Home Home > GIT Browse > openSUSE-15.1
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorPetr Tesarik <ptesarik@suse.cz>2019-07-13 19:59:31 +0200
committerPetr Tesarik <ptesarik@suse.cz>2019-07-13 19:59:31 +0200
commit0ab03b7cb746b414046caa4cbf23793a253ce7b3 (patch)
tree35d9265eed3e3a39ec8f5f85d7abdc90564535ab
parentd3899dba3b40493002db660eee06af9262f515a3 (diff)
parent9d0e4fc071d2acb10d633d125d84c6258befec19 (diff)
Merge branch 'SLE15-SP1' into openSUSE-15.1openSUSE-15.1
Conflicts: config/ppc64le/default
-rw-r--r--blacklist.conf23
-rw-r--r--config/ppc64le/default2
-rw-r--r--patches.arch/kvm-svm-avic-fix-off-by-one-in-checking-host-apic-id43
-rw-r--r--patches.arch/kvm-x86-fix-return-value-for-reserved-efer36
-rw-r--r--patches.arch/kvm-x86-skip-efer-vs-guest-cpuid-checks-for-host-initiated-writes99
-rw-r--r--patches.arch/powerpc-mm-64s-hash-Reallocate-context-ids-on-fork.patch144
-rw-r--r--patches.arch/powerpc-perf-Add-PM_LD_MISS_L1-and-PM_BR_2PATH-to-po.patch60
-rw-r--r--patches.arch/powerpc-perf-Add-POWER9-alternate-PM_RUN_CYC-and-PM_.patch55
-rw-r--r--patches.arch/powerpc-perf-Add-blacklisted-events-for-Power9-DD2.1.patch18
-rw-r--r--patches.arch/powerpc-rtas-retry-when-cpu-offline-races-with-suspe.patch59
-rw-r--r--patches.arch/revert-svm-fix-avic-incomplete-ipi-emulation71
-rw-r--r--patches.arch/svm-add-warning-message-for-avic-ipi-invalid-target34
-rw-r--r--patches.arch/svm-fix-avic-incomplete-ipi-emulation56
-rw-r--r--patches.arch/x86-amd_nb-add-pci-device-ids-for-family-17h-model-30h.patch25
-rw-r--r--patches.arch/x86-amd_nb-add-support-for-newer-pci-topologies.patch26
-rw-r--r--patches.arch/x86-cpu-get-cache-info-and-setup-cache-cpumap-for-hygon-dhyana.patch124
-rw-r--r--patches.drivers/0001-usb-typec-Group-all-TCPCI-TCPM-code-together.patch22
-rw-r--r--patches.drivers/ACPI-PM-Allow-transitions-to-D0-to-occur-in-special-.patch146
-rw-r--r--patches.drivers/ACPI-PM-Avoid-evaluating-_PS3-on-transitions-from-D3.patch50
-rw-r--r--patches.drivers/ACPICA-Clear-status-of-GPEs-on-first-direct-enable.patch135
-rw-r--r--patches.drivers/ALSA-firewire-lib-fireworks-fix-miss-detection-of-re.patch57
-rw-r--r--patches.drivers/ALSA-hda-Force-polling-mode-on-CNL-for-fixing-codec-.patch45
-rw-r--r--patches.drivers/ALSA-hda-realtek-Add-quirks-for-several-Clevo-notebo.patch49
-rw-r--r--patches.drivers/ALSA-hda-realtek-Change-front-mic-location-for-Lenov.patch34
-rw-r--r--patches.drivers/ALSA-line6-Fix-write-on-zero-sized-buffer.patch44
-rw-r--r--patches.drivers/ALSA-seq-fix-incorrect-order-of-dest_client-dest_por.patch51
-rw-r--r--patches.drivers/ALSA-usb-audio-Fix-parse-of-UAC2-Extension-Units.patch138
-rw-r--r--patches.drivers/ALSA-usb-audio-fix-sign-unintended-sign-extension-on.patch48
-rw-r--r--patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX20723
-rw-r--r--patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC3
-rw-r--r--patches.drivers/ASoC-cx2072x-fix-integer-overflow-on-unsigned-int-mu.patch41
-rw-r--r--patches.drivers/Bluetooth-Fix-regression-with-minimum-encryption-key.patch154
-rw-r--r--patches.drivers/Drivers-misc-fix-out-of-bounds-access-in-function-pa.patch42
-rw-r--r--patches.drivers/IB-hfi1-Clear-the-IOWAIT-pending-bits-when-QP-is-put.patch43
-rw-r--r--patches.drivers/IB-hfi1-Create-inline-to-get-extended-headers.patch100
-rw-r--r--patches.drivers/IB-hfi1-Validate-fault-injection-opcode-user-input.patch44
-rw-r--r--patches.drivers/IB-mlx5-Verify-DEVX-general-object-type-correctly.patch62
-rw-r--r--patches.drivers/Input-synaptics-enable-SMBus-on-ThinkPad-E480-and-E5.patch40
-rw-r--r--patches.drivers/Input-uinput-add-compat-ioctl-number-translation-for.patch65
-rw-r--r--patches.drivers/PCI-P2PDMA-fix-the-gen_pool_add_virt-failure-path.patch54
-rw-r--r--patches.drivers/PCI-PM-Skip-devices-in-D0-for-suspend-to-idle.patch119
-rw-r--r--patches.drivers/PCI-rpadlpar-Fix-leaked-device_node-references-in-ad.patch60
-rw-r--r--patches.drivers/RDMA-ipoib-Allow-user-space-differentiate-between-va.patch53
-rw-r--r--patches.drivers/RDMA-mlx5-Do-not-allow-the-user-to-write-to-the-cloc.patch38
-rw-r--r--patches.drivers/RDMA-mlx5-Initialize-roce-port-info-before-multiport.patch60
-rw-r--r--patches.drivers/RDMA-mlx5-Use-rdma_user_map_io-for-mapping-BAR-pages.patch41
-rw-r--r--patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch378
-rw-r--r--patches.drivers/Revert-net-mlx5e-Enable-reporting-checksum-unnecessa.patch45
-rw-r--r--patches.drivers/USB-Fix-chipmunk-like-voice-when-using-Logitech-C270.patch42
-rw-r--r--patches.drivers/USB-serial-option-add-Telit-0x1260-and-0x1261-compos.patch37
-rw-r--r--patches.drivers/USB-serial-option-add-support-for-Simcom-SIM7500-SIM.patch55
-rw-r--r--patches.drivers/USB-serial-pl2303-add-Allied-Telesis-VT-Kit3.patch47
-rw-r--r--patches.drivers/USB-usb-storage-Add-new-ID-to-ums-realtek.patch41
-rw-r--r--patches.drivers/bpf-devmap-Add-missing-RCU-read-lock-on-flush.patch54
-rw-r--r--patches.drivers/bpf-devmap-Add-missing-bulk-queue-free.patch28
-rw-r--r--patches.drivers/bpf-devmap-Fix-premature-entry-free-on-destroying-ma.patch45
-rw-r--r--patches.drivers/bpf-devmap-fix-use-after-free-Read-in-__dev_map_entr.patch120
-rw-r--r--patches.drivers/bpf-lpm_trie-check-left-child-of-last-leftmost-node-.patch124
-rw-r--r--patches.drivers/bpf-sockmap-fix-msg-sg.size-account-on-ingress-skb.patch32
-rw-r--r--patches.drivers/bpf-sockmap-fix-use-after-free-from-sleep-in-psock-b.patch84
-rw-r--r--patches.drivers/bpf-sockmap-remove-duplicate-queue-free.patch35
-rw-r--r--patches.drivers/bpf-tcp-correctly-handle-DONT_WAIT-flags-and-timeo-0.patch38
-rw-r--r--patches.drivers/can-flexcan-fix-timeout-when-set-small-bitrate.patch59
-rw-r--r--patches.drivers/ceph-osd_client-add-support-for-CEPH_OSD_OP_GETXATTR.patch62
-rw-r--r--patches.drivers/clk-rockchip-Turn-on-aclk_dmac1-for-suspend-on-rk328.patch91
-rw-r--r--patches.drivers/clk-tegra-Fix-PLLM-programming-on-Tegra124-when-PMC-.patch43
-rw-r--r--patches.drivers/dmaengine-imx-sdma-remove-BD_INTR-for-channel0.patch58
-rw-r--r--patches.drivers/documentation-dma-api-fix-a-function-name-of-max_mapping_size31
-rw-r--r--patches.drivers/drivers-base-devres-introduce-devm_release_action.patch104
-rw-r--r--patches.drivers/failover-allow-name-change-on-IFF_UP-slave-interface.patch143
-rw-r--r--patches.drivers/genwqe-Prevent-an-integer-overflow-in-the-ioctl.patch64
-rw-r--r--patches.drivers/gpio-omap-fix-lack-of-irqstatus_raw0-for-OMAP4.patch45
-rw-r--r--patches.drivers/hwmon-k10temp-add-support-for-amd-family-17h-model-30h-cpus.patch17
-rw-r--r--patches.drivers/i2c-mlxcpld-Add-support-for-extended-transaction-len.patch85
-rw-r--r--patches.drivers/i2c-mlxcpld-Add-support-for-smbus-block-read-transac.patch107
-rw-r--r--patches.drivers/i2c-mlxcpld-Allow-configurable-adapter-id-for-mlxcpl.patch29
-rw-r--r--patches.drivers/i2c-mlxcpld-Fix-adapter-functionality-support-callba.patch36
-rw-r--r--patches.drivers/i2c-mlxcpld-Fix-wrong-initialization-order-in-probe.patch41
-rw-r--r--patches.drivers/i2c-mux-mlxcpld-simplify-code-to-reach-the-adapter.patch30
-rw-r--r--patches.drivers/ibmvnic-Do-not-close-unopened-driver-during-reset.patch3
-rw-r--r--patches.drivers/ibmvnic-Fix-unchecked-return-codes-of-memory-allocat.patch3
-rw-r--r--patches.drivers/ibmvnic-Refresh-device-multicast-list-after-reset.patch3
-rw-r--r--patches.drivers/iommu-amd-make-iommu_disable-safer33
-rw-r--r--patches.drivers/iommu-arm-smmu-avoid-constant-zero-in-tlbi-writes74
-rw-r--r--patches.drivers/iommu-fix-a-leak-in-iommu_insert_resv_region55
-rw-r--r--patches.drivers/iommu-use-right-function-to-get-group-for-device35
-rw-r--r--patches.drivers/iommu-vt-d-duplicate-iommu_resv_region-objects-per-device-list128
-rw-r--r--patches.drivers/iommu-vt-d-handle-pci-bridge-rmrr-device-scopes-in-intel_iommu_get_resv_regions33
-rw-r--r--patches.drivers/iommu-vt-d-handle-rmrr-with-pci-bridge-device-scopes36
-rw-r--r--patches.drivers/iommu-vt-d-introduce-is_downstream_to_pci_bridge-helper79
-rw-r--r--patches.drivers/iommu-vt-d-remove-unnecessary-rcu_read_locks47
-rw-r--r--patches.drivers/ixgbe-Avoid-NULL-pointer-dereference-with-VF-on-non-.patch87
-rw-r--r--patches.drivers/libata-Extend-quirks-for-the-ST1000LM024-drives-with.patch46
-rw-r--r--patches.drivers/libceph-add-scatterlist-messenger-data-type.patch55
-rw-r--r--patches.drivers/libceph-add-support-for-CMPEXT-compare-extent-reques.patch36
-rw-r--r--patches.drivers/libceph-add-support-for-write-same-requests.patch48
-rw-r--r--patches.drivers/mISDN-make-sure-device-name-is-NUL-terminated.patch58
-rw-r--r--patches.drivers/media-v4l2-ioctl-clear-fields-in-s_parm.patch55
-rw-r--r--patches.drivers/mfd-hi655x-Fix-regmap-area-declared-size-for-hi655x.patch69
-rw-r--r--patches.drivers/mlxsw-core-Add-API-for-QSFP-module-temperature-thres.patch170
-rw-r--r--patches.drivers/mlxsw-core-Do-not-use-WQ_MEM_RECLAIM-for-EMAD-workqu.patch34
-rw-r--r--patches.drivers/mlxsw-core-Move-ethtool-module-callbacks-to-a-common.patch321
-rw-r--r--patches.drivers/mlxsw-core-Prevent-reading-unsupported-slave-address.patch77
-rw-r--r--patches.drivers/mlxsw-core-mlxsw-core-avoid-Wint-in-bool-context-war.patch46
-rw-r--r--patches.drivers/mlxsw-pci-Reincrease-PCI-reset-timeout.patch39
-rw-r--r--patches.drivers/mlxsw-reg-Add-Management-Temperature-Bulk-Register.patch110
-rw-r--r--patches.drivers/mlxsw-spectrum-Move-QSFP-EEPROM-definitions-to-commo.patch180
-rw-r--r--patches.drivers/mlxsw-spectrum-Put-MC-TCs-into-DWRR-mode.patch42
-rw-r--r--patches.drivers/mlxsw-spectrum_flower-Fix-TOS-matching.patch30
-rw-r--r--patches.drivers/mm-devm_memremap_pages-introduce-devm_memunmap_pages.patch67
-rw-r--r--patches.drivers/mmc-core-Prevent-processing-SDIO-IRQs-when-the-card-.patch79
-rw-r--r--patches.drivers/mmc-core-complete-HS400-before-checking-status.patch48
-rw-r--r--patches.drivers/net-Fix-missing-meta-data-in-skb-with-vlan-packet.patch47
-rw-r--r--patches.drivers/net-core-support-XDP-generic-on-stacked-devices.patch116
-rw-r--r--patches.drivers/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch78
-rw-r--r--patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch39
-rw-r--r--patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch366
-rw-r--r--patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch103
-rw-r--r--patches.drivers/net-ena-add-good-checksum-counter.patch69
-rw-r--r--patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch223
-rw-r--r--patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch92
-rw-r--r--patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch54
-rw-r--r--patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch102
-rw-r--r--patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch320
-rw-r--r--patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch50
-rw-r--r--patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch269
-rw-r--r--patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch393
-rw-r--r--patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch31
-rw-r--r--patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch28
-rw-r--r--patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch33
-rw-r--r--patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch91
-rw-r--r--patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch32
-rw-r--r--patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch42
-rw-r--r--patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch41
-rw-r--r--patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch51
-rw-r--r--patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch47
-rw-r--r--patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch241
-rw-r--r--patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch194
-rw-r--r--patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch30
-rw-r--r--patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch35
-rw-r--r--patches.drivers/net-ethernet-ti-cpsw_ethtool-fix-ethtool-ring-param-.patch31
-rw-r--r--patches.drivers/net-mlx5-Avoid-reloading-already-removed-devices.patch61
-rw-r--r--patches.drivers/net-mlx5-FPGA-tls-hold-rcu-read-lock-a-bit-longer.patch52
-rw-r--r--patches.drivers/net-mlx5-FPGA-tls-idr-remove-on-flow-delete.patch137
-rw-r--r--patches.drivers/net-mlx5-Set-completion-EQs-as-shared-resources.patch44
-rw-r--r--patches.drivers/net-mlx5-Update-pci-error-handler-entries-and-comman.patch46
-rw-r--r--patches.drivers/net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG_MLX5.patch57
-rw-r--r--patches.drivers/net-mlx5e-Fix-the-max-MTU-check-in-case-of-XDP.patch88
-rw-r--r--patches.drivers/net-mlx5e-Fix-use-after-free-after-xdp_return_frame.patch44
-rw-r--r--patches.drivers/net-mlx5e-Rx-Check-ip-headers-sanity.patch43
-rw-r--r--patches.drivers/net-mlx5e-Rx-Fixup-skb-checksum-for-packets-with-tai.patch181
-rw-r--r--patches.drivers/net-mlx5e-XDP-Fix-shifted-flag-index-in-RQ-bitmap.patch33
-rw-r--r--patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch32
-rw-r--r--patches.drivers/net-mvpp2-prs-Fix-parser-range-for-VID-filtering.patch75
-rw-r--r--patches.drivers/net-mvpp2-prs-Use-the-correct-helpers-when-removing-.patch38
-rw-r--r--patches.drivers/net-phy-marvell10g-report-if-the-PHY-fails-to-boot-f.patch50
-rw-r--r--patches.drivers/net-sched-cbs-Fix-error-path-of-cbs_module_init.patch41
-rw-r--r--patches.drivers/net-sched-cbs-fix-port_rate-miscalculation.patch220
-rw-r--r--patches.drivers/net-tls-avoid-NULL-pointer-deref-on-nskb-sk-in-fallb.patch37
-rw-r--r--patches.drivers/net-tls-avoid-potential-deadlock-in-tls_set_device_o.patch34
-rw-r--r--patches.drivers/net-tls-correctly-account-for-copied-bytes-with-mult.patch49
-rw-r--r--patches.drivers/net-tls-don-t-copy-negative-amounts-of-data-in-reenc.patch46
-rw-r--r--patches.drivers/net-tls-don-t-ignore-netdev-notifications-if-no-TLS-.patch35
-rw-r--r--patches.drivers/net-tls-don-t-leak-IV-and-record-seq-when-offload-fa.patch69
-rw-r--r--patches.drivers/net-tls-don-t-leak-partially-sent-record-in-device-m.patch130
-rw-r--r--patches.drivers/net-tls-fix-build-without-CONFIG_TLS_DEVICE.patch32
-rw-r--r--patches.drivers/net-tls-fix-copy-to-fragments-in-reencrypt.patch83
-rw-r--r--patches.drivers/net-tls-fix-page-double-free-on-TX-cleanup.patch98
-rw-r--r--patches.drivers/net-tls-fix-refcount-adjustment-in-fallback.patch66
-rw-r--r--patches.drivers/net-tls-fix-state-removal-with-feature-flags-off.patch58
-rw-r--r--patches.drivers/net-tls-fix-the-IV-leaks.patch38
-rw-r--r--patches.drivers/net-tls-prevent-bad-memory-access-in-tls_is_sk_tx_de.patch34
-rw-r--r--patches.drivers/net-tls-replace-the-sleeping-lock-around-RX-resync-w.patch94
-rw-r--r--patches.drivers/net-udp_gso-Allow-TX-timestamp-with-UDP-GSO.patch73
-rw-r--r--patches.drivers/new-primitive-vmemdup_user78
-rw-r--r--patches.drivers/nfit-ars-avoid-stale-ars-results.patch73
-rw-r--r--patches.drivers/nfit-ars-introduce-scrub_flags.patch123
-rw-r--r--patches.drivers/nfp-bpf-fix-static-check-error-through-tightening-sh.patch59
-rw-r--r--patches.drivers/nfp-flower-add-rcu-locks-when-accessing-netdev-for-t.patch80
-rw-r--r--patches.drivers/nvme-rdma-move-nvme_rdma_configure_admin_queue-code-.patch2
-rw-r--r--patches.drivers/nvme-rdma-stop-admin-queue-before-freeing-it.patch13
-rw-r--r--patches.drivers/pinctrl-amd-add-get_direction-handler.patch63
-rw-r--r--patches.drivers/pinctrl-amd-fix-gpio-irq-level-in-debugfs.patch75
-rw-r--r--patches.drivers/pinctrl-amd-fix-masking-of-GPIO-interrupts.patch71
-rw-r--r--patches.drivers/pinctrl-amd-make-functions-amd_gpio_suspend-and-amd_.patch49
-rw-r--r--patches.drivers/pinctrl-amd-poll-InterruptEnable-bits-in-amd_gpio_ir.patch102
-rw-r--r--patches.drivers/pinctrl-amd-poll-InterruptEnable-bits-in-enable_irq.patch57
-rw-r--r--patches.drivers/ppp-mppe-Add-softdep-to-arc4.patch35
-rw-r--r--patches.drivers/pwm-stm32-Use-3-cells-of_xlate.patch37
-rw-r--r--patches.drivers/qedi-use-hwfns-and-affin_hwfn_idx-to-get-msi-x-vector-index92
-rw-r--r--patches.drivers/qmi_wwan-Fix-out-of-bounds-read.patch58
-rw-r--r--patches.drivers/rbd-add-support-for-COMPARE_AND_WRITE-CMPEXT.patch37
-rw-r--r--patches.drivers/regulator-s2mps11-Fix-buck7-and-buck8-wrong-voltages.patch46
-rw-r--r--patches.drivers/scsi-aacraid-change-event_wait-to-a-completion233
-rw-r--r--patches.drivers/scsi-aacraid-change-wait_sem-to-a-completion79
-rw-r--r--patches.drivers/scsi-aacraid-clean-up-some-indentation-and-formatting-issues84
-rw-r--r--patches.drivers/scsi-aacraid-mark-expected-switch-fall-through31
-rw-r--r--patches.drivers/scsi-aacraid-mark-expected-switch-fall-throughs52
-rw-r--r--patches.drivers/scsi-be2iscsi-be_iscsi-mark-expected-switch-fall-through30
-rw-r--r--patches.drivers/scsi-be2iscsi-be_main-mark-expected-switch-fall-through31
-rw-r--r--patches.drivers/scsi-be2iscsi-fix-spelling-mistake-retreiving-retrieving30
-rw-r--r--patches.drivers/scsi-be2iscsi-lpfc-fix-typo53
-rw-r--r--patches.drivers/scsi-be2iscsi-remove-unused-variable-dmsg41
-rw-r--r--patches.drivers/scsi-be2iscsi-switch-to-generic-dma-api432
-rw-r--r--patches.drivers/scsi-core-add-new-RDAC-LENOVO-DE_Series-device.patch53
-rw-r--r--patches.drivers/scsi-csiostor-csio_wr-mark-expected-switch-fall-through31
-rw-r--r--patches.drivers/scsi-csiostor-drop-serial_number-usage43
-rw-r--r--patches.drivers/scsi-csiostor-fix-incorrect-dma-device-in-case-of-vport31
-rw-r--r--patches.drivers/scsi-csiostor-fix-missing-data-copy-in-csio_scsi_err_handler36
-rw-r--r--patches.drivers/scsi-csiostor-fix-null-pointer-dereference-in-csio_vport_set_state38
-rw-r--r--patches.drivers/scsi-csiostor-no-need-to-check-return-value-of-debugfs_create-functions48
-rw-r--r--patches.drivers/scsi-csiostor-remove-set-but-not-used-variable-pln43
-rw-r--r--patches.drivers/scsi-hpsa-bump-driver-version30
-rw-r--r--patches.drivers/scsi-hpsa-check-for-lv-removal49
-rw-r--r--patches.drivers/scsi-hpsa-clean-up-two-indentation-issues40
-rw-r--r--patches.drivers/scsi-hpsa-correct-device-id-issues46
-rw-r--r--patches.drivers/scsi-hpsa-correct-device-resets496
-rw-r--r--patches.drivers/scsi-hpsa-correct-ioaccel2-chaining62
-rw-r--r--patches.drivers/scsi-hpsa-correct-simple-mode90
-rw-r--r--patches.drivers/scsi-hpsa-mark-expected-switch-fall-throughs68
-rw-r--r--patches.drivers/scsi-hpsa-remove-timeout-from-turs36
-rw-r--r--patches.drivers/scsi-hpsa-switch-to-generic-dma-api439
-rw-r--r--patches.drivers/scsi-hpsa-use-vmemdup_user-to-replace-the-open-code52
-rw-r--r--patches.drivers/scsi-megaraid_sas-Add-support-for-DEVICE_LIST-DCMD-i.patch464
-rw-r--r--patches.drivers/scsi-megaraid_sas-Retry-reads-of-outbound_intr_statu.patch37
-rw-r--r--patches.drivers/scsi-megaraid_sas-Rework-code-to-get-PD-and-LD-list.patch93
-rw-r--r--patches.drivers/scsi-megaraid_sas-Rework-device-add-code-in-AEN-path.patch254
-rw-r--r--patches.drivers/scsi-megaraid_sas-Update-structures-for-HOST_DEVICE_.patch42
-rw-r--r--patches.drivers/scsi-megaraid_sas-correct-an-info-message.patch33
-rw-r--r--patches.drivers/scsi-megaraid_sas-driver-version-update-to-07.707.51.00.patch32
-rw-r--r--patches.drivers/scsi-mpt3sas-Add-Atomic-RequestDescriptor-support-on.patch193
-rw-r--r--patches.drivers/scsi-mpt3sas-Add-flag-high_iops_queues.patch137
-rw-r--r--patches.drivers/scsi-mpt3sas-Add-missing-breaks-in-switch-statements.patch86
-rw-r--r--patches.drivers/scsi-mpt3sas-Add-support-for-ATLAS-PCIe-switch.patch70
-rw-r--r--patches.drivers/scsi-mpt3sas-Add-support-for-NVMe-Switch-Adapter.patch63
-rw-r--r--patches.drivers/scsi-mpt3sas-Affinity-high-iops-queues-IRQs-to-local.patch171
-rw-r--r--patches.drivers/scsi-mpt3sas-Enable-interrupt-coalescing-on-high-iop.patch241
-rw-r--r--patches.drivers/scsi-mpt3sas-Fix-kernel-panic-during-expander-reset.patch102
-rw-r--r--patches.drivers/scsi-mpt3sas-Fix-typo-in-request_desript_type.patch87
-rw-r--r--patches.drivers/scsi-mpt3sas-Improve-the-threshold-value-and-introdu.patch95
-rw-r--r--patches.drivers/scsi-mpt3sas-Introduce-perf_mode-module-parameter.patch271
-rw-r--r--patches.drivers/scsi-mpt3sas-Irq-poll-to-avoid-CPU-hard-lockups.patch287
-rw-r--r--patches.drivers/scsi-mpt3sas-Load-balance-to-improve-performance-and.patch95
-rw-r--r--patches.drivers/scsi-mpt3sas-Rename-mpi-endpoint-device-ID-macro.patch67
-rw-r--r--patches.drivers/scsi-mpt3sas-Update-driver-version-to-27.102.00.00.patch35
-rw-r--r--patches.drivers/scsi-mpt3sas-Update-driver-version-to-29.100.00.00.patch36
-rw-r--r--patches.drivers/scsi-mpt3sas-Update-mpt3sas-driver-version-to-28.100.patch36
-rw-r--r--patches.drivers/scsi-mpt3sas-Use-high-iops-queues-under-some-circums.patch145
-rw-r--r--patches.drivers/scsi-mpt3sas-change-_base_get_msix_index-prototype.patch129
-rw-r--r--patches.drivers/scsi-mpt3sas-fix-indentation-issue.patch34
-rw-r--r--patches.drivers/scsi-mpt3sas-function-pointers-of-request-descriptor.patch419
-rw-r--r--patches.drivers/scsi-mpt3sas-save-and-use-MSI-X-index-for-posting-RD.patch175
-rw-r--r--patches.drivers/scsi-mpt3sas-simplify-interrupt-handler.patch119
-rw-r--r--patches.drivers/scsi-qedi-add-module-param-to-set-ping-packet-size76
-rw-r--r--patches.drivers/scsi-qedi-add-packet-filter-in-light-l2-rx-path60
-rw-r--r--patches.drivers/scsi-qedi-check-for-session-online-before-getting-iscsi-tlv-data64
-rw-r--r--patches.drivers/scsi-qedi-cleanup-redundant-qedi_page_size-macro-definition34
-rw-r--r--patches.drivers/scsi-qedi-fix-spelling-mistake-oustanding-outstanding54
-rw-r--r--patches.drivers/scsi-qedi-move-ll2-producer-index-processing-in-bh96
-rw-r--r--patches.drivers/scsi-qedi-remove-set-but-not-used-variables-cdev-and-udev46
-rw-r--r--patches.drivers/scsi-qedi-replace-page_size-with-qedi_page_size85
-rw-r--r--patches.drivers/scsi-qedi-update-driver-version-to-8-33-0-2130
-rw-r--r--patches.drivers/staging-comedi-ni_mio_common-Fix-divide-by-zero-for-.patch153
-rw-r--r--patches.drivers/staging-iio-ad7150-fix-threshold-mode-config-bit.patch75
-rw-r--r--patches.drivers/tools-bpftool-fix-infinite-loop-in-map-create.patch43
-rw-r--r--patches.drivers/typec-tcpm-fix-compiler-warning-about-stupid-things.patch40
-rw-r--r--patches.drivers/usbnet-ipheth-fix-racing-condition.patch64
-rw-r--r--patches.drivers/xdp-check-device-pointer-before-clearing.patch45
-rw-r--r--patches.drm/drm-Fix-drm_release-and-device-unplug.patch70
-rw-r--r--patches.drm/drm-amd-powerplay-use-hardware-fan-control-if-no-pow.patch71
-rw-r--r--patches.drm/drm-amdgpu-gfx9-use-reset-default-for-PA_SC_FIFO_SIZ.patch52
-rw-r--r--patches.drm/drm-arm-hdlcd-Actually-validate-CRTC-modes.patch60
-rw-r--r--patches.drm/drm-arm-hdlcd-Allow-a-bit-of-clock-tolerance.patch36
-rw-r--r--patches.drm/drm-arm-mali-dp-Add-a-loop-around-the-second-set-CVA.patch55
-rw-r--r--patches.drm/drm-etnaviv-add-missing-failure-path-to-destroy-suba.patch56
-rw-r--r--patches.drm/drm-fb-helper-generic-Don-t-take-module-ref-for-fbco.patch51
-rw-r--r--patches.drm/drm-i915-dmc-protect-against-reading-random-memory.patch97
-rw-r--r--patches.drm/drm-i915-gvt-ignore-unexpected-pvinfo-write.patch74
-rw-r--r--patches.drm/drm-imx-notify-drm-core-before-sending-event-during-.patch60
-rw-r--r--patches.drm/drm-imx-only-send-event-on-crtc-disable-if-kept-disa.patch38
-rw-r--r--patches.drm/drm-panel-orientation-quirks-Add-quirk-for-GPD-Micro.patch64
-rw-r--r--patches.drm/drm-panel-orientation-quirks-Add-quirk-for-GPD-pocke.patch69
-rw-r--r--patches.drm/drm-vmwgfx-Use-the-backdoor-port-if-the-HB-port-is-n.patch225
-rw-r--r--patches.drm/drm-vmwgfx-fix-a-warning-due-to-missing-dma_parms.patch76
-rw-r--r--patches.fixes/0001-USB-serial-fix-initial-termios-handling.patch71
-rw-r--r--patches.fixes/0001-coredump-fix-race-condition-between-collapse_huge_pa.patch103
-rw-r--r--patches.fixes/0001-coredump-fix-race-condition-between-mmget_not_zero-g.patch245
-rw-r--r--patches.fixes/0001-i2c-acorn-fix-i2c-warning.patch36
-rw-r--r--patches.fixes/0001-mm-hwpoison-fix-thp-split-handing-in-soft_offline_in.patch4
-rw-r--r--patches.fixes/0001-mwifiex-Fix-heap-overflow-in-mwifiex_uap_parse_tail_.patch2
-rw-r--r--patches.fixes/0001-ntp-Allow-TAI-UTC-offset-to-be-set-to-zero.patch47
-rw-r--r--patches.fixes/0001-rbd-drop-extra-rbd_img_request_get.patch6
-rw-r--r--patches.fixes/0001-usb-chipidea-udc-workaround-for-endpoint-conflict-is.patch80
-rw-r--r--patches.fixes/0001-usb-dwc2-host-Fix-wMaxPacketSize-handling-fix-webcam.patch250
-rw-r--r--patches.fixes/0002-rbd-make-sure-pages-are-freed-by-libceph.patch6
-rw-r--r--patches.fixes/0006-irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch80
-rw-r--r--patches.fixes/Abort-file_remove_privs-for-non-reg.-files.patch54
-rw-r--r--patches.fixes/Bluetooth-Fix-faulty-expression-for-minimum-encrypti.patch37
-rw-r--r--patches.fixes/PCI-Do-not-poll-for-PME-if-the-device-is-in-D3cold.patch60
-rw-r--r--patches.fixes/PM-ACPI-PCI-Resume-all-devices-during-hibernation.patch89
-rw-r--r--patches.fixes/apparmor-enforce-nullbyte-at-end-of-tag-string.patch42
-rw-r--r--patches.fixes/ax25-fix-inconsistent-lock-state-in-ax25_destroy_tim.patch122
-rw-r--r--patches.fixes/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch127
-rw-r--r--patches.fixes/can-af_can-Fix-error-path-of-can_init.patch72
-rw-r--r--patches.fixes/can-purge-socket-error-queue-on-sock-destruct.patch37
-rw-r--r--patches.fixes/ceph-flush-dirty-inodes-before-proceeding-with-remount.patch2
-rw-r--r--patches.fixes/coresight-etb10-Fix-handling-of-perf-mode.patch40
-rw-r--r--patches.fixes/coresight-etm4x-Add-support-to-enable-ETMv4.2.patch66
-rw-r--r--patches.fixes/crypto-cryptd-Fix-skcipher-instance-memory-leak.patch46
-rw-r--r--patches.fixes/crypto-user-prevent-operating-on-larval-algorithms.patch59
-rw-r--r--patches.fixes/dax-Fix-xarray-entry-association-for-mixed-mappings.patch61
-rw-r--r--patches.fixes/device-core-Consolidate-locking-and-unlocking-of-par.patch237
-rw-r--r--patches.fixes/doc-Cope-with-the-deprecation-of-AutoReporter.patch82
-rw-r--r--patches.fixes/driver-core-Establish-order-of-operations-for-device.patch138
-rw-r--r--patches.fixes/driver-core-Probe-devices-asynchronously-instead-of-.patch164
-rw-r--r--patches.fixes/drivers-base-introduce-kill_device.patch94
-rw-r--r--patches.fixes/ext4-do-not-delete-unlinked-inode-from-orphan-list-o.patch42
-rw-r--r--patches.fixes/fs-hugetlbfs-inode.c-fix-hwpoison-reserve-accounting.patch64
-rw-r--r--patches.fixes/fs-ocfs2-fix-race-in-ocfs2_dentry_attach_lock.patch101
-rw-r--r--patches.fixes/fs-proc-proc_sysctl.c-Fix-a-NULL-pointer-dereference.patch101
-rw-r--r--patches.fixes/fs-proc-proc_sysctl.c-fix-NULL-pointer-dereference-i.patch105
-rw-r--r--patches.fixes/genirq-Prevent-use-after-free-and-work-list-corrupti.patch45
-rw-r--r--patches.fixes/genirq-Respect-IRQCHIP_SKIP_SET_WAKE-in-irq_chip_set.patch73
-rw-r--r--patches.fixes/inet-switch-IP-ID-generator-to-siphash.patch151
-rw-r--r--patches.fixes/iommu-arm-smmu-Add-support-for-qcom-smmu-v2-variant.patch52
-rw-r--r--patches.fixes/iommu-arm-smmu-v3-Fix-big-endian-CMD_SYNC-writes.patch52
-rw-r--r--patches.fixes/iommu-arm-smmu-v3-Use-explicit-mb-when-moving-cons-p.patch50
-rw-r--r--patches.fixes/iommu-arm-smmu-v3-sync-the-OVACKFLG-to-PRIQ-consumer.patch37
-rw-r--r--patches.fixes/iov_iter-Fix-build-error-without-CONFIG_CRYPTO.patch51
-rw-r--r--patches.fixes/irqchip-mbigen-Don-t-clear-eventid-when-freeing-an-M.patch50
-rw-r--r--patches.fixes/libceph-assign-cookies-in-linger_submit.patch104
-rw-r--r--patches.fixes/libceph-check-reply-num_data_items-in-setup_request_data.patch133
-rw-r--r--patches.fixes/libceph-don-t-consume-a-ref-on-pagelist-in-ceph_msg_data_add_pagelist.patch87
-rw-r--r--patches.fixes/libceph-enable-fallback-to-ceph_msg_new-in-ceph_msgpool_get.patch54
-rw-r--r--patches.fixes/libceph-introduce-alloc_watch_request.patch72
-rw-r--r--patches.fixes/libceph-introduce-ceph_pagelist_alloc.patch169
-rw-r--r--patches.fixes/libceph-preallocate-message-data-items.patch662
-rw-r--r--patches.fixes/libceph-rbd-ceph-move-ceph_osdc_alloc_messages-calls.patch210
-rw-r--r--patches.fixes/libnvdimm-bus-prevent-duplicate-device_unregister-calls.patch95
-rw-r--r--patches.fixes/libnvdimm-pfn-fix-over-trim-in-trim_pfn_device.patch39
-rw-r--r--patches.fixes/mac80211-Do-not-use-stack-memory-with-scatterlist-fo.patch64
-rw-r--r--patches.fixes/mac80211-drop-robust-management-frames-from-unknown-.patch36
-rw-r--r--patches.fixes/mac80211-handle-deauthentication-disassociation-from.patch125
-rw-r--r--patches.fixes/mm-fix-race-on-soft-offlining-free-huge-pages.patch194
-rw-r--r--patches.fixes/mm-hugetlb-delete-dequeue_hwpoisoned_huge_page.patch115
-rw-r--r--patches.fixes/mm-hugetlb-prevent-reuse-of-hwpoisoned-free-hugepage.patch79
-rw-r--r--patches.fixes/mm-hugetlb-soft-offline-dissolve-source-hugepage-aft.patch149
-rw-r--r--patches.fixes/mm-hugetlb-soft-offline-dissolve_free_huge_page-retu.patch139
-rw-r--r--patches.fixes/mm-hugetlb-soft_offline-save-compound-page-order-bef.patch77
-rw-r--r--patches.fixes/mm-hwpoison-change-PageHWPoison-behavior-on-hugetlb-.patch248
-rw-r--r--patches.fixes/mm-hwpoison-dissolve-in-use-hugepage-in-unrecoverabl.patch212
-rw-r--r--patches.fixes/mm-hwpoison-introduce-idenfity_page_state.patch113
-rw-r--r--patches.fixes/mm-hwpoison-introduce-memory_failure_hugetlb.patch234
-rw-r--r--patches.fixes/mm-madvise_inject_error-Let-memory_failure-optionall.patch19
-rw-r--r--patches.fixes/mm-memory_failure-Teach-memory_failure-about-dev_pag.patch20
-rw-r--r--patches.fixes/mm-soft-offline-close-the-race-against-page-allocati.patch203
-rw-r--r--patches.fixes/mm-soft-offline-dissolve-free-hugepage-if-soft-offli.patch36
-rw-r--r--patches.fixes/mm-soft-offline-return-EBUSY-if-set_hwpoison_free_bu.patch51
-rw-r--r--patches.fixes/netns-get-more-entropy-from-net_hash_mix.patch46
-rw-r--r--patches.fixes/netns-provide-pure-entropy-for-net_hash_mix.patch73
-rw-r--r--patches.fixes/nfit-ars-allow-root-to-busy-poll-the-ars-state-machine.patch66
-rw-r--r--patches.fixes/nvme-copy-mtfa-field-from-identify-controller.patch39
-rw-r--r--patches.fixes/ocfs2-try-to-reuse-extent-block-in-dealloc-without-m.patch369
-rw-r--r--patches.fixes/rbd-copy-compare-and-write-osd-requests-before-resub.patch32
-rw-r--r--patches.fixes/rbd-truncate-objects-on-cmpext-short-reads.patch22
-rw-r--r--patches.fixes/s390-dasd-fix-using-offset-into-zero-size-array-error91
-rw-r--r--patches.fixes/s390-qeth-fix-race-when-initializing-the-ip-address-table37
-rw-r--r--patches.fixes/s390-qeth-fix-vlan-attribute-in-bridge_hostnotify-udev-event46
-rw-r--r--patches.fixes/s390-virtio-handle-find-on-invalid-queue-gracefully41
-rw-r--r--patches.fixes/sbitmap-fix-improper-use-of-smp_mb__before_atomic.patch42
-rw-r--r--patches.fixes/scsi-Introduce-scsi_start_queue.patch2
-rw-r--r--patches.fixes/scsi-Split-scsi_internal_device_block.patch2
-rw-r--r--patches.fixes/scsi-csiostor-fix-calls-to-dma_set_mask_and_coherent41
-rw-r--r--patches.fixes/scsi-hpsa-fix-an-uninitialized-read-and-dereference-of-pointer-dev34
-rw-r--r--patches.fixes/scsi-qla2xxx-fix-abort-handling-in-tcm_qla2xxx_write_pending.patch42
-rw-r--r--patches.fixes/scsi-qla2xxx-fix-incorrect-region-size-setting-in-optrom-sysfs.patch48
-rw-r--r--patches.fixes/scsi-target-iblock-fix-overrun-in-write-same-emulation41
-rw-r--r--patches.fixes/scsi-vmw_pscsi-Fix-use-after-free-in-pvscsi_queue_lc.patch3
-rw-r--r--patches.fixes/scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove33
-rw-r--r--patches.fixes/scsi-zfcp-fix-rport-unblock-if-deleted-scsi-devices-on-scsi_host80
-rw-r--r--patches.fixes/scsi-zfcp-fix-scsi_eh-host-reset-with-port_forced-erp-for-non-npiv-fcp-devices92
-rw-r--r--patches.fixes/scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs184
-rw-r--r--patches.fixes/sysctl-handle-overflow-in-proc_get_long.patch123
-rw-r--r--patches.fixes/tcp-refine-memory-limit-test-in-tcp_fragment.patch39
-rw-r--r--patches.fixes/vfio-ccw-only-free-cp-on-final-interrupt56
-rw-r--r--patches.fixes/x86-mm-mm-hwpoison-clear-present-bit-for-kernel-1-1-mappings-of-poison-pages.patch6
-rw-r--r--patches.fixes/x86-mm-mm-hwpoison-don-t-unconditionally-unmap-kernel-1-1-pages.patch62
-rw-r--r--patches.kabi/drivers-base-kABI-fixes-for-struct-device_private.patch34
-rw-r--r--patches.kabi/kabi-drop-LINUX_MIB_TCPWQUEUETOOBIG-snmp-counter.patch4
-rw-r--r--patches.kabi/kabi-fixup-blk_mq_register_dev.patch41
-rw-r--r--patches.kabi/kabi-handle-addition-of-net-hash_mix.patch34
-rw-r--r--patches.kabi/kabi-handle-addition-of-netns_ipv4-ip_id_key.patch77
-rw-r--r--patches.kabi/kabi-protect-struct-acpi_nfit_desc.patch33
-rw-r--r--patches.suse/0004-libceph-rbd-add-error-handling-for-osd_req_op_cls_init.patch95
-rw-r--r--patches.suse/Documentation-ABI-Document-umwait-control-sysfs-inte.patch60
-rw-r--r--patches.suse/RFC-Bluetooth-Check-key-sizes-only-when-Secure-Simple-Pairing-is-enabled.patch42
-rw-r--r--patches.suse/block-Fix-a-NULL-pointer-dereference-in-generic_make.patch73
-rw-r--r--patches.suse/do-not-default-to-ibrs-on-skl.patch2
-rw-r--r--patches.suse/ftrace-x86-remove-possible-deadlock-between-register_kprobe-and-ftrace_run_update_code.patch182
-rw-r--r--patches.suse/hugetlbfs-dirty-pages-as-they-are-added-to-pagecache.patch74
-rw-r--r--patches.suse/hugetlbfs-fix-kernel-BUG-at-fs-hugetlbfs-inode.c-444.patch134
-rw-r--r--patches.suse/mm-page_alloc.c-avoid-potential-NULL-pointer-dereference.patch40
-rw-r--r--patches.suse/mm-page_alloc.c-fix-never-set-ALLOC_NOFRAGMENT-flag.patch52
-rw-r--r--patches.suse/mm-vmscan.c-prevent-useless-kswapd-loops.patch106
-rw-r--r--patches.suse/ptrace-Fix-ptracer_cred-handling-for-PTRACE_TRACEME.patch54
-rw-r--r--patches.suse/ptrace-restore-smp_rmb-in-__ptrace_may_access.patch60
-rw-r--r--patches.suse/rbd-do-away-with-obj_request-in-cmpsetxattr.patch31
-rw-r--r--patches.suse/rbd-do-away-with-obj_request-in-getxattr.patch38
-rw-r--r--patches.suse/rbd-do-away-with-obj_request-in-setxattr.patch30
-rw-r--r--patches.suse/signal-ptrace-Don-t-leak-unitialized-kernel-memory-w.patch74
-rw-r--r--patches.suse/tracing-snapshot-resize-spare-buffer-if-size-changed.patch105
-rw-r--r--patches.suse/x86-cpufeatures-Enumerate-user-wait-instructions.patch67
-rw-r--r--patches.suse/x86-insn-eval-Fix-use-after-free-access-to-LDT-entry.patch172
-rw-r--r--patches.suse/x86-umwait-Add-sysfs-interface-to-control-umwait-C0..patch205
-rw-r--r--patches.suse/x86-umwait-Add-sysfs-interface-to-control-umwait-max.patch86
-rw-r--r--patches.suse/x86-umwait-Initialize-umwait-control-values.patch149
-rw-r--r--rpm/gitlog-excludes4
-rw-r--r--rpm/kernel-binary.spec.in2
-rw-r--r--rpm/package-descriptions2
-rw-r--r--rpm/post.sh4
-rwxr-xr-xscripts/git_sort/git_sort.py4
-rw-r--r--series.conf406
422 files changed, 34015 insertions, 427 deletions
diff --git a/blacklist.conf b/blacklist.conf
index d71d7d1d0b..a4f95dcf95 100644
--- a/blacklist.conf
+++ b/blacklist.conf
@@ -1168,3 +1168,26 @@ a25d8c327bb41742dbd59f8c545f59f3b9c39983 # md/raid5: reverting the above
9421e45f5ff3d558cf8b75a8cc0824530caf3453 # uio: reverted by the below
3d27c4de8d4fb2d4099ff324671792aa2578c6f9 # uio: reverting the above
9d8d0294e78a164d407133dea05caf4b84247d6a # documentation only
+e9d38b08d7a68ede91280036a6657693387e2bcd # bt: revert in the stable tree, but fixed differently in upstream
+6c5ed91b0ca6480642eed4fd9862e2bb238f35ae # cosmetic buil dix only
+1e029b836108d0b68ba574482604247c97cb4757 # driver is not used
+1a22ec643580626f439c8583edafdcc73798f2fb # would break kABI
+09fe1f8d7e2f461275b1cdd832f2cfa5e9be346d # would break kABI
+c3acd59014148470dc58519870fbc779785b4bf7 # depends on 09fe1f8d7e2f461275b1cdd832f2cfa5e9be346d
+7746a8dfb3f9c91b3a0b63a1d5c2664410e6498d # depends on 09fe1f8d7e2f461275b1cdd832f2cfa5e9be346d
+d5443bbf5fc8f8389cce146b1fc2987cdd229d12 # infrastructure, no bug fix
+064c5d6881e897077639e04973de26440ee205e6 # not needed
+d3669ca9ff33e1dc6414d1e34891d342e4544e71 # not applicable, just changes in comments
+24512228b7a3f412b5a51f189df302616b021c33 # DISCONTIGMEM unsupported
+0c97bf863efce63d6ab7971dad811601e6171d2f # compiler warning, gcc-9
+4a60aa05a0634241ce17f957bf9fb5ac1eed6576 # not needed. We don't build with -ffunction-sections -fdata-sections.
+074376ac0e1d1fcd4fafebca86ee6158e7c20680 # __CHECKER__ only
+fe0640eb30b7da261ae84d252ed9ed3c7e68dfd8 # compiler.h: reverted in below
+c6975e4196549c18c5277a55e30b2d6d1b80abf2 # compiler.h: reverted above in 4.14.x
+149d05f80dc9259ad62f2630935502e4c02b26a7 # nouveau: build fix, not affected
+9ae306d8dbc874de331bb10a4451a5198b660257 # nouveau: build fix, not affected
+6491d698396fd5da4941980a35ca7c162a672016 # nfc: breaks kABI
+65fd4cb65b2dad97feb8330b6690445910b56d6a # Documentation moving only
+9c3e922ba316a5d3d8cbe41e0db97888fca5c359 # too risky because too many dependencies
+8a4db13ccc079b762123d04a7270d6d2cb3398d7 # drm/i915: Already cherry-picked
+600d3712ae122be3ceab0d7ac8246caa3d87dcea # drm/i915: Already cherry-picked
diff --git a/config/ppc64le/default b/config/ppc64le/default
index ccd871bb17..aef2acd50a 100644
--- a/config/ppc64le/default
+++ b/config/ppc64le/default
@@ -458,7 +458,7 @@ CONFIG_KVM_GUEST=y
CONFIG_EPAPR_PARAVIRT=y
CONFIG_PPC_NATIVE=y
CONFIG_PPC_OF_BOOT_TRAMPOLINE=y
-# CONFIG_PPC_DT_CPU_FTRS is not set
+CONFIG_PPC_DT_CPU_FTRS=y
CONFIG_UDBG_RTAS_CONSOLE=y
CONFIG_PPC_SMP_MUXED_IPI=y
# CONFIG_IPIC is not set
diff --git a/patches.arch/kvm-svm-avic-fix-off-by-one-in-checking-host-apic-id b/patches.arch/kvm-svm-avic-fix-off-by-one-in-checking-host-apic-id
new file mode 100644
index 0000000000..e147510107
--- /dev/null
+++ b/patches.arch/kvm-svm-avic-fix-off-by-one-in-checking-host-apic-id
@@ -0,0 +1,43 @@
+From: "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@amd.com>
+Date: Tue, 14 May 2019 15:49:52 +0000
+Subject: kvm: svm/avic: fix off-by-one in checking host APIC ID
+Git-commit: c9bcd3e3335d0a29d89fabd2c385e1b989e6f1b0
+Patch-mainline: v5.2-rc2
+References: bsc#1140971
+
+Current logic does not allow VCPU to be loaded onto CPU with
+APIC ID 255. This should be allowed since the host physical APIC ID
+field in the AVIC Physical APIC table entry is an 8-bit value,
+and APIC ID 255 is valid in system with x2APIC enabled.
+Instead, do not allow VCPU load if the host APIC ID cannot be
+represented by an 8-bit value.
+
+Also, use the more appropriate AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK
+instead of AVIC_MAX_PHYSICAL_ID_COUNT.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index a849dcb7fbc5..a9e553a1317f 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -2024,7 +2024,11 @@ static void avic_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ if (!kvm_vcpu_apicv_active(vcpu))
+ return;
+
+- if (WARN_ON(h_physical_id >= AVIC_MAX_PHYSICAL_ID_COUNT))
++ /*
++ * Since the host physical APIC id is 8 bits,
++ * we can support host APIC ID upto 255.
++ */
++ if (WARN_ON(h_physical_id > AVIC_PHYSICAL_ID_ENTRY_HOST_PHYSICAL_ID_MASK))
+ return;
+
+ entry = READ_ONCE(*(svm->avic_physical_id_cache));
+
diff --git a/patches.arch/kvm-x86-fix-return-value-for-reserved-efer b/patches.arch/kvm-x86-fix-return-value-for-reserved-efer
new file mode 100644
index 0000000000..5f8ffae10c
--- /dev/null
+++ b/patches.arch/kvm-x86-fix-return-value-for-reserved-efer
@@ -0,0 +1,36 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Fri, 24 May 2019 21:52:46 +0200
+Subject: KVM: x86: fix return value for reserved EFER
+Git-commit: 66f61c92889ff3ca365161fb29dd36d6354682ba
+Patch-mainline: v5.2-rc2
+References: bsc#1140992
+
+Commit 11988499e62b ("KVM: x86: Skip EFER vs. guest CPUID checks for
+host-initiated writes", 2019-04-02) introduced a "return false" in a
+function returning int, and anyway set_efer has a "nonzero on error"
+conventon so it should be returning 1.
+
+Reported-by: Pavel Machek <pavel@denx.de>
+Fixes: 11988499e62b ("KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes")
+Cc: Sean Christopherson <sean.j.christopherson@intel.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index e7e57de50a3c..acb179f78fdc 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1298,7 +1298,7 @@ static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ u64 efer = msr_info->data;
+
+ if (efer & efer_reserved_bits)
+- return false;
++ return 1;
+
+ if (!msr_info->host_initiated) {
+ if (!__kvm_valid_efer(vcpu, efer))
+
diff --git a/patches.arch/kvm-x86-skip-efer-vs-guest-cpuid-checks-for-host-initiated-writes b/patches.arch/kvm-x86-skip-efer-vs-guest-cpuid-checks-for-host-initiated-writes
new file mode 100644
index 0000000000..ef1cd7f41b
--- /dev/null
+++ b/patches.arch/kvm-x86-skip-efer-vs-guest-cpuid-checks-for-host-initiated-writes
@@ -0,0 +1,99 @@
+From: Sean Christopherson <sean.j.christopherson@intel.com>
+Date: Tue, 2 Apr 2019 08:19:15 -0700
+Subject: KVM: x86: Skip EFER vs. guest CPUID checks for host-initiated writes
+Git-commit: 11988499e62b310f3bf6f6d0a807a06d3f9ccc96
+Patch-mainline: v5.2-rc1
+References: bsc#1140972
+
+KVM allows userspace to violate consistency checks related to the
+guest's CPUID model to some degree. Generally speaking, userspace has
+carte blanche when it comes to guest state so long as jamming invalid
+state won't negatively affect the host.
+
+Currently this is seems to be a non-issue as most of the interesting
+EFER checks are missing, e.g. NX and LME, but those will be added
+shortly. Proactively exempt userspace from the CPUID checks so as not
+to break userspace.
+
+Note, the efer_reserved_bits check still applies to userspace writes as
+that mask reflects the host's capabilities, e.g. KVM shouldn't allow a
+guest to run with NX=1 if it has been disabled in the host.
+
+Fixes: d80174745ba39 ("KVM: SVM: Only allow setting of EFER_SVME when CPUID SVM is set")
+Cc: stable@vger.kernel.org
+Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/x86.c | 37 ++++++++++++++++++++++++-------------
+ 1 file changed, 24 insertions(+), 13 deletions(-)
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index a0d1fc80ac5a..5d7dcd06d08a 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1258,31 +1258,42 @@ static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data)
+ return 0;
+ }
+
+-bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
++static bool __kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
+ {
+- if (efer & efer_reserved_bits)
+- return false;
+-
+ if (efer & EFER_FFXSR && !guest_cpuid_has(vcpu, X86_FEATURE_FXSR_OPT))
+- return false;
++ return false;
+
+ if (efer & EFER_SVME && !guest_cpuid_has(vcpu, X86_FEATURE_SVM))
+- return false;
++ return false;
+
+ return true;
++
++}
++bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer)
++{
++ if (efer & efer_reserved_bits)
++ return false;
++
++ return __kvm_valid_efer(vcpu, efer);
+ }
+ EXPORT_SYMBOL_GPL(kvm_valid_efer);
+
+-static int set_efer(struct kvm_vcpu *vcpu, u64 efer)
++static int set_efer(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ {
+ u64 old_efer = vcpu->arch.efer;
++ u64 efer = msr_info->data;
+
+- if (!kvm_valid_efer(vcpu, efer))
+- return 1;
++ if (efer & efer_reserved_bits)
++ return false;
+
+- if (is_paging(vcpu)
+- && (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME))
+- return 1;
++ if (!msr_info->host_initiated) {
++ if (!__kvm_valid_efer(vcpu, efer))
++ return 1;
++
++ if (is_paging(vcpu) &&
++ (vcpu->arch.efer & EFER_LME) != (efer & EFER_LME))
++ return 1;
++ }
+
+ efer &= ~EFER_LMA;
+ efer |= vcpu->arch.efer & EFER_LMA;
+@@ -2452,7 +2463,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ vcpu->arch.arch_capabilities = data;
+ break;
+ case MSR_EFER:
+- return set_efer(vcpu, data);
++ return set_efer(vcpu, msr_info);
+ case MSR_K7_HWCR:
+ data &= ~(u64)0x40; /* ignore flush filter disable */
+ data &= ~(u64)0x100; /* ignore ignne emulation enable */
+
diff --git a/patches.arch/powerpc-mm-64s-hash-Reallocate-context-ids-on-fork.patch b/patches.arch/powerpc-mm-64s-hash-Reallocate-context-ids-on-fork.patch
new file mode 100644
index 0000000000..c64dc099b9
--- /dev/null
+++ b/patches.arch/powerpc-mm-64s-hash-Reallocate-context-ids-on-fork.patch
@@ -0,0 +1,144 @@
+From 1f013b4e2e3ec181cd0be70f19c6b8d00252e0db Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Wed, 12 Jun 2019 23:35:07 +1000
+Subject: [PATCH] powerpc/mm/64s/hash: Reallocate context ids on fork
+
+References: bsc#1138263, bsc#1139619, LTC#178538, CVE-2019-12817
+Patch-mainline: v5.2 or v5.2-rc7 (next release)
+Git-commit: ca72d88378b2f2444d3ec145dd442d449d3fefbc
+
+When using the Hash Page Table (HPT) MMU, userspace memory mappings
+are managed at two levels. Firstly in the Linux page tables, much like
+other architectures, and secondly in the SLB (Segment Lookaside
+Buffer) and HPT. It's the SLB and HPT that are actually used by the
+hardware to do translations.
+
+As part of the series adding support for 4PB user virtual address
+space using the hash MMU, we added support for allocating multiple
+"context ids" per process, one for each 512TB chunk of address space.
+These are tracked in an array called extended_id in the mm_context_t
+of a process that has done a mapping above 512TB.
+
+If such a process forks (ie. clone(2) without CLONE_VM set) it's mm is
+copied, including the mm_context_t, and then init_new_context() is
+called to reinitialise parts of the mm_context_t as appropriate to
+separate the address spaces of the two processes.
+
+The key step in ensuring the two processes have separate address
+spaces is to allocate a new context id for the process, this is done
+at the beginning of hash__init_new_context(). If we didn't allocate a
+new context id then the two processes would share mappings as far as
+the SLB and HPT are concerned, even though their Linux page tables
+would be separate.
+
+For mappings above 512TB, which use the extended_id array, we
+neglected to allocate new context ids on fork, meaning the parent and
+child use the same ids and therefore share those mappings even though
+they're supposed to be separate. This can lead to the parent seeing
+writes done by the child, which is essentially memory corruption.
+
+There is an additional exposure which is that if the child process
+exits, all its context ids are freed, including the context ids that
+are still in use by the parent for mappings above 512TB. One or more
+of those ids can then be reallocated to a third process, that process
+can then read/write to the parent's mappings above 512TB. Additionally
+if the freed id is used for the third process's primary context id,
+then the parent is able to read/write to the third process's mappings
+*below* 512TB.
+
+All of these are fundamental failures to enforce separation between
+processes. The only mitigating factor is that the bug only occurs if a
+process creates mappings above 512TB, and most applications still do
+not create such mappings.
+
+Only machines using the hash page table MMU are affected, eg. PowerPC
+970 (G5), PA6T, Power5/6/7/8/9. By default Power9 bare metal machines
+(powernv) use the Radix MMU and are not affected, unless the machine
+has been explicitly booted in HPT mode (using disable_radix on the
+kernel command line). KVM guests on Power9 may be affected if the host
+or guest is configured to use the HPT MMU. LPARs under PowerVM on
+Power9 are affected as they always use the HPT MMU. Kernels built with
+PAGE_SIZE=4K are not affected.
+
+The fix is relatively simple, we need to reallocate context ids for
+all extended mappings on fork.
+
+Fixes: f384796c40dc ("powerpc/mm: Add support for handling > 512TB address in SLB miss")
+Cc: stable@vger.kernel.org # v4.17+
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/mm/mmu_context_book3s64.c | 46 +++++++++++++++++++++++---
+ 1 file changed, 42 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/mm/mmu_context_book3s64.c b/arch/powerpc/mm/mmu_context_book3s64.c
+index a792d5f288bb..f7090b277027 100644
+--- a/arch/powerpc/mm/mmu_context_book3s64.c
++++ b/arch/powerpc/mm/mmu_context_book3s64.c
+@@ -85,14 +85,48 @@ int hash__alloc_context_id(void)
+ }
+ EXPORT_SYMBOL_GPL(hash__alloc_context_id);
+
++static int realloc_context_ids(mm_context_t *ctx)
++{
++ int i, id;
++
++ /*
++ * id 0 (aka. ctx->id) is special, we always allocate a new one, even if
++ * there wasn't one allocated previously (which happens in the exec
++ * case where ctx is newly allocated).
++ *
++ * We have to be a bit careful here. We must keep the existing ids in
++ * the array, so that we can test if they're non-zero to decide if we
++ * need to allocate a new one. However in case of error we must free the
++ * ids we've allocated but *not* any of the existing ones (or risk a
++ * UAF). That's why we decrement i at the start of the error handling
++ * loop, to skip the id that we just tested but couldn't reallocate.
++ */
++ for (i = 0; i < ARRAY_SIZE(ctx->extended_id); i++) {
++ if (i == 0 || ctx->extended_id[i]) {
++ id = hash__alloc_context_id();
++ if (id < 0)
++ goto error;
++
++ ctx->extended_id[i] = id;
++ }
++ }
++
++ /* The caller expects us to return id */
++ return ctx->id;
++
++error:
++ for (i--; i >= 0; i--) {
++ if (ctx->extended_id[i])
++ ida_free(&mmu_context_ida, ctx->extended_id[i]);
++ }
++
++ return id;
++}
++
+ static int hash__init_new_context(struct mm_struct *mm)
+ {
+ int index;
+
+- index = hash__alloc_context_id();
+- if (index < 0)
+- return index;
+-
+ /*
+ * The old code would re-promote on fork, we don't do that when using
+ * slices as it could cause problem promoting slices that have been
+@@ -110,6 +144,10 @@ static int hash__init_new_context(struct mm_struct *mm)
+ if (mm->context.id == 0)
+ slice_init_new_context_exec(mm);
+
++ index = realloc_context_ids(&mm->context);
++ if (index < 0)
++ return index;
++
+ subpage_prot_init_new_context(mm);
+
+ pkey_mm_init(mm);
+--
+2.21.0
+
diff --git a/patches.arch/powerpc-perf-Add-PM_LD_MISS_L1-and-PM_BR_2PATH-to-po.patch b/patches.arch/powerpc-perf-Add-PM_LD_MISS_L1-and-PM_BR_2PATH-to-po.patch
new file mode 100644
index 0000000000..4bd608c84a
--- /dev/null
+++ b/patches.arch/powerpc-perf-Add-PM_LD_MISS_L1-and-PM_BR_2PATH-to-po.patch
@@ -0,0 +1,60 @@
+From 91e0bd1e62519bdb50e35775ec37b27a9535b8d7 Mon Sep 17 00:00:00 2001
+From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Date: Mon, 31 Jul 2017 15:03:21 +0530
+Subject: [PATCH] powerpc/perf: Add PM_LD_MISS_L1 and PM_BR_2PATH to power9
+ event list
+
+References: bsc#1137728, LTC#178106
+Patch-mainline: v4.14-rc1
+Git-commit: 91e0bd1e62519bdb50e35775ec37b27a9535b8d7
+
+Add couple of more events (PM_LD_MISS_L1 and PM_BR_2PATH) to
+power9 event list and power9_event_alternatives array (these
+events can be counted in more than one PMC).
+
+Signed-off-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/perf/power9-events-list.h | 7 +++++++
+ arch/powerpc/perf/power9-pmu.c | 2 ++
+ 2 files changed, 9 insertions(+)
+
+diff --git a/arch/powerpc/perf/power9-events-list.h b/arch/powerpc/perf/power9-events-list.h
+index 50689180a6c1..3910dd81919d 100644
+--- a/arch/powerpc/perf/power9-events-list.h
++++ b/arch/powerpc/perf/power9-events-list.h
+@@ -23,6 +23,9 @@ EVENT(PM_BR_MPRED_CMPL, 0x400f6)
+ EVENT(PM_LD_REF_L1, 0x100fc)
+ /* Load Missed L1 */
+ EVENT(PM_LD_MISS_L1_FIN, 0x2c04e)
++EVENT(PM_LD_MISS_L1, 0x3e054)
++/* Alternate event code for PM_LD_MISS_L1 */
++EVENT(PM_LD_MISS_L1_ALT, 0x400f0)
+ /* Store Missed L1 */
+ EVENT(PM_ST_MISS_L1, 0x300f0)
+ /* L1 cache data prefetches */
+@@ -62,3 +65,7 @@ EVENT(PM_INST_DISP, 0x200f2)
+ EVENT(PM_INST_DISP_ALT, 0x300f2)
+ /* Alternate Branch event code */
+ EVENT(PM_BR_CMPL_ALT, 0x10012)
++/* Branch event that are not strongly biased */
++EVENT(PM_BR_2PATH, 0x20036)
++/* ALternate branch event that are not strongly biased */
++EVENT(PM_BR_2PATH_ALT, 0x40036)
+diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
+index d83aa24b77d4..bbf675983f21 100644
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -109,6 +109,8 @@ static const unsigned int power9_event_alternatives[][MAX_ALT] = {
+ { PM_INST_DISP, PM_INST_DISP_ALT },
+ { PM_RUN_CYC_ALT, PM_RUN_CYC },
+ { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL },
++ { PM_LD_MISS_L1, PM_LD_MISS_L1_ALT },
++ { PM_BR_2PATH, PM_BR_2PATH_ALT },
+ };
+
+ static int power9_get_alternatives(u64 event, unsigned int flags, u64 alt[])
+--
+2.21.0
+
diff --git a/patches.arch/powerpc-perf-Add-POWER9-alternate-PM_RUN_CYC-and-PM_.patch b/patches.arch/powerpc-perf-Add-POWER9-alternate-PM_RUN_CYC-and-PM_.patch
new file mode 100644
index 0000000000..6e9678c51e
--- /dev/null
+++ b/patches.arch/powerpc-perf-Add-POWER9-alternate-PM_RUN_CYC-and-PM_.patch
@@ -0,0 +1,55 @@
+From 3f0bd8dad0db73f5d71b355aec5ab33b374260ba Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Mon, 19 Jun 2017 09:51:28 +1000
+Subject: [PATCH] powerpc/perf: Add POWER9 alternate PM_RUN_CYC and
+ PM_RUN_INST_CMPL events
+
+References: bsc#1137728, LTC#178106
+Patch-mainline: v4.13-rc1
+Git-commit: 3f0bd8dad0db73f5d71b355aec5ab33b374260ba
+
+Similar to POWER8, POWER9 can count run cycles and run instructions
+completed on more than one PMU.
+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Acked-by: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/perf/power9-events-list.h | 4 ++++
+ arch/powerpc/perf/power9-pmu.c | 2 ++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/powerpc/perf/power9-events-list.h b/arch/powerpc/perf/power9-events-list.h
+index 80204e064362..50689180a6c1 100644
+--- a/arch/powerpc/perf/power9-events-list.h
++++ b/arch/powerpc/perf/power9-events-list.h
+@@ -51,8 +51,12 @@ EVENT(PM_DTLB_MISS, 0x300fc)
+ EVENT(PM_ITLB_MISS, 0x400fc)
+ /* Run_Instructions */
+ EVENT(PM_RUN_INST_CMPL, 0x500fa)
++/* Alternate event code for PM_RUN_INST_CMPL */
++EVENT(PM_RUN_INST_CMPL_ALT, 0x400fa)
+ /* Run_cycles */
+ EVENT(PM_RUN_CYC, 0x600f4)
++/* Alternate event code for Run_cycles */
++EVENT(PM_RUN_CYC_ALT, 0x200f4)
+ /* Instruction Dispatched */
+ EVENT(PM_INST_DISP, 0x200f2)
+ EVENT(PM_INST_DISP_ALT, 0x300f2)
+diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
+index f17435e4a489..2280cf87ff9c 100644
+--- a/arch/powerpc/perf/power9-pmu.c
++++ b/arch/powerpc/perf/power9-pmu.c
+@@ -107,6 +107,8 @@ extern struct attribute_group isa207_pmu_format_group;
+ /* Table of alternatives, sorted by column 0 */
+ static const unsigned int power9_event_alternatives[][MAX_ALT] = {
+ { PM_INST_DISP, PM_INST_DISP_ALT },
++ { PM_RUN_CYC_ALT, PM_RUN_CYC },
++ { PM_RUN_INST_CMPL_ALT, PM_RUN_INST_CMPL },
+ };
+
+ static int power9_get_alternatives(u64 event, unsigned int flags, u64 alt[])
+--
+2.21.0
+
diff --git a/patches.arch/powerpc-perf-Add-blacklisted-events-for-Power9-DD2.1.patch b/patches.arch/powerpc-perf-Add-blacklisted-events-for-Power9-DD2.1.patch
index 8db65d82bc..4392c7af82 100644
--- a/patches.arch/powerpc-perf-Add-blacklisted-events-for-Power9-DD2.1.patch
+++ b/patches.arch/powerpc-perf-Add-blacklisted-events-for-Power9-DD2.1.patch
@@ -1,4 +1,4 @@
-From eafffa1f14c7f4d50efdb60fe6a487309daffba6 Mon Sep 17 00:00:00 2001
+From 64acab4e4fca19706e907bec435cc2acb65c83f3 Mon Sep 17 00:00:00 2001
From: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
Date: Sun, 4 Mar 2018 17:26:27 +0530
Subject: [PATCH] powerpc/perf: Add blacklisted events for Power9 DD2.1
@@ -20,13 +20,13 @@ Acked-by: Michal Suchanek <msuchanek@suse.de>
2 files changed, 39 insertions(+)
diff --git a/arch/powerpc/perf/power9-events-list.h b/arch/powerpc/perf/power9-events-list.h
-index 6842ee338ef4..62cf209e9dbf 100644
+index e99c6bf4d391..9d7a16a943a8 100644
--- a/arch/powerpc/perf/power9-events-list.h
+++ b/arch/powerpc/perf/power9-events-list.h
-@@ -58,3 +58,16 @@ EVENT(PM_INST_DISP, 0x200f2)
- EVENT(PM_INST_DISP_ALT, 0x300f2)
- /* Alternate Branch event code */
- EVENT(PM_BR_CMPL_ALT, 0x10012)
+@@ -69,3 +69,16 @@ EVENT(PM_BR_CMPL_ALT, 0x10012)
+ EVENT(PM_BR_2PATH, 0x20036)
+ /* ALternate branch event that are not strongly biased */
+ EVENT(PM_BR_2PATH_ALT, 0x40036)
+
+/* Blacklisted events */
+EVENT(PM_MRK_ST_DONE_L2, 0x10134)
@@ -41,7 +41,7 @@ index 6842ee338ef4..62cf209e9dbf 100644
+EVENT(PM_TM_TX_PASS_RUN_INST, 0x4e014)
+EVENT(PM_DISP_HELD_SYNC_HOLD, 0x4003c)
diff --git a/arch/powerpc/perf/power9-pmu.c b/arch/powerpc/perf/power9-pmu.c
-index 18fc2e43a559..6e5808e9a3cb 100644
+index 24b5b5b7a206..3847607c16f0 100644
--- a/arch/powerpc/perf/power9-pmu.c
+++ b/arch/powerpc/perf/power9-pmu.c
@@ -101,9 +101,26 @@ enum {
@@ -71,7 +71,7 @@ index 18fc2e43a559..6e5808e9a3cb 100644
/* Table of alternatives, sorted by column 0 */
static const unsigned int power9_event_alternatives[][MAX_ALT] = {
{ PM_INST_DISP, PM_INST_DISP_ALT },
-@@ -442,12 +459,21 @@ static struct power_pmu power9_pmu = {
+@@ -446,12 +463,21 @@ static struct power_pmu power9_pmu = {
static int __init init_power9_pmu(void)
{
int rc = 0;
@@ -94,5 +94,5 @@ index 18fc2e43a559..6e5808e9a3cb 100644
/*
* Since PM_INST_CMPL may not provide right counts in all
--
-2.13.6
+2.21.0
diff --git a/patches.arch/powerpc-rtas-retry-when-cpu-offline-races-with-suspe.patch b/patches.arch/powerpc-rtas-retry-when-cpu-offline-races-with-suspe.patch
new file mode 100644
index 0000000000..68b390c6ed
--- /dev/null
+++ b/patches.arch/powerpc-rtas-retry-when-cpu-offline-races-with-suspe.patch
@@ -0,0 +1,59 @@
+From 9fb603050ffd94f8127df99c699cca2f575eb6a0 Mon Sep 17 00:00:00 2001
+From: Nathan Lynch <nathanl@linux.ibm.com>
+Date: Fri, 21 Jun 2019 01:05:18 -0500
+Subject: [PATCH] powerpc/rtas: retry when cpu offline races with
+ suspend/migration
+
+References: bsc#1140428, LTC#178808
+Patch-mainline: queued
+Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git
+Git-commit: 9fb603050ffd94f8127df99c699cca2f575eb6a0
+
+The protocol for suspending or migrating an LPAR requires all present
+processor threads to enter H_JOIN. So if we have threads offline, we
+have to temporarily bring them up. This can race with administrator
+actions such as SMT state changes. As of dfd718a2ed1f ("powerpc/rtas:
+Fix a potential race between CPU-Offline & Migration"),
+rtas_ibm_suspend_me() accounts for this, but errors out with -EBUSY
+for what almost certainly is a transient condition in any reasonable
+scenario.
+
+Callers of rtas_ibm_suspend_me() already retry when -EAGAIN is
+returned, and it is typical during a migration for that to happen
+repeatedly for several minutes polling the H_VASI_STATE hcall result
+before proceeding to the next stage.
+
+So return -EAGAIN instead of -EBUSY when this race is
+encountered. Additionally: logging this event is still appropriate but
+use pr_info instead of pr_err; and remove use of unlikely() while here
+as this is not a hot path at all.
+
+Fixes: dfd718a2ed1f ("powerpc/rtas: Fix a potential race between CPU-Offline & Migration")
+Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Acked-by: Michal Suchanek <msuchanek@suse.de>
+---
+ arch/powerpc/kernel/rtas.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index fbc676160adf..9b4d2a2ffb4f 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -984,10 +984,9 @@ int rtas_ibm_suspend_me(u64 handle)
+ cpu_hotplug_disable();
+
+ /* Check if we raced with a CPU-Offline Operation */
+- if (unlikely(!cpumask_equal(cpu_present_mask, cpu_online_mask))) {
+- pr_err("%s: Raced against a concurrent CPU-Offline\n",
+- __func__);
+- atomic_set(&data.error, -EBUSY);
++ if (!cpumask_equal(cpu_present_mask, cpu_online_mask)) {
++ pr_info("%s: Raced against a concurrent CPU-Offline\n", __func__);
++ atomic_set(&data.error, -EAGAIN);
+ goto out_hotplug_enable;
+ }
+
+--
+2.21.0
+
diff --git a/patches.arch/revert-svm-fix-avic-incomplete-ipi-emulation b/patches.arch/revert-svm-fix-avic-incomplete-ipi-emulation
new file mode 100644
index 0000000000..a2862cad07
--- /dev/null
+++ b/patches.arch/revert-svm-fix-avic-incomplete-ipi-emulation
@@ -0,0 +1,71 @@
+From: "Suthikulpanit, Suravee" <Suravee.Suthikulpanit@amd.com>
+Date: Wed, 20 Mar 2019 08:12:28 +0000
+Subject: Revert "svm: Fix AVIC incomplete IPI emulation"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Git-commit: 4a58038b9e420276157785afa0a0bbb4b9bc2265
+Patch-mainline: v5.1-rc6
+References: bsc#1140133
+
+This reverts commit bb218fbcfaaa3b115d4cd7a43c0ca164f3a96e57.
+
+As Oren Twaig pointed out the old discussion:
+
+ https://patchwork.kernel.org/patch/8292231/
+
+that the change coud potentially cause an extra IPI to be sent to
+the destination vcpu because the AVIC hardware already set the IRR bit
+before the incomplete IPI #VMEXIT with id=1 (target vcpu is not running).
+Since writting to ICR and ICR2 will also set the IRR. If something triggers
+the destination vcpu to get scheduled before the emulation finishes, then
+this could result in an additional IPI.
+
+Also, the issue mentioned in the commit bb218fbcfaaa was misdiagnosed.
+
+Cc: Radim Krčmář <rkrcmar@redhat.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Reported-by: Oren Twaig <oren@scalemp.com>
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index e0a791c3d4fc..d7b14c902052 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4517,14 +4517,25 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
++ int i;
++ struct kvm_vcpu *vcpu;
++ struct kvm *kvm = svm->vcpu.kvm;
+ struct kvm_lapic *apic = svm->vcpu.arch.apic;
+
+ /*
+- * Update ICR high and low, then emulate sending IPI,
+- * which is handled when writing APIC_ICR.
++ * At this point, we expect that the AVIC HW has already
++ * set the appropriate IRR bits on the valid target
++ * vcpus. So, we just need to kick the appropriate vcpu.
+ */
+- kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
+- kvm_lapic_reg_write(apic, APIC_ICR, icrl);
++ kvm_for_each_vcpu(i, vcpu, kvm) {
++ bool m = kvm_apic_match_dest(vcpu, apic,
++ icrl & KVM_APIC_SHORT_MASK,
++ GET_APIC_DEST_FIELD(icrh),
++ icrl & KVM_APIC_DEST_MASK);
++
++ if (m && !avic_vcpu_is_running(vcpu))
++ kvm_vcpu_wake_up(vcpu);
++ }
+ break;
+ }
+ case AVIC_IPI_FAILURE_INVALID_TARGET:
+
diff --git a/patches.arch/svm-add-warning-message-for-avic-ipi-invalid-target b/patches.arch/svm-add-warning-message-for-avic-ipi-invalid-target
new file mode 100644
index 0000000000..955351f2ee
--- /dev/null
+++ b/patches.arch/svm-add-warning-message-for-avic-ipi-invalid-target
@@ -0,0 +1,34 @@
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Date: Tue, 22 Jan 2019 10:24:19 +0000
+Subject: svm: Add warning message for AVIC IPI invalid target
+Git-commit: 37ef0c4414c9743ba7f1af4392f0a27a99649f2a
+Patch-mainline: v5.0-rc4
+References: bsc#1140133
+
+Print warning message when IPI target ID is invalid due to one of
+the following reasons:
+ * In logical mode: cluster > max_cluster (64)
+ * In physical mode: target > max_physical (512)
+ * Address is not present in the physical or logical ID tables
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index a157ca5b6869..2aff835a65ed 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4526,6 +4526,8 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ break;
+ }
+ case AVIC_IPI_FAILURE_INVALID_TARGET:
++ WARN_ONCE(1, "Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n",
++ index, svm->vcpu.vcpu_id, icrh, icrl);
+ break;
+ case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE:
+ WARN_ONCE(1, "Invalid backing page\n");
+
diff --git a/patches.arch/svm-fix-avic-incomplete-ipi-emulation b/patches.arch/svm-fix-avic-incomplete-ipi-emulation
new file mode 100644
index 0000000000..c94b2e3793
--- /dev/null
+++ b/patches.arch/svm-fix-avic-incomplete-ipi-emulation
@@ -0,0 +1,56 @@
+From: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Date: Tue, 22 Jan 2019 10:25:13 +0000
+Subject: svm: Fix AVIC incomplete IPI emulation
+Git-commit: bb218fbcfaaa3b115d4cd7a43c0ca164f3a96e57
+Patch-mainline: v5.0-rc4
+References: bsc#1140133
+
+In case of incomplete IPI with invalid interrupt type, the current
+SVM driver does not properly emulate the IPI, and fails to boot
+FreeBSD guests with multiple vcpus when enabling AVIC.
+
+Fix this by update APIC ICR high/low registers, which also
+emulate sending the IPI.
+
+Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 19 ++++---------------
+ 1 file changed, 4 insertions(+), 15 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 2aff835a65ed..8a0c9a1f6ac8 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -4504,25 +4504,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
+- int i;
+- struct kvm_vcpu *vcpu;
+- struct kvm *kvm = svm->vcpu.kvm;
+ struct kvm_lapic *apic = svm->vcpu.arch.apic;
+
+ /*
+- * At this point, we expect that the AVIC HW has already
+- * set the appropriate IRR bits on the valid target
+- * vcpus. So, we just need to kick the appropriate vcpu.
++ * Update ICR high and low, then emulate sending IPI,
++ * which is handled when writing APIC_ICR.
+ */
+- kvm_for_each_vcpu(i, vcpu, kvm) {
+- bool m = kvm_apic_match_dest(vcpu, apic,
+- icrl & KVM_APIC_SHORT_MASK,
+- GET_APIC_DEST_FIELD(icrh),
+- icrl & KVM_APIC_DEST_MASK);
+-
+- if (m && !avic_vcpu_is_running(vcpu))
+- kvm_vcpu_wake_up(vcpu);
+- }
++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
++ kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ break;
+ }
+ case AVIC_IPI_FAILURE_INVALID_TARGET:
+
diff --git a/patches.arch/x86-amd_nb-add-pci-device-ids-for-family-17h-model-30h.patch b/patches.arch/x86-amd_nb-add-pci-device-ids-for-family-17h-model-30h.patch
index f45d89847a..6652c25090 100644
--- a/patches.arch/x86-amd_nb-add-pci-device-ids-for-family-17h-model-30h.patch
+++ b/patches.arch/x86-amd_nb-add-pci-device-ids-for-family-17h-model-30h.patch
@@ -1,9 +1,11 @@
+From be3518a16ef270e3b030a6ae96055f83f51bd3dd Mon Sep 17 00:00:00 2001
From: "Woods, Brian" <Brian.Woods@amd.com>
Date: Tue, 6 Nov 2018 20:08:18 +0000
-Subject: x86/amd_nb: Add PCI device IDs for family 17h, model 30h
-Git-commit: be3518a16ef270e3b030a6ae96055f83f51bd3dd
-Patch-mainline: v5.0-rc1
+Subject: [PATCH] x86/amd_nb: Add PCI device IDs for family 17h, model 30h
+
References: fate#326884
+Patch-mainline: v5.0-rc1
+Git-commit: be3518a16ef270e3b030a6ae96055f83f51bd3dd
Add the PCI device IDs for family 17h model 30h, since they are needed
for accessing various registers via the data fabric/SMN interface.
@@ -24,10 +26,12 @@ CC: Thomas Gleixner <tglx@linutronix.de>
CC: x86-ml <x86@kernel.org>
Link: http://lkml.kernel.org/r/20181106200754.60722-4-brian.woods@amd.com
---
- arch/x86/kernel/amd_nb.c | 6 ++++++
- include/linux/pci_ids.h | 1 +
+ arch/x86/kernel/amd_nb.c | 6 ++++++
+ include/linux/pci_ids.h | 1 +
2 files changed, 7 insertions(+)
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index cc34266e3c62..cc51275c8759 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
@@ -16,8 +16,10 @@
@@ -53,7 +57,7 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-4-brian.woods@amd.com
#define PCI_DEVICE_ID_AMD_CNB17H_F4 0x1704
const struct pci_device_id amd_nb_misc_ids[] = {
-@@ -43,6 +47,7 @@ const struct pci_device_id amd_nb_misc_i
+@@ -43,6 +47,7 @@ const struct pci_device_id amd_nb_misc_ids[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) },
@@ -61,7 +65,7 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-4-brian.woods@amd.com
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
{}
};
-@@ -56,6 +61,7 @@ static const struct pci_device_id amd_nb
+@@ -56,6 +61,7 @@ static const struct pci_device_id amd_nb_link_ids[] = {
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_DF_F4) },
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F4) },
@@ -69,9 +73,11 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-4-brian.woods@amd.com
{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) },
{}
};
+diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
+index 78d5cd29778a..349276fbd269 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
-@@ -542,6 +542,7 @@
+@@ -547,6 +547,7 @@
#define PCI_DEVICE_ID_AMD_16H_M30H_NB_F4 0x1584
#define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
#define PCI_DEVICE_ID_AMD_17H_M10H_DF_F3 0x15eb
@@ -79,3 +85,6 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-4-brian.woods@amd.com
#define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703
#define PCI_DEVICE_ID_AMD_LANCE 0x2000
#define PCI_DEVICE_ID_AMD_LANCE_HOME 0x2001
+--
+2.21.0
+
diff --git a/patches.arch/x86-amd_nb-add-support-for-newer-pci-topologies.patch b/patches.arch/x86-amd_nb-add-support-for-newer-pci-topologies.patch
index 400d7c2819..9ff61a0459 100644
--- a/patches.arch/x86-amd_nb-add-support-for-newer-pci-topologies.patch
+++ b/patches.arch/x86-amd_nb-add-support-for-newer-pci-topologies.patch
@@ -1,9 +1,11 @@
+From 556e4c62baffa71e2045a298379db7e57dd47f3d Mon Sep 17 00:00:00 2001
From: "Woods, Brian" <Brian.Woods@amd.com>
Date: Tue, 6 Nov 2018 20:08:16 +0000
-Subject: x86/amd_nb: Add support for newer PCI topologies
-Git-commit: 556e4c62baffa71e2045a298379db7e57dd47f3d
-Patch-mainline: v5.0-rc1
+Subject: [PATCH] x86/amd_nb: Add support for newer PCI topologies
+
References: fate#326884
+Patch-mainline: v5.0-rc1
+Git-commit: 556e4c62baffa71e2045a298379db7e57dd47f3d
Add support for new processors which have multiple PCI root complexes
per data fabric/system management network interface. If there are (N)
@@ -37,16 +39,15 @@ CC: Pu Wen <puwen@hygon.cn>
CC: Thomas Gleixner <tglx@linutronix.de>
CC: x86-ml <x86@kernel.org>
Link: http://lkml.kernel.org/r/20181106200754.60722-3-brian.woods@amd.com
-
-[ bp: Fix build without the hygon stuff from c6babb5806b77 ]
-
---
- arch/x86/kernel/amd_nb.c | 44 ++++++++++++++++++++++++++++++++++++++------
+ arch/x86/kernel/amd_nb.c | 44 ++++++++++++++++++++++++++++++++++------
1 file changed, 38 insertions(+), 6 deletions(-)
+diff --git a/arch/x86/kernel/amd_nb.c b/arch/x86/kernel/amd_nb.c
+index 19d489ee2b1e..cc34266e3c62 100644
--- a/arch/x86/kernel/amd_nb.c
+++ b/arch/x86/kernel/amd_nb.c
-@@ -208,7 +208,10 @@ int amd_cache_northbridges(void)
+@@ -213,7 +213,10 @@ int amd_cache_northbridges(void)
const struct pci_device_id *root_ids = amd_root_ids;
struct pci_dev *root, *misc, *link;
struct amd_northbridge *nb;
@@ -58,7 +59,7 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-3-brian.woods@amd.com
if (amd_northbridges.num)
return 0;
-@@ -221,26 +224,55 @@ int amd_cache_northbridges(void)
+@@ -226,26 +229,55 @@ int amd_cache_northbridges(void)
misc = NULL;
while ((misc = next_northbridge(misc, misc_ids)) != NULL)
@@ -71,7 +72,7 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-3-brian.woods@amd.com
- nb = kcalloc(i, sizeof(struct amd_northbridge), GFP_KERNEL);
+ root = NULL;
-+ while ((root = next_northbridge(root, amd_root_ids)) != NULL)
++ while ((root = next_northbridge(root, root_ids)) != NULL)
+ root_count++;
+
+ if (root_count) {
@@ -115,7 +116,10 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-3-brian.woods@amd.com
+ * correct PCI roots.
+ */
+ for (j = 1; j < roots_per_misc; j++)
-+ root = next_northbridge(root, amd_root_ids);
++ root = next_northbridge(root, root_ids);
}
if (amd_gart_present())
+--
+2.21.0
+
diff --git a/patches.arch/x86-cpu-get-cache-info-and-setup-cache-cpumap-for-hygon-dhyana.patch b/patches.arch/x86-cpu-get-cache-info-and-setup-cache-cpumap-for-hygon-dhyana.patch
index fa08958b4a..94dda05274 100644
--- a/patches.arch/x86-cpu-get-cache-info-and-setup-cache-cpumap-for-hygon-dhyana.patch
+++ b/patches.arch/x86-cpu-get-cache-info-and-setup-cache-cpumap-for-hygon-dhyana.patch
@@ -27,45 +27,43 @@ Cc: x86@kernel.org
Cc: thomas.lendacky@amd.com
Link: https://lkml.kernel.org/r/2a686b2ac0e2f5a1f2f5f101124d9dd44f949731.1537533369.git.puwen@hygon.cn
---
- arch/x86/include/asm/cacheinfo.h | 1 +
- arch/x86/kernel/cpu/cacheinfo.c | 31 +++++++++++++++++++++++++++++--
- arch/x86/kernel/cpu/cpu.h | 1 +
- arch/x86/kernel/cpu/hygon.c | 3 +++
- 4 files changed, 34 insertions(+), 2 deletions(-)
+ arch/x86/kernel/cpu/cpu.h | 2 ++
+ arch/x86/kernel/cpu/hygon.c | 3 +++
+ arch/x86/kernel/cpu/cacheinfo.c | 31 +++++++++++++++++++++++++++++--
+ 3 files changed, 34 insertions(+), 2 deletions(-)
---- a/arch/x86/include/asm/cacheinfo.h
-+++ b/arch/x86/include/asm/cacheinfo.h
-@@ -3,5 +3,6 @@
- #define _ASM_X86_CACHEINFO_H
-
- void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id);
+--- a/arch/x86/kernel/cpu/cpu.h
++++ b/arch/x86/kernel/cpu/cpu.h
+@@ -50,5 +50,7 @@ extern void x86_spec_ctrl_setup_ap(void)
+ extern int detect_extended_topology_early(struct cpuinfo_x86 *c);
+ extern int detect_extended_topology(struct cpuinfo_x86 *c);
+ extern int detect_ht_early(struct cpuinfo_x86 *c);
++extern void init_hygon_cacheinfo(struct cpuinfo_x86 *c);
+void cacheinfo_hygon_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id);
- #endif /* _ASM_X86_CACHEINFO_H */
+ #endif /* ARCH_X86_CPU_H */
+--- a/arch/x86/kernel/cpu/hygon.c
++++ b/arch/x86/kernel/cpu/hygon.c
+@@ -86,6 +86,7 @@ static void hygon_get_topology(struct cp
+ if (!err)
+ c->x86_coreid_bits = get_count_order(c->x86_max_cores);
+
++ cacheinfo_hygon_init_llc_id(c, cpu, node_id);
+ } else if (cpu_has(c, X86_FEATURE_NODEID_MSR)) {
+ u64 value;
+
+@@ -320,6 +321,8 @@ static void init_hygon(struct cpuinfo_x8
+ hygon_get_topology(c);
+ srat_detect_node(c);
+
++ init_hygon_cacheinfo(c);
++
+ if (cpu_has(c, X86_FEATURE_XMM2)) {
+ unsigned long long val;
+ int ret;
--- a/arch/x86/kernel/cpu/cacheinfo.c
+++ b/arch/x86/kernel/cpu/cacheinfo.c
-@@ -599,6 +599,10 @@ cpuid4_cache_lookup_regs(int index, stru
- else
- amd_cpuid4(index, &eax, &ebx, &ecx);
- amd_init_l3_cache(this_leaf, index);
-+ } else if (boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) {
-+ cpuid_count(0x8000001d, index, &eax.full,
-+ &ebx.full, &ecx.full, &edx);
-+ amd_init_l3_cache(this_leaf, index);
- } else {
- cpuid_count(4, index, &eax.full, &ebx.full, &ecx.full, &edx);
- }
-@@ -622,7 +626,8 @@ static int find_num_cache_leaves(struct
- union _cpuid4_leaf_eax cache_eax;
- int i = -1;
-
-- if (c->x86_vendor == X86_VENDOR_AMD)
-+ if (c->x86_vendor == X86_VENDOR_AMD ||
-+ c->x86_vendor == X86_VENDOR_HYGON)
- op = 0x8000001d;
- else
- op = 4;
-@@ -675,6 +680,22 @@ void cacheinfo_amd_init_llc_id(struct cp
+@@ -395,6 +395,22 @@ static void amd_l3_disable_index(struct
}
}
@@ -85,10 +83,31 @@ Link: https://lkml.kernel.org/r/2a686b2ac0e2f5a1f2f5f101124d9dd44f949731.1537533
+ per_cpu(cpu_llc_id, cpu) = c->apicid >> 3;
+}
+
- void init_amd_cacheinfo(struct cpuinfo_x86 *c)
- {
+ /*
+ * disable a L3 cache index by using a disable-slot
+ *
+@@ -599,6 +615,10 @@ cpuid4_cache_lookup_regs(int index, stru
+ else
+ amd_cpuid4(index, &eax, &ebx, &ecx);
+ amd_init_l3_cache(this_leaf, index);
++ } else if (boot_cpu_data.x86_vendor == X86_VENDOR_HYGON) {
++ cpuid_count(0x8000001d, index, &eax.full,
++ &ebx.full, &ecx.full, &edx);
++ amd_init_l3_cache(this_leaf, index);
+ } else {
+ cpuid_count(4, index, &eax.full, &ebx.full, &ecx.full, &edx);
+ }
+@@ -622,7 +642,8 @@ static int find_num_cache_leaves(struct
+ union _cpuid4_leaf_eax cache_eax;
+ int i = -1;
-@@ -688,6 +709,11 @@ void init_amd_cacheinfo(struct cpuinfo_x
+- if (c->x86_vendor == X86_VENDOR_AMD)
++ if (c->x86_vendor == X86_VENDOR_AMD ||
++ c->x86_vendor == X86_VENDOR_HYGON)
+ op = 0x8000001d;
+ else
+ op = 4;
+@@ -649,6 +670,11 @@ void init_amd_cacheinfo(struct cpuinfo_x
}
}
@@ -100,7 +119,7 @@ Link: https://lkml.kernel.org/r/2a686b2ac0e2f5a1f2f5f101124d9dd44f949731.1537533
unsigned int init_intel_cacheinfo(struct cpuinfo_x86 *c)
{
/* Cache sizes */
-@@ -910,7 +936,8 @@ static void __cache_cpumap_setup(unsigne
+@@ -871,7 +897,8 @@ static void __cache_cpumap_setup(unsigne
int index_msb, i;
struct cpuinfo_x86 *c = &cpu_data(cpu);
@@ -110,32 +129,3 @@ Link: https://lkml.kernel.org/r/2a686b2ac0e2f5a1f2f5f101124d9dd44f949731.1537533
if (__cache_amd_cpumap_setup(cpu, index, base))
return;
}
---- a/arch/x86/kernel/cpu/cpu.h
-+++ b/arch/x86/kernel/cpu/cpu.h
-@@ -27,6 +27,7 @@ struct cpu_dev {
- } legacy_models[5];
- #endif
- };
-+extern void init_hygon_cacheinfo(struct cpuinfo_x86 *c);
-
- struct _tlb_table {
- unsigned char descriptor;
---- a/arch/x86/kernel/cpu/hygon.c
-+++ b/arch/x86/kernel/cpu/hygon.c
-@@ -87,6 +87,7 @@ static void hygon_get_topology(struct cp
- if (!err)
- c->x86_coreid_bits = get_count_order(c->x86_max_cores);
-
-+ cacheinfo_hygon_init_llc_id(c, cpu, node_id);
- } else if (cpu_has(c, X86_FEATURE_NODEID_MSR)) {
- u64 value;
-
-@@ -321,6 +322,8 @@ static void init_hygon(struct cpuinfo_x8
- hygon_get_topology(c);
- srat_detect_node(c);
-
-+ init_hygon_cacheinfo(c);
-+
- if (cpu_has(c, X86_FEATURE_XMM2)) {
- unsigned long long val;
- int ret;
diff --git a/patches.drivers/0001-usb-typec-Group-all-TCPCI-TCPM-code-together.patch b/patches.drivers/0001-usb-typec-Group-all-TCPCI-TCPM-code-together.patch
index 80c1238935..260170b184 100644
--- a/patches.drivers/0001-usb-typec-Group-all-TCPCI-TCPM-code-together.patch
+++ b/patches.drivers/0001-usb-typec-Group-all-TCPCI-TCPM-code-together.patch
@@ -20,16 +20,16 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
drivers/usb/typec/tcpci.c | 605 ----
drivers/usb/typec/tcpci.h | 147 -
drivers/usb/typec/tcpci_rt1711h.c | 312 --
- drivers/usb/typec/tcpm.c | 4526 ---------------------------------
- drivers/usb/typec/tcpm/Kconfig | 52
- drivers/usb/typec/tcpm/Makefile | 7
+ drivers/usb/typec/tcpm.c | 4527 ---------------------------------
+ drivers/usb/typec/tcpm/Kconfig | 44
+ drivers/usb/typec/tcpm/Makefile | 6
drivers/usb/typec/tcpm/tcpci.c | 605 ++++
drivers/usb/typec/tcpm/tcpci.h | 147 +
drivers/usb/typec/tcpm/tcpci_rt1711h.c | 312 ++
- drivers/usb/typec/tcpm/tcpm.c | 4526 +++++++++++++++++++++++++++++++++
+ drivers/usb/typec/tcpm/tcpm.c | 4527 +++++++++++++++++++++++++++++++++
drivers/usb/typec/tcpm/wcove.c | 377 ++
drivers/usb/typec/typec_wcove.c | 377 --
- 14 files changed, 6033 insertions(+), 5969 deletions(-)
+ 14 files changed, 6025 insertions(+), 5970 deletions(-)
create mode 100644 drivers/usb/typec/tcpm/Kconfig
create mode 100644 drivers/usb/typec/tcpm/Makefile
rename drivers/usb/typec/{ => tcpm}/tcpci.c (100%)
@@ -40,7 +40,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
--- a/MAINTAINERS
+++ b/MAINTAINERS
-@@ -13544,6 +13544,12 @@ F: Documentation/driver-api/usb/typec_bu
+@@ -13617,6 +13617,12 @@ F: Documentation/driver-api/usb/typec_bu
F: drivers/usb/typec/altmodes/
F: include/linux/usb/typec_altmode.h
@@ -1139,7 +1139,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
-MODULE_LICENSE("GPL");
--- a/drivers/usb/typec/tcpm.c
+++ /dev/null
-@@ -1,4526 +0,0 @@
+@@ -1,4527 +0,0 @@
-/*
- * Copyright 2015-2017 Google, Inc
- *
@@ -3444,8 +3444,9 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
- unsigned int mv, ma, mw, flags;
- unsigned int max_ma, max_mw;
- enum pd_pdo_type type;
-- int src_pdo_index, snk_pdo_index;
- u32 pdo, matching_snk_pdo;
+- int src_pdo_index = 0;
+- int snk_pdo_index = 0;
- int ret;
-
- ret = tcpm_pd_select_pdo(port, &snk_pdo_index, &src_pdo_index);
@@ -6797,7 +6798,7 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
+MODULE_LICENSE("GPL");
--- /dev/null
+++ b/drivers/usb/typec/tcpm/tcpm.c
-@@ -0,0 +1,4526 @@
+@@ -0,0 +1,4527 @@
+/*
+ * Copyright 2015-2017 Google, Inc
+ *
@@ -9102,8 +9103,9 @@ Signed-off-by: Oliver Neukum <oneukum@suse.com>
+ unsigned int mv, ma, mw, flags;
+ unsigned int max_ma, max_mw;
+ enum pd_pdo_type type;
-+ int src_pdo_index, snk_pdo_index;
+ u32 pdo, matching_snk_pdo;
++ int src_pdo_index = 0;
++ int snk_pdo_index = 0;
+ int ret;
+
+ ret = tcpm_pd_select_pdo(port, &snk_pdo_index, &src_pdo_index);
diff --git a/patches.drivers/ACPI-PM-Allow-transitions-to-D0-to-occur-in-special-.patch b/patches.drivers/ACPI-PM-Allow-transitions-to-D0-to-occur-in-special-.patch
new file mode 100644
index 0000000000..7591216e6b
--- /dev/null
+++ b/patches.drivers/ACPI-PM-Allow-transitions-to-D0-to-occur-in-special-.patch
@@ -0,0 +1,146 @@
+From f850a48a07996bfd7bd1b2e52f57b5ee55125482 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 25 Jun 2019 14:06:13 +0200
+Subject: [PATCH] ACPI: PM: Allow transitions to D0 to occur in special cases
+Git-commit: f850a48a07996bfd7bd1b2e52f57b5ee55125482
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+If a device with ACPI PM is left in D0 during a system-wide
+transition to the S3 (suspend-to-RAM) or S4 (hibernation) sleep
+state, the actual state of the device need not be D0 during resume
+from it, although its power.state value will still reflect D0 (that
+is, the power state from before the system-wide transition).
+
+In that case, the acpi_device_set_power() call made to ensure that
+the power state of the device will be D0 going forward has no effect,
+because the new state (D0) is equal to the one reflected by the
+device's power.state value. That does not affect power resources,
+which are taken care of by acpi_resume_power_resources() called from
+acpi_pm_finish() during resume from system-wide sleep states, but it
+still may be necessary to invoke _PS0 for the device on top of that
+in order to finalize its transition to D0.
+
+For this reason, modify acpi_device_set_power() to allow transitions
+to D0 to occur even if D0 is the current power state of the device
+according to its power.state value.
+
+That will not affect power resources, which are assumed to be in
+the right configuration already (as reflected by the current values
+of their reference counters), but it may cause _PS0 to be evaluated
+for the device. However, evaluating _PS0 for a device already in D0
+may lead to confusion in general, so invoke _PSC (if present) to
+check the device's current power state upfront and only evaluate
+_PS0 for it if _PSC has returned a power state different from D0.
+[If _PSC is not present or the evaluation of it fails, the power
+state of the device is assumed to be D0 at this point.]
+
+Fixes: 20dacb71ad28 (ACPI / PM: Rework device power management to follow ACPI 6)
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/acpi/device_pm.c | 53 ++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 45 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index 3269a4e8b902..94194c7e8a07 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -53,6 +53,19 @@ const char *acpi_power_state_string(int state)
+ }
+ }
+
++static int acpi_dev_pm_explicit_get(struct acpi_device *device, int *state)
++{
++ unsigned long long psc;
++ acpi_status status;
++
++ status = acpi_evaluate_integer(device->handle, "_PSC", NULL, &psc);
++ if (ACPI_FAILURE(status))
++ return -ENODEV;
++
++ *state = psc;
++ return 0;
++}
++
+ /**
+ * acpi_device_get_power - Get power state of an ACPI device.
+ * @device: Device to get the power state of.
+@@ -65,6 +78,7 @@ const char *acpi_power_state_string(int state)
+ int acpi_device_get_power(struct acpi_device *device, int *state)
+ {
+ int result = ACPI_STATE_UNKNOWN;
++ int error;
+
+ if (!device || !state)
+ return -EINVAL;
+@@ -81,18 +95,16 @@ int acpi_device_get_power(struct acpi_device *device, int *state)
+ * if available.
+ */
+ if (device->power.flags.power_resources) {
+- int error = acpi_power_get_inferred_state(device, &result);
++ error = acpi_power_get_inferred_state(device, &result);
+ if (error)
+ return error;
+ }
+ if (device->power.flags.explicit_get) {
+- acpi_handle handle = device->handle;
+- unsigned long long psc;
+- acpi_status status;
++ int psc;
+
+- status = acpi_evaluate_integer(handle, "_PSC", NULL, &psc);
+- if (ACPI_FAILURE(status))
+- return -ENODEV;
++ error = acpi_dev_pm_explicit_get(device, &psc);
++ if (error)
++ return error;
+
+ /*
+ * The power resources settings may indicate a power state
+@@ -160,7 +172,8 @@ int acpi_device_set_power(struct acpi_device *device, int state)
+
+ /* Make sure this is a valid target state */
+
+- if (state == device->power.state) {
++ /* There is a special case for D0 addressed below. */
++ if (state > ACPI_STATE_D0 && state == device->power.state) {
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Device [%s] already in %s\n",
+ device->pnp.bus_id,
+ acpi_power_state_string(state)));
+@@ -228,6 +241,30 @@ int acpi_device_set_power(struct acpi_device *device, int state)
+ if (result)
+ goto end;
+ }
++
++ if (device->power.state == ACPI_STATE_D0) {
++ int psc;
++
++ /* Nothing to do here if _PSC is not present. */
++ if (!device->power.flags.explicit_get)
++ return 0;
++
++ /*
++ * The power state of the device was set to D0 last
++ * time, but that might have happened before a
++ * system-wide transition involving the platform
++ * firmware, so it may be necessary to evaluate _PS0
++ * for the device here. However, use extra care here
++ * and evaluate _PSC to check the device's current power
++ * state, and only invoke _PS0 if the evaluation of _PSC
++ * is successful and it returns a power state different
++ * from D0.
++ */
++ result = acpi_dev_pm_explicit_get(device, &psc);
++ if (result || psc == ACPI_STATE_D0)
++ return 0;
++ }
++
+ result = acpi_dev_pm_explicit_set(device, ACPI_STATE_D0);
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ACPI-PM-Avoid-evaluating-_PS3-on-transitions-from-D3.patch b/patches.drivers/ACPI-PM-Avoid-evaluating-_PS3-on-transitions-from-D3.patch
new file mode 100644
index 0000000000..3ae9bad71f
--- /dev/null
+++ b/patches.drivers/ACPI-PM-Avoid-evaluating-_PS3-on-transitions-from-D3.patch
@@ -0,0 +1,50 @@
+From 21ba237926227121dacccaf5d7863b0cb50f3eda Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Tue, 25 Jun 2019 14:04:45 +0200
+Subject: [PATCH] ACPI: PM: Avoid evaluating _PS3 on transitions from D3hot to D3cold
+Git-commit: 21ba237926227121dacccaf5d7863b0cb50f3eda
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+If the power state of a device with ACPI PM is changed from D3hot to
+D3cold, it merely is a matter of dropping references to additional
+power resources (specifically, those in the list returned by _PR3),
+and the _PS3 method should not be invoked for the device then (as
+it has already been evaluated during the previous transition to
+D3hot).
+
+Fixes: 20dacb71ad28 (ACPI / PM: Rework device power management to follow ACPI 6)
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/acpi/device_pm.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
+index b859d75eaf9f..3269a4e8b902 100644
+--- a/drivers/acpi/device_pm.c
++++ b/drivers/acpi/device_pm.c
+@@ -210,9 +210,15 @@ int acpi_device_set_power(struct acpi_device *device, int state)
+ return -ENODEV;
+ }
+
+- result = acpi_dev_pm_explicit_set(device, state);
+- if (result)
+- goto end;
++ /*
++ * If the device goes from D3hot to D3cold, _PS3 has been
++ * evaluated for it already, so skip it in that case.
++ */
++ if (device->power.state < ACPI_STATE_D3_HOT) {
++ result = acpi_dev_pm_explicit_set(device, state);
++ if (result)
++ goto end;
++ }
+
+ if (device->power.flags.power_resources)
+ result = acpi_power_transition(device, target_state);
+--
+2.16.4
+
diff --git a/patches.drivers/ACPICA-Clear-status-of-GPEs-on-first-direct-enable.patch b/patches.drivers/ACPICA-Clear-status-of-GPEs-on-first-direct-enable.patch
new file mode 100644
index 0000000000..dc62bf30f6
--- /dev/null
+++ b/patches.drivers/ACPICA-Clear-status-of-GPEs-on-first-direct-enable.patch
@@ -0,0 +1,135 @@
+From 44758bafa53602f2581a6857bb20b55d4d8ad5b2 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Mon, 17 Jun 2019 13:31:45 +0200
+Subject: [PATCH] ACPICA: Clear status of GPEs on first direct enable
+Git-commit: 44758bafa53602f2581a6857bb20b55d4d8ad5b2
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+ACPI GPEs (other than the EC one) can be enabled in two situations.
+First, the GPEs with existing _Lxx and _Exx methods are enabled
+implicitly by ACPICA during system initialization. Second, the
+GPEs without these methods (like GPEs listed by _PRW objects for
+wakeup devices) need to be enabled directly by the code that is
+going to use them (e.g. ACPI power management or device drivers).
+
+In the former case, if the status of a given GPE is set to start
+with, its handler method (either _Lxx or _Exx) needs to be invoked
+to take care of the events (possibly) signaled before the GPE was
+enabled. In the latter case, however, the first caller of
+acpi_enable_gpe() for a given GPE should not be expected to care
+about any events that might be signaled through it earlier. In
+that case, it is better to clear the status of the GPE before
+enabling it, to prevent stale events from triggering unwanted
+actions (like spurious system resume, for example).
+
+For this reason, modify acpi_ev_add_gpe_reference() to take an
+additional boolean argument indicating whether or not the GPE
+status needs to be cleared when its reference counter changes from
+zero to one and make acpi_enable_gpe() pass TRUE to it through
+that new argument.
+
+Fixes: 18996f2db918 ("ACPICA: Events: Stop unconditionally clearing ACPI IRQs during suspend/resume")
+Reported-by: Furquan Shaikh <furquan@google.com>
+Tested-by: Furquan Shaikh <furquan@google.com>
+Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/acpi/acpica/acevents.h | 3 ++-
+ drivers/acpi/acpica/evgpe.c | 8 +++++++-
+ drivers/acpi/acpica/evgpeblk.c | 2 +-
+ drivers/acpi/acpica/evxface.c | 2 +-
+ drivers/acpi/acpica/evxfgpe.c | 2 +-
+ 5 files changed, 12 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h
+index 831660179662..c8652f91054e 100644
+--- a/drivers/acpi/acpica/acevents.h
++++ b/drivers/acpi/acpica/acevents.h
+@@ -69,7 +69,8 @@ acpi_status
+ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked);
+
+ acpi_status
+-acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info);
++acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info,
++ u8 clear_on_enable);
+
+ acpi_status
+ acpi_ev_remove_gpe_reference(struct acpi_gpe_event_info *gpe_event_info);
+diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
+index 62d3aa74277b..344feba29063 100644
+--- a/drivers/acpi/acpica/evgpe.c
++++ b/drivers/acpi/acpica/evgpe.c
+@@ -146,6 +146,7 @@ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked)
+ * FUNCTION: acpi_ev_add_gpe_reference
+ *
+ * PARAMETERS: gpe_event_info - Add a reference to this GPE
++ * clear_on_enable - Clear GPE status before enabling it
+ *
+ * RETURN: Status
+ *
+@@ -155,7 +156,8 @@ acpi_ev_mask_gpe(struct acpi_gpe_event_info *gpe_event_info, u8 is_masked)
+ ******************************************************************************/
+
+ acpi_status
+-acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
++acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info,
++ u8 clear_on_enable)
+ {
+ acpi_status status = AE_OK;
+
+@@ -170,6 +172,10 @@ acpi_ev_add_gpe_reference(struct acpi_gpe_event_info *gpe_event_info)
+
+ /* Enable on first reference */
+
++ if (clear_on_enable) {
++ (void)acpi_hw_clear_gpe(gpe_event_info);
++ }
++
+ status = acpi_ev_update_gpe_enable_mask(gpe_event_info);
+ if (ACPI_SUCCESS(status)) {
+ status = acpi_ev_enable_gpe(gpe_event_info);
+diff --git a/drivers/acpi/acpica/evgpeblk.c b/drivers/acpi/acpica/evgpeblk.c
+index 328d1d6123ad..fb15e9e2373b 100644
+--- a/drivers/acpi/acpica/evgpeblk.c
++++ b/drivers/acpi/acpica/evgpeblk.c
+@@ -453,7 +453,7 @@ acpi_ev_initialize_gpe_block(struct acpi_gpe_xrupt_info *gpe_xrupt_info,
+ continue;
+ }
+
+- status = acpi_ev_add_gpe_reference(gpe_event_info);
++ status = acpi_ev_add_gpe_reference(gpe_event_info, FALSE);
+ if (ACPI_FAILURE(status)) {
+ ACPI_EXCEPTION((AE_INFO, status,
+ "Could not enable GPE 0x%02X",
+diff --git a/drivers/acpi/acpica/evxface.c b/drivers/acpi/acpica/evxface.c
+index 3df00eb6621b..279ef0557aa3 100644
+--- a/drivers/acpi/acpica/evxface.c
++++ b/drivers/acpi/acpica/evxface.c
+@@ -971,7 +971,7 @@ acpi_remove_gpe_handler(acpi_handle gpe_device,
+ ACPI_GPE_DISPATCH_METHOD) ||
+ (ACPI_GPE_DISPATCH_TYPE(handler->original_flags) ==
+ ACPI_GPE_DISPATCH_NOTIFY)) && handler->originally_enabled) {
+- (void)acpi_ev_add_gpe_reference(gpe_event_info);
++ (void)acpi_ev_add_gpe_reference(gpe_event_info, FALSE);
+ if (ACPI_GPE_IS_POLLING_NEEDED(gpe_event_info)) {
+
+ /* Poll edge triggered GPEs to handle existing events */
+diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
+index 30a083902f52..710488ec59e9 100644
+--- a/drivers/acpi/acpica/evxfgpe.c
++++ b/drivers/acpi/acpica/evxfgpe.c
+@@ -108,7 +108,7 @@ acpi_status acpi_enable_gpe(acpi_handle gpe_device, u32 gpe_number)
+ if (gpe_event_info) {
+ if (ACPI_GPE_DISPATCH_TYPE(gpe_event_info->flags) !=
+ ACPI_GPE_DISPATCH_NONE) {
+- status = acpi_ev_add_gpe_reference(gpe_event_info);
++ status = acpi_ev_add_gpe_reference(gpe_event_info, TRUE);
+ if (ACPI_SUCCESS(status) &&
+ ACPI_GPE_IS_POLLING_NEEDED(gpe_event_info)) {
+
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-firewire-lib-fireworks-fix-miss-detection-of-re.patch b/patches.drivers/ALSA-firewire-lib-fireworks-fix-miss-detection-of-re.patch
new file mode 100644
index 0000000000..271333c385
--- /dev/null
+++ b/patches.drivers/ALSA-firewire-lib-fireworks-fix-miss-detection-of-re.patch
@@ -0,0 +1,57 @@
+From 7fbd1753b64eafe21cf842348a40a691d0dee440 Mon Sep 17 00:00:00 2001
+From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Date: Mon, 1 Jul 2019 23:43:53 +0900
+Subject: [PATCH 5/7] ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages
+Git-commit: 7fbd1753b64eafe21cf842348a40a691d0dee440
+Patch-mainline: v5.2
+References: bsc#1051510
+
+In IEC 61883-6, 8 MIDI data streams are multiplexed into single
+MIDI conformant data channel. The index of stream is calculated by
+modulo 8 of the value of data block counter.
+
+In fireworks, the value of data block counter in CIP header has a quirk
+with firmware version v5.0.0, v5.7.3 and v5.8.0. This brings ALSA
+IEC 61883-1/6 packet streaming engine to miss detection of MIDI
+messages.
+
+This commit fixes the miss detection to modify the value of data block
+counter for the modulo calculation.
+
+For maintainers, this bug exists since a commit 18f5ed365d3f ("ALSA:
+Fireworks/firewire-lib: add support for recent firmware quirk") in Linux
+kernel v4.2. There're many changes since the commit. This fix can be
+backported to Linux kernel v4.4 or later. I tagged a base commit to the
+backport for your convenience.
+
+Besides, my work for Linux kernel v5.3 brings heavy code refactoring and
+some structure members are renamed in 'sound/firewire/amdtp-stream.h'.
+The content of this patch brings conflict when merging -rc tree with
+this patch and the latest tree. I request maintainers to solve the
+conflict to replace 'tx_first_dbc' with 'ctx_data.tx.first_dbc'.
+
+Fixes: df075feefbd3 ("ALSA: firewire-lib: complete AM824 data block processing layer")
+Cc: <stable@vger.kernel.org> # v4.4+
+Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/firewire/amdtp-am824.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/firewire/amdtp-am824.c b/sound/firewire/amdtp-am824.c
+index 4210e5c6262e..d09da9dbf235 100644
+--- a/sound/firewire/amdtp-am824.c
++++ b/sound/firewire/amdtp-am824.c
+@@ -321,7 +321,7 @@ static void read_midi_messages(struct amdtp_stream *s,
+ u8 *b;
+
+ for (f = 0; f < frames; f++) {
+- port = (s->data_block_counter + f) % 8;
++ port = (8 - s->tx_first_dbc + s->data_block_counter + f) % 8;
+ b = (u8 *)&buffer[p->midi_position];
+
+ len = b[0] - 0x80;
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-Force-polling-mode-on-CNL-for-fixing-codec-.patch b/patches.drivers/ALSA-hda-Force-polling-mode-on-CNL-for-fixing-codec-.patch
new file mode 100644
index 0000000000..8d2c71e68e
--- /dev/null
+++ b/patches.drivers/ALSA-hda-Force-polling-mode-on-CNL-for-fixing-codec-.patch
@@ -0,0 +1,45 @@
+From fa763f1b2858752e6150ffff46886a1b7faffc82 Mon Sep 17 00:00:00 2001
+From: Bard Liao <yung-chuan.liao@linux.intel.com>
+Date: Mon, 27 May 2019 00:58:32 +0800
+Subject: [PATCH] ALSA: hda - Force polling mode on CNL for fixing codec communication
+Git-commit: fa763f1b2858752e6150ffff46886a1b7faffc82
+Patch-mainline: v5.2-rc3
+References: bsc#1051510
+
+We observed the same issue as reported by commit a8d7bde23e7130686b7662
+("alsa: hda - Force polling mode on CFL for fixing codec communication")
+We don't have a better solution. So apply the same workaround to CNL.
+
+Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/hda_intel.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 0741eae23f10..a4b0414dda3b 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -375,6 +375,7 @@ enum {
+
+ #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
+ #define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348)
++#define IS_CNL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9dc8)
+
+ static char *driver_short_names[] = {
+ [AZX_DRIVER_ICH] = "HDA Intel",
+@@ -1700,8 +1701,8 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
+ else
+ chip->bdl_pos_adj = bdl_pos_adj[dev];
+
+- /* Workaround for a communication error on CFL (bko#199007) */
+- if (IS_CFL(pci))
++ /* Workaround for a communication error on CFL (bko#199007) and CNL */
++ if (IS_CFL(pci) || IS_CNL(pci))
+ chip->polling_mode = 1;
+
+ err = azx_bus_init(chip, model[dev], &pci_hda_io_ops);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Add-quirks-for-several-Clevo-notebo.patch b/patches.drivers/ALSA-hda-realtek-Add-quirks-for-several-Clevo-notebo.patch
new file mode 100644
index 0000000000..4d50162a19
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Add-quirks-for-several-Clevo-notebo.patch
@@ -0,0 +1,49 @@
+From 503d90b30602a3295978e46d844ccc8167400fe6 Mon Sep 17 00:00:00 2001
+From: Richard Sailer <rs@tuxedocomputers.com>
+Date: Wed, 19 Jun 2019 13:33:11 +0200
+Subject: [PATCH 1/7] ALSA: hda/realtek: Add quirks for several Clevo notebook barebones
+Git-commit: 503d90b30602a3295978e46d844ccc8167400fe6
+Patch-mainline: v5.2
+References: bsc#1051510
+
+This adds 4 SND_PCI_QUIRK(...) lines for several barebone models of the ODM
+Clevo. The model names are written in regex syntax to describe/match all clevo
+models that are similar enough and use the same PCI SSID that this fixup works
+for them.
+
+Additionally the lines regarding SSID 0x96e1 and 0x97e1 didn't fix audio for the
+all our Clevo notebooks using these SSIDs (models Clevo P960* and P970*) since
+ALC1220_FIXP_CLEVO_PB51ED_PINS swapped pins that are not necesarry to be
+swapped. This patch initiates ALC1220_FIXUP_CLEVO_P950 instead for these model
+and fixes the audio.
+
+Fixes: 80690a276f44 ("ALSA: hda/realtek - Add quirk for Tuxedo XC 1509")
+Signed-off-by: Richard Sailer <rs@tuxedocomputers.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 179e4be1f747..35f01f5102da 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2461,9 +2461,10 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+- SND_PCI_QUIRK(0x1558, 0x96e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x97e1, "System76 Oryx Pro (oryp5)", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+- SND_PCI_QUIRK(0x1558, 0x65d1, "Tuxedo Book XC1509", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
++ SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
++ SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+ SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", ALC882_FIXUP_LENOVO_Y530),
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-hda-realtek-Change-front-mic-location-for-Lenov.patch b/patches.drivers/ALSA-hda-realtek-Change-front-mic-location-for-Lenov.patch
new file mode 100644
index 0000000000..d9e56de2c1
--- /dev/null
+++ b/patches.drivers/ALSA-hda-realtek-Change-front-mic-location-for-Lenov.patch
@@ -0,0 +1,34 @@
+From bef33e19203dde434bcdf21c449e3fb4f06c2618 Mon Sep 17 00:00:00 2001
+From: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Date: Fri, 28 Jun 2019 10:54:53 +0200
+Subject: [PATCH 3/7] ALSA: hda/realtek - Change front mic location for Lenovo M710q
+Git-commit: bef33e19203dde434bcdf21c449e3fb4f06c2618
+Patch-mainline: v5.2
+References: bsc#1051510
+
+On M710q Lenovo ThinkCentre machine, there are two front mics,
+we change the location for one of them to avoid conflicts.
+
+Signed-off-by: Dennis Wassenberg <dennis.wassenberg@secunet.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 35f01f5102da..48f3c5b8d6e9 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7088,6 +7088,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
++ SND_PCI_QUIRK(0x17aa, 0x3111, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+ SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-line6-Fix-write-on-zero-sized-buffer.patch b/patches.drivers/ALSA-line6-Fix-write-on-zero-sized-buffer.patch
new file mode 100644
index 0000000000..63ae7ade56
--- /dev/null
+++ b/patches.drivers/ALSA-line6-Fix-write-on-zero-sized-buffer.patch
@@ -0,0 +1,44 @@
+From 3450121997ce872eb7f1248417225827ea249710 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 2 Jul 2019 20:07:21 +0200
+Subject: [PATCH 7/7] ALSA: line6: Fix write on zero-sized buffer
+Git-commit: 3450121997ce872eb7f1248417225827ea249710
+Patch-mainline: v5.2
+References: bsc#1051510
+
+LINE6 drivers allocate the buffers based on the value returned from
+usb_maxpacket() calls. The manipulated device may return zero for
+this, and this results in the kmalloc() with zero size (and it may
+succeed) while the other part of the driver code writes the packet
+data with the fixed size -- which eventually overwrites.
+
+This patch adds a simple sanity check for the invalid buffer size for
+avoiding that problem.
+
+Reported-by: syzbot+219f00fb49874dcaea17@syzkaller.appspotmail.com
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/line6/pcm.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
+index 72c6f8e82a7e..78c2d6cab3b5 100644
+--- a/sound/usb/line6/pcm.c
++++ b/sound/usb/line6/pcm.c
+@@ -560,6 +560,11 @@ int line6_init_pcm(struct usb_line6 *line6,
+ line6pcm->max_packet_size_out =
+ usb_maxpacket(line6->usbdev,
+ usb_sndisocpipe(line6->usbdev, ep_write), 1);
++ if (!line6pcm->max_packet_size_in || !line6pcm->max_packet_size_out) {
++ dev_err(line6pcm->line6->ifcdev,
++ "cannot get proper max packet size\n");
++ return -EINVAL;
++ }
+
+ spin_lock_init(&line6pcm->out.lock);
+ spin_lock_init(&line6pcm->in.lock);
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-seq-fix-incorrect-order-of-dest_client-dest_por.patch b/patches.drivers/ALSA-seq-fix-incorrect-order-of-dest_client-dest_por.patch
new file mode 100644
index 0000000000..2f91a32253
--- /dev/null
+++ b/patches.drivers/ALSA-seq-fix-incorrect-order-of-dest_client-dest_por.patch
@@ -0,0 +1,51 @@
+From c3ea60c231446663afd6ea1054da6b7f830855ca Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 28 Jun 2019 10:54:29 +0100
+Subject: [PATCH 4/7] ALSA: seq: fix incorrect order of dest_client/dest_ports arguments
+Git-commit: c3ea60c231446663afd6ea1054da6b7f830855ca
+Patch-mainline: v5.2
+References: bsc#1051510
+
+There are two occurrances of a call to snd_seq_oss_fill_addr where
+the dest_client and dest_port arguments are in the wrong order. Fix
+this by swapping them around.
+
+Addresses-coverity: ("Arguments in wrong order")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/core/seq/oss/seq_oss_ioctl.c | 2 +-
+ sound/core/seq/oss/seq_oss_rw.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/core/seq/oss/seq_oss_ioctl.c b/sound/core/seq/oss/seq_oss_ioctl.c
+index 5b8520177b0e..7d72e3d48ad5 100644
+--- a/sound/core/seq/oss/seq_oss_ioctl.c
++++ b/sound/core/seq/oss/seq_oss_ioctl.c
+@@ -62,7 +62,7 @@ static int snd_seq_oss_oob_user(struct seq_oss_devinfo *dp, void __user *arg)
+ if (copy_from_user(ev, arg, 8))
+ return -EFAULT;
+ memset(&tmpev, 0, sizeof(tmpev));
+- snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.port, dp->addr.client);
++ snd_seq_oss_fill_addr(dp, &tmpev, dp->addr.client, dp->addr.port);
+ tmpev.time.tick = 0;
+ if (! snd_seq_oss_process_event(dp, (union evrec *)ev, &tmpev)) {
+ snd_seq_oss_dispatch(dp, &tmpev, 0, 0);
+diff --git a/sound/core/seq/oss/seq_oss_rw.c b/sound/core/seq/oss/seq_oss_rw.c
+index eb1ef12181f3..1063e1b16ea0 100644
+--- a/sound/core/seq/oss/seq_oss_rw.c
++++ b/sound/core/seq/oss/seq_oss_rw.c
+@@ -174,7 +174,7 @@ insert_queue(struct seq_oss_devinfo *dp, union evrec *rec, struct file *opt)
+ memset(&event, 0, sizeof(event));
+ /* set dummy -- to be sure */
+ event.type = SNDRV_SEQ_EVENT_NOTEOFF;
+- snd_seq_oss_fill_addr(dp, &event, dp->addr.port, dp->addr.client);
++ snd_seq_oss_fill_addr(dp, &event, dp->addr.client, dp->addr.port);
+
+ if (snd_seq_oss_process_event(dp, rec, &event))
+ return 0; /* invalid event - no need to insert queue */
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-Fix-parse-of-UAC2-Extension-Units.patch b/patches.drivers/ALSA-usb-audio-Fix-parse-of-UAC2-Extension-Units.patch
new file mode 100644
index 0000000000..fa7669ef7c
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-Fix-parse-of-UAC2-Extension-Units.patch
@@ -0,0 +1,138 @@
+From ca95c7bf3d29716916baccdc77c3c2284b703069 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 4 Jul 2019 16:31:12 +0200
+Subject: [PATCH] ALSA: usb-audio: Fix parse of UAC2 Extension Units
+Git-commit: ca95c7bf3d29716916baccdc77c3c2284b703069
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+Extension Unit (XU) is used to have a compatible layout with
+Processing Unit (PU) on UAC1, and the usb-audio driver code assumed it
+for parsing the descriptors. Meanwhile, on UAC2, XU became slightly
+incompatible with PU; namely, XU has a one-byte bmControls bitmap
+while PU has two bytes bmControls bitmap. This incompatibility
+results in the read of a wrong address for the last iExtension field,
+which ended up with an incorrect string for the mixer element name, as
+recently reported for Focusrite Scarlett 18i20 device.
+
+This patch corrects this misalignment by introducing a couple of new
+macros and calling them depending on the descriptor type.
+
+Fixes: 23caaf19b11e ("ALSA: usb-mixer: Add support for Audio Class v2.0")
+Reported-by: Stefan Sauer <ensonic@hora-obscura.de>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ include/uapi/linux/usb/audio.h | 37 +++++++++++++++++++++++++++++++++++++
+ sound/usb/mixer.c | 16 ++++++++++------
+ 2 files changed, 47 insertions(+), 6 deletions(-)
+
+diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h
+index ddc5396800aa..76b7c3f6cd0d 100644
+--- a/include/uapi/linux/usb/audio.h
++++ b/include/uapi/linux/usb/audio.h
+@@ -450,6 +450,43 @@ static inline __u8 *uac_processing_unit_specific(struct uac_processing_unit_desc
+ }
+ }
+
++/*
++ * Extension Unit (XU) has almost compatible layout with Processing Unit, but
++ * on UAC2, it has a different bmControls size (bControlSize); it's 1 byte for
++ * XU while 2 bytes for PU. The last iExtension field is a one-byte index as
++ * well as iProcessing field of PU.
++ */
++static inline __u8 uac_extension_unit_bControlSize(struct uac_processing_unit_descriptor *desc,
++ int protocol)
++{
++ switch (protocol) {
++ case UAC_VERSION_1:
++ return desc->baSourceID[desc->bNrInPins + 4];
++ case UAC_VERSION_2:
++ return 1; /* in UAC2, this value is constant */
++ case UAC_VERSION_3:
++ return 4; /* in UAC3, this value is constant */
++ default:
++ return 1;
++ }
++}
++
++static inline __u8 uac_extension_unit_iExtension(struct uac_processing_unit_descriptor *desc,
++ int protocol)
++{
++ __u8 control_size = uac_extension_unit_bControlSize(desc, protocol);
++
++ switch (protocol) {
++ case UAC_VERSION_1:
++ case UAC_VERSION_2:
++ default:
++ return *(uac_processing_unit_bmControls(desc, protocol)
++ + control_size);
++ case UAC_VERSION_3:
++ return 0; /* UAC3 does not have this field */
++ }
++}
++
+ /* 4.5.2 Class-Specific AS Interface Descriptor */
+ struct uac1_as_header_descriptor {
+ __u8 bLength; /* in bytes: 7 */
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index e003b5e7b01a..ac121b10c51c 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -2318,7 +2318,7 @@ static struct procunit_info extunits[] = {
+ */
+ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ void *raw_desc, struct procunit_info *list,
+- char *name)
++ bool extension_unit)
+ {
+ struct uac_processing_unit_descriptor *desc = raw_desc;
+ int num_ins;
+@@ -2335,6 +2335,8 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ static struct procunit_info default_info = {
+ 0, NULL, default_value_info
+ };
++ const char *name = extension_unit ?
++ "Extension Unit" : "Processing Unit";
+
+ if (desc->bLength < 13) {
+ usb_audio_err(state->chip, "invalid %s descriptor (id %d)\n", name, unitid);
+@@ -2448,7 +2450,10 @@ static int build_audio_procunit(struct mixer_build *state, int unitid,
+ } else if (info->name) {
+ strlcpy(kctl->id.name, info->name, sizeof(kctl->id.name));
+ } else {
+- nameid = uac_processing_unit_iProcessing(desc, state->mixer->protocol);
++ if (extension_unit)
++ nameid = uac_extension_unit_iExtension(desc, state->mixer->protocol);
++ else
++ nameid = uac_processing_unit_iProcessing(desc, state->mixer->protocol);
+ len = 0;
+ if (nameid)
+ len = snd_usb_copy_string_desc(state->chip,
+@@ -2481,10 +2486,10 @@ static int parse_audio_processing_unit(struct mixer_build *state, int unitid,
+ case UAC_VERSION_2:
+ default:
+ return build_audio_procunit(state, unitid, raw_desc,
+- procunits, "Processing Unit");
++ procunits, false);
+ case UAC_VERSION_3:
+ return build_audio_procunit(state, unitid, raw_desc,
+- uac3_procunits, "Processing Unit");
++ uac3_procunits, false);
+ }
+ }
+
+@@ -2495,8 +2500,7 @@ static int parse_audio_extension_unit(struct mixer_build *state, int unitid,
+ * Note that we parse extension units with processing unit descriptors.
+ * That's ok as the layout is the same.
+ */
+- return build_audio_procunit(state, unitid, raw_desc,
+- extunits, "Extension Unit");
++ return build_audio_procunit(state, unitid, raw_desc, extunits, true);
+ }
+
+ /*
+--
+2.16.4
+
diff --git a/patches.drivers/ALSA-usb-audio-fix-sign-unintended-sign-extension-on.patch b/patches.drivers/ALSA-usb-audio-fix-sign-unintended-sign-extension-on.patch
new file mode 100644
index 0000000000..76c6745471
--- /dev/null
+++ b/patches.drivers/ALSA-usb-audio-fix-sign-unintended-sign-extension-on.patch
@@ -0,0 +1,48 @@
+From 2acf5a3e6e9371e63c9e4ff54d84d08f630467a0 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Thu, 27 Jun 2019 17:43:08 +0100
+Subject: [PATCH 2/7] ALSA: usb-audio: fix sign unintended sign extension on left shifts
+Git-commit: 2acf5a3e6e9371e63c9e4ff54d84d08f630467a0
+Patch-mainline: v5.2
+References: bsc#1051510
+
+There are a couple of left shifts of unsigned 8 bit values that
+first get promoted to signed ints and hence get sign extended
+on the shift if the top bit of the 8 bit values are set. Fix
+this by casting the 8 bit values to unsigned ints to stop the
+unintentional sign extension.
+
+Addresses-coverity: ("Unintended sign extension")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/usb/mixer_quirks.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index a751a18ca4c2..5783329a3237 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -754,7 +754,7 @@ static int snd_ni_control_init_val(struct usb_mixer_interface *mixer,
+ return err;
+ }
+
+- kctl->private_value |= (value << 24);
++ kctl->private_value |= ((unsigned int)value << 24);
+ return 0;
+ }
+
+@@ -915,7 +915,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer,
+ if (err < 0)
+ return err;
+
+- kctl->private_value |= value[0] << 24;
++ kctl->private_value |= (unsigned int)value[0] << 24;
+ return 0;
+ }
+
+--
+2.16.4
+
diff --git a/patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072 b/patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072
index 2ca1565c25..f68d63c78d 100644
--- a/patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072
+++ b/patches.drivers/ASoC-Intel-Add-machine-driver-for-Cherrytrail-CX2072
@@ -4,8 +4,7 @@ Date: Tue, 21 May 2019 08:26:53 +0200
Subject: [PATCH] ASoC: Intel: Add machine driver for CX2072X on BYT/CHT
platforms
Git-commit: 3917da94f787e6c907e440653ead0c666a71379e
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.3-rc1
References: bsc#1068546
This is an implementation of a machine driver needed for Conexant
diff --git a/patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC b/patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
index 84a7521746..9901b44f89 100644
--- a/patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
+++ b/patches.drivers/ASoC-add-support-for-Conexant-CX2072X-CODEC
@@ -3,8 +3,7 @@ From: Simon Ho <simon.ho@conexant.com>
Date: Tue, 21 May 2019 08:26:52 +0200
Subject: [PATCH] ASoC: Add support for Conexant CX2072X CODEC
Git-commit: a497a4363706b3eb208c64e66e5b485bb3b186ac
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
-Patch-mainline: Queued in subsystem maintainer repository
+Patch-mainline: v5.3-rc1
References: bsc#1068546
Initial commit of the Conexant CX2072X CODEC driver. Some features are
diff --git a/patches.drivers/ASoC-cx2072x-fix-integer-overflow-on-unsigned-int-mu.patch b/patches.drivers/ASoC-cx2072x-fix-integer-overflow-on-unsigned-int-mu.patch
new file mode 100644
index 0000000000..b8ebd2832a
--- /dev/null
+++ b/patches.drivers/ASoC-cx2072x-fix-integer-overflow-on-unsigned-int-mu.patch
@@ -0,0 +1,41 @@
+From be0461048b60066eaba9046178fb96e78579af21 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 24 May 2019 23:25:51 +0100
+Subject: [PATCH] ASoC: cx2072x: fix integer overflow on unsigned int multiply
+Git-commit: be0461048b60066eaba9046178fb96e78579af21
+Patch-mainline: v5.3-rc1
+References: bsc#1111666
+
+In the case where frac_div larger than 96 the result of an unsigned
+multiplication overflows an unsigned int. For example, this can
+happen when the sample_rate is 192000 and pll_input is 122. Fix
+this by casing the first term of the mutiply to a u64. Also remove
+the extraneous parentheses around the expression.
+
+Addresses-coverity: ("Unintentional integer overflow")
+Fixes: a497a4363706 ("ASoC: Add support for Conexant CX2072X CODEC")
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ sound/soc/codecs/cx2072x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/cx2072x.c b/sound/soc/codecs/cx2072x.c
+index c11a585bbf70..ed762546eaee 100644
+--- a/sound/soc/codecs/cx2072x.c
++++ b/sound/soc/codecs/cx2072x.c
+@@ -627,7 +627,7 @@ static int cx2072x_config_pll(struct cx2072x_priv *cx2072x)
+ if (frac_div) {
+ frac_div *= 1000;
+ frac_div /= pll_input;
+- frac_num = ((4000 + frac_div) * ((1 << 20) - 4));
++ frac_num = (u64)(4000 + frac_div) * ((1 << 20) - 4);
+ do_div(frac_num, 7);
+ frac = ((u32)frac_num + 499) / 1000;
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/Bluetooth-Fix-regression-with-minimum-encryption-key.patch b/patches.drivers/Bluetooth-Fix-regression-with-minimum-encryption-key.patch
new file mode 100644
index 0000000000..873a22aab4
--- /dev/null
+++ b/patches.drivers/Bluetooth-Fix-regression-with-minimum-encryption-key.patch
@@ -0,0 +1,154 @@
+From 693cd8ce3f882524a5d06f7800dd8492411877b3 Mon Sep 17 00:00:00 2001
+From: Marcel Holtmann <marcel@holtmann.org>
+Date: Sat, 22 Jun 2019 15:47:01 +0200
+Subject: [PATCH] Bluetooth: Fix regression with minimum encryption key size alignment
+Git-commit: 693cd8ce3f882524a5d06f7800dd8492411877b3
+Patch-mainline: v5.2-rc6
+References: bsc#1135556
+
+When trying to align the minimum encryption key size requirement for
+Bluetooth connections, it turns out doing this in a central location in
+the HCI connection handling code is not possible.
+
+Original Bluetooth version up to 2.0 used a security model where the
+L2CAP service would enforce authentication and encryption. Starting
+with Bluetooth 2.1 and Secure Simple Pairing that model has changed into
+that the connection initiator is responsible for providing an encrypted
+ACL link before any L2CAP communication can happen.
+
+Now connecting Bluetooth 2.1 or later devices with Bluetooth 2.0 and
+before devices are causing a regression. The encryption key size check
+needs to be moved out of the HCI connection handling into the L2CAP
+channel setup.
+
+To achieve this, the current check inside hci_conn_security() has been
+moved into l2cap_check_enc_key_size() helper function and then called
+from four decisions point inside L2CAP to cover all combinations of
+Secure Simple Pairing enabled devices and device using legacy pairing
+and legacy service security model.
+
+Fixes: d5bb334a8e17 ("Bluetooth: Align minimum encryption key size for LE and BR/EDR connections")
+Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203643
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ net/bluetooth/hci_conn.c | 18 +++++++++---------
+ net/bluetooth/l2cap_core.c | 33 ++++++++++++++++++++++++++++-----
+ 2 files changed, 37 insertions(+), 14 deletions(-)
+
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 3cf0764d5793..15d1cb5aee18 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -1276,14 +1276,6 @@ int hci_conn_check_link_mode(struct hci_conn *conn)
+ !test_bit(HCI_CONN_ENCRYPT, &conn->flags))
+ return 0;
+
+- /* The minimum encryption key size needs to be enforced by the
+- * host stack before establishing any L2CAP connections. The
+- * specification in theory allows a minimum of 1, but to align
+- * BR/EDR and LE transports, a minimum of 7 is chosen.
+- */
+- if (conn->enc_key_size < HCI_MIN_ENC_KEY_SIZE)
+- return 0;
+-
+ return 1;
+ }
+
+@@ -1400,8 +1392,16 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
+ return 0;
+
+ encrypt:
+- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
++ if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) {
++ /* Ensure that the encryption key size has been read,
++ * otherwise stall the upper layer responses.
++ */
++ if (!conn->enc_key_size)
++ return 0;
++
++ /* Nothing else needed, all requirements are met */
+ return 1;
++ }
+
+ hci_conn_encrypt(conn);
+ return 0;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index b53acd6c9a3d..9f77432dbe38 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -1341,6 +1341,21 @@ static void l2cap_request_info(struct l2cap_conn *conn)
+ sizeof(req), &req);
+ }
+
++static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
++{
++ /* The minimum encryption key size needs to be enforced by the
++ * host stack before establishing any L2CAP connections. The
++ * specification in theory allows a minimum of 1, but to align
++ * BR/EDR and LE transports, a minimum of 7 is chosen.
++ *
++ * This check might also be called for unencrypted connections
++ * that have no key size requirements. Ensure that the link is
++ * actually encrypted before enforcing a key size.
++ */
++ return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
++ hcon->enc_key_size > HCI_MIN_ENC_KEY_SIZE);
++}
++
+ static void l2cap_do_start(struct l2cap_chan *chan)
+ {
+ struct l2cap_conn *conn = chan->conn;
+@@ -1358,9 +1373,14 @@ static void l2cap_do_start(struct l2cap_chan *chan)
+ if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
+ return;
+
+- if (l2cap_chan_check_security(chan, true) &&
+- __l2cap_no_conn_pending(chan))
++ if (!l2cap_chan_check_security(chan, true) ||
++ !__l2cap_no_conn_pending(chan))
++ return;
++
++ if (l2cap_check_enc_key_size(conn->hcon))
+ l2cap_start_connection(chan);
++ else
++ __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+ }
+
+ static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
+@@ -1439,7 +1459,10 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
+ continue;
+ }
+
+- l2cap_start_connection(chan);
++ if (l2cap_check_enc_key_size(conn->hcon))
++ l2cap_start_connection(chan);
++ else
++ l2cap_chan_close(chan, ECONNREFUSED);
+
+ } else if (chan->state == BT_CONNECT2) {
+ struct l2cap_conn_rsp rsp;
+@@ -7490,7 +7513,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
+ }
+
+ if (chan->state == BT_CONNECT) {
+- if (!status)
++ if (!status && l2cap_check_enc_key_size(hcon))
+ l2cap_start_connection(chan);
+ else
+ __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
+@@ -7499,7 +7522,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
+ struct l2cap_conn_rsp rsp;
+ __u16 res, stat;
+
+- if (!status) {
++ if (!status && l2cap_check_enc_key_size(hcon)) {
+ if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
+ res = L2CAP_CR_PEND;
+ stat = L2CAP_CS_AUTHOR_PEND;
+--
+2.16.4
+
diff --git a/patches.drivers/Drivers-misc-fix-out-of-bounds-access-in-function-pa.patch b/patches.drivers/Drivers-misc-fix-out-of-bounds-access-in-function-pa.patch
new file mode 100644
index 0000000000..fe997e9cab
--- /dev/null
+++ b/patches.drivers/Drivers-misc-fix-out-of-bounds-access-in-function-pa.patch
@@ -0,0 +1,42 @@
+From b281218ad4311a0342a40cb02fb17a363df08b48 Mon Sep 17 00:00:00 2001
+From: Young Xiao <YangX92@hotmail.com>
+Date: Fri, 12 Apr 2019 15:45:06 +0800
+Subject: [PATCH] Drivers: misc: fix out-of-bounds access in function param_set_kgdbts_var
+Git-commit: b281218ad4311a0342a40cb02fb17a363df08b48
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+There is an out-of-bounds access to "config[len - 1]" array when the
+variable "len" is zero.
+
+See commit dada6a43b040 ("kgdboc: fix KASAN global-out-of-bounds bug
+in param_set_kgdboc_var()") for details.
+
+Signed-off-by: Young Xiao <YangX92@hotmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/kgdbts.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/kgdbts.c
++++ b/drivers/misc/kgdbts.c
+@@ -1134,7 +1134,7 @@ static void kgdbts_put_char(u8 chr)
+
+ static int param_set_kgdbts_var(const char *kmessage, struct kernel_param *kp)
+ {
+- int len = strlen(kmessage);
++ size_t len = strlen(kmessage);
+
+ if (len >= MAX_CONFIG_LEN) {
+ printk(KERN_ERR "kgdbts: config string too long\n");
+@@ -1154,7 +1154,7 @@ static int param_set_kgdbts_var(const ch
+
+ strcpy(config, kmessage);
+ /* Chop out \n char as a result of echo */
+- if (config[len - 1] == '\n')
++ if (len && config[len - 1] == '\n')
+ config[len - 1] = '\0';
+
+ /* Go and configure with the new params. */
diff --git a/patches.drivers/IB-hfi1-Clear-the-IOWAIT-pending-bits-when-QP-is-put.patch b/patches.drivers/IB-hfi1-Clear-the-IOWAIT-pending-bits-when-QP-is-put.patch
new file mode 100644
index 0000000000..4fbda030a2
--- /dev/null
+++ b/patches.drivers/IB-hfi1-Clear-the-IOWAIT-pending-bits-when-QP-is-put.patch
@@ -0,0 +1,43 @@
+From: Kaike Wan <kaike.wan@intel.com>
+Date: Mon, 18 Mar 2019 09:55:29 -0700
+Subject: IB/hfi1: Clear the IOWAIT pending bits when QP is put into error
+ state
+Patch-mainline: v5.1-rc5
+Git-commit: 93b289b9aff66eca7575b09f36f5abbeca8e6167
+References: bsc#1114685 FATE#325854
+
+When a QP is put into error state, it may be waiting for send engine
+resources. In this case, the QP will be removed from the send engine's
+waiting list, but its IOWAIT pending bits are not cleared. This will
+normally not have any major impact as the QP is being destroyed. However,
+the QP still needs to wind down its operations, such as draining the send
+queue by scheduling the send engine. Clearing the pending bits will avoid
+any potential complications. In addition, if the QP will eventually hang,
+clearing the pending bits can help debugging by presenting a consistent
+picture if the user dumps the qp_stats.
+
+This patch clears a QP's IOWAIT_PENDING_IB and IO_PENDING_TID bits in
+priv->s_iowait.flags in this case.
+
+Fixes: 5da0fc9dbf89 ("IB/hfi1: Prepare resource waits for dual leg")
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Reviewed-by: Alex Estrin <alex.estrin@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/hfi1/qp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/hw/hfi1/qp.c
++++ b/drivers/infiniband/hw/hfi1/qp.c
+@@ -834,6 +834,8 @@ void notify_error_qp(struct rvt_qp *qp)
+ if (!list_empty(&priv->s_iowait.list) &&
+ !(qp->s_flags & RVT_S_BUSY)) {
+ qp->s_flags &= ~HFI1_S_ANY_WAIT_IO;
++ iowait_clear_flag(&priv->s_iowait, IOWAIT_PENDING_IB);
++ iowait_clear_flag(&priv->s_iowait, IOWAIT_PENDING_TID);
+ list_del_init(&priv->s_iowait.list);
+ priv->s_iowait.lock = NULL;
+ rvt_put_qp(qp);
diff --git a/patches.drivers/IB-hfi1-Create-inline-to-get-extended-headers.patch b/patches.drivers/IB-hfi1-Create-inline-to-get-extended-headers.patch
new file mode 100644
index 0000000000..abc9a02359
--- /dev/null
+++ b/patches.drivers/IB-hfi1-Create-inline-to-get-extended-headers.patch
@@ -0,0 +1,100 @@
+From: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Date: Fri, 14 Jun 2019 12:32:38 -0400
+Subject: IB/hfi1: Create inline to get extended headers
+Patch-mainline: v5.2-rc6
+Git-commit: 9755f72496664eec70bc804104118b5797b6bf63
+References: bsc#1114685 FATE#325854
+
+This paves the way for another patch that reacts to a
+flush sdma completion for RC.
+
+Fixes: 81cd3891f021 ("IB/hfi1: Add support for 16B Management Packets")
+Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/hfi1/hfi.h | 31 +++++++++++++++++++++++++++++++
+ drivers/infiniband/hw/hfi1/rc.c | 22 +---------------------
+ 2 files changed, 32 insertions(+), 21 deletions(-)
+
+--- a/drivers/infiniband/hw/hfi1/hfi.h
++++ b/drivers/infiniband/hw/hfi1/hfi.h
+@@ -519,6 +519,37 @@ static inline void hfi1_16B_set_qpn(stru
+ mgmt->src_qpn = cpu_to_be32(src_qp & OPA_16B_MGMT_QPN_MASK);
+ }
+
++/**
++ * hfi1_get_rc_ohdr - get extended header
++ * @opah - the opaheader
++ */
++static inline struct ib_other_headers *
++hfi1_get_rc_ohdr(struct hfi1_opa_header *opah)
++{
++ struct ib_other_headers *ohdr;
++ struct ib_header *hdr = NULL;
++ struct hfi1_16b_header *hdr_16b = NULL;
++
++ /* Find out where the BTH is */
++ if (opah->hdr_type == HFI1_PKT_TYPE_9B) {
++ hdr = &opah->ibh;
++ if (ib_get_lnh(hdr) == HFI1_LRH_BTH)
++ ohdr = &hdr->u.oth;
++ else
++ ohdr = &hdr->u.l.oth;
++ } else {
++ u8 l4;
++
++ hdr_16b = &opah->opah;
++ l4 = hfi1_16B_get_l4(hdr_16b);
++ if (l4 == OPA_16B_L4_IB_LOCAL)
++ ohdr = &hdr_16b->u.oth;
++ else
++ ohdr = &hdr_16b->u.l.oth;
++ }
++ return ohdr;
++}
++
+ struct rvt_sge_state;
+
+ /*
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -1100,10 +1100,7 @@ static void reset_sending_psn(struct rvt
+ void hfi1_rc_send_complete(struct rvt_qp *qp, struct hfi1_opa_header *opah)
+ {
+ struct ib_other_headers *ohdr;
+- struct hfi1_qp_priv *priv = qp->priv;
+ struct rvt_swqe *wqe;
+- struct ib_header *hdr = NULL;
+- struct hfi1_16b_header *hdr_16b = NULL;
+ u32 opcode;
+ u32 psn;
+
+@@ -1111,24 +1108,7 @@ void hfi1_rc_send_complete(struct rvt_qp
+ if (!(ib_rvt_state_ops[qp->state] & RVT_SEND_OR_FLUSH_OR_RECV_OK))
+ return;
+
+- /* Find out where the BTH is */
+- if (priv->hdr_type == HFI1_PKT_TYPE_9B) {
+- hdr = &opah->ibh;
+- if (ib_get_lnh(hdr) == HFI1_LRH_BTH)
+- ohdr = &hdr->u.oth;
+- else
+- ohdr = &hdr->u.l.oth;
+- } else {
+- u8 l4;
+-
+- hdr_16b = &opah->opah;
+- l4 = hfi1_16B_get_l4(hdr_16b);
+- if (l4 == OPA_16B_L4_IB_LOCAL)
+- ohdr = &hdr_16b->u.oth;
+- else
+- ohdr = &hdr_16b->u.l.oth;
+- }
+-
++ ohdr = hfi1_get_rc_ohdr(opah);
+ opcode = ib_bth_get_opcode(ohdr);
+ if (opcode >= OP(RDMA_READ_RESPONSE_FIRST) &&
+ opcode <= OP(ATOMIC_ACKNOWLEDGE)) {
diff --git a/patches.drivers/IB-hfi1-Validate-fault-injection-opcode-user-input.patch b/patches.drivers/IB-hfi1-Validate-fault-injection-opcode-user-input.patch
new file mode 100644
index 0000000000..1a9876ab4d
--- /dev/null
+++ b/patches.drivers/IB-hfi1-Validate-fault-injection-opcode-user-input.patch
@@ -0,0 +1,44 @@
+From: Kaike Wan <kaike.wan@intel.com>
+Date: Fri, 7 Jun 2019 08:25:25 -0400
+Subject: IB/hfi1: Validate fault injection opcode user input
+Patch-mainline: v5.2-rc6
+Git-commit: 5f90677ed31963abb184ee08ebee4a4a68225dd8
+References: bsc#1114685 FATE#325854
+
+The opcode range for fault injection from user should be validated before
+it is applied to the fault->opcodes[] bitmap to avoid out-of-bound
+error.
+
+Cc: <stable@vger.kernel.org>
+Fixes: a74d5307caba ("IB/hfi1: Rework fault injection machinery")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
+Signed-off-by: Kaike Wan <kaike.wan@intel.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/hfi1/fault.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/infiniband/hw/hfi1/fault.c
++++ b/drivers/infiniband/hw/hfi1/fault.c
+@@ -153,6 +153,7 @@ static ssize_t fault_opcodes_write(struc
+ char *dash;
+ unsigned long range_start, range_end, i;
+ bool remove = false;
++ unsigned long bound = 1U << BITS_PER_BYTE;
+
+ end = strchr(ptr, ',');
+ if (end)
+@@ -178,6 +179,10 @@ static ssize_t fault_opcodes_write(struc
+ BITS_PER_BYTE);
+ break;
+ }
++ /* Check the inputs */
++ if (range_start >= bound || range_end >= bound)
++ break;
++
+ for (i = range_start; i <= range_end; i++) {
+ if (remove)
+ clear_bit(i, fault->opcodes);
diff --git a/patches.drivers/IB-mlx5-Verify-DEVX-general-object-type-correctly.patch b/patches.drivers/IB-mlx5-Verify-DEVX-general-object-type-correctly.patch
new file mode 100644
index 0000000000..8c90eb63ee
--- /dev/null
+++ b/patches.drivers/IB-mlx5-Verify-DEVX-general-object-type-correctly.patch
@@ -0,0 +1,62 @@
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Tue, 14 May 2019 14:44:11 +0300
+Subject: IB/mlx5: Verify DEVX general object type correctly
+Patch-mainline: v5.2-rc1
+Git-commit: cd5d20f13f2de7d5d528dbbc2b095e06c70bad9a
+References: bsc#1103991 FATE#326007
+
+As the obj_id in the firmware is not globally unique in general_object,
+the object type must be considered upon checking for a valid object id.
+
+Fixes: 2351776e87a1 ("IB/mlx5: Verify DEVX object type")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/devx.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/devx.c
++++ b/drivers/infiniband/hw/mlx5/devx.c
+@@ -112,7 +112,7 @@ bool mlx5_ib_devx_is_flow_dest(void *obj
+ * must be considered upon checking for a valid object id.
+ * For that the opcode of the creator command is encoded as part of the obj_id.
+ */
+-static u64 get_enc_obj_id(u16 opcode, u32 obj_id)
++static u64 get_enc_obj_id(u32 opcode, u32 obj_id)
+ {
+ return ((u64)opcode << 32) | obj_id;
+ }
+@@ -125,7 +125,9 @@ static int devx_is_valid_obj_id(struct d
+ switch (opcode) {
+ case MLX5_CMD_OP_MODIFY_GENERAL_OBJECT:
+ case MLX5_CMD_OP_QUERY_GENERAL_OBJECT:
+- obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_GENERAL_OBJECT,
++ obj_id = get_enc_obj_id(MLX5_CMD_OP_CREATE_GENERAL_OBJECT |
++ MLX5_GET(general_obj_in_cmd_hdr, in,
++ obj_type) << 16,
+ MLX5_GET(general_obj_in_cmd_hdr, in,
+ obj_id));
+ break;
+@@ -939,6 +941,7 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD
+ struct mlx5_ib_dev *dev = to_mdev(c->ibucontext.device);
+ u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)];
+ struct devx_obj *obj;
++ u16 obj_type = 0;
+ int err;
+ int uid;
+ u32 obj_id;
+@@ -978,7 +981,11 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD
+ if (err)
+ goto obj_destroy;
+
+- obj->obj_id = get_enc_obj_id(opcode, obj_id);
++ if (opcode == MLX5_CMD_OP_CREATE_GENERAL_OBJECT)
++ obj_type = MLX5_GET(general_obj_in_cmd_hdr, cmd_in, obj_type);
++
++ obj->obj_id = get_enc_obj_id(opcode | obj_type << 16, obj_id);
++
+ return 0;
+
+ obj_destroy:
diff --git a/patches.drivers/Input-synaptics-enable-SMBus-on-ThinkPad-E480-and-E5.patch b/patches.drivers/Input-synaptics-enable-SMBus-on-ThinkPad-E480-and-E5.patch
new file mode 100644
index 0000000000..2ff8c16dba
--- /dev/null
+++ b/patches.drivers/Input-synaptics-enable-SMBus-on-ThinkPad-E480-and-E5.patch
@@ -0,0 +1,40 @@
+From 9843f3e08e2144724be7148e08d77a195dea257a Mon Sep 17 00:00:00 2001
+From: Alexander Mikhaylenko <exalm7659@gmail.com>
+Date: Wed, 12 Jun 2019 14:59:46 -0700
+Subject: [PATCH] Input: synaptics - enable SMBus on ThinkPad E480 and E580
+Git-commit: 9843f3e08e2144724be7148e08d77a195dea257a
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+They are capable of using intertouch and it works well with
+psmouse.synaptics_intertouch=1, so add them to the list.
+
+Without it, scrolling and gestures are jumpy, three-finger pinch gesture
+doesn't work and three- or four-finger swipes sometimes get stuck.
+
+Signed-off-by: Alexander Mikhaylenko <exalm7659@gmail.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/mouse/synaptics.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index b6da0c1267e3..8e6077d8e434 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -179,6 +179,8 @@ static const char * const smbus_pnp_ids[] = {
+ "LEN0096", /* X280 */
+ "LEN0097", /* X280 -> ALPS trackpoint */
+ "LEN200f", /* T450s */
++ "LEN2054", /* E480 */
++ "LEN2055", /* E580 */
+ "SYN3052", /* HP EliteBook 840 G4 */
+ "SYN3221", /* HP 15-ay000 */
+ NULL
+--
+2.16.4
+
diff --git a/patches.drivers/Input-uinput-add-compat-ioctl-number-translation-for.patch b/patches.drivers/Input-uinput-add-compat-ioctl-number-translation-for.patch
new file mode 100644
index 0000000000..a55da0bc64
--- /dev/null
+++ b/patches.drivers/Input-uinput-add-compat-ioctl-number-translation-for.patch
@@ -0,0 +1,65 @@
+From 7c7da40da1640ce6814dab1e8031b44e19e5a3f6 Mon Sep 17 00:00:00 2001
+From: Andrey Smirnov <andrew.smirnov@gmail.com>
+Date: Thu, 23 May 2019 12:55:26 -0700
+Subject: [PATCH] Input: uinput - add compat ioctl number translation for UI_*_FF_UPLOAD
+Git-commit: 7c7da40da1640ce6814dab1e8031b44e19e5a3f6
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+In the case of compat syscall ioctl numbers for UI_BEGIN_FF_UPLOAD and
+UI_END_FF_UPLOAD need to be adjusted before being passed on
+uinput_ioctl_handler() since code built with -m32 will be passing
+slightly different values. Extend the code already covering
+UI_SET_PHYS to cover UI_BEGIN_FF_UPLOAD and UI_END_FF_UPLOAD as well.
+
+Reported-by: Pierre-Loup A. Griffais <pgriffais@valvesoftware.com>
+Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/input/misc/uinput.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
+index 26ec603fe220..83d1499fe021 100644
+--- a/drivers/input/misc/uinput.c
++++ b/drivers/input/misc/uinput.c
+@@ -1051,13 +1051,31 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+
+ #ifdef CONFIG_COMPAT
+
+-#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
++/*
++ * These IOCTLs change their size and thus their numbers between
++ * 32 and 64 bits.
++ */
++#define UI_SET_PHYS_COMPAT \
++ _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t)
++#define UI_BEGIN_FF_UPLOAD_COMPAT \
++ _IOWR(UINPUT_IOCTL_BASE, 200, struct uinput_ff_upload_compat)
++#define UI_END_FF_UPLOAD_COMPAT \
++ _IOW(UINPUT_IOCTL_BASE, 201, struct uinput_ff_upload_compat)
+
+ static long uinput_compat_ioctl(struct file *file,
+ unsigned int cmd, unsigned long arg)
+ {
+- if (cmd == UI_SET_PHYS_COMPAT)
++ switch (cmd) {
++ case UI_SET_PHYS_COMPAT:
+ cmd = UI_SET_PHYS;
++ break;
++ case UI_BEGIN_FF_UPLOAD_COMPAT:
++ cmd = UI_BEGIN_FF_UPLOAD;
++ break;
++ case UI_END_FF_UPLOAD_COMPAT:
++ cmd = UI_END_FF_UPLOAD;
++ break;
++ }
+
+ return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg));
+ }
+--
+2.16.4
+
diff --git a/patches.drivers/PCI-P2PDMA-fix-the-gen_pool_add_virt-failure-path.patch b/patches.drivers/PCI-P2PDMA-fix-the-gen_pool_add_virt-failure-path.patch
new file mode 100644
index 0000000000..278ea79982
--- /dev/null
+++ b/patches.drivers/PCI-P2PDMA-fix-the-gen_pool_add_virt-failure-path.patch
@@ -0,0 +1,54 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 13 Jun 2019 15:56:24 -0700
+Subject: PCI/P2PDMA: fix the gen_pool_add_virt() failure path
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.2-rc5
+Git-commit: e615a191216e3fb4e9c0d239007f2b0cd48f28bf
+References: bsc#1103992 FATE#326009
+
+The pci_p2pdma_add_resource() implementation immediately frees the pgmap
+if gen_pool_add_virt() fails. However, that means that when @dev
+triggers a devres release devm_memremap_pages_release() will crash
+trying to access the freed @pgmap.
+
+Use the new devm_memunmap_pages() to manually free the mapping in the
+error path.
+
+Link: http://lkml.kernel.org/r/155727337603.292046.13101332703665246702.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Fixes: 52916982af48 ("PCI/P2PDMA: Support peer-to-peer memory")
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Acked-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Jérôme Glisse" <jglisse@redhat.com>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/pci/p2pdma.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/p2pdma.c
++++ b/drivers/pci/p2pdma.c
+@@ -160,13 +160,15 @@ int pci_p2pdma_add_resource(struct pci_d
+ error = devm_add_action_or_reset(&pdev->dev, pci_p2pdma_percpu_kill,
+ &pdev->p2pdma->devmap_ref);
+ if (error)
+- goto pgmap_free;
++ goto pages_free;
+
+ pci_info(pdev, "added peer-to-peer DMA memory %pR\n",
+ &pgmap->res);
+
+ return 0;
+
++pages_free:
++ devm_memunmap_pages(&pdev->dev, pgmap);
+ pgmap_free:
+ devm_kfree(&pdev->dev, pgmap);
+ return error;
diff --git a/patches.drivers/PCI-PM-Skip-devices-in-D0-for-suspend-to-idle.patch b/patches.drivers/PCI-PM-Skip-devices-in-D0-for-suspend-to-idle.patch
new file mode 100644
index 0000000000..445b259359
--- /dev/null
+++ b/patches.drivers/PCI-PM-Skip-devices-in-D0-for-suspend-to-idle.patch
@@ -0,0 +1,119 @@
+From 3e26c5feed2add218046ecf91bab3cfa9bf762a6 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Thu, 13 Jun 2019 23:59:45 +0200
+Subject: [PATCH] PCI: PM: Skip devices in D0 for suspend-to-idle
+Git-commit: 3e26c5feed2add218046ecf91bab3cfa9bf762a6
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+Commit d491f2b75237 ("PCI: PM: Avoid possible suspend-to-idle issue")
+attempted to avoid a problem with devices whose drivers want them to
+stay in D0 over suspend-to-idle and resume, but it did not go as far
+as it should with that.
+
+Namely, first of all, the power state of a PCI bridge with a
+downstream device in D0 must be D0 (based on the PCI PM spec r1.2,
+sec 6, table 6-1, if the bridge is not in D0, there can be no PCI
+transactions on its secondary bus), but that is not actively enforced
+during system-wide PM transitions, so use the skip_bus_pm flag
+introduced by commit d491f2b75237 for that.
+
+Second, the configuration of devices left in D0 (whatever the reason)
+during suspend-to-idle need not be changed and attempting to put them
+into D0 again by force is pointless, so explicitly avoid doing that.
+
+Fixes: d491f2b75237 ("PCI: PM: Avoid possible suspend-to-idle issue")
+Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/pci-driver.c | 47 +++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 35 insertions(+), 12 deletions(-)
+
+--- a/drivers/pci/pci-driver.c
++++ b/drivers/pci/pci-driver.c
+@@ -521,7 +521,6 @@ static void pci_pm_default_resume_early(
+ {
+ pci_power_up(pci_dev);
+ pci_restore_state(pci_dev);
+- pci_fixup_device(pci_fixup_resume_early, pci_dev);
+ }
+
+ /*
+@@ -835,23 +834,37 @@ static int pci_pm_suspend_noirq(struct d
+
+ if (pci_dev->skip_bus_pm) {
+ /*
+- * The function is running for the second time in a row without
++ * Either the device is a bridge with a child in D0 below it, or
++ * the function is running for the second time in a row without
+ * going through full resume, which is possible only during
+- * suspend-to-idle in a spurious wakeup case. Moreover, the
+- * device was originally left in D0, so its power state should
+- * not be changed here and the device register values saved
+- * originally should be restored on resume again.
++ * suspend-to-idle in a spurious wakeup case. The device should
++ * be in D0 at this point, but if it is a bridge, it may be
++ * necessary to save its state.
+ */
+- pci_dev->state_saved = true;
+- } else if (pci_dev->state_saved) {
+- if (pci_dev->current_state == PCI_D0)
+- pci_dev->skip_bus_pm = true;
+- } else {
++ if (!pci_dev->state_saved)
++ pci_save_state(pci_dev);
++ } else if (!pci_dev->state_saved) {
+ pci_save_state(pci_dev);
+ if (pci_power_manageable(pci_dev))
+ pci_prepare_to_sleep(pci_dev);
+ }
+
++ if (pci_dev->current_state == PCI_D0) {
++ pci_dev->skip_bus_pm = true;
++ /*
++ * Per PCI PM r1.2, table 6-1, a bridge must be in D0 if any
++ * downstream device is in D0, so avoid changing the power state
++ * of the parent bridge by setting the skip_bus_pm flag for it.
++ */
++ if (pci_dev->bus->self)
++ pci_dev->bus->self->skip_bus_pm = true;
++ }
++
++ if (pci_dev->skip_bus_pm && !pm_suspend_via_firmware()) {
++ dev_dbg(dev, "PCI PM: Skipped\n");
++ goto Fixup;
++ }
++
+ pci_pm_set_unknown_state(pci_dev);
+
+ /*
+@@ -899,7 +912,16 @@ static int pci_pm_resume_noirq(struct de
+ if (dev_pm_smart_suspend_and_suspended(dev))
+ pm_runtime_set_active(dev);
+
+- pci_pm_default_resume_early(pci_dev);
++ /*
++ * In the suspend-to-idle case, devices left in D0 during suspend will
++ * stay in D0, so it is not necessary to restore or update their
++ * configuration here and attempting to put them into D0 again may
++ * confuse some firmware, so avoid doing that.
++ */
++ if (!pci_dev->skip_bus_pm || pm_suspend_via_firmware())
++ pci_pm_default_resume_early(pci_dev);
++
++ pci_fixup_device(pci_fixup_resume_early, pci_dev);
+
+ if (pci_has_legacy_pm_support(pci_dev))
+ return pci_legacy_resume_early(dev);
+@@ -1195,6 +1217,7 @@ static int pci_pm_restore_noirq(struct d
+ }
+
+ pci_pm_default_resume_early(pci_dev);
++ pci_fixup_device(pci_fixup_resume_early, pci_dev);
+
+ if (pci_has_legacy_pm_support(pci_dev))
+ return pci_legacy_resume_early(dev);
diff --git a/patches.drivers/PCI-rpadlpar-Fix-leaked-device_node-references-in-ad.patch b/patches.drivers/PCI-rpadlpar-Fix-leaked-device_node-references-in-ad.patch
new file mode 100644
index 0000000000..f029f912b4
--- /dev/null
+++ b/patches.drivers/PCI-rpadlpar-Fix-leaked-device_node-references-in-ad.patch
@@ -0,0 +1,60 @@
+From fb26228bfc4ce3951544848555c0278e2832e618 Mon Sep 17 00:00:00 2001
+From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Date: Fri, 22 Mar 2019 13:27:21 -0500
+Subject: [PATCH] PCI: rpadlpar: Fix leaked device_node references in add/remove paths
+Git-commit: fb26228bfc4ce3951544848555c0278e2832e618
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+The find_dlpar_node() helper returns a device node with its reference
+incremented. Both the add and remove paths use this helper for find the
+appropriate node, but fail to release the reference when done.
+
+Annotate the find_dlpar_node() helper with a comment about the incremented
+reference count and call of_node_put() on the obtained device_node in the
+add and remove paths. Also, fixup a reference leak in the find_vio_slot()
+helper where we fail to call of_node_put() on the vdevice node after we
+iterate over its children.
+
+Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/pci/hotplug/rpadlpar_core.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/hotplug/rpadlpar_core.c
++++ b/drivers/pci/hotplug/rpadlpar_core.c
+@@ -55,6 +55,7 @@ static struct device_node *find_vio_slot
+ if ((rc == 0) && (!strcmp(drc_name, name)))
+ break;
+ }
++ of_node_put(parent);
+
+ return dn;
+ }
+@@ -78,6 +79,7 @@ static struct device_node *find_php_slot
+ return np;
+ }
+
++/* Returns a device_node with its reference count incremented */
+ static struct device_node *find_dlpar_node(char *drc_name, int *node_type)
+ {
+ struct device_node *dn;
+@@ -313,6 +315,7 @@ int dlpar_add_slot(char *drc_name)
+ rc = dlpar_add_phb(drc_name, dn);
+ break;
+ }
++ of_node_put(dn);
+
+ printk(KERN_INFO "%s: slot %s added\n", DLPAR_MODULE_NAME, drc_name);
+ exit:
+@@ -446,6 +449,7 @@ int dlpar_remove_slot(char *drc_name)
+ rc = dlpar_remove_pci_slot(drc_name, dn);
+ break;
+ }
++ of_node_put(dn);
+ vm_unmap_aliases();
+
+ printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
diff --git a/patches.drivers/RDMA-ipoib-Allow-user-space-differentiate-between-va.patch b/patches.drivers/RDMA-ipoib-Allow-user-space-differentiate-between-va.patch
new file mode 100644
index 0000000000..d0e5331e4d
--- /dev/null
+++ b/patches.drivers/RDMA-ipoib-Allow-user-space-differentiate-between-va.patch
@@ -0,0 +1,53 @@
+From: Leon Romanovsky <leonro@mellanox.com>
+Date: Mon, 6 May 2019 14:23:04 +0300
+Subject: RDMA/ipoib: Allow user space differentiate between valid dev_port
+Patch-mainline: v5.2-rc1
+Git-commit: b79656ed44c6865e17bcd93472ec39488bcc4984
+References: bsc#1103992 FATE#326009
+
+Systemd triggers the following warning during IPoIB device load:
+
+ mlx5_core 0000:00:0c.0 ib0: "systemd-udevd" wants to know my dev_id.
+ Should it look at dev_port instead?
+ See Documentation/ABI/testing/sysfs-class-net for more info.
+
+This is caused due to user space attempt to differentiate old systems
+without dev_port and new systems with dev_port. In case dev_port will be
+zero, the systemd will try to read dev_id instead.
+
+There is no need to print a warning in such case, because it is valid
+situation and it is needed to ensure systemd compatibility with old
+kernels.
+
+Link: https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
+Cc: <stable@vger.kernel.org> # 4.19
+Fixes: f6350da41dc7 ("IB/ipoib: Log sysfs 'dev_id' accesses from userspace")
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -2400,7 +2400,18 @@ static ssize_t dev_id_show(struct device
+ {
+ struct net_device *ndev = to_net_dev(dev);
+
+- if (ndev->dev_id == ndev->dev_port)
++ /*
++ * ndev->dev_port will be equal to 0 in old kernel prior to commit
++ * 9b8b2a323008 ("IB/ipoib: Use dev_port to expose network interface
++ * port numbers") Zero was chosen as special case for user space
++ * applications to fallback and query dev_id to check if it has
++ * different value or not.
++ *
++ * Don't print warning in such scenario.
++ *
++ * https://github.com/systemd/systemd/blob/master/src/udev/udev-builtin-net_id.c#L358
++ */
++ if (ndev->dev_port && ndev->dev_id == ndev->dev_port)
+ netdev_info_once(ndev,
+ "\"%s\" wants to know my dev_id. Should it look at dev_port instead? See Documentation/ABI/testing/sysfs-class-net for more info.\n",
+ current->comm);
diff --git a/patches.drivers/RDMA-mlx5-Do-not-allow-the-user-to-write-to-the-cloc.patch b/patches.drivers/RDMA-mlx5-Do-not-allow-the-user-to-write-to-the-cloc.patch
new file mode 100644
index 0000000000..4f84e23976
--- /dev/null
+++ b/patches.drivers/RDMA-mlx5-Do-not-allow-the-user-to-write-to-the-cloc.patch
@@ -0,0 +1,38 @@
+From: Jason Gunthorpe <jgg@mellanox.com>
+Date: Tue, 16 Apr 2019 14:07:25 +0300
+Subject: RDMA/mlx5: Do not allow the user to write to the clock page
+Patch-mainline: v5.1-rc7
+Git-commit: c660133c339f9ab684fdf568c0d51b9ae5e86002
+References: bsc#1103991 FATE#326007
+
+The intent of this VMA was to be read-only from user space, but the
+VM_MAYWRITE masking was missed, so mprotect could make it writable.
+
+Cc: stable@vger.kernel.org
+Fixes: 5c99eaecb1fc ("IB/mlx5: Mmap the HCA's clock info to user-space")
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -1966,6 +1966,7 @@ static int mlx5_ib_mmap_clock_info_page(
+
+ if (vma->vm_flags & VM_WRITE)
+ return -EPERM;
++ vma->vm_flags &= ~VM_MAYWRITE;
+
+ if (!dev->mdev->clock_info_page)
+ return -EOPNOTSUPP;
+@@ -2131,6 +2132,7 @@ static int mlx5_ib_mmap(struct ib_uconte
+
+ if (vma->vm_flags & VM_WRITE)
+ return -EPERM;
++ vma->vm_flags &= ~VM_MAYWRITE;
+
+ /* Don't expose to user-space information it shouldn't have */
+ if (PAGE_SIZE > 4096)
diff --git a/patches.drivers/RDMA-mlx5-Initialize-roce-port-info-before-multiport.patch b/patches.drivers/RDMA-mlx5-Initialize-roce-port-info-before-multiport.patch
new file mode 100644
index 0000000000..7d805c6258
--- /dev/null
+++ b/patches.drivers/RDMA-mlx5-Initialize-roce-port-info-before-multiport.patch
@@ -0,0 +1,60 @@
+From: Mark Bloch <markb@mellanox.com>
+Date: Thu, 28 Mar 2019 15:46:26 +0200
+Subject: RDMA/mlx5: Initialize roce port info before multiport master init
+Patch-mainline: v5.2-rc1
+Git-commit: d3b5cc1cd996ce84d362b3c15f940346603741b9
+References: bsc#1103991 FATE#326007
+
+When working in mutliport RoCE mode it is possible to attach a slave
+before the master. In that case the slave is waiting for a master to be
+attached. When the master is attached it goes over the list of waiting
+slaves, finds a slave that is compatible and tries to bind it to itself.
+
+The call stack is:
+mlx5_ib_init_multiport_master() -> mlx5_ib_bind_slave_port()
+
+In the bind function we will create a netdev notifier, but this is done
+before we initialize the RoCE structure (this is done at a later stage by
+the master in the ROCE stage).
+
+Once events are delivered to that notifier we will use
+mlx5_ib_get_native_port_mdev() to get the actual port and as the native
+port is zero we will access an invalid index in the port structure.
+
+Move the RoCE structure initialization to an earlier stage.
+
+Fixes: 32f69e4be269 ("{net, IB}/mlx5: Manage port association for multiport RoCE")
+Signed-off-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/main.c | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -5668,6 +5668,9 @@ int mlx5_ib_stage_init_init(struct mlx5_
+ for (i = 0; i < dev->num_ports; i++) {
+ spin_lock_init(&dev->port[i].mp.mpi_lock);
+ rwlock_init(&dev->roce[i].netdev_lock);
++ dev->roce[i].dev = dev;
++ dev->roce[i].native_port_num = i + 1;
++ dev->roce[i].last_port_state = IB_PORT_DOWN;
+ }
+
+ err = mlx5_ib_init_multiport_master(dev);
+@@ -5919,13 +5922,6 @@ int mlx5_ib_stage_rep_non_default_cb(str
+ static int mlx5_ib_stage_common_roce_init(struct mlx5_ib_dev *dev)
+ {
+ u8 port_num;
+- int i;
+-
+- for (i = 0; i < dev->num_ports; i++) {
+- dev->roce[i].dev = dev;
+- dev->roce[i].native_port_num = i + 1;
+- dev->roce[i].last_port_state = IB_PORT_DOWN;
+- }
+
+ dev->ib_dev.get_netdev = mlx5_ib_get_netdev;
+ dev->ib_dev.create_wq = mlx5_ib_create_wq;
diff --git a/patches.drivers/RDMA-mlx5-Use-rdma_user_map_io-for-mapping-BAR-pages.patch b/patches.drivers/RDMA-mlx5-Use-rdma_user_map_io-for-mapping-BAR-pages.patch
new file mode 100644
index 0000000000..cbbbdc1f70
--- /dev/null
+++ b/patches.drivers/RDMA-mlx5-Use-rdma_user_map_io-for-mapping-BAR-pages.patch
@@ -0,0 +1,41 @@
+From: Jason Gunthorpe <jgg@mellanox.com>
+Date: Tue, 16 Apr 2019 14:07:26 +0300
+Subject: RDMA/mlx5: Use rdma_user_map_io for mapping BAR pages
+Patch-mainline: v5.1-rc7
+Git-commit: d5e560d3f72382ac4e3bfe4e0f0420e6a220b039
+References: bsc#1103992 FATE#326009
+
+Since mlx5 supports device disassociate it must use this API for all
+BAR page mmaps, otherwise the pages can remain mapped after the device
+is unplugged causing a system crash.
+
+Cc: stable@vger.kernel.org
+Fixes: 5f9794dc94f5 ("RDMA/ucontext: Add a core API for mmaping driver IO memory")
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Reviewed-by: Haggai Eran <haggaie@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/infiniband/hw/mlx5/main.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -2138,14 +2138,12 @@ static int mlx5_ib_mmap(struct ib_uconte
+ if (PAGE_SIZE > 4096)
+ return -EOPNOTSUPP;
+
+- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ pfn = (dev->mdev->iseg_base +
+ offsetof(struct mlx5_init_seg, internal_timer_h)) >>
+ PAGE_SHIFT;
+- if (io_remap_pfn_range(vma, vma->vm_start, pfn,
+- PAGE_SIZE, vma->vm_page_prot))
+- return -EAGAIN;
+- break;
++ return rdma_user_mmap_io(&context->ibucontext, vma, pfn,
++ PAGE_SIZE,
++ pgprot_noncached(vma->vm_page_prot));
+ case MLX5_IB_MMAP_CLOCK_INFO:
+ return mlx5_ib_mmap_clock_info_page(dev, vma, context);
+
diff --git a/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch b/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch
new file mode 100644
index 0000000000..2134927f94
--- /dev/null
+++ b/patches.drivers/Revert-net-ena-ethtool-add-extra-properties-retrieva.patch
@@ -0,0 +1,378 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Tue, 25 Jun 2019 09:59:56 -0700
+Subject: Revert "net: ena: ethtool: add extra properties retrieval via
+ get_priv_flags"
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: eb203bae834efc6aff05da49f61edda0f3bc3e01
+References: bsc#1138879
+
+This reverts commit 315c28d2b714 ("net: ena: ethtool: add extra properties retrieval via get_priv_flags").
+
+As discussed at netconf and on the mailing list we can't allow
+for the the abuse of private flags for exposing arbitrary device
+labels.
+
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_admin_defs.h | 16 ----
+ drivers/net/ethernet/amazon/ena/ena_com.c | 56 -----------------
+ drivers/net/ethernet/amazon/ena/ena_com.h | 32 ---------
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 75 +++--------------------
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 14 ----
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 2
+ 6 files changed, 11 insertions(+), 184 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
++++ b/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
+@@ -32,8 +32,6 @@
+ #ifndef _ENA_ADMIN_H_
+ #define _ENA_ADMIN_H_
+
+-#define ENA_ADMIN_EXTRA_PROPERTIES_STRING_LEN 32
+-#define ENA_ADMIN_EXTRA_PROPERTIES_COUNT 32
+
+ enum ena_admin_aq_opcode {
+ ENA_ADMIN_CREATE_SQ = 1,
+@@ -62,8 +60,6 @@ enum ena_admin_aq_feature_id {
+ ENA_ADMIN_MAX_QUEUES_NUM = 2,
+ ENA_ADMIN_HW_HINTS = 3,
+ ENA_ADMIN_LLQ = 4,
+- ENA_ADMIN_EXTRA_PROPERTIES_STRINGS = 5,
+- ENA_ADMIN_EXTRA_PROPERTIES_FLAGS = 6,
+ ENA_ADMIN_MAX_QUEUES_EXT = 7,
+ ENA_ADMIN_RSS_HASH_FUNCTION = 10,
+ ENA_ADMIN_STATELESS_OFFLOAD_CONFIG = 11,
+@@ -599,14 +595,6 @@ struct ena_admin_set_feature_mtu_desc {
+ u32 mtu;
+ };
+
+-struct ena_admin_get_extra_properties_strings_desc {
+- u32 count;
+-};
+-
+-struct ena_admin_get_extra_properties_flags_desc {
+- u32 flags;
+-};
+-
+ struct ena_admin_set_feature_host_attr_desc {
+ /* host OS info base address in OS memory. host info is 4KB of
+ * physically contiguous
+@@ -926,10 +914,6 @@ struct ena_admin_get_feat_resp {
+ struct ena_admin_feature_intr_moder_desc intr_moderation;
+
+ struct ena_admin_ena_hw_hints hw_hints;
+-
+- struct ena_admin_get_extra_properties_strings_desc extra_properties_strings;
+-
+- struct ena_admin_get_extra_properties_flags_desc extra_properties_flags;
+ } u;
+ };
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -1896,62 +1896,6 @@ int ena_com_get_link_params(struct ena_c
+ return ena_com_get_feature(ena_dev, resp, ENA_ADMIN_LINK_CONFIG, 0);
+ }
+
+-int ena_com_extra_properties_strings_init(struct ena_com_dev *ena_dev)
+-{
+- struct ena_admin_get_feat_resp resp;
+- struct ena_extra_properties_strings *extra_properties_strings =
+- &ena_dev->extra_properties_strings;
+- u32 rc;
+-
+- extra_properties_strings->size = ENA_ADMIN_EXTRA_PROPERTIES_COUNT *
+- ENA_ADMIN_EXTRA_PROPERTIES_STRING_LEN;
+-
+- extra_properties_strings->virt_addr =
+- dma_alloc_coherent(ena_dev->dmadev,
+- extra_properties_strings->size,
+- &extra_properties_strings->dma_addr,
+- GFP_KERNEL);
+- if (unlikely(!extra_properties_strings->virt_addr)) {
+- pr_err("Failed to allocate extra properties strings\n");
+- return 0;
+- }
+-
+- rc = ena_com_get_feature_ex(ena_dev, &resp,
+- ENA_ADMIN_EXTRA_PROPERTIES_STRINGS,
+- extra_properties_strings->dma_addr,
+- extra_properties_strings->size, 0);
+- if (rc) {
+- pr_debug("Failed to get extra properties strings\n");
+- goto err;
+- }
+-
+- return resp.u.extra_properties_strings.count;
+-err:
+- ena_com_delete_extra_properties_strings(ena_dev);
+- return 0;
+-}
+-
+-void ena_com_delete_extra_properties_strings(struct ena_com_dev *ena_dev)
+-{
+- struct ena_extra_properties_strings *extra_properties_strings =
+- &ena_dev->extra_properties_strings;
+-
+- if (extra_properties_strings->virt_addr) {
+- dma_free_coherent(ena_dev->dmadev,
+- extra_properties_strings->size,
+- extra_properties_strings->virt_addr,
+- extra_properties_strings->dma_addr);
+- extra_properties_strings->virt_addr = NULL;
+- }
+-}
+-
+-int ena_com_get_extra_properties_flags(struct ena_com_dev *ena_dev,
+- struct ena_admin_get_feat_resp *resp)
+-{
+- return ena_com_get_feature(ena_dev, resp,
+- ENA_ADMIN_EXTRA_PROPERTIES_FLAGS, 0);
+-}
+-
+ int ena_com_get_dev_attr_feat(struct ena_com_dev *ena_dev,
+ struct ena_com_dev_get_features_ctx *get_feat_ctx)
+ {
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -352,12 +352,6 @@ struct ena_host_attribute {
+ dma_addr_t host_info_dma_addr;
+ };
+
+-struct ena_extra_properties_strings {
+- u8 *virt_addr;
+- dma_addr_t dma_addr;
+- u32 size;
+-};
+-
+ /* Each ena_dev is a PCI function. */
+ struct ena_com_dev {
+ struct ena_com_admin_queue admin_queue;
+@@ -386,7 +380,6 @@ struct ena_com_dev {
+ struct ena_intr_moder_entry *intr_moder_tbl;
+
+ struct ena_com_llq_info llq_info;
+- struct ena_extra_properties_strings extra_properties_strings;
+ };
+
+ struct ena_com_dev_get_features_ctx {
+@@ -620,31 +613,6 @@ int ena_com_validate_version(struct ena_
+ int ena_com_get_link_params(struct ena_com_dev *ena_dev,
+ struct ena_admin_get_feat_resp *resp);
+
+-/* ena_com_extra_properties_strings_init - Initialize the extra properties strings buffer.
+- * @ena_dev: ENA communication layer struct
+- *
+- * Initialize the extra properties strings buffer.
+- */
+-int ena_com_extra_properties_strings_init(struct ena_com_dev *ena_dev);
+-
+-/* ena_com_delete_extra_properties_strings - Free the extra properties strings buffer.
+- * @ena_dev: ENA communication layer struct
+- *
+- * Free the allocated extra properties strings buffer.
+- */
+-void ena_com_delete_extra_properties_strings(struct ena_com_dev *ena_dev);
+-
+-/* ena_com_get_extra_properties_flags - Retrieve extra properties flags.
+- * @ena_dev: ENA communication layer struct
+- * @resp: Extra properties flags.
+- *
+- * Retrieve the extra properties flags.
+- *
+- * @return - 0 on Success negative value otherwise.
+- */
+-int ena_com_get_extra_properties_flags(struct ena_com_dev *ena_dev,
+- struct ena_admin_get_feat_resp *resp);
+-
+ /* ena_com_get_dma_width - Retrieve physical dma address width the device
+ * supports.
+ * @ena_dev: ENA communication layer struct
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -198,24 +198,15 @@ static void ena_get_ethtool_stats(struct
+ ena_dev_admin_queue_stats(adapter, &data);
+ }
+
+-static int get_stats_sset_count(struct ena_adapter *adapter)
+-{
+- return adapter->num_queues * (ENA_STATS_ARRAY_TX + ENA_STATS_ARRAY_RX)
+- + ENA_STATS_ARRAY_GLOBAL + ENA_STATS_ARRAY_ENA_COM;
+-}
+-
+ int ena_get_sset_count(struct net_device *netdev, int sset)
+ {
+ struct ena_adapter *adapter = netdev_priv(netdev);
+
+- switch (sset) {
+- case ETH_SS_STATS:
+- return get_stats_sset_count(adapter);
+- case ETH_SS_PRIV_FLAGS:
+- return adapter->ena_extra_properties_count;
+- default:
++ if (sset != ETH_SS_STATS)
+ return -EOPNOTSUPP;
+- }
++
++ return adapter->num_queues * (ENA_STATS_ARRAY_TX + ENA_STATS_ARRAY_RX)
++ + ENA_STATS_ARRAY_GLOBAL + ENA_STATS_ARRAY_ENA_COM;
+ }
+
+ static void ena_queue_strings(struct ena_adapter *adapter, u8 **data)
+@@ -257,54 +248,26 @@ static void ena_com_dev_strings(u8 **dat
+ }
+ }
+
+-static void get_stats_strings(struct ena_adapter *adapter, u8 *data)
++static void ena_get_strings(struct net_device *netdev, u32 sset, u8 *data)
+ {
++ struct ena_adapter *adapter = netdev_priv(netdev);
+ const struct ena_stats *ena_stats;
+ int i;
+
++ if (sset != ETH_SS_STATS)
++ return;
++
+ for (i = 0; i < ENA_STATS_ARRAY_GLOBAL; i++) {
+ ena_stats = &ena_stats_global_strings[i];
++
+ memcpy(data, ena_stats->name, ETH_GSTRING_LEN);
+ data += ETH_GSTRING_LEN;
+ }
++
+ ena_queue_strings(adapter, &data);
+ ena_com_dev_strings(&data);
+ }
+
+-static void get_private_flags_strings(struct ena_adapter *adapter, u8 *data)
+-{
+- struct ena_com_dev *ena_dev = adapter->ena_dev;
+- u8 *strings = ena_dev->extra_properties_strings.virt_addr;
+- int i;
+-
+- if (unlikely(!strings)) {
+- adapter->ena_extra_properties_count = 0;
+- return;
+- }
+-
+- for (i = 0; i < adapter->ena_extra_properties_count; i++) {
+- strlcpy(data, strings + ENA_ADMIN_EXTRA_PROPERTIES_STRING_LEN * i,
+- ETH_GSTRING_LEN);
+- data += ETH_GSTRING_LEN;
+- }
+-}
+-
+-static void ena_get_strings(struct net_device *netdev, u32 sset, u8 *data)
+-{
+- struct ena_adapter *adapter = netdev_priv(netdev);
+-
+- switch (sset) {
+- case ETH_SS_STATS:
+- get_stats_strings(adapter, data);
+- break;
+- case ETH_SS_PRIV_FLAGS:
+- get_private_flags_strings(adapter, data);
+- break;
+- default:
+- break;
+- }
+-}
+-
+ static int ena_get_link_ksettings(struct net_device *netdev,
+ struct ethtool_link_ksettings *link_ksettings)
+ {
+@@ -479,7 +442,6 @@ static void ena_get_drvinfo(struct net_d
+ strlcpy(info->version, DRV_MODULE_VERSION, sizeof(info->version));
+ strlcpy(info->bus_info, pci_name(adapter->pdev),
+ sizeof(info->bus_info));
+- info->n_priv_flags = adapter->ena_extra_properties_count;
+ }
+
+ static void ena_get_ringparam(struct net_device *netdev,
+@@ -856,20 +818,6 @@ static int ena_set_tunable(struct net_de
+ return ret;
+ }
+
+-static u32 ena_get_priv_flags(struct net_device *netdev)
+-{
+- struct ena_adapter *adapter = netdev_priv(netdev);
+- struct ena_com_dev *ena_dev = adapter->ena_dev;
+- struct ena_admin_get_feat_resp get_resp;
+- u32 rc;
+-
+- rc = ena_com_get_extra_properties_flags(ena_dev, &get_resp);
+- if (!rc)
+- return get_resp.u.extra_properties_flags.flags;
+-
+- return 0;
+-}
+-
+ static const struct ethtool_ops ena_ethtool_ops = {
+ .get_link_ksettings = ena_get_link_ksettings,
+ .get_drvinfo = ena_get_drvinfo,
+@@ -892,7 +840,6 @@ static const struct ethtool_ops ena_etht
+ .get_channels = ena_get_channels,
+ .get_tunable = ena_get_tunable,
+ .set_tunable = ena_set_tunable,
+- .get_priv_flags = ena_get_priv_flags,
+ };
+
+ void ena_set_ethtool_ops(struct net_device *netdev)
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2474,14 +2474,6 @@ err:
+ ena_com_delete_debug_area(adapter->ena_dev);
+ }
+
+-static void ena_extra_properties_strings_destroy(struct net_device *netdev)
+-{
+- struct ena_adapter *adapter = netdev_priv(netdev);
+-
+- ena_com_delete_extra_properties_strings(adapter->ena_dev);
+- adapter->ena_extra_properties_count = 0;
+-}
+-
+ static void ena_get_stats64(struct net_device *netdev,
+ struct rtnl_link_stats64 *stats)
+ {
+@@ -3580,9 +3572,6 @@ static int ena_probe(struct pci_dev *pde
+
+ ena_config_debug_area(adapter);
+
+- adapter->ena_extra_properties_count =
+- ena_com_extra_properties_strings_init(ena_dev);
+-
+ memcpy(adapter->netdev->perm_addr, adapter->mac_addr, netdev->addr_len);
+
+ netif_carrier_off(netdev);
+@@ -3623,7 +3612,6 @@ static int ena_probe(struct pci_dev *pde
+ return 0;
+
+ err_rss:
+- ena_extra_properties_strings_destroy(netdev);
+ ena_com_delete_debug_area(ena_dev);
+ ena_com_rss_destroy(ena_dev);
+ err_free_msix:
+@@ -3716,8 +3704,6 @@ static void ena_remove(struct pci_dev *p
+
+ ena_com_delete_host_info(ena_dev);
+
+- ena_extra_properties_strings_destroy(netdev);
+-
+ ena_release_bars(ena_dev, pdev);
+
+ pci_disable_device(pdev);
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -378,8 +378,6 @@ struct ena_adapter {
+ u32 last_monitored_tx_qid;
+
+ enum ena_regs_reset_reason_types reset_reason;
+-
+- u8 ena_extra_properties_count;
+ };
+
+ void ena_set_ethtool_ops(struct net_device *netdev);
diff --git a/patches.drivers/Revert-net-mlx5e-Enable-reporting-checksum-unnecessa.patch b/patches.drivers/Revert-net-mlx5e-Enable-reporting-checksum-unnecessa.patch
new file mode 100644
index 0000000000..ed5951c012
--- /dev/null
+++ b/patches.drivers/Revert-net-mlx5e-Enable-reporting-checksum-unnecessa.patch
@@ -0,0 +1,45 @@
+From: Or Gerlitz <ogerlitz@mellanox.com>
+Date: Sun, 31 Mar 2019 12:53:03 +0000
+Subject: Revert "net/mlx5e: Enable reporting checksum unnecessary also for L3
+ packets"
+Patch-mainline: v5.1-rc6
+Git-commit: 8c8811d46d00d119ffbe039a6e52a0b504df1c2c
+References: bsc#1103990 FATE#326006
+
+This reverts commit b820e6fb0978f9c2ac438c199d2bb2f35950e9c9.
+
+Prior the commit we are reverting, checksum unnecessary was only set when
+both the L3 OK and L4 OK bits are set on the CQE. This caused packets
+of IP protocols such as SCTP which are not dealt by the current HW L4
+parser (hence the L4 OK bit is not set, but the L4 header type none bit
+is set) to go through the checksum none code, where currently we wrongly
+report checksum unnecessary for them, a regression. Fix this by a revert.
+
+Note that on our usual track we report checksum complete, so the revert
+isn't expected to have any notable performance impact. Also, when we are
+not on the checksum complete track, the L4 protocols for which we report
+checksum none are not high performance ones, we will still report
+checksum unnecessary for UDP/TCP.
+
+Fixes: b820e6fb0978 ("net/mlx5e: Enable reporting checksum unnecessary also for L3 packets")
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Reported-by: Avi Urman <aviu@mellanox.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -847,8 +847,7 @@ static inline void mlx5e_handle_csum(str
+
+ csum_unnecessary:
+ if (likely((cqe->hds_ip_ext & CQE_L3_OK) &&
+- ((cqe->hds_ip_ext & CQE_L4_OK) ||
+- (get_cqe_l4_hdr_type(cqe) == CQE_L4_HDR_TYPE_NONE)))) {
++ (cqe->hds_ip_ext & CQE_L4_OK))) {
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ if (cqe_is_tunneled(cqe)) {
+ skb->csum_level = 1;
diff --git a/patches.drivers/USB-Fix-chipmunk-like-voice-when-using-Logitech-C270.patch b/patches.drivers/USB-Fix-chipmunk-like-voice-when-using-Logitech-C270.patch
new file mode 100644
index 0000000000..d004c29f16
--- /dev/null
+++ b/patches.drivers/USB-Fix-chipmunk-like-voice-when-using-Logitech-C270.patch
@@ -0,0 +1,42 @@
+From bd21f0222adab64974b7d1b4b8c7ce6b23e9ea4d Mon Sep 17 00:00:00 2001
+From: Marco Zatta <marco@zatta.me>
+Date: Sat, 1 Jun 2019 09:52:57 +0200
+Subject: [PATCH] USB: Fix chipmunk-like voice when using Logitech C270 for recording audio.
+Git-commit: bd21f0222adab64974b7d1b4b8c7ce6b23e9ea4d
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+This patch fixes the chipmunk-like voice that manifets randomly when
+using the integrated mic of the Logitech Webcam HD C270.
+
+The issue was solved initially for this device by commit 2394d67e446b
+("usb: add RESET_RESUME for webcams shown to be quirky") but it was then
+reintroduced by e387ef5c47dd ("usb: Add USB_QUIRK_RESET_RESUME for all
+Logitech UVC webcams"). This patch is to have the fix back.
+
+Signed-off-by: Marco Zatta <marco@zatta.me>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/core/quirks.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 6082b008969b..6b6413073584 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -215,6 +215,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */
+ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Logitech HD Webcam C270 */
++ { USB_DEVICE(0x046d, 0x0825), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */
+ { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT },
+--
+2.16.4
+
diff --git a/patches.drivers/USB-serial-option-add-Telit-0x1260-and-0x1261-compos.patch b/patches.drivers/USB-serial-option-add-Telit-0x1260-and-0x1261-compos.patch
new file mode 100644
index 0000000000..2c142f3da9
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-Telit-0x1260-and-0x1261-compos.patch
@@ -0,0 +1,37 @@
+From f3dfd4072c3ee6e287f501a18b5718b185d6a940 Mon Sep 17 00:00:00 2001
+From: Daniele Palmas <dnlplm@gmail.com>
+Date: Wed, 15 May 2019 17:27:49 +0200
+Subject: [PATCH] USB: serial: option: add Telit 0x1260 and 0x1261 compositions
+Git-commit: f3dfd4072c3ee6e287f501a18b5718b185d6a940
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+Added support for Telit LE910Cx 0x1260 and 0x1261 compositions.
+
+Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 100a5c0ec3e7..a0aaf0635359 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1171,6 +1171,10 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++ { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ { USB_DEVICE(TELIT_VENDOR_ID, 0x1900), /* Telit LN940 (QMI) */
+ .driver_info = NCTRL(0) | RSVD(1) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */
+--
+2.16.4
+
diff --git a/patches.drivers/USB-serial-option-add-support-for-Simcom-SIM7500-SIM.patch b/patches.drivers/USB-serial-option-add-support-for-Simcom-SIM7500-SIM.patch
new file mode 100644
index 0000000000..9b5781c45c
--- /dev/null
+++ b/patches.drivers/USB-serial-option-add-support-for-Simcom-SIM7500-SIM.patch
@@ -0,0 +1,55 @@
+From 5417a7e482962952e622eabd60cd3600dd65dedf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rgen=20Storvist?= <jorgen.storvist@gmail.com>
+Date: Mon, 13 May 2019 18:37:52 +0200
+Subject: [PATCH] USB: serial: option: add support for Simcom SIM7500/SIM7600 RNDIS mode
+Mime-version: 1.0
+Content-type: text/plain; charset=UTF-8
+Content-transfer-encoding: 8bit
+Git-commit: 5417a7e482962952e622eabd60cd3600dd65dedf
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+Added IDs for Simcom SIM7500/SIM7600 series cellular module in RNDIS
+mode. Reserved the interface for ADB.
+
+T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1e0e ProdID=9011 Rev=03.18
+S: Manufacturer=SimTech, Incorporated
+S: Product=SimTech, Incorporated
+S: SerialNumber=0123456789ABCDEF
+C: #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA
+I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=02 Prot=ff Driver=rndis_host
+I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
+I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I: If#=0x7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+Signed-off-by: Jörgen Storvist <jorgen.storvist@gmail.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 83869065b802..100a5c0ec3e7 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1772,6 +1772,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
+ .driver_info = RSVD(5) | RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9003, 0xff) }, /* Simcom SIM7500/SIM7600 MBIM mode */
++ { USB_DEVICE_INTERFACE_CLASS(0x1e0e, 0x9011, 0xff), /* Simcom SIM7500/SIM7600 RNDIS mode */
++ .driver_info = RSVD(7) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = NCTRL(0) | NCTRL(1) | RSVD(4) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D),
+--
+2.16.4
+
diff --git a/patches.drivers/USB-serial-pl2303-add-Allied-Telesis-VT-Kit3.patch b/patches.drivers/USB-serial-pl2303-add-Allied-Telesis-VT-Kit3.patch
new file mode 100644
index 0000000000..64b970f589
--- /dev/null
+++ b/patches.drivers/USB-serial-pl2303-add-Allied-Telesis-VT-Kit3.patch
@@ -0,0 +1,47 @@
+From c5f81656a18b271976a86724dadd8344e54de74e Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Tue, 14 May 2019 17:35:42 +1200
+Subject: [PATCH] USB: serial: pl2303: add Allied Telesis VT-Kit3
+Git-commit: c5f81656a18b271976a86724dadd8344e54de74e
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+This is adds the vendor and device id for the AT-VT-Kit3 which is a
+pl2303-based device.
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/serial/pl2303.c | 1 +
+ drivers/usb/serial/pl2303.h | 3 +++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 55122ac84518..d7abde14b3cf 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -106,6 +106,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+ { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
+ { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) },
++ { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) },
+ { } /* Terminating entry */
+ };
+
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 559941ca884d..b0175f17d1a2 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -155,3 +155,6 @@
+ #define SMART_VENDOR_ID 0x0b8c
+ #define SMART_PRODUCT_ID 0x2303
+
++/* Allied Telesis VT-Kit3 */
++#define AT_VENDOR_ID 0x0caa
++#define AT_VTKIT3_PRODUCT_ID 0x3001
+--
+2.16.4
+
diff --git a/patches.drivers/USB-usb-storage-Add-new-ID-to-ums-realtek.patch b/patches.drivers/USB-usb-storage-Add-new-ID-to-ums-realtek.patch
new file mode 100644
index 0000000000..27cae5e6aa
--- /dev/null
+++ b/patches.drivers/USB-usb-storage-Add-new-ID-to-ums-realtek.patch
@@ -0,0 +1,41 @@
+From 1a6dd3fea131276a4fc44ae77b0f471b0b473577 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Tue, 4 Jun 2019 00:20:49 +0800
+Subject: [PATCH] USB: usb-storage: Add new ID to ums-realtek
+Git-commit: 1a6dd3fea131276a4fc44ae77b0f471b0b473577
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+There is one more Realtek card reader requires ums-realtek to work
+correctly.
+
+Add the device ID to support it.
+
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/storage/unusual_realtek.h | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h
+index 6b2140f966ef..7e14c2d7cf73 100644
+--- a/drivers/usb/storage/unusual_realtek.h
++++ b/drivers/usb/storage/unusual_realtek.h
+@@ -17,6 +17,11 @@ UNUSUAL_DEV(0x0bda, 0x0138, 0x0000, 0x9999,
+ "USB Card Reader",
+ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
+
++UNUSUAL_DEV(0x0bda, 0x0153, 0x0000, 0x9999,
++ "Realtek",
++ "USB Card Reader",
++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0),
++
+ UNUSUAL_DEV(0x0bda, 0x0158, 0x0000, 0x9999,
+ "Realtek",
+ "USB Card Reader",
+--
+2.16.4
+
diff --git a/patches.drivers/bpf-devmap-Add-missing-RCU-read-lock-on-flush.patch b/patches.drivers/bpf-devmap-Add-missing-RCU-read-lock-on-flush.patch
new file mode 100644
index 0000000000..084af9c9fb
--- /dev/null
+++ b/patches.drivers/bpf-devmap-Add-missing-RCU-read-lock-on-flush.patch
@@ -0,0 +1,54 @@
+From: Toshiaki Makita <toshiaki.makita1@gmail.com>
+Date: Fri, 14 Jun 2019 17:20:15 +0900
+Subject: bpf, devmap: Add missing RCU read lock on flush
+Patch-mainline: v5.2-rc6
+Git-commit: 86723c8640633bee4b4588d3c7784ee7a0032f65
+References: bsc#1109837
+
+.ndo_xdp_xmit() assumes it is called under RCU. For example virtio_net
+uses RCU to detect it has setup the resources for tx. The assumption
+accidentally broke when introducing bulk queue in devmap.
+
+Fixes: 5d053f9da431 ("bpf: devmap prepare xdp frames for bulking")
+Reported-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: Toshiaki Makita <toshiaki.makita1@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/devmap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -282,6 +282,7 @@ void __dev_map_flush(struct bpf_map *map
+ unsigned long *bitmap = this_cpu_ptr(dtab->flush_needed);
+ u32 bit;
+
++ rcu_read_lock();
+ for_each_set_bit(bit, bitmap, map->max_entries) {
+ struct bpf_dtab_netdev *dev = READ_ONCE(dtab->netdev_map[bit]);
+ struct xdp_bulk_queue *bq;
+@@ -297,6 +298,7 @@ void __dev_map_flush(struct bpf_map *map
+
+ __clear_bit(bit, bitmap);
+ }
++ rcu_read_unlock();
+ }
+
+ /* rcu_read_lock (from syscall and BPF contexts) ensures that if a delete and/or
+@@ -389,6 +391,7 @@ static void dev_map_flush_old(struct bpf
+
+ int cpu;
+
++ rcu_read_lock();
+ for_each_online_cpu(cpu) {
+ bitmap = per_cpu_ptr(dev->dtab->flush_needed, cpu);
+ __clear_bit(dev->bit, bitmap);
+@@ -396,6 +399,7 @@ static void dev_map_flush_old(struct bpf
+ bq = per_cpu_ptr(dev->bulkq, cpu);
+ bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, false);
+ }
++ rcu_read_unlock();
+ }
+ }
+
diff --git a/patches.drivers/bpf-devmap-Add-missing-bulk-queue-free.patch b/patches.drivers/bpf-devmap-Add-missing-bulk-queue-free.patch
new file mode 100644
index 0000000000..dd4414fa1b
--- /dev/null
+++ b/patches.drivers/bpf-devmap-Add-missing-bulk-queue-free.patch
@@ -0,0 +1,28 @@
+From: Toshiaki Makita <toshiaki.makita1@gmail.com>
+Date: Fri, 14 Jun 2019 17:20:14 +0900
+Subject: bpf, devmap: Add missing bulk queue free
+Patch-mainline: v5.2-rc6
+Git-commit: edabf4d9dd905acd60048ea1579943801e3a4876
+References: bsc#1109837
+
+dev_map_free() forgot to free bulk queue when freeing its entries.
+
+Fixes: 5d053f9da431 ("bpf: devmap prepare xdp frames for bulking")
+Signed-off-by: Toshiaki Makita <toshiaki.makita1@gmail.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/devmap.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -186,6 +186,7 @@ static void dev_map_free(struct bpf_map
+ if (!dev)
+ continue;
+
++ free_percpu(dev->bulkq);
+ dev_put(dev->dev);
+ kfree(dev);
+ }
diff --git a/patches.drivers/bpf-devmap-Fix-premature-entry-free-on-destroying-ma.patch b/patches.drivers/bpf-devmap-Fix-premature-entry-free-on-destroying-ma.patch
new file mode 100644
index 0000000000..ec50edbdb5
--- /dev/null
+++ b/patches.drivers/bpf-devmap-Fix-premature-entry-free-on-destroying-ma.patch
@@ -0,0 +1,45 @@
+From: Toshiaki Makita <toshiaki.makita1@gmail.com>
+Date: Fri, 14 Jun 2019 17:20:13 +0900
+Subject: bpf, devmap: Fix premature entry free on destroying map
+Patch-mainline: v5.2-rc6
+Git-commit: d4dd153d551634683fccf8881f606fa9f3dfa1ef
+References: bsc#1109837
+
+dev_map_free() waits for flush_needed bitmap to be empty in order to
+ensure all flush operations have completed before freeing its entries.
+However the corresponding clear_bit() was called before using the
+entries, so the entries could be used after free.
+
+All access to the entries needs to be done before clearing the bit.
+It seems commit a5e2da6e9787 ("bpf: netdev is never null in
+__dev_map_flush") accidentally changed the clear_bit() and memory access
+order.
+
+Note that the problem happens only in __dev_map_flush(), not in
+dev_map_flush_old(). dev_map_flush_old() is called only after nulling
+out the corresponding netdev_map entry, so dev_map_free() never frees
+the entry thus no such race happens there.
+
+Fixes: a5e2da6e9787 ("bpf: netdev is never null in __dev_map_flush")
+Signed-off-by: Toshiaki Makita <toshiaki.makita1@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/devmap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -291,10 +291,10 @@ void __dev_map_flush(struct bpf_map *map
+ if (unlikely(!dev))
+ continue;
+
+- __clear_bit(bit, bitmap);
+-
+ bq = this_cpu_ptr(dev->bulkq);
+ bq_xmit_all(dev, bq, XDP_XMIT_FLUSH, true);
++
++ __clear_bit(bit, bitmap);
+ }
+ }
+
diff --git a/patches.drivers/bpf-devmap-fix-use-after-free-Read-in-__dev_map_entr.patch b/patches.drivers/bpf-devmap-fix-use-after-free-Read-in-__dev_map_entr.patch
new file mode 100644
index 0000000000..3806ef39ea
--- /dev/null
+++ b/patches.drivers/bpf-devmap-fix-use-after-free-Read-in-__dev_map_entr.patch
@@ -0,0 +1,120 @@
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 13 May 2019 09:59:16 -0700
+Subject: bpf: devmap: fix use-after-free Read in __dev_map_entry_free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.2-rc2
+Git-commit: 2baae3545327632167c0180e9ca1d467416f1919
+References: bsc#1109837
+
+synchronize_rcu() is fine when the rcu callbacks only need
+to free memory (kfree_rcu() or direct kfree() call rcu call backs)
+
+__dev_map_entry_free() is a bit more complex, so we need to make
+sure that call queued __dev_map_entry_free() callbacks have completed.
+
+sysbot report:
+
+BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:365
+[inline]
+BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a8/0x300
+kernel/bpf/devmap.c:379
+Read of size 8 at addr ffff8801b8da38c8 by task ksoftirqd/1/18
+
+CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.17.0+ #39
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
+Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:77 [inline]
+ dump_stack+0x1b9/0x294 lib/dump_stack.c:113
+ print_address_description+0x6c/0x20b mm/kasan/report.c:256
+ kasan_report_error mm/kasan/report.c:354 [inline]
+ kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
+ __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
+ dev_map_flush_old kernel/bpf/devmap.c:365 [inline]
+ __dev_map_entry_free+0x2a8/0x300 kernel/bpf/devmap.c:379
+ __rcu_reclaim kernel/rcu/rcu.h:178 [inline]
+ rcu_do_batch kernel/rcu/tree.c:2558 [inline]
+ invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline]
+ __rcu_process_callbacks kernel/rcu/tree.c:2785 [inline]
+ rcu_process_callbacks+0xe9d/0x1760 kernel/rcu/tree.c:2802
+ __do_softirq+0x2e0/0xaf5 kernel/softirq.c:284
+ run_ksoftirqd+0x86/0x100 kernel/softirq.c:645
+ smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
+ kthread+0x345/0x410 kernel/kthread.c:240
+ ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
+
+Allocated by task 6675:
+ save_stack+0x43/0xd0 mm/kasan/kasan.c:448
+ set_track mm/kasan/kasan.c:460 [inline]
+ kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
+ kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
+ kmalloc include/linux/slab.h:513 [inline]
+ kzalloc include/linux/slab.h:706 [inline]
+ dev_map_alloc+0x208/0x7f0 kernel/bpf/devmap.c:102
+ find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
+ map_create+0x393/0x1010 kernel/bpf/syscall.c:453
+ __do_sys_bpf kernel/bpf/syscall.c:2351 [inline]
+ __se_sys_bpf kernel/bpf/syscall.c:2328 [inline]
+ __x64_sys_bpf+0x303/0x510 kernel/bpf/syscall.c:2328
+ do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
+
+Freed by task 26:
+ save_stack+0x43/0xd0 mm/kasan/kasan.c:448
+ set_track mm/kasan/kasan.c:460 [inline]
+ __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
+ kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
+ __cache_free mm/slab.c:3498 [inline]
+ kfree+0xd9/0x260 mm/slab.c:3813
+ dev_map_free+0x4fa/0x670 kernel/bpf/devmap.c:191
+ bpf_map_free_deferred+0xba/0xf0 kernel/bpf/syscall.c:262
+ process_one_work+0xc64/0x1b70 kernel/workqueue.c:2153
+ worker_thread+0x181/0x13a0 kernel/workqueue.c:2296
+ kthread+0x345/0x410 kernel/kthread.c:240
+ ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:412
+
+The buggy address belongs to the object at ffff8801b8da37c0
+ which belongs to the cache kmalloc-512 of size 512
+The buggy address is located 264 bytes inside of
+ 512-byte region [ffff8801b8da37c0, ffff8801b8da39c0)
+The buggy address belongs to the page:
+page:ffffea0006e368c0 count:1 mapcount:0 mapping:ffff8801da800940
+index:0xffff8801b8da3540
+flags: 0x2fffc0000000100(slab)
+raw: 02fffc0000000100 ffffea0007217b88 ffffea0006e30cc8 ffff8801da800940
+raw: ffff8801b8da3540 ffff8801b8da3040 0000000100000004 0000000000000000
+page dumped because: kasan: bad access detected
+
+Memory state around the buggy address:
+ ffff8801b8da3780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
+ ffff8801b8da3800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+> ffff8801b8da3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ^
+ ffff8801b8da3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
+ ffff8801b8da3980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+
+Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot+457d3e2ffbcf31aee5c0@syzkaller.appspotmail.com
+Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/devmap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/kernel/bpf/devmap.c
++++ b/kernel/bpf/devmap.c
+@@ -164,6 +164,9 @@ static void dev_map_free(struct bpf_map
+ bpf_clear_redirect_map(map);
+ synchronize_rcu();
+
++ /* Make sure prior __dev_map_entry_free() have completed. */
++ rcu_barrier();
++
+ /* To ensure all pending flush operations have completed wait for flush
+ * bitmap to indicate all flush_needed bits to be zero on _all_ cpus.
+ * Because the above synchronize_rcu() ensures the map is disconnected
diff --git a/patches.drivers/bpf-lpm_trie-check-left-child-of-last-leftmost-node-.patch b/patches.drivers/bpf-lpm_trie-check-left-child-of-last-leftmost-node-.patch
new file mode 100644
index 0000000000..7c13a3b4da
--- /dev/null
+++ b/patches.drivers/bpf-lpm_trie-check-left-child-of-last-leftmost-node-.patch
@@ -0,0 +1,124 @@
+From: Jonathan Lemon <jonathan.lemon@gmail.com>
+Date: Sat, 8 Jun 2019 12:54:19 -0700
+Subject: bpf: lpm_trie: check left child of last leftmost node for NULL
+Patch-mainline: v5.2-rc6
+Git-commit: da2577fdd0932ea4eefe73903f1130ee366767d2
+References: bsc#1109837
+
+If the leftmost parent node of the tree has does not have a child
+on the left side, then trie_get_next_key (and bpftool map dump) will
+not look at the child on the right. This leads to the traversal
+missing elements.
+
+Lookup is not affected.
+
+Update selftest to handle this case.
+
+Reproducer:
+
+ bpftool map create /sys/fs/bpf/lpm type lpm_trie key 6 \
+ value 1 entries 256 name test_lpm flags 1
+ bpftool map update pinned /sys/fs/bpf/lpm key 8 0 0 0 0 0 value 1
+ bpftool map update pinned /sys/fs/bpf/lpm key 16 0 0 0 0 128 value 2
+ bpftool map dump pinned /sys/fs/bpf/lpm
+
+Returns only 1 element. (2 expected)
+
+Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE")
+Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Acked-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ kernel/bpf/lpm_trie.c | 9 ++++--
+ tools/testing/selftests/bpf/test_lpm_map.c | 41 ++++++++++++++++++++++++++---
+ 2 files changed, 45 insertions(+), 5 deletions(-)
+
+--- a/kernel/bpf/lpm_trie.c
++++ b/kernel/bpf/lpm_trie.c
+@@ -673,9 +673,14 @@ find_leftmost:
+ * have exact two children, so this function will never return NULL.
+ */
+ for (node = search_root; node;) {
+- if (!(node->flags & LPM_TREE_NODE_FLAG_IM))
++ if (node->flags & LPM_TREE_NODE_FLAG_IM) {
++ node = rcu_dereference(node->child[0]);
++ } else {
+ next_node = node;
+- node = rcu_dereference(node->child[0]);
++ node = rcu_dereference(node->child[0]);
++ if (!node)
++ node = rcu_dereference(next_node->child[1]);
++ }
+ }
+ do_copy:
+ next_key->prefixlen = next_node->prefixlen;
+--- a/tools/testing/selftests/bpf/test_lpm_map.c
++++ b/tools/testing/selftests/bpf/test_lpm_map.c
+@@ -562,13 +562,13 @@ static void test_lpm_get_next_key(void)
+
+ /* add one more element (total two) */
+ key_p->prefixlen = 24;
+- inet_pton(AF_INET, "192.168.0.0", key_p->data);
++ inet_pton(AF_INET, "192.168.128.0", key_p->data);
+ assert(bpf_map_update_elem(map_fd, key_p, &value, 0) == 0);
+
+ memset(key_p, 0, key_size);
+ assert(bpf_map_get_next_key(map_fd, NULL, key_p) == 0);
+ assert(key_p->prefixlen == 24 && key_p->data[0] == 192 &&
+- key_p->data[1] == 168 && key_p->data[2] == 0);
++ key_p->data[1] == 168 && key_p->data[2] == 128);
+
+ memset(next_key_p, 0, key_size);
+ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
+@@ -581,7 +581,7 @@ static void test_lpm_get_next_key(void)
+
+ /* Add one more element (total three) */
+ key_p->prefixlen = 24;
+- inet_pton(AF_INET, "192.168.128.0", key_p->data);
++ inet_pton(AF_INET, "192.168.0.0", key_p->data);
+ assert(bpf_map_update_elem(map_fd, key_p, &value, 0) == 0);
+
+ memset(key_p, 0, key_size);
+@@ -617,6 +617,41 @@ static void test_lpm_get_next_key(void)
+ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
+ assert(next_key_p->prefixlen == 24 && next_key_p->data[0] == 192 &&
+ next_key_p->data[1] == 168 && next_key_p->data[2] == 1);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 24 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168 && next_key_p->data[2] == 128);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 16 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == -1 &&
++ errno == ENOENT);
++
++ /* Add one more element (total five) */
++ key_p->prefixlen = 28;
++ inet_pton(AF_INET, "192.168.1.128", key_p->data);
++ assert(bpf_map_update_elem(map_fd, key_p, &value, 0) == 0);
++
++ memset(key_p, 0, key_size);
++ assert(bpf_map_get_next_key(map_fd, NULL, key_p) == 0);
++ assert(key_p->prefixlen == 24 && key_p->data[0] == 192 &&
++ key_p->data[1] == 168 && key_p->data[2] == 0);
++
++ memset(next_key_p, 0, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 28 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168 && next_key_p->data[2] == 1 &&
++ next_key_p->data[3] == 128);
++
++ memcpy(key_p, next_key_p, key_size);
++ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
++ assert(next_key_p->prefixlen == 24 && next_key_p->data[0] == 192 &&
++ next_key_p->data[1] == 168 && next_key_p->data[2] == 1);
+
+ memcpy(key_p, next_key_p, key_size);
+ assert(bpf_map_get_next_key(map_fd, key_p, next_key_p) == 0);
diff --git a/patches.drivers/bpf-sockmap-fix-msg-sg.size-account-on-ingress-skb.patch b/patches.drivers/bpf-sockmap-fix-msg-sg.size-account-on-ingress-skb.patch
new file mode 100644
index 0000000000..70c74d8f3b
--- /dev/null
+++ b/patches.drivers/bpf-sockmap-fix-msg-sg.size-account-on-ingress-skb.patch
@@ -0,0 +1,32 @@
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Mon, 13 May 2019 07:19:55 -0700
+Subject: bpf: sockmap fix msg->sg.size account on ingress skb
+Patch-mainline: v5.2-rc2
+Git-commit: cabede8b4f2b746232aa25730a0b752de1cb82ca
+References: bsc#1109837
+
+When converting a skb to msg->sg we forget to set the size after the
+latest ktls/tls code conversion. This patch can be reached by doing
+a redir into ingress path from BPF skb sock recv hook. Then trying to
+read the size fails.
+
+Fix this by setting the size.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/core/skmsg.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/skmsg.c
++++ b/net/core/skmsg.c
+@@ -402,6 +402,7 @@ static int sk_psock_skb_ingress(struct s
+ sk_mem_charge(sk, skb->len);
+ copied = skb->len;
+ msg->sg.start = 0;
++ msg->sg.size = copied;
+ msg->sg.end = num_sge == MAX_MSG_FRAGS ? 0 : num_sge;
+ msg->skb = skb;
+
diff --git a/patches.drivers/bpf-sockmap-fix-use-after-free-from-sleep-in-psock-b.patch b/patches.drivers/bpf-sockmap-fix-use-after-free-from-sleep-in-psock-b.patch
new file mode 100644
index 0000000000..28454f2ee8
--- /dev/null
+++ b/patches.drivers/bpf-sockmap-fix-use-after-free-from-sleep-in-psock-b.patch
@@ -0,0 +1,84 @@
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Fri, 24 May 2019 08:01:00 -0700
+Subject: bpf: sockmap, fix use after free from sleep in psock backlog
+ workqueue
+Patch-mainline: v5.2-rc6
+Git-commit: bd95e678e0f6e18351ecdc147ca819145db9ed7b
+References: bsc#1109837
+
+Backlog work for psock (sk_psock_backlog) might sleep while waiting
+for memory to free up when sending packets. However, while sleeping
+the socket may be closed and removed from the map by the user space
+side.
+
+This breaks an assumption in sk_stream_wait_memory, which expects the
+wait queue to be still there when it wakes up resulting in a
+use-after-free shown below. To fix his mark sendmsg as MSG_DONTWAIT
+to avoid the sleep altogether. We already set the flag for the
+sendpage case but we missed the case were sendmsg is used.
+Sockmap is currently the only user of skb_send_sock_locked() so only
+the sockmap paths should be impacted.
+
+==================================================================
+BUG: KASAN: use-after-free in remove_wait_queue+0x31/0x70
+Write of size 8 at addr ffff888069a0c4e8 by task kworker/0:2/110
+
+CPU: 0 PID: 110 Comm: kworker/0:2 Not tainted 5.0.0-rc2-00335-g28f9d1a3d4fe-dirty #14
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-2.fc27 04/01/2014
+Workqueue: events sk_psock_backlog
+Call Trace:
+ print_address_description+0x6e/0x2b0
+ ? remove_wait_queue+0x31/0x70
+ kasan_report+0xfd/0x177
+ ? remove_wait_queue+0x31/0x70
+ ? remove_wait_queue+0x31/0x70
+ remove_wait_queue+0x31/0x70
+ sk_stream_wait_memory+0x4dd/0x5f0
+ ? sk_stream_wait_close+0x1b0/0x1b0
+ ? wait_woken+0xc0/0xc0
+ ? tcp_current_mss+0xc5/0x110
+ tcp_sendmsg_locked+0x634/0x15d0
+ ? tcp_set_state+0x2e0/0x2e0
+ ? __kasan_slab_free+0x1d1/0x230
+ ? kmem_cache_free+0x70/0x140
+ ? sk_psock_backlog+0x40c/0x4b0
+ ? process_one_work+0x40b/0x660
+ ? worker_thread+0x82/0x680
+ ? kthread+0x1b9/0x1e0
+ ? ret_from_fork+0x1f/0x30
+ ? check_preempt_curr+0xaf/0x130
+ ? iov_iter_kvec+0x5f/0x70
+ ? kernel_sendmsg_locked+0xa0/0xe0
+ skb_send_sock_locked+0x273/0x3c0
+ ? skb_splice_bits+0x180/0x180
+ ? start_thread+0xe0/0xe0
+ ? update_min_vruntime.constprop.27+0x88/0xc0
+ sk_psock_backlog+0xb3/0x4b0
+ ? strscpy+0xbf/0x1e0
+ process_one_work+0x40b/0x660
+ worker_thread+0x82/0x680
+ ? process_one_work+0x660/0x660
+ kthread+0x1b9/0x1e0
+ ? __kthread_create_on_node+0x250/0x250
+ ret_from_fork+0x1f/0x30
+
+Fixes: 20bf50de3028c ("skbuff: Function to send an skbuf on a socket")
+Reported-by: Jakub Sitnicki <jakub@cloudflare.com>
+Tested-by: Jakub Sitnicki <jakub@cloudflare.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/core/skbuff.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2036,6 +2036,7 @@ do_frag_list:
+ kv.iov_base = skb->data + offset;
+ kv.iov_len = slen;
+ memset(&msg, 0, sizeof(msg));
++ msg.msg_flags = MSG_DONTWAIT;
+
+ ret = kernel_sendmsg_locked(sk, &msg, &kv, 1, slen);
+ if (ret <= 0)
diff --git a/patches.drivers/bpf-sockmap-remove-duplicate-queue-free.patch b/patches.drivers/bpf-sockmap-remove-duplicate-queue-free.patch
new file mode 100644
index 0000000000..90a9d762dc
--- /dev/null
+++ b/patches.drivers/bpf-sockmap-remove-duplicate-queue-free.patch
@@ -0,0 +1,35 @@
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Mon, 13 May 2019 07:19:37 -0700
+Subject: bpf: sockmap remove duplicate queue free
+Patch-mainline: v5.2-rc2
+Git-commit: c42253cc88206fd0e9868c8b2fd7f9e79f9e0e03
+References: bsc#1109837
+
+In tcp bpf remove we free the cork list and purge the ingress msg
+list. However we do this before the ref count reaches zero so it
+could be possible some other access is in progress. In this case
+(tcp close and/or tcp_unhash) we happen to also hold the sock
+lock so no path exists but lets fix it otherwise it is extremely
+fragile and breaks the reference counting rules. Also we already
+check the cork list and ingress msg queue and free them once the
+ref count reaches zero so its wasteful to check twice.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/ipv4/tcp_bpf.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -517,8 +517,6 @@ static void tcp_bpf_remove(struct sock *
+ {
+ struct sk_psock_link *link;
+
+- sk_psock_cork_free(psock);
+- __sk_psock_purge_ingress_msg(psock);
+ while ((link = sk_psock_link_pop(psock))) {
+ sk_psock_unlink(sk, link);
+ sk_psock_free_link(link);
diff --git a/patches.drivers/bpf-tcp-correctly-handle-DONT_WAIT-flags-and-timeo-0.patch b/patches.drivers/bpf-tcp-correctly-handle-DONT_WAIT-flags-and-timeo-0.patch
new file mode 100644
index 0000000000..df5718c01a
--- /dev/null
+++ b/patches.drivers/bpf-tcp-correctly-handle-DONT_WAIT-flags-and-timeo-0.patch
@@ -0,0 +1,38 @@
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Mon, 13 May 2019 21:42:03 -0700
+Subject: bpf, tcp: correctly handle DONT_WAIT flags and timeo == 0
+Patch-mainline: v5.2-rc2
+Git-commit: 5fa2ca7c4a3fc176f31b495e1a704862d8188b53
+References: bsc#1109837
+
+The tcp_bpf_wait_data() routine needs to check timeo != 0 before
+calling sk_wait_event() otherwise we may see unexpected stalls
+on receiver.
+
+Arika did all the leg work here I just formatted, posted and ran
+a few tests.
+
+Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
+Reported-by: Arika Chen <eaglesora@gmail.com>
+Suggested-by: Arika Chen <eaglesora@gmail.com>
+Signed-off-by: John Fastabend <john.fastabend@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/ipv4/tcp_bpf.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -27,7 +27,10 @@ static int tcp_bpf_wait_data(struct sock
+ int flags, long timeo, int *err)
+ {
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+- int ret;
++ int ret = 0;
++
++ if (!timeo)
++ return ret;
+
+ add_wait_queue(sk_sleep(sk), &wait);
+ sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
diff --git a/patches.drivers/can-flexcan-fix-timeout-when-set-small-bitrate.patch b/patches.drivers/can-flexcan-fix-timeout-when-set-small-bitrate.patch
new file mode 100644
index 0000000000..cb63ccfc38
--- /dev/null
+++ b/patches.drivers/can-flexcan-fix-timeout-when-set-small-bitrate.patch
@@ -0,0 +1,59 @@
+From 247e5356a709eb49a0d95ff2a7f07dac05c8252c Mon Sep 17 00:00:00 2001
+From: Joakim Zhang <qiangqing.zhang@nxp.com>
+Date: Thu, 31 Jan 2019 09:37:22 +0000
+Subject: [PATCH] can: flexcan: fix timeout when set small bitrate
+Git-commit: 247e5356a709eb49a0d95ff2a7f07dac05c8252c
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+Current we can meet timeout issue when setting a small bitrate like
+10000 as follows on i.MX6UL EVK board (ipg clock = 66MHZ, per clock =
+30mhz):
+
+| root@imx6ul7d:~# ip link set can0 up type can bitrate 10000
+
+A link change request failed with some changes committed already.
+Interface can0 may have been left with an inconsistent configuration,
+please check.
+
+| RTNETLINK answers: Connection timed out
+
+It is caused by calling of flexcan_chip_unfreeze() timeout.
+
+Originally the code is using usleep_range(10, 20) for unfreeze
+operation, but the patch (8badd65 can: flexcan: avoid calling
+usleep_range from interrupt context) changed it into udelay(10) which is
+only a half delay of before, there're also some other delay changes.
+
+After double to FLEXCAN_TIMEOUT_US to 100 can fix the issue.
+
+Meanwhile, Rasmus Villemoes reported that even with a timeout of 100,
+flexcan_probe() fails on the MPC8309, which requires a value of at least
+140 to work reliably. 250 works for everyone.
+
+Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
+Reviewed-by: Dong Aisheng <aisheng.dong@nxp.com>
+Cc: linux-stable <stable@vger.kernel.org>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/net/can/flexcan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 1c66fb2ad76b..f97c628eb2ad 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -166,7 +166,7 @@
+ #define FLEXCAN_MB_CNT_LENGTH(x) (((x) & 0xf) << 16)
+ #define FLEXCAN_MB_CNT_TIMESTAMP(x) ((x) & 0xffff)
+
+-#define FLEXCAN_TIMEOUT_US (50)
++#define FLEXCAN_TIMEOUT_US (250)
+
+ /* FLEXCAN hardware feature flags
+ *
+--
+2.16.4
+
diff --git a/patches.drivers/ceph-osd_client-add-support-for-CEPH_OSD_OP_GETXATTR.patch b/patches.drivers/ceph-osd_client-add-support-for-CEPH_OSD_OP_GETXATTR.patch
index 27e9cb2d9b..4e2fd36e27 100644
--- a/patches.drivers/ceph-osd_client-add-support-for-CEPH_OSD_OP_GETXATTR.patch
+++ b/patches.drivers/ceph-osd_client-add-support-for-CEPH_OSD_OP_GETXATTR.patch
@@ -9,14 +9,21 @@ Allows for xattr retrieval. Response data buffer allocation is the
responsibility of the osd_req_op_xattr_init() caller.
Signed-off-by: David Disseldorp <ddiss@suse.de>
+[luis: adjusted context due to commit 33165d472310 ("libceph: introduce
+ ceph_pagelist_alloc()")]
+Acked-by: Luis Henriques <lhenriques@suse.com>
+[luis: updated get_num_data_items() introduced by commit 0d9c1ab3be4c
+ ("libceph: preallocate message data items")]
+[luis: rebased atop 26f887e0a3c4 ("libceph, rbd, ceph: move
+ ceph_osdc_alloc_messages() calls")]
---
- include/linux/ceph/osd_client.h | 8 +++++
- net/ceph/osd_client.c | 55 +++++++++++++++++++++++++++++++---------
- 2 files changed, 50 insertions(+), 13 deletions(-)
+ include/linux/ceph/osd_client.h | 8 ++++-
+ net/ceph/osd_client.c | 58 +++++++++++++++++++++++++++++++---------
+ 2 files changed, 52 insertions(+), 14 deletions(-)
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
-@@ -104,7 +104,8 @@ struct ceph_osd_req_op {
+@@ -109,7 +109,8 @@ struct ceph_osd_req_op {
u32 value_len;
__u8 cmp_op; /* CEPH_OSD_CMPXATTR_OP_* */
__u8 cmp_mode; /* CEPH_OSD_CMPXATTR_MODE_* */
@@ -26,7 +33,7 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
} xattr;
struct {
const char *class_name;
-@@ -392,6 +393,11 @@ extern void osd_req_op_raw_data_in_pages
+@@ -401,6 +402,11 @@ extern void osd_req_op_raw_data_in_pages
unsigned int which,
struct page **pages, u64 length,
u32 alignment, bool pages_from_pool,
@@ -40,7 +47,7 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
extern void osd_req_op_writesame_init(struct ceph_osd_request *osd_req,
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
-@@ -308,6 +308,18 @@ void osd_req_op_writesame_osd_data_sg(st
+@@ -369,6 +369,18 @@ void osd_req_op_writesame_osd_data_sg(st
}
EXPORT_SYMBOL(osd_req_op_writesame_osd_data_sg);
@@ -59,7 +66,7 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
static u64 ceph_osd_data_length(struct ceph_osd_data *osd_data)
{
switch (osd_data->type) {
-@@ -366,7 +378,9 @@ static void osd_req_op_data_release(stru
+@@ -431,7 +443,9 @@ static void osd_req_op_data_release(stru
break;
case CEPH_OSD_OP_SETXATTR:
case CEPH_OSD_OP_CMPXATTR:
@@ -70,7 +77,26 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
break;
case CEPH_OSD_OP_STAT:
ceph_osd_data_release(&op->raw_data_in);
-@@ -806,31 +820,44 @@ int osd_req_op_xattr_init(struct ceph_os
+@@ -736,8 +750,6 @@ static void get_num_data_items(struct ce
+ /* request */
+ case CEPH_OSD_OP_WRITE:
+ case CEPH_OSD_OP_WRITEFULL:
+- case CEPH_OSD_OP_SETXATTR:
+- case CEPH_OSD_OP_CMPXATTR:
+ case CEPH_OSD_OP_NOTIFY_ACK:
+ case CEPH_OSD_OP_CMPEXT:
+ case CEPH_OSD_OP_WRITESAME:
+@@ -752,6 +764,9 @@ static void get_num_data_items(struct ce
+ break;
+
+ /* both */
++ case CEPH_OSD_OP_GETXATTR:
++ case CEPH_OSD_OP_SETXATTR:
++ case CEPH_OSD_OP_CMPXATTR:
+ case CEPH_OSD_OP_NOTIFY:
+ *num_request_data_items += 1;
+ *num_reply_data_items += 1;
+@@ -938,29 +953,42 @@ int osd_req_op_xattr_init(struct ceph_os
{
struct ceph_osd_req_op *op = _osd_req_op_init(osd_req, which,
opcode, 0);
@@ -84,15 +110,12 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
+ && opcode != CEPH_OSD_OP_CMPXATTR
+ && opcode != CEPH_OSD_OP_GETXATTR);
-- pagelist = kmalloc(sizeof(*pagelist), GFP_NOFS);
+- pagelist = ceph_pagelist_alloc(GFP_NOFS);
- if (!pagelist)
-+ req_pagelist = kmalloc(sizeof(*req_pagelist), GFP_NOFS);
++ req_pagelist = ceph_pagelist_alloc(GFP_NOFS);
+ if (!req_pagelist)
return -ENOMEM;
-- ceph_pagelist_init(pagelist);
-+ ceph_pagelist_init(req_pagelist);
-
payload_len = strlen(name);
op->xattr.name_len = payload_len;
- ceph_pagelist_append(pagelist, name, payload_len);
@@ -125,7 +148,7 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
}
EXPORT_SYMBOL(osd_req_op_xattr_init);
-@@ -945,6 +972,7 @@ static u32 osd_req_encode_op(struct ceph
+@@ -1077,6 +1105,7 @@ static u32 osd_req_encode_op(struct ceph
break;
case CEPH_OSD_OP_SETXATTR:
case CEPH_OSD_OP_CMPXATTR:
@@ -133,17 +156,18 @@ Signed-off-by: David Disseldorp <ddiss@suse.de>
dst->xattr.name_len = cpu_to_le32(src->xattr.name_len);
dst->xattr.value_len = cpu_to_le32(src->xattr.value_len);
dst->xattr.cmp_op = src->xattr.cmp_op;
-@@ -1853,9 +1881,12 @@ static void setup_request_data(struct ce
+@@ -2018,10 +2047,13 @@ static void setup_request_data(struct ce
break;
case CEPH_OSD_OP_SETXATTR:
case CEPH_OSD_OP_CMPXATTR:
+ case CEPH_OSD_OP_GETXATTR:
WARN_ON(op->indata_len != op->xattr.name_len +
op->xattr.value_len);
-- ceph_osdc_msg_data_add(msg, &op->xattr.osd_data);
-+ ceph_osdc_msg_data_add(msg, &op->xattr.request_data);
-+ ceph_osdc_msg_data_add(req->r_reply,
+ ceph_osdc_msg_data_add(request_msg,
+- &op->xattr.osd_data);
++ &op->xattr.request_data);
++ ceph_osdc_msg_data_add(reply_msg,
+ &op->xattr.response_data);
break;
case CEPH_OSD_OP_NOTIFY_ACK:
- ceph_osdc_msg_data_add(msg,
+ ceph_osdc_msg_data_add(request_msg,
diff --git a/patches.drivers/clk-rockchip-Turn-on-aclk_dmac1-for-suspend-on-rk328.patch b/patches.drivers/clk-rockchip-Turn-on-aclk_dmac1-for-suspend-on-rk328.patch
new file mode 100644
index 0000000000..0569125656
--- /dev/null
+++ b/patches.drivers/clk-rockchip-Turn-on-aclk_dmac1-for-suspend-on-rk328.patch
@@ -0,0 +1,91 @@
+From 57a20248ef3e429dc822f0774bc4e00136c46c83 Mon Sep 17 00:00:00 2001
+From: Douglas Anderson <dianders@chromium.org>
+Date: Thu, 11 Apr 2019 16:21:53 -0700
+Subject: [PATCH] clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288
+Git-commit: 57a20248ef3e429dc822f0774bc4e00136c46c83
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+Experimentally it can be seen that going into deep sleep (specifically
+setting PMU_CLR_DMA and PMU_CLR_BUS in RK3288_PMU_PWRMODE_CON1)
+appears to fail unless "aclk_dmac1" is on. The failure is that the
+system never signals that it made it into suspend on the GLOBAL_PWROFF
+pin and it just hangs.
+
+NOTE that it's confirmed that it's the actual suspend that fails, not
+one of the earlier calls to read/write registers. Specifically if you
+comment out the "PMU_GLOBAL_INT_DISABLE" setting in
+rk3288_slp_mode_set() and then comment out the "cpu_do_idle()" call in
+rockchip_lpmode_enter() then you can exercise the whole suspend path
+without any crashing.
+
+This is currently not a problem with suspend upstream because there is
+no current way to exercise the deep suspend code. However, anyone
+trying to make it work will run into this issue.
+
+This was not a problem on shipping rk3288-based Chromebooks because
+those devices all ran on an old kernel based on 3.14. On that kernel
+"aclk_dmac1" appears to be left on all the time.
+
+There are several ways to skin this problem.
+
+A) We could add "aclk_dmac1" to the list of critical clocks and that
+apperas to work, but presumably that wastes power.
+
+B) We could keep a list of "struct clk" objects to enable at suspend
+time in clk-rk3288.c and use the standard clock APIs.
+
+C) We could make the rk3288-pmu driver keep a list of clocks to enable
+at suspend time. Presumably this would require a dts and bindings
+change.
+
+D) We could just whack the clock on in the existing syscore suspend
+function where we whack a bunch of other clocks. This is particularly
+easy because we know for sure that the clock's only parent
+("aclk_cpu") is a critical clock so we don't need to do anything more
+than ungate it.
+
+In this case I have chosen D) because it seemed like the least work,
+but any of the other options would presumably also work fine.
+
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Reviewed-by: Elaine Zhang <zhangqing@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/rockchip/clk-rk3288.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/drivers/clk/rockchip/clk-rk3288.c b/drivers/clk/rockchip/clk-rk3288.c
+index 961d4ee86b75..e8b5a6bfcc8a 100644
+--- a/drivers/clk/rockchip/clk-rk3288.c
++++ b/drivers/clk/rockchip/clk-rk3288.c
+@@ -861,6 +861,9 @@ static const int rk3288_saved_cru_reg_ids[] = {
+ RK3288_CLKSEL_CON(10),
+ RK3288_CLKSEL_CON(33),
+ RK3288_CLKSEL_CON(37),
++
++ /* We turn aclk_dmac1 on for suspend; this will restore it */
++ RK3288_CLKGATE_CON(10),
+ };
+
+ static u32 rk3288_saved_cru_regs[ARRAY_SIZE(rk3288_saved_cru_reg_ids)];
+@@ -876,6 +879,14 @@ static int rk3288_clk_suspend(void)
+ readl_relaxed(rk3288_cru_base + reg_id);
+ }
+
++ /*
++ * Going into deep sleep (specifically setting PMU_CLR_DMA in
++ * RK3288_PMU_PWRMODE_CON1) appears to fail unless
++ * "aclk_dmac1" is on.
++ */
++ writel_relaxed(1 << (12 + 16),
++ rk3288_cru_base + RK3288_CLKGATE_CON(10));
++
+ /*
+ * Switch PLLs other than DPLL (for SDRAM) to slow mode to
+ * avoid crashes on resume. The Mask ROM on the system will
+--
+2.16.4
+
diff --git a/patches.drivers/clk-tegra-Fix-PLLM-programming-on-Tegra124-when-PMC-.patch b/patches.drivers/clk-tegra-Fix-PLLM-programming-on-Tegra124-when-PMC-.patch
new file mode 100644
index 0000000000..0b70c9eece
--- /dev/null
+++ b/patches.drivers/clk-tegra-Fix-PLLM-programming-on-Tegra124-when-PMC-.patch
@@ -0,0 +1,43 @@
+From 40db569d6769ffa3864fd1b89616b1a7323568a8 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Fri, 12 Apr 2019 00:48:34 +0300
+Subject: [PATCH] clk: tegra: Fix PLLM programming on Tegra124+ when PMC overrides divider
+Git-commit: 40db569d6769ffa3864fd1b89616b1a7323568a8
+Patch-mainline: v5.2-rc1
+References: bsc#1051510
+
+There are wrongly set parenthesis in the code that are resulting in a
+wrong configuration being programmed for PLLM. The original fix was made
+by Danny Huang in the downstream kernel. The patch was tested on Nyan Big
+Tegra124 chromebook, PLLM rate changing works correctly now and system
+doesn't lock up after changing the PLLM rate due to EMC scaling.
+
+Cc: <stable@vger.kernel.org>
+Tested-by: Steev Klimaszewski <steev@kali.org>
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Acked-by: Peter De Schrijver <pdeschrijver@nvidia.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/clk/tegra/clk-pll.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c
+index ebc8481a2122..6b976b2514f7 100644
+--- a/drivers/clk/tegra/clk-pll.c
++++ b/drivers/clk/tegra/clk-pll.c
+@@ -666,8 +666,8 @@ static void _update_pll_mnp(struct tegra_clk_pll *pll,
+ pll_override_writel(val, params->pmc_divp_reg, pll);
+
+ val = pll_override_readl(params->pmc_divnm_reg, pll);
+- val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
+- ~(divn_mask(pll) << div_nmp->override_divn_shift);
++ val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
++ (divn_mask(pll) << div_nmp->override_divn_shift));
+ val |= (cfg->m << div_nmp->override_divm_shift) |
+ (cfg->n << div_nmp->override_divn_shift);
+ pll_override_writel(val, params->pmc_divnm_reg, pll);
+--
+2.16.4
+
diff --git a/patches.drivers/dmaengine-imx-sdma-remove-BD_INTR-for-channel0.patch b/patches.drivers/dmaengine-imx-sdma-remove-BD_INTR-for-channel0.patch
new file mode 100644
index 0000000000..a1620a33ac
--- /dev/null
+++ b/patches.drivers/dmaengine-imx-sdma-remove-BD_INTR-for-channel0.patch
@@ -0,0 +1,58 @@
+From 3f93a4f297961c12bb17aa16cb3a4d1291823cae Mon Sep 17 00:00:00 2001
+From: Robin Gong <yibin.gong@nxp.com>
+Date: Fri, 21 Jun 2019 16:23:06 +0800
+Subject: [PATCH] dmaengine: imx-sdma: remove BD_INTR for channel0
+Git-commit: 3f93a4f297961c12bb17aa16cb3a4d1291823cae
+Patch-mainline: v5.2
+References: bsc#1051510
+
+It is possible for an irq triggered by channel0 to be received later
+after clks are disabled once firmware loaded during sdma probe. If
+that happens then clearing them by writing to SDMA_H_INTR won't work
+and the kernel will hang processing infinite interrupts. Actually,
+don't need interrupt triggered on channel0 since it's pollling
+SDMA_H_STATSTOP to know channel0 done rather than interrupt in
+current code, just clear BD_INTR to disable channel0 interrupt to
+avoid the above case.
+This issue was brought by commit 1d069bfa3c78 ("dmaengine: imx-sdma:
+ack channel 0 IRQ in the interrupt handler") which didn't take care
+the above case.
+
+Fixes: 1d069bfa3c78 ("dmaengine: imx-sdma: ack channel 0 IRQ in the interrupt handler")
+Cc: stable@vger.kernel.org #5.0+
+Signed-off-by: Robin Gong <yibin.gong@nxp.com>
+Reported-by: Sven Van Asbroeck <thesven73@gmail.com>
+Tested-by: Sven Van Asbroeck <thesven73@gmail.com>
+Reviewed-by: Michael Olbrich <m.olbrich@pengutronix.de>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/dma/imx-sdma.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c
+index ba72fcfbebfe..4ec84a633bd3 100644
+--- a/drivers/dma/imx-sdma.c
++++ b/drivers/dma/imx-sdma.c
+@@ -703,7 +703,7 @@ static int sdma_load_script(struct sdma_engine *sdma, void *buf, int size,
+ spin_lock_irqsave(&sdma->channel_0_lock, flags);
+
+ bd0->mode.command = C0_SETPM;
+- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
++ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
+ bd0->mode.count = size / 2;
+ bd0->buffer_addr = buf_phys;
+ bd0->ext_buffer_addr = address;
+@@ -1025,7 +1025,7 @@ static int sdma_load_context(struct sdma_channel *sdmac)
+ context->gReg[7] = sdmac->watermark_level;
+
+ bd0->mode.command = C0_SETDM;
+- bd0->mode.status = BD_DONE | BD_INTR | BD_WRAP | BD_EXTD;
++ bd0->mode.status = BD_DONE | BD_WRAP | BD_EXTD;
+ bd0->mode.count = sizeof(*context) / 4;
+ bd0->buffer_addr = sdma->context_phys;
+ bd0->ext_buffer_addr = 2048 + (sizeof(*context) / 4) * channel;
+--
+2.16.4
+
diff --git a/patches.drivers/documentation-dma-api-fix-a-function-name-of-max_mapping_size b/patches.drivers/documentation-dma-api-fix-a-function-name-of-max_mapping_size
new file mode 100644
index 0000000000..50ef6b870b
--- /dev/null
+++ b/patches.drivers/documentation-dma-api-fix-a-function-name-of-max_mapping_size
@@ -0,0 +1,31 @@
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 7 Jun 2019 16:47:13 +0900
+Subject: Documentation: DMA-API: fix a function name of max_mapping_size
+Git-commit: 99d2b938672944831035bef50c68a6e948e93abf
+Patch-mainline: v5.3-rc1
+References: bsc#1140954
+
+The exported function name is dma_max_mapping_size(), not
+dma_direct_max_mapping_size() so that this patch fixes
+the function name in the documentation.
+
+Fixes: 133d624b1cee ("dma: Introduce dma_max_mapping_size()")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Jonathan Corbet <corbet@lwn.net>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ Documentation/DMA-API.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Documentation/DMA-API.txt
++++ b/Documentation/DMA-API.txt
+@@ -181,7 +181,7 @@ call to set the mask to the value return
+ ::
+
+ size_t
+- dma_direct_max_mapping_size(struct device *dev);
++ dma_max_mapping_size(struct device *dev);
+
+ Returns the maximum size of a mapping for the device. The size parameter
+ of the mapping functions like dma_map_single(), dma_map_page() and
+
diff --git a/patches.drivers/drivers-base-devres-introduce-devm_release_action.patch b/patches.drivers/drivers-base-devres-introduce-devm_release_action.patch
new file mode 100644
index 0000000000..d74bd8d64a
--- /dev/null
+++ b/patches.drivers/drivers-base-devres-introduce-devm_release_action.patch
@@ -0,0 +1,104 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 13 Jun 2019 15:56:18 -0700
+Subject: drivers/base/devres: introduce devm_release_action()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.2-rc5
+Git-commit: 2374b682255184d7ef75fcb507ce5af4995ead32
+References: bsc#1103992 FATE#326009
+
+Patch series "mm/devm_memremap_pages: Fix page release race", v2.
+
+Logan audited the devm_memremap_pages() shutdown path and noticed that
+it was possible to proceed to arch_remove_memory() before all potential
+page references have been reaped.
+
+Introduce a new ->cleanup() callback to do the work of waiting for any
+straggling page references and then perform the percpu_ref_exit() in
+devm_memremap_pages_release() context.
+
+For p2pdma this involves some deeper reworks to reference count
+resources on a per-instance basis rather than a per pci-device basis. A
+modified genalloc api is introduced to convey a driver-private pointer
+through gen_pool_{alloc,free}() interfaces. Also, a
+devm_memunmap_pages() api is introduced since p2pdma does not
+auto-release resources on a setup failure.
+
+The dax and pmem changes pass the nvdimm unit tests, and the p2pdma
+changes should now pass testing with the pci_p2pdma_release() fix.
+Jrme, how does this look for HMM?
+
+This patch (of 6):
+
+The devm_add_action() facility allows a resource allocation routine to
+add custom devm semantics. One such user is devm_memremap_pages().
+
+There is now a need to manually trigger
+devm_memremap_pages_release(). Introduce devm_release_action() so the
+release action can be triggered via a new devm_memunmap_pages() api in a
+follow-on change.
+
+Link: http://lkml.kernel.org/r/155727336530.292046.2926860263201336366.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: "Jérôme Glisse" <jglisse@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/base/devres.c | 24 +++++++++++++++++++++++-
+ include/linux/device.h | 1 +
+ 2 files changed, 24 insertions(+), 1 deletion(-)
+
+--- a/drivers/base/devres.c
++++ b/drivers/base/devres.c
+@@ -754,10 +754,32 @@ void devm_remove_action(struct device *d
+
+ WARN_ON(devres_destroy(dev, devm_action_release, devm_action_match,
+ &devres));
+-
+ }
+ EXPORT_SYMBOL_GPL(devm_remove_action);
+
++/**
++ * devm_release_action() - release previously added custom action
++ * @dev: Device that owns the action
++ * @action: Function implementing the action
++ * @data: Pointer to data passed to @action implementation
++ *
++ * Releases and removes instance of @action previously added by
++ * devm_add_action(). Both action and data should match one of the
++ * existing entries.
++ */
++void devm_release_action(struct device *dev, void (*action)(void *), void *data)
++{
++ struct action_devres devres = {
++ .data = data,
++ .action = action,
++ };
++
++ WARN_ON(devres_release(dev, devm_action_release, devm_action_match,
++ &devres));
++
++}
++EXPORT_SYMBOL_GPL(devm_release_action);
++
+ /*
+ * Managed kmalloc/kfree
+ */
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -703,6 +703,7 @@ void __iomem *devm_ioremap_resource(stru
+ /* allows to add/remove a custom action to devres stack */
+ int devm_add_action(struct device *dev, void (*action)(void *), void *data);
+ void devm_remove_action(struct device *dev, void (*action)(void *), void *data);
++void devm_release_action(struct device *dev, void (*action)(void *), void *data);
+
+ static inline int devm_add_action_or_reset(struct device *dev,
+ void (*action)(void *), void *data)
diff --git a/patches.drivers/failover-allow-name-change-on-IFF_UP-slave-interface.patch b/patches.drivers/failover-allow-name-change-on-IFF_UP-slave-interface.patch
new file mode 100644
index 0000000000..08d0d35041
--- /dev/null
+++ b/patches.drivers/failover-allow-name-change-on-IFF_UP-slave-interface.patch
@@ -0,0 +1,143 @@
+From: Si-Wei Liu <si-wei.liu@oracle.com>
+Date: Mon, 8 Apr 2019 19:45:27 -0400
+Subject: failover: allow name change on IFF_UP slave interfaces
+Patch-mainline: v5.1-rc6
+Git-commit: 8065a779f17e94536a1c4dcee4f9d88011672f97
+References: bsc#1109837
+
+When a netdev appears through hot plug then gets enslaved by a failover
+master that is already up and running, the slave will be opened
+right away after getting enslaved. Today there's a race that userspace
+(udev) may fail to rename the slave if the kernel (net_failover)
+opens the slave earlier than when the userspace rename happens.
+Unlike bond or team, the primary slave of failover can't be renamed by
+userspace ahead of time, since the kernel initiated auto-enslavement is
+unable to, or rather, is never meant to be synchronized with the rename
+request from userspace.
+
+As the failover slave interfaces are not designed to be operated
+directly by userspace apps: IP configuration, filter rules with
+regard to network traffic passing and etc., should all be done on master
+interface. In general, userspace apps only care about the
+name of master interface, while slave names are less important as long
+as admin users can see reliable names that may carry
+other information describing the netdev. For e.g., they can infer that
+"ens3nsby" is a standby slave of "ens3", while for a
+name like "eth0" they can't tell which master it belongs to.
+
+Historically the name of IFF_UP interface can't be changed because
+there might be admin script or management software that is already
+relying on such behavior and assumes that the slave name can't be
+changed once UP. But failover is special: with the in-kernel
+auto-enslavement mechanism, the userspace expectation for device
+enumeration and bring-up order is already broken. Previously initramfs
+and various userspace config tools were modified to bypass failover
+slaves because of auto-enslavement and duplicate MAC address. Similarly,
+in case that users care about seeing reliable slave name, the new type
+of failover slaves needs to be taken care of specifically in userspace
+anyway.
+
+It's less risky to lift up the rename restriction on failover slave
+which is already UP. Although it's possible this change may potentially
+break userspace component (most likely configuration scripts or
+management software) that assumes slave name can't be changed while
+UP, it's relatively a limited and controllable set among all userspace
+components, which can be fixed specifically to listen for the rename
+events on failover slaves. Userspace component interacting with slaves
+is expected to be changed to operate on failover master interface
+instead, as the failover slave is dynamic in nature which may come and
+go at any point. The goal is to make the role of failover slaves less
+relevant, and userspace components should only deal with failover master
+in the long run.
+
+Fixes: 30c8bd5aa8b2 ("net: Introduce generic failover module")
+Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com>
+Reviewed-by: Liran Alon <liran.alon@oracle.com>
+Acked-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/linux/netdevice.h | 3 +++
+ net/core/dev.c | 16 +++++++++++++++-
+ net/core/failover.c | 6 +++---
+ 3 files changed, 21 insertions(+), 4 deletions(-)
+
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1473,6 +1473,7 @@ struct net_device_ops {
+ * @IFF_FAILOVER: device is a failover master device
+ * @IFF_FAILOVER_SLAVE: device is lower dev of a failover master device
+ * @IFF_L3MDEV_RX_HANDLER: only invoke the rx handler of L3 master device
++ * @IFF_LIVE_RENAME_OK: rename is allowed while device is up and running
+ */
+ enum netdev_priv_flags {
+ IFF_802_1Q_VLAN = 1<<0,
+@@ -1505,6 +1506,7 @@ enum netdev_priv_flags {
+ IFF_FAILOVER = 1<<27,
+ IFF_FAILOVER_SLAVE = 1<<28,
+ IFF_L3MDEV_RX_HANDLER = 1<<29,
++ IFF_LIVE_RENAME_OK = 1<<30,
+ };
+
+ #define IFF_802_1Q_VLAN IFF_802_1Q_VLAN
+@@ -1536,6 +1538,7 @@ enum netdev_priv_flags {
+ #define IFF_FAILOVER IFF_FAILOVER
+ #define IFF_FAILOVER_SLAVE IFF_FAILOVER_SLAVE
+ #define IFF_L3MDEV_RX_HANDLER IFF_L3MDEV_RX_HANDLER
++#define IFF_LIVE_RENAME_OK IFF_LIVE_RENAME_OK
+
+ /**
+ * struct net_device - The DEVICE structure.
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -1185,7 +1185,21 @@ int dev_change_name(struct net_device *d
+ BUG_ON(!dev_net(dev));
+
+ net = dev_net(dev);
+- if (dev->flags & IFF_UP)
++
++ /* Some auto-enslaved devices e.g. failover slaves are
++ * special, as userspace might rename the device after
++ * the interface had been brought up and running since
++ * the point kernel initiated auto-enslavement. Allow
++ * live name change even when these slave devices are
++ * up and running.
++ *
++ * Typically, users of these auto-enslaving devices
++ * don't actually care about slave name change, as
++ * they are supposed to operate on master interface
++ * directly.
++ */
++ if (dev->flags & IFF_UP &&
++ likely(!(dev->priv_flags & IFF_LIVE_RENAME_OK)))
+ return -EBUSY;
+
+ write_seqcount_begin(&devnet_rename_seq);
+--- a/net/core/failover.c
++++ b/net/core/failover.c
+@@ -80,14 +80,14 @@ static int failover_slave_register(struc
+ goto err_upper_link;
+ }
+
+- slave_dev->priv_flags |= IFF_FAILOVER_SLAVE;
++ slave_dev->priv_flags |= (IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
+
+ if (fops && fops->slave_register &&
+ !fops->slave_register(slave_dev, failover_dev))
+ return NOTIFY_OK;
+
+ netdev_upper_dev_unlink(slave_dev, failover_dev);
+- slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
++ slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
+ err_upper_link:
+ netdev_rx_handler_unregister(slave_dev);
+ done:
+@@ -121,7 +121,7 @@ int failover_slave_unregister(struct net
+
+ netdev_rx_handler_unregister(slave_dev);
+ netdev_upper_dev_unlink(slave_dev, failover_dev);
+- slave_dev->priv_flags &= ~IFF_FAILOVER_SLAVE;
++ slave_dev->priv_flags &= ~(IFF_FAILOVER_SLAVE | IFF_LIVE_RENAME_OK);
+
+ if (fops && fops->slave_unregister &&
+ !fops->slave_unregister(slave_dev, failover_dev))
diff --git a/patches.drivers/genwqe-Prevent-an-integer-overflow-in-the-ioctl.patch b/patches.drivers/genwqe-Prevent-an-integer-overflow-in-the-ioctl.patch
new file mode 100644
index 0000000000..a33fc71903
--- /dev/null
+++ b/patches.drivers/genwqe-Prevent-an-integer-overflow-in-the-ioctl.patch
@@ -0,0 +1,64 @@
+From 110080cea0d0e4dfdb0b536e7f8a5633ead6a781 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 7 May 2019 11:36:34 +0300
+Subject: [PATCH] genwqe: Prevent an integer overflow in the ioctl
+Git-commit: 110080cea0d0e4dfdb0b536e7f8a5633ead6a781
+Patch-mainline: v5.2-rc4
+References: bsc#1051510
+
+There are a couple potential integer overflows here.
+
+ round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE);
+
+The first thing is that the "m->size + (...)" addition could overflow,
+and the second is that round_up() overflows to zero if the result is
+within PAGE_SIZE of the type max.
+
+In this code, the "m->size" variable is an u64 but we're saving the
+result in "map_size" which is an unsigned long and genwqe_user_vmap()
+takes an unsigned long as well. So I have used ULONG_MAX as the upper
+bound. From a practical perspective unsigned long is fine/better than
+trying to change all the types to u64.
+
+Fixes: eaf4722d4645 ("GenWQE Character device and DDCB queue")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/misc/genwqe/card_dev.c | 2 ++
+ drivers/misc/genwqe/card_utils.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
+index 8c1b63a4337b..d2098b4d2945 100644
+--- a/drivers/misc/genwqe/card_dev.c
++++ b/drivers/misc/genwqe/card_dev.c
+@@ -780,6 +780,8 @@ static int genwqe_pin_mem(struct genwqe_file *cfile, struct genwqe_mem *m)
+
+ if ((m->addr == 0x0) || (m->size == 0))
+ return -EINVAL;
++ if (m->size > ULONG_MAX - PAGE_SIZE - (m->addr & ~PAGE_MASK))
++ return -EINVAL;
+
+ map_addr = (m->addr & PAGE_MASK);
+ map_size = round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE);
+diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
+index 89cff9d1012b..7571700abc6e 100644
+--- a/drivers/misc/genwqe/card_utils.c
++++ b/drivers/misc/genwqe/card_utils.c
+@@ -586,6 +586,10 @@ int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr,
+ /* determine space needed for page_list. */
+ data = (unsigned long)uaddr;
+ offs = offset_in_page(data);
++ if (size > ULONG_MAX - PAGE_SIZE - offs) {
++ m->size = 0; /* mark unused and not added */
++ return -EINVAL;
++ }
+ m->nr_pages = DIV_ROUND_UP(offs + size, PAGE_SIZE);
+
+ m->page_list = kcalloc(m->nr_pages,
+--
+2.16.4
+
diff --git a/patches.drivers/gpio-omap-fix-lack-of-irqstatus_raw0-for-OMAP4.patch b/patches.drivers/gpio-omap-fix-lack-of-irqstatus_raw0-for-OMAP4.patch
new file mode 100644
index 0000000000..0cc1d96d08
--- /dev/null
+++ b/patches.drivers/gpio-omap-fix-lack-of-irqstatus_raw0-for-OMAP4.patch
@@ -0,0 +1,45 @@
+From 64ea3e9094a1f13b96c33244a3fb3a0f45690bd2 Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Mon, 10 Jun 2019 20:10:45 +0300
+Subject: [PATCH] gpio: omap: fix lack of irqstatus_raw0 for OMAP4
+Git-commit: 64ea3e9094a1f13b96c33244a3fb3a0f45690bd2
+Patch-mainline: v5.3-rc1
+References: bsc#1051510
+
+Commit 384ebe1c2849 ("gpio/omap: Add DT support to GPIO driver") added
+the register definition tables to the gpio-omap driver. Subsequently to
+that commit, commit 4e962e8998cc ("gpio/omap: remove cpu_is_omapxxxx()
+checks from *_runtime_resume()") added definitions for irqstatus_raw*
+registers to the legacy OMAP4 definitions, but missed the DT
+definitions.
+
+This causes an unintentional change of behaviour for the 1.101 errata
+workaround on OMAP4 platforms. Fix this oversight.
+
+Fixes: 4e962e8998cc ("gpio/omap: remove cpu_is_omapxxxx() checks from *_runtime_resume()")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Tested-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/gpio/gpio-omap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
+index 2c6d46396834..44b214e5cefb 100644
+--- a/drivers/gpio/gpio-omap.c
++++ b/drivers/gpio/gpio-omap.c
+@@ -1457,6 +1457,8 @@ static struct omap_gpio_reg_offs omap4_gpio_regs = {
+ .clr_dataout = OMAP4_GPIO_CLEARDATAOUT,
+ .irqstatus = OMAP4_GPIO_IRQSTATUS0,
+ .irqstatus2 = OMAP4_GPIO_IRQSTATUS1,
++ .irqstatus_raw0 = OMAP4_GPIO_IRQSTATUSRAW0,
++ .irqstatus_raw1 = OMAP4_GPIO_IRQSTATUSRAW1,
+ .irqenable = OMAP4_GPIO_IRQSTATUSSET0,
+ .irqenable2 = OMAP4_GPIO_IRQSTATUSSET1,
+ .set_irqenable = OMAP4_GPIO_IRQSTATUSSET0,
+--
+2.16.4
+
diff --git a/patches.drivers/hwmon-k10temp-add-support-for-amd-family-17h-model-30h-cpus.patch b/patches.drivers/hwmon-k10temp-add-support-for-amd-family-17h-model-30h-cpus.patch
index ff0d2050cd..3fc875e0e6 100644
--- a/patches.drivers/hwmon-k10temp-add-support-for-amd-family-17h-model-30h-cpus.patch
+++ b/patches.drivers/hwmon-k10temp-add-support-for-amd-family-17h-model-30h-cpus.patch
@@ -1,9 +1,11 @@
+From 210ba1201ff950b3d05bfd8fa5d47540cea393c0 Mon Sep 17 00:00:00 2001
From: "Woods, Brian" <Brian.Woods@amd.com>
Date: Tue, 6 Nov 2018 20:08:21 +0000
-Subject: hwmon/k10temp: Add support for AMD family 17h, model 30h CPUs
-Git-commit: 210ba1201ff950b3d05bfd8fa5d47540cea393c0
-Patch-mainline: v5.0-rc1
+Subject: [PATCH] hwmon/k10temp: Add support for AMD family 17h, model 30h CPUs
+
References: fate#326884
+Patch-mainline: v5.0-rc1
+Git-commit: 210ba1201ff950b3d05bfd8fa5d47540cea393c0
Add support for AMD family 17h model 30h processors for k10temp. Model
30h is functionally the same as model 01h processors (as far as k10temp
@@ -25,12 +27,14 @@ CC: Thomas Gleixner <tglx@linutronix.de>
CC: x86-ml <x86@kernel.org>
Link: http://lkml.kernel.org/r/20181106200754.60722-5-brian.woods@amd.com
---
- drivers/hwmon/k10temp.c | 1 +
+ drivers/hwmon/k10temp.c | 1 +
1 file changed, 1 insertion(+)
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index bc6871c8dd4e..9790f1f5eb98 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
-@@ -215,6 +215,7 @@ static const struct pci_device_id k10tem
+@@ -360,6 +360,7 @@ static const struct pci_device_id k10temp_id_table[] = {
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_M10H_DF_F3) },
@@ -38,3 +42,6 @@ Link: http://lkml.kernel.org/r/20181106200754.60722-5-brian.woods@amd.com
{}
};
MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+--
+2.21.0
+
diff --git a/patches.drivers/i2c-mlxcpld-Add-support-for-extended-transaction-len.patch b/patches.drivers/i2c-mlxcpld-Add-support-for-extended-transaction-len.patch
new file mode 100644
index 0000000000..63ae7ebcbd
--- /dev/null
+++ b/patches.drivers/i2c-mlxcpld-Add-support-for-extended-transaction-len.patch
@@ -0,0 +1,85 @@
+From: Michael Shych <michaelsh@mellanox.com>
+Date: Tue, 27 Mar 2018 14:01:22 +0000
+Subject: i2c: mlxcpld: Add support for extended transaction length for
+ i2c-mlxcpld
+Patch-mainline: v4.18-rc1
+Git-commit: 313ce648b5a4ac8ceed63a36570126b7684165a0
+References: bsc#1112374
+
+It adds support for extended length of read and write transactions.
+New CPLD logic allows double size of the read and write transactions
+length. This feature is verified through capability register, which is
+renamed from unclear LPF_REG to CPBLTY_REG. Two bits 5 and 6 of these
+register are used for length capability detection, while only 01
+combination indicates support of extended transaction length.
+Others mean lack of such support.
+
+Signed-off-by: Michael Shych <michaelsh@mellanox.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/i2c/busses/i2c-mlxcpld.c | 19 +++++++++++++++++--
+ 1 file changed, 17 insertions(+), 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -45,13 +45,15 @@
+ #define MLXCPLD_I2C_VALID_FLAG (I2C_M_RECV_LEN | I2C_M_RD)
+ #define MLXCPLD_I2C_BUS_NUM 1
+ #define MLXCPLD_I2C_DATA_REG_SZ 36
++#define MLXCPLD_I2C_DATA_SZ_BIT BIT(5)
++#define MLXCPLD_I2C_DATA_SZ_MASK GENMASK(6, 5)
+ #define MLXCPLD_I2C_MAX_ADDR_LEN 4
+ #define MLXCPLD_I2C_RETR_NUM 2
+ #define MLXCPLD_I2C_XFER_TO 500000 /* usec */
+ #define MLXCPLD_I2C_POLL_TIME 2000 /* usec */
+
+ /* LPC I2C registers */
+-#define MLXCPLD_LPCI2C_LPF_REG 0x0
++#define MLXCPLD_LPCI2C_CPBLTY_REG 0x0
+ #define MLXCPLD_LPCI2C_CTRL_REG 0x1
+ #define MLXCPLD_LPCI2C_HALF_CYC_REG 0x4
+ #define MLXCPLD_LPCI2C_I2C_HOLD_REG 0x5
+@@ -230,7 +232,7 @@ static void mlxcpld_i2c_set_transf_data(
+ * All upper layers currently are never use transfer with more than
+ * 2 messages. Actually, it's also not so relevant in Mellanox systems
+ * because of HW limitation. Max size of transfer is not more than 32
+- * bytes in the current x86 LPCI2C bridge.
++ * or 68 bytes in the current x86 LPCI2C bridge.
+ */
+ priv->xfer.cmd = msgs[num - 1].flags & I2C_M_RD;
+
+@@ -440,6 +442,13 @@ static struct i2c_adapter_quirks mlxcpld
+ .max_comb_1st_msg_len = 4,
+ };
+
++static const struct i2c_adapter_quirks mlxcpld_i2c_quirks_ext = {
++ .flags = I2C_AQ_COMB_WRITE_THEN_READ,
++ .max_read_len = MLXCPLD_I2C_DATA_REG_SZ * 2 - MLXCPLD_I2C_MAX_ADDR_LEN,
++ .max_write_len = MLXCPLD_I2C_DATA_REG_SZ * 2,
++ .max_comb_1st_msg_len = 4,
++};
++
+ static struct i2c_adapter mlxcpld_i2c_adapter = {
+ .owner = THIS_MODULE,
+ .name = "i2c-mlxcpld",
+@@ -454,6 +463,7 @@ static int mlxcpld_i2c_probe(struct plat
+ {
+ struct mlxcpld_i2c_priv *priv;
+ int err;
++ u8 val;
+
+ priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+@@ -466,6 +476,11 @@ static int mlxcpld_i2c_probe(struct plat
+
+ /* Register with i2c layer */
+ mlxcpld_i2c_adapter.timeout = usecs_to_jiffies(MLXCPLD_I2C_XFER_TO);
++ /* Read capability register */
++ mlxcpld_i2c_read_comm(priv, MLXCPLD_LPCI2C_CPBLTY_REG, &val, 1);
++ /* Check support for extended transaction length */
++ if ((val & MLXCPLD_I2C_DATA_SZ_MASK) == MLXCPLD_I2C_DATA_SZ_BIT)
++ mlxcpld_i2c_adapter.quirks = &mlxcpld_i2c_quirks_ext;
+ priv->adap = mlxcpld_i2c_adapter;
+ priv->adap.dev.parent = &pdev->dev;
+ priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
diff --git a/patches.drivers/i2c-mlxcpld-Add-support-for-smbus-block-read-transac.patch b/patches.drivers/i2c-mlxcpld-Add-support-for-smbus-block-read-transac.patch
new file mode 100644
index 0000000000..0a8141cef2
--- /dev/null
+++ b/patches.drivers/i2c-mlxcpld-Add-support-for-smbus-block-read-transac.patch
@@ -0,0 +1,107 @@
+From: Michael Shych <michaelsh@mellanox.com>
+Date: Tue, 27 Mar 2018 14:01:23 +0000
+Subject: i2c: mlxcpld: Add support for smbus block read transaction
+Patch-mainline: v4.18-rc1
+Git-commit: c9bfdc7c16cbc16348ede102f21d0c5c1338cee8
+References: bsc#1112374
+
+It adds support for smbus block read transaction. CPLD smbus block read bit
+of capability register is verified during driver initialization, and driver
+data is updated if such capability is available. In case an upper layer
+requests a read transaction of length one and expects that length will be
+the first received byte, driver will notify CPLD about SMBus block read
+transaction flavor, so CPLD will know to execute such kind of transaction.
+
+Signed-off-by: Michael Shych <michaelsh@mellanox.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/i2c/busses/i2c-mlxcpld.c | 38 ++++++++++++++++++++++++++++++++------
+ 1 file changed, 32 insertions(+), 6 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -47,6 +47,7 @@
+ #define MLXCPLD_I2C_DATA_REG_SZ 36
+ #define MLXCPLD_I2C_DATA_SZ_BIT BIT(5)
+ #define MLXCPLD_I2C_DATA_SZ_MASK GENMASK(6, 5)
++#define MLXCPLD_I2C_SMBUS_BLK_BIT BIT(7)
+ #define MLXCPLD_I2C_MAX_ADDR_LEN 4
+ #define MLXCPLD_I2C_RETR_NUM 2
+ #define MLXCPLD_I2C_XFER_TO 500000 /* usec */
+@@ -85,6 +86,7 @@ struct mlxcpld_i2c_priv {
+ struct mutex lock;
+ struct mlxcpld_i2c_curr_xfer xfer;
+ struct device *dev;
++ bool smbus_block;
+ };
+
+ static void mlxcpld_i2c_lpc_write_buf(u8 *data, u8 len, u32 addr)
+@@ -297,7 +299,7 @@ static int mlxcpld_i2c_wait_for_free(str
+ static int mlxcpld_i2c_wait_for_tc(struct mlxcpld_i2c_priv *priv)
+ {
+ int status, i, timeout = 0;
+- u8 datalen;
++ u8 datalen, val;
+
+ do {
+ usleep_range(MLXCPLD_I2C_POLL_TIME / 2, MLXCPLD_I2C_POLL_TIME);
+@@ -326,9 +328,22 @@ static int mlxcpld_i2c_wait_for_tc(struc
+ * Actual read data len will be always the same as
+ * requested len. 0xff (line pull-up) will be returned
+ * if slave has no data to return. Thus don't read
+- * MLXCPLD_LPCI2C_NUM_DAT_REG reg from CPLD.
++ * MLXCPLD_LPCI2C_NUM_DAT_REG reg from CPLD. Only in case of
++ * SMBus block read transaction data len can be different,
++ * check this case.
+ */
+- datalen = priv->xfer.data_len;
++ mlxcpld_i2c_read_comm(priv, MLXCPLD_LPCI2C_NUM_ADDR_REG, &val,
++ 1);
++ if (priv->smbus_block && (val & MLXCPLD_I2C_SMBUS_BLK_BIT)) {
++ mlxcpld_i2c_read_comm(priv, MLXCPLD_LPCI2C_NUM_DAT_REG,
++ &datalen, 1);
++ if (unlikely(datalen > (I2C_SMBUS_BLOCK_MAX + 1))) {
++ dev_err(priv->dev, "Incorrect smbus block read message len\n");
++ return -E2BIG;
++ }
++ } else {
++ datalen = priv->xfer.data_len;
++ }
+
+ mlxcpld_i2c_read_comm(priv, MLXCPLD_LPCI2C_DATA_REG,
+ priv->xfer.msg[i].buf, datalen);
+@@ -346,12 +361,20 @@ static int mlxcpld_i2c_wait_for_tc(struc
+ static void mlxcpld_i2c_xfer_msg(struct mlxcpld_i2c_priv *priv)
+ {
+ int i, len = 0;
+- u8 cmd;
++ u8 cmd, val;
+
+ mlxcpld_i2c_write_comm(priv, MLXCPLD_LPCI2C_NUM_DAT_REG,
+ &priv->xfer.data_len, 1);
+- mlxcpld_i2c_write_comm(priv, MLXCPLD_LPCI2C_NUM_ADDR_REG,
+- &priv->xfer.addr_width, 1);
++
++ val = priv->xfer.addr_width;
++ /* Notify HW about SMBus block read transaction */
++ if (priv->smbus_block && priv->xfer.msg_num >= 2 &&
++ priv->xfer.msg[1].len == 1 &&
++ (priv->xfer.msg[1].flags & I2C_M_RECV_LEN) &&
++ (priv->xfer.msg[1].flags & I2C_M_RD))
++ val |= MLXCPLD_I2C_SMBUS_BLK_BIT;
++
++ mlxcpld_i2c_write_comm(priv, MLXCPLD_LPCI2C_NUM_ADDR_REG, &val, 1);
+
+ for (i = 0; i < priv->xfer.msg_num; i++) {
+ if ((priv->xfer.msg[i].flags & I2C_M_RD) != I2C_M_RD) {
+@@ -481,6 +504,9 @@ static int mlxcpld_i2c_probe(struct plat
+ /* Check support for extended transaction length */
+ if ((val & MLXCPLD_I2C_DATA_SZ_MASK) == MLXCPLD_I2C_DATA_SZ_BIT)
+ mlxcpld_i2c_adapter.quirks = &mlxcpld_i2c_quirks_ext;
++ /* Check support for smbus block transaction */
++ if (val & MLXCPLD_I2C_SMBUS_BLK_BIT)
++ priv->smbus_block = true;
+ priv->adap = mlxcpld_i2c_adapter;
+ priv->adap.dev.parent = &pdev->dev;
+ priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
diff --git a/patches.drivers/i2c-mlxcpld-Allow-configurable-adapter-id-for-mlxcpl.patch b/patches.drivers/i2c-mlxcpld-Allow-configurable-adapter-id-for-mlxcpl.patch
new file mode 100644
index 0000000000..3d653db97d
--- /dev/null
+++ b/patches.drivers/i2c-mlxcpld-Allow-configurable-adapter-id-for-mlxcpl.patch
@@ -0,0 +1,29 @@
+From: Michael Shych <michaelsh@mellanox.com>
+Date: Tue, 27 Mar 2018 14:01:25 +0000
+Subject: i2c: mlxcpld: Allow configurable adapter id for mlxcpld
+Patch-mainline: v4.18-rc1
+Git-commit: ae4aa68dd3e4bf16bff6078c1851b832b0b3db1a
+References: bsc#1112374
+
+It allows mlxcpld driver to be connected to pre-defined adapter number
+equal or greater than one, in order to avoid current limitation, assuming
+usage of id number one only.
+
+Signed-off-by: Michael Shych <michaelsh@mellanox.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/i2c/busses/i2c-mlxcpld.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -514,6 +514,8 @@ static int mlxcpld_i2c_probe(struct plat
+ /* Check support for smbus block transaction */
+ if (val & MLXCPLD_I2C_SMBUS_BLK_BIT)
+ priv->smbus_block = true;
++ if (pdev->id >= -1)
++ mlxcpld_i2c_adapter.nr = pdev->id;
+ priv->adap = mlxcpld_i2c_adapter;
+ priv->adap.dev.parent = &pdev->dev;
+ priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
diff --git a/patches.drivers/i2c-mlxcpld-Fix-adapter-functionality-support-callba.patch b/patches.drivers/i2c-mlxcpld-Fix-adapter-functionality-support-callba.patch
new file mode 100644
index 0000000000..db37a6e81a
--- /dev/null
+++ b/patches.drivers/i2c-mlxcpld-Fix-adapter-functionality-support-callba.patch
@@ -0,0 +1,36 @@
+From: Michael Shych <michaelsh@mellanox.com>
+Date: Tue, 27 Mar 2018 14:01:24 +0000
+Subject: i2c: mlxcpld: Fix adapter functionality support callback
+Patch-mainline: v4.18-rc1
+Git-commit: 845f2a6d00791f1f8541ae4c69a70a6be6d21fb8
+References: bsc#1112374
+
+It fixes report about supported functionality.
+Functionality can be different up to CPLD capability.
+
+Fixes: 6bec23bff9149 (i2c: mlxcpld: add master driver for mellanox systems)
+Signed-off-by: Michael Shych <michaelsh@mellanox.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/i2c/busses/i2c-mlxcpld.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -450,7 +450,14 @@ static int mlxcpld_i2c_xfer(struct i2c_a
+
+ static u32 mlxcpld_i2c_func(struct i2c_adapter *adap)
+ {
+- return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_SMBUS_BLOCK_DATA;
++ struct mlxcpld_i2c_priv *priv = i2c_get_adapdata(adap);
++
++ if (priv->smbus_block)
++ return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL |
++ I2C_FUNC_SMBUS_I2C_BLOCK | I2C_FUNC_SMBUS_BLOCK_DATA;
++ else
++ return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL |
++ I2C_FUNC_SMBUS_I2C_BLOCK;
+ }
+
+ static const struct i2c_algorithm mlxcpld_i2c_algo = {
diff --git a/patches.drivers/i2c-mlxcpld-Fix-wrong-initialization-order-in-probe.patch b/patches.drivers/i2c-mlxcpld-Fix-wrong-initialization-order-in-probe.patch
new file mode 100644
index 0000000000..10d4952a8c
--- /dev/null
+++ b/patches.drivers/i2c-mlxcpld-Fix-wrong-initialization-order-in-probe.patch
@@ -0,0 +1,41 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Thu, 16 May 2019 17:15:41 +0000
+Subject: i2c: mlxcpld: Fix wrong initialization order in probe
+Patch-mainline: v5.2-rc3
+Git-commit: 13067ef73f337336e3149f5bb9f3fd05fe7f87a0
+References: bsc#1112374
+
+Fix wrong order in probing routine initialization - field `base_addr'
+is used before it's initialized. Move assignment of 'priv->base_addr`
+to the beginning, prior the call to mlxcpld_i2c_read_comm().
+Wrong order caused the first read of capability register to be executed
+at wrong offset 0x0 instead of 0x2000. By chance it was a "good
+garbage" at 0x0 offset.
+
+Fixes: 313ce648b5a4 ("i2c: mlxcpld: Add support for extended transaction length for i2c-mlxcpld")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Cc: stable@kernel.org
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/i2c/busses/i2c-mlxcpld.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-mlxcpld.c
++++ b/drivers/i2c/busses/i2c-mlxcpld.c
+@@ -503,6 +503,7 @@ static int mlxcpld_i2c_probe(struct plat
+ platform_set_drvdata(pdev, priv);
+
+ priv->dev = &pdev->dev;
++ priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
+
+ /* Register with i2c layer */
+ mlxcpld_i2c_adapter.timeout = usecs_to_jiffies(MLXCPLD_I2C_XFER_TO);
+@@ -518,7 +519,6 @@ static int mlxcpld_i2c_probe(struct plat
+ mlxcpld_i2c_adapter.nr = pdev->id;
+ priv->adap = mlxcpld_i2c_adapter;
+ priv->adap.dev.parent = &pdev->dev;
+- priv->base_addr = MLXPLAT_CPLD_LPC_I2C_BASE_ADDR;
+ i2c_set_adapdata(&priv->adap, priv);
+
+ err = i2c_add_numbered_adapter(&priv->adap);
diff --git a/patches.drivers/i2c-mux-mlxcpld-simplify-code-to-reach-the-adapter.patch b/patches.drivers/i2c-mux-mlxcpld-simplify-code-to-reach-the-adapter.patch
new file mode 100644
index 0000000000..2e647833d6
--- /dev/null
+++ b/patches.drivers/i2c-mux-mlxcpld-simplify-code-to-reach-the-adapter.patch
@@ -0,0 +1,30 @@
+From: Luca Ceresoli <luca@lucaceresoli.net>
+Date: Wed, 3 Oct 2018 17:50:24 +0200
+Subject: i2c: mux: mlxcpld: simplify code to reach the adapter
+Patch-mainline: v4.20-rc1
+Git-commit: 7451dc608564f9f2077c6c895f9c94a815d401e5
+References: bsc#1112374
+
+struct i2c_client has a direct pointer to the adapter, no need to dig
+it out of the struct device tree.
+
+Suggested-by: Peter Rosin <peda@axentia.se>
+Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
+Acked-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Peter Rosin <peda@axentia.se>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/i2c/muxes/i2c-mux-mlxcpld.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/muxes/i2c-mux-mlxcpld.c
++++ b/drivers/i2c/muxes/i2c-mux-mlxcpld.c
+@@ -152,7 +152,7 @@ static int mlxcpld_mux_deselect(struct i
+ static int mlxcpld_mux_probe(struct i2c_client *client,
+ const struct i2c_device_id *id)
+ {
+- struct i2c_adapter *adap = to_i2c_adapter(client->dev.parent);
++ struct i2c_adapter *adap = client->adapter;
+ struct mlxcpld_mux_plat_data *pdata = dev_get_platdata(&client->dev);
+ struct i2c_mux_core *muxc;
+ int num, force;
diff --git a/patches.drivers/ibmvnic-Do-not-close-unopened-driver-during-reset.patch b/patches.drivers/ibmvnic-Do-not-close-unopened-driver-during-reset.patch
index c5a7b22902..9b12047150 100644
--- a/patches.drivers/ibmvnic-Do-not-close-unopened-driver-during-reset.patch
+++ b/patches.drivers/ibmvnic-Do-not-close-unopened-driver-during-reset.patch
@@ -4,8 +4,7 @@ Date: Fri, 7 Jun 2019 16:03:53 -0500
Subject: [PATCH] ibmvnic: Do not close unopened driver during reset
References: bsc#1137752
-Patch-mainline: queued
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+Patch-mainline: v5.2-rc6
Git-commit: 1f94608b0ce141be5286dde31270590bdf35b86a
Check driver state before halting it during a reset. If the driver is
diff --git a/patches.drivers/ibmvnic-Fix-unchecked-return-codes-of-memory-allocat.patch b/patches.drivers/ibmvnic-Fix-unchecked-return-codes-of-memory-allocat.patch
index f730273849..d4743b1b26 100644
--- a/patches.drivers/ibmvnic-Fix-unchecked-return-codes-of-memory-allocat.patch
+++ b/patches.drivers/ibmvnic-Fix-unchecked-return-codes-of-memory-allocat.patch
@@ -4,8 +4,7 @@ Date: Fri, 7 Jun 2019 16:03:55 -0500
Subject: [PATCH] ibmvnic: Fix unchecked return codes of memory allocations
References: bsc#1137752
-Patch-mainline: queued
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+Patch-mainline: v5.2-rc6
Git-commit: 7c940b1a5291e5069d561f5b8f0e51db6b7a259a
The return values for these memory allocations are unchecked,
diff --git a/patches.drivers/ibmvnic-Refresh-device-multicast-list-after-reset.patch b/patches.drivers/ibmvnic-Refresh-device-multicast-list-after-reset.patch
index 2b6d40e8ec..ee71f4f214 100644
--- a/patches.drivers/ibmvnic-Refresh-device-multicast-list-after-reset.patch
+++ b/patches.drivers/ibmvnic-Refresh-device-multicast-list-after-reset.patch
@@ -4,8 +4,7 @@ Date: Fri, 7 Jun 2019 16:03:54 -0500
Subject: [PATCH] ibmvnic: Refresh device multicast list after reset
References: bsc#1137752
-Patch-mainline: queued
-Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git
+Patch-mainline: v5.2-rc6
Git-commit: be32a24372cf162e825332da1a7ccef058d4f20b
It was observed that multicast packets were no longer received after
diff --git a/patches.drivers/iommu-amd-make-iommu_disable-safer b/patches.drivers/iommu-amd-make-iommu_disable-safer
new file mode 100644
index 0000000000..9937554526
--- /dev/null
+++ b/patches.drivers/iommu-amd-make-iommu_disable-safer
@@ -0,0 +1,33 @@
+From: Kevin Mitchell <kevmitch@arista.com>
+Date: Wed, 12 Jun 2019 14:52:03 -0700
+Subject: iommu/amd: Make iommu_disable safer
+Git-commit: 3ddbe913e55516d3e2165d43d4d5570761769878
+Patch-mainline: v5.3-rc1
+References: bsc#1140955
+
+Make it safe to call iommu_disable during early init error conditions
+before mmio_base is set, but after the struct amd_iommu has been added
+to the amd_iommu_list. For example, this happens if firmware fails to
+fill in mmio_phys in the ACPI table leading to a NULL pointer
+dereference in iommu_feature_disable.
+
+Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine')
+Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu_init.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/iommu/amd_iommu_init.c
++++ b/drivers/iommu/amd_iommu_init.c
+@@ -421,6 +421,9 @@ static void iommu_enable(struct amd_iomm
+
+ static void iommu_disable(struct amd_iommu *iommu)
+ {
++ if (!iommu->mmio_base)
++ return;
++
+ /* Disable command buffer */
+ iommu_feature_disable(iommu, CONTROL_CMDBUF_EN);
+
+
diff --git a/patches.drivers/iommu-arm-smmu-avoid-constant-zero-in-tlbi-writes b/patches.drivers/iommu-arm-smmu-avoid-constant-zero-in-tlbi-writes
new file mode 100644
index 0000000000..b3e9bc2ab7
--- /dev/null
+++ b/patches.drivers/iommu-arm-smmu-avoid-constant-zero-in-tlbi-writes
@@ -0,0 +1,74 @@
+From: Robin Murphy <robin.murphy@arm.com>
+Date: Mon, 3 Jun 2019 14:15:37 +0200
+Subject: iommu/arm-smmu: Avoid constant zero in TLBI writes
+Git-commit: 4e4abae311e4b44aaf61f18a826fd7136037f199
+Patch-mainline: v5.2-rc5
+References: bsc#1140956
+
+Apparently, some Qualcomm arm64 platforms which appear to expose their
+SMMU global register space are still, in fact, using a hypervisor to
+mediate it by trapping and emulating register accesses. Sadly, some
+deployed versions of said trapping code have bugs wherein they go
+horribly wrong for stores using r31 (i.e. XZR/WZR) as the source
+register.
+
+While this can be mitigated for GCC today by tweaking the constraints
+for the implementation of writel_relaxed(), to avoid any potential
+arms race with future compilers more aggressively optimising register
+allocation, the simple way is to just remove all the problematic
+constant zeros. For the write-only TLB operations, the actual value is
+irrelevant anyway and any old nearby variable will provide a suitable
+GPR to encode. The one point at which we really do need a zero to clear
+a context bank happens before any of the TLB maintenance where crashes
+have been reported, so is apparently not a problem... :/
+
+Reported-by: AngeloGioacchino Del Regno <kholk11@gmail.com>
+Tested-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Signed-off-by: Robin Murphy <robin.murphy@arm.com>
+Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr>
+Acked-by: Will Deacon <will.deacon@arm.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/arm-smmu.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/arm-smmu.c
++++ b/drivers/iommu/arm-smmu.c
+@@ -252,6 +252,15 @@ enum arm_smmu_s2cr_privcfg {
+ #define SCTLR_TRE (1 << 1)
+ #define SCTLR_M (1 << 0)
+
++/*
++ * Apparently, some Qualcomm arm64 platforms which appear to expose their SMMU
++ * global register space are still, in fact, using a hypervisor to mediate it
++ * by trapping and emulating register accesses. Sadly, some deployed versions
++ * of said trapping code have bugs wherein they go horribly wrong for stores
++ * using r31 (i.e. XZR/WZR) as the source register.
++ */
++#define QCOM_DUMMY_VAL -1
++
+ #define ARM_MMU500_ACTLR_CPRE (1 << 1)
+
+ #define ARM_MMU500_ACR_CACHE_LOCK (1 << 26)
+@@ -588,7 +597,7 @@ static void __arm_smmu_tlb_sync(struct a
+ {
+ unsigned int spin_cnt, delay;
+
+- writel_relaxed(0, sync);
++ writel_relaxed(QCOM_DUMMY_VAL, sync);
+ for (delay = 1; delay < TLB_LOOP_TIMEOUT; delay *= 2) {
+ for (spin_cnt = TLB_SPIN_COUNT; spin_cnt > 0; spin_cnt--) {
+ if (!(readl_relaxed(status) & sTLBGSTATUS_GSACTIVE))
+@@ -1787,8 +1796,8 @@ static void arm_smmu_device_reset(struct
+ }
+
+ /* Invalidate the TLB, just in case */
+- writel_relaxed(0, gr0_base + ARM_SMMU_GR0_TLBIALLH);
+- writel_relaxed(0, gr0_base + ARM_SMMU_GR0_TLBIALLNSNH);
++ writel_relaxed(QCOM_DUMMY_VAL, gr0_base + ARM_SMMU_GR0_TLBIALLH);
++ writel_relaxed(QCOM_DUMMY_VAL, gr0_base + ARM_SMMU_GR0_TLBIALLNSNH);
+
+ reg = readl_relaxed(ARM_SMMU_GR0_NS(smmu) + ARM_SMMU_GR0_sCR0);
+
+
diff --git a/patches.drivers/iommu-fix-a-leak-in-iommu_insert_resv_region b/patches.drivers/iommu-fix-a-leak-in-iommu_insert_resv_region
new file mode 100644
index 0000000000..33400b82d1
--- /dev/null
+++ b/patches.drivers/iommu-fix-a-leak-in-iommu_insert_resv_region
@@ -0,0 +1,55 @@
+From: Eric Auger <eric.auger@redhat.com>
+Date: Mon, 3 Jun 2019 08:53:30 +0200
+Subject: iommu: Fix a leak in iommu_insert_resv_region
+Git-commit: ad0834dedaa15c3a176f783c0373f836e44b4700
+Patch-mainline: v5.3-rc1
+References: bsc#1140957
+
+In case we expand an existing region, we unlink
+this latter and insert the larger one. In
+that case we should free the original region after
+the insertion. Also we can immediately return.
+
+Fixes: 6c65fb318e8b ("iommu: iommu_get_group_resv_regions")
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/iommu.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -205,18 +205,21 @@ static int iommu_insert_resv_region(stru
+ pos = pos->next;
+ } else if ((start >= a) && (end <= b)) {
+ if (new->type == type)
+- goto done;
++ return 0;
+ else
+ pos = pos->next;
+ } else {
+ if (new->type == type) {
+ phys_addr_t new_start = min(a, start);
+ phys_addr_t new_end = max(b, end);
++ int ret;
+
+ list_del(&entry->list);
+ entry->start = new_start;
+ entry->length = new_end - new_start + 1;
+- iommu_insert_resv_region(entry, regions);
++ ret = iommu_insert_resv_region(entry, regions);
++ kfree(entry);
++ return ret;
+ } else {
+ pos = pos->next;
+ }
+@@ -229,7 +232,6 @@ insert:
+ return -ENOMEM;
+
+ list_add_tail(&region->list, pos);
+-done:
+ return 0;
+ }
+
+
diff --git a/patches.drivers/iommu-use-right-function-to-get-group-for-device b/patches.drivers/iommu-use-right-function-to-get-group-for-device
new file mode 100644
index 0000000000..5ac2b0957d
--- /dev/null
+++ b/patches.drivers/iommu-use-right-function-to-get-group-for-device
@@ -0,0 +1,35 @@
+From: Lu Baolu <baolu.lu@linux.intel.com>
+Date: Tue, 21 May 2019 15:27:35 +0800
+Subject: iommu: Use right function to get group for device
+Git-commit: 57274ea25736496ee019a5c40479855b21888839
+Patch-mainline: v5.3-rc1
+References: bsc#1140958
+
+The iommu_group_get_for_dev() will allocate a group for a
+device if it isn't in any group. This isn't the use case
+in iommu_request_dm_for_dev(). Let's use iommu_group_get()
+instead.
+
+Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()")
+Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/iommu.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -1849,9 +1849,9 @@ int iommu_request_dm_for_dev(struct devi
+ int ret;
+
+ /* Device must already be in a group before calling this function */
+- group = iommu_group_get_for_dev(dev);
+- if (IS_ERR(group))
+- return PTR_ERR(group);
++ group = iommu_group_get(dev);
++ if (!group)
++ return -EINVAL;
+
+ mutex_lock(&group->mutex);
+
+
diff --git a/patches.drivers/iommu-vt-d-duplicate-iommu_resv_region-objects-per-device-list b/patches.drivers/iommu-vt-d-duplicate-iommu_resv_region-objects-per-device-list
new file mode 100644
index 0000000000..c7debfec4d
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-duplicate-iommu_resv_region-objects-per-device-list
@@ -0,0 +1,128 @@
+From: Eric Auger <eric.auger@redhat.com>
+Date: Mon, 3 Jun 2019 08:53:31 +0200
+Subject: iommu/vt-d: Duplicate iommu_resv_region objects per device list
+Git-commit: 5f64ce5411b467f1cfea6c63e2494c22b773582b
+Patch-mainline: v5.3-rc1
+References: bsc#1140959
+
+intel_iommu_get_resv_regions() aims to return the list of
+reserved regions accessible by a given @device. However several
+devices can access the same reserved memory region and when
+building the list it is not safe to use a single iommu_resv_region
+object, whose container is the RMRR. This iommu_resv_region must
+be duplicated per device reserved region list.
+
+Let's remove the struct iommu_resv_region from the RMRR unit
+and allocate the iommu_resv_region directly in
+intel_iommu_get_resv_regions(). We hold the dmar_global_lock instead
+of the rcu-lock to allow sleeping.
+
+Fixes: 0659b8dc45a6 ("iommu/vt-d: Implement reserved region get/put callbacks")
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -442,7 +442,6 @@ struct dmar_rmrr_unit {
+ u64 end_address; /* reserved end address */
+ struct dmar_dev_scope *devices; /* target devices */
+ int devices_cnt; /* target device count */
+- struct iommu_resv_region *resv; /* reserved region handle */
+ };
+
+ struct dmar_atsr_unit {
+@@ -4281,7 +4280,6 @@ static inline void init_iommu_pm_ops(voi
+ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg)
+ {
+ struct acpi_dmar_reserved_memory *rmrr;
+- int prot = DMA_PTE_READ|DMA_PTE_WRITE;
+ struct dmar_rmrr_unit *rmrru;
+ size_t length;
+
+@@ -4295,22 +4293,16 @@ int __init dmar_parse_one_rmrr(struct ac
+ rmrru->end_address = rmrr->end_address;
+
+ length = rmrr->end_address - rmrr->base_address + 1;
+- rmrru->resv = iommu_alloc_resv_region(rmrr->base_address, length, prot,
+- IOMMU_RESV_DIRECT);
+- if (!rmrru->resv)
+- goto free_rmrru;
+
+ rmrru->devices = dmar_alloc_dev_scope((void *)(rmrr + 1),
+ ((void *)rmrr) + rmrr->header.length,
+ &rmrru->devices_cnt);
+ if (rmrru->devices_cnt && rmrru->devices == NULL)
+- goto free_all;
++ goto free_rmrru;
+
+ list_add(&rmrru->list, &dmar_rmrr_units);
+
+ return 0;
+-free_all:
+- kfree(rmrru->resv);
+ free_rmrru:
+ kfree(rmrru);
+ out:
+@@ -4528,7 +4520,6 @@ static void intel_iommu_free_dmars(void)
+ list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) {
+ list_del(&rmrru->list);
+ dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt);
+- kfree(rmrru->resv);
+ kfree(rmrru);
+ }
+
+@@ -5308,22 +5299,33 @@ static void intel_iommu_remove_device(st
+ static void intel_iommu_get_resv_regions(struct device *device,
+ struct list_head *head)
+ {
++ int prot = DMA_PTE_READ | DMA_PTE_WRITE;
+ struct iommu_resv_region *reg;
+ struct dmar_rmrr_unit *rmrr;
+ struct device *i_dev;
+ int i;
+
+- rcu_read_lock();
++ down_read(&dmar_global_lock);
+ for_each_rmrr_units(rmrr) {
+ for_each_active_dev_scope(rmrr->devices, rmrr->devices_cnt,
+ i, i_dev) {
++ struct iommu_resv_region *resv;
++ size_t length;
++
+ if (i_dev != device)
+ continue;
+
+- list_add_tail(&rmrr->resv->list, head);
++ length = rmrr->end_address - rmrr->base_address + 1;
++ resv = iommu_alloc_resv_region(rmrr->base_address,
++ length, prot,
++ IOMMU_RESV_DIRECT);
++ if (!resv)
++ break;
++
++ list_add_tail(&resv->list, head);
+ }
+ }
+- rcu_read_unlock();
++ up_read(&dmar_global_lock);
+
+ reg = iommu_alloc_resv_region(IOAPIC_RANGE_START,
+ IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1,
+@@ -5338,10 +5340,8 @@ static void intel_iommu_put_resv_regions
+ {
+ struct iommu_resv_region *entry, *next;
+
+- list_for_each_entry_safe(entry, next, head, list) {
+- if (entry->type == IOMMU_RESV_MSI)
+- kfree(entry);
+- }
++ list_for_each_entry_safe(entry, next, head, list)
++ kfree(entry);
+ }
+
+ #ifdef CONFIG_INTEL_IOMMU_SVM
+
diff --git a/patches.drivers/iommu-vt-d-handle-pci-bridge-rmrr-device-scopes-in-intel_iommu_get_resv_regions b/patches.drivers/iommu-vt-d-handle-pci-bridge-rmrr-device-scopes-in-intel_iommu_get_resv_regions
new file mode 100644
index 0000000000..331e0bbde3
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-handle-pci-bridge-rmrr-device-scopes-in-intel_iommu_get_resv_regions
@@ -0,0 +1,33 @@
+From: Eric Auger <eric.auger@redhat.com>
+Date: Mon, 3 Jun 2019 08:53:34 +0200
+Subject: iommu/vt-d: Handle PCI bridge RMRR device scopes in
+ intel_iommu_get_resv_regions
+Git-commit: 3855ba2d834d8f7727b7f992ff781fa66cc09f96
+Patch-mainline: v5.3-rc1
+References: bsc#1140960
+
+In the case the RMRR device scope is a PCI-PCI bridge, let's check
+the device belongs to the PCI sub-hierarchy.
+
+Fixes: 0659b8dc45a6 ("iommu/vt-d: Implement reserved region get/put callbacks")
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -5313,7 +5313,8 @@ static void intel_iommu_get_resv_regions
+ struct iommu_resv_region *resv;
+ size_t length;
+
+- if (i_dev != device)
++ if (i_dev != device &&
++ !is_downstream_to_pci_bridge(device, i_dev))
+ continue;
+
+ length = rmrr->end_address - rmrr->base_address + 1;
+
diff --git a/patches.drivers/iommu-vt-d-handle-rmrr-with-pci-bridge-device-scopes b/patches.drivers/iommu-vt-d-handle-rmrr-with-pci-bridge-device-scopes
new file mode 100644
index 0000000000..4e10bfbc16
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-handle-rmrr-with-pci-bridge-device-scopes
@@ -0,0 +1,36 @@
+From: Eric Auger <eric.auger@redhat.com>
+Date: Mon, 3 Jun 2019 08:53:33 +0200
+Subject: iommu/vt-d: Handle RMRR with PCI bridge device scopes
+Git-commit: e143fd4598ddf7401d3699957cd59ceb5426d53d
+Patch-mainline: v5.3-rc1
+References: bsc#1140961
+
+When reading the vtd specification and especially the
+Reserved Memory Region Reporting Structure chapter,
+it is not obvious a device scope element cannot be a
+PCI-PCI bridge, in which case all downstream ports are
+likely to access the reserved memory region. Let's handle
+this case in device_has_rmrr.
+
+Fixes: ea2447f700ca ("intel-iommu: Prevent devices with RMRRs from being placed into SI Domain")
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2825,7 +2825,8 @@ static bool device_has_rmrr(struct devic
+ */
+ for_each_active_dev_scope(rmrr->devices,
+ rmrr->devices_cnt, i, tmp)
+- if (tmp == dev) {
++ if (tmp == dev ||
++ is_downstream_to_pci_bridge(dev, tmp)) {
+ rcu_read_unlock();
+ return true;
+ }
+
diff --git a/patches.drivers/iommu-vt-d-introduce-is_downstream_to_pci_bridge-helper b/patches.drivers/iommu-vt-d-introduce-is_downstream_to_pci_bridge-helper
new file mode 100644
index 0000000000..cd867e1f56
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-introduce-is_downstream_to_pci_bridge-helper
@@ -0,0 +1,79 @@
+From: Eric Auger <eric.auger@redhat.com>
+Date: Mon, 3 Jun 2019 08:53:32 +0200
+Subject: iommu/vt-d: Introduce is_downstream_to_pci_bridge helper
+Git-commit: b9a7f9816483b19360b92e9b8c91bea2f9f30308
+Patch-mainline: v5.3-rc1
+References: bsc#1140962
+
+Several call sites are about to check whether a device belongs
+to the PCI sub-hierarchy of a candidate PCI-PCI bridge.
+Introduce an helper to perform that check.
+
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 37 +++++++++++++++++++++++++++++--------
+ 1 file changed, 29 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 082fbb1bdeaf..6747fec46cfb 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -729,12 +729,39 @@ static int iommu_dummy(struct device *dev)
+ return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
+ }
+
++/**
++ * is_downstream_to_pci_bridge - test if a device belongs to the PCI
++ * sub-hierarchy of a candidate PCI-PCI bridge
++ * @dev: candidate PCI device belonging to @bridge PCI sub-hierarchy
++ * @bridge: the candidate PCI-PCI bridge
++ *
++ * Return: true if @dev belongs to @bridge PCI sub-hierarchy, else false.
++ */
++static bool
++is_downstream_to_pci_bridge(struct device *dev, struct device *bridge)
++{
++ struct pci_dev *pdev, *pbridge;
++
++ if (!dev_is_pci(dev) || !dev_is_pci(bridge))
++ return false;
++
++ pdev = to_pci_dev(dev);
++ pbridge = to_pci_dev(bridge);
++
++ if (pbridge->subordinate &&
++ pbridge->subordinate->number <= pdev->bus->number &&
++ pbridge->subordinate->busn_res.end >= pdev->bus->number)
++ return true;
++
++ return false;
++}
++
+ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devfn)
+ {
+ struct dmar_drhd_unit *drhd = NULL;
+ struct intel_iommu *iommu;
+ struct device *tmp;
+- struct pci_dev *ptmp, *pdev = NULL;
++ struct pci_dev *pdev = NULL;
+ u16 segment = 0;
+ int i;
+
+@@ -780,13 +807,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
+ goto out;
+ }
+
+- if (!pdev || !dev_is_pci(tmp))
+- continue;
+-
+- ptmp = to_pci_dev(tmp);
+- if (ptmp->subordinate &&
+- ptmp->subordinate->number <= pdev->bus->number &&
+- ptmp->subordinate->busn_res.end >= pdev->bus->number)
++ if (is_downstream_to_pci_bridge(dev, tmp))
+ goto got_pdev;
+ }
+
+
diff --git a/patches.drivers/iommu-vt-d-remove-unnecessary-rcu_read_locks b/patches.drivers/iommu-vt-d-remove-unnecessary-rcu_read_locks
new file mode 100644
index 0000000000..601dea269b
--- /dev/null
+++ b/patches.drivers/iommu-vt-d-remove-unnecessary-rcu_read_locks
@@ -0,0 +1,47 @@
+From: Lukasz Odzioba <lukasz.odzioba@intel.com>
+Date: Mon, 20 May 2019 15:41:28 +0200
+Subject: iommu/vt-d: Remove unnecessary rcu_read_locks
+Git-commit: f780a8dc196db1c41b5da21ecfa27e83ee5fb776
+Patch-mainline: v5.3-rc1
+References: bsc#1140964
+
+We use RCU's for rarely updated lists like iommus, rmrr, atsr units.
+
+I'm not sure why domain_remove_dev_info() in domain_exit() was surrounded
+by rcu_read_lock. Lock was present before refactoring in d160aca527,
+but it was related to rcu list, not domain_remove_dev_info function.
+
+dmar_remove_one_dev_info() doesn't touch any of those lists, so it doesn't
+require a lock. In fact it is called 6 times without it anyway.
+
+Fixes: d160aca5276d ("iommu/vt-d: Unify domain->iommu attach/detachment")
+
+Signed-off-by: Lukasz Odzioba <lukasz.odzioba@intel.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/intel-iommu.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2013,9 +2013,7 @@ static void domain_exit(struct dmar_doma
+ }
+
+ /* Remove associated devices and clear attached or cached domains */
+- rcu_read_lock();
+ domain_remove_dev_info(domain);
+- rcu_read_unlock();
+
+ /* destroy iovas */
+ put_iova_domain(&domain->iovad);
+@@ -5121,9 +5119,7 @@ static int intel_iommu_attach_device(str
+
+ old_domain = find_domain(dev);
+ if (old_domain) {
+- rcu_read_lock();
+ dmar_remove_one_dev_info(old_domain, dev);
+- rcu_read_unlock();
+
+ if (!domain_type_is_vm_or_si(old_domain) &&
+ list_empty(&old_domain->devices))
+
diff --git a/patches.drivers/ixgbe-Avoid-NULL-pointer-dereference-with-VF-on-non-.patch b/patches.drivers/ixgbe-Avoid-NULL-pointer-dereference-with-VF-on-non-.patch
new file mode 100644
index 0000000000..d14079b970
--- /dev/null
+++ b/patches.drivers/ixgbe-Avoid-NULL-pointer-dereference-with-VF-on-non-.patch
@@ -0,0 +1,87 @@
+From: Dann Frazier <dann.frazier@canonical.com>
+Date: Wed, 22 May 2019 17:22:58 -0600
+Subject: ixgbe: Avoid NULL pointer dereference with VF on non-IPsec hw
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 92924064106e410cdc015f1dbfc0499309f9f5b1
+References: bsc#1140228
+
+An ipsec structure will not be allocated if the hardware does not support
+offload. Fixes the following Oops:
+
+[ 191.045452] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
+[ 191.054232] Mem abort info:
+[ 191.057014] ESR = 0x96000004
+[ 191.060057] Exception class = DABT (current EL), IL = 32 bits
+[ 191.065963] SET = 0, FnV = 0
+[ 191.069004] EA = 0, S1PTW = 0
+[ 191.072132] Data abort info:
+[ 191.074999] ISV = 0, ISS = 0x00000004
+[ 191.078822] CM = 0, WnR = 0
+[ 191.081780] user pgtable: 4k pages, 48-bit VAs, pgdp = 0000000043d9e467
+[ 191.088382] [0000000000000000] pgd=0000000000000000
+[ 191.093252] Internal error: Oops: 96000004 [#1] SMP
+[ 191.098119] Modules linked in: vhost_net vhost tap vfio_pci vfio_virqfd vfio_iommu_type1 vfio xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ipt_REJECT nf_reject_ipv4 xt_tcpudp bridge stp llc ebtable_filter devlink ebtables ip6table_filter ip6_tables iptable_filter bpfilter ipmi_ssif nls_iso8859_1 input_leds joydev ipmi_si hns_roce_hw_v2 ipmi_devintf hns_roce ipmi_msghandler cppc_cpufreq sch_fq_codel ib_iser rdma_cm iw_cm ib_cm ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip_tables x_tables autofs4 ses enclosure btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor hid_generic usbhid hid raid6_pq libcrc32c raid1 raid0 multipath linear ixgbevf hibmc_drm ttm
+[ 191.168607] drm_kms_helper aes_ce_blk aes_ce_cipher syscopyarea crct10dif_ce sysfillrect ghash_ce qla2xxx sysimgblt sha2_ce sha256_arm64 hisi_sas_v3_hw fb_sys_fops sha1_ce uas nvme_fc mpt3sas ixgbe drm hisi_sas_main nvme_fabrics usb_storage hclge scsi_transport_fc ahci libsas hnae3 raid_class libahci xfrm_algo scsi_transport_sas mdio aes_neon_bs aes_neon_blk crypto_simd cryptd aes_arm64
+[ 191.202952] CPU: 94 PID: 0 Comm: swapper/94 Not tainted 4.19.0-rc1+ #11
+[ 191.209553] Hardware name: Huawei D06 /D06, BIOS Hisilicon D06 UEFI RC0 - V1.20.01 04/26/2019
+[ 191.218064] pstate: 20400089 (nzCv daIf +PAN -UAO)
+[ 191.222873] pc : ixgbe_ipsec_vf_clear+0x60/0xd0 [ixgbe]
+[ 191.228093] lr : ixgbe_msg_task+0x2d0/0x1088 [ixgbe]
+[ 191.233044] sp : ffff000009b3bcd0
+[ 191.236346] x29: ffff000009b3bcd0 x28: 0000000000000000
+[ 191.241647] x27: ffff000009628000 x26: 0000000000000000
+[ 191.246946] x25: ffff803f652d7600 x24: 0000000000000004
+[ 191.252246] x23: ffff803f6a718900 x22: 0000000000000000
+[ 191.257546] x21: 0000000000000000 x20: 0000000000000000
+[ 191.262845] x19: 0000000000000000 x18: 0000000000000000
+[ 191.268144] x17: 0000000000000000 x16: 0000000000000000
+[ 191.273443] x15: 0000000000000000 x14: 0000000100000026
+[ 191.278742] x13: 0000000100000025 x12: ffff8a5f7fbe0df0
+[ 191.284042] x11: 000000010000000b x10: 0000000000000040
+[ 191.289341] x9 : 0000000000001100 x8 : ffff803f6a824fd8
+[ 191.294640] x7 : ffff803f6a825098 x6 : 0000000000000001
+[ 191.299939] x5 : ffff000000f0ffc0 x4 : 0000000000000000
+[ 191.305238] x3 : ffff000028c00000 x2 : ffff803f652d7600
+[ 191.310538] x1 : 0000000000000000 x0 : ffff000000f205f0
+[ 191.315838] Process swapper/94 (pid: 0, stack limit = 0x00000000addfed5a)
+[ 191.322613] Call trace:
+[ 191.325055] ixgbe_ipsec_vf_clear+0x60/0xd0 [ixgbe]
+[ 191.329927] ixgbe_msg_task+0x2d0/0x1088 [ixgbe]
+[ 191.334536] ixgbe_msix_other+0x274/0x330 [ixgbe]
+[ 191.339233] __handle_irq_event_percpu+0x78/0x270
+[ 191.343924] handle_irq_event_percpu+0x40/0x98
+[ 191.348355] handle_irq_event+0x50/0xa8
+[ 191.352180] handle_fasteoi_irq+0xbc/0x148
+[ 191.356263] generic_handle_irq+0x34/0x50
+[ 191.360259] __handle_domain_irq+0x68/0xc0
+[ 191.364343] gic_handle_irq+0x84/0x180
+[ 191.368079] el1_irq+0xe8/0x180
+[ 191.371208] arch_cpu_idle+0x30/0x1a8
+[ 191.374860] do_idle+0x1dc/0x2a0
+[ 191.378077] cpu_startup_entry+0x2c/0x30
+[ 191.381988] secondary_start_kernel+0x150/0x1e0
+[ 191.386506] Code: 6b15003f 54000320 f1404a9f 54000060 (79400260)
+
+Fixes: eda0333ac2930 ("ixgbe: add VF IPsec management")
+Signed-off-by: Dann Frazier <dann.frazier@canonical.com>
+Acked-by: Shannon Nelson <snelson@pensando.io>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c
+@@ -866,6 +866,9 @@ void ixgbe_ipsec_vf_clear(struct ixgbe_a
+ struct ixgbe_ipsec *ipsec = adapter->ipsec;
+ int i;
+
++ if (!ipsec)
++ return;
++
+ /* search rx sa table */
+ for (i = 0; i < IXGBE_IPSEC_MAX_SA_COUNT && ipsec->num_rx_sa; i++) {
+ if (!ipsec->rx_tbl[i].used)
diff --git a/patches.drivers/libata-Extend-quirks-for-the-ST1000LM024-drives-with.patch b/patches.drivers/libata-Extend-quirks-for-the-ST1000LM024-drives-with.patch
new file mode 100644
index 0000000000..769ebf2037
--- /dev/null
+++ b/patches.drivers/libata-Extend-quirks-for-the-ST1000LM024-drives-with.patch
@@ -0,0 +1,46 @@
+From 31f6264e225fb92cf6f4b63031424f20797c297d Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Tue, 11 Jun 2019 16:32:59 +0200
+Subject: [PATCH] libata: Extend quirks for the ST1000LM024 drives with NOLPM quirk
+Git-commit: 31f6264e225fb92cf6f4b63031424f20797c297d
+Patch-mainline: v5.2-rc5
+References: bsc#1051510
+
+We've received a bugreport that using LPM with ST1000LM024 drives leads
+to system lockups. So it seems that these models are buggy in more then
+1 way. Add NOLPM quirk to the existing quirks entry for BROKEN_FPDMA_AA.
+
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1571330
+Cc: stable@vger.kernel.org
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/ata/libata-core.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index aaa57e0c809d..4a2dff303865 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4460,9 +4460,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
+ ATA_HORKAGE_FIRMWARE_WARN },
+
+- /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
+- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
++ /* drives which fail FPDMA_AA activation (some may freeze afterwards)
++ the ST disks also have LPM issues */
++ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA |
++ ATA_HORKAGE_NOLPM, },
++ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA |
++ ATA_HORKAGE_NOLPM, },
+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
+ /* Blacklist entries taken from Silicon Image 3124/3132
+--
+2.16.4
+
diff --git a/patches.drivers/libceph-add-scatterlist-messenger-data-type.patch b/patches.drivers/libceph-add-scatterlist-messenger-data-type.patch
index cd022a4d50..bf66ce2dd4 100644
--- a/patches.drivers/libceph-add-scatterlist-messenger-data-type.patch
+++ b/patches.drivers/libceph-add-scatterlist-messenger-data-type.patch
@@ -11,12 +11,18 @@ down directly to rbd.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: David Disseldorp <ddiss@suse.de>
+[luis: due to 0d9c1ab3be4c ("libceph: preallocate message data items"):
+ - dropped changes to ceph_msg_data_type_valid() as this function was
+ removed;
+ - use ceph_msg_data_add() instead of ceph_msg_data_create() in function
+ ceph_msg_data_add_sg (and no need for list_add_tail() either)]
+Acked-by: Luis Henriques <lhenriques@suse.com>
---
- include/linux/ceph/messenger.h | 13 +++++
+ include/linux/ceph/messenger.h | 12 +++++
include/linux/ceph/osd_client.h | 12 ++++-
- net/ceph/messenger.c | 96 ++++++++++++++++++++++++++++++++++++++++
+ net/ceph/messenger.c | 95 ++++++++++++++++++++++++++++++++++++++++
net/ceph/osd_client.c | 26 ++++++++++
- 4 files changed, 146 insertions(+), 1 deletion(-)
+ 4 files changed, 144 insertions(+), 1 deletion(-)
--- a/include/linux/ceph/messenger.h
+++ b/include/linux/ceph/messenger.h
@@ -27,16 +33,8 @@ Acked-by: David Disseldorp <ddiss@suse.de>
+ CEPH_MSG_DATA_SG, /* data source/destination is a scatterlist */
};
- static __inline__ bool ceph_msg_data_type_valid(enum ceph_msg_data_type type)
-@@ -91,6 +92,7 @@ static __inline__ bool ceph_msg_data_typ
- case CEPH_MSG_DATA_BIO:
- #endif /* CONFIG_BLOCK */
- case CEPH_MSG_DATA_BVECS:
-+ case CEPH_MSG_DATA_SG:
- return true;
- default:
- return false;
-@@ -196,6 +198,11 @@ struct ceph_msg_data {
+ #ifdef CONFIG_BLOCK
+@@ -179,6 +180,11 @@ struct ceph_msg_data {
unsigned int alignment; /* first page */
};
struct ceph_pagelist *pagelist;
@@ -48,7 +46,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
};
};
-@@ -221,6 +228,10 @@ struct ceph_msg_data_cursor {
+@@ -203,6 +209,10 @@ struct ceph_msg_data_cursor {
struct page *page; /* page from list */
size_t offset; /* bytes from list */
};
@@ -59,15 +57,15 @@ Acked-by: David Disseldorp <ddiss@suse.de>
};
};
-@@ -379,6 +390,8 @@ void ceph_msg_data_add_bio(struct ceph_m
+@@ -363,6 +373,8 @@ void ceph_msg_data_add_bio(struct ceph_m
#endif /* CONFIG_BLOCK */
void ceph_msg_data_add_bvecs(struct ceph_msg *msg,
struct ceph_bvec_iter *bvec_pos);
+extern void ceph_msg_data_add_sg(struct ceph_msg *msg, struct scatterlist *sgl,
+ unsigned int sgl_init_offset, u64 length);
- extern struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags,
- bool can_fail);
+ struct ceph_msg *ceph_msg_new2(int type, int front_len, int max_data_items,
+ gfp_t flags, bool can_fail);
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
@@ -57,6 +57,7 @@ enum ceph_osd_data_type {
@@ -105,7 +103,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
struct ceph_pagelist *pagelist);
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
-@@ -950,6 +950,75 @@ static bool ceph_msg_data_bvecs_advance(
+@@ -920,6 +920,75 @@ static bool ceph_msg_data_bvecs_advance(
}
/*
@@ -181,7 +179,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
* For a page array, a piece comes from the first page in the array
* that has not already been fully consumed.
*/
-@@ -1135,6 +1204,9 @@ static void __ceph_msg_data_cursor_init(
+@@ -1105,6 +1174,9 @@ static void __ceph_msg_data_cursor_init(
case CEPH_MSG_DATA_BVECS:
ceph_msg_data_bvecs_cursor_init(cursor, length);
break;
@@ -191,7 +189,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
case CEPH_MSG_DATA_NONE:
default:
/* BUG(); */
-@@ -1186,6 +1258,9 @@ static struct page *ceph_msg_data_next(s
+@@ -1153,6 +1225,9 @@ static struct page *ceph_msg_data_next(s
case CEPH_MSG_DATA_BVECS:
page = ceph_msg_data_bvecs_next(cursor, page_offset, length);
break;
@@ -201,7 +199,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
case CEPH_MSG_DATA_NONE:
default:
page = NULL;
-@@ -1227,6 +1302,9 @@ static void ceph_msg_data_advance(struct
+@@ -1194,6 +1269,9 @@ static void ceph_msg_data_advance(struct
case CEPH_MSG_DATA_BVECS:
new_piece = ceph_msg_data_bvecs_advance(cursor, bytes);
break;
@@ -211,7 +209,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
case CEPH_MSG_DATA_NONE:
default:
BUG();
-@@ -3346,6 +3424,24 @@ void ceph_msg_data_add_bvecs(struct ceph
+@@ -3307,6 +3385,23 @@ void ceph_msg_data_add_bvecs(struct ceph
}
EXPORT_SYMBOL(ceph_msg_data_add_bvecs);
@@ -222,13 +220,12 @@ Acked-by: David Disseldorp <ddiss@suse.de>
+
+ BUG_ON(!sgl);
+
-+ data = ceph_msg_data_create(CEPH_MSG_DATA_SG);
-+ BUG_ON(!data);
++ data = ceph_msg_data_add(msg);
++ data->type = CEPH_MSG_DATA_SG;
+ data->sgl = sgl;
+ data->sgl_length = length;
+ data->sgl_init_offset = sgl_init_offset;
+
-+ list_add_tail(&data->links, &msg->data);
+ msg->data_length += length;
+}
+EXPORT_SYMBOL(ceph_msg_data_add_sg);
@@ -238,7 +235,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
* the new msg has a ref count of 1.
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
-@@ -163,6 +163,16 @@ static void ceph_osd_data_bvecs_init(str
+@@ -169,6 +169,16 @@ static void ceph_osd_data_bvecs_init(str
osd_data->num_bvecs = num_bvecs;
}
@@ -255,7 +252,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
#define osd_req_op_data(oreq, whch, typ, fld) \
({ \
struct ceph_osd_request *__oreq = (oreq); \
-@@ -264,6 +274,17 @@ void osd_req_op_extent_osd_data_bvec_pos
+@@ -270,6 +280,17 @@ void osd_req_op_extent_osd_data_bvec_pos
}
EXPORT_SYMBOL(osd_req_op_extent_osd_data_bvec_pos);
@@ -273,7 +270,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
static void osd_req_op_cls_request_info_pagelist(
struct ceph_osd_request *osd_req,
unsigned int which, struct ceph_pagelist *pagelist)
-@@ -346,6 +367,8 @@ static u64 ceph_osd_data_length(struct c
+@@ -352,6 +373,8 @@ static u64 ceph_osd_data_length(struct c
#endif /* CONFIG_BLOCK */
case CEPH_OSD_DATA_TYPE_BVECS:
return osd_data->bvec_pos.iter.bi_size;
@@ -282,7 +279,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
default:
WARN(true, "unrecognized data type %d\n", (int)osd_data->type);
return 0;
-@@ -888,6 +911,9 @@ static void ceph_osdc_msg_data_add(struc
+@@ -959,6 +982,9 @@ static void ceph_osdc_msg_data_add(struc
#endif
} else if (osd_data->type == CEPH_OSD_DATA_TYPE_BVECS) {
ceph_msg_data_add_bvecs(msg, &osd_data->bvec_pos);
diff --git a/patches.drivers/libceph-add-support-for-CMPEXT-compare-extent-reques.patch b/patches.drivers/libceph-add-support-for-CMPEXT-compare-extent-reques.patch
index ff506c7e84..7158d5ec66 100644
--- a/patches.drivers/libceph-add-support-for-CMPEXT-compare-extent-reques.patch
+++ b/patches.drivers/libceph-add-support-for-CMPEXT-compare-extent-reques.patch
@@ -13,11 +13,15 @@ extent.offset on disk. If there is a miscompare the osd will return
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: David Disseldorp <ddiss@suse.de>
[ddiss@suse.de: reworked to use new API, which isn't bidirectional.]
----
+Acked-by: Luis Henriques <lhenriques@suse.com>
+[luis: updated get_num_data_items() introduced by commit 0d9c1ab3be4c
+ ("libceph: preallocate message data items")]
+[luis: rebased atop 26f887e0a3c4 ("libceph, rbd, ceph: move
+ ceph_osdc_alloc_messages() calls")]
---
include/linux/ceph/rados.h | 3 +++
- net/ceph/osd_client.c | 17 ++++++++++++-----
- 2 files changed, 15 insertions(+), 5 deletions(-)
+ net/ceph/osd_client.c | 18 +++++++++++++-----
+ 2 files changed, 16 insertions(+), 5 deletions(-)
--- a/include/linux/ceph/rados.h
+++ b/include/linux/ceph/rados.h
@@ -33,7 +37,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
f(ASSERT_SRC_VERSION, __CEPH_OSD_OP(RD, MULTI, 2), "assert-src-version") \
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
-@@ -342,6 +342,7 @@ static void osd_req_op_data_release(stru
+@@ -407,6 +407,7 @@ static void osd_req_op_data_release(stru
case CEPH_OSD_OP_READ:
case CEPH_OSD_OP_WRITE:
case CEPH_OSD_OP_WRITEFULL:
@@ -41,7 +45,15 @@ Acked-by: David Disseldorp <ddiss@suse.de>
ceph_osd_data_release(&op->extent.osd_data);
break;
case CEPH_OSD_OP_CALL:
-@@ -676,13 +677,14 @@ void osd_req_op_extent_init(struct ceph_
+@@ -724,6 +725,7 @@ static void get_num_data_items(struct ce
+ case CEPH_OSD_OP_SETXATTR:
+ case CEPH_OSD_OP_CMPXATTR:
+ case CEPH_OSD_OP_NOTIFY_ACK:
++ case CEPH_OSD_OP_CMPEXT:
+ *num_request_data_items += 1;
+ break;
+
+@@ -805,13 +807,14 @@ void osd_req_op_extent_init(struct ceph_
BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE &&
opcode != CEPH_OSD_OP_WRITEFULL && opcode != CEPH_OSD_OP_ZERO &&
@@ -58,7 +70,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
payload_len += length;
op->indata_len = payload_len;
-@@ -704,7 +706,8 @@ void osd_req_op_extent_update(struct cep
+@@ -833,7 +836,8 @@ void osd_req_op_extent_update(struct cep
BUG_ON(length > previous);
op->extent.length = length;
@@ -68,7 +80,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
op->indata_len -= previous - length;
}
EXPORT_SYMBOL(osd_req_op_extent_update);
-@@ -726,7 +729,8 @@ void osd_req_op_extent_dup_last(struct c
+@@ -855,7 +859,8 @@ void osd_req_op_extent_dup_last(struct c
op->extent.offset += offset_inc;
op->extent.length -= offset_inc;
@@ -78,7 +90,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
op->indata_len -= offset_inc;
}
EXPORT_SYMBOL(osd_req_op_extent_dup_last);
-@@ -877,6 +881,7 @@ static u32 osd_req_encode_op(struct ceph
+@@ -1007,6 +1012,7 @@ static u32 osd_req_encode_op(struct ceph
case CEPH_OSD_OP_WRITEFULL:
case CEPH_OSD_OP_ZERO:
case CEPH_OSD_OP_TRUNCATE:
@@ -86,7 +98,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
dst->extent.offset = cpu_to_le64(src->extent.offset);
dst->extent.length = cpu_to_le64(src->extent.length);
dst->extent.truncate_size =
-@@ -960,7 +965,8 @@ struct ceph_osd_request *ceph_osdc_new_r
+@@ -1090,7 +1096,8 @@ struct ceph_osd_request *ceph_osdc_new_r
BUG_ON(opcode != CEPH_OSD_OP_READ && opcode != CEPH_OSD_OP_WRITE &&
opcode != CEPH_OSD_OP_ZERO && opcode != CEPH_OSD_OP_TRUNCATE &&
@@ -96,11 +108,11 @@ Acked-by: David Disseldorp <ddiss@suse.de>
req = ceph_osdc_alloc_request(osdc, snapc, num_ops, use_mempool,
GFP_NOFS);
-@@ -1802,6 +1808,7 @@ static void setup_request_data(struct ce
+@@ -1966,6 +1973,7 @@ static void setup_request_data(struct ce
/* request */
case CEPH_OSD_OP_WRITE:
case CEPH_OSD_OP_WRITEFULL:
+ case CEPH_OSD_OP_CMPEXT:
WARN_ON(op->indata_len != op->extent.length);
- ceph_osdc_msg_data_add(msg, &op->extent.osd_data);
- break;
+ ceph_osdc_msg_data_add(request_msg,
+ &op->extent.osd_data);
diff --git a/patches.drivers/libceph-add-support-for-write-same-requests.patch b/patches.drivers/libceph-add-support-for-write-same-requests.patch
index b42ea4d981..809905b9ab 100644
--- a/patches.drivers/libceph-add-support-for-write-same-requests.patch
+++ b/patches.drivers/libceph-add-support-for-write-same-requests.patch
@@ -14,15 +14,20 @@ rbd and lio will hook in to this support.
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Acked-by: David Disseldorp <ddiss@suse.de>
+Acked-by: Luis Henriques <lhenriques@suse.com>
+[luis: updated get_num_data_items() introduced by commit 0d9c1ab3be4c
+ ("libceph: preallocate message data items")]
+[luis: rebased atop 26f887e0a3c4 ("libceph, rbd, ceph: move
+ ceph_osdc_alloc_messages() calls")]
---
- include/linux/ceph/osd_client.h | 15 +++++++++++++++
- include/linux/ceph/rados.h | 6 ++++++
- net/ceph/osd_client.c | 39 +++++++++++++++++++++++++++++++++++++++
- 3 files changed, 60 insertions(+)
+ include/linux/ceph/osd_client.h | 15 ++++++++++++++
+ include/linux/ceph/rados.h | 6 +++++
+ net/ceph/osd_client.c | 41 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 62 insertions(+)
--- a/include/linux/ceph/osd_client.h
+++ b/include/linux/ceph/osd_client.h
-@@ -133,6 +133,12 @@ struct ceph_osd_req_op {
+@@ -141,6 +141,12 @@ struct ceph_osd_req_op {
u64 expected_object_size;
u64 expected_write_size;
} alloc_hint;
@@ -35,7 +40,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
};
};
-@@ -323,6 +329,10 @@ extern void osd_req_op_raw_data_in_pages
+@@ -397,6 +403,10 @@ extern void osd_req_op_raw_data_in_pages
u32 alignment, bool pages_from_pool,
bool own_pages);
@@ -46,7 +51,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
extern void osd_req_op_extent_init(struct ceph_osd_request *osd_req,
unsigned int which, u16 opcode,
u64 offset, u64 length,
-@@ -353,6 +363,11 @@ extern void osd_req_op_extent_osd_data_s
+@@ -435,6 +445,11 @@ extern void osd_req_op_extent_osd_data_s
unsigned int which,
struct scatterlist *sgl,
unsigned int init_sg_offset,
@@ -60,7 +65,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
unsigned int which,
--- a/include/linux/ceph/rados.h
+++ b/include/linux/ceph/rados.h
-@@ -223,6 +223,7 @@ extern const char *ceph_osd_state_name(i
+@@ -227,6 +227,7 @@ extern const char *ceph_osd_state_name(i
f(TRUNCATE, __CEPH_OSD_OP(WR, DATA, 3), "truncate") \
f(ZERO, __CEPH_OSD_OP(WR, DATA, 4), "zero") \
f(DELETE, __CEPH_OSD_OP(WR, DATA, 5), "delete") \
@@ -68,7 +73,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
\
/* fancy write */ \
f(APPEND, __CEPH_OSD_OP(WR, DATA, 6), "append") \
-@@ -490,6 +491,11 @@ struct ceph_osd_op {
+@@ -499,6 +500,11 @@ struct ceph_osd_op {
__le64 expected_object_size;
__le64 expected_write_size;
} __attribute__ ((packed)) alloc_hint;
@@ -82,7 +87,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
} __attribute__ ((packed));
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
-@@ -295,6 +295,17 @@ void osd_req_op_cls_response_data_pages(
+@@ -358,6 +358,17 @@ void osd_req_op_cls_response_data_pages(
}
EXPORT_SYMBOL(osd_req_op_cls_response_data_pages);
@@ -100,7 +105,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
static u64 ceph_osd_data_length(struct ceph_osd_data *osd_data)
{
switch (osd_data->type) {
-@@ -343,6 +354,9 @@ static void osd_req_op_data_release(stru
+@@ -410,6 +421,9 @@ static void osd_req_op_data_release(stru
case CEPH_OSD_OP_CMPEXT:
ceph_osd_data_release(&op->extent.osd_data);
break;
@@ -110,7 +115,15 @@ Acked-by: David Disseldorp <ddiss@suse.de>
case CEPH_OSD_OP_CALL:
ceph_osd_data_release(&op->cls.request_info);
ceph_osd_data_release(&op->cls.request_data);
-@@ -656,6 +670,22 @@ void osd_req_op_init(struct ceph_osd_req
+@@ -726,6 +740,7 @@ static void get_num_data_items(struct ce
+ case CEPH_OSD_OP_CMPXATTR:
+ case CEPH_OSD_OP_NOTIFY_ACK:
+ case CEPH_OSD_OP_CMPEXT:
++ case CEPH_OSD_OP_WRITESAME:
+ *num_request_data_items += 1;
+ break;
+
+@@ -796,6 +811,22 @@ void osd_req_op_init(struct ceph_osd_req
}
EXPORT_SYMBOL(osd_req_op_init);
@@ -133,7 +146,7 @@ Acked-by: David Disseldorp <ddiss@suse.de>
void osd_req_op_extent_init(struct ceph_osd_request *osd_req,
unsigned int which, u16 opcode,
u64 offset, u64 length,
-@@ -912,6 +942,12 @@ static u32 osd_req_encode_op(struct ceph
+@@ -1054,6 +1085,12 @@ static u32 osd_req_encode_op(struct ceph
case CEPH_OSD_OP_CREATE:
case CEPH_OSD_OP_DELETE:
break;
@@ -146,12 +159,13 @@ Acked-by: David Disseldorp <ddiss@suse.de>
default:
pr_err("unsupported osd opcode %s\n",
ceph_osd_op_name(src->op));
-@@ -1462,6 +1498,9 @@ static void setup_request_data(struct ce
- WARN_ON(op->indata_len != op->extent.length);
- ceph_osdc_msg_data_add(msg, &op->extent.osd_data);
+@@ -1976,6 +2013,10 @@ static void setup_request_data(struct ce
+ ceph_osdc_msg_data_add(request_msg,
+ &op->extent.osd_data);
break;
+ case CEPH_OSD_OP_WRITESAME:
-+ ceph_osdc_msg_data_add(msg, &op->writesame.request_data);
++ ceph_osdc_msg_data_add(request_msg,
++ &op->writesame.request_data);
+ break;
case CEPH_OSD_OP_SETXATTR:
case CEPH_OSD_OP_CMPXATTR:
diff --git a/patches.drivers/mISDN-make-sure-device-name-is-NUL-terminated.patch b/patches.drivers/mISDN-make-sure-device-name-is-NUL-terminated.patch
new file mode 100644
index 0000000000..7230277b2b
--- /dev/null
+++ b/patches.drivers/mISDN-make-sure-device-name-is-NUL-terminated.patch
@@ -0,0 +1,58 @@
+From ccfb62f27beb295103e9392462b20a6ed807d0ea Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 22 May 2019 11:45:13 +0300
+Subject: [PATCH] mISDN: make sure device name is NUL terminated
+Git-commit: ccfb62f27beb295103e9392462b20a6ed807d0ea
+Patch-mainline: v5.2-rc3
+References: bsc#1051510
+
+The user can change the device_name with the IMSETDEVNAME ioctl, but we
+need to ensure that the user's name is NUL terminated. Otherwise it
+could result in a buffer overflow when we copy the name back to the user
+with IMGETDEVINFO ioctl.
+
+I also changed two strcpy() calls which handle the name to strscpy().
+Hopefully, there aren't any other ways to create a too long name, but
+it's nice to do this as a kernel hardening measure.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/isdn/mISDN/socket.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
+index a14e35d40538..84e1d4c2db66 100644
+--- a/drivers/isdn/mISDN/socket.c
++++ b/drivers/isdn/mISDN/socket.c
+@@ -393,7 +393,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ memcpy(di.channelmap, dev->channelmap,
+ sizeof(di.channelmap));
+ di.nrbchan = dev->nrbchan;
+- strcpy(di.name, dev_name(&dev->dev));
++ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
+ if (copy_to_user((void __user *)arg, &di, sizeof(di)))
+ err = -EFAULT;
+ } else
+@@ -676,7 +676,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ memcpy(di.channelmap, dev->channelmap,
+ sizeof(di.channelmap));
+ di.nrbchan = dev->nrbchan;
+- strcpy(di.name, dev_name(&dev->dev));
++ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name));
+ if (copy_to_user((void __user *)arg, &di, sizeof(di)))
+ err = -EFAULT;
+ } else
+@@ -690,6 +690,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ err = -EFAULT;
+ break;
+ }
++ dn.name[sizeof(dn.name) - 1] = '\0';
+ dev = get_mdevice(dn.id);
+ if (dev)
+ err = device_rename(&dev->dev, dn.name);
+--
+2.16.4
+
diff --git a/patches.drivers/media-v4l2-ioctl-clear-fields-in-s_parm.patch b/patches.drivers/media-v4l2-ioctl-clear-fields-in-s_parm.patch
new file mode 100644
index 0000000000..4dfc1a26db
--- /dev/null
+++ b/patches.drivers/media-v4l2-ioctl-clear-fields-in-s_parm.patch
@@ -0,0 +1,55 @@
+From 8a7c5594c02022ca5fa7fb603e11b3e1feb76ed5 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Sat, 12 May 2018 10:44:02 -0400
+Subject: [PATCH] media: v4l2-ioctl: clear fields in s_parm
+Git-commit: 8a7c5594c02022ca5fa7fb603e11b3e1feb76ed5
+Patch-mainline: v4.18-rc1
+References: bsc#1051510
+
+Zero the reserved capture/output array.
+
+Zero the extendedmode (it is never used in drivers).
+
+Clear all flags in capture/outputmode except for V4L2_MODE_HIGHQUALITY,
+as that is the only valid flag.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/media/v4l2-core/v4l2-ioctl.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index a40dbec271f1..212aac1d22c1 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -1952,7 +1952,22 @@ static int v4l_s_parm(const struct v4l2_ioctl_ops *ops,
+ struct v4l2_streamparm *p = arg;
+ int ret = check_fmt(file, p->type);
+
+- return ret ? ret : ops->vidioc_s_parm(file, fh, p);
++ if (ret)
++ return ret;
++
++ /* Note: extendedmode is never used in drivers */
++ if (V4L2_TYPE_IS_OUTPUT(p->type)) {
++ memset(p->parm.output.reserved, 0,
++ sizeof(p->parm.output.reserved));
++ p->parm.output.extendedmode = 0;
++ p->parm.output.outputmode &= V4L2_MODE_HIGHQUALITY;
++ } else {
++ memset(p->parm.capture.reserved, 0,
++ sizeof(p->parm.capture.reserved));
++ p->parm.capture.extendedmode = 0;
++ p->parm.capture.capturemode &= V4L2_MODE_HIGHQUALITY;
++ }
++ return ops->vidioc_s_parm(file, fh, p);
+ }
+
+ static int v4l_queryctrl(const struct v4l2_ioctl_ops *ops,
+--
+2.16.4
+
diff --git a/patches.drivers/mfd-hi655x-Fix-regmap-area-declared-size-for-hi655x.patch b/patches.drivers/mfd-hi655x-Fix-regmap-area-declared-size-for-hi655x.patch
new file mode 100644
index 0000000000..3ed2cf666e
--- /dev/null
+++ b/patches.drivers/mfd-hi655x-Fix-regmap-area-declared-size-for-hi655x.patch
@@ -0,0 +1,69 @@
+From 6afebb70ee7a4bde106dc1a875e7ac7997248f84 Mon Sep 17 00:00:00 2001
+From: Rafael David Tinoco <rafael.tinoco@linaro.org>
+Date: Fri, 6 Jul 2018 14:28:33 -0300
+Subject: [PATCH] mfd: hi655x: Fix regmap area declared size for hi655x
+Git-commit: 6afebb70ee7a4bde106dc1a875e7ac7997248f84
+Patch-mainline: v4.19-rc1
+References: bsc#1051510
+
+Fixes https://bugs.linaro.org/show_bug.cgi?id=3903
+
+LTP Functional tests have caused a bad paging request when triggering
+the regmap_read_debugfs() logic of the device PMIC Hi6553 (reading
+regmap/f8000000.pmic/registers file during read_all test):
+
+Unable to handle kernel paging request at virtual address ffff0
+[ffff00000984e000] pgd=0000000077ffe803, pud=0000000077ffd803,0
+Internal error: Oops: 96000007 [#1] SMP
+...
+Hardware name: HiKey Development Board (DT)
+...
+Call trace:
+ regmap_mmio_read8+0x24/0x40
+ regmap_mmio_read+0x48/0x70
+ _regmap_bus_reg_read+0x38/0x48
+ _regmap_read+0x68/0x170
+ regmap_read+0x50/0x78
+ regmap_read_debugfs+0x1a0/0x308
+ regmap_map_read_file+0x48/0x58
+ full_proxy_read+0x68/0x98
+ __vfs_read+0x48/0x80
+ vfs_read+0x94/0x150
+ SyS_read+0x6c/0xd8
+ el0_svc_naked+0x30/0x34
+Code: aa1e03e0 d503201f f9400280 8b334000 (39400000)
+
+Investigations have showed that, when triggered by debugfs read()
+handler, the mmio regmap logic was reading a bigger (16k) register area
+than the one mapped by devm_ioremap_resource() during hi655x-pmic probe
+time (4k).
+
+This commit changes hi655x's max register, according to HW specs, to be
+the same as the one declared in the pmic device in hi6220's dts, fixing
+the issue.
+
+Cc: <stable@vger.kernel.org> #v4.9 #v4.14 #v4.16 #v4.17
+Signed-off-by: Rafael David Tinoco <rafael.tinoco@linaro.org>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mfd/hi655x-pmic.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/mfd/hi655x-pmic.c b/drivers/mfd/hi655x-pmic.c
+index c37ccbfd52f2..96c07fa1802a 100644
+--- a/drivers/mfd/hi655x-pmic.c
++++ b/drivers/mfd/hi655x-pmic.c
+@@ -49,7 +49,7 @@ static struct regmap_config hi655x_regmap_config = {
+ .reg_bits = 32,
+ .reg_stride = HI655X_STRIDE,
+ .val_bits = 8,
+- .max_register = HI655X_BUS_ADDR(0xFFF),
++ .max_register = HI655X_BUS_ADDR(0x400) - HI655X_STRIDE,
+ };
+
+ static struct resource pwrkey_resources[] = {
+--
+2.16.4
+
diff --git a/patches.drivers/mlxsw-core-Add-API-for-QSFP-module-temperature-thres.patch b/patches.drivers/mlxsw-core-Add-API-for-QSFP-module-temperature-thres.patch
new file mode 100644
index 0000000000..60d18dc91b
--- /dev/null
+++ b/patches.drivers/mlxsw-core-Add-API-for-QSFP-module-temperature-thres.patch
@@ -0,0 +1,170 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Wed, 13 Feb 2019 11:28:47 +0000
+Subject: mlxsw: core: Add API for QSFP module temperature thresholds reading
+Patch-mainline: v5.1-rc1
+Git-commit: d93c19a1d95c90b6ded1dc3c8ccfe0e46e220af8
+References: bsc#1112374
+
+Add new API to read QSFP module's temperature thresholds - warning and
+critical.
+
+New internal API reads the temperature thresholds from the modules,
+which are equipped with the thermal sensor. These thresholds will be
+exposed via hwmon subsystem.
+
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/Makefile | 2
+ drivers/net/ethernet/mellanox/mlxsw/core_env.c | 117 +++++++++++++++++++++++++
+ drivers/net/ethernet/mellanox/mlxsw/core_env.h | 10 ++
+ 3 files changed, 128 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/net/ethernet/mellanox/mlxsw/core_env.c
+ create mode 100644 drivers/net/ethernet/mellanox/mlxsw/core_env.h
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/Makefile
++++ b/drivers/net/ethernet/mellanox/mlxsw/Makefile
+@@ -1,6 +1,6 @@
+ obj-$(CONFIG_MLXSW_CORE) += mlxsw_core.o
+ mlxsw_core-objs := core.o core_acl_flex_keys.o \
+- core_acl_flex_actions.o
++ core_acl_flex_actions.o core_env.o
+ mlxsw_core-$(CONFIG_MLXSW_CORE_HWMON) += core_hwmon.o
+ mlxsw_core-$(CONFIG_MLXSW_CORE_THERMAL) += core_thermal.o
+ obj-$(CONFIG_MLXSW_PCI) += mlxsw_pci.o
+--- /dev/null
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+@@ -0,0 +1,117 @@
++// SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0
++/* Copyright (c) 2018 Mellanox Technologies. All rights reserved */
++
++#include <linux/kernel.h>
++#include <linux/err.h>
++
++#include "core.h"
++#include "core_env.h"
++#include "item.h"
++#include "reg.h"
++
++static int mlxsw_env_validate_cable_ident(struct mlxsw_core *core, int id,
++ bool *qsfp)
++{
++ char eeprom_tmp[MLXSW_REG_MCIA_EEPROM_SIZE];
++ char mcia_pl[MLXSW_REG_MCIA_LEN];
++ u8 ident;
++ int err;
++
++ mlxsw_reg_mcia_pack(mcia_pl, id, 0, MLXSW_REG_MCIA_PAGE0_LO_OFF, 0, 1,
++ MLXSW_REG_MCIA_I2C_ADDR_LOW);
++ err = mlxsw_reg_query(core, MLXSW_REG(mcia), mcia_pl);
++ if (err)
++ return err;
++ mlxsw_reg_mcia_eeprom_memcpy_from(mcia_pl, eeprom_tmp);
++ ident = eeprom_tmp[0];
++ switch (ident) {
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP:
++ *qsfp = false;
++ break;
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP: /* fall-through */
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_PLUS: /* fall-through */
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28: /* fall-through */
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_DD:
++ *qsfp = true;
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
++int mlxsw_env_module_temp_thresholds_get(struct mlxsw_core *core, int module,
++ int off, int *temp)
++{
++ char eeprom_tmp[MLXSW_REG_MCIA_EEPROM_SIZE];
++ union {
++ u8 buf[MLXSW_REG_MCIA_TH_ITEM_SIZE];
++ u16 temp;
++ } temp_thresh;
++ char mcia_pl[MLXSW_REG_MCIA_LEN] = {0};
++ char mtbr_pl[MLXSW_REG_MTBR_LEN] = {0};
++ u16 module_temp;
++ bool qsfp;
++ int err;
++
++ mlxsw_reg_mtbr_pack(mtbr_pl, MLXSW_REG_MTBR_BASE_MODULE_INDEX + module,
++ 1);
++ err = mlxsw_reg_query(core, MLXSW_REG(mtbr), mtbr_pl);
++ if (err)
++ return err;
++
++ /* Don't read temperature thresholds for module with no valid info. */
++ mlxsw_reg_mtbr_temp_unpack(mtbr_pl, 0, &module_temp, NULL);
++ switch (module_temp) {
++ case MLXSW_REG_MTBR_BAD_SENS_INFO: /* fall-through */
++ case MLXSW_REG_MTBR_NO_CONN: /* fall-through */
++ case MLXSW_REG_MTBR_NO_TEMP_SENS: /* fall-through */
++ case MLXSW_REG_MTBR_INDEX_NA:
++ *temp = 0;
++ return 0;
++ default:
++ /* Do not consider thresholds for zero temperature. */
++ if (!MLXSW_REG_MTMP_TEMP_TO_MC(module_temp)) {
++ *temp = 0;
++ return 0;
++ }
++ break;
++ }
++
++ /* Read Free Side Device Temperature Thresholds from page 03h
++ * (MSB at lower byte address).
++ * Bytes:
++ * 128-129 - Temp High Alarm (SFP_TEMP_HIGH_ALARM);
++ * 130-131 - Temp Low Alarm (SFP_TEMP_LOW_ALARM);
++ * 132-133 - Temp High Warning (SFP_TEMP_HIGH_WARN);
++ * 134-135 - Temp Low Warning (SFP_TEMP_LOW_WARN);
++ */
++
++ /* Validate module identifier value. */
++ err = mlxsw_env_validate_cable_ident(core, module, &qsfp);
++ if (err)
++ return err;
++
++ if (qsfp)
++ mlxsw_reg_mcia_pack(mcia_pl, module, 0,
++ MLXSW_REG_MCIA_TH_PAGE_NUM,
++ MLXSW_REG_MCIA_TH_PAGE_OFF + off,
++ MLXSW_REG_MCIA_TH_ITEM_SIZE,
++ MLXSW_REG_MCIA_I2C_ADDR_LOW);
++ else
++ mlxsw_reg_mcia_pack(mcia_pl, module, 0,
++ MLXSW_REG_MCIA_PAGE0_LO,
++ off, MLXSW_REG_MCIA_TH_ITEM_SIZE,
++ MLXSW_REG_MCIA_I2C_ADDR_HIGH);
++
++ err = mlxsw_reg_query(core, MLXSW_REG(mcia), mcia_pl);
++ if (err)
++ return err;
++
++ mlxsw_reg_mcia_eeprom_memcpy_from(mcia_pl, eeprom_tmp);
++ memcpy(temp_thresh.buf, eeprom_tmp, MLXSW_REG_MCIA_TH_ITEM_SIZE);
++ *temp = temp_thresh.temp * 1000;
++
++ return 0;
++}
+--- /dev/null
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.h
+@@ -0,0 +1,10 @@
++/* SPDX-License-Identifier: BSD-3-Clause OR GPL-2.0 */
++/* Copyright (c) 2018 Mellanox Technologies. All rights reserved */
++
++#ifndef _MLXSW_CORE_ENV_H
++#define _MLXSW_CORE_ENV_H
++
++int mlxsw_env_module_temp_thresholds_get(struct mlxsw_core *core, int module,
++ int off, int *temp);
++
++#endif
diff --git a/patches.drivers/mlxsw-core-Do-not-use-WQ_MEM_RECLAIM-for-EMAD-workqu.patch b/patches.drivers/mlxsw-core-Do-not-use-WQ_MEM_RECLAIM-for-EMAD-workqu.patch
new file mode 100644
index 0000000000..09fbce29ba
--- /dev/null
+++ b/patches.drivers/mlxsw-core-Do-not-use-WQ_MEM_RECLAIM-for-EMAD-workqu.patch
@@ -0,0 +1,34 @@
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Wed, 10 Apr 2019 06:58:13 +0000
+Subject: mlxsw: core: Do not use WQ_MEM_RECLAIM for EMAD workqueue
+Patch-mainline: v5.1-rc6
+Git-commit: a8c133b06183c529c51cd0d54eb57d6b7078370c
+References: bsc#1112374
+
+The EMAD workqueue is used to handle retransmission of EMAD packets that
+contain configuration data for the device's firmware.
+
+Given the workers need to allocate these packets and that the code is
+not called as part of memory reclaim path, remove the WQ_MEM_RECLAIM
+flag.
+
+Fixes: d965465b60ba ("mlxsw: core: Fix possible deadlock")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
+@@ -568,7 +568,7 @@ static int mlxsw_emad_init(struct mlxsw_
+ if (!(mlxsw_core->bus->features & MLXSW_BUS_F_TXRX))
+ return 0;
+
+- emad_wq = alloc_workqueue("mlxsw_core_emad", WQ_MEM_RECLAIM, 0);
++ emad_wq = alloc_workqueue("mlxsw_core_emad", 0, 0);
+ if (!emad_wq)
+ return -ENOMEM;
+ mlxsw_core->emad_wq = emad_wq;
diff --git a/patches.drivers/mlxsw-core-Move-ethtool-module-callbacks-to-a-common.patch b/patches.drivers/mlxsw-core-Move-ethtool-module-callbacks-to-a-common.patch
new file mode 100644
index 0000000000..7446022c3a
--- /dev/null
+++ b/patches.drivers/mlxsw-core-Move-ethtool-module-callbacks-to-a-common.patch
@@ -0,0 +1,321 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Sun, 3 Mar 2019 09:12:08 +0000
+Subject: mlxsw: core: Move ethtool module callbacks to a common location
+Patch-mainline: v5.1-rc1
+Git-commit: 1b1c6c1a3802bf9e7a698d359771e29897c369e5
+References: bsc#1112374
+
+Move the implementation of ethtool module callbacks - .get_module_info()
+and .get_module_eeprom() - to a common location to allow reuse by the
+different mlxsw drivers.
+
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core_env.c | 121 +++++++++++++++++++++++++
+ drivers/net/ethernet/mellanox/mlxsw/core_env.h | 7 +
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 118 ++----------------------
+ 3 files changed, 139 insertions(+), 107 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+@@ -41,6 +41,47 @@ static int mlxsw_env_validate_cable_iden
+ return 0;
+ }
+
++static int
++mlxsw_env_query_module_eeprom(struct mlxsw_core *mlxsw_core, int module,
++ u16 offset, u16 size, void *data,
++ unsigned int *p_read_size)
++{
++ char eeprom_tmp[MLXSW_REG_MCIA_EEPROM_SIZE];
++ char mcia_pl[MLXSW_REG_MCIA_LEN];
++ u16 i2c_addr;
++ int status;
++ int err;
++
++ size = min_t(u16, size, MLXSW_REG_MCIA_EEPROM_SIZE);
++
++ if (offset < MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH &&
++ offset + size > MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH)
++ /* Cross pages read, read until offset 256 in low page */
++ size = MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH - offset;
++
++ i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_LOW;
++ if (offset >= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH) {
++ i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_HIGH;
++ offset -= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH;
++ }
++
++ mlxsw_reg_mcia_pack(mcia_pl, module, 0, 0, offset, size, i2c_addr);
++
++ err = mlxsw_reg_query(mlxsw_core, MLXSW_REG(mcia), mcia_pl);
++ if (err)
++ return err;
++
++ status = mlxsw_reg_mcia_status_get(mcia_pl);
++ if (status)
++ return -EIO;
++
++ mlxsw_reg_mcia_eeprom_memcpy_from(mcia_pl, eeprom_tmp);
++ memcpy(data, eeprom_tmp, size);
++ *p_read_size = size;
++
++ return 0;
++}
++
+ int mlxsw_env_module_temp_thresholds_get(struct mlxsw_core *core, int module,
+ int off, int *temp)
+ {
+@@ -115,3 +156,83 @@ int mlxsw_env_module_temp_thresholds_get
+
+ return 0;
+ }
++
++int mlxsw_env_get_module_info(struct mlxsw_core *mlxsw_core, int module,
++ struct ethtool_modinfo *modinfo)
++{
++ u8 module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE];
++ u16 offset = MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE;
++ u8 module_rev_id, module_id;
++ unsigned int read_size;
++ int err;
++
++ err = mlxsw_env_query_module_eeprom(mlxsw_core, module, 0, offset,
++ module_info, &read_size);
++ if (err)
++ return err;
++
++ if (read_size < offset)
++ return -EIO;
++
++ module_rev_id = module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID];
++ module_id = module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID];
++
++ switch (module_id) {
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP:
++ modinfo->type = ETH_MODULE_SFF_8436;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
++ break;
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_PLUS: /* fall-through */
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28:
++ if (module_id == MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28 ||
++ module_rev_id >=
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID_8636) {
++ modinfo->type = ETH_MODULE_SFF_8636;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN;
++ } else {
++ modinfo->type = ETH_MODULE_SFF_8436;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
++ }
++ break;
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP:
++ modinfo->type = ETH_MODULE_SFF_8472;
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ break;
++ default:
++ return -EINVAL;
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL(mlxsw_env_get_module_info);
++
++int mlxsw_env_get_module_eeprom(struct net_device *netdev,
++ struct mlxsw_core *mlxsw_core, int module,
++ struct ethtool_eeprom *ee, u8 *data)
++{
++ int offset = ee->offset;
++ unsigned int read_size;
++ int i = 0;
++ int err;
++
++ if (!ee->len)
++ return -EINVAL;
++
++ memset(data, 0, ee->len);
++
++ while (i < ee->len) {
++ err = mlxsw_env_query_module_eeprom(mlxsw_core, module, offset,
++ ee->len - i, data + i,
++ &read_size);
++ if (err) {
++ netdev_err(netdev, "Eeprom query failed\n");
++ return err;
++ }
++
++ i += read_size;
++ offset += read_size;
++ }
++
++ return 0;
++}
++EXPORT_SYMBOL(mlxsw_env_get_module_eeprom);
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.h
+@@ -7,4 +7,11 @@
+ int mlxsw_env_module_temp_thresholds_get(struct mlxsw_core *core, int module,
+ int off, int *temp);
+
++int mlxsw_env_get_module_info(struct mlxsw_core *mlxsw_core, int module,
++ struct ethtool_modinfo *modinfo);
++
++int mlxsw_env_get_module_eeprom(struct net_device *netdev,
++ struct mlxsw_core *mlxsw_core, int module,
++ struct ethtool_eeprom *ee, u8 *data);
++
+ #endif
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -32,6 +32,7 @@
+ #include "spectrum.h"
+ #include "pci.h"
+ #include "core.h"
++#include "core_env.h"
+ #include "reg.h"
+ #include "port.h"
+ #include "trap.h"
+@@ -2543,99 +2544,18 @@ out:
+ return err;
+ }
+
+-#define MLXSW_SP_I2C_ADDR_LOW 0x50
+-#define MLXSW_SP_I2C_ADDR_HIGH 0x51
+-#define MLXSW_SP_EEPROM_PAGE_LENGTH 256
+-
+-static int mlxsw_sp_query_module_eeprom(struct mlxsw_sp_port *mlxsw_sp_port,
+- u16 offset, u16 size, void *data,
+- unsigned int *p_read_size)
+-{
+- struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+- char eeprom_tmp[MLXSW_REG_MCIA_EEPROM_SIZE];
+- char mcia_pl[MLXSW_REG_MCIA_LEN];
+- u16 i2c_addr;
+- int status;
+- int err;
+-
+- size = min_t(u16, size, MLXSW_REG_MCIA_EEPROM_SIZE);
+-
+- if (offset < MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH &&
+- offset + size > MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH)
+- /* Cross pages read, read until offset 256 in low page */
+- size = MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH - offset;
+-
+- i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_LOW;
+- if (offset >= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH) {
+- i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_HIGH;
+- offset -= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH;
+- }
+-
+- mlxsw_reg_mcia_pack(mcia_pl, mlxsw_sp_port->mapping.module,
+- 0, 0, offset, size, i2c_addr);
+-
+- err = mlxsw_reg_query(mlxsw_sp->core, MLXSW_REG(mcia), mcia_pl);
+- if (err)
+- return err;
+-
+- status = mlxsw_reg_mcia_status_get(mcia_pl);
+- if (status)
+- return -EIO;
+-
+- mlxsw_reg_mcia_eeprom_memcpy_from(mcia_pl, eeprom_tmp);
+- memcpy(data, eeprom_tmp, size);
+- *p_read_size = size;
+-
+- return 0;
+-}
+-
+ static int mlxsw_sp_get_module_info(struct net_device *netdev,
+ struct ethtool_modinfo *modinfo)
+ {
+ struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(netdev);
+- u8 module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE];
+- u16 offset = MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE;
+- u8 module_rev_id, module_id;
+- unsigned int read_size;
++ struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+ int err;
+
+- err = mlxsw_sp_query_module_eeprom(mlxsw_sp_port, 0, offset,
+- module_info, &read_size);
+- if (err)
+- return err;
+-
+- if (read_size < offset)
+- return -EIO;
+-
+- module_rev_id = module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID];
+- module_id = module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID];
++ err = mlxsw_env_get_module_info(mlxsw_sp->core,
++ mlxsw_sp_port->mapping.module,
++ modinfo);
+
+- switch (module_id) {
+- case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP:
+- modinfo->type = ETH_MODULE_SFF_8436;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
+- break;
+- case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_PLUS: /* fall-through */
+- case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28:
+- if (module_id == MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28 ||
+- module_rev_id >=
+- MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID_8636) {
+- modinfo->type = ETH_MODULE_SFF_8636;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN;
+- } else {
+- modinfo->type = ETH_MODULE_SFF_8436;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
+- }
+- break;
+- case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP:
+- modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+- break;
+- default:
+- return -EINVAL;
+- }
+-
+- return 0;
++ return err;
+ }
+
+ static int mlxsw_sp_get_module_eeprom(struct net_device *netdev,
+@@ -2643,30 +2563,14 @@ static int mlxsw_sp_get_module_eeprom(st
+ u8 *data)
+ {
+ struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(netdev);
+- int offset = ee->offset;
+- unsigned int read_size;
+- int i = 0;
++ struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+ int err;
+
+- if (!ee->len)
+- return -EINVAL;
+-
+- memset(data, 0, ee->len);
+-
+- while (i < ee->len) {
+- err = mlxsw_sp_query_module_eeprom(mlxsw_sp_port, offset,
+- ee->len - i, data + i,
+- &read_size);
+- if (err) {
+- netdev_err(mlxsw_sp_port->dev, "Eeprom query failed\n");
+- return err;
+- }
+-
+- i += read_size;
+- offset += read_size;
+- }
++ err = mlxsw_env_get_module_eeprom(netdev, mlxsw_sp->core,
++ mlxsw_sp_port->mapping.module, ee,
++ data);
+
+- return 0;
++ return err;
+ }
+
+ static const struct ethtool_ops mlxsw_sp_port_ethtool_ops = {
diff --git a/patches.drivers/mlxsw-core-Prevent-reading-unsupported-slave-address.patch b/patches.drivers/mlxsw-core-Prevent-reading-unsupported-slave-address.patch
new file mode 100644
index 0000000000..97f8513411
--- /dev/null
+++ b/patches.drivers/mlxsw-core-Prevent-reading-unsupported-slave-address.patch
@@ -0,0 +1,77 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Sat, 18 May 2019 18:58:29 +0300
+Subject: mlxsw: core: Prevent reading unsupported slave address from SFP
+ EEPROM
+Patch-mainline: v5.2-rc2
+Git-commit: f1436c8036fa3632b2ee78841cf5184b7ef0ad87
+References: bsc#1112374
+
+Prevent reading unsupported slave address from SFP EEPROM by testing
+Diagnostic Monitoring Type byte in EEPROM. Read only page zero of
+EEPROM, in case this byte is zero.
+
+If some SFP transceiver does not support Digital Optical Monitoring
+(DOM), reading SFP EEPROM slave address 0x51 could return an error.
+Availability of DOM support is verified by reading from zero page
+Diagnostic Monitoring Type byte describing how diagnostic monitoring is
+implemented by transceiver. If bit 6 of this byte is set, it indicates
+that digital diagnostic monitoring has been implemented. Otherwise it is
+not and transceiver could fail to reply to transaction for slave address
+0x51 [1010001X (A2h)], which is used to access measurements page.
+
+Such issue has been observed when reading cable MCP2M00-xxxx,
+MCP7F00-xxxx, and few others.
+
+Fixes: 2ea109039cd3 ("mlxsw: spectrum: Add support for access cable info via ethtool")
+Fixes: 4400081b631a ("mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+")
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core_env.c | 18 ++++++++++++++++--
+ 1 file changed, 16 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+@@ -3,6 +3,7 @@
+
+ #include <linux/kernel.h>
+ #include <linux/err.h>
++#include <linux/sfp.h>
+
+ #include "core.h"
+ #include "core_env.h"
+@@ -162,7 +163,7 @@ int mlxsw_env_get_module_info(struct mlx
+ {
+ u8 module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE];
+ u16 offset = MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE;
+- u8 module_rev_id, module_id;
++ u8 module_rev_id, module_id, diag_mon;
+ unsigned int read_size;
+ int err;
+
+@@ -195,8 +196,21 @@ int mlxsw_env_get_module_info(struct mlx
+ }
+ break;
+ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP:
++ /* Verify if transceiver provides diagnostic monitoring page */
++ err = mlxsw_env_query_module_eeprom(mlxsw_core, module,
++ SFP_DIAGMON, 1, &diag_mon,
++ &read_size);
++ if (err)
++ return err;
++
++ if (read_size < 1)
++ return -EIO;
++
+ modinfo->type = ETH_MODULE_SFF_8472;
+- modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ if (diag_mon)
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
++ else
++ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN / 2;
+ break;
+ default:
+ return -EINVAL;
diff --git a/patches.drivers/mlxsw-core-mlxsw-core-avoid-Wint-in-bool-context-war.patch b/patches.drivers/mlxsw-core-mlxsw-core-avoid-Wint-in-bool-context-war.patch
new file mode 100644
index 0000000000..f10f2ed586
--- /dev/null
+++ b/patches.drivers/mlxsw-core-mlxsw-core-avoid-Wint-in-bool-context-war.patch
@@ -0,0 +1,46 @@
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 18 Mar 2019 17:35:11 +0100
+Subject: mlxsw: core: mlxsw: core: avoid -Wint-in-bool-context warning
+Patch-mainline: v5.1-rc3
+Git-commit: 7442c483b963dbee7d1b655cbad99c727c047828
+References: bsc#1112374
+
+A recently added function in mlxsw triggers a harmless compiler warning:
+
+In file included from drivers/net/ethernet/mellanox/mlxsw/core.h:17,
+ from drivers/net/ethernet/mellanox/mlxsw/core_env.c:7:
+drivers/net/ethernet/mellanox/mlxsw/core_env.c: In function 'mlxsw_env_module_temp_thresholds_get':
+drivers/net/ethernet/mellanox/mlxsw/reg.h:8015:45: error: '*' in boolean context, suggest '&&' instead [-Werror=int-in-bool-context]
+ #define MLXSW_REG_MTMP_TEMP_TO_MC(val) (val * 125)
+ ~~~~~^~~~~~
+drivers/net/ethernet/mellanox/mlxsw/core_env.c:116:8: note: in expansion of macro 'MLXSW_REG_MTMP_TEMP_TO_MC'
+ if (!MLXSW_REG_MTMP_TEMP_TO_MC(module_temp)) {
+ ^~~~~~~~~~~~~~~~~~~~~~~~~
+
+The warning is normally disabled, but it would be nice to enable
+it to find real bugs, and there are no other known instances at
+the moment.
+
+Replace the negation with a zero-comparison, which also matches
+the comment above it.
+
+Fixes: d93c19a1d95c ("mlxsw: core: Add API for QSFP module temperature thresholds reading")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/core_env.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/core_env.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/core_env.c
+@@ -113,7 +113,7 @@ int mlxsw_env_module_temp_thresholds_get
+ return 0;
+ default:
+ /* Do not consider thresholds for zero temperature. */
+- if (!MLXSW_REG_MTMP_TEMP_TO_MC(module_temp)) {
++ if (MLXSW_REG_MTMP_TEMP_TO_MC(module_temp) == 0) {
+ *temp = 0;
+ return 0;
+ }
diff --git a/patches.drivers/mlxsw-pci-Reincrease-PCI-reset-timeout.patch b/patches.drivers/mlxsw-pci-Reincrease-PCI-reset-timeout.patch
new file mode 100644
index 0000000000..cef3167870
--- /dev/null
+++ b/patches.drivers/mlxsw-pci-Reincrease-PCI-reset-timeout.patch
@@ -0,0 +1,39 @@
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Thu, 18 Apr 2019 07:14:14 +0000
+Subject: mlxsw: pci: Reincrease PCI reset timeout
+Patch-mainline: v5.1-rc7
+Git-commit: 1ab3030193d25878b3b1409060e1e0a879800c95
+References: bsc#1112374
+
+During driver initialization the driver sends a reset to the device and
+waits for the firmware to signal that it is ready to continue.
+
+Commit d2f372ba0914 ("mlxsw: pci: Increase PCI SW reset timeout")
+increased the timeout to 13 seconds due to longer PHY calibration in
+Spectrum-2 compared to Spectrum-1.
+
+Recently it became apparent that this timeout is too short and therefore
+this patch increases it again to a safer limit that will be reduced in
+the future.
+
+Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC")
+Fixes: d2f372ba0914 ("mlxsw: pci: Increase PCI SW reset timeout")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h
+@@ -27,7 +27,7 @@
+
+ #define MLXSW_PCI_SW_RESET 0xF0010
+ #define MLXSW_PCI_SW_RESET_RST_BIT BIT(0)
+-#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 13000
++#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 20000
+ #define MLXSW_PCI_SW_RESET_WAIT_MSECS 100
+ #define MLXSW_PCI_FW_READY 0xA1844
+ #define MLXSW_PCI_FW_READY_MASK 0xFFFF
diff --git a/patches.drivers/mlxsw-reg-Add-Management-Temperature-Bulk-Register.patch b/patches.drivers/mlxsw-reg-Add-Management-Temperature-Bulk-Register.patch
new file mode 100644
index 0000000000..f126d6e628
--- /dev/null
+++ b/patches.drivers/mlxsw-reg-Add-Management-Temperature-Bulk-Register.patch
@@ -0,0 +1,110 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Wed, 13 Feb 2019 11:28:45 +0000
+Subject: mlxsw: reg: Add Management Temperature Bulk Register
+Patch-mainline: v5.1-rc1
+Git-commit: 5f28ef71a5ce7f3995c11e765683202fb10c1fbd
+References: bsc#1112374
+
+Add MTBR (Management Temperature Bulk Register), which is used for port
+temperature reading in a bulk mode.
+
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/reg.h | 75 ++++++++++++++++++++++++++++++
+ 1 file changed, 75 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -7661,6 +7661,80 @@ static inline void mlxsw_reg_mtmp_unpack
+ mlxsw_reg_mtmp_sensor_name_memcpy_from(payload, sensor_name);
+ }
+
++/* MTBR - Management Temperature Bulk Register
++ * -------------------------------------------
++ * This register is used for bulk temperature reading.
++ */
++#define MLXSW_REG_MTBR_ID 0x900F
++#define MLXSW_REG_MTBR_BASE_LEN 0x10 /* base length, without records */
++#define MLXSW_REG_MTBR_REC_LEN 0x04 /* record length */
++#define MLXSW_REG_MTBR_REC_MAX_COUNT 47 /* firmware limitation */
++#define MLXSW_REG_MTBR_LEN (MLXSW_REG_MTBR_BASE_LEN + \
++ MLXSW_REG_MTBR_REC_LEN * \
++ MLXSW_REG_MTBR_REC_MAX_COUNT)
++
++MLXSW_REG_DEFINE(mtbr, MLXSW_REG_MTBR_ID, MLXSW_REG_MTBR_LEN);
++
++/* reg_mtbr_base_sensor_index
++ * Base sensors index to access (0 - ASIC sensor, 1-63 - ambient sensors,
++ * 64-127 are mapped to the SFP+/QSFP modules sequentially).
++ * Access: Index
++ */
++MLXSW_ITEM32(reg, mtbr, base_sensor_index, 0x00, 0, 7);
++
++/* reg_mtbr_num_rec
++ * Request: Number of records to read
++ * Response: Number of records read
++ * See above description for more details.
++ * Range 1..255
++ * Access: RW
++ */
++MLXSW_ITEM32(reg, mtbr, num_rec, 0x04, 0, 8);
++
++/* reg_mtbr_rec_max_temp
++ * The highest measured temperature from the sensor.
++ * When the bit mte is cleared, the field max_temperature is reserved.
++ * Access: RO
++ */
++MLXSW_ITEM32_INDEXED(reg, mtbr, rec_max_temp, MLXSW_REG_MTBR_BASE_LEN, 16,
++ 16, MLXSW_REG_MTBR_REC_LEN, 0x00, false);
++
++/* reg_mtbr_rec_temp
++ * Temperature reading from the sensor. Reading is in 0..125 Celsius
++ * degrees units.
++ * Access: RO
++ */
++MLXSW_ITEM32_INDEXED(reg, mtbr, rec_temp, MLXSW_REG_MTBR_BASE_LEN, 0, 16,
++ MLXSW_REG_MTBR_REC_LEN, 0x00, false);
++
++static inline void mlxsw_reg_mtbr_pack(char *payload, u8 base_sensor_index,
++ u8 num_rec)
++{
++ MLXSW_REG_ZERO(mtbr, payload);
++ mlxsw_reg_mtbr_base_sensor_index_set(payload, base_sensor_index);
++ mlxsw_reg_mtbr_num_rec_set(payload, num_rec);
++}
++
++/* Error codes from temperatute reading */
++enum mlxsw_reg_mtbr_temp_status {
++ MLXSW_REG_MTBR_NO_CONN = 0x8000,
++ MLXSW_REG_MTBR_NO_TEMP_SENS = 0x8001,
++ MLXSW_REG_MTBR_INDEX_NA = 0x8002,
++ MLXSW_REG_MTBR_BAD_SENS_INFO = 0x8003,
++};
++
++/* Base index for reading modules temperature */
++#define MLXSW_REG_MTBR_BASE_MODULE_INDEX 64
++
++static inline void mlxsw_reg_mtbr_temp_unpack(char *payload, int rec_ind,
++ u16 *p_temp, u16 *p_max_temp)
++{
++ if (p_temp)
++ *p_temp = mlxsw_reg_mtbr_rec_temp_get(payload, rec_ind);
++ if (p_max_temp)
++ *p_max_temp = mlxsw_reg_mtbr_rec_max_temp_get(payload, rec_ind);
++}
++
+ /* MCIA - Management Cable Info Access
+ * -----------------------------------
+ * MCIA register is used to access the SFP+ and QSFP connector's EPROM.
+@@ -9437,6 +9511,7 @@ static const struct mlxsw_reg_info *mlxs
+ MLXSW_REG(mfsl),
+ MLXSW_REG(mtcap),
+ MLXSW_REG(mtmp),
++ MLXSW_REG(mtbr),
+ MLXSW_REG(mcia),
+ MLXSW_REG(mpat),
+ MLXSW_REG(mpar),
diff --git a/patches.drivers/mlxsw-spectrum-Move-QSFP-EEPROM-definitions-to-commo.patch b/patches.drivers/mlxsw-spectrum-Move-QSFP-EEPROM-definitions-to-commo.patch
new file mode 100644
index 0000000000..f174b2cf90
--- /dev/null
+++ b/patches.drivers/mlxsw-spectrum-Move-QSFP-EEPROM-definitions-to-commo.patch
@@ -0,0 +1,180 @@
+From: Vadim Pasternak <vadimp@mellanox.com>
+Date: Wed, 13 Feb 2019 11:28:44 +0000
+Subject: mlxsw: spectrum: Move QSFP EEPROM definitions to common location
+Patch-mainline: v5.1-rc1
+Git-commit: d517ee7ca8ff8dfe2b200fd7b3087f00ede5f56f
+References: bsc#1112374
+
+Move QSFP EEPROM definitions to common location from the spectrum driver
+in order to make them available for other mlxsw modules. They are common
+for all kind of chips and have relation to SFF specifications 8024,
+8436, 8472, 8636, rather than to chip type.
+
+Signed-off-by: Vadim Pasternak <vadimp@mellanox.com>
+Reviewed-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/reg.h | 32 ++++++++++++
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 62 ++++++++-----------------
+ 2 files changed, 52 insertions(+), 42 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h
+@@ -7715,13 +7715,41 @@ MLXSW_ITEM32(reg, mcia, device_address,
+ */
+ MLXSW_ITEM32(reg, mcia, size, 0x08, 0, 16);
+
+-#define MLXSW_SP_REG_MCIA_EEPROM_SIZE 48
++#define MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH 256
++#define MLXSW_REG_MCIA_EEPROM_SIZE 48
++#define MLXSW_REG_MCIA_I2C_ADDR_LOW 0x50
++#define MLXSW_REG_MCIA_I2C_ADDR_HIGH 0x51
++#define MLXSW_REG_MCIA_PAGE0_LO_OFF 0xa0
++#define MLXSW_REG_MCIA_TH_ITEM_SIZE 2
++#define MLXSW_REG_MCIA_TH_PAGE_NUM 3
++#define MLXSW_REG_MCIA_PAGE0_LO 0
++#define MLXSW_REG_MCIA_TH_PAGE_OFF 0x80
++
++enum mlxsw_reg_mcia_eeprom_module_info_rev_id {
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID_UNSPC = 0x00,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID_8436 = 0x01,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID_8636 = 0x03,
++};
++
++enum mlxsw_reg_mcia_eeprom_module_info_id {
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP = 0x03,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP = 0x0C,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_PLUS = 0x0D,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28 = 0x11,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_DD = 0x18,
++};
++
++enum mlxsw_reg_mcia_eeprom_module_info {
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID,
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE,
++};
+
+ /* reg_mcia_eeprom
+ * Bytes to read/write.
+ * Access: RW
+ */
+-MLXSW_ITEM_BUF(reg, mcia, eeprom, 0x10, MLXSW_SP_REG_MCIA_EEPROM_SIZE);
++MLXSW_ITEM_BUF(reg, mcia, eeprom, 0x10, MLXSW_REG_MCIA_EEPROM_SIZE);
+
+ static inline void mlxsw_reg_mcia_pack(char *payload, u8 module, u8 lock,
+ u8 page_number, u16 device_addr,
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2552,23 +2552,23 @@ static int mlxsw_sp_query_module_eeprom(
+ unsigned int *p_read_size)
+ {
+ struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;
+- char eeprom_tmp[MLXSW_SP_REG_MCIA_EEPROM_SIZE];
++ char eeprom_tmp[MLXSW_REG_MCIA_EEPROM_SIZE];
+ char mcia_pl[MLXSW_REG_MCIA_LEN];
+ u16 i2c_addr;
+ int status;
+ int err;
+
+- size = min_t(u16, size, MLXSW_SP_REG_MCIA_EEPROM_SIZE);
++ size = min_t(u16, size, MLXSW_REG_MCIA_EEPROM_SIZE);
+
+- if (offset < MLXSW_SP_EEPROM_PAGE_LENGTH &&
+- offset + size > MLXSW_SP_EEPROM_PAGE_LENGTH)
++ if (offset < MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH &&
++ offset + size > MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH)
+ /* Cross pages read, read until offset 256 in low page */
+- size = MLXSW_SP_EEPROM_PAGE_LENGTH - offset;
++ size = MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH - offset;
+
+- i2c_addr = MLXSW_SP_I2C_ADDR_LOW;
+- if (offset >= MLXSW_SP_EEPROM_PAGE_LENGTH) {
+- i2c_addr = MLXSW_SP_I2C_ADDR_HIGH;
+- offset -= MLXSW_SP_EEPROM_PAGE_LENGTH;
++ i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_LOW;
++ if (offset >= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH) {
++ i2c_addr = MLXSW_REG_MCIA_I2C_ADDR_HIGH;
++ offset -= MLXSW_REG_MCIA_EEPROM_PAGE_LENGTH;
+ }
+
+ mlxsw_reg_mcia_pack(mcia_pl, mlxsw_sp_port->mapping.module,
+@@ -2589,55 +2589,37 @@ static int mlxsw_sp_query_module_eeprom(
+ return 0;
+ }
+
+-enum mlxsw_sp_eeprom_module_info_rev_id {
+- MLXSW_SP_EEPROM_MODULE_INFO_REV_ID_UNSPC = 0x00,
+- MLXSW_SP_EEPROM_MODULE_INFO_REV_ID_8436 = 0x01,
+- MLXSW_SP_EEPROM_MODULE_INFO_REV_ID_8636 = 0x03,
+-};
+-
+-enum mlxsw_sp_eeprom_module_info_id {
+- MLXSW_SP_EEPROM_MODULE_INFO_ID_SFP = 0x03,
+- MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP = 0x0C,
+- MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP_PLUS = 0x0D,
+- MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP28 = 0x11,
+-};
+-
+-enum mlxsw_sp_eeprom_module_info {
+- MLXSW_SP_EEPROM_MODULE_INFO_ID,
+- MLXSW_SP_EEPROM_MODULE_INFO_REV_ID,
+- MLXSW_SP_EEPROM_MODULE_INFO_SIZE,
+-};
+-
+ static int mlxsw_sp_get_module_info(struct net_device *netdev,
+ struct ethtool_modinfo *modinfo)
+ {
+ struct mlxsw_sp_port *mlxsw_sp_port = netdev_priv(netdev);
+- u8 module_info[MLXSW_SP_EEPROM_MODULE_INFO_SIZE];
++ u8 module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE];
++ u16 offset = MLXSW_REG_MCIA_EEPROM_MODULE_INFO_SIZE;
+ u8 module_rev_id, module_id;
+ unsigned int read_size;
+ int err;
+
+- err = mlxsw_sp_query_module_eeprom(mlxsw_sp_port, 0,
+- MLXSW_SP_EEPROM_MODULE_INFO_SIZE,
++ err = mlxsw_sp_query_module_eeprom(mlxsw_sp_port, 0, offset,
+ module_info, &read_size);
+ if (err)
+ return err;
+
+- if (read_size < MLXSW_SP_EEPROM_MODULE_INFO_SIZE)
++ if (read_size < offset)
+ return -EIO;
+
+- module_rev_id = module_info[MLXSW_SP_EEPROM_MODULE_INFO_REV_ID];
+- module_id = module_info[MLXSW_SP_EEPROM_MODULE_INFO_ID];
++ module_rev_id = module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID];
++ module_id = module_info[MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID];
+
+ switch (module_id) {
+- case MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP:
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP:
+ modinfo->type = ETH_MODULE_SFF_8436;
+ modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
+ break;
+- case MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP_PLUS:
+- case MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP28:
+- if (module_id == MLXSW_SP_EEPROM_MODULE_INFO_ID_QSFP28 ||
+- module_rev_id >= MLXSW_SP_EEPROM_MODULE_INFO_REV_ID_8636) {
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP_PLUS: /* fall-through */
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28:
++ if (module_id == MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_QSFP28 ||
++ module_rev_id >=
++ MLXSW_REG_MCIA_EEPROM_MODULE_INFO_REV_ID_8636) {
+ modinfo->type = ETH_MODULE_SFF_8636;
+ modinfo->eeprom_len = ETH_MODULE_SFF_8636_LEN;
+ } else {
+@@ -2645,7 +2627,7 @@ static int mlxsw_sp_get_module_info(stru
+ modinfo->eeprom_len = ETH_MODULE_SFF_8436_LEN;
+ }
+ break;
+- case MLXSW_SP_EEPROM_MODULE_INFO_ID_SFP:
++ case MLXSW_REG_MCIA_EEPROM_MODULE_INFO_ID_SFP:
+ modinfo->type = ETH_MODULE_SFF_8472;
+ modinfo->eeprom_len = ETH_MODULE_SFF_8472_LEN;
+ break;
diff --git a/patches.drivers/mlxsw-spectrum-Put-MC-TCs-into-DWRR-mode.patch b/patches.drivers/mlxsw-spectrum-Put-MC-TCs-into-DWRR-mode.patch
new file mode 100644
index 0000000000..72c7b85b7b
--- /dev/null
+++ b/patches.drivers/mlxsw-spectrum-Put-MC-TCs-into-DWRR-mode.patch
@@ -0,0 +1,42 @@
+From: Petr Machata <petrm@mellanox.com>
+Date: Thu, 18 Apr 2019 07:14:13 +0000
+Subject: mlxsw: spectrum: Put MC TCs into DWRR mode
+Patch-mainline: v5.1-rc7
+Git-commit: f476b3f809fa02f47af6333ed63715058c3fc348
+References: bsc#1112374
+
+Both Spectrum-1 and Spectrum-2 chips are currently configured such that
+pairs of TC n (which is used for UC traffic) and TC n+8 (which is used
+for MC traffic) are feeding into the same subgroup. Strict
+prioritization is configured between the two TCs, and by enabling
+MC-aware mode on the switch, the lower-numbered (UC) TCs are favored
+over the higher-numbered (MC) TCs.
+
+On Spectrum-2 however, there is an issue in configuration of the
+MC-aware mode. As a result, MC traffic is prioritized over UC traffic.
+To work around the issue, configure the MC TCs with DWRR mode (while
+keeping the UC TCs in strict mode).
+
+With this patch, the multicast-unicast arbitration results in the same
+behavior on both Spectrum-1 and Spectrum-2 chips.
+
+Fixes: 7b8195306694 ("mlxsw: spectrum: Configure MC-aware mode on mlxsw ports")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -2801,7 +2801,7 @@ static int mlxsw_sp_port_ets_init(struct
+ err = mlxsw_sp_port_ets_set(mlxsw_sp_port,
+ MLXSW_REG_QEEC_HIERARCY_TC,
+ i + 8, i,
+- false, 0);
++ true, 100);
+ if (err)
+ return err;
+ }
diff --git a/patches.drivers/mlxsw-spectrum_flower-Fix-TOS-matching.patch b/patches.drivers/mlxsw-spectrum_flower-Fix-TOS-matching.patch
new file mode 100644
index 0000000000..c21ef5b597
--- /dev/null
+++ b/patches.drivers/mlxsw-spectrum_flower-Fix-TOS-matching.patch
@@ -0,0 +1,30 @@
+From: Jiri Pirko <jiri@mellanox.com>
+Date: Tue, 11 Jun 2019 10:19:43 +0300
+Subject: mlxsw: spectrum_flower: Fix TOS matching
+Patch-mainline: v5.2-rc6
+Git-commit: e49f9adffb28c5acbaea46ddfe2d17b1373c2473
+References: bsc#1112374
+
+The TOS value was not extracted correctly. Fix it.
+
+Fixes: 87996f91f739 ("mlxsw: spectrum_flower: Add support for ip tos")
+Reported-by: Alexander Petrovskiy <alexpe@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+@@ -253,7 +253,7 @@ static int mlxsw_sp_flower_parse_ip(stru
+ key->tos & 0x3, mask->tos & 0x3);
+
+ mlxsw_sp_acl_rulei_keymask_u32(rulei, MLXSW_AFK_ELEMENT_IP_DSCP,
+- key->tos >> 6, mask->tos >> 6);
++ key->tos >> 2, mask->tos >> 2);
+
+ return 0;
+ }
diff --git a/patches.drivers/mm-devm_memremap_pages-introduce-devm_memunmap_pages.patch b/patches.drivers/mm-devm_memremap_pages-introduce-devm_memunmap_pages.patch
new file mode 100644
index 0000000000..2843fb3308
--- /dev/null
+++ b/patches.drivers/mm-devm_memremap_pages-introduce-devm_memunmap_pages.patch
@@ -0,0 +1,67 @@
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 13 Jun 2019 15:56:21 -0700
+Subject: mm/devm_memremap_pages: introduce devm_memunmap_pages
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Patch-mainline: v5.2-rc5
+Git-commit: 2e3f139e8ecebf177fe01299285a56855e93fb84
+References: bsc#1103992 FATE#326009
+
+Use the new devm_release_action() facility to allow
+devm_memremap_pages_release() to be manually triggered.
+
+Link: http://lkml.kernel.org/r/155727337088.292046.5774214552136776763.stgit@dwillia2-desk3.amr.corp.intel.com
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Reviewed-by: Ira Weiny <ira.weiny@intel.com>
+Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Cc: "Jérôme Glisse" <jglisse@redhat.com>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ include/linux/memremap.h | 6 ++++++
+ kernel/memremap.c | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+--- a/include/linux/memremap.h
++++ b/include/linux/memremap.h
+@@ -129,6 +129,7 @@ struct dev_pagemap {
+
+ #ifdef CONFIG_ZONE_DEVICE
+ void *devm_memremap_pages(struct device *dev, struct dev_pagemap *pgmap);
++void devm_memunmap_pages(struct device *dev, struct dev_pagemap *pgmap);
+ struct dev_pagemap *get_dev_pagemap(unsigned long pfn,
+ struct dev_pagemap *pgmap);
+
+@@ -147,6 +148,11 @@ static inline void *devm_memremap_pages(
+ return ERR_PTR(-ENXIO);
+ }
+
++static inline void devm_memunmap_pages(struct device *dev,
++ struct dev_pagemap *pgmap)
++{
++}
++
+ static inline struct dev_pagemap *get_dev_pagemap(unsigned long pfn,
+ struct dev_pagemap *pgmap)
+ {
+--- a/kernel/memremap.c
++++ b/kernel/memremap.c
+@@ -427,6 +427,12 @@ void *devm_memremap_pages(struct device
+ }
+ EXPORT_SYMBOL(devm_memremap_pages);
+
++void devm_memunmap_pages(struct device *dev, struct dev_pagemap *pgmap)
++{
++ devm_release_action(dev, devm_memremap_pages_release, pgmap);
++}
++EXPORT_SYMBOL_GPL(devm_memunmap_pages);
++
+ unsigned long vmem_altmap_offset(struct vmem_altmap *altmap)
+ {
+ /* number of pfns from base where pfn_to_page() is valid */
diff --git a/patches.drivers/mmc-core-Prevent-processing-SDIO-IRQs-when-the-card-.patch b/patches.drivers/mmc-core-Prevent-processing-SDIO-IRQs-when-the-card-.patch
new file mode 100644
index 0000000000..c0a622d839
--- /dev/null
+++ b/patches.drivers/mmc-core-Prevent-processing-SDIO-IRQs-when-the-card-.patch
@@ -0,0 +1,79 @@
+From 83293386bc95cf5e9f0c0175794455835bd1cb4a Mon Sep 17 00:00:00 2001
+From: Ulf Hansson <ulf.hansson@linaro.org>
+Date: Tue, 18 Jun 2019 14:05:17 +0200
+Subject: [PATCH] mmc: core: Prevent processing SDIO IRQs when the card is suspended
+Git-commit: 83293386bc95cf5e9f0c0175794455835bd1cb4a
+Patch-mainline: v5.2-rc6
+References: bsc#1051510
+
+[ Backport note: cancel_delayed_work_sync() call in mmc_sdio_suspend()
+ is commented out, as the work doesn't exist in SLE15 code ]
+
+Processing of SDIO IRQs must obviously be prevented while the card is
+system suspended, otherwise we may end up trying to communicate with an
+uninitialized SDIO card.
+
+Reports throughout the years shows that this is not only a theoretical
+problem, but a real issue. So, let's finally fix this problem, by keeping
+track of the state for the card and bail out before processing the SDIO
+IRQ, in case the card is suspended.
+
+Cc: stable@vger.kernel.org
+Reported-by: Douglas Anderson <dianders@chromium.org>
+Tested-by: Douglas Anderson <dianders@chromium.org>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/core/sdio.c | 13 ++++++++++++-
+ drivers/mmc/core/sdio_irq.c | 4 ++++
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+--- a/drivers/mmc/core/sdio.c
++++ b/drivers/mmc/core/sdio.c
+@@ -907,6 +907,10 @@ static int mmc_sdio_pre_suspend(struct m
+ */
+ static int mmc_sdio_suspend(struct mmc_host *host)
+ {
++ /* Prevent processing of SDIO IRQs in suspended state. */
++ mmc_card_set_suspended(host->card);
++ /* cancel_delayed_work_sync(&host->sdio_irq_work); */
++
+ mmc_claim_host(host);
+
+ if (mmc_card_keep_power(host) && mmc_card_wake_sdio_irq(host))
+@@ -962,13 +966,20 @@ static int mmc_sdio_resume(struct mmc_ho
+ err = sdio_enable_4bit_bus(host->card);
+ }
+
+- if (!err && host->sdio_irqs) {
++ if (err)
++ goto out;
++
++ /* Allow SDIO IRQs to be processed again. */
++ mmc_card_clr_suspended(host->card);
++
++ if (host->sdio_irqs) {
+ if (!(host->caps2 & MMC_CAP2_SDIO_IRQ_NOTHREAD))
+ wake_up_process(host->sdio_irq_thread);
+ else if (host->caps & MMC_CAP_SDIO_IRQ)
+ host->ops->enable_sdio_irq(host, 1);
+ }
+
++out:
+ mmc_release_host(host);
+
+ host->pm_flags &= ~MMC_PM_KEEP_POWER;
+--- a/drivers/mmc/core/sdio_irq.c
++++ b/drivers/mmc/core/sdio_irq.c
+@@ -38,6 +38,10 @@ static int process_sdio_pending_irqs(str
+ unsigned char pending;
+ struct sdio_func *func;
+
++ /* Don't process SDIO IRQs if the card is suspended. */
++ if (mmc_card_suspended(card))
++ return 0;
++
+ /*
+ * Optimization, if there is only 1 function interrupt registered
+ * and we know an IRQ was signaled then call irq handler directly.
diff --git a/patches.drivers/mmc-core-complete-HS400-before-checking-status.patch b/patches.drivers/mmc-core-complete-HS400-before-checking-status.patch
new file mode 100644
index 0000000000..f3c23d9570
--- /dev/null
+++ b/patches.drivers/mmc-core-complete-HS400-before-checking-status.patch
@@ -0,0 +1,48 @@
+From b0e370b95a3b231d0fb5d1958cce85ef57196fe6 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Tue, 11 Jun 2019 22:03:43 +0200
+Subject: [PATCH] mmc: core: complete HS400 before checking status
+Git-commit: b0e370b95a3b231d0fb5d1958cce85ef57196fe6
+Patch-mainline: v5.2-rc6
+References: bsc#1111666
+
+We don't have a reproducible error case, yet our BSP team suggested that
+the mmc_switch_status() command in mmc_select_hs400() should come after
+the callback into the driver completing HS400 setup. It makes sense to
+me because we want the status of a fully setup HS400, so it will
+increase the reliability of the mmc_switch_status() command.
+
+Reported-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Fixes: ba6c7ac3a2f4 ("mmc: core: more fine-grained hooks for HS400 tuning")
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/mmc/core/mmc.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 3e786ba204c3..671bfcceea6a 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -1212,13 +1212,13 @@ static int mmc_select_hs400(struct mmc_card *card)
+ mmc_set_timing(host, MMC_TIMING_MMC_HS400);
+ mmc_set_bus_speed(card);
+
++ if (host->ops->hs400_complete)
++ host->ops->hs400_complete(host);
++
+ err = mmc_switch_status(card);
+ if (err)
+ goto out_err;
+
+- if (host->ops->hs400_complete)
+- host->ops->hs400_complete(host);
+-
+ return 0;
+
+ out_err:
+--
+2.16.4
+
diff --git a/patches.drivers/net-Fix-missing-meta-data-in-skb-with-vlan-packet.patch b/patches.drivers/net-Fix-missing-meta-data-in-skb-with-vlan-packet.patch
new file mode 100644
index 0000000000..d8a18b3d78
--- /dev/null
+++ b/patches.drivers/net-Fix-missing-meta-data-in-skb-with-vlan-packet.patch
@@ -0,0 +1,47 @@
+From: Yuya Kusakabe <yuya.kusakabe@gmail.com>
+Date: Tue, 16 Apr 2019 10:22:28 +0900
+Subject: net: Fix missing meta data in skb with vlan packet
+Patch-mainline: v5.1-rc6
+Git-commit: d85e8be2a5a02869f815dd0ac2d743deb4cd7957
+References: bsc#1109837
+
+skb_reorder_vlan_header() should move XDP meta data with ethernet header
+if XDP meta data exists.
+
+Fixes: de8f3a83b0a0 ("bpf: add meta pointer for direct access")
+Signed-off-by: Yuya Kusakabe <yuya.kusakabe@gmail.com>
+Signed-off-by: Takeru Hayasaka <taketarou2@gmail.com>
+Co-developed-by: Takeru Hayasaka <taketarou2@gmail.com>
+Reviewed-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/core/skbuff.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4694,7 +4694,8 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mac_l
+
+ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
+ {
+- int mac_len;
++ int mac_len, meta_len;
++ void *meta;
+
+ if (skb_cow(skb, skb_headroom(skb)) < 0) {
+ kfree_skb(skb);
+@@ -4706,6 +4707,13 @@ static struct sk_buff *skb_reorder_vlan_
+ memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb),
+ mac_len - VLAN_HLEN - ETH_TLEN);
+ }
++
++ meta_len = skb_metadata_len(skb);
++ if (meta_len) {
++ meta = skb_metadata_end(skb) - meta_len;
++ memmove(meta + VLAN_HLEN, meta, meta_len);
++ }
++
+ skb->mac_header += VLAN_HLEN;
+ return skb;
+ }
diff --git a/patches.drivers/net-core-support-XDP-generic-on-stacked-devices.patch b/patches.drivers/net-core-support-XDP-generic-on-stacked-devices.patch
new file mode 100644
index 0000000000..05a41af8cd
--- /dev/null
+++ b/patches.drivers/net-core-support-XDP-generic-on-stacked-devices.patch
@@ -0,0 +1,116 @@
+From: Stephen Hemminger <stephen@networkplumber.org>
+Date: Tue, 28 May 2019 11:47:31 -0700
+Subject: net: core: support XDP generic on stacked devices.
+Patch-mainline: v5.2-rc3
+Git-commit: 458bf2f224f04a513b0be972f8708e78ee2c986e
+References: bsc#1109837
+
+When a device is stacked like (team, bonding, failsafe or netvsc) the
+XDP generic program for the parent device was not called.
+
+Move the call to XDP generic inside __netif_receive_skb_core where
+it can be done multiple times for stacked case.
+
+Fixes: d445516966dc ("net: xdp: support xdp generic on virtual devices")
+Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/core/dev.c | 58 +++++++++++----------------------------------------------
+ 1 file changed, 12 insertions(+), 46 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4419,23 +4419,6 @@ static int netif_rx_internal(struct sk_b
+
+ trace_netif_rx(skb);
+
+- if (static_branch_unlikely(&generic_xdp_needed_key)) {
+- int ret;
+-
+- preempt_disable();
+- rcu_read_lock();
+- ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+- rcu_read_unlock();
+- preempt_enable();
+-
+- /* Consider XDP consuming the packet a success from
+- * the netdev point of view we do not want to count
+- * this as an error.
+- */
+- if (ret != XDP_PASS)
+- return NET_RX_SUCCESS;
+- }
+-
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+ struct rps_dev_flow voidflow, *rflow = &voidflow;
+@@ -4769,6 +4752,18 @@ another_round:
+
+ __this_cpu_inc(softnet_data.processed);
+
++ if (static_branch_unlikely(&generic_xdp_needed_key)) {
++ int ret2;
++
++ preempt_disable();
++ ret2 = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
++ preempt_enable();
++
++ if (ret2 != XDP_PASS)
++ return NET_RX_DROP;
++ skb_reset_mac_len(skb);
++ }
++
+ if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
+ skb->protocol == cpu_to_be16(ETH_P_8021AD)) {
+ skb = skb_vlan_untag(skb);
+@@ -5087,19 +5082,6 @@ static int netif_receive_skb_internal(st
+ if (skb_defer_rx_timestamp(skb))
+ return NET_RX_SUCCESS;
+
+- if (static_branch_unlikely(&generic_xdp_needed_key)) {
+- int ret;
+-
+- preempt_disable();
+- rcu_read_lock();
+- ret = do_xdp_generic(rcu_dereference(skb->dev->xdp_prog), skb);
+- rcu_read_unlock();
+- preempt_enable();
+-
+- if (ret != XDP_PASS)
+- return NET_RX_DROP;
+- }
+-
+ rcu_read_lock();
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+@@ -5120,7 +5102,6 @@ static int netif_receive_skb_internal(st
+
+ static void netif_receive_skb_list_internal(struct list_head *head)
+ {
+- struct bpf_prog *xdp_prog = NULL;
+ struct sk_buff *skb, *next;
+ struct list_head sublist;
+
+@@ -5133,21 +5114,6 @@ static void netif_receive_skb_list_inter
+ }
+ list_splice_init(&sublist, head);
+
+- if (static_branch_unlikely(&generic_xdp_needed_key)) {
+- preempt_disable();
+- rcu_read_lock();
+- list_for_each_entry_safe(skb, next, head, list) {
+- xdp_prog = rcu_dereference(skb->dev->xdp_prog);
+- skb_list_del_init(skb);
+- if (do_xdp_generic(xdp_prog, skb) == XDP_PASS)
+- list_add_tail(&skb->list, &sublist);
+- }
+- rcu_read_unlock();
+- preempt_enable();
+- /* Put passed packets back on main list */
+- list_splice_init(&sublist, head);
+- }
+-
+ rcu_read_lock();
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
diff --git a/patches.drivers/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch b/patches.drivers/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch
new file mode 100644
index 0000000000..69c87615c0
--- /dev/null
+++ b/patches.drivers/net-don-t-clear-sock-sk-early-to-avoid-trouble-in-st.patch
@@ -0,0 +1,78 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Wed, 29 May 2019 16:33:23 -0700
+Subject: net: don't clear sock->sk early to avoid trouble in strparser
+Patch-mainline: v5.2-rc3
+Git-commit: 2b81f8161dfeda4017cef4f2498ccb64b13f0d61
+References: bsc#1103990 FATE#326006
+
+af_inet sets sock->sk to NULL which trips strparser over:
+
+BUG: kernel NULL pointer dereference, address: 0000000000000012
+PGD 0 P4D 0
+Oops: 0000 [#1] SMP PTI
+CPU: 7 PID: 0 Comm: swapper/7 Not tainted 5.2.0-rc1-00139-g14629453a6d3 #21
+RIP: 0010:tcp_peek_len+0x10/0x60
+RSP: 0018:ffffc02e41c54b98 EFLAGS: 00010246
+RAX: 0000000000000000 RBX: ffff9cf924c4e030 RCX: 0000000000000051
+RDX: 0000000000000000 RSI: 000000000000000c RDI: ffff9cf97128f480
+RBP: ffff9cf9365e0300 R08: ffff9cf94fe7d2c0 R09: 0000000000000000
+R10: 000000000000036b R11: ffff9cf939735e00 R12: ffff9cf91ad9ae40
+R13: ffff9cf924c4e000 R14: ffff9cf9a8fcbaae R15: 0000000000000020
+FS: 0000000000000000(0000) GS:ffff9cf9af7c0000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 0000000000000012 CR3: 000000013920a003 CR4: 00000000003606e0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ Call Trace:
+ <IRQ>
+ strp_data_ready+0x48/0x90
+ tls_data_ready+0x22/0xd0 [tls]
+ tcp_rcv_established+0x569/0x620
+ tcp_v4_do_rcv+0x127/0x1e0
+ tcp_v4_rcv+0xad7/0xbf0
+ ip_protocol_deliver_rcu+0x2c/0x1c0
+ ip_local_deliver_finish+0x41/0x50
+ ip_local_deliver+0x6b/0xe0
+ ? ip_protocol_deliver_rcu+0x1c0/0x1c0
+ ip_rcv+0x52/0xd0
+ ? ip_rcv_finish_core.isra.20+0x380/0x380
+ __netif_receive_skb_one_core+0x7e/0x90
+ netif_receive_skb_internal+0x42/0xf0
+ napi_gro_receive+0xed/0x150
+ nfp_net_poll+0x7a2/0xd30 [nfp]
+ ? kmem_cache_free_bulk+0x286/0x310
+ net_rx_action+0x149/0x3b0
+ __do_softirq+0xe3/0x30a
+ ? handle_irq_event_percpu+0x6a/0x80
+ irq_exit+0xe8/0xf0
+ do_IRQ+0x85/0xd0
+ common_interrupt+0xf/0xf
+ </IRQ>
+RIP: 0010:cpuidle_enter_state+0xbc/0x450
+
+To avoid this issue set sock->sk after sk_prot->close.
+My grepping and testing did not discover any code which
+would depend on the current behaviour.
+
+Fixes: c46234ebb4d1 ("tls: RX path for ktls")
+Reported-by: David Beckett <david.beckett@netronome.com>
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/ipv4/af_inet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -422,8 +422,8 @@ int inet_release(struct socket *sock)
+ if (sock_flag(sk, SOCK_LINGER) &&
+ !(current->flags & PF_EXITING))
+ timeout = sk->sk_lingertime;
+- sock->sk = NULL;
+ sk->sk_prot->close(sk, timeout);
++ sock->sk = NULL;
+ }
+ return 0;
+ }
diff --git a/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch b/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch
new file mode 100644
index 0000000000..67a0d00b44
--- /dev/null
+++ b/patches.drivers/net-ena-Fix-bug-where-ring-allocation-backoff-stoppe.patch
@@ -0,0 +1,39 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Sun, 23 Jun 2019 10:11:10 +0300
+Subject: net: ena: Fix bug where ring allocation backoff stopped too late
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 3e5bfb189e1a65df132fd0e3fa00fbb6feec1431
+References: bsc#1138879
+
+The current code of create_queues_with_size_backoff() allows the ring size
+to become as small as ENA_MIN_RING_SIZE/2. This is a bug since we don't
+want the queue ring to be smaller than ENA_MIN_RING_SIZE
+
+In this commit we change the loop's termination condition to look at the
+queue size of the next iteration instead of that of the current one,
+so that the minimal queue size again becomes ENA_MIN_RING_SIZE.
+
+Fixes: eece4d2ab9d2 ("net: ena: add ethtool function for changing io queue sizes")
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1840,8 +1840,8 @@ err_setup_tx:
+ if (cur_rx_ring_size >= cur_tx_ring_size)
+ new_rx_ring_size = cur_rx_ring_size / 2;
+
+- if (cur_tx_ring_size < ENA_MIN_RING_SIZE ||
+- cur_rx_ring_size < ENA_MIN_RING_SIZE) {
++ if (new_tx_ring_size < ENA_MIN_RING_SIZE ||
++ new_rx_ring_size < ENA_MIN_RING_SIZE) {
+ netif_err(adapter, ifup, adapter->netdev,
+ "Queue creation failed with the smallest possible queue size of %d for both queues. Not retrying with smaller queues\n",
+ ENA_MIN_RING_SIZE);
diff --git a/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch b/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch
new file mode 100644
index 0000000000..0b34ea0c62
--- /dev/null
+++ b/patches.drivers/net-ena-add-MAX_QUEUES_EXT-get-feature-admin-command.patch
@@ -0,0 +1,366 @@
+From: Arthur Kiyanovski <akiyano@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:05 +0300
+Subject: net: ena: add MAX_QUEUES_EXT get feature admin command
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: ba8ef506fb91005fc4808370b7587ab7bf4bd918
+References: bsc#1138879
+
+Add a new admin command to support different queue size for Tx/Rx
+queues (the change also support different SQ/CQ sizes)
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_admin_defs.h | 56 ++++++++++++++++
+ drivers/net/ethernet/amazon/ena/ena_com.c | 76 ++++++++++++++---------
+ drivers/net/ethernet/amazon/ena/ena_com.h | 3
+ 3 files changed, 105 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
++++ b/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
+@@ -64,6 +64,7 @@ enum ena_admin_aq_feature_id {
+ ENA_ADMIN_LLQ = 4,
+ ENA_ADMIN_EXTRA_PROPERTIES_STRINGS = 5,
+ ENA_ADMIN_EXTRA_PROPERTIES_FLAGS = 6,
++ ENA_ADMIN_MAX_QUEUES_EXT = 7,
+ ENA_ADMIN_RSS_HASH_FUNCTION = 10,
+ ENA_ADMIN_STATELESS_OFFLOAD_CONFIG = 11,
+ ENA_ADMIN_RSS_REDIRECTION_TABLE_CONFIG = 12,
+@@ -425,7 +426,13 @@ struct ena_admin_get_set_feature_common_
+ /* as appears in ena_admin_aq_feature_id */
+ u8 feature_id;
+
+- u16 reserved16;
++ /* The driver specifies the max feature version it supports and the
++ * device responds with the currently supported feature version. The
++ * field is zero based
++ */
++ u8 feature_version;
++
++ u8 reserved8;
+ };
+
+ struct ena_admin_device_attr_feature_desc {
+@@ -535,6 +542,34 @@ struct ena_admin_feature_llq_desc {
+ u32 max_tx_burst_size;
+ };
+
++struct ena_admin_queue_ext_feature_fields {
++ u32 max_tx_sq_num;
++
++ u32 max_tx_cq_num;
++
++ u32 max_rx_sq_num;
++
++ u32 max_rx_cq_num;
++
++ u32 max_tx_sq_depth;
++
++ u32 max_tx_cq_depth;
++
++ u32 max_rx_sq_depth;
++
++ u32 max_rx_cq_depth;
++
++ u32 max_tx_header_size;
++
++ /* Maximum Descriptors number, including meta descriptor, allowed for
++ * a single Tx packet
++ */
++ u16 max_per_packet_tx_descs;
++
++ /* Maximum Descriptors number allowed for a single Rx packet */
++ u16 max_per_packet_rx_descs;
++};
++
+ struct ena_admin_queue_feature_desc {
+ u32 max_sq_num;
+
+@@ -849,6 +884,19 @@ struct ena_admin_get_feat_cmd {
+ u32 raw[11];
+ };
+
++struct ena_admin_queue_ext_feature_desc {
++ /* version */
++ u8 version;
++
++ u8 reserved1[3];
++
++ union {
++ struct ena_admin_queue_ext_feature_fields max_queue_ext;
++
++ u32 raw[10];
++ };
++};
++
+ struct ena_admin_get_feat_resp {
+ struct ena_admin_acq_common_desc acq_common_desc;
+
+@@ -861,6 +909,8 @@ struct ena_admin_get_feat_resp {
+
+ struct ena_admin_queue_feature_desc max_queue;
+
++ struct ena_admin_queue_ext_feature_desc max_queue_ext;
++
+ struct ena_admin_feature_aenq_desc aenq;
+
+ struct ena_admin_get_feature_link_desc link;
+@@ -929,7 +979,9 @@ struct ena_admin_aenq_common_desc {
+
+ u16 syndrom;
+
+- /* 0 : phase */
++ /* 0 : phase
++ * 7:1 : reserved - MBZ
++ */
+ u8 flags;
+
+ u8 reserved1[3];
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -978,7 +978,8 @@ static int ena_com_get_feature_ex(struct
+ struct ena_admin_get_feat_resp *get_resp,
+ enum ena_admin_aq_feature_id feature_id,
+ dma_addr_t control_buf_dma_addr,
+- u32 control_buff_size)
++ u32 control_buff_size,
++ u8 feature_ver)
+ {
+ struct ena_com_admin_queue *admin_queue;
+ struct ena_admin_get_feat_cmd get_cmd;
+@@ -1009,7 +1010,7 @@ static int ena_com_get_feature_ex(struct
+ }
+
+ get_cmd.control_buffer.length = control_buff_size;
+-
++ get_cmd.feat_common.feature_version = feature_ver;
+ get_cmd.feat_common.feature_id = feature_id;
+
+ ret = ena_com_execute_admin_command(admin_queue,
+@@ -1029,13 +1030,15 @@ static int ena_com_get_feature_ex(struct
+
+ static int ena_com_get_feature(struct ena_com_dev *ena_dev,
+ struct ena_admin_get_feat_resp *get_resp,
+- enum ena_admin_aq_feature_id feature_id)
++ enum ena_admin_aq_feature_id feature_id,
++ u8 feature_ver)
+ {
+ return ena_com_get_feature_ex(ena_dev,
+ get_resp,
+ feature_id,
+ 0,
+- 0);
++ 0,
++ feature_ver);
+ }
+
+ static int ena_com_hash_key_allocate(struct ena_com_dev *ena_dev)
+@@ -1095,7 +1098,7 @@ static int ena_com_indirect_table_alloca
+ int ret;
+
+ ret = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_RSS_REDIRECTION_TABLE_CONFIG);
++ ENA_ADMIN_RSS_REDIRECTION_TABLE_CONFIG, 0);
+ if (unlikely(ret))
+ return ret;
+
+@@ -1515,7 +1518,7 @@ int ena_com_set_aenq_config(struct ena_c
+ struct ena_admin_get_feat_resp get_resp;
+ int ret;
+
+- ret = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_AENQ_CONFIG);
++ ret = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_AENQ_CONFIG, 0);
+ if (ret) {
+ pr_info("Can't get aenq configuration\n");
+ return ret;
+@@ -1890,7 +1893,7 @@ void ena_com_destroy_io_queue(struct ena
+ int ena_com_get_link_params(struct ena_com_dev *ena_dev,
+ struct ena_admin_get_feat_resp *resp)
+ {
+- return ena_com_get_feature(ena_dev, resp, ENA_ADMIN_LINK_CONFIG);
++ return ena_com_get_feature(ena_dev, resp, ENA_ADMIN_LINK_CONFIG, 0);
+ }
+
+ int ena_com_extra_properties_strings_init(struct ena_com_dev *ena_dev)
+@@ -1916,7 +1919,7 @@ int ena_com_extra_properties_strings_ini
+ rc = ena_com_get_feature_ex(ena_dev, &resp,
+ ENA_ADMIN_EXTRA_PROPERTIES_STRINGS,
+ extra_properties_strings->dma_addr,
+- extra_properties_strings->size);
++ extra_properties_strings->size, 0);
+ if (rc) {
+ pr_debug("Failed to get extra properties strings\n");
+ goto err;
+@@ -1946,7 +1949,7 @@ int ena_com_get_extra_properties_flags(s
+ struct ena_admin_get_feat_resp *resp)
+ {
+ return ena_com_get_feature(ena_dev, resp,
+- ENA_ADMIN_EXTRA_PROPERTIES_FLAGS);
++ ENA_ADMIN_EXTRA_PROPERTIES_FLAGS, 0);
+ }
+
+ int ena_com_get_dev_attr_feat(struct ena_com_dev *ena_dev,
+@@ -1956,7 +1959,7 @@ int ena_com_get_dev_attr_feat(struct ena
+ int rc;
+
+ rc = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_DEVICE_ATTRIBUTES);
++ ENA_ADMIN_DEVICE_ATTRIBUTES, 0);
+ if (rc)
+ return rc;
+
+@@ -1964,17 +1967,34 @@ int ena_com_get_dev_attr_feat(struct ena
+ sizeof(get_resp.u.dev_attr));
+ ena_dev->supported_features = get_resp.u.dev_attr.supported_features;
+
+- rc = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_MAX_QUEUES_NUM);
+- if (rc)
+- return rc;
++ if (ena_dev->supported_features & BIT(ENA_ADMIN_MAX_QUEUES_EXT)) {
++ rc = ena_com_get_feature(ena_dev, &get_resp,
++ ENA_ADMIN_MAX_QUEUES_EXT,
++ ENA_FEATURE_MAX_QUEUE_EXT_VER);
++ if (rc)
++ return rc;
+
+- memcpy(&get_feat_ctx->max_queues, &get_resp.u.max_queue,
+- sizeof(get_resp.u.max_queue));
+- ena_dev->tx_max_header_size = get_resp.u.max_queue.max_header_size;
++ if (get_resp.u.max_queue_ext.version != ENA_FEATURE_MAX_QUEUE_EXT_VER)
++ return -EINVAL;
++
++ memcpy(&get_feat_ctx->max_queue_ext, &get_resp.u.max_queue_ext,
++ sizeof(get_resp.u.max_queue_ext));
++ ena_dev->tx_max_header_size =
++ get_resp.u.max_queue_ext.max_queue_ext.max_tx_header_size;
++ } else {
++ rc = ena_com_get_feature(ena_dev, &get_resp,
++ ENA_ADMIN_MAX_QUEUES_NUM, 0);
++ memcpy(&get_feat_ctx->max_queues, &get_resp.u.max_queue,
++ sizeof(get_resp.u.max_queue));
++ ena_dev->tx_max_header_size =
++ get_resp.u.max_queue.max_header_size;
++
++ if (rc)
++ return rc;
++ }
+
+ rc = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_AENQ_CONFIG);
++ ENA_ADMIN_AENQ_CONFIG, 0);
+ if (rc)
+ return rc;
+
+@@ -1982,7 +2002,7 @@ int ena_com_get_dev_attr_feat(struct ena
+ sizeof(get_resp.u.aenq));
+
+ rc = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_STATELESS_OFFLOAD_CONFIG);
++ ENA_ADMIN_STATELESS_OFFLOAD_CONFIG, 0);
+ if (rc)
+ return rc;
+
+@@ -1992,7 +2012,7 @@ int ena_com_get_dev_attr_feat(struct ena
+ /* Driver hints isn't mandatory admin command. So in case the
+ * command isn't supported set driver hints to 0
+ */
+- rc = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_HW_HINTS);
++ rc = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_HW_HINTS, 0);
+
+ if (!rc)
+ memcpy(&get_feat_ctx->hw_hints, &get_resp.u.hw_hints,
+@@ -2003,7 +2023,7 @@ int ena_com_get_dev_attr_feat(struct ena
+ else
+ return rc;
+
+- rc = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_LLQ);
++ rc = ena_com_get_feature(ena_dev, &get_resp, ENA_ADMIN_LLQ, 0);
+ if (!rc)
+ memcpy(&get_feat_ctx->llq, &get_resp.u.llq,
+ sizeof(get_resp.u.llq));
+@@ -2241,7 +2261,7 @@ int ena_com_get_offload_settings(struct
+ struct ena_admin_get_feat_resp resp;
+
+ ret = ena_com_get_feature(ena_dev, &resp,
+- ENA_ADMIN_STATELESS_OFFLOAD_CONFIG);
++ ENA_ADMIN_STATELESS_OFFLOAD_CONFIG, 0);
+ if (unlikely(ret)) {
+ pr_err("Failed to get offload capabilities %d\n", ret);
+ return ret;
+@@ -2270,7 +2290,7 @@ int ena_com_set_hash_function(struct ena
+
+ /* Validate hash function is supported */
+ ret = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_RSS_HASH_FUNCTION);
++ ENA_ADMIN_RSS_HASH_FUNCTION, 0);
+ if (unlikely(ret))
+ return ret;
+
+@@ -2330,7 +2350,7 @@ int ena_com_fill_hash_function(struct en
+ rc = ena_com_get_feature_ex(ena_dev, &get_resp,
+ ENA_ADMIN_RSS_HASH_FUNCTION,
+ rss->hash_key_dma_addr,
+- sizeof(*rss->hash_key));
++ sizeof(*rss->hash_key), 0);
+ if (unlikely(rc))
+ return rc;
+
+@@ -2382,7 +2402,7 @@ int ena_com_get_hash_function(struct ena
+ rc = ena_com_get_feature_ex(ena_dev, &get_resp,
+ ENA_ADMIN_RSS_HASH_FUNCTION,
+ rss->hash_key_dma_addr,
+- sizeof(*rss->hash_key));
++ sizeof(*rss->hash_key), 0);
+ if (unlikely(rc))
+ return rc;
+
+@@ -2407,7 +2427,7 @@ int ena_com_get_hash_ctrl(struct ena_com
+ rc = ena_com_get_feature_ex(ena_dev, &get_resp,
+ ENA_ADMIN_RSS_HASH_INPUT,
+ rss->hash_ctrl_dma_addr,
+- sizeof(*rss->hash_ctrl));
++ sizeof(*rss->hash_ctrl), 0);
+ if (unlikely(rc))
+ return rc;
+
+@@ -2643,7 +2663,7 @@ int ena_com_indirect_table_get(struct en
+ rc = ena_com_get_feature_ex(ena_dev, &get_resp,
+ ENA_ADMIN_RSS_REDIRECTION_TABLE_CONFIG,
+ rss->rss_ind_tbl_dma_addr,
+- tbl_size);
++ tbl_size, 0);
+ if (unlikely(rc))
+ return rc;
+
+@@ -2857,7 +2877,7 @@ int ena_com_init_interrupt_moderation(st
+ int rc;
+
+ rc = ena_com_get_feature(ena_dev, &get_resp,
+- ENA_ADMIN_INTERRUPT_MODERATION);
++ ENA_ADMIN_INTERRUPT_MODERATION, 0);
+
+ if (rc) {
+ if (rc == -EOPNOTSUPP) {
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -101,6 +101,8 @@
+
+ #define ENA_HW_HINTS_NO_TIMEOUT 0xFFFF
+
++#define ENA_FEATURE_MAX_QUEUE_EXT_VER 1
++
+ enum ena_intr_moder_level {
+ ENA_INTR_MODER_LOWEST = 0,
+ ENA_INTR_MODER_LOW,
+@@ -389,6 +391,7 @@ struct ena_com_dev {
+
+ struct ena_com_dev_get_features_ctx {
+ struct ena_admin_queue_feature_desc max_queues;
++ struct ena_admin_queue_ext_feature_desc max_queue_ext;
+ struct ena_admin_device_attr_feature_desc dev_attr;
+ struct ena_admin_feature_aenq_desc aenq;
+ struct ena_admin_feature_offload_desc offload;
diff --git a/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch b/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
new file mode 100644
index 0000000000..f9e9adb630
--- /dev/null
+++ b/patches.drivers/net-ena-add-ethtool-function-for-changing-io-queue-s.patch
@@ -0,0 +1,103 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:09 +0300
+Subject: net: ena: add ethtool function for changing io queue sizes
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: eece4d2ab9d214e3b12f5ac1ed189a05793b28a5
+References: bsc#1138879
+
+Implement the set_ringparam() function of the ethtool interface
+to enable the changing of io queue sizes.
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 22 ++++++++++++++++++++++
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 14 ++++++++++++++
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 5 ++++-
+ 3 files changed, 40 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -493,6 +493,27 @@ static void ena_get_ringparam(struct net
+ ring->rx_pending = adapter->rx_ring[0].ring_size;
+ }
+
++static int ena_set_ringparam(struct net_device *netdev,
++ struct ethtool_ringparam *ring)
++{
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ u32 new_tx_size, new_rx_size;
++
++ new_tx_size = ring->tx_pending < ENA_MIN_RING_SIZE ?
++ ENA_MIN_RING_SIZE : ring->tx_pending;
++ new_tx_size = rounddown_pow_of_two(new_tx_size);
++
++ new_rx_size = ring->rx_pending < ENA_MIN_RING_SIZE ?
++ ENA_MIN_RING_SIZE : ring->rx_pending;
++ new_rx_size = rounddown_pow_of_two(new_rx_size);
++
++ if (new_tx_size == adapter->requested_tx_ring_size &&
++ new_rx_size == adapter->requested_rx_ring_size)
++ return 0;
++
++ return ena_update_queue_sizes(adapter, new_tx_size, new_rx_size);
++}
++
+ static u32 ena_flow_hash_to_flow_type(u16 hash_fields)
+ {
+ u32 data = 0;
+@@ -858,6 +879,7 @@ static const struct ethtool_ops ena_etht
+ .get_coalesce = ena_get_coalesce,
+ .set_coalesce = ena_set_coalesce,
+ .get_ringparam = ena_get_ringparam,
++ .set_ringparam = ena_set_ringparam,
+ .get_sset_count = ena_get_sset_count,
+ .get_strings = ena_get_strings,
+ .get_ethtool_stats = ena_get_ethtool_stats,
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2032,6 +2032,20 @@ static int ena_close(struct net_device *
+ return 0;
+ }
+
++int ena_update_queue_sizes(struct ena_adapter *adapter,
++ u32 new_tx_size,
++ u32 new_rx_size)
++{
++ bool dev_up;
++
++ dev_up = test_bit(ENA_FLAG_DEV_UP, &adapter->flags);
++ ena_close(adapter->netdev);
++ adapter->requested_tx_ring_size = new_tx_size;
++ adapter->requested_rx_ring_size = new_rx_size;
++ ena_init_io_rings(adapter);
++ return dev_up ? ena_up(adapter) : 0;
++}
++
+ static void ena_tx_csum(struct ena_com_tx_ctx *ena_tx_ctx, struct sk_buff *skb)
+ {
+ u32 mss = skb_shinfo(skb)->gso_size;
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -81,7 +81,6 @@
+ #define ENA_DEFAULT_RING_SIZE (1024)
+ #define ENA_MIN_RING_SIZE (256)
+
+-
+ #define ENA_TX_WAKEUP_THRESH (MAX_SKB_FRAGS + 2)
+ #define ENA_DEFAULT_RX_COPYBREAK (256 - NET_IP_ALIGN)
+
+@@ -389,6 +388,10 @@ void ena_dump_stats_to_dmesg(struct ena_
+
+ void ena_dump_stats_to_buf(struct ena_adapter *adapter, u8 *buf);
+
++int ena_update_queue_sizes(struct ena_adapter *adapter,
++ u32 new_tx_size,
++ u32 new_rx_size);
++
+ int ena_get_sset_count(struct net_device *netdev, int sset);
+
+ #endif /* !(ENA_H) */
diff --git a/patches.drivers/net-ena-add-good-checksum-counter.patch b/patches.drivers/net-ena-add-good-checksum-counter.patch
new file mode 100644
index 0000000000..8ab1df2053
--- /dev/null
+++ b/patches.drivers/net-ena-add-good-checksum-counter.patch
@@ -0,0 +1,69 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:28 +0300
+Subject: net: ena: add good checksum counter
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: d2eecc6ee8c92053797513e34931334dd0e85e18
+References: bsc#1138879
+
+Add a new statistics to ETHTOOL to specify if the device calculated
+and validated the Rx csum.
+
+Signed-off-by: Evgeny Shmeilin <evgeny@annapurnaLabs.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 3 ++-
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 3 +++
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 3 ++-
+ 3 files changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -88,13 +88,14 @@ static const struct ena_stats ena_stats_
+ static const struct ena_stats ena_stats_rx_strings[] = {
+ ENA_STAT_RX_ENTRY(cnt),
+ ENA_STAT_RX_ENTRY(bytes),
++ ENA_STAT_RX_ENTRY(rx_copybreak_pkt),
++ ENA_STAT_RX_ENTRY(csum_good),
+ ENA_STAT_RX_ENTRY(refil_partial),
+ ENA_STAT_RX_ENTRY(bad_csum),
+ ENA_STAT_RX_ENTRY(page_alloc_fail),
+ ENA_STAT_RX_ENTRY(skb_alloc_fail),
+ ENA_STAT_RX_ENTRY(dma_mapping_err),
+ ENA_STAT_RX_ENTRY(bad_desc_num),
+- ENA_STAT_RX_ENTRY(rx_copybreak_pkt),
+ ENA_STAT_RX_ENTRY(bad_req_id),
+ ENA_STAT_RX_ENTRY(empty_rx_ring),
+ ENA_STAT_RX_ENTRY(csum_unchecked),
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1002,6 +1002,9 @@ static inline void ena_rx_checksum(struc
+
+ if (likely(ena_rx_ctx->l4_csum_checked)) {
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
++ u64_stats_update_begin(&rx_ring->syncp);
++ rx_ring->rx_stats.csum_good++;
++ u64_stats_update_end(&rx_ring->syncp);
+ } else {
+ u64_stats_update_begin(&rx_ring->syncp);
+ rx_ring->rx_stats.csum_unchecked++;
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -208,13 +208,14 @@ struct ena_stats_tx {
+ struct ena_stats_rx {
+ u64 cnt;
+ u64 bytes;
++ u64 rx_copybreak_pkt;
++ u64 csum_good;
+ u64 refil_partial;
+ u64 bad_csum;
+ u64 page_alloc_fail;
+ u64 skb_alloc_fail;
+ u64 dma_mapping_err;
+ u64 bad_desc_num;
+- u64 rx_copybreak_pkt;
+ u64 bad_req_id;
+ u64 empty_rx_ring;
+ u64 csum_unchecked;
diff --git a/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch b/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch
new file mode 100644
index 0000000000..376b9a6dd5
--- /dev/null
+++ b/patches.drivers/net-ena-add-handling-of-llq-max-tx-burst-size.patch
@@ -0,0 +1,223 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:19 +0300
+Subject: net: ena: add handling of llq max tx burst size
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 05d62ca218f8425c70389d0416c15bd0d455b416
+References: bsc#1138879
+
+There is a maximum TX burst size that the ENA device can handle.
+It is exposed by the device to the driver and the driver
+needs to comply with it to avoid bugs.
+
+In this commit we:
+1. Add ena_com_is_doorbell_needed(), which calculates the number of
+ llq entries that will be used to hold a packet, and will return
+ true if they exceed the number of allowed entries in a burst.
+ If the function returns true, a doorbell needs to be invoked
+ to send this packet in the next burst.
+
+2. Follow the available entries in the current burst:
+ - Every doorbell a new burst begins
+ - With each write of an llq entry, the available entries in the
+ current burst are decreased by 1.
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_admin_defs.h | 5 ++
+ drivers/net/ethernet/amazon/ena/ena_com.c | 7 +++
+ drivers/net/ethernet/amazon/ena/ena_com.h | 2
+ drivers/net/ethernet/amazon/ena/ena_eth_com.c | 28 ++++--------
+ drivers/net/ethernet/amazon/ena/ena_eth_com.h | 53 +++++++++++++++++++++++
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 7 +++
+ 6 files changed, 85 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
++++ b/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
+@@ -524,6 +524,11 @@ struct ena_admin_feature_llq_desc {
+
+ /* the stride control the driver selected to use */
+ u16 descriptors_stride_ctrl_enabled;
++
++ /* Maximum size in bytes taken by llq entries in a single tx burst.
++ * Set to 0 when there is no such limit.
++ */
++ u32 max_tx_burst_size;
+ };
+
+ struct ena_admin_queue_feature_desc {
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -396,6 +396,10 @@ static int ena_com_init_io_sq(struct ena
+ 0x0, io_sq->llq_info.desc_list_entry_size);
+ io_sq->llq_buf_ctrl.descs_left_in_line =
+ io_sq->llq_info.descs_num_before_header;
++
++ if (io_sq->llq_info.max_entries_in_tx_burst > 0)
++ io_sq->entries_in_tx_burst_left =
++ io_sq->llq_info.max_entries_in_tx_burst;
+ }
+
+ io_sq->tail = 0;
+@@ -727,6 +731,9 @@ static int ena_com_config_llq_info(struc
+ supported_feat, llq_info->descs_num_before_header);
+ }
+
++ llq_info->max_entries_in_tx_burst =
++ (u16)(llq_features->max_tx_burst_size / llq_default_cfg->llq_ring_entry_size_value);
++
+ rc = ena_com_set_llq(ena_dev);
+ if (rc)
+ pr_err("Cannot set LLQ configuration: %d\n", rc);
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -159,6 +159,7 @@ struct ena_com_llq_info {
+ u16 desc_list_entry_size;
+ u16 descs_num_before_header;
+ u16 descs_per_entry;
++ u16 max_entries_in_tx_burst;
+ };
+
+ struct ena_com_io_cq {
+@@ -238,6 +239,7 @@ struct ena_com_io_sq {
+ u8 phase;
+ u8 desc_entry_size;
+ u8 dma_addr_bits;
++ u16 entries_in_tx_burst_left;
+ } ____cacheline_aligned;
+
+ struct ena_com_admin_cq {
+--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+@@ -82,6 +82,17 @@ static inline int ena_com_write_bounce_b
+ dst_tail_mask = io_sq->tail & (io_sq->q_depth - 1);
+ dst_offset = dst_tail_mask * llq_info->desc_list_entry_size;
+
++ if (is_llq_max_tx_burst_exists(io_sq)) {
++ if (unlikely(!io_sq->entries_in_tx_burst_left)) {
++ pr_err("Error: trying to send more packets than tx burst allows\n");
++ return -ENOSPC;
++ }
++
++ io_sq->entries_in_tx_burst_left--;
++ pr_debug("decreasing entries_in_tx_burst_left of queue %d to %d\n",
++ io_sq->qid, io_sq->entries_in_tx_burst_left);
++ }
++
+ /* Make sure everything was written into the bounce buffer before
+ * writing the bounce buffer to the device
+ */
+@@ -274,23 +285,6 @@ static inline u16 ena_com_cdesc_rx_pkt_g
+ return count;
+ }
+
+-static inline bool ena_com_meta_desc_changed(struct ena_com_io_sq *io_sq,
+- struct ena_com_tx_ctx *ena_tx_ctx)
+-{
+- int rc;
+-
+- if (ena_tx_ctx->meta_valid) {
+- rc = memcmp(&io_sq->cached_tx_meta,
+- &ena_tx_ctx->ena_meta,
+- sizeof(struct ena_com_tx_meta));
+-
+- if (unlikely(rc != 0))
+- return true;
+- }
+-
+- return false;
+-}
+-
+ static inline int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq,
+ struct ena_com_tx_ctx *ena_tx_ctx)
+ {
+--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.h
+@@ -125,8 +125,55 @@ static inline bool ena_com_sq_have_enoug
+ return ena_com_free_desc(io_sq) > temp;
+ }
+
++static inline bool ena_com_meta_desc_changed(struct ena_com_io_sq *io_sq,
++ struct ena_com_tx_ctx *ena_tx_ctx)
++{
++ if (!ena_tx_ctx->meta_valid)
++ return false;
++
++ return !!memcmp(&io_sq->cached_tx_meta,
++ &ena_tx_ctx->ena_meta,
++ sizeof(struct ena_com_tx_meta));
++}
++
++static inline bool is_llq_max_tx_burst_exists(struct ena_com_io_sq *io_sq)
++{
++ return (io_sq->mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) &&
++ io_sq->llq_info.max_entries_in_tx_burst > 0;
++}
++
++static inline bool ena_com_is_doorbell_needed(struct ena_com_io_sq *io_sq,
++ struct ena_com_tx_ctx *ena_tx_ctx)
++{
++ struct ena_com_llq_info *llq_info;
++ int descs_after_first_entry;
++ int num_entries_needed = 1;
++ u16 num_descs;
++
++ if (!is_llq_max_tx_burst_exists(io_sq))
++ return false;
++
++ llq_info = &io_sq->llq_info;
++ num_descs = ena_tx_ctx->num_bufs;
++
++ if (unlikely(ena_com_meta_desc_changed(io_sq, ena_tx_ctx)))
++ ++num_descs;
++
++ if (num_descs > llq_info->descs_num_before_header) {
++ descs_after_first_entry = num_descs - llq_info->descs_num_before_header;
++ num_entries_needed += DIV_ROUND_UP(descs_after_first_entry,
++ llq_info->descs_per_entry);
++ }
++
++ pr_debug("queue: %d num_descs: %d num_entries_needed: %d\n", io_sq->qid,
++ num_descs, num_entries_needed);
++
++ return num_entries_needed > io_sq->entries_in_tx_burst_left;
++}
++
+ static inline int ena_com_write_sq_doorbell(struct ena_com_io_sq *io_sq)
+ {
++ u16 max_entries_in_tx_burst = io_sq->llq_info.max_entries_in_tx_burst;
+ u16 tail = io_sq->tail;
+
+ pr_debug("write submission queue doorbell for queue: %d tail: %d\n",
+@@ -134,6 +181,12 @@ static inline int ena_com_write_sq_doorb
+
+ writel(tail, io_sq->db_addr);
+
++ if (is_llq_max_tx_burst_exists(io_sq)) {
++ pr_debug("reset available entries in tx burst for queue %d to %d\n",
++ io_sq->qid, max_entries_in_tx_burst);
++ io_sq->entries_in_tx_burst_left = max_entries_in_tx_burst;
++ }
++
+ return 0;
+ }
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2173,6 +2173,13 @@ static netdev_tx_t ena_start_xmit(struct
+ /* set flags and meta data */
+ ena_tx_csum(&ena_tx_ctx, skb);
+
++ if (unlikely(ena_com_is_doorbell_needed(tx_ring->ena_com_io_sq, &ena_tx_ctx))) {
++ netif_dbg(adapter, tx_queued, dev,
++ "llq tx max burst size of queue %d achieved, writing doorbell to send burst\n",
++ qid);
++ ena_com_write_sq_doorbell(tx_ring->ena_com_io_sq);
++ }
++
+ /* prepare the packet's descriptors to dma engine */
+ rc = ena_com_prepare_tx(tx_ring->ena_com_io_sq, &ena_tx_ctx,
+ &nb_hw_desc);
diff --git a/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch b/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch
new file mode 100644
index 0000000000..685be1c868
--- /dev/null
+++ b/patches.drivers/net-ena-add-newline-at-the-end-of-pr_err-prints.patch
@@ -0,0 +1,92 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:23 +0300
+Subject: net: ena: add newline at the end of pr_err prints
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 9cb9c0de266f1ea52f01589f2f4019f163c01cd1
+References: bsc#1138879
+
+Some pr_err prints lacked '\n' in the end. Added where missing.
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -115,7 +115,7 @@ static int ena_com_admin_init_sq(struct
+ GFP_KERNEL);
+
+ if (!sq->entries) {
+- pr_err("memory allocation failed");
++ pr_err("memory allocation failed\n");
+ return -ENOMEM;
+ }
+
+@@ -137,7 +137,7 @@ static int ena_com_admin_init_cq(struct
+ GFP_KERNEL);
+
+ if (!cq->entries) {
+- pr_err("memory allocation failed");
++ pr_err("memory allocation failed\n");
+ return -ENOMEM;
+ }
+
+@@ -160,7 +160,7 @@ static int ena_com_admin_init_aenq(struc
+ GFP_KERNEL);
+
+ if (!aenq->entries) {
+- pr_err("memory allocation failed");
++ pr_err("memory allocation failed\n");
+ return -ENOMEM;
+ }
+
+@@ -285,7 +285,7 @@ static inline int ena_com_init_comp_ctxt
+
+ queue->comp_ctx = devm_kzalloc(queue->q_dmadev, size, GFP_KERNEL);
+ if (unlikely(!queue->comp_ctx)) {
+- pr_err("memory allocation failed");
++ pr_err("memory allocation failed\n");
+ return -ENOMEM;
+ }
+
+@@ -356,7 +356,7 @@ static int ena_com_init_io_sq(struct ena
+ }
+
+ if (!io_sq->desc_addr.virt_addr) {
+- pr_err("memory allocation failed");
++ pr_err("memory allocation failed\n");
+ return -ENOMEM;
+ }
+ }
+@@ -382,7 +382,7 @@ static int ena_com_init_io_sq(struct ena
+ devm_kzalloc(ena_dev->dmadev, size, GFP_KERNEL);
+
+ if (!io_sq->bounce_buf_ctrl.base_buffer) {
+- pr_err("bounce buffer memory allocation failed");
++ pr_err("bounce buffer memory allocation failed\n");
+ return -ENOMEM;
+ }
+
+@@ -440,7 +440,7 @@ static int ena_com_init_io_cq(struct ena
+ }
+
+ if (!io_cq->cdesc_addr.virt_addr) {
+- pr_err("memory allocation failed");
++ pr_err("memory allocation failed\n");
+ return -ENOMEM;
+ }
+
+@@ -829,7 +829,7 @@ static u32 ena_com_reg_bar_read32(struct
+ }
+
+ if (read_resp->reg_off != offset) {
+- pr_err("Read failure: wrong offset provided");
++ pr_err("Read failure: wrong offset provided\n");
+ ret = ENA_MMIO_READ_TIMEOUT;
+ } else {
+ ret = read_resp->reg_val;
diff --git a/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch b/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch
new file mode 100644
index 0000000000..89b0529ff2
--- /dev/null
+++ b/patches.drivers/net-ena-add-support-for-changing-max_header_size-in-.patch
@@ -0,0 +1,54 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:26 +0300
+Subject: net: ena: add support for changing max_header_size in LLQ mode
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: cdf449eccc5946d5dd4145b38347874a7423c50d
+References: bsc#1138879
+
+Up until now the driver always used a single setting for the sizes
+of the different parts of the llq entry - 128 for entry size, 2 for
+descriptors before header and 96 for maximum header size.
+
+The current code makes sure that the parts of the llq entry are
+compatible with each other and with the initial llq entry size given
+by the device.
+
+This commit changes this code to support any llq entry size
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2992,8 +2992,8 @@ int ena_com_config_dev_mode(struct ena_c
+ struct ena_admin_feature_llq_desc *llq_features,
+ struct ena_llq_configurations *llq_default_cfg)
+ {
++ struct ena_com_llq_info *llq_info = &ena_dev->llq_info;
+ int rc;
+- int size;
+
+ if (!llq_features->max_llq_num) {
+ ena_dev->tx_mem_queue_type = ENA_ADMIN_PLACEMENT_POLICY_HOST;
+@@ -3004,12 +3004,10 @@ int ena_com_config_dev_mode(struct ena_c
+ if (rc)
+ return rc;
+
+- /* Validate the descriptor is not too big */
+- size = ena_dev->tx_max_header_size;
+- size += ena_dev->llq_info.descs_num_before_header *
+- sizeof(struct ena_eth_io_tx_desc);
++ ena_dev->tx_max_header_size = llq_info->desc_list_entry_size -
++ (llq_info->descs_num_before_header * sizeof(struct ena_eth_io_tx_desc));
+
+- if (unlikely(ena_dev->llq_info.desc_list_entry_size < size)) {
++ if (unlikely(ena_dev->tx_max_header_size == 0)) {
+ pr_err("the size of the LLQ entry is smaller than needed\n");
+ return -EINVAL;
+ }
diff --git a/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch b/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch
new file mode 100644
index 0000000000..d1e971a69c
--- /dev/null
+++ b/patches.drivers/net-ena-allow-automatic-fallback-to-polling-mode.patch
@@ -0,0 +1,102 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:25 +0300
+Subject: net: ena: allow automatic fallback to polling mode
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: a4e262cde3cda4491ce666e7c5270954c4d926b9
+References: bsc#1138879
+
+Enable fallback to polling mode for Admin queue
+when identified a command response arrival
+without an accompanying MSI-X interrupt
+
+Signed-off-by: Igor Chauskin <igorch@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 34 ++++++++++++++++++++++--------
+ drivers/net/ethernet/amazon/ena/ena_com.h | 14 ++++++++++++
+ 2 files changed, 39 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -762,16 +762,26 @@ static int ena_com_wait_and_process_admi
+ admin_queue->stats.no_completion++;
+ spin_unlock_irqrestore(&admin_queue->q_lock, flags);
+
+- if (comp_ctx->status == ENA_CMD_COMPLETED)
+- pr_err("The ena device have completion but the driver didn't receive any MSI-X interrupt (cmd %d)\n",
+- comp_ctx->cmd_opcode);
+- else
+- pr_err("The ena device doesn't send any completion for the admin cmd %d status %d\n",
++ if (comp_ctx->status == ENA_CMD_COMPLETED) {
++ pr_err("The ena device sent a completion but the driver didn't receive a MSI-X interrupt (cmd %d), autopolling mode is %s\n",
++ comp_ctx->cmd_opcode,
++ admin_queue->auto_polling ? "ON" : "OFF");
++ /* Check if fallback to polling is enabled */
++ if (admin_queue->auto_polling)
++ admin_queue->polling = true;
++ } else {
++ pr_err("The ena device doesn't send a completion for the admin cmd %d status %d\n",
+ comp_ctx->cmd_opcode, comp_ctx->status);
+-
+- admin_queue->running_state = false;
+- ret = -ETIME;
+- goto err;
++ }
++ /* Check if shifted to polling mode.
++ * This will happen if there is a completion without an interrupt
++ * and autopolling mode is enabled. Continuing normal execution in such case
++ */
++ if (!admin_queue->polling) {
++ admin_queue->running_state = false;
++ ret = -ETIME;
++ goto err;
++ }
+ }
+
+ ret = ena_com_comp_status_to_errno(comp_ctx->comp_status);
+@@ -1650,6 +1660,12 @@ void ena_com_set_admin_polling_mode(stru
+ ena_dev->admin_queue.polling = polling;
+ }
+
++void ena_com_set_admin_auto_polling_mode(struct ena_com_dev *ena_dev,
++ bool polling)
++{
++ ena_dev->admin_queue.auto_polling = polling;
++}
++
+ int ena_com_mmio_reg_read_request_init(struct ena_com_dev *ena_dev)
+ {
+ struct ena_com_mmio_read *mmio_read = &ena_dev->mmio_read;
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -283,6 +283,9 @@ struct ena_com_admin_queue {
+ /* Indicate if the admin queue should poll for completion */
+ bool polling;
+
++ /* Define if fallback to polling mode should occur */
++ bool auto_polling;
++
+ u16 curr_cmd_id;
+
+ /* Indicate that the ena was initialized and can
+@@ -545,6 +548,17 @@ void ena_com_set_admin_polling_mode(stru
+ */
+ bool ena_com_get_ena_admin_polling_mode(struct ena_com_dev *ena_dev);
+
++/* ena_com_set_admin_auto_polling_mode - Enable autoswitch to polling mode
++ * @ena_dev: ENA communication layer struct
++ * @polling: Enable/Disable polling mode
++ *
++ * Set the autopolling mode.
++ * If autopolling is on:
++ * In case of missing interrupt when data is available switch to polling.
++ */
++void ena_com_set_admin_auto_polling_mode(struct ena_com_dev *ena_dev,
++ bool polling);
++
+ /* ena_com_admin_q_comp_intr_handler - admin queue interrupt handler
+ * @ena_dev: ENA communication layer struct
+ *
diff --git a/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch b/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch
new file mode 100644
index 0000000000..95f8a59a76
--- /dev/null
+++ b/patches.drivers/net-ena-allow-queue-allocation-backoff-when-low-on-m.patch
@@ -0,0 +1,320 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:08 +0300
+Subject: net: ena: allow queue allocation backoff when low on memory
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 13ca32a69e29f3a0fe72094dd930f312b3f3ee44
+References: bsc#1138879
+
+If there is not enough memory to allocate io queues the driver will
+try to allocate smaller queues.
+
+The backoff algorithm is as follows:
+
+1. Try to allocate TX and RX and if successful.
+1.1. return success
+
+2. Divide by 2 the size of the larger of RX and TX queues (or both if their size is the same).
+
+3. If TX or RX is smaller than 256
+3.1. return failure.
+4. else
+4.1. go back to 1.
+
+Also change the tx_queue_size, rx_queue_size field names in struct
+adapter to requested_tx_queue_size and requested_rx_queue_size, and
+use RX and TX queue 0 for actual queue sizes.
+Explanation:
+The original fields were useless as they were simply used to assign
+values once from them to each of the queues in the adapter in ena_probe().
+They could simply be deleted. However now that we have a backoff
+feature, we have use for them. In case of backoff there is a difference
+between the requested queue sizes and the actual sizes. Therefore there
+is a need to save the requested queue size for future retries of queue
+allocation (for example if allocation failed and then ifdown + ifup was
+called we want to start the allocation from the original requested size of
+the queues).
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 159 +++++++++++++++++++-------
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 6
+ 3 files changed, 127 insertions(+), 42 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -489,8 +489,8 @@ static void ena_get_ringparam(struct net
+
+ ring->tx_max_pending = adapter->max_tx_ring_size;
+ ring->rx_max_pending = adapter->max_rx_ring_size;
+- ring->tx_pending = adapter->tx_ring_size;
+- ring->rx_pending = adapter->rx_ring_size;
++ ring->tx_pending = adapter->tx_ring[0].ring_size;
++ ring->rx_pending = adapter->rx_ring[0].ring_size;
+ }
+
+ static u32 ena_flow_hash_to_flow_type(u16 hash_fields)
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -183,7 +183,7 @@ static void ena_init_io_rings(struct ena
+ ena_init_io_rings_common(adapter, rxr, i);
+
+ /* TX specific ring state */
+- txr->ring_size = adapter->tx_ring_size;
++ txr->ring_size = adapter->requested_tx_ring_size;
+ txr->tx_max_header_size = ena_dev->tx_max_header_size;
+ txr->tx_mem_queue_type = ena_dev->tx_mem_queue_type;
+ txr->sgl_size = adapter->max_tx_sgl_size;
+@@ -191,7 +191,7 @@ static void ena_init_io_rings(struct ena
+ ena_com_get_nonadaptive_moderation_interval_tx(ena_dev);
+
+ /* RX specific ring state */
+- rxr->ring_size = adapter->rx_ring_size;
++ rxr->ring_size = adapter->requested_rx_ring_size;
+ rxr->rx_copybreak = adapter->rx_copybreak;
+ rxr->sgl_size = adapter->max_rx_sgl_size;
+ rxr->smoothed_interval =
+@@ -595,7 +595,6 @@ static void ena_free_rx_bufs(struct ena_
+
+ /* ena_refill_all_rx_bufs - allocate all queues Rx buffers
+ * @adapter: board private structure
+- *
+ */
+ static void ena_refill_all_rx_bufs(struct ena_adapter *adapter)
+ {
+@@ -1639,7 +1638,7 @@ static int ena_create_io_tx_queue(struct
+ ctx.qid = ena_qid;
+ ctx.mem_queue_type = ena_dev->tx_mem_queue_type;
+ ctx.msix_vector = msix_vector;
+- ctx.queue_size = adapter->tx_ring_size;
++ ctx.queue_size = tx_ring->ring_size;
+ ctx.numa_node = cpu_to_node(tx_ring->cpu);
+
+ rc = ena_com_create_io_queue(ena_dev, &ctx);
+@@ -1706,7 +1705,7 @@ static int ena_create_io_rx_queue(struct
+ ctx.direction = ENA_COM_IO_QUEUE_DIRECTION_RX;
+ ctx.mem_queue_type = ENA_ADMIN_PLACEMENT_POLICY_HOST;
+ ctx.msix_vector = msix_vector;
+- ctx.queue_size = adapter->rx_ring_size;
++ ctx.queue_size = rx_ring->ring_size;
+ ctx.numa_node = cpu_to_node(rx_ring->cpu);
+
+ rc = ena_com_create_io_queue(ena_dev, &ctx);
+@@ -1753,6 +1752,112 @@ create_err:
+ return rc;
+ }
+
++static void set_io_rings_size(struct ena_adapter *adapter,
++ int new_tx_size, int new_rx_size)
++{
++ int i;
++
++ for (i = 0; i < adapter->num_queues; i++) {
++ adapter->tx_ring[i].ring_size = new_tx_size;
++ adapter->rx_ring[i].ring_size = new_rx_size;
++ }
++}
++
++/* This function allows queue allocation to backoff when the system is
++ * low on memory. If there is not enough memory to allocate io queues
++ * the driver will try to allocate smaller queues.
++ *
++ * The backoff algorithm is as follows:
++ * 1. Try to allocate TX and RX and if successful.
++ * 1.1. return success
++ *
++ * 2. Divide by 2 the size of the larger of RX and TX queues (or both if their size is the same).
++ *
++ * 3. If TX or RX is smaller than 256
++ * 3.1. return failure.
++ * 4. else
++ * 4.1. go back to 1.
++ */
++static int create_queues_with_size_backoff(struct ena_adapter *adapter)
++{
++ int rc, cur_rx_ring_size, cur_tx_ring_size;
++ int new_rx_ring_size, new_tx_ring_size;
++
++ /* current queue sizes might be set to smaller than the requested
++ * ones due to past queue allocation failures.
++ */
++ set_io_rings_size(adapter, adapter->requested_tx_ring_size,
++ adapter->requested_rx_ring_size);
++
++ while (1) {
++ rc = ena_setup_all_tx_resources(adapter);
++ if (rc)
++ goto err_setup_tx;
++
++ rc = ena_create_all_io_tx_queues(adapter);
++ if (rc)
++ goto err_create_tx_queues;
++
++ rc = ena_setup_all_rx_resources(adapter);
++ if (rc)
++ goto err_setup_rx;
++
++ rc = ena_create_all_io_rx_queues(adapter);
++ if (rc)
++ goto err_create_rx_queues;
++
++ return 0;
++
++err_create_rx_queues:
++ ena_free_all_io_rx_resources(adapter);
++err_setup_rx:
++ ena_destroy_all_tx_queues(adapter);
++err_create_tx_queues:
++ ena_free_all_io_tx_resources(adapter);
++err_setup_tx:
++ if (rc != -ENOMEM) {
++ netif_err(adapter, ifup, adapter->netdev,
++ "Queue creation failed with error code %d\n",
++ rc);
++ return rc;
++ }
++
++ cur_tx_ring_size = adapter->tx_ring[0].ring_size;
++ cur_rx_ring_size = adapter->rx_ring[0].ring_size;
++
++ netif_err(adapter, ifup, adapter->netdev,
++ "Not enough memory to create queues with sizes TX=%d, RX=%d\n",
++ cur_tx_ring_size, cur_rx_ring_size);
++
++ new_tx_ring_size = cur_tx_ring_size;
++ new_rx_ring_size = cur_rx_ring_size;
++
++ /* Decrease the size of the larger queue, or
++ * decrease both if they are the same size.
++ */
++ if (cur_rx_ring_size <= cur_tx_ring_size)
++ new_tx_ring_size = cur_tx_ring_size / 2;
++ if (cur_rx_ring_size >= cur_tx_ring_size)
++ new_rx_ring_size = cur_rx_ring_size / 2;
++
++ if (cur_tx_ring_size < ENA_MIN_RING_SIZE ||
++ cur_rx_ring_size < ENA_MIN_RING_SIZE) {
++ netif_err(adapter, ifup, adapter->netdev,
++ "Queue creation failed with the smallest possible queue size of %d for both queues. Not retrying with smaller queues\n",
++ ENA_MIN_RING_SIZE);
++ return rc;
++ }
++
++ netif_err(adapter, ifup, adapter->netdev,
++ "Retrying queue creation with sizes TX=%d, RX=%d\n",
++ new_tx_ring_size,
++ new_rx_ring_size);
++
++ set_io_rings_size(adapter, new_tx_ring_size,
++ new_rx_ring_size);
++ }
++}
++
+ static int ena_up(struct ena_adapter *adapter)
+ {
+ int rc, i;
+@@ -1772,25 +1877,9 @@ static int ena_up(struct ena_adapter *ad
+ if (rc)
+ goto err_req_irq;
+
+- /* allocate transmit descriptors */
+- rc = ena_setup_all_tx_resources(adapter);
++ rc = create_queues_with_size_backoff(adapter);
+ if (rc)
+- goto err_setup_tx;
+-
+- /* allocate receive descriptors */
+- rc = ena_setup_all_rx_resources(adapter);
+- if (rc)
+- goto err_setup_rx;
+-
+- /* Create TX queues */
+- rc = ena_create_all_io_tx_queues(adapter);
+- if (rc)
+- goto err_create_tx_queues;
+-
+- /* Create RX queues */
+- rc = ena_create_all_io_rx_queues(adapter);
+- if (rc)
+- goto err_create_rx_queues;
++ goto err_create_queues_with_backoff;
+
+ rc = ena_up_complete(adapter);
+ if (rc)
+@@ -1819,14 +1908,11 @@ static int ena_up(struct ena_adapter *ad
+ return rc;
+
+ err_up:
+- ena_destroy_all_rx_queues(adapter);
+-err_create_rx_queues:
+ ena_destroy_all_tx_queues(adapter);
+-err_create_tx_queues:
+- ena_free_all_io_rx_resources(adapter);
+-err_setup_rx:
+ ena_free_all_io_tx_resources(adapter);
+-err_setup_tx:
++ ena_destroy_all_rx_queues(adapter);
++ ena_free_all_io_rx_resources(adapter);
++err_create_queues_with_backoff:
+ ena_free_io_irq(adapter);
+ err_req_irq:
+ ena_del_napi(adapter);
+@@ -3298,17 +3384,14 @@ static int ena_calc_queue_size(struct en
+ max_tx_queue_size = rounddown_pow_of_two(max_tx_queue_size);
+ max_rx_queue_size = rounddown_pow_of_two(max_rx_queue_size);
+
+- tx_queue_size = min_t(u32, tx_queue_size, max_tx_queue_size);
+- rx_queue_size = min_t(u32, rx_queue_size, max_rx_queue_size);
++ tx_queue_size = clamp_val(tx_queue_size, ENA_MIN_RING_SIZE,
++ max_tx_queue_size);
++ rx_queue_size = clamp_val(rx_queue_size, ENA_MIN_RING_SIZE,
++ max_rx_queue_size);
+
+ tx_queue_size = rounddown_pow_of_two(tx_queue_size);
+ rx_queue_size = rounddown_pow_of_two(rx_queue_size);
+
+- if (unlikely(!rx_queue_size || !tx_queue_size)) {
+- dev_err(&ctx->pdev->dev, "Invalid queue size\n");
+- return -EFAULT;
+- }
+-
+ ctx->max_tx_queue_size = max_tx_queue_size;
+ ctx->max_rx_queue_size = max_rx_queue_size;
+ ctx->tx_queue_size = tx_queue_size;
+@@ -3438,8 +3521,8 @@ static int ena_probe(struct pci_dev *pde
+ adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE);
+ adapter->reset_reason = ENA_REGS_RESET_NORMAL;
+
+- adapter->tx_ring_size = calc_queue_ctx.tx_queue_size;
+- adapter->rx_ring_size = calc_queue_ctx.rx_queue_size;
++ adapter->requested_tx_ring_size = calc_queue_ctx.tx_queue_size;
++ adapter->requested_rx_ring_size = calc_queue_ctx.rx_queue_size;
+ adapter->max_tx_ring_size = calc_queue_ctx.max_tx_queue_size;
+ adapter->max_rx_ring_size = calc_queue_ctx.max_rx_queue_size;
+ adapter->max_tx_sgl_size = calc_queue_ctx.max_tx_sgl_size;
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -79,6 +79,8 @@
+ #define ENA_BAR_MASK (BIT(ENA_REG_BAR) | BIT(ENA_MEM_BAR))
+
+ #define ENA_DEFAULT_RING_SIZE (1024)
++#define ENA_MIN_RING_SIZE (256)
++
+
+ #define ENA_TX_WAKEUP_THRESH (MAX_SKB_FRAGS + 2)
+ #define ENA_DEFAULT_RX_COPYBREAK (256 - NET_IP_ALIGN)
+@@ -331,8 +333,8 @@ struct ena_adapter {
+ u32 tx_usecs, rx_usecs; /* interrupt moderation */
+ u32 tx_frames, rx_frames; /* interrupt moderation */
+
+- u32 tx_ring_size;
+- u32 rx_ring_size;
++ u32 requested_tx_ring_size;
++ u32 requested_rx_ring_size;
+
+ u32 max_tx_ring_size;
+ u32 max_rx_ring_size;
diff --git a/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch b/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch
new file mode 100644
index 0000000000..1e2123c377
--- /dev/null
+++ b/patches.drivers/net-ena-arrange-ena_probe-function-variables-in-reve.patch
@@ -0,0 +1,50 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:22 +0300
+Subject: net: ena: arrange ena_probe() function variables in reverse christmas
+ tree
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 83b9240428a66da3c8e24e719b985d533cf58067
+References: bsc#1138879
+
+Reverse christmas tree arrangement is when strings are written from longer
+to shorter with each line. Most of our functions are abiding this
+arrangement but this function does not.
+
+In this commit we arrange the variables of ena_probe() in reverse christmas
+tree.
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -3283,17 +3283,17 @@ static int ena_calc_queue_size(struct pc
+ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct ena_com_dev_get_features_ctx get_feat_ctx;
+- static int version_printed;
+- struct net_device *netdev;
+- struct ena_adapter *adapter;
+ struct ena_llq_configurations llq_config;
+ struct ena_com_dev *ena_dev = NULL;
+- char *queue_type_str;
+- static int adapters_found;
++ struct ena_adapter *adapter;
++ static int version_printed;
+ int io_queue_num, bars, rc;
+- int queue_size;
++ struct net_device *netdev;
++ static int adapters_found;
++ char *queue_type_str;
+ u16 tx_sgl_size = 0;
+ u16 rx_sgl_size = 0;
++ int queue_size;
+ bool wd_state;
+
+ dev_dbg(&pdev->dev, "%s\n", __func__);
diff --git a/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch b/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch
new file mode 100644
index 0000000000..fa63971611
--- /dev/null
+++ b/patches.drivers/net-ena-enable-negotiating-larger-Rx-ring-size.patch
@@ -0,0 +1,269 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:06 +0300
+Subject: net: ena: enable negotiating larger Rx ring size
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 31aa9857f1733403f2eb12d51c1cec20a22483d9
+References: bsc#1138879
+
+Use MAX_QUEUES_EXT get feature capability to query the device.
+
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 148 +++++++++++++++++----------
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 15 ++
+ 2 files changed, 112 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2467,13 +2467,6 @@ static int ena_device_validate_params(st
+ return -EINVAL;
+ }
+
+- if ((get_feat_ctx->max_queues.max_cq_num < adapter->num_queues) ||
+- (get_feat_ctx->max_queues.max_sq_num < adapter->num_queues)) {
+- netif_err(adapter, drv, netdev,
+- "Error, device doesn't support enough queues\n");
+- return -EINVAL;
+- }
+-
+ if (get_feat_ctx->dev_attr.max_mtu < netdev->mtu) {
+ netif_err(adapter, drv, netdev,
+ "Error, device max mtu is smaller than netdev MTU\n");
+@@ -3047,18 +3040,32 @@ static int ena_calc_io_queue_num(struct
+ struct ena_com_dev *ena_dev,
+ struct ena_com_dev_get_features_ctx *get_feat_ctx)
+ {
+- int io_sq_num, io_queue_num;
++ int io_tx_sq_num, io_tx_cq_num, io_rx_num, io_queue_num;
++
++ if (ena_dev->supported_features & BIT(ENA_ADMIN_MAX_QUEUES_EXT)) {
++ struct ena_admin_queue_ext_feature_fields *max_queue_ext =
++ &get_feat_ctx->max_queue_ext.max_queue_ext;
++ io_rx_num = min_t(int, max_queue_ext->max_rx_sq_num,
++ max_queue_ext->max_rx_cq_num);
+
+- /* In case of LLQ use the llq number in the get feature cmd */
++ io_tx_sq_num = max_queue_ext->max_tx_sq_num;
++ io_tx_cq_num = max_queue_ext->max_tx_cq_num;
++ } else {
++ struct ena_admin_queue_feature_desc *max_queues =
++ &get_feat_ctx->max_queues;
++ io_tx_sq_num = max_queues->max_sq_num;
++ io_tx_cq_num = max_queues->max_cq_num;
++ io_rx_num = min_t(int, io_tx_sq_num, io_tx_cq_num);
++ }
++
++ /* In case of LLQ use the llq fields for the tx SQ/CQ */
+ if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV)
+- io_sq_num = get_feat_ctx->llq.max_llq_num;
+- else
+- io_sq_num = get_feat_ctx->max_queues.max_sq_num;
++ io_tx_sq_num = get_feat_ctx->llq.max_llq_num;
+
+ io_queue_num = min_t(int, num_online_cpus(), ENA_MAX_NUM_IO_QUEUES);
+- io_queue_num = min_t(int, io_queue_num, io_sq_num);
+- io_queue_num = min_t(int, io_queue_num,
+- get_feat_ctx->max_queues.max_cq_num);
++ io_queue_num = min_t(int, io_queue_num, io_rx_num);
++ io_queue_num = min_t(int, io_queue_num, io_tx_sq_num);
++ io_queue_num = min_t(int, io_queue_num, io_tx_cq_num);
+ /* 1 IRQ for for mgmnt and 1 IRQs for each IO direction */
+ io_queue_num = min_t(int, io_queue_num, pci_msix_vec_count(pdev) - 1);
+ if (unlikely(!io_queue_num)) {
+@@ -3241,36 +3248,73 @@ static inline void set_default_llq_confi
+ llq_config->llq_ring_entry_size_value = 128;
+ }
+
+-static int ena_calc_queue_size(struct pci_dev *pdev,
+- struct ena_com_dev *ena_dev,
+- u16 *max_tx_sgl_size,
+- u16 *max_rx_sgl_size,
+- struct ena_com_dev_get_features_ctx *get_feat_ctx)
+-{
+- u32 queue_size = ENA_DEFAULT_RING_SIZE;
+-
+- queue_size = min_t(u32, queue_size,
+- get_feat_ctx->max_queues.max_cq_depth);
+- queue_size = min_t(u32, queue_size,
+- get_feat_ctx->max_queues.max_sq_depth);
++static int ena_calc_queue_size(struct ena_calc_queue_size_ctx *ctx)
++{
++ struct ena_admin_feature_llq_desc *llq = &ctx->get_feat_ctx->llq;
++ struct ena_com_dev *ena_dev = ctx->ena_dev;
++ u32 tx_queue_size = ENA_DEFAULT_RING_SIZE;
++ u32 rx_queue_size = ENA_DEFAULT_RING_SIZE;
++ u32 max_tx_queue_size;
++ u32 max_rx_queue_size;
++
++ if (ctx->ena_dev->supported_features & BIT(ENA_ADMIN_MAX_QUEUES_EXT)) {
++ struct ena_admin_queue_ext_feature_fields *max_queue_ext =
++ &ctx->get_feat_ctx->max_queue_ext.max_queue_ext;
++ max_rx_queue_size = min_t(u32, max_queue_ext->max_rx_cq_depth,
++ max_queue_ext->max_rx_sq_depth);
++ max_tx_queue_size = max_queue_ext->max_tx_cq_depth;
++
++ if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV)
++ max_tx_queue_size = min_t(u32, max_tx_queue_size,
++ llq->max_llq_depth);
++ else
++ max_tx_queue_size = min_t(u32, max_tx_queue_size,
++ max_queue_ext->max_tx_sq_depth);
++
++ ctx->max_tx_sgl_size = min_t(u16, ENA_PKT_MAX_BUFS,
++ max_queue_ext->max_per_packet_tx_descs);
++ ctx->max_rx_sgl_size = min_t(u16, ENA_PKT_MAX_BUFS,
++ max_queue_ext->max_per_packet_rx_descs);
++ } else {
++ struct ena_admin_queue_feature_desc *max_queues =
++ &ctx->get_feat_ctx->max_queues;
++ max_rx_queue_size = min_t(u32, max_queues->max_cq_depth,
++ max_queues->max_sq_depth);
++ max_tx_queue_size = max_queues->max_cq_depth;
++
++ if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV)
++ max_tx_queue_size = min_t(u32, max_tx_queue_size,
++ llq->max_llq_depth);
++ else
++ max_tx_queue_size = min_t(u32, max_tx_queue_size,
++ max_queues->max_sq_depth);
+
+- if (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV)
+- queue_size = min_t(u32, queue_size,
+- get_feat_ctx->llq.max_llq_depth);
++ ctx->max_tx_sgl_size = min_t(u16, ENA_PKT_MAX_BUFS,
++ max_queues->max_packet_tx_descs);
++ ctx->max_rx_sgl_size = min_t(u16, ENA_PKT_MAX_BUFS,
++ max_queues->max_packet_rx_descs);
++ }
+
+- queue_size = rounddown_pow_of_two(queue_size);
++ max_tx_queue_size = rounddown_pow_of_two(max_tx_queue_size);
++ max_rx_queue_size = rounddown_pow_of_two(max_rx_queue_size);
+
+- if (unlikely(!queue_size)) {
+- dev_err(&pdev->dev, "Invalid queue size\n");
++ tx_queue_size = min_t(u32, tx_queue_size, max_tx_queue_size);
++ rx_queue_size = min_t(u32, rx_queue_size, max_rx_queue_size);
++
++ tx_queue_size = rounddown_pow_of_two(tx_queue_size);
++ rx_queue_size = rounddown_pow_of_two(rx_queue_size);
++
++ if (unlikely(!rx_queue_size || !tx_queue_size)) {
++ dev_err(&ctx->pdev->dev, "Invalid queue size\n");
+ return -EFAULT;
+ }
+
+- *max_tx_sgl_size = min_t(u16, ENA_PKT_MAX_BUFS,
+- get_feat_ctx->max_queues.max_packet_tx_descs);
+- *max_rx_sgl_size = min_t(u16, ENA_PKT_MAX_BUFS,
+- get_feat_ctx->max_queues.max_packet_rx_descs);
++ ctx->max_tx_queue_size = max_tx_queue_size;
++ ctx->max_rx_queue_size = max_rx_queue_size;
++ ctx->tx_queue_size = tx_queue_size;
++ ctx->rx_queue_size = rx_queue_size;
+
+- return queue_size;
++ return 0;
+ }
+
+ /* ena_probe - Device Initialization Routine
+@@ -3286,6 +3330,7 @@ static int ena_calc_queue_size(struct pc
+ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
+ struct ena_com_dev_get_features_ctx get_feat_ctx;
++ struct ena_calc_queue_size_ctx calc_queue_ctx = { 0 };
+ struct ena_llq_configurations llq_config;
+ struct ena_com_dev *ena_dev = NULL;
+ struct ena_adapter *adapter;
+@@ -3293,9 +3338,6 @@ static int ena_probe(struct pci_dev *pde
+ struct net_device *netdev;
+ static int adapters_found;
+ char *queue_type_str;
+- u16 tx_sgl_size = 0;
+- u16 rx_sgl_size = 0;
+- int queue_size;
+ bool wd_state;
+
+ dev_dbg(&pdev->dev, "%s\n", __func__);
+@@ -3352,20 +3394,25 @@ static int ena_probe(struct pci_dev *pde
+ goto err_device_destroy;
+ }
+
++ calc_queue_ctx.ena_dev = ena_dev;
++ calc_queue_ctx.get_feat_ctx = &get_feat_ctx;
++ calc_queue_ctx.pdev = pdev;
++
+ /* initial Tx interrupt delay, Assumes 1 usec granularity.
+ * Updated during device initialization with the real granularity
+ */
+ ena_dev->intr_moder_tx_interval = ENA_INTR_INITIAL_TX_INTERVAL_USECS;
+ io_queue_num = ena_calc_io_queue_num(pdev, ena_dev, &get_feat_ctx);
+- queue_size = ena_calc_queue_size(pdev, ena_dev, &tx_sgl_size,
+- &rx_sgl_size, &get_feat_ctx);
+- if ((queue_size <= 0) || (io_queue_num <= 0)) {
++ rc = ena_calc_queue_size(&calc_queue_ctx);
++ if (rc || io_queue_num <= 0) {
+ rc = -EFAULT;
+ goto err_device_destroy;
+ }
+
+- dev_info(&pdev->dev, "creating %d io queues. queue size: %d. LLQ is %s\n",
+- io_queue_num, queue_size,
++ dev_info(&pdev->dev, "creating %d io queues. rx queue size: %d tx queue size. %d LLQ is %s\n",
++ io_queue_num,
++ calc_queue_ctx.rx_queue_size,
++ calc_queue_ctx.tx_queue_size,
+ (ena_dev->tx_mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV) ?
+ "ENABLED" : "DISABLED");
+
+@@ -3391,11 +3438,10 @@ static int ena_probe(struct pci_dev *pde
+ adapter->msg_enable = netif_msg_init(debug, DEFAULT_MSG_ENABLE);
+ adapter->reset_reason = ENA_REGS_RESET_NORMAL;
+
+- adapter->tx_ring_size = queue_size;
+- adapter->rx_ring_size = queue_size;
+-
+- adapter->max_tx_sgl_size = tx_sgl_size;
+- adapter->max_rx_sgl_size = rx_sgl_size;
++ adapter->tx_ring_size = calc_queue_ctx.tx_queue_size;
++ adapter->rx_ring_size = calc_queue_ctx.rx_queue_size;
++ adapter->max_tx_sgl_size = calc_queue_ctx.max_tx_sgl_size;
++ adapter->max_rx_sgl_size = calc_queue_ctx.max_rx_sgl_size;
+
+ adapter->num_queues = io_queue_num;
+ adapter->last_monitored_tx_qid = 0;
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -154,6 +154,18 @@ struct ena_napi {
+ u32 qid;
+ };
+
++struct ena_calc_queue_size_ctx {
++ struct ena_com_dev_get_features_ctx *get_feat_ctx;
++ struct ena_com_dev *ena_dev;
++ struct pci_dev *pdev;
++ u16 tx_queue_size;
++ u16 rx_queue_size;
++ u16 max_tx_queue_size;
++ u16 max_rx_queue_size;
++ u16 max_tx_sgl_size;
++ u16 max_rx_sgl_size;
++};
++
+ struct ena_tx_buffer {
+ struct sk_buff *skb;
+ /* num of ena desc for this specific skb
+@@ -322,6 +334,9 @@ struct ena_adapter {
+ u32 tx_ring_size;
+ u32 rx_ring_size;
+
++ u32 max_tx_ring_size;
++ u32 max_rx_ring_size;
++
+ u32 msg_enable;
+
+ u16 max_tx_sgl_size;
diff --git a/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch b/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch
new file mode 100644
index 0000000000..b1eb6f0ed4
--- /dev/null
+++ b/patches.drivers/net-ena-ethtool-add-extra-properties-retrieval-via-g.patch
@@ -0,0 +1,393 @@
+From: Arthur Kiyanovski <akiyano@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:20 +0300
+Subject: net: ena: ethtool: add extra properties retrieval via get_priv_flags
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 315c28d2b714f2c52c0b22f38dbf9b44f8f0c9e4
+References: bsc#1138879
+
+This commit adds a mechanism for exposing different device
+properties via ethtool's priv_flags. The strings are provided
+by the device and copied to user space through the driver.
+
+In this commit we:
+
+Add commands, structs and defines necessary for handling
+extra properties
+
+Add functions for:
+Allocation/destruction of a buffer for extra properties strings.
+Retreival of extra properties strings and flags from the network device.
+
+Handle the allocation of a buffer for extra properties strings.
+
+* Initialize buffer with extra properties strings from the
+ network device at driver startup.
+
+Use ethtool's get_priv_flags to expose extra properties of
+the ENA device
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_admin_defs.h | 16 ++++
+ drivers/net/ethernet/amazon/ena/ena_com.c | 56 +++++++++++++++++
+ drivers/net/ethernet/amazon/ena/ena_com.h | 32 +++++++++
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 75 +++++++++++++++++++----
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 14 ++++
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 2
+ 6 files changed, 184 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
++++ b/drivers/net/ethernet/amazon/ena/ena_admin_defs.h
+@@ -32,6 +32,8 @@
+ #ifndef _ENA_ADMIN_H_
+ #define _ENA_ADMIN_H_
+
++#define ENA_ADMIN_EXTRA_PROPERTIES_STRING_LEN 32
++#define ENA_ADMIN_EXTRA_PROPERTIES_COUNT 32
+
+ enum ena_admin_aq_opcode {
+ ENA_ADMIN_CREATE_SQ = 1,
+@@ -60,6 +62,8 @@ enum ena_admin_aq_feature_id {
+ ENA_ADMIN_MAX_QUEUES_NUM = 2,
+ ENA_ADMIN_HW_HINTS = 3,
+ ENA_ADMIN_LLQ = 4,
++ ENA_ADMIN_EXTRA_PROPERTIES_STRINGS = 5,
++ ENA_ADMIN_EXTRA_PROPERTIES_FLAGS = 6,
+ ENA_ADMIN_RSS_HASH_FUNCTION = 10,
+ ENA_ADMIN_STATELESS_OFFLOAD_CONFIG = 11,
+ ENA_ADMIN_RSS_REDIRECTION_TABLE_CONFIG = 12,
+@@ -560,6 +564,14 @@ struct ena_admin_set_feature_mtu_desc {
+ u32 mtu;
+ };
+
++struct ena_admin_get_extra_properties_strings_desc {
++ u32 count;
++};
++
++struct ena_admin_get_extra_properties_flags_desc {
++ u32 flags;
++};
++
+ struct ena_admin_set_feature_host_attr_desc {
+ /* host OS info base address in OS memory. host info is 4KB of
+ * physically contiguous
+@@ -864,6 +876,10 @@ struct ena_admin_get_feat_resp {
+ struct ena_admin_feature_intr_moder_desc intr_moderation;
+
+ struct ena_admin_ena_hw_hints hw_hints;
++
++ struct ena_admin_get_extra_properties_strings_desc extra_properties_strings;
++
++ struct ena_admin_get_extra_properties_flags_desc extra_properties_flags;
+ } u;
+ };
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -1877,6 +1877,62 @@ int ena_com_get_link_params(struct ena_c
+ return ena_com_get_feature(ena_dev, resp, ENA_ADMIN_LINK_CONFIG);
+ }
+
++int ena_com_extra_properties_strings_init(struct ena_com_dev *ena_dev)
++{
++ struct ena_admin_get_feat_resp resp;
++ struct ena_extra_properties_strings *extra_properties_strings =
++ &ena_dev->extra_properties_strings;
++ u32 rc;
++
++ extra_properties_strings->size = ENA_ADMIN_EXTRA_PROPERTIES_COUNT *
++ ENA_ADMIN_EXTRA_PROPERTIES_STRING_LEN;
++
++ extra_properties_strings->virt_addr =
++ dma_alloc_coherent(ena_dev->dmadev,
++ extra_properties_strings->size,
++ &extra_properties_strings->dma_addr,
++ GFP_KERNEL);
++ if (unlikely(!extra_properties_strings->virt_addr)) {
++ pr_err("Failed to allocate extra properties strings\n");
++ return 0;
++ }
++
++ rc = ena_com_get_feature_ex(ena_dev, &resp,
++ ENA_ADMIN_EXTRA_PROPERTIES_STRINGS,
++ extra_properties_strings->dma_addr,
++ extra_properties_strings->size);
++ if (rc) {
++ pr_debug("Failed to get extra properties strings\n");
++ goto err;
++ }
++
++ return resp.u.extra_properties_strings.count;
++err:
++ ena_com_delete_extra_properties_strings(ena_dev);
++ return 0;
++}
++
++void ena_com_delete_extra_properties_strings(struct ena_com_dev *ena_dev)
++{
++ struct ena_extra_properties_strings *extra_properties_strings =
++ &ena_dev->extra_properties_strings;
++
++ if (extra_properties_strings->virt_addr) {
++ dma_free_coherent(ena_dev->dmadev,
++ extra_properties_strings->size,
++ extra_properties_strings->virt_addr,
++ extra_properties_strings->dma_addr);
++ extra_properties_strings->virt_addr = NULL;
++ }
++}
++
++int ena_com_get_extra_properties_flags(struct ena_com_dev *ena_dev,
++ struct ena_admin_get_feat_resp *resp)
++{
++ return ena_com_get_feature(ena_dev, resp,
++ ENA_ADMIN_EXTRA_PROPERTIES_FLAGS);
++}
++
+ int ena_com_get_dev_attr_feat(struct ena_com_dev *ena_dev,
+ struct ena_com_dev_get_features_ctx *get_feat_ctx)
+ {
+--- a/drivers/net/ethernet/amazon/ena/ena_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_com.h
+@@ -347,6 +347,12 @@ struct ena_host_attribute {
+ dma_addr_t host_info_dma_addr;
+ };
+
++struct ena_extra_properties_strings {
++ u8 *virt_addr;
++ dma_addr_t dma_addr;
++ u32 size;
++};
++
+ /* Each ena_dev is a PCI function. */
+ struct ena_com_dev {
+ struct ena_com_admin_queue admin_queue;
+@@ -375,6 +381,7 @@ struct ena_com_dev {
+ struct ena_intr_moder_entry *intr_moder_tbl;
+
+ struct ena_com_llq_info llq_info;
++ struct ena_extra_properties_strings extra_properties_strings;
+ };
+
+ struct ena_com_dev_get_features_ctx {
+@@ -596,6 +603,31 @@ int ena_com_validate_version(struct ena_
+ int ena_com_get_link_params(struct ena_com_dev *ena_dev,
+ struct ena_admin_get_feat_resp *resp);
+
++/* ena_com_extra_properties_strings_init - Initialize the extra properties strings buffer.
++ * @ena_dev: ENA communication layer struct
++ *
++ * Initialize the extra properties strings buffer.
++ */
++int ena_com_extra_properties_strings_init(struct ena_com_dev *ena_dev);
++
++/* ena_com_delete_extra_properties_strings - Free the extra properties strings buffer.
++ * @ena_dev: ENA communication layer struct
++ *
++ * Free the allocated extra properties strings buffer.
++ */
++void ena_com_delete_extra_properties_strings(struct ena_com_dev *ena_dev);
++
++/* ena_com_get_extra_properties_flags - Retrieve extra properties flags.
++ * @ena_dev: ENA communication layer struct
++ * @resp: Extra properties flags.
++ *
++ * Retrieve the extra properties flags.
++ *
++ * @return - 0 on Success negative value otherwise.
++ */
++int ena_com_get_extra_properties_flags(struct ena_com_dev *ena_dev,
++ struct ena_admin_get_feat_resp *resp);
++
+ /* ena_com_get_dma_width - Retrieve physical dma address width the device
+ * supports.
+ * @ena_dev: ENA communication layer struct
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -197,15 +197,24 @@ static void ena_get_ethtool_stats(struct
+ ena_dev_admin_queue_stats(adapter, &data);
+ }
+
++static int get_stats_sset_count(struct ena_adapter *adapter)
++{
++ return adapter->num_queues * (ENA_STATS_ARRAY_TX + ENA_STATS_ARRAY_RX)
++ + ENA_STATS_ARRAY_GLOBAL + ENA_STATS_ARRAY_ENA_COM;
++}
++
+ int ena_get_sset_count(struct net_device *netdev, int sset)
+ {
+ struct ena_adapter *adapter = netdev_priv(netdev);
+
+- if (sset != ETH_SS_STATS)
++ switch (sset) {
++ case ETH_SS_STATS:
++ return get_stats_sset_count(adapter);
++ case ETH_SS_PRIV_FLAGS:
++ return adapter->ena_extra_properties_count;
++ default:
+ return -EOPNOTSUPP;
+-
+- return adapter->num_queues * (ENA_STATS_ARRAY_TX + ENA_STATS_ARRAY_RX)
+- + ENA_STATS_ARRAY_GLOBAL + ENA_STATS_ARRAY_ENA_COM;
++ }
+ }
+
+ static void ena_queue_strings(struct ena_adapter *adapter, u8 **data)
+@@ -247,26 +256,54 @@ static void ena_com_dev_strings(u8 **dat
+ }
+ }
+
+-static void ena_get_strings(struct net_device *netdev, u32 sset, u8 *data)
++static void get_stats_strings(struct ena_adapter *adapter, u8 *data)
+ {
+- struct ena_adapter *adapter = netdev_priv(netdev);
+ const struct ena_stats *ena_stats;
+ int i;
+
+- if (sset != ETH_SS_STATS)
+- return;
+-
+ for (i = 0; i < ENA_STATS_ARRAY_GLOBAL; i++) {
+ ena_stats = &ena_stats_global_strings[i];
+-
+ memcpy(data, ena_stats->name, ETH_GSTRING_LEN);
+ data += ETH_GSTRING_LEN;
+ }
+-
+ ena_queue_strings(adapter, &data);
+ ena_com_dev_strings(&data);
+ }
+
++static void get_private_flags_strings(struct ena_adapter *adapter, u8 *data)
++{
++ struct ena_com_dev *ena_dev = adapter->ena_dev;
++ u8 *strings = ena_dev->extra_properties_strings.virt_addr;
++ int i;
++
++ if (unlikely(!strings)) {
++ adapter->ena_extra_properties_count = 0;
++ return;
++ }
++
++ for (i = 0; i < adapter->ena_extra_properties_count; i++) {
++ strlcpy(data, strings + ENA_ADMIN_EXTRA_PROPERTIES_STRING_LEN * i,
++ ETH_GSTRING_LEN);
++ data += ETH_GSTRING_LEN;
++ }
++}
++
++static void ena_get_strings(struct net_device *netdev, u32 sset, u8 *data)
++{
++ struct ena_adapter *adapter = netdev_priv(netdev);
++
++ switch (sset) {
++ case ETH_SS_STATS:
++ get_stats_strings(adapter, data);
++ break;
++ case ETH_SS_PRIV_FLAGS:
++ get_private_flags_strings(adapter, data);
++ break;
++ default:
++ break;
++ }
++}
++
+ static int ena_get_link_ksettings(struct net_device *netdev,
+ struct ethtool_link_ksettings *link_ksettings)
+ {
+@@ -441,6 +478,7 @@ static void ena_get_drvinfo(struct net_d
+ strlcpy(info->version, DRV_MODULE_VERSION, sizeof(info->version));
+ strlcpy(info->bus_info, pci_name(adapter->pdev),
+ sizeof(info->bus_info));
++ info->n_priv_flags = adapter->ena_extra_properties_count;
+ }
+
+ static void ena_get_ringparam(struct net_device *netdev,
+@@ -798,6 +836,20 @@ static int ena_set_tunable(struct net_de
+ return ret;
+ }
+
++static u32 ena_get_priv_flags(struct net_device *netdev)
++{
++ struct ena_adapter *adapter = netdev_priv(netdev);
++ struct ena_com_dev *ena_dev = adapter->ena_dev;
++ struct ena_admin_get_feat_resp get_resp;
++ u32 rc;
++
++ rc = ena_com_get_extra_properties_flags(ena_dev, &get_resp);
++ if (!rc)
++ return get_resp.u.extra_properties_flags.flags;
++
++ return 0;
++}
++
+ static const struct ethtool_ops ena_ethtool_ops = {
+ .get_link_ksettings = ena_get_link_ksettings,
+ .get_drvinfo = ena_get_drvinfo,
+@@ -819,6 +871,7 @@ static const struct ethtool_ops ena_etht
+ .get_channels = ena_get_channels,
+ .get_tunable = ena_get_tunable,
+ .set_tunable = ena_set_tunable,
++ .get_priv_flags = ena_get_priv_flags,
+ };
+
+ void ena_set_ethtool_ops(struct net_device *netdev)
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2371,6 +2371,14 @@ err:
+ ena_com_delete_debug_area(adapter->ena_dev);
+ }
+
++static void ena_extra_properties_strings_destroy(struct net_device *netdev)
++{
++ struct ena_adapter *adapter = netdev_priv(netdev);
++
++ ena_com_delete_extra_properties_strings(adapter->ena_dev);
++ adapter->ena_extra_properties_count = 0;
++}
++
+ static void ena_get_stats64(struct net_device *netdev,
+ struct rtnl_link_stats64 *stats)
+ {
+@@ -3426,6 +3434,9 @@ static int ena_probe(struct pci_dev *pde
+
+ ena_config_debug_area(adapter);
+
++ adapter->ena_extra_properties_count =
++ ena_com_extra_properties_strings_init(ena_dev);
++
+ memcpy(adapter->netdev->perm_addr, adapter->mac_addr, netdev->addr_len);
+
+ netif_carrier_off(netdev);
+@@ -3466,6 +3477,7 @@ static int ena_probe(struct pci_dev *pde
+ return 0;
+
+ err_rss:
++ ena_extra_properties_strings_destroy(netdev);
+ ena_com_delete_debug_area(ena_dev);
+ ena_com_rss_destroy(ena_dev);
+ err_free_msix:
+@@ -3558,6 +3570,8 @@ static void ena_remove(struct pci_dev *p
+
+ ena_com_delete_host_info(ena_dev);
+
++ ena_extra_properties_strings_destroy(netdev);
++
+ ena_release_bars(ena_dev, pdev);
+
+ pci_disable_device(pdev);
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -364,6 +364,8 @@ struct ena_adapter {
+ u32 last_monitored_tx_qid;
+
+ enum ena_regs_reset_reason_types reset_reason;
++
++ u8 ena_extra_properties_count;
+ };
+
+ void ena_set_ethtool_ops(struct net_device *netdev);
diff --git a/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch b/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch
new file mode 100644
index 0000000000..bd1c06eb07
--- /dev/null
+++ b/patches.drivers/net-ena-fix-Free-napi-resources-when-ena_up-fails.patch
@@ -0,0 +1,31 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:05 +0300
+Subject: net: ena: fix: Free napi resources when ena_up() fails
+Patch-mainline: v5.2-rc1
+Git-commit: b287cdbd1cedfc9606682c6e02b58d00ff3a33ae
+References: bsc#1138879
+
+ena_up() calls ena_init_napi() but does not call ena_del_napi() in
+case of failure. This causes a segmentation fault upon rmmod when
+netif_napi_del() is called. Fix this bug by calling ena_del_napi()
+before returning error from ena_up().
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -1826,6 +1826,7 @@ err_setup_rx:
+ err_setup_tx:
+ ena_free_io_irq(adapter);
+ err_req_irq:
++ ena_del_napi(adapter);
+
+ return rc;
+ }
diff --git a/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch b/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
new file mode 100644
index 0000000000..b9574894ed
--- /dev/null
+++ b/patches.drivers/net-ena-fix-ena_com_fill_hash_function-implementatio.patch
@@ -0,0 +1,28 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:09 +0300
+Subject: net: ena: fix ena_com_fill_hash_function() implementation
+Patch-mainline: v5.2-rc1
+Git-commit: 11bd7a00c0d8ffe33d1e926f8e789b4aea787186
+References: bsc#1138879
+
+ena_com_fill_hash_function() didn't configure the rss->hash_func.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Netanel Belgazal <netanel@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2280,6 +2280,7 @@ int ena_com_fill_hash_function(struct en
+ return -EINVAL;
+ }
+
++ rss->hash_func = func;
+ rc = ena_com_set_hash_function(ena_dev);
+
+ /* Restore the old function */
diff --git a/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch b/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
new file mode 100644
index 0000000000..dbe7a86a99
--- /dev/null
+++ b/patches.drivers/net-ena-fix-incorrect-test-of-supported-hash-functio.patch
@@ -0,0 +1,33 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:06 +0300
+Subject: net: ena: fix incorrect test of supported hash function
+Patch-mainline: v5.2-rc1
+Git-commit: d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8
+References: bsc#1138879
+
+ena_com_set_hash_function() tests if a hash function is supported
+by the device before setting it.
+The test returns the opposite result than needed.
+Reverse the condition to return the correct value.
+Also use the BIT macro instead of inline shift.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2195,7 +2195,7 @@ int ena_com_set_hash_function(struct ena
+ if (unlikely(ret))
+ return ret;
+
+- if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) {
++ if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) {
+ pr_err("Func hash %d isn't supported by device, abort\n",
+ rss->hash_func);
+ return -EOPNOTSUPP;
diff --git a/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch b/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch
new file mode 100644
index 0000000000..f43e2f2a80
--- /dev/null
+++ b/patches.drivers/net-ena-fix-set-freed-objects-to-NULL-to-avoid-faili.patch
@@ -0,0 +1,91 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:04 +0300
+Subject: net: ena: fix: set freed objects to NULL to avoid failing future
+ allocations
+Patch-mainline: v5.2-rc1
+Git-commit: 8ee8ee7fe87bf64738ab4e31be036a7165608b27
+References: bsc#1138879
+
+In some cases when a queue related allocation fails, successful past
+allocations are freed but the pointer that pointed to them is not
+set to NULL. This is a problem for 2 reasons:
+1. This is generally a bad practice since this pointer might be
+accidentally accessed in the future.
+2. Future allocations using the same pointer check if the pointer
+is NULL and fail if it is not.
+
+Fixed this by setting such pointers to NULL in the allocation of
+queue related objects.
+
+Also refactored the code of ena_setup_tx_resources() to goto-style
+error handling to avoid code duplication of resource freeing.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 25 +++++++++++++++----------
+ 1 file changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -225,28 +225,23 @@ static int ena_setup_tx_resources(struct
+ if (!tx_ring->tx_buffer_info) {
+ tx_ring->tx_buffer_info = vzalloc(size);
+ if (!tx_ring->tx_buffer_info)
+- return -ENOMEM;
++ goto err_tx_buffer_info;
+ }
+
+ size = sizeof(u16) * tx_ring->ring_size;
+ tx_ring->free_tx_ids = vzalloc_node(size, node);
+ if (!tx_ring->free_tx_ids) {
+ tx_ring->free_tx_ids = vzalloc(size);
+- if (!tx_ring->free_tx_ids) {
+- vfree(tx_ring->tx_buffer_info);
+- return -ENOMEM;
+- }
++ if (!tx_ring->free_tx_ids)
++ goto err_free_tx_ids;
+ }
+
+ size = tx_ring->tx_max_header_size;
+ tx_ring->push_buf_intermediate_buf = vzalloc_node(size, node);
+ if (!tx_ring->push_buf_intermediate_buf) {
+ tx_ring->push_buf_intermediate_buf = vzalloc(size);
+- if (!tx_ring->push_buf_intermediate_buf) {
+- vfree(tx_ring->tx_buffer_info);
+- vfree(tx_ring->free_tx_ids);
+- return -ENOMEM;
+- }
++ if (!tx_ring->push_buf_intermediate_buf)
++ goto err_push_buf_intermediate_buf;
+ }
+
+ /* Req id ring for TX out of order completions */
+@@ -260,6 +255,15 @@ static int ena_setup_tx_resources(struct
+ tx_ring->next_to_clean = 0;
+ tx_ring->cpu = ena_irq->cpu;
+ return 0;
++
++err_push_buf_intermediate_buf:
++ vfree(tx_ring->free_tx_ids);
++ tx_ring->free_tx_ids = NULL;
++err_free_tx_ids:
++ vfree(tx_ring->tx_buffer_info);
++ tx_ring->tx_buffer_info = NULL;
++err_tx_buffer_info:
++ return -ENOMEM;
+ }
+
+ /* ena_free_tx_resources - Free I/O Tx Resources per Queue
+@@ -379,6 +383,7 @@ static int ena_setup_rx_resources(struct
+ rx_ring->free_rx_ids = vzalloc(size);
+ if (!rx_ring->free_rx_ids) {
+ vfree(rx_ring->rx_buffer_info);
++ rx_ring->rx_buffer_info = NULL;
+ return -ENOMEM;
+ }
+ }
diff --git a/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch b/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
new file mode 100644
index 0000000000..37c269447b
--- /dev/null
+++ b/patches.drivers/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch
@@ -0,0 +1,32 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:03 +0300
+Subject: net: ena: fix swapped parameters when calling
+ ena_com_indirect_table_fill_entry
+Patch-mainline: v5.2-rc1
+Git-commit: 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9
+References: bsc#1138879
+
+second parameter should be the index of the table rather than the value.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Saeed Bshara <saeedb@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -697,8 +697,8 @@ static int ena_set_rxfh(struct net_devic
+ if (indir) {
+ for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) {
+ rc = ena_com_indirect_table_fill_entry(ena_dev,
+- ENA_IO_RXQ_IDX(indir[i]),
+- i);
++ i,
++ ENA_IO_RXQ_IDX(indir[i]));
+ if (unlikely(rc)) {
+ netif_err(adapter, drv, netdev,
+ "Cannot fill indirect table (index is too large)\n");
diff --git a/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch b/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch
new file mode 100644
index 0000000000..73130e2966
--- /dev/null
+++ b/patches.drivers/net-ena-gcc-8-fix-compilation-warning.patch
@@ -0,0 +1,42 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:10 +0300
+Subject: net: ena: gcc 8: fix compilation warning
+Patch-mainline: v5.2-rc1
+Git-commit: f913308879bc6ae437ce64d878c7b05643ddea44
+References: bsc#1138879
+
+GCC 8 contains a number of new warnings as well as enhancements to existing
+checkers. The warning - Wstringop-truncation - warns for calls to bounded
+string manipulation functions such as strncat, strncpy, and stpncpy that
+may either truncate the copied string or leave the destination unchanged.
+
+In our case the destination string length (32 bytes) is much shorter than
+the source string (64 bytes) which causes this warning to show up. In
+general the destination has to be at least a byte larger than the length
+of the source string with strncpy for this warning not to showup.
+
+This can be easily fixed by using strlcpy instead which already does the
+truncation to the string. Documentation for this function can be
+found here:
+
+https://elixir.bootlin.com/linux/latest/source/lib/string.c#L141
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2299,7 +2299,7 @@ static void ena_config_host_info(struct
+ host_info->bdf = (pdev->bus->number << 8) | pdev->devfn;
+ host_info->os_type = ENA_ADMIN_OS_LINUX;
+ host_info->kernel_ver = LINUX_VERSION_CODE;
+- strncpy(host_info->kernel_ver_str, utsname()->version,
++ strlcpy(host_info->kernel_ver_str, utsname()->version,
+ sizeof(host_info->kernel_ver_str) - 1);
+ host_info->os_dist = 0;
+ strncpy(host_info->os_dist_str, utsname()->release,
diff --git a/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch b/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch
new file mode 100644
index 0000000000..a3af8f25d0
--- /dev/null
+++ b/patches.drivers/net-ena-improve-latency-by-disabling-adaptive-interr.patch
@@ -0,0 +1,41 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Wed, 1 May 2019 16:47:08 +0300
+Subject: net: ena: improve latency by disabling adaptive interrupt moderation
+ by default
+Patch-mainline: v5.2-rc1
+Git-commit: 78cb421d185cfb4fcea94e7c3ff6e6ea77bb8c11
+References: bsc#1138879
+
+Adaptive interrupt moderation was erroneously enabled by default
+in the driver.
+
+In case the device supports adaptive interrupt moderation it will
+be automatically used, which may potentially increase latency.
+
+The adaptive moderation can be enabled from ethtool command in
+case the feature is supported by the device.
+
+Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)")
+Signed-off-by: Guy Tzalik <gtzalik@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -2801,7 +2801,11 @@ int ena_com_init_interrupt_moderation(st
+ /* if moderation is supported by device we set adaptive moderation */
+ delay_resolution = get_resp.u.intr_moderation.intr_delay_resolution;
+ ena_com_update_intr_delay_resolution(ena_dev, delay_resolution);
+- ena_com_enable_adaptive_moderation(ena_dev);
++
++ /* Disable adaptive moderation by default - can be enabled from
++ * ethtool
++ */
++ ena_com_disable_adaptive_moderation(ena_dev);
+
+ return 0;
+ err:
diff --git a/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch b/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch
new file mode 100644
index 0000000000..dcd3288254
--- /dev/null
+++ b/patches.drivers/net-ena-make-ethtool-show-correct-current-and-max-qu.patch
@@ -0,0 +1,51 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:07 +0300
+Subject: net: ena: make ethtool show correct current and max queue sizes
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 9f9ae3f98b8d8b8aa709831057759dbb52ba5083
+References: bsc#1138879
+
+Currently ethtool -g shows the same size for current and max queue
+sizes.
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 10 ++++------
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 2 ++
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c
++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c
+@@ -486,13 +486,11 @@ static void ena_get_ringparam(struct net
+ struct ethtool_ringparam *ring)
+ {
+ struct ena_adapter *adapter = netdev_priv(netdev);
+- struct ena_ring *tx_ring = &adapter->tx_ring[0];
+- struct ena_ring *rx_ring = &adapter->rx_ring[0];
+
+- ring->rx_max_pending = rx_ring->ring_size;
+- ring->tx_max_pending = tx_ring->ring_size;
+- ring->rx_pending = rx_ring->ring_size;
+- ring->tx_pending = tx_ring->ring_size;
++ ring->tx_max_pending = adapter->max_tx_ring_size;
++ ring->rx_max_pending = adapter->max_rx_ring_size;
++ ring->tx_pending = adapter->tx_ring_size;
++ ring->rx_pending = adapter->rx_ring_size;
+ }
+
+ static u32 ena_flow_hash_to_flow_type(u16 hash_fields)
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -3440,6 +3440,8 @@ static int ena_probe(struct pci_dev *pde
+
+ adapter->tx_ring_size = calc_queue_ctx.tx_queue_size;
+ adapter->rx_ring_size = calc_queue_ctx.rx_queue_size;
++ adapter->max_tx_ring_size = calc_queue_ctx.max_tx_queue_size;
++ adapter->max_rx_ring_size = calc_queue_ctx.max_rx_queue_size;
+ adapter->max_tx_sgl_size = calc_queue_ctx.max_tx_sgl_size;
+ adapter->max_rx_sgl_size = calc_queue_ctx.max_rx_sgl_size;
+
diff --git a/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch b/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch
new file mode 100644
index 0000000000..be4caf77dd
--- /dev/null
+++ b/patches.drivers/net-ena-optimise-calculations-for-CQ-doorbell.patch
@@ -0,0 +1,47 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:27 +0300
+Subject: net: ena: optimise calculations for CQ doorbell
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: d91860989dd4bce582ed6c3647a0d41d6fd895b3
+References: bsc#1138879
+
+This patch initially checks if CQ doorbell
+is needed before proceeding with the calculations.
+
+Signed-off-by: Igor Chauskin <igorch@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_eth_com.h | 18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.h
++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.h
+@@ -195,15 +195,17 @@ static inline int ena_com_update_dev_com
+ u16 unreported_comp, head;
+ bool need_update;
+
+- head = io_cq->head;
+- unreported_comp = head - io_cq->last_head_update;
+- need_update = unreported_comp > (io_cq->q_depth / ENA_COMP_HEAD_THRESH);
++ if (unlikely(io_cq->cq_head_db_reg)) {
++ head = io_cq->head;
++ unreported_comp = head - io_cq->last_head_update;
++ need_update = unreported_comp > (io_cq->q_depth / ENA_COMP_HEAD_THRESH);
+
+- if (io_cq->cq_head_db_reg && need_update) {
+- pr_debug("Write completion queue doorbell for queue %d: head: %d\n",
+- io_cq->qid, head);
+- writel(head, io_cq->cq_head_db_reg);
+- io_cq->last_head_update = head;
++ if (unlikely(need_update)) {
++ pr_debug("Write completion queue doorbell for queue %d: head: %d\n",
++ io_cq->qid, head);
++ writel(head, io_cq->cq_head_db_reg);
++ io_cq->last_head_update = head;
++ }
+ }
+
+ return 0;
diff --git a/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch b/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch
new file mode 100644
index 0000000000..ab78c09270
--- /dev/null
+++ b/patches.drivers/net-ena-remove-inline-keyword-from-functions-in-.c.patch
@@ -0,0 +1,241 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:10 +0300
+Subject: net: ena: remove inline keyword from functions in *.c
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: c2b542044761965db0e4cc400ab6abf670fc25b7
+References: bsc#1138879
+
+Let the compiler decide if the function should be inline in *.c files
+
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_com.c | 6 +++---
+ drivers/net/ethernet/amazon/ena/ena_eth_com.c | 26 +++++++++++++-------------
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 16 ++++++++--------
+ 3 files changed, 24 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_com.c
+@@ -91,7 +91,7 @@ struct ena_com_stats_ctx {
+ struct ena_admin_acq_get_stats_resp get_resp;
+ };
+
+-static inline int ena_com_mem_addr_set(struct ena_com_dev *ena_dev,
++static int ena_com_mem_addr_set(struct ena_com_dev *ena_dev,
+ struct ena_common_mem_addr *ena_addr,
+ dma_addr_t addr)
+ {
+@@ -190,7 +190,7 @@ static int ena_com_admin_init_aenq(struc
+ return 0;
+ }
+
+-static inline void comp_ctxt_release(struct ena_com_admin_queue *queue,
++static void comp_ctxt_release(struct ena_com_admin_queue *queue,
+ struct ena_comp_ctx *comp_ctx)
+ {
+ comp_ctx->occupied = false;
+@@ -277,7 +277,7 @@ static struct ena_comp_ctx *__ena_com_su
+ return comp_ctx;
+ }
+
+-static inline int ena_com_init_comp_ctxt(struct ena_com_admin_queue *queue)
++static int ena_com_init_comp_ctxt(struct ena_com_admin_queue *queue)
+ {
+ size_t size = queue->q_depth * sizeof(struct ena_comp_ctx);
+ struct ena_comp_ctx *comp_ctx;
+--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c
++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c
+@@ -32,7 +32,7 @@
+
+ #include "ena_eth_com.h"
+
+-static inline struct ena_eth_io_rx_cdesc_base *ena_com_get_next_rx_cdesc(
++static struct ena_eth_io_rx_cdesc_base *ena_com_get_next_rx_cdesc(
+ struct ena_com_io_cq *io_cq)
+ {
+ struct ena_eth_io_rx_cdesc_base *cdesc;
+@@ -59,7 +59,7 @@ static inline struct ena_eth_io_rx_cdesc
+ return cdesc;
+ }
+
+-static inline void *get_sq_desc_regular_queue(struct ena_com_io_sq *io_sq)
++static void *get_sq_desc_regular_queue(struct ena_com_io_sq *io_sq)
+ {
+ u16 tail_masked;
+ u32 offset;
+@@ -71,7 +71,7 @@ static inline void *get_sq_desc_regular_
+ return (void *)((uintptr_t)io_sq->desc_addr.virt_addr + offset);
+ }
+
+-static inline int ena_com_write_bounce_buffer_to_dev(struct ena_com_io_sq *io_sq,
++static int ena_com_write_bounce_buffer_to_dev(struct ena_com_io_sq *io_sq,
+ u8 *bounce_buffer)
+ {
+ struct ena_com_llq_info *llq_info = &io_sq->llq_info;
+@@ -111,7 +111,7 @@ static inline int ena_com_write_bounce_b
+ return 0;
+ }
+
+-static inline int ena_com_write_header_to_bounce(struct ena_com_io_sq *io_sq,
++static int ena_com_write_header_to_bounce(struct ena_com_io_sq *io_sq,
+ u8 *header_src,
+ u16 header_len)
+ {
+@@ -142,7 +142,7 @@ static inline int ena_com_write_header_t
+ return 0;
+ }
+
+-static inline void *get_sq_desc_llq(struct ena_com_io_sq *io_sq)
++static void *get_sq_desc_llq(struct ena_com_io_sq *io_sq)
+ {
+ struct ena_com_llq_pkt_ctrl *pkt_ctrl = &io_sq->llq_buf_ctrl;
+ u8 *bounce_buffer;
+@@ -162,7 +162,7 @@ static inline void *get_sq_desc_llq(stru
+ return sq_desc;
+ }
+
+-static inline int ena_com_close_bounce_buffer(struct ena_com_io_sq *io_sq)
++static int ena_com_close_bounce_buffer(struct ena_com_io_sq *io_sq)
+ {
+ struct ena_com_llq_pkt_ctrl *pkt_ctrl = &io_sq->llq_buf_ctrl;
+ struct ena_com_llq_info *llq_info = &io_sq->llq_info;
+@@ -189,7 +189,7 @@ static inline int ena_com_close_bounce_b
+ return 0;
+ }
+
+-static inline void *get_sq_desc(struct ena_com_io_sq *io_sq)
++static void *get_sq_desc(struct ena_com_io_sq *io_sq)
+ {
+ if (io_sq->mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV)
+ return get_sq_desc_llq(io_sq);
+@@ -197,7 +197,7 @@ static inline void *get_sq_desc(struct e
+ return get_sq_desc_regular_queue(io_sq);
+ }
+
+-static inline int ena_com_sq_update_llq_tail(struct ena_com_io_sq *io_sq)
++static int ena_com_sq_update_llq_tail(struct ena_com_io_sq *io_sq)
+ {
+ struct ena_com_llq_pkt_ctrl *pkt_ctrl = &io_sq->llq_buf_ctrl;
+ struct ena_com_llq_info *llq_info = &io_sq->llq_info;
+@@ -225,7 +225,7 @@ static inline int ena_com_sq_update_llq_
+ return 0;
+ }
+
+-static inline int ena_com_sq_update_tail(struct ena_com_io_sq *io_sq)
++static int ena_com_sq_update_tail(struct ena_com_io_sq *io_sq)
+ {
+ if (io_sq->mem_queue_type == ENA_ADMIN_PLACEMENT_POLICY_DEV)
+ return ena_com_sq_update_llq_tail(io_sq);
+@@ -239,7 +239,7 @@ static inline int ena_com_sq_update_tail
+ return 0;
+ }
+
+-static inline struct ena_eth_io_rx_cdesc_base *
++static struct ena_eth_io_rx_cdesc_base *
+ ena_com_rx_cdesc_idx_to_ptr(struct ena_com_io_cq *io_cq, u16 idx)
+ {
+ idx &= (io_cq->q_depth - 1);
+@@ -248,7 +248,7 @@ static inline struct ena_eth_io_rx_cdesc
+ idx * io_cq->cdesc_entry_size_in_bytes);
+ }
+
+-static inline u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
++static u16 ena_com_cdesc_rx_pkt_get(struct ena_com_io_cq *io_cq,
+ u16 *first_cdesc_idx)
+ {
+ struct ena_eth_io_rx_cdesc_base *cdesc;
+@@ -285,7 +285,7 @@ static inline u16 ena_com_cdesc_rx_pkt_g
+ return count;
+ }
+
+-static inline int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq,
++static int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq,
+ struct ena_com_tx_ctx *ena_tx_ctx)
+ {
+ struct ena_eth_io_tx_meta_desc *meta_desc = NULL;
+@@ -334,7 +334,7 @@ static inline int ena_com_create_and_sto
+ return ena_com_sq_update_tail(io_sq);
+ }
+
+-static inline void ena_com_rx_set_flags(struct ena_com_rx_ctx *ena_rx_ctx,
++static void ena_com_rx_set_flags(struct ena_com_rx_ctx *ena_rx_ctx,
+ struct ena_eth_io_rx_cdesc_base *cdesc)
+ {
+ ena_rx_ctx->l3_proto = cdesc->status &
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -327,7 +327,7 @@ static void ena_free_all_io_tx_resources
+ ena_free_tx_resources(adapter, i);
+ }
+
+-static inline int validate_rx_req_id(struct ena_ring *rx_ring, u16 req_id)
++static int validate_rx_req_id(struct ena_ring *rx_ring, u16 req_id)
+ {
+ if (likely(req_id < rx_ring->ring_size))
+ return 0;
+@@ -461,7 +461,7 @@ static void ena_free_all_io_rx_resources
+ ena_free_rx_resources(adapter, i);
+ }
+
+-static inline int ena_alloc_rx_page(struct ena_ring *rx_ring,
++static int ena_alloc_rx_page(struct ena_ring *rx_ring,
+ struct ena_rx_buffer *rx_info, gfp_t gfp)
+ {
+ struct ena_com_buf *ena_buf;
+@@ -621,7 +621,7 @@ static void ena_free_all_rx_bufs(struct
+ ena_free_rx_bufs(adapter, i);
+ }
+
+-static inline void ena_unmap_tx_skb(struct ena_ring *tx_ring,
++static void ena_unmap_tx_skb(struct ena_ring *tx_ring,
+ struct ena_tx_buffer *tx_info)
+ {
+ struct ena_com_buf *ena_buf;
+@@ -956,7 +956,7 @@ static struct sk_buff *ena_rx_skb(struct
+ * @ena_rx_ctx: received packet context/metadata
+ * @skb: skb currently being received and modified
+ */
+-static inline void ena_rx_checksum(struct ena_ring *rx_ring,
++static void ena_rx_checksum(struct ena_ring *rx_ring,
+ struct ena_com_rx_ctx *ena_rx_ctx,
+ struct sk_buff *skb)
+ {
+@@ -1156,7 +1156,7 @@ error:
+ return 0;
+ }
+
+-inline void ena_adjust_intr_moderation(struct ena_ring *rx_ring,
++void ena_adjust_intr_moderation(struct ena_ring *rx_ring,
+ struct ena_ring *tx_ring)
+ {
+ /* We apply adaptive moderation on Rx path only.
+@@ -1175,7 +1175,7 @@ inline void ena_adjust_intr_moderation(s
+ rx_ring->per_napi_bytes = 0;
+ }
+
+-static inline void ena_unmask_interrupt(struct ena_ring *tx_ring,
++static void ena_unmask_interrupt(struct ena_ring *tx_ring,
+ struct ena_ring *rx_ring)
+ {
+ struct ena_eth_io_intr_reg intr_reg;
+@@ -1195,7 +1195,7 @@ static inline void ena_unmask_interrupt(
+ ena_com_unmask_intr(rx_ring->ena_com_io_cq, &intr_reg);
+ }
+
+-static inline void ena_update_ring_numa_node(struct ena_ring *tx_ring,
++static void ena_update_ring_numa_node(struct ena_ring *tx_ring,
+ struct ena_ring *rx_ring)
+ {
+ int cpu = get_cpu();
+@@ -3339,7 +3339,7 @@ static void ena_release_bars(struct ena_
+ pci_release_selected_regions(pdev, release_bars);
+ }
+
+-static inline void set_default_llq_configurations(struct ena_llq_configurations *llq_config)
++static void set_default_llq_configurations(struct ena_llq_configurations *llq_config)
+ {
+ llq_config->llq_header_location = ENA_ADMIN_INLINE_HEADER;
+ llq_config->llq_ring_entry_size = ENA_ADMIN_LIST_ENTRY_SIZE_128B;
diff --git a/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch b/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch
new file mode 100644
index 0000000000..8220b560c8
--- /dev/null
+++ b/patches.drivers/net-ena-replace-free_tx-rx_ids-union-with-single-fre.patch
@@ -0,0 +1,194 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:21 +0300
+Subject: net: ena: replace free_tx/rx_ids union with single free_ids field in
+ ena_ring
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: f917249833c7a00ea8be39b1bcb3ec8ef3aea45f
+References: bsc#1138879
+
+struct ena_ring holds a union of free_rx_ids and free_tx_ids.
+Both of the above fields mean the exact same thing and are used
+exactly the same way.
+Furthermore, these fields are always used with a prefix of the
+type of ring. So for tx it will be tx_ring->free_tx_ids, and for
+rx it will be rx_ring->free_rx_ids, which shows how redundant the
+"_tx" and "_rx" parts are.
+Furthermore still, this may lead to confusing code like where
+tx_ring->free_rx_ids which works correctly but looks like a mess.
+
+This commit removes the aforementioned redundancy by replacing the
+free_rx/tx_ids union with a single free_ids field.
+It also changes a single goto label name from err_free_tx_ids: to
+err_tx_free_ids: for consistency with the above new notation.
+
+Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com>
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 48 +++++++++++++--------------
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 11 ++----
+ 2 files changed, 28 insertions(+), 31 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -229,11 +229,11 @@ static int ena_setup_tx_resources(struct
+ }
+
+ size = sizeof(u16) * tx_ring->ring_size;
+- tx_ring->free_tx_ids = vzalloc_node(size, node);
+- if (!tx_ring->free_tx_ids) {
+- tx_ring->free_tx_ids = vzalloc(size);
+- if (!tx_ring->free_tx_ids)
+- goto err_free_tx_ids;
++ tx_ring->free_ids = vzalloc_node(size, node);
++ if (!tx_ring->free_ids) {
++ tx_ring->free_ids = vzalloc(size);
++ if (!tx_ring->free_ids)
++ goto err_tx_free_ids;
+ }
+
+ size = tx_ring->tx_max_header_size;
+@@ -246,7 +246,7 @@ static int ena_setup_tx_resources(struct
+
+ /* Req id ring for TX out of order completions */
+ for (i = 0; i < tx_ring->ring_size; i++)
+- tx_ring->free_tx_ids[i] = i;
++ tx_ring->free_ids[i] = i;
+
+ /* Reset tx statistics */
+ memset(&tx_ring->tx_stats, 0x0, sizeof(tx_ring->tx_stats));
+@@ -257,9 +257,9 @@ static int ena_setup_tx_resources(struct
+ return 0;
+
+ err_push_buf_intermediate_buf:
+- vfree(tx_ring->free_tx_ids);
+- tx_ring->free_tx_ids = NULL;
+-err_free_tx_ids:
++ vfree(tx_ring->free_ids);
++ tx_ring->free_ids = NULL;
++err_tx_free_ids:
+ vfree(tx_ring->tx_buffer_info);
+ tx_ring->tx_buffer_info = NULL;
+ err_tx_buffer_info:
+@@ -279,8 +279,8 @@ static void ena_free_tx_resources(struct
+ vfree(tx_ring->tx_buffer_info);
+ tx_ring->tx_buffer_info = NULL;
+
+- vfree(tx_ring->free_tx_ids);
+- tx_ring->free_tx_ids = NULL;
++ vfree(tx_ring->free_ids);
++ tx_ring->free_ids = NULL;
+
+ vfree(tx_ring->push_buf_intermediate_buf);
+ tx_ring->push_buf_intermediate_buf = NULL;
+@@ -378,10 +378,10 @@ static int ena_setup_rx_resources(struct
+ }
+
+ size = sizeof(u16) * rx_ring->ring_size;
+- rx_ring->free_rx_ids = vzalloc_node(size, node);
+- if (!rx_ring->free_rx_ids) {
+- rx_ring->free_rx_ids = vzalloc(size);
+- if (!rx_ring->free_rx_ids) {
++ rx_ring->free_ids = vzalloc_node(size, node);
++ if (!rx_ring->free_ids) {
++ rx_ring->free_ids = vzalloc(size);
++ if (!rx_ring->free_ids) {
+ vfree(rx_ring->rx_buffer_info);
+ rx_ring->rx_buffer_info = NULL;
+ return -ENOMEM;
+@@ -390,7 +390,7 @@ static int ena_setup_rx_resources(struct
+
+ /* Req id ring for receiving RX pkts out of order */
+ for (i = 0; i < rx_ring->ring_size; i++)
+- rx_ring->free_rx_ids[i] = i;
++ rx_ring->free_ids[i] = i;
+
+ /* Reset rx statistics */
+ memset(&rx_ring->rx_stats, 0x0, sizeof(rx_ring->rx_stats));
+@@ -416,8 +416,8 @@ static void ena_free_rx_resources(struct
+ vfree(rx_ring->rx_buffer_info);
+ rx_ring->rx_buffer_info = NULL;
+
+- vfree(rx_ring->free_rx_ids);
+- rx_ring->free_rx_ids = NULL;
++ vfree(rx_ring->free_ids);
++ rx_ring->free_ids = NULL;
+ }
+
+ /* ena_setup_all_rx_resources - allocate I/O Rx queues resources for all queues
+@@ -532,7 +532,7 @@ static int ena_refill_rx_bufs(struct ena
+ for (i = 0; i < num; i++) {
+ struct ena_rx_buffer *rx_info;
+
+- req_id = rx_ring->free_rx_ids[next_to_use];
++ req_id = rx_ring->free_ids[next_to_use];
+ rc = validate_rx_req_id(rx_ring, req_id);
+ if (unlikely(rc < 0))
+ break;
+@@ -798,7 +798,7 @@ static int ena_clean_tx_irq(struct ena_r
+ tx_pkts++;
+ total_done += tx_info->tx_descs;
+
+- tx_ring->free_tx_ids[next_to_clean] = req_id;
++ tx_ring->free_ids[next_to_clean] = req_id;
+ next_to_clean = ENA_TX_RING_IDX_NEXT(next_to_clean,
+ tx_ring->ring_size);
+ }
+@@ -912,7 +912,7 @@ static struct sk_buff *ena_rx_skb(struct
+
+ skb_put(skb, len);
+ skb->protocol = eth_type_trans(skb, rx_ring->netdev);
+- rx_ring->free_rx_ids[*next_to_clean] = req_id;
++ rx_ring->free_ids[*next_to_clean] = req_id;
+ *next_to_clean = ENA_RX_RING_IDX_ADD(*next_to_clean, descs,
+ rx_ring->ring_size);
+ return skb;
+@@ -936,7 +936,7 @@ static struct sk_buff *ena_rx_skb(struct
+
+ rx_info->page = NULL;
+
+- rx_ring->free_rx_ids[*next_to_clean] = req_id;
++ rx_ring->free_ids[*next_to_clean] = req_id;
+ *next_to_clean =
+ ENA_RX_RING_IDX_NEXT(*next_to_clean,
+ rx_ring->ring_size);
+@@ -1089,7 +1089,7 @@ static int ena_clean_rx_irq(struct ena_r
+ /* exit if we failed to retrieve a buffer */
+ if (unlikely(!skb)) {
+ for (i = 0; i < ena_rx_ctx.descs; i++) {
+- rx_ring->free_tx_ids[next_to_clean] =
++ rx_ring->free_ids[next_to_clean] =
+ rx_ring->ena_bufs[i].req_id;
+ next_to_clean =
+ ENA_RX_RING_IDX_NEXT(next_to_clean,
+@@ -2153,7 +2153,7 @@ static netdev_tx_t ena_start_xmit(struct
+ skb_tx_timestamp(skb);
+
+ next_to_use = tx_ring->next_to_use;
+- req_id = tx_ring->free_tx_ids[next_to_use];
++ req_id = tx_ring->free_ids[next_to_use];
+ tx_info = &tx_ring->tx_buffer_info[req_id];
+ tx_info->num_of_bufs = 0;
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -221,13 +221,10 @@ struct ena_stats_rx {
+ };
+
+ struct ena_ring {
+- union {
+- /* Holds the empty requests for TX/RX
+- * out of order completions
+- */
+- u16 *free_tx_ids;
+- u16 *free_rx_ids;
+- };
++ /* Holds the empty requests for TX/RX
++ * out of order completions
++ */
++ u16 *free_ids;
+
+ union {
+ struct ena_tx_buffer *tx_buffer_info;
diff --git a/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch b/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
new file mode 100644
index 0000000000..69ef54bfb9
--- /dev/null
+++ b/patches.drivers/net-ena-update-driver-version-from-2.0.3-to-2.1.0.patch
@@ -0,0 +1,30 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Tue, 11 Jun 2019 14:58:11 +0300
+Subject: net: ena: update driver version from 2.0.3 to 2.1.0
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: dbbc6e6877768a03092751edf89d012d561b4553
+References: bsc#1138879
+
+Update driver version to match device specification.
+
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h
+@@ -44,8 +44,8 @@
+ #include "ena_eth_com.h"
+
+ #define DRV_MODULE_VER_MAJOR 2
+-#define DRV_MODULE_VER_MINOR 0
+-#define DRV_MODULE_VER_SUBMINOR 3
++#define DRV_MODULE_VER_MINOR 1
++#define DRV_MODULE_VER_SUBMINOR 0
+
+ #define DRV_MODULE_NAME "ena"
+ #ifndef DRV_MODULE_VERSION
diff --git a/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch b/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch
new file mode 100644
index 0000000000..53e9bc09c2
--- /dev/null
+++ b/patches.drivers/net-ena-use-dev_info_once-instead-of-static-variable.patch
@@ -0,0 +1,35 @@
+From: Sameeh Jubran <sameehj@amazon.com>
+Date: Mon, 3 Jun 2019 17:43:29 +0300
+Subject: net: ena: use dev_info_once instead of static variable
+Patch-mainline: Queued in subsystem maintainer repository
+Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
+Git-commit: 1e9c3fbad83a70e0b00806df3f4dd2db0bc04cc4
+References: bsc#1138879
+
+Signed-off-by: Sameeh Jubran <sameehj@amazon.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/amazon/ena/ena_netdev.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -3289,7 +3289,6 @@ static int ena_probe(struct pci_dev *pde
+ struct ena_llq_configurations llq_config;
+ struct ena_com_dev *ena_dev = NULL;
+ struct ena_adapter *adapter;
+- static int version_printed;
+ int io_queue_num, bars, rc;
+ struct net_device *netdev;
+ static int adapters_found;
+@@ -3301,8 +3300,7 @@ static int ena_probe(struct pci_dev *pde
+
+ dev_dbg(&pdev->dev, "%s\n", __func__);
+
+- if (version_printed++ == 0)
+- dev_info(&pdev->dev, "%s", version);
++ dev_info_once(&pdev->dev, "%s", version);
+
+ rc = pci_enable_device_mem(pdev);
+ if (rc) {
diff --git a/patches.drivers/net-ethernet-ti-cpsw_ethtool-fix-ethtool-ring-param-.patch b/patches.drivers/net-ethernet-ti-cpsw_ethtool-fix-ethtool-ring-param-.patch
new file mode 100644
index 0000000000..678b2ad321
--- /dev/null
+++ b/patches.drivers/net-ethernet-ti-cpsw_ethtool-fix-ethtool-ring-param-.patch
@@ -0,0 +1,31 @@
+From: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Date: Fri, 31 May 2019 16:47:25 +0300
+Subject: net: ethernet: ti: cpsw_ethtool: fix ethtool ring param set
+Patch-mainline: v5.2-rc4
+Git-commit: 09faf5a7d7c0bcb07faba072f611937af9dd5788
+References: bsc#1130836
+
+Fix ability to set RX descriptor number, the reason - initially
+"tx_max_pending" was set incorrectly, but the issue appears after
+adding sanity check, so fix is for "sanity" patch.
+
+Fixes: 37e2d99b59c476 ("ethtool: Ensure new ring parameters are within bounds during SRINGPARAM")
+Signed-off-by: Ivan Khoronzhuk <ivan.khoronzhuk@linaro.org>
+Reviewed-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/ti/cpsw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -2520,7 +2520,7 @@ static void cpsw_get_ringparam(struct ne
+ struct cpsw_common *cpsw = priv->cpsw;
+
+ /* not supported */
+- ering->tx_max_pending = 0;
++ ering->tx_max_pending = descs_pool_size - CPSW_MAX_QUEUES;
+ ering->tx_pending = cpdma_get_num_tx_descs(cpsw->dma);
+ ering->rx_max_pending = descs_pool_size - CPSW_MAX_QUEUES;
+ ering->rx_pending = cpdma_get_num_rx_descs(cpsw->dma);
diff --git a/patches.drivers/net-mlx5-Avoid-reloading-already-removed-devices.patch b/patches.drivers/net-mlx5-Avoid-reloading-already-removed-devices.patch
new file mode 100644
index 0000000000..d8bb05b899
--- /dev/null
+++ b/patches.drivers/net-mlx5-Avoid-reloading-already-removed-devices.patch
@@ -0,0 +1,61 @@
+From: Alaa Hleihel <alaa@mellanox.com>
+Date: Sun, 19 May 2019 11:11:49 +0300
+Subject: net/mlx5: Avoid reloading already removed devices
+Patch-mainline: v5.2-rc6
+Git-commit: dd80857bf388abd0c64dd3aa4fbf7d407deba819
+References: bsc#1103990 FATE#326006
+
+Prior to reloading a device we must first verify that it was not already
+removed. Otherwise, the attempt to remove the device will do nothing, and
+in that case we will end up proceeding with adding an new device that no
+one was expecting to remove, leaving behind used resources such as EQs that
+causes a failure to destroy comp EQs and syndrome (0x30f433).
+
+Fix that by making sure that we try to remove and add a device (based on a
+protocol) only if the device is already added.
+
+Fixes: c5447c70594b ("net/mlx5: E-Switch, Reload IB interface when switching devlink modes")
+Signed-off-by: Alaa Hleihel <alaa@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/dev.c | 25 +++++++++++++++++++++++--
+ 1 file changed, 23 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+@@ -342,11 +342,32 @@ void mlx5_unregister_interface(struct ml
+ }
+ EXPORT_SYMBOL(mlx5_unregister_interface);
+
++/* Must be called with intf_mutex held */
++static bool mlx5_has_added_dev_by_protocol(struct mlx5_core_dev *mdev, int protocol)
++{
++ struct mlx5_device_context *dev_ctx;
++ struct mlx5_interface *intf;
++ bool found = false;
++
++ list_for_each_entry(intf, &intf_list, list) {
++ if (intf->protocol == protocol) {
++ dev_ctx = mlx5_get_device(intf, &mdev->priv);
++ if (dev_ctx && test_bit(MLX5_INTERFACE_ADDED, &dev_ctx->state))
++ found = true;
++ break;
++ }
++ }
++
++ return found;
++}
++
+ void mlx5_reload_interface(struct mlx5_core_dev *mdev, int protocol)
+ {
+ mutex_lock(&mlx5_intf_mutex);
+- mlx5_remove_dev_by_protocol(mdev, protocol);
+- mlx5_add_dev_by_protocol(mdev, protocol);
++ if (mlx5_has_added_dev_by_protocol(mdev, protocol)) {
++ mlx5_remove_dev_by_protocol(mdev, protocol);
++ mlx5_add_dev_by_protocol(mdev, protocol);
++ }
+ mutex_unlock(&mlx5_intf_mutex);
+ }
+
diff --git a/patches.drivers/net-mlx5-FPGA-tls-hold-rcu-read-lock-a-bit-longer.patch b/patches.drivers/net-mlx5-FPGA-tls-hold-rcu-read-lock-a-bit-longer.patch
new file mode 100644
index 0000000000..d6259d16b0
--- /dev/null
+++ b/patches.drivers/net-mlx5-FPGA-tls-hold-rcu-read-lock-a-bit-longer.patch
@@ -0,0 +1,52 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Tue, 19 Mar 2019 22:09:05 -0700
+Subject: net/mlx5: FPGA, tls, hold rcu read lock a bit longer
+Patch-mainline: v5.1-rc6
+Git-commit: 31634bf5dcc418b5b2cacd954394c0c4620db6a2
+References: bsc#1103990 FATE#326006
+
+To avoid use-after-free, hold the rcu read lock until we are done copying
+flow data into the command buffer.
+
+Fixes: ab412e1dd7db ("net/mlx5: Accel, add TLS rx offload routines")
+Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+@@ -217,22 +217,22 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_
+ void *cmd;
+ int ret;
+
+- rcu_read_lock();
+- flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
+- rcu_read_unlock();
+-
+- if (!flow) {
+- WARN_ONCE(1, "Received NULL pointer for handle\n");
+- return -EINVAL;
+- }
+-
+ buf = kzalloc(size, GFP_ATOMIC);
+ if (!buf)
+ return -ENOMEM;
+
+ cmd = (buf + 1);
+
++ rcu_read_lock();
++ flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));
++ if (unlikely(!flow)) {
++ rcu_read_unlock();
++ WARN_ONCE(1, "Received NULL pointer for handle\n");
++ kfree(buf);
++ return -EINVAL;
++ }
+ mlx5_fpga_tls_flow_to_cmd(flow, cmd);
++ rcu_read_unlock();
+
+ MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));
+ MLX5_SET64(tls_cmd, cmd, tls_rcd_sn, be64_to_cpu(rcd_sn));
diff --git a/patches.drivers/net-mlx5-FPGA-tls-idr-remove-on-flow-delete.patch b/patches.drivers/net-mlx5-FPGA-tls-idr-remove-on-flow-delete.patch
new file mode 100644
index 0000000000..d239a18561
--- /dev/null
+++ b/patches.drivers/net-mlx5-FPGA-tls-idr-remove-on-flow-delete.patch
@@ -0,0 +1,137 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Tue, 19 Mar 2019 01:05:41 -0700
+Subject: net/mlx5: FPGA, tls, idr remove on flow delete
+Patch-mainline: v5.1-rc6
+Git-commit: df3a8344d404a810b4aadbf19b08c8232fbaa715
+References: bsc#1103990 FATE#326006
+
+Flow is kfreed on mlx5_fpga_tls_del_flow but kept in the idr data
+structure, this is risky and can cause use-after-free, since the
+idr_remove is delayed until tls_send_teardown_cmd completion.
+
+Instead of delaying idr_remove, in this patch we do it on
+mlx5_fpga_tls_del_flow, before actually kfree(flow).
+
+Added synchronize_rcu before kfree(flow)
+
+Fixes: ab412e1dd7db ("net/mlx5: Accel, add TLS rx offload routines")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c | 43 +++++++--------------
+ 1 file changed, 15 insertions(+), 28 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c
+@@ -148,14 +148,16 @@ static int mlx5_fpga_tls_alloc_swid(stru
+ return ret;
+ }
+
+-static void mlx5_fpga_tls_release_swid(struct idr *idr,
+- spinlock_t *idr_spinlock, u32 swid)
++static void *mlx5_fpga_tls_release_swid(struct idr *idr,
++ spinlock_t *idr_spinlock, u32 swid)
+ {
+ unsigned long flags;
++ void *ptr;
+
+ spin_lock_irqsave(idr_spinlock, flags);
+- idr_remove(idr, swid);
++ ptr = idr_remove(idr, swid);
+ spin_unlock_irqrestore(idr_spinlock, flags);
++ return ptr;
+ }
+
+ static void mlx_tls_kfree_complete(struct mlx5_fpga_conn *conn,
+@@ -165,20 +167,12 @@ static void mlx_tls_kfree_complete(struc
+ kfree(buf);
+ }
+
+-struct mlx5_teardown_stream_context {
+- struct mlx5_fpga_tls_command_context cmd;
+- u32 swid;
+-};
+-
+ static void
+ mlx5_fpga_tls_teardown_completion(struct mlx5_fpga_conn *conn,
+ struct mlx5_fpga_device *fdev,
+ struct mlx5_fpga_tls_command_context *cmd,
+ struct mlx5_fpga_dma_buf *resp)
+ {
+- struct mlx5_teardown_stream_context *ctx =
+- container_of(cmd, struct mlx5_teardown_stream_context, cmd);
+-
+ if (resp) {
+ u32 syndrome = MLX5_GET(tls_resp, resp->sg[0].data, syndrome);
+
+@@ -186,14 +180,6 @@ mlx5_fpga_tls_teardown_completion(struct
+ mlx5_fpga_err(fdev,
+ "Teardown stream failed with syndrome = %d",
+ syndrome);
+- else if (MLX5_GET(tls_cmd, cmd->buf.sg[0].data, direction_sx))
+- mlx5_fpga_tls_release_swid(&fdev->tls->tx_idr,
+- &fdev->tls->tx_idr_spinlock,
+- ctx->swid);
+- else
+- mlx5_fpga_tls_release_swid(&fdev->tls->rx_idr,
+- &fdev->tls->rx_idr_spinlock,
+- ctx->swid);
+ }
+ mlx5_fpga_tls_put_command_ctx(cmd);
+ }
+@@ -253,7 +239,7 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_
+ static void mlx5_fpga_tls_send_teardown_cmd(struct mlx5_core_dev *mdev,
+ void *flow, u32 swid, gfp_t flags)
+ {
+- struct mlx5_teardown_stream_context *ctx;
++ struct mlx5_fpga_tls_command_context *ctx;
+ struct mlx5_fpga_dma_buf *buf;
+ void *cmd;
+
+@@ -261,7 +247,7 @@ static void mlx5_fpga_tls_send_teardown_
+ if (!ctx)
+ return;
+
+- buf = &ctx->cmd.buf;
++ buf = &ctx->buf;
+ cmd = (ctx + 1);
+ MLX5_SET(tls_cmd, cmd, command_type, CMD_TEARDOWN_STREAM);
+ MLX5_SET(tls_cmd, cmd, swid, swid);
+@@ -272,8 +258,7 @@ static void mlx5_fpga_tls_send_teardown_
+ buf->sg[0].data = cmd;
+ buf->sg[0].size = MLX5_TLS_COMMAND_SIZE;
+
+- ctx->swid = swid;
+- mlx5_fpga_tls_cmd_send(mdev->fpga, &ctx->cmd,
++ mlx5_fpga_tls_cmd_send(mdev->fpga, ctx,
+ mlx5_fpga_tls_teardown_completion);
+ }
+
+@@ -283,13 +268,14 @@ void mlx5_fpga_tls_del_flow(struct mlx5_
+ struct mlx5_fpga_tls *tls = mdev->fpga->tls;
+ void *flow;
+
+- rcu_read_lock();
+ if (direction_sx)
+- flow = idr_find(&tls->tx_idr, swid);
++ flow = mlx5_fpga_tls_release_swid(&tls->tx_idr,
++ &tls->tx_idr_spinlock,
++ swid);
+ else
+- flow = idr_find(&tls->rx_idr, swid);
+-
+- rcu_read_unlock();
++ flow = mlx5_fpga_tls_release_swid(&tls->rx_idr,
++ &tls->rx_idr_spinlock,
++ swid);
+
+ if (!flow) {
+ mlx5_fpga_err(mdev->fpga, "No flow information for swid %u\n",
+@@ -297,6 +283,7 @@ void mlx5_fpga_tls_del_flow(struct mlx5_
+ return;
+ }
+
++ synchronize_rcu(); /* before kfree(flow) */
+ mlx5_fpga_tls_send_teardown_cmd(mdev, flow, swid, flags);
+ }
+
diff --git a/patches.drivers/net-mlx5-Set-completion-EQs-as-shared-resources.patch b/patches.drivers/net-mlx5-Set-completion-EQs-as-shared-resources.patch
new file mode 100644
index 0000000000..2814212fe7
--- /dev/null
+++ b/patches.drivers/net-mlx5-Set-completion-EQs-as-shared-resources.patch
@@ -0,0 +1,44 @@
+From: Yishai Hadas <yishaih@mellanox.com>
+Date: Tue, 14 May 2019 14:44:12 +0300
+Subject: net/mlx5: Set completion EQs as shared resources
+Patch-mainline: v5.2-rc1
+Git-commit: c191f93454bcc92810b9c8cdb895a452a57948c2
+References: bsc#1103991 FATE#326007
+
+Mark completion EQs as shared resources so that they can be used by CQs
+with uid != 0.
+
+Fixes: 7efce3691d33 ("IB/mlx5: Add obj create and destroy functionality")
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eq.c | 3 +++
+ include/linux/mlx5/mlx5_ifc.h | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+@@ -692,6 +692,9 @@ int mlx5_create_map_eq(struct mlx5_core_
+ mlx5_fill_page_array(&eq->buf, pas);
+
+ MLX5_SET(create_eq_in, in, opcode, MLX5_CMD_OP_CREATE_EQ);
++ if (!mask && MLX5_CAP_GEN(dev, log_max_uctx))
++ MLX5_SET(create_eq_in, in, uid, MLX5_SHARED_RESOURCE_UID);
++
+ MLX5_SET64(create_eq_in, in, event_bitmask, mask);
+
+ eqc = MLX5_ADDR_OF(create_eq_in, in, eq_context_entry);
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -7154,7 +7154,7 @@ struct mlx5_ifc_create_eq_out_bits {
+
+ struct mlx5_ifc_create_eq_in_bits {
+ u8 opcode[0x10];
+- u8 reserved_at_10[0x10];
++ u8 uid[0x10];
+
+ u8 reserved_at_20[0x10];
+ u8 op_mod[0x10];
diff --git a/patches.drivers/net-mlx5-Update-pci-error-handler-entries-and-comman.patch b/patches.drivers/net-mlx5-Update-pci-error-handler-entries-and-comman.patch
new file mode 100644
index 0000000000..f872631362
--- /dev/null
+++ b/patches.drivers/net-mlx5-Update-pci-error-handler-entries-and-comman.patch
@@ -0,0 +1,46 @@
+From: Edward Srouji <edwards@mellanox.com>
+Date: Thu, 23 May 2019 19:45:38 +0300
+Subject: net/mlx5: Update pci error handler entries and command translation
+Patch-mainline: v5.2-rc6
+Git-commit: 6a6fabbfa3e8c656ff906ae999fb6856410fa4cd
+References: bsc#1103991 FATE#326007
+
+Add missing entries for create/destroy UCTX and UMEM commands.
+This could get us wrong "unknown FW command" error in flows
+where we unbind the device or reset the driver.
+
+Also the translation of these commands from opcodes to string
+was missing.
+
+Fixes: 6e3722baac04 ("IB/mlx5: Use the correct commands for UMEM and UCTX allocation")
+Signed-off-by: Edward Srouji <edwards@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -436,6 +436,10 @@ static int mlx5_internal_err_ret_value(s
+ case MLX5_CMD_OP_CREATE_GENERAL_OBJECT:
+ case MLX5_CMD_OP_MODIFY_GENERAL_OBJECT:
+ case MLX5_CMD_OP_QUERY_GENERAL_OBJECT:
++ case MLX5_CMD_OP_CREATE_UCTX:
++ case MLX5_CMD_OP_DESTROY_UCTX:
++ case MLX5_CMD_OP_CREATE_UMEM:
++ case MLX5_CMD_OP_DESTROY_UMEM:
+ case MLX5_CMD_OP_ALLOC_MEMIC:
+ *status = MLX5_DRIVER_STATUS_ABORTED;
+ *synd = MLX5_DRIVER_SYND;
+@@ -621,6 +625,10 @@ const char *mlx5_command_str(int command
+ MLX5_COMMAND_STR_CASE(QUERY_MODIFY_HEADER_CONTEXT);
+ MLX5_COMMAND_STR_CASE(ALLOC_MEMIC);
+ MLX5_COMMAND_STR_CASE(DEALLOC_MEMIC);
++ MLX5_COMMAND_STR_CASE(CREATE_UCTX);
++ MLX5_COMMAND_STR_CASE(DESTROY_UCTX);
++ MLX5_COMMAND_STR_CASE(CREATE_UMEM);
++ MLX5_COMMAND_STR_CASE(DESTROY_UMEM);
+ default: return "unknown command opcode";
+ }
+ }
diff --git a/patches.drivers/net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG_MLX5.patch b/patches.drivers/net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG_MLX5.patch
new file mode 100644
index 0000000000..50fb9f5ef5
--- /dev/null
+++ b/patches.drivers/net-mlx5e-Fix-ethtool-rxfh-commands-when-CONFIG_MLX5.patch
@@ -0,0 +1,57 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Tue, 7 May 2019 12:59:38 -0700
+Subject: net/mlx5e: Fix ethtool rxfh commands when CONFIG_MLX5_EN_RXNFC is
+ disabled
+Patch-mainline: v5.2-rc2
+Git-commit: 8f0916c6dc5cd5e3bc52416fa2a9ff4075080180
+References: bsc#1103990 FATE#326006
+
+ethtool user spaces needs to know ring count via ETHTOOL_GRXRINGS when
+executing (ethtool -x) which is retrieved via ethtool get_rxnfc callback,
+in mlx5 this callback is disabled when CONFIG_MLX5_EN_RXNFC=n.
+
+This patch allows only ETHTOOL_GRXRINGS command on mlx5e_get_rxnfc() when
+CONFIG_MLX5_EN_RXNFC is disabled, so ethtool -x will continue working.
+
+Fixes: fe6d86b3c316 ("net/mlx5e: Add CONFIG_MLX5_EN_RXNFC for ethtool rx nfc")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 18 +++++++++++++++++-
+ 1 file changed, 17 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -1780,6 +1780,22 @@ static int mlx5e_flash_device(struct net
+ return mlx5e_ethtool_flash_device(priv, flash);
+ }
+
++#ifndef CONFIG_MLX5_EN_RXNFC
++/* When CONFIG_MLX5_EN_RXNFC=n we only support ETHTOOL_GRXRINGS
++ * otherwise this function will be defined from en_fs_ethtool.c
++ */
++static int mlx5e_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info, u32 *rule_locs)
++{
++ struct mlx5e_priv *priv = netdev_priv(dev);
++
++ if (info->cmd != ETHTOOL_GRXRINGS)
++ return -EOPNOTSUPP;
++ /* ring_count is needed by ethtool -x */
++ info->data = priv->channels.params.num_channels;
++ return 0;
++}
++#endif
++
+ const struct ethtool_ops mlx5e_ethtool_ops = {
+ .get_drvinfo = mlx5e_get_drvinfo,
+ .get_link = ethtool_op_get_link,
+@@ -1798,8 +1814,8 @@ const struct ethtool_ops mlx5e_ethtool_o
+ .get_rxfh_indir_size = mlx5e_get_rxfh_indir_size,
+ .get_rxfh = mlx5e_get_rxfh,
+ .set_rxfh = mlx5e_set_rxfh,
+-#ifdef CONFIG_MLX5_EN_RXNFC
+ .get_rxnfc = mlx5e_get_rxnfc,
++#ifdef CONFIG_MLX5_EN_RXNFC
+ .set_rxnfc = mlx5e_set_rxnfc,
+ #endif
+ .flash_device = mlx5e_flash_device,
diff --git a/patches.drivers/net-mlx5e-Fix-the-max-MTU-check-in-case-of-XDP.patch b/patches.drivers/net-mlx5e-Fix-the-max-MTU-check-in-case-of-XDP.patch
new file mode 100644
index 0000000000..978d647243
--- /dev/null
+++ b/patches.drivers/net-mlx5e-Fix-the-max-MTU-check-in-case-of-XDP.patch
@@ -0,0 +1,88 @@
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+Date: Mon, 8 Apr 2019 15:12:45 +0300
+Subject: net/mlx5e: Fix the max MTU check in case of XDP
+Patch-mainline: v5.1-rc7
+Git-commit: d460c2718906252a2a69bc6f89b537071f792e6e
+References: bsc#1103990 FATE#326006
+
+MLX5E_XDP_MAX_MTU was calculated incorrectly. It didn't account for
+NET_IP_ALIGN and MLX5E_HW2SW_MTU, and it also misused MLX5_SKB_FRAG_SZ.
+This commit fixes the calculations and adds a brief explanation for the
+formula used.
+
+Fixes: a26a5bdf3ee2d ("net/mlx5e: Restrict the combination of large MTU and XDP")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 20 ++++++++++++++++++++
+ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 3 +--
+ drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++--
+ 3 files changed, 24 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+@@ -33,6 +33,26 @@
+ #include <linux/bpf_trace.h>
+ #include "en/xdp.h"
+
++int mlx5e_xdp_max_mtu(struct mlx5e_params *params)
++{
++ int hr = NET_IP_ALIGN + XDP_PACKET_HEADROOM;
++
++ /* Let S := SKB_DATA_ALIGN(sizeof(struct skb_shared_info)).
++ * The condition checked in mlx5e_rx_is_linear_skb is:
++ * SKB_DATA_ALIGN(sw_mtu + hard_mtu + hr) + S <= PAGE_SIZE (1)
++ * (Note that hw_mtu == sw_mtu + hard_mtu.)
++ * What is returned from this function is:
++ * max_mtu = PAGE_SIZE - S - hr - hard_mtu (2)
++ * After assigning sw_mtu := max_mtu, the left side of (1) turns to
++ * SKB_DATA_ALIGN(PAGE_SIZE - S) + S, which is equal to PAGE_SIZE,
++ * because both PAGE_SIZE and S are already aligned. Any number greater
++ * than max_mtu would make the left side of (1) greater than PAGE_SIZE,
++ * so max_mtu is the maximum MTU allowed.
++ */
++
++ return MLX5E_HW2SW_MTU(params, SKB_MAX_HEAD(hr));
++}
++
+ static inline bool
+ mlx5e_xmit_xdp_buff(struct mlx5e_xdpsq *sq, struct mlx5e_dma_info *di,
+ struct xdp_buff *xdp)
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h
+@@ -34,12 +34,11 @@
+
+ #include "en.h"
+
+-#define MLX5E_XDP_MAX_MTU ((int)(PAGE_SIZE - \
+- MLX5_SKB_FRAG_SZ(XDP_PACKET_HEADROOM)))
+ #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)
+ #define MLX5E_XDP_TX_DS_COUNT \
+ ((sizeof(struct mlx5e_tx_wqe) / MLX5_SEND_WQE_DS) + 1 /* SG DS */)
+
++int mlx5e_xdp_max_mtu(struct mlx5e_params *params);
+ bool mlx5e_xdp_handle(struct mlx5e_rq *rq, struct mlx5e_dma_info *di,
+ void *va, u16 *rx_headroom, u32 *len);
+ bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq *cq);
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+@@ -3785,7 +3785,7 @@ int mlx5e_change_mtu(struct net_device *
+ if (params->xdp_prog &&
+ !mlx5e_rx_is_linear_skb(priv->mdev, &new_channels.params)) {
+ netdev_err(netdev, "MTU(%d) > %d is not allowed while XDP enabled\n",
+- new_mtu, MLX5E_XDP_MAX_MTU);
++ new_mtu, mlx5e_xdp_max_mtu(params));
+ err = -EINVAL;
+ goto out;
+ }
+@@ -4251,7 +4251,8 @@ static int mlx5e_xdp_allowed(struct mlx5
+
+ if (!mlx5e_rx_is_linear_skb(priv->mdev, &new_channels.params)) {
+ netdev_warn(netdev, "XDP is not allowed with MTU(%d) > %d\n",
+- new_channels.params.sw_mtu, MLX5E_XDP_MAX_MTU);
++ new_channels.params.sw_mtu,
++ mlx5e_xdp_max_mtu(&new_channels.params));
+ return -EINVAL;
+ }
+
diff --git a/patches.drivers/net-mlx5e-Fix-use-after-free-after-xdp_return_frame.patch b/patches.drivers/net-mlx5e-Fix-use-after-free-after-xdp_return_frame.patch
new file mode 100644
index 0000000000..36c73991a6
--- /dev/null
+++ b/patches.drivers/net-mlx5e-Fix-use-after-free-after-xdp_return_frame.patch
@@ -0,0 +1,44 @@
+From: Maxim Mikityanskiy <maximmi@mellanox.com>
+Date: Fri, 15 Mar 2019 16:41:43 +0200
+Subject: net/mlx5e: Fix use-after-free after xdp_return_frame
+Patch-mainline: v5.1-rc7
+Git-commit: 12fc512f5741443a03adde2ead20724da8ad550a
+References: bsc#1103990 FATE#326006
+
+xdp_return_frame releases the frame. It leads to releasing the page, so
+it's not allowed to access xdpi.xdpf->len after that, because xdpi.xdpf
+is at xdp->data_hard_start after convert_to_xdp_frame. This patch moves
+the memory access to precede the return of the frame.
+
+Fixes: 58b99ee3e3ebe ("net/mlx5e: Add support for XDP_REDIRECT in device-out side")
+Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+@@ -207,9 +207,9 @@ bool mlx5e_poll_xdpsq_cq(struct mlx5e_cq
+ sqcc++;
+
+ if (is_redirect) {
+- xdp_return_frame(xdpi->xdpf);
+ dma_unmap_single(sq->pdev, xdpi->dma_addr,
+ xdpi->xdpf->len, DMA_TO_DEVICE);
++ xdp_return_frame(xdpi->xdpf);
+ } else {
+ /* Recycle RX page */
+ mlx5e_page_release(rq, &xdpi->di, true);
+@@ -243,9 +243,9 @@ void mlx5e_free_xdpsq_descs(struct mlx5e
+ sq->cc++;
+
+ if (is_redirect) {
+- xdp_return_frame(xdpi->xdpf);
+ dma_unmap_single(sq->pdev, xdpi->dma_addr,
+ xdpi->xdpf->len, DMA_TO_DEVICE);
++ xdp_return_frame(xdpi->xdpf);
+ } else {
+ /* Recycle RX page */
+ mlx5e_page_release(rq, &xdpi->di, false);
diff --git a/patches.drivers/net-mlx5e-Rx-Check-ip-headers-sanity.patch b/patches.drivers/net-mlx5e-Rx-Check-ip-headers-sanity.patch
new file mode 100644
index 0000000000..4b8e6c7777
--- /dev/null
+++ b/patches.drivers/net-mlx5e-Rx-Check-ip-headers-sanity.patch
@@ -0,0 +1,43 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Mon, 25 Mar 2019 22:10:59 -0700
+Subject: net/mlx5e: Rx, Check ip headers sanity
+Patch-mainline: v5.1-rc6
+Git-commit: 0318a7b7fcad9765931146efa7ca3a034194737c
+References: bsc#1103990 FATE#326006
+
+In the two places is_last_ethertype_ip is being called, the caller will
+be looking inside the ip header, to be safe, add ip{4,6} header sanity
+check. And return true only on valid ip headers, i.e: the whole header
+is contained in the linear part of the skb.
+
+Note: Such situation is very rare and hard to reproduce, since mlx5e
+allocates a large enough headroom to contain the largest header one can
+imagine.
+
+Fixes: fe1dc069990c ("net/mlx5e: don't set CHECKSUM_COMPLETE on SCTP packets")
+Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -693,7 +693,14 @@ static inline bool is_last_ethertype_ip(
+ {
+ *proto = ((struct ethhdr *)skb->data)->h_proto;
+ *proto = __vlan_get_protocol(skb, *proto, network_depth);
+- return (*proto == htons(ETH_P_IP) || *proto == htons(ETH_P_IPV6));
++
++ if (*proto == htons(ETH_P_IP))
++ return pskb_may_pull(skb, *network_depth + sizeof(struct iphdr));
++
++ if (*proto == htons(ETH_P_IPV6))
++ return pskb_may_pull(skb, *network_depth + sizeof(struct ipv6hdr));
++
++ return false;
+ }
+
+ static inline void mlx5e_enable_ecn(struct mlx5e_rq *rq, struct sk_buff *skb)
diff --git a/patches.drivers/net-mlx5e-Rx-Fixup-skb-checksum-for-packets-with-tai.patch b/patches.drivers/net-mlx5e-Rx-Fixup-skb-checksum-for-packets-with-tai.patch
new file mode 100644
index 0000000000..cc9af64df4
--- /dev/null
+++ b/patches.drivers/net-mlx5e-Rx-Fixup-skb-checksum-for-packets-with-tai.patch
@@ -0,0 +1,181 @@
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Tue, 12 Mar 2019 00:24:52 -0700
+Subject: net/mlx5e: Rx, Fixup skb checksum for packets with tail padding
+Patch-mainline: v5.1-rc6
+Git-commit: 0aa1d18615c163f92935b806dcaff9157645233a
+References: bsc#1109837
+
+When an ethernet frame with ip payload is padded, the padding octets are
+not covered by the hardware checksum.
+
+Prior to the cited commit, skb checksum was forced to be CHECKSUM_NONE
+when padding is detected. After it, the kernel will try to trim the
+padding bytes and subtract their checksum from skb->csum.
+
+In this patch we fixup skb->csum for any ip packet with tail padding of
+any size, if any padding found.
+FCS case is just one special case of this general purpose patch, hence,
+it is removed.
+
+Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends"),
+Cc: Eric Dumazet <edumazet@google.com>
+Reviewed-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 79 +++++++++++++++++----
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 6 +
+ drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 4 +
+ 3 files changed, 74 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+@@ -713,17 +713,6 @@ static inline void mlx5e_enable_ecn(stru
+ rq->stats->ecn_mark += !!rc;
+ }
+
+-static u32 mlx5e_get_fcs(const struct sk_buff *skb)
+-{
+- const void *fcs_bytes;
+- u32 _fcs_bytes;
+-
+- fcs_bytes = skb_header_pointer(skb, skb->len - ETH_FCS_LEN,
+- ETH_FCS_LEN, &_fcs_bytes);
+-
+- return __get_unaligned_cpu32(fcs_bytes);
+-}
+-
+ static u8 get_ip_proto(struct sk_buff *skb, int network_depth, __be16 proto)
+ {
+ void *ip_p = skb->data + network_depth;
+@@ -734,6 +723,68 @@ static u8 get_ip_proto(struct sk_buff *s
+
+ #define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
+
++#define MAX_PADDING 8
++
++static void
++tail_padding_csum_slow(struct sk_buff *skb, int offset, int len,
++ struct mlx5e_rq_stats *stats)
++{
++ stats->csum_complete_tail_slow++;
++ skb->csum = csum_block_add(skb->csum,
++ skb_checksum(skb, offset, len, 0),
++ offset);
++}
++
++static void
++tail_padding_csum(struct sk_buff *skb, int offset,
++ struct mlx5e_rq_stats *stats)
++{
++ u8 tail_padding[MAX_PADDING];
++ int len = skb->len - offset;
++ void *tail;
++
++ if (unlikely(len > MAX_PADDING)) {
++ tail_padding_csum_slow(skb, offset, len, stats);
++ return;
++ }
++
++ tail = skb_header_pointer(skb, offset, len, tail_padding);
++ if (unlikely(!tail)) {
++ tail_padding_csum_slow(skb, offset, len, stats);
++ return;
++ }
++
++ stats->csum_complete_tail++;
++ skb->csum = csum_block_add(skb->csum, csum_partial(tail, len, 0), offset);
++}
++
++static void
++mlx5e_skb_padding_csum(struct sk_buff *skb, int network_depth, __be16 proto,
++ struct mlx5e_rq_stats *stats)
++{
++ struct ipv6hdr *ip6;
++ struct iphdr *ip4;
++ int pkt_len;
++
++ switch (proto) {
++ case htons(ETH_P_IP):
++ ip4 = (struct iphdr *)(skb->data + network_depth);
++ pkt_len = network_depth + ntohs(ip4->tot_len);
++ break;
++ case htons(ETH_P_IPV6):
++ ip6 = (struct ipv6hdr *)(skb->data + network_depth);
++ pkt_len = network_depth + sizeof(*ip6) + ntohs(ip6->payload_len);
++ break;
++ default:
++ return;
++ }
++
++ if (likely(pkt_len >= skb->len))
++ return;
++
++ tail_padding_csum(skb, pkt_len, stats);
++}
++
+ static inline void mlx5e_handle_csum(struct net_device *netdev,
+ struct mlx5_cqe64 *cqe,
+ struct mlx5e_rq *rq,
+@@ -781,10 +832,8 @@ static inline void mlx5e_handle_csum(str
+ skb->csum = csum_partial(skb->data + ETH_HLEN,
+ network_depth - ETH_HLEN,
+ skb->csum);
+- if (unlikely(netdev->features & NETIF_F_RXFCS))
+- skb->csum = csum_block_add(skb->csum,
+- (__force __wsum)mlx5e_get_fcs(skb),
+- skb->len - ETH_FCS_LEN);
++
++ mlx5e_skb_padding_csum(skb, network_depth, proto, stats);
+ stats->csum_complete++;
+ return;
+ }
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+@@ -58,6 +58,8 @@ static const struct counter_desc sw_stat
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_none) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete) },
++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail) },
++ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_complete_tail_slow) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_csum_unnecessary_inner) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_drop) },
+ { MLX5E_DECLARE_STAT(struct mlx5e_sw_stats, rx_xdp_redirect) },
+@@ -150,6 +152,8 @@ static void mlx5e_grp_sw_update_stats(st
+ s->rx_removed_vlan_packets += rq_stats->removed_vlan_packets;
+ s->rx_csum_none += rq_stats->csum_none;
+ s->rx_csum_complete += rq_stats->csum_complete;
++ s->rx_csum_complete_tail += rq_stats->csum_complete_tail;
++ s->rx_csum_complete_tail_slow += rq_stats->csum_complete_tail_slow;
+ s->rx_csum_unnecessary += rq_stats->csum_unnecessary;
+ s->rx_csum_unnecessary_inner += rq_stats->csum_unnecessary_inner;
+ s->rx_xdp_drop += rq_stats->xdp_drop;
+@@ -1175,6 +1179,8 @@ static const struct counter_desc rq_stat
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, packets) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, bytes) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete) },
++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail) },
++ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_complete_tail_slow) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_unnecessary_inner) },
+ { MLX5E_DECLARE_RX_STAT(struct mlx5e_rq_stats, csum_none) },
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h
+@@ -71,6 +71,8 @@ struct mlx5e_sw_stats {
+ u64 rx_csum_unnecessary;
+ u64 rx_csum_none;
+ u64 rx_csum_complete;
++ u64 rx_csum_complete_tail;
++ u64 rx_csum_complete_tail_slow;
+ u64 rx_csum_unnecessary_inner;
+ u64 rx_xdp_drop;
+ u64 rx_xdp_redirect;
+@@ -181,6 +183,8 @@ struct mlx5e_rq_stats {
+ u64 packets;
+ u64 bytes;
+ u64 csum_complete;
++ u64 csum_complete_tail;
++ u64 csum_complete_tail_slow;
+ u64 csum_unnecessary;
+ u64 csum_unnecessary_inner;
+ u64 csum_none;
diff --git a/patches.drivers/net-mlx5e-XDP-Fix-shifted-flag-index-in-RQ-bitmap.patch b/patches.drivers/net-mlx5e-XDP-Fix-shifted-flag-index-in-RQ-bitmap.patch
new file mode 100644
index 0000000000..6fbf1e18ca
--- /dev/null
+++ b/patches.drivers/net-mlx5e-XDP-Fix-shifted-flag-index-in-RQ-bitmap.patch
@@ -0,0 +1,33 @@
+From: Tariq Toukan <tariqt@mellanox.com>
+Date: Sun, 10 Mar 2019 15:29:13 +0200
+Subject: net/mlx5e: XDP, Fix shifted flag index in RQ bitmap
+Patch-mainline: v5.2-rc1
+Git-commit: f03590f74cc280ce5bcfe7aa0729691df79f7718
+References: bsc#1103990 FATE#326006
+
+Values in enum mlx5e_rq_flag are used as bit indixes.
+Intention was to use them with no BIT(i) wrapping.
+
+No functional bug fix here, as the same (shifted)flag bit
+is used for all set, test, and clear operations.
+
+Fixes: 121e89275471 ("net/mlx5e: Refactor RQ XDP_TX indication")
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Reviewed-by: Shay Agroskin <shayag@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -514,7 +514,7 @@ typedef bool (*mlx5e_fp_post_rx_wqes)(st
+ typedef void (*mlx5e_fp_dealloc_wqe)(struct mlx5e_rq*, u16);
+
+ enum mlx5e_rq_flag {
+- MLX5E_RQ_FLAG_XDP_XMIT = BIT(0),
++ MLX5E_RQ_FLAG_XDP_XMIT,
+ };
+
+ struct mlx5e_rq_frag_info {
diff --git a/patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch b/patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch
new file mode 100644
index 0000000000..93442d3057
--- /dev/null
+++ b/patches.drivers/net-mvpp2-Use-strscpy-to-handle-stat-strings.patch
@@ -0,0 +1,32 @@
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Thu, 6 Jun 2019 10:42:56 +0200
+Subject: net: mvpp2: Use strscpy to handle stat strings
+Patch-mainline: v5.2-rc4
+Git-commit: d37acd5aa99c57505b64913e0e2624ec3daed8c5
+References: bsc#1098633
+
+Use a safe strscpy call to copy the ethtool stat strings into the
+relevant buffers, instead of a memcpy that will be accessing
+out-of-bound data.
+
+Fixes: 118d6298f6f0 ("net: mvpp2: add ethtool GOP statistics")
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -1334,8 +1334,8 @@ static void mvpp2_ethtool_get_strings(st
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(mvpp2_ethtool_regs); i++)
+- memcpy(data + i * ETH_GSTRING_LEN,
+- &mvpp2_ethtool_regs[i].string, ETH_GSTRING_LEN);
++ strscpy(data + i * ETH_GSTRING_LEN,
++ mvpp2_ethtool_regs[i].string, ETH_GSTRING_LEN);
+ }
+ }
+
diff --git a/patches.drivers/net-mvpp2-prs-Fix-parser-range-for-VID-filtering.patch b/patches.drivers/net-mvpp2-prs-Fix-parser-range-for-VID-filtering.patch
new file mode 100644
index 0000000000..87d8cf634e
--- /dev/null
+++ b/patches.drivers/net-mvpp2-prs-Fix-parser-range-for-VID-filtering.patch
@@ -0,0 +1,75 @@
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Tue, 11 Jun 2019 11:51:42 +0200
+Subject: net: mvpp2: prs: Fix parser range for VID filtering
+Patch-mainline: v5.2-rc6
+Git-commit: 46b0090a6636cf34c0e856f15dd03e15ba4cdda6
+References: bsc#1098633
+
+VID filtering is implemented in the Header Parser, with one range of 11
+vids being assigned for each no-loopback port.
+
+Make sure we use the per-port range when looking for existing entries in
+the Parser.
+
+Since we used a global range instead of a per-port one, this causes VIDs
+to be removed from the whitelist from all ports of the same PPv2
+instance.
+
+Fixes: 56beda3db602 ("net: mvpp2: Add hardware offloading for VLAN filtering")
+Suggested-by: Yuri Chipchev <yuric@marvell.com>
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -1905,8 +1905,7 @@ static int mvpp2_prs_ip6_init(struct mvp
+ }
+
+ /* Find tcam entry with matched pair <vid,port> */
+-static int mvpp2_prs_vid_range_find(struct mvpp2 *priv, int pmap, u16 vid,
+- u16 mask)
++static int mvpp2_prs_vid_range_find(struct mvpp2_port *port, u16 vid, u16 mask)
+ {
+ unsigned char byte[2], enable[2];
+ struct mvpp2_prs_entry pe;
+@@ -1914,13 +1913,13 @@ static int mvpp2_prs_vid_range_find(stru
+ int tid;
+
+ /* Go through the all entries with MVPP2_PRS_LU_VID */
+- for (tid = MVPP2_PE_VID_FILT_RANGE_START;
+- tid <= MVPP2_PE_VID_FILT_RANGE_END; tid++) {
+- if (!priv->prs_shadow[tid].valid ||
+- priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
++ for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
++ tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
++ if (!port->priv->prs_shadow[tid].valid ||
++ port->priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
+ continue;
+
+- mvpp2_prs_init_from_hw(priv, &pe, tid);
++ mvpp2_prs_init_from_hw(port->priv, &pe, tid);
+
+ mvpp2_prs_tcam_data_byte_get(&pe, 2, &byte[0], &enable[0]);
+ mvpp2_prs_tcam_data_byte_get(&pe, 3, &byte[1], &enable[1]);
+@@ -1950,7 +1949,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2
+ memset(&pe, 0, sizeof(pe));
+
+ /* Scan TCAM and see if entry with this <vid,port> already exist */
+- tid = mvpp2_prs_vid_range_find(priv, (1 << port->id), vid, mask);
++ tid = mvpp2_prs_vid_range_find(port, vid, mask);
+
+ reg_val = mvpp2_read(priv, MVPP2_MH_REG(port->id));
+ if (reg_val & MVPP2_DSA_EXTENDED)
+@@ -2008,7 +2007,7 @@ void mvpp2_prs_vid_entry_remove(struct m
+ int tid;
+
+ /* Scan TCAM and see if entry with this <vid,port> already exist */
+- tid = mvpp2_prs_vid_range_find(priv, (1 << port->id), vid, 0xfff);
++ tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
+
+ /* No such entry */
+ if (tid < 0)
diff --git a/patches.drivers/net-mvpp2-prs-Use-the-correct-helpers-when-removing-.patch b/patches.drivers/net-mvpp2-prs-Use-the-correct-helpers-when-removing-.patch
new file mode 100644
index 0000000000..fcddf1103e
--- /dev/null
+++ b/patches.drivers/net-mvpp2-prs-Use-the-correct-helpers-when-removing-.patch
@@ -0,0 +1,38 @@
+From: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Date: Tue, 11 Jun 2019 11:51:43 +0200
+Subject: net: mvpp2: prs: Use the correct helpers when removing all VID
+ filters
+Patch-mainline: v5.2-rc6
+Git-commit: 6b7a3430c163455cf8a514d636bda52b04654972
+References: bsc#1098633
+
+When removing all VID filters, the mvpp2_prs_vid_entry_remove would be
+called with the TCAM id incorrectly used as a VID, causing the wrong
+TCAM entries to be invalidated.
+
+Fix this by directly invalidating entries in the VID range.
+
+Fixes: 56beda3db602 ("net: mvpp2: Add hardware offloading for VLAN filtering")
+Suggested-by: Yuri Chipchev <yuric@marvell.com>
+Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -2025,8 +2025,10 @@ void mvpp2_prs_vid_remove_all(struct mvp
+
+ for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
+ tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
+- if (priv->prs_shadow[tid].valid)
+- mvpp2_prs_vid_entry_remove(port, tid);
++ if (priv->prs_shadow[tid].valid) {
++ mvpp2_prs_hw_inv(priv, tid);
++ priv->prs_shadow[tid].valid = false;
++ }
+ }
+ }
+
diff --git a/patches.drivers/net-phy-marvell10g-report-if-the-PHY-fails-to-boot-f.patch b/patches.drivers/net-phy-marvell10g-report-if-the-PHY-fails-to-boot-f.patch
new file mode 100644
index 0000000000..5d7ebc563c
--- /dev/null
+++ b/patches.drivers/net-phy-marvell10g-report-if-the-PHY-fails-to-boot-f.patch
@@ -0,0 +1,50 @@
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Tue, 28 May 2019 10:34:42 +0100
+Subject: net: phy: marvell10g: report if the PHY fails to boot firmware
+Patch-mainline: v5.2-rc3
+Git-commit: 3d3ced2ec5d71b99d72ae6910fbdf890bc2eccf0
+References: bsc#1119113 FATE#326472
+
+Some boards do not have the PHY firmware programmed in the 3310's flash,
+which leads to the PHY not working as expected. Warn the user when the
+PHY fails to boot the firmware and refuse to initialise.
+
+Fixes: 20b2af32ff3f ("net: phy: add Marvell Alaska X 88X3310 10Gigabit PHY support")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Tested-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ drivers/net/phy/marvell10g.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/net/phy/marvell10g.c
++++ b/drivers/net/phy/marvell10g.c
+@@ -29,6 +29,9 @@
+ #define MDIO_AN_10GBT_CTRL_ADV_NBT_MASK 0x01e0
+
+ enum {
++ MV_PMA_BOOT = 0xc050,
++ MV_PMA_BOOT_FATAL = BIT(0),
++
+ MV_PCS_BASE_T = 0x0000,
+ MV_PCS_BASE_R = 0x1000,
+ MV_PCS_1000BASEX = 0x2000,
+@@ -228,6 +231,16 @@ static int mv3310_probe(struct phy_devic
+ (phydev->c45_ids.devices_in_package & mmd_mask) != mmd_mask)
+ return -ENODEV;
+
++ ret = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MV_PMA_BOOT);
++ if (ret < 0)
++ return ret;
++
++ if (ret & MV_PMA_BOOT_FATAL) {
++ dev_warn(&phydev->mdio.dev,
++ "PHY failed to boot firmware, status=%04x\n", ret);
++ return -ENODEV;
++ }
++
+ priv = devm_kzalloc(&phydev->mdio.dev, sizeof(*priv), GFP_KERNEL);
+ if (!priv)
+ return -ENOMEM;
diff --git a/patches.drivers/net-sched-cbs-Fix-error-path-of-cbs_module_init.patch b/patches.drivers/net-sched-cbs-Fix-error-path-of-cbs_module_init.patch
new file mode 100644
index 0000000000..e457f3b202
--- /dev/null
+++ b/patches.drivers/net-sched-cbs-Fix-error-path-of-cbs_module_init.patch
@@ -0,0 +1,41 @@
+From: YueHaibing <yuehaibing@huawei.com>
+Date: Fri, 21 Jun 2019 21:44:37 +0800
+Subject: net/sched: cbs: Fix error path of cbs_module_init
+Patch-mainline: v5.2-rc7
+Git-commit: 45d5cb137c3638b3a310f41b31d8e79daf647f14
+References: bsc#1109837
+
+If register_qdisc fails, we should unregister
+netdevice notifier.
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Fixes: e0a7683d30e9 ("net/sched: cbs: fix port_rate miscalculation")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/sched/sch_cbs.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -553,12 +553,17 @@ static struct notifier_block cbs_device_
+
+ static int __init cbs_module_init(void)
+ {
+- int err = register_netdevice_notifier(&cbs_device_notifier);
++ int err;
+
++ err = register_netdevice_notifier(&cbs_device_notifier);
+ if (err)
+ return err;
+
+- return register_qdisc(&cbs_qdisc_ops);
++ err = register_qdisc(&cbs_qdisc_ops);
++ if (err)
++ unregister_netdevice_notifier(&cbs_device_notifier);
++
++ return err;
+ }
+
+ static void __exit cbs_module_exit(void)
diff --git a/patches.drivers/net-sched-cbs-fix-port_rate-miscalculation.patch b/patches.drivers/net-sched-cbs-fix-port_rate-miscalculation.patch
new file mode 100644
index 0000000000..116a26fab1
--- /dev/null
+++ b/patches.drivers/net-sched-cbs-fix-port_rate-miscalculation.patch
@@ -0,0 +1,220 @@
+From: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
+Date: Mon, 8 Apr 2019 10:12:18 -0700
+Subject: net/sched: cbs: fix port_rate miscalculation
+Patch-mainline: v5.2-rc1
+Git-commit: e0a7683d30e91e30ee6cf96314ae58a0314a095e
+References: bsc#1109837
+
+The Credit Based Shaper heavily depends on link speed to calculate
+the scheduling credits, we can't properly calculate the credits if the
+device has failed to report the link speed.
+
+In that case we can't dequeue packets assuming a wrong port rate that will
+result into an inconsistent credit distribution.
+
+This patch makes sure we fail to dequeue case:
+
+1) __ethtool_get_link_ksettings() reports error or 2) the ethernet driver
+failed to set the ksettings' speed value (setting link speed to
+SPEED_UNKNOWN).
+
+Additionally we properly re calculate the port rate whenever the link speed
+is changed.
+
+Fixes: 3d0bd028ffb4a ("net/sched: Add support for HW offloading for CBS")
+Signed-off-by: Leandro Dorileo <leandro.maciel.dorileo@intel.com>
+Reviewed-by: Vedang Patel <vedang.patel@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/sched/sch_cbs.c | 98 ++++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 84 insertions(+), 14 deletions(-)
+
+--- a/net/sched/sch_cbs.c
++++ b/net/sched/sch_cbs.c
+@@ -61,16 +61,20 @@
+ #include <linux/string.h>
+ #include <linux/errno.h>
+ #include <linux/skbuff.h>
++#include <net/netevent.h>
+ #include <net/netlink.h>
+ #include <net/sch_generic.h>
+ #include <net/pkt_sched.h>
+
++static LIST_HEAD(cbs_list);
++static DEFINE_SPINLOCK(cbs_list_lock);
++
+ #define BYTES_PER_KBIT (1000LL / 8)
+
+ struct cbs_sched_data {
+ bool offload;
+ int queue;
+- s64 port_rate; /* in bytes/s */
++ atomic64_t port_rate; /* in bytes/s */
+ s64 last; /* timestamp in ns */
+ s64 credits; /* in bytes */
+ s32 locredit; /* in bytes */
+@@ -82,6 +86,7 @@ struct cbs_sched_data {
+ struct sk_buff **to_free);
+ struct sk_buff *(*dequeue)(struct Qdisc *sch);
+ struct Qdisc *qdisc;
++ struct list_head cbs_list;
+ };
+
+ static int cbs_child_enqueue(struct sk_buff *skb, struct Qdisc *sch,
+@@ -181,6 +186,11 @@ static struct sk_buff *cbs_dequeue_soft(
+ s64 credits;
+ int len;
+
++ if (atomic64_read(&q->port_rate) == -1) {
++ WARN_ONCE(1, "cbs: dequeue() called with unknown port rate.");
++ return NULL;
++ }
++
+ if (q->credits < 0) {
+ credits = timediff_to_credits(now - q->last, q->idleslope);
+
+@@ -207,7 +217,8 @@ static struct sk_buff *cbs_dequeue_soft(
+ /* As sendslope is a negative number, this will decrease the
+ * amount of q->credits.
+ */
+- credits = credits_from_len(len, q->sendslope, q->port_rate);
++ credits = credits_from_len(len, q->sendslope,
++ atomic64_read(&q->port_rate));
+ credits += q->credits;
+
+ q->credits = max_t(s64, credits, q->locredit);
+@@ -294,6 +305,50 @@ static int cbs_enable_offload(struct net
+ return 0;
+ }
+
++static void cbs_set_port_rate(struct net_device *dev, struct cbs_sched_data *q)
++{
++ struct ethtool_link_ksettings ecmd;
++ int port_rate = -1;
++
++ if (!__ethtool_get_link_ksettings(dev, &ecmd) &&
++ ecmd.base.speed != SPEED_UNKNOWN)
++ port_rate = ecmd.base.speed * 1000 * BYTES_PER_KBIT;
++
++ atomic64_set(&q->port_rate, port_rate);
++ netdev_dbg(dev, "cbs: set %s's port_rate to: %lld, linkspeed: %d\n",
++ dev->name, (long long)atomic64_read(&q->port_rate),
++ ecmd.base.speed);
++}
++
++static int cbs_dev_notifier(struct notifier_block *nb, unsigned long event,
++ void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct cbs_sched_data *q;
++ struct net_device *qdev;
++ bool found = false;
++
++ ASSERT_RTNL();
++
++ if (event != NETDEV_UP && event != NETDEV_CHANGE)
++ return NOTIFY_DONE;
++
++ spin_lock(&cbs_list_lock);
++ list_for_each_entry(q, &cbs_list, cbs_list) {
++ qdev = qdisc_dev(q->qdisc);
++ if (qdev == dev) {
++ found = true;
++ break;
++ }
++ }
++ spin_unlock(&cbs_list_lock);
++
++ if (found)
++ cbs_set_port_rate(dev, q);
++
++ return NOTIFY_DONE;
++}
++
+ static int cbs_change(struct Qdisc *sch, struct nlattr *opt,
+ struct netlink_ext_ack *extack)
+ {
+@@ -315,16 +370,7 @@ static int cbs_change(struct Qdisc *sch,
+ qopt = nla_data(tb[TCA_CBS_PARMS]);
+
+ if (!qopt->offload) {
+- struct ethtool_link_ksettings ecmd;
+- s64 link_speed;
+-
+- if (!__ethtool_get_link_ksettings(dev, &ecmd))
+- link_speed = ecmd.base.speed;
+- else
+- link_speed = SPEED_1000;
+-
+- q->port_rate = link_speed * 1000 * BYTES_PER_KBIT;
+-
++ cbs_set_port_rate(dev, q);
+ cbs_disable_offload(dev, q);
+ } else {
+ err = cbs_enable_offload(dev, q, qopt, extack);
+@@ -347,6 +393,7 @@ static int cbs_init(struct Qdisc *sch, s
+ {
+ struct cbs_sched_data *q = qdisc_priv(sch);
+ struct net_device *dev = qdisc_dev(sch);
++ int err;
+
+ if (!opt) {
+ NL_SET_ERR_MSG(extack, "Missing CBS qdisc options which are mandatory");
+@@ -367,7 +414,17 @@ static int cbs_init(struct Qdisc *sch, s
+
+ qdisc_watchdog_init(&q->watchdog, sch);
+
+- return cbs_change(sch, opt, extack);
++ err = cbs_change(sch, opt, extack);
++ if (err)
++ return err;
++
++ if (!q->offload) {
++ spin_lock(&cbs_list_lock);
++ list_add(&q->cbs_list, &cbs_list);
++ spin_unlock(&cbs_list_lock);
++ }
++
++ return 0;
+ }
+
+ static void cbs_destroy(struct Qdisc *sch)
+@@ -375,8 +432,11 @@ static void cbs_destroy(struct Qdisc *sc
+ struct cbs_sched_data *q = qdisc_priv(sch);
+ struct net_device *dev = qdisc_dev(sch);
+
+- qdisc_watchdog_cancel(&q->watchdog);
++ spin_lock(&cbs_list_lock);
++ list_del(&q->cbs_list);
++ spin_unlock(&cbs_list_lock);
+
++ qdisc_watchdog_cancel(&q->watchdog);
+ cbs_disable_offload(dev, q);
+
+ if (q->qdisc)
+@@ -487,14 +547,24 @@ static struct Qdisc_ops cbs_qdisc_ops __
+ .owner = THIS_MODULE,
+ };
+
++static struct notifier_block cbs_device_notifier = {
++ .notifier_call = cbs_dev_notifier,
++};
++
+ static int __init cbs_module_init(void)
+ {
++ int err = register_netdevice_notifier(&cbs_device_notifier);
++
++ if (err)
++ return err;
++
+ return register_qdisc(&cbs_qdisc_ops);
+ }
+
+ static void __exit cbs_module_exit(void)
+ {
+ unregister_qdisc(&cbs_qdisc_ops);
++ unregister_netdevice_notifier(&cbs_device_notifier);
+ }
+ module_init(cbs_module_init)
+ module_exit(cbs_module_exit)
diff --git a/patches.drivers/net-tls-avoid-NULL-pointer-deref-on-nskb-sk-in-fallb.patch b/patches.drivers/net-tls-avoid-NULL-pointer-deref-on-nskb-sk-in-fallb.patch
new file mode 100644
index 0000000000..05dc702f75
--- /dev/null
+++ b/patches.drivers/net-tls-avoid-NULL-pointer-deref-on-nskb-sk-in-fallb.patch
@@ -0,0 +1,37 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Mon, 29 Apr 2019 12:19:12 -0700
+Subject: net/tls: avoid NULL pointer deref on nskb->sk in fallback
+Patch-mainline: v5.1
+Git-commit: 2dcb003314032c6efb13a065ffae60d164b2dd35
+References: bsc#1109837
+
+update_chksum() accesses nskb->sk before it has been set
+by complete_skb(), move the init up.
+
+Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/tls/tls_device_fallback.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/tls/tls_device_fallback.c
++++ b/net/tls/tls_device_fallback.c
+@@ -200,12 +200,14 @@ static void complete_skb(struct sk_buff
+
+ skb_put(nskb, skb->len);
+ memcpy(nskb->data, skb->data, headln);
+- update_chksum(nskb, headln);
+
+ nskb->destructor = skb->destructor;
+ nskb->sk = sk;
+ skb->destructor = NULL;
+ skb->sk = NULL;
++
++ update_chksum(nskb, headln);
++
+ delta = nskb->truesize - skb->truesize;
+ if (likely(delta < 0))
+ WARN_ON_ONCE(atomic_sub_and_test(-delta, &sk->sk_wmem_alloc));
diff --git a/patches.drivers/net-tls-avoid-potential-deadlock-in-tls_set_device_o.patch b/patches.drivers/net-tls-avoid-potential-deadlock-in-tls_set_device_o.patch
new file mode 100644
index 0000000000..7400e82368
--- /dev/null
+++ b/patches.drivers/net-tls-avoid-potential-deadlock-in-tls_set_device_o.patch
@@ -0,0 +1,34 @@
+From: Jakub Kicinski <jakub.kicinski@netronome.com>
+Date: Fri, 19 Apr 2019 16:51:38 -0700
+Subject: net/tls: avoid potential deadlock in tls_set_device_offload_rx()
+Patch-mainline: v5.1-rc7
+Git-commit: 62ef81d5632634d5e310ed25b9b940b2b6612b46
+References: bsc#1109837
+
+If device supports offload, but offload fails tls_set_device_offload_rx()
+will call tls_sw_free_resources_rx() which (unhelpfully) releases
+and reacquires the socket lock.
+
+For a small fix release and reacquire the device_offload_lock.
+
+Fixes: 4799ac81e52a ("tls: Add rx inline crypto offload")
+Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
+Reviewed-by: Dirk van der Merwe <dirk.vandermerwe@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
+---
+ net/tls/tls_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/tls/tls_device.c
++++ b/net/tls/tls_device.c
+@@ -899,7 +899,9 @@ int tls_set_device_offload_rx(struct soc
+ goto release_netdev;
+
+ free_sw_resources:
++ up_read(&device_offload_lock);
+ tls_sw_free_resources_rx(sk);
++ down_read(&device_offload_lock);
+ release_ctx:
+ ctx->priv_ctx_rx = NULL;
+ release_netdev:
diff --git a/patches.drivers/net-tls-correctly-account-for-copied-bytes-with-mult.patch b/patches.drivers/net-tls-correctly-account-for-copied-bytes-with-mult.patch
new file mode 100644
index 0000000000..9f609dc9e3
--- /dev/null
+++ b/patches.drivers/net-tls-correctly-account-for-copied-bytes-with-mult.patch
@@ -0,0 +1,49 @@
+From: John Fastabend <john.fastabend@gmail.com>
+Date: Wed, 12 Jun 2019 17:23:57 +0000
+Subject: net: tls, correctly account for copied bytes with multiple sk_msgs
+Patch-mainline: v5.2-rc6
+Git-commit: 648ee6cea7dde4a5cdf817e5d964fd60b22006a4
+References: bsc#1109837
+
+tls_sw_do_sendpage needs to return the total number of bytes sent
+regardless of how many sk_msgs are allocated. Unfortunately, copied
+(the value we return up the stack) is zero'd before each new sk_msg
+is allocated so we only return the copied size of the last sk_msg used.
+
+The caller (splice, etc.) of sendpage will then believe only part
+of its data was sent and send the missing chunks again. However,
+because the data actually was sent the receiver will get multiple
+copies of the same data.
+
+To reproduce this do multiple sendfile calls with a length close to
+the max record size. This will in turn call splice/sendpage, sendpage
+may use multiple sk_msg in this case and then returns the incorrect
+number of bytes. This will cause splice to resend creating duplicate
+data on the receiver. Andre