Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJohannes Thumshirn <jthumshirn@suse.de>2018-12-04 12:50:13 +0100
committerJohannes Thumshirn <jthumshirn@suse.de>2018-12-04 12:50:13 +0100
commit132ab569be570ee1d2e1111c1df486732648652f (patch)
tree224951f008121621aab4438da213eaee1075785d
parent45af63016e11a94bd940deb66408555612677c99 (diff)
parent9e1724a02b6b83832e0029b6fba72ac3590d937f (diff)
Merge remote-tracking branch 'origin/SLE15' into SLE12-SP4
Conflicts: series.conf
-rw-r--r--blacklist.conf3
-rw-r--r--patches.arch/kvm-vmx-re-add-ple_gap-module-parameter33
-rw-r--r--patches.arch/kvm-x86-fix-kernel-info-leak-in-kvm_hc_clock_pairing-hypercall41
-rw-r--r--patches.arch/x86-l1tf-06-add-sysfs-report.patch18
-rw-r--r--patches.arch/x86-mce-amd-fix-the-thresholding-machinery-initialization-order.patch103
-rw-r--r--patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch150
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-UAF-decrement-if-card-has-no-live.patch54
-rw-r--r--patches.drivers/edac-i7core-sb-skx-edac-fix-uncorrected-error-counting.patch65
-rw-r--r--patches.drivers/edac-skx_edac-fix-logical-channel-intermediate-decoding.patch40
-rw-r--r--patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch37
-rw-r--r--patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check85
-rw-r--r--patches.drm/drm-Add-DRM-client-cap-for-aspect-ratio104
-rw-r--r--patches.drm/drm-Add-and-handle-new-aspect-ratios-in-DRM-layer107
-rw-r--r--patches.drm/drm-Add-aspect-ratio-parsing-in-DRM-layer146
-rw-r--r--patches.drm/drm-Expose-modes-with-aspect-ratio-only-if-requested157
-rw-r--r--patches.drm/drm-Handle-aspect-ratio-info-in-legacy-modeset-path72
-rw-r--r--patches.drm/drm-dp_mst-Skip-validating-ports-during-destruction-.patch90
-rw-r--r--patches.fixes/dax-remove-VM_MIXEDMAP-for-fsdax-and-device-dax.patch24
-rw-r--r--patches.fixes/kvm-svm-ensure-an-ibpb-on-all-affected-cpus-when-freeing-a-vmcb.patch64
-rw-r--r--patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch32
-rw-r--r--patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch104
-rw-r--r--patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch95
-rw-r--r--patches.suse/0002-Btrfs-fix-assertion-on-fsync-of-regular-file-when-us.patch61
-rw-r--r--patches.suse/0003-Btrfs-send-fix-infinite-loop-due-to-directory-rename.patch200
-rw-r--r--patches.suse/0004-Btrfs-fix-cur_offset-in-the-error-case-for-nocow.patch79
-rw-r--r--scripts/git_sort/README.md11
-rw-r--r--scripts/lib/SUSE/MyBS.pm11
-rwxr-xr-xscripts/log212
-rw-r--r--series.conf23
29 files changed, 1273 insertions, 748 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 01dd85ef0c..f41775f961 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -926,3 +926,6 @@ ecaaf408478b6fb4d9986f9b6652f3824e374f4c # The function does not exist in SLE15
25bbe21bf427a81b8e3ccd480ea0e1d940256156 # Actually caused by 9f32d221301 which we don't have
f1782c9bc547754f4bd3043fe8cfda53db85f13f # User visible changes and lots of fixups needed
4530ec36bb1e0d24f41c33229694adacda3d5d89 # can: only renames, breaking kABI
+c54c7374ff44de5e609506aca7c0deae4703b6d1 # drm/dp_mst: reverted in the below
+9765635b30756eb74e05e260ac812659c296cd28 # drm/dp_mst: reverting
+8960de4a5ca7980ed1e19e7ca5a774d3b7a55c38 # client part, likely not needed for SLE
diff --git a/patches.arch/kvm-vmx-re-add-ple_gap-module-parameter b/patches.arch/kvm-vmx-re-add-ple_gap-module-parameter
new file mode 100644
index 0000000000..86fc2879f3
--- /dev/null
+++ b/patches.arch/kvm-vmx-re-add-ple_gap-module-parameter
@@ -0,0 +1,33 @@
+From: Luiz Capitulino <lcapitulino@redhat.com>
+Date: Fri, 23 Nov 2018 12:02:14 -0500
+Subject: KVM: VMX: re-add ple_gap module parameter
+Git-commit: a87c99e61236ba8ca962ce97a19fab5ebd588d35
+Patch-mainline: v4.20-rc5
+References: bsc#1106240
+
+Apparently, the ple_gap parameter was accidentally removed
+by commit c8e88717cfc6b36bedea22368d97667446318291. Add it
+back.
+
+Signed-off-by: Luiz Capitulino <lcapitulino@redhat.com>
+Cc: stable@vger.kernel.org
+Fixes: c8e88717cfc6b36bedea22368d97667446318291
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/vmx.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4555077d69ce..be6f13f1c25f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -174,6 +174,7 @@ module_param_named(preemption_timer, enable_preemption_timer, bool, S_IRUGO);
+ * refer SDM volume 3b section 21.6.13 & 22.1.3.
+ */
+ static unsigned int ple_gap = KVM_DEFAULT_PLE_GAP;
++module_param(ple_gap, uint, 0444);
+
+ static unsigned int ple_window = KVM_VMX_DEFAULT_PLE_WINDOW;
+ module_param(ple_window, uint, 0444);
+
diff --git a/patches.arch/kvm-x86-fix-kernel-info-leak-in-kvm_hc_clock_pairing-hypercall b/patches.arch/kvm-x86-fix-kernel-info-leak-in-kvm_hc_clock_pairing-hypercall
new file mode 100644
index 0000000000..6ee56136a3
--- /dev/null
+++ b/patches.arch/kvm-x86-fix-kernel-info-leak-in-kvm_hc_clock_pairing-hypercall
@@ -0,0 +1,41 @@
+From: Liran Alon <liran.alon@oracle.com>
+Date: Thu, 8 Nov 2018 00:43:06 +0200
+Subject: KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
+Git-commit: bcbfbd8ec21096027f1ee13ce6c185e8175166f6
+Patch-mainline: v4.20-rc5
+References: bsc#1106240
+
+kvm_pv_clock_pairing() allocates local var
+"struct kvm_clock_pairing clock_pairing" on stack and initializes
+all it's fields besides padding (clock_pairing.pad[]).
+
+Because clock_pairing var is written completely (including padding)
+to guest memory, failure to init struct padding results in kernel
+info-leak.
+
+Fix the issue by making sure to also init the padding with zeroes.
+
+Fixes: 55dd00a73a51 ("KVM: x86: add KVM_HC_CLOCK_PAIRING hypercall")
+Reported-by: syzbot+a8ef68d71211ba264f56@syzkaller.appspotmail.com
+Reviewed-by: Mark Kanda <mark.kanda@oracle.com>
+Signed-off-by: Liran Alon <liran.alon@oracle.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 64cae03b2c20..7e4be1f2f253 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6918,6 +6918,7 @@ static int kvm_pv_clock_pairing(struct kvm_vcpu *vcpu, gpa_t paddr,
+ clock_pairing.nsec = ts.tv_nsec;
+ clock_pairing.tsc = kvm_read_l1_tsc(vcpu, cycle);
+ clock_pairing.flags = 0;
++ memset(&clock_pairing.pad, 0, sizeof(clock_pairing.pad));
+
+ ret = 0;
+ if (kvm_write_guest(vcpu->kvm, paddr, &clock_pairing,
+
diff --git a/patches.arch/x86-l1tf-06-add-sysfs-report.patch b/patches.arch/x86-l1tf-06-add-sysfs-report.patch
index 12ea5b9871..14d9466d54 100644
--- a/patches.arch/x86-l1tf-06-add-sysfs-report.patch
+++ b/patches.arch/x86-l1tf-06-add-sysfs-report.patch
@@ -50,14 +50,14 @@ White space changes. Move l1tf_pfn_limit here.
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -221,6 +221,7 @@
- #define X86_FEATURE_IBPB ( 7*32+27) /* Indirect Branch Prediction Barrier */
#define X86_FEATURE_STIBP ( 7*32+28) /* Single Thread Indirect Branch Predictors */
#define X86_FEATURE_ZEN ( 7*32+29) /* "" CPU is AMD family 0x17 (Zen) */
-+#define X86_FEATURE_L1TF_FIX ( 7*32+30) /* "" L1TF workaround used */
+ #define X86_FEATURE_IBRS_ENHANCED ( 7*32+30) /* Enhanced IBRS */
++#define X86_FEATURE_L1TF_FIX ( 7*32+31) /* "" L1TF workaround used */
/* Virtualization flags: Linux defined, word 8 */
#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */
-@@ -369,4 +370,5 @@
+@@ -372,4 +373,5 @@
#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */
#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */
#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */
@@ -65,7 +65,7 @@ White space changes. Move l1tf_pfn_limit here.
#endif /* _ASM_X86_CPUFEATURES_H */
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
-@@ -182,6 +182,11 @@ extern const struct seq_operations cpuin
+@@ -180,6 +180,11 @@ extern const struct seq_operations cpuin
extern void cpu_detect(struct cpuinfo_x86 *c);
@@ -100,7 +100,7 @@ White space changes. Move l1tf_pfn_limit here.
#ifdef CONFIG_X86_32
/*
* Check whether we are able to run this kernel safely on SMP.
-@@ -207,6 +211,32 @@ static void x86_amd_ssb_disable(void)
+@@ -206,6 +210,32 @@ static void x86_amd_ssb_disable(void)
wrmsrl(MSR_AMD64_LS_CFG, msrval);
}
@@ -133,7 +133,7 @@ White space changes. Move l1tf_pfn_limit here.
#ifdef RETPOLINE
static bool spectre_v2_bad_module;
-@@ -704,6 +734,11 @@ static ssize_t cpu_show_common(struct de
+@@ -694,6 +724,11 @@ static ssize_t cpu_show_common(struct de
case X86_BUG_SPEC_STORE_BYPASS:
return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
@@ -145,7 +145,7 @@ White space changes. Move l1tf_pfn_limit here.
default:
break;
}
-@@ -730,4 +765,9 @@ ssize_t cpu_show_spec_store_bypass(struc
+@@ -720,4 +755,9 @@ ssize_t cpu_show_spec_store_bypass(struc
{
return cpu_show_common(dev, attr, buf, X86_BUG_SPEC_STORE_BYPASS);
}
@@ -157,7 +157,7 @@ White space changes. Move l1tf_pfn_limit here.
#endif
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
-@@ -933,6 +933,21 @@ static const __initconst struct x86_cpu_
+@@ -940,6 +940,21 @@ static const __initconst struct x86_cpu_
{}
};
@@ -179,7 +179,7 @@ White space changes. Move l1tf_pfn_limit here.
static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c)
{
u64 ia32_cap = 0;
-@@ -958,6 +973,11 @@ static void __init cpu_set_bug_bits(stru
+@@ -968,6 +983,11 @@ static void __init cpu_set_bug_bits(stru
return;
setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN);
diff --git a/patches.arch/x86-mce-amd-fix-the-thresholding-machinery-initialization-order.patch b/patches.arch/x86-mce-amd-fix-the-thresholding-machinery-initialization-order.patch
new file mode 100644
index 0000000000..f4dfc489c0
--- /dev/null
+++ b/patches.arch/x86-mce-amd-fix-the-thresholding-machinery-initialization-order.patch
@@ -0,0 +1,103 @@
+From: Borislav Petkov <bp@suse.de>
+Date: Tue, 27 Nov 2018 14:41:37 +0100
+Subject: x86/MCE/AMD: Fix the thresholding machinery initialization order
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 60c8144afc287ef09ce8c1230c6aa972659ba1bb
+Patch-mainline: v4.20-rc5
+References: bsc#1114279
+
+Currently, the code sets up the thresholding interrupt vector and only
+then goes about initializing the thresholding banks. Which is wrong,
+because an early thresholding interrupt would cause a NULL pointer
+dereference when accessing those banks and prevent the machine from
+booting.
+
+Therefore, set the thresholding interrupt vector only *after* having
+initialized the banks successfully.
+
+Fixes: 18807ddb7f88 ("x86/mce/AMD: Reset Threshold Limit after logging error")
+Reported-by: Rafał Miłecki <rafal@milecki.pl>
+Reported-by: John Clemens <clemej@gmail.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: Rafał Miłecki <rafal@milecki.pl>
+Tested-by: John Clemens <john@deater.net>
+Cc: Aravind Gopalakrishnan <aravindksg.lkml@gmail.com>
+Cc: linux-edac@vger.kernel.org
+Cc: stable@vger.kernel.org
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: x86@kernel.org
+Cc: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Link: https://lkml.kernel.org/r/20181127101700.2964-1-zajec5@gmail.com
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=201291
+---
+ arch/x86/kernel/cpu/mcheck/mce_amd.c | 19 ++++++-------------
+ 1 file changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index dd33c357548f..e12454e21b8a 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -56,7 +56,7 @@
+ /* Threshold LVT offset is at MSR0xC0000410[15:12] */
+ #define SMCA_THR_LVT_OFF 0xF000
+
+-static bool thresholding_en;
++static bool thresholding_irq_en;
+
+ static const char * const th_names[] = {
+ "load_store",
+@@ -534,9 +534,8 @@ prepare_threshold_block(unsigned int bank, unsigned int block, u32 addr,
+
+ set_offset:
+ offset = setup_APIC_mce_threshold(offset, new);
+-
+- if ((offset == new) && (mce_threshold_vector != amd_threshold_interrupt))
+- mce_threshold_vector = amd_threshold_interrupt;
++ if (offset == new)
++ thresholding_irq_en = true;
+
+ done:
+ mce_threshold_block_init(&b, offset);
+@@ -1357,9 +1356,6 @@ int mce_threshold_remove_device(unsigned int cpu)
+ {
+ unsigned int bank;
+
+- if (!thresholding_en)
+- return 0;
+-
+ for (bank = 0; bank < mca_cfg.banks; ++bank) {
+ if (!(per_cpu(bank_map, cpu) & (1 << bank)))
+ continue;
+@@ -1377,9 +1373,6 @@ int mce_threshold_create_device(unsigned int cpu)
+ struct threshold_bank **bp;
+ int err = 0;
+
+- if (!thresholding_en)
+- return 0;
+-
+ bp = per_cpu(threshold_banks, cpu);
+ if (bp)
+ return 0;
+@@ -1408,9 +1401,6 @@ static __init int threshold_init_device(void)
+ {
+ unsigned lcpu = 0;
+
+- if (mce_threshold_vector == amd_threshold_interrupt)
+- thresholding_en = true;
+-
+ /* to hit CPUs online before the notifier is up */
+ for_each_online_cpu(lcpu) {
+ int err = mce_threshold_create_device(lcpu);
+@@ -1419,6 +1409,9 @@ static __init int threshold_init_device(void)
+ return err;
+ }
+
++ if (thresholding_irq_en)
++ mce_threshold_vector = amd_threshold_interrupt;
++
+ return 0;
+ }
+ /*
+
diff --git a/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch b/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
new file mode 100644
index 0000000000..e0333fec19
--- /dev/null
+++ b/patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
@@ -0,0 +1,150 @@
+From: Sai Praneeth <sai.praneeth.prakhya@intel.com>
+Date: Wed, 1 Aug 2018 11:42:25 -0700
+Subject: x86/speculation: Support Enhanced IBRS on future CPUs
+Git-commit: 706d51681d636a0c4a5ef53395ec3b803e45ed4d
+Patch-mainline: v4.19-rc1
+References: fate#326564
+
+Future Intel processors will support "Enhanced IBRS" which is an "always
+on" mode i.e. IBRS bit in SPEC_CTRL MSR is enabled once and never
+disabled.
+
+>From the specification [1]:
+
+ "With enhanced IBRS, the predicted targets of indirect branches
+ executed cannot be controlled by software that was executed in a less
+ privileged predictor mode or on another logical processor. As a
+ result, software operating on a processor with enhanced IBRS need not
+ use WRMSR to set IA32_SPEC_CTRL.IBRS after every transition to a more
+ privileged predictor mode. Software can isolate predictor modes
+ effectively simply by setting the bit once. Software need not disable
+ enhanced IBRS prior to entering a sleep state such as MWAIT or HLT."
+
+If Enhanced IBRS is supported by the processor then use it as the
+preferred spectre v2 mitigation mechanism instead of Retpoline. Intel's
+Retpoline white paper [2] states:
+
+ "Retpoline is known to be an effective branch target injection (Spectre
+ variant 2) mitigation on Intel processors belonging to family 6
+ (enumerated by the CPUID instruction) that do not have support for
+ enhanced IBRS. On processors that support enhanced IBRS, it should be
+ used for mitigation instead of retpoline."
+
+The reason why Enhanced IBRS is the recommended mitigation on processors
+which support it is that these processors also support CET which
+provides a defense against ROP attacks. Retpoline is very similar to ROP
+techniques and might trigger false positives in the CET defense.
+
+If Enhanced IBRS is selected as the mitigation technique for spectre v2,
+the IBRS bit in SPEC_CTRL MSR is set once at boot time and never
+cleared. Kernel also has to make sure that IBRS bit remains set after
+VMEXIT because the guest might have cleared the bit. This is already
+covered by the existing x86_spec_ctrl_set_guest() and
+x86_spec_ctrl_restore_host() speculation control functions.
+
+Enhanced IBRS still requires IBPB for full mitigation.
+
+[1] Speculative-Execution-Side-Channel-Mitigations.pdf
+[2] Retpoline-A-Branch-Target-Injection-Mitigation.pdf
+Both documents are available at:
+https://bugzilla.kernel.org/show_bug.cgi?id=199511
+
+Originally-by: David Woodhouse <dwmw@amazon.co.uk>
+Signed-off-by: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tim C Chen <tim.c.chen@intel.com>
+Cc: Dave Hansen <dave.hansen@intel.com>
+Cc: Ravi Shankar <ravi.v.shankar@intel.com>
+Link: https://lkml.kernel.org/r/1533148945-24095-1-git-send-email-sai.praneeth.prakhya@intel.com
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/cpufeatures.h | 1 +
+ arch/x86/include/asm/nospec-branch.h | 1 +
+ arch/x86/kernel/cpu/bugs.c | 20 ++++++++++++++++++--
+ arch/x86/kernel/cpu/common.c | 3 +++
+ 4 files changed, 23 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -220,6 +220,7 @@
+ #define X86_FEATURE_IBPB ( 7*32+27) /* Indirect Branch Prediction Barrier */
+ #define X86_FEATURE_STIBP ( 7*32+28) /* Single Thread Indirect Branch Predictors */
+ #define X86_FEATURE_ZEN ( 7*32+29) /* "" CPU is AMD family 0x17 (Zen) */
++#define X86_FEATURE_IBRS_ENHANCED ( 7*32+30) /* Enhanced IBRS */
+
+ /* Virtualization flags: Linux defined, word 8 */
+ #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -215,6 +215,7 @@ enum spectre_v2_mitigation {
+ SPECTRE_V2_RETPOLINE_GENERIC,
+ SPECTRE_V2_RETPOLINE_AMD,
+ SPECTRE_V2_IBRS,
++ SPECTRE_V2_IBRS_ENHANCED,
+ };
+
+ /* The Speculative Store Bypass disable variants */
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -129,6 +129,7 @@ static const char *spectre_v2_strings[]
+ [SPECTRE_V2_RETPOLINE_MINIMAL_AMD] = "Vulnerable: Minimal AMD ASM retpoline",
+ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
+ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
++ [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
+ };
+
+ #undef pr_fmt
+@@ -347,6 +348,13 @@ static void __init spectre_v2_select_mit
+
+ case SPECTRE_V2_CMD_FORCE:
+ case SPECTRE_V2_CMD_AUTO:
++ if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
++ mode = SPECTRE_V2_IBRS_ENHANCED;
++ /* Force it so VMEXIT will restore correctly */
++ x86_spec_ctrl_base |= SPEC_CTRL_IBRS;
++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
++ goto specv2_set_mode;
++ }
+ if (IS_ENABLED(CONFIG_RETPOLINE))
+ goto retpoline_auto;
+ break;
+@@ -384,6 +392,7 @@ retpoline_auto:
+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
+ }
+
++specv2_set_mode:
+ spectre_v2_enabled = mode;
+ pr_info("%s\n", spectre_v2_strings[mode]);
+
+@@ -406,9 +415,16 @@ retpoline_auto:
+
+ /*
+ * Retpoline means the kernel is safe because it has no indirect
+- * branches. But firmware isn't, so use IBRS to protect that.
++ * branches. Enhanced IBRS protects firmware too, so, enable restricted
++ * speculation around firmware calls only when Enhanced IBRS isn't
++ * supported.
++ *
++ * Use "mode" to check Enhanced IBRS instead of boot_cpu_has(), because
++ * the user might select retpoline on the kernel command line and if
++ * the CPU supports Enhanced IBRS, kernel might un-intentionally not
++ * enable IBRS around firmware calls.
+ */
+- if (boot_cpu_has(X86_FEATURE_IBRS)) {
++ if (boot_cpu_has(X86_FEATURE_IBRS) && mode != SPECTRE_V2_IBRS_ENHANCED) {
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW);
+ pr_info("Enabling Restricted Speculation for firmware calls\n");
+ }
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -957,6 +957,9 @@ static void __init cpu_set_bug_bits(stru
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V1);
+ setup_force_cpu_bug(X86_BUG_SPECTRE_V2);
+
++ if (ia32_cap & ARCH_CAP_IBRS_ALL)
++ setup_force_cpu_cap(X86_FEATURE_IBRS_ENHANCED);
++
+ if (x86_match_cpu(cpu_no_meltdown))
+ return;
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-UAF-decrement-if-card-has-no-live.patch b/patches.drivers/ALSA-usb-audio-Fix-UAF-decrement-if-card-has-no-live.patch
new file mode 100644
index 0000000000..9c088bbf2b
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-UAF-decrement-if-card-has-no-live.patch
@@ -0,0 +1,54 @@
+From 5f8cf712582617d523120df67d392059eaf2fc4b Mon Sep 17 00:00:00 2001
+From: Hui Peng <benquike@gmail.com>
+Date: Mon, 3 Dec 2018 16:09:34 +0100
+Subject: [PATCH] ALSA: usb-audio: Fix UAF decrement if card has no live
+ interfaces in card.c
+References: CVE-2018-19824,bsc#1118152
+Git-commit: 5f8cf712582617d523120df67d392059eaf2fc4b
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
+Patch-mainline: Queued in subsystem maintainer repository
+
+If a USB sound card reports 0 interfaces, an error condition is triggered
+and the function usb_audio_probe errors out. In the error path, there was a
+use-after-free vulnerability where the memory object of the card was first
+freed, followed by a decrement of the number of active chips. Moving the
+decrement above the atomic_dec fixes the UAF.
+
+[ The original problem was introduced in 3.1 kernel, while it was
+ developed in a different form. The Fixes tag below indicates the
+ original commit but it doesn't mean that the patch is applicable
+ cleanly. -- tiwai ]
+
+Fixes: 362e4e49abe5 ("ALSA: usb-audio - clear chip->probing on error exit")
+Reported-by: Hui Peng <benquike@gmail.com>
+Reported-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Signed-off-by: Hui Peng <benquike@gmail.com>
+Signed-off-by: Mathias Payer <mathias.payer@nebelwelt.net>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/card.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 2bfe4e80a6b9..a105947eaf55 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -682,9 +682,12 @@ static int usb_audio_probe(struct usb_interface *intf,
+
+ __error:
+ if (chip) {
++ /* chip->active is inside the chip->card object,
++ * decrement before memory is possibly returned.
++ */
++ atomic_dec(&chip->active);
+ if (!chip->num_interfaces)
+ snd_card_free(chip->card);
+- atomic_dec(&chip->active);
+ }
+ mutex_unlock(&register_mutex);
+ return err;
+--
+2.19.2
+
diff --git a/patches.drivers/edac-i7core-sb-skx-edac-fix-uncorrected-error-counting.patch b/patches.drivers/edac-i7core-sb-skx-edac-fix-uncorrected-error-counting.patch
new file mode 100644
index 0000000000..628f96cf66
--- /dev/null
+++ b/patches.drivers/edac-i7core-sb-skx-edac-fix-uncorrected-error-counting.patch
@@ -0,0 +1,65 @@
+From: Tony Luck <tony.luck@intel.com>
+Date: Fri, 28 Sep 2018 14:39:34 -0700
+Subject: EDAC, {i7core,sb,skx}_edac: Fix uncorrected error counting
+Git-commit: 432de7fd7630c84ad24f1c2acd1e3bb4ce3741ca
+Patch-mainline: v4.20-rc1
+References: bsc#1114279
+
+The count of errors is picked up from bits 52:38 of the machine check
+bank status register. But this is the count of *corrected* errors. If an
+uncorrected error is being logged, the h/w sets this field to 0. Which
+means that when edac_mc_handle_error() is called, the EDAC core will
+carefully add zero to the appropriate uncorrected error counts.
+
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+[ Massage commit message. ]
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: stable@vger.kernel.org
+Cc: Aristeu Rozanski <aris@redhat.com>
+Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
+Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Cc: linux-edac <linux-edac@vger.kernel.org>
+Link: http://lkml.kernel.org/r/20180928213934.19890-1-tony.luck@intel.com
+---
+ drivers/edac/i7core_edac.c | 1 +
+ drivers/edac/sb_edac.c | 1 +
+ drivers/edac/skx_edac.c | 1 +
+ 3 files changed, 3 insertions(+)
+
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 943aab62dea1..9ef448fef12f 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1711,6 +1711,7 @@ static void i7core_mce_output_error(struct mem_ctl_info *mci,
+ u32 errnum = find_first_bit(&error, 32);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv)
+ tp_event = HW_EVENT_ERR_FATAL;
+ else
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index cacd0ca12af6..9353c3fc7c05 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -2982,6 +2982,7 @@ static void sbridge_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index b2987efa2c6d..e840412abe4e 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -959,6 +959,7 @@ static void skx_mce_output_error(struct mem_ctl_info *mci,
+ recoverable = GET_BITFIELD(m->status, 56, 56);
+
+ if (uncorrected_error) {
++ core_err_cnt = 1;
+ if (ripv) {
+ type = "FATAL";
+ tp_event = HW_EVENT_ERR_FATAL;
+
diff --git a/patches.drivers/edac-skx_edac-fix-logical-channel-intermediate-decoding.patch b/patches.drivers/edac-skx_edac-fix-logical-channel-intermediate-decoding.patch
new file mode 100644
index 0000000000..2698b8547b
--- /dev/null
+++ b/patches.drivers/edac-skx_edac-fix-logical-channel-intermediate-decoding.patch
@@ -0,0 +1,40 @@
+From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Date: Tue, 9 Oct 2018 10:20:25 -0700
+Subject: EDAC, skx_edac: Fix logical channel intermediate decoding
+Git-commit: 8f18973877204dc8ca4ce1004a5d28683b9a7086
+Patch-mainline: v4.20-rc1
+References: bsc#1114279
+
+The code "lchan = (lchan << 1) | ~lchan" for logical channel
+intermediate decoding is wrong. The wrong intermediate decoding
+result is {0xffffffff, 0xfffffffe}.
+
+Fix it by replacing '~' with '!'. The correct intermediate
+decoding result is {0x1, 0x2}.
+
+Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+CC: Aristeu Rozanski <aris@redhat.com>
+CC: Mauro Carvalho Chehab <mchehab@kernel.org>
+CC: linux-edac <linux-edac@vger.kernel.org>
+Cc: stable@vger.kernel.org
+Link: http://lkml.kernel.org/r/20181009172025.18594-1-tony.luck@intel.com
+---
+ drivers/edac/skx_edac.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/edac/skx_edac.c b/drivers/edac/skx_edac.c
+index e840412abe4e..dd209e0dd9ab 100644
+--- a/drivers/edac/skx_edac.c
++++ b/drivers/edac/skx_edac.c
+@@ -668,7 +668,7 @@ static bool skx_sad_decode(struct decoded_addr *res)
+ break;
+ case 2:
+ lchan = (addr >> shift) % 2;
+- lchan = (lchan << 1) | ~lchan;
++ lchan = (lchan << 1) | !lchan;
+ break;
+ case 3:
+ lchan = ((addr >> shift) % 2) << 1;
+
diff --git a/patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch b/patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
new file mode 100644
index 0000000000..971f28ec48
--- /dev/null
+++ b/patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
@@ -0,0 +1,37 @@
+From patchwork Fri Nov 30 16:59:08 2018
+Subject: [net] net/ibmvnic: Fix RTNL deadlock during device reset
+X-Patchwork-Id: 1006087
+Date: Fri, 30 Nov 2018 10:59:08 -0600
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+
+References: bnc#1115431
+Patch-mainline: submitted, http://patchwork.ozlabs.org/patch/1006087/
+
+Commit a5681e20b541 ("net/ibmnvic: Fix deadlock problem
+in reset") made the change to hold the RTNL lock during
+driver reset but still calls netdev_notify_peers, which
+results in a deadlock. Instead, use call_netdevice_notifiers,
+which is functionally the same except that it does not
+take the RTNL lock again.
+
+Fixes: a5681e20b541 ("net/ibmnvic: Fix deadlock problem in reset")
+
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/net/ethernet/ibm/ibmvnic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index c0203a0..ed50b8d 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1859,7 +1859,7 @@ static int do_reset(struct ibmvnic_adapter *adapter,
+
+ if (adapter->reset_reason != VNIC_RESET_FAILOVER &&
+ adapter->reset_reason != VNIC_RESET_CHANGE_PARAM)
+- netdev_notify_peers(netdev);
++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, netdev);
+
+ netif_carrier_on(netdev);
+
diff --git a/patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check b/patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check
new file mode 100644
index 0000000000..f983ab065a
--- /dev/null
+++ b/patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check
@@ -0,0 +1,85 @@
+From: Trent Piepho <tpiepho@impinj.com>
+Date: Mon, 5 Nov 2018 18:11:36 +0000
+Subject: PCI: imx6: Fix link training status detection in link up check
+Git-commit: 68bc10bf992180f269816ff3d22eb30383138577
+Patch-mainline: v4.20-rc5
+References: bsc#1109806
+
+This bug was introduced in the interaction for two commits on either
+branch of the merge commit 562df5c8521e ("Merge branch
+'pci/host-designware' into next").
+
+Commit 4d107d3b5a68 ("PCI: imx6: Move link up check into
+imx6_pcie_wait_for_link()"), changed imx6_pcie_wait_for_link() to poll
+the link status register directly, checking for link up and not
+training, and made imx6_pcie_link_up() only check the link up bit (once,
+not a polling loop).
+
+While commit 886bc5ceb5cc ("PCI: designware: Add generic
+dw_pcie_wait_for_link()"), replaced the loop in
+imx6_pcie_wait_for_link() with a call to a new dwc core function, which
+polled imx6_pcie_link_up(), which still checked both link up and not
+training in a loop.
+
+When these two commits were merged, the version of
+imx6_pcie_wait_for_link() from 886bc5ceb5cc was kept, which eliminated
+the link training check placed there by 4d107d3b5a68. However, the
+version of imx6_pcie_link_up() from 4d107d3b5a68 was kept, which
+eliminated the link training check that had been there and was moved to
+imx6_pcie_wait_for_link().
+
+The result was the link training check got lost for the imx6 driver.
+
+Eliminate imx6_pcie_link_up() so that the default handler,
+dw_pcie_link_up(), is used instead. The default handler has the correct
+code, which checks for link up and also that it still is not training,
+fixing the regression.
+
+Fixes: 562df5c8521e ("Merge branch 'pci/host-designware' into next")
+Signed-off-by: Trent Piepho <tpiepho@impinj.com>
+[lorenzo.pieralisi@arm.com: rewrote the commit log]
+Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Joao Pinto <Joao.Pinto@synopsys.com>
+Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
+Cc: Richard Zhu <hongxing.zhu@nxp.com>
+
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+--- a/drivers/pci/dwc/pci-imx6.c
++++ b/drivers/pci/dwc/pci-imx6.c
+@@ -81,8 +81,6 @@ struct imx6_pcie {
+ #define PCIE_PL_PFLR_FORCE_LINK (1 << 15)
+ #define PCIE_PHY_DEBUG_R0 (PL_OFFSET + 0x28)
+ #define PCIE_PHY_DEBUG_R1 (PL_OFFSET + 0x2c)
+-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_IN_TRAINING (1 << 29)
+-#define PCIE_PHY_DEBUG_R1_XMLH_LINK_UP (1 << 4)
+
+ #define PCIE_PHY_CTRL (PL_OFFSET + 0x114)
+ #define PCIE_PHY_CTRL_DATA_LOC 0
+@@ -623,12 +621,6 @@ static void imx6_pcie_host_init(struct p
+ dw_pcie_msi_init(pp);
+ }
+
+-static int imx6_pcie_link_up(struct dw_pcie *pci)
+-{
+- return dw_pcie_readl_dbi(pci, PCIE_PHY_DEBUG_R1) &
+- PCIE_PHY_DEBUG_R1_XMLH_LINK_UP;
+-}
+-
+ static struct dw_pcie_host_ops imx6_pcie_host_ops = {
+ .host_init = imx6_pcie_host_init,
+ };
+@@ -671,7 +663,7 @@ static int imx6_add_pcie_port(struct imx
+ }
+
+ static const struct dw_pcie_ops dw_pcie_ops = {
+- .link_up = imx6_pcie_link_up,
++ /* No special ops needed, but pcie-designware still expects this struct */
+ };
+
+ static int imx6_pcie_probe(struct platform_device *pdev)
diff --git a/patches.drm/drm-Add-DRM-client-cap-for-aspect-ratio b/patches.drm/drm-Add-DRM-client-cap-for-aspect-ratio
deleted file mode 100644
index 35d0ead57d..0000000000
--- a/patches.drm/drm-Add-DRM-client-cap-for-aspect-ratio
+++ /dev/null
@@ -1,104 +0,0 @@
-From 7595bda2fb4378ccbb8db1d0e8de56d15ea7f7fa Mon Sep 17 00:00:00 2001
-From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-Date: Tue, 8 May 2018 16:39:41 +0530
-Subject: [PATCH] drm: Add DRM client cap for aspect-ratio
-Git-commit: 7595bda2fb4378ccbb8db1d0e8de56d15ea7f7fa
-Patch-mainline: v4.18-rc1
-References: FATE#325208
-
-To enable aspect-ratio support in DRM, blindly exposing the aspect
-ratio information along with mode, can break things in existing
-non-atomic user-spaces which have no intention or support to use this
-aspect ratio information.
-
-To avoid this, a new drm client cap is required to enable a non-atomic
-user-space to advertise if it supports modes with aspect-ratio. Based
-on this cap value, the kernel will take a call on exposing the aspect
-ratio info in modes or not.
-
-This patch adds the client cap for aspect-ratio.
-
-Since no atomic-userspaces blow up on receiving aspect-ratio
-information, the client cap for aspect-ratio is always enabled
-for atomic clients.
-
-Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
-Cc: Shashank Sharma <shashank.sharma@intel.com>
-Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-
-V3: rebase
-V4: As suggested by Marteen Lankhorst modified the commit message explaining the need to use the DRM cap for aspect-ratio. Also, tweaked the comment lines in the code for better understanding and clarity, as recommended by Shashank Sharma.
-V5: rebase
-V6: rebase
-V7: rebase
-V8: rebase
-V9: rebase
-V10: rebase
-V11: rebase
-V12: As suggested by Daniel Vetter and Ville Syrjala, always enable aspect-ratio client cap for atomic userspaces, if no atomic userspace breaks on aspect-ratio bits.
-V13: rebase
-V14: rebase
-
-Reviewed-by: Shashank Sharma <shashank.sharma@intel.com>
-Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
-Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/1525777785-9740-7-git-send-email-ankit.k.nautiyal@intel.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/drm_ioctl.c | 9 +++++++++
- include/drm/drm_file.h | 8 ++++++++
- include/uapi/drm/drm.h | 7 +++++++
- 3 files changed, 24 insertions(+)
-
---- a/drivers/gpu/drm/drm_ioctl.c
-+++ b/drivers/gpu/drm/drm_ioctl.c
-@@ -331,6 +331,15 @@ drm_setclientcap(struct drm_device *dev,
- return -EINVAL;
- file_priv->atomic = req->value;
- file_priv->universal_planes = req->value;
-+ /*
-+ * No atomic user-space blows up on aspect ratio mode bits.
-+ */
-+ file_priv->aspect_ratio_allowed = req->value;
-+ break;
-+ case DRM_CLIENT_CAP_ASPECT_RATIO:
-+ if (req->value > 1)
-+ return -EINVAL;
-+ file_priv->aspect_ratio_allowed = req->value;
- break;
- default:
- return -EINVAL;
---- a/include/drm/drm_file.h
-+++ b/include/drm/drm_file.h
-@@ -182,6 +182,14 @@ struct drm_file {
- unsigned atomic:1;
-
- /**
-+ * @aspect_ratio_allowed:
-+ *
-+ * True, if client can handle picture aspect ratios, and has requested
-+ * to pass this information along with the mode.
-+ */
-+ unsigned aspect_ratio_allowed:1;
-+
-+ /**
- * @is_master:
- *
- * This client is the creator of @master. Protected by struct
---- a/include/uapi/drm/drm.h
-+++ b/include/uapi/drm/drm.h
-@@ -680,6 +680,13 @@ struct drm_get_cap {
- */
- #define DRM_CLIENT_CAP_ATOMIC 3
-
-+/**
-+ * DRM_CLIENT_CAP_ASPECT_RATIO
-+ *
-+ * If set to 1, the DRM core will provide aspect ratio information in modes.
-+ */
-+#define DRM_CLIENT_CAP_ASPECT_RATIO 4
-+
- /** DRM_IOCTL_SET_CLIENT_CAP ioctl argument type */
- struct drm_set_client_cap {
- __u64 capability;
diff --git a/patches.drm/drm-Add-and-handle-new-aspect-ratios-in-DRM-layer b/patches.drm/drm-Add-and-handle-new-aspect-ratios-in-DRM-layer
deleted file mode 100644
index a14cfaa671..0000000000
--- a/patches.drm/drm-Add-and-handle-new-aspect-ratios-in-DRM-layer
+++ /dev/null
@@ -1,107 +0,0 @@
-From 900aa8ad21587e909603f471b6cd81fd5338ec45 Mon Sep 17 00:00:00 2001
-From: Shashank Sharma <shashank.sharma@intel.com>
-Date: Tue, 8 May 2018 16:39:45 +0530
-Subject: [PATCH] drm: Add and handle new aspect ratios in DRM layer
-Git-commit: 900aa8ad21587e909603f471b6cd81fd5338ec45
-Patch-mainline: v4.18-rc1
-References: FATE#325208
-
-HDMI 2.0/CEA-861-F introduces two new aspect ratios:
-- 64:27
-- 256:135
-
-This patch:
-- Adds new DRM flags for to represent these new aspect ratios.
-- Adds new cases to handle these aspect ratios while converting
-from user->kernel mode or vise versa.
-
-This patch was once reviewed and merged, and later reverted due
-to lack of DRM client protection, while adding aspect ratio bits
-in user modes. This is a re-spin of the series, with DRM client
-cap protection.
-
-The previous series can be found here:
-https://pw-emeril.freedesktop.org/series/10850/
-
-Signed-off-by: Shashank Sharma <shashank.sharma@intel.com>
-Reviewed-by: Sean Paul <seanpaul@chromium.org> (V2)
-Reviewed-by: Jose Abreu <Jose.Abreu@synopsys.com> (V2)
-
-Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
-Cc: Sean Paul <seanpaul@chromium.org>
-Cc: Jose Abreu <Jose.Abreu@synopsys.com>
-Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-
-V3: rebase
-V4: rebase
-V5: corrected the macro name for an aspect ratio, in a switch case.
-V6: rebase
-V7: rebase
-V8: rebase
-V9: rebase
-V10: rebase
-V11: rebase
-V12: rebase
-V13: rebase
-V14: rebase
-
-Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
-Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/1525777785-9740-11-git-send-email-ankit.k.nautiyal@intel.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/drm_modes.c | 12 ++++++++++++
- include/uapi/drm/drm_mode.h | 6 ++++++
- 2 files changed, 18 insertions(+)
-
---- a/drivers/gpu/drm/drm_modes.c
-+++ b/drivers/gpu/drm/drm_modes.c
-@@ -1630,6 +1630,12 @@ void drm_mode_convert_to_umode(struct dr
- case HDMI_PICTURE_ASPECT_16_9:
- out->flags |= DRM_MODE_FLAG_PIC_AR_16_9;
- break;
-+ case HDMI_PICTURE_ASPECT_64_27:
-+ out->flags |= DRM_MODE_FLAG_PIC_AR_64_27;
-+ break;
-+ case HDMI_PICTURE_ASPECT_256_135:
-+ out->flags |= DRM_MODE_FLAG_PIC_AR_256_135;
-+ break;
- case HDMI_PICTURE_ASPECT_RESERVED:
- default:
- out->flags |= DRM_MODE_FLAG_PIC_AR_NONE;
-@@ -1694,6 +1700,12 @@ int drm_mode_convert_umode(struct drm_di
- case DRM_MODE_FLAG_PIC_AR_16_9:
- out->picture_aspect_ratio |= HDMI_PICTURE_ASPECT_16_9;
- break;
-+ case DRM_MODE_FLAG_PIC_AR_64_27:
-+ out->picture_aspect_ratio |= HDMI_PICTURE_ASPECT_64_27;
-+ break;
-+ case DRM_MODE_FLAG_PIC_AR_256_135:
-+ out->picture_aspect_ratio |= HDMI_PICTURE_ASPECT_256_135;
-+ break;
- default:
- out->picture_aspect_ratio = HDMI_PICTURE_ASPECT_NONE;
- break;
---- a/include/uapi/drm/drm_mode.h
-+++ b/include/uapi/drm/drm_mode.h
-@@ -89,6 +89,8 @@ extern "C" {
- #define DRM_MODE_PICTURE_ASPECT_NONE 0
- #define DRM_MODE_PICTURE_ASPECT_4_3 1
- #define DRM_MODE_PICTURE_ASPECT_16_9 2
-+#define DRM_MODE_PICTURE_ASPECT_64_27 3
-+#define DRM_MODE_PICTURE_ASPECT_256_135 4
-
- /* Aspect ratio flag bitmask (4 bits 22:19) */
- #define DRM_MODE_FLAG_PIC_AR_MASK (0x0F<<19)
-@@ -98,6 +100,10 @@ extern "C" {
- (DRM_MODE_PICTURE_ASPECT_4_3<<19)
- #define DRM_MODE_FLAG_PIC_AR_16_9 \
- (DRM_MODE_PICTURE_ASPECT_16_9<<19)
-+#define DRM_MODE_FLAG_PIC_AR_64_27 \
-+ (DRM_MODE_PICTURE_ASPECT_64_27<<19)
-+#define DRM_MODE_FLAG_PIC_AR_256_135 \
-+ (DRM_MODE_PICTURE_ASPECT_256_135<<19)
-
- /* DPMS flags */
- /* bit compatible with the xorg definitions. */
diff --git a/patches.drm/drm-Add-aspect-ratio-parsing-in-DRM-layer b/patches.drm/drm-Add-aspect-ratio-parsing-in-DRM-layer
deleted file mode 100644
index a47ec817df..0000000000
--- a/patches.drm/drm-Add-aspect-ratio-parsing-in-DRM-layer
+++ /dev/null
@@ -1,146 +0,0 @@
-From 222ec1618c3aceca1e61e1e73e559c647c2b946f Mon Sep 17 00:00:00 2001
-From: Shashank Sharma <shashank.sharma@intel.com>
-Date: Tue, 8 May 2018 16:39:44 +0530
-Subject: [PATCH] drm: Add aspect ratio parsing in DRM layer
-Git-commit: 222ec1618c3aceca1e61e1e73e559c647c2b946f
-Patch-mainline: v4.18-rc1
-References: FATE#325208
-
-Current DRM layer functions don't parse aspect ratio information
-while converting a user mode->kernel mode or vice versa. This
-causes modeset to pick mode with wrong aspect ratio, eventually
-causing failures in HDMI compliance test cases, due to wrong VIC.
-
-This patch adds aspect ratio information in DRM's mode conversion
-and mode comparision functions, to make sure kernel picks mode
-with right aspect ratio (as per the VIC).
-
-Background:
-This patch was once reviewed and merged, and later reverted due to
-lack of DRM cap protection. This is a re-spin of this patch, this
-time with DRM cap protection, to avoid aspect ratio information, when
-the client doesn't request for it.
-
-Review link: https://pw-emeril.freedesktop.org/patch/104068/
-Background discussion: https://patchwork.kernel.org/patch/9379057/
-
-Signed-off-by: Shashank Sharma <shashank.sharma@intel.com>
-Signed-off-by: Lin, Jia <lin.a.jia@intel.com>
-Signed-off-by: Akashdeep Sharma <akashdeep.sharma@intel.com>
-Reviewed-by: Jim Bride <jim.bride@linux.intel.com> (V2)
-Reviewed-by: Jose Abreu <Jose.Abreu@synopsys.com> (V4)
-
-Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
-Cc: Jim Bride <jim.bride@linux.intel.com>
-Cc: Jose Abreu <Jose.Abreu@synopsys.com>
-Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-
-V3: modified the aspect-ratio check in drm_mode_equal as per new flags provided by Ville. https://patchwork.freedesktop.org/patch/188043/
-V4: rebase
-V5: rebase
-V6: As recommended by Ville, avoided matching of aspect-ratio in drm_fb_helper, while trying to find a common mode among connectors for the target clone mode.
-V7: rebase
-V8: rebase
-V9: rebase
-V10: rebase
-V11: rebase
-V12: rebase
-V13: rebase
-V14: rebase
-
-Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
-Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/1525777785-9740-10-git-send-email-ankit.k.nautiyal@intel.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/drm_fb_helper.c | 12 ++++++++++--
- drivers/gpu/drm/drm_modes.c | 35 ++++++++++++++++++++++++++++++++++-
- 2 files changed, 44 insertions(+), 3 deletions(-)
-
---- a/drivers/gpu/drm/drm_fb_helper.c
-+++ b/drivers/gpu/drm/drm_fb_helper.c
-@@ -2113,7 +2113,11 @@ static bool drm_target_cloned(struct drm
- for (j = 0; j < i; j++) {
- if (!enabled[j])
- continue;
-- if (!drm_mode_equal(modes[j], modes[i]))
-+ if (!drm_mode_match(modes[j], modes[i],
-+ DRM_MODE_MATCH_TIMINGS |
-+ DRM_MODE_MATCH_CLOCK |
-+ DRM_MODE_MATCH_FLAGS |
-+ DRM_MODE_MATCH_3D_FLAGS))
- can_clone = false;
- }
- }
-@@ -2133,7 +2137,11 @@ static bool drm_target_cloned(struct drm
-
- fb_helper_conn = fb_helper->connector_info[i];
- list_for_each_entry(mode, &fb_helper_conn->connector->modes, head) {
-- if (drm_mode_equal(mode, dmt_mode))
-+ if (drm_mode_match(mode, dmt_mode,
-+ DRM_MODE_MATCH_TIMINGS |
-+ DRM_MODE_MATCH_CLOCK |
-+ DRM_MODE_MATCH_FLAGS |
-+ DRM_MODE_MATCH_3D_FLAGS))
- modes[i] = mode;
- }
- if (!modes[i])
---- a/drivers/gpu/drm/drm_modes.c
-+++ b/drivers/gpu/drm/drm_modes.c
-@@ -1050,7 +1050,8 @@ bool drm_mode_equal(const struct drm_dis
- DRM_MODE_MATCH_TIMINGS |
- DRM_MODE_MATCH_CLOCK |
- DRM_MODE_MATCH_FLAGS |
-- DRM_MODE_MATCH_3D_FLAGS);
-+ DRM_MODE_MATCH_3D_FLAGS|
-+ DRM_MODE_MATCH_ASPECT_RATIO);
- }
- EXPORT_SYMBOL(drm_mode_equal);
-
-@@ -1621,6 +1622,20 @@ void drm_mode_convert_to_umode(struct dr
- out->vrefresh = in->vrefresh;
- out->flags = in->flags;
- out->type = in->type;
-+
-+ switch (in->picture_aspect_ratio) {
-+ case HDMI_PICTURE_ASPECT_4_3:
-+ out->flags |= DRM_MODE_FLAG_PIC_AR_4_3;
-+ break;
-+ case HDMI_PICTURE_ASPECT_16_9:
-+ out->flags |= DRM_MODE_FLAG_PIC_AR_16_9;
-+ break;
-+ case HDMI_PICTURE_ASPECT_RESERVED:
-+ default:
-+ out->flags |= DRM_MODE_FLAG_PIC_AR_NONE;
-+ break;
-+ }
-+
- strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
- out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
- }
-@@ -1666,6 +1681,24 @@ int drm_mode_convert_umode(struct drm_di
- strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
- out->name[DRM_DISPLAY_MODE_LEN-1] = 0;
-
-+ /* Clearing picture aspect ratio bits from out flags,
-+ * as the aspect-ratio information is not stored in
-+ * flags for kernel-mode, but in picture_aspect_ratio.
-+ */
-+ out->flags &= ~DRM_MODE_FLAG_PIC_AR_MASK;
-+
-+ switch (in->flags & DRM_MODE_FLAG_PIC_AR_MASK) {
-+ case DRM_MODE_FLAG_PIC_AR_4_3:
-+ out->picture_aspect_ratio |= HDMI_PICTURE_ASPECT_4_3;
-+ break;
-+ case DRM_MODE_FLAG_PIC_AR_16_9:
-+ out->picture_aspect_ratio |= HDMI_PICTURE_ASPECT_16_9;
-+ break;
-+ default:
-+ out->picture_aspect_ratio = HDMI_PICTURE_ASPECT_NONE;
-+ break;
-+ }
-+
- out->status = drm_mode_validate_basic(out);
- if (out->status != MODE_OK)
- goto out;
diff --git a/patches.drm/drm-Expose-modes-with-aspect-ratio-only-if-requested b/patches.drm/drm-Expose-modes-with-aspect-ratio-only-if-requested
deleted file mode 100644
index 6bb3e7cfef..0000000000
--- a/patches.drm/drm-Expose-modes-with-aspect-ratio-only-if-requested
+++ /dev/null
@@ -1,157 +0,0 @@
-From c3ff0cdb354f89a5b877eee61af70e6ae51de50b Mon Sep 17 00:00:00 2001
-From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-Date: Tue, 8 May 2018 16:39:43 +0530
-Subject: [PATCH] drm: Expose modes with aspect ratio, only if requested
-Git-commit: c3ff0cdb354f89a5b877eee61af70e6ae51de50b
-Patch-mainline: v4.18-rc1
-References: FATE#325208
-
-We parse the EDID and add all the modes in the connector's modelist.
-This adds CEA modes with aspect ratio information too, regardless of
-whether user space requested this information or not.
-
-This patch:
--prunes the modes with aspect-ratio information, from the
- drm_mode_get_connector modelist supplied to the user, if the
- user-space has not set the aspect ratio DRM client cap. However if
- such a mode is unique in the list, it is kept in the list, with
- aspect-ratio flags reset.
--prepares a list of exposed modes, which is used to find unique modes
- if aspect-ratio is not allowed.
--adds a new list_head 'exposed_head' in drm_mode_display, to traverse
- the list of exposed modes.
-
-Cc: Ville Syrjala <ville.syrjala@linux.intel.com>
-Cc: Shashank Sharma <shashank.sharma@intel.com>
-Cc: Jose Abreu <jose.abreu@synopsys.com>
-
-Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-
-V3: As suggested by Ville, modified the mechanism of pruning of modes with aspect-ratio, if the aspect-ratio is not supported. Instead of straight away pruning such a mode, the mode is retained with aspect ratio bits set to zero, provided it is unique.
-V4: rebase
-V5: Addressed review comments from Ville: -used a pointer to store last valid mode. -avoided, modifying of picture_aspect_ratio in kernel mode, instead only flags bits of user mode are reset (if aspect-ratio is not supported).
-V6: As suggested by Ville, corrected the mode pruning logic and elaborated the mode pruning logic and the assumptions taken.
-V7: rebase
-V8: rebase
-V9: rebase
-V10: rebase
-V11: Fixed the issue caused in kms_3d test, and enhanced the pruning logic to correctly identify and prune modes with aspect-ratio, if aspect-ratio cap is not set.
-V12: As suggested by Ville, added another list_head in drm_mode_display to traverse the list of exposed modes and avoided duplication of modes.
-V13: Minor modifications, as suggested by Ville.
-V14: As suggested by Daniel Vetter and Ville Syrjala, corrected the pruning logic to avoid any dependency in the order of mode with aspect-ratio.
-Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
-Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/1525777785-9740-9-git-send-email-ankit.k.nautiyal@intel.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/drm_connector.c | 44 +++++++++++++++++++++++++++++++++-------
- include/drm/drm_modes.h | 13 +++++++++++
- 2 files changed, 50 insertions(+), 7 deletions(-)
-
---- a/drivers/gpu/drm/drm_connector.c
-+++ b/drivers/gpu/drm/drm_connector.c
-@@ -1370,8 +1370,10 @@ static struct drm_encoder *drm_connector
- return connector->encoder;
- }
-
--static bool drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
-- const struct drm_file *file_priv)
-+static bool
-+drm_mode_expose_to_userspace(const struct drm_display_mode *mode,
-+ const struct list_head *export_list,
-+ const struct drm_file *file_priv)
- {
- /*
- * If user-space hasn't configured the driver to expose the stereo 3D
-@@ -1379,6 +1381,23 @@ static bool drm_mode_expose_to_userspace
- */
- if (!file_priv->stereo_allowed && drm_mode_is_stereo(mode))
- return false;
-+ /*
-+ * If user-space hasn't configured the driver to expose the modes
-+ * with aspect-ratio, don't expose them. However if such a mode
-+ * is unique, let it be exposed, but reset the aspect-ratio flags
-+ * while preparing the list of user-modes.
-+ */
-+ if (!file_priv->aspect_ratio_allowed) {
-+ struct drm_display_mode *mode_itr;
-+
-+ list_for_each_entry(mode_itr, export_list, export_head)
-+ if (drm_mode_match(mode_itr, mode,
-+ DRM_MODE_MATCH_TIMINGS |
-+ DRM_MODE_MATCH_CLOCK |
-+ DRM_MODE_MATCH_FLAGS |
-+ DRM_MODE_MATCH_3D_FLAGS))
-+ return false;
-+ }
-
- return true;
- }
-@@ -1398,6 +1417,7 @@ int drm_mode_getconnector(struct drm_dev
- struct drm_mode_modeinfo u_mode;
- struct drm_mode_modeinfo __user *mode_ptr;
- uint32_t __user *encoder_ptr;
-+ LIST_HEAD(export_list);
-
- if (!drm_core_check_feature(dev, DRIVER_MODESET))
- return -EINVAL;
-@@ -1446,21 +1466,31 @@ int drm_mode_getconnector(struct drm_dev
-
- /* delayed so we get modes regardless of pre-fill_modes state */
- list_for_each_entry(mode, &connector->modes, head)
-- if (drm_mode_expose_to_userspace(mode, file_priv))
-+ if (drm_mode_expose_to_userspace(mode, &export_list,
-+ file_priv)) {
-+ list_add_tail(&mode->export_head, &export_list);
- mode_count++;
-+ }
-
- /*
- * This ioctl is called twice, once to determine how much space is
- * needed, and the 2nd time to fill it.
-+ * The modes that need to be exposed to the user are maintained in the
-+ * 'export_list'. When the ioctl is called first time to determine the,
-+ * space, the export_list gets filled, to find the no.of modes. In the
-+ * 2nd time, the user modes are filled, one by one from the export_list.
- */
- if ((out_resp->count_modes >= mode_count) && mode_count) {
- copied = 0;
- mode_ptr = (struct drm_mode_modeinfo __user *)(unsigned long)out_resp->modes_ptr;
-- list_for_each_entry(mode, &connector->modes, head) {
-- if (!drm_mode_expose_to_userspace(mode, file_priv))
-- continue;
--
-+ list_for_each_entry(mode, &export_list, export_head) {
- drm_mode_convert_to_umode(&u_mode, mode);
-+ /*
-+ * Reset aspect ratio flags of user-mode, if modes with
-+ * aspect-ratio are not supported.
-+ */
-+ if (!file_priv->aspect_ratio_allowed)
-+ u_mode.flags &= ~DRM_MODE_FLAG_PIC_AR_MASK;
- if (copy_to_user(mode_ptr + copied,
- &u_mode, sizeof(u_mode))) {
- ret = -EFAULT;
---- a/include/drm/drm_modes.h
-+++ b/include/drm/drm_modes.h
-@@ -415,6 +415,19 @@ struct drm_display_mode {
- * Field for setting the HDMI picture aspect ratio of a mode.
- */
- enum hdmi_picture_aspect picture_aspect_ratio;
-+
-+ /**
-+ * @export_head:
-+ *
-+ * struct list_head for modes to be exposed to the userspace.
-+ * This is to maintain a list of exposed modes while preparing
-+ * user-mode's list in drm_mode_getconnector ioctl. The purpose of this
-+ * list_head only lies in the ioctl function, and is not expected to be
-+ * used outside the function.
-+ * Once used, the stale pointers are not reset, but left as it is, to
-+ * avoid overhead of protecting it by mode_config.mutex.
-+ */
-+ struct list_head export_head;
- };
-
- /**
diff --git a/patches.drm/drm-Handle-aspect-ratio-info-in-legacy-modeset-path b/patches.drm/drm-Handle-aspect-ratio-info-in-legacy-modeset-path
deleted file mode 100644
index 498466b657..0000000000
--- a/patches.drm/drm-Handle-aspect-ratio-info-in-legacy-modeset-path
+++ /dev/null
@@ -1,72 +0,0 @@
-From ace5bf0e254b10585efa938d05e95ea05ae15326 Mon Sep 17 00:00:00 2001
-From: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-Date: Tue, 8 May 2018 16:39:42 +0530
-Subject: [PATCH] drm: Handle aspect ratio info in legacy modeset path
-Git-commit: ace5bf0e254b10585efa938d05e95ea05ae15326
-Patch-mainline: v4.18-rc1
-References: FATE#325208
-
-If the user-space does not support aspect-ratio, and requests for a
-modeset with mode having aspect ratio bits set, then the given
-user-mode must be rejected. Secondly, while preparing a user-mode from
-kernel mode, the aspect-ratio info must not be given, if aspect-ratio
-is not supported by the user.
-
-This patch:
-1. rejects the modes with aspect-ratio info, during modeset, if the
- user does not support aspect ratio.
-2. does not load the aspect-ratio info in user-mode structure, if
- aspect ratio is not supported.
-3. adds helper functions for determining if aspect-ratio is expected
- in user-mode and for allowing/disallowing the aspect-ratio, if its
- not expected.
-
-Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
-
-V3: Addressed review comments from Ville: Do not corrupt the current crtc state by updating aspect-ratio on the fly.
-V4: rebase
-V5: As suggested by Ville, rejected the modeset calls for modes with aspect ratio, if the user does not set aspect-ratio cap.
-V6: Used the helper functions for determining if aspect-ratio is expected in the user-mode.
-V7: rebase
-V8: rebase
-V9: rebase
-V10: Modified the commit-message
-V11: rebase
-V12: Merged the patch for adding aspect-ratio helper functions with this patch.
-V13: Minor modifications as suggested by Ville.
-V14: Removed helper functions, as they were used only once in legacy modeset path, as suggested by Daniel Vetter.
-
-Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
-Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/1525777785-9740-8-git-send-email-ankit.k.nautiyal@intel.com
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/drm_crtc.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -442,6 +442,8 @@ int drm_mode_getcrtc(struct drm_device *
- crtc_resp->mode_valid = 0;
- }
- }
-+ if (!file_priv->aspect_ratio_allowed)
-+ crtc_resp->mode.flags &= ~DRM_MODE_FLAG_PIC_AR_MASK;
- drm_modeset_unlock(&crtc->mutex);
-
- return 0;
-@@ -609,6 +611,13 @@ retry:
- ret = -ENOMEM;
- goto out;
- }
-+ if (!file_priv->aspect_ratio_allowed &&
-+ (crtc_req->mode.flags & DRM_MODE_FLAG_PIC_AR_MASK) != DRM_MODE_FLAG_PIC_AR_NONE) {
-+ DRM_DEBUG_KMS("Unexpected aspect-ratio flag bits\n");
-+ ret = -EINVAL;
-+ goto out;
-+ }
-+
-
- ret = drm_mode_convert_umode(mode, &crtc_req->mode);
- if (ret) {
diff --git a/patches.drm/drm-dp_mst-Skip-validating-ports-during-destruction-.patch b/patches.drm/drm-dp_mst-Skip-validating-ports-during-destruction-.patch
deleted file mode 100644
index 08152a6b7d..0000000000
--- a/patches.drm/drm-dp_mst-Skip-validating-ports-during-destruction-.patch
+++ /dev/null
@@ -1,90 +0,0 @@
-From c54c7374ff44de5e609506aca7c0deae4703b6d1 Mon Sep 17 00:00:00 2001
-From: Lyude Paul <lyude@redhat.com>
-Date: Tue, 13 Nov 2018 17:46:14 -0500
-Subject: [PATCH] drm/dp_mst: Skip validating ports during destruction, just ref
-Git-commit: c54c7374ff44de5e609506aca7c0deae4703b6d1
-Patch-mainline: 4.20-rc5
-References: bsc#1051510
-
-Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I
-accidentally introduced into DRM two years ago.
-
-Pretend we have a topology like this:
-
-|- DP-1: mst_primary
- |- DP-4: active display
- |- DP-5: disconnected
- |- DP-6: active hub
- |- DP-7: active display
- |- DP-8: disconnected
- |- DP-9: disconnected
-
-If we unplug DP-6, the topology starting at DP-7 will be destroyed but
-it's payloads will live on in DP-1's VCPI allocations and thus require
-removal. However, this removal currently fails because
-drm_dp_update_payload_part1() will (rightly so) try to validate the port
-before accessing it, fail then abort. If we keep going, eventually we
-run the MST hub out of bandwidth and all new allocations will start to
-fail (or in my case; all new displays just start flickering a ton).
-
-We could just teach drm_dp_update_payload_part1() not to drop the port
-ref in this case, but then we also need to teach
-drm_dp_destroy_payload_step1() to do the same thing, then hope no one
-ever adds anything to the that requires a validated port reference in
-drm_dp_destroy_connector_work(). Kind of sketchy.
-
-So let's go with a more clever solution: any port that
-drm_dp_destroy_connector_work() interacts with is guaranteed to still
-exist in memory until we say so. While said port might not be valid we
-don't really care: that's the whole reason we're destroying it in the
-first place! So, teach drm_dp_get_validated_port_ref() to use the all
-mighty current_work() function to avoid attempting to validate ports
-from the context of mgr->destroy_connector_work. I can't see any
-situation where this wouldn't be safe, and this avoids having to play
-whack-a-mole in the future of trying to work around port validation.
-
-Signed-off-by: Lyude Paul <lyude@redhat.com>
-Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()")
-Reported-by: Jerry Zuo <Jerry.Zuo@amd.com>
-Cc: Jerry Zuo <Jerry.Zuo@amd.com>
-Cc: Harry Wentland <Harry.Wentland@amd.com>
-Cc: <stable@vger.kernel.org> # v4.6+
-Reviewed-by: Dave Airlie <airlied@redhat.com>
-Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com
-Signed-off-by: Sean Paul <seanpaul@chromium.org>
-Acked-by: Takashi Iwai <tiwai@suse.de>
-
----
- drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++--
- 1 file changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
-index 0e0df398222d..250d7160826f 100644
---- a/drivers/gpu/drm/drm_dp_mst_topology.c
-+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
-@@ -1023,9 +1023,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_
- static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port)
- {
- struct drm_dp_mst_port *rport = NULL;
-+
- mutex_lock(&mgr->lock);
-- if (mgr->mst_primary)
-- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port);
-+ /*
-+ * Port may or may not be 'valid' but we don't care about that when
-+ * destroying the port and we are guaranteed that the port pointer
-+ * will be valid until we've finished
-+ */
-+ if (current_work() == &mgr->destroy_connector_work) {
-+ kref_get(&port->kref);
-+ rport = port;
-+ } else if (mgr->mst_primary) {
-+ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary,
-+ port);
-+ }
- mutex_unlock(&mgr->lock);
- return rport;
- }
---
-2.19.1
-
diff --git a/patches.fixes/dax-remove-VM_MIXEDMAP-for-fsdax-and-device-dax.patch b/patches.fixes/dax-remove-VM_MIXEDMAP-for-fsdax-and-device-dax.patch
index f14bc29bb1..50265541f3 100644
--- a/patches.fixes/dax-remove-VM_MIXEDMAP-for-fsdax-and-device-dax.patch
+++ b/patches.fixes/dax-remove-VM_MIXEDMAP-for-fsdax-and-device-dax.patch
@@ -41,14 +41,14 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
fs/ext2/file.c | 1 -
fs/ext4/file.c | 2 +-
fs/xfs/xfs_file.c | 2 +-
- mm/hmm.c | 3 ++-
+ mm/hmm.c | 6 ++++--
mm/huge_memory.c | 4 ++--
mm/ksm.c | 3 +++
mm/memory.c | 6 ++++++
mm/migrate.c | 3 ++-
mm/mlock.c | 3 ++-
mm/mmap.c | 9 +++++----
- 11 files changed, 25 insertions(+), 13 deletions(-)
+ 11 files changed, 27 insertions(+), 14 deletions(-)
--- a/drivers/dax/device.c
+++ b/drivers/dax/device.c
@@ -95,7 +95,17 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
--- a/mm/hmm.c
+++ b/mm/hmm.c
-@@ -698,7 +698,8 @@ int hmm_vma_fault(struct vm_area_struct
+@@ -504,7 +504,8 @@ int hmm_vma_get_pfns(struct vm_area_stru
+ struct hmm *hmm;
+
+ /* FIXME support hugetlb fs */
+- if (is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL)) {
++ if (is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL) ||
++ vma_is_dax(vma)) {
+ hmm_pfns_special(pfns, start, end);
+ return -EINVAL;
+ }
+@@ -698,7 +699,8 @@ int hmm_vma_fault(struct vm_area_struct
spin_unlock(&hmm->lock);
/* FIXME support hugetlb fs */
@@ -107,7 +117,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
}
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
-@@ -766,11 +766,11 @@ int vmf_insert_pfn_pmd(struct vm_area_st
+@@ -765,11 +765,11 @@ int vmf_insert_pfn_pmd(struct vm_area_st
* but we need to be consistent with PTEs and architectures that
* can't support a 'special' bit.
*/
@@ -123,7 +133,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
return VM_FAULT_SIGBUS;
--- a/mm/ksm.c
+++ b/mm/ksm.c
-@@ -1801,6 +1801,9 @@ int ksm_madvise(struct vm_area_struct *v
+@@ -1804,6 +1804,9 @@ int ksm_madvise(struct vm_area_struct *v
VM_HUGETLB | VM_MIXEDMAP))
return 0; /* just ignore the advice */
@@ -135,7 +145,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
return 0;
--- a/mm/memory.c
+++ b/mm/memory.c
-@@ -860,6 +860,10 @@ struct page *_vm_normal_page(struct vm_a
+@@ -854,6 +854,10 @@ struct page *_vm_normal_page(struct vm_a
return NULL;
}
}
@@ -146,7 +156,7 @@ Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
print_bad_pte(vma, addr, pte, NULL);
return NULL;
}
-@@ -923,6 +927,8 @@ struct page *vm_normal_page_pmd(struct v
+@@ -917,6 +921,8 @@ struct page *vm_normal_page_pmd(struct v
}
}
diff --git a/patches.fixes/kvm-svm-ensure-an-ibpb-on-all-affected-cpus-when-freeing-a-vmcb.patch b/patches.fixes/kvm-svm-ensure-an-ibpb-on-all-affected-cpus-when-freeing-a-vmcb.patch
new file mode 100644
index 0000000000..2e2280e4b3
--- /dev/null
+++ b/patches.fixes/kvm-svm-ensure-an-ibpb-on-all-affected-cpus-when-freeing-a-vmcb.patch
@@ -0,0 +1,64 @@
+From: Jim Mattson <jmattson@google.com>
+Date: Tue, 22 May 2018 09:54:20 -0700
+Subject: kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
+Git-commit: fd65d3142f734bc4376053c8d75670041903134d
+Patch-mainline: v4.20-rc5
+References: bsc#1114279
+
+Previously, we only called indirect_branch_prediction_barrier on the
+logical CPU that freed a vmcb. This function should be called on all
+logical CPUs that last loaded the vmcb in question.
+
+Fixes: 15d45071523d ("KVM/x86: Add IBPB support")
+Reported-by: Neel Natu <neelnatu@google.com>
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kvm/svm.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index a24733aade4c..cc6467b35a85 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2193,21 +2193,31 @@ static struct kvm_vcpu *svm_create_vcpu(struct kvm *kvm, unsigned int id)
+ return ERR_PTR(err);
+ }
+
++static void svm_clear_current_vmcb(struct vmcb *vmcb)
++{
++ int i;
++
++ for_each_online_cpu(i)
++ cmpxchg(&per_cpu(svm_data, i)->current_vmcb, vmcb, NULL);
++}
++
+ static void svm_free_vcpu(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
++ /*
++ * The vmcb page can be recycled, causing a false negative in
++ * svm_vcpu_load(). So, ensure that no logical CPU has this
++ * vmcb page recorded as its current vmcb.
++ */
++ svm_clear_current_vmcb(svm->vmcb);
++
+ __free_page(pfn_to_page(__sme_clr(svm->vmcb_pa) >> PAGE_SHIFT));
+ __free_pages(virt_to_page(svm->msrpm), MSRPM_ALLOC_ORDER);
+ __free_page(virt_to_page(svm->nested.hsave));
+ __free_pages(virt_to_page(svm->nested.msrpm), MSRPM_ALLOC_ORDER);
+ kvm_vcpu_uninit(vcpu);
+ kmem_cache_free(kvm_vcpu_cache, svm);
+- /*
+- * The vmcb page can be recycled, causing a false negative in
+- * svm_vcpu_load(). So do a full IBPB now.
+- */
+- indirect_branch_prediction_barrier();
+ }
+
+ static void svm_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+
diff --git a/patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch b/patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch
new file mode 100644
index 0000000000..5172fad5a4
--- /dev/null
+++ b/patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch
@@ -0,0 +1,32 @@
+From: Keith Busch <keith.busch@intel.com>
+Date: Mon, 26 Nov 2018 16:39:47 -0700
+Subject: nvme: Free ctrl device name on init failure
+Git-commit: d6a2b9535d1e52bea269c138614c4801469d10e1
+Patch-mainline: v4.20-rc5
+References: FATE#323952, FATE#322506
+
+Free the kobject name that was allocated for the controller device on
+failure rather than its parent.
+
+Fixes: d22524a4782a9 ("nvme: switch controller refcounting to use struct device")
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvme/host/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 559d567693b8..5afda6fe5ae9 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3585,7 +3585,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev,
+
+ return 0;
+ out_free_name:
+- kfree_const(dev->kobj.name);
++ kfree_const(ctrl->device->kobj.name);
+ out_release_instance:
+ ida_simple_remove(&nvme_instance_ida, ctrl->instance);
+ out:
+
diff --git a/patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch b/patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch
new file mode 100644
index 0000000000..968469f6f4
--- /dev/null
+++ b/patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch
@@ -0,0 +1,104 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Fri, 28 Jul 2017 15:22:36 +0100
+Patch-mainline: 4.14
+Git-commit: 6399fb5a0b69a9cc73aa84767954366d867b145d
+Subject: [PATCH] Btrfs: fix assertion failure during fsync in no-holes
+ mode
+References: bsc#1118136
+
+When logging an inode in full mode that has an inline compressed extent
+that represents a range with a size matching the sector size (currently
+the same as the page size), has a trailing hole and the no-holes feature
+is enabled, we end up failing an assertion leading to a trace like the
+following:
+
+[141812.031528] assertion failed: len == i_size, file: fs/btrfs/tree-log.c, line: 4453
+[141812.033069] ------------[ cut here ]------------
+[141812.034330] kernel BUG at fs/btrfs/ctree.h:3452!
+[141812.035137] invalid opcode: 0000 [#1] PREEMPT SMP
+[141812.035932] Modules linked in: btrfs dm_thin_pool dm_persistent_data dm_bio_prison dm_bufio dm_flakey dm_mod dax ppdev evdev ghash_clmulni_intel pcbc aesni_intel aes_x86_64 tpm_tis psmouse crypto_simd parport_pc sg pcspkr tpm_tis_core cryptd parport serio_raw glue_helper tpm i2c_piix4 i2c_core button sunrpc loop autofs4 ext4 crc16 jbd2 mbcache raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c crc32c_generic raid1 raid0 multipath linear md_mod sd_mod ata_generic virtio_scsi ata_piix floppy crc32c_intel libata scsi_mod virtio_pci virtio_ring e1000 virtio [last unloaded: btrfs]
+[141812.036790] CPU: 3 PID: 845 Comm: fdm-stress Tainted: G B W 4.12.3-btrfs-next-52+ #1
+[141812.036790] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014
+[141812.036790] task: ffff8801e6694180 task.stack: ffffc90009004000
+[141812.036790] RIP: 0010:assfail.constprop.18+0x1c/0x1e [btrfs]
+[141812.036790] RSP: 0018:ffffc90009007bc0 EFLAGS: 00010282
+[141812.036790] RAX: 0000000000000046 RBX: ffff88017512c008 RCX: 0000000000000001
+[141812.036790] RDX: ffff88023fd95201 RSI: ffffffff8182264c RDI: 00000000ffffffff
+[141812.036790] RBP: ffffc90009007bc0 R08: 0000000000000001 R09: 0000000000000001
+[141812.036790] R10: 0000000000001000 R11: ffffffff82f5a0c9 R12: ffff88014e5947e8
+[141812.036790] R13: 00000000000b4000 R14: ffff8801b234d008 R15: 0000000000000000
+[141812.036790] FS: 00007fdba6ffd700(0000) GS:ffff88023fd80000(0000) knlGS:0000000000000000
+[141812.036790] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[141812.036790] CR2: 00007fdb9c000010 CR3: 000000016efa2000 CR4: 00000000001406e0
+[141812.036790] Call Trace:
+[141812.036790] btrfs_log_inode+0x9f0/0xd3d [btrfs]
+[141812.036790] ? __mutex_lock+0x120/0x3ce
+[141812.036790] btrfs_log_inode_parent+0x224/0x685 [btrfs]
+[141812.036790] ? lock_acquire+0x16b/0x1af
+[141812.036790] btrfs_log_dentry_safe+0x60/0x7b [btrfs]
+[141812.036790] btrfs_sync_file+0x32e/0x3f8 [btrfs]
+[141812.036790] vfs_fsync_range+0x8a/0x9d
+[141812.036790] vfs_fsync+0x1c/0x1e
+[141812.036790] do_fsync+0x31/0x4a
+[141812.036790] SyS_fdatasync+0x13/0x17
+[141812.036790] entry_SYSCALL_64_fastpath+0x18/0xad
+[141812.036790] RIP: 0033:0x7fdbac41a47d
+[141812.036790] RSP: 002b:00007fdba6ffce30 EFLAGS: 00000293 ORIG_RAX: 000000000000004b
+[141812.036790] RAX: ffffffffffffffda RBX: ffffffff81092c9f RCX: 00007fdbac41a47d
+[141812.036790] RDX: 0000004cf0160a40 RSI: 0000000000000000 RDI: 0000000000000006
+[141812.036790] RBP: ffffc90009007f98 R08: 0000000000000000 R09: 0000000000000010
+[141812.036790] R10: 00000000000002e8 R11: 0000000000000293 R12: ffffffff8110cd90
+[141812.036790] R13: ffffc90009007f78 R14: 0000000000000000 R15: 0000000000000000
+[141812.036790] ? time_hardirqs_off+0x9/0x14
+[141812.036790] ? trace_hardirqs_off_caller+0x1f/0xa3
+[141812.036790] Code: c7 d6 61 6b a0 48 89 e5 e8 ba ef a8 e0 0f 0b 55 89 f1 48 c7 c2 6d 65 6b a0 48 89 fe 48 c7 c7 81 65 6b a0 48 89 e5 e8 9c ef a8 e0 <0f> 0b 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 49 89
+[141812.036790] RIP: assfail.constprop.18+0x1c/0x1e [btrfs] RSP: ffffc90009007bc0
+[141812.084448] ---[ end trace 44e472684c7a32cc ]---
+
+Which happens because the code that logs a trailing hole when the no-holes
+feature is enabled, did not consider that a compressed inline extent can
+represent a range with a size matching the sector size, in which case
+expanding the inode's i_size, through a truncate operation, won't lead
+to padding with zeroes the page that represents the inline extent, and
+therefore the inline extent remains after the truncation.
+
+Fix this by adapting the assertion to accept inline extents representing
+data with a sector size length if, and only if, the inline extents are
+compressed.
+
+A sample and trivial reproducer (for systems with a 4K page size) for this
+issue:
+
+ mkfs.btrfs -O no-holes -f /dev/sdc
+ mount -o compress /dev/sdc /mnt
+ xfs_io -f -c "pwrite -S 0xab 0 4K" /mnt/foobar
+ sync
+ xfs_io -c "truncate 32K" /mnt/foobar
+ xfs_io -c "fsync" /mnt/foobar
+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/tree-log.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 051bdc9a801b..d8928fedf4d9 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4824,7 +4824,10 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ len = btrfs_file_extent_inline_len(leaf,
+ path->slots[0],
+ extent);
+- ASSERT(len == i_size);
++ ASSERT(len == i_size ||
++ (len == fs_info->sectorsize &&
++ btrfs_file_extent_compression(leaf, extent) !=
++ BTRFS_COMPRESS_NONE));
+ return 0;
+ }
+
+--
+2.19.0
+
diff --git a/patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch b/patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch
index e75326a332..7bf5313f2b 100644
--- a/patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch
+++ b/patches.suse/0001-x86-speculation-Add-basic-IBRS-support-infrastructur.patch
@@ -25,21 +25,11 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Documentation/admin-guide/kernel-parameters.txt | 1
arch/x86/include/asm/cpufeatures.h | 1
arch/x86/include/asm/nospec-branch.h | 2 -
- arch/x86/kernel/cpu/bugs.c | 31 +++++++++++++++++++-----
+ arch/x86/kernel/cpu/bugs.c | 42 +++++++++++++++++-------
arch/x86/lib/Makefile | 2 -
- arch/x86/lib/retpoline.S | 5 +++
- 6 files changed, 33 insertions(+), 9 deletions(-)
+ arch/x86/lib/retpoline.S | 5 ++
+ 6 files changed, 38 insertions(+), 15 deletions(-)
---- a/Documentation/admin-guide/kernel-parameters.txt
-+++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -3980,6 +3980,7 @@
- retpoline - replace indirect branches
- retpoline,generic - google's original retpoline
- retpoline,amd - AMD-specific minimal thunk
-+ ibrs - Intel/AMD microcode feature
-
- Not specifying this option is equivalent to
- spectre_v2=auto.
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -214,6 +214,7 @@
@@ -52,7 +42,7 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
#define X86_FEATURE_IBRS ( 7*32+26) /* Indirect Branch Restricted Speculation */
--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
-@@ -236,7 +236,6 @@ extern char __indirect_thunk_end[];
+@@ -237,7 +237,6 @@ extern char __indirect_thunk_end[];
*/
static inline void vmexit_fill_RSB(void)
{
@@ -60,7 +50,7 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
unsigned long loops;
asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE
-@@ -246,7 +245,6 @@ static inline void vmexit_fill_RSB(void)
+@@ -247,7 +246,6 @@ static inline void vmexit_fill_RSB(void)
"910:"
: "=r" (loops), ASM_CALL_CONSTRAINT
: : "memory" );
@@ -78,15 +68,15 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
};
static const char *spectre_v2_strings[] = {
-@@ -140,6 +141,7 @@ static const char *spectre_v2_strings[]
- [SPECTRE_V2_RETPOLINE_MINIMAL_AMD] = "Vulnerable: Minimal AMD ASM retpoline",
+@@ -141,6 +142,7 @@ static const char *spectre_v2_strings[]
[SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline",
[SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline",
+ [SPECTRE_V2_IBRS_ENHANCED] = "Mitigation: Enhanced IBRS",
+ [SPECTRE_V2_IBRS] = "Mitigation: Indirect Branch Restricted Speculation",
};
#undef pr_fmt
-@@ -389,6 +391,7 @@ static const struct {
+@@ -390,6 +392,7 @@ static const struct {
{ "retpoline", SPECTRE_V2_CMD_RETPOLINE, false },
{ "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false },
{ "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false },
@@ -94,7 +84,7 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
{ "auto", SPECTRE_V2_CMD_AUTO, false },
};
-@@ -440,7 +443,7 @@ static enum spectre_v2_mitigation_cmd __
+@@ -441,7 +444,7 @@ static enum spectre_v2_mitigation_cmd __
return cmd;
}
@@ -103,32 +93,43 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
static bool __init is_skylake_era(void)
{
if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL &&
-@@ -474,19 +477,34 @@ static void __init spectre_v2_select_mit
+@@ -475,6 +478,20 @@ static void __init spectre_v2_select_mit
case SPECTRE_V2_CMD_NONE:
return;
-- case SPECTRE_V2_CMD_FORCE:
-- case SPECTRE_V2_CMD_AUTO:
-- if (IS_ENABLED(CONFIG_RETPOLINE))
-- goto retpoline_auto;
-- break;
- case SPECTRE_V2_CMD_RETPOLINE_AMD:
- if (IS_ENABLED(CONFIG_RETPOLINE))
- goto retpoline_amd;
- break;
-+
- case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
- if (IS_ENABLED(CONFIG_RETPOLINE))
- goto retpoline_generic;
- break;
++ case SPECTRE_V2_CMD_RETPOLINE_AMD:
++ if (IS_ENABLED(CONFIG_RETPOLINE))
++ goto retpoline_amd;
++ break;
++ case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
++ if (IS_ENABLED(CONFIG_RETPOLINE))
++ goto retpoline_generic;
++ break;
+
+ case SPECTRE_V2_CMD_IBRS:
+ mode = SPECTRE_V2_IBRS;
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS);
-+ goto enabled;
++ goto specv2_set_mode;
++
+ case SPECTRE_V2_CMD_FORCE:
+ case SPECTRE_V2_CMD_AUTO:
+ if (boot_cpu_has(X86_FEATURE_IBRS_ENHANCED)) {
+@@ -484,17 +501,18 @@ static void __init spectre_v2_select_mit
+ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base);
+ goto specv2_set_mode;
+ }
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_auto;
+- break;
+- case SPECTRE_V2_CMD_RETPOLINE_AMD:
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_amd;
+- break;
+- case SPECTRE_V2_CMD_RETPOLINE_GENERIC:
+- if (IS_ENABLED(CONFIG_RETPOLINE))
+- goto retpoline_generic;
+- break;
+
-+ case SPECTRE_V2_CMD_AUTO:
-+ case SPECTRE_V2_CMD_FORCE:
+ /*
+ * If we have IBRS support, and either Skylake or !RETPOLINE,
+ * then that's what we do.
@@ -137,20 +138,12 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+ (is_skylake_era() || !retp_compiler())) {
+ mode = SPECTRE_V2_IBRS;
+ setup_force_cpu_cap(X86_FEATURE_USE_IBRS);
-+ goto enabled;
++ goto specv2_set_mode;
+ }
+ /* fall through */
case SPECTRE_V2_CMD_RETPOLINE:
if (IS_ENABLED(CONFIG_RETPOLINE))
goto retpoline_auto;
-@@ -513,6 +531,7 @@ retpoline_auto:
- setup_force_cpu_cap(X86_FEATURE_RETPOLINE);
- }
-
-+ enabled:
- spectre_v2_enabled = mode;
- pr_info("%s\n", spectre_v2_strings[mode]);
-
--- a/arch/x86/lib/Makefile
+++ b/arch/x86/lib/Makefile
@@ -25,7 +25,7 @@ lib-y += memcpy_$(BITS).o
@@ -180,3 +173,13 @@ Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+
+#endif /* CONFIG_RETPOLINE */
+
+--- a/Documentation/admin-guide/kernel-parameters.txt
++++ b/Documentation/admin-guide/kernel-parameters.txt
+@@ -3980,6 +3980,7 @@
+ retpoline - replace indirect branches
+ retpoline,generic - google's original retpoline
+ retpoline,amd - AMD-specific minimal thunk
++ ibrs - Intel/AMD microcode feature
+
+ Not specifying this option is equivalent to
+ spectre_v2=auto.
diff --git a/patches.suse/0002-Btrfs-fix-assertion-on-fsync-of-regular-file-when-us.patch b/patches.suse/0002-Btrfs-fix-assertion-on-fsync-of-regular-file-when-us.patch
new file mode 100644
index 0000000000..1b59b052d5
--- /dev/null
+++ b/patches.suse/0002-Btrfs-fix-assertion-on-fsync-of-regular-file-when-us.patch
@@ -0,0 +1,61 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 15 Oct 2018 09:51:00 +0100
+Patch-mainline: 4.20-rc1
+Git-commit: 7ed586d0a8241e81d58c656c5b315f781fa6fc97
+Subject: [PATCH] Btrfs: fix assertion on fsync of regular file when using
+ no-holes feature
+References: bsc#1118137
+
+When using the NO_HOLES feature and logging a regular file, we were
+expecting that if we find an inline extent, that either its size in RAM
+(uncompressed and unenconded) matches the size of the file or if it does
+not, that it matches the sector size and it represents compressed data.
+This assertion does not cover a case where the length of the inline extent
+is smaller than the sector size and also smaller the file's size, such
+case is possible through fallocate. Example:
+
+ $ mkfs.btrfs -f -O no-holes /dev/sdb
+ $ mount /dev/sdb /mnt
+
+ $ xfs_io -f -c "pwrite -S 0xb60 0 21" /mnt/foobar
+ $ xfs_io -c "falloc 40 40" /mnt/foobar
+ $ xfs_io -c "fsync" /mnt/foobar
+
+In the above example we trigger the assertion because the inline extent's
+length is 21 bytes while the file size is 80 bytes. The fallocate() call
+merely updated the file's size and did not touch the existing inline
+extent, as expected.
+
+So fix this by adjusting the assertion so that an inline extent length
+smaller than the file size is valid if the file size is smaller than the
+filesystem's sector size.
+
+A test case for fstests follows soon.
+
+Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com>
+Fixes: a89ca6f24ffe ("Btrfs: fix fsync after truncate when no_holes feature is enabled")
+CC: stable@vger.kernel.org # 4.14+
+Link: https://lore.kernel.org/linux-btrfs/CAE5jQCfRSBC7n4pUTFJcmHh109=gwyT9mFkCOL+NKfzswmR=_Q@mail.gmail.com/
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/tree-log.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index d8928fedf4d9..61ded3c9cc1a 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4827,7 +4827,8 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ ASSERT(len == i_size ||
+ (len == fs_info->sectorsize &&
+ btrfs_file_extent_compression(leaf, extent) !=
+- BTRFS_COMPRESS_NONE));
++ BTRFS_COMPRESS_NONE) ||
++ (len < i_size && i_size < fs_info->sectorsize));
+ return 0;
+ }
+
+--
+2.19.0
+
diff --git a/patches.suse/0003-Btrfs-send-fix-infinite-loop-due-to-directory-rename.patch b/patches.suse/0003-Btrfs-send-fix-infinite-loop-due-to-directory-rename.patch
new file mode 100644
index 0000000000..ef872387f9
--- /dev/null
+++ b/patches.suse/0003-Btrfs-send-fix-infinite-loop-due-to-directory-rename.patch
@@ -0,0 +1,200 @@
+From: Robbie Ko <robbieko@synology.com>
+Date: Wed, 14 Nov 2018 18:32:37 +0000
+Patch-mainline: 4.20-rc5
+Git-commit: a4390aee72713d9e73f1132bcdeb17d72fbbf974
+References: bsc#1118138
+Subject: [PATCH] Btrfs: send, fix infinite loop due to directory rename
+ dependencies
+
+When doing an incremental send, due to the need of delaying directory move
+(rename) operations we can end up in infinite loop at
+apply_children_dir_moves().
+
+An example scenario that triggers this problem is described below, where
+directory names correspond to the numbers of their respective inodes.
+
+Parent snapshot:
+
+ .
+ |--- 261/
+ |--- 271/
+ |--- 266/
+ |--- 259/
+ |--- 260/
+ | |--- 267
+ |
+ |--- 264/
+ | |--- 258/
+ | |--- 257/
+ |
+ |--- 265/
+ |--- 268/
+ |--- 269/
+ | |--- 262/
+ |
+ |--- 270/
+ |--- 272/
+ | |--- 263/
+ | |--- 275/
+ |
+ |--- 274/
+ |--- 273/
+
+Send snapshot:
+
+ .
+ |-- 275/
+ |-- 274/
+ |-- 273/
+ |-- 262/
+ |-- 269/
+ |-- 258/
+ |-- 271/
+ |-- 268/
+ |-- 267/
+ |-- 270/
+ |-- 259/
+ | |-- 265/
+ |
+ |-- 272/
+ |-- 257/
+ |-- 260/
+ |-- 264/
+ |-- 263/
+ |-- 261/
+ |-- 266/
+
+When processing inode 257 we delay its move (rename) operation because its
+new parent in the send snapshot, inode 272, was not yet processed. Then
+when processing inode 272, we delay the move operation for that inode
+because inode 274 is its ancestor in the send snapshot. Finally we delay
+the move operation for inode 274 when processing it because inode 275 is
+its new parent in the send snapshot and was not yet moved.
+
+When finishing processing inode 275, we start to do the move operations
+that were previously delayed (at apply_children_dir_moves()), resulting in
+the following iterations:
+
+1) We issue the move operation for inode 274;
+
+2) Because inode 262 depended on the move operation of inode 274 (it was
+ delayed because 274 is its ancestor in the send snapshot), we issue the
+ move operation for inode 262;
+
+3) We issue the move operation for inode 272, because it was delayed by
+ inode 274 too (ancestor of 272 in the send snapshot);
+
+4) We issue the move operation for inode 269 (it was delayed by 262);
+
+5) We issue the move operation for inode 257 (it was delayed by 272);
+
+6) We issue the move operation for inode 260 (it was delayed by 272);
+
+7) We issue the move operation for inode 258 (it was delayed by 269);
+
+8) We issue the move operation for inode 264 (it was delayed by 257);
+
+9) We issue the move operation for inode 271 (it was delayed by 258);
+
+10) We issue the move operation for inode 263 (it was delayed by 264);
+
+11) We issue the move operation for inode 268 (it was delayed by 271);
+
+12) We verify if we can issue the move operation for inode 270 (it was
+ delayed by 271). We detect a path loop in the current state, because
+ inode 267 needs to be moved first before we can issue the move
+ operation for inode 270. So we delay again the move operation for
+ inode 270, this time we will attempt to do it after inode 267 is
+ moved;
+
+13) We issue the move operation for inode 261 (it was delayed by 263);
+
+14) We verify if we can issue the move operation for inode 266 (it was
+ delayed by 263). We detect a path loop in the current state, because
+ inode 270 needs to be moved first before we can issue the move
+ operation for inode 266. So we delay again the move operation for
+ inode 266, this time we will attempt to do it after inode 270 is
+ moved (its move operation was delayed in step 12);
+
+15) We issue the move operation for inode 267 (it was delayed by 268);
+
+16) We verify if we can issue the move operation for inode 266 (it was
+ delayed by 270). We detect a path loop in the current state, because
+ inode 270 needs to be moved first before we can issue the move
+ operation for inode 266. So we delay again the move operation for
+ inode 266, this time we will attempt to do it after inode 270 is
+ moved (its move operation was delayed in step 12). So here we added
+ again the same delayed move operation that we added in step 14;
+
+17) We attempt again to see if we can issue the move operation for inode
+ 266, and as in step 16, we realize we can not due to a path loop in
+ the current state due to a dependency on inode 270. Again we delay
+ inode's 266 rename to happen after inode's 270 move operation, adding
+ the same dependency to the empty stack that we did in steps 14 and 16.
+ The next iteration will pick the same move dependency on the stack
+ (the only entry) and realize again there is still a path loop and then
+ again the same dependency to the stack, over and over, resulting in
+ an infinite loop.
+
+So fix this by preventing adding the same move dependency entries to the
+stack by removing each pending move record from the red black tree of
+pending moves. This way the next call to get_pending_dir_moves() will
+not return anything for the current parent inode.
+
+A test case for fstests, with this reproducer, follows soon.
+
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+[Wrote changelog with example and more clear explanation]
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/send.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index 50a22402083a..b1eba0274983 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -3367,7 +3367,8 @@ static void free_pending_move(struct send_ctx *sctx, struct pending_dir_move *m)
+ kfree(m);
+ }
+
+-static void tail_append_pending_moves(struct pending_dir_move *moves,
++static void tail_append_pending_moves(struct send_ctx *sctx,
++ struct pending_dir_move *moves,
+ struct list_head *stack)
+ {
+ if (list_empty(&moves->list)) {
+@@ -3378,6 +3379,10 @@ static void tail_append_pending_moves(struct pending_dir_move *moves,
+ list_add_tail(&moves->list, stack);
+ list_splice_tail(&list, stack);
+ }
++ if (!RB_EMPTY_NODE(&moves->node)) {
++ rb_erase(&moves->node, &sctx->pending_dir_moves);
++ RB_CLEAR_NODE(&moves->node);
++ }
+ }
+
+ static int apply_children_dir_moves(struct send_ctx *sctx)
+@@ -3392,7 +3397,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
+ return 0;
+
+ INIT_LIST_HEAD(&stack);
+- tail_append_pending_moves(pm, &stack);
++ tail_append_pending_moves(sctx, pm, &stack);
+
+ while (!list_empty(&stack)) {
+ pm = list_first_entry(&stack, struct pending_dir_move, list);
+@@ -3403,7 +3408,7 @@ static int apply_children_dir_moves(struct send_ctx *sctx)
+ goto out;
+ pm = get_pending_dir_moves(sctx, parent_ino);
+ if (pm)
+- tail_append_pending_moves(pm, &stack);
++ tail_append_pending_moves(sctx, pm, &stack);
+ }
+ return 0;
+
+--
+2.19.0
+
diff --git a/patches.suse/0004-Btrfs-fix-cur_offset-in-the-error-case-for-nocow.patch b/patches.suse/0004-Btrfs-fix-cur_offset-in-the-error-case-for-nocow.patch
new file mode 100644
index 0000000000..99c7db5e24
--- /dev/null
+++ b/patches.suse/0004-Btrfs-fix-cur_offset-in-the-error-case-for-nocow.patch
@@ -0,0 +1,79 @@
+From: Robbie Ko <robbieko@synology.com>
+Date: Tue, 30 Oct 2018 18:04:04 +0800
+Patch-mainline: 4.20-rc2
+Git-commit: 506481b20e818db40b6198815904ecd2d6daee64
+Subject: [PATCH] Btrfs: fix cur_offset in the error case for nocow
+References: bsc#1118140
+
+When the cow_file_range fails, the related resources are unlocked
+according to the range [start..end), so the unlock cannot be repeated in
+run_delalloc_nocow.
+
+In some cases (e.g. cur_offset <= end && cow_start != -1), cur_offset is
+not updated correctly, so move the cur_offset update before
+cow_file_range.
+
+ kernel BUG at mm/page-writeback.c:2663!
+ Internal error: Oops - BUG: 0 [#1] SMP
+ CPU: 3 PID: 31525 Comm: kworker/u8:7 Tainted: P O
+ Hardware name: Realtek_RTD1296 (DT)
+ Workqueue: writeback wb_workfn (flush-btrfs-1)
+ task: ffffffc076db3380 ti: ffffffc02e9ac000 task.ti: ffffffc02e9ac000
+ PC is at clear_page_dirty_for_io+0x1bc/0x1e8
+ LR is at clear_page_dirty_for_io+0x14/0x1e8
+ pc : [<ffffffc00033c91c>] lr : [<ffffffc00033c774>] pstate: 40000145
+ sp : ffffffc02e9af4f0
+ Process kworker/u8:7 (pid: 31525, stack limit = 0xffffffc02e9ac020)
+ Call trace:
+ [<ffffffc00033c91c>] clear_page_dirty_for_io+0x1bc/0x1e8
+ [<ffffffbffc514674>] extent_clear_unlock_delalloc+0x1e4/0x210 [btrfs]
+ [<ffffffbffc4fb168>] run_delalloc_nocow+0x3b8/0x948 [btrfs]
+ [<ffffffbffc4fb948>] run_delalloc_range+0x250/0x3a8 [btrfs]
+ [<ffffffbffc514c0c>] writepage_delalloc.isra.21+0xbc/0x1d8 [btrfs]
+ [<ffffffbffc516048>] __extent_writepage+0xe8/0x248 [btrfs]
+ [<ffffffbffc51630c>] extent_write_cache_pages.isra.17+0x164/0x378 [btrfs]
+ [<ffffffbffc5185a8>] extent_writepages+0x48/0x68 [btrfs]
+ [<ffffffbffc4f5828>] btrfs_writepages+0x20/0x30 [btrfs]
+ [<ffffffc00033d758>] do_writepages+0x30/0x88
+ [<ffffffc0003ba0f4>] __writeback_single_inode+0x34/0x198
+ [<ffffffc0003ba6c4>] writeback_sb_inodes+0x184/0x3c0
+ [<ffffffc0003ba96c>] __writeback_inodes_wb+0x6c/0xc0
+ [<ffffffc0003bac20>] wb_writeback+0x1b8/0x1c0
+ [<ffffffc0003bb0f0>] wb_workfn+0x150/0x250
+ [<ffffffc0002b0014>] process_one_work+0x1dc/0x388
+ [<ffffffc0002b02f0>] worker_thread+0x130/0x500
+ [<ffffffc0002b6344>] kthread+0x10c/0x110
+ [<ffffffc000284590>] ret_from_fork+0x10/0x40
+ Code: d503201f a9025bb5 a90363b7 f90023b9 (d4210000)
+
+CC: stable@vger.kernel.org # 4.4+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Robbie Ko <robbieko@synology.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+---
+ fs/btrfs/inode.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 2c68a8193501..357fe75589a9 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1543,12 +1543,11 @@ static noinline int run_delalloc_nocow(struct inode *inode,
+ }
+ btrfs_release_path(path);
+
+- if (cur_offset <= end && cow_start == (u64)-1) {
++ if (cur_offset <= end && cow_start == (u64)-1)
+ cow_start = cur_offset;
+- cur_offset = end;
+- }
+
+ if (cow_start != (u64)-1) {
++ cur_offset = end;
+ ret = cow_file_range(inode, locked_page, cow_start, end, end,
+ page_started, nr_written, 1, NULL);
+ if (ret)
+--
+2.19.0
+
diff --git a/scripts/git_sort/README.md b/scripts/git_sort/README.md
index ce349495c7..362254b5fa 100644
--- a/scripts/git_sort/README.md
+++ b/scripts/git_sort/README.md
@@ -270,6 +270,17 @@ conflict can be solved automatically using the git mergetool interface with
the script merge_tool.py. Please see the header of that file for installation
instructions.
+When using the merge tool, the LINUX_GIT reference repository must fetch from
+the repositories which are the upstream source of patches which were added in
+the remote branch of the merge (the `<commit>` argument to `git merge`) or
+which are in different subsystem maintainer sections between the local and
+remote revisions. A simple way to satisfy that condition is to fetch from all
+remotes configured for git-sort before doing a merge resolution. The script
+`scripts/git_sort/update_clone.py` can be used to create or update the
+configuration of a repository so that it contains all of the remotes
+configured for git-sort. Please see the help message of that script for more
+information.
+
As an example, the merge in kernel-source commit da87d04b3b needed conflict
resolution. Let's redo this resolution using merge_tool:
```
diff --git a/scripts/lib/SUSE/MyBS.pm b/scripts/lib/SUSE/MyBS.pm
index 654c788ae1..da42f3d9c7 100644
--- a/scripts/lib/SUSE/MyBS.pm
+++ b/scripts/lib/SUSE/MyBS.pm
@@ -26,7 +26,16 @@ sub new {
}
$self->{url} = URI->new($api_url);
- my $cfgfile = "$ENV{HOME}/.oscrc";
+ my $cfgfile;
+ foreach ("$ENV{HOME}/.oscrc", "$ENV{HOME}/.config/osc/oscrc") {
+ if (-f) {
+ $cfgfile = $_;
+ last;
+ }
+ }
+
+ defined $cfgfile or die "oscrc not found";
+
# replace name: value with name= value that Config::IniFiles can parse
open(my $fh, '<', $cfgfile) or die "$cfgfile: $!\n";
my $data = "";
diff --git a/scripts/log2 b/scripts/log2
index 21b681010f..40c9e21ac3 100755
--- a/scripts/log2
+++ b/scripts/log2
@@ -298,7 +298,7 @@ splice_series()
commit_single_patches()
{
local saved_index=$(git write-tree) patch series
- local file added=() modified_aux=() deleted=() no_edit
+ local file added=() modified_aux=() deleted=()
git cat-file blob HEAD:series.conf > "$tmpdir"/old_series
cp series.conf "$tmpdir"/new_series
@@ -375,6 +375,16 @@ fi
"$_libdir"/check-cvs-add || exit 1
+while [ -n "$1" ] ; do
+ case "$1" in
+ --no-edit) no_edit=--no-edit
+ ;;
+ *) echo Unknown argument "$1" >&2
+ ;;
+ esac
+ shift
+done
+
trap 'rm -rf "$tmpdir"' EXIT
tmpdir=$(mktemp -d /tmp/${0##*/}.XXXXXX)
diff --git a/series.conf b/series.conf
index b51f057226..fc7db68228 100644
--- a/series.conf
+++ b/series.conf
@@ -6612,6 +6612,7 @@
patches.suse/btrfs-use-GFP_KERNEL-in-mount-and-remount.patch
patches.suse/btrfs-account-for-pinned-bytes-in-should_alloc_chunk.patch
patches.suse/btrfs-fix-readdir-deadlock-with-pagefault.patch
+ patches.suse/0001-Btrfs-fix-assertion-failure-during-fsync-in-no-holes.patch
patches.suse/btrfs-incremental-send-fix-emission-of-invalid-clone-operations.patch
patches.suse/btrfs-preserve-i_mode-if-_btrfs_set_acl-fails.patch
patches.drivers/svcrdma-Limit-RQ-depth.patch
@@ -17602,6 +17603,7 @@
patches.arch/x86-pti-check-the-return-value-of-pti_user_pagetable_walk_pmd
patches.arch/x86-mm-remove-in_nmi-warning-from-vmalloc_fault
patches.arch/x86-speculation-Protect-against-userspace-userspace-.patch
+ patches.arch/x86-speculation-support-enhanced-ibrs-on-future-cpus.patch
patches.arch/x86-tsc-add-missing-header-to-tsc_msr-c
patches.arch/s390-sles15-15-02-qdio-reset-old-sbal_state-flags.patch
patches.arch/s390-mm-correct-allocate_pgste-proc_handler-callback.patch
@@ -18862,6 +18864,8 @@
patches.fixes/nvdimm-use-namespace-index-data-to-reduce-number-of-label-reads-needed.patch
patches.fixes/libnvdimm-label-fix-sparse-warning.patch
patches.drivers/edac-raise-the-maximum-number-of-memory-controllers.patch
+ patches.drivers/edac-i7core-sb-skx-edac-fix-uncorrected-error-counting.patch
+ patches.drivers/edac-skx_edac-fix-logical-channel-intermediate-decoding.patch
patches.drivers/edac-thunderx-fix-memory-leak-in-thunderx_l2c_threaded_isr.patch
patches.drivers/driver-dma-ioat-Call-del_timer_sync-without-holding-.patch
patches.drivers/PCI-ASPM-Fix-link_state-teardown-on-device-removal.patch
@@ -19049,6 +19053,7 @@
patches.drivers/media-v4l2-tpg-fix-kernel-oops-when-enabling-HFLIP-a.patch
patches.drivers/soc-tegra-pmc-Fix-child-node-lookup.patch
patches.suse/btrfs-fix-null-pointer-dereference-on-compressed-wri.patch
+ patches.suse/0002-Btrfs-fix-assertion-on-fsync-of-regular-file-when-us.patch
patches.suse/btrfs-fix-deadlock-when-writing-out-free-space-cache.patch
patches.suse/0006-Btrfs-fix-use-after-free-during-inode-eviction.patch
patches.suse/0007-Btrfs-fix-use-after-free-when-dumping-free-space.patch
@@ -19135,6 +19140,7 @@
patches.fixes/ext4-release-bs.bh-before-re-using-in-ext4_xattr_blo.patch
patches.fixes/ext4-fix-buffer-leak-in-ext4_xattr_move_to_block-on-.patch
patches.fixes/ext4-fix-buffer-leak-in-__ext4_read_dirblock-on-erro.patch
+ patches.suse/0004-Btrfs-fix-cur_offset-in-the-error-case-for-nocow.patch
patches.suse/0009-Btrfs-fix-deadlock-on-tree-root-leaf-when-finding-fr.patch
patches.suse/0010-Btrfs-fix-infinite-loop-on-inode-eviction-after-dedu.patch
patches.suse/0011-Btrfs-fix-data-corruption-due-to-cloning-of-eof-bloc.patch
@@ -19207,6 +19213,10 @@
patches.drivers/hwmon-raspberrypi-Fix-initial-notify.patch
patches.drivers/hwmon-ina2xx-Fix-current-value-calculation.patch
patches.drivers/hwmon-w83795-temp4_type-has-writable-permission.patch
+ patches.arch/kvm-vmx-re-add-ple_gap-module-parameter
+ patches.arch/kvm-x86-fix-kernel-info-leak-in-kvm_hc_clock_pairing-hypercall
+ patches.fixes/kvm-svm-ensure-an-ibpb-on-all-affected-cpus-when-freeing-a-vmcb.patch
+ patches.suse/0003-Btrfs-send-fix-infinite-loop-due-to-directory-rename.patch
patches.drivers/ALSA-ac97-Fix-incorrect-bit-shift-at-AC97-SPSA-contr.patch
patches.drivers/ALSA-hda-Add-ASRock-N68C-S-UCC-the-power_save-blackl.patch
patches.drivers/ALSA-hda-realtek-fix-headset-mic-detection-for-MSI-M.patch
@@ -19220,10 +19230,10 @@
patches.drivers/ASoC-sun8i-codec-fix-crash-on-module-removal.patch
patches.drivers/ALSA-usb-audio-Add-vendor-and-product-name-for-Dell-.patch
patches.drm/drm-ast-Fix-incorrect-free-on-ioregs.patch
- patches.drm/drm-dp_mst-Skip-validating-ports-during-destruction-.patch
patches.drm/drm-meson-Enable-fast_io-in-meson_dw_hdmi_regmap_con.patch
patches.drm/drm-meson-Fix-OOB-memory-accesses-in-meson_viu_set_o.patch
patches.drm/drm-meson-add-support-for-1080p25-mode.patch
+ patches.arch/x86-mce-amd-fix-the-thresholding-machinery-initialization-order.patch
patches.drivers/Revert-usb-dwc3-gadget-skip-Set-Clear-Halt-when-inva.patch
patches.drivers/USB-omap_udc-fix-rejection-of-out-transfers-when-DMA.patch
patches.drivers/usb-gadget-u_ether-fix-unsafe-list-iteration.patch
@@ -19232,6 +19242,8 @@
patches.drivers/iio-st_magn-Fix-enable-device-after-trigger.patch
patches.fixes/fscache-fix-race-between-enablement-and-dropping-of-.patch
patches.fixes/ACPI-IORT-Fix-iort_get_platform_device_domain-uninit.patch
+ patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check
+ patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch
# jejb/scsi for-next
patches.drivers/scsi-lpfc-Correct-speeds-on-SFP-swap.patch
@@ -19264,6 +19276,7 @@
patches.suse/tty-ldsem-Convert-to-regular-lockdep-annotations.patch
patches.suse/tty-ldsem-Add-lockdep-asserts-for-ldisc_sem.patch
patches.suse/tty-ldsem-Decrement-wait_readers-on-timeouted-down_r.patch
+ patches.drivers/net-net-ibmvnic-Fix-RTNL-deadlock-during-device-reset.patch
########################################################
# end of sorted patches
@@ -19651,13 +19664,6 @@
patches.drm/drm-nouveau-Don-t-disable-polling-in-fallback-mode.patch
patches.suse/drm-i915-CFL-NVMe-breakage-workaround.patch
- patches.drm/drm-Add-DRM-client-cap-for-aspect-ratio
- patches.drm/drm-Handle-aspect-ratio-info-in-legacy-modeset-path
- patches.drm/drm-Expose-modes-with-aspect-ratio-only-if-requested
- patches.drm/drm-Add-aspect-ratio-parsing-in-DRM-layer
- patches.drm/drm-Add-and-handle-new-aspect-ratios-in-DRM-layer
-
- ########################################################
# Out-of-tree networking
########################################################
patches.fixes/irda-Only-insert-new-objects-into-the-global-databas.patch
@@ -19684,6 +19690,7 @@
##########################################################
# Sound
##########################################################
+ patches.drivers/ALSA-usb-audio-Fix-UAF-decrement-if-card-has-no-live.patch
patches.drivers/ASoC-cx2072x-Add-DT-bingings-documentation-for-CX207
patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072