Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-03-20 07:11:09 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-03-20 07:11:09 +0100
commit28a56122d44970894e4fe4a5777f733b39c076a0 (patch)
treefb5de76954d91a151d2ddfe0b14b0745a7fb24d8
parent839e98b0a8e9e94e66d924d39386b35aa8d7299b (diff)
parenteffc051d4d76d18c1a82b5d1db2ad261300416d5 (diff)
Merge branch 'SLE12-SP4' into SLE12-SP4-AZURE
-rw-r--r--blacklist.conf2
-rw-r--r--patches.drivers/IB-core-Destroy-QP-if-XRC-QP-fails.patch108
-rw-r--r--patches.drivers/IB-core-Fix-potential-memory-leak-while-creating-MAD.patch47
-rw-r--r--patches.drivers/IB-core-Unregister-notifier-before-freeing-MAD-secur.patch34
-rw-r--r--patches.drivers/IB-hfi1-Close-race-condition-on-user-context-disable.patch139
-rw-r--r--patches.drivers/IB-mlx5-Unmap-DMA-addr-from-HCA-before-IOMMU.patch84
-rw-r--r--patches.drivers/RDMA-vmw_pvrdma-Support-upto-64-bit-PFNs.patch90
-rw-r--r--patches.drivers/VMCI-Support-upto-64-bit-PPNs.patch312
-rw-r--r--patches.drivers/bnxt_en-Fix-typo-in-firmware-message-timeout-logic.patch32
-rw-r--r--patches.drivers/bnxt_en-Wait-longer-for-the-firmware-message-respons.patch43
-rw-r--r--patches.drivers/bpf-verifier-fix-verifier-instability.patch74
-rw-r--r--patches.drivers/net-Don-t-default-Cavium-PTP-driver-to-y.patch29
-rw-r--r--patches.drivers/net-ena-fix-race-between-link-up-and-device-initaliz.patch53
-rw-r--r--patches.drivers/net-mlx5e-RX-Fix-wrong-early-return-in-receive-queue.patch60
-rw-r--r--patches.drm/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch35
-rw-r--r--patches.drm/0002-drm-etnaviv-potential-NULL-dereference.patch37
-rw-r--r--patches.fixes/0001-fbdev-chipsfb-remove-set-but-not-used-variable-size.patch50
-rw-r--r--patches.fixes/0001-net-aquantia-fixed-instack-structure-overflow.patch48
-rw-r--r--patches.fixes/0001-net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracef.patch32
-rw-r--r--patches.fixes/0001-net-mlx4_core-Fix-locking-in-SRIOV-mode-when-switchi.patch70
-rw-r--r--patches.fixes/0001-net-mlx4_core-Fix-qp-mtt-size-calculation.patch65
-rw-r--r--patches.fixes/0001-net-mlx4_core-Fix-reset-flow-when-in-command-polling.patch82
-rw-r--r--patches.fixes/0001-net-mlx5e-IPoIB-Fix-RX-checksum-statistics-update.patch43
-rw-r--r--patches.fixes/0001-nfp-bpf-fix-ALU32-high-bits-clearance-bug.patch90
-rw-r--r--patches.fixes/0001-pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch43
-rw-r--r--patches.fixes/0001-vxlan-Fix-GRO-cells-race-condition-between-receive-a.patch50
-rw-r--r--patches.fixes/0001-vxlan-test-dev-flags-IFF_UP-before-calling-gro_cells.patch64
-rw-r--r--patches.fixes/9p-net-fix-memory-leak-in-p9_client_create.patch39
-rw-r--r--patches.fixes/9p-use-inode-i_lock-to-protect-i_size_write-under-32.patch331
-rw-r--r--patches.fixes/fsdcache-Fix-incorrect-nr_dentry_unused-accounting-in-shrink_dcache_sb.patch48
-rw-r--r--patches.fixes/fsdevpts-always-delete-dcache-dentry-s-in-dput.patch78
-rw-r--r--patches.fixes/libnvdimm-label-clear-updating-flag-after-label-set-update.patch97
-rw-r--r--patches.fixes/libnvdimm-pmem-honor-force_raw-for-legacy-pmem-regions.patch46
-rw-r--r--patches.fixes/nfit-acpi_nfit_ctl-check-out_obj-type-in-the-right-place.patch52
-rw-r--r--patches.fixes/nvme-flush-namespace-scanning-work-just-before-remov.patch54
-rw-r--r--patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch3
-rw-r--r--patches.fixes/perf-x86-intel-fix-memory-corruption.patch5
-rw-r--r--patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch5
-rw-r--r--patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch5
-rw-r--r--patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch5
-rw-r--r--patches.fixes/procsysctl-dont-return-ENOMEM-on-lookup-when-a-table-is-unregistering.patch81
-rw-r--r--patches.fixes/splice-dont-merge-into-linked-buffers.patch113
-rw-r--r--patches.suse/Btrfs-fix-corruption-reading-shared-and-compressed-e.patch120
-rw-r--r--patches.suse/msft-hv-1847-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch (renamed from patches.suse/suse-hv-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch)7
-rw-r--r--patches.suse/msft-hv-1848-iommu-hyper-v-Add-Hyper-V-stub-IOMMU-driver.patch (renamed from patches.suse/suse-hv-HYPERV-IOMMU-Add-Hyper-V-stub-IOMMU-driver.patch)14
-rw-r--r--patches.suse/sched-do-not-re-read-h_load_next-during-hierarchical-load-calculation.patch77
-rw-r--r--patches.suse/tracing-do-not-free-iter-trace-in-fail-path-of-tracing_open_pipe.patch39
-rw-r--r--patches.suse/tracing-use-strncpy-instead-of-memcpy-for-string-keys-in-hist-triggers.patch73
-rw-r--r--series.conf56
49 files changed, 3138 insertions, 26 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 5b66dac21a..424c48c1a6 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -998,3 +998,5 @@ a3238924a820c1d7c977b632b769f3b5690cba09 # file not present: arch/arm/boot/dts/e
0192e6535ebe9af68614198ced4fd6d37b778ebf # Breaks build
24c41220659ecc5576c34c6f23537f8d3949fb05 # Cleanup, not needed in SLES
826c1362e79abcd36f99092acd083b5a2d576676 # only needed with 09abb5e3e5e50
+5bc373ff254002b5ce1b7e7f37f8ed7074e45d2a # Cleanup, not needed in SLES
+35f12f0f5c3bbd60caba89351f45c8eef8ffd423 # 75075168ae4546f7ae4de793444a6008620de7b0 already addresses end byte
diff --git a/patches.drivers/IB-core-Destroy-QP-if-XRC-QP-fails.patch b/patches.drivers/IB-core-Destroy-QP-if-XRC-QP-fails.patch
new file mode 100644
index 0000000000..aa676c8351
--- /dev/null
+++ b/patches.drivers/IB-core-Destroy-QP-if-XRC-QP-fails.patch
@@ -0,0 +1,108 @@
+From: Yuval Avnery <yuvalav@mellanox.com>
+Date: Tue, 22 Jan 2019 09:02:05 +0200
+Subject: IB/core: Destroy QP if XRC QP fails
+Patch-mainline: v5.1-rc1
+Git-commit: 535005ca8e5e71918d64074032f4b9d4fef8981e
+References: bsc#1046306 FATE#322942
+
+The open-coded variant missed destroy of SELinux created QP, reuse already
+existing ib_detroy_qp() call and use this opportunity to clean
+ib_create_qp() from double prints and unclear exit paths.
+
+Reported-by: Parav Pandit <parav@mellanox.com>
+Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
+Signed-off-by: Yuval Avnery <yuvalav@mellanox.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/core/verbs.c | 41 +++++++++++++++++++++++-----------------
+ 1 file changed, 24 insertions(+), 17 deletions(-)
+
+--- a/drivers/infiniband/core/verbs.c
++++ b/drivers/infiniband/core/verbs.c
+@@ -766,8 +766,8 @@ struct ib_qp *ib_open_qp(struct ib_xrcd
+ }
+ EXPORT_SYMBOL(ib_open_qp);
+
+-static struct ib_qp *ib_create_xrc_qp(struct ib_qp *qp,
+- struct ib_qp_init_attr *qp_init_attr)
++static struct ib_qp *create_xrc_qp(struct ib_qp *qp,
++ struct ib_qp_init_attr *qp_init_attr)
+ {
+ struct ib_qp *real_qp = qp;
+
+@@ -782,10 +782,10 @@ static struct ib_qp *ib_create_xrc_qp(st
+
+ qp = __ib_open_qp(real_qp, qp_init_attr->event_handler,
+ qp_init_attr->qp_context);
+- if (!IS_ERR(qp))
+- __ib_insert_xrcd_qp(qp_init_attr->xrcd, real_qp);
+- else
+- real_qp->device->destroy_qp(real_qp);
++ if (IS_ERR(qp))
++ return qp;
++
++ __ib_insert_xrcd_qp(qp_init_attr->xrcd, real_qp);
+ return qp;
+ }
+
+@@ -816,10 +816,8 @@ struct ib_qp *ib_create_qp(struct ib_pd
+ return qp;
+
+ ret = ib_create_qp_security(qp, device);
+- if (ret) {
+- ib_destroy_qp(qp);
+- return ERR_PTR(ret);
+- }
++ if (ret)
++ goto err;
+
+ qp->device = device;
+ qp->real_qp = qp;
+@@ -834,8 +832,15 @@ struct ib_qp *ib_create_qp(struct ib_pd
+ INIT_LIST_HEAD(&qp->sig_mrs);
+ qp->port = 0;
+
+- if (qp_init_attr->qp_type == IB_QPT_XRC_TGT)
+- return ib_create_xrc_qp(qp, qp_init_attr);
++ if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) {
++ struct ib_qp *xrc_qp = create_xrc_qp(qp, qp_init_attr);
++
++ if (IS_ERR(xrc_qp)) {
++ ret = PTR_ERR(xrc_qp);
++ goto err;
++ }
++ return xrc_qp;
++ }
+
+ qp->event_handler = qp_init_attr->event_handler;
+ qp->qp_context = qp_init_attr->qp_context;
+@@ -863,11 +868,8 @@ struct ib_qp *ib_create_qp(struct ib_pd
+
+ if (qp_init_attr->cap.max_rdma_ctxs) {
+ ret = rdma_rw_init_mrs(qp, qp_init_attr);
+- if (ret) {
+- pr_err("failed to init MR pool ret= %d\n", ret);
+- ib_destroy_qp(qp);
+- return ERR_PTR(ret);
+- }
++ if (ret)
++ goto err;
+ }
+
+ /*
+@@ -880,6 +882,11 @@ struct ib_qp *ib_create_qp(struct ib_pd
+ device->attrs.max_sge_rd);
+
+ return qp;
++
++err:
++ ib_destroy_qp(qp);
++ return ERR_PTR(ret);
++
+ }
+ EXPORT_SYMBOL(ib_create_qp);
+
diff --git a/patches.drivers/IB-core-Fix-potential-memory-leak-while-creating-MAD.patch b/patches.drivers/IB-core-Fix-potential-memory-leak-while-creating-MAD.patch
new file mode 100644
index 0000000000..220dcc80f8
--- /dev/null
+++ b/patches.drivers/IB-core-Fix-potential-memory-leak-while-creating-MAD.patch
@@ -0,0 +1,47 @@
+From: Daniel Jurgens <danielj@mellanox.com>
+Date: Sat, 2 Feb 2019 11:09:43 +0200
+Subject: IB/core: Fix potential memory leak while creating MAD agents
+Patch-mainline: v5.1-rc1
+Git-commit: 6e88e672b69f0e627acdae74a527b730ea224b6b
+References: bsc#1046306 FATE#322942
+
+If the MAD agents isn't allowed to manage the subnet, or fails to register
+for the LSM notifier, the security context is leaked. Free the context in
+these cases.
+
+Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams")
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Reported-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/core/security.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -715,16 +715,20 @@ int ib_mad_agent_security_setup(struct i
+ agent->device->name,
+ agent->port_num);
+ if (ret)
+- return ret;
++ goto free_security;
+
+ agent->lsm_nb.notifier_call = ib_mad_agent_security_change;
+ ret = register_lsm_notifier(&agent->lsm_nb);
+ if (ret)
+- return ret;
++ goto free_security;
+
+ agent->smp_allowed = true;
+ agent->lsm_nb_reg = true;
+ return 0;
++
++free_security:
++ security_ib_free_security(agent->security);
++ return ret;
+ }
+
+ void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent)
diff --git a/patches.drivers/IB-core-Unregister-notifier-before-freeing-MAD-secur.patch b/patches.drivers/IB-core-Unregister-notifier-before-freeing-MAD-secur.patch
new file mode 100644
index 0000000000..ab291740d6
--- /dev/null
+++ b/patches.drivers/IB-core-Unregister-notifier-before-freeing-MAD-secur.patch
@@ -0,0 +1,34 @@
+From: Daniel Jurgens <danielj@mellanox.com>
+Date: Sat, 2 Feb 2019 11:09:42 +0200
+Subject: IB/core: Unregister notifier before freeing MAD security
+Patch-mainline: v5.1-rc1
+Git-commit: d60667fc398ed34b3c7456b020481c55c760e503
+References: bsc#1046306 FATE#322942
+
+If the notifier runs after the security context is freed an access of
+freed memory can occur.
+
+Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams")
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Parav Pandit <parav@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/core/security.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/core/security.c
++++ b/drivers/infiniband/core/security.c
+@@ -732,9 +732,10 @@ void ib_mad_agent_security_cleanup(struc
+ if (!rdma_protocol_ib(agent->device, agent->port_num))
+ return;
+
+- security_ib_free_security(agent->security);
+ if (agent->lsm_nb_reg)
+ unregister_lsm_notifier(&agent->lsm_nb);
++
++ security_ib_free_security(agent->security);
+ }
+
+ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
diff --git a/patches.drivers/IB-hfi1-Close-race-condition-on-user-context-disable.patch b/patches.drivers/IB-hfi1-Close-race-condition-on-user-context-disable.patch
new file mode 100644
index 0000000000..844089de42
--- /dev/null
+++ b/patches.drivers/IB-hfi1-Close-race-condition-on-user-context-disable.patch
@@ -0,0 +1,139 @@
+From: "Michael J. Ruhl" <michael.j.ruhl@intel.com>
+Date: Tue, 26 Feb 2019 08:45:35 -0800
+Subject: IB/hfi1: Close race condition on user context disable and close
+Patch-mainline: v5.1-rc1
+Git-commit: bc5add09764c123f58942a37c8335247e683d234
+References: bsc#1060463 FATE#323043
+
+When disabling and removing a receive context, it is possible for an
+asynchronous event (i.e IRQ) to occur. Because of this, there is a race
+between cleaning up the context, and the context being used by the
+asynchronous event.
+
+cpu 0 (context cleanup)
+ rc->ref_count-- (ref_count == 0)
+ hfi1_rcd_free()
+cpu 1 (IRQ (with rcd index))
+ rcd_get_by_index()
+ lock
+ ref_count+++ <-- reference count race (WARNING)
+ return rcd
+ unlock
+cpu 0
+ hfi1_free_ctxtdata() <-- incorrect free location
+ lock
+ remove rcd from array
+ unlock
+ free rcd
+
+This race will cause the following WARNING trace:
+
+WARNING: CPU: 0 PID: 175027 at include/linux/kref.h:52 hfi1_rcd_get_by_index+0x84/0xa0 [hfi1]
+CPU: 0 PID: 175027 Comm: IMB-MPI1 Kdump: loaded Tainted: G OE ------------ 3.10.0-957.el7.x86_64 #1
+Hardware name: Intel Corporation S2600KP/S2600KP, BIOS SE5C610.86B.11.01.0076.C4.111920150602 11/19/2015
+Call Trace:
+ dump_stack+0x19/0x1b
+ __warn+0xd8/0x100
+ warn_slowpath_null+0x1d/0x20
+ hfi1_rcd_get_by_index+0x84/0xa0 [hfi1]
+ is_rcv_urgent_int+0x24/0x90 [hfi1]
+ general_interrupt+0x1b6/0x210 [hfi1]
+ __handle_irq_event_percpu+0x44/0x1c0
+ handle_irq_event_percpu+0x32/0x80
+ handle_irq_event+0x3c/0x60
+ handle_edge_irq+0x7f/0x150
+ handle_irq+0xe4/0x1a0
+ do_IRQ+0x4d/0xf0
+ common_interrupt+0x162/0x162
+
+The race can also lead to a use after free which could be similar to:
+
+general protection fault: 0000 1 SMP
+CPU: 71 PID: 177147 Comm: IMB-MPI1 Kdump: loaded Tainted: G W OE ------------ 3.10.0-957.el7.x86_64 #1
+Hardware name: Intel Corporation S2600KP/S2600KP, BIOS SE5C610.86B.11.01.0076.C4.111920150602 11/19/2015
+task: ffff9962a8098000 ti: ffff99717a508000 task.ti: ffff99717a508000 __kmalloc+0x94/0x230
+Call Trace:
+ ? hfi1_user_sdma_process_request+0x9c8/0x1250 [hfi1]
+ hfi1_user_sdma_process_request+0x9c8/0x1250 [hfi1]
+ hfi1_aio_write+0xba/0x110 [hfi1]
+ do_sync_readv_writev+0x7b/0xd0
+ do_readv_writev+0xce/0x260
+ ? handle_mm_fault+0x39d/0x9b0
+ ? pick_next_task_fair+0x5f/0x1b0
+ ? sched_clock_cpu+0x85/0xc0
+ ? __schedule+0x13a/0x890
+ vfs_writev+0x35/0x60
+ SyS_writev+0x7f/0x110
+ system_call_fastpath+0x22/0x27
+
+Use the appropriate kref API to verify access.
+
+Reorder context cleanup to ensure context removal before cleanup occurs
+correctly.
+
+Cc: stable@vger.kernel.org # v4.14.0+
+Fixes: f683c80ca68e ("IB/hfi1: Resolve kernel panics by reference counting receive contexts")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/hfi1/hfi.h | 2 +-
+ drivers/infiniband/hw/hfi1/init.c | 14 +++++++++-----
+ 2 files changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -1411,7 +1411,7 @@ void hfi1_init_pportdata(struct pci_dev
+ struct hfi1_devdata *dd, u8 hw_pidx, u8 port);
+ void hfi1_free_ctxtdata(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd);
+ int hfi1_rcd_put(struct hfi1_ctxtdata *rcd);
+-void hfi1_rcd_get(struct hfi1_ctxtdata *rcd);
++int hfi1_rcd_get(struct hfi1_ctxtdata *rcd);
+ struct hfi1_ctxtdata *hfi1_rcd_get_by_index_safe(struct hfi1_devdata *dd,
+ u16 ctxt);
+ struct hfi1_ctxtdata *hfi1_rcd_get_by_index(struct hfi1_devdata *dd, u16 ctxt);
+--- a/drivers/infiniband/hw/hfi1/init.c
++++ b/drivers/infiniband/hw/hfi1/init.c
+@@ -213,12 +213,12 @@ static void hfi1_rcd_free(struct kref *k
+ struct hfi1_ctxtdata *rcd =
+ container_of(kref, struct hfi1_ctxtdata, kref);
+
+- hfi1_free_ctxtdata(rcd->dd, rcd);
+-
+ spin_lock_irqsave(&rcd->dd->uctxt_lock, flags);
+ rcd->dd->rcd[rcd->ctxt] = NULL;
+ spin_unlock_irqrestore(&rcd->dd->uctxt_lock, flags);
+
++ hfi1_free_ctxtdata(rcd->dd, rcd);
++
+ kfree(rcd);
+ }
+
+@@ -241,10 +241,13 @@ int hfi1_rcd_put(struct hfi1_ctxtdata *r
+ * @rcd: pointer to an initialized rcd data structure
+ *
+ * Use this to get a reference after the init.
++ *
++ * Return : reflect kref_get_unless_zero(), which returns non-zero on
++ * increment, otherwise 0.
+ */
+-void hfi1_rcd_get(struct hfi1_ctxtdata *rcd)
++int hfi1_rcd_get(struct hfi1_ctxtdata *rcd)
+ {
+- kref_get(&rcd->kref);
++ return kref_get_unless_zero(&rcd->kref);
+ }
+
+ /**
+@@ -324,7 +327,8 @@ struct hfi1_ctxtdata *hfi1_rcd_get_by_in
+ spin_lock_irqsave(&dd->uctxt_lock, flags);
+ if (dd->rcd[ctxt]) {
+ rcd = dd->rcd[ctxt];
+- hfi1_rcd_get(rcd);
++ if (!hfi1_rcd_get(rcd))
++ rcd = NULL;
+ }
+ spin_unlock_irqrestore(&dd->uctxt_lock, flags);
+
diff --git a/patches.drivers/IB-mlx5-Unmap-DMA-addr-from-HCA-before-IOMMU.patch b/patches.drivers/IB-mlx5-Unmap-DMA-addr-from-HCA-before-IOMMU.patch
new file mode 100644
index 0000000000..efdaf44c64
--- /dev/null
+++ b/patches.drivers/IB-mlx5-Unmap-DMA-addr-from-HCA-before-IOMMU.patch
@@ -0,0 +1,84 @@
+From: Valentine Fatiev <Valentinef@mellanox.com>
+Date: Wed, 10 Oct 2018 09:56:25 +0300
+Subject: IB/mlx5: Unmap DMA addr from HCA before IOMMU
+Patch-mainline: v4.19-rc8
+Git-commit: dd9a403495704fc80fb9f399003013ef2be2ee23
+References: bsc#1046305 FATE#322943
+
+The function that puts back the MR in cache also removes the DMA address
+from the HCA. Therefore we need to call this function before we remove
+the DMA mapping from MMU. Otherwise the HCA may access a memory that
+is no longer DMA mapped.
+
+Call trace:
+NMI: IOCK error (debug interrupt?) for reason 71 on CPU 0.
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.0-rc6+ #4
+Hardware name: HP ProLiant DL360p Gen8, BIOS P71 08/20/2012
+RIP: 0010:intel_idle+0x73/0x120
+Code: 80 5c 01 00 0f ae 38 0f ae f0 31 d2 65 48 8b 04 25 80 5c 01 00 48 89 d1 0f 60 02
+RSP: 0018:ffffffff9a403e38 EFLAGS: 00000046
+RAX: 0000000000000030 RBX: 0000000000000005 RCX: 0000000000000001
+RDX: 0000000000000000 RSI: ffffffff9a5790c0 RDI: 0000000000000000
+RBP: 0000000000000030 R08: 0000000000000000 R09: 0000000000007cf9
+R10: 000000000000030a R11: 0000000000000018 R12: 0000000000000000
+R13: ffffffff9a5792b8 R14: ffffffff9a5790c0 R15: 0000002b48471e4d
+FS: 0000000000000000(0000) GS:ffff9c6caf400000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 00007f5737185000 CR3: 0000000590c0a002 CR4: 00000000000606f0
+Call Trace:
+ cpuidle_enter_state+0x7e/0x2e0
+ do_idle+0x1ed/0x290
+ cpu_startup_entry+0x6f/0x80
+ start_kernel+0x524/0x544
+ ? set_init_arg+0x55/0x55
+ secondary_startup_64+0xa4/0xb0
+DMAR: DRHD: handling fault status reg 2
+DMAR: [DMA Read] Request device [04:00.0] fault addr b34d2000 [fault reason 06] PTE Read access is not set
+DMAR: [DMA Read] Request device [01:00.2] fault addr bff8b000 [fault reason 06] PTE Read access is not set
+
+Fixes: f3f134f5260a ("RDMA/mlx5: Fix crash while accessing garbage pointer and freed memory")
+Signed-off-by: Valentine Fatiev <valentinef@mellanox.com>
+Reviewed-by: Moni Shoua <monis@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/mr.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -536,6 +536,9 @@ void mlx5_mr_cache_free(struct mlx5_ib_d
+ int shrink = 0;
+ int c;
+
++ if (!mr->allocated_from_cache)
++ return;
++
+ c = order2idx(dev, mr->order);
+ if (c < 0 || c >= MAX_MR_CACHE_ENTRIES) {
+ mlx5_ib_warn(dev, "order %d, cache index %d\n", mr->order, c);
+@@ -1564,18 +1567,19 @@ static int dereg_mr(struct mlx5_ib_dev *
+ umem = NULL;
+ }
+ #endif
+-
+ clean_mr(dev, mr);
+
++ /*
++ * We should unregister the DMA address from the HCA before
++ * remove the DMA mapping.
++ */
++ mlx5_mr_cache_free(dev, mr);
+ if (umem) {
+ ib_umem_release(umem);
+ atomic_sub(npages, &dev->mdev->priv.reg_pages);
+ }
+-
+ if (!mr->allocated_from_cache)
+ kfree(mr);
+- else
+- mlx5_mr_cache_free(dev, mr);
+
+ return 0;
+ }
diff --git a/patches.drivers/RDMA-vmw_pvrdma-Support-upto-64-bit-PFNs.patch b/patches.drivers/RDMA-vmw_pvrdma-Support-upto-64-bit-PFNs.patch
new file mode 100644
index 0000000000..f18aedfd6b
--- /dev/null
+++ b/patches.drivers/RDMA-vmw_pvrdma-Support-upto-64-bit-PFNs.patch
@@ -0,0 +1,90 @@
+From: Adit Ranadive <aditr@vmware.com>
+Date: Sat, 26 Jan 2019 05:09:36 +0000
+Subject: RDMA/vmw_pvrdma: Support upto 64-bit PFNs
+Patch-mainline: v5.1-rc1
+Git-commit: 8aa04ad3b39396e315b23448c56d5465200fa777
+References: bsc#1127285
+
+Update the driver to use the new device capability to report 64-bit UAR
+PFNs.
+
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: Adit Ranadive <aditr@vmware.com>
+Reviewed-by: Vishnu Dasa <vdasa@vmware.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h | 15 ++++++++++-----
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 6 +++++-
+ drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c | 7 ++++++-
+ 3 files changed, 21 insertions(+), 7 deletions(-)
+
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h
+@@ -57,7 +57,8 @@
+
+ #define PVRDMA_ROCEV1_VERSION 17
+ #define PVRDMA_ROCEV2_VERSION 18
+-#define PVRDMA_VERSION PVRDMA_ROCEV2_VERSION
++#define PVRDMA_PPN64_VERSION 19
++#define PVRDMA_VERSION PVRDMA_PPN64_VERSION
+
+ #define PVRDMA_BOARD_ID 1
+ #define PVRDMA_REV_ID 1
+@@ -279,8 +280,10 @@ struct pvrdma_device_shared_region {
+ /* W: Async ring page info. */
+ struct pvrdma_ring_page_info cq_ring_pages;
+ /* W: CQ ring page info. */
+- u32 uar_pfn; /* W: UAR pageframe. */
+- u32 pad2; /* Pad to 8-byte align. */
++ union {
++ u32 uar_pfn; /* W: UAR pageframe. */
++ u64 uar_pfn64; /* W: 64-bit UAR page frame. */
++ };
+ struct pvrdma_device_caps caps; /* R: Device capabilities. */
+ };
+
+@@ -411,8 +414,10 @@ struct pvrdma_cmd_query_pkey_resp {
+
+ struct pvrdma_cmd_create_uc {
+ struct pvrdma_cmd_hdr hdr;
+- u32 pfn; /* UAR page frame number */
+- u8 reserved[4];
++ union {
++ u32 pfn; /* UAR page frame number */
++ u64 pfn64; /* 64-bit UAR page frame number */
++ };
+ };
+
+ struct pvrdma_cmd_create_uc_resp {
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+@@ -898,7 +898,11 @@ static int pvrdma_pci_probe(struct pci_d
+ PVRDMA_GOS_BITS_64;
+ dev->dsr->gos_info.gos_type = PVRDMA_GOS_TYPE_LINUX;
+ dev->dsr->gos_info.gos_ver = 1;
+- dev->dsr->uar_pfn = dev->driver_uar.pfn;
++
++ if (dev->dsr_version < PVRDMA_PPN64_VERSION)
++ dev->dsr->uar_pfn = dev->driver_uar.pfn;
++ else
++ dev->dsr->uar_pfn64 = dev->driver_uar.pfn;
+
+ /* Command slot. */
+ dev->cmd_slot = dma_alloc_coherent(&pdev->dev, PAGE_SIZE,
+--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c
+@@ -338,7 +338,12 @@ struct ib_ucontext *pvrdma_alloc_ucontex
+
+ /* get ctx_handle from host */
+ memset(cmd, 0, sizeof(*cmd));
+- cmd->pfn = context->uar.pfn;
++
++ if (vdev->dsr_version < PVRDMA_PPN64_VERSION)
++ cmd->pfn = context->uar.pfn;
++ else
++ cmd->pfn64 = context->uar.pfn;
++
+ cmd->hdr.cmd = PVRDMA_CMD_CREATE_UC;
+ ret = pvrdma_cmd_post(vdev, &req, &rsp, PVRDMA_CMD_CREATE_UC_RESP);
+ if (ret < 0) {
diff --git a/patches.drivers/VMCI-Support-upto-64-bit-PPNs.patch b/patches.drivers/VMCI-Support-upto-64-bit-PPNs.patch
new file mode 100644
index 0000000000..a8011646c7
--- /dev/null
+++ b/patches.drivers/VMCI-Support-upto-64-bit-PPNs.patch
@@ -0,0 +1,312 @@
+From: Vishnu DASA <vdasa@vmware.com>
+Date: Fri, 15 Feb 2019 16:32:47 +0000
+Subject: VMCI: Support upto 64-bit PPNs
+Patch-mainline: v5.1-rc1
+Git-commit: f2db7361cb19bf3a6f7fd367f21d8eb325397946
+References: bsc#1127286
+
+Add support in the VMCI driver to handle upto 64-bit PPNs when the VMCI
+device exposes the capability for 64-bit PPNs.
+
+Reviewed-by: Adit Ranadive <aditr@vmware.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: Vishnu Dasa <vdasa@vmware.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/misc/vmw_vmci/vmci_doorbell.c | 9 +++-
+ drivers/misc/vmw_vmci/vmci_doorbell.h | 2 -
+ drivers/misc/vmw_vmci/vmci_driver.h | 2 +
+ drivers/misc/vmw_vmci/vmci_guest.c | 39 ++++++++++++++++---
+ drivers/misc/vmw_vmci/vmci_queue_pair.c | 63 ++++++++++++++------------------
+ drivers/misc/vmw_vmci/vmci_queue_pair.h | 4 +-
+ include/linux/vmw_vmci_defs.h | 7 ++-
+ 7 files changed, 77 insertions(+), 49 deletions(-)
+
+--- a/drivers/misc/vmw_vmci/vmci_doorbell.c
++++ b/drivers/misc/vmw_vmci/vmci_doorbell.c
+@@ -330,7 +330,7 @@ int vmci_dbell_host_context_notify(u32 s
+ /*
+ * Register the notification bitmap with the host.
+ */
+-bool vmci_dbell_register_notification_bitmap(u32 bitmap_ppn)
++bool vmci_dbell_register_notification_bitmap(u64 bitmap_ppn)
+ {
+ int result;
+ struct vmci_notify_bm_set_msg bitmap_set_msg;
+@@ -340,11 +340,14 @@ bool vmci_dbell_register_notification_bi
+ bitmap_set_msg.hdr.src = VMCI_ANON_SRC_HANDLE;
+ bitmap_set_msg.hdr.payload_size = sizeof(bitmap_set_msg) -
+ VMCI_DG_HEADERSIZE;
+- bitmap_set_msg.bitmap_ppn = bitmap_ppn;
++ if (vmci_use_ppn64())
++ bitmap_set_msg.bitmap_ppn64 = bitmap_ppn;
++ else
++ bitmap_set_msg.bitmap_ppn32 = (u32) bitmap_ppn;
+
+ result = vmci_send_datagram(&bitmap_set_msg.hdr);
+ if (result != VMCI_SUCCESS) {
+- pr_devel("Failed to register (PPN=%u) as notification bitmap (error=%d)\n",
++ pr_devel("Failed to register (PPN=%llu) as notification bitmap (error=%d)\n",
+ bitmap_ppn, result);
+ return false;
+ }
+--- a/drivers/misc/vmw_vmci/vmci_doorbell.h
++++ b/drivers/misc/vmw_vmci/vmci_doorbell.h
+@@ -45,7 +45,7 @@ struct dbell_cpt_state {
+ int vmci_dbell_host_context_notify(u32 src_cid, struct vmci_handle handle);
+ int vmci_dbell_get_priv_flags(struct vmci_handle handle, u32 *priv_flags);
+
+-bool vmci_dbell_register_notification_bitmap(u32 bitmap_ppn);
++bool vmci_dbell_register_notification_bitmap(u64 bitmap_ppn);
+ void vmci_dbell_scan_notification_entries(u8 *bitmap);
+
+ #endif /* VMCI_DOORBELL_H */
+--- a/drivers/misc/vmw_vmci/vmci_driver.h
++++ b/drivers/misc/vmw_vmci/vmci_driver.h
+@@ -54,4 +54,6 @@ void vmci_guest_exit(void);
+ bool vmci_guest_code_active(void);
+ u32 vmci_get_vm_context_id(void);
+
++bool vmci_use_ppn64(void);
++
+ #endif /* _VMCI_DRIVER_H_ */
+--- a/drivers/misc/vmw_vmci/vmci_guest.c
++++ b/drivers/misc/vmw_vmci/vmci_guest.c
+@@ -64,6 +64,13 @@ struct vmci_guest_device {
+ dma_addr_t notification_base;
+ };
+
++static bool use_ppn64;
++
++bool vmci_use_ppn64(void)
++{
++ return use_ppn64;
++}
++
+ /* vmci_dev singleton device and supporting data*/
+ struct pci_dev *vmci_pdev;
+ static struct vmci_guest_device *vmci_dev_g;
+@@ -432,6 +439,7 @@ static int vmci_guest_probe_device(struc
+ struct vmci_guest_device *vmci_dev;
+ void __iomem *iobase;
+ unsigned int capabilities;
++ unsigned int caps_in_use;
+ unsigned long cmd;
+ int vmci_err;
+ int error;
+@@ -496,6 +504,23 @@ static int vmci_guest_probe_device(struc
+ error = -ENXIO;
+ goto err_free_data_buffer;
+ }
++ caps_in_use = VMCI_CAPS_DATAGRAM;
++
++ /*
++ * Use 64-bit PPNs if the device supports.
++ *
++ * There is no check for the return value of dma_set_mask_and_coherent
++ * since this driver can handle the default mask values if
++ * dma_set_mask_and_coherent fails.
++ */
++ if (capabilities & VMCI_CAPS_PPN64) {
++ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64));
++ use_ppn64 = true;
++ caps_in_use |= VMCI_CAPS_PPN64;
++ } else {
++ dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(44));
++ use_ppn64 = false;
++ }
+
+ /*
+ * If the hardware supports notifications, we will use that as
+@@ -510,14 +535,14 @@ static int vmci_guest_probe_device(struc
+ "Unable to allocate notification bitmap\n");
+ } else {
+ memset(vmci_dev->notification_bitmap, 0, PAGE_SIZE);
+- capabilities |= VMCI_CAPS_NOTIFICATIONS;
++ caps_in_use |= VMCI_CAPS_NOTIFICATIONS;
+ }
+ }
+
+- dev_info(&pdev->dev, "Using capabilities 0x%x\n", capabilities);
++ dev_info(&pdev->dev, "Using capabilities 0x%x\n", caps_in_use);
+
+ /* Let the host know which capabilities we intend to use. */
+- iowrite32(capabilities, vmci_dev->iobase + VMCI_CAPS_ADDR);
++ iowrite32(caps_in_use, vmci_dev->iobase + VMCI_CAPS_ADDR);
+
+ /* Set up global device so that we can start sending datagrams */
+ spin_lock_irq(&vmci_dev_spinlock);
+@@ -529,13 +554,13 @@ static int vmci_guest_probe_device(struc
+ * Register notification bitmap with device if that capability is
+ * used.
+ */
+- if (capabilities & VMCI_CAPS_NOTIFICATIONS) {
++ if (caps_in_use & VMCI_CAPS_NOTIFICATIONS) {
+ unsigned long bitmap_ppn =
+ vmci_dev->notification_base >> PAGE_SHIFT;
+ if (!vmci_dbell_register_notification_bitmap(bitmap_ppn)) {
+ dev_warn(&pdev->dev,
+- "VMCI device unable to register notification bitmap with PPN 0x%x\n",
+- (u32) bitmap_ppn);
++ "VMCI device unable to register notification bitmap with PPN 0x%lx\n",
++ bitmap_ppn);
+ error = -ENXIO;
+ goto err_remove_vmci_dev_g;
+ }
+@@ -611,7 +636,7 @@ static int vmci_guest_probe_device(struc
+
+ /* Enable specific interrupt bits. */
+ cmd = VMCI_IMR_DATAGRAM;
+- if (capabilities & VMCI_CAPS_NOTIFICATIONS)
++ if (caps_in_use & VMCI_CAPS_NOTIFICATIONS)
+ cmd |= VMCI_IMR_NOTIFICATION;
+ iowrite32(cmd, vmci_dev->iobase + VMCI_IMR_ADDR);
+
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -476,8 +476,8 @@ static int qp_alloc_ppn_set(void *prod_q
+ void *cons_q,
+ u64 num_consume_pages, struct ppn_set *ppn_set)
+ {
+- u32 *produce_ppns;
+- u32 *consume_ppns;
++ u64 *produce_ppns;
++ u64 *consume_ppns;
+ struct vmci_queue *produce_q = prod_q;
+ struct vmci_queue *consume_q = cons_q;
+ u64 i;
+@@ -501,31 +501,13 @@ static int qp_alloc_ppn_set(void *prod_q
+ return VMCI_ERROR_NO_MEM;
+ }
+
+- for (i = 0; i < num_produce_pages; i++) {
+- unsigned long pfn;
+-
++ for (i = 0; i < num_produce_pages; i++)
+ produce_ppns[i] =
+ produce_q->kernel_if->u.g.pas[i] >> PAGE_SHIFT;
+- pfn = produce_ppns[i];
+-
+- /* Fail allocation if PFN isn't supported by hypervisor. */
+- if (sizeof(pfn) > sizeof(*produce_ppns)
+- && pfn != produce_ppns[i])
+- goto ppn_error;
+- }
+-
+- for (i = 0; i < num_consume_pages; i++) {
+- unsigned long pfn;
+
++ for (i = 0; i < num_consume_pages; i++)
+ consume_ppns[i] =
+ consume_q->kernel_if->u.g.pas[i] >> PAGE_SHIFT;
+- pfn = consume_ppns[i];
+-
+- /* Fail allocation if PFN isn't supported by hypervisor. */
+- if (sizeof(pfn) > sizeof(*consume_ppns)
+- && pfn != consume_ppns[i])
+- goto ppn_error;
+- }
+
+ ppn_set->num_produce_pages = num_produce_pages;
+ ppn_set->num_consume_pages = num_consume_pages;
+@@ -533,11 +515,6 @@ static int qp_alloc_ppn_set(void *prod_q
+ ppn_set->consume_ppns = consume_ppns;
+ ppn_set->initialized = true;
+ return VMCI_SUCCESS;
+-
+- ppn_error:
+- kfree(produce_ppns);
+- kfree(consume_ppns);
+- return VMCI_ERROR_INVALID_ARGS;
+ }
+
+ /*
+@@ -559,12 +536,28 @@ static void qp_free_ppn_set(struct ppn_s
+ */
+ static int qp_populate_ppn_set(u8 *call_buf, const struct ppn_set *ppn_set)
+ {
+- memcpy(call_buf, ppn_set->produce_ppns,
+- ppn_set->num_produce_pages * sizeof(*ppn_set->produce_ppns));
+- memcpy(call_buf +
+- ppn_set->num_produce_pages * sizeof(*ppn_set->produce_ppns),
+- ppn_set->consume_ppns,
+- ppn_set->num_consume_pages * sizeof(*ppn_set->consume_ppns));
++ if (vmci_use_ppn64()) {
++ memcpy(call_buf, ppn_set->produce_ppns,
++ ppn_set->num_produce_pages *
++ sizeof(*ppn_set->produce_ppns));
++ memcpy(call_buf +
++ ppn_set->num_produce_pages *
++ sizeof(*ppn_set->produce_ppns),
++ ppn_set->consume_ppns,
++ ppn_set->num_consume_pages *
++ sizeof(*ppn_set->consume_ppns));
++ } else {
++ int i;
++ u32 *ppns = (u32 *) call_buf;
++
++ for (i = 0; i < ppn_set->num_produce_pages; i++)
++ ppns[i] = (u32) ppn_set->produce_ppns[i];
++
++ ppns = &ppns[ppn_set->num_produce_pages];
++
++ for (i = 0; i < ppn_set->num_consume_pages; i++)
++ ppns[i] = (u32) ppn_set->consume_ppns[i];
++ }
+
+ return VMCI_SUCCESS;
+ }
+@@ -1038,13 +1031,15 @@ static int qp_alloc_hypercall(const stru
+ {
+ struct vmci_qp_alloc_msg *alloc_msg;
+ size_t msg_size;
++ size_t ppn_size;
+ int result;
+
+ if (!entry || entry->num_ppns <= 2)
+ return VMCI_ERROR_INVALID_ARGS;
+
++ ppn_size = vmci_use_ppn64() ? sizeof(u64) : sizeof(u32);
+ msg_size = sizeof(*alloc_msg) +
+- (size_t) entry->num_ppns * sizeof(u32);
++ (size_t) entry->num_ppns * ppn_size;
+ alloc_msg = kmalloc(msg_size, GFP_KERNEL);
+ if (!alloc_msg)
+ return VMCI_ERROR_NO_MEM;
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.h
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.h
+@@ -28,8 +28,8 @@ typedef int (*vmci_event_release_cb) (vo
+ struct ppn_set {
+ u64 num_produce_pages;
+ u64 num_consume_pages;
+- u32 *produce_ppns;
+- u32 *consume_ppns;
++ u64 *produce_ppns;
++ u64 *consume_ppns;
+ bool initialized;
+ };
+
+--- a/include/linux/vmw_vmci_defs.h
++++ b/include/linux/vmw_vmci_defs.h
+@@ -45,6 +45,7 @@
+ #define VMCI_CAPS_GUESTCALL 0x2
+ #define VMCI_CAPS_DATAGRAM 0x4
+ #define VMCI_CAPS_NOTIFICATIONS 0x8
++#define VMCI_CAPS_PPN64 0x10
+
+ /* Interrupt Cause register bits. */
+ #define VMCI_ICR_DATAGRAM 0x1
+@@ -569,8 +570,10 @@ struct vmci_resource_query_msg {
+ */
+ struct vmci_notify_bm_set_msg {
+ struct vmci_datagram hdr;
+- u32 bitmap_ppn;
+- u32 _pad;
++ union {
++ u32 bitmap_ppn32;
++ u64 bitmap_ppn64;
++ };
+ };
+
+ /*
diff --git a/patches.drivers/bnxt_en-Fix-typo-in-firmware-message-timeout-logic.patch b/patches.drivers/bnxt_en-Fix-typo-in-firmware-message-timeout-logic.patch
new file mode 100644
index 0000000000..7d3a3893d4
--- /dev/null
+++ b/patches.drivers/bnxt_en-Fix-typo-in-firmware-message-timeout-logic.patch
@@ -0,0 +1,32 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Wed, 20 Feb 2019 19:07:31 -0500
+Subject: bnxt_en: Fix typo in firmware message timeout logic.
+Patch-mainline: v5.0-rc8
+Git-commit: 67681d02aaa1db9044a16df4ca9c77cde1221a3e
+References: bsc#1086282 FATE#324873
+
+The logic that polls for the firmware message response uses a shorter
+sleep interval for the first few passes. But there was a typo so it
+was using the wrong counter (larger counter) for these short sleep
+passes. The result is a slightly shorter timeout period for these
+firmware messages than intended. Fix it by using the proper counter.
+
+Fixes: 9751e8e71487 ("bnxt_en: reduce timeout on initial HWRM calls")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3521,7 +3521,7 @@ static int bnxt_hwrm_do_send_msg(struct
+ if (len)
+ break;
+ /* on first few passes, just barely sleep */
+- if (i < DFLT_HWRM_CMD_TIMEOUT)
++ if (i < HWRM_SHORT_TIMEOUT_COUNTER)
+ usleep_range(HWRM_SHORT_MIN_TIMEOUT,
+ HWRM_SHORT_MAX_TIMEOUT);
+ else
diff --git a/patches.drivers/bnxt_en-Wait-longer-for-the-firmware-message-respons.patch b/patches.drivers/bnxt_en-Wait-longer-for-the-firmware-message-respons.patch
new file mode 100644
index 0000000000..e61cf344d1
--- /dev/null
+++ b/patches.drivers/bnxt_en-Wait-longer-for-the-firmware-message-respons.patch
@@ -0,0 +1,43 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Wed, 20 Feb 2019 19:07:32 -0500
+Subject: bnxt_en: Wait longer for the firmware message response to complete.
+Patch-mainline: v5.0-rc8
+Git-commit: 0000b81a063b5f3ab82fa18041c28327ce72c312
+References: bsc#1086282 FATE#324873
+
+The code waits up to 20 usec for the firmware response to complete
+once we've seen the valid response header in the buffer. It turns
+out that in some scenarios, this wait time is not long enough.
+Extend it to 150 usec and use usleep_range() instead of udelay().
+
+Fixes: 9751e8e71487 ("bnxt_en: reduce timeout on initial HWRM calls")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
+ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -3544,7 +3544,7 @@ static int bnxt_hwrm_do_send_msg(struct
+ dma_rmb();
+ if (*valid)
+ break;
+- udelay(1);
++ usleep_range(1, 5);
+ }
+
+ if (j >= HWRM_VALID_BIT_DELAY_USEC) {
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h
+@@ -542,7 +542,7 @@ struct rx_tpa_end_cmp_ext {
+ (HWRM_SHORT_TIMEOUT_COUNTER * HWRM_SHORT_MIN_TIMEOUT + \
+ ((n) - HWRM_SHORT_TIMEOUT_COUNTER) * HWRM_MIN_TIMEOUT))
+
+-#define HWRM_VALID_BIT_DELAY_USEC 20
++#define HWRM_VALID_BIT_DELAY_USEC 150
+
+ #define BNXT_RX_EVENT 1
+ #define BNXT_AGG_EVENT 2
diff --git a/patches.drivers/bpf-verifier-fix-verifier-instability.patch b/patches.drivers/bpf-verifier-fix-verifier-instability.patch
new file mode 100644
index 0000000000..57a4c7c37a
--- /dev/null
+++ b/patches.drivers/bpf-verifier-fix-verifier-instability.patch
@@ -0,0 +1,74 @@
+From: Alexei Starovoitov <ast@kernel.org>
+Date: Tue, 4 Sep 2018 19:13:44 -0700
+Subject: bpf/verifier: fix verifier instability
+Patch-mainline: v4.20-rc1
+Git-commit: a9c676bc8fc58d00eea9836fb14ee43c0346416a
+References: bsc#1056787
+
+Edward Cree says:
+In check_mem_access(), for the PTR_TO_CTX case, after check_ctx_access()
+has supplied a reg_type, the other members of the register state are set
+appropriately. Previously reg.range was set to 0, but as it is in a
+union with reg.map_ptr, which is larger, upper bytes of the latter were
+left in place. This then caused the memcmp() in regsafe() to fail,
+preventing some branches from being pruned (and occasionally causing the
+same program to take a varying number of processed insns on repeated
+verifier runs).
+
+Fix the instability by clearing bpf_reg_state in __mark_reg_[un]known()
+
+Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
+Debugged-by: Edward Cree <ecree@solarflare.com>
+Acked-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/verifier.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -448,7 +448,9 @@ static void __mark_reg_not_init(struct b
+ */
+ static void __mark_reg_known(struct bpf_reg_state *reg, u64 imm)
+ {
+- reg->id = 0;
++ /* Clear id, off, and union(map_ptr, range) */
++ memset(((u8 *)reg) + sizeof(reg->type), 0,
++ offsetof(struct bpf_reg_state, var_off) - sizeof(reg->type));
+ reg->var_off = tnum_const(imm);
+ reg->smin_value = (s64)imm;
+ reg->smax_value = (s64)imm;
+@@ -546,9 +548,12 @@ static void __mark_reg_unbounded(struct
+ /* Mark a register as having a completely unknown (scalar) value. */
+ static void __mark_reg_unknown(struct bpf_reg_state *reg)
+ {
++ /*
++ * Clear type, id, off, and union(map_ptr, range) and
++ * padding between 'type' and union
++ */
++ memset(reg, 0, offsetof(struct bpf_reg_state, var_off));
+ reg->type = SCALAR_VALUE;
+- reg->id = 0;
+- reg->off = 0;
+ reg->var_off = tnum_unknown;
+ __mark_reg_unbounded(reg);
+ }
+@@ -1197,9 +1202,6 @@ static int check_mem_access(struct bpf_v
+ else
+ mark_reg_known_zero(env, regs,
+ value_regno);
+- regs[value_regno].id = 0;
+- regs[value_regno].off = 0;
+- regs[value_regno].range = 0;
+ regs[value_regno].type = reg_type;
+ }
+
+@@ -1793,7 +1795,6 @@ static int check_call(struct bpf_verifie
+ regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL;
+ /* There is no offset yet applied, variable or fixed */
+ mark_reg_known_zero(env, regs, BPF_REG_0);
+- regs[BPF_REG_0].off = 0;
+ /* remember map_ptr, so that check_map_access()
+ * can check 'value_size' boundary of memory access
+ * to map element returned from bpf_map_lookup_elem()
diff --git a/patches.drivers/net-Don-t-default-Cavium-PTP-driver-to-y.patch b/patches.drivers/net-Don-t-default-Cavium-PTP-driver-to-y.patch
new file mode 100644
index 0000000000..9066357775
--- /dev/null
+++ b/patches.drivers/net-Don-t-default-Cavium-PTP-driver-to-y.patch
@@ -0,0 +1,29 @@
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Tue, 5 Feb 2019 14:47:21 -0600
+Subject: net: Don't default Cavium PTP driver to 'y'
+Patch-mainline: v5.0-rc6
+Git-commit: e8c32c32b48c2e889704d8ca0872f92eb027838e
+References: bsc#1110096
+
+8c56df372bc1 ("net: add support for Cavium PTP coprocessor") added the
+Cavium PTP coprocessor driver and enabled it by default. Remove the
+"default y" because the driver only applies to Cavium ThunderX processors.
+
+Fixes: 8c56df372bc1 ("net: add support for Cavium PTP coprocessor")
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/cavium/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ethernet/cavium/Kconfig
++++ b/drivers/net/ethernet/cavium/Kconfig
+@@ -55,7 +55,6 @@ config CAVIUM_PTP
+ tristate "Cavium PTP coprocessor as PTP clock"
+ depends on 64BIT
+ imply PTP_1588_CLOCK
+- default y
+ ---help---
+ This driver adds support for the Precision Time Protocol Clocks and
+ Timestamping coprocessor (PTP) found on Cavium processors.
diff --git a/patches.drivers/net-ena-fix-race-between-link-up-and-device-initaliz.patch b/patches.drivers/net-ena-fix-race-between-link-up-and-device-initaliz.patch
new file mode 100644
index 0000000000..bbba4a81b4
--- /dev/null
+++ b/patches.drivers/net-ena-fix-race-between-link-up-and-device-initaliz.patch
@@ -0,0 +1,53 @@
+From: Arthur Kiyanovski <akiyano@amazon.com>
+Date: Mon, 11 Feb 2019 19:17:43 +0200
+Subject: net: ena: fix race between link up and device initalization
+Patch-mainline: v5.0-rc7
+Git-commit: e1f1bd9bfbedcfce428ee7e1b82a6ec12d4c3863
+References: bsc#1083548
+
+Fix race condition between ena_update_on_link_change() and
+ena_restore_device().
+
+This race can occur if link notification arrives while the driver
+is performing a reset sequence. In this case link can be set up,
+enabling the device, before it is fully restored. If packets are
+sent at this time, the driver might access uninitialized data
+structures, causing kernel crash.
+
+Move the clearing of ENA_FLAG_ONGOING_RESET and netif_carrier_on()
+after ena_up() to ensure the device is ready when link is set up.
+
+Fixes: d18e4f683445 ("net: ena: fix race condition between device reset and link up setup")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2663,11 +2663,6 @@ static int ena_restore_device(struct ena
+ goto err_device_destroy;
+ }
+
+- clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
+- /* Make sure we don't have a race with AENQ Links state handler */
+- if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
+- netif_carrier_on(adapter->netdev);
+-
+ rc = ena_enable_msix_and_set_admin_interrupts(adapter,
+ adapter->num_queues);
+ if (rc) {
+@@ -2684,6 +2679,11 @@ static int ena_restore_device(struct ena
+ }
+
+ set_bit(ENA_FLAG_DEVICE_RUNNING, &adapter->flags);
++
++ clear_bit(ENA_FLAG_ONGOING_RESET, &adapter->flags);
++ if (test_bit(ENA_FLAG_LINK_UP, &adapter->flags))
++ netif_carrier_on(adapter->netdev);
++
+ mod_timer(&adapter->timer_service, round_jiffies(jiffies + HZ));
+ dev_err(&pdev->dev,
+ "Device reset completed successfully, Driver info: %s\n",
diff --git a/patches.drivers/net-mlx5e-RX-Fix-wrong-early-return-in-receive-queue.patch b/patches.drivers/net-mlx5e-RX-Fix-wrong-early-return-in-receive-queue.patch
new file mode 100644
index 0000000000..9b225219ce
--- /dev/null
+++ b/patches.drivers/net-mlx5e-RX-Fix-wrong-early-return-in-receive-queue.patch
@@ -0,0 +1,60 @@
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Sun, 2 Dec 2018 15:45:53 +0200
+Subject: net/mlx5e: RX, Fix wrong early return in receive queue poll
+Patch-mainline: v4.20
+Git-commit: bfc698254ba97b3e3e4ebbfae0ffa1f7e2fa0717
+References: bsc#1046305 FATE#322943
+
+When the completion queue of the RQ is empty, do not immediately return.
+If left-over decompressed CQEs (from the previous cycle) were processed,
+need to go to the finalization part of the poll function.
+
+Bug exists only when CQE compression is turned ON.
+
+This solves the following issue:
+mlx5_core 0000:82:00.1: mlx5_eq_int:544:(pid 0): CQ error on CQN 0xc08, syndrome 0x1
+mlx5_core 0000:82:00.1 p4p2: mlx5e_cq_error_event: cqn=0x000c08 event=0x04
+
+Fixes: 4b7dfc992514 ("net/mlx5e: Early-return on empty completion queues")
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Reviewed-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1100,7 +1100,7 @@ mpwrq_cqe_out:
+ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget)
+ {
+ struct mlx5e_rq *rq = container_of(cq, struct mlx5e_rq, cq);
+- struct mlx5e_xdpsq *xdpsq;
++ struct mlx5e_xdpsq *xdpsq = &rq->xdpsq;
+ struct mlx5_cqe64 *cqe;
+ int work_done = 0;
+
+@@ -1111,10 +1111,11 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq
+ work_done += mlx5e_decompress_cqes_cont(rq, cq, 0, budget);
+
+ cqe = mlx5_cqwq_get_cqe(&cq->wq);
+- if (!cqe)
++ if (!cqe) {
++ if (unlikely(work_done))
++ goto out;
+ return 0;
+-
+- xdpsq = &rq->xdpsq;
++ }
+
+ do {
+ if (mlx5_get_cqe_format(cqe) == MLX5_COMPRESSED) {
+@@ -1129,6 +1130,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq
+ rq->handle_rx_cqe(rq, cqe);
+ } while ((++work_done < budget) && (cqe = mlx5_cqwq_get_cqe(&cq->wq)));
+
++out:
+ if (xdpsq->db.doorbell) {
+ mlx5e_xmit_xdp_doorbell(xdpsq);
+ xdpsq->db.doorbell = false;
diff --git a/patches.drm/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch b/patches.drm/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch
new file mode 100644
index 0000000000..858e8193c0
--- /dev/null
+++ b/patches.drm/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch
@@ -0,0 +1,35 @@
+From f8261c376e7f8cb9024af5a6c54be540c7f9108e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Mon, 14 Jan 2019 13:49:46 +0300
+Subject: drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump()
+Git-commit: f8261c376e7f8cb9024af5a6c54be540c7f9108e
+Patch-mainline: v5.1-rc1
+References: bsc#1113722
+
+The etnaviv_gem_get_pages() never returns NULL. It returns error
+pointers on error.
+
+Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+index 3fbb4855396c..33854c94cb85 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+@@ -215,7 +215,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu)
+ mutex_lock(&obj->lock);
+ pages = etnaviv_gem_get_pages(obj);
+ mutex_unlock(&obj->lock);
+- if (pages) {
++ if (!IS_ERR(pages)) {
+ int j;
+
+ iter.hdr->data[0] = bomap - bomap_start;
+--
+2.20.1
+
diff --git a/patches.drm/0002-drm-etnaviv-potential-NULL-dereference.patch b/patches.drm/0002-drm-etnaviv-potential-NULL-dereference.patch
new file mode 100644
index 0000000000..e7eb8e0620
--- /dev/null
+++ b/patches.drm/0002-drm-etnaviv-potential-NULL-dereference.patch
@@ -0,0 +1,37 @@
+From 9e05352340d3a3e68c144136db9810b26ebb88c3 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 5 Feb 2019 12:08:19 +0300
+Subject: drm/etnaviv: potential NULL dereference
+Git-commit: 9e05352340d3a3e68c144136db9810b26ebb88c3
+Patch-mainline: v5.1-rc1
+References: bsc#1113722
+
+The etnaviv_gem_prime_get_sg_table() is supposed to return error
+pointers. Otherwise it can lead to a NULL dereference when it's called
+from drm_gem_map_dma_buf().
+
+Fixes: 5f4a4a73f437 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+index 0566171f8df2..f21529e635e3 100644
+--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c
+@@ -15,7 +15,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj)
+ int npages = obj->size >> PAGE_SHIFT;
+
+ if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */
+- return NULL;
++ return ERR_PTR(-EINVAL);
+
+ return drm_prime_pages_to_sg(etnaviv_obj->pages, npages);
+ }
+--
+2.20.1
+
diff --git a/patches.fixes/0001-fbdev-chipsfb-remove-set-but-not-used-variable-size.patch b/patches.fixes/0001-fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
new file mode 100644
index 0000000000..260038358c
--- /dev/null
+++ b/patches.fixes/0001-fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
@@ -0,0 +1,50 @@
+From 8e71fa5e4d86bedfd26df85381d65d6b4c860020 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 8 Feb 2019 19:24:45 +0100
+Subject: fbdev: chipsfb: remove set but not used variable 'size'
+Git-commit: 8e71fa5e4d86bedfd26df85381d65d6b4c860020
+Patch-mainline: v5.1-rc1
+References: bsc#1113722
+
+Fixes gcc '-Wunused-but-set-variable' warning:
+
+drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init':
+drivers/video/fbdev/chipsfb.c:352:22: warning:
+ variable 'size' set but not used [-Wunused-but-set-variable]
+
+Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK").
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Michael Ellerman <mpe@ellerman.id.au>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Christophe Leroy <christophe.leroy@c-s.fr>
+[b.zolnierkie: minor commit summary and description fixups]
+Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/video/fbdev/chipsfb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c
+index 40182ed85648..ca549e1532e6 100644
+--- a/drivers/video/fbdev/chipsfb.c
++++ b/drivers/video/fbdev/chipsfb.c
+@@ -349,7 +349,7 @@ static void init_chips(struct fb_info *p, unsigned long addr)
+ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ {
+ struct fb_info *p;
+- unsigned long addr, size;
++ unsigned long addr;
+ unsigned short cmd;
+ int rc = -ENODEV;
+
+@@ -361,7 +361,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)
+ if ((dp->resource[0].flags & IORESOURCE_MEM) == 0)
+ goto err_disable;
+ addr = pci_resource_start(dp, 0);
+- size = pci_resource_len(dp, 0);
+ if (addr == 0)
+ goto err_disable;
+
+--
+2.20.1
+
diff --git a/patches.fixes/0001-net-aquantia-fixed-instack-structure-overflow.patch b/patches.fixes/0001-net-aquantia-fixed-instack-structure-overflow.patch
new file mode 100644
index 0000000000..435d58eb36
--- /dev/null
+++ b/patches.fixes/0001-net-aquantia-fixed-instack-structure-overflow.patch
@@ -0,0 +1,48 @@
+From: Igor Russkikh <Igor.Russkikh@aquantia.com>
+Subject: net: aquantia: fixed instack structure overflow
+Patch-mainline: v5.1-rc1
+Git-commit: 8006e3730b6e900319411e35cee85b4513d298df
+References: git-fixes
+
+This is a real stack undercorruption found by kasan build.
+
+The issue did no harm normally because it only overflowed
+2 bytes after `bitary` array which on most architectures
+were mapped into `err` local.
+
+Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.")
+Signed-off-by: Nikita Danilov <nikita.danilov@aquantia.com>
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 4 ++--
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c
+@@ -171,8 +171,8 @@ static int hw_atl_a0_hw_rss_set(struct a
+ u32 i = 0U;
+ u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ int err = 0;
+- u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX *
+- HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
++ u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX *
++ HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)];
+
+ memset(bitary, 0, sizeof(bitary));
+
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -172,8 +172,8 @@ static int hw_atl_b0_hw_rss_set(struct a
+ u32 i = 0U;
+ u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues);
+ int err = 0;
+- u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX *
+- HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
++ u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX *
++ HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)];
+
+ memset(bitary, 0, sizeof(bitary));
+
diff --git a/patches.fixes/0001-net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracef.patch b/patches.fixes/0001-net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracef.patch
new file mode 100644
index 0000000000..850238ace7
--- /dev/null
+++ b/patches.fixes/0001-net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracef.patch
@@ -0,0 +1,32 @@
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Subject: net: dsa: mv88e6xxx: handle unknown duplex modes gracefully in mv88e6xxx_port_set_duplex
+Patch-mainline: v5.1-rc1
+Git-commit: c6195a8bdfc62a7cecf7df685e64847a4b700275
+References: git-fixes
+
+When testing another issue I faced the problem that
+mv88e6xxx_port_setup_mac() failed due to DUPLEX_UNKNOWN being passed
+as argument to mv88e6xxx_port_set_duplex(). We should handle this case
+gracefully and return -EOPNOTSUPP, like e.g. mv88e6xxx_port_set_speed()
+is doing it.
+
+Fixes: 7f1ae07b51e8 ("net: dsa: mv88e6xxx: add port duplex setter")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/dsa/mv88e6xxx/port.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mv88e6xxx/port.c
++++ b/drivers/net/dsa/mv88e6xxx/port.c
+@@ -122,7 +122,7 @@ int mv88e6xxx_port_set_link(struct mv88e
+ /* normal link detection */
+ break;
+ default:
+- return -EINVAL;
++ return -EOPNOTSUPP;
+ }
+
+ err = mv88e6xxx_port_write(chip, port, PORT_PCS_CTRL, reg);
diff --git a/patches.fixes/0001-net-mlx4_core-Fix-locking-in-SRIOV-mode-when-switchi.patch b/patches.fixes/0001-net-mlx4_core-Fix-locking-in-SRIOV-mode-when-switchi.patch
new file mode 100644
index 0000000000..9bc48dbb78
--- /dev/null
+++ b/patches.fixes/0001-net-mlx4_core-Fix-locking-in-SRIOV-mode-when-switchi.patch
@@ -0,0 +1,70 @@
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Subject: net/mlx4_core: Fix locking in SRIOV mode when switching between events and polling
+Patch-mainline: v5.1-rc1
+Git-commit: c07d27927f2f2e96fcd27bb9fb330c9ea65612d0
+References: git-fixes
+
+In procedures mlx4_cmd_use_events() and mlx4_cmd_use_polling(), we need to
+guarantee that there are no FW commands in progress on the comm channel
+(for VFs) or wrapped FW commands (on the PF) when SRIOV is active.
+
+We do this by also taking the slave_cmd_mutex when SRIOV is active.
+
+This is especially important when switching from event to polling, since we
+free the command-context array during the switch. If there are FW commands
+in progress (e.g., waiting for a completion event), the completion event
+handler will access freed memory.
+
+Since the decision to use comm_wait or comm_poll is taken before grabbing
+the event_sem/poll_sem in mlx4_comm_cmd_wait/poll, we must take the
+slave_cmd_mutex as well (to guarantee that the decision to use events or
+polling and the call to the appropriate cmd function are atomic).
+
+Fixes: a7e1f04905e5 ("net/mlx4_core: Fix deadlock when switching between polling and event fw commands")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/mellanox/mlx4/cmd.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2642,6 +2642,9 @@ int mlx4_cmd_use_events(struct mlx4_dev
+ if (!priv->cmd.context)
+ return -ENOMEM;
+
++ if (mlx4_is_mfunc(dev))
++ mutex_lock(&priv->cmd.slave_cmd_mutex);
++
+ down_write(&priv->cmd.switch_sem);
+ for (i = 0; i < priv->cmd.max_cmds; ++i) {
+ priv->cmd.context[i].token = i;
+@@ -2667,6 +2670,8 @@ int mlx4_cmd_use_events(struct mlx4_dev
+ down(&priv->cmd.poll_sem);
+ priv->cmd.use_events = 1;
+ up_write(&priv->cmd.switch_sem);
++ if (mlx4_is_mfunc(dev))
++ mutex_unlock(&priv->cmd.slave_cmd_mutex);
+
+ return err;
+ }
+@@ -2679,6 +2684,8 @@ void mlx4_cmd_use_polling(struct mlx4_de
+ struct mlx4_priv *priv = mlx4_priv(dev);
+ int i;
+
++ if (mlx4_is_mfunc(dev))
++ mutex_lock(&priv->cmd.slave_cmd_mutex);
+ down_write(&priv->cmd.switch_sem);
+ priv->cmd.use_events = 0;
+
+@@ -2689,6 +2696,8 @@ void mlx4_cmd_use_polling(struct mlx4_de
+
+ up(&priv->cmd.poll_sem);
+ up_write(&priv->cmd.switch_sem);
++ if (mlx4_is_mfunc(dev))
++ mutex_unlock(&priv->cmd.slave_cmd_mutex);
+ }
+
+ struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev)
diff --git a/patches.fixes/0001-net-mlx4_core-Fix-qp-mtt-size-calculation.patch b/patches.fixes/0001-net-mlx4_core-Fix-qp-mtt-size-calculation.patch
new file mode 100644
index 0000000000..9666a39e78
--- /dev/null
+++ b/patches.fixes/0001-net-mlx4_core-Fix-qp-mtt-size-calculation.patch
@@ -0,0 +1,65 @@
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Subject: net/mlx4_core: Fix qp mtt size calculation
+Patch-mainline: v5.1-rc1
+Git-commit: 8511a653e9250ef36b95803c375a7be0e2edb628
+References: git-fixes
+
+Calculation of qp mtt size (in function mlx4_RST2INIT_wrapper)
+ultimately depends on function roundup_pow_of_two.
+
+If the amount of memory required by the QP is less than one page,
+roundup_pow_of_two is called with argument zero. In this case, the
+roundup_pow_of_two result is undefined.
+
+Calling roundup_pow_of_two with a zero argument resulted in the
+following stack trace:
+
+UBSAN: Undefined behaviour in ./include/linux/log2.h:61:13
+shift exponent 64 is too large for 64-bit type 'long unsigned int'
+CPU: 4 PID: 26939 Comm: rping Tainted: G OE 4.19.0-rc1
+Hardware name: Supermicro X9DR3-F/X9DR3-F, BIOS 3.2a 07/09/2015
+Call Trace:
+dump_stack+0x9a/0xeb
+ubsan_epilogue+0x9/0x7c
+__ubsan_handle_shift_out_of_bounds+0x254/0x29d
+? __ubsan_handle_load_invalid_value+0x180/0x180
+? debug_show_all_locks+0x310/0x310
+? sched_clock+0x5/0x10
+? sched_clock+0x5/0x10
+? sched_clock_cpu+0x18/0x260
+? find_held_lock+0x35/0x1e0
+? mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core]
+mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core]
+
+Fix this by explicitly testing for zero, and returning one if the
+argument is zero (assuming that the next higher power of 2 in this case
+should be one).
+
+Fixes: c82e9aa0a8bc ("mlx4_core: resource tracking for HCA resources used by guests")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -2718,13 +2718,13 @@ static int qp_get_mtt_size(struct mlx4_q
+ int total_pages;
+ int total_mem;
+ int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f;
++ int tot;
+
+ sq_size = 1 << (log_sq_size + log_sq_sride + 4);
+ rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4));
+ total_mem = sq_size + rq_size;
+- total_pages =
+- roundup_pow_of_two((total_mem + (page_offset << 6)) >>
+- page_shift);
++ tot = (total_mem + (page_offset << 6)) >> page_shift;
++ total_pages = !tot ? 1 : roundup_pow_of_two(tot);
+
+ return total_pages;
+ }
diff --git a/patches.fixes/0001-net-mlx4_core-Fix-reset-flow-when-in-command-polling.patch b/patches.fixes/0001-net-mlx4_core-Fix-reset-flow-when-in-command-polling.patch
new file mode 100644
index 0000000000..d15f421b27
--- /dev/null
+++ b/patches.fixes/0001-net-mlx4_core-Fix-reset-flow-when-in-command-polling.patch
@@ -0,0 +1,82 @@
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Subject: net/mlx4_core: Fix reset flow when in command polling mode
+Patch-mainline: v5.1-rc1
+Git-commit: e15ce4b8d11227007577e6dc1364d288b8874fbe
+References: git-fixes
+
+As part of unloading a device, the driver switches from
+FW command event mode to FW command polling mode.
+
+Part of switching over to polling mode is freeing the command context array
+memory (unfortunately, currently, without NULLing the command context array
+pointer).
+
+The reset flow calls "complete" to complete all outstanding fw commands
+(if we are in event mode). The check for event vs. polling mode here
+is to test if the command context array pointer is NULL.
+
+If the reset flow is activated after the switch to polling mode, it will
+attempt (incorrectly) to complete all the commands in the context array --
+because the pointer was not NULLed when the driver switched over to polling
+mode.
+
+As a result, we have a use-after-free situation, which results in a
+kernel crash.
+
+For example:
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<ffffffff876c4a8e>] __wake_up_common+0x2e/0x90
+PGD 0
+Oops: 0000 [#1] SMP
+Modules linked in: netconsole nfsv3 nfs_acl nfs lockd grace ...
+CPU: 2 PID: 940 Comm: kworker/2:3 Kdump: loaded Not tainted 3.10.0-862.el7.x86_64 #1
+Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090006 04/28/2016
+Workqueue: events hv_eject_device_work [pci_hyperv]
+task: ffff8d1734ca0fd0 ti: ffff8d17354bc000 task.ti: ffff8d17354bc000
+RIP: 0010:[<ffffffff876c4a8e>] [<ffffffff876c4a8e>] __wake_up_common+0x2e/0x90
+RSP: 0018:ffff8d17354bfa38 EFLAGS: 00010082
+RAX: 0000000000000000 RBX: ffff8d17362d42c8 RCX: 0000000000000000
+RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8d17362d42c8
+RBP: ffff8d17354bfa70 R08: 0000000000000000 R09: 0000000000000000
+R10: 0000000000000298 R11: ffff8d173610e000 R12: ffff8d17362d42d0
+R13: 0000000000000246 R14: 0000000000000000 R15: 0000000000000003
+FS: 0000000000000000(0000) GS:ffff8d1802680000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000000 CR3: 00000000f16d8000 CR4: 00000000001406e0
+Call Trace:
+ [<ffffffff876c7adc>] complete+0x3c/0x50
+ [<ffffffffc04242f0>] mlx4_cmd_wake_completions+0x70/0x90 [mlx4_core]
+ [<ffffffffc041e7b1>] mlx4_enter_error_state+0xe1/0x380 [mlx4_core]
+ [<ffffffffc041fa4b>] mlx4_comm_cmd+0x29b/0x360 [mlx4_core]
+ [<ffffffffc041ff51>] __mlx4_cmd+0x441/0x920 [mlx4_core]
+ [<ffffffff877f62b1>] ? __slab_free+0x81/0x2f0
+ [<ffffffff87951384>] ? __radix_tree_lookup+0x84/0xf0
+ [<ffffffffc043a8eb>] mlx4_free_mtt_range+0x5b/0xb0 [mlx4_core]
+ [<ffffffffc043a957>] mlx4_mtt_cleanup+0x17/0x20 [mlx4_core]
+ [<ffffffffc04272c7>] mlx4_free_eq+0xa7/0x1c0 [mlx4_core]
+ [<ffffffffc042803e>] mlx4_cleanup_eq_table+0xde/0x130 [mlx4_core]
+ [<ffffffffc0433e08>] mlx4_unload_one+0x118/0x300 [mlx4_core]
+ [<ffffffffc0434191>] mlx4_remove_one+0x91/0x1f0 [mlx4_core]
+
+The fix is to set the command context array pointer to NULL after freeing
+the array.
+
+Fixes: f5aef5aa3506 ("net/mlx4_core: Activate reset flow upon fatal command cases")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/mellanox/mlx4/cmd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
+@@ -2693,6 +2693,7 @@ void mlx4_cmd_use_polling(struct mlx4_de
+ down(&priv->cmd.event_sem);
+
+ kfree(priv->cmd.context);
++ priv->cmd.context = NULL;
+
+ up(&priv->cmd.poll_sem);
+ up_write(&priv->cmd.switch_sem);
diff --git a/patches.fixes/0001-net-mlx5e-IPoIB-Fix-RX-checksum-statistics-update.patch b/patches.fixes/0001-net-mlx5e-IPoIB-Fix-RX-checksum-statistics-update.patch
new file mode 100644
index 0000000000..88f4750fd2
--- /dev/null
+++ b/patches.fixes/0001-net-mlx5e-IPoIB-Fix-RX-checksum-statistics-update.patch
@@ -0,0 +1,43 @@
+From: Feras Daoud <ferasda@mellanox.com>
+Subject: net/mlx5e: IPoIB, Fix RX checksum statistics update
+Patch-mainline: v5.1-rc1
+Git-commit: 3d6f3cdf9bfe92c430674308db0f1c8655f2c11d
+References: git-fixes
+
+Update the RX checksum only if the feature is enabled.
+
+Fixes: 9d6bd752c63c ("net/mlx5e: IPoIB, RX handler")
+Signed-off-by: Feras Daoud <ferasda@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -1265,8 +1265,14 @@ static inline void mlx5i_complete_rx_cqe
+
+ skb->protocol = *((__be16 *)(skb->data));
+
+- skb->ip_summed = CHECKSUM_COMPLETE;
+- skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++ if (netdev->features & NETIF_F_RXCSUM) {
++ skb->ip_summed = CHECKSUM_COMPLETE;
++ skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++ rq->stats.csum_complete++;
++ } else {
++ skb->ip_summed = CHECKSUM_NONE;
++ rq->stats.csum_none++;
++ }
+
+ if (unlikely(mlx5e_rx_hw_stamp(tstamp)))
+ skb_hwtstamps(skb)->hwtstamp =
+@@ -1285,7 +1291,6 @@ static inline void mlx5i_complete_rx_cqe
+
+ skb->dev = netdev;
+
+- rq->stats.csum_complete++;
+ rq->stats.packets++;
+ rq->stats.bytes += cqe_bcnt;
+ }
diff --git a/patches.fixes/0001-nfp-bpf-fix-ALU32-high-bits-clearance-bug.patch b/patches.fixes/0001-nfp-bpf-fix-ALU32-high-bits-clearance-bug.patch
new file mode 100644
index 0000000000..06a03ed03b
--- /dev/null
+++ b/patches.fixes/0001-nfp-bpf-fix-ALU32-high-bits-clearance-bug.patch
@@ -0,0 +1,90 @@
+From: Jiong Wang <jiong.wang@netronome.com>
+Subject: nfp: bpf: fix ALU32 high bits clearance bug
+Patch-mainline: v5.0-rc8
+Git-commit: f036ebd9bfbe1e91a3d855e85e05fc5ff156b641
+References: git-fixes
+
+NFP BPF JIT compiler is doing a couple of small optimizations when jitting
+ALU imm instructions, some of these optimizations could save code-gen, for
+example:
+
+ A & -1 = A
+ A | 0 = A
+ A ^ 0 = A
+
+However, for ALU32, high 32-bit of the 64-bit register should still be
+cleared according to ISA semantics.
+
+Fixes: cd7df56ed3e6 ("nfp: add BPF to NFP code translator")
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/netronome/nfp/bpf/jit.c | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/netronome/nfp/bpf/jit.c
++++ b/drivers/net/ethernet/netronome/nfp/bpf/jit.c
+@@ -756,15 +756,10 @@ wrp_alu64_reg(struct nfp_prog *nfp_prog,
+
+ static int
+ wrp_alu32_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta,
+- enum alu_op alu_op, bool skip)
++ enum alu_op alu_op)
+ {
+ const struct bpf_insn *insn = &meta->insn;
+
+- if (skip) {
+- meta->skip = true;
+- return 0;
+- }
+-
+ wrp_alu_imm(nfp_prog, insn->dst_reg * 2, alu_op, insn->imm);
+ wrp_immed(nfp_prog, reg_both(insn->dst_reg * 2 + 1), 0);
+
+@@ -1017,7 +1012,7 @@ static int xor_reg(struct nfp_prog *nfp_
+
+ static int xor_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR, !~meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_XOR);
+ }
+
+ static int and_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -1027,7 +1022,7 @@ static int and_reg(struct nfp_prog *nfp_
+
+ static int and_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND, !~meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_AND);
+ }
+
+ static int or_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -1037,7 +1032,7 @@ static int or_reg(struct nfp_prog *nfp_p
+
+ static int or_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR, !meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_OR);
+ }
+
+ static int add_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -1047,7 +1042,7 @@ static int add_reg(struct nfp_prog *nfp_
+
+ static int add_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD, !meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_ADD);
+ }
+
+ static int sub_reg(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+@@ -1057,7 +1052,7 @@ static int sub_reg(struct nfp_prog *nfp_
+
+ static int sub_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
+ {
+- return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB, !meta->insn.imm);
++ return wrp_alu32_imm(nfp_prog, meta, ALU_OP_SUB);
+ }
+
+ static int shl_imm(struct nfp_prog *nfp_prog, struct nfp_insn_meta *meta)
diff --git a/patches.fixes/0001-pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch b/patches.fixes/0001-pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch
new file mode 100644
index 0000000000..0acf4ec8d1
--- /dev/null
+++ b/patches.fixes/0001-pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch
@@ -0,0 +1,43 @@
+From: Xin Long <lucien.xin@gmail.com>
+Subject: pptp: dst_release sk_dst_cache in pptp_sock_destruct
+Patch-mainline: v5.1-rc1
+Git-commit: 9417d81f4f8adfe20a12dd1fadf73a618cbd945d
+References: git-fixes
+
+sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect,
+so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct,
+otherwise, the dst refcnt will leak.
+
+It can be reproduced by this syz log:
+
+ r1 = socket$pptp(0x18, 0x1, 0x2)
+ bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e)
+ connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
+
+Consecutive dmesg warnings will occur:
+
+ unregister_netdevice: waiting for lo to become free. Usage count = 1
+
+v1->v2:
+ - use rcu_dereference_protected() instead of rcu_dereference_check(),
+ as suggested by Eric.
+
+Fixes: 00959ade36ac ("PPTP: PPP over IPv4 (Point-to-Point Tunneling Protocol)")
+Reported-by: Xiumei Mu <xmu@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ppp/pptp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -541,6 +541,7 @@ static void pptp_sock_destruct(struct so
+ pppox_unbind_sock(sk);
+ }
+ skb_queue_purge(&sk->sk_receive_queue);
++ dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
+ }
+
+ static int pptp_create(struct net *net, struct socket *sock, int kern)
diff --git a/patches.fixes/0001-vxlan-Fix-GRO-cells-race-condition-between-receive-a.patch b/patches.fixes/0001-vxlan-Fix-GRO-cells-race-condition-between-receive-a.patch
new file mode 100644
index 0000000000..99905e14fd
--- /dev/null
+++ b/patches.fixes/0001-vxlan-Fix-GRO-cells-race-condition-between-receive-a.patch
@@ -0,0 +1,50 @@
+From: Stefano Brivio <sbrivio@redhat.com>
+Subject: vxlan: Fix GRO cells race condition between receive and link delete
+Patch-mainline: v5.1-rc1
+Git-commit: ad6c9986bcb627c7c22b8f9e9a934becc27df87c
+References: git-fixes
+
+If we receive a packet while deleting a VXLAN device, there's a chance
+vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine,
+except that vxlan_dellink() should never ever touch stuff that's still in
+use, such as the GRO cells list.
+
+Otherwise, vxlan_rcv() crashes while queueing packets via
+gro_cells_receive().
+
+Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU
+grace period is elapsed and nothing needs the gro_cells anymore.
+
+This is now done in the same way as commit 8e816df87997 ("geneve: Use GRO
+cells infrastructure.") originally implemented for GENEVE.
+
+Reported-by: Jianlin Shi <jishi@redhat.com>
+Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/vxlan.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2451,6 +2451,8 @@ static void vxlan_uninit(struct net_devi
+ {
+ struct vxlan_dev *vxlan = netdev_priv(dev);
+
++ gro_cells_destroy(&vxlan->gro_cells);
++
+ vxlan_fdb_delete_default(vxlan, vxlan->cfg.vni);
+
+ free_percpu(dev->tstats);
+@@ -3383,7 +3385,6 @@ static void vxlan_dellink(struct net_dev
+
+ vxlan_flush(vxlan, true);
+
+- gro_cells_destroy(&vxlan->gro_cells);
+ list_del(&vxlan->next);
+ unregister_netdevice_queue(dev, head);
+ }
diff --git a/patches.fixes/0001-vxlan-test-dev-flags-IFF_UP-before-calling-gro_cells.patch b/patches.fixes/0001-vxlan-test-dev-flags-IFF_UP-before-calling-gro_cells.patch
new file mode 100644
index 0000000000..52df35d732
--- /dev/null
+++ b/patches.fixes/0001-vxlan-test-dev-flags-IFF_UP-before-calling-gro_cells.patch
@@ -0,0 +1,64 @@
+From: Eric Dumazet <edumazet@google.com>
+Subject: vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
+Patch-mainline: v5.1-rc1
+Git-commit: 59cbf56fcd98ba2a715b6e97c4e43f773f956393
+References: git-fixes
+
+Same reasons than the ones explained in commit 4179cb5a4c92
+("vxlan: test dev->flags & IFF_UP before calling netif_rx()")
+
+netif_rx() or gro_cells_receive() must be called under a strict contract.
+
+At device dismantle phase, core networking clears IFF_UP
+and flush_all_backlogs() is called after rcu grace period
+to make sure no incoming packet might be in a cpu backlog
+and still referencing the device.
+
+A similar protocol is used for gro_cells infrastructure, as
+gro_cells_destroy() will be called only after a full rcu
+grace period is observed after IFF_UP has been cleared.
+
+Most drivers call netif_rx() from their interrupt handler,
+and since the interrupts are disabled at device dismantle,
+netif_rx() does not have to check dev->flags & IFF_UP
+
+Virtual drivers do not have this guarantee, and must
+therefore make the check themselves.
+
+Otherwise we risk use-after-free and/or crashes.
+
+Fixes: d342894c5d2f ("vxlan: virtual extensible lan")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/vxlan.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1457,6 +1457,14 @@ static int vxlan_rcv(struct sock *sk, st
+ goto drop;
+ }
+
++ rcu_read_lock();
++
++ if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
++ rcu_read_unlock();
++ atomic_long_inc(&vxlan->dev->rx_dropped);
++ goto drop;
++ }
++
+ stats = this_cpu_ptr(vxlan->dev->tstats);
+ u64_stats_update_begin(&stats->syncp);
+ stats->rx_packets++;
+@@ -1464,6 +1472,9 @@ static int vxlan_rcv(struct sock *sk, st
+ u64_stats_update_end(&stats->syncp);
+
+ gro_cells_receive(&vxlan->gro_cells, skb);
++
++ rcu_read_unlock();
++
+ return 0;
+
+ drop:
diff --git a/patches.fixes/9p-net-fix-memory-leak-in-p9_client_create.patch b/patches.fixes/9p-net-fix-memory-leak-in-p9_client_create.patch
new file mode 100644
index 0000000000..40cd016034
--- /dev/null
+++ b/patches.fixes/9p-net-fix-memory-leak-in-p9_client_create.patch
@@ -0,0 +1,39 @@
+From bb06c388fa20ae24cfe80c52488de718a7e3a53f Mon Sep 17 00:00:00 2001
+From: zhengbin <zhengbin13@huawei.com>
+Date: Wed, 13 Mar 2019 16:01:37 +0800
+Subject: [PATCH] 9p/net: fix memory leak in p9_client_create
+Git-commit: bb06c388fa20ae24cfe80c52488de718a7e3a53f
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+If msize is less than 4096, we should close and put trans, destroy
+tagpool, not just free client. This patch fixes that.
+
+Link: http://lkml.kernel.org/m/1552464097-142659-1-git-send-email-zhengbin13@huawei.com
+Cc: stable@vger.kernel.org
+Fixes: 574d356b7a02 ("9p/net: put a lower bound on msize")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/9p/client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/9p/client.c b/net/9p/client.c
+index 357214a51f13..b85d51f4b8eb 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -1061,7 +1061,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
+ p9_debug(P9_DEBUG_ERROR,
+ "Please specify a msize of at least 4k\n");
+ err = -EINVAL;
+- goto free_client;
++ goto close_trans;
+ }
+
+ err = p9_client_version(clnt);
+--
+2.16.4
+
diff --git a/patches.fixes/9p-use-inode-i_lock-to-protect-i_size_write-under-32.patch b/patches.fixes/9p-use-inode-i_lock-to-protect-i_size_write-under-32.patch
new file mode 100644
index 0000000000..f3bb80d00c
--- /dev/null
+++ b/patches.fixes/9p-use-inode-i_lock-to-protect-i_size_write-under-32.patch
@@ -0,0 +1,331 @@
+From 5e3cc1ee1405a7eb3487ed24f786dec01b4cbe1f Mon Sep 17 00:00:00 2001
+From: Hou Tao <houtao1@huawei.com>
+Date: Thu, 24 Jan 2019 14:35:13 +0800
+Subject: [PATCH] 9p: use inode->i_lock to protect i_size_write() under 32-bit
+Git-commit: 5e3cc1ee1405a7eb3487ed24f786dec01b4cbe1f
+Patch-mainline: v5.1-rc1
+References: bsc#1051510
+
+Use inode->i_lock to protect i_size_write(), else i_size_read() in
+generic_fillattr() may loop infinitely in read_seqcount_begin() when
+multiple processes invoke v9fs_vfs_getattr() or v9fs_vfs_getattr_dotl()
+simultaneously under 32-bit SMP environment, and a soft lockup will be
+triggered as show below:
+
+ watchdog: BUG: soft lockup - CPU#5 stuck for 22s! [stat:2217]
+ Modules linked in:
+ CPU: 5 PID: 2217 Comm: stat Not tainted 5.0.0-rc1-00005-g7f702faf5a9e #4
+ Hardware name: Generic DT based system
+ PC is at generic_fillattr+0x104/0x108
+ LR is at 0xec497f00
+ pc : [<802b8898>] lr : [<ec497f00>] psr: 200c0013
+ sp : ec497e20 ip : ed608030 fp : ec497e3c
+ r10: 00000000 r9 : ec497f00 r8 : ed608030
+ r7 : ec497ebc r6 : ec497f00 r5 : ee5c1550 r4 : ee005780
+ r3 : 0000052d r2 : 00000000 r1 : ec497f00 r0 : ed608030
+ Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+ Control: 10c5387d Table: ac48006a DAC: 00000051
+ CPU: 5 PID: 2217 Comm: stat Not tainted 5.0.0-rc1-00005-g7f702faf5a9e #4
+ Hardware name: Generic DT based system
+ Backtrace:
+ [<8010d974>] (dump_backtrace) from [<8010dc88>] (show_stack+0x20/0x24)
+ [<8010dc68>] (show_stack) from [<80a1d194>] (dump_stack+0xb0/0xdc)
+ [<80a1d0e4>] (dump_stack) from [<80109f34>] (show_regs+0x1c/0x20)
+ [<80109f18>] (show_regs) from [<801d0a80>] (watchdog_timer_fn+0x280/0x2f8)
+ [<801d0800>] (watchdog_timer_fn) from [<80198658>] (__hrtimer_run_queues+0x18c/0x380)
+ [<801984cc>] (__hrtimer_run_queues) from [<80198e60>] (hrtimer_run_queues+0xb8/0xf0)
+ [<80198da8>] (hrtimer_run_queues) from [<801973e8>] (run_local_timers+0x28/0x64)
+ [<801973c0>] (run_local_timers) from [<80197460>] (update_process_times+0x3c/0x6c)
+ [<80197424>] (update_process_times) from [<801ab2b8>] (tick_nohz_handler+0xe0/0x1bc)
+ [<801ab1d8>] (tick_nohz_handler) from [<80843050>] (arch_timer_handler_virt+0x38/0x48)
+ [<80843018>] (arch_timer_handler_virt) from [<80180a64>] (handle_percpu_devid_irq+0x8c/0x240)
+ [<801809d8>] (handle_percpu_devid_irq) from [<8017ac20>] (generic_handle_irq+0x34/0x44)
+ [<8017abec>] (generic_handle_irq) from [<8017b344>] (__handle_domain_irq+0x6c/0xc4)
+ [<8017b2d8>] (__handle_domain_irq) from [<801022e0>] (gic_handle_irq+0x4c/0x88)
+ [<80102294>] (gic_handle_irq) from [<80101a30>] (__irq_svc+0x70/0x98)
+ [<802b8794>] (generic_fillattr) from [<8056b284>] (v9fs_vfs_getattr_dotl+0x74/0xa4)
+ [<8056b210>] (v9fs_vfs_getattr_dotl) from [<802b8904>] (vfs_getattr_nosec+0x68/0x7c)
+ [<802b889c>] (vfs_getattr_nosec) from [<802b895c>] (vfs_getattr+0x44/0x48)
+ [<802b8918>] (vfs_getattr) from [<802b8a74>] (vfs_statx+0x9c/0xec)
+ [<802b89d8>] (vfs_statx) from [<802b9428>] (sys_lstat64+0x48/0x78)
+ [<802b93e0>] (sys_lstat64) from [<80101000>] (ret_fast_syscall+0x0/0x28)
+
+[dominique.martinet@cea.fr: updated comment to not refer to a function
+in another subsystem]
+
+Link: http://lkml.kernel.org/r/20190124063514.8571-2-houtao1@huawei.com
+Cc: stable@vger.kernel.org
+Fixes: 7549ae3e81cc ("9p: Use the i_size_[read, write]() macros instead of using inode->i_size directly.")
+Reported-by: Xing Gaopeng <xingaopeng@huawei.com>
+Signed-off-by: Hou Tao <houtao1@huawei.com>
+Signed-off-by: Dominique Martinet <dominique.martinet@cea.fr>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ fs/9p/v9fs_vfs.h | 23 +++++++++++++++++++++--
+ fs/9p/vfs_file.c | 6 +++++-
+ fs/9p/vfs_inode.c | 23 +++++++++++------------
+ fs/9p/vfs_inode_dotl.c | 27 ++++++++++++++-------------
+ fs/9p/vfs_super.c | 4 ++--
+ 5 files changed, 53 insertions(+), 30 deletions(-)
+
+diff --git a/fs/9p/v9fs_vfs.h b/fs/9p/v9fs_vfs.h
+index 5a0db6dec8d1..aaee1e6584e6 100644
+--- a/fs/9p/v9fs_vfs.h
++++ b/fs/9p/v9fs_vfs.h
+@@ -40,6 +40,9 @@
+ */
+ #define P9_LOCK_TIMEOUT (30*HZ)
+
++/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */
++#define V9FS_STAT2INODE_KEEP_ISIZE 1
++
+ extern struct file_system_type v9fs_fs_type;
+ extern const struct address_space_operations v9fs_addr_operations;
+ extern const struct file_operations v9fs_file_operations;
+@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_info *v9ses,
+ struct inode *inode, umode_t mode, dev_t);
+ void v9fs_evict_inode(struct inode *inode);
+ ino_t v9fs_qid2ino(struct p9_qid *qid);
+-void v9fs_stat2inode(struct p9_wstat *, struct inode *, struct super_block *);
+-void v9fs_stat2inode_dotl(struct p9_stat_dotl *, struct inode *);
++void v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
++ struct super_block *sb, unsigned int flags);
++void v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
++ unsigned int flags);
+ int v9fs_dir_release(struct inode *inode, struct file *filp);
+ int v9fs_file_open(struct inode *inode, struct file *file);
+ void v9fs_inode2stat(struct inode *inode, struct p9_wstat *stat);
+@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode_attr(struct inode *inode)
+ }
+
+ int v9fs_open_to_dotl_flags(int flags);
++
++static inline void v9fs_i_size_write(struct inode *inode, loff_t i_size)
++{
++ /*
++ * 32-bit need the lock, concurrent updates could break the
++ * sequences and make i_size_read() loop forever.
++ * 64-bit updates are atomic and can skip the locking.
++ */
++ if (sizeof(i_size) > sizeof(long))
++ spin_lock(&inode->i_lock);
++ i_size_write(inode, i_size);
++ if (sizeof(i_size) > sizeof(long))
++ spin_unlock(&inode->i_lock);
++}
+ #endif
+diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
+index a25efa782fcc..9a1125305d84 100644
+--- a/fs/9p/vfs_file.c
++++ b/fs/9p/vfs_file.c
+@@ -446,7 +446,11 @@ v9fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
+ i_size = i_size_read(inode);
+ if (iocb->ki_pos > i_size) {
+ inode_add_bytes(inode, iocb->ki_pos - i_size);
+- i_size_write(inode, iocb->ki_pos);
++ /*
++ * Need to serialize against i_size_write() in
++ * v9fs_stat2inode()
++ */
++ v9fs_i_size_write(inode, iocb->ki_pos);
+ }
+ return retval;
+ }
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 85ff859d3af5..72b779bc0942 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
+ if (retval)
+ goto error;
+
+- v9fs_stat2inode(st, inode, sb);
++ v9fs_stat2inode(st, inode, sb, 0);
+ v9fs_cache_inode_get_cookie(inode);
+ unlock_new_inode(inode);
+ return inode;
+@@ -1092,7 +1092,7 @@ v9fs_vfs_getattr(const struct path *path, struct kstat *stat,
+ if (IS_ERR(st))
+ return PTR_ERR(st);
+
+- v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb);
++ v9fs_stat2inode(st, d_inode(dentry), dentry->d_sb, 0);
+ generic_fillattr(d_inode(dentry), stat);
+
+ p9stat_free(st);
+@@ -1170,12 +1170,13 @@ static int v9fs_vfs_setattr(struct dentry *dentry, struct iattr *iattr)
+ * @stat: Plan 9 metadata (mistat) structure
+ * @inode: inode to populate
+ * @sb: superblock of filesystem
++ * @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE)
+ *
+ */
+
+ void
+ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
+- struct super_block *sb)
++ struct super_block *sb, unsigned int flags)
+ {
+ umode_t mode;
+ char ext[32];
+@@ -1216,10 +1217,11 @@ v9fs_stat2inode(struct p9_wstat *stat, struct inode *inode,
+ mode = p9mode2perm(v9ses, stat);
+ mode |= inode->i_mode & ~S_IALLUGO;
+ inode->i_mode = mode;
+- i_size_write(inode, stat->length);
+
++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE))
++ v9fs_i_size_write(inode, stat->length);
+ /* not real number of blocks, but 512 byte ones ... */
+- inode->i_blocks = (i_size_read(inode) + 512 - 1) >> 9;
++ inode->i_blocks = (stat->length + 512 - 1) >> 9;
+ v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR;
+ }
+
+@@ -1416,9 +1418,9 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
+ {
+ int umode;
+ dev_t rdev;
+- loff_t i_size;
+ struct p9_wstat *st;
+ struct v9fs_session_info *v9ses;
++ unsigned int flags;
+
+ v9ses = v9fs_inode2v9ses(inode);
+ st = p9_client_stat(fid);
+@@ -1431,16 +1433,13 @@ int v9fs_refresh_inode(struct p9_fid *fid, struct inode *inode)
+ if ((inode->i_mode & S_IFMT) != (umode & S_IFMT))
+ goto out;
+
+- spin_lock(&inode->i_lock);
+ /*
+ * We don't want to refresh inode->i_size,
+ * because we may have cached data
+ */
+- i_size = inode->i_size;
+- v9fs_stat2inode(st, inode, inode->i_sb);
+- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE)
+- inode->i_size = i_size;
+- spin_unlock(&inode->i_lock);
++ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ?
++ V9FS_STAT2INODE_KEEP_ISIZE : 0;
++ v9fs_stat2inode(st, inode, inode->i_sb, flags);
+ out:
+ p9stat_free(st);
+ kfree(st);
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index 4823e1c46999..a950a927a626 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
+ if (retval)
+ goto error;
+
+- v9fs_stat2inode_dotl(st, inode);
++ v9fs_stat2inode_dotl(st, inode, 0);
+ v9fs_cache_inode_get_cookie(inode);
+ retval = v9fs_get_acl(inode, fid);
+ if (retval)
+@@ -496,7 +496,7 @@ v9fs_vfs_getattr_dotl(const struct path *path, struct kstat *stat,
+ if (IS_ERR(st))
+ return PTR_ERR(st);
+
+- v9fs_stat2inode_dotl(st, d_inode(dentry));
++ v9fs_stat2inode_dotl(st, d_inode(dentry), 0);
+ generic_fillattr(d_inode(dentry), stat);
+ /* Change block size to what the server returned */
+ stat->blksize = st->st_blksize;
+@@ -607,11 +607,13 @@ int v9fs_vfs_setattr_dotl(struct dentry *dentry, struct iattr *iattr)
+ * v9fs_stat2inode_dotl - populate an inode structure with stat info
+ * @stat: stat structure
+ * @inode: inode to populate
++ * @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE)
+ *
+ */
+
+ void
+-v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
++v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode,
++ unsigned int flags)
+ {
+ umode_t mode;
+ struct v9fs_inode *v9inode = V9FS_I(inode);
+@@ -631,7 +633,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
+ mode |= inode->i_mode & ~S_IALLUGO;
+ inode->i_mode = mode;
+
+- i_size_write(inode, stat->st_size);
++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE))
++ v9fs_i_size_write(inode, stat->st_size);
+ inode->i_blocks = stat->st_blocks;
+ } else {
+ if (stat->st_result_mask & P9_STATS_ATIME) {
+@@ -661,8 +664,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl *stat, struct inode *inode)
+ }
+ if (stat->st_result_mask & P9_STATS_RDEV)
+ inode->i_rdev = new_decode_dev(stat->st_rdev);
+- if (stat->st_result_mask & P9_STATS_SIZE)
+- i_size_write(inode, stat->st_size);
++ if (!(flags & V9FS_STAT2INODE_KEEP_ISIZE) &&
++ stat->st_result_mask & P9_STATS_SIZE)
++ v9fs_i_size_write(inode, stat->st_size);
+ if (stat->st_result_mask & P9_STATS_BLOCKS)
+ inode->i_blocks = stat->st_blocks;
+ }
+@@ -928,9 +932,9 @@ v9fs_vfs_get_link_dotl(struct dentry *dentry,
+
+ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
+ {
+- loff_t i_size;
+ struct p9_stat_dotl *st;
+ struct v9fs_session_info *v9ses;
++ unsigned int flags;
+
+ v9ses = v9fs_inode2v9ses(inode);
+ st = p9_client_getattr_dotl(fid, P9_STATS_ALL);
+@@ -942,16 +946,13 @@ int v9fs_refresh_inode_dotl(struct p9_fid *fid, struct inode *inode)
+ if ((inode->i_mode & S_IFMT) != (st->st_mode & S_IFMT))
+ goto out;
+
+- spin_lock(&inode->i_lock);
+ /*
+ * We don't want to refresh inode->i_size,
+ * because we may have cached data
+ */
+- i_size = inode->i_size;
+- v9fs_stat2inode_dotl(st, inode);
+- if (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE)
+- inode->i_size = i_size;
+- spin_unlock(&inode->i_lock);
++ flags = (v9ses->cache == CACHE_LOOSE || v9ses->cache == CACHE_FSCACHE) ?
++ V9FS_STAT2INODE_KEEP_ISIZE : 0;
++ v9fs_stat2inode_dotl(st, inode, flags);
+ out:
+ kfree(st);
+ return 0;
+diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
+index 48ce50484e80..eeab9953af89 100644
+--- a/fs/9p/vfs_super.c
++++ b/fs/9p/vfs_super.c
+@@ -172,7 +172,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
+ goto release_sb;
+ }
+ d_inode(root)->i_ino = v9fs_qid2ino(&st->qid);
+- v9fs_stat2inode_dotl(st, d_inode(root));
++ v9fs_stat2inode_dotl(st, d_inode(root), 0);
+ kfree(st);
+ } else {
+ struct p9_wstat *st = NULL;
+@@ -183,7 +183,7 @@ static struct dentry *v9fs_mount(struct file_system_type *fs_type, int flags,
+ }
+
+ d_inode(root)->i_ino = v9fs_qid2ino(&st->qid);
+- v9fs_stat2inode(st, d_inode(root), sb);
++ v9fs_stat2inode(st, d_inode(root), sb, 0);
+
+ p9stat_free(st);
+ kfree(st);
+--
+2.16.4
+
diff --git a/patches.fixes/fsdcache-Fix-incorrect-nr_dentry_unused-accounting-in-shrink_dcache_sb.patch b/patches.fixes/fsdcache-Fix-incorrect-nr_dentry_unused-accounting-in-shrink_dcache_sb.patch
new file mode 100644
index 0000000000..315e3d9154
--- /dev/null
+++ b/patches.fixes/fsdcache-Fix-incorrect-nr_dentry_unused-accounting-in-shrink_dcache_sb.patch
@@ -0,0 +1,48 @@
+From 1dbd449c9943e3145148cc893c2461b72ba6fef0 Mon Sep 17 00:00:00 2001
+From: Waiman Long <longman@redhat.com>
+Date: Wed Jan 30 13:52:36 2019 -0500
+Subject: [PATCH] fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
+Git-commit: 1dbd449c9943e3145148cc893c2461b72ba6fef0
+References: git-fixes
+Patch-mainline: v5.0-rc5
+
+The nr_dentry_unused per-cpu counter tracks dentries in both the LRU
+lists and the shrink lists where the DCACHE_LRU_LIST bit is set.
+
+The shrink_dcache_sb() function moves dentries from the LRU list to a
+shrink list and subtracts the dentry count from nr_dentry_unused. This
+is incorrect as the nr_dentry_unused count will also be decremented in
+shrink_dentry_list() via d_shrink_del().
+
+To fix this double decrement, the decrement in the shrink_dcache_sb()
+function is taken out.
+
+Fixes: 4e717f5c1083 ("list_lru: remove special case function list_lru_dispose_all."
+Cc: stable@kernel.org
+Signed-off-by: Waiman Long <longman@redhat.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 2593153..44e5652 100644
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1188,15 +1188,11 @@ static enum lru_status dentry_lru_isolate_shrink(struct list_head *item,
+ */
+ void shrink_dcache_sb(struct super_block *sb)
+ {
+- long freed;
+-
+ do {
+ LIST_HEAD(dispose);
+
+- freed = list_lru_walk(&sb->s_dentry_lru,
++ list_lru_walk(&sb->s_dentry_lru,
+ dentry_lru_isolate_shrink, &dispose, 1024);
+-
+- this_cpu_sub(nr_dentry_unused, freed);
+ shrink_dentry_list(&dispose);
+ } while (list_lru_count(&sb->s_dentry_lru) > 0);
+ }
diff --git a/patches.fixes/fsdevpts-always-delete-dcache-dentry-s-in-dput.patch b/patches.fixes/fsdevpts-always-delete-dcache-dentry-s-in-dput.patch
new file mode 100644
index 0000000000..b1cae97955
--- /dev/null
+++ b/patches.fixes/fsdevpts-always-delete-dcache-dentry-s-in-dput.patch
@@ -0,0 +1,78 @@
+From 73052b0daee0b750b39af18460dfec683e4f5887 Mon Sep 17 00:00:00 2001
+From: Varad Gautam <vrd@amazon.de>
+Date: Thu Jan 24 14:03:06 2019 +0100
+Subject: [PATCH] fs/devpts: always delete dcache dentry-s in dput()
+Git-commit: 73052b0daee0b750b39af18460dfec683e4f5887
+References: git-fixes
+Patch-mainline: v5.1-rc1
+
+d_delete only unhashes an entry if it is reached with
+dentry->d_lockref.count != 1. Prior to commit 8ead9dd54716 ("devpts:
+more pty driver interface cleanups"), d_delete was called on a dentry
+from devpts_pty_kill with two references held, which would trigger the
+unhashing, and the subsequent dputs would release it.
+
+Commit 8ead9dd54716 reworked devpts_pty_kill to stop acquiring the second
+reference from d_find_alias, and the d_delete call left the dentries
+still on the hashed list without actually ever being dropped from dcache
+before explicit cleanup. This causes the number of negative dentries for
+devpts to pile up, and an `ls /dev/pts` invocation can take seconds to
+return.
+
+Provide always_delete_dentry() from simple_dentry_operations
+as .d_delete for devpts, to make the dentry be dropped from dcache.
+
+Without this cleanup, the number of dentries in /dev/pts/ can be grown
+arbitrarily as:
+
+`python -c 'import pty; pty.spawn(["ls", "/dev/pts"])'`
+
+A systemtap probe on dcache_readdir to count d_subdirs shows this count
+to increase with each pty spawn invocation above:
+
+probe kernel.function("dcache_readdir") {
+ subdirs = &@cast($file->f_path->dentry, "dentry")->d_subdirs;
+ p = subdirs;
+ p = @cast(p, "list_head")->next;
+ i = 0
+ while (p != subdirs) {
+ p = @cast(p, "list_head")->next;
+ i = i+1;
+ }
+ printf("number of dentries: %d\n", i);
+}
+
+Fixes: 8ead9dd54716 ("devpts: more pty driver interface cleanups")
+Signed-off-by: Varad Gautam <vrd@amazon.de>
+Reported-by: Zheng Wang <wanz@amazon.de>
+Reported-by: Brandon Schwartz <bsschwar@amazon.de>
+Root-caused-by: Maximilian Heyne <mheyne@amazon.de>
+Root-caused-by: Nicolas Pernas Maradei <npernas@amazon.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Maximilian Heyne <mheyne@amazon.de>
+Cc: Stefan Nuernberger <snu@amazon.de>
+Cc: Amit Shah <aams@amazon.de>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: Al Viro <viro@ZenIV.linux.org.uk>
+Cc: Christian Brauner <christian.brauner@ubuntu.com>
+Cc: Eric W. Biederman <ebiederm@xmission.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Eric Biggers <ebiggers@google.com>
+Cc: <stable@vger.kernel.org> # 4.9+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+
+diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
+index c538145..553a3f3 100644
+
+--- a/fs/devpts/inode.c
++++ b/fs/devpts/inode.c
+@@ -455,6 +455,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
+ s->s_blocksize_bits = 10;
+ s->s_magic = DEVPTS_SUPER_MAGIC;
+ s->s_op = &devpts_sops;
++ s->s_d_op = &simple_dentry_operations;
+ s->s_time_gran = 1;
+
+ error = -ENOMEM;
diff --git a/patches.fixes/libnvdimm-label-clear-updating-flag-after-label-set-update.patch b/patches.fixes/libnvdimm-label-clear-updating-flag-after-label-set-update.patch
new file mode 100644
index 0000000000..67af450a7e
--- /dev/null
+++ b/patches.fixes/libnvdimm-label-clear-updating-flag-after-label-set-update.patch
@@ -0,0 +1,97 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 15 Jan 2019 10:47:00 -0800
+Subject: libnvdimm/label: Clear 'updating' flag after label-set update
+Git-commit: 966d23a006ca7b44ac8cf4d0c96b19785e0c3da0
+Patch-mainline: v5.1-rc1
+References: bsc#1129543
+
+The UEFI 2.7 specification sets expectations that the 'updating' flag is
+eventually cleared. To date, the libnvdimm core has never adhered to
+that protocol. The policy of the core matches the policy of other
+multi-device info-block formats like MD-Software-RAID that expect
+administrator intervention on inconsistent info-blocks, not automatic
+invalidation.
+
+However, some pre-boot environments may unfortunately attempt to "clean
+up" the labels and invalidate a set when it fails to find at least one
+"non-updating" label in the set. Clear the updating flag after set
+updates to minimize the window of vulnerability to aggressive pre-boot
+environments.
+
+Ideally implementations would not write to the label area outside of
+creating namespaces.
+
+Note that this only minimizes the window, it does not close it as the
+system can still crash while clearing the flag and the set can be
+subsequently deleted / invalidated by the pre-boot environment.
+
+Fixes: f524bf271a5c ("libnvdimm: write pmem label set")
+Cc: <stable@vger.kernel.org>
+Cc: Kelly Couch <kelly.j.couch@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/label.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c
+index a11bf4e6b451..6d6e9a12150b 100644
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -755,7 +755,7 @@ static const guid_t *to_abstraction_guid(enum nvdimm_claim_class claim_class,
+
+ static int __pmem_label_update(struct nd_region *nd_region,
+ struct nd_mapping *nd_mapping, struct nd_namespace_pmem *nspm,
+- int pos)
++ int pos, unsigned long flags)
+ {
+ struct nd_namespace_common *ndns = &nspm->nsio.common;
+ struct nd_interleave_set *nd_set = nd_region->nd_set;
+@@ -796,7 +796,7 @@ static int __pmem_label_update(struct nd_region *nd_region,
+ memcpy(nd_label->uuid, nspm->uuid, NSLABEL_UUID_LEN);
+ if (nspm->alt_name)
+ memcpy(nd_label->name, nspm->alt_name, NSLABEL_NAME_LEN);
+- nd_label->flags = __cpu_to_le32(NSLABEL_FLAG_UPDATING);
++ nd_label->flags = __cpu_to_le32(flags);
+ nd_label->nlabel = __cpu_to_le16(nd_region->ndr_mappings);
+ nd_label->position = __cpu_to_le16(pos);
+ nd_label->isetcookie = __cpu_to_le64(cookie);
+@@ -1249,13 +1249,13 @@ static int del_labels(struct nd_mapping *nd_mapping, u8 *uuid)
+ int nd_pmem_namespace_label_update(struct nd_region *nd_region,
+ struct nd_namespace_pmem *nspm, resource_size_t size)
+ {
+- int i;
++ int i, rc;
+
+ for (i = 0; i < nd_region->ndr_mappings; i++) {
+ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+ struct resource *res;
+- int rc, count = 0;
++ int count = 0;
+
+ if (size == 0) {
+ rc = del_labels(nd_mapping, nspm->uuid);
+@@ -1273,7 +1273,20 @@ int nd_pmem_namespace_label_update(struct nd_region *nd_region,
+ if (rc < 0)
+ return rc;
+
+- rc = __pmem_label_update(nd_region, nd_mapping, nspm, i);
++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i,
++ NSLABEL_FLAG_UPDATING);
++ if (rc)
++ return rc;
++ }
++
++ if (size == 0)
++ return 0;
++
++ /* Clear the UPDATING flag per UEFI 2.7 expectations */
++ for (i = 0; i < nd_region->ndr_mappings; i++) {
++ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
++
++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i, 0);
+ if (rc)
+ return rc;
+ }
+
diff --git a/patches.fixes/libnvdimm-pmem-honor-force_raw-for-legacy-pmem-regions.patch b/patches.fixes/libnvdimm-pmem-honor-force_raw-for-legacy-pmem-regions.patch
new file mode 100644
index 0000000000..481fdc3ac5
--- /dev/null
+++ b/patches.fixes/libnvdimm-pmem-honor-force_raw-for-legacy-pmem-regions.patch
@@ -0,0 +1,46 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 24 Jan 2019 17:33:06 -0800
+Subject: libnvdimm/pmem: Honor force_raw for legacy pmem regions
+Git-commit: fa7d2e639cd90442d868dfc6ca1d4cc9d8bf206e
+Patch-mainline: v5.1-rc1
+References: bsc#1129551
+
+For recovery, where non-dax access is needed to a given physical address
+range, and testing, allow the 'force_raw' attribute to override the
+default establishment of a dev_pagemap.
+
+Otherwise without this capability it is possible to end up with a
+namespace that can not be activated due to corrupted info-block, and one
+that can not be repaired due to a section collision.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 004f1afbe199 ("libnvdimm, pmem: direct map legacy pmem by default")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/nvdimm/namespace_devs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
+index 4b077555ac70..33a3b23b3db7 100644
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -138,6 +138,7 @@ bool nd_is_uuid_unique(struct device *dev, u8 *uuid)
+ bool pmem_should_map_pages(struct device *dev)
+ {
+ struct nd_region *nd_region = to_nd_region(dev->parent);
++ struct nd_namespace_common *ndns = to_ndns(dev);
+ struct nd_namespace_io *nsio;
+
+ if (!IS_ENABLED(CONFIG_ZONE_DEVICE))
+@@ -149,6 +150,9 @@ bool pmem_should_map_pages(struct device *dev)
+ if (is_nd_pfn(dev) || is_nd_btt(dev))
+ return false;
+
++ if (ndns->force_raw)
++ return false;
++
+ nsio = to_nd_namespace_io(dev);
+ if (region_intersects(nsio->res.start, resource_size(&nsio->res),
+ IORESOURCE_SYSTEM_RAM,
+
diff --git a/patches.fixes/nfit-acpi_nfit_ctl-check-out_obj-type-in-the-right-place.patch b/patches.fixes/nfit-acpi_nfit_ctl-check-out_obj-type-in-the-right-place.patch
new file mode 100644
index 0000000000..9e09327b00
--- /dev/null
+++ b/patches.fixes/nfit-acpi_nfit_ctl-check-out_obj-type-in-the-right-place.patch
@@ -0,0 +1,52 @@
+From: Dexuan Cui <decui@microsoft.com>
+Date: Wed, 30 Jan 2019 01:23:01 +0000
+Subject: nfit: acpi_nfit_ctl(): Check out_obj->type in the right place
+Git-commit: 43f89877f26671c6309cd87d7364b1a3e66e71cf
+Patch-mainline: v5.1-rc1
+References: bsc#1129547
+
+In the case of ND_CMD_CALL, we should also check out_obj->type.
+
+The patch uses out_obj->type, which is a short alias to
+out_obj->package.type.
+
+Fixes: 31eca76ba2fc ("nfit, libnvdimm: limited/whitelisted dimm command marshaling mechanism")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dexuan Cui <decui@microsoft.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/acpi/nfit/core.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -537,6 +537,13 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ return -EINVAL;
+ }
+
++ if (out_obj->type != ACPI_TYPE_BUFFER) {
++ dev_dbg(dev, "%s unexpected output object type cmd: %s type: %d\n",
++ dimm_name, cmd_name, out_obj->type);
++ rc = -EINVAL;
++ goto out;
++ }
++
+ if (call_pkg) {
+ call_pkg->nd_fw_size = out_obj->buffer.length;
+ memcpy(call_pkg->nd_payload + call_pkg->nd_size_in,
+@@ -555,13 +562,6 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
+ return 0;
+ }
+
+- if (out_obj->package.type != ACPI_TYPE_BUFFER) {
+- dev_dbg(dev, "%s:%s unexpected output object type cmd: %s type: %d\n",
+- __func__, dimm_name, cmd_name, out_obj->type);
+- rc = -EINVAL;
+- goto out;
+- }
+-
+ dev_dbg(dev, "%s:%s cmd: %s output length: %d\n", __func__, dimm_name,
+ cmd_name, out_obj->buffer.length);
+ print_hex_dump_debug(cmd_name, DUMP_PREFIX_OFFSET, 4, 4,
+
diff --git a/patches.fixes/nvme-flush-namespace-scanning-work-just-before-remov.patch b/patches.fixes/nvme-flush-namespace-scanning-work-just-before-remov.patch
new file mode 100644
index 0000000000..cb7ae897b0
--- /dev/null
+++ b/patches.fixes/nvme-flush-namespace-scanning-work-just-before-remov.patch
@@ -0,0 +1,54 @@
+From: Sagi Grimberg <sagi@grimberg.me>
+Date: Wed, 21 Nov 2018 15:17:37 -0800
+Subject: [PATCH] nvme: flush namespace scanning work just before removing
+ namespaces
+Git-commit: f6c8e432cb0479255322c5d0335b9f1699a0270c
+Patch-Mainline: v4.20-rc5
+References: bsc#1108101
+
+nvme_stop_ctrl can be called also for reset flow and there is no need to
+flush the scan_work as namespaces are not being removed. This can cause
+deadlock in rdma, fc and loop drivers since nvme_stop_ctrl barriers
+before controller teardown (and specifically I/O cancellation of the
+scan_work itself) takes place, but the scan_work will be blocked anyways
+so there is no need to flush it.
+
+Instead, move scan_work flush to nvme_remove_namespaces() where it really
+needs to flush.
+
+Reported-by: Ming Lei <ming.lei@redhat.com>
+Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
+Reviewed-by: Keith Busch <keith.busch@intel.com>
+Reviewed by: James Smart <jsmart2021@gmail.com>
+Tested-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Hannes Reinecke <hare@suse.com>
+---
+ drivers/nvme/host/core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index bb39b91253c2..3cf1b773158e 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -3314,6 +3314,9 @@ void nvme_remove_namespaces(struct nvme_ctrl *ctrl)
+ {
+ struct nvme_ns *ns, *next;
+
++ /* prevent racing with ns scanning */
++ flush_work(&ctrl->scan_work);
++
+ /*
+ * The dead states indicates the controller was not gracefully
+ * disconnected. In that case, we won't be able to flush any data while
+@@ -3476,7 +3479,6 @@ void nvme_stop_ctrl(struct nvme_ctrl *ctrl)
+ nvme_mpath_stop(ctrl);
+ nvme_stop_keep_alive(ctrl);
+ flush_work(&ctrl->async_event_work);
+- flush_work(&ctrl->scan_work);
+ cancel_work_sync(&ctrl->fw_act_work);
+ }
+ EXPORT_SYMBOL_GPL(nvme_stop_ctrl);
+--
+2.16.4
+
diff --git a/patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch b/patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch
index eed3476854..8dea76fd35 100644
--- a/patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch
+++ b/patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch
@@ -1,7 +1,8 @@
From: Hannes Reinecke <hare@suse.de>
Date: Tue, 8 Jan 2019 12:44:51 +0100
Subject: [PATCH] nvme-multipath: zero out ANA log buffer
-Patch-Mainline: submitted linux-nvme 2019/01/08
+Patch-mainline: v5.0-rc2
+Git-commit: c7055fd15ff46d92eb0dd1c16a4fe010d58224c8
References: bsc#1105168
When nvme_init_identify() fails the ANA log buffer is deallocated
diff --git a/patches.fixes/perf-x86-intel-fix-memory-corruption.patch b/patches.fixes/perf-x86-intel-fix-memory-corruption.patch
index 18f7e5bce3..d4fd9a893c 100644
--- a/patches.fixes/perf-x86-intel-fix-memory-corruption.patch
+++ b/patches.fixes/perf-x86-intel-fix-memory-corruption.patch
@@ -1,9 +1,9 @@
From: Peter Zijlstra <peterz@infradead.org>
Date: Thu, 14 Mar 2019 14:01:14 +0100
Subject: [PATCH 1/8] perf/x86/intel: Fix memory corruption
-Patch-mainline: Not yet, just posted
+Patch-mainline: v5.1-rc1
+Git-commit: ede271b059463731cbd6dffe55ffd70d7dbe8392
References: bsc#1121805
-Signed-off-by: Tony Jones <tonyj@suse.de>
Through:
@@ -26,6 +26,7 @@ Tested-by: "DSouza, Nelson" <nelson.dsouza@intel.com>
Cc: stable@kernel.org
Fixes: 400816f60c54 ("perf/x86/intel: Implement support for TSX Force Abort")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Tony Jones <tonyj@suse.de>
---
arch/x86/events/intel/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch b/patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch
index 71b9c31614..74349c4223 100644
--- a/patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch
+++ b/patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch
@@ -1,14 +1,15 @@
From: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Subject: perf/x86/intel: Generalize dynamic constraint creation
Date: Tue, 5 Mar 2019 22:23:16 +0100
-Patch-mainline: Not yet (embargoed)
+Patch-mainline: v5.1-rc1
+Git-commit: 11f8b2d65ca9029591c8df26bb6bd063c312b7fe
References: bsc#1121805
-Signed-off-by: Tony Jones <tonyj@suse.de>
Such that we can re-use it.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Tony Jones <tonyj@suse.de>
---
arch/x86/events/intel/core.c | 51 +++++++++++++++++++++++++------------------
1 file changed, 30 insertions(+), 21 deletions(-)
diff --git a/patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch b/patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch
index 1cc497d030..d7bce44142 100644
--- a/patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch
+++ b/patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch
@@ -1,9 +1,9 @@
From: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Subject: perf/x86/intel: Implement support for TSX Force Abort
Date: Tue, 5 Mar 2019 22:23:18 +0100
-Patch-mainline: Not yet (embargoed)
+Patch-mainline: v5.1-rc1
+Git-commit: 400816f60c543153656ac74eaf7f36f6b7202378
References: bsc#1121805
-Signed-off-by: Tony Jones <tonyj@suse.de>
X-Info: adjust for context (no b00233b53065)
Skylake (and later) will receive a microcode update to address a TSX
@@ -24,6 +24,7 @@ will not get used.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Tony Jones <tonyj@suse.de>
---
arch/x86/events/intel/core.c | 74 +++++++++++++++++++++++++++++++++++++++++--
arch/x86/events/perf_event.h | 6 +++
diff --git a/patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch b/patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch
index ac315accae..7120a4ba62 100644
--- a/patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch
+++ b/patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch
@@ -1,15 +1,16 @@
From: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Subject: perf/x86/intel: Make cpuc allocations consistent
Date: Tue, 5 Mar 2019 22:23:15 +0100
-Patch-mainline: Not yet (embargoed)
+Patch-mainline: v5.1-rc1
+Git-commit: d01b1f96a82e5dd7841a1d39db3abfdaf95f70ab
References: bsc#1121805
-Signed-off-by: Tony Jones <tonyj@suse.de>
The cpuc data structure allocation is different between fake and real
cpuc's; use the same code to init/free both.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Tony Jones <tonyj@suse.de>
---
arch/x86/events/core.c | 13 +++++--------
arch/x86/events/intel/core.c | 29 ++++++++++++++++++-----------
diff --git a/patches.fixes/procsysctl-dont-return-ENOMEM-on-lookup-when-a-table-is-unregistering.patch b/patches.fixes/procsysctl-dont-return-ENOMEM-on-lookup-when-a-table-is-unregistering.patch
new file mode 100644
index 0000000000..7047200b0a
--- /dev/null
+++ b/patches.fixes/procsysctl-dont-return-ENOMEM-on-lookup-when-a-table-is-unregistering.patch
@@ -0,0 +1,81 @@
+From ea5751ccd665a2fd1b24f9af81f6167f0718c5f6 Mon Sep 17 00:00:00 2001
+From: Ivan Delalande <colona@arista.com>
+Date: Thu Dec 13 15:20:52 2018 -0800
+Subject: [PATCH] proc/sysctl: don't return ENOMEM on lookup when a table is unregistering
+Git-commit: ea5751ccd665a2fd1b24f9af81f6167f0718c5f6
+References: git-fixes
+Patch-mainline: v4.20
+
+proc_sys_lookup can fail with ENOMEM instead of ENOENT when the
+corresponding sysctl table is being unregistered. In our case we see
+this upon opening /proc/sys/net/*/conf files while network interfaces
+are being deleted, which confuses our configuration daemon.
+
+The problem was successfully reproduced and this fix tested on v4.9.122
+and v4.20-rc6.
+
+V2: return ERR_PTRs in all cases when proc_sys_make_inode fails instead
+of mixing them with NULL. Thanks Al Viro for the feedback.
+
+Fixes: ace0c791e6c3 ("proc/sysctl: Don't grab i_lock under sysctl_lock.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Ivan Delalande <colona@arista.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+
+---
+ fs/proc/proc_sysctl.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/fs/proc/proc_sysctl.c
++++ b/fs/proc/proc_sysctl.c
+@@ -463,7 +463,7 @@ static struct inode *proc_sys_make_inode
+
+ inode = new_inode(sb);
+ if (!inode)
+- goto out;
++ return ERR_PTR(-ENOMEM);
+
+ inode->i_ino = get_next_ino();
+
+@@ -473,8 +473,7 @@ static struct inode *proc_sys_make_inode
+ if (unlikely(head->unregistering)) {
+ spin_unlock(&sysctl_lock);
+ iput(inode);
+- inode = NULL;
+- goto out;
++ return ERR_PTR(-ENOENT);
+ }
+ ei->sysctl = head;
+ ei->sysctl_entry = table;
+@@ -499,7 +498,6 @@ static struct inode *proc_sys_make_inode
+ if (root->set_ownership)
+ root->set_ownership(head, table, &inode->i_uid, &inode->i_gid);
+
+-out:
+ return inode;
+ }
+
+@@ -548,10 +546,11 @@ static struct dentry *proc_sys_lookup(st
+ goto out;
+ }
+
+- err = ERR_PTR(-ENOMEM);
+ inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
+- if (!inode)
++ if (IS_ERR(inode)) {
++ err = ERR_CAST(inode);
+ goto out;
++ }
+
+ err = NULL;
+ d_set_d_op(dentry, &proc_sys_dentry_operations);
+@@ -684,7 +683,7 @@ static bool proc_sys_fill_cache(struct f
+ return false;
+ if (d_in_lookup(child)) {
+ inode = proc_sys_make_inode(dir->d_sb, head, table);
+- if (!inode) {
++ if (IS_ERR(inode)) {
+ d_lookup_done(child);
+ dput(child);
+ return false;
diff --git a/patches.fixes/splice-dont-merge-into-linked-buffers.patch b/patches.fixes/splice-dont-merge-into-linked-buffers.patch
new file mode 100644
index 0000000000..81b91d1737
--- /dev/null
+++ b/patches.fixes/splice-dont-merge-into-linked-buffers.patch
@@ -0,0 +1,113 @@
+From a0ce2f0aa6ad97c3d4927bf2ca54bcebdf062d55 Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Wed Jan 23 15:19:17 2019 +0100
+Subject: [PATCH] splice: don't merge into linked buffers
+Git-commit: a0ce2f0aa6ad97c3d4927bf2ca54bcebdf062d55
+References: git-fixes
+Patch-mainline: v5.1-rc1
+
+Before this patch, it was possible for two pipes to affect each other after
+data had been transferred between them with tee():
+
+============
+$ cat tee_test.c
+
+int main(void) {
+ int pipe_a[2];
+ if (pipe(pipe_a)) err(1, "pipe");
+ int pipe_b[2];
+ if (pipe(pipe_b)) err(1, "pipe");
+ if (write(pipe_a[1], "abcd", 4) != 4) err(1, "write");
+ if (tee(pipe_a[0], pipe_b[1], 2, 0) != 2) err(1, "tee");
+ if (write(pipe_b[1], "xx", 2) != 2) err(1, "write");
+
+ char buf[5];
+ if (read(pipe_a[0], buf, 4) != 4) err(1, "read");
+ buf[4] = 0;
+ printf("got back: '%s'\n", buf);
+}
+$ gcc -o tee_test tee_test.c
+$ ./tee_test
+got back: 'abxx'
+$
+============
+
+As suggested by Al Viro, fix it by creating a separate type for
+non-mergeable pipe buffers, then changing the types of buffers in
+splice_pipe_to_pipe() and link_pipe().
+
+Cc: <stable@vger.kernel.org>
+Fixes: 7c77f0b3f920 ("splice: implement pipe to pipe splicing")
+Fixes: 70524490ee2e ("[PATCH] splice: add support for sys_tee()")
+Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
+
+diff --git a/fs/pipe.c b/fs/pipe.c
+index bdc5d3c..c51750e 100644
+
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -234,6 +234,14 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = {
+ .get = generic_pipe_buf_get,
+ };
+
++static const struct pipe_buf_operations anon_pipe_buf_nomerge_ops = {
++ .can_merge = 0,
++ .confirm = generic_pipe_buf_confirm,
++ .release = anon_pipe_buf_release,
++ .steal = anon_pipe_buf_steal,
++ .get = generic_pipe_buf_get,
++};
++
+ static const struct pipe_buf_operations packet_pipe_buf_ops = {
+ .can_merge = 0,
+ .confirm = generic_pipe_buf_confirm,
+@@ -242,6 +250,12 @@ static const struct pipe_buf_operations packet_pipe_buf_ops = {
+ .get = generic_pipe_buf_get,
+ };
+
++void pipe_buf_mark_unmergeable(struct pipe_buffer *buf)
++{
++ if (buf->ops == &anon_pipe_buf_ops)
++ buf->ops = &anon_pipe_buf_nomerge_ops;
++}
++
+ static ssize_t
+ pipe_read(struct kiocb *iocb, struct iov_iter *to)
+ {
+diff --git a/fs/splice.c b/fs/splice.c
+index de2ede0..90c2967 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1597,6 +1597,8 @@ static int splice_pipe_to_pipe(struct pipe_inode_info *ipipe,
+ */
+ obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
+
++ pipe_buf_mark_unmergeable(obuf);
++
+ obuf->len = len;
+ opipe->nrbufs++;
+ ibuf->offset += obuf->len;
+@@ -1671,6 +1673,8 @@ static int link_pipe(struct pipe_inode_info *ipipe,
+ */
+ obuf->flags &= ~PIPE_BUF_FLAG_GIFT;
+
++ pipe_buf_mark_unmergeable(obuf);
++
+ if (obuf->len > len)
+ obuf->len = len;
+
+diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
+index 5a3bb3b..3ecd7ea 100644
+--- a/include/linux/pipe_fs_i.h
++++ b/include/linux/pipe_fs_i.h
+@@ -182,6 +182,7 @@ void generic_pipe_buf_get(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
+ int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
+ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);
++void pipe_buf_mark_unmergeable(struct pipe_buffer *buf);
+
+ extern const struct pipe_buf_operations nosteal_pipe_buf_ops;
+
diff --git a/patches.suse/Btrfs-fix-corruption-reading-shared-and-compressed-e.patch b/patches.suse/Btrfs-fix-corruption-reading-shared-and-compressed-e.patch
new file mode 100644
index 0000000000..d4519948c5
--- /dev/null
+++ b/patches.suse/Btrfs-fix-corruption-reading-shared-and-compressed-e.patch
@@ -0,0 +1,120 @@
+From: Filipe Manana <fdmanana@suse.com>
+Date: Thu, 14 Feb 2019 15:17:20 +0000
+Patch-mainline: 5.0-rc1
+Git-commit: 8e928218780e2f1cf2f5891c7575e8f0b284fcce
+Subject: [PATCH] Btrfs: fix corruption reading shared and compressed extents
+ after hole punching
+References: bsc#1126476
+
+In the past we had data corruption when reading compressed extents that
+are shared within the same file and they are consecutive, this got fixed
+by commit 005efedf2c7d0 ("Btrfs: fix read corruption of compressed and
+shared extents") and by commit 808f80b46790f ("Btrfs: update fix for read
+corruption of compressed and shared extents"). However there was a case
+that was missing in those fixes, which is when the shared and compressed
+extents are referenced with a non-zero offset. The following shell script
+creates a reproducer for this issue:
+
+ #!/bin/bash
+
+ mkfs.btrfs -f /dev/sdc &> /dev/null
+ mount -o compress /dev/sdc /mnt/sdc
+
+ # Create a file with 3 consecutive compressed extents, each has an
+ # uncompressed size of 128Kb and a compressed size of 4Kb.
+ for ((i = 1; i <= 3; i++)); do
+ head -c 4096 /dev/zero
+ for ((j = 1; j <= 31; j++)); do
+ head -c 4096 /dev/zero | tr '\0' "\377"
+ done
+ done > /mnt/sdc/foobar
+ sync
+
+ echo "Digest after file creation: $(md5sum /mnt/sdc/foobar)"
+
+ # Clone the first extent into offsets 128K and 256K.
+ xfs_io -c "reflink /mnt/sdc/foobar 0 128K 128K" /mnt/sdc/foobar
+ xfs_io -c "reflink /mnt/sdc/foobar 0 256K 128K" /mnt/sdc/foobar
+ sync
+
+ echo "Digest after cloning: $(md5sum /mnt/sdc/foobar)"
+
+ # Punch holes into the regions that are already full of zeroes.
+ xfs_io -c "fpunch 0 4K" /mnt/sdc/foobar
+ xfs_io -c "fpunch 128K 4K" /mnt/sdc/foobar
+ xfs_io -c "fpunch 256K 4K" /mnt/sdc/foobar
+ sync
+
+ echo "Digest after hole punching: $(md5sum /mnt/sdc/foobar)"
+
+ echo "Dropping page cache..."
+ sysctl -q vm.drop_caches=1
+ echo "Digest after hole punching: $(md5sum /mnt/sdc/foobar)"
+
+ umount /dev/sdc
+
+When running the script we get the following output:
+
+ Digest after file creation: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
+ linked 131072/131072 bytes at offset 131072
+ 128 KiB, 1 ops; 0.0033 sec (36.960 MiB/sec and 295.6830 ops/sec)
+ linked 131072/131072 bytes at offset 262144
+ 128 KiB, 1 ops; 0.0015 sec (78.567 MiB/sec and 628.5355 ops/sec)
+ Digest after cloning: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
+ Digest after hole punching: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
+ Dropping page cache...
+ Digest after hole punching: fba694ae8664ed0c2e9ff8937e7f1484 /mnt/sdc/foobar
+
+This happens because after reading all the pages of the extent in the
+range from 128K to 256K for example, we read the hole at offset 256K
+and then when reading the page at offset 260K we don't submit the
+existing bio, which is responsible for filling all the page in the
+range 128K to 256K only, therefore adding the pages from range 260K
+to 384K to the existing bio and submitting it after iterating over the
+entire range. Once the bio completes, the uncompressed data fills only
+the pages in the range 128K to 256K because there's no more data read
+from disk, leaving the pages in the range 260K to 384K unfilled. It is
+just a slightly different variant of what was solved by commit
+005efedf2c7d0 ("Btrfs: fix read corruption of compressed and shared
+extents").
+
+Fix this by forcing a bio submit, during readpages(), whenever we find a
+compressed extent map for a page that is different from the extent map
+for the previous page or has a different starting offset (in case it's
+the same compressed extent), instead of the extent map's original start
+offset.
+
+A test case for fstests follows soon.
+
+Reported-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org>
+Fixes: 808f80b46790f ("Btrfs: update fix for read corruption of compressed and shared extents")
+Fixes: 005efedf2c7d0 ("Btrfs: fix read corruption of compressed and shared extents")
+Cc: stable@vger.kernel.org # 4.3+
+Tested-by: Zygo Blaxell <ce3g8jdj@umail.furryterror.org>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+---
+ fs/btrfs/extent_io.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 1e46d50373ae..8699621a904f 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -3056,11 +3056,11 @@ static int __do_readpage(struct extent_io_tree *tree,
+ */
+ if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
+ prev_em_start && *prev_em_start != (u64)-1 &&
+- *prev_em_start != em->orig_start)
++ *prev_em_start != em->start)
+ force_bio_submit = true;
+
+ if (prev_em_start)
+- *prev_em_start = em->orig_start;
++ *prev_em_start = em->start;
+
+ free_extent_map(em);
+ em = NULL;
+--
+2.19.0
+
diff --git a/patches.suse/suse-hv-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch b/patches.suse/msft-hv-1847-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch
index 7aba9d07ba..1dd5e175a2 100644
--- a/patches.suse/suse-hv-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch
+++ b/patches.suse/msft-hv-1847-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch
@@ -1,8 +1,9 @@
From: Lan Tianyu <Tianyu.Lan@microsoft.com>
Date: Wed, 27 Feb 2019 22:54:03 +0800
-Patch-mainline: Never, v6 submitted(https://lkml.org/lkml/2019/2/27/363)
-References: fate#327171, bsc#1122822
+Patch-mainline: v5.1-rc1
Subject: x86/Hyper-V: Set x2apic destination mode to physical when x2apic is available
+Git-commit: 84fdfafab849036b5aefa52824b5cb42e887ef0e
+References: fate#327171, bsc#1122822
Hyper-V doesn't provide irq remapping for IO-APIC. To enable x2apic,
set x2apic destination mode to physcial mode when x2apic is available
@@ -12,13 +13,13 @@ and Hyper-V IOMMU driver makes sure cpus assigned with IO-APIC irqs have
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Lan Tianyu <Tianyu.Lan@microsoft.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
Acked-by: Olaf Hering <ohering@suse.de>
---
arch/x86/kernel/cpu/mshyperv.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
-index e81a2db42df7..3fa238a137d2 100644
--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -328,6 +328,18 @@ static void __init ms_hyperv_init_platform(void)
diff --git a/patches.suse/suse-hv-HYPERV-IOMMU-Add-Hyper-V-stub-IOMMU-driver.patch b/patches.suse/msft-hv-1848-iommu-hyper-v-Add-Hyper-V-stub-IOMMU-driver.patch
index d1ae7bac69..5a1b1f901d 100644
--- a/patches.suse/suse-hv-HYPERV-IOMMU-Add-Hyper-V-stub-IOMMU-driver.patch
+++ b/patches.suse/msft-hv-1848-iommu-hyper-v-Add-Hyper-V-stub-IOMMU-driver.patch
@@ -1,8 +1,9 @@
From: Lan Tianyu <Tianyu.Lan@microsoft.com>
Date: Wed, 27 Feb 2019 22:54:04 +0800
-Patch-mainline: Never, v6 submitted(https://lkml.org/lkml/2019/2/27/364)
+Patch-mainline: v5.1-rc1
+Subject: iommu/hyper-v: Add Hyper-V stub IOMMU driver
+Git-commit: 29217a4746835fef35279abbd12c1a1efe83bfca
References: fate#327171, bsc#1122822
-Subject: HYPERV/IOMMU: Add Hyper-V stub IOMMU driver
On the bare metal, enabling X2APIC mode requires interrupt remapping
function which helps to deliver irq to cpu with 32-bit APIC ID.
@@ -23,6 +24,7 @@ https://pdos.csail.mit.edu/6.828/2016/readings/ia32/ioapic.pdf).
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Lan Tianyu <Tianyu.Lan@microsoft.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
Acked-by: Olaf Hering <ohering@suse.de>
---
drivers/iommu/Kconfig | 9 ++
@@ -269,11 +271,11 @@ Acked-by: Olaf Hering <ohering@suse.de>
--- a/drivers/iommu/irq_remapping.h
+++ b/drivers/iommu/irq_remapping.h
-@@ -66,6 +66,7 @@ extern struct irq_remap_ops intel_irq_re
- extern struct irq_remap_ops amd_iommu_irq_ops;
+@@ -64,6 +64,7 @@ struct irq_remap_ops {
- extern void ir_ack_apic_edge(struct irq_data *data);
+ extern struct irq_remap_ops intel_irq_remap_ops;
+ extern struct irq_remap_ops amd_iommu_irq_ops;
+extern struct irq_remap_ops hyperv_irq_remap_ops;
- #else /* CONFIG_IRQ_REMAP */
+ extern void ir_ack_apic_edge(struct irq_data *data);
diff --git a/patches.suse/sched-do-not-re-read-h_load_next-during-hierarchical-load-calculation.patch b/patches.suse/sched-do-not-re-read-h_load_next-during-hierarchical-load-calculation.patch
new file mode 100644
index 0000000000..0fe5e22a26
--- /dev/null
+++ b/patches.suse/sched-do-not-re-read-h_load_next-during-hierarchical-load-calculation.patch
@@ -0,0 +1,77 @@
+From 3d78851e1fb18f96eb2247b641f930ce81021942 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@techsingularity.net>
+Date: Tue, 19 Mar 2019 08:51:58 +0000
+Subject: [PATCH] sched: Do not re-read h_load_next during hierarchical load
+ calculation
+
+References: bnc#1120909
+Patch-mainline: No, under review, expected in 5.1
+
+A NULL pointer dereference bug was reported on a distribution kernel but
+the same issue should be present on mainline kernel. It occured on s390
+but should not be arch-specific. A partial oops looks like
+
+[775277.408564] Unable to handle kernel pointer dereference in virtual kernel address space
+...
+[775277.408759] Call Trace:
+[775277.408763] ([<0002c11c56899c61>] 0x2c11c56899c61)
+[775277.408766] [<0000000000177bb4>] try_to_wake_up+0xfc/0x450
+[775277.408773] [<000003ff81ede872>] vhost_poll_wakeup+0x3a/0x50 [vhost]
+[775277.408777] [<0000000000194ae4>] __wake_up_common+0xbc/0x178
+[775277.408779] [<0000000000194f86>] __wake_up_common_lock+0x9e/0x160
+[775277.408780] [<00000000001950de>] __wake_up_sync_key+0x4e/0x60
+[775277.408785] [<00000000005d911e>] sock_def_readable+0x5e/0x98
+
+The bug hits any time between 1 hour to 3 days. The dereference occurs
+in update_cfs_rq_h_load when accumulating h_load. The problem is that
+cfq_rq->h_load_next is not protected by any locking and can be updated
+by parallel calls to task_h_load. Depending on the compiler, code may be
+generated that re-reads cfq_rq->h_load_next after the check for NULL and
+then oops when reading se->avg.load_avg. The dissassembly showed that it
+was possible to reread h_load_next after the check for NULL.
+
+While this does not appear to be an issue for later compilers, it's still
+an accident if the correct code is generated. Full locking in this path
+would have high overhead so this patch uses READ_ONCE to read h_load_next
+only once and check for NULL before dereferencing. It was confirmed that
+there were no further oops after 10 days of testing.
+
+As Peter pointed out, it is also necessary to use WRITE_ONCE to avoid any
+potential problems with store tearing.
+
+Fixes: 685207963be9 ("sched: Move h_load calculation to task_h_load()")
+[peterz@infradead.org: Use WRITE_ONCE to protect against store tearing]
+Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
+Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
+Signed-off-by: Mel Gorman <mgorman@suse.com>
+Cc: stable@vger.kernel.org
+---
+ kernel/sched/fair.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 310d0637fe4b..5e61a1a99e38 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -7713,10 +7713,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
+ if (cfs_rq->last_h_load_update == now)
+ return;
+
+- cfs_rq->h_load_next = NULL;
++ WRITE_ONCE(cfs_rq->h_load_next, NULL);
+ for_each_sched_entity(se) {
+ cfs_rq = cfs_rq_of(se);
+- cfs_rq->h_load_next = se;
++ WRITE_ONCE(cfs_rq->h_load_next, se);
+ if (cfs_rq->last_h_load_update == now)
+ break;
+ }
+@@ -7726,7 +7726,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
+ cfs_rq->last_h_load_update = now;
+ }
+
+- while ((se = cfs_rq->h_load_next) != NULL) {
++ while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) {
+ load = cfs_rq->h_load;
+ load = div64_ul(load * se->avg.load_avg,
+ cfs_rq_load_avg(cfs_rq) + 1);
diff --git a/patches.suse/tracing-do-not-free-iter-trace-in-fail-path-of-tracing_open_pipe.patch b/patches.suse/tracing-do-not-free-iter-trace-in-fail-path-of-tracing_open_pipe.patch
new file mode 100644
index 0000000000..c65faf42b8
--- /dev/null
+++ b/patches.suse/tracing-do-not-free-iter-trace-in-fail-path-of-tracing_open_pipe.patch
@@ -0,0 +1,39 @@
+From: "zhangyi (F)" <yi.zhang@huawei.com>
+Date: Wed, 13 Feb 2019 20:29:06 +0800
+Subject: tracing: Do not free iter->trace in fail path of tracing_open_pipe()
+Git-commit: e7f0c424d0806b05d6f47be9f202b037eb701707
+Patch-mainline: v5.1-rc1
+References: bsc#1129581
+
+Commit d716ff71dd12 ("tracing: Remove taking of trace_types_lock in
+pipe files") use the current tracer instead of the copy in
+tracing_open_pipe(), but it forget to remove the freeing sentence in
+the error path.
+
+There's an error path that can call kfree(iter->trace) after the iter->trace
+was assigned to tr->current_trace, which would be bad to free.
+
+Link: http://lkml.kernel.org/r/1550060946-45984-1-git-send-email-yi.zhang@huawei.com
+
+Cc: stable@vger.kernel.org
+Fixes: d716ff71dd12 ("tracing: Remove taking of trace_types_lock in pipe files")
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/trace.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index c521b7347482..b583ff7656bb 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -5624,7 +5624,6 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
+ return ret;
+
+ fail:
+- kfree(iter->trace);
+ kfree(iter);
+ __trace_array_put(tr);
+ mutex_unlock(&trace_types_lock);
+
diff --git a/patches.suse/tracing-use-strncpy-instead-of-memcpy-for-string-keys-in-hist-triggers.patch b/patches.suse/tracing-use-strncpy-instead-of-memcpy-for-string-keys-in-hist-triggers.patch
new file mode 100644
index 0000000000..c68c9d13d1
--- /dev/null
+++ b/patches.suse/tracing-use-strncpy-instead-of-memcpy-for-string-keys-in-hist-triggers.patch
@@ -0,0 +1,73 @@
+From: Tom Zanussi <tom.zanussi@linux.intel.com>
+Date: Mon, 4 Feb 2019 15:07:24 -0600
+Subject: tracing: Use strncpy instead of memcpy for string keys in hist
+ triggers
+Git-commit: 9f0bbf3115ca9f91f43b7c74e9ac7d79f47fc6c2
+Patch-mainline: v5.1-rc1
+References: bsc#1129625
+
+Because there may be random garbage beyond a string's null terminator,
+it's not correct to copy the the complete character array for use as a
+hist trigger key. This results in multiple histogram entries for the
+'same' string key.
+
+So, in the case of a string key, use strncpy instead of memcpy to
+avoid copying in the extra bytes.
+
+Before, using the gdbus entries in the following hist trigger as an
+example:
+
+ # echo 'hist:key=comm' > /sys/kernel/debug/tracing/events/sched/sched_waking/trigger
+ # cat /sys/kernel/debug/tracing/events/sched/sched_waking/hist
+
+ ...
+
+ { comm: ImgDecoder #4 } hitcount: 203
+ { comm: gmain } hitcount: 213
+ { comm: gmain } hitcount: 216
+ { comm: StreamTrans #73 } hitcount: 221
+ { comm: mozStorage #3 } hitcount: 230
+ { comm: gdbus } hitcount: 233
+ { comm: StyleThread#5 } hitcount: 253
+ { comm: gdbus } hitcount: 256
+ { comm: gdbus } hitcount: 260
+ { comm: StyleThread#4 } hitcount: 271
+
+ ...
+
+ # cat /sys/kernel/debug/tracing/events/sched/sched_waking/hist | egrep gdbus | wc -l
+ 51
+
+After:
+
+ # cat /sys/kernel/debug/tracing/events/sched/sched_waking/hist | egrep gdbus | wc -l
+ 1
+
+Link: http://lkml.kernel.org/r/50c35ae1267d64eee975b8125e151e600071d4dc.1549309756.git.tom.zanussi@linux.intel.com
+
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: stable@vger.kernel.org
+Fixes: 79e577cbce4c4 ("tracing: Support string type key properly")
+Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
+Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Acked-by: Miroslav Benes <mbenes@suse.cz>
+---
+ kernel/trace/trace_events_hist.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/kernel/trace/trace_events_hist.c
++++ b/kernel/trace/trace_events_hist.c
+@@ -872,9 +872,10 @@ static inline void add_to_key(char *comp
+ /* ensure NULL-termination */
+ if (size > key_field->size - 1)
+ size = key_field->size - 1;
+- }
+
+- memcpy(compound_key + key_field->offset, key, size);
++ strncpy(compound_key + key_field->offset, (char *)key, size);
++ } else
++ memcpy(compound_key + key_field->offset, key, size);
+ }
+
+ static void event_hist_trigger(struct event_trigger_data *data, void *rec)
+
diff --git a/series.conf b/series.conf
index d8de178b7e..422731a57d 100644
--- a/series.conf
+++ b/series.conf
@@ -19380,6 +19380,7 @@
patches.suse/net-dsa-bcm_sf2-Fix-unbind-ordering.patch
patches.suse/net-dsa-bcm_sf2-Call-setup-during-switch-resume.patch
patches.drivers/Input-xpad-add-support-for-Xbox1-PDP-Camo-series-gam.patch
+ patches.drivers/IB-mlx5-Unmap-DMA-addr-from-HCA-before-IOMMU.patch
patches.drivers/mmc-block-avoid-multiblock-reads-for-the-last-sector.patch
patches.drivers/libertas-call-into-generic-suspend-code-before-turni.patch
patches.fixes/0010-arm64-Fix-proc-iomem-for-reserved-but-not-memory-reg.patch
@@ -19488,6 +19489,7 @@
patches.drivers/net-hns3-Fix-ets-validate-issue.patch
patches.drivers/net-hns3-Fix-tqp-array-traversal-condition-for-vf.patch
patches.drivers/net-hns3-Add-nic-state-check-before-calling-netif_tx.patch
+ patches.drivers/bpf-verifier-fix-verifier-instability.patch
patches.drivers/net-hns3-Fix-for-packet-buffer-setting-bug.patch
patches.drivers/net-hns3-Fix-for-netdev-not-up-problem-when-setting-.patch
patches.drivers/net-hns3-Fix-loss-of-coal-configuration-while-doing-.patch
@@ -20197,6 +20199,7 @@
patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check
patches.fixes/fs-fix-lost-error-code-in-dio_complete.patch
patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch
+ patches.fixes/nvme-flush-namespace-scanning-work-just-before-remov.patch
patches.arch/x86-retpoline-make-config_retpoline-depend-on-compiler-support.patch
patches.arch/x86-retpoline-remove-minimal-retpoline-support.patch
patches.arch/x86-speculation-update-the-tif_ssbd-comment.patch
@@ -20380,6 +20383,7 @@
patches.suse/net-smc-fix-TCP-fallback-socket-release.patch
patches.fixes/0001-iwlwifi-mvm-don-t-send-GEO_TX_POWER_LIMIT-to-old-fir.patch
patches.suse/ipv6-explicitly-initialize-udp6_addr-in-udp_sock_cre.patch
+ patches.drivers/net-mlx5e-RX-Fix-wrong-early-return-in-receive-queue.patch
patches.suse/net-mlx5-Typo-fix-in-del_sw_hw_rule.patch
patches.suse/net-mlx5e-Remove-the-false-indication-of-software-ti.patch
patches.suse/gro_cell-add-napi_disable-in-gro_cells_destroy.patch
@@ -20412,6 +20416,7 @@
patches.suse/ipv6-tunnels-fix-two-use-after-free.patch
patches.suse/qmi_wwan-Add-support-for-Fibocom-NL678-series.patch
patches.drivers/serial-sunsu-fix-refcount-leak.patch
+ patches.fixes/procsysctl-dont-return-ENOMEM-on-lookup-when-a-table-is-unregistering.patch
patches.drivers/platform-x86-asus-wmi-Tell-the-EC-the-OS-will-handle.patch
patches.drivers/platform-x86-asus-nb-wmi-Map-0x35-to-KEY_SCREENLOCK.patch
patches.drivers/platform-x86-asus-nb-wmi-Drop-mapping-of-0x33-and-0x.patch
@@ -20788,6 +20793,7 @@
patches.drm/0001-drm-fb-helper-Ignore-the-value-of-fb_var_screeninfo..patch
patches.fixes/kvm-sev-fail-kvm_sev_init-if-already-initialized.patch
patches.fixes/loop-drop-caches-if-offset-or-block_size-are-changed.patch
+ patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch
patches.drivers/ata-ahci-mvebu-remove-stale-comment.patch
patches.fixes/0001-usb-cdc-acm-send-ZLP-for-Telit-3G-Intel-based-modems.patch
patches.fixes/0001-USB-storage-don-t-insert-sane-sense-for-SPC3-when-ba.patch
@@ -20929,6 +20935,7 @@
patches.drivers/iommu-amd-unmap-all-mapped-pages-in-error-path-of-map_sg
patches.drivers/iommu-vt-d-fix-memory-leak-in-intel_iommu_put_resv_regions
patches.drivers/iommu-amd-fix-iommu-page-flush-when-detach-device-from-a-domain
+ patches.fixes/fsdcache-Fix-incorrect-nr_dentry_unused-accounting-in-shrink_dcache_sb.patch
patches.drivers/ALSA-usb-audio-Add-Opus-3-to-quirks-for-native-DSD-s.patch
patches.drivers/ALSA-hda-realtek-Fixed-hp_pin-no-value.patch
patches.fixes/NFS-Fix-up-return-value-on-fatal-errors-in-nfs_page_.patch
@@ -20992,6 +20999,7 @@
patches.suse/net-dsa-slave-Don-t-propagate-flag-changes-on-down-s.patch
patches.fixes/mISDN-fix-a-race-in-dev_expire_timer.patch
patches.suse/rxrpc-bad-unlock-balance-in-rxrpc_recvmsg.patch
+ patches.drivers/net-Don-t-default-Cavium-PTP-driver-to-y.patch
patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
patches.fixes/ARM-iop32x-n2100-fix-PCI-IRQ-mapping.patch
patches.fixes/ARM-tango-Improve-ARCH_MULTIPLATFORM-compatibility.patch
@@ -21011,6 +21019,7 @@
patches.drivers/ASoC-rsnd-fixup-rsnd_ssi_master_clk_start-user-count.patch
patches.fixes/vsock-cope-with-memory-allocation-failure-at-socket-.patch
patches.fixes/batman-adv-fix-uninit-value-in-batadv_interface_tx.patch
+ patches.drivers/net-ena-fix-race-between-link-up-and-device-initaliz.patch
patches.fixes/team-avoid-complex-list-operations-in-team_nl_cmd_op.patch
patches.drm/0001-gpu-ipu-v3-Fix-i.MX51-CSI-control-registers-offset.patch
patches.drm/0002-gpu-ipu-v3-Fix-CSI-offsets-for-imx53.patch
@@ -21046,8 +21055,11 @@
patches.suse/kallsyms-handle-too-long-symbols-in-kallsyms-c.patch
patches.drivers/scsi-libiscsi-fix-race-between-iscsi_xmit_task-and-iscsi_complete_task
patches.fixes/scsi-core-reset-host-byte-in-DID_NEXUS_FAILURE-case.patch
+ patches.drivers/bnxt_en-Fix-typo-in-firmware-message-timeout-logic.patch
+ patches.drivers/bnxt_en-Wait-longer-for-the-firmware-message-respons.patch
patches.fixes/mdio_bus-Fix-use-after-free-on-device_register-fails.patch
patches.fixes/bpf-lpm-fix-lookup-bug-in-map_delete_elem.patch
+ patches.fixes/0001-nfp-bpf-fix-ALU32-high-bits-clearance-bug.patch
patches.fixes/0001-mm-enforce-min-addr-even-if-capable-in-expand_downwa.patch
patches.drivers/mmc-spi-Fix-card-detection-during-probe.patch
patches.drm/drm-Block-fb-changes-for-async-plane-updates.patch
@@ -21081,9 +21093,11 @@
patches.fixes/0001-rt2800-enable-TX_PIN_CFG_RFRX_EN-only-for-MT7620.patch
patches.drivers/Bluetooth-Fix-locking-in-bt_accept_enqueue-for-BH-co.patch
patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch
+ patches.fixes/0001-net-aquantia-fixed-instack-structure-overflow.patch
patches.suse/netfilter-nf_tables-check-the-result-of-dereferencin.patch
patches.drivers/team-Free-BPF-filter-when-unregistering-netdev.patch
patches.drivers/sky2-Disable-MSI-on-Dell-Inspiron-1545-and-Gateway-P.patch
+ patches.fixes/0001-net-dsa-mv88e6xxx-handle-unknown-duplex-modes-gracef.patch
patches.fixes/crypto-hash-set-CRYPTO_TFM_NEED_KEY-if-setkey-fails.patch
patches.fixes/crypto-brcm-Fix-some-set-but-not-used-warning.patch
patches.fixes/crypto-tgr192-fix-unaligned-memory-access.patch
@@ -21112,6 +21126,7 @@
patches.drivers/applicom-Fix-potential-Spectre-v1-vulnerabilities.patch
patches.drivers/parport_pc-fix-find_superio-io-compare-code-should-u.patch
patches.drivers/intel_th-Don-t-reference-unassigned-outputs.patch
+ patches.drivers/VMCI-Support-upto-64-bit-PPNs.patch
patches.drivers/misc-hpilo-Exclude-unsupported-device-via-blacklist.patch
patches.drivers/misc-hpilo-Do-not-claim-unsupported-hardware.patch
patches.drivers/intel_th-gth-Fix-an-off-by-one-in-output-unassigning.patch
@@ -21186,8 +21201,15 @@
patches.drivers/PCI-PME-Fix-hotplug-sysfs-remove-deadlock-in-pcie_pm.patch
patches.drivers/pci-qcom-don-t-deassert-reset-gpio-during-probe
patches.drivers/PCI-endpoint-functions-Use-memcpy_fromio-memcpy_toio.patch
+ patches.drivers/IB-core-Destroy-QP-if-XRC-QP-fails.patch
+ patches.drivers/RDMA-vmw_pvrdma-Support-upto-64-bit-PFNs.patch
+ patches.drivers/IB-core-Unregister-notifier-before-freeing-MAD-secur.patch
+ patches.drivers/IB-core-Fix-potential-memory-leak-while-creating-MAD.patch
+ patches.drivers/IB-hfi1-Close-race-condition-on-user-context-disable.patch
patches.drivers/iommu-vt-d-check-identity-map-for-hot-added-devices
patches.drivers/iommu-vt-d-fix-null-pointer-reference-in-intel_svm_bind_mm
+ patches.suse/msft-hv-1847-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch
+ patches.suse/msft-hv-1848-iommu-hyper-v-Add-Hyper-V-stub-IOMMU-driver.patch
patches.drivers/iommu-io-pgtable-arm-v7s-only-kmemleak_ignore-l2-tables
patches.drivers/iommu-document-iommu_ops-is_attach_deferred
patches.arch/0001-swiotlb-introduce-swiotlb_max_mapping_size
@@ -21197,7 +21219,9 @@
patches.arch/0005-virtio-blk-consider-virtio_max_dma_size-for-maximum-segment-size
patches.fixes/tipc-fix-RDM-DGRAM-connect-regression.patch
patches.drivers/enic-fix-build-warning-without-CONFIG_CPUMASK_OFFSTA.patch
+ patches.fixes/0001-vxlan-Fix-GRO-cells-race-condition-between-receive-a.patch
patches.fixes/bpf-fix-replace_map_fd_with_map_ptr-s-ldimm64-second.patch
+ patches.fixes/0001-vxlan-test-dev-flags-IFF_UP-before-calling-gro_cells.patch
patches.drivers/input-raspberrypi-ts-select-config_input_polldev.patch
patches.drivers/Input-elan_i2c-add-id-for-touchpad-found-in-Lenovo-s.patch
patches.drivers/Input-wacom_serial4-add-support-for-Wacom-ArtPad-II-.patch
@@ -21206,12 +21230,23 @@
patches.drivers/pinctrl-sh-pfc-r8a7791-Fix-scifb2_data_c-pin-group.patch
patches.drivers/pinctrl-sh-pfc-r8a7792-Fix-vin1_data18_b-pin-group.patch
patches.drivers/pinctrl-sh-pfc-sh73a0-Fix-fsic_spdif-pin-groups.patch
+ patches.suse/tracing-do-not-free-iter-trace-in-fail-path-of-tracing_open_pipe.patch
+ patches.suse/tracing-use-strncpy-instead-of-memcpy-for-string-keys-in-hist-triggers.patch
patches.fixes/0001-xen-remove-pre-xen3-fallback-handlers.patch
patches.fixes/0001-xen-cpu_hotplug-Prevent-an-out-of-bounds-access.patch
patches.fixes/0001-xen-fix-dom0-boot-on-huge-systems.patch
+ patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch
+ patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch
patches.arch/x86-add-tsx-force-abort-cpuid-msr
+ patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch
+ patches.fixes/fsdevpts-always-delete-dcache-dentry-s-in-dput.patch
+ patches.fixes/splice-dont-merge-into-linked-buffers.patch
+ patches.suse/Btrfs-fix-corruption-reading-shared-and-compressed-e.patch
patches.fixes/acpi-nfit-Fix-bus-command-validation.patch
+ patches.fixes/libnvdimm-label-clear-updating-flag-after-label-set-update.patch
+ patches.fixes/nfit-acpi_nfit_ctl-check-out_obj-type-in-the-right-place.patch
patches.fixes/libnvdimm-Fix-altmap-reservation-size-calculation.patch
+ patches.fixes/libnvdimm-pmem-honor-force_raw-for-legacy-pmem-regions.patch
patches.fixes/nfit-ars-Attempt-a-short-ARS-whenever-the-ARS-state-.patch
patches.fixes/nfit-ars-Attempt-short-ARS-even-in-the-no_init_ars-c.patch
patches.drivers/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch
@@ -21235,8 +21270,19 @@
patches.drivers/dmaengine-pl330-drop-useless-LIST_HEAD.patch
patches.drivers/dmaengine-sa11x0-drop-useless-LIST_HEAD.patch
patches.drivers/dmaengine-mv_xor-Use-correct-device-for-DMA-API.patch
+ patches.fixes/0001-net-mlx5e-IPoIB-Fix-RX-checksum-statistics-update.patch
+ patches.fixes/0001-net-mlx4_core-Fix-reset-flow-when-in-command-polling.patch
+ patches.fixes/0001-net-mlx4_core-Fix-locking-in-SRIOV-mode-when-switchi.patch
+ patches.fixes/0001-net-mlx4_core-Fix-qp-mtt-size-calculation.patch
+ patches.fixes/0001-pptp-dst_release-sk_dst_cache-in-pptp_sock_destruct.patch
patches.fixes/ACPI-device_sysfs-Avoid-OF-modalias-creation-for-rem.patch
+ patches.drm/0001-drm-etnaviv-NULL-vs-IS_ERR-buf-in-etnaviv_core_dump.patch
+ patches.drm/0002-drm-etnaviv-potential-NULL-dereference.patch
+ patches.fixes/0001-fbdev-chipsfb-remove-set-but-not-used-variable-size.patch
patches.fixes/nvme-fc-reject-reconnect-if-io-queue-count-is-reduce.patch
+ patches.fixes/9p-use-inode-i_lock-to-protect-i_size_write-under-32.patch
+ patches.fixes/9p-net-fix-memory-leak-in-p9_client_create.patch
+ patches.fixes/perf-x86-intel-fix-memory-corruption.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -21249,7 +21295,6 @@
# out-of-tree patches
patches.fixes/ext4-close-race-between-direct-IO-and-ext4_break_layouts.patch
patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
- patches.fixes/nvme-multipath-zero-out-ANA-log-buffer.patch
patches.arch/powerpc-tm-Avoid-machine-crash-on-rt_sigreturn.patch
patches.suse/mpt3sas-check-sense-buffer-before-copying-sense-data.patch
patches.suse/nvme-multipath-round-robin-I-O-policy.patch
@@ -21262,11 +21307,6 @@
# end of sorted patches
########################################################
- patches.fixes/perf-x86-intel-make-cpuc-allocations-consistent.patch
- patches.fixes/perf-x86-intel-generalize-dynamic-constraint-creation.patch
- patches.fixes/perf-x86-intel-implement-support-for-tsx-force-abort.patch
- patches.fixes/perf-x86-intel-fix-memory-corruption.patch
-
########################################################
#
# packaging-specific patches (tweaks for autobuild,
@@ -21341,6 +21381,8 @@
patches.suse/IBRS-forbid-shooting-in-foot.patch
+ patches.suse/sched-do-not-re-read-h_load_next-during-hierarchical-load-calculation.patch
+
########################################################
# locking/core
########################################################
@@ -21471,8 +21513,6 @@
########################################################
# Suse specific stuff
########################################################
- patches.suse/suse-hv-x86-Hyper-V-Set-x2apic-destination-mode-to-physical-.patch
- patches.suse/suse-hv-HYPERV-IOMMU-Add-Hyper-V-stub-IOMMU-driver.patch
patches.suse/suse-hv-hv-iommu-api.patch
patches.suse/suse-hv-HV_VP_SET_BANK_COUNT_MAX.patch
patches.suse/suse-hv-kabi-hv_ringbuffer_get_debuginfo.patch