Home Home > GIT Browse > SLE12-SP4
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenis Kirjanov <dkirjanov@suse.com>2019-07-29 11:42:03 +0300
committerDenis Kirjanov <dkirjanov@suse.com>2019-07-29 11:42:03 +0300
commit6eb755b2e7728e4e5902f74febf325096509b2aa (patch)
treeae36ff2a9ddd54431d16b9aa78c0cd247be2f17c
parent57e14fc1e38ae6b2c368bc88356d7313dd054a0b (diff)
parent328e900ccc15dfa4a78f967fb9caa6896df47b1d (diff)
Merge remote-tracking branch 'origin/SLE15-SP1' into SLE12-SP5rpm-4.12.14-104
Conflicts: blacklist.conf patches.kabi/asus-wmi-quirk_entry-kabi-fix.patch series.conf
-rw-r--r--blacklist.conf5
-rw-r--r--patches.arch/powerpc-Fix-check-for-copy-paste-instructions-in-ali.patch7
-rw-r--r--patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch15
-rw-r--r--patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch11
-rw-r--r--patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch11
-rw-r--r--patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch3
-rw-r--r--patches.arch/ppc-Convert-mmu-context-allocation-to-new-IDA-API.patch104
-rw-r--r--patches.drivers/0001-PCI-pciehp-Rename-host-native_hotplug-to-host-native.patch4
-rw-r--r--patches.drivers/0001-PCI-portdrv-Rename-and-reverse-sense-of-pcie_ports_a.patch9
-rw-r--r--patches.drivers/0001-PCI-portdrv-Resume-upon-exit-from-system-suspend-if-.patch12
-rw-r--r--patches.drivers/0001-PCI-portdrv-Simplify-PCIe-feature-permission-checkin.patch11
-rw-r--r--patches.drivers/0001-fpga-add-intel-stratix10-soc-fpga-manager-driver.patch588
-rw-r--r--patches.drivers/0001-fpga-stratix10-soc-fix-use-after-free-on-s10_init.patch54
-rw-r--r--patches.drivers/0001-fpga-stratix10-soc-fix-wrong-of_node_put-in-init-fun.patch50
-rw-r--r--patches.drivers/ALSA-hda-Fix-intermittent-CORB-RIRB-stall-on-Intel-c.patch53
-rw-r--r--patches.drivers/ALSA-hda-Optimize-resume-for-codecs-without-jack-det.patch35
-rw-r--r--patches.drivers/IB-ipoib-Add-child-to-parent-list-only-if-device-ini.patch90
-rw-r--r--patches.drivers/IB-mlx5-Fixed-reporting-counters-on-2nd-port-for-Dua.patch173
-rw-r--r--patches.drivers/PCI-AER-Use-cached-AER-Capability-offset.patch116
-rw-r--r--patches.drivers/PCI-PM-Use-SMART_SUSPEND-and-LEAVE_SUSPENDED-flags-f.patch38
-rw-r--r--patches.drivers/PCI-portdrv-Add-defines-for-AER-and-DPC-Interrupt-Me.patch61
-rw-r--r--patches.drivers/PCI-portdrv-Consolidate-comments.patch133
-rw-r--r--patches.drivers/PCI-portdrv-Disable-port-driver-in-compat-mode.patch63
-rw-r--r--patches.drivers/PCI-portdrv-Remove-pcie_portdrv_err_handler.slot_res.patch74
-rw-r--r--patches.drivers/PCI-portdrv-Restore-PCI-config-state-on-slot-reset.patch50
-rw-r--r--patches.drivers/PCI-portdrv-Support-PCIe-services-on-subtractive-dec.patch37
-rw-r--r--patches.drivers/PCI-portdrv-Use-conventional-Device-ID-table-formatt.patch40
-rw-r--r--patches.drivers/RDMA-odp-Fix-missed-unlock-in-non-blocking-invalidat.patch45
-rw-r--r--patches.drivers/RDMA-srp-Accept-again-source-addresses-that-do-not-h.patch87
-rw-r--r--patches.drivers/RDMA-srp-Document-srp_parse_in-arguments.patch31
-rw-r--r--patches.drivers/RDMA-uverbs-check-for-allocation-failure-in-uapi_add.patch32
-rw-r--r--patches.drivers/ath-DFS-JP-domain-W56-fixed-pulse-type-3-RADAR-detec.patch46
-rw-r--r--patches.drivers/ath10k-Do-not-send-probe-response-template-for-mesh.patch45
-rw-r--r--patches.drivers/ath10k-add-peer-id-check-in-ath10k_peer_find_by_id.patch69
-rw-r--r--patches.drivers/ath10k-destroy-sdio-workqueue-while-remove-sdio-modu.patch35
-rw-r--r--patches.drivers/ath10k-fix-PCIE-device-wake-up-failed.patch51
-rw-r--r--patches.drivers/ath9k-Check-for-errors-when-reading-SREV-register.patch123
-rw-r--r--patches.drivers/bnxt_en-Cap-the-returned-MSIX-vectors-to-the-RDMA-dr.patch37
-rw-r--r--patches.drivers/bnxt_en-Disable-bus-master-during-PCI-shutdown-and-d.patch45
-rw-r--r--patches.drivers/bnxt_en-Fix-statistics-context-reservation-logic-for.patch55
-rw-r--r--patches.drivers/bnxt_en-Suppress-error-messages-when-querying-DSCP-D.patch30
-rw-r--r--patches.drivers/bpf-fix-callees-pruning-callers.patch57
-rw-r--r--patches.drivers/idr-fix-overflow-case-for-idr_for_each_entry_ul.patch98
-rw-r--r--patches.drivers/iwlwifi-add-support-for-22560-devices.patch20
-rw-r--r--patches.drivers/iwlwifi-correct-one-of-the-PCI-struct-names.patch114
-rw-r--r--patches.drivers/iwlwifi-don-t-WARN-when-calling-iwl_get_shared_mem_c.patch70
-rw-r--r--patches.drivers/iwlwifi-fix-RF-Kill-interrupt-while-FW-load-for-gen2.patch147
-rw-r--r--patches.drivers/iwlwifi-fix-cfg-structs-for-22000-with-different-RF-.patch90
-rw-r--r--patches.drivers/iwlwifi-fix-devices-with-PCI-Device-ID-0x34F0-and-11.patch228
-rw-r--r--patches.drivers/iwlwifi-mvm-Drop-large-non-sta-frames.patch41
-rw-r--r--patches.drivers/iwlwifi-pcie-don-t-service-an-interrupt-that-was-mas.patch76
-rw-r--r--patches.drivers/iwlwifi-pcie-fix-ALIVE-interrupt-handling-for-gen2-d.patch76
-rw-r--r--patches.drivers/iwlwifi-rename-the-temporary-name-of-A000-to-the-off.patch10
-rw-r--r--patches.drivers/mlxsw-spectrum_dcb-Configure-DSCP-map-as-the-last-ru.patch72
-rw-r--r--patches.drivers/mt7601u-do-not-schedule-rx_tasklet-when-the-device-h.patch115
-rw-r--r--patches.drivers/mt7601u-fix-possible-memory-leak-when-the-device-is-.patch127
-rw-r--r--patches.drivers/net-mlx5e-Rx-Fix-checksum-calculation-for-new-hardwa.patch84
-rw-r--r--patches.drivers/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch33
-rw-r--r--patches.drivers/net-tls-make-sure-offload-also-gets-the-keys-wiped.patch64
-rw-r--r--patches.drivers/platform-x86-asus-nb-wmi-Support-ALS-on-the-Zenbook-.patch2
-rw-r--r--patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch6
-rw-r--r--patches.drivers/qed-Fix-Wmaybe-uninitialized-false-positive.patch43
-rw-r--r--patches.drivers/qed-Fix-build-error-without-CONFIG_DEVLINK.patch37
-rw-r--r--patches.drivers/rtlwifi-rtl8192cu-fix-error-handle-when-usb-probe-fa.patch106
-rw-r--r--patches.drivers/scsi-ibmvfc-fix-WARN_ON-during-event-pool-release.patch75
-rw-r--r--patches.drivers/scsi-megaraid_sas-return-error-when-create-dma-pool-failed74
-rw-r--r--patches.drivers/tcp-fix-tcp_set_congestion_control-use-from-bpf-hook.patch100
-rw-r--r--patches.drivers/tools-bpftool-Fix-json-dump-crash-on-powerpc.patch86
-rw-r--r--patches.drivers/tools-bpftool-use-correct-argument-in-cgroup-errors.patch49
-rw-r--r--patches.drivers/xdp-fix-possible-cq-entry-leak.patch62
-rw-r--r--patches.drivers/xdp-fix-race-on-generic-receive-path.patch97
-rw-r--r--patches.drivers/xdp-hold-device-for-umem-regardless-of-zero-copy-mod.patch53
-rw-r--r--patches.drivers/xprtrdma-Fix-use-after-free-in-rpcrdma_post_recvs.patch35
-rw-r--r--patches.drivers/xsk-Properly-terminate-assignment-in-xskq_produce_fl.patch49
-rw-r--r--patches.fixes/0001-Input-tm2-touchkey-acknowledge-that-setting-brightne.patch51
-rw-r--r--patches.fixes/0001-xen-let-alloc_xenballooned_pages-fail-if-not-enough-.patch72
-rw-r--r--patches.fixes/Revert-e1000e-fix-cyclic-resets-at-link-up-with-acti.patch79
-rw-r--r--patches.fixes/bonding-Force-slave-speed-check-after-link-state-rec.patch76
-rw-r--r--patches.fixes/drivers-base-introduce-kill_device.patch4
-rw-r--r--patches.fixes/e1000e-start-network-tx-queue-only-when-link-is-up.patch78
-rw-r--r--patches.fixes/libnvdimm-bus-prevent-duplicate-device_unregister-calls.patch4
-rw-r--r--patches.fixes/pci-portdrv-compute-msi-msi-x-irq-vectors-after-final-allocation64
-rw-r--r--patches.fixes/pci-portdrv-factor-out-interrupt-message-number-lookup92
-rw-r--r--series.conf78
84 files changed, 5405 insertions, 167 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 320622b1ea..15c9d5d6c6 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1206,3 +1206,8 @@ d057dc4e35e16050befa3dda943876dab39cbf80 # seccomp: reverted in below
c3ca9064273c3d7bc1654d685d42f41ccf3744d7 # seccomp: reverting above
a5008b59cd9d8de12ab623cb5052bb4735330e5c # not needed because of differences to upstream code
26e53d5ebe2e2a5ff7343e820f0ffd69dd503f8e # obsoleted by dffe8449c5dd63ff18b47709de75553586582cd8
+0bfcd24b39c29dbaba81a188ca364563866e6ecc # already present as 8c2eb7b6468a
+ad408a1596b45868e38d0504f2ec1d5fb06f17d4 # cosmetic change
+7a625549ea8c14be70bc7cfaf30215401bba6da0 # breaks kABI
+5c14a4d05f68415af9e41a4e667d1748d41d1baf # optimization
+b4c3fbe6360178dc2181b7b43b7ae793a192b282 # optimization, breaks kABI
diff --git a/patches.arch/powerpc-Fix-check-for-copy-paste-instructions-in-ali.patch b/patches.arch/powerpc-Fix-check-for-copy-paste-instructions-in-ali.patch
index 5f1769aa35..fc9dfa2fc8 100644
--- a/patches.arch/powerpc-Fix-check-for-copy-paste-instructions-in-ali.patch
+++ b/patches.arch/powerpc-Fix-check-for-copy-paste-instructions-in-ali.patch
@@ -26,8 +26,6 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
arch/powerpc/kernel/align.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
-index fd3c1fcc73eb..5483c945f55d 100644
--- a/arch/powerpc/kernel/align.c
+++ b/arch/powerpc/kernel/align.c
@@ -930,7 +930,7 @@ int fix_alignment(struct pt_regs *regs)
@@ -35,10 +33,7 @@ index fd3c1fcc73eb..5483c945f55d 100644
* synchronisation point for preceding copy/paste sequences.
*/
- if ((instruction & 0xfc0006fe) == PPC_INST_COPY)
-+ if ((instruction & 0xfc0006fe) == PPC_INST_COPY & 0xfc0006fe)
++ if ((instruction & 0xfc0006fe) == (PPC_INST_COPY & 0xfc0006fe))
return -EIO;
/* A size of 0 indicates an instruction we don't support, with
---
-2.13.6
-
diff --git a/patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch b/patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch
index 4492e656f7..861a8f0d5b 100644
--- a/patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch
+++ b/patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch
@@ -1,11 +1,12 @@
-From 28bdaa1ecb1c7bb8d6919da49041d7ae8418a2e6 Mon Sep 17 00:00:00 2001
+From 3a855b7ac7d5021674aa3e1cc9d3bfd6b604e9c0 Mon Sep 17 00:00:00 2001
From: Vaibhav Jain <vaibhav@linux.ibm.com>
Date: Sat, 29 Jun 2019 21:36:10 +0530
Subject: [PATCH 3/3] powerpc/papr_scm: Force a scm-unbind if initial scm-bind
fails
References: bsc#1140322 LTC#176270
-Patch-mainline: submitted https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=116880
+Patch-mainline: v5.3 or v5.3-rc2 (next release)
+Git-commit: 3a855b7ac7d5021674aa3e1cc9d3bfd6b604e9c0
In some cases initial bind of scm memory for an lpar can fail if
previously it wasn't released using a scm-unbind hcall. This situation
@@ -22,16 +23,18 @@ and indicate it as a EBUSY error back to the caller.
Suggested-by: "Oliver O'Halloran" <oohall@gmail.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
Reviewed-by: Oliver O'Halloran <oohall@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190629160610.23402-4-vaibhav@linux.ibm.com
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/platforms/pseries/papr_scm.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
-index 0bbbe3a0e155..32f1e3a33650 100644
+index 82568a7e0a7c..2c07908359b2 100644
--- a/arch/powerpc/platforms/pseries/papr_scm.c
+++ b/arch/powerpc/platforms/pseries/papr_scm.c
-@@ -43,8 +43,9 @@ struct papr_scm_priv {
+@@ -44,8 +44,9 @@ struct papr_scm_priv {
static int drc_pmem_bind(struct papr_scm_priv *p)
{
unsigned long ret[PLPAR_HCALL_BUFSIZE];
@@ -42,7 +45,7 @@ index 0bbbe3a0e155..32f1e3a33650 100644
/*
* When the hypervisor cannot map all the requested memory in a single
-@@ -64,6 +65,10 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
+@@ -65,6 +66,10 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
} while (rc == H_BUSY);
if (rc) {
@@ -53,7 +56,7 @@ index 0bbbe3a0e155..32f1e3a33650 100644
dev_err(&p->pdev->dev, "bind err: %lld\n", rc);
return -ENXIO;
}
-@@ -330,6 +335,14 @@ static int papr_scm_probe(struct platform_device *pdev)
+@@ -404,6 +409,14 @@ static int papr_scm_probe(struct platform_device *pdev)
/* request the hypervisor to bind this region to somewhere in memory */
rc = drc_pmem_bind(p);
diff --git a/patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch b/patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch
index 96e1d10dd0..1b8dfdadcc 100644
--- a/patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch
+++ b/patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch
@@ -1,11 +1,12 @@
-From 8e8e1e8d9c25e25c406fa7b2e887e14087a32133 Mon Sep 17 00:00:00 2001
+From 0d7fc080ba139a2a639d3732616403ccddfa2d36 Mon Sep 17 00:00:00 2001
From: Vaibhav Jain <vaibhav@linux.ibm.com>
Date: Sat, 29 Jun 2019 21:36:09 +0530
Subject: [PATCH 2/3] powerpc/papr_scm: Update drc_pmem_unbind() to use
H_SCM_UNBIND_ALL
References: bsc#1140322 LTC#176270
-Patch-mainline: submitted https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=116880
+Patch-mainline: v5.3 or v5.3-rc2 (next release)
+Git-commit: 0d7fc080ba139a2a639d3732616403ccddfa2d36
The new hcall named H_SCM_UNBIND_ALL has been introduce that can
unbind all or specific scm memory assigned to an lpar. This is
@@ -26,13 +27,15 @@ Hence this patch proposes following changes to drc_pmem_unbind():
Reviewed-by: Oliver O'Halloran <oohall@gmail.com>
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190629160610.23402-3-vaibhav@linux.ibm.com
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/platforms/pseries/papr_scm.c | 29 +++++++++++++++++------
1 file changed, 22 insertions(+), 7 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c
-index bba281b1fe1b..0bbbe3a0e155 100644
+index c8ec670ee924..82568a7e0a7c 100644
--- a/arch/powerpc/platforms/pseries/papr_scm.c
+++ b/arch/powerpc/platforms/pseries/papr_scm.c
@@ -11,6 +11,7 @@
@@ -43,7 +46,7 @@ index bba281b1fe1b..0bbbe3a0e155 100644
#include <asm/plpar_wrappers.h>
-@@ -77,22 +78,36 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
+@@ -78,22 +79,36 @@ static int drc_pmem_bind(struct papr_scm_priv *p)
static int drc_pmem_unbind(struct papr_scm_priv *p)
{
unsigned long ret[PLPAR_HCALL_BUFSIZE];
diff --git a/patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch b/patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch
index fc219ca8e4..a3d38de7bd 100644
--- a/patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch
+++ b/patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch
@@ -1,10 +1,11 @@
-From cc2d9fa1545ab8c91b42a0fa0b46be70ba101122 Mon Sep 17 00:00:00 2001
+From 6d140e7569db89a1b596c1c2d1c2293d5c594432 Mon Sep 17 00:00:00 2001
From: Vaibhav Jain <vaibhav@linux.ibm.com>
Date: Sat, 29 Jun 2019 21:36:08 +0530
Subject: [PATCH 1/3] powerpc/pseries: Update SCM hcall op-codes in hvcall.h
References: bsc#1140322 LTC#176270
-Patch-mainline: submitted https://patchwork.ozlabs.org/project/linuxppc-dev/list/?series=116880
+Patch-mainline: v5.3 or v5.3-rc2 (next release)
+Git-commit: 6d140e7569db89a1b596c1c2d1c2293d5c594432
Update the hvcalls.h to include op-codes for new hcalls introduce to
manage SCM memory. Also update existing hcall definitions to reflect
@@ -16,16 +17,18 @@ Power-VM nor they were used anywhere in Linux kernel. Hence we don't
expect anyone to be impacted by this change.
Signed-off-by: Vaibhav Jain <vaibhav@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20190629160610.23402-2-vaibhav@linux.ibm.com
Acked-by: Michal Suchanek <msuchanek@suse.de>
---
arch/powerpc/include/asm/hvcall.h | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
-index a0e3bb565e15..37983f997577 100644
+index 463c63a9fcf1..11112023e327 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
-@@ -300,9 +300,14 @@
+@@ -302,9 +302,14 @@
#define H_SCM_UNBIND_MEM 0x3F0
#define H_SCM_QUERY_BLOCK_MEM_BINDING 0x3F4
#define H_SCM_QUERY_LOGICAL_MEM_BINDING 0x3F8
diff --git a/patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch b/patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch
index ab7f3c6f28..95afaca2a1 100644
--- a/patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch
+++ b/patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch
@@ -4,8 +4,7 @@ Date: Fri, 19 Jul 2019 15:05:02 +1000
Subject: [PATCH] powerpc/tm: Fix oops on sigreturn on systems without TM
References: bsc#1142265 CVE-2019-13648
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v5.3 or v5.3-rc2 (next release)
Git-commit: f16d80b75a096c52354c6e0a574993f3b0dfbdfe
On systems like P9 powernv where we have no TM (or P8 booted with
diff --git a/patches.arch/ppc-Convert-mmu-context-allocation-to-new-IDA-API.patch b/patches.arch/ppc-Convert-mmu-context-allocation-to-new-IDA-API.patch
new file mode 100644
index 0000000000..a1cea78b5c
--- /dev/null
+++ b/patches.arch/ppc-Convert-mmu-context-allocation-to-new-IDA-API.patch
@@ -0,0 +1,104 @@
+From 14b19ee94fa00ff749b2fa8a2131c14ccfdd3d09 Mon Sep 17 00:00:00 2001
+From: Matthew Wilcox <willy@infradead.org>
+Date: Mon, 18 Jun 2018 08:26:32 -0400
+Subject: [PATCH] ppc: Convert mmu context allocation to new IDA API
+
+References: bsc#1139619 LTC#178538
+Patch-mainline: v4.19-rc1
+Git-commit: b3fa64170e21393b5790be89ab16cdfe1f5bddbc
+
+ida_alloc_range is the perfect fit for this use case. Eliminates
+a custom spinlock, a call to ida_pre_get and a local check for the
+allocated ID exceeding a maximum.
+
+Signed-off-by: Matthew Wilcox <willy@infradead.org>
+Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/mmu_context_book3s64.c | 44 +++-----------------------
+ 1 file changed, 4 insertions(+), 40 deletions(-)
+
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index c2a8f15a7972..d77bd6ce33da 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -26,48 +26,16 @@
+ #include <asm/mmu_context.h>
+ #include <asm/pgalloc.h>
+
+-static DEFINE_SPINLOCK(mmu_context_lock);
+ static DEFINE_IDA(mmu_context_ida);
+
+ static int alloc_context_id(int min_id, int max_id)
+ {
+- int index, err;
+-
+-again:
+- if (!ida_pre_get(&mmu_context_ida, GFP_KERNEL))
+- return -ENOMEM;
+-
+- spin_lock(&mmu_context_lock);
+- err = ida_get_new_above(&mmu_context_ida, min_id, &index);
+- spin_unlock(&mmu_context_lock);
+-
+- if (err == -EAGAIN)
+- goto again;
+- else if (err)
+- return err;
+-
+- if (index > max_id) {
+- spin_lock(&mmu_context_lock);
+- ida_remove(&mmu_context_ida, index);
+- spin_unlock(&mmu_context_lock);
+- return -ENOMEM;
+- }
+-
+- return index;
++ return ida_alloc_range(&mmu_context_ida, min_id, max_id, GFP_KERNEL);
+ }
+
+ void hash__reserve_context_id(int id)
+ {
+- int rc, result = 0;
+-
+- do {
+- if (!ida_pre_get(&mmu_context_ida, GFP_KERNEL))
+- break;
+-
+- spin_lock(&mmu_context_lock);
+- rc = ida_get_new_above(&mmu_context_ida, id, &result);
+- spin_unlock(&mmu_context_lock);
+- } while (rc == -EAGAIN);
++ int result = ida_alloc_range(&mmu_context_ida, id, id, GFP_KERNEL);
+
+ WARN(result != id, "mmu: Failed to reserve context id %d (rc %d)\n", id, result);
+ }
+@@ -211,9 +179,7 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+
+ void __destroy_context(int context_id)
+ {
+- spin_lock(&mmu_context_lock);
+- ida_remove(&mmu_context_ida, context_id);
+- spin_unlock(&mmu_context_lock);
++ ida_free(&mmu_context_ida, context_id);
+ }
+ EXPORT_SYMBOL_GPL(__destroy_context);
+
+@@ -221,13 +187,11 @@ static void destroy_contexts(mm_context_t *ctx)
+ {
+ int index, context_id;
+
+- spin_lock(&mmu_context_lock);
+ for (index = 0; index < ARRAY_SIZE(ctx->extended_id); index++) {
+ context_id = ctx->extended_id[index];
+ if (context_id)
+- ida_remove(&mmu_context_ida, context_id);
++ ida_free(&mmu_context_ida, context_id);
+ }
+- spin_unlock(&mmu_context_lock);
+ }
+
+ #ifdef CONFIG_PPC_64K_PAGES
+--
+2.22.0
+
diff --git a/patches.drivers/0001-PCI-pciehp-Rename-host-native_hotplug-to-host-native.patch b/patches.drivers/0001-PCI-pciehp-Rename-host-native_hotplug-to-host-native.patch
index f0eea41ce3..a11c374322 100644
--- a/patches.drivers/0001-PCI-pciehp-Rename-host-native_hotplug-to-host-native.patch
+++ b/patches.drivers/0001-PCI-pciehp-Rename-host-native_hotplug-to-host-native.patch
@@ -35,8 +35,8 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
if (!(root->osc_control_set & OSC_PCI_EXPRESS_PME_CONTROL))
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
-@@ -207,7 +207,7 @@ static int get_port_device_capability(st
- return 0;
+@@ -217,7 +217,7 @@ static int get_port_device_capability(st
+ int services = 0;
if (dev->is_hotplug_bridge &&
- (pcie_ports_native || host->native_hotplug)) {
diff --git a/patches.drivers/0001-PCI-portdrv-Rename-and-reverse-sense-of-pcie_ports_a.patch b/patches.drivers/0001-PCI-portdrv-Rename-and-reverse-sense-of-pcie_ports_a.patch
index 529ec298a4..aecc056161 100644
--- a/patches.drivers/0001-PCI-portdrv-Rename-and-reverse-sense-of-pcie_ports_a.patch
+++ b/patches.drivers/0001-PCI-portdrv-Rename-and-reverse-sense-of-pcie_ports_a.patch
@@ -35,16 +35,13 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
#define PCIE_PORT_SERVICE_PME (1 << PCIE_PORT_SERVICE_PME_SHIFT)
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
-@@ -200,21 +200,13 @@ legacy_irq:
+@@ -208,18 +208,10 @@ legacy_irq:
static int get_port_device_capability(struct pci_dev *dev)
{
struct pci_host_bridge *host = pci_find_host_bridge(dev->bus);
- bool native;
int services = 0;
- if (pcie_ports_disabled)
- return 0;
-
- /*
- * If the user specified "pcie_ports=native", use the PCIe services
- * regardless of whether the platform has given us permission. On
@@ -59,7 +56,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
services |= PCIE_PORT_SERVICE_HP;
/*
-@@ -226,7 +218,7 @@ static int get_port_device_capability(st
+@@ -231,7 +223,7 @@ static int get_port_device_capability(st
}
if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR) &&
@@ -68,7 +65,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
services |= PCIE_PORT_SERVICE_AER;
/*
-@@ -245,7 +237,7 @@ static int get_port_device_capability(st
+@@ -250,7 +242,7 @@ static int get_port_device_capability(st
* those yet.
*/
if (pci_pcie_type(dev) == PCI_EXP_TYPE_ROOT_PORT &&
diff --git a/patches.drivers/0001-PCI-portdrv-Resume-upon-exit-from-system-suspend-if-.patch b/patches.drivers/0001-PCI-portdrv-Resume-upon-exit-from-system-suspend-if-.patch
index 223bf4d5d3..2565ccd765 100644
--- a/patches.drivers/0001-PCI-portdrv-Resume-upon-exit-from-system-suspend-if-.patch
+++ b/patches.drivers/0001-PCI-portdrv-Resume-upon-exit-from-system-suspend-if-.patch
@@ -32,19 +32,19 @@ Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
- drivers/pci/pcie/portdrv_pci.c | 4 ++++
- 1 file changed, 4 insertions(+)
+ drivers/pci/pcie/portdrv_pci.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
-@@ -145,6 +145,10 @@ static int pcie_portdrv_probe(struct pci
+@@ -123,8 +123,8 @@ static int pcie_portdrv_probe(struct pci
pci_save_state(dev);
+- dev_pm_set_driver_flags(&dev->dev, DPM_FLAG_SMART_SUSPEND |
+- DPM_FLAG_LEAVE_SUSPENDED);
+ dev_pm_set_driver_flags(&dev->dev, DPM_FLAG_NEVER_SKIP |
+ DPM_FLAG_SMART_SUSPEND);
-+
-+
+
if (pci_bridge_d3_possible(dev)) {
/*
- * Keep the port resumed 100ms to make sure things like
diff --git a/patches.drivers/0001-PCI-portdrv-Simplify-PCIe-feature-permission-checkin.patch b/patches.drivers/0001-PCI-portdrv-Simplify-PCIe-feature-permission-checkin.patch
index c338f2074c..5fe0d13f9c 100644
--- a/patches.drivers/0001-PCI-portdrv-Simplify-PCIe-feature-permission-checkin.patch
+++ b/patches.drivers/0001-PCI-portdrv-Simplify-PCIe-feature-permission-checkin.patch
@@ -99,7 +99,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
#endif /* _PORTDRV_H_ */
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
-@@ -199,23 +199,24 @@ legacy_irq:
+@@ -207,20 +207,21 @@ legacy_irq:
*/
static int get_port_device_capability(struct pci_dev *dev)
{
@@ -108,9 +108,6 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
int services = 0;
- int cap_mask = 0;
- if (pcie_ports_disabled)
- return 0;
-
- cap_mask = PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP
- | PCIE_PORT_SERVICE_VC;
- if (pci_aer_available())
@@ -133,7 +130,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
/*
* Disable hot-plug interrupts in case they have been enabled
* by the BIOS and the hot-plug service driver is not loaded.
-@@ -223,10 +224,11 @@ static int get_port_device_capability(st
+@@ -228,10 +229,11 @@ static int get_port_device_capability(st
pcie_capability_clear_word(dev, PCI_EXP_SLTCTL,
PCI_EXP_SLTCTL_CCIE | PCI_EXP_SLTCTL_HPIE);
}
@@ -148,7 +145,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
/*
* Disable AER on this port in case it's been enabled by the
* BIOS (the AER service driver will enable it when necessary).
-@@ -236,10 +238,16 @@ static int get_port_device_capability(st
+@@ -241,10 +243,16 @@ static int get_port_device_capability(st
/* VC support */
if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_VC))
services |= PCIE_PORT_SERVICE_VC;
@@ -168,7 +165,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
/*
* Disable PME interrupt on this port in case it's been enabled
* by the BIOS (the PME service driver will enable it when
-@@ -247,7 +255,9 @@ static int get_port_device_capability(st
+@@ -252,7 +260,9 @@ static int get_port_device_capability(st
*/
pcie_pme_interrupt_enable(dev, false);
}
diff --git a/patches.drivers/0001-fpga-add-intel-stratix10-soc-fpga-manager-driver.patch b/patches.drivers/0001-fpga-add-intel-stratix10-soc-fpga-manager-driver.patch
new file mode 100644
index 0000000000..f7bd3001c3
--- /dev/null
+++ b/patches.drivers/0001-fpga-add-intel-stratix10-soc-fpga-manager-driver.patch
@@ -0,0 +1,588 @@
+From e7eef1d7633a875977705d203e6f651893582374 Mon Sep 17 00:00:00 2001
+From: Alan Tull <atull@kernel.org>
+Date: Tue, 13 Nov 2018 12:14:04 -0600
+Subject: [PATCH] fpga: add intel stratix10 soc fpga manager driver
+Git-commit: e7eef1d7633a875977705d203e6f651893582374
+References: jsc#SLE-7057
+Patch-mainline: v5.0
+
+Add driver for reconfiguring Intel Stratix10 SoC FPGA devices.
+This driver communicates through the Intel service layer driver
+which does communication with privileged hardware (that does the
+FPGA programming) through a secure mailbox.
+
+Signed-off-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Richard Gong <richard.gong@intel.com>
+Acked-by: Moritz Fischer <mdf@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/fpga/Kconfig | 6
+ drivers/fpga/Makefile | 1
+ drivers/fpga/stratix10-soc.c | 535 +++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 542 insertions(+)
+ create mode 100644 drivers/fpga/stratix10-soc.c
+
+--- a/drivers/fpga/Kconfig
++++ b/drivers/fpga/Kconfig
+@@ -43,6 +43,12 @@ config FPGA_MGR_ZYNQ_FPGA
+ help
+ FPGA manager driver support for Xilinx Zynq FPGAs.
+
++config FPGA_MGR_STRATIX10_SOC
++ tristate "Intel Stratix10 SoC FPGA Manager"
++ depends on (ARCH_STRATIX10 && INTEL_STRATIX10_SERVICE)
++ help
++ FPGA manager driver support for the Intel Stratix10 SoC.
++
+ config FPGA_MGR_XILINX_SPI
+ tristate "Xilinx Configuration over Slave Serial (SPI)"
+ depends on SPI
+--- a/drivers/fpga/Makefile
++++ b/drivers/fpga/Makefile
+@@ -9,6 +9,7 @@ obj-$(CONFIG_FPGA) += fpga-mgr.o
+ obj-$(CONFIG_FPGA_MGR_ICE40_SPI) += ice40-spi.o
+ obj-$(CONFIG_FPGA_MGR_SOCFPGA) += socfpga.o
+ obj-$(CONFIG_FPGA_MGR_SOCFPGA_A10) += socfpga-a10.o
++obj-$(CONFIG_FPGA_MGR_STRATIX10_SOC) += stratix10-soc.o
+ obj-$(CONFIG_FPGA_MGR_TS73XX) += ts73xx-fpga.o
+ obj-$(CONFIG_FPGA_MGR_XILINX_SPI) += xilinx-spi.o
+ obj-$(CONFIG_FPGA_MGR_ZYNQ_FPGA) += zynq-fpga.o
+--- /dev/null
++++ b/drivers/fpga/stratix10-soc.c
+@@ -0,0 +1,535 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * FPGA Manager Driver for Intel Stratix10 SoC
++ *
++ * Copyright (C) 2018 Intel Corporation
++ */
++#include <linux/completion.h>
++#include <linux/fpga/fpga-mgr.h>
++#include <linux/firmware/intel/stratix10-svc-client.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_platform.h>
++
++/*
++ * FPGA programming requires a higher level of privilege (EL3), per the SoC
++ * design.
++ */
++#define NUM_SVC_BUFS 4
++#define SVC_BUF_SIZE SZ_512K
++
++/* Indicates buffer is in use if set */
++#define SVC_BUF_LOCK 0
++
++#define S10_BUFFER_TIMEOUT (msecs_to_jiffies(SVC_RECONFIG_BUFFER_TIMEOUT_MS))
++#define S10_RECONFIG_TIMEOUT (msecs_to_jiffies(SVC_RECONFIG_REQUEST_TIMEOUT_MS))
++
++/*
++ * struct s10_svc_buf
++ * buf: virtual address of buf provided by service layer
++ * lock: locked if buffer is in use
++ */
++struct s10_svc_buf {
++ char *buf;
++ unsigned long lock;
++};
++
++struct s10_priv {
++ struct stratix10_svc_chan *chan;
++ struct stratix10_svc_client client;
++ struct completion status_return_completion;
++ struct s10_svc_buf svc_bufs[NUM_SVC_BUFS];
++ unsigned long status;
++};
++
++static int s10_svc_send_msg(struct s10_priv *priv,
++ enum stratix10_svc_command_code command,
++ void *payload, u32 payload_length)
++{
++ struct stratix10_svc_chan *chan = priv->chan;
++ struct device *dev = priv->client.dev;
++ struct stratix10_svc_client_msg msg;
++ int ret;
++
++ dev_dbg(dev, "%s cmd=%d payload=%p length=%d\n",
++ __func__, command, payload, payload_length);
++
++ msg.command = command;
++ msg.payload = payload;
++ msg.payload_length = payload_length;
++
++ ret = stratix10_svc_send(chan, &msg);
++ dev_dbg(dev, "stratix10_svc_send returned status %d\n", ret);
++
++ return ret;
++}
++
++/*
++ * Free buffers allocated from the service layer's pool that are not in use.
++ * Return true when all buffers are freed.
++ */
++static bool s10_free_buffers(struct fpga_manager *mgr)
++{
++ struct s10_priv *priv = mgr->priv;
++ uint num_free = 0;
++ uint i;
++
++ for (i = 0; i < NUM_SVC_BUFS; i++) {
++ if (!priv->svc_bufs[i].buf) {
++ num_free++;
++ continue;
++ }
++
++ if (!test_and_set_bit_lock(SVC_BUF_LOCK,
++ &priv->svc_bufs[i].lock)) {
++ stratix10_svc_free_memory(priv->chan,
++ priv->svc_bufs[i].buf);
++ priv->svc_bufs[i].buf = NULL;
++ num_free++;
++ }
++ }
++
++ return num_free == NUM_SVC_BUFS;
++}
++
++/*
++ * Returns count of how many buffers are not in use.
++ */
++static uint s10_free_buffer_count(struct fpga_manager *mgr)
++{
++ struct s10_priv *priv = mgr->priv;
++ uint num_free = 0;
++ uint i;
++
++ for (i = 0; i < NUM_SVC_BUFS; i++)
++ if (!priv->svc_bufs[i].buf)
++ num_free++;
++
++ return num_free;
++}
++
++/*
++ * s10_unlock_bufs
++ * Given the returned buffer address, match that address to our buffer struct
++ * and unlock that buffer. This marks it as available to be refilled and sent
++ * (or freed).
++ * priv: private data
++ * kaddr: kernel address of buffer that was returned from service layer
++ */
++static void s10_unlock_bufs(struct s10_priv *priv, void *kaddr)
++{
++ uint i;
++
++ if (!kaddr)
++ return;
++
++ for (i = 0; i < NUM_SVC_BUFS; i++)
++ if (priv->svc_bufs[i].buf == kaddr) {
++ clear_bit_unlock(SVC_BUF_LOCK,
++ &priv->svc_bufs[i].lock);
++ return;
++ }
++
++ WARN(1, "Unknown buffer returned from service layer %p\n", kaddr);
++}
++
++/*
++ * s10_receive_callback - callback for service layer to use to provide client
++ * (this driver) messages received through the mailbox.
++ * client: service layer client struct
++ * data: message from service layer
++ */
++static void s10_receive_callback(struct stratix10_svc_client *client,
++ struct stratix10_svc_cb_data *data)
++{
++ struct s10_priv *priv = client->priv;
++ u32 status;
++ int i;
++
++ WARN_ONCE(!data, "%s: stratix10_svc_rc_data = NULL", __func__);
++
++ status = data->status;
++
++ /*
++ * Here we set status bits as we receive them. Elsewhere, we always use
++ * test_and_clear_bit() to check status in priv->status
++ */
++ for (i = 0; i <= SVC_STATUS_RECONFIG_ERROR; i++)
++ if (status & (1 << i))
++ set_bit(i, &priv->status);
++
++ if (status & BIT(SVC_STATUS_RECONFIG_BUFFER_DONE)) {
++ s10_unlock_bufs(priv, data->kaddr1);
++ s10_unlock_bufs(priv, data->kaddr2);
++ s10_unlock_bufs(priv, data->kaddr3);
++ }
++
++ complete(&priv->status_return_completion);
++}
++
++/*
++ * s10_ops_write_init - prepare for FPGA reconfiguration by requesting
++ * partial reconfig and allocating buffers from the service layer.
++ */
++static int s10_ops_write_init(struct fpga_manager *mgr,
++ struct fpga_image_info *info,
++ const char *buf, size_t count)
++{
++ struct s10_priv *priv = mgr->priv;
++ struct device *dev = priv->client.dev;
++ struct stratix10_svc_command_config_type ctype;
++ char *kbuf;
++ uint i;
++ int ret;
++
++ ctype.flags = 0;
++ if (info->flags & FPGA_MGR_PARTIAL_RECONFIG) {
++ dev_dbg(dev, "Requesting partial reconfiguration.\n");
++ ctype.flags |= BIT(COMMAND_RECONFIG_FLAG_PARTIAL);
++ } else {
++ dev_dbg(dev, "Requesting full reconfiguration.\n");
++ }
++
++ reinit_completion(&priv->status_return_completion);
++ ret = s10_svc_send_msg(priv, COMMAND_RECONFIG,
++ &ctype, sizeof(ctype));
++ if (ret < 0)
++ goto init_done;
++
++ ret = wait_for_completion_interruptible_timeout(
++ &priv->status_return_completion, S10_RECONFIG_TIMEOUT);
++ if (!ret) {
++ dev_err(dev, "timeout waiting for RECONFIG_REQUEST\n");
++ ret = -ETIMEDOUT;
++ goto init_done;
++ }
++ if (ret < 0) {
++ dev_err(dev, "error (%d) waiting for RECONFIG_REQUEST\n", ret);
++ goto init_done;
++ }
++
++ ret = 0;
++ if (!test_and_clear_bit(SVC_STATUS_RECONFIG_REQUEST_OK,
++ &priv->status)) {
++ ret = -ETIMEDOUT;
++ goto init_done;
++ }
++
++ /* Allocate buffers from the service layer's pool. */
++ for (i = 0; i < NUM_SVC_BUFS; i++) {
++ kbuf = stratix10_svc_allocate_memory(priv->chan, SVC_BUF_SIZE);
++ if (!kbuf) {
++ s10_free_buffers(mgr);
++ ret = -ENOMEM;
++ goto init_done;
++ }
++
++ priv->svc_bufs[i].buf = kbuf;
++ priv->svc_bufs[i].lock = 0;
++ }
++
++init_done:
++ stratix10_svc_done(priv->chan);
++ return ret;
++}
++
++/*
++ * s10_send_buf - send a buffer to the service layer queue
++ * mgr: fpga manager struct
++ * buf: fpga image buffer
++ * count: size of buf in bytes
++ * Returns # of bytes transferred or -ENOBUFS if the all the buffers are in use
++ * or if the service queue is full. Never returns 0.
++ */
++static int s10_send_buf(struct fpga_manager *mgr, const char *buf, size_t count)
++{
++ struct s10_priv *priv = mgr->priv;
++ struct device *dev = priv->client.dev;
++ void *svc_buf;
++ size_t xfer_sz;
++ int ret;
++ uint i;
++
++ /* get/lock a buffer that that's not being used */
++ for (i = 0; i < NUM_SVC_BUFS; i++)
++ if (!test_and_set_bit_lock(SVC_BUF_LOCK,
++ &priv->svc_bufs[i].lock))
++ break;
++
++ if (i == NUM_SVC_BUFS)
++ return -ENOBUFS;
++
++ xfer_sz = count < SVC_BUF_SIZE ? count : SVC_BUF_SIZE;
++
++ svc_buf = priv->svc_bufs[i].buf;
++ memcpy(svc_buf, buf, xfer_sz);
++ ret = s10_svc_send_msg(priv, COMMAND_RECONFIG_DATA_SUBMIT,
++ svc_buf, xfer_sz);
++ if (ret < 0) {
++ dev_err(dev,
++ "Error while sending data to service layer (%d)", ret);
++ clear_bit_unlock(SVC_BUF_LOCK, &priv->svc_bufs[i].lock);
++ return ret;
++ }
++
++ return xfer_sz;
++}
++
++/*
++ * Send a FPGA image to privileged layers to write to the FPGA. When done
++ * sending, free all service layer buffers we allocated in write_init.
++ */
++static int s10_ops_write(struct fpga_manager *mgr, const char *buf,
++ size_t count)
++{
++ struct s10_priv *priv = mgr->priv;
++ struct device *dev = priv->client.dev;
++ long wait_status;
++ int sent = 0;
++ int ret = 0;
++
++ /*
++ * Loop waiting for buffers to be returned. When a buffer is returned,
++ * reuse it to send more data or free if if all data has been sent.
++ */
++ while (count > 0 || s10_free_buffer_count(mgr) != NUM_SVC_BUFS) {
++ reinit_completion(&priv->status_return_completion);
++
++ if (count > 0) {
++ sent = s10_send_buf(mgr, buf, count);
++ if (sent < 0)
++ continue;
++
++ count -= sent;
++ buf += sent;
++ } else {
++ if (s10_free_buffers(mgr))
++ return 0;
++
++ ret = s10_svc_send_msg(
++ priv, COMMAND_RECONFIG_DATA_CLAIM,
++ NULL, 0);
++ if (ret < 0)
++ break;
++ }
++
++ /*
++ * If callback hasn't already happened, wait for buffers to be
++ * returned from service layer
++ */
++ wait_status = 1; /* not timed out */
++ if (!priv->status)
++ wait_status = wait_for_completion_interruptible_timeout(
++ &priv->status_return_completion,
++ S10_BUFFER_TIMEOUT);
++
++ if (test_and_clear_bit(SVC_STATUS_RECONFIG_BUFFER_DONE,
++ &priv->status) ||
++ test_and_clear_bit(SVC_STATUS_RECONFIG_BUFFER_SUBMITTED,
++ &priv->status)) {
++ ret = 0;
++ continue;
++ }
++
++ if (test_and_clear_bit(SVC_STATUS_RECONFIG_ERROR,
++ &priv->status)) {
++ dev_err(dev, "ERROR - giving up - SVC_STATUS_RECONFIG_ERROR\n");
++ ret = -EFAULT;
++ break;
++ }
++
++ if (!wait_status) {
++ dev_err(dev, "timeout waiting for svc layer buffers\n");
++ ret = -ETIMEDOUT;
++ break;
++ }
++ if (wait_status < 0) {
++ ret = wait_status;
++ dev_err(dev,
++ "error (%d) waiting for svc layer buffers\n",
++ ret);
++ break;
++ }
++ }
++
++ if (!s10_free_buffers(mgr))
++ dev_err(dev, "%s not all buffers were freed\n", __func__);
++
++ return ret;
++}
++
++static int s10_ops_write_complete(struct fpga_manager *mgr,
++ struct fpga_image_info *info)
++{
++ struct s10_priv *priv = mgr->priv;
++ struct device *dev = priv->client.dev;
++ unsigned long timeout;
++ int ret;
++
++ timeout = usecs_to_jiffies(info->config_complete_timeout_us);
++
++ do {
++ reinit_completion(&priv->status_return_completion);
++
++ ret = s10_svc_send_msg(priv, COMMAND_RECONFIG_STATUS, NULL, 0);
++ if (ret < 0)
++ break;
++
++ ret = wait_for_completion_interruptible_timeout(
++ &priv->status_return_completion, timeout);
++ if (!ret) {
++ dev_err(dev,
++ "timeout waiting for RECONFIG_COMPLETED\n");
++ ret = -ETIMEDOUT;
++ break;
++ }
++ if (ret < 0) {
++ dev_err(dev,
++ "error (%d) waiting for RECONFIG_COMPLETED\n",
++ ret);
++ break;
++ }
++ /* Not error or timeout, so ret is # of jiffies until timeout */
++ timeout = ret;
++ ret = 0;
++
++ if (test_and_clear_bit(SVC_STATUS_RECONFIG_COMPLETED,
++ &priv->status))
++ break;
++
++ if (test_and_clear_bit(SVC_STATUS_RECONFIG_ERROR,
++ &priv->status)) {
++ dev_err(dev, "ERROR - giving up - SVC_STATUS_RECONFIG_ERROR\n");
++ ret = -EFAULT;
++ break;
++ }
++ } while (1);
++
++ stratix10_svc_done(priv->chan);
++
++ return ret;
++}
++
++static enum fpga_mgr_states s10_ops_state(struct fpga_manager *mgr)
++{
++ return FPGA_MGR_STATE_UNKNOWN;
++}
++
++static const struct fpga_manager_ops s10_ops = {
++ .state = s10_ops_state,
++ .write_init = s10_ops_write_init,
++ .write = s10_ops_write,
++ .write_complete = s10_ops_write_complete,
++};
++
++static int s10_probe(struct platform_device *pdev)
++{
++ struct device *dev = &pdev->dev;
++ struct s10_priv *priv;
++ struct fpga_manager *mgr;
++ int ret;
++
++ priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++
++ priv->client.dev = dev;
++ priv->client.receive_cb = s10_receive_callback;
++ priv->client.priv = priv;
++
++ priv->chan = stratix10_svc_request_channel_byname(&priv->client,
++ SVC_CLIENT_FPGA);
++ if (IS_ERR(priv->chan)) {
++ dev_err(dev, "couldn't get service channel (%s)\n",
++ SVC_CLIENT_FPGA);
++ return PTR_ERR(priv->chan);
++ }
++
++ init_completion(&priv->status_return_completion);
++
++ mgr = fpga_mgr_create(dev, "Stratix10 SOC FPGA Manager",
++ &s10_ops, priv);
++ if (!mgr) {
++ dev_err(dev, "unable to create FPGA manager\n");
++ ret = -ENOMEM;
++ goto probe_err;
++ }
++
++ ret = fpga_mgr_register(mgr);
++ if (ret) {
++ dev_err(dev, "unable to register FPGA manager\n");
++ fpga_mgr_free(mgr);
++ goto probe_err;
++ }
++
++ platform_set_drvdata(pdev, mgr);
++ return ret;
++
++probe_err:
++ stratix10_svc_free_channel(priv->chan);
++ return ret;
++}
++
++static int s10_remove(struct platform_device *pdev)
++{
++ struct fpga_manager *mgr = platform_get_drvdata(pdev);
++ struct s10_priv *priv = mgr->priv;
++
++ fpga_mgr_unregister(mgr);
++ stratix10_svc_free_channel(priv->chan);
++
++ return 0;
++}
++
++static const struct of_device_id s10_of_match[] = {
++ { .compatible = "intel,stratix10-soc-fpga-mgr", },
++ {},
++};
++
++MODULE_DEVICE_TABLE(of, s10_of_match);
++
++static struct platform_driver s10_driver = {
++ .probe = s10_probe,
++ .remove = s10_remove,
++ .driver = {
++ .name = "Stratix10 SoC FPGA manager",
++ .of_match_table = of_match_ptr(s10_of_match),
++ },
++};
++
++static int __init s10_init(void)
++{
++ struct device_node *fw_np;
++ struct device_node *np;
++ int ret;
++
++ fw_np = of_find_node_by_name(NULL, "svc");
++ if (!fw_np)
++ return -ENODEV;
++
++ np = of_find_matching_node(fw_np, s10_of_match);
++ if (!np) {
++ of_node_put(fw_np);
++ return -ENODEV;
++ }
++
++ of_node_put(np);
++ ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
++ of_node_put(fw_np);
++ if (ret)
++ return ret;
++
++ return platform_driver_register(&s10_driver);
++}
++
++static void __exit s10_exit(void)
++{
++ return platform_driver_unregister(&s10_driver);
++}
++
++module_init(s10_init);
++module_exit(s10_exit);
++
++MODULE_AUTHOR("Alan Tull <atull@kernel.org>");
++MODULE_DESCRIPTION("Intel Stratix 10 SOC FPGA Manager");
++MODULE_LICENSE("GPL v2");
diff --git a/patches.drivers/0001-fpga-stratix10-soc-fix-use-after-free-on-s10_init.patch b/patches.drivers/0001-fpga-stratix10-soc-fix-use-after-free-on-s10_init.patch
new file mode 100644
index 0000000000..d6de2f6824
--- /dev/null
+++ b/patches.drivers/0001-fpga-stratix10-soc-fix-use-after-free-on-s10_init.patch
@@ -0,0 +1,54 @@
+From f5dd87326fefe42a4b1a4b1a1a695060c33a88d6 Mon Sep 17 00:00:00 2001
+From: Wen Yang <wen.yang99@zte.com.cn>
+Date: Thu, 9 May 2019 16:08:26 -0500
+Subject: [PATCH] fpga: stratix10-soc: fix use-after-free on s10_init()
+Git-commit: f5dd87326fefe42a4b1a4b1a1a695060c33a88d6
+References: jsc#SLE-7057
+Patch-mainline: v5.2-rc4
+
+The refcount of fw_np has already been decreased by of_find_matching_node()
+so it shouldn't be used anymore.
+This patch adds an of_node_get() before of_find_matching_node() to avoid
+the use-after-free problem.
+
+Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
+Signed-off-by: Wen Yang <wen.yang99@zte.com.cn>
+Cc: Alan Tull <atull@kernel.org>
+Cc: Moritz Fischer <mdf@kernel.org>
+Cc: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Cc: linux-fpga@vger.kernel.org
+Cc: linux-kernel@vger.kernel.org
+Reviewed-by: Moritz Fischer <mdf@kernel.org>
+Reviewed-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Acked-by: Alan Tull <atull@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/fpga/stratix10-soc.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
+index 13851b3d1c56..215d33789c74 100644
+--- a/drivers/fpga/stratix10-soc.c
++++ b/drivers/fpga/stratix10-soc.c
+@@ -507,12 +507,16 @@ static int __init s10_init(void)
+ if (!fw_np)
+ return -ENODEV;
+
++ of_node_get(fw_np);
+ np = of_find_matching_node(fw_np, s10_of_match);
+- if (!np)
++ if (!np) {
++ of_node_put(fw_np);
+ return -ENODEV;
++ }
+
+ of_node_put(np);
+ ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
++ of_node_put(fw_np);
+ if (ret)
+ return ret;
+
+--
+2.16.4
+
diff --git a/patches.drivers/0001-fpga-stratix10-soc-fix-wrong-of_node_put-in-init-fun.patch b/patches.drivers/0001-fpga-stratix10-soc-fix-wrong-of_node_put-in-init-fun.patch
new file mode 100644
index 0000000000..256904ab06
--- /dev/null
+++ b/patches.drivers/0001-fpga-stratix10-soc-fix-wrong-of_node_put-in-init-fun.patch
@@ -0,0 +1,50 @@
+From 32a66374487bbd78115747f0084cea5e8fca4c80 Mon Sep 17 00:00:00 2001
+From: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Date: Sat, 26 Jan 2019 10:38:29 -0600
+Subject: [PATCH] fpga: stratix10-soc: fix wrong of_node_put() in init function
+Git-commit: 32a66374487bbd78115747f0084cea5e8fca4c80
+Patch-mainline: v5.0
+References: jsc#jsc#SLE-7057
+
+After finding a "firmware" dt node stratix10 tries to match it's
+compatible string with it. To do so it's calling of_find_matching_node()
+which already takes care of decreasing the refcount on the "firmware"
+node. We are then incorrectly decreasing the refcount on that node
+again.
+
+This patch removes the unwarranted call to of_node_put().
+
+Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
+Signed-off-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+Acked-by: Alan Tull <atull@kernel.org>
+Acked-by: Moritz Fischer <mdf@kernel.org>
+[atull: remove unnecessary braces]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/fpga/stratix10-soc.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/fpga/stratix10-soc.c b/drivers/fpga/stratix10-soc.c
+index a1a09e04fab8..13851b3d1c56 100644
+--- a/drivers/fpga/stratix10-soc.c
++++ b/drivers/fpga/stratix10-soc.c
+@@ -508,14 +508,11 @@ static int __init s10_init(void)
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, s10_of_match);
+- if (!np) {
+- of_node_put(fw_np);
++ if (!np)
+ return -ENODEV;
+- }
+
+ of_node_put(np);
+ ret = of_platform_populate(fw_np, s10_of_match, NULL, NULL);
+- of_node_put(fw_np);
+ if (ret)
+ return ret;
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Fix-intermittent-CORB-RIRB-stall-on-Intel-c.patch b/patches.drivers/ALSA-hda-Fix-intermittent-CORB-RIRB-stall-on-Intel-c.patch
new file mode 100644
index 0000000000..c9954d2fcc
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Fix-intermittent-CORB-RIRB-stall-on-Intel-c.patch
@@ -0,0 +1,53 @@
+From 2756d9143aa517b97961e85412882b8ce31371a6 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Fri, 19 Jul 2019 10:27:54 +0200
+Subject: [PATCH] ALSA: hda - Fix intermittent CORB/RIRB stall on Intel chips
+Git-commit: 2756d9143aa517b97961e85412882b8ce31371a6
+Patch-mainline: v5.3-rc2
+References: bsc#1111666
+
+It turned out that the recent Intel HD-audio controller chips show a
+significant stall during the system PM resume intermittently. It
+doesn't happen so often and usually it may read back successfully
+after one or more seconds, but in some rare worst cases the driver
+went into fallback mode.
+
+After trial-and-error, we found out that the communication stall seems
+covered by issuing the sync after each verb write, as already done for
+AMD and other chipsets. So this patch enables the write-sync flag for
+the recent Intel chips, Skylake and onward, as a workaround.
+
+Also, since Broxton and co have the very same driver flags as Skylake,
+refer to the Skylake driver flags instead of defining the same
+contents again for simplification.
+
+Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=201901
+Reported-and-tested-by: Todd Brandt <todd.e.brandt@linux.intel.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index cb8b0945547c..1e14d7270adf 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -313,11 +313,10 @@ enum {
+
+ #define AZX_DCAPS_INTEL_SKYLAKE \
+ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
++ AZX_DCAPS_SYNC_WRITE |\
+ AZX_DCAPS_SEPARATE_STREAM_TAG | AZX_DCAPS_I915_COMPONENT)
+
+-#define AZX_DCAPS_INTEL_BROXTON \
+- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\
+- AZX_DCAPS_SEPARATE_STREAM_TAG | AZX_DCAPS_I915_COMPONENT)
++#define AZX_DCAPS_INTEL_BROXTON AZX_DCAPS_INTEL_SKYLAKE
+
+ /* quirks for ATI SB / AMD Hudson */
+ #define AZX_DCAPS_PRESET_ATI_SB \
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Optimize-resume-for-codecs-without-jack-det.patch b/patches.drivers/ALSA-hda-Optimize-resume-for-codecs-without-jack-det.patch
new file mode 100644
index 0000000000..96b1840317
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Optimize-resume-for-codecs-without-jack-det.patch
@@ -0,0 +1,35 @@
+From 59d81c1e3cade953a0cb3f66ce9a3f2398fdfac3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 16 Jul 2019 11:52:00 +0200
+Subject: [PATCH] ALSA: hda - Optimize resume for codecs without jack detection
+Git-commit: 59d81c1e3cade953a0cb3f66ce9a3f2398fdfac3
+Patch-mainline: v5.3-rc2
+References: bsc#1111666
+
+The codecs without jack detection also don't have to be resumed
+forcibly because, obviously, they have no jack. Skip the forced
+resume in such a case as optimization as well.
+
+Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_codec.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index e30e86ca6b72..51f10ed9bc43 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2942,7 +2942,7 @@ static int hda_codec_runtime_resume(struct device *dev)
+ static int hda_codec_force_resume(struct device *dev)
+ {
+ struct hda_codec *codec = dev_to_hda_codec(dev);
+- bool forced_resume = !codec->relaxed_resume;
++ bool forced_resume = !codec->relaxed_resume && codec->jacktbl.used;
+ int ret;
+
+ /* The get/put pair below enforces the runtime resume even if the
+--
+2.16.4
+
diff --git a/patches.drivers/IB-ipoib-Add-child-to-parent-list-only-if-device-ini.patch b/patches.drivers/IB-ipoib-Add-child-to-parent-list-only-if-device-ini.patch
new file mode 100644
index 0000000000..560c7d279f
--- /dev/null
+++ b/patches.drivers/IB-ipoib-Add-child-to-parent-list-only-if-device-ini.patch
@@ -0,0 +1,90 @@
+From: Valentine Fatiev <valentinef@mellanox.com>
+Date: Sun, 30 Jun 2019 16:48:41 +0300
+Subject: IB/ipoib: Add child to parent list only if device initialized
+Patch-mainline: v5.3-rc1
+Git-commit: 91b01061fef9c57d2f5b712a6322ef51061f4efd
+References: bsc#1103992 FATE#326009
+
+Despite failure in ipoib_dev_init() we continue with initialization flow
+and creation of child device. It causes to the situation where this child
+device is added too early to parent device list.
+
+Change the logic, so in case of failure we properly return error from
+ipoib_dev_init() and add child only in success path.
+
+Fixes: eaeb39842508 ("IB/ipoib: Move init code to ndo_init")
+Signed-off-by: Valentine Fatiev <valentinef@mellanox.com>
+Reviewed-by: Feras Daoud <ferasda@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 34 +++++++++++++++++-------------
+ 1 file changed, 20 insertions(+), 14 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1891,12 +1891,6 @@ static void ipoib_child_init(struct net_
+ struct ipoib_dev_priv *priv = ipoib_priv(ndev);
+ struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
+
+- dev_hold(priv->parent);
+-
+- down_write(&ppriv->vlan_rwsem);
+- list_add_tail(&priv->list, &ppriv->child_intfs);
+- up_write(&ppriv->vlan_rwsem);
+-
+ priv->max_ib_mtu = ppriv->max_ib_mtu;
+ set_bit(IPOIB_FLAG_SUBINTERFACE, &priv->flags);
+ memcpy(priv->dev->dev_addr, ppriv->dev->dev_addr, INFINIBAND_ALEN);
+@@ -1939,6 +1933,17 @@ static int ipoib_ndo_init(struct net_dev
+ if (rc) {
+ pr_warn("%s: failed to initialize device: %s port %d (ret = %d)\n",
+ priv->ca->name, priv->dev->name, priv->port, rc);
++ return rc;
++ }
++
++ if (priv->parent) {
++ struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
++
++ dev_hold(priv->parent);
++
++ down_write(&ppriv->vlan_rwsem);
++ list_add_tail(&priv->list, &ppriv->child_intfs);
++ up_write(&ppriv->vlan_rwsem);
+ }
+
+ return 0;
+@@ -1956,6 +1961,14 @@ static void ipoib_ndo_uninit(struct net_
+ */
+ WARN_ON(!list_empty(&priv->child_intfs));
+
++ if (priv->parent) {
++ struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
++
++ down_write(&ppriv->vlan_rwsem);
++ list_del(&priv->list);
++ up_write(&ppriv->vlan_rwsem);
++ }
++
+ ipoib_neigh_hash_uninit(dev);
+
+ ipoib_ib_dev_cleanup(dev);
+@@ -1967,15 +1980,8 @@ static void ipoib_ndo_uninit(struct net_
+ priv->wq = NULL;
+ }
+
+- if (priv->parent) {
+- struct ipoib_dev_priv *ppriv = ipoib_priv(priv->parent);
+-
+- down_write(&ppriv->vlan_rwsem);
+- list_del(&priv->list);
+- up_write(&ppriv->vlan_rwsem);
+-
++ if (priv->parent)
+ dev_put(priv->parent);
+- }
+ }
+
+ static int ipoib_set_vf_link_state(struct net_device *dev, int vf, int link_state)
diff --git a/patches.drivers/IB-mlx5-Fixed-reporting-counters-on-2nd-port-for-Dua.patch b/patches.drivers/IB-mlx5-Fixed-reporting-counters-on-2nd-port-for-Dua.patch
new file mode 100644
index 0000000000..21fd4295d3
--- /dev/null
+++ b/patches.drivers/IB-mlx5-Fixed-reporting-counters-on-2nd-port-for-Dua.patch
@@ -0,0 +1,173 @@
+From: Parav Pandit <parav@mellanox.com>
+Date: Sun, 30 Jun 2019 10:52:52 +0300
+Subject: IB/mlx5: Fixed reporting counters on 2nd port for Dual port RoCE
+Patch-mainline: v5.3-rc1
+Git-commit: 2f40cf30c8644360d37287861d5288f00eab35e5
+References: bsc#1103991 FATE#326007
+
+Currently during dual port IB device registration in below code flow,
+
+ib_register_device()
+ ib_device_register_sysfs()
+ ib_setup_port_attrs()
+ add_port()
+ get_counter_table()
+ get_perf_mad()
+ process_mad()
+ mlx5_ib_process_mad()
+
+mlx5_ib_process_mad() fails on 2nd port when both the ports are not fully
+setup at the device level (because 2nd port is unaffiliated).
+
+As a result, get_perf_mad() registers different PMA counter group for 1st
+and 2nd port, namely pma_counter_ext and pma_counter. However both ports
+have the same capability and counter offsets.
+
+Due to this when counters are read by the user via sysfs in below code
+flow, counters are queried from wrong location from the device mainly from
+PPCNT instead of VPORT counters.
+
+show_pma_counter()
+ get_perf_mad()
+ process_mad()
+ mlx5_ib_process_mad()
+ process_pma_cmd()
+
+This shows all zero counters for 2nd port.
+
+To overcome this, process_pma_cmd() is invoked, and when unaffiliated port
+is not yet setup during device registration phase, make the query on the
+first port. while at it, only process_pma_cmd() needs to work on the
+native port number and underlying mdev, so shift the get, put calls to
+where its needed inside process_pma_cmd().
+
+Fixes: 212f2a87b74f ("IB/mlx5: Route MADs for dual port RoCE")
+Signed-off-by: Parav Pandit <parav@mellanox.com>
+Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/mad.c | 60 +++++++++++++++++++++++----------------
+ 1 file changed, 36 insertions(+), 24 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/mad.c
++++ b/drivers/infiniband/hw/mlx5/mad.c
+@@ -197,19 +197,33 @@ static void pma_cnt_assign(struct ib_pma
+ vl_15_dropped);
+ }
+
+-static int process_pma_cmd(struct mlx5_core_dev *mdev, u8 port_num,
++static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num,
+ const struct ib_mad *in_mad, struct ib_mad *out_mad)
+ {
+- int err;
++ struct mlx5_core_dev *mdev;
++ bool native_port = true;
++ u8 mdev_port_num;
+ void *out_cnt;
++ int err;
+
++ mdev = mlx5_ib_get_native_port_mdev(dev, port_num, &mdev_port_num);
++ if (!mdev) {
++ /* Fail to get the native port, likely due to 2nd port is still
++ * unaffiliated. In such case default to 1st port and attached
++ * PF device.
++ */
++ native_port = false;
++ mdev = dev->mdev;
++ mdev_port_num = 1;
++ }
+ /* Declaring support of extended counters */
+ if (in_mad->mad_hdr.attr_id == IB_PMA_CLASS_PORT_INFO) {
+ struct ib_class_port_info cpi = {};
+
+ cpi.capability_mask = IB_PMA_CLASS_CAP_EXT_WIDTH;
+ memcpy((out_mad->data + 40), &cpi, sizeof(cpi));
+- return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++ err = IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++ goto done;
+ }
+
+ if (in_mad->mad_hdr.attr_id == IB_PMA_PORT_COUNTERS_EXT) {
+@@ -218,11 +232,13 @@ static int process_pma_cmd(struct mlx5_c
+ int sz = MLX5_ST_SZ_BYTES(query_vport_counter_out);
+
+ out_cnt = kvzalloc(sz, GFP_KERNEL);
+- if (!out_cnt)
+- return IB_MAD_RESULT_FAILURE;
++ if (!out_cnt) {
++ err = IB_MAD_RESULT_FAILURE;
++ goto done;
++ }
+
+ err = mlx5_core_query_vport_counter(mdev, 0, 0,
+- port_num, out_cnt, sz);
++ mdev_port_num, out_cnt, sz);
+ if (!err)
+ pma_cnt_ext_assign(pma_cnt_ext, out_cnt);
+ } else {
+@@ -231,20 +247,23 @@ static int process_pma_cmd(struct mlx5_c
+ int sz = MLX5_ST_SZ_BYTES(ppcnt_reg);
+
+ out_cnt = kvzalloc(sz, GFP_KERNEL);
+- if (!out_cnt)
+- return IB_MAD_RESULT_FAILURE;
++ if (!out_cnt) {
++ err = IB_MAD_RESULT_FAILURE;
++ goto done;
++ }
+
+- err = mlx5_core_query_ib_ppcnt(mdev, port_num,
++ err = mlx5_core_query_ib_ppcnt(mdev, mdev_port_num,
+ out_cnt, sz);
+ if (!err)
+ pma_cnt_assign(pma_cnt, out_cnt);
+- }
+-
++ }
+ kvfree(out_cnt);
+- if (err)
+- return IB_MAD_RESULT_FAILURE;
+-
+- return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++ err = err ? IB_MAD_RESULT_FAILURE :
++ IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
++done:
++ if (native_port)
++ mlx5_ib_put_native_port_mdev(dev, port_num);
++ return err;
+ }
+
+ int mlx5_ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+@@ -256,8 +275,6 @@ int mlx5_ib_process_mad(struct ib_device
+ struct mlx5_ib_dev *dev = to_mdev(ibdev);
+ const struct ib_mad *in_mad = (const struct ib_mad *)in;
+ struct ib_mad *out_mad = (struct ib_mad *)out;
+- struct mlx5_core_dev *mdev;
+- u8 mdev_port_num;
+ int ret;
+
+ if (WARN_ON_ONCE(in_mad_size != sizeof(*in_mad) ||
+@@ -266,19 +283,14 @@ int mlx5_ib_process_mad(struct ib_device
+
+ memset(out_mad->data, 0, sizeof(out_mad->data));
+
+- mdev = mlx5_ib_get_native_port_mdev(dev, port_num, &mdev_port_num);
+- if (!mdev)
+- return IB_MAD_RESULT_FAILURE;
+-
+- if (MLX5_CAP_GEN(mdev, vport_counters) &&
++ if (MLX5_CAP_GEN(dev->mdev, vport_counters) &&
+ in_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_PERF_MGMT &&
+ in_mad->mad_hdr.method == IB_MGMT_METHOD_GET) {
+- ret = process_pma_cmd(mdev, mdev_port_num, in_mad, out_mad);
++ ret = process_pma_cmd(dev, port_num, in_mad, out_mad);
+ } else {
+ ret = process_mad(ibdev, mad_flags, port_num, in_wc, in_grh,
+ in_mad, out_mad);
+ }
+- mlx5_ib_put_native_port_mdev(dev, port_num);
+ return ret;
+ }
+
diff --git a/patches.drivers/PCI-AER-Use-cached-AER-Capability-offset.patch b/patches.drivers/PCI-AER-Use-cached-AER-Capability-offset.patch
new file mode 100644
index 0000000000..b050163ec9
--- /dev/null
+++ b/patches.drivers/PCI-AER-Use-cached-AER-Capability-offset.patch
@@ -0,0 +1,116 @@
+From f0553ba08a19031726f120448eedc3aff1599c23 Mon Sep 17 00:00:00 2001
+From: Frederick Lawler <fred@fredlawl.com>
+Date: Thu, 22 Mar 2018 16:20:55 -0500
+Subject: [PATCH] PCI/AER: Use cached AER Capability offset
+Git-commit: f0553ba08a19031726f120448eedc3aff1599c23
+Patch-mainline: v4.17-rc1
+References: bsc#1142623
+
+Replace pci_find_ext_capability(..., PCI_EXT_CAP_ID_ERR) calls with
+pci_dev->aer_cap.
+
+pci_dev->aer_cap is initialized in pci_init_capabilities(), which happens
+before any of these users of the AER Capability.
+
+Signed-off-by: Frederick Lawler <fred@fredlawl.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/aer/aer_inject.c | 4 ++--
+ drivers/pci/pcie/aer/ecrc.c | 4 ++--
+ drivers/pci/pcie/portdrv_core.c | 14 ++++++++++----
+ 3 files changed, 14 insertions(+), 8 deletions(-)
+
+--- a/drivers/pci/pcie/aer/aer_inject.c
++++ b/drivers/pci/pcie/aer/aer_inject.c
+@@ -349,7 +349,7 @@ static int aer_inject(struct aer_error_i
+ goto out_put;
+ }
+
+- pos_cap_err = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
++ pos_cap_err = dev->aer_cap;
+ if (!pos_cap_err) {
+ pci_err(dev, "aer_inject: Device doesn't support AER\n");
+ ret = -EPROTONOSUPPORT;
+@@ -360,7 +360,7 @@ static int aer_inject(struct aer_error_i
+ pci_read_config_dword(dev, pos_cap_err + PCI_ERR_UNCOR_MASK,
+ &uncor_mask);
+
+- rp_pos_cap_err = pci_find_ext_capability(rpdev, PCI_EXT_CAP_ID_ERR);
++ rp_pos_cap_err = rpdev->aer_cap;
+ if (!rp_pos_cap_err) {
+ pci_err(rpdev, "aer_inject: Root port doesn't support AER\n");
+ ret = -EPROTONOSUPPORT;
+--- a/drivers/pci/pcie/aer/ecrc.c
++++ b/drivers/pci/pcie/aer/ecrc.c
+@@ -54,7 +54,7 @@ static int enable_ecrc_checking(struct p
+ if (!pci_is_pcie(dev))
+ return -ENODEV;
+
+- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
++ pos = dev->aer_cap;
+ if (!pos)
+ return -ENODEV;
+
+@@ -82,7 +82,7 @@ static int disable_ecrc_checking(struct
+ if (!pci_is_pcie(dev))
+ return -ENODEV;
+
+- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
++ pos = dev->aer_cap;
+ if (!pos)
+ return -ENODEV;
+
+--- a/drivers/pci/pcie/portdrv_core.c
++++ b/drivers/pci/pcie/portdrv_core.c
+@@ -50,7 +50,7 @@ static void release_pcie_device(struct d
+ static int pcie_message_numbers(struct pci_dev *dev, int mask,
+ u32 *pme, u32 *aer, u32 *dpc)
+ {
+- u32 nvec = 0, pos, reg32;
++ u32 nvec = 0, pos;
+ u16 reg16;
+
+ /*
+@@ -66,8 +66,11 @@ static int pcie_message_numbers(struct p
+ nvec = *pme + 1;
+ }
+
++#ifdef CONFIG_PCIEAER
+ if (mask & PCIE_PORT_SERVICE_AER) {
+- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
++ u32 reg32;
++
++ pos = dev->aer_cap;
+ if (pos) {
+ pci_read_config_dword(dev, pos + PCI_ERR_ROOT_STATUS,
+ &reg32);
+@@ -75,6 +78,7 @@ static int pcie_message_numbers(struct p
+ nvec = max(nvec, *aer + 1);
+ }
+ }
++#endif
+
+ if (mask & PCIE_PORT_SERVICE_DPC) {
+ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC);
+@@ -222,8 +226,9 @@ static int get_port_device_capability(st
+ PCI_EXP_SLTCTL_CCIE | PCI_EXP_SLTCTL_HPIE);
+ }
+
+- if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR) &&
+- pci_aer_available() && (pcie_ports_native || host->native_aer)) {
++#ifdef CONFIG_PCIEAER
++ if (dev->aer_cap && pci_aer_available() &&
++ (pcie_ports_native || host->native_aer)) {
+ services |= PCIE_PORT_SERVICE_AER;
+
+ /*
+@@ -232,6 +237,7 @@ static int get_port_device_capability(st
+ */
+ pci_disable_pcie_error_reporting(dev);
+ }
++#endif
+ /* VC support */
+ if (pci_find_ext_capability(dev, PCI_EXT_CAP_ID_VC))
+ services |= PCIE_PORT_SERVICE_VC;
diff --git a/patches.drivers/PCI-PM-Use-SMART_SUSPEND-and-LEAVE_SUSPENDED-flags-f.patch b/patches.drivers/PCI-PM-Use-SMART_SUSPEND-and-LEAVE_SUSPENDED-flags-f.patch
new file mode 100644
index 0000000000..696264fd7c
--- /dev/null
+++ b/patches.drivers/PCI-PM-Use-SMART_SUSPEND-and-LEAVE_SUSPENDED-flags-f.patch
@@ -0,0 +1,38 @@
+From 877b3729ca03b00800b99ac0c076e9456ef3ae6b Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Wed, 3 Jan 2018 01:38:27 +0100
+Subject: [PATCH] PCI / PM: Use SMART_SUSPEND and LEAVE_SUSPENDED flags for PCIe ports
+Git-commit: 877b3729ca03b00800b99ac0c076e9456ef3ae6b
+Patch-mainline: v4.16-rc1
+References: bsc#1142623
+
+Make the PCIe port driver set DPM_FLAG_SMART_SUSPEND and
+DPM_FLAG_LEAVE_SUSPENDED for the devices handled by it to benefit
+from the opportunistic optimizations in the PCI layer enabled by
+these flags.
+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_pci.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index ffbf4e723527..fb1c1bb87316 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -150,6 +150,9 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
+
+ pci_save_state(dev);
+
++ dev_pm_set_driver_flags(&dev->dev, DPM_FLAG_SMART_SUSPEND |
++ DPM_FLAG_LEAVE_SUSPENDED);
++
+ if (pci_bridge_d3_possible(dev)) {
+ /*
+ * Keep the port resumed 100ms to make sure things like
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-portdrv-Add-defines-for-AER-and-DPC-Interrupt-Me.patch b/patches.drivers/PCI-portdrv-Add-defines-for-AER-and-DPC-Interrupt-Me.patch
new file mode 100644
index 0000000000..c4fbf1f466
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Add-defines-for-AER-and-DPC-Interrupt-Me.patch
@@ -0,0 +1,61 @@
+From 7c950b9e53732f574e3a46d37c62f1f33d0b218c Mon Sep 17 00:00:00 2001
+From: Dongdong Liu <liudongdong3@huawei.com>
+Date: Wed, 11 Oct 2017 18:52:58 +0800
+Subject: [PATCH] PCI/portdrv: Add #defines for AER and DPC Interrupt Message Number masks
+Git-commit: 7c950b9e53732f574e3a46d37c62f1f33d0b218c
+Patch-mainline: v4.15-rc1
+References: bsc#1142623
+
+In the AER case, the mask isn't strictly necessary because there are no
+higher-order bits above the Interrupt Message Number, but using a #define
+will make it possible to grep for it.
+
+Suggested-by: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Dongdong Liu <liudongdong3@huawei.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_core.c | 4 ++--
+ include/uapi/linux/pci_regs.h | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/pcie/portdrv_core.c
++++ b/drivers/pci/pcie/portdrv_core.c
+@@ -114,7 +114,7 @@ static int pcie_port_enable_irq_vec(stru
+ */
+ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
+ pci_read_config_dword(dev, pos + PCI_ERR_ROOT_STATUS, &reg32);
+- entry = reg32 >> 27;
++ entry = (reg32 & PCI_ERR_ROOT_AER_IRQ) >> 27;
+ if (entry >= nr_entries)
+ goto out_free_irqs;
+
+@@ -141,7 +141,7 @@ static int pcie_port_enable_irq_vec(stru
+ */
+ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC);
+ pci_read_config_word(dev, pos + PCI_EXP_DPC_CAP, &reg16);
+- entry = reg16 & 0x1f;
++ entry = reg16 & PCI_EXP_DPC_IRQ;
+ if (entry >= nr_entries)
+ goto out_free_irqs;
+
+--- a/include/uapi/linux/pci_regs.h
++++ b/include/uapi/linux/pci_regs.h
+@@ -750,6 +750,7 @@
+ #define PCI_ERR_ROOT_FIRST_FATAL 0x00000010 /* First Fatal */
+ #define PCI_ERR_ROOT_NONFATAL_RCV 0x00000020 /* Non-Fatal Received */
+ #define PCI_ERR_ROOT_FATAL_RCV 0x00000040 /* Fatal Received */
++#define PCI_ERR_ROOT_AER_IRQ 0xf8000000 /* Advanced Error Interrupt Message Number */
+ #define PCI_ERR_ROOT_ERR_SRC 52 /* Error Source Identification */
+
+ /* Virtual Channel */
+@@ -964,6 +965,7 @@
+
+ /* Downstream Port Containment */
+ #define PCI_EXP_DPC_CAP 4 /* DPC Capability */
++#define PCI_EXP_DPC_IRQ 0x1f /* DPC Interrupt Message Number */
+ #define PCI_EXP_DPC_CAP_RP_EXT 0x20 /* Root Port Extensions for DPC */
+ #define PCI_EXP_DPC_CAP_POISONED_TLP 0x40 /* Poisoned TLP Egress Blocking Supported */
+ #define PCI_EXP_DPC_CAP_SW_TRIGGER 0x80 /* Software Triggering Supported */
diff --git a/patches.drivers/PCI-portdrv-Consolidate-comments.patch b/patches.drivers/PCI-portdrv-Consolidate-comments.patch
new file mode 100644
index 0000000000..112a8395eb
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Consolidate-comments.patch
@@ -0,0 +1,133 @@
+From b8acfd7c0f88c49dc0089cd40e02040187160f6a Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Thu, 19 Oct 2017 16:09:26 -0500
+Subject: [PATCH] PCI/portdrv: Consolidate comments
+Git-commit: b8acfd7c0f88c49dc0089cd40e02040187160f6a
+Patch-mainline: v4.15-rc1
+References: bsc#1142623
+
+Consolidate some repetitive comments so we can see the code better. No
+functional change.
+
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_core.c | 63 ++++++-----------------------------------
+ 1 file changed, 9 insertions(+), 54 deletions(-)
+
+diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
+index 72fcbe5567dd..accd16082348 100644
+--- a/drivers/pci/pcie/portdrv_core.c
++++ b/drivers/pci/pcie/portdrv_core.c
+@@ -56,40 +56,27 @@ static int pcie_port_enable_irq_vec(struct pci_dev *dev, int *irqs, int mask)
+ {
+ int nr_entries, entry, nvec = 0;
+
+- /*
+- * Allocate as many entries as the port wants, so that we can check
+- * which of them will be useful. Moreover, if nr_entries is correctly
+- * equal to the number of entries this port actually uses, we'll happily
+- * go through without any tricks.
+- */
++ /* Allocate the maximum possible number of MSI/MSI-X vectors */
+ nr_entries = pci_alloc_irq_vectors(dev, 1, PCIE_PORT_MAX_MSI_ENTRIES,
+ PCI_IRQ_MSIX | PCI_IRQ_MSI);
+ if (nr_entries < 0)
+ return nr_entries;
+
++ /*
++ * The Interrupt Message Number indicates which vector is used, i.e.,
++ * the MSI-X table entry or the MSI offset between the base Message
++ * Data and the generated interrupt message. See PCIe r3.1, sec
++ * 7.8.2, 7.10.10, 7.31.2.
++ */
+ if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP)) {
+ u16 reg16;
+
+- /*
+- * Per PCIe r3.1, sec 6.1.6, "PME and Hot-Plug Event
+- * interrupts (when both are implemented) always share the
+- * same MSI or MSI-X vector, as indicated by the Interrupt
+- * Message Number field in the PCI Express Capabilities
+- * register".
+- *
+- * Per sec 7.8.2, "For MSI, the [Interrupt Message Number]
+- * indicates the offset between the base Message Data and
+- * the interrupt message that is generated."
+- *
+- * "For MSI-X, the [Interrupt Message Number] indicates
+- * which MSI-X Table entry is used to generate the
+- * interrupt message."
+- */
+ pcie_capability_read_word(dev, PCI_EXP_FLAGS, &reg16);
+ entry = (reg16 & PCI_EXP_FLAGS_IRQ) >> 9;
+ if (entry >= nr_entries)
+ goto out_free_irqs;
+
++ /* PME and hotplug share an MSI/MSI-X vector */
+ irqs[PCIE_PORT_SERVICE_PME_SHIFT] = pci_irq_vector(dev, entry);
+ irqs[PCIE_PORT_SERVICE_HP_SHIFT] = pci_irq_vector(dev, entry);
+
+@@ -99,19 +86,6 @@ static int pcie_port_enable_irq_vec(struct pci_dev *dev, int *irqs, int mask)
+ if (mask & PCIE_PORT_SERVICE_AER) {
+ u32 reg32, pos;
+
+- /*
+- * Per PCIe r3.1, sec 7.10.10, the Advanced Error Interrupt
+- * Message Number in the Root Error Status register
+- * indicates which MSI/MSI-X vector is used for AER.
+- *
+- * "For MSI, the [Advanced Error Interrupt Message Number]
+- * indicates the offset between the base Message Data and
+- * the interrupt message that is generated."
+- *
+- * "For MSI-X, the [Advanced Error Interrupt Message
+- * Number] indicates which MSI-X Table entry is used to
+- * generate the interrupt message."
+- */
+ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
+ pci_read_config_dword(dev, pos + PCI_ERR_ROOT_STATUS, &reg32);
+ entry = (reg32 & PCI_ERR_ROOT_AER_IRQ) >> 27;
+@@ -126,19 +100,6 @@ static int pcie_port_enable_irq_vec(struct pci_dev *dev, int *irqs, int mask)
+ if (mask & PCIE_PORT_SERVICE_DPC) {
+ u16 reg16, pos;
+
+- /*
+- * Per PCIe r4.0 (v0.9), sec 7.9.15.2, the DPC Interrupt
+- * Message Number in the DPC Capability register indicates
+- * which MSI/MSI-X vector is used for DPC.
+- *
+- * "For MSI, the [DPC Interrupt Message Number] indicates
+- * the offset between the base Message Data and the
+- * interrupt message that is generated."
+- *
+- * "For MSI-X, the [DPC Interrupt Message Number] indicates
+- * which MSI-X Table entry is used to generate the
+- * interrupt message."
+- */
+ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC);
+ pci_read_config_word(dev, pos + PCI_EXP_DPC_CAP, &reg16);
+ entry = reg16 & PCI_EXP_DPC_IRQ;
+@@ -150,16 +111,10 @@ static int pcie_port_enable_irq_vec(struct pci_dev *dev, int *irqs, int mask)
+ nvec = max(nvec, entry + 1);
+ }
+
+- /*
+- * If nvec is equal to the allocated number of entries, we can just use
+- * what we have. Otherwise, the port has some extra entries not for the
+- * services we know and we need to work around that.
+- */
++ /* If we allocated more than we need, free them and allocate fewer */
+ if (nvec != nr_entries) {
+- /* Drop the temporary MSI-X setup */
+ pci_free_irq_vectors(dev);
+
+- /* Now allocate the MSI-X vectors for real */
+ nr_entries = pci_alloc_irq_vectors(dev, nvec, nvec,
+ PCI_IRQ_MSIX | PCI_IRQ_MSI);
+ if (nr_entries < 0)
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-portdrv-Disable-port-driver-in-compat-mode.patch b/patches.drivers/PCI-portdrv-Disable-port-driver-in-compat-mode.patch
new file mode 100644
index 0000000000..dbfaca0828
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Disable-port-driver-in-compat-mode.patch
@@ -0,0 +1,63 @@
+From 79a011194b23302dc43f265ed4237054877768ff Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Fri, 9 Mar 2018 11:06:56 -0600
+Subject: [PATCH] PCI/portdrv: Disable port driver in compat mode
+Git-commit: 79a011194b23302dc43f265ed4237054877768ff
+Patch-mainline: v4.17-rc1
+References: bsc#1142623
+
+The "pcie_ports=compat" kernel parameter sets pcie_ports_disabled, which is
+intended to disable the PCIe port driver. But even when it was disabled,
+we registered pcie_portdriver so we could work around a BIOS PME issue (see
+fe31e69740ed ("PCI/PCIe: Clear Root PME Status bits early during system
+resume")).
+
+Registering the driver meant that the pcie_portdrv_probe() path called
+pci_enable_device(), pci_save_state(), pm_runtime_set_autosuspend_delay(),
+pm_runtime_use_autosuspend(), etc., even when the driver was disabled.
+
+We've since moved the BIOS PME workaround from the port driver to the core,
+so stop registering the PCIe port driver in compat mode.
+
+This means "pcie_ports=compat" will now be basically the same as turning
+off CONFIG_PCIEPORTBUS completely.
+
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_core.c | 3 ---
+ drivers/pci/pcie/portdrv_pci.c | 2 +-
+ 2 files changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/drivers/pci/pcie/portdrv_core.c b/drivers/pci/pcie/portdrv_core.c
+index 4268b2fc2c7a..9a41751db332 100644
+--- a/drivers/pci/pcie/portdrv_core.c
++++ b/drivers/pci/pcie/portdrv_core.c
+@@ -211,9 +211,6 @@ static int get_port_device_capability(struct pci_dev *dev)
+ int services = 0;
+ int cap_mask = 0;
+
+- if (pcie_ports_disabled)
+- return 0;
+-
+ cap_mask = PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP
+ | PCIE_PORT_SERVICE_VC;
+ if (pci_aer_available())
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index ec9e936c2a5b..5d9d5305ebef 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -261,7 +261,7 @@ static int __init pcie_portdrv_init(void)
+ int retval;
+
+ if (pcie_ports_disabled)
+- return pci_register_driver(&pcie_portdriver);
++ return -EACCES;
+
+ dmi_check_system(pcie_portdrv_dmi_table);
+
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-portdrv-Remove-pcie_portdrv_err_handler.slot_res.patch b/patches.drivers/PCI-portdrv-Remove-pcie_portdrv_err_handler.slot_res.patch
new file mode 100644
index 0000000000..8000deecf8
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Remove-pcie_portdrv_err_handler.slot_res.patch
@@ -0,0 +1,74 @@
+From 89e1f5cb1ecc1cd509a196f4e79d12a1e39410b6 Mon Sep 17 00:00:00 2001
+From: Oza Pawandeep <poza@codeaurora.org>
+Date: Thu, 19 Jul 2018 17:58:10 -0500
+Subject: [PATCH] PCI/portdrv: Remove pcie_portdrv_err_handler.slot_reset
+Git-commit: 89e1f5cb1ecc1cd509a196f4e79d12a1e39410b6
+Patch-mainline: v4.19-rc1
+References: bsc#1142623
+
+The pci_error_handlers.slot_reset() callback is only used for non-bridge
+devices (see broadcast_error_message()). Since portdrv only binds to
+bridges, we don't need pcie_portdrv_slot_reset(), so remove it.
+
+Signed-off-by: Oza Pawandeep <poza@codeaurora.org>
+[bhelgaas: changelog, remove pcie_portdrv_slot_reset() completely]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_pci.c | 25 -------------------------
+ 1 file changed, 25 deletions(-)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 973f1b80a038..b78840f54a9b 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -42,17 +42,6 @@ __setup("pcie_ports=", pcie_port_setup);
+
+ /* global data */
+
+-static int pcie_portdrv_restore_config(struct pci_dev *dev)
+-{
+- int retval;
+-
+- retval = pci_enable_device(dev);
+- if (retval)
+- return retval;
+- pci_set_master(dev);
+- return 0;
+-}
+-
+ #ifdef CONFIG_PM
+ static int pcie_port_runtime_suspend(struct device *dev)
+ {
+@@ -160,19 +149,6 @@ static pci_ers_result_t pcie_portdrv_mmio_enabled(struct pci_dev *dev)
+ return PCI_ERS_RESULT_RECOVERED;
+ }
+
+-static pci_ers_result_t pcie_portdrv_slot_reset(struct pci_dev *dev)
+-{
+- /* If fatal, restore cfg space for possible link reset at upstream */
+- if (dev->error_state == pci_channel_io_frozen) {
+- dev->state_saved = true;
+- pci_restore_state(dev);
+- pcie_portdrv_restore_config(dev);
+- pci_enable_pcie_error_reporting(dev);
+- }
+-
+- return PCI_ERS_RESULT_RECOVERED;
+-}
+-
+ static int resume_iter(struct device *device, void *data)
+ {
+ struct pcie_device *pcie_device;
+@@ -208,7 +184,6 @@ static const struct pci_device_id port_pci_ids[] = { {
+ static const struct pci_error_handlers pcie_portdrv_err_handler = {
+ .error_detected = pcie_portdrv_error_detected,
+ .mmio_enabled = pcie_portdrv_mmio_enabled,
+- .slot_reset = pcie_portdrv_slot_reset,
+ .resume = pcie_portdrv_err_resume,
+ };
+
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-portdrv-Restore-PCI-config-state-on-slot-reset.patch b/patches.drivers/PCI-portdrv-Restore-PCI-config-state-on-slot-reset.patch
new file mode 100644
index 0000000000..be11b6a23d
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Restore-PCI-config-state-on-slot-reset.patch
@@ -0,0 +1,50 @@
+From 874b3251113a1e2cbe79c24994dc03fe4fe4b99b Mon Sep 17 00:00:00 2001
+From: Keith Busch <keith.busch@intel.com>
+Date: Thu, 20 Sep 2018 10:27:07 -0600
+Subject: [PATCH] PCI: portdrv: Restore PCI config state on slot reset
+Git-commit: 874b3251113a1e2cbe79c24994dc03fe4fe4b99b
+Patch-mainline: v4.20-rc1
+References: bsc#1142623
+
+The port's config space may be cleared after a link reset, which wipes out
+the bridge's bus and memory windows. Restore the config space that was
+saved during probe so we can access downstream devices.
+
+Signed-off-by: Keith Busch <keith.busch@intel.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Sinan Kaya <okaya@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_pci.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 23a5a0c2c3fe..17256733fa43 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -146,6 +146,13 @@ static pci_ers_result_t pcie_portdrv_error_detected(struct pci_dev *dev,
+ return PCI_ERS_RESULT_CAN_RECOVER;
+ }
+
++static pci_ers_result_t pcie_portdrv_slot_reset(struct pci_dev *dev)
++{
++ pci_restore_state(dev);
++ pci_save_state(dev);
++ return PCI_ERS_RESULT_RECOVERED;
++}
++
+ static pci_ers_result_t pcie_portdrv_mmio_enabled(struct pci_dev *dev)
+ {
+ return PCI_ERS_RESULT_RECOVERED;
+@@ -185,6 +192,7 @@ static const struct pci_device_id port_pci_ids[] = { {
+
+ static const struct pci_error_handlers pcie_portdrv_err_handler = {
+ .error_detected = pcie_portdrv_error_detected,
++ .slot_reset = pcie_portdrv_slot_reset,
+ .mmio_enabled = pcie_portdrv_mmio_enabled,
+ .resume = pcie_portdrv_err_resume,
+ };
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-portdrv-Support-PCIe-services-on-subtractive-dec.patch b/patches.drivers/PCI-portdrv-Support-PCIe-services-on-subtractive-dec.patch
new file mode 100644
index 0000000000..d023f47d10
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Support-PCIe-services-on-subtractive-dec.patch
@@ -0,0 +1,37 @@
+From f0cfecea8d1e8e0cd5d5053f9452b3a450f49eb5 Mon Sep 17 00:00:00 2001
+From: Honghui Zhang <honghui.zhang@mediatek.com>
+Date: Thu, 14 Feb 2019 13:21:17 +0800
+Subject: [PATCH] PCI/portdrv: Support PCIe services on subtractive decode bridges
+Git-commit: f0cfecea8d1e8e0cd5d5053f9452b3a450f49eb5
+Patch-mainline: v5.1-rc1
+References: bsc#1142623
+
+The Class Code for subtractive decode PCI-to-PCI bridge is 060401h; add an
+entry to make portdrv support this type of bridge. This allows use of PCIe
+services on subtractive decode ports.
+
+Signed-off-by: Honghui Zhang <honghui.zhang@mediatek.com>
+[bhelgaas: add braces surrounding entry]
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index a289e734b9a4..99d2abe88d0b 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -185,6 +185,8 @@ static void pcie_portdrv_err_resume(struct pci_dev *dev)
+ static const struct pci_device_id port_pci_ids[] = {
+ /* handle any PCI-Express port */
+ { PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0) },
++ /* subtractive decode PCI-to-PCI bridge, class type is 060401h */
++ { PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x01), ~0) },
+ { },
+ };
+
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-portdrv-Use-conventional-Device-ID-table-formatt.patch b/patches.drivers/PCI-portdrv-Use-conventional-Device-ID-table-formatt.patch
new file mode 100644
index 0000000000..9fee15a2e6
--- /dev/null
+++ b/patches.drivers/PCI-portdrv-Use-conventional-Device-ID-table-formatt.patch
@@ -0,0 +1,40 @@
+From c89f7f98c971e0cabc819b6c0fe6bf509287b7e0 Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Fri, 15 Feb 2019 13:49:18 -0600
+Subject: [PATCH] PCI/portdrv: Use conventional Device ID table formatting
+Git-commit: c89f7f98c971e0cabc819b6c0fe6bf509287b7e0
+Patch-mainline: v5.1-rc1
+References: bsc#1142623
+
+The pci_device_id table was technically correct, but unusually formatted,
+which made adding entries error-prone. Change the format so it's obvious
+how to add entries.
+
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pcie/portdrv_pci.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
+index 0acca3596807..a289e734b9a4 100644
+--- a/drivers/pci/pcie/portdrv_pci.c
++++ b/drivers/pci/pcie/portdrv_pci.c
+@@ -182,10 +182,10 @@ static void pcie_portdrv_err_resume(struct pci_dev *dev)
+ /*
+ * LINUX Device Driver Model
+ */
+-static const struct pci_device_id port_pci_ids[] = { {
++static const struct pci_device_id port_pci_ids[] = {
+ /* handle any PCI-Express port */
+- PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
+- }, { /* end: all zeroes */ }
++ { PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0) },
++ { },
+ };
+
+ static const struct pci_error_handlers pcie_portdrv_err_handler = {
+--
+2.16.4
+
diff --git a/patches.drivers/RDMA-odp-Fix-missed-unlock-in-non-blocking-invalidat.patch b/patches.drivers/RDMA-odp-Fix-missed-unlock-in-non-blocking-invalidat.patch
new file mode 100644
index 0000000000..d2a15878ec
--- /dev/null
+++ b/patches.drivers/RDMA-odp-Fix-missed-unlock-in-non-blocking-invalidat.patch
@@ -0,0 +1,45 @@
+From: Jason Gunthorpe <jgg@mellanox.com>
+Date: Tue, 11 Jun 2019 13:09:51 -0300
+Subject: RDMA/odp: Fix missed unlock in non-blocking invalidate_start
+Patch-mainline: v5.3-rc1
+Git-commit: 7608bf40cf2480057ec0da31456cc428791c32ef
+References: bsc#1103992 FATE#326009
+
+If invalidate_start returns with EAGAIN then the umem_rwsem needs to be
+unlocked as no invalidate_end will be called.
+
+Cc: <stable@vger.kernel.org>
+Fixes: ca748c39ea3f ("RDMA/umem: Get rid of per_mm->notifier_count")
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/core/umem_odp.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/core/umem_odp.c
++++ b/drivers/infiniband/core/umem_odp.c
+@@ -145,6 +145,7 @@ static void ib_umem_notifier_invalidate_
+ {
+ struct ib_ucontext_per_mm *per_mm =
+ container_of(mn, struct ib_ucontext_per_mm, mn);
++ int rc;
+
+ down_read(&per_mm->umem_rwsem);
+ if (!per_mm->active) {
+@@ -157,8 +158,12 @@ static void ib_umem_notifier_invalidate_
+ return;
+ }
+
+- rbt_ib_umem_for_each_in_range(&per_mm->umem_tree, start, end,
+- invalidate_range_start_trampoline, NULL);
++ rc = rbt_ib_umem_for_each_in_range(&per_mm->umem_tree, start, end,
++ invalidate_range_start_trampoline,
++ NULL);
++ if (rc)
++ up_read(&per_mm->umem_rwsem);
++ return;
+ }
+
+ static int invalidate_range_end_trampoline(struct ib_umem_odp *item, u64 start,
diff --git a/patches.drivers/RDMA-srp-Accept-again-source-addresses-that-do-not-h.patch b/patches.drivers/RDMA-srp-Accept-again-source-addresses-that-do-not-h.patch
new file mode 100644
index 0000000000..71c87d99ec
--- /dev/null
+++ b/patches.drivers/RDMA-srp-Accept-again-source-addresses-that-do-not-h.patch
@@ -0,0 +1,87 @@
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 29 May 2019 09:38:31 -0700
+Subject: RDMA/srp: Accept again source addresses that do not have a port
+ number
+Patch-mainline: v5.3-rc1
+Git-commit: bcef5b7215681250c4bf8961dfe15e9e4fef97d0
+References: bsc#1103992 FATE#326009
+
+The function srp_parse_in() is used both for parsing source address
+specifications and for target address specifications. Target addresses
+must have a port number. Having to specify a port number for source
+addresses is inconvenient. Make sure that srp_parse_in() supports again
+parsing addresses with no port number.
+
+Cc: <stable@vger.kernel.org>
+Fixes: c62adb7def71 ("IB/srp: Fix IPv6 address parsing")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -3405,13 +3405,14 @@ static const match_table_t srp_opt_token
+ * @net: [in] Network namespace.
+ * @sa: [out] Address family, IP address and port number.
+ * @addr_port_str: [in] IP address and port number.
++ * @has_port: [out] Whether or not @addr_port_str includes a port number.
+ *
+ * Parse the following address formats:
+ * - IPv4: <ip_address>:<port>, e.g. 1.2.3.4:5.
+ * - IPv6: \[<ipv6_address>\]:<port>, e.g. [1::2:3%4]:5.
+ */
+ static int srp_parse_in(struct net *net, struct sockaddr_storage *sa,
+- const char *addr_port_str)
++ const char *addr_port_str, bool *has_port)
+ {
+ char *addr_end, *addr = kstrdup(addr_port_str, GFP_KERNEL);
+ char *port_str;
+@@ -3420,9 +3421,12 @@ static int srp_parse_in(struct net *net,
+ if (!addr)
+ return -ENOMEM;
+ port_str = strrchr(addr, ':');
+- if (!port_str)
+- return -EINVAL;
+- *port_str++ = '\0';
++ if (port_str && strchr(port_str, ']'))
++ port_str = NULL;
++ if (port_str)
++ *port_str++ = '\0';
++ if (has_port)
++ *has_port = port_str != NULL;
+ ret = inet_pton_with_scope(net, AF_INET, addr, port_str, sa);
+ if (ret && addr[0]) {
+ addr_end = addr + strlen(addr) - 1;
+@@ -3444,6 +3448,7 @@ static int srp_parse_options(struct net
+ char *p;
+ substring_t args[MAX_OPT_ARGS];
+ unsigned long long ull;
++ bool has_port;
+ int opt_mask = 0;
+ int token;
+ int ret = -EINVAL;
+@@ -3542,7 +3547,8 @@ static int srp_parse_options(struct net
+ ret = -ENOMEM;
+ goto out;
+ }
+- ret = srp_parse_in(net, &target->rdma_cm.src.ss, p);
++ ret = srp_parse_in(net, &target->rdma_cm.src.ss, p,
++ NULL);
+ if (ret < 0) {
+ pr_warn("bad source parameter '%s'\n", p);
+ kfree(p);
+@@ -3558,7 +3564,10 @@ static int srp_parse_options(struct net
+ ret = -ENOMEM;
+ goto out;
+ }
+- ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p);
++ ret = srp_parse_in(net, &target->rdma_cm.dst.ss, p,
++ &has_port);
++ if (!has_port)
++ ret = -EINVAL;
+ if (ret < 0) {
+ pr_warn("bad dest parameter '%s'\n", p);
+ kfree(p);
diff --git a/patches.drivers/RDMA-srp-Document-srp_parse_in-arguments.patch b/patches.drivers/RDMA-srp-Document-srp_parse_in-arguments.patch
new file mode 100644
index 0000000000..154c1fe35b
--- /dev/null
+++ b/patches.drivers/RDMA-srp-Document-srp_parse_in-arguments.patch
@@ -0,0 +1,31 @@
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 17 Dec 2018 13:20:34 -0800
+Subject: RDMA/srp: Document srp_parse_in() arguments
+Patch-mainline: v5.0-rc1
+Git-commit: e37df2d5b569390e3b80ebed9a73fd5b9dcda010
+References: bsc#1103992 FATE#326009
+
+This patch avoids that a warning is reported when building with W=1.
+
+Cc: Sergey Gorenko <sergeygo@mellanox.com>
+Cc: Max Gurtovoy <maxg@mellanox.com>
+Cc: Laurence Oberman <loberman@redhat.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/ulp/srp/ib_srp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -3402,6 +3402,9 @@ static const match_table_t srp_opt_token
+
+ /**
+ * srp_parse_in - parse an IP address and port number combination
++ * @net: [in] Network namespace.
++ * @sa: [out] Address family, IP address and port number.
++ * @addr_port_str: [in] IP address and port number.
+ *
+ * Parse the following address formats:
+ * - IPv4: <ip_address>:<port>, e.g. 1.2.3.4:5.
diff --git a/patches.drivers/RDMA-uverbs-check-for-allocation-failure-in-uapi_add.patch b/patches.drivers/RDMA-uverbs-check-for-allocation-failure-in-uapi_add.patch
new file mode 100644
index 0000000000..49f3690551
--- /dev/null
+++ b/patches.drivers/RDMA-uverbs-check-for-allocation-failure-in-uapi_add.patch
@@ -0,0 +1,32 @@
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 30 May 2019 11:20:24 +0300
+Subject: RDMA/uverbs: check for allocation failure in uapi_add_elm()
+Patch-mainline: v5.3-rc1
+Git-commit: cac2a301c02a9b178842e22df34217da7854e588
+References: bsc#1103992 FATE#326009
+
+If the kzalloc() fails then we should return ERR_PTR(-ENOMEM). In the
+current code it's possible that the kzalloc() fails and the
+radix_tree_insert() inserts the NULL pointer successfully and we return
+the NULL "elm" pointer to the caller. That results in a NULL pointer
+dereference.
+
+Fixes: 9ed3e5f44772 ("IB/uverbs: Build the specs into a radix tree at runtime")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/core/uverbs_uapi.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/core/uverbs_uapi.c
++++ b/drivers/infiniband/core/uverbs_uapi.c
+@@ -17,6 +17,8 @@ static void *uapi_add_elm(struct uverbs_
+ return ERR_PTR(-EOVERFLOW);
+
+ elm = kzalloc(alloc_size, GFP_KERNEL);
++ if (!elm)
++ return ERR_PTR(-ENOMEM);
+ rc = radix_tree_insert(&uapi->radix, key, elm);
+ if (rc) {
+ kfree(elm);
diff --git a/patches.drivers/ath-DFS-JP-domain-W56-fixed-pulse-type-3-RADAR-detec.patch b/patches.drivers/ath-DFS-JP-domain-W56-fixed-pulse-type-3-RADAR-detec.patch
new file mode 100644
index 0000000000..fc93a7fe43
--- /dev/null
+++ b/patches.drivers/ath-DFS-JP-domain-W56-fixed-pulse-type-3-RADAR-detec.patch
@@ -0,0 +1,46 @@
+From d8792393a783158cbb2c39939cb897dc5e5299b6 Mon Sep 17 00:00:00 2001
+From: Anilkumar Kolli <akolli@codeaurora.org>
+Date: Wed, 6 Mar 2019 23:06:11 +0530
+Subject: [PATCH] ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
+Git-commit: d8792393a783158cbb2c39939cb897dc5e5299b6
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Increase pulse width range from 1-2usec to 0-4usec.
+During data traffic HW occasionally fails detecting radar pulses,
+so that SW cannot get enough radar reports to achieve the success rate.
+
+Tested ath10k hw and fw:
+ * QCA9888(10.4-3.5.1-00052)
+ * QCA4019(10.4-3.2.1.1-00017)
+ * QCA9984(10.4-3.6-00104)
+ * QCA988X(10.2.4-1.0-00041)
+
+Tested ath9k hw: AR9300
+
+Tested-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Tamizh chelvam <tamizhr@codeaurora.org>
+Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/dfs_pattern_detector.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/dfs_pattern_detector.c b/drivers/net/wireless/ath/dfs_pattern_detector.c
+index d52b31b45df7..a274eb0d1968 100644
+--- a/drivers/net/wireless/ath/dfs_pattern_detector.c
++++ b/drivers/net/wireless/ath/dfs_pattern_detector.c
+@@ -111,7 +111,7 @@ static const struct radar_detector_specs jp_radar_ref_types[] = {
+ JP_PATTERN(0, 0, 1, 1428, 1428, 1, 18, 29, false),
+ JP_PATTERN(1, 2, 3, 3846, 3846, 1, 18, 29, false),
+ JP_PATTERN(2, 0, 1, 1388, 1388, 1, 18, 50, false),
+- JP_PATTERN(3, 1, 2, 4000, 4000, 1, 18, 50, false),
++ JP_PATTERN(3, 0, 4, 4000, 4000, 1, 18, 50, false),
+ JP_PATTERN(4, 0, 5, 150, 230, 1, 23, 50, false),
+ JP_PATTERN(5, 6, 10, 200, 500, 1, 16, 50, false),
+ JP_PATTERN(6, 11, 20, 200, 500, 1, 12, 50, false),
+--
+2.16.4
+
diff --git a/patches.drivers/ath10k-Do-not-send-probe-response-template-for-mesh.patch b/patches.drivers/ath10k-Do-not-send-probe-response-template-for-mesh.patch
new file mode 100644
index 0000000000..004c4f3e0c
--- /dev/null
+++ b/patches.drivers/ath10k-Do-not-send-probe-response-template-for-mesh.patch
@@ -0,0 +1,45 @@
+From 97354f2c432788e3163134df6bb144f4b6289d87 Mon Sep 17 00:00:00 2001
+From: Surabhi Vishnoi <svishnoi@codeaurora.org>
+Date: Wed, 17 Apr 2019 14:01:46 +0530
+Subject: [PATCH] ath10k: Do not send probe response template for mesh
+Git-commit: 97354f2c432788e3163134df6bb144f4b6289d87
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Currently mac80211 do not support probe response template for
+mesh point. When WMI_SERVICE_BEACON_OFFLOAD is enabled, host
+driver tries to configure probe response template for mesh, but
+it fails because the interface type is not NL80211_IFTYPE_AP but
+NL80211_IFTYPE_MESH_POINT.
+
+To avoid this failure, skip sending probe response template to
+firmware for mesh point.
+
+Tested HW: WCN3990/QCA6174/QCA9984
+
+Signed-off-by: Surabhi Vishnoi <svishnoi@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 80760a20a049..98a7842e09b1 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -1630,6 +1630,10 @@ static int ath10k_mac_setup_prb_tmpl(struct ath10k_vif *arvif)
+ if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+ return 0;
+
++ /* For mesh, probe response and beacon share the same template */
++ if (ieee80211_vif_is_mesh(vif))
++ return 0;
++
+ prb = ieee80211_proberesp_get(hw, vif);
+ if (!prb) {
+ ath10k_warn(ar, "failed to get probe resp template from mac80211\n");
+--
+2.16.4
+
diff --git a/patches.drivers/ath10k-add-peer-id-check-in-ath10k_peer_find_by_id.patch b/patches.drivers/ath10k-add-peer-id-check-in-ath10k_peer_find_by_id.patch
new file mode 100644
index 0000000000..57ea5e27d5
--- /dev/null
+++ b/patches.drivers/ath10k-add-peer-id-check-in-ath10k_peer_find_by_id.patch
@@ -0,0 +1,69 @@
+From 49ed34b835e231aa941257394716bc689bc98d9f Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Mon, 29 Apr 2019 19:17:12 +0800
+Subject: [PATCH] ath10k: add peer id check in ath10k_peer_find_by_id
+Git-commit: 49ed34b835e231aa941257394716bc689bc98d9f
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+For some SDIO chip, the peer id is 65535 for MPDU with error status,
+then test_bit will trigger buffer overflow for peer's memory, if kasan
+enabled, it will report error.
+
+Reason is when station is in disconnecting status, firmware do not delete
+the peer info since it not disconnected completely, meanwhile some AP will
+still send data packet to station, then hardware will receive the packet
+and send to firmware, firmware's logic will report peer id of 65535 for
+MPDU with error status.
+
+Add check for overflow the size of peer's peer_ids will avoid the buffer
+overflow access.
+
+Call trace of kasan:
+dump_backtrace+0x0/0x2ec
+show_stack+0x20/0x2c
+__dump_stack+0x20/0x28
+dump_stack+0xc8/0xec
+print_address_description+0x74/0x240
+kasan_report+0x250/0x26c
+__asan_report_load8_noabort+0x20/0x2c
+ath10k_peer_find_by_id+0x180/0x1e4 [ath10k_core]
+ath10k_htt_t2h_msg_handler+0x100c/0x2fd4 [ath10k_core]
+ath10k_htt_htc_t2h_msg_handler+0x20/0x34 [ath10k_core]
+ath10k_sdio_irq_handler+0xcc8/0x1678 [ath10k_sdio]
+process_sdio_pending_irqs+0xec/0x370
+sdio_run_irqs+0x68/0xe4
+sdio_irq_work+0x1c/0x28
+process_one_work+0x3d8/0x8b0
+worker_thread+0x508/0x7cc
+kthread+0x24c/0x264
+ret_from_fork+0x10/0x18
+
+Tested with QCA6174 SDIO with firmware
+WLAN.RMH.4.4.1-00007-QCARMSWP-1.
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath10k/txrx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
+index c5818d28f55a..4102df016931 100644
+--- a/drivers/net/wireless/ath/ath10k/txrx.c
++++ b/drivers/net/wireless/ath/ath10k/txrx.c
+@@ -150,6 +150,9 @@ struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar, int peer_id)
+ {
+ struct ath10k_peer *peer;
+
++ if (peer_id >= BITS_PER_TYPE(peer->peer_ids))
++ return NULL;
++
+ lockdep_assert_held(&ar->data_lock);
+
+ list_for_each_entry(peer, &ar->peers, list)
+--
+2.16.4
+
diff --git a/patches.drivers/ath10k-destroy-sdio-workqueue-while-remove-sdio-modu.patch b/patches.drivers/ath10k-destroy-sdio-workqueue-while-remove-sdio-modu.patch
new file mode 100644
index 0000000000..57877eb68f
--- /dev/null
+++ b/patches.drivers/ath10k-destroy-sdio-workqueue-while-remove-sdio-modu.patch
@@ -0,0 +1,35 @@
+From 3ed39f8e747a7aafeec07bb244f2c3a1bdca5730 Mon Sep 17 00:00:00 2001
+From: Wen Gong <wgong@codeaurora.org>
+Date: Thu, 27 Jun 2019 21:21:51 +0300
+Subject: [PATCH] ath10k: destroy sdio workqueue while remove sdio module
+Git-commit: 3ed39f8e747a7aafeec07bb244f2c3a1bdca5730
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+The workqueue need to flush and destory while remove sdio module,
+otherwise it will have thread which is not destory after remove
+sdio modules.
+
+Tested with QCA6174 SDIO with firmware
+WLAN.RMH.4.4.1-00007-QCARMSWP-1.
+
+Signed-off-by: Wen Gong <wgong@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath10k/sdio.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/sdio.c
++++ b/drivers/net/wireless/ath/ath10k/sdio.c
+@@ -2073,6 +2073,9 @@ static void ath10k_sdio_remove(struct sd
+ cancel_work_sync(&ar_sdio->wr_async_work);
+ ath10k_core_unregister(ar);
+ ath10k_core_destroy(ar);
++
++ flush_workqueue(ar_sdio->workqueue);
++ destroy_workqueue(ar_sdio->workqueue);
+ }
+
+ static const struct sdio_device_id ath10k_sdio_devices[] = {
diff --git a/patches.drivers/ath10k-fix-PCIE-device-wake-up-failed.patch b/patches.drivers/ath10k-fix-PCIE-device-wake-up-failed.patch
new file mode 100644
index 0000000000..dfcd3a5938
--- /dev/null
+++ b/patches.drivers/ath10k-fix-PCIE-device-wake-up-failed.patch
@@ -0,0 +1,51 @@
+From 011d4111c8c602ea829fa4917af1818eb0500a90 Mon Sep 17 00:00:00 2001
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+Date: Thu, 30 May 2019 09:49:20 +0800
+Subject: [PATCH] ath10k: fix PCIE device wake up failed
+Git-commit: 011d4111c8c602ea829fa4917af1818eb0500a90
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Observed PCIE device wake up failed after ~120 iterations of
+soft-reboot test. The error message is
+"ath10k_pci 0000:01:00.0: failed to wake up device : -110"
+
+The call trace as below:
+ath10k_pci_probe -> ath10k_pci_force_wake -> ath10k_pci_wake_wait ->
+ath10k_pci_is_awake
+
+Once trigger the device to wake up, we will continuously check the RTC
+state until it returns RTC_STATE_V_ON or timeout.
+
+But for QCA99x0 chips, we use wrong value for RTC_STATE_V_ON.
+Occasionally, we get 0x7 on the fist read, we thought as a failure
+case, but actually is the right value, also verified with the spec.
+So fix the issue by changing RTC_STATE_V_ON from 0x5 to 0x7, passed
+~2000 iterations.
+
+Tested HW: QCA9984
+
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath10k/hw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/hw.c b/drivers/net/wireless/ath/ath10k/hw.c
+index ad082b7d7643..b242085c3c16 100644
+--- a/drivers/net/wireless/ath/ath10k/hw.c
++++ b/drivers/net/wireless/ath/ath10k/hw.c
+@@ -158,7 +158,7 @@ const struct ath10k_hw_values qca6174_values = {
+ };
+
+ const struct ath10k_hw_values qca99x0_values = {
+- .rtc_state_val_on = 5,
++ .rtc_state_val_on = 7,
+ .ce_count = 12,
+ .msi_assign_ce_max = 12,
+ .num_target_ce_config_wlan = 10,
+--
+2.16.4
+
diff --git a/patches.drivers/ath9k-Check-for-errors-when-reading-SREV-register.patch b/patches.drivers/ath9k-Check-for-errors-when-reading-SREV-register.patch
new file mode 100644
index 0000000000..44c94dc66d
--- /dev/null
+++ b/patches.drivers/ath9k-Check-for-errors-when-reading-SREV-register.patch
@@ -0,0 +1,123 @@
+From 2f90c7e5d09437a4d8d5546feaae9f1cf48cfbe1 Mon Sep 17 00:00:00 2001
+From: Tim Schumacher <timschumi@gmx.de>
+Date: Mon, 18 Mar 2019 20:05:57 +0100
+Subject: [PATCH] ath9k: Check for errors when reading SREV register
+Git-commit: 2f90c7e5d09437a4d8d5546feaae9f1cf48cfbe1
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Right now, if an error is encountered during the SREV register
+read (i.e. an EIO in ath9k_regread()), that error code gets
+passed all the way to __ath9k_hw_init(), where it is visible
+during the "Chip rev not supported" message.
+
+ ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits
+ ath: phy2: Mac Chip Rev 0x0f.3 is not supported by this driver
+ ath: phy2: Unable to initialize hardware; initialization status: -95
+ ath: phy2: Unable to initialize hardware; initialization status: -95
+ ath9k_htc: Failed to initialize the device
+
+Check for -EIO explicitly in ath9k_hw_read_revisions() and return
+a boolean based on the success of the operation. Check for that in
+__ath9k_hw_init() and abort with a more debugging-friendly message
+if reading the revisions wasn't successful.
+
+ ath9k_htc 1-1.4:1.0: ath9k_htc: HTC initialized with 33 credits
+ ath: phy2: Failed to read SREV register
+ ath: phy2: Could not read hardware revision
+ ath: phy2: Unable to initialize hardware; initialization status: -95
+ ath: phy2: Unable to initialize hardware; initialization status: -95
+ ath9k_htc: Failed to initialize the device
+
+This helps when debugging by directly showing the first point of
+failure and it could prevent possible errors if a 0x0f.3 revision
+is ever supported.
+
+Signed-off-by: Tim Schumacher <timschumi@gmx.de>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/ath/ath9k/hw.c | 32 +++++++++++++++++++++++---------
+ 1 file changed, 23 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
+index 8581d917635a..b6773d613f0c 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.c
++++ b/drivers/net/wireless/ath/ath9k/hw.c
+@@ -252,8 +252,9 @@ void ath9k_hw_get_channel_centers(struct ath_hw *ah,
+ /* Chip Revisions */
+ /******************/
+
+-static void ath9k_hw_read_revisions(struct ath_hw *ah)
++static bool ath9k_hw_read_revisions(struct ath_hw *ah)
+ {
++ u32 srev;
+ u32 val;
+
+ if (ah->get_mac_revision)
+@@ -269,25 +270,33 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
+ val = REG_READ(ah, AR_SREV);
+ ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+ }
+- return;
++ return true;
+ case AR9300_DEVID_AR9340:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9340;
+- return;
++ return true;
+ case AR9300_DEVID_QCA955X:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9550;
+- return;
++ return true;
+ case AR9300_DEVID_AR953X:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+- return;
++ return true;
+ case AR9300_DEVID_QCA956X:
+ ah->hw_version.macVersion = AR_SREV_VERSION_9561;
+- return;
++ return true;
+ }
+
+- val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
++ srev = REG_READ(ah, AR_SREV);
++
++ if (srev == -EIO) {
++ ath_err(ath9k_hw_common(ah),
++ "Failed to read SREV register");
++ return false;
++ }
++
++ val = srev & AR_SREV_ID;
+
+ if (val == 0xFF) {
+- val = REG_READ(ah, AR_SREV);
++ val = srev;
+ ah->hw_version.macVersion =
+ (val & AR_SREV_VERSION2) >> AR_SREV_TYPE2_S;
+ ah->hw_version.macRev = MS(val, AR_SREV_REVISION2);
+@@ -306,6 +315,8 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
+ if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCIE)
+ ah->is_pciexpress = true;
+ }
++
++ return true;
+ }
+
+ /************************************/
+@@ -559,7 +570,10 @@ static int __ath9k_hw_init(struct ath_hw *ah)
+ struct ath_common *common = ath9k_hw_common(ah);
+ int r = 0;
+
+- ath9k_hw_read_revisions(ah);
++ if (!ath9k_hw_read_revisions(ah)) {
++ ath_err(common, "Could not read hardware revisions");
++ return -EOPNOTSUPP;
++ }
+
+ switch (ah->hw_version.macVersion) {
+ case AR_SREV_VERSION_5416_PCI:
+--
+2.16.4
+
diff --git a/patches.drivers/bnxt_en-Cap-the-returned-MSIX-vectors-to-the-RDMA-dr.patch b/patches.drivers/bnxt_en-Cap-the-returned-MSIX-vectors-to-the-RDMA-dr.patch
new file mode 100644
index 0000000000..bf7fe52b60
--- /dev/null
+++ b/patches.drivers/bnxt_en-Cap-the-returned-MSIX-vectors-to-the-RDMA-dr.patch
@@ -0,0 +1,37 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sat, 29 Jun 2019 11:16:47 -0400
+Subject: bnxt_en: Cap the returned MSIX vectors to the RDMA driver.
+Patch-mainline: v5.3-rc1
+Git-commit: 1dbc59fa4bbaa108b641cd65a54f662b75e4ed36
+References: bsc#1134090 jsc#SLE-5954
+
+In an earlier commit to improve NQ reservations on 57500 chips, we
+set the resv_irqs on the 57500 VFs to the fixed value assigned by
+the PF regardless of how many are actually used. The current
+code assumes that resv_irqs minus the ones used by the network driver
+must be the ones for the RDMA driver. This is no longer true and
+we may return more MSIX vectors than requested, causing inconsistency.
+Fix it by capping the value.
+
+Fixes: 01989c6b69d9 ("bnxt_en: Improve NQ reservations.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c
+@@ -157,8 +157,10 @@ static int bnxt_req_msix_vecs(struct bnx
+
+ if (BNXT_NEW_RM(bp)) {
+ struct bnxt_hw_resc *hw_resc = &bp->hw_resc;
++ int resv_msix;
+
+- avail_msix = hw_resc->resv_irqs - bp->cp_nr_rings;
++ resv_msix = hw_resc->resv_irqs - bp->cp_nr_rings;
++ avail_msix = min_t(int, resv_msix, avail_msix);
+ edev->ulp_tbl[ulp_id].msix_requested = avail_msix;
+ }
+ bnxt_fill_msix_vecs(bp, ent);
diff --git a/patches.drivers/bnxt_en-Disable-bus-master-during-PCI-shutdown-and-d.patch b/patches.drivers/bnxt_en-Disable-bus-master-during-PCI-shutdown-and-d.patch
new file mode 100644
index 0000000000..43ec5cac4b
--- /dev/null
+++ b/patches.drivers/bnxt_en-Disable-bus-master-during-PCI-shutdown-and-d.patch
@@ -0,0 +1,45 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sat, 29 Jun 2019 11:16:44 -0400
+Subject: bnxt_en: Disable bus master during PCI shutdown and driver unload.
+Patch-mainline: v5.3-rc1
+Git-commit: c20dc142dd7b2884b8570eeab323bcd4a84294fa
+References: bsc#1104745 FATE#325918
+
+Some chips with older firmware can continue to perform DMA read from
+context memory even after the memory has been freed. In the PCI shutdown
+method, we need to call pci_disable_device() to shutdown DMA to prevent
+this DMA before we put the device into D3hot. DMA memory request in
+D3hot state will generate PCI fatal error. Similarly, in the driver
+remove method, the context memory should only be freed after DMA has
+been shutdown for correctness.
+
+Fixes: 98f04cf0f1fc ("bnxt_en: Check context memory requirements from firmware.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -10113,10 +10113,10 @@ static void bnxt_remove_one(struct pci_d
+ bnxt_dcb_free(bp);
+ kfree(bp->edev);
+ bp->edev = NULL;
++ bnxt_cleanup_pci(bp);
+ bnxt_free_ctx_mem(bp);
+ kfree(bp->ctx);
+ bp->ctx = NULL;
+- bnxt_cleanup_pci(bp);
+ bnxt_free_port_stats(bp);
+ free_netdev(dev);
+ }
+@@ -10679,6 +10679,7 @@ static void bnxt_shutdown(struct pci_dev
+
+ if (system_state == SYSTEM_POWER_OFF) {
+ bnxt_clear_int_mode(bp);
++ pci_disable_device(pdev);
+ pci_wake_from_d3(pdev, bp->wol);
+ pci_set_power_state(pdev, PCI_D3hot);
+ }
diff --git a/patches.drivers/bnxt_en-Fix-statistics-context-reservation-logic-for.patch b/patches.drivers/bnxt_en-Fix-statistics-context-reservation-logic-for.patch
new file mode 100644
index 0000000000..16eb9d007d
--- /dev/null
+++ b/patches.drivers/bnxt_en-Fix-statistics-context-reservation-logic-for.patch
@@ -0,0 +1,55 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sat, 29 Jun 2019 11:16:46 -0400
+Subject: bnxt_en: Fix statistics context reservation logic for RDMA driver.
+Patch-mainline: v5.3-rc1
+Git-commit: d77b1ad8e87dc5a6cd0d9158b097a4817946ca3b
+References: bsc#1104745 FATE#325918
+
+The current logic assumes that the RDMA driver uses one statistics
+context adjacent to the ones used by the network driver. This
+assumption is not true and the statistics context used by the
+RDMA driver is tied to its MSIX base vector. This wrong assumption
+can cause RDMA driver failure after changing ethtool rings on the
+network side. Fix the statistics reservation logic accordingly.
+
+Fixes: 780baad44f0f ("bnxt_en: Reserve 1 stat_ctx for RDMA driver.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -5484,7 +5484,16 @@ static int bnxt_cp_rings_in_use(struct b
+
+ static int bnxt_get_func_stat_ctxs(struct bnxt *bp)
+ {
+- return bp->cp_nr_rings + bnxt_get_ulp_stat_ctxs(bp);
++ int ulp_stat = bnxt_get_ulp_stat_ctxs(bp);
++ int cp = bp->cp_nr_rings;
++
++ if (!ulp_stat)
++ return cp;
++
++ if (bnxt_nq_rings_in_use(bp) > cp + bnxt_get_ulp_msix_num(bp))
++ return bnxt_get_ulp_msix_base(bp) + ulp_stat;
++
++ return cp + ulp_stat;
+ }
+
+ static bool bnxt_need_reserve_rings(struct bnxt *bp)
+@@ -7374,11 +7383,7 @@ unsigned int bnxt_get_avail_cp_rings_for
+
+ unsigned int bnxt_get_avail_stat_ctxs_for_en(struct bnxt *bp)
+ {
+- unsigned int stat;
+-
+- stat = bnxt_get_max_func_stat_ctxs(bp) - bnxt_get_ulp_stat_ctxs(bp);
+- stat -= bp->cp_nr_rings;
+- return stat;
++ return bnxt_get_max_func_stat_ctxs(bp) - bnxt_get_func_stat_ctxs(bp);
+ }
+
+ int bnxt_get_avail_msix(struct bnxt *bp, int num)
diff --git a/patches.drivers/bnxt_en-Suppress-error-messages-when-querying-DSCP-D.patch b/patches.drivers/bnxt_en-Suppress-error-messages-when-querying-DSCP-D.patch
new file mode 100644
index 0000000000..4e1d513342
--- /dev/null
+++ b/patches.drivers/bnxt_en-Suppress-error-messages-when-querying-DSCP-D.patch
@@ -0,0 +1,30 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Sat, 29 Jun 2019 11:16:48 -0400
+Subject: bnxt_en: Suppress error messages when querying DSCP DCB capabilities.
+Patch-mainline: v5.3-rc1
+Git-commit: 4ca5fa39e1aea2f85eb9c4257075c4077c6531da
+References: bsc#1104745 FATE#325918
+
+Some firmware versions do not support this so use the silent variant
+to send the message to firmware to suppress the harmless error. This
+error message is unnecessarily alarming the user.
+
+Fixes: afdc8a84844a ("bnxt_en: Add DCBNL DSCP application protocol support.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c
+@@ -396,7 +396,7 @@ static int bnxt_hwrm_queue_dscp_qcaps(st
+
+ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_QUEUE_DSCP_QCAPS, -1, -1);
+ mutex_lock(&bp->hwrm_cmd_lock);
+- rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
++ rc = _hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT);
+ if (!rc) {
+ bp->max_dscp_value = (1 << resp->num_dscp_bits) - 1;
+ if (bp->max_dscp_value < 0x3f)
diff --git a/patches.drivers/bpf-fix-callees-pruning-callers.patch b/patches.drivers/bpf-fix-callees-pruning-callers.patch
new file mode 100644
index 0000000000..8b1fca9e43
--- /dev/null
+++ b/patches.drivers/bpf-fix-callees-pruning-callers.patch
@@ -0,0 +1,57 @@
+From: Alexei Starovoitov <ast@kernel.org>
+Date: Sat, 15 Jun 2019 12:12:21 -0700
+Subject: bpf: fix callees pruning callers
+Patch-mainline: v5.3-rc1
+Git-commit: eea1c227b9e9bad295e8ef984004a9acf12bb68c
+References: bsc#1109837
+
+The commit 7640ead93924 partially resolved the issue of callees
+incorrectly pruning the callers.
+With introduction of bounded loops and jmps_processed heuristic
+single verifier state may contain multiple branches and calls.
+It's possible that new verifier state (for future pruning) will be
+allocated inside callee. Then callee will exit (still within the same
+verifier state). It will go back to the caller and there R6-R9 registers
+will be read and will trigger mark_reg_read. But the reg->live for all frames
+but the top frame is not set to LIVE_NONE. Hence mark_reg_read will fail
+to propagate liveness into parent and future walking will incorrectly
+conclude that the states are equivalent because LIVE_READ is not set.
+In other words the rule for parent/live should be:
+whenever register parentage chain is set the reg->live should be set to LIVE_NONE.
+is_state_visited logic already follows this rule for spilled registers.
+
+Fixes: 7640ead93924 ("bpf: verifier: make sure callees don't prune with caller differences")
+Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)")
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/verifier.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4829,17 +4829,18 @@ static int is_state_visited(struct bpf_v
+ * the state of the call instruction (with WRITTEN set), and r0 comes
+ * from callee with its full parentage chain, anyway.
+ */
+- for (j = 0; j <= cur->curframe; j++)
+- for (i = j < cur->curframe ? BPF_REG_6 : 0; i < BPF_REG_FP; i++)
+- cur->frame[j]->regs[i].parent = &new->frame[j]->regs[i];
+ /* clear write marks in current state: the writes we did are not writes
+ * our child did, so they don't screen off its reads from us.
+ * (There are no read marks in current state, because reads always mark
+ * their parent and current state never has children yet. Only
+ * explored_states can get read marks.)
+ */
+- for (i = 0; i < BPF_REG_FP; i++)
+- cur->frame[cur->curframe]->regs[i].live = REG_LIVE_NONE;
++ for (j = 0; j <= cur->curframe; j++) {
++ for (i = j < cur->curframe ? BPF_REG_6 : 0; i < BPF_REG_FP; i++)
++ cur->frame[j]->regs[i].parent = &new->frame[j]->regs[i];
++ for (i = 0; i < BPF_REG_FP; i++)
++ cur->frame[j]->regs[i].live = REG_LIVE_NONE;
++ }
+
+ /* all stack frames are accessible from callee, clear them all */
+ for (j = 0; j <= cur->curframe; j++) {
diff --git a/patches.drivers/idr-fix-overflow-case-for-idr_for_each_entry_ul.patch b/patches.drivers/idr-fix-overflow-case-for-idr_for_each_entry_ul.patch
new file mode 100644
index 0000000000..83a2328b17
--- /dev/null
+++ b/patches.drivers/idr-fix-overflow-case-for-idr_for_each_entry_ul.patch
@@ -0,0 +1,98 @@
+From: Cong Wang <xiyou.wangcong@gmail.com>
+Date: Fri, 28 Jun 2019 11:03:41 -0700
+Subject: idr: fix overflow case for idr_for_each_entry_ul()
+Patch-mainline: v5.3-rc1
+Git-commit: e33d2b74d805af0e4c8060f41040595ba105a520
+References: bsc#1109837
+
+idr_for_each_entry_ul() is buggy as it can't handle overflow
+case correctly. When we have an ID == UINT_MAX, it becomes an
+infinite loop. This happens when running on 32-bit CPU where
+unsigned long has the same size with unsigned int.
+
+There is no better way to fix this than casting it to a larger
+integer, but we can't just 64 bit integer on 32 bit CPU. Instead
+we could just use an additional integer to help us to detect this
+overflow case, that is, adding a new parameter to this macro.
+Fortunately tc action is its only user right now.
+
+Fixes: 65a206c01e8e ("net/sched: Change act_api and act_xxx modules to use IDR")
+Reported-by: Li Shuang <shuali@redhat.com>
+Tested-by: Davide Caratti <dcaratti@redhat.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Chris Mi <chrism@mellanox.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/linux/idr.h | 7 +++++--
+ net/sched/act_api.c | 9 ++++++---
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/include/linux/idr.h
++++ b/include/linux/idr.h
+@@ -156,14 +156,17 @@ static inline void *idr_find(const struc
+ * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type.
+ * @idr: IDR handle.
+ * @entry: The type * to use as cursor.
++ * @tmp: A temporary placeholder for ID.
+ * @id: Entry ID.
+ *
+ * @entry and @id do not need to be initialized before the loop, and
+ * after normal termination @entry is left with the value NULL. This
+ * is convenient for a "not found" value.
+ */
+-#define idr_for_each_entry_ul(idr, entry, id) \
+- for (id = 0; ((entry) = idr_get_next_ul(idr, &(id))) != NULL; ++id)
++#define idr_for_each_entry_ul(idr, entry, tmp, id) \
++ for (tmp = 0, id = 0; \
++ tmp <= id && ((entry) = idr_get_next_ul(idr, &(id))) != NULL; \
++ tmp = id, ++id)
+
+ /**
+ * idr_for_each_entry_continue() - Continue iteration over an IDR's elements of a given type
+--- a/net/sched/act_api.c
++++ b/net/sched/act_api.c
+@@ -199,12 +199,13 @@ static int tcf_dump_walker(struct tcf_id
+ struct idr *idr = &idrinfo->action_idr;
+ struct tc_action *p;
+ unsigned long id = 1;
++ unsigned long tmp;
+
+ mutex_lock(&idrinfo->lock);
+
+ s_i = cb->args[0];
+
+- idr_for_each_entry_ul(idr, p, id) {
++ idr_for_each_entry_ul(idr, p, tmp, id) {
+ index++;
+ if (index < s_i)
+ continue;
+@@ -270,6 +271,7 @@ static int tcf_del_walker(struct tcf_idr
+ struct idr *idr = &idrinfo->action_idr;
+ struct tc_action *p;
+ unsigned long id = 1;
++ unsigned long tmp;
+
+ nest = nla_nest_start(skb, 0);
+ if (nest == NULL)
+@@ -278,7 +280,7 @@ static int tcf_del_walker(struct tcf_idr
+ goto nla_put_failure;
+
+ mutex_lock(&idrinfo->lock);
+- idr_for_each_entry_ul(idr, p, id) {
++ idr_for_each_entry_ul(idr, p, tmp, id) {
+ ret = tcf_idr_release_unsafe(p);
+ if (ret == ACT_P_DELETED) {
+ module_put(ops->owner);
+@@ -511,8 +513,9 @@ void tcf_idrinfo_destroy(const struct tc
+ struct tc_action *p;
+ int ret;
+ unsigned long id = 1;
++ unsigned long tmp;
+
+- idr_for_each_entry_ul(idr, p, id) {
++ idr_for_each_entry_ul(idr, p, tmp, id) {
+ ret = __tcf_idr_release(p, false, true);
+ if (ret == ACT_P_DELETED)
+ module_put(ops->owner);
diff --git a/patches.drivers/iwlwifi-add-support-for-22560-devices.patch b/patches.drivers/iwlwifi-add-support-for-22560-devices.patch
index 235b58e0f9..e99787bfca 100644
--- a/patches.drivers/iwlwifi-add-support-for-22560-devices.patch
+++ b/patches.drivers/iwlwifi-add-support-for-22560-devices.patch
@@ -14,12 +14,12 @@ Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
- drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 71 ++++++++++++++----------
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 63 +++++++++++++++---------
drivers/net/wireless/intel/iwlwifi/iwl-config.h | 4 +
drivers/net/wireless/intel/iwlwifi/iwl-csr.h | 3 +
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2
- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 20 +++++-
- 5 files changed, 66 insertions(+), 34 deletions(-)
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 20 ++++++-
+ 5 files changed, 62 insertions(+), 30 deletions(-)
--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
@@ -43,23 +43,19 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
+#define IWL_22000_SU_Z0_FW_PRE "iwlwifi-su-z0-"
#define IWL_22000_HR_MODULE_FIRMWARE(api) \
-- IWL_22000_HR_FW_PRE "-" __stringify(api) ".ucode"
-+ IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
+ IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
#define IWL_22000_JF_MODULE_FIRMWARE(api) \
-- IWL_22000_JF_FW_PRE "-" __stringify(api) ".ucode"
+ IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
-#define IWL_22000_HR_F0_QNJ_MODULE_FIRMWARE(api) \
-- IWL_22000_HR_F0_FW_PRE "-" __stringify(api) ".ucode"
-+ IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
+- IWL_22000_HR_F0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_A_F0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
#define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
-- IWL_22000_JF_B0_FW_PRE "-" __stringify(api) ".ucode"
-+ IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
+ IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
#define IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(api) \
-- IWL_22000_HR_A0_FW_PRE "-" __stringify(api) ".ucode"
-+ IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+ IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
+ IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
diff --git a/patches.drivers/iwlwifi-correct-one-of-the-PCI-struct-names.patch b/patches.drivers/iwlwifi-correct-one-of-the-PCI-struct-names.patch
new file mode 100644
index 0000000000..cb77c91a80
--- /dev/null
+++ b/patches.drivers/iwlwifi-correct-one-of-the-PCI-struct-names.patch
@@ -0,0 +1,114 @@
+From a98e2802a654e240d9020546fd29e5632da5f848 Mon Sep 17 00:00:00 2001
+From: Ihab Zhaika <ihab.zhaika@intel.com>
+Date: Sun, 5 Aug 2018 15:05:45 +0300
+Subject: [PATCH] iwlwifi: correct one of the PCI struct names
+Git-commit: a98e2802a654e240d9020546fd29e5632da5f848
+Patch-mainline: v5.1-rc1
+References: bsc#1111666
+
+One of the cfg struct names is mistakenly "iwl22000", when it should
+be "iwl22560".
+
+Chage-id: If9fbfa4bceef81d028c90c98d47115fbe39da547
+Signed-off-by: Ihab Zhaika <ihab.zhaika@intel.com>
+Fixes: 2f7a3863191a ("iwlwifi: rename the temporary name of A000 to the official 22000")
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 4 +-
+ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 1
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 34 ++++++++++++------------
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 +-
+ 4 files changed, 22 insertions(+), 21 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -197,8 +197,8 @@ const struct iwl_cfg iwl22000_2ac_cfg_jf
+ IWL_DEVICE_22500,
+ };
+
+-const struct iwl_cfg iwl22000_2ax_cfg_hr = {
+- .name = "Intel(R) Dual Band Wireless AX 22000",
++const struct iwl_cfg iwl22560_2ax_cfg_hr = {
++ .name = "Intel(R) Wireless-AX 22560",
+ .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -573,6 +573,7 @@ extern const struct iwl_cfg iwl9560_kill
+ extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
++extern const struct iwl_cfg iwl22560_2ax_cfg_hr;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
+ extern const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0;
+ extern const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0;
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -876,32 +876,32 @@ static const struct pci_device_id iwl_hw
+ {IWL_PCI_DEVICE(0xA370, 0x42A4, iwl9462_2ac_cfg_soc)},
+
+ /* 22000 Series */
+- {IWL_PCI_DEVICE(0x2720, 0x0000, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x2720, 0x0040, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x2720, 0x0078, iwl22000_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x2720, 0x0000, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x2720, 0x0040, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x2720, 0x0078, iwl22560_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x2720, 0x0070, iwl22000_2ac_cfg_hr_cdb)},
+ {IWL_PCI_DEVICE(0x2720, 0x0030, iwl22000_2ac_cfg_hr_cdb)},
+- {IWL_PCI_DEVICE(0x2720, 0x1080, iwl22000_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x2720, 0x1080, iwl22560_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x2720, 0x0090, iwl22000_2ac_cfg_hr_cdb)},
+ {IWL_PCI_DEVICE(0x2720, 0x0310, iwl22000_2ac_cfg_hr_cdb)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22560_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0310, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0A10, iwl22560_2ax_cfg_su_cdb)},
+- {IWL_PCI_DEVICE(0x43F0, 0x0040, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x43F0, 0x0070, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x43F0, 0x0078, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0xA0F0, 0x0A10, iwl22000_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0040, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0070, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0x43F0, 0x0078, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0000, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0040, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0070, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0078, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x00B0, iwl22560_2ax_cfg_hr)},
++ {IWL_PCI_DEVICE(0xA0F0, 0x0A10, iwl22560_2ax_cfg_hr)},
+
+ #endif /* CONFIG_IWLMVM */
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -3395,10 +3395,10 @@ struct iwl_trans *iwl_trans_pcie_alloc(s
+ #if IS_ENABLED(CONFIG_IWLMVM)
+ trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID);
+
+- if (cfg == &iwl22000_2ax_cfg_hr) {
++ if (cfg == &iwl22560_2ax_cfg_hr) {
+ if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
+- trans->cfg = &iwl22000_2ax_cfg_hr;
++ trans->cfg = &iwl22560_2ax_cfg_hr;
+ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
+ trans->cfg = &iwl22000_2ax_cfg_jf;
diff --git a/patches.drivers/iwlwifi-don-t-WARN-when-calling-iwl_get_shared_mem_c.patch b/patches.drivers/iwlwifi-don-t-WARN-when-calling-iwl_get_shared_mem_c.patch
new file mode 100644
index 0000000000..5b6181f980
--- /dev/null
+++ b/patches.drivers/iwlwifi-don-t-WARN-when-calling-iwl_get_shared_mem_c.patch
@@ -0,0 +1,70 @@
+From 0d53cfd0cca3c729a089c39eef0e7d8ae7662974 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Wed, 22 May 2019 12:17:09 +0300
+Subject: [PATCH] iwlwifi: don't WARN when calling iwl_get_shared_mem_conf with RF-Kill
+Git-commit: 0d53cfd0cca3c729a089c39eef0e7d8ae7662974
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+iwl_mvm_send_cmd returns 0 when the command won't be sent
+because RF-Kill is asserted. Do the same when we call
+iwl_get_shared_mem_conf since it is not sent through
+iwl_mvm_send_cmd but directly calls the transport layer.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/fw/smem.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/fw/smem.c b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+index ff85d69c2a8c..557ee47bffd8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/fw/smem.c
++++ b/drivers/net/wireless/intel/iwlwifi/fw/smem.c
+@@ -8,7 +8,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -31,7 +31,7 @@
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -134,6 +134,7 @@ void iwl_get_shared_mem_conf(struct iwl_fw_runtime *fwrt)
+ .len = { 0, },
+ };
+ struct iwl_rx_packet *pkt;
++ int ret;
+
+ if (fw_has_capa(&fwrt->fw->ucode_capa,
+ IWL_UCODE_TLV_CAPA_EXTEND_SHARED_MEM_CFG))
+@@ -141,8 +142,13 @@ void iwl_get_shared_mem_conf(struct iwl_fw_runtime *fwrt)
+ else
+ cmd.id = SHARED_MEM_CFG;
+
+- if (WARN_ON(iwl_trans_send_cmd(fwrt->trans, &cmd)))
++ ret = iwl_trans_send_cmd(fwrt->trans, &cmd);
++
++ if (ret) {
++ WARN(ret != -ERFKILL,
++ "Could not send the SMEM command: %d\n", ret);
+ return;
++ }
+
+ pkt = cmd.resp_pkt;
+ if (fwrt->trans->cfg->device_family >= IWL_DEVICE_FAMILY_22000)
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-fix-RF-Kill-interrupt-while-FW-load-for-gen2.patch b/patches.drivers/iwlwifi-fix-RF-Kill-interrupt-while-FW-load-for-gen2.patch
new file mode 100644
index 0000000000..cb96c01e34
--- /dev/null
+++ b/patches.drivers/iwlwifi-fix-RF-Kill-interrupt-while-FW-load-for-gen2.patch
@@ -0,0 +1,147 @@
+From ed3e4c6d3cd8f093a3636cb05492429fe2af228d Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 20 May 2019 15:18:24 +0300
+Subject: [PATCH] iwlwifi: fix RF-Kill interrupt while FW load for gen2 devices
+Git-commit: ed3e4c6d3cd8f093a3636cb05492429fe2af228d
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Newest devices have a new firmware load mechanism. This
+mechanism is called the context info. It means that the
+driver doesn't need to load the sections of the firmware.
+The driver rather prepares a place in DRAM, with pointers
+to the relevant sections of the firmware, and the firmware
+loads itself.
+At the end of the process, the firmware sends the ALIVE
+interrupt. This is different from the previous scheme in
+which the driver expected the FH_TX interrupt after each
+section being transferred over the DMA.
+
+In order to support this new flow, we enabled all the
+interrupts. This broke the assumption that we have in the
+code that the RF-Kill interrupt can't interrupt the firmware
+load flow.
+
+Change the context info flow to enable only the ALIVE
+interrupt, and re-enable all the other interrupts only
+after the firmware is alive. Then, we won't see the RF-Kill
+interrupt until then. Getting the RF-Kill interrupt while
+loading the firmware made us kill the firmware while it is
+loading and we ended up dumping garbage instead of the firmware
+state.
+
+Re-enable the ALIVE | RX interrupts from the ISR when we
+get the ALIVE interrupt to be able to get the RX interrupt
+that comes immediately afterwards for the ALIVE
+notification. This is needed for non MSI-X only.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c | 2 -
+ drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c | 2 -
+ drivers/net/wireless/intel/iwlwifi/pcie/internal.h | 27 +++++++++++++++
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 5 ++
+ drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 9 +++++
+ 5 files changed, 43 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info-gen3.c
+@@ -164,7 +164,7 @@ int iwl_pcie_ctxt_info_gen3_init(struct
+
+ memcpy(iml_img, trans->iml, trans->iml_len);
+
+- iwl_enable_interrupts(trans);
++ iwl_enable_fw_load_int_ctx_info(trans);
+
+ /* kick FW self load */
+ iwl_write64(trans, CSR_CTXT_INFO_ADDR,
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c
+@@ -206,7 +206,7 @@ int iwl_pcie_ctxt_info_init(struct iwl_t
+
+ trans_pcie->ctxt_info = ctxt_info;
+
+- iwl_enable_interrupts(trans);
++ iwl_enable_fw_load_int_ctx_info(trans);
+
+ /* Configure debug, if exists */
+ if (trans->dbg_dest_tlv)
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/internal.h
+@@ -898,6 +898,33 @@ static inline void iwl_enable_fw_load_in
+ }
+ }
+
++static inline void iwl_enable_fw_load_int_ctx_info(struct iwl_trans *trans)
++{
++ struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
++
++ IWL_DEBUG_ISR(trans, "Enabling ALIVE interrupt only\n");
++
++ if (!trans_pcie->msix_enabled) {
++ /*
++ * When we'll receive the ALIVE interrupt, the ISR will call
++ * iwl_enable_fw_load_int_ctx_info again to set the ALIVE
++ * interrupt (which is not really needed anymore) but also the
++ * RX interrupt which will allow us to receive the ALIVE
++ * notification (which is Rx) and continue the flow.
++ */
++ trans_pcie->inta_mask = CSR_INT_BIT_ALIVE | CSR_INT_BIT_FH_RX;
++ iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
++ } else {
++ iwl_enable_hw_int_msk_msix(trans,
++ MSIX_HW_INT_CAUSES_REG_ALIVE);
++ /*
++ * Leave all the FH causes enabled to get the ALIVE
++ * notification.
++ */
++ iwl_enable_fh_int_msk_msix(trans, trans_pcie->fh_init_mask);
++ }
++}
++
+ static inline u16 iwl_pcie_get_cmd_index(const struct iwl_txq *q, u32 index)
+ {
+ return index & (q->n_window - 1);
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1796,6 +1796,8 @@ irqreturn_t iwl_pcie_irq_handler(int irq
+ */
+ iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+ }
++
++ handled |= CSR_INT_BIT_ALIVE;
+ }
+
+ /* Safely ignore these bits for debug checks below */
+@@ -1914,6 +1916,9 @@ irqreturn_t iwl_pcie_irq_handler(int irq
+ /* Re-enable RF_KILL if it occurred */
+ else if (handled & CSR_INT_BIT_RF_KILL)
+ iwl_enable_rfkill_int(trans);
++ /* Re-enable the ALIVE / Rx interrupt if it occurred */
++ else if (handled & (CSR_INT_BIT_ALIVE | CSR_INT_BIT_FH_RX))
++ iwl_enable_fw_load_int_ctx_info(trans);
+ spin_unlock(&trans_pcie->irq_lock);
+
+ out:
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c
+@@ -289,6 +289,15 @@ void iwl_trans_pcie_gen2_fw_alive(struct
+ * paging memory cannot be freed included since FW will still use it
+ */
+ iwl_pcie_ctxt_info_free(trans);
++
++ /*
++ * Re-enable all the interrupts, including the RF-Kill one, now that
++ * the firmware is alive.
++ */
++ iwl_enable_interrupts(trans);
++ mutex_lock(&trans_pcie->mutex);
++ iwl_pcie_check_hw_rf_kill(trans);
++ mutex_unlock(&trans_pcie->mutex);
+ }
+
+ int iwl_trans_pcie_gen2_start_fw(struct iwl_trans *trans,
diff --git a/patches.drivers/iwlwifi-fix-cfg-structs-for-22000-with-different-RF-.patch b/patches.drivers/iwlwifi-fix-cfg-structs-for-22000-with-different-RF-.patch
new file mode 100644
index 0000000000..5d628d9d46
--- /dev/null
+++ b/patches.drivers/iwlwifi-fix-cfg-structs-for-22000-with-different-RF-.patch
@@ -0,0 +1,90 @@
+From b1bbc1a636505ebdd6336ff781e417123226d4f7 Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Sat, 4 Aug 2018 14:45:42 +0300
+Subject: [PATCH] iwlwifi: fix cfg structs for 22000 with different RF modules
+Git-commit: b1bbc1a636505ebdd6336ff781e417123226d4f7
+Patch-mainline: v5.0-rc1
+References: bsc#1111666
+
+We have to choose different configuration and different firmwares
+depending on the external RF module that is installed. Since the
+external module is not represented in the PCI IDs, we need to change
+the configuration at runtime, after checking the RF ID of the module
+installed. We have a bit of a mess in the code that does this,
+because it applies cfg's according to the RF ID only, ignoring the
+integrated module that is in use.
+
+Fix that for some devices by adding correct configurations for them
+and not ignoring the integrated module's type when making the
+decision.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 1 -
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 +-
+ drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 22 ++++++++++++++++++++--
+ 3 files changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index da5d5f9b2573..8b2339165bca 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -323,7 +323,6 @@ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+-MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 8d4711590dfc..353581ccc01e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -882,7 +882,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22000_2ax_cfg_hr)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ac_cfg_jf)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ax_cfg_hr)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)},
+ {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)},
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+index 16eed9b0f301..231ec8131ee8 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+@@ -3401,8 +3401,26 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ #if IS_ENABLED(CONFIG_IWLMVM)
+ trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID);
+
+- if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
+- CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
++ if (cfg == &iwl22000_2ax_cfg_hr) {
++ if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
++ trans->cfg = &iwl22000_2ax_cfg_hr;
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) {
++ trans->cfg = &iwl22000_2ax_cfg_jf;
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HRCDB)) {
++ IWL_ERR(trans, "RF ID HRCDB is not supported\n");
++ ret = -EINVAL;
++ goto out_no_pci;
++ } else {
++ IWL_ERR(trans, "Unrecognized RF ID 0x%08x\n",
++ CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id));
++ ret = -EINVAL;
++ goto out_no_pci;
++ }
++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) ==
++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) {
+ u32 hw_status;
+
+ hw_status = iwl_read_prph(trans, UMAG_GEN_HW_STATUS);
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-fix-devices-with-PCI-Device-ID-0x34F0-and-11.patch b/patches.drivers/iwlwifi-fix-devices-with-PCI-Device-ID-0x34F0-and-11.patch
new file mode 100644
index 0000000000..9884efcc5c
--- /dev/null
+++ b/patches.drivers/iwlwifi-fix-devices-with-PCI-Device-ID-0x34F0-and-11.patch
@@ -0,0 +1,228 @@
+From ab27926d9e4ae23df4f4d98e31f067c8b486bb4f Mon Sep 17 00:00:00 2001
+From: Luca Coelho <luciano.coelho@intel.com>
+Date: Wed, 15 Aug 2018 22:07:25 +0300
+Subject: [PATCH] iwlwifi: fix devices with PCI Device ID 0x34F0 and 11ac RF modules
+Git-commit: ab27926d9e4ae23df4f4d98e31f067c8b486bb4f
+Patch-mainline: v4.20-rc1
+References: bsc#1111666
+
+The devices with PCI device ID 0x34F0 are part of the SoC and can be
+combined with some different external RF modules. The configuration
+for these devices should reflect that, but are currently mixed up. To
+avoid confusion with discrete devices, add part of the firmware to be
+used and the official name of the device to the cfg structs.
+
+This is least reorganization possible (without messing things even
+more) that could be done as a bugfix for this SoC. Further
+reorganization of this code will be done separately.
+
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/cfg/22000.c | 65 +++++++++++++++++++++++--
+ drivers/net/wireless/intel/iwlwifi/iwl-config.h | 9 +++-
+ drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 55 ++++++++++-----------
+ 3 files changed, 97 insertions(+), 32 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+index c6b738c8fd84..204a51fd6375 100644
+--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c
+@@ -77,10 +77,13 @@
+ #define IWL_22000_HR_FW_PRE "iwlwifi-Qu-a0-hr-a0-"
+ #define IWL_22000_HR_CDB_FW_PRE "iwlwifi-QuIcp-z0-hrcdb-a0-"
+ #define IWL_22000_HR_A_F0_FW_PRE "iwlwifi-QuQnj-f0-hr-a0-"
+-#define IWL_22000_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_HR_B_F0_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_QU_B_HR_B_FW_PRE "iwlwifi-Qu-b0-hr-b0-"
++#define IWL_22000_HR_B_FW_PRE "iwlwifi-QuQnj-b0-hr-b0-"
+ #define IWL_22000_JF_B0_FW_PRE "iwlwifi-QuQnj-a0-jf-b0-"
+ #define IWL_22000_HR_A0_FW_PRE "iwlwifi-QuQnj-a0-hr-a0-"
+ #define IWL_22000_SU_Z0_FW_PRE "iwlwifi-su-z0-"
++#define IWL_QU_B_JF_B_FW_PRE "iwlwifi-Qu-b0-jf-b0-"
+
+ #define IWL_22000_HR_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
+@@ -88,7 +91,11 @@
+ IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_A_F0_FW_PRE __stringify(api) ".ucode"
+-#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
++#define IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(api) \
++ IWL_22000_HR_B_F0_FW_PRE __stringify(api) ".ucode"
++#define IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(api) \
++ IWL_22000_QU_B_HR_B_FW_PRE __stringify(api) ".ucode"
++#define IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_HR_B_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
+ IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
+@@ -96,6 +103,8 @@
+ IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+ #define IWL_22000_SU_Z0_MODULE_FIRMWARE(api) \
+ IWL_22000_SU_Z0_FW_PRE __stringify(api) ".ucode"
++#define IWL_QU_B_JF_B_MODULE_FIRMWARE(api) \
++ IWL_QU_B_JF_B_FW_PRE __stringify(api) ".ucode"
+
+ #define NVM_HW_SECTION_NUM_FAMILY_22000 10
+
+@@ -192,7 +201,54 @@ const struct iwl_cfg iwl22000_2ac_cfg_jf = {
+
+ const struct iwl_cfg iwl22000_2ax_cfg_hr = {
+ .name = "Intel(R) Dual Band Wireless AX 22000",
+- .fw_name_pre = IWL_22000_HR_FW_PRE,
++ .fw_name_pre = IWL_22000_QU_B_HR_B_FW_PRE,
++ IWL_DEVICE_22500,
++ /*
++ * This device doesn't support receiving BlockAck with a large bitmap
++ * so we need to restrict the size of transmitted aggregation to the
++ * HT size; mac80211 would otherwise pick the HE max (256) by default.
++ */
++ .max_tx_agg_size = IEEE80211_MAX_AMPDU_BUF_HT,
++};
++
++/*
++ * All JF radio modules are part of the 9000 series, but the MAC part
++ * looks more like 22000. That's why this device is here, but called
++ * 9560 nevertheless.
++ */
++const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9461",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9462",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Intel(R) Wireless-AC 9560",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0 = {
++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
++ IWL_DEVICE_22500,
++};
++
++const struct iwl_cfg iwl22000_2ax_cfg_jf = {
++ .name = "Intel(R) Dual Band Wireless AX 22000",
++ .fw_name_pre = IWL_QU_B_JF_B_FW_PRE,
+ IWL_DEVICE_22500,
+ /*
+ * This device doesn't support receiving BlockAck with a large bitmap
+@@ -266,7 +322,10 @@ const struct iwl_cfg iwl22560_2ax_cfg_su_cdb = {
+ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+ MODULE_FIRMWARE(IWL_22000_SU_Z0_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
++MODULE_FIRMWARE(IWL_QU_B_JF_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX));
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+index 5e1280783376..5eb906a0d0d2 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h
+@@ -573,11 +573,18 @@ extern const struct iwl_cfg iwl22000_2ac_cfg_hr;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_hr_cdb;
+ extern const struct iwl_cfg iwl22000_2ac_cfg_jf;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_hr;
++extern const struct iwl_cfg iwl9461_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl9462_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl9560_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg killer1550i_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg killer1550s_2ac_cfg_qu_b0_jf_b0;
++extern const struct iwl_cfg iwl22000_2ax_cfg_jf;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0_f0;
++extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0_f0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_b0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_jf_b0;
+ extern const struct iwl_cfg iwl22000_2ax_cfg_qnj_hr_a0;
+ extern const struct iwl_cfg iwl22560_2ax_cfg_su_cdb;
+-#endif /* CONFIG_IWLMVM */
++#endif /* CPTCFG_IWLMVM || CPTCFG_IWLFMAC */
+
+ #endif /* __IWL_CONFIG_H__ */
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+index 0d40864ac90f..9e015212c2c0 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+@@ -641,34 +641,33 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
+ {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x4234, iwl9560_2ac_cfg_shared_clk)},
+ {IWL_PCI_DEVICE(0x31DC, 0x42A4, iwl9462_2ac_cfg_shared_clk)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_soc)},
+- {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_soc)},
++
++ {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1551, killer1550s_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x1552, killer1550i_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_qu_b0_jf_b0)},
++ {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_qu_b0_jf_b0)},
++
+ {IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)},
+ {IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_cfg_soc)},
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-mvm-Drop-large-non-sta-frames.patch b/patches.drivers/iwlwifi-mvm-Drop-large-non-sta-frames.patch
new file mode 100644
index 0000000000..33c56b88cd
--- /dev/null
+++ b/patches.drivers/iwlwifi-mvm-Drop-large-non-sta-frames.patch
@@ -0,0 +1,41 @@
+From ac70499ee97231a418dc1a4d6c9dc102e8f64631 Mon Sep 17 00:00:00 2001
+From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Date: Mon, 15 Apr 2019 16:45:04 +0300
+Subject: [PATCH] iwlwifi: mvm: Drop large non sta frames
+Git-commit: ac70499ee97231a418dc1a4d6c9dc102e8f64631
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+In some buggy scenarios we could possible attempt to transmit frames larger
+than maximum MSDU size. Since our devices don't know how to handle this,
+it may result in asserts, hangs etc.
+This can happen, for example, when we receive a large multicast frame
+and try to transmit it back to the air in AP mode.
+Since in a legal scenario this should never happen, drop such frames and
+warn about it.
+
+Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+index 16f7458e2e81..a3e5d88f1c07 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+@@ -726,6 +726,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
+
+ memcpy(&info, skb->cb, sizeof(info));
+
++ if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen))
++ return -1;
++
+ if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU))
+ return -1;
+
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-pcie-don-t-service-an-interrupt-that-was-mas.patch b/patches.drivers/iwlwifi-pcie-don-t-service-an-interrupt-that-was-mas.patch
new file mode 100644
index 0000000000..fb330465b8
--- /dev/null
+++ b/patches.drivers/iwlwifi-pcie-don-t-service-an-interrupt-that-was-mas.patch
@@ -0,0 +1,76 @@
+From 3b57a10ca14c619707398dc58fe5ece18c95b20b Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 21 May 2019 15:10:38 +0300
+Subject: [PATCH] iwlwifi: pcie: don't service an interrupt that was masked
+Git-commit: 3b57a10ca14c619707398dc58fe5ece18c95b20b
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Sometimes the register status can include interrupts that
+were masked. We can, for example, get the RF-Kill bit set
+in the interrupt status register although this interrupt
+was masked. Then if we get the ALIVE interrupt (for example)
+that was not masked, we need to *not* service the RF-Kill
+interrupt.
+Fix this in the MSI-X interrupt handler.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 27 +++++++++++++++++++++------
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index de9c2a4cd330..a2d709642b2a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -2111,10 +2111,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+ return IRQ_NONE;
+ }
+
+- if (iwl_have_debug_level(IWL_DL_ISR))
+- IWL_DEBUG_ISR(trans, "ISR inta_fh 0x%08x, enabled 0x%08x\n",
+- inta_fh,
++ if (iwl_have_debug_level(IWL_DL_ISR)) {
++ IWL_DEBUG_ISR(trans,
++ "ISR inta_fh 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
++ inta_fh, trans_pcie->fh_mask,
+ iwl_read32(trans, CSR_MSIX_FH_INT_MASK_AD));
++ if (inta_fh & ~trans_pcie->fh_mask)
++ IWL_DEBUG_ISR(trans,
++ "We got a masked interrupt (0x%08x)\n",
++ inta_fh & ~trans_pcie->fh_mask);
++ }
++
++ inta_fh &= trans_pcie->fh_mask;
+
+ if ((trans_pcie->shared_vec_mask & IWL_SHARED_IRQ_NON_RX) &&
+ inta_fh & MSIX_FH_INT_CAUSES_Q0) {
+@@ -2154,11 +2162,18 @@ irqreturn_t iwl_pcie_irq_msix_handler(int irq, void *dev_id)
+ }
+
+ /* After checking FH register check HW register */
+- if (iwl_have_debug_level(IWL_DL_ISR))
++ if (iwl_have_debug_level(IWL_DL_ISR)) {
+ IWL_DEBUG_ISR(trans,
+- "ISR inta_hw 0x%08x, enabled 0x%08x\n",
+- inta_hw,
++ "ISR inta_hw 0x%08x, enabled (sw) 0x%08x (hw) 0x%08x\n",
++ inta_hw, trans_pcie->hw_mask,
+ iwl_read32(trans, CSR_MSIX_HW_INT_MASK_AD));
++ if (inta_hw & ~trans_pcie->hw_mask)
++ IWL_DEBUG_ISR(trans,
++ "We got a masked interrupt 0x%08x\n",
++ inta_hw & ~trans_pcie->hw_mask);
++ }
++
++ inta_hw &= trans_pcie->hw_mask;
+
+ /* Alive notification via Rx interrupt will do the real work */
+ if (inta_hw & MSIX_HW_INT_CAUSES_REG_ALIVE) {
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-pcie-fix-ALIVE-interrupt-handling-for-gen2-d.patch b/patches.drivers/iwlwifi-pcie-fix-ALIVE-interrupt-handling-for-gen2-d.patch
new file mode 100644
index 0000000000..5063d3d716
--- /dev/null
+++ b/patches.drivers/iwlwifi-pcie-fix-ALIVE-interrupt-handling-for-gen2-d.patch
@@ -0,0 +1,76 @@
+From ec46ae30245ecb41d73f8254613db07c653fb498 Mon Sep 17 00:00:00 2001
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Tue, 21 May 2019 15:03:21 +0300
+Subject: [PATCH] iwlwifi: pcie: fix ALIVE interrupt handling for gen2 devices w/o MSI-X
+Git-commit: ec46ae30245ecb41d73f8254613db07c653fb498
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+We added code to restock the buffer upon ALIVE interrupt
+when MSI-X is disabled. This was added as part of the context
+info code. This code was added only if the ISR debug level
+is set which is very unlikely to be related.
+Move this code to run even when the ISR debug level is not
+set.
+
+Note that gen2 devices work with MSI-X in most cases so that
+this path is seldom used.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 34 +++++++++++++---------------
+ 1 file changed, 16 insertions(+), 18 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+index 7e370a92de0e..578ee793c2f4 100644
+--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+@@ -1827,25 +1827,23 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
+ goto out;
+ }
+
+- if (iwl_have_debug_level(IWL_DL_ISR)) {
+- /* NIC fires this, but we don't use it, redundant with WAKEUP */
+- if (inta & CSR_INT_BIT_SCD) {
+- IWL_DEBUG_ISR(trans,
+- "Scheduler finished to transmit the frame/frames.\n");
+- isr_stats->sch++;
+- }
++ /* NIC fires this, but we don't use it, redundant with WAKEUP */
++ if (inta & CSR_INT_BIT_SCD) {
++ IWL_DEBUG_ISR(trans,
++ "Scheduler finished to transmit the frame/frames.\n");
++ isr_stats->sch++;
++ }
+
+- /* Alive notification via Rx interrupt will do the real work */
+- if (inta & CSR_INT_BIT_ALIVE) {
+- IWL_DEBUG_ISR(trans, "Alive interrupt\n");
+- isr_stats->alive++;
+- if (trans->cfg->gen2) {
+- /*
+- * We can restock, since firmware configured
+- * the RFH
+- */
+- iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+- }
++ /* Alive notification via Rx interrupt will do the real work */
++ if (inta & CSR_INT_BIT_ALIVE) {
++ IWL_DEBUG_ISR(trans, "Alive interrupt\n");
++ isr_stats->alive++;
++ if (trans->cfg->gen2) {
++ /*
++ * We can restock, since firmware configured
++ * the RFH
++ */
++ iwl_pcie_rxmq_restock(trans, trans_pcie->rxq);
+ }
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/iwlwifi-rename-the-temporary-name-of-A000-to-the-off.patch b/patches.drivers/iwlwifi-rename-the-temporary-name-of-A000-to-the-off.patch
index 96c1723392..cb40c8b70d 100644
--- a/patches.drivers/iwlwifi-rename-the-temporary-name-of-A000-to-the-off.patch
+++ b/patches.drivers/iwlwifi-rename-the-temporary-name-of-A000-to-the-off.patch
@@ -129,15 +129,15 @@ Acked-by: Takashi Iwai <tiwai@suse.de>
+#define IWL_22000_HR_A0_FW_PRE "iwlwifi-QuQnj-a0-hr-a0-"
+
+#define IWL_22000_HR_MODULE_FIRMWARE(api) \
-+ IWL_22000_HR_FW_PRE "-" __stringify(api) ".ucode"
++ IWL_22000_HR_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_JF_MODULE_FIRMWARE(api) \
-+ IWL_22000_JF_FW_PRE "-" __stringify(api) ".ucode"
++ IWL_22000_JF_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_F0_QNJ_MODULE_FIRMWARE(api) \
-+ IWL_22000_HR_F0_FW_PRE "-" __stringify(api) ".ucode"
++ IWL_22000_HR_F0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(api) \
-+ IWL_22000_JF_B0_FW_PRE "-" __stringify(api) ".ucode"
++ IWL_22000_JF_B0_FW_PRE __stringify(api) ".ucode"
+#define IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(api) \
-+ IWL_22000_HR_A0_FW_PRE "-" __stringify(api) ".ucode"
++ IWL_22000_HR_A0_FW_PRE __stringify(api) ".ucode"
+
+#define NVM_HW_SECTION_NUM_FAMILY_22000 10
+
diff --git a/patches.drivers/mlxsw-spectrum_dcb-Configure-DSCP-map-as-the-last-ru.patch b/patches.drivers/mlxsw-spectrum_dcb-Configure-DSCP-map-as-the-last-ru.patch
new file mode 100644
index 0000000000..72c5dfea48
--- /dev/null
+++ b/patches.drivers/mlxsw-spectrum_dcb-Configure-DSCP-map-as-the-last-ru.patch
@@ -0,0 +1,72 @@
+From: Petr Machata <petrm@mellanox.com>
+Date: Wed, 17 Jul 2019 23:29:07 +0300
+Subject: mlxsw: spectrum_dcb: Configure DSCP map as the last rule is removed
+Patch-mainline: v5.3-rc1
+Git-commit: dedfde2fe1c4ccf27179fcb234e2112d065c39bb
+References: bsc#1112374
+
+Spectrum systems use DSCP rewrite map to update DSCP field in egressing
+packets to correspond to priority that the packet has. Whether rewriting
+will take place is determined at the point when the packet ingresses the
+switch: if the port is in Trust L3 mode, packet priority is determined from
+the DSCP map at the port, and DSCP rewrite will happen. If the port is in
+Trust L2 mode, 802.1p is used for packet prioritization, and no DSCP
+rewrite will happen.
+
+The driver determines the port trust mode based on whether any DSCP
+prioritization rules are in effect at given port. If there are any, trust
+level is L3, otherwise it's L2. When the last DSCP rule is removed, the
+port is switched to trust L2. Under that scenario, if DSCP of a packet
+should be rewritten, it should be rewritten to 0.
+
+However, when switching to Trust L2, the driver neglects to also update the
+DSCP rewrite map. The last DSCP rule thus remains in effect, and packets
+egressing through this port, if they have the right priority, will have
+their DSCP set according to this rule.
+
+Fix by first configuring the rewrite map, and only then switching to trust
+L2 and bailing out.
+
+Fixes: b2b1dab6884e ("mlxsw: spectrum: Support ieee_setapp, ieee_delapp")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Reported-by: Alex Veber <alexve@mellanox.com>
+Tested-by: Alex Veber <alexve@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_dcb.c
+@@ -408,14 +408,6 @@ static int mlxsw_sp_port_dcb_app_update(
+ have_dscp = mlxsw_sp_port_dcb_app_prio_dscp_map(mlxsw_sp_port,
+ &prio_map);
+
+- if (!have_dscp) {
+- err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
+- MLXSW_REG_QPTS_TRUST_STATE_PCP);
+- if (err)
+- netdev_err(mlxsw_sp_port->dev, "Couldn't switch to trust L2\n");
+- return err;
+- }
+-
+ mlxsw_sp_port_dcb_app_dscp_prio_map(mlxsw_sp_port, default_prio,
+ &dscp_map);
+ err = mlxsw_sp_port_dcb_app_update_qpdpm(mlxsw_sp_port,
+@@ -432,6 +424,14 @@ static int mlxsw_sp_port_dcb_app_update(
+ return err;
+ }
+
++ if (!have_dscp) {
++ err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
++ MLXSW_REG_QPTS_TRUST_STATE_PCP);
++ if (err)
++ netdev_err(mlxsw_sp_port->dev, "Couldn't switch to trust L2\n");
++ return err;
++ }
++
+ err = mlxsw_sp_port_dcb_toggle_trust(mlxsw_sp_port,
+ MLXSW_REG_QPTS_TRUST_STATE_DSCP);
+ if (err) {
diff --git a/patches.drivers/mt7601u-do-not-schedule-rx_tasklet-when-the-device-h.patch b/patches.drivers/mt7601u-do-not-schedule-rx_tasklet-when-the-device-h.patch
new file mode 100644
index 0000000000..25b16648a6
--- /dev/null
+++ b/patches.drivers/mt7601u-do-not-schedule-rx_tasklet-when-the-device-h.patch
@@ -0,0 +1,115 @@
+From 4079e8ccabc3b6d1b503f2376123cb515d14921f Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 7 Jun 2019 13:48:09 +0200
+Subject: [PATCH] mt7601u: do not schedule rx_tasklet when the device has been disconnected
+Git-commit: 4079e8ccabc3b6d1b503f2376123cb515d14921f
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Do not schedule rx_tasklet when the usb dongle is disconnected.
+Moreover do not grub rx_lock in mt7601u_kill_rx since usb_poison_urb
+can run concurrently with urb completion and we can unlink urbs from rx
+ring in any order.
+This patch fixes the common kernel warning reported when
+the device is removed.
+
+[ 24.921354] usb 3-14: USB disconnect, device number 7
+[ 24.921593] ------------[ cut here ]------------
+[ 24.921594] RX urb mismatch
+[ 24.921675] WARNING: CPU: 4 PID: 163 at drivers/net/wireless/mediatek/mt7601u/dma.c:200 mt7601u_complete_rx+0xcb/0xd0 [mt7601u]
+[ 24.921769] CPU: 4 PID: 163 Comm: kworker/4:2 Tainted: G OE 4.19.31-041931-generic #201903231635
+[ 24.921770] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./Z97 Extreme4, BIOS P1.30 05/23/2014
+[ 24.921782] Workqueue: usb_hub_wq hub_event
+[ 24.921797] RIP: 0010:mt7601u_complete_rx+0xcb/0xd0 [mt7601u]
+[ 24.921800] RSP: 0018:ffff9bd9cfd03d08 EFLAGS: 00010086
+[ 24.921802] RAX: 0000000000000000 RBX: ffff9bd9bf043540 RCX: 0000000000000006
+[ 24.921803] RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9bd9cfd16420
+[ 24.921804] RBP: ffff9bd9cfd03d28 R08: 0000000000000002 R09: 00000000000003a8
+[ 24.921805] R10: 0000002f485fca34 R11: 0000000000000000 R12: ffff9bd9bf043c1c
+[ 24.921806] R13: ffff9bd9c62fa3c0 R14: 0000000000000082 R15: 0000000000000000
+[ 24.921807] FS: 0000000000000000(0000) GS:ffff9bd9cfd00000(0000) knlGS:0000000000000000
+[ 24.921808] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 24.921808] CR2: 00007fb2648b0000 CR3: 0000000142c0a004 CR4: 00000000001606e0
+[ 24.921809] Call Trace:
+[ 24.921812] <IRQ>
+[ 24.921819] __usb_hcd_giveback_urb+0x8b/0x140
+[ 24.921821] usb_hcd_giveback_urb+0xca/0xe0
+[ 24.921828] xhci_giveback_urb_in_irq.isra.42+0x82/0xf0
+[ 24.921834] handle_cmd_completion+0xe02/0x10d0
+[ 24.921837] xhci_irq+0x274/0x4a0
+[ 24.921838] xhci_msi_irq+0x11/0x20
+[ 24.921851] __handle_irq_event_percpu+0x44/0x190
+[ 24.921856] handle_irq_event_percpu+0x32/0x80
+[ 24.921861] handle_irq_event+0x3b/0x5a
+[ 24.921867] handle_edge_irq+0x80/0x190
+[ 24.921874] handle_irq+0x20/0x30
+[ 24.921889] do_IRQ+0x4e/0xe0
+[ 24.921891] common_interrupt+0xf/0xf
+[ 24.921892] </IRQ>
+[ 24.921900] RIP: 0010:usb_hcd_flush_endpoint+0x78/0x180
+[ 24.921354] usb 3-14: USB disconnect, device number 7
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/mediatek/mt7601u/dma.c | 33 ++++++++++++++++-------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index f7edeffb2b19..134f8a5bb5d4 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -193,10 +193,23 @@ static void mt7601u_complete_rx(struct urb *urb)
+ struct mt7601u_rx_queue *q = &dev->rx_q;
+ unsigned long flags;
+
+- spin_lock_irqsave(&dev->rx_lock, flags);
++ /* do no schedule rx tasklet if urb has been unlinked
++ * or the device has been removed
++ */
++ switch (urb->status) {
++ case -ECONNRESET:
++ case -ESHUTDOWN:
++ case -ENOENT:
++ return;
++ default:
++ dev_err_ratelimited(dev->dev, "rx urb failed: %d\n",
++ urb->status);
++ /* fall through */
++ case 0:
++ break;
++ }
+
+- if (mt7601u_urb_has_error(urb))
+- dev_err(dev->dev, "Error: RX urb failed:%d\n", urb->status);
++ spin_lock_irqsave(&dev->rx_lock, flags);
+ if (WARN_ONCE(q->e[q->end].urb != urb, "RX urb mismatch"))
+ goto out;
+
+@@ -363,19 +376,9 @@ int mt7601u_dma_enqueue_tx(struct mt7601u_dev *dev, struct sk_buff *skb,
+ static void mt7601u_kill_rx(struct mt7601u_dev *dev)
+ {
+ int i;
+- unsigned long flags;
+
+- spin_lock_irqsave(&dev->rx_lock, flags);
+-
+- for (i = 0; i < dev->rx_q.entries; i++) {
+- int next = dev->rx_q.end;
+-
+- spin_unlock_irqrestore(&dev->rx_lock, flags);
+- usb_poison_urb(dev->rx_q.e[next].urb);
+- spin_lock_irqsave(&dev->rx_lock, flags);
+- }
+-
+- spin_unlock_irqrestore(&dev->rx_lock, flags);
++ for (i = 0; i < dev->rx_q.entries; i++)
++ usb_poison_urb(dev->rx_q.e[i].urb);
+ }
+
+ static int mt7601u_submit_rx_buf(struct mt7601u_dev *dev,
+--
+2.16.4
+
diff --git a/patches.drivers/mt7601u-fix-possible-memory-leak-when-the-device-is-.patch b/patches.drivers/mt7601u-fix-possible-memory-leak-when-the-device-is-.patch
new file mode 100644
index 0000000000..378b85e111
--- /dev/null
+++ b/patches.drivers/mt7601u-fix-possible-memory-leak-when-the-device-is-.patch
@@ -0,0 +1,127 @@
+From 23377c200b2eb48a60d0f228b2a2e75ed6ee6060 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 7 Jun 2019 13:48:10 +0200
+Subject: [PATCH] mt7601u: fix possible memory leak when the device is disconnected
+Git-commit: 23377c200b2eb48a60d0f228b2a2e75ed6ee6060
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+When the device is disconnected while passing traffic it is possible
+to receive out of order urbs causing a memory leak since the skb linked
+to the current tx urb is not removed. Fix the issue deallocating the skb
+cleaning up the tx ring. Moreover this patch fixes the following kernel
+warning
+
+[ 57.480771] usb 1-1: USB disconnect, device number 2
+[ 57.483451] ------------[ cut here ]------------
+[ 57.483462] TX urb mismatch
+[ 57.483481] WARNING: CPU: 1 PID: 32 at drivers/net/wireless/mediatek/mt7601u/dma.c:245 mt7601u_complete_tx+0x165/00
+[ 57.483483] Modules linked in:
+[ 57.483496] CPU: 1 PID: 32 Comm: kworker/1:1 Not tainted 5.2.0-rc1+ #72
+[ 57.483498] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.12.0-2.fc30 04/01/2014
+[ 57.483502] Workqueue: usb_hub_wq hub_event
+[ 57.483507] RIP: 0010:mt7601u_complete_tx+0x165/0x1e0
+[ 57.483510] Code: 8b b5 10 04 00 00 8b 8d 14 04 00 00 eb 8b 80 3d b1 cb e1 00 00 75 9e 48 c7 c7 a4 ea 05 82 c6 05 f
+[ 57.483513] RSP: 0000:ffffc900000a0d28 EFLAGS: 00010092
+[ 57.483516] RAX: 000000000000000f RBX: ffff88802c0a62c0 RCX: ffffc900000a0c2c
+[ 57.483518] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff810a8371
+[ 57.483520] RBP: ffff88803ced6858 R08: 0000000000000000 R09: 0000000000000001
+[ 57.483540] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000046
+[ 57.483542] R13: ffff88802c0a6c88 R14: ffff88803baab540 R15: ffff88803a0cc078
+[ 57.483548] FS: 0000000000000000(0000) GS:ffff88803eb00000(0000) knlGS:0000000000000000
+[ 57.483550] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 57.483552] CR2: 000055e7f6780100 CR3: 0000000028c86000 CR4: 00000000000006a0
+[ 57.483554] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[ 57.483556] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[ 57.483559] Call Trace:
+[ 57.483561] <IRQ>
+[ 57.483565] __usb_hcd_giveback_urb+0x77/0xe0
+[ 57.483570] xhci_giveback_urb_in_irq.isra.0+0x8b/0x140
+[ 57.483574] handle_cmd_completion+0xf5b/0x12c0
+[ 57.483577] xhci_irq+0x1f6/0x1810
+[ 57.483581] ? lockdep_hardirqs_on+0x9e/0x180
+[ 57.483584] ? _raw_spin_unlock_irq+0x24/0x30
+[ 57.483588] __handle_irq_event_percpu+0x3a/0x260
+[ 57.483592] handle_irq_event_percpu+0x1c/0x60
+[ 57.483595] handle_irq_event+0x2f/0x4c
+[ 57.483599] handle_edge_irq+0x7e/0x1a0
+[ 57.483603] handle_irq+0x17/0x20
+[ 57.483607] do_IRQ+0x54/0x110
+[ 57.483610] common_interrupt+0xf/0xf
+[ 57.483612] </IRQ>
+
+Acked-by: Jakub Kicinski <kubakici@wp.pl>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/mediatek/mt7601u/dma.c | 21 ++++++++++++++++-----
+ drivers/net/wireless/mediatek/mt7601u/tx.c | 4 ++--
+ 2 files changed, 18 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/wireless/mediatek/mt7601u/dma.c b/drivers/net/wireless/mediatek/mt7601u/dma.c
+index 134f8a5bb5d4..401444f36402 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/dma.c
++++ b/drivers/net/wireless/mediatek/mt7601u/dma.c
+@@ -241,14 +241,25 @@ static void mt7601u_complete_tx(struct urb *urb)
+ struct sk_buff *skb;
+ unsigned long flags;
+
+- spin_lock_irqsave(&dev->tx_lock, flags);
++ switch (urb->status) {
++ case -ECONNRESET:
++ case -ESHUTDOWN:
++ case -ENOENT:
++ return;
++ default:
++ dev_err_ratelimited(dev->dev, "tx urb failed: %d\n",
++ urb->status);
++ /* fall through */
++ case 0:
++ break;
++ }
+
+- if (mt7601u_urb_has_error(urb))
+- dev_err(dev->dev, "Error: TX urb failed:%d\n", urb->status);
++ spin_lock_irqsave(&dev->tx_lock, flags);
+ if (WARN_ONCE(q->e[q->start].urb != urb, "TX urb mismatch"))
+ goto out;
+
+ skb = q->e[q->start].skb;
++ q->e[q->start].skb = NULL;
+ trace_mt_tx_dma_done(dev, skb);
+
+ __skb_queue_tail(&dev->tx_skb_done, skb);
+@@ -448,10 +459,10 @@ static void mt7601u_free_tx_queue(struct mt7601u_tx_queue *q)
+ {
+ int i;
+
+- WARN_ON(q->used);
+-
+ for (i = 0; i < q->entries; i++) {
+ usb_poison_urb(q->e[i].urb);
++ if (q->e[i].skb)
++ mt7601u_tx_status(q->dev, q->e[i].skb);
+ usb_free_urb(q->e[i].urb);
+ }
+ }
+diff --git a/drivers/net/wireless/mediatek/mt7601u/tx.c b/drivers/net/wireless/mediatek/mt7601u/tx.c
+index 3600e911a63e..4d81c45722fb 100644
+--- a/drivers/net/wireless/mediatek/mt7601u/tx.c
++++ b/drivers/net/wireless/mediatek/mt7601u/tx.c
+@@ -117,9 +117,9 @@ void mt7601u_tx_status(struct mt7601u_dev *dev, struct sk_buff *skb)
+ info->status.rates[0].idx = -1;
+ info->flags |= IEEE80211_TX_STAT_ACK;
+
+- spin_lock(&dev->mac_lock);
++ spin_lock_bh(&dev->mac_lock);
+ ieee80211_tx_status(dev->hw, skb);
+- spin_unlock(&dev->mac_lock);
++ spin_unlock_bh(&dev->mac_lock);
+ }
+
+ static int mt7601u_skb_rooms(struct mt7601u_dev *dev, struct sk_buff *skb)
+--
+2.16.4
+
diff --git a/patches.drivers/net-mlx5e-Rx-Fix-checksum-calculation-for-new-hardwa.patch b/patches.drivers/net-mlx5e-Rx-Fix-checksum-calculation-for-new-hardwa.patch
new file mode 100644
index 0000000000..b125816d19
--- /dev/null
+++ b/patches.drivers/net-mlx5e-Rx-Fix-checksum-calculation-for-new-hardwa.patch
@@ -0,0 +1,84 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Fri, 3 May 2019 13:14:59 -0700
+Subject: net/mlx5e: Rx, Fix checksum calculation for new hardware
+Patch-mainline: v5.3-rc1
+Git-commit: db849faa9bef993a1379dc510623f750a72fa7ce
+References: bsc#1127611
+
+CQE checksum full mode in new HW, provides a full checksum of rx frame.
+Covering bytes starting from eth protocol up to last byte in the received
+frame (frame_size - ETH_HLEN), as expected by the stack.
+
+Fixing up skb->csum by the driver is not required in such case. This fix
+is to avoid wrong checksum calculation in drivers which already support
+the new hardware with the new checksum mode.
+
+Fixes: 85327a9c4150 ("net/mlx5: Update the list of the PCI supported devices")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 +
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 +++
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 ++++++-
+ include/linux/mlx5/mlx5_ifc.h | 3 ++-
+ 4 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -301,6 +301,7 @@ enum {
+ MLX5E_RQ_STATE_ENABLED,
+ MLX5E_RQ_STATE_AM,
+ MLX5E_RQ_STATE_NO_CSUM_COMPLETE,
++ MLX5E_RQ_STATE_CSUM_FULL, /* cqe_csum_full hw bit is set */
+ };
+
+ struct mlx5e_cq {
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -942,6 +942,9 @@ static int mlx5e_open_rq(struct mlx5e_ch
+ if (err)
+ goto err_destroy_rq;
+
++ if (MLX5_CAP_ETH(c->mdev, cqe_checksum_full))
++ __set_bit(MLX5E_RQ_STATE_CSUM_FULL, &c->rq.state);
++
+ if (params->rx_dim_enabled)
+ __set_bit(MLX5E_RQ_STATE_AM, &c->rq.state);
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -829,8 +829,14 @@ static inline void mlx5e_handle_csum(str
+ if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP))
+ goto csum_unnecessary;
+
++ stats->csum_complete++;
+ skb->ip_summed = CHECKSUM_COMPLETE;
+ skb->csum = csum_unfold((__force __sum16)cqe->check_sum);
++
++ if (test_bit(MLX5E_RQ_STATE_CSUM_FULL, &rq->state))
++ return; /* CQE csum covers all received bytes */
++
++ /* csum might need some fixups ...*/
+ if (network_depth > ETH_HLEN)
+ /* CQE csum is calculated from the IP header and does
+ * not cover VLAN headers (if present). This will add
+@@ -841,7 +847,6 @@ static inline void mlx5e_handle_csum(str
+ skb->csum);
+
+ mlx5e_skb_padding_csum(skb, network_depth, proto, stats);
+- stats->csum_complete++;
+ return;
+ }
+
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -694,7 +694,8 @@ struct mlx5_ifc_per_protocol_networking_
+ u8 swp[0x1];
+ u8 swp_csum[0x1];
+ u8 swp_lso[0x1];
+- u8 reserved_at_23[0xd];
++ u8 cqe_checksum_full[0x1];
++ u8 reserved_at_24[0xc];
+ u8 max_vxlan_udp_ports[0x8];
+ u8 reserved_at_38[0x6];
+ u8 max_geneve_opt_len[0x1];
diff --git a/patches.drivers/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch b/patches.drivers/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
new file mode 100644
index 0000000000..0adf844d67
--- /dev/null
+++ b/patches.drivers/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
@@ -0,0 +1,33 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Mon, 8 Jul 2019 19:53:18 -0700
+Subject: net/tls: fix socket wmem accounting on fallback with netem
+Patch-mainline: v5.3-rc1
+Git-commit: 5c4b4608fe100838c62591877101128467e56c00
+References: bsc#1109837
+
+netem runs skb_orphan_partial() which "disconnects" the skb
+from normal TCP write memory accounting. We should not adjust
+sk->sk_wmem_alloc on the fallback path for such skbs.
+
+Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/tls/tls_device_fallback.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/tls/tls_device_fallback.c
++++ b/net/tls/tls_device_fallback.c
+@@ -208,6 +208,10 @@ static void complete_skb(struct sk_buff
+
+ update_chksum(nskb, headln);
+
++ /* sock_efree means skb must gone through skb_orphan_partial() */
++ if (nskb->destructor == sock_efree)
++ return;
++
+ delta = nskb->truesize - skb->truesize;
+ if (likely(delta < 0))
+ WARN_ON_ONCE(atomic_sub_and_test(-delta, &sk->sk_wmem_alloc));
diff --git a/patches.drivers/net-tls-make-sure-offload-also-gets-the-keys-wiped.patch b/patches.drivers/net-tls-make-sure-offload-also-gets-the-keys-wiped.patch
new file mode 100644
index 0000000000..56b3d5e29a
--- /dev/null
+++ b/patches.drivers/net-tls-make-sure-offload-also-gets-the-keys-wiped.patch
@@ -0,0 +1,64 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Fri, 28 Jun 2019 16:11:39 -0700
+Subject: net/tls: make sure offload also gets the keys wiped
+Patch-mainline: v5.3-rc1
+Git-commit: acd3e96d53a24d219f720ed4012b62723ae05da1
+References: bsc#1109837
+
+Commit 86029d10af18 ("tls: zero the crypto information from tls_context
+before freeing") added memzero_explicit() calls to clear the key material
+before freeing struct tls_context, but it missed tls_device.c has its
+own way of freeing this structure. Replace the missing free.
+
+Fixes: 86029d10af18 ("tls: zero the crypto information from tls_context before freeing")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/net/tls.h | 1 +
+ net/tls/tls_device.c | 2 +-
+ net/tls/tls_main.c | 4 ++--
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -263,6 +263,7 @@ struct tls_offload_context_rx {
+ (ALIGN(sizeof(struct tls_offload_context_rx), sizeof(void *)) + \
+ TLS_DRIVER_STATE_SIZE)
+
++void tls_ctx_free(struct tls_context *ctx);
+ int wait_on_pending_writer(struct sock *sk, long *timeo);
+ int tls_sk_query(struct sock *sk, int optname, char __user *optval,
+ int __user *optlen);
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -61,7 +61,7 @@ static void tls_device_free_ctx(struct t
+ if (ctx->rx_conf == TLS_HW)
+ kfree(tls_offload_ctx_rx(ctx));
+
+- kfree(ctx);
++ tls_ctx_free(ctx);
+ }
+
+ static void tls_device_gc_task(struct work_struct *work)
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -249,7 +249,7 @@ static void tls_write_space(struct sock
+ ctx->sk_write_space(sk);
+ }
+
+-static void tls_ctx_free(struct tls_context *ctx)
++void tls_ctx_free(struct tls_context *ctx)
+ {
+ if (!ctx)
+ return;
+@@ -567,7 +567,7 @@ static void tls_hw_sk_destruct(struct so
+
+ ctx->sk_destruct(sk);
+ /* Free ctx */
+- kfree(ctx);
++ tls_ctx_free(ctx);
+ icsk->icsk_ulp_data = NULL;
+ }
+
diff --git a/patches.drivers/platform-x86-asus-nb-wmi-Support-ALS-on-the-Zenbook-.patch b/patches.drivers/platform-x86-asus-nb-wmi-Support-ALS-on-the-Zenbook-.patch
index a376f637a3..3dc3577250 100644
--- a/patches.drivers/platform-x86-asus-nb-wmi-Support-ALS-on-the-Zenbook-.patch
+++ b/patches.drivers/platform-x86-asus-nb-wmi-Support-ALS-on-the-Zenbook-.patch
@@ -4,7 +4,7 @@ Date: Mon, 20 Nov 2017 14:18:44 -0700
Subject: [PATCH] platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ
Git-commit: db2582afa7444a0ce6bb1ebf1431715969a10b06
Patch-mainline: v4.16-rc1
-References: bsc#1126285
+References: bsc#1126285, bsc#1051510
This patch adds support for ALS on the Zenbook UX430UQ to the asus_nb_wmi
driver. It also renames "quirk_asus_ux330uak" to "quirk_asus_forceals"
diff --git a/patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch b/patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
index ec5feedfec..b01e1453d7 100644
--- a/patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
+++ b/patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
@@ -1,12 +1,12 @@
-From 401fee8195d401b2b94dee57383f627050724d5b Mon Sep 17 00:00:00 2001
From: Hans de Goede <hdegoede@redhat.com>
Date: Wed, 12 Jun 2019 09:02:02 +0200
Subject: [PATCH] platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi
Mime-version: 1.0
Content-type: text/plain; charset=UTF-8
Content-transfer-encoding: 8bit
-Git-commit: 401fee8195d401b2b94dee57383f627050724d5b
-Patch-mainline: v5.2-rc5
+Git-commit: 1dd93f873d8ed8e5b228d1ae324b1f3c1e94bfa8
+No-Fix: 401fee8195d401b2b94dee57383f627050724d5b
+Patch-mainline: v5.3-rc1
References: bsc#1051510
Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will
diff --git a/patches.drivers/qed-Fix-Wmaybe-uninitialized-false-positive.patch b/patches.drivers/qed-Fix-Wmaybe-uninitialized-false-positive.patch
new file mode 100644
index 0000000000..4f75e9e9f4
--- /dev/null
+++ b/patches.drivers/qed-Fix-Wmaybe-uninitialized-false-positive.patch
@@ -0,0 +1,43 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 17 Jun 2019 15:04:49 +0200
+Subject: qed: Fix -Wmaybe-uninitialized false positive
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.3-rc1
+Git-commit: 815deee0e34503dee7e74fb5ba4ea4a9b3a56750
+References: bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692
+
+A previous attempt to shut up the uninitialized variable use
+warning was apparently insufficient. When CONFIG_PROFILE_ANNOTATED_BRANCHES
+is set, gcc-8 still warns, because the unlikely() check in DP_NOTICE()
+causes it to no longer track the state of all variables correctly:
+
+drivers/net/ethernet/qlogic/qed/qed_dev.c: In function 'qed_llh_set_ppfid_affinity':
+drivers/net/ethernet/qlogic/qed/qed_dev.c:798:47: error: 'abs_ppfid' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ addr = NIG_REG_PPF_TO_ENGINE_SEL + abs_ppfid * 0x4;
+ ~~~~~~~~~~^~~~~
+
+This is not a nice workaround, but always initializing the output from
+qed_llh_abs_ppfid() at least shuts up the false positive reliably.
+
+Fixes: 79284adeb99e ("qed: Add llh ppfid interface and 100g support for offload protocols")
+Fixes: 8e2ea3ea9625 ("qed: Fix static checker warning")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -652,6 +652,7 @@ static int qed_llh_abs_ppfid(struct qed_
+ DP_NOTICE(cdev,
+ "ppfid %d is not valid, available indices are 0..%hhd\n",
+ ppfid, p_llh_info->num_ppfid - 1);
++ *p_abs_ppfid = 0;
+ return -EINVAL;
+ }
+
diff --git a/patches.drivers/qed-Fix-build-error-without-CONFIG_DEVLINK.patch b/patches.drivers/qed-Fix-build-error-without-CONFIG_DEVLINK.patch
new file mode 100644
index 0000000000..e5fa61d926
--- /dev/null
+++ b/patches.drivers/qed-Fix-build-error-without-CONFIG_DEVLINK.patch
@@ -0,0 +1,37 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Sat, 1 Jun 2019 16:06:05 +0800
+Subject: qed: Fix build error without CONFIG_DEVLINK
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.3-rc1
+Git-commit: bd8d7d9088289ba099721e7c696d988842b6cc24
+References: bsc#1136460 jsc#SLE-4691 bsc#1136461 jsc#SLE-4692
+
+Fix gcc build error while CONFIG_DEVLINK is not set
+
+drivers/net/ethernet/qlogic/qed/qed_main.o: In function `qed_remove':
+qed_main.c:(.text+0x1eb4): undefined reference to `devlink_unregister'
+
+Select DEVLINK to fix this.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: 24e04879abdd ("qed: Add qed devlink parameters table")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/qlogic/Kconfig
++++ b/drivers/net/ethernet/qlogic/Kconfig
+@@ -86,6 +86,7 @@ config QED
+ depends on PCI
+ select ZLIB_INFLATE
+ select CRC8
++ select NET_DEVLINK
+ ---help---
+ This enables the support for ...
+
diff --git a/patches.drivers/rtlwifi-rtl8192cu-fix-error-handle-when-usb-probe-fa.patch b/patches.drivers/rtlwifi-rtl8192cu-fix-error-handle-when-usb-probe-fa.patch
new file mode 100644
index 0000000000..e2480f7543
--- /dev/null
+++ b/patches.drivers/rtlwifi-rtl8192cu-fix-error-handle-when-usb-probe-fa.patch
@@ -0,0 +1,106 @@
+From 6c0ed66f1a5b84e2a812c7c2d6571a5621bf3396 Mon Sep 17 00:00:00 2001
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Wed, 29 May 2019 14:57:30 +0800
+Subject: [PATCH] rtlwifi: rtl8192cu: fix error handle when usb probe failed
+Git-commit: 6c0ed66f1a5b84e2a812c7c2d6571a5621bf3396
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+rtl_usb_probe() must do error handle rtl_deinit_core() only if
+rtl_init_core() is done, otherwise goto error_out2.
+
+| usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
+| rtl_usb: reg 0xf0, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0
+| rtl8192cu: Chip version 0x10
+| rtl_usb: reg 0xa, usbctrl_vendorreq TimeOut! status:0xffffffb9 value=0x0
+| rtl_usb: Too few input end points found
+| INFO: trying to register non-static key.
+| the code is fine but needs lockdep annotation.
+| turning off the locking correctness validator.
+| CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.1.0-rc4-319354-g9a33b36 #3
+| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+| Google 01/01/2011
+| Workqueue: usb_hub_wq hub_event
+| Call Trace:
+| __dump_stack lib/dump_stack.c:77 [inline]
+| dump_stack+0xe8/0x16e lib/dump_stack.c:113
+| assign_lock_key kernel/locking/lockdep.c:786 [inline]
+| register_lock_class+0x11b8/0x1250 kernel/locking/lockdep.c:1095
+| __lock_acquire+0xfb/0x37c0 kernel/locking/lockdep.c:3582
+| lock_acquire+0x10d/0x2f0 kernel/locking/lockdep.c:4211
+| __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
+| _raw_spin_lock_irqsave+0x44/0x60 kernel/locking/spinlock.c:152
+| rtl_c2hcmd_launcher+0xd1/0x390
+| drivers/net/wireless/realtek/rtlwifi/base.c:2344
+| rtl_deinit_core+0x25/0x2d0 drivers/net/wireless/realtek/rtlwifi/base.c:574
+| rtl_usb_probe.cold+0x861/0xa70
+| drivers/net/wireless/realtek/rtlwifi/usb.c:1093
+| usb_probe_interface+0x31d/0x820 drivers/usb/core/driver.c:361
+| really_probe+0x2da/0xb10 drivers/base/dd.c:509
+| driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
+| __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
+| bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
+| __device_attach+0x223/0x3a0 drivers/base/dd.c:844
+| bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
+| device_add+0xad2/0x16e0 drivers/base/core.c:2106
+| usb_set_configuration+0xdf7/0x1740 drivers/usb/core/message.c:2021
+| generic_probe+0xa2/0xda drivers/usb/core/generic.c:210
+| usb_probe_device+0xc0/0x150 drivers/usb/core/driver.c:266
+| really_probe+0x2da/0xb10 drivers/base/dd.c:509
+| driver_probe_device+0x21d/0x350 drivers/base/dd.c:671
+| __device_attach_driver+0x1d8/0x290 drivers/base/dd.c:778
+| bus_for_each_drv+0x163/0x1e0 drivers/base/bus.c:454
+| __device_attach+0x223/0x3a0 drivers/base/dd.c:844
+| bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
+| device_add+0xad2/0x16e0 drivers/base/core.c:2106
+| usb_new_device.cold+0x537/0xccf drivers/usb/core/hub.c:2534
+| hub_port_connect drivers/usb/core/hub.c:5089 [inline]
+| hub_port_connect_change drivers/usb/core/hub.c:5204 [inline]
+| port_event drivers/usb/core/hub.c:5350 [inline]
+| hub_event+0x138e/0x3b00 drivers/usb/core/hub.c:5432
+| process_one_work+0x90f/0x1580 kernel/workqueue.c:2269
+| worker_thread+0x9b/0xe20 kernel/workqueue.c:2415
+| kthread+0x313/0x420 kernel/kthread.c:253
+| ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
+
+Reported-by: syzbot+1fcc5ef45175fc774231@syzkaller.appspotmail.com
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/wireless/realtek/rtlwifi/usb.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
+index e24fda5e9087..34d68dbf4b4c 100644
+--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
+@@ -1064,13 +1064,13 @@ int rtl_usb_probe(struct usb_interface *intf,
+ rtlpriv->cfg->ops->read_eeprom_info(hw);
+ err = _rtl_usb_init(hw);
+ if (err)
+- goto error_out;
++ goto error_out2;
+ rtl_usb_init_sw(hw);
+ /* Init mac80211 sw */
+ err = rtl_init_core(hw);
+ if (err) {
+ pr_err("Can't allocate sw for mac80211\n");
+- goto error_out;
++ goto error_out2;
+ }
+ if (rtlpriv->cfg->ops->init_sw_vars(hw)) {
+ pr_err("Can't init_sw_vars\n");
+@@ -1091,6 +1091,7 @@ int rtl_usb_probe(struct usb_interface *intf,
+
+ error_out:
+ rtl_deinit_core(hw);
++error_out2:
+ _rtl_usb_io_handler_release(hw);
+ usb_put_dev(udev);
+ complete(&rtlpriv->firmware_loading_complete);
+--
+2.16.4
+
diff --git a/patches.drivers/scsi-ibmvfc-fix-WARN_ON-during-event-pool-release.patch b/patches.drivers/scsi-ibmvfc-fix-WARN_ON-during-event-pool-release.patch
new file mode 100644
index 0000000000..a797ed5ba7
--- /dev/null
+++ b/patches.drivers/scsi-ibmvfc-fix-WARN_ON-during-event-pool-release.patch
@@ -0,0 +1,75 @@
+From 5578257ca0e21056821e6481bd534ba267b84e58 Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Wed, 17 Jul 2019 14:48:27 -0500
+Subject: [PATCH] scsi: ibmvfc: fix WARN_ON during event pool release
+
+References: bsc#1137458 LTC#178093
+Patch-mainline: v5.3 or v5.3-rc2 (next release)
+Git-commit: 5578257ca0e21056821e6481bd534ba267b84e58
+
+While removing an ibmvfc client adapter a WARN_ON like the following
+WARN_ON is seen in the kernel log:
+
+WARNING: CPU: 6 PID: 5421 at ./include/linux/dma-mapping.h:541
+ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc]
+CPU: 6 PID: 5421 Comm: rmmod Tainted: G E 4.17.0-rc1-next-20180419-autotest #1
+NIP: d00000000290328c LR: d00000000290325c CTR: c00000000036ee20
+REGS: c000000288d1b7e0 TRAP: 0700 Tainted: G E (4.17.0-rc1-next-20180419-autotest)
+MSR: 800000010282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE,TM[E]> CR: 44008828 XER: 20000000
+CFAR: c00000000036e408 SOFTE: 1
+GPR00: d00000000290325c c000000288d1ba60 d000000002917900 c000000289d75448
+GPR04: 0000000000000071 c0000000ff870000 0000000018040000 0000000000000001
+GPR08: 0000000000000000 c00000000156e838 0000000000000001 d00000000290c640
+GPR12: c00000000036ee20 c00000001ec4dc00 0000000000000000 0000000000000000
+GPR16: 0000000000000000 0000000000000000 00000100276901e0 0000000010020598
+GPR20: 0000000010020550 0000000010020538 0000000010020578 00000000100205b0
+GPR24: 0000000000000000 0000000000000000 0000000010020590 5deadbeef0000100
+GPR28: 5deadbeef0000200 d000000002910b00 0000000000000071 c0000002822f87d8
+NIP [d00000000290328c] ibmvfc_free_event_pool+0x12c/0x1f0 [ibmvfc]
+LR [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc]
+Call Trace:
+[c000000288d1ba60] [d00000000290325c] ibmvfc_free_event_pool+0xfc/0x1f0 [ibmvfc] (unreliable)
+[c000000288d1baf0] [d000000002909390] ibmvfc_abort_task_set+0x7b0/0x8b0 [ibmvfc]
+[c000000288d1bb70] [c0000000000d8c68] vio_bus_remove+0x68/0x100
+[c000000288d1bbb0] [c0000000007da7c4] device_release_driver_internal+0x1f4/0x2d0
+[c000000288d1bc00] [c0000000007da95c] driver_detach+0x7c/0x100
+[c000000288d1bc40] [c0000000007d8af4] bus_remove_driver+0x84/0x140
+[c000000288d1bcb0] [c0000000007db6ac] driver_unregister+0x4c/0xa0
+[c000000288d1bd20] [c0000000000d6e7c] vio_unregister_driver+0x2c/0x50
+[c000000288d1bd50] [d00000000290ba0c] cleanup_module+0x24/0x15e0 [ibmvfc]
+[c000000288d1bd70] [c0000000001dadb0] sys_delete_module+0x220/0x2d0
+[c000000288d1be30] [c00000000000b284] system_call+0x58/0x6c
+Instruction dump:
+e8410018 e87f0068 809f0078 e8bf0080 e8df0088 2fa30000 419e008c e9230200
+2fa90000 419e0080 894d098a 794a07e0 <0b0a0000> e9290008 2fa90000 419e0028
+
+This is tripped as a result of irqs being disabled during the call to
+dma_free_coherent() by ibmvfc_free_event_pool(). At this point in the code path
+we have quiesced the adapter and its overly paranoid anyways to be holding the
+host lock.
+
+Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
+Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ drivers/scsi/ibmvscsi/ibmvfc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
+index acd16e0d52cf..8cdbac076a1b 100644
+--- a/drivers/scsi/ibmvscsi/ibmvfc.c
++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
+@@ -4864,8 +4864,8 @@ static int ibmvfc_remove(struct vio_dev *vdev)
+
+ spin_lock_irqsave(vhost->host->host_lock, flags);
+ ibmvfc_purge_requests(vhost, DID_ERROR);
+- ibmvfc_free_event_pool(vhost);
+ spin_unlock_irqrestore(vhost->host->host_lock, flags);
++ ibmvfc_free_event_pool(vhost);
+
+ ibmvfc_free_mem(vhost);
+ spin_lock(&ibmvfc_driver_lock);
+--
+2.22.0
+
diff --git a/patches.drivers/scsi-megaraid_sas-return-error-when-create-dma-pool-failed b/patches.drivers/scsi-megaraid_sas-return-error-when-create-dma-pool-failed
new file mode 100644
index 0000000000..6b25d21c26
--- /dev/null
+++ b/patches.drivers/scsi-megaraid_sas-return-error-when-create-dma-pool-failed
@@ -0,0 +1,74 @@
+From: Jason Yan <yanaijie@huawei.com>
+Date: Fri, 15 Feb 2019 19:50:27 +0800
+Subject: scsi: megaraid_sas: return error when create DMA pool failed
+Git-commit: bcf3b67d16a4c8ffae0aa79de5853435e683945c
+Patch-mainline: v5.1-rc1
+References: CVE-2019-11810 bsc#1134399
+
+when create DMA pool for cmd frames failed, we should return -ENOMEM,
+instead of 0.
+In some case in:
+
+ megasas_init_adapter_fusion()
+
+ -->megasas_alloc_cmds()
+ -->megasas_create_frame_pool
+ create DMA pool failed,
+ --> megasas_free_cmds() [1]
+
+ -->megasas_alloc_cmds_fusion()
+ failed, then goto fail_alloc_cmds.
+ -->megasas_free_cmds() [2]
+
+we will call megasas_free_cmds twice, [1] will kfree cmd_list,
+[2] will use cmd_list.it will cause a problem:
+
+Unable to handle kernel NULL pointer dereference at virtual address
+00000000
+pgd = ffffffc000f70000
+[00000000] *pgd=0000001fbf893003, *pud=0000001fbf893003,
+*pmd=0000001fbf894003, *pte=006000006d000707
+Internal error: Oops: 96000005 [#1] SMP
+ Modules linked in:
+ CPU: 18 PID: 1 Comm: swapper/0 Not tainted
+ task: ffffffdfb9290000 ti: ffffffdfb923c000 task.ti: ffffffdfb923c000
+ PC is at megasas_free_cmds+0x30/0x70
+ LR is at megasas_free_cmds+0x24/0x70
+ ...
+ Call trace:
+ [<ffffffc0005b779c>] megasas_free_cmds+0x30/0x70
+ [<ffffffc0005bca74>] megasas_init_adapter_fusion+0x2f4/0x4d8
+ [<ffffffc0005b926c>] megasas_init_fw+0x2dc/0x760
+ [<ffffffc0005b9ab0>] megasas_probe_one+0x3c0/0xcd8
+ [<ffffffc0004a5abc>] local_pci_probe+0x4c/0xb4
+ [<ffffffc0004a5c40>] pci_device_probe+0x11c/0x14c
+ [<ffffffc00053a5e4>] driver_probe_device+0x1ec/0x430
+ [<ffffffc00053a92c>] __driver_attach+0xa8/0xb0
+ [<ffffffc000538178>] bus_for_each_dev+0x74/0xc8
+ [<ffffffc000539e88>] driver_attach+0x28/0x34
+ [<ffffffc000539a18>] bus_add_driver+0x16c/0x248
+ [<ffffffc00053b234>] driver_register+0x6c/0x138
+ [<ffffffc0004a5350>] __pci_register_driver+0x5c/0x6c
+ [<ffffffc000ce3868>] megasas_init+0xc0/0x1a8
+ [<ffffffc000082a58>] do_one_initcall+0xe8/0x1ec
+ [<ffffffc000ca7be8>] kernel_init_freeable+0x1c8/0x284
+ [<ffffffc0008d90b8>] kernel_init+0x1c/0xe4
+
+Signed-off-by: Jason Yan <yanaijie@huawei.com>
+Acked-by: Sumit Saxena <sumit.saxena@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/megaraid/megaraid_sas_base.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -4149,6 +4149,7 @@ int megasas_alloc_cmds(struct megasas_in
+ if (megasas_create_frame_pool(instance)) {
+ dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating frame DMA pool\n");
+ megasas_free_cmds(instance);
++ return -ENOMEM;
+ }
+
+ return 0;
diff --git a/patches.drivers/tcp-fix-tcp_set_congestion_control-use-from-bpf-hook.patch b/patches.drivers/tcp-fix-tcp_set_congestion_control-use-from-bpf-hook.patch
new file mode 100644
index 0000000000..0bf1d67948
--- /dev/null
+++ b/patches.drivers/tcp-fix-tcp_set_congestion_control-use-from-bpf-hook.patch
@@ -0,0 +1,100 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 18 Jul 2019 19:28:14 -0700
+Subject: tcp: fix tcp_set_congestion_control() use from bpf hook
+Patch-mainline: v5.3-rc1
+Git-commit: 8d650cdedaabb33e85e9b7c517c0c71fcecc1de9
+References: bsc#1109837
+
+Neal reported incorrect use of ns_capable() from bpf hook.
+
+bpf_setsockopt(...TCP_CONGESTION...)
+ -> tcp_set_congestion_control()
+ -> ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)
+ -> ns_capable_common()
+ -> current_cred()
+ -> rcu_dereference_protected(current->cred, 1)
+
+Accessing 'current' in bpf context makes no sense, since packets
+are processed from softirq context.
+
+As Neal stated : The capability check in tcp_set_congestion_control()
+was written assuming a system call context, and then was reused from
+a BPF call site.
+
+The fix is to add a new parameter to tcp_set_congestion_control(),
+so that the ns_capable() call is only performed under the right
+context.
+
+Fixes: 91b5b21c7c16 ("bpf: Add support for changing congestion control")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Lawrence Brakmo <brakmo@fb.com>
+Reported-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Acked-by: Lawrence Brakmo <brakmo@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/net/tcp.h | 3 ++-
+ net/core/filter.c | 2 +-
+ net/ipv4/tcp.c | 4 +++-
+ net/ipv4/tcp_cong.c | 6 +++---
+ 4 files changed, 9 insertions(+), 6 deletions(-)
+
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -1035,7 +1035,8 @@ void tcp_get_default_congestion_control(
+ void tcp_get_available_congestion_control(char *buf, size_t len);
+ void tcp_get_allowed_congestion_control(char *buf, size_t len);
+ int tcp_set_allowed_congestion_control(char *allowed);
+-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit);
++int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
++ bool reinit, bool cap_net_admin);
+ u32 tcp_slow_start(struct tcp_sock *tp, u32 acked);
+ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked);
+
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3843,7 +3843,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_so
+ TCP_CA_NAME_MAX-1));
+ name[TCP_CA_NAME_MAX-1] = 0;
+ ret = tcp_set_congestion_control(sk, name, false,
+- reinit);
++ reinit, true);
+ } else {
+ struct tcp_sock *tp = tcp_sk(sk);
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2432,7 +2432,9 @@ static int do_tcp_setsockopt(struct sock
+ name[val] = 0;
+
+ lock_sock(sk);
+- err = tcp_set_congestion_control(sk, name, true, true);
++ err = tcp_set_congestion_control(sk, name, true, true,
++ ns_capable(sock_net(sk)->user_ns,
++ CAP_NET_ADMIN));
+ release_sock(sk);
+ return err;
+ }
+--- a/net/ipv4/tcp_cong.c
++++ b/net/ipv4/tcp_cong.c
+@@ -338,7 +338,8 @@ out:
+ * tcp_reinit_congestion_control (if the current congestion control was
+ * already initialized.
+ */
+-int tcp_set_congestion_control(struct sock *sk, const char *name, bool load, bool reinit)
++int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,
++ bool reinit, bool cap_net_admin)
+ {
+ struct inet_connection_sock *icsk = inet_csk(sk);
+ const struct tcp_congestion_ops *ca;
+@@ -372,8 +373,7 @@ int tcp_set_congestion_control(struct so
+ } else {
+ err = -EBUSY;
+ }
+- } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) ||
+- ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))) {
++ } else if (!((ca->flags & TCP_CONG_NON_RESTRICTED) || cap_net_admin)) {
+ err = -EPERM;
+ } else if (!try_module_get(ca->owner)) {
+ err = -EBUSY;
diff --git a/patches.drivers/tools-bpftool-Fix-json-dump-crash-on-powerpc.patch b/patches.drivers/tools-bpftool-Fix-json-dump-crash-on-powerpc.patch
new file mode 100644
index 0000000000..b945c995a0
--- /dev/null
+++ b/patches.drivers/tools-bpftool-Fix-json-dump-crash-on-powerpc.patch
@@ -0,0 +1,86 @@
+From: Jiri Olsa <jolsa@redhat.com>
+Date: Fri, 5 Jul 2019 14:10:31 +0200
+Subject: tools: bpftool: Fix json dump crash on powerpc
+Patch-mainline: v5.3-rc1
+Git-commit: aa52bcbe0e72fac36b1862db08b9c09c4caefae3
+References: bsc#1109837
+
+Michael reported crash with by bpf program in json mode on powerpc:
+
+ # bpftool prog -p dump jited id 14
+ [{
+ "name": "0xd00000000a9aa760",
+ "insns": [{
+ "pc": "0x0",
+ "operation": "nop",
+ "operands": [null
+ ]
+ },{
+ "pc": "0x4",
+ "operation": "nop",
+ "operands": [null
+ ]
+ },{
+ "pc": "0x8",
+ "operation": "mflr",
+ Segmentation fault (core dumped)
+
+The code is assuming char pointers in format, which is not always
+true at least for powerpc. Fixing this by dumping the whole string
+into buffer based on its format.
+
+Please note that libopcodes code does not check return values from
+fprintf callback, but as per Jakub suggestion returning -1 on allocation
+failure so we do the best effort to propagate the error.
+
+Fixes: 107f041212c1 ("tools: bpftool: add JSON output for `bpftool prog dump jited *` command")
+Reported-by: Michael Petlan <mpetlan@redhat.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ tools/bpf/bpftool/jit_disasm.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/tools/bpf/bpftool/jit_disasm.c
++++ b/tools/bpf/bpftool/jit_disasm.c
+@@ -10,6 +10,8 @@
+ * Licensed under the GNU General Public License, version 2.0 (GPLv2)
+ */
+
++#define _GNU_SOURCE
++#include <stdio.h>
+ #include <stdarg.h>
+ #include <stdint.h>
+ #include <stdio.h>
+@@ -51,11 +53,13 @@ static int fprintf_json(void *out, const
+ char *s;
+
+ va_start(ap, fmt);
++ if (vasprintf(&s, fmt, ap) < 0)
++ return -1;
++ va_end(ap);
++
+ if (!oper_count) {
+ int i;
+
+- s = va_arg(ap, char *);
+-
+ /* Strip trailing spaces */
+ i = strlen(s) - 1;
+ while (s[i] == ' ')
+@@ -68,11 +72,10 @@ static int fprintf_json(void *out, const
+ } else if (!strcmp(fmt, ",")) {
+ /* Skip */
+ } else {
+- s = va_arg(ap, char *);
+ jsonw_string(json_wtr, s);
+ oper_count++;
+ }
+- va_end(ap);
++ free(s);
+ return 0;
+ }
+
diff --git a/patches.drivers/tools-bpftool-use-correct-argument-in-cgroup-errors.patch b/patches.drivers/tools-bpftool-use-correct-argument-in-cgroup-errors.patch
new file mode 100644
index 0000000000..8987109660
--- /dev/null
+++ b/patches.drivers/tools-bpftool-use-correct-argument-in-cgroup-errors.patch
@@ -0,0 +1,49 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Tue, 25 Jun 2019 09:56:31 -0700
+Subject: tools: bpftool: use correct argument in cgroup errors
+Patch-mainline: v5.3-rc1
+Git-commit: 6c6874f401e5a0caab3b6a0663169e1fb5e930bb
+References: bsc#1109837
+
+cgroup code tries to use argv[0] as the cgroup path,
+but if it fails uses argv[1] to report errors.
+
+Fixes: 5ccda64d38cc ("bpftool: implement cgroup bpf operations")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Acked-by: Roman Gushchin <guro@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ tools/bpf/bpftool/cgroup.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/tools/bpf/bpftool/cgroup.c
++++ b/tools/bpf/bpftool/cgroup.c
+@@ -164,7 +164,7 @@ static int do_show(int argc, char **argv
+
+ cgroup_fd = open(argv[0], O_RDONLY);
+ if (cgroup_fd < 0) {
+- p_err("can't open cgroup %s", argv[1]);
++ p_err("can't open cgroup %s", argv[0]);
+ goto exit;
+ }
+
+@@ -345,7 +345,7 @@ static int do_attach(int argc, char **ar
+
+ cgroup_fd = open(argv[0], O_RDONLY);
+ if (cgroup_fd < 0) {
+- p_err("can't open cgroup %s", argv[1]);
++ p_err("can't open cgroup %s", argv[0]);
+ goto exit;
+ }
+
+@@ -403,7 +403,7 @@ static int do_detach(int argc, char **ar
+
+ cgroup_fd = open(argv[0], O_RDONLY);
+ if (cgroup_fd < 0) {
+- p_err("can't open cgroup %s", argv[1]);
++ p_err("can't open cgroup %s", argv[0]);
+ goto exit;
+ }
+
diff --git a/patches.drivers/xdp-fix-possible-cq-entry-leak.patch b/patches.drivers/xdp-fix-possible-cq-entry-leak.patch
new file mode 100644
index 0000000000..14f0bb8676
--- /dev/null
+++ b/patches.drivers/xdp-fix-possible-cq-entry-leak.patch
@@ -0,0 +1,62 @@
+From: Ilya Maximets <i.maximets@samsung.com>
+Date: Thu, 4 Jul 2019 17:25:03 +0300
+Subject: xdp: fix possible cq entry leak
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.3-rc1
+Git-commit: 675716400da6f15b9d3db04ef74ee74ca9a00af3
+References: bsc#1109837
+
+Completion queue address reservation could not be undone.
+In case of bad 'queue_id' or skb allocation failure, reserved entry
+will be leaked reducing the total capacity of completion queue.
+
+Fix that by moving reservation to the point where failure is not
+possible. Additionally, 'queue_id' checking moved out from the loop
+since there is no point to check it there.
+
+Fixes: 35fcde7f8deb ("xsk: support for Tx")
+Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Tested-by: William Tu <u9012063@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/xdp/xsk.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -242,6 +242,9 @@ static int xsk_generic_xmit(struct sock
+
+ mutex_lock(&xs->mutex);
+
++ if (xs->queue_id >= xs->dev->real_num_tx_queues)
++ goto out;
++
+ while (xskq_peek_desc(xs->tx, &desc)) {
+ char *buffer;
+ u64 addr;
+@@ -252,12 +255,6 @@ static int xsk_generic_xmit(struct sock
+ goto out;
+ }
+
+- if (xskq_reserve_addr(xs->umem->cq))
+- goto out;
+-
+- if (xs->queue_id >= xs->dev->real_num_tx_queues)
+- goto out;
+-
+ len = desc.len;
+ skb = sock_alloc_send_skb(sk, len, 1, &err);
+ if (unlikely(!skb)) {
+@@ -269,7 +266,7 @@ static int xsk_generic_xmit(struct sock
+ addr = desc.addr;
+ buffer = xdp_umem_get_data(xs->umem, addr);
+ err = skb_store_bits(skb, 0, buffer, len);
+- if (unlikely(err)) {
++ if (unlikely(err) || xskq_reserve_addr(xs->umem->cq)) {
+ kfree_skb(skb);
+ goto out;
+ }
diff --git a/patches.drivers/xdp-fix-race-on-generic-receive-path.patch b/patches.drivers/xdp-fix-race-on-generic-receive-path.patch
new file mode 100644
index 0000000000..ce3bf0bdc0
--- /dev/null
+++ b/patches.drivers/xdp-fix-race-on-generic-receive-path.patch
@@ -0,0 +1,97 @@
+From: Ilya Maximets <i.maximets@samsung.com>
+Date: Wed, 3 Jul 2019 15:09:16 +0300
+Subject: xdp: fix race on generic receive path
+Patch-mainline: v5.3-rc1
+Git-commit: bf0bdd1343efbbf65b4d53aef1fce14acbd79d50
+References: bsc#1109837
+
+Unlike driver mode, generic xdp receive could be triggered
+by different threads on different CPU cores at the same time
+leading to the fill and rx queue breakage. For example, this
+could happen while sending packets from two processes to the
+first interface of veth pair while the second part of it is
+open with AF_XDP socket.
+
+Need to take a lock for each generic receive to avoid race.
+
+Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support")
+Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
+Acked-by: Magnus Karlsson <magnus.karlsson@intel.com>
+Tested-by: William Tu <u9012063@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/net/xdp_sock.h | 2 ++
+ net/xdp/xsk.c | 31 ++++++++++++++++++++++---------
+ 2 files changed, 24 insertions(+), 9 deletions(-)
+
+--- a/include/net/xdp_sock.h
++++ b/include/net/xdp_sock.h
+@@ -66,6 +66,8 @@ struct xdp_sock {
+ * in the SKB destructor callback.
+ */
+ spinlock_t tx_completion_lock;
++ /* Protects generic receive. */
++ spinlock_t rx_lock;
+ u64 rx_dropped;
+ };
+
+--- a/net/xdp/xsk.c
++++ b/net/xdp/xsk.c
+@@ -127,13 +127,17 @@ int xsk_generic_rcv(struct xdp_sock *xs,
+ u64 addr;
+ int err;
+
+- if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index)
+- return -EINVAL;
++ spin_lock_bh(&xs->rx_lock);
++
++ if (xs->dev != xdp->rxq->dev || xs->queue_id != xdp->rxq->queue_index) {
++ err = -EINVAL;
++ goto out_unlock;
++ }
+
+ if (!xskq_peek_addr(xs->umem->fq, &addr) ||
+ len > xs->umem->chunk_size_nohr - XDP_PACKET_HEADROOM) {
+- xs->rx_dropped++;
+- return -ENOSPC;
++ err = -ENOSPC;
++ goto out_drop;
+ }
+
+ addr += xs->umem->headroom;
+@@ -142,13 +146,21 @@ int xsk_generic_rcv(struct xdp_sock *xs,
+ memcpy(buffer, xdp->data_meta, len + metalen);
+ addr += metalen;
+ err = xskq_produce_batch_desc(xs->rx, addr, len);
+- if (!err) {
+- xskq_discard_addr(xs->umem->fq);
+- xsk_flush(xs);
+- return 0;
+- }
++ if (err)
++ goto out_drop;
++
++ xskq_discard_addr(xs->umem->fq);
++ xskq_produce_flush_desc(xs->rx);
++
++ spin_unlock_bh(&xs->rx_lock);
+
++ xs->sk.sk_data_ready(&xs->sk);
++ return 0;
++
++out_drop:
+ xs->rx_dropped++;
++out_unlock:
++ spin_unlock_bh(&xs->rx_lock);
+ return err;
+ }
+
+@@ -765,6 +777,7 @@ static int xsk_create(struct net *net, s
+
+ xs = xdp_sk(sk);
+ mutex_init(&xs->mutex);
++ spin_lock_init(&xs->rx_lock);
+ spin_lock_init(&xs->tx_completion_lock);
+
+ local_bh_disable();
diff --git a/patches.drivers/xdp-hold-device-for-umem-regardless-of-zero-copy-mod.patch b/patches.drivers/xdp-hold-device-for-umem-regardless-of-zero-copy-mod.patch
new file mode 100644
index 0000000000..7a6cc53f08
--- /dev/null
+++ b/patches.drivers/xdp-hold-device-for-umem-regardless-of-zero-copy-mod.patch
@@ -0,0 +1,53 @@
+From: Ilya Maximets <i.maximets@samsung.com>
+Date: Fri, 28 Jun 2019 11:04:06 +0300
+Subject: xdp: hold device for umem regardless of zero-copy mode
+Patch-mainline: v5.3-rc1
+Git-commit: 162c820ed8965bf94d2685f97388aea5aee9e258
+References: bsc#1109837
+
+Device pointer stored in umem regardless of zero-copy mode,
+so we heed to hold the device in all cases.
+
+Fixes: c9b47cc1fabc ("xsk: fix bug when trying to use both copy and zero-copy on one queue id")
+Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/xdp/xdp_umem.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/net/xdp/xdp_umem.c
++++ b/net/xdp/xdp_umem.c
+@@ -102,6 +102,9 @@ int xdp_umem_assign_dev(struct xdp_umem
+
+ umem->dev = dev;
+ umem->queue_id = queue_id;
++
++ dev_hold(dev);
++
+ if (force_copy)
+ /* For copy-mode, we are done. */
+ goto out_rtnl_unlock;
+@@ -121,7 +124,6 @@ int xdp_umem_assign_dev(struct xdp_umem
+ goto err_unreg_umem;
+ rtnl_unlock();
+
+- dev_hold(dev);
+ umem->zc = true;
+ return 0;
+
+@@ -160,10 +162,9 @@ static void xdp_umem_clear_dev(struct xd
+ xdp_clear_umem_at_qid(umem->dev, umem->queue_id);
+ rtnl_unlock();
+
+- if (umem->zc) {
+- dev_put(umem->dev);
+- umem->zc = false;
+- }
++ dev_put(umem->dev);
++ umem->dev = NULL;
++ umem->zc = false;
+ }
+
+ static void xdp_umem_unpin_pages(struct xdp_umem *umem)
diff --git a/patches.drivers/xprtrdma-Fix-use-after-free-in-rpcrdma_post_recvs.patch b/patches.drivers/xprtrdma-Fix-use-after-free-in-rpcrdma_post_recvs.patch
new file mode 100644
index 0000000000..b1c0798814
--- /dev/null
+++ b/patches.drivers/xprtrdma-Fix-use-after-free-in-rpcrdma_post_recvs.patch
@@ -0,0 +1,35 @@
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 19 Jun 2019 10:32:38 -0400
+Subject: xprtrdma: Fix use-after-free in rpcrdma_post_recvs
+Patch-mainline: v5.3-rc1
+Git-commit: 2d0abe36cf13fb7b577949fd1539326adddcc9bc
+References: bsc#1103992 FATE#326009
+
+Dereference wr->next /before/ the memory backing wr has been
+released. This issue was found by code inspection. It is not
+expected to be a significant problem because it is in an error
+path that is almost never executed.
+
+Fixes: 7c8d9e7c8863 ("xprtrdma: Move Receive posting to ... ")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/sunrpc/xprtrdma/verbs.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -1553,10 +1553,11 @@ rpcrdma_post_recvs(struct rpcrdma_xprt *
+ rc = ib_post_recv(r_xprt->rx_ia.ri_id->qp, wr,
+ (const struct ib_recv_wr **)&bad_wr);
+ if (rc) {
+- for (wr = bad_wr; wr; wr = wr->next) {
++ for (wr = bad_wr; wr;) {
+ struct rpcrdma_rep *rep;
+
+ rep = container_of(wr, struct rpcrdma_rep, rr_recv_wr);
++ wr = wr->next;
+ rpcrdma_recv_buffer_put(rep);
+ --count;
+ }
diff --git a/patches.drivers/xsk-Properly-terminate-assignment-in-xskq_produce_fl.patch b/patches.drivers/xsk-Properly-terminate-assignment-in-xskq_produce_fl.patch
new file mode 100644
index 0000000000..63d8df433a
--- /dev/null
+++ b/patches.drivers/xsk-Properly-terminate-assignment-in-xskq_produce_fl.patch
@@ -0,0 +1,49 @@
+From: Nathan Chancellor <natechancellor@gmail.com>
+Date: Tue, 25 Jun 2019 11:23:52 -0700
+Subject: xsk: Properly terminate assignment in xskq_produce_flush_desc
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.3-rc1
+Git-commit: f7019b7b0ad14bde732b8953161994edfc384953
+References: bsc#1109837
+
+Clang warns:
+
+In file included from net/xdp/xsk_queue.c:10:
+net/xdp/xsk_queue.h:292:2: warning: expression result unused
+[-Wunused-value]
+ WRITE_ONCE(q->ring->producer, q->prod_tail);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include/linux/compiler.h:284:6: note: expanded from macro 'WRITE_ONCE'
+ __u.__val; \
+ ~~~ ^~~~~
+1 warning generated.
+
+The q->prod_tail assignment has a comma at the end, not a semi-colon.
+Fix that so clang no longer warns and everything works as expected.
+
+Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support")
+Link: https://github.com/ClangBuiltLinux/linux/issues/544
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Nick Desaulniers <ndesaulniers@google.com>
+Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Acked-by: Björn Töpel <bjorn.topel@intel.com>
+Acked-by: Song Liu <songliubraving@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/xdp/xsk_queue.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/xdp/xsk_queue.h
++++ b/net/xdp/xsk_queue.h
+@@ -240,7 +240,7 @@ static inline void xskq_produce_flush_de
+ /* Order producer and data */
+ smp_wmb();
+
+- q->prod_tail = q->prod_head,
++ q->prod_tail = q->prod_head;
+ WRITE_ONCE(q->ring->producer, q->prod_tail);
+ }
+
diff --git a/patches.fixes/0001-Input-tm2-touchkey-acknowledge-that-setting-brightne.patch b/patches.fixes/0001-Input-tm2-touchkey-acknowledge-that-setting-brightne.patch
new file mode 100644
index 0000000000..4db07de863
--- /dev/null
+++ b/patches.fixes/0001-Input-tm2-touchkey-acknowledge-that-setting-brightne.patch
@@ -0,0 +1,51 @@
+From 0ab0e5a383a78a9e3bd9a02a1b06237fe75fd6a1 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Wed, 6 Feb 2019 10:10:12 -0800
+Subject: [PATCH] Input: tm2-touchkey - acknowledge that setting brightness is
+ a blocking call
+Git-commit: 0ab0e5a383a78a9e3bd9a02a1b06237fe75fd6a1
+Patch-mainline: v5.1
+References: bsc#1129770
+
+We need to access I2C bus when switching brightness, and that may block,
+therefore we have to set stmfts_brightness_set() as LED's
+brightness_set_blocking() method.
+
+Fixes: 72d1f2346ded ("Input: tm2-touchkey - add touchkey driver support for TM2")
+Acked-by: Andi Shyti <andi@etezian.org>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+---
+ drivers/input/keyboard/tm2-touchkey.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/input/keyboard/tm2-touchkey.c
++++ b/drivers/input/keyboard/tm2-touchkey.c
+@@ -48,7 +48,7 @@ struct tm2_touchkey_data {
+ struct regulator_bulk_data regulators[2];
+ };
+
+-static void tm2_touchkey_led_brightness_set(struct led_classdev *led_dev,
++static int tm2_touchkey_led_brightness_set(struct led_classdev *led_dev,
+ enum led_brightness brightness)
+ {
+ struct tm2_touchkey_data *touchkey =
+@@ -65,7 +65,7 @@ static void tm2_touchkey_led_brightness_
+ }
+
+ regulator_set_voltage(touchkey->vdd, volt, volt);
+- i2c_smbus_write_byte_data(touchkey->client,
++ return i2c_smbus_write_byte_data(touchkey->client,
+ TM2_TOUCHKEY_BASE_REG, data);
+ }
+
+@@ -214,7 +214,8 @@ static int tm2_touchkey_probe(struct i2c
+ touchkey->led_dev.name = TM2_TOUCHKEY_DEV_NAME;
+ touchkey->led_dev.brightness = LED_FULL;
+ touchkey->led_dev.max_brightness = LED_ON;
+- touchkey->led_dev.brightness_set = tm2_touchkey_led_brightness_set;
++ touchkey->led_dev.brightness_set_blocking =
++ tm2_touchkey_led_brightness_set;
+
+ error = devm_led_classdev_register(&client->dev, &touchkey->led_dev);
+ if (error) {
diff --git a/patches.fixes/0001-xen-let-alloc_xenballooned_pages-fail-if-not-enough-.patch b/patches.fixes/0001-xen-let-alloc_xenballooned_pages-fail-if-not-enough-.patch
new file mode 100644
index 0000000000..1f8c44c30e
--- /dev/null
+++ b/patches.fixes/0001-xen-let-alloc_xenballooned_pages-fail-if-not-enough-.patch
@@ -0,0 +1,72 @@
+Patch-mainline: v5.3-rc1
+Git-commit: a1078e821b605813b63bf6bca414a85f804d5c66
+References: bsc#1142450 XSA-300
+From: Juergen Gross <jgross@suse.com>
+Date: Wed, 19 Jun 2019 11:00:56 +0200
+Subject: [PATCH] xen: let alloc_xenballooned_pages() fail if not enough memory
+ free
+
+Instead of trying to allocate pages with GFP_USER in
+add_ballooned_pages() check the available free memory via
+si_mem_available(). GFP_USER is far less limiting memory exhaustion
+than the test via si_mem_available().
+
+This will avoid dom0 running out of memory due to excessive foreign
+page mappings especially on ARM and on x86 in PVH mode, as those don't
+have a pre-ballooned area which can be used for foreign mappings.
+
+As the normal ballooning suffers from the same problem don't balloon
+down more than si_mem_available() pages in one iteration. At the same
+time limit the default maximum number of retries.
+
+This is part of XSA-300.
+
+Signed-off-by: Juergen Gross <jgross@suse.com>
+---
+ drivers/xen/balloon.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
+index d37dd5bb7a8f..559768dc2567 100644
+--- a/drivers/xen/balloon.c
++++ b/drivers/xen/balloon.c
+@@ -538,8 +538,15 @@ static void balloon_process(struct work_struct *work)
+ state = reserve_additional_memory();
+ }
+
+- if (credit < 0)
+- state = decrease_reservation(-credit, GFP_BALLOON);
++ if (credit < 0) {
++ long n_pages;
++
++ n_pages = min(-credit, si_mem_available());
++ state = decrease_reservation(n_pages, GFP_BALLOON);
++ if (state == BP_DONE && n_pages != -credit &&
++ n_pages < totalreserve_pages)
++ state = BP_EAGAIN;
++ }
+
+ state = update_schedule(state);
+
+@@ -578,6 +585,9 @@ static int add_ballooned_pages(int nr_pages)
+ }
+ }
+
++ if (si_mem_available() < nr_pages)
++ return -ENOMEM;
++
+ st = decrease_reservation(nr_pages, GFP_USER);
+ if (st != BP_DONE)
+ return -ENOMEM;
+@@ -710,7 +720,7 @@ static int __init balloon_init(void)
+ balloon_stats.schedule_delay = 1;
+ balloon_stats.max_schedule_delay = 32;
+ balloon_stats.retry_count = 1;
+- balloon_stats.max_retry_count = RETRY_UNLIMITED;
++ balloon_stats.max_retry_count = 4;
+
+ #ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG
+ set_online_page_callback(&xen_online_page);
+--
+2.16.4
+
diff --git a/patches.fixes/Revert-e1000e-fix-cyclic-resets-at-link-up-with-acti.patch b/patches.fixes/Revert-e1000e-fix-cyclic-resets-at-link-up-with-acti.patch
new file mode 100644
index 0000000000..0eb13738dc
--- /dev/null
+++ b/patches.fixes/Revert-e1000e-fix-cyclic-resets-at-link-up-with-acti.patch
@@ -0,0 +1,79 @@
+From caff422ea81e144842bc44bab408d85ac449377b Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Wed, 17 Apr 2019 11:13:16 +0300
+Subject: [PATCH] Revert "e1000e: fix cyclic resets at link up with active tx"
+Git-commit: caff422ea81e144842bc44bab408d85ac449377b
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+This reverts commit 0f9e980bf5ee1a97e2e401c846b2af989eb21c61.
+
+That change cased false-positive warning about hardware hang:
+
+E1000e: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: Rx/Tx
+Ipv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
+e1000e 0000:00:1f.6 eth0: Detected Hardware Unit Hang:
+ TDH <0>
+ TDT <1>
+ next_to_use <1>
+ next_to_clean <0>
+Buffer_info[next_to_clean]: time_stamp <fffba7a7> next_to_watch <0> jiffies <fffbb140> next_to_watch.status <0>
+MAC Status <40080080>
+PHY Status <7949>
+PHY 1000BASE-T Status <0>
+PHY Extended Status <3000>
+PCI Status <10>
+
+Besides warning everything works fine.
+Original issue will be fixed property in following patch.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Reported-by: Joseph Yasi <joe.yasi@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=203175
+Tested-by: Joseph Yasi <joe.yasi@gmail.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index 0e09bede42a2..e21b2ffd1e92 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -5308,13 +5308,8 @@ static void e1000_watchdog_task(struct work_struct *work)
+ /* 8000ES2LAN requires a Rx packet buffer work-around
+ * on link down event; reset the controller to flush
+ * the Rx packet buffer.
+- *
+- * If the link is lost the controller stops DMA, but
+- * if there is queued Tx work it cannot be done. So
+- * reset the controller to flush the Tx packet buffers.
+ */
+- if ((adapter->flags & FLAG_RX_NEEDS_RESTART) ||
+- e1000_desc_unused(tx_ring) + 1 < tx_ring->count)
++ if (adapter->flags & FLAG_RX_NEEDS_RESTART)
+ adapter->flags |= FLAG_RESTART_NOW;
+ else
+ pm_schedule_suspend(netdev->dev.parent,
+@@ -5337,6 +5332,14 @@ static void e1000_watchdog_task(struct work_struct *work)
+ adapter->gotc_old = adapter->stats.gotc;
+ spin_unlock(&adapter->stats64_lock);
+
++ /* If the link is lost the controller stops DMA, but
++ * if there is queued Tx work it cannot be done. So
++ * reset the controller to flush the Tx packet buffers.
++ */
++ if (!netif_carrier_ok(netdev) &&
++ (e1000_desc_unused(tx_ring) + 1 < tx_ring->count))
++ adapter->flags |= FLAG_RESTART_NOW;
++
+ /* If reset is necessary, do it outside of interrupt context. */
+ if (adapter->flags & FLAG_RESTART_NOW) {
+ schedule_work(&adapter->reset_task);
+--
+2.16.4
+
diff --git a/patches.fixes/bonding-Force-slave-speed-check-after-link-state-rec.patch b/patches.fixes/bonding-Force-slave-speed-check-after-link-state-rec.patch
new file mode 100644
index 0000000000..5943135fa1
--- /dev/null
+++ b/patches.fixes/bonding-Force-slave-speed-check-after-link-state-rec.patch
@@ -0,0 +1,76 @@
+From: Thomas Falcon <tlfalcon@linux.ibm.com>
+Date: Tue, 16 Jul 2019 17:25:10 -0500
+Subject: [PATCH] bonding: Force slave speed check after link state recovery
+ for 802.3ad
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+Git-commit: 12185dfe44360f814ac4ead9d22ad2af7511b2e9
+References: bsc#1137584
+
+
+The following scenario was encountered during testing of logical
+partition mobility on pseries partitions with bonded ibmvnic
+adapters in LACP mode.
+
+1. Driver receives a signal that the device has been
+ swapped, and it needs to reset to initialize the new
+ device.
+
+2. Driver reports loss of carrier and begins initialization.
+
+3. Bonding driver receives NETDEV_CHANGE notifier and checks
+ the slave's current speed and duplex settings. Because these
+ are unknown at the time, the bond sets its link state to
+ BOND_LINK_FAIL and handles the speed update, clearing
+ AD_PORT_LACP_ENABLE.
+
+4. Driver finishes recovery and reports that the carrier is on.
+
+5. Bond receives a new notification and checks the speed again.
+ The speeds are valid but miimon has not altered the link
+ state yet. AD_PORT_LACP_ENABLE remains off.
+
+Because the slave's link state is still BOND_LINK_FAIL,
+no further port checks are made when it recovers. Though
+the slave devices are operational and have valid speed
+and duplex settings, the bond will not send LACPDU's. The
+simplest fix I can see is to force another speed check
+in bond_miimon_commit. This way the bond will update
+AD_PORT_LACP_ENABLE if needed when transitioning from
+BOND_LINK_FAIL to BOND_LINK_UP.
+
+CC: Jarod Wilson <jarod@redhat.com>
+CC: Jay Vosburgh <j.vosburgh@gmail.com>
+CC: Veaceslav Falico <vfalico@gmail.com>
+CC: Andy Gospodarek <andy@greyhouse.net>
+Signed-off-by: Thomas Falcon <tlfalcon@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+Acked-by: Johannes Thumshirn <jthumshirn@suse.de>
+---
+ drivers/net/bonding/bond_main.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 9b7016abca2f..02fd7822c14a 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -2196,6 +2196,15 @@ static void bond_miimon_commit(struct bonding *bond)
+ bond_for_each_slave(bond, slave, iter) {
+ switch (slave->new_link) {
+ case BOND_LINK_NOCHANGE:
++ /* For 802.3ad mode, check current slave speed and
++ * duplex again in case its port was disabled after
++ * invalid speed/duplex reporting but recovered before
++ * link monitoring could make a decision on the actual
++ * link status
++ */
++ if (BOND_MODE(bond) == BOND_MODE_8023AD &&
++ slave->link == BOND_LINK_UP)
++ bond_3ad_adapter_speed_duplex_changed(slave);
+ continue;
+
+ case BOND_LINK_UP:
+--
+2.22.0
+
diff --git a/patches.fixes/drivers-base-introduce-kill_device.patch b/patches.fixes/drivers-base-introduce-kill_device.patch
index de803f6155..84045dee33 100644
--- a/patches.fixes/drivers-base-introduce-kill_device.patch
+++ b/patches.fixes/drivers-base-introduce-kill_device.patch
@@ -1,9 +1,9 @@
From: Dan Williams <dan.j.williams@intel.com>
-Date: Mon, 10 Jun 2019 21:03:44 -0700
+Date: Wed, 17 Jul 2019 18:07:53 -0700
Subject: drivers/base: Introduce kill_device()
Patch-mainline: Queued in subsystem maintainer repository
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm.git
-Git-commit: 2fcf7c0b67e03233b118ca29c551c1e66da6c80b
+Git-commit: 00289cd87676e14913d2d8492d1ce05c4baafdae
References: bsc#1139865
The libnvdimm subsystem arranges for devices to be destroyed as a result
diff --git a/patches.fixes/e1000e-start-network-tx-queue-only-when-link-is-up.patch b/patches.fixes/e1000e-start-network-tx-queue-only-when-link-is-up.patch
new file mode 100644
index 0000000000..7089aa41cb
--- /dev/null
+++ b/patches.fixes/e1000e-start-network-tx-queue-only-when-link-is-up.patch
@@ -0,0 +1,78 @@
+From d17ba0f616a08f597d9348c372d89b8c0405ccf3 Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Wed, 17 Apr 2019 11:13:20 +0300
+Subject: [PATCH] e1000e: start network tx queue only when link is up
+Git-commit: d17ba0f616a08f597d9348c372d89b8c0405ccf3
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Driver does not want to keep packets in Tx queue when link is lost.
+But present code only reset NIC to flush them, but does not prevent
+queuing new packets. Moreover reset sequence itself could generate
+new packets via netconsole and NIC falls into endless reset loop.
+
+This patch wakes Tx queue only when NIC is ready to send packets.
+
+This is proper fix for problem addressed by commit 0f9e980bf5ee
+("e1000e: fix cyclic resets at link up with active tx").
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Suggested-by: Alexander Duyck <alexander.duyck@gmail.com>
+Tested-by: Joseph Yasi <joe.yasi@gmail.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Tested-by: Oleksandr Natalenko <oleksandr@redhat.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ethernet/intel/e1000e/netdev.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
+index e21b2ffd1e92..b081a1ef6859 100644
+--- a/drivers/net/ethernet/intel/e1000e/netdev.c
++++ b/drivers/net/ethernet/intel/e1000e/netdev.c
+@@ -4208,7 +4208,7 @@ void e1000e_up(struct e1000_adapter *adapter)
+ e1000_configure_msix(adapter);
+ e1000_irq_enable(adapter);
+
+- netif_start_queue(adapter->netdev);
++ /* Tx queue started by watchdog timer when link is up */
+
+ e1000e_trigger_lsc(adapter);
+ }
+@@ -4606,6 +4606,7 @@ int e1000e_open(struct net_device *netdev)
+ pm_runtime_get_sync(&pdev->dev);
+
+ netif_carrier_off(netdev);
++ netif_stop_queue(netdev);
+
+ /* allocate transmit descriptors */
+ err = e1000e_setup_tx_resources(adapter->tx_ring);
+@@ -4666,7 +4667,6 @@ int e1000e_open(struct net_device *netdev)
+ e1000_irq_enable(adapter);
+
+ adapter->tx_hang_recheck = false;
+- netif_start_queue(netdev);
+
+ hw->mac.get_link_status = true;
+ pm_runtime_put(&pdev->dev);
+@@ -5288,6 +5288,7 @@ static void e1000_watchdog_task(struct work_struct *work)
+ if (phy->ops.cfg_on_link_up)
+ phy->ops.cfg_on_link_up(hw);
+
++ netif_wake_queue(netdev);
+ netif_carrier_on(netdev);
+
+ if (!test_bit(__E1000_DOWN, &adapter->state))
+@@ -5301,6 +5302,7 @@ static void e1000_watchdog_task(struct work_struct *work)
+ /* Link status message must follow this format */
+ pr_info("%s NIC Link is Down\n", adapter->netdev->name);
+ netif_carrier_off(netdev);
++ netif_stop_queue(netdev);
+ if (!test_bit(__E1000_DOWN, &adapter->state))
+ mod_timer(&adapter->phy_info_timer,
+ round_jiffies(jiffies + 2 * HZ));
+--
+2.16.4
+
diff --git a/patches.fixes/libnvdimm-bus-prevent-duplicate-device_unregister-calls.patch b/patches.fixes/libnvdimm-bus-prevent-duplicate-device_unregister-calls.patch
index bedf626b2b..998b29f711 100644
--- a/patches.fixes/libnvdimm-bus-prevent-duplicate-device_unregister-calls.patch
+++ b/patches.fixes/libnvdimm-bus-prevent-duplicate-device_unregister-calls.patch
@@ -1,9 +1,9 @@
From: Dan Williams <dan.j.williams@intel.com>
-Date: Mon, 10 Jun 2019 21:10:58 -0700
+Date: Wed, 17 Jul 2019 18:07:58 -0700
Subject: libnvdimm/bus: Prevent duplicate device_unregister() calls
Patch-mainline: Queued in subsystem maintainer repository
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm.git
-Git-commit: 4bc5021f8006cfb021e878cb8fb1b0e15a01ff28
+Git-commit: 8aac0e2338916e273ccbd438a2b7a1e8c61749f5
References: bsc#1139865
A multithreaded namespace creation/destruction stress test currently
diff --git a/patches.fixes/pci-portdrv-compute-msi-msi-x-irq-vectors-after-final-allocation b/patches.fixes/pci-portdrv-compute-msi-msi-x-irq-vectors-after-final-allocation
index bb1c6f5f31..aaa7a19c36 100644
--- a/patches.fixes/pci-portdrv-compute-msi-msi-x-irq-vectors-after-final-allocation
+++ b/patches.fixes/pci-portdrv-compute-msi-msi-x-irq-vectors-after-final-allocation
@@ -36,28 +36,16 @@ Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Joerg Roedel <jroedel@suse.de>
---
- drivers/pci/pcie/portdrv_core.c | 32 ++++++++++++++++++--------------
- 1 file changed, 18 insertions(+), 14 deletions(-)
+ drivers/pci/pcie/portdrv_core.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
-@@ -112,31 +112,35 @@ static int pcie_port_enable_irq_vec(stru
+@@ -117,6 +117,26 @@ static int pcie_port_enable_irq_vec(stru
return -EIO;
}
-- /* PME and hotplug share an MSI/MSI-X vector */
-- if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP)) {
-- irqs[PCIE_PORT_SERVICE_PME_SHIFT] = pci_irq_vector(dev, pme);
-- irqs[PCIE_PORT_SERVICE_HP_SHIFT] = pci_irq_vector(dev, pme);
-- }
--
-- if (mask & PCIE_PORT_SERVICE_AER)
-- irqs[PCIE_PORT_SERVICE_AER_SHIFT] = pci_irq_vector(dev, aer);
--
- /*
-- * If nvec is equal to the allocated number of entries, we can just use
-- * what we have. Otherwise, the port has some extra entries not for the
-- * services we know and we need to work around that.
++ /*
+ * If we allocated more than we need, free them and reallocate fewer.
+ *
+ * Reallocating may change the specific vectors we get, so
@@ -67,27 +55,33 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
+ * Message Numbers when we free and reallocate the vectors, but we
+ * assume it won't because we allocate enough vectors for the
+ * biggest Message Number we found.
- */
- if (nvec != nr_entries) {
-- /* Drop the temporary MSI-X setup */
- pci_free_irq_vectors(dev);
-
-- /* Now allocate the MSI-X vectors for real */
- nr_entries = pci_alloc_irq_vectors(dev, nvec, nvec,
- PCI_IRQ_MSIX | PCI_IRQ_MSI);
- if (nr_entries < 0)
- return nr_entries;
- }
-
-+ /* PME and hotplug share an MSI/MSI-X vector */
-+ if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP)) {
-+ irqs[PCIE_PORT_SERVICE_PME_SHIFT] = pci_irq_vector(dev, pme);
-+ irqs[PCIE_PORT_SERVICE_HP_SHIFT] = pci_irq_vector(dev, pme);
-+ }
++ */
++ if (nvec != nr_entries) {
++ pci_free_irq_vectors(dev);
+
-+ if (mask & PCIE_PORT_SERVICE_AER)
-+ irqs[PCIE_PORT_SERVICE_AER_SHIFT] = pci_irq_vector(dev, aer);
++ nr_entries = pci_alloc_irq_vectors(dev, nvec, nvec,
++ PCI_IRQ_MSIX | PCI_IRQ_MSI);
++ if (nr_entries < 0)
++ return nr_entries;
++ }
+
+ /* PME and hotplug share an MSI/MSI-X vector */
+ if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP)) {
+ irqs[PCIE_PORT_SERVICE_PME_SHIFT] = pci_irq_vector(dev, pme);
+@@ -129,16 +149,6 @@ static int pcie_port_enable_irq_vec(stru
+ if (mask & PCIE_PORT_SERVICE_DPC)
+ irqs[PCIE_PORT_SERVICE_DPC_SHIFT] = pci_irq_vector(dev, dpc);
+
+- /* If we allocated more than we need, free them and allocate fewer */
+- if (nvec != nr_entries) {
+- pci_free_irq_vectors(dev);
+-
+- nr_entries = pci_alloc_irq_vectors(dev, nvec, nvec,
+- PCI_IRQ_MSIX | PCI_IRQ_MSI);
+- if (nr_entries < 0)
+- return nr_entries;
+- }
+-
return 0;
}
diff --git a/patches.fixes/pci-portdrv-factor-out-interrupt-message-number-lookup b/patches.fixes/pci-portdrv-factor-out-interrupt-message-number-lookup
index 246277de92..b29ad15665 100644
--- a/patches.fixes/pci-portdrv-factor-out-interrupt-message-number-lookup
+++ b/patches.fixes/pci-portdrv-factor-out-interrupt-message-number-lookup
@@ -13,12 +13,12 @@ Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Joerg Roedel <jroedel@suse.de>
---
- drivers/pci/pcie/portdrv_core.c | 133 +++++++++++++++-------------------------
- 1 file changed, 50 insertions(+), 83 deletions(-)
+ drivers/pci/pcie/portdrv_core.c | 110 ++++++++++++++++++++++------------------
+ 1 file changed, 62 insertions(+), 48 deletions(-)
--- a/drivers/pci/pcie/portdrv_core.c
+++ b/drivers/pci/pcie/portdrv_core.c
-@@ -43,6 +43,43 @@ static void release_pcie_device(struct d
+@@ -43,6 +43,53 @@ static void release_pcie_device(struct d
kfree(to_pcie_device(dev));
}
@@ -51,18 +51,28 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
+ if (pos) {
+ pci_read_config_dword(dev, pos + PCI_ERR_ROOT_STATUS,
+ &reg32);
-+ *aer = reg32 >> 27;
++ *aer = (reg32 & PCI_ERR_ROOT_AER_IRQ) >> 27;
+ nvec = max(nvec, *aer + 1);
+ }
+ }
+
++ if (mask & PCIE_PORT_SERVICE_DPC) {
++ pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC);
++ if (pos) {
++ pci_read_config_word(dev, pos + PCI_EXP_DPC_CAP,
++ &reg16);
++ *dpc = reg16 & PCI_EXP_DPC_IRQ;
++ nvec = max(nvec, *dpc + 1);
++ }
++ }
++
+ return nvec;
+}
+
/**
* pcie_port_enable_irq_vec - try to set up MSI-X or MSI as interrupt mode
* for given port
-@@ -54,7 +91,8 @@ static void release_pcie_device(struct d
+@@ -54,7 +101,8 @@ static void release_pcie_device(struct d
*/
static int pcie_port_enable_irq_vec(struct pci_dev *dev, int *irqs, int mask)
{
@@ -70,35 +80,27 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
+ int nr_entries, nvec;
+ u32 pme = 0, aer = 0, dpc = 0;
- /*
- * Allocate as many entries as the port wants, so that we can check
-@@ -67,88 +105,21 @@ static int pcie_port_enable_irq_vec(stru
+ /* Allocate the maximum possible number of MSI/MSI-X vectors */
+ nr_entries = pci_alloc_irq_vectors(dev, 1, PCIE_PORT_MAX_MSI_ENTRIES,
+@@ -62,54 +110,24 @@ static int pcie_port_enable_irq_vec(stru
if (nr_entries < 0)
return nr_entries;
+- /*
+- * The Interrupt Message Number indicates which vector is used, i.e.,
+- * the MSI-X table entry or the MSI offset between the base Message
+- * Data and the generated interrupt message. See PCIe r3.1, sec
+- * 7.8.2, 7.10.10, 7.31.2.
+- */
- if (mask & (PCIE_PORT_SERVICE_PME | PCIE_PORT_SERVICE_HP)) {
- u16 reg16;
-
-- /*
-- * Per PCIe r3.1, sec 6.1.6, "PME and Hot-Plug Event
-- * interrupts (when both are implemented) always share the
-- * same MSI or MSI-X vector, as indicated by the Interrupt
-- * Message Number field in the PCI Express Capabilities
-- * register".
-- *
-- * Per sec 7.8.2, "For MSI, the [Interrupt Message Number]
-- * indicates the offset between the base Message Data and
-- * the interrupt message that is generated."
-- *
-- * "For MSI-X, the [Interrupt Message Number] indicates
-- * which MSI-X Table entry is used to generate the
-- * interrupt message."
-- */
- pcie_capability_read_word(dev, PCI_EXP_FLAGS, &reg16);
- entry = (reg16 & PCI_EXP_FLAGS_IRQ) >> 9;
- if (entry >= nr_entries)
- goto out_free_irqs;
-
+- /* PME and hotplug share an MSI/MSI-X vector */
- irqs[PCIE_PORT_SERVICE_PME_SHIFT] = pci_irq_vector(dev, entry);
- irqs[PCIE_PORT_SERVICE_HP_SHIFT] = pci_irq_vector(dev, entry);
-
@@ -113,22 +115,9 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
- if (mask & PCIE_PORT_SERVICE_AER) {
- u32 reg32, pos;
-
-- /*
-- * Per PCIe r3.1, sec 7.10.10, the Advanced Error Interrupt
-- * Message Number in the Root Error Status register
-- * indicates which MSI/MSI-X vector is used for AER.
-- *
-- * "For MSI, the [Advanced Error Interrupt Message Number]
-- * indicates the offset between the base Message Data and
-- * the interrupt message that is generated."
-- *
-- * "For MSI-X, the [Advanced Error Interrupt Message
-- * Number] indicates which MSI-X Table entry is used to
-- * generate the interrupt message."
-- */
- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_ERR);
- pci_read_config_dword(dev, pos + PCI_ERR_ROOT_STATUS, &reg32);
-- entry = reg32 >> 27;
+- entry = (reg32 & PCI_ERR_ROOT_AER_IRQ) >> 27;
- if (entry >= nr_entries)
- goto out_free_irqs;
-
@@ -143,23 +132,12 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
- if (mask & PCIE_PORT_SERVICE_DPC) {
- u16 reg16, pos;
--
-- /*
-- * Per PCIe r4.0 (v0.9), sec 7.9.15.2, the DPC Interrupt
-- * Message Number in the DPC Capability register indicates
-- * which MSI/MSI-X vector is used for DPC.
-- *
-- * "For MSI, the [DPC Interrupt Message Number] indicates
-- * the offset between the base Message Data and the
-- * interrupt message that is generated."
-- *
-- * "For MSI-X, the [DPC Interrupt Message Number] indicates
-- * which MSI-X Table entry is used to generate the
-- * interrupt message."
-- */
++ if (mask & PCIE_PORT_SERVICE_AER)
++ irqs[PCIE_PORT_SERVICE_AER_SHIFT] = pci_irq_vector(dev, aer);
+
- pos = pci_find_ext_capability(dev, PCI_EXT_CAP_ID_DPC);
- pci_read_config_word(dev, pos + PCI_EXP_DPC_CAP, &reg16);
-- entry = reg16 & 0x1f;
+- entry = reg16 & PCI_EXP_DPC_IRQ;
- if (entry >= nr_entries)
- goto out_free_irqs;
-
@@ -167,12 +145,12 @@ Acked-by: Joerg Roedel <jroedel@suse.de>
-
- nvec = max(nvec, entry + 1);
- }
-+ if (mask & PCIE_PORT_SERVICE_AER)
-+ irqs[PCIE_PORT_SERVICE_AER_SHIFT] = pci_irq_vector(dev, aer);
++ if (mask & PCIE_PORT_SERVICE_DPC)
++ irqs[PCIE_PORT_SERVICE_DPC_SHIFT] = pci_irq_vector(dev, dpc);
- /*
- * If nvec is equal to the allocated number of entries, we can just use
-@@ -167,10 +138,6 @@ static int pcie_port_enable_irq_vec(stru
+ /* If we allocated more than we need, free them and allocate fewer */
+ if (nvec != nr_entries) {
+@@ -122,10 +140,6 @@ static int pcie_port_enable_irq_vec(stru
}
return 0;
diff --git a/series.conf b/series.conf
index bb554fd531..ba81d6e75a 100644
--- a/series.conf
+++ b/series.conf
@@ -14547,6 +14547,8 @@
patches.drivers/0001-PCI-pciehp-Fix-race-condition-handling-surprise-link.patch
patches.drivers/0001-PCI-pciehp-Do-not-clear-Presence-Detect-Changed-duri.patch
patches.drivers/PCI-PME-Handle-invalid-data-when-reading-Root-Status
+ patches.drivers/PCI-portdrv-Add-defines-for-AER-and-DPC-Interrupt-Me.patch
+ patches.drivers/PCI-portdrv-Consolidate-comments.patch
patches.fixes/pci-portdrv-factor-out-interrupt-message-number-lookup
patches.fixes/pci-portdrv-compute-msi-msi-x-irq-vectors-after-final-allocation
patches.drivers/PCI-Add-PCI-resource-type-mask-define
@@ -19255,6 +19257,7 @@
patches.drivers/0001-PM-core-Add-LEAVE_SUSPENDED-driver-flag.patch
patches.drivers/0002-PCI-PM-Support-for-LEAVE_SUSPENDED-driver-flag.patch
patches.drivers/0003-ACPI-PM-Support-for-LEAVE_SUSPENDED-driver-flag-in-A.patch
+ patches.drivers/PCI-PM-Use-SMART_SUSPEND-and-LEAVE_SUSPENDED-flags-f.patch
patches.drivers/dmaengine-rcar-dmac-Make-DMAC-reinit-during-system-r.patch
patches.fixes/PM-sleep-Make-lock-unlock_system_sleep-available-to-.patch
patches.fixes/block-scsi-Fix-race-between-SPI-domain-validation-an.patch
@@ -28798,8 +28801,10 @@
patches.drivers/PCI-PM-Move-pcie_clear_root_pme_status-to-core.patch
patches.drivers/PCI-PM-Clear-PCIe-PME-Status-bit-in-core-not-PCIe-po.patch
patches.drivers/PCI-PM-Clear-PCIe-PME-Status-bit-for-Root-Complex-Ev.patch
+ patches.drivers/PCI-portdrv-Disable-port-driver-in-compat-mode.patch
patches.drivers/0001-PCI-portdrv-Simplify-PCIe-feature-permission-checkin.patch
patches.drivers/0001-PCI-portdrv-Rename-and-reverse-sense-of-pcie_ports_a.patch
+ patches.drivers/PCI-AER-Use-cached-AER-Capability-offset.patch
patches.drivers/pci-dpc-do-not-enable-dpc-if-aer-control-is-not-allowed-by-the-bios
patches.drivers/0001-PCI-DPC-Rename-from-pcie-dpc.c-to-dpc.c.patch
patches.drivers/0012-PCI-Probe-for-device-reset-support-during-enumeratio.patch
@@ -38410,6 +38415,7 @@
patches.drivers/tpm-allow-tpm_tis-drivers-to-set-hwrng-quality.patch
patches.fixes/evm-Don-t-deadlock-if-a-crypto-algorithm-is-unavaila.patch
patches.drivers/PCI-AER-Expose-internal-API-for-obtaining-AER-inform.patch
+ patches.drivers/PCI-portdrv-Remove-pcie_portdrv_err_handler.slot_res.patch
patches.drivers/igb-Remove-unnecessary-include-of-linux-pci-aspm.h.patch
patches.drivers/ath9k-Remove-unnecessary-include-of-linux-pci-aspm.h.patch
patches.drivers/iwlwifi-Remove-unnecessary-include-of-linux-pci-aspm.patch
@@ -39473,6 +39479,7 @@
patches.arch/0001-x86-speculation-l1tf-Fix-off-by-one-error-when-warni.patch
patches.arch/0001-x86-speculation-l1tf-Suggest-what-to-do-on-systems-w.patch
patches.drm/0001-ida-Add-new-API.patch
+ patches.arch/ppc-Convert-mmu-context-allocation-to-new-IDA-API.patch
patches.drm/8823-drm-vmwgfx-convert-to-new-ida-api
patches.fixes/iscsi-target-fix-session-creation-failure-handling.patch
patches.suse/ip6_vti-fix-a-null-pointer-deference-when-destroy-vt.patch
@@ -41019,6 +41026,7 @@
patches.drivers/iwlwifi-mvm-Send-LQ-command-as-async-when-necessary.patch
patches.drivers/iwlwifi-mvm-send-BCAST-management-frames-to-the-righ.patch
patches.drivers/iwlwifi-mvm-always-init-rs_fw-with-20MHz-bandwidth-r.patch
+ patches.drivers/iwlwifi-fix-devices-with-PCI-Device-ID-0x34F0-and-11.patch
patches.fixes/0001-libertas_tf-prevent-underflow-in-process_cmdrequest.patch
patches.drivers/brcmfmac-fix-for-proper-support-of-160MHz-bandwidth.patch
patches.drivers/iwlwifi-mvm-report-RU-offset-is-known.patch
@@ -41489,6 +41497,7 @@
patches.drivers/0001-PCI-pciehp-Drop-hotplug_slot_ops-wrappers.patch
patches.fixes/0001-PCI-pciehp-Tolerate-Presence-Detect-hardwired-to-zer.patch
patches.drivers/0001-PCI-pciehp-Unify-controller-and-slot-structs.patch
+ patches.drivers/PCI-portdrv-Restore-PCI-config-state-on-slot-reset.patch
patches.drivers/0001-PCI-Do-not-skip-power-managed-bridges-in-pci_enable_.patch
patches.drivers/0001-PCI-ACPI-Enable-wake-automatically-for-power-managed.patch
patches.drivers/0001-PCI-pciehp-Disable-hotplug-interrupt-during-suspend.patch
@@ -43973,6 +43982,7 @@
patches.drivers/iwlwifi-fw-do-not-set-sgi-bits-for-HE-connection.patch
patches.drivers/iwlwifi-pcie-don-t-reset-TXQ-write-pointer.patch
patches.drivers/iwlwifi-add-new-cards-for-9560-9462-9461-and-killer-.patch
+ patches.drivers/iwlwifi-fix-cfg-structs-for-22000-with-different-RF-.patch
patches.drivers/b43-Fix-error-in-cordic-routine.patch
patches.drivers/brcmfmac-Call-brcmf_dmi_probe-before-brcmf_of_probe.patch
patches.drivers/brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
@@ -44368,6 +44378,7 @@
patches.drivers/RDMA-hns-Bugfix-for-RoCE-loopback-test.patch
patches.drivers/RDMA-core-Delete-RoCE-GID-in-hw-when-corresponding-I.patch
patches.drivers/RDMA-hns-Fix-an-error-code-in-hns_roce_create_srq.patch
+ patches.drivers/RDMA-srp-Document-srp_parse_in-arguments.patch
patches.drivers/RDMA-bnxt_re-Query-HWRM-Interface-version-from-FW.patch
patches.drivers/RDMA-bnxt_re-Increase-depth-of-control-path-command-.patch
patches.drivers/net-mlx5-Add-shared-Q-counter-bits.patch
@@ -44480,6 +44491,7 @@
patches.suse/msft-hv-1801-hv_utils-update-name-in-struct-hv_driver-util_drv.patch
patches.suse/msft-hv-1802-Drivers-hv-kvp-Use-u-to-print-U32.patch
patches.suse/msft-hv-1803-Tools-hv-kvp-Fix-a-warning-of-buffer-overflow-with-g.patch
+ patches.drivers/0001-fpga-add-intel-stratix10-soc-fpga-manager-driver.patch
patches.suse/msft-hv-1806-Drivers-hv-vmbus-Remove-the-useless-API-vmbus_get_ou.patch
patches.drivers/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch
patches.drivers/misc-vexpress-Off-by-one-in-vexpress_syscfg_exec.patch
@@ -45012,6 +45024,7 @@
patches.drivers/serial-fix-race-between-flush_to_ldisc-and-tty_open.patch
patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
patches.fixes/debugfs-fix-debugfs_rename-parameter-checking.patch
+ patches.drivers/0001-fpga-stratix10-soc-fix-wrong-of_node_put-in-init-fun.patch
patches.suse/ucc_geth-Reset-BQL-queue-when-stopping-device.patch
patches.drivers/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch
patches.suse/virtio_net-Don-t-call-free_old_xmit_skbs-for-xdp_fra.patch
@@ -45415,6 +45428,7 @@
patches.drivers/cw1200-fix-missing-unlock-on-error-in-cw1200_hw_scan.patch
patches.drivers/cw1200-drop-useless-LIST_HEAD.patch
patches.drivers/brcmfmac-Use-firmware_request_nowarn-for-the-clm_blo.patch
+ patches.drivers/iwlwifi-correct-one-of-the-PCI-struct-names.patch
patches.fixes/0001-iwlwifi-mvm-fix-firmware-statistics-usage.patch
patches.drivers/iwlwifi-mvm-avoid-possible-access-out-of-array.patch
patches.drivers/iwlwifi-mvm-fix-A-MPDU-reference-assignment.patch
@@ -45863,6 +45877,8 @@
patches.drivers/pci-dpc-fix-print-aer-status-in-dpc-event-handling
patches.fixes/x86-PCI-Fixup-RTIT_BAR-of-Intel-Denverton-Trace-Hub.patch
patches.fixes/0001-PCI-pciehp-Assign-ctrl-slot_ctrl-before-writing-it-t.patch
+ patches.drivers/PCI-portdrv-Use-conventional-Device-ID-table-formatt.patch
+ patches.drivers/PCI-portdrv-Support-PCIe-services-on-subtractive-dec.patch
patches.fixes/0001-Revert-PCI-PME-Implement-runtime-PM-callbacks.patch
patches.fixes/0001-PCI-pciehp-Disable-Data-Link-Layer-State-Changed-eve.patch
patches.drivers/PCI-PME-Fix-hotplug-sysfs-remove-deadlock-in-pcie_pm.patch
@@ -46018,6 +46034,7 @@
patches.drivers/scsi-qla2xxx-Add-new-FW-dump-template-entry-types.patch
patches.drivers/scsi-qla2xxx-Update-driver-version-to-10.00.00.14-k.patch
patches.drivers/scsi-qla2xxx-Avoid-PCI-IRQ-affinity-mapping-when-mul.patch
+ patches.drivers/scsi-megaraid_sas-return-error-when-create-dma-pool-failed
patches.drivers/scsi-csiostor-drop-serial_number-usage
patches.drivers/scsi-mpt3sas-Add-missing-breaks-in-switch-statements.patch
patches.drivers/iommu-vt-d-check-identity-map-for-hot-added-devices
@@ -46081,6 +46098,7 @@
patches.suse/net-x25-fix-use-after-free-in-x25_device_event.patch
patches.fixes/0001-vxlan-test-dev-flags-IFF_UP-before-calling-gro_cells.patch
patches.fixes/0001-gro_cells-make-sure-device-is-up-in-gro_cells_receiv.patch
+ patches.fixes/0001-Input-tm2-touchkey-acknowledge-that-setting-brightne.patch
patches.drivers/input-raspberrypi-ts-select-config_input_polldev.patch
patches.drivers/Input-elan_i2c-add-id-for-touchpad-found-in-Lenovo-s.patch
patches.drivers/Input-wacom_serial4-add-support-for-Wacom-ArtPad-II-.patch
@@ -47776,6 +47794,7 @@
patches.drm/drm-arm-hdlcd-Actually-validate-CRTC-modes.patch
patches.drm/drm-arm-hdlcd-Allow-a-bit-of-clock-tolerance.patch
patches.drivers/dmaengine-tegra210-adma-Fix-crash-during-probe.patch
+ patches.drivers/0001-fpga-stratix10-soc-fix-use-after-free-on-s10_init.patch
patches.drivers/parport-Fix-mem-leak-in-parport_register_dev_model.patch
patches.drivers/genwqe-Prevent-an-integer-overflow-in-the-ioctl.patch
patches.fixes/0001-test_firmware-Use-correct-snprintf-limit.patch
@@ -47831,7 +47850,6 @@
patches.drivers/USB-serial-option-add-support-for-Simcom-SIM7500-SIM.patch
patches.drivers/USB-serial-pl2303-add-Allied-Telesis-VT-Kit3.patch
patches.drivers/USB-serial-option-add-Telit-0x1260-and-0x1261-compos.patch
- patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
patches.drivers/platform-x86-mlx-platform-Fix-parent-device-in-i2c-m.patch
patches.drivers/platform-mellanox-mlxreg-hotplug-Add-devm_free_irq-c.patch
patches.drivers/ras-cec-fix-binary-search-function.patch
@@ -48088,6 +48106,8 @@
patches.drivers/qed-Add-iWARP-100g-support.patch
patches.drivers/qedi-use-hwfns-and-affin_hwfn_idx-to-get-msi-x-vector-index
patches.drivers/net-hns3-fix-for-HNS3_RXD_GRO_SIZE_M-macro.patch
+ patches.fixes/Revert-e1000e-fix-cyclic-resets-at-link-up-with-acti.patch
+ patches.fixes/e1000e-start-network-tx-queue-only-when-link-is-up.patch
patches.drivers/qed-Reduce-the-severity-of-ptp-debug-message.patch
patches.drivers/qede-Handle-infinite-driver-spinning-for-Tx-timestam.patch
patches.drivers/qed-fix-spelling-mistake-inculde-include.patch
@@ -48103,6 +48123,7 @@
patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch
patches.drivers/net-ena-add-good-checksum-counter.patch
patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch
+ patches.drivers/qed-Fix-build-error-without-CONFIG_DEVLINK.patch
patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch
patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch
patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch
@@ -48110,19 +48131,47 @@
patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch
patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
+ patches.drivers/qed-Fix-Wmaybe-uninitialized-false-positive.patch
+ patches.drivers/bpf-fix-callees-pruning-callers.patch
patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch
patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch
patches.drivers/ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch
patches.drivers/ath6kl-add-some-bounds-checking.patch
+ patches.drivers/ath9k-Check-for-errors-when-reading-SREV-register.patch
+ patches.drivers/ath-DFS-JP-domain-W56-fixed-pulse-type-3-RADAR-detec.patch
patches.drivers/wil6210-fix-potential-out-of-bounds-read.patch
patches.drivers/ath10k-Fix-encoding-for-protected-management-frames.patch
+ patches.drivers/ath10k-Do-not-send-probe-response-template-for-mesh.patch
+ patches.drivers/ath10k-add-peer-id-check-in-ath10k_peer_find_by_id.patch
patches.drivers/p54usb-Fix-race-between-disconnect-and-firmware-load.patch
+ patches.drivers/rtlwifi-rtl8192cu-fix-error-handle-when-usb-probe-fa.patch
+ patches.drivers/mt7601u-do-not-schedule-rx_tasklet-when-the-device-h.patch
+ patches.drivers/mt7601u-fix-possible-memory-leak-when-the-device-is-.patch
patches.drivers/ixgbe-Avoid-NULL-pointer-dereference-with-VF-on-non-.patch
+ patches.drivers/iwlwifi-mvm-Drop-large-non-sta-frames.patch
+ patches.drivers/iwlwifi-pcie-fix-ALIVE-interrupt-handling-for-gen2-d.patch
+ patches.drivers/iwlwifi-fix-RF-Kill-interrupt-while-FW-load-for-gen2.patch
+ patches.drivers/iwlwifi-pcie-don-t-service-an-interrupt-that-was-mas.patch
+ patches.drivers/iwlwifi-don-t-WARN-when-calling-iwl_get_shared_mem_c.patch
patches.drivers/ath10k-add-missing-error-handling.patch
+ patches.drivers/ath10k-fix-PCIE-device-wake-up-failed.patch
patches.drivers/ath9k-correctly-handle-short-radar-pulses.patch
patches.drivers/carl9170-fix-misuse-of-device-driver-API.patch
+ patches.drivers/ath10k-destroy-sdio-workqueue-while-remove-sdio-modu.patch
+ patches.drivers/tools-bpftool-Fix-json-dump-crash-on-powerpc.patch
+ patches.drivers/xdp-fix-race-on-generic-receive-path.patch
patches.fixes/mwifiex-Don-t-abort-on-small-spec-compliant-vendor-I.patch
patches.drivers/batman-adv-fix-for-leaked-TVLV-handler.patch
+ patches.drivers/bnxt_en-Disable-bus-master-during-PCI-shutdown-and-d.patch
+ patches.drivers/bnxt_en-Fix-statistics-context-reservation-logic-for.patch
+ patches.drivers/bnxt_en-Cap-the-returned-MSIX-vectors-to-the-RDMA-dr.patch
+ patches.drivers/bnxt_en-Suppress-error-messages-when-querying-DSCP-D.patch
+ patches.drivers/idr-fix-overflow-case-for-idr_for_each_entry_ul.patch
+ patches.drivers/net-tls-make-sure-offload-also-gets-the-keys-wiped.patch
+ patches.drivers/xsk-Properly-terminate-assignment-in-xskq_produce_fl.patch
+ patches.drivers/tools-bpftool-use-correct-argument-in-cgroup-errors.patch
+ patches.drivers/xdp-hold-device-for-umem-regardless-of-zero-copy-mod.patch
+ patches.drivers/net-tls-fix-socket-wmem-accounting-on-fallback-with-.patch
patches.drivers/scsi-hpsa-correct-simple-mode
patches.drivers/scsi-hpsa-correct-device-resets
patches.drivers/scsi-lpfc-Fix-alloc-context-on-oas-lun-creations.patch
@@ -48187,6 +48236,7 @@
patches.arch/kvm-svm-avic-do-not-send-avic-doorbell-to-self
patches.suse/s390-cpumf-add-extended-counter-set-definitions-for-model-8561-and-8562
patches.drivers/Input-synaptics-enable-SMBUS-on-T480-thinkpad-trackp.patch
+ patches.drivers/net-mlx5e-Rx-Fix-checksum-calculation-for-new-hardwa.patch
patches.suse/sunhv-Fix-device-naming-inconsistency-between-sunhv_.patch
patches.arch/powerpc-pseries-dlpar-Fix-a-missing-check-in-dlpar_p.patch
patches.arch/powerpc-pseries-Fix-oops-in-hotplug-memory-notifier.patch
@@ -48198,6 +48248,7 @@
patches.arch/powerpc-mm-drconf-Use-NUMA_NO_NODE-on-failures-inste.patch
patches.arch/powerpc-mm-Fix-node-look-up-with-numa-off-boot.patch
patches.arch/powerpc-mm-Consolidate-numa_enable-check-and-min_com.patch
+ patches.drivers/platform-x86-asus-wmi-Only-Tell-EC-the-OS-will-handl.patch
patches.drivers/platform-x86-pmc_atom-Add-CB4063-Beckhoff-Automation.patch
patches.drivers/platform-x86-ISST-Add-common-API-to-register-and-han.patch
patches.drivers/platform-x86-ISST-Store-per-CPU-information.patch
@@ -48224,7 +48275,12 @@
patches.drivers/RDMA-hns-Update-CQE-specifications.patch
patches.drivers/RDMA-hns-Move-spin_lock_irqsave-to-the-correct-place.patch
patches.drivers/RDMA-hns-Remove-jiffies-operation-in-disable-interru.patch
+ patches.drivers/RDMA-uverbs-check-for-allocation-failure-in-uapi_add.patch
patches.drivers/RDMA-hns-Bugfix-for-posting-multiple-srq-work-reques.patch
+ patches.drivers/RDMA-srp-Accept-again-source-addresses-that-do-not-h.patch
+ patches.drivers/RDMA-odp-Fix-missed-unlock-in-non-blocking-invalidat.patch
+ patches.drivers/IB-mlx5-Fixed-reporting-counters-on-2nd-port-for-Dua.patch
+ patches.drivers/IB-ipoib-Add-child-to-parent-list-only-if-device-ini.patch
patches.drivers/PCI-Return-error-if-cannot-probe-VF.patch
patches.drivers/PCI-Always-allow-probing-with-driver_override.patch
patches.fixes/PCI-P2PDMA-Fix-missing-check-for-dma_virt_ops.patch
@@ -48238,7 +48294,12 @@
patches.drivers/ALSA-hda-hdmi-Remove-duplicated-define.patch
patches.drivers/ALSA-hda-hdmi-Fix-i915-reverse-port-pin-mapping.patch
patches.drivers/ALSA-hda-Don-t-resume-forcibly-i915-HDMI-DP-codec.patch
+ patches.drivers/xprtrdma-Fix-use-after-free-in-rpcrdma_post_recvs.patch
patches.drivers/be2net-Signal-that-the-device-cannot-transmit-during.patch
+ patches.drivers/mlxsw-spectrum_dcb-Configure-DSCP-map-as-the-last-ru.patch
+ patches.drivers/xdp-fix-possible-cq-entry-leak.patch
+ patches.drivers/tcp-fix-tcp_set_congestion_control-use-from-bpf-hook.patch
+ patches.fixes/0001-xen-let-alloc_xenballooned_pages-fail-if-not-enough-.patch
patches.fixes/crypto-crypto4xx-fix-a-potential-double-free-in-ppc4.patch
patches.fixes/crypto-ccp-memset-structure-fields-to-zero-before-re.patch
patches.fixes/crypto-ccp-gcm-use-const-time-tag-comparison.patch
@@ -48248,9 +48309,16 @@
patches.drivers/Input-gtco-bounds-check-collection-indent-level.patch
patches.drivers/Input-psmouse-fix-build-error-of-multiple-definition.patch
patches.drivers/be2net-Synchronize-be_update_queues-with-dev_watchdo.patch
-
- # powerpc/linux fixes
patches.arch/powerpc-tm-Fix-oops-on-sigreturn-on-systems-without-.patch
+ patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch
+ patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch
+ patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch
+ patches.drivers/ALSA-hda-Optimize-resume-for-codecs-without-jack-det.patch
+ patches.drivers/ALSA-hda-Fix-intermittent-CORB-RIRB-stall-on-Intel-c.patch
+ patches.drivers/scsi-ibmvfc-fix-WARN_ON-during-event-pool-release.patch
+
+ # davem/net
+ patches.fixes/bonding-Force-slave-speed-check-after-link-state-rec.patch
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
@@ -48281,9 +48349,6 @@
patches.suse/nvme-skip-nvme_update_disk_info-if-the-controller-is.patch
patches.suse/block-Fix-a-NULL-pointer-dereference-in-generic_make.patch
patches.suse/dasd_fba-Display-00000000-for-zero-page-when-dumping.patch
- patches.arch/powerpc-pseries-Update-SCM-hcall-op-codes-in-hvcall..patch
- patches.arch/powerpc-papr_scm-Update-drc_pmem_unbind-to-use-H_SCM.patch
- patches.arch/powerpc-papr_scm-Force-a-scm-unbind-if-initial-scm-b.patch
patches.arch/mm-nvdimm-add-is_ioremap_addr-and-use-that-to-check-.patch
patches.drivers/scsi-qla2xxx-do-not-crash-on-uninitialized-pool-list.patch
@@ -48981,7 +49046,6 @@
# KVM
patches.suse/0001-kvm-Introduce-nopvspin-kernel-parameter.patch
-
########################################################
# You'd better have a good reason for adding a patch
# below here.