Merge pull request #3037 from rn/rel_v0.4

Preparation for the v0.4 release
Merge pull request #3035 from justincormack/containerd-conf-remove
2026-03-19 12:55:52 +00:00 · 2018-05-12 16:39:03 +01:00 · 2018-05-12 16:18:26 +01:00 · 2018-05-12 14:51:54 +01:00 · 2018-05-12 14:34:40 +01:00 · 2018-05-12 14:32:14 +01:00
741 changed files with 4010 additions and 1498 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,25 @@ All notable changes to this project will be documented in this file.

 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).

+## [v0.4] - 2018-05-12
+### Added
+- Support for v4.16.x kernels.
+- Support for MPLS, USB_STORAGE, and SCTP support in the kernel config.
+- Support for creating and booting from squashfs root filesystems.
+- Super experimental support for crosvm.
+- Support for compiling with go 1.10.
+- Adjusted hyperkit support to be compatible with soon to be released Docker for Mac changes.
+
+### Changed
+- `containerd` updated to v1.1.0.
+- WireGuard updated to 0.0.20180420.
+- Intel CPU microcode update to 20180425.
+
+### Removed
+- Support for v4.15.x. kernels as they have been EOLed.
+- `perf` support for 4.9.x kernels (the compile broke).
+
+
 ## [v0.3] - 2018-04-05
 ### Added
 - Initial `s390x` support.
--- a/4
+++ b/4
@@ -4,10 +4,10 @@
 default: bin/linuxkit bin/rtf
 all: default

-VERSION="v0.3"
+VERSION="v0.4"
 GIT_COMMIT=$(shell git rev-list -1 HEAD)

-GO_COMPILE=linuxkit/go-compile:2940a8141d907c2976be15f201f6e9b7c4c1f931
+GO_COMPILE=linuxkit/go-compile:a8bffe875268a973ea82e5937b0fb23a5b08cc79

 LINUXKIT?=bin/linuxkit
 GOOS?=$(shell uname -s | tr '[:upper:]' '[:lower:]')
--- a/contrib/crosvm/.gitignore
+++ b/contrib/crosvm/.gitignore
@@ -0,0 +1,2 @@
+/build
+iid
--- a/contrib/crosvm/Dockerfile
+++ b/contrib/crosvm/Dockerfile
@@ -0,0 +1,36 @@
+FROM rust:1.25.0-stretch
+
+ENV CROSVM_REPO=https://chromium.googlesource.com/chromiumos/platform/crosvm
+ENV CROSVM_COMMIT=7a7268faf0a43c79b6a4520f5c2f35c3e0233932
+ENV MINIJAIL_REPO=https://android.googlesource.com/platform/external/minijail
+ENV MINIJAIL_COMMIT=d45fc420bb8fd9d1fc9297174f3c344db8c20bbd
+
+# Install deps
+RUN apt-get update && apt-get install -y libcap-dev libfdt-dev
+
+# Get source code
+RUN git clone ${MINIJAIL_REPO} && \
+    cd /minijail && \
+    git checkout ${MINIJAIL_COMMIT} && \
+    cd / && \
+    git clone ${CROSVM_REPO} && \
+    cd crosvm && \
+    git checkout ${CROSVM_COMMIT}
+
+# Compile and install minijail
+WORKDIR /minijail
+RUN make && \
+    cp libminijail.so /usr/lib/ && \
+    cp libminijail.h /usr/include/
+
+# Compile crosvm
+WORKDIR /crosvm
+RUN cargo build --release
+    
+RUN mkdir /out && \
+    cp /minijail/libminijail.so /out && \
+    cp /crosvm/target/release/crosvm /out && \
+    cp -r /crosvm/seccomp /out
+
+WORKDIR /out
+ENTRYPOINT ["tar", "cf", "-", "libminijail.so", "crosvm", "seccomp"]
--- a/contrib/crosvm/Makefile
+++ b/contrib/crosvm/Makefile
@@ -0,0 +1,9 @@
+.PHONY: extract
+extract: iid
+	rm -rf ./build
+	mkdir -p ./build
+	docker run --rm $(shell cat iid) | tar xf - -C ./build
+	rm iid
+
+iid: Makefile Dockerfile
+	docker build --no-cache --iidfile iid .
--- a/contrib/crosvm/README.md
+++ b/contrib/crosvm/README.md
@@ -0,0 +1,85 @@
+The Chrome OS Virtual Machine Monitor
+[`crosvm`](https://chromium.googlesource.com/chromiumos/platform/crosvm/)
+is a lightweight VMM written in Rust. It runs on top of KVM and
+optionally runs the device models in separate processes isolated with
+seccomp profiles.
+
+
+## Build/Install
+
+The `Makefile` and `Dockerfile` compile `crosvm` and a suitable
+version of `libminijail`. To build:
+
+```sh
+make
+```
+
+You should end up with a `crosvm` and `libminijail.so` binaries as
+well as the seccomp profiles in `./build`. Copy `libminijail.so` to
+`/usr/lib` or wherever `ldd` picks it up. You may also need `libcap`
+(on Ubuntu or Debian `apt-get install -y libcap-dev`).
+
+You may also have to create an empty directory `/var/empty`.
+
+
+## Use with LinuxKit images
+
+You can build a LinuxKit image suitable for `crosvm` with the
+`kernel+squashfs` build format. For example, using this LinuxKit
+YAML file (`minimal.yml`):
+
+```
+kernel:
+  image: linuxkit/kernel:4.9.91
+  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
+init:
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+services:
+  - name: getty
+    image: linuxkit/getty:v0.4
+    env:
+      - INSECURE=true
+trust:
+  org:
+    - linuxkit
+```
+
+run:
+
+```sh
+linuxkit build -output kernel+squashfs minimal.yml
+```
+
+The kernel this produces (`minimal-kernel`) needs to be converted as
+`crosvm` does not grok `bzImage`s. You can convert the LinuxKit kernel
+image with
+[extract-vmlinux](https://raw.githubusercontent.com/torvalds/linux/master/scripts/extract-vmlinux):
+
+```sh
+extract-vmlinux minimal-kernel > minimal-vmlinux
+```
+
+Then you can run `crosvm`:
+```sh
+./crosvm run --seccomp-policy-dir=./seccomp/x86_64 \
+    --root ./minimal-squashfs.img \
+    --mem 2048 \
+    --multiprocess \
+    --socket ./linuxkit-socket \
+    minimal-vmlinux
+```
+
+## Known issues
+
+- With 4.14.x, a `BUG_ON()` is hit in `drivers/base/driver.c`. 4.9.x
+  kernels seem to work.
+- Networking does not yet work, so don't include a `onboot` `dhcpd` service.
+- `poweroff` from the command line does not work (crosvm does not seem
+  to support ACPI). So to stop a VM you can use the control socket
+  and: `./crosvm stop ./linuxkit-socket`
+- `crosvm` and its dependencies compile on `arm64` but `crosvm` seems
+  to lack support for setting op the IRQ chip on the system I
+  tested. I got: `failed to create in-kernel IRQ chip:
+  CreateGICFailure(Error(19))`.
--- a/docs/platform-hyperkit.md
+++ b/docs/platform-hyperkit.md
@@ -12,9 +12,19 @@ Alternatively, you can install HyperKit and VPNKit standalone and use it without

 ## Boot

-The HyperKit backend currently supports booting the
-`kernel+initrd` output from `moby`, and EFI ISOs using the EFI firmware.
+The HyperKit backend currently supports booting:
+- `kernel+initrd` output from `linuxkit build`.
+- `kernel+squashfs` output from `linuxkit build`.
+- EFI ISOs using the EFI firmware.

+You need to select the boot method manually using the command line
+options. The default is `kernel+initrd`. `kernel+squashfs` can be
+selected using `-squashfs` and to boot a ISO with EFI you have to
+specify `-iso -uefi`.
+
+The `kernel+initrd` uses a RAM disk for the root filesystem. If you
+have RAM constraints or large images we recommend using either the
+`kernel+squashfs` or the EFI ISO boot.

 ## Console

--- a/docs/platform-qemu.md
+++ b/docs/platform-qemu.md
@@ -24,6 +24,7 @@ specified with `-arch` and currently accepts `x86_64`, `aarch64`, and
 `linuxkit run qemu` can boot in different types of images:

 - `kernel+initrd`: This is the default mode of `linuxkit run qemu` [`x86_64`, `arm64`, `s390x`]
+- `kernel+squashfs`: `linuxkit run qemu -squashfs <path to directory>`. This expects a kernel and a squashfs image. [`x86_64`, `arm64`, `s390x`]
 - `iso-bios`: `linuxkit run qemu -iso <path to iso>` [`x86_64`]
 - `iso-efi`: `linuxkit run qemu -iso -uefi <path to iso>`. This looks in `/usr/share/ovmf/bios.bin` for the EFI firmware by default. Can be overwritten with `-fw`. [`x86_64`, `arm64`]
 - `qcow-bios`: `linuxkit run qemu disk.qcow2` [`x86_64`]
@@ -32,6 +33,10 @@ specified with `-arch` and currently accepts `x86_64`, `aarch64`, and

 The formats `qcow-efi` and `raw-efi` may also work, but are currently not tested.

+The default `kernel+initrd` boot uses a RAM disk for the root
+filesystem. If you have RAM constraints or large images we recommend
+using one of the other methods, such as `kernel+squashfs` or booting
+via a ISO image.

 ## Console

--- a/docs/platform-rpi3.md
+++ b/docs/platform-rpi3.md
@@ -46,6 +46,14 @@ partition as `ext4` (or similar), and use it for persistent storage.

 **TODO:** Experiment with and document this set up.

+To enable and external USB stick as disk, add the following to the
+onboot section in your YAML:
+
+```
+  - name: usb-storage
+    image: linuxkit/modprobe:<hash>
+    command: ["modprobe", "usb_storage"]
+```

 ## Networking

--- a/docs/vendoring.md
+++ b/docs/vendoring.md
@@ -28,7 +28,7 @@ docker run -it --rm \
 -v $(pwd):/go/src/github.com/linuxkit/linuxkit \
 -w /go/src/github.com/linuxkit/linuxkit/src/cmd/linuxkit \
 --entrypoint /go/bin/vndr \
-linuxkit/go-compile:2940a8141d907c2976be15f201f6e9b7c4c1f931
+linuxkit/go-compile:a8bffe875268a973ea82e5937b0fb23a5b08cc79
 ```

 To update a single dependency:
@@ -38,7 +38,7 @@ docker run -it --rm \
 -v $(pwd):/go/src/github.com/linuxkit/linuxkit \
 -w /go/src/github.com/linuxkit/linuxkit/src/cmd/linuxkit \
 --entrypoint /go/bin/vndr \
-linuxkit/go-compile:2940a8141d907c2976be15f201f6e9b7c4c1f931
+linuxkit/go-compile:a8bffe875268a973ea82e5937b0fb23a5b08cc79
 github.com/docker/docker
 ```

--- a/examples/aws.yml
+++ b/examples/aws.yml
@@ -1,24 +1,24 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: metadata
-    image: linuxkit/metadata:v0.3
+    image: linuxkit/metadata:v0.4
 services:
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
    binds:
     - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
  - name: nginx
--- a/examples/azure.yml
+++ b/examples/azure.yml
@@ -1,21 +1,21 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
 services:
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
 files:
  - path: root/.ssh/authorized_keys
    source: ~/.ssh/id_rsa.pub
--- a/examples/cadvisor.yml
+++ b/examples/cadvisor.yml
@@ -1,34 +1,34 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: sysfs
-    image: linuxkit/sysfs:v0.3
+    image: linuxkit/sysfs:v0.4
  - name: format
-    image: linuxkit/format:v0.3
+    image: linuxkit/format:v0.4
  - name: mount
-    image: linuxkit/mount:v0.3
+    image: linuxkit/mount:v0.4
    command: ["/usr/bin/mountie", "/var/lib/docker"]

 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
      - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: ntpd
-    image: linuxkit/openntpd:v0.3
+    image: linuxkit/openntpd:v0.4

  - name: docker
    image: docker:17.10.0-ce-dind
@@ -46,7 +46,7 @@ services:
      - /etc/docker/daemon.json:/etc/docker/daemon.json
    command: ["/usr/local/bin/docker-init", "/usr/local/bin/dockerd"]
  - name: cadvisor
-    image: linuxkit/cadvisor:v0.3
+    image: linuxkit/cadvisor:v0.4
 files:
  - path: var/lib/docker
    directory: true
--- a/examples/docker-for-mac.yml
+++ b/examples/docker-for-mac.yml
@@ -1,32 +1,32 @@
 # This is an example for building the open source components of Docker for Mac
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0 page_poison=1"
 init:
-  - linuxkit/vpnkit-expose-port:v0.3 # install vpnkit-expose-port and vpnkit-iptables-wrapper on host
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/vpnkit-expose-port:v0.4 # install vpnkit-expose-port and vpnkit-iptables-wrapper on host
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  # support metadata for optional config in /run/config
  - name: metadata
-    image: linuxkit/metadata:v0.3
+    image: linuxkit/metadata:v0.4
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: sysfs
-    image: linuxkit/sysfs:v0.3
+    image: linuxkit/sysfs:v0.4
  - name: binfmt
-    image: linuxkit/binfmt:v0.3
+    image: linuxkit/binfmt:v0.4
  # Format and mount the disk image in /var/lib/docker
  - name: format
-    image: linuxkit/format:v0.3
+    image: linuxkit/format:v0.4
  - name: mount
-    image: linuxkit/mount:v0.3
+    image: linuxkit/mount:v0.4
    command: ["/usr/bin/mountie", "/var/lib"]
  # make a swap file on the mounted disk
  - name: swap
-    image: linuxkit/swap:v0.3
+    image: linuxkit/swap:v0.4
    command: ["/swap.sh", "--path", "/var/lib/swap", "--size", "1024M"]
  # mount-vpnkit mounts the 9p share used by vpnkit to coordinate port forwarding
  - name: mount-vpnkit
@@ -44,41 +44,41 @@ onboot:
        - /var:/host_var
    command: ["sh", "-c", "mv -v /host_var/log /host_var/lib && ln -vs /var/lib/log /host_var/log"]
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  # Enable acpi to shutdown on power events
  - name: acpid
-    image: linuxkit/acpid:v0.3
+    image: linuxkit/acpid:v0.4
  # Enable getty for easier debugging
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
        - INSECURE=true
  # Run ntpd to keep time synchronised in the VM
  - name: ntpd
-    image: linuxkit/openntpd:v0.3
+    image: linuxkit/openntpd:v0.4
  # VSOCK to unix domain socket forwarding. Forwards guest /var/run/docker.sock
  # to a socket on the host.
  - name: vsudd
-    image: linuxkit/vsudd:v0.3
+    image: linuxkit/vsudd:v0.4
    binds:
        - /var/run:/var/run
    command: ["/vsudd", "-inport", "2376:unix:/var/run/docker.sock"]
  # vpnkit-forwarder forwards network traffic to/from the host via VSOCK port 62373. 
  # It needs access to the vpnkit 9P coordination share 
  - name: vpnkit-forwarder
-    image: linuxkit/vpnkit-forwarder:v0.3
+    image: linuxkit/vpnkit-forwarder:v0.4
    binds:
        - /var/vpnkit:/port
    net: host
    command: ["/vpnkit-forwarder", "-vsockPort", "62373"]
  # Monitor for image deletes and invoke a TRIM on the container filesystem
  - name: trim-after-delete
-    image: linuxkit/trim-after-delete:v0.3
+    image: linuxkit/trim-after-delete:v0.4
  # When the host resumes from sleep, force a clock resync
  - name: host-timesync-daemon
-    image: linuxkit/host-timesync-daemon:v0.3
+    image: linuxkit/host-timesync-daemon:v0.4
  # Run dockerd with the vpnkit userland proxy from the vpnkit-forwarder container.
  # Bind mounts /var/run to allow vsudd to connect to docker.sock, /var/vpnkit
  # for vpnkit coordination and /run/config/docker for the configuration file.
--- a/examples/docker.yml
+++ b/examples/docker.yml
@@ -1,32 +1,32 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: sysfs
-    image: linuxkit/sysfs:v0.3
+    image: linuxkit/sysfs:v0.4
  - name: format
-    image: linuxkit/format:v0.3
+    image: linuxkit/format:v0.4
  - name: mount
-    image: linuxkit/mount:v0.3
+    image: linuxkit/mount:v0.4
    command: ["/usr/bin/mountie", "/var/lib/docker"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
  - name: ntpd
-    image: linuxkit/openntpd:v0.3
+    image: linuxkit/openntpd:v0.4
  - name: docker
    image: docker:17.09.0-ce-dind
    capabilities:
--- a/examples/gcp.yml
+++ b/examples/gcp.yml
@@ -1,28 +1,28 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: metadata
-    image: linuxkit/metadata:v0.3
+    image: linuxkit/metadata:v0.4
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
    binds:
     - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
  - name: nginx
--- a/examples/getty.yml
+++ b/examples/getty.yml
@@ -1,25 +1,25 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    # to make insecure with passwordless root login, uncomment following lines
    #env:
    # - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
 files:
  - path: etc/getty.shadow
    # sample sets password for root to "abcdefgh" (without quotes)
--- a/examples/hostmount-writeable-overlay.yml
+++ b/examples/hostmount-writeable-overlay.yml
@@ -1,16 +1,16 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 onshutdown:
  - name: shutdown
@@ -18,7 +18,7 @@ onshutdown:
    command: ["/bin/echo", "so long and thanks for all the fish"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
    runtime:
@@ -30,7 +30,7 @@ services:
          destination: writeable-host-etc
          options: ["rw", "lowerdir=/etc", "upperdir=/run/hostetc/upper", "workdir=/run/hostetc/work"]
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: nginx
    image: nginx:1.13.8-alpine
    capabilities:
--- a/examples/influxdb-os.yml
+++ b/examples/influxdb-os.yml
@@ -1,18 +1,18 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: influxdb
--- a/examples/minimal.yml
+++ b/examples/minimal.yml
@@ -1,17 +1,17 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
 onboot:
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
 trust:
--- a/examples/node_exporter.yml
+++ b/examples/node_exporter.yml
@@ -1,21 +1,21 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
  - name: node_exporter
-    image: linuxkit/node_exporter:v0.3
+    image: linuxkit/node_exporter:v0.4
 trust:
  org:
    - linuxkit
--- a/examples/openstack.yml
+++ b/examples/openstack.yml
@@ -1,25 +1,25 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: metadata
-    image: linuxkit/metadata:v0.3
+    image: linuxkit/metadata:v0.4
    command: ["/usr/bin/metadata", "openstack"]
 services:
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
    binds:
     - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
  - name: nginx
--- a/examples/packet.arm64.yml
+++ b/examples/packet.arm64.yml
@@ -5,10 +5,10 @@
 # for arm64 then the 'ucode' line in the kernel section can be left
 # out.
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyAMA0"
  ucode: ""
 onboot:
  - name: modprobe
-    image: linuxkit/modprobe:v0.3
+    image: linuxkit/modprobe:v0.4
    command: ["modprobe", "nicvf"]
--- a/examples/packet.yml
+++ b/examples/packet.yml
@@ -1,34 +1,34 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: console=ttyS1
  ucode: intel-ucode.cpio
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
-  - linuxkit/firmware:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
+  - linuxkit/firmware:v0.4
 onboot:
  - name: rngd1
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
    command: ["/sbin/rngd", "-1"]
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: metadata
-    image: linuxkit/metadata:v0.3
+    image: linuxkit/metadata:v0.4
    command: ["/usr/bin/metadata", "packet"]
 services:
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
 files:
  - path: root/.ssh/authorized_keys
    source: ~/.ssh/id_rsa.pub
--- a/examples/redis-os.yml
+++ b/examples/redis-os.yml
@@ -1,19 +1,19 @@
 # Minimal YAML to run a redis server (used at DockerCon'17)
 # connect: nc localhost 6379
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
 onboot:
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  # Currently redis:4.0.6-alpine has trust issue with multi-arch
--- a/examples/rt-for-vmware.yml
+++ b/examples/rt-for-vmware.yml
@@ -1,25 +1,25 @@
 kernel:
-  image: linuxkit/kernel:4.14.29-rt
+  image: linuxkit/kernel:4.14.34-rt
  cmdline: "console=tty0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
  - name: open-vm-tools
-    image: linuxkit/open-vm-tools:v0.3
+    image: linuxkit/open-vm-tools:v0.4
  - name: nginx
    image: nginx:1.13.8-alpine
    capabilities:
--- a/examples/sshd.yml
+++ b/examples/sshd.yml
@@ -1,28 +1,28 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: rngd1
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
    command: ["/sbin/rngd", "-1"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
 files:
  - path: root/.ssh/authorized_keys
    source: ~/.ssh/id_rsa.pub
--- a/examples/swap.yml
+++ b/examples/swap.yml
@@ -1,34 +1,34 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0 console=ttysclp0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: format
-    image: linuxkit/format:v0.3
+    image: linuxkit/format:v0.4
  - name: mount
-    image: linuxkit/mount:v0.3
+    image: linuxkit/mount:v0.4
    command: ["/usr/bin/mountie", "/var/external"]
  - name: swap
-    image: linuxkit/swap:v0.3
+    image: linuxkit/swap:v0.4
    # to use unencrypted swap, use:
    # command: ["/swap.sh", "--path", "/var/external/swap", "--size", "1G"]
    command: ["/swap.sh", "--path", "/var/external/swap", "--size", "1G", "--encrypt"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
 trust:
  org:
    - linuxkit
--- a/examples/tpm.yml
+++ b/examples/tpm.yml
@@ -2,25 +2,25 @@ kernel:
  image: linuxkit/kernel:4.9.38
  cmdline: "console=tty0 console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: tss
-    image: linuxkit/tss:v0.3
+    image: linuxkit/tss:v0.4
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
 files:
  - path: etc/getty.shadow
    # sample sets password for root to "abcdefgh" (without quotes)
--- a/examples/vmware.yml
+++ b/examples/vmware.yml
@@ -1,23 +1,23 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
  - name: nginx
    image: nginx:1.13.8-alpine
    capabilities:
--- a/examples/vpnkit-forwarder.yml
+++ b/examples/vpnkit-forwarder.yml
@@ -1,13 +1,13 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
 onboot:
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: mount-vpnkit
    image: alpine:3.7
@@ -19,9 +19,9 @@ onboot:
    command: ["sh", "-c", "mkdir /host_var/vpnkit && mount -v -t 9p -o trans=virtio,dfltuid=1001,dfltgid=50,version=9p2000 port /host_var/vpnkit"]
 services:
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
  - name: vpnkit-forwarder
-    image: linuxkit/vpnkit-forwarder:v0.3
+    image: linuxkit/vpnkit-forwarder:v0.4
    binds:
        - /var/vpnkit:/port
    net: host
--- a/examples/vsudd-containerd.yml
+++ b/examples/vsudd-containerd.yml
@@ -1,17 +1,17 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
 onboot:
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
  - name: vsudd
-    image: linuxkit/vsudd:v0.3
+    image: linuxkit/vsudd:v0.4
    binds:
        - /run/containerd/containerd.sock:/run/containerd/containerd.sock
    command: ["/vsudd",
--- a/examples/vultr.yml
+++ b/examples/vultr.yml
@@ -1,28 +1,28 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=ttyS0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: metadata
-    image: linuxkit/metadata:v0.3
+    image: linuxkit/metadata:v0.4
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: sshd
-    image: linuxkit/sshd:v0.3
+    image: linuxkit/sshd:v0.4
    binds:
     - /run/config/ssh/authorized_keys:/root/.ssh/authorized_keys
  - name: nginx
--- a/examples/wireguard.yml
+++ b/examples/wireguard.yml
@@ -1,19 +1,19 @@
 kernel:
-  image: linuxkit/kernel:4.14.32
+  image: linuxkit/kernel:4.14.40
  cmdline: "console=tty0 console=ttyS0 console=ttyAMA0"
 init:
-  - linuxkit/init:v0.3
-  - linuxkit/runc:v0.3
-  - linuxkit/containerd:v0.3
-  - linuxkit/ca-certificates:v0.3
+  - linuxkit/init:v0.4
+  - linuxkit/runc:v0.4
+  - linuxkit/containerd:v0.4
+  - linuxkit/ca-certificates:v0.4
 onboot:
  - name: sysctl
-    image: linuxkit/sysctl:v0.3
+    image: linuxkit/sysctl:v0.4
  - name: dhcpcd
-    image: linuxkit/dhcpcd:v0.3
+    image: linuxkit/dhcpcd:v0.4
    command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
  - name: wg0
-    image: linuxkit/ip:v0.3
+    image: linuxkit/ip:v0.4
    net: new
    binds:
      - /etc/wireguard:/etc/wireguard
@@ -26,7 +26,7 @@ onboot:
      bindNS:
          net: /run/netns/wg0
  - name: wg1
-    image: linuxkit/ip:v0.3
+    image: linuxkit/ip:v0.4
    net: new
    binds:
      - /etc/wireguard:/etc/wireguard
@@ -40,12 +40,12 @@ onboot:
          net: /run/netns/wg1
 services:
  - name: getty
-    image: linuxkit/getty:v0.3
+    image: linuxkit/getty:v0.4
    env:
     - INSECURE=true
    net: /run/netns/wg1
  - name: rngd
-    image: linuxkit/rngd:v0.3
+    image: linuxkit/rngd:v0.4
  - name: nginx
    image: nginx:1.13.8-alpine
    net: /run/netns/wg0
--- a/kernel/Dockerfile
+++ b/kernel/Dockerfile
@@ -1,4 +1,4 @@
-FROM linuxkit/alpine:96ad1eb5ec262b4cd0eef574cdc0b225b502d9ee AS kernel-build
+FROM linuxkit/alpine:90571a1a9059f3bf33ca3431bc5396aa837a47d3 AS kernel-build
 RUN apk add \
    argp-standalone \
    automake \
@@ -16,6 +16,7 @@ RUN apk add \
    installkernel \
    kmod \
    libelf-dev \
+    libressl \
    libressl-dev \
    linux-headers \
    mpc1-dev \
@@ -41,8 +42,8 @@ ENV KERNEL_SOURCE=https://www.kernel.org/pub/linux/kernel/v4.x/linux-${KERNEL_VE
 ENV KERNEL_SHA256_SUMS=https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
 ENV KERNEL_PGP2_SIGN=https://www.kernel.org/pub/linux/kernel/v4.x/linux-${KERNEL_VERSION}.tar.sign

-ENV WIREGUARD_VERSION=0.0.20180304
-ENV WIREGUARD_SHA256=efb1652f0da67fb2731040439b6abb820a5e2f1bc177aa15c5dce68ea3327787
+ENV WIREGUARD_VERSION=0.0.20180420
+ENV WIREGUARD_SHA256="b58cd2acf9e8d3fe9044c06c0056bd74da1f5673a456f011d36eee3f6fb1da16"
 ENV WIREGUARD_URL=https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${WIREGUARD_VERSION}.tar.xz

 # We copy the entire directory. This copies some unneeded files, but
@@ -168,8 +169,10 @@ RUN DVER=$(basename $(find /tmp/kernel-modules/lib/modules/ -mindepth 1 -maxdept

 RUN printf "KERNEL_SOURCE=${KERNEL_SOURCE}\n" > /out/kernel-source-info

-# perf (Don't compile for 4.4.x, it's broken and tedious to fix)
-RUN if [ "${KERNEL_SERIES}" != "4.4.x" ]; then \
+# perf
+# Skip for 4.4.x (the compile is broken and tedious to fix) and 4.9.x (the
+# compile broke with 4.9.93)
+RUN if [ "${KERNEL_SERIES}" != "4.4.x" ] && [ "${KERNEL_SERIES}" != "4.9.x" ]; then \
       mkdir -p /build/perf && \
       make -C tools/perf LDFLAGS=-static O=/build/perf && \
       strip /build/perf/perf && \
@@ -177,13 +180,14 @@ RUN if [ "${KERNEL_SERIES}" != "4.4.x" ]; then \
     fi

 # Download Intel ucode and create a CPIO archive for it
-ENV UCODE_URL=https://downloadmirror.intel.com/27591/eng/microcode-20180312.tgz
+ENV UCODE_URL=https://downloadmirror.intel.com/27776/eng/microcode-20180425.tgz
 RUN set -e && \
    if [ $(uname -m) == x86_64 ]; then \
        cd /ucode && \
        curl -sSL -o microcode.tar.gz ${UCODE_URL} && \
        md5sum -c intel-ucode-md5sums && \
        tar xf microcode.tar.gz && \
+        rm -f intel-ucode/list && \
        iucode_tool --normal-earlyfw --write-earlyfw=/out/intel-ucode.cpio ./intel-ucode && \
        cp intel-ucode-license.txt /out; \
    fi
--- a/kernel/Dockerfile.kconfig
+++ b/kernel/Dockerfile.kconfig
@@ -1,9 +1,11 @@
-FROM linuxkit/alpine:96ad1eb5ec262b4cd0eef574cdc0b225b502d9ee AS kernel-build
+FROM linuxkit/alpine:90571a1a9059f3bf33ca3431bc5396aa837a47d3 AS kernel-build
 RUN apk add \
    argp-standalone \
+    bison \
    build-base \
    curl \
    diffutils \
+    flex \
    libarchive-tools \
    ncurses-dev \
    patch \
--- a/kernel/Dockerfile.zfs
+++ b/kernel/Dockerfile.zfs
@@ -1,6 +1,6 @@
 ARG IMAGE
 FROM ${IMAGE} AS ksrc
-FROM linuxkit/alpine:96ad1eb5ec262b4cd0eef574cdc0b225b502d9ee AS build
+FROM linuxkit/alpine:90571a1a9059f3bf33ca3431bc5396aa837a47d3 AS build
 RUN apk add \
    attr-dev \
    autoconf \
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -156,8 +156,8 @@ fetch: sources/linux-$(1).tar.xz
 # with DCT as part of the dependency on build_$(2)$(3)$(4) and then build
 # with DOCKER_CONTENT_TRUST explicitly set to 0

-ifneq ($(2), 4.4.x)
-# perf does not build out of the box for 4.4.x and 4.4.x is not that relevant anymore to work on a fix
+ifneq ($(2), $(filter $(2),4.4.x 4.9.x))
+# perf does not build out of the box for 4.4.x and 4.9.x
 build_perf_$(2)$(3)$(4): build_$(2)$(3)$(4)
 	docker pull $(ORG)/$(IMAGE_PERF):$(1)$(3)$(4)-$(TAG)$(SUFFIX) || \
 		 DOCKER_CONTENT_TRUST=0 docker build -f Dockerfile.perf \
@@ -218,21 +218,21 @@ endef
 # Debug targets only for latest stable and LTS stable
 #
 ifeq ($(ARCH),x86_64)
-$(eval $(call kernel,4.15.15,4.15.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,4.14.32,4.14.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,4.14.32,4.14.x,,-dbg))
-$(eval $(call kernel,4.14.29,4.14.x,-rt,))
-$(eval $(call kernel,4.9.92,4.9.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,4.4.126,4.4.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.16.8,4.16.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.14.40,4.14.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.14.40,4.14.x,,-dbg))
+$(eval $(call kernel,4.14.34,4.14.x,-rt,))
+$(eval $(call kernel,4.9.99,4.9.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.4.131,4.4.x,$(EXTRA),$(DEBUG)))

 else ifeq ($(ARCH),aarch64)
-$(eval $(call kernel,4.15.15,4.15.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,4.14.32,4.14.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,4.14.29,4.14.x,-rt,))
+$(eval $(call kernel,4.16.8,4.16.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.14.40,4.14.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.14.34,4.14.x,-rt,))

 else ifeq ($(ARCH),s390x)
-$(eval $(call kernel,4.15.15,4.15.x,$(EXTRA),$(DEBUG)))
-$(eval $(call kernel,4.14.32,4.14.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.16.8,4.16.x,$(EXTRA),$(DEBUG)))
+$(eval $(call kernel,4.14.40,4.14.x,$(EXTRA),$(DEBUG)))
 endif

 # Target for kernel config
--- a/kernel/config-4.14.x-aarch64
+++ b/kernel/config-4.14.x-aarch64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 4.14.32 Kernel Configuration
+# Linux/arm64 4.14.40 Kernel Configuration
 #
 CONFIG_ARM64=y
 CONFIG_64BIT=y
@@ -1116,7 +1116,15 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1232,7 +1240,8 @@ CONFIG_VIRTIO_VSOCKETS_COMMON=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 # CONFIG_NET_NSH is not set
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
@@ -2133,7 +2142,8 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_RP2 is not set
 # CONFIG_SERIAL_FSL_LPUART is not set
 # CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set
-# CONFIG_SERIAL_DEV_BUS is not set
+CONFIG_SERIAL_DEV_BUS=y
+# CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
 # CONFIG_TTY_PRINTK is not set
 CONFIG_HVC_DRIVER=y
 CONFIG_HVC_IRQ=y
@@ -2942,7 +2952,22 @@ CONFIG_USB_UHCI_HCD=m
 #
 # also be needed; see USB_STORAGE Help for more info
 #
-# CONFIG_USB_STORAGE is not set
+CONFIG_USB_STORAGE=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set

 #
 # USB Imaging devices
--- a/kernel/config-4.14.x-s390x
+++ b/kernel/config-4.14.x-s390x
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/s390 4.14.32 Kernel Configuration
+# Linux/s390 4.14.40 Kernel Configuration
 #
 CONFIG_MMU=y
 CONFIG_ZONE_DMA=y
@@ -466,6 +466,11 @@ CONFIG_HZ_250=y
 CONFIG_HZ=250
 CONFIG_SCHED_HRTICK=y
 CONFIG_ARCH_RANDOM=y
+CONFIG_KERNEL_NOBP=y
+CONFIG_EXPOLINE=y
+# CONFIG_EXPOLINE_OFF is not set
+# CONFIG_EXPOLINE_AUTO is not set
+CONFIG_EXPOLINE_FULL=y

 #
 # Memory setup
@@ -1051,7 +1056,15 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1165,7 +1178,8 @@ CONFIG_VIRTIO_VSOCKETS_COMMON=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 # CONFIG_NET_NSH is not set
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
@@ -1240,6 +1254,7 @@ CONFIG_ALLOW_DEV_COREDUMP=y
 CONFIG_SYS_HYPERVISOR=y
 # CONFIG_GENERIC_CPU_DEVICES is not set
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 # CONFIG_DMA_SHARED_BUFFER is not set
 # CONFIG_DMA_CMA is not set

--- a/kernel/config-4.14.x-x86_64
+++ b/kernel/config-4.14.x-x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.14.32 Kernel Configuration
+# Linux/x86 4.14.40 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -1276,7 +1276,15 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1393,7 +1401,8 @@ CONFIG_HYPERV_VSOCKETS=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 # CONFIG_NET_NSH is not set
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
@@ -2884,7 +2893,22 @@ CONFIG_USB_UHCI_HCD=m
 #
 # also be needed; see USB_STORAGE Help for more info
 #
-# CONFIG_USB_STORAGE is not set
+CONFIG_USB_STORAGE=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set

 #
 # USB Imaging devices
--- a/kernel/config-4.16.x-aarch64
+++ b/kernel/config-4.16.x-aarch64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 4.15.15 Kernel Configuration
+# Linux/arm64 4.16.8 Kernel Configuration
 #
 CONFIG_ARM64=y
 CONFIG_64BIT=y
@@ -22,7 +22,7 @@ CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CSUM=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
-CONFIG_ZONE_DMA=y
+CONFIG_ZONE_DMA32=y
 CONFIG_HAVE_GENERIC_GUP=y
 CONFIG_ARCH_DMA_ADDR_T_64BIT=y
 CONFIG_NEED_DMA_MAP_STATE=y
@@ -35,7 +35,6 @@ CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_PGTABLE_LEVELS=4
 CONFIG_ARCH_SUPPORTS_UPROBES=y
 CONFIG_ARCH_PROC_KCORE_TEXT=y
-CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_EXTABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y
@@ -77,7 +76,6 @@ CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
 CONFIG_GENERIC_MSI_IRQ=y
 CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
-CONFIG_IRQ_DOMAIN_DEBUG=y
 CONFIG_IRQ_FORCED_THREADING=y
 CONFIG_SPARSE_IRQ=y
 # CONFIG_GENERIC_IRQ_DEBUGFS is not set
@@ -207,6 +205,7 @@ CONFIG_KALLSYMS_BASE_RELATIVE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT_ALWAYS_ON=y
 # CONFIG_USERFAULTFD is not set
+CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_HAVE_PERF_EVENTS=y
 # CONFIG_PC104 is not set
@@ -242,6 +241,7 @@ CONFIG_GENERIC_SMP_IDLE_THREAD=y
 CONFIG_GENERIC_IDLE_POLL_SETUP=y
 CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
 CONFIG_ARCH_HAS_SET_MEMORY=y
+CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
 CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
 CONFIG_HAVE_CLK=y
 CONFIG_HAVE_DMA_API_DEBUG=y
@@ -266,10 +266,10 @@ CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
 CONFIG_HAVE_CC_STACKPROTECTOR=y
-CONFIG_CC_STACKPROTECTOR=y
 # CONFIG_CC_STACKPROTECTOR_NONE is not set
 # CONFIG_CC_STACKPROTECTOR_REGULAR is not set
 CONFIG_CC_STACKPROTECTOR_STRONG=y
+# CONFIG_CC_STACKPROTECTOR_AUTO is not set
 CONFIG_THIN_ARCHIVES=y
 CONFIG_HAVE_CONTEXT_TRACKING=y
 CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
@@ -429,7 +429,6 @@ CONFIG_PCIEASPM_DEFAULT=y
 # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
 # CONFIG_PCIEASPM_PERFORMANCE is not set
 CONFIG_PCIE_PME=y
-# CONFIG_PCIE_DPC is not set
 # CONFIG_PCIE_PTM is not set
 CONFIG_PCI_BUS_ADDR_T_64BIT=y
 CONFIG_PCI_MSI=y
@@ -450,6 +449,11 @@ CONFIG_HOTPLUG_PCI_ACPI=y
 # CONFIG_HOTPLUG_PCI_CPCI is not set
 # CONFIG_HOTPLUG_PCI_SHPC is not set

+#
+# Cadence PCIe controllers support
+#
+# CONFIG_PCIE_CADENCE_HOST is not set
+
 #
 # DesignWare PCI Core Support
 #
@@ -495,6 +499,7 @@ CONFIG_ARM64_ERRATUM_819472=y
 CONFIG_ARM64_ERRATUM_832075=y
 CONFIG_ARM64_ERRATUM_834220=y
 CONFIG_ARM64_ERRATUM_843419=y
+CONFIG_ARM64_ERRATUM_1024718=y
 CONFIG_CAVIUM_ERRATUM_22375=y
 CONFIG_CAVIUM_ERRATUM_23154=y
 CONFIG_CAVIUM_ERRATUM_27456=y
@@ -511,6 +516,8 @@ CONFIG_ARM64_4K_PAGES=y
 # CONFIG_ARM64_VA_BITS_39 is not set
 CONFIG_ARM64_VA_BITS_48=y
 CONFIG_ARM64_VA_BITS=48
+CONFIG_ARM64_PA_BITS_48=y
+CONFIG_ARM64_PA_BITS=48
 # CONFIG_CPU_BIG_ENDIAN is not set
 CONFIG_SCHED_MC=y
 # CONFIG_SCHED_SMT is not set
@@ -553,7 +560,6 @@ CONFIG_BALLOON_COMPACTION=y
 CONFIG_COMPACTION=y
 CONFIG_MIGRATION=y
 CONFIG_PHYS_ADDR_T_64BIT=y
-CONFIG_BOUNCE=y
 CONFIG_MMU_NOTIFIER=y
 CONFIG_KSM=y
 CONFIG_DEFAULT_MMAP_MIN_ADDR=32768
@@ -571,6 +577,7 @@ CONFIG_TRANSPARENT_HUGE_PAGECACHE=y
 # CONFIG_ZBUD is not set
 # CONFIG_ZSMALLOC is not set
 CONFIG_GENERIC_EARLY_IOREMAP=y
+# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
 # CONFIG_IDLE_PAGE_TRACKING is not set
 # CONFIG_PERCPU_STATS is not set
 # CONFIG_GUP_BENCHMARK is not set
@@ -598,6 +605,7 @@ CONFIG_ARM64_VHE=y
 #
 CONFIG_ARM64_UAO=y
 # CONFIG_ARM64_PMEM is not set
+CONFIG_ARM64_RAS_EXTN=y
 CONFIG_ARM64_SVE=y
 CONFIG_ARM64_MODULE_CMODEL_LARGE=y
 CONFIG_ARM64_MODULE_PLTS=y
@@ -684,10 +692,10 @@ CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 #
 CONFIG_CPUFREQ_DT=y
 CONFIG_CPUFREQ_DT_PLATDEV=y
+# CONFIG_ACPI_CPPC_CPUFREQ is not set
 CONFIG_ARM_BIG_LITTLE_CPUFREQ=y
 CONFIG_ARM_DT_BL_CPUFREQ=y
 # CONFIG_ARM_KIRKWOOD_CPUFREQ is not set
-# CONFIG_ACPI_CPPC_CPUFREQ is not set
 # CONFIG_QORIQ_CPUFREQ is not set
 CONFIG_NET=y
 CONFIG_NET_INGRESS=y
@@ -796,12 +804,15 @@ CONFIG_BRIDGE_NETFILTER=y
 #
 CONFIG_NETFILTER_INGRESS=y
 CONFIG_NETFILTER_NETLINK=y
+CONFIG_NETFILTER_FAMILY_BRIDGE=y
+CONFIG_NETFILTER_FAMILY_ARP=y
 CONFIG_NETFILTER_NETLINK_ACCT=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
 CONFIG_NF_LOG_COMMON=y
 # CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NETFILTER_CONNCOUNT=y
 CONFIG_NF_CONNTRACK_MARK=y
 # CONFIG_NF_CONNTRACK_SECMARK is not set
 CONFIG_NF_CONNTRACK_ZONES=y
@@ -868,6 +879,7 @@ CONFIG_NFT_HASH=y
 CONFIG_NF_DUP_NETDEV=y
 CONFIG_NFT_DUP_NETDEV=y
 CONFIG_NFT_FWD_NETDEV=y
+# CONFIG_NF_FLOW_TABLE is not set
 CONFIG_NETFILTER_XTABLES=y

 #
@@ -1090,6 +1102,7 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=y
 CONFIG_IP6_NF_MATCH_MH=y
 CONFIG_IP6_NF_MATCH_RPFILTER=y
 CONFIG_IP6_NF_MATCH_RT=y
+# CONFIG_IP6_NF_MATCH_SRH is not set
 CONFIG_IP6_NF_TARGET_HL=y
 CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_REJECT=y
@@ -1126,7 +1139,14 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1145,7 +1165,6 @@ CONFIG_VLAN_8021Q=y
 # CONFIG_DECNET is not set
 CONFIG_LLC=y
 # CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
@@ -1244,7 +1263,8 @@ CONFIG_VIRTIO_VSOCKETS_COMMON=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_NSH=m
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
@@ -1266,7 +1286,6 @@ CONFIG_NET_FLOW_LIMIT=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NET_TCPPROBE is not set
 # CONFIG_NET_DROP_MONITOR is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_CAN is not set
@@ -1312,7 +1331,6 @@ CONFIG_DEVTMPFS=y
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
-CONFIG_FIRMWARE_IN_KERNEL=y
 CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
 CONFIG_ALLOW_DEV_COREDUMP=y
@@ -1352,12 +1370,9 @@ CONFIG_OF_EARLY_FLATTREE=y
 CONFIG_OF_KOBJ=y
 CONFIG_OF_DYNAMIC=y
 CONFIG_OF_ADDRESS=y
-CONFIG_OF_ADDRESS_PCI=y
 CONFIG_OF_IRQ=y
 CONFIG_OF_NET=y
 CONFIG_OF_MDIO=m
-CONFIG_OF_PCI=y
-CONFIG_OF_PCI_IRQ=y
 CONFIG_OF_RESERVED_MEM=y
 CONFIG_OF_RESOLVE=y
 CONFIG_OF_OVERLAY=y
@@ -1428,6 +1443,7 @@ CONFIG_BLK_DEV_NVME=y
 # CONFIG_SRAM is not set
 CONFIG_VEXPRESS_SYSCFG=y
 # CONFIG_PCI_ENDPOINT_TEST is not set
+# CONFIG_MISC_RTSX is not set
 # CONFIG_C2PORT is not set

 #
@@ -1487,6 +1503,9 @@ CONFIG_VEXPRESS_SYSCFG=y
 # CONFIG_CXL_BASE is not set
 # CONFIG_CXL_AFU_DRIVER_OPS is not set
 # CONFIG_CXL_LIB is not set
+# CONFIG_OCXL_BASE is not set
+# CONFIG_MISC_RTSX_PCI is not set
+# CONFIG_MISC_RTSX_USB is not set

 #
 # SCSI device support
@@ -1589,6 +1608,7 @@ CONFIG_ATA_ACPI=y
 # Controllers with non-SFF native interface
 #
 CONFIG_SATA_AHCI=y
+CONFIG_SATA_MOBILE_LPM_POLICY=0
 CONFIG_SATA_AHCI_PLATFORM=y
 # CONFIG_AHCI_CEVA is not set
 # CONFIG_AHCI_QORIQ is not set
@@ -1686,6 +1706,7 @@ CONFIG_DM_BUFIO=y
 # CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set
 CONFIG_DM_BIO_PRISON=y
 CONFIG_DM_PERSISTENT_DATA=y
+# CONFIG_DM_UNSTRIPED is not set
 CONFIG_DM_CRYPT=y
 CONFIG_DM_SNAPSHOT=y
 CONFIG_DM_THIN_PROVISIONING=y
@@ -1793,10 +1814,13 @@ CONFIG_THUNDER_NIC_PF=m
 CONFIG_THUNDER_NIC_VF=m
 CONFIG_THUNDER_NIC_BGX=m
 CONFIG_THUNDER_NIC_RGX=m
+CONFIG_CAVIUM_PTP=y
 # CONFIG_LIQUIDIO is not set
 # CONFIG_LIQUIDIO_VF is not set
 # CONFIG_NET_VENDOR_CHELSIO is not set
 # CONFIG_NET_VENDOR_CISCO is not set
+CONFIG_NET_VENDOR_CORTINA=y
+# CONFIG_GEMINI_ETHERNET is not set
 # CONFIG_DNET is not set
 # CONFIG_NET_VENDOR_DEC is not set
 # CONFIG_NET_VENDOR_DLINK is not set
@@ -1869,6 +1893,8 @@ CONFIG_8139CP=m
 # CONFIG_NET_VENDOR_SIS is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
+CONFIG_NET_VENDOR_SOCIONEXT=y
+# CONFIG_SNI_NETSEC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
 # CONFIG_NET_VENDOR_TEHUTI is not set
@@ -1983,6 +2009,7 @@ CONFIG_USB_NET_SMSC95XX=m
 CONFIG_XEN_NETDEV_FRONTEND=y
 # CONFIG_VMXNET3 is not set
 # CONFIG_FUJITSU_ES is not set
+# CONFIG_NETDEVSIM is not set
 # CONFIG_ISDN is not set
 # CONFIG_NVM is not set

@@ -2047,7 +2074,6 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_MMA8450 is not set
 # CONFIG_INPUT_GP2A is not set
 # CONFIG_INPUT_GPIO_BEEPER is not set
-# CONFIG_INPUT_GPIO_TILT_POLLED is not set
 # CONFIG_INPUT_GPIO_DECODER is not set
 # CONFIG_INPUT_ATI_REMOTE2 is not set
 # CONFIG_INPUT_KEYSPAN_REMOTE is not set
@@ -2155,7 +2181,8 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_RP2 is not set
 # CONFIG_SERIAL_FSL_LPUART is not set
 # CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set
-# CONFIG_SERIAL_DEV_BUS is not set
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
 # CONFIG_TTY_PRINTK is not set
 CONFIG_HVC_DRIVER=y
 CONFIG_HVC_IRQ=y
@@ -2168,10 +2195,10 @@ CONFIG_HW_RANDOM=y
 # CONFIG_HW_RANDOM_TIMERIOMEM is not set
 CONFIG_HW_RANDOM_BCM2835=y
 CONFIG_HW_RANDOM_VIRTIO=y
-CONFIG_HW_RANDOM_TPM=y
 CONFIG_HW_RANDOM_HISI=y
 CONFIG_HW_RANDOM_MSM=y
 CONFIG_HW_RANDOM_CAVIUM=y
+CONFIG_HW_RANDOM_EXYNOS=y
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set

@@ -2181,6 +2208,7 @@ CONFIG_HW_RANDOM_CAVIUM=y
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_HPET is not set
 CONFIG_TCG_TPM=y
+CONFIG_HW_RANDOM_TPM=y
 CONFIG_TCG_TIS_CORE=m
 CONFIG_TCG_TIS=m
 CONFIG_TCG_TIS_I2C_ATMEL=m
@@ -2338,6 +2366,7 @@ CONFIG_PINCTRL_BCM2835=y
 # CONFIG_PINCTRL_MSM8916 is not set
 # CONFIG_PINCTRL_MSM8994 is not set
 # CONFIG_PINCTRL_MSM8996 is not set
+# CONFIG_PINCTRL_MSM8998 is not set
 # CONFIG_PINCTRL_QDF2XXX is not set
 # CONFIG_PINCTRL_QCOM_SSBI_PMIC is not set
 CONFIG_PINCTRL_SAMSUNG=y
@@ -2392,6 +2421,7 @@ CONFIG_GPIO_THUNDERX=m
 #
 # CONFIG_GPIO_BT8XX is not set
 # CONFIG_GPIO_PCI_IDIO_16 is not set
+# CONFIG_GPIO_PCIE_IDIO_24 is not set
 # CONFIG_GPIO_RDC321X is not set

 #
@@ -2440,7 +2470,6 @@ CONFIG_POWER_SUPPLY=y
 # CONFIG_BATTERY_GAUGE_LTC2941 is not set
 # CONFIG_CHARGER_RT9455 is not set
 CONFIG_HWMON=y
-# CONFIG_HWMON_VID is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set

 #
@@ -2535,7 +2564,6 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
-# CONFIG_SENSORS_SCH56XX_COMMON is not set
 # CONFIG_SENSORS_STTS751 is not set
 # CONFIG_SENSORS_SMM665 is not set
 # CONFIG_SENSORS_ADC128D818 is not set
@@ -2556,6 +2584,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT1211 is not set
 # CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83773G is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
@@ -2610,10 +2639,6 @@ CONFIG_EXYNOS_THERMAL=y
 #
 # CONFIG_WATCHDOG is not set
 CONFIG_SSB_POSSIBLE=y
-
-#
-# Sonics Silicon Backplane
-#
 # CONFIG_SSB is not set
 CONFIG_BCMA_POSSIBLE=y
 # CONFIG_BCMA is not set
@@ -2669,9 +2694,7 @@ CONFIG_MFD_CORE=y
 # CONFIG_MFD_PCF50633 is not set
 # CONFIG_MFD_QCOM_RPM is not set
 # CONFIG_MFD_RDC321X is not set
-# CONFIG_MFD_RTSX_PCI is not set
 # CONFIG_MFD_RT5033 is not set
-# CONFIG_MFD_RTSX_USB is not set
 # CONFIG_MFD_RC5T583 is not set
 # CONFIG_MFD_RK808 is not set
 # CONFIG_MFD_RN5T618 is not set
@@ -2715,6 +2738,7 @@ CONFIG_MFD_SYSCON=y
 # CONFIG_MFD_WM8350_I2C is not set
 # CONFIG_MFD_WM8994 is not set
 CONFIG_MFD_VEXPRESS_SYSREG=y
+# CONFIG_RAVE_SP_CORE is not set
 # CONFIG_REGULATOR is not set
 # CONFIG_RC_CORE is not set
 # CONFIG_MEDIA_SUPPORT is not set
@@ -2733,6 +2757,7 @@ CONFIG_MFD_VEXPRESS_SYSREG=y
 # AMD Library routines
 #
 # CONFIG_CHASH is not set
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
 # CONFIG_DRM_LIB_RANDOM is not set

 #
@@ -2859,6 +2884,7 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_GYRATION is not set
 # CONFIG_HID_ICADE is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_JABRA is not set
 # CONFIG_HID_TWINHAN is not set
 # CONFIG_HID_KENSINGTON is not set
 # CONFIG_HID_LCPOWER is not set
@@ -2935,6 +2961,7 @@ CONFIG_USB_OTG=y
 #
 # CONFIG_USB_C67X00_HCD is not set
 CONFIG_USB_XHCI_HCD=m
+# CONFIG_USB_XHCI_DBGCAP is not set
 CONFIG_USB_XHCI_PCI=m
 # CONFIG_USB_XHCI_PLATFORM is not set
 CONFIG_USB_EHCI_HCD=m
@@ -2971,7 +2998,22 @@ CONFIG_USB_UHCI_HCD=m
 #
 # also be needed; see USB_STORAGE Help for more info
 #
-# CONFIG_USB_STORAGE is not set
+CONFIG_USB_STORAGE=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set

 #
 # USB Imaging devices
@@ -3073,6 +3115,7 @@ CONFIG_MMC_SDHCI_IPROC=m
 # CONFIG_MMC_VUB300 is not set
 # CONFIG_MMC_USHC is not set
 # CONFIG_MMC_USDHI6ROL0 is not set
+# CONFIG_MMC_CQHCI is not set
 # CONFIG_MMC_TOSHIBA_PCI is not set
 CONFIG_MMC_BCM2835=m
 # CONFIG_MMC_MTK is not set
@@ -3229,10 +3272,7 @@ CONFIG_UIO=m
 CONFIG_IRQ_BYPASS_MANAGER=y
 # CONFIG_VIRT_DRIVERS is not set
 CONFIG_VIRTIO=y
-
-#
-# Virtio drivers
-#
+CONFIG_VIRTIO_MENU=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_PCI_LEGACY=y
 CONFIG_VIRTIO_BALLOON=y
@@ -3296,6 +3336,7 @@ CONFIG_COMMON_CLK_HI3660=y
 CONFIG_COMMON_CLK_HI3798CV200=y
 # CONFIG_COMMON_CLK_HI6220 is not set
 CONFIG_RESET_HISI=y
+# CONFIG_STUB_CLK_HI3660 is not set
 # CONFIG_COMMON_CLK_QCOM is not set
 CONFIG_COMMON_CLK_SAMSUNG=y
 CONFIG_EXYNOS_ARM64_COMMON_CLK=y
@@ -3344,6 +3385,7 @@ CONFIG_BCM2835_MBOX=y
 #
 # CONFIG_RPMSG_QCOM_GLINK_RPM is not set
 # CONFIG_RPMSG_VIRTIO is not set
+# CONFIG_SOUNDWIRE is not set

 #
 # SOC (System On Chip) specific Drivers
@@ -3374,6 +3416,11 @@ CONFIG_EXYNOS_PMU=y
 CONFIG_EXYNOS_PM_DOMAINS=y
 # CONFIG_SUNXI_SRAM is not set
 # CONFIG_SOC_TI is not set
+
+#
+# Xilinx SoC drivers
+#
+# CONFIG_XILINX_VCU is not set
 CONFIG_PM_DEVFREQ=y

 #
@@ -3472,6 +3519,7 @@ CONFIG_GENERIC_PHY=y
 #
 CONFIG_ARM_PMU=y
 CONFIG_ARM_PMU_ACPI=y
+# CONFIG_ARM_DSU_PMU is not set
 # CONFIG_HISI_PMU is not set
 # CONFIG_QCOM_L2_PMU is not set
 # CONFIG_QCOM_L3_PMU is not set
@@ -3490,13 +3538,11 @@ CONFIG_NVMEM=y
 # CONFIG_STM is not set
 # CONFIG_INTEL_TH is not set
 # CONFIG_FPGA is not set
-
-#
-# FSI support
-#
 # CONFIG_FSI is not set
 # CONFIG_TEE is not set
 CONFIG_PM_OPP=y
+# CONFIG_SIOX is not set
+# CONFIG_SLIMBUS is not set

 #
 # Firmware Drivers
@@ -3504,6 +3550,7 @@ CONFIG_PM_OPP=y
 CONFIG_ARM_PSCI_FW=y
 # CONFIG_ARM_PSCI_CHECKER is not set
 # CONFIG_ARM_SCPI_PROTOCOL is not set
+# CONFIG_ARM_SDE_INTERFACE is not set
 CONFIG_FIRMWARE_MEMMAP=y
 CONFIG_DMIID=y
 CONFIG_DMI_SYSFS=y
@@ -3773,7 +3820,6 @@ CONFIG_CIFS_DEBUG=y
 CONFIG_CIFS_DFS_UPCALL=y
 # CONFIG_CIFS_SMB311 is not set
 CONFIG_CIFS_FSCACHE=y
-# CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
 CONFIG_9P_FS=y
@@ -4021,10 +4067,7 @@ CONFIG_FTRACE_MCOUNT_RECORD=y
 # CONFIG_TRACE_EVAL_MAP_FILE is not set
 CONFIG_TRACING_EVENTS_GPIO=y
 # CONFIG_DMA_API_DEBUG is not set
-
-#
-# Runtime Testing
-#
+CONFIG_RUNTIME_TESTING_MENU=y
 # CONFIG_LKDTM is not set
 # CONFIG_TEST_LIST_SORT is not set
 # CONFIG_TEST_SORT is not set
@@ -4045,7 +4088,7 @@ CONFIG_TRACING_EVENTS_GPIO=y
 # CONFIG_TEST_LKM is not set
 # CONFIG_TEST_USER_COPY is not set
 # CONFIG_TEST_BPF is not set
-# CONFIG_TEST_FIND_BIT is not set
+# CONFIG_FIND_BIT_BENCHMARK is not set
 # CONFIG_TEST_FIRMWARE is not set
 # CONFIG_TEST_SYSCTL is not set
 # CONFIG_TEST_UDELAY is not set
@@ -4093,6 +4136,7 @@ CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
 CONFIG_HARDENED_USERCOPY=y
+CONFIG_HARDENED_USERCOPY_FALLBACK=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
 CONFIG_FORTIFY_SOURCE=y
 CONFIG_STATIC_USERMODEHELPER=y
@@ -4294,6 +4338,9 @@ CONFIG_CRYPTO_SHA256_ARM64=y
 CONFIG_CRYPTO_SHA512_ARM64=y
 CONFIG_CRYPTO_SHA1_ARM64_CE=y
 CONFIG_CRYPTO_SHA2_ARM64_CE=y
+# CONFIG_CRYPTO_SHA512_ARM64_CE is not set
+# CONFIG_CRYPTO_SHA3_ARM64 is not set
+# CONFIG_CRYPTO_SM3_ARM64_CE is not set
 CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
 CONFIG_CRYPTO_CRC32_ARM64_CE=y
@@ -4367,7 +4414,8 @@ CONFIG_ASSOCIATIVE_ARRAY=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HAS_DMA=y
-# CONFIG_DMA_NOOP_OPS is not set
+CONFIG_SGL_ALLOC=y
+CONFIG_DMA_DIRECT_OPS=y
 # CONFIG_DMA_VIRT_OPS is not set
 CONFIG_CHECK_SIGNATURE=y
 CONFIG_CPU_RMAP=y
--- a/kernel/config-4.16.x-s390x
+++ b/kernel/config-4.16.x-s390x
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/s390 4.15.15 Kernel Configuration
+# Linux/s390 4.16.8 Kernel Configuration
 #
 CONFIG_MMU=y
 CONFIG_ZONE_DMA=y
@@ -24,7 +24,6 @@ CONFIG_ARCH_SUPPORTS_UPROBES=y
 CONFIG_S390=y
 CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_PGTABLE_LEVELS=5
-CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_EXTABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y
@@ -68,7 +67,6 @@ CONFIG_AUDIT_TREE=y
 #
 CONFIG_IRQ_DOMAIN=y
 CONFIG_GENERIC_MSI_IRQ=y
-# CONFIG_IRQ_DOMAIN_DEBUG is not set
 CONFIG_SPARSE_IRQ=y
 # CONFIG_GENERIC_IRQ_DEBUGFS is not set
 CONFIG_GENERIC_TIME_VSYSCALL=y
@@ -254,7 +252,6 @@ CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
 # CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set
 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
-# CONFIG_CC_STACKPROTECTOR is not set
 CONFIG_THIN_ARCHIVES=y
 CONFIG_HAVE_VIRT_CPU_ACCOUNTING=y
 CONFIG_ARCH_HAS_SCALED_CPUTIME=y
@@ -477,6 +474,11 @@ CONFIG_HZ_250=y
 CONFIG_HZ=250
 CONFIG_SCHED_HRTICK=y
 CONFIG_ARCH_RANDOM=y
+CONFIG_KERNEL_NOBP=y
+CONFIG_EXPOLINE=y
+# CONFIG_EXPOLINE_OFF is not set
+# CONFIG_EXPOLINE_MEDIUM is not set
+CONFIG_EXPOLINE_FULL=y

 #
 # Memory setup
@@ -527,7 +529,7 @@ CONFIG_CMA_AREAS=7
 # CONFIG_ZPOOL is not set
 # CONFIG_ZBUD is not set
 # CONFIG_ZSMALLOC is not set
-CONFIG_ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT=y
+# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
 # CONFIG_IDLE_PAGE_TRACKING is not set
 # CONFIG_PERCPU_STATS is not set
 # CONFIG_GUP_BENCHMARK is not set
@@ -553,7 +555,6 @@ CONFIG_PCIEASPM_DEFAULT=y
 # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
 # CONFIG_PCIEASPM_PERFORMANCE is not set
 CONFIG_PCIE_PME=y
-# CONFIG_PCIE_DPC is not set
 # CONFIG_PCIE_PTM is not set
 CONFIG_PCI_BUS_ADDR_T_64BIT=y
 CONFIG_PCI_MSI=y
@@ -570,6 +571,10 @@ CONFIG_HOTPLUG_PCI=y
 # CONFIG_HOTPLUG_PCI_SHPC is not set
 # CONFIG_HOTPLUG_PCI_S390 is not set

+#
+# Cadence PCIe controllers support
+#
+
 #
 # DesignWare PCI Core Support
 #
@@ -732,12 +737,15 @@ CONFIG_BRIDGE_NETFILTER=y
 #
 CONFIG_NETFILTER_INGRESS=y
 CONFIG_NETFILTER_NETLINK=y
+CONFIG_NETFILTER_FAMILY_BRIDGE=y
+CONFIG_NETFILTER_FAMILY_ARP=y
 CONFIG_NETFILTER_NETLINK_ACCT=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
 CONFIG_NF_LOG_COMMON=y
 # CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NETFILTER_CONNCOUNT=y
 CONFIG_NF_CONNTRACK_MARK=y
 # CONFIG_NF_CONNTRACK_SECMARK is not set
 CONFIG_NF_CONNTRACK_ZONES=y
@@ -804,6 +812,7 @@ CONFIG_NFT_HASH=y
 CONFIG_NF_DUP_NETDEV=y
 CONFIG_NFT_DUP_NETDEV=y
 CONFIG_NFT_FWD_NETDEV=y
+# CONFIG_NF_FLOW_TABLE is not set
 CONFIG_NETFILTER_XTABLES=y

 #
@@ -1026,6 +1035,7 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=y
 CONFIG_IP6_NF_MATCH_MH=y
 CONFIG_IP6_NF_MATCH_RPFILTER=y
 CONFIG_IP6_NF_MATCH_RT=y
+# CONFIG_IP6_NF_MATCH_SRH is not set
 CONFIG_IP6_NF_TARGET_HL=y
 CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_REJECT=y
@@ -1062,7 +1072,14 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1079,7 +1096,6 @@ CONFIG_VLAN_8021Q=y
 # CONFIG_DECNET is not set
 CONFIG_LLC=y
 # CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
@@ -1178,7 +1194,8 @@ CONFIG_VIRTIO_VSOCKETS_COMMON=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_NSH=m
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
@@ -1199,7 +1216,6 @@ CONFIG_NET_FLOW_LIMIT=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NET_TCPPROBE is not set
 # CONFIG_NET_DROP_MONITOR is not set
 # CONFIG_CAN is not set
 # CONFIG_AF_RXRPC is not set
@@ -1242,7 +1258,6 @@ CONFIG_DEVTMPFS=y
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
-CONFIG_FIRMWARE_IN_KERNEL=y
 CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
 CONFIG_ALLOW_DEV_COREDUMP=y
@@ -1328,6 +1343,7 @@ CONFIG_BLK_DEV_RBD=m
 # CONFIG_USB_SWITCH_FSA9480 is not set
 # CONFIG_SRAM is not set
 # CONFIG_PCI_ENDPOINT_TEST is not set
+# CONFIG_MISC_RTSX is not set
 # CONFIG_C2PORT is not set

 #
@@ -1386,6 +1402,8 @@ CONFIG_BLK_DEV_RBD=m
 # CONFIG_CXL_BASE is not set
 # CONFIG_CXL_AFU_DRIVER_OPS is not set
 # CONFIG_CXL_LIB is not set
+# CONFIG_OCXL_BASE is not set
+# CONFIG_MISC_RTSX_PCI is not set

 #
 # SCSI device support
@@ -1479,6 +1497,7 @@ CONFIG_ATA=y
 # Controllers with non-SFF native interface
 #
 CONFIG_SATA_AHCI=y
+CONFIG_SATA_MOBILE_LPM_POLICY=0
 # CONFIG_SATA_AHCI_PLATFORM is not set
 # CONFIG_SATA_INIC162X is not set
 # CONFIG_SATA_ACARD_AHCI is not set
@@ -1570,6 +1589,7 @@ CONFIG_DM_BUFIO=y
 # CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set
 CONFIG_DM_BIO_PRISON=y
 CONFIG_DM_PERSISTENT_DATA=y
+# CONFIG_DM_UNSTRIPED is not set
 CONFIG_DM_CRYPT=y
 CONFIG_DM_SNAPSHOT=y
 CONFIG_DM_THIN_PROVISIONING=y
@@ -1652,6 +1672,7 @@ CONFIG_ETHERNET=y
 # CONFIG_NET_VENDOR_CAVIUM is not set
 # CONFIG_NET_VENDOR_CHELSIO is not set
 # CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_DNET is not set
 # CONFIG_NET_VENDOR_DEC is not set
 # CONFIG_NET_VENDOR_DLINK is not set
@@ -1697,6 +1718,7 @@ CONFIG_MLX5_ESWITCH=y
 # CONFIG_NET_VENDOR_SIS is not set
 # CONFIG_NET_VENDOR_SOLARFLARE is not set
 # CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
 # CONFIG_NET_VENDOR_TEHUTI is not set
@@ -1772,7 +1794,6 @@ CONFIG_SMSGIUCV_EVENT=m
 CONFIG_QETH=y
 CONFIG_QETH_L2=y
 CONFIG_QETH_L3=y
-CONFIG_QETH_IPV6=y
 CONFIG_CCWGROUP=y

 #
@@ -1784,6 +1805,7 @@ CONFIG_CCWGROUP=y
 #
 # CONFIG_WAN is not set
 # CONFIG_VMXNET3 is not set
+# CONFIG_NETDEVSIM is not set
 # CONFIG_NVM is not set

 #
@@ -1898,13 +1920,13 @@ CONFIG_VIRTIO_CONSOLE=y
 CONFIG_HW_RANDOM=y
 # CONFIG_HW_RANDOM_TIMERIOMEM is not set
 CONFIG_HW_RANDOM_VIRTIO=y
-CONFIG_HW_RANDOM_TPM=y
 CONFIG_HW_RANDOM_S390=y
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_HANGCHECK_TIMER is not set
 CONFIG_TCG_TPM=y
+CONFIG_HW_RANDOM_TPM=y
 # CONFIG_TCG_TIS_I2C_ATMEL is not set
 # CONFIG_TCG_TIS_I2C_INFINEON is not set
 # CONFIG_TCG_TIS_I2C_NUVOTON is not set
@@ -2057,7 +2079,6 @@ CONFIG_POWER_SUPPLY=y
 # CONFIG_CHARGER_SMB347 is not set
 # CONFIG_BATTERY_GAUGE_LTC2941 is not set
 CONFIG_HWMON=y
-# CONFIG_HWMON_VID is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set

 #
@@ -2149,7 +2170,6 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
-# CONFIG_SENSORS_SCH56XX_COMMON is not set
 # CONFIG_SENSORS_STTS751 is not set
 # CONFIG_SENSORS_SMM665 is not set
 # CONFIG_SENSORS_ADC128D818 is not set
@@ -2169,6 +2189,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT1211 is not set
 # CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83773G is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
@@ -2199,10 +2220,6 @@ CONFIG_THERMAL_GOV_STEP_WISE=y
 #
 # CONFIG_WATCHDOG is not set
 CONFIG_SSB_POSSIBLE=y
-
-#
-# Sonics Silicon Backplane
-#
 # CONFIG_SSB is not set
 CONFIG_BCMA_POSSIBLE=y
 # CONFIG_BCMA is not set
@@ -2243,7 +2260,6 @@ CONFIG_BCMA_POSSIBLE=y
 # CONFIG_MFD_RETU is not set
 # CONFIG_MFD_PCF50633 is not set
 # CONFIG_MFD_RDC321X is not set
-# CONFIG_MFD_RTSX_PCI is not set
 # CONFIG_MFD_RT5033 is not set
 # CONFIG_MFD_RC5T583 is not set
 # CONFIG_MFD_SEC_CORE is not set
@@ -2396,6 +2412,7 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_GYRATION is not set
 # CONFIG_HID_ICADE is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_JABRA is not set
 # CONFIG_HID_TWINHAN is not set
 # CONFIG_HID_KENSINGTON is not set
 # CONFIG_HID_LCPOWER is not set
@@ -2463,10 +2480,7 @@ CONFIG_UIO=m
 # CONFIG_VFIO is not set
 # CONFIG_VIRT_DRIVERS is not set
 CONFIG_VIRTIO=y
-
-#
-# Virtio drivers
-#
+CONFIG_VIRTIO_MENU=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_PCI_LEGACY=y
 CONFIG_VIRTIO_BALLOON=y
@@ -2510,6 +2524,7 @@ CONFIG_S390_IOMMU=y
 #
 # CONFIG_RPMSG_QCOM_GLINK_RPM is not set
 # CONFIG_RPMSG_VIRTIO is not set
+# CONFIG_SOUNDWIRE is not set

 #
 # SOC (System On Chip) specific Drivers
@@ -2532,6 +2547,11 @@ CONFIG_S390_IOMMU=y
 #
 # CONFIG_SUNXI_SRAM is not set
 # CONFIG_SOC_TI is not set
+
+#
+# Xilinx SoC drivers
+#
+# CONFIG_XILINX_VCU is not set
 CONFIG_PM_DEVFREQ=y

 #
@@ -2602,12 +2622,10 @@ CONFIG_DAX=y
 # CONFIG_STM is not set
 # CONFIG_INTEL_TH is not set
 # CONFIG_FPGA is not set
-
-#
-# FSI support
-#
 # CONFIG_FSI is not set
 CONFIG_PM_OPP=y
+# CONFIG_SIOX is not set
+# CONFIG_SLIMBUS is not set

 #
 # File systems
@@ -2644,6 +2662,7 @@ CONFIG_BTRFS_FS_POSIX_ACL=y
 # CONFIG_NILFS2_FS is not set
 # CONFIG_F2FS_FS is not set
 # CONFIG_FS_DAX is not set
+CONFIG_FS_DAX_LIMITED=y
 CONFIG_FS_POSIX_ACL=y
 CONFIG_EXPORTFS=y
 # CONFIG_EXPORTFS_BLOCK_OPS is not set
@@ -2817,7 +2836,6 @@ CONFIG_CIFS_DEBUG=y
 CONFIG_CIFS_DFS_UPCALL=y
 # CONFIG_CIFS_SMB311 is not set
 CONFIG_CIFS_FSCACHE=y
-# CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
 CONFIG_9P_FS=y
@@ -3035,10 +3053,7 @@ CONFIG_FTRACE_MCOUNT_RECORD=y
 # CONFIG_RING_BUFFER_STARTUP_TEST is not set
 # CONFIG_TRACE_EVAL_MAP_FILE is not set
 # CONFIG_DMA_API_DEBUG is not set
-
-#
-# Runtime Testing
-#
+CONFIG_RUNTIME_TESTING_MENU=y
 # CONFIG_LKDTM is not set
 # CONFIG_TEST_LIST_SORT is not set
 # CONFIG_TEST_SORT is not set
@@ -3059,7 +3074,7 @@ CONFIG_FTRACE_MCOUNT_RECORD=y
 # CONFIG_TEST_LKM is not set
 # CONFIG_TEST_USER_COPY is not set
 # CONFIG_TEST_BPF is not set
-# CONFIG_TEST_FIND_BIT is not set
+# CONFIG_FIND_BIT_BENCHMARK is not set
 # CONFIG_TEST_FIRMWARE is not set
 # CONFIG_TEST_SYSCTL is not set
 # CONFIG_TEST_UDELAY is not set
@@ -3099,6 +3114,7 @@ CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
 CONFIG_HARDENED_USERCOPY=y
+CONFIG_HARDENED_USERCOPY_FALLBACK=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
 CONFIG_FORTIFY_SOURCE=y
 CONFIG_STATIC_USERMODEHELPER=y
@@ -3352,7 +3368,8 @@ CONFIG_TEXTSEARCH_FSM=y
 CONFIG_RADIX_TREE_MULTIORDER=y
 CONFIG_ASSOCIATIVE_ARRAY=y
 CONFIG_HAS_DMA=y
-CONFIG_DMA_NOOP_OPS=y
+CONFIG_SGL_ALLOC=y
+CONFIG_DMA_DIRECT_OPS=y
 # CONFIG_DMA_VIRT_OPS is not set
 CONFIG_CHECK_SIGNATURE=y
 CONFIG_CPU_RMAP=y
@@ -3391,6 +3408,7 @@ CONFIG_KVM_ASYNC_PF_SYNC=y
 CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y
 CONFIG_KVM_VFIO=y
 CONFIG_HAVE_KVM_INVALID_WAKEUPS=y
+CONFIG_HAVE_KVM_VCPU_ASYNC_IOCTL=y
 CONFIG_VIRTUALIZATION=y
 CONFIG_KVM=y
 # CONFIG_KVM_S390_UCONTROL is not set
--- a/kernel/config-4.16.x-x86_64
+++ b/kernel/config-4.16.x-x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.15.15 Kernel Configuration
+# Linux/x86 4.16.8 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -41,7 +41,6 @@ CONFIG_X86_64_SMP=y
 CONFIG_ARCH_SUPPORTS_UPROBES=y
 CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_PGTABLE_LEVELS=4
-CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 CONFIG_IRQ_WORK=y
 CONFIG_BUILDTIME_EXTABLE_SORT=y
 CONFIG_THREAD_INFO_IN_TASK=y
@@ -94,7 +93,6 @@ CONFIG_GENERIC_MSI_IRQ=y
 CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
 CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y
 CONFIG_GENERIC_IRQ_RESERVATION_MODE=y
-# CONFIG_IRQ_DOMAIN_DEBUG is not set
 CONFIG_IRQ_FORCED_THREADING=y
 CONFIG_SPARSE_IRQ=y
 # CONFIG_GENERIC_IRQ_DEBUGFS is not set
@@ -233,6 +231,7 @@ CONFIG_KALLSYMS_BASE_RELATIVE=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT_ALWAYS_ON=y
 # CONFIG_USERFAULTFD is not set
+CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y
 # CONFIG_EMBEDDED is not set
 CONFIG_HAVE_PERF_EVENTS=y
 # CONFIG_PC104 is not set
@@ -272,12 +271,14 @@ CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
 CONFIG_HAVE_OPTPROBES=y
 CONFIG_HAVE_KPROBES_ON_FTRACE=y
+CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y
 CONFIG_HAVE_NMI=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
 CONFIG_HAVE_DMA_CONTIGUOUS=y
 CONFIG_GENERIC_SMP_IDLE_THREAD=y
 CONFIG_ARCH_HAS_FORTIFY_SOURCE=y
 CONFIG_ARCH_HAS_SET_MEMORY=y
+CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y
 CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y
 CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y
 CONFIG_HAVE_CLK=y
@@ -308,10 +309,10 @@ CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
 CONFIG_GCC_PLUGIN_RANDSTRUCT=y
 CONFIG_GCC_PLUGIN_RANDSTRUCT_PERFORMANCE=y
 CONFIG_HAVE_CC_STACKPROTECTOR=y
-CONFIG_CC_STACKPROTECTOR=y
 # CONFIG_CC_STACKPROTECTOR_NONE is not set
 # CONFIG_CC_STACKPROTECTOR_REGULAR is not set
 CONFIG_CC_STACKPROTECTOR_STRONG=y
+# CONFIG_CC_STACKPROTECTOR_AUTO is not set
 CONFIG_THIN_ARCHIVES=y
 CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y
 CONFIG_HAVE_CONTEXT_TRACKING=y
@@ -346,6 +347,7 @@ CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y
 CONFIG_STRICT_KERNEL_RWX=y
 CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y
 CONFIG_STRICT_MODULE_RWX=y
+CONFIG_ARCH_HAS_PHYS_TO_DMA=y
 CONFIG_ARCH_HAS_REFCOUNT=y
 CONFIG_REFCOUNT_FULL=y

@@ -437,6 +439,7 @@ CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y
 CONFIG_QUEUED_SPINLOCKS=y
 CONFIG_ARCH_USE_QUEUED_RWLOCKS=y
 CONFIG_QUEUED_RWLOCKS=y
+CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y
 CONFIG_FREEZER=y

 #
@@ -475,6 +478,7 @@ CONFIG_KVM_GUEST=y
 # CONFIG_KVM_DEBUG_FS is not set
 # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
 CONFIG_PARAVIRT_CLOCK=y
+# CONFIG_JAILHOUSE_GUEST is not set
 CONFIG_NO_BOOTMEM=y
 # CONFIG_MK8 is not set
 # CONFIG_MPSC is not set
@@ -500,6 +504,9 @@ CONFIG_DMI=y
 CONFIG_SWIOTLB=y
 CONFIG_IOMMU_HELPER=y
 # CONFIG_MAXSMP is not set
+CONFIG_NR_CPUS_RANGE_BEGIN=2
+CONFIG_NR_CPUS_RANGE_END=512
+CONFIG_NR_CPUS_DEFAULT=64
 CONFIG_NR_CPUS=128
 # CONFIG_SCHED_SMT is not set
 CONFIG_SCHED_MC=y
@@ -587,7 +594,6 @@ CONFIG_TRANSPARENT_HUGE_PAGECACHE=y
 # CONFIG_ZBUD is not set
 # CONFIG_ZSMALLOC is not set
 CONFIG_GENERIC_EARLY_IOREMAP=y
-CONFIG_ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT=y
 # CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set
 # CONFIG_IDLE_PAGE_TRACKING is not set
 CONFIG_ARCH_HAS_ZONE_DEVICE=y
@@ -638,7 +644,6 @@ CONFIG_HOTPLUG_CPU=y
 # CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
 # CONFIG_DEBUG_HOTPLUG_CPU0 is not set
 # CONFIG_COMPAT_VDSO is not set
-# CONFIG_LEGACY_VSYSCALL_NATIVE is not set
 # CONFIG_LEGACY_VSYSCALL_EMULATE is not set
 CONFIG_LEGACY_VSYSCALL_NONE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -667,6 +672,7 @@ CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
 CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
 CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y
 # CONFIG_ACPI_DEBUGGER is not set
+CONFIG_ACPI_SPCR_TABLE=y
 CONFIG_ACPI_LPIT=y
 # CONFIG_ACPI_PROCFS_POWER is not set
 # CONFIG_ACPI_REV_OVERRIDE_POSSIBLE is not set
@@ -689,7 +695,6 @@ CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y
 CONFIG_ACPI_TABLE_UPGRADE=y
 # CONFIG_ACPI_DEBUG is not set
 # CONFIG_ACPI_PCI_SLOT is not set
-CONFIG_X86_PM_TIMER=y
 CONFIG_ACPI_CONTAINER=y
 # CONFIG_ACPI_HOTPLUG_MEMORY is not set
 CONFIG_ACPI_HOTPLUG_IOAPIC=y
@@ -708,6 +713,7 @@ CONFIG_ACPI_APEI_GHES=y
 # CONFIG_DPTF_POWER is not set
 # CONFIG_PMIC_OPREGION is not set
 # CONFIG_ACPI_CONFIGFS is not set
+CONFIG_X86_PM_TIMER=y
 # CONFIG_SFI is not set

 #
@@ -775,7 +781,6 @@ CONFIG_PCIEASPM_DEFAULT=y
 # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
 # CONFIG_PCIEASPM_PERFORMANCE is not set
 CONFIG_PCIE_PME=y
-# CONFIG_PCIE_DPC is not set
 # CONFIG_PCIE_PTM is not set
 CONFIG_PCI_BUS_ADDR_T_64BIT=y
 CONFIG_PCI_MSI=y
@@ -797,6 +802,10 @@ CONFIG_HOTPLUG_PCI=y
 # CONFIG_HOTPLUG_PCI_CPCI is not set
 CONFIG_HOTPLUG_PCI_SHPC=y

+#
+# Cadence PCIe controllers support
+#
+
 #
 # DesignWare PCI Core Support
 #
@@ -949,12 +958,15 @@ CONFIG_BRIDGE_NETFILTER=y
 #
 CONFIG_NETFILTER_INGRESS=y
 CONFIG_NETFILTER_NETLINK=y
+CONFIG_NETFILTER_FAMILY_BRIDGE=y
+CONFIG_NETFILTER_FAMILY_ARP=y
 CONFIG_NETFILTER_NETLINK_ACCT=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
 CONFIG_NETFILTER_NETLINK_LOG=y
 CONFIG_NF_CONNTRACK=y
 CONFIG_NF_LOG_COMMON=y
 # CONFIG_NF_LOG_NETDEV is not set
+CONFIG_NETFILTER_CONNCOUNT=y
 CONFIG_NF_CONNTRACK_MARK=y
 # CONFIG_NF_CONNTRACK_SECMARK is not set
 CONFIG_NF_CONNTRACK_ZONES=y
@@ -1021,6 +1033,7 @@ CONFIG_NFT_HASH=y
 CONFIG_NF_DUP_NETDEV=y
 CONFIG_NFT_DUP_NETDEV=y
 CONFIG_NFT_FWD_NETDEV=y
+# CONFIG_NF_FLOW_TABLE is not set
 CONFIG_NETFILTER_XTABLES=y

 #
@@ -1243,6 +1256,7 @@ CONFIG_IP6_NF_MATCH_IPV6HEADER=y
 CONFIG_IP6_NF_MATCH_MH=y
 CONFIG_IP6_NF_MATCH_RPFILTER=y
 CONFIG_IP6_NF_MATCH_RT=y
+# CONFIG_IP6_NF_MATCH_SRH is not set
 CONFIG_IP6_NF_TARGET_HL=y
 CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_REJECT=y
@@ -1279,7 +1293,14 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1298,7 +1319,6 @@ CONFIG_VLAN_8021Q=y
 # CONFIG_DECNET is not set
 CONFIG_LLC=y
 # CONFIG_LLC2 is not set
-# CONFIG_IPX is not set
 # CONFIG_ATALK is not set
 # CONFIG_X25 is not set
 # CONFIG_LAPB is not set
@@ -1398,7 +1418,8 @@ CONFIG_HYPERV_VSOCKETS=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 CONFIG_NET_NSH=m
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
@@ -1419,7 +1440,6 @@ CONFIG_NET_FLOW_LIMIT=y
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_NET_TCPPROBE is not set
 # CONFIG_NET_DROP_MONITOR is not set
 # CONFIG_HAMRADIO is not set
 # CONFIG_CAN is not set
@@ -1464,7 +1484,6 @@ CONFIG_DEVTMPFS=y
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=y
-CONFIG_FIRMWARE_IN_KERNEL=y
 CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
 CONFIG_ALLOW_DEV_COREDUMP=y
@@ -1555,6 +1574,7 @@ CONFIG_BLK_DEV_NVME=y
 # CONFIG_USB_SWITCH_FSA9480 is not set
 # CONFIG_SRAM is not set
 # CONFIG_PCI_ENDPOINT_TEST is not set
+# CONFIG_MISC_RTSX is not set
 # CONFIG_C2PORT is not set

 #
@@ -1620,6 +1640,9 @@ CONFIG_BLK_DEV_NVME=y
 # CONFIG_CXL_BASE is not set
 # CONFIG_CXL_AFU_DRIVER_OPS is not set
 # CONFIG_CXL_LIB is not set
+# CONFIG_OCXL_BASE is not set
+# CONFIG_MISC_RTSX_PCI is not set
+# CONFIG_MISC_RTSX_USB is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set

@@ -1725,6 +1748,7 @@ CONFIG_ATA_ACPI=y
 # Controllers with non-SFF native interface
 #
 CONFIG_SATA_AHCI=y
+CONFIG_SATA_MOBILE_LPM_POLICY=0
 # CONFIG_SATA_AHCI_PLATFORM is not set
 # CONFIG_SATA_INIC162X is not set
 # CONFIG_SATA_ACARD_AHCI is not set
@@ -1817,6 +1841,7 @@ CONFIG_DM_BUFIO=y
 # CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set
 CONFIG_DM_BIO_PRISON=y
 CONFIG_DM_PERSISTENT_DATA=y
+# CONFIG_DM_UNSTRIPED is not set
 CONFIG_DM_CRYPT=y
 CONFIG_DM_SNAPSHOT=y
 CONFIG_DM_THIN_PROVISIONING=y
@@ -1896,15 +1921,13 @@ CONFIG_MDIO=m
 # CONFIG_NET_VENDOR_3COM is not set
 # CONFIG_NET_VENDOR_ADAPTEC is not set
 # CONFIG_NET_VENDOR_AGERE is not set
-CONFIG_NET_VENDOR_ALACRITECH=y
-# CONFIG_SLICOSS is not set
+# CONFIG_NET_VENDOR_ALACRITECH is not set
 # CONFIG_NET_VENDOR_ALTEON is not set
 # CONFIG_ALTERA_TSE is not set
 CONFIG_NET_VENDOR_AMAZON=y
 CONFIG_ENA_ETHERNET=m
 # CONFIG_NET_VENDOR_AMD is not set
-CONFIG_NET_VENDOR_AQUANTIA=y
-# CONFIG_AQTION is not set
+# CONFIG_NET_VENDOR_AQUANTIA is not set
 # CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_VENDOR_ATHEROS is not set
 # CONFIG_NET_VENDOR_AURORA is not set
@@ -1924,6 +1947,7 @@ CONFIG_BNXT_FLOWER_OFFLOAD=y
 # CONFIG_NET_VENDOR_CAVIUM is not set
 # CONFIG_NET_VENDOR_CHELSIO is not set
 # CONFIG_NET_VENDOR_CISCO is not set
+# CONFIG_NET_VENDOR_CORTINA is not set
 # CONFIG_CX_ECAT is not set
 # CONFIG_DNET is not set
 # CONFIG_NET_VENDOR_DEC is not set
@@ -1990,14 +2014,14 @@ CONFIG_NET_VENDOR_SOLARFLARE=y
 # CONFIG_SFC is not set
 # CONFIG_SFC_FALCON is not set
 # CONFIG_NET_VENDOR_SMSC is not set
+# CONFIG_NET_VENDOR_SOCIONEXT is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
 # CONFIG_NET_VENDOR_TEHUTI is not set
 # CONFIG_NET_VENDOR_TI is not set
 # CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
-CONFIG_NET_VENDOR_SYNOPSYS=y
-# CONFIG_DWC_XLGMAC is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
 # CONFIG_NET_SB1000 is not set
@@ -2066,6 +2090,7 @@ CONFIG_XEN_NETDEV_FRONTEND=y
 CONFIG_VMXNET3=y
 # CONFIG_FUJITSU_ES is not set
 CONFIG_HYPERV_NET=y
+# CONFIG_NETDEVSIM is not set
 # CONFIG_ISDN is not set
 # CONFIG_NVM is not set

@@ -2225,7 +2250,6 @@ CONFIG_HW_RANDOM_INTEL=y
 CONFIG_HW_RANDOM_AMD=y
 CONFIG_HW_RANDOM_VIA=y
 CONFIG_HW_RANDOM_VIRTIO=y
-CONFIG_HW_RANDOM_TPM=m
 CONFIG_NVRAM=y
 # CONFIG_R3964 is not set
 # CONFIG_APPLICOM is not set
@@ -2236,6 +2260,7 @@ CONFIG_HPET_MMAP=y
 CONFIG_HPET_MMAP_DEFAULT=y
 CONFIG_HANGCHECK_TIMER=y
 CONFIG_TCG_TPM=y
+CONFIG_HW_RANDOM_TPM=y
 CONFIG_TCG_TIS_CORE=y
 CONFIG_TCG_TIS=y
 CONFIG_TCG_TIS_I2C_ATMEL=m
@@ -2380,7 +2405,6 @@ CONFIG_POWER_SUPPLY=y
 # CONFIG_CHARGER_SMB347 is not set
 # CONFIG_BATTERY_GAUGE_LTC2941 is not set
 CONFIG_HWMON=y
-# CONFIG_HWMON_VID is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set

 #
@@ -2483,7 +2507,6 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
-# CONFIG_SENSORS_SCH56XX_COMMON is not set
 # CONFIG_SENSORS_STTS751 is not set
 # CONFIG_SENSORS_SMM665 is not set
 # CONFIG_SENSORS_ADC128D818 is not set
@@ -2504,6 +2527,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_VIA686A is not set
 # CONFIG_SENSORS_VT1211 is not set
 # CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83773G is not set
 # CONFIG_SENSORS_W83781D is not set
 # CONFIG_SENSORS_W83791D is not set
 # CONFIG_SENSORS_W83792D is not set
@@ -2546,10 +2570,6 @@ CONFIG_THERMAL_GOV_STEP_WISE=y
 # CONFIG_INTEL_PCH_THERMAL is not set
 # CONFIG_WATCHDOG is not set
 CONFIG_SSB_POSSIBLE=y
-
-#
-# Sonics Silicon Backplane
-#
 # CONFIG_SSB is not set
 CONFIG_BCMA_POSSIBLE=y
 # CONFIG_BCMA is not set
@@ -2597,9 +2617,7 @@ CONFIG_LPC_SCH=y
 # CONFIG_MFD_RETU is not set
 # CONFIG_MFD_PCF50633 is not set
 # CONFIG_MFD_RDC321X is not set
-# CONFIG_MFD_RTSX_PCI is not set
 # CONFIG_MFD_RT5033 is not set
-# CONFIG_MFD_RTSX_USB is not set
 # CONFIG_MFD_RC5T583 is not set
 # CONFIG_MFD_SEC_CORE is not set
 # CONFIG_MFD_SI476X_CORE is not set
@@ -2653,6 +2671,7 @@ CONFIG_MFD_VX855=y
 # AMD Library routines
 #
 # CONFIG_CHASH is not set
+CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
 # CONFIG_DRM_LIB_RANDOM is not set

 #
@@ -2787,6 +2806,7 @@ CONFIG_HID_GENERIC=y
 # CONFIG_HID_GYRATION is not set
 # CONFIG_HID_ICADE is not set
 # CONFIG_HID_ITE is not set
+# CONFIG_HID_JABRA is not set
 # CONFIG_HID_TWINHAN is not set
 # CONFIG_HID_KENSINGTON is not set
 # CONFIG_HID_LCPOWER is not set
@@ -2868,6 +2888,7 @@ CONFIG_USB_DEFAULT_PERSIST=y
 #
 # CONFIG_USB_C67X00_HCD is not set
 CONFIG_USB_XHCI_HCD=m
+# CONFIG_USB_XHCI_DBGCAP is not set
 CONFIG_USB_XHCI_PCI=m
 # CONFIG_USB_XHCI_PLATFORM is not set
 CONFIG_USB_EHCI_HCD=m
@@ -2902,7 +2923,22 @@ CONFIG_USB_UHCI_HCD=m
 #
 # also be needed; see USB_STORAGE Help for more info
 #
-# CONFIG_USB_STORAGE is not set
+CONFIG_USB_STORAGE=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set

 #
 # USB Imaging devices
@@ -3076,10 +3112,7 @@ CONFIG_UIO=m
 CONFIG_IRQ_BYPASS_MANAGER=m
 # CONFIG_VIRT_DRIVERS is not set
 CONFIG_VIRTIO=y
-
-#
-# Virtio drivers
-#
+CONFIG_VIRTIO_MENU=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_PCI_LEGACY=y
 CONFIG_VIRTIO_BALLOON=y
@@ -3122,12 +3155,14 @@ CONFIG_XEN_ACPI=y
 CONFIG_XEN_HAVE_VPMU=y
 # CONFIG_STAGING is not set
 CONFIG_X86_PLATFORM_DEVICES=y
+# CONFIG_ACER_WIRELESS is not set
 # CONFIG_ACERHDF is not set
-# CONFIG_DELL_SMBIOS_WMI is not set
+# CONFIG_DELL_SMBIOS is not set
 # CONFIG_DELL_WMI is not set
 # CONFIG_DELL_WMI_AIO is not set
 # CONFIG_DELL_SMO8800 is not set
 # CONFIG_FUJITSU_TABLET is not set
+# CONFIG_GPD_POCKET_FAN is not set
 # CONFIG_HP_ACCEL is not set
 # CONFIG_HP_WIRELESS is not set
 # CONFIG_HP_WMI is not set
@@ -3157,10 +3192,10 @@ CONFIG_MXM_WMI=y
 # CONFIG_SURFACE_PRO3_BUTTON is not set
 # CONFIG_INTEL_PUNIT_IPC is not set
 # CONFIG_MLX_PLATFORM is not set
-# CONFIG_MLX_CPLD_PLATFORM is not set
 # CONFIG_INTEL_TURBO_MAX_3 is not set
 CONFIG_PMC_ATOM=y
 # CONFIG_CHROME_PLATFORMS is not set
+# CONFIG_MELLANOX_PLATFORM is not set
 CONFIG_CLKDEV_LOOKUP=y
 CONFIG_HAVE_CLK_PREPARE=y
 CONFIG_COMMON_CLK=y
@@ -3202,6 +3237,7 @@ CONFIG_PCC=y
 #
 # CONFIG_RPMSG_QCOM_GLINK_RPM is not set
 # CONFIG_RPMSG_VIRTIO is not set
+# CONFIG_SOUNDWIRE is not set

 #
 # SOC (System On Chip) specific Drivers
@@ -3224,6 +3260,11 @@ CONFIG_PCC=y
 #
 # CONFIG_SUNXI_SRAM is not set
 # CONFIG_SOC_TI is not set
+
+#
+# Xilinx SoC drivers
+#
+# CONFIG_XILINX_VCU is not set
 CONFIG_PM_DEVFREQ=y

 #
@@ -3304,12 +3345,11 @@ CONFIG_NVMEM=y
 # CONFIG_STM is not set
 # CONFIG_INTEL_TH is not set
 # CONFIG_FPGA is not set
-
-#
-# FSI support
-#
 # CONFIG_FSI is not set
 CONFIG_PM_OPP=y
+# CONFIG_UNISYS_VISORBUS is not set
+# CONFIG_SIOX is not set
+# CONFIG_SLIMBUS is not set

 #
 # Firmware Drivers
@@ -3557,7 +3597,6 @@ CONFIG_CIFS_DEBUG=y
 CONFIG_CIFS_DFS_UPCALL=y
 # CONFIG_CIFS_SMB311 is not set
 CONFIG_CIFS_FSCACHE=y
-# CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
 # CONFIG_AFS_FS is not set
 CONFIG_9P_FS=y
@@ -3749,6 +3788,7 @@ CONFIG_RCU_CPU_STALL_TIMEOUT=60
 # CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set
 # CONFIG_NOTIFIER_ERROR_INJECTION is not set
 # CONFIG_FAULT_INJECTION is not set
+CONFIG_FUNCTION_ERROR_INJECTION=y
 # CONFIG_LATENCYTOP is not set
 CONFIG_USER_STACKTRACE_SUPPORT=y
 CONFIG_NOP_TRACER=y
@@ -3788,6 +3828,7 @@ CONFIG_PROBE_EVENTS=y
 CONFIG_DYNAMIC_FTRACE=y
 CONFIG_DYNAMIC_FTRACE_WITH_REGS=y
 CONFIG_FUNCTION_PROFILER=y
+# CONFIG_BPF_KPROBE_OVERRIDE is not set
 CONFIG_FTRACE_MCOUNT_RECORD=y
 # CONFIG_FTRACE_STARTUP_TEST is not set
 CONFIG_MMIOTRACE=y
@@ -3799,10 +3840,7 @@ CONFIG_MMIOTRACE=y
 # CONFIG_TRACE_EVAL_MAP_FILE is not set
 # CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set
 # CONFIG_DMA_API_DEBUG is not set
-
-#
-# Runtime Testing
-#
+CONFIG_RUNTIME_TESTING_MENU=y
 # CONFIG_LKDTM is not set
 # CONFIG_TEST_LIST_SORT is not set
 # CONFIG_TEST_SORT is not set
@@ -3823,7 +3861,7 @@ CONFIG_MMIOTRACE=y
 # CONFIG_TEST_LKM is not set
 # CONFIG_TEST_USER_COPY is not set
 # CONFIG_TEST_BPF is not set
-# CONFIG_TEST_FIND_BIT is not set
+# CONFIG_FIND_BIT_BENCHMARK is not set
 # CONFIG_TEST_FIRMWARE is not set
 # CONFIG_TEST_SYSCTL is not set
 # CONFIG_TEST_UDELAY is not set
@@ -3854,7 +3892,6 @@ CONFIG_EARLY_PRINTK=y
 # CONFIG_DEBUG_WX is not set
 CONFIG_DOUBLEFAULT=y
 # CONFIG_DEBUG_TLBFLUSH is not set
-# CONFIG_IOMMU_STRESS is not set
 CONFIG_HAVE_MMIOTRACE_SUPPORT=y
 # CONFIG_X86_DECODER_SELFTEST is not set
 CONFIG_IO_DELAY_TYPE_0X80=0
@@ -3897,6 +3934,7 @@ CONFIG_SECURITY_NETWORK_XFRM=y
 CONFIG_SECURITY_PATH=y
 CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y
 CONFIG_HARDENED_USERCOPY=y
+CONFIG_HARDENED_USERCOPY_FALLBACK=y
 # CONFIG_HARDENED_USERCOPY_PAGESPAN is not set
 CONFIG_FORTIFY_SOURCE=y
 CONFIG_STATIC_USERMODEHELPER=y
@@ -4213,7 +4251,8 @@ CONFIG_ASSOCIATIVE_ARRAY=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HAS_DMA=y
-# CONFIG_DMA_NOOP_OPS is not set
+CONFIG_SGL_ALLOC=y
+# CONFIG_DMA_DIRECT_OPS is not set
 # CONFIG_DMA_VIRT_OPS is not set
 CONFIG_CHECK_SIGNATURE=y
 CONFIG_CPU_RMAP=y
--- a/kernel/config-4.4.x-x86_64
+++ b/kernel/config-4.4.x-x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.4.126 Kernel Configuration
+# Linux/x86 4.4.131 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -36,7 +36,6 @@ CONFIG_AUDIT_ARCH=y
 CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
 CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y
 CONFIG_X86_64_SMP=y
-CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11"
 CONFIG_ARCH_SUPPORTS_UPROBES=y
 CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_PGTABLE_LEVELS=4
@@ -1124,7 +1123,14 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1232,7 +1238,8 @@ CONFIG_VSOCKETS=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_L3_MASTER_DEV=y
@@ -2619,7 +2626,22 @@ CONFIG_USB_UHCI_HCD=m
 #
 # also be needed; see USB_STORAGE Help for more info
 #
-# CONFIG_USB_STORAGE is not set
+CONFIG_USB_STORAGE=y
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set

 #
 # USB Imaging devices
--- a/kernel/config-4.9.x-x86_64
+++ b/kernel/config-4.9.x-x86_64
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 4.9.92 Kernel Configuration
+# Linux/x86 4.9.99 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -1189,7 +1189,15 @@ CONFIG_BRIDGE_EBT_SNAT=y
 CONFIG_BRIDGE_EBT_LOG=y
 CONFIG_BRIDGE_EBT_NFLOG=y
 # CONFIG_IP_DCCP is not set
-# CONFIG_IP_SCTP is not set
+CONFIG_IP_SCTP=m
+# CONFIG_NET_SCTPPROBE is not set
+# CONFIG_SCTP_DBG_OBJCNT is not set
+CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set
+# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set
+CONFIG_SCTP_COOKIE_HMAC_MD5=y
+# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set
+CONFIG_INET_SCTP_DIAG=m
 # CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
@@ -1304,7 +1312,8 @@ CONFIG_HYPERV_SOCK=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=m
-# CONFIG_MPLS_ROUTING is not set
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
 # CONFIG_HSR is not set
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_L3_MASTER_DEV=y
@@ -2743,7 +2752,22 @@ CONFIG_USB_UHCI_HCD=m
 #
 # also be needed; see USB_STORAGE Help for more info
 #
-# CONFIG_USB_STORAGE is not set
+CONFIG_USB_STORAGE=m
+# CONFIG_USB_STORAGE_DEBUG is not set
+# CONFIG_USB_STORAGE_REALTEK is not set
+# CONFIG_USB_STORAGE_DATAFAB is not set
+# CONFIG_USB_STORAGE_FREECOM is not set
+# CONFIG_USB_STORAGE_ISD200 is not set
+# CONFIG_USB_STORAGE_USBAT is not set
+# CONFIG_USB_STORAGE_SDDR09 is not set
+# CONFIG_USB_STORAGE_SDDR55 is not set
+# CONFIG_USB_STORAGE_JUMPSHOT is not set
+# CONFIG_USB_STORAGE_ALAUDA is not set
+# CONFIG_USB_STORAGE_ONETOUCH is not set
+# CONFIG_USB_STORAGE_KARMA is not set
+# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
+# CONFIG_USB_STORAGE_ENE_UB6250 is not set
+# CONFIG_USB_UAS is not set

 #
 # USB Imaging devices
--- a/kernel/patches-4.14.x-rt/0004-KVM-arm-arm64-Remove-redundant-preemptible-checks.patch
+++ b/kernel/patches-4.14.x-rt/0004-KVM-arm-arm64-Remove-redundant-preemptible-checks.patch
@@ -0,0 +1,38 @@
+From: Christoffer Dall <christoffer.dall@linaro.org>
+Date: Fri, 8 Sep 2017 07:07:13 -0700
+Subject: [PATCH] KVM: arm/arm64: Remove redundant preemptible checks
+
+Upstream commit 5a24575032971c5a9a4580417a791c427ebdb8e5
+
+The __this_cpu_read() and __this_cpu_write() functions already implement
+checks for the required preemption levels when using
+CONFIG_DEBUG_PREEMPT which gives you nice error messages and such.
+Therefore there is no need to explicitly check this using a BUG_ON() in
+the code (which we don't do for other uses of per cpu variables either).
+
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Reviewed-by: Andre Przywara <andre.przywara@arm.com>
+Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+---
+ virt/kvm/arm/arm.c |    2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
+@@ -69,7 +69,6 @@ static DEFINE_PER_CPU(unsigned char, kvm
+ 
+ static void kvm_arm_set_running_vcpu(struct kvm_vcpu *vcpu)
+ {
+-	BUG_ON(preemptible());
+ 	__this_cpu_write(kvm_arm_running_vcpu, vcpu);
+ }
+ 
+@@ -79,7 +78,6 @@ static void kvm_arm_set_running_vcpu(str
+  */
+ struct kvm_vcpu *kvm_arm_get_running_vcpu(void)
+ {
+-	BUG_ON(preemptible());
+ 	return __this_cpu_read(kvm_arm_running_vcpu);
+ }
+ 
--- a/kernel/patches-4.14.x-rt/0005-0001-iommu-amd-Use-raw-locks-on-atomic-context-paths.patch
+++ b/kernel/patches-4.14.x-rt/0005-0001-iommu-amd-Use-raw-locks-on-atomic-context-paths.patch
@@ -0,0 +1,170 @@
+From: Scott Wood <swood@redhat.com>
+Date: Sun, 21 Jan 2018 03:28:54 -0600
+Subject: [PATCH 1/3] iommu/amd: Use raw locks on atomic context paths
+
+Upstream commit 27790398c2aed917828dc3c6f81240d57f1584c9
+
+Several functions in this driver are called from atomic context,
+and thus raw locks must be used in order to be safe on PREEMPT_RT.
+
+This includes paths that must wait for command completion, which is
+a potential PREEMPT_RT latency concern but not easily avoidable.
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c       |   30 +++++++++++++++---------------
+ drivers/iommu/amd_iommu_init.c  |    2 +-
+ drivers/iommu/amd_iommu_types.h |    4 ++--
+ 3 files changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -1054,9 +1054,9 @@ static int iommu_queue_command_sync(stru
+ 	unsigned long flags;
+ 	int ret;
+ 
+-	spin_lock_irqsave(&iommu->lock, flags);
+	raw_spin_lock_irqsave(&iommu->lock, flags);
+ 	ret = __iommu_queue_command_sync(iommu, cmd, sync);
+-	spin_unlock_irqrestore(&iommu->lock, flags);
+	raw_spin_unlock_irqrestore(&iommu->lock, flags);
+ 
+ 	return ret;
+ }
+@@ -1082,7 +1082,7 @@ static int iommu_completion_wait(struct
+ 
+ 	build_completion_wait(&cmd, (u64)&iommu->cmd_sem);
+ 
+-	spin_lock_irqsave(&iommu->lock, flags);
+	raw_spin_lock_irqsave(&iommu->lock, flags);
+ 
+ 	iommu->cmd_sem = 0;
+ 
+@@ -1093,7 +1093,7 @@ static int iommu_completion_wait(struct
+ 	ret = wait_on_sem(&iommu->cmd_sem);
+ 
+ out_unlock:
+-	spin_unlock_irqrestore(&iommu->lock, flags);
+	raw_spin_unlock_irqrestore(&iommu->lock, flags);
+ 
+ 	return ret;
+ }
+@@ -3618,7 +3618,7 @@ static struct irq_remap_table *get_irq_t
+ 		goto out_unlock;
+ 
+ 	/* Initialize table spin-lock */
+-	spin_lock_init(&table->lock);
+	raw_spin_lock_init(&table->lock);
+ 
+ 	if (ioapic)
+ 		/* Keep the first 32 indexes free for IOAPIC interrupts */
+@@ -3677,7 +3677,7 @@ static int alloc_irq_index(u16 devid, in
+ 	if (!table)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&table->lock, flags);
+	raw_spin_lock_irqsave(&table->lock, flags);
+ 
+ 	/* Scan table for free entries */
+ 	for (c = 0, index = table->min_index;
+@@ -3700,7 +3700,7 @@ static int alloc_irq_index(u16 devid, in
+ 	index = -ENOSPC;
+ 
+ out:
+-	spin_unlock_irqrestore(&table->lock, flags);
+	raw_spin_unlock_irqrestore(&table->lock, flags);
+ 
+ 	return index;
+ }
+@@ -3721,7 +3721,7 @@ static int modify_irte_ga(u16 devid, int
+ 	if (!table)
+ 		return -ENOMEM;
+ 
+-	spin_lock_irqsave(&table->lock, flags);
+	raw_spin_lock_irqsave(&table->lock, flags);
+ 
+ 	entry = (struct irte_ga *)table->table;
+ 	entry = &entry[index];
+@@ -3732,7 +3732,7 @@ static int modify_irte_ga(u16 devid, int
+ 	if (data)
+ 		data->ref = entry;
+ 
+-	spin_unlock_irqrestore(&table->lock, flags);
+	raw_spin_unlock_irqrestore(&table->lock, flags);
+ 
+ 	iommu_flush_irt(iommu, devid);
+ 	iommu_completion_wait(iommu);
+@@ -3754,9 +3754,9 @@ static int modify_irte(u16 devid, int in
+ 	if (!table)
+ 		return -ENOMEM;
+ 
+-	spin_lock_irqsave(&table->lock, flags);
+	raw_spin_lock_irqsave(&table->lock, flags);
+ 	table->table[index] = irte->val;
+-	spin_unlock_irqrestore(&table->lock, flags);
+	raw_spin_unlock_irqrestore(&table->lock, flags);
+ 
+ 	iommu_flush_irt(iommu, devid);
+ 	iommu_completion_wait(iommu);
+@@ -3778,9 +3778,9 @@ static void free_irte(u16 devid, int ind
+ 	if (!table)
+ 		return;
+ 
+-	spin_lock_irqsave(&table->lock, flags);
+	raw_spin_lock_irqsave(&table->lock, flags);
+ 	iommu->irte_ops->clear_allocated(table, index);
+-	spin_unlock_irqrestore(&table->lock, flags);
+	raw_spin_unlock_irqrestore(&table->lock, flags);
+ 
+ 	iommu_flush_irt(iommu, devid);
+ 	iommu_completion_wait(iommu);
+@@ -4359,7 +4359,7 @@ int amd_iommu_update_ga(int cpu, bool is
+ 	if (!irt)
+ 		return -ENODEV;
+ 
+-	spin_lock_irqsave(&irt->lock, flags);
+	raw_spin_lock_irqsave(&irt->lock, flags);
+ 
+ 	if (ref->lo.fields_vapic.guest_mode) {
+ 		if (cpu >= 0)
+@@ -4368,7 +4368,7 @@ int amd_iommu_update_ga(int cpu, bool is
+ 		barrier();
+ 	}
+ 
+-	spin_unlock_irqrestore(&irt->lock, flags);
+	raw_spin_unlock_irqrestore(&irt->lock, flags);
+ 
+ 	iommu_flush_irt(iommu, devid);
+ 	iommu_completion_wait(iommu);
+--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
+@@ -1474,7 +1474,7 @@ static int __init init_iommu_one(struct
+ {
+ 	int ret;
+ 
+-	spin_lock_init(&iommu->lock);
+	raw_spin_lock_init(&iommu->lock);
+ 
+ 	/* Add IOMMU to internal data structures */
+ 	list_add_tail(&iommu->list, &amd_iommu_list);
+--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
+@@ -406,7 +406,7 @@ extern bool amd_iommu_iotlb_sup;
+ #define IRQ_TABLE_ALIGNMENT	128
+ 
+ struct irq_remap_table {
+-	spinlock_t lock;
+	raw_spinlock_t lock;
+ 	unsigned min_index;
+ 	u32 *table;
+ };
+@@ -488,7 +488,7 @@ struct amd_iommu {
+ 	int index;
+ 
+ 	/* locks the accesses to the hardware */
+-	spinlock_t lock;
+	raw_spinlock_t lock;
+ 
+ 	/* Pointer to PCI device of this IOMMU */
+ 	struct pci_dev *dev;
--- a/kernel/patches-4.14.x-rt/0006-0002-iommu-amd-Don-t-use-dev_data-in-irte_ga_set_affinity.patch
+++ b/kernel/patches-4.14.x-rt/0006-0002-iommu-amd-Don-t-use-dev_data-in-irte_ga_set_affinity.patch
@@ -0,0 +1,31 @@
+From: Scott Wood <swood@redhat.com>
+Date: Sun, 28 Jan 2018 14:22:19 -0600
+Subject: [PATCH 2/3] iommu/amd: Don't use dev_data in irte_ga_set_affinity()
+
+Upstream commit 01ee04badefd296eb7a4430497373be9b7b16783
+
+search_dev_data() acquires a non-raw lock, which can't be done
+from atomic context on PREEMPT_RT.  There is no need to look at
+dev_data because guest_mode should never be set if use_vapic is
+not set.
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -3861,10 +3861,8 @@ static void irte_ga_set_affinity(void *e
+ 				 u8 vector, u32 dest_apicid)
+ {
+ 	struct irte_ga *irte = (struct irte_ga *) entry;
+-	struct iommu_dev_data *dev_data = search_dev_data(devid);
+ 
+-	if (!dev_data || !dev_data->use_vapic ||
+-	    !irte->lo.fields_remap.guest_mode) {
+	if (!irte->lo.fields_remap.guest_mode) {
+ 		irte->hi.fields.vector = vector;
+ 		irte->lo.fields_remap.destination = dest_apicid;
+ 		modify_irte_ga(devid, index, irte, NULL);
--- a/kernel/patches-4.14.x-rt/0007-0003-iommu-amd-Avoid-locking-get_irq_table-from-atomic-co.patch
+++ b/kernel/patches-4.14.x-rt/0007-0003-iommu-amd-Avoid-locking-get_irq_table-from-atomic-co.patch
@@ -0,0 +1,116 @@
+From: Scott Wood <swood@redhat.com>
+Date: Wed, 14 Feb 2018 17:36:28 -0600
+Subject: [PATCH 3/3] iommu/amd: Avoid locking get_irq_table() from atomic
+ context
+
+Upstream commit df42a04b15f19a842393dc98a84cbc52b1f8ed49
+
+get_irq_table() previously acquired amd_iommu_devtable_lock which is not
+a raw lock, and thus cannot be acquired from atomic context on
+PREEMPT_RT.  Many calls to modify_irte*() come from atomic context due to
+the IRQ desc->lock, as does amd_iommu_update_ga() due to the preemption
+disabling in vcpu_load/put().
+
+The only difference between calling get_irq_table() and reading from
+irq_lookup_table[] directly, other than the lock acquisition and
+amd_iommu_rlookup_table[] check, is if the table entry is unpopulated,
+which should never happen when looking up a devid that came from an
+irq_2_irte struct, as get_irq_table() would have already been called on
+that devid during irq_remapping_alloc().
+
+The lock acquisition is not needed in these cases because entries in
+irq_lookup_table[] never change once non-NULL -- nor would the
+amd_iommu_devtable_lock usage in get_irq_table() provide meaningful
+protection if they did, since it's released before using the looked up
+table in the get_irq_table() caller.
+
+Rename the old get_irq_table() to alloc_irq_table(), and create a new
+lockless get_irq_table() to be used in non-allocating contexts that WARNs
+if it doesn't find what it's looking for.
+
+Signed-off-by: Scott Wood <swood@redhat.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   29 ++++++++++++++++++++++-------
+ 1 file changed, 22 insertions(+), 7 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -3586,7 +3586,22 @@ static void set_dte_irq_entry(u16 devid,
+ 	amd_iommu_dev_table[devid].data[2] = dte;
+ }
+ 
+-static struct irq_remap_table *get_irq_table(u16 devid, bool ioapic)
+static struct irq_remap_table *get_irq_table(u16 devid)
+{
+	struct irq_remap_table *table;
+
+	if (WARN_ONCE(!amd_iommu_rlookup_table[devid],
+		      "%s: no iommu for devid %x\n", __func__, devid))
+		return NULL;
+
+	table = irq_lookup_table[devid];
+	if (WARN_ONCE(!table, "%s: no table for devid %x\n", __func__, devid))
+		return NULL;
+
+	return table;
+}
+
+static struct irq_remap_table *alloc_irq_table(u16 devid, bool ioapic)
+ {
+ 	struct irq_remap_table *table = NULL;
+ 	struct amd_iommu *iommu;
+@@ -3673,7 +3688,7 @@ static int alloc_irq_index(u16 devid, in
+ 	if (!iommu)
+ 		return -ENODEV;
+ 
+-	table = get_irq_table(devid, false);
+	table = alloc_irq_table(devid, false);
+ 	if (!table)
+ 		return -ENODEV;
+ 
+@@ -3717,7 +3732,7 @@ static int modify_irte_ga(u16 devid, int
+ 	if (iommu == NULL)
+ 		return -EINVAL;
+ 
+-	table = get_irq_table(devid, false);
+	table = get_irq_table(devid);
+ 	if (!table)
+ 		return -ENOMEM;
+ 
+@@ -3750,7 +3765,7 @@ static int modify_irte(u16 devid, int in
+ 	if (iommu == NULL)
+ 		return -EINVAL;
+ 
+-	table = get_irq_table(devid, false);
+	table = get_irq_table(devid);
+ 	if (!table)
+ 		return -ENOMEM;
+ 
+@@ -3774,7 +3789,7 @@ static void free_irte(u16 devid, int ind
+ 	if (iommu == NULL)
+ 		return;
+ 
+-	table = get_irq_table(devid, false);
+	table = get_irq_table(devid);
+ 	if (!table)
+ 		return;
+ 
+@@ -4092,7 +4107,7 @@ static int irq_remapping_alloc(struct ir
+ 		return ret;
+ 
+ 	if (info->type == X86_IRQ_ALLOC_TYPE_IOAPIC) {
+-		if (get_irq_table(devid, true))
+		if (alloc_irq_table(devid, true))
+ 			index = info->ioapic_pin;
+ 		else
+ 			ret = -ENOMEM;
+@@ -4353,7 +4368,7 @@ int amd_iommu_update_ga(int cpu, bool is
+ 	if (!iommu)
+ 		return -ENODEV;
+ 
+-	irt = get_irq_table(devid, false);
+	irt = get_irq_table(devid);
+ 	if (!irt)
+ 		return -ENODEV;
+ 
--- a/kernel/patches-4.14.x-rt/0008-0001-iommu-amd-Take-into-account-that-alloc_dev_data-may-.patch
+++ b/kernel/patches-4.14.x-rt/0008-0001-iommu-amd-Take-into-account-that-alloc_dev_data-may-.patch
@@ -0,0 +1,32 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:33 +0100
+Subject: [PATCH 01/10] iommu/amd: Take into account that alloc_dev_data() may
+ return NULL
+
+Upstream commit 39ffe39545cd5cb5b8cee9f0469165cf24dc62c2
+
+find_dev_data() does not check whether the return value alloc_dev_data()
+is NULL. This was okay once because the pointer was returned once as-is.
+Since commit df3f7a6e8e85 ("iommu/amd: Use is_attach_deferred
+call-back") the pointer may be used within find_dev_data() so a NULL
+check is required.
+
+Cc: Baoquan He <bhe@redhat.com>
+Fixes: df3f7a6e8e85 ("iommu/amd: Use is_attach_deferred call-back")
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -311,6 +311,8 @@ static struct iommu_dev_data *find_dev_d
+ 
+ 	if (dev_data == NULL) {
+ 		dev_data = alloc_dev_data(devid);
+		if (!dev_data)
+			return NULL;
+ 
+ 		if (translation_pre_enabled(iommu))
+ 			dev_data->defer_attach = true;
--- a/kernel/patches-4.14.x-rt/0009-0002-iommu-amd-Turn-dev_data_list-into-a-lock-less-list.patch
+++ b/kernel/patches-4.14.x-rt/0009-0002-iommu-amd-Turn-dev_data_list-into-a-lock-less-list.patch
@@ -0,0 +1,97 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:34 +0100
+Subject: [PATCH 02/10] iommu/amd: Turn dev_data_list into a lock less list
+
+Upstream commit 779da73273fc4c4c6f41579a95e4fb7880a1720e
+
+alloc_dev_data() adds new items to dev_data_list and search_dev_data()
+is searching for items in this list. Both protect the access to the list
+with a spinlock.
+There is no need to navigate forth and back within the list and there is
+also no deleting of a specific item. This qualifies the list to become a
+lock less list and as part of this, the spinlock can be removed.
+With this change the ordering of those items within the list is changed:
+before the change new items were added to the end of the list, now they
+are added to the front. I don't think it matters but wanted to mention
+it.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c       |   28 ++++++++++------------------
+ drivers/iommu/amd_iommu_types.h |    2 +-
+ 2 files changed, 11 insertions(+), 19 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -84,8 +84,7 @@
+ static DEFINE_RWLOCK(amd_iommu_devtable_lock);
+ 
+ /* List of all available dev_data structures */
+-static LIST_HEAD(dev_data_list);
+-static DEFINE_SPINLOCK(dev_data_list_lock);
+static LLIST_HEAD(dev_data_list);
+ 
+ LIST_HEAD(ioapic_map);
+ LIST_HEAD(hpet_map);
+@@ -204,40 +203,33 @@ static struct dma_ops_domain* to_dma_ops
+ static struct iommu_dev_data *alloc_dev_data(u16 devid)
+ {
+ 	struct iommu_dev_data *dev_data;
+-	unsigned long flags;
+ 
+ 	dev_data = kzalloc(sizeof(*dev_data), GFP_KERNEL);
+ 	if (!dev_data)
+ 		return NULL;
+ 
+ 	dev_data->devid = devid;
+-
+-	spin_lock_irqsave(&dev_data_list_lock, flags);
+-	list_add_tail(&dev_data->dev_data_list, &dev_data_list);
+-	spin_unlock_irqrestore(&dev_data_list_lock, flags);
+-
+ 	ratelimit_default_init(&dev_data->rs);
+ 
+	llist_add(&dev_data->dev_data_list, &dev_data_list);
+ 	return dev_data;
+ }
+ 
+ static struct iommu_dev_data *search_dev_data(u16 devid)
+ {
+ 	struct iommu_dev_data *dev_data;
+-	unsigned long flags;
+	struct llist_node *node;
+
+	if (llist_empty(&dev_data_list))
+		return NULL;
+ 
+-	spin_lock_irqsave(&dev_data_list_lock, flags);
+-	list_for_each_entry(dev_data, &dev_data_list, dev_data_list) {
+	node = dev_data_list.first;
+	llist_for_each_entry(dev_data, node, dev_data_list) {
+ 		if (dev_data->devid == devid)
+-			goto out_unlock;
+			return dev_data;
+ 	}
+ 
+-	dev_data = NULL;
+-
+-out_unlock:
+-	spin_unlock_irqrestore(&dev_data_list_lock, flags);
+-
+-	return dev_data;
+	return NULL;
+ }
+ 
+ static int __last_alias(struct pci_dev *pdev, u16 alias, void *data)
+--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
+@@ -625,7 +625,7 @@ struct devid_map {
+  */
+ struct iommu_dev_data {
+ 	struct list_head list;		  /* For domain->dev_list */
+-	struct list_head dev_data_list;	  /* For global dev_data_list */
+	struct llist_node dev_data_list;  /* For global dev_data_list */
+ 	struct protection_domain *domain; /* Domain the device is bound to */
+ 	u16 devid;			  /* PCI Device ID */
+ 	u16 alias;			  /* Alias Device ID */
--- a/kernel/patches-4.14.x-rt/0010-0003-iommu-amd-Split-domain-id-out-of-amd_iommu_devtable_.patch
+++ b/kernel/patches-4.14.x-rt/0010-0003-iommu-amd-Split-domain-id-out-of-amd_iommu_devtable_.patch
@@ -0,0 +1,62 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:35 +0100
+Subject: [PATCH 03/10] iommu/amd: Split domain id out of
+ amd_iommu_devtable_lock
+
+Upstream commit 2bc00180890427dcc092b2f2b0d03c904bcade29
+
+domain_id_alloc() and domain_id_free() is used for id management. Those
+two function share a bitmap (amd_iommu_pd_alloc_bitmap) and set/clear
+bits based on id allocation. There is no need to share this with
+amd_iommu_devtable_lock, it can use its own lock for this operation.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   12 +++++-------
+ 1 file changed, 5 insertions(+), 7 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -82,6 +82,7 @@
+ #define AMD_IOMMU_PGSIZES	((~0xFFFUL) & ~(2ULL << 38))
+ 
+ static DEFINE_RWLOCK(amd_iommu_devtable_lock);
+static DEFINE_SPINLOCK(pd_bitmap_lock);
+ 
+ /* List of all available dev_data structures */
+ static LLIST_HEAD(dev_data_list);
+@@ -1596,29 +1597,26 @@ static void del_domain_from_list(struct
+ 
+ static u16 domain_id_alloc(void)
+ {
+-	unsigned long flags;
+ 	int id;
+ 
+-	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+	spin_lock(&pd_bitmap_lock);
+ 	id = find_first_zero_bit(amd_iommu_pd_alloc_bitmap, MAX_DOMAIN_ID);
+ 	BUG_ON(id == 0);
+ 	if (id > 0 && id < MAX_DOMAIN_ID)
+ 		__set_bit(id, amd_iommu_pd_alloc_bitmap);
+ 	else
+ 		id = 0;
+-	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+	spin_unlock(&pd_bitmap_lock);
+ 
+ 	return id;
+ }
+ 
+ static void domain_id_free(int id)
+ {
+-	unsigned long flags;
+-
+-	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+	spin_lock(&pd_bitmap_lock);
+ 	if (id > 0 && id < MAX_DOMAIN_ID)
+ 		__clear_bit(id, amd_iommu_pd_alloc_bitmap);
+-	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+	spin_unlock(&pd_bitmap_lock);
+ }
+ 
+ #define DEFINE_FREE_PT_FN(LVL, FN)				\
--- a/kernel/patches-4.14.x-rt/0011-0004-iommu-amd-Split-irq_lookup_table-out-of-the-amd_iomm.patch
+++ b/kernel/patches-4.14.x-rt/0011-0004-iommu-amd-Split-irq_lookup_table-out-of-the-amd_iomm.patch
@@ -0,0 +1,50 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:36 +0100
+Subject: [PATCH 04/10] iommu/amd: Split irq_lookup_table out of the
+ amd_iommu_devtable_lock
+
+Upstream commit ea6166f4b83e9cfba1c18f46a764d50045682fe5
+
+The function get_irq_table() reads/writes irq_lookup_table while holding
+the amd_iommu_devtable_lock. It also modifies
+amd_iommu_dev_table[].data[2].
+set_dte_entry() is using amd_iommu_dev_table[].data[0|1] (under the
+domain->lock) so it should be okay. The access to the iommu is
+serialized with its own (iommu's) lock.
+
+So split out get_irq_table() out of amd_iommu_devtable_lock's lock.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -83,6 +83,7 @@
+ 
+ static DEFINE_RWLOCK(amd_iommu_devtable_lock);
+ static DEFINE_SPINLOCK(pd_bitmap_lock);
+static DEFINE_SPINLOCK(iommu_table_lock);
+ 
+ /* List of all available dev_data structures */
+ static LLIST_HEAD(dev_data_list);
+@@ -3600,7 +3601,7 @@ static struct irq_remap_table *alloc_irq
+ 	unsigned long flags;
+ 	u16 alias;
+ 
+-	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+	spin_lock_irqsave(&iommu_table_lock, flags);
+ 
+ 	iommu = amd_iommu_rlookup_table[devid];
+ 	if (!iommu)
+@@ -3665,7 +3666,7 @@ static struct irq_remap_table *alloc_irq
+ 	iommu_completion_wait(iommu);
+ 
+ out_unlock:
+-	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+	spin_unlock_irqrestore(&iommu_table_lock, flags);
+ 
+ 	return table;
+ }
--- a/kernel/patches-4.14.x-rt/0012-0005-iommu-amd-Remove-the-special-case-from-alloc_irq_tab.patch
+++ b/kernel/patches-4.14.x-rt/0012-0005-iommu-amd-Remove-the-special-case-from-alloc_irq_tab.patch
@@ -0,0 +1,94 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:37 +0100
+Subject: [PATCH 05/10] iommu/amd: Remove the special case from
+ alloc_irq_table()
+
+Upstream commit fde65dd3d3096e8f6ecc7bbe544eb91f4220772c
+
+alloc_irq_table() has a special ioapic argument. If set then it will
+pre-allocate / reserve the first 32 indexes. The argument is only once
+true and it would make alloc_irq_table() a little simpler if we would
+extract the special bits to the caller.
+The caller of irq_remapping_alloc() is holding irq_domain_mutex so the
+initialization of iommu->irte_ops->set_allocated() should not race
+against other user.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   34 ++++++++++++++++++++--------------
+ 1 file changed, 20 insertions(+), 14 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -3594,7 +3594,7 @@ static struct irq_remap_table *get_irq_t
+ 	return table;
+ }
+ 
+-static struct irq_remap_table *alloc_irq_table(u16 devid, bool ioapic)
+static struct irq_remap_table *alloc_irq_table(u16 devid)
+ {
+ 	struct irq_remap_table *table = NULL;
+ 	struct amd_iommu *iommu;
+@@ -3628,10 +3628,6 @@ static struct irq_remap_table *alloc_irq
+ 	/* Initialize table spin-lock */
+ 	raw_spin_lock_init(&table->lock);
+ 
+-	if (ioapic)
+-		/* Keep the first 32 indexes free for IOAPIC interrupts */
+-		table->min_index = 32;
+-
+ 	table->table = kmem_cache_alloc(amd_iommu_irq_cache, GFP_ATOMIC);
+ 	if (!table->table) {
+ 		kfree(table);
+@@ -3646,12 +3642,6 @@ static struct irq_remap_table *alloc_irq
+ 		memset(table->table, 0,
+ 		       (MAX_IRQS_PER_TABLE * (sizeof(u64) * 2)));
+ 
+-	if (ioapic) {
+-		int i;
+-
+-		for (i = 0; i < 32; ++i)
+-			iommu->irte_ops->set_allocated(table, i);
+-	}
+ 
+ 	irq_lookup_table[devid] = table;
+ 	set_dte_irq_entry(devid, table);
+@@ -3681,7 +3671,7 @@ static int alloc_irq_index(u16 devid, in
+ 	if (!iommu)
+ 		return -ENODEV;
+ 
+-	table = alloc_irq_table(devid, false);
+	table = alloc_irq_table(devid);
+ 	if (!table)
+ 		return -ENODEV;
+ 
+@@ -4100,10 +4090,26 @@ static int irq_remapping_alloc(struct ir
+ 		return ret;
+ 
+ 	if (info->type == X86_IRQ_ALLOC_TYPE_IOAPIC) {
+-		if (alloc_irq_table(devid, true))
+		struct irq_remap_table *table;
+		struct amd_iommu *iommu;
+
+		table = alloc_irq_table(devid);
+		if (table) {
+			if (!table->min_index) {
+				/*
+				 * Keep the first 32 indexes free for IOAPIC
+				 * interrupts.
+				 */
+				table->min_index = 32;
+				iommu = amd_iommu_rlookup_table[devid];
+				for (i = 0; i < 32; ++i)
+					iommu->irte_ops->set_allocated(table, i);
+			}
+			WARN_ON(table->min_index != 32);
+ 			index = info->ioapic_pin;
+-		else
+		} else {
+ 			ret = -ENOMEM;
+		}
+ 	} else {
+ 		index = alloc_irq_index(devid, nr_irqs);
+ 	}
--- a/kernel/patches-4.14.x-rt/0013-0006-iommu-amd-Use-table-instead-irt-as-variable-name-in-.patch
+++ b/kernel/patches-4.14.x-rt/0013-0006-iommu-amd-Use-table-instead-irt-as-variable-name-in-.patch
@@ -0,0 +1,52 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:38 +0100
+Subject: [PATCH 06/10] iommu/amd: Use `table' instead `irt' as variable name
+ in amd_iommu_update_ga()
+
+Upstream commit 4fde541c9dc114c5b448ad34b0286fe8b7c550f1
+
+The variable of type struct irq_remap_table is always named `table'
+except in amd_iommu_update_ga() where it is called `irt'. Make it
+consistent and name it also `table'.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -4353,7 +4353,7 @@ int amd_iommu_update_ga(int cpu, bool is
+ {
+ 	unsigned long flags;
+ 	struct amd_iommu *iommu;
+-	struct irq_remap_table *irt;
+	struct irq_remap_table *table;
+ 	struct amd_ir_data *ir_data = (struct amd_ir_data *)data;
+ 	int devid = ir_data->irq_2_irte.devid;
+ 	struct irte_ga *entry = (struct irte_ga *) ir_data->entry;
+@@ -4367,11 +4367,11 @@ int amd_iommu_update_ga(int cpu, bool is
+ 	if (!iommu)
+ 		return -ENODEV;
+ 
+-	irt = get_irq_table(devid);
+-	if (!irt)
+	table = get_irq_table(devid);
+	if (!table)
+ 		return -ENODEV;
+ 
+-	raw_spin_lock_irqsave(&irt->lock, flags);
+	raw_spin_lock_irqsave(&table->lock, flags);
+ 
+ 	if (ref->lo.fields_vapic.guest_mode) {
+ 		if (cpu >= 0)
+@@ -4380,7 +4380,7 @@ int amd_iommu_update_ga(int cpu, bool is
+ 		barrier();
+ 	}
+ 
+-	raw_spin_unlock_irqrestore(&irt->lock, flags);
+	raw_spin_unlock_irqrestore(&table->lock, flags);
+ 
+ 	iommu_flush_irt(iommu, devid);
+ 	iommu_completion_wait(iommu);
--- a/kernel/patches-4.14.x-rt/0014-0007-iommu-amd-Factor-out-setting-the-remap-table-for-a-d.patch
+++ b/kernel/patches-4.14.x-rt/0014-0007-iommu-amd-Factor-out-setting-the-remap-table-for-a-d.patch
@@ -0,0 +1,66 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:39 +0100
+Subject: [PATCH 07/10] iommu/amd: Factor out setting the remap table for a
+ devid
+
+Upstream commit 2fcc1e8ac4a8514c64f946178fc36c2e30e56a41
+
+Setting the IRQ remap table for a specific devid (or its alias devid)
+includes three steps. Those three steps are always repeated each time
+this is done.
+Introduce a new helper function, move those steps there and use that
+function instead. The compiler can still decide if it is worth to
+inline.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -3594,6 +3594,14 @@ static struct irq_remap_table *get_irq_t
+ 	return table;
+ }
+ 
+static void set_remap_table_entry(struct amd_iommu *iommu, u16 devid,
+				  struct irq_remap_table *table)
+{
+	irq_lookup_table[devid] = table;
+	set_dte_irq_entry(devid, table);
+	iommu_flush_dte(iommu, devid);
+}
+
+ static struct irq_remap_table *alloc_irq_table(u16 devid)
+ {
+ 	struct irq_remap_table *table = NULL;
+@@ -3614,9 +3622,7 @@ static struct irq_remap_table *alloc_irq
+ 	alias = amd_iommu_alias_table[devid];
+ 	table = irq_lookup_table[alias];
+ 	if (table) {
+-		irq_lookup_table[devid] = table;
+-		set_dte_irq_entry(devid, table);
+-		iommu_flush_dte(iommu, devid);
+		set_remap_table_entry(iommu, devid, table);
+ 		goto out;
+ 	}
+ 
+@@ -3643,14 +3649,9 @@ static struct irq_remap_table *alloc_irq
+ 		       (MAX_IRQS_PER_TABLE * (sizeof(u64) * 2)));
+ 
+ 
+-	irq_lookup_table[devid] = table;
+-	set_dte_irq_entry(devid, table);
+-	iommu_flush_dte(iommu, devid);
+-	if (devid != alias) {
+-		irq_lookup_table[alias] = table;
+-		set_dte_irq_entry(alias, table);
+-		iommu_flush_dte(iommu, alias);
+-	}
+	set_remap_table_entry(iommu, devid, table);
+	if (devid != alias)
+		set_remap_table_entry(iommu, alias, table);
+ 
+ out:
+ 	iommu_completion_wait(iommu);
--- a/kernel/patches-4.14.x-rt/0015-0008-iommu-amd-Drop-the-lock-while-allocating-new-irq-rem.patch
+++ b/kernel/patches-4.14.x-rt/0015-0008-iommu-amd-Drop-the-lock-while-allocating-new-irq-rem.patch
@@ -0,0 +1,131 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:40 +0100
+Subject: [PATCH 08/10] iommu/amd: Drop the lock while allocating new irq remap
+ table
+
+Upstream commit 993ca6e063a69a0c65ca42ed449b6bc1b3844151
+
+The irq_remap_table is allocated while the iommu_table_lock is held with
+interrupts disabled.
+>From looking at the call sites, all callers are in the early device
+initialisation (apic_bsp_setup(), pci_enable_device(),
+pci_enable_msi()) so make sense to drop the lock which also enables
+interrupts and try to allocate that memory with GFP_KERNEL instead
+GFP_ATOMIC.
+
+Since during the allocation the iommu_table_lock is dropped, we need to
+recheck if table exists after the lock has been reacquired. I *think*
+that it is impossible that the "devid" entry appears in irq_lookup_table
+while the lock is dropped since the same device can only be probed once.
+However I check for both cases, just to be sure.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   63 ++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 45 insertions(+), 18 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -3594,6 +3594,30 @@ static struct irq_remap_table *get_irq_t
+ 	return table;
+ }
+ 
+static struct irq_remap_table *__alloc_irq_table(void)
+{
+	struct irq_remap_table *table;
+
+	table = kzalloc(sizeof(*table), GFP_KERNEL);
+	if (!table)
+		return NULL;
+
+	table->table = kmem_cache_alloc(amd_iommu_irq_cache, GFP_KERNEL);
+	if (!table->table) {
+		kfree(table);
+		return NULL;
+	}
+	raw_spin_lock_init(&table->lock);
+
+	if (!AMD_IOMMU_GUEST_IR_GA(amd_iommu_guest_ir))
+		memset(table->table, 0,
+		       MAX_IRQS_PER_TABLE * sizeof(u32));
+	else
+		memset(table->table, 0,
+		       (MAX_IRQS_PER_TABLE * (sizeof(u64) * 2)));
+	return table;
+}
+
+ static void set_remap_table_entry(struct amd_iommu *iommu, u16 devid,
+ 				  struct irq_remap_table *table)
+ {
+@@ -3605,6 +3629,7 @@ static void set_remap_table_entry(struct
+ static struct irq_remap_table *alloc_irq_table(u16 devid)
+ {
+ 	struct irq_remap_table *table = NULL;
+	struct irq_remap_table *new_table = NULL;
+ 	struct amd_iommu *iommu;
+ 	unsigned long flags;
+ 	u16 alias;
+@@ -3623,42 +3648,44 @@ static struct irq_remap_table *alloc_irq
+ 	table = irq_lookup_table[alias];
+ 	if (table) {
+ 		set_remap_table_entry(iommu, devid, table);
+-		goto out;
+		goto out_wait;
+ 	}
+	spin_unlock_irqrestore(&iommu_table_lock, flags);
+ 
+ 	/* Nothing there yet, allocate new irq remapping table */
+-	table = kzalloc(sizeof(*table), GFP_ATOMIC);
+-	if (!table)
+-		goto out_unlock;
+	new_table = __alloc_irq_table();
+	if (!new_table)
+		return NULL;
+ 
+-	/* Initialize table spin-lock */
+-	raw_spin_lock_init(&table->lock);
+	spin_lock_irqsave(&iommu_table_lock, flags);
+ 
+-	table->table = kmem_cache_alloc(amd_iommu_irq_cache, GFP_ATOMIC);
+-	if (!table->table) {
+-		kfree(table);
+-		table = NULL;
+	table = irq_lookup_table[devid];
+	if (table)
+ 		goto out_unlock;
+-	}
+ 
+-	if (!AMD_IOMMU_GUEST_IR_GA(amd_iommu_guest_ir))
+-		memset(table->table, 0,
+-		       MAX_IRQS_PER_TABLE * sizeof(u32));
+-	else
+-		memset(table->table, 0,
+-		       (MAX_IRQS_PER_TABLE * (sizeof(u64) * 2)));
+	table = irq_lookup_table[alias];
+	if (table) {
+		set_remap_table_entry(iommu, devid, table);
+		goto out_wait;
+	}
+ 
+	table = new_table;
+	new_table = NULL;
+ 
+ 	set_remap_table_entry(iommu, devid, table);
+ 	if (devid != alias)
+ 		set_remap_table_entry(iommu, alias, table);
+ 
+-out:
+out_wait:
+ 	iommu_completion_wait(iommu);
+ 
+ out_unlock:
+ 	spin_unlock_irqrestore(&iommu_table_lock, flags);
+ 
+	if (new_table) {
+		kmem_cache_free(amd_iommu_irq_cache, new_table->table);
+		kfree(new_table);
+	}
+ 	return table;
+ }
+ 
--- a/kernel/patches-4.14.x-rt/0016-0009-iommu-amd-Make-amd_iommu_devtable_lock-a-spin_lock.patch
+++ b/kernel/patches-4.14.x-rt/0016-0009-iommu-amd-Make-amd_iommu_devtable_lock-a-spin_lock.patch
@@ -0,0 +1,73 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:41 +0100
+Subject: [PATCH 09/10] iommu/amd: Make amd_iommu_devtable_lock a spin_lock
+
+Upstream commit 2cd1083d79a0a8c223af430ca97884c28a1e2fc0
+
+Before commit 0bb6e243d7fb ("iommu/amd: Support IOMMU_DOMAIN_DMA type
+allocation") amd_iommu_devtable_lock had a read_lock() user but now
+there are none. In fact, after the mentioned commit we had only
+write_lock() user of the lock. Since there is no reason to keep it as
+writer lock, change its type to a spin_lock.
+I *think* that we might even be able to remove the lock because all its
+current user seem to have their own protection.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |   14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -81,7 +81,7 @@
+  */
+ #define AMD_IOMMU_PGSIZES	((~0xFFFUL) & ~(2ULL << 38))
+ 
+-static DEFINE_RWLOCK(amd_iommu_devtable_lock);
+static DEFINE_SPINLOCK(amd_iommu_devtable_lock);
+ static DEFINE_SPINLOCK(pd_bitmap_lock);
+ static DEFINE_SPINLOCK(iommu_table_lock);
+ 
+@@ -2086,9 +2086,9 @@ static int attach_device(struct device *
+ 	}
+ 
+ skip_ats_check:
+-	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+	spin_lock_irqsave(&amd_iommu_devtable_lock, flags);
+ 	ret = __attach_device(dev_data, domain);
+-	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+	spin_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+ 
+ 	/*
+ 	 * We might boot into a crash-kernel here. The crashed kernel
+@@ -2138,9 +2138,9 @@ static void detach_device(struct device
+ 	domain   = dev_data->domain;
+ 
+ 	/* lock device table */
+-	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+	spin_lock_irqsave(&amd_iommu_devtable_lock, flags);
+ 	__detach_device(dev_data);
+-	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+	spin_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+ 
+ 	if (!dev_is_pci(dev))
+ 		return;
+@@ -2804,7 +2804,7 @@ static void cleanup_domain(struct protec
+ 	struct iommu_dev_data *entry;
+ 	unsigned long flags;
+ 
+-	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+	spin_lock_irqsave(&amd_iommu_devtable_lock, flags);
+ 
+ 	while (!list_empty(&domain->dev_list)) {
+ 		entry = list_first_entry(&domain->dev_list,
+@@ -2812,7 +2812,7 @@ static void cleanup_domain(struct protec
+ 		__detach_device(entry);
+ 	}
+ 
+-	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+	spin_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+ }
+ 
+ static void protection_domain_free(struct protection_domain *domain)
--- a/kernel/patches-4.14.x-rt/0017-0010-iommu-amd-Return-proper-error-code-in-irq_remapping_.patch
+++ b/kernel/patches-4.14.x-rt/0017-0010-iommu-amd-Return-proper-error-code-in-irq_remapping_.patch
@@ -0,0 +1,40 @@
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Thu, 22 Mar 2018 16:22:42 +0100
+Subject: [PATCH 10/10] iommu/amd: Return proper error code in
+ irq_remapping_alloc()
+
+Upstream commit 29d049be9438278c47253a74cf8d0ddf36bd5d68
+
+In the unlikely case when alloc_irq_table() is not able to return a
+remap table then "ret" will be assigned with an error code. Later, the
+code checks `index' and if it is negative (which it is because it is
+initialized with `-1') and then then function properly aborts but
+returns `-1' instead `-ENOMEM' what was intended.
+In order to correct this, I assign -ENOMEM to index.
+
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
+@@ -4094,7 +4094,7 @@ static int irq_remapping_alloc(struct ir
+ 	struct amd_ir_data *data = NULL;
+ 	struct irq_cfg *cfg;
+ 	int i, ret, devid;
+-	int index = -1;
+	int index;
+ 
+ 	if (!info)
+ 		return -EINVAL;
+@@ -4136,7 +4136,7 @@ static int irq_remapping_alloc(struct ir
+ 			WARN_ON(table->min_index != 32);
+ 			index = info->ioapic_pin;
+ 		} else {
+-			ret = -ENOMEM;
+			index = -ENOMEM;
+ 		}
+ 	} else {
+ 		index = alloc_irq_index(devid, nr_irqs);
--- a/kernel/patches-4.14.x-rt/0018-0001-timers-Use-static-keys-for-migrate_enable-nohz_activ.patch
+++ b/kernel/patches-4.14.x-rt/0018-0001-timers-Use-static-keys-for-migrate_enable-nohz_activ.patch
--- a/kernel/patches-4.14.x-rt/0019-0002-hrtimer-Correct-blantanly-wrong-comment.patch
+++ b/kernel/patches-4.14.x-rt/0019-0002-hrtimer-Correct-blantanly-wrong-comment.patch
--- a/kernel/patches-4.14.x-rt/0020-0003-hrtimer-Fix-kerneldoc-for-struct-hrtimer_cpu_base.patch
+++ b/kernel/patches-4.14.x-rt/0020-0003-hrtimer-Fix-kerneldoc-for-struct-hrtimer_cpu_base.patch
--- a/kernel/patches-4.14.x-rt/0021-0004-hrtimer-Cleanup-clock-argument-in-schedule_hrtimeout.patch
+++ b/kernel/patches-4.14.x-rt/0021-0004-hrtimer-Cleanup-clock-argument-in-schedule_hrtimeout.patch
--- a/kernel/patches-4.14.x-rt/0022-0005-hrtimer-Fix-hrtimer-function-description.patch
+++ b/kernel/patches-4.14.x-rt/0022-0005-hrtimer-Fix-hrtimer-function-description.patch
--- a/kernel/patches-4.14.x-rt/0023-0007-hrtimer-Cleanup-hrtimer_mode-enum.patch
+++ b/kernel/patches-4.14.x-rt/0023-0007-hrtimer-Cleanup-hrtimer_mode-enum.patch
--- a/kernel/patches-4.14.x-rt/0024-0008-tracing-hrtimer-Take-all-clock-bases-and-modes-into-.patch
+++ b/kernel/patches-4.14.x-rt/0024-0008-tracing-hrtimer-Take-all-clock-bases-and-modes-into-.patch
--- a/kernel/patches-4.14.x-rt/0025-0009-tracing-hrtimer-Print-hrtimer-mode-in-hrtimer_start-.patch
+++ b/kernel/patches-4.14.x-rt/0025-0009-tracing-hrtimer-Print-hrtimer-mode-in-hrtimer_start-.patch
--- a/kernel/patches-4.14.x-rt/0026-0010-hrtimer-Switch-for-loop-to-_ffs-evaluation.patch
+++ b/kernel/patches-4.14.x-rt/0026-0010-hrtimer-Switch-for-loop-to-_ffs-evaluation.patch
--- a/kernel/patches-4.14.x-rt/0027-0011-hrtimer-Store-running-timer-in-hrtimer_clock_base.patch
+++ b/kernel/patches-4.14.x-rt/0027-0011-hrtimer-Store-running-timer-in-hrtimer_clock_base.patch
--- a/kernel/patches-4.14.x-rt/0028-0012-hrtimer-Make-room-in-struct-hrtimer_cpu_base.patch
+++ b/kernel/patches-4.14.x-rt/0028-0012-hrtimer-Make-room-in-struct-hrtimer_cpu_base.patch
--- a/kernel/patches-4.14.x-rt/0029-0013-hrtimer-Reduce-conditional-code-hres_active.patch
+++ b/kernel/patches-4.14.x-rt/0029-0013-hrtimer-Reduce-conditional-code-hres_active.patch
--- a/kernel/patches-4.14.x-rt/0030-0014-hrtimer-Use-accesor-functions-instead-of-direct-acce.patch
+++ b/kernel/patches-4.14.x-rt/0030-0014-hrtimer-Use-accesor-functions-instead-of-direct-acce.patch
--- a/kernel/patches-4.14.x-rt/0031-0015-hrtimer-Make-the-remote-enqueue-check-unconditional.patch
+++ b/kernel/patches-4.14.x-rt/0031-0015-hrtimer-Make-the-remote-enqueue-check-unconditional.patch
--- a/kernel/patches-4.14.x-rt/0032-0016-hrtimer-Make-hrtimer_cpu_base.next_timer-handling-un.patch
+++ b/kernel/patches-4.14.x-rt/0032-0016-hrtimer-Make-hrtimer_cpu_base.next_timer-handling-un.patch
--- a/kernel/patches-4.14.x-rt/0033-0017-hrtimer-Make-hrtimer_reprogramm-unconditional.patch
+++ b/kernel/patches-4.14.x-rt/0033-0017-hrtimer-Make-hrtimer_reprogramm-unconditional.patch
--- a/kernel/patches-4.14.x-rt/0034-0018-hrtimer-Make-hrtimer_force_reprogramm-unconditionall.patch
+++ b/kernel/patches-4.14.x-rt/0034-0018-hrtimer-Make-hrtimer_force_reprogramm-unconditionall.patch
--- a/kernel/patches-4.14.x-rt/0035-0019-hrtimer-Unify-handling-of-hrtimer-remove.patch
+++ b/kernel/patches-4.14.x-rt/0035-0019-hrtimer-Unify-handling-of-hrtimer-remove.patch
--- a/kernel/patches-4.14.x-rt/0036-0020-hrtimer-Unify-handling-of-remote-enqueue.patch
+++ b/kernel/patches-4.14.x-rt/0036-0020-hrtimer-Unify-handling-of-remote-enqueue.patch
--- a/kernel/patches-4.14.x-rt/0037-0021-hrtimer-Make-remote-enqueue-decision-less-restrictiv.patch
+++ b/kernel/patches-4.14.x-rt/0037-0021-hrtimer-Make-remote-enqueue-decision-less-restrictiv.patch
--- a/kernel/patches-4.14.x-rt/0038-0022-hrtimer-Remove-base-argument-from-hrtimer_reprogram.patch
+++ b/kernel/patches-4.14.x-rt/0038-0022-hrtimer-Remove-base-argument-from-hrtimer_reprogram.patch
--- a/kernel/patches-4.14.x-rt/0039-0023-hrtimer-Split-hrtimer_start_range_ns.patch
+++ b/kernel/patches-4.14.x-rt/0039-0023-hrtimer-Split-hrtimer_start_range_ns.patch
--- a/kernel/patches-4.14.x-rt/0040-0024-hrtimer-Split-__hrtimer_get_next_event.patch
+++ b/kernel/patches-4.14.x-rt/0040-0024-hrtimer-Split-__hrtimer_get_next_event.patch
--- a/kernel/patches-4.14.x-rt/0041-0025-hrtimer-Use-irqsave-irqrestore-around-__run_hrtimer.patch
+++ b/kernel/patches-4.14.x-rt/0041-0025-hrtimer-Use-irqsave-irqrestore-around-__run_hrtimer.patch
--- a/kernel/patches-4.14.x-rt/0042-0026-hrtimer-Add-clock-bases-and-hrtimer-mode-for-soft-ir.patch
+++ b/kernel/patches-4.14.x-rt/0042-0026-hrtimer-Add-clock-bases-and-hrtimer-mode-for-soft-ir.patch
--- a/kernel/patches-4.14.x-rt/0043-0027-hrtimer-Prepare-handling-of-hard-and-softirq-based-h.patch
+++ b/kernel/patches-4.14.x-rt/0043-0027-hrtimer-Prepare-handling-of-hard-and-softirq-based-h.patch
--- a/kernel/patches-4.14.x-rt/0044-0028-hrtimer-Implement-support-for-softirq-based-hrtimers.patch
+++ b/kernel/patches-4.14.x-rt/0044-0028-hrtimer-Implement-support-for-softirq-based-hrtimers.patch
--- a/kernel/patches-4.14.x-rt/0045-0029-hrtimer-Implement-SOFT-HARD-clock-base-selection.patch
+++ b/kernel/patches-4.14.x-rt/0045-0029-hrtimer-Implement-SOFT-HARD-clock-base-selection.patch
--- a/kernel/patches-4.14.x-rt/0046-0030-can-bcm-Replace-hrtimer_tasklet-with-softirq-based-h.patch
+++ b/kernel/patches-4.14.x-rt/0046-0030-can-bcm-Replace-hrtimer_tasklet-with-softirq-based-h.patch
--- a/kernel/patches-4.14.x-rt/0047-0031-mac80211_hwsim-Replace-hrtimer-tasklet-with-softirq-.patch
+++ b/kernel/patches-4.14.x-rt/0047-0031-mac80211_hwsim-Replace-hrtimer-tasklet-with-softirq-.patch
--- a/kernel/patches-4.14.x-rt/0048-0032-xfrm-Replace-hrtimer-tasklet-with-softirq-hrtimer.patch
+++ b/kernel/patches-4.14.x-rt/0048-0032-xfrm-Replace-hrtimer-tasklet-with-softirq-hrtimer.patch
--- a/kernel/patches-4.14.x-rt/0049-0033-softirq-Remove-tasklet_hrtimer.patch
+++ b/kernel/patches-4.14.x-rt/0049-0033-softirq-Remove-tasklet_hrtimer.patch
--- a/kernel/patches-4.14.x-rt/0050-0034-ALSA-dummy-Replace-tasklet-with-softirq-hrtimer.patch
+++ b/kernel/patches-4.14.x-rt/0050-0034-ALSA-dummy-Replace-tasklet-with-softirq-hrtimer.patch
--- a/kernel/patches-4.14.x-rt/0051-0035-usb-gadget-NCM-Replace-tasklet-with-softirq-hrtimer.patch
+++ b/kernel/patches-4.14.x-rt/0051-0035-usb-gadget-NCM-Replace-tasklet-with-softirq-hrtimer.patch
--- a/kernel/patches-4.14.x-rt/0051-tty-goldfish-Enable-earlycon-only-if-built-in.patch
+++ b/kernel/patches-4.14.x-rt/0051-tty-goldfish-Enable-earlycon-only-if-built-in.patch
@@ -1,65 +0,0 @@
-From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
-Date: Wed, 29 Nov 2017 16:32:20 +0100
-Subject: [PATCH] tty: goldfish: Enable 'earlycon' only if built-in
-
-Commit 3840ed9548f7 ("tty: goldfish: Implement support for kernel
-'earlycon' parameter") breaks an allmodconfig config on x86:
-|  LD      vmlinux.o
-|  MODPOST vmlinux.o
-|drivers/tty/serial/earlycon.o: In function `parse_options':
-|drivers/tty/serial/earlycon.c:97: undefined reference to `uart_parse_earlycon'
-|Makefile:1005: recipe for target 'vmlinux' failed
-
-earlycon.c::parse_options() invokes uart_parse_earlycon() from serial_core.c
-which is compiled=m because GOLDFISH_TTY itself (and most others) are =m.
-To avoid that, I'm adding the _CONSOLE config option which is selected if the
-GOLDFISH module itself is =y since it doesn't need the early bits for the =m
-case (other drivers do the same dance).
-The alternative would be to move uart_parse_earlycon() from
-serial_core.c to earlycon.c (we don't have that many users of that
-function).
-
-Fixes: 3840ed9548f7 ("tty: goldfish: Implement support for kernel
-       'earlycon' parameter")
-Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
---
- drivers/tty/Kconfig    |    6 +++++-
- drivers/tty/goldfish.c |    2 ++
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
--- a/drivers/tty/Kconfig
-+++ b/drivers/tty/Kconfig
-@@ -394,10 +394,14 @@ config GOLDFISH_TTY
- 	depends on GOLDFISH
- 	select SERIAL_CORE
- 	select SERIAL_CORE_CONSOLE
-	select SERIAL_EARLYCON
- 	help
- 	  Console and system TTY driver for the Goldfish virtual platform.
- 
-+config GOLDFISH_TTY_EARLY_CONSOLE
-+	bool
-+	default y if GOLDFISH_TTY=y
-+	select SERIAL_EARLYCON
-+
- config DA_TTY
- 	bool "DA TTY"
- 	depends on METAG_DA
--- a/drivers/tty/goldfish.c
-+++ b/drivers/tty/goldfish.c
-@@ -442,6 +442,7 @@ static int goldfish_tty_remove(struct pl
- 	return 0;
- }
- 
-+#ifdef CONFIG_GOLDFISH_TTY_EARLY_CONSOLE
- static void gf_early_console_putchar(struct uart_port *port, int ch)
- {
- 	__raw_writel(ch, port->membase);
-@@ -465,6 +466,7 @@ static int __init gf_earlycon_setup(stru
- }
- 
- OF_EARLYCON_DECLARE(early_gf_tty, "google,goldfish-tty", gf_earlycon_setup);
-+#endif
- 
- static const struct of_device_id goldfish_tty_of_match[] = {
- 	{ .compatible = "google,goldfish-tty", },
--- a/kernel/patches-4.14.x-rt/0052-0036-net-mvpp2-Replace-tasklet-with-softirq-hrtimer.patch
+++ b/kernel/patches-4.14.x-rt/0052-0036-net-mvpp2-Replace-tasklet-with-softirq-hrtimer.patch
--- a/kernel/patches-4.14.x-rt/0053-at91_dont_enable_disable_clock.patch
+++ b/kernel/patches-4.14.x-rt/0053-at91_dont_enable_disable_clock.patch
--- a/kernel/patches-4.14.x-rt/0054-rfc-arm-smp-__cpu_disable-fix-sleeping-function-called-from-invalid-context.patch
+++ b/kernel/patches-4.14.x-rt/0054-rfc-arm-smp-__cpu_disable-fix-sleeping-function-called-from-invalid-context.patch
--- a/kernel/patches-4.14.x-rt/0055-rtmutex--Handle-non-enqueued-waiters-gracefully.patch
+++ b/kernel/patches-4.14.x-rt/0055-rtmutex--Handle-non-enqueued-waiters-gracefully.patch
--- a/kernel/patches-4.14.x-rt/0056-rbtree-include-rcu.h-because-we-use-it.patch
+++ b/kernel/patches-4.14.x-rt/0056-rbtree-include-rcu.h-because-we-use-it.patch
--- a/Show More
+++ b/Show More