Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKernel Build Daemon <kbuild@suse.de>2019-02-13 07:20:53 +0100
committerKernel Build Daemon <kbuild@suse.de>2019-02-13 07:20:53 +0100
commit360bd3f240e2d87545b01fa33537fa802c8fd7c9 (patch)
tree73f868bb7b151fc05961cfa04c2b4475262b9b2e
parent5954981fc35ee7894693f74f9e2618bb09a9d8f5 (diff)
parent24d8fbd04f5d882ef97734096db8ac73da05b913 (diff)
Merge branch 'SLE15-SP1' into openSUSE-15.1openSUSE-15.1
-rw-r--r--blacklist.conf10
-rw-r--r--patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch3
-rw-r--r--patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages31
-rw-r--r--patches.arch/s390-cpum_cf-reject-request-for-sampling-in-event-initialization108
-rw-r--r--patches.arch/s390-early-improve-machine-detection50
-rw-r--r--patches.arch/s390-mm-always-force-a-load-of-the-primary-asce-on-context-switch47
-rw-r--r--patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch3
-rw-r--r--patches.arch/s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu76
-rw-r--r--patches.arch/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan83
-rw-r--r--patches.arch/s390-sthyi-fix-machine-name-validity-indication51
-rw-r--r--patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch6
-rw-r--r--patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch67
-rw-r--r--patches.arch/x86-bugs-update-when-to-check-for-the-ls_cfg-ssbd-mitigation.patch41
-rw-r--r--patches.arch/x86-mce-initialize-mce-bank-in-the-case-of-a-fatal-error-in-mce_no_way_out.patch51
-rw-r--r--patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch63
-rw-r--r--patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch54
-rw-r--r--patches.drivers/Revert-net-phy-marvell-avoid-pause-mode-on-SGMII-to-.patch50
-rw-r--r--patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch51
-rw-r--r--patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch47
-rw-r--r--patches.drivers/bnxt_en-Disable-interrupts-when-allocating-CP-rings-.patch45
-rw-r--r--patches.drivers/bpf-fix-potential-deadlock-in-bpf_prog_register.patch160
-rw-r--r--patches.drivers/bpf-sock-recvbuff-must-be-limited-by-rmem_max-in-bpf.patch35
-rw-r--r--patches.drivers/bpftool-Fix-prog-dump-by-tag.patch65
-rw-r--r--patches.drivers/bpftool-fix-percpu-maps-updating.patch60
-rw-r--r--patches.drivers/dmaengine-at_xdmac-Fix-wrongfull-report-of-a-channel.patch97
-rw-r--r--patches.drivers/dmaengine-bcm2835-Fix-abort-of-transactions.patch161
-rw-r--r--patches.drivers/dmaengine-bcm2835-Fix-interrupt-race-on-RT.patch154
-rw-r--r--patches.drivers/dmaengine-dmatest-Abort-test-in-case-of-mapping-erro.patch124
-rw-r--r--patches.drivers/dt-bindings-imx8mq-number-clocks-consecutively.patch72
-rw-r--r--patches.drivers/ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch51
-rw-r--r--patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch49
-rw-r--r--patches.drivers/net-cls_flower-Remove-filter-from-mask-before-freein.patch49
-rw-r--r--patches.drivers/net-mlx5e-FPGA-fix-Innova-IPsec-TX-offload-data-path.patch45
-rw-r--r--patches.drivers/qed-Add-doorbell-overflow-recovery-mechanism.patch478
-rw-r--r--patches.drivers/qed-Add-support-for-MBI-upgrade-over-MFW.patch173
-rw-r--r--patches.drivers/qed-Advance-drivers-version-to-8.37.0.20.patch40
-rw-r--r--patches.drivers/qed-Assign-UFP-TC-value-to-vlan-priority-in-UFP-mode.patch31
-rw-r--r--patches.drivers/qed-Change-verbosity-for-coalescing-message.patch33
-rw-r--r--patches.drivers/qed-Consider-TX-tcs-while-deriving-the-max-num_queue.patch39
-rw-r--r--patches.drivers/qed-Display-port_id-in-the-UFP-debug-messages.patch76
-rw-r--r--patches.drivers/qed-Expose-the-doorbell-overflow-recovery-mechanism-.patch69
-rw-r--r--patches.drivers/qed-Fix-EQ-full-firmware-assert.patch77
-rw-r--r--patches.drivers/qed-Fix-LACP-pdu-drops-for-VFs.patch85
-rw-r--r--patches.drivers/qed-Fix-VF-probe-failure-while-FLR.patch52
-rw-r--r--patches.drivers/qed-Fix-bug-in-tx-promiscuous-mode-settings.patch50
-rw-r--r--patches.drivers/qed-Fix-qed_chain_set_prod-for-PBL-chains-with-non-p.patch60
-rw-r--r--patches.drivers/qed-Fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch31
-rw-r--r--patches.drivers/qed-Fix-stack-out-of-bounds-bug.patch104
-rw-r--r--patches.drivers/qed-Fix-system-crash-in-ll2-xmit.patch79
-rw-r--r--patches.drivers/qed-Register-light-L2-queues-with-doorbell-overflow-.patch113
-rw-r--r--patches.drivers/qed-Register-slowpath-queue-doorbell-with-doorbell-o.patch136
-rw-r--r--patches.drivers/qed-Use-the-doorbell-overflow-recovery-mechanism-in-.patch456
-rw-r--r--patches.drivers/qed-fix-spelling-mistake-Dispalying-Displaying.patch27
-rw-r--r--patches.drivers/qede-Add-a-statistic-for-a-case-where-driver-drops-t.patch56
-rw-r--r--patches.drivers/qede-Fix-system-crash-on-configuring-channels.patch86
-rw-r--r--patches.drivers/qede-Register-l2-queues-with-doorbell-overflow-recov.patch45
-rw-r--r--patches.drivers/qede-Simplify-the-usage-of-qede-flags.patch91
-rw-r--r--patches.drivers/qede-Update-link-status-only-when-interface-is-ready.patch66
-rw-r--r--patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets62
-rw-r--r--patches.drivers/svcrdma-Reduce-max_send_sges.patch37
-rw-r--r--patches.drivers/svcrdma-Remove-max_sge-check-at-connect-time.patch196
-rw-r--r--patches.drivers/tun-move-the-call-to-tun_set_real_num_queues.patch41
-rw-r--r--patches.drivers/usb-typec-tcpm-correct-the-pps-out_volt-calculation.patch46
-rw-r--r--patches.drivers/vfio-ccw-fix-cleanup-if-cp_prefetch-fails66
-rw-r--r--patches.drivers/vfio-ccw-process-ssch-with-interrupts-disabled75
-rw-r--r--patches.drivers/virtio_net-Account-for-tx-bytes-and-packets-on-sendi.patch63
-rw-r--r--patches.drivers/virtio_net-Differentiate-sk_buff-and-xdp_frame-on-fr.patch153
-rw-r--r--patches.drivers/virtio_net-Don-t-call-free_old_xmit_skbs-for-xdp_fra.patch141
-rw-r--r--patches.drivers/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch40
-rw-r--r--patches.drivers/virtio_net-Don-t-process-redirected-XDP-frames-when-.patch119
-rw-r--r--patches.drivers/virtio_net-Fix-not-restoring-real_num_rx_queues.patch36
-rw-r--r--patches.drivers/virtio_net-Fix-out-of-bounds-access-of-sq.patch52
-rw-r--r--patches.drivers/virtio_net-Use-xdp_return_frame-to-free-xdp_frames-o.patch32
-rw-r--r--patches.drivers/virtio_net-bulk-free-tx-skbs.patch75
-rw-r--r--patches.drm/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch42
-rw-r--r--patches.drm/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch41
-rw-r--r--patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch2
-rw-r--r--patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch87
-rw-r--r--patches.fixes/irqchip-gic-v3-its-Don-t-bind-LPI-to-unavailable-NUM.patch53
-rw-r--r--patches.fixes/irqchip-gic-v3-its-Fix-ITT_entry_size-accessor.patch39
-rw-r--r--patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch3
-rw-r--r--patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch3
-rw-r--r--patches.fixes/sysfs-Disable-lockdep-for-driver-bind-unbind-files.patch176
-rw-r--r--patches.fixes/uprobes-Fix-handle_swbp-vs.-unregister-register-race.patch83
-rw-r--r--patches.fixes/virtio-s390-avoid-race-on-vcdev-config71
-rw-r--r--patches.fixes/virtio-s390-fix-race-in-ccw_io_helper76
-rw-r--r--patches.suse/mm-Adjust-watermark-boost-factor-tunable.patch41
-rw-r--r--patches.suse/mm-hwpoison-use-do_send_sig_info-instead-of-force_sig.patch59
-rw-r--r--patches.suse/mm-madvise-MADV_DODUMP-allow-hugetlbfs-pages.patch90
-rw-r--r--patches.suse/mm-migrate-don-t-rely-on-__PageMovable-of-newpage-after-unlocking-it.patch99
-rw-r--r--patches.suse/mm-vmscan-Make-unregister_shrinker-no-op-if-register_shrinker-failed.patch112
-rw-r--r--patches.suse/qed-bump-drivers-to-version-8.10.10.55.patch34
-rw-r--r--rpm/kernel-binary.spec.in2
-rw-r--r--series.conf101
-rw-r--r--supported.conf124
95 files changed, 7124 insertions, 60 deletions
diff --git a/blacklist.conf b/blacklist.conf
index 802f850b2e..37a05716c3 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -978,3 +978,13 @@ d93fa1b47b8fcd149b5091f18385304f402a8e15 # Duplicate of 368b554d63948133aca05e63
4be9bd10e22dfc7fc101c5cf5969ef2d3a042d8a # Not applicable: drm/fb_helper: Allow leaking fbdev smem_start
69756c6ff0de478c10100481f16c966dde3b5339 # Duplicate of e2306cc6a07aefc458982b3d7ae1e146515ed656: drm/amdgpu: Add amdgpu "max bpc" connector property (v2)
62358aa4ee86481ce044bef04859820e1bc7c1d9 # Duplicate of 9b27390139dbe0dc10d1899545248862fe826b61: drm/i915: Use the correct crtc when sanitizing plane mapping
+4ea899ead2786a30aaa8181fefa81a3df4ad28f6 # Not applicable to SLE15
+b1ab5fa309e6c49e4e06270ec67dd7b3e9971d04 # Just a cleanup
+967d1dc144b50ad005e5eecdfadfbcfb399ffff6 # Just a cleanup
+0a42e99b58a208839626465af194cfe640ef9493 # Just a cleanup
+fb265c9cb49e2074ddcdd4de99728aefdd3b3592 # Intrusive patch, mostly cleanup, fixes only long-standing error code mismatch
+31e62d25b5b8155b2ff6a7c6d31256475dbbcc7a # too many dependencies, not worth effort
+db7ddef301128dad394f1c0f77027f86ee9a4edb # Preparation patch for other fixes
+0207df4fa1a869281ddbf72db6203dbf036b3e1a # KASAN not supported
+3f1959721558a976aaf9c2024d5bc884e6411bf7 # KASAN not supported
+71546d100422bcc2c543dadeb9328728997cd23a # Microblaze not supported
diff --git a/patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch b/patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch
index 9667732745..de06e2ec4e 100644
--- a/patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch
+++ b/patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch
@@ -4,8 +4,7 @@ Date: Thu, 31 Jan 2019 12:53:47 +1100
Subject: [PATCH] powerpc/papr_scm: Use the correct bind address
References: FATE#326628, bsc#1113295, git-fixes
-Patch-mainline: queued
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Patch-mainline: v5.0-rc6
Git-commit: 5a3840a470c41ec0b85cd36ca80370330656b163
When binding an SCM volume to a physical address the hypervisor has the
diff --git a/patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages b/patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages
new file mode 100644
index 0000000000..23c884621f
--- /dev/null
+++ b/patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages
@@ -0,0 +1,31 @@
+From: Eric Farman <farman@linux.ibm.com>
+Date: Tue, 2 Oct 2018 03:02:35 +0200
+Subject: s390/cio: Fix how vfio-ccw checks pinned pages
+Git-commit: 24abf2901b18bf941b9f21ea2ce5791f61097ae4
+Patch-mainline: v4.19-rc8
+References: git-fixes
+
+We have two nested loops to check the entries within the pfn_array_table
+arrays. But we mistakenly use the outer array as an index in our check,
+and completely ignore the indexing performed by the inner loop.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Eric Farman <farman@linux.ibm.com>
+Message-Id: <20181002010235.42483-1-farman@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/cio/vfio_ccw_cp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/cio/vfio_ccw_cp.c
++++ b/drivers/s390/cio/vfio_ccw_cp.c
+@@ -171,7 +171,7 @@ static bool pfn_array_table_iova_pinned(
+
+ for (i = 0; i < pat->pat_nr; i++, pa++)
+ for (j = 0; j < pa->pa_nr; j++)
+- if (pa->pa_iova_pfn[i] == iova_pfn)
++ if (pa->pa_iova_pfn[j] == iova_pfn)
+ return true;
+
+ return false;
diff --git a/patches.arch/s390-cpum_cf-reject-request-for-sampling-in-event-initialization b/patches.arch/s390-cpum_cf-reject-request-for-sampling-in-event-initialization
new file mode 100644
index 0000000000..711161af70
--- /dev/null
+++ b/patches.arch/s390-cpum_cf-reject-request-for-sampling-in-event-initialization
@@ -0,0 +1,108 @@
+From: Thomas Richter <tmricht@linux.ibm.com>
+Date: Tue, 13 Nov 2018 15:38:22 +0000
+Subject: s390/cpum_cf: Reject request for sampling in event initialization
+Git-commit: 613a41b0d16e617f46776a93b975a1eeea96417c
+Patch-mainline: v4.20-rc5
+References: git-fixes
+
+On s390 command perf top fails
+[root@s35lp76 perf] # ./perf top -F100000 --stdio
+ Error:
+ cycles: PMU Hardware doesn't support sampling/overflow-interrupts.
+ Try 'perf stat'
+[root@s35lp76 perf] #
+
+Using event -e rb0000 works as designed. Event rb0000 is the event
+number of the sampling facility for basic sampling.
+
+During system start up the following PMUs are installed in the kernel's
+PMU list (from head to tail):
+ cpum_cf --> s390 PMU counter facility device driver
+ cpum_sf --> s390 PMU sampling facility device driver
+ uprobe
+ kprobe
+ tracepoint
+ task_clock
+ cpu_clock
+
+Perf top executes following functions and calls perf_event_open(2) system
+call with different parameters many times:
+
+cmd_top
+--> __cmd_top
+ --> perf_evlist__add_default
+ --> __perf_evlist__add_default
+ --> perf_evlist__new_cycles (creates event type:0 (HW)
+ config 0 (CPU_CYCLES)
+ --> perf_event_attr__set_max_precise_ip
+ Uses perf_event_open(2) to detect correct
+ precise_ip level. Fails 3 times on s390 which is ok.
+
+Then functions cmd_top
+--> __cmd_top
+ --> perf_top__start_counters
+ -->perf_evlist__config
+ --> perf_can_comm_exec
+ --> perf_probe_api
+ This functions test support for the following events:
+ "cycles:u", "instructions:u", "cpu-clock:u" using
+ --> perf_do_probe_api
+ --> perf_event_open_cloexec
+ Test the close on exec flag support with
+ perf_event_open(2).
+ perf_do_probe_api returns true if the event is
+ supported.
+ The function returns true because event cpu-clock is
+ supported by the PMU cpu_clock.
+ This is achieved by many calls to perf_event_open(2).
+
+Function perf_top__start_counters now calls perf_evsel__open() for every
+event, which is the default event cpu_cycles (config:0) and type HARDWARE
+(type:0) which a predfined frequence of 4000.
+
+Given the above order of the PMU list, the PMU cpum_cf gets called first
+and returns 0, which indicates support for this sampling. The event is
+fully allocated in the function perf_event_open (file kernel/event/core.c
+near line 10521 and the following check fails:
+
+ event = perf_event_alloc(&attr, cpu, task, group_leader, NULL,
+ NULL, NULL, cgroup_fd);
+ if (IS_ERR(event)) {
+ err = PTR_ERR(event);
+ goto err_cred;
+ }
+
+ if (is_sampling_event(event)) {
+ if (event->pmu->capabilities & PERF_PMU_CAP_NO_INTERRUPT) {
+ err = -EOPNOTSUPP;
+ goto err_alloc;
+ }
+ }
+
+The check for the interrupt capabilities fails and the system call
+perf_event_open() returns -EOPNOTSUPP (-95).
+
+Add a check to return -ENODEV when sampling is requested in PMU cpum_cf.
+This allows common kernel code in the perf_event_open() system call to
+test the next PMU in above list.
+
+Fixes: 97b1198fece0 (" "s390, perf: Use common PMU interrupt disabled code")
+Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
+Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/perf_cpum_cf.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/s390/kernel/perf_cpum_cf.c
++++ b/arch/s390/kernel/perf_cpum_cf.c
+@@ -349,6 +349,8 @@ static int __hw_perf_event_init(struct p
+ break;
+
+ case PERF_TYPE_HARDWARE:
++ if (is_sampling_event(event)) /* No sampling support */
++ return -ENOENT;
+ ev = attr->config;
+ /* Count user space (problem-state) only */
+ if (!attr->exclude_user && attr->exclude_kernel) {
diff --git a/patches.arch/s390-early-improve-machine-detection b/patches.arch/s390-early-improve-machine-detection
new file mode 100644
index 0000000000..5317447c78
--- /dev/null
+++ b/patches.arch/s390-early-improve-machine-detection
@@ -0,0 +1,50 @@
+From: Christian Borntraeger <borntraeger@de.ibm.com>
+Date: Fri, 9 Nov 2018 09:21:47 +0100
+Subject: s390/early: improve machine detection
+Git-commit: 03aa047ef2db4985e444af6ee1c1dd084ad9fb4c
+Patch-mainline: v5.0 or v5.0-rc3 (next release)
+References: git-fixes
+
+Right now the early machine detection code check stsi 3.2.2 for "KVM"
+and set MACHINE_IS_VM if this is different. As the console detection
+uses diagnose 8 if MACHINE_IS_VM returns true this will crash Linux
+early for any non z/VM system that sets a different value than KVM.
+So instead of assuming z/VM, do not set any of MACHINE_IS_LPAR,
+MACHINE_IS_VM, or MACHINE_IS_KVM.
+
+CC: stable@vger.kernel.org
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/early.c | 4 ++--
+ arch/s390/kernel/setup.c | 2 ++
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/s390/kernel/early.c
++++ b/arch/s390/kernel/early.c
+@@ -224,10 +224,10 @@ static noinline __init void detect_machi
+ if (stsi(vmms, 3, 2, 2) || !vmms->count)
+ return;
+
+- /* Running under KVM? If not we assume z/VM */
++ /* Detect known hypervisors */
+ if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3))
+ S390_lowcore.machine_flags |= MACHINE_FLAG_KVM;
+- else
++ else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4))
+ S390_lowcore.machine_flags |= MACHINE_FLAG_VM;
+ }
+
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -881,6 +881,8 @@ void __init setup_arch(char **cmdline_p)
+ pr_info("Linux is running under KVM in 64-bit mode\n");
+ else if (MACHINE_IS_LPAR)
+ pr_info("Linux is running natively in 64-bit mode\n");
++ else
++ pr_info("Linux is running as a guest in 64-bit mode\n");
+
+ /* Have one command line that is parsed and saved in /proc/cmdline */
+ /* boot_command_line has been already set up in early.c */
diff --git a/patches.arch/s390-mm-always-force-a-load-of-the-primary-asce-on-context-switch b/patches.arch/s390-mm-always-force-a-load-of-the-primary-asce-on-context-switch
new file mode 100644
index 0000000000..7074e4c5ad
--- /dev/null
+++ b/patches.arch/s390-mm-always-force-a-load-of-the-primary-asce-on-context-switch
@@ -0,0 +1,47 @@
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Tue, 8 Jan 2019 12:44:57 +0100
+Subject: s390/mm: always force a load of the primary ASCE on context switch
+Git-commit: a38662084c8bdb829ff486468c7ea801c13fcc34
+Patch-mainline: v5.0 or v5.0-rc3 (next release)
+References: git-fixes
+
+The ASCE of an mm_struct can be modified after a task has been created,
+e.g. via crst_table_downgrade for a compat process. The active_mm logic
+to avoid the switch_mm call if the next task is a kernel thread can
+lead to a situation where switch_mm is called where 'prev == next' is
+true but 'prev->context.asce == next->context.asce' is not.
+
+This can lead to a situation where a CPU uses the outdated ASCE to run
+a task. The result can be a crash, endless loops and really subtle
+problem due to TLBs being created with an invalid ASCE.
+
+Cc: stable@kernel.org # v3.15+
+Fixes: 53e857f30867 ("s390/mm,tlb: race of lazy TLB flush vs. recreation")
+Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+[ ptesarik: Adjusted context, because SLE15 does not contain upstream
+ commit a38662084c8bdb829ff486468c7ea801c13fcc34. ]
+Signed-off-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/include/asm/mmu_context.h | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/arch/s390/include/asm/mmu_context.h
++++ b/arch/s390/include/asm/mmu_context.h
+@@ -96,13 +96,12 @@ static inline void switch_mm(struct mm_s
+ int cpu = smp_processor_id();
+
+ S390_lowcore.user_asce = next->context.asce;
+- if (prev == next)
+- return;
+ cpumask_set_cpu(cpu, &next->context.cpu_attach_mask);
+ /* Clear old ASCE by loading the kernel ASCE. */
+ __ctl_load(S390_lowcore.kernel_asce, 1, 1);
+ __ctl_load(S390_lowcore.kernel_asce, 7, 7);
+- cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
++ if (prev != next)
++ cpumask_clear_cpu(cpu, &prev->context.cpu_attach_mask);
+ }
+
+ #define finish_arch_post_lock_switch finish_arch_post_lock_switch
diff --git a/patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch b/patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch
index a2c796d8ad..b4c6fbb3fa 100644
--- a/patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch
+++ b/patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch
@@ -1,8 +1,7 @@
From: Harald Freudenberger <freude@linux.ibm.com>
Subject: s390/zcrypt: fix specification exception on z196 during ap probe
References: LTC#174936, bsc#1123061
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git
+Patch-mainline: v5.0 or v5.0-rc7 (next release)
Git-commit: 8f9aca0c45322a807a343fc32f95f2500f83b9ae
Description: kernel: zcrypt: fix specification exception on z196 at ap probe
diff --git a/patches.arch/s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu b/patches.arch/s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu
new file mode 100644
index 0000000000..1ab80e2d44
--- /dev/null
+++ b/patches.arch/s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu
@@ -0,0 +1,76 @@
+From: David Hildenbrand <david@redhat.com>
+Date: Fri, 11 Jan 2019 15:18:22 +0100
+Subject: s390/smp: Fix calling smp_call_ipl_cpu() from ipl CPU
+Git-commit: 60f1bf29c0b2519989927cae640cd1f50f59dc7f
+Patch-mainline: v5.0 or v5.0-rc3 (next release)
+References: git-fixes
+
+When calling smp_call_ipl_cpu() from the IPL CPU, we will try to read
+from pcpu_devices->lowcore. However, due to prefixing, that will result
+in reading from absolute address 0 on that CPU. We have to go via the
+actual lowcore instead.
+
+This means that right now, we will read lc->nodat_stack == 0 and
+therfore work on a very wrong stack.
+
+This BUG essentially broke rebooting under QEMU TCG (which will report
+a low address protection exception). And checking under KVM, it is
+also broken under KVM. With 1 VCPU it can be easily triggered.
+
+:/# echo 1 > /proc/sys/kernel/sysrq
+:/# echo b > /proc/sysrq-trigger
+[ 28.476745] sysrq: SysRq : Resetting
+[ 28.476793] Kernel stack overflow.
+[ 28.476817] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13
+[ 28.476820] Hardware name: IBM 2964 NE1 716 (KVM/Linux)
+[ 28.476826] Krnl PSW : 0400c00180000000 0000000000115c0c (pcpu_delegate+0x12c/0x140)
+[ 28.476861] R:0 T:1 IO:0 EX:0 Key:0 M:0 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3
+[ 28.476863] Krnl GPRS: ffffffffffffffff 0000000000000000 000000000010dff8 0000000000000000
+[ 28.476864] 0000000000000000 0000000000000000 0000000000ab7090 000003e0006efbf0
+[ 28.476864] 000000000010dff8 0000000000000000 0000000000000000 0000000000000000
+[ 28.476865] 000000007fffc000 0000000000730408 000003e0006efc58 0000000000000000
+[ 28.476887] Krnl Code: 0000000000115bfe: 4170f000 la %r7,0(%r15)
+[ 28.476887] 0000000000115c02: 41f0a000 la %r15,0(%r10)
+[ 28.476887] #0000000000115c06: e370f0980024 stg %r7,152(%r15)
+[ 28.476887] >0000000000115c0c: c0e5fffff86e brasl %r14,114ce8
+[ 28.476887] 0000000000115c12: 41f07000 la %r15,0(%r7)
+[ 28.476887] 0000000000115c16: a7f4ffa8 brc 15,115b66
+[ 28.476887] 0000000000115c1a: 0707 bcr 0,%r7
+[ 28.476887] 0000000000115c1c: 0707 bcr 0,%r7
+[ 28.476901] Call Trace:
+[ 28.476902] Last Breaking-Event-Address:
+[ 28.476920] [<0000000000a01c4a>] arch_call_rest_init+0x22/0x80
+[ 28.476927] Kernel panic - not syncing: Corrupt kernel stack, can't continue.
+[ 28.476930] CPU: 0 PID: 424 Comm: sh Not tainted 5.0.0-rc1+ #13
+[ 28.476932] Hardware name: IBM 2964 NE1 716 (KVM/Linux)
+[ 28.476932] Call Trace:
+
+Fixes: 2f859d0dad81 ("s390/smp: reduce size of struct pcpu")
+Cc: stable@vger.kernel.org # 4.0+
+Reported-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+[ ptesarik: Use panic_stack, because SLE15 does not have virtually
+ mapped kernel stacks (commit ce3dc447493ff4186b192b38d723ab5e8c1eb52f). ]
+Signed-off-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/smp.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -382,8 +382,13 @@ void smp_call_online_cpu(void (*func)(vo
+ */
+ void smp_call_ipl_cpu(void (*func)(void *), void *data)
+ {
++ struct lowcore *lc = pcpu_devices->lowcore;
++
++ if (pcpu_devices[0].address == stap())
++ lc = &S390_lowcore;
++
+ pcpu_delegate(&pcpu_devices[0], func, data,
+- pcpu_devices->lowcore->panic_stack -
++ lc->panic_stack -
+ PANIC_FRAME_OFFSET + PAGE_SIZE);
+ }
+
diff --git a/patches.arch/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan b/patches.arch/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan
new file mode 100644
index 0000000000..47f559027e
--- /dev/null
+++ b/patches.arch/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan
@@ -0,0 +1,83 @@
+From: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Date: Wed, 9 Jan 2019 13:00:03 +0100
+Subject: s390/smp: fix CPU hotplug deadlock with CPU rescan
+Git-commit: b7cb707c373094ce4008d4a6ac9b6b366ec52da5
+Patch-mainline: v5.0 or v5.0-rc3 (next release)
+References: git-fixes
+
+smp_rescan_cpus() is called without the device_hotplug_lock, which can lead
+to a dedlock when a new CPU is found and immediately set online by a udev
+rule.
+
+This was observed on an older kernel version, where the cpu_hotplug_begin()
+loop was still present, and it resulted in hanging chcpu and systemd-udev
+processes. This specific deadlock will not show on current kernels. However,
+there may be other possible deadlocks, and since smp_rescan_cpus() can still
+trigger a CPU hotplug operation, the device_hotplug_lock should be held.
+
+For reference, this was the deadlock with the old cpu_hotplug_begin() loop:
+
+ chcpu (rescan) systemd-udevd
+
+ echo 1 > /sys/../rescan
+ -> smp_rescan_cpus()
+ -> (*) get_online_cpus()
+ (increases refcount)
+ -> smp_add_present_cpu()
+ (new CPU found)
+ -> register_cpu()
+ -> device_add()
+ -> udev "add" event triggered -----------> udev rule sets CPU online
+ -> echo 1 > /sys/.../online
+ -> lock_device_hotplug_sysfs()
+ (this is missing in rescan path)
+ -> device_online()
+ -> (**) device_lock(new CPU dev)
+ -> cpu_up()
+ -> cpu_hotplug_begin()
+ (loops until refcount == 0)
+ -> deadlock with (*)
+ -> bus_probe_device()
+ -> device_attach()
+ -> device_lock(new CPU dev)
+ -> deadlock with (**)
+
+Fix this by taking the device_hotplug_lock in the CPU rescan path.
+
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+[ ptesarik: Context adjusted, because SLE15 does not contain upstream
+ commit 6cbaefb4bf2ce6746e49c972289702133b347ffa. ]
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/smp.c | 4 ++++
+ drivers/s390/char/sclp_config.c | 2 ++
+ 2 files changed, 6 insertions(+)
+
+--- a/arch/s390/kernel/smp.c
++++ b/arch/s390/kernel/smp.c
+@@ -1163,7 +1163,11 @@ static ssize_t __ref rescan_store(struct
+ {
+ int rc;
+
++ rc = lock_device_hotplug_sysfs();
++ if (rc)
++ return rc;
+ rc = smp_rescan_cpus();
++ unlock_device_hotplug();
+ return rc ? rc : count;
+ }
+ static DEVICE_ATTR(rescan, 0200, NULL, rescan_store);
+--- a/drivers/s390/char/sclp_config.c
++++ b/drivers/s390/char/sclp_config.c
+@@ -59,7 +59,9 @@ static void sclp_cpu_capability_notify(s
+
+ static void __ref sclp_cpu_change_notify(struct work_struct *work)
+ {
++ lock_device_hotplug();
+ smp_rescan_cpus();
++ unlock_device_hotplug();
+ }
+
+ static void sclp_conf_receiver_fn(struct evbuf_header *evbuf)
diff --git a/patches.arch/s390-sthyi-fix-machine-name-validity-indication b/patches.arch/s390-sthyi-fix-machine-name-validity-indication
new file mode 100644
index 0000000000..958636ee32
--- /dev/null
+++ b/patches.arch/s390-sthyi-fix-machine-name-validity-indication
@@ -0,0 +1,51 @@
+From: Janosch Frank <frankja@linux.ibm.com>
+Date: Tue, 2 Oct 2018 10:57:52 +0200
+Subject: s390/sthyi: Fix machine name validity indication
+Git-commit: b5130dc2224d1881f24224c0590c6d97f2168d6a
+Patch-mainline: v4.20-rc1
+References: git-fixes
+
+When running as a level 3 guest with no host provided sthyi support
+sclp_ocf_cpc_name_copy() will only return zeroes. Zeroes are not a
+valid group name, so let's not indicate that the group name field is
+valid.
+
+Also the group name is not dependent on stsi, let's not return based
+on stsi before setting it.
+
+Fixes: 95ca2cb57985 ("KVM: s390: Add sthyi emulation")
+Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ arch/s390/kernel/sthyi.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/arch/s390/kernel/sthyi.c b/arch/s390/kernel/sthyi.c
+index 0859cde36f75..888cc2f166db 100644
+--- a/arch/s390/kernel/sthyi.c
++++ b/arch/s390/kernel/sthyi.c
+@@ -183,17 +183,19 @@ static void fill_hdr(struct sthyi_sctns *sctns)
+ static void fill_stsi_mac(struct sthyi_sctns *sctns,
+ struct sysinfo_1_1_1 *sysinfo)
+ {
++ sclp_ocf_cpc_name_copy(sctns->mac.infmname);
++ if (*(u64 *)sctns->mac.infmname != 0)
++ sctns->mac.infmval1 |= MAC_NAME_VLD;
++
+ if (stsi(sysinfo, 1, 1, 1))
+ return;
+
+- sclp_ocf_cpc_name_copy(sctns->mac.infmname);
+-
+ memcpy(sctns->mac.infmtype, sysinfo->type, sizeof(sctns->mac.infmtype));
+ memcpy(sctns->mac.infmmanu, sysinfo->manufacturer, sizeof(sctns->mac.infmmanu));
+ memcpy(sctns->mac.infmpman, sysinfo->plant, sizeof(sctns->mac.infmpman));
+ memcpy(sctns->mac.infmseq, sysinfo->sequence, sizeof(sctns->mac.infmseq));
+
+- sctns->mac.infmval1 |= MAC_ID_VLD | MAC_NAME_VLD;
++ sctns->mac.infmval1 |= MAC_ID_VLD;
+ }
+
+ static void fill_stsi_par(struct sthyi_sctns *sctns,
+
diff --git a/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch b/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch
index ad6d385a05..8dfcfd90a5 100644
--- a/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch
+++ b/patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch
@@ -57,8 +57,8 @@ Acked-by: Borislav Petkov <bp@suse.de>
#define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */
+#define X86_FEATURE_AMD_SSBD (13*32+24) /* "" Speculative Store Bypass Disable */
#define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */
+ #define X86_FEATURE_AMD_SSB_NO (13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */
- /* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -528,18 +528,20 @@ static enum ssb_mitigation __init __ssb_
@@ -108,8 +108,8 @@ Acked-by: Borislav Petkov <bp@suse.de>
/* cpuid 0x80000008.ebx */
const u32 kvm_cpuid_8000_0008_ebx_x86_features =
-- F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD);
-+ F(AMD_IBPB) | F(AMD_IBRS) | F(AMD_SSBD) | F(VIRT_SSBD);
+- F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD) | F(AMD_SSB_NO);
++ F(AMD_IBPB) | F(AMD_IBRS) | F(AMD_SSBD) | F(VIRT_SSBD) | F(AMD_SSB_NO);
/* cpuid 0xC0000001.edx */
const u32 kvm_cpuid_C000_0001_edx_x86_features =
diff --git a/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch b/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch
new file mode 100644
index 0000000000..2114216f45
--- /dev/null
+++ b/patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch
@@ -0,0 +1,67 @@
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 1 Jun 2018 10:59:19 -0400
+Subject: x86/bugs: Add AMD's variant of SSB_NO
+Git-commit: 24809860012e0130fbafe536709e08a22b3e959e
+Patch-mainline: v4.18-rc1
+References: bsc#1114279
+
+The AMD document outlining the SSBD handling
+124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf
+mentions that the CPUID 8000_0008.EBX[26] will mean that the
+speculative store bypass disable is no longer needed.
+
+A copy of this document is available at:
+ https://bugzilla.kernel.org/show_bug.cgi?id=199889
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Janakarajan Natarajan <Janakarajan.Natarajan@amd.com>
+Cc: kvm@vger.kernel.org
+Cc: andrew.cooper3@citrix.com
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Borislav Petkov <bp@suse.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Link: https://lkml.kernel.org/r/20180601145921.9500-2-konrad.wilk@oracle.com
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/include/asm/cpufeatures.h | 1 +
+ arch/x86/kernel/cpu/common.c | 3 ++-
+ arch/x86/kvm/cpuid.c | 2 +-
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -284,6 +284,7 @@
+ #define X86_FEATURE_AMD_IBRS (13*32+14) /* "" Indirect Branch Restricted Speculation */
+ #define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */
+ #define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */
++#define X86_FEATURE_AMD_SSB_NO (13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */
+
+ /* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */
+ #define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -948,7 +948,8 @@ static void __init cpu_set_bug_bits(stru
+ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap);
+
+ if (!x86_match_cpu(cpu_no_spec_store_bypass) &&
+- !(ia32_cap & ARCH_CAP_SSB_NO))
++ !(ia32_cap & ARCH_CAP_SSB_NO) &&
++ !cpu_has(c, X86_FEATURE_AMD_SSB_NO))
+ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS);
+
+ if (x86_match_cpu(cpu_no_speculation))
+--- a/arch/x86/kvm/cpuid.c
++++ b/arch/x86/kvm/cpuid.c
+@@ -367,7 +367,7 @@ static inline int __do_cpuid_ent(struct
+
+ /* cpuid 0x80000008.ebx */
+ const u32 kvm_cpuid_8000_0008_ebx_x86_features =
+- F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD);
++ F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD) | F(AMD_SSB_NO);
+
+ /* cpuid 0xC0000001.edx */
+ const u32 kvm_cpuid_C000_0001_edx_x86_features =
diff --git a/patches.arch/x86-bugs-update-when-to-check-for-the-ls_cfg-ssbd-mitigation.patch b/patches.arch/x86-bugs-update-when-to-check-for-the-ls_cfg-ssbd-mitigation.patch
new file mode 100644
index 0000000000..60ef3bb0a9
--- /dev/null
+++ b/patches.arch/x86-bugs-update-when-to-check-for-the-ls_cfg-ssbd-mitigation.patch
@@ -0,0 +1,41 @@
+From: Tom Lendacky <thomas.lendacky@amd.com>
+Date: Mon, 2 Jul 2018 16:35:53 -0500
+Subject: x86/bugs: Update when to check for the LS_CFG SSBD mitigation
+Git-commit: 845d382bb15c6e7dc5026c0ff919c5b13fc7e11b
+Patch-mainline: v4.18-rc4
+References: bsc#1114279
+
+If either the X86_FEATURE_AMD_SSBD or X86_FEATURE_VIRT_SSBD features are
+present, then there is no need to perform the check for the LS_CFG SSBD
+mitigation support.
+
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Cc: Borislav Petkov <bpetkov@suse.de>
+Cc: David Woodhouse <dwmw@amazon.co.uk>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/20180702213553.29202.21089.stgit@tlendack-t1.amdoffice.net
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ arch/x86/kernel/cpu/amd.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index 082d7875cef8..38915fbfae73 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -543,7 +543,9 @@ static void bsp_init_amd(struct cpuinfo_x86 *c)
+ nodes_per_socket = ((value >> 3) & 7) + 1;
+ }
+
+- if (c->x86 >= 0x15 && c->x86 <= 0x17) {
++ if (!boot_cpu_has(X86_FEATURE_AMD_SSBD) &&
++ !boot_cpu_has(X86_FEATURE_VIRT_SSBD) &&
++ c->x86 >= 0x15 && c->x86 <= 0x17) {
+ unsigned int bit;
+
+ switch (c->x86) {
+
diff --git a/patches.arch/x86-mce-initialize-mce-bank-in-the-case-of-a-fatal-error-in-mce_no_way_out.patch b/patches.arch/x86-mce-initialize-mce-bank-in-the-case-of-a-fatal-error-in-mce_no_way_out.patch
new file mode 100644
index 0000000000..25ce173b62
--- /dev/null
+++ b/patches.arch/x86-mce-initialize-mce-bank-in-the-case-of-a-fatal-error-in-mce_no_way_out.patch
@@ -0,0 +1,51 @@
+From: Tony Luck <tony.luck@intel.com>
+Date: Thu, 31 Jan 2019 16:33:41 -0800
+Subject: x86/MCE: Initialize mce.bank in the case of a fatal error in
+ mce_no_way_out()
+Git-commit: d28af26faa0b1daf3c692603d46bc4687c16f19e
+Patch-mainline: v5.0-rc6
+References: bsc#1114279
+
+Internal injection testing crashed with a console log that said:
+
+ mce: [Hardware Error]: CPU 7: Machine Check Exception: f Bank 0: bd80000000100134
+
+This caused a lot of head scratching because the MCACOD (bits 15:0) of
+that status is a signature from an L1 data cache error. But Linux says
+that it found it in "Bank 0", which on this model CPU only reports L1
+instruction cache errors.
+
+The answer was that Linux doesn't initialize "m->bank" in the case that
+it finds a fatal error in the mce_no_way_out() pre-scan of banks. If
+this was a local machine check, then this partially initialized struct
+mce is being passed to mce_panic().
+
+Fix is simple: just initialize m->bank in the case of a fatal error.
+
+Fixes: 40c36e2741d7 ("x86/mce: Fix incorrect "Machine check from unknown source" message")
+Signed-off-by: Tony Luck <tony.luck@intel.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Cc: stable@vger.kernel.org # v4.18 Note pre-v5.0 arch/x86/kernel/cpu/mce/core.c was called arch/x86/kernel/cpu/mcheck/mce.c
+Link: https://lkml.kernel.org/r/20190201003341.10638-1-tony.luck@intel.com
+---
+ arch/x86/kernel/cpu/mce/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 672c7225cb1b..6ce290c506d9 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -784,6 +784,7 @@ static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp,
+ quirk_no_way_out(i, m, regs);
+
+ if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) {
++ m->bank = i;
+ mce_read_aux(m, i);
+ *msg = tmp;
+ return 1;
+
diff --git a/patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch b/patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch
new file mode 100644
index 0000000000..6bc77a7425
--- /dev/null
+++ b/patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch
@@ -0,0 +1,63 @@
+From: Thomas Lendacky <Thomas.Lendacky@amd.com>
+Date: Thu, 31 Jan 2019 14:33:06 +0000
+Subject: x86/microcode/amd: Don't falsely trick the late loading mechanism
+Git-commit: 912139cfbfa6a2bc1da052314d2c29338dae1f6a
+Patch-mainline: v5.0-rc5
+References: bsc#1114279
+
+The load_microcode_amd() function searches for microcode patches and
+attempts to apply a microcode patch if it is of different level than the
+currently installed level.
+
+While the processor won't actually load a level that is less than
+what is already installed, the logic wrongly returns UCODE_NEW thus
+signaling to its caller reload_store() that a late loading should be
+attempted.
+
+If the file-system contains an older microcode revision than what is
+currently running, such a late microcode reload can result in these
+misleading messages:
+
+ x86/CPU: CPU features have changed after loading microcode, but might not take effect.
+ x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.
+
+These messages were issued on a system where SME/SEV are not
+enabled by the BIOS (MSR C001_0010[23] = 0b) because during boot,
+early_detect_mem_encrypt() is called and cleared the SME and SEV
+features in this case.
+
+However, after the wrong late load attempt, get_cpu_cap() is called and
+reloads the SME and SEV feature bits, resulting in the messages.
+
+Update the microcode level check to not attempt microcode loading if the
+current level is greater than(!) and not only equal to the current patch
+level.
+
+ [ bp: massage commit message. ]
+
+Fixes: 2613f36ed965 ("x86/microcode: Attempt late loading only when new microcode is present")
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/154894518427.9406.8246222496874202773.stgit@tlendack-t1.amdoffice.net
+---
+ arch/x86/kernel/cpu/microcode/amd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c
+index 51adde0a0f1a..e1f3ba19ba54 100644
+--- a/arch/x86/kernel/cpu/microcode/amd.c
++++ b/arch/x86/kernel/cpu/microcode/amd.c
+@@ -855,7 +855,7 @@ load_microcode_amd(bool save, u8 family, const u8 *data, size_t size)
+ if (!p) {
+ return ret;
+ } else {
+- if (boot_cpu_data.microcode == p->patch_id)
++ if (boot_cpu_data.microcode >= p->patch_id)
+ return ret;
+
+ ret = UCODE_NEW;
+
diff --git a/patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch b/patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch
new file mode 100644
index 0000000000..5eed224291
--- /dev/null
+++ b/patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch
@@ -0,0 +1,54 @@
+From: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Date: Thu, 17 Jan 2019 02:10:59 -0800
+Subject: x86/speculation: Remove redundant arch_smt_update() invocation
+Git-commit: 34d66caf251df91ff27b24a3a786810d29989eca
+Patch-mainline: v5.0 or v5.0-rc5 (next release)
+References: bsc#1114279
+
+With commit a74cfffb03b7 ("x86/speculation: Rework SMT state change"),
+arch_smt_update() is invoked from each individual CPU hotplug function.
+
+Therefore the extra arch_smt_update() call in the sysfs SMT control is
+redundant.
+
+Fixes: a74cfffb03b7 ("x86/speculation: Rework SMT state change")
+Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: <konrad.wilk@oracle.com>
+Cc: <dwmw@amazon.co.uk>
+Cc: <bp@suse.de>
+Cc: <srinivas.eeda@oracle.com>
+Cc: <peterz@infradead.org>
+Cc: <hpa@zytor.com>
+Link: https://lkml.kernel.org/r/e2e064f2-e8ef-42ca-bf4f-76b612964752@default
+
+Acked-by: Borislav Petkov <bp@suse.de>
+---
+ kernel/cpu.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+diff --git a/kernel/cpu.c b/kernel/cpu.c
+index 91d5c38eb7e5..c0c7f64573ed 100644
+--- a/kernel/cpu.c
++++ b/kernel/cpu.c
+@@ -2090,10 +2090,8 @@ static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval)
+ */
+ cpuhp_offline_cpu_device(cpu);
+ }
+- if (!ret) {
++ if (!ret)
+ cpu_smt_control = ctrlval;
+- arch_smt_update();
+- }
+ cpu_maps_update_done();
+ return ret;
+ }
+@@ -2104,7 +2102,6 @@ static int cpuhp_smt_enable(void)
+
+ cpu_maps_update_begin();
+ cpu_smt_control = CPU_SMT_ENABLED;
+- arch_smt_update();
+ for_each_present_cpu(cpu) {
+ /* Skip online CPUs and CPUs on offline nodes */
+ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu)))
+
diff --git a/patches.drivers/Revert-net-phy-marvell-avoid-pause-mode-on-SGMII-to-.patch b/patches.drivers/Revert-net-phy-marvell-avoid-pause-mode-on-SGMII-to-.patch
new file mode 100644
index 0000000000..360417b2c6
--- /dev/null
+++ b/patches.drivers/Revert-net-phy-marvell-avoid-pause-mode-on-SGMII-to-.patch
@@ -0,0 +1,50 @@
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Thu, 31 Jan 2019 16:59:46 +0000
+Subject: Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for
+ 88e151x"
+Patch-mainline: v5.0-rc6
+Git-commit: c14f07c6211cc01d52ed92cce1fade5071b8d197
+References: bsc#1119113 FATE#326472
+
+This reverts commit 6623c0fba10ef45b64ca213ad5dec926f37fa9a0.
+
+The original diagnosis was incorrect: it appears that the NIC had
+PHY polling mode enabled, which meant that it overwrote the PHYs
+advertisement register during negotiation.
+
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Tested-by: Yonglong Liu <liuyonglong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/phy/marvell.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -826,8 +826,6 @@ static int m88e1510_config_init(struct p
+
+ /* SGMII-to-Copper mode initialization */
+ if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+- u32 pause;
+-
+ /* Select page 18 */
+ err = marvell_set_page(phydev, 18);
+ if (err < 0)
+@@ -850,16 +848,6 @@ static int m88e1510_config_init(struct p
+ err = marvell_set_page(phydev, MII_MARVELL_COPPER_PAGE);
+ if (err < 0)
+ return err;
+-
+- /* There appears to be a bug in the 88e1512 when used in
+- * SGMII to copper mode, where the AN advertisement register
+- * clears the pause bits each time a negotiation occurs.
+- * This means we can never be truely sure what was advertised,
+- * so disable Pause support.
+- */
+- pause = SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+- phydev->supported &= ~pause;
+- phydev->advertising &= ~pause;
+ }
+
+ return m88e1121_config_init(phydev);
diff --git a/patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch b/patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
new file mode 100644
index 0000000000..933d7da960
--- /dev/null
+++ b/patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
@@ -0,0 +1,51 @@
+From 955d3411a17f590364238bd0d3329b61f20c1cd2 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Sun, 30 Dec 2018 12:46:01 +0100
+Subject: [PATCH] batman-adv: Avoid WARN on net_device without parent in netns
+Git-commit: 955d3411a17f590364238bd0d3329b61f20c1cd2
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+It is not allowed to use WARN* helpers on potential incorrect input from
+the user or transient problems because systems configured as panic_on_warn
+will reboot due to such a problem.
+
+A NULL return value of __dev_get_by_index can be caused by various problems
+which can either be related to the system configuration or problems
+(incorrectly returned network namespaces) in other (virtual) net_device
+drivers. batman-adv should not cause a (harmful) WARN in this situation and
+instead only report it via a simple message.
+
+Fixes: b7eddd0b3950 ("batman-adv: prevent using any virtual device created on batman-adv as hard-interface")
+Reported-by: syzbot+c764de0fcfadca9a8595@syzkaller.appspotmail.com
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/hard-interface.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/batman-adv/hard-interface.c
++++ b/net/batman-adv/hard-interface.c
+@@ -19,7 +19,6 @@
+ #include "main.h"
+
+ #include <linux/atomic.h>
+-#include <linux/bug.h>
+ #include <linux/byteorder/generic.h>
+ #include <linux/errno.h>
+ #include <linux/fs.h>
+@@ -172,8 +171,10 @@ static bool batadv_is_on_batman_iface(co
+ parent_dev = __dev_get_by_index((struct net *)parent_net,
+ dev_get_iflink(net_dev));
+ /* if we got a NULL parent_dev there is something broken.. */
+- if (WARN(!parent_dev, "Cannot find parent device"))
++ if (!parent_dev) {
++ pr_err("Cannot find parent device\n");
+ return false;
++ }
+
+ if (batadv_mutual_parents(net_dev, net, parent_dev, parent_net))
+ return false;
diff --git a/patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch b/patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
new file mode 100644
index 0000000000..08f2998f1d
--- /dev/null
+++ b/patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
@@ -0,0 +1,47 @@
+From 9114daa825fc3f335f9bea3313ce667090187280 Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@narfation.org>
+Date: Mon, 31 Dec 2018 22:31:01 +0100
+Subject: [PATCH] batman-adv: Force mac header to start of data on xmit
+Git-commit: 9114daa825fc3f335f9bea3313ce667090187280
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+The caller of ndo_start_xmit may not already have called
+skb_reset_mac_header. The returned value of skb_mac_header/eth_hdr
+therefore can be in the wrong position and even outside the current skbuff.
+This for example happens when the user binds to the device using a
+PF_PACKET-SOCK_RAW with enabled qdisc-bypass:
+
+ int opt = 4;
+ setsockopt(sock, SOL_PACKET, PACKET_QDISC_BYPASS, &opt, sizeof(opt));
+
+Since eth_hdr is used all over the codebase, the batadv_interface_tx
+function must always take care of resetting it.
+
+Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
+Reported-by: syzbot+9d7405c7faa390e60b4e@syzkaller.appspotmail.com
+Reported-by: syzbot+7d20bc3f1ddddc0f9079@syzkaller.appspotmail.com
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/batman-adv/soft-interface.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 5db5a0a4c959..b85ca809e509 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -221,6 +221,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
+
+ netif_trans_update(soft_iface);
+ vid = batadv_get_vid(skb, 0);
++
++ skb_reset_mac_header(skb);
+ ethhdr = eth_hdr(skb);
+
+ switch (ntohs(ethhdr->h_proto)) {
+--
+2.16.4
+
diff --git a/patches.drivers/bnxt_en-Disable-interrupts-when-allocating-CP-rings-.patch b/patches.drivers/bnxt_en-Disable-interrupts-when-allocating-CP-rings-.patch
new file mode 100644
index 0000000000..0e528ed7b4
--- /dev/null
+++ b/patches.drivers/bnxt_en-Disable-interrupts-when-allocating-CP-rings-.patch
@@ -0,0 +1,45 @@
+From: Michael Chan <michael.chan@broadcom.com>
+Date: Thu, 31 Jan 2019 14:31:48 -0500
+Subject: bnxt_en: Disable interrupts when allocating CP rings or NQs.
+Patch-mainline: v5.0-rc6
+Git-commit: 5e66e35aab335b83d9ffb220d8a3a13986a7a60e
+References: bsc#1104745 FATE#325918
+
+When calling firmware to allocate a CP ring or NQ, an interrupt associated
+with that ring may be generated immediately before the doorbell is even
+setup after the firmware call returns. When servicing the interrupt, the
+driver may crash when trying to access the doorbell.
+
+Fix it by disabling interrupt on that vector until the doorbell is
+set up.
+
+Fixes: 697197e5a173 ("bnxt_en: Re-structure doorbells.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4973,12 +4973,18 @@ static int bnxt_hwrm_ring_alloc(struct b
+ struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+ struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
+ u32 map_idx = ring->map_idx;
++ unsigned int vector;
+
++ vector = bp->irq_tbl[map_idx].vector;
++ disable_irq_nosync(vector);
+ rc = hwrm_ring_alloc_send_msg(bp, ring, type, map_idx);
+- if (rc)
++ if (rc) {
++ enable_irq(vector);
+ goto err_out;
++ }
+ bnxt_set_db(bp, &cpr->cp_db, type, map_idx, ring->fw_ring_id);
+ bnxt_db_nq(bp, &cpr->cp_db, cpr->cp_raw_cons);
++ enable_irq(vector);
+ bp->grp_info[i].cp_fw_ring_id = ring->fw_ring_id;
+
+ if (!i) {
diff --git a/patches.drivers/bpf-fix-potential-deadlock-in-bpf_prog_register.patch b/patches.drivers/bpf-fix-potential-deadlock-in-bpf_prog_register.patch
new file mode 100644
index 0000000000..453f73dbe4
--- /dev/null
+++ b/patches.drivers/bpf-fix-potential-deadlock-in-bpf_prog_register.patch
@@ -0,0 +1,160 @@
+From: Alexei Starovoitov <ast@kernel.org>
+Date: Wed, 30 Jan 2019 18:12:44 -0800
+Subject: bpf: fix potential deadlock in bpf_prog_register
+Patch-mainline: v5.0-rc6
+Git-commit: e16ec34039c701594d55d08a5aa49ee3e1abc821
+References: bsc#1109837
+
+Lockdep found a potential deadlock between cpu_hotplug_lock, bpf_event_mutex, and cpuctx_mutex:
+[ 13.007000] WARNING: possible circular locking dependency detected
+[ 13.007587] 5.0.0-rc3-00018-g2fa53f892422-dirty #477 Not tainted
+[ 13.008124] ------------------------------------------------------
+[ 13.008624] test_progs/246 is trying to acquire lock:
+[ 13.009030] 0000000094160d1d (tracepoints_mutex){+.+.}, at: tracepoint_probe_register_prio+0x2d/0x300
+[ 13.009770]
+[ 13.009770] but task is already holding lock:
+[ 13.010239] 00000000d663ef86 (bpf_event_mutex){+.+.}, at: bpf_probe_register+0x1d/0x60
+[ 13.010877]
+[ 13.010877] which lock already depends on the new lock.
+[ 13.010877]
+[ 13.011532]
+[ 13.011532] the existing dependency chain (in reverse order) is:
+[ 13.012129]
+[ 13.012129] -> #4 (bpf_event_mutex){+.+.}:
+[ 13.012582] perf_event_query_prog_array+0x9b/0x130
+[ 13.013016] _perf_ioctl+0x3aa/0x830
+[ 13.013354] perf_ioctl+0x2e/0x50
+[ 13.013668] do_vfs_ioctl+0x8f/0x6a0
+[ 13.014003] ksys_ioctl+0x70/0x80
+[ 13.014320] __x64_sys_ioctl+0x16/0x20
+[ 13.014668] do_syscall_64+0x4a/0x180
+[ 13.015007] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 13.015469]
+[ 13.015469] -> #3 (&cpuctx_mutex){+.+.}:
+[ 13.015910] perf_event_init_cpu+0x5a/0x90
+[ 13.016291] perf_event_init+0x1b2/0x1de
+[ 13.016654] start_kernel+0x2b8/0x42a
+[ 13.016995] secondary_startup_64+0xa4/0xb0
+[ 13.017382]
+[ 13.017382] -> #2 (pmus_lock){+.+.}:
+[ 13.017794] perf_event_init_cpu+0x21/0x90
+[ 13.018172] cpuhp_invoke_callback+0xb3/0x960
+[ 13.018573] _cpu_up+0xa7/0x140
+[ 13.018871] do_cpu_up+0xa4/0xc0
+[ 13.019178] smp_init+0xcd/0xd2
+[ 13.019483] kernel_init_freeable+0x123/0x24f
+[ 13.019878] kernel_init+0xa/0x110
+[ 13.020201] ret_from_fork+0x24/0x30
+[ 13.020541]
+[ 13.020541] -> #1 (cpu_hotplug_lock.rw_sem){++++}:
+[ 13.021051] static_key_slow_inc+0xe/0x20
+[ 13.021424] tracepoint_probe_register_prio+0x28c/0x300
+[ 13.021891] perf_trace_event_init+0x11f/0x250
+[ 13.022297] perf_trace_init+0x6b/0xa0
+[ 13.022644] perf_tp_event_init+0x25/0x40
+[ 13.023011] perf_try_init_event+0x6b/0x90
+[ 13.023386] perf_event_alloc+0x9a8/0xc40
+[ 13.023754] __do_sys_perf_event_open+0x1dd/0xd30
+[ 13.024173] do_syscall_64+0x4a/0x180
+[ 13.024519] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 13.024968]
+[ 13.024968] -> #0 (tracepoints_mutex){+.+.}:
+[ 13.025434] __mutex_lock+0x86/0x970
+[ 13.025764] tracepoint_probe_register_prio+0x2d/0x300
+[ 13.026215] bpf_probe_register+0x40/0x60
+[ 13.026584] bpf_raw_tracepoint_open.isra.34+0xa4/0x130
+[ 13.027042] __do_sys_bpf+0x94f/0x1a90
+[ 13.027389] do_syscall_64+0x4a/0x180
+[ 13.027727] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 13.028171]
+[ 13.028171] other info that might help us debug this:
+[ 13.028171]
+[ 13.028807] Chain exists of:
+[ 13.028807] tracepoints_mutex --> &cpuctx_mutex --> bpf_event_mutex
+[ 13.028807]
+[ 13.029666] Possible unsafe locking scenario:
+[ 13.029666]
+[ 13.030140] CPU0 CPU1
+[ 13.030510] ---- ----
+[ 13.030875] lock(bpf_event_mutex);
+[ 13.031166] lock(&cpuctx_mutex);
+[ 13.031645] lock(bpf_event_mutex);
+[ 13.032135] lock(tracepoints_mutex);
+[ 13.032441]
+[ 13.032441] *** DEADLOCK ***
+[ 13.032441]
+[ 13.032911] 1 lock held by test_progs/246:
+[ 13.033239] #0: 00000000d663ef86 (bpf_event_mutex){+.+.}, at: bpf_probe_register+0x1d/0x60
+[ 13.033909]
+[ 13.033909] stack backtrace:
+[ 13.034258] CPU: 1 PID: 246 Comm: test_progs Not tainted 5.0.0-rc3-00018-g2fa53f892422-dirty #477
+[ 13.034964] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
+[ 13.035657] Call Trace:
+[ 13.035859] dump_stack+0x5f/0x8b
+[ 13.036130] print_circular_bug.isra.37+0x1ce/0x1db
+[ 13.036526] __lock_acquire+0x1158/0x1350
+[ 13.036852] ? lock_acquire+0x98/0x190
+[ 13.037154] lock_acquire+0x98/0x190
+[ 13.037447] ? tracepoint_probe_register_prio+0x2d/0x300
+[ 13.037876] __mutex_lock+0x86/0x970
+[ 13.038167] ? tracepoint_probe_register_prio+0x2d/0x300
+[ 13.038600] ? tracepoint_probe_register_prio+0x2d/0x300
+[ 13.039028] ? __mutex_lock+0x86/0x970
+[ 13.039337] ? __mutex_lock+0x24a/0x970
+[ 13.039649] ? bpf_probe_register+0x1d/0x60
+[ 13.039992] ? __bpf_trace_sched_wake_idle_without_ipi+0x10/0x10
+[ 13.040478] ? tracepoint_probe_register_prio+0x2d/0x300
+[ 13.040906] tracepoint_probe_register_prio+0x2d/0x300
+[ 13.041325] bpf_probe_register+0x40/0x60
+[ 13.041649] bpf_raw_tracepoint_open.isra.34+0xa4/0x130
+[ 13.042068] ? __might_fault+0x3e/0x90
+[ 13.042374] __do_sys_bpf+0x94f/0x1a90
+[ 13.042678] do_syscall_64+0x4a/0x180
+[ 13.042975] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[ 13.043382] RIP: 0033:0x7f23b10a07f9
+[ 13.045155] RSP: 002b:00007ffdef42fdd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000141
+[ 13.045759] RAX: ffffffffffffffda RBX: 00007ffdef42ff70 RCX: 00007f23b10a07f9
+[ 13.046326] RDX: 0000000000000070 RSI: 00007ffdef42fe10 RDI: 0000000000000011
+[ 13.046893] RBP: 00007ffdef42fdf0 R08: 0000000000000038 R09: 00007ffdef42fe10
+[ 13.047462] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
+[ 13.048029] R13: 0000000000000016 R14: 00007f23b1db4690 R15: 0000000000000000
+
+Since tracepoints_mutex will be taken in tracepoint_probe_register/unregister()
+there is no need to take bpf_event_mutex too.
+bpf_event_mutex is protecting modifications to prog array used in kprobe/perf bpf progs.
+bpf_raw_tracepoints don't need to take this mutex.
+
+Fixes: c4f6699dfcb8 ("bpf: introduce BPF_RAW_TRACEPOINT")
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/trace/bpf_trace.c | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -1123,20 +1123,10 @@ static int __bpf_probe_register(struct b
+
+ int bpf_probe_register(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
+ {
+- int err;
+-
+- mutex_lock(&bpf_event_mutex);
+- err = __bpf_probe_register(btp, prog);
+- mutex_unlock(&bpf_event_mutex);
+- return err;
++ return __bpf_probe_register(btp, prog);
+ }
+
+ int bpf_probe_unregister(struct bpf_raw_event_map *btp, struct bpf_prog *prog)
+ {
+- int err;
+-
+- mutex_lock(&bpf_event_mutex);
+- err = tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
+- mutex_unlock(&bpf_event_mutex);
+- return err;
++ return tracepoint_probe_unregister(btp->tp, (void *)btp->bpf_func, prog);
+ }
diff --git a/patches.drivers/bpf-sock-recvbuff-must-be-limited-by-rmem_max-in-bpf.patch b/patches.drivers/bpf-sock-recvbuff-must-be-limited-by-rmem_max-in-bpf.patch
new file mode 100644
index 0000000000..00736411c0
--- /dev/null
+++ b/patches.drivers/bpf-sock-recvbuff-must-be-limited-by-rmem_max-in-bpf.patch
@@ -0,0 +1,35 @@
+From: Yafang Shao <laoar.shao@gmail.com>
+Date: Wed, 23 Jan 2019 12:37:19 +0800
+Subject: bpf: sock recvbuff must be limited by rmem_max in bpf_setsockopt()
+Patch-mainline: v5.0-rc6
+Git-commit: c9e4576743eeda8d24dedc164d65b78877f9a98c
+References: bsc#1109837
+
+When sock recvbuff is set by bpf_setsockopt(), the value must by
+limited by rmem_max. It is the same with sendbuff.
+
+Fixes: 8c4b4c7e9ff0 ("bpf: Add setsockopt helper function to bpf")
+Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Acked-by: Lawrence Brakmo <brakmo@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/core/filter.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3753,10 +3753,12 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_so
+ /* Only some socketops are supported */
+ switch (optname) {
+ case SO_RCVBUF:
++ val = min_t(u32, val, sysctl_rmem_max);
+ sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
+ sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
+ break;
+ case SO_SNDBUF:
++ val = min_t(u32, val, sysctl_wmem_max);
+ sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
+ sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
+ break;
diff --git a/patches.drivers/bpftool-Fix-prog-dump-by-tag.patch b/patches.drivers/bpftool-Fix-prog-dump-by-tag.patch
new file mode 100644
index 0000000000..fbeb9af4aa
--- /dev/null
+++ b/patches.drivers/bpftool-Fix-prog-dump-by-tag.patch
@@ -0,0 +1,65 @@
+From: Jiri Olsa <jolsa@kernel.org>
+Date: Fri, 18 Jan 2019 13:58:17 +0100
+Subject: bpftool: Fix prog dump by tag
+Patch-mainline: v5.0-rc6
+Git-commit: 752bcf80f5549c9901b2e8bc77b2138de55b1026
+References: bsc#1109837
+
+Lance reported an issue with bpftool not being able to
+dump program if there are more programs loaded and you
+want to dump any but the first program, like:
+
+ # bpftool prog
+ 28: kprobe name trace_req_start tag 1dfc28ba8b3dd597 gpl
+ loaded_at 2019-01-18T17:02:40+1100 uid 0
+ xlated 112B jited 109B memlock 4096B map_ids 13
+ 29: kprobe name trace_req_compl tag 5b6a5ecc6030a683 gpl
+ loaded_at 2019-01-18T17:02:40+1100 uid 0
+ xlated 928B jited 575B memlock 4096B map_ids 13,14
+ # bpftool prog dum jited tag 1dfc28ba8b3dd597
+ 0: push %rbp
+ 1: mov %rsp,%rbp
+ ...
+
+ # bpftool prog dum jited tag 5b6a5ecc6030a683
+ Error: can't get prog info (29): Bad address
+
+The problem is in the prog_fd_by_tag function not cleaning
+the struct bpf_prog_info before another request, so the
+previous program length is still in there and kernel assumes
+it needs to dump the program, which fails because there's no
+user pointer set.
+
+Moving the struct bpf_prog_info declaration into the loop,
+so it gets cleaned before each query.
+
+Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool")
+Reported-by: Lance Digby <ldigby@redhat.com>
+Signed-off-by: Jiri Olsa <jolsa@kernel.org>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Acked-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ tools/bpf/bpftool/prog.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/tools/bpf/bpftool/prog.c
++++ b/tools/bpf/bpftool/prog.c
+@@ -128,13 +128,14 @@ static void print_boot_time(__u64 nsecs,
+
+ static int prog_fd_by_tag(unsigned char *tag)
+ {
+- struct bpf_prog_info info = {};
+- __u32 len = sizeof(info);
+ unsigned int id = 0;
+ int err;
+ int fd;
+
+ while (true) {
++ struct bpf_prog_info info = {};
++ __u32 len = sizeof(info);
++
+ err = bpf_prog_get_next_id(id, &id);
+ if (err) {
+ p_err("%s", strerror(errno));
diff --git a/patches.drivers/bpftool-fix-percpu-maps-updating.patch b/patches.drivers/bpftool-fix-percpu-maps-updating.patch
new file mode 100644
index 0000000000..8768734b89
--- /dev/null
+++ b/patches.drivers/bpftool-fix-percpu-maps-updating.patch
@@ -0,0 +1,60 @@
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Mon, 21 Jan 2019 12:36:12 +0100
+Subject: bpftool: fix percpu maps updating
+Patch-mainline: v5.0-rc6
+Git-commit: b0ca5ecb8e2279d706261f525f1bd0ba9e3fe800
+References: bsc#1109837
+
+When updating a percpu map, bpftool currently copies the provided
+value only into the first per CPU copy of the specified value,
+all others instances are left zeroed.
+
+This change explicitly copies the user-provided bytes to all the
+per CPU instances, keeping the sub-command syntax unchanged.
+
+v2 -> v3:
+ - drop unused argument, as per Quentin's suggestion
+v1 -> v2:
+ - rename the helper as per Quentin's suggestion
+
+Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Quentin Monnet <quentin.monnet@netronome.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ tools/bpf/bpftool/map.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/tools/bpf/bpftool/map.c
++++ b/tools/bpf/bpftool/map.c
+@@ -268,6 +268,20 @@ static char **parse_bytes(char **argv, c
+ return argv + i;
+ }
+
++/* on per cpu maps we must copy the provided value on all value instances */
++static void fill_per_cpu_value(struct bpf_map_info *info, void *value)
++{
++ unsigned int i, n, step;
++
++ if (!map_is_per_cpu(info->type))
++ return;
++
++ n = get_possible_cpus();
++ step = round_up(info->value_size, 8);
++ for (i = 1; i < n; i++)
++ memcpy(value + i * step, value, info->value_size);
++}
++
+ static int parse_elem(char **argv, struct bpf_map_info *info,
+ void *key, void *value, __u32 key_size, __u32 value_size,
+ __u32 *flags, __u32 **value_fd)
+@@ -347,6 +361,8 @@ static int parse_elem(char **argv, struc
+ argv = parse_bytes(argv, "value", value, value_size);
+ if (!argv)
+ return -1;
++
++ fill_per_cpu_value(info, value);
+ }
+
+ return parse_elem(argv, info, key, NULL, key_size, value_size,
diff --git a/patches.drivers/dmaengine-at_xdmac-Fix-wrongfull-report-of-a-channel.patch b/patches.drivers/dmaengine-at_xdmac-Fix-wrongfull-report-of-a-channel.patch
new file mode 100644
index 0000000000..c5bd1363e0
--- /dev/null
+++ b/patches.drivers/dmaengine-at_xdmac-Fix-wrongfull-report-of-a-channel.patch
@@ -0,0 +1,97 @@
+From dc3f595b6617ebc0307e0ce151e8f2f2b2489b95 Mon Sep 17 00:00:00 2001
+From: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Date: Wed, 23 Jan 2019 16:33:47 +0000
+Subject: [PATCH] dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
+Git-commit: dc3f595b6617ebc0307e0ce151e8f2f2b2489b95
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+atchan->status variable is used to store two different information:
+ - pass channel interrupts status from interrupt handler to tasklet;
+ - channel information like whether it is cyclic or paused;
+
+This causes a bug when device_terminate_all() is called,
+(AT_XDMAC_CHAN_IS_CYCLIC cleared on atchan->status) and then a late End
+of Block interrupt arrives (AT_XDMAC_CIS_BIS), which sets bit 0 of
+atchan->status. Bit 0 is also used for AT_XDMAC_CHAN_IS_CYCLIC, so when
+a new descriptor for a cyclic transfer is created, the driver reports
+the channel as in use:
+
+if (test_and_set_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status)) {
+ dev_err(chan2dev(chan), "channel currently used\n");
+ return NULL;
+}
+
+This patch fixes the bug by adding a different struct member to keep
+the interrupts status separated from the channel status bits.
+
+Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel eXtended DMA Controller driver")
+Signed-off-by: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/at_xdmac.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -203,6 +203,7 @@ struct at_xdmac_chan {
+ u32 save_cim;
+ u32 save_cnda;
+ u32 save_cndc;
++ u32 irq_status;
+ unsigned long status;
+ struct tasklet_struct tasklet;
+ struct dma_slave_config sconfig;
+@@ -1580,8 +1581,8 @@ static void at_xdmac_tasklet(unsigned lo
+ struct at_xdmac_desc *desc;
+ u32 error_mask;
+
+- dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08lx\n",
+- __func__, atchan->status);
++ dev_dbg(chan2dev(&atchan->chan), "%s: status=0x%08x\n",
++ __func__, atchan->irq_status);
+
+ error_mask = AT_XDMAC_CIS_RBEIS
+ | AT_XDMAC_CIS_WBEIS
+@@ -1589,15 +1590,15 @@ static void at_xdmac_tasklet(unsigned lo
+
+ if (at_xdmac_chan_is_cyclic(atchan)) {
+ at_xdmac_handle_cyclic(atchan);
+- } else if ((atchan->status & AT_XDMAC_CIS_LIS)
+- || (atchan->status & error_mask)) {
++ } else if ((atchan->irq_status & AT_XDMAC_CIS_LIS)
++ || (atchan->irq_status & error_mask)) {
+ struct dma_async_tx_descriptor *txd;
+
+- if (atchan->status & AT_XDMAC_CIS_RBEIS)
++ if (atchan->irq_status & AT_XDMAC_CIS_RBEIS)
+ dev_err(chan2dev(&atchan->chan), "read bus error!!!");
+- if (atchan->status & AT_XDMAC_CIS_WBEIS)
++ if (atchan->irq_status & AT_XDMAC_CIS_WBEIS)
+ dev_err(chan2dev(&atchan->chan), "write bus error!!!");
+- if (atchan->status & AT_XDMAC_CIS_ROIS)
++ if (atchan->irq_status & AT_XDMAC_CIS_ROIS)
+ dev_err(chan2dev(&atchan->chan), "request overflow error!!!");
+
+ spin_lock_bh(&atchan->lock);
+@@ -1652,7 +1653,7 @@ static irqreturn_t at_xdmac_interrupt(in
+ atchan = &atxdmac->chan[i];
+ chan_imr = at_xdmac_chan_read(atchan, AT_XDMAC_CIM);
+ chan_status = at_xdmac_chan_read(atchan, AT_XDMAC_CIS);
+- atchan->status = chan_status & chan_imr;
++ atchan->irq_status = chan_status & chan_imr;
+ dev_vdbg(atxdmac->dma.dev,
+ "%s: chan%d: imr=0x%x, status=0x%x\n",
+ __func__, i, chan_imr, chan_status);
+@@ -1666,7 +1667,7 @@ static irqreturn_t at_xdmac_interrupt(in
+ at_xdmac_chan_read(atchan, AT_XDMAC_CDA),
+ at_xdmac_chan_read(atchan, AT_XDMAC_CUBC));
+
+- if (atchan->status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
++ if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS | AT_XDMAC_CIS_WBEIS))
+ at_xdmac_write(atxdmac, AT_XDMAC_GD, atchan->mask);
+
+ tasklet_schedule(&atchan->tasklet);
diff --git a/patches.drivers/dmaengine-bcm2835-Fix-abort-of-transactions.patch b/patches.drivers/dmaengine-bcm2835-Fix-abort-of-transactions.patch
new file mode 100644
index 0000000000..c40e959c93
--- /dev/null
+++ b/patches.drivers/dmaengine-bcm2835-Fix-abort-of-transactions.patch
@@ -0,0 +1,161 @@
+From 9e528c799d17a4ac37d788c81440b50377dd592d Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 23 Jan 2019 09:26:00 +0100
+Subject: [PATCH] dmaengine: bcm2835: Fix abort of transactions
+Git-commit: 9e528c799d17a4ac37d788c81440b50377dd592d
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+There are multiple issues with bcm2835_dma_abort() (which is called on
+termination of a transaction):
+
+* The algorithm to abort the transaction first pauses the channel by
+ clearing the ACTIVE flag in the CS register, then waits for the PAUSED
+ flag to clear. Page 49 of the spec documents the latter as follows:
+
+ "Indicates if the DMA is currently paused and not transferring data.
+ This will occur if the active bit has been cleared [...]"
+ https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
+
+ So the function is entering an infinite loop because it is waiting for
+ PAUSED to clear which is always set due to the function having cleared
+ the ACTIVE flag. The only thing that's saving it from itself is the
+ upper bound of 10000 loop iterations.
+
+ The code comment says that the intention is to "wait for any current
+ AXI transfer to complete", so the author probably wanted to check the
+ WAITING_FOR_OUTSTANDING_WRITES flag instead. Amend the function
+ accordingly.
+
+* The CS register is only read at the beginning of the function. It
+ needs to be read again after pausing the channel and before checking
+ for outstanding writes, otherwise writes which were issued between
+ the register read at the beginning of the function and pausing the
+ channel may not be waited for.
+
+* The function seeks to abort the transfer by writing 0 to the NEXTCONBK
+ register and setting the ABORT and ACTIVE flags. Thereby, the 0 in
+ NEXTCONBK is sought to be loaded into the CONBLK_AD register. However
+ experimentation has shown this approach to not work: The CONBLK_AD
+ register remains the same as before and the CS register contains
+ 0x00000030 (PAUSED | DREQ_STOPS_DMA). In other words, the control
+ block is not aborted but merely paused and it will be resumed once the
+ next DMA transaction is started. That is absolutely not the desired
+ behavior.
+
+ A simpler approach is to set the channel's RESET flag instead. This
+ reliably zeroes the NEXTCONBK as well as the CS register. It requires
+ less code and only a single MMIO write. This is also what popular
+ user space DMA drivers do, e.g.:
+ https://github.com/metachris/RPIO/blob/master/source/c_pwm/pwm.c
+
+ Note that the spec is contradictory whether the NEXTCONBK register
+ is writeable at all. On the one hand, page 41 claims:
+
+ "The value loaded into the NEXTCONBK register can be overwritten so
+ that the linked list of Control Block data structures can be
+ dynamically altered. However it is only safe to do this when the DMA
+ is paused."
+
+ On the other hand, page 40 specifies:
+
+ "Only three registers in each channel's register set are directly
+ writeable (CS, CONBLK_AD and DEBUG). The other registers (TI,
+ SOURCE_AD, DEST_AD, TXFR_LEN, STRIDE & NEXTCONBK), are automatically
+ loaded from a Control Block data structure held in external memory."
+
+Fixes: 96286b576690 ("dmaengine: Add support for BCM2835")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v3.14+
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Cc: Florian Meier <florian.meier@koalo.de>
+Cc: Clive Messer <clive.m.messer@gmail.com>
+Cc: Matthias Reichl <hias@horus.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Florian Kauer <florian.kauer@koalo.de>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/bcm2835-dma.c | 41 +++++++++--------------------------------
+ 1 file changed, 9 insertions(+), 32 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -415,13 +415,11 @@ static void bcm2835_dma_fill_cb_chain_wi
+ }
+ }
+
+-static int bcm2835_dma_abort(void __iomem *chan_base)
++static int bcm2835_dma_abort(struct bcm2835_chan *c)
+ {
+- unsigned long cs;
++ void __iomem *chan_base = c->chan_base;
+ long int timeout = 10000;
+
+- cs = readl(chan_base + BCM2835_DMA_CS);
+-
+ /*
+ * A zero control block address means the channel is idle.
+ * (The ACTIVE flag in the CS register is not a reliable indicator.)
+@@ -433,25 +431,16 @@ static int bcm2835_dma_abort(void __iome
+ writel(0, chan_base + BCM2835_DMA_CS);
+
+ /* Wait for any current AXI transfer to complete */
+- while ((cs & BCM2835_DMA_ISPAUSED) && --timeout) {
++ while ((readl(chan_base + BCM2835_DMA_CS) &
++ BCM2835_DMA_WAITING_FOR_WRITES) && --timeout)
+ cpu_relax();
+- cs = readl(chan_base + BCM2835_DMA_CS);
+- }
+
+- /* We'll un-pause when we set of our next DMA */
++ /* Peripheral might be stuck and fail to signal AXI write responses */
+ if (!timeout)
+- return -ETIMEDOUT;
+-
+- if (!(cs & BCM2835_DMA_ACTIVE))
+- return 0;
+-
+- /* Terminate the control block chain */
+- writel(0, chan_base + BCM2835_DMA_NEXTCB);
+-
+- /* Abort the whole DMA */
+- writel(BCM2835_DMA_ABORT | BCM2835_DMA_ACTIVE,
+- chan_base + BCM2835_DMA_CS);
++ dev_err(c->vc.chan.device->dev,
++ "failed to complete outstanding writes\n");
+
++ writel(BCM2835_DMA_RESET, chan_base + BCM2835_DMA_CS);
+ return 0;
+ }
+
+@@ -804,7 +793,6 @@ static int bcm2835_dma_terminate_all(str
+ struct bcm2835_chan *c = to_bcm2835_dma_chan(chan);
+ struct bcm2835_dmadev *d = to_bcm2835_dma_dev(c->vc.chan.device);
+ unsigned long flags;
+- int timeout = 10000;
+ LIST_HEAD(head);
+
+ spin_lock_irqsave(&c->vc.lock, flags);
+@@ -818,18 +806,7 @@ static int bcm2835_dma_terminate_all(str
+ if (c->desc) {
+ bcm2835_dma_desc_free(&c->desc->vd);
+ c->desc = NULL;
+- bcm2835_dma_abort(c->chan_base);
+-
+- /* Wait for stopping */
+- while (--timeout) {
+- if (!readl(c->chan_base + BCM2835_DMA_ADDR))
+- break;
+-
+- cpu_relax();
+- }
+-
+- if (!timeout)
+- dev_err(d->ddev.dev, "DMA transfer could not be terminated\n");
++ bcm2835_dma_abort(c);
+ }
+
+ vchan_get_all_descriptors(&c->vc, &head);
diff --git a/patches.drivers/dmaengine-bcm2835-Fix-interrupt-race-on-RT.patch b/patches.drivers/dmaengine-bcm2835-Fix-interrupt-race-on-RT.patch
new file mode 100644
index 0000000000..42f7071779
--- /dev/null
+++ b/patches.drivers/dmaengine-bcm2835-Fix-interrupt-race-on-RT.patch
@@ -0,0 +1,154 @@
+From f7da7782aba92593f7b82f03d2409a1c5f4db91b Mon Sep 17 00:00:00 2001
+From: Lukas Wunner <lukas@wunner.de>
+Date: Wed, 23 Jan 2019 09:26:00 +0100
+Subject: [PATCH] dmaengine: bcm2835: Fix interrupt race on RT
+Git-commit: f7da7782aba92593f7b82f03d2409a1c5f4db91b
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+If IRQ handlers are threaded (either because CONFIG_PREEMPT_RT_BASE is
+enabled or "threadirqs" was passed on the command line) and if system
+load is sufficiently high that wakeup latency of IRQ threads degrades,
+SPI DMA transactions on the BCM2835 occasionally break like this:
+
+ks8851 spi0.0: SPI transfer timed out
+bcm2835-dma 3f007000.dma: DMA transfer could not be terminated
+ks8851 spi0.0 eth2: ks8851_rdfifo: spi_sync() failed
+
+The root cause is an assumption made by the DMA driver which is
+documented in a code comment in bcm2835_dma_terminate_all():
+
+/*
+ * Stop DMA activity: we assume the callback will not be called
+ * after bcm_dma_abort() returns (even if it does, it will see
+ * c->desc is NULL and exit.)
+ */
+
+That assumption falls apart if the IRQ handler bcm2835_dma_callback() is
+Threaded: A client may terminate a descriptor and issue a new one
+before the IRQ handler had a chance to run. In fact the IRQ handler may
+miss an *arbitrary* number of descriptors. The result is the following
+race condition:
+
+1. A descriptor finishes, its interrupt is deferred to the IRQ thread.
+2. A client calls dma_terminate_async() which sets channel->desc = NULL.
+3. The client issues a new descriptor. Because channel->desc is NULL,
+ bcm2835_dma_issue_pending() immediately starts the descriptor.
+4. Finally the IRQ thread runs and writes BCM2835_DMA_INT to the CS
+ register to acknowledge the interrupt. This clears the ACTIVE flag,
+ so the newly issued descriptor is paused in the middle of the
+ transaction. Because channel->desc is not NULL, the IRQ thread
+ finalizes the descriptor and tries to start the next one.
+
+I see two possible solutions: The first is to call synchronize_irq()
+in bcm2835_dma_issue_pending() to wait until the IRQ thread has
+finished before issuing a new descriptor. The downside of this approach
+is unnecessary latency if clients desire rapidly terminating and
+re-issuing descriptors and don't have any use for an IRQ callback.
+(The SPI TX DMA channel is a case in point.)
+
+A better alternative is to make the IRQ thread recognize that it has
+missed descriptors and avoid finalizing the newly issued descriptor.
+So first of all, set the ACTIVE flag when acknowledging the interrupt.
+This keeps a newly issued descriptor running.
+
+If the descriptor was finished, the channel remains idle despite the
+ACTIVE flag being set. However the ACTIVE flag can then no longer be
+used to check whether the channel is idle, so instead check whether
+the register containing the current control block address is zero
+and finalize the current descriptor only if so.
+
+That way, there is no impact on latency and throughput if the client
+doesn't care for the interrupt: Only minimal additional overhead is
+introduced for non-cyclic descriptors as one further MMIO read is
+necessary per interrupt to check for idleness of the channel. Cyclic
+descriptors are sped up slightly by removing one MMIO write per
+interrupt.
+
+Fixes: 96286b576690 ("dmaengine: Add support for BCM2835")
+Signed-off-by: Lukas Wunner <lukas@wunner.de>
+Cc: stable@vger.kernel.org # v3.14+
+Cc: Frank Pavlic <f.pavlic@kunbus.de>
+Cc: Martin Sperl <kernel@martin.sperl.org>
+Cc: Florian Meier <florian.meier@koalo.de>
+Cc: Clive Messer <clive.m.messer@gmail.com>
+Cc: Matthias Reichl <hias@horus.com>
+Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
+Acked-by: Florian Kauer <florian.kauer@koalo.de>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/bcm2835-dma.c | 33 ++++++++++++++++++---------------
+ 1 file changed, 18 insertions(+), 15 deletions(-)
+
+--- a/drivers/dma/bcm2835-dma.c
++++ b/drivers/dma/bcm2835-dma.c
+@@ -421,7 +421,12 @@ static int bcm2835_dma_abort(void __iome
+ long int timeout = 10000;
+
+ cs = readl(chan_base + BCM2835_DMA_CS);
+- if (!(cs & BCM2835_DMA_ACTIVE))
++
++ /*
++ * A zero control block address means the channel is idle.
++ * (The ACTIVE flag in the CS register is not a reliable indicator.)
++ */
++ if (!readl(chan_base + BCM2835_DMA_ADDR))
+ return 0;
+
+ /* Write 0 to the active bit - Pause the DMA */
+@@ -485,8 +490,15 @@ static irqreturn_t bcm2835_dma_callback(
+
+ spin_lock_irqsave(&c->vc.lock, flags);
+
+- /* Acknowledge interrupt */
+- writel(BCM2835_DMA_INT, c->chan_base + BCM2835_DMA_CS);
++ /*
++ * Clear the INT flag to receive further interrupts. Keep the channel
++ * active in case the descriptor is cyclic or in case the client has
++ * already terminated the descriptor and issued a new one. (May happen
++ * if this IRQ handler is threaded.) If the channel is finished, it
++ * will remain idle despite the ACTIVE flag being set.
++ */
++ writel(BCM2835_DMA_INT | BCM2835_DMA_ACTIVE,
++ c->chan_base + BCM2835_DMA_CS);
+
+ d = c->desc;
+
+@@ -494,11 +506,7 @@ static irqreturn_t bcm2835_dma_callback(
+ if (d->cyclic) {
+ /* call the cyclic callback */
+ vchan_cyclic_callback(&d->vd);
+-
+- /* Keep the DMA engine running */
+- writel(BCM2835_DMA_ACTIVE,
+- c->chan_base + BCM2835_DMA_CS);
+- } else {
++ } else if (!readl(c->chan_base + BCM2835_DMA_ADDR)) {
+ vchan_cookie_complete(&c->desc->vd);
+ bcm2835_dma_start_desc(c);
+ }
+@@ -806,11 +814,7 @@ static int bcm2835_dma_terminate_all(str
+ list_del_init(&c->node);
+ spin_unlock(&d->lock);
+
+- /*
+- * Stop DMA activity: we assume the callback will not be called
+- * after bcm_dma_abort() returns (even if it does, it will see
+- * c->desc is NULL and exit.)
+- */
++ /* stop DMA activity */
+ if (c->desc) {
+ bcm2835_dma_desc_free(&c->desc->vd);
+ c->desc = NULL;
+@@ -818,8 +822,7 @@ static int bcm2835_dma_terminate_all(str
+
+ /* Wait for stopping */
+ while (--timeout) {
+- if (!(readl(c->chan_base + BCM2835_DMA_CS) &
+- BCM2835_DMA_ACTIVE))
++ if (!readl(c->chan_base + BCM2835_DMA_ADDR))
+ break;
+
+ cpu_relax();
diff --git a/patches.drivers/dmaengine-dmatest-Abort-test-in-case-of-mapping-erro.patch b/patches.drivers/dmaengine-dmatest-Abort-test-in-case-of-mapping-erro.patch
new file mode 100644
index 0000000000..e8103fac87
--- /dev/null
+++ b/patches.drivers/dmaengine-dmatest-Abort-test-in-case-of-mapping-erro.patch
@@ -0,0 +1,124 @@
+From 6454368a804c4955ccd116236037536f81e5b1f1 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Wed, 30 Jan 2019 21:48:44 +0200
+Subject: [PATCH] dmaengine: dmatest: Abort test in case of mapping error
+Git-commit: 6454368a804c4955ccd116236037536f81e5b1f1
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+In case of mapping error the DMA addresses are invalid and continuing
+will screw system memory or potentially something else.
+
+[ 222.480310] dmatest: dma0chan7-copy0: summary 1 tests, 3 failures 6 iops 349 KB/s (0)
+...
+[ 240.912725] check: Corrupted low memory at 00000000c7c75ac9 (2940 phys) = 5656000000000000
+[ 240.921998] check: Corrupted low memory at 000000005715a1cd (2948 phys) = 279f2aca5595ab2b
+[ 240.931280] check: Corrupted low memory at 000000002f4024c0 (2950 phys) = 5e5624f349e793cf
+...
+
+Abort any test if mapping failed.
+
+Fixes: 4076e755dbec ("dmatest: convert to dmaengine_unmap_data")
+Cc: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/dmatest.c | 30 ++++++++++++++----------------
+ 1 file changed, 14 insertions(+), 16 deletions(-)
+
+--- a/drivers/dma/dmatest.c
++++ b/drivers/dma/dmatest.c
+@@ -613,11 +613,9 @@ static int dmatest_func(void *data)
+ srcs[i] = um->addr[i] + src_off;
+ ret = dma_mapping_error(dev->dev, um->addr[i]);
+ if (ret) {
+- dmaengine_unmap_put(um);
+ result("src mapping error", total_tests,
+ src_off, dst_off, len, ret);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+ um->to_cnt++;
+ }
+@@ -632,11 +630,9 @@ static int dmatest_func(void *data)
+ DMA_BIDIRECTIONAL);
+ ret = dma_mapping_error(dev->dev, dsts[i]);
+ if (ret) {
+- dmaengine_unmap_put(um);
+ result("dst mapping error", total_tests,
+ src_off, dst_off, len, ret);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+ um->bidi_cnt++;
+ }
+@@ -673,12 +669,10 @@ static int dmatest_func(void *data)
+ }
+
+ if (!tx) {
+- dmaengine_unmap_put(um);
+ result("prep error", total_tests, src_off,
+ dst_off, len, ret);
+ msleep(100);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+
+ done->done = false;
+@@ -687,12 +681,10 @@ static int dmatest_func(void *data)
+ cookie = tx->tx_submit(tx);
+
+ if (dma_submit_error(cookie)) {
+- dmaengine_unmap_put(um);
+ result("submit error", total_tests, src_off,
+ dst_off, len, ret);
+ msleep(100);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+ dma_async_issue_pending(chan);
+
+@@ -705,20 +697,20 @@ static int dmatest_func(void *data)
+ dmaengine_unmap_put(um);
+ result("test timed out", total_tests, src_off, dst_off,
+ len, 0);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ } else if (status != DMA_COMPLETE) {
+ dmaengine_unmap_put(um);
+ result(status == DMA_ERROR ?
+ "completion error status" :
+ "completion busy status", total_tests, src_off,
+ dst_off, len, ret);
+- failed_tests++;
+- continue;
++ goto error_unmap_continue;
+ }
+
+ dmaengine_unmap_put(um);
+
++ dmaengine_unmap_put(um);
++
+ if (params->noverify) {
+ verbose_result("test passed", total_tests, src_off,
+ dst_off, len, 0);
+@@ -757,6 +749,12 @@ static int dmatest_func(void *data)
+ verbose_result("test passed", total_tests, src_off,
+ dst_off, len, 0);
+ }
++
++ continue;
++
++error_unmap_continue:
++ dmaengine_unmap_put(um);
++ failed_tests++;
+ }
+ ktime = ktime_sub(ktime_get(), ktime);
+ ktime = ktime_sub(ktime, comparetime);
diff --git a/patches.drivers/dt-bindings-imx8mq-number-clocks-consecutively.patch b/patches.drivers/dt-bindings-imx8mq-number-clocks-consecutively.patch
new file mode 100644
index 0000000000..1c27c82859
--- /dev/null
+++ b/patches.drivers/dt-bindings-imx8mq-number-clocks-consecutively.patch
@@ -0,0 +1,72 @@
+From: =?UTF-8?q?Guido=20G=C3=BCnther?= <agx@sigxcpu.org>
+Date: Wed, 16 Jan 2019 09:41:22 +0100
+Subject: dt-bindings: imx8mq: Number clocks consecutively
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: c5b11ee9f1c22a8d6b5cab2099904f7adbe79a7f
+Patch-mainline: v5.0-rc6
+References: git-fixes
+
+This fixes a duplicate use of 232 and numbers the clocks without holes.
+
+Fixes: 1cf3817bf1f5 ("dt-bindings: Add binding for i.MX8MQ CCM")
+Signed-off-by: Guido G√ľnther <agx@sigxcpu.org>
+Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Acked-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+---
+ include/dt-bindings/clock/imx8mq-clock.h | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/include/dt-bindings/clock/imx8mq-clock.h b/include/dt-bindings/clock/imx8mq-clock.h
+index b53be41929be..04f7ac345984 100644
+--- a/include/dt-bindings/clock/imx8mq-clock.h
++++ b/include/dt-bindings/clock/imx8mq-clock.h
+@@ -350,7 +350,7 @@
+ #define IMX8MQ_CLK_VPU_G2_ROOT 241
+
+ /* SCCG PLL GATE */
+-#define IMX8MQ_SYS1_PLL_OUT 232
++#define IMX8MQ_SYS1_PLL_OUT 242
+ #define IMX8MQ_SYS2_PLL_OUT 243
+ #define IMX8MQ_SYS3_PLL_OUT 244
+ #define IMX8MQ_DRAM_PLL_OUT 245
+@@ -372,24 +372,24 @@
+ /* txesc clock */
+ #define IMX8MQ_CLK_DSI_IPG_DIV 256
+
+-#define IMX8MQ_CLK_TMU_ROOT 265
++#define IMX8MQ_CLK_TMU_ROOT 257
+
+ /* Display root clocks */
+-#define IMX8MQ_CLK_DISP_AXI_ROOT 266
+-#define IMX8MQ_CLK_DISP_APB_ROOT 267
+-#define IMX8MQ_CLK_DISP_RTRM_ROOT 268
++#define IMX8MQ_CLK_DISP_AXI_ROOT 258
++#define IMX8MQ_CLK_DISP_APB_ROOT 259
++#define IMX8MQ_CLK_DISP_RTRM_ROOT 260
+
+-#define IMX8MQ_CLK_OCOTP_ROOT 269
++#define IMX8MQ_CLK_OCOTP_ROOT 261
+
+-#define IMX8MQ_CLK_DRAM_ALT_ROOT 270
+-#define IMX8MQ_CLK_DRAM_CORE 271
++#define IMX8MQ_CLK_DRAM_ALT_ROOT 262
++#define IMX8MQ_CLK_DRAM_CORE 263
+
+-#define IMX8MQ_CLK_MU_ROOT 272
+-#define IMX8MQ_VIDEO2_PLL_OUT 273
++#define IMX8MQ_CLK_MU_ROOT 264
++#define IMX8MQ_VIDEO2_PLL_OUT 265
+
+-#define IMX8MQ_CLK_CLKO2 274
++#define IMX8MQ_CLK_CLKO2 266
+
+-#define IMX8MQ_CLK_NAND_USDHC_BUS_RAWNAND_CLK 275
++#define IMX8MQ_CLK_NAND_USDHC_BUS_RAWNAND_CLK 267
+
+-#define IMX8MQ_CLK_END 276
++#define IMX8MQ_CLK_END 268
+ #endif /* __DT_BINDINGS_CLOCK_IMX8MQ_H */
+
diff --git a/patches.drivers/ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch b/patches.drivers/ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch
new file mode 100644
index 0000000000..29fa711f87
--- /dev/null
+++ b/patches.drivers/ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch
@@ -0,0 +1,51 @@
+From 8e41cae64b08fe2e86a9ffb88b295c6b4b3a3322 Mon Sep 17 00:00:00 2001
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Tue, 11 Dec 2018 11:13:39 +0800
+Subject: [PATCH] ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
+Git-commit: 8e41cae64b08fe2e86a9ffb88b295c6b4b3a3322
+Patch-mainline: v4.20
+References: bsc#1051510
+
+gcc warning this:
+
+drivers/net/ieee802154/ca8210.c:730:10: warning:
+ comparison is always false due to limited range of data type [-Wtype-limits]
+
+'len' is u8 type, we get it from buf[1] adding 2, which can overflow.
+This patch change the type of 'len' to unsigned int to avoid this,also fix
+the gcc warning.
+
+Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/ieee802154/ca8210.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
+index 0ff5a403a8dc..b2ff903a9cb6 100644
+--- a/drivers/net/ieee802154/ca8210.c
++++ b/drivers/net/ieee802154/ca8210.c
+@@ -721,7 +721,7 @@ static void ca8210_mlme_reset_worker(struct work_struct *work)
+ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ {
+ u8 *buf;
+- u8 len;
++ unsigned int len;
+ struct work_priv_container *mlme_reset_wpc;
+ struct ca8210_priv *priv = cas_ctl->priv;
+
+@@ -730,7 +730,7 @@ static void ca8210_rx_done(struct cas_control *cas_ctl)
+ if (len > CA8210_SPI_BUF_SIZE) {
+ dev_crit(
+ &priv->spi->dev,
+- "Received packet len (%d) erroneously long\n",
++ "Received packet len (%u) erroneously long\n",
+ len
+ );
+ goto finish;
+--
+2.16.4
+
diff --git a/patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch b/patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
new file mode 100644
index 0000000000..40977ce290
--- /dev/null
+++ b/patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
@@ -0,0 +1,49 @@
+From 0808831dc62e90023ad14ff8da4804c7846e904b Mon Sep 17 00:00:00 2001
+From: Matt Ranostay <matt.ranostay@konsulko.com>
+Date: Sun, 30 Dec 2018 19:07:01 -0800
+Subject: [PATCH] iio: chemical: atlas-ph-sensor: correct IIO_TEMP values to millicelsius
+Git-commit: 0808831dc62e90023ad14ff8da4804c7846e904b
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+IIO_TEMP scale value for temperature was incorrect and not in millicelsius
+as required by the ABI documentation.
+
+Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
+Fixes: 27dec00ecf2d (iio: chemical: add Atlas pH-SM sensor support)
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/iio/chemical/atlas-ph-sensor.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/iio/chemical/atlas-ph-sensor.c b/drivers/iio/chemical/atlas-ph-sensor.c
+index a406ad31b096..3a20cb5d9bff 100644
+--- a/drivers/iio/chemical/atlas-ph-sensor.c
++++ b/drivers/iio/chemical/atlas-ph-sensor.c
+@@ -444,9 +444,8 @@ static int atlas_read_raw(struct iio_dev *indio_dev,
+ case IIO_CHAN_INFO_SCALE:
+ switch (chan->type) {
+ case IIO_TEMP:
+- *val = 1; /* 0.01 */
+- *val2 = 100;
+- break;
++ *val = 10;
++ return IIO_VAL_INT;
+ case IIO_PH:
+ *val = 1; /* 0.001 */
+ *val2 = 1000;
+@@ -477,7 +476,7 @@ static int atlas_write_raw(struct iio_dev *indio_dev,
+ int val, int val2, long mask)
+ {
+ struct atlas_data *data = iio_priv(indio_dev);
+- __be32 reg = cpu_to_be32(val);
++ __be32 reg = cpu_to_be32(val / 10);
+
+ if (val2 != 0 || val < 0 || val > 20000)
+ return -EINVAL;
+--
+2.16.4
+
diff --git a/patches.drivers/net-cls_flower-Remove-filter-from-mask-before-freein.patch b/patches.drivers/net-cls_flower-Remove-filter-from-mask-before-freein.patch
new file mode 100644
index 0000000000..1d0d0a4026
--- /dev/null
+++ b/patches.drivers/net-cls_flower-Remove-filter-from-mask-before-freein.patch
@@ -0,0 +1,49 @@
+From: Petr Machata <petrm@mellanox.com>
+Date: Mon, 4 Feb 2019 14:50:38 +0000
+Subject: net: cls_flower: Remove filter from mask before freeing it
+Patch-mainline: v5.0-rc6
+Git-commit: c1f7e02979edd7a3a3e69fe04be60b1d650dc8a7
+References: bsc#1109837
+
+In fl_change(), when adding a new rule (i.e. fold == NULL), a driver may
+reject the new rule, for example due to resource exhaustion. By that
+point, the new rule was already assigned a mask, and it was added to
+that mask's hash table. The clean-up path that's invoked as a result of
+the rejection however neglects to undo the hash table addition, and
+proceeds to free the new rule, thus leaving a dangling pointer in the
+hash table.
+
+Fix by removing fnew from the mask's hash table before it is freed.
+
+Fixes: 35cc3cefc4de ("net/sched: cls_flower: Reject duplicated rules also under skip_sw")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Reviewed-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/sched/cls_flower.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -1257,7 +1257,7 @@ static int fl_change(struct net *net, st
+ if (!tc_skip_hw(fnew->flags)) {
+ err = fl_hw_replace_filter(tp, fnew, extack);
+ if (err)
+- goto errout_mask;
++ goto errout_mask_ht;
+ }
+
+ if (!tc_in_hw(fnew->flags))
+@@ -1287,6 +1287,10 @@ static int fl_change(struct net *net, st
+ kfree(mask);
+ return 0;
+
++errout_mask_ht:
++ rhashtable_remove_fast(&fnew->mask->ht, &fnew->ht_node,
++ fnew->mask->filter_ht_params);
++
+ errout_mask:
+ fl_mask_put(head, fnew->mask, false);
+
diff --git a/patches.drivers/net-mlx5e-FPGA-fix-Innova-IPsec-TX-offload-data-path.patch b/patches.drivers/net-mlx5e-FPGA-fix-Innova-IPsec-TX-offload-data-path.patch
new file mode 100644
index 0000000000..898d06f0c1
--- /dev/null
+++ b/patches.drivers/net-mlx5e-FPGA-fix-Innova-IPsec-TX-offload-data-path.patch
@@ -0,0 +1,45 @@
+From: Raed Salem <raeds@mellanox.com>
+Date: Mon, 17 Dec 2018 11:40:06 +0200
+Subject: net/mlx5e: FPGA, fix Innova IPsec TX offload data path performance
+Patch-mainline: v5.0-rc6
+Git-commit: 82eaa1fa0448da1852d7b80832e67e80a08dcc27
+References: bsc#1103990 FATE#326006
+
+At Innova IPsec TX offload data path a special software parser metadata
+is used to pass some packet attributes to the hardware, this metadata
+is passed using the Ethernet control segment of a WQE (a HW descriptor)
+header.
+
+The cited commit might nullify this header, hence the metadata is lost,
+this caused a significant performance drop during hw offloading
+operation.
+
+Fix by restoring the metadata at the Ethernet control segment in case
+it was nullified.
+
+Fixes: 37fdffb217a4 ("net/mlx5: WQ, fixes for fragmented WQ buffers API")
+Signed-off-by: Raed Salem <raeds@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -387,8 +387,14 @@ netdev_tx_t mlx5e_sq_xmit(struct mlx5e_t
+ num_wqebbs = DIV_ROUND_UP(ds_cnt, MLX5_SEND_WQEBB_NUM_DS);
+ contig_wqebbs_room = mlx5_wq_cyc_get_contig_wqebbs(wq, pi);
+ if (unlikely(contig_wqebbs_room < num_wqebbs)) {
++#ifdef CONFIG_MLX5_EN_IPSEC
++ struct mlx5_wqe_eth_seg cur_eth = wqe->eth;
++#endif
+ mlx5e_fill_sq_frag_edge(sq, wq, pi, contig_wqebbs_room);
+ mlx5e_sq_fetch_wqe(sq, &wqe, &pi);
++#ifdef CONFIG_MLX5_EN_IPSEC
++ wqe->eth = cur_eth;
++#endif
+ }
+
+ /* fill wqe */
diff --git a/patches.drivers/qed-Add-doorbell-overflow-recovery-mechanism.patch b/patches.drivers/qed-Add-doorbell-overflow-recovery-mechanism.patch
new file mode 100644
index 0000000000..210aa206f8
--- /dev/null
+++ b/patches.drivers/qed-Add-doorbell-overflow-recovery-mechanism.patch
@@ -0,0 +1,478 @@
+From: Ariel Elior <Ariel.Elior@cavium.com>
+Date: Wed, 28 Nov 2018 18:16:02 +0200
+Subject: qed: Add doorbell overflow recovery mechanism
+Patch-mainline: v5.0-rc1
+Git-commit: 36907cd5cd720c5a6d36670b49eba3b1f7f4d8fe
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Add the database used to register doorbelling entities, and APIs for adding
+and deleting entries, and logic for traversing the database and doorbelling
+once on behalf of all entities.
+
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed.h | 17 +
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 320 ++++++++++++++++++++++++++
+ drivers/net/ethernet/qlogic/qed/qed_dev_api.h | 28 ++
+ include/linux/qed/qed_if.h | 14 +
+ 4 files changed, 379 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed.h
++++ b/drivers/net/ethernet/qlogic/qed/qed.h
+@@ -296,6 +296,12 @@ enum qed_wol_support {
+ QED_WOL_SUPPORT_PME,
+ };
+
++enum qed_db_rec_exec {
++ DB_REC_DRY_RUN,
++ DB_REC_REAL_DEAL,
++ DB_REC_ONCE,
++};
++
+ struct qed_hw_info {
+ /* PCI personality */
+ enum qed_pci_personality personality;
+@@ -425,6 +431,14 @@ struct qed_qm_info {
+ u8 num_pf_rls;
+ };
+
++struct qed_db_recovery_info {
++ struct list_head list;
++
++ /* Lock to protect the doorbell recovery mechanism list */
++ spinlock_t lock;
++ u32 db_recovery_counter;
++};
++
+ struct storm_stats {
+ u32 address;
+ u32 len;
+@@ -640,6 +654,9 @@ struct qed_hwfn {
+ /* L2-related */
+ struct qed_l2_info *p_l2_info;
+
++ /* Mechanism for recovering from doorbell drop */
++ struct qed_db_recovery_info db_recovery_info;
++
+ /* Nvm images number and attributes */
+ struct qed_nvm_image_info nvm_info;
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -66,6 +66,318 @@
+
+ static DEFINE_SPINLOCK(qm_lock);
+
++/******************** Doorbell Recovery *******************/
++/* The doorbell recovery mechanism consists of a list of entries which represent
++ * doorbelling entities (l2 queues, roce sq/rq/cqs, the slowpath spq, etc). Each
++ * entity needs to register with the mechanism and provide the parameters
++ * describing it's doorbell, including a location where last used doorbell data
++ * can be found. The doorbell execute function will traverse the list and
++ * doorbell all of the registered entries.
++ */
++struct qed_db_recovery_entry {
++ struct list_head list_entry;
++ void __iomem *db_addr;
++ void *db_data;
++ enum qed_db_rec_width db_width;
++ enum qed_db_rec_space db_space;
++ u8 hwfn_idx;
++};
++
++/* Display a single doorbell recovery entry */
++static void qed_db_recovery_dp_entry(struct qed_hwfn *p_hwfn,
++ struct qed_db_recovery_entry *db_entry,
++ char *action)
++{
++ DP_VERBOSE(p_hwfn,
++ QED_MSG_SPQ,
++ "(%s: db_entry %p, addr %p, data %p, width %s, %s space, hwfn %d)\n",
++ action,
++ db_entry,
++ db_entry->db_addr,
++ db_entry->db_data,
++ db_entry->db_width == DB_REC_WIDTH_32B ? "32b" : "64b",
++ db_entry->db_space == DB_REC_USER ? "user" : "kernel",
++ db_entry->hwfn_idx);
++}
++
++/* Doorbell address sanity (address within doorbell bar range) */
++static bool qed_db_rec_sanity(struct qed_dev *cdev,
++ void __iomem *db_addr, void *db_data)
++{
++ /* Make sure doorbell address is within the doorbell bar */
++ if (db_addr < cdev->doorbells ||
++ (u8 __iomem *)db_addr >
++ (u8 __iomem *)cdev->doorbells + cdev->db_size) {
++ WARN(true,
++ "Illegal doorbell address: %p. Legal range for doorbell addresses is [%p..%p]\n",
++ db_addr,
++ cdev->doorbells,
++ (u8 __iomem *)cdev->doorbells + cdev->db_size);
++ return false;
++ }
++
++ /* ake sure doorbell data pointer is not null */
++ if (!db_data) {
++ WARN(true, "Illegal doorbell data pointer: %p", db_data);
++ return false;
++ }
++
++ return true;
++}
++
++/* Find hwfn according to the doorbell address */
++static struct qed_hwfn *qed_db_rec_find_hwfn(struct qed_dev *cdev,
++ void __iomem *db_addr)
++{
++ struct qed_hwfn *p_hwfn;
++
++ /* In CMT doorbell bar is split down the middle between engine 0 and enigne 1 */
++ if (cdev->num_hwfns > 1)
++ p_hwfn = db_addr < cdev->hwfns[1].doorbells ?
++ &cdev->hwfns[0] : &cdev->hwfns[1];
++ else
++ p_hwfn = QED_LEADING_HWFN(cdev);
++
++ return p_hwfn;
++}
++
++/* Add a new entry to the doorbell recovery mechanism */
++int qed_db_recovery_add(struct qed_dev *cdev,
++ void __iomem *db_addr,
++ void *db_data,
++ enum qed_db_rec_width db_width,
++ enum qed_db_rec_space db_space)
++{
++ struct qed_db_recovery_entry *db_entry;
++ struct qed_hwfn *p_hwfn;
++
++ /* Shortcircuit VFs, for now */
++ if (IS_VF(cdev)) {
++ DP_VERBOSE(cdev,
++ QED_MSG_IOV, "db recovery - skipping VF doorbell\n");
++ return 0;
++ }
++
++ /* Sanitize doorbell address */
++ if (!qed_db_rec_sanity(cdev, db_addr, db_data))
++ return -EINVAL;
++
++ /* Obtain hwfn from doorbell address */
++ p_hwfn = qed_db_rec_find_hwfn(cdev, db_addr);
++
++ /* Create entry */
++ db_entry = kzalloc(sizeof(*db_entry), GFP_KERNEL);
++ if (!db_entry) {
++ DP_NOTICE(cdev, "Failed to allocate a db recovery entry\n");
++ return -ENOMEM;
++ }
++
++ /* Populate entry */
++ db_entry->db_addr = db_addr;
++ db_entry->db_data = db_data;
++ db_entry->db_width = db_width;
++ db_entry->db_space = db_space;
++ db_entry->hwfn_idx = p_hwfn->my_id;
++
++ /* Display */
++ qed_db_recovery_dp_entry(p_hwfn, db_entry, "Adding");
++
++ /* Protect the list */
++ spin_lock_bh(&p_hwfn->db_recovery_info.lock);
++ list_add_tail(&db_entry->list_entry, &p_hwfn->db_recovery_info.list);
++ spin_unlock_bh(&p_hwfn->db_recovery_info.lock);
++
++ return 0;
++}
++
++/* Remove an entry from the doorbell recovery mechanism */
++int qed_db_recovery_del(struct qed_dev *cdev,
++ void __iomem *db_addr, void *db_data)
++{
++ struct qed_db_recovery_entry *db_entry = NULL;
++ struct qed_hwfn *p_hwfn;
++ int rc = -EINVAL;
++
++ /* Shortcircuit VFs, for now */
++ if (IS_VF(cdev)) {
++ DP_VERBOSE(cdev,
++ QED_MSG_IOV, "db recovery - skipping VF doorbell\n");
++ return 0;
++ }
++
++ /* Sanitize doorbell address */
++ if (!qed_db_rec_sanity(cdev, db_addr, db_data))
++ return -EINVAL;
++
++ /* Obtain hwfn from doorbell address */
++ p_hwfn = qed_db_rec_find_hwfn(cdev, db_addr);
++
++ /* Protect the list */
++ spin_lock_bh(&p_hwfn->db_recovery_info.lock);
++ list_for_each_entry(db_entry,
++ &p_hwfn->db_recovery_info.list, list_entry) {
++ /* search according to db_data addr since db_addr is not unique (roce) */
++ if (db_entry->db_data == db_data) {
++ qed_db_recovery_dp_entry(p_hwfn, db_entry, "Deleting");
++ list_del(&db_entry->list_entry);
++ rc = 0;
++ break;
++ }
++ }
++
++ spin_unlock_bh(&p_hwfn->db_recovery_info.lock);
++
++ if (rc == -EINVAL)
++
++ DP_NOTICE(p_hwfn,
++ "Failed to find element in list. Key (db_data addr) was %p. db_addr was %p\n",
++ db_data, db_addr);
++ else
++ kfree(db_entry);
++
++ return rc;
++}
++
++/* Initialize the doorbell recovery mechanism */
++static int qed_db_recovery_setup(struct qed_hwfn *p_hwfn)
++{
++ DP_VERBOSE(p_hwfn, QED_MSG_SPQ, "Setting up db recovery\n");
++
++ /* Make sure db_size was set in cdev */
++ if (!p_hwfn->cdev->db_size) {
++ DP_ERR(p_hwfn->cdev, "db_size not set\n");
++ return -EINVAL;
++ }
++
++ INIT_LIST_HEAD(&p_hwfn->db_recovery_info.list);
++ spin_lock_init(&p_hwfn->db_recovery_info.lock);
++ p_hwfn->db_recovery_info.db_recovery_counter = 0;
++
++ return 0;
++}
++
++/* Destroy the doorbell recovery mechanism */
++static void qed_db_recovery_teardown(struct qed_hwfn *p_hwfn)
++{
++ struct qed_db_recovery_entry *db_entry = NULL;
++
++ DP_VERBOSE(p_hwfn, QED_MSG_SPQ, "Tearing down db recovery\n");
++ if (!list_empty(&p_hwfn->db_recovery_info.list)) {
++ DP_VERBOSE(p_hwfn,
++ QED_MSG_SPQ,
++ "Doorbell Recovery teardown found the doorbell recovery list was not empty (Expected in disorderly driver unload (e.g. recovery) otherwise this probably means some flow forgot to db_recovery_del). Prepare to purge doorbell recovery list...\n");
++ while (!list_empty(&p_hwfn->db_recovery_info.list)) {
++ db_entry =
++ list_first_entry(&p_hwfn->db_recovery_info.list,
++ struct qed_db_recovery_entry,
++ list_entry);
++ qed_db_recovery_dp_entry(p_hwfn, db_entry, "Purging");
++ list_del(&db_entry->list_entry);
++ kfree(db_entry);
++ }
++ }
++ p_hwfn->db_recovery_info.db_recovery_counter = 0;
++}
++
++/* Print the content of the doorbell recovery mechanism */
++void qed_db_recovery_dp(struct qed_hwfn *p_hwfn)
++{
++ struct qed_db_recovery_entry *db_entry = NULL;
++
++ DP_NOTICE(p_hwfn,
++ "Dispalying doorbell recovery database. Counter was %d\n",
++ p_hwfn->db_recovery_info.db_recovery_counter);
++
++ /* Protect the list */
++ spin_lock_bh(&p_hwfn->db_recovery_info.lock);
++ list_for_each_entry(db_entry,
++ &p_hwfn->db_recovery_info.list, list_entry) {
++ qed_db_recovery_dp_entry(p_hwfn, db_entry, "Printing");
++ }
++
++ spin_unlock_bh(&p_hwfn->db_recovery_info.lock);
++}
++
++/* Ring the doorbell of a single doorbell recovery entry */
++static void qed_db_recovery_ring(struct qed_hwfn *p_hwfn,
++ struct qed_db_recovery_entry *db_entry,
++ enum qed_db_rec_exec db_exec)
++{
++ if (db_exec != DB_REC_ONCE) {
++ /* Print according to width */
++ if (db_entry->db_width == DB_REC_WIDTH_32B) {
++ DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
++ "%s doorbell address %p data %x\n",
++ db_exec == DB_REC_DRY_RUN ?
++ "would have rung" : "ringing",
++ db_entry->db_addr,
++ *(u32 *)db_entry->db_data);
++ } else {
++ DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
++ "%s doorbell address %p data %llx\n",
++ db_exec == DB_REC_DRY_RUN ?
++ "would have rung" : "ringing",
++ db_entry->db_addr,
++ *(u64 *)(db_entry->db_data));
++ }
++ }
++
++ /* Sanity */
++ if (!qed_db_rec_sanity(p_hwfn->cdev, db_entry->db_addr,
++ db_entry->db_data))
++ return;
++
++ /* Flush the write combined buffer. Since there are multiple doorbelling
++ * entities using the same address, if we don't flush, a transaction
++ * could be lost.
++ */
++ wmb();
++
++ /* Ring the doorbell */
++ if (db_exec == DB_REC_REAL_DEAL || db_exec == DB_REC_ONCE) {
++ if (db_entry->db_width == DB_REC_WIDTH_32B)
++ DIRECT_REG_WR(db_entry->db_addr,
++ *(u32 *)(db_entry->db_data));
++ else
++ DIRECT_REG_WR64(db_entry->db_addr,
++ *(u64 *)(db_entry->db_data));
++ }
++
++ /* Flush the write combined buffer. Next doorbell may come from a
++ * different entity to the same address...
++ */
++ wmb();
++}
++
++/* Traverse the doorbell recovery entry list and ring all the doorbells */
++void qed_db_recovery_execute(struct qed_hwfn *p_hwfn,
++ enum qed_db_rec_exec db_exec)
++{
++ struct qed_db_recovery_entry *db_entry = NULL;
++
++ if (db_exec != DB_REC_ONCE) {
++ DP_NOTICE(p_hwfn,
++ "Executing doorbell recovery. Counter was %d\n",
++ p_hwfn->db_recovery_info.db_recovery_counter);
++
++ /* Track amount of times recovery was executed */
++ p_hwfn->db_recovery_info.db_recovery_counter++;
++ }
++
++ /* Protect the list */
++ spin_lock_bh(&p_hwfn->db_recovery_info.lock);
++ list_for_each_entry(db_entry,
++ &p_hwfn->db_recovery_info.list, list_entry) {
++ qed_db_recovery_ring(p_hwfn, db_entry, db_exec);
++ if (db_exec == DB_REC_ONCE)
++ break;
++ }
++
++ spin_unlock_bh(&p_hwfn->db_recovery_info.lock);
++}
++
++/******************** Doorbell Recovery end ****************/
++
+ #define QED_MIN_DPIS (4)
+ #define QED_MIN_PWM_REGION (QED_WID_SIZE * QED_MIN_DPIS)
+
+@@ -194,6 +506,9 @@ void qed_resc_free(struct qed_dev *cdev)
+ qed_dmae_info_free(p_hwfn);
+ qed_dcbx_info_free(p_hwfn);
+ qed_dbg_user_data_free(p_hwfn);
++
++ /* Destroy doorbell recovery mechanism */
++ qed_db_recovery_teardown(p_hwfn);
+ }
+ }
+
+@@ -969,6 +1284,11 @@ int qed_resc_alloc(struct qed_dev *cdev)
+ struct qed_hwfn *p_hwfn = &cdev->hwfns[i];
+ u32 n_eqes, num_cons;
+
++ /* Initialize the doorbell recovery mechanism */
++ rc = qed_db_recovery_setup(p_hwfn);
++ if (rc)
++ goto alloc_err;
++
+ /* First allocate the context manager structure */
+ rc = qed_cxt_mngr_alloc(p_hwfn);
+ if (rc)
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev_api.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev_api.h
+@@ -472,6 +472,34 @@ int qed_get_queue_coalesce(struct qed_hw
+ int
+ qed_set_queue_coalesce(u16 rx_coal, u16 tx_coal, void *p_handle);
+
++/**
++ * @brief db_recovery_add - add doorbell information to the doorbell
++ * recovery mechanism.
++ *
++ * @param cdev
++ * @param db_addr - doorbell address
++ * @param db_data - address of where db_data is stored
++ * @param db_width - doorbell is 32b pr 64b
++ * @param db_space - doorbell recovery addresses are user or kernel space
++ */
++int qed_db_recovery_add(struct qed_dev *cdev,
++ void __iomem *db_addr,
++ void *db_data,
++ enum qed_db_rec_width db_width,
++ enum qed_db_rec_space db_space);
++
++/**
++ * @brief db_recovery_del - remove doorbell information from the doorbell
++ * recovery mechanism. db_data serves as key (db_addr is not unique).
++ *
++ * @param cdev
++ * @param db_addr - doorbell address
++ * @param db_data - address where db_data is stored. Serves as key for the
++ * entry to delete.
++ */
++int qed_db_recovery_del(struct qed_dev *cdev,
++ void __iomem *db_addr, void *db_data);
++
+
+ const char *qed_hw_get_resc_name(enum qed_resources res_id);
+ #endif
+--- a/include/linux/qed/qed_if.h
++++ b/include/linux/qed/qed_if.h
+@@ -47,6 +47,7 @@
+ #include <linux/slab.h>
+ #include <linux/qed/common_hsi.h>
+ #include <linux/qed/qed_chain.h>
++#include <linux/io-64-nonatomic-lo-hi.h>
+
+ enum dcbx_protocol_type {
+ DCBX_PROTOCOL_ISCSI,
+@@ -448,11 +449,24 @@ struct qed_mfw_tlv_iscsi {
+ bool tx_bytes_set;
+ };
+
++enum qed_db_rec_width {
++ DB_REC_WIDTH_32B,
++ DB_REC_WIDTH_64B,
++};
++
++enum qed_db_rec_space {
++ DB_REC_KERNEL,
++ DB_REC_USER,
++};
++
+ #define DIRECT_REG_WR(reg_addr, val) writel((u32)val, \
+ (void __iomem *)(reg_addr))
+
+ #define DIRECT_REG_RD(reg_addr) readl((void __iomem *)(reg_addr))
+
++#define DIRECT_REG_WR64(reg_addr, val) writeq((u32)val, \
++ (void __iomem *)(reg_addr))
++
+ #define QED_COALESCE_MAX 0x1FF
+ #define QED_DEFAULT_RX_USECS 12
+ #define QED_DEFAULT_TX_USECS 48
diff --git a/patches.drivers/qed-Add-support-for-MBI-upgrade-over-MFW.patch b/patches.drivers/qed-Add-support-for-MBI-upgrade-over-MFW.patch
new file mode 100644
index 0000000000..90d9b98c91
--- /dev/null
+++ b/patches.drivers/qed-Add-support-for-MBI-upgrade-over-MFW.patch
@@ -0,0 +1,173 @@
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 26 Nov 2018 02:27:00 -0800
+Subject: qed: Add support for MBI upgrade over MFW.
+Patch-mainline: v5.0-rc1
+Git-commit: 057d2b192be89df4c78fc8eb5d344d362d75e3c5
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+The patch adds driver support for MBI image update through MFW.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_hsi.h | 6 +++
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 13 +++++++-
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 45 ++++++++++++++---------------
+ drivers/net/ethernet/qlogic/qed/qed_mcp.h | 10 ------
+ 4 files changed, 40 insertions(+), 34 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_hsi.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_hsi.h
+@@ -12655,6 +12655,7 @@ struct public_drv_mb {
+ #define DRV_MB_PARAM_DCBX_NOTIFY_MASK 0x000000FF
+ #define DRV_MB_PARAM_DCBX_NOTIFY_SHIFT 3
+
++#define DRV_MB_PARAM_NVM_PUT_FILE_BEGIN_MBI 0x3
+ #define DRV_MB_PARAM_NVM_LEN_OFFSET 24
+
+ #define DRV_MB_PARAM_CFG_VF_MSIX_VF_ID_SHIFT 0
+@@ -12814,6 +12815,11 @@ struct public_drv_mb {
+ union drv_union_data union_data;
+ };
+
++#define FW_MB_PARAM_NVM_PUT_FILE_REQ_OFFSET_MASK 0x00ffffff
++#define FW_MB_PARAM_NVM_PUT_FILE_REQ_OFFSET_SHIFT 0
++#define FW_MB_PARAM_NVM_PUT_FILE_REQ_SIZE_MASK 0xff000000
++#define FW_MB_PARAM_NVM_PUT_FILE_REQ_SIZE_SHIFT 24
++
+ enum MFW_DRV_MSG_TYPE {
+ MFW_DRV_MSG_LINK_CHANGE,
+ MFW_DRV_MSG_FLR_FW_ACK_FAILED,
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -1939,21 +1939,30 @@ exit:
+ * 0B | 0x3 [command index] |
+ * 4B | b'0: check_response? | b'1-31 reserved |
+ * 8B | File-type | reserved |
++ * 12B | Image length in bytes |
+ * \----------------------------------------------------------------------/
+ * Start a new file of the provided type
+ */
+ static int qed_nvm_flash_image_file_start(struct qed_dev *cdev,
+ const u8 **data, bool *check_resp)
+ {
++ u32 file_type, file_size = 0;
+ int rc;
+
+ *data += 4;
+ *check_resp = !!(**data & BIT(0));
+ *data += 4;
++ file_type = **data;
+
+ DP_VERBOSE(cdev, NETIF_MSG_DRV,
+- "About to start a new file of type %02x\n", **data);
+- rc = qed_mcp_nvm_put_file_begin(cdev, **data);
++ "About to start a new file of type %02x\n", file_type);
++ if (file_type == DRV_MB_PARAM_NVM_PUT_FILE_BEGIN_MBI) {
++ *data += 4;
++ file_size = *((u32 *)(*data));
++ }
++
++ rc = qed_mcp_nvm_write(cdev, QED_PUT_FILE_BEGIN, file_type,
++ (u8 *)(&file_size), 4);
+ *data += 4;
+
+ return rc;
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -2745,24 +2745,6 @@ int qed_mcp_nvm_resp(struct qed_dev *cde
+ return 0;
+ }
+
+-int qed_mcp_nvm_put_file_begin(struct qed_dev *cdev, u32 addr)
+-{
+- struct qed_hwfn *p_hwfn = QED_LEADING_HWFN(cdev);
+- struct qed_ptt *p_ptt;
+- u32 resp, param;
+- int rc;
+-
+- p_ptt = qed_ptt_acquire(p_hwfn);
+- if (!p_ptt)
+- return -EBUSY;
+- rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_NVM_PUT_FILE_BEGIN, addr,
+- &resp, &param);
+- cdev->mcp_nvm_resp = resp;
+- qed_ptt_release(p_hwfn, p_ptt);
+-
+- return rc;
+-}
+-
+ int qed_mcp_nvm_write(struct qed_dev *cdev,
+ u32 cmd, u32 addr, u8 *p_buf, u32 len)
+ {
+@@ -2776,6 +2758,9 @@ int qed_mcp_nvm_write(struct qed_dev *cd
+ return -EBUSY;
+
+ switch (cmd) {
++ case QED_PUT_FILE_BEGIN:
++ nvm_cmd = DRV_MSG_CODE_NVM_PUT_FILE_BEGIN;
++ break;
+ case QED_PUT_FILE_DATA:
+ nvm_cmd = DRV_MSG_CODE_NVM_PUT_FILE_DATA;
+ break;
+@@ -2788,10 +2773,14 @@ int qed_mcp_nvm_write(struct qed_dev *cd
+ goto out;
+ }
+
++ buf_size = min_t(u32, (len - buf_idx), MCP_DRV_NVM_BUF_LEN);
+ while (buf_idx < len) {
+- buf_size = min_t(u32, (len - buf_idx), MCP_DRV_NVM_BUF_LEN);
+- nvm_offset = ((buf_size << DRV_MB_PARAM_NVM_LEN_OFFSET) |
+- addr) + buf_idx;
++ if (cmd == QED_PUT_FILE_BEGIN)
++ nvm_offset = addr;
++ else
++ nvm_offset = ((buf_size <<
++ DRV_MB_PARAM_NVM_LEN_OFFSET) | addr) +
++ buf_idx;
+ rc = qed_mcp_nvm_wr_cmd(p_hwfn, p_ptt, nvm_cmd, nvm_offset,
+ &resp, &param, buf_size,
+ (u32 *)&p_buf[buf_idx]);
+@@ -2816,7 +2805,19 @@ int qed_mcp_nvm_write(struct qed_dev *cd
+ if (buf_idx % 0x1000 > (buf_idx + buf_size) % 0x1000)
+ usleep_range(1000, 2000);
+
+- buf_idx += buf_size;
++ /* For MBI upgrade, MFW response includes the next buffer offset
++ * to be delivered to MFW.
++ */
++ if (param && cmd == QED_PUT_FILE_DATA) {
++ buf_idx = QED_MFW_GET_FIELD(param,
++ FW_MB_PARAM_NVM_PUT_FILE_REQ_OFFSET);
++ buf_size = QED_MFW_GET_FIELD(param,
++ FW_MB_PARAM_NVM_PUT_FILE_REQ_SIZE);
++ } else {
++ buf_idx += buf_size;
++ buf_size = min_t(u32, (len - buf_idx),
++ MCP_DRV_NVM_BUF_LEN);
++ }
+ }
+
+ cdev->mcp_nvm_resp = resp;
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.h
+@@ -543,16 +543,6 @@ int qed_mcp_nvm_write(struct qed_dev *cd
+ u32 cmd, u32 addr, u8 *p_buf, u32 len);
+
+ /**
+- * @brief Put file begin
+- *
+- * @param cdev
+- * @param addr - nvm offset
+- *
+- * @return int - 0 - operation was successful.
+- */
+-int qed_mcp_nvm_put_file_begin(struct qed_dev *cdev, u32 addr);
+-
+-/**
+ * @brief Check latest response
+ *
+ * @param cdev
diff --git a/patches.drivers/qed-Advance-drivers-version-to-8.37.0.20.patch b/patches.drivers/qed-Advance-drivers-version-to-8.37.0.20.patch
new file mode 100644
index 0000000000..65e39c6a1d
--- /dev/null
+++ b/patches.drivers/qed-Advance-drivers-version-to-8.37.0.20.patch
@@ -0,0 +1,40 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Wed, 6 Feb 2019 14:43:47 -0800
+Subject: qed*: Advance drivers version to 8.37.0.20
+Patch-mainline: v5.0-rc6
+Git-commit: 42dbcd6b25cd6fe8b47cf838f5da8178d1cd926c
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Version update for qed/qede modules.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed.h | 2 +-
+ drivers/net/ethernet/qlogic/qede/qede.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed.h
++++ b/drivers/net/ethernet/qlogic/qed/qed.h
+@@ -53,7 +53,7 @@
+ extern const struct qed_common_ops qed_common_ops_pass;
+
+ #define QED_MAJOR_VERSION 8
+-#define QED_MINOR_VERSION 33
++#define QED_MINOR_VERSION 37
+ #define QED_REVISION_VERSION 0
+ #define QED_ENGINEERING_VERSION 20
+
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -56,7 +56,7 @@
+ #include <net/tc_act/tc_gact.h>
+
+ #define QEDE_MAJOR_VERSION 8
+-#define QEDE_MINOR_VERSION 33
++#define QEDE_MINOR_VERSION 37
+ #define QEDE_REVISION_VERSION 0
+ #define QEDE_ENGINEERING_VERSION 20
+ #define DRV_MODULE_VERSION __stringify(QEDE_MAJOR_VERSION) "." \
diff --git a/patches.drivers/qed-Assign-UFP-TC-value-to-vlan-priority-in-UFP-mode.patch b/patches.drivers/qed-Assign-UFP-TC-value-to-vlan-priority-in-UFP-mode.patch
new file mode 100644
index 0000000000..a56820cf10
--- /dev/null
+++ b/patches.drivers/qed-Assign-UFP-TC-value-to-vlan-priority-in-UFP-mode.patch
@@ -0,0 +1,31 @@
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Date: Wed, 6 Feb 2019 14:43:43 -0800
+Subject: qed: Assign UFP TC value to vlan priority in UFP mode.
+Patch-mainline: v5.0-rc6
+Git-commit: ebd873a31cae778c2379959ab382b34ba3b73549
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+In the case of Unified Fabric Port (UFP) mode, switch provides
+the traffic class (TC) value to be used for the traffic.
+Configure hardware to use this TC value for vlan priority.
+
+Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_sp_commands.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c
+@@ -604,6 +604,9 @@ int qed_sp_pf_update_stag(struct qed_hwf
+
+ p_ent->ramrod.pf_update.update_mf_vlan_flag = true;
+ p_ent->ramrod.pf_update.mf_vlan = cpu_to_le16(p_hwfn->hw_info.ovlan);
++ if (test_bit(QED_MF_UFP_SPECIFIC, &p_hwfn->cdev->mf_bits))
++ p_ent->ramrod.pf_update.mf_vlan |=
++ cpu_to_le16(((u16)p_hwfn->ufp_info.tc << 13));
+
+ return qed_spq_post(p_hwfn, p_ent, NULL);
+ }
diff --git a/patches.drivers/qed-Change-verbosity-for-coalescing-message.patch b/patches.drivers/qed-Change-verbosity-for-coalescing-message.patch
new file mode 100644
index 0000000000..9f753bff3b
--- /dev/null
+++ b/patches.drivers/qed-Change-verbosity-for-coalescing-message.patch
@@ -0,0 +1,33 @@
+From: Rahul Verma <rverma@marvell.com>
+Date: Wed, 6 Feb 2019 14:43:46 -0800
+Subject: qed: Change verbosity for coalescing message.
+Patch-mainline: v5.0-rc6
+Git-commit: 8c8502532f0064d0f04335bfe0f80d9431866a73
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Fix unnecessary logging of message in an expected
+default case where coalescing value read (via ethtool -c)
+migh not be valid unless they are configured explicitly
+in the hardware using ethtool -C.
+
+Signed-off-by: Rahul Verma <rverma@marvell.com>
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -2871,7 +2871,8 @@ static int qed_get_coalesce(struct qed_d
+ p_hwfn = p_cid->p_owner;
+ rc = qed_get_queue_coalesce(p_hwfn, coal, handle);
+ if (rc)
+- DP_NOTICE(p_hwfn, "Unable to read queue coalescing\n");
++ DP_VERBOSE(cdev, QED_MSG_DEBUG,
++ "Unable to read queue coalescing\n");
+
+ return rc;
+ }
diff --git a/patches.drivers/qed-Consider-TX-tcs-while-deriving-the-max-num_queue.patch b/patches.drivers/qed-Consider-TX-tcs-while-deriving-the-max-num_queue.patch
new file mode 100644
index 0000000000..a35948e11d
--- /dev/null
+++ b/patches.drivers/qed-Consider-TX-tcs-while-deriving-the-max-num_queue.patch
@@ -0,0 +1,39 @@
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Date: Wed, 6 Feb 2019 14:43:44 -0800
+Subject: qed: Consider TX tcs while deriving the max num_queues for PF.
+Patch-mainline: v5.0-rc6
+Git-commit: fb1faab74ddef9ec2d841d54e5d0912a097b3abe
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Max supported queues is derived incorrectly in the case of multi-CoS.
+Need to consider TCs while calculating num_queues for PF.
+
+Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -2216,7 +2216,7 @@ static int qed_fill_eth_dev_info(struct
+ u16 num_queues = 0;
+
+ /* Since the feature controls only queue-zones,
+- * make sure we have the contexts [rx, tx, xdp] to
++ * make sure we have the contexts [rx, xdp, tcs] to
+ * match.
+ */
+ for_each_hwfn(cdev, i) {
+@@ -2226,7 +2226,8 @@ static int qed_fill_eth_dev_info(struct
+ u16 cids;
+
+ cids = hwfn->pf_params.eth_pf_params.num_cons;
+- num_queues += min_t(u16, l2_queues, cids / 3);
++ cids /= (2 + info->num_tc);
++ num_queues += min_t(u16, l2_queues, cids);
+ }
+
+ /* queues might theoretically be >256, but interrupts'
diff --git a/patches.drivers/qed-Display-port_id-in-the-UFP-debug-messages.patch b/patches.drivers/qed-Display-port_id-in-the-UFP-debug-messages.patch
new file mode 100644
index 0000000000..c837f98d53
--- /dev/null
+++ b/patches.drivers/qed-Display-port_id-in-the-UFP-debug-messages.patch
@@ -0,0 +1,76 @@
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 26 Nov 2018 02:26:57 -0800
+Subject: qed: Display port_id in the UFP debug messages.
+Patch-mainline: v5.0-rc1
+Git-commit: ec036eb92e34298871c45ae6469cd8f7bb56c30e
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+MFW sends UFP notifications mostly during the device init phase and PFs
+might not be assigned with a name by this time. Hence capturing port-id in
+the debug messages would help in finding which PF the ufp notification was
+sent to.
+
+Also, fixed a minor scemantic issue in a debug print.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_mcp.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -1619,7 +1619,7 @@ static void qed_mcp_update_stag(struct q
+ qed_sp_pf_update_stag(p_hwfn);
+ }
+
+- DP_VERBOSE(p_hwfn, QED_MSG_SP, "ovlan = %d hw_mode = 0x%x\n",
++ DP_VERBOSE(p_hwfn, QED_MSG_SP, "ovlan = %d hw_mode = 0x%x\n",
+ p_hwfn->mcp_info->func_info.ovlan, p_hwfn->hw_info.hw_mode);
+
+ /* Acknowledge the MFW */
+@@ -1641,7 +1641,9 @@ void qed_mcp_read_ufp_config(struct qed_
+ val = (port_cfg & OEM_CFG_CHANNEL_TYPE_MASK) >>
+ OEM_CFG_CHANNEL_TYPE_OFFSET;
+ if (val != OEM_CFG_CHANNEL_TYPE_STAGGED)
+- DP_NOTICE(p_hwfn, "Incorrect UFP Channel type %d\n", val);
++ DP_NOTICE(p_hwfn,
++ "Incorrect UFP Channel type %d port_id 0x%02x\n",
++ val, MFW_PORT(p_hwfn));
+
+ val = (port_cfg & OEM_CFG_SCHED_TYPE_MASK) >> OEM_CFG_SCHED_TYPE_OFFSET;
+ if (val == OEM_CFG_SCHED_TYPE_ETS) {
+@@ -1650,7 +1652,9 @@ void qed_mcp_read_ufp_config(struct qed_
+ p_hwfn->ufp_info.mode = QED_UFP_MODE_VNIC_BW;
+ } else {
+ p_hwfn->ufp_info.mode = QED_UFP_MODE_UNKNOWN;
+- DP_NOTICE(p_hwfn, "Unknown UFP scheduling mode %d\n", val);
++ DP_NOTICE(p_hwfn,
++ "Unknown UFP scheduling mode %d port_id 0x%02x\n",
++ val, MFW_PORT(p_hwfn));
+ }
+
+ qed_mcp_get_shmem_func(p_hwfn, p_ptt, &shmem_info, MCP_PF_ID(p_hwfn));
+@@ -1665,13 +1669,15 @@ void qed_mcp_read_ufp_config(struct qed_
+ p_hwfn->ufp_info.pri_type = QED_UFP_PRI_OS;
+ } else {
+ p_hwfn->ufp_info.pri_type = QED_UFP_PRI_UNKNOWN;
+- DP_NOTICE(p_hwfn, "Unknown Host priority control %d\n", val);
++ DP_NOTICE(p_hwfn,
++ "Unknown Host priority control %d port_id 0x%02x\n",
++ val, MFW_PORT(p_hwfn));
+ }
+
+ DP_NOTICE(p_hwfn,
+- "UFP shmem config: mode = %d tc = %d pri_type = %d\n",
+- p_hwfn->ufp_info.mode,
+- p_hwfn->ufp_info.tc, p_hwfn->ufp_info.pri_type);
++ "UFP shmem config: mode = %d tc = %d pri_type = %d port_id 0x%02x\n",
++ p_hwfn->ufp_info.mode, p_hwfn->ufp_info.tc,
++ p_hwfn->ufp_info.pri_type, MFW_PORT(p_hwfn));
+ }
+
+ static int
diff --git a/patches.drivers/qed-Expose-the-doorbell-overflow-recovery-mechanism-.patch b/patches.drivers/qed-Expose-the-doorbell-overflow-recovery-mechanism-.patch
new file mode 100644
index 0000000000..864a9eff34
--- /dev/null
+++ b/patches.drivers/qed-Expose-the-doorbell-overflow-recovery-mechanism-.patch
@@ -0,0 +1,69 @@
+From: Ariel Elior <Ariel.Elior@cavium.com>
+Date: Wed, 28 Nov 2018 18:16:06 +0200
+Subject: qed: Expose the doorbell overflow recovery mechanism to the protocol
+ drivers
+Patch-mainline: v5.0-rc1
+Git-commit: 0e1f10447e2aa79ba7d8960e5d0ed3cf2ea8356e
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Most of the doorbelling entities are outside of the core module.
+L2 queues, Roce queues, iscsi and fcoe all need to register.
+Make the APIs available for these drivers.
+
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 2 ++
+ include/linux/qed/qed_if.h | 27 +++++++++++++++++++++++++++
+ 2 files changed, 29 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -2384,6 +2384,8 @@ const struct qed_common_ops qed_common_o
+ .update_mac = &qed_update_mac,
+ .update_mtu = &qed_update_mtu,
+ .update_wol = &qed_update_wol,
++ .db_recovery_add = &qed_db_recovery_add,
++ .db_recovery_del = &qed_db_recovery_del,
+ .read_module_eeprom = &qed_read_module_eeprom,
+ };
+
+--- a/include/linux/qed/qed_if.h
++++ b/include/linux/qed/qed_if.h
+@@ -1029,6 +1029,33 @@ struct qed_common_ops {
+ */
+ int (*set_led)(struct qed_dev *cdev,
+ enum qed_led_mode mode);
++/**
++ * @brief db_recovery_add - add doorbell information to the doorbell
++ * recovery mechanism.
++ *
++ * @param cdev
++ * @param db_addr - doorbell address
++ * @param db_data - address of where db_data is stored
++ * @param db_is_32b - doorbell is 32b pr 64b
++ * @param db_is_user - doorbell recovery addresses are user or kernel space
++ */
++ int (*db_recovery_add)(struct qed_dev *cdev,
++ void __iomem *db_addr,
++ void *db_data,
++ enum qed_db_rec_width db_width,
++ enum qed_db_rec_space db_space);
++
++/**
++ * @brief db_recovery_del - remove doorbell information from the doorbell
++ * recovery mechanism. db_data serves as key (db_addr is not unique).
++ *
++ * @param cdev
++ * @param db_addr - doorbell address
++ * @param db_data - address where db_data is stored. Serves as key for the
++ * entry to delete.
++ */
++ int (*db_recovery_del)(struct qed_dev *cdev,
++ void __iomem *db_addr, void *db_data);
+
+ /**
+ * @brief update_drv_state - API to inform the change in the driver state.
diff --git a/patches.drivers/qed-Fix-EQ-full-firmware-assert.patch b/patches.drivers/qed-Fix-EQ-full-firmware-assert.patch
new file mode 100644
index 0000000000..6d6e3bacc0
--- /dev/null
+++ b/patches.drivers/qed-Fix-EQ-full-firmware-assert.patch
@@ -0,0 +1,77 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Wed, 6 Feb 2019 14:43:42 -0800
+Subject: qed: Fix EQ full firmware assert.
+Patch-mainline: v5.0-rc6
+Git-commit: 660492bcf4a7561b5fdc13be0ae0b0c0a8c120be
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+When slowpath messages are sent with high rate, the resulting
+events can lead to a FW assert in case they are not handled fast
+enough (Event Queue Full assert). Attempt to send queued slowpath
+messages only after the newly evacuated entries in the EQ ring
+are indicated to FW.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_sp.h | 1 +
+ drivers/net/ethernet/qlogic/qed/qed_spq.c | 15 +++++++--------
+ 2 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -382,6 +382,7 @@ void qed_consq_setup(struct qed_hwfn *p_
+ * @param p_hwfn
+ */
+ void qed_consq_free(struct qed_hwfn *p_hwfn);
++int qed_spq_pend_post(struct qed_hwfn *p_hwfn);
+
+ /**
+ * @file
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -397,6 +397,11 @@ int qed_eq_completion(struct qed_hwfn *p
+
+ qed_eq_prod_update(p_hwfn, qed_chain_get_prod_idx(p_chain));
+
++ /* Attempt to post pending requests */
++ spin_lock_bh(&p_hwfn->p_spq->lock);
++ rc = qed_spq_pend_post(p_hwfn);
++ spin_unlock_bh(&p_hwfn->p_spq->lock);
++
+ return rc;
+ }
+
+@@ -767,7 +772,7 @@ static int qed_spq_post_list(struct qed_
+ return 0;
+ }
+
+-static int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
++int qed_spq_pend_post(struct qed_hwfn *p_hwfn)
+ {
+ struct qed_spq *p_spq = p_hwfn->p_spq;
+ struct qed_spq_entry *p_ent = NULL;
+@@ -905,7 +910,6 @@ int qed_spq_completion(struct qed_hwfn *
+ struct qed_spq_entry *p_ent = NULL;
+ struct qed_spq_entry *tmp;
+ struct qed_spq_entry *found = NULL;
+- int rc;
+
+ if (!p_hwfn)
+ return -EINVAL;
+@@ -963,12 +967,7 @@ int qed_spq_completion(struct qed_hwfn *
+ */
+ qed_spq_return_entry(p_hwfn, found);
+
+- /* Attempt to post pending requests */
+- spin_lock_bh(&p_spq->lock);
+- rc = qed_spq_pend_post(p_hwfn);
+- spin_unlock_bh(&p_spq->lock);
+-
+- return rc;
++ return 0;
+ }
+
+ int qed_consq_alloc(struct qed_hwfn *p_hwfn)
diff --git a/patches.drivers/qed-Fix-LACP-pdu-drops-for-VFs.patch b/patches.drivers/qed-Fix-LACP-pdu-drops-for-VFs.patch
new file mode 100644
index 0000000000..c40ac57172
--- /dev/null
+++ b/patches.drivers/qed-Fix-LACP-pdu-drops-for-VFs.patch
@@ -0,0 +1,85 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 28 Jan 2019 10:05:05 -0800
+Subject: qed: Fix LACP pdu drops for VFs
+Patch-mainline: v5.0-rc5
+Git-commit: ff9296966e5e00b0d0d00477b2365a178f0f06a3
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+VF is always configured to drop control frames
+(with reserved mac addresses) but to work LACP
+on the VFs, it would require LACP control frames
+to be forwarded or transmitted successfully.
+
+This patch fixes this in such a way that trusted VFs
+(marked through ndo_set_vf_trust) would be allowed to
+pass the control frames such as LACP pdus.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 5 +++++
+ drivers/net/ethernet/qlogic/qed/qed_l2.h | 3 +++
+ drivers/net/ethernet/qlogic/qed/qed_sriov.c | 10 ++++++++--
+ 3 files changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -748,6 +748,11 @@ int qed_sp_vport_update(struct qed_hwfn
+ return rc;
+ }
+
++ if (p_params->update_ctl_frame_check) {
++ p_cmn->ctl_frame_mac_check_en = p_params->mac_chk_en;
++ p_cmn->ctl_frame_ethtype_check_en = p_params->ethtype_chk_en;
++ }
++
+ /* Update mcast bins for VFs, PF doesn't use this functionality */
+ qed_sp_update_mcast_bin(p_hwfn, p_ramrod, p_params);
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.h
+@@ -219,6 +219,9 @@ struct qed_sp_vport_update_params {
+ struct qed_rss_params *rss_params;
+ struct qed_filter_accept_flags accept_flags;
+ struct qed_sge_tpa_params *sge_tpa_params;
++ u8 update_ctl_frame_check;
++ u8 mac_chk_en;
++ u8 ethtype_chk_en;
+ };
+
+ int qed_sp_vport_update(struct qed_hwfn *p_hwfn,
+--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c
+@@ -1969,7 +1969,9 @@ static void qed_iov_vf_mbx_start_vport(s
+ params.vport_id = vf->vport_id;
+ params.max_buffers_per_cqe = start->max_buffers_per_cqe;
+ params.mtu = vf->mtu;
+- params.check_mac = true;
++
++ /* Non trusted VFs should enable control frame filtering */
++ params.check_mac = !vf->p_vf_info.is_trusted_configured;
+
+ rc = qed_sp_eth_vport_start(p_hwfn, &params);
+ if (rc) {
+@@ -5130,6 +5132,9 @@ static void qed_iov_handle_trust_change(
+ params.opaque_fid = vf->opaque_fid;
+ params.vport_id = vf->vport_id;
+
++ params.update_ctl_frame_check = 1;
++ params.mac_chk_en = !vf_info->is_trusted_configured;
++
+ if (vf_info->rx_accept_mode & mask) {
+ flags->update_rx_mode_config = 1;
+ flags->rx_accept_filter = vf_info->rx_accept_mode;
+@@ -5147,7 +5152,8 @@ static void qed_iov_handle_trust_change(
+ }
+
+ if (flags->update_rx_mode_config ||
+- flags->update_tx_mode_config)
++ flags->update_tx_mode_config ||
++ params.update_ctl_frame_check)
+ qed_sp_vport_update(hwfn, &params,
+ QED_SPQ_MODE_EBLOCK, NULL);
+ }
diff --git a/patches.drivers/qed-Fix-VF-probe-failure-while-FLR.patch b/patches.drivers/qed-Fix-VF-probe-failure-while-FLR.patch
new file mode 100644
index 0000000000..ef967880ca
--- /dev/null
+++ b/patches.drivers/qed-Fix-VF-probe-failure-while-FLR.patch
@@ -0,0 +1,52 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 28 Jan 2019 10:05:06 -0800
+Subject: qed: Fix VF probe failure while FLR
+Patch-mainline: v5.0-rc5
+Git-commit: 327852ec64205bb651be391a069784872098a3b2
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+VFs may hit VF-PF channel timeout while probing, as in some
+cases it was observed that VF FLR and VF "acquire" message
+transaction (i.e first message from VF to PF in VF's probe flow)
+could occur simultaneously which could lead VF to fail sending
+"acquire" message to PF as VF is marked disabled from HW perspective
+due to FLR, which will result into channel timeout and VF probe failure.
+
+In such cases, try retrying VF "acquire" message so that in later
+attempts it could be successful to pass message to PF after the VF
+FLR is completed and can be probed successfully.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_vf.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_vf.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_vf.c
+@@ -261,6 +261,7 @@ static int qed_vf_pf_acquire(struct qed_
+ struct pfvf_acquire_resp_tlv *resp = &p_iov->pf2vf_reply->acquire_resp;
+ struct pf_vf_pfdev_info *pfdev_info = &resp->pfdev_info;
+ struct vf_pf_resc_request *p_resc;
++ u8 retry_cnt = VF_ACQUIRE_THRESH;
+ bool resources_acquired = false;
+ struct vfpf_acquire_tlv *req;
+ int rc = 0, attempts = 0;
+@@ -314,6 +315,15 @@ static int qed_vf_pf_acquire(struct qed_
+
+ /* send acquire request */
+ rc = qed_send_msg2pf(p_hwfn, &resp->hdr.status, sizeof(*resp));
++
++ /* Re-try acquire in case of vf-pf hw channel timeout */
++ if (retry_cnt && rc == -EBUSY) {
++ DP_VERBOSE(p_hwfn, QED_MSG_IOV,
++ "VF retrying to acquire due to VPC timeout\n");
++ retry_cnt--;
++ continue;
++ }
++
+ if (rc)
+ goto exit;
+
diff --git a/patches.drivers/qed-Fix-bug-in-tx-promiscuous-mode-settings.patch b/patches.drivers/qed-Fix-bug-in-tx-promiscuous-mode-settings.patch
new file mode 100644
index 0000000000..de6f87b30d
--- /dev/null
+++ b/patches.drivers/qed-Fix-bug-in-tx-promiscuous-mode-settings.patch
@@ -0,0 +1,50 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 28 Jan 2019 10:05:04 -0800
+Subject: qed: Fix bug in tx promiscuous mode settings
+Patch-mainline: v5.0-rc5
+Git-commit: 9e71a15d8b5bbce25c637f7f8833cd3f45b65646
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+When running tx switched traffic between VNICs
+created via a bridge(to which VFs are added),
+adapter drops the unicast packets in tx flow due to
+VNIC's ucast mac being unknown to it. But VF interfaces
+being in promiscuous mode should have caused adapter
+to accept all the unknown ucast packets. Later, it
+was found that driver doesn't really configure tx
+promiscuous mode settings to accept all unknown unicast macs.
+
+This patch fixes tx promiscuous mode settings to accept all
+unknown/unmatched unicast macs and works out the scenario.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_l2.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c
+@@ -609,6 +609,10 @@ qed_sp_update_accept_mode(struct qed_hwf
+ (!!(accept_filter & QED_ACCEPT_MCAST_MATCHED) &&
+ !!(accept_filter & QED_ACCEPT_MCAST_UNMATCHED)));
+
++ SET_FIELD(state, ETH_VPORT_TX_MODE_UCAST_ACCEPT_ALL,
++ (!!(accept_filter & QED_ACCEPT_UCAST_MATCHED) &&
++ !!(accept_filter & QED_ACCEPT_UCAST_UNMATCHED)));
++
+ SET_FIELD(state, ETH_VPORT_TX_MODE_BCAST_ACCEPT_ALL,
+ !!(accept_filter & QED_ACCEPT_BCAST));
+
+@@ -2688,7 +2692,8 @@ static int qed_configure_filter_rx_mode(
+ if (type == QED_FILTER_RX_MODE_TYPE_PROMISC) {
+ accept_flags.rx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
+ QED_ACCEPT_MCAST_UNMATCHED;
+- accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
++ accept_flags.tx_accept_filter |= QED_ACCEPT_UCAST_UNMATCHED |
++ QED_ACCEPT_MCAST_UNMATCHED;
+ } else if (type == QED_FILTER_RX_MODE_TYPE_MULTI_PROMISC) {
+ accept_flags.rx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
+ accept_flags.tx_accept_filter |= QED_ACCEPT_MCAST_UNMATCHED;
diff --git a/patches.drivers/qed-Fix-qed_chain_set_prod-for-PBL-chains-with-non-p.patch b/patches.drivers/qed-Fix-qed_chain_set_prod-for-PBL-chains-with-non-p.patch
new file mode 100644
index 0000000000..5a7c6899b0
--- /dev/null
+++ b/patches.drivers/qed-Fix-qed_chain_set_prod-for-PBL-chains-with-non-p.patch
@@ -0,0 +1,60 @@
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:39 +0200
+Subject: qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page
+ count
+Patch-mainline: v5.0-rc3
+Git-commit: 2d533a9287f2011632977e87ce2783f4c689c984
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+In PBL chains with non power of 2 page count, the producer is not at the
+beginning of the chain when index is 0 after a wrap. Therefore, after the
+producer index wrap around, page index should be calculated more carefully.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/linux/qed/qed_chain.h | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -663,6 +663,37 @@ out:
+ static inline void qed_chain_set_prod(struct qed_chain *p_chain,
+ u32 prod_idx, void *p_prod_elem)
+ {
++ if (p_chain->mode == QED_CHAIN_MODE_PBL) {
++ u32 cur_prod, page_mask, page_cnt, page_diff;
++
++ cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
++ p_chain->u.chain32.prod_idx;
++
++ /* Assume that number of elements in a page is power of 2 */
++ page_mask = ~p_chain->elem_per_page_mask;
++
++ /* Use "cur_prod - 1" and "prod_idx - 1" since producer index
++ * reaches the first element of next page before the page index
++ * is incremented. See qed_chain_produce().
++ * Index wrap around is not a problem because the difference
++ * between current and given producer indices is always
++ * positive and lower than the chain's capacity.
++ */
++ page_diff = (((cur_prod - 1) & page_mask) -
++ ((prod_idx - 1) & page_mask)) /
++ p_chain->elem_per_page;
++
++ page_cnt = qed_chain_get_page_cnt(p_chain);
++ if (is_chain_u16(p_chain))
++ p_chain->pbl.c.u16.prod_page_idx =
++ (p_chain->pbl.c.u16.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ else
++ p_chain->pbl.c.u32.prod_page_idx =
++ (p_chain->pbl.c.u32.prod_page_idx -
++ page_diff + page_cnt) % page_cnt;
++ }
++
+ if (is_chain_u16(p_chain))
+ p_chain->u.chain16.prod_idx = (u16) prod_idx;
+ else
diff --git a/patches.drivers/qed-Fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch b/patches.drivers/qed-Fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch
new file mode 100644
index 0000000000..c6e4abe711
--- /dev/null
+++ b/patches.drivers/qed-Fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch
@@ -0,0 +1,31 @@
+From: Denis Bolotin <dbolotin@marvell.com>
+Date: Thu, 3 Jan 2019 12:02:40 +0200
+Subject: qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory
+ barrier
+Patch-mainline: v5.0-rc3
+Git-commit: 46721c3d9e273aea880e9ff835b0e1271e1cd2fb
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Make sure chain element is updated before ringing the doorbell.
+
+Signed-off-by: Denis Bolotin <dbolotin@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1619,6 +1619,10 @@ static void qed_ll2_post_rx_buffer_notif
+ cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
+ rx_prod.bd_prod = cpu_to_le16(bd_prod);
+ rx_prod.cqe_prod = cpu_to_le16(cq_prod);
++
++ /* Make sure chain element is updated before ringing the doorbell */
++ dma_wmb();
++
+ DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
+ }
+
diff --git a/patches.drivers/qed-Fix-stack-out-of-bounds-bug.patch b/patches.drivers/qed-Fix-stack-out-of-bounds-bug.patch
new file mode 100644
index 0000000000..ac55168746
--- /dev/null
+++ b/patches.drivers/qed-Fix-stack-out-of-bounds-bug.patch
@@ -0,0 +1,104 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 28 Jan 2019 10:05:08 -0800
+Subject: qed: Fix stack out of bounds bug
+Patch-mainline: v5.0-rc5
+Git-commit: ffb057f98928aa099b08e419bbe5afc26ec9f448
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+KASAN reported following bug in qed_init_qm_get_idx_from_flags
+due to inappropriate casting of "pq_flags". Fix the type of "pq_flags".
+
+[ 196.624707] BUG: KASAN: stack-out-of-bounds in qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed]
+[ 196.624712] Read of size 8 at addr ffff809b00bc7360 by task kworker/0:9/1712
+[ 196.624714]
+[ 196.624720] CPU: 0 PID: 1712 Comm: kworker/0:9 Not tainted 4.18.0-60.el8.aarch64+debug #1
+[ 196.624723] Hardware name: To be filled by O.E.M. Saber/Saber, BIOS 0ACKL024 09/26/2018
+[ 196.624733] Workqueue: events work_for_cpu_fn
+[ 196.624738] Call trace:
+[ 196.624742] dump_backtrace+0x0/0x2f8
+[ 196.624745] show_stack+0x24/0x30
+[ 196.624749] dump_stack+0xe0/0x11c
+[ 196.624755] print_address_description+0x68/0x260
+[ 196.624759] kasan_report+0x178/0x340
+[ 196.624762] __asan_report_load_n_noabort+0x38/0x48
+[ 196.624786] qed_init_qm_get_idx_from_flags+0x1a4/0x1b8 [qed]
+[ 196.624808] qed_init_qm_info+0xec0/0x2200 [qed]
+[ 196.624830] qed_resc_alloc+0x284/0x7e8 [qed]
+[ 196.624853] qed_slowpath_start+0x6cc/0x1ae8 [qed]
+[ 196.624864] __qede_probe.isra.10+0x1cc/0x12c0 [qede]
+[ 196.624874] qede_probe+0x78/0xf0 [qede]
+[ 196.624879] local_pci_probe+0xc4/0x180
+[ 196.624882] work_for_cpu_fn+0x54/0x98
+[ 196.624885] process_one_work+0x758/0x1900
+[ 196.624888] worker_thread+0x4e0/0xd18
+[ 196.624892] kthread+0x2c8/0x350
+[ 196.624897] ret_from_fork+0x10/0x18
+[ 196.624899]
+[ 196.624902] Allocated by task 2:
+[ 196.624906] kasan_kmalloc.part.1+0x40/0x108
+[ 196.624909] kasan_kmalloc+0xb4/0xc8
+[ 196.624913] kasan_slab_alloc+0x14/0x20
+[ 196.624916] kmem_cache_alloc_node+0x1dc/0x480
+[ 196.624921] copy_process.isra.1.part.2+0x1d8/0x4a98
+[ 196.624924] _do_fork+0x150/0xfa0
+[ 196.624926] kernel_thread+0x48/0x58
+[ 196.624930] kthreadd+0x3a4/0x5a0
+[ 196.624932] ret_from_fork+0x10/0x18
+[ 196.624934]
+[ 196.624937] Freed by task 0:
+[ 196.624938] (stack is not available)
+[ 196.624940]
+[ 196.624943] The buggy address belongs to the object at ffff809b00bc0000
+[ 196.624943] which belongs to the cache thread_stack of size 32768
+[ 196.624946] The buggy address is located 29536 bytes inside of
+[ 196.624946] 32768-byte region [ffff809b00bc0000, ffff809b00bc8000)
+[ 196.624948] The buggy address belongs to the page:
+[ 196.624952] page:ffff7fe026c02e00 count:1 mapcount:0 mapping:ffff809b4001c000 index:0x0 compound_mapcount: 0
+[ 196.624960] flags: 0xfffff8000008100(slab|head)
+[ 196.624967] raw: 0fffff8000008100 dead000000000100 dead000000000200 ffff809b4001c000
+[ 196.624970] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
+[ 196.624973] page dumped because: kasan: bad access detected
+[ 196.624974]
+[ 196.624976] Memory state around the buggy address:
+[ 196.624980] ffff809b00bc7200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 196.624983] ffff809b00bc7280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 196.624985] >ffff809b00bc7300: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2
+[ 196.624988] ^
+[ 196.624990] ffff809b00bc7380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 196.624993] ffff809b00bc7400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
+[ 196.624995] ==================================================================
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -795,19 +795,19 @@ static void qed_init_qm_pq(struct qed_hw
+
+ /* get pq index according to PQ_FLAGS */
+ static u16 *qed_init_qm_get_idx_from_flags(struct qed_hwfn *p_hwfn,
+- u32 pq_flags)
++ unsigned long pq_flags)
+ {
+ struct qed_qm_info *qm_info = &p_hwfn->qm_info;
+
+ /* Can't have multiple flags set here */
+- if (bitmap_weight((unsigned long *)&pq_flags,
++ if (bitmap_weight(&pq_flags,
+ sizeof(pq_flags) * BITS_PER_BYTE) > 1) {
+- DP_ERR(p_hwfn, "requested multiple pq flags 0x%x\n", pq_flags);
++ DP_ERR(p_hwfn, "requested multiple pq flags 0x%lx\n", pq_flags);
+ goto err;
+ }
+
+ if (!(qed_get_pq_flags(p_hwfn) & pq_flags)) {
+- DP_ERR(p_hwfn, "pq flag 0x%x is not set\n", pq_flags);
++ DP_ERR(p_hwfn, "pq flag 0x%lx is not set\n", pq_flags);
+ goto err;
+ }
+
diff --git a/patches.drivers/qed-Fix-system-crash-in-ll2-xmit.patch b/patches.drivers/qed-Fix-system-crash-in-ll2-xmit.patch
new file mode 100644
index 0000000000..c2f61ce716
--- /dev/null
+++ b/patches.drivers/qed-Fix-system-crash-in-ll2-xmit.patch
@@ -0,0 +1,79 @@
+From: Manish Chopra <manishc@marvell.com>
+Date: Mon, 28 Jan 2019 10:05:07 -0800
+Subject: qed: Fix system crash in ll2 xmit
+Patch-mainline: v5.0-rc5
+Git-commit: 7c81626a3c37e4ac320b8ad785694ba498f24794
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Cache number of fragments in the skb locally as in case
+of linear skb (with zero fragments), tx completion
+(or freeing of skb) may happen before driver tries
+to get number of frgaments from the skb which could
+lead to stale access to an already freed skb.
+
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -2451,19 +2451,24 @@ static int qed_ll2_start_xmit(struct qed
+ {
+ struct qed_ll2_tx_pkt_info pkt;
+ const skb_frag_t *frag;
++ u8 flags = 0, nr_frags;
+ int rc = -EINVAL, i;
+ dma_addr_t mapping;
+ u16 vlan = 0;
+- u8 flags = 0;
+
+ if (unlikely(skb->ip_summed != CHECKSUM_NONE)) {
+ DP_INFO(cdev, "Cannot transmit a checksummed packet\n");
+ return -EINVAL;
+ }
+
+- if (1 + skb_shinfo(skb)->nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
++ /* Cache number of fragments from SKB since SKB may be freed by
++ * the completion routine after calling qed_ll2_prepare_tx_packet()
++ */
++ nr_frags = skb_shinfo(skb)->nr_frags;
++
++ if (1 + nr_frags > CORE_LL2_TX_MAX_BDS_PER_PACKET) {
+ DP_ERR(cdev, "Cannot transmit a packet with %d fragments\n",
+- 1 + skb_shinfo(skb)->nr_frags);
++ 1 + nr_frags);
+ return -EINVAL;
+ }
+
+@@ -2485,7 +2490,7 @@ static int qed_ll2_start_xmit(struct qed
+ }
+
+ memset(&pkt, 0, sizeof(pkt));
+- pkt.num_of_bds = 1 + skb_shinfo(skb)->nr_frags;
++ pkt.num_of_bds = 1 + nr_frags;
+ pkt.vlan = vlan;
+ pkt.bd_flags = flags;
+ pkt.tx_dest = QED_LL2_TX_DEST_NW;
+@@ -2496,12 +2501,17 @@ static int qed_ll2_start_xmit(struct qed
+ test_bit(QED_LL2_XMIT_FLAGS_FIP_DISCOVERY, &xmit_flags))
+ pkt.remove_stag = true;
+
++ /* qed_ll2_prepare_tx_packet() may actually send the packet if
++ * there are no fragments in the skb and subsequently the completion
++ * routine may run and free the SKB, so no dereferencing the SKB
++ * beyond this point unless skb has any fragments.
++ */
+ rc = qed_ll2_prepare_tx_packet(&cdev->hwfns[0], cdev->ll2->handle,
+ &pkt, 1);
+ if (rc)
+ goto err;
+
+- for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
++ for (i = 0; i < nr_frags; i++) {
+ frag = &skb_shinfo(skb)->frags[i];
+
+ mapping = skb_frag_dma_map(&cdev->pdev->dev, frag, 0,
diff --git a/patches.drivers/qed-Register-light-L2-queues-with-doorbell-overflow-.patch b/patches.drivers/qed-Register-light-L2-queues-with-doorbell-overflow-.patch
new file mode 100644
index 0000000000..32b24762b2
--- /dev/null
+++ b/patches.drivers/qed-Register-light-L2-queues-with-doorbell-overflow-.patch
@@ -0,0 +1,113 @@
+From: Ariel Elior <Ariel.Elior@cavium.com>
+Date: Wed, 28 Nov 2018 18:16:05 +0200
+Subject: qed: Register light L2 queues with doorbell overflow recovery
+ mechanism
+Patch-mainline: v5.0-rc1
+Git-commit: b78d5400bda4e7c49ffdb001df83e4ffcb93d63b
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Light L2 queues are doorbelling entities. Modify the implementation
+to keep the doorbell data necessary for doorbelling in well known
+location instead of recomputing every time. Register the LL2 queue
+with doorbell recovery mechanism.
+
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_ll2.c | 30 ++++++++++++++++++++----------
+ drivers/net/ethernet/qlogic/qed/qed_ll2.h | 1 +
+ 2 files changed, 21 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1085,7 +1085,14 @@ static int qed_sp_ll2_tx_queue_start(str
+
+ p_ramrod->gsi_offload_flag = p_ll2_conn->input.gsi_enable;
+
+- return qed_spq_post(p_hwfn, p_ent, NULL);
++ rc = qed_spq_post(p_hwfn, p_ent, NULL);
++ if (rc)
++ return rc;
++
++ rc = qed_db_recovery_add(p_hwfn->cdev, p_tx->doorbell_addr,
++ &p_tx->db_msg, DB_REC_WIDTH_32B,
++ DB_REC_KERNEL);
++ return rc;
+ }
+
+ static int qed_sp_ll2_rx_queue_stop(struct qed_hwfn *p_hwfn,
+@@ -1119,9 +1126,11 @@ static int qed_sp_ll2_rx_queue_stop(stru
+ static int qed_sp_ll2_tx_queue_stop(struct qed_hwfn *p_hwfn,
+ struct qed_ll2_info *p_ll2_conn)
+ {
++ struct qed_ll2_tx_queue *p_tx = &p_ll2_conn->tx_queue;
+ struct qed_spq_entry *p_ent = NULL;
+ struct qed_sp_init_data init_data;
+ int rc = -EINVAL;
++ qed_db_recovery_del(p_hwfn->cdev, p_tx->doorbell_addr, &p_tx->db_msg);
+
+ /* Get SPQ entry */
+ memset(&init_data, 0, sizeof(init_data));
+@@ -1542,6 +1551,13 @@ int qed_ll2_establish_connection(void *c
+ p_tx->doorbell_addr = (u8 __iomem *)p_hwfn->doorbells +
+ qed_db_addr(p_ll2_conn->cid,
+ DQ_DEMS_LEGACY);
++ /* prepare db data */
++ SET_FIELD(p_tx->db_msg.params, CORE_DB_DATA_DEST, DB_DEST_XCM);
++ SET_FIELD(p_tx->db_msg.params, CORE_DB_DATA_AGG_CMD, DB_AGG_CMD_SET);
++ SET_FIELD(p_tx->db_msg.params, CORE_DB_DATA_AGG_VAL_SEL,
++ DQ_XCM_CORE_TX_BD_PROD_CMD);
++ p_tx->db_msg.agg_flags = DQ_XCM_CORE_DQ_CF_CMD;
++
+
+ rc = qed_ll2_establish_connection_rx(p_hwfn, p_ll2_conn);
+ if (rc)
+@@ -1780,7 +1796,6 @@ static void qed_ll2_tx_packet_notify(str
+ bool b_notify = p_ll2_conn->tx_queue.cur_send_packet->notify_fw;
+ struct qed_ll2_tx_queue *p_tx = &p_ll2_conn->tx_queue;
+ struct qed_ll2_tx_packet *p_pkt = NULL;
+- struct core_db_data db_msg = { 0, 0, 0 };
+ u16 bd_prod;
+
+ /* If there are missing BDs, don't do anything now */
+@@ -1809,24 +1824,19 @@ static void qed_ll2_tx_packet_notify(str
+ list_move_tail(&p_pkt->list_entry, &p_tx->active_descq);
+ }
+
+- SET_FIELD(db_msg.params, CORE_DB_DATA_DEST, DB_DEST_XCM);
+- SET_FIELD(db_msg.params, CORE_DB_DATA_AGG_CMD, DB_AGG_CMD_SET);
+- SET_FIELD(db_msg.params, CORE_DB_DATA_AGG_VAL_SEL,
+- DQ_XCM_CORE_TX_BD_PROD_CMD);
+- db_msg.agg_flags = DQ_XCM_CORE_DQ_CF_CMD;
+- db_msg.spq_prod = cpu_to_le16(bd_prod);
++ p_tx->db_msg.spq_prod = cpu_to_le16(bd_prod);
+
+ /* Make sure the BDs data is updated before ringing the doorbell */
+ wmb();
+
+- DIRECT_REG_WR(p_tx->doorbell_addr, *((u32 *)&db_msg));
++ DIRECT_REG_WR(p_tx->doorbell_addr, *((u32 *)&p_tx->db_msg));
+
+ DP_VERBOSE(p_hwfn,
+ (NETIF_MSG_TX_QUEUED | QED_MSG_LL2),
+ "LL2 [q 0x%02x cid 0x%08x type 0x%08x] Doorbelled [producer 0x%04x]\n",
+ p_ll2_conn->queue_id,
+ p_ll2_conn->cid,
+- p_ll2_conn->input.conn_type, db_msg.spq_prod);
++ p_ll2_conn->input.conn_type, p_tx->db_msg.spq_prod);
+ }
+
+ int qed_ll2_prepare_tx_packet(void *cxt,
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.h
+@@ -103,6 +103,7 @@ struct qed_ll2_tx_queue {
+ struct qed_ll2_tx_packet cur_completing_packet;
+ u16 cur_completing_bd_idx;
+ void __iomem *doorbell_addr;
++ struct core_db_data db_msg;
+ u16 bds_idx;
+ u16 cur_send_frag_num;
+ u16 cur_completing_frag_num;
diff --git a/patches.drivers/qed-Register-slowpath-queue-doorbell-with-doorbell-o.patch b/patches.drivers/qed-Register-slowpath-queue-doorbell-with-doorbell-o.patch
new file mode 100644
index 0000000000..a155bc385e
--- /dev/null
+++ b/patches.drivers/qed-Register-slowpath-queue-doorbell-with-doorbell-o.patch
@@ -0,0 +1,136 @@
+From: Ariel Elior <Ariel.Elior@cavium.com>
+Date: Wed, 28 Nov 2018 18:16:04 +0200
+Subject: qed: Register slowpath queue doorbell with doorbell overflow recovery
+ mechanism
+Patch-mainline: v5.0-rc1
+Git-commit: 9ecd8c3feaa53405508499495d06a6f1e7dc8e7b
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Slow path queue is a doorbelling entity. Register it with the overflow mechanism.
+
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_sp.h | 4 +-
+ drivers/net/ethernet/qlogic/qed/qed_spq.c | 47 ++++++++++++++++++++++--------
+ 2 files changed, 38 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h
+@@ -227,7 +227,9 @@ struct qed_spq {
+ u32 comp_count;
+
+ u32 cid;
+- qed_spq_async_comp_cb async_comp_cb[MAX_PROTOCOL_TYPE];
++ u32 db_addr_offset;
++ struct core_db_data db_data;
++ qed_spq_async_comp_cb async_comp_cb[MAX_PROTOCOL_TYPE];
+ };
+
+ /**
+--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c
+@@ -252,9 +252,9 @@ static int qed_spq_hw_post(struct qed_hw
+ struct qed_spq *p_spq, struct qed_spq_entry *p_ent)
+ {
+ struct qed_chain *p_chain = &p_hwfn->p_spq->chain;
++ struct core_db_data *p_db_data = &p_spq->db_data;
+ u16 echo = qed_chain_get_prod_idx(p_chain);
+ struct slow_path_element *elem;
+- struct core_db_data db;
+
+ p_ent->elem.hdr.echo = cpu_to_le16(echo);
+ elem = qed_chain_produce(p_chain);
+@@ -266,27 +266,22 @@ static int qed_spq_hw_post(struct qed_hw
+ *elem = p_ent->elem; /* struct assignment */
+
+ /* send a doorbell on the slow hwfn session */
+- memset(&db, 0, sizeof(db));
+- SET_FIELD(db.params, CORE_DB_DATA_DEST, DB_DEST_XCM);
+- SET_FIELD(db.params, CORE_DB_DATA_AGG_CMD, DB_AGG_CMD_SET);
+- SET_FIELD(db.params, CORE_DB_DATA_AGG_VAL_SEL,
+- DQ_XCM_CORE_SPQ_PROD_CMD);
+- db.agg_flags = DQ_XCM_CORE_DQ_CF_CMD;
+- db.spq_prod = cpu_to_le16(qed_chain_get_prod_idx(p_chain));
++ p_db_data->spq_prod = cpu_to_le16(qed_chain_get_prod_idx(p_chain));
+
+ /* make sure the SPQE is updated before the doorbell */
+ wmb();
+
+- DOORBELL(p_hwfn, qed_db_addr(p_spq->cid, DQ_DEMS_LEGACY), *(u32 *)&db);
++ DOORBELL(p_hwfn, p_spq->db_addr_offset, *(u32 *)p_db_data);
+
+ /* make sure doorbell is rang */
+ wmb();
+
+ DP_VERBOSE(p_hwfn, QED_MSG_SPQ,
+ "Doorbelled [0x%08x, CID 0x%08x] with Flags: %02x agg_params: %02x, prod: %04x\n",
+- qed_db_addr(p_spq->cid, DQ_DEMS_LEGACY),
+- p_spq->cid, db.params, db.agg_flags,
+- qed_chain_get_prod_idx(p_chain));
++ p_spq->db_addr_offset,
++ p_spq->cid,
++ p_db_data->params,
++ p_db_data->agg_flags, qed_chain_get_prod_idx(p_chain));
+
+ return 0;
+ }
+@@ -490,8 +485,11 @@ void qed_spq_setup(struct qed_hwfn *p_hw
+ {
+ struct qed_spq *p_spq = p_hwfn->p_spq;
+ struct qed_spq_entry *p_virt = NULL;
++ struct core_db_data *p_db_data;
++ void __iomem *db_addr;
+ dma_addr_t p_phys = 0;
+ u32 i, capacity;
++ int rc;
+
+ INIT_LIST_HEAD(&p_spq->pending);
+ INIT_LIST_HEAD(&p_spq->completion_pending);
+@@ -528,6 +526,25 @@ void qed_spq_setup(struct qed_hwfn *p_hw
+
+ /* reset the chain itself */
+ qed_chain_reset(&p_spq->chain);
++
++ /* Initialize the address/data of the SPQ doorbell */
++ p_spq->db_addr_offset = qed_db_addr(p_spq->cid, DQ_DEMS_LEGACY);
++ p_db_data = &p_spq->db_data;
++ memset(p_db_data, 0, sizeof(*p_db_data));
++ SET_FIELD(p_db_data->params, CORE_DB_DATA_DEST, DB_DEST_XCM);
++ SET_FIELD(p_db_data->params, CORE_DB_DATA_AGG_CMD, DB_AGG_CMD_MAX);
++ SET_FIELD(p_db_data->params, CORE_DB_DATA_AGG_VAL_SEL,
++ DQ_XCM_CORE_SPQ_PROD_CMD);
++ p_db_data->agg_flags = DQ_XCM_CORE_DQ_CF_CMD;
++
++ /* Register the SPQ doorbell with the doorbell recovery mechanism */
++ db_addr = (void __iomem *)((u8 __iomem *)p_hwfn->doorbells +
++ p_spq->db_addr_offset);
++ rc = qed_db_recovery_add(p_hwfn->cdev, db_addr, &p_spq->db_data,
++ DB_REC_WIDTH_32B, DB_REC_KERNEL);
++ if (rc)
++ DP_INFO(p_hwfn,
++ "Failed to register the SPQ doorbell with the doorbell recovery mechanism\n");
+ }
+
+ int qed_spq_alloc(struct qed_hwfn *p_hwfn)
+@@ -575,11 +592,17 @@ spq_allocate_fail:
+ void qed_spq_free(struct qed_hwfn *p_hwfn)
+ {
+ struct qed_spq *p_spq = p_hwfn->p_spq;
++ void __iomem *db_addr;
+ u32 capacity;
+
+ if (!p_spq)
+ return;
+
++ /* Delete the SPQ doorbell from the doorbell recovery mechanism */
++ db_addr = (void __iomem *)((u8 __iomem *)p_hwfn->doorbells +
++ p_spq->db_addr_offset);
++ qed_db_recovery_del(p_hwfn->cdev, db_addr, &p_spq->db_data);
++
+ if (p_spq->p_virt) {
+ capacity = qed_chain_get_capacity(&p_spq->chain);
+ dma_free_coherent(&p_hwfn->cdev->pdev->dev,
diff --git a/patches.drivers/qed-Use-the-doorbell-overflow-recovery-mechanism-in-.patch b/patches.drivers/qed-Use-the-doorbell-overflow-recovery-mechanism-in-.patch
new file mode 100644
index 0000000000..1d630cb480
--- /dev/null
+++ b/patches.drivers/qed-Use-the-doorbell-overflow-recovery-mechanism-in-.patch
@@ -0,0 +1,456 @@
+From: Ariel Elior <Ariel.Elior@cavium.com>
+Date: Wed, 28 Nov 2018 18:16:03 +0200
+Subject: qed: Use the doorbell overflow recovery mechanism in case of doorbell
+ overflow
+Patch-mainline: v5.0-rc1
+Git-commit: a1b469b8b17f1573741eb0272349eca47d32462a
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+In case of an attention from the doorbell queue block, analyze the HW
+indications. In case of a doorbell overflow, execute a doorbell recovery.
+Since there can be spurious indications (race conditions between multiple PFs),
+schedule a periodic task for checking whether a doorbell overflow may have been
+missed. After a set time with no indications, terminate the periodic task.
+
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed.h | 14 +-
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 14 +-
+ drivers/net/ethernet/qlogic/qed/qed_int.c | 154 ++++++++++++++++++++++---
+ drivers/net/ethernet/qlogic/qed/qed_int.h | 10 +
+ drivers/net/ethernet/qlogic/qed/qed_main.c | 64 ++++++++++
+ drivers/net/ethernet/qlogic/qed/qed_reg_addr.h | 50 ++++++++
+ 6 files changed, 281 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed.h
++++ b/drivers/net/ethernet/qlogic/qed/qed.h
+@@ -536,6 +536,7 @@ struct qed_simd_fp_handler {
+
+ enum qed_slowpath_wq_flag {
+ QED_SLOWPATH_MFW_TLV_REQ,
++ QED_SLOWPATH_PERIODIC_DB_REC,
+ };
+
+ struct qed_hwfn {
+@@ -669,11 +670,12 @@ struct qed_hwfn {
+ struct delayed_work iov_task;
+ unsigned long iov_task_flags;
+ #endif
+-
+- struct z_stream_s *stream;
++ struct z_stream_s *stream;
++ bool slowpath_wq_active;
+ struct workqueue_struct *slowpath_wq;
+ struct delayed_work slowpath_task;
+ unsigned long slowpath_task_flags;
++ u32 periodic_db_rec_count;
+ };
+
+ struct pci_params {
+@@ -914,6 +916,12 @@ u16 qed_get_cm_pq_idx_llt_mtc(struct qed
+
+ #define QED_LEADING_HWFN(dev) (&dev->hwfns[0])
+
++/* doorbell recovery mechanism */
++void qed_db_recovery_dp(struct qed_hwfn *p_hwfn);
++void qed_db_recovery_execute(struct qed_hwfn *p_hwfn,
++ enum qed_db_rec_exec db_exec);
++bool qed_edpm_enabled(struct qed_hwfn *p_hwfn);
++
+ /* Other Linux specific common definitions */
+ #define DP_NAME(cdev) ((cdev)->name)
+
+@@ -948,4 +956,6 @@ int qed_mfw_fill_tlv_data(struct qed_hwf
+ union qed_mfw_tlv_data *tlv_data);
+
+ void qed_hw_info_set_offload_tc(struct qed_hw_info *p_info, u8 tc);
++
++void qed_periodic_db_rec_start(struct qed_hwfn *p_hwfn);
+ #endif /* _QED_H */
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -1788,6 +1788,14 @@ enum QED_ROCE_EDPM_MODE {
+ QED_ROCE_EDPM_MODE_DISABLE = 2,
+ };
+
++bool qed_edpm_enabled(struct qed_hwfn *p_hwfn)
++{
++ if (p_hwfn->dcbx_no_edpm || p_hwfn->db_bar_no_edpm)
++ return false;
++
++ return true;
++}
++
+ static int
+ qed_hw_init_pf_doorbell_bar(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+@@ -1857,13 +1865,13 @@ qed_hw_init_pf_doorbell_bar(struct qed_h
+ p_hwfn->wid_count = (u16) n_cpus;
+
+ DP_INFO(p_hwfn,
+- "doorbell bar: normal_region_size=%d, pwm_region_size=%d, dpi_size=%d, dpi_count=%d, roce_edpm=%s\n",
++ "doorbell bar: normal_region_size=%d, pwm_region_size=%d, dpi_size=%d, dpi_count=%d, roce_edpm=%s, page_size=%lu\n",
+ norm_regsize,
+ pwm_regsize,
+ p_hwfn->dpi_size,
+ p_hwfn->dpi_count,
+- ((p_hwfn->dcbx_no_edpm) || (p_hwfn->db_bar_no_edpm)) ?
+- "disabled" : "enabled");
++ (!qed_edpm_enabled(p_hwfn)) ?
++ "disabled" : "enabled", PAGE_SIZE);
+
+ if (rc) {
+ DP_ERR(p_hwfn,
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
+@@ -361,29 +361,147 @@ static int qed_pglub_rbc_attn_cb(struct
+ return 0;
+ }
+
+-#define QED_DORQ_ATTENTION_REASON_MASK (0xfffff)
+-#define QED_DORQ_ATTENTION_OPAQUE_MASK (0xffff)
+-#define QED_DORQ_ATTENTION_SIZE_MASK (0x7f)
+-#define QED_DORQ_ATTENTION_SIZE_SHIFT (16)
++#define QED_DORQ_ATTENTION_REASON_MASK (0xfffff)
++#define QED_DORQ_ATTENTION_OPAQUE_MASK (0xffff)
++#define QED_DORQ_ATTENTION_OPAQUE_SHIFT (0x0)
++#define QED_DORQ_ATTENTION_SIZE_MASK (0x7f)
++#define QED_DORQ_ATTENTION_SIZE_SHIFT (16)
++
++#define QED_DB_REC_COUNT 1000
++#define QED_DB_REC_INTERVAL 100
++
++static int qed_db_rec_flush_queue(struct qed_hwfn *p_hwfn,
++ struct qed_ptt *p_ptt)
++{
++ u32 count = QED_DB_REC_COUNT;
++ u32 usage = 1;
++
++ /* wait for usage to zero or count to run out. This is necessary since
++ * EDPM doorbell transactions can take multiple 64b cycles, and as such
++ * can "split" over the pci. Possibly, the doorbell drop can happen with
++ * half an EDPM in the queue and other half dropped. Another EDPM
++ * doorbell to the same address (from doorbell recovery mechanism or
++ * from the doorbelling entity) could have first half dropped and second
++ * half interpreted as continuation of the first. To prevent such
++ * malformed doorbells from reaching the device, flush the queue before
++ * releasing the overflow sticky indication.
++ */
++ while (count-- && usage) {
++ usage = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_USAGE_CNT);
++ udelay(QED_DB_REC_INTERVAL);
++ }
++
++ /* should have been depleted by now */
++ if (usage) {
++ DP_NOTICE(p_hwfn->cdev,
++ "DB recovery: doorbell usage failed to zero after %d usec. usage was %x\n",
++ QED_DB_REC_INTERVAL * QED_DB_REC_COUNT, usage);
++ return -EBUSY;
++ }
++
++ return 0;
++}
++
++int qed_db_rec_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
++{
++ u32 overflow;
++ int rc;
++
++ overflow = qed_rd(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY);
++ DP_NOTICE(p_hwfn, "PF Overflow sticky 0x%x\n", overflow);
++ if (!overflow) {
++ qed_db_recovery_execute(p_hwfn, DB_REC_ONCE);
++ return 0;
++ }
++
++ if (qed_edpm_enabled(p_hwfn)) {
++ rc = qed_db_rec_flush_queue(p_hwfn, p_ptt);
++ if (rc)
++ return rc;
++ }
++
++ /* Flush any pending (e)dpm as they may never arrive */
++ qed_wr(p_hwfn, p_ptt, DORQ_REG_DPM_FORCE_ABORT, 0x1);
++
++ /* Release overflow sticky indication (stop silently dropping everything) */
++ qed_wr(p_hwfn, p_ptt, DORQ_REG_PF_OVFL_STICKY, 0x0);
++
++ /* Repeat all last doorbells (doorbell drop recovery) */
++ qed_db_recovery_execute(p_hwfn, DB_REC_REAL_DEAL);
++
++ return 0;
++}
++
+ static int qed_dorq_attn_cb(struct qed_hwfn *p_hwfn)
+ {
+- u32 reason;
++ u32 int_sts, first_drop_reason, details, address, all_drops_reason;
++ struct qed_ptt *p_ptt = p_hwfn->p_dpc_ptt;
++ int rc;
++
++ int_sts = qed_rd(p_hwfn, p_ptt, DORQ_REG_INT_STS);
++ DP_NOTICE(p_hwfn->cdev, "DORQ attention. int_sts was %x\n", int_sts);
+
+- reason = qed_rd(p_hwfn, p_hwfn->p_dpc_ptt, DORQ_REG_DB_DROP_REASON) &
+- QED_DORQ_ATTENTION_REASON_MASK;
+- if (reason) {
+- u32 details = qed_rd(p_hwfn, p_hwfn->p_dpc_ptt,
+- DORQ_REG_DB_DROP_DETAILS);
+-
+- DP_INFO(p_hwfn->cdev,
+- "DORQ db_drop: address 0x%08x Opaque FID 0x%04x Size [bytes] 0x%08x Reason: 0x%08x\n",
+- qed_rd(p_hwfn, p_hwfn->p_dpc_ptt,
+- DORQ_REG_DB_DROP_DETAILS_ADDRESS),
+- (u16)(details & QED_DORQ_ATTENTION_OPAQUE_MASK),
+- GET_FIELD(details, QED_DORQ_ATTENTION_SIZE) * 4,
+- reason);
++ /* int_sts may be zero since all PFs were interrupted for doorbell
++ * overflow but another one already handled it. Can abort here. If
++ * This PF also requires overflow recovery we will be interrupted again.
++ * The masked almost full indication may also be set. Ignoring.
++ */
++ if (!(int_sts & ~DORQ_REG_INT_STS_DORQ_FIFO_AFULL))
++ return 0;
++
++ /* check if db_drop or overflow happened */
++ if (int_sts & (DORQ_REG_INT_STS_DB_DROP |
++ DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR)) {
++ /* Obtain data about db drop/overflow */
++ first_drop_reason = qed_rd(p_hwfn, p_ptt,
++ DORQ_REG_DB_DROP_REASON) &
++ QED_DORQ_ATTENTION_REASON_MASK;
++ details = qed_rd(p_hwfn, p_ptt, DORQ_REG_DB_DROP_DETAILS);
++ address = qed_rd(p_hwfn, p_ptt,
++ DORQ_REG_DB_DROP_DETAILS_ADDRESS);
++ all_drops_reason = qed_rd(p_hwfn, p_ptt,
++ DORQ_REG_DB_DROP_DETAILS_REASON);
++
++ /* Log info */
++ DP_NOTICE(p_hwfn->cdev,
++ "Doorbell drop occurred\n"
++ "Address\t\t0x%08x\t(second BAR address)\n"
++ "FID\t\t0x%04x\t\t(Opaque FID)\n"
++ "Size\t\t0x%04x\t\t(in bytes)\n"
++ "1st drop reason\t0x%08x\t(details on first drop since last handling)\n"
++ "Sticky reasons\t0x%08x\t(all drop reasons since last handling)\n",
++ address,
++ GET_FIELD(details, QED_DORQ_ATTENTION_OPAQUE),
++ GET_FIELD(details, QED_DORQ_ATTENTION_SIZE) * 4,
++ first_drop_reason, all_drops_reason);
++
++ rc = qed_db_rec_handler(p_hwfn, p_ptt);
++ qed_periodic_db_rec_start(p_hwfn);
++ if (rc)
++ return rc;
++
++ /* Clear the doorbell drop details and prepare for next drop */
++ qed_wr(p_hwfn, p_ptt, DORQ_REG_DB_DROP_DETAILS_REL, 0);
++
++ /* Mark interrupt as handled (note: even if drop was due to a different
++ * reason than overflow we mark as handled)
++ */
++ qed_wr(p_hwfn,
++ p_ptt,
++ DORQ_REG_INT_STS_WR,
++ DORQ_REG_INT_STS_DB_DROP |
++ DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR);
++
++ /* If there are no indications other than drop indications, success */
++ if ((int_sts & ~(DORQ_REG_INT_STS_DB_DROP |
++ DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR |
++ DORQ_REG_INT_STS_DORQ_FIFO_AFULL)) == 0)
++ return 0;
+ }
+
++ /* Some other indication was present - non recoverable */
++ DP_INFO(p_hwfn, "DORQ fatal attention\n");
++
+ return -EINVAL;
+ }
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_int.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_int.h
+@@ -190,6 +190,16 @@ void qed_int_get_num_sbs(struct qed_hwfn
+ */
+ void qed_int_disable_post_isr_release(struct qed_dev *cdev);
+
++/**
++ * @brief - Doorbell Recovery handler.
++ * Run DB_REAL_DEAL doorbell recovery in case of PF overflow
++ * (and flush DORQ if needed), otherwise run DB_REC_ONCE.
++ *
++ * @param p_hwfn
++ * @param p_ptt
++ */
++int qed_db_rec_handler(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt);
++
+ #define QED_CAU_DEF_RX_TIMER_RES 0
+ #define QED_CAU_DEF_TX_TIMER_RES 0
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
+@@ -966,9 +966,47 @@ static void qed_update_pf_params(struct
+ }
+ }
+
++#define QED_PERIODIC_DB_REC_COUNT 100
++#define QED_PERIODIC_DB_REC_INTERVAL_MS 100
++#define QED_PERIODIC_DB_REC_INTERVAL \
++ msecs_to_jiffies(QED_PERIODIC_DB_REC_INTERVAL_MS)
++#define QED_PERIODIC_DB_REC_WAIT_COUNT 10
++#define QED_PERIODIC_DB_REC_WAIT_INTERVAL \
++ (QED_PERIODIC_DB_REC_INTERVAL_MS / QED_PERIODIC_DB_REC_WAIT_COUNT)
++
++static int qed_slowpath_delayed_work(struct qed_hwfn *hwfn,
++ enum qed_slowpath_wq_flag wq_flag,
++ unsigned long delay)
++{
++ if (!hwfn->slowpath_wq_active)
++ return -EINVAL;
++
++ /* Memory barrier for setting atomic bit */
++ smp_mb__before_atomic();
++ set_bit(wq_flag, &hwfn->slowpath_task_flags);
++ smp_mb__after_atomic();
++ queue_delayed_work(hwfn->slowpath_wq, &hwfn->slowpath_task, delay);
++
++ return 0;
++}
++
++void qed_periodic_db_rec_start(struct qed_hwfn *p_hwfn)
++{
++ /* Reset periodic Doorbell Recovery counter */
++ p_hwfn->periodic_db_rec_count = QED_PERIODIC_DB_REC_COUNT;
++
++ /* Don't schedule periodic Doorbell Recovery if already scheduled */
++ if (test_bit(QED_SLOWPATH_PERIODIC_DB_REC,
++ &p_hwfn->slowpath_task_flags))
++ return;
++
++ qed_slowpath_delayed_work(p_hwfn, QED_SLOWPATH_PERIODIC_DB_REC,
++ QED_PERIODIC_DB_REC_INTERVAL);
++}
++
+ static void qed_slowpath_wq_stop(struct qed_dev *cdev)
+ {
+- int i;
++ int i, sleep_count = QED_PERIODIC_DB_REC_WAIT_COUNT;
+
+ if (IS_VF(cdev))
+ return;
+@@ -977,6 +1015,15 @@ static void qed_slowpath_wq_stop(struct
+ if (!cdev->hwfns[i].slowpath_wq)
+ continue;
+
++ /* Stop queuing new delayed works */
++ cdev->hwfns[i].slowpath_wq_active = false;
++
++ /* Wait until the last periodic doorbell recovery is executed */
++ while (test_bit(QED_SLOWPATH_PERIODIC_DB_REC,
++ &cdev->hwfns[i].slowpath_task_flags) &&
++ sleep_count--)
++ msleep(QED_PERIODIC_DB_REC_WAIT_INTERVAL);
++
+ flush_workqueue(cdev->hwfns[i].slowpath_wq);
+ destroy_workqueue(cdev->hwfns[i].slowpath_wq);
+ }
+@@ -989,7 +1036,10 @@ static void qed_slowpath_task(struct wor
+ struct qed_ptt *ptt = qed_ptt_acquire(hwfn);
+
+ if (!ptt) {
+- queue_delayed_work(hwfn->slowpath_wq, &hwfn->slowpath_task, 0);
++ if (hwfn->slowpath_wq_active)
++ queue_delayed_work(hwfn->slowpath_wq,
++ &hwfn->slowpath_task, 0);
++
+ return;
+ }
+
+@@ -997,6 +1047,15 @@ static void qed_slowpath_task(struct wor
+ &hwfn->slowpath_task_flags))
+ qed_mfw_process_tlv_req(hwfn, ptt);
+
++ if (test_and_clear_bit(QED_SLOWPATH_PERIODIC_DB_REC,
++ &hwfn->slowpath_task_flags)) {
++ qed_db_rec_handler(hwfn, ptt);
++ if (hwfn->periodic_db_rec_count--)
++ qed_slowpath_delayed_work(hwfn,
++ QED_SLOWPATH_PERIODIC_DB_REC,
++ QED_PERIODIC_DB_REC_INTERVAL);
++ }
++
+ qed_ptt_release(hwfn, ptt);
+ }
+
+@@ -1023,6 +1082,7 @@ static int qed_slowpath_wq_start(struct
+ }
+
+ INIT_DELAYED_WORK(&hwfn->slowpath_task, qed_slowpath_task);
++ hwfn->slowpath_wq_active = true;
+ }
+
+ return 0;
+--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+@@ -1243,6 +1243,56 @@
+ 0x1701534UL
+ #define TSEM_REG_DBG_FORCE_FRAME \
+ 0x1701538UL
++#define DORQ_REG_PF_USAGE_CNT \
++ 0x1009c0UL
++#define DORQ_REG_PF_OVFL_STICKY \
++ 0x1009d0UL
++#define DORQ_REG_DPM_FORCE_ABORT \
++ 0x1009d8UL
++#define DORQ_REG_INT_STS \
++ 0x100180UL
++#define DORQ_REG_INT_STS_ADDRESS_ERROR \
++ (0x1UL << 0)
++#define DORQ_REG_INT_STS_WR \
++ 0x100188UL
++#define DORQ_REG_DB_DROP_DETAILS_REL \
++ 0x100a28UL
++#define DORQ_REG_INT_STS_ADDRESS_ERROR_SHIFT \
++ 0
++#define DORQ_REG_INT_STS_DB_DROP \
++ (0x1UL << 1)
++#define DORQ_REG_INT_STS_DB_DROP_SHIFT \
++ 1
++#define DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR \
++ (0x1UL << 2)
++#define DORQ_REG_INT_STS_DORQ_FIFO_OVFL_ERR_SHIFT \
++ 2
++#define DORQ_REG_INT_STS_DORQ_FIFO_AFULL\
++ (0x1UL << 3)
++#define DORQ_REG_INT_STS_DORQ_FIFO_AFULL_SHIFT \
++ 3
++#define DORQ_REG_INT_STS_CFC_BYP_VALIDATION_ERR \
++ (0x1UL << 4)
++#define DORQ_REG_INT_STS_CFC_BYP_VALIDATION_ERR_SHIFT \
++ 4
++#define DORQ_REG_INT_STS_CFC_LD_RESP_ERR \
++ (0x1UL << 5)
++#define DORQ_REG_INT_STS_CFC_LD_RESP_ERR_SHIFT \
++ 5
++#define DORQ_REG_INT_STS_XCM_DONE_CNT_ERR \
++ (0x1UL << 6)
++#define DORQ_REG_INT_STS_XCM_DONE_CNT_ERR_SHIFT \
++ 6
++#define DORQ_REG_INT_STS_CFC_LD_REQ_FIFO_OVFL_ERR \
++ (0x1UL << 7)
++#define DORQ_REG_INT_STS_CFC_LD_REQ_FIFO_OVFL_ERR_SHIFT \
++ 7
++#define DORQ_REG_INT_STS_CFC_LD_REQ_FIFO_UNDER_ERR \
++ (0x1UL << 8)
++#define DORQ_REG_INT_STS_CFC_LD_REQ_FIFO_UNDER_ERR_SHIFT \
++ 8
++#define DORQ_REG_DB_DROP_DETAILS_REASON \
++ 0x100a20UL
+ #define MSEM_REG_DBG_SELECT \
+ 0x1801528UL
+ #define MSEM_REG_DBG_DWORD_ENABLE \
diff --git a/patches.drivers/qed-fix-spelling-mistake-Dispalying-Displaying.patch b/patches.drivers/qed-fix-spelling-mistake-Dispalying-Displaying.patch
new file mode 100644
index 0000000000..cfd4c53e17
--- /dev/null
+++ b/patches.drivers/qed-fix-spelling-mistake-Dispalying-Displaying.patch
@@ -0,0 +1,27 @@
+From: Colin Ian King <colin.king@canonical.com>
+Date: Mon, 3 Dec 2018 17:13:31 +0000
+Subject: qed: fix spelling mistake "Dispalying" -> "Displaying"
+Patch-mainline: v5.0-rc1
+Git-commit: d1ecf8a660fafd023f2e5792107381de6fb34357
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+There is a spelling mistake in a DP_NOTICE message, fix it.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c
+@@ -285,7 +285,7 @@ void qed_db_recovery_dp(struct qed_hwfn
+ struct qed_db_recovery_entry *db_entry = NULL;
+
+ DP_NOTICE(p_hwfn,
+- "Dispalying doorbell recovery database. Counter was %d\n",
++ "Displaying doorbell recovery database. Counter was %d\n",
+ p_hwfn->db_recovery_info.db_recovery_counter);
+
+ /* Protect the list */
diff --git a/patches.drivers/qede-Add-a-statistic-for-a-case-where-driver-drops-t.patch b/patches.drivers/qede-Add-a-statistic-for-a-case-where-driver-drops-t.patch
new file mode 100644
index 0000000000..644e6ce321
--- /dev/null
+++ b/patches.drivers/qede-Add-a-statistic-for-a-case-where-driver-drops-t.patch
@@ -0,0 +1,56 @@
+From: Michael Shteinbok <michael.shteinbok@cavium.com>
+Date: Thu, 29 Nov 2018 10:50:19 +0200
+Subject: qede - Add a statistic for a case where driver drops tx packet due to
+ memory allocation failure.
+Patch-mainline: v5.0-rc1
+Git-commit: dcc6abae0f473a67543ce651fbfb6b15452876f6
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+skb_linearization can fail due to memory allocation failure.
+In such a case, the driver will drop the packet. In such a case
+The driver used to print an error message.
+This patch replaces this error message by a dedicated statistic.
+
+Signed-off-by: Michael Shteinbok <michael.shteinbok@cavium.com>
+Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qede/qede.h | 1 +
+ drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 1 +
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 4 ++--
+ 3 files changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -381,6 +381,7 @@ struct qede_tx_queue {
+
+ u64 xmit_pkts;
+ u64 stopped_cnt;
++ u64 tx_mem_alloc_err;
+
+ __le16 *hw_cons_ptr;
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c
+@@ -73,6 +73,7 @@ static const struct {
+ } qede_tqstats_arr[] = {
+ QEDE_TQSTAT(xmit_pkts),
+ QEDE_TQSTAT(stopped_cnt),
++ QEDE_TQSTAT(tx_mem_alloc_err),
+ };
+
+ #define QEDE_STAT_OFFSET(stat_name, type, base) \
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1466,8 +1466,8 @@ netdev_tx_t qede_start_xmit(struct sk_bu
+ #if ((MAX_SKB_FRAGS + 2) > ETH_TX_MAX_BDS_PER_NON_LSO_PACKET)
+ if (qede_pkt_req_lin(skb, xmit_type)) {
+ if (skb_linearize(skb)) {
+- DP_NOTICE(edev,
+- "SKB linearization failed - silently dropping this SKB\n");
++ txq->tx_mem_alloc_err++;
++
+ dev_kfree_skb_any(skb);
+ return NETDEV_TX_OK;
+ }
diff --git a/patches.drivers/qede-Fix-system-crash-on-configuring-channels.patch b/patches.drivers/qede-Fix-system-crash-on-configuring-channels.patch
new file mode 100644
index 0000000000..96b57c7239
--- /dev/null
+++ b/patches.drivers/qede-Fix-system-crash-on-configuring-channels.patch
@@ -0,0 +1,86 @@
+From: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Date: Wed, 6 Feb 2019 14:43:45 -0800
+Subject: qede: Fix system crash on configuring channels.
+Patch-mainline: v5.0-rc6
+Git-commit: 0aa4febb420d91df5b56b1864a2465765da85f4b
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+Under heavy traffic load, when changing number of channels via
+ethtool (ethtool -L) which will cause interface to be reloaded,
+it was observed that some packets gets transmitted on old TX
+channel/queue id which doesn't really exist after the channel
+configuration leads to system crash.
+
+Add a safeguard in the driver by validating queue id through
+ndo_select_queue() which is called before the ndo_start_xmit().
+
+Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
+Signed-off-by: Ariel Elior <aelior@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qede/qede.h | 3 +++
+ drivers/net/ethernet/qlogic/qede/qede_fp.c | 13 +++++++++++++
+ drivers/net/ethernet/qlogic/qede/qede_main.c | 3 +++
+ 3 files changed, 19 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -494,6 +494,9 @@ struct qede_reload_args {
+
+ /* Datapath functions definition */
+ netdev_tx_t qede_start_xmit(struct sk_buff *skb, struct net_device *ndev);
++u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
++ struct net_device *sb_dev,
++ select_queue_fallback_t fallback);
+ netdev_features_t qede_features_check(struct sk_buff *skb,
+ struct net_device *dev,
+ netdev_features_t features);
+--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c
+@@ -1695,6 +1695,19 @@ netdev_tx_t qede_start_xmit(struct sk_bu
+ return NETDEV_TX_OK;
+ }
+
++u16 qede_select_queue(struct net_device *dev, struct sk_buff *skb,
++ struct net_device *sb_dev,
++ select_queue_fallback_t fallback)
++{
++ struct qede_dev *edev = netdev_priv(dev);
++ int total_txq;
++
++ total_txq = QEDE_TSS_COUNT(edev) * edev->dev_info.num_tc;
++
++ return QEDE_TSS_COUNT(edev) ?
++ fallback(dev, skb, NULL) % total_txq : 0;
++}
++
+ /* 8B udp header + 8B base tunnel header + 32B option length */
+ #define QEDE_MAX_TUN_HDR_LEN 48
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -631,6 +631,7 @@ static const struct net_device_ops qede_
+ .ndo_open = qede_open,
+ .ndo_stop = qede_close,
+ .ndo_start_xmit = qede_start_xmit,
++ .ndo_select_queue = qede_select_queue,
+ .ndo_set_rx_mode = qede_set_rx_mode,
+ .ndo_set_mac_address = qede_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+@@ -666,6 +667,7 @@ static const struct net_device_ops qede_
+ .ndo_open = qede_open,
+ .ndo_stop = qede_close,
+ .ndo_start_xmit = qede_start_xmit,
++ .ndo_select_queue = qede_select_queue,
+ .ndo_set_rx_mode = qede_set_rx_mode,
+ .ndo_set_mac_address = qede_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
+@@ -684,6 +686,7 @@ static const struct net_device_ops qede_
+ .ndo_open = qede_open,
+ .ndo_stop = qede_close,
+ .ndo_start_xmit = qede_start_xmit,
++ .ndo_select_queue = qede_select_queue,
+ .ndo_set_rx_mode = qede_set_rx_mode,
+ .ndo_set_mac_address = qede_set_mac_addr,
+ .ndo_validate_addr = eth_validate_addr,
diff --git a/patches.drivers/qede-Register-l2-queues-with-doorbell-overflow-recov.patch b/patches.drivers/qede-Register-l2-queues-with-doorbell-overflow-recov.patch
new file mode 100644
index 0000000000..8a13efcdca
--- /dev/null
+++ b/patches.drivers/qede-Register-l2-queues-with-doorbell-overflow-recov.patch
@@ -0,0 +1,45 @@
+From: Ariel Elior <Ariel.Elior@cavium.com>
+Date: Wed, 28 Nov 2018 18:16:07 +0200
+Subject: qede: Register l2 queues with doorbell overflow recovery mechanism
+Patch-mainline: v5.0-rc1
+Git-commit: bd4db888ab848ac6f9a2a5f8e66bd4d5a99dce6f
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+All L2 queues funnel through this flow, so this would cover the
+regular RSS queues, as well queues created for VFs, mqos queues,
+xdp queues, etc.
+
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: Tomer Tayar <Tomer.Tayar@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qede/qede_main.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -1774,6 +1774,10 @@ static int qede_drain_txq(struct qede_de
+ static int qede_stop_txq(struct qede_dev *edev,
+ struct qede_tx_queue *txq, int rss_id)
+ {
++ /* delete doorbell from doorbell recovery mechanism */
++ edev->ops->common->db_recovery_del(edev->cdev, txq->doorbell_addr,
++ &txq->tx_db);
++
+ return edev->ops->q_tx_stop(edev->cdev, rss_id, txq->handle);
+ }
+
+@@ -1910,6 +1914,11 @@ static int qede_start_txq(struct qede_de
+ DQ_XCM_ETH_TX_BD_PROD_CMD);
+ txq->tx_db.data.agg_flags = DQ_XCM_ETH_DQ_CF_CMD;
+
++ /* register doorbell with doorbell recovery mechanism */
++ rc = edev->ops->common->db_recovery_add(edev->cdev, txq->doorbell_addr,
++ &txq->tx_db, DB_REC_WIDTH_32B,
++ DB_REC_KERNEL);
++
+ return rc;
+ }
+
diff --git a/patches.drivers/qede-Simplify-the-usage-of-qede-flags.patch b/patches.drivers/qede-Simplify-the-usage-of-qede-flags.patch
new file mode 100644
index 0000000000..55b804b595
--- /dev/null
+++ b/patches.drivers/qede-Simplify-the-usage-of-qede-flags.patch
@@ -0,0 +1,91 @@
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 26 Nov 2018 02:26:58 -0800
+Subject: qede: Simplify the usage of qede-flags.
+Patch-mainline: v5.0-rc1
+Git-commit: 149d3775f108c9b97f3309891f010b65e912c7b7
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+The values represented by qede->flags is being used in mixed ways:
+ 1. As 'value' at some places e.g., QEDE_FLAGS_IS_VF usage
+ 2. As bit-mask(value) at some places e.g., QEDE_FLAGS_PTP_TX_IN_PRORGESS
+ usage.
+This implementation pose problems in future when we want to add more flag
+values e.g., overlap of the values, overflow of 64-bit storage.
+
+Updated the implementation to go with approach (2) for qede->flags.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qede/qede.h | 11 +++++++----
+ drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
+ drivers/net/ethernet/qlogic/qede/qede_ptp.c | 6 +++---
+ 3 files changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -168,6 +168,12 @@ struct qede_ptp;
+
+ #define QEDE_RFS_MAX_FLTR 256
+
++enum qede_flags_bit {
++ QEDE_FLAGS_IS_VF = 0,
++ QEDE_FLAGS_PTP_TX_IN_PRORGESS,
++ QEDE_FLAGS_TX_TIMESTAMPING_EN
++};
++
+ struct qede_dev {
+ struct qed_dev *cdev;
+ struct net_device *ndev;
+@@ -177,10 +183,7 @@ struct qede_dev {
+ u8 dp_level;
+
+ unsigned long flags;
+-#define QEDE_FLAG_IS_VF BIT(0)
+-#define IS_VF(edev) (!!((edev)->flags & QEDE_FLAG_IS_VF))
+-#define QEDE_TX_TIMESTAMPING_EN BIT(1)
+-#define QEDE_FLAGS_PTP_TX_IN_PRORGESS BIT(2)
++#define IS_VF(edev) (test_bit(QEDE_FLAGS_IS_VF, &(edev)->flags))
+
+ const struct qed_eth_ops *ops;
+ struct qede_ptp *ptp;
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -1086,7 +1086,7 @@ static int __qede_probe(struct pci_dev *
+ }
+
+ if (is_vf)
+- edev->flags |= QEDE_FLAG_IS_VF;
++ set_bit(QEDE_FLAGS_IS_VF, &edev->flags);
+
+ qede_init_ndev(edev);
+
+--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c
+@@ -223,12 +223,12 @@ static int qede_ptp_cfg_filters(struct q
+
+ switch (ptp->tx_type) {
+ case HWTSTAMP_TX_ON:
+- edev->flags |= QEDE_TX_TIMESTAMPING_EN;
++ set_bit(QEDE_FLAGS_TX_TIMESTAMPING_EN, &edev->flags);
+ tx_type = QED_PTP_HWTSTAMP_TX_ON;
+ break;
+
+ case HWTSTAMP_TX_OFF:
+- edev->flags &= ~QEDE_TX_TIMESTAMPING_EN;
++ clear_bit(QEDE_FLAGS_TX_TIMESTAMPING_EN, &edev->flags);
+ tx_type = QED_PTP_HWTSTAMP_TX_OFF;
+ break;
+
+@@ -518,7 +518,7 @@ void qede_ptp_tx_ts(struct qede_dev *ede
+ if (test_and_set_bit_lock(QEDE_FLAGS_PTP_TX_IN_PRORGESS, &edev->flags))
+ return;
+
+- if (unlikely(!(edev->flags & QEDE_TX_TIMESTAMPING_EN))) {
++ if (unlikely(!test_bit(QEDE_FLAGS_TX_TIMESTAMPING_EN, &edev->flags))) {
+ DP_NOTICE(edev,
+ "Tx timestamping was not enabled, this packet will not be timestamped\n");
+ } else if (unlikely(ptp->tx_skb)) {
diff --git a/patches.drivers/qede-Update-link-status-only-when-interface-is-ready.patch b/patches.drivers/qede-Update-link-status-only-when-interface-is-ready.patch
new file mode 100644
index 0000000000..df764b0f6f
--- /dev/null
+++ b/patches.drivers/qede-Update-link-status-only-when-interface-is-ready.patch
@@ -0,0 +1,66 @@
+From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
+Date: Mon, 26 Nov 2018 02:26:59 -0800
+Subject: qede: Update link status only when interface is ready.
+Patch-mainline: v5.0-rc1
+Git-commit: f04e48dbfaf732e0a9f926057e8f6fd44d45d1bb
+References: bsc#1104393 FATE#325891 bsc#1104389 FATE#325890
+
+In the case of internal reload (e.g., mtu change), there could be a race
+between link-up notification from mfw and the driver unload processing. In
+such case kernel assumes the link is up and starts using the queues which
+leads to the server crash.
+
+Send link notification to the kernel only when driver has already requested
+MFW for the link.
+
+Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@cavium.com>
+Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/qlogic/qede/qede.h | 1 +
+ drivers/net/ethernet/qlogic/qede/qede_main.c | 8 ++++++--
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qede/qede.h
++++ b/drivers/net/ethernet/qlogic/qede/qede.h
+@@ -170,6 +170,7 @@ struct qede_ptp;
+
+ enum qede_flags_bit {
+ QEDE_FLAGS_IS_VF = 0,
++ QEDE_FLAGS_LINK_REQUESTED,
+ QEDE_FLAGS_PTP_TX_IN_PRORGESS,
+ QEDE_FLAGS_TX_TIMESTAMPING_EN
+ };
+--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
+@@ -2057,6 +2057,8 @@ static void qede_unload(struct qede_dev
+ if (!is_locked)
+ __qede_lock(edev);
+
++ clear_bit(QEDE_FLAGS_LINK_REQUESTED, &edev->flags);
++
+ edev->state = QEDE_STATE_CLOSED;
+
+ qede_rdma_dev_event_close(edev);
+@@ -2163,6 +2165,8 @@ static int qede_load(struct qede_dev *ed
+ /* Program un-configured VLANs */
+ qede_configure_vlan_filters(edev);
+
++ set_bit(QEDE_FLAGS_LINK_REQUESTED, &edev->flags);
++
+ /* Ask for link-up using current configuration */
+ memset(&link_params, 0, sizeof(link_params));
+ link_params.link_up = true;
+@@ -2258,8 +2262,8 @@ static void qede_link_update(void *dev,
+ {
+ struct qede_dev *edev = dev;
+
+- if (!netif_running(edev->ndev)) {
+- DP_VERBOSE(edev, NETIF_MSG_LINK, "Interface is not running\n");
++ if (!test_bit(QEDE_FLAGS_LINK_REQUESTED, &edev->flags)) {
++ DP_VERBOSE(edev, NETIF_MSG_LINK, "Interface is not ready\n");
+ return;
+ }
+
diff --git a/patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets b/patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets
new file mode 100644
index 0000000000..8a1268befe
--- /dev/null
+++ b/patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets
@@ -0,0 +1,62 @@
+From: Manish Rangankar <mrangankar@marvell.com>
+Date: Wed, 9 Jan 2019 01:39:07 -0800
+Subject: scsi: qedi: Add ep_state for login completion on un-reachable targets
+Git-commit: 34a2ce887668db9dda4b56e6f155c49ac13f3e54
+Patch-mainline: v5.0-rc3
+References: bsc#1113712
+
+When the driver finds invalid destination MAC for the first un-reachable
+target, and before completes the PATH_REQ operation, set new ep_state to
+OFFLDCONN_NONE so that as part of driver ep_poll mechanism, the upper
+open-iscsi layer is notified to complete the login process on the first
+un-reachable target and thus proceed login to other reachable targets.
+
+Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Acked-by: Lee Duncan <lduncan@suse.com>
+---
+ drivers/scsi/qedi/qedi_iscsi.c | 3 +++
+ drivers/scsi/qedi/qedi_iscsi.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index 4da660c1c431..6d6d6013e35b 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -953,6 +953,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+
+ qedi_ep = ep->dd_data;
+ if (qedi_ep->state == EP_STATE_IDLE ||
++ qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
+ qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
+ return -1;
+
+@@ -1035,6 +1036,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+
+ switch (qedi_ep->state) {
+ case EP_STATE_OFLDCONN_START:
++ case EP_STATE_OFLDCONN_NONE:
+ goto ep_release_conn;
+ case EP_STATE_OFLDCONN_FAILED:
+ break;
+@@ -1225,6 +1227,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+
+ if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
+ QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
++ qedi_ep->state = EP_STATE_OFLDCONN_NONE;
+ ret = -EIO;
+ goto set_path_exit;
+ }
+diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
+index 11260776212f..892d70d54553 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.h
++++ b/drivers/scsi/qedi/qedi_iscsi.h
+@@ -59,6 +59,7 @@ enum {
+ EP_STATE_OFLDCONN_FAILED = 0x2000,
+ EP_STATE_CONNECT_FAILED = 0x4000,
+ EP_STATE_DISCONN_TIMEDOUT = 0x8000,
++ EP_STATE_OFLDCONN_NONE = 0x10000,
+ };
+
+ struct qedi_conn;
+
diff --git a/patches.drivers/svcrdma-Reduce-max_send_sges.patch b/patches.drivers/svcrdma-Reduce-max_send_sges.patch
new file mode 100644
index 0000000000..c80b71863d
--- /dev/null
+++ b/patches.drivers/svcrdma-Reduce-max_send_sges.patch
@@ -0,0 +1,37 @@
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Mon, 1 Oct 2018 14:15:56 -0400
+Subject: svcrdma: Reduce max_send_sges
+Patch-mainline: v4.20-rc1
+Git-commit: f3c1fd0ee294abd4367dfa72d89f016c682202f0
+References: bsc#1103992 FATE#326009
+
+There's no need to request a large number of send SGEs because the
+inline threshold already constrains the number of SGEs per Send.
+
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/sunrpc/xprtrdma/svc_rdma_transport.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -475,10 +475,12 @@ static struct svc_xprt *svc_rdma_accept(
+
+ /* Qualify the transport resource defaults with the
+ * capabilities of this particular device */
+- newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
+- /* transport hdr, head iovec, one page list entry, tail iovec */
+- if (newxprt->sc_max_send_sges < 4) {
+- pr_err("svcrdma: too few Send SGEs available (%d)\n",
++ /* Transport header, head iovec, tail iovec */
++ newxprt->sc_max_send_sges = 3;
++ /* Add one SGE per page list entry */
++ newxprt->sc_max_send_sges += svcrdma_max_req_size / PAGE_SIZE;
++ if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge) {
++ pr_err("svcrdma: too few Send SGEs available (%d needed)\n",
+ newxprt->sc_max_send_sges);
+ goto errout;
+ }
diff --git a/patches.drivers/svcrdma-Remove-max_sge-check-at-connect-time.patch b/patches.drivers/svcrdma-Remove-max_sge-check-at-connect-time.patch
new file mode 100644
index 0000000000..212cdf38b6
--- /dev/null
+++ b/patches.drivers/svcrdma-Remove-max_sge-check-at-connect-time.patch
@@ -0,0 +1,196 @@
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Fri, 25 Jan 2019 16:54:54 -0500
+Subject: svcrdma: Remove max_sge check at connect time
+Patch-mainline: v5.0-rc6
+Git-commit: e248aa7be86e8179f20ac0931774ecd746f3f5bf
+References: bsc#1103992 FATE#326009
+
+Two and a half years ago, the client was changed to use gathered
+Send for larger inline messages, in commit 655fec6987b ("xprtrdma:
+Use gathered Send for large inline messages"). Several fixes were
+required because there are a few in-kernel device drivers whose
+max_sge is 3, and these were broken by the change.
+
+Apparently my memory is going, because some time later, I submitted
+commit 25fd86eca11c ("svcrdma: Don't overrun the SGE array in
+svc_rdma_send_ctxt"), and after that, commit f3c1fd0ee294 ("svcrdma:
+Reduce max_send_sges"). These too incorrectly assumed in-kernel
+device drivers would have more than a few Send SGEs available.
+
+The fix for the server side is not the same. This is because the
+fundamental problem on the server is that, whether or not the client
+has provisioned a chunk for the RPC reply, the server must squeeze
+even the most complex RPC replies into a single RDMA Send. Failing
+in the send path because of Send SGE exhaustion should never be an
+option.
+
+Therefore, instead of failing when the send path runs out of SGEs,
+switch to using a bounce buffer mechanism to handle RPC replies that
+are too complex for the device to send directly. That allows us to
+remove the max_sge check to enable drivers with small max_sge to
+work again.
+
+Reported-by: Don Dutile <ddutile@redhat.com>
+Fixes: 25fd86eca11c ("svcrdma: Don't overrun the SGE array in ...")
+Cc: stable@vger.kernel.org
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/sunrpc/xprtrdma/svc_rdma_sendto.c | 105 +++++++++++++++++++++++++++++--
+ net/sunrpc/xprtrdma/svc_rdma_transport.c | 9 --
+ 2 files changed, 102 insertions(+), 12 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -563,6 +563,99 @@ void svc_rdma_sync_reply_hdr(struct svcx
+ DMA_TO_DEVICE);
+ }
+
++/* If the xdr_buf has more elements than the device can
++ * transmit in a single RDMA Send, then the reply will
++ * have to be copied into a bounce buffer.
++ */
++static bool svc_rdma_pull_up_needed(struct svcxprt_rdma *rdma,
++ struct xdr_buf *xdr,
++ __be32 *wr_lst)
++{
++ int elements;
++
++ /* xdr->head */
++ elements = 1;
++
++ /* xdr->pages */
++ if (!wr_lst) {
++ unsigned int remaining;
++ unsigned long pageoff;
++
++ pageoff = xdr->page_base & ~PAGE_MASK;
++ remaining = xdr->page_len;
++ while (remaining) {
++ ++elements;
++ remaining -= min_t(u32, PAGE_SIZE - pageoff,
++ remaining);
++ pageoff = 0;
++ }
++ }
++
++ /* xdr->tail */
++ if (xdr->tail[0].iov_len)
++ ++elements;
++
++ /* assume 1 SGE is needed for the transport header */
++ return elements >= rdma->sc_max_send_sges;
++}
++
++/* The device is not capable of sending the reply directly.
++ * Assemble the elements of @xdr into the transport header
++ * buffer.
++ */
++static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma,
++ struct svc_rdma_send_ctxt *ctxt,
++ struct xdr_buf *xdr, __be32 *wr_lst)
++{
++ unsigned char *dst, *tailbase;
++ unsigned int taillen;
++
++ dst = ctxt->sc_xprt_buf;
++ dst += ctxt->sc_sges[0].length;
++
++ memcpy(dst, xdr->head[0].iov_base, xdr->head[0].iov_len);
++ dst += xdr->head[0].iov_len;
++
++ tailbase = xdr->tail[0].iov_base;
++ taillen = xdr->tail[0].iov_len;
++ if (wr_lst) {
++ u32 xdrpad;
++
++ xdrpad = xdr_padsize(xdr->page_len);
++ if (taillen && xdrpad) {
++ tailbase += xdrpad;
++ taillen -= xdrpad;
++ }
++ } else {
++ unsigned int len, remaining;
++ unsigned long pageoff;
++ struct page **ppages;
++
++ ppages = xdr->pages + (xdr->page_base >> PAGE_SHIFT);
++ pageoff = xdr->page_base & ~PAGE_MASK;
++ remaining = xdr->page_len;
++ while (remaining) {
++ len = min_t(u32, PAGE_SIZE - pageoff, remaining);
++
++ memcpy(dst, page_address(*ppages), len);
++ remaining -= len;
++ dst += len;
++ pageoff = 0;
++ }
++ }
++
++ if (taillen)
++ memcpy(dst, tailbase, taillen);
++
++ ctxt->sc_sges[0].length += xdr->len;
++ ib_dma_sync_single_for_device(rdma->sc_pd->device,
++ ctxt->sc_sges[0].addr,
++ ctxt->sc_sges[0].length,
++ DMA_TO_DEVICE);
++
++ return 0;
++}
++
+ /* svc_rdma_map_reply_msg - Map the buffer holding RPC message
+ * @rdma: controlling transport
+ * @ctxt: send_ctxt for the Send WR
+@@ -585,8 +678,10 @@ int svc_rdma_map_reply_msg(struct svcxpr
+ u32 xdr_pad;
+ int ret;
+
+- if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+- return -EIO;
++ if (svc_rdma_pull_up_needed(rdma, xdr, wr_lst))
++ return svc_rdma_pull_up_reply_msg(rdma, ctxt, xdr, wr_lst);
++
++ ++ctxt->sc_cur_sge_no;
+ ret = svc_rdma_dma_map_buf(rdma, ctxt,
+ xdr->head[0].iov_base,
+ xdr->head[0].iov_len);
+@@ -617,8 +712,7 @@ int svc_rdma_map_reply_msg(struct svcxpr
+ while (remaining) {
+ len = min_t(u32, PAGE_SIZE - page_off, remaining);
+
+- if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+- return -EIO;
++ ++ctxt->sc_cur_sge_no;
+ ret = svc_rdma_dma_map_page(rdma, ctxt, *ppages++,
+ page_off, len);
+ if (ret < 0)
+@@ -632,8 +726,7 @@ int svc_rdma_map_reply_msg(struct svcxpr
+ len = xdr->tail[0].iov_len;
+ tail:
+ if (len) {
+- if (++ctxt->sc_cur_sge_no >= rdma->sc_max_send_sges)
+- return -EIO;
++ ++ctxt->sc_cur_sge_no;
+ ret = svc_rdma_dma_map_buf(rdma, ctxt, base, len);
+ if (ret < 0)
+ return ret;
+--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
+@@ -478,12 +478,9 @@ static struct svc_xprt *svc_rdma_accept(
+ /* Transport header, head iovec, tail iovec */
+ newxprt->sc_max_send_sges = 3;
+ /* Add one SGE per page list entry */
+- newxprt->sc_max_send_sges += svcrdma_max_req_size / PAGE_SIZE;
+- if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge) {
+- pr_err("svcrdma: too few Send SGEs available (%d needed)\n",
+- newxprt->sc_max_send_sges);
+- goto errout;
+- }
++ newxprt->sc_max_send_sges += (svcrdma_max_req_size / PAGE_SIZE) + 1;
++ if (newxprt->sc_max_send_sges > dev->attrs.max_send_sge)
++ newxprt->sc_max_send_sges = dev->attrs.max_send_sge;
+ newxprt->sc_max_req_size = svcrdma_max_req_size;
+ newxprt->sc_max_requests = svcrdma_max_requests;
+ newxprt->sc_max_bc_requests = svcrdma_max_bc_requests;
diff --git a/patches.drivers/tun-move-the-call-to-tun_set_real_num_queues.patch b/patches.drivers/tun-move-the-call-to-tun_set_real_num_queues.patch
new file mode 100644
index 0000000000..f4edced6dd
--- /dev/null
+++ b/patches.drivers/tun-move-the-call-to-tun_set_real_num_queues.patch
@@ -0,0 +1,41 @@
+From: George Amanakis <gamanakis@gmail.com>
+Date: Tue, 29 Jan 2019 22:50:13 -0500
+Subject: tun: move the call to tun_set_real_num_queues
+Patch-mainline: v5.0-rc6
+Git-commit: 3a03cb8456cc1d61c467a5375e0a10e5207b948c
+References: bsc#1109837
+
+Call tun_set_real_num_queues() after the increment of tun->numqueues
+since the former depends on it. Otherwise, the number of queues is not
+correctly accounted for, which results to warnings similar to:
+"vnet0 selects TX queue 11, but real number of TX queues is 11".
+
+Fixes: 0b7959b62573 ("tun: publish tfile after it's fully initialized")
+Reported-and-tested-by: George Amanakis <gamanakis@gmail.com>
+Signed-off-by: George Amanakis <gamanakis@gmail.com>
+Signed-off-by: Stanislav Fomichev <sdf@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/tun.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -861,8 +861,6 @@ static int tun_attach(struct tun_struct
+ if (rtnl_dereference(tun->xdp_prog))
+ sock_set_flag(&tfile->sk, SOCK_XDP);
+
+- tun_set_real_num_queues(tun);
+-
+ /* device is allowed to go away first, so no need to hold extra
+ * refcnt.
+ */
+@@ -874,6 +872,7 @@ static int tun_attach(struct tun_struct
+ rcu_assign_pointer(tfile->tun, tun);
+ rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
+ tun->numqueues++;
++ tun_set_real_num_queues(tun);
+ out:
+ return err;
+ }
diff --git a/patches.drivers/usb-typec-tcpm-correct-the-pps-out_volt-calculation.patch b/patches.drivers/usb-typec-tcpm-correct-the-pps-out_volt-calculation.patch
new file mode 100644
index 0000000000..93fa735ae7
--- /dev/null
+++ b/patches.drivers/usb-typec-tcpm-correct-the-pps-out_volt-calculation.patch
@@ -0,0 +1,46 @@
+From: Kyle Tso <kyletso@google.com>
+Date: Wed, 30 Jan 2019 11:13:53 +0800
+Subject: usb: typec: tcpm: Correct the PPS out_volt calculation
+Git-commit: a07ddce4df807e41a85245e769b6f6f14f0c6db0
+Patch-mainline: v5.0-rc6
+References: git-fixes
+
+When Sink negotiates PPS, the voltage range of selected PPS APDO might
+not cover the previous voltage (out_volt). If the previous out_volt is
+lower than the new min_volt, the output voltage in RDO might be set to
+an invalid value. For instance, supposed that the previous voltage is
+5V, and the new voltage range in the APDO is 7V-12V. Then the output
+voltage in the RDO should not be set to 5V which is lower than the
+possible min_volt 7V.
+
+Fix this by choosing the maximal value between the previous voltage and
+the new min_volt first. And ensure that this value will not exceed the
+new max_volt. The new out_volt will fall within the new voltage range
+while being the closest value compared to the previous out_volt.
+
+Signed-off-by: Kyle Tso <kyletso@google.com>
+Reviewed-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Fixes: c710d0bb76ff0 ("usb: typec: tcpm: Extend the matching rules on PPS APDO selection")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
+---
+ drivers/usb/typec/tcpm/tcpm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/usb/typec/tcpm/tcpm.c b/drivers/usb/typec/tcpm/tcpm.c
+index 4bc29b586698..f1c39a3c7534 100644
+--- a/drivers/usb/typec/tcpm/tcpm.c
++++ b/drivers/usb/typec/tcpm/tcpm.c
+@@ -2297,7 +2297,8 @@ static unsigned int tcpm_pd_select_pps_apdo(struct tcpm_port *port)
+ pdo_pps_apdo_max_voltage(snk));
+ port->pps_data.max_curr = min_pps_apdo_current(src, snk);
+ port->pps_data.out_volt = min(port->pps_data.max_volt,
+- port->pps_data.out_volt);
++ max(port->pps_data.min_volt,
++ port->pps_data.out_volt));
+ port->pps_data.op_curr = min(port->pps_data.max_curr,
+ port->pps_data.op_curr);
+ }
+
diff --git a/patches.drivers/vfio-ccw-fix-cleanup-if-cp_prefetch-fails b/patches.drivers/vfio-ccw-fix-cleanup-if-cp_prefetch-fails
new file mode 100644
index 0000000000..73b4665653
--- /dev/null
+++ b/patches.drivers/vfio-ccw-fix-cleanup-if-cp_prefetch-fails
@@ -0,0 +1,66 @@
+From: Halil Pasic <pasic@linux.vnet.ibm.com>
+Date: Tue, 24 Apr 2018 13:26:56 +0200
+Subject: vfio: ccw: fix cleanup if cp_prefetch fails
+Git-commit: d66a7355717ec903d455277a550d930ba13df4a8
+Patch-mainline: v4.17-rc6
+References: git-fixes
+
+If the translation of a channel program fails, we may end up attempting
+to clean up (free, unpin) stuff that never got translated (and allocated,
+pinned) in the first place.
+
+By adjusting the lengths of the chains accordingly (so the element that
+failed, and all subsequent elements are excluded) cleanup activities
+based on false assumptions can be avoided.
+
+Let's make sure cp_free works properly after cp_prefetch returns with an
+error by setting ch_len of a ccw chain to the number of the translated
+CCWs on that chain.
+
+Cc: stable@vger.kernel.org #v4.12+
+Acked-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
+Reviewed-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+Signed-off-by: Halil Pasic <pasic@linux.vnet.ibm.com>
+Signed-off-by: Dong Jia Shi <bjsdjshi@linux.vnet.ibm.com>
+Message-Id: <20180423110113.59385-2-bjsdjshi@linux.vnet.ibm.com>
+[CH: fixed typos]
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/cio/vfio_ccw_cp.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/cio/vfio_ccw_cp.c
++++ b/drivers/s390/cio/vfio_ccw_cp.c
+@@ -700,6 +700,10 @@ void cp_free(struct channel_program *cp)
+ * and stores the result to ccwchain list. @cp must have been
+ * initialized by a previous call with cp_init(). Otherwise, undefined
+ * behavior occurs.
++ * For each chain composing the channel program:
++ * - On entry ch_len holds the count of CCWs to be translated.
++ * - On exit ch_len is adjusted to the count of successfully translated CCWs.
++ * This allows cp_free to find in ch_len the count of CCWs to free in a chain.
+ *
+ * The S/390 CCW Translation APIS (prefixed by 'cp_') are introduced
+ * as helpers to do ccw chain translation inside the kernel. Basically
+@@ -734,11 +738,18 @@ int cp_prefetch(struct channel_program *
+ for (idx = 0; idx < len; idx++) {
+ ret = ccwchain_fetch_one(chain, idx, cp);
+ if (ret)
+- return ret;
++ goto out_err;
+ }
+ }
+
+ return 0;
++out_err:
++ /* Only cleanup the chain elements that were actually translated. */
++ chain->ch_len = idx;
++ list_for_each_entry_continue(chain, &cp->ccwchain_list, next) {
++ chain->ch_len = 0;
++ }
++ return ret;
+ }
+
+ /**
diff --git a/patches.drivers/vfio-ccw-process-ssch-with-interrupts-disabled b/patches.drivers/vfio-ccw-process-ssch-with-interrupts-disabled
new file mode 100644
index 0000000000..063b17baac
--- /dev/null
+++ b/patches.drivers/vfio-ccw-process-ssch-with-interrupts-disabled
@@ -0,0 +1,75 @@
+From: Cornelia Huck <cohuck@redhat.com>
+Date: Fri, 20 Apr 2018 10:24:04 +0200
+Subject: vfio: ccw: process ssch with interrupts disabled
+Git-commit: 3368e547c52b96586f0edf9657ca12b94d8e61a7
+Patch-mainline: v4.17-rc3
+References: git-fixes
+
+When we call ssch, an interrupt might already be pending once we
+return from the START SUBCHANNEL instruction. Therefore we need to
+make sure interrupts are disabled while holding the subchannel lock
+until after we're done with our processing.
+
+Cc: stable@vger.kernel.org #v4.12+
+Reviewed-by: Dong Jia Shi <bjsdjshi@linux.ibm.com>
+Acked-by: Halil Pasic <pasic@linux.vnet.ibm.com>
+Acked-by: Pierre Morel <pmorel@linux.vnet.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/cio/vfio_ccw_fsm.c | 19 ++++++++++++-------
+ 1 file changed, 12 insertions(+), 7 deletions(-)
+
+--- a/drivers/s390/cio/vfio_ccw_fsm.c
++++ b/drivers/s390/cio/vfio_ccw_fsm.c
+@@ -19,12 +19,12 @@ static int fsm_io_helper(struct vfio_ccw
+ int ccode;
+ __u8 lpm;
+ unsigned long flags;
++ int ret;
+
+ sch = private->sch;
+
+ spin_lock_irqsave(sch->lock, flags);
+ private->state = VFIO_CCW_STATE_BUSY;
+- spin_unlock_irqrestore(sch->lock, flags);
+
+ orb = cp_get_orb(&private->cp, (u32)(addr_t)sch, sch->lpm);
+
+@@ -37,10 +37,12 @@ static int fsm_io_helper(struct vfio_ccw
+ * Initialize device status information
+ */
+ sch->schib.scsw.cmd.actl |= SCSW_ACTL_START_PEND;
+- return 0;
++ ret = 0;
++ break;
+ case 1: /* Status pending */
+ case 2: /* Busy */
+- return -EBUSY;
++ ret = -EBUSY;
++ break;
+ case 3: /* Device/path not operational */
+ {
+ lpm = orb->cmd.lpm;
+@@ -50,13 +52,16 @@ static int fsm_io_helper(struct vfio_ccw
+ sch->lpm = 0;
+
+ if (cio_update_schib(sch))
+- return -ENODEV;
+-
+- return sch->lpm ? -EACCES : -ENODEV;
++ ret = -ENODEV;
++ else
++ ret = sch->lpm ? -EACCES : -ENODEV;
++ break;
+ }
+ default:
+- return ccode;
++ ret = ccode;
+ }
++ spin_unlock_irqrestore(sch->lock, flags);
++ return ret;
+ }
+
+ static void fsm_notoper(struct vfio_ccw_private *private,
diff --git a/patches.drivers/virtio_net-Account-for-tx-bytes-and-packets-on-sendi.patch b/patches.drivers/virtio_net-Account-for-tx-bytes-and-packets-on-sendi.patch
new file mode 100644
index 0000000000..f75f41069c
--- /dev/null
+++ b/patches.drivers/virtio_net-Account-for-tx-bytes-and-packets-on-sendi.patch
@@ -0,0 +1,63 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Thu, 31 Jan 2019 20:40:30 +0900
+Subject: virtio_net: Account for tx bytes and packets on sending xdp_frames
+Patch-mainline: v5.0-rc6
+Git-commit: 546f28974d771b124fb0bf7b551b343888cf0419
+References: bsc#1109837
+
+Previously virtnet_xdp_xmit() did not account for device tx counters,
+which caused confusions.
+To be consistent with SKBs, account them on freeing xdp_frames.
+
+Reported-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -502,6 +502,8 @@ static int virtnet_xdp_xmit(struct net_d
+ struct bpf_prog *xdp_prog;
+ struct send_queue *sq;
+ unsigned int len;
++ int packets = 0;
++ int bytes = 0;
+ int drops = 0;
+ int kicks = 0;
+ int ret, err;
+@@ -525,10 +527,18 @@ static int virtnet_xdp_xmit(struct net_d
+
+ /* Free up any pending old buffers before queueing new ones. */
+ while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+- if (likely(is_xdp_frame(ptr)))
+- xdp_return_frame(ptr_to_xdp(ptr));
+- else
+- napi_consume_skb(ptr, false);
++ if (likely(is_xdp_frame(ptr))) {
++ struct xdp_frame *frame = ptr_to_xdp(ptr);
++
++ bytes += frame->len;
++ xdp_return_frame(frame);
++ } else {
++ struct sk_buff *skb = ptr;
++
++ bytes += skb->len;
++ napi_consume_skb(skb, false);
++ }
++ packets++;
+ }
+
+ for (i = 0; i < n; i++) {
+@@ -548,6 +558,8 @@ static int virtnet_xdp_xmit(struct net_d
+ }
+ out:
+ u64_stats_update_begin(&sq->stats.syncp);
++ sq->stats.bytes += bytes;
++ sq->stats.packets += packets;
+ sq->stats.xdp_tx += n;
+ sq->stats.xdp_tx_drops += drops;
+ sq->stats.kicks += kicks;
diff --git a/patches.drivers/virtio_net-Differentiate-sk_buff-and-xdp_frame-on-fr.patch b/patches.drivers/virtio_net-Differentiate-sk_buff-and-xdp_frame-on-fr.patch
new file mode 100644
index 0000000000..6b5d13e97f
--- /dev/null
+++ b/patches.drivers/virtio_net-Differentiate-sk_buff-and-xdp_frame-on-fr.patch
@@ -0,0 +1,153 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:59 +0900
+Subject: virtio_net: Differentiate sk_buff and xdp_frame on freeing
+Patch-mainline: v5.0-rc6
+Git-commit: 5050471d35d1316ba32dfcbb409978337eb9e75e
+References: bsc#1109837
+
+We do not reset or free up unused buffers when enabling/disabling XDP,
+so it can happen that xdp_frames are freed after disabling XDP or
+sk_buffs are freed after enabling XDP on xdp tx queues.
+Thus we need to handle both forms (xdp_frames and sk_buffs) regardless
+of XDP setting.
+One way to trigger this problem is to disable XDP when napi_tx is
+enabled. In that case, virtnet_xdp_set() calls virtnet_napi_enable()
+which kicks NAPI. The NAPI handler will call virtnet_poll_cleantx()
+which invokes free_old_xmit_skbs() for queues which have been used by
+XDP.
+
+Note that even with this change we need to keep skipping
+free_old_xmit_skbs() from NAPI handlers when XDP is enabled, because XDP
+tx queues do not aquire queue locks.
+
+- v2: Use napi_consume_skb() instead of dev_consume_skb_any()
+
+Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 54 ++++++++++++++++++++++++++++++++++++-----------
+ 1 file changed, 42 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -57,6 +57,8 @@ module_param(napi_tx, bool, 0644);
+ #define VIRTIO_XDP_TX BIT(0)
+ #define VIRTIO_XDP_REDIR BIT(1)
+
++#define VIRTIO_XDP_FLAG BIT(0)
++
+ /* RX packet size EWMA. The average packet size is used to determine the packet
+ * buffer size when refilling RX rings. As the entire RX ring may be refilled
+ * at once, the weight is chosen so that the EWMA will be insensitive to short-
+@@ -251,6 +253,21 @@ struct padded_vnet_hdr {
+ char padding[4];
+ };
+
++static bool is_xdp_frame(void *ptr)
++{
++ return (unsigned long)ptr & VIRTIO_XDP_FLAG;
++}
++
++static void *xdp_to_ptr(struct xdp_frame *ptr)
++{
++ return (void *)((unsigned long)ptr | VIRTIO_XDP_FLAG);
++}
++
++static struct xdp_frame *ptr_to_xdp(void *ptr)
++{
++ return (struct xdp_frame *)((unsigned long)ptr & ~VIRTIO_XDP_FLAG);
++}
++
+ /* Converting between virtqueue no. and kernel tx/rx queue no.
+ * 0:rx0 1:tx0 2:rx1 3:tx1 ... 2N:rxN 2N+1:txN 2N+2:cvq
+ */
+@@ -461,7 +478,8 @@ static int __virtnet_xdp_xmit_one(struct
+
+ sg_init_one(sq->sg, xdpf->data, xdpf->len);
+
+- err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdpf, GFP_ATOMIC);
++ err = virtqueue_add_outbuf(sq->vq, sq->sg, 1, xdp_to_ptr(xdpf),
++ GFP_ATOMIC);
+ if (unlikely(err))
+ return -ENOSPC; /* Caller handle free/refcnt */
+
+@@ -481,13 +499,13 @@ static int virtnet_xdp_xmit(struct net_d
+ {
+ struct virtnet_info *vi = netdev_priv(dev);
+ struct receive_queue *rq = vi->rq;
+- struct xdp_frame *xdpf_sent;
+ struct bpf_prog *xdp_prog;
+ struct send_queue *sq;
+ unsigned int len;
+ int drops = 0;
+ int kicks = 0;
+ int ret, err;
++ void *ptr;
+ int i;
+
+ /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
+@@ -506,8 +524,12 @@ static int virtnet_xdp_xmit(struct net_d
+ }
+
+ /* Free up any pending old buffers before queueing new ones. */
+- while ((xdpf_sent = virtqueue_get_buf(sq->vq, &len)) != NULL)
+- xdp_return_frame(xdpf_sent);
++ while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
++ if (likely(is_xdp_frame(ptr)))
++ xdp_return_frame(ptr_to_xdp(ptr));
++ else
++ napi_consume_skb(ptr, false);
++ }
+
+ for (i = 0; i < n; i++) {
+ struct xdp_frame *xdpf = frames[i];
+@@ -1329,18 +1351,26 @@ static int virtnet_receive(struct receiv
+
+ static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
+ {
+- struct sk_buff *skb;
+ unsigned int len;
+ unsigned int packets = 0;
+ unsigned int bytes = 0;
++ void *ptr;
+
+- while ((skb = virtqueue_get_buf(sq->vq, &len)) != NULL) {
+- pr_debug("Sent skb %p\n", skb);
++ while ((ptr = virtqueue_get_buf(sq->vq, &len)) != NULL) {
++ if (likely(!is_xdp_frame(ptr))) {
++ struct sk_buff *skb = ptr;
+
+- bytes += skb->len;
+- packets++;
++ pr_debug("Sent skb %p\n", skb);
+
+- napi_consume_skb(skb, in_napi);
++ bytes += skb->len;
++ napi_consume_skb(skb, in_napi);
++ } else {
++ struct xdp_frame *frame = ptr_to_xdp(ptr);
++
++ bytes += frame->len;
++ xdp_return_frame(frame);
++ }
++ packets++;
+ }
+
+ /* Avoid overhead when no packets have been processed
+@@ -2640,10 +2670,10 @@ static void free_unused_bufs(struct virt
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ struct virtqueue *vq = vi->sq[i].vq;
+ while ((buf = virtqueue_detach_unused_buf(vq)) != NULL) {
+- if (!is_xdp_raw_buffer_queue(vi, i))
++ if (!is_xdp_frame(buf))
+ dev_kfree_skb(buf);
+ else
+- xdp_return_frame(buf);
++ xdp_return_frame(ptr_to_xdp(buf));
+ }
+ }
+
diff --git a/patches.drivers/virtio_net-Don-t-call-free_old_xmit_skbs-for-xdp_fra.patch b/patches.drivers/virtio_net-Don-t-call-free_old_xmit_skbs-for-xdp_fra.patch
new file mode 100644
index 0000000000..ce6eb7fe9b
--- /dev/null
+++ b/patches.drivers/virtio_net-Don-t-call-free_old_xmit_skbs-for-xdp_fra.patch
@@ -0,0 +1,141 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:54 +0900
+Subject: virtio_net: Don't call free_old_xmit_skbs for xdp_frames
+Patch-mainline: v5.0-rc6
+Git-commit: 534da5e856334fb54cb0272a9fb3afec28ea3aed
+References: bsc#1109837
+
+When napi_tx is enabled, virtnet_poll_cleantx() called
+free_old_xmit_skbs() even for xdp send queue.
+This is bogus since the queue has xdp_frames, not sk_buffs, thus mangled
+device tx bytes counters because skb->len is meaningless value, and even
+triggered oops due to general protection fault on freeing them.
+
+Since xdp send queues do not aquire locks, old xdp_frames should be
+freed only in virtnet_xdp_xmit(), so just skip free_old_xmit_skbs() for
+xdp send queues.
+
+Similarly virtnet_poll_tx() called free_old_xmit_skbs(). This NAPI
+handler is called even without calling start_xmit() because cb for tx is
+by default enabled. Once the handler is called, it enabled the cb again,
+and then the handler would be called again. We don't need this handler
+for XDP, so don't enable cb as well as not calling free_old_xmit_skbs().
+
+Also, we need to disable tx NAPI when disabling XDP, so
+virtnet_poll_tx() can safely access curr_queue_pairs and
+xdp_queue_pairs, which are not atomically updated while disabling XDP.
+
+Fixes: b92f1e6751a6 ("virtio-net: transmit napi")
+Fixes: 7b0411ef4aa6 ("virtio-net: clean tx descriptors from rx napi")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 49 +++++++++++++++++++++++++++++++----------------
+ 1 file changed, 33 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1358,6 +1358,16 @@ static void free_old_xmit_skbs(struct se
+ u64_stats_update_end(&sq->stats.syncp);
+ }
+
++static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
++{
++ if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
++ return false;
++ else if (q < vi->curr_queue_pairs)
++ return true;
++ else
++ return false;
++}
++
+ static void virtnet_poll_cleantx(struct receive_queue *rq)
+ {
+ struct virtnet_info *vi = rq->vq->vdev->priv;
+@@ -1365,7 +1375,7 @@ static void virtnet_poll_cleantx(struct
+ struct send_queue *sq = &vi->sq[index];
+ struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, index);
+
+- if (!sq->napi.weight)
++ if (!sq->napi.weight || is_xdp_raw_buffer_queue(vi, index))
+ return;
+
+ if (__netif_tx_trylock(txq)) {
+@@ -1442,8 +1452,16 @@ static int virtnet_poll_tx(struct napi_s
+ {
+ struct send_queue *sq = container_of(napi, struct send_queue, napi);
+ struct virtnet_info *vi = sq->vq->vdev->priv;
+- struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
++ unsigned int index = vq2txq(sq->vq);
++ struct netdev_queue *txq;
+
++ if (unlikely(is_xdp_raw_buffer_queue(vi, index))) {
++ /* We don't need to enable cb for XDP */
++ napi_complete_done(napi, 0);
++ return 0;
++ }
++
++ txq = netdev_get_tx_queue(vi->dev, index);
+ __netif_tx_lock(txq, raw_smp_processor_id());
+ free_old_xmit_skbs(sq, true);
+ __netif_tx_unlock(txq);
+@@ -2402,9 +2420,12 @@ static int virtnet_xdp_set(struct net_de
+ }
+
+ /* Make sure NAPI is not using any XDP TX queues for RX. */
+- if (netif_running(dev))
+- for (i = 0; i < vi->max_queue_pairs; i++)
++ if (netif_running(dev)) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
+ napi_disable(&vi->rq[i].napi);
++ virtnet_napi_tx_disable(&vi->sq[i].napi);
++ }
++ }
+
+ netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
+ err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
+@@ -2423,16 +2444,22 @@ static int virtnet_xdp_set(struct net_de
+ }
+ if (old_prog)
+ bpf_prog_put(old_prog);
+- if (netif_running(dev))
++ if (netif_running(dev)) {
+ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ virtnet_napi_tx_enable(vi, vi->sq[i].vq,
++ &vi->sq[i].napi);
++ }
+ }
+
+ return 0;
+
+ err:
+ if (netif_running(dev)) {
+- for (i = 0; i < vi->max_queue_pairs; i++)
++ for (i = 0; i < vi->max_queue_pairs; i++) {
+ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ virtnet_napi_tx_enable(vi, vi->sq[i].vq,
++ &vi->sq[i].napi);
++ }
+ }
+ if (prog)
+ bpf_prog_sub(prog, vi->max_queue_pairs - 1);
+@@ -2589,16 +2616,6 @@ static void free_receive_page_frags(stru
+ put_page(vi->rq[i].alloc_frag.page);
+ }
+
+-static bool is_xdp_raw_buffer_queue(struct virtnet_info *vi, int q)
+-{
+- if (q < (vi->curr_queue_pairs - vi->xdp_queue_pairs))
+- return false;
+- else if (q < vi->curr_queue_pairs)
+- return true;
+- else
+- return false;
+-}
+-
+ static void free_unused_bufs(struct virtnet_info *vi)
+ {
+ void *buf;
diff --git a/patches.drivers/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch b/patches.drivers/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch
new file mode 100644
index 0000000000..b45f61fb16
--- /dev/null
+++ b/patches.drivers/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch
@@ -0,0 +1,40 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:53 +0900
+Subject: virtio_net: Don't enable NAPI when interface is down
+Patch-mainline: v5.0-rc6
+Git-commit: 8be4d9a492f88b96d4d3a06c6cbedbc40ca14c83
+References: bsc#1109837
+
+Commit 4e09ff536284 ("virtio-net: disable NAPI only when enabled during
+XDP set") tried to fix inappropriate NAPI enabling/disabling when
+!netif_running(), but was not complete.
+
+On error path virtio_net could enable NAPI even when !netif_running().
+This can cause enabling NAPI twice on virtnet_open(), which would
+trigger BUG_ON() in napi_enable().
+
+Fixes: 4941d472bf95b ("virtio-net: do not reset during XDP set")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2430,8 +2430,10 @@ static int virtnet_xdp_set(struct net_de
+ return 0;
+
+ err:
+- for (i = 0; i < vi->max_queue_pairs; i++)
+- virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ if (netif_running(dev)) {
++ for (i = 0; i < vi->max_queue_pairs; i++)
++ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
++ }
+ if (prog)
+ bpf_prog_sub(prog, vi->max_queue_pairs - 1);
+ return err;
diff --git a/patches.drivers/virtio_net-Don-t-process-redirected-XDP-frames-when-.patch b/patches.drivers/virtio_net-Don-t-process-redirected-XDP-frames-when-.patch
new file mode 100644
index 0000000000..07908e0271
--- /dev/null
+++ b/patches.drivers/virtio_net-Don-t-process-redirected-XDP-frames-when-.patch
@@ -0,0 +1,119 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:57 +0900
+Subject: virtio_net: Don't process redirected XDP frames when XDP is disabled
+Patch-mainline: v5.0-rc6
+Git-commit: 03aa6d34868c07b2b1b8b2db080602d7ec528173
+References: bsc#1109837
+
+Commit 8dcc5b0ab0ec ("virtio_net: fix ndo_xdp_xmit crash towards dev not
+ready for XDP") tried to avoid access to unexpected sq while XDP is
+disabled, but was not complete.
+
+There was a small window which causes out of bounds sq access in
+virtnet_xdp_xmit() while disabling XDP.
+
+An example case of
+ - curr_queue_pairs = 6 (2 for SKB and 4 for XDP)
+ - online_cpu_num = xdp_queue_paris = 4
+when XDP is enabled:
+
+CPU 0 CPU 1
+(Disabling XDP) (Processing redirected XDP frames)
+
+ virtnet_xdp_xmit()
+virtnet_xdp_set()
+ _virtnet_set_queues()
+ set curr_queue_pairs (2)
+ check if rq->xdp_prog is not NULL
+ virtnet_xdp_sq(vi)
+ qp = curr_queue_pairs -
+ xdp_queue_pairs +
+ smp_processor_id()
+ = 2 - 4 + 1 = -1
+ sq = &vi->sq[qp] // out of bounds access
+ set xdp_queue_pairs (0)
+ rq->xdp_prog = NULL
+
+Basically we should not change curr_queue_pairs and xdp_queue_pairs
+while someone can read the values. Thus, when disabling XDP, assign NULL
+to rq->xdp_prog first, and wait for RCU grace period, then change
+xxx_queue_pairs.
+Note that we need to keep the current order when enabling XDP though.
+
+- v2: Make rcu_assign_pointer/synchronize_net conditional instead of
+ _virtnet_set_queues.
+
+Fixes: 186b3c998c50 ("virtio-net: support XDP_REDIRECT")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 33 ++++++++++++++++++++++++++-------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2410,6 +2410,10 @@ static int virtnet_xdp_set(struct net_de
+ return -ENOMEM;
+ }
+
++ old_prog = rtnl_dereference(vi->rq[0].xdp_prog);
++ if (!prog && !old_prog)
++ return 0;
++
+ if (prog) {
+ prog = bpf_prog_add(prog, vi->max_queue_pairs - 1);
+ if (IS_ERR(prog))
+@@ -2424,21 +2428,30 @@ static int virtnet_xdp_set(struct net_de
+ }
+ }
+
++ if (!prog) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
++ rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
++ if (i == 0)
++ virtnet_restore_guest_offloads(vi);
++ }
++ synchronize_net();
++ }
++
+ err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
+ if (err)
+ goto err;
+ netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
+ vi->xdp_queue_pairs = xdp_qp;
+
+- for (i = 0; i < vi->max_queue_pairs; i++) {
+- old_prog = rtnl_dereference(vi->rq[i].xdp_prog);
+- rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
+- if (i == 0) {
+- if (!old_prog)
++ if (prog) {
++ for (i = 0; i < vi->max_queue_pairs; i++) {
++ rcu_assign_pointer(vi->rq[i].xdp_prog, prog);
++ if (i == 0 && !old_prog)
+ virtnet_clear_guest_offloads(vi);
+- if (!prog)
+- virtnet_restore_guest_offloads(vi);
+ }
++ }
++
++ for (i = 0; i < vi->max_queue_pairs; i++) {
+ if (old_prog)
+ bpf_prog_put(old_prog);
+ if (netif_running(dev)) {
+@@ -2451,6 +2464,12 @@ static int virtnet_xdp_set(struct net_de
+ return 0;
+
+ err:
++ if (!prog) {
++ virtnet_clear_guest_offloads(vi);
++ for (i = 0; i < vi->max_queue_pairs; i++)
++ rcu_assign_pointer(vi->rq[i].xdp_prog, old_prog);
++ }
++
+ if (netif_running(dev)) {
+ for (i = 0; i < vi->max_queue_pairs; i++) {
+ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi);
diff --git a/patches.drivers/virtio_net-Fix-not-restoring-real_num_rx_queues.patch b/patches.drivers/virtio_net-Fix-not-restoring-real_num_rx_queues.patch
new file mode 100644
index 0000000000..651ab7c5a2
--- /dev/null
+++ b/patches.drivers/virtio_net-Fix-not-restoring-real_num_rx_queues.patch
@@ -0,0 +1,36 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:55 +0900
+Subject: virtio_net: Fix not restoring real_num_rx_queues
+Patch-mainline: v5.0-rc6
+Git-commit: 188313c137c4f76afd0862f50dbc185b198b9e2a
+References: bsc#1109837
+
+When _virtnet_set_queues() failed we did not restore real_num_rx_queues.
+Fix this by placing the change of real_num_rx_queues after
+_virtnet_set_queues().
+This order is also in line with virtnet_set_channels().
+
+Fixes: 4941d472bf95 ("virtio-net: do not reset during XDP set")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2427,10 +2427,10 @@ static int virtnet_xdp_set(struct net_de
+ }
+ }
+
+- netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
+ err = _virtnet_set_queues(vi, curr_qp + xdp_qp);
+ if (err)
+ goto err;
++ netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp);
+ vi->xdp_queue_pairs = xdp_qp;
+
+ for (i = 0; i < vi->max_queue_pairs; i++) {
diff --git a/patches.drivers/virtio_net-Fix-out-of-bounds-access-of-sq.patch b/patches.drivers/virtio_net-Fix-out-of-bounds-access-of-sq.patch
new file mode 100644
index 0000000000..c5e4da74b0
--- /dev/null
+++ b/patches.drivers/virtio_net-Fix-out-of-bounds-access-of-sq.patch
@@ -0,0 +1,52 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:56 +0900
+Subject: virtio_net: Fix out of bounds access of sq
+Patch-mainline: v5.0-rc6
+Git-commit: 1667c08a9d31c7cdf09f4890816bfbf20b685495
+References: bsc#1109837
+
+When XDP is disabled, curr_queue_pairs + smp_processor_id() can be
+larger than max_queue_pairs.
+There is no guarantee that we have enough XDP send queues dedicated for
+each cpu when XDP is disabled, so do not count drops on sq in that case.
+
+Fixes: 5b8f3c8d30a6 ("virtio_net: Add XDP related stats")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 17 +++++++----------
+ 1 file changed, 7 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -490,20 +490,17 @@ static int virtnet_xdp_xmit(struct net_d
+ int ret, err;
+ int i;
+
+- sq = virtnet_xdp_sq(vi);
+-
+- if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
+- ret = -EINVAL;
+- drops = n;
+- goto out;
+- }
+-
+ /* Only allow ndo_xdp_xmit if XDP is loaded on dev, as this
+ * indicate XDP resources have been successfully allocated.
+ */
+ xdp_prog = rcu_dereference(rq->xdp_prog);
+- if (!xdp_prog) {
+- ret = -ENXIO;
++ if (!xdp_prog)
++ return -ENXIO;
++
++ sq = virtnet_xdp_sq(vi);
++
++ if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) {
++ ret = -EINVAL;
+ drops = n;
+ goto out;
+ }
diff --git a/patches.drivers/virtio_net-Use-xdp_return_frame-to-free-xdp_frames-o.patch b/patches.drivers/virtio_net-Use-xdp_return_frame-to-free-xdp_frames-o.patch
new file mode 100644
index 0000000000..956de1af6d
--- /dev/null
+++ b/patches.drivers/virtio_net-Use-xdp_return_frame-to-free-xdp_frames-o.patch
@@ -0,0 +1,32 @@
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Tue, 29 Jan 2019 09:45:58 +0900
+Subject: virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs
+Patch-mainline: v5.0-rc6
+Git-commit: 07b344f494ddda9f061b396407c96df8c46c82b5
+References: bsc#1109837
+
+put_page() can work as a fallback for freeing xdp_frames, but the
+appropriate way is to use xdp_return_frame().
+
+Fixes: cac320c850ef ("virtio_net: convert to use generic xdp_frame and xdp_return_frame API")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -2643,7 +2643,7 @@ static void free_unused_bufs(struct virt
+ if (!is_xdp_raw_buffer_queue(vi, i))
+ dev_kfree_skb(buf);
+ else
+- put_page(virt_to_head_page(buf));
++ xdp_return_frame(buf);
+ }
+ }
+
diff --git a/patches.drivers/virtio_net-bulk-free-tx-skbs.patch b/patches.drivers/virtio_net-bulk-free-tx-skbs.patch
new file mode 100644
index 0000000000..d5d84f5be7
--- /dev/null
+++ b/patches.drivers/virtio_net-bulk-free-tx-skbs.patch
@@ -0,0 +1,75 @@
+From: "Michael S. Tsirkin" <mst@redhat.com>
+Date: Thu, 17 Jan 2019 23:20:07 -0500
+Subject: virtio_net: bulk free tx skbs
+Patch-mainline: v5.0-rc3
+Git-commit: df133f3f96257ee29696c0ed8bd198ec801dc810
+References: bsc#1109837
+
+Use napi_consume_skb() to get bulk free. Note that napi_consume_skb is
+safe to call in a non-napi context as long as the napi_budget flag is
+correct.
+
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/virtio_net.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1330,7 +1330,7 @@ static int virtnet_receive(struct receiv
+ return stats.packets;
+ }
+
+-static void free_old_xmit_skbs(struct send_queue *sq)
++static void free_old_xmit_skbs(struct send_queue *sq, bool in_napi)
+ {
+ struct sk_buff *skb;
+ unsigned int len;
+@@ -1343,7 +1343,7 @@ static void free_old_xmit_skbs(struct se
+ bytes += skb->len;
+ packets++;
+
+- dev_consume_skb_any(skb);
++ napi_consume_skb(skb, in_napi);
+ }
+
+ /* Avoid overhead when no packets have been processed
+@@ -1369,7 +1369,7 @@ static void virtnet_poll_cleantx(struct
+ return;
+
+ if (__netif_tx_trylock(txq)) {
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, true);
+ __netif_tx_unlock(txq);
+ }
+
+@@ -1445,7 +1445,7 @@ static int virtnet_poll_tx(struct napi_s
+ struct netdev_queue *txq = netdev_get_tx_queue(vi->dev, vq2txq(sq->vq));
+
+ __netif_tx_lock(txq, raw_smp_processor_id());
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, true);
+ __netif_tx_unlock(txq);
+
+ virtqueue_napi_complete(napi, sq->vq, 0);
+@@ -1514,7 +1514,7 @@ static netdev_tx_t start_xmit(struct sk_
+ bool use_napi = sq->napi.weight;
+
+ /* Free up any pending old buffers before queueing new ones. */
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, false);
+
+ if (use_napi && kick)
+ virtqueue_enable_cb_delayed(sq->vq);
+@@ -1557,7 +1557,7 @@ static netdev_tx_t start_xmit(struct sk_
+ if (!use_napi &&
+ unlikely(!virtqueue_enable_cb_delayed(sq->vq))) {
+ /* More just got used, free them then recheck. */
+- free_old_xmit_skbs(sq);
++ free_old_xmit_skbs(sq, false);
+ if (sq->vq->num_free >= 2+MAX_SKB_FRAGS) {
+ netif_start_subqueue(dev, qnum);
+ virtqueue_disable_cb(sq->vq);
diff --git a/patches.drm/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch b/patches.drm/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch
new file mode 100644
index 0000000000..707e8376b0
--- /dev/null
+++ b/patches.drm/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch
@@ -0,0 +1,42 @@
+From 4cbfa1e6c09e98450aab3240e5119b0ab2c9795b Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Mon, 28 Jan 2019 10:31:33 +0100
+Subject: drm/vmwgfx: Fix setting of dma masks
+Git-commit: 4cbfa1e6c09e98450aab3240e5119b0ab2c9795b
+Patch-mainline: v5.0-rc6
+References: bsc#1120902
+
+Previously we set only the dma mask and not the coherent mask. Fix that.
+Also, for clarity, make sure both are initially set to 64 bits.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 0d00c488f3de: ("drm/vmwgfx: Fix the driver for large dma addresses")
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -605,13 +605,16 @@ out_fixup:
+ static int vmw_dma_masks(struct vmw_private *dev_priv)
+ {
+ struct drm_device *dev = dev_priv->dev;
++ int ret = 0;
+
+- if (intel_iommu_enabled &&
++ ret = dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(64));
++ if (dev_priv->map_mode != vmw_dma_phys &&
+ (sizeof(unsigned long) == 4 || vmw_restrict_dma_mask)) {
+ DRM_INFO("Restricting DMA addresses to 44 bits.\n");
+- return dma_set_mask(dev->dev, DMA_BIT_MASK(44));
++ return dma_set_mask_and_coherent(dev->dev, DMA_BIT_MASK(44));
+ }
+- return 0;
++
++ return ret;
+ }
+ #else
+ static int vmw_dma_masks(struct vmw_private *dev_priv)
diff --git a/patches.drm/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch b/patches.drm/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch
new file mode 100644
index 0000000000..71fdc81818
--- /dev/null
+++ b/patches.drm/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch
@@ -0,0 +1,41 @@
+From 728354c005c36eaf44b6e5552372b67e60d17f56 Mon Sep 17 00:00:00 2001
+From: Thomas Hellstrom <thellstrom@vmware.com>
+Date: Thu, 31 Jan 2019 10:55:37 +0100
+Subject: drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
+Git-commit: 728354c005c36eaf44b6e5552372b67e60d17f56
+Patch-mainline: v5.0-rc6
+References: bsc#1120902
+
+The function was unconditionally returning 0, and a caller would have to
+rely on the returned fence pointer being NULL to detect errors. However,
+the function vmw_execbuf_copy_fence_user() would expect a non-zero error
+code in that case and would BUG otherwise.
+
+So make sure we return a proper non-zero error code if the fence pointer
+returned is NULL.
+
+Cc: <stable@vger.kernel.org>
+Fixes: ae2a104058e2: ("vmwgfx: Implement fence objects")
+Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
+Reviewed-by: Deepak Rawat <drawat@vmware.com>
+Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index f2d13a72c05d..88b8178d4687 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -3570,7 +3570,7 @@ int vmw_execbuf_fence_commands(struct drm_file *file_priv,
+ *p_fence = NULL;
+ }
+
+- return 0;
++ return ret;
+ }
+
+ /**
+--
+2.20.1
+
diff --git a/patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch b/patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch
index e51cdd1466..a01b20bc19 100644
--- a/patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch
+++ b/patches.fixes/Bluetooth-Verify-that-l2cap_get_conf_opt-provides-la.patch
@@ -5,7 +5,7 @@ Subject: [PATCH] Bluetooth: Verify that l2cap_get_conf_opt provides large
Patch-mainline: Queued in subsystem maintainer repository
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Git-commit: 7c9cbd0b5e38a1672fcd137894ace3b042dfbf69
-References: bsc#1120758 CVE-2019-3459 CVE-2019-3560
+References: bsc#1120758 CVE-2019-3459 CVE-2019-3460
The function l2cap_get_conf_opt will return L2CAP_CONF_OPT_SIZE + opt->len
as length value. The opt->len however is in control over the remote user
diff --git a/patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch b/patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch
new file mode 100644
index 0000000000..345979f827
--- /dev/null
+++ b/patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch
@@ -0,0 +1,87 @@
+From 8208d1708b88b412ca97f50a6d951242c88cbbac Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Fri, 18 Jan 2019 14:08:59 +0000
+Subject: [PATCH] irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size
+Git-commit: 8208d1708b88b412ca97f50a6d951242c88cbbac
+Patch-mainline: v5.0-rc4
+References: bsc#1051510
+
+The way we allocate events works fine in most cases, except
+when multiple PCI devices share an ITS-visible DevID, and that
+one of them is trying to use MultiMSI allocation.
+
+In that case, our allocation is not guaranteed to be zero-based
+anymore, and we have to make sure we allocate it on a boundary
+that is compatible with the PCI Multi-MSI constraints.
+
+Fix this by allocating the full region upfront instead of iterating
+over the number of MSIs. MSI-X are always allocated one by one,
+so this shouldn't change anything on that front.
+
+Fixes: b48ac83d6bbc2 ("irqchip: GICv3: ITS: MSI support")
+Cc: stable@vger.kernel.org
+Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Tested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 25 +++++++++++++------------
+ 1 file changed, 13 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index db20e992a40f..7f2a45445b00 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2399,13 +2399,14 @@ static void its_free_device(struct its_device *its_dev)
+ kfree(its_dev);
+ }
+
+-static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
++static int its_alloc_device_irq(struct its_device *dev, int nvecs, irq_hw_number_t *hwirq)
+ {
+ int idx;
+
+- idx = find_first_zero_bit(dev->event_map.lpi_map,
+- dev->event_map.nr_lpis);
+- if (idx == dev->event_map.nr_lpis)
++ idx = bitmap_find_free_region(dev->event_map.lpi_map,
++ dev->event_map.nr_lpis,
++ get_count_order(nvecs));
++ if (idx < 0)
+ return -ENOSPC;
+
+ *hwirq = dev->event_map.lpi_base + idx;
+@@ -2501,21 +2502,21 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ int err;
+ int i;
+
+- for (i = 0; i < nr_irqs; i++) {
+- err = its_alloc_device_irq(its_dev, &hwirq);
+- if (err)
+- return err;
++ err = its_alloc_device_irq(its_dev, nr_irqs, &hwirq);
++ if (err)
++ return err;
+
+- err = its_irq_gic_domain_alloc(domain, virq + i, hwirq);
++ for (i = 0; i < nr_irqs; i++) {
++ err = its_irq_gic_domain_alloc(domain, virq + i, hwirq + i);
+ if (err)
+ return err;
+
+ irq_domain_set_hwirq_and_chip(domain, virq + i,
+- hwirq, &its_irq_chip, its_dev);
++ hwirq + i, &its_irq_chip, its_dev);
+ irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + i)));
+ pr_debug("ID:%d pID:%d vID:%d\n",
+- (int)(hwirq - its_dev->event_map.lpi_base),
+- (int) hwirq, virq + i);
++ (int)(hwirq + i - its_dev->event_map.lpi_base),
++ (int)(hwirq + i), virq + i);
+ }
+
+ return 0;
+--
+2.16.4
+
diff --git a/patches.fixes/irqchip-gic-v3-its-Don-t-bind-LPI-to-unavailable-NUM.patch b/patches.fixes/irqchip-gic-v3-its-Don-t-bind-LPI-to-unavailable-NUM.patch
new file mode 100644
index 0000000000..d96e88cee7
--- /dev/null
+++ b/patches.fixes/irqchip-gic-v3-its-Don-t-bind-LPI-to-unavailable-NUM.patch
@@ -0,0 +1,53 @@
+From c1797b11a09c8323c92b074fd48b89a936c991d0 Mon Sep 17 00:00:00 2001
+From: Yang Yingliang <yangyingliang@huawei.com>
+Date: Fri, 22 Jun 2018 10:52:51 +0100
+Subject: [PATCH] irqchip/gic-v3-its: Don't bind LPI to unavailable NUMA node
+Git-commit: c1797b11a09c8323c92b074fd48b89a936c991d0
+Patch-mainline: v4.18-rc2
+References: bsc#1051510
+
+On a NUMA system, if an ITS is local to an offline node, the ITS driver may
+pick an offline CPU to bind the LPI. In this case, pick an online CPU (and
+the first one will do).
+
+But on some systems, binding an LPI to non-local node CPU may cause
+deadlock (see Cavium erratum 23144). In this case, just fail the activate
+and return an error code.
+
+Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Jason Cooper <jason@lakedaemon.net>
+Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Cc: Sumit Garg <sumit.garg@linaro.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20180622095254.5906-5-marc.zyngier@arm.com
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/irqchip/irq-gic-v3-its.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 5377d7e2afba..cae53937feeb 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -2310,7 +2310,14 @@ static int its_irq_domain_activate(struct irq_domain *domain,
+ cpu_mask = cpumask_of_node(its_dev->its->numa_node);
+
+ /* Bind the LPI to the first possible CPU */
+- cpu = cpumask_first(cpu_mask);
++ cpu = cpumask_first_and(cpu_mask, cpu_online_mask);
++ if (cpu >= nr_cpu_ids) {
++ if (its_dev->its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144)
++ return -EINVAL;
++
++ cpu = cpumask_first(cpu_online_mask);
++ }
++
+ its_dev->event_map.col_map[event] = cpu;
+ irq_data_update_effective_affinity(d, cpumask_of(cpu));
+
+--
+2.16.4
+
diff --git a/patches.fixes/irqchip-gic-v3-its-Fix-ITT_entry_size-accessor.patch b/patches.fixes/irqchip-gic-v3-its-Fix-ITT_entry_size-accessor.patch
new file mode 100644
index 0000000000..aff604301d
--- /dev/null
+++ b/patches.fixes/irqchip-gic-v3-its-Fix-ITT_entry_size-accessor.patch
@@ -0,0 +1,39 @@
+From 56841070ccc87b463ac037d2d1f2beb8e5e35f0c Mon Sep 17 00:00:00 2001
+From: Zenghui Yu <yuzenghui@huawei.com>
+Date: Thu, 31 Jan 2019 11:19:43 +0000
+Subject: [PATCH] irqchip/gic-v3-its: Fix ITT_entry_size accessor
+Git-commit: 56841070ccc87b463ac037d2d1f2beb8e5e35f0c
+Patch-mainline: v5.0-rc6
+References: bsc#1051510
+
+According to ARM IHI 0069C (ID070116), we should use GITS_TYPER's
+bits [7:4] as ITT_entry_size instead of [8:4]. Although this is
+pretty annoying, it only results in a potential over-allocation
+of memory, and nothing bad happens.
+
+Fixes: 3dfa576bfb45 ("irqchip/gic-v3-its: Add probing for VLPI properties")
+Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
+[maz: massaged subject and commit message]
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/linux/irqchip/arm-gic-v3.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h
+index 071b4cbdf010..c848a7cc502e 100644
+--- a/include/linux/irqchip/arm-gic-v3.h
++++ b/include/linux/irqchip/arm-gic-v3.h
+@@ -319,7 +319,7 @@
+ #define GITS_TYPER_PLPIS (1UL << 0)
+ #define GITS_TYPER_VLPIS (1UL << 1)
+ #define GITS_TYPER_ITT_ENTRY_SIZE_SHIFT 4
+-#define GITS_TYPER_ITT_ENTRY_SIZE(r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0x1f) + 1)
++#define GITS_TYPER_ITT_ENTRY_SIZE(r) ((((r) >> GITS_TYPER_ITT_ENTRY_SIZE_SHIFT) & 0xf) + 1)
+ #define GITS_TYPER_IDBITS_SHIFT 8
+ #define GITS_TYPER_DEVBITS_SHIFT 13
+ #define GITS_TYPER_DEVBITS(r) ((((r) >> GITS_TYPER_DEVBITS_SHIFT) & 0x1f) + 1)
+--
+2.16.4
+
diff --git a/patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch b/patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch
index 65509ea4a1..5cb8c8f987 100644
--- a/patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch
+++ b/patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch
@@ -2,8 +2,7 @@ From: Keith Busch <keith.busch@intel.com>
Date: Mon, 28 Jan 2019 09:46:07 -0700
Subject: [PATCH] nvme: llock NS list changes while handling command effects
Git-commit: e7ad43c3eda6a1690c4c3c341f95dc1c6898da83
-Git-repo: git://git.infradead.org/nvme.git
-Patch-Mainline: queued in upstream maintainer repository
+Patch-Mainline: v5.0-rc6
References: bsc#1123882
If a controller supports the NS Change Notification, the namespace
diff --git a/patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch b/patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
index 55be1c7b36..6a0a1b020e 100644
--- a/patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
+++ b/patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
@@ -3,8 +3,7 @@ From: David Disseldorp <ddiss@suse.de>
Date: Mon, 4 Feb 2019 19:32:10 +0100
Subject: [PATCH] scsi: target: make the pi_prot_format ConfigFS path readable
References: bsc#1123933
-Patch-mainline: Queued in subsystem maintainer repository
-Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git
+Patch-mainline: v5.0-rc6
Git-commit: b6cd7f34ba1354498de03e6882c33f935b071e99
pi_prot_format conversion to write-only caused userspace breakage. Make the
diff --git a/patches.fixes/sysfs-Disable-lockdep-for-driver-bind-unbind-files.patch b/patches.fixes/sysfs-Disable-lockdep-for-driver-bind-unbind-files.patch
new file mode 100644
index 0000000000..837aa22e1b
--- /dev/null
+++ b/patches.fixes/sysfs-Disable-lockdep-for-driver-bind-unbind-files.patch
@@ -0,0 +1,176 @@
+From 4f4b374332ec0ae9c738ff8ec9bed5cd97ff9adc Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Wed, 19 Dec 2018 13:39:09 +0100
+Subject: [PATCH] sysfs: Disable lockdep for driver bind/unbind files
+Git-commit: 4f4b374332ec0ae9c738ff8ec9bed5cd97ff9adc
+Patch-mainline: v5.0-rc1
+References: bsc#1051510
+
+This is the much more correct fix for my earlier attempt at:
+
+https://lkml.org/lkml/2018/12/10/118
+
+Short recap:
+
+- There's not actually a locking issue, it's just lockdep being a bit
+ too eager to complain about a possible deadlock.
+
+- Contrary to what I claimed the real problem is recursion on
+ kn->count. Greg pointed me at sysfs_break_active_protection(), used
+ by the scsi subsystem to allow a sysfs file to unbind itself. That
+ would be a real deadlock, which isn't what's happening here. Also,
+ breaking the active protection means we'd need to manually handle
+ all the lifetime fun.
+
+- With Rafael we discussed the task_work approach, which kinda works,
+ but has two downsides: It's a functional change for a lockdep
+ annotation issue, and it won't work for the bind file (which needs
+ to get the errno from the driver load function back to userspace).
+
+- Greg also asked why this never showed up: To hit this you need to
+ unregister a 2nd driver from the unload code of your first driver. I
+ guess only gpus do that. The bug has always been there, but only
+ with a recent patch series did we add more locks so that lockdep
+ built a chain from unbinding the snd-hda driver to the
+ acpi_video_unregister call.
+
+Full lockdep splat:
+
+[12301.898799] ============================================
+[12301.898805] WARNING: possible recursive locking detected
+[12301.898811] 4.20.0-rc7+ #84 Not tainted
+[12301.898815] --------------------------------------------
+[12301.898821] bash/5297 is trying to acquire lock:
+[12301.898826] 00000000f61c6093 (kn->count#39){++++}, at: kernfs_remove_by_name_ns+0x3b/0x80
+[12301.898841] but task is already holding lock:
+[12301.898847] 000000005f634021 (kn->count#39){++++}, at: kernfs_fop_write+0xdc/0x190
+[12301.898856] other info that might help us debug this:
+[12301.898862] Possible unsafe locking scenario:
+[12301.898867] CPU0
+[12301.898870] ----
+[12301.898874] lock(kn->count#39);
+[12301.898879] lock(kn->count#39);
+[12301.898883] *** DEADLOCK ***
+[12301.898891] May be due to missing lock nesting notation
+[12301.898899] 5 locks held by bash/5297:
+[12301.898903] #0: 00000000cd800e54 (sb_writers#4){.+.+}, at: vfs_write+0x17f/0x1b0
+[12301.898915] #1: 000000000465e7c2 (&of->mutex){+.+.}, at: kernfs_fop_write+0xd3/0x190
+[12301.898925] #2: 000000005f634021 (kn->count#39){++++}, at: kernfs_fop_write+0xdc/0x190
+[12301.898936] #3: 00000000414ef7ac (&dev->mutex){....}, at: device_release_driver_internal+0x34/0x240
+[12301.898950] #4: 000000003218fbdf (register_count_mutex){+.+.}, at: acpi_video_unregister+0xe/0x40
+[12301.898960] stack backtrace:
+[12301.898968] CPU: 1 PID: 5297 Comm: bash Not tainted 4.20.0-rc7+ #84
+[12301.898974] Hardware name: Hewlett-Packard HP EliteBook 8460p/161C, BIOS 68SCF Ver. F.01 03/11/2011
+[12301.898982] Call Trace:
+[12301.898989] dump_stack+0x67/0x9b
+[12301.898997] __lock_acquire+0x6ad/0x1410
+[12301.899003] ? kernfs_remove_by_name_ns+0x3b/0x80
+[12301.899010] ? find_held_lock+0x2d/0x90
+[12301.899017] ? mutex_spin_on_owner+0xe4/0x150
+[12301.899023] ? find_held_lock+0x2d/0x90
+[12301.899030] ? lock_acquire+0x90/0x180
+[12301.899036] lock_acquire+0x90/0x180
+[12301.899042] ? kernfs_remove_by_name_ns+0x3b/0x80
+[12301.899049] __kernfs_remove+0x296/0x310
+[12301.899055] ? kernfs_remove_by_name_ns+0x3b/0x80
+[12301.899060] ? kernfs_name_hash+0xd/0x80
+[12301.899066] ? kernfs_find_ns+0x6c/0x100
+[12301.899073] kernfs_remove_by_name_ns+0x3b/0x80
+[12301.899080] bus_remove_driver+0x92/0xa0
+[12301.899085] acpi_video_unregister+0x24/0x40
+[12301.899127] i915_driver_unload+0x42/0x130 [i915]
+[12301.899160] i915_pci_remove+0x19/0x30 [i915]
+[12301.899169] pci_device_remove+0x36/0xb0
+[12301.899176] device_release_driver_internal+0x185/0x240
+[12301.899183] unbind_store+0xaf/0x180
+[12301.899189] kernfs_fop_write+0x104/0x190
+[12301.899195] __vfs_write+0x31/0x180
+[12301.899203] ? rcu_read_lock_sched_held+0x6f/0x80
+[12301.899209] ? rcu_sync_lockdep_assert+0x29/0x50
+[12301.899216] ? __sb_start_write+0x13c/0x1a0
+[12301.899221] ? vfs_write+0x17f/0x1b0
+[12301.899227] vfs_write+0xb9/0x1b0
+[12301.899233] ksys_write+0x50/0xc0
+[12301.899239] do_syscall_64+0x4b/0x180
+[12301.899247] entry_SYSCALL_64_after_hwframe+0x49/0xbe
+[12301.899253] RIP: 0033:0x7f452ac7f7a4
+[12301.899259] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 80 00 00 00 00 8b 05 aa f0 2c 00 48 63 ff 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 f3 c3 66 90 55 53 48 89 d5 48 89 f3 48 83
+[12301.899273] RSP: 002b:00007ffceafa6918 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
+[12301.899282] RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f452ac7f7a4
+[12301.899288] RDX: 000000000000000d RSI: 00005612a1abf7c0 RDI: 0000000000000001
+[12301.899295] RBP: 00005612a1abf7c0 R08: 000000000000000a R09: 00005612a1c46730
+[12301.899301] R10: 000000000000000a R11: 0000000000000246 R12: 000000000000000d
+[12301.899308] R13: 0000000000000001 R14: 00007f452af4a740 R15: 000000000000000d
+
+Looking around I've noticed that usb and i2c already handle similar
+recursion problems, where a sysfs file can unbind the same type of
+sysfs somewhere else in the hierarchy. Relevant commits are:
+
+commit 356c05d58af05d582e634b54b40050c73609617b
+Author: Alan Stern <stern@rowland.harvard.edu>
+Date: Mon May 14 13:30:03 2012 -0400
+
+ sysfs: get rid of some lockdep false positives
+
+commit e9b526fe704812364bca07edd15eadeba163ebfb
+Author: Alexander Sverdlin <alexander.sverdlin@nsn.com>
+Date: Fri May 17 14:56:35 2013 +0200
+
+ i2c: suppress lockdep warning on delete_device
+
+Implement the same trick for driver bind/unbind.
+
+V2: Put the macro into bus.c (Greg).
+
+Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Cc: Ramalingam C <ramalingam.c@intel.com>
+Cc: Arend van Spriel <aspriel@gmail.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Cc: Geert Uytterhoeven <geert+renesas@glider.be>
+Cc: Bartosz Golaszewski <brgl@bgdev.pl>
+Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Cc: Vivek Gautam <vivek.gautam@codeaurora.org>
+Cc: Joe Perches <joe@perches.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/base/bus.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index b886b15cb53b..e06a57936cc9 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -31,6 +31,9 @@ static struct kset *system_kset;
+
+ #define to_drv_attr(_attr) container_of(_attr, struct driver_attribute, attr)
+
++#define DRIVER_ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store) \
++ struct driver_attribute driver_attr_##_name = \
++ __ATTR_IGNORE_LOCKDEP(_name, _mode, _show, _store)
+
+ static int __must_check bus_rescan_devices_helper(struct device *dev,
+ void *data);
+@@ -195,7 +198,7 @@ static ssize_t unbind_store(struct device_driver *drv, const char *buf,
+ bus_put(bus);
+ return err;
+ }
+-static DRIVER_ATTR_WO(unbind);
++static DRIVER_ATTR_IGNORE_LOCKDEP(unbind, S_IWUSR, NULL, unbind_store);
+
+ /*
+ * Manually attach a device to a driver.
+@@ -231,7 +234,7 @@ static ssize_t bind_store(struct device_driver *drv, const char *buf,
+ bus_put(bus);
+ return err;
+ }
+-static DRIVER_ATTR_WO(bind);
++static DRIVER_ATTR_IGNORE_LOCKDEP(bind, S_IWUSR, NULL, bind_store);
+
+ static ssize_t show_drivers_autoprobe(struct bus_type *bus, char *buf)
+ {
+--
+2.16.4
+
diff --git a/patches.fixes/uprobes-Fix-handle_swbp-vs.-unregister-register-race.patch b/patches.fixes/uprobes-Fix-handle_swbp-vs.-unregister-register-race.patch
new file mode 100644
index 0000000000..ae37c82c2b
--- /dev/null
+++ b/patches.fixes/uprobes-Fix-handle_swbp-vs.-unregister-register-race.patch
@@ -0,0 +1,83 @@
+From 09d3f015d1e1b4fee7e9bbdcf54201d239393391 Mon Sep 17 00:00:00 2001
+From: Andrea Parri <andrea.parri@amarulasolutions.com>
+Date: Thu, 22 Nov 2018 17:10:31 +0100
+Subject: [PATCH] uprobes: Fix handle_swbp() vs. unregister() + register() race once more
+Git-commit: 09d3f015d1e1b4fee7e9bbdcf54201d239393391
+Patch-mainline: v4.20-rc5
+References: bsc#1051510
+
+Commit:
+
+ 142b18ddc8143 ("uprobes: Fix handle_swbp() vs unregister() + register() race")
+
+added the UPROBE_COPY_INSN flag, and corresponding smp_wmb() and smp_rmb()
+memory barriers, to ensure that handle_swbp() uses fully-initialized
+uprobes only.
+
+However, the smp_rmb() is mis-placed: this barrier should be placed
+after handle_swbp() has tested for the flag, thus guaranteeing that
+(program-order) subsequent loads from the uprobe can see the initial
+stores performed by prepare_uprobe().
+
+Move the smp_rmb() accordingly. Also amend the comments associated
+to the two memory barriers to indicate their actual locations.
+
+Signed-off-by: Andrea Parri <andrea.parri@amarulasolutions.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Andrew Morton <akpm@linux-foundation.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Stephane Eranian <eranian@google.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: stable@kernel.org
+Fixes: 142b18ddc8143 ("uprobes: Fix handle_swbp() vs unregister() + register() race")
+Link: http://lkml.kernel.org/r/20181122161031.15179-1-andrea.parri@amarulasolutions.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ kernel/events/uprobes.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index 96d4bee83489..322e97bbb437 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -829,7 +829,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
+ BUG_ON((uprobe->offset & ~PAGE_MASK) +
+ UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+
+- smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
++ smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
+ set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+
+ out:
+@@ -2178,10 +2178,18 @@ static void handle_swbp(struct pt_regs *regs)
+ * After we hit the bp, _unregister + _register can install the
+ * new and not-yet-analyzed uprobe at the same address, restart.
+ */
+- smp_rmb(); /* pairs with wmb() in install_breakpoint() */
+ if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
+ goto out;
+
++ /*
++ * Pairs with the smp_wmb() in prepare_uprobe().
++ *
++ * Guarantees that if we see the UPROBE_COPY_INSN bit set, then
++ * we must also see the stores to &uprobe->arch performed by the
++ * prepare_uprobe() call.
++ */
++ smp_rmb();
++
+ /* Tracing handlers use ->utask to communicate with fetch methods */
+ if (!get_utask())
+ goto out;
+--
+2.16.4
+
diff --git a/patches.fixes/virtio-s390-avoid-race-on-vcdev-config b/patches.fixes/virtio-s390-avoid-race-on-vcdev-config
new file mode 100644
index 0000000000..1e501b2a4a
--- /dev/null
+++ b/patches.fixes/virtio-s390-avoid-race-on-vcdev-config
@@ -0,0 +1,71 @@
+From: Halil Pasic <pasic@linux.ibm.com>
+Date: Wed, 26 Sep 2018 18:48:29 +0200
+Subject: virtio/s390: avoid race on vcdev->config
+Git-commit: 2448a299ec416a80f699940a86f4a6d9a4f643b1
+Patch-mainline: v4.20-rc6
+References: git-fixes
+
+Currently we have a race on vcdev->config in virtio_ccw_get_config() and
+in virtio_ccw_set_config().
+
+This normally does not cause problems, as these are usually infrequent
+operations. However, for some devices writing to/reading from the config
+space can be triggered through sysfs attributes. For these, userspace can
+force the race by increasing the frequency.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Cc: stable@vger.kernel.org
+Message-Id: <20180925121309.58524-2-pasic@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/virtio/virtio_ccw.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -831,6 +831,7 @@ static void virtio_ccw_get_config(struct
+ int ret;
+ struct ccw1 *ccw;
+ void *config_area;
++ unsigned long flags;
+
+ ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+ if (!ccw)
+@@ -849,11 +850,13 @@ static void virtio_ccw_get_config(struct
+ if (ret)
+ goto out_free;
+
++ spin_lock_irqsave(&vcdev->lock, flags);
+ memcpy(vcdev->config, config_area, offset + len);
+- if (buf)
+- memcpy(buf, &vcdev->config[offset], len);
+ if (vcdev->config_ready < offset + len)
+ vcdev->config_ready = offset + len;
++ spin_unlock_irqrestore(&vcdev->lock, flags);
++ if (buf)
++ memcpy(buf, config_area + offset, len);
+
+ out_free:
+ kfree(config_area);
+@@ -867,6 +870,7 @@ static void virtio_ccw_set_config(struct
+ struct virtio_ccw_device *vcdev = to_vc_device(vdev);
+ struct ccw1 *ccw;
+ void *config_area;
++ unsigned long flags;
+
+ ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
+ if (!ccw)
+@@ -879,9 +883,11 @@ static void virtio_ccw_set_config(struct
+ /* Make sure we don't overwrite fields. */
+ if (vcdev->config_ready < offset)
+ virtio_ccw_get_config(vdev, 0, NULL, offset);
++ spin_lock_irqsave(&vcdev->lock, flags);
+ memcpy(&vcdev->config[offset], buf, len);
+ /* Write the config area to the host. */
+ memcpy(config_area, vcdev->config, sizeof(vcdev->config));
++ spin_unlock_irqrestore(&vcdev->lock, flags);
+ ccw->cmd_code = CCW_CMD_WRITE_CONF;
+ ccw->flags = 0;
+ ccw->count = offset + len;
diff --git a/patches.fixes/virtio-s390-fix-race-in-ccw_io_helper b/patches.fixes/virtio-s390-fix-race-in-ccw_io_helper
new file mode 100644
index 0000000000..4e0e9ca311
--- /dev/null
+++ b/patches.fixes/virtio-s390-fix-race-in-ccw_io_helper
@@ -0,0 +1,76 @@
+From: Halil Pasic <pasic@linux.ibm.com>
+Date: Wed, 26 Sep 2018 18:48:30 +0200
+Subject: virtio/s390: fix race in ccw_io_helper()
+Git-commit: 78b1a52e05c9db11d293342e8d6d8a230a04b4e7
+Patch-mainline: v4.20-rc6
+References: git-fixes
+
+While ccw_io_helper() seems like intended to be exclusive in a sense that
+it is supposed to facilitate I/O for at most one thread at any given
+time, there is actually nothing ensuring that threads won't pile up at
+vcdev->wait_q. If they do, all threads get woken up and see the status
+that belongs to some other request than their own. This can lead to bugs.
+For an example see:
+https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1788432
+
+This race normally does not cause any problems. The operations provided
+by struct virtio_config_ops are usually invoked in a well defined
+sequence, normally don't fail, and are normally used quite infrequent
+too.
+
+Yet, if some of the these operations are directly triggered via sysfs
+attributes, like in the case described by the referenced bug, userspace
+is given an opportunity to force races by increasing the frequency of the
+given operations.
+
+Let us fix the problem by ensuring, that for each device, we finish
+processing the previous request before starting with a new one.
+
+Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
+Reported-by: Colin Ian King <colin.king@canonical.com>
+Cc: stable@vger.kernel.org
+Message-Id: <20180925121309.58524-3-pasic@linux.ibm.com>
+Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Acked-by: Petr Tesarik <ptesarik@suse.com>
+---
+ drivers/s390/virtio/virtio_ccw.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/s390/virtio/virtio_ccw.c
++++ b/drivers/s390/virtio/virtio_ccw.c
+@@ -59,6 +59,7 @@ struct virtio_ccw_device {
+ unsigned int revision; /* Transport revision */
+ wait_queue_head_t wait_q;
+ spinlock_t lock;
++ struct mutex io_lock; /* Serializes I/O requests */
+ struct list_head virtqueues;
+ unsigned long indicators;
+ unsigned long indicators2;
+@@ -299,6 +300,7 @@ static int ccw_io_helper(struct virtio_c
+ unsigned long flags;
+ int flag = intparm & VIRTIO_CCW_INTPARM_MASK;
+
++ mutex_lock(&vcdev->io_lock);
+ do {
+ spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags);
+ ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0);
+@@ -311,7 +313,9 @@ static int ccw_io_helper(struct virtio_c
+ cpu_relax();
+ } while (ret == -EBUSY);
+ wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0);
+- return ret ? ret : vcdev->err;
++ ret = ret ? ret : vcdev->err;
++ mutex_unlock(&vcdev->io_lock);
++ return ret;
+ }
+
+ static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
+@@ -1256,6 +1260,7 @@ static int virtio_ccw_online(struct ccw_
+ init_waitqueue_head(&vcdev->wait_q);
+ INIT_LIST_HEAD(&vcdev->virtqueues);
+ spin_lock_init(&vcdev->lock);
++ mutex_init(&vcdev->io_lock);
+
+ spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
+ dev_set_drvdata(&cdev->dev, vcdev);
diff --git a/patches.suse/mm-Adjust-watermark-boost-factor-tunable.patch b/patches.suse/mm-Adjust-watermark-boost-factor-tunable.patch
new file mode 100644
index 0000000000..0eac388260
--- /dev/null
+++ b/patches.suse/mm-Adjust-watermark-boost-factor-tunable.patch
@@ -0,0 +1,41 @@
+From dc134b85f201066ed6ba73eed5ff724c3d178c7a Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Sun, 10 Feb 2019 09:39:24 +0000
+Subject: [PATCH] mm: Adjust watermark boost factor tunable
+
+Patch-mainline: No, reclaim behaviour differs in mainline
+References: bnc#1122972
+
+The patch
+patches.suse/mm-reclaim-small-amounts-of-memory-when-an-external-fragmentation-event-occurs.patch
+boosts watermarks slightly in the event of external fragmentation to
+reduce future external fragmentation events. The impact is that reclaim
+is smoother but also occurs sooner and may prevent some page cache or
+slab objects remaining resident when they otherwise would be available.
+
+In bonnie, it was reported that delete was slower with the patch applied
+and tracing indicated that, in xfs at least, it was due to buffer objects
+being reclaimed and then reread from disk incurring a delay.
+
+This patch adjusts the tunable slightly to reduce the number of objects
+reclaimed with the negative impact that external fragmentation events
+are slightly more common but still far less than a full revert.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ mm/page_alloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 63e483e398db..609ac01a637d 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -264,7 +264,7 @@ compound_page_dtor * const compound_page_dtors[] = {
+
+ int min_free_kbytes = 1024;
+ int user_min_free_kbytes = -1;
+-int watermark_boost_factor __read_mostly = 15000;
++int watermark_boost_factor __read_mostly = 10000;
+ int watermark_scale_factor = 10;
+
+ static unsigned long __meminitdata nr_kernel_pages;
diff --git a/patches.suse/mm-hwpoison-use-do_send_sig_info-instead-of-force_sig.patch b/patches.suse/mm-hwpoison-use-do_send_sig_info-instead-of-force_sig.patch
new file mode 100644
index 0000000000..e81c7dea51
--- /dev/null
+++ b/patches.suse/mm-hwpoison-use-do_send_sig_info-instead-of-force_sig.patch
@@ -0,0 +1,59 @@
+From f4489c075d632f53a17d5e596404feec31183f28 Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Date: Fri, 1 Feb 2019 14:21:08 -0800
+Subject: [PATCH] mm: hwpoison: use do_send_sig_info() instead of force_sig()
+
+References: git fixes (mm/hwpoison)
+Patch-mainline: v5.0
+Git-commit: 6376360ecbe525a9c17b3d081dfd88ba3e4ed65b
+
+Currently memory_failure() is racy against process's exiting, which
+results in kernel crash by null pointer dereference.
+
+The root cause is that memory_failure() uses force_sig() to forcibly
+kill asynchronous (meaning not in the current context) processes. As
+discussed in thread https://lkml.org/lkml/2010/6/8/236 years ago for OOM
+fixes, this is not a right thing to do. OOM solves this issue by using
+do_send_sig_info() as done in commit d2d393099de2 ("signal:
+oom_kill_task: use SEND_SIG_FORCED instead of force_sig()"), so this
+patch is suggesting to do the same for hwpoison. do_send_sig_info()
+properly accesses to siglock with lock_task_sighand(), so is free from
+the reported race.
+
+I confirmed that the reported bug reproduces with inserting some delay
+in kill_procs(), and it never reproduces with this patch.
+
+Note that memory_failure() can send another type of signal using
+force_sig_mceerr(), and the reported race shouldn't happen on it because
+force_sig_mceerr() is called only for synchronous processes (i.e.
+BUS_MCEERR_AR happens only when some process accesses to the corrupted
+memory.)
+
+Link: http://lkml.kernel.org/r/20190116093046.GA29835@hori1.linux.bs1.fc.nec.co.jp
+Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Reported-by: Jane Chu <jane.chu@oracle.com>
+Reviewed-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: William Kucharski <william.kucharski@oracle.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ mm/memory-failure.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index e86cdcec0b7d..9540f2589455 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -380,7 +380,8 @@ static void kill_procs(struct list_head *to_kill, int forcekill, int trapno,
+ if (fail || tk->addr_valid == 0) {
+ pr_err("Memory failure: %#lx: forcibly killing %s:%d because of failure to unmap corrupted page\n",
+ pfn, tk->tsk->comm, tk->tsk->pid);
+- force_sig(SIGKILL, tk->tsk);
++ do_send_sig_info(SIGKILL, SEND_SIG_PRIV,
++ tk->tsk, PIDTYPE_PID);
+ }
+
+ /*
diff --git a/patches.suse/mm-madvise-MADV_DODUMP-allow-hugetlbfs-pages.patch b/patches.suse/mm-madvise-MADV_DODUMP-allow-hugetlbfs-pages.patch
new file mode 100644
index 0000000000..e8fc7cab5f
--- /dev/null
+++ b/patches.suse/mm-madvise-MADV_DODUMP-allow-hugetlbfs-pages.patch
@@ -0,0 +1,90 @@
+From d52995c86030a625e47614403d7c7fedb4b9892b Mon Sep 17 00:00:00 2001
+From: Daniel Black <daniel@linux.ibm.com>
+Date: Fri, 5 Oct 2018 15:52:19 -0700
+Subject: [PATCH] mm: madvise(MADV_DODUMP): allow hugetlbfs pages
+
+References: git fixes (mm/madvise)
+Patch-mainline: v4.19
+Git-commit: d41aa5252394c065d1f04d1ceea885b70d00c9c6
+
+Reproducer, assuming 2M of hugetlbfs available:
+
+Hugetlbfs mounted, size=2M and option user=testuser
+
+ # mount | grep ^hugetlbfs
+ hugetlbfs on /dev/hugepages type hugetlbfs (rw,pagesize=2M,user=dan)
+ # sysctl vm.nr_hugepages=1
+ vm.nr_hugepages = 1
+ # grep Huge /proc/meminfo
+ AnonHugePages: 0 kB
+ ShmemHugePages: 0 kB
+ HugePages_Total: 1
+ HugePages_Free: 1
+ HugePages_Rsvd: 0
+ HugePages_Surp: 0
+ Hugepagesize: 2048 kB
+ Hugetlb: 2048 kB
+
+Code:
+
+ #include <sys/mman.h>
+ #include <stddef.h>
+ #define SIZE 2*1024*1024
+ int main()
+ {
+ void *ptr;
+ ptr = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_HUGETLB | MAP_ANONYMOUS, -1, 0);
+ madvise(ptr, SIZE, MADV_DONTDUMP);
+ madvise(ptr, SIZE, MADV_DODUMP);
+ }
+
+Compile and strace:
+
+ mmap(NULL, 2097152, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB, -1, 0) = 0x7ff7c9200000
+ madvise(0x7ff7c9200000, 2097152, MADV_DONTDUMP) = 0
+ madvise(0x7ff7c9200000, 2097152, MADV_DODUMP) = -1 EINVAL (Invalid argument)
+
+hugetlbfs pages have VM_DONTEXPAND in the VmFlags driver pages based on
+author testing with analysis from Florian Weimer[1].
+
+The inclusion of VM_DONTEXPAND into the VM_SPECIAL defination was a
+consequence of the large useage of VM_DONTEXPAND in device drivers.
+
+A consequence of [2] is that VM_DONTEXPAND marked pages are unable to be
+marked DODUMP.
+
+A user could quite legitimately madvise(MADV_DONTDUMP) their hugetlbfs
+memory for a while and later request that madvise(MADV_DODUMP) on the same
+memory. We correct this omission by allowing madvice(MADV_DODUMP) on
+hugetlbfs pages.
+
+[1] https://stackoverflow.com/questions/52548260/madvisedodump-on-the-same-ptr-size-as-a-successful-madvisedontdump-fails-wit
+[2] commit 0103bd16fb90 ("mm: prepare VM_DONTDUMP for using in drivers")
+
+Link: http://lkml.kernel.org/r/20180930054629.29150-1-daniel@linux.ibm.com
+Link: https://lists.launchpad.net/maria-discuss/msg05245.html
+Fixes: 0103bd16fb90 ("mm: prepare VM_DONTDUMP for using in drivers")
+Reported-by: Kenneth Penza <kpenza@gmail.com>
+Signed-off-by: Daniel Black <daniel@linux.ibm.com>
+Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ mm/madvise.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mm/madvise.c b/mm/madvise.c
+index 3147813b6c36..c95aa2f5a7f1 100644
+--- a/mm/madvise.c
++++ b/mm/madvise.c
+@@ -84,7 +84,7 @@ static long madvise_behavior(struct vm_area_struct *vma,
+ new_flags |= VM_DONTDUMP;
+ break;
+ case MADV_DODUMP:
+- if (new_flags & VM_SPECIAL) {
++ if (!is_vm_hugetlb_page(vma) && new_flags & VM_SPECIAL) {
+ error = -EINVAL;
+ goto out;
+ }
diff --git a/patches.suse/mm-migrate-don-t-rely-on-__PageMovable-of-newpage-after-unlocking-it.patch b/patches.suse/mm-migrate-don-t-rely-on-__PageMovable-of-newpage-after-unlocking-it.patch
new file mode 100644
index 0000000000..28650f0508
--- /dev/null
+++ b/patches.suse/mm-migrate-don-t-rely-on-__PageMovable-of-newpage-after-unlocking-it.patch
@@ -0,0 +1,99 @@
+From 6ccb59a3d64fc99afa4a7c3a0565f2183d788923 Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Fri, 1 Feb 2019 14:21:19 -0800
+Subject: [PATCH] mm: migrate: don't rely on __PageMovable() of newpage after
+ unlocking it
+
+References: git fixes (mm/migrate)
+Patch-mainline: v5.0
+Git-commit: e0a352fabce61f730341d119fbedf71ffdb8663f
+
+We had a race in the old balloon compaction code before b1123ea6d3b3
+("mm: balloon: use general non-lru movable page feature") refactored it
+that became visible after backporting 195a8c43e93d ("virtio-balloon:
+deflate via a page list") without the refactoring.
+
+The bug existed from commit d6d86c0a7f8d ("mm/balloon_compaction:
+redesign ballooned pages management") till b1123ea6d3b3 ("mm: balloon:
+use general non-lru movable page feature"). d6d86c0a7f8d
+("mm/balloon_compaction: redesign ballooned pages management") was
+backported to 3.12, so the broken kernels are stable kernels [3.12 -
+4.7].
+
+There was a subtle race between dropping the page lock of the newpage in
+__unmap_and_move() and checking for __is_movable_balloon_page(newpage).
+
+Just after dropping this page lock, virtio-balloon could go ahead and
+deflate the newpage, effectively dequeueing it and clearing PageBalloon,
+in turn making __is_movable_balloon_page(newpage) fail.
+
+This resulted in dropping the reference of the newpage via
+putback_lru_page(newpage) instead of put_page(newpage), leading to
+page->lru getting modified and a !LRU page ending up in the LRU lists.
+With 195a8c43e93d ("virtio-balloon: deflate via a page list")
+backported, one would suddenly get corrupted lists in
+release_pages_balloon():
+
+- WARNING: CPU: 13 PID: 6586 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0
+- list_del corruption. prev->next should be ffffe253961090a0, but was dead000000000100
+
+Nowadays this race is no longer possible, but it is hidden behind very
+ugly handling of __ClearPageMovable() and __PageMovable().
+
+__ClearPageMovable() will not make __PageMovable() fail, only
+PageMovable(). So the new check (__PageMovable(newpage)) will still
+hold even after newpage was dequeued by virtio-balloon.
+
+If anybody would ever change that special handling, the BUG would be
+introduced again. So instead, make it explicit and use the information
+of the original isolated page before migration.
+
+This patch can be backported fairly easy to stable kernels (in contrast
+to the refactoring).
+
+Link: http://lkml.kernel.org/r/20190129233217.10747-1-david@redhat.com
+Fixes: d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management")
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Reported-by: Vratislav Bendel <vbendel@redhat.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Acked-by: Rafael Aquini <aquini@redhat.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
+Cc: Michal Hocko <mhocko@suse.com>
+Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
+Cc: Jan Kara <jack@suse.cz>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Dominik Brodowski <linux@dominikbrodowski.net>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Vratislav Bendel <vbendel@redhat.com>
+Cc: Rafael Aquini <aquini@redhat.com>
+Cc: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: <stable@vger.kernel.org> [3.12 - 4.7]
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ mm/migrate.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/mm/migrate.c b/mm/migrate.c
+index e44f3467750e..a157d67877c5 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -1120,10 +1120,13 @@ static int __unmap_and_move(struct page *page, struct page *newpage,
+ * If migration is successful, decrease refcount of the newpage
+ * which will not free the page because new page owner increased
+ * refcounter. As well, if it is LRU page, add the page to LRU
+- * list in here.
++ * list in here. Use the old state of the isolated source page to
++ * determine if we migrated a LRU page. newpage was already unlocked
++ * and possibly modified by its owner - don't rely on the page
++ * state.
+ */
+ if (rc == MIGRATEPAGE_SUCCESS) {
+- if (unlikely(__PageMovable(newpage)))
++ if (unlikely(!is_lru))
+ put_page(newpage);
+ else
+ putback_lru_page(newpage);
diff --git a/patches.suse/mm-vmscan-Make-unregister_shrinker-no-op-if-register_shrinker-failed.patch b/patches.suse/mm-vmscan-Make-unregister_shrinker-no-op-if-register_shrinker-failed.patch
new file mode 100644
index 0000000000..5797c94749
--- /dev/null
+++ b/patches.suse/mm-vmscan-Make-unregister_shrinker-no-op-if-register_shrinker-failed.patch
@@ -0,0 +1,112 @@
+From 6c49738c2aa1d8c91909f11b004adb4c25f7e03b Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Mon, 18 Dec 2017 20:31:41 +0900
+Subject: [PATCH] mm,vmscan: Make unregister_shrinker() no-op if
+ register_shrinker() failed.
+
+References: git fixes (mm/vmscan)
+Patch-mainline: v4.15
+Git-commit: bb422a738f6566f7439cd347d54e321e4fe92a9f
+
+Syzbot caught an oops at unregister_shrinker() because combination of
+commit 1d3d4437eae1bb29 ("vmscan: per-node deferred work") and fault
+injection made register_shrinker() fail and the caller of
+register_shrinker() did not check for failure.
+
+----------
+[ 554.881422] FAULT_INJECTION: forcing a failure.
+[ 554.881422] name failslab, interval 1, probability 0, space 0, times 0
+[ 554.881438] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82
+[ 554.881443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+[ 554.881445] Call Trace:
+[ 554.881459] dump_stack+0x194/0x257
+[ 554.881474] ? arch_local_irq_restore+0x53/0x53
+[ 554.881486] ? find_held_lock+0x35/0x1d0
+[ 554.881507] should_fail+0x8c0/0xa40
+[ 554.881522] ? fault_create_debugfs_attr+0x1f0/0x1f0
+[ 554.881537] ? check_noncircular+0x20/0x20
+[ 554.881546] ? find_next_zero_bit+0x2c/0x40
+[ 554.881560] ? ida_get_new_above+0x421/0x9d0
+[ 554.881577] ? find_held_lock+0x35/0x1d0
+[ 554.881594] ? __lock_is_held+0xb6/0x140
+[ 554.881628] ? check_same_owner+0x320/0x320
+[ 554.881634] ? lock_downgrade+0x990/0x990
+[ 554.881649] ? find_held_lock+0x35/0x1d0
+[ 554.881672] should_failslab+0xec/0x120
+[ 554.881684] __kmalloc+0x63/0x760
+[ 554.881692] ? lock_downgrade+0x990/0x990
+[ 554.881712] ? register_shrinker+0x10e/0x2d0
+[ 554.881721] ? trace_event_raw_event_module_request+0x320/0x320
+[ 554.881737] register_shrinker+0x10e/0x2d0
+[ 554.881747] ? prepare_kswapd_sleep+0x1f0/0x1f0
+[ 554.881755] ? _down_write_nest_lock+0x120/0x120
+[ 554.881765] ? memcpy+0x45/0x50
+[ 554.881785] sget_userns+0xbcd/0xe20
+(...snipped...)
+[ 554.898693] kasan: CONFIG_KASAN_INLINE enabled
+[ 554.898724] kasan: GPF could be caused by NULL-ptr deref or user memory access
+[ 554.898732] general protection fault: 0000 [#1] SMP KASAN
+[ 554.898737] Dumping ftrace buffer:
+[ 554.898741] (ftrace buffer empty)
+[ 554.898743] Modules linked in:
+[ 554.898752] CPU: 1 PID: 13231 Comm: syz-executor1 Not tainted 4.14.0-rc8+ #82
+[ 554.898755] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+[ 554.898760] task: ffff8801d1dbe5c0 task.stack: ffff8801c9e38000
+[ 554.898772] RIP: 0010:__list_del_entry_valid+0x7e/0x150
+[ 554.898775] RSP: 0018:ffff8801c9e3f108 EFLAGS: 00010246
+[ 554.898780] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[ 554.898784] RDX: 0000000000000000 RSI: ffff8801c53c6f98 RDI: ffff8801c53c6fa0
+[ 554.898788] RBP: ffff8801c9e3f120 R08: 1ffff100393c7d55 R09: 0000000000000004
+[ 554.898791] R10: ffff8801c9e3ef70 R11: 0000000000000000 R12: 0000000000000000
+[ 554.898795] R13: dffffc0000000000 R14: 1ffff100393c7e45 R15: ffff8801c53c6f98
+[ 554.898800] FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
+[ 554.898804] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
+[ 554.898807] CR2: 00000000dbc23000 CR3: 00000001c7269000 CR4: 00000000001406e0
+[ 554.898813] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
+[ 554.898816] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
+[ 554.898818] Call Trace:
+[ 554.898828] unregister_shrinker+0x79/0x300
+[ 554.898837] ? perf_trace_mm_vmscan_writepage+0x750/0x750
+[ 554.898844] ? down_write+0x87/0x120
+[ 554.898851] ? deactivate_super+0x139/0x1b0
+[ 554.898857] ? down_read+0x150/0x150
+[ 554.898864] ? check_same_owner+0x320/0x320
+[ 554.898875] deactivate_locked_super+0x64/0xd0
+[ 554.898883] deactivate_super+0x141/0x1b0
+----------
+
+Since allowing register_shrinker() callers to call unregister_shrinker()
+when register_shrinker() failed can simplify error recovery path, this
+patch makes unregister_shrinker() no-op when register_shrinker() failed.
+Also, reset shrinker->nr_deferred in case unregister_shrinker() was
+by error called twice.
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: Aliaksei Karaliou <akaraliou.dev@gmail.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Cc: Glauber Costa <glauber@scylladb.com>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+---
+ mm/vmscan.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 15e9f6f6123a..8cf73cb92a13 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -296,10 +296,13 @@ EXPORT_SYMBOL(register_shrinker);
+ */
+ void unregister_shrinker(struct shrinker *shrinker)
+ {
++ if (!shrinker->nr_deferred)
++ return;
+ down_write(&shrinker_rwsem);
+ list_del(&shrinker->list);
+ up_write(&shrinker_rwsem);
+ kfree(shrinker->nr_deferred);
++ shrinker->nr_deferred = NULL;
+ }
+ EXPORT_SYMBOL(unregister_shrinker);
+
diff --git a/patches.suse/qed-bump-drivers-to-version-8.10.10.55.patch b/patches.suse/qed-bump-drivers-to-version-8.10.10.55.patch
deleted file mode 100644
index 801ac7e5e4..0000000000
--- a/patches.suse/qed-bump-drivers-to-version-8.10.10.55.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
-Date: Fri, 26 Jan 2018 10:02:05 +0100
-Subject: qed* - bump drivers to version 8.10.10.55
-Patch-mainline: never, SUSE version
-References: bsc#1050536 FATE#322898 bsc#1050538 FATE#322897
-
-Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
----
- drivers/net/ethernet/qlogic/qed/qed.h | 2 +-
- drivers/net/ethernet/qlogic/qede/qede.h | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/net/ethernet/qlogic/qed/qed.h
-+++ b/drivers/net/ethernet/qlogic/qed/qed.h
-@@ -55,7 +55,7 @@ extern const struct qed_common_ops qed_c
- #define QED_MAJOR_VERSION 8
- #define QED_MINOR_VERSION 33
- #define QED_REVISION_VERSION 0
--#define QED_ENGINEERING_VERSION 20
-+#define QED_ENGINEERING_VERSION 55
-
- #define QED_VERSION \
- ((QED_MAJOR_VERSION << 24) | (QED_MINOR_VERSION << 16) | \
---- a/drivers/net/ethernet/qlogic/qede/qede.h
-+++ b/drivers/net/ethernet/qlogic/qede/qede.h
-@@ -54,7 +54,7 @@
- #define QEDE_MAJOR_VERSION 8
- #define QEDE_MINOR_VERSION 33
- #define QEDE_REVISION_VERSION 0
--#define QEDE_ENGINEERING_VERSION 20
-+#define QEDE_ENGINEERING_VERSION 55
- #define DRV_MODULE_VERSION __stringify(QEDE_MAJOR_VERSION) "." \
- __stringify(QEDE_MINOR_VERSION) "." \
- __stringify(QEDE_REVISION_VERSION) "." \
diff --git a/rpm/kernel-binary.spec.in b/rpm/kernel-binary.spec.in
index bdf5440857..4cefc4f0ef 100644
--- a/rpm/kernel-binary.spec.in
+++ b/rpm/kernel-binary.spec.in
@@ -250,7 +250,7 @@ Provides: compat-ath9k = 3.0
%obsolete_kmp drm 4.12
# Will modules not listed in supported.conf abort the kernel build (0/1)?
-%define supported_modules_check 0
+%define supported_modules_check 1
%description
@DESCRIPTION@
diff --git a/series.conf b/series.conf
index 1df91f1feb..9840fde3a8 100644
--- a/series.conf
+++ b/series.conf
@@ -18706,6 +18706,7 @@
patches.suse/kvm-vmx-Scrub-hardware-GPRs-at-VM-exit.patch
patches.drivers/KVM-s390-fix-cmma-migration-for-multiple-memory-slot.patch
patches.drivers/KVM-s390-prevent-buffer-overrun-on-memory-hotplug-du.patch
+ patches.suse/mm-vmscan-Make-unregister_shrinker-no-op-if-register_shrinker-failed.patch
patches.fixes/sget-handle-failures-of-register_shrinker.patch
patches.drivers/fix-netfilter-xt_bpf-Fix-XT_BPF_MODE_FD_PINNED-mode-.patch
patches.drivers/leds-core-Fix-regression-caused-by-commit-2b83ff96f5
@@ -29251,6 +29252,7 @@
patches.arch/s390-uprobes-implement-arch_uretprobe_is_alive.patch
patches.arch/s390-dasd-fix-IO-error-for-newly-defined-devices.patch
patches.arch/s390-sles15sp1-00-05-05-s390-cpum_cf-rename-IBM-z13-z14-counter-names.patch
+ patches.drivers/vfio-ccw-process-ssch-with-interrupts-disabled
patches.arch/s390-correct-module-section-names-for-expoline-code.patch
patches.drivers/random-fix-possible-sleeping-allocation-from-irq-con
patches.suse/random-rate-limit-unseeded-randomness-warnings.patch
@@ -29680,6 +29682,7 @@
patches.fixes/scsi-aacraid-Correct-hba_send-to-include-iu_type.patch
patches.arch/tracing-x86-xen-remove-zero-data-size-trace-events-trace_xen_mmu_flush_tlb-all
patches.fixes/0001-proc-do-not-access-cmdline-nor-environ-from-file-bac.patch
+ patches.drivers/vfio-ccw-fix-cleanup-if-cp_prefetch-fails
patches.arch/s390-move-expoline-assembler-macros-to-a-header.patch
patches.arch/s390-crc32-vx-use-expoline-for-indirect-branches.patch
patches.arch/s390-lib-use-expoline-for-indirect-branches.patch
@@ -33280,6 +33283,7 @@
patches.drivers/clk-at91-PLL-recalc_rate-now-using-cached-MUL-and-DI
patches.suse/objtool-fix-gcc-8-cold-subfunction-detection-for-aliased-functions.patch
patches.drivers/0344-irqchip-ls-scfg-msi-Map-MSIs-in-the-iommu.patch
+ patches.arch/x86-bugs-add-amd-s-variant-of-ssb_no.patch
patches.arch/x86-bugs-add-amd-s-spec_ctrl-msr-usage.patch
patches.arch/x86-bugs-switch-the-selection-of-mitigation-from-cpu-vendor-to-cpu-features.patch
patches.arch/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt
@@ -33948,6 +33952,7 @@
patches.drivers/nvme-pci-limit-max-IO-size-and-segments-to-avoid-hig.patch
patches.fixes/bdi-Fix-another-oops-in-wb_workfn.patch
patches.fixes/blk-mq-Fix-timeout-handling-in-case-the-timeout-hand.patch
+ patches.fixes/irqchip-gic-v3-its-Don-t-bind-LPI-to-unavailable-NUM.patch
patches.drivers/irqchip-gic-v3-its-Only-emit-SYNC-if-targetting-a-va.patch
patches.drivers/irqchip-gic-v3-its-Only-emit-VSYNC-if-targetting-a-v.patch
patches.drivers/irqchip-gic-v3-its-Fix-reprogramming-of-redistributo.patch
@@ -34199,6 +34204,7 @@
patches.fixes/compiler-gcc-h-add-_attribute__gnu_inline-to-all-inline-declarations.patch
patches.arch/x86-asm-add-asm_arg-constants-for-argument-registers-to-asm-asm-h
patches.suse/msft-hv-1726-x86-hyper-v-Fix-the-circular-dependency-in-IPI-enlig.patch
+ patches.arch/x86-bugs-update-when-to-check-for-the-ls_cfg-ssbd-mitigation.patch
patches.arch/x86-bugs-fix-the-amd-ssbd-usage-of-the-spec_ctrl-msr.patch
patches.arch/ARM-imx_v6_v7_defconfig-Select-ULPI-support.patch
patches.arch/ARM-imx_v4_v5_defconfig-Select-ULPI-support.patch
@@ -39522,6 +39528,7 @@
patches.fixes/0001-mm-migration-fix-migration-of-huge-PMD-shared-pages.patch
patches.fixes/proc-restrict-kernel-stack-dumps-to-root.patch
patches.fixes/ocfs2-fix-locking-for-res-tracking-and-dlm-tracking_.patch
+ patches.suse/mm-madvise-MADV_DODUMP-allow-hugetlbfs-pages.patch
patches.drivers/mlxsw-pci-Derive-event-type-from-event-queue-number.patch
patches.drivers/mlxsw-spectrum-Delete-RIF-when-VLAN-device-is-remove.patch
patches.drivers/cfg80211-fix-wext-compat-memory-leak.patch
@@ -39558,6 +39565,7 @@
patches.suse/msft-hv-1761-tools-hv-fcopy-set-error-in-case-an-unknown-operatio.patch
patches.drivers/0001-fpga-bridge-fix-obvious-function-documentation-error.patch
patches.drivers/mach64-detect-the-dot-clock-divider-correctly-on-spa.patch
+ patches.arch/s390-cio-fix-how-vfio-ccw-checks-pinned-pages
patches.suse/0161-dm-cache-destroy-migration_cache-if-cache-target-reg.patch
patches.suse/0162-dm-fix-report-zone-remapping-to-account-for-partitio.patch
patches.suse/0163-dm-linear-eliminate-linear_end_io-call-if-CONFIG_DM_.patch
@@ -39767,6 +39775,7 @@
patches.arch/s390-sles15sp1-00-10-06-s390-pkey-Introduce-new-API-for-transforming-key-blo.patch
patches.arch/s390-sles15sp1-00-10-07-s390-crypto-Enhance-paes-cipher-to-accept-variable-l.patch
patches.arch/s390-sles15sp1-00-06-02-zcrypt-fix-broken-zcrypt_send_cprb-in-kernel-ap.patch
+ patches.arch/s390-sthyi-fix-machine-name-validity-indication
patches.arch/s390-sles15sp1-00-10-08-s390-pkey-Load-pkey-kernel-module-automatically.patch
patches.arch/0001-efi-honour-memory-reservations-passed-via-a-linux-sp.patch
patches.arch/0002-efi-arm-libstub-add-a-root-memreserve-config-table.patch
@@ -41613,6 +41622,7 @@
patches.suse/uprobes-sdt-prevent-multiple-reference-counter-for-same-uprobe.patch
patches.suse/trace_uprobe-sdt-prevent-multiple-reference-counter-for-same-uprobe.patch
patches.fixes/Cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch
+ patches.drivers/svcrdma-Reduce-max_send_sges.patch
patches.fixes/nfsd-Fix-an-Oops-in-free_session.patch
patches.fixes/lockd-fix-access-beyond-unterminated-strings-in-prin.patch
patches.fixes/linux-bitmap.h-fix-type-of-nbits-in-bitmap_shift_rig.patch
@@ -42047,6 +42057,7 @@
patches.drivers/ASoC-omap-mcpdm-Add-pm_qos-handling-to-avoid-under-o.patch
patches.drivers/ASoC-omap-dmic-Add-pm_qos-handling-to-avoid-overruns.patch
patches.drivers/ALSA-usb-audio-Add-vendor-and-product-name-for-Dell-.patch
+ patches.arch/s390-cpum_cf-reject-request-for-sampling-in-event-initialization
patches.arch/s390-zcrypt-reinit-ap-queue-state-machine-during-device-probe.patch
patches.drivers/selinux-add-support-for-RTM_NEWCHAIN-RTM_DELCHAIN-an.patch
patches.drivers/net-mlx5-Fix-XRC-SRQ-umem-valid-bits.patch
@@ -42077,6 +42088,7 @@
patches.fixes/exportfs-do-not-read-dentry-after-free.patch
patches.suse/objtool-fix-double-free-in-cold-detection-error-path.patch
patches.suse/objtool-fix-segfault-in-cold-detection-with-ffunction-sections.patch
+ patches.fixes/uprobes-Fix-handle_swbp-vs.-unregister-register-race.patch
patches.arch/x86-mce-amd-fix-the-thresholding-machinery-initialization-order.patch
patches.fixes/test_hexdump-use-memcpy-instead-of-strncpy.patch
patches.drivers/0001-USB-usb-storage-Add-new-IDs-to-ums-realtek.patch
@@ -42226,6 +42238,8 @@
patches.drivers/nvmet-rdma-fix-response-use-after-free.patch
patches.drivers/Revert-PCI-ASPM-Do-not-initialize-link-state-when-as.patch
patches.drivers/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch
+ patches.fixes/virtio-s390-avoid-race-on-vcdev-config
+ patches.fixes/virtio-s390-fix-race-in-ccw_io_helper
patches.drivers/vhost-vsock-fix-use-after-free-in-network-stack-call.patch
patches.fixes/splice-dont-read-more-than-available-pipe-space.patch
patches.drivers/clk-mvebu-Off-by-one-bugs-in-cp110_of_clk_get.patch
@@ -42361,6 +42375,7 @@
patches.arch/ibmvnic-Convert-reset-work-item-mutex-to-spin-lock.patch
patches.arch/ibmvnic-Fix-non-atomic-memory-allocation-in-IRQ-cont.patch
patches.drivers/nfp-flower-ensure-TCP-flags-can-be-placed-in-IPv6-fr.patch
+ patches.drivers/ieee802154-ca8210-fix-possible-u8-overflow-in-ca8210.patch
patches.drivers/USB-hso-Fix-OOB-memory-access-in-hso_probe-hso_get_c.patch
patches.drivers/bnx2x-Clear-fip-MAC-when-fcoe-offload-support-is-dis.patch
patches.drivers/bnx2x-Remove-configured-vlans-as-part-of-unload-sequ.patch
@@ -42769,10 +42784,21 @@
patches.drivers/net-hns3-Add-qos-pause-config-info-query-function.patch
patches.drivers/net-hns3-Add-qos-prio-map-info-query-function.patch
patches.drivers/net-hns3-Add-qos-buffer-config-info-query-function.patch
+ patches.drivers/qed-Display-port_id-in-the-UFP-debug-messages.patch
+ patches.drivers/qede-Simplify-the-usage-of-qede-flags.patch
+ patches.drivers/qede-Update-link-status-only-when-interface-is-ready.patch
+ patches.drivers/qed-Add-support-for-MBI-upgrade-over-MFW.patch
patches.drivers/net-hns3-Config-NIC-port-speed-same-as-that-of-optic.patch
patches.drivers/bnx2x-Add-MBI-version-to-ethtool-driver-query-output.patch
patches.drivers/bnx2x-Add-storm-FW-version-to-ethtool-driver-query-o.patch
patches.drivers/can-flexcan-flexcan_irq-fix-indention.patch
+ patches.drivers/qede-Add-a-statistic-for-a-case-where-driver-drops-t.patch
+ patches.drivers/qed-Add-doorbell-overflow-recovery-mechanism.patch
+ patches.drivers/qed-Use-the-doorbell-overflow-recovery-mechanism-in-.patch
+ patches.drivers/qed-Register-slowpath-queue-doorbell-with-doorbell-o.patch
+ patches.drivers/qed-Register-light-L2-queues-with-doorbell-overflow-.patch
+ patches.drivers/qed-Expose-the-doorbell-overflow-recovery-mechanism-.patch
+ patches.drivers/qede-Register-l2-queues-with-doorbell-overflow-recov.patch
patches.drivers/net-hns3-Support-ethtool-d-for-HNS3-VF-driver.patch
patches.drivers/net-hns3-Adds-support-to-dump-using-ethool-d-PCIe-re.patch
patches.drivers/0001-brcmfmac-Remove-firmware-loading-code-duplication.patch
@@ -42793,6 +42819,7 @@
patches.drivers/b43-Fix-error-in-cordic-routine.patch
patches.drivers/brcmfmac-Call-brcmf_dmi_probe-before-brcmf_of_probe.patch
patches.drivers/brcmfmac-Fix-out-of-bounds-memory-access-during-fw-l.patch
+ patches.drivers/qed-fix-spelling-mistake-Dispalying-Displaying.patch
patches.drivers/net-mlx5-Fix-offsets-of-ifc-reserved-fields.patch
patches.drivers/RDMA-mlx5-Use-stages-for-callback-to-setup-and-relea.patch
patches.drivers/net-mlx5-Update-mlx5_ifc-with-DEVX-UCTX-capabilities.patch
@@ -43114,6 +43141,7 @@
patches.drivers/staging-bcm2835-audio-double-free-in-init-error-path.patch
patches.drivers/staging-wilc1000-fix-missing-read_write-setting-when.patch
patches.drivers/driver-core-Move-async_synchronize_full-call.patch
+ patches.fixes/sysfs-Disable-lockdep-for-driver-bind-unbind-files.patch
patches.suse/msft-hv-1800-Drivers-hv-vmbus-Get-rid-of-unnecessary-state-in-hv_.patch
patches.suse/msft-hv-1801-hv_utils-update-name-in-struct-hv_driver-util_drv.patch
patches.suse/msft-hv-1802-Drivers-hv-kvp-Use-u-to-print-U32.patch
@@ -43239,6 +43267,8 @@
patches.drivers/gpio-pl061-handle-failed-allocations.patch
patches.drivers/mfd-ab8500-core-Return-zero-in-get_register_interrup.patch
patches.drivers/mfd-tps6586x-Handle-interrupts-on-suspend.patch
+ patches.drivers/qed-Fix-qed_chain_set_prod-for-PBL-chains-with-non-p.patch
+ patches.drivers/qed-Fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch
patches.drivers/can-gw-ensure-DLC-boundaries-after-CAN-frame-modific.patch
patches.fixes/smc-move-unhash-as-early-as-possible-in-smc_release
patches.drivers/bpf-Fix-1-rewrite-in-sys_sendmsg.patch
@@ -43274,6 +43304,7 @@
patches.arch/powerpc-tm-Limit-TM-code-inside-PPC_TRANSACTIONAL_ME.patch
patches.drivers/media-v4l-ioctl-Validate-num_planes-for-debug-messag.patch
patches.drivers/scsi-hisi_sas-set-protection-parameters-prior-to-adding-scsi-host.patch
+ patches.drivers/scsi-qedi-add-ep_state-for-login-completion-on-un-reachable-targets
patches.drivers/xprtrdma-Double-free-in-rpcrdma_sendctxs_create.patch
patches.fixes/nfit-mark-some-functions-as-_maybe_unused.patch
patches.fixes/libnvdimm-dimm-fix-security-capability-detection-for-non-intel-nvdimms.patch
@@ -43290,6 +43321,7 @@
patches.drivers/mlxsw-spectrum_fid-Update-dummy-FID-index.patch
patches.drivers/net-mlx5e-Force-CHECKSUM_UNNECESSARY-for-short-ether.patch
patches.drivers/net-mlx5e-Fix-wrong-error-code-return-on-FEC-query-f.patch
+ patches.drivers/virtio_net-bulk-free-tx-skbs.patch
patches.drivers/xsk-Check-if-a-queue-exists-during-umem-setup.patch
patches.drivers/bpf-libbpf-retry-loading-program-on-EAGAIN.patch
patches.drivers/bpf-don-t-assume-build-id-length-is-always-20-bytes.patch
@@ -43300,6 +43332,10 @@
patches.fixes/pstore-ram-Avoid-allocation-and-leak-of-platform-dat.patch
patches.drivers/clk-imx-fix-potential-null-dereference-in-imx8qxp_lpcg_clk_probe.patch
patches.drivers/thermal-int340x_thermal-Fix-a-NULL-vs-IS_ERR-check.patch
+ patches.arch/s390-early-improve-machine-detection
+ patches.arch/s390-mm-always-force-a-load-of-the-primary-asce-on-context-switch
+ patches.arch/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan
+ patches.arch/s390-smp-fix-calling-smp_call_ipl_cpu-from-ipl-cpu
patches.drivers/ipmi-ssif-Fix-handling-of-multi-part-return-messages.patch
patches.drivers/ALSA-hda-realtek-Fix-typo-for-ALC225-model.patch
patches.drivers/ASoC-intel-skl-Fix-display-power-regression.patch
@@ -43336,8 +43372,14 @@
patches.fixes/libnvdimm-security-require-nvdimm_security_setup_events-to-succeed.patch
patches.fixes/acpi-nfit-Block-function-zero-DSMs.patch
patches.fixes/acpi-nfit-Fix-command-supported-detection.patch
+ patches.fixes/irqchip-gic-v3-its-Align-PCI-Multi-MSI-allocation-on.patch
patches.suse/sched-wait-Fix-rcuwait_wake_up-ordering.patch
patches.drivers/Revert-net-mlx5e-E-Switch-Initialize-eswitch-only-if.patch
+ patches.drivers/qed-Fix-bug-in-tx-promiscuous-mode-settings.patch
+ patches.drivers/qed-Fix-LACP-pdu-drops-for-VFs.patch
+ patches.drivers/qed-Fix-VF-probe-failure-while-FLR.patch
+ patches.drivers/qed-Fix-system-crash-in-ll2-xmit.patch
+ patches.drivers/qed-Fix-stack-out-of-bounds-bug.patch
patches.drivers/vhost-fix-OOB-in-get_rx_bufs.patch
patches.drivers/net-tls-Save-iv-in-tls_rec-for-async-crypto-requests.patch
patches.drivers/net-tls-Fix-deadlock-in-free_resources-tx.patch
@@ -43362,22 +43404,64 @@
patches.drivers/RDMA-umem-Add-missing-initialization-of-owning_mm.patch
patches.drivers/IB-uverbs-Fix-OOPs-in-uverbs_user_mmap_disassociate.patch
patches.suse/kernel-exit.c-release-ptraced-tasks-before-zap_pid_n.patch
+ patches.suse/mm-hwpoison-use-do_send_sig_info-instead-of-force_sig.patch
+ patches.suse/mm-migrate-don-t-rely-on-__PageMovable-of-newpage-after-unlocking-it.patch
+ patches.arch/x86-speculation-remove-redundant-arch_smt_update-invocation.patch
+ patches.arch/x86-microcode-amd-don-t-falsely-trick-the-late-loading-mechanism.patch
patches.drivers/ALSA-hda-realtek-Fix-lose-hp_pins-for-disable-auto-m.patch
patches.drivers/ALSA-hda-realtek-Use-a-common-helper-for-hp-pin-refe.patch
patches.drivers/ALSA-hda-Serialize-codec-registrations.patch
patches.drivers/ALSA-usb-audio-Add-support-for-new-T-A-USB-DAC.patch
patches.drivers/ALSA-compress-Fix-stop-handling-on-compressed-captur.patch
patches.drivers/ALSA-hda-ca0132-Fix-build-error-without-CONFIG_PCI.patch
+ patches.drivers/svcrdma-Remove-max_sge-check-at-connect-time.patch
patches.arch/kvm-fix-kvm_ioctl_create_device-reference-counting-cve-2019-6974
patches.arch/kvm-x86-work-around-leak-of-uninitialized-stack-contents-cve-2019-7222
patches.arch/kvm-nvmx-unconditionally-cancel-preemption-timer-in-free_nested-cve-2019-7221
+ patches.drm/0001-drm-vmwgfx-Return-error-code-from-vmw_execbuf_copy_f.patch
+ patches.drm/0001-drm-vmwgfx-Fix-setting-of-dma-masks.patch
+ patches.drivers/usb-typec-tcpm-correct-the-pps-out_volt-calculation.patch
+ patches.drivers/iio-chemical-atlas-ph-sensor-correct-IIO_TEMP-values.patch
+ patches.drivers/virtio_net-Don-t-enable-NAPI-when-interface-is-down.patch
+ patches.drivers/virtio_net-Don-t-call-free_old_xmit_skbs-for-xdp_fra.patch
+ patches.drivers/virtio_net-Fix-not-restoring-real_num_rx_queues.patch
+ patches.drivers/virtio_net-Fix-out-of-bounds-access-of-sq.patch
+ patches.drivers/virtio_net-Don-t-process-redirected-XDP-frames-when-.patch
+ patches.drivers/virtio_net-Use-xdp_return_frame-to-free-xdp_frames-o.patch
+ patches.drivers/virtio_net-Differentiate-sk_buff-and-xdp_frame-on-fr.patch
+ patches.drivers/tun-move-the-call-to-tun_set_real_num_queues.patch
+ patches.drivers/bnxt_en-Disable-interrupts-when-allocating-CP-rings-.patch
+ patches.drivers/batman-adv-Avoid-WARN-on-net_device-without-parent-i.patch
+ patches.drivers/batman-adv-Force-mac-header-to-start-of-data-on-xmit.patch
+ patches.drivers/bpftool-Fix-prog-dump-by-tag.patch
+ patches.drivers/bpftool-fix-percpu-maps-updating.patch
+ patches.drivers/bpf-sock-recvbuff-must-be-limited-by-rmem_max-in-bpf.patch
+ patches.drivers/bpf-fix-potential-deadlock-in-bpf_prog_register.patch
+ patches.drivers/Revert-net-phy-marvell-avoid-pause-mode-on-SGMII-to-.patch
+ patches.drivers/virtio_net-Account-for-tx-bytes-and-packets-on-sendi.patch
+ patches.drivers/net-cls_flower-Remove-filter-from-mask-before-freein.patch
+ patches.drivers/net-mlx5e-FPGA-fix-Innova-IPsec-TX-offload-data-path.patch
+ patches.drivers/qed-Fix-EQ-full-firmware-assert.patch
+ patches.drivers/qed-Assign-UFP-TC-value-to-vlan-priority-in-UFP-mode.patch
+ patches.drivers/qed-Consider-TX-tcs-while-deriving-the-max-num_queue.patch
+ patches.drivers/qede-Fix-system-crash-on-configuring-channels.patch
+ patches.drivers/qed-Change-verbosity-for-coalescing-message.patch
+ patches.drivers/qed-Advance-drivers-version-to-8.37.0.20.patch
+ patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
+ patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch
+ patches.drivers/dt-bindings-imx8mq-number-clocks-consecutively.patch
+ patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch
+ patches.fixes/irqchip-gic-v3-its-Fix-ITT_entry_size-accessor.patch
+ patches.arch/x86-mce-initialize-mce-bank-in-the-case-of-a-fatal-error-in-mce_no_way_out.patch
+ patches.drivers/dmaengine-at_xdmac-Fix-wrongfull-report-of-a-channel.patch
+ patches.drivers/dmaengine-bcm2835-Fix-interrupt-race-on-RT.patch
+ patches.drivers/dmaengine-bcm2835-Fix-abort-of-transactions.patch
+ patches.drivers/dmaengine-dmatest-Abort-test-in-case-of-mapping-erro.patch
+ patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch
# git://linuxtv.org/media_tree.git
patches.fixes/0001-media-usb-pwc-Don-t-use-coherent-DMA-buffers-for-ISO.patch
- # powerpc/linux fixes
- patches.arch/powerpc-papr_scm-Use-the-correct-bind-address.patch
-
# dhowells/linux-fs keys-uefi
patches.suse/0001-KEYS-Allow-unrestricted-boot-time-addition-of-keys-t.patch
patches.suse/0002-efi-Add-EFI-signature-data-types.patch
@@ -43386,9 +43470,6 @@
patches.suse/0005-MODSIGN-Allow-the-db-UEFI-variable-to-be-suppressed.patch
patches.suse/0006-modsign-Use-secondary-trust-keyring-for-module-signi.patch
- # s390/linux fixes
- patches.arch/s390-sles15-zcrypt-fix-specification-exception.patch
-
# kvalo/wireless-drivers-next
patches.drivers/brcmfmac-Use-firmware_request_nowarn-for-the-clm_blo.patch
@@ -43428,12 +43509,6 @@
patches.drivers/scsi-lpfc-Update-12.2.0.0-file-copyrights-to-2019.patch
patches.drivers/scsi-lpfc-Update-lpfc-version-to-12.2.0.0.patch
- # mkp/scsi fixes
- patches.fixes/scsi-target-make-the-pi_prot_format-ConfigFS-path-re.patch
-
- # git://git.infradead.org/nvme.git nvme-5.0
- patches.fixes/nvme-llock-NS-list-changes-while-handling-command-ef.patch
-
# out-of-tree patches
patches.drivers/firmware-arm_sdei-fix-wrong-of_node_put-in-init-function.patch
patches.arch/powerpc-pseries-Track-LMB-nid-instead-of-using-devic.patch
@@ -43570,6 +43645,7 @@
patches.fixes/getcwd-close-race-with-d_move-called-by-lustre.patch
patches.fixes/vfs-use-synchronize_rcu_expedited-in-namespace_unlock.patch
patches.drivers/lustre-Simplify-ib_post_-send-recv-srq_recv-calls.patch
+ patches.suse/mm-Adjust-watermark-boost-factor-tunable.patch
# bnc#1102831
patches.suse/mm-sched-numa-Remove-remaining-traces-of-NUMA-rate-limiting.patch
@@ -43819,7 +43895,6 @@
########################################################
# Out-of-tree networking
########################################################
- patches.suse/qed-bump-drivers-to-version-8.10.10.55.patch
patches.suse/bsc1084332-0003-lan78xx-Enable-LEDs-and-auto-negotiation.patch
patches.fixes/irda-Fix-memory-leak-caused-by-repeated-binds-of-ird.patch
patches.fixes/irda-Only-insert-new-objects-into-the-global-databas.patch
diff --git a/supported.conf b/supported.conf
index ae41c435eb..7e1aa0b46b 100644
--- a/supported.conf
+++ b/supported.conf
@@ -124,6 +124,7 @@
crypto/cast_common
crypto/cast5_generic
crypto/cast6_generic
+- drivers/crypto/cavium/zip/thunderx_zip
crypto/cbc
crypto/ccm
crypto/chacha20_generic
@@ -222,11 +223,13 @@
drivers/acpi/video
drivers/ata/acard-ahci
+base drivers/ata/ahci # fate#303913
+- drivers/ata/ahci_brcm
drivers/ata/ahci_ceva # fate#320029
drivers/ata/ahci_mvebu
drivers/ata/ahci_qoriq # NXP LS1043A LS2080A
drivers/ata/ahci_platform
drivers/ata/ahci_seattle
+- drivers/ata/ahci_sunxi
- drivers/ata/ahci_tegra
drivers/ata/libahci_platform
drivers/ata/ahci_xgene
@@ -245,6 +248,7 @@
drivers/ata/pata_cmd640
drivers/ata/pata_cmd64x
drivers/ata/pata_cypress
+- drivers/ata/sata_dwc_460ex
drivers/ata/pata_efar
drivers/ata/pata_hpt366
drivers/ata/pata_hpt37x
@@ -294,6 +298,7 @@
drivers/auxdisplay/cfag12864bfb
- drivers/auxdisplay/charlcd
- drivers/auxdisplay/hd44780.ko
+- drivers/auxdisplay/ht16k33
drivers/auxdisplay/ks0108
- drivers/auxdisplay/panel
drivers/base/regmap/regmap-i2c
@@ -328,6 +333,7 @@
drivers/bluetooth/btmrvl
drivers/bluetooth/btmrvl_sdio
drivers/bluetooth/btqca
+- drivers/bluetooth/btqcomsmd
drivers/bluetooth/btrtl
drivers/bluetooth/btsdio
drivers/bluetooth/btusb
@@ -396,6 +402,7 @@
drivers/char/tpm/tpm_nsc
drivers/char/tpm/tpm_tis
drivers/char/tpm/tpm_tis_core
+- drivers/char/tpm/tpm_tis_spi
- drivers/char/tpm/tpm_vtpm_proxy # virtual testing driver
drivers/char/tpm/tpm_xenu
drivers/char/tpm/xen-tpmfront
@@ -409,6 +416,7 @@
- drivers/cpufreq/arm_big_little
drivers/cpufreq/amd_freq_sensitivity # AMD frequency sensitivity feedback to the ondemand governor
drivers/cpufreq/bcm2835-cpufreq # bsc#989511
+- drivers/cpufreq/brcmstb-avs-cpufreq
drivers/cpufreq/cpufreq_conservative
drivers/cpufreq/cpufreq-dt
drivers/cpufreq/cpufreq-dt-platdev # fate#322003
@@ -423,6 +431,10 @@
drivers/cpufreq/pcc-cpufreq # HP's PCC cpufreq driver -> fate#306746
drivers/cpufreq/powernow-k8 # Old AMD Athlon 64 and Opteron processor frequency driver,
# still supporting IO based switching. MSR based switching is done via acpi-cpufreq
+- drivers/cpufreq/qoriq-cpufreq
+- drivers/cpufreq/scpi-cpufreq
+- drivers/cpufreq/tegra186-cpufreq
+- drivers/crypto/bcm/bcm_crypto_spu
drivers/crypto/caam/*
drivers/crypto/ccp
drivers/crypto/ccp/ccp-crypto
@@ -465,12 +477,17 @@
- drivers/dma/hsu/hsu_dma
drivers/dma/idma64
drivers/dma/ioat/ioatdma # IOAT DMA Driver from Intel
+- drivers/dma/k3dma
# drivers/dma/mic_x100_dma # disabled (FATE#321372)
drivers/dma/qcom/bam_dma
drivers/dma/qcom/hdma
drivers/dma/qcom/hdma_mgmt
+- drivers/dma/sun6i-dma
drivers/dma/xgene-dma
+- drivers/dma/xilinx/xilinx_dma
+- drivers/dma/xilinx/zynqmp_dma
drivers/dma/virt-dma
+- drivers/dma/zx_dma
drivers/edac/amd64_edac_mod # EDAC driver for all AMD platforms
drivers/edac/cpc925_edac # IBM HT-bridge in some PPC hw
drivers/edac/e752x_edac
@@ -485,6 +502,7 @@
drivers/edac/i7core_edac
drivers/edac/i82975x_edac
drivers/edac/ie31200_edac # single-CPU SNB,IVB,HSW
+- drivers/edac/layerscape_edac_mod
drivers/edac/mce_amd_inj # MCE error injection module on AMD
drivers/edac/pnd2_edac # Denverton SoC, fate#322662
drivers/edac/sb_edac # EDAC driver for Sandybridge machines, fate#311968
@@ -498,12 +516,14 @@
- drivers/extcon/extcon-gpio
- drivers/extcon/extcon-intel-int3496
- drivers/extcon/extcon-max3355
+- drivers/extcon/extcon-qcom-spmi-misc
- drivers/extcon/extcon-sm5502
drivers/firewire/firewire_core
drivers/firewire/firewire_net
drivers/firewire/firewire_ohci
drivers/firewire/firewire_sbp2
drivers/firewire/nosy # FireWire traffic sniffer for TI PCILynx cards
+- drivers/firmware/arm_scpi
+external drivers/firmware/dcdbas # fate#143 bsc#153134
+external drivers/firmware/dell_rbu # fate#142 bsc#153134
drivers/firmware/dmi-sysfs # fate#320109
@@ -513,7 +533,9 @@
drivers/firmware/efi/efivars # efi sysfs information
+base drivers/firmware/iscsi_ibft
drivers/firmware/qemu_fw_cfg # bsc#1077919
+- drivers/firmware/scpi_pm_domain
drivers/fpga/altera-pr-ip-core
+- drivers/fpga/altera-pr-ip-core-plat
drivers/fpga/dfl # fate#326235
drivers/fpga/dfl-afu # fate#326235
drivers/fpga/dfl-fme # fate#326235
@@ -524,8 +546,10 @@
drivers/fpga/fpga-bridge # fate#322047
drivers/fpga/fpga-mgr
drivers/fpga/fpga-region # fate#322047
+- drivers/fpga/ice40-spi
drivers/fpga/of-fpga-region # fate#326235
drivers/fpga/xilinx-pr-decoupler # fate#326235
+- drivers/fpga/xilinx-spi
drivers/fpga/zynq-fpga
- drivers/fsi/fsi-core
- drivers/gpio/gpio-axp209
@@ -535,6 +559,7 @@
- drivers/gpio/gpio-adp5588
- drivers/gpio/gpio-amd8111
drivers/gpio/gpio-amdpt
+- drivers/gpio/gpio-brcmstb
- drivers/gpio/gpio-dln2
drivers/gpio/gpio-dwapb
- drivers/gpio/gpio-exar
@@ -544,6 +569,7 @@
drivers/gpio/gpio-ich
- drivers/gpio/gpio-it87
- drivers/gpio/gpio-lp3943
+- drivers/gpio/gpio-lp873x
- drivers/gpio/gpio-max7300
drivers/gpio/gpio-max730x
drivers/gpio/gpio-max732x
@@ -553,6 +579,7 @@
drivers/gpio/gpio-pca953x
drivers/gpio/gpio-pcf857x
- drivers/gpio/gpio-pci-idio-16
+- drivers/gpio/gpio-pisosr
- drivers/gpio/gpio-sch311x
- drivers/gpio/gpio-sch
drivers/gpio/gpio-thunderx
@@ -569,6 +596,8 @@
drivers/gpu/drm/amd/amdgpu/amdgpu
drivers/gpu/drm/amd/amdkfd/amdkfd
drivers/gpu/drm/amd/lib/chash
+- drivers/gpu/drm/arm/hdlcd
+- drivers/gpu/drm/arm/mali-dp
drivers/gpu/drm/ast/ast # fate#314487
drivers/gpu/drm/bochs/bochs-drm # bsc#969091
drivers/gpu/drm/bridge/analogix/analogix_dp
@@ -581,12 +610,18 @@
drivers/gpu/drm/drm_usb
- drivers/gpu/drm/gma500/gma500_gfx
drivers/gpu/drm/hisilicon/hibmc/hibmc-drm # fate#322061
+- drivers/gpu/drm/hisilicon/kirin/dw_drm_dsi
+- drivers/gpu/drm/hisilicon/kirin/kirin-drm
drivers/gpu/drm/i2c/ch7006
drivers/gpu/drm/i2c/sil164
- drivers/gpu/drm/i2c/adv7511
drivers/gpu/drm/i810/i810 # Intel i810
drivers/gpu/drm/i915/i915 # Intel 830M/i915
drivers/gpu/drm/i915/gvt/kvmgt
+- drivers/gpu/drm/mediatek/mediatek-drm
+- drivers/gpu/drm/mediatek/mediatek-drm-hdmi
+- drivers/gpu/drm/meson/meson-drm
+- drivers/gpu/drm/meson/meson_dw_hdmi
drivers/gpu/drm/mga/mga # Matrox G200/G400
drivers/gpu/drm/mgag200/mgag200 # fate#314425
- drivers/gpu/drm/msm # Qualcomm Snapdragon (phone)
@@ -612,6 +647,7 @@
- drivers/gpu/drm/via/via
+base drivers/gpu/drm/virtio-gpu # fate#319660
drivers/gpu/drm/vmwgfx/vmwgfx # fate#315585 VMware DRM driver for Virtual GPU
+- drivers/gpu/drm/zte/zxdrm
- drivers/gpu/host1x/host1x # Tegra is unsupported
drivers/hid/hid
drivers/hid/hid-a4tech
@@ -778,6 +814,7 @@
drivers/i2c/busses/i2c-amd8111 # AMD8111 SMBus 2.0 driver
drivers/i2c/busses/i2c-bcm2835
drivers/i2c/busses/i2c-bcm-iproc
+- drivers/i2c/busses/i2c-brcmstb
drivers/i2c/busses/i2c-cadence
- drivers/i2c/busses/i2c-cros-ec-tunnel
drivers/i2c/busses/i2c-diolan-u2c # Diolan u2c-12 USB-I2C driver
@@ -787,11 +824,13 @@
drivers/i2c/busses/i2c-designware-platform
drivers/i2c/busses/i2c-dln2
drivers/i2c/busses/i2c-gpio # Raspberry Pi 7" touchscreen
+- drivers/i2c/busses/i2c-hix5hd2
drivers/i2c/busses/i2c-i801 # Intel 82801 SMBus driver
drivers/i2c/busses/i2c-imx
drivers/i2c/busses/i2c-imx-lpi2c
drivers/i2c/busses/i2c-isch # Intel SCH SMBus driver
drivers/i2c/busses/i2c-ismt # Intel SMT driver (for Centerton)
+- drivers/i2c/busses/i2c-meson
- drivers/i2c/busses/i2c-mlxcpld
- drivers/i2c/busses/i2c-mt65xx
- drivers/i2c/busses/i2c-mt8173
@@ -810,6 +849,7 @@
drivers/i2c/busses/i2c-sis630 # SIS630 SMBus driver
drivers/i2c/busses/i2c-sis96x # SiS96x SMBus driver
- drivers/i2c/busses/i2c-tegra
+- drivers/i2c/busses/i2c-tegra-bpmp
drivers/i2c/busses/i2c-xgene-slimpro # APM XGene
drivers/i2c/busses/i2c-xlp9xx.ko
drivers/i2c/busses/i2c-taos-evm
@@ -823,6 +863,7 @@
drivers/i2c/i2c-smbus
drivers/i2c/i2c-stub
- drivers/i2c/muxes/i2c-arb-gpio-challenge
+- drivers/i2c/muxes/i2c-demux-pinctrl
drivers/i2c/muxes/i2c-mux-gpio
- drivers/i2c/muxes/i2c-mux-ltc4306
- drivers/i2c/muxes/i2c-mux-mlxcpld
@@ -888,9 +929,11 @@
- drivers/input/keyboard/qt1070 # For embedded devices
- drivers/input/keyboard/qt2160 # For embedded devices
drivers/input/keyboard/sunkbd # Sun keyboard driver
+- drivers/input/keyboard/sun4i-lradc-keys
- drivers/input/keyboard/tca6416-keypad # For embedded devices
- drivers/input/keyboard/tca8418_keypad # For embedded devices
- drivers/input/keyboard/tegra-kbc
+- drivers/input/keyboard/tm2-touchkey
drivers/input/keyboard/xtkbd # XT keyboard driver
drivers/input/matrix-keymap
- drivers/input/misc/ad714x # Touch-sensor, mostly for phones
@@ -899,12 +942,14 @@
- drivers/input/misc/adxl34x-i2c # Acceleration sensor
- drivers/input/misc/adxl34x-spi
drivers/input/misc/apanel
+- drivers/input/misc/atmel_captouch
drivers/input/misc/ati_remote2
drivers/input/misc/atlas_btns
- drivers/input/misc/axp20x-pek
drivers/input/misc/cm109
- drivers/input/misc/cma3000_d0x # Acceleration sensor
- drivers/input/misc/cma3000_d0x_i2c # Acceleration sensor
+- drivers/input/misc/cpcap-pwrbutton
- drivers/input/misc/da9063_onkey
- drivers/input/misc/drv26*
- drivers/input/misc/ideapad_slidebar # For Lenovo Ideapad
@@ -918,6 +963,7 @@
- drivers/input/rmi4/rmi_i2c
- drivers/input/rmi4/rmi_smbus
- drivers/input/rmi4/rmi_spi
+- drivers/input/misc/hisi_powerkey
drivers/input/misc/rotary_encoder
- drivers/input/misc/soc_button_array
drivers/input/misc/uinput # User level driver support for input subsystem
@@ -994,7 +1040,9 @@
- drivers/leds/leds-bd2802
- drivers/leds/leds-blinkm
drivers/leds/leds-clevo-mail
+- drivers/leds/leds-cpcap
drivers/leds/leds-gpio
+- drivers/leds/leds-is31fl319x
- drivers/leds/leds-is31fl32xx
- drivers/leds/leds-lm3530
- drivers/leds/leds-lm355x
@@ -1030,7 +1078,11 @@
drivers/lightnvm/gennvm # fate#319446
drivers/lightnvm/pblk
drivers/lightnvm/rrpc # fate#319446
+- drivers/mailbox/bcm-flexrm-mailbox
+- drivers/mailbox/bcm-pdc-mailbox
+- drivers/mailbox/hi6220-mailbox
drivers/mailbox/mailbox-xgene-slimpro # fate#319483
+- drivers/mailbox/platform_mhu
drivers/md/bcache/bcache
drivers/md/dm-bio-prison
drivers/md/dm-bufio
@@ -1188,8 +1240,10 @@
+base drivers/message/fusion/mptsas
drivers/message/fusion/mptscsih # Fusion MPT SCSI Host driver
+base drivers/message/fusion/mptspi
+- drivers/mfd/ac100
- drivers/mfd/axp20x
- drivers/mfd/axp20x-i2c
+- drivers/mfd/axp20x-rsb
- drivers/mfd/atmel-hlcdc
- drivers/mfd/cros_ec_core
- drivers/mfd/cros_ec_i2c
@@ -1197,8 +1251,11 @@
- drivers/mfd/cros_ec
- drivers/mfd/da9062-core
drivers/mfd/dln2
+- drivers/mfd/exynos-lpass
+- drivers/mfd/hi655x-pmic
drivers/mfd/htc-pasic3
- drivers/mfd/lp3943
+- drivers/mfd/lp873x
drivers/mfd/lpc_ich
drivers/mfd/lpc_sch
drivers/mfd/intel-lpss-acpi
@@ -1209,8 +1266,10 @@
- drivers/mfd/intel_soc_pmic_chtdc_ti
- drivers/mfd/menf21bmc
drivers/mfd/mfd-core
+- drivers/mfd/motorola-cpcap
- drivers/mfd/qcom_rpm
drivers/mfd/rk808
+- drivers/mfd/sun4i-gpadc
- drivers/mfd/ti_am335x_tscadc
- drivers/mfd/ti-lmu
- drivers/mfd/tps65010
@@ -1270,6 +1329,9 @@
drivers/mmc/card/mmc_block
drivers/mmc/card/sdio_uart
drivers/mmc/core/mmc_core
+- drivers/mmc/core/pwrseq_emmc
+- drivers/mmc/core/pwrseq_sd8787
+- drivers/mmc/core/pwrseq_simple
drivers/mmc/host/bcm2835 # RPi3 (bsc#983145)
- drivers/mmc/host/cb710-mmc
drivers/mmc/host/cqhci
@@ -1280,13 +1342,17 @@
drivers/mmc/host/dw_mmc-pci
drivers/mmc/host/dw_mmc-pltfm
drivers/mmc/host/dw_mmc-rockchip
+- drivers/mmc/host/dw_mmc-zx
drivers/mmc/host/armmmci
+- drivers/mmc/host/meson-gx-mmc
- drivers/mmc/host/mtk-sd
drivers/mmc/host/rtsx_pci_sdmmc
drivers/mmc/host/rtsx_usb_sdmmc
drivers/mmc/host/sdhci
drivers/mmc/host/sdhci-acpi
- drivers/mmc/host/sdhci-bcm2835
+- drivers/mmc/host/sdhci-brcmstb
+- drivers/mmc/host/sdhci-cadence
drivers/mmc/host/sdhci-esdhc-imx
- drivers/mmc/host/sdhci_f_sdh30
drivers/mmc/host/sdhci-iproc
@@ -1298,6 +1364,7 @@
drivers/mmc/host/sdhci-pxav3 # Marvell plattforms (fate#319899 fate#320700)
- drivers/mmc/host/sdhci-tegra
drivers/mmc/host/sdhci-xenon-driver
+- drivers/mmc/host/sunxi-mmc
drivers/mmc/host/thunderx-mmc
drivers/mmc/host/tifm_sd
- drivers/mmc/host/toshsd
@@ -1324,6 +1391,7 @@
- drivers/net/can/sja1000/plx_pci
drivers/net/can/sja1000/sja1000
drivers/net/can/slcan
+- drivers/net/can/spi/hi311x
- drivers/net/can/usb/ems_usb
- drivers/net/can/usb/esd_usb2
- drivers/net/can/usb/gs_usb
@@ -1364,6 +1432,8 @@
- drivers/net/ethernet/aurora/nb8800
drivers/net/ethernet/broadcom/b44 # Broadcom 4400 10/100 PCI ethernet driver
- drivers/net/ethernet/broadcom/bcmsysport
+- drivers/net/ethernet/broadcom/bgmac
+- drivers/net/ethernet/broadcom/bgmac-platform
- drivers/net/ethernet/broadcom/genet
drivers/net/ethernet/broadcom/bnx2 # Broadcom NX2 network driver
drivers/net/ethernet/broadcom/bnx2x/bnx2x
@@ -1372,6 +1442,7 @@
drivers/net/ethernet/broadcom/bnxt/bnxt_en
drivers/net/ethernet/brocade/bna/bna # Brocade 10Gb Ethernet Driver
drivers/net/ethernet/cadence/macb
+- drivers/net/ethernet/cadence/macb_pci
drivers/net/ethernet/cavium/common/cavium_ptp
drivers/net/ethernet/cavium/liquidio/liquidio
drivers/net/ethernet/cavium/liquidio/liquidio_vf
@@ -1409,6 +1480,7 @@
drivers/net/ethernet/freescale/fman/*
drivers/net/ethernet/hp/hp100 # HP CASCADE Architecture Driver for 100VG-AnyLan Network Adapters
- drivers/net/ethernet/hisilicon/hip04_eth
+- drivers/net/ethernet/hisilicon/hisi_femac
- drivers/net/ethernet/hisilicon/hix5hd2_gmac
drivers/net/ethernet/hisilicon/hns_mdio
drivers/net/ethernet/hisilicon/hns/*
@@ -1535,13 +1607,17 @@
drivers/net/phy/mdio-bitbang
drivers/net/phy/mdio-cavium # bsc#1040902
drivers/net/phy/mdio-gpio
+- drivers/net/phy/mdio-hisi-femac
drivers/net/phy/mdio-i2c
- drivers/net/phy/mdio-mux
+- drivers/net/phy/mdio-mux-bcm-iproc
- drivers/net/phy/mdio-mux-gpio
- drivers/net/phy/mdio-mux-mmioreg
drivers/net/phy/mdio-octeon
+- drivers/net/phy/mdio-sun4i
drivers/net/phy/mdio-thunder # bsc#1040902
drivers/net/phy/mdio-xgene
+- drivers/net/phy/meson-gxl
drivers/net/phy/micrel
- drivers/net/phy/microchip
drivers/net/phy/mscc
@@ -1555,6 +1631,7 @@
- drivers/net/phy/teranetics
drivers/net/phy/vitesse
drivers/net/phy/xgene
+- drivers/net/phy/xilinx_gmii2rgmii
drivers/net/plip/plip
drivers/net/ppp/bsd_comp
drivers/net/ppp/ppp_async
@@ -1623,7 +1700,14 @@
drivers/net/wireless/ath/carl9170/carl9170
drivers/net/wireless/ath/wcn36xx/wcn36xx
drivers/net/wireless/ath/wil6210/wil6210
+- drivers/remoteproc/qcom_adsp_pil
+- drivers/remoteproc/qcom_common
+- drivers/remoteproc/qcom_q6v5_pil
- drivers/remoteproc/remoteproc
+- drivers/reset/hisilicon/hi6220_reset
+- drivers/reset/hisilicon/reset-hi3660
+- drivers/rpmsg/qcom_smd
+- drivers/rpmsg/rpmsg_char
drivers/rpmsg/rpmsg_core # rpmsg_core needed by wcn36xx
drivers/net/wireless/ath/wcn36xx/wcn36xx
drivers/net/wireless/ath/wil6210/wil6210
@@ -1666,9 +1750,13 @@
drivers/nvdimm/of_pmem
drivers/nvme/host/* # fate#319965
drivers/nvme/target/* # fate#321732
+- drivers/nvmem/nvmem-bcm-ocotp
drivers/nvmem/nvmem_core
+- drivers/nvmem/nvmem_meson_efuse
+- drivers/nvmem/nvmem_mtk-efuse
drivers/nvmem/nvmem_qfprom
- drivers/nvmem/nvmem_rockchip_efuse
+- drivers/nvmem/nvmem_sunxi_sid
drivers/of/of_mdio
drivers/parport/parport
drivers/parport/parport_ax88796
@@ -1723,6 +1811,7 @@
drivers/phy/rockchip/phy-rockchip-pcie
drivers/phy/rockchip/phy-rockchip-typec
- drivers/phy/rockchip/phy-rockchip-usb
+- drivers/phy/tegra/phy-tegra-xusb
drivers/pinctrl/intel/pinctrl-broxton
drivers/pinctrl/intel/pinctrl-cannonlake
drivers/pinctrl/intel/pinctrl-cherryview
@@ -1817,20 +1906,31 @@
drivers/pwm/pwm-bcm2835
- drivers/pwm/*
- drivers/rapidio/*
+- drivers/regulator/axp20x-regulator
+- drivers/regulator/cpcap-regulator
drivers/regulator/fixed
drivers/regulator/fan53555
drivers/regulator/rk808-regulator
- drivers/regulator/gpio-regulator
+- drivers/regulator/hi655x-regulator
- drivers/regulator/isl9305
+- drivers/regulator/lm363x-regulator
+- drivers/regulator/lp873x-regulator
- drivers/regulator/ltc3589
+- drivers/regulator/ltc3676
- drivers/regulator/pwm-regulator
- drivers/regulator/qcom_rpm-regulator
- drivers/regulator/qcom_smd-regulator
+- drivers/regulator/tps65132-regulator
+- drivers/regulator/vctrl-regulator
drivers/regulator/vexpress
+- drivers/regulator/vexpress-regulator
drivers/rtc/rtc-ab-b5ze-s3
drivers/rtc/rtc-abx80x
+- drivers/rtc/rtc-ac100
drivers/rtc/rtc-armada38x
drivers/rtc/rtc-cmos
+- drivers/rtc/rtc-cpcap
drivers/rtc/rtc-ds1307
drivers/rtc/rtc-ds1374
drivers/rtc/rtc-ds1672
@@ -1845,6 +1945,7 @@
drivers/rtc/rtc-isl1208
drivers/rtc/rtc-m41t80
drivers/rtc/rtc-max6900
+- drivers/rtc/rtc-max6916
drivers/rtc/rtc-mv
+external drivers/rtc/rtc-opal # supported by IBM
drivers/rtc/rtc-pcf2127
@@ -1853,6 +1954,7 @@
drivers/rtc/rtc-pcf8563
drivers/rtc/rtc-pcf8583
drivers/rtc/rtc-rk808
+- drivers/rtc/rtc-r7301
drivers/rtc/rtc-rs5c372
- drivers/rtc/rtc-rv8803
- drivers/rtc/rtc-rx8010
@@ -2020,12 +2122,18 @@
drivers/soc/fsl/dpio/fsl-mc-dpio
drivers/soc/qcom/*
drivers/soc/rockchip/grf # fate#322003
+- drivers/spi/spi-armada-3700
drivers/spi/spi-bitbang
drivers/spi/spi-bcm2835
drivers/spi/spi-bcm2835aux
+- drivers/spi/spi-bcm-qspi
+- drivers/spi/spi-brcmstb-qspi
drivers/spi/spi-cadence # fate#320029
drivers/spi/spi-fsl-dspi
+- drivers/spi/spi-iproc-qspi
+- drivers/spi/spi-loopback-test
drivers/spi/spi-orion # fate#319899 fate#320700
+- drivers/spi/spi-sun4i
drivers/spi/spi-thunderx.ko
drivers/spi/spi-xilinx # fate#320029
drivers/spi/spi-xlp # fate#319481
@@ -2059,6 +2167,8 @@
drivers/target/target_core_rbd # fate#318836 SES2 Ceph RBD iSCSI gateway
drivers/target/tcm_fc/tcm_fc
drivers/target/target_core_user # fate#320188
+- drivers/tee/optee/optee
+- drivers/tee/tee
drivers/thermal/armada_thermal
drivers/thermal/broadcom/bcm2835-thermal # bsc#989511 bsc#1095573
drivers/thermal/hisi_thermal
@@ -2073,6 +2183,8 @@
drivers/thermal/intel_powerclamp # fate#315620
- drivers/thermal/intel_soc_dts_iosf
- drivers/thermal/intel_soc_dts_thermal
+- drivers/thermal/mtk_thermal
+- drivers/thermal/qcom/qcom_tsens
drivers/thermal/qoriq_thermal
- drivers/thermal/rockchip_thermal
- drivers/thermal/samsung/*
@@ -2080,6 +2192,7 @@
drivers/thermal/thermal_sys # Generic thermal zone interface
drivers/thermal/x86_pkg_temp_thermal
drivers/thermal/intel_pch_thermal
+- drivers/thermal/zx2967_thermal
drivers/tty/cyclades
- drivers/tty/ehv_bytechan
+external drivers/tty/hvc/hvcs # IBM pSeries virtual console server
@@ -2152,6 +2265,7 @@
drivers/usb/host/ehci-msm
- drivers/usb/host/ehci-tegra
+base drivers/usb/host/ehci-hcd # 2003-Dec-29 USB 2.0 'Enhanced' Host Controller (EHCI) Driver
+- drivers/usb/host/ehci-orion
+base drivers/usb/host/ehci-pci # 2013-Dec-16 USB 2.0 'Enhanced' Host Controller (EHCI) Driver
drivers/usb/host/ehci-platform # For SoC
- drivers/usb/host/hwa-hc
@@ -2163,8 +2277,10 @@
- drivers/usb/host/whci/whci-hcd
drivers/usb/host/xen-hcd # fate#315712
+base drivers/usb/host/xhci-hcd # bsc#712752
+- drivers/usb/host/xhci-mtk
+base drivers/usb/host/xhci-pci
drivers/usb/host/xhci-plat-hcd
+- drivers/usb/host/xhci-tegra
drivers/usb/isp1760/isp1760
drivers/usb/image/mdc800 # USB Driver for Mustek MDC800 Digital Camera
drivers/usb/image/microtek # Microtek Scanmaker X6 USB scanner driver
@@ -2200,7 +2316,9 @@
drivers/usb/misc/uss720 # USB Parport Cable driver for Cables using the Lucent Technologies USS720 Chip
- drivers/usb/misc/yurex # Esoteric specialised input device
- drivers/usb/mon/usbmon # The USB Monitor
+- drivers/usb/mtu3/mtu3
- drivers/usb/musb/musb_hdrc # For embedded systems
+- drivers/usb/musb/sunxi
- drivers/usb/phy/phy-am335x # For embedded systems
- drivers/usb/phy/phy-am335x-control # For embedded systems
drivers/usb/phy/phy-generic
@@ -2353,6 +2471,8 @@
drivers/watchdog/machzwd # MachZ ZF-Logic Watchdog driver
drivers/watchdog/mei_wdt
- drivers/watchdog/mena21_wdt
+- drivers/watchdog/meson_gxbb_wdt
+- drivers/watchdog/meson_wdt
- drivers/watchdog/mtk_wdt
- drivers/watchdog/ni903x_wdt
- drivers/watchdog/nic7018_wdt
@@ -2372,6 +2492,7 @@
drivers/watchdog/smsc37b787_wdt
drivers/watchdog/softdog # Software Watchdog Device Driver
- drivers/watchdog/sp5100_tco
+- drivers/watchdog/sunxi_wdt
- drivers/watchdog/tegra_wdt
drivers/watchdog/w83627hf_wdt # w38627hf WDT driver
drivers/watchdog/w83697hf_wdt
@@ -2383,6 +2504,7 @@
drivers/watchdog/wdt_pci # Driver for the ICS PCI-WDT500/501 watchdog cards
drivers/watchdog/xen_wdt # Xen pv watchdog driver
- drivers/watchdog/ziirave_wdt
+- drivers/watchdog/zx2967_wdt
drivers/xen/blkback/blkback-pagemap
drivers/xen/blkback/blkbk # Xen block device backend
+base drivers/xen/blkfront/xenblk # Xen block device frontend
@@ -2940,6 +3062,8 @@
+base net/packet/af_packet # packet sockets (e.g. tcpdump)
net/packet/af_packet_diag # packet socket monitoring via netlink
net/psample/psample # netlink packet sampling interface
+- net/qrtr/qrtr
+- net/qrtr/qrtr-smd
net/rds/rds # Reliable Datagram Sockets (RDS) protocol
net/rds/rds_rdma # RDS over Infiniband and iWARP
net/rds/rds_tcp # RDS over TCP