--- /dev/null
+From b9c191be3fbdd9d78be11160dd7a3ddb9fdc6d42 Mon Sep 17 00:00:00 2001
+From: Raja Mani <rmani@qti.qualcomm.com>
+Date: Thu, 10 Mar 2016 10:25:07 +0530
+Subject: ath10k: free cached fw bin contents when get board id fails
+
+From: Raja Mani <rmani@qti.qualcomm.com>
+
+commit b9c191be3fbdd9d78be11160dd7a3ddb9fdc6d42 upstream.
+
+ath10k_core_probe_fw() simply returns error without freeing
+cached firmware file content when get board id operation fails.
+Free cached fw bin data in failure case to avoid memory leak.
+
+Fixes: db0984e51a18 ("ath10k: select board data based on BMI chip id and board id")
+Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
+Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/ath/ath10k/core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ath/ath10k/core.c
++++ b/drivers/net/wireless/ath/ath10k/core.c
+@@ -1805,7 +1805,7 @@ static int ath10k_core_probe_fw(struct a
+ if (ret && ret != -EOPNOTSUPP) {
+ ath10k_err(ar, "failed to get board id from otp for qca99x0: %d\n",
+ ret);
+- return ret;
++ goto err_free_firmware_files;
+ }
+
+ ret = ath10k_core_fetch_board_file(ar);
--- /dev/null
+From f87fda00b6ed232a817c655b8d179b48bde8fdbe Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 30 Jun 2016 16:13:41 +0200
+Subject: bonding: prevent out of bound accesses
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit f87fda00b6ed232a817c655b8d179b48bde8fdbe upstream.
+
+ether_addr_equal_64bits() requires some care about its arguments,
+namely that 8 bytes might be read, even if last 2 byte values are not
+used.
+
+KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
+in bond_3ad.c
+
+Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
+Although the 8-byte alignment was there, KASan would detect out
+of bound accesses.
+
+Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
+Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
+Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Dmitry Vyukov <dvyukov@google.com>
+Acked-by: Dmitry Vyukov <dvyukov@google.com>
+Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Acked-by: Ding Tianhong <dingtianhong@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/bonding/bond_3ad.c | 11 +++++++----
+ drivers/net/bonding/bond_alb.c | 7 ++-----
+ include/net/bonding.h | 7 ++++++-
+ 3 files changed, 15 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/bonding/bond_3ad.c
++++ b/drivers/net/bonding/bond_3ad.c
+@@ -100,11 +100,14 @@ enum ad_link_speed_type {
+ #define MAC_ADDRESS_EQUAL(A, B) \
+ ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
+
+-static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
++static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = {
++ 0, 0, 0, 0, 0, 0
++};
+ static u16 ad_ticks_per_sec;
+ static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
+
+-static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
++static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned =
++ MULTICAST_LACPDU_ADDR;
+
+ /* ================= main 802.3ad protocol functions ================== */
+ static int ad_lacpdu_send(struct port *port);
+@@ -1701,7 +1704,7 @@ static void ad_clear_agg(struct aggregat
+ aggregator->is_individual = false;
+ aggregator->actor_admin_aggregator_key = 0;
+ aggregator->actor_oper_aggregator_key = 0;
+- aggregator->partner_system = null_mac_addr;
++ eth_zero_addr(aggregator->partner_system.mac_addr_value);
+ aggregator->partner_system_priority = 0;
+ aggregator->partner_oper_aggregator_key = 0;
+ aggregator->receive_state = 0;
+@@ -1723,7 +1726,7 @@ static void ad_initialize_agg(struct agg
+ if (aggregator) {
+ ad_clear_agg(aggregator);
+
+- aggregator->aggregator_mac_address = null_mac_addr;
++ eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
+ aggregator->aggregator_identifier = 0;
+ aggregator->slave = NULL;
+ }
+--- a/drivers/net/bonding/bond_alb.c
++++ b/drivers/net/bonding/bond_alb.c
+@@ -42,13 +42,10 @@
+
+
+
+-#ifndef __long_aligned
+-#define __long_aligned __attribute__((aligned((sizeof(long)))))
+-#endif
+-static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
++static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+ };
+-static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = {
++static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {
+ 0x33, 0x33, 0x00, 0x00, 0x00, 0x01
+ };
+ static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC;
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -34,6 +34,9 @@
+
+ #define BOND_DEFAULT_MIIMON 100
+
++#ifndef __long_aligned
++#define __long_aligned __attribute__((aligned((sizeof(long)))))
++#endif
+ /*
+ * Less bad way to call ioctl from within the kernel; this needs to be
+ * done some other way to get the call out of interrupt context.
+@@ -138,7 +141,9 @@ struct bond_params {
+ struct reciprocal_value reciprocal_packets_per_slave;
+ u16 ad_actor_sys_prio;
+ u16 ad_user_port_key;
+- u8 ad_actor_system[ETH_ALEN];
++
++ /* 2 bytes of padding : see ether_addr_equal_64bits() */
++ u8 ad_actor_system[ETH_ALEN + 2];
+ };
+
+ struct bond_parm_tbl {
--- /dev/null
+From 838fe1887765f4cc679febea60d87d2a06bd300e Mon Sep 17 00:00:00 2001
+From: Jiri Kosina <jkosina@suse.cz>
+Date: Tue, 15 Mar 2016 11:28:54 +0100
+Subject: btrfs: cleaner_kthread() doesn't need explicit freeze
+
+From: Jiri Kosina <jkosina@suse.cz>
+
+commit 838fe1887765f4cc679febea60d87d2a06bd300e upstream.
+
+cleaner_kthread() is not marked freezable, and therefore calling
+try_to_freeze() in its context is a pointless no-op.
+
+In addition to that, as has been clearly demonstrated by 80ad623edd2d
+("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()"), it's perfectly
+valid / legal for cleaner_kthread() to stay scheduled out in an arbitrary
+place during suspend (in that particular example that was waiting for
+reading of extent pages), so there is no need to leave any traces of
+freezer in this kthread.
+
+Fixes: 80ad623edd2d ("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()")
+Fixes: 696249132158 ("btrfs: clear PF_NOFREEZE in cleaner_kthread()")
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/disk-io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1750,7 +1750,7 @@ static int cleaner_kthread(void *arg)
+ */
+ btrfs_delete_unused_bgs(root->fs_info);
+ sleep:
+- if (!try_to_freeze() && !again) {
++ if (!again) {
+ set_current_state(TASK_INTERRUPTIBLE);
+ if (!kthread_should_stop())
+ schedule();
--- /dev/null
+From c23ac90f78aa9190643c82c1975a0cfe480d7c60 Mon Sep 17 00:00:00 2001
+From: Peter Griffin <peter.griffin@linaro.org>
+Date: Thu, 24 Mar 2016 08:23:52 -0300
+Subject: [media] c8sectpfe: Rework firmware loading mechanism
+
+From: Peter Griffin <peter.griffin@linaro.org>
+
+commit c23ac90f78aa9190643c82c1975a0cfe480d7c60 upstream.
+
+c8sectpfe driver relied on CONFIG_FW_LOADER_USER_HELPER_FALLBACK option
+for loading its xp70 firmware. A previous commit removed this Kconfig
+option, as it is apparently harmful, but did not update the driver
+code which relied on it.
+
+This patch reworks the firmware loading into the start_feed callback.
+At this point we can be sure the rootfs is present, thereby removing
+the depedency on CONFIG_FW_LOADER_USER_HELPER_FALLBACK.
+
+Fixes: 79f5b6ae960d ('[media] c8sectpfe: Remove select on CONFIG_FW_LOADER_USER_HELPER_FALLBACK')
+
+Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c | 65 ++++++------------
+ 1 file changed, 22 insertions(+), 43 deletions(-)
+
+--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+@@ -49,7 +49,7 @@ MODULE_FIRMWARE(FIRMWARE_MEMDMA);
+ #define PID_TABLE_SIZE 1024
+ #define POLL_MSECS 50
+
+-static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei);
++static int load_c8sectpfe_fw(struct c8sectpfei *fei);
+
+ #define TS_PKT_SIZE 188
+ #define HEADER_SIZE (4)
+@@ -143,6 +143,7 @@ static int c8sectpfe_start_feed(struct d
+ struct channel_info *channel;
+ u32 tmp;
+ unsigned long *bitmap;
++ int ret;
+
+ switch (dvbdmxfeed->type) {
+ case DMX_TYPE_TS:
+@@ -171,8 +172,9 @@ static int c8sectpfe_start_feed(struct d
+ }
+
+ if (!atomic_read(&fei->fw_loaded)) {
+- dev_err(fei->dev, "%s: c8sectpfe fw not loaded\n", __func__);
+- return -EINVAL;
++ ret = load_c8sectpfe_fw(fei);
++ if (ret)
++ return ret;
+ }
+
+ mutex_lock(&fei->lock);
+@@ -267,8 +269,9 @@ static int c8sectpfe_stop_feed(struct dv
+ unsigned long *bitmap;
+
+ if (!atomic_read(&fei->fw_loaded)) {
+- dev_err(fei->dev, "%s: c8sectpfe fw not loaded\n", __func__);
+- return -EINVAL;
++ ret = load_c8sectpfe_fw(fei);
++ if (ret)
++ return ret;
+ }
+
+ mutex_lock(&fei->lock);
+@@ -882,13 +885,6 @@ static int c8sectpfe_probe(struct platfo
+ goto err_clk_disable;
+ }
+
+- /* ensure all other init has been done before requesting firmware */
+- ret = load_c8sectpfe_fw_step1(fei);
+- if (ret) {
+- dev_err(dev, "Couldn't load slim core firmware\n");
+- goto err_clk_disable;
+- }
+-
+ c8sectpfe_debugfs_init(fei);
+
+ return 0;
+@@ -1093,15 +1089,14 @@ static void load_dmem_segment(struct c8s
+ phdr->p_memsz - phdr->p_filesz);
+ }
+
+-static int load_slim_core_fw(const struct firmware *fw, void *context)
++static int load_slim_core_fw(const struct firmware *fw, struct c8sectpfei *fei)
+ {
+- struct c8sectpfei *fei = context;
+ Elf32_Ehdr *ehdr;
+ Elf32_Phdr *phdr;
+ u8 __iomem *dst;
+ int err = 0, i;
+
+- if (!fw || !context)
++ if (!fw || !fei)
+ return -EINVAL;
+
+ ehdr = (Elf32_Ehdr *)fw->data;
+@@ -1153,29 +1148,35 @@ static int load_slim_core_fw(const struc
+ return err;
+ }
+
+-static void load_c8sectpfe_fw_cb(const struct firmware *fw, void *context)
++static int load_c8sectpfe_fw(struct c8sectpfei *fei)
+ {
+- struct c8sectpfei *fei = context;
++ const struct firmware *fw;
+ int err;
+
++ dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA);
++
++ err = request_firmware(&fw, FIRMWARE_MEMDMA, fei->dev);
++ if (err)
++ return err;
++
+ err = c8sectpfe_elf_sanity_check(fei, fw);
+ if (err) {
+ dev_err(fei->dev, "c8sectpfe_elf_sanity_check failed err=(%d)\n"
+ , err);
+- goto err;
++ return err;
+ }
+
+- err = load_slim_core_fw(fw, context);
++ err = load_slim_core_fw(fw, fei);
+ if (err) {
+ dev_err(fei->dev, "load_slim_core_fw failed err=(%d)\n", err);
+- goto err;
++ return err;
+ }
+
+ /* now the firmware is loaded configure the input blocks */
+ err = configure_channels(fei);
+ if (err) {
+ dev_err(fei->dev, "configure_channels failed err=(%d)\n", err);
+- goto err;
++ return err;
+ }
+
+ /*
+@@ -1188,28 +1189,6 @@ static void load_c8sectpfe_fw_cb(const s
+ writel(0x1, fei->io + DMA_CPU_RUN);
+
+ atomic_set(&fei->fw_loaded, 1);
+-err:
+- complete_all(&fei->fw_ack);
+-}
+-
+-static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei)
+-{
+- int err;
+-
+- dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA);
+-
+- init_completion(&fei->fw_ack);
+- atomic_set(&fei->fw_loaded, 0);
+-
+- err = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG,
+- FIRMWARE_MEMDMA, fei->dev, GFP_KERNEL, fei,
+- load_c8sectpfe_fw_cb);
+-
+- if (err) {
+- dev_err(fei->dev, "request_firmware_nowait err: %d.\n", err);
+- complete_all(&fei->fw_ack);
+- return err;
+- }
+
+ return 0;
+ }
--- /dev/null
+From 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc Mon Sep 17 00:00:00 2001
+From: Brian Norris <computersforpeace@gmail.com>
+Date: Wed, 9 Dec 2015 14:50:28 -0800
+Subject: firmware: actually return NULL on failed request_firmware_nowait()
+
+From: Brian Norris <computersforpeace@gmail.com>
+
+commit 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc upstream.
+
+The kerneldoc for request_firmware_nowait() says that it may call the
+provided cont() callback with @fw == NULL, if the firmware request
+fails. However, this is not the case when called with an empty string
+(""). This case is short-circuited by the 'name[0] == '\0'' check
+introduced in commit 471b095dfe0d ("firmware_class: make sure fw requests
+contain a name"), so _request_firmware() never gets to set the fw to
+NULL.
+
+Noticed while using the new 'trigger_async_request' testing hook:
+
+ # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
+ [10553.726178] test_firmware: loading ''
+ [10553.729859] test_firmware: loaded: 995209091
+ # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
+ [10733.676184] test_firmware: loading ''
+ [10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004
+ [10733.687951] pgd = ec188000
+ [10733.690655] [00000004] *pgd=00000000
+ [10733.694240] Internal error: Oops: 5 [#1] SMP ARM
+ [10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun
+ [10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178
+ [10733.733137] Hardware name: Rockchip (Device Tree)
+ [10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000
+ [10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0
+ [10733.747831] LR is at _raw_spin_lock+0x18/0x1c
+ [10733.752180] pc : [<c00653a0>] lr : [<c054c204>] psr: a00d0013
+ [10733.752180] sp : ee323df8 ip : ee323e20 fp : ee323e1c
+ [10733.763634] r10: 00000051 r9 : b6f18000 r8 : ee323f80
+ [10733.768847] r7 : c089cebc r6 : 00000001 r5 : 00000000 r4 : ec0e6000
+ [10733.775360] r3 : dead4ead r2 : c06bd140 r1 : eef913b4 r0 : 00000000
+ [10733.781874] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
+ [10733.788995] Control: 10c5387d Table: 2c18806a DAC: 00000051
+ [10733.794728] Process bash (pid: 6600, stack limit = 0xee322218)
+ [10733.800549] Stack: (0xee323df8 to 0xee324000)
+ [10733.804896] 3de0: ec0e6000 00000000
+ [10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394
+ [10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48
+ [10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac
+ [10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c
+ [10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720
+ [10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00
+ [10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8
+ [10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001
+ [10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28
+ [10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80
+ [10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00
+ [10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24
+ [10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8
+ [10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000
+ [10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84
+ [10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390
+ [10733.943664] [<c00653a0>] (do_raw_spin_lock) from [<c054c204>] (_raw_spin_lock+0x18/0x1c)
+ [10733.951743] [<c054c204>] (_raw_spin_lock) from [<c02fec60>] (fw_free_buf+0x24/0x64)
+ [10733.959388] [<c02fec60>] (fw_free_buf) from [<c02fed08>] (release_firmware+0x68/0x74)
+ [10733.967207] [<c02fed08>] (release_firmware) from [<c0253828>] (trigger_async_request_store+0x60/0x124)
+ [10733.976501] [<c0253828>] (trigger_async_request_store) from [<c02e873c>] (dev_attr_store+0x28/0x34)
+ [10733.985533] [<c02e873c>] (dev_attr_store) from [<c017bd40>] (sysfs_kf_write+0x4c/0x58)
+ [10733.993437] [<c017bd40>] (sysfs_kf_write) from [<c017b250>] (kernfs_fop_write+0x144/0x1a8)
+ [10734.001689] [<c017b250>] (kernfs_fop_write) from [<c011b71c>] (__vfs_write+0x3c/0xe4)
+
+After this patch:
+
+ # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
+ [ 32.126322] test_firmware: loading ''
+ [ 32.129995] test_firmware: failed to async load firmware
+ -bash: printf: write error: No such device
+
+Fixes: 471b095dfe0d ("firmware_class: make sure fw requests contain a name")
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Acked-by: Ming Lei <ming.lei@canonical.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/firmware_class.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -1119,15 +1119,17 @@ static int
+ _request_firmware(const struct firmware **firmware_p, const char *name,
+ struct device *device, unsigned int opt_flags)
+ {
+- struct firmware *fw;
++ struct firmware *fw = NULL;
+ long timeout;
+ int ret;
+
+ if (!firmware_p)
+ return -EINVAL;
+
+- if (!name || name[0] == '\0')
+- return -EINVAL;
++ if (!name || name[0] == '\0') {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ ret = _request_firmware_prepare(&fw, name, device);
+ if (ret <= 0) /* error or already assigned */
--- /dev/null
+From c0fcebf55289c48148992eee002a7caf853a5358 Mon Sep 17 00:00:00 2001
+From: Eran Ben Elisha <eranbe@mellanox.com>
+Date: Sat, 4 Jun 2016 15:15:30 +0300
+Subject: IB/mlx5: Fix FW version diaplay in sysfs
+
+From: Eran Ben Elisha <eranbe@mellanox.com>
+
+commit c0fcebf55289c48148992eee002a7caf853a5358 upstream.
+
+Add a 4-digit padding to show FW version in proper format.
+
+Fixes: 9603b61de1eee ('mlx5: Move pci device handling from...')
+Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -905,7 +905,7 @@ static ssize_t show_fw_ver(struct device
+ {
+ struct mlx5_ib_dev *dev =
+ container_of(device, struct mlx5_ib_dev, ib_dev.dev);
+- return sprintf(buf, "%d.%d.%d\n", fw_rev_maj(dev->mdev),
++ return sprintf(buf, "%d.%d.%04d\n", fw_rev_maj(dev->mdev),
+ fw_rev_min(dev->mdev), fw_rev_sub(dev->mdev));
+ }
+
--- /dev/null
+From 75c1657e1d50730dc0130a67977f7831a4e241f4 Mon Sep 17 00:00:00 2001
+From: Leon Romanovsky <leon@kernel.org>
+Date: Thu, 11 Feb 2016 21:09:57 +0200
+Subject: IB/mlx5: Fix RC transport send queue overhead computation
+
+From: Leon Romanovsky <leon@leon.nu>
+
+commit 75c1657e1d50730dc0130a67977f7831a4e241f4 upstream.
+
+Fix the RC QPs send queue overhead computation to take into account
+two additional segments in the WQE which are needed for registration
+operations.
+
+The ATOMIC and UMR segments can't coexist together, so chose maximum out
+of them.
+
+The commit 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead
+computation") was intended to update RC transport as commit messages
+states, but added the code to UC transport.
+
+Fixes: 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation")
+Signed-off-by: Kamal Heib <kamalh@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/qp.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx5/qp.c
++++ b/drivers/infiniband/hw/mlx5/qp.c
+@@ -271,8 +271,10 @@ static int sq_overhead(enum ib_qp_type q
+ /* fall through */
+ case IB_QPT_RC:
+ size += sizeof(struct mlx5_wqe_ctrl_seg) +
+- sizeof(struct mlx5_wqe_atomic_seg) +
+- sizeof(struct mlx5_wqe_raddr_seg);
++ max(sizeof(struct mlx5_wqe_atomic_seg) +
++ sizeof(struct mlx5_wqe_raddr_seg),
++ sizeof(struct mlx5_wqe_umr_ctrl_seg) +
++ sizeof(struct mlx5_mkey_seg));
+ break;
+
+ case IB_QPT_XRC_TGT:
+@@ -280,9 +282,9 @@ static int sq_overhead(enum ib_qp_type q
+
+ case IB_QPT_UC:
+ size += sizeof(struct mlx5_wqe_ctrl_seg) +
+- sizeof(struct mlx5_wqe_raddr_seg) +
+- sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+- sizeof(struct mlx5_mkey_seg);
++ max(sizeof(struct mlx5_wqe_raddr_seg),
++ sizeof(struct mlx5_wqe_umr_ctrl_seg) +
++ sizeof(struct mlx5_mkey_seg));
+ break;
+
+ case IB_QPT_UD:
--- /dev/null
+From 8ab86c00e349cef9fb14719093a7f198bcc72629 Mon Sep 17 00:00:00 2001
+From: "phil.turnbull@oracle.com" <phil.turnbull@oracle.com>
+Date: Thu, 15 Sep 2016 12:41:44 -0400
+Subject: irda: Free skb on irda_accept error path.
+
+From: phil.turnbull@oracle.com <phil.turnbull@oracle.com>
+
+commit 8ab86c00e349cef9fb14719093a7f198bcc72629 upstream.
+
+skb is not freed if newsk is NULL. Rework the error path so free_skb is
+unconditionally called on function exit.
+
+Fixes: c3ea9fa27413 ("[IrDA] af_irda: IRDA_ASSERT cleanups")
+Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/irda/af_irda.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -839,7 +839,7 @@ static int irda_accept(struct socket *so
+ struct sock *sk = sock->sk;
+ struct irda_sock *new, *self = irda_sk(sk);
+ struct sock *newsk;
+- struct sk_buff *skb;
++ struct sk_buff *skb = NULL;
+ int err;
+
+ err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0);
+@@ -907,7 +907,6 @@ static int irda_accept(struct socket *so
+ err = -EPERM; /* value does not seem to make sense. -arnd */
+ if (!new->tsap) {
+ pr_debug("%s(), dup failed!\n", __func__);
+- kfree_skb(skb);
+ goto out;
+ }
+
+@@ -926,7 +925,6 @@ static int irda_accept(struct socket *so
+ /* Clean up the original one to keep it in listen state */
+ irttp_listen(self->tsap);
+
+- kfree_skb(skb);
+ sk->sk_ack_backlog--;
+
+ newsock->state = SS_CONNECTED;
+@@ -934,6 +932,7 @@ static int irda_accept(struct socket *so
+ irda_connect_response(new);
+ err = 0;
+ out:
++ kfree_skb(skb);
+ release_sock(sk);
+ return err;
+ }
--- /dev/null
+From de64aa9ec129ba627634088f662a4d09e356ddb6 Mon Sep 17 00:00:00 2001
+From: Boris Brezillon <bbrezillon@kernel.org>
+Date: Mon, 23 Nov 2015 11:23:07 +0100
+Subject: mtd: nand: fix ONFI parameter page layout
+
+From: Boris Brezillon <boris.brezillon@free-electrons.com>
+
+commit de64aa9ec129ba627634088f662a4d09e356ddb6 upstream.
+
+src_ssync_features field is only 1 byte large, and the 4th reserved area
+is actually 8 bytes large.
+
+Fixes: d1e1f4e42b5 ("mtd: nand: add support for reading ONFI parameters from NAND device")
+Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
+Signed-off-by: Brian Norris <computersforpeace@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mtd/nand.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/include/linux/mtd/nand.h
++++ b/include/linux/mtd/nand.h
+@@ -276,7 +276,7 @@ struct nand_onfi_params {
+ __le16 t_r;
+ __le16 t_ccs;
+ __le16 src_sync_timing_mode;
+- __le16 src_ssync_features;
++ u8 src_ssync_features;
+ __le16 clk_pin_capacitance_typ;
+ __le16 io_pin_capacitance_typ;
+ __le16 input_pin_capacitance_typ;
+@@ -284,7 +284,7 @@ struct nand_onfi_params {
+ u8 driver_strength_support;
+ __le16 t_int_r;
+ __le16 t_ald;
+- u8 reserved4[7];
++ u8 reserved4[8];
+
+ /* vendor */
+ __le16 vendor_revision;
--- /dev/null
+From 65ee67084589c1783a74b4a4a5db38d7264ec8b5 Mon Sep 17 00:00:00 2001
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+Date: Thu, 30 Jun 2016 17:34:43 +0300
+Subject: net/mlx5: Add timeout handle to commands with callback
+
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+
+commit 65ee67084589c1783a74b4a4a5db38d7264ec8b5 upstream.
+
+The current implementation does not handle timeout in case of command
+with callback request, and this can lead to deadlock if the command
+doesn't get fw response.
+Add delayed callback timeout work before posting the command to fw.
+In case of real fw command completion we will cancel the delayed work.
+In case of fw command timeout the callback timeout handler will be
+called and it will simulate fw completion with timeout error.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 38 +++++++++++++++++++++-----
+ include/linux/mlx5/driver.h | 1
+ 2 files changed, 32 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -634,11 +634,36 @@ static void free_msg(struct mlx5_core_de
+ static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
+ struct mlx5_cmd_msg *msg);
+
++static u16 msg_to_opcode(struct mlx5_cmd_msg *in)
++{
++ struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data);
++
++ return be16_to_cpu(hdr->opcode);
++}
++
++static void cb_timeout_handler(struct work_struct *work)
++{
++ struct delayed_work *dwork = container_of(work, struct delayed_work,
++ work);
++ struct mlx5_cmd_work_ent *ent = container_of(dwork,
++ struct mlx5_cmd_work_ent,
++ cb_timeout_work);
++ struct mlx5_core_dev *dev = container_of(ent->cmd, struct mlx5_core_dev,
++ cmd);
++
++ ent->ret = -ETIMEDOUT;
++ mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
++ mlx5_command_str(msg_to_opcode(ent->in)),
++ msg_to_opcode(ent->in));
++ mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
++}
++
+ static void cmd_work_handler(struct work_struct *work)
+ {
+ struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);
+ struct mlx5_cmd *cmd = ent->cmd;
+ struct mlx5_core_dev *dev = container_of(cmd, struct mlx5_core_dev, cmd);
++ unsigned long cb_timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC);
+ struct mlx5_cmd_layout *lay;
+ struct semaphore *sem;
+ unsigned long flags;
+@@ -691,6 +716,9 @@ static void cmd_work_handler(struct work
+ ent->ts1 = ktime_get_ns();
+ cmd_mode = cmd->mode;
+
++ if (ent->callback)
++ schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
++
+ /* ring doorbell after the descriptor is valid */
+ mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
+ wmb();
+@@ -735,13 +763,6 @@ static const char *deliv_status_to_str(u
+ }
+ }
+
+-static u16 msg_to_opcode(struct mlx5_cmd_msg *in)
+-{
+- struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data);
+-
+- return be16_to_cpu(hdr->opcode);
+-}
+-
+ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
+ {
+ unsigned long timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC);
+@@ -808,6 +829,7 @@ static int mlx5_cmd_invoke(struct mlx5_c
+ if (!callback)
+ init_completion(&ent->done);
+
++ INIT_DELAYED_WORK(&ent->cb_timeout_work, cb_timeout_handler);
+ INIT_WORK(&ent->work, cmd_work_handler);
+ if (page_queue) {
+ cmd_work_handler(&ent->work);
+@@ -1287,6 +1309,8 @@ void mlx5_cmd_comp_handler(struct mlx5_c
+ struct semaphore *sem;
+
+ ent = cmd->ent_arr[i];
++ if (ent->callback)
++ cancel_delayed_work(&ent->cb_timeout_work);
+ if (ent->page_queue)
+ sem = &cmd->pages_sem;
+ else
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -566,6 +566,7 @@ struct mlx5_cmd_work_ent {
+ void *uout;
+ int uout_size;
+ mlx5_cmd_cbk_t callback;
++ struct delayed_work cb_timeout_work;
+ void *context;
+ int idx;
+ struct completion done;
--- /dev/null
+From c1d4d2e92ad670168a17a57dfa182a5a5baa72d4 Mon Sep 17 00:00:00 2001
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+Date: Thu, 30 Jun 2016 17:34:39 +0300
+Subject: net/mlx5: Avoid calling sleeping function by the health poll thread
+
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+
+commit c1d4d2e92ad670168a17a57dfa182a5a5baa72d4 upstream.
+
+In internal error state the health poll thread will eventually call
+synchronize_irq() (to safely trigger command completions) which might
+sleep, so we are calling sleeping function from atomic context which is
+invalid.
+Here we move trigger_cmd_completions(dev) to enter error state which is
+the earliest stage in error state handling.
+This way we won't need to wait for next health poll to trigger command
+completions and will solve the scheduling while atomic issue.
+mlx5_enter_error_state can be called from two contexts, protect it with
+dev->intf_state_lock
+
+Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver')
+Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/health.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
+@@ -108,15 +108,21 @@ static int in_fatal(struct mlx5_core_dev
+
+ void mlx5_enter_error_state(struct mlx5_core_dev *dev)
+ {
++ mutex_lock(&dev->intf_state_mutex);
+ if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
+- return;
++ goto unlock;
+
+ mlx5_core_err(dev, "start\n");
+- if (pci_channel_offline(dev->pdev) || in_fatal(dev))
++ if (pci_channel_offline(dev->pdev) || in_fatal(dev)) {
+ dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
++ trigger_cmd_completions(dev);
++ }
+
+ mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 0);
+ mlx5_core_err(dev, "end\n");
++
++unlock:
++ mutex_unlock(&dev->intf_state_mutex);
+ }
+
+ static void mlx5_handle_bad_state(struct mlx5_core_dev *dev)
+@@ -245,7 +251,6 @@ static void poll_health(unsigned long da
+ u32 count;
+
+ if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+- trigger_cmd_completions(dev);
+ mod_timer(&health->timer, get_next_poll_jiffies());
+ return;
+ }
--- /dev/null
+From 6b276190c50a12511d889d9079ffb901ff94a822 Mon Sep 17 00:00:00 2001
+From: Noa Osherovich <noaos@mellanox.com>
+Date: Tue, 25 Oct 2016 18:36:35 +0300
+Subject: net/mlx5: Avoid passing dma address 0 to firmware
+
+From: Noa Osherovich <noaos@mellanox.com>
+
+commit 6b276190c50a12511d889d9079ffb901ff94a822 upstream.
+
+Currently the firmware can't work with a page with dma address 0.
+Passing such an address to the firmware will cause the give_pages
+command to fail.
+
+To avoid this, in case we get a 0 dma address of a page from the
+dma engine, we avoid passing it to FW by remapping to get an address
+other than 0.
+
+Fixes: bf0bf77f6519 ('mlx5: Support communicating arbitrary host...')
+Signed-off-by: Noa Osherovich <noaos@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 26 +++++++++++++-------
+ 1 file changed, 18 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -243,6 +243,7 @@ static void free_4k(struct mlx5_core_dev
+ static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id)
+ {
+ struct page *page;
++ u64 zero_addr = 1;
+ u64 addr;
+ int err;
+ int nid = dev_to_node(&dev->pdev->dev);
+@@ -252,26 +253,35 @@ static int alloc_system_page(struct mlx5
+ mlx5_core_warn(dev, "failed to allocate page\n");
+ return -ENOMEM;
+ }
++map:
+ addr = dma_map_page(&dev->pdev->dev, page, 0,
+ PAGE_SIZE, DMA_BIDIRECTIONAL);
+ if (dma_mapping_error(&dev->pdev->dev, addr)) {
+ mlx5_core_warn(dev, "failed dma mapping page\n");
+ err = -ENOMEM;
+- goto out_alloc;
++ goto err_mapping;
+ }
++
++ /* Firmware doesn't support page with physical address 0 */
++ if (addr == 0) {
++ zero_addr = addr;
++ goto map;
++ }
++
+ err = insert_page(dev, addr, page, func_id);
+ if (err) {
+ mlx5_core_err(dev, "failed to track allocated page\n");
+- goto out_mapping;
++ dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE,
++ DMA_BIDIRECTIONAL);
+ }
+
+- return 0;
+-
+-out_mapping:
+- dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE, DMA_BIDIRECTIONAL);
++err_mapping:
++ if (err)
++ __free_page(page);
+
+-out_alloc:
+- __free_page(page);
++ if (zero_addr == 0)
++ dma_unmap_page(&dev->pdev->dev, zero_addr, PAGE_SIZE,
++ DMA_BIDIRECTIONAL);
+
+ return err;
+ }
--- /dev/null
+From 9cd3411c42c5d5ba55d6e745edfe7df53c1ffa41 Mon Sep 17 00:00:00 2001
+From: Majd Dibbiny <majd@mellanox.com>
+Date: Fri, 10 Jun 2016 00:07:29 +0300
+Subject: net/mlx5: Fix masking of reserved bits in XRCD number
+
+From: Majd Dibbiny <majd@mellanox.com>
+
+commit 9cd3411c42c5d5ba55d6e745edfe7df53c1ffa41 upstream.
+
+Mask the reserved bits when reading the number of newly
+created XRCD.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/qp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+@@ -393,7 +393,7 @@ int mlx5_core_xrcd_alloc(struct mlx5_cor
+ if (out.hdr.status)
+ err = mlx5_cmd_status_to_err(&out.hdr);
+ else
+- *xrcdn = be32_to_cpu(out.xrcdn);
++ *xrcdn = be32_to_cpu(out.xrcdn) & 0xffffff;
+
+ return err;
+ }
--- /dev/null
+From 1061c90f524963a0a90e7d2f9a6bfa666458af51 Mon Sep 17 00:00:00 2001
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+Date: Thu, 18 Aug 2016 21:09:04 +0300
+Subject: net/mlx5: Fix pci error recovery flow
+
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+
+commit 1061c90f524963a0a90e7d2f9a6bfa666458af51 upstream.
+
+When PCI error is detected we should save the state of the pci prior to
+disabling it.
+
+Also when receiving pci slot reset call we need to verify that the
+device is responsive.
+
+Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core
+driver')
+Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 59 ++++++++++++-------------
+ 1 file changed, 29 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1276,36 +1276,12 @@ static pci_ers_result_t mlx5_pci_err_det
+ dev_info(&pdev->dev, "%s was called\n", __func__);
+ mlx5_enter_error_state(dev);
+ mlx5_unload_one(dev, priv);
++ pci_save_state(pdev);
+ mlx5_pci_disable_device(dev);
+ return state == pci_channel_io_perm_failure ?
+ PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
+ }
+
+-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
+-{
+- struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+- int err = 0;
+-
+- dev_info(&pdev->dev, "%s was called\n", __func__);
+-
+- err = mlx5_pci_enable_device(dev);
+- if (err) {
+- dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
+- , __func__, err);
+- return PCI_ERS_RESULT_DISCONNECT;
+- }
+- pci_set_master(pdev);
+- pci_set_power_state(pdev, PCI_D0);
+- pci_restore_state(pdev);
+-
+- return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
+-}
+-
+-void mlx5_disable_device(struct mlx5_core_dev *dev)
+-{
+- mlx5_pci_err_detected(dev->pdev, 0);
+-}
+-
+ /* wait for the device to show vital signs by waiting
+ * for the health counter to start counting.
+ */
+@@ -1333,21 +1309,44 @@ static int wait_vital(struct pci_dev *pd
+ return -ETIMEDOUT;
+ }
+
+-static void mlx5_pci_resume(struct pci_dev *pdev)
++static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
+ {
+ struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+- struct mlx5_priv *priv = &dev->priv;
+ int err;
+
+ dev_info(&pdev->dev, "%s was called\n", __func__);
+
+- pci_save_state(pdev);
+- err = wait_vital(pdev);
++ err = mlx5_pci_enable_device(dev);
+ if (err) {
++ dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
++ , __func__, err);
++ return PCI_ERS_RESULT_DISCONNECT;
++ }
++
++ pci_set_master(pdev);
++ pci_restore_state(pdev);
++
++ if (wait_vital(pdev)) {
+ dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
+- return;
++ return PCI_ERS_RESULT_DISCONNECT;
+ }
+
++ return PCI_ERS_RESULT_RECOVERED;
++}
++
++void mlx5_disable_device(struct mlx5_core_dev *dev)
++{
++ mlx5_pci_err_detected(dev->pdev, 0);
++}
++
++static void mlx5_pci_resume(struct pci_dev *pdev)
++{
++ struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
++ struct mlx5_priv *priv = &dev->priv;
++ int err;
++
++ dev_info(&pdev->dev, "%s was called\n", __func__);
++
+ err = mlx5_load_one(dev, priv);
+ if (err)
+ dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"
--- /dev/null
+From 9cba4ebcf374c3772f6eb61f2d065294b2451b49 Mon Sep 17 00:00:00 2001
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+Date: Thu, 30 Jun 2016 17:34:42 +0300
+Subject: net/mlx5: Fix potential deadlock in command mode change
+
+From: Mohamad Haj Yahia <mohamad@mellanox.com>
+
+commit 9cba4ebcf374c3772f6eb61f2d065294b2451b49 upstream.
+
+Call command completion handler in case of timeout when working in
+interrupts mode.
+Avoid flushing the commands workqueue after acquiring the semaphores to
+prevent a potential deadlock.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 79 ++++++++++----------------
+ 1 file changed, 33 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -750,13 +750,13 @@ static int wait_func(struct mlx5_core_de
+
+ if (cmd->mode == CMD_MODE_POLLING) {
+ wait_for_completion(&ent->done);
+- err = ent->ret;
+- } else {
+- if (!wait_for_completion_timeout(&ent->done, timeout))
+- err = -ETIMEDOUT;
+- else
+- err = 0;
++ } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
++ ent->ret = -ETIMEDOUT;
++ mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+ }
++
++ err = ent->ret;
++
+ if (err == -ETIMEDOUT) {
+ mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
+ mlx5_command_str(msg_to_opcode(ent->in)),
+@@ -817,28 +817,26 @@ static int mlx5_cmd_invoke(struct mlx5_c
+ goto out_free;
+ }
+
+- if (!callback) {
+- err = wait_func(dev, ent);
+- if (err == -ETIMEDOUT)
+- goto out;
+-
+- ds = ent->ts2 - ent->ts1;
+- op = be16_to_cpu(((struct mlx5_inbox_hdr *)in->first.data)->opcode);
+- if (op < ARRAY_SIZE(cmd->stats)) {
+- stats = &cmd->stats[op];
+- spin_lock_irq(&stats->lock);
+- stats->sum += ds;
+- ++stats->n;
+- spin_unlock_irq(&stats->lock);
+- }
+- mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME,
+- "fw exec time for %s is %lld nsec\n",
+- mlx5_command_str(op), ds);
+- *status = ent->status;
+- free_cmd(ent);
+- }
++ if (callback)
++ goto out;
+
+- return err;
++ err = wait_func(dev, ent);
++ if (err == -ETIMEDOUT)
++ goto out_free;
++
++ ds = ent->ts2 - ent->ts1;
++ op = be16_to_cpu(((struct mlx5_inbox_hdr *)in->first.data)->opcode);
++ if (op < ARRAY_SIZE(cmd->stats)) {
++ stats = &cmd->stats[op];
++ spin_lock_irq(&stats->lock);
++ stats->sum += ds;
++ ++stats->n;
++ spin_unlock_irq(&stats->lock);
++ }
++ mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME,
++ "fw exec time for %s is %lld nsec\n",
++ mlx5_command_str(op), ds);
++ *status = ent->status;
+
+ out_free:
+ free_cmd(ent);
+@@ -1230,41 +1228,30 @@ err_dbg:
+ return err;
+ }
+
+-void mlx5_cmd_use_events(struct mlx5_core_dev *dev)
++static void mlx5_cmd_change_mod(struct mlx5_core_dev *dev, int mode)
+ {
+ struct mlx5_cmd *cmd = &dev->cmd;
+ int i;
+
+ for (i = 0; i < cmd->max_reg_cmds; i++)
+ down(&cmd->sem);
+-
+ down(&cmd->pages_sem);
+
+- flush_workqueue(cmd->wq);
+-
+- cmd->mode = CMD_MODE_EVENTS;
++ cmd->mode = mode;
+
+ up(&cmd->pages_sem);
+ for (i = 0; i < cmd->max_reg_cmds; i++)
+ up(&cmd->sem);
+ }
+
+-void mlx5_cmd_use_polling(struct mlx5_core_dev *dev)
++void mlx5_cmd_use_events(struct mlx5_core_dev *dev)
+ {
+- struct mlx5_cmd *cmd = &dev->cmd;
+- int i;
+-
+- for (i = 0; i < cmd->max_reg_cmds; i++)
+- down(&cmd->sem);
+-
+- down(&cmd->pages_sem);
+-
+- flush_workqueue(cmd->wq);
+- cmd->mode = CMD_MODE_POLLING;
++ mlx5_cmd_change_mod(dev, CMD_MODE_EVENTS);
++}
+
+- up(&cmd->pages_sem);
+- for (i = 0; i < cmd->max_reg_cmds; i++)
+- up(&cmd->sem);
++void mlx5_cmd_use_polling(struct mlx5_core_dev *dev)
++{
++ mlx5_cmd_change_mod(dev, CMD_MODE_POLLING);
+ }
+
+ static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg)
--- /dev/null
+From 418f8399a8bedf376ec13eb01088f04a76ebdd6f Mon Sep 17 00:00:00 2001
+From: Majd Dibbiny <majd@mellanox.com>
+Date: Fri, 10 Jun 2016 00:07:28 +0300
+Subject: net/mlx5: Fix the size of modify QP mailbox
+
+From: Majd Dibbiny <majd@mellanox.com>
+
+commit 418f8399a8bedf376ec13eb01088f04a76ebdd6f upstream.
+
+Add 16 reserved bytes at the end of mlx5_modify_qp_mbox_in to
+match the hardware spec definition.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Majd Dibbiny <majd@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mlx5/qp.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/linux/mlx5/qp.h
++++ b/include/linux/mlx5/qp.h
+@@ -539,6 +539,7 @@ struct mlx5_modify_qp_mbox_in {
+ __be32 optparam;
+ u8 rsvd1[4];
+ struct mlx5_qp_context ctx;
++ u8 rsvd2[16];
+ };
+
+ struct mlx5_modify_qp_mbox_out {
--- /dev/null
+From d57847dc4177c6fd8d950cb533f5edf0eab45b11 Mon Sep 17 00:00:00 2001
+From: Daniel Jurgens <danielj@mellanox.com>
+Date: Thu, 30 Jun 2016 17:34:41 +0300
+Subject: net/mlx5: Fix wait_vital for VFs and remove fixed sleep
+
+From: Daniel Jurgens <danielj@mellanox.com>
+
+commit d57847dc4177c6fd8d950cb533f5edf0eab45b11 upstream.
+
+The device ID for VFs is in a different location than PFs. This results
+in the poll always timing out for VFs. There's no good way to read the
+VF device ID without using the PF's configuration space. Switch to waiting
+for the health poll to start incrementing. Also remove the 1s sleep
+at the beginning.
+
+fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core
+driver')
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/main.c | 41 +++++++++----------------
+ 1 file changed, 15 insertions(+), 26 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
+@@ -1306,46 +1306,31 @@ void mlx5_disable_device(struct mlx5_cor
+ mlx5_pci_err_detected(dev->pdev, 0);
+ }
+
+-/* wait for the device to show vital signs. For now we check
+- * that we can read the device ID and that the health buffer
+- * shows a non zero value which is different than 0xffffffff
++/* wait for the device to show vital signs by waiting
++ * for the health counter to start counting.
+ */
+-static void wait_vital(struct pci_dev *pdev)
++static int wait_vital(struct pci_dev *pdev)
+ {
+ struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+ struct mlx5_core_health *health = &dev->priv.health;
+ const int niter = 100;
++ u32 last_count = 0;
+ u32 count;
+- u16 did;
+ int i;
+
+- /* Wait for firmware to be ready after reset */
+- msleep(1000);
+- for (i = 0; i < niter; i++) {
+- if (pci_read_config_word(pdev, 2, &did)) {
+- dev_warn(&pdev->dev, "failed reading config word\n");
+- break;
+- }
+- if (did == pdev->device) {
+- dev_info(&pdev->dev, "device ID correctly read after %d iterations\n", i);
+- break;
+- }
+- msleep(50);
+- }
+- if (i == niter)
+- dev_warn(&pdev->dev, "%s-%d: could not read device ID\n", __func__, __LINE__);
+-
+ for (i = 0; i < niter; i++) {
+ count = ioread32be(health->health_counter);
+ if (count && count != 0xffffffff) {
+- dev_info(&pdev->dev, "Counter value 0x%x after %d iterations\n", count, i);
+- break;
++ if (last_count && last_count != count) {
++ dev_info(&pdev->dev, "Counter value 0x%x after %d iterations\n", count, i);
++ return 0;
++ }
++ last_count = count;
+ }
+ msleep(50);
+ }
+
+- if (i == niter)
+- dev_warn(&pdev->dev, "%s-%d: could not read device ID\n", __func__, __LINE__);
++ return -ETIMEDOUT;
+ }
+
+ static void mlx5_pci_resume(struct pci_dev *pdev)
+@@ -1357,7 +1342,11 @@ static void mlx5_pci_resume(struct pci_d
+ dev_info(&pdev->dev, "%s was called\n", __func__);
+
+ pci_save_state(pdev);
+- wait_vital(pdev);
++ err = wait_vital(pdev);
++ if (err) {
++ dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
++ return;
++ }
+
+ err = mlx5_load_one(dev, priv);
+ if (err)
--- /dev/null
+From 6b6c07bdcdc97ccac2596063bfc32a5faddfe884 Mon Sep 17 00:00:00 2001
+From: Or Gerlitz <ogerlitz@mellanox.com>
+Date: Wed, 2 Mar 2016 00:13:39 +0200
+Subject: net/mlx5: Make command timeout way shorter
+
+From: Or Gerlitz <ogerlitz@mellanox.com>
+
+commit 6b6c07bdcdc97ccac2596063bfc32a5faddfe884 upstream.
+
+The command timeout is terribly long, whole two hours. Make it 60s so if
+things do go wrong, the user gets feedback in relatively short time, so
+they can take corrective actions and/or investigate using tools and such.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/mlx5/driver.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/mlx5/driver.h
++++ b/include/linux/mlx5/driver.h
+@@ -54,7 +54,7 @@ enum {
+ /* one minute for the sake of bringup. Generally, commands must always
+ * complete and we may need to increase this timeout value
+ */
+- MLX5_CMD_TIMEOUT_MSEC = 7200 * 1000,
++ MLX5_CMD_TIMEOUT_MSEC = 60 * 1000,
+ MLX5_CMD_WQ_MAX_NAME = 32,
+ };
+
--- /dev/null
+From f299a02d5f13c4deb52c1a7ddf2b42630fe6294a Mon Sep 17 00:00:00 2001
+From: Wang Sheng-Hui <shhuiw@foxmail.com>
+Date: Fri, 24 Jun 2016 08:52:11 +0800
+Subject: net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create
+
+From: Wang Sheng-Hui <shhuiw@foxmail.com>
+
+commit f299a02d5f13c4deb52c1a7ddf2b42630fe6294a upstream.
+
+Commit 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on
+reader NUMA node") introduced mlx5_*_alloc_node() but missed changing
+some calling and warn messages. This patch introduces 2 changes:
+ * Use mlx5_buf_alloc_node() instead of mlx5_buf_alloc() in
+ mlx5_wq_ll_create()
+ * Update the failure warn messages with _node postfix for
+ mlx5_*_alloc function names
+
+Fixes: 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on reader NUMA node")
+Signed-off-by: Wang Sheng-Hui <shhuiw@foxmail.com>
+Acked-By: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/wq.c | 15 ++++++++-------
+ 1 file changed, 8 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+@@ -75,14 +75,14 @@ int mlx5_wq_cyc_create(struct mlx5_core_
+
+ err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
+ if (err) {
+- mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
++ mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
+ return err;
+ }
+
+ err = mlx5_buf_alloc_node(mdev, mlx5_wq_cyc_get_byte_size(wq),
+ &wq_ctrl->buf, param->buf_numa_node);
+ if (err) {
+- mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
++ mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
+ goto err_db_free;
+ }
+
+@@ -111,14 +111,14 @@ int mlx5_cqwq_create(struct mlx5_core_de
+
+ err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
+ if (err) {
+- mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
++ mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
+ return err;
+ }
+
+ err = mlx5_buf_alloc_node(mdev, mlx5_cqwq_get_byte_size(wq),
+ &wq_ctrl->buf, param->buf_numa_node);
+ if (err) {
+- mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
++ mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
+ goto err_db_free;
+ }
+
+@@ -148,13 +148,14 @@ int mlx5_wq_ll_create(struct mlx5_core_d
+
+ err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
+ if (err) {
+- mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
++ mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
+ return err;
+ }
+
+- err = mlx5_buf_alloc(mdev, mlx5_wq_ll_get_byte_size(wq), &wq_ctrl->buf);
++ err = mlx5_buf_alloc_node(mdev, mlx5_wq_ll_get_byte_size(wq),
++ &wq_ctrl->buf, param->buf_numa_node);
+ if (err) {
+- mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
++ mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
+ goto err_db_free;
+ }
+
--- /dev/null
+From e3a19b53cbb0e6738b7a547f262179065b72e3fa Mon Sep 17 00:00:00 2001
+From: Matthew Finlay <matt@mellanox.com>
+Date: Thu, 30 Jun 2016 17:34:47 +0300
+Subject: net/mlx5e: Copy all L2 headers into inline segment
+
+From: Matthew Finlay <matt@mellanox.com>
+
+commit e3a19b53cbb0e6738b7a547f262179065b72e3fa upstream.
+
+ConnectX4-Lx uses an inline wqe mode that currently defaults to
+requiring the entire L2 header be included in the wqe.
+This patch fixes mlx5e_get_inline_hdr_size() to account for
+all L2 headers (VLAN, QinQ, etc) using skb_network_offset(skb).
+
+Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files")
+Signed-off-by: Matthew Finlay <matt@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -124,7 +124,7 @@ static inline u16 mlx5e_get_inline_hdr_s
+ * headers and occur before the data gather.
+ * Therefore these headers must be copied into the WQE
+ */
+-#define MLX5E_MIN_INLINE ETH_HLEN
++#define MLX5E_MIN_INLINE (ETH_HLEN + VLAN_HLEN)
+
+ if (bf) {
+ u16 ihs = skb_headlen(skb);
+@@ -136,7 +136,7 @@ static inline u16 mlx5e_get_inline_hdr_s
+ return skb_headlen(skb);
+ }
+
+- return MLX5E_MIN_INLINE;
++ return max(skb_network_offset(skb), MLX5E_MIN_INLINE);
+ }
+
+ static inline void mlx5e_insert_vlan(void *start, struct sk_buff *skb, u16 ihs)
--- /dev/null
+From 0ca00fc1f808602137dc6d51f17747b3bb0fc34d Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli@mellanox.com>
+Date: Fri, 10 Jun 2016 00:07:40 +0300
+Subject: net/mlx5e: Fix blue flame quota logic
+
+From: Eli Cohen <eli@mellanox.com>
+
+commit 0ca00fc1f808602137dc6d51f17747b3bb0fc34d upstream.
+
+Blue flame is a latency enhancement feature that allows the driver to
+write the packet data directly to the NIC's registers thus making the
+read of the packet data from host memory redundant.
+
+We maintain a quota for the blue flame which is reloaded whenever we
+identify that the hardware is processing send requests and processes
+them fast enough so by the time we post the next send request it was
+able to process all the pending ones. This indicates that the hardware
+is capable of processing more blue flame requests efficiently. The blue
+flame quota is decremented whenever we send using blue flame.
+
+The current code erroneously clears the budget if we did not use blue
+flame for the current post send operation and we fix it here.
+
+Fixes: 88a85f99e51f ('net/mlx5e: TX latency optimization to save DMA reads')
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en_tx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+@@ -290,7 +290,8 @@ static netdev_tx_t mlx5e_sq_xmit(struct
+ while ((sq->pc & wq->sz_m1) > sq->edge)
+ mlx5e_send_nop(sq, false);
+
+- sq->bf_budget = bf ? sq->bf_budget - 1 : 0;
++ if (bf)
++ sq->bf_budget--;
+
+ sq->stats.packets++;
+ return NETDEV_TX_OK;
--- /dev/null
+From 6e4c21894673baabdbef03c3ac2458a28246128b Mon Sep 17 00:00:00 2001
+From: Rana Shahout <ranas@mellanox.com>
+Date: Fri, 22 Apr 2016 00:33:01 +0300
+Subject: net/mlx5e: Fix MLX5E_100BASE_T define
+
+From: Rana Shahout <ranas@mellanox.com>
+
+commit 6e4c21894673baabdbef03c3ac2458a28246128b upstream.
+
+Bit 25 of eth_proto_capability in PTYS register is
+1000Base-TT and not 100Base-T.
+
+Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to
+support ConnectX-4 Ethernet functionality')
+Signed-off-by: Rana Shahout <ranas@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx5/core/en.h | 2 +-
+ drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
+@@ -543,7 +543,7 @@ enum mlx5e_link_mode {
+ MLX5E_100GBASE_KR4 = 22,
+ MLX5E_100GBASE_LR4 = 23,
+ MLX5E_100BASE_TX = 24,
+- MLX5E_100BASE_T = 25,
++ MLX5E_1000BASE_T = 25,
+ MLX5E_10GBASE_T = 26,
+ MLX5E_25GBASE_CR = 27,
+ MLX5E_25GBASE_KR = 28,
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+@@ -138,10 +138,10 @@ static const struct {
+ [MLX5E_100BASE_TX] = {
+ .speed = 100,
+ },
+- [MLX5E_100BASE_T] = {
+- .supported = SUPPORTED_100baseT_Full,
+- .advertised = ADVERTISED_100baseT_Full,
+- .speed = 100,
++ [MLX5E_1000BASE_T] = {
++ .supported = SUPPORTED_1000baseT_Full,
++ .advertised = ADVERTISED_1000baseT_Full,
++ .speed = 1000,
+ },
+ [MLX5E_10GBASE_T] = {
+ .supported = SUPPORTED_10000baseT_Full,
--- /dev/null
+From a27758ffaf96f89002129eedb2cc172d254099f8 Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Fri, 3 Jun 2016 15:05:57 -0700
+Subject: net_sched: keep backlog updated with qlen
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit a27758ffaf96f89002129eedb2cc172d254099f8 upstream.
+
+For gso_skb we only update qlen, backlog should be updated too.
+
+Note, it is correct to just update these stats at one layer,
+because the gso_skb is cached there.
+
+Reported-by: Stas Nichiporovich <stasn77@gmail.com>
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/sch_generic.h | 5 ++++-
+ net/sched/sch_generic.c | 2 ++
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -674,9 +674,11 @@ static inline struct sk_buff *qdisc_peek
+ /* we can reuse ->gso_skb because peek isn't called for root qdiscs */
+ if (!sch->gso_skb) {
+ sch->gso_skb = sch->dequeue(sch);
+- if (sch->gso_skb)
++ if (sch->gso_skb) {
+ /* it's still part of the queue */
++ qdisc_qstats_backlog_inc(sch, sch->gso_skb);
+ sch->q.qlen++;
++ }
+ }
+
+ return sch->gso_skb;
+@@ -689,6 +691,7 @@ static inline struct sk_buff *qdisc_dequ
+
+ if (skb) {
+ sch->gso_skb = NULL;
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ } else {
+ skb = sch->dequeue(sch);
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -49,6 +49,7 @@ static inline int dev_requeue_skb(struct
+ {
+ q->gso_skb = skb;
+ q->qstats.requeues++;
++ qdisc_qstats_backlog_inc(q, skb);
+ q->q.qlen++; /* it's still part of the queue */
+ __netif_schedule(q);
+
+@@ -92,6 +93,7 @@ static struct sk_buff *dequeue_skb(struc
+ txq = skb_get_tx_queue(txq->dev, skb);
+ if (!netif_xmit_frozen_or_stopped(txq)) {
+ q->gso_skb = NULL;
++ qdisc_qstats_backlog_dec(q, skb);
+ q->q.qlen--;
+ } else
+ skb = NULL;
--- /dev/null
+From 17ae1c650c1ecf8dc8e16d54b0f68a345965f43f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 3 Nov 2016 18:40:19 +0100
+Subject: phy: fix device reference leaks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 17ae1c650c1ecf8dc8e16d54b0f68a345965f43f upstream.
+
+Make sure to drop the reference taken by bus_find_device_by_name()
+before returning from phy_connect() and phy_attach().
+
+Note that both function still take a reference to the phy device
+through phy_attach_direct().
+
+Fixes: e13934563db0 ("[PATCH] PHY Layer fixup")
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/phy/phy_device.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -522,6 +522,7 @@ struct phy_device *phy_connect(struct ne
+ phydev = to_phy_device(d);
+
+ rc = phy_connect_direct(dev, phydev, handler, interface);
++ put_device(d);
+ if (rc)
+ return ERR_PTR(rc);
+
+@@ -721,6 +722,7 @@ struct phy_device *phy_attach(struct net
+ phydev = to_phy_device(d);
+
+ rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
++ put_device(d);
+ if (rc)
+ return ERR_PTR(rc);
+
--- /dev/null
+From 6a73b571b63075ef408c83f07c2565b5652f93cc Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Wed, 1 Jun 2016 16:15:17 -0700
+Subject: sch_drr: update backlog as well
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit 6a73b571b63075ef408c83f07c2565b5652f93cc upstream.
+
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_drr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/sched/sch_drr.c
++++ b/net/sched/sch_drr.c
+@@ -375,6 +375,7 @@ static int drr_enqueue(struct sk_buff *s
+ cl->deficit = cl->quantum;
+ }
+
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ return err;
+ }
+@@ -405,6 +406,7 @@ static struct sk_buff *drr_dequeue(struc
+
+ bstats_update(&cl->bstats, skb);
+ qdisc_bstats_update(sch, skb);
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ return skb;
+ }
+@@ -426,6 +428,7 @@ static unsigned int drr_drop(struct Qdis
+ if (cl->qdisc->ops->drop) {
+ len = cl->qdisc->ops->drop(cl->qdisc);
+ if (len > 0) {
++ sch->qstats.backlog -= len;
+ sch->q.qlen--;
+ if (cl->qdisc->q.qlen == 0)
+ list_del(&cl->alist);
+@@ -461,6 +464,7 @@ static void drr_reset_qdisc(struct Qdisc
+ qdisc_reset(cl->qdisc);
+ }
+ }
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ }
+
--- /dev/null
+From 357cc9b4a8a7a0cd0e662537b76e6fa4670b6798 Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Wed, 1 Jun 2016 16:15:15 -0700
+Subject: sch_hfsc: always keep backlog updated
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit 357cc9b4a8a7a0cd0e662537b76e6fa4670b6798 upstream.
+
+hfsc updates backlog lazily, that is only when we
+dump the stats. This is problematic after we begin to
+update backlog in qdisc_tree_reduce_backlog().
+
+Reported-by: Stas Nichiporovich <stasn77@gmail.com>
+Tested-by: Stas Nichiporovich <stasn77@gmail.com>
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_hfsc.c | 12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/net/sched/sch_hfsc.c
++++ b/net/sched/sch_hfsc.c
+@@ -1529,6 +1529,7 @@ hfsc_reset_qdisc(struct Qdisc *sch)
+ q->eligible = RB_ROOT;
+ INIT_LIST_HEAD(&q->droplist);
+ qdisc_watchdog_cancel(&q->watchdog);
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ }
+
+@@ -1559,14 +1560,6 @@ hfsc_dump_qdisc(struct Qdisc *sch, struc
+ struct hfsc_sched *q = qdisc_priv(sch);
+ unsigned char *b = skb_tail_pointer(skb);
+ struct tc_hfsc_qopt qopt;
+- struct hfsc_class *cl;
+- unsigned int i;
+-
+- sch->qstats.backlog = 0;
+- for (i = 0; i < q->clhash.hashsize; i++) {
+- hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
+- sch->qstats.backlog += cl->qdisc->qstats.backlog;
+- }
+
+ qopt.defcls = q->defcls;
+ if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
+@@ -1604,6 +1597,7 @@ hfsc_enqueue(struct sk_buff *skb, struct
+ if (cl->qdisc->q.qlen == 1)
+ set_active(cl, qdisc_pkt_len(skb));
+
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+
+ return NET_XMIT_SUCCESS;
+@@ -1672,6 +1666,7 @@ hfsc_dequeue(struct Qdisc *sch)
+
+ qdisc_unthrottled(sch);
+ qdisc_bstats_update(sch, skb);
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+
+ return skb;
+@@ -1695,6 +1690,7 @@ hfsc_drop(struct Qdisc *sch)
+ }
+ cl->qstats.drops++;
+ qdisc_qstats_drop(sch);
++ sch->qstats.backlog -= len;
+ sch->q.qlen--;
+ return len;
+ }
--- /dev/null
+From 6529d75ad9228f4d8a8f6c5c5244ceb945ac9bc2 Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Wed, 1 Jun 2016 16:15:16 -0700
+Subject: sch_prio: update backlog as well
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit 6529d75ad9228f4d8a8f6c5c5244ceb945ac9bc2 upstream.
+
+We need to update backlog too when we update qlen.
+
+Joint work with Stas.
+
+Reported-by: Stas Nichiporovich <stasn77@gmail.com>
+Tested-by: Stas Nichiporovich <stasn77@gmail.com>
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_prio.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/sched/sch_prio.c
++++ b/net/sched/sch_prio.c
+@@ -85,6 +85,7 @@ prio_enqueue(struct sk_buff *skb, struct
+
+ ret = qdisc_enqueue(skb, qdisc);
+ if (ret == NET_XMIT_SUCCESS) {
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ return NET_XMIT_SUCCESS;
+ }
+@@ -117,6 +118,7 @@ static struct sk_buff *prio_dequeue(stru
+ struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
+ if (skb) {
+ qdisc_bstats_update(sch, skb);
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ return skb;
+ }
+@@ -135,6 +137,7 @@ static unsigned int prio_drop(struct Qdi
+ for (prio = q->bands-1; prio >= 0; prio--) {
+ qdisc = q->queues[prio];
+ if (qdisc->ops->drop && (len = qdisc->ops->drop(qdisc)) != 0) {
++ sch->qstats.backlog -= len;
+ sch->q.qlen--;
+ return len;
+ }
+@@ -151,6 +154,7 @@ prio_reset(struct Qdisc *sch)
+
+ for (prio = 0; prio < q->bands; prio++)
+ qdisc_reset(q->queues[prio]);
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ }
+
--- /dev/null
+From 2ed5c3f09627f72a2e0e407a86b2ac05494190f9 Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Sun, 18 Sep 2016 16:22:47 -0700
+Subject: sch_qfq: keep backlog updated with qlen
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit 2ed5c3f09627f72a2e0e407a86b2ac05494190f9 upstream.
+
+Reported-by: Stas Nichiporovich <stasn77@gmail.com>
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_qfq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sched/sch_qfq.c
++++ b/net/sched/sch_qfq.c
+@@ -1150,6 +1150,7 @@ static struct sk_buff *qfq_dequeue(struc
+ if (!skb)
+ return NULL;
+
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ qdisc_bstats_update(sch, skb);
+
+@@ -1250,6 +1251,7 @@ static int qfq_enqueue(struct sk_buff *s
+ }
+
+ bstats_update(&cl->bstats, skb);
++ qdisc_qstats_backlog_inc(sch, skb);
+ ++sch->q.qlen;
+
+ agg = cl->agg;
+@@ -1516,6 +1518,7 @@ static void qfq_reset_qdisc(struct Qdisc
+ qdisc_reset(cl->qdisc);
+ }
+ }
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ }
+
--- /dev/null
+From 3d4357fba82b3cf19ebf0a04d1c9cb086af15d02 Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Sun, 18 Sep 2016 16:22:48 -0700
+Subject: sch_sfb: keep backlog updated with qlen
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit 3d4357fba82b3cf19ebf0a04d1c9cb086af15d02 upstream.
+
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_sfb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sched/sch_sfb.c
++++ b/net/sched/sch_sfb.c
+@@ -400,6 +400,7 @@ static int sfb_enqueue(struct sk_buff *s
+ enqueue:
+ ret = qdisc_enqueue(skb, child);
+ if (likely(ret == NET_XMIT_SUCCESS)) {
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ increment_qlen(skb, q);
+ } else if (net_xmit_drop_count(ret)) {
+@@ -428,6 +429,7 @@ static struct sk_buff *sfb_dequeue(struc
+
+ if (skb) {
+ qdisc_bstats_update(sch, skb);
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ decrement_qlen(skb, q);
+ }
+@@ -450,6 +452,7 @@ static void sfb_reset(struct Qdisc *sch)
+ struct sfb_sched_data *q = qdisc_priv(sch);
+
+ qdisc_reset(q->qdisc);
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ q->slot = 0;
+ q->double_buffering = false;
--- /dev/null
+From 8d5958f424b62060a8696b12c17dad198d5d386f Mon Sep 17 00:00:00 2001
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Wed, 1 Jun 2016 16:15:19 -0700
+Subject: sch_tbf: update backlog as well
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+commit 8d5958f424b62060a8696b12c17dad198d5d386f upstream.
+
+Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_tbf.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/sched/sch_tbf.c
++++ b/net/sched/sch_tbf.c
+@@ -197,6 +197,7 @@ static int tbf_enqueue(struct sk_buff *s
+ return ret;
+ }
+
++ qdisc_qstats_backlog_inc(sch, skb);
+ sch->q.qlen++;
+ return NET_XMIT_SUCCESS;
+ }
+@@ -207,6 +208,7 @@ static unsigned int tbf_drop(struct Qdis
+ unsigned int len = 0;
+
+ if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop(q->qdisc)) != 0) {
++ sch->qstats.backlog -= len;
+ sch->q.qlen--;
+ qdisc_qstats_drop(sch);
+ }
+@@ -253,6 +255,7 @@ static struct sk_buff *tbf_dequeue(struc
+ q->t_c = now;
+ q->tokens = toks;
+ q->ptokens = ptoks;
++ qdisc_qstats_backlog_dec(sch, skb);
+ sch->q.qlen--;
+ qdisc_unthrottled(sch);
+ qdisc_bstats_update(sch, skb);
+@@ -284,6 +287,7 @@ static void tbf_reset(struct Qdisc *sch)
+ struct tbf_sched_data *q = qdisc_priv(sch);
+
+ qdisc_reset(q->qdisc);
++ sch->qstats.backlog = 0;
+ sch->q.qlen = 0;
+ q->t_c = ktime_get_ns();
+ q->tokens = q->buffer;
ovs-gre-geneve-fix-error-path-when-creating-an-iface.patch
gre-disable-segmentation-offloads-w-csum-and-we-are-encapsulated-via-fou.patch
powerpc-pci-of-parse-unassigned-resources.patch
+firmware-actually-return-null-on-failed-request_firmware_nowait.patch
+c8sectpfe-rework-firmware-loading-mechanism.patch
+net-mlx5-avoid-passing-dma-address-0-to-firmware.patch
+ib-mlx5-fix-rc-transport-send-queue-overhead-computation.patch
+net-mlx5-make-command-timeout-way-shorter.patch
+ib-mlx5-fix-fw-version-diaplay-in-sysfs.patch
+net-mlx5e-fix-mlx5e_100base_t-define.patch
+net-mlx5-fix-the-size-of-modify-qp-mailbox.patch
+net-mlx5-fix-masking-of-reserved-bits-in-xrcd-number.patch
+net-mlx5e-fix-blue-flame-quota-logic.patch
+net-mlx5-use-mlx5_buf_alloc_node-instead-of-mlx5_buf_alloc-in-mlx5_wq_ll_create.patch
+net-mlx5-avoid-calling-sleeping-function-by-the-health-poll-thread.patch
+net-mlx5-fix-wait_vital-for-vfs-and-remove-fixed-sleep.patch
+net-mlx5-fix-potential-deadlock-in-command-mode-change.patch
+net-mlx5-add-timeout-handle-to-commands-with-callback.patch
+net-mlx5-fix-pci-error-recovery-flow.patch
+net-mlx5e-copy-all-l2-headers-into-inline-segment.patch
+net_sched-keep-backlog-updated-with-qlen.patch
+sch_drr-update-backlog-as-well.patch
+sch_hfsc-always-keep-backlog-updated.patch
+sch_prio-update-backlog-as-well.patch
+sch_qfq-keep-backlog-updated-with-qlen.patch
+sch_sfb-keep-backlog-updated-with-qlen.patch
+sch_tbf-update-backlog-as-well.patch
+btrfs-cleaner_kthread-doesn-t-need-explicit-freeze.patch
+irda-free-skb-on-irda_accept-error-path.patch
+phy-fix-device-reference-leaks.patch
+bonding-prevent-out-of-bound-accesses.patch
+mtd-nand-fix-onfi-parameter-page-layout.patch
+ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
