--- /dev/null
+From bb2e2b1b3e4f597fa0608df746a313b28e576bb3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:07:28 +1100
+Subject: airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit 78f7a7566f5eb59321e99b55a6fdb16ea05b37d1 ]
+
+The driver for Cisco Aironet 4500 and 4800 series cards (airo.c),
+implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().
+
+The ioctl handler copies an aironet_ioctl struct from userspace, which
+includes a command. Some of the commands are handled in readrids(),
+where the user controlled command is converted into a driver-internal
+value called "ridcode".
+
+There are two command values, AIROGWEPKTMP and AIROGWEPKNV, which
+correspond to ridcode values of RID_WEP_TEMP and RID_WEP_PERM
+respectively. These commands both have checks that the user has
+CAP_NET_ADMIN, with the comment that "Only super-user can read WEP
+keys", otherwise they return -EPERM.
+
+However there is another command value, AIRORRID, that lets the user
+specify the ridcode value directly, with no other checks. This means
+the user can bypass the CAP_NET_ADMIN check on AIROGWEPKTMP and
+AIROGWEPKNV.
+
+Fix it by moving the CAP_NET_ADMIN check out of the command handling
+and instead do it later based on the ridcode. That way regardless of
+whether the ridcode is set via AIROGWEPKTMP or AIROGWEPKNV, or passed
+in using AIRORID, we always do the CAP_NET_ADMIN check.
+
+Found by Ilja by code inspection, not tested as I don't have the
+required hardware.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/cisco/airo.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 7956b5b529c99..a8d470010f5ea 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -7796,16 +7796,8 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ case AIROGVLIST: ridcode = RID_APLIST; break;
+ case AIROGDRVNAM: ridcode = RID_DRVNAME; break;
+ case AIROGEHTENC: ridcode = RID_ETHERENCAP; break;
+- case AIROGWEPKTMP: ridcode = RID_WEP_TEMP;
+- /* Only super-user can read WEP keys */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- break;
+- case AIROGWEPKNV: ridcode = RID_WEP_PERM;
+- /* Only super-user can read WEP keys */
+- if (!capable(CAP_NET_ADMIN))
+- return -EPERM;
+- break;
++ case AIROGWEPKTMP: ridcode = RID_WEP_TEMP; break;
++ case AIROGWEPKNV: ridcode = RID_WEP_PERM; break;
+ case AIROGSTAT: ridcode = RID_STATUS; break;
+ case AIROGSTATSD32: ridcode = RID_STATSDELTA; break;
+ case AIROGSTATSC32: ridcode = RID_STATS; break;
+@@ -7819,6 +7811,12 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ return -EINVAL;
+ }
+
++ if (ridcode == RID_WEP_TEMP || ridcode == RID_WEP_PERM) {
++ /* Only super-user can read WEP keys */
++ if (!capable(CAP_NET_ADMIN))
++ return -EPERM;
++ }
++
+ if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+
+--
+2.20.1
+
--- /dev/null
+From 73115c1d2bb90f7366512b6da0a37249a12a5418 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:07:27 +1100
+Subject: airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+[ Upstream commit d6bce2137f5d6bb1093e96d2f801479099b28094 ]
+
+The driver for Cisco Aironet 4500 and 4800 series cards (airo.c),
+implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().
+
+The ioctl handler copies an aironet_ioctl struct from userspace, which
+includes a command and a length. Some of the commands are handled in
+readrids(), which kmalloc()'s a buffer of RIDSIZE (2048) bytes.
+
+That buffer is then passed to PC4500_readrid(), which has two cases.
+The else case does some setup and then reads up to RIDSIZE bytes from
+the hardware into the kmalloc()'ed buffer.
+
+Here len == RIDSIZE, pBuf is the kmalloc()'ed buffer:
+
+ // read the rid length field
+ bap_read(ai, pBuf, 2, BAP1);
+ // length for remaining part of rid
+ len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2;
+ ...
+ // read remainder of the rid
+ rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1);
+
+PC4500_readrid() then returns to readrids() which does:
+
+ len = comp->len;
+ if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) {
+
+Where comp->len is the user controlled length field.
+
+So if the "rid length field" returned by the hardware is < 2048, and
+the user requests 2048 bytes in comp->len, we will leak the previous
+contents of the kmalloc()'ed buffer to userspace.
+
+Fix it by kzalloc()'ing the buffer.
+
+Found by Ilja by code inspection, not tested as I don't have the
+required hardware.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/cisco/airo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
+index 04939e576ee02..7956b5b529c99 100644
+--- a/drivers/net/wireless/cisco/airo.c
++++ b/drivers/net/wireless/cisco/airo.c
+@@ -7819,7 +7819,7 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
+ return -EINVAL;
+ }
+
+- if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
++ if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
+ return -ENOMEM;
+
+ PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1);
+--
+2.20.1
+
--- /dev/null
+From 998b8ccff6bf22854d6bfabda899f3ae1f1d13ec Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 20 Jan 2020 15:07:46 +0100
+Subject: ARM: 8955/1: virt: Relax arch timer version check during early boot
+
+From: Vladimir Murzin <vladimir.murzin@arm.com>
+
+[ Upstream commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e ]
+
+Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to
+have values other than 0 or 1 while still preserving backward
+compatibility. At the moment, Linux is quite strict in the way it
+handles this field at early boot and will not configure arch timer if
+it doesn't find the value 1.
+
+Since here use ubfx for arch timer version extraction (hyb-stub build
+with -march=armv7-a, so it is safe)
+
+To help backports (even though the code was correct at the time of writing)
+
+Fixes: 8ec58be9f3ff ("ARM: virt: arch_timers: enable access to physical timers")
+Acked-by: Marc Zyngier <maz@kernel.org>
+Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/kernel/hyp-stub.S | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S
+index f5e5e3e196592..f587681a9553c 100644
+--- a/arch/arm/kernel/hyp-stub.S
++++ b/arch/arm/kernel/hyp-stub.S
+@@ -158,10 +158,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE
+ #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER)
+ @ make CNTP_* and CNTPCT accessible from PL1
+ mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1
+- lsr r7, #16
+- and r7, #0xf
+- cmp r7, #1
+- bne 1f
++ ubfx r7, r7, #16, #4
++ teq r7, #0
++ beq 1f
+ mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL
+ orr r7, r7, #3 @ PL1PCEN | PL1PCTEN
+ mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL
+--
+2.20.1
+
--- /dev/null
+From 5d4b49c05b12895711ab7f37af754490d2d40274 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 17 Dec 2019 14:21:24 +0530
+Subject: ARM: dts: beagle-x15-common: Model 5V0 regulator
+
+From: Kishon Vijay Abraham I <kishon@ti.com>
+
+[ Upstream commit e17e7c498d4f734df93c300441e100818ed58168 ]
+
+On am57xx-beagle-x15, 5V0 is connected to P16, P17, P18 and P19
+connectors. On am57xx-evm, 5V0 regulator is used to get 3V6 regulator
+which is connected to the COMQ port. Model 5V0 regulator here in order
+for it to be used in am57xx-evm to model 3V6 regulator.
+
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../boot/dts/am57xx-beagle-x15-common.dtsi | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+index 78bee26361f15..552de167f95fe 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
++++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
+@@ -27,6 +27,27 @@
+ reg = <0x0 0x80000000 0x0 0x80000000>;
+ };
+
++ main_12v0: fixedregulator-main_12v0 {
++ /* main supply */
++ compatible = "regulator-fixed";
++ regulator-name = "main_12v0";
++ regulator-min-microvolt = <12000000>;
++ regulator-max-microvolt = <12000000>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
++ evm_5v0: fixedregulator-evm_5v0 {
++ /* Output of TPS54531D */
++ compatible = "regulator-fixed";
++ regulator-name = "evm_5v0";
++ regulator-min-microvolt = <5000000>;
++ regulator-max-microvolt = <5000000>;
++ vin-supply = <&main_12v0>;
++ regulator-always-on;
++ regulator-boot-on;
++ };
++
+ vdd_3v3: fixedregulator-vdd_3v3 {
+ compatible = "regulator-fixed";
+ regulator-name = "vdd_3v3";
+--
+2.20.1
+
--- /dev/null
+From c5505d2f2ee0d90cff39f3c7f53afa1d6a6d4216 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 18 Dec 2019 20:04:54 +0100
+Subject: clk: mmp2: Fix the order of timer mux parents
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+[ Upstream commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad ]
+
+Determined empirically, no documentation is available.
+
+The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but
+thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing
+what is going on, ended up just dividing the rate as of
+commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")'
+
+Link: https://lore.kernel.org/r/20191218190454.420358-3-lkundrak@v3.sk
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/mmp/clk-of-mmp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
+index 061a9f10218b3..20cfdf837bfab 100644
+--- a/drivers/clk/mmp/clk-of-mmp2.c
++++ b/drivers/clk/mmp/clk-of-mmp2.c
+@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock);
+ static const char *ssp_parent_names[] = {"vctcxo_4", "vctcxo_2", "vctcxo", "pll1_16"};
+
+ static DEFINE_SPINLOCK(timer_lock);
+-static const char *timer_parent_names[] = {"clk32", "vctcxo_2", "vctcxo_4", "vctcxo"};
++static const char *timer_parent_names[] = {"clk32", "vctcxo_4", "vctcxo_2", "vctcxo"};
+
+ static DEFINE_SPINLOCK(reset_lock);
+
+--
+2.20.1
+
--- /dev/null
+From 98f0ffd7c040bb20f3605dbef75ecc687a17aab2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Jan 2020 11:59:52 -0800
+Subject: Input: aiptek - use descriptors of current altsetting
+
+From: Johan Hovold <johan@kernel.org>
+
+[ Upstream commit cfa4f6a99fb183742cace65ec551b444852b8ef6 ]
+
+Make sure to always use the descriptors of the current alternate setting
+to avoid future issues when accessing fields that may differ between
+settings.
+
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Acked-by: Vladis Dronov <vdronov@redhat.com>
+Link: https://lore.kernel.org/r/20191210113737.4016-4-johan@kernel.org
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/input/tablet/aiptek.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/input/tablet/aiptek.c b/drivers/input/tablet/aiptek.c
+index 5a7e5e073e526..3b5bccad4a1bb 100644
+--- a/drivers/input/tablet/aiptek.c
++++ b/drivers/input/tablet/aiptek.c
+@@ -1733,7 +1733,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id)
+
+ aiptek->inputdev = inputdev;
+ aiptek->intf = intf;
+- aiptek->ifnum = intf->altsetting[0].desc.bInterfaceNumber;
++ aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
+ aiptek->inDelay = 0;
+ aiptek->endDelay = 0;
+ aiptek->previousJitterable = 0;
+--
+2.20.1
+
--- /dev/null
+From 514ac5e856f30c58fc714008db2bf3ab7a0a65e2 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 27 Nov 2019 17:03:55 +0800
+Subject: ixgbe: Fix calculation of queue with VFs and flow director on
+ interface flap
+
+From: Cambda Zhu <cambda@linux.alibaba.com>
+
+[ Upstream commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 ]
+
+This patch fixes the calculation of queue when we restore flow director
+filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's
+vf may be zero which makes the queue outside of the rx_ring array.
+
+The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry().
+
+Signed-off-by: Cambda Zhu <cambda@linux.alibaba.com>
+Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++++++++++++-----
+ 1 file changed, 27 insertions(+), 10 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 8ad20b7852ed7..4c729faeb7132 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -4804,7 +4804,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct hlist_node *node2;
+ struct ixgbe_fdir_filter *filter;
+- u64 action;
++ u8 queue;
+
+ spin_lock(&adapter->fdir_perfect_lock);
+
+@@ -4813,17 +4813,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)
+
+ hlist_for_each_entry_safe(filter, node2,
+ &adapter->fdir_filter_list, fdir_node) {
+- action = filter->action;
+- if (action != IXGBE_FDIR_DROP_QUEUE && action != 0)
+- action =
+- (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1;
++ if (filter->action == IXGBE_FDIR_DROP_QUEUE) {
++ queue = IXGBE_FDIR_DROP_QUEUE;
++ } else {
++ u32 ring = ethtool_get_flow_spec_ring(filter->action);
++ u8 vf = ethtool_get_flow_spec_ring_vf(filter->action);
++
++ if (!vf && (ring >= adapter->num_rx_queues)) {
++ e_err(drv, "FDIR restore failed without VF, ring: %u\n",
++ ring);
++ continue;
++ } else if (vf &&
++ ((vf > adapter->num_vfs) ||
++ ring >= adapter->num_rx_queues_per_pool)) {
++ e_err(drv, "FDIR restore failed with VF, vf: %hhu, ring: %u\n",
++ vf, ring);
++ continue;
++ }
++
++ /* Map the ring onto the absolute queue index */
++ if (!vf)
++ queue = adapter->rx_ring[ring]->reg_idx;
++ else
++ queue = ((vf - 1) *
++ adapter->num_rx_queues_per_pool) + ring;
++ }
+
+ ixgbe_fdir_write_perfect_filter_82599(hw,
+- &filter->filter,
+- filter->sw_idx,
+- (action == IXGBE_FDIR_DROP_QUEUE) ?
+- IXGBE_FDIR_DROP_QUEUE :
+- adapter->rx_ring[action]->reg_idx);
++ &filter->filter, filter->sw_idx, queue);
+ }
+
+ spin_unlock(&adapter->fdir_perfect_lock);
+--
+2.20.1
+
--- /dev/null
+From 683a026fefdb39f43fbfa29920bd673366f311cb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 25 Nov 2019 15:24:52 +0100
+Subject: ixgbevf: Remove limit of 10 entries for unicast filter list
+
+From: Radoslaw Tyl <radoslawx.tyl@intel.com>
+
+[ Upstream commit aa604651d523b1493988d0bf6710339f3ee60272 ]
+
+Currently, though the FDB entry is added to VF, it does not appear in
+RAR filters. VF driver only allows to add 10 entries. Attempting to add
+another causes an error. This patch removes limitation and allows use of
+all free RAR entries for the FDB if needed.
+
+Fixes: 46ec20ff7d ("ixgbevf: Add macvlan support in the set rx mode op")
+Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
+Acked-by: Paul Menzel <pmenzel@molgen.mpg.de>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 75607267e656f..7a763e85ff27e 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -1885,11 +1885,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev)
+ struct ixgbe_hw *hw = &adapter->hw;
+ int count = 0;
+
+- if ((netdev_uc_count(netdev)) > 10) {
+- pr_err("Too many unicast filters - No Space\n");
+- return -ENOSPC;
+- }
+-
+ if (!netdev_uc_empty(netdev)) {
+ struct netdev_hw_addr *ha;
+
+--
+2.20.1
+
--- /dev/null
+From 267a63e4ef545fab4f51f40fbeee97011129d556 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 10:11:13 +0300
+Subject: l2t_seq_next should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 66018a102f7756cf72db4d2704e1b93969d9d332 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+index 60a26037a1c67..e58aae110ed2d 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+@@ -682,8 +682,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos)
+ static void *l2t_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = l2t_get_idx(seq, *pos);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+--
+2.20.1
+
--- /dev/null
+From fad7a77f580cf5e50f3332ab95e372c19380db77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 17:35:45 +0200
+Subject: mac80211: Fix TKIP replay protection immediately after key setup
+
+From: Jouni Malinen <j@w1.fi>
+
+[ Upstream commit 6f601265215a421f425ba3a4850a35861d024643 ]
+
+TKIP replay protection was skipped for the very first frame received
+after a new key is configured. While this is potentially needed to avoid
+dropping a frame in some cases, this does leave a window for replay
+attacks with group-addressed frames at the station side. Any earlier
+frame sent by the AP using the same key would be accepted as a valid
+frame and the internal RSC would then be updated to the TSC from that
+frame. This would allow multiple previously transmitted group-addressed
+frames to be replayed until the next valid new group-addressed frame
+from the AP is received by the station.
+
+Fix this by limiting the no-replay-protection exception to apply only
+for the case where TSC=0, i.e., when this is for the very first frame
+protected using the new key, and the local RSC had not been set to a
+higher value when configuring the key (which may happen with GTK).
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+Link: https://lore.kernel.org/r/20200107153545.10934-1-j@w1.fi
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/tkip.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/net/mac80211/tkip.c b/net/mac80211/tkip.c
+index b3622823bad23..ebd66e8f46b3f 100644
+--- a/net/mac80211/tkip.c
++++ b/net/mac80211/tkip.c
+@@ -266,9 +266,21 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,
+ if ((keyid >> 6) != key->conf.keyidx)
+ return TKIP_DECRYPT_INVALID_KEYIDX;
+
+- if (rx_ctx->ctx.state != TKIP_STATE_NOT_INIT &&
+- (iv32 < rx_ctx->iv32 ||
+- (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16)))
++ /* Reject replays if the received TSC is smaller than or equal to the
++ * last received value in a valid message, but with an exception for
++ * the case where a new key has been set and no valid frame using that
++ * key has yet received and the local RSC was initialized to 0. This
++ * exception allows the very first frame sent by the transmitter to be
++ * accepted even if that transmitter were to use TSC 0 (IEEE 802.11
++ * described TSC to be initialized to 1 whenever a new key is taken into
++ * use).
++ */
++ if (iv32 < rx_ctx->iv32 ||
++ (iv32 == rx_ctx->iv32 &&
++ (iv16 < rx_ctx->iv16 ||
++ (iv16 == rx_ctx->iv16 &&
++ (rx_ctx->iv32 || rx_ctx->iv16 ||
++ rx_ctx->ctx.state != TKIP_STATE_NOT_INIT)))))
+ return TKIP_DECRYPT_REPLAY;
+
+ if (only_iv) {
+--
+2.20.1
+
--- /dev/null
+From 25d9b93bbc8ebf5ec274bba916f5a8fa5b29699f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 3 Dec 2019 19:06:44 +0100
+Subject: mac80211: mesh: restrict airtime metric to peered established plinks
+
+From: Markus Theil <markus.theil@tu-ilmenau.de>
+
+[ Upstream commit 02a614499600af836137c3fbc4404cd96365fff2 ]
+
+The following warning is triggered every time an unestablished mesh peer
+gets dumped. Checks if a peer link is established before retrieving the
+airtime link metric.
+
+[ 9563.022567] WARNING: CPU: 0 PID: 6287 at net/mac80211/mesh_hwmp.c:345
+ airtime_link_metric_get+0xa2/0xb0 [mac80211]
+[ 9563.022697] Hardware name: PC Engines apu2/apu2, BIOS v4.10.0.3
+[ 9563.022756] RIP: 0010:airtime_link_metric_get+0xa2/0xb0 [mac80211]
+[ 9563.022838] Call Trace:
+[ 9563.022897] sta_set_sinfo+0x936/0xa10 [mac80211]
+[ 9563.022964] ieee80211_dump_station+0x6d/0x90 [mac80211]
+[ 9563.023062] nl80211_dump_station+0x154/0x2a0 [cfg80211]
+[ 9563.023120] netlink_dump+0x17b/0x370
+[ 9563.023130] netlink_recvmsg+0x2a4/0x480
+[ 9563.023140] ____sys_recvmsg+0xa6/0x160
+[ 9563.023154] ___sys_recvmsg+0x93/0xe0
+[ 9563.023169] __sys_recvmsg+0x7e/0xd0
+[ 9563.023210] do_syscall_64+0x4e/0x140
+[ 9563.023217] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
+Link: https://lore.kernel.org/r/20191203180644.70653-1-markus.theil@tu-ilmenau.de
+[rewrite commit message]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/mac80211/mesh_hwmp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
+index b0acb2961e805..5f4c228b82e56 100644
+--- a/net/mac80211/mesh_hwmp.c
++++ b/net/mac80211/mesh_hwmp.c
+@@ -326,6 +326,9 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,
+ u32 tx_time, estimated_retx;
+ u64 result;
+
++ if (sta->mesh->plink_state != NL80211_PLINK_ESTAB)
++ return MAX_METRIC;
++
+ /* Try to get rate based on HW/SW RC algorithm.
+ * Rate is returned in units of Kbps, correct this
+ * to comply with airtime calculation units
+--
+2.20.1
+
--- /dev/null
+From 0fbe11db28e85aaa38c66d2274f97f3374f2d6c5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 12:33:28 -0800
+Subject: net: Fix skb->csum update in inet_proto_csum_replace16().
+
+From: Praveen Chaudhary <praveen5582@gmail.com>
+
+[ Upstream commit 189c9b1e94539b11c80636bc13e9cf47529e7bba ]
+
+skb->csum is updated incorrectly, when manipulation for
+NF_NAT_MANIP_SRC\DST is done on IPV6 packet.
+
+Fix:
+There is no need to update skb->csum in inet_proto_csum_replace16(),
+because update in two fields a.) IPv6 src/dst address and b.) L4 header
+checksum cancels each other for skb->csum calculation. Whereas
+inet_proto_csum_replace4 function needs to update skb->csum, because
+update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum
+and c.) L4 header checksum results in same diff as L4 Header checksum
+for skb->csum calculation.
+
+[ pablo@netfilter.org: a few comestic documentation edits ]
+Signed-off-by: Praveen Chaudhary <pchaudhary@linkedin.com>
+Signed-off-by: Zhenggen Xu <zxu@linkedin.com>
+Signed-off-by: Andy Stracner <astracner@linkedin.com>
+Reviewed-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/core/utils.c | 20 +++++++++++++++++---
+ 1 file changed, 17 insertions(+), 3 deletions(-)
+
+diff --git a/net/core/utils.c b/net/core/utils.c
+index cf5622b9ccc44..3317f90b32eb0 100644
+--- a/net/core/utils.c
++++ b/net/core/utils.c
+@@ -316,6 +316,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL(inet_proto_csum_replace4);
+
++/**
++ * inet_proto_csum_replace16 - update layer 4 header checksum field
++ * @sum: Layer 4 header checksum field
++ * @skb: sk_buff for the packet
++ * @from: old IPv6 address
++ * @to: new IPv6 address
++ * @pseudohdr: True if layer 4 header checksum includes pseudoheader
++ *
++ * Update layer 4 header as per the update in IPv6 src/dst address.
++ *
++ * There is no need to update skb->csum in this function, because update in two
++ * fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other
++ * for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to
++ * update skb->csum, because update in 3 fields a.) IPv4 src/dst address,
++ * b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as
++ * L4 Header checksum for skb->csum calculation.
++ */
+ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ const __be32 *from, const __be32 *to,
+ bool pseudohdr)
+@@ -327,9 +344,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,
+ if (skb->ip_summed != CHECKSUM_PARTIAL) {
+ *sum = csum_fold(csum_partial(diff, sizeof(diff),
+ ~csum_unfold(*sum)));
+- if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+- skb->csum = ~csum_partial(diff, sizeof(diff),
+- ~skb->csum);
+ } else if (pseudohdr)
+ *sum = ~csum_fold(csum_partial(diff, sizeof(diff),
+ csum_unfold(*sum)));
+--
+2.20.1
+
--- /dev/null
+From 42d1f425db308e6361e819898ff4bf8cd3fc4bac Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:15:14 +0200
+Subject: net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 457bfc0a4bf531487ecc3cf82ec728a5e114fb1e ]
+
+As the only 10G PHY interface type defined at the moment the code
+was developed was XGMII, although the PHY interface mode used was
+not XGMII, XGMII was used in the code to denote 10G. This patch
+renames the 10G interface mode to remove the ambiguity.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/fman/fman_memac.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c
+index 21dd5579130e6..c30994a09a7c2 100644
+--- a/drivers/net/ethernet/freescale/fman/fman_memac.c
++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c
+@@ -109,7 +109,7 @@ do { \
+ /* Interface Mode Register (IF_MODE) */
+
+ #define IF_MODE_MASK 0x00000003 /* 30-31 Mask on i/f mode bits */
+-#define IF_MODE_XGMII 0x00000000 /* 30-31 XGMII (10G) interface */
++#define IF_MODE_10G 0x00000000 /* 30-31 10G interface */
+ #define IF_MODE_GMII 0x00000002 /* 30-31 GMII (1G) interface */
+ #define IF_MODE_RGMII 0x00000004
+ #define IF_MODE_RGMII_AUTO 0x00008000
+@@ -438,7 +438,7 @@ static int init(struct memac_regs __iomem *regs, struct memac_cfg *cfg,
+ tmp = 0;
+ switch (phy_if) {
+ case PHY_INTERFACE_MODE_XGMII:
+- tmp |= IF_MODE_XGMII;
++ tmp |= IF_MODE_10G;
+ break;
+ default:
+ tmp |= IF_MODE_GMII;
+--
+2.20.1
+
--- /dev/null
+From bd333040c4b063c63f8740d09110e77b609246af Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:20:29 +0200
+Subject: net/fsl: treat fsl,erratum-a011043
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 ]
+
+When fsl,erratum-a011043 is set, adjust for erratum A011043:
+MDIO reads to internal PCS registers may result in having
+the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no
+error and read data (MDIO_DATA[MDIO_DATA]) is correct.
+Software may get false read error when reading internal
+PCS registers through MDIO. As a workaround, all internal
+MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/xgmac_mdio.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/xgmac_mdio.c b/drivers/net/ethernet/freescale/xgmac_mdio.c
+index e03b30c60dcfd..c82c85ef5fb34 100644
+--- a/drivers/net/ethernet/freescale/xgmac_mdio.c
++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c
+@@ -49,6 +49,7 @@ struct tgec_mdio_controller {
+ struct mdio_fsl_priv {
+ struct tgec_mdio_controller __iomem *mdio_base;
+ bool is_little_endian;
++ bool has_a011043;
+ };
+
+ static u32 xgmac_read32(void __iomem *regs,
+@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum)
+ return ret;
+
+ /* Return all Fs if nothing was there */
+- if (xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) {
++ if ((xgmac_read32(®s->mdio_stat, endian) & MDIO_STAT_RD_ER) &&
++ !priv->has_a011043) {
+ dev_err(&bus->dev,
+ "Error while reading PHY%d reg at %d.%hhu\n",
+ phy_id, dev_addr, regnum);
+@@ -274,6 +276,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev)
+ priv->is_little_endian = of_property_read_bool(pdev->dev.of_node,
+ "little-endian");
+
++ priv->has_a011043 = of_property_read_bool(pdev->dev.of_node,
++ "fsl,erratum-a011043");
++
+ ret = of_mdiobus_register(bus, np);
+ if (ret) {
+ dev_err(&pdev->dev, "cannot register MDIO bus\n");
+--
+2.20.1
+
--- /dev/null
+From 88f6f2d28c100a4f228aed8b22ff9588b845ce60 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 09:07:26 +1100
+Subject: net/sonic: Add mutual exclusion for accessing shared state
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 865ad2f2201dc18685ba2686f13217f8b3a9c52c ]
+
+The netif_stop_queue() call in sonic_send_packet() races with the
+netif_wake_queue() call in sonic_interrupt(). This causes issues
+like "NETDEV WATCHDOG: eth0 (macsonic): transmit queue 0 timed out".
+Fix this by disabling interrupts when accessing tx_skb[] and next_tx.
+Update a comment to clarify the synchronization properties.
+
+Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 49 ++++++++++++++++++++--------
+ drivers/net/ethernet/natsemi/sonic.h | 1 +
+ 2 files changed, 36 insertions(+), 14 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index a051dddcbd768..7aa7f8050d44e 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -50,6 +50,8 @@ static int sonic_open(struct net_device *dev)
+ if (sonic_debug > 2)
+ printk("sonic_open: initializing sonic driver.\n");
+
++ spin_lock_init(&lp->lock);
++
+ for (i = 0; i < SONIC_NUM_RRS; i++) {
+ struct sk_buff *skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
+ if (skb == NULL) {
+@@ -194,8 +196,6 @@ static void sonic_tx_timeout(struct net_device *dev)
+ * wake the tx queue
+ * Concurrently with all of this, the SONIC is potentially writing to
+ * the status flags of the TDs.
+- * Until some mutual exclusion is added, this code will not work with SMP. However,
+- * MIPS Jazz machines and m68k Macs were all uni-processor machines.
+ */
+
+ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+@@ -203,7 +203,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ struct sonic_local *lp = netdev_priv(dev);
+ dma_addr_t laddr;
+ int length;
+- int entry = lp->next_tx;
++ int entry;
++ unsigned long flags;
+
+ if (sonic_debug > 2)
+ printk("sonic_send_packet: skb=%p, dev=%p\n", skb, dev);
+@@ -226,6 +227,10 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ return NETDEV_TX_OK;
+ }
+
++ spin_lock_irqsave(&lp->lock, flags);
++
++ entry = lp->next_tx;
++
+ sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */
+ sonic_tda_put(dev, entry, SONIC_TD_FRAG_COUNT, 1); /* single fragment */
+ sonic_tda_put(dev, entry, SONIC_TD_PKTSIZE, length); /* length of packet */
+@@ -235,10 +240,6 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+ sonic_tda_put(dev, entry, SONIC_TD_LINK,
+ sonic_tda_get(dev, entry, SONIC_TD_LINK) | SONIC_EOL);
+
+- /*
+- * Must set tx_skb[entry] only after clearing status, and
+- * before clearing EOL and before stopping queue
+- */
+ wmb();
+ lp->tx_len[entry] = length;
+ lp->tx_laddr[entry] = laddr;
+@@ -263,6 +264,8 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)
+
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_TXP);
+
++ spin_unlock_irqrestore(&lp->lock, flags);
++
+ return NETDEV_TX_OK;
+ }
+
+@@ -275,9 +278,21 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ struct net_device *dev = dev_id;
+ struct sonic_local *lp = netdev_priv(dev);
+ int status;
++ unsigned long flags;
++
++ /* The lock has two purposes. Firstly, it synchronizes sonic_interrupt()
++ * with sonic_send_packet() so that the two functions can share state.
++ * Secondly, it makes sonic_interrupt() re-entrant, as that is required
++ * by macsonic which must use two IRQs with different priority levels.
++ */
++ spin_lock_irqsave(&lp->lock, flags);
++
++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT;
++ if (!status) {
++ spin_unlock_irqrestore(&lp->lock, flags);
+
+- if (!(status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT))
+ return IRQ_NONE;
++ }
+
+ do {
+ if (status & SONIC_INT_PKTRX) {
+@@ -292,11 +307,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ int td_status;
+ int freed_some = 0;
+
+- /* At this point, cur_tx is the index of a TD that is one of:
+- * unallocated/freed (status set & tx_skb[entry] clear)
+- * allocated and sent (status set & tx_skb[entry] set )
+- * allocated and not yet sent (status clear & tx_skb[entry] set )
+- * still being allocated by sonic_send_packet (status clear & tx_skb[entry] clear)
++ /* The state of a Transmit Descriptor may be inferred
++ * from { tx_skb[entry], td_status } as follows.
++ * { clear, clear } => the TD has never been used
++ * { set, clear } => the TD was handed to SONIC
++ * { set, set } => the TD was handed back
++ * { clear, set } => the TD is available for re-use
+ */
+
+ if (sonic_debug > 2)
+@@ -398,7 +414,12 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ /* load CAM done */
+ if (status & SONIC_INT_LCD)
+ SONIC_WRITE(SONIC_ISR, SONIC_INT_LCD); /* clear the interrupt */
+- } while((status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT));
++
++ status = SONIC_READ(SONIC_ISR) & SONIC_IMR_DEFAULT;
++ } while (status);
++
++ spin_unlock_irqrestore(&lp->lock, flags);
++
+ return IRQ_HANDLED;
+ }
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h
+index 07091dd27e5df..1fd61d7f79bcb 100644
+--- a/drivers/net/ethernet/natsemi/sonic.h
++++ b/drivers/net/ethernet/natsemi/sonic.h
+@@ -320,6 +320,7 @@ struct sonic_local {
+ unsigned int next_tx; /* next free TD */
+ struct device *device; /* generic device */
+ struct net_device_stats stats;
++ spinlock_t lock;
+ };
+
+ #define TX_TIMEOUT (3 * HZ)
+--
+2.20.1
+
--- /dev/null
+From 9af7f6b1223a68069d0147b69791579f2761c452 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 09:07:26 +1100
+Subject: net/sonic: Fix receive buffer handling
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 9e311820f67e740f4fb8dcb82b4c4b5b05bdd1a5 ]
+
+The SONIC can sometimes advance its rx buffer pointer (RRP register)
+without advancing its rx descriptor pointer (CRDA register). As a result
+the index of the current rx descriptor may not equal that of the current
+rx buffer. The driver mistakenly assumes that they are always equal.
+This assumption leads to incorrect packet lengths and possible packet
+duplication. Avoid this by calling a new function to locate the buffer
+corresponding to a given descriptor.
+
+Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 35 ++++++++++++++++++++++++----
+ drivers/net/ethernet/natsemi/sonic.h | 5 ++--
+ 2 files changed, 33 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index 7aa7f8050d44e..b6599aa22504f 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -423,6 +423,21 @@ static irqreturn_t sonic_interrupt(int irq, void *dev_id)
+ return IRQ_HANDLED;
+ }
+
++/* Return the array index corresponding to a given Receive Buffer pointer. */
++static int index_from_addr(struct sonic_local *lp, dma_addr_t addr,
++ unsigned int last)
++{
++ unsigned int i = last;
++
++ do {
++ i = (i + 1) & SONIC_RRS_MASK;
++ if (addr == lp->rx_laddr[i])
++ return i;
++ } while (i != last);
++
++ return -ENOENT;
++}
++
+ /*
+ * We have a good packet(s), pass it/them up the network stack.
+ */
+@@ -442,6 +457,16 @@ static void sonic_rx(struct net_device *dev)
+
+ status = sonic_rda_get(dev, entry, SONIC_RD_STATUS);
+ if (status & SONIC_RCR_PRX) {
++ u32 addr = (sonic_rda_get(dev, entry,
++ SONIC_RD_PKTPTR_H) << 16) |
++ sonic_rda_get(dev, entry, SONIC_RD_PKTPTR_L);
++ int i = index_from_addr(lp, addr, entry);
++
++ if (i < 0) {
++ WARN_ONCE(1, "failed to find buffer!\n");
++ break;
++ }
++
+ /* Malloc up new buffer. */
+ new_skb = netdev_alloc_skb(dev, SONIC_RBSIZE + 2);
+ if (new_skb == NULL) {
+@@ -463,7 +488,7 @@ static void sonic_rx(struct net_device *dev)
+
+ /* now we have a new skb to replace it, pass the used one up the stack */
+ dma_unmap_single(lp->device, lp->rx_laddr[entry], SONIC_RBSIZE, DMA_FROM_DEVICE);
+- used_skb = lp->rx_skb[entry];
++ used_skb = lp->rx_skb[i];
+ pkt_len = sonic_rda_get(dev, entry, SONIC_RD_PKTLEN);
+ skb_trim(used_skb, pkt_len);
+ used_skb->protocol = eth_type_trans(used_skb, dev);
+@@ -472,13 +497,13 @@ static void sonic_rx(struct net_device *dev)
+ lp->stats.rx_bytes += pkt_len;
+
+ /* and insert the new skb */
+- lp->rx_laddr[entry] = new_laddr;
+- lp->rx_skb[entry] = new_skb;
++ lp->rx_laddr[i] = new_laddr;
++ lp->rx_skb[i] = new_skb;
+
+ bufadr_l = (unsigned long)new_laddr & 0xffff;
+ bufadr_h = (unsigned long)new_laddr >> 16;
+- sonic_rra_put(dev, entry, SONIC_RR_BUFADR_L, bufadr_l);
+- sonic_rra_put(dev, entry, SONIC_RR_BUFADR_H, bufadr_h);
++ sonic_rra_put(dev, i, SONIC_RR_BUFADR_L, bufadr_l);
++ sonic_rra_put(dev, i, SONIC_RR_BUFADR_H, bufadr_h);
+ } else {
+ /* This should only happen, if we enable accepting broken packets. */
+ lp->stats.rx_errors++;
+diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h
+index a009a99c0e544..d9f8ceb5353a4 100644
+--- a/drivers/net/ethernet/natsemi/sonic.h
++++ b/drivers/net/ethernet/natsemi/sonic.h
+@@ -273,8 +273,9 @@
+ #define SONIC_NUM_RDS SONIC_NUM_RRS /* number of receive descriptors */
+ #define SONIC_NUM_TDS 16 /* number of transmit descriptors */
+
+-#define SONIC_RDS_MASK (SONIC_NUM_RDS-1)
+-#define SONIC_TDS_MASK (SONIC_NUM_TDS-1)
++#define SONIC_RRS_MASK (SONIC_NUM_RRS - 1)
++#define SONIC_RDS_MASK (SONIC_NUM_RDS - 1)
++#define SONIC_TDS_MASK (SONIC_NUM_TDS - 1)
+
+ #define SONIC_RBSIZE 1520 /* size of one resource buffer */
+
+--
+2.20.1
+
--- /dev/null
+From bafdefeec12b6553915f443afcd84d7f82cc8450 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 09:07:26 +1100
+Subject: net/sonic: Quiesce SONIC before re-initializing descriptor memory
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit 3f4b7e6a2be982fd8820a2b54d46dd9c351db899 ]
+
+Make sure the SONIC's DMA engine is idle before altering the transmit
+and receive descriptors. Add a helper for this as it will be needed
+again.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.c | 25 +++++++++++++++++++++++++
+ drivers/net/ethernet/natsemi/sonic.h | 3 +++
+ 2 files changed, 28 insertions(+)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
+index b6599aa22504f..254e6dbc4c6aa 100644
+--- a/drivers/net/ethernet/natsemi/sonic.c
++++ b/drivers/net/ethernet/natsemi/sonic.c
+@@ -103,6 +103,24 @@ static int sonic_open(struct net_device *dev)
+ return 0;
+ }
+
++/* Wait for the SONIC to become idle. */
++static void sonic_quiesce(struct net_device *dev, u16 mask)
++{
++ struct sonic_local * __maybe_unused lp = netdev_priv(dev);
++ int i;
++ u16 bits;
++
++ for (i = 0; i < 1000; ++i) {
++ bits = SONIC_READ(SONIC_CMD) & mask;
++ if (!bits)
++ return;
++ if (irqs_disabled() || in_interrupt())
++ udelay(20);
++ else
++ usleep_range(100, 200);
++ }
++ WARN_ONCE(1, "command deadline expired! 0x%04x\n", bits);
++}
+
+ /*
+ * Close the SONIC device
+@@ -120,6 +138,9 @@ static int sonic_close(struct net_device *dev)
+ /*
+ * stop the SONIC, disable interrupts
+ */
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
++ sonic_quiesce(dev, SONIC_CR_ALL);
++
+ SONIC_WRITE(SONIC_IMR, 0);
+ SONIC_WRITE(SONIC_ISR, 0x7fff);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+@@ -159,6 +180,9 @@ static void sonic_tx_timeout(struct net_device *dev)
+ * put the Sonic into software-reset mode and
+ * disable all interrupts before releasing DMA buffers
+ */
++ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
++ sonic_quiesce(dev, SONIC_CR_ALL);
++
+ SONIC_WRITE(SONIC_IMR, 0);
+ SONIC_WRITE(SONIC_ISR, 0x7fff);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RST);
+@@ -638,6 +662,7 @@ static int sonic_init(struct net_device *dev)
+ */
+ SONIC_WRITE(SONIC_CMD, 0);
+ SONIC_WRITE(SONIC_CMD, SONIC_CR_RXDIS);
++ sonic_quiesce(dev, SONIC_CR_ALL);
+
+ /*
+ * initialize the receive resource area
+diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h
+index d9f8ceb5353a4..7dcf913d7395a 100644
+--- a/drivers/net/ethernet/natsemi/sonic.h
++++ b/drivers/net/ethernet/natsemi/sonic.h
+@@ -109,6 +109,9 @@
+ #define SONIC_CR_TXP 0x0002
+ #define SONIC_CR_HTX 0x0001
+
++#define SONIC_CR_ALL (SONIC_CR_LCAM | SONIC_CR_RRRA | \
++ SONIC_CR_RXEN | SONIC_CR_TXP)
++
+ /*
+ * SONIC data configuration bits
+ */
+--
+2.20.1
+
--- /dev/null
+From f27e7ab665889113849bc377f5014a875e30a7b3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 09:07:26 +1100
+Subject: net/sonic: Use MMIO accessors
+
+From: Finn Thain <fthain@telegraphics.com.au>
+
+[ Upstream commit e3885f576196ddfc670b3d53e745de96ffcb49ab ]
+
+The driver accesses descriptor memory which is simultaneously accessed by
+the chip, so the compiler must not be allowed to re-order CPU accesses.
+sonic_buf_get() used 'volatile' to prevent that. sonic_buf_put() should
+have done so too but was overlooked.
+
+Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update")
+Tested-by: Stan Johnson <userm57@yahoo.com>
+Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/natsemi/sonic.h | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/net/ethernet/natsemi/sonic.h b/drivers/net/ethernet/natsemi/sonic.h
+index 1fd61d7f79bcb..a009a99c0e544 100644
+--- a/drivers/net/ethernet/natsemi/sonic.h
++++ b/drivers/net/ethernet/natsemi/sonic.h
+@@ -342,30 +342,30 @@ static void sonic_tx_timeout(struct net_device *dev);
+ as far as we can tell. */
+ /* OpenBSD calls this "SWO". I'd like to think that sonic_buf_put()
+ is a much better name. */
+-static inline void sonic_buf_put(void* base, int bitmode,
++static inline void sonic_buf_put(u16 *base, int bitmode,
+ int offset, __u16 val)
+ {
+ if (bitmode)
+ #ifdef __BIG_ENDIAN
+- ((__u16 *) base + (offset*2))[1] = val;
++ __raw_writew(val, base + (offset * 2) + 1);
+ #else
+- ((__u16 *) base + (offset*2))[0] = val;
++ __raw_writew(val, base + (offset * 2) + 0);
+ #endif
+ else
+- ((__u16 *) base)[offset] = val;
++ __raw_writew(val, base + (offset * 1) + 0);
+ }
+
+-static inline __u16 sonic_buf_get(void* base, int bitmode,
++static inline __u16 sonic_buf_get(u16 *base, int bitmode,
+ int offset)
+ {
+ if (bitmode)
+ #ifdef __BIG_ENDIAN
+- return ((volatile __u16 *) base + (offset*2))[1];
++ return __raw_readw(base + (offset * 2) + 1);
+ #else
+- return ((volatile __u16 *) base + (offset*2))[0];
++ return __raw_readw(base + (offset * 2) + 0);
+ #endif
+ else
+- return ((volatile __u16 *) base)[offset];
++ return __raw_readw(base + (offset * 1) + 0);
+ }
+
+ /* Inlines that you should actually use for reading/writing DMA buffers */
+--
+2.20.1
+
--- /dev/null
+From 18f77bb8ad60c8377f873ecb394e743bbe103069 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 15:20:28 +0200
+Subject: powerpc/fsl/dts: add fsl,erratum-a011043
+
+From: Madalin Bucur <madalin.bucur@oss.nxp.com>
+
+[ Upstream commit 73d527aef68f7644e59f22ce7f9ac75e7b533aea ]
+
+Add fsl,erratum-a011043 to internal MDIO buses.
+Software may get false read error when reading internal
+PCS registers through MDIO. As a workaround, all internal
+MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
+
+Signed-off-by: Madalin Bucur <madalin.bucur@oss.nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 +
+ arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 +
+ 18 files changed, 18 insertions(+)
+
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+index e1a961f05dcd5..baa0c503e741b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+index c288f3c6c6378..93095600e8086 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy6: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+index 94f3e71750124..ff4bd38f06459 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi
+@@ -63,6 +63,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+index 94a76982d214b..1fa38ed6f59e2 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy7: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+index b5ff5f71c6b8b..a8cc9780c0c42 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy0: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+index ee44182c63485..8b8bd70c93823 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy1: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+index f05f0d775039b..619c880b54d8d 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy2: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+index a9114ec510759..d7ebb73a400d0 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy3: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+index 44dd00ac7367f..b151d696a0699 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy4: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+index 5b1b84b58602f..adc0ae0013a3c 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@400000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy5: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+index 0e1daaef9e74b..435047e0e250e 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy14: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+index 68c5ef779266a..c098657cca0a7 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi
+@@ -60,6 +60,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xf3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy15: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+index 605363cc1117f..9d06824815f34 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe1000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy8: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+index 1955dfa136348..70e947730c4ba 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe3000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy9: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+index 2c1476454ee01..ad96e65295959 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe5000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy10: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+index b8b541ff5fb03..034bc4b71f7a5 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe7000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy11: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+index 4b2cfddd1b155..93ca23d82b39b 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xe9000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy12: ethernet-phy@0 {
+ reg = <0x0>;
+diff --git a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+index 0a52ddf7cc171..23b3117a2fd2a 100644
+--- a/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
++++ b/arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi
+@@ -59,6 +59,7 @@ fman@500000 {
+ #size-cells = <0>;
+ compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio";
+ reg = <0xeb000 0x1000>;
++ fsl,erratum-a011043; /* must ignore read errors */
+
+ pcsphy13: ethernet-phy@0 {
+ reg = <0x0>;
+--
+2.20.1
+
--- /dev/null
+From fe8e30cb419d266d10a14c397cef63a61b6cc718 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 01:43:38 -0800
+Subject: qlcnic: Fix CPU soft lockup while collecting firmware dump
+
+From: Manish Chopra <manishc@marvell.com>
+
+[ Upstream commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 ]
+
+Driver while collecting firmware dump takes longer time to
+collect/process some of the firmware dump entries/memories.
+Bigger capture masks makes it worse as it results in larger
+amount of data being collected and results in CPU soft lockup.
+Place cond_resched() in some of the driver flows that are
+expectedly time consuming to relinquish the CPU to avoid CPU
+soft lockup panic.
+
+Signed-off-by: Shahed Shaikh <shshaikh@marvell.com>
+Tested-by: Yonggen Xu <Yonggen.Xu@dell.com>
+Signed-off-by: Manish Chopra <manishc@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 +
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 ++
+ 2 files changed, 3 insertions(+)
+
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+index a496390b8632f..07f9067affc65 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,
+ break;
+ }
+ entry += p_hdr->size;
++ cond_resched();
+ }
+ p_dev->ahw->reset.seq_index = index;
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+index 0844b7c757670..5174e0bd75d1e 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter,
+ addr += 16;
+ reg_read -= 16;
+ ret += 16;
++ cond_resched();
+ }
+ out:
+ mutex_unlock(&adapter->ahw->mem_lock);
+@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter)
+ buf_offset += entry->hdr.cap_size;
+ entry_offset += entry->hdr.offset;
+ buffer = fw_dump->data + buf_offset;
++ cond_resched();
+ }
+
+ fw_dump->clr = 1;
+--
+2.20.1
+
--- /dev/null
+From 6c94c045453a1df92f923db8915149c9869768c8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 22 Jan 2020 16:02:07 +0800
+Subject: r8152: get default setting of WOL before initializing
+
+From: Hayes Wang <hayeswang@realtek.com>
+
+[ Upstream commit 9583a3638dc07cc1878f41265e85ed497f72efcb ]
+
+Initailization would reset runtime suspend by tp->saved_wolopts, so
+the tp->saved_wolopts should be set before initializing.
+
+Signed-off-by: Hayes Wang <hayeswang@realtek.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/usb/r8152.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
+index 3c037b76a0cc8..ba7cfc0895165 100644
+--- a/drivers/net/usb/r8152.c
++++ b/drivers/net/usb/r8152.c
+@@ -4441,6 +4441,11 @@ static int rtl8152_probe(struct usb_interface *intf,
+
+ intf->needs_remote_wakeup = 1;
+
++ if (!rtl_can_wakeup(tp))
++ __rtl_set_wol(tp, 0);
++ else
++ tp->saved_wolopts = __rtl_get_wol(tp);
++
+ tp->rtl_ops.init(tp);
+ queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0);
+ set_ethernet_addr(tp);
+@@ -4454,10 +4459,6 @@ static int rtl8152_probe(struct usb_interface *intf,
+ goto out1;
+ }
+
+- if (!rtl_can_wakeup(tp))
+- __rtl_set_wol(tp, 0);
+-
+- tp->saved_wolopts = __rtl_get_wol(tp);
+ if (tp->saved_wolopts)
+ device_set_wakeup_enable(&udev->dev, true);
+ else
+--
+2.20.1
+
--- /dev/null
+From fceb6439a90b2f32bc98e6e720382e520f2003bf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 16 Jan 2020 11:20:53 +0100
+Subject: scsi: fnic: do not queue commands during fwreset
+
+From: Hannes Reinecke <hare@suse.de>
+
+[ Upstream commit 0e2209629fec427ba75a6351486153a9feddd36b ]
+
+When a link is going down the driver will be calling fnic_cleanup_io(),
+which will traverse all commands and calling 'done' for each found command.
+While the traversal is handled under the host_lock, calling 'done' happens
+after the host_lock is being dropped.
+
+As fnic_queuecommand_lck() is being called with the host_lock held, it
+might well be that it will pick the command being selected for abortion
+from the above routine and enqueue it for sending, but then 'done' is being
+called on that very command from the above routine.
+
+Which of course confuses the hell out of the scsi midlayer.
+
+So fix this by not queueing commands when fnic_cleanup_io is active.
+
+Link: https://lore.kernel.org/r/20200116102053.62755-1-hare@suse.de
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/fnic/fnic_scsi.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
+index c056b8111ad27..7bf6102b4c3d5 100644
+--- a/drivers/scsi/fnic/fnic_scsi.c
++++ b/drivers/scsi/fnic/fnic_scsi.c
+@@ -445,6 +445,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_
+ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_IO_BLOCKED)))
+ return SCSI_MLQUEUE_HOST_BUSY;
+
++ if (unlikely(fnic_chk_state_flags_locked(fnic, FNIC_FLAGS_FWRESET)))
++ return SCSI_MLQUEUE_HOST_BUSY;
++
+ rport = starget_to_rport(scsi_target(sc->device));
+ ret = fc_remote_port_chkready(rport);
+ if (ret) {
+--
+2.20.1
+
--- /dev/null
+From 4853979b326023d13ea69f87a1aa2db62025ea3c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Jan 2020 10:11:08 +0300
+Subject: seq_tab_next() should increase position index
+
+From: Vasily Averin <vvs@virtuozzo.com>
+
+[ Upstream commit 70a87287c821e9721b62463777f55ba588ac4623 ]
+
+if seq_file .next fuction does not change position index,
+read after some lseek can generate unexpected output.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=206283
+Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+index 61c55621b9589..c150521647172 100644
+--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c
+@@ -66,8 +66,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos)
+ static void *seq_tab_next(struct seq_file *seq, void *v, loff_t *pos)
+ {
+ v = seq_tab_get_idx(seq->private, *pos + 1);
+- if (v)
+- ++*pos;
++ ++(*pos);
+ return v;
+ }
+
+--
+2.20.1
+
bluetooth-fix-race-condition-in-hci_release_sock.patch
usb-dwc3-turn-off-vbus-when-leaving-host-mode.patch
media-si470x-i2c-move-free-past-last-use-of-radio.patch
+arm-dts-beagle-x15-common-model-5v0-regulator.patch
+soc-ti-wkup_m3_ipc-fix-race-condition-with-rproc_boo.patch
+mac80211-mesh-restrict-airtime-metric-to-peered-esta.patch
+clk-mmp2-fix-the-order-of-timer-mux-parents.patch
+ixgbevf-remove-limit-of-10-entries-for-unicast-filte.patch
+ixgbe-fix-calculation-of-queue-with-vfs-and-flow-dir.patch
+wireless-fix-enabling-channel-12-for-custom-regulato.patch
+mac80211-fix-tkip-replay-protection-immediately-afte.patch
+wireless-wext-avoid-gcc-o3-warning.patch
+input-aiptek-use-descriptors-of-current-altsetting.patch
+vti-6-fix-packet-tx-through-bpf_redirect.patch
+scsi-fnic-do-not-queue-commands-during-fwreset.patch
+arm-8955-1-virt-relax-arch-timer-version-check-durin.patch
+airo-fix-possible-info-leak-in-airooldioctl-siocdevp.patch
+airo-add-missing-cap_net_admin-check-in-airooldioctl.patch
+r8152-get-default-setting-of-wol-before-initializing.patch
+qlcnic-fix-cpu-soft-lockup-while-collecting-firmware.patch
+powerpc-fsl-dts-add-fsl-erratum-a011043.patch
+net-fsl-treat-fsl-erratum-a011043.patch
+net-fsl-fman-rename-if_mode_xgmii-to-if_mode_10g.patch
+net-sonic-add-mutual-exclusion-for-accessing-shared-.patch
+net-sonic-use-mmio-accessors.patch
+net-sonic-fix-receive-buffer-handling.patch
+net-sonic-quiesce-sonic-before-re-initializing-descr.patch
+seq_tab_next-should-increase-position-index.patch
+l2t_seq_next-should-increase-position-index.patch
+net-fix-skb-csum-update-in-inet_proto_csum_replace16.patch
--- /dev/null
+From 75eafdd4045404574035327b7b953ca27367d632 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 22:03:14 -0600
+Subject: soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
+
+From: Dave Gerlach <d-gerlach@ti.com>
+
+[ Upstream commit 03729cfa0d543bc996bf959e762ec999afc8f3d2 ]
+
+Any user of wkup_m3_ipc calls wkup_m3_ipc_get to get a handle and this
+checks the value of the static variable m3_ipc_state to see if the
+wkup_m3 is ready. Currently this is populated during probe before
+rproc_boot has been called, meaning there is a window of time that
+wkup_m3_ipc_get can return a valid handle but the wkup_m3 itself is not
+ready, leading to invalid IPC calls to the wkup_m3 and system
+instability.
+
+To avoid this, move the population of the m3_ipc_state variable until
+after rproc_boot has succeeded to guarantee a valid and usable handle
+is always returned.
+
+Reported-by: Suman Anna <s-anna@ti.com>
+Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
+Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/ti/wkup_m3_ipc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c
+index 5bb376009d98b..fc33bfdc957cc 100644
+--- a/drivers/soc/ti/wkup_m3_ipc.c
++++ b/drivers/soc/ti/wkup_m3_ipc.c
+@@ -377,6 +377,8 @@ static void wkup_m3_rproc_boot_thread(struct wkup_m3_ipc *m3_ipc)
+ ret = rproc_boot(m3_ipc->rproc);
+ if (ret)
+ dev_err(dev, "rproc_boot failed\n");
++ else
++ m3_ipc_state = m3_ipc;
+
+ do_exit(0);
+ }
+@@ -463,8 +465,6 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev)
+ goto err_put_rproc;
+ }
+
+- m3_ipc_state = m3_ipc;
+-
+ return 0;
+
+ err_put_rproc:
+--
+2.20.1
+
--- /dev/null
+From e89b3412e2a81831271c2d8c591517f757193ec9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Jan 2020 09:32:46 +0100
+Subject: vti[6]: fix packet tx through bpf_redirect()
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+[ Upstream commit 95224166a9032ff5d08fca633d37113078ce7d01 ]
+
+With an ebpf program that redirects packets through a vti[6] interface,
+the packets are dropped because no dst is attached.
+
+This could also be reproduced with an AF_PACKET socket, with the following
+python script (vti1 is an ip_vti interface):
+
+ import socket
+ send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
+ # scapy
+ # p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
+ # raw(p)
+ req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
+ send_s.sendto(req, ('vti1', 0x800, 0, 0))
+
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv4/ip_vti.c | 13 +++++++++++--
+ net/ipv6/ip6_vti.c | 13 +++++++++++--
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 4e39c935e057e..ec417156f388e 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -208,8 +208,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,
+ int mtu;
+
+ if (!dst) {
+- dev->stats.tx_carrier_errors++;
+- goto tx_error_icmp;
++ struct rtable *rt;
++
++ fl->u.ip4.flowi4_oif = dev->ifindex;
++ fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
++ rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4);
++ if (IS_ERR(rt)) {
++ dev->stats.tx_carrier_errors++;
++ goto tx_error_icmp;
++ }
++ dst = &rt->dst;
++ skb_dst_set(skb, dst);
+ }
+
+ dst_hold(dst);
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index c2b2ee71fc6c3..a266fac084261 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -453,8 +453,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ int err = -1;
+ int mtu;
+
+- if (!dst)
+- goto tx_err_link_failure;
++ if (!dst) {
++ fl->u.ip6.flowi6_oif = dev->ifindex;
++ fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC;
++ dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6);
++ if (dst->error) {
++ dst_release(dst);
++ dst = NULL;
++ goto tx_err_link_failure;
++ }
++ skb_dst_set(skb, dst);
++ }
+
+ dst_hold(dst);
+ dst = xfrm_lookup(t->net, dst, fl, NULL, 0);
+--
+2.20.1
+
--- /dev/null
+From 0c921ec09f26d68498890eb5b51b4591d9050d12 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 20 Dec 2019 10:14:32 +0000
+Subject: wireless: fix enabling channel 12 for custom regulatory domain
+
+From: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+
+[ Upstream commit c4b9d655e445a8be0bff624aedea190606b5ebbc ]
+
+Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by
+default when checking usable channels"") fixed a broken
+regulatory (leaving channel 12 open for AP where not permitted).
+Apply a similar fix to custom regulatory domain processing.
+
+Signed-off-by: Cathy Luo <xiaohua.luo@nxp.com>
+Signed-off-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
+Link: https://lore.kernel.org/r/1576836859-8945-1-git-send-email-ganapathi.bhat@nxp.com
+[reword commit message, fix coding style, add a comment]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/reg.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index dde741f298de7..0e66768427ba7 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -1715,14 +1715,15 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
+
+ static void handle_channel_custom(struct wiphy *wiphy,
+ struct ieee80211_channel *chan,
+- const struct ieee80211_regdomain *regd)
++ const struct ieee80211_regdomain *regd,
++ u32 min_bw)
+ {
+ u32 bw_flags = 0;
+ const struct ieee80211_reg_rule *reg_rule = NULL;
+ const struct ieee80211_power_rule *power_rule = NULL;
+ u32 bw;
+
+- for (bw = MHZ_TO_KHZ(20); bw >= MHZ_TO_KHZ(5); bw = bw / 2) {
++ for (bw = MHZ_TO_KHZ(20); bw >= min_bw; bw = bw / 2) {
+ reg_rule = freq_reg_info_regd(MHZ_TO_KHZ(chan->center_freq),
+ regd, bw);
+ if (!IS_ERR(reg_rule))
+@@ -1778,8 +1779,14 @@ static void handle_band_custom(struct wiphy *wiphy,
+ if (!sband)
+ return;
+
++ /*
++ * We currently assume that you always want at least 20 MHz,
++ * otherwise channel 12 might get enabled if this rule is
++ * compatible to US, which permits 2402 - 2472 MHz.
++ */
+ for (i = 0; i < sband->n_channels; i++)
+- handle_channel_custom(wiphy, &sband->channels[i], regd);
++ handle_channel_custom(wiphy, &sband->channels[i], regd,
++ MHZ_TO_KHZ(20));
+ }
+
+ /* Used by drivers prior to wiphy registration */
+--
+2.20.1
+
--- /dev/null
+From b1a170ef3cbba55fd5e07a60dae77aab5b945b73 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Jan 2020 21:07:35 +0100
+Subject: wireless: wext: avoid gcc -O3 warning
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit e16119655c9e6c4aa5767cd971baa9c491f41b13 ]
+
+After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3,
+the wext code produces a bogus warning:
+
+In function 'iw_handler_get_iwstats',
+ inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9,
+ inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10,
+ inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8,
+ inlined from 'wext_handle_ioctl':
+net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull]
+ memcpy(extra, stats, sizeof(struct iw_statistics));
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+In file included from arch/x86/include/asm/string.h:5,
+net/wireless/wext-core.c: In function 'wext_handle_ioctl':
+arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here
+
+The problem is that ioctl_standard_call() sometimes calls the handler
+with a NULL argument that would cause a problem for iw_handler_get_iwstats.
+However, iw_handler_get_iwstats never actually gets called that way.
+
+Marking that function as noinline avoids the warning and leads
+to slightly smaller object code as well.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20200107200741.3588770-1-arnd@arndb.de
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/wext-core.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
+index 6250b1cfcde58..4bf0296a7c433 100644
+--- a/net/wireless/wext-core.c
++++ b/net/wireless/wext-core.c
+@@ -659,7 +659,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)
+ return NULL;
+ }
+
+-static int iw_handler_get_iwstats(struct net_device * dev,
++/* noinline to avoid a bogus warning with -O3 */
++static noinline int iw_handler_get_iwstats(struct net_device * dev,
+ struct iw_request_info * info,
+ union iwreq_data * wrqu,
+ char * extra)
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
