs freeze protection on copy up for
+ ioctl
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 3428030da004a1128cbdcf93dc03e16f184d845b
+
+commit 3428030da004a1128cbdcf93dc03e16f184d845b upstream.
+
+Generalize the helper ovl_open_maybe_copy_up() and use it to copy up file
+with data before FS_IOC_SETFLAGS ioctl.
+
+The FS_IOC_SETFLAGS ioctl is a bit of an odd ball in vfs, which probably
+caused the confusion. File may be open O_RDONLY, but ioctl modifies the
+file. VFS does not call mnt_want_write_file() nor lock inode mutex, but
+fs-specific code for FS_IOC_SETFLAGS does. So ovl_ioctl() calls
+mnt_want_write_file() for the overlay file, and fs-specific code calls
+mnt_want_write_file() for upper fs file, but there was no call for
+ovl_want_write() for copy up duration which prevents overlayfs from copying
+up on a frozen upper fs.
+
+Fixes: dab5ca8fd9dd ("ovl: add lsattr/chattr support")
+Cc: <stable@vger.kernel.org> # v4.19
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Acked-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/overlayfs/copy_up.c | 6 +++---
+ fs/overlayfs/file.c | 5 ++---
+ fs/overlayfs/overlayfs.h | 2 +-
+ 3 files changed, 6 insertions(+), 7 deletions(-)
+
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 68b3303e4b46..56feaa739979 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -909,14 +909,14 @@ static bool ovl_open_need_copy_up(struct dentry *dentry, int flags)
+ return true;
+ }
+
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags)
++int ovl_maybe_copy_up(struct dentry *dentry, int flags)
+ {
+ int err = 0;
+
+- if (ovl_open_need_copy_up(dentry, file_flags)) {
++ if (ovl_open_need_copy_up(dentry, flags)) {
+ err = ovl_want_write(dentry);
+ if (!err) {
+- err = ovl_copy_up_flags(dentry, file_flags);
++ err = ovl_copy_up_flags(dentry, flags);
+ ovl_drop_write(dentry);
+ }
+ }
+diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c
+index 84dd957efa24..50e4407398d8 100644
+--- a/fs/overlayfs/file.c
++++ b/fs/overlayfs/file.c
+@@ -116,11 +116,10 @@ static int ovl_real_fdget(const struct file *file, struct fd *real)
+
+ static int ovl_open(struct inode *inode, struct file *file)
+ {
+- struct dentry *dentry = file_dentry(file);
+ struct file *realfile;
+ int err;
+
+- err = ovl_open_maybe_copy_up(dentry, file->f_flags);
++ err = ovl_maybe_copy_up(file_dentry(file), file->f_flags);
+ if (err)
+ return err;
+
+@@ -390,7 +389,7 @@ static long ovl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (ret)
+ return ret;
+
+- ret = ovl_copy_up_with_data(file_dentry(file));
++ ret = ovl_maybe_copy_up(file_dentry(file), O_WRONLY);
+ if (!ret) {
+ ret = ovl_real_ioctl(file, cmd, arg);
+
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 9c6018287d57..d26efed9f80a 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -421,7 +421,7 @@ extern const struct file_operations ovl_file_operations;
+ int ovl_copy_up(struct dentry *dentry);
+ int ovl_copy_up_with_data(struct dentry *dentry);
+ int ovl_copy_up_flags(struct dentry *dentry, int flags);
+-int ovl_open_maybe_copy_up(struct dentry *dentry, unsigned int file_flags);
++int ovl_maybe_copy_up(struct dentry *dentry, int flags);
+ int ovl_copy_xattr(struct dentry *old, struct dentry *new);
+ int ovl_set_attr(struct dentry *upper, struct kstat *stat);
+ struct ovl_fh *ovl_encode_real_fh(struct dentry *real, bool is_upper);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-069-fsnotify-fix-unlink-performance-regression.patch b/patches.kernel.org/5.1.5-069-fsnotify-fix-unlink-performance-regression.patch
new file mode 100644
index 0000000000..dd11659e90
--- /dev/null
+++ b/patches.kernel.org/5.1.5-069-fsnotify-fix-unlink-performance-regression.patch
@@ -0,0 +1,151 @@
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Sun, 5 May 2019 12:15:49 +0300
+Subject: [PATCH] fsnotify: fix unlink performance regression
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 4d8e7055a4058ee191296699803c5090e14f0dff
+
+commit 4d8e7055a4058ee191296699803c5090e14f0dff upstream.
+
+__fsnotify_parent() has an optimization in place to avoid unneeded
+take_dentry_name_snapshot(). When fsnotify_nameremove() was changed
+not to call __fsnotify_parent(), we left out the optimization.
+Kernel test robot reported a 5% performance regression in concurrent
+unlink() workload.
+
+Reported-by: kernel test robot <rong.a.chen@intel.com>
+Link: https://lore.kernel.org/lkml/20190505062153.GG29809@shao2-debian/
+Link: https://lore.kernel.org/linux-fsdevel/20190104090357.GD22409@quack2.suse.cz/
+Fixes: 5f02a8776384 ("fsnotify: annotate directory entry modification events")
+CC: stable@vger.kernel.org
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/notify/fsnotify.c | 41 ++++++++++++++++++++++++++++++++
+ include/linux/fsnotify.h | 33 -------------------------
+ include/linux/fsnotify_backend.h | 4 ++++
+ 3 files changed, 45 insertions(+), 33 deletions(-)
+
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index df06f3da166c..e8d3f349b7f2 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -107,6 +107,47 @@ void fsnotify_sb_delete(struct super_block *sb)
+ fsnotify_clear_marks_by_sb(sb);
+ }
+
++/*
++ * fsnotify_nameremove - a filename was removed from a directory
++ *
++ * This is mostly called under parent vfs inode lock so name and
++ * dentry->d_parent should be stable. However there are some corner cases where
++ * inode lock is not held. So to be on the safe side and be reselient to future
++ * callers and out of tree users of d_delete(), we do not assume that d_parent
++ * and d_name are stable and we use dget_parent() and
++ * take_dentry_name_snapshot() to grab stable references.
++ */
++void fsnotify_nameremove(struct dentry *dentry, int isdir)
++{
++ struct dentry *parent;
++ struct name_snapshot name;
++ __u32 mask = FS_DELETE;
++
++ /* d_delete() of pseudo inode? (e.g. __ns_get_path() playing tricks) */
++ if (IS_ROOT(dentry))
++ return;
++
++ if (isdir)
++ mask |= FS_ISDIR;
++
++ parent = dget_parent(dentry);
++ /* Avoid unneeded take_dentry_name_snapshot() */
++ if (!(d_inode(parent)->i_fsnotify_mask & FS_DELETE) &&
++ !(dentry->d_sb->s_fsnotify_mask & FS_DELETE))
++ goto out_dput;
++
++ take_dentry_name_snapshot(&name, dentry);
++
++ fsnotify(d_inode(parent), mask, d_inode(dentry), FSNOTIFY_EVENT_INODE,
++ name.name, 0);
++
++ release_dentry_name_snapshot(&name);
++
++out_dput:
++ dput(parent);
++}
++EXPORT_SYMBOL(fsnotify_nameremove);
++
+ /*
+ * Given an inode, first check if we care what happens to our children. Inotify
+ * and dnotify both tell their parents about events. If we care about any event
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index 09587e2860b5..e30d6132c633 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -151,39 +151,6 @@ static inline void fsnotify_vfsmount_delete(struct vfsmount *mnt)
+ __fsnotify_vfsmount_delete(mnt);
+ }
+
+-/*
+- * fsnotify_nameremove - a filename was removed from a directory
+- *
+- * This is mostly called under parent vfs inode lock so name and
+- * dentry->d_parent should be stable. However there are some corner cases where
+- * inode lock is not held. So to be on the safe side and be reselient to future
+- * callers and out of tree users of d_delete(), we do not assume that d_parent
+- * and d_name are stable and we use dget_parent() and
+- * take_dentry_name_snapshot() to grab stable references.
+- */
+-static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
+-{
+- struct dentry *parent;
+- struct name_snapshot name;
+- __u32 mask = FS_DELETE;
+-
+- /* d_delete() of pseudo inode? (e.g. __ns_get_path() playing tricks) */
+- if (IS_ROOT(dentry))
+- return;
+-
+- if (isdir)
+- mask |= FS_ISDIR;
+-
+- parent = dget_parent(dentry);
+- take_dentry_name_snapshot(&name, dentry);
+-
+- fsnotify(d_inode(parent), mask, d_inode(dentry), FSNOTIFY_EVENT_INODE,
+- name.name, 0);
+-
+- release_dentry_name_snapshot(&name);
+- dput(parent);
+-}
+-
+ /*
+ * fsnotify_inoderemove - an inode is going away
+ */
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index dfc28fcb4de8..094b38f2d9a1 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -355,6 +355,7 @@ extern int __fsnotify_parent(const struct path *path, struct dentry *dentry, __u
+ extern void __fsnotify_inode_delete(struct inode *inode);
+ extern void __fsnotify_vfsmount_delete(struct vfsmount *mnt);
+ extern void fsnotify_sb_delete(struct super_block *sb);
++extern void fsnotify_nameremove(struct dentry *dentry, int isdir);
+ extern u32 fsnotify_get_cookie(void);
+
+ static inline int fsnotify_inode_watches_children(struct inode *inode)
+@@ -524,6 +525,9 @@ static inline void __fsnotify_vfsmount_delete(struct vfsmount *mnt)
+ static inline void fsnotify_sb_delete(struct super_block *sb)
+ {}
+
++static inline void fsnotify_nameremove(struct dentry *dentry, int isdir)
++{}
++
+ static inline void fsnotify_update_flags(struct dentry *dentry)
+ {}
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-070-gcc-plugins-arm_ssp_per_task_plugin-Fix-for-old.patch b/patches.kernel.org/5.1.5-070-gcc-plugins-arm_ssp_per_task_plugin-Fix-for-old.patch
new file mode 100644
index 0000000000..bcfe16117c
--- /dev/null
+++ b/patches.kernel.org/5.1.5-070-gcc-plugins-arm_ssp_per_task_plugin-Fix-for-old.patch
@@ -0,0 +1,54 @@
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Fri, 10 May 2019 21:00:25 +1200
+Subject: [PATCH] gcc-plugins: arm_ssp_per_task_plugin: Fix for older GCC < 6
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e
+
+commit 259799ea5a9aa099a267f3b99e1f7078bbaf5c5e upstream.
+
+Use gen_rtx_set instead of gen_rtx_SET. The former is a wrapper macro
+that handles the difference between GCC versions implementing
+the latter.
+
+This fixes the following error on my system with g++ 5.4.0 as the host
+compiler
+
+ HOSTCXX -fPIC scripts/gcc-plugins/arm_ssp_per_task_plugin.o
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c:42:14: error: macro "gen_rtx_SET" requires 3 arguments, but only 2 given
+ mask)),
+ ^
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c: In function ‘unsigned int arm_pertask_ssp_rtl_execute()’:
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c:39:20: error: ‘gen_rtx_SET’ was not declared in this scope
+ emit_insn_before(gen_rtx_SET
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries")
+Cc: stable@vger.kernel.org
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+index 89c47f57d1ce..8c1af9bdcb1b 100644
+--- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
++++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c
+@@ -36,7 +36,7 @@ static unsigned int arm_pertask_ssp_rtl_execute(void)
+ mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
+ masked_sp = gen_reg_rtx(Pmode);
+
+- emit_insn_before(gen_rtx_SET(masked_sp,
++ emit_insn_before(gen_rtx_set(masked_sp,
+ gen_rtx_AND(Pmode,
+ stack_pointer_rtx,
+ mask)),
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-071-iommu-tegra-smmu-Fix-invalid-ASID-bits-on-Tegra.patch b/patches.kernel.org/5.1.5-071-iommu-tegra-smmu-Fix-invalid-ASID-bits-on-Tegra.patch
new file mode 100644
index 0000000000..efb97c9fe5
--- /dev/null
+++ b/patches.kernel.org/5.1.5-071-iommu-tegra-smmu-Fix-invalid-ASID-bits-on-Tegra.patch
@@ -0,0 +1,86 @@
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Thu, 7 Mar 2019 01:50:07 +0300
+Subject: [PATCH] iommu/tegra-smmu: Fix invalid ASID bits on Tegra30/114
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 43a0541e312f7136e081e6bf58f6c8a2e9672688
+
+commit 43a0541e312f7136e081e6bf58f6c8a2e9672688 upstream.
+
+Both Tegra30 and Tegra114 have 4 ASID's and the corresponding bitfield of
+the TLB_FLUSH register differs from later Tegra generations that have 128
+ASID's.
+
+In a result the PTE's are now flushed correctly from TLB and this fixes
+problems with graphics (randomly failing tests) on Tegra30.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/iommu/tegra-smmu.c | 25 ++++++++++++++++++-------
+ 1 file changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/iommu/tegra-smmu.c b/drivers/iommu/tegra-smmu.c
+index 5182c7d6171e..8d30653cd13a 100644
+--- a/drivers/iommu/tegra-smmu.c
++++ b/drivers/iommu/tegra-smmu.c
+@@ -102,7 +102,6 @@ static inline u32 smmu_readl(struct tegra_smmu *smmu, unsigned long offset)
+ #define SMMU_TLB_FLUSH_VA_MATCH_ALL (0 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_SECTION (2 << 0)
+ #define SMMU_TLB_FLUSH_VA_MATCH_GROUP (3 << 0)
+-#define SMMU_TLB_FLUSH_ASID(x) (((x) & 0x7f) << 24)
+ #define SMMU_TLB_FLUSH_VA_SECTION(addr) ((((addr) & 0xffc00000) >> 12) | \
+ SMMU_TLB_FLUSH_VA_MATCH_SECTION)
+ #define SMMU_TLB_FLUSH_VA_GROUP(addr) ((((addr) & 0xffffc000) >> 12) | \
+@@ -205,8 +204,12 @@ static inline void smmu_flush_tlb_asid(struct tegra_smmu *smmu,
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_MATCH_ALL;
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_MATCH_ALL;
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -216,8 +219,12 @@ static inline void smmu_flush_tlb_section(struct tegra_smmu *smmu,
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_SECTION(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_SECTION(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+@@ -227,8 +234,12 @@ static inline void smmu_flush_tlb_group(struct tegra_smmu *smmu,
+ {
+ u32 value;
+
+- value = SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_ASID(asid) |
+- SMMU_TLB_FLUSH_VA_GROUP(iova);
++ if (smmu->soc->num_asids == 4)
++ value = (asid & 0x3) << 29;
++ else
++ value = (asid & 0x7f) << 24;
++
++ value |= SMMU_TLB_FLUSH_ASID_MATCH | SMMU_TLB_FLUSH_VA_GROUP(iova);
+ smmu_writel(smmu, value, SMMU_TLB_FLUSH);
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-072-ceph-flush-dirty-inodes-before-proceeding-with-.patch b/patches.kernel.org/5.1.5-072-ceph-flush-dirty-inodes-before-proceeding-with-.patch
new file mode 100644
index 0000000000..531939041f
--- /dev/null
+++ b/patches.kernel.org/5.1.5-072-ceph-flush-dirty-inodes-before-proceeding-with-.patch
@@ -0,0 +1,53 @@
+From: Jeff Layton <jlayton@kernel.org>
+Date: Tue, 7 May 2019 09:20:54 -0400
+Subject: [PATCH] ceph: flush dirty inodes before proceeding with remount
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 00abf69dd24f4444d185982379c5cc3bb7b6d1fc
+
+commit 00abf69dd24f4444d185982379c5cc3bb7b6d1fc upstream.
+
+xfstest generic/452 was triggering a "Busy inodes after umount" warning.
+ceph was allowing the mount to go read-only without first flushing out
+dirty inodes in the cache. Ensure we sync out the filesystem before
+allowing a remount to proceed.
+
+Cc: stable@vger.kernel.org
+Link: http://tracker.ceph.com/issues/39571
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/ceph/super.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index 6d5bb2f74612..01113c86e469 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -845,6 +845,12 @@ static void ceph_umount_begin(struct super_block *sb)
+ return;
+ }
+
++static int ceph_remount(struct super_block *sb, int *flags, char *data)
++{
++ sync_filesystem(sb);
++ return 0;
++}
++
+ static const struct super_operations ceph_super_ops = {
+ .alloc_inode = ceph_alloc_inode,
+ .destroy_inode = ceph_destroy_inode,
+@@ -852,6 +858,7 @@ static const struct super_operations ceph_super_ops = {
+ .drop_inode = ceph_drop_inode,
+ .sync_fs = ceph_sync_fs,
+ .put_super = ceph_put_super,
++ .remount_fs = ceph_remount,
+ .show_options = ceph_show_options,
+ .statfs = ceph_statfs,
+ .umount_begin = ceph_umount_begin,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-073-x86_64-Add-gap-to-int3-to-allow-for-call-emulat.patch b/patches.kernel.org/5.1.5-073-x86_64-Add-gap-to-int3-to-allow-for-call-emulat.patch
new file mode 100644
index 0000000000..2dd32f91f0
--- /dev/null
+++ b/patches.kernel.org/5.1.5-073-x86_64-Add-gap-to-int3-to-allow-for-call-emulat.patch
@@ -0,0 +1,81 @@
+From: Josh Poimboeuf <jpoimboe@redhat.com>
+Date: Fri, 30 Nov 2018 12:39:17 -0600
+Subject: [PATCH] x86_64: Add gap to int3 to allow for call emulation
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 2700fefdb2d9751c416ad56897e27d41e409324a
+
+commit 2700fefdb2d9751c416ad56897e27d41e409324a upstream.
+
+To allow an int3 handler to emulate a call instruction, it must be able to
+push a return address onto the stack. Add a gap to the stack to allow the
+int3 handler to push the return address and change the return from int3 to
+jump straight to the emulated called function target.
+
+Link: http://lkml.kernel.org/r/20181130183917.hxmti5josgq4clti@treble
+Link: http://lkml.kernel.org/r/20190502162133.GX2623@hirez.programming.kicks-ass.net
+
+[
+ Note, this is needed to allow Live Kernel Patching to not miss calling a
+ patched function when tracing is enabled. -- Steven Rostedt
+]
+
+Cc: stable@vger.kernel.org
+Fixes: b700e7f03df5 ("livepatch: kernel: add support for live patching")
+Tested-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/entry/entry_64.S | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 4fe27b67d7e2..b1d59a7c556e 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -881,7 +881,7 @@ apicinterrupt IRQ_WORK_VECTOR irq_work_interrupt smp_irq_work_interrupt
+ * @paranoid == 2 is special: the stub will never switch stacks. This is for
+ * #DF: if the thread stack is somehow unusable, we'll still get a useful OOPS.
+ */
+-.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
++.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1 create_gap=0
+ ENTRY(\sym)
+ UNWIND_HINT_IRET_REGS offset=\has_error_code*8
+
+@@ -901,6 +901,20 @@ ENTRY(\sym)
+ jnz .Lfrom_usermode_switch_stack_\@
+ .endif
+
++ .if \create_gap == 1
++ /*
++ * If coming from kernel space, create a 6-word gap to allow the
++ * int3 handler to emulate a call instruction.
++ */
++ testb $3, CS-ORIG_RAX(%rsp)
++ jnz .Lfrom_usermode_no_gap_\@
++ .rept 6
++ pushq 5*8(%rsp)
++ .endr
++ UNWIND_HINT_IRET_REGS offset=8
++.Lfrom_usermode_no_gap_\@:
++ .endif
++
+ .if \paranoid
+ call paranoid_entry
+ .else
+@@ -1132,7 +1146,7 @@ apicinterrupt3 HYPERV_STIMER0_VECTOR \
+ #endif /* CONFIG_HYPERV */
+
+ idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
+-idtentry int3 do_int3 has_error_code=0
++idtentry int3 do_int3 has_error_code=0 create_gap=1
+ idtentry stack_segment do_stack_segment has_error_code=1
+
+ #ifdef CONFIG_XEN_PV
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-074-x86_64-Allow-breakpoints-to-emulate-call-instru.patch b/patches.kernel.org/5.1.5-074-x86_64-Allow-breakpoints-to-emulate-call-instru.patch
new file mode 100644
index 0000000000..f286a6d357
--- /dev/null
+++ b/patches.kernel.org/5.1.5-074-x86_64-Allow-breakpoints-to-emulate-call-instru.patch
@@ -0,0 +1,99 @@
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 1 May 2019 15:11:17 +0200
+Subject: [PATCH] x86_64: Allow breakpoints to emulate call instructions
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 4b33dadf37666c0860b88f9e52a16d07bf6d0b03
+
+commit 4b33dadf37666c0860b88f9e52a16d07bf6d0b03 upstream.
+
+In order to allow breakpoints to emulate call instructions, they need to push
+the return address onto the stack. The x86_64 int3 handler adds a small gap
+to allow the stack to grow some. Use this gap to add the return address to
+be able to emulate a call instruction at the breakpoint location.
+
+These helper functions are added:
+
+ int3_emulate_jmp(): changes the location of the regs->ip to return there.
+
+ (The next two are only for x86_64)
+ int3_emulate_push(): to push the address onto the gap in the stack
+ int3_emulate_call(): push the return address and change regs->ip
+
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Nicolai Stange <nstange@suse.de>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: the arch/x86 maintainers <x86@kernel.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Miroslav Benes <mbenes@suse.cz>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Mimi Zohar <zohar@linux.ibm.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Nayna Jain <nayna@linux.ibm.com>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Joerg Roedel <jroedel@suse.de>
+Cc: "open list:KERNEL SELFTEST FRAMEWORK" <linux-kselftest@vger.kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: b700e7f03df5 ("livepatch: kernel: add support for live patching")
+Tested-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+[ Modified to only work for x86_64 and added comment to int3_emulate_push() ]
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/include/asm/text-patching.h | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+diff --git a/arch/x86/include/asm/text-patching.h b/arch/x86/include/asm/text-patching.h
+index e85ff65c43c3..05861cc08787 100644
+--- a/arch/x86/include/asm/text-patching.h
++++ b/arch/x86/include/asm/text-patching.h
+@@ -39,4 +39,32 @@ extern int poke_int3_handler(struct pt_regs *regs);
+ extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);
+ extern int after_bootmem;
+
++static inline void int3_emulate_jmp(struct pt_regs *regs, unsigned long ip)
++{
++ regs->ip = ip;
++}
++
++#define INT3_INSN_SIZE 1
++#define CALL_INSN_SIZE 5
++
++#ifdef CONFIG_X86_64
++static inline void int3_emulate_push(struct pt_regs *regs, unsigned long val)
++{
++ /*
++ * The int3 handler in entry_64.S adds a gap between the
++ * stack where the break point happened, and the saving of
++ * pt_regs. We can extend the original stack because of
++ * this gap. See the idtentry macro's create_gap option.
++ */
++ regs->sp -= sizeof(unsigned long);
++ *(unsigned long *)regs->sp = val;
++}
++
++static inline void int3_emulate_call(struct pt_regs *regs, unsigned long func)
++{
++ int3_emulate_push(regs, regs->ip - INT3_INSN_SIZE + CALL_INSN_SIZE);
++ int3_emulate_jmp(regs, func);
++}
++#endif
++
+ #endif /* _ASM_X86_TEXT_PATCHING_H */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-075-ftrace-x86_64-Emulate-call-function-while-updat.patch b/patches.kernel.org/5.1.5-075-ftrace-x86_64-Emulate-call-function-while-updat.patch
new file mode 100644
index 0000000000..09366282b8
--- /dev/null
+++ b/patches.kernel.org/5.1.5-075-ftrace-x86_64-Emulate-call-function-while-updat.patch
@@ -0,0 +1,158 @@
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 1 May 2019 15:11:17 +0200
+Subject: [PATCH] ftrace/x86_64: Emulate call function while updating in
+ breakpoint handler
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 9e298e8604088a600d8100a111a532a9d342af09
+
+commit 9e298e8604088a600d8100a111a532a9d342af09 upstream.
+
+Nicolai Stange discovered[1] that if live kernel patching is enabled, and the
+function tracer started tracing the same function that was patched, the
+conversion of the fentry call site during the translation of going from
+calling the live kernel patch trampoline to the iterator trampoline, would
+have as slight window where it didn't call anything.
+
+As live kernel patching depends on ftrace to always call its code (to
+prevent the function being traced from being called, as it will redirect
+it). This small window would allow the old buggy function to be called, and
+this can cause undesirable results.
+
+Nicolai submitted new patches[2] but these were controversial. As this is
+similar to the static call emulation issues that came up a while ago[3].
+But after some debate[4][5] adding a gap in the stack when entering the
+breakpoint handler allows for pushing the return address onto the stack to
+easily emulate a call.
+
+[1] http://lkml.kernel.org/r/20180726104029.7736-1-nstange@suse.de
+[2] http://lkml.kernel.org/r/20190427100639.15074-1-nstange@suse.de
+[3] http://lkml.kernel.org/r/3cf04e113d71c9f8e4be95fb84a510f085aa4afa.1541711457.git.jpoimboe@redhat.com
+[4] http://lkml.kernel.org/r/CAHk-=wh5OpheSU8Em_Q3Hg8qw_JtoijxOdPtHru6d+5K8TWM=A@mail.gmail.com
+[5] http://lkml.kernel.org/r/CAHk-=wjvQxY4DvPrJ6haPgAa6b906h=MwZXO6G8OtiTGe=N7_w@mail.gmail.com
+
+[
+ Live kernel patching is not implemented on x86_32, thus the emulate
+ calls are only for x86_64.
+]
+
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Nicolai Stange <nstange@suse.de>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: the arch/x86 maintainers <x86@kernel.org>
+Cc: Josh Poimboeuf <jpoimboe@redhat.com>
+Cc: Jiri Kosina <jikos@kernel.org>
+Cc: Miroslav Benes <mbenes@suse.cz>
+Cc: Petr Mladek <pmladek@suse.com>
+Cc: Joe Lawrence <joe.lawrence@redhat.com>
+Cc: Shuah Khan <shuah@kernel.org>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Tim Chen <tim.c.chen@linux.intel.com>
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: Mimi Zohar <zohar@linux.ibm.com>
+Cc: Juergen Gross <jgross@suse.com>
+Cc: Nick Desaulniers <ndesaulniers@google.com>
+Cc: Nayna Jain <nayna@linux.ibm.com>
+Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
+Cc: Joerg Roedel <jroedel@suse.de>
+Cc: "open list:KERNEL SELFTEST FRAMEWORK" <linux-kselftest@vger.kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: b700e7f03df5 ("livepatch: kernel: add support for live patching")
+Tested-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Nicolai Stange <nstange@suse.de>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+[ Changed to only implement emulated calls for x86_64 ]
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/x86/kernel/ftrace.c | 32 +++++++++++++++++++++++++++-----
+ 1 file changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
+index ef49517f6bb2..bd553b3af22e 100644
+--- a/arch/x86/kernel/ftrace.c
++++ b/arch/x86/kernel/ftrace.c
+@@ -29,6 +29,7 @@
+ #include <asm/kprobes.h>
+ #include <asm/ftrace.h>
+ #include <asm/nops.h>
++#include <asm/text-patching.h>
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+
+@@ -231,6 +232,7 @@ int ftrace_modify_call(struct dyn_ftrace *rec, unsigned long old_addr,
+ }
+
+ static unsigned long ftrace_update_func;
++static unsigned long ftrace_update_func_call;
+
+ static int update_ftrace_func(unsigned long ip, void *new)
+ {
+@@ -259,6 +261,8 @@ int ftrace_update_ftrace_func(ftrace_func_t func)
+ unsigned char *new;
+ int ret;
+
++ ftrace_update_func_call = (unsigned long)func;
++
+ new = ftrace_call_replace(ip, (unsigned long)func);
+ ret = update_ftrace_func(ip, new);
+
+@@ -294,13 +298,28 @@ int ftrace_int3_handler(struct pt_regs *regs)
+ if (WARN_ON_ONCE(!regs))
+ return 0;
+
+- ip = regs->ip - 1;
+- if (!ftrace_location(ip) && !is_ftrace_caller(ip))
+- return 0;
++ ip = regs->ip - INT3_INSN_SIZE;
+
+- regs->ip += MCOUNT_INSN_SIZE - 1;
++#ifdef CONFIG_X86_64
++ if (ftrace_location(ip)) {
++ int3_emulate_call(regs, (unsigned long)ftrace_regs_caller);
++ return 1;
++ } else if (is_ftrace_caller(ip)) {
++ if (!ftrace_update_func_call) {
++ int3_emulate_jmp(regs, ip + CALL_INSN_SIZE);
++ return 1;
++ }
++ int3_emulate_call(regs, ftrace_update_func_call);
++ return 1;
++ }
++#else
++ if (ftrace_location(ip) || is_ftrace_caller(ip)) {
++ int3_emulate_jmp(regs, ip + CALL_INSN_SIZE);
++ return 1;
++ }
++#endif
+
+- return 1;
++ return 0;
+ }
+ NOKPROBE_SYMBOL(ftrace_int3_handler);
+
+@@ -859,6 +878,8 @@ void arch_ftrace_update_trampoline(struct ftrace_ops *ops)
+
+ func = ftrace_ops_get_func(ops);
+
++ ftrace_update_func_call = (unsigned long)func;
++
+ /* Do a safe modify in case the trampoline is executing */
+ new = ftrace_call_replace(ip, (unsigned long)func);
+ ret = update_ftrace_func(ip, new);
+@@ -960,6 +981,7 @@ static int ftrace_mod_jmp(unsigned long ip, void *func)
+ {
+ unsigned char *new;
+
++ ftrace_update_func_call = 0UL;
+ new = ftrace_jmp_replace(ip, (unsigned long)func);
+
+ return update_ftrace_func(ip, new);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-076-tracing-Fix-partial-reading-of-trace-event-s-id.patch b/patches.kernel.org/5.1.5-076-tracing-Fix-partial-reading-of-trace-event-s-id.patch
new file mode 100644
index 0000000000..df2b114be6
--- /dev/null
+++ b/patches.kernel.org/5.1.5-076-tracing-Fix-partial-reading-of-trace-event-s-id.patch
@@ -0,0 +1,82 @@
+From: Elazar Leibovich <elazar@lightbitslabs.com>
+Date: Mon, 31 Dec 2018 13:58:37 +0200
+Subject: [PATCH] tracing: Fix partial reading of trace event's id file
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: cbe08bcbbe787315c425dde284dcb715cfbf3f39
+
+commit cbe08bcbbe787315c425dde284dcb715cfbf3f39 upstream.
+
+When reading only part of the id file, the ppos isn't tracked correctly.
+This is taken care by simple_read_from_buffer.
+
+Reading a single byte, and then the next byte would result EOF.
+
+While this seems like not a big deal, this breaks abstractions that
+reads information from files unbuffered. See for example
+https://github.com/golang/go/issues/29399
+
+This code was mentioned as problematic in
+commit cd458ba9d5a5
+("tracing: Do not (ab)use trace_seq in event_id_read()")
+
+An example C code that show this bug is:
+
+ #include <stdio.h>
+ #include <stdint.h>
+
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <unistd.h>
+
+ int main(int argc, char **argv) {
+ if (argc < 2)
+ return 1;
+ int fd = open(argv[1], O_RDONLY);
+ char c;
+ read(fd, &c, 1);
+ printf("First %c\n", c);
+ read(fd, &c, 1);
+ printf("Second %c\n", c);
+ }
+
+Then run with, e.g.
+
+ sudo ./a.out /sys/kernel/debug/tracing/events/tcp/tcp_set_state/id
+
+You'll notice you're getting the first character twice, instead of the
+first two characters in the id file.
+
+Link: http://lkml.kernel.org/r/20181231115837.4932-1-elazar@lightbitslabs.com
+
+Cc: Orit Wasserman <orit.was@gmail.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: 23725aeeab10b ("ftrace: provide an id file for each event")
+Signed-off-by: Elazar Leibovich <elazar@lightbitslabs.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/trace/trace_events.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index 5b3b0c3c8a47..d910e36c34b5 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -1318,9 +1318,6 @@ event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
+ char buf[32];
+ int len;
+
+- if (*ppos)
+- return 0;
+-
+ if (unlikely(!id))
+ return -ENODEV;
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-077-tracing-probeevent-Fix-to-make-the-type-of-comm.patch b/patches.kernel.org/5.1.5-077-tracing-probeevent-Fix-to-make-the-type-of-comm.patch
new file mode 100644
index 0000000000..bec410d6dd
--- /dev/null
+++ b/patches.kernel.org/5.1.5-077-tracing-probeevent-Fix-to-make-the-type-of-comm.patch
@@ -0,0 +1,57 @@
+From: Masami Hiramatsu <mhiramat@kernel.org>
+Date: Tue, 7 May 2019 22:56:02 +0900
+Subject: [PATCH] tracing: probeevent: Fix to make the type of $comm string
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 3dd1f7f24f8ceec00bbbc364c2ac3c893f0fdc4c
+
+commit 3dd1f7f24f8ceec00bbbc364c2ac3c893f0fdc4c upstream.
+
+Fix to make the type of $comm "string". If we set the other type to $comm
+argument, it shows meaningless value or wrong data. Currently probe events
+allow us to set string array type (e.g. ":string[2]"), or other digit types
+like x8 on $comm. But since clearly $comm is just a string data, it should
+not be fetched by other types including array.
+
+Link: http://lkml.kernel.org/r/155723736241.9149.14582064184468574539.stgit@devnote2
+
+Cc: Andreas Ziegler <andreas.ziegler@fau.de>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
+Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/trace/trace_probe.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c
+index 8f8411e7835f..e41d389b7f49 100644
+--- a/kernel/trace/trace_probe.c
++++ b/kernel/trace/trace_probe.c
+@@ -420,13 +420,14 @@ static int traceprobe_parse_probe_arg_body(char *arg, ssize_t *size,
+ return -E2BIG;
+ }
+ }
+- /*
+- * The default type of $comm should be "string", and it can't be
+- * dereferenced.
+- */
+- if (!t && strcmp(arg, "$comm") == 0)
++
++ /* Since $comm can not be dereferred, we can find $comm by strcmp */
++ if (strcmp(arg, "$comm") == 0) {
++ /* The type of $comm must be "string", and not an array. */
++ if (parg->count || (t && strcmp(t, "string")))
++ return -EINVAL;
+ parg->type = find_fetch_type("string");
+- else
++ } else
+ parg->type = find_fetch_type(t);
+ if (!parg->type) {
+ pr_info("Unsupported type: %s\n", t);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-078-memory-tegra-Fix-integer-overflow-on-tick-value.patch b/patches.kernel.org/5.1.5-078-memory-tegra-Fix-integer-overflow-on-tick-value.patch
new file mode 100644
index 0000000000..f30d216b59
--- /dev/null
+++ b/patches.kernel.org/5.1.5-078-memory-tegra-Fix-integer-overflow-on-tick-value.patch
@@ -0,0 +1,39 @@
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 01:12:48 +0300
+Subject: [PATCH] memory: tegra: Fix integer overflow on tick value calculation
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b906c056b6023c390f18347169071193fda57dde
+
+commit b906c056b6023c390f18347169071193fda57dde upstream.
+
+Multiplying the Memory Controller clock rate by the tick count results
+in an integer overflow and in result the truncated tick value is being
+programmed into hardware, such that the GR3D memory client performance is
+reduced by two times.
+
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/memory/tegra/mc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c
+index 0a53598d982f..5bd8df926052 100644
+--- a/drivers/memory/tegra/mc.c
++++ b/drivers/memory/tegra/mc.c
+@@ -282,7 +282,7 @@ static int tegra_mc_setup_latency_allowance(struct tegra_mc *mc)
+ u32 value;
+
+ /* compute the number of MC clock cycles per tick */
+- tick = mc->tick * clk_get_rate(mc->clk);
++ tick = (unsigned long long)mc->tick * clk_get_rate(mc->clk);
+ do_div(tick, NSEC_PER_SEC);
+
+ value = readl(mc->regs + MC_EMEM_ARB_CFG);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-079-perf-intel-pt-Fix-instructions-sampling-rate.patch b/patches.kernel.org/5.1.5-079-perf-intel-pt-Fix-instructions-sampling-rate.patch
new file mode 100644
index 0000000000..2ac1023975
--- /dev/null
+++ b/patches.kernel.org/5.1.5-079-perf-intel-pt-Fix-instructions-sampling-rate.patch
@@ -0,0 +1,96 @@
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 10 May 2019 15:41:41 +0300
+Subject: [PATCH] perf intel-pt: Fix instructions sampling rate
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 7ba8fa20e26eb3c0c04d747f7fd2223694eac4d5
+
+commit 7ba8fa20e26eb3c0c04d747f7fd2223694eac4d5 upstream.
+
+The timestamp used to determine if an instruction sample is made, is an
+estimate based on the number of instructions since the last known
+timestamp. A consequence is that it might go backwards, which results in
+extra samples. Change it so that a sample is only made when the
+timestamp goes forwards.
+
+Note this does not affect a sampling period of 0 or sampling periods
+specified as a count of instructions.
+
+Example:
+
+ Before:
+
+ $ perf script --itrace=i10us
+ ls 13812 [003] 2167315.222583: 3270 instructions:u: 7fac71e2e494 __GI___tunables_init+0xf4 (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 30902 instructions:u: 7fac71e2da0f _dl_cache_libcmp+0x2f (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 10 instructions:u: 7fac71e2d9ff _dl_cache_libcmp+0x1f (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 8 instructions:u: 7fac71e2d9ea _dl_cache_libcmp+0xa (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 14 instructions:u: 7fac71e2d9ea _dl_cache_libcmp+0xa (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 6 instructions:u: 7fac71e2d9ff _dl_cache_libcmp+0x1f (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 14 instructions:u: 7fac71e2d9ff _dl_cache_libcmp+0x1f (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 4 instructions:u: 7fac71e2dab2 _dl_cache_libcmp+0xd2 (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222728: 16423 instructions:u: 7fac71e2477a _dl_map_object_deps+0x1ba (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222734: 12731 instructions:u: 7fac71e27938 _dl_name_match_p+0x68 (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ...
+
+ After:
+ $ perf script --itrace=i10us
+ ls 13812 [003] 2167315.222583: 3270 instructions:u: 7fac71e2e494 __GI___tunables_init+0xf4 (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222667: 30902 instructions:u: 7fac71e2da0f _dl_cache_libcmp+0x2f (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ls 13812 [003] 2167315.222728: 16479 instructions:u: 7fac71e2477a _dl_map_object_deps+0x1ba (/lib/x86_64-linux-gnu/ld-2.28.so)
+ ...
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: f4aa081949e7b ("perf tools: Add Intel PT decoder")
+Link: http://lkml.kernel.org/r/20190510124143.27054-2-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 872fab163585..26dbf11e071a 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -888,16 +888,20 @@ static uint64_t intel_pt_next_period(struct intel_pt_decoder *decoder)
+ timestamp = decoder->timestamp + decoder->timestamp_insn_cnt;
+ masked_timestamp = timestamp & decoder->period_mask;
+ if (decoder->continuous_period) {
+- if (masked_timestamp != decoder->last_masked_timestamp)
++ if (masked_timestamp > decoder->last_masked_timestamp)
+ return 1;
+ } else {
+ timestamp += 1;
+ masked_timestamp = timestamp & decoder->period_mask;
+- if (masked_timestamp != decoder->last_masked_timestamp) {
++ if (masked_timestamp > decoder->last_masked_timestamp) {
+ decoder->last_masked_timestamp = masked_timestamp;
+ decoder->continuous_period = true;
+ }
+ }
++
++ if (masked_timestamp < decoder->last_masked_timestamp)
++ return decoder->period_ticks;
++
+ return decoder->period_ticks - (timestamp - masked_timestamp);
+ }
+
+@@ -926,7 +930,10 @@ static void intel_pt_sample_insn(struct intel_pt_decoder *decoder)
+ case INTEL_PT_PERIOD_TICKS:
+ timestamp = decoder->timestamp + decoder->timestamp_insn_cnt;
+ masked_timestamp = timestamp & decoder->period_mask;
+- decoder->last_masked_timestamp = masked_timestamp;
++ if (masked_timestamp > decoder->last_masked_timestamp)
++ decoder->last_masked_timestamp = masked_timestamp;
++ else
++ decoder->last_masked_timestamp += decoder->period_ticks;
+ break;
+ case INTEL_PT_PERIOD_NONE:
+ case INTEL_PT_PERIOD_MTC:
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-080-perf-intel-pt-Fix-improved-sample-timestamp.patch b/patches.kernel.org/5.1.5-080-perf-intel-pt-Fix-improved-sample-timestamp.patch
new file mode 100644
index 0000000000..11a4888c6a
--- /dev/null
+++ b/patches.kernel.org/5.1.5-080-perf-intel-pt-Fix-improved-sample-timestamp.patch
@@ -0,0 +1,101 @@
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 10 May 2019 15:41:42 +0300
+Subject: [PATCH] perf intel-pt: Fix improved sample timestamp
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 61b6e08dc8e3ea80b7485c9b3f875ddd45c8466b
+
+commit 61b6e08dc8e3ea80b7485c9b3f875ddd45c8466b upstream.
+
+The decoder uses its current timestamp in samples. Usually that is a
+timestamp that has already passed, but in some cases it is a timestamp
+for a branch that the decoder is walking towards, and consequently
+hasn't reached.
+
+The intel_pt_sample_time() function decides which is which, but was not
+handling TNT packets exactly correctly.
+
+In the case of TNT, the timestamp applies to the first branch, so the
+decoder must first walk to that branch.
+
+That means intel_pt_sample_time() should return true for TNT, and this
+patch makes that change. However, if the first branch is a non-taken
+branch (i.e. a 'N'), then intel_pt_sample_time() needs to return false
+for subsequent taken branches in the same TNT packet.
+
+To handle that, introduce a new state INTEL_PT_STATE_TNT_CONT to
+distinguish the cases.
+
+Note that commit 3f04d98e972b5 ("perf intel-pt: Improve sample
+timestamp") was also a stable fix and appears, for example, in v4.4
+stable tree as commit a4ebb58fd124 ("perf intel-pt: Improve sample
+timestamp").
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: stable@vger.kernel.org # v4.4+
+Fixes: 3f04d98e972b5 ("perf intel-pt: Improve sample timestamp")
+Link: http://lkml.kernel.org/r/20190510124143.27054-3-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 26dbf11e071a..9cbd587489bf 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -58,6 +58,7 @@ enum intel_pt_pkt_state {
+ INTEL_PT_STATE_NO_IP,
+ INTEL_PT_STATE_ERR_RESYNC,
+ INTEL_PT_STATE_IN_SYNC,
++ INTEL_PT_STATE_TNT_CONT,
+ INTEL_PT_STATE_TNT,
+ INTEL_PT_STATE_TIP,
+ INTEL_PT_STATE_TIP_PGD,
+@@ -72,8 +73,9 @@ static inline bool intel_pt_sample_time(enum intel_pt_pkt_state pkt_state)
+ case INTEL_PT_STATE_NO_IP:
+ case INTEL_PT_STATE_ERR_RESYNC:
+ case INTEL_PT_STATE_IN_SYNC:
+- case INTEL_PT_STATE_TNT:
++ case INTEL_PT_STATE_TNT_CONT:
+ return true;
++ case INTEL_PT_STATE_TNT:
+ case INTEL_PT_STATE_TIP:
+ case INTEL_PT_STATE_TIP_PGD:
+ case INTEL_PT_STATE_FUP:
+@@ -1261,7 +1263,9 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
+ return -ENOENT;
+ }
+ decoder->tnt.count -= 1;
+- if (!decoder->tnt.count)
++ if (decoder->tnt.count)
++ decoder->pkt_state = INTEL_PT_STATE_TNT_CONT;
++ else
+ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ decoder->tnt.payload <<= 1;
+ decoder->state.from_ip = decoder->ip;
+@@ -1292,7 +1296,9 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
+
+ if (intel_pt_insn.branch == INTEL_PT_BR_CONDITIONAL) {
+ decoder->tnt.count -= 1;
+- if (!decoder->tnt.count)
++ if (decoder->tnt.count)
++ decoder->pkt_state = INTEL_PT_STATE_TNT_CONT;
++ else
+ decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
+ if (decoder->tnt.payload & BIT63) {
+ decoder->tnt.payload <<= 1;
+@@ -2372,6 +2378,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder)
+ err = intel_pt_walk_trace(decoder);
+ break;
+ case INTEL_PT_STATE_TNT:
++ case INTEL_PT_STATE_TNT_CONT:
+ err = intel_pt_walk_tnt(decoder);
+ if (err == -EAGAIN)
+ err = intel_pt_walk_trace(decoder);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-081-perf-intel-pt-Fix-sample-timestamp-wrt-non-take.patch b/patches.kernel.org/5.1.5-081-perf-intel-pt-Fix-sample-timestamp-wrt-non-take.patch
new file mode 100644
index 0000000000..32ab60b399
--- /dev/null
+++ b/patches.kernel.org/5.1.5-081-perf-intel-pt-Fix-sample-timestamp-wrt-non-take.patch
@@ -0,0 +1,52 @@
+From: Adrian Hunter <adrian.hunter@intel.com>
+Date: Fri, 10 May 2019 15:41:43 +0300
+Subject: [PATCH] perf intel-pt: Fix sample timestamp wrt non-taken branches
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 1b6599a9d8e6c9f7e9b0476012383b1777f7fc93
+
+commit 1b6599a9d8e6c9f7e9b0476012383b1777f7fc93 upstream.
+
+The sample timestamp is updated to ensure that the timestamp represents
+the time of the sample and not a branch that the decoder is still
+walking towards. The sample timestamp is updated when the decoder
+returns, but the decoder does not return for non-taken branches. Update
+the sample timestamp then also.
+
+Note that commit 3f04d98e972b5 ("perf intel-pt: Improve sample
+timestamp") was also a stable fix and appears, for example, in v4.4
+stable tree as commit a4ebb58fd124 ("perf intel-pt: Improve sample
+timestamp").
+
+Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: stable@vger.kernel.org # v4.4+
+Fixes: 3f04d98e972b ("perf intel-pt: Improve sample timestamp")
+Link: http://lkml.kernel.org/r/20190510124143.27054-4-adrian.hunter@intel.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+index 9cbd587489bf..f4c3c84b090f 100644
+--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+@@ -1318,8 +1318,11 @@ static int intel_pt_walk_tnt(struct intel_pt_decoder *decoder)
+ return 0;
+ }
+ decoder->ip += intel_pt_insn.length;
+- if (!decoder->tnt.count)
++ if (!decoder->tnt.count) {
++ decoder->sample_timestamp = decoder->timestamp;
++ decoder->sample_insn_cnt = decoder->timestamp_insn_cnt;
+ return -EAGAIN;
++ }
+ decoder->tnt.payload <<= 1;
+ continue;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-082-MIPS-perf-Fix-build-with-CONFIG_CPU_BMIPS5000-e.patch b/patches.kernel.org/5.1.5-082-MIPS-perf-Fix-build-with-CONFIG_CPU_BMIPS5000-e.patch
new file mode 100644
index 0000000000..7096dc2242
--- /dev/null
+++ b/patches.kernel.org/5.1.5-082-MIPS-perf-Fix-build-with-CONFIG_CPU_BMIPS5000-e.patch
@@ -0,0 +1,106 @@
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 9 May 2019 11:30:47 -0700
+Subject: [PATCH] MIPS: perf: Fix build with CONFIG_CPU_BMIPS5000 enabled
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 1b1f01b653b408ebe58fec78c566d1075d285c64
+
+commit 1b1f01b653b408ebe58fec78c566d1075d285c64 upstream.
+
+arch/mips/kernel/perf_event_mipsxx.c: In function 'mipsxx_pmu_enable_event':
+arch/mips/kernel/perf_event_mipsxx.c:326:21: error: unused variable 'event' [-Werror=unused-variable]
+ struct perf_event *event = container_of(evt, struct perf_event, hw);
+ ^~~~~
+
+Fix this by making use of IS_ENABLED() to simplify the code and avoid
+unnecessary ifdefery.
+
+Fixes: 84002c88599d ("MIPS: perf: Fix perf with MT counting other threads")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Cc: linux-mips@linux-mips.org
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-kernel@vger.kernel.org
+Cc: linux-mips@vger.kernel.org
+Cc: stable@vger.kernel.org # v4.18+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/mips/kernel/perf_event_mipsxx.c | 21 +++------------------
+ 1 file changed, 3 insertions(+), 18 deletions(-)
+
+diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
+index 413863508f6f..d67fb64e908c 100644
+--- a/arch/mips/kernel/perf_event_mipsxx.c
++++ b/arch/mips/kernel/perf_event_mipsxx.c
+@@ -64,17 +64,11 @@ struct mips_perf_event {
+ #define CNTR_EVEN 0x55555555
+ #define CNTR_ODD 0xaaaaaaaa
+ #define CNTR_ALL 0xffffffff
+-#ifdef CONFIG_MIPS_MT_SMP
+ enum {
+ T = 0,
+ V = 1,
+ P = 2,
+ } range;
+-#else
+- #define T
+- #define V
+- #define P
+-#endif
+ };
+
+ static struct mips_perf_event raw_event;
+@@ -325,9 +319,7 @@ static void mipsxx_pmu_enable_event(struct hw_perf_event *evt, int idx)
+ {
+ struct perf_event *event = container_of(evt, struct perf_event, hw);
+ struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+-#ifdef CONFIG_MIPS_MT_SMP
+ unsigned int range = evt->event_base >> 24;
+-#endif /* CONFIG_MIPS_MT_SMP */
+
+ WARN_ON(idx < 0 || idx >= mipspmu.num_counters);
+
+@@ -336,21 +328,15 @@ static void mipsxx_pmu_enable_event(struct hw_perf_event *evt, int idx)
+ /* Make sure interrupt enabled. */
+ MIPS_PERFCTRL_IE;
+
+-#ifdef CONFIG_CPU_BMIPS5000
+- {
++ if (IS_ENABLED(CONFIG_CPU_BMIPS5000)) {
+ /* enable the counter for the calling thread */
+ cpuc->saved_ctrl[idx] |=
+ (1 << (12 + vpe_id())) | BRCM_PERFCTRL_TC;
+- }
+-#else
+-#ifdef CONFIG_MIPS_MT_SMP
+- if (range > V) {
++ } else if (IS_ENABLED(CONFIG_MIPS_MT_SMP) && range > V) {
+ /* The counter is processor wide. Set it up to count all TCs. */
+ pr_debug("Enabling perf counter for all TCs\n");
+ cpuc->saved_ctrl[idx] |= M_TC_EN_ALL;
+- } else
+-#endif /* CONFIG_MIPS_MT_SMP */
+- {
++ } else {
+ unsigned int cpu, ctrl;
+
+ /*
+@@ -365,7 +351,6 @@ static void mipsxx_pmu_enable_event(struct hw_perf_event *evt, int idx)
+ cpuc->saved_ctrl[idx] |= ctrl;
+ pr_debug("Enabling perf counter for CPU%d\n", cpu);
+ }
+-#endif /* CONFIG_CPU_BMIPS5000 */
+ /*
+ * We do not actually let the counter run. Leave it until start().
+ */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-083-objtool-Allow-AR-to-be-overridden-with-HOSTAR.patch b/patches.kernel.org/5.1.5-083-objtool-Allow-AR-to-be-overridden-with-HOSTAR.patch
new file mode 100644
index 0000000000..8a04522622
--- /dev/null
+++ b/patches.kernel.org/5.1.5-083-objtool-Allow-AR-to-be-overridden-with-HOSTAR.patch
@@ -0,0 +1,62 @@
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Thu, 16 May 2019 12:49:42 -0500
+Subject: [PATCH] objtool: Allow AR to be overridden with HOSTAR
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 8ea58f1e8b11cca3087b294779bf5959bf89cc10
+
+commit 8ea58f1e8b11cca3087b294779bf5959bf89cc10 upstream.
+
+Currently, this Makefile hardcodes GNU ar, meaning that if it is not
+available, there is no way to supply a different one and the build will
+fail.
+
+ $ make AR=llvm-ar CC=clang LD=ld.lld HOSTAR=llvm-ar HOSTCC=clang \
+ HOSTLD=ld.lld HOSTLDFLAGS=-fuse-ld=lld defconfig modules_prepare
+ ...
+ AR /out/tools/objtool/libsubcmd.a
+ /bin/sh: 1: ar: not found
+ ...
+
+Follow the logic of HOST{CC,LD} and allow the user to specify a
+different ar tool via HOSTAR (which is used elsewhere in other
+tools/ Makefiles).
+
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Mukesh Ojha <mojha@codeaurora.org>
+Cc: <stable@vger.kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/80822a9353926c38fd7a152991c6292491a9d0e8.1558028966.git.jpoimboe@redhat.com
+Link: https://github.com/ClangBuiltLinux/linux/issues/481
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ tools/objtool/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile
+index 53f8be0f4a1f..88158239622b 100644
+--- a/tools/objtool/Makefile
++++ b/tools/objtool/Makefile
+@@ -7,11 +7,12 @@ ARCH := x86
+ endif
+
+ # always use the host compiler
++HOSTAR ?= ar
+ HOSTCC ?= gcc
+ HOSTLD ?= ld
++AR = $(HOSTAR)
+ CC = $(HOSTCC)
+ LD = $(HOSTLD)
+-AR = ar
+
+ ifeq ($(srctree),)
+ srctree := $(patsubst %/,%,$(dir $(CURDIR)))
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-084-x86-mpx-mm-core-Fix-recursive-munmap-corruption.patch b/patches.kernel.org/5.1.5-084-x86-mpx-mm-core-Fix-recursive-munmap-corruption.patch
new file mode 100644
index 0000000000..d13ba7a607
--- /dev/null
+++ b/patches.kernel.org/5.1.5-084-x86-mpx-mm-core-Fix-recursive-munmap-corruption.patch
@@ -0,0 +1,374 @@
+From: Dave Hansen <dave.hansen@linux.intel.com>
+Date: Fri, 19 Apr 2019 12:47:47 -0700
+Subject: [PATCH] x86/mpx, mm/core: Fix recursive munmap() corruption
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 5a28fc94c9143db766d1ba5480cae82d856ad080
+
+commit 5a28fc94c9143db766d1ba5480cae82d856ad080 upstream.
+
+This is a bit of a mess, to put it mildly. But, it's a bug
+that only seems to have showed up in 4.20 but wasn't noticed
+until now, because nobody uses MPX.
+
+MPX has the arch_unmap() hook inside of munmap() because MPX
+uses bounds tables that protect other areas of memory. When
+memory is unmapped, there is also a need to unmap the MPX
+bounds tables. Barring this, unused bounds tables can eat 80%
+of the address space.
+
+But, the recursive do_munmap() that gets called vi arch_unmap()
+wreaks havoc with __do_munmap()'s state. It can result in
+freeing populated page tables, accessing bogus VMA state,
+double-freed VMAs and more.
+
+See the "long story" further below for the gory details.
+
+To fix this, call arch_unmap() before __do_unmap() has a chance
+to do anything meaningful. Also, remove the 'vma' argument
+and force the MPX code to do its own, independent VMA lookup.
+
+== UML / unicore32 impact ==
+
+Remove unused 'vma' argument to arch_unmap(). No functional
+change.
+
+I compile tested this on UML but not unicore32.
+
+== powerpc impact ==
+
+powerpc uses arch_unmap() well to watch for munmap() on the
+VDSO and zeroes out 'current->mm->context.vdso_base'. Moving
+arch_unmap() makes this happen earlier in __do_munmap(). But,
+'vdso_base' seems to only be used in perf and in the signal
+delivery that happens near the return to userspace. I can not
+find any likely impact to powerpc, other than the zeroing
+happening a little earlier.
+
+powerpc does not use the 'vma' argument and is unaffected by
+its removal.
+
+I compile-tested a 64-bit powerpc defconfig.
+
+== x86 impact ==
+
+For the common success case this is functionally identical to
+what was there before. For the munmap() failure case, it's
+possible that some MPX tables will be zapped for memory that
+continues to be in use. But, this is an extraordinarily
+unlikely scenario and the harm would be that MPX provides no
+protection since the bounds table got reset (zeroed).
+
+I can't imagine anyone doing this:
+
+ ptr = mmap();
+ // use ptr
+ ret = munmap(ptr);
+ if (ret)
+ // oh, there was an error, I'll
+ // keep using ptr.
+
+Because if you're doing munmap(), you are *done* with the
+memory. There's probably no good data in there _anyway_.
+
+This passes the original reproducer from Richard Biener as
+well as the existing mpx selftests/.
+
+The long story:
+
+munmap() has a couple of pieces:
+
+ 1. Find the affected VMA(s)
+ 2. Split the start/end one(s) if neceesary
+ 3. Pull the VMAs out of the rbtree
+ 4. Actually zap the memory via unmap_region(), including
+ freeing page tables (or queueing them to be freed).
+ 5. Fix up some of the accounting (like fput()) and actually
+ free the VMA itself.
+
+This specific ordering was actually introduced by:
+
+ dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
+
+during the 4.20 merge window. The previous __do_munmap() code
+was actually safe because the only thing after arch_unmap() was
+remove_vma_list(). arch_unmap() could not see 'vma' in the
+rbtree because it was detached, so it is not even capable of
+doing operations unsafe for remove_vma_list()'s use of 'vma'.
+
+Richard Biener reported a test that shows this in dmesg:
+
+ [1216548.787498] BUG: Bad rss-counter state mm:0000000017ce560b idx:1 val:551
+ [1216548.787500] BUG: non-zero pgtables_bytes on freeing mm: 24576
+
+What triggered this was the recursive do_munmap() called via
+arch_unmap(). It was freeing page tables that has not been
+properly zapped.
+
+But, the problem was bigger than this. For one, arch_unmap()
+can free VMAs. But, the calling __do_munmap() has variables
+that *point* to VMAs and obviously can't handle them just
+getting freed while the pointer is still in use.
+
+I tried a couple of things here. First, I tried to fix the page
+table freeing problem in isolation, but I then found the VMA
+issue. I also tried having the MPX code return a flag if it
+modified the rbtree which would force __do_munmap() to re-walk
+to restart. That spiralled out of control in complexity pretty
+fast.
+
+Just moving arch_unmap() and accepting that the bonkers failure
+case might eat some bounds tables seems like the simplest viable
+fix.
+
+This was also reported in the following kernel bugzilla entry:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=203123
+
+There are some reports that this commit triggered this bug:
+
+ dd2283f2605 ("mm: mmap: zap pages with read mmap_sem in munmap")
+
+While that commit certainly made the issues easier to hit, I believe
+the fundamental issue has been with us as long as MPX itself, thus
+the Fixes: tag below is for one of the original MPX commits.
+
+[ mingo: Minor edits to the changelog and the patch. ]
+
+Reported-by: Richard Biener <rguenther@suse.de>
+Reported-by: H.J. Lu <hjl.tools@gmail.com>
+Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
+Reviewed-by Thomas Gleixner <tglx@linutronix.de>
+Reviewed-by: Yang Shi <yang.shi@linux.alibaba.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
+Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: Guan Xuetao <gxt@pku.edu.cn>
+Cc: H. Peter Anvin <hpa@zytor.com>
+Cc: Jeff Dike <jdike@addtoit.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Paul Mackerras <paulus@samba.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Richard Weinberger <richard@nod.at>
+Cc: Rik van Riel <riel@surriel.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Cc: linux-arch@vger.kernel.org
+Cc: linux-mm@kvack.org
+Cc: linux-um@lists.infradead.org
+Cc: linuxppc-dev@lists.ozlabs.org
+Cc: stable@vger.kernel.org
+Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
+Link: http://lkml.kernel.org/r/20190419194747.5E1AD6DC@viggo.jf.intel.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/powerpc/include/asm/mmu_context.h | 1 -
+ arch/um/include/asm/mmu_context.h | 1 -
+ arch/unicore32/include/asm/mmu_context.h | 1 -
+ arch/x86/include/asm/mmu_context.h | 6 +++---
+ arch/x86/include/asm/mpx.h | 15 ++++++++-------
+ arch/x86/mm/mpx.c | 10 ++++++----
+ include/asm-generic/mm_hooks.h | 1 -
+ mm/mmap.c | 15 ++++++++-------
+ 8 files changed, 25 insertions(+), 25 deletions(-)
+
+diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
+index 6ee8195a2ffb..4a6dd3ba0b0b 100644
+--- a/arch/powerpc/include/asm/mmu_context.h
++++ b/arch/powerpc/include/asm/mmu_context.h
+@@ -237,7 +237,6 @@ extern void arch_exit_mmap(struct mm_struct *mm);
+ #endif
+
+ static inline void arch_unmap(struct mm_struct *mm,
+- struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
+ if (start <= mm->context.vdso_base && mm->context.vdso_base < end)
+diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h
+index fca34b2177e2..9f4b4bb78120 100644
+--- a/arch/um/include/asm/mmu_context.h
++++ b/arch/um/include/asm/mmu_context.h
+@@ -22,7 +22,6 @@ static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
+ }
+ extern void arch_exit_mmap(struct mm_struct *mm);
+ static inline void arch_unmap(struct mm_struct *mm,
+- struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
+ }
+diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h
+index 5c205a9cb5a6..9f06ea5466dd 100644
+--- a/arch/unicore32/include/asm/mmu_context.h
++++ b/arch/unicore32/include/asm/mmu_context.h
+@@ -88,7 +88,6 @@ static inline int arch_dup_mmap(struct mm_struct *oldmm,
+ }
+
+ static inline void arch_unmap(struct mm_struct *mm,
+- struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
+ }
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 19d18fae6ec6..41019af68adf 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -277,8 +277,8 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm,
+ mpx_mm_init(mm);
+ }
+
+-static inline void arch_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
+- unsigned long start, unsigned long end)
++static inline void arch_unmap(struct mm_struct *mm, unsigned long start,
++ unsigned long end)
+ {
+ /*
+ * mpx_notify_unmap() goes and reads a rarely-hot
+@@ -298,7 +298,7 @@ static inline void arch_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
+ * consistently wrong.
+ */
+ if (unlikely(cpu_feature_enabled(X86_FEATURE_MPX)))
+- mpx_notify_unmap(mm, vma, start, end);
++ mpx_notify_unmap(mm, start, end);
+ }
+
+ /*
+diff --git a/arch/x86/include/asm/mpx.h b/arch/x86/include/asm/mpx.h
+index d0b1434fb0b6..143a5c193ed3 100644
+--- a/arch/x86/include/asm/mpx.h
++++ b/arch/x86/include/asm/mpx.h
+@@ -64,12 +64,15 @@ struct mpx_fault_info {
+ };
+
+ #ifdef CONFIG_X86_INTEL_MPX
+-int mpx_fault_info(struct mpx_fault_info *info, struct pt_regs *regs);
+-int mpx_handle_bd_fault(void);
++
++extern int mpx_fault_info(struct mpx_fault_info *info, struct pt_regs *regs);
++extern int mpx_handle_bd_fault(void);
++
+ static inline int kernel_managing_mpx_tables(struct mm_struct *mm)
+ {
+ return (mm->context.bd_addr != MPX_INVALID_BOUNDS_DIR);
+ }
++
+ static inline void mpx_mm_init(struct mm_struct *mm)
+ {
+ /*
+@@ -78,11 +81,10 @@ static inline void mpx_mm_init(struct mm_struct *mm)
+ */
+ mm->context.bd_addr = MPX_INVALID_BOUNDS_DIR;
+ }
+-void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
+- unsigned long start, unsigned long end);
+
+-unsigned long mpx_unmapped_area_check(unsigned long addr, unsigned long len,
+- unsigned long flags);
++extern void mpx_notify_unmap(struct mm_struct *mm, unsigned long start, unsigned long end);
++extern unsigned long mpx_unmapped_area_check(unsigned long addr, unsigned long len, unsigned long flags);
++
+ #else
+ static inline int mpx_fault_info(struct mpx_fault_info *info, struct pt_regs *regs)
+ {
+@@ -100,7 +102,6 @@ static inline void mpx_mm_init(struct mm_struct *mm)
+ {
+ }
+ static inline void mpx_notify_unmap(struct mm_struct *mm,
+- struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
+ }
+diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
+index c805db6236b4..7aeb9fe2955f 100644
+--- a/arch/x86/mm/mpx.c
++++ b/arch/x86/mm/mpx.c
+@@ -881,9 +881,10 @@ static int mpx_unmap_tables(struct mm_struct *mm,
+ * the virtual address region start...end have already been split if
+ * necessary, and the 'vma' is the first vma in this range (start -> end).
+ */
+-void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
+- unsigned long start, unsigned long end)
++void mpx_notify_unmap(struct mm_struct *mm, unsigned long start,
++ unsigned long end)
+ {
++ struct vm_area_struct *vma;
+ int ret;
+
+ /*
+@@ -902,11 +903,12 @@ void mpx_notify_unmap(struct mm_struct *mm, struct vm_area_struct *vma,
+ * which should not occur normally. Being strict about it here
+ * helps ensure that we do not have an exploitable stack overflow.
+ */
+- do {
++ vma = find_vma(mm, start);
++ while (vma && vma->vm_start < end) {
+ if (vma->vm_flags & VM_MPX)
+ return;
+ vma = vma->vm_next;
+- } while (vma && vma->vm_start < end);
++ }
+
+ ret = mpx_unmap_tables(mm, start, end);
+ if (ret)
+diff --git a/include/asm-generic/mm_hooks.h b/include/asm-generic/mm_hooks.h
+index 8ac4e68a12f0..6736ed2f632b 100644
+--- a/include/asm-generic/mm_hooks.h
++++ b/include/asm-generic/mm_hooks.h
+@@ -18,7 +18,6 @@ static inline void arch_exit_mmap(struct mm_struct *mm)
+ }
+
+ static inline void arch_unmap(struct mm_struct *mm,
+- struct vm_area_struct *vma,
+ unsigned long start, unsigned long end)
+ {
+ }
+diff --git a/mm/mmap.c b/mm/mmap.c
+index bd7b9f293b39..2d6a6662edb9 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2735,9 +2735,17 @@ int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
+ return -EINVAL;
+
+ len = PAGE_ALIGN(len);
++ end = start + len;
+ if (len == 0)
+ return -EINVAL;
+
++ /*
++ * arch_unmap() might do unmaps itself. It must be called
++ * and finish any rbtree manipulation before this code
++ * runs and also starts to manipulate the rbtree.
++ */
++ arch_unmap(mm, start, end);
++
+ /* Find the first overlapping VMA */
+ vma = find_vma(mm, start);
+ if (!vma)
+@@ -2746,7 +2754,6 @@ int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
+ /* we have start < vma->vm_end */
+
+ /* if it doesn't overlap, we have nothing.. */
+- end = start + len;
+ if (vma->vm_start >= end)
+ return 0;
+
+@@ -2816,12 +2823,6 @@ int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
+ /* Detach vmas from rbtree */
+ detach_vmas_to_be_unmapped(mm, vma, prev, end);
+
+- /*
+- * mpx unmap needs to be called with mmap_sem held for write.
+- * It is safe to call it before unmap_region().
+- */
+- arch_unmap(mm, vma, start, end);
+-
+ if (downgrade)
+ downgrade_write(&mm->mmap_sem);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-085-fbdev-efifb-Ignore-framebuffer-memmap-entries-t.patch b/patches.kernel.org/5.1.5-085-fbdev-efifb-Ignore-framebuffer-memmap-entries-t.patch
new file mode 100644
index 0000000000..91e8d3eaca
--- /dev/null
+++ b/patches.kernel.org/5.1.5-085-fbdev-efifb-Ignore-framebuffer-memmap-entries-t.patch
@@ -0,0 +1,81 @@
+From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Date: Thu, 16 May 2019 23:31:59 +0200
+Subject: [PATCH] fbdev/efifb: Ignore framebuffer memmap entries that lack any
+ memory types
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: f8585539df0a1527c78b5d760665c89fe1c105a9
+
+commit f8585539df0a1527c78b5d760665c89fe1c105a9 upstream.
+
+The following commit:
+
+ 38ac0287b7f4 ("fbdev/efifb: Honour UEFI memory map attributes when mapping the FB")
+
+updated the EFI framebuffer code to use memory mappings for the linear
+framebuffer that are permitted by the memory attributes described by the
+EFI memory map for the particular region, if the framebuffer happens to
+be covered by the EFI memory map (which is typically only the case for
+framebuffers in shared memory). This is required since non-x86 systems
+may require cacheable attributes for memory mappings that are shared
+with other masters (such as GPUs), and this information cannot be
+described by the Graphics Output Protocol (GOP) EFI protocol itself,
+and so we rely on the EFI memory map for this.
+
+As reported by James, this breaks some x86 systems:
+
+ [ 1.173368] efifb: probing for efifb
+ [ 1.173386] efifb: abort, cannot remap video memory 0x1d5000 @ 0xcf800000
+ [ 1.173395] Trying to free nonexistent resource <00000000cf800000-00000000cf9d4bff>
+ [ 1.173413] efi-framebuffer: probe of efi-framebuffer.0 failed with error -5
+
+The problem turns out to be that the memory map entry that describes the
+framebuffer has no memory attributes listed at all, and so we end up with
+a mem_flags value of 0x0.
+
+So work around this by ensuring that the memory map entry's attribute field
+has a sane value before using it to mask the set of usable attributes.
+
+Reported-by: James Hilliard <james.hilliard1@gmail.com>
+Tested-by: James Hilliard <james.hilliard1@gmail.com>
+Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Cc: <stable@vger.kernel.org> # v4.19+
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: James Morse <james.morse@arm.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matt Fleming <matt@codeblueprint.co.uk>
+Cc: Peter Jones <pjones@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: linux-efi@vger.kernel.org
+Fixes: 38ac0287b7f4 ("fbdev/efifb: Honour UEFI memory map attributes when ...")
+Link: http://lkml.kernel.org/r/20190516213159.3530-2-ard.biesheuvel@linaro.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/efifb.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c
+index ba906876cc45..fd02e8a4841d 100644
+--- a/drivers/video/fbdev/efifb.c
++++ b/drivers/video/fbdev/efifb.c
+@@ -476,8 +476,12 @@ static int efifb_probe(struct platform_device *dev)
+ * If the UEFI memory map covers the efifb region, we may only
+ * remap it using the attributes the memory map prescribes.
+ */
+- mem_flags |= EFI_MEMORY_WT | EFI_MEMORY_WB;
+- mem_flags &= md.attribute;
++ md.attribute &= EFI_MEMORY_UC | EFI_MEMORY_WC |
++ EFI_MEMORY_WT | EFI_MEMORY_WB;
++ if (md.attribute) {
++ mem_flags |= EFI_MEMORY_WT | EFI_MEMORY_WB;
++ mem_flags &= md.attribute;
++ }
+ }
+ if (mem_flags & EFI_MEMORY_WC)
+ info->screen_base = ioremap_wc(efifb_fix.smem_start,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-086-fbdev-sm712fb-fix-brightness-control-on-reboot-.patch b/patches.kernel.org/5.1.5-086-fbdev-sm712fb-fix-brightness-control-on-reboot-.patch
new file mode 100644
index 0000000000..1a81b49089
--- /dev/null
+++ b/patches.kernel.org/5.1.5-086-fbdev-sm712fb-fix-brightness-control-on-reboot-.patch
@@ -0,0 +1,52 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:58 +0200
+Subject: [PATCH] fbdev: sm712fb: fix brightness control on reboot, don't set
+ SR30
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 5481115e25e42b9215f2619452aa99c95f08492f
+
+commit 5481115e25e42b9215f2619452aa99c95f08492f upstream.
+
+On a Thinkpad s30 (Pentium III / i440MX, Lynx3DM), rebooting with
+sm712fb framebuffer driver would cause the role of brightness up/down
+button to swap.
+
+Experiments showed the FPR30 register caused this behavior. Moreover,
+even if this register don't have side-effect on other systems, over-
+writing it is also highly questionable, since it was originally
+configurated by the motherboard manufacturer by hardwiring pull-down
+resistors to indicate the type of LCD panel. We should not mess with
+it.
+
+Stop writing to the SR30 (a.k.a FPR30) register.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 502d0de2feec..1fd7ae6cffd3 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1145,8 +1145,8 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb)
+
+ /* init SEQ register SR30 - SR75 */
+ for (i = 0; i < SIZE_SR30_SR75; i++)
+- if ((i + 0x30) != 0x62 && (i + 0x30) != 0x6a &&
+- (i + 0x30) != 0x6b)
++ if ((i + 0x30) != 0x30 && (i + 0x30) != 0x62 &&
++ (i + 0x30) != 0x6a && (i + 0x30) != 0x6b)
+ smtc_seqw(i + 0x30,
+ vgamode[j].init_sr30_sr75[i]);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-087-fbdev-sm712fb-fix-VRAM-detection-don-t-set-SR70.patch b/patches.kernel.org/5.1.5-087-fbdev-sm712fb-fix-VRAM-detection-don-t-set-SR70.patch
new file mode 100644
index 0000000000..42b4012fe8
--- /dev/null
+++ b/patches.kernel.org/5.1.5-087-fbdev-sm712fb-fix-VRAM-detection-don-t-set-SR70.patch
@@ -0,0 +1,49 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:58 +0200
+Subject: [PATCH] fbdev: sm712fb: fix VRAM detection, don't set SR70/71/74/75
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: dcf9070595e100942c539e229dde4770aaeaa4e9
+
+commit dcf9070595e100942c539e229dde4770aaeaa4e9 upstream.
+
+On a Thinkpad s30 (Pentium III / i440MX, Lynx3DM), the amount of Video
+RAM is not detected correctly by the xf86-video-siliconmotion driver.
+This is because sm712fb overwrites the GPR71 Scratch Pad Register, which
+is set by BIOS on x86 and used to indicate amount of VRAM.
+
+Other Scratch Pad Registers, including GPR70/74/75, don't have the same
+side-effect, but overwriting to them is still questionable, as they are
+not related to modesetting.
+
+Stop writing to SR70/71/74/75 (a.k.a GPR70/71/74/75).
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 1fd7ae6cffd3..1199895f5c34 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1146,7 +1146,9 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb)
+ /* init SEQ register SR30 - SR75 */
+ for (i = 0; i < SIZE_SR30_SR75; i++)
+ if ((i + 0x30) != 0x30 && (i + 0x30) != 0x62 &&
+- (i + 0x30) != 0x6a && (i + 0x30) != 0x6b)
++ (i + 0x30) != 0x6a && (i + 0x30) != 0x6b &&
++ (i + 0x30) != 0x70 && (i + 0x30) != 0x71 &&
++ (i + 0x30) != 0x74 && (i + 0x30) != 0x75)
+ smtc_seqw(i + 0x30,
+ vgamode[j].init_sr30_sr75[i]);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-088-fbdev-sm712fb-fix-white-screen-of-death-on-rebo.patch b/patches.kernel.org/5.1.5-088-fbdev-sm712fb-fix-white-screen-of-death-on-rebo.patch
new file mode 100644
index 0000000000..509027c575
--- /dev/null
+++ b/patches.kernel.org/5.1.5-088-fbdev-sm712fb-fix-white-screen-of-death-on-rebo.patch
@@ -0,0 +1,57 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:58 +0200
+Subject: [PATCH] fbdev: sm712fb: fix white screen of death on reboot, don't
+ set CR3B-CR3F
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 8069053880e0ee3a75fd6d7e0a30293265fe3de4
+
+commit 8069053880e0ee3a75fd6d7e0a30293265fe3de4 upstream.
+
+On a Thinkpad s30 (Pentium III / i440MX, Lynx3DM), rebooting with
+sm712fb framebuffer driver would cause a white screen of death on
+the next POST, presumably the proper timings for the LCD panel was
+not reprogrammed properly by the BIOS.
+
+Experiments showed a few CRTC Scratch Registers, including CRT3D,
+CRT3E and CRT3F may be used internally by BIOS as some flags. CRT3B is
+a hardware testing register, we shouldn't mess with it. CRT3C has
+blanking signal and line compare control, which is not needed for this
+driver.
+
+Stop writing to CR3B-CR3F (a.k.a CRT3B-CRT3F) registers. Even if these
+registers don't have side-effect on other systems, writing to them is
+also highly questionable.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 1199895f5c34..1a3d232c2916 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1173,8 +1173,12 @@ static void sm7xx_set_timing(struct smtcfb_info *sfb)
+ smtc_crtcw(i, vgamode[j].init_cr00_cr18[i]);
+
+ /* init CRTC register CR30 - CR4D */
+- for (i = 0; i < SIZE_CR30_CR4D; i++)
++ for (i = 0; i < SIZE_CR30_CR4D; i++) {
++ if ((i + 0x30) >= 0x3B && (i + 0x30) <= 0x3F)
++ /* side-effect, don't write to CR3B-CR3F */
++ continue;
+ smtc_crtcw(i + 0x30, vgamode[j].init_cr30_cr4d[i]);
++ }
+
+ /* init CRTC register CR90 - CRA7 */
+ for (i = 0; i < SIZE_CR90_CRA7; i++)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-089-fbdev-sm712fb-fix-boot-screen-glitch-when-sm712.patch b/patches.kernel.org/5.1.5-089-fbdev-sm712fb-fix-boot-screen-glitch-when-sm712.patch
new file mode 100644
index 0000000000..5a69cbb869
--- /dev/null
+++ b/patches.kernel.org/5.1.5-089-fbdev-sm712fb-fix-boot-screen-glitch-when-sm712.patch
@@ -0,0 +1,47 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:59 +0200
+Subject: [PATCH] fbdev: sm712fb: fix boot screen glitch when sm712fb replaces
+ VGA
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: ec1587d5073f29820e358f3a383850d61601d981
+
+commit ec1587d5073f29820e358f3a383850d61601d981 upstream.
+
+When the machine is booted in VGA mode, loading sm712fb would cause
+a glitch of random pixels shown on the screen. To prevent it from
+happening, we first clear the entire framebuffer, and we also need
+to stop calling smtcfb_setmode() during initialization, the fbdev
+layer will call it for us later when it's ready.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 1a3d232c2916..e8149f0f47d5 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1493,7 +1493,11 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ if (err)
+ goto failed;
+
+- smtcfb_setmode(sfb);
++ /*
++ * The screen would be temporarily garbled when sm712fb takes over
++ * vesafb or VGA text mode. Zero the framebuffer.
++ */
++ memset_io(sfb->lfb, 0, sfb->fb->fix.smem_len);
+
+ err = register_framebuffer(info);
+ if (err < 0)
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-090-fbdev-sm712fb-fix-crashes-during-framebuffer-wr.patch b/patches.kernel.org/5.1.5-090-fbdev-sm712fb-fix-crashes-during-framebuffer-wr.patch
new file mode 100644
index 0000000000..0703a4a3b3
--- /dev/null
+++ b/patches.kernel.org/5.1.5-090-fbdev-sm712fb-fix-crashes-during-framebuffer-wr.patch
@@ -0,0 +1,155 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:59 +0200
+Subject: [PATCH] fbdev: sm712fb: fix crashes during framebuffer writes by
+ correctly mapping VRAM
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 9e0e59993df0601cddb95c4f6c61aa3d5e753c00
+
+commit 9e0e59993df0601cddb95c4f6c61aa3d5e753c00 upstream.
+
+On a Thinkpad s30 (Pentium III / i440MX, Lynx3DM), running fbtest or X
+will crash the machine instantly, because the VRAM/framebuffer is not
+mapped correctly.
+
+On SM712, the framebuffer starts at the beginning of address space, but
+SM720's framebuffer starts at the 1 MiB offset from the beginning. However,
+sm712fb fails to take this into account, as a result, writing to the
+framebuffer will destroy all the registers and kill the system immediately.
+Another problem is the driver assumes 8 MiB of VRAM for SM720, but some
+SM720 system, such as this IBM Thinkpad, only has 4 MiB of VRAM.
+
+Fix this problem by removing the hardcoded VRAM size, adding a function to
+query the amount of VRAM from register MCR76 on SM720, and adding proper
+framebuffer offset.
+
+Please note that the memory map may have additional problems on Big-Endian
+system, which is not available for testing by myself. But I highly suspect
+that the original code is also broken on Big-Endian machines for SM720, so
+at least we are not making the problem worse. More, the driver also assumed
+SM710/SM712 has 4 MiB of VRAM, but it has a 2 MiB version as well, and used
+in earlier laptops, such as IBM Thinkpad 240X, the driver would probably
+crash on them. I've never seen one of those machines and cannot fix it, but
+I have documented these problems in the comments.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712.h | 5 ----
+ drivers/video/fbdev/sm712fb.c | 48 ++++++++++++++++++++++++++++++++---
+ 2 files changed, 44 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712.h b/drivers/video/fbdev/sm712.h
+index aad1cc4be34a..2cba1e73ed24 100644
+--- a/drivers/video/fbdev/sm712.h
++++ b/drivers/video/fbdev/sm712.h
+@@ -19,11 +19,6 @@
+ #define SCREEN_Y_RES 600
+ #define SCREEN_BPP 16
+
+-/*Assume SM712 graphics chip has 4MB VRAM */
+-#define SM712_VIDEOMEMORYSIZE 0x00400000
+-/*Assume SM722 graphics chip has 8MB VRAM */
+-#define SM722_VIDEOMEMORYSIZE 0x00800000
+-
+ #define dac_reg (0x3c8)
+ #define dac_val (0x3c9)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index e8149f0f47d5..52234c57be02 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1329,6 +1329,11 @@ static int smtc_map_smem(struct smtcfb_info *sfb,
+ {
+ sfb->fb->fix.smem_start = pci_resource_start(pdev, 0);
+
++ if (sfb->chip_id == 0x720)
++ /* on SM720, the framebuffer starts at the 1 MB offset */
++ sfb->fb->fix.smem_start += 0x00200000;
++
++ /* XXX: is it safe for SM720 on Big-Endian? */
+ if (sfb->fb->var.bits_per_pixel == 32)
+ sfb->fb->fix.smem_start += big_addr;
+
+@@ -1366,12 +1371,45 @@ static inline void sm7xx_init_hw(void)
+ outb_p(0x11, 0x3c5);
+ }
+
++static u_long sm7xx_vram_probe(struct smtcfb_info *sfb)
++{
++ u8 vram;
++
++ switch (sfb->chip_id) {
++ case 0x710:
++ case 0x712:
++ /*
++ * Assume SM712 graphics chip has 4MB VRAM.
++ *
++ * FIXME: SM712 can have 2MB VRAM, which is used on earlier
++ * laptops, such as IBM Thinkpad 240X. This driver would
++ * probably crash on those machines. If anyone gets one of
++ * those and is willing to help, run "git blame" and send me
++ * an E-mail.
++ */
++ return 0x00400000;
++ case 0x720:
++ outb_p(0x76, 0x3c4);
++ vram = inb_p(0x3c5) >> 6;
++
++ if (vram == 0x00)
++ return 0x00800000; /* 8 MB */
++ else if (vram == 0x01)
++ return 0x01000000; /* 16 MB */
++ else if (vram == 0x02)
++ return 0x00400000; /* illegal, fallback to 4 MB */
++ else if (vram == 0x03)
++ return 0x00400000; /* 4 MB */
++ }
++ return 0; /* unknown hardware */
++}
++
+ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+ struct smtcfb_info *sfb;
+ struct fb_info *info;
+- u_long smem_size = 0x00800000; /* default 8MB */
++ u_long smem_size;
+ int err;
+ unsigned long mmio_base;
+
+@@ -1428,12 +1466,15 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ mmio_base = pci_resource_start(pdev, 0);
+ pci_read_config_byte(pdev, PCI_REVISION_ID, &sfb->chip_rev_id);
+
++ smem_size = sm7xx_vram_probe(sfb);
++ dev_info(&pdev->dev, "%lu MiB of VRAM detected.\n",
++ smem_size / 1048576);
++
+ switch (sfb->chip_id) {
+ case 0x710:
+ case 0x712:
+ sfb->fb->fix.mmio_start = mmio_base + 0x00400000;
+ sfb->fb->fix.mmio_len = 0x00400000;
+- smem_size = SM712_VIDEOMEMORYSIZE;
+ sfb->lfb = ioremap(mmio_base, mmio_addr);
+ if (!sfb->lfb) {
+ dev_err(&pdev->dev,
+@@ -1465,8 +1506,7 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ case 0x720:
+ sfb->fb->fix.mmio_start = mmio_base;
+ sfb->fb->fix.mmio_len = 0x00200000;
+- smem_size = SM722_VIDEOMEMORYSIZE;
+- sfb->dp_regs = ioremap(mmio_base, 0x00a00000);
++ sfb->dp_regs = ioremap(mmio_base, 0x00200000 + smem_size);
+ sfb->lfb = sfb->dp_regs + 0x00200000;
+ sfb->mmio = (smtc_regbaseaddress =
+ sfb->dp_regs + 0x000c0000);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-091-fbdev-sm712fb-fix-support-for-1024x768-16-mode.patch b/patches.kernel.org/5.1.5-091-fbdev-sm712fb-fix-support-for-1024x768-16-mode.patch
new file mode 100644
index 0000000000..76df86f833
--- /dev/null
+++ b/patches.kernel.org/5.1.5-091-fbdev-sm712fb-fix-support-for-1024x768-16-mode.patch
@@ -0,0 +1,100 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:59 +0200
+Subject: [PATCH] fbdev: sm712fb: fix support for 1024x768-16 mode
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 6053d3a4793e5bde6299ac5388e76a3bf679ff65
+
+commit 6053d3a4793e5bde6299ac5388e76a3bf679ff65 upstream.
+
+In order to support the 1024x600 panel on Yeeloong Loongson MIPS
+laptop, the original 1024x768-16 table was modified to 1024x600-16,
+without leaving the original. It causes problem on x86 laptop as
+the 1024x768-16 support was still claimed but not working.
+
+Fix it by introducing the 1024x768-16 mode.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 59 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 59 insertions(+)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 52234c57be02..c772c08db294 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -530,6 +530,65 @@ static const struct modeinit vgamode[] = {
+ 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
+ },
+ },
++ { /* 1024 x 768 16Bpp 60Hz */
++ 1024, 768, 16, 60,
++ /* Init_MISC */
++ 0xEB,
++ { /* Init_SR0_SR4 */
++ 0x03, 0x01, 0x0F, 0x03, 0x0E,
++ },
++ { /* Init_SR10_SR24 */
++ 0xF3, 0xB6, 0xC0, 0xDD, 0x00, 0x0E, 0x17, 0x2C,
++ 0x99, 0x02, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0xC4, 0x30, 0x02, 0x01, 0x01,
++ },
++ { /* Init_SR30_SR75 */
++ 0x38, 0x03, 0x20, 0x09, 0xC0, 0x3A, 0x3A, 0x3A,
++ 0x3A, 0x3A, 0x3A, 0x3A, 0x00, 0x00, 0x03, 0xFF,
++ 0x00, 0xFC, 0x00, 0x00, 0x20, 0x18, 0x00, 0xFC,
++ 0x20, 0x0C, 0x44, 0x20, 0x00, 0x00, 0x00, 0x3A,
++ 0x06, 0x68, 0xA7, 0x7F, 0x83, 0x24, 0xFF, 0x03,
++ 0x0F, 0x60, 0x59, 0x3A, 0x3A, 0x00, 0x00, 0x3A,
++ 0x01, 0x80, 0x7E, 0x1A, 0x1A, 0x00, 0x00, 0x00,
++ 0x50, 0x03, 0x74, 0x14, 0x3B, 0x0D, 0x09, 0x02,
++ 0x04, 0x45, 0x30, 0x30, 0x40, 0x20,
++ },
++ { /* Init_SR80_SR93 */
++ 0xFF, 0x07, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x3A,
++ 0xF7, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x3A, 0x3A,
++ 0x00, 0x00, 0x00, 0x00,
++ },
++ { /* Init_SRA0_SRAF */
++ 0x00, 0xFB, 0x9F, 0x01, 0x00, 0xED, 0xED, 0xED,
++ 0x7B, 0xFB, 0xFF, 0xFF, 0x97, 0xEF, 0xBF, 0xDF,
++ },
++ { /* Init_GR00_GR08 */
++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x05, 0x0F,
++ 0xFF,
++ },
++ { /* Init_AR00_AR14 */
++ 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
++ 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
++ 0x41, 0x00, 0x0F, 0x00, 0x00,
++ },
++ { /* Init_CR00_CR18 */
++ 0xA3, 0x7F, 0x7F, 0x00, 0x85, 0x16, 0x24, 0xF5,
++ 0x00, 0x60, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
++ 0x03, 0x09, 0xFF, 0x80, 0x40, 0xFF, 0x00, 0xE3,
++ 0xFF,
++ },
++ { /* Init_CR30_CR4D */
++ 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x02, 0x20,
++ 0x00, 0x00, 0x00, 0x40, 0x00, 0xFF, 0xBF, 0xFF,
++ 0xA3, 0x7F, 0x00, 0x86, 0x15, 0x24, 0xFF, 0x00,
++ 0x01, 0x07, 0xE5, 0x20, 0x7F, 0xFF,
++ },
++ { /* Init_CR90_CRA7 */
++ 0x55, 0xD9, 0x5D, 0xE1, 0x86, 0x1B, 0x8E, 0x26,
++ 0xDA, 0x8D, 0xDE, 0x94, 0x00, 0x00, 0x18, 0x00,
++ 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x15, 0x03,
++ },
++ },
+ { /* mode#5: 1024 x 768 24Bpp 60Hz */
+ 1024, 768, 24, 60,
+ /* Init_MISC */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-092-fbdev-sm712fb-use-1024x768-by-default-on-non-MI.patch b/patches.kernel.org/5.1.5-092-fbdev-sm712fb-use-1024x768-by-default-on-non-MI.patch
new file mode 100644
index 0000000000..e994ca8e1e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-092-fbdev-sm712fb-use-1024x768-by-default-on-non-MI.patch
@@ -0,0 +1,132 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:59 +0200
+Subject: [PATCH] fbdev: sm712fb: use 1024x768 by default on non-MIPS, fix
+ garbled display
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 4ed7d2ccb7684510ec5f7a8f7ef534bc6a3d55b2
+
+commit 4ed7d2ccb7684510ec5f7a8f7ef534bc6a3d55b2 upstream.
+
+Loongson MIPS netbooks use 1024x600 LCD panels, which is the original
+target platform of this driver, but nearly all old x86 laptops have
+1024x768. Lighting 768 panels using 600's timings would partially
+garble the display. Since it's not possible to distinguish them reliably,
+we change the default to 768, but keep 600 as-is on MIPS.
+
+Further, earlier laptops, such as IBM Thinkpad 240X, has a 800x600 LCD
+panel, this driver would probably garbled those display. As we don't
+have one for testing, the original behavior of the driver is kept as-is,
+but the problem has been documented is the comments.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712.h | 7 +++--
+ drivers/video/fbdev/sm712fb.c | 53 ++++++++++++++++++++++++++---------
+ 2 files changed, 44 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712.h b/drivers/video/fbdev/sm712.h
+index 2cba1e73ed24..c7ebf03b8d53 100644
+--- a/drivers/video/fbdev/sm712.h
++++ b/drivers/video/fbdev/sm712.h
+@@ -15,9 +15,10 @@
+
+ #define FB_ACCEL_SMI_LYNX 88
+
+-#define SCREEN_X_RES 1024
+-#define SCREEN_Y_RES 600
+-#define SCREEN_BPP 16
++#define SCREEN_X_RES 1024
++#define SCREEN_Y_RES_PC 768
++#define SCREEN_Y_RES_NETBOOK 600
++#define SCREEN_BPP 16
+
+ #define dac_reg (0x3c8)
+ #define dac_val (0x3c9)
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index c772c08db294..0d03ea09849f 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -1463,6 +1463,43 @@ static u_long sm7xx_vram_probe(struct smtcfb_info *sfb)
+ return 0; /* unknown hardware */
+ }
+
++static void sm7xx_resolution_probe(struct smtcfb_info *sfb)
++{
++ /* get mode parameter from smtc_scr_info */
++ if (smtc_scr_info.lfb_width != 0) {
++ sfb->fb->var.xres = smtc_scr_info.lfb_width;
++ sfb->fb->var.yres = smtc_scr_info.lfb_height;
++ sfb->fb->var.bits_per_pixel = smtc_scr_info.lfb_depth;
++ goto final;
++ }
++
++ /*
++ * No parameter, default resolution is 1024x768-16.
++ *
++ * FIXME: earlier laptops, such as IBM Thinkpad 240X, has a 800x600
++ * panel, also see the comments about Thinkpad 240X above.
++ */
++ sfb->fb->var.xres = SCREEN_X_RES;
++ sfb->fb->var.yres = SCREEN_Y_RES_PC;
++ sfb->fb->var.bits_per_pixel = SCREEN_BPP;
++
++#ifdef CONFIG_MIPS
++ /*
++ * Loongson MIPS netbooks use 1024x600 LCD panels, which is the original
++ * target platform of this driver, but nearly all old x86 laptops have
++ * 1024x768. Lighting 768 panels using 600's timings would partially
++ * garble the display, so we don't want that. But it's not possible to
++ * distinguish them reliably.
++ *
++ * So we change the default to 768, but keep 600 as-is on MIPS.
++ */
++ sfb->fb->var.yres = SCREEN_Y_RES_NETBOOK;
++#endif
++
++final:
++ big_pixel_depth(sfb->fb->var.bits_per_pixel, smtc_scr_info.lfb_depth);
++}
++
+ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ const struct pci_device_id *ent)
+ {
+@@ -1508,19 +1545,6 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+
+ sm7xx_init_hw();
+
+- /* get mode parameter from smtc_scr_info */
+- if (smtc_scr_info.lfb_width != 0) {
+- sfb->fb->var.xres = smtc_scr_info.lfb_width;
+- sfb->fb->var.yres = smtc_scr_info.lfb_height;
+- sfb->fb->var.bits_per_pixel = smtc_scr_info.lfb_depth;
+- } else {
+- /* default resolution 1024x600 16bit mode */
+- sfb->fb->var.xres = SCREEN_X_RES;
+- sfb->fb->var.yres = SCREEN_Y_RES;
+- sfb->fb->var.bits_per_pixel = SCREEN_BPP;
+- }
+-
+- big_pixel_depth(sfb->fb->var.bits_per_pixel, smtc_scr_info.lfb_depth);
+ /* Map address and memory detection */
+ mmio_base = pci_resource_start(pdev, 0);
+ pci_read_config_byte(pdev, PCI_REVISION_ID, &sfb->chip_rev_id);
+@@ -1582,6 +1606,9 @@ static int smtcfb_pci_probe(struct pci_dev *pdev,
+ goto failed_fb;
+ }
+
++ /* probe and decide resolution */
++ sm7xx_resolution_probe(sfb);
++
+ /* can support 32 bpp */
+ if (sfb->fb->var.bits_per_pixel == 15)
+ sfb->fb->var.bits_per_pixel = 16;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-093-fbdev-sm712fb-fix-crashes-and-garbled-display-d.patch b/patches.kernel.org/5.1.5-093-fbdev-sm712fb-fix-crashes-and-garbled-display-d.patch
new file mode 100644
index 0000000000..2d751d1d7b
--- /dev/null
+++ b/patches.kernel.org/5.1.5-093-fbdev-sm712fb-fix-crashes-and-garbled-display-d.patch
@@ -0,0 +1,146 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Mon, 1 Apr 2019 17:46:59 +0200
+Subject: [PATCH] fbdev: sm712fb: fix crashes and garbled display during DPMS
+ modesetting
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: f627caf55b8e735dcec8fa6538e9668632b55276
+
+commit f627caf55b8e735dcec8fa6538e9668632b55276 upstream.
+
+On a Thinkpad s30 (Pentium III / i440MX, Lynx3DM), blanking the display
+or starting the X server will crash and freeze the system, or garble the
+display.
+
+Experiments showed this problem can mostly be solved by adjusting the
+order of register writes. Also, sm712fb failed to consider the difference
+of clock frequency when unblanking the display, and programs the clock for
+SM712 to SM720.
+
+Fix them by adjusting the order of register writes, and adding an
+additional check for SM720 for programming the clock frequency.
+
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Tested-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: Teddy Wang <teddy.wang@siliconmotion.com>
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 64 +++++++++++++++++++++--------------
+ 1 file changed, 38 insertions(+), 26 deletions(-)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 0d03ea09849f..1e2503b52c6f 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -886,67 +886,79 @@ static inline unsigned int chan_to_field(unsigned int chan,
+
+ static int smtc_blank(int blank_mode, struct fb_info *info)
+ {
++ struct smtcfb_info *sfb = info->par;
++
+ /* clear DPMS setting */
+ switch (blank_mode) {
+ case FB_BLANK_UNBLANK:
+ /* Screen On: HSync: On, VSync : On */
++
++ switch (sfb->chip_id) {
++ case 0x710:
++ case 0x712:
++ smtc_seqw(0x6a, 0x16);
++ smtc_seqw(0x6b, 0x02);
++ case 0x720:
++ smtc_seqw(0x6a, 0x0d);
++ smtc_seqw(0x6b, 0x02);
++ break;
++ }
++
++ smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+ smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20)));
+- smtc_seqw(0x6a, 0x16);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) & 0x77));
+ smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+- smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+- smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+ smtc_seqw(0x31, (smtc_seqr(0x31) | 0x03));
++ smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+ break;
+ case FB_BLANK_NORMAL:
+ /* Screen Off: HSync: On, VSync : On Soft blank */
++ smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+ smtc_seqw(0x01, (smtc_seqr(0x01) & (~0x20)));
++ smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+ smtc_seqw(0x6a, 0x16);
+ smtc_seqw(0x6b, 0x02);
+- smtc_seqw(0x22, (smtc_seqr(0x22) & (~0x30)));
+- smtc_seqw(0x23, (smtc_seqr(0x23) & (~0xc0)));
+- smtc_seqw(0x24, (smtc_seqr(0x24) | 0x01));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ break;
+ case FB_BLANK_VSYNC_SUSPEND:
+ /* Screen On: HSync: On, VSync : Off */
++ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20));
+ smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+- smtc_seqw(0x6a, 0x0c);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
++ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+ smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x20));
+- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0x20));
+- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
++ smtc_seqw(0x6a, 0x0c);
++ smtc_seqw(0x6b, 0x02);
+ break;
+ case FB_BLANK_HSYNC_SUSPEND:
+ /* Screen On: HSync: Off, VSync : On */
++ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+ smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+- smtc_seqw(0x6a, 0x0c);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
++ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+ smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x10));
+- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
++ smtc_seqw(0x6a, 0x0c);
++ smtc_seqw(0x6b, 0x02);
+ break;
+ case FB_BLANK_POWERDOWN:
+ /* Screen On: HSync: Off, VSync : Off */
++ smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
++ smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
++ smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+ smtc_seqw(0x01, (smtc_seqr(0x01) | 0x20));
+- smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+- smtc_seqw(0x6a, 0x0c);
+- smtc_seqw(0x6b, 0x02);
+ smtc_seqw(0x21, (smtc_seqr(0x21) | 0x88));
++ smtc_seqw(0x20, (smtc_seqr(0x20) & (~0xB0)));
+ smtc_seqw(0x22, ((smtc_seqr(0x22) & (~0x30)) | 0x30));
+- smtc_seqw(0x23, ((smtc_seqr(0x23) & (~0xc0)) | 0xD8));
+- smtc_seqw(0x24, (smtc_seqr(0x24) & (~0x01)));
+- smtc_seqw(0x31, ((smtc_seqr(0x31) & (~0x07)) | 0x00));
+ smtc_seqw(0x34, (smtc_seqr(0x34) | 0x80));
++ smtc_seqw(0x6a, 0x0c);
++ smtc_seqw(0x6b, 0x02);
+ break;
+ default:
+ return -EINVAL;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-094-PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch b/patches.kernel.org/5.1.5-094-PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
new file mode 100644
index 0000000000..5ed1af17f1
--- /dev/null
+++ b/patches.kernel.org/5.1.5-094-PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
@@ -0,0 +1,49 @@
+From: Nikolai Kostrigin <nickel@altlinux.org>
+Date: Mon, 8 Apr 2019 13:37:25 +0300
+Subject: [PATCH] PCI: Mark AMD Stoney Radeon R7 GPU ATS as broken
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: d28ca864c493637f3c957f4ed9348a94fca6de60
+
+commit d28ca864c493637f3c957f4ed9348a94fca6de60 upstream.
+
+ATS is broken on the Radeon R7 GPU (at least for Stoney Ridge based laptop)
+and causes IOMMU stalls and system failure. Disable ATS on these devices
+to make them usable again with IOMMU enabled.
+
+Thanks to Joerg Roedel <jroedel@suse.de> for help.
+
+[bhelgaas: In the email thread mentioned below, Alex suspects the real
+problem is in sbios or iommu, so it may affect only certain systems, and it
+may affect other devices in those systems as well. However, per Joerg we
+lack the ability to debug further, so this quirk is the best we can do for
+now.]
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=194521
+Link: https://lore.kernel.org/lkml/20190408103725.30426-1-nickel@altlinux.org
+Fixes: 9b44b0b09dec ("PCI: Mark AMD Stoney GPU ATS as broken")
+Signed-off-by: Nikolai Kostrigin <nickel@altlinux.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+CC: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index a077f67fe1da..ce58e4690306 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4905,6 +4905,7 @@ static void quirk_no_ats(struct pci_dev *pdev)
+
+ /* AMD Stoney platform GPU */
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_no_ats);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_no_ats);
+ #endif /* CONFIG_PCI_ATS */
+
+ /* Freescale PCIe doesn't support MSI in RC mode */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-095-PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch b/patches.kernel.org/5.1.5-095-PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
new file mode 100644
index 0000000000..342b682e31
--- /dev/null
+++ b/patches.kernel.org/5.1.5-095-PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
@@ -0,0 +1,39 @@
+From: James Prestwood <james.prestwood@linux.intel.com>
+Date: Mon, 7 Jan 2019 13:32:48 -0800
+Subject: [PATCH] PCI: Mark Atheros AR9462 to avoid bus reset
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 6afb7e26978da5e86e57e540fdce65c8b04f398a
+
+commit 6afb7e26978da5e86e57e540fdce65c8b04f398a upstream.
+
+When using PCI passthrough with this device, the host machine locks up
+completely when starting the VM, requiring a hard reboot. Add a quirk to
+avoid bus resets on this device.
+
+Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset")
+Link: https://lore.kernel.org/linux-pci/20190107213248.3034-1-james.prestwood@linux.intel.com
+Signed-off-by: James Prestwood <james.prestwood@linux.intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: stable@vger.kernel.org # v3.14+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/quirks.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index ce58e4690306..331ae194bc36 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -3408,6 +3408,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
+
+ /*
+ * Root port on some Cavium CN8xxx chips do not successfully complete a bus
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-096-PCI-Reset-Lenovo-ThinkPad-P50-nvgpu-at-boot-if-.patch b/patches.kernel.org/5.1.5-096-PCI-Reset-Lenovo-ThinkPad-P50-nvgpu-at-boot-if-.patch
new file mode 100644
index 0000000000..525a13b94d
--- /dev/null
+++ b/patches.kernel.org/5.1.5-096-PCI-Reset-Lenovo-ThinkPad-P50-nvgpu-at-boot-if-.patch
@@ -0,0 +1,156 @@
+From: Lyude Paul <lyude@redhat.com>
+Date: Tue, 12 Feb 2019 17:02:30 -0500
+Subject: [PATCH] PCI: Reset Lenovo ThinkPad P50 nvgpu at boot if necessary
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: e0547c81bfcfad01cbbfa93a5e66bb98ab932f80
+
+commit e0547c81bfcfad01cbbfa93a5e66bb98ab932f80 upstream.
+
+On ThinkPad P50 SKUs with an Nvidia Quadro M1000M instead of the M2000M
+variant, the BIOS does not always reset the secondary Nvidia GPU during
+reboot if the laptop is configured in Hybrid Graphics mode. The reason is
+unknown, but the following steps and possibly a good bit of patience will
+reproduce the issue:
+
+ 1. Boot up the laptop normally in Hybrid Graphics mode
+ 2. Make sure nouveau is loaded and that the GPU is awake
+ 3. Allow the Nvidia GPU to runtime suspend itself after being idle
+ 4. Reboot the machine, the more sudden the better (e.g. sysrq-b may help)
+ 5. If nouveau loads up properly, reboot the machine again and go back to
+ step 2 until you reproduce the issue
+
+This results in some very strange behavior: the GPU will be left in exactly
+the same state it was in when the previously booted kernel started the
+reboot. This has all sorts of bad side effects: for starters, this
+completely breaks nouveau starting with a mysterious EVO channel failure
+that happens well before we've actually used the EVO channel for anything:
+
+ nouveau 0000:01:00.0: disp: chid 0 mthd 0000 data 00000400 00001000 00000002
+
+This causes a timeout trying to bring up the GR ctx:
+
+ nouveau 0000:01:00.0: timeout
+ WARNING: CPU: 0 PID: 12 at drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.c:1547 gf100_grctx_generate+0x7b2/0x850 [nouveau]
+ Hardware name: LENOVO 20EQS64N0B/20EQS64N0B, BIOS N1EET82W (1.55 ) 12/18/2018
+ Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper]
+ ...
+ nouveau 0000:01:00.0: gr: wait for idle timeout (en: 1, ctxsw: 0, busy: 1)
+ nouveau 0000:01:00.0: gr: wait for idle timeout (en: 1, ctxsw: 0, busy: 1)
+ nouveau 0000:01:00.0: fifo: fault 01 [WRITE] at 0000000000008000 engine 00 [GR] client 15 [HUB/SCC_NB] reason c4 [] on channel -1 [0000000000 unknown]
+
+The GPU never manages to recover. Booting without loading nouveau causes
+issues as well, since the GPU starts sending spurious interrupts that cause
+other device's IRQs to get disabled by the kernel:
+
+ irq 16: nobody cared (try booting with the "irqpoll" option)
+ ...
+ handlers:
+ [<000000007faa9e99>] i801_isr [i2c_i801]
+ Disabling IRQ #16
+ ...
+ serio: RMI4 PS/2 pass-through port at rmi4-00.fn03
+ i801_smbus 0000:00:1f.4: Timeout waiting for interrupt!
+ i801_smbus 0000:00:1f.4: Transaction timeout
+ rmi4_f03 rmi4-00.fn03: rmi_f03_pt_write: Failed to write to F03 TX register (-110).
+ i801_smbus 0000:00:1f.4: Timeout waiting for interrupt!
+ i801_smbus 0000:00:1f.4: Transaction timeout
+ rmi4_physical rmi4-00: rmi_driver_set_irq_bits: Failed to change enabled interrupts!
+
+This causes the touchpad and sometimes other things to get disabled.
+
+Since this happens without nouveau, we can't fix this problem from nouveau
+itself.
+
+Add a PCI quirk for the specific P50 variant of this GPU. Make sure the
+GPU is advertising NoReset- so we don't reset the GPU when the machine is
+in Dedicated graphics mode (where the GPU being initialized by the BIOS is
+normal and expected). Map the GPU MMIO space and read the magic 0x2240c
+register, which will have bit 1 set if the device was POSTed during a
+previous boot. Once we've confirmed all of this, reset the GPU and
+re-disable it - bringing it back to a healthy state.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=203003
+Link: https://lore.kernel.org/lkml/20190212220230.1568-1-lyude@redhat.com
+Signed-off-by: Lyude Paul <lyude@redhat.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Cc: nouveau@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: Karol Herbst <kherbst@redhat.com>
+Cc: Ben Skeggs <skeggsb@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/quirks.c | 58 ++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 58 insertions(+)
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 331ae194bc36..65b194a479a1 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -5124,3 +5124,61 @@ SWITCHTEC_QUIRK(0x8573); /* PFXI 48XG3 */
+ SWITCHTEC_QUIRK(0x8574); /* PFXI 64XG3 */
+ SWITCHTEC_QUIRK(0x8575); /* PFXI 80XG3 */
+ SWITCHTEC_QUIRK(0x8576); /* PFXI 96XG3 */
++
++/*
++ * On Lenovo Thinkpad P50 SKUs with a Nvidia Quadro M1000M, the BIOS does
++ * not always reset the secondary Nvidia GPU between reboots if the system
++ * is configured to use Hybrid Graphics mode. This results in the GPU
++ * being left in whatever state it was in during the *previous* boot, which
++ * causes spurious interrupts from the GPU, which in turn causes us to
++ * disable the wrong IRQ and end up breaking the touchpad. Unsurprisingly,
++ * this also completely breaks nouveau.
++ *
++ * Luckily, it seems a simple reset of the Nvidia GPU brings it back to a
++ * clean state and fixes all these issues.
++ *
++ * When the machine is configured in Dedicated display mode, the issue
++ * doesn't occur. Fortunately the GPU advertises NoReset+ when in this
++ * mode, so we can detect that and avoid resetting it.
++ */
++static void quirk_reset_lenovo_thinkpad_p50_nvgpu(struct pci_dev *pdev)
++{
++ void __iomem *map;
++ int ret;
++
++ if (pdev->subsystem_vendor != PCI_VENDOR_ID_LENOVO ||
++ pdev->subsystem_device != 0x222e ||
++ !pdev->reset_fn)
++ return;
++
++ if (pci_enable_device_mem(pdev))
++ return;
++
++ /*
++ * Based on nvkm_device_ctor() in
++ * drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
++ */
++ map = pci_iomap(pdev, 0, 0x23000);
++ if (!map) {
++ pci_err(pdev, "Can't map MMIO space\n");
++ goto out_disable;
++ }
++
++ /*
++ * Make sure the GPU looks like it's been POSTed before resetting
++ * it.
++ */
++ if (ioread32(map + 0x2240c) & 0x2) {
++ pci_info(pdev, FW_BUG "GPU left initialized by EFI, resetting\n");
++ ret = pci_reset_function(pdev);
++ if (ret < 0)
++ pci_err(pdev, "Failed to reset GPU: %d\n", ret);
++ }
++
++ iounmap(map);
++out_disable:
++ pci_disable_device(pdev);
++}
++DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, 0x13b1,
++ PCI_CLASS_DISPLAY_VGA, 8,
++ quirk_reset_lenovo_thinkpad_p50_nvgpu);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-097-PCI-Init-PCIe-feature-bits-for-managed-host-bri.patch b/patches.kernel.org/5.1.5-097-PCI-Init-PCIe-feature-bits-for-managed-host-bri.patch
new file mode 100644
index 0000000000..882ba5f4c7
--- /dev/null
+++ b/patches.kernel.org/5.1.5-097-PCI-Init-PCIe-feature-bits-for-managed-host-bri.patch
@@ -0,0 +1,78 @@
+From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Date: Mon, 18 Mar 2019 16:07:18 +0000
+Subject: [PATCH] PCI: Init PCIe feature bits for managed host bridge alloc
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 6302bf3ef78dd210b5ff4a922afcb7d8eff8a211
+
+commit 6302bf3ef78dd210b5ff4a922afcb7d8eff8a211 upstream.
+
+Two functions allocate a host bridge: devm_pci_alloc_host_bridge() and
+pci_alloc_host_bridge(). At the moment, only the unmanaged one initializes
+the PCIe feature bits, which prevents from using features such as hotplug
+or AER on some systems, when booting with device tree. Make the
+initialization code common.
+
+Fixes: 02bfeb484230 ("PCI/portdrv: Simplify PCIe feature permission checking")
+Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: stable@vger.kernel.org # v4.17+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/probe.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 7e12d0163863..eea78477d311 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -586,16 +586,9 @@ static void pci_release_host_bridge_dev(struct device *dev)
+ kfree(to_pci_host_bridge(dev));
+ }
+
+-struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
++static void pci_init_host_bridge(struct pci_host_bridge *bridge)
+ {
+- struct pci_host_bridge *bridge;
+-
+- bridge = kzalloc(sizeof(*bridge) + priv, GFP_KERNEL);
+- if (!bridge)
+- return NULL;
+-
+ INIT_LIST_HEAD(&bridge->windows);
+- bridge->dev.release = pci_release_host_bridge_dev;
+
+ /*
+ * We assume we can manage these PCIe features. Some systems may
+@@ -608,6 +601,18 @@ struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
+ bridge->native_shpc_hotplug = 1;
+ bridge->native_pme = 1;
+ bridge->native_ltr = 1;
++}
++
++struct pci_host_bridge *pci_alloc_host_bridge(size_t priv)
++{
++ struct pci_host_bridge *bridge;
++
++ bridge = kzalloc(sizeof(*bridge) + priv, GFP_KERNEL);
++ if (!bridge)
++ return NULL;
++
++ pci_init_host_bridge(bridge);
++ bridge->dev.release = pci_release_host_bridge_dev;
+
+ return bridge;
+ }
+@@ -622,7 +627,7 @@ struct pci_host_bridge *devm_pci_alloc_host_bridge(struct device *dev,
+ if (!bridge)
+ return NULL;
+
+- INIT_LIST_HEAD(&bridge->windows);
++ pci_init_host_bridge(bridge);
+ bridge->dev.release = devm_pci_release_host_bridge_dev;
+
+ return bridge;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-098-PCI-AER-Change-pci_aer_init-stub-to-return-void.patch b/patches.kernel.org/5.1.5-098-PCI-AER-Change-pci_aer_init-stub-to-return-void.patch
new file mode 100644
index 0000000000..f2174ad97e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-098-PCI-AER-Change-pci_aer_init-stub-to-return-void.patch
@@ -0,0 +1,40 @@
+From: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Date: Fri, 12 Apr 2019 06:43:06 +0000
+Subject: [PATCH] PCI/AER: Change pci_aer_init() stub to return void
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 31f996efbd5a7825f4d30150469e9d110aea00e8
+
+commit 31f996efbd5a7825f4d30150469e9d110aea00e8 upstream.
+
+Commit 60ed982a4e78 ("PCI/AER: Move internal declarations to
+drivers/pci/pci.h") changed pci_aer_init() to return "void", but didn't
+change the stub for when CONFIG_PCIEAER isn't enabled. Change the stub to
+match.
+
+Fixes: 60ed982a4e78 ("PCI/AER: Move internal declarations to drivers/pci/pci.h")
+Signed-off-by: Jisheng Zhang <Jisheng.Zhang@synaptics.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: stable@vger.kernel.org # v4.19+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/pci.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
+index d994839a3e24..9cb99380c61e 100644
+--- a/drivers/pci/pci.h
++++ b/drivers/pci/pci.h
+@@ -597,7 +597,7 @@ void pci_aer_clear_fatal_status(struct pci_dev *dev);
+ void pci_aer_clear_device_status(struct pci_dev *dev);
+ #else
+ static inline void pci_no_aer(void) { }
+-static inline int pci_aer_init(struct pci_dev *d) { return -ENODEV; }
++static inline void pci_aer_init(struct pci_dev *d) { }
+ static inline void pci_aer_exit(struct pci_dev *d) { }
+ static inline void pci_aer_clear_fatal_status(struct pci_dev *dev) { }
+ static inline void pci_aer_clear_device_status(struct pci_dev *dev) { }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-099-PCI-rcar-Add-the-initialization-of-PCIe-link-in.patch b/patches.kernel.org/5.1.5-099-PCI-rcar-Add-the-initialization-of-PCIe-link-in.patch
new file mode 100644
index 0000000000..9bec5602c2
--- /dev/null
+++ b/patches.kernel.org/5.1.5-099-PCI-rcar-Add-the-initialization-of-PCIe-link-in.patch
@@ -0,0 +1,97 @@
+From: Kazufumi Ikeda <kaz-ikeda@xc.jp.nec.com>
+Date: Mon, 25 Mar 2019 20:43:19 +0100
+Subject: [PATCH] PCI: rcar: Add the initialization of PCIe link in
+ resume_noirq()
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: be20bbcb0a8cb5597cc62b3e28d275919f3431df
+
+commit be20bbcb0a8cb5597cc62b3e28d275919f3431df upstream.
+
+Reestablish the PCIe link very early in the resume process in case it
+went down to prevent PCI accesses from hanging the bus. Such accesses
+can happen early in the PCI resume process, as early as the
+SUSPEND_RESUME_NOIRQ step, thus the link must be reestablished in the
+driver resume_noirq() callback.
+
+Fixes: e015f88c368d ("PCI: rcar: Add support for R-Car H3 to pcie-rcar")
+Signed-off-by: Kazufumi Ikeda <kaz-ikeda@xc.jp.nec.com>
+Signed-off-by: Gaku Inami <gaku.inami.xw@bp.renesas.com>
+Signed-off-by: Marek Vasut <marek.vasut+renesas@gmail.com>
+[lorenzo.pieralisi@arm.com: reformatted commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Cc: stable@vger.kernel.org
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: Phil Edworthy <phil.edworthy@renesas.com>
+Cc: Simon Horman <horms+renesas@verge.net.au>
+Cc: Wolfram Sang <wsa@the-dreams.de>
+Cc: linux-renesas-soc@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/controller/pcie-rcar.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/drivers/pci/controller/pcie-rcar.c b/drivers/pci/controller/pcie-rcar.c
+index c8febb009454..6a4e435bd35f 100644
+--- a/drivers/pci/controller/pcie-rcar.c
++++ b/drivers/pci/controller/pcie-rcar.c
+@@ -46,6 +46,7 @@
+
+ /* Transfer control */
+ #define PCIETCTLR 0x02000
++#define DL_DOWN BIT(3)
+ #define CFINIT 1
+ #define PCIETSTR 0x02004
+ #define DATA_LINK_ACTIVE 1
+@@ -94,6 +95,7 @@
+ #define MACCTLR 0x011058
+ #define SPEED_CHANGE BIT(24)
+ #define SCRAMBLE_DISABLE BIT(27)
++#define PMSR 0x01105c
+ #define MACS2R 0x011078
+ #define MACCGSPSETR 0x011084
+ #define SPCNGRSN BIT(31)
+@@ -1130,6 +1132,7 @@ static int rcar_pcie_probe(struct platform_device *pdev)
+ pcie = pci_host_bridge_priv(bridge);
+
+ pcie->dev = dev;
++ platform_set_drvdata(pdev, pcie);
+
+ err = pci_parse_request_of_pci_ranges(dev, &pcie->resources, NULL);
+ if (err)
+@@ -1221,10 +1224,28 @@ err_free_bridge:
+ return err;
+ }
+
++static int rcar_pcie_resume_noirq(struct device *dev)
++{
++ struct rcar_pcie *pcie = dev_get_drvdata(dev);
++
++ if (rcar_pci_read_reg(pcie, PMSR) &&
++ !(rcar_pci_read_reg(pcie, PCIETCTLR) & DL_DOWN))
++ return 0;
++
++ /* Re-establish the PCIe link */
++ rcar_pci_write_reg(pcie, CFINIT, PCIETCTLR);
++ return rcar_pcie_wait_for_dl(pcie);
++}
++
++static const struct dev_pm_ops rcar_pcie_pm_ops = {
++ .resume_noirq = rcar_pcie_resume_noirq,
++};
++
+ static struct platform_driver rcar_pcie_driver = {
+ .driver = {
+ .name = "rcar-pcie",
+ .of_match_table = rcar_pcie_of_match,
++ .pm = &rcar_pcie_pm_ops,
+ .suppress_bind_attrs = true,
+ },
+ .probe = rcar_pcie_probe,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-100-PCI-Factor-out-pcie_retrain_link-function.patch b/patches.kernel.org/5.1.5-100-PCI-Factor-out-pcie_retrain_link-function.patch
new file mode 100644
index 0000000000..77b8780570
--- /dev/null
+++ b/patches.kernel.org/5.1.5-100-PCI-Factor-out-pcie_retrain_link-function.patch
@@ -0,0 +1,93 @@
+From: =?UTF-8?q?Stefan=20M=C3=A4tje?= <stefan.maetje@esd.eu>
+Date: Fri, 29 Mar 2019 18:07:34 +0100
+Subject: [PATCH] PCI: Factor out pcie_retrain_link() function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 86fa6a344209d9414ea962b1f1ac6ade9dd7563a
+
+commit 86fa6a344209d9414ea962b1f1ac6ade9dd7563a upstream.
+
+Factor out pcie_retrain_link() to use for Pericom Retrain Link quirk. No
+functional change intended.
+
+Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+CC: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/pcie/aspm.c | 40 ++++++++++++++++++++++++----------------
+ 1 file changed, 24 insertions(+), 16 deletions(-)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 727e3c1ef9a4..4fa37622ad66 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -196,6 +196,29 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist)
+ link->clkpm_capable = (blacklist) ? 0 : capable;
+ }
+
++static bool pcie_retrain_link(struct pcie_link_state *link)
++{
++ struct pci_dev *parent = link->pdev;
++ unsigned long start_jiffies;
++ u16 reg16;
++
++ pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &reg16);
++ reg16 |= PCI_EXP_LNKCTL_RL;
++ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++
++ /* Wait for link training end. Break out after waiting for timeout */
++ start_jiffies = jiffies;
++ for (;;) {
++ pcie_capability_read_word(parent, PCI_EXP_LNKSTA, &reg16);
++ if (!(reg16 & PCI_EXP_LNKSTA_LT))
++ break;
++ if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
++ break;
++ msleep(1);
++ }
++ return !(reg16 & PCI_EXP_LNKSTA_LT);
++}
++
+ /*
+ * pcie_aspm_configure_common_clock: check if the 2 ends of a link
+ * could use common clock. If they are, configure them to use the
+@@ -205,7 +228,6 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ {
+ int same_clock = 1;
+ u16 reg16, parent_reg, child_reg[8];
+- unsigned long start_jiffies;
+ struct pci_dev *child, *parent = link->pdev;
+ struct pci_bus *linkbus = parent->subordinate;
+ /*
+@@ -263,21 +285,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
+ reg16 &= ~PCI_EXP_LNKCTL_CCC;
+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+
+- /* Retrain link */
+- reg16 |= PCI_EXP_LNKCTL_RL;
+- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+-
+- /* Wait for link training end. Break out after waiting for timeout */
+- start_jiffies = jiffies;
+- for (;;) {
+- pcie_capability_read_word(parent, PCI_EXP_LNKSTA, &reg16);
+- if (!(reg16 & PCI_EXP_LNKSTA_LT))
+- break;
+- if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
+- break;
+- msleep(1);
+- }
+- if (!(reg16 & PCI_EXP_LNKSTA_LT))
++ if (pcie_retrain_link(link))
+ return;
+
+ /* Training failed. Restore common clock configurations */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-101-PCI-Work-around-Pericom-PCIe-to-PCI-bridge-Retr.patch b/patches.kernel.org/5.1.5-101-PCI-Work-around-Pericom-PCIe-to-PCI-bridge-Retr.patch
new file mode 100644
index 0000000000..fbbe46e834
--- /dev/null
+++ b/patches.kernel.org/5.1.5-101-PCI-Work-around-Pericom-PCIe-to-PCI-bridge-Retr.patch
@@ -0,0 +1,111 @@
+From: =?UTF-8?q?Stefan=20M=C3=A4tje?= <stefan.maetje@esd.eu>
+Date: Fri, 29 Mar 2019 18:07:35 +0100
+Subject: [PATCH] PCI: Work around Pericom PCIe-to-PCI bridge Retrain Link
+ erratum
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 4ec73791a64bab25cabf16a6067ee478692e506d
+
+commit 4ec73791a64bab25cabf16a6067ee478692e506d upstream.
+
+Due to an erratum in some Pericom PCIe-to-PCI bridges in reverse mode
+(conventional PCI on primary side, PCIe on downstream side), the Retrain
+Link bit needs to be cleared manually to allow the link training to
+complete successfully.
+
+If it is not cleared manually, the link training is continuously restarted
+and no devices below the PCI-to-PCIe bridge can be accessed. That means
+drivers for devices below the bridge will be loaded but won't work and may
+even crash because the driver is only reading 0xffff.
+
+See the Pericom Errata Sheet PI7C9X111SLB_errata_rev1.2_102711.pdf for
+details. Devices known as affected so far are: PI7C9X110, PI7C9X111SL,
+PI7C9X130.
+
+Add a new flag, clear_retrain_link, in struct pci_dev. Quirks for affected
+devices set this bit.
+
+Note that pcie_retrain_link() lives in aspm.c because that's currently the
+only place we use it, but this erratum is not specific to ASPM, and we may
+retrain links for other reasons in the future.
+
+Signed-off-by: Stefan Mätje <stefan.maetje@esd.eu>
+[bhelgaas: apply regardless of CONFIG_PCIEASPM]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+CC: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/pci/pcie/aspm.c | 9 +++++++++
+ drivers/pci/quirks.c | 17 +++++++++++++++++
+ include/linux/pci.h | 2 ++
+ 3 files changed, 28 insertions(+)
+
+diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
+index 4fa37622ad66..38e7017478b5 100644
+--- a/drivers/pci/pcie/aspm.c
++++ b/drivers/pci/pcie/aspm.c
+@@ -205,6 +205,15 @@ static bool pcie_retrain_link(struct pcie_link_state *link)
+ pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &reg16);
+ reg16 |= PCI_EXP_LNKCTL_RL;
+ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++ if (parent->clear_retrain_link) {
++ /*
++ * Due to an erratum in some devices the Retrain Link bit
++ * needs to be cleared again manually to allow the link
++ * training to succeed.
++ */
++ reg16 &= ~PCI_EXP_LNKCTL_RL;
++ pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
++ }
+
+ /* Wait for link training end. Break out after waiting for timeout */
+ start_jiffies = jiffies;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 65b194a479a1..cc616a5f6a8f 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2245,6 +2245,23 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f1, quirk_disable_aspm_l0s);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
+
++/*
++ * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain
++ * Link bit cleared after starting the link retrain process to allow this
++ * process to finish.
++ *
++ * Affected devices: PI7C9X110, PI7C9X111SL, PI7C9X130. See also the
++ * Pericom Errata Sheet PI7C9X111SLB_errata_rev1.2_102711.pdf.
++ */
++static void quirk_enable_clear_retrain_link(struct pci_dev *dev)
++{
++ dev->clear_retrain_link = 1;
++ pci_info(dev, "Enable PCIe Retrain Link quirk\n");
++}
++DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe110, quirk_enable_clear_retrain_link);
++DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe111, quirk_enable_clear_retrain_link);
++DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe130, quirk_enable_clear_retrain_link);
++
+ static void fixup_rev1_53c810(struct pci_dev *dev)
+ {
+ u32 class = dev->class;
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 77448215ef5b..2c056a7a728a 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -348,6 +348,8 @@ struct pci_dev {
+ unsigned int hotplug_user_indicators:1; /* SlotCtl indicators
+ controlled exclusively by
+ user sysfs */
++ unsigned int clear_retrain_link:1; /* Need to clear Retrain Link
++ bit manually */
+ unsigned int d3_delay; /* D3->D0 transition time in ms */
+ unsigned int d3cold_delay; /* D3cold->D0 transition time in ms */
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-102-dm-cache-metadata-Fix-loading-discard-bitset.patch b/patches.kernel.org/5.1.5-102-dm-cache-metadata-Fix-loading-discard-bitset.patch
new file mode 100644
index 0000000000..57e5317521
--- /dev/null
+++ b/patches.kernel.org/5.1.5-102-dm-cache-metadata-Fix-loading-discard-bitset.patch
@@ -0,0 +1,52 @@
+From: Nikos Tsironis <ntsironis@arrikto.com>
+Date: Wed, 17 Apr 2019 17:19:18 +0300
+Subject: [PATCH] dm cache metadata: Fix loading discard bitset
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: e28adc3bf34e434b30e8d063df4823ba0f3e0529
+
+commit e28adc3bf34e434b30e8d063df4823ba0f3e0529 upstream.
+
+Add missing dm_bitset_cursor_next() to properly advance the bitset
+cursor.
+
+Otherwise, the discarded state of all blocks is set according to the
+discarded state of the first block.
+
+Fixes: ae4a46a1f6 ("dm cache metadata: use bitset cursor api to load discard bitset")
+Cc: stable@vger.kernel.org
+Signed-off-by: Nikos Tsironis <ntsironis@arrikto.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-cache-metadata.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c
+index 6fc93834da44..151aa95775be 100644
+--- a/drivers/md/dm-cache-metadata.c
++++ b/drivers/md/dm-cache-metadata.c
+@@ -1167,11 +1167,18 @@ static int __load_discards(struct dm_cache_metadata *cmd,
+ if (r)
+ return r;
+
+- for (b = 0; b < from_dblock(cmd->discard_nr_blocks); b++) {
++ for (b = 0; ; b++) {
+ r = fn(context, cmd->discard_block_size, to_dblock(b),
+ dm_bitset_cursor_get_value(&c));
+ if (r)
+ break;
++
++ if (b >= (from_dblock(cmd->discard_nr_blocks) - 1))
++ break;
++
++ r = dm_bitset_cursor_next(&c);
++ if (r)
++ break;
+ }
+
+ dm_bitset_cursor_end(&c);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-103-dm-zoned-Fix-zone-report-handling.patch b/patches.kernel.org/5.1.5-103-dm-zoned-Fix-zone-report-handling.patch
new file mode 100644
index 0000000000..2f609ed4f0
--- /dev/null
+++ b/patches.kernel.org/5.1.5-103-dm-zoned-Fix-zone-report-handling.patch
@@ -0,0 +1,62 @@
+From: Damien Le Moal <damien.lemoal@wdc.com>
+Date: Thu, 18 Apr 2019 18:03:07 +0900
+Subject: [PATCH] dm zoned: Fix zone report handling
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 7aedf75ff740a98f3683439449cd91c8662d03b2
+
+commit 7aedf75ff740a98f3683439449cd91c8662d03b2 upstream.
+
+The function blkdev_report_zones() returns success even if no zone
+information is reported (empty report). Empty zone reports can only
+happen if the report start sector passed exceeds the device capacity.
+The conditions for this to happen are either a bug in the caller code,
+or, a change in the device that forced the low level driver to change
+the device capacity to a value that is lower than the report start
+sector. This situation includes a failed disk revalidation resulting in
+the disk capacity being changed to 0.
+
+If this change happens while dm-zoned is in its initialization phase
+executing dmz_init_zones(), this function may enter an infinite loop
+and hang the system. To avoid this, add a check to disallow empty zone
+reports and bail out early. Also fix the function dmz_update_zone() to
+make sure that the report for the requested zone was correctly obtained.
+
+Fixes: 3b1a94c88b79 ("dm zoned: drive-managed zoned block device target")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Reviewed-by: Shaun Tancheff <shaun@tancheff.com>
+Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-zoned-metadata.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/md/dm-zoned-metadata.c b/drivers/md/dm-zoned-metadata.c
+index fa68336560c3..d8334cd45d7c 100644
+--- a/drivers/md/dm-zoned-metadata.c
++++ b/drivers/md/dm-zoned-metadata.c
+@@ -1169,6 +1169,9 @@ static int dmz_init_zones(struct dmz_metadata *zmd)
+ goto out;
+ }
+
++ if (!nr_blkz)
++ break;
++
+ /* Process report */
+ for (i = 0; i < nr_blkz; i++) {
+ ret = dmz_init_zone(zmd, zone, &blkz[i]);
+@@ -1204,6 +1207,8 @@ static int dmz_update_zone(struct dmz_metadata *zmd, struct dm_zone *zone)
+ /* Get zone information from disk */
+ ret = blkdev_report_zones(zmd->dev->bdev, dmz_start_sect(zmd, zone),
+ &blkz, &nr_blkz, GFP_NOIO);
++ if (!nr_blkz)
++ ret = -EIO;
+ if (ret) {
+ dmz_dev_err(zmd->dev, "Get zone %u report failed",
+ dmz_id(zmd, zone));
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-104-dm-init-fix-max-devices-targets-checks.patch b/patches.kernel.org/5.1.5-104-dm-init-fix-max-devices-targets-checks.patch
new file mode 100644
index 0000000000..704b43f5c8
--- /dev/null
+++ b/patches.kernel.org/5.1.5-104-dm-init-fix-max-devices-targets-checks.patch
@@ -0,0 +1,54 @@
+From: Helen Koike <helen.koike@collabora.com>
+Date: Fri, 26 Apr 2019 17:09:55 -0300
+Subject: [PATCH] dm init: fix max devices/targets checks
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 8e890c1ab1b1e0f765cd8da82c4dee011698a5e8
+
+commit 8e890c1ab1b1e0f765cd8da82c4dee011698a5e8 upstream.
+
+dm-init should allow up to DM_MAX_{DEVICES,TARGETS} for devices/targets,
+and not DM_MAX_{DEVICES,TARGETS} - 1.
+
+Fix the checks and also fix the error message when the number of devices
+is surpassed.
+
+Fixes: 6bbc923dfcf57d ("dm: add support to directly boot to a mapped device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-init.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-init.c b/drivers/md/dm-init.c
+index 4b76f84424c3..352e803f566e 100644
+--- a/drivers/md/dm-init.c
++++ b/drivers/md/dm-init.c
+@@ -160,7 +160,7 @@ static int __init dm_parse_table(struct dm_device *dev, char *str)
+
+ while (table_entry) {
+ DMDEBUG("parsing table \"%s\"", str);
+- if (++dev->dmi.target_count >= DM_MAX_TARGETS) {
++ if (++dev->dmi.target_count > DM_MAX_TARGETS) {
+ DMERR("too many targets %u > %d",
+ dev->dmi.target_count, DM_MAX_TARGETS);
+ return -EINVAL;
+@@ -242,9 +242,9 @@ static int __init dm_parse_devices(struct list_head *devices, char *str)
+ return -ENOMEM;
+ list_add_tail(&dev->list, devices);
+
+- if (++ndev >= DM_MAX_DEVICES) {
+- DMERR("too many targets %u > %d",
+- dev->dmi.target_count, DM_MAX_TARGETS);
++ if (++ndev > DM_MAX_DEVICES) {
++ DMERR("too many devices %lu > %d",
++ ndev, DM_MAX_DEVICES);
+ return -EINVAL;
+ }
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-105-dm-delay-fix-a-crash-when-invalid-device-is-spe.patch b/patches.kernel.org/5.1.5-105-dm-delay-fix-a-crash-when-invalid-device-is-spe.patch
new file mode 100644
index 0000000000..1724391a75
--- /dev/null
+++ b/patches.kernel.org/5.1.5-105-dm-delay-fix-a-crash-when-invalid-device-is-spe.patch
@@ -0,0 +1,39 @@
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Thu, 25 Apr 2019 12:07:54 -0400
+Subject: [PATCH] dm delay: fix a crash when invalid device is specified
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 81bc6d150ace6250503b825d9d0c10f7bbd24095
+
+commit 81bc6d150ace6250503b825d9d0c10f7bbd24095 upstream.
+
+When the target line contains an invalid device, delay_ctr() will call
+delay_dtr() with NULL workqueue. Attempting to destroy the NULL
+workqueue causes a crash.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-delay.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-delay.c b/drivers/md/dm-delay.c
+index fddffe251bf6..f496213f8b67 100644
+--- a/drivers/md/dm-delay.c
++++ b/drivers/md/dm-delay.c
+@@ -121,7 +121,8 @@ static void delay_dtr(struct dm_target *ti)
+ {
+ struct delay_c *dc = ti->private;
+
+- destroy_workqueue(dc->kdelayd_wq);
++ if (dc->kdelayd_wq)
++ destroy_workqueue(dc->kdelayd_wq);
+
+ if (dc->read.dev)
+ dm_put_device(ti, dc->read.dev);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-106-dm-crypt-move-detailed-message-into-debug-level.patch b/patches.kernel.org/5.1.5-106-dm-crypt-move-detailed-message-into-debug-level.patch
new file mode 100644
index 0000000000..13b768107a
--- /dev/null
+++ b/patches.kernel.org/5.1.5-106-dm-crypt-move-detailed-message-into-debug-level.patch
@@ -0,0 +1,78 @@
+From: Milan Broz <gmazyland@gmail.com>
+Date: Wed, 15 May 2019 16:23:43 +0200
+Subject: [PATCH] dm crypt: move detailed message into debug level
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 7a1cd7238fde6ab367384a4a2998cba48330c398
+
+commit 7a1cd7238fde6ab367384a4a2998cba48330c398 upstream.
+
+The information about tag size should not be printed without debug info
+set. Also print device major:minor in the error message to identify the
+device instance.
+
+Also use rate limiting and debug level for info about used crypto API
+implementaton. This is important because during online reencryption
+the existing message saturates syslog (because we are moving hotzone
+across the whole device).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Milan Broz <gmazyland@gmail.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-crypt.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index dd6565798778..86fd2d0fa975 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -949,6 +949,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+ {
+ #ifdef CONFIG_BLK_DEV_INTEGRITY
+ struct blk_integrity *bi = blk_get_integrity(cc->dev->bdev->bd_disk);
++ struct mapped_device *md = dm_table_get_md(ti->table);
+
+ /* From now we require underlying device with our integrity profile */
+ if (!bi || strcasecmp(bi->profile->name, "DM-DIF-EXT-TAG")) {
+@@ -968,7 +969,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+
+ if (crypt_integrity_aead(cc)) {
+ cc->integrity_tag_size = cc->on_disk_tag_size - cc->integrity_iv_size;
+- DMINFO("Integrity AEAD, tag size %u, IV size %u.",
++ DMDEBUG("%s: Integrity AEAD, tag size %u, IV size %u.", dm_device_name(md),
+ cc->integrity_tag_size, cc->integrity_iv_size);
+
+ if (crypto_aead_setauthsize(any_tfm_aead(cc), cc->integrity_tag_size)) {
+@@ -976,7 +977,7 @@ static int crypt_integrity_ctr(struct crypt_config *cc, struct dm_target *ti)
+ return -EINVAL;
+ }
+ } else if (cc->integrity_iv_size)
+- DMINFO("Additional per-sector space %u bytes for IV.",
++ DMDEBUG("%s: Additional per-sector space %u bytes for IV.", dm_device_name(md),
+ cc->integrity_iv_size);
+
+ if ((cc->integrity_tag_size + cc->integrity_iv_size) != bi->tag_size) {
+@@ -1891,7 +1892,7 @@ static int crypt_alloc_tfms_skcipher(struct crypt_config *cc, char *ciphermode)
+ * algorithm implementation is used. Help people debug performance
+ * problems by logging the ->cra_driver_name.
+ */
+- DMINFO("%s using implementation \"%s\"", ciphermode,
++ DMDEBUG_LIMIT("%s using implementation \"%s\"", ciphermode,
+ crypto_skcipher_alg(any_tfm(cc))->base.cra_driver_name);
+ return 0;
+ }
+@@ -1911,7 +1912,7 @@ static int crypt_alloc_tfms_aead(struct crypt_config *cc, char *ciphermode)
+ return err;
+ }
+
+- DMINFO("%s using implementation \"%s\"", ciphermode,
++ DMDEBUG_LIMIT("%s using implementation \"%s\"", ciphermode,
+ crypto_aead_alg(any_tfm_aead(cc))->base.cra_driver_name);
+ return 0;
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-107-dm-integrity-correctly-calculate-the-size-of-me.patch b/patches.kernel.org/5.1.5-107-dm-integrity-correctly-calculate-the-size-of-me.patch
new file mode 100644
index 0000000000..6a674310ae
--- /dev/null
+++ b/patches.kernel.org/5.1.5-107-dm-integrity-correctly-calculate-the-size-of-me.patch
@@ -0,0 +1,53 @@
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Tue, 7 May 2019 14:28:35 -0400
+Subject: [PATCH] dm integrity: correctly calculate the size of metadata area
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 30bba430ddf737978e40561198693ba91386dac1
+
+commit 30bba430ddf737978e40561198693ba91386dac1 upstream.
+
+When we use separate devices for data and metadata, dm-integrity would
+incorrectly calculate the size of the metadata device as if it had
+512-byte block size - and it would refuse activation with larger block
+size and smaller metadata device.
+
+Fix this so that it takes actual block size into account, which fixes
+the following reported issue:
+https://gitlab.com/cryptsetup/cryptsetup/issues/450
+
+Fixes: 356d9d52e122 ("dm integrity: allow separate metadata device")
+Cc: stable@vger.kernel.org # v4.19+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-integrity.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
+index 7c678f50aaa3..7848ef019880 100644
+--- a/drivers/md/dm-integrity.c
++++ b/drivers/md/dm-integrity.c
+@@ -2568,7 +2568,7 @@ static int calculate_device_limits(struct dm_integrity_c *ic)
+ if (last_sector < ic->start || last_sector >= ic->meta_device_sectors)
+ return -EINVAL;
+ } else {
+- __u64 meta_size = ic->provided_data_sectors * ic->tag_size;
++ __u64 meta_size = (ic->provided_data_sectors >> ic->sb->log2_sectors_per_block) * ic->tag_size;
+ meta_size = (meta_size + ((1U << (ic->log2_buffer_sectors + SECTOR_SHIFT)) - 1))
+ >> (ic->log2_buffer_sectors + SECTOR_SHIFT);
+ meta_size <<= ic->log2_buffer_sectors;
+@@ -3439,7 +3439,7 @@ try_smaller_buffer:
+ DEBUG_print(" journal_sections %u\n", (unsigned)le32_to_cpu(ic->sb->journal_sections));
+ DEBUG_print(" journal_entries %u\n", ic->journal_entries);
+ DEBUG_print(" log2_interleave_sectors %d\n", ic->sb->log2_interleave_sectors);
+- DEBUG_print(" device_sectors 0x%llx\n", (unsigned long long)ic->device_sectors);
++ DEBUG_print(" data_device_sectors 0x%llx\n", (unsigned long long)ic->data_device_sectors);
+ DEBUG_print(" initial_sectors 0x%x\n", ic->initial_sectors);
+ DEBUG_print(" metadata_run 0x%x\n", ic->metadata_run);
+ DEBUG_print(" log2_metadata_run %d\n", ic->log2_metadata_run);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-108-dm-ioctl-fix-hang-in-early-create-error-conditi.patch b/patches.kernel.org/5.1.5-108-dm-ioctl-fix-hang-in-early-create-error-conditi.patch
new file mode 100644
index 0000000000..d6ad7205ab
--- /dev/null
+++ b/patches.kernel.org/5.1.5-108-dm-ioctl-fix-hang-in-early-create-error-conditi.patch
@@ -0,0 +1,55 @@
+From: Helen Koike <helen.koike@collabora.com>
+Date: Wed, 15 May 2019 13:50:54 -0300
+Subject: [PATCH] dm ioctl: fix hang in early create error condition
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 0f41fcf78849c902ddca564f99a8e23ccfc80333
+
+commit 0f41fcf78849c902ddca564f99a8e23ccfc80333 upstream.
+
+The dm_early_create() function (which deals with "dm-mod.create=" kernel
+command line option) calls dm_hash_insert() who gets an extra reference
+to the md object.
+
+In case of failure, this reference wasn't being released, causing
+dm_destroy() to hang, thus hanging the whole boot process.
+
+Fix this by calling __hash_remove() in the error path.
+
+Fixes: 6bbc923dfcf57d ("dm: add support to directly boot to a mapped device")
+Cc: stable@vger.kernel.org
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-ioctl.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
+index c740153b4e52..1e03bc89e20f 100644
+--- a/drivers/md/dm-ioctl.c
++++ b/drivers/md/dm-ioctl.c
+@@ -2069,7 +2069,7 @@ int __init dm_early_create(struct dm_ioctl *dmi,
+ /* alloc table */
+ r = dm_table_create(&t, get_mode(dmi), dmi->target_count, md);
+ if (r)
+- goto err_destroy_dm;
++ goto err_hash_remove;
+
+ /* add targets */
+ for (i = 0; i < dmi->target_count; i++) {
+@@ -2116,6 +2116,10 @@ int __init dm_early_create(struct dm_ioctl *dmi,
+
+ err_destroy_table:
+ dm_table_destroy(t);
++err_hash_remove:
++ (void) __hash_remove(__get_name_cell(dmi->name));
++ /* release reference from __get_name_cell */
++ dm_put(md);
+ err_destroy_dm:
+ dm_put(md);
+ dm_destroy(md);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-109-dm-mpath-always-free-attached_handler_name-in-p.patch b/patches.kernel.org/5.1.5-109-dm-mpath-always-free-attached_handler_name-in-p.patch
new file mode 100644
index 0000000000..d823886937
--- /dev/null
+++ b/patches.kernel.org/5.1.5-109-dm-mpath-always-free-attached_handler_name-in-p.patch
@@ -0,0 +1,51 @@
+From: Martin Wilck <mwilck@suse.com>
+Date: Mon, 29 Apr 2019 11:48:15 +0200
+Subject: [PATCH] dm mpath: always free attached_handler_name in parse_path()
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 940bc471780b004a5277c1931f52af363c2fc9da
+
+commit 940bc471780b004a5277c1931f52af363c2fc9da upstream.
+
+Commit b592211c33f7 ("dm mpath: fix attached_handler_name leak and
+dangling hw_handler_name pointer") fixed a memory leak for the case
+where setup_scsi_dh() returns failure. But setup_scsi_dh may return
+success and not "use" attached_handler_name if the
+retain_attached_hwhandler flag is not set on the map. As setup_scsi_sh
+properly "steals" the pointer by nullifying it, freeing it
+unconditionally in parse_path() is safe.
+
+Fixes: b592211c33f7 ("dm mpath: fix attached_handler_name leak and dangling hw_handler_name pointer")
+Cc: stable@vger.kernel.org
+Reported-by: Yufen Yu <yuyufen@huawei.com>
+Signed-off-by: Martin Wilck <mwilck@suse.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/dm-mpath.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index 2ee5e357a0a7..cc5173dfd466 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -882,6 +882,7 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
+ if (attached_handler_name || m->hw_handler_name) {
+ INIT_DELAYED_WORK(&p->activate_path, activate_path_work);
+ r = setup_scsi_dh(p->path.dev->bdev, m, &attached_handler_name, &ti->error);
++ kfree(attached_handler_name);
+ if (r) {
+ dm_put_device(ti, p->path.dev);
+ goto bad;
+@@ -896,7 +897,6 @@ static struct pgpath *parse_path(struct dm_arg_set *as, struct path_selector *ps
+
+ return p;
+ bad:
+- kfree(attached_handler_name);
+ free_pgpath(p);
+ return ERR_PTR(r);
+ }
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-110-fuse-Add-FOPEN_STREAM-to-use-stream_open.patch b/patches.kernel.org/5.1.5-110-fuse-Add-FOPEN_STREAM-to-use-stream_open.patch
new file mode 100644
index 0000000000..9eecebe67e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-110-fuse-Add-FOPEN_STREAM-to-use-stream_open.patch
@@ -0,0 +1,94 @@
+From: Kirill Smelkov <kirr@nexedi.com>
+Date: Wed, 24 Apr 2019 07:13:57 +0000
+Subject: [PATCH] fuse: Add FOPEN_STREAM to use stream_open()
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: bbd84f33652f852ce5992d65db4d020aba21f882
+
+commit bbd84f33652f852ce5992d65db4d020aba21f882 upstream.
+
+Starting from commit 9c225f2655e3 ("vfs: atomic f_pos accesses as per
+POSIX") files opened even via nonseekable_open gate read and write via lock
+and do not allow them to be run simultaneously. This can create read vs
+write deadlock if a filesystem is trying to implement a socket-like file
+which is intended to be simultaneously used for both read and write from
+filesystem client. See commit 10dce8af3422 ("fs: stream_open - opener for
+stream-like files so that read and write can run simultaneously without
+deadlock") for details and e.g. commit 581d21a2d02a ("xenbus: fix deadlock
+on writes to /proc/xen/xenbus") for a similar deadlock example on
+/proc/xen/xenbus.
+
+To avoid such deadlock it was tempting to adjust fuse_finish_open to use
+stream_open instead of nonseekable_open on just FOPEN_NONSEEKABLE flags,
+but grepping through Debian codesearch shows users of FOPEN_NONSEEKABLE,
+and in particular GVFS which actually uses offset in its read and write
+handlers
+
+ https://codesearch.debian.net/search?q=-%3Enonseekable+%3D
+ https://gitlab.gnome.org/GNOME/gvfs/blob/1.40.0-6-gcbc54396/client/gvfsfusedaemon.c#L1080
+ https://gitlab.gnome.org/GNOME/gvfs/blob/1.40.0-6-gcbc54396/client/gvfsfusedaemon.c#L1247-1346
+ https://gitlab.gnome.org/GNOME/gvfs/blob/1.40.0-6-gcbc54396/client/gvfsfusedaemon.c#L1399-1481
+
+so if we would do such a change it will break a real user.
+
+Add another flag (FOPEN_STREAM) for filesystem servers to indicate that the
+opened handler is having stream-like semantics; does not use file position
+and thus the kernel is free to issue simultaneous read and write request on
+opened file handle.
+
+This patch together with stream_open() should be added to stable kernels
+starting from v3.14+. This will allow to patch OSSPD and other FUSE
+filesystems that provide stream-like files to return FOPEN_STREAM |
+FOPEN_NONSEEKABLE in open handler and this way avoid the deadlock on all
+kernel versions. This should work because fuse_finish_open ignores unknown
+open flags returned from a filesystem and so passing FOPEN_STREAM to a
+kernel that is not aware of this flag cannot hurt. In turn the kernel that
+is not aware of FOPEN_STREAM will be < v3.14 where just FOPEN_NONSEEKABLE
+is sufficient to implement streams without read vs write deadlock.
+
+Cc: stable@vger.kernel.org # v3.14+
+Signed-off-by: Kirill Smelkov <kirr@nexedi.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/fuse/file.c | 4 +++-
+ include/uapi/linux/fuse.h | 2 ++
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index f811af4f6507..92ee15dda4c7 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -178,7 +178,9 @@ void fuse_finish_open(struct inode *inode, struct file *file)
+
+ if (!(ff->open_flags & FOPEN_KEEP_CACHE))
+ invalidate_inode_pages2(inode->i_mapping);
+- if (ff->open_flags & FOPEN_NONSEEKABLE)
++ if (ff->open_flags & FOPEN_STREAM)
++ stream_open(inode, file);
++ else if (ff->open_flags & FOPEN_NONSEEKABLE)
+ nonseekable_open(inode, file);
+ if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
+ struct fuse_inode *fi = get_fuse_inode(inode);
+diff --git a/include/uapi/linux/fuse.h b/include/uapi/linux/fuse.h
+index 2ac598614a8f..56a8fb4e1222 100644
+--- a/include/uapi/linux/fuse.h
++++ b/include/uapi/linux/fuse.h
+@@ -229,11 +229,13 @@ struct fuse_file_lock {
+ * FOPEN_KEEP_CACHE: don't invalidate the data cache on open
+ * FOPEN_NONSEEKABLE: the file is not seekable
+ * FOPEN_CACHE_DIR: allow caching this directory
++ * FOPEN_STREAM: the file is stream-like (no file position at all)
+ */
+ #define FOPEN_DIRECT_IO (1 << 0)
+ #define FOPEN_KEEP_CACHE (1 << 1)
+ #define FOPEN_NONSEEKABLE (1 << 2)
+ #define FOPEN_CACHE_DIR (1 << 3)
++#define FOPEN_STREAM (1 << 4)
+
+ /**
+ * INIT request/reply flags
+--
+2.21.0
+
diff --git a/patches.suse/dm-make-sure-to-obey-max_io_len_target_boundary.patch b/patches.kernel.org/5.1.5-111-dm-make-sure-to-obey-max_io_len_target_boundary.patch
index 360fb50590..8c7c6396fc 100644
--- a/patches.suse/dm-make-sure-to-obey-max_io_len_target_boundary.patch
+++ b/patches.kernel.org/5.1.5-111-dm-make-sure-to-obey-max_io_len_target_boundary.patch
@@ -1,10 +1,11 @@
From: Michael Lass <bevan@bi-co.net>
Date: Tue, 21 May 2019 21:58:07 +0200
-Subject: dm: make sure to obey max_io_len_target_boundary
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git#for-next
+Subject: [PATCH] dm: make sure to obey max_io_len_target_boundary
+Patch-mainline: 5.1.5
+References: bnc#1012628 bnc#1135868
Git-commit: 51b86f9a8d1c4bb4e3862ee4b4c5f46072f7520d
-Patch-mainline: Queued in subsystem maintainer repository
-References: bnc#1135868
+
+commit 51b86f9a8d1c4bb4e3862ee4b4c5f46072f7520d upstream.
Commit 61697a6abd24 ("dm: eliminate 'split_discard_bios' flag from DM
target interface") incorrectly removed code from
@@ -20,14 +21,17 @@ Fixes: 61697a6abd24 ("dm: eliminate 'split_discard_bios' flag from DM target int
Cc: stable@vger.kernel.org # 5.1+
Signed-off-by: Michael Lass <bevan@bi-co.net>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
- drivers/md/dm.c | 4 +++-
+ drivers/md/dm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 043f0761e4a0..08e7d412af95 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
-@@ -1483,7 +1483,7 @@ static unsigned get_num_write_zeroes_bio
+@@ -1467,7 +1467,7 @@ static unsigned get_num_write_zeroes_bios(struct dm_target *ti)
static int __send_changing_extent_only(struct clone_info *ci, struct dm_target *ti,
unsigned num_bios)
{
@@ -36,7 +40,7 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
/*
* Even though the device advertised support for this type of
-@@ -1494,6 +1494,8 @@ static int __send_changing_extent_only(s
+@@ -1478,6 +1478,8 @@ static int __send_changing_extent_only(struct clone_info *ci, struct dm_target *
if (!num_bios)
return -EOPNOTSUPP;
@@ -45,3 +49,6 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
__send_duplicate_bios(ci, ti, num_bios, &len);
ci->sector += len;
+--
+2.21.0
+
diff --git a/patches.suse/Revert-Don-t-jump-to-compute_result-state-from-check.patch b/patches.kernel.org/5.1.5-112-Revert-Don-t-jump-to-compute_result-state-from-.patch
index 759aa6ac2f..a55606d751 100644
--- a/patches.suse/Revert-Don-t-jump-to-compute_result-state-from-check.patch
+++ b/patches.kernel.org/5.1.5-112-Revert-Don-t-jump-to-compute_result-state-from-.patch
@@ -1,9 +1,12 @@
From: Song Liu <songliubraving@fb.com>
Date: Tue, 16 Apr 2019 09:34:21 -0700
-Subject: Revert "Don't jump to compute_result state from check_result state"
+Subject: [PATCH] Revert "Don't jump to compute_result state from check_result
+ state"
+Patch-mainline: 5.1.5
+References: bnc#1012628 git-fixes
Git-commit: a25d8c327bb41742dbd59f8c545f59f3b9c39983
-Patch-mainline: 5.2-rc1
-References: git-fixes
+
+commit a25d8c327bb41742dbd59f8c545f59f3b9c39983 upstream.
This reverts commit 4f4fd7c5798bbdd5a03a60f6269cf1177fbd11ef.
@@ -11,16 +14,17 @@ Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Nigel Croxon <ncroxon@redhat.com>
Cc: Xiao Ni <xni@redhat.com>
Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
drivers/md/raid5.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 2b0a715e70c9..b5742d07662d 100644
+index 364dd2f6fa1b..c033bfcb209e 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
-@@ -4227,15 +4227,26 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+@@ -4223,15 +4223,26 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
case check_state_check_result:
sh->check_state = check_state_idle;
diff --git a/patches.kernel.org/5.1.5-113-md-raid-raid5-preserve-the-writeback-action-aft.patch b/patches.kernel.org/5.1.5-113-md-raid-raid5-preserve-the-writeback-action-aft.patch
new file mode 100644
index 0000000000..752a944fea
--- /dev/null
+++ b/patches.kernel.org/5.1.5-113-md-raid-raid5-preserve-the-writeback-action-aft.patch
@@ -0,0 +1,58 @@
+From: Nigel Croxon <ncroxon@redhat.com>
+Date: Tue, 16 Apr 2019 09:50:09 -0700
+Subject: [PATCH] md/raid: raid5 preserve the writeback action after the parity
+ check
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: b2176a1dfb518d870ee073445d27055fea64dfb8
+
+commit b2176a1dfb518d870ee073445d27055fea64dfb8 upstream.
+
+The problem is that any 'uptodate' vs 'disks' check is not precise
+in this path. Put a "WARN_ON(!test_bit(R5_UPTODATE, &dev->flags)" on the
+device that might try to kick off writes and then skip the action.
+Better to prevent the raid driver from taking unexpected action *and* keep
+the system alive vs killing the machine with BUG_ON.
+
+Note: fixed warning reported by kbuild test robot <lkp@intel.com>
+
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Nigel Croxon <ncroxon@redhat.com>
+Signed-off-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/md/raid5.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c033bfcb209e..a4d2f552c8ab 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -4187,7 +4187,7 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ /* now write out any block on a failed drive,
+ * or P or Q if they were recomputed
+ */
+- BUG_ON(s->uptodate < disks - 1); /* We don't need Q to recover */
++ dev = NULL;
+ if (s->failed == 2) {
+ dev = &sh->dev[s->failed_num[1]];
+ s->locked++;
+@@ -4212,6 +4212,14 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
+ set_bit(R5_LOCKED, &dev->flags);
+ set_bit(R5_Wantwrite, &dev->flags);
+ }
++ if (WARN_ONCE(dev && !test_bit(R5_UPTODATE, &dev->flags),
++ "%s: disk%td not up to date\n",
++ mdname(conf->mddev),
++ dev - (struct r5dev *) &sh->dev)) {
++ clear_bit(R5_LOCKED, &dev->flags);
++ clear_bit(R5_Wantwrite, &dev->flags);
++ s->locked--;
++ }
+ clear_bit(STRIPE_DEGRADED, &sh->state);
+
+ set_bit(STRIPE_INSYNC, &sh->state);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-114-dmaengine-imx-sdma-Only-check-ratio-on-parts-th.patch b/patches.kernel.org/5.1.5-114-dmaengine-imx-sdma-Only-check-ratio-on-parts-th.patch
new file mode 100644
index 0000000000..23973ab4f1
--- /dev/null
+++ b/patches.kernel.org/5.1.5-114-dmaengine-imx-sdma-Only-check-ratio-on-parts-th.patch
@@ -0,0 +1,84 @@
+From: "Angus Ainslie (Purism)" <angus@akkea.ca>
+Date: Fri, 29 Mar 2019 08:21:29 -0700
+Subject: [PATCH] dmaengine: imx-sdma: Only check ratio on parts that support
+ 1:1
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 941acd566b1807b291bbdca31cc5158e26ffcf83
+
+commit 941acd566b1807b291bbdca31cc5158e26ffcf83 upstream.
+
+On imx8mq B0 chip, AHB/SDMA clock ratio 2:1 can't be supported,
+since SDMA clock ratio has to be increased to 250Mhz, AHB can't reach
+to 500Mhz, so use 1:1 instead.
+
+To limit this change to the imx8mq for now this patch also adds an
+im8mq-sdma compatible string.
+
+Signed-off-by: Angus Ainslie (Purism) <angus@akkea.ca>
+Acked-by: Robin Gong <yibin.gong@nxp.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Cc: Richard Leitner <richard.leitner@skidata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/dma/imx-sdma.c | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index 5f3c1378b90e..99d9f431ae2c 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -419,6 +419,7 @@ struct sdma_driver_data {
+ int chnenbl0;
+ int num_events;
+ struct sdma_script_start_addrs *script_addrs;
++ bool check_ratio;
+ };
+
+ struct sdma_engine {
+@@ -557,6 +558,13 @@ static struct sdma_driver_data sdma_imx7d = {
+ .script_addrs = &sdma_script_imx7d,
+ };
+
++static struct sdma_driver_data sdma_imx8mq = {
++ .chnenbl0 = SDMA_CHNENBL0_IMX35,
++ .num_events = 48,
++ .script_addrs = &sdma_script_imx7d,
++ .check_ratio = 1,
++};
++
+ static const struct platform_device_id sdma_devtypes[] = {
+ {
+ .name = "imx25-sdma",
+@@ -579,6 +587,9 @@ static const struct platform_device_id sdma_devtypes[] = {
+ }, {
+ .name = "imx7d-sdma",
+ .driver_data = (unsigned long)&sdma_imx7d,
++ }, {
++ .name = "imx8mq-sdma",
++ .driver_data = (unsigned long)&sdma_imx8mq,
+ }, {
+ /* sentinel */
+ }
+@@ -593,6 +604,7 @@ static const struct of_device_id sdma_dt_ids[] = {
+ { .compatible = "fsl,imx31-sdma", .data = &sdma_imx31, },
+ { .compatible = "fsl,imx25-sdma", .data = &sdma_imx25, },
+ { .compatible = "fsl,imx7d-sdma", .data = &sdma_imx7d, },
++ { .compatible = "fsl,imx8mq-sdma", .data = &sdma_imx8mq, },
+ { /* sentinel */ }
+ };
+ MODULE_DEVICE_TABLE(of, sdma_dt_ids);
+@@ -1852,7 +1864,8 @@ static int sdma_init(struct sdma_engine *sdma)
+ if (ret)
+ goto disable_clk_ipg;
+
+- if (clk_get_rate(sdma->clk_ahb) == clk_get_rate(sdma->clk_ipg))
++ if (sdma->drvdata->check_ratio &&
++ (clk_get_rate(sdma->clk_ahb) == clk_get_rate(sdma->clk_ipg)))
+ sdma->clk_ratio = 1;
+
+ /* Be sure SDMA has not started yet */
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-115-driver-core-Postpone-DMA-tear-down-until-after-.patch b/patches.kernel.org/5.1.5-115-driver-core-Postpone-DMA-tear-down-until-after-.patch
new file mode 100644
index 0000000000..f5b32edc9e
--- /dev/null
+++ b/patches.kernel.org/5.1.5-115-driver-core-Postpone-DMA-tear-down-until-after-.patch
@@ -0,0 +1,123 @@
+From: John Garry <john.garry@huawei.com>
+Date: Thu, 28 Mar 2019 18:08:05 +0800
+Subject: [PATCH] driver core: Postpone DMA tear-down until after devres
+ release for probe failure
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 0b777eee88d712256ba8232a9429edb17c4f9ceb
+
+commit 0b777eee88d712256ba8232a9429edb17c4f9ceb upstream.
+
+In commit 376991db4b64 ("driver core: Postpone DMA tear-down until after
+devres release"), we changed the ordering of tearing down the device DMA
+ops and releasing all the device's resources; this was because the DMA ops
+should be maintained until we release the device's managed DMA memories.
+
+However, we have seen another crash on an arm64 system when a
+device driver probe fails:
+
+ hisi_sas_v3_hw 0000:74:02.0: Adding to iommu group 2
+ scsi host1: hisi_sas_v3_hw
+ BUG: Bad page state in process swapper/0 pfn:313f5
+ page:ffff7e0000c4fd40 count:1 mapcount:0
+ mapping:0000000000000000 index:0x0
+ flags: 0xfffe00000001000(reserved)
+ raw: 0fffe00000001000 ffff7e0000c4fd48 ffff7e0000c4fd48
+0000000000000000
+ raw: 0000000000000000 0000000000000000 00000001ffffffff
+0000000000000000
+ page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
+ bad because of flags: 0x1000(reserved)
+ Modules linked in:
+ CPU: 49 PID: 1 Comm: swapper/0 Not tainted
+5.1.0-rc1-43081-g22d97fd-dirty #1433
+ Hardware name: Huawei D06/D06, BIOS Hisilicon D06 UEFI
+RC0 - V1.12.01 01/29/2019
+ Call trace:
+ dump_backtrace+0x0/0x118
+ show_stack+0x14/0x1c
+ dump_stack+0xa4/0xc8
+ bad_page+0xe4/0x13c
+ free_pages_check_bad+0x4c/0xc0
+ __free_pages_ok+0x30c/0x340
+ __free_pages+0x30/0x44
+ __dma_direct_free_pages+0x30/0x38
+ dma_direct_free+0x24/0x38
+ dma_free_attrs+0x9c/0xd8
+ dmam_release+0x20/0x28
+ release_nodes+0x17c/0x220
+ devres_release_all+0x34/0x54
+ really_probe+0xc4/0x2c8
+ driver_probe_device+0x58/0xfc
+ device_driver_attach+0x68/0x70
+ __driver_attach+0x94/0xdc
+ bus_for_each_dev+0x5c/0xb4
+ driver_attach+0x20/0x28
+ bus_add_driver+0x14c/0x200
+ driver_register+0x6c/0x124
+ __pci_register_driver+0x48/0x50
+ sas_v3_pci_driver_init+0x20/0x28
+ do_one_initcall+0x40/0x25c
+ kernel_init_freeable+0x2b8/0x3c0
+ kernel_init+0x10/0x100
+ ret_from_fork+0x10/0x18
+ Disabling lock debugging due to kernel taint
+ BUG: Bad page state in process swapper/0 pfn:313f6
+ page:ffff7e0000c4fd80 count:1 mapcount:0
+mapping:0000000000000000 index:0x0
+[ 89.322983] flags: 0xfffe00000001000(reserved)
+ raw: 0fffe00000001000 ffff7e0000c4fd88 ffff7e0000c4fd88
+0000000000000000
+ raw: 0000000000000000 0000000000000000 00000001ffffffff
+0000000000000000
+
+The crash occurs for the same reason.
+
+In this case, on the really_probe() failure path, we are still clearing
+the DMA ops prior to releasing the device's managed memories.
+
+This patch fixes this issue by reordering the DMA ops teardown and the
+call to devres_release_all() on the failure path.
+
+Reported-by: Xiang Chen <chenxiang66@hisilicon.com>
+Tested-by: Xiang Chen <chenxiang66@hisilicon.com>
+Signed-off-by: John Garry <john.garry@huawei.com>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/base/dd.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index a823f469e53f..0df9b4461766 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -490,7 +490,7 @@ re_probe:
+ if (dev->bus->dma_configure) {
+ ret = dev->bus->dma_configure(dev);
+ if (ret)
+- goto dma_failed;
++ goto probe_failed;
+ }
+
+ if (driver_sysfs_add(dev)) {
+@@ -546,14 +546,13 @@ re_probe:
+ goto done;
+
+ probe_failed:
+- arch_teardown_dma_ops(dev);
+-dma_failed:
+ if (dev->bus)
+ blocking_notifier_call_chain(&dev->bus->p->bus_notifier,
+ BUS_NOTIFY_DRIVER_NOT_BOUND, dev);
+ pinctrl_bind_failed:
+ device_links_no_driver(dev);
+ devres_release_all(dev);
++ arch_teardown_dma_ops(dev);
+ driver_sysfs_remove(dev);
+ dev->driver = NULL;
+ dev_set_drvdata(dev, NULL);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-116-bpf-relax-inode-permission-check-for-retrieving.patch b/patches.kernel.org/5.1.5-116-bpf-relax-inode-permission-check-for-retrieving.patch
new file mode 100644
index 0000000000..823fe117d9
--- /dev/null
+++ b/patches.kernel.org/5.1.5-116-bpf-relax-inode-permission-check-for-retrieving.patch
@@ -0,0 +1,43 @@
+From: Chenbo Feng <fengc@google.com>
+Date: Tue, 14 May 2019 19:42:57 -0700
+Subject: [PATCH] bpf: relax inode permission check for retrieving bpf program
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: e547ff3f803e779a3898f1f48447b29f43c54085
+
+commit e547ff3f803e779a3898f1f48447b29f43c54085 upstream.
+
+For iptable module to load a bpf program from a pinned location, it
+only retrieve a loaded program and cannot change the program content so
+requiring a write permission for it might not be necessary.
+Also when adding or removing an unrelated iptable rule, it might need to
+flush and reload the xt_bpf related rules as well and triggers the inode
+permission check. It might be better to remove the write premission
+check for the inode so we won't need to grant write access to all the
+processes that flush and restore iptables rules.
+
+Signed-off-by: Chenbo Feng <fengc@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/bpf/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
+index 4a8f390a2b82..dc9d7ac8228d 100644
+--- a/kernel/bpf/inode.c
++++ b/kernel/bpf/inode.c
+@@ -518,7 +518,7 @@ out:
+ static struct bpf_prog *__get_prog_inode(struct inode *inode, enum bpf_prog_type type)
+ {
+ struct bpf_prog *prog;
+- int ret = inode_permission(inode, MAY_READ | MAY_WRITE);
++ int ret = inode_permission(inode, MAY_READ);
+ if (ret)
+ return ERR_PTR(ret);
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-117-bpf-add-map_lookup_elem_sys_only-for-lookups-fr.patch b/patches.kernel.org/5.1.5-117-bpf-add-map_lookup_elem_sys_only-for-lookups-fr.patch
new file mode 100644
index 0000000000..b9e7bc3149
--- /dev/null
+++ b/patches.kernel.org/5.1.5-117-bpf-add-map_lookup_elem_sys_only-for-lookups-fr.patch
@@ -0,0 +1,61 @@
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Tue, 14 May 2019 01:18:55 +0200
+Subject: [PATCH] bpf: add map_lookup_elem_sys_only for lookups from syscall
+ side
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: c6110222c6f49ea68169f353565eb865488a8619
+
+commit c6110222c6f49ea68169f353565eb865488a8619 upstream.
+
+Add a callback map_lookup_elem_sys_only() that map implementations
+could use over map_lookup_elem() from system call side in case the
+map implementation needs to handle the latter differently than from
+the BPF data path. If map_lookup_elem_sys_only() is set, this will
+be preferred pick for map lookups out of user space. This hook is
+used in a follow-up fix for LRU map, but once development window
+opens, we can convert other map types from map_lookup_elem() (here,
+the one called upon BPF_MAP_LOOKUP_ELEM cmd is meant) over to use
+the callback to simplify and clean up the latter.
+
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ include/linux/bpf.h | 1 +
+ kernel/bpf/syscall.c | 5 ++++-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/include/linux/bpf.h b/include/linux/bpf.h
+index 944ccc310201..ac721fc5f95e 100644
+--- a/include/linux/bpf.h
++++ b/include/linux/bpf.h
+@@ -36,6 +36,7 @@ struct bpf_map_ops {
+ void (*map_free)(struct bpf_map *map);
+ int (*map_get_next_key)(struct bpf_map *map, void *key, void *next_key);
+ void (*map_release_uref)(struct bpf_map *map);
++ void *(*map_lookup_elem_sys_only)(struct bpf_map *map, void *key);
+
+ /* funcs callable from userspace and from eBPF programs */
+ void *(*map_lookup_elem)(struct bpf_map *map, void *key);
+diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
+index afca36f53c49..db6e825e2958 100644
+--- a/kernel/bpf/syscall.c
++++ b/kernel/bpf/syscall.c
+@@ -773,7 +773,10 @@ static int map_lookup_elem(union bpf_attr *attr)
+ err = map->ops->map_peek_elem(map, value);
+ } else {
+ rcu_read_lock();
+- ptr = map->ops->map_lookup_elem(map, key);
++ if (map->ops->map_lookup_elem_sys_only)
++ ptr = map->ops->map_lookup_elem_sys_only(map, key);
++ else
++ ptr = map->ops->map_lookup_elem(map, key);
+ if (IS_ERR(ptr)) {
+ err = PTR_ERR(ptr);
+ } else if (!ptr) {
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-118-bpf-lru-avoid-messing-with-eviction-heuristics-.patch b/patches.kernel.org/5.1.5-118-bpf-lru-avoid-messing-with-eviction-heuristics-.patch
new file mode 100644
index 0000000000..a517aa4a81
--- /dev/null
+++ b/patches.kernel.org/5.1.5-118-bpf-lru-avoid-messing-with-eviction-heuristics-.patch
@@ -0,0 +1,112 @@
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Tue, 14 May 2019 01:18:56 +0200
+Subject: [PATCH] bpf, lru: avoid messing with eviction heuristics upon syscall
+ lookup
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 50b045a8c0ccf44f76640ac3eea8d80ca53979a3
+
+commit 50b045a8c0ccf44f76640ac3eea8d80ca53979a3 upstream.
+
+One of the biggest issues we face right now with picking LRU map over
+regular hash table is that a map walk out of user space, for example,
+to just dump the existing entries or to remove certain ones, will
+completely mess up LRU eviction heuristics and wrong entries such
+as just created ones will get evicted instead. The reason for this
+is that we mark an entry as "in use" via bpf_lru_node_set_ref() from
+system call lookup side as well. Thus upon walk, all entries are
+being marked, so information of actual least recently used ones
+are "lost".
+
+In case of Cilium where it can be used (besides others) as a BPF
+based connection tracker, this current behavior causes disruption
+upon control plane changes that need to walk the map from user space
+to evict certain entries. Discussion result from bpfconf [0] was that
+we should simply just remove marking from system call side as no
+good use case could be found where it's actually needed there.
+Therefore this patch removes marking for regular LRU and per-CPU
+flavor. If there ever should be a need in future, the behavior could
+be selected via map creation flag, but due to mentioned reason we
+avoid this here.
+
+ [0] http://vger.kernel.org/bpfconf.html
+
+Fixes: 29ba732acbee ("bpf: Add BPF_MAP_TYPE_LRU_HASH")
+Fixes: 8f8449384ec3 ("bpf: Add BPF_MAP_TYPE_LRU_PERCPU_HASH")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ kernel/bpf/hashtab.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
+index fed15cf94dca..f79b4aa0a4af 100644
+--- a/kernel/bpf/hashtab.c
++++ b/kernel/bpf/hashtab.c
+@@ -527,18 +527,30 @@ static u32 htab_map_gen_lookup(struct bpf_map *map, struct bpf_insn *insn_buf)
+ return insn - insn_buf;
+ }
+
+-static void *htab_lru_map_lookup_elem(struct bpf_map *map, void *key)
++static __always_inline void *__htab_lru_map_lookup_elem(struct bpf_map *map,
++ void *key, const bool mark)
+ {
+ struct htab_elem *l = __htab_map_lookup_elem(map, key);
+
+ if (l) {
+- bpf_lru_node_set_ref(&l->lru_node);
++ if (mark)
++ bpf_lru_node_set_ref(&l->lru_node);
+ return l->key + round_up(map->key_size, 8);
+ }
+
+ return NULL;
+ }
+
++static void *htab_lru_map_lookup_elem(struct bpf_map *map, void *key)
++{
++ return __htab_lru_map_lookup_elem(map, key, true);
++}
++
++static void *htab_lru_map_lookup_elem_sys(struct bpf_map *map, void *key)
++{
++ return __htab_lru_map_lookup_elem(map, key, false);
++}
++
+ static u32 htab_lru_map_gen_lookup(struct bpf_map *map,
+ struct bpf_insn *insn_buf)
+ {
+@@ -1250,6 +1262,7 @@ const struct bpf_map_ops htab_lru_map_ops = {
+ .map_free = htab_map_free,
+ .map_get_next_key = htab_map_get_next_key,
+ .map_lookup_elem = htab_lru_map_lookup_elem,
++ .map_lookup_elem_sys_only = htab_lru_map_lookup_elem_sys,
+ .map_update_elem = htab_lru_map_update_elem,
+ .map_delete_elem = htab_lru_map_delete_elem,
+ .map_gen_lookup = htab_lru_map_gen_lookup,
+@@ -1281,7 +1294,6 @@ static void *htab_lru_percpu_map_lookup_elem(struct bpf_map *map, void *key)
+
+ int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value)
+ {
+- struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
+ struct htab_elem *l;
+ void __percpu *pptr;
+ int ret = -ENOENT;
+@@ -1297,8 +1309,9 @@ int bpf_percpu_hash_copy(struct bpf_map *map, void *key, void *value)
+ l = __htab_map_lookup_elem(map, key);
+ if (!l)
+ goto out;
+- if (htab_is_lru(htab))
+- bpf_lru_node_set_ref(&l->lru_node);
++ /* We do not mark LRU map element here in order to not mess up
++ * eviction heuristics when user space does a map walk.
++ */
+ pptr = htab_elem_get_ptr(l, map->key_size);
+ for_each_possible_cpu(cpu) {
+ bpf_long_memcpy(value + off,
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-119-y2038-Make-CONFIG_64BIT_TIME-unconditional.patch b/patches.kernel.org/5.1.5-119-y2038-Make-CONFIG_64BIT_TIME-unconditional.patch
new file mode 100644
index 0000000000..53912e0fb1
--- /dev/null
+++ b/patches.kernel.org/5.1.5-119-y2038-Make-CONFIG_64BIT_TIME-unconditional.patch
@@ -0,0 +1,62 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 29 Apr 2019 15:19:37 +0200
+Subject: [PATCH] y2038: Make CONFIG_64BIT_TIME unconditional
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: f3d964673b2f1c5d5c68c77273efcf7103eed03b
+
+commit f3d964673b2f1c5d5c68c77273efcf7103eed03b upstream.
+
+As Stepan Golosunov points out, there is a small mistake in the
+get_timespec64() function in the kernel. It was originally added under the
+assumption that CONFIG_64BIT_TIME would get enabled on all 32-bit and
+64-bit architectures, but when the conversion was done, it was only turned
+on for 32-bit ones.
+
+The effect is that the get_timespec64() function never clears the upper
+half of the tv_nsec field for 32-bit tasks in compat mode. Clearing this is
+required for POSIX compliant behavior of functions that pass a 'timespec'
+structure with a 64-bit tv_sec and a 32-bit tv_nsec, plus uninitialized
+padding.
+
+The easiest fix for linux-5.1 is to just make the Kconfig symbol
+unconditional, as it was originally intended. As a follow-up, the #ifdef
+CONFIG_64BIT_TIME can be removed completely..
+
+Note: for native 32-bit mode, no change is needed, this works as
+designed and user space should never need to clear the upper 32
+bits of the tv_nsec field, in or out of the kernel.
+
+Fixes: 00bf25d693e7 ("y2038: use time32 syscall names on 32-bit")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Joseph Myers <joseph@codesourcery.com>
+Cc: libc-alpha@sourceware.org
+Cc: linux-api@vger.kernel.org
+Cc: Deepa Dinamani <deepa.kernel@gmail.com>
+Cc: Lukasz Majewski <lukma@denx.de>
+Cc: Stepan Golosunov <stepan@golosunov.pp.ru>
+Link: https://lore.kernel.org/lkml/20190422090710.bmxdhhankurhafxq@sghpc.golosunov.pp.ru/
+Link: https://lkml.kernel.org/r/20190429131951.471701-1-arnd@arndb.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/Kconfig b/arch/Kconfig
+index 33687dddd86a..9092e0ffe4d3 100644
+--- a/arch/Kconfig
++++ b/arch/Kconfig
+@@ -764,7 +764,7 @@ config COMPAT_OLD_SIGACTION
+ bool
+
+ config 64BIT_TIME
+- def_bool ARCH_HAS_64BIT_TIME
++ def_bool y
+ help
+ This should be selected by all architectures that need to support
+ new system calls with a 64-bit time_t. This is relevant on all 32-bit
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-120-btrfs-reloc-Fix-NULL-pointer-dereference-due-to.patch b/patches.kernel.org/5.1.5-120-btrfs-reloc-Fix-NULL-pointer-dereference-due-to.patch
new file mode 100644
index 0000000000..e9af789ea5
--- /dev/null
+++ b/patches.kernel.org/5.1.5-120-btrfs-reloc-Fix-NULL-pointer-dereference-due-to.patch
@@ -0,0 +1,91 @@
+From: Qu Wenruo <wqu@suse.com>
+Date: Mon, 18 Mar 2019 10:48:19 +0800
+Subject: [PATCH] btrfs: reloc: Fix NULL pointer dereference due to expanded
+ reloc_root lifespan
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 10995c0491204c861948c9850939a7f4e90760a4
+
+commit 10995c0491204c861948c9850939a7f4e90760a4 upstream.
+
+Commit d2311e698578 ("btrfs: relocation: Delay reloc tree deletion after
+merge_reloc_roots()") expands the life span of root->reloc_root.
+
+This breaks certain checs of fs_info->reloc_ctl. Before that commit, if
+we have a root with valid reloc_root, then it's ensured to have
+fs_info->reloc_ctl.
+
+But now since reloc_root doesn't always mean a valid fs_info->reloc_ctl,
+such check is unreliable and can cause the following NULL pointer
+dereference:
+
+ BUG: unable to handle kernel NULL pointer dereference at 00000000000005c1
+ IP: btrfs_reloc_pre_snapshot+0x20/0x50 [btrfs]
+ PGD 0 P4D 0
+ Oops: 0000 [#1] SMP PTI
+ CPU: 0 PID: 10379 Comm: snapperd Not tainted
+ Call Trace:
+ create_pending_snapshot+0xd7/0xfc0 [btrfs]
+ create_pending_snapshots+0x8e/0xb0 [btrfs]
+ btrfs_commit_transaction+0x2ac/0x8f0 [btrfs]
+ btrfs_mksubvol+0x561/0x570 [btrfs]
+ btrfs_ioctl_snap_create_transid+0x189/0x190 [btrfs]
+ btrfs_ioctl_snap_create_v2+0x102/0x150 [btrfs]
+ btrfs_ioctl+0x5c9/0x1e60 [btrfs]
+ do_vfs_ioctl+0x90/0x5f0
+ SyS_ioctl+0x74/0x80
+ do_syscall_64+0x7b/0x150
+ entry_SYSCALL_64_after_hwframe+0x3d/0xa2
+ RIP: 0033:0x7fd7cdab8467
+
+Fix it by explicitly checking fs_info->reloc_ctl other than using the
+implied root->reloc_root.
+
+Fixes: d2311e698578 ("btrfs: relocation: Delay reloc tree deletion after merge_reloc_roots")
+Signed-off-by: Qu Wenruo <wqu@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ fs/btrfs/relocation.c | 12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index ddf028509931..351fa506dc9b 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -4667,14 +4667,12 @@ int btrfs_reloc_cow_block(struct btrfs_trans_handle *trans,
+ void btrfs_reloc_pre_snapshot(struct btrfs_pending_snapshot *pending,
+ u64 *bytes_to_reserve)
+ {
+- struct btrfs_root *root;
+- struct reloc_control *rc;
++ struct btrfs_root *root = pending->root;
++ struct reloc_control *rc = root->fs_info->reloc_ctl;
+
+- root = pending->root;
+- if (!root->reloc_root)
++ if (!root->reloc_root || !rc)
+ return;
+
+- rc = root->fs_info->reloc_ctl;
+ if (!rc->merge_reloc_tree)
+ return;
+
+@@ -4703,10 +4701,10 @@ int btrfs_reloc_post_snapshot(struct btrfs_trans_handle *trans,
+ struct btrfs_root *root = pending->root;
+ struct btrfs_root *reloc_root;
+ struct btrfs_root *new_root;
+- struct reloc_control *rc;
++ struct reloc_control *rc = root->fs_info->reloc_ctl;
+ int ret;
+
+- if (!root->reloc_root)
++ if (!root->reloc_root || !rc)
+ return 0;
+
+ rc = root->fs_info->reloc_ctl;
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-121-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch b/patches.kernel.org/5.1.5-121-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch
new file mode 100644
index 0000000000..1bf0f878d3
--- /dev/null
+++ b/patches.kernel.org/5.1.5-121-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch
@@ -0,0 +1,39 @@
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 2 Apr 2019 14:32:04 -0500
+Subject: [PATCH] ARM: dts: imx6q-logicpd: Reduce inrush current on USBH1
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 7aedca875074b33795bc77066b325898b1eb8032
+
+commit 7aedca875074b33795bc77066b325898b1eb8032 upstream.
+
+Some USB peripherals draw more power, and the sourcing regulator
+take a little time to turn on. This patch fixes an issue where
+some devices occasionally do not get detected, because the power
+isn't quite ready when communication starts, so we add a bit
+of a delay.
+
+Fixes: 1c207f911fe9 ("ARM: dts: imx: Add support for Logic PD i.MX6QD EVM")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi b/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
+index 3cae139e6396..2aab020a1e91 100644
+--- a/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
++++ b/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
+@@ -88,6 +88,7 @@
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
+ gpio = <&gpio7 12 GPIO_ACTIVE_HIGH>;
++ startup-delay-us = <70000>;
+ enable-active-high;
+ };
+
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-122-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch b/patches.kernel.org/5.1.5-122-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch
new file mode 100644
index 0000000000..0243c7ac38
--- /dev/null
+++ b/patches.kernel.org/5.1.5-122-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch
@@ -0,0 +1,41 @@
+From: Adam Ford <aford173@gmail.com>
+Date: Tue, 2 Apr 2019 14:19:08 -0500
+Subject: [PATCH] ARM: dts: imx6q-logicpd: Reduce inrush current on start
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: dbb58e291cd47e594b64293bd91a4ce40626513c
+
+commit dbb58e291cd47e594b64293bd91a4ce40626513c upstream.
+
+The main 3.3V regulator sources a series of additional regulators.
+This patch adds a small delay, so when the 3.3V regulator comes
+on it delays a bit before the subsequent regulators can come on.
+This reduces the inrush current a bit on the external DC power
+supply to help prevent a situation where the sourcing power supply
+cannot source enough current and overloads and the kit fails to
+start.
+
+Fixes: 1c207f911fe9 ("ARM: dts: imx: Add support for Logic PD i.MX6QD EVM")
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi b/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
+index 2aab020a1e91..c40a7af6ebee 100644
+--- a/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
++++ b/arch/arm/boot/dts/imx6-logicpd-baseboard.dtsi
+@@ -100,6 +100,7 @@
+ regulator-min-microvolt = <3300000>;
+ regulator-max-microvolt = <3300000>;
+ gpio = <&gpio1 26 GPIO_ACTIVE_HIGH>;
++ startup-delay-us = <70000>;
+ enable-active-high;
+ regulator-always-on;
+ };
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-123-fbdev-sm712fb-fix-memory-frequency-by-avoiding-.patch b/patches.kernel.org/5.1.5-123-fbdev-sm712fb-fix-memory-frequency-by-avoiding-.patch
new file mode 100644
index 0000000000..a745178775
--- /dev/null
+++ b/patches.kernel.org/5.1.5-123-fbdev-sm712fb-fix-memory-frequency-by-avoiding-.patch
@@ -0,0 +1,52 @@
+From: Yifeng Li <tomli@tomli.me>
+Date: Tue, 2 Apr 2019 17:14:10 +0200
+Subject: [PATCH] fbdev: sm712fb: fix memory frequency by avoiding a
+ switch/case fallthrough
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 9dc20113988b9a75ea6b3abd68dc45e2d73ccdab
+
+commit 9dc20113988b9a75ea6b3abd68dc45e2d73ccdab upstream.
+
+A fallthrough in switch/case was introduced in f627caf55b8e ("fbdev:
+sm712fb: fix crashes and garbled display during DPMS modesetting"),
+due to my copy-paste error, which would cause the memory clock frequency
+for SM720 to be programmed to SM712.
+
+Since it only reprograms the clock to a different frequency, it's only
+a benign issue without visible side-effect, so it also evaded Sudip
+Mukherjee's code review and regression tests. scripts/checkpatch.pl
+also failed to discover the issue, possibly due to nested switch
+statements.
+
+This issue was found by Stephen Rothwell by building linux-next with
+-Wimplicit-fallthrough.
+
+Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Fixes: f627caf55b8e ("fbdev: sm712fb: fix crashes and garbled display during DPMS modesetting")
+Signed-off-by: Yifeng Li <tomli@tomli.me>
+Cc: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
+Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Cc: Kees Cook <keescook@chromium.org>
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/video/fbdev/sm712fb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c
+index 1e2503b52c6f..f1dcc6766d1e 100644
+--- a/drivers/video/fbdev/sm712fb.c
++++ b/drivers/video/fbdev/sm712fb.c
+@@ -898,6 +898,7 @@ static int smtc_blank(int blank_mode, struct fb_info *info)
+ case 0x712:
+ smtc_seqw(0x6a, 0x16);
+ smtc_seqw(0x6b, 0x02);
++ break;
+ case 0x720:
+ smtc_seqw(0x6a, 0x0d);
+ smtc_seqw(0x6b, 0x02);
+--
+2.21.0
+
diff --git a/patches.kernel.org/5.1.5-124-Linux-5.1.5.patch b/patches.kernel.org/5.1.5-124-Linux-5.1.5.patch
new file mode 100644
index 0000000000..dd27596bf6
--- /dev/null
+++ b/patches.kernel.org/5.1.5-124-Linux-5.1.5.patch
@@ -0,0 +1,28 @@
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Sat, 25 May 2019 18:16:51 +0200
+Subject: [PATCH] Linux 5.1.5
+References: bnc#1012628
+Patch-mainline: 5.1.5
+Git-commit: 835365932f0dc25468840753e071c05ad6abc76f
+
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index acab93537f63..24a16a544ffd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 1
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Shy Crocodile
+
+--
+2.21.0
+
diff --git a/series.conf b/series.conf
index ac140643bc..16a3c5f21e 100644
--- a/series.conf
+++ b/series.conf
@@ -256,6 +256,130 @@
patches.kernel.org/5.1.4-124-s390-mm-make-the-pxd_offset-functions-more-robu.patch
patches.kernel.org/5.1.4-125-s390-mm-convert-to-the-generic-get_user_pages_f.patch
patches.kernel.org/5.1.4-126-Linux-5.1.4.patch
+ patches.kernel.org/5.1.5-001-ipv6-fix-src-addr-routing-with-the-exception-ta.patch
+ patches.kernel.org/5.1.5-002-ipv6-prevent-possible-fib6-leaks.patch
+ patches.kernel.org/5.1.5-003-net-Always-descend-into-dsa.patch
+ patches.kernel.org/5.1.5-004-net-avoid-weird-emergency-message.patch
+ patches.kernel.org/5.1.5-005-net-mlx4_core-Change-the-error-print-to-info-pr.patch
+ patches.kernel.org/5.1.5-006-net-test-nouarg-before-dereferencing-zerocopy-p.patch
+ patches.kernel.org/5.1.5-007-net-usb-qmi_wwan-add-Telit-0x1260-and-0x1261-co.patch
+ patches.kernel.org/5.1.5-008-nfp-flower-add-rcu-locks-when-accessing-netdev-.patch
+ patches.kernel.org/5.1.5-009-ppp-deflate-Fix-possible-crash-in-deflate_init.patch
+ patches.kernel.org/5.1.5-010-rtnetlink-always-put-IFLA_LINK-for-links-with-a.patch
+ patches.kernel.org/5.1.5-011-tipc-switch-order-of-device-registration-to-fix.patch
+ patches.kernel.org/5.1.5-012-vsock-virtio-free-packets-during-the-socket-rel.patch
+ patches.kernel.org/5.1.5-013-tipc-fix-modprobe-tipc-failed-after-switch-orde.patch
+ patches.kernel.org/5.1.5-014-mlxsw-core-Prevent-QSFP-module-initialization-f.patch
+ patches.kernel.org/5.1.5-015-mlxsw-core-Prevent-reading-unsupported-slave-ad.patch
+ patches.kernel.org/5.1.5-016-flow_offload-support-CVLAN-match.patch
+ patches.kernel.org/5.1.5-017-net-mlx5e-Fix-calling-wrong-function-to-get-inn.patch
+ patches.kernel.org/5.1.5-018-net-mlx5-Fix-peer-pf-disable-hca-command.patch
+ patches.kernel.org/5.1.5-019-vsock-virtio-Initialize-core-virtio-vsock-befor.patch
+ patches.kernel.org/5.1.5-020-net-mlx5e-Add-missing-ethtool-driver-info-for-r.patch
+ patches.kernel.org/5.1.5-021-net-mlx5e-Additional-check-for-flow-destination.patch
+ patches.kernel.org/5.1.5-022-net-mlx5-Imply-MLXFW-in-mlx5_core.patch
+ patches.kernel.org/5.1.5-023-net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG.patch
+ patches.kernel.org/5.1.5-024-blk-mq-free-hw-queue-s-resource-in-hctx-s-relea.patch
+ patches.kernel.org/5.1.5-025-regulator-core-fix-error-path-for-regulator_set.patch
+ patches.kernel.org/5.1.5-026-parisc-Export-running_on_qemu-symbol-for-module.patch
+ patches.kernel.org/5.1.5-027-parisc-Add-memory-clobber-to-TLB-purges.patch
+ patches.kernel.org/5.1.5-028-parisc-Skip-registering-LED-when-running-in-QEM.patch
+ patches.kernel.org/5.1.5-029-parisc-Add-memory-barrier-to-asm-pdc-and-sync-i.patch
+ patches.kernel.org/5.1.5-030-parisc-Allow-live-patching-of-__meminit-functio.patch
+ patches.kernel.org/5.1.5-031-parisc-Use-PA_ASM_LEVEL-in-boot-code.patch
+ patches.kernel.org/5.1.5-032-parisc-Rename-LEVEL-to-PA_ASM_LEVEL-to-avoid-na.patch
+ patches.kernel.org/5.1.5-033-stm-class-Fix-channel-free-in-stm-output-free-p.patch
+ patches.kernel.org/5.1.5-034-stm-class-Fix-channel-bitmap-on-32-bit-systems.patch
+ patches.kernel.org/5.1.5-035-brd-re-enable-__GFP_HIGHMEM-in-brd_insert_page.patch
+ patches.kernel.org/5.1.5-036-proc-prevent-changes-to-overridden-credentials.patch
+ patches.kernel.org/5.1.5-037-Revert-MD-fix-lock-contention-for-flush-bios.patch
+ patches.kernel.org/5.1.5-038-md-batch-flush-requests.patch
+ patches.kernel.org/5.1.5-039-md-add-mddev-pers-to-avoid-potential-NULL-point.patch
+ patches.kernel.org/5.1.5-040-md-add-a-missing-endianness-conversion-in-check.patch
+ patches.kernel.org/5.1.5-041-dcache-sort-the-freeing-without-RCU-delay-mess-.patch
+ patches.kernel.org/5.1.5-042-intel_th-msu-Fix-single-mode-with-IOMMU.patch
+ patches.kernel.org/5.1.5-043-p54-drop-device-reference-count-if-fails-to-ena.patch
+ patches.kernel.org/5.1.5-044-of-fix-clang-Wunsequenced-for-be32_to_cpu.patch
+ patches.kernel.org/5.1.5-045-brcmfmac-Add-DMI-nvram-filename-quirk-for-ACEPC.patch
+ patches.kernel.org/5.1.5-046-cifs-fix-credits-leak-for-SMB1-oplock-breaks.patch
+ patches.kernel.org/5.1.5-047-cifs-fix-strcat-buffer-overflow-and-reduce-raci.patch
+ patches.kernel.org/5.1.5-048-phy-ti-pipe3-fix-missing-bit-wise-or-operator-w.patch
+ patches.kernel.org/5.1.5-049-media-ov6650-Fix-sensor-possibly-not-detected-o.patch
+ patches.kernel.org/5.1.5-050-media-seco-cec-fix-building-with-RC_CORE-m.patch
+ patches.kernel.org/5.1.5-051-media-imx-csi-Allow-unknown-nearest-upstream-en.patch
+ patches.kernel.org/5.1.5-052-media-imx-Clear-fwnode-link-struct-for-each-end.patch
+ patches.kernel.org/5.1.5-053-media-imx-Rename-functions-that-add-IPU-interna.patch
+ patches.kernel.org/5.1.5-054-media-imx-Don-t-register-IPU-subdevs-links-if-C.patch
+ patches.kernel.org/5.1.5-055-RDMA-mlx5-Use-get_zeroed_page-for-clock_info.patch
+ patches.kernel.org/5.1.5-056-RDMA-ipoib-Allow-user-space-differentiate-betwe.patch
+ patches.kernel.org/5.1.5-057-NFS4-Fix-v4.0-client-state-corruption-when-moun.patch
+ patches.kernel.org/5.1.5-058-PNFS-fallback-to-MDS-if-no-deviceid-found.patch
+ patches.kernel.org/5.1.5-059-clk-hi3660-Mark-clk_gate_ufs_subsys-as-critical.patch
+ patches.kernel.org/5.1.5-060-clk-tegra-Fix-PLLM-programming-on-Tegra124-when.patch
+ patches.kernel.org/5.1.5-061-clk-mediatek-Disable-tuner_en-before-change-PLL.patch
+ patches.kernel.org/5.1.5-062-clk-rockchip-fix-wrong-clock-definitions-for-rk.patch
+ patches.kernel.org/5.1.5-063-udlfb-delete-the-unused-parameter-for-dlfb_hand.patch
+ patches.kernel.org/5.1.5-064-udlfb-fix-sleeping-inside-spinlock.patch
+ patches.kernel.org/5.1.5-065-udlfb-introduce-a-rendering-mutex.patch
+ patches.kernel.org/5.1.5-066-fuse-fix-writepages-on-32bit.patch
+ patches.kernel.org/5.1.5-067-fuse-honor-RLIMIT_FSIZE-in-fuse_file_fallocate.patch
+ patches.kernel.org/5.1.5-068-ovl-fix-missing-upper-fs-freeze-protection-on-c.patch
+ patches.kernel.org/5.1.5-069-fsnotify-fix-unlink-performance-regression.patch
+ patches.kernel.org/5.1.5-070-gcc-plugins-arm_ssp_per_task_plugin-Fix-for-old.patch
+ patches.kernel.org/5.1.5-071-iommu-tegra-smmu-Fix-invalid-ASID-bits-on-Tegra.patch
+ patches.kernel.org/5.1.5-072-ceph-flush-dirty-inodes-before-proceeding-with-.patch
+ patches.kernel.org/5.1.5-073-x86_64-Add-gap-to-int3-to-allow-for-call-emulat.patch
+ patches.kernel.org/5.1.5-074-x86_64-Allow-breakpoints-to-emulate-call-instru.patch
+ patches.kernel.org/5.1.5-075-ftrace-x86_64-Emulate-call-function-while-updat.patch
+ patches.kernel.org/5.1.5-076-tracing-Fix-partial-reading-of-trace-event-s-id.patch
+ patches.kernel.org/5.1.5-077-tracing-probeevent-Fix-to-make-the-type-of-comm.patch
+ patches.kernel.org/5.1.5-078-memory-tegra-Fix-integer-overflow-on-tick-value.patch
+ patches.kernel.org/5.1.5-079-perf-intel-pt-Fix-instructions-sampling-rate.patch
+ patches.kernel.org/5.1.5-080-perf-intel-pt-Fix-improved-sample-timestamp.patch
+ patches.kernel.org/5.1.5-081-perf-intel-pt-Fix-sample-timestamp-wrt-non-take.patch
+ patches.kernel.org/5.1.5-082-MIPS-perf-Fix-build-with-CONFIG_CPU_BMIPS5000-e.patch
+ patches.kernel.org/5.1.5-083-objtool-Allow-AR-to-be-overridden-with-HOSTAR.patch
+ patches.kernel.org/5.1.5-084-x86-mpx-mm-core-Fix-recursive-munmap-corruption.patch
+ patches.kernel.org/5.1.5-085-fbdev-efifb-Ignore-framebuffer-memmap-entries-t.patch
+ patches.kernel.org/5.1.5-086-fbdev-sm712fb-fix-brightness-control-on-reboot-.patch
+ patches.kernel.org/5.1.5-087-fbdev-sm712fb-fix-VRAM-detection-don-t-set-SR70.patch
+ patches.kernel.org/5.1.5-088-fbdev-sm712fb-fix-white-screen-of-death-on-rebo.patch
+ patches.kernel.org/5.1.5-089-fbdev-sm712fb-fix-boot-screen-glitch-when-sm712.patch
+ patches.kernel.org/5.1.5-090-fbdev-sm712fb-fix-crashes-during-framebuffer-wr.patch
+ patches.kernel.org/5.1.5-091-fbdev-sm712fb-fix-support-for-1024x768-16-mode.patch
+ patches.kernel.org/5.1.5-092-fbdev-sm712fb-use-1024x768-by-default-on-non-MI.patch
+ patches.kernel.org/5.1.5-093-fbdev-sm712fb-fix-crashes-and-garbled-display-d.patch
+ patches.kernel.org/5.1.5-094-PCI-Mark-AMD-Stoney-Radeon-R7-GPU-ATS-as-broken.patch
+ patches.kernel.org/5.1.5-095-PCI-Mark-Atheros-AR9462-to-avoid-bus-reset.patch
+ patches.kernel.org/5.1.5-096-PCI-Reset-Lenovo-ThinkPad-P50-nvgpu-at-boot-if-.patch
+ patches.kernel.org/5.1.5-097-PCI-Init-PCIe-feature-bits-for-managed-host-bri.patch
+ patches.kernel.org/5.1.5-098-PCI-AER-Change-pci_aer_init-stub-to-return-void.patch
+ patches.kernel.org/5.1.5-099-PCI-rcar-Add-the-initialization-of-PCIe-link-in.patch
+ patches.kernel.org/5.1.5-100-PCI-Factor-out-pcie_retrain_link-function.patch
+ patches.kernel.org/5.1.5-101-PCI-Work-around-Pericom-PCIe-to-PCI-bridge-Retr.patch
+ patches.kernel.org/5.1.5-102-dm-cache-metadata-Fix-loading-discard-bitset.patch
+ patches.kernel.org/5.1.5-103-dm-zoned-Fix-zone-report-handling.patch
+ patches.kernel.org/5.1.5-104-dm-init-fix-max-devices-targets-checks.patch
+ patches.kernel.org/5.1.5-105-dm-delay-fix-a-crash-when-invalid-device-is-spe.patch
+ patches.kernel.org/5.1.5-106-dm-crypt-move-detailed-message-into-debug-level.patch
+ patches.kernel.org/5.1.5-107-dm-integrity-correctly-calculate-the-size-of-me.patch
+ patches.kernel.org/5.1.5-108-dm-ioctl-fix-hang-in-early-create-error-conditi.patch
+ patches.kernel.org/5.1.5-109-dm-mpath-always-free-attached_handler_name-in-p.patch
+ patches.kernel.org/5.1.5-110-fuse-Add-FOPEN_STREAM-to-use-stream_open.patch
+ patches.kernel.org/5.1.5-111-dm-make-sure-to-obey-max_io_len_target_boundary.patch
+ patches.kernel.org/5.1.5-112-Revert-Don-t-jump-to-compute_result-state-from-.patch
+ patches.kernel.org/5.1.5-113-md-raid-raid5-preserve-the-writeback-action-aft.patch
+ patches.kernel.org/5.1.5-114-dmaengine-imx-sdma-Only-check-ratio-on-parts-th.patch
+ patches.kernel.org/5.1.5-115-driver-core-Postpone-DMA-tear-down-until-after-.patch
+ patches.kernel.org/5.1.5-116-bpf-relax-inode-permission-check-for-retrieving.patch
+ patches.kernel.org/5.1.5-117-bpf-add-map_lookup_elem_sys_only-for-lookups-fr.patch
+ patches.kernel.org/5.1.5-118-bpf-lru-avoid-messing-with-eviction-heuristics-.patch
+ patches.kernel.org/5.1.5-119-y2038-Make-CONFIG_64BIT_TIME-unconditional.patch
+ patches.kernel.org/5.1.5-120-btrfs-reloc-Fix-NULL-pointer-dereference-due-to.patch
+ patches.kernel.org/5.1.5-121-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch
+ patches.kernel.org/5.1.5-122-ARM-dts-imx6q-logicpd-Reduce-inrush-current-on-.patch
+ patches.kernel.org/5.1.5-123-fbdev-sm712fb-fix-memory-frequency-by-avoiding-.patch
+ patches.kernel.org/5.1.5-124-Linux-5.1.5.patch
########################################################
# Build fixes that apply to the vanilla kernel too.
@@ -583,12 +707,10 @@
patches.suse/dm-mpath-leastpending-path-update
patches.suse/dm-table-switch-to-readonly
patches.suse/dm-mpath-no-partitions-feature
- patches.suse/dm-make-sure-to-obey-max_io_len_target_boundary.patch
########################################################
# md
########################################################
- patches.suse/Revert-Don-t-jump-to-compute_result-state-from-check.patch
##########################################################
#