update ABI file for 5.13.19-6-pve

(generated with debian/scripts/abi-generate)

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

.gitignore

@@ -1 +1,2 @@
 ubuntu-zesty
+*.prepared

.gitmodules

@@ -1,6 +1,6 @@
-[submodule "submodules/ubuntu-artful"]
-	path = submodules/ubuntu-artful
-	url = ../mirror_ubuntu-artful-kernel
 [submodule "submodules/zfsonlinux"]
 	path = submodules/zfsonlinux
 	url = ../zfsonlinux
+[submodule "submodules/ubuntu-impish"]
+	path = submodules/ubuntu-impish
+	url = ../mirror_ubuntu-impish-kernel

Makefile

@@ -1,12 +1,12 @@
-RELEASE=5.1
-
-# also update pve-kernel-meta.git if either of these change
-KERNEL_MAJ=4
+# also bump pve-kernel-meta if either of MAJ.MIN, PATCHLEVEL or KREL change
+KERNEL_MAJ=5
 KERNEL_MIN=13
-KERNEL_PATCHLEVEL=16
-KREL=4
+KERNEL_PATCHLEVEL=19
+# increment KREL if the ABI changes (abicheck target in debian/rules)
+# rebuild packages with new KREL and run 'make abiupdate'
+KREL=6
 
-PKGREL=51
+PKGREL=14
 
 KERNEL_MAJMIN=$(KERNEL_MAJ).$(KERNEL_MIN)
 KERNEL_VER=$(KERNEL_MAJMIN).$(KERNEL_PATCHLEVEL)
@@ -29,56 +29,32 @@ GITVERSION:=$(shell git rev-parse HEAD)
 
 SKIPABI=0
 
-ifeq    ($(CC), cc)
-GCC=gcc
-else
-GCC=$(CC)
-endif
-
 BUILD_DIR=build
 
-KERNEL_SRC=ubuntu-artful
+KERNEL_SRC=ubuntu-impish
 KERNEL_SRC_SUBMODULE=submodules/$(KERNEL_SRC)
 KERNEL_CFG_ORG=config-${KERNEL_VER}.org
 
-E1000EDIR=e1000e-3.3.6
-E1000ESRC=${E1000EDIR}.tar.gz
-
-IGBDIR=igb-5.3.5.10
-IGBSRC=${IGBDIR}.tar.gz
-
-IXGBEDIR=ixgbe-5.3.3
-IXGBESRC=${IXGBEDIR}.tar.gz
-
 ZFSONLINUX_SUBMODULE=submodules/zfsonlinux
-SPLDIR=pkg-spl
-SPLSRC=${ZFSONLINUX_SUBMODULE}/spl-debian
 ZFSDIR=pkg-zfs
-ZFSSRC=${ZFSONLINUX_SUBMODULE}/zfs-debian
 
 MODULES=modules
-MODULE_DIRS=${E1000EDIR} ${IGBDIR} ${IXGBEDIR} ${SPLDIR} ${ZFSDIR}
+MODULE_DIRS=${ZFSDIR}
 
 # exported to debian/rules via debian/rules.d/dirs.mk
-DIRS=KERNEL_SRC E1000EDIR IGBDIR IXGBEDIR SPLDIR ZFSDIR MODULES
+DIRS=KERNEL_SRC ZFSDIR MODULES
 
 DST_DEB=${PACKAGE}_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
 HDR_DEB=${HDRPACKAGE}_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
+USR_HDR_DEB=pve-kernel-libc-dev_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
 LINUX_TOOLS_DEB=linux-tools-$(KERNEL_MAJMIN)_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
+LINUX_TOOLS_DBG_DEB=linux-tools-$(KERNEL_MAJMIN)-dbgsym_${KERNEL_VER}-${PKGREL}_${ARCH}.deb
 
-DEBS=${DST_DEB} ${HDR_DEB} ${LINUX_TOOLS_DEB}
+DEBS=${DST_DEB} ${HDR_DEB} ${USR_HDR_DEB} ${LINUX_TOOLS_DEB} ${LINUX_TOOLS_DBG_DEB}
 
-all: check_gcc deb
+all: deb
 deb: ${DEBS}
 
-check_gcc:
-	$(GCC) --version|grep "6\.3" || false
-	@$(GCC) -Werror -mindirect-branch=thunk-extern -mindirect-branch-register -c -x c /dev/null -o check_gcc.o \
-		|| ( rm -f check_gcc.o; \
-		     echo "Please install gcc-6 packages with indirect thunk / RETPOLINE support"; \
-		     false)
-	@rm -f check_gcc.o
-
 ${LINUX_TOOLS_DEB} ${HDR_DEB}: ${DST_DEB}
 ${DST_DEB}: ${BUILD_DIR}.prepared
 	cd ${BUILD_DIR}; dpkg-buildpackage --jobs=auto -b -uc -us
@@ -112,53 +88,23 @@ ${KERNEL_SRC}.prepared: ${KERNEL_SRC_SUBMODULE} | submodule
 	cp ${KERNEL_CFG_ORG} ${BUILD_DIR}/${KERNEL_SRC}/.config
 	sed -i ${BUILD_DIR}/${KERNEL_SRC}/Makefile -e 's/^EXTRAVERSION.*$$/EXTRAVERSION=${EXTRAVERSION}/'
 	rm -rf ${BUILD_DIR}/${KERNEL_SRC}/debian ${BUILD_DIR}/${KERNEL_SRC}/debian.master
-	cd ${BUILD_DIR}/${KERNEL_SRC}; for patch in ../../patches/kernel/*.patch; do patch -p1 < $${patch}; done
+	set -e; cd ${BUILD_DIR}/${KERNEL_SRC}; for patch in ../../patches/kernel/*.patch; do echo "applying patch '$$patch'" && patch -p1 < $${patch}; done
 	touch $@
 
 ${MODULES}.prepared: $(addsuffix .prepared,${MODULE_DIRS})
 	touch $@
 
-${E1000EDIR}.prepared: ${E1000ESRC}
-	rm -rf ${BUILD_DIR}/${MODULES}/${E1000EDIR} $@
-	mkdir -p ${BUILD_DIR}/${MODULES}/${E1000EDIR}
-	tar --strip-components=1 -C ${BUILD_DIR}/${MODULES}/${E1000EDIR} -xf ${E1000ESRC}
-	cd ${BUILD_DIR}/${MODULES}/${E1000EDIR}; patch -p1 < ../../../patches/intel/intel-module-gcc6-compat.patch
-	cd ${BUILD_DIR}/${MODULES}/${E1000EDIR}; patch -p1 < ../../../patches/intel/e1000e/e1000e_4.10_max-mtu.patch
-	touch $@
-
-${IGBDIR}.prepared: ${IGBSRC}
-	rm -rf ${BUILD_DIR}/${MODULES}/${IGBDIR} $@
-	mkdir -p ${BUILD_DIR}/${MODULES}/${IGBDIR}
-	tar --strip-components=1 -C ${BUILD_DIR}/${MODULES}/${IGBDIR} -xf ${IGBSRC}
-	cd ${BUILD_DIR}/${MODULES}/${IGBDIR}; patch -p1 < ../../../patches/intel/igb/igb_4.10_max-mtu.patch
-	cd ${BUILD_DIR}/${MODULES}/${IGBDIR}; patch -p1 < ../../../patches/intel/igb/igb_4.12_compat.patch
-	touch $@
-
-${IXGBEDIR}.prepared: ${IXGBESRC}
-	rm -rf ${BUILD_DIR}/${MODULES}/${IXGBEDIR} $@
-	mkdir -p ${BUILD_DIR}/${MODULES}/${IXGBEDIR}
-	tar --strip-components=1 -C ${BUILD_DIR}/${MODULES}/${IXGBEDIR} -xf ${IXGBESRC}
-	touch $@
-
-$(SPLDIR).prepared: ${SPLSRC}
-	rm -rf ${BUILD_DIR}/${MODULES}/${SPLDIR} $@
-	mkdir -p ${BUILD_DIR}/${MODULES}/${SPLDIR}
-	cp -a ${SPLSRC}/* ${BUILD_DIR}/${MODULES}/${SPLDIR}
-	cd ${BUILD_DIR}/${MODULES}/${SPLDIR}; for patch in ../../../${SPLSRC}/../spl-patches/*.patch; do patch -p1 < $${patch}; done
-	touch $@
-
-$(ZFSDIR).prepared: ${ZFSSRC}
-	rm -rf ${BUILD_DIR}/${MODULES}/${ZFSDIR} $@
-	mkdir -p ${BUILD_DIR}/${MODULES}/${ZFSDIR}
-	cp -a ${ZFSSRC}/* ${BUILD_DIR}/${MODULES}/${ZFSDIR}
-	cd ${BUILD_DIR}/${MODULES}/${ZFSDIR}; for patch in ../../../${ZFSSRC}/../zfs-patches/*.patch; do patch -p1 < $${patch}; done
-	# temporarily since patch does not know about permissions, remove after 0.7.7 was merged properly
-	chmod +x ${BUILD_DIR}/${MODULES}/${ZFSDIR}/scripts/enum-extract.pl
-	touch $@
+${ZFSDIR}.prepared: ${ZFSONLINUX_SUBMODULE}
+	rm -rf ${BUILD_DIR}/${MODULES}/${ZFSDIR} ${BUILD_DIR}/${MODULES}/tmp $@
+	mkdir -p ${BUILD_DIR}/${MODULES}/tmp
+	cp -a ${ZFSONLINUX_SUBMODULE}/* ${BUILD_DIR}/${MODULES}/tmp
+	cd ${BUILD_DIR}/${MODULES}/tmp; make kernel
+	rm -rf ${BUILD_DIR}/${MODULES}/tmp
+	touch ${ZFSDIR}.prepared
 
 .PHONY: upload
 upload: ${DEBS}
-	tar cf - ${DEBS}|ssh repoman@repo.proxmox.com -- upload --product pve,pmg --dist stretch --arch ${ARCH}
+	tar cf - ${DEBS}|ssh -X repoman@repo.proxmox.com -- upload --product pve,pmg,pbs --dist bullseye --arch ${ARCH}
 
 .PHONY: distclean
 distclean: clean
@@ -168,15 +114,13 @@ distclean: clean
 .PHONY: update_modules
 update_modules: submodule
 	git submodule foreach 'git pull --ff-only origin master'
-	cd ${ZFSSRC}; git pull --ff-only origin master
-	cd ${SPLSRC}; git pull --ff-only origin master
+	cd ${ZFSONLINUX_SUBMODULE}; git pull --ff-only origin master
 
 # make sure submodules were initialized
 .PHONY: submodule
 submodule:
 	test -f "${KERNEL_SRC_SUBMODULE}/README" || git submodule update --init ${KERNEL_SRC_SUBMODULE}
-	test -f "${ZFSONLINUX_SUBMODULE}/Makefile" || git submodule update --init ${ZFSONLINUX_SUBMODULE}
-	(test -f "${ZFSSRC}/debian/changelog" && test -f "${SPLZRC}/debian/changelog") || (cd ${ZFSONLINUX_SUBMODULE}; git submodule update --init)
+	test -f "${ZFSONLINUX_SUBMODULE}/Makefile" || git submodule update --init --recursive ${ZFSONLINUX_SUBMODULE}
 
 # call after ABI bump with header deb in working directory
 .PHONY: abiupdate

README

@@ -3,22 +3,20 @@ KERNEL SOURCE:
 
 We currently use the Ubuntu kernel sources, available from:
 
- http://kernel.ubuntu.com/git/ubuntu/ubuntu-artful.git/
+ http://kernel.ubuntu.com/git/ubuntu/ubuntu-impish.git/
 
 Ubuntu will maintain those kernels till:
 
  https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable
+ or
+ https://pve.proxmox.com/pve-docs/chapter-pve-faq.html#faq-support-table
+
+ whatever happens to be earlier.
 
 
 Additional/Updated Modules:
 ---------------------------
 
-- include latest e1000e driver from intel/sourceforge
-
-- include latest ixgbe driver from intel/sourceforge
-
-- include latest igb driver from intel/sourceforge
-
 - include native OpenZFS filesystem kernel modules for Linux
 
   * https://github.com/zfsonlinux/
@@ -26,6 +24,32 @@ Additional/Updated Modules:
   For licensing questions, see: http://open-zfs.org/wiki/Talk:FAQ
 
 
+SUBMODULE
+=========
+
+We track the current upstream repository as submodule. Besides obvious
+advantages over tracking binary tar archives this also has some implications.
+
+For building the submodule directory gets copied into build/ and a few patches
+get applied with the `patch` tool. From a git point-of-view, the copied
+directory remains clean even with extra patches applied since it does not
+contain a .git directory, but a reference to the (still pristine) submodule:
+
+$ cat build/ubuntu-impish/.git
+
+If you mistakenly cloned the upstream repo as "normal" clone (not via the
+submodule mechanics) this means that you have a real .git directory with its
+independent objects and tracking info when copying for building, thus git
+operates on the copied directory - and "sees" that it was dirtied by `patch`,
+and thus the kernel buildsystem sees this too and will add a '+' to the version
+as a result. This changes the output directories for modules and other build
+artefacts and let's then the build fail on packaging.
+
+So always ensure that you really checked it out as submodule, not as full
+"normal" clone. You can also explicitly set the LOCALVERSION variable to
+undefined with: `export LOCALVERSION= but that should only be done for test
+builds.
+
 RELATED PACKAGES:
 =================
 
@@ -40,7 +64,7 @@ pve-kernel-meta
 ---------------
 
 depends on latest kernel and header package within a certain kernel series,
-e.g., pve-kernel-4.13 / pve-headers-4.13
+e.g., pve-kernel-5.11 / pve-headers-5.11
 
 git clone git://git.proxmox.com/git/pve-kernel-meta.git
 
@@ -55,6 +79,21 @@ git clone git://git.proxmox.com/git/pve-firmware.git
 NOTES:
 ======
 
+ABI versions, package versions and package name:
+------------------------------------------------
+
+We follow debian's versioning w.r.t ABI changes:
+
+https://kernel-team.pages.debian.net/kernel-handbook/ch-versions.html
+https://wiki.debian.org/DebianKernelABIChanges
+
+The debian/rules file has a target comparing the build kernel's ABI against the
+version stored in the repository and indicates when an ABI bump is necessary.
+An ABI bump within one upstream version consists of incrementing the KREL
+variable in the Makefile, rebuilding the packages and running 'make abiupdate'
+(the 'abiupdate' target in 'Makefile' contains the steps for consistently
+updating the repository).
+
 Watchdog blacklist
 ------------------
 
@@ -63,13 +102,25 @@ which device is actually used for /dev/watchdog.
 We ship this list in /lib/modprobe.d/blacklist_pve-kernel-<VERSION>.conf
 The user typically edit /etc/modules to enable a specific watchdog device.
 
+Debug kernel and modules
+------------------------
+
+In order to build a -dbgsym package containing an unstripped copy of the kernel
+image and modules, enable the 'pkg.pve-kernel.debug' build profile (e.g. by
+exporting DEB_BUILD_PROFILES='pkg.pve-kernel.debug'). The resulting package can
+be used together with 'crash'/'kdump-tools' to debug kernel crashes.
+
+Note: the -dbgsym package is only valid for the pve-kernel packages produced by
+the same build. A kernel/module from a different build will likely not match,
+even if both builds are of the same kernel and package version.
+
 Additional information
 ----------------------
 
 We use the default configuration provided by Ubuntu, and apply
 the following modifications:
 
-see debian/rules (PVE_CONFIG_OPTS)
+NOTE: For the exact and current list see debian/rules (PVE_CONFIG_OPTS)
 
 - enable INTEL_MEI_WDT=m (to allow disabling via patch)
 
@@ -80,68 +131,45 @@ see debian/rules (PVE_CONFIG_OPTS)
 - enable CONFIG_CEPH_FS=m (request from user)
 
 - enable common CONFIG_BLK_DEV_XXX to avoid hardware detection
-  problems (udev, undate-initramfs have serious problems without that)
+  problems (udev, update-initramfs have serious problems without that)
 
   	 CONFIG_BLK_DEV_SD=y
   	 CONFIG_BLK_DEV_SR=y
   	 CONFIG_BLK_DEV_DM=y
 
-- add workaround for Debian bug #807000 (see
-  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807000)
-
-  	 CONFIG_BLK_DEV_NVME=y
-
 - compile NBD and RBD modules
 	 CONFIG_BLK_DEV_NBD=m
 	 CONFIG_BLK_DEV_RBD=m
 
-- set LOOP_MIN_COUNT to 8 (debian defaults)
-	 CONFIG_BLK_DEV_LOOP_MIN_COUNT=8
+- enable IBM JFS file system as module
+  requested by users (bug #64)
 
-- disable module signatures (CONFIG_MODULE_SIG)
-
-- enable IBM JFS file system
-
-  This is disabled in RHEL kernel for no real reason, so we enable
-  it as requested by users (bug #64)
-
-- enable apple HFS and HFSPLUS
-
-  This is disabled in RHEL kernel for no real reason, so we enable
-  it as requested by users
+- enable apple HFS and HFSPLUS as module
+  requested by users
 
 - enable CONFIG_BCACHE=m (requested by user)
 
 - enable CONFIG_BRIDGE=y
-
-  Else we get warnings on boot, that
-  net.bridge.bridge-nf-call-iptables is an unknown key
+  to avoid warnings on boot, e.g. that net.bridge.bridge-nf-call-iptables is an unknown key
 
 - enable CONFIG_DEFAULT_SECURITY_APPARMOR
-
   We need this for lxc
 
 - set CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
-
   because if not set, it can give some dynamic memory or cpu frequencies 
   change, and vms can crash (mainly windows guest).
-
   see http://forum.proxmox.com/threads/18238-Windows-7-x64-VMs-crashing-randomly-during-process-termination?p=93273#post93273
 
 - use 'deadline' as default scheduler
-
-  This is the suggested setting for KVM. We also measure bad fsync
-  performance with ext4 and cfq.
+  This is the suggested setting for KVM. We also measure bad fsync performance with ext4 and cfq.
 
 - disable CONFIG_INPUT_EVBUG
-
-  Module evbug is not blacklisted on debian, so we simply disable it
-  to avoid key-event logs (which is a big security problem)
+  Module evbug is not blacklisted on debian, so we simply disable it to avoid
+  key-event logs (which is a big security problem)
 
 - enable CONFIG_MODVERSIONS (needed for ABI tracking)
 
 - switch default UNWINDER to FRAME_POINTER
-
   the recently introduced ORC_UNWINDER is not 100% stable yet, especially in combination with ZFS
 
 - enable CONFIG_PAGE_TABLE_ISOLATION (Meltdown mitigation)

debian/changelog

@@ -1,69 +1,856 @@
-pve-kernel (4.13.16-51) unstable; urgency=medium
+pve-kernel (5.13.19-14) bullseye; urgency=medium
 
-  * update sources to Ubuntu-4.13.0-45.50
+  * update to Ubuntu-5.13.0-36.41
 
-  * bump ABI to 4.13.16-4-pve
+  * bump ABI to 5.13.19-6
 
- -- Proxmox Support Team <support@proxmox.com>  Thu, 05 Jul 2018 10:25:38 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 10 Mar 2022 16:24:52 +0100
 
-pve-kernel (4.13.16-50) unstable; urgency=medium
+pve-kernel (5.13.19-13) bullseye; urgency=medium
 
-  * fix KVM L1 guest escape when nested virtualization is used - CVE-
-    2018-12904
+  * backport "KVM: VMX: prepare sync_pir_to_irr for running with APICv
+    disabled" to avoid breaking some Windows VMs startup
 
- -- Proxmox Support Team <support@proxmox.com>  Wed, 27 Jun 2018 18:02:52 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 08 Mar 2022 07:32:25 +0100
 
-pve-kernel (4.13.16-49) unstable; urgency=medium
+pve-kernel (5.13.19-12) bullseye; urgency=medium
 
-  * update to Ubuntu-4.13.0-43.48
+  * Revert "PCI/MSI: Mask MSI-X vectors only on success" as it's causing PCI-E
+    initialization failures on some systems.
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 07 Mar 2022 15:54:28 +0100
+
+pve-kernel (5.13.19-11) bullseye; urgency=medium
+
+  * backport "lib/iov_iter: initialize "flags" in new pipe_buffer" fixing
+    CVE-2022-0847 "dirty pipe"
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 07 Mar 2022 13:28:22 +0100
+
+pve-kernel (5.13.19-10) bullseye; urgency=medium
+
+  * update to Ubuntu-5.13.0-31.34
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 21 Feb 2022 09:26:12 +0100
+
+pve-kernel (5.13.19-9) bullseye; urgency=medium
+
+  * update to Ubuntu-5.13.0-30.33
+    revert a problematic patch causing issues with releasing block devices
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 07 Feb 2022 11:01:14 +0100
+
+pve-kernel (5.13.19-8) bullseye; urgency=medium
+
+  * update sources to Ubuntu-5.13.0-29.32
+
+  * bump ABI to 5.13.19-4
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 31 Jan 2022 10:09:37 +0100
+
+pve-kernel (5.13.19-7) bullseye; urgency=medium
+
+  * backport "vfs: fs_context: fix up param length parsing in
+    legacy_parse_param"
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 20 Jan 2022 16:37:56 +0100
+
+pve-kernel (5.13.19-6) bullseye; urgency=medium
+
+  * update sources to Ubuntu-5.13.0-24.24
+
+  * bump ABI to 5.13.19-3
+
+  * update ZFS to 2.1.2
+
+  * ZFS: cherry-pick lock-inversion patch for zvol_open
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 11 Jan 2022 16:44:47 +0100
+
+pve-kernel (5.13.19-4) bullseye; urgency=medium
+
+  * update sources to Ubuntu-5.13.0-23.23
+
+  * bump ABI to 5.13.19-2
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 29 Nov 2021 12:10:09 +0100
+
+pve-kernel (5.13.19-3) bullseye; urgency=medium
+
+  * backport two io-wq fixes relevant for io_uring
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 23 Nov 2021 13:31:19 +0100
+
+pve-kernel (5.13.19-2) bullseye; urgency=medium
+
+  * re-enable retrying to get a blockdev on ERESTARTSYS to work around
+    ZFS still depending on that
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 09 Nov 2021 12:59:38 +0100
+
+pve-kernel (5.13.19-1) bullseye; urgency=medium
+
+  * update sources to Ubuntu-5.13.0-22.22
+
+ -- Proxmox Support Team <support@proxmox.com>  Sat, 06 Nov 2021 13:08:30 +0100
+
+pve-kernel (5.13.18-1) bullseye; urgency=medium
+
+  * update sources to Ubuntu-5.13.0-21.21
+
+  * bump ABI to 5.13.18-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 19 Oct 2021 13:42:26 +0200
+
+pve-kernel (5.13.14-1) bullseye; urgency=medium
+
+  * update kernel-base to Ubuntu 21.10 Impish kernel
+
+  * update ZFS to 2.1.1
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 28 Sep 2021 06:16:44 +0200
+
+pve-kernel (5.11.22-9) bullseye; urgency=medium
+
+  * backport "blk-mq: fix kernel panic during iterating over flush
+    request"
+
+  * d/rules: kconfig: enable SQUASHFS_DECOMP_MULTI_PERCPU to speed up
+    decompression of mounted squashfs images
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 22 Sep 2021 10:11:11 +0200
+
+pve-kernel (5.11.22-8) bullseye; urgency=medium
+
+  * update to Ubuntu-5.11.0-34.36
+
+  * fix #3552: cherry-pick PCI probe fixes
+
+  * build nvme as a module again to satisfy some inflexible (mellanox) modules
+    insisting in being able to load the nvme-core module as dependency
+
+  * bump ABI to 5.11.22-4
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Aug 2021 11:51:34 +0200
+
+pve-kernel (5.11.22-7) bullseye; urgency=medium
+
+  * cherry-pick fixes for CVE-2021-3656 and CVE-2021-3653
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 18 Aug 2021 15:06:12 +0200
+
+pve-kernel (5.11.22-6) bullseye; urgency=medium
+
+  * io_uring: don't block level reissue off completion path
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 28 Jul 2021 10:51:12 +0200
+
+pve-kernel (5.11.22-5) bullseye; urgency=medium
+
+  * import Ubuntu-5.11.0-26.28
+
+  * pull in upstream stable releases from v5.10.44, v5.12.11
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 21 Jul 2021 18:25:44 +0200
+
+pve-kernel (5.11.22-4) bullseye; urgency=medium
+
+  * fix CVE-2021-33909: seq_file: disallow extremely large seq buffer
+    allocations
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 20 Jul 2021 21:40:02 +0200
+
+pve-kernel (5.11.22-3) bullseye; urgency=medium
+
+  * update ZFS to 2.0.5
+
+  * pull in upstream stable releases from v5.10.43, v5.12.10
+
+  * ensure 'performance' is the default frequency CPU governor again, as
+    schedutil seems to cause still some issues in with a few VM workloads
+
+ -- Proxmox Support Team <support@proxmox.com>  Sun, 11 Jul 2021 13:45:15 +0200
+
+pve-kernel (5.11.22-2) bullseye; urgency=medium
+
+  * net: bridge: sync fdb to new unicast-filtering ports
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 02 Jul 2021 16:22:45 +0200
+
+pve-kernel (5.11.22-1) bullseye; urgency=medium
+
+  * update sources to stable release 5.11.22 with Ubuntu-5.11.0-23.24
+
+  * pve-kernel-libc-dev: add version to Provides dependency field for
+    linux-libc-dev to satisfy versioned dependencies from other packages
+
+  * build perf with python3
+
+  * fixes #3465: keep unstripped kernel and module files, allowing one to use
+    kdump-tools
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 23 Jun 2021 08:53:17 +0200
+
+pve-kernel (5.11.21-1) bullseye; urgency=medium
+
+  * update sources to stable release 5.11.21 with Ubuntu-5.11.0-19.20
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 01 Jun 2021 16:38:57 +0200
+
+pve-kernel (5.11.17-1) bullseye; urgency=medium
+
+  * update sources to stable release 5.11.17 with Ubuntu-5.11.0-18.19
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 12 May 2021 12:45:37 +0200
+
+pve-kernel (5.11.12-1) bullseye; urgency=medium
+
+  * update sources to Ubuntu-5.11.0-14.15
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 09 Apr 2021 10:31:19 +0200
+
+pve-kernel (5.11.7-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.11.0-12.13
+
+  * update ZFS to 2.0.4
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 18 Mar 2021 14:07:05 +0100
+
+pve-kernel (5.11.0-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.11.0-11.12
+
+  * update ZFS to 2.0.3
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 02 Mar 2021 13:36:01 +0100
+
+pve-kernel (5.10.6-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.10.0-12.13
+
+  * update ZFS to 2.0.1
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 14 Jan 2021 14:27:01 +0100
+
+pve-kernel (5.4.78-2) pve pmg; urgency=medium
+
+  * revert commit 552b270b5784dc3 "scsi: be2iscsi: Fix a theoretical leak in
+    beiscsi_create_eqs()" to avoid hangs and kernel oopses on module load
+
+  * cherry-pick patch to allow unprivileged whiteout device creation
+
+  * bump ABI to 5.4.78-2
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 03 Dec 2020 14:26:17 +0100
+
+pve-kernel (5.4.78-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-57.63
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 30 Nov 2020 10:57:47 +0100
+
+pve-kernel (5.4.73-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-55.61
+
+  * update ZFS to 0.8.5
+
+  * downgrade unregister_netdev waiting to become free error from emergency to
+    error log
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 16 Nov 2020 10:52:16 +0100
+
+pve-kernel (5.4.65-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-49.53
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 21 Sep 2020 15:40:22 +0200
+
+pve-kernel (5.4.60-2) pve pmg; urgency=medium
+
+  * improve guards against a packet offset calculation overflow for certain raw
+    packet sockets
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 04 Sep 2020 10:24:50 +0200
+
+pve-kernel (5.4.60-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-46.50
+
+  * bump ABI to 5.4.60-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 31 Aug 2020 10:36:22 +0200
+
+pve-kernel (5.4.55-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-43.47
+
+  * bump ABI to 5.4.55-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 10 Aug 2020 10:26:27 +0200
+
+pve-kernel (5.4.44-2) pve pmg; urgency=medium
+
+  * fix #2814: config: disable lockdown
+
+  * backport: cgroup: fix cgroup_sk_alloc() for sk_clone_lock()
+
+  * bump ABI to 5.4.44-2
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 01 Jul 2020 16:37:57 +0200
+
+pve-kernel (5.4.44-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-38.42
+
+  * bump ABI to 5.4.44-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 12 Jun 2020 08:18:46 +0200
+
+pve-kernel (5.4.41-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.4.0-32.36
+
+  * update ZFS to 0.8.4
+
+  * Revert "scsi: lpfc: Fix broken Credit Recovery after driver load" as a
+    workaround for some LP Fibre Channel SCSI boxes.
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 15 May 2020 15:06:08 +0200
+
+pve-kernel (5.4.34-2) pve pmg; urgency=medium
+
+  * backport fix for overlayfs
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 07 May 2020 10:02:02 +0200
+
+pve-kernel (5.4.34-1) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.4.0-30.34
+
+  * bump ABI to 5.4.34-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 06 May 2020 10:16:59 +0200
+
+pve-kernel (5.4.30-1) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.4.0-24.28
+
+  * bump ABI to 5.4.30-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 10 Apr 2020 09:12:42 +0200
+
+pve-kernel (5.4.27-1) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.4.0-19.23
+
+  * bump ABI to 5.4.27-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 23 Mar 2020 15:02:22 +0100
+
+pve-kernel (5.4.24-1) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.4.0-18.22
+
+  * bump ABI to 5.4.24-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 09 Mar 2020 12:59:46 +0100
+
+pve-kernel (5.4.22-1) pve pmg; urgency=medium
+
+  * Initial Ubuntu Focal Kernel build, based on 5.4
+
+  * update sources to Ubuntu-5.4.0-17.21
+
+  * bump ABI to 5.4.22-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 02 Mar 2020 15:49:45 +0100
+
+pve-kernel (5.3.18-2) pve pmg; urgency=medium
+
+  * bump ABI to 5.3.18-2
+
+  * update to Ubuntu-5.3.0-41.33
+
+ -- Proxmox Support Team <support@proxmox.com>  Sat, 15 Feb 2020 15:11:52 +0100
+
+pve-kernel (5.3.18-1) pve pmg; urgency=medium
+
+  * bump ABI to 5.3.18-1
+
+  * update sources to Ubuntu-5.3.0-40.32
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 05 Feb 2020 11:49:10 +0100
+
+pve-kernel (5.3.13-3) pve pmg; urgency=medium
+
+  * backport fixes for information leak within a KVM guest
+
+  * bump ABI to 5.3.13-3
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 31 Jan 2020 08:17:11 +0100
+
+pve-kernel (5.3.13-2) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.3.0-29.31
+
+  * update ZFS to 0.8.3
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 24 Jan 2020 09:49:36 +0100
+
+pve-kernel (5.3.13-1) pve pmg; urgency=medium
+
+  * bump ABI to 5.3.13-1
+
+  * update sources to Ubuntu-5.3.0-25.27
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 05 Dec 2019 07:18:14 +0100
+
+pve-kernel (5.3.10-1) pve pmg; urgency=medium
+
+  * bump ABI to 5.3.10-1
+
+  * update sources to Ubuntu-5.3.0-24.26
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 14 Nov 2019 10:43:13 +0100
+
+pve-kernel (5.3.7-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.3.0-20.21
+
+  * bump ABI to 5.3.7-1
+
+  * update ZFS submodule to include FPU/SIMD fixes
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 23 Oct 2019 19:00:21 +0200
+
+pve-kernel (5.3.1-1) pve pmg; urgency=medium
+
+  * Initial Ubuntu Eoan Kernel build, based on 5.3
+
+  * update sources to Ubuntu-5.3.0-16.17
+
+  * bump ABI to 5.3.0-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 01 Oct 2019 18:57:21 +0200
+
+pve-kernel (5.0.21-7) pve pmg; urgency=medium
+
+  * update ZFS to 0.8.2
+
+  * bump ABI to 5.0.21-3
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 30 Sep 2019 09:11:02 +0200
+
+pve-kernel (5.0.21-6) pve pmg; urgency=medium
+
+  * backport new FPU register copy helpers
+
+  * ZFS SIMD: FPU register save/restore is also required on 5.0 kernels
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 27 Sep 2019 17:17:02 +0200
+
+pve-kernel (5.0.21-4) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.0.0-30.32
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 20 Sep 2019 11:55:17 +0200
+
+pve-kernel (5.0.21-3) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-28.30
+
+  * bump ABI to 5.0.21-2
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 05 Sep 2019 13:56:01 +0200
+
+pve-kernel (5.0.21-2) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-27.28
+
+  * backport vhost_net: disable zerocopy by default
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 28 Aug 2019 15:12:18 +0200
+
+pve-kernel (5.0.21-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-26.27
+
+  * update ZFS to include SIMD compat patch for newer Kernel
+
+  * bump ABI to 5.0.21-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 20 Aug 2019 17:16:32 +0200
+
+pve-kernel (5.0.18-3) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-25.26
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 8 Aug 2019 09:05:29 +0200
+
+pve-kernel (5.0.18-2) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-24.25
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 2 Aug 2019 14:51:00 +0200
+
+pve-kernel (5.0.18-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-22.23
+
+  * bump ABI to 5.0.18-1
+
+  * backport "rbd: don't assert on writes to snapshots" to fix issues with
+    DISCARD operations on Ceph RBD backed block devices during a snapshot
+    operation.
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 24 Jul 2019 08:13:30 +0200
+
+pve-kernel (5.0.15-1) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.0.0-21.22
+
+  * bump ABI to 5.0.15-1
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 03 Jul 2019 10:51:57 +0200
+
+pve-kernel (5.0.12-1) pve pmg; urgency=medium
+
+  * update sources to Ubuntu-5.0.0-18.19
+
+  * update to ZFS 0.8.1
+
+  * revert KVM nested option default back to off
+
+ -- Proxmox Support Team <support@proxmox.com>  Sat, 15 Jun 2019 11:39:18 +0200
+
+pve-kernel (5.0.8-2) pve pmg; urgency=medium
+
+  * update to ZFS 0.8.0
+
+  * bump ABI to 5.0.8-2
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 24 May 2019 20:38:04 +0200
+
+pve-kernel (5.0.8-1) pve pmg; urgency=medium
+
+  * update to Ubuntu-5.0.0-16.17
+
+  * bump ABI to 5.0.8-1
+
+  * build for Debian Buster / PVE/PMG 6
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 22 May 2019 14:06:59 +0200
+
+pve-kernel (4.15.18-40) unstable; urgency=medium
+
+  * update to Ubuntu-4.15.0-51.55
+
+  * bump ABI to 4.15.18-15
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 21 May 2019 17:43:20 +0200
+
+pve-kernel (4.15.18-39) unstable; urgency=medium
+
+  * update to Ubuntu-4.15.0-50.54 with MDS mitigations
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 15 May 2019 06:56:23 +0200
+
+pve-kernel (4.15.18-38) unstable; urgency=medium
+
+  * update to Ubuntu-4.15.0-49.53
+
+  * bump ABI to 4.15.18-14
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 30 Apr 2019 10:51:33 +0200
+
+pve-kernel (4.15.18-37) unstable; urgency=medium
+
+  * bump ABI to 4.15.18-13
+
+ -- Proxmox Support Team <support@proxmox.com>  Sat, 13 Apr 2019 21:09:15 +0200
+
+pve-kernel (4.15.18-36) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-48.51
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 05 Apr 2019 18:47:13 +0200
+
+pve-kernel (4.15.18-35) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-47.50
+
+  * update ZFS to 0.7.13
+
+  * bump ABI to 4.15.18-12
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 13 Mar 2019 08:24:42 +0100
+
+pve-kernel (4.15.18-34) unstable; urgency=medium
+
+  * backport fix for possible ipset memory exhaustion bug
+
+  * backport fix for possible use after free in crypto stack
+
+  * backport fixes for multiple KVM vulnerabilities: CVE-2019-6974,
+    CVE-2019-7221, CVE-2019-7222
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 25 Feb 2019 14:51:06 +0100
+
+pve-kernel (4.15.18-33) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-46.49
+
+  * bump ABI to 4.15.18-11
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 05 Feb 2019 07:36:16 +0100
+
+pve-kernel (4.15.18-32) unstable; urgency=medium
+
+  * fix NULL pointer dereference possibility in net/ipip
+
+ -- Proxmox Support Team <support@proxmox.com>  Sat, 19 Jan 2019 10:09:37 +0100
+
+pve-kernel (4.15.18-31) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-44.47
+
+  * bump ABI to 4.15.18-10
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 14 Jan 2019 10:59:31 +0100
+
+pve-kernel (4.15.18-30) unstable; urgency=medium
+
+  * add patches for CVE-2018-18955 and  https://launchpad.net/bugs/1789161
+
+  * update ZFS to 0.7.12
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 15 Nov 2018 13:32:46 +0100
+
+pve-kernel (4.15.18-29) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-40.43
+
+  * bump ABI to 4.15.18-9
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 12 Nov 2018 14:01:34 +0100
+
+pve-kernel (4.15.18-28) unstable; urgency=medium
+
+  * backport deadlock fix for issue ZOL#7939
+
+  * cherry-pick 2 patches planned for zfs-0.7.12
+
+  * update sources to Ubuntu-4.15.0-39.42
+
+  * bump ABI to 4.15.18-8
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 30 Oct 2018 14:27:50 +0100
+
+pve-kernel (4.15.18-27) unstable; urgency=medium
+
+  * backport fix for silent corruption in Linux kernel 4.15 with O_DIRECT
+    (e.g., VM with cache=none disk)
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 10 Oct 2018 10:50:11 +0200
+
+pve-kernel (4.15.18-26) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-37.40
+
+  * bump ABI to 4.15.18-7-pve
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 04 Oct 2018 11:03:06 +0200
+
+pve-kernel (4.15.18-25) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-36.39
+
+  * bump ABI to 4.15.18-6-pve
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 03 Oct 2018 14:09:02 +0200
+
+pve-kernel (4.15.18-24) unstable; urgency=medium
+
+  * bump spl and zfs to 0.7.11
+
+  * update sources to Ubuntu-4.15.0-35.38
+
+  * bump ABI to 4.15.18-5-pve
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 13 Sep 2018 09:15:10 +0200
+
+pve-kernel (4.15.18-23) unstable; urgency=medium
+
+  * backport protection against userspace-userspace spectreRSB
+
+  * update sources to Ubuntu-4.15.0-34.37
+
+  * bump ABI to 4.15.18-4-pve
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 30 Aug 2018 13:04:08 +0200
+
+pve-kernel (4.15.18-22) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-33.36
+
+  * bump ABI to 4.15.18-3-pve
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 24 Aug 2018 11:12:20 +0200
+
+pve-kernel (4.15.18-21) unstable; urgency=medium
+
+  * backport fix for udp/tcp with SO_BINDTODEVICE
+
+  * scsi: hpsa: disable device during shutdown
+
+  * vhost: fix info leak due to uninitialized memory (CVE-2018-1118)
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 23 Aug 2018 11:01:17 +0200
+
+pve-kernel (4.15.18-20) unstable; urgency=medium
+
+  * update to Ubuntu-4.15.0-32.35
+
+  * bump ABI to 4.15.18-2-pve
+
+  * fix CVE-2018-3620, CVE-2018-3646, CVE-2018-5391
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 16 Aug 2018 11:06:35 +0200
+
+pve-kernel (4.15.18-19) unstable; urgency=medium
+
+  * update ZFS submodule to 0.7.9-pve3
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 13 Aug 2018 07:50:59 +0200
+
+pve-kernel (4.15.18-18) unstable; urgency=medium
+
+  * add SGID non-directory fix (fixes CVE-2018-13405)
+  * update to Ubuntu-4.15.0-30.32 (fixes CVE-2018-5390)
+
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 07 Aug 2018 16:04:18 +0200
+
+pve-kernel (4.15.18-17) unstable; urgency=medium
+
+  * apparmor: fix apparmor mediating locking non-fs unix sockets
+    Addresses issues with newer systemd versions found in, e.g., Arch or Fedora
+    containers
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 30 Jul 2018 12:53:35 +0200
+
+pve-kernel (4.15.18-16) unstable; urgency=medium
+
+  * update to Ubuntu-4.15.0-29.31
+
+  * cherry-pick fix for zpl_mount deadlock possibility
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 23 Jul 2018 15:59:19 +0200
+
+pve-kernel (4.15.18-15) unstable; urgency=medium
+
+  * update sources to Ubuntu-4.15.0-24.26
+
+  * drop out-of-tree IXGBE driver
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 04 Jul 2018 15:42:56 +0200
+
+pve-kernel (4.15.17-14) unstable; urgency=medium
+
+  * fix KVM L1 guest escape when nested virtualization is used - CVE-2018-12904
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 27 Jun 2018 17:18:05 +0200
+
+pve-kernel (4.15.17-13) unstable; urgency=medium
+
+  * fix regression for newer out-of-tree IGB driver when setting a non-
+    default MTU
+
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 18 Jun 2018 17:15:04 +0200
+
+pve-kernel (4.15.17-12) unstable; urgency=medium
+
+  * backport fix for SUN NICs when used with Open vSwitch
+
+  * update and re-enable out-of-tree Intel ethernet drivers (e1000e, igb, ixgbe)
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 08 Jun 2018 11:18:32 +0200
+
+pve-kernel (4.15.17-10) unstable; urgency=medium
+
+  * update to Ubuntu-4.15.0-22.24
 
   * update ZFS to 0.7.9-pve1
 
- -- Proxmox Support Team <support@proxmox.com>  Tue, 22 May 2018 15:10:48 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Tue, 22 May 2018 11:15:44 +0200
 
-pve-kernel (4.13.16-48) unstable; urgency=medium
+pve-kernel (4.15.17-9) unstable; urgency=medium
+
+  * include objtool in pve-headers-* package (needed for some external
+    modules)
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 9 May 2018 13:31:43 +0200
+
+pve-kernel (4.15.17-8) unstable; urgency=medium
 
   * update ZFS to 0.7.8-pve1
 
-  * update to Ubuntu-4.13.0-40.45
+  * update sources to Ubuntu-4.15.0-20.21
 
- -- Proxmox Support Team <support@proxmox.com>  Fri, 04 May 2018 11:00:32 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 03 May 2018 08:43:38 +0200
 
-pve-kernel (4.13.16-47) unstable; urgency=medium
+pve-kernel (4.15.17-7) unstable; urgency=medium
 
-  * update to Ubuntu-4.13.0-39.44
+  * update sources to Ubuntu-4.15.0-17.18
 
-  * bump ABI to 4.13.16-2-pve
+  * bump ABI to 4.15.17-1-pve
+
+ -- Proxmox Support Team <support@proxmox.com>  Thu, 19 Apr 2018 14:43:22 +0200
+
+pve-kernel (4.15.15-6) unstable; urgency=medium
 
   * update ZFS to 0.7.7-pve2
 
- -- Proxmox Support Team <support@proxmox.com>  Mon, 9 Apr 2018 09:58:12 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Mon, 9 Apr 2018 12:24:42 +0200
 
-pve-kernel (4.13.16-46) unstable; urgency=medium
+pve-kernel (4.15.15-5) unstable; urgency=medium
 
-  * update ZFS/SPL to 0.7.7
+  * update sources to Ubuntu-4.15.0-14.15
 
- -- Proxmox Support Team <support@proxmox.com>  Wed, 4 Apr 2018 10:30:30 +0200
+  * bump ABI to 4.15.15-1-pve
 
-pve-kernel (4.13.16-45) unstable; urgency=medium
+  * update SPL/ZFS to 0.7.7
+
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 4 Apr 2018 09:50:07 +0200
+
+pve-kernel (4.15.10-4) unstable; urgency=medium
 
   * cherry-pick fix for shmem related deadlock
 
- -- Proxmox Support Team <support@proxmox.com>  Wed, 28 Mar 2018 15:47:11 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 28 Mar 2018 15:47:48 +0200
 
-pve-kernel (4.13.16-44) unstable; urgency=medium
+pve-kernel (4.15.10-3) unstable; urgency=medium
 
   * cherry-pick fix for THP related deadlock
 
- -- Proxmox Support Team <support@proxmox.com>  Wed, 28 Mar 2018 10:36:55 +0200
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 28 Mar 2018 11:07:39 +0200
 
-pve-kernel (4.13.16-43) unstable; urgency=medium
+pve-kernel (4.15.10-2) unstable; urgency=medium
 
-  * update to Ubuntu-4.13.0-38.43
+  * update to Ubuntu-4.15.0-13.14
 
-  * bump ABI to 4.13.16-1-pve
+  * bump ABI to 4.15.10-1-pve
 
- -- Proxmox Support Team <support@proxmox.com>  Fri, 16 Mar 2018 19:41:43 +0100
+ -- Proxmox Support Team <support@proxmox.com>  Wed, 21 Mar 2018 10:35:07 +0100
+
+pve-kernel (4.15.3-1) unstable; urgency=medium
+
+  * switch source to Ubuntu-4.15.0-10.11
+
+  * switch to in-tree Intel NIC drivers (e1000e, igb, ixgbe)
+
+ -- Proxmox Support Team <support@proxmox.com>  Fri, 9 Mar 2018 14:45:34 +0100
 
 pve-kernel (4.13.13-42) unstable; urgency=medium
 

debian/control.in

@@ -2,18 +2,39 @@ Source: pve-kernel
 Section: devel
 Priority: optional
 Maintainer: Proxmox Support Team <support@proxmox.com>
-Build-Depends: asciidoc,
+Build-Depends: asciidoc-base,
+               automake,
                bc,
                bison,
+               cpio,
+               debhelper (>= 10~),
+               dh-python,
+               dwarves,
+               file,
                flex,
-               gcc-6 (>= 6.3.0-18+deb9u1),
+               gcc (>= 8.3.0-6),
+               git,
+               kmod,
+               libdw-dev,
+               libelf-dev,
                libiberty-dev,
+               libnuma-dev,
+               libpve-common-perl,
+               libslang2-dev,
                libssl-dev,
+               libtool,
                lintian,
+               lz4,
+               perl-modules,
+               python3-minimal,
+               rsync,
                sed,
+               sphinx-common,
                tar,
                xmlto,
-Build-Conflicts: pve-headers-@KVNAME@,
+               zlib1g-dev,
+               zstd,
+Build-Conflicts: pve-headers-@KVNAME@
 Vcs-Git: git://git.proxmox.com/git/pve-kernel
 Vcs-Browser: https://git.proxmox.com/?p=pve-kernel.git
 
@@ -21,9 +42,7 @@ Package: linux-tools-@KVMAJMIN@
 Architecture: any
 Section: devel
 Priority: optional
-Depends: linux-base,
-         ${misc:Depends},
-         ${shlibs:Depends},
+Depends: linux-base, ${misc:Depends}, ${shlibs:Depends}
 Description: Linux kernel version specific tools for version @KVMAJMIN@
  This package provides the architecture dependent parts for kernel
  version locked tools (such as perf and x86_energy_perf_policy)
@@ -32,9 +51,8 @@ Package: pve-headers-@KVNAME@
 Section: devel
 Priority: optional
 Architecture: any
-Provides: linux-headers,
-          linux-headers-2.6,
-Depends: coreutils | fileutils (>= 4.0),
+Provides: linux-headers-@KVNAME@-amd64
+Depends: coreutils | fileutils (>= 4.0)
 Description: The Proxmox PVE Kernel Headers
  This package contains the linux kernel headers
 
@@ -42,11 +60,34 @@ Package: pve-kernel-@KVNAME@
 Section: admin
 Priority: optional
 Architecture: any
-Provides: linux-image,
-          linux-image-2.6,
-Suggests: pve-firmware,
-Depends: busybox,
-         grub-pc | grub-efi-amd64 | grub-efi-ia32 | grub-efi-arm64,
-         initramfs-tools,
+Provides: linux-image-@KVNAME@-amd64
+Suggests: pve-firmware
+Depends: busybox, initramfs-tools
+Recommends: grub-pc | grub-efi-amd64 | grub-efi-ia32 | grub-efi-arm64
 Description: The Proxmox PVE Kernel Image
  This package contains the linux kernel and initial ramdisk used for booting
+
+Package: pve-kernel-@KVNAME@-dbgsym
+Architecture: any
+Provides: linux-debug
+Section: devel
+Priority: optional
+Build-Profiles: <pkg.pve-kernel.debug>
+Description: The Proxmox PVE Kernel debug image
+ This package provides the kernel debug image for version @KVNAME@. The debug
+ kernel image contained in this package is NOT meant to boot from - it is
+ uncompressed, and unstripped, and suitable for use with crash/kdump-tools/..
+ to analyze kernel crashes. This package also contains the pve-kernel modules
+ in their unstripped version.
+
+Package: pve-kernel-libc-dev
+Section: devel
+Priority: optional
+Architecture: any
+Provides: linux-libc-dev (=${binary:Version})
+Conflicts: linux-libc-dev
+Replaces: linux-libc-dev
+Depends: ${misc:Depends}
+Description: Linux support headers for userspace development
+ This package provides userspaces headers from the Linux kernel.  These headers
+ are used by the installed headers for GNU libc and other system libraries.

debian/rules

@@ -14,8 +14,11 @@ include debian/rules.d/${DEB_BUILD_ARCH}.mk
 CHANGELOG_DATE:=$(shell dpkg-parsechangelog -SDate)
 
 PVE_KERNEL_PKG=pve-kernel-${KVNAME}
+PVE_DEBUG_KERNEL_PKG=pve-kernel-${KVNAME}-dbgsym
 PVE_HEADER_PKG=pve-headers-${KVNAME}
+PVE_USR_HEADER_PKG=pve-kernel-libc-dev
 LINUX_TOOLS_PKG=linux-tools-${KERNEL_MAJMIN}
+KERNEL_SRC_COPY=${KERNEL_SRC}_tmp
 
 # TODO: split for archs, move to files?
 PVE_CONFIG_OPTS= \
@@ -26,22 +29,43 @@ PVE_CONFIG_OPTS= \
 -m CONFIG_CEPH_FS \
 -m CONFIG_BLK_DEV_NBD \
 -m CONFIG_BLK_DEV_RBD \
+-d CONFIG_SND_PCSP \
 -m CONFIG_BCACHE \
 -m CONFIG_JFS_FS \
 -m CONFIG_HFS_FS \
 -m CONFIG_HFSPLUS_FS \
+-e CIFS_SMB_DIRECT \
+-e CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU \
 -e CONFIG_BRIDGE \
 -e CONFIG_BRIDGE_NETFILTER \
 -e CONFIG_BLK_DEV_SD \
 -e CONFIG_BLK_DEV_SR \
 -e CONFIG_BLK_DEV_DM \
--e CONFIG_BLK_DEV_NVME \
+-m CONFIG_BLK_DEV_NVME \
+-e CONFIG_NLS_ISO8859_1 \
 -d CONFIG_INPUT_EVBUG \
 -d CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND \
+-d CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL \
 -e CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE \
 -d CONFIG_MODULE_SIG \
 -d CONFIG_MEMCG_DISABLED \
 -e CONFIG_MEMCG_SWAP_ENABLED \
+-e CONFIG_HYPERV \
+-m CONFIG_VFIO_IOMMU_TYPE1 \
+-m CONFIG_VFIO_VIRQFD \
+-m CONFIG_VFIO \
+-m CONFIG_VFIO_PCI \
+-m CONFIG_USB_XHCI_HCD \
+-m CONFIG_USB_XHCI_PCI \
+-m CONFIG_USB_EHCI_HCD \
+-m CONFIG_USB_EHCI_PCI \
+-m CONFIG_USB_EHCI_HCD_PLATFORM \
+-m CONFIG_USB_OHCI_HCD \
+-m CONFIG_USB_OHCI_HCD_PCI \
+-m CONFIG_USB_OHCI_HCD_PLATFORM \
+-d CONFIG_USB_OHCI_HCD_SSB \
+-m CONFIG_USB_UHCI_HCD \
+-d CONFIG_USB_SL811_HCD_ISO \
 -e CONFIG_MEMCG_KMEM \
 -d CONFIG_DEFAULT_CFQ \
 -e CONFIG_DEFAULT_DEADLINE \
@@ -52,6 +76,11 @@ PVE_CONFIG_OPTS= \
 -d CONFIG_UNWINDER_ORC \
 -d CONFIG_UNWINDER_GUESS \
 -e CONFIG_UNWINDER_FRAME_POINTER \
+--set-str CONFIG_SYSTEM_TRUSTED_KEYS ""\
+--set-str CONFIG_SYSTEM_REVOCATION_KEYS ""\
+-d CONFIG_SECURITY_LOCKDOWN_LSM \
+-d CONFIG_SECURITY_LOCKDOWN_LSM_EARLY \
+--set-str CONFIG_LSM yama,integrity,apparmor \
 -e CONFIG_PAGE_TABLE_ISOLATION
 
 debian/control: $(wildcard debian/*.in)
@@ -67,7 +96,7 @@ debian/control: $(wildcard debian/*.in)
 
 build: .compile_mark .tools_compile_mark .modules_compile_mark
 
-install: .install_mark .tools_install_mark .headers_install_mark
+install: .install_mark .tools_install_mark .headers_install_mark .usr_headers_install_mark
 	dh_installdocs -A debian/copyright debian/SOURCE
 	dh_installchangelogs
 	dh_installman
@@ -77,7 +106,7 @@ install: .install_mark .tools_install_mark .headers_install_mark
 
 binary: install
 	debian/rules fwcheck abicheck
-	dh_strip -N${PVE_HEADER_PKG}
+	dh_strip -N${PVE_HEADER_PKG} -N${PVE_USR_HEADER_PKG}
 	dh_makeshlibs
 	dh_shlibdeps
 	dh_installdeb
@@ -85,9 +114,15 @@ binary: install
 	dh_md5sums
 	dh_builddeb
 
-.compile_mark: ${KERNEL_SRC}/.config
+.config_mark:
 	cd ${KERNEL_SRC}; scripts/config ${PVE_CONFIG_OPTS}
 	${MAKE} -C ${KERNEL_SRC} oldconfig
+	# copy to allow building in parallel to kernel/module compilation without interference
+	rm -rf ${KERNEL_SRC_COPY}
+	cp -ar ${KERNEL_SRC} ${KERNEL_SRC_COPY}
+	touch $@
+
+.compile_mark: .config_mark
 	${MAKE} -C ${KERNEL_SRC} KBUILD_BUILD_VERSION_TIMESTAMP="PVE ${DEB_VERSION} (${CHANGELOG_DATE})"
 	touch $@
 
@@ -99,17 +134,25 @@ binary: install
 	install -m 644 ${KERNEL_SRC}/System.map debian/${PVE_KERNEL_PKG}/boot/System.map-${KVNAME}
 	install -m 644 ${KERNEL_SRC}/${KERNEL_IMAGE_PATH} debian/${PVE_KERNEL_PKG}/boot/${KERNEL_INSTALL_FILE}-${KVNAME}
 	${MAKE} -C ${KERNEL_SRC} INSTALL_MOD_PATH=${BUILD_DIR}/debian/${PVE_KERNEL_PKG}/ modules_install
-	## install latest ibg driver
-	install -m 644 ${MODULES}/igb.ko debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/kernel/drivers/net/ethernet/intel/igb/
-	# install latest ixgbe driver
-	install -m 644 ${MODULES}/ixgbe.ko debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/kernel/drivers/net/ethernet/intel/ixgbe/
-	# install latest e1000e driver
-	install -m 644 ${MODULES}/e1000e.ko debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/kernel/drivers/net/ethernet/intel/e1000e/
 	# install zfs drivers
 	install -d -m 0755 debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/zfs
-	install -m 644 $(addprefix ${MODULES}/,spl.ko splat.ko zfs.ko zavl.ko znvpair.ko zunicode.ko zcommon.ko zpios.ko icp.ko) debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/zfs
+	install -m 644 $(addprefix ${MODULES}/,zfs.ko zavl.ko znvpair.ko zunicode.ko zcommon.ko icp.ko zlua.ko spl.ko zzstd.ko) debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME}/zfs
 	# remove firmware
 	rm -rf debian/${PVE_KERNEL_PKG}/lib/firmware
+
+ifeq ($(filter pkg.pve-kernel.debug,$(DEB_BUILD_PROFILES)),)
+	echo "'pkg.pve-kernel.debug' build profile disabled, skipping -dbgsym creation"
+else
+	echo "'pkg.pve-kernel.debug' build profile enabled, creating -dbgsym contents"
+	mkdir -p debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/lib/modules/${KVNAME}
+	mkdir debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/boot
+	install -m 644 ${KERNEL_SRC}/vmlinux debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/boot/vmlinux-${KVNAME}
+	cp -r debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME} debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/lib/modules/
+	rm -f debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/lib/modules/${KVNAME}/source
+	rm -f debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/lib/modules/${KVNAME}/build
+	rm -f debian/${PVE_DEBUG_KERNEL_PKG}/usr/lib/debug/lib/modules/${KVNAME}/modules.*
+endif
+
 	# strip debug info
 	find debian/${PVE_KERNEL_PKG}/lib/modules -name \*.ko -print | while read f ; do strip --strip-debug "$$f"; done
 	# finalize
@@ -124,7 +167,7 @@ binary: install
 	touch $@
 
 .tools_compile_mark: .compile_mark
-	${MAKE} -C ${KERNEL_SRC}/tools/perf prefix=/usr HAVE_NO_LIBBFD=1 HAVE_CPLUS_DEMANGLE_SUPPORT=1 NO_LIBPYTHON=1 NO_LIBPERL=1 NO_LIBCRYPTO=1 PYTHON=python2.7
+	${MAKE} -C ${KERNEL_SRC}/tools/perf prefix=/usr HAVE_NO_LIBBFD=1 HAVE_CPLUS_DEMANGLE_SUPPORT=1 NO_LIBPYTHON=1 NO_LIBPERL=1 NO_LIBCRYPTO=1 PYTHON=python3
 	echo "checking GPL-2 only perf binary for library linkage with incompatible licenses.."
 	! ldd ${KERNEL_SRC}/tools/perf/perf | grep -q -E '\blibbfd'
 	! ldd ${KERNEL_SRC}/tools/perf/perf | grep -q -E '\blibcrypto'
@@ -142,12 +185,12 @@ binary: install
 	done
 	touch $@
 
-.headers_install_mark: .compile_mark .modules_compile_mark
+.headers_prepare_mark: .config_mark
 	rm -rf debian/${PVE_HEADER_PKG}
 	mkdir -p debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
 	install -m 0644 ${KERNEL_SRC}/.config debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
-	install -m 0644 ${KERNEL_SRC}/Module.symvers debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
-	cd ${KERNEL_SRC}; find . -path './debian/*' -prune \
+	make -C ${KERNEL_SRC_COPY} mrproper
+	cd ${KERNEL_SRC_COPY}; find . -path './debian/*' -prune \
 	    -o -path './include/*' -prune \
 	    -o -path './Documentation' -prune \
 	    -o -path './scripts' -prune \
@@ -160,50 +203,66 @@ binary: install
 	        -o -name '*.pl' \
 	    \) \
 	    -print | cpio -pd --preserve-modification-time ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
-	cd ${KERNEL_SRC}; cp -a include scripts ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
-	cd ${KERNEL_SRC}; \
+	cd ${KERNEL_SRC_COPY}; \
 	    ( \
 	        find arch/${KERNEL_HEADER_ARCH} -name include -type d -print | \
 	        xargs -n1 -i: find : -type f \
 	    ) | \
 	    cpio -pd --preserve-modification-time ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	touch $@
+
+.headers_compile_mark: .headers_prepare_mark
+	# set output to subdir of source to reduce number of hardcoded paths in output files
+	rm -rf ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}
+	mkdir -p ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}
+	cp ${KERNEL_SRC}/.config ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}/.config
+	${MAKE} -C ${KERNEL_SRC_COPY} O=${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG} -j1 syncconfig modules_prepare prepare scripts
+	cd ${KERNEL_SRC_COPY}; cp -a include scripts ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
+	find ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG} -name \*.o.ur-\* -o -name '*.cmd' | xargs rm -f
+	rsync --ignore-existing -r -v -a $(addprefix ${BUILD_DIR}/${KERNEL_SRC_COPY}/${PVE_HEADER_PKG}/,arch include kernel scripts tools) ${BUILD_DIR}/debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}/
+	rm -rf ${BUILD_DIR}/${KERNEL_SRC_COPY}
+	touch $@
+
+.headers_install_mark: .compile_mark .modules_compile_mark .headers_compile_mark
+	cp ${KERNEL_SRC}/include/generated/compile.h debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}/include/generated/compile.h
+	install -m 0644 ${KERNEL_SRC}/Module.symvers debian/${PVE_HEADER_PKG}/usr/src/linux-headers-${KVNAME}
 	mkdir -p debian/${PVE_HEADER_PKG}/lib/modules/${KVNAME}
 	ln -sf /usr/src/linux-headers-${KVNAME} debian/${PVE_HEADER_PKG}/lib/modules/${KVNAME}/build
 	touch $@
 
-.modules_compile_mark: $(addprefix ${MODULES}/,igb.ko ixgbe.ko e1000e.ko spl.ko zfs.ko)
+.usr_headers_install_mark: PKG_DIR = debian/${PVE_USR_HEADER_PKG}
+.usr_headers_install_mark: OUT_DIR = ${PKG_DIR}/usr
+.usr_headers_install_mark: .config_mark
+	rm -rf '${PKG_DIR}'
+	mkdir -p  '${PKG_DIR}'
+	$(MAKE) -C ${KERNEL_SRC} headers_check ARCH=$(KERNEL_HEADER_ARCH)
+	$(MAKE) -C ${KERNEL_SRC} headers_install ARCH=$(KERNEL_HEADER_ARCH) INSTALL_HDR_PATH='$(CURDIR)'/$(OUT_DIR)
+	rm -rf $(OUT_DIR)/include/drm $(OUT_DIR)/include/scsi
+	find $(OUT_DIR)/include \( -name .install -o -name ..install.cmd \) -execdir rm {} +
+
+# Move include/asm to arch-specific directory
+	mkdir -p $(OUT_DIR)/include/$(DEB_HOST_MULTIARCH)
+	mv $(OUT_DIR)/include/asm $(OUT_DIR)/include/$(DEB_HOST_MULTIARCH)/
+	test ! -d $(OUT_DIR)/include/arch || \
+		mv $(OUT_DIR)/include/arch $(OUT_DIR)/include/$(DEB_HOST_MULTIARCH)/
 	touch $@
 
-${MODULES}/spl.ko: .compile_mark
-	cd ${MODULES}/${SPLDIR}; ./autogen.sh
-	cd ${MODULES}/${SPLDIR}; ./configure --with-config=kernel --with-linux=${BUILD_DIR}/${KERNEL_SRC} --with-linux-obj=${BUILD_DIR}/${KERNEL_SRC}
-	${MAKE} -C ${MODULES}/${SPLDIR}
-	cp ${MODULES}/${SPLDIR}/module/splat/splat.ko ${MODULES}/
-	cp ${MODULES}/${SPLDIR}/module/spl/spl.ko ${MODULES}/
+.modules_compile_mark: ${MODULES}/zfs.ko
+	touch $@
 
-${MODULES}/zfs.ko: .compile_mark ${MODULES}/spl.ko
+${MODULES}/zfs.ko: .compile_mark
 	cd ${MODULES}/${ZFSDIR}; ./autogen.sh
-	cd ${MODULES}/${ZFSDIR}; ./configure --with-spl=${BUILD_DIR}/${MODULES}/${SPLDIR} --with-spl-obj=${BUILD_DIR}/${MODULES}/${SPLDIR} --with-config=kernel --with-linux=${BUILD_DIR}/${KERNEL_SRC} --with-linux-obj=${BUILD_DIR}/${KERNEL_SRC}
+	cd ${MODULES}/${ZFSDIR}; ./configure --with-config=kernel --with-linux=${BUILD_DIR}/${KERNEL_SRC} --with-linux-obj=${BUILD_DIR}/${KERNEL_SRC}
 	${MAKE} -C ${MODULES}/${ZFSDIR}
 	cp ${MODULES}/${ZFSDIR}/module/avl/zavl.ko ${MODULES}/
 	cp ${MODULES}/${ZFSDIR}/module/nvpair/znvpair.ko ${MODULES}/
 	cp ${MODULES}/${ZFSDIR}/module/unicode/zunicode.ko ${MODULES}/
 	cp ${MODULES}/${ZFSDIR}/module/zcommon/zcommon.ko ${MODULES}/
-	cp ${MODULES}/${ZFSDIR}/module/zpios/zpios.ko ${MODULES}/
 	cp ${MODULES}/${ZFSDIR}/module/icp/icp.ko ${MODULES}/
 	cp ${MODULES}/${ZFSDIR}/module/zfs/zfs.ko ${MODULES}/
-
-${MODULES}/igb.ko: .compile_mark
-	${MAKE} -C ${MODULES}/${IGBDIR}/src BUILD_KERNEL=${KVNAME} KSRC=${BUILD_DIR}/${KERNEL_SRC}
-	cp ${MODULES}/${IGBDIR}/src/igb.ko ${MODULES}/
-
-${MODULES}/ixgbe.ko: .compile_mark
-	${MAKE} -C ${MODULES}/${IXGBEDIR}/src CFLAGS_EXTRA="-DIXGBE_NO_LRO" BUILD_KERNEL=${KVNAME} KSRC=${BUILD_DIR}/${KERNEL_SRC}
-	cp ${MODULES}/${IXGBEDIR}/src/ixgbe.ko ${MODULES}/
-
-${MODULES}/e1000e.ko: .compile_mark
-	${MAKE} -C ${MODULES}/${E1000EDIR}/src BUILD_KERNEL=${KVNAME} KSRC=${BUILD_DIR}/${KERNEL_SRC}
-	cp ${MODULES}/${E1000EDIR}/src/e1000e.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/lua/zlua.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/spl/spl.ko ${MODULES}/
+	cp ${MODULES}/${ZFSDIR}/module/zstd/zzstd.ko ${MODULES}/
 
 fwlist-${KVNAME}: .compile_mark .modules_compile_mark
 	debian/scripts/find-firmware.pl debian/${PVE_KERNEL_PKG}/lib/modules/${KVNAME} >fwlist.tmp

debian/scripts/export-patchqueue

@@ -6,7 +6,7 @@ top=$(pwd)
 
 if [ "$#" -ne 3 ]; then
     echo "USAGE: $0 repo patchdir ref"
-    echo "\t exports patches from 'repo' to 'patchdir' based on 'ref'"
+    printf "\t exports patches from 'repo' to 'patchdir' based on 'ref'\n"
     exit 1
 fi
 
@@ -25,10 +25,10 @@ git format-patch \
     --no-cover-letter \
     --zero-commit \
     --no-signature \
-    --output-dir \
-    "${top}/${kernel_patchdir}" \
+    --diff-algorithm=myers \
+    --output-directory="${top}/${kernel_patchdir}" \
     "${base_ref}.."
 
-git checkout ${base_ref}
+git checkout "${base_ref}"
 
 cd "${top}"

debian/scripts/find-firmware.pl

@@ -8,7 +8,7 @@ die "no directory to scan" if !$dir;
 
 die "no such directory" if ! -d $dir;
 
-die "strange directory name" if $dir !~ m|^(.*/)?(4.13.\d+\-\d+\-pve)(/+)?$|;
+die "strange directory name: $dir" if $dir !~ m|^(.*/)?(\d+.\d+.\d+\-\d+\-pve)(/+)?$|;
 
 my $apiver = $2;
 

patches/intel/e1000e/e1000e_4.10_max-mtu.patch

@@ -1,37 +0,0 @@
-diff --git a/src/netdev.c b/src/netdev.c
-index 73b0f9a..aef1bc2 100644
---- a/src/netdev.c
-+++ b/src/netdev.c
-@@ -6724,19 +6724,12 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
- 	int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
- 
- 	/* Jumbo frame support */
--	if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) &&
-+	if ((new_mtu > ETH_DATA_LEN) &&
- 	    !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
- 		e_err("Jumbo Frames not supported.\n");
- 		return -EINVAL;
- 	}
- 
--	/* Supported frame sizes */
--	if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) ||
--	    (max_frame > adapter->max_hw_frame_size)) {
--		e_err("Unsupported MTU setting\n");
--		return -EINVAL;
--	}
--
- 	/* Jumbo frame workaround on 82579 and newer requires CRC be stripped */
- 	if ((adapter->hw.mac.type >= e1000_pch2lan) &&
- 	    !(adapter->flags2 & FLAG2_CRC_STRIPPING) &&
-@@ -8262,6 +8255,11 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
- #endif /* HAVE_NETDEV_VLAN_FEATURES */
- 	}
- 
-+	/* MTU range: 68 - max_hw_frame_size */
-+	netdev->min_mtu = ETH_MIN_MTU;
-+	netdev->max_mtu = adapter->max_hw_frame_size -
-+	                  (VLAN_ETH_HLEN + ETH_FCS_LEN);
-+
- 	if (e1000e_enable_mng_pass_thru(&adapter->hw))
- 		adapter->flags |= FLAG_MNG_PT_ENABLED;
- 

patches/intel/igb/igb_4.10_max-mtu.patch

@@ -1,47 +0,0 @@
-diff --git a/src/e1000_defines.h b/src/e1000_defines.h
-index 6de3988..d58e12f 100644
---- a/src/e1000_defines.h
-+++ b/src/e1000_defines.h
-@@ -423,7 +423,8 @@
- #define ETHERNET_IEEE_VLAN_TYPE		0x8100  /* 802.3ac packet */
- 
- #define ETHERNET_FCS_SIZE		4
--#define MAX_JUMBO_FRAME_SIZE		0x3F00
-+#define MAX_JUMBO_FRAME_SIZE		0x2600
-+#define MAX_STD_JUMBO_FRAME_SIZE	9216
- /* The datasheet maximum supported RX size is 9.5KB (9728 bytes) */
- #define MAX_RX_JUMBO_FRAME_SIZE		0x2600
- #define E1000_TX_PTR_GAP		0x1F
-diff --git a/src/igb_main.c b/src/igb_main.c
-index 2dff0f4..bbfe87e 100644
---- a/src/igb_main.c
-+++ b/src/igb_main.c
-@@ -2852,6 +2852,10 @@ static int igb_probe(struct pci_dev *pdev,
- 	if (pci_using_dac)
- 		netdev->features |= NETIF_F_HIGHDMA;
- 
-+	/* MTU range: 68 - 9216 */
-+	netdev->min_mtu = ETH_MIN_MTU;
-+	netdev->max_mtu = MAX_STD_JUMBO_FRAME_SIZE;
-+
- 	adapter->en_mng_pt = e1000_enable_mng_pass_thru(hw);
- #ifdef DEBUG
- 	if (adapter->dmac != IGB_DMAC_DISABLE)
-@@ -5832,17 +5836,6 @@ static int igb_change_mtu(struct net_device *netdev, int new_mtu)
- 	struct pci_dev *pdev = adapter->pdev;
- 	int max_frame = new_mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN;
- 
--	if ((new_mtu < 68) || (max_frame > MAX_JUMBO_FRAME_SIZE)) {
--		dev_err(pci_dev_to_dev(pdev), "Invalid MTU setting\n");
--		return -EINVAL;
--	}
--
--#define MAX_STD_JUMBO_FRAME_SIZE 9238
--	if (max_frame > MAX_STD_JUMBO_FRAME_SIZE) {
--		dev_err(pci_dev_to_dev(pdev), "MTU > 9216 not supported.\n");
--		return -EINVAL;
--	}
--
- 	/* adjust max frame to be at least the size of a standard frame */
- 	if (max_frame < (ETH_FRAME_LEN + ETH_FCS_LEN))
- 		max_frame = ETH_FRAME_LEN + ETH_FCS_LEN;

patches/intel/igb/igb_4.12_compat.patch

@@ -1,17 +0,0 @@
-diff --git a/src/igb_main.c.orig b/src/igb_main.c
-index 3ee1ec7..c8adf04 100644
---- a/src/igb_main.c.orig
-+++ b/src/igb_main.c
-@@ -1047,8 +1047,10 @@ static void igb_set_interrupt_capability(struct igb_adapter *adapter, bool msix)
- 			for (i = 0; i < numvecs; i++)
- 				adapter->msix_entries[i].entry = i;
- 
--			err = pci_enable_msix(pdev,
--					      adapter->msix_entries, numvecs);
-+			err = pci_enable_msix_range(pdev,
-+						    adapter->msix_entries,
-+						    numvecs,
-+						    numvecs);
- 			if (err == 0)
- 				break;
- 		}

patches/intel/intel-module-gcc6-compat.patch

@@ -1,18 +0,0 @@
-diff --git a/src/Makefile.orig b/src/Makefile
-index 8e962f7..50bcdcc 100644
---- a/src/Makefile.orig
-+++ b/src/Makefile
-@@ -123,6 +123,13 @@ ifeq (,$(CC))
-   $(error Compiler not found)
- endif
- 
-+# workaround for GCC6's default PIE
-+ifeq ($(CC),gcc)
-+  PIE_TEST = [ -z "`$(CC) -fno-PIE -no-pie -x c -c /dev/null -o /dev/null 2>&1`" ]
-+  PIE_FLAGS := $(shell $(PIE_TEST) && echo '-fno-PIE -no-pie')
-+  EXTRA_CFLAGS += $(PIE_FLAGS)
-+endif
-+
- # we need to know what platform the driver is being built on
- # some additional features are only built on Intel platforms
- ARCH := $(shell uname -m | sed 's/i.86/i386/')

patches/kernel/0001-Make-mkcompile_h-accept-an-alternate-timestamp-strin.patch

@@ -15,15 +15,16 @@ Make mkcompile_h use $KBUILD_BUILD_VERSION_TIMESTAMP in preference to
 $KBUILD_BUILD_TIMESTAMP.
 
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  scripts/mkcompile_h | 10 +++++++---
  1 file changed, 7 insertions(+), 3 deletions(-)
 
 diff --git a/scripts/mkcompile_h b/scripts/mkcompile_h
-index fd8fdb91581d..1e35ac9fc810 100755
+index a72b154de7b0..4dd111086466 100755
 --- a/scripts/mkcompile_h
 +++ b/scripts/mkcompile_h
-@@ -37,10 +37,14 @@ else
+@@ -24,10 +24,14 @@ else
  	VERSION=$KBUILD_BUILD_VERSION
  fi
  

patches/kernel/0002-bridge-keep-MAC-of-first-assigned-port.patch

@@ -13,15 +13,16 @@ connected ports (for no real reason). To avoid problems with ARP
 we simply use the MAC of the first connected port.
 
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  net/bridge/br_stp_if.c | 5 +----
  1 file changed, 1 insertion(+), 4 deletions(-)
 
 diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 89110319ef0f..5e73fff65f47 100644
+index ba55851fe132..82675e1ecfb8 100644
 --- a/net/bridge/br_stp_if.c
 +++ b/net/bridge/br_stp_if.c
-@@ -259,10 +259,7 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+@@ -265,10 +265,7 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
  		return false;
  
  	list_for_each_entry(p, &br->port_list, list) {

patches/kernel/0003-pci-Enable-overrides-for-missing-ACS-capabilities-4..patch

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Mark Weiman <mark.weiman@markzz.com>
-Date: Sat, 29 Jul 2017 09:15:32 -0400
-Subject: [PATCH] pci: Enable overrides for missing ACS capabilities (4.12+)
+Date: Wed, 7 Feb 2018 16:04:03 -0500
+Subject: [PATCH] pci: Enable overrides for missing ACS capabilities (4.15)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -48,37 +48,38 @@ capability.  Please contact me to have your devices added and save
 your customers the hassle of this boot option.
 
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
- Documentation/admin-guide/kernel-parameters.txt |   9 +++
- drivers/pci/quirks.c                            | 102 ++++++++++++++++++++++++
+ .../admin-guide/kernel-parameters.txt         |   9 ++
+ drivers/pci/quirks.c                          | 102 ++++++++++++++++++
  2 files changed, 111 insertions(+)
 
 diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
-index ce24cb1e8f46..0cc1d4200c24 100644
+index 550f341daf99..478530b48cf1 100644
 --- a/Documentation/admin-guide/kernel-parameters.txt
 +++ b/Documentation/admin-guide/kernel-parameters.txt
-@@ -2938,6 +2938,15 @@
- 		nomsi		[MSI] If the PCI_MSI kernel config parameter is
- 				enabled, this kernel boot option can be used to
- 				disable the use of MSI interrupts system-wide.
+@@ -3814,6 +3814,15 @@
+ 				Also, it enforces the PCI Local Bus spec
+ 				rule that those bits should be 0 in system reset
+ 				events (useful for kexec/kdump cases).
 +		pci_acs_override =
-+					[PCIE] Override missing PCIe ACS support for:
++				[PCIE] Override missing PCIe ACS support for:
 +				downstream
 +					All downstream ports - full ACS capabilities
-+				multfunction
-+					All multifunction devices - multifunction ACS subset
++				multifunction
++					Add multifunction devices - multifunction ACS subset
 +				id:nnnn:nnnn
-+					Specfic device - full ACS capabilities
++					Specific device - full ACS capabilities
 +					Specified as vid:did (vendor/device ID) in hex
  		noioapicquirk	[APIC] Disable all boot interrupt quirks.
  				Safety option to keep boot IRQs enabled. This
  				should never be necessary.
 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 9dcd5ed5a05b..8882b8d38d7d 100644
+index 444ba11f3e79..5843ba2cad8e 100644
 --- a/drivers/pci/quirks.c
 +++ b/drivers/pci/quirks.c
-@@ -3694,6 +3694,107 @@ static int __init pci_apply_final_quirks(void)
- 
+@@ -193,6 +193,106 @@ static int __init pci_apply_final_quirks(void)
+ }
  fs_initcall_sync(pci_apply_final_quirks);
  
 +static bool acs_on_downstream;
@@ -121,7 +122,6 @@ index 9dcd5ed5a05b..8882b8d38d7d 100644
 +				goto next;
 +			}
 +			acs_on_ids[max_acs_id].vendor = val;
-+
 +			p += strcspn(p, ":");
 +			if (*p != ':') {
 +				pr_warn("PCIe ACS invalid ID\n");
@@ -166,30 +166,31 @@ index 9dcd5ed5a05b..8882b8d38d7d 100644
 +				return 1;
 +
 +	switch (pci_pcie_type(dev)) {
-+	case PCI_EXP_TYPE_DOWNSTREAM:
-+	case PCI_EXP_TYPE_ROOT_PORT:
-+		if (acs_on_downstream)
-+			return 1;
-+		break;
-+	case PCI_EXP_TYPE_ENDPOINT:
-+	case PCI_EXP_TYPE_UPSTREAM:
-+	case PCI_EXP_TYPE_LEG_END:
-+	case PCI_EXP_TYPE_RC_END:
-+		if (acs_on_multifunction && dev->multifunction)
-+			return 1;
++		case PCI_EXP_TYPE_DOWNSTREAM:
++		case PCI_EXP_TYPE_ROOT_PORT:
++			if (acs_on_downstream)
++				return 1;
++			break;
++		case PCI_EXP_TYPE_ENDPOINT:
++		case PCI_EXP_TYPE_UPSTREAM:
++		case PCI_EXP_TYPE_LEG_END:
++		case PCI_EXP_TYPE_RC_END:
++			if (acs_on_multifunction && dev->multifunction)
++				return 1;
 +	}
 +
 +	return -ENOTTY;
 +}
 +
  /*
-  * Following are device-specific reset methods which can be used to
-  * reset a single function if other methods (e.g. FLR, PM D0->D3) are
-@@ -4536,6 +4637,7 @@ static const struct pci_dev_acs_enabled {
- 	{ 0x10df, 0x720, pci_quirk_mf_endpoint_acs }, /* Emulex Skyhawk-R */
- 	/* Cavium ThunderX */
- 	{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
+  * Decoding should be disabled for a PCI device during BAR sizing to avoid
+  * conflict. But doing so may cause problems on host bridge and perhaps other
+@@ -4876,6 +4976,8 @@ static const struct pci_dev_acs_enabled {
+ 	{ PCI_VENDOR_ID_CAVIUM, 0xA060, pci_quirk_mf_endpoint_acs },
+ 	/* APM X-Gene */
+ 	{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
++	/* Enable overrides for missing ACS capabilities */
 +	{ PCI_ANY_ID, PCI_ANY_ID, pcie_acs_overrides },
- 	{ 0 }
- };
- 
+ 	/* Ampere Computing */
+ 	{ PCI_VENDOR_ID_AMPERE, 0xE005, pci_quirk_xgene_acs },
+ 	{ PCI_VENDOR_ID_AMPERE, 0xE006, pci_quirk_xgene_acs },

patches/kernel/0004-kvm-disable-default-dynamic-halt-polling-growth.patch

@@ -7,15 +7,16 @@ Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
 ---
  virt/kvm/kvm_main.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 3b3e54742263..d0085c9d6297 100644
+index b86d4bce9793..946643fa1aa1 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
-@@ -77,7 +77,7 @@ module_param(halt_poll_ns, uint, 0644);
+@@ -78,7 +78,7 @@ module_param(halt_poll_ns, uint, 0644);
  EXPORT_SYMBOL_GPL(halt_poll_ns);
  
  /* Default doubles per-vcpu halt_poll_ns. */

patches/kernel/0005-cgroup-Add-mount-flag-to-enable-cpuset-to-use-v2-beh.patch

@@ -1,63 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Waiman Long <longman@redhat.com>
-Date: Thu, 17 Aug 2017 15:33:09 -0400
-Subject: [PATCH] cgroup: Add mount flag to enable cpuset to use v2 behavior in
- v1 cgroup
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-A new mount option "cpuset_v2_mode" is added to the v1 cgroupfs
-filesystem to enable cpuset controller to use v2 behavior in a v1
-cgroup. This mount option applies only to cpuset controller and have
-no effect on other controllers.
-
-Signed-off-by: Waiman Long <longman@redhat.com>
-Signed-off-by: Tejun Heo <tj@kernel.org>
-(cherry-picked from e1cba4b85daa71b710384d451ff6238d5e4d1ff6)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- include/linux/cgroup-defs.h | 5 +++++
- kernel/cgroup/cgroup-v1.c   | 6 ++++++
- 2 files changed, 11 insertions(+)
-
-diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
-index 09f4c7df1478..c344e77707a5 100644
---- a/include/linux/cgroup-defs.h
-+++ b/include/linux/cgroup-defs.h
-@@ -74,6 +74,11 @@ enum {
- 	 * aren't writeable from inside the namespace.
- 	 */
- 	CGRP_ROOT_NS_DELEGATE	= (1 << 3),
-+
-+	/*
-+	 * Enable cpuset controller in v1 cgroup to use v2 behavior.
-+	 */
-+	CGRP_ROOT_CPUSET_V2_MODE = (1 << 4),
- };
- 
- /* cftype->flags */
-diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
-index 7bf4b1533f34..ce7426b875f5 100644
---- a/kernel/cgroup/cgroup-v1.c
-+++ b/kernel/cgroup/cgroup-v1.c
-@@ -846,6 +846,8 @@ static int cgroup1_show_options(struct seq_file *seq, struct kernfs_root *kf_roo
- 		seq_puts(seq, ",noprefix");
- 	if (root->flags & CGRP_ROOT_XATTR)
- 		seq_puts(seq, ",xattr");
-+	if (root->flags & CGRP_ROOT_CPUSET_V2_MODE)
-+		seq_puts(seq, ",cpuset_v2_mode");
- 
- 	spin_lock(&release_agent_path_lock);
- 	if (strlen(root->release_agent_path))
-@@ -900,6 +902,10 @@ static int parse_cgroupfs_options(char *data, struct cgroup_sb_opts *opts)
- 			opts->cpuset_clone_children = true;
- 			continue;
- 		}
-+		if (!strcmp(token, "cpuset_v2_mode")) {
-+			opts->flags |= CGRP_ROOT_CPUSET_V2_MODE;
-+			continue;
-+		}
- 		if (!strcmp(token, "xattr")) {
- 			opts->flags |= CGRP_ROOT_XATTR;
- 			continue;

patches/kernel/0005-net-core-downgrade-unregister_netdevice-refcount-lea.patch

@@ -0,0 +1,24 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Date: Wed, 7 Oct 2020 17:18:28 +0200
+Subject: [PATCH] net: core: downgrade unregister_netdevice refcount leak from
+ emergency to error
+
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ net/core/dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 7bac7947d8b8..4196ce468b10 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -10533,7 +10533,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
+ 		if (refcnt != 1 &&
+ 		    time_after(jiffies, warning_time +
+ 			       netdev_unregister_timeout_secs * HZ)) {
+-			pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
++			pr_err("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
+ 				 dev->name, refcnt);
+ 			warning_time = jiffies;
+ 		}

patches/kernel/0006-Revert-PCI-Coalesce-host-bridge-contiguous-apertures.patch

@@ -0,0 +1,105 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Thomas Lamprecht <t.lamprecht@proxmox.com>
+Date: Mon, 27 Sep 2021 11:28:39 +0200
+Subject: [PATCH] Revert "PCI: Coalesce host bridge contiguous apertures"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit ab20e43b20b60f5cc8e2ea3763ffa388158469ac.
+
+was reverted upstream because of reports similar to
+
+Link: https://bugzilla.proxmox.com/show_bug.cgi?id=3552
+Link: https://lore.kernel.org/r/20210709231529.GA3270116@roeck-us.net
+Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ drivers/pci/probe.c | 52 +++++----------------------------------------
+ 1 file changed, 5 insertions(+), 47 deletions(-)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 59ef93f1d953..b38a345c5df6 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -19,7 +19,6 @@
+ #include <linux/hypervisor.h>
+ #include <linux/irqdomain.h>
+ #include <linux/pm_runtime.h>
+-#include <linux/list_sort.h>
+ #include "pci.h"
+ 
+ #define CARDBUS_LATENCY_TIMER	176	/* secondary latency timer */
+@@ -875,31 +874,14 @@ static void pci_set_bus_msi_domain(struct pci_bus *bus)
+ 	dev_set_msi_domain(&bus->dev, d);
+ }
+ 
+-static int res_cmp(void *priv, const struct list_head *a,
+-		   const struct list_head *b)
+-{
+-	struct resource_entry *entry1, *entry2;
+-
+-	entry1 = container_of(a, struct resource_entry, node);
+-	entry2 = container_of(b, struct resource_entry, node);
+-
+-	if (entry1->res->flags != entry2->res->flags)
+-		return entry1->res->flags > entry2->res->flags;
+-
+-	if (entry1->offset != entry2->offset)
+-		return entry1->offset > entry2->offset;
+-
+-	return entry1->res->start > entry2->res->start;
+-}
+-
+ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ {
+ 	struct device *parent = bridge->dev.parent;
+-	struct resource_entry *window, *next, *n;
++	struct resource_entry *window, *n;
+ 	struct pci_bus *bus, *b;
+-	resource_size_t offset, next_offset;
++	resource_size_t offset;
+ 	LIST_HEAD(resources);
+-	struct resource *res, *next_res;
++	struct resource *res;
+ 	char addr[64], *fmt;
+ 	const char *name;
+ 	int err;
+@@ -979,35 +961,11 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ 	if (nr_node_ids > 1 && pcibus_to_node(bus) == NUMA_NO_NODE)
+ 		dev_warn(&bus->dev, "Unknown NUMA node; performance will be reduced\n");
+ 
+-	/* Sort and coalesce contiguous windows */
+-	list_sort(NULL, &resources, res_cmp);
+-	resource_list_for_each_entry_safe(window, n, &resources) {
+-		if (list_is_last(&window->node, &resources))
+-			break;
+-
+-		next = list_next_entry(window, node);
+-		offset = window->offset;
+-		res = window->res;
+-		next_offset = next->offset;
+-		next_res = next->res;
+-
+-		if (res->flags != next_res->flags || offset != next_offset)
+-			continue;
+-
+-		if (res->end + 1 == next_res->start) {
+-			next_res->start = res->start;
+-			res->flags = res->start = res->end = 0;
+-		}
+-	}
+-
+ 	/* Add initial resources to the bus */
+ 	resource_list_for_each_entry_safe(window, n, &resources) {
+-		offset = window->offset;
+-		res = window->res;
+-		if (!res->end)
+-			continue;
+-
+ 		list_move_tail(&window->node, &bridge->windows);
++		offset = window->offset;
++		res = window->res;
+ 
+ 		if (res->flags & IORESOURCE_BUS)
+ 			pci_bus_insert_busn_res(bus, bus->number, res->end);

patches/kernel/0006-cpuset-Allow-v2-behavior-in-v1-cgroup.patch

@@ -1,138 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Waiman Long <longman@redhat.com>
-Date: Thu, 17 Aug 2017 15:33:10 -0400
-Subject: [PATCH] cpuset: Allow v2 behavior in v1 cgroup
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Cpuset v2 has some useful behaviors that are not present in v1 because
-of backward compatibility concern. One of that is the restoration of
-the original cpu and memory node mask after a hot removal and addition
-event sequence.
-
-This patch makes the cpuset controller to check the
-CGRP_ROOT_CPUSET_V2_MODE flag and use the v2 behavior if it is set.
-
-Signed-off-by: Waiman Long <longman@redhat.com>
-Signed-off-by: Tejun Heo <tj@kernel.org>
-(cherry-picked from b8d1b8ee93df8ffbabbeadd65d39853cfad6d698)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- kernel/cgroup/cpuset.c | 33 ++++++++++++++++++++-------------
- 1 file changed, 20 insertions(+), 13 deletions(-)
-
-diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
-index e8cb34193433..f76c4bf3d46a 100644
---- a/kernel/cgroup/cpuset.c
-+++ b/kernel/cgroup/cpuset.c
-@@ -300,6 +300,16 @@ static DECLARE_WORK(cpuset_hotplug_work, cpuset_hotplug_workfn);
- static DECLARE_WAIT_QUEUE_HEAD(cpuset_attach_wq);
- 
- /*
-+ * Cgroup v2 behavior is used when on default hierarchy or the
-+ * cgroup_v2_mode flag is set.
-+ */
-+static inline bool is_in_v2_mode(void)
-+{
-+	return cgroup_subsys_on_dfl(cpuset_cgrp_subsys) ||
-+	      (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
-+}
-+
-+/*
-  * This is ugly, but preserves the userspace API for existing cpuset
-  * users. If someone tries to mount the "cpuset" filesystem, we
-  * silently switch it to mount "cgroup" instead
-@@ -489,8 +499,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
- 
- 	/* On legacy hiearchy, we must be a subset of our parent cpuset. */
- 	ret = -EACCES;
--	if (!cgroup_subsys_on_dfl(cpuset_cgrp_subsys) &&
--	    !is_cpuset_subset(trial, par))
-+	if (!is_in_v2_mode() && !is_cpuset_subset(trial, par))
- 		goto out;
- 
- 	/*
-@@ -896,8 +905,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
- 		 * If it becomes empty, inherit the effective mask of the
- 		 * parent, which is guaranteed to have some CPUs.
- 		 */
--		if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys) &&
--		    cpumask_empty(new_cpus))
-+		if (is_in_v2_mode() && cpumask_empty(new_cpus))
- 			cpumask_copy(new_cpus, parent->effective_cpus);
- 
- 		/* Skip the whole subtree if the cpumask remains the same. */
-@@ -914,7 +922,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
- 		cpumask_copy(cp->effective_cpus, new_cpus);
- 		spin_unlock_irq(&callback_lock);
- 
--		WARN_ON(!cgroup_subsys_on_dfl(cpuset_cgrp_subsys) &&
-+		WARN_ON(!is_in_v2_mode() &&
- 			!cpumask_equal(cp->cpus_allowed, cp->effective_cpus));
- 
- 		update_tasks_cpumask(cp);
-@@ -1150,8 +1158,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
- 		 * If it becomes empty, inherit the effective mask of the
- 		 * parent, which is guaranteed to have some MEMs.
- 		 */
--		if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys) &&
--		    nodes_empty(*new_mems))
-+		if (is_in_v2_mode() && nodes_empty(*new_mems))
- 			*new_mems = parent->effective_mems;
- 
- 		/* Skip the whole subtree if the nodemask remains the same. */
-@@ -1168,7 +1175,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
- 		cp->effective_mems = *new_mems;
- 		spin_unlock_irq(&callback_lock);
- 
--		WARN_ON(!cgroup_subsys_on_dfl(cpuset_cgrp_subsys) &&
-+		WARN_ON(!is_in_v2_mode() &&
- 			!nodes_equal(cp->mems_allowed, cp->effective_mems));
- 
- 		update_tasks_nodemask(cp);
-@@ -1460,7 +1467,7 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
- 
- 	/* allow moving tasks into an empty cpuset if on default hierarchy */
- 	ret = -ENOSPC;
--	if (!cgroup_subsys_on_dfl(cpuset_cgrp_subsys) &&
-+	if (!is_in_v2_mode() &&
- 	    (cpumask_empty(cs->cpus_allowed) || nodes_empty(cs->mems_allowed)))
- 		goto out_unlock;
- 
-@@ -1979,7 +1986,7 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
- 	cpuset_inc();
- 
- 	spin_lock_irq(&callback_lock);
--	if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys)) {
-+	if (is_in_v2_mode()) {
- 		cpumask_copy(cs->effective_cpus, parent->effective_cpus);
- 		cs->effective_mems = parent->effective_mems;
- 	}
-@@ -2056,7 +2063,7 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
- 	mutex_lock(&cpuset_mutex);
- 	spin_lock_irq(&callback_lock);
- 
--	if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys)) {
-+	if (is_in_v2_mode()) {
- 		cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
- 		top_cpuset.mems_allowed = node_possible_map;
- 	} else {
-@@ -2250,7 +2257,7 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs)
- 	cpus_updated = !cpumask_equal(&new_cpus, cs->effective_cpus);
- 	mems_updated = !nodes_equal(new_mems, cs->effective_mems);
- 
--	if (cgroup_subsys_on_dfl(cpuset_cgrp_subsys))
-+	if (is_in_v2_mode())
- 		hotplug_update_tasks(cs, &new_cpus, &new_mems,
- 				     cpus_updated, mems_updated);
- 	else
-@@ -2288,7 +2295,7 @@ static void cpuset_hotplug_workfn(struct work_struct *work)
- 	static cpumask_t new_cpus;
- 	static nodemask_t new_mems;
- 	bool cpus_updated, mems_updated;
--	bool on_dfl = cgroup_subsys_on_dfl(cpuset_cgrp_subsys);
-+	bool on_dfl = is_in_v2_mode();
- 
- 	mutex_lock(&cpuset_mutex);
- 

patches/kernel/0007-IB-core-Avoid-crash-on-pkey-enforcement-failed-in-re.patch

@@ -1,90 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Parav Pandit <parav@mellanox.com>
-Date: Fri, 5 Jan 2018 23:51:12 +0100
-Subject: [PATCH] IB/core: Avoid crash on pkey enforcement failed in received
- MADs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 89548bcafec7ecfeea58c553f0834b5d575a66eb upstream.
-
-Below kernel crash is observed when Pkey security enforcement fails on
-received MADs. This issue is reported in [1].
-
-ib_free_recv_mad() accesses the rmpp_list, whose initialization is
-needed before accessing it.
-When security enformcent fails on received MADs, MAD processing avoided
-due to security checks failed.
-
-OpenSM[3770]: SM port is down
-kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
-kernel: IP: ib_free_recv_mad+0x44/0xa0 [ib_core]
-kernel: PGD 0
-kernel: P4D 0
-kernel:
-kernel: Oops: 0002 [#1] SMP
-kernel: CPU: 0 PID: 2833 Comm: kworker/0:1H Tainted: P          IO    4.13.4-1-pve #1
-kernel: Hardware name: Dell       XS23-TY3        /9CMP63, BIOS 1.71 09/17/2013
-kernel: Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
-kernel: task: ffffa069c6541600 task.stack: ffffb9a729054000
-kernel: RIP: 0010:ib_free_recv_mad+0x44/0xa0 [ib_core]
-kernel: RSP: 0018:ffffb9a729057d38 EFLAGS: 00010286
-kernel: RAX: ffffa069cb138a48 RBX: ffffa069cb138a10 RCX: 0000000000000000
-kernel: RDX: ffffb9a729057d38 RSI: 0000000000000000 RDI: ffffa069cb138a20
-kernel: RBP: ffffb9a729057d60 R08: ffffa072d2d49800 R09: ffffa069cb138ae0
-kernel: R10: ffffa069cb138ae0 R11: ffffa072b3994e00 R12: ffffb9a729057d38
-kernel: R13: ffffa069d1c90000 R14: 0000000000000000 R15: ffffa069d1c90880
-kernel: FS:  0000000000000000(0000) GS:ffffa069dba00000(0000) knlGS:0000000000000000
-kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-kernel: CR2: 0000000000000008 CR3: 00000011f51f2000 CR4: 00000000000006f0
-kernel: Call Trace:
-kernel:  ib_mad_recv_done+0x5cc/0xb50 [ib_core]
-kernel:  __ib_process_cq+0x5c/0xb0 [ib_core]
-kernel:  ib_cq_poll_work+0x20/0x60 [ib_core]
-kernel:  process_one_work+0x1e9/0x410
-kernel:  worker_thread+0x4b/0x410
-kernel:  kthread+0x109/0x140
-kernel:  ? process_one_work+0x410/0x410
-kernel:  ? kthread_create_on_node+0x70/0x70
-kernel:  ? SyS_exit_group+0x14/0x20
-kernel:  ret_from_fork+0x25/0x30
-kernel: RIP: ib_free_recv_mad+0x44/0xa0 [ib_core] RSP: ffffb9a729057d38
-kernel: CR2: 0000000000000008
-
-[1] : https://www.spinics.net/lists/linux-rdma/msg56190.html
-
-Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams")
-Signed-off-by: Parav Pandit <parav@mellanox.com>
-Reported-by: Chris Blake <chrisrblake93@gmail.com>
-Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
-Reviewed-by: Hal Rosenstock <hal@mellanox.com>
-Signed-off-by: Doug Ledford <dledford@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- drivers/infiniband/core/mad.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
-index f8f53bb90837..cb91245e9163 100644
---- a/drivers/infiniband/core/mad.c
-+++ b/drivers/infiniband/core/mad.c
-@@ -1974,14 +1974,15 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
- 	unsigned long flags;
- 	int ret;
- 
-+	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
- 	ret = ib_mad_enforce_security(mad_agent_priv,
- 				      mad_recv_wc->wc->pkey_index);
- 	if (ret) {
- 		ib_free_recv_mad(mad_recv_wc);
- 		deref_mad_agent(mad_agent_priv);
-+		return;
- 	}
- 
--	INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
- 	list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
- 	if (ib_mad_kernel_rmpp_agent(&mad_agent_priv->agent)) {
- 		mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,

patches/kernel/0007-PCI-Reinstate-PCI-Coalesce-host-bridge-contiguous-ap.patch

@@ -0,0 +1,113 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Tue, 13 Jul 2021 20:50:07 +0800
+Subject: [PATCH] PCI: Reinstate "PCI: Coalesce host bridge contiguous
+ apertures"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Built-in graphics on HP EliteDesk 805 G6 doesn't work because graphics
+can't get the BAR it needs:
+  pci_bus 0000:00: root bus resource [mem 0x10020200000-0x100303fffff window]
+  pci_bus 0000:00: root bus resource [mem 0x10030400000-0x100401fffff window]
+
+  pci 0000:00:08.1:   bridge window [mem 0xd2000000-0xd23fffff]
+  pci 0000:00:08.1:   bridge window [mem 0x10030000000-0x100401fffff 64bit pref]
+  pci 0000:00:08.1: can't claim BAR 15 [mem 0x10030000000-0x100401fffff 64bit pref]: no compatible bridge window
+  pci 0000:00:08.1: [mem 0x10030000000-0x100401fffff 64bit pref] clipped to [mem 0x10030000000-0x100303fffff 64bit pref]
+  pci 0000:00:08.1:   bridge window [mem 0x10030000000-0x100303fffff 64bit pref]
+  pci 0000:07:00.0: can't claim BAR 0 [mem 0x10030000000-0x1003fffffff 64bit pref]: no compatible bridge window
+  pci 0000:07:00.0: can't claim BAR 2 [mem 0x10040000000-0x100401fffff 64bit pref]: no compatible bridge window
+
+However, the root bus has two contiguous apertures that can contain the
+child resource requested.
+
+Coalesce contiguous apertures so we can allocate from the entire contiguous
+region.
+
+This is the second take of commit 65db04053efe ("PCI: Coalesce host
+bridge contiguous apertures"). The original approach sorts the apertures
+by address, but that makes NVMe stop working on QEMU ppc:sam460ex:
+  PCI host bridge to bus 0002:00
+  pci_bus 0002:00: root bus resource [io  0x0000-0xffff]
+  pci_bus 0002:00: root bus resource [mem 0xd80000000-0xdffffffff] (bus address [0x80000000-0xffffffff])
+  pci_bus 0002:00: root bus resource [mem 0xc0ee00000-0xc0eefffff] (bus address [0x00000000-0x000fffff])
+
+After the offending commit:
+  PCI host bridge to bus 0002:00
+  pci_bus 0002:00: root bus resource [io  0x0000-0xffff]
+  pci_bus 0002:00: root bus resource [mem 0xc0ee00000-0xc0eefffff] (bus address [0x00000000-0x000fffff])
+  pci_bus 0002:00: root bus resource [mem 0xd80000000-0xdffffffff] (bus address [0x80000000-0xffffffff])
+
+Since the apertures on HP EliteDesk 805 G6 are already in ascending
+order, doing a precautious sorting is not necessary.
+
+Remove the sorting part to avoid the regression on ppc:sam460ex.
+
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=212013
+Cc: Guenter Roeck <linux@roeck-us.net>
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ drivers/pci/probe.c | 33 ++++++++++++++++++++++++++++-----
+ 1 file changed, 28 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index b38a345c5df6..485167ca62a1 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -877,11 +877,11 @@ static void pci_set_bus_msi_domain(struct pci_bus *bus)
+ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ {
+ 	struct device *parent = bridge->dev.parent;
+-	struct resource_entry *window, *n;
++	struct resource_entry *window, *next, *n;
+ 	struct pci_bus *bus, *b;
+-	resource_size_t offset;
++	resource_size_t offset, next_offset;
+ 	LIST_HEAD(resources);
+-	struct resource *res;
++	struct resource *res, *next_res;
+ 	char addr[64], *fmt;
+ 	const char *name;
+ 	int err;
+@@ -961,11 +961,34 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
+ 	if (nr_node_ids > 1 && pcibus_to_node(bus) == NUMA_NO_NODE)
+ 		dev_warn(&bus->dev, "Unknown NUMA node; performance will be reduced\n");
+ 
++	/* Coalesce contiguous windows */
++	resource_list_for_each_entry_safe(window, n, &resources) {
++		if (list_is_last(&window->node, &resources))
++			break;
++
++		next = list_next_entry(window, node);
++		offset = window->offset;
++		res = window->res;
++		next_offset = next->offset;
++		next_res = next->res;
++
++		if (res->flags != next_res->flags || offset != next_offset)
++			continue;
++
++		if (res->end + 1 == next_res->start) {
++			next_res->start = res->start;
++			res->flags = res->start = res->end = 0;
++		}
++	}
++
+ 	/* Add initial resources to the bus */
+ 	resource_list_for_each_entry_safe(window, n, &resources) {
++		offset = window->offset;
++		res = window->res;
++		if (!res->end)
++			continue;
++
+ 		list_move_tail(&window->node, &bridge->windows);
+-		offset = window->offset;
+-		res = window->res;
+ 
+ 		if (res->flags & IORESOURCE_BUS)
+ 			pci_bus_insert_busn_res(bus, bus->number, res->end);

patches/kernel/0008-IB-core-Don-t-enforce-PKey-security-on-SMI-MADs.patch

@@ -1,44 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Daniel Jurgens <danielj@mellanox.com>
-Date: Mon, 20 Nov 2017 16:47:45 -0600
-Subject: [PATCH] IB/core: Don't enforce PKey security on SMI MADs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Per the infiniband spec an SMI MAD can have any PKey. Checking the pkey
-on SMI MADs is not necessary, and it seems that some older adapters
-using the mthca driver don't follow the convention of using the default
-PKey, resulting in false denials, or errors querying the PKey cache.
-
-SMI MAD security is still enforced, only agents allowed to manage the
-subnet are able to receive or send SMI MADs.
-
-Reported-by: Chris Blake <chrisrblake93@gmail.com>
-Fixes: 47a2b338fe63("IB/core: Enforce security on management datagrams")
-Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
-Reviewed-by: Parav Pandit <parav@mellanox.com>
-Signed-off-by: Leon Romanovsky <leon@kernel.org>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- drivers/infiniband/core/security.c | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c
-index 70ad19c4c73e..8f9fd3b757db 100644
---- a/drivers/infiniband/core/security.c
-+++ b/drivers/infiniband/core/security.c
-@@ -692,8 +692,11 @@ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)
- {
- 	int ret;
- 
--	if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed)
--		return -EACCES;
-+	if (map->agent.qp->qp_type == IB_QPT_SMI) {
-+		if (!map->agent.smp_allowed)
-+			return -EACCES;
-+		return 0;
-+	}
- 
- 	ret = ib_security_pkey_access(map->agent.device,
- 				      map->agent.port_num,

patches/kernel/0008-io-wq-split-bounded-and-unbounded-work-into-separate.patch

@@ -0,0 +1,418 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Tue, 31 Aug 2021 13:57:32 -0600
+Subject: [PATCH] io-wq: split bounded and unbounded work into separate lists
+
+We've got a few issues that all boil down to the fact that we have one
+list of pending work items, yet two different types of workers to
+serve them. This causes some oddities around workers switching type and
+even hashed work vs regular work on the same bounded list.
+
+Just separate them out cleanly, similarly to how we already do
+accounting of what is running. That provides a clean separation and
+removes some corner cases that can cause stalls when handling IO
+that is punted to io-wq.
+
+Fixes: ecc53c48c13d ("io-wq: check max_worker limits if a worker transitions bound state")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+[backport]
+Signed-off-by: Fabian Ebner <f.ebner@proxmox.com>
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ fs/io-wq.c | 160 +++++++++++++++++++++++------------------------------
+ 1 file changed, 70 insertions(+), 90 deletions(-)
+
+diff --git a/fs/io-wq.c b/fs/io-wq.c
+index ba7aaf2b95d0..6710da3d4445 100644
+--- a/fs/io-wq.c
++++ b/fs/io-wq.c
+@@ -34,7 +34,7 @@ enum {
+ };
+ 
+ enum {
+-	IO_WQE_FLAG_STALLED	= 1,	/* stalled on hash */
++	IO_ACCT_STALLED_BIT	= 0,	/* stalled on hash */
+ };
+ 
+ /*
+@@ -73,26 +73,25 @@ struct io_wqe_acct {
+ 	unsigned max_workers;
+ 	int index;
+ 	atomic_t nr_running;
++	struct io_wq_work_list work_list;
++	unsigned long flags;
+ };
+ 
+ enum {
+ 	IO_WQ_ACCT_BOUND,
+ 	IO_WQ_ACCT_UNBOUND,
++	IO_WQ_ACCT_NR,
+ };
+ 
+ /*
+  * Per-node worker thread pool
+  */
+ struct io_wqe {
+-	struct {
+-		raw_spinlock_t lock;
+-		struct io_wq_work_list work_list;
+-		unsigned flags;
+-	} ____cacheline_aligned_in_smp;
+-
+-	int node;
++	raw_spinlock_t lock;
+ 	struct io_wqe_acct acct[2];
+ 
++	int node;
++
+ 	struct hlist_nulls_head free_list;
+ 	struct list_head all_list;
+ 
+@@ -196,11 +195,10 @@ static void io_worker_exit(struct io_worker *worker)
+ 	do_exit(0);
+ }
+ 
+-static inline bool io_wqe_run_queue(struct io_wqe *wqe)
+-	__must_hold(wqe->lock)
++static inline bool io_acct_run_queue(struct io_wqe_acct *acct)
+ {
+-	if (!wq_list_empty(&wqe->work_list) &&
+-	    !(wqe->flags & IO_WQE_FLAG_STALLED))
++	if (!wq_list_empty(&acct->work_list) &&
++	    !test_bit(IO_ACCT_STALLED_BIT, &acct->flags))
+ 		return true;
+ 	return false;
+ }
+@@ -209,7 +207,8 @@ static inline bool io_wqe_run_queue(struct io_wqe *wqe)
+  * Check head of free list for an available worker. If one isn't available,
+  * caller must create one.
+  */
+-static bool io_wqe_activate_free_worker(struct io_wqe *wqe)
++static bool io_wqe_activate_free_worker(struct io_wqe *wqe,
++					struct io_wqe_acct *acct)
+ 	__must_hold(RCU)
+ {
+ 	struct hlist_nulls_node *n;
+@@ -223,6 +222,10 @@ static bool io_wqe_activate_free_worker(struct io_wqe *wqe)
+ 	hlist_nulls_for_each_entry_rcu(worker, n, &wqe->free_list, nulls_node) {
+ 		if (!io_worker_get(worker))
+ 			continue;
++		if (io_wqe_get_acct(worker) != acct) {
++			io_worker_release(worker);
++			continue;
++		}
+ 		if (wake_up_process(worker->task)) {
+ 			io_worker_release(worker);
+ 			return true;
+@@ -341,7 +344,7 @@ static void io_wqe_dec_running(struct io_worker *worker)
+ 	if (!(worker->flags & IO_WORKER_F_UP))
+ 		return;
+ 
+-	if (atomic_dec_and_test(&acct->nr_running) && io_wqe_run_queue(wqe)) {
++	if (atomic_dec_and_test(&acct->nr_running) && io_acct_run_queue(acct)) {
+ 		atomic_inc(&acct->nr_running);
+ 		atomic_inc(&wqe->wq->worker_refs);
+ 		io_queue_worker_create(wqe, worker, acct);
+@@ -356,29 +359,10 @@ static void __io_worker_busy(struct io_wqe *wqe, struct io_worker *worker,
+ 			     struct io_wq_work *work)
+ 	__must_hold(wqe->lock)
+ {
+-	bool worker_bound, work_bound;
+-
+-	BUILD_BUG_ON((IO_WQ_ACCT_UNBOUND ^ IO_WQ_ACCT_BOUND) != 1);
+-
+ 	if (worker->flags & IO_WORKER_F_FREE) {
+ 		worker->flags &= ~IO_WORKER_F_FREE;
+ 		hlist_nulls_del_init_rcu(&worker->nulls_node);
+ 	}
+-
+-	/*
+-	 * If worker is moving from bound to unbound (or vice versa), then
+-	 * ensure we update the running accounting.
+-	 */
+-	worker_bound = (worker->flags & IO_WORKER_F_BOUND) != 0;
+-	work_bound = (work->flags & IO_WQ_WORK_UNBOUND) == 0;
+-	if (worker_bound != work_bound) {
+-		int index = work_bound ? IO_WQ_ACCT_UNBOUND : IO_WQ_ACCT_BOUND;
+-		io_wqe_dec_running(worker);
+-		worker->flags ^= IO_WORKER_F_BOUND;
+-		wqe->acct[index].nr_workers--;
+-		wqe->acct[index ^ 1].nr_workers++;
+-		io_wqe_inc_running(worker);
+-	 }
+ }
+ 
+ /*
+@@ -420,44 +404,23 @@ static bool io_wait_on_hash(struct io_wqe *wqe, unsigned int hash)
+ 	return ret;
+ }
+ 
+-/*
+- * We can always run the work if the worker is currently the same type as
+- * the work (eg both are bound, or both are unbound). If they are not the
+- * same, only allow it if incrementing the worker count would be allowed.
+- */
+-static bool io_worker_can_run_work(struct io_worker *worker,
+-				   struct io_wq_work *work)
+-{
+-	struct io_wqe_acct *acct;
+-
+-	if (!(worker->flags & IO_WORKER_F_BOUND) !=
+-	    !(work->flags & IO_WQ_WORK_UNBOUND))
+-		return true;
+-
+-	/* not the same type, check if we'd go over the limit */
+-	acct = io_work_get_acct(worker->wqe, work);
+-	return acct->nr_workers < acct->max_workers;
+-}
+-
+-static struct io_wq_work *io_get_next_work(struct io_wqe *wqe,
++static struct io_wq_work *io_get_next_work(struct io_wqe_acct *acct,
+ 					   struct io_worker *worker)
+ 	__must_hold(wqe->lock)
+ {
+ 	struct io_wq_work_node *node, *prev;
+ 	struct io_wq_work *work, *tail;
+ 	unsigned int stall_hash = -1U;
++	struct io_wqe *wqe = worker->wqe;
+ 
+-	wq_list_for_each(node, prev, &wqe->work_list) {
++	wq_list_for_each(node, prev, &acct->work_list) {
+ 		unsigned int hash;
+ 
+ 		work = container_of(node, struct io_wq_work, list);
+ 
+-		if (!io_worker_can_run_work(worker, work))
+-			break;
+-
+ 		/* not hashed, can run anytime */
+ 		if (!io_wq_is_hashed(work)) {
+-			wq_list_del(&wqe->work_list, node, prev);
++			wq_list_del(&acct->work_list, node, prev);
+ 			return work;
+ 		}
+ 
+@@ -468,7 +431,7 @@ static struct io_wq_work *io_get_next_work(struct io_wqe *wqe,
+ 		/* hashed, can run if not already running */
+ 		if (!test_and_set_bit(hash, &wqe->wq->hash->map)) {
+ 			wqe->hash_tail[hash] = NULL;
+-			wq_list_cut(&wqe->work_list, &tail->list, prev);
++			wq_list_cut(&acct->work_list, &tail->list, prev);
+ 			return work;
+ 		}
+ 		if (stall_hash == -1U)
+@@ -484,12 +447,12 @@ static struct io_wq_work *io_get_next_work(struct io_wqe *wqe,
+ 		 * Set this before dropping the lock to avoid racing with new
+ 		 * work being added and clearing the stalled bit.
+ 		 */
+-		wqe->flags |= IO_WQE_FLAG_STALLED;
++		set_bit(IO_ACCT_STALLED_BIT, &acct->flags);
+ 		raw_spin_unlock(&wqe->lock);
+ 		unstalled = io_wait_on_hash(wqe, stall_hash);
+ 		raw_spin_lock(&wqe->lock);
+ 		if (unstalled) {
+-			wqe->flags &= ~IO_WQE_FLAG_STALLED;
++			clear_bit(IO_ACCT_STALLED_BIT, &acct->flags);
+ 			if (wq_has_sleeper(&wqe->wq->hash->wait))
+ 				wake_up(&wqe->wq->hash->wait);
+ 		}
+@@ -526,6 +489,7 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work);
+ static void io_worker_handle_work(struct io_worker *worker)
+ 	__releases(wqe->lock)
+ {
++	struct io_wqe_acct *acct = io_wqe_get_acct(worker);
+ 	struct io_wqe *wqe = worker->wqe;
+ 	struct io_wq *wq = wqe->wq;
+ 	bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state);
+@@ -540,7 +504,7 @@ static void io_worker_handle_work(struct io_worker *worker)
+ 		 * can't make progress, any work completion or insertion will
+ 		 * clear the stalled flag.
+ 		 */
+-		work = io_get_next_work(wqe, worker);
++		work = io_get_next_work(acct, worker);
+ 		if (work)
+ 			__io_worker_busy(wqe, worker, work);
+ 
+@@ -576,7 +540,7 @@ static void io_worker_handle_work(struct io_worker *worker)
+ 				/* serialize hash clear with wake_up() */
+ 				spin_lock_irq(&wq->hash->wait.lock);
+ 				clear_bit(hash, &wq->hash->map);
+-				wqe->flags &= ~IO_WQE_FLAG_STALLED;
++				clear_bit(IO_ACCT_STALLED_BIT, &acct->flags);
+ 				spin_unlock_irq(&wq->hash->wait.lock);
+ 				if (wq_has_sleeper(&wq->hash->wait))
+ 					wake_up(&wq->hash->wait);
+@@ -595,6 +559,7 @@ static void io_worker_handle_work(struct io_worker *worker)
+ static int io_wqe_worker(void *data)
+ {
+ 	struct io_worker *worker = data;
++	struct io_wqe_acct *acct = io_wqe_get_acct(worker);
+ 	struct io_wqe *wqe = worker->wqe;
+ 	struct io_wq *wq = wqe->wq;
+ 	char buf[TASK_COMM_LEN];
+@@ -610,7 +575,7 @@ static int io_wqe_worker(void *data)
+ 		set_current_state(TASK_INTERRUPTIBLE);
+ loop:
+ 		raw_spin_lock_irq(&wqe->lock);
+-		if (io_wqe_run_queue(wqe)) {
++		if (io_acct_run_queue(acct)) {
+ 			io_worker_handle_work(worker);
+ 			goto loop;
+ 		}
+@@ -636,7 +601,7 @@ static int io_wqe_worker(void *data)
+ 
+ 	if (test_bit(IO_WQ_BIT_EXIT, &wq->state)) {
+ 		raw_spin_lock_irq(&wqe->lock);
+-		if (!wq_list_empty(&wqe->work_list))
++		if (!wq_list_empty(&acct->work_list))
+ 			io_worker_handle_work(worker);
+ 		else
+ 			raw_spin_unlock_irq(&wqe->lock);
+@@ -782,12 +747,13 @@ static void io_run_cancel(struct io_wq_work *work, struct io_wqe *wqe)
+ 
+ static void io_wqe_insert_work(struct io_wqe *wqe, struct io_wq_work *work)
+ {
++	struct io_wqe_acct *acct = io_work_get_acct(wqe, work);
+ 	unsigned int hash;
+ 	struct io_wq_work *tail;
+ 
+ 	if (!io_wq_is_hashed(work)) {
+ append:
+-		wq_list_add_tail(&work->list, &wqe->work_list);
++		wq_list_add_tail(&work->list, &acct->work_list);
+ 		return;
+ 	}
+ 
+@@ -797,7 +763,7 @@ static void io_wqe_insert_work(struct io_wqe *wqe, struct io_wq_work *work)
+ 	if (!tail)
+ 		goto append;
+ 
+-	wq_list_add_after(&work->list, &tail->list, &wqe->work_list);
++	wq_list_add_after(&work->list, &tail->list, &acct->work_list);
+ }
+ 
+ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
+@@ -819,10 +785,10 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
+ 
+ 	raw_spin_lock_irqsave(&wqe->lock, flags);
+ 	io_wqe_insert_work(wqe, work);
+-	wqe->flags &= ~IO_WQE_FLAG_STALLED;
++	clear_bit(IO_ACCT_STALLED_BIT, &acct->flags);
+ 
+ 	rcu_read_lock();
+-	do_create = !io_wqe_activate_free_worker(wqe);
++	do_create = !io_wqe_activate_free_worker(wqe, acct);
+ 	rcu_read_unlock();
+ 
+ 	raw_spin_unlock_irqrestore(&wqe->lock, flags);
+@@ -875,6 +841,7 @@ static inline void io_wqe_remove_pending(struct io_wqe *wqe,
+ 					 struct io_wq_work *work,
+ 					 struct io_wq_work_node *prev)
+ {
++	struct io_wqe_acct *acct = io_work_get_acct(wqe, work);
+ 	unsigned int hash = io_get_work_hash(work);
+ 	struct io_wq_work *prev_work = NULL;
+ 
+@@ -886,7 +853,7 @@ static inline void io_wqe_remove_pending(struct io_wqe *wqe,
+ 		else
+ 			wqe->hash_tail[hash] = NULL;
+ 	}
+-	wq_list_del(&wqe->work_list, &work->list, prev);
++	wq_list_del(&acct->work_list, &work->list, prev);
+ }
+ 
+ static void io_wqe_cancel_pending_work(struct io_wqe *wqe,
+@@ -895,22 +862,27 @@ static void io_wqe_cancel_pending_work(struct io_wqe *wqe,
+ 	struct io_wq_work_node *node, *prev;
+ 	struct io_wq_work *work;
+ 	unsigned long flags;
++	int i;
+ 
+ retry:
+ 	raw_spin_lock_irqsave(&wqe->lock, flags);
+-	wq_list_for_each(node, prev, &wqe->work_list) {
+-		work = container_of(node, struct io_wq_work, list);
+-		if (!match->fn(work, match->data))
+-			continue;
+-		io_wqe_remove_pending(wqe, work, prev);
+-		raw_spin_unlock_irqrestore(&wqe->lock, flags);
+-		io_run_cancel(work, wqe);
+-		match->nr_pending++;
+-		if (!match->cancel_all)
+-			return;
++	for (i = 0; i < IO_WQ_ACCT_NR; i++) {
++		struct io_wqe_acct *acct = io_get_acct(wqe, i == 0);
+ 
+-		/* not safe to continue after unlock */
+-		goto retry;
++		wq_list_for_each(node, prev, &acct->work_list) {
++			work = container_of(node, struct io_wq_work, list);
++			if (!match->fn(work, match->data))
++				continue;
++			io_wqe_remove_pending(wqe, work, prev);
++			raw_spin_unlock_irqrestore(&wqe->lock, flags);
++			io_run_cancel(work, wqe);
++			match->nr_pending++;
++			if (!match->cancel_all)
++				return;
++
++			/* not safe to continue after unlock */
++			goto retry;
++		}
+ 	}
+ 	raw_spin_unlock_irqrestore(&wqe->lock, flags);
+ }
+@@ -971,18 +943,24 @@ static int io_wqe_hash_wake(struct wait_queue_entry *wait, unsigned mode,
+ 			    int sync, void *key)
+ {
+ 	struct io_wqe *wqe = container_of(wait, struct io_wqe, wait);
++	int i;
+ 
+ 	list_del_init(&wait->entry);
+ 
+ 	rcu_read_lock();
+-	io_wqe_activate_free_worker(wqe);
++	for (i = 0; i < IO_WQ_ACCT_NR; i++) {
++		struct io_wqe_acct *acct = &wqe->acct[i];
++
++		if (test_and_clear_bit(IO_ACCT_STALLED_BIT, &acct->flags))
++			io_wqe_activate_free_worker(wqe, acct);
++	}
+ 	rcu_read_unlock();
+ 	return 1;
+ }
+ 
+ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)
+ {
+-	int ret = -ENOMEM, node;
++	int ret, node, i;
+ 	struct io_wq *wq;
+ 
+ 	if (WARN_ON_ONCE(!data->free_work || !data->do_work))
+@@ -1019,18 +997,20 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)
+ 			goto err;
+ 		wq->wqes[node] = wqe;
+ 		wqe->node = alloc_node;
+-		wqe->acct[IO_WQ_ACCT_BOUND].index = IO_WQ_ACCT_BOUND;
+-		wqe->acct[IO_WQ_ACCT_UNBOUND].index = IO_WQ_ACCT_UNBOUND;
+ 		wqe->acct[IO_WQ_ACCT_BOUND].max_workers = bounded;
+-		atomic_set(&wqe->acct[IO_WQ_ACCT_BOUND].nr_running, 0);
+ 		wqe->acct[IO_WQ_ACCT_UNBOUND].max_workers =
+ 					task_rlimit(current, RLIMIT_NPROC);
+-		atomic_set(&wqe->acct[IO_WQ_ACCT_UNBOUND].nr_running, 0);
+-		wqe->wait.func = io_wqe_hash_wake;
+ 		INIT_LIST_HEAD(&wqe->wait.entry);
++		wqe->wait.func = io_wqe_hash_wake;
++		for (i = 0; i < IO_WQ_ACCT_NR; i++) {
++			struct io_wqe_acct *acct = &wqe->acct[i];
++
++			acct->index = i;
++			atomic_set(&acct->nr_running, 0);
++			INIT_WQ_LIST(&acct->work_list);
++		}
+ 		wqe->wq = wq;
+ 		raw_spin_lock_init(&wqe->lock);
+-		INIT_WQ_LIST(&wqe->work_list);
+ 		INIT_HLIST_NULLS_HEAD(&wqe->free_list, 0);
+ 		INIT_LIST_HEAD(&wqe->all_list);
+ 	}

patches/kernel/0009-KVM-SVM-obey-guest-PAT.patch

@@ -1,53 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Paolo Bonzini <pbonzini@redhat.com>
-Date: Thu, 26 Oct 2017 09:13:27 +0200
-Subject: [PATCH] KVM: SVM: obey guest PAT
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-For many years some users of assigned devices have reported worse
-performance on AMD processors with NPT than on AMD without NPT,
-Intel or bare metal.
-
-The reason turned out to be that SVM is discarding the guest PAT
-setting and uses the default (PA0=PA4=WB, PA1=PA5=WT, PA2=PA6=UC-,
-PA3=UC).  The guest might be using a different setting, and
-especially might want write combining but isn't getting it
-(instead getting slow UC or UC- accesses).
-
-Thanks a lot to geoff@hostfission.com for noticing the relation
-to the g_pat setting.  The patch has been tested also by a bunch
-of people on VFIO users forums.
-
-Fixes: 709ddebf81cb40e3c36c6109a7892e8b93a09464
-Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=196409
-Cc: stable@vger.kernel.org
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
-Tested-by: Nick Sarnie <commendsarnex@gmail.com>
-Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
-(cherry picked from commit 15038e14724799b8c205beb5f20f9e54896013c3)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- arch/x86/kvm/svm.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 068084c8e540..da10db3de636 100644
---- a/arch/x86/kvm/svm.c
-+++ b/arch/x86/kvm/svm.c
-@@ -3666,6 +3666,13 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
- 	u32 ecx = msr->index;
- 	u64 data = msr->data;
- 	switch (ecx) {
-+	case MSR_IA32_CR_PAT:
-+		if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data))
-+			return 1;
-+		vcpu->arch.pat = data;
-+		svm->vmcb->save.g_pat = data;
-+		mark_dirty(svm->vmcb, VMCB_NPT);
-+		break;
- 	case MSR_IA32_TSC:
- 		kvm_write_tsc(vcpu, msr);
- 		break;

patches/kernel/0009-do-not-generate-split-BTF-type-info-per-default.patch

@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
+Date: Thu, 14 Sep 2017 11:09:58 +0200
+Subject: [PATCH] do not generate split BTF type info per default
+
+This reverts commit a8ed1a0607cfa5478ff6009539f44790c4d0956d.
+
+It breaks ZFS sometimes:
+https://github.com/openzfs/zfs/issues/12301#issuecomment-873303739
+
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ lib/Kconfig.debug | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
+index 25dc20175bba..7ff51a3f65e6 100644
+--- a/lib/Kconfig.debug
++++ b/lib/Kconfig.debug
+@@ -314,7 +314,7 @@ config PAHOLE_HAS_SPLIT_BTF
+ 	def_bool $(success, test `$(PAHOLE) --version | sed -E 's/v([0-9]+)\.([0-9]+)/\1\2/'` -ge "119")
+ 
+ config DEBUG_INFO_BTF_MODULES
+-	def_bool y
++	def_bool n
+ 	depends on DEBUG_INFO_BTF && MODULES && PAHOLE_HAS_SPLIT_BTF
+ 	help
+ 	  Generate compact split BTF type information for kernel modules.

patches/kernel/0010-KVM-VMX-prepare-sync_pir_to_irr-for-running-with-API.patch

@@ -0,0 +1,90 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Mon, 22 Nov 2021 19:43:09 -0500
+Subject: [PATCH] KVM: VMX: prepare sync_pir_to_irr for running with APICv
+ disabled
+
+If APICv is disabled for this vCPU, assigned devices may still attempt to
+post interrupts.  In that case, we need to cancel the vmentry and deliver
+the interrupt with KVM_REQ_EVENT.  Extend the existing code that handles
+injection of L1 interrupts into L2 to cover this case as well.
+
+vmx_hwapic_irr_update is only called when APICv is active so it would be
+confusing to add a check for vcpu->arch.apicv_active in there.  Instead,
+just use vmx_set_rvi directly in vmx_sync_pir_to_irr.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Maxim Levitsky <mlevitsk@redhat.com>
+Reviewed-by: David Matlack <dmatlack@google.com>
+Reviewed-by: Sean Christopherson <seanjc@google.com>
+Message-Id: <20211123004311.2954158-3-pbonzini@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+(cherry picked from commit 7e1901f6c86c896acff6609e0176f93f756d8b2a)
+[ T: reused WARN instead of newer KVM_BUG_ON for minimal change ]
+Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
+---
+ arch/x86/kvm/vmx/vmx.c | 39 +++++++++++++++++++++++++--------------
+ 1 file changed, 25 insertions(+), 14 deletions(-)
+
+diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
+index fc6fbaba1cb5..2f6db087e243 100644
+--- a/arch/x86/kvm/vmx/vmx.c
++++ b/arch/x86/kvm/vmx/vmx.c
+@@ -6331,9 +6331,9 @@ static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
+ 	int max_irr;
+-	bool max_irr_updated;
++	bool got_posted_interrupt;
+ 
+-	WARN_ON(!vcpu->arch.apicv_active);
++	WARN_ON(!enable_apicv);
+ 	if (pi_test_on(&vmx->pi_desc)) {
+ 		pi_clear_on(&vmx->pi_desc);
+ 		/*
+@@ -6341,22 +6341,33 @@ static int vmx_sync_pir_to_irr(struct kvm_vcpu *vcpu)
+ 		 * But on x86 this is just a compiler barrier anyway.
+ 		 */
+ 		smp_mb__after_atomic();
+-		max_irr_updated =
++		got_posted_interrupt =
+ 			kvm_apic_update_irr(vcpu, vmx->pi_desc.pir, &max_irr);
+-
+-		/*
+-		 * If we are running L2 and L1 has a new pending interrupt
+-		 * which can be injected, this may cause a vmexit or it may
+-		 * be injected into L2.  Either way, this interrupt will be
+-		 * processed via KVM_REQ_EVENT, not RVI, because we do not use
+-		 * virtual interrupt delivery to inject L1 interrupts into L2.
+-		 */
+-		if (is_guest_mode(vcpu) && max_irr_updated)
+-			kvm_make_request(KVM_REQ_EVENT, vcpu);
+ 	} else {
+ 		max_irr = kvm_lapic_find_highest_irr(vcpu);
++		got_posted_interrupt = false;
+ 	}
+-	vmx_hwapic_irr_update(vcpu, max_irr);
++
++	/*
++	 * Newly recognized interrupts are injected via either virtual interrupt
++	 * delivery (RVI) or KVM_REQ_EVENT.  Virtual interrupt delivery is
++	 * disabled in two cases:
++	 *
++	 * 1) If L2 is running and the vCPU has a new pending interrupt.  If L1
++	 * wants to exit on interrupts, KVM_REQ_EVENT is needed to synthesize a
++	 * VM-Exit to L1.  If L1 doesn't want to exit, the interrupt is injected
++	 * into L2, but KVM doesn't use virtual interrupt delivery to inject
++	 * interrupts into L2, and so KVM_REQ_EVENT is again needed.
++	 *
++	 * 2) If APICv is disabled for this vCPU, assigned devices may still
++	 * attempt to post interrupts.  The posted interrupt vector will cause
++	 * a VM-Exit and the subsequent entry will call sync_pir_to_irr.
++	 */
++	if (!is_guest_mode(vcpu) && kvm_vcpu_apicv_active(vcpu))
++		vmx_set_rvi(max_irr);
++	else if (got_posted_interrupt)
++		kvm_make_request(KVM_REQ_EVENT, vcpu);
++
+ 	return max_irr;
+ }
+ 

patches/kernel/0010-kvm-nVMX-Enforce-cpl-0-for-VMX-instructions.patch

@@ -1,65 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Felix Wilhelm <fwilhelm@google.com>
-Date: Mon, 11 Jun 2018 09:43:44 +0200
-Subject: [PATCH] kvm: nVMX: Enforce cpl=0 for VMX instructions
-
-VMX instructions executed inside a L1 VM will always trigger a VM exit
-even when executed with cpl 3. This means we must perform the
-privilege check in software.
-
-Fixes: 70f3aac964ae("kvm: nVMX: Remove superfluous VMX instruction fault checks")
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Wilhelm <fwilhelm@google.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
----
- arch/x86/kvm/vmx.c | 15 +++++++++++++--
- 1 file changed, 13 insertions(+), 2 deletions(-)
-
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 54980817194a..b2d75b59b6e5 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -7180,6 +7180,12 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
- 		return 1;
- 	}
- 
-+	/* CPL=0 must be checked manually. */
-+	if (vmx_get_cpl(vcpu)) {
-+		kvm_queue_exception(vcpu, UD_VECTOR);
-+		return 1;
-+	}
-+
- 	if (vmx->nested.vmxon) {
- 		nested_vmx_failValid(vcpu, VMXERR_VMXON_IN_VMX_ROOT_OPERATION);
- 		return kvm_skip_emulated_instruction(vcpu);
-@@ -7239,6 +7245,11 @@ static int handle_vmon(struct kvm_vcpu *vcpu)
-  */
- static int nested_vmx_check_permission(struct kvm_vcpu *vcpu)
- {
-+	if (vmx_get_cpl(vcpu)) {
-+		kvm_queue_exception(vcpu, UD_VECTOR);
-+		return 0;
-+	}
-+
- 	if (!to_vmx(vcpu)->nested.vmxon) {
- 		kvm_queue_exception(vcpu, UD_VECTOR);
- 		return 0;
-@@ -7577,7 +7588,7 @@ static int handle_vmread(struct kvm_vcpu *vcpu)
- 		if (get_vmx_mem_address(vcpu, exit_qualification,
- 				vmx_instruction_info, true, &gva))
- 			return 1;
--		/* _system ok, as hardware has verified cpl=0 */
-+		/* _system ok, nested_vmx_check_permission has verified cpl=0 */
- 		kvm_write_guest_virt_system(&vcpu->arch.emulate_ctxt, gva,
- 			     &field_value, (is_long_mode(vcpu) ? 8 : 4), NULL);
- 	}
-@@ -7720,7 +7731,7 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
- 	if (get_vmx_mem_address(vcpu, exit_qualification,
- 			vmx_instruction_info, true, &vmcs_gva))
- 		return 1;
--	/* ok to use *_system, as hardware has verified cpl=0 */
-+	/* *_system ok, nested_vmx_check_permission has verified cpl=0 */
- 	if (kvm_write_guest_virt_system(&vcpu->arch.emulate_ctxt, vmcs_gva,
- 				 (void *)&to_vmx(vcpu)->nested.current_vmptr,
- 				 sizeof(u64), &e)) {

patches/kernel/0011-net-sched-em_nbyte-don-t-add-the-data-offset-twice.patch

@@ -1,30 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Fri, 19 Jan 2018 11:12:37 +0100
-Subject: [PATCH] net: sched: em_nbyte: don't add the data offset twice
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-'ptr' is shifted by the offset and then validated,
-the memcmp should not add it a second time.
-
-Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- net/sched/em_nbyte.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/net/sched/em_nbyte.c b/net/sched/em_nbyte.c
-index df3110d69585..07c10bac06a0 100644
---- a/net/sched/em_nbyte.c
-+++ b/net/sched/em_nbyte.c
-@@ -51,7 +51,7 @@ static int em_nbyte_match(struct sk_buff *skb, struct tcf_ematch *em,
- 	if (!tcf_valid_offset(skb, ptr, nbyte->hdr.len))
- 		return 0;
- 
--	return !memcmp(ptr + nbyte->hdr.off, nbyte->pattern, nbyte->hdr.len);
-+	return !memcmp(ptr, nbyte->pattern, nbyte->hdr.len);
- }
- 
- static struct tcf_ematch_ops em_nbyte_ops = {

patches/kernel/0012-net-sched-fix-TCF_LAYER_LINK-case-in-tcf_get_base_pt.patch

@@ -1,31 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Fri, 19 Jan 2018 11:12:38 +0100
-Subject: [PATCH] net: sched: fix TCF_LAYER_LINK case in tcf_get_base_ptr
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-TCF_LAYER_LINK and TCF_LAYER_NETWORK returned the same pointer as
-skb->data points to the network header.
-Use skb_mac_header instead.
-
-Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- include/net/pkt_cls.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
-index 537d0a0ad4c4..4450961b1554 100644
---- a/include/net/pkt_cls.h
-+++ b/include/net/pkt_cls.h
-@@ -395,7 +395,7 @@ static inline unsigned char * tcf_get_base_ptr(struct sk_buff *skb, int layer)
- {
- 	switch (layer) {
- 		case TCF_LAYER_LINK:
--			return skb->data;
-+			return skb_mac_header(skb);
- 		case TCF_LAYER_NETWORK:
- 			return skb_network_header(skb);
- 		case TCF_LAYER_TRANSPORT:

patches/kernel/0013-KVM-x86-Add-memory-barrier-on-vmcs-field-lookup.patch

@@ -1,46 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Andrew Honig <ahonig@google.com>
-Date: Wed, 10 Jan 2018 10:12:03 -0800
-Subject: [PATCH] KVM: x86: Add memory barrier on vmcs field lookup
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-commit 75f139aaf896d6fdeec2e468ddfa4b2fe469bf40 upstream.
-
-This adds a memory barrier when performing a lookup into
-the vmcs_field_to_offset_table.  This is related to
-CVE-2017-5753.
-
-Signed-off-by: Andrew Honig <ahonig@google.com>
-Reviewed-by: Jim Mattson <jmattson@google.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- arch/x86/kvm/vmx.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index b2d75b59b6e5..a393186d14b1 100644
---- a/arch/x86/kvm/vmx.c
-+++ b/arch/x86/kvm/vmx.c
-@@ -883,8 +883,16 @@ static inline short vmcs_field_to_offset(unsigned long field)
- {
- 	BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX);
- 
--	if (field >= ARRAY_SIZE(vmcs_field_to_offset_table) ||
--	    vmcs_field_to_offset_table[field] == 0)
-+	if (field >= ARRAY_SIZE(vmcs_field_to_offset_table))
-+		return -ENOENT;
-+
-+	/*
-+	 * FIXME: Mitigation for CVE-2017-5753.  To be replaced with a
-+	 * generic mechanism.
-+	 */
-+	asm("lfence");
-+
-+	if (vmcs_field_to_offset_table[field] == 0)
- 		return -ENOENT;
- 
- 	return vmcs_field_to_offset_table[field];

patches/kernel/0014-EDAC-sb_edac-Fix-missing-break-in-switch.patch

@@ -1,34 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Gustavo A. R. Silva" <garsilva@embeddedor.com>
-Date: Mon, 16 Oct 2017 12:40:29 -0500
-Subject: [PATCH] EDAC, sb_edac: Fix missing break in switch
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Add missing break statement in order to prevent the code from falling
-through.
-
-Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
-Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
-Cc: linux-edac <linux-edac@vger.kernel.org>
-Link: http://lkml.kernel.org/r/20171016174029.GA19757@embeddedor.com
-Signed-off-by: Borislav Petkov <bp@suse.de>
-(cherry picked from commit a8e9b186f153a44690ad0363a56716e7077ad28c)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- drivers/edac/sb_edac.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index 5c3e707ff3fc..59af590b660c 100644
---- a/drivers/edac/sb_edac.c
-+++ b/drivers/edac/sb_edac.c
-@@ -2454,6 +2454,7 @@ static int ibridge_mci_bind_devs(struct mem_ctl_info *mci,
- 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA:
- 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_TA:
- 			pvt->pci_ta = pdev;
-+			break;
- 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_RAS:
- 		case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA1_RAS:
- 			pvt->pci_ras = pdev;

patches/kernel/0015-sched-wait-Fix-add_wait_queue-behavioral-change.patch

@@ -1,49 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Omar Sandoval <osandov@fb.com>
-Date: Tue, 5 Dec 2017 23:15:31 -0800
-Subject: [PATCH] sched/wait: Fix add_wait_queue() behavioral change
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The following cleanup commit:
-
-  50816c48997a ("sched/wait: Standardize internal naming of wait-queue entries")
-
-... unintentionally changed the behavior of add_wait_queue() from
-inserting the wait entry at the head of the wait queue to the tail
-of the wait queue.
-
-Beyond a negative performance impact this change in behavior
-theoretically also breaks wait queues which mix exclusive and
-non-exclusive waiters, as non-exclusive waiters will not be
-woken up if they are queued behind enough exclusive waiters.
-
-Signed-off-by: Omar Sandoval <osandov@fb.com>
-Reviewed-by: Jens Axboe <axboe@kernel.dk>
-Acked-by: Peter Zijlstra <peterz@infradead.org>
-Cc: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Cc: kernel-team@fb.com
-Fixes: ("sched/wait: Standardize internal naming of wait-queue entries")
-Link: http://lkml.kernel.org/r/a16c8ccffd39bd08fdaa45a5192294c784b803a7.1512544324.git.osandov@fb.com
-Signed-off-by: Ingo Molnar <mingo@kernel.org>
-(cherry picked from commit c6b9d9a33029014446bd9ed84c1688f6d3d4eab9)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- kernel/sched/wait.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c
-index d6afed6d0752..c09ebe92a40a 100644
---- a/kernel/sched/wait.c
-+++ b/kernel/sched/wait.c
-@@ -27,7 +27,7 @@ void add_wait_queue(struct wait_queue_head *wq_head, struct wait_queue_entry *wq
- 
- 	wq_entry->flags &= ~WQ_FLAG_EXCLUSIVE;
- 	spin_lock_irqsave(&wq_head->lock, flags);
--	__add_wait_queue_entry_tail(wq_head, wq_entry);
-+	__add_wait_queue(wq_head, wq_entry);
- 	spin_unlock_irqrestore(&wq_head->lock, flags);
- }
- EXPORT_SYMBOL(add_wait_queue);

patches/kernel/0016-module-retpoline-Warn-about-missing-retpoline-in-mod.patch

@@ -1,161 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Andi Kleen <ak@linux.intel.com>
-Date: Thu, 25 Jan 2018 15:50:28 -0800
-Subject: [PATCH] module/retpoline: Warn about missing retpoline in module
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-There's a risk that a kernel which has full retpoline mitigations becomes
-vulnerable when a module gets loaded that hasn't been compiled with the
-right compiler or the right option.
-
-To enable detection of that mismatch at module load time, add a module info
-string "retpoline" at build time when the module was compiled with
-retpoline support. This only covers compiled C source, but assembler source
-or prebuilt object files are not checked.
-
-If a retpoline enabled kernel detects a non retpoline protected module at
-load time, print a warning and report it in the sysfs vulnerability file.
-
-[ tglx: Massaged changelog ]
-
-Signed-off-by: Andi Kleen <ak@linux.intel.com>
-Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
-Cc: David Woodhouse <dwmw2@infradead.org>
-Cc: gregkh@linuxfoundation.org
-Cc: torvalds@linux-foundation.org
-Cc: jeyu@kernel.org
-Cc: arjan@linux.intel.com
-Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org
-(backported from commit caf7501a1b4ec964190f31f9c3f163de252273b8)
-Conflicts:
-	arch/x86/kernel/cpu/bugs.c
-context changes
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- arch/x86/kernel/cpu/bugs.c | 18 +++++++++++++++++-
- include/linux/module.h     |  9 +++++++++
- kernel/module.c            | 11 +++++++++++
- scripts/mod/modpost.c      |  9 +++++++++
- 4 files changed, 46 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
-index 7e5db5aa37f3..b5bcdf7e94d7 100644
---- a/arch/x86/kernel/cpu/bugs.c
-+++ b/arch/x86/kernel/cpu/bugs.c
-@@ -11,6 +11,7 @@
- #include <linux/utsname.h>
- #include <linux/cpu.h>
- #include <linux/smp.h>
-+#include <linux/module.h>
- #include <linux/nospec.h>
- #include <linux/prctl.h>
- 
-@@ -131,6 +132,19 @@ static const char *spectre_v2_strings[] = {
- 
- static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init =
- 	SPECTRE_V2_NONE;
-+static bool spectre_v2_bad_module;
-+
-+#ifdef RETPOLINE
-+bool retpoline_module_ok(bool has_retpoline)
-+{
-+	if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
-+		return true;
-+
-+	pr_err("System may be vunerable to spectre v2\n");
-+	spectre_v2_bad_module = true;
-+	return false;
-+}
-+#endif
- 
- void
- x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest)
-@@ -627,7 +641,9 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr
- 			return sprintf(buf, "Mitigation: OSB (observable speculation barrier, Intel v6)\n");
- 
- 	case X86_BUG_SPECTRE_V2:
--		return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled], ibpb_inuse ? ", IBPB (Intel v4)" : "");
-+		return sprintf(buf, "%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],
-+		               ibpb_inuse ? ",IBPB (Intel v4)" : "",
-+		               spectre_v2_bad_module ? " - vulnerable module loaded" : "");
- 
- 	case X86_BUG_SPEC_STORE_BYPASS:
- 		return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);
-diff --git a/include/linux/module.h b/include/linux/module.h
-index e7bdd549e527..c4fdf7661f82 100644
---- a/include/linux/module.h
-+++ b/include/linux/module.h
-@@ -794,6 +794,15 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr,
- static inline void module_bug_cleanup(struct module *mod) {}
- #endif	/* CONFIG_GENERIC_BUG */
- 
-+#ifdef RETPOLINE
-+extern bool retpoline_module_ok(bool has_retpoline);
-+#else
-+static inline bool retpoline_module_ok(bool has_retpoline)
-+{
-+	return true;
-+}
-+#endif
-+
- #ifdef CONFIG_MODULE_SIG
- static inline bool module_sig_ok(struct module *module)
- {
-diff --git a/kernel/module.c b/kernel/module.c
-index 41b97a191a72..1c3fd6f767b4 100644
---- a/kernel/module.c
-+++ b/kernel/module.c
-@@ -2855,6 +2855,15 @@ static int check_modinfo_livepatch(struct module *mod, struct load_info *info)
- }
- #endif /* CONFIG_LIVEPATCH */
- 
-+static void check_modinfo_retpoline(struct module *mod, struct load_info *info)
-+{
-+	if (retpoline_module_ok(get_modinfo(info, "retpoline")))
-+		return;
-+
-+	pr_warn("%s: loading module not compiled with retpoline compiler.\n",
-+		mod->name);
-+}
-+
- /* Sets info->hdr and info->len. */
- static int copy_module_from_user(const void __user *umod, unsigned long len,
- 				  struct load_info *info)
-@@ -3021,6 +3030,8 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
- 		add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
- 	}
- 
-+	check_modinfo_retpoline(mod, info);
-+
- 	if (get_modinfo(info, "staging")) {
- 		add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
- 		pr_warn("%s: module is from the staging directory, the quality "
-diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
-index 48397feb08fb..cc91f81ac33e 100644
---- a/scripts/mod/modpost.c
-+++ b/scripts/mod/modpost.c
-@@ -2147,6 +2147,14 @@ static void add_intree_flag(struct buffer *b, int is_intree)
- 		buf_printf(b, "\nMODULE_INFO(intree, \"Y\");\n");
- }
- 
-+/* Cannot check for assembler */
-+static void add_retpoline(struct buffer *b)
-+{
-+	buf_printf(b, "\n#ifdef RETPOLINE\n");
-+	buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
-+	buf_printf(b, "#endif\n");
-+}
-+
- static void add_staging_flag(struct buffer *b, const char *name)
- {
- 	static const char *staging_dir = "drivers/staging";
-@@ -2492,6 +2500,7 @@ int main(int argc, char **argv)
- 
- 		add_header(&buf, mod);
- 		add_intree_flag(&buf, !external_module);
-+		add_retpoline(&buf);
- 		add_staging_flag(&buf, mod->name);
- 		err |= add_versions(&buf, mod);
- 		add_depends(&buf, mod, modules);

patches/kernel/0017-net-tcp-close-sock-if-net-namespace-is-exiting.patch

@@ -1,124 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Dan Streetman <ddstreet@ieee.org>
-Date: Thu, 18 Jan 2018 16:14:26 -0500
-Subject: [PATCH] net: tcp: close sock if net namespace is exiting
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When a tcp socket is closed, if it detects that its net namespace is
-exiting, close immediately and do not wait for FIN sequence.
-
-For normal sockets, a reference is taken to their net namespace, so it will
-never exit while the socket is open.  However, kernel sockets do not take a
-reference to their net namespace, so it may begin exiting while the kernel
-socket is still open.  In this case if the kernel socket is a tcp socket,
-it will stay open trying to complete its close sequence.  The sock's dst(s)
-hold a reference to their interface, which are all transferred to the
-namespace's loopback interface when the real interfaces are taken down.
-When the namespace tries to take down its loopback interface, it hangs
-waiting for all references to the loopback interface to release, which
-results in messages like:
-
-unregister_netdevice: waiting for lo to become free. Usage count = 1
-
-These messages continue until the socket finally times out and closes.
-Since the net namespace cleanup holds the net_mutex while calling its
-registered pernet callbacks, any new net namespace initialization is
-blocked until the current net namespace finishes exiting.
-
-After this change, the tcp socket notices the exiting net namespace, and
-closes immediately, releasing its dst(s) and their reference to the
-loopback interface, which lets the net namespace continue exiting.
-
-Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1711407
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=97811
-Signed-off-by: Dan Streetman <ddstreet@canonical.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- include/net/net_namespace.h | 10 ++++++++++
- net/ipv4/tcp.c              |  3 +++
- net/ipv4/tcp_timer.c        | 15 +++++++++++++++
- 3 files changed, 28 insertions(+)
-
-diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
-index 1c401bd4c2e0..a5d023fa78db 100644
---- a/include/net/net_namespace.h
-+++ b/include/net/net_namespace.h
-@@ -221,6 +221,11 @@ int net_eq(const struct net *net1, const struct net *net2)
- 	return net1 == net2;
- }
- 
-+static inline int check_net(const struct net *net)
-+{
-+	return atomic_read(&net->count) != 0;
-+}
-+
- void net_drop_ns(void *);
- 
- #else
-@@ -245,6 +250,11 @@ int net_eq(const struct net *net1, const struct net *net2)
- 	return 1;
- }
- 
-+static inline int check_net(const struct net *net)
-+{
-+	return 1;
-+}
-+
- #define net_drop_ns NULL
- #endif
- 
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index a3e91b552edc..fd2a086da910 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2258,6 +2258,9 @@ void tcp_close(struct sock *sk, long timeout)
- 			tcp_send_active_reset(sk, GFP_ATOMIC);
- 			__NET_INC_STATS(sock_net(sk),
- 					LINUX_MIB_TCPABORTONMEMORY);
-+		} else if (!check_net(sock_net(sk))) {
-+			/* Not possible to send reset; just close */
-+			tcp_set_state(sk, TCP_CLOSE);
- 		}
- 	}
- 
-diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
-index e906014890b6..ec1e5de41653 100644
---- a/net/ipv4/tcp_timer.c
-+++ b/net/ipv4/tcp_timer.c
-@@ -50,11 +50,19 @@ static void tcp_write_err(struct sock *sk)
-  *  to prevent DoS attacks. It is called when a retransmission timeout
-  *  or zero probe timeout occurs on orphaned socket.
-  *
-+ *  Also close if our net namespace is exiting; in that case there is no
-+ *  hope of ever communicating again since all netns interfaces are already
-+ *  down (or about to be down), and we need to release our dst references,
-+ *  which have been moved to the netns loopback interface, so the namespace
-+ *  can finish exiting.  This condition is only possible if we are a kernel
-+ *  socket, as those do not hold references to the namespace.
-+ *
-  *  Criteria is still not confirmed experimentally and may change.
-  *  We kill the socket, if:
-  *  1. If number of orphaned sockets exceeds an administratively configured
-  *     limit.
-  *  2. If we have strong memory pressure.
-+ *  3. If our net namespace is exiting.
-  */
- static int tcp_out_of_resources(struct sock *sk, bool do_reset)
- {
-@@ -83,6 +91,13 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset)
- 		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY);
- 		return 1;
- 	}
-+
-+	if (!check_net(sock_net(sk))) {
-+		/* Not possible to send reset; just close */
-+		tcp_done(sk);
-+		return 1;
-+	}
-+
- 	return 0;
- }
- 

patches/kernel/0018-sctp-fix-dst-refcnt-leak-in-sctp_v4_get_dst.patch

@@ -1,86 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Tommi Rantala <tommi.t.rantala@nokia.com>
-Date: Mon, 5 Feb 2018 21:48:14 +0200
-Subject: [PATCH] sctp: fix dst refcnt leak in sctp_v4_get_dst
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Fix dst reference count leak in sctp_v4_get_dst() introduced in commit
-410f03831 ("sctp: add routing output fallback"):
-
-When walking the address_list, successive ip_route_output_key() calls
-may return the same rt->dst with the reference incremented on each call.
-
-The code would not decrement the dst refcount when the dst pointer was
-identical from the previous iteration, causing the dst refcnt leak.
-
-Testcase:
-  ip netns add TEST
-  ip netns exec TEST ip link set lo up
-  ip link add dummy0 type dummy
-  ip link add dummy1 type dummy
-  ip link add dummy2 type dummy
-  ip link set dev dummy0 netns TEST
-  ip link set dev dummy1 netns TEST
-  ip link set dev dummy2 netns TEST
-  ip netns exec TEST ip addr add 192.168.1.1/24 dev dummy0
-  ip netns exec TEST ip link set dummy0 up
-  ip netns exec TEST ip addr add 192.168.1.2/24 dev dummy1
-  ip netns exec TEST ip link set dummy1 up
-  ip netns exec TEST ip addr add 192.168.1.3/24 dev dummy2
-  ip netns exec TEST ip link set dummy2 up
-  ip netns exec TEST sctp_test -H 192.168.1.2 -P 20002 -h 192.168.1.1 -p 20000 -s -B 192.168.1.3
-  ip netns del TEST
-
-In 4.4 and 4.9 kernels this results to:
-  [  354.179591] unregister_netdevice: waiting for lo to become free. Usage count = 1
-  [  364.419674] unregister_netdevice: waiting for lo to become free. Usage count = 1
-  [  374.663664] unregister_netdevice: waiting for lo to become free. Usage count = 1
-  [  384.903717] unregister_netdevice: waiting for lo to become free. Usage count = 1
-  [  395.143724] unregister_netdevice: waiting for lo to become free. Usage count = 1
-  [  405.383645] unregister_netdevice: waiting for lo to become free. Usage count = 1
-  ...
-
-Fixes: 410f03831 ("sctp: add routing output fallback")
-Fixes: 0ca50d12f ("sctp: fix src address selection if using secondary addresses")
-Signed-off-by: Tommi Rantala <tommi.t.rantala@nokia.com>
-Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
-Acked-by: Neil Horman <nhorman@tuxdriver.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- net/sctp/protocol.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
-diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
-index 989a900383b5..e1a3ae4f3cab 100644
---- a/net/sctp/protocol.c
-+++ b/net/sctp/protocol.c
-@@ -514,22 +514,20 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
- 		if (IS_ERR(rt))
- 			continue;
- 
--		if (!dst)
--			dst = &rt->dst;
--
- 		/* Ensure the src address belongs to the output
- 		 * interface.
- 		 */
- 		odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr,
- 				     false);
- 		if (!odev || odev->ifindex != fl4->flowi4_oif) {
--			if (&rt->dst != dst)
-+			if (!dst)
-+				dst = &rt->dst;
-+			else
- 				dst_release(&rt->dst);
- 			continue;
- 		}
- 
--		if (dst != &rt->dst)
--			dst_release(dst);
-+		dst_release(dst);
- 		dst = &rt->dst;
- 		break;
- 	}

patches/kernel/0019-sctp-fix-dst-refcnt-leak-in-sctp_v6_get_dst.patch

@@ -1,57 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Alexey Kodanev <alexey.kodanev@oracle.com>
-Date: Mon, 5 Feb 2018 15:10:35 +0300
-Subject: [PATCH] sctp: fix dst refcnt leak in sctp_v6_get_dst()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-When going through the bind address list in sctp_v6_get_dst() and
-the previously found address is better ('matchlen > bmatchlen'),
-the code continues to the next iteration without releasing currently
-held destination.
-
-Fix it by releasing 'bdst' before continue to the next iteration, and
-instead of introducing one more '!IS_ERR(bdst)' check for dst_release(),
-move the already existed one right after ip6_dst_lookup_flow(), i.e. we
-shouldn't proceed further if we get an error for the route lookup.
-
-Fixes: dbc2b5e9a09e ("sctp: fix src address selection if using secondary addresses for ipv6")
-Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
-Acked-by: Neil Horman <nhorman@tuxdriver.com>
-Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- net/sctp/ipv6.c | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index edb462b0b73b..e626d72868fe 100644
---- a/net/sctp/ipv6.c
-+++ b/net/sctp/ipv6.c
-@@ -326,8 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
- 		final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final);
- 		bdst = ip6_dst_lookup_flow(sk, fl6, final_p);
- 
--		if (!IS_ERR(bdst) &&
--		    ipv6_chk_addr(dev_net(bdst->dev),
-+		if (IS_ERR(bdst))
-+			continue;
-+
-+		if (ipv6_chk_addr(dev_net(bdst->dev),
- 				  &laddr->a.v6.sin6_addr, bdst->dev, 1)) {
- 			if (!IS_ERR_OR_NULL(dst))
- 				dst_release(dst);
-@@ -336,8 +338,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
- 		}
- 
- 		bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
--		if (matchlen > bmatchlen)
-+		if (matchlen > bmatchlen) {
-+			dst_release(bdst);
- 			continue;
-+		}
- 
- 		if (!IS_ERR_OR_NULL(dst))
- 			dst_release(dst);

patches/kernel/0020-lockd-lost-rollback-of-set_grace_period-in-lockd_dow.patch

@@ -1,43 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Vasily Averin <vvs@virtuozzo.com>
-Date: Thu, 2 Nov 2017 13:03:42 +0300
-Subject: [PATCH] lockd: lost rollback of set_grace_period() in
- lockd_down_net()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Commit efda760fe95ea ("lockd: fix lockd shutdown race") is incorrect,
-it removes lockd_manager and disarm grace_period_end for init_net only.
-
-If nfsd was started from another net namespace lockd_up_net() calls
-set_grace_period() that adds lockd_manager into per-netns list
-and queues grace_period_end delayed work.
-
-These action should be reverted in lockd_down_net().
-Otherwise it can lead to double list_add on after restart nfsd in netns,
-and to use-after-free if non-disarmed delayed work will be executed after netns destroy.
-
-Fixes: efda760fe95e ("lockd: fix lockd shutdown race")
-Cc: stable@vger.kernel.org
-Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
-Signed-off-by: J. Bruce Fields <bfields@redhat.com>
-(cherry picked from commit 3a2b19d1ee5633f76ae8a88da7bc039a5d1732aa)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- fs/lockd/svc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
-index 726b6cecf430..fa8f6effcf00 100644
---- a/fs/lockd/svc.c
-+++ b/fs/lockd/svc.c
-@@ -274,6 +274,8 @@ static void lockd_down_net(struct svc_serv *serv, struct net *net)
- 	if (ln->nlmsvc_users) {
- 		if (--ln->nlmsvc_users == 0) {
- 			nlm_shutdown_hosts_net(net);
-+			cancel_delayed_work_sync(&ln->grace_period_end);
-+			locks_end_grace(&ln->lockd_manager);
- 			svc_shutdown_net(serv, net);
- 			dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net);
- 		}

patches/kernel/0021-ocfs2-make-metadata-estimation-accurate-and-clear.patch

@@ -1,58 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Changwei Ge <ge.changwei@h3c.com>
-Date: Wed, 31 Jan 2018 16:15:02 -0800
-Subject: [PATCH] ocfs2: make metadata estimation accurate and clear
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Current code assume that ::w_unwritten_list always has only one item on.
-This is not right and hard to get understood.  So improve how to count
-unwritten item.
-
-Link: http://lkml.kernel.org/r/1515479070-32653-1-git-send-email-ge.changwei@h3c.com
-Signed-off-by: Changwei Ge <ge.changwei@h3c.com>
-Reported-by: John Lightsey <john@nixnuts.net>
-Tested-by: John Lightsey <john@nixnuts.net>
-Cc: Mark Fasheh <mfasheh@versity.com>
-Cc: Joseph Qi <jiangqi903@gmail.com>
-Cc: Junxiao Bi <junxiao.bi@oracle.com>
-Cc: Joel Becker <jlbec@evilplan.org>
-Cc: Changwei Ge <ge.changwei@h3c.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-(cherry picked from commit 63de8bd9328bf2a778fc277503da163ae3defa3c)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- fs/ocfs2/aops.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
-index 88a31e9340a0..77ec9b495027 100644
---- a/fs/ocfs2/aops.c
-+++ b/fs/ocfs2/aops.c
-@@ -784,6 +784,7 @@ struct ocfs2_write_ctxt {
- 	struct ocfs2_cached_dealloc_ctxt w_dealloc;
- 
- 	struct list_head		w_unwritten_list;
-+	unsigned int			w_unwritten_count;
- };
- 
- void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
-@@ -1373,6 +1374,7 @@ static int ocfs2_unwritten_check(struct inode *inode,
- 	desc->c_clear_unwritten = 0;
- 	list_add_tail(&new->ue_ip_node, &oi->ip_unwritten_list);
- 	list_add_tail(&new->ue_node, &wc->w_unwritten_list);
-+	wc->w_unwritten_count++;
- 	new = NULL;
- unlock:
- 	spin_unlock(&oi->ip_lock);
-@@ -2246,7 +2248,7 @@ static int ocfs2_dio_get_block(struct inode *inode, sector_t iblock,
- 		ue->ue_phys = desc->c_phys;
- 
- 		list_splice_tail_init(&wc->w_unwritten_list, &dwc->dw_zero_list);
--		dwc->dw_zero_count++;
-+		dwc->dw_zero_count += wc->w_unwritten_count;
- 	}
- 
- 	ret = ocfs2_write_end_nolock(inode->i_mapping, pos, len, len, wc);

patches/kernel/0022-ocfs2-try-to-reuse-extent-block-in-dealloc-without-m.patch

@@ -1,367 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Changwei Ge <ge.changwei@h3c.com>
-Date: Wed, 31 Jan 2018 16:15:06 -0800
-Subject: [PATCH] ocfs2: try to reuse extent block in dealloc without
- meta_alloc
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-A crash issue was reported by John Lightsey with a call trace as follows:
-
-  ocfs2_split_extent+0x1ad3/0x1b40 [ocfs2]
-  ocfs2_change_extent_flag+0x33a/0x470 [ocfs2]
-  ocfs2_mark_extent_written+0x172/0x220 [ocfs2]
-  ocfs2_dio_end_io+0x62d/0x910 [ocfs2]
-  dio_complete+0x19a/0x1a0
-  do_blockdev_direct_IO+0x19dd/0x1eb0
-  __blockdev_direct_IO+0x43/0x50
-  ocfs2_direct_IO+0x8f/0xa0 [ocfs2]
-  generic_file_direct_write+0xb2/0x170
-  __generic_file_write_iter+0xc3/0x1b0
-  ocfs2_file_write_iter+0x4bb/0xca0 [ocfs2]
-  __vfs_write+0xae/0xf0
-  vfs_write+0xb8/0x1b0
-  SyS_write+0x4f/0xb0
-  system_call_fastpath+0x16/0x75
-
-The BUG code told that extent tree wants to grow but no metadata was
-reserved ahead of time.  From my investigation into this issue, the root
-cause it that although enough metadata is not reserved, there should be
-enough for following use.  Rightmost extent is merged into its left one
-due to a certain times of marking extent written.  Because during
-marking extent written, we got many physically continuous extents.  At
-last, an empty extent showed up and the rightmost path is removed from
-extent tree.
-
-Add a new mechanism to reuse extent block cached in dealloc which were
-just unlinked from extent tree to solve this crash issue.
-
-Criteria is that during marking extents *written*, if extent rotation
-and merging results in unlinking extent with growing extent tree later
-without any metadata reserved ahead of time, try to reuse those extents
-in dealloc in which deleted extents are cached.
-
-Also, this patch addresses the issue John reported that ::dw_zero_count
-is not calculated properly.
-
-After applying this patch, the issue John reported was gone.  Thanks for
-the reproducer provided by John.  And this patch has passed
-ocfs2-test(29 cases) suite running by New H3C Group.
-
-[ge.changwei@h3c.com: fix static checker warnning]
-  Link: http://lkml.kernel.org/r/63ADC13FD55D6546B7DECE290D39E373F29196AE@H3CMLB12-EX.srv.huawei-3com.com
-[akpm@linux-foundation.org: brelse(NULL) is legal]
-Link: http://lkml.kernel.org/r/1515479070-32653-2-git-send-email-ge.changwei@h3c.com
-Signed-off-by: Changwei Ge <ge.changwei@h3c.com>
-Reported-by: John Lightsey <john@nixnuts.net>
-Tested-by: John Lightsey <john@nixnuts.net>
-Cc: Joel Becker <jlbec@evilplan.org>
-Cc: Joseph Qi <jiangqi903@gmail.com>
-Cc: Junxiao Bi <junxiao.bi@oracle.com>
-Cc: Dan Carpenter <dan.carpenter@oracle.com>
-Cc: Mark Fasheh <mfasheh@versity.com>
-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-(cherry picked from commit 71a36944042b7d9dd71f6a5d1c5ea1c2353b5d42)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- fs/ocfs2/alloc.c | 206 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
- fs/ocfs2/alloc.h |   1 +
- fs/ocfs2/aops.c  |   6 ++
- 3 files changed, 203 insertions(+), 10 deletions(-)
-
-diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
-index 386aecce881d..9b5e7d8ba710 100644
---- a/fs/ocfs2/alloc.c
-+++ b/fs/ocfs2/alloc.c
-@@ -165,6 +165,13 @@ static int ocfs2_dinode_insert_check(struct ocfs2_extent_tree *et,
- 				     struct ocfs2_extent_rec *rec);
- static int ocfs2_dinode_sanity_check(struct ocfs2_extent_tree *et);
- static void ocfs2_dinode_fill_root_el(struct ocfs2_extent_tree *et);
-+
-+static int ocfs2_reuse_blk_from_dealloc(handle_t *handle,
-+					struct ocfs2_extent_tree *et,
-+					struct buffer_head **new_eb_bh,
-+					int blk_wanted, int *blk_given);
-+static int ocfs2_is_dealloc_empty(struct ocfs2_extent_tree *et);
-+
- static const struct ocfs2_extent_tree_operations ocfs2_dinode_et_ops = {
- 	.eo_set_last_eb_blk	= ocfs2_dinode_set_last_eb_blk,
- 	.eo_get_last_eb_blk	= ocfs2_dinode_get_last_eb_blk,
-@@ -448,6 +455,7 @@ static void __ocfs2_init_extent_tree(struct ocfs2_extent_tree *et,
- 	if (!obj)
- 		obj = (void *)bh->b_data;
- 	et->et_object = obj;
-+	et->et_dealloc = NULL;
- 
- 	et->et_ops->eo_fill_root_el(et);
- 	if (!et->et_ops->eo_fill_max_leaf_clusters)
-@@ -1159,7 +1167,7 @@ static int ocfs2_add_branch(handle_t *handle,
- 			    struct buffer_head **last_eb_bh,
- 			    struct ocfs2_alloc_context *meta_ac)
- {
--	int status, new_blocks, i;
-+	int status, new_blocks, i, block_given = 0;
- 	u64 next_blkno, new_last_eb_blk;
- 	struct buffer_head *bh;
- 	struct buffer_head **new_eb_bhs = NULL;
-@@ -1214,11 +1222,31 @@ static int ocfs2_add_branch(handle_t *handle,
- 		goto bail;
- 	}
- 
--	status = ocfs2_create_new_meta_bhs(handle, et, new_blocks,
--					   meta_ac, new_eb_bhs);
--	if (status < 0) {
--		mlog_errno(status);
--		goto bail;
-+	/* Firstyly, try to reuse dealloc since we have already estimated how
-+	 * many extent blocks we may use.
-+	 */
-+	if (!ocfs2_is_dealloc_empty(et)) {
-+		status = ocfs2_reuse_blk_from_dealloc(handle, et,
-+						      new_eb_bhs, new_blocks,
-+						      &block_given);
-+		if (status < 0) {
-+			mlog_errno(status);
-+			goto bail;
-+		}
-+	}
-+
-+	BUG_ON(block_given > new_blocks);
-+
-+	if (block_given < new_blocks) {
-+		BUG_ON(!meta_ac);
-+		status = ocfs2_create_new_meta_bhs(handle, et,
-+						   new_blocks - block_given,
-+						   meta_ac,
-+						   &new_eb_bhs[block_given]);
-+		if (status < 0) {
-+			mlog_errno(status);
-+			goto bail;
-+		}
- 	}
- 
- 	/* Note: new_eb_bhs[new_blocks - 1] is the guy which will be
-@@ -1341,15 +1369,25 @@ static int ocfs2_shift_tree_depth(handle_t *handle,
- 				  struct ocfs2_alloc_context *meta_ac,
- 				  struct buffer_head **ret_new_eb_bh)
- {
--	int status, i;
-+	int status, i, block_given = 0;
- 	u32 new_clusters;
- 	struct buffer_head *new_eb_bh = NULL;
- 	struct ocfs2_extent_block *eb;
- 	struct ocfs2_extent_list  *root_el;
- 	struct ocfs2_extent_list  *eb_el;
- 
--	status = ocfs2_create_new_meta_bhs(handle, et, 1, meta_ac,
--					   &new_eb_bh);
-+	if (!ocfs2_is_dealloc_empty(et)) {
-+		status = ocfs2_reuse_blk_from_dealloc(handle, et,
-+						      &new_eb_bh, 1,
-+						      &block_given);
-+	} else if (meta_ac) {
-+		status = ocfs2_create_new_meta_bhs(handle, et, 1, meta_ac,
-+						   &new_eb_bh);
-+
-+	} else {
-+		BUG();
-+	}
-+
- 	if (status < 0) {
- 		mlog_errno(status);
- 		goto bail;
-@@ -1512,7 +1550,7 @@ static int ocfs2_grow_tree(handle_t *handle, struct ocfs2_extent_tree *et,
- 	int depth = le16_to_cpu(el->l_tree_depth);
- 	struct buffer_head *bh = NULL;
- 
--	BUG_ON(meta_ac == NULL);
-+	BUG_ON(meta_ac == NULL && ocfs2_is_dealloc_empty(et));
- 
- 	shift = ocfs2_find_branch_target(et, &bh);
- 	if (shift < 0) {
-@@ -6593,6 +6631,154 @@ ocfs2_find_per_slot_free_list(int type,
- 	return fl;
- }
- 
-+static struct ocfs2_per_slot_free_list *
-+ocfs2_find_preferred_free_list(int type,
-+			       int preferred_slot,
-+			       int *real_slot,
-+			       struct ocfs2_cached_dealloc_ctxt *ctxt)
-+{
-+	struct ocfs2_per_slot_free_list *fl = ctxt->c_first_suballocator;
-+
-+	while (fl) {
-+		if (fl->f_inode_type == type && fl->f_slot == preferred_slot) {
-+			*real_slot = fl->f_slot;
-+			return fl;
-+		}
-+
-+		fl = fl->f_next_suballocator;
-+	}
-+
-+	/* If we can't find any free list matching preferred slot, just use
-+	 * the first one.
-+	 */
-+	fl = ctxt->c_first_suballocator;
-+	*real_slot = fl->f_slot;
-+
-+	return fl;
-+}
-+
-+/* Return Value 1 indicates empty */
-+static int ocfs2_is_dealloc_empty(struct ocfs2_extent_tree *et)
-+{
-+	struct ocfs2_per_slot_free_list *fl = NULL;
-+
-+	if (!et->et_dealloc)
-+		return 1;
-+
-+	fl = et->et_dealloc->c_first_suballocator;
-+	if (!fl)
-+		return 1;
-+
-+	if (!fl->f_first)
-+		return 1;
-+
-+	return 0;
-+}
-+
-+/* If extent was deleted from tree due to extent rotation and merging, and
-+ * no metadata is reserved ahead of time. Try to reuse some extents
-+ * just deleted. This is only used to reuse extent blocks.
-+ * It is supposed to find enough extent blocks in dealloc if our estimation
-+ * on metadata is accurate.
-+ */
-+static int ocfs2_reuse_blk_from_dealloc(handle_t *handle,
-+					struct ocfs2_extent_tree *et,
-+					struct buffer_head **new_eb_bh,
-+					int blk_wanted, int *blk_given)
-+{
-+	int i, status = 0, real_slot;
-+	struct ocfs2_cached_dealloc_ctxt *dealloc;
-+	struct ocfs2_per_slot_free_list *fl;
-+	struct ocfs2_cached_block_free *bf;
-+	struct ocfs2_extent_block *eb;
-+	struct ocfs2_super *osb =
-+		OCFS2_SB(ocfs2_metadata_cache_get_super(et->et_ci));
-+
-+	*blk_given = 0;
-+
-+	/* If extent tree doesn't have a dealloc, this is not faulty. Just
-+	 * tell upper caller dealloc can't provide any block and it should
-+	 * ask for alloc to claim more space.
-+	 */
-+	dealloc = et->et_dealloc;
-+	if (!dealloc)
-+		goto bail;
-+
-+	for (i = 0; i < blk_wanted; i++) {
-+		/* Prefer to use local slot */
-+		fl = ocfs2_find_preferred_free_list(EXTENT_ALLOC_SYSTEM_INODE,
-+						    osb->slot_num, &real_slot,
-+						    dealloc);
-+		/* If no more block can be reused, we should claim more
-+		 * from alloc. Just return here normally.
-+		 */
-+		if (!fl) {
-+			status = 0;
-+			break;
-+		}
-+
-+		bf = fl->f_first;
-+		fl->f_first = bf->free_next;
-+
-+		new_eb_bh[i] = sb_getblk(osb->sb, bf->free_blk);
-+		if (new_eb_bh[i] == NULL) {
-+			status = -ENOMEM;
-+			mlog_errno(status);
-+			goto bail;
-+		}
-+
-+		mlog(0, "Reusing block(%llu) from "
-+		     "dealloc(local slot:%d, real slot:%d)\n",
-+		     bf->free_blk, osb->slot_num, real_slot);
-+
-+		ocfs2_set_new_buffer_uptodate(et->et_ci, new_eb_bh[i]);
-+
-+		status = ocfs2_journal_access_eb(handle, et->et_ci,
-+						 new_eb_bh[i],
-+						 OCFS2_JOURNAL_ACCESS_CREATE);
-+		if (status < 0) {
-+			mlog_errno(status);
-+			goto bail;
-+		}
-+
-+		memset(new_eb_bh[i]->b_data, 0, osb->sb->s_blocksize);
-+		eb = (struct ocfs2_extent_block *) new_eb_bh[i]->b_data;
-+
-+		/* We can't guarantee that buffer head is still cached, so
-+		 * polutlate the extent block again.
-+		 */
-+		strcpy(eb->h_signature, OCFS2_EXTENT_BLOCK_SIGNATURE);
-+		eb->h_blkno = cpu_to_le64(bf->free_blk);
-+		eb->h_fs_generation = cpu_to_le32(osb->fs_generation);
-+		eb->h_suballoc_slot = cpu_to_le16(real_slot);
-+		eb->h_suballoc_loc = cpu_to_le64(bf->free_bg);
-+		eb->h_suballoc_bit = cpu_to_le16(bf->free_bit);
-+		eb->h_list.l_count =
-+			cpu_to_le16(ocfs2_extent_recs_per_eb(osb->sb));
-+
-+		/* We'll also be dirtied by the caller, so
-+		 * this isn't absolutely necessary.
-+		 */
-+		ocfs2_journal_dirty(handle, new_eb_bh[i]);
-+
-+		if (!fl->f_first) {
-+			dealloc->c_first_suballocator = fl->f_next_suballocator;
-+			kfree(fl);
-+		}
-+		kfree(bf);
-+	}
-+
-+	*blk_given = i;
-+
-+bail:
-+	if (unlikely(status < 0)) {
-+		for (i = 0; i < blk_wanted; i++)
-+			brelse(new_eb_bh[i]);
-+	}
-+
-+	return status;
-+}
-+
- int ocfs2_cache_block_dealloc(struct ocfs2_cached_dealloc_ctxt *ctxt,
- 			      int type, int slot, u64 suballoc,
- 			      u64 blkno, unsigned int bit)
-diff --git a/fs/ocfs2/alloc.h b/fs/ocfs2/alloc.h
-index 4a5152ec88a3..571692171dd1 100644
---- a/fs/ocfs2/alloc.h
-+++ b/fs/ocfs2/alloc.h
-@@ -61,6 +61,7 @@ struct ocfs2_extent_tree {
- 	ocfs2_journal_access_func		et_root_journal_access;
- 	void					*et_object;
- 	unsigned int				et_max_leaf_clusters;
-+	struct ocfs2_cached_dealloc_ctxt	*et_dealloc;
- };
- 
- /*
-diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
-index 77ec9b495027..2ff02dda97d8 100644
---- a/fs/ocfs2/aops.c
-+++ b/fs/ocfs2/aops.c
-@@ -2322,6 +2322,12 @@ static int ocfs2_dio_end_io_write(struct inode *inode,
- 
- 	ocfs2_init_dinode_extent_tree(&et, INODE_CACHE(inode), di_bh);
- 
-+	/* Attach dealloc with extent tree in case that we may reuse extents
-+	 * which are already unlinked from current extent tree due to extent
-+	 * rotation and merging.
-+	 */
-+	et.et_dealloc = &dealloc;
-+
- 	ret = ocfs2_lock_allocators(inode, &et, 0, dwc->dw_zero_count*2,
- 				    &data_ac, &meta_ac);
- 	if (ret) {

patches/kernel/0023-mm-shmem-do-not-wait-for-lock_page-in-shmem_unused_h.patch

@@ -1,100 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
-Date: Fri, 23 Mar 2018 09:19:21 +0100
-Subject: [PATCH] mm/shmem: do not wait for lock_page() in
- shmem_unused_huge_shrink()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-shmem_unused_huge_shrink() gets called from reclaim path.  Waiting for
-page lock may lead to deadlock there.
-
-There was a bug report that may be attributed to this:
-
-http://lkml.kernel.org/r/alpine.LRH.2.11.1801242349220.30642@mail.ewheeler.net
-
-Replace lock_page() with trylock_page() and skip the page if we failed to
-lock it.  We will get to the page on the next scan.
-
-We can test for the PageTransHuge() outside the page lock as we only need
-protection against splitting the page under us.  Holding pin oni the page
-is enough for this.
-
-Link: http://lkml.kernel.org/r/20180316210830.43738-1-kirill.shutemov@linux.intel.com
-Fixes: 779750d20b93 ("shmem: split huge pages beyond i_size under memory pressure")
-Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
-Reported-by: Eric Wheeler <linux-mm@lists.ewheeler.net>
-Acked-by: Michal Hocko <mhocko@suse.com>
-Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
-Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
-Cc: Hugh Dickins <hughd@google.com>
-Cc: <stable@vger.kernel.org>	[4.8+]
-Signed-off-by: Andrew Morton <>
-(cherry-picked from https://git.kernel.org/pub/scm/linux/kernel/git/mhocko/mm.git/commit/?h=since-4.15&id=73eccc61c701ee7b4223aea2079542a712feeea7)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- mm/shmem.c | 31 ++++++++++++++++++++-----------
- 1 file changed, 20 insertions(+), 11 deletions(-)
-
-diff --git a/mm/shmem.c b/mm/shmem.c
-index 859e4c224b80..2aae929eb90b 100644
---- a/mm/shmem.c
-+++ b/mm/shmem.c
-@@ -483,36 +483,45 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo,
- 		info = list_entry(pos, struct shmem_inode_info, shrinklist);
- 		inode = &info->vfs_inode;
- 
--		if (nr_to_split && split >= nr_to_split) {
--			iput(inode);
--			continue;
--		}
-+		if (nr_to_split && split >= nr_to_split)
-+			goto leave;
- 
--		page = find_lock_page(inode->i_mapping,
-+		page = find_get_page(inode->i_mapping,
- 				(inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT);
- 		if (!page)
- 			goto drop;
- 
-+		/* No huge page at the end of the file: nothing to split */
- 		if (!PageTransHuge(page)) {
--			unlock_page(page);
- 			put_page(page);
- 			goto drop;
- 		}
- 
-+		/*
-+		 * Leave the inode on the list if we failed to lock
-+		 * the page at this time.
-+		 *
-+		 * Waiting for the lock may lead to deadlock in the
-+		 * reclaim path.
-+		 */
-+		if (!trylock_page(page)) {
-+			put_page(page);
-+			goto leave;
-+		}
-+
- 		ret = split_huge_page(page);
- 		unlock_page(page);
- 		put_page(page);
- 
--		if (ret) {
--			/* split failed: leave it on the list */
--			iput(inode);
--			continue;
--		}
-+		/* If split failed leave the inode on the list */
-+		if (ret)
-+			goto leave;
- 
- 		split++;
- drop:
- 		list_del_init(&info->shrinklist);
- 		removed++;
-+leave:
- 		iput(inode);
- 	}
- 

patches/kernel/0024-mm-thp-Do-not-wait-for-lock_page-in-deferred_split_s.patch

@@ -1,43 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
-Date: Thu, 15 Mar 2018 18:07:47 +0300
-Subject: [PATCH] mm/thp: Do not wait for lock_page() in deferred_split_scan()
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-deferred_split_scan() gets called from reclaim path. Waiting for page
-lock may lead to deadlock there.
-
-Replace lock_page() with trylock_page() and skip the page if we failed
-to lock it. We will get to the page on the next scan.
-
-Fixes: 9a982250f773 ("thp: introduce deferred_split_huge_page()")
-
-Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
-Acked-by: Michal Hocko <mhocko@suse.com>
-(cherry-picked from https://patchwork.kernel.org/patch/10284703/)
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- mm/huge_memory.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/mm/huge_memory.c b/mm/huge_memory.c
-index 8b887db33383..5c4093e0be8d 100644
---- a/mm/huge_memory.c
-+++ b/mm/huge_memory.c
-@@ -2621,11 +2621,13 @@ static unsigned long deferred_split_scan(struct shrinker *shrink,
- 
- 	list_for_each_safe(pos, next, &list) {
- 		page = list_entry((void *)pos, struct page, mapping);
--		lock_page(page);
-+		if (!trylock_page(page))
-+			goto next;
- 		/* split_huge_page() removes page from list on success */
- 		if (!split_huge_page(page))
- 			split++;
- 		unlock_page(page);
-+next:
- 		put_page(page);
- 	}
- 

patches/kernel/0025-Revert-Ubuntu-RETPOLINE-checks-in-kernel-Makefile.patch

@@ -1,46 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <f.gruenbichler@proxmox.com>
-Date: Mon, 9 Apr 2018 09:33:25 +0200
-Subject: [PATCH] Revert Ubuntu RETPOLINE checks in kernel Makefile
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-these break builds outside of Ubuntu's packaging.
-
-Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
----
- scripts/Makefile.build | 8 --------
- 1 file changed, 8 deletions(-)
-
-diff --git a/scripts/Makefile.build b/scripts/Makefile.build
-index d74c3f9f1fa8..436005392047 100644
---- a/scripts/Makefile.build
-+++ b/scripts/Makefile.build
-@@ -282,18 +282,11 @@ objtool_dep = $(objtool_obj)					\
- 	      $(wildcard include/config/orc/unwinder.h		\
- 			 include/config/stack/validation.h)
- 
--ifdef CONFIG_RETPOLINE
--cmd_ubuntu_retpoline = $(CONFIG_SHELL) $(srctree)/scripts/ubuntu-retpoline-extract-one $(@) $(<) "$(filter -m16 %code16gcc.h,$(a_flags))";
--else
--cmd_ubuntu_retpoline =
--endif
--
- define rule_cc_o_c
- 	$(call echo-cmd,checksrc) $(cmd_checksrc)			  \
- 	$(call cmd_and_fixdep,cc_o_c)					  \
- 	$(cmd_modversions_c)						  \
- 	$(call echo-cmd,objtool) $(cmd_objtool)				  \
--	$(call echo-cmd,ubuntu-retpoline) $(cmd_ubuntu_retpoline)	  \
- 	$(call echo-cmd,record_mcount) $(cmd_record_mcount)
- endef
- 
-@@ -301,7 +294,6 @@ define rule_as_o_S
- 	$(call cmd_and_fixdep,as_o_S)					  \
- 	$(cmd_modversions_S)						  \
- 	$(call echo-cmd,objtool) $(cmd_objtool)
--	$(call echo-cmd,ubuntu-retpoline) $(cmd_ubuntu_retpoline)
- endef
- 
- # List module undefined symbols (or empty line if not enabled)

patches/kernel/0026-net-fix-deadlock-while-clearing-neighbor-proxy-table.patch

@@ -1,92 +0,0 @@
-From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Wolfgang Bumiller <w.bumiller@proxmox.com>
-Date: Mon, 9 Apr 2018 14:56:29 +0200
-Subject: [PATCH] net: fix deadlock while clearing neighbor proxy table
-
-When coming from ndisc_netdev_event() in net/ipv6/ndisc.c,
-neigh_ifdown() is called with &nd_tbl, locking this while
-clearing the proxy neighbor entries when eg. deleting an
-interface. Calling the table's pndisc_destructor() with the
-lock still held, however, can cause a deadlock: When a
-multicast listener is available an IGMP packet of type
-ICMPV6_MGM_REDUCTION may be sent out. When reaching
-ip6_finish_output2(), if no neighbor entry for the target
-address is found, __neigh_create() is called with &nd_tbl,
-which it'll want to lock.
-
-Move the elements into their own list, then unlock the table
-and perform the destruction.
-
-Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=199289
-Fixes: 6fd6ce2056de ("ipv6: Do not depend on rt->n in ip6_finish_output2().")
-Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
----
- net/core/neighbour.c | 28 ++++++++++++++++++----------
- 1 file changed, 18 insertions(+), 10 deletions(-)
-
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index d0713627deb6..3b495739bf65 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -55,7 +55,8 @@ static void neigh_timer_handler(unsigned long arg);
- static void __neigh_notify(struct neighbour *n, int type, int flags,
- 			   u32 pid);
- static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
--static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
-+static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
-+				    struct net_device *dev);
- 
- #ifdef CONFIG_PROC_FS
- static const struct file_operations neigh_stat_seq_fops;
-@@ -291,8 +292,7 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
- {
- 	write_lock_bh(&tbl->lock);
- 	neigh_flush_dev(tbl, dev);
--	pneigh_ifdown(tbl, dev);
--	write_unlock_bh(&tbl->lock);
-+	pneigh_ifdown_and_unlock(tbl, dev);
- 
- 	del_timer_sync(&tbl->proxy_timer);
- 	pneigh_queue_purge(&tbl->proxy_queue);
-@@ -681,9 +681,10 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
- 	return -ENOENT;
- }
- 
--static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
-+static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
-+				    struct net_device *dev)
- {
--	struct pneigh_entry *n, **np;
-+	struct pneigh_entry *n, **np, *freelist = NULL;
- 	u32 h;
- 
- 	for (h = 0; h <= PNEIGH_HASHMASK; h++) {
-@@ -691,16 +692,23 @@ static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
- 		while ((n = *np) != NULL) {
- 			if (!dev || n->dev == dev) {
- 				*np = n->next;
--				if (tbl->pdestructor)
--					tbl->pdestructor(n);
--				if (n->dev)
--					dev_put(n->dev);
--				kfree(n);
-+				n->next = freelist;
-+				freelist = n;
- 				continue;
- 			}
- 			np = &n->next;
- 		}
- 	}
-+	write_unlock_bh(&tbl->lock);
-+	while ((n = freelist)) {
-+		freelist = n->next;
-+		n->next = NULL;
-+		if (tbl->pdestructor)
-+			tbl->pdestructor(n);
-+		if (n->dev)
-+			dev_put(n->dev);
-+		kfree(n);
-+	}
- 	return -ENOENT;
- }
-