--- /dev/null
+From e93d97349d8be9108b4537be2f9fdf8d56929188 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:07:28 +1100
+Subject: airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 78f7a7566f5eb59321e99b55a6fdb16ea05b37d1 ]
+
+The driver for Cisco Aironet 4500 and 4800 series cards (airo.c),
+implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().
+
+The ioctl handler copies an aironet_ioctl struct from userspace, which
+includes a command. Some of the commands are handled in readrids(),
+where the user controlled command is converted into a driver-internal
+value called "ridcode".
+
+There are two command values, AIROGWEPKTMP and AIROGWEPKNV, which
+correspond to ridcode values of RID_WEP_TEMP and RID_WEP_PERM
+respectively. These commands both have checks that the user has
+CAP_NET_ADMIN, with the comment that "Only super-user can read WEP
+keys", otherwise they return -EPERM.
+
+However there is another command value, AIRORRID, that lets the user
+specify the ridcode value directly, with no other checks. This means
+the user can bypass the CAP_NET_ADMIN check on AIROGWEPKTMP and
+AIROGWEPKNV.
+
+Fix it by moving the CAP_NET_ADMIN check out of the command handling
+and instead do it later based on the ridcode. That way regardless of
+whether the ridcode is set via AIROGWEPKTMP or AIROGWEPKNV, or passed
+in using AIRORID, we always do the CAP_NET_ADMIN check.
+
+Found by Ilja by code inspection, not tested as I don't have the
+required hardware.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/cisco/airo.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 9344cf17d6b11..c3fe9bfff8122 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -7786,16 +7786,8 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ case AIROGVLIST: ridcode = RID_APLIST; break;
+ case AIROGDRVNAM: ridcode = RID_DRVNAME; break;
+ case AIROGEHTENC: ridcode = RID_ETHERENCAP; break;
+- case AIROGWEPKTMP: ridcode = RID_WEP_TEMP;
+- /* Only super-user can read WEP keys */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- break;
+- case AIROGWEPKNV: ridcode = RID_WEP_PERM;
+- /* Only super-user can read WEP keys */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- break;
++ case AIROGWEPKTMP: ridcode = RID_WEP_TEMP; break;
++ case AIROGWEPKNV: ridcode = RID_WEP_PERM; break;
+ case AIROGSTAT: ridcode = RID_STATUS; break;
+ case AIROGSTATSD32: ridcode = RID_STATSDELTA; break;
+ case AIROGSTATSC32: ridcode = RID_STATS; break;
+@@ -7809,6 +7801,12 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ return -EINVAL;
+ }
+
++ if (ridcode == RID_WEP_TEMP || ridcode == RID_WEP_PERM) {
++ /* Only super-user can read WEP keys */
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++ }
++
+ if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From 4dedfff63ad838c3aeab0069bfafd08da37972a2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:07:27 +1100
+Subject: airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit d6bce2137f5d6bb1093e96d2f801479099b28094 ]
+
+The driver for Cisco Aironet 4500 and 4800 series cards (airo.c),
+implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().
+
+The ioctl handler copies an aironet_ioctl struct from userspace, which
+includes a command and a length. Some of the commands are handled in
+readrids(), which kmalloc()'s a buffer of RIDSIZE (2048) bytes.
+
+That buffer is then passed to PC4500_readrid(), which has two cases.
+The else case does some setup and then reads up to RIDSIZE bytes from
+the hardware into the kmalloc()'ed buffer.
+
+Here len == RIDSIZE, pBuf is the kmalloc()'ed buffer:
+
+ // read the rid length field
+ bap_read(ai, pBuf, 2, BAP1);
+ // length for remaining part of rid
+ len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2;
+ ...
+ // read remainder of the rid
+ rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1);
+
+PC4500_readrid() then returns to readrids() which does:
+
+ len = comp->len;
+ if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) {
+
+Where comp->len is the user controlled length field.
+
+So if the "rid length field" returned by the hardware is < 2048, and
+the user requests 2048 bytes in comp->len, we will leak the previous
+contents of the kmalloc()'ed buffer to userspace.
+
+Fix it by kzalloc()'ing the buffer.
+
+Found by Ilja by code inspection, not tested as I don't have the
+required hardware.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/cisco/airo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 5512c7f73fce8..9344cf17d6b11 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -7809,7 +7809,7 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ return -EINVAL;
+ }
+
+- if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
++ if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+
+ PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1);
+--
+2.20.1
+
--- /dev/null
+From b6fa1249d189e0acfbc01182fa4529a6e43a6950 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 15:07:46 +0100
+Subject: ARM: 8955/1: virt: Relax arch timer version check during early boot
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e ]
+
+Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to
+have values other than 0 or 1 while still preserving backward
+compatibility. At the moment, Linux is quite strict in the way it
+handles this field at early boot and will not configure arch timer if
+it doesn't find the value 1.
+
+Since here use ubfx for arch timer version extraction (hyb-stub build
+with -march=armv7-a, so it is safe)
+
+To help backports (even though the code was correct at the time of writing)
+
+Fixes: 8ec58be9f3ff ("ARM: virt: arch_timers: enable access to physical timers")
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/hyp-stub.S | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index 82a942894fc04..83e463c05dcdb 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -159,10 +159,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
+ #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
+ @ make CNTP_* and CNTPCT accessible from PL1
+ mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1
+- lsr r7, #16
+- and r7, #0xf
+- cmp r7, #1
+- bne 1f
++ ubfx r7, r7, #16, #4
++ teq r7, #0
++ beq 1f
+ mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL
+ orr r7, r7, #3 @ PL1PCEN | PL1PCTEN
+ mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL
+--
+2.20.1
+
--- /dev/null
+From 3add648d5129512c12b1b6fa99feb594340da138 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 16:09:08 +0300
+Subject: ARM: dts: am335x-boneblack-common: fix memory size
+
+From: Matwey V. Kornilov <matwey@sai.msu.ru>
+
+[ Upstream commit 5abd45ea0fc3060f7805e131753fdcbafd6c6618 ]
+
+BeagleBone Black series is equipped with 512MB RAM
+whereas only 256MB is included from am335x-bone-common.dtsi
+
+This leads to an issue with unusual setups when devicetree
+is loaded by GRUB2 directly.
+
+Signed-off-by: Matwey V. Kornilov <matwey@sai.msu.ru>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am335x-boneblack-common.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am335x-boneblack-common.dtsi b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+index 21bc1173fa6b9..cb4267edde63d 100644
+--- a/arch/arm/boot/dts/am335x-boneblack-common.dtsi
++++ b/arch/arm/boot/dts/am335x-boneblack-common.dtsi
+@@ -131,6 +131,11 @@
+ };
+
+ / {
++ memory@80000000 {
++ device_type = "memory";
++ reg = <0x80000000 0x20000000>; /* 512 MB */
++ };
++
+ clk_mcasp0_fixed: clk_mcasp0_fixed {
+ #clock-cells = <0>;
+ compatible = "fixed-clock";
+--
+2.20.1
+
--- /dev/null
+From 3e7185718ac966db1299fdaa0f2d0db801a98325 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 19 Jan 2020 16:58:59 +0530
+Subject: ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
+
+From: Raag Jadav <raagjadav@gmail.com>
+
+[ Upstream commit b0b03951544534d6d9ad4aa2787eefec988fff20 ]
+
+Set d0 and d1 pin directions for spi0 and spi1 as per their pinmux.
+
+Signed-off-by: Raag Jadav <raagjadav@gmail.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am43x-epos-evm.dts | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts
+index 12735cf9674bb..b6950eee550b2 100644
+--- a/arch/arm/boot/dts/am43x-epos-evm.dts
++++ b/arch/arm/boot/dts/am43x-epos-evm.dts
+@@ -839,6 +839,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi0_pins_default>;
+ pinctrl-1 = <&spi0_pins_sleep>;
++ ti,pindir-d0-out-d1-in = <1>;
+ };
+
+ &spi1 {
+@@ -846,6 +847,7 @@
+ pinctrl-names = "default", "sleep";
+ pinctrl-0 = <&spi1_pins_default>;
+ pinctrl-1 = <&spi1_pins_sleep>;
++ ti,pindir-d0-out-d1-in = <1>;
+ };
+
+ &usb2_phy1 {
+--
+2.20.1
+
--- /dev/null
+From 3b3fd258f9e3c96314883632e0cbbc288bd6fe0f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 14:21:22 +0530
+Subject: ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint
+ dt nodes
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit 81cc0877840f72210e809bbedd6346d686560fc1 ]
+
+PERST# line in the PCIE connector is driven by the host mode and not
+EP mode. The gpios property here is used for driving the PERST# line.
+Remove gpios property from all endpoint device tree nodes.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/am571x-idk.dts | 4 ----
+ arch/arm/boot/dts/am572x-idk-common.dtsi | 4 ----
+ arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 4 ----
+ 3 files changed, 12 deletions(-)
+
+diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
+index bf4163eb6b2ac..510f61d20b6d6 100644
+--- a/arch/arm/boot/dts/am571x-idk.dts
++++ b/arch/arm/boot/dts/am571x-idk.dts
+@@ -93,10 +93,6 @@
+ gpios = <&gpio5 18 GPIO_ACTIVE_HIGH>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+-};
+-
+ &mmc1 {
+ pinctrl-names = "default", "hs";
+ pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
+diff --git a/arch/arm/boot/dts/am572x-idk-common.dtsi b/arch/arm/boot/dts/am572x-idk-common.dtsi
+index 784639ddf4513..8a7d34c8ae115 100644
+--- a/arch/arm/boot/dts/am572x-idk-common.dtsi
++++ b/arch/arm/boot/dts/am572x-idk-common.dtsi
+@@ -71,10 +71,6 @@
+ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>;
+-};
+-
+ &mailbox5 {
+ status = "okay";
+ mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index d53532b479475..872382bd043f8 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -550,10 +550,6 @@
+ gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+ };
+
+-&pcie1_ep {
+- gpios = <&gpio2 8 GPIO_ACTIVE_LOW>;
+-};
+-
+ &mcasp3 {
+ #sound-dai-cells = <0>;
+ assigned-clocks = <&l4per_clkctrl DRA7_MCASP3_CLKCTRL 24>;
+--
+2.20.1
+
--- /dev/null
+From 635a04020ff77f83f0565b03c365a9ed695f7b92 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 14:21:24 +0530
+Subject: ARM: dts: beagle-x15-common: Model 5V0 regulator
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit e17e7c498d4f734df93c300441e100818ed58168 ]
+
+On am57xx-beagle-x15, 5V0 is connected to P16, P17, P18 and P19
+connectors. On am57xx-evm, 5V0 regulator is used to get 3V6 regulator
+which is connected to the COMQ port. Model 5V0 regulator here in order
+for it to be used in am57xx-evm to model 3V6 regulator.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/am57xx-beagle-x15-common.dtsi | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index 872382bd043f8..0051b2e05c2d5 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -32,6 +32,27 @@
+ reg = <0x0 0x80000000 0x0 0x80000000>;
+ };
+
++ main_12v0: fixedregulator-main_12v0 {
++ /* main supply */
++ compatible = "regulator-fixed";
++ regulator-name = "main_12v0";
++ regulator-min-microvolt = <12000000>;
++ regulator-max-microvolt = <12000000>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
++ evm_5v0: fixedregulator-evm_5v0 {
++ /* Output of TPS54531D */
++ compatible = "regulator-fixed";
++ regulator-name = "evm_5v0";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ vin-supply = <&main_12v0>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
+ vdd_3v3: fixedregulator-vdd_3v3 {
+ compatible = "regulator-fixed";
+ regulator-name = "vdd_3v3";
+--
+2.20.1
+
--- /dev/null
+From 9f04c55767482d27f54313c084e7cad0d7fa8242 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 15:52:17 +0100
+Subject: ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
+
+From: Marek Szyprowski <m.szyprowski@samsung.com>
+
+[ Upstream commit 1c226017d3ec93547b58082bdf778d9db7401c95 ]
+
+Current USB3503 driver ignores GPIO polarity and always operates as if the
+GPIO lines were flagged as ACTIVE_HIGH. Fix the polarity for the existing
+USB3503 chip applications to match the chip specification and common
+convention for naming the pins. The only pin, which has to be ACTIVE_LOW
+is the reset pin. The remaining are ACTIVE_HIGH. This change allows later
+to fix the USB3503 driver to properly use generic GPIO bindings and read
+polarity from DT.
+
+Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+index e5f0645e53a7b..7e74ba83f8095 100644
+--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+@@ -90,7 +90,7 @@
+ initial-mode = <1>; /* initialize in HUB mode */
+ disabled-ports = <1>;
+ intn-gpios = <&pio 7 5 GPIO_ACTIVE_HIGH>; /* PH5 */
+- reset-gpios = <&pio 4 16 GPIO_ACTIVE_HIGH>; /* PE16 */
++ reset-gpios = <&pio 4 16 GPIO_ACTIVE_LOW>; /* PE16 */
+ connect-gpios = <&pio 4 17 GPIO_ACTIVE_HIGH>; /* PE17 */
+ refclk-frequency = <19200000>;
+ };
+--
+2.20.1
+
--- /dev/null
+From 996abe5f6dbcb8e8eb3dbf8c50c92a482334870e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 04:47:07 +0300
+Subject: ASoC: rt5640: Fix NULL dereference on module unload
+
+From: Dmitry Osipenko <digetx@gmail.com>
+
+[ Upstream commit 89b71b3f02d8ae5a08a1dd6f4a2098b7b868d498 ]
+
+The rt5640->jack is NULL if jack is already disabled at the time of
+driver's module unloading.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Link: https://lore.kernel.org/r/20200106014707.11378-1-digetx@gmail.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/rt5640.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/sound/soc/codecs/rt5640.c b/sound/soc/codecs/rt5640.c
+index 27770143ae8f2..974e1a4491723 100644
+--- a/sound/soc/codecs/rt5640.c
++++ b/sound/soc/codecs/rt5640.c
+@@ -2435,6 +2435,13 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component)
+ {
+ struct rt5640_priv *rt5640 = snd_soc_component_get_drvdata(component);
+
++ /*
++ * soc_remove_component() force-disables jack and thus rt5640->jack
++ * could be NULL at the time of driver's module unloading.
++ */
++ if (!rt5640->jack)
++ return;
++
+ disable_irq(rt5640->irq);
+ rt5640_cancel_work(rt5640);
+
+--
+2.20.1
+
--- /dev/null
+From 000ee147d86b8bf17a6ac0009f1af7828c19ee95 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 11:04:00 +0100
+Subject: ASoC: sti: fix possible sleep-in-atomic
+
+From: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+
+[ Upstream commit ce780a47c3c01e1e179d0792df6b853a913928f1 ]
+
+Change mutex and spinlock management to avoid sleep
+in atomic issue.
+
+Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@st.com>
+Link: https://lore.kernel.org/r/20200113100400.30472-1-arnaud.pouliquen@st.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sti/uniperif_player.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/sound/soc/sti/uniperif_player.c b/sound/soc/sti/uniperif_player.c
+index 313dab2857ef9..4b0beb372cd94 100644
+--- a/sound/soc/sti/uniperif_player.c
++++ b/sound/soc/sti/uniperif_player.c
+@@ -226,7 +226,6 @@ static void uni_player_set_channel_status(struct uniperif *player,
+ * sampling frequency. If no sample rate is already specified, then
+ * set one.
+ */
+- mutex_lock(&player->ctrl_lock);
+ if (runtime) {
+ switch (runtime->rate) {
+ case 22050:
+@@ -303,7 +302,6 @@ static void uni_player_set_channel_status(struct uniperif *player,
+ player->stream_settings.iec958.status[3 + (n * 4)] << 24;
+ SET_UNIPERIF_CHANNEL_STA_REGN(player, n, status);
+ }
+- mutex_unlock(&player->ctrl_lock);
+
+ /* Update the channel status */
+ if (player->ver < SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0)
+@@ -365,8 +363,10 @@ static int uni_player_prepare_iec958(struct uniperif *player,
+
+ SET_UNIPERIF_CTRL_ZERO_STUFF_HW(player);
+
++ mutex_lock(&player->ctrl_lock);
+ /* Update the channel status */
+ uni_player_set_channel_status(player, runtime);
++ mutex_unlock(&player->ctrl_lock);
+
+ /* Clear the user validity user bits */
+ SET_UNIPERIF_USER_VALIDITY_VALIDITY_LR(player, 0);
+@@ -598,7 +598,6 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
+ iec958->status[1] = ucontrol->value.iec958.status[1];
+ iec958->status[2] = ucontrol->value.iec958.status[2];
+ iec958->status[3] = ucontrol->value.iec958.status[3];
+- mutex_unlock(&player->ctrl_lock);
+
+ spin_lock_irqsave(&player->irq_lock, flags);
+ if (player->substream && player->substream->runtime)
+@@ -608,6 +607,8 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,
+ uni_player_set_channel_status(player, NULL);
+
+ spin_unlock_irqrestore(&player->irq_lock, flags);
++ mutex_unlock(&player->ctrl_lock);
++
+ return 0;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From 4a9b7ae7421b5b66b386c5868024d59b650248b2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 Jan 2020 00:32:46 -0500
+Subject: bnxt_en: Fix ipv6 RFS filter matching logic.
+
+From: Michael Chan <michael.chan@broadcom.com>
+
+[ Upstream commit 6fc7caa84e713f7627e171ab1e7c4b5be0dc9b3d ]
+
+Fix bnxt_fltr_match() to match ipv6 source and destination addresses.
+The function currently only checks ipv4 addresses and will not work
+corrently on ipv6 filters.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index 2f61175f5655a..5cf85a89016e0 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8215,11 +8215,23 @@ static bool bnxt_fltr_match(struct bnxt_ntuple_filter *f1,
+ struct flow_keys *keys1 = &f1->fkeys;
+ struct flow_keys *keys2 = &f2->fkeys;
+
+- if (keys1->addrs.v4addrs.src == keys2->addrs.v4addrs.src &&
+- keys1->addrs.v4addrs.dst == keys2->addrs.v4addrs.dst &&
+- keys1->ports.ports == keys2->ports.ports &&
+- keys1->basic.ip_proto == keys2->basic.ip_proto &&
+- keys1->basic.n_proto == keys2->basic.n_proto &&
++ if (keys1->basic.n_proto != keys2->basic.n_proto ||
++ keys1->basic.ip_proto != keys2->basic.ip_proto)
++ return false;
++
++ if (keys1->basic.n_proto == htons(ETH_P_IP)) {
++ if (keys1->addrs.v4addrs.src != keys2->addrs.v4addrs.src ||
++ keys1->addrs.v4addrs.dst != keys2->addrs.v4addrs.dst)
++ return false;
++ } else {
++ if (memcmp(&keys1->addrs.v6addrs.src, &keys2->addrs.v6addrs.src,
++ sizeof(keys1->addrs.v6addrs.src)) ||
++ memcmp(&keys1->addrs.v6addrs.dst, &keys2->addrs.v6addrs.dst,
++ sizeof(keys1->addrs.v6addrs.dst)))
++ return false;
++ }
++
++ if (keys1->ports.ports == keys2->ports.ports &&
+ keys1->control.flags == keys2->control.flags &&
+ ether_addr_equal(f1->src_mac_addr, f2->src_mac_addr) &&
+ ether_addr_equal(f1->dst_mac_addr, f2->dst_mac_addr))
+--
+2.20.1
+
--- /dev/null
+From 12088aa49ffa808fd527d6992704ead32f20b7ca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 22 Dec 2019 14:55:31 +0000
+Subject: cfg80211: Fix radar event during another phy CAC
+
+From: Orr Mazor <orr.mazor@tandemg.com>
+
+[ Upstream commit 26ec17a1dc5ecdd8d91aba63ead6f8b5ad5dea0d ]
+
+In case a radar event of CAC_FINISHED or RADAR_DETECTED
+happens during another phy is during CAC we might need
+to cancel that CAC.
+
+If we got a radar in a channel that another phy is now
+doing CAC on then the CAC should be canceled there.
+
+If, for example, 2 phys doing CAC on the same channels,
+or on comptable channels, once on of them will finish his
+CAC the other might need to cancel his CAC, since it is no
+longer relevant.
+
+To fix that the commit adds an callback and implement it in
+mac80211 to end CAC.
+This commit also adds a call to said callback if after a radar
+event we see the CAC is no longer relevant
+
+Signed-off-by: Orr Mazor <Orr.Mazor@tandemg.com>
+Reviewed-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
+Link: https://lore.kernel.org/r/20191222145449.15792-1-Orr.Mazor@tandemg.com
+[slightly reformat/reword commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/cfg80211.h | 5 +++++
+ net/mac80211/cfg.c | 23 +++++++++++++++++++++++
+ net/wireless/rdev-ops.h | 10 ++++++++++
+ net/wireless/reg.c | 23 ++++++++++++++++++++++-
+ net/wireless/trace.h | 5 +++++
+ 5 files changed, 65 insertions(+), 1 deletion(-)
+
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index 1fa2e72ff7a6a..ae936cd5567e0 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -3050,6 +3050,9 @@ struct cfg80211_external_auth_params {
+ *
+ * @start_radar_detection: Start radar detection in the driver.
+ *
++ * @end_cac: End running CAC, probably because a related CAC
++ * was finished on another phy.
++ *
+ * @update_ft_ies: Provide updated Fast BSS Transition information to the
+ * driver. If the SME is in the driver/firmware, this information can be
+ * used in building Authentication and Reassociation Request frames.
+@@ -3364,6 +3367,8 @@ struct cfg80211_ops {
+ struct net_device *dev,
+ struct cfg80211_chan_def *chandef,
+ u32 cac_time_ms);
++ void (*end_cac)(struct wiphy *wiphy,
++ struct net_device *dev);
+ int (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
+ struct cfg80211_update_ft_ies_params *ftie);
+ int (*crit_proto_start)(struct wiphy *wiphy,
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index e46944500cfa1..cb7076d9a7698 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -2825,6 +2825,28 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,
+ return err;
+ }
+
++static void ieee80211_end_cac(struct wiphy *wiphy,
++ struct net_device *dev)
++{
++ struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
++ struct ieee80211_local *local = sdata->local;
++
++ mutex_lock(&local->mtx);
++ list_for_each_entry(sdata, &local->interfaces, list) {
++ /* it might be waiting for the local->mtx, but then
++ * by the time it gets it, sdata->wdev.cac_started
++ * will no longer be true
++ */
++ cancel_delayed_work(&sdata->dfs_cac_timer_work);
++
++ if (sdata->wdev.cac_started) {
++ ieee80211_vif_release_channel(sdata);
++ sdata->wdev.cac_started = false;
++ }
++ }
++ mutex_unlock(&local->mtx);
++}
++
+ static struct cfg80211_beacon_data *
+ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon)
+ {
+@@ -3848,6 +3870,7 @@ const struct cfg80211_ops mac80211_config_ops = {
+ #endif
+ .get_channel = ieee80211_cfg_get_channel,
+ .start_radar_detection = ieee80211_start_radar_detection,
++ .end_cac = ieee80211_end_cac,
+ .channel_switch = ieee80211_channel_switch,
+ .set_qos_map = ieee80211_set_qos_map,
+ .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
+diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
+index 4cff76f33d45f..a8c58aeb9dde9 100644
+--- a/net/wireless/rdev-ops.h
++++ b/net/wireless/rdev-ops.h
+@@ -1170,6 +1170,16 @@ rdev_start_radar_detection(struct cfg80211_registered_device *rdev,
+ return ret;
+ }
+
++static inline void
++rdev_end_cac(struct cfg80211_registered_device *rdev,
++ struct net_device *dev)
++{
++ trace_rdev_end_cac(&rdev->wiphy, dev);
++ if (rdev->ops->end_cac)
++ rdev->ops->end_cac(&rdev->wiphy, dev);
++ trace_rdev_return_void(&rdev->wiphy);
++}
++
+ static inline int
+ rdev_set_mcast_rate(struct cfg80211_registered_device *rdev,
+ struct net_device *dev,
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 4c3c8a1c116da..018c60be153a7 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -3840,6 +3840,25 @@ bool regulatory_pre_cac_allowed(struct wiphy *wiphy)
+ return pre_cac_allowed;
+ }
+
++static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev)
++{
++ struct wireless_dev *wdev;
++ /* If we finished CAC or received radar, we should end any
++ * CAC running on the same channels.
++ * the check !cfg80211_chandef_dfs_usable contain 2 options:
++ * either all channels are available - those the CAC_FINISHED
++ * event has effected another wdev state, or there is a channel
++ * in unavailable state in wdev chandef - those the RADAR_DETECTED
++ * event has effected another wdev state.
++ * In both cases we should end the CAC on the wdev.
++ */
++ list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
++ if (wdev->cac_started &&
++ !cfg80211_chandef_dfs_usable(&rdev->wiphy, &wdev->chandef))
++ rdev_end_cac(rdev, wdev->netdev);
++ }
++}
++
+ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
+ struct cfg80211_chan_def *chandef,
+ enum nl80211_dfs_state dfs_state,
+@@ -3866,8 +3885,10 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,
+ cfg80211_set_dfs_state(&rdev->wiphy, chandef, dfs_state);
+
+ if (event == NL80211_RADAR_DETECTED ||
+- event == NL80211_RADAR_CAC_FINISHED)
++ event == NL80211_RADAR_CAC_FINISHED) {
+ cfg80211_sched_dfs_chan_update(rdev);
++ cfg80211_check_and_end_cac(rdev);
++ }
+
+ nl80211_radar_notify(rdev, chandef, event, NULL, GFP_KERNEL);
+ }
+diff --git a/net/wireless/trace.h b/net/wireless/trace.h
+index 7c73510b161f3..54b0bb344cf93 100644
+--- a/net/wireless/trace.h
++++ b/net/wireless/trace.h
+@@ -607,6 +607,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,
+ TP_ARGS(wiphy, netdev)
+ );
+
++DEFINE_EVENT(wiphy_netdev_evt, rdev_end_cac,
++ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
++ TP_ARGS(wiphy, netdev)
++);
++
+ DECLARE_EVENT_CLASS(station_add_change,
+ TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *mac,
+ struct station_parameters *params),
+--
+2.20.1
+
--- /dev/null
+From 98ebff307812a1e4c04a280c3424675f5ab10b2b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:04:54 +0100
+Subject: clk: mmp2: Fix the order of timer mux parents
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad ]
+
+Determined empirically, no documentation is available.
+
+The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but
+thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing
+what is going on, ended up just dividing the rate as of
+commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")'
+
+Link: https://lore.kernel.org/r/20191218190454.420358-3-lkundrak@v3.sk
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mmp/clk-of-mmp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
+index d083b860f0833..10689d8cd3867 100644
+--- a/drivers/clk/mmp/clk-of-mmp2.c
++++ b/drivers/clk/mmp/clk-of-mmp2.c
+@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock);
+ static const char *ssp_parent_names[] = {"vctcxo_4", "vctcxo_2", "vctcxo", "pll1_16"};
+
+ static DEFINE_SPINLOCK(timer_lock);
+-static const char *timer_parent_names[] = {"clk32", "vctcxo_2", "vctcxo_4", "vctcxo"};
++static const char *timer_parent_names[] = {"clk32", "vctcxo_4", "vctcxo_2", "vctcxo"};
+
+ static DEFINE_SPINLOCK(reset_lock);
+
+--
+2.20.1
+
--- /dev/null
+From 0bc250c98e16dccae9554454453a80467aa9f964 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 28 Dec 2019 20:59:22 -0600
+Subject: clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
+
+From: Samuel Holland <samuel@sholland.org>
+
+[ Upstream commit 0c545240aebc2ccb8f661dc54283a14d64659804 ]
+
+According to the BSP source code, both the AR100 and R_APB2 clocks have
+PLL_PERIPH0 as mux index 3, not 2 as it was on previous chips. The pre-
+divider used for PLL_PERIPH0 should be changed to index 3 to match.
+
+This was verified by running a rough benchmark on the AR100 with various
+clock settings:
+
+ | mux | pre-divider | iterations/second | clock source |
+ |=====|=============|===================|==============|
+ | 0 | 0 | 19033 (stable) | osc24M |
+ | 2 | 5 | 11466 (unstable) | iosc/osc16M |
+ | 2 | 17 | 11422 (unstable) | iosc/osc16M |
+ | 3 | 5 | 85338 (stable) | pll-periph0 |
+ | 3 | 17 | 27167 (stable) | pll-periph0 |
+
+The relative performance numbers all match up (with pll-periph0 running
+at its default 600MHz).
+
+Signed-off-by: Samuel Holland <samuel@sholland.org>
+Signed-off-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+index 8d05d4f1f8a1e..28b84c701a7d2 100644
+--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c
+@@ -23,9 +23,9 @@
+ */
+
+ static const char * const ar100_r_apb2_parents[] = { "osc24M", "osc32k",
+- "pll-periph0", "iosc" };
++ "iosc", "pll-periph0" };
+ static const struct ccu_mux_var_prediv ar100_r_apb2_predivs[] = {
+- { .index = 2, .shift = 0, .width = 5 },
++ { .index = 3, .shift = 0, .width = 5 },
+ };
+
+ static struct ccu_div ar100_clk = {
+--
+2.20.1
+
--- /dev/null
+From 90118311d1a8f964075e87db195e8a56c3caa42f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 4 Dec 2019 11:40:26 +0100
+Subject: igb: Fix SGMII SFP module discovery for 100FX/LX.
+
+From: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
+
+[ Upstream commit 5365ec1aeff5b9f2962a9c9b31d63f9dad7e0e2d ]
+
+Changing the link mode should also be done for 100BaseFX SGMII modules,
+otherwise they just don't work when the default link mode in CTRL_EXT
+coming from the EEPROM is SERDES.
+
+Additionally 100Base-LX SGMII SFP modules are also supported now, which
+was not the case before.
+
+Tested with an i210 using Flexoptix S.1303.2M.G 100FX and
+S.1303.10.G 100LX SGMII SFP modules.
+
+Signed-off-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/igb/e1000_82575.c | 8 ++------
+ drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +-
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
+index bafdcf70a353d..fdab974b245b7 100644
+--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
++++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
+@@ -530,7 +530,7 @@ static s32 igb_set_sfp_media_type_82575(struct e1000_hw *hw)
+ dev_spec->module_plugged = true;
+ if (eth_flags->e1000_base_lx || eth_flags->e1000_base_sx) {
+ hw->phy.media_type = e1000_media_type_internal_serdes;
+- } else if (eth_flags->e100_base_fx) {
++ } else if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) {
+ dev_spec->sgmii_active = true;
+ hw->phy.media_type = e1000_media_type_internal_serdes;
+ } else if (eth_flags->e1000_base_t) {
+@@ -657,14 +657,10 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)
+ break;
+ }
+
+- /* do not change link mode for 100BaseFX */
+- if (dev_spec->eth_flags.e100_base_fx)
+- break;
+-
+ /* change current link mode setting */
+ ctrl_ext &= ~E1000_CTRL_EXT_LINK_MODE_MASK;
+
+- if (hw->phy.media_type == e1000_media_type_copper)
++ if (dev_spec->sgmii_active)
+ ctrl_ext |= E1000_CTRL_EXT_LINK_MODE_SGMII;
+ else
+ ctrl_ext |= E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES;
+diff --git a/drivers/net/ethernet/intel/igb/igb_ethtool.c b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+index 5acf3b743876a..50954e4449854 100644
+--- a/drivers/net/ethernet/intel/igb/igb_ethtool.c
++++ b/drivers/net/ethernet/intel/igb/igb_ethtool.c
+@@ -181,7 +181,7 @@ static int igb_get_link_ksettings(struct net_device *netdev,
+ advertising &= ~ADVERTISED_1000baseKX_Full;
+ }
+ }
+- if (eth_flags->e100_base_fx) {
++ if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) {
+ supported |= SUPPORTED_100baseT_Full;
+ advertising |= ADVERTISED_100baseT_Full;
+ }
+--
+2.20.1
+
--- /dev/null
+From 7dc04dcbf775acf47747bc17d2e9993d4350b16d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 11:59:52 -0800
+Subject: Input: aiptek - use descriptors of current altsetting
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cfa4f6a99fb183742cace65ec551b444852b8ef6 ]
+
+Make sure to always use the descriptors of the current alternate setting
+to avoid future issues when accessing fields that may differ between
+settings.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Vladis Dronov <vdronov@redhat.com>
+Link: https://lore.kernel.org/r/20191210113737.4016-4-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/tablet/aiptek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
+index dc2ad1cc8fe1d..8632ca509887d 100644
+--- a/drivers/input/tablet/aiptek.c
++++ b/drivers/input/tablet/aiptek.c
+@@ -1726,7 +1726,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ aiptek->inputdev = inputdev;
+ aiptek->intf = intf;
+- aiptek->ifnum = intf->altsetting[0].desc.bInterfaceNumber;
++ aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+ aiptek->inDelay = 0;
+ aiptek->endDelay = 0;
+ aiptek->previousJitterable = 0;
+--
+2.20.1
+
--- /dev/null
+From 3d7a9e43653dc7baab4911f8fa59f0c365a5ed62 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 14:55:58 -0500
+Subject: iwlwifi: Don't ignore the cap field upon mcc update
+
+From: Haim Dreyfuss <haim.dreyfuss@intel.com>
+
+[ Upstream commit 2763bba6328c53c455d8f7f5302b80030551c31b ]
+
+When receiving a new MCC driver get all the data about the new country
+code and its regulatory information.
+Mistakenly, we ignored the cap field, which includes global regulatory
+information which should be applies to every channel.
+Fix it.
+
+Signed-off-by: Haim Dreyfuss <haim.dreyfuss@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 48 ++++++++++++++++++-
+ .../wireless/intel/iwlwifi/iwl-nvm-parse.h | 6 +--
+ .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +-
+ 3 files changed, 51 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+index b850cca9853c8..a6e64787a3454 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c
+@@ -217,6 +217,34 @@ enum iwl_nvm_channel_flags {
+ NVM_CHANNEL_DC_HIGH = BIT(12),
+ };
+
++/**
++ * enum iwl_reg_capa_flags - global flags applied for the whole regulatory
++ * domain.
++ * @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the
++ * 2.4Ghz band is allowed.
++ * @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the
++ * 5Ghz band is allowed.
++ * @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed.
++ * @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed.
++ * @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden
++ * for this regulatory domain (valid only in 5Ghz).
++ * @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed.
++ */
++enum iwl_reg_capa_flags {
++ REG_CAPA_BF_CCD_LOW_BAND = BIT(0),
++ REG_CAPA_BF_CCD_HIGH_BAND = BIT(1),
++ REG_CAPA_160MHZ_ALLOWED = BIT(2),
++ REG_CAPA_80MHZ_ALLOWED = BIT(3),
++ REG_CAPA_MCS_8_ALLOWED = BIT(4),
++ REG_CAPA_MCS_9_ALLOWED = BIT(5),
++ REG_CAPA_40MHZ_FORBIDDEN = BIT(7),
++ REG_CAPA_DC_HIGH_ENABLED = BIT(9),
++};
++
+ static inline void iwl_nvm_print_channel_flags(struct device *dev, u32 level,
+ int chan, u16 flags)
+ {
+@@ -923,6 +951,7 @@ IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);
+
+ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
+ int ch_idx, u16 nvm_flags,
++ u16 cap_flags,
+ const struct iwl_cfg *cfg)
+ {
+ u32 flags = NL80211_RRF_NO_HT40;
+@@ -966,6 +995,20 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan,
+ (flags & NL80211_RRF_NO_IR))
+ flags |= NL80211_RRF_GO_CONCURRENT;
+
++ /*
++ * cap_flags is per regulatory domain so apply it for every channel
++ */
++ if (ch_idx >= NUM_2GHZ_CHANNELS) {
++ if (cap_flags & REG_CAPA_40MHZ_FORBIDDEN)
++ flags |= NL80211_RRF_NO_HT40;
++
++ if (!(cap_flags & REG_CAPA_80MHZ_ALLOWED))
++ flags |= NL80211_RRF_NO_80MHZ;
++
++ if (!(cap_flags & REG_CAPA_160MHZ_ALLOWED))
++ flags |= NL80211_RRF_NO_160MHZ;
++ }
++
+ return flags;
+ }
+
+@@ -977,7 +1020,7 @@ struct regdb_ptrs {
+ struct ieee80211_regdomain *
+ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ int num_of_ch, __le32 *channels, u16 fw_mcc,
+- u16 geo_info)
++ u16 geo_info, u16 cap)
+ {
+ int ch_idx;
+ u16 ch_flags;
+@@ -1038,7 +1081,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ }
+
+ reg_rule_flags = iwl_nvm_get_regdom_bw_flags(nvm_chan, ch_idx,
+- ch_flags, cfg);
++ ch_flags, cap,
++ cfg);
+
+ /* we can't continue the same rule */
+ if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
+diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+index 234d1009a9de4..a9bdd4aa01c7e 100644
+--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h
+@@ -7,7 +7,7 @@
+ *
+ * Copyright(c) 2008 - 2015 Intel Corporation. All rights reserved.
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+@@ -34,7 +34,7 @@
+ *
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
+ * Copyright(c) 2016 - 2017 Intel Deutschland GmbH
+- * Copyright(c) 2018 Intel Corporation
++ * Copyright(c) 2018 - 2019 Intel Corporation
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+@@ -108,7 +108,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,
+ struct ieee80211_regdomain *
+ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg,
+ int num_of_ch, __le32 *channels, u16 fw_mcc,
+- u16 geo_info);
++ u16 geo_info, u16 cap);
+
+ /**
+ * struct iwl_nvm_section - describes an NVM section in memory.
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+index 476c44db0e64b..58653598db146 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
+@@ -317,7 +317,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,
+ __le32_to_cpu(resp->n_channels),
+ resp->channels,
+ __le16_to_cpu(resp->mcc),
+- __le16_to_cpu(resp->geo_info));
++ __le16_to_cpu(resp->geo_info),
++ __le16_to_cpu(resp->cap));
+ /* Store the return source id */
+ src_id = resp->source_id;
+ kfree(resp);
+--
+2.20.1
+
--- /dev/null
+From 48e05aff3d728c9676c793591783b09c4ac9b47a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 13:21:58 +0200
+Subject: iwlwifi: mvm: fix NVM check for 3168 devices
+
+From: Luca Coelho <luciano.coelho@intel.com>
+
+[ Upstream commit b3f20e098293892388d6a0491d6bbb2efb46fbff ]
+
+We had a check on !NVM_EXT and then a check for NVM_SDP in the else
+block of this if. The else block, obviously, could only be reached if
+using NVM_EXT, so it would never be NVM_SDP.
+
+Fix that by checking whether the nvm_type is IWL_NVM instead of
+checking for !IWL_NVM_EXT to solve this issue.
+
+Reported-by: Stefan Sperling <stsp@stsp.name>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+index f2579c94ffdbc..3270faafe0bc3 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c
+@@ -286,7 +286,7 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
+ int regulatory_type;
+
+ /* Checking for required sections */
+- if (mvm->trans->cfg->nvm_type != IWL_NVM_EXT) {
++ if (mvm->trans->cfg->nvm_type == IWL_NVM) {
+ if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW].data ||
+ !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {
+ IWL_ERR(mvm, "Can't parse empty OTP/NVM sections\n");
+--
+2.20.1
+
--- /dev/null
+From a7aa2b4a8487bf87bc4299a8276368b53bc74569 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 17:03:55 +0800
+Subject: ixgbe: Fix calculation of queue with VFs and flow director on
+ interface flap
+
+From: Cambda Zhu <cambda@linux.alibaba.com>
+
+[ Upstream commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 ]
+
+This patch fixes the calculation of queue when we restore flow director
+filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's
+vf may be zero which makes the queue outside of the rx_ring array.
+
+The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry().
+
+Signed-off-by: Cambda Zhu <cambda@linux.alibaba.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 51cd58fbab695..8177276500f5a 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -5189,7 +5189,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct hlist_node *node2;
+ struct ixgbe_fdir_filter *filter;
+- u64 action;
++ u8 queue;
+
+ spin_lock(&adapter->fdir_perfect_lock);
+
+@@ -5198,17 +5198,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+
+ hlist_for_each_entry_safe(filter, node2,
+ &adapter->fdir_filter_list, fdir_node) {
+- action = filter->action;
+- if (action != IXGBE_FDIR_DROP_QUEUE && action != 0)
+- action =
+- (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1;
++ if (filter->action == IXGBE_FDIR_DROP_QUEUE) {
++ queue = IXGBE_FDIR_DROP_QUEUE;
++ } else {
++ u32 ring = ethtool_get_flow_spec_ring(filter->action);
++ u8 vf = ethtool_get_flow_spec_ring_vf(filter->action);
++
++ if (!vf && (ring >= adapter->num_rx_queues)) {
++ e_err(drv, "FDIR restore failed without VF, ring: %u\n",
++ ring);
++ continue;
++ } else if (vf &&
++ ((vf > adapter->num_vfs) ||
++ ring >= adapter->num_rx_queues_per_pool)) {
++ e_err(drv, "FDIR restore failed with VF, vf: %hhu, ring: %u\n",
++ vf, ring);
++ continue;
++ }
++
++ /* Map the ring onto the absolute queue index */
++ if (!vf)
++ queue = adapter->rx_ring[ring]->reg_idx;
++ else
++ queue = ((vf - 1) *
++ adapter->num_rx_queues_per_pool) + ring;
++ }
+
+ ixgbe_fdir_write_perfect_filter_82599(hw,
+- &filter->filter,
+- filter->sw_idx,
+- (action == IXGBE_FDIR_DROP_QUEUE) ?
+- IXGBE_FDIR_DROP_QUEUE :
+- adapter->rx_ring[action]->reg_idx);
++ &filter->filter, filter->sw_idx, queue);
+ }
+
+ spin_unlock(&adapter->fdir_perfect_lock);
+--
+2.20.1
+
--- /dev/null
+From ade215b0b1c3e039ee7136d83e5bcb522778bb73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 15:24:52 +0100
+Subject: ixgbevf: Remove limit of 10 entries for unicast filter list
+
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+
+[ Upstream commit aa604651d523b1493988d0bf6710339f3ee60272 ]
+
+Currently, though the FDB entry is added to VF, it does not appear in
+RAR filters. VF driver only allows to add 10 entries. Attempting to add
+another causes an error. This patch removes limitation and allows use of
+all free RAR entries for the FDB if needed.
+
+Fixes: 46ec20ff7d ("ixgbevf: Add macvlan support in the set rx mode op")
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 4093a9c52c182..a10756f0b0d8b 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -2066,11 +2066,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev)
+ struct ixgbe_hw *hw = &adapter->hw;
+ int count = 0;
+
+- if ((netdev_uc_count(netdev)) > 10) {
+- pr_err("Too many unicast filters - No Space\n");
+- return -ENOSPC;
+- }
+-
+ if (!netdev_uc_empty(netdev)) {
+ struct netdev_hw_addr *ha;
+
+--
+2.20.1
+
--- /dev/null
+From 3a129b253ae235fa5904624f470a160bd86294d3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 10:11:13 +0300
+Subject: l2t_seq_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 66018a102f7756cf72db4d2704e1b93969d9d332 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+index 301c4df8a5664..986277744611c 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+@@ -683,8 +683,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos)
+ static void *l2t_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = l2t_get_idx(seq, *pos);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From ecf7475183c562ac98228e60d582114efd54a27a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 17:35:45 +0200
+Subject: mac80211: Fix TKIP replay protection immediately after key setup
+
+From: Jouni Malinen <j@w1.fi>
+
+[ Upstream commit 6f601265215a421f425ba3a4850a35861d024643 ]
+
+TKIP replay protection was skipped for the very first frame received
+after a new key is configured. While this is potentially needed to avoid
+dropping a frame in some cases, this does leave a window for replay
+attacks with group-addressed frames at the station side. Any earlier
+frame sent by the AP using the same key would be accepted as a valid
+frame and the internal RSC would then be updated to the TSC from that
+frame. This would allow multiple previously transmitted group-addressed
+frames to be replayed until the next valid new group-addressed frame
+from the AP is received by the station.
+
+Fix this by limiting the no-replay-protection exception to apply only
+for the case where TSC=0, i.e., when this is for the very first frame
+protected using the new key, and the local RSC had not been set to a
+higher value when configuring the key (which may happen with GTK).
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tkip.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
+index b3622823bad23..ebd66e8f46b3f 100644
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -266,9 +266,21 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
+ if ((keyid >> 6) != key->conf.keyidx)
+ return TKIP_DECRYPT_INVALID_KEYIDX;
+
+- if (rx_ctx->ctx.state != TKIP_STATE_NOT_INIT &&
+- (iv32 < rx_ctx->iv32 ||
+- (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16)))
++ /* Reject replays if the received TSC is smaller than or equal to the
++ * last received value in a valid message, but with an exception for
++ * the case where a new key has been set and no valid frame using that
++ * key has yet received and the local RSC was initialized to 0. This
++ * exception allows the very first frame sent by the transmitter to be
++ * accepted even if that transmitter were to use TSC 0 (IEEE 802.11
++ * described TSC to be initialized to 1 whenever a new key is taken into
++ * use).
++ */
++ if (iv32 < rx_ctx->iv32 ||
++ (iv32 == rx_ctx->iv32 &&
++ (iv16 < rx_ctx->iv16 ||
++ (iv16 == rx_ctx->iv16 &&
++ (rx_ctx->iv32 || rx_ctx->iv16 ||
++ rx_ctx->ctx.state != TKIP_STATE_NOT_INIT)))))
+ return TKIP_DECRYPT_REPLAY;
+
+ if (only_iv) {
+--
+2.20.1
+
--- /dev/null
+From bc29cc0eb40038069f270b33dc7e745cd0a77d9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 19:06:44 +0100
+Subject: mac80211: mesh: restrict airtime metric to peered established plinks
+
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+
+[ Upstream commit 02a614499600af836137c3fbc4404cd96365fff2 ]
+
+The following warning is triggered every time an unestablished mesh peer
+gets dumped. Checks if a peer link is established before retrieving the
+airtime link metric.
+
+[ 9563.022567] WARNING: CPU: 0 PID: 6287 at net/mac80211/mesh_hwmp.c:345
+ airtime_link_metric_get+0xa2/0xb0 [mac80211]
+[ 9563.022697] Hardware name: PC Engines apu2/apu2, BIOS v4.10.0.3
+[ 9563.022756] RIP: 0010:airtime_link_metric_get+0xa2/0xb0 [mac80211]
+[ 9563.022838] Call Trace:
+[ 9563.022897] sta_set_sinfo+0x936/0xa10 [mac80211]
+[ 9563.022964] ieee80211_dump_station+0x6d/0x90 [mac80211]
+[ 9563.023062] nl80211_dump_station+0x154/0x2a0 [cfg80211]
+[ 9563.023120] netlink_dump+0x17b/0x370
+[ 9563.023130] netlink_recvmsg+0x2a4/0x480
+[ 9563.023140] ____sys_recvmsg+0xa6/0x160
+[ 9563.023154] ___sys_recvmsg+0x93/0xe0
+[ 9563.023169] __sys_recvmsg+0x7e/0xd0
+[ 9563.023210] do_syscall_64+0x4e/0x140
+[ 9563.023217] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+Link: https://lore.kernel.org/r/20191203180644.70653-1-markus.theil@tu-ilmenau.de
+[rewrite commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index 6950cd0bf5940..740dc9fa127cd 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -326,6 +326,9 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
+ unsigned long fail_avg =
+ ewma_mesh_fail_avg_read(&sta->mesh->fail_avg);
+
++ if (sta->mesh->plink_state != NL80211_PLINK_ESTAB)
++ return MAX_METRIC;
++
+ /* Try to get rate based on HW/SW RC algorithm.
+ * Rate is returned in units of Kbps, correct this
+ * to comply with airtime calculation units
+--
+2.20.1
+
--- /dev/null
+From 8caa275046a5f6cf304137b185394695d799f333 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 12:55:48 -0800
+Subject: net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 8f1880cbe8d0d49ebb7e9ae409b3b96676e5aa97 ]
+
+With the implementation of the system reset controller we lost a setting
+that is currently applied by the bootloader and which configures the IMP
+port for 2Gb/sec, the default is 1Gb/sec. This is needed given the
+number of ports and applications we expect to run so bring back that
+setting.
+
+Fixes: 01b0ac07589e ("net: dsa: bcm_sf2: Add support for optional reset controller line")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/dsa/bcm_sf2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
+index 02a4187d81bd0..c936090076706 100644
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -72,7 +72,7 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)
+
+ /* Force link status for IMP port */
+ reg = core_readl(priv, offset);
+- reg |= (MII_SW_OR | LINK_STS);
++ reg |= (MII_SW_OR | LINK_STS | GMII_SPEED_UP_2G);
+ core_writel(priv, reg, offset);
+
+ /* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
+--
+2.20.1
+
--- /dev/null
+From 67ca71b9d155e9dc11e4241682bf323f22ab81c9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 12:33:28 -0800
+Subject: net: Fix skb->csum update in inet_proto_csum_replace16().
+
+From: Praveen Chaudhary <praveen5582@gmail.com>
+
+[ Upstream commit 189c9b1e94539b11c80636bc13e9cf47529e7bba ]
+
+skb->csum is updated incorrectly, when manipulation for
+NF_NAT_MANIP_SRC\DST is done on IPV6 packet.
+
+Fix:
+There is no need to update skb->csum in inet_proto_csum_replace16(),
+because update in two fields a.) IPv6 src/dst address and b.) L4 header
+checksum cancels each other for skb->csum calculation. Whereas
+inet_proto_csum_replace4 function needs to update skb->csum, because
+update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum
+and c.) L4 header checksum results in same diff as L4 Header checksum
+for skb->csum calculation.
+
+[ pablo@netfilter.org: a few comestic documentation edits ]
+Signed-off-by: Praveen Chaudhary <pchaudhary@linkedin.com>
+Signed-off-by: Zhenggen Xu <zxu@linkedin.com>
+Signed-off-by: Andy Stracner <astracner@linkedin.com>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/utils.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/utils.c b/net/core/utils.c
+index 2a597ac7808e2..60045e9fea05b 100644
+--- a/net/core/utils.c
++++ b/net/core/utils.c
+@@ -442,6 +442,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL(inet_proto_csum_replace4);
+
++/**
++ * inet_proto_csum_replace16 - update layer 4 header checksum field
++ * @sum: Layer 4 header checksum field
++ * @skb: sk_buff for the packet
++ * @from: old IPv6 address
++ * @to: new IPv6 address
++ * @pseudohdr: True if layer 4 header checksum includes pseudoheader
++ *
++ * Update layer 4 header as per the update in IPv6 src/dst address.
++ *
++ * There is no need to update skb->csum in this function, because update in two
++ * fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other
++ * for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to
++ * update skb->csum, because update in 3 fields a.) IPv4 src/dst address,
++ * b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as
++ * L4 Header checksum for skb->csum calculation.
++ */
+ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ const __be32 *from, const __be32 *to,
+ bool pseudohdr)
+@@ -453,9 +470,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ if (skb->ip_summed != CHECKSUM_PARTIAL) {
+ *sum = csum_fold(csum_partial(diff, sizeof(diff),
+ ~csum_unfold(*sum)));
+- if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+- skb->csum = ~csum_partial(diff, sizeof(diff),
+- ~skb->csum);
+ } else if (pseudohdr)
+ *sum = ~csum_fold(csum_partial(diff, sizeof(diff),
+ csum_unfold(*sum)));
+--
+2.20.1
+
--- /dev/null
+From 8d72b1e8d139f60edca085c744c9ffa4b493fd7b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:15:14 +0200
+Subject: net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 457bfc0a4bf531487ecc3cf82ec728a5e114fb1e ]
+
+As the only 10G PHY interface type defined at the moment the code
+was developed was XGMII, although the PHY interface mode used was
+not XGMII, XGMII was used in the code to denote 10G. This patch
+renames the 10G interface mode to remove the ambiguity.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_memac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index 41c6fa200e746..e1901874c19f0 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -110,7 +110,7 @@ do { \
+ /* Interface Mode Register (IF_MODE) */
+
+ #define IF_MODE_MASK 0x00000003 /* 30-31 Mask on i/f mode bits */
+-#define IF_MODE_XGMII 0x00000000 /* 30-31 XGMII (10G) interface */
++#define IF_MODE_10G 0x00000000 /* 30-31 10G interface */
+ #define IF_MODE_GMII 0x00000002 /* 30-31 GMII (1G) interface */
+ #define IF_MODE_RGMII 0x00000004
+ #define IF_MODE_RGMII_AUTO 0x00008000
+@@ -440,7 +440,7 @@ static int init(struct memac_regs __iomem *regs, struct memac_cfg *cfg,
+ tmp = 0;
+ switch (phy_if) {
+ case PHY_INTERFACE_MODE_XGMII:
+- tmp |= IF_MODE_XGMII;
++ tmp |= IF_MODE_10G;
+ break;
+ default:
+ tmp |= IF_MODE_GMII;
+--
+2.20.1
+
--- /dev/null
+From baa34e2b4c19f305f09d668711a221d6f8260800 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:20:29 +0200
+Subject: net/fsl: treat fsl,erratum-a011043
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 ]
+
+When fsl,erratum-a011043 is set, adjust for erratum A011043:
+MDIO reads to internal PCS registers may result in having
+the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no
+error and read data (MDIO_DATA[MDIO_DATA]) is correct.
+Software may get false read error when reading internal
+PCS registers through MDIO. As a workaround, all internal
+MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/xgmac_mdio.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c
+index e03b30c60dcfd..c82c85ef5fb34 100644
+--- a/drivers/net/ethernet/freescale/xgmac_mdio.c
++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c
+@@ -49,6 +49,7 @@ struct tgec_mdio_controller {
+ struct mdio_fsl_priv {
+ struct tgec_mdio_controller __iomem *mdio_base;
+ bool is_little_endian;
++ bool has_a011043;
+ };
+
+ static u32 xgmac_read32(void __iomem *regs,
+@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
+ return ret;
+
+ /* Return all Fs if nothing was there */
+- if (xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) {
++ if ((xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) &&
++ !priv->has_a011043) {
+ dev_err(&bus->dev,
+ "Error while reading PHY%d reg at %d.%hhu\n",
+ phy_id, dev_addr, regnum);
+@@ -274,6 +276,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev)
+ priv->is_little_endian = of_property_read_bool(pdev->dev.of_node,
+ "little-endian");
+
++ priv->has_a011043 = of_property_read_bool(pdev->dev.of_node,
++ "fsl,erratum-a011043");
++
+ ret = of_mdiobus_register(bus, np);
+ if (ret) {
+ dev_err(&pdev->dev, "cannot register MDIO bus\n");
+--
+2.20.1
+
--- /dev/null
+From f33921c0c980af8c4a48fcec0ec60e4d9d94a722 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 08:58:05 +0100
+Subject: netfilter: nft_tunnel: ERSPAN_VERSION must not be null
+
+From: Florian Westphal <fw@strlen.de>
+
+[ Upstream commit 9ec22d7c6c69146180577f3ad5fdf504beeaee62 ]
+
+Fixes: af308b94a2a4a5 ("netfilter: nf_tables: add tunnel support")
+Signed-off-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/netfilter/nft_tunnel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c
+index 09441bbb0166f..e5444f3ff43fc 100644
+--- a/net/netfilter/nft_tunnel.c
++++ b/net/netfilter/nft_tunnel.c
+@@ -235,6 +235,9 @@ static int nft_tunnel_obj_erspan_init(const struct nlattr *attr,
+ if (err < 0)
+ return err;
+
++ if (!tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION])
++ return -EINVAL;
++
+ version = ntohl(nla_get_be32(tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION]));
+ switch (version) {
+ case ERSPAN_VERSION:
+--
+2.20.1
+
--- /dev/null
+From 1dc2f627a06260d665e7d22dc0c6aef16c546034 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 3 Jan 2020 17:39:25 +0100
+Subject: parisc: Use proper printk format for resource_size_t
+
+From: Krzysztof Kozlowski <krzk@kernel.org>
+
+[ Upstream commit 4f80b70e1953cb846dbdd1ce72cb17333d4c8d11 ]
+
+resource_size_t should be printed with its own size-independent format
+to fix warnings when compiling on 64-bit platform (e.g. with
+COMPILE_TEST):
+
+ arch/parisc/kernel/drivers.c: In function 'print_parisc_device':
+ arch/parisc/kernel/drivers.c:892:9: warning:
+ format '%p' expects argument of type 'void *',
+ but argument 4 has type 'resource_size_t {aka unsigned int}' [-Wformat=]
+
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/drivers.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c
+index a1a5e4c59e6b2..4d5ad9cb0f692 100644
+--- a/arch/parisc/kernel/drivers.c
++++ b/arch/parisc/kernel/drivers.c
+@@ -868,8 +868,8 @@ static void print_parisc_device(struct parisc_device *dev)
+ static int count;
+
+ print_pa_hwpath(dev, hw_path);
+- pr_info("%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
+- ++count, dev->name, (void*) dev->hpa.start, hw_path, dev->id.hw_type,
++ pr_info("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }",
++ ++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type,
+ dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);
+
+ if (dev->num_addrs) {
+--
+2.20.1
+
--- /dev/null
+From ad4b04f7852dcfcd3295e86ad40736bc0f24b3ea Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Jan 2020 15:42:19 +0100
+Subject: platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature
+ limits
+
+From: Hans de Goede <hdegoede@redhat.com>
+
+[ Upstream commit 1f27dbd8265dbb379926c8f6a4453fe7fe26d7a3 ]
+
+Allow the user to configure the fan to turn on / speed-up at lower
+thresholds then before (20 degrees Celcius as minimum instead of 40) and
+likewise also allow the user to delay the fan speeding-up till the
+temperature hits 90 degrees Celcius (was 70).
+
+Cc: Jason Anderson <jasona.594@gmail.com>
+Reported-by: Jason Anderson <jasona.594@gmail.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/platform/x86/gpd-pocket-fan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/platform/x86/gpd-pocket-fan.c b/drivers/platform/x86/gpd-pocket-fan.c
+index 73eb1572b9662..b471b86c28fe8 100644
+--- a/drivers/platform/x86/gpd-pocket-fan.c
++++ b/drivers/platform/x86/gpd-pocket-fan.c
+@@ -127,7 +127,7 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(temp_limits); i++) {
+- if (temp_limits[i] < 40000 || temp_limits[i] > 70000) {
++ if (temp_limits[i] < 20000 || temp_limits[i] > 90000) {
+ dev_err(&pdev->dev, "Invalid temp-limit %d (must be between 40000 and 70000)\n",
+ temp_limits[i]);
+ temp_limits[0] = TEMP_LIMIT0_DEFAULT;
+--
+2.20.1
+
--- /dev/null
+From 566dd8ce929066d74b0a7c282af39d4654971f6e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:20:28 +0200
+Subject: powerpc/fsl/dts: add fsl,erratum-a011043
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 73d527aef68f7644e59f22ce7f9ac75e7b533aea ]
+
+Add fsl,erratum-a011043 to internal MDIO buses.
+Software may get false read error when reading internal
+PCS registers through MDIO. As a workaround, all internal
+MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 +
+ 18 files changed, 18 insertions(+)
+
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+index e1a961f05dcd5..baa0c503e741b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+index c288f3c6c6378..93095600e8086 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy6: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+index 94f3e71750124..ff4bd38f06459 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+index 94a76982d214b..1fa38ed6f59e2 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy7: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+index b5ff5f71c6b8b..a8cc9780c0c42 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+index ee44182c63485..8b8bd70c93823 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+index f05f0d775039b..619c880b54d8d 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy2: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+index a9114ec510759..d7ebb73a400d0 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy3: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+index 44dd00ac7367f..b151d696a0699 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy4: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+index 5b1b84b58602f..adc0ae0013a3c 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy5: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+index 0e1daaef9e74b..435047e0e250e 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy14: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+index 68c5ef779266a..c098657cca0a7 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy15: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+index 605363cc1117f..9d06824815f34 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy8: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+index 1955dfa136348..70e947730c4ba 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy9: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+index 2c1476454ee01..ad96e65295959 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy10: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+index b8b541ff5fb03..034bc4b71f7a5 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy11: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+index 4b2cfddd1b155..93ca23d82b39b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy12: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+index 0a52ddf7cc171..23b3117a2fd2a 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy13: ethernet-phy@0 {
+ reg = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From 4711d211d928508abdb4eab6fae8f21b7b454f9e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 01:43:38 -0800
+Subject: qlcnic: Fix CPU soft lockup while collecting firmware dump
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 ]
+
+Driver while collecting firmware dump takes longer time to
+collect/process some of the firmware dump entries/memories.
+Bigger capture masks makes it worse as it results in larger
+amount of data being collected and results in CPU soft lockup.
+Place cond_resched() in some of the driver flows that are
+expectedly time consuming to relinquish the CPU to avoid CPU
+soft lockup panic.
+
+Signed-off-by: Shahed Shaikh <shshaikh@marvell.com>
+Tested-by: Yonggen Xu <Yonggen.Xu@dell.com>
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 +
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index a496390b8632f..07f9067affc65 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
+ break;
+ }
+ entry += p_hdr->size;
++ cond_resched();
+ }
+ p_dev->ahw->reset.seq_index = index;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+index afa10a163da1f..f34ae8c75bc5e 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter,
+ addr += 16;
+ reg_read -= 16;
+ ret += 16;
++ cond_resched();
+ }
+ out:
+ mutex_unlock(&adapter->ahw->mem_lock);
+@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
+ buf_offset += entry->hdr.cap_size;
+ entry_offset += entry->hdr.offset;
+ buffer = fw_dump->data + buf_offset;
++ cond_resched();
+ }
+
+ fw_dump->clr = 1;
+--
+2.20.1
+
--- /dev/null
+From 9fa95c3a936e784dd31d0712e3c40ca9fe9f6c08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 14:57:40 +0100
+Subject: qmi_wwan: Add support for Quectel RM500Q
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kristian Evensen <kristian.evensen@gmail.com>
+
+[ Upstream commit a9ff44f0e61d074f29770413fef6a5452be7b83e ]
+
+RM500Q is a 5G module from Quectel, supporting both standalone and
+non-standalone modes. The normal Quectel quirks apply (DTR and dynamic
+interface numbers).
+
+Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index b55fd76348f9f..13c8788e3b6b2 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -999,6 +999,7 @@ static const struct usb_device_id products[] = {
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */
+ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
++ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+
+ /* 3. Combined interface devices matching on interface number */
+ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
+--
+2.20.1
+
--- /dev/null
+From 3c381515d8c4557f22e259acf0a451c4527221d0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:07 +0800
+Subject: r8152: get default setting of WOL before initializing
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 9583a3638dc07cc1878f41265e85ed497f72efcb ]
+
+Initailization would reset runtime suspend by tp->saved_wolopts, so
+the tp->saved_wolopts should be set before initializing.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index db817d3c2bb8b..c5c188dc66268 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -5259,6 +5259,11 @@ static int rtl8152_probe(struct usb_interface *intf,
+
+ intf->needs_remote_wakeup = 1;
+
++ if (!rtl_can_wakeup(tp))
++ __rtl_set_wol(tp, 0);
++ else
++ tp->saved_wolopts = __rtl_get_wol(tp);
++
+ tp->rtl_ops.init(tp);
+ queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ set_ethernet_addr(tp);
+@@ -5272,10 +5277,6 @@ static int rtl8152_probe(struct usb_interface *intf,
+ goto out1;
+ }
+
+- if (!rtl_can_wakeup(tp))
+- __rtl_set_wol(tp, 0);
+-
+- tp->saved_wolopts = __rtl_get_wol(tp);
+ if (tp->saved_wolopts)
+ device_set_wakeup_enable(&udev->dev, true);
+ else
+--
+2.20.1
+
--- /dev/null
+From 8b04a4a789067d5875e6a1b8d655bdd33f9c008b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Jan 2020 13:32:42 +0200
+Subject: riscv: delete temporary files
+
+From: Ilie Halip <ilie.halip@gmail.com>
+
+[ Upstream commit 95f4d9cced96afa9c69b3da8e79e96102c84fc60 ]
+
+Temporary files used in the VDSO build process linger on even after make
+mrproper: vdso-dummy.o.tmp, vdso.so.dbg.tmp.
+
+Delete them once they're no longer needed.
+
+Signed-off-by: Ilie Halip <ilie.halip@gmail.com>
+Signed-off-by: Paul Walmsley <paul.walmsley@sifive.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/riscv/kernel/vdso/Makefile | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile
+index eed1c137f6183..87f71a6cd3ef8 100644
+--- a/arch/riscv/kernel/vdso/Makefile
++++ b/arch/riscv/kernel/vdso/Makefile
+@@ -55,7 +55,8 @@ quiet_cmd_vdsold = VDSOLD $@
+ cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \
+ -Wl,-T,$(filter-out FORCE,$^) -o $@.tmp && \
+ $(CROSS_COMPILE)objcopy \
+- $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@
++ $(patsubst %, -G __vdso_%, $(vdso-syms)) $@.tmp $@ && \
++ rm $@.tmp
+
+ # install commands for the unstripped file
+ quiet_cmd_vdso_install = INSTALL $@
+--
+2.20.1
+
--- /dev/null
+From bca4cf1dff03376f46af0157921d75f5d446afa0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 11:17:12 -0500
+Subject: rseq: Unregister rseq for clone CLONE_VM
+
+From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+
+[ Upstream commit 463f550fb47bede3a5d7d5177f363a6c3b45d50b ]
+
+It has been reported by Google that rseq is not behaving properly
+with respect to clone when CLONE_VM is used without CLONE_THREAD.
+
+It keeps the prior thread's rseq TLS registered when the TLS of the
+thread has moved, so the kernel can corrupt the TLS of the parent.
+
+The approach of clearing the per task-struct rseq registration
+on clone with CLONE_THREAD flag is incomplete. It does not cover
+the use-case of clone with CLONE_VM set, but without CLONE_THREAD.
+
+Here is the rationale for unregistering rseq on clone with CLONE_VM
+flag set:
+
+1) CLONE_THREAD requires CLONE_SIGHAND, which requires CLONE_VM to be
+ set. Therefore, just checking for CLONE_VM covers all CLONE_THREAD
+ uses. There is no point in checking for both CLONE_THREAD and
+ CLONE_VM,
+
+2) There is the possibility of an unlikely scenario where CLONE_SETTLS
+ is used without CLONE_VM. In order to be an issue, it would require
+ that the rseq TLS is in a shared memory area.
+
+ I do not plan on adding CLONE_SETTLS to the set of clone flags which
+ unregister RSEQ, because it would require that we also unregister RSEQ
+ on set_thread_area(2) and arch_prctl(2) ARCH_SET_FS for completeness.
+ So rather than doing a partial solution, it appears better to let
+ user-space explicitly perform rseq unregistration across clone if
+ needed in scenarios where CLONE_VM is not set.
+
+Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lkml.kernel.org/r/20191211161713.4490-3-mathieu.desnoyers@efficios.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/sched.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 20f5ba262cc0d..0530de9a4efcc 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1843,11 +1843,11 @@ static inline void rseq_migrate(struct task_struct *t)
+
+ /*
+ * If parent process has a registered restartable sequences area, the
+- * child inherits. Only applies when forking a process, not a thread.
++ * child inherits. Unregister rseq for a clone with CLONE_VM set.
+ */
+ static inline void rseq_fork(struct task_struct *t, unsigned long clone_flags)
+ {
+- if (clone_flags & CLONE_THREAD) {
++ if (clone_flags & CLONE_VM) {
+ t->rseq = NULL;
+ t->rseq_len = 0;
+ t->rseq_sig = 0;
+--
+2.20.1
+
--- /dev/null
+From dbafcb2578f7554debe982782912368ab3c4581d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 11:20:53 +0100
+Subject: scsi: fnic: do not queue commands during fwreset
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 0e2209629fec427ba75a6351486153a9feddd36b ]
+
+When a link is going down the driver will be calling fnic_cleanup_io(),
+which will traverse all commands and calling 'done' for each found command.
+While the traversal is handled under the host_lock, calling 'done' happens
+after the host_lock is being dropped.
+
+As fnic_queuecommand_lck() is being called with the host_lock held, it
+might well be that it will pick the command being selected for abortion
+from the above routine and enqueue it for sending, but then 'done' is being
+called on that very command from the above routine.
+
+Which of course confuses the hell out of the scsi midlayer.
+
+So fix this by not queueing commands when fnic_cleanup_io is active.
+
+Link: https://lore.kernel.org/r/20200116102053.62755-1-hare@suse.de
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_scsi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index 8cbd3c9f0b4cb..73ffc16ec0225 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -446,6 +446,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_
+ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_IO_BLOCKED)))
+ return SCSI_MLQUEUE_HOST_BUSY;
+
++ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_FWRESET)))
++ return SCSI_MLQUEUE_HOST_BUSY;
++
+ rport = starget_to_rport(scsi_target(sc->device));
+ if (!rport) {
+ FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
+--
+2.20.1
+
--- /dev/null
+From f48d8fd41ef4b2f8e7926c2f532b260fecab9ca8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 10:11:08 +0300
+Subject: seq_tab_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 70a87287c821e9721b62463777f55ba588ac4623 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index d320e9afab880..4af6e6ffc5df2 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -70,8 +70,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos)
+ static void *seq_tab_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = seq_tab_get_idx(seq->private, *pos + 1);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+--
+2.20.1
+
bluetooth-fix-race-condition-in-hci_release_sock.patch
cgroup-prevent-double-killing-of-css-when-enabling-threaded-cgroup.patch
media-si470x-i2c-move-free-past-last-use-of-radio.patch
+arm-dts-sun8i-a83t-correct-usb3503-gpios-polarity.patch
+arm-dts-am57xx-beagle-x15-am57xx-idk-remove-gpios-fo.patch
+arm-dts-beagle-x15-common-model-5v0-regulator.patch
+soc-ti-wkup_m3_ipc-fix-race-condition-with-rproc_boo.patch
+tools-lib-traceevent-fix-memory-leakage-in-filter_ev.patch
+rseq-unregister-rseq-for-clone-clone_vm.patch
+clk-sunxi-ng-h6-r-fix-ar100-r_apb2-parent-order.patch
+mac80211-mesh-restrict-airtime-metric-to-peered-esta.patch
+clk-mmp2-fix-the-order-of-timer-mux-parents.patch
+asoc-rt5640-fix-null-dereference-on-module-unload.patch
+ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch
+ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch
+igb-fix-sgmii-sfp-module-discovery-for-100fx-lx.patch
+platform-x86-gpd-pocket-fan-allow-somewhat-lower-hig.patch
+asoc-sti-fix-possible-sleep-in-atomic.patch
+qmi_wwan-add-support-for-quectel-rm500q.patch
+parisc-use-proper-printk-format-for-resource_size_t.patch
+wireless-fix-enabling-channel-12-for-custom-regulato.patch
+cfg80211-fix-radar-event-during-another-phy-cac.patch
+mac80211-fix-tkip-replay-protection-immediately-afte.patch
+wireless-wext-avoid-gcc-o3-warning.patch
+netfilter-nft_tunnel-erspan_version-must-not-be-null.patch
+net-dsa-bcm_sf2-configure-imp-port-for-2gb-sec.patch
+bnxt_en-fix-ipv6-rfs-filter-matching-logic.patch
+riscv-delete-temporary-files.patch
+iwlwifi-mvm-fix-nvm-check-for-3168-devices.patch
+iwlwifi-don-t-ignore-the-cap-field-upon-mcc-update.patch
+input-aiptek-use-descriptors-of-current-altsetting.patch
+arm-dts-am335x-boneblack-common-fix-memory-size.patch
+vti-6-fix-packet-tx-through-bpf_redirect.patch
+xfrm-interface-fix-packet-tx-through-bpf_redirect.patch
+xfrm-interface-do-not-confirm-neighbor-when-do-pmtu-.patch
+scsi-fnic-do-not-queue-commands-during-fwreset.patch
+arm-8955-1-virt-relax-arch-timer-version-check-durin.patch
+tee-optee-fix-compilation-issue-with-nommu.patch
+airo-fix-possible-info-leak-in-airooldioctl-siocdevp.patch
+airo-add-missing-cap_net_admin-check-in-airooldioctl.patch
+r8152-get-default-setting-of-wol-before-initializing.patch
+arm-dts-am43x-epos-evm-set-data-pin-directions-for-s.patch
+qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch
+powerpc-fsl-dts-add-fsl-erratum-a011043.patch
+net-fsl-treat-fsl-erratum-a011043.patch
+net-fsl-fman-rename-if_mode_xgmii-to-if_mode_10g.patch
+seq_tab_next-should-increase-position-index.patch
+l2t_seq_next-should-increase-position-index.patch
+net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch
--- /dev/null
+From 77c08350be18cbf6df755cb61e1466b17a0bad6d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 22:03:14 -0600
+Subject: soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
+
+From: Dave Gerlach <d-gerlach@ti.com>
+
+[ Upstream commit 03729cfa0d543bc996bf959e762ec999afc8f3d2 ]
+
+Any user of wkup_m3_ipc calls wkup_m3_ipc_get to get a handle and this
+checks the value of the static variable m3_ipc_state to see if the
+wkup_m3 is ready. Currently this is populated during probe before
+rproc_boot has been called, meaning there is a window of time that
+wkup_m3_ipc_get can return a valid handle but the wkup_m3 itself is not
+ready, leading to invalid IPC calls to the wkup_m3 and system
+instability.
+
+To avoid this, move the population of the m3_ipc_state variable until
+after rproc_boot has succeeded to guarantee a valid and usable handle
+is always returned.
+
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
+Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/wkup_m3_ipc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index f5cb8c0af09f3..c1fda6acb670a 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -426,6 +426,8 @@ static void wkup_m3_rproc_boot_thread(struct wkup_m3_ipc *m3_ipc)
+ ret = rproc_boot(m3_ipc->rproc);
+ if (ret)
+ dev_err(dev, "rproc_boot failed\n");
++ else
++ m3_ipc_state = m3_ipc;
+
+ do_exit(0);
+ }
+@@ -512,8 +514,6 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ goto err_put_rproc;
+ }
+
+- m3_ipc_state = m3_ipc;
+-
+ return 0;
+
+ err_put_rproc:
+--
+2.20.1
+
--- /dev/null
+From 0cf119b70bd839c1d1dd2e451bf07866d093805a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 12:28:07 +0000
+Subject: tee: optee: Fix compilation issue with nommu
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vincenzo Frascino <vincenzo.frascino@arm.com>
+
+[ Upstream commit 9e0caab8e0f96f0af7d1dd388e62f44184a75372 ]
+
+The optee driver uses specific page table types to verify if a memory
+region is normal. These types are not defined in nommu systems. Trying
+to compile the driver in these systems results in a build error:
+
+ linux/drivers/tee/optee/call.c: In function ‘is_normal_memory’:
+ linux/drivers/tee/optee/call.c:533:26: error: ‘L_PTE_MT_MASK’ undeclared
+ (first use in this function); did you mean ‘PREEMPT_MASK’?
+ return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
+ ^~~~~~~~~~~~~
+ PREEMPT_MASK
+ linux/drivers/tee/optee/call.c:533:26: note: each undeclared identifier is
+ reported only once for each function it appears in
+ linux/drivers/tee/optee/call.c:533:44: error: ‘L_PTE_MT_WRITEALLOC’ undeclared
+ (first use in this function)
+ return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
+ ^~~~~~~~~~~~~~~~~~~
+
+Make the optee driver depend on MMU to fix the compilation issue.
+
+Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
+[jw: update commit title]
+Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/tee/optee/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/tee/optee/Kconfig b/drivers/tee/optee/Kconfig
+index 3c59e19029bef..3c1ec4e9ed29a 100644
+--- a/drivers/tee/optee/Kconfig
++++ b/drivers/tee/optee/Kconfig
+@@ -2,6 +2,7 @@
+ config OPTEE
+ tristate "OP-TEE"
+ depends on HAVE_ARM_SMCCC
++ depends on MMU
+ help
+ This implements the OP-TEE Trusted Execution Environment (TEE)
+ driver.
+--
+2.20.1
+
--- /dev/null
+From 157559b29c114b3089817be8c83aa0a337f06041 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Dec 2019 01:35:49 -0500
+Subject: tools lib traceevent: Fix memory leakage in filter_event
+
+From: Hewenliang <hewenliang4@huawei.com>
+
+[ Upstream commit f84ae29a6169318f9c929720c49d96323d2bbab9 ]
+
+It is necessary to call free_arg(arg) when add_filter_type() returns NULL
+in filter_event().
+
+Signed-off-by: Hewenliang <hewenliang4@huawei.com>
+Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
+Cc: Feilong Lin <linfeilong@huawei.com>
+Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
+Link: http://lore.kernel.org/lkml/20191209063549.59941-1-hewenliang4@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/lib/traceevent/parse-filter.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
+index 2700f1f17876e..27248a0aad84a 100644
+--- a/tools/lib/traceevent/parse-filter.c
++++ b/tools/lib/traceevent/parse-filter.c
+@@ -1227,8 +1227,10 @@ filter_event(struct event_filter *filter, struct event_format *event,
+ }
+
+ filter_type = add_filter_type(filter, event->id);
+- if (filter_type == NULL)
++ if (filter_type == NULL) {
++ free_arg(arg);
+ return TEP_ERRNO__MEM_ALLOC_FAILED;
++ }
+
+ if (filter_type->filter)
+ free_arg(filter_type->filter);
+--
+2.20.1
+
--- /dev/null
+From 07bcbc875188b948b8e7b893eece1d2cf9c292a0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:32:46 +0100
+Subject: vti[6]: fix packet tx through bpf_redirect()
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 95224166a9032ff5d08fca633d37113078ce7d01 ]
+
+With an ebpf program that redirects packets through a vti[6] interface,
+the packets are dropped because no dst is attached.
+
+This could also be reproduced with an AF_PACKET socket, with the following
+python script (vti1 is an ip_vti interface):
+
+ import socket
+ send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
+ # scapy
+ # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
+ # raw(p)
+ req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
+ send_s.sendto(req, ('vti1', 0x800, 0, 0))
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_vti.c | 13 +++++++++++--
+ net/ipv6/ip6_vti.c | 13 +++++++++++--
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 960f4faaf2942..f5e5fcd908592 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -208,8 +208,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+ int mtu;
+
+ if (!dst) {
+- dev->stats.tx_carrier_errors++;
+- goto tx_error_icmp;
++ struct rtable *rt;
++
++ fl->u.ip4.flowi4_oif = dev->ifindex;
++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++ if (IS_ERR(rt)) {
++ dev->stats.tx_carrier_errors++;
++ goto tx_error_icmp;
++ }
++ dst = &rt->dst;
++ skb_dst_set(skb, dst);
+ }
+
+ dst_hold(dst);
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index bfd39db3398a5..67ff206b6d619 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -453,8 +453,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
++ if (!dst) {
++ fl->u.ip6.flowi6_oif = dev->ifindex;
++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ dst = NULL;
++ goto tx_err_link_failure;
++ }
++ skb_dst_set(skb, dst);
++ }
+
+ dst_hold(dst);
+ dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
+--
+2.20.1
+
--- /dev/null
+From 94e8617c7581dffe16687112e46e9ec9fbd8bc43 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:14:32 +0000
+Subject: wireless: fix enabling channel 12 for custom regulatory domain
+
+From: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+
+[ Upstream commit c4b9d655e445a8be0bff624aedea190606b5ebbc ]
+
+Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by
+default when checking usable channels"") fixed a broken
+regulatory (leaving channel 12 open for AP where not permitted).
+Apply a similar fix to custom regulatory domain processing.
+
+Signed-off-by: Cathy Luo <xiaohua.luo@nxp.com>
+Signed-off-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Link: https://lore.kernel.org/r/1576836859-8945-1-git-send-email-ganapathi.bhat@nxp.com
+[reword commit message, fix coding style, add a comment]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 5643bdee7198f..4c3c8a1c116da 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -2254,14 +2254,15 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
+
+ static void handle_channel_custom(struct wiphy *wiphy,
+ struct ieee80211_channel *chan,
+- const struct ieee80211_regdomain *regd)
++ const struct ieee80211_regdomain *regd,
++ u32 min_bw)
+ {
+ u32 bw_flags = 0;
+ const struct ieee80211_reg_rule *reg_rule = NULL;
+ const struct ieee80211_power_rule *power_rule = NULL;
+ u32 bw;
+
+- for (bw = MHZ_TO_KHZ(20); bw >= MHZ_TO_KHZ(5); bw = bw / 2) {
++ for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
+ reg_rule = freq_reg_info_regd(MHZ_TO_KHZ(chan->center_freq),
+ regd, bw);
+ if (!IS_ERR(reg_rule))
+@@ -2317,8 +2318,14 @@ static void handle_band_custom(struct wiphy *wiphy,
+ if (!sband)
+ return;
+
++ /*
++ * We currently assume that you always want at least 20 MHz,
++ * otherwise channel 12 might get enabled if this rule is
++ * compatible to US, which permits 2402 - 2472 MHz.
++ */
+ for (i = 0; i < sband->n_channels; i++)
+- handle_channel_custom(wiphy, &sband->channels[i], regd);
++ handle_channel_custom(wiphy, &sband->channels[i], regd,
++ MHZ_TO_KHZ(20));
+ }
+
+ /* Used by drivers prior to wiphy registration */
+--
+2.20.1
+
--- /dev/null
+From 4f117c3d2558c4da6749525beb2d98157f23f765 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:07:35 +0100
+Subject: wireless: wext: avoid gcc -O3 warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e16119655c9e6c4aa5767cd971baa9c491f41b13 ]
+
+After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3,
+the wext code produces a bogus warning:
+
+In function 'iw_handler_get_iwstats',
+ inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9,
+ inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10,
+ inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8,
+ inlined from 'wext_handle_ioctl':
+net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull]
+ memcpy(extra, stats, sizeof(struct iw_statistics));
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In file included from arch/x86/include/asm/string.h:5,
+net/wireless/wext-core.c: In function 'wext_handle_ioctl':
+arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here
+
+The problem is that ioctl_standard_call() sometimes calls the handler
+with a NULL argument that would cause a problem for iw_handler_get_iwstats.
+However, iw_handler_get_iwstats never actually gets called that way.
+
+Marking that function as noinline avoids the warning and leads
+to slightly smaller object code as well.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107200741.3588770-1-arnd@arndb.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/wext-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 5e677dac2a0ce..69102fda9ebd4 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -657,7 +657,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)
+ return NULL;
+ }
+
+-static int iw_handler_get_iwstats(struct net_device * dev,
++/* noinline to avoid a bogus warning with -O3 */
++static noinline int iw_handler_get_iwstats(struct net_device * dev,
+ struct iw_request_info * info,
+ union iwreq_data * wrqu,
+ char * extra)
+--
+2.20.1
+
--- /dev/null
+From 9419adc146b4968dbf859d5af21bcf67bea5091d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:00:36 +0000
+Subject: xfrm: interface: do not confirm neighbor when do pmtu update
+
+From: Xu Wang <vulab@iscas.ac.cn>
+
+[ Upstream commit 8aaea2b0428b6aad7c7e22d3fddc31a78bb1d724 ]
+
+When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end,
+we should not call dst_confirm_neigh() as there is no two-way communication.
+
+Signed-off-by: Xu Wang <vulab@iscas.ac.cn>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 20565a4742112..317fe9c92932b 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -294,7 +294,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+
+ mtu = dst_mtu(dst);
+ if (!skb->ignore_df && skb->len > mtu) {
+- skb_dst_update_pmtu(skb, mtu);
++ skb_dst_update_pmtu_no_confirm(skb, mtu);
+
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+ if (mtu < IPV6_MIN_MTU)
+--
+2.20.1
+
--- /dev/null
+From 291ce2eb5e319d71f48f4066d537e800e9f66d33 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:32:47 +0100
+Subject: xfrm interface: fix packet tx through bpf_redirect()
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit f042365dbffea98fb8148c98c700402e8d099f02 ]
+
+With an ebpf program that redirects packets through a xfrm interface,
+packets are dropped because no dst is attached to skb.
+
+This could also be reproduced with an AF_PACKET socket, with the following
+python script (xfrm1 is a xfrm interface):
+
+ import socket
+ send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
+ # scapy
+ # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
+ # raw(p)
+ req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
+ send_s.sendto(req, ('xfrm1', 0x800, 0, 0))
+
+It was also not possible to send an ip packet through an AF_PACKET socket
+because a LL header was expected. Let's remove those LL header constraints.
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++-------
+ 1 file changed, 25 insertions(+), 7 deletions(-)
+
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 4ee512622e93d..20565a4742112 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
+-
+ dst_hold(dst);
+ dst = xfrm_lookup_with_ifid(xi->net, dst, fl, NULL, 0, xi->p.if_id);
+ if (IS_ERR(dst)) {
+@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ {
+ struct xfrm_if *xi = netdev_priv(dev);
+ struct net_device_stats *stats = &xi->dev->stats;
++ struct dst_entry *dst = skb_dst(skb);
+ struct flowi fl;
+ int ret;
+
+@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
+ case htons(ETH_P_IPV6):
+ xfrm_decode_session(skb, &fl, AF_INET6);
+ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
++ if (!dst) {
++ fl.u.ip6.flowi6_oif = dev->ifindex;
++ fl.u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, dst);
++ }
+ break;
+ case htons(ETH_P_IP):
+ xfrm_decode_session(skb, &fl, AF_INET);
+ memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
++ if (!dst) {
++ struct rtable *rt;
++
++ fl.u.ip4.flowi4_oif = dev->ifindex;
++ fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
++ if (IS_ERR(rt)) {
++ stats->tx_carrier_errors++;
++ goto tx_err;
++ }
++ skb_dst_set(skb, &rt->dst);
++ }
+ break;
+ default:
+ goto tx_err;
+@@ -566,12 +587,9 @@ static void xfrmi_dev_setup(struct net_device *dev)
+ {
+ dev->netdev_ops = &xfrmi_netdev_ops;
+ dev->type = ARPHRD_NONE;
+- dev->hard_header_len = ETH_HLEN;
+- dev->min_header_len = ETH_HLEN;
+ dev->mtu = ETH_DATA_LEN;
+ dev->min_mtu = ETH_MIN_MTU;
+- dev->max_mtu = ETH_DATA_LEN;
+- dev->addr_len = ETH_ALEN;
++ dev->max_mtu = IP_MAX_MTU;
+ dev->flags = IFF_NOARP;
+ dev->needs_free_netdev = true;
+ dev->priv_destructor = xfrmi_dev_free;
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
